@jc_stack/ez-agents 0.1.0-beta.45 → 0.1.0-beta.47

package/.dockerignore

@@ -27,3 +27,5 @@
 !scripts/trusted-beta.mjs
 !scripts/generate-publish-caller.mjs
 !scripts/smoke-busy-reply.ts
+
+!pnpm-workspace.yaml

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.1.0-beta.47
+
+- Trigger an existing scheduled task manually with its saved instructions, model,
+  reasoning effort and delivery settings in a fresh session. Preserve recurring
+  timing and prevent overlapping schedule runs.
+- Require explicit saved models for scheduled work; reject missing or mismatched
+  models before launch. Legacy definitions remain readable for explicit repair.
+- Refresh Codex catalogs through the bound native CLI. Managed builds and upgrades
+  resolve latest Codex before cache lookup and supersede stale deployment pins.
+  Record the concrete native version; restricted correspondence uses audited
+  Codex 0.160.0 and fails closed on unaudited versions.
+- Keep owner channels responsive while upgrades wait for active work to finish.
+- Standardize dependency installs and runtime builds on pinned pnpm.
+
+Beta limits: live fresh-host/reboot acceptance and the Daily Leverage VM smoke
+remain pending. Publication does not establish an installed-agent upgrade.
+
+## 0.1.0-beta.46
+
+- Allow private RC/QA candidates to graduate to their matching published beta
+  through the existing updater, without permitting a move to an older beta.
+
+- Refresh the isolated broker after plugin upgrade or rollback so status reports
+  the resulting installed versions rather than its startup inventory. Preserve
+  the previous registry snapshot independently during plugin activation.
+  Preserve stopped plugins as stopped when Docker retains a created container.
+
+- Include the existing Telegram runtime/version summary in authorized private
+  channel controls so channel status can show the running relay and host versions.
+
 ## 0.1.0-beta.45
 
 - Keep owner chat responsive while a scheduled native turn runs. Foreground

package/CONTRIBUTING.md

@@ -12,7 +12,7 @@ repository. Public docs describe shipped behavior and explicit limitations.
    unnecessary behavior first, and explain why remaining code is needed. Change
    the code, user instructions and focused tests together. Authority,
    paths, credentials, cancellation and uncertain writes need negative tests.
-4. Run `pnpm verify`, `npm run release:check` and `git diff --check`.
+4. Run `pnpm verify`, `pnpm run release:check` and `git diff --check`.
    Packaging/runtime changes also need the Docker checks in docs/releasing.md.
 5. Open a PR explaining the problem, resulting behavior, verification and limits.
    Include a short sanitized reproduction. State which tests were not run.

package/Dockerfile

@@ -3,8 +3,12 @@ FROM node:22.22.0-bookworm-slim@sha256:dd9d21971ec4395903fa6143c2b9267d048ae01ca
 WORKDIR /app
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates git util-linux ffmpeg docker.io && rm -rf /var/lib/apt/lists/*
 COPY --from=compose-bin /docker-compose /usr/local/bin/docker-compose
-RUN corepack enable && corepack prepare pnpm@10.30.3 --activate
-COPY package.json ./
+ENV PNPM_HOME=/opt/pnpm COREPACK_HOME=/opt/corepack COREPACK_DEFAULT_TO_LATEST=0
+ENV PATH=/opt/pnpm:$PATH
+RUN corepack enable && corepack prepare pnpm@10.30.3 --activate && pnpm config set --global global-bin-dir /usr/local/bin
+RUN mkdir -p /opt/pnpm/global/5
+COPY docker/engine-pnpm-workspace.yaml /opt/pnpm/global/5/pnpm-workspace.yaml
+COPY package.json pnpm-workspace.yaml ./
 COPY docker/pnpm-lock.yaml ./pnpm-lock.yaml
 RUN pnpm install --frozen-lockfile --ignore-scripts
 COPY . .
@@ -12,27 +16,27 @@ FROM dependencies AS test
 RUN pnpm verify
 FROM dependencies AS runtime
 # Isolated agents run this CLI in the relay; do not bind-mount the
-# operator's ~/.codex. Pin the reviewed CLI for repeatable release images.
-ARG CODEX_CLI_VERSION=0.153.4
-RUN npm install -g @openai/codex@${CODEX_CLI_VERSION} && command -v codex
+# operator's ~/.codex. Managed builds resolve latest to a concrete cache key.
+ARG CODEX_CLI_VERSION=latest
+RUN pnpm add --global --ignore-scripts @openai/codex@${CODEX_CLI_VERSION} && command -v codex && codex --version
 # Isolated agents run the selected CLI in the relay; host-capable agents reuse
 # the host installation instead. OpenCode carries no task-runner pin because
 # restricted messaging tasks stay on the audited Codex above.
 # Pin the reviewed CLI for repeatable release images.
 ARG OPENCODE_CLI_VERSION=1.18.32
-RUN npm install -g opencode-ai@${OPENCODE_CLI_VERSION} && command -v opencode && opencode --version
+RUN pnpm add --global --allow-build=opencode-ai@${OPENCODE_CLI_VERSION} opencode-ai@${OPENCODE_CLI_VERSION} && command -v opencode && opencode --version
 # Isolated agents select pi from the relay menu; the binary must resolve on
 # the relay PATH just like codex/opencode above.
 # Pin the reviewed CLI for repeatable release images.
 ARG PI_CLI_VERSION=0.87.1
-RUN npm install -g @earendil-works/pi-coding-agent@${PI_CLI_VERSION} && command -v pi
+RUN pnpm add --global --ignore-scripts @earendil-works/pi-coding-agent@${PI_CLI_VERSION} && command -v pi
 RUN chmod +x docker/entrypoint.sh bin/ez bin/ezenciel-agents* && mkdir -p /state/control /state/home /workspace && chown node:node /state/control /state/home /workspace
 RUN node -e 'for (const [name, target] of Object.entries(require("./package.json").bin)) require("node:fs").symlinkSync("/app/" + target, "/usr/local/bin/" + name); require("node:fs").symlinkSync("/app/bin/ez", "/usr/local/bin/ez")'
 # Build identity for relay status (package version stays release-owned).
 ARG BUILD_TAG=""
 ARG BUILD_SHA=""
-RUN node -e 'require("node:fs").writeFileSync("/app/build.json",JSON.stringify({tag:process.env.BUILD_TAG||"",sha:process.env.BUILD_SHA||""})+"\n")'
-ENV HOME=/state/home EZ_AGENT_WORKSPACE=/workspace EZ_CONTROL_DIR=/state/control EZ_EXECUTOR_CLI=grok PATH=/app/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+RUN node -e 'require("node:fs").writeFileSync("/app/build.json",JSON.stringify({tag:process.env.BUILD_TAG||"",sha:process.env.BUILD_SHA||"",codexVersion:require("node:child_process").execFileSync("codex",["--version"],{encoding:"utf8"}).trim()})+"\n")'
+ENV HOME=/state/home EZ_AGENT_WORKSPACE=/workspace EZ_CONTROL_DIR=/state/control EZ_EXECUTOR_CLI=grok PATH=/app/bin:/opt/pnpm:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 WORKDIR /workspace
 ENTRYPOINT ["/app/docker/entrypoint.sh"]
 CMD ["start"]

package/docker/engine-pnpm-workspace.yaml

@@ -0,0 +1,4 @@
+# Native CLI engines share the same install protections as project dependencies.
+minimumReleaseAge: 10080
+trustPolicy: no-downgrade
+blockExoticSubdeps: true

package/docker/smoke.mjs

@@ -34,7 +34,7 @@ try {
   assert.equal(login.status,0,login.stderr);
   assert.match(login.stdout,/\/usr\/local\/bin\/ezenciel-agents-application/);
   assert.match(login.stdout,/\/usr\/local\/bin\/ezenciel-agents-message/);
-  assert.match(login.stdout,/codex-cli 0\.153\.4/);
+  assert.match(login.stdout,/codex-cli \d+\.\d+\.\d+/);
   const started = run(['run','-d','--name',application,...nonroot,image,'start']);
   assert.equal(started.status,0,started.stderr);
   let ready = false;

package/docs/application-channel.md

@@ -58,6 +58,9 @@ the ordinary last-selection-wins behavior. Already-admitted runs keep their
 captured conversation and AI. Uncertain control responses require a fresh read,
 not blind repetition of `/new`.
 
+The scope-control response includes `software`, the same current runtime/version
+summary used by Telegram status. It is read-only and does not create a session.
+
 For private application conversations, `GET /v1/scope-control?scope=<encoded-scope>` returns
 the same catalog and the current scope's public control ID and preset. The scope
 is the application's original admission scope, resolved under its authenticated

package/docs/architecture/ai-selection.md

@@ -36,7 +36,12 @@ References used for the adapter contract:
 - [Codex non-interactive execution](https://learn.chatgpt.com/docs/non-interactive-mode)
 - [OpenCode native run events](https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/cli/cmd/run.ts)
 
-The catalog is local metadata, not an authentication or billing health check.
+The catalog is native metadata, not an authentication or billing health check.
+Codex refreshes through `codex debug models` with the whitelisted executor
+environment and the execution-bound `CODEX_HOME`; discovery starts no session
+or inference. Only visible model names and supported efforts are projected.
+Unavailable discovery retains the native cache. The installed native version
+still owns which models it advertises; Core never guesses newly released aliases.
 Grok/Codex/OpenCode support explicit listed model/effort choices. Other installed clients
 offer their own default only in this slice. OpenCode lists the installed `opencode models`
 catalog with the whitelisted executor environment, so only models the relay can actually
@@ -46,7 +51,8 @@ Authenticated providers appear only when the agent-bound
 login); otherwise the free tier lists. `EZ_OPENCODE_PROVIDERS` optionally
 restricts the catalog to named providers (e.g. `opencode-go`); a set
 allowlist that matches nothing offers no OpenCode choice rather than falling
-back outside it. Refresh by opening the native client;
+back outside it. Codex discovery refreshes directly; for other cache-only
+catalogs, refresh by opening the native client;
 the relay does not install models, manage subscriptions or guess aliases.
 
 Setup initialization and relay startup seed one default choice per installed client.

package/docs/architecture/authority-boundaries.md

@@ -109,12 +109,12 @@ after service outages; core revocation blocks sends immediately.
 
 ## Native execution and core tools
 
-V1 uses audited Codex CLI **0.153.4** for task work, regardless of the owner's
+V1 uses audited Codex CLI **0.160.0** for task work, regardless of the owner's
 selected executor. Missing or different versions fail closed; upgrading this pin
 requires repeating the native tool inventory test. Owner work retains its normal
 executor. The task runner creates a fresh ephemeral home/session, skips user
 config, rules and ancestor project instructions, and disables shell, file/image,
-browser, apps, hooks, memory and agent spawning tools. A native permissions
+browser, apps, hooks, memory, goals and agent spawning tools. A native permissions
 profile denies general filesystem access and tool network access. No owner
 workspace or conversation is passed to this runner. The runner uses the pinned
 CLI's bundled model catalog with task-specific tool defaults: direct MCP calls,

package/docs/development-and-testing.md

@@ -2,7 +2,7 @@
 
 Use Node 22+ and pnpm 10.30.3: `pnpm install --frozen-lockfile`, then
 `pnpm verify`. Tests use temporary synthetic state; TypeScript checks source and
-tests. Use `npm run release:check` for package contents. See CONTRIBUTING.md for
+tests. Use `pnpm run release:check` for package contents. See CONTRIBUTING.md for
 PR expectations and [release checks](releasing.md) for Docker and clean-host QA.
 
 For the cross-repository fixture, place the reviewed WhatsApp source beside this

package/docs/docker-runtime.md

@@ -162,6 +162,16 @@ control state, then remove only the verified orphaned `control-state.lock` and
 restart the single relay. Never remove a lock while a writer might still be live.
 Model catalog metadata is exported from the selected host CLI without credentials.
 The AI menu stays within that CLI. No automatic executor fallback is performed.
+Codex discovery invokes `codex debug models` in the agent's bound `CODEX_HOME`
+and projects only visible model names and supported reasoning efforts. Older
+clients without that command or unavailable discovery retain the native cache.
+The native CLI owns availability: a new model may require a CLI upgrade as well
+as a catalog refresh. Managed builds and upgrades resolve npm Codex `latest` before cache lookup and
+record the concrete version in the build/update receipt and image identity. Old
+deployment Codex pins are superseded. Host installations remain operator-owned.
+Restricted correspondence retains its audited native version gate and fails closed
+when the normal CLI is newer than the audited version. Direct Docker builds use
+`latest`; use `--no-cache` to refresh native acquisition on a reused builder.
 
 ## Secrets and plugins
 

package/docs/plugin-guide.md

@@ -97,7 +97,7 @@ baseline is:
 ```sh
 pnpm install --frozen-lockfile
 pnpm verify
-npm run release:check
+pnpm run release:check
 git diff --check
 ```
 

package/docs/plugins.md

@@ -157,6 +157,11 @@ snapshots. Reinstallation reuses that data. Plain install does not replace a dif
 compatible upgrades under saved policy; see [upgrades](upgrades.md). Manual
 uninstall/reinstall remains available but does not promise schema rollback.
 
+Installed package files retain their reviewed modes (0644 for ordinary files,
+0755 for executables and nested directories), including under restrictive umasks
+or inherited default ACLs. The snapshot root remains private (0700); provider
+data and private operation receipts keep their separate permissions.
+
 For another reviewed local package, inspect with `plugins inspect <id> --source
 /absolute/source`, then install with that source and the returned `--revision
 sha256:...`. Changed contents fail. To make a reviewed package discoverable without installing,
@@ -329,7 +334,7 @@ only to its authoritative service over the reviewed transport.
 
 ## Verification
 
-`npm run verify` runs offline negative/contract tests. Explicit Docker integration:
+`pnpm run verify` runs offline negative/contract tests. Explicit Docker integration:
 `node docker/plugin-smoke.mjs`. It builds the actual WhatsApp package with the
 synthetic transport in an isolated snapshot and tests installation, start,
 registered CLI, literal file paths, idempotency, restart persistence and

package/docs/releasing.md

@@ -11,7 +11,7 @@ separate release bot is not required.
    update plugin manifest version when present. After lockfile changes, copy
    `pnpm-lock.yaml` to `docker/pnpm-lock.yaml` (npm omits the root lockfile; CI
    checks this shipping copy is identical). Never overwrite a published version.
-2. Run `pnpm install --frozen-lockfile`, `pnpm verify`, `npm run release:check`,
+2. Run `pnpm install --frozen-lockfile`, `pnpm verify`, `pnpm run release:check`,
    `git diff --check`. Review `npm audit --omit=dev` and dependency licenses.
    Record accepted risks with a reason; never run an unreviewed audit fix.
 3. Build both Docker targets from a clean checkout:

package/docs/scheduling.md

@@ -13,6 +13,7 @@ ezenciel-agents-schedule create --name Research --now \
   --text '/goal Complete the authorized research objective. Save evidence, verify the outcome, and send the owner the result.'
 ezenciel-agents-schedule list
 ezenciel-agents-schedule runs
+ezenciel-agents-schedule trigger SCHEDULE_ID --key owner-smoke-20261003
 ezenciel-agents-schedule pause SCHEDULE_ID
 ezenciel-agents-schedule resume SCHEDULE_ID
 ezenciel-agents-schedule remove SCHEDULE_ID
@@ -36,9 +37,22 @@ the host changes zones. Nonexistent DST wall times are skipped; repeated wall
 times fire once, at the earlier instant. Search is bounded to eight years.
 Public-holiday calendars and arbitrary RRULE syntax are not implemented.
 
-New tasks inherit selected engine settings. Explicit `--cli`, `--model` and
-`--effort` override those choices; omitted values use native defaults. Edits
-preserve existing choices. Historical deferred tasks keep their source context
+New tasks capture selected engine settings. Explicit `--cli`, `--model` and
+`--effort` override those choices. Edits preserve existing choices.
+Core always passes the task's concrete saved model. Creation and edits
+require a model in the captured settings or an explicit `--model`; missing models
+are rejected. Legacy tasks with no saved model remain inspectable, but dispatch
+and executor admission refuse to run them until they are explicitly configured.
+Chat changes and native defaults never supply a missing model at run time.
+To run an existing task outside its cadence, use `trigger ID --key REQUEST_KEY`: it queues
+the task's saved instructions, engine, model, effort and delivery binding in a
+fresh session, without changing its definition or next regular occurrence.
+Model/text/trigger overrides are rejected. Reuse the same request key after an
+uncertain response; it reads back the same run while the relay retains it.
+After a relay restart, inspect native history and provider/canonical receipts
+before issuing another request: the run ledger remains intentionally in memory.
+Paused, stale-owner, overlapping or held tasks and unmet conditions cannot be
+triggered. Historical deferred tasks keep their source context
 available through `ezenciel-agents-schedule context`.
 
 ## Execution and authority

package/docs/upgrades.md

@@ -1,5 +1,9 @@
 # Agent-owned software upgrades
 
+Private `beta.N.rc.M` and `beta.N.qa.M` candidates may upgrade to the matching
+published `beta.N`, despite SemVer's prerelease ordering. All identity, integrity,
+deployment and owner-policy checks still apply; older betas remain rejected.
+
 For an application's independently deployed frontend, backend or embedded gateway,
 see [managed applications](managed-applications.md). They use their existing
 deployment tools and a saved maintenance mandate; this package updater inventories
@@ -12,6 +16,8 @@ automatic channel for core and plugins without a saved policy. Existing explicit
 stable or manual policies are preserved. The owner may select either per target.
 The main target and installed plugins version independently.
 
+Queued upgrades leave channel admission open while native work runs. The supervisor pauses admission only after work is idle and releases that pause if a turn raced the check.
+
 The owner chooses the saved update policy. The host supervisor owns
 interruption-safe replacement. There is one host service per agent, not a second
 agent or an additional updater daemon. Its replaceable child runs the normal CLI
@@ -228,7 +234,7 @@ Upgrading does not invent an explicit setting for an omitted field.
 Verify upgrade from the previous supported artifact, retained identity/state,
 failed-health rollback, and rejection of incompatible candidates. Main runtime
 changes also need supervisor restart and requesting-process-exit tests. Run
-`pnpm verify`, `npm run release:check`, packed Docker builds and
+`pnpm verify`, `pnpm run release:check`, packed Docker builds and
 `node docker/upgrade-smoke.mjs` with a local `EZ_WHATSAPP_SOURCE` containing the
 WhatsApp fixture. The smoke uses synthetic transport only. VM installation,
 agent-led upgrades, restart and real account acceptance remain separate QA gates.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jc_stack/ez-agents",
-  "version": "0.1.0-beta.45",
+  "version": "0.1.0-beta.47",
   "private": false,
   "type": "module",
   "description": "A lightweight foundation for persistent business AI assistants using existing AI harnesses, workspaces and plugins.",
@@ -52,7 +52,8 @@
     "scripts/assert-local-registry.mjs",
     ".dockerignore",
     "scripts/trusted-beta.mjs",
-    "scripts/generate-publish-caller.mjs"
+    "scripts/generate-publish-caller.mjs",
+    "pnpm-workspace.yaml"
   ],
   "publishConfig": {
     "access": "public",
@@ -70,7 +71,7 @@
     "verify": "pnpm test && pnpm build",
     "smoke:scheduler": "tsx scripts/smoke-scheduler.ts",
     "smoke": "./bin/ezenciel-agents-docker run --rm --no-deps relay smoke",
-    "prepublishOnly": "npm run verify",
+    "prepublishOnly": "pnpm run verify",
     "registry:up": "docker compose -f registry/docker-compose.yml up -d",
     "registry:down": "docker compose -f registry/docker-compose.yml down",
     "publish:local": "node scripts/publish-local.mjs",

package/pnpm-workspace.yaml

@@ -0,0 +1,7 @@
+# Hold third-party updates for seven days; reviewed first-party releases are exempt.
+minimumReleaseAge: 10080
+minimumReleaseAgeExclude:
+  - "@jc_stack/*"
+  - "@aifit/*"
+trustPolicy: no-downgrade
+blockExoticSubdeps: true

package/scripts/smoke-scheduler.ts

@@ -10,6 +10,7 @@ import { RunStore } from '../src/runs.js'
 import { serveDeliverySocket, createLedgerHandler } from '../src/delivery-socket.js'
 import { packageVersion } from '../src/version.js'
 import { initialPreset } from '../src/ai.js'
+import { discoverDefaults } from '../src/client-defaults.js'
 import { initializeWorkspace } from '../src/workspace.js'
 import type { Update } from 'grammy/types'
 
@@ -21,7 +22,9 @@ const purpose=join(root,'purpose.md');await writeFile(purpose,'Verify native sch
 await initializeWorkspace(workspace,purpose)
 const control=new ControlStore(controlDir,1000),scheduler=new Scheduler(controlDir),runs=new RunStore(controlDir)
 await control.requestPairing(101,101);await control.approveOwner(101)
-const owner=(await control.status()).owner!,execution=await control.captureChoice(initialPreset(cli))
+const initial=initialPreset(cli)
+const defaults=initial.model ? initial : (await discoverDefaults(workspace,{nativeCodexFallback:true})).find(p=>p.cli===cli)
+const owner=(await control.status()).owner!,execution=await control.captureChoice({...initial,model:defaults?.model,effort:defaults?.effort})
 const replies:{at:number;text:string}[]=[]
 const relay=createRelay({workspace,controlDir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:cli,telegramBotToken:'fixture'})
 // Engine children reach this process's memory ledger through the socket.

package/src/ai.ts

@@ -128,7 +128,25 @@ export const readCuratedModels = async (controlDir?: string): Promise<ModelChoic
   return curated
 }
 
-export const readModels = async (home = homedir(), available = installed, codexHome = join(home, '.codex'), opencodeRunner?: (args: string[]) => Promise<string>, opencodeDataHome?: string, opencodeAllowlist?: string[], curationDir?: string): Promise<ModelChoice[]> => {
+// Let the installed native client refresh its own catalog. No conversation or
+// prompt is submitted; CODEX_HOME is the same agent binding used for execution.
+export const readCodexCatalog = async (codexHome: string, run?: (args: string[], env: NodeJS.ProcessEnv) => Promise<string>): Promise<unknown> => {
+  const env = { ...executorEnvironment(), CODEX_HOME: codexHome }
+  const args = ['debug', 'models']
+  try {
+    const stdout = run ? await run(args, env) : await (async () => {
+      const invocation = executorInvocation('codex', args)
+      return (await promisify(execFile)(invocation.command, invocation.args, {
+        cwd: codexHome, env, timeout: 8000, maxBuffer: 4 * 1024 * 1024,
+      })).stdout
+    })()
+    const catalog = JSON.parse(stdout)
+    if (catalog && Array.isArray(catalog.models) && catalog.models.length) return catalog
+  } catch { /* Older/offline native clients retain their last known catalog. */ }
+  try { return JSON.parse(await readFile(join(codexHome, 'models_cache.json'), 'utf8')) } catch { return {} }
+}
+
+export const readModels = async (home = homedir(), available = installed, codexHome = join(home, '.codex'), opencodeRunner?: (args: string[]) => Promise<string>, opencodeDataHome?: string, opencodeAllowlist?: string[], curationDir?: string, codexRunner?: (args: string[], env: NodeJS.ProcessEnv) => Promise<string>): Promise<ModelChoice[]> => {
   const models: ModelChoice[] = []
   const record = (value: unknown): Record<string, unknown> =>
     value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}
@@ -147,7 +165,7 @@ export const readModels = async (home = homedir(), available = installed, codexH
     }
   }
   if (await available('codex')) {
-    const cache = await json(join(codexHome, 'models_cache.json'))
+    const cache = record(await readCodexCatalog(codexHome, codexRunner))
     for (const entry of Array.isArray(cache.models) ? cache.models : []) {
       const info = record(entry)
       if (info.visibility !== 'list' || !safe(info.slug)) continue

package/src/application-channel.ts

@@ -11,6 +11,7 @@ import { MAX_INCOMING_ATTACHMENT_BYTES, stageChatAttachment } from './files.js'
 import { assertEffort } from './model-policy.js'
 import { ApprovalStore } from './approval.js'
 import { Tasks } from './tasks.js'
+import { softwareStatus } from './software-status.js'
 import { SpeechCreditsDepletedError } from './audio.js'
 
 const hash = (value: string) => createHash('sha256').update(value).digest('hex')
@@ -72,7 +73,7 @@ export class ApplicationChannel {
   private admissions = Promise.resolve()
   readonly bindings: ApplicationBindings
   constructor(private options: {
-    controlDir: string; workspace?: string; initial: AiPreset
+    controlDir: string; workspace?: string; isolation?: string; initial: AiPreset
     wake: () => void
     cancel: (id: string) => Promise<void>
     speech?: (text: string, language: 'en' | 'es') => Promise<{ buffer: Buffer; mimeType: string }>
@@ -180,6 +181,7 @@ export class ApplicationChannel {
     await this.sharedBinding(bindingId, false)
     return {ai:{...ai, selectedId:session?.preset?.id ?? ai.selectedId,
       presets:session?.preset ? [...ai.presets.filter(item=>item.id!==session.preset!.id),session.preset] : ai.presets},
+      software: await softwareStatus(this.options.controlDir, this.options.isolation),
       models, activeSessionId:session?.sessionId ?? null, sessions:session ? [{id:session.sessionId,title:sessionTitle(session),cli:session.cli,archived:false}] : []}
   }
   async changeScopeControls(bindingId: string, scope: string, input: unknown) {

package/src/delivery-socket.ts

@@ -8,6 +8,7 @@ import { ApprovalStore } from './approval.js'
 import { deliveredMessages } from './message-history.js'
 import { readOnlyOwner, requireOwnerExecution } from './execution-authority.js'
 import { telegramOwner } from './control-state.js'
+import { Scheduler } from './scheduler.js'
 
 // Stateless pipe transport. The relay owns the runs/outbox ledger in process
 // memory; engine children, plugin children and the host executor reach it
@@ -27,6 +28,7 @@ export { deliverySocketPath }
 export type DeliverySocketOp =
   | { op: 'ping' }
   | { op: 'status' }
+  | { op: 'triggerSchedule'; payload: { scheduleId: string; revision: string; key: string; callerRunId?: string } }
   | { op: 'enqueue'; payload: Record<string, unknown> }
   | { op: 'wait'; payload: { id: string; timeoutMs?: number } }
   | { op: 'get'; payload: { runId: string } }
@@ -208,6 +210,19 @@ export const createLedgerHandler = (controlDir: string, hooks: LedgerHooks): Del
           queued: all.filter((run) => run.status === 'queued').length,
         }
       }
+      case 'triggerSchedule': {
+        const {scheduleId,revision,key,callerRunId}=op.payload ?? {}
+        if (!nonEmptyString(scheduleId) || !nonEmptyString(revision) || !nonEmptyString(key)) throw new Error('Task ID, revision and request key are required')
+        if (callerRunId !== undefined) {
+          const caller=await requireOwnerExecution(controlDir,callerRunId)
+          if (caller.replyOnly || (caller.scheduled && caller.scheduled.pairedAt !== (await readOnlyOwner(controlDir))?.pairedAt)) throw new Error('Scheduling requires an active owner-authorized run')
+        }
+        const owner=await readOnlyOwner(controlDir)
+        if (!owner) throw new Error('Pair an owner before scheduling')
+        const run=await new Scheduler(controlDir).trigger(scheduleId,revision,key,owner,runs)
+        hooks.wake()
+        return run
+      }
       case 'enqueue': {
         const envelope = (op.payload ?? {}) as Record<string, unknown>
         if (envelope.kind === 'owner') {
@@ -351,4 +366,3 @@ export const deliverySocketAlive = (socketPath: string, timeoutMs = 2000): Promi
 // closed DeliverySocketOp union.
 export const callDeliverySocket = (socketPath: string, op: DeliverySocketOp, timeoutMs = 130_000): Promise<unknown> =>
   callSocket(socketPath, op, timeoutMs)
-

package/src/host-executor.ts

@@ -13,6 +13,7 @@ import { readModels, validateSelection, validateOpencodeProviders, type ModelCho
 import type { ChildProcess } from 'node:child_process'
 import { packageVersion } from './version.js'
 import { installedPluginVersions } from './software-status.js'
+import { assertScheduledModel } from './model-policy.js'
 import { processSnapshot } from './process-tree.js'
 
 export type PluginNetworkRoute = { revisions:string[]; bindings:{service:string;network:string}[] }
@@ -194,6 +195,10 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
                 await new Tasks(agent.controlDir).authorize(run, false)
               } else await authorizeRun(agent.controlDir, path.basename(base))
               const opts=request.options as ExecutorOptions
+              if (run?.scheduled) {
+                assertScheduledModel(run.execution?.preset.model)
+                if (opts.model !== run.execution!.preset.model) throw new Error('Scheduled run model does not match its saved task model')
+              }
               const cli = opts.cli || installation.cli
               resolveExecutor(cli)
               const provider = cli === 'codex' && opts.provider

package/src/index.ts

@@ -26,6 +26,7 @@ import { loadConfig, type Config } from './config.js'
 import { ControlStore, telegramOwner, ownerId, ownerEpoch } from './control-state.js'
 import { ApprovalStore } from './approval.js'
 import { startExecutorJob, terminateJob, opencodeDataHome } from './executor.js'
+import { assertScheduledModel } from './model-policy.js'
 import { RunStore, type RunRecord } from './runs.js'
 import { splitTelegramText } from './reply.js'
 import { markdownToTelegramHtml, escapeHtml } from './format.js'
@@ -100,7 +101,7 @@ export const createRelay = (config: Config, launch = startExecutorJob) => {
   }
 
   const applicationChannel = new ApplicationChannel({
-    controlDir: config.controlDir, workspace: config.workspace, initial: aiMenu.initial,
+    controlDir: config.controlDir, workspace: config.workspace, isolation: config.isolation, initial: aiMenu.initial,
     aiControls: aiMenu,
     speech: config.geminiApiKey ? (text, language) => synthesizeSpeech(text, {
       geminiApiKey: config.geminiApiKey,
@@ -240,6 +241,7 @@ export const createRelay = (config: Config, launch = startExecutorJob) => {
           ? { sessionId: randomUUID(), hasStarted: false, nativeSessionId: undefined }
           : await control.executionSession(started.execution!)
         const selected = run.taskId ? (started.execution?.preset.cli === 'codex' ? started.execution.preset : initialPreset('codex')) : started.execution!.preset
+        if (run.scheduled) assertScheduledModel(selected.model)
         const { child, cleanup } = await launch(texts, {
           workspace: config.workspace,
           timeoutMs: config.executorTimeoutMs,

package/src/install-tools.mjs

@@ -114,6 +114,11 @@ export async function migrateLedger({ deployment } = {}) {
   return { ok: true, deployment: directory, changed: true, port, overlay };
 }
 
+export async function latestCodexVersion(invoke,manager={command:"npm",args:[]}) {
+  const version=JSON.parse(await invoke(manager.command,[...manager.args,'view','@openai/codex@latest','version','--json','--registry','https://registry.npmjs.org/']));
+  if(typeof version!=='string'||!/^\d+\.\d+\.\d+$/.test(version))throw Error('Invalid latest Codex version');
+  return version;
+}
 async function fingerprintOf(source,invoke) {
   const listing=JSON.parse(await invoke('npm',['pack','--dry-run','--ignore-scripts','--json'],{cwd:source}));
   const hash=createHash('sha256');
@@ -144,8 +149,9 @@ async function buildIdentity(source,label,invoke) {
 export async function build({home=defaultHome(),source=root,label},invoke=run) {
   source=await fs.realpath(source);
   const identity=await buildIdentity(source,label,invoke);
+  const codexVersion=await latestCodexVersion(invoke);
   const fingerprint=await fingerprintOf(source,invoke);
-  const artifact=createHash('sha256').update(JSON.stringify([fingerprint,identity.label??'',identity.sha??''])).digest('hex');
+  const artifact=createHash('sha256').update(JSON.stringify([fingerprint,identity.label??'',identity.sha??'',codexVersion])).digest('hex');
   const image='ezenciel-agents:install-'+artifact.slice(0,24);
   const dir=path.join(path.resolve(home),'builds',artifact);await fs.mkdir(dir,{recursive:true,mode:0o700});
   const lock=path.join(dir,'lock'),receipt=path.join(dir,'status.json'),log=path.join(dir,'build.log');
@@ -155,14 +161,14 @@ export async function build({home=defaultHome(),source=root,label},invoke=run) {
     await handle.writeFile(JSON.stringify({pid:process.pid,source,image,...identity}));
     const prior=await read(receipt).catch(absent);
     if(prior?.state==='completed')try{if(await invoke('docker',['image','inspect','--format','{{.Id}}',image])===prior.imageId)return {...prior,reused:true};}catch{/* Image was removed; rebuild under the same exclusive lock. */}
-    await atomic(receipt,{state:'building',pid:process.pid,source,image,log,...identity});
-    console.error(JSON.stringify({state:'building',image,log,...identity}));
-    const buildArgs=identity.label?['--build-arg',`BUILD_TAG=${identity.label}`,'--build-arg',`BUILD_SHA=${identity.sha}`]:[];
+    await atomic(receipt,{state:'building',pid:process.pid,source,image,log,codexVersion,...identity});
+    console.error(JSON.stringify({state:'building',image,log,codexVersion,...identity}));
+    const buildArgs=['--build-arg',`CODEX_CLI_VERSION=${codexVersion}`,...(identity.label?['--build-arg',`BUILD_TAG=${identity.label}`,'--build-arg',`BUILD_SHA=${identity.sha}`]:[])];
     const tags=[image,...(identity.label?[`ezenciel-agents:${identity.label}`]:[])];
     const output=await fs.open(log,'a',0o600);
     try{await invoke('docker',['build','--progress','plain','--target','runtime',...buildArgs,...tags.flatMap(t=>['-t',t]),source],{log:output.fd,timeout:3600000});}finally{await output.close();}
     if(await fingerprintOf(source,invoke)!==fingerprint)throw Error('Package changed during build; keep the source stable and retry');
-    const result={state:'completed',source,image,imageId:await invoke('docker',['image','inspect','--format','{{.Id}}',image]),log,...identity};await atomic(receipt,result);return result;
+    const result={state:'completed',source,image,imageId:await invoke('docker',['image','inspect','--format','{{.Id}}',image]),log,codexVersion,...identity};await atomic(receipt,result);return result;
   }catch(e){await atomic(receipt,{state:'failed',source,image,log,error:e.message,...identity});throw e;}
   finally{await handle.close();await fs.rm(lock);}
 }

package/src/model-policy.ts

@@ -3,6 +3,10 @@ export const allowedEffort = (effort?: string, _model?: string, _cli?: string) =
 export function assertEffort(effort?: string, model?: string, cli?: string) {
   if (!allowedEffort(effort,model,cli)) throw new Error('Invalid reasoning effort')
 }
+export function assertScheduledModel(model: unknown): asserts model is string {
+  if (typeof model !== 'string' || !/^[a-zA-Z0-9_./:-]{1,160}$/.test(model))
+    throw new Error('Scheduled tasks require a saved explicit model; configure the task with --model')
+}
 export function executionDefaults<T extends { model?: string; effort?: string }>(cli: string, options: T): T {
   assertEffort(options.effort,options.model,cli)
   return options

package/src/plugins/manager.mjs

@@ -553,7 +553,13 @@ export async function install(home,config,name,source,revision) {
     const base=path.join(home,'packages',name),target=path.join(base,revision.slice(7));await privateDir(base);
     const stage=path.join(base,`.stage-${randomUUID()}`);await privateDir(stage);
     try {
-      for(const [relative,file] of p.files) {const dest=path.join(stage,relative);await fs.mkdir(path.dirname(dest),{recursive:true,mode:0o755});await fs.writeFile(dest,file.data,{mode:file.mode,flag:'wx'});}
+      for(const [relative,file] of p.files) {
+        const dest=path.join(stage,relative);await fs.mkdir(path.dirname(dest),{recursive:true,mode:0o755});
+        // Package modes are part of the reviewed snapshot; umask/default ACLs
+        // must not make Docker COPY inputs unreadable to the runtime user.
+        for(let dir=path.dirname(dest);dir!==stage;dir=path.dirname(dir))await fs.chmod(dir,0o755);
+        await fs.writeFile(dest,file.data,{mode:file.mode,flag:'wx'});await fs.chmod(dest,file.mode);
+      }
       // A previously interrupted install may leave a snapshot. Never silently replace it.
       try { await fs.rename(stage,target); } catch(error) {
         if(!['EEXIST','ENOTEMPTY'].includes(error.code)) throw error;

package/src/runs.ts

@@ -141,7 +141,7 @@ export class RunStore {
     taskId?: string
     application?: ApplicationOrigin
     delivery?: { bindingId: string; scope: string }
-  }): Promise<RunRecord> {
+  }, exclusiveSchedule = false): Promise<RunRecord> {
     const store = runsFor(this.controlDir)
     if (input.id) {
       assertId(input.id)
@@ -152,6 +152,9 @@ export class RunStore {
         return existing
       }
     }
+    if (exclusiveSchedule && input.scheduled && [...store.values()].some(run =>
+      run.scheduled?.id === input.scheduled!.id && ['queued','running'].includes(run.status)))
+      throw new Error('Schedule already has a queued or running occurrence')
     const run: RunRecord = {
       version: input.taskId ? 2 : 1,
       taskId: input.taskId,