@jc_stack/ez-agents 0.1.0-beta.36 → 0.1.0-beta.38

package/test/executor.test.ts

@@ -6,7 +6,7 @@ import { mkdtemp, mkdir, rm, writeFile, readFile } from 'node:fs/promises'
 import { spawn } from 'node:child_process'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
-import { EXECUTOR_REGISTRY, antigravityInvocation, executorEnvironment, grokInvocation, grokJobEnv, opencodeInvocation, resolveExecutor, resolveHostCommand, startExecutorJob, terminateJob, validateCodexProvider } from '../src/executor.js'
+import { EXECUTOR_REGISTRY, executorEnvironment, grokInvocation, grokJobEnv, opencodeDataHome, opencodeInvocation, piAgentDir, resolveExecutor, resolveHostCommand, startExecutorJob, terminateJob, validateCodexProvider } from '../src/executor.js'
 import { requireOwnerExecution } from '../src/execution-authority.js'
 import { splitTelegramText } from '../src/reply.js'
 import { matchingProcessIds, processSnapshot } from '../src/process-tree.js'
@@ -97,14 +97,6 @@ test('the Grok invocation is headless, workspace-scoped, and token-free', () =>
   assert.equal(invocation.args.includes('TELEGRAM_BOT_TOKEN'), false)
 })
 
-test('the antigravity invocation is headless, skips permissions, and uses print mode', () => {
-  const invocation = antigravityInvocation('test prompt')
-  assert.equal(invocation.command, 'agy')
-  assert.deepEqual(invocation.args, [
-    '--dangerously-skip-permissions', '--print=test prompt',
-  ])
-})
-
 test('the opencode invocation is headless, auto-approves, and sets model and workspace', () => {
   const invocation = opencodeInvocation('test prompt', { workspace: '/tmp/test-ws' })
   assert.equal(invocation.command, 'opencode')
@@ -119,15 +111,15 @@ test('the opencode invocation is headless, auto-approves, and sets model and wor
 })
 
 test('resolveExecutor correctly maps keys and aliases', () => {
-  assert.equal(resolveExecutor('agy').command, 'agy')
-  assert.equal(resolveExecutor('antigravity').command, 'agy')
   assert.equal(resolveExecutor('claude').command, 'claude')
   assert.equal(resolveExecutor('grok').command, 'grok')
   assert.equal(resolveExecutor('opencode').command, 'opencode')
   assert.equal(resolveExecutor('oc').command, 'opencode')
+  for (const cli of ['unreal-agent', 'antigravity', 'agy'])
+    assert.throws(() => resolveExecutor(cli), /Unsupported executor CLI/)
   assert.equal(resolveExecutor('codex-gui').name, 'codex-gui')
   assert.notEqual(resolveExecutor('codex-gui').name, resolveExecutor('codex').name)
-  assert.equal(resolveExecutor(undefined).command, 'agy')
+  assert.equal(resolveExecutor(undefined).command, 'codex')
   assert.throws(() => resolveExecutor('claude-spark'), /Unsupported executor CLI "claude-spark"/)
   assert.throws(() => resolveExecutor('spark'), /Unsupported executor CLI "spark"/)
   assert.throws(() => resolveExecutor('nonexistent'), /Unsupported executor CLI "nonexistent"/)
@@ -177,6 +169,114 @@ test('Codex custom providers use declared runtime state and an environment key r
   assert.throws(()=>validateCodexProvider({...provider,models:[]}),/provider models/)
 })
 
+test('opencode jobs use the agent-bound data home only when its auth binding exists', async t => {
+  const root=await mkdtemp(path.join(tmpdir(),'ez-opencode-auth-'));t.after(()=>rm(root,{recursive:true,force:true}))
+  const bin=path.join(root,'bin');await mkdir(bin)
+  await writeFile(path.join(bin,'opencode'),`#!${process.execPath}\nconst fs=require('fs');fs.writeFileSync(${JSON.stringify(path.join(root,'observed.json'))},JSON.stringify({args:process.argv.slice(2),xdg:process.env.XDG_DATA_HOME,telegram:process.env.TELEGRAM_BOT_TOKEN}));`,{mode:0o755})
+  assert.equal(opencodeDataHome(root),undefined)
+  await mkdir(path.join(root,'cli','opencode'),{recursive:true})
+  assert.equal(opencodeDataHome(root),undefined)
+  await writeFile(path.join(root,'cli','opencode','auth.json'),'{}',{mode:0o600})
+  assert.equal(opencodeDataHome(root),path.join(root,'cli'))
+  const prior={path:process.env.PATH,telegram:process.env.TELEGRAM_BOT_TOKEN,transport:process.env.EZ_EXECUTOR_TRANSPORT}
+  const launch=async(runId:string)=>{
+    await ownerRun(root,runId)
+    process.env.PATH=bin+path.delimiter+prior.path;process.env.TELEGRAM_BOT_TOKEN='relay-secret';delete process.env.EZ_EXECUTOR_TRANSPORT
+    const job=await startExecutorJob(['hello'],{workspace:root,controlDir:root,binDir:bin,runId,timeoutMs:0,cli:'opencode',model:'opencode-go/muse-spark-1.3-contributor',effort:'xhigh'})
+    assert.equal(await new Promise(resolve=>job.child.once('close',resolve)),0);await job.cleanup()
+    return JSON.parse(await readFile(path.join(root,'observed.json'),'utf8'))
+  }
+  try {
+    const bound=await launch('r_ocbound')
+    assert.equal(bound.xdg,path.join(root,'cli'))
+    assert.equal(bound.telegram,undefined)
+    assert.equal(bound.args[bound.args.indexOf('-m')+1],'opencode-go/muse-spark-1.3-contributor')
+    assert.equal(bound.args[bound.args.indexOf('--variant')+1],'xhigh')
+    await rm(path.join(root,'cli','opencode','auth.json'))
+    const free=await launch('r_ocfree')
+    assert.equal(free.xdg,undefined)
+    assert.equal(free.telegram,undefined)
+  } finally {
+    if(prior.path===undefined)delete process.env.PATH;else process.env.PATH=prior.path
+    if(prior.telegram===undefined)delete process.env.TELEGRAM_BOT_TOKEN;else process.env.TELEGRAM_BOT_TOKEN=prior.telegram
+    if(prior.transport===undefined)delete process.env.EZ_EXECUTOR_TRANSPORT;else process.env.EZ_EXECUTOR_TRANSPORT=prior.transport
+  }
+})
+
+test('pi jobs use the agent-bound config dir only when its auth binding exists', async t => {
+  const root=await mkdtemp(path.join(tmpdir(),'ez-pi-auth-'));t.after(()=>rm(root,{recursive:true,force:true}))
+  const bin=path.join(root,'bin');await mkdir(bin)
+  await writeFile(path.join(bin,'pi'),`#!${process.execPath}\nconst fs=require('fs');fs.writeFileSync(${JSON.stringify(path.join(root,'observed.json'))},JSON.stringify({args:process.argv.slice(2),agentDir:process.env.PI_CODING_AGENT_DIR,telegram:process.env.TELEGRAM_BOT_TOKEN}));`,{mode:0o755})
+  assert.equal(piAgentDir(root),undefined)
+  await mkdir(path.join(root,'cli','pi','agent'),{recursive:true})
+  assert.equal(piAgentDir(root),undefined)
+  await writeFile(path.join(root,'cli','pi','agent','auth.json'),'{}',{mode:0o600})
+  assert.equal(piAgentDir(root),path.join(root,'cli','pi','agent'))
+  const prior={path:process.env.PATH,telegram:process.env.TELEGRAM_BOT_TOKEN,transport:process.env.EZ_EXECUTOR_TRANSPORT,agentDir:process.env.PI_CODING_AGENT_DIR}
+  const launch=async(runId:string)=>{
+    await ownerRun(root,runId)
+    process.env.PATH=bin+path.delimiter+prior.path;process.env.TELEGRAM_BOT_TOKEN='relay-secret';delete process.env.EZ_EXECUTOR_TRANSPORT;delete process.env.PI_CODING_AGENT_DIR
+    const job=await startExecutorJob(['hello'],{workspace:root,controlDir:root,binDir:bin,runId,timeoutMs:0,cli:'pi',model:'opencode-go/muse-spark-1.3-contributor',effort:'xhigh'})
+    assert.equal(await new Promise(resolve=>job.child.once('close',resolve)),0);await job.cleanup()
+    return JSON.parse(await readFile(path.join(root,'observed.json'),'utf8'))
+  }
+  try {
+    const bound=await launch('r_pibound')
+    assert.equal(bound.agentDir,path.join(root,'cli','pi','agent'))
+    assert.equal(bound.telegram,undefined)
+    assert.equal(bound.args[bound.args.indexOf('--model')+1],'opencode-go/muse-spark-1.3-contributor')
+    assert.equal(bound.args[bound.args.indexOf('--thinking')+1],'xhigh')
+    await rm(path.join(root,'cli','pi','agent','auth.json'))
+    const free=await launch('r_pifree')
+    assert.equal(free.agentDir,undefined)
+    assert.equal(free.telegram,undefined)
+    // Owner-provisioned delivery skill loads by path; absence keeps prior args.
+    assert.ok(!bound.args.includes('--skill'))
+    await mkdir(path.join(root,'cli','pi','skills','ez-delivery'),{recursive:true})
+    await writeFile(path.join(root,'cli','pi','skills','ez-delivery','SKILL.md'),'# delivery',{mode:0o644})
+    const skilled=await launch('r_piskilled')
+    assert.equal(skilled.args[skilled.args.indexOf('--skill')+1],path.join(root,'cli','pi','skills','ez-delivery'))
+  } finally {
+    if(prior.path===undefined)delete process.env.PATH;else process.env.PATH=prior.path
+    if(prior.telegram===undefined)delete process.env.TELEGRAM_BOT_TOKEN;else process.env.TELEGRAM_BOT_TOKEN=prior.telegram
+    if(prior.transport===undefined)delete process.env.EZ_EXECUTOR_TRANSPORT;else process.env.EZ_EXECUTOR_TRANSPORT=prior.transport
+    if(prior.agentDir===undefined)delete process.env.PI_CODING_AGENT_DIR;else process.env.PI_CODING_AGENT_DIR=prior.agentDir
+  }
+})
+
+test('the pi invocation pins control sessions, model, and thinking level', () => {
+  assert.equal(resolveExecutor('pi').command, 'pi')
+  const args = EXECUTOR_REGISTRY.pi.buildArgs(
+    { workspace: '/agent/mind', controlDir: '/agent/control', sessionId: 'ez-session', isResume: true, model: 'opencode-go/muse-spark-1.3-contributor', effort: 'xhigh' },
+    '/prompt', 'review CAMT')
+  assert.deepEqual(args, ['-p', '--mode', 'json', '--session-dir', '/agent/control/cli/pi/sessions', '--session-id', 'ez-session',
+    '--model', 'opencode-go/muse-spark-1.3-contributor', '--thinking', 'xhigh', '--', 'review CAMT'])
+  const other = EXECUTOR_REGISTRY.pi.buildArgs({ workspace: '/agent/mind', controlDir: '/agent/control', sessionId: 'other-session', isResume: true }, '/prompt', 'other')
+  assert.equal(other[other.indexOf('--session-id') + 1], 'other-session')
+  assert.ok(!other.includes('--continue'))
+  assert.throws(() => EXECUTOR_REGISTRY.pi.buildArgs({ workspace: '/agent' }, '/prompt', 'hi'), /bound control directory/)
+})
+
+test('pi jobs run with control-bound sessions and no secret leakage', async t => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-pi-auth-')); t.after(() => rm(root, { recursive: true, force: true }))
+  const bin = path.join(root, 'bin'); await mkdir(bin)
+  await writeFile(path.join(bin, 'pi'), `#!${process.execPath}\nconst fs=require('fs');fs.writeFileSync(${JSON.stringify(path.join(root, 'observed.json'))},JSON.stringify({args:process.argv.slice(2),telegram:process.env.TELEGRAM_BOT_TOKEN}));`, { mode: 0o755 })
+  const prior = { path: process.env.PATH, telegram: process.env.TELEGRAM_BOT_TOKEN, transport: process.env.EZ_EXECUTOR_TRANSPORT }
+  try {
+    await ownerRun(root, 'r_pibound')
+    process.env.PATH = bin + path.delimiter + prior.path; process.env.TELEGRAM_BOT_TOKEN = 'relay-secret'; delete process.env.EZ_EXECUTOR_TRANSPORT
+    const job = await startExecutorJob(['review CAMT'], { workspace: root, controlDir: root, binDir: bin, runId: 'r_pibound', timeoutMs: 0, cli: 'pi', model: 'opencode-go/muse-spark-1.3-contributor', effort: 'xhigh' })
+    assert.equal(await new Promise(resolve => job.child.once('close', resolve)), 0); await job.cleanup()
+    const observed = JSON.parse(await readFile(path.join(root, 'observed.json'), 'utf8'))
+    assert.deepEqual(observed.args, ['-p', '--mode', 'json', '--session-dir', path.join(root, 'cli', 'pi', 'sessions'),
+      '--model', 'opencode-go/muse-spark-1.3-contributor', '--thinking', 'xhigh', '--', 'review CAMT'])
+    assert.equal(observed.telegram, undefined)
+  } finally {
+    if (prior.path === undefined) delete process.env.PATH; else process.env.PATH = prior.path
+    if (prior.telegram === undefined) delete process.env.TELEGRAM_BOT_TOKEN; else process.env.TELEGRAM_BOT_TOKEN = prior.telegram
+    if (prior.transport === undefined) delete process.env.EZ_EXECUTOR_TRANSPORT; else process.env.EZ_EXECUTOR_TRANSPORT = prior.transport
+  }
+})
 test('a configured Codex provider receives only its declared key and runtime selection', async t => {
   const root=await mkdtemp(path.join(tmpdir(),'ez-codex-provider-'));t.after(()=>rm(root,{recursive:true,force:true}))
   const bin=path.join(root,'bin');await mkdir(bin)

package/test/host-executor.test.ts

@@ -4,7 +4,7 @@ import test from 'node:test'
 import { mkdtemp, mkdir, readFile, writeFile, rm, realpath, symlink } from 'node:fs/promises'
 import path from 'node:path'
 import { tmpdir } from 'node:os'
-import { serveHostExecutor } from '../src/host-executor.js'
+import { serveHostExecutor, refreshAgentCatalog } from '../src/host-executor.js'
 import { spawn } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
 import { isHostRunId } from '../src/host-executor-protocol.js'
@@ -21,8 +21,8 @@ test('host restart replaces a lock whose PID was reused by another process',asyn
   try {
     await mkdir(workspace);await mkdir(directory,{recursive:true})
     await writeFile(path.join(directory,'worker.lock'),JSON.stringify({pid:process.pid,started:'reused-pid'}))
-    server=serveHostExecutor({cli:'grok',agents:[{name:'test',workspace,controlDir,binDir:root}]},abort.signal)
-    for(let n=0;n<100;n++){try{await readFile(path.join(directory,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
+    server=serveHostExecutor({cli:'grok',agents:[{name:'test',workspace,controlDir,binDir:root}]},abort.signal,undefined,async()=>[])
+    for(let n=0;n<300;n++){try{await readFile(path.join(directory,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
     await readFile(path.join(directory,'heartbeat.json'))
     const lock=JSON.parse(await readFile(path.join(directory,'worker.lock'),'utf8'))
     assert.equal(lock.pid,process.pid)
@@ -47,6 +47,16 @@ test('isolated installations cannot start host transport', async () => {
   abort.abort()
 })
 
+test('host bindings reject invalid opencode provider scopes before touching state', async () => {
+  const abort=new AbortController()
+  for (const opencodeProviders of [['BAD NAME'], [], ['ok', 'ok'], new Array(17).fill('ok')]) {
+    await assert.rejects(serveHostExecutor({cli:'grok',agents:[{
+      name:'t',workspace:'/tmp/ez-scope-x',controlDir:'/tmp/ez-scope-y',binDir:'/tmp/ez-scope-z',opencodeProviders} as never]},abort.signal),
+      /one to sixteen unique provider IDs/)
+  }
+  abort.abort()
+})
+
 test('host restart clears dead native lease only after proving previous CLI stopped',async()=>{
   const root=await mkdtemp(path.join(tmpdir(),'ez-native-recovery-'));
   const workspace=path.join(root,'mind'),controlDir=path.join(root,'control'),toolsHome=path.join(root,'tools'),directory=path.join(controlDir,'host-executor');
@@ -62,8 +72,8 @@ test('host restart clears dead native lease only after proving previous CLI stop
     await assert.rejects(serveHostExecutor(installation,abort.signal),/Previous host CLI is still running/);
     await readFile(path.join(toolsHome,'workspace-writer.lock'));
     await writeFile(path.join(directory,'r_old.process.json'),JSON.stringify({pid:deadPid}));
-    server=serveHostExecutor(installation,abort.signal);
-    for(let n=0;n<100;n++){try{await readFile(path.join(directory,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
+    server=serveHostExecutor(installation,abort.signal,undefined,async()=>[]);
+    for(let n=0;n<300;n++){try{await readFile(path.join(directory,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
     await readFile(path.join(directory,'heartbeat.json'));
     await assert.rejects(readFile(path.join(toolsHome,'workspace-writer.lock')),{code:'ENOENT'});
   }finally{abort.abort();await server;await rm(root,{recursive:true,force:true});}
@@ -93,6 +103,7 @@ test('host execution resolves a declared provider from the bound agent, not a la
     await mkdir(fakeBin, {recursive: true})
     await mkdir(path.join(controlDir, 'cli', 'codex'), {recursive: true})
     await writeFile(path.join(fakeBin, 'codex'), '#!/bin/sh\nexit 0\n', {mode: 0o700})
+    await writeFile(path.join(fakeBin, 'opencode'), '#!/bin/sh\nexit 0\n', {mode: 0o700})
     await writeFile(path.join(controlDir, 'cli', 'codex', 'models_cache.json'), JSON.stringify({models: [
       {slug: provider.models[0], visibility: 'list', display_name: 'DeepSeek V4.1 Flash', supported_reasoning_levels: [{effort: 'max'}]},
     ]}))
@@ -107,6 +118,9 @@ test('host execution resolves a declared provider from the bound agent, not a la
       try { await readFile(path.join(directory, 'heartbeat.json')); break }
       catch { await new Promise(resolve => setTimeout(resolve, 20)) }
     }
+    // The selected model was advertised at startup. A later catalog probe
+    // can fail while the client remains able to execute the selected model.
+    await rm(path.join(controlDir, 'cli', 'codex', 'models_cache.json'))
     await writeFile(path.join(directory, 'r_provider.request.json'), JSON.stringify({
       texts: ['hello'], options: {cli: 'codex', provider: 'openrouter', model: provider.models[0], effort: 'max'},
     }))
@@ -156,6 +170,7 @@ test('one installed CLI executes two agent bindings with separate minds and sani
     await writeFile(binary,`#!${process.execPath}\nif(process.env.EZ_RUN_ID==='r_hold')setInterval(()=>{},1000);console.log(JSON.stringify({cwd:process.cwd(),home:process.env.HOME,token:process.env.TELEGRAM_BOT_TOKEN,control:process.env.EZ_CONTROL_DIR,run:process.env.EZ_RUN_ID,repair:process.env.EZ_REPAIR_ENABLED,args:process.argv.slice(2)}));\n`,{mode:0o700})
     await writeFile(path.join(root,'claude'),await readFile(binary),{mode:0o700})
     await writeFile(path.join(root,'codex'),await readFile(binary),{mode:0o700})
+    await writeFile(path.join(root,'opencode'),'#!/bin/sh\nexit 0\n',{mode:0o700})
     process.env.PATH=root+path.delimiter+oldPath
     EXECUTOR_REGISTRY.grok.command=binary
     EXECUTOR_REGISTRY.grok.buildArgs=(opts,file,prompt)=>[...EXECUTOR_REGISTRY.codex.buildArgs(opts,file,prompt).slice(0,-1),prompt]
@@ -173,7 +188,7 @@ test('one installed CLI executes two agent bindings with separate minds and sani
     server=serveHostExecutor({cli:'grok',agents},abort.signal)
     for(const agent of agents){
       const dir=path.join(agent.controlDir,'host-executor')
-      for(let n=0;n<100;n++){try{await readFile(path.join(dir,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
+      for(let n=0;n<300;n++){try{await readFile(path.join(dir,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
       assert.equal(JSON.parse(await readFile(path.join(dir,'heartbeat.json'),'utf8')).version,packageVersion)
       const release = await workspaceLease(agent.toolsHome)
       await ownerRun(agent.controlDir, `r_${agent.name}`)
@@ -231,10 +246,14 @@ test('one installed CLI executes two agent bindings with separate minds and sani
     switched.stdin.end(JSON.stringify({texts:['Explicit CLI change'],options:executionDefaults('claude',{cli:'claude',timeoutMs:5000,effort:undefined})}))
     assert.equal(await new Promise(resolve=>switched.once('close',resolve)),0)
     assert.ok(JSON.parse(switchedOutput).args.includes('--print'))
-    // The bound cache may advertise a model absent from the host's cache.
+    // The host's published catalog can gain a model after its first probe.
     const codexHome=path.join(agents[0].controlDir,'cli','codex')
     await mkdir(codexHome,{recursive:true})
     await writeFile(path.join(codexHome,'models_cache.json'),JSON.stringify({models:[{slug:'agent-only-fixture',visibility:'list',display_name:'Agent model',supported_reasoning_levels:[]}]}))
+    const catalogFile=path.join(agents[0].controlDir,'host-executor','models.json')
+    const advertised=JSON.parse(await readFile(catalogFile,'utf8'))
+    advertised.push({cli:'codex',model:'agent-only-fixture',name:'Agent model',efforts:[]})
+    await writeFile(catalogFile,JSON.stringify(advertised))
     await ownerRun(agents[0].controlDir,'tg_6293307')
     const bound=spawn(process.execPath,['--import',fileURLToPath(new URL('../node_modules/tsx/dist/loader.mjs',import.meta.url)),fileURLToPath(new URL('../src/host-executor-client.ts',import.meta.url)),agents[0].controlDir,'tg_6293307'],{stdio:['pipe','pipe','pipe']})
     let boundOutput='',boundError=''
@@ -344,9 +363,146 @@ test('client cancels on stale or invalid heartbeat instead of waiting indefinite
 
 
 test('host rejects a plugin registry bound to another workspace',async()=>{
- const root=await mkdtemp(path.join(tmpdir(),'ez-host-plugin-binding-'))
- try {
-  await writeFile(path.join(root,'config.json'),JSON.stringify({schemaVersion:1,workspace:'/another-agent'}))
-  await assert.rejects(serveHostExecutor({cli:'codex',agents:[{name:'test',workspace:root,controlDir:root,binDir:root,toolsHome:root}]},new AbortController().signal),/another workspace/)
- } finally {await rm(root,{recursive:true,force:true})}
+  const root=await mkdtemp(path.join(tmpdir(),'ez-host-plugin-binding-'))
+  try {
+   await writeFile(path.join(root,'config.json'),JSON.stringify({schemaVersion:1,workspace:'/another-agent'}))
+   await assert.rejects(serveHostExecutor({cli:'codex',agents:[{name:'test',workspace:root,controlDir:root,binDir:root,toolsHome:root}]},new AbortController().signal),/another workspace/)
+  } finally {await rm(root,{recursive:true,force:true})}
+})
+
+test('refresh blip throws so the caller keeps last-good models instead of crashing',async()=>{
+  const root=await mkdtemp(path.join(tmpdir(),'ez-host-refresh-blip-'))
+  const workspace=path.join(root,'mind'),controlDir=path.join(root,'control'),directory=path.join(controlDir,'host-executor')
+  try {
+    await mkdir(workspace,{recursive:true});await mkdir(directory,{recursive:true})
+    const agent={name:'test',workspace,controlDir,binDir:root}
+    const lastGood=[{cli:'codex',model:'cached-model',name:'Cached',efforts:[]}]
+    await writeFile(path.join(directory,'models.json'),JSON.stringify(lastGood))
+    const seen=new Map()
+    await assert.rejects(refreshAgentCatalog(agent,async()=>{throw new Error('transient catalog blip')},seen),/transient catalog blip/)
+    assert.deepEqual(JSON.parse(await readFile(path.join(directory,'models.json'),'utf8')),lastGood)
+    assert.equal(seen.has(agent),false)
+  } finally {await rm(root,{recursive:true,force:true})}
+})
+
+test('empty refresh preserves the last-good catalog and a later nonempty refresh replaces it',async()=>{
+  const root=await mkdtemp(path.join(tmpdir(),'ez-host-empty-refresh-'))
+  const directory=path.join(root,'host-executor')
+  try {
+    await mkdir(directory)
+    const agent={name:'test',workspace:root,controlDir:root,binDir:root}
+    const lastGood=[{cli:'codex',model:'cached-model',name:'Cached',efforts:[]}]
+    const fresh=[{cli:'codex',model:'new-model',name:'New',efforts:[]}]
+    await writeFile(path.join(directory,'models.json'),JSON.stringify(lastGood))
+    const seen=new Map([[agent,JSON.stringify(lastGood)]])
+    await refreshAgentCatalog(agent,async()=>[],seen)
+    assert.deepEqual(JSON.parse(await readFile(path.join(directory,'models.json'),'utf8')),lastGood)
+    assert.equal(seen.get(agent),JSON.stringify(lastGood))
+    await refreshAgentCatalog(agent,async()=>fresh,seen)
+    assert.deepEqual(JSON.parse(await readFile(path.join(directory,'models.json'),'utf8')),fresh)
+    assert.equal(seen.get(agent),JSON.stringify(fresh))
+  } finally {await rm(root,{recursive:true,force:true})}
+})
+
+test('slow catalog refresh keeps heartbeats live and active client completes without cancellation', {timeout:70000}, async()=>{
+  const root=await mkdtemp(path.join(tmpdir(),'ez-host-slow-refresh-'))
+  const directory=path.join(root,'host-executor')
+  const abort=new AbortController()
+  let server:Promise<void>|undefined
+  let client:ReturnType<typeof spawn>|undefined
+  let closed:Promise<number|null>|undefined
+  let releaseRefresh!:()=>void
+  let startedRefresh!:()=>void
+  const blocked=new Promise<void>(resolve=>{releaseRefresh=resolve})
+  const refreshing=new Promise<void>(resolve=>{startedRefresh=resolve})
+  let calls=0
+  let finishRun: (()=>void) | undefined
+  try {
+    await mkdir(directory)
+    await ownerRun(root,'r_slow_catalog')
+    server=serveHostExecutor({cli:'grok',agents:[{name:'test',workspace:root,controlDir:root,binDir:root}]},abort.signal,async()=>{
+      const child=spawn(process.execPath,['-e','process.stdin.resume();process.stdin.once("data",()=>process.exit(0))'])
+      finishRun=()=>{child.stdin!.end('done')}
+      return {child,cleanup:async()=>{},stdout:''}
+    },async()=>{
+      if(++calls>1){startedRefresh();await blocked}
+      return [{cli:'grok',name:'Grok',efforts:[]}]
+    })
+    for(let n=0;n<300;n++){try{await readFile(path.join(directory,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
+    client=spawn(process.execPath,['--import',fileURLToPath(new URL('../node_modules/tsx/dist/loader.mjs',import.meta.url)),fileURLToPath(new URL('../src/host-executor-client.ts',import.meta.url)),root,'r_slow_catalog'],{stdio:['pipe','pipe','pipe']})
+    closed=new Promise(resolve=>client!.once('close',resolve))
+    let stderr='';client.stderr!.on('data',chunk=>stderr+=chunk);client.stdout!.resume()
+    client.stdin!.end(JSON.stringify({texts:['test'],options:{cli:'grok'}}))
+    await refreshing
+    // Exceed the real relay client's 15s offline threshold while discovery hangs.
+    await new Promise(resolve=>setTimeout(resolve,16500))
+    const heartbeat=JSON.parse(await readFile(path.join(directory,'heartbeat.json'),'utf8'))
+    assert.ok(Date.now()-heartbeat.at<5000,'heartbeat stopped during catalog I/O')
+    assert.equal(client.exitCode,null,stderr)
+    await assert.rejects(readFile(path.join(directory,'r_slow_catalog.cancel')),{code:'ENOENT'})
+    assert.equal(calls,2,'catalog refresh must not overlap itself')
+    assert.ok(finishRun,'the native run must have started')
+    finishRun()
+    assert.equal(await closed,0,stderr)
+    releaseRefresh()
+  } finally {
+    releaseRefresh();abort.abort()
+    if(client?.exitCode===null && client.signalCode===null)client.kill()
+    await closed;await server;await rm(root,{recursive:true,force:true})
+  }
+})
+
+test('cross-CLI admission uses the advertised catalog without another discovery probe',async()=>{
+  const root=await mkdtemp(path.join(tmpdir(),'ez-host-advertised-'))
+  const workspace=path.join(root,'mind'),controlDir=path.join(root,'control'),directory=path.join(controlDir,'host-executor')
+  const abort=new AbortController();let server:Promise<void>|undefined
+  const previousPath=process.env.PATH
+  try {
+    await mkdir(workspace,{recursive:true});await mkdir(directory,{recursive:true})
+    const fakeBin=path.join(root,'bin');await mkdir(fakeBin,{recursive:true})
+    await writeFile(path.join(fakeBin,'codex'),'#!/bin/sh\nexit 0\n',{mode:0o700})
+    process.env.PATH=`${fakeBin}${path.delimiter}${previousPath ?? ''}`
+    const installation={cli:'grok' as const,agents:[{name:'test',workspace,controlDir,binDir:fakeBin}]}
+    const advertised=[{cli:'codex',model:'cached-model',name:'Cached',efforts:[]}]
+    let reads=0
+    server=serveHostExecutor(installation,abort.signal,async()=>{
+      const child=spawn(process.execPath,['-e','process.exit(0)'])
+      return {child,cleanup:async()=>{},stdout:''}
+    },async()=>{if(++reads>1)throw new Error('unexpected discovery during admission');return advertised})
+    for(let n=0;n<300;n++){try{await readFile(path.join(directory,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
+    await readFile(path.join(directory,'heartbeat.json'))
+    await ownerRun(controlDir,'r_advertised')
+    await writeFile(path.join(directory,'r_advertised.request.json'),JSON.stringify({
+      texts:['hello'],options:{cli:'codex',model:'cached-model'},
+    }))
+    let events=''
+    for(let n=0;n<200;n++){
+      try{events=await readFile(path.join(directory,'r_advertised.events'),'utf8');if(events.includes('"stream":"exit"'))break}catch{}
+      await new Promise(r=>setTimeout(r,20))
+    }
+    assert.match(events,/"stream":"exit","code":0/)
+    assert.equal(reads,1)
+  } finally {
+    abort.abort();await server
+    if(previousPath===undefined)delete process.env.PATH;else process.env.PATH=previousPath
+    await rm(root,{recursive:true,force:true})
+  }
+})
+
+test('startup replaces prior catalog after provider policy changes even when discovery is empty',async()=>{
+  const root=await mkdtemp(path.join(tmpdir(),'ez-host-policy-reset-'))
+  const directory=path.join(root,'host-executor')
+  const abort=new AbortController();let server:Promise<void>|undefined
+  try {
+    await mkdir(directory)
+    await writeFile(path.join(directory,'models.json'),JSON.stringify([
+      {cli:'opencode',model:'old-provider/model',name:'Old provider',efforts:[]},
+    ]))
+    server=serveHostExecutor({cli:'grok',agents:[{
+      name:'test',workspace:root,controlDir:root,binDir:root,opencodeProviders:['allowed-provider'],
+    }]},abort.signal,undefined,async()=>[])
+    for(let n=0;n<300;n++){try{await readFile(path.join(directory,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
+    await readFile(path.join(directory,'heartbeat.json'))
+    assert.deepEqual(JSON.parse(await readFile(path.join(directory,'models.json'),'utf8')),[])
+  } finally {abort.abort();await server;await rm(root,{recursive:true,force:true})}
 })

package/test/message-history.test.ts

@@ -10,6 +10,9 @@ import { serveTestLedger } from './helpers/ledger.js'
 import { deliveredMessages } from '../src/message-history.js'
 import { RunStore } from '../src/runs.js'
 import { ControlStore } from '../src/control-state.js'
+import { ownerId, ownerEpoch } from '../src/control-state.js'
+import { ApplicationBindings } from '../src/application-channel.js'
+import { randomBytes } from 'node:crypto'
 
 async function fixture(t: test.TestContext) {
   const dir = await mkdtemp(join(tmpdir(), 'ez-history-'))
@@ -117,3 +120,47 @@ test('CLI flushes complete long reports and rejects send options in history mode
   // History reads never create outbox state on disk.
   await assert.rejects(stat(join(dir, 'outbox')))
 })
+
+test('application history reads only delivered literal text in its current binding and scope', async t => {
+  const { dir, runs } = await fixture(t)
+  const owner = (await new ControlStore(dir, 1000).status()).owner!
+  const bindings = new ApplicationBindings(dir)
+  const first = (await bindings.register('first', randomBytes(32).toString('base64url'), owner))!
+  const second = (await bindings.register('second', randomBytes(32).toString('base64url'), owner))!
+  const create = async (id: string, bindingId: string, scope: string) => {
+    const run = await runs.create({ id, ownerId: ownerId(owner), ownerEpoch: ownerEpoch(owner),
+      texts: ['test'], application: { bindingId, scope, requestId: id } })
+    await runs.patch(id, { status: 'running' })
+    return run
+  }
+  const earlier = await create('r_app_earlier', first.bindingId, 'book')
+  const current = await create('r_app_current', first.bindingId, 'book')
+  const otherScope = await create('r_app_other_scope', first.bindingId, 'private')
+  const otherBinding = await create('r_app_other_binding', second.bindingId, 'book')
+  const deliver = async (runId: string, text: string) => {
+    const item = await runs.enqueueMessage(runId, text)
+    await runs.claimOutbox(item.id)
+    await runs.markOutboxSent(item.id)
+    return item
+  }
+  const literal = 'Book is $1,234; path C:\\reports\\$raw'
+  const firstItem = await deliver(earlier.id, literal)
+  await runs.patch(earlier.id, { status: 'completed' })
+  await deliver(otherScope.id, 'other scope secret')
+  await deliver(otherBinding.id, 'other binding secret')
+  await deliver('tg_1', 'Telegram secret')
+  await runs.enqueueMessage(current.id, 'queued is not delivered')
+  const env = { ...process.env, EZ_CONTROL_DIR: dir, EZ_RUN_ID: current.id }
+  const { stdout } = await promisify(execFile)(process.execPath, ['bin/ezenciel-agents-message.mjs', 'history'], { env })
+  const result = JSON.parse(stdout)
+  assert.equal(result.scope, 'book')
+  assert.deepEqual(result.messages.map((message: { id: string; text: string }) => ({ id: message.id, text: message.text })),
+    [{ id: firstItem.id, text: literal }])
+  assert.equal(result.hasMore, false)
+  await assert.rejects(promisify(execFile)(process.execPath,
+    ['bin/ezenciel-agents-message.mjs', 'history', '--message-id', '1'], { env }), /Telegram history/)
+  await bindings.register('first', null, owner)
+  await assert.rejects(deliveredMessages(dir, current.id), /revoked/)
+  await new ControlStore(dir, 1000).revokeOwner()
+  await assert.rejects(deliveredMessages(dir, otherBinding.id), /owner-mismatch|revoked/)
+})

package/test/model-policy.test.ts

@@ -12,7 +12,7 @@ import { runCodexSession } from '../src/codex-session.js'
 import { runDesktopTurn } from '../src/desktop-bridge.js'
 
 test('engine defaults stay omitted and explicit native settings survive every adapter', async () => {
- for(const cli of ['codex','codex-gui','grok','claude','opencode','agy']) {
+ for(const cli of ['codex','codex-gui','grok','claude','opencode']) {
   assert.deepEqual(executionDefaults(cli,{}),{})
   const preset={id:'chosen',name:'Chosen',cli,model:'native-model',effort:'ultra'}
   assert.deepEqual(executionDefaults(cli,preset),preset)
@@ -41,7 +41,7 @@ test('invalid setting syntax never mutates a saved choice', async () => {
 test('non-Codex catalog defaults survive executor normalization and host revalidation', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-adapter-defaults-'))
   try {
-    const available = async (cli: string) => ['claude', 'opencode', 'agy'].includes(cli)
+    const available = async (cli: string) => ['claude', 'opencode'].includes(cli)
     const catalog = await readModels(dir, available)
     for (const choice of catalog) {
       const preset = {id:'selected', name:choice.name, cli:choice.cli, model:choice.model}

package/test/plugin-manager.test.mjs

@@ -276,6 +276,23 @@ test('isolated broker host binding validates exact mounts without deployment sym
   if(previous===undefined)delete process.env.EZ_DOCKER_COMPOSE;else process.env.EZ_DOCKER_COMPOSE=previous;
  }
 });
+test('isolated broker allows unbound plugins when another plugin has host binding',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source),isolated=path.join(f.root,'isolated-other'),workspace=path.join(isolated,'workspace'),control=path.join(isolated,'control'),hostConfig=path.join(isolated,'host-executor.json'),previous=process.env.EZ_DOCKER_COMPOSE;
+ await fs.mkdir(f.home,{recursive:true});await fs.mkdir(workspace,{recursive:true});await fs.mkdir(control,{recursive:true});
+ await fs.writeFile(hostConfig,JSON.stringify({cli:'codex',isolation:'isolated',agents:[{name:'sample',workspace,controlDir:control,binDir:path.join(f.root,'bin'),toolsHome:f.home}]}));
+ const record={source:p.source,project:'ezp-synthetic',revision:p.revision,manifest:p.manifest,deployment:p.deployment};
+ const config={workspace:await fs.realpath(workspace),hostConfig:await fs.realpath(hostConfig)};
+ await fs.writeFile(hostConfig,JSON.stringify({cli:'codex',isolation:'isolated',agents:[{name:'sample',workspace,controlDir:control,binDir:path.join(f.root,'bin'),toolsHome:f.home,pluginNetworkBindings:{voice:{revisions:[p.revision],bindings:[{service:'sample',network:'voice_default'}]}}}]}));
+ process.env.EZ_DOCKER_COMPOSE='standalone';
+ try {
+  const c=await compose(config,record,{},f.home);
+  assert.equal(c.version,'3.8');assert.equal(c.networks,undefined);
+  await fs.writeFile(hostConfig,JSON.stringify({cli:'codex',isolation:'isolated',agents:[{name:'sample',workspace,controlDir:control,binDir:path.join(f.root,'bin'),toolsHome:f.home,pluginNetworkBindings:{sample:{revisions:[p.revision],bindings:[{service:'sample',network:'sample_default'}]}}}]}));
+  await assert.rejects(compose(config,record,{},f.home),/Isolated broker cannot use host network bindings/);
+ } finally {
+  if(previous===undefined)delete process.env.EZ_DOCKER_COMPOSE;else process.env.EZ_DOCKER_COMPOSE=previous;
+ }
+});
 test('host-owned private networks survive registered-call Compose regeneration',async t=>{
  const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);
  await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);

package/test/setup.test.ts

@@ -13,11 +13,11 @@ test('findExecutableInPath locates existing binary and returns null for nonexist
   assert.equal(missing, null)
 })
 
-test('readActiveExecutor extracts EZ_EXECUTOR_CLI or defaults to agy', async () => {
+test('readActiveExecutor extracts EZ_EXECUTOR_CLI or defaults to codex', async () => {
   const dir = await mkdtemp(path.join(tmpdir(), 'ez-setup-test-'))
   try {
     const envPath = path.join(dir, '.env')
-    assert.equal(await readActiveExecutor(envPath), 'agy')
+    assert.equal(await readActiveExecutor(envPath), 'codex')
 
     await writeFile(envPath, 'EZ_EXECUTOR_CLI=claude\n', 'utf8')
     assert.equal(await readActiveExecutor(envPath), 'claude')
@@ -37,10 +37,10 @@ test('setExecutorInEnv updates or adds EZ_EXECUTOR_CLI without altering other en
     assert.match(content, /TELEGRAM_BOT_TOKEN=token123/)
     assert.match(content, /EZ_EXECUTOR_CLI=claude/)
 
-    await setExecutorInEnv(envPath, 'antigravity')
+    await setExecutorInEnv(envPath, 'codex')
     content = await readFile(envPath, 'utf8')
     assert.match(content, /TELEGRAM_BOT_TOKEN=token123/)
-    assert.match(content, /EZ_EXECUTOR_CLI=antigravity/)
+    assert.match(content, /EZ_EXECUTOR_CLI=codex/)
     assert.ok(!content.includes('claude'))
   } finally {
     await rm(dir, { recursive: true, force: true })
@@ -59,9 +59,9 @@ test('getExecutorsStatus returns all executors and sets isActive correctly', asy
     assert.ok(claudeItem)
     assert.equal(claudeItem.isActive, true)
 
-    const agyItem = status.items.find((item) => item.id === 'agy')
-    assert.ok(agyItem)
-    assert.equal(agyItem.isActive, false)
+    const codexItem = status.items.find((item) => item.id === 'codex')
+    assert.ok(codexItem)
+    assert.equal(codexItem.isActive, false)
   } finally {
     await rm(dir, { recursive: true, force: true })
   }