@jc_stack/ez-agents 0.1.0-beta.42 → 0.1.0-beta.44

package/src/updates/control.mjs

@@ -2,7 +2,7 @@ import * as fs from 'node:fs/promises';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { parseEnv } from 'node:util';
-import { atomic, locked, snapshot } from '../plugins/manager.mjs';
+import { atomic, locked, snapshot, privateDir, stewardOwned } from '../plugins/manager.mjs';
 import { digest, extract, newer, compatible, version, releaseContract, registryVersion, registryCandidate, download } from './artifact.mjs';
 
 export const read = async file => JSON.parse(await fs.readFile(file,'utf8'));
@@ -129,17 +129,19 @@ export async function eligibility(home,target,root,automatic) {
 }
 export async function prepare(home,target,{file,release}) {
   targetId(target);if(Boolean(file)===Boolean(release))throw Error('Supply one --file tarball or --version exact-version');
-  const {directory}=await state(home);await fs.mkdir(directory,{recursive:true,mode:0o700});
+  const {directory}=await state(home);await privateDir(directory);
   const old=await installed(home,target);
   let data,origin;
   if(file){data=await fs.readFile(file);origin={type:'local'};}
   else {version(release);const pkg=await registryVersion(old.pkg.name,release);data=await download(pkg);origin={type:'npm',name:pkg.name,version:pkg.version,integrity:pkg.dist.integrity};}
-  const id=randomUUID(),dir=path.join(directory,id),root=path.join(dir,'package');await fs.mkdir(dir,{mode:0o700});
+  const id=randomUUID(),dir=path.join(directory,id),root=path.join(dir,'package');await privateDir(dir);
   try {
     await extract(data,root);
+    await stewardOwned(root);
     const next=await eligibility(home,target,root,false);
     if(origin.type==='npm'&&next.pkg.version!==origin.version)throw Error('Artifact version differs from registry metadata');
     await fs.writeFile(path.join(dir,'candidate.tgz'),data,{mode:0o600,flag:'wx'});
+    await stewardOwned(path.join(dir,'candidate.tgz'));
     const job={id,target,source:root,releaseNotes:path.join(root,'CHANGELOG.md'),status:'prepared',version:next.pkg.version,previousVersion:next.old.pkg.version,previousRoot:next.old.root,sha256:digest(data),origin,...(next.deploymentMigration?{deploymentMigration:next.deploymentMigration}:{}),createdAt:new Date().toISOString()};
     await atomic(path.join(dir,'job.json'),job);return job;
   } catch(error){await fs.rm(dir,{recursive:true,force:true});throw error;}

package/src/updates/runtime.mjs

@@ -17,15 +17,15 @@ export function execute(command,args,options={}) {
   return new Promise((resolve,reject)=>{
     const invocation=process.env.EZ_DOCKER_COMPOSE==='standalone'&&command==='docker'&&args[0]==='compose'
       ? {command:'docker-compose',args:args.slice(1)} : {command,args};
-    const child=spawn(invocation.command,invocation.args,{cwd:options.cwd,env:environment(),stdio:['ignore','pipe','pipe']});let output='';
+    const child=spawn(invocation.command,invocation.args,{cwd:options.cwd,env:environment(),stdio:['ignore','pipe','pipe']});let output='',stdout='';
     const timer=setTimeout(()=>child.kill('SIGKILL'),options.timeout||600000);
     const file=options.outputFile?createWriteStream(options.outputFile,{flags:'wx',mode:0o600}):null;
     const written=file?new Promise((resolve,reject)=>{file.once('finish',resolve);file.once('error',reject);}):Promise.resolve();
-    if(file)child.stdout.pipe(file);else child.stdout.on('data',b=>{output=(output+b).slice(-16000);});
+    if(file)child.stdout.pipe(file);else child.stdout.on('data',b=>{output=(output+b).slice(-16000);if(options.stdoutOnly)stdout=(stdout+b).slice(-16000);});
     child.stderr.on('data',b=>{output=(output+b).slice(-16000);});
     void written.catch(()=>child.kill('SIGKILL'));
     child.once('error',error=>{clearTimeout(timer);reject(error);});
-    child.once('close',async code=>{clearTimeout(timer);try{await written;if(code!==0)throw Error(`${invocation.command} failed (${code}): ${output}`);resolve(output);}catch(error){reject(error);}});
+    child.once('close',async code=>{clearTimeout(timer);try{await written;if(code!==0)throw Error(`${invocation.command} failed (${code}): ${output}`);resolve(options.stdoutOnly?stdout:output);}catch(error){reject(error);}});
   });
 }
 export async function textAtomic(file,text) {
@@ -109,8 +109,18 @@ export async function perform(home,job,hooks) {
       await run(process.execPath,['--import',path.join(root,'node_modules/tsx/dist/loader.mjs'),path.join(root,'bin/ezenciel-agents.mjs'),'--version'],{cwd:root});
       try { await replaceGuidance(root, config.workspace, run); }
       catch(error) { console.error(`Workspace guidance replacement failed; upgrade continues: ${error.message}`); }
-      const image=`ez-upgrade-${job.sha256.slice(0,24)}`;
-      await run('docker',['build','--target','runtime','-t',image,root]);
+      // Preserve operator-owned native CLI pins from the effective deployment.
+      // Building only the package defaults silently downgrades those clients.
+      const deployment=JSON.parse(await run('docker',[...relayArgs(config),'config','--format','json'],{stdoutOnly:true}));
+      const args=deployment.services?.relay?.build?.args||{};
+      if(typeof args!=='object'||Array.isArray(args))throw Error('Invalid relay build arguments');
+      const buildArgs=Object.keys(args).sort().flatMap(key=>{
+        const value=args[key];
+        if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)||typeof value!=='string'||value.includes('\0'))throw Error('Unresolved relay build argument');
+        return ['--build-arg',`${key}=${value}`];
+      });
+      const image=`ez-upgrade-${digest(JSON.stringify([job.sha256,buildArgs])).slice(0,24)}`;
+      await run('docker',['build','--target','runtime',...buildArgs,'-t',image,root]);
       const envFile=path.join(config.deploymentDir,'docker.env'),oldEnv=await fs.readFile(envFile,'utf8');
       const cid=(await run('docker',[...relayArgs(config),'ps','-q','relay'])).trim();
       if(!cid||/\s/.test(cid))throw Error('Expected one running relay');
@@ -162,11 +172,21 @@ export async function recover(home,job,hooks) {
   try {
     if(job.rollback) {
       if(job.target==='main') {
-        await run('docker',[...relayArgs(config),'stop','relay']);await hooks.stopHost();
+        // Keep a healthy instance of the exact pinned image when a failed
+        // activation retained it, even if Docker has removed its image index.
+        const pinned=parseEnv(job.rollback.env).EZ_RELAY_IMAGE;
+        const retained=await (async()=>{
+          const id=(await run('docker',[...relayArgs(config),'ps','-q','relay'])).trim();
+          if(!/^[a-f0-9]{12,64}$/i.test(id))return false;
+          const current=JSON.parse(await run('docker',['inspect','--format','{{json .}}',id]));
+          return /^sha256:[a-f0-9]{64}$/.test(pinned||'')&&current.Image===pinned&&current.State?.Running===true&&current.State?.Health?.Status==='healthy';
+        })().catch(()=>false);
+        if(!retained)await run('docker',[...relayArgs(config),'stop','relay']);
+        await hooks.stopHost();
         await textAtomic(path.join(config.deploymentDir,'docker.env'),job.rollback.env);
         await bindUpdates(home,path.join(config.deploymentDir,'host-executor.json'),job.rollback.packageRoot);
         await hooks.startHost(job.rollback.packageRoot);
-        await run('docker',[...relayArgs(config),'up','-d','--wait','--wait-timeout','90','--no-build',...(await relayServices(config))]);
+        if(!retained)await run('docker',[...relayArgs(config),'up','-d','--wait','--wait-timeout','90','--no-build',...(await relayServices(config))]);
       } else {
         const b=job.rollback;
         await run('docker',[...pluginArgs(b.record),'stop']);

package/test/agent-install.test.ts

@@ -24,6 +24,9 @@ test('new agents receive independent projects, secrets and plugin bindings; dupl
     const b=parseEnv(await readFile(join(root,'work/docker.env'),'utf8'))
     assert.equal(a.EZ_ISOLATION,'host-capable')
     assert.equal(a.EZ_EXECUTOR_TRANSPORT,'host')
+    assert.equal(a.EZ_PLUGIN_BROKER_SOCKET,undefined)
+    assert.equal(a.EZ_PLUGIN_BROKER_HOST_CONFIG,undefined)
+    assert.equal(a.COMPOSE_PROFILES,undefined)
     assert.equal(b.EZ_ISOLATION,'host-capable')
     assert.equal(b.EZ_EXECUTOR_TRANSPORT,'host')
     assert.equal(JSON.parse(await readFile(join(root,'family/agent.json'),'utf8')).isolation,'host-capable')
@@ -74,6 +77,9 @@ test('package installer records its CLI before any agent exists; creation inheri
     assert.equal(env.EZ_ISOLATION,'isolated')
     assert.equal(env.EZ_EXECUTOR_TRANSPORT,'local')
     assert.equal(env.EZ_CODEX_SANDBOX,'external')
+    assert.equal(env.EZ_PLUGIN_BROKER_SOCKET,'/private/agents/shopper/control/plugin-broker.sock')
+    assert.equal(env.EZ_PLUGIN_BROKER_HOST_CONFIG,'/private/agents/shopper/host-executor.json')
+    assert.equal(env.COMPOSE_PROFILES,'isolated')
     assert.equal(env.EZ_DELIVERY_TCP_PORT,undefined)
     assert.equal(env.COMPOSE_FILE,'/opt/ez/compose.yaml')
     assert.equal(JSON.parse(await readFile(join(root,'shopper/host-executor.json'),'utf8')).agents[0].toolsHome,'/private/agents/shopper/tools')

package/test/ai-cli.test.ts

@@ -23,8 +23,13 @@ test('explicit CLI/model selection preserves installation default and rejects un
   const state=await store.status();assert.equal(state.ai?.defaultId,'initial')
   assert.equal(state.ai?.presets.find(p=>p.id===state.ai?.selectedId)?.cli,'codex')
   assert.equal(state.activeSession?.cli,'codex')
+  const setDefault=spawnSync(process.execPath,[bin,'default'],{env,encoding:'utf8'})
+  assert.equal(setDefault.status,0,setDefault.stderr)
+  const updated=await store.status()
+  assert.equal(updated.ai?.defaultId,updated.ai?.selectedId)
+  assert.equal(updated.activeSession?.sessionId,state.activeSession?.sessionId)
   assert.notEqual(call('unavailable').status,0)
-  assert.deepEqual(await store.status(),state)
+  assert.deepEqual(await store.status(),updated)
  }finally{await rm(root,{recursive:true,force:true})}
 })
 

package/test/ai.test.ts

@@ -11,7 +11,7 @@ import { InboxStore } from '../src/inbox.js'
 import { executionDefaults } from '../src/model-policy.js'
 import type { Update } from 'grammy/types'
 
-test('same-client model switch does not resume the previous native thread', async () => {
+test('same-client model and default changes preserve history; provider changes require a fresh conversation', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-ai-model-switch-'))
   try {
     const store = new ControlStore(dir, 1000)
@@ -28,34 +28,59 @@ test('same-client model switch does not resume the previous native thread', asyn
     await store.savePreset(luna)
     await store.selectPreset(luna.id, started.sessionId, false)
     const next = await store.captureChoice(initialPreset('codex'))
-    assert.notEqual(next.sessionId, started.sessionId)
+    assert.equal(next.sessionId, started.sessionId)
     assert.equal(next.preset.model, luna.model)
-    assert.equal((await store.executionSession(next)).hasStarted, false)
-    assert.equal((await store.executionSession(next)).nativeSessionId, undefined)
+    assert.equal((await store.executionSession(next)).hasStarted, true)
+    assert.equal((await store.executionSession(next)).nativeSessionId, 'native-deepseek')
     assert.equal((await store.executionSession(started)).nativeSessionId, 'native-deepseek')
-    await store.saveNativeSession(next.sessionId, 'native-luna')
+    assert.equal(started.preset.model, deepseek.model)
     const clientDefault = initialPreset('codex')
     await store.savePreset(clientDefault)
     await store.selectPreset(clientDefault.id, next.sessionId, false)
     const defaultChoice = await store.captureChoice(clientDefault)
-    assert.notEqual(defaultChoice.sessionId, next.sessionId)
+    assert.equal(defaultChoice.sessionId, next.sessionId)
     assert.equal(defaultChoice.preset.model, undefined)
-    await store.saveNativeSession(defaultChoice.sessionId, 'native-default')
+    assert.equal((await store.executionSession(defaultChoice)).nativeSessionId, 'native-deepseek')
     await store.selectPreset(deepseek.id, defaultChoice.sessionId, false)
     const explicitAgain = await store.captureChoice(clientDefault)
-    assert.notEqual(explicitAgain.sessionId, defaultChoice.sessionId)
+    assert.equal(explicitAgain.sessionId, defaultChoice.sessionId)
     assert.equal(explicitAgain.preset.model, deepseek.model)
-    await store.saveNativeSession(explicitAgain.sessionId, 'native-explicit')
     const openrouter = { ...deepseek, id: 'openrouter-deepseek', name: 'OpenRouter DeepSeek', provider: 'openrouter' }
     await store.savePreset(openrouter)
-    await store.selectPreset(openrouter.id, explicitAgain.sessionId, false)
+    assert.equal(await store.selectPreset(openrouter.id, explicitAgain.sessionId, false), false)
+    await store.selectPreset(openrouter.id, explicitAgain.sessionId, true)
     const providerChoice = await store.captureChoice(clientDefault)
     assert.notEqual(providerChoice.sessionId, explicitAgain.sessionId)
     assert.equal(providerChoice.preset.provider, 'openrouter')
     const args = EXECUTOR_REGISTRY.codex.buildArgs({
-      workspace: dir, isResume: false, sessionId: next.sessionId,
+      workspace: dir, isResume: true, sessionId: (await store.executionSession(next)).nativeSessionId,
+      model: next.preset.model, effort: next.preset.effort,
     }, '', '')
-    assert.equal(args.includes('resume'), false)
+    assert.equal(args[args.indexOf('resume') + 1], 'native-deepseek')
+    assert.equal(args[args.indexOf('--model') + 1], luna.model)
+  } finally { await rm(dir, { recursive: true, force: true }) }
+})
+
+test('OpenCode keeps same-provider models together and separates providers encoded in model IDs', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-ai-provider-switch-'))
+  try {
+    const store = new ControlStore(dir, 1000)
+    const first = { id: 'first', name: 'First', cli: 'opencode', model: 'opencode-go/first' }
+    const second = { ...first, id: 'second', name: 'Second', model: 'opencode-go/second' }
+    const other = { ...first, id: 'other', name: 'Other', model: 'openrouter/other' }
+    const choice = await store.captureChoice(first)
+    await store.saveNativeSession(choice.sessionId, 'ses_original')
+    const menu = createAiMenu(store, 'opencode', async () => [first, second, other].map(p => ({ ...p, efforts: [] })), dir, undefined, async () => true)
+    await store.savePreset(second)
+    assert.equal((await menu.select(second, choice.sessionId)).fresh, false)
+    assert.equal((await store.captureChoice(first)).sessionId, choice.sessionId)
+    await store.savePreset(other)
+    assert.equal(await store.selectPreset(other.id, choice.sessionId), false)
+    assert.equal((await menu.select(other, choice.sessionId)).fresh, true)
+    const next = await store.captureChoice(first)
+    assert.notEqual(next.sessionId, choice.sessionId)
+    assert.equal((await store.executionSession(next)).nativeSessionId, undefined)
+    assert.equal((await store.executionSession(choice)).nativeSessionId, 'ses_original')
   } finally { await rm(dir, { recursive: true, force: true }) }
 })
 
@@ -181,7 +206,7 @@ test('Choose AI lists recent choices and installed clients before model and effo
       },
     })
     await menu.list(context() as never)
-    assert.match(replies.at(-1)!.text, /recent choice|installed client/i)
+    assert.match(replies.at(-1)!.text, /Current: codex · fixture-model · medium/)
     assert.deepEqual(replies.at(-1)!.buttons.map((button) => button.text), [
       '✓ Recent · codex · Recent', 'claude', 'codex', 'codex-gui (desktop)', 'Refresh available AIs',
     ])
@@ -200,7 +225,7 @@ test('Choose AI lists recent choices and installed clients before model and effo
     assert.deepEqual({ cli: selected.cli, model: selected.model, effort: selected.effort }, {
       cli: 'codex', model: 'fixture-model', effort: 'high',
     })
-    assert.match(replies.at(-1)!.text, /Selected for this conversation/)
+    assert.match(replies.at(-1)!.text, /Saved for this conversation. History kept/)
   } finally { await rm(dir, { recursive: true, force: true }) }
 })
 
@@ -537,3 +562,33 @@ test('curated models respect installed clients and provider scope', async () =>
     assert.equal(catalog.some(entry => entry.cli === 'pi' && !entry.model), false)
   } finally { await rm(control, { recursive: true, force: true }) }
 })
+
+
+test('private channel model choices do not consume owner preset slots', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-private-ai-capacity-'))
+  try {
+    const store = new ControlStore(dir, 1000)
+    await store.requestPairing(42, 42); await store.approveOwner(42)
+    const initial = initialPreset('codex')
+    await store.captureChoice(initial)
+    for (let n = 1; n < 12; n++) await store.savePreset({...initial, id:`saved-${n}`, name:`Saved ${n}`})
+    const before = (await store.status()).ai!
+    const model = {cli:'codex', model:'gpt-5.6-luna', name:'Luna', efforts:['low','max']}
+    const menu = createAiMenu(store, 'codex', async () => [model], dir, undefined, async () => true)
+    const scope = 'a'.repeat(64)
+    const choice = await store.captureApplicationChoice(initial, scope)
+    await store.saveNativeSession(choice.sessionId, 'private-native-session')
+    const guard = {owner:(await store.status()).owner!, applicationScope:scope, expectedSession:choice.sessionId, authorize:async()=>{}}
+    const preset = await menu.saveSelection(model, 'low', guard)
+    await store.changeApplicationSession(scope, guard, preset)
+    const readback = (await store.applicationSession(scope))!
+    assert.equal(readback.sessionId, choice.sessionId)
+    assert.equal(readback.nativeSessionId, 'private-native-session')
+    assert.equal(readback.preset?.model, model.model)
+    assert.equal(readback.preset?.effort, 'low')
+    assert.deepEqual((await store.status()).ai, before)
+    await assert.rejects(menu.saveSelection(model, 'max'), /at most 12/)
+    await assert.rejects(store.changeApplicationSession(scope, {...guard, expectedSession:null}, preset), /Conversation changed/)
+    assert.deepEqual((await store.applicationSession(scope))?.preset, readback.preset)
+  } finally { await rm(dir, {recursive:true, force:true}) }
+})

package/test/application-controls.test.ts

@@ -145,7 +145,8 @@ test('application controls share native choices, protect hidden scopes and prese
   assert.equal(selected.status,200)
   const modelChoice = await control.captureChoice(menu.initial)
   assert.equal(modelChoice.preset.effort,'high')
-  assert.notEqual(modelChoice.sessionId,old.sessionId)
+  assert.equal(modelChoice.sessionId,old.sessionId)
+  assert.equal((await control.executionSession(modelChoice)).nativeSessionId,'native-private-id')
   assert.deepEqual((await new RunStore(root).get(run.id))!.execution,old)
   const reset = await request({action:'new',expectedSession:modelChoice.sessionId})
   assert.equal(reset.status,200)

package/test/conversation-menu.test.ts

@@ -32,6 +32,8 @@ test('empty placeholders stay out of history and Back edits one panel without cr
       await menu.handle({...ctx, callbackQuery:{data, message:{message_id:1}}} as unknown as Context)
     }
     await click(`chat:open:${choice.sessionId}`)
+    assert.match(text, /AI: grok · client default · default effort/)
+    assert.ok(keyboard!.inline_keyboard.flat().some(b => 'callback_data' in b && b.callback_data === 'menu:ai'))
     const before = await control.status()
     for (let n = 0; n < 5; n++) { await click('chat:list:0:0'); await click(`chat:open:${choice.sessionId}`) }
     assert.deepEqual(await control.status(), before)

package/test/conversations.test.ts

@@ -13,6 +13,32 @@ const fixture = async (work: (store: ControlStore, dir: string) => Promise<void>
   finally { await rm(dir, { recursive: true, force: true }) }
 }
 
+test('named conversations remember model and effort immediately across switches and restart', async () => fixture(async (store, dir) => {
+  const astra = { id: 'astra', name: 'Astra Medium', cli: 'codex', model: 'gpt-6-astra', effort: 'medium' }
+  const sol = { id: 'sol', name: 'Sol High', cli: 'codex', model: 'gpt-6-sol', effort: 'high' }
+  const first = await store.captureChoice(astra, 'Research')
+  await store.saveNativeSession(first.sessionId, 'native_research')
+  await store.resetSession()
+  const second = await store.captureChoice(astra, 'Writing')
+  await store.saveNativeSession(second.sessionId, 'native_writing')
+  await store.savePreset(sol)
+  await store.selectPreset(sol.id, second.sessionId)
+  // No message is needed to save the new choice.
+  assert.deepEqual((await store.getActiveSession())!.preset, sol)
+  const restarted = new ControlStore(dir, 1000)
+  await restarted.switchSession(first.sessionId)
+  assert.deepEqual(await restarted.captureChoice(astra), first)
+  await restarted.switchSession(second.sessionId)
+  assert.deepEqual(await restarted.captureChoice(astra), { sessionId: second.sessionId, preset: sol })
+  await restarted.selectPreset(astra.id, second.sessionId)
+  assert.equal((await restarted.getActiveSession())!.title, 'Writing')
+  assert.equal((await restarted.getActiveSession())!.nativeSessionId, 'native_writing')
+  assert.equal((await restarted.listSessions()).length, 2)
+  // Work admitted before the selection keeps its original choice and binding.
+  assert.deepEqual(second.preset, astra)
+  assert.equal((await restarted.executionSession(second)).nativeSessionId, 'native_writing')
+}))
+
 test('switching after restart restores native context and model while queued choices stay pinned', async () => fixture(async (store, dir) => {
   const first = await store.captureChoice(initialPreset('codex'), 'Client launch')
   await store.saveNativeSession(first.sessionId, 'native_first')

package/test/plugin-broker.test.mjs

@@ -42,11 +42,12 @@ async function fixture(t) {
     revision,
     source,
     project: `ezp-${hash(realHome).slice(0, 16)}-sample`,
-    manifest: { schemaVersion: 1, id: 'sample', version: '1.0.0', commands: { sample: { executable: 'client.mjs', args: [] } }, skills: [] },
+    manifest: { schemaVersion: 1, id: 'sample', version: '1.0.0', commands: { sample: { executable: 'client.mjs', args: [] } }, skills: ['SKILL.md'] },
     deployment: { schemaVersion: 1, services: { sample: { buildTarget: 'runtime', volumes: {}, workspace: false, healthcheck: ['node', '--version'] } }, commands: { sample: { service: 'sample', argv: ['node', '/app/client.mjs'], suffix: [] } }, exports: {} },
     compose: path.join(home, 'packages', 'sample', 'compose.json'),
   };
   await fs.writeFile(path.join(home, 'registry.json'), JSON.stringify({ schemaVersion: 1, owner: realHome, plugins: { sample: record }, commands: { sample: 'sample' } }) + '\n', { mode: 0o600 });
+  await fs.writeFile(path.join(source, 'SKILL.md'), '# Synthetic authoring format\n');
   const fake = path.join(root, 'fake');
   await fs.mkdir(fake, { mode: 0o700 });
   await fs.writeFile(path.join(fake, 'docker'), `#!${process.execPath}
@@ -103,6 +104,13 @@ test('isolated broker authenticates an owned run, pins plugin revision, and writ
     const detailed = await request(f.socket, { version: 1, id: randomUUID(), operation: 'manager', runId: f.runId, args: ['tools', 'list', '--details'] });
     assert.equal(detailed.ok, true);
     assert.deepEqual(JSON.parse(detailed.stdout).sample.commands, ['ez sample --help']);
+    assert.deepEqual(JSON.parse(detailed.stdout).sample.skillReads, [['ez', 'tools', 'skill', 'sample', 'SKILL.md']]);
+    const skill = await request(f.socket, { version: 1, id: randomUUID(), operation: 'manager', runId: f.runId, args: ['tools', 'skill', 'sample', 'SKILL.md'] });
+    assert.equal(skill.code, 0);
+    assert.deepEqual(JSON.parse(skill.stdout), { plugin: 'sample', revision, path: 'SKILL.md', content: '# Synthetic authoring format\n' });
+    const privateFile = await request(f.socket, { version: 1, id: randomUUID(), operation: 'manager', runId: f.runId, args: ['tools', 'skill', 'sample', '../../config.json'] });
+    assert.notEqual(privateFile.code, 0);
+    assert.equal(privateFile.stdout, '');
     const resolved = await request(f.socket, { version: 1, id: randomUUID(), operation: 'resolve', runId: f.runId, alias: 'sample' });
     assert.equal(resolved.ok, true);
     assert.equal(resolved.revision, revision);
@@ -147,6 +155,7 @@ test('broker rejects foreign agent bindings and unsafe management or request fie
   const candidate = path.join(source, 'candidate.tgz');
   await fs.writeFile(candidate, 'candidate');
   await assert.doesNotReject(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['updates', 'prepare', 'sample', '--file', candidate] }, f.workspace));
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['updates', 'prepare', 'main', '--file', candidate] }, f.workspace), /operator preparation/);
   await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['updates', 'prepare', 'sample', '--file', '/tmp/candidate.tgz'] }, f.workspace), /agent workspace/);
   await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['updates', 'prepare', 'sample', '--version', '1.0.1'] }, f.workspace), /not allowed/);
   await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'invoke', runId: 'r_broker', alias: 'sample', revision, capability: 'short', args: [] }), /capability/);
@@ -161,6 +170,9 @@ test('broker rejects resolve and invoke for a revoked run', async t => {
   try {
     await waitForSocket(f.socket);
     await new RunStore(f.controlDir).patch(f.runId, { status: 'cancelled' });
+    const skill = await request(f.socket, { version: 1, id: randomUUID(), operation: 'manager', runId: f.runId, args: ['tools', 'skill', 'sample', 'SKILL.md'] });
+    assert.equal(skill.ok, false);
+    assert.equal(skill.stdout, undefined);
     const resolved = await request(f.socket, { version: 1, id: randomUUID(), operation: 'resolve', runId: f.runId, alias: 'sample' });
     assert.equal(resolved.ok, false);
     const invoked = await request(f.socket, { version: 1, id: randomUUID(), operation: 'invoke', runId: f.runId, alias: 'sample', revision, capability: 'a'.repeat(64), args: [] });

package/test/plugin-manager.test.mjs

@@ -104,12 +104,26 @@ test('installed snippets follow install, upgrade and uninstall without files or
   const before=await fs.readFile(f.log,'utf8'),index=await details();
   assert.equal(index.sample.description,description);assert.deepEqual(index.sample.commands,['ez sample --help']);
   assert.equal(await fs.readFile(index.sample.skills[0],'utf8'),'Synthetic');
+  assert.deepEqual(index.sample.skillReads,[['ez','tools','skill','sample','SKILL.md']]);
+  assert.deepEqual(JSON.parse((await f.call('tools','skill','sample','SKILL.md')).stdout),{plugin:'sample',revision:p.revision,path:'SKILL.md',content:'Synthetic'});
   assert.equal(await fs.readFile(f.log,'utf8'),before);
   assert.deepEqual(JSON.parse((await f.call('tools','list')).stdout),{sample:'sample'});
   await f.call('plugins','uninstall','sample');assert.deepEqual(await details(),{});
  }
  await assert.rejects(fs.access(path.join(f.workspace,'TOOLS.md')),{code:'ENOENT'});
 });
+test('skill reads reject undeclared paths, traversal, symlinks and oversized files',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ for(const requested of ['../config.json','/etc/passwd','client.mjs'])await assert.rejects(f.call('tools','skill','sample',requested),/Unknown installed plugin skill/);
+ await assert.rejects(f.call('tools','skill','foreign','SKILL.md'),/Unknown installed plugin skill/);
+ const r=JSON.parse(await fs.readFile(path.join(f.home,'registry.json'),'utf8')),file=path.join(r.plugins.sample.source,'SKILL.md');
+ await fs.rm(file);await fs.symlink(path.join(f.home,'config.json'),file);
+ await assert.rejects(f.call('tools','skill','sample','SKILL.md'),/symlink/);
+ await fs.rm(file);await fs.writeFile(file,'x'.repeat(64*1024+1));
+ await assert.rejects(f.call('tools','skill','sample','SKILL.md'),/64 KiB/);
+ r.plugins.sample.manifest.skills=['../config.json'];await fs.writeFile(path.join(f.home,'registry.json'),JSON.stringify(r));
+ await assert.rejects(f.call('tools','skill','sample','../config.json'),/Unsafe skill path/);
+});
 test('application plugin context is namespaced, authorized, and absent from ordinary commands',async t=>{
  const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
  const home=await fs.realpath(f.home);
@@ -288,7 +302,17 @@ test('isolated broker allows unbound plugins when another plugin has host bindin
   const c=await compose(config,record,{},f.home);
   assert.equal(c.version,'3.8');assert.equal(c.networks,undefined);
   await fs.writeFile(hostConfig,JSON.stringify({cli:'codex',isolation:'isolated',agents:[{name:'sample',workspace,controlDir:control,binDir:path.join(f.root,'bin'),toolsHome:f.home,pluginNetworkBindings:{sample:{revisions:[p.revision],bindings:[{service:'sample',network:'sample_default'}]}}}]}));
-  await assert.rejects(compose(config,record,{},f.home),/Isolated broker cannot use host network bindings/);
+  const bound=await compose(config,record,{},f.home);
+  const [network]=Object.entries(bound.networks).filter(([name])=>name!=='default');
+  assert.deepEqual(network[1],{external:true,name:'sample_default'});
+  assert.deepEqual(bound.services.sample.networks,['default',network[0]]);
+  const host=JSON.parse(await fs.readFile(hostConfig,'utf8'));
+  host.agents[0].pluginNetworkBindings.sample.revisions=['sha256:'+'f'.repeat(64)];
+  await fs.writeFile(hostConfig,JSON.stringify(host));
+  await assert.rejects(compose(config,record,{},f.home),/not pinned to the reviewed plugin revision/);
+  host.isolation='host-capable';
+  await fs.writeFile(hostConfig,JSON.stringify(host));
+  await assert.rejects(compose(config,record,{},f.home),/requires an isolated host binding/);
  } finally {
   if(previous===undefined)delete process.env.EZ_DOCKER_COMPOSE;else process.env.EZ_DOCKER_COMPOSE=previous;
  }
@@ -343,6 +367,39 @@ test('host install exposes runnable public commands without source aliases',asyn
  assert.match(result.stdout,/Usage: ezenciel-agents-message/);
  const application=await exec(path.join(f.home,'bin','ezenciel-agents-application'),['--help'],{env:{...process.env,PATH:path.dirname(process.execPath)+path.delimiter+process.env.PATH}});
  assert.match(application.stdout,/--token-file/);
+ const help=JSON.parse((await f.call('--help')).stdout);
+ const scheduler=help.native.find(item=>item.argv[0].endsWith('/ezenciel-agents-schedule'));
+ assert.deepEqual(scheduler.argv,[path.join(await fs.realpath(f.home),'bin','ezenciel-agents-schedule'),'--help']);
+ const discovered=await exec(scheduler.argv[0],scheduler.argv.slice(1),{env:f.env});
+ assert.match(discovered.stdout,/list \| runs \| show ID/);
+ assert.ok(help.native.some(item=>item.argv[0].endsWith('/ezenciel-agents-message')));
+ await fs.unlink(scheduler.argv[0]);
+ assert.equal(JSON.parse((await f.call('--help')).stdout).native.some(item=>item.argv[0]===scheduler.argv[0]),false);
+});
+test('host onboarding accepts the creator package bin but rejects unrelated ez collisions',async t=>{
+ for(const packaged of [true,false]) {
+  const f=await fixture(t),config=path.join(f.root,'host.json'),native=packaged?await fs.realpath(new URL('../bin',import.meta.url)):path.join(f.root,'native');
+  if(!packaged){await fs.mkdir(native);await fs.writeFile(path.join(native,'ez'),'unrelated');}
+  await fs.writeFile(config,JSON.stringify({cli:'codex',agents:[{name:'demo',workspace:f.workspace,binDir:native}]}));
+  if(!packaged){await assert.rejects(init(f.home,f.workspace,undefined,config),/Existing ez binding collision/);continue;}
+  await init(f.home,f.workspace,undefined,config);
+  assert.equal((await fs.lstat(path.join(f.home,'bin','ez'))).isSymbolicLink(),false);
+  assert.ok(JSON.parse((await f.call('--help')).stdout).native.some(item=>item.argv[0].endsWith('/ezenciel-agents-schedule')));
+ }
+});
+test('standalone help does not advertise uninstalled native controls',async t=>{
+ const f=await fixture(t);await init(f.home,f.workspace);
+ assert.deepEqual(JSON.parse((await f.call('--help')).stdout).native,[]);
+});
+test('isolated help discovers runnable native controls without a broker or run',async()=>{
+ const client=new URL('../bin/ez',import.meta.url).pathname;
+ const env={PATH:process.env.PATH};
+ const help=JSON.parse((await exec(process.execPath,[client,'--help'],{env})).stdout);
+ const scheduler=help.native.find(item=>item.argv[0].endsWith('/ezenciel-agents-schedule'));
+ assert.ok(scheduler);
+ const result=await exec(scheduler.argv[0],scheduler.argv.slice(1),{env});
+ assert.match(result.stdout,/list \| runs \| show ID/);
+ await assert.rejects(exec(process.execPath,[client,'tools','list'],{env}),/EZ_RUN_ID is required/);
 });
 test('copying another agent registry is rejected before any Docker operation',async t=>{
  const f=await fixture(t),other=path.join(f.root,'other');await init(f.home,f.workspace);await init(other,f.workspace);

package/test/scheduler-host.test.ts

@@ -36,6 +36,7 @@ test('host transport serializes owner schedules and chat in the bound mind',asyn
   assert.ok(await exists('tg_1.request.json'))
   assert.equal(await exists('tg_1.events'),'')
   assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
+  await until(async()=>(await exists(id+'.events')).includes('"stream":"stdout"'))
   const scheduled=JSON.parse(stdout(await exists(id+'.events')))
   assert.equal(scheduled.cwd,await realpath(workspace))
   assert.equal(scheduled.agents,'bound-owner-instructions')

package/test/task-native.test.ts

@@ -11,7 +11,6 @@ import { Tasks } from '../src/tasks.js'
 import { ownerRun } from './helpers/owner-run.js'
 import { EventSources } from '../src/event-sources.js'
 import { ControlStore } from '../src/control-state.js'
-import { ApprovalStore } from '../src/approval.js'
 import { RunStore } from '../src/runs.js'
 import { taskRequests } from '../src/task-rpc.js'
 
@@ -34,9 +33,8 @@ test('native restricted task has only bounded MCP tools, ignores private guidanc
   await ownerRun(root, 'owner')
   await new EventSources(root).register('fixture', `${root}/p.sock`, (await new ControlStore(root, 900000).status()).owner!)
   const tasks = new Tasks(root), drain = taskRequests(tasks)
-  const proposal: any = await tasks.ownerCall('owner', 'propose', { sourceId: 'fixture', conversationId: 'contact-a', purpose: 'Book dinner without payment', context: 'Two people at 7pm', hours: 1 })
-  await new ApprovalStore(root).recordDecision(proposal.id, 'approved', 101)
-  await tasks.decide(proposal.id)
+  const proposal: any = await tasks.ownerCall('owner', 'start', { sourceId: 'fixture', conversationId: 'contact-a', purpose: 'Book dinner without payment', context: 'Two people at 7pm', hours: 1 })
+  assert.equal(proposal.state, 'active')
   const runs = new RunStore(root), run = (await runs.list()).find(r => r.taskId)!
   await runs.patch(run.id, { status: 'running' })
   const sequence = [