@jc_stack/ez-agents 0.1.0-beta.43 → 0.1.0-beta.45

package/AGENTS.md

@@ -120,8 +120,8 @@ round merely to seek more criticism, tests or hypothetical edge cases.
 - **Rate limits:** Avoid spamming bubbles to respect Telegram’s 1 message/sec per-chat rate limit.
 
 ## 6. Concurrency & Workspace Invariants
-- **1 Writer Job per Workspace:** The agent's Markdown folder (`./agent/`) is its mind. Never run concurrent background processes writing to the same workspace simultaneously.
-- Main-conversation and owner-scheduled jobs write the same mind workspace one at a time; the delivery socket carries every cross-process enqueue/receipt, never control/ files. Scheduled jobs keep separate native CLI sessions and control-side task state. Restricted contact tasks retain their separate authorization boundary. Delegation decisions and goal persistence belong to the agent/executor; there is no automatic planner or canned chat ACK. Production executor runs have no wall-clock timeout; cancellation is explicit.
+- **Responsive owner channels:** One foreground turn and one owner-scheduled turn may run concurrently; each stream stays serial. Separate native sessions isolate history and engine state, while the agent-owned Markdown workspace is shared. The engine coordinates shared file updates and plugins guard canonical record writes. Do not add a second reply agent, scheduler or execution queue.
+- The delivery socket carries every cross-process enqueue/receipt, never control/ files. Host plugin workspace invocations remain excluded until both native turns finish. Scheduled jobs keep separate native CLI sessions and control-side task state. Restricted contact tasks retain their separate authorization boundary. Delegation decisions and goal persistence belong to the agent/executor; there is no automatic planner or canned chat ACK. Production executor runs have no wall-clock timeout; cancellation is explicit.
 
 ## 7. Fail-Closed Authority (Channel Access ≠ Execution)
 - Incoming messages outside the approved owner binding must **never** spawn the executor. A first DM or group message records a pending request only. Explicitly approved owner groups grant owner access to all human members in that exact chat; bots and anonymous posts are ignored.

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 0.1.0-beta.45
+
+- Keep owner chat responsive while a scheduled native turn runs. Foreground
+  turns and scheduled turns each stay serial, with separate native sessions.
+  Host workspace invocations remain excluded until both streams finish.
+
+- Expose the existing immediate scheduling command in bounded managed guidance;
+  scope the owner-requested preference to foreground turns and prevent scheduled
+  work from scheduling itself again. Upgrade and rollback render the selected
+  package's guidance while preserving agent-owned text.
+- Support real external agent workspaces and private control directories without
+  deployment convenience symlinks, including plugin grants and updater backups.
+- Treat a concurrently released workspace lock as busy without adding retries,
+  and allow bounded host initialization beyond the former ten-second window.
+- Preserve failed native Codex turn diagnostics for channel delivery instead of
+  losing the failure when a native turn completes without response text.
+
+## 0.1.0-beta.44
+
+- Let isolated native agents read declared installed plugin skills through the
+  existing authorized broker. Discovery supplies literal skill-read commands,
+  so tools such as EzStudy work without copying package instructions into the
+  agent workspace or rebuilding native context.
+- Keep skill reads bound to the installed revision and active authorized run;
+  reject undeclared paths, traversal, symlinks and oversized files.
+
 ## 0.1.0-beta.43
 
 - Keep model and reasoning settings with each named conversation and preserve

package/bin/ez

@@ -88,7 +88,7 @@ const manager = async args => {
 const main = async () => {
   const args = process.argv.slice(2);
   if (!args.length || args[0] === '--help' || args[0] === '-h') {
-    process.stdout.write(JSON.stringify({commands:['tools list [--details]','<registered CLI> ...'],native:await installedNativeHelp(fileURLToPath(new URL('.',import.meta.url)))})+'\n');
+    process.stdout.write(JSON.stringify({commands:['tools list [--details]','tools skill <plugin> <declared-path>','<registered CLI> ...'],native:await installedNativeHelp(fileURLToPath(new URL('.',import.meta.url)))})+'\n');
     return;
   }
   const stdin = ['plugins', 'tools', 'updates', 'status'].includes(args[0]) ? '' : await readStdin();

package/docs/local-qa.md

@@ -16,7 +16,7 @@ Commit, push and open a PR first — then stage only from that PR's exact commit
 ```sh
 node scripts/stage-qa.mjs --source /absolute/feature-checkout \
   --catalog /absolute/deployment/tools/qa --label beta-12 \
-  --version 0.1.0-beta.12.qa.1 --flow /absolute/feature-QA.md
+  --version 0.1.0-beta.12.rc.1 --flow /absolute/feature-QA.md
 ```
 
 `beta-12` is a local catalog label, distinct from public `0.1.0-beta.12`. The

package/docs/plugin-connection.md

@@ -64,8 +64,9 @@ environment. Calls have a 30-second timeout and 256 KiB combined output limit;
 connection frames are limited to 1 MiB. Connection closure aborts pending calls
 and removes their exact command containers. There is no automatic retry.
 
-Arbitrary calls take the same fail-fast workspace lease as non-scheduled native
-jobs. Native work stays pending while a call runs; calls refuse pending/running
+Arbitrary calls take the same fail-fast workspace lease as native jobs. Host
+foreground and scheduled turns share that lease until both finish. Native work
+stays pending while a call runs; calls refuse pending/running
 native work. Ordinary CLI calls inside an admitted native job do not reacquire
 the lease. Isolated scheduled work keeps its existing workspace behavior. A stale
 native `workspace-writer.lock` is recovered at host startup only after its host

package/docs/plugin-guide.md

@@ -57,7 +57,16 @@ At minimum, provide:
   machine-readable commands, stable exit codes, and readback for writes.
 
 The manager snapshots the package according to `package.json.files` plus the
-required manifests and Docker inputs. Keep one canonical checkout; do not keep
+required manifests and Docker inputs. `ez tools list --details` includes
+`skillReads`: literal command argument arrays for reading each installed skill.
+Use `ez tools skill <plugin> <declared-path>` to return its text and pinned
+revision. The isolated executor cannot open private host package paths directly;
+the authorized broker reads only manifest-declared regular skill files, without
+copying them into the agent workspace. Skill reads reject symlinks and files over
+64 KiB. The existing generic discovery footer remains accurate; no plugin-specific
+usage snippet or per-turn instruction is needed for this read contract.
+
+Keep one canonical checkout; do not keep
 permanent packaged copies or a second registry. See the full
 [plugin contribution requirements](plugin-contributions.md) and the
 [plugin manager contract](plugins.md#deployment-descriptors).
@@ -199,4 +208,3 @@ hash.
 
 For contribution, security, and removal details, follow the links above and the
 plugin's own `CONTRIBUTING.md`, `SECURITY.md`, and README.
-

package/docs/plugins.md

@@ -281,6 +281,19 @@ survive command-time Compose regeneration and restarts. Before a routed plugin
 update, the host adds the inspected candidate revision to that route; both the
 current and candidate revisions may remain authorized during the transition.
 
+An isolated broker mounts `host-executor.json` as a read-only file. After the host
+atomically replaces that configuration, recreate the declared broker service
+through the deployment's bound launcher before activating the candidate:
+`ezenciel-agents-docker up -d --no-deps --no-build --force-recreate plugin-broker`.
+This refreshes the file mount without replacing the native relay or its sessions.
+Host-capable executors read the current host file directly. Verify a native plugin
+call and its provider receipt after the configuration change.
+
+Before a data-preserving uninstall, record the host-owned routes and any
+operator-created plugin network's name, labels and IPAM configuration. Restore
+that same network configuration before activation if uninstall removed it;
+private volumes alone do not preserve Docker networks.
+
 This is deployment configuration, not a package-descriptor field or an `ez`
 command: agents and plugins cannot request or alter host networks. The host
 installer owns the binding and must ensure the selected service is stopped
@@ -400,6 +413,12 @@ and `skills`. Descriptions are limited to 200 characters in this view; full
 instructions stay in the skill. Installation, replacement and removal are reflected
 on the next read, without hooks, LLM calls or a cached inventory file.
 
+The additive `skillReads` field supplies literal argument arrays for
+`ez tools skill <plugin> <declared-path>`. This read returns JSON with the
+installed plugin revision, declared path and skill content. Use it in isolated
+agents, where host package paths are private. It reads only the installed
+manifest's skills; arbitrary files, symlinks and files over 64 KiB are rejected.
+
 `ez tools list` retains its alias mapping for existing clients. Native AGENTS.md
 contains only the agent-bound discovery shortcut. New workspaces do not seed
 TOOLS.md, SOUL.md, USER.md, or an `inbox/`/`work/` layout; upgrades preserve

package/docs/responsive-channels.md

@@ -1,10 +1,17 @@
 # Responsive channels
 
-Owner input passes unchanged to the selected engine. The agent decides when to
-delegate or schedule long work to remain available. ez queues foreground input
-while a foreground run is active; it does not create a separate busy-reply agent.
-Owner-scheduled turns use the bound mind workspace under the same single-writer
-limit as foreground turns.
+Owner input passes unchanged to the selected engine. In a foreground owner turn,
+when work can continue independently, the global managed guidance tells the agent
+to prefer an immediate scheduled turn so the foreground channel remains available.
+A scheduled turn executes its assigned work directly instead of scheduling itself
+again. The agent still makes that choice; ez does not infer task duration or
+auto-schedule work. ez queues foreground input while a foreground run is active;
+it does not create a separate busy-reply agent.
+Owner-scheduled turns run independently of the foreground channel stream, so a
+long review does not block chat. Each stream runs one turn at a time. They share
+the agent-owned workspace, but use separate native sessions; session isolation
+does not isolate Markdown files. The agent coordinates shared file updates and
+plugins enforce their canonical record-write contracts.
 
 Background tasks receive literal task text. Their native sessions contain no
 generated role instructions or copied identity files; native workspace instructions

package/docs/scheduling.md

@@ -49,10 +49,14 @@ No identity files or role instructions are generated. Existing workspace Markdow
 provides context, including native `AGENTS.md` discovery and relative links; the
 engine chooses what to read. Per-run native state stays under `control/`.
 
-One writer runs in the agent workspace: owner schedules and foreground turns
-queue behind each other. Foreground inputs queue while another turn runs;
-ez does not create another reply agent. The agent can delegate or schedule long
-work and return to chat. It decides when to send through the message CLI.
+One foreground turn and one owner-scheduled turn can run at the same time.
+Foreground inputs queue behind foreground work; scheduled turns queue behind
+scheduled work. A long scheduled goal therefore does not block chat. Both streams
+use the existing admission and executor path, with separate native sessions.
+They share the agent-owned Markdown workspace: the agent coordinates shared file
+updates, and plugins enforce canonical record-write guards. The host keeps plugin
+workspace invocations excluded until both native turns finish.
+The agent decides when to send through the message CLI.
 A recurring schedule has at most one pending or active occurrence. Shared
 provider resources still need writer coordination. The former four background
 slots are no longer used for owner schedules.
@@ -150,7 +154,7 @@ Telegram delivery, and a sleep test does not prove native goal persistence.
 
 Create a normal recurring schedule with `--every-seconds 900 --when unreviewed-failures --text-file templates/failure-review.md`. The condition advances empty occurrences without launching an executor. It considers only failures belonging to the paired owner. No separate monitor or automatic retry is introduced.
 
-`failures [--all] [--limit N]` returns failedAt, reason, exit code, native session, captured error and runtime versions. Capture keeps at most 4 KiB of redacted stderr; historical failures are not backfilled. `run RUN_ID` reads an owned run. `review RUN_ID --failed-at ISO --status resolved|attention --diagnosis TEXT --recovery TEXT --outcome TEXT` records the investigation without rewriting execution history. A stale timestamp is rejected; a later failure needs a new review. Restricted reply, external and isolated-task callers cannot review failures. An attention review is handed off, not repeatedly relaunched; another new failure wakes the next review.
+`failures [--all] [--limit N]` returns failedAt, reason, exit code, native session, captured error and runtime versions. Capture keeps at most 4 KiB of redacted stderr, including a failed native Codex turn's error message when supplied. A failure without error details remains explicitly unknown; historical failures are not backfilled. `run RUN_ID` reads an owned run. `review RUN_ID --failed-at ISO --status resolved|attention --diagnosis TEXT --recovery TEXT --outcome TEXT` records the investigation without rewriting execution history. A stale timestamp is rejected; a later failure needs a new review. Restricted reply, external and isolated-task callers cannot review failures. An attention review is handed off, not repeatedly relaunched; another new failure wakes the next review.
 
 The prompt controls diagnosis, authorized recovery and quiet notification behavior. Inspect prior effects and receipts before retrying anything. A failed review run itself remains visible as a new failure for the next occurrence.
 

package/docs/upgrades.md

@@ -245,10 +245,15 @@ handbook from workspace `AGENTS.md` (and existing `AGENTS.override.md`).
 Personal text outside that block is preserved byte-for-byte. Do not reinsert
 coding, KISS, contribution or repair loops into operating minds.
 
-The package-owned locator is the managed `<!-- ez tools -->` block: the bound
-`ez` launcher, `ez --help`, and `ez tools list --details`. Inventory is
-generated on read. Plugin registry init and update binding refresh that locator.
+The package-owned guidance is the managed `<!-- ez tools -->` block: the bound
+`ez` launcher, `ez --help`, `ez tools list --details`, and one routing hint for
+foreground owner turns to prefer `ezenciel-agents-schedule create --now` when work
+can continue independently without blocking interaction. The hint tells scheduled
+turns to execute their assigned work directly instead of rescheduling themselves.
+Inventory and full scheduler usage are generated on read. Plugin registry init and update binding refresh that block.
 Malformed markers and symlinks fail visibly rather than overwriting personal work.
+Upgrade and rollback render the block through the exact package root being activated,
+so an already-running package cannot leave stale guidance behind.
 
 Codex, Grok and OpenCode discover workspace instructions natively. Claude
 receives the native `--append-system-prompt-file` binding to `AGENTS.md`, alongside

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jc_stack/ez-agents",
-  "version": "0.1.0-beta.43",
+  "version": "0.1.0-beta.45",
   "private": false,
   "type": "module",
   "description": "A lightweight foundation for persistent business AI assistants using existing AI harnesses, workspaces and plugins.",

package/scripts/stage-qa.mjs

@@ -8,10 +8,10 @@ import {parseArgs} from 'node:util';
 import {digest, extract, version, newer} from '../src/updates/artifact.mjs';
 
 const {values:v}=parseArgs({options:Object.fromEntries(['source','catalog','label','version','flow'].map(k=>[k,{type:'string'}]))});
-if(!['source','catalog','label','version','flow'].every(k=>v[k]))throw Error('Required: --source CHECKOUT --catalog DIRECTORY --label beta-12 --version 0.1.0-beta.12.qa.1 --flow QA.md');
+if(!['source','catalog','label','version','flow'].every(k=>v[k]))throw Error('Required: --source CHECKOUT --catalog DIRECTORY --label beta-12 --version 0.1.0-beta.12.rc.1 --flow QA.md');
 if(!/^beta-[1-9]\d*$/.test(v.label))throw Error('Label must be beta-N');
 version(v.version);
-if(!/^\d+\.\d+\.\d+-beta\.\d+\.qa\.[1-9]\d*$/.test(v.version))throw Error('Use a distinct private version: X.Y.Z-beta.N.qa.BUILD');
+if(!/^\d+\.\d+\.\d+-beta\.\d+\.rc\.[1-9]\d*$/.test(v.version))throw Error('Use a distinct private version: X.Y.Z-beta.N.rc.M');
 const source=await fs.realpath(v.source),catalog=path.resolve(v.catalog);
 const run=(cmd,args,cwd=source)=>execFileSync(cmd,args,{cwd,encoding:'utf8',stdio:['ignore','pipe','pipe']}).trim();
 if(run('git',['status','--porcelain']))throw Error('Commit the reviewed source before staging QA');

package/src/codex-session.ts

@@ -1,4 +1,5 @@
 import { executionDefaults } from './model-policy.js'
+import { redactFailure } from './failure.js'
 import { spawn, type ChildProcess } from 'node:child_process'
 import { createInterface } from 'node:readline'
 import { fileURLToPath } from 'node:url'
@@ -62,7 +63,12 @@ export async function runCodexSession(options:Options, io:{launch?:()=>ChildProc
     if(message.method==='thread/goal/cleared')settled(null)
     if(message.method==='turn/completed'){
       if(activeTurn===message.params.turn.id)activeTurn=undefined
-      if(message.params.turn.status!=='completed'){finish(message.params.turn.status==='interrupted'?130:1);return}
+      if(message.params.turn.status!=='completed'){
+        if(message.params.turn.status==='interrupted')finish(130)
+        else fail(new Error(redactFailure(typeof message.params.turn.error?.message==='string'
+          ? message.params.turn.error.message : 'Native turn failed without error details')))
+        return
+      }
       // Completion of a turn is not completion of a native goal. The native
       // app-server remains running and owns any automatic next turn.
       void request('thread/goal/get',{threadId}).then(result=>settled(result.goal)).catch(fail)

package/src/host-executor.ts

@@ -51,7 +51,7 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
   let catalogRefresh: Promise<void> | undefined
   const locks: string[] = []
   const sharedWorkspaces = new Map<HostBinding, string>()
-  const activeWorkspaces = new Set<HostBinding>()
+  const activeWorkspaces = new Map<HostBinding, { lanes: Set<boolean>; release?: () => Promise<void> }>()
   const additionalWorkspaces = new Map<HostBinding, string[]>()
   const catalog = async (agent: HostBinding) => {
     const discovered = await readModels(undefined, undefined, path.join(agent.controlDir, 'cli', 'codex'),
@@ -158,13 +158,27 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
           }
           const sharedWorkspace=sharedWorkspaces.get(agent)
           const base=path.join(directory,id)
-          if (activeWorkspaces.has(agent)) continue
-          const releaseWorkspace = agent.toolsHome
-            ? await (await import('./plugins/workspace-lease.mjs')).workspaceLease(agent.toolsHome,{kind:'native',runId:id}) : undefined
-          if (agent.toolsHome && !releaseWorkspace) continue
-          activeWorkspaces.add(agent)
+          const scheduled = Boolean(run?.scheduled)
+          let workspace = activeWorkspaces.get(agent)
+          if (workspace?.lanes.has(scheduled)) continue
+          if (!workspace) {
+            const release = agent.toolsHome
+              ? await (await import('./plugins/workspace-lease.mjs')).workspaceLease(agent.toolsHome,{kind:'native',runId:id}) : undefined
+            if (agent.toolsHome && !release) continue
+            workspace = { lanes: new Set(), release }
+            activeWorkspaces.set(agent, workspace)
+          }
+          workspace.lanes.add(scheduled)
+          // Keep plugin workspace invocations excluded until both streams finish.
+          const releaseWorkspace = async () => {
+            workspace.lanes.delete(scheduled)
+            if (!workspace.lanes.size) {
+              activeWorkspaces.delete(agent)
+              await workspace.release?.()
+            }
+          }
           try { await rename(base+'.request.json',base+'.running.json') }
-          catch (error) { activeWorkspaces.delete(agent); await releaseWorkspace?.(); throw error }
+          catch (error) { await releaseWorkspace(); throw error }
           const task=(async()=>{
             let job: Awaited<ReturnType<typeof startExecutorJob>> | undefined
             let cancellation: ReturnType<typeof setInterval> | undefined
@@ -220,7 +234,7 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
               await rm(base+'.process.json',{force:true})
               await rm(base+'.cancel',{force:true})
               active.delete(base)
-              try { await releaseWorkspace?.() } finally { activeWorkspaces.delete(agent) }
+              await releaseWorkspace()
             }
           })()
           tasks.add(task); void task.finally(()=>tasks.delete(task))

package/src/index.ts

@@ -205,8 +205,9 @@ export const createRelay = (config: Config, launch = startExecutorJob) => {
         return
       }
       if (run.scheduled && !(await scheduler.get(run.scheduled.id)).enabled) return
-      // Owner turns and schedules write the same mind. Keep one native writer.
-      if (activeChild || background.size) return
+      // A long scheduled turn must not occupy the owner's chat stream.
+      // Each stream remains serial, with separate native sessions.
+      if (run.scheduled ? background.size > 0 : activeChild !== null) return
       let texts = run.texts
       if (run.external) {
         // Availability failures leave durable queued work for a later check.

package/src/plugin-broker.mjs

@@ -59,6 +59,7 @@ const validateManagerArgs = async (value, workspace) => {
   if (!args.length) throw Error('Missing broker management command');
   const [group, action, name, extra, ...tail] = args;
   if (group === 'tools' && action === 'list' && (args.length === 2 || args.length === 3 && name === '--details')) return args;
+  if (group === 'tools' && action === 'skill' && IDENTIFIER.test(name) && args.length === 4) return args;
   if (group === 'tools' && action === 'exposure' && args.length === 2) return args;
   if (group === 'plugins' && action === 'available' && args.length === 2) return args;
   if (group === 'plugins' && action === 'list' && args.length === 2) return args;

package/src/plugins/manager.mjs

@@ -41,16 +41,24 @@ export async function stewardOwned(file) {
   const parent = await fs.stat(path.dirname(file));
   await fs.chown(file, parent.uid, parent.gid);
 }
-// Only a registry locator lives in native instructions. Inventory is generated on read.
-export async function bindToolDiscovery(home,workspace) {
-  home=await fs.realpath(home);workspace=await fs.realpath(workspace);
+// Native instructions keep only the registry locator and one crucial routing
+// hint. Inventory and full scheduler usage are generated on read.
+export async function toolDiscoveryBlock(home,hostConfig) {
+  home=await fs.realpath(home);
   let launcher=path.join(home,'bin','ez');
-  const config=await json(path.join(home,'config.json')).catch(error=>{if(error.code==='ENOENT')return undefined;throw error;});
+  const config=hostConfig?{hostConfig}:await json(path.join(home,'config.json')).catch(error=>{if(error.code==='ENOENT')return undefined;throw error;});
   if(config?.hostConfig) {
     const host=await json(config.hostConfig);
     if(host.isolation==='isolated') launcher='ez';
   }
   const start='<!-- ez tools: begin -->',end='<!-- ez tools: end -->';
+  const block=start+'\nUse `'+launcher+'`; run it with `--help` or `tools list --details` to discover installed capabilities, and read the matching skill when needed.\nKeep the channel responsive: during a foreground owner turn, prefer `ezenciel-agents-schedule create --now ...` when work can continue independently. A `[schedule ...]` turn executes its assigned work directly and must not schedule it again.\n'+end;
+  if(Buffer.byteLength(block)>600)throw Error('Tool discovery guidance exceeds the 600-byte core budget');
+  return {block,start,end};
+}
+export async function bindToolDiscovery(home,workspace) {
+  home=await fs.realpath(home);workspace=await fs.realpath(workspace);
+  const {block,start,end}=await toolDiscoveryBlock(home);
   for(const name of ['AGENTS.md','AGENTS.override.md']) {
     const file=path.join(workspace,name);
     const stat=await fs.lstat(file).catch(e=>{if(e.code==='ENOENT')return null;throw e;});
@@ -59,7 +67,6 @@ export async function bindToolDiscovery(home,workspace) {
     const prior=stat?await fs.readFile(file,'utf8'):'';
     const from=prior.indexOf(start),to=prior.indexOf(end);
     if((from<0)!==(to<0)||(from>=0&&(to<from||prior.indexOf(start,from+start.length)>=0||prior.indexOf(end,to+end.length)>=0)))throw Error('Malformed tool discovery block');
-    const block=start+'\nInstalled capabilities: `'+launcher+' --help` and `'+launcher+' tools list --details`. Use this bound launcher; read the matching skill when needed.\n'+end;
     const next=from<0?prior+'\n'+block+'\n':prior.slice(0,from)+block+prior.slice(to+end.length);
     if(next===prior)continue;
     const tmp=file+'.'+randomUUID()+'.tmp';
@@ -226,18 +233,11 @@ async function hostFolderRoots(config, record, home) {
   if (!host || typeof host !== 'object' || !Array.isArray(host.agents)) throw Error('Invalid host folder bindings');
   const candidates = host.agents.filter(agent => agent && typeof agent === 'object' && typeof agent.toolsHome === 'string' && realpathSync(agent.toolsHome) === home);
   if (candidates.length !== 1) throw Error('Host folder binding does not belong to this registry');
-  const agent = candidates[0], deployment = path.dirname(hostConfig);
+  const agent = candidates[0];
   if (typeof agent.workspace !== 'string' || typeof agent.controlDir !== 'string' ||
       realpathSync(agent.workspace) !== config.workspace ||
       childOf(hostConfig, config.workspace) || childOf(hostConfig, realpathSync(agent.controlDir)))
     throw Error('Invalid host folder binding deployment');
-  // The isolated broker receives only the exact workspace, control directory,
-  // tools home, and host config mounts. It must not require the host
-  // deployment's convenience mind/control symlinks (or a deployment mount).
-  if (process.env.EZ_DOCKER_COMPOSE !== 'standalone' &&
-      (realpathSync(path.join(deployment, 'mind')) !== config.workspace ||
-       realpathSync(path.join(deployment, 'control')) !== realpathSync(agent.controlDir)))
-    throw Error('Invalid host folder binding deployment');
   const configured = agent.pluginFolderRoots;
   if (configured !== undefined && (!configured || typeof configured !== 'object' || Array.isArray(configured)))
     throw Error('Invalid host folder roots');
@@ -280,7 +280,7 @@ export async function hostNetworkBindings(config, record, home) {
   if (!host || typeof host !== 'object' || !Array.isArray(host.agents)) throw Error('Invalid host network bindings');
   const candidates = host.agents.filter(agent => agent && typeof agent === 'object' && typeof agent.toolsHome === 'string' && realpathSync(agent.toolsHome) === home);
   if (candidates.length !== 1) throw Error('Host network binding does not belong to this registry');
-  const agent = candidates[0], deployment = path.dirname(hostConfig);
+  const agent = candidates[0];
   if (typeof agent.workspace !== 'string' || typeof agent.controlDir !== 'string' ||
       realpathSync(agent.workspace) !== config.workspace ||
       childOf(hostConfig, config.workspace) || childOf(hostConfig, realpathSync(agent.controlDir)))
@@ -292,11 +292,6 @@ export async function hostNetworkBindings(config, record, home) {
   if (route === undefined) return [];
   const isolated = process.env.EZ_DOCKER_COMPOSE === 'standalone';
   if (isolated && host.isolation !== 'isolated') throw Error('Isolated broker requires an isolated host binding');
-  // Like folder grants, network grants use the exact mounted identities. The
-  // broker does not receive the host deployment's convenience symlinks.
-  if (!isolated && (realpathSync(path.join(deployment, 'mind')) !== config.workspace ||
-      realpathSync(path.join(deployment, 'control')) !== realpathSync(agent.controlDir)))
-    throw Error('Invalid host network binding deployment');
   keys(route, ['revisions', 'bindings']);
   const trusted = await snapshot(record.source);
   if (record.revision !== trusted.revision || record.source !== trusted.source ||
@@ -509,6 +504,7 @@ export async function init(home,workspace,catalogFile,hostConfig,standalone=fals
   if(standalone && hostConfig) throw Error('Standalone setup cannot bind a relay host config');
   if(typeof home!=='string'||typeof workspace!=='string'||!path.isAbsolute(home)||!path.isAbsolute(workspace)||/[\r\n\0$:,]/.test(home+workspace)) throw Error('Explicit absolute home/workspace required');
   workspace=await fs.realpath(workspace);await privateDir(home);home=await fs.realpath(home);if(hostConfig)hostConfig=await fs.realpath(hostConfig);
+  await toolDiscoveryBlock(home,hostConfig);
   if(await fs.lstat(path.join(home,'registry.json')).catch(()=>null)) throw Error('Registry already exists; refusing replacement');
   catalogFile=path.resolve(catalogFile||fileURLToPath(new URL('../../default-plugins.json',import.meta.url)));
   const sources=await json(catalogFile);
@@ -600,17 +596,34 @@ export async function main(args) {
     return (await import('./connection.mjs')).connect(home,rest[0],rest.slice(1),{publish:port,serve:true});
   }
   if(group==='tools'&&action==='connect')return (await import('./connection.mjs')).connect(home,rest[0],rest.slice(1));
-  if(group==='--help'||!group) return emit({commands:['status','updates check|policy|prepare|apply|status','plugins available|catalog-add|list|inspect|install|start|stop|status|logs|uninstall|export','tools list [--details]|exposure|connect <alias> <args...>|serve <host-port:container-port> <alias> <args...>','<registered CLI> ...'],native:await installedNativeHelp(path.join(home,'bin')),foreignWorkspace:'Relay-bound registries run only from their owning agent workspace',scope:home});
+  if(group==='--help'||!group) return emit({commands:['status','updates check|policy|prepare|apply|status','plugins available|catalog-add|list|inspect|install|start|stop|status|logs|uninstall|export','tools list [--details]|skill <plugin> <declared-path>|exposure|connect <alias> <args...>|serve <host-port:container-port> <alias> <args...>','<registered CLI> ...'],native:await installedNativeHelp(path.join(home,'bin')),foreignWorkspace:'Relay-bound registries run only from their owning agent workspace',scope:home});
   if(group==='plugins'&&(!action||args.includes('--help'))) return emit({commands:['available','list','inspect <id>','install <id>','start <id>','stop <id>','status <id>','logs <id>','uninstall <id>','catalog-add <id> --source PATH --revision HASH','export <id> <artifact> --output PATH','folder-bind <id> --service NAME --source PATH --target PATH [--writable]','folder-unbind <id> --service NAME --target PATH','folders <id>','shared-enable <id> <service>','shared-disable <id> <service>','shared-status <id> <service>'],uninstall:'Stops and removes containers/network and unregisters aliases; retains all volumes and secrets. No data deletion flag.',scope:home});
   if(group==='plugins'||group==='tools') {
     args=rest;args=args.filter(a=>a!=='--json');
     if(action==='available'&&group==='plugins') return emit(config.catalog);
     const r=await registry(home);
+    if(group==='tools' && action==='skill') {
+      if(args.length!==2)throw Error('Use tools skill <plugin> <declared-path>');
+      const [name,skill]=args,record=r.plugins[id(name)];
+      if(!record || !record.manifest.skills.includes(skill))throw Error('Unknown installed plugin skill');
+      if(path.isAbsolute(skill) || skill.split('/').some(part=>!part || part==='.' || part==='..') || /[\0\r\n]/.test(skill))throw Error('Unsafe skill path');
+      const source=await fs.realpath(record.source);
+      if(source!==record.source || !childOf(source,home))throw Error('Skill source must stay inside installed packages');
+      let file=source;
+      for(const part of skill.split('/')) {
+        file=path.join(file,part);
+        if((await fs.lstat(file)).isSymbolicLink())throw Error('Skill symlinks are not supported');
+      }
+      const stat=await fs.stat(file);
+      if(!stat.isFile() || stat.size>64*1024)throw Error('Skill must be a regular file of at most 64 KiB');
+      return emit({plugin:name,revision:record.revision,path:skill,content:await fs.readFile(file,'utf8')});
+    }
     if(action==='list') {
       if(group==='tools' && args.length===1 && args[0]==='--details')return emit(Object.fromEntries(Object.entries(r.plugins).map(([name,p])=>[name,{
         description:typeof p.manifest.description==='string'?p.manifest.description.replace(/\s+/g,' ').trim().slice(0,200):'',
         commands:Object.keys(p.manifest.commands).map(alias=>`ez ${alias} --help`),
         skills:p.manifest.skills.map(skill=>path.join(p.source,skill)),
+        skillReads:p.manifest.skills.map(skill=>['ez','tools','skill',name,skill]),
       }])));
       if(args.length)throw Error('Use tools list [--details] or plugins list');
       return emit(group==='tools'?r.commands:r.plugins);

package/src/plugins/workspace-lease.mjs

@@ -23,7 +23,7 @@ export async function recoverNativeLease(home) {
 export async function workspaceLease(home,owner={kind:'plugin'}) {
   const file=path.join(home,'workspace-writer.lock'),temp=file+'.'+randomUUID()+'.tmp';
   await fs.writeFile(temp,JSON.stringify({...owner,pid:process.pid}),{flag:'wx',mode:0o600});
-  try {await fs.link(temp,file);}catch(error){if(error.code!=='EEXIST')throw error;const prior=await leaseOwner(file);if(!prior.alive)throw Error('Stale workspace-writer.lock: inspect stopped owner and command containers, then restart for recovery');return undefined;}
+  try {await fs.link(temp,file);}catch(error){if(error.code!=='EEXIST')throw error;let prior;try {prior=await leaseOwner(file);}catch(error){if(error.code==='ENOENT')return undefined;throw error;}if(!prior.alive)throw Error('Stale workspace-writer.lock: inspect stopped owner and command containers, then restart for recovery');return undefined;}
   finally {await fs.rm(temp);}
   return async()=>{await fs.rm(file);};
 }

package/src/runs.ts

@@ -235,7 +235,7 @@ export class RunStore {
 
   async nextQueued(background?: boolean): Promise<RunRecord | undefined> {
     const queued = [...runsFor(this.controlDir).values()].sort((a,b)=>a.createdAt.localeCompare(b.createdAt)).filter((run) => run.status === 'queued' && (background === undefined || Boolean(run.scheduled) === background))
-    return queued.find(run => !run.taskId) ?? queued[0]
+    return queued.find(run => !run.taskId && !run.scheduled) ?? queued.find(run => !run.taskId) ?? queued[0]
   }
 
   async deliveryStatus(): Promise<{ failed: number; unknown: number }> {

package/src/updates/binding.mjs

@@ -1,14 +1,21 @@
 import * as fs from 'node:fs/promises';
 import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { atomic, bindToolDiscovery } from '../plugins/manager.mjs';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { atomic } from '../plugins/manager.mjs';
 import { read } from './control.mjs';
 
+async function packageToolDiscovery(packageRoot,home,workspace) {
+  const entry=path.join(packageRoot,'src/plugins/manager.mjs');
+  const manager=await import(pathToFileURL(entry).href);
+  if(typeof manager.bindToolDiscovery!=='function')throw Error('Selected package has no tool discovery binding');
+  await manager.bindToolDiscovery(home,workspace);
+}
+
 export async function bindUpdates(home,hostConfig,packageRoot=fileURLToPath(new URL('../../',import.meta.url))) {
   home=await fs.realpath(home);hostConfig=await fs.realpath(hostConfig);
-  const config=await read(path.join(home,'config.json')),host=await read(hostConfig),deploymentDir=path.dirname(hostConfig);
-  if(path.basename(hostConfig)!=='host-executor.json'||host.agents.length!==1||host.agents[0].toolsHome!==home||host.agents[0].workspace!==config.workspace)throw Error('Updates require this agent registry and its own single-deployment host config');
-  if(await fs.realpath(path.join(deploymentDir,'mind'))!==config.workspace||await fs.realpath(path.join(deploymentDir,'control'))!==host.agents[0].controlDir)throw Error('Noncanonical deployment state paths');
+  const config=await read(path.join(home,'config.json')),host=await read(hostConfig),deploymentDir=path.dirname(hostConfig),agent=host.agents[0];
+  if(path.basename(hostConfig)!=='host-executor.json'||host.agents.length!==1||agent.toolsHome!==home||agent.workspace!==config.workspace)throw Error('Updates require this agent registry and its own single-deployment host config');
+  if(await fs.realpath(agent.workspace)!==agent.workspace||await fs.realpath(agent.controlDir)!==agent.controlDir)throw Error('Noncanonical deployment state paths');
   packageRoot=await fs.realpath(packageRoot);
   await fs.mkdir(path.join(home,'updates'),{recursive:true,mode:0o700});
   await atomic(path.join(home,'config.json'),{...config,hostConfig,packageRoot:packageRoot.replace(/\/$/,''),deploymentDir});
@@ -19,8 +26,8 @@ export async function bindUpdates(home,hostConfig,packageRoot=fileURLToPath(new
   await fs.writeFile(path.join(bin,'ez'),`#!${process.execPath}\nimport fs from 'node:fs';import {pathToFileURL} from 'node:url';const c=JSON.parse(fs.readFileSync(${configFile}));const m=await import(pathToFileURL(c.packageRoot+'/src/plugins/manager.mjs'));m.main(['--home',${JSON.stringify(home)},...process.argv.slice(2)]).catch(e=>{console.error(e.message);process.exitCode=1});\n`,{mode:0o700});
   for(const [name,entry] of Object.entries(pkg.bin)) {
     const dest=path.join(bin,name);await fs.rm(dest,{force:true});
-    await fs.writeFile(dest,`#!${process.execPath}\nimport fs from 'node:fs';import {spawn} from 'node:child_process';const c=JSON.parse(fs.readFileSync(${configFile}));const child=spawn(c.packageRoot+'/'+${JSON.stringify(entry)},process.argv.slice(2),{stdio:'inherit',env:{...process.env,EZ_DEPLOYMENT_DIR:c.deploymentDir,EZ_CONTROL_DIR:c.deploymentDir+'/control'}});for(const s of ['SIGTERM','SIGINT'])process.on(s,()=>child.kill(s));child.on('error',e=>{console.error(e.message);process.exitCode=1});child.on('close',c=>process.exitCode=c??1);\n`,{mode:0o700});
+    await fs.writeFile(dest,`#!${process.execPath}\nimport fs from 'node:fs';import {spawn} from 'node:child_process';const c=JSON.parse(fs.readFileSync(${configFile}));const child=spawn(c.packageRoot+'/'+${JSON.stringify(entry)},process.argv.slice(2),{stdio:'inherit',env:{...process.env,EZ_DEPLOYMENT_DIR:c.deploymentDir,EZ_CONTROL_DIR:${JSON.stringify(agent.controlDir)}}});for(const s of ['SIGTERM','SIGINT'])process.on(s,()=>child.kill(s));child.on('error',e=>{console.error(e.message);process.exitCode=1});child.on('close',c=>process.exitCode=c??1);\n`,{mode:0o700});
   }
-  await bindToolDiscovery(home,config.workspace);
+  await packageToolDiscovery(packageRoot,home,config.workspace);
   return {ok:true,home,deploymentDir,packageRoot,policy:'Automatic compatible beta-channel updates by default; saved stable-only or manual policies take precedence. Local candidates require an explicit owner request.'};
 }

package/src/updates/runtime.mjs

@@ -90,7 +90,7 @@ async function backupVolume(run,record,name,directory) {
 // Interruptible work is journaled before any running installation is touched.
 // On restart, recovery restores code/config only, never provider journals.
 export async function perform(home,job,hooks) {
-  const run=hooks.execute||execute,{config}=await state(home),dir=jobPath(home,job.id),file=path.join(dir,'job.json');
+  const run=hooks.execute||execute,{config,agent}=await state(home),dir=jobPath(home,job.id),file=path.join(dir,'job.json');
   const save=()=>atomic(file,job);
   if(job.status==='applying'||job.recoveryRequested)return recover(home,job,hooks);
   if(job.status!=='queued')throw Error('Job is not queued');
@@ -129,7 +129,8 @@ export async function perform(home,job,hooks) {
       job.rollback={env:envValue(oldEnv,'EZ_RELAY_IMAGE',oldImage),packageRoot:config.packageRoot};await save();
       await run('docker',[...relayArgs(config),'stop','relay']);await hooks.stopHost();
       const backup=path.join(dir,'backup');await fs.mkdir(backup,{mode:0o700});
-      for(const name of ['mind','control'])await backupStateDirectory(path.join(config.deploymentDir,name),path.join(backup,name));
+      await backupStateDirectory(config.workspace,path.join(backup,'workspace'));
+      await backupStateDirectory(agent.controlDir,path.join(backup,'control'));
       for(const name of ['docker.env','host-executor.json','agent.json','purpose.md','relay.env'])await fs.copyFile(path.join(config.deploymentDir,name),path.join(backup,name));
       let env=oldEnv.split(job.previousRoot+path.sep).join(root+path.sep);env=envValue(env,'EZ_RELAY_IMAGE',image);
       await textAtomic(envFile,env);

package/src/updates/supervisor.mjs

@@ -20,6 +20,16 @@ export function providerEnvironment(host, environment=process.env) {
 }
 
 const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
+export async function waitForHostHeartbeat(controlDir,child,failure,{attempts=300,intervalMs=100,readHeartbeat=read,wait=sleep}={}) {
+  for(let n=0;n<attempts;n++) {
+    const error=failure();
+    if(error||child.exitCode!==null)throw error||Error('Host transport failed to start');
+    const beat=await readHeartbeat(path.join(controlDir,'host-executor/heartbeat.json')).catch(missing);
+    if(beat?.pid===child.pid&&Date.now()-beat.at<10000)return;
+    await wait(intervalMs);
+  }
+  throw Error('Host transport heartbeat timeout');
+}
 export async function idle(control) {
   const host=await fs.readdir(path.join(control,'host-executor')).catch(e=>{if(e.code==='ENOENT')return [];throw e;});
   if(host.some(f=>f.endsWith('.running.json')||f.endsWith('.request.json')))return false;
@@ -67,13 +77,7 @@ export async function supervise(deployment,signal,{discover=check}={}) {
     child=spawn(process.execPath,['--import',path.join(root,'node_modules/tsx/dist/loader.mjs'),path.join(root,'src/host-executor.ts'),path.join(deployment,'host-executor.json')],
       {env:{...environment(),...providerEnvironment(host),EZ_HOST_SUPERVISOR_PID:String(process.pid)},stdio:['ignore','inherit','inherit']});
     let error;child.once('error',e=>{error=e;});
-    for(let n=0;n<100;n++) {
-      if(error||child.exitCode!==null)throw error||Error('Host transport failed to start');
-      const beat=await read(path.join(agent.controlDir,'host-executor/heartbeat.json')).catch(missing);
-      if(beat?.pid===child.pid&&Date.now()-beat.at<10000)return;
-      await sleep(100);
-    }
-    throw Error('Host transport heartbeat timeout');
+    await waitForHostHeartbeat(agent.controlDir,child,()=>error);
   };
   const pause=path.join(agent.controlDir,'upgrade-pause.json');
   const beat=setInterval(()=>{void atomic(path.join(directory,'supervisor.json'),{pid:process.pid,at:Date.now()}).catch(()=>{});},1000);

package/test/codex-session.test.ts

@@ -3,7 +3,9 @@ import assert from 'node:assert/strict'
 import { spawn } from 'node:child_process'
 import { runCodexSession } from '../src/codex-session.js'
 
-for(const mode of ['external','goal','long-goal','plain','tool-goal','blocked','disconnect','approval','late-limit','early-limit','early-clear','missing-goal'])test(`native Codex session: ${mode}`,async()=>{
+for(const mode of ['external','goal','long-goal','plain','tool-goal','blocked','disconnect','approval','late-limit','early-limit','early-clear','missing-goal','failed','failed-redacted','failed-no-error','interrupted'])test(`native Codex session: ${mode}`,async(t)=>{
+  const diagnostics:string[]=[]
+  t.mock.method(console,'error',(...args:unknown[])=>diagnostics.push(args.join(' ')))
   const prompt=mode==='long-goal'?'/goal Complete the research.\n'+'Full workflow context.\n'.repeat(400)+'FINAL_COMPLETION_CRITERION':'test'
   const requests:string[]=[],output:string[]=[]
   const program=`
@@ -24,6 +26,10 @@ if(q.method==='turn/start'){
  send({method:'turn/completed',params:{threadId:'unrelated',turn:{id:'unrelated',status:'completed'}}});start('one');
  if(${JSON.stringify(mode)}==='disconnect')return process.exit(0);
  if(${JSON.stringify(mode)}==='approval')return send({id:999,method:'item/commandExecution/requestApproval',params:{threadId:'native-test'}});
+ if(['failed','failed-redacted','failed-no-error','interrupted'].includes(${JSON.stringify(mode)})){
+  const message=${JSON.stringify(mode)}==='failed-redacted'?'Native provider request failed: Bearer synthetic-private-token https://user:password@example.test/response?api_key=synthetic-private-key':'Native provider request failed';
+  return event('turn/completed',{turn:{id:'one',status:${JSON.stringify(mode)}==='interrupted'?'interrupted':'failed',error:${JSON.stringify(mode)}==='failed-no-error'?null:{message}}});
+ }
  if(${JSON.stringify(mode)}==='missing-goal')event('thread/goal/updated',{goal:{status:'active'}});
  end('one');return;
 }
@@ -57,9 +63,16 @@ if(q.method==='thread/goal/get'){
     assert.equal(threadConfig.model_provider,'openrouter')
     assert.deepEqual(threadConfig['model_providers.openrouter'],{name:'OpenRouter',base_url:'https://openrouter.ai/api/v1',env_key:'OPENROUTER_API_KEY',wire_api:'responses',supports_websockets:false})
   }
-  assert.equal(result,['external','plain','goal','long-goal','tool-goal'].includes(mode)?0:1)
+  assert.equal(result,mode==='interrupted'?130:['external','plain','goal','long-goal','tool-goal'].includes(mode)?0:1)
   assert.equal(requests.filter(x=>x==='turn/start').length,1,'transport must not send goal continuation prompts')
   assert.equal(requests.filter(x=>x==='thread/goal/set').length,0)
   if(mode==='goal')assert.equal(requests.filter(x=>x==='thread/goal/get').length,2,'must wait for the second turn to complete')
+  if(mode==='failed' || mode==='failed-redacted')assert.ok(diagnostics.some(line=>line.includes('Native provider request failed')),'terminal native error must reach existing stderr diagnostics')
+  if(mode==='failed-redacted'){
+    assert.ok(diagnostics.some(line=>line.includes('https://example.test/response')))
+    assert.ok(diagnostics.every(line=>!line.includes('synthetic-private') && !line.includes('user:password')))
+  }
+  if(mode==='failed-no-error')assert.ok(diagnostics.some(line=>line.includes('Native turn failed without error details')))
+  if(mode==='interrupted')assert.equal(diagnostics.length,0,'owner interruption is not a provider failure')
   assert.equal(JSON.parse(output[0]).thread_id,'native-test')
 })

package/test/host-executor.test.ts

@@ -167,7 +167,7 @@ test('one installed CLI executes two agent bindings with separate minds and sani
   let server:Promise<void>|undefined
   try {
     const binary=path.join(root,'cli')
-    await writeFile(binary,`#!${process.execPath}\nif(process.env.EZ_RUN_ID==='r_hold')setInterval(()=>{},1000);console.log(JSON.stringify({cwd:process.cwd(),home:process.env.HOME,token:process.env.TELEGRAM_BOT_TOKEN,control:process.env.EZ_CONTROL_DIR,run:process.env.EZ_RUN_ID,repair:process.env.EZ_REPAIR_ENABLED,args:process.argv.slice(2)}));\n`,{mode:0o700})
+    await writeFile(binary,`#!${process.execPath}\nif(['r_hold','tg_43'].includes(process.env.EZ_RUN_ID))setInterval(()=>{},1000);console.log(JSON.stringify({cwd:process.cwd(),home:process.env.HOME,token:process.env.TELEGRAM_BOT_TOKEN,control:process.env.EZ_CONTROL_DIR,run:process.env.EZ_RUN_ID,repair:process.env.EZ_REPAIR_ENABLED,args:process.argv.slice(2)}));\n`,{mode:0o700})
     await writeFile(path.join(root,'claude'),await readFile(binary),{mode:0o700})
     await writeFile(path.join(root,'codex'),await readFile(binary),{mode:0o700})
     await writeFile(path.join(root,'opencode'),'#!/bin/sh\nexit 0\n',{mode:0o700})
@@ -284,18 +284,32 @@ test('one installed CLI executes two agent bindings with separate minds and sani
       assert.match(output, /"stream":"exit","code":0/)
       return output.trim().split('\n').map(line=>JSON.parse(line))
     }
-    // Another agent remains independent; this agent's queued schedule and chat
-    // wait behind its active owner schedule in the same mind.
+    // Chat completes while this agent's scheduled turn stays active. A second
+    // scheduled turn still waits, and the shared lifecycle lease stays held.
     await completed(otherDirectory,'r_other_shared')
+    const chatEvents=await completed(directory,'tg_42')
     assert.ok(await readFile(path.join(directory,'r_schedule_queued.request.json')))
-    assert.ok(await readFile(path.join(directory,'tg_42.request.json')))
+    assert.equal(await workspaceLease(agents[0].toolsHome),undefined)
+    await ownerRun(agents[0].controlDir,'tg_43')
+    await writeFile(path.join(directory,'tg_43.request.json'),JSON.stringify({texts:['Hold chat'],options:{cli:'grok'}}))
+    for(let n=0;n<100;n++){try{await readFile(path.join(directory,'tg_43.process.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
+    await readFile(path.join(directory,'tg_43.running.json'))
     assert.doesNotMatch(await readFile(path.join(directory,'r_hold.events'),'utf8'),/"stream":"exit"/)
     await readFile(path.join(directory,'r_hold.running.json'))
     await writeFile(path.join(directory,'r_hold.cancel'),'')
     let heldOutput=''
     for(let n=0;n<200;n++){heldOutput=await readFile(path.join(directory,'r_hold.events'),'utf8');if(heldOutput.includes('"stream":"exit"'))break;await new Promise(r=>setTimeout(r,20))}
     assert.match(heldOutput, /"stream":"exit","code":1/)
-    const [scheduleEvents,chatEvents]=await Promise.all([completed(directory,'r_schedule_queued'),completed(directory,'tg_42')])
+    const scheduleEvents=await completed(directory,'r_schedule_queued')
+    // When the scheduled lane finishes first, chat still owns the lease.
+    assert.equal(await workspaceLease(agents[0].toolsHome),undefined)
+    await writeFile(path.join(directory,'tg_43.cancel'),'')
+    for(let n=0;n<100;n++){try{await readFile(path.join(directory,'tg_43.running.json'))}catch{break}await new Promise(r=>setTimeout(r,20))}
+    // The running marker is removed before the lifecycle lease is released.
+    let unlock
+    for(let n=0;n<100;n++){unlock=await workspaceLease(agents[0].toolsHome);if(unlock)break;await new Promise(r=>setTimeout(r,20))}
+    assert.ok(unlock)
+    await unlock()
     const scheduled=JSON.parse(scheduleEvents.filter(e=>e.stream==='stdout').map(e=>e.text).join(''))
     const chat=JSON.parse(chatEvents.filter(e=>e.stream==='stdout').map(e=>e.text).join(''))
     assert.equal(scheduled.cwd,await realpath(agents[0].workspace))

package/test/local-qa.test.mjs

@@ -20,7 +20,7 @@ test('local QA staging preserves source and rejects label replacement and dirty
   git(['init']);git(['add','package.json','feature.txt','run.sh']);
   git(['-c','user.name=QA','-c','user.email=qa@example.invalid','-c','core.hooksPath=/dev/null','-c','commit.gpgsign=false','commit','-m','fixture']);
   const script=fileURLToPath(new URL('../scripts/stage-qa.mjs',import.meta.url));
-  const args=[script,'--source',source,'--catalog',catalog,'--label','beta-12','--version','0.1.0-beta.12.qa.1','--flow',flow];
+  const args=[script,'--source',source,'--catalog',catalog,'--label','beta-12','--version','0.1.0-beta.12.rc.1','--flow',flow];
   const stage=()=>{const prior=process.umask(0o027);try{return execFileSync(process.execPath,args,{stdio:'pipe'}).toString();}finally{process.umask(prior);}};
   try {
     const result=JSON.parse(stage()),data=await fs.readFile(path.join(result.directory,result.file));
@@ -28,7 +28,7 @@ test('local QA staging preserves source and rejects label replacement and dirty
     assert.equal(git(['status','--porcelain']),'');
     await extract(data,path.join(root,'unpacked'));
     const built=JSON.parse(await fs.readFile(path.join(root,'unpacked/package.json'),'utf8'));
-    assert.equal(built.version,'0.1.0-beta.12.qa.1');assert.equal(built.ezQa.commit,result.commit);
+    assert.equal(built.version,'0.1.0-beta.12.rc.1');assert.equal(built.ezQa.commit,result.commit);
     assert.equal(await fs.readFile(path.join(root,'unpacked/feature.txt'),'utf8'),'feature source');
     assert.equal((await fs.stat(path.join(root,'unpacked'))).mode&0o777,0o755);
     assert.equal((await fs.stat(path.join(root,'unpacked/feature.txt'))).mode&0o777,0o644);

package/test/plugin-broker.test.mjs

@@ -42,11 +42,12 @@ async function fixture(t) {
     revision,
     source,
     project: `ezp-${hash(realHome).slice(0, 16)}-sample`,
-    manifest: { schemaVersion: 1, id: 'sample', version: '1.0.0', commands: { sample: { executable: 'client.mjs', args: [] } }, skills: [] },
+    manifest: { schemaVersion: 1, id: 'sample', version: '1.0.0', commands: { sample: { executable: 'client.mjs', args: [] } }, skills: ['SKILL.md'] },
     deployment: { schemaVersion: 1, services: { sample: { buildTarget: 'runtime', volumes: {}, workspace: false, healthcheck: ['node', '--version'] } }, commands: { sample: { service: 'sample', argv: ['node', '/app/client.mjs'], suffix: [] } }, exports: {} },
     compose: path.join(home, 'packages', 'sample', 'compose.json'),
   };
   await fs.writeFile(path.join(home, 'registry.json'), JSON.stringify({ schemaVersion: 1, owner: realHome, plugins: { sample: record }, commands: { sample: 'sample' } }) + '\n', { mode: 0o600 });
+  await fs.writeFile(path.join(source, 'SKILL.md'), '# Synthetic authoring format\n');
   const fake = path.join(root, 'fake');
   await fs.mkdir(fake, { mode: 0o700 });
   await fs.writeFile(path.join(fake, 'docker'), `#!${process.execPath}
@@ -103,6 +104,13 @@ test('isolated broker authenticates an owned run, pins plugin revision, and writ
     const detailed = await request(f.socket, { version: 1, id: randomUUID(), operation: 'manager', runId: f.runId, args: ['tools', 'list', '--details'] });
     assert.equal(detailed.ok, true);
     assert.deepEqual(JSON.parse(detailed.stdout).sample.commands, ['ez sample --help']);
+    assert.deepEqual(JSON.parse(detailed.stdout).sample.skillReads, [['ez', 'tools', 'skill', 'sample', 'SKILL.md']]);
+    const skill = await request(f.socket, { version: 1, id: randomUUID(), operation: 'manager', runId: f.runId, args: ['tools', 'skill', 'sample', 'SKILL.md'] });
+    assert.equal(skill.code, 0);
+    assert.deepEqual(JSON.parse(skill.stdout), { plugin: 'sample', revision, path: 'SKILL.md', content: '# Synthetic authoring format\n' });
+    const privateFile = await request(f.socket, { version: 1, id: randomUUID(), operation: 'manager', runId: f.runId, args: ['tools', 'skill', 'sample', '../../config.json'] });
+    assert.notEqual(privateFile.code, 0);
+    assert.equal(privateFile.stdout, '');
     const resolved = await request(f.socket, { version: 1, id: randomUUID(), operation: 'resolve', runId: f.runId, alias: 'sample' });
     assert.equal(resolved.ok, true);
     assert.equal(resolved.revision, revision);
@@ -162,6 +170,9 @@ test('broker rejects resolve and invoke for a revoked run', async t => {
   try {
     await waitForSocket(f.socket);
     await new RunStore(f.controlDir).patch(f.runId, { status: 'cancelled' });
+    const skill = await request(f.socket, { version: 1, id: randomUUID(), operation: 'manager', runId: f.runId, args: ['tools', 'skill', 'sample', 'SKILL.md'] });
+    assert.equal(skill.ok, false);
+    assert.equal(skill.stdout, undefined);
     const resolved = await request(f.socket, { version: 1, id: randomUUID(), operation: 'resolve', runId: f.runId, alias: 'sample' });
     assert.equal(resolved.ok, false);
     const invoked = await request(f.socket, { version: 1, id: randomUUID(), operation: 'invoke', runId: f.runId, alias: 'sample', revision, capability: 'a'.repeat(64), args: [] });

package/test/plugin-connection.test.mjs

@@ -66,6 +66,17 @@ test('shared workspace lease excludes concurrent writers and refuses queued nati
     await fs.mkdir(path.join(dir,'host-executor'));await fs.writeFile(path.join(dir,'host.json'),JSON.stringify({agents:[{toolsHome:dir,workspace:dir,controlDir:dir}]}));await fs.writeFile(path.join(dir,'config.json'),JSON.stringify({hostConfig:path.join(dir,'host.json'),workspace:dir}));await fs.writeFile(path.join(dir,'host-executor','r.request.json'),'{}');await assert.rejects(invokeLease(dir),/pending/);await fs.rm(path.join(dir,'host-executor','r.request.json'));const unlock=await invokeLease(dir);await unlock();
   }finally{await fs.rm(dir,{recursive:true,force:true});}
 });
+test('workspace lease contention tolerates a concurrent owner release',async()=>{
+  const dir=await fs.mkdtemp(path.join(os.tmpdir(),'ez-lease-release-'));
+  try {
+    for(let n=0;n<100;n++) {
+      const release=await workspaceLease(dir);assert.ok(release);
+      const [,contender]=await Promise.all([release(),workspaceLease(dir)]);
+      if(contender)await contender();
+      const next=await workspaceLease(dir);assert.ok(next);await next();
+    }
+  }finally{await fs.rm(dir,{recursive:true,force:true});}
+});
 test('command output bound and timeout remove exact containers without leaking daemon secrets',async()=>{
   const dir=await fs.mkdtemp(path.join(os.tmpdir(),'ez-bound-'));
   try {

package/test/plugin-manager.test.mjs

@@ -68,13 +68,15 @@ test('catalog paths resolve relative to the catalog and pin each new agent indep
  assert.notEqual(first.sample.revision,next.catalog.sample.revision);
  assert.deepEqual(JSON.parse((await f.call('plugins','available')).stdout),first);
 });
-test('native discovery binding preserves notes and never seeds a tool inventory',async t=>{
+test('native discovery binding preserves notes and adds bounded nonblocking routing guidance',async t=>{
  const f=await fixture(t),instructions=path.join(f.workspace,'AGENTS.md'),notes=path.join(f.workspace,'TOOLS.md');
  await fs.writeFile(instructions,'Owner mandate\n');
  await init(f.home,f.workspace);
  await assert.rejects(fs.access(notes),{code:'ENOENT'});
  const first=await fs.readFile(instructions,'utf8');assert(first.startsWith('Owner mandate\n'));assert(first.includes(f.home+'/bin/ez'));
- assert.match(first,/tools list --details/);assert.match(first,/ --help/);assert.doesNotMatch(first,/ezenciel-agents-message|KISS/);
+ assert.match(first,/tools list --details/);assert.match(first,/`--help`/);assert.match(first,/during a foreground owner turn, prefer `ezenciel-agents-schedule create --now \.\.\.`/);assert.match(first,/A `\[schedule \.\.\.\]` turn executes its assigned work directly and must not schedule it again/);assert.doesNotMatch(first,/ezenciel-agents-message|KISS/);
+ const managed=first.slice(first.indexOf('<!-- ez tools: begin -->'),first.indexOf('<!-- ez tools: end -->')+'<!-- ez tools: end -->'.length);
+ assert.ok(Buffer.byteLength(managed)<=600);
  await bindToolDiscovery(f.home,f.workspace);assert.equal(await fs.readFile(instructions,'utf8'),first);
  await fs.writeFile(notes,'Legacy policy');
  await bindToolDiscovery(f.home,f.workspace);assert.equal(await fs.readFile(notes,'utf8'),'Legacy policy');
@@ -91,7 +93,20 @@ test('isolated discovery uses the relay-bound ez client without exposing toolsHo
  const f=await fixture(t);await fs.mkdir(f.home);const workspace=await fs.realpath(f.workspace),controlDir=await fs.realpath(f.control),toolsHome=await fs.realpath(f.home),host={cli:'codex',isolation:'isolated',agents:[{name:'sample',workspace,controlDir,binDir:path.join(f.root,'bin'),toolsHome}]};
  await fs.mkdir(path.join(f.root,'bin'));await fs.writeFile(f.hostConfig,JSON.stringify(host));
  await init(f.home,f.workspace,undefined,f.hostConfig);
- const instructions=await fs.readFile(path.join(f.workspace,'AGENTS.md'),'utf8');assert.match(instructions,/`ez tools list --details`/);assert.doesNotMatch(instructions,new RegExp(f.home.replace(/[.*+?^${}()|[\]\\]/g,'\\$&')));
+ const instructions=await fs.readFile(path.join(f.workspace,'AGENTS.md'),'utf8');assert.match(instructions,/Use `ez`/);assert.match(instructions,/`tools list --details`/);assert.doesNotMatch(instructions,new RegExp(f.home.replace(/[.*+?^${}()|[\]\\]/g,'\\$&')));
+});
+test('discovery rejects an over-budget launcher before rewriting instructions',async t=>{
+ const f=await fixture(t),instructions=path.join(f.workspace,'AGENTS.md'),longHome=path.join(f.root,'h'.repeat(200),'n'.repeat(200));
+ await fs.mkdir(longHome,{recursive:true});await fs.writeFile(instructions,'Owner mandate\n');
+ await assert.rejects(bindToolDiscovery(longHome,f.workspace),/600-byte core budget/);
+ assert.equal(await fs.readFile(instructions,'utf8'),'Owner mandate\n');
+});
+test('standalone init rejects over-budget guidance before creating activation state',async t=>{
+ const f=await fixture(t),instructions=path.join(f.workspace,'AGENTS.md'),longHome=path.join(f.root,'i'.repeat(200),'j'.repeat(200)),catalog=path.join(f.root,'empty-catalog.json');
+ await fs.writeFile(catalog,'{}');await fs.writeFile(instructions,'Owner mandate\n');
+ await assert.rejects(initManager(longHome,f.workspace,catalog,undefined,true),/600-byte core budget/);
+ assert.deepEqual(await fs.readdir(longHome),[]);
+ assert.equal(await fs.readFile(instructions,'utf8'),'Owner mandate\n');
 });
 test('installed snippets follow install, upgrade and uninstall without files or Docker reads',async t=>{
  const f=await fixture(t);await init(f.home,f.workspace);
@@ -104,12 +119,26 @@ test('installed snippets follow install, upgrade and uninstall without files or
   const before=await fs.readFile(f.log,'utf8'),index=await details();
   assert.equal(index.sample.description,description);assert.deepEqual(index.sample.commands,['ez sample --help']);
   assert.equal(await fs.readFile(index.sample.skills[0],'utf8'),'Synthetic');
+  assert.deepEqual(index.sample.skillReads,[['ez','tools','skill','sample','SKILL.md']]);
+  assert.deepEqual(JSON.parse((await f.call('tools','skill','sample','SKILL.md')).stdout),{plugin:'sample',revision:p.revision,path:'SKILL.md',content:'Synthetic'});
   assert.equal(await fs.readFile(f.log,'utf8'),before);
   assert.deepEqual(JSON.parse((await f.call('tools','list')).stdout),{sample:'sample'});
   await f.call('plugins','uninstall','sample');assert.deepEqual(await details(),{});
  }
  await assert.rejects(fs.access(path.join(f.workspace,'TOOLS.md')),{code:'ENOENT'});
 });
+test('skill reads reject undeclared paths, traversal, symlinks and oversized files',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ for(const requested of ['../config.json','/etc/passwd','client.mjs'])await assert.rejects(f.call('tools','skill','sample',requested),/Unknown installed plugin skill/);
+ await assert.rejects(f.call('tools','skill','foreign','SKILL.md'),/Unknown installed plugin skill/);
+ const r=JSON.parse(await fs.readFile(path.join(f.home,'registry.json'),'utf8')),file=path.join(r.plugins.sample.source,'SKILL.md');
+ await fs.rm(file);await fs.symlink(path.join(f.home,'config.json'),file);
+ await assert.rejects(f.call('tools','skill','sample','SKILL.md'),/symlink/);
+ await fs.rm(file);await fs.writeFile(file,'x'.repeat(64*1024+1));
+ await assert.rejects(f.call('tools','skill','sample','SKILL.md'),/64 KiB/);
+ r.plugins.sample.manifest.skills=['../config.json'];await fs.writeFile(path.join(f.home,'registry.json'),JSON.stringify(r));
+ await assert.rejects(f.call('tools','skill','sample','../config.json'),/Unsafe skill path/);
+});
 test('application plugin context is namespaced, authorized, and absent from ordinary commands',async t=>{
  const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
  const home=await fs.realpath(f.home);
@@ -276,6 +305,19 @@ test('isolated broker host binding validates exact mounts without deployment sym
   if(previous===undefined)delete process.env.EZ_DOCKER_COMPOSE;else process.env.EZ_DOCKER_COMPOSE=previous;
  }
 });
+test('host-capable binding validates an external real workspace without deployment symlinks',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source),workspace=path.join(f.root,'external-workspace');
+ await fs.rm(f.workspace,{recursive:true});await fs.mkdir(workspace);await fs.mkdir(f.home);
+ const binding={service:'sample',network:'sample_default'};
+ await fs.writeFile(f.hostConfig,JSON.stringify({cli:'synthetic',agents:[{name:'sample',workspace,controlDir:f.control,binDir:path.join(f.root,'bin'),toolsHome:f.home,pluginNetworkBindings:{sample:{revisions:[p.revision],bindings:[binding]}}}]}));
+ const realWorkspace=await fs.realpath(workspace),config={workspace:realWorkspace,hostConfig:await fs.realpath(f.hostConfig),folders:{sample:[{service:'sample',source:realWorkspace,target:'/data/files'}]}};
+ const record={source:p.source,project:'ezp-synthetic',revision:p.revision,manifest:p.manifest,deployment:p.deployment};
+ const c=await compose(config,record,{},f.home);
+ assert.equal(c.services.sample.volumes.find(volume=>volume.target===realWorkspace).source,realWorkspace);
+ assert.equal(c.services.sample.volumes.find(volume=>volume.target==='/data/files').source,realWorkspace);
+ const network=Object.values(c.networks).find(candidate=>candidate.name==='sample_default');
+ assert.deepEqual(network,{external:true,name:'sample_default'});
+});
 test('isolated broker allows unbound plugins when another plugin has host binding',async t=>{
  const f=await fixture(t),p=await snapshot(f.source),isolated=path.join(f.root,'isolated-other'),workspace=path.join(isolated,'workspace'),control=path.join(isolated,'control'),hostConfig=path.join(isolated,'host-executor.json'),previous=process.env.EZ_DOCKER_COMPOSE;
  await fs.mkdir(f.home,{recursive:true});await fs.mkdir(workspace,{recursive:true});await fs.mkdir(control,{recursive:true});

package/test/scheduler-host.test.ts

@@ -11,7 +11,7 @@ import { RunStore } from '../src/runs.js'
 
 const until=async(check:()=>Promise<boolean>)=>{for(let n=0;n<250;n++){if(await check())return;await new Promise(r=>setTimeout(r,20))}throw new Error('Host probe timed out')}
 const stdout=(events:string) => events.trim().split('\n').filter(Boolean).map(line=>JSON.parse(line)).filter(event=>event.stream==='stdout').map(event=>event.text).join('')
-test('host transport serializes owner schedules and chat in the bound mind',async()=>{
+test('host transport keeps chat responsive beside a schedule in the bound mind',async()=>{
  const root=await mkdtemp(join(tmpdir(),'ez-scheduler-host-')),workspace=join(root,'agent'),controlDir=join(root,'control')
  await mkdir(workspace);await mkdir(controlDir)
  await writeFile(join(workspace,'AGENTS.md'),'bound-owner-instructions')
@@ -32,9 +32,7 @@ test('host transport serializes owner schedules and chat in the bound mind',asyn
   await submit(id)
   await until(async()=>Boolean(await exists(id+'.process.json')))
   await submit('tg_1')
-  await new Promise(resolve=>setTimeout(resolve,300))
-  assert.ok(await exists('tg_1.request.json'))
-  assert.equal(await exists('tg_1.events'),'')
+  await until(async()=>(await exists('tg_1.events')).includes('"stream":"exit","code":0'))
   assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
   await until(async()=>(await exists(id+'.events')).includes('"stream":"stdout"'))
   const scheduled=JSON.parse(stdout(await exists(id+'.events')))
@@ -47,7 +45,8 @@ test('host transport serializes owner schedules and chat in the bound mind',asyn
   assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
   await ownerRun(controlDir,'tg_2')
   await submit('tg_2')
-  assert.ok(await exists('tg_2.request.json'))
+  await until(async()=>(await exists('tg_2.events')).includes('"stream":"exit","code":0'))
+  assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
   await writeFile(join(dir,id+'.cancel'),'')
   await until(async()=>(await exists(id+'.events')).includes('"stream":"exit"'))
   await until(async()=>(await exists('tg_1.events')).includes('"stream":"exit","code":0'))

package/test/scheduler-relay.test.ts

@@ -44,7 +44,50 @@ test('a wrapper-shaped run id has no maintenance treatment and a stale notice is
  }finally{await relay.stop();await rm(dir,{recursive:true,force:true})}
 })
 
-test('owner chat queues behind a scheduled CLI in the same workspace; targeted cancellation',async()=>{
+test('Slack application replies beside a schedule and keeps both streams serial',async()=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-slack-scheduled-')),runs=new RunStore(dir),scheduler=new Scheduler(dir),control=new ControlStore(dir,1000)
+ const children=new Map<string,ReturnType<typeof spawn>>()
+ const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture'},async(_texts,options)=>{
+  const child=spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:process.platform!=='win32'})
+  children.set(options.runId,child);await once(child,'spawn')
+  if(!options.runId.startsWith('r_schedule_'))await runs.enqueueMessage(options.runId,'Slack reply')
+  return {child,cleanup:async()=>{},stdout:''}
+ })
+ try{
+  await control.requestPairing(101,101);await control.approveOwner(101)
+  const owner=(await control.status()).owner!,execution=await control.captureChoice(initialPreset('grok'))
+  const due=Date.now()+10000
+  for(const id of ['first','second'])await scheduler.save({id,name:id,text:'Long work',trigger:{at:new Date(due).toISOString()},enabled:true,owner,execution})
+  await scheduler.tick(owner,runs,due);await relay.drainSources()
+  const scheduled=(await runs.list()).filter(run=>run.scheduled)
+  assert.deepEqual(scheduled.map(run=>run.status),['running','queued'])
+  const binding=(await relay.applicationChannel.bindings.register('slack','s'.repeat(48),owner))!
+  const scope='slack:T_FIXTURE:C_FIXTURE'
+  const first=await relay.applicationChannel.submit(binding.bindingId,{requestId:'event-1',scope,text:'Top twenty'})
+  await until(async()=>children.has(first.id));await relay.drainOutbox()
+  assert.equal((await relay.applicationChannel.snapshot(binding.bindingId,first.id)).messages[0].text,'Slack reply')
+  assert.equal((await runs.get(scheduled[0].id))?.status,'running')
+  const second=await relay.applicationChannel.submit(binding.bindingId,{requestId:'event-2',scope,text:'Next question'})
+  await relay.drainSources()
+  assert.equal((await runs.get(second.id))?.status,'queued')
+  assert.equal(children.size,2)
+  // Revoking the channel stops only its foreground work; background authority
+  // and the original one-occurrence-per-schedule limit remain intact.
+  await relay.applicationChannel.bindings.register('slack',null,owner)
+  await relay.drainSources()
+  await until(async()=> (await runs.get(first.id))?.status==='cancelled')
+  await relay.drainSources()
+  assert.equal((await runs.get(second.id))?.status,'cancelled')
+  assert.equal((await runs.get(scheduled[0].id))?.status,'running')
+  assert.equal((await runs.get(scheduled[1].id))?.status,'queued')
+ }finally{
+  await relay.stop()
+  await until(async()=>!(await runs.list()).some(run=>run.status==='running'))
+  await rm(dir,{recursive:true,force:true})
+ }
+})
+
+test('owner chat replies while a scheduled CLI keeps running; targeted cancellation',async()=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-scheduler-relay-')), children:ReturnType<typeof spawn>[]=[]
  const runs=new RunStore(dir),scheduler=new Scheduler(dir),control=new ControlStore(dir,1000)
  const replies:string[]=[], workspaces:string[]=[]
@@ -67,19 +110,18 @@ test('owner chat queues behind a scheduled CLI in the same workspace; targeted c
   const [background]=await runs.list()
   assert.equal(background.status,'running')
   const update:Update={update_id:123,message:{message_id:123,date:0,text:'What is 17 × 19?',from:{id:101,is_bot:false,first_name:'Fixture'},chat:{id:101,type:'private',first_name:'Fixture'}}}
-  await relay.bot.handleUpdate(update);await relay.drainInbox(true);await relay.drainOutbox()
-  assert.ok(!replies.includes('323'))
+  await relay.bot.handleUpdate(update);await relay.drainInbox(true)
+  await until(async()=>children.length===2)
+  await relay.drainOutbox()
+  assert.ok(replies.includes('323'))
   assert.equal((await runs.get(background.id))?.status,'running')
   assert.equal(children[0].exitCode,null)
-  assert.deepEqual(workspaces,[dir])
+  assert.deepEqual(workspaces,[dir,dir])
   // Pausing future dispatch doesn't kill active work; cancelling this run does.
   await scheduler.enable('slow',false);await relay.drainSources()
   assert.equal(children[0].exitCode,null)
   await scheduler.cancel(background.id);await relay.drainSources()
   await until(async()=> (await runs.get(background.id))?.status==='cancelled')
-  await until(async()=>children.length===2)
-  await relay.drainOutbox()
-  assert.ok(replies.includes('323'))
   assert.deepEqual(workspaces,[dir,dir])
   assert.equal((await runs.list()).filter(r=>r.scheduled).length,1)
  }finally{

package/test/updates.test.mjs

@@ -13,7 +13,7 @@ import { perform, environment, packageManager, backupStateDirectory, execute } f
 import { atomic, snapshot, compose, prepareCommand } from '../src/plugins/manager.mjs';
 import { bindUpdates } from '../src/updates/binding.mjs';
 import { status as runtimeStatus } from '../src/updates/status.mjs';
-import { providerEnvironment, queueAutomatic } from '../src/updates/supervisor.mjs';
+import { providerEnvironment, queueAutomatic, waitForHostHeartbeat } from '../src/updates/supervisor.mjs';
 const exec=promisify(execFile);
 
 test('structured runtime output excludes warnings but failures retain diagnostics',async()=>{
@@ -42,6 +42,14 @@ test('supervisor forwards only provider keys declared by the agent installation'
  for(const envKey of ['PATH','HOME','CODEX_HOME','NODE_OPTIONS','EZ_CONTROL_DIR','TELEGRAM_BOT_TOKEN'])
   assert.throws(()=>providerEnvironment({agents:[{codexProviders:[{envKey}]}]},{}),/Reserved Codex provider environment key/);
 });
+test('host startup gate tolerates initialization beyond the former ten-second window',async()=>{
+ let reads=0;
+ await waitForHostHeartbeat('/control',{pid:42,exitCode:null},()=>undefined,{
+  attempts:120,intervalMs:0,wait:async()=>{},
+  readHeartbeat:async()=>++reads===111?{pid:42,at:Date.now()}:null,
+ });
+ assert.equal(reads,111);
+});
 const contract=kind=>({protocol:1,kind,stateSchema:1,mainProtocol:1});
 function tar(entries) {
  const chunks=[];
@@ -56,7 +64,8 @@ async function fixture(t,kind='main') {
  const deployment=path.join(root,'agent'),home=path.join(deployment,'tools'),old=path.join(root,'old'),source=path.join(root,'candidate');
  for(const d of [home,old,source,path.join(home,'bin'),path.join(home,'updates'),path.join(deployment,'mind'),path.join(deployment,'control')])await fs.mkdir(d,{recursive:true});
  const pkg={name:'@ez-test/example',version:'0.1.0',packageManager:'pnpm@10.30.3',type:'module',files:['bin','src','docker','compose.yaml','compose.whatsapp.yaml','.dockerignore','Dockerfile'],bin:{example:'bin/example.mjs'},ezRelease:contract(kind)};
- const files={'package.json':JSON.stringify(pkg),'compose.yaml':'services: {}\n','compose.whatsapp.yaml':'services: {}\n','.dockerignore':'','Dockerfile':'FROM scratch AS runtime','docker/pnpm-lock.yaml':'lockfileVersion: 9.0\n','src/host-executor.ts':'','bin/example.mjs':'#!/usr/bin/env node\nconsole.log("example")','bin/ezenciel-agents.mjs':'console.log("0.1.1")'};
+ const guidance=text=>`export async function bindToolDiscovery(_home,workspace){const fs=await import('node:fs/promises');await fs.writeFile(workspace+'/AGENTS.md',${JSON.stringify(text+'\n')});}\n`;
+ const files={'package.json':JSON.stringify(pkg),'compose.yaml':'services: {}\n','compose.whatsapp.yaml':'services: {}\n','.dockerignore':'','Dockerfile':'FROM scratch AS runtime','docker/pnpm-lock.yaml':'lockfileVersion: 9.0\n','src/host-executor.ts':'','src/plugins/manager.mjs':guidance('old guidance'),'bin/example.mjs':'#!/usr/bin/env node\nconsole.log("example")','bin/ezenciel-agents.mjs':'console.log("0.1.1")'};
  let record,target='main';
  if(kind==='plugin') {
   target='sample';files['ez-plugin.json']=JSON.stringify({schemaVersion:1,id:'sample',version:pkg.version,commands:{sample:{executable:'bin/example.mjs',args:[]}},skills:[]});
@@ -76,11 +85,19 @@ async function fixture(t,kind='main') {
   await atomic(record.compose,await compose(config,record,{},home));
  }
  await atomic(path.join(home,'registry.json'),{schemaVersion:1,owner:home,plugins:record?{sample:record}:{},commands:record?{sample:'sample'}:{}});
- await fs.cp(old,source,{recursive:true});pkg.version='0.1.1';await atomic(path.join(source,'package.json'),pkg);
+ await fs.cp(old,source,{recursive:true});pkg.version='0.1.1';await atomic(path.join(source,'package.json'),pkg);await fs.writeFile(path.join(source,'src/plugins/manager.mjs'),guidance('candidate guidance'));
  if(kind==='plugin'){const m=await read(path.join(source,'ez-plugin.json'));m.version=pkg.version;await atomic(path.join(source,'ez-plugin.json'),m);}
  const pack=async()=>{const entries=[];async function walk(dir,prefix=''){for(const e of await fs.readdir(dir,{withFileTypes:true})){const rel=prefix+e.name;if(e.isDirectory())await walk(path.join(dir,e.name),rel+'/');else entries.push(['package/'+rel,await fs.readFile(path.join(dir,e.name))]);}}await walk(source);const file=path.join(root,'candidate.tgz');await fs.writeFile(file,tar(entries));return file;};
  return {root,home,old,source,agent,config,record,target,pack};
 }
+async function externalState(f) {
+ const workspace=path.join(f.root,'workspace'),controlDir=path.join(f.root,'control');
+ await fs.rename(f.agent.workspace,workspace);await fs.rename(f.agent.controlDir,controlDir);
+ f.agent.workspace=workspace;f.agent.controlDir=controlDir;f.config.workspace=workspace;
+ await atomic(path.join(f.config.deploymentDir,'host-executor.json'),{cli:'grok',agents:[f.agent]});
+ await atomic(path.join(f.home,'config.json'),f.config);
+ return f;
+}
 test('root preparation leaves private plugin updates readable by the installer', {
  skip:process.platform!=='linux'||process.geteuid?.()!==0,
 },async t=>{
@@ -267,12 +284,14 @@ test('reviewed Library beta14 command migration is exact and fail-closed',()=>{
  const unsafe=structuredClone(next);unsafe.deployment.services.library.cpus=4;assert.equal(reviewedPluginDeploymentMigration('library',old,unsafe),undefined);
 });
 test('main transaction stages before stopping, pins rollback image, preserves state and rebinds root',async t=>{
- const f=await fixture(t),job=await queued(f),r=runtime(f);
+ const f=await externalState(await fixture(t)),job=await queued(f),r=runtime(f);
  await fs.writeFile(path.join(f.agent.workspace,'memory.md'),'retain me');
  // Mutable preparation files cannot alter the verified archive executed later.
  await fs.writeFile(path.join(jobPath(f.home,job.id),'package/bin/example.mjs'),'tampered');
  const result=await perform(f.home,job,r);assert.equal(result.status,'completed');
  assert.equal(await fs.readFile(path.join(f.agent.workspace,'memory.md'),'utf8'),'retain me');
+ assert.equal(await fs.readFile(path.join(jobPath(f.home,job.id),'backup/workspace/memory.md'),'utf8'),'retain me');
+ await assert.rejects(fs.access(path.join(f.config.deploymentDir,'mind')));
  const active=(await read(path.join(f.home,'config.json'))).packageRoot;assert(active.endsWith('/runtime'));
  assert.notEqual(await fs.readFile(path.join(active,'bin/example.mjs'),'utf8'),'tampered');
  assert(r.calls.findIndex(c=>c.includes('build'))<r.calls.findIndex(c=>c[0]==='stopHost'));
@@ -281,6 +300,16 @@ test('main transaction stages before stopping, pins rollback image, preserves st
  const status=await command(f.home,['status']);assert(!JSON.stringify(status).includes('private-test-token'));assert(!('rollback'in status.jobs[0]));
  assert.equal((await fs.stat(path.join(jobPath(f.home,job.id),'job.json'))).mode&0o777,0o600);
 });
+test('main activation and rollback bind guidance from the selected package root',async t=>{
+ const success=await fixture(t);await bindUpdates(success.home,path.join(success.config.deploymentDir,'host-executor.json'),success.old);
+ assert.equal(await fs.readFile(path.join(success.agent.workspace,'AGENTS.md'),'utf8'),'old guidance\n');
+ assert.equal((await perform(success.home,await queued(success),runtime(success))).status,'completed');
+ assert.equal(await fs.readFile(path.join(success.agent.workspace,'AGENTS.md'),'utf8'),'candidate guidance\n');
+
+ const failed=await fixture(t);await bindUpdates(failed.home,path.join(failed.config.deploymentDir,'host-executor.json'),failed.old);
+ assert.equal((await perform(failed.home,await queued(failed),runtime(failed,{fail:(_command,args)=>args.includes('up')}))).status,'rolled-back');
+ assert.equal(await fs.readFile(path.join(failed.agent.workspace,'AGENTS.md'),'utf8'),'old guidance\n');
+});
 test('the same archive with different deployment CLI pins gets distinct image bindings',async t=>{
  const tags=[],hashes=[];
  for(const pin of ['0.153.4','0.156.1']) {
@@ -366,7 +395,7 @@ test('interrupted activation recovers previous code; rollback failure is explici
  const retried=await read(path.join(jobPath(f.home,interrupted.id),'job.json'));assert.equal((await perform(f.home,retried,r)).status,'rolled-back');
 });
 test('bound dispatch follows active package root and retains private scope',async t=>{
- const f=await fixture(t);
+ const f=await externalState(await fixture(t));
  const prior=await fs.readFile(path.join(f.agent.workspace,'TOOLS.md'),'utf8');
  const bound=await bindUpdates(f.home,path.join(f.config.deploymentDir,'host-executor.json'));
  assert.match(bound.policy,/beta-channel/);