@jc_stack/ez-agents 0.1.0-beta.39 → 0.1.0-beta.41

package/AGENTS.md

@@ -121,7 +121,7 @@ round merely to seek more criticism, tests or hypothetical edge cases.
 
 ## 6. Concurrency & Workspace Invariants
 - **1 Writer Job per Workspace:** The agent's Markdown folder (`./agent/`) is its mind. Never run concurrent background processes writing to the same workspace simultaneously.
-- Main-conversation jobs queue sequentially in the relay's memory ledger; the delivery socket carries every cross-process enqueue/receipt, never control/ files. Scheduled/background work uses separate task directories under the control directory and native CLI sessions (up to four alongside chat). Never share a mutable task directory. Delegation decisions and goal persistence belong to the agent/executor; there is no automatic planner or canned chat ACK. Production executor runs have no wall-clock timeout; cancellation is explicit.
+- Main-conversation and owner-scheduled jobs write the same mind workspace one at a time; the delivery socket carries every cross-process enqueue/receipt, never control/ files. Scheduled jobs keep separate native CLI sessions and control-side task state. Restricted contact tasks retain their separate authorization boundary. Delegation decisions and goal persistence belong to the agent/executor; there is no automatic planner or canned chat ACK. Production executor runs have no wall-clock timeout; cancellation is explicit.
 
 ## 7. Fail-Closed Authority (Channel Access ≠ Execution)
 - Incoming messages outside the approved owner binding must **never** spawn the executor. A first DM or group message records a pending request only. Explicitly approved owner groups grant owner access to all human members in that exact chat; bots and anonymous posts are ignored.

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.1.0-beta.41
+
+- Run owner-scheduled tasks from the bound agent workspace so native instructions
+  and relative context are available, while serializing writes with owner turns.
+
+## 0.1.0-beta.40
+
+- Apply eligible npm releases under each agent's saved automatic update policy
+  through the existing guarded updater. Queue one update at a time, preserve
+  manual policies, and wait for a newer version after a failed automatic update.
+
 ## 0.1.0-beta.39
 
 - Render completed, binding-scoped application replies as WAV speech with

package/README.md

@@ -327,6 +327,6 @@ main/plugin replacement. See [upgrade setup, tools and recovery](docs/upgrades.m
 
 The core `ezenciel-agents-schedule` CLI accepts instruction text for one-off dates,
 intervals and timezone-aware cron schedules. `create --now` delegates a task to a
-separate CLI session so the owner conversation remains available. Long work has
+separate CLI session queued with owner turns in the bound workspace. Long work has
 no production wall-clock timeout; goals and subagents remain native executor
 features. See [scheduling, recovery and QA](docs/scheduling.md).

package/docs/responsive-channels.md

@@ -3,11 +3,12 @@
 Owner input passes unchanged to the selected engine. The agent decides when to
 delegate or schedule long work to remain available. ez queues foreground input
 while a foreground run is active; it does not create a separate busy-reply agent.
-Independent scheduled task directories retain deterministic writer isolation.
+Owner-scheduled turns use the bound mind workspace under the same single-writer
+limit as foreground turns.
 
-Background tasks receive literal task text. Their directories contain no generated
-role instructions or copied identity files; native workspace instructions and
-existing Markdown provide context. The agent chooses what to read and when to use
+Background tasks receive literal task text. Their native sessions contain no
+generated role instructions or copied identity files; native workspace instructions
+and existing Markdown provide context. The agent chooses what to read and when to use
 the message CLI. Native final text is not automatically delivered to Telegram.
 
 Restricted correspondence receives a typed activation event and scoped tools.

package/docs/scheduling.md

@@ -40,18 +40,18 @@ available through `ezenciel-agents-schedule context`.
 ## Execution and authority
 
 Due occurrences enter the durable queue with stable IDs and literal task text.
-Background runs use fresh native sessions in `work/tasks/RUN_ID/`. No identity
-files or role instructions are generated there. Existing workspace Markdown
-provides context; the engine chooses what to read. Codex uses `AGENTS.md` or `.git`
-as its native project-root marker, so a nested task sees the existing agent scope. Task folders remain for
-inspection and artifact delivery.
-
-One writer runs per task directory. Up to four background tasks can run alongside
-the main conversation. Foreground inputs queue while a foreground turn runs;
+Owner-scheduled runs use fresh native sessions in the bound agent workspace.
+No identity files or role instructions are generated. Existing workspace Markdown
+provides context, including native `AGENTS.md` discovery and relative links; the
+engine chooses what to read. Per-run native state stays under `control/`.
+
+One writer runs in the agent workspace: owner schedules and foreground turns
+queue behind each other. Foreground inputs queue while another turn runs;
 ez does not create another reply agent. The agent can delegate or schedule long
 work and return to chat. It decides when to send through the message CLI.
 A recurring schedule has at most one pending or active occurrence. Shared
-provider resources still need writer coordination.
+provider resources still need writer coordination. The former four background
+slots are no longer used for owner schedules.
 
 Production relay/host execution has no wall-clock timeout. The old
 `EZ_EXECUTOR_TIMEOUT_SECONDS` setting is ignored. Individual network/tool waits
@@ -70,7 +70,7 @@ goal is not reported as successful. Native RPC requests have a response deadline
 running tasks do not.
 Each scheduled task has its own Codex state under `control/cli/codex/tasks/RUN_ID`,
 with a snapshot of the agent's Codex configuration and the existing auth link.
-Foreground chat and background tasks do not initialize or migrate one shared
+Foreground chat and scheduled tasks do not initialize or migrate one shared
 native database concurrently.
 
 The foreground chat still uses `codex exec`. That invocation exits after one

package/docs/upgrades.md

@@ -12,12 +12,13 @@ automatic channel for core and plugins without a saved policy. Existing explicit
 stable or manual policies are preserved. The owner may select either per target.
 The main target and installed plugins version independently.
 
-The agent owns release review, policy decisions and communication. The host
-supervisor owns interruption-safe replacement. There is one host service per
-agent, not a second agent or an additional updater daemon. Its replaceable child
-runs the normal CLI transport. It checks npm every six hours while running and
-records automatic-channel changes; discovery never wakes the agent or injects
-wrapper state into a session. Updates stay owner-invoked through `ez updates`.
+The owner chooses the saved update policy. The host supervisor owns
+interruption-safe replacement. There is one host service per agent, not a second
+agent or an additional updater daemon. Its replaceable child runs the normal CLI
+transport. It checks npm every six hours while running and queues one eligible
+release at a time when the policy is automatic. Discovery and replacement never
+wake the agent or inject wrapper state into a session. Manual policies retain
+owner-invoked updates through `ez updates`.
 Checks use the installed scoped npm identity; failures are
 visible in `updates check` and private `tools/updates/available.json`. Plugins marked
 `private: true` in their package metadata are reported as local-source updates
@@ -265,5 +266,7 @@ execution authority.
 
 Update discovery runs independently of active host work. A discovery failure is
 logged locally and retried at the next regular six-hour check; it does not stop
-the host or create a repair task. Inspect `ez updates check` for target diagnostics.
+the host or create a repair task. An automatically failed or rolled-back version
+is not retried until a newer version appears or the owner explicitly retries.
+Inspect `ez updates check` and `ez updates status` for target diagnostics.
 Actual update transactions retain their existing admission, drain and rollback rules.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jc_stack/ez-agents",
-  "version": "0.1.0-beta.39",
+  "version": "0.1.0-beta.41",
   "private": false,
   "type": "module",
   "description": "A lightweight foundation for persistent business AI assistants using existing AI harnesses, workspaces and plugins.",

package/src/host-executor.ts

@@ -11,7 +11,6 @@ import { startExecutorJob, terminateJob, resolveExecutor, validateCodexProvider,
 import { parseIsolationClass, type IsolationClass } from './isolation.js'
 import { readModels, validateSelection, validateOpencodeProviders, type ModelChoice } from './ai.js'
 import type { ChildProcess } from 'node:child_process'
-import { taskWorkspace } from './task-workspace.js'
 import { packageVersion } from './version.js'
 import { installedPluginVersions } from './software-status.js'
 import { processSnapshot } from './process-tree.js'
@@ -52,6 +51,7 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
   let catalogRefresh: Promise<void> | undefined
   const locks: string[] = []
   const sharedWorkspaces = new Map<HostBinding, string>()
+  const activeWorkspaces = new Set<HostBinding>()
   const additionalWorkspaces = new Map<HostBinding, string[]>()
   const catalog = async (agent: HostBinding) => {
     const discovered = await readModels(undefined, undefined, path.join(agent.controlDir, 'cli', 'codex'),
@@ -158,11 +158,13 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
           }
           const sharedWorkspace=sharedWorkspaces.get(agent)
           const base=path.join(directory,id)
-          const releaseWorkspace = !run?.scheduled && agent.toolsHome
+          if (activeWorkspaces.has(agent)) continue
+          const releaseWorkspace = agent.toolsHome
             ? await (await import('./plugins/workspace-lease.mjs')).workspaceLease(agent.toolsHome,{kind:'native',runId:id}) : undefined
-          if (!run?.scheduled && agent.toolsHome && !releaseWorkspace) continue
+          if (agent.toolsHome && !releaseWorkspace) continue
+          activeWorkspaces.add(agent)
           try { await rename(base+'.request.json',base+'.running.json') }
-          catch (error) { await releaseWorkspace?.(); throw error }
+          catch (error) { activeWorkspaces.delete(agent); await releaseWorkspace?.(); throw error }
           const task=(async()=>{
             let job: Awaited<ReturnType<typeof startExecutorJob>> | undefined
             let cancellation: ReturnType<typeof setInterval> | undefined
@@ -193,7 +195,7 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
               // transient native-client probe failure must not reject a model
               // that the host just advertised to the relay and application.
               if (cli !== installation.cli) await validateSelection({id:'selected',name:'Selected model',cli,provider:opts.provider,model,effort:opts.effort},JSON.parse(await readFile(path.join(directory,'models.json'),'utf8')))
-              const options:ExecutorOptions={workspace:run?.scheduled ? await taskWorkspace(agent.controlDir,id) : agent.workspace,controlDir:agent.controlDir,binDir:agent.binDir,toolsHome:agent.toolsHome,sharedWorkspace,additionalWorkspaces:additionalWorkspaces.get(agent),cli,
+              const options:ExecutorOptions={workspace:agent.workspace,controlDir:agent.controlDir,binDir:agent.binDir,toolsHome:agent.toolsHome,sharedWorkspace,additionalWorkspaces:additionalWorkspaces.get(agent),cli,
                 runId:path.basename(base),timeoutMs:0,repairEnabled:opts.repairEnabled,
                 sessionId:opts.sessionId,isResume:opts.isResume,model,effort:opts.effort,provider:opts.provider,codexAutoCompactTokens:opts.codexAutoCompactTokens,codexProvider:provider,
                 promptSuffix:runPromptSuffix(run),taskRun:Boolean(run?.taskId),nativeSession:Boolean(run?.scheduled)}
@@ -218,7 +220,7 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
               await rm(base+'.process.json',{force:true})
               await rm(base+'.cancel',{force:true})
               active.delete(base)
-              await releaseWorkspace?.()
+              try { await releaseWorkspace?.() } finally { activeWorkspaces.delete(agent) }
             }
           })()
           tasks.add(task); void task.finally(()=>tasks.delete(task))

package/src/index.ts

@@ -12,7 +12,6 @@ import { randomUUID } from 'node:crypto'
 import { stat } from 'node:fs/promises'
 import { Scheduler } from './scheduler.js'
 import { ownedScheduledTasks, scheduledTaskDetailText, scheduledTasksText } from './scheduled-tasks.js'
-import { taskWorkspace } from './task-workspace.js'
 import { EventSources, eventRunId, batchReady, type SourceEvent } from './event-sources.js'
 import {removeTaskAttachments} from './task-attachments.js'
 import { dirname, join, basename } from 'node:path'
@@ -206,7 +205,8 @@ export const createRelay = (config: Config, launch = startExecutorJob) => {
         return
       }
       if (run.scheduled && !(await scheduler.get(run.scheduled.id)).enabled) return
-      if (run.scheduled ? background.size >= 4 : activeChild) return
+      // Owner turns and schedules write the same mind. Keep one native writer.
+      if (activeChild || background.size) return
       let texts = run.texts
       if (run.external) {
         // Availability failures leave durable queued work for a later check.
@@ -240,7 +240,7 @@ export const createRelay = (config: Config, launch = startExecutorJob) => {
           : await control.executionSession(started.execution!)
         const selected = run.taskId ? (started.execution?.preset.cli === 'codex' ? started.execution.preset : initialPreset('codex')) : started.execution!.preset
         const { child, cleanup } = await launch(texts, {
-          workspace: run.scheduled ? await taskWorkspace(config.controlDir,run.id) : config.workspace,
+          workspace: config.workspace,
           timeoutMs: config.executorTimeoutMs,
           repairEnabled: config.repairEnabled,
           runId: started.id,
@@ -319,7 +319,7 @@ export const createRelay = (config: Config, launch = startExecutorJob) => {
               }
             })
             console.info('run ended', { run_id: started.id, code })
-            const next = await runs.nextQueued(false)
+            const next = await runs.nextQueued()
             if (next && !shuttingDown) await startJob(next)
           })().catch((error) => console.error('Run completion failed', error.message))
         })
@@ -336,7 +336,7 @@ export const createRelay = (config: Config, launch = startExecutorJob) => {
         if (bot && !run.application && !run.delivery && run.chatId !== undefined) await sendChat(run.chatId, `Run ${run.id} failed to start. Check the local relay log.`)
         setImmediate(() => {
           void runs
-            .nextQueued(false)
+            .nextQueued()
             .then((next) => next && startJob(next))
             .catch(console.error)
         })
@@ -571,7 +571,7 @@ export const createRelay = (config: Config, launch = startExecutorJob) => {
             ])
             console.info('run reaction sent', { run_id: item.runId, emoji })
           } else if (item.type === 'document' && item.documentPath) {
-            const docPath = await workspaceFile(origin?.scheduled ? await taskWorkspace(config.controlDir,origin.id) : config.workspace, item.documentPath)
+            const docPath = await workspaceFile(config.workspace, item.documentPath)
             await paceSend()
             await authorizeChannelDelivery()
             attemptedDelivery = true
@@ -1206,7 +1206,7 @@ export const createRelay = (config: Config, launch = startExecutorJob) => {
       }
       const currentRunning = await runs.running(false)
       if (!currentRunning) {
-        const pendingRun = await runs.nextQueued(false)
+        const pendingRun = await runs.nextQueued()
         if (pendingRun) {
           console.info('Processing queued run on startup:', pendingRun.id)
           void startJob(pendingRun)

package/src/updates/supervisor.mjs

@@ -4,7 +4,7 @@ import { fileURLToPath } from 'node:url';
 import { spawn } from 'node:child_process';
 import { atomic, locked } from '../plugins/manager.mjs';
 import { callDeliverySocket } from '../delivery-socket-client.mjs';
-import { state, read, jobs, jobPath, check, missing, cleanupStaleBackups } from './control.mjs';
+import { state, read, jobs, jobPath, check, prepare, submit, missing, cleanupStaleBackups } from './control.mjs';
 import { perform, environment } from './runtime.mjs';
 
 const reservedProviderKeys=new Set(['HOME','LANG','LC_ALL','LOGNAME','PATH','SHELL','TERM','TMPDIR','USER','CODEX_HOME','NODE_OPTIONS']);
@@ -28,6 +28,22 @@ export async function idle(control) {
   const status=await callDeliverySocket(path.join(control,'delivery.sock'),{op:'status'},2000).catch(()=>null);
   return !status||status.running===0;
 }
+export async function queueAutomatic(home,available) {
+  const existing=await jobs(home);
+  if(existing.some(job=>['queued','applying','recovery-required'].includes(job.status)))return null;
+  for(const candidate of available) {
+    if(!candidate.newer||!candidate.policy?.automatic||!candidate.available)continue;
+    // A failed release needs a newer version or an explicit owner retry.
+    if(existing.some(job=>job.target===candidate.target&&job.version===candidate.available&&['failed','rolled-back'].includes(job.status)))continue;
+    try {
+      const job=await prepare(home,candidate.target,{release:candidate.available});
+      return await submit(home,job.id,true);
+    }catch {
+      console.error(`Automatic update of ${candidate.target} failed; inspect ez updates check/status.`);
+    }
+  }
+  return null;
+}
 export async function supervise(deployment,signal,{discover=check}={}) {
   const host=await read(path.join(deployment,'host-executor.json'));
   if(host.agents.length!==1||!host.agents[0].toolsHome)throw Error('Initialize a single deployment plugin registry before starting the supervisor');
@@ -96,12 +112,16 @@ export async function supervise(deployment,signal,{discover=check}={}) {
           const latest=await read(path.join(jobPath(home,pending.id),'job.json'));
           if(latest.status==='queued'){latest.status='failed';latest.error=error.message;await atomic(path.join(jobPath(home,pending.id),'job.json'),latest);}else throw error;
         } finally {await fs.rm(pause,{force:true});}
-        if(result?.status==='completed'&&pending.target==='main')return;
+        if(result?.status==='completed') {
+          if(pending.target==='main')return;
+          nextCheck=0;
+        }
       }
       if(Date.now()>=nextCheck) {
         nextCheck=Date.now()+6*60*60*1000;
         try {
           const results=await discover(home);await atomic(path.join(directory,'available.json'),results);
+          await queueAutomatic(home,results);
         } catch {
           // Discovery is optional; its failure must not terminate the host.
           // Do not expose registry response bodies or credentials in logs.

package/test/host-executor.test.ts

@@ -284,18 +284,23 @@ test('one installed CLI executes two agent bindings with separate minds and sani
       assert.match(output, /"stream":"exit","code":0/)
       return output.trim().split('\n').map(line=>JSON.parse(line))
     }
-    // A running scheduled engine does not reserve either its agent or its
-    // shared workspace, including another binding through a filesystem alias.
-    const [,,chatEvents]=await Promise.all([completed(directory,'r_schedule_queued'),completed(otherDirectory,'r_other_shared'),completed(directory,'tg_42')])
-    const chat=JSON.parse(chatEvents.filter(e=>e.stream==='stdout').map(e=>e.text).join(''))
-    assert.match(chat.args.at(-1),/^Chat while scheduled work runs/)
-    assert.match(chat.args.at(-1),/ezenciel-agents-message/)
+    // Another agent remains independent; this agent's queued schedule and chat
+    // wait behind its active owner schedule in the same mind.
+    await completed(otherDirectory,'r_other_shared')
+    assert.ok(await readFile(path.join(directory,'r_schedule_queued.request.json')))
+    assert.ok(await readFile(path.join(directory,'tg_42.request.json')))
     assert.doesNotMatch(await readFile(path.join(directory,'r_hold.events'),'utf8'),/"stream":"exit"/)
     await readFile(path.join(directory,'r_hold.running.json'))
     await writeFile(path.join(directory,'r_hold.cancel'),'')
     let heldOutput=''
     for(let n=0;n<200;n++){heldOutput=await readFile(path.join(directory,'r_hold.events'),'utf8');if(heldOutput.includes('"stream":"exit"'))break;await new Promise(r=>setTimeout(r,20))}
     assert.match(heldOutput, /"stream":"exit","code":1/)
+    const [scheduleEvents,chatEvents]=await Promise.all([completed(directory,'r_schedule_queued'),completed(directory,'tg_42')])
+    const scheduled=JSON.parse(scheduleEvents.filter(e=>e.stream==='stdout').map(e=>e.text).join(''))
+    const chat=JSON.parse(chatEvents.filter(e=>e.stream==='stdout').map(e=>e.text).join(''))
+    assert.equal(scheduled.cwd,await realpath(agents[0].workspace))
+    assert.match(chat.args.at(-1),/^Chat while scheduled work runs/)
+    assert.match(chat.args.at(-1),/ezenciel-agents-message/)
   } finally {
     abort.abort();await server
     EXECUTOR_REGISTRY.grok.command=old

package/test/scheduler-host.test.ts

@@ -11,11 +11,12 @@ import { RunStore } from '../src/runs.js'
 
 const until=async(check:()=>Promise<boolean>)=>{for(let n=0;n<250;n++){if(await check())return;await new Promise(r=>setTimeout(r,20))}throw new Error('Host probe timed out')}
 const stdout=(events:string) => events.trim().split('\n').filter(Boolean).map(line=>JSON.parse(line)).filter(event=>event.stream==='stdout').map(event=>event.text).join('')
-test('host transport reserves separate task and main lanes, pins directories, and cancels only its target',async()=>{
+test('host transport serializes owner schedules and chat in the bound mind',async()=>{
  const root=await mkdtemp(join(tmpdir(),'ez-scheduler-host-')),workspace=join(root,'agent'),controlDir=join(root,'control')
  await mkdir(workspace);await mkdir(controlDir)
+ await writeFile(join(workspace,'AGENTS.md'),'bound-owner-instructions')
  const script=join(root,'fixture.mjs')
- await writeFile(script,`console.log(JSON.stringify({cwd:process.cwd(),token:process.env.TELEGRAM_BOT_TOKEN,run:process.env.EZ_RUN_ID}));if(process.env.EZ_RUN_ID.startsWith('r_schedule_'))setInterval(()=>{},1000);`)
+ await writeFile(script,`import {readFileSync} from 'node:fs';console.log(JSON.stringify({cwd:process.cwd(),agents:readFileSync('AGENTS.md','utf8'),token:process.env.TELEGRAM_BOT_TOKEN,run:process.env.EZ_RUN_ID}));if(process.env.EZ_RUN_ID.startsWith('r_schedule_'))setInterval(()=>{},1000);`)
  const old={...EXECUTOR_REGISTRY.grok},token=process.env.TELEGRAM_BOT_TOKEN
  EXECUTOR_REGISTRY.grok.command=process.execPath;EXECUTOR_REGISTRY.grok.buildArgs=()=>[script]
  process.env.TELEGRAM_BOT_TOKEN='never-in-child'
@@ -31,21 +32,29 @@ test('host transport reserves separate task and main lanes, pins directories, an
   await submit(id)
   await until(async()=>Boolean(await exists(id+'.process.json')))
   await submit('tg_1')
-  await until(async()=>(await exists('tg_1.events')).includes('"stream":"exit","code":0'))
+  await new Promise(resolve=>setTimeout(resolve,300))
+  assert.ok(await exists('tg_1.request.json'))
+  assert.equal(await exists('tg_1.events'),'')
   assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
   const scheduled=JSON.parse(stdout(await exists(id+'.events')))
-  const main=JSON.parse(stdout(await exists('tg_1.events')))
-  assert.equal(scheduled.cwd,await realpath(join(controlDir,'work/tasks',id)));assert.equal(main.cwd,await realpath(workspace))
-  assert.equal(scheduled.token,undefined);assert.equal(main.token,undefined)
+  assert.equal(scheduled.cwd,await realpath(workspace))
+  assert.equal(scheduled.agents,'bound-owner-instructions')
+  assert.equal(scheduled.token,undefined)
   // An unknown scheduled run must not unwind the shared host service.
   await submit('r_schedule_corrupt')
   await until(async()=>(await exists('r_schedule_corrupt.events')).includes('"stream":"exit","code":1'))
   assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
   await ownerRun(controlDir,'tg_2')
   await submit('tg_2')
-  await until(async()=>(await exists('tg_2.events')).includes('"stream":"exit","code":0'))
+  assert.ok(await exists('tg_2.request.json'))
   await writeFile(join(dir,id+'.cancel'),'')
   await until(async()=>(await exists(id+'.events')).includes('"stream":"exit"'))
+  await until(async()=>(await exists('tg_1.events')).includes('"stream":"exit","code":0'))
+  await until(async()=>(await exists('tg_2.events')).includes('"stream":"exit","code":0'))
+  const main=JSON.parse(stdout(await exists('tg_1.events')))
+  assert.equal(main.cwd,await realpath(workspace))
+  assert.equal(main.agents,'bound-owner-instructions')
+  assert.equal(main.token,undefined)
  }finally{
   abort.abort();await server
   Object.assign(EXECUTOR_REGISTRY.grok,old)

package/test/scheduler-relay.test.ts

@@ -44,7 +44,7 @@ test('a wrapper-shaped run id has no maintenance treatment and a stale notice is
  }finally{await relay.stop();await rm(dir,{recursive:true,force:true})}
 })
 
-test('chat replies through the real ingress/outbox while scheduled CLI remains alive; targeted cancellation',async()=>{
+test('owner chat queues behind a scheduled CLI in the same workspace; targeted cancellation',async()=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-scheduler-relay-')), children:ReturnType<typeof spawn>[]=[]
  const runs=new RunStore(dir),scheduler=new Scheduler(dir),control=new ControlStore(dir,1000)
  const replies:string[]=[], workspaces:string[]=[]
@@ -68,27 +68,20 @@ test('chat replies through the real ingress/outbox while scheduled CLI remains a
   assert.equal(background.status,'running')
   const update:Update={update_id:123,message:{message_id:123,date:0,text:'What is 17 × 19?',from:{id:101,is_bot:false,first_name:'Fixture'},chat:{id:101,type:'private',first_name:'Fixture'}}}
   await relay.bot.handleUpdate(update);await relay.drainInbox(true);await relay.drainOutbox()
-  assert.ok(replies.includes('323'))
+  assert.ok(!replies.includes('323'))
   assert.equal((await runs.get(background.id))?.status,'running')
   assert.equal(children[0].exitCode,null)
-  assert.equal(new Set(workspaces).size,2)
+  assert.deepEqual(workspaces,[dir])
   // Pausing future dispatch doesn't kill active work; cancelling this run does.
   await scheduler.enable('slow',false);await relay.drainSources()
   assert.equal(children[0].exitCode,null)
   await scheduler.cancel(background.id);await relay.drainSources()
   await until(async()=> (await runs.get(background.id))?.status==='cancelled')
+  await until(async()=>children.length===2)
+  await relay.drainOutbox()
+  assert.ok(replies.includes('323'))
+  assert.deepEqual(workspaces,[dir,dir])
   assert.equal((await runs.list()).filter(r=>r.scheduled).length,1)
-  for(let n=0;n<5;n++)await scheduler.save({id:'pool_'+n,name:'Pool',text:'Long work',trigger:{at:new Date(Date.now()+2000).toISOString()},enabled:true,owner,execution})
-  await scheduler.tick(owner,runs,Date.now()+3000);await relay.drainSources()
-  const queued=(await runs.list()).find(r=>r.scheduled && r.status==='queued')!
-  assert.ok(queued)
-  assert.equal((await runs.list()).filter(r=>r.scheduled && r.status==='running').length,4)
-  await scheduler.enable(queued.scheduled!.id,false);await relay.drainSources()
-  assert.equal((await runs.get(queued.id))?.status,'queued')
-  await scheduler.enable(queued.scheduled!.id,true);await scheduler.cancel(queued.id);await relay.drainSources()
-  assert.equal((await runs.get(queued.id))?.status,'cancelled')
-  await relay.bot.handleUpdate({...update,update_id:124,message:{...update.message!,message_id:124,text:'/stop'}} as Update)
-  await until(async()=>!(await runs.list()).some(r=>r.scheduled && r.status==='running'))
  }finally{
   await relay.stop()
   for(const child of children)if(child.exitCode===null && child.signalCode===null)await once(child,'close')

package/test/scheduler.test.ts

@@ -1,13 +1,12 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, rm, writeFile, readFile, stat, symlink, mkdir } from 'node:fs/promises'
+import { mkdtemp, rm, writeFile, readFile, stat } from 'node:fs/promises'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { randomUUID } from 'node:crypto'
 import { Scheduler, scheduledRunId } from '../src/scheduler.js'
 import { RunStore } from '../src/runs.js'
 import { nextOccurrence, validateTrigger, type Trigger } from '../src/schedule-time.js'
-import { taskWorkspace } from '../src/task-workspace.js'
 
 const next=(t:Trigger,after:string)=>{
  const at=nextOccurrence(validateTrigger(t),Date.parse(after));return at===null ? null : new Date(at).toISOString()
@@ -76,19 +75,6 @@ test('pause, edit, removal, owner revocation, corrupt records and traversal fail
  await assert.rejects(f.scheduler.cancel('../bad'))
  await f.scheduler.cancel(run.id);assert.equal(await f.scheduler.cancelled(run.id),true)
 })
-test('task workspaces are distinct and cannot escape through symlinks',async t=>{
- const f=await fixture(t)
- await writeFile(join(f.dir,'private.md'),'Owner context')
- const first=await taskWorkspace(f.dir,'r_one'),second=await taskWorkspace(f.dir,'r_two')
- assert.notEqual(first,second)
- await assert.rejects(readFile(join(first,'private.md'),'utf8'),{code:'ENOENT'})
- await assert.rejects(readFile(join(first,'AGENTS.md'),'utf8'),{code:'ENOENT'})
- await assert.rejects(taskWorkspace(f.dir,'../escape'))
- const other=join(f.dir,'other');await mkdir(other)
- await symlink(other,join(f.dir,'work/tasks/r_link'))
- await assert.rejects(taskWorkspace(f.dir,'r_link'))
-})
-
 test('startup quarantines an interrupted spawn before PID persistence; explicit edit releases its schedule',async t=>{
  const f=await fixture(t),s=await f.scheduler.save({...f.input,trigger:{everySeconds:60,start:new Date(f.now).toISOString()}})
  await f.scheduler.tick(f.owner,f.runs,f.now)

package/test/updates.test.mjs

@@ -13,7 +13,7 @@ import { perform, environment, packageManager, backupStateDirectory } from '../s
 import { atomic, snapshot, compose, prepareCommand } from '../src/plugins/manager.mjs';
 import { bindUpdates } from '../src/updates/binding.mjs';
 import { status as runtimeStatus } from '../src/updates/status.mjs';
-import { providerEnvironment } from '../src/updates/supervisor.mjs';
+import { providerEnvironment, queueAutomatic } from '../src/updates/supervisor.mjs';
 const exec=promisify(execFile);
 
 test('main upgrade backup omits a live plugin socket and keeps private files',async t=>{
@@ -442,6 +442,29 @@ test('npm candidates verify exact version and integrity; automatic policy is enf
  pkg.version='0.1.2';await assert.rejects(prepare(f.home,'main',{release:'0.1.1'}),/version mismatch/);
 });
 
+test('supervisor queues an eligible release once and preserves manual and failed-version gates',async t=>{
+ const f=await fixture(t),data=await fs.readFile(await f.pack());
+ const {createHash}=await import('node:crypto');
+ const pkg={name:'@ez-test/example',version:'0.1.1',dist:{tarball:'https://registry.npmjs.org/@ez-test/example/-/example-0.1.1.tgz',integrity:'sha512-'+createHash('sha512').update(data).digest('base64')}};
+ const original=globalThis.fetch;
+ globalThis.fetch=async url=>new Response(String(url).endsWith('.tgz')?data:JSON.stringify(String(url).endsWith('/0.1.1')?pkg:{name:pkg.name,'dist-tags':{latest:pkg.version},versions:{[pkg.version]:pkg}}));
+ t.after(()=>globalThis.fetch=original);
+ await atomic(path.join(f.home,'updates/supervisor.json'),{at:Date.now()});
+ await command(f.home,['policy','main','manual']);
+ assert.equal(await queueAutomatic(f.home,await command(f.home,['check'])),null);
+ assert.deepEqual(await jobs(f.home),[]);
+ await command(f.home,['policy','main','beta']);
+ const queued=await queueAutomatic(f.home,await command(f.home,['check']));
+ assert.equal(queued.status,'queued');assert.equal(queued.automatic,true);
+ assert.equal(queued.origin.type,'npm');assert.equal(queued.sha256,digest(data));
+ assert.equal(await queueAutomatic(f.home,await command(f.home,['check'])),null);
+ assert.equal((await jobs(f.home)).length,1);
+ queued.status='failed';await atomic(path.join(jobPath(f.home,queued.id),'job.json'),queued);
+ assert.equal(await queueAutomatic(f.home,await command(f.home,['check'])),null);
+ assert.equal((await jobs(f.home)).length,1);
+ await assert.rejects(fs.readFile(path.join(f.agent.controlDir,'update-attention.json')),error=>error.code==='ENOENT');
+});
+
 test('update discovery follows latest while preserving legacy beta and stable-only policies',async t=>{
  const {registryCandidate}=await import('../src/updates/artifact.mjs');
  const name='@ez-test/example',pkg=v=>({name,version:v});

package/src/task-workspace.ts

@@ -1,14 +0,0 @@
-import { mkdir, lstat } from 'node:fs/promises'
-import { join } from 'node:path'
-import { assertId } from './identity.js'
-
-// Fixed, agent-bound path under the control directory, never the workspace
-// mind folder and never a caller-provided cwd. No shared mutable task files.
-export async function taskWorkspace(baseDir: string, id: string): Promise<string> {
-  const dirs=[join(baseDir,'work'),join(baseDir,'work','tasks'),join(baseDir,'work','tasks',assertId(id))]
-  for(const dir of dirs){
-    await mkdir(dir,{recursive:true,mode:0o700})
-    if(!(await lstat(dir)).isDirectory())throw new Error('Task workspace must not be a symlink')
-  }
-  return dirs[2]
-}