@jc_stack/ez-agents 0.1.0-beta.46 → 0.1.0-beta.48

package/test/ai.test.ts

@@ -4,13 +4,49 @@ import { mkdtemp, mkdir, writeFile, readFile, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { ControlStore } from '../src/control-state.js'
-import { initialPreset, chatPreset, readModels, isPreset, readOpencodeModels, readCuratedModels, validateSelection, opencodeProviderAllowlist } from '../src/ai.js'
+import { initialPreset, chatPreset, readModels, readCodexCatalog, isPreset, readOpencodeModels, readCuratedModels, validateSelection, opencodeProviderAllowlist } from '../src/ai.js'
 import { createAiMenu } from '../src/menu.js'
 import { EXECUTOR_REGISTRY, nativeSessionId } from '../src/executor.js'
 import { InboxStore } from '../src/inbox.js'
 import { executionDefaults } from '../src/model-policy.js'
 import type { Update } from 'grammy/types'
 
+const noCodex = async (): Promise<string> => { throw new Error('Native discovery unavailable') }
+
+test('Codex discovery refreshes through the bound native CLI without curated overrides or a turn', async () => {
+  const home = await mkdtemp(join(tmpdir(), 'ez-native-catalog-'))
+  const previousToken = process.env.TELEGRAM_BOT_TOKEN
+  try {
+    process.env.TELEGRAM_BOT_TOKEN = 'must-not-reach-native-client'
+    await writeFile(join(home, 'models_cache.json'), JSON.stringify({ models: [
+      { slug: 'old-model', visibility: 'list' },
+    ] }))
+    const calls: string[][] = []
+    const run = async (args: string[], env: NodeJS.ProcessEnv) => {
+      calls.push(args)
+      assert.equal(env.CODEX_HOME, home)
+      assert.equal(env.TELEGRAM_BOT_TOKEN, undefined)
+      return JSON.stringify({ models: [
+        { slug: 'new-model', display_name: 'New model', visibility: 'list',
+          supported_reasoning_levels: [{ effort: 'ultra' }], model_messages: 'untrusted', api_key: 'secret' },
+        { slug: 'hidden-model', visibility: 'hide' },
+      ] })
+    }
+    assert.deepEqual(await readModels(home, async cli => cli === 'codex', home,
+      undefined, undefined, undefined, undefined, run), [
+      { cli: 'codex', model: 'new-model', name: 'New model', efforts: ['ultra'] },
+    ])
+    assert.deepEqual(calls, [['debug', 'models']])
+    for (const unavailable of [noCodex, async () => 'not json', async () => '{"models":[]}']) {
+      assert.deepEqual(await readCodexCatalog(home, unavailable), { models: [{ slug: 'old-model', visibility: 'list' }] })
+    }
+  } finally {
+    if (previousToken === undefined) delete process.env.TELEGRAM_BOT_TOKEN
+    else process.env.TELEGRAM_BOT_TOKEN = previousToken
+    await rm(home, { recursive: true, force: true })
+  }
+})
+
 test('same-client model and default changes preserve history; provider changes require a fresh conversation', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-ai-model-switch-'))
   try {
@@ -173,7 +209,7 @@ test('model catalog projects native metadata only, excluding hidden entries and
         supported_reasoning_levels: [{ effort: 'high' }, { effort: 'xhigh' }, { effort: 'max' }] },
       { slug: 'hidden-model', visibility: 'hide' },
     ] }))
-    assert.deepEqual(await readModels(home, async (cli) => cli === 'codex'), [
+    assert.deepEqual(await readModels(home, async (cli) => cli === 'codex', undefined, undefined, undefined, undefined, undefined, noCodex), [
       { cli: 'codex', model: 'fixture-model', name: 'Fixture', efforts: ['medium'] },
       { cli: 'codex', model: 'gpt-5.6-luna', name: 'Luna', efforts: ['high', 'xhigh', 'max'] },
     ])
@@ -258,7 +294,7 @@ test('model catalog can read an agent-bound Codex home', async () => {
       { slug: 'gpt-6-astra', display_name: 'GPT-6 Astra', visibility: 'list',
         supported_reasoning_levels: [{ effort: 'low' }] },
     ] }))
-    assert.deepEqual(await readModels(home, async (cli) => cli === 'codex', codexHome), [
+    assert.deepEqual(await readModels(home, async (cli) => cli === 'codex', codexHome, undefined, undefined, undefined, undefined, noCodex), [
       { cli: 'codex', model: 'gpt-6-astra', name: 'GPT-6 Astra', efforts: ['low'] },
     ])
   } finally {
@@ -270,7 +306,10 @@ test('model catalog can read an agent-bound Codex home', async () => {
 test('Choose AI lists the agent-bound Codex home instead of only the desktop fallback', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-ai-menu-codex-home-'))
   const codexHome = await mkdtemp(join(tmpdir(), 'ez-ai-menu-cache-'))
+  const previousPath = process.env.PATH
   try {
+    await writeFile(join(codexHome, 'codex'), '#!/bin/sh\nexit 1\n', { mode: 0o700 })
+    process.env.PATH = `${codexHome}:${previousPath ?? ''}`
     await writeFile(join(codexHome, 'models_cache.json'), JSON.stringify({ models: [
       { slug: 'fixture-bound-model', display_name: 'Bound Fixture', visibility: 'list',
         supported_reasoning_levels: [{ effort: 'medium' }] },
@@ -298,6 +337,7 @@ test('Choose AI lists the agent-bound Codex home instead of only the desktop fal
     await menu.handle(context(client.callback_data) as never)
     assert.deepEqual(replies.at(-1)!.buttons.map((button) => button.text), ['Bound Fixture', 'Back to clients'])
   } finally {
+    process.env.PATH = previousPath
     await rm(dir, { recursive: true, force: true })
     await rm(codexHome, { recursive: true, force: true })
   }
@@ -522,7 +562,7 @@ test('model catalog merges user-curated entries ahead of discovered ones', async
     const installedOnly = async (cli: string) => cli === 'codex' || cli === 'pi'
     const noRunner = async (_args: string[]): Promise<string> => { throw new Error('no native CLI in test') }
     const catalog = await readModels(home, installedOnly, join(home, '.codex'),
-      noRunner, undefined, undefined, control)
+      noRunner, undefined, undefined, control, noCodex)
     assert.deepEqual(catalog.filter((m) => m.cli === 'pi'), [
       { cli: 'pi', model: 'opencode-go/muse-spark-1.3-contributor', name: 'Pi · Muse Spark 1.3', efforts: ['xhigh'] },
       { cli: 'pi', name: 'Pi · client default', efforts: [] },
@@ -538,7 +578,7 @@ test('model catalog merges user-curated entries ahead of discovered ones', async
     assert.deepEqual(await readCuratedModels(join(control, 'missing-dir')), [])
     await writeFile(join(control, 'ai-models.json'), 'not json')
     assert.deepEqual(await readModels(home, async (cli) => cli === 'codex', join(home, '.codex'),
-      noRunner, undefined, undefined, control), [
+      noRunner, undefined, undefined, control, noCodex), [
       { cli: 'codex', model: 'fixture-model', name: 'Fixture', efforts: ['medium'] },
     ])
   } finally {
@@ -592,3 +632,43 @@ test('private channel model choices do not consume owner preset slots', async ()
     assert.deepEqual((await store.applicationSession(scope))?.preset, readback.preset)
   } finally { await rm(dir, {recursive:true, force:true}) }
 })
+
+test('detected presets do not count against the saved AI cap', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-ai-cap-'))
+  try {
+    const store = new ControlStore(dir, 1000)
+    const initial = initialPreset('codex')
+    await store.captureChoice(initial)
+    for (let n = 1; n < 11; n++) await store.savePreset({...initial, id:`saved-${n}`, name:`Saved ${n}`})
+    await store.syncClientPresets(initial, ['claude', 'grok'].map(cli => ({id:`detected_${cli}`, cli, name:`${cli} · client default`})))
+    assert.equal((await store.status()).ai!.presets.length, 13)
+    const next = {id:'one-more', name:'One more', cli:'claude', model:'sonnet', effort:'medium'}
+    await store.savePreset(next)
+    await assert.rejects(store.savePreset({...next, id:'too-many', name:'Too many'}), /at most 12/)
+  } finally { await rm(dir, {recursive:true, force:true}) }
+})
+
+test('Claude catalog projects only aliases and efforts from the installed native help', async () => {
+  const help = `Options:
+  --effort <level>                      Effort level for the current session
+                                        (low, medium, high, xhigh, max)
+  --model <model>                       Model for the current session. Provide
+                                        an alias for the latest model (e.g.
+                                        'fable', 'opus', or 'sonnet') or a
+                                        model's full name.
+  -n, --name <name>                     Set a display name ('ignored')
+`
+  const calls: string[][] = []
+  const models = await readModels('/nonexistent', async cli => cli === 'claude', undefined, undefined, undefined, undefined, undefined, undefined,
+    async (args) => { calls.push(args); return help })
+  assert.deepEqual(calls, [['--help']])
+  assert.deepEqual(models, [
+    { cli: 'claude', name: 'claude · client default', efforts: [] },
+    ...['fable', 'opus', 'sonnet'].map(model => ({ cli: 'claude', model, name: `claude · ${model}`, efforts: ['low', 'medium', 'high', 'xhigh', 'max'] })),
+  ])
+  for (const unavailable of [async () => { throw new Error('not runnable') }, async () => 'Usage: claude'])
+    assert.deepEqual(await readModels('/nonexistent', async cli => cli === 'claude', undefined, undefined, undefined, undefined, undefined, undefined, unavailable),
+      [{ cli: 'claude', name: 'claude · client default', efforts: [] }])
+  await validateSelection({ id: 'c', name: 'c', cli: 'claude', model: 'opus', effort: 'xhigh' }, models, async () => true)
+  await assert.rejects(validateSelection({ id: 'c', name: 'c', cli: 'claude', model: 'opus-guess' }, models, async () => true), /not in the installed client catalog/)
+})

package/test/application-channel.test.ts

@@ -1,7 +1,7 @@
 import test from 'node:test'
 import { request as httpRequest } from 'node:http'
 import assert from 'node:assert/strict'
-import { mkdtemp, rm, writeFile, readFile } from 'node:fs/promises'
+import { mkdtemp, rm, writeFile, readFile, chown, stat } from 'node:fs/promises'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { spawnSync } from 'node:child_process'
@@ -435,3 +435,18 @@ test('shareTelegram bindings list Telegram intake and admit one run with context
   await runs.patch(finished.id,{status:'completed'})
   assert.equal((await attach(finished.id,sharedToken,{context:{}})).status,409)
 })
+
+test('administrator task grant replacement preserves the runtime file owner', {skip:process.getuid?.()!==0},async()=>{
+  const dir=await mkdtemp(join(tmpdir(),'ez-app-grant-owner-'))
+  try {
+    const who=await owner(dir),bindings=new ApplicationBindings(dir)
+    await bindings.register('voice',token(),who)
+    const file=join(dir,'application-bindings.json')
+    await chown(file,20000,20000)
+    await bindings.taskLaunch('voice',{command:'voice',args:['launch','--task'],tasks:['task_'+'a'.repeat(32)]})
+    const saved=await stat(file)
+    assert.equal(saved.uid,20000);assert.equal(saved.gid,20000);assert.equal(saved.mode&0o777,0o600)
+    await bindings.taskLaunch('voice',null)
+    const disabled=await stat(file);assert.equal(disabled.uid,20000);assert.equal(disabled.gid,20000)
+  }finally{await rm(dir,{recursive:true,force:true})}
+})

package/test/audio.test.ts

@@ -1,3 +1,4 @@
+import {execFileSync} from 'node:child_process'
 import test from 'node:test'
 import assert from 'node:assert/strict'
 import { pcmToWav, encodeOggOpus, transcribeAudio, synthesizeSpeech, SpeechCreditsDepletedError } from '../src/audio.js'
@@ -91,3 +92,21 @@ test('synthesizeSpeech rejects empty text', async () => {
     /Cannot synthesize speech for empty text/,
   )
 })
+
+
+test('OpenRouter uses the existing renderer and encoder for real Ogg Opus and WAV without provider fallback', async t => {
+  const mp3=execFileSync('ffmpeg',['-f','s16le','-ar','24000','-ac','1','-i','pipe:0','-f','mp3','pipe:1'],{input:Buffer.alloc(48000),stdio:['pipe','pipe','ignore']})
+  t.mock.method(globalThis,'fetch',async (url:string,options:RequestInit) => {
+    assert.equal(url,'https://openrouter.ai/api/v1/audio/speech')
+    assert.equal(new Headers(options.headers).get('authorization'),'Bearer fixture-key')
+    assert.deepEqual(JSON.parse(String(options.body)),{model:'fish-audio/s2.1-pro-free:free',input:'Fixture',response_format:'mp3'})
+    return new Response(mp3,{headers:{'content-type':'audio/mpeg'}})
+  })
+  const options={speechProvider:'openrouter' as const,openrouterApiKey:'fixture-key',geminiApiKey:'unused'}
+  const ogg=await synthesizeSpeech('Fixture',options)
+  assert.equal(ogg.mimeType,'audio/ogg');assert.equal(ogg.buffer.subarray(0,4).toString(),'OggS');assert.ok(ogg.buffer.includes(Buffer.from('OpusHead')))
+  const wav=await synthesizeSpeech('Fixture',{...options,format:'wav'})
+  assert.equal(wav.buffer.subarray(0,4).toString(),'RIFF');assert.equal(wav.buffer.readUInt32LE(24),24000)
+  t.mock.method(globalThis,'fetch',async () => new Response('private provider detail',{status:429}))
+  await assert.rejects(synthesizeSpeech('Fixture',options), /error 429/)
+})

package/test/channel-owner.test.ts

@@ -85,7 +85,7 @@ test('web owner uses the standard schedule CLI, executor and outbox with Telegra
   await writeFile(fixture,`import {spawnSync} from 'node:child_process';
     if(process.env.TELEGRAM_BOT_TOKEN)throw Error('secret leak');
     const scheduled=process.env.EZ_RUN_ID.startsWith('r_schedule_');
-    if(!scheduled){const r=spawnSync(process.execPath,[${JSON.stringify(scheduleCli)},'create','followup','--now','--name','Followup','--text','Finish the requested work'],{env:process.env,encoding:'utf8'});if(r.status)throw Error(r.stderr)}
+    if(!scheduled){const r=spawnSync(process.execPath,[${JSON.stringify(scheduleCli)},'create','followup','--model','fixture-model','--now','--name','Followup','--text','Finish the requested work'],{env:process.env,encoding:'utf8'});if(r.status)throw Error(r.stderr)}
     const r=spawnSync(process.execPath,[${JSON.stringify(messageCli)},'--text',scheduled?'Scheduled reply':'Chat reply'],{env:process.env,encoding:'utf8'});if(r.status)throw Error(r.stderr);`)
   EXECUTOR_REGISTRY.grok={...original,command:process.execPath,buildArgs:()=>['--import',require.resolve('tsx'),fixture]}
   const config=loadConfig({EZ_APPLICATION_PORT:'8787',EZ_CONTROL_DIR:root,EZ_AGENT_WORKSPACE:root,EZ_EXECUTOR_CLI:'grok'})
@@ -151,7 +151,7 @@ for (const mode of ['owner','web','telegram']) test(`${mode} revocation stops it
     await runs.create({id:'r_telegram',chatId:42,telegramUserId:42,ownerId:ownerId(owner),ownerEpoch:ownerEpoch(owner),texts:['Wait'],execution:await control.captureChoice(initialPreset('grok'))})
   } else {
     const binding=(await relay.applicationChannel.bindings.register('web',secret(),owner))!
-    await scheduler.save({id:'wait',name:'Wait',text:'Wait',enabled:true,trigger:{at:new Date(Date.now()+1000).toISOString()},owner,delivery:{bindingId:binding.bindingId,scope:'main'},execution:await control.captureChoice(initialPreset('grok'))})
+    await scheduler.save({id:'wait',name:'Wait',text:'Wait',enabled:true,trigger:{at:new Date(Date.now()+1000).toISOString()},owner,delivery:{bindingId:binding.bindingId,scope:'main'},execution:await control.captureChoice({...initialPreset('grok'),model:'fixture-model'})})
     await scheduler.tick(owner,runs,Date.now()+2000)
   }
   await relay.drainSources()

package/test/config.test.ts

@@ -84,3 +84,11 @@ test('Telegram transport is inferred from a valid token; legacy flag contradicti
   assert.equal(loadConfig({ EZ_TELEGRAM_ENABLED: 'false', EZ_APPLICATION_PORT: '8110' }).telegramEnabled, false)
   assert.equal(loadConfig({ TELEGRAM_BOT_TOKEN: token, EZ_TELEGRAM_ENABLED: 'true' }).telegramEnabled, true)
 })
+
+test('scheduled concurrency defaults to six and accepts only positive integers',()=>{
+ const env={EZ_APPLICATION_PORT:'8110'}
+ assert.equal(loadConfig(env).scheduledConcurrency,6)
+ assert.equal(loadConfig({...env,EZ_SCHEDULED_CONCURRENCY:'2'}).scheduledConcurrency,2)
+ for(const value of ['0','-1','1.5','bad','9007199254740992'])
+  assert.throws(()=>loadConfig({...env,EZ_SCHEDULED_CONCURRENCY:value}),/EZ_SCHEDULED_CONCURRENCY must be a positive integer/)
+})

package/test/desktop-bridge.test.ts

@@ -52,7 +52,8 @@ test('codex-gui is a distinct preset and catalog entry', async () => {
     await writeFile(path.join(home, '.codex/models_cache.json'), JSON.stringify({ models: [
       { slug: 'fixture-model', display_name: 'Fixture', visibility: 'list', supported_reasoning_levels: [{ effort: 'medium' }] },
     ] }))
-    const models = await readModels(home, async (cli) => cli === 'codex' || cli === 'codex-gui')
+    const models = await readModels(home, async (cli) => cli === 'codex' || cli === 'codex-gui', undefined, undefined, undefined, undefined, undefined,
+      async () => { throw new Error('Native discovery unavailable') })
     assert.ok(models.some((model) => model.cli === 'codex' && model.model === 'fixture-model'))
     assert.ok(models.some((model) => model.cli === 'codex-gui' && model.model === 'fixture-model'))
   } finally { await rm(home, { recursive: true, force: true }) }

package/test/executor.test.ts

@@ -372,3 +372,40 @@ test('external local owner chat preserves literal input and admission rejects fo
     if(prior.transport===undefined)delete process.env.EZ_EXECUTOR_TRANSPORT;else process.env.EZ_EXECUTOR_TRANSPORT=prior.transport
   }
 })
+
+test('Claude runs with agent-bound configuration, shared login and the agent directories', {skip:process.platform==='win32'}, async t => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-claude-home-'))
+  t.after(() => rm(root, { recursive: true, force: true }))
+  const bin = path.join(root, 'bin'), workspace = path.join(root, 'mind'), controlDir = path.join(root, 'control'), shared = path.join(root, 'shared')
+  await mkdir(bin); await mkdir(workspace)
+  await writeFile(path.join(bin, 'claude'), `#!${process.execPath}\nrequire('fs').writeFileSync('observed.json',JSON.stringify({args:process.argv.slice(2),config:process.env.CLAUDE_CONFIG_DIR,storage:process.env.CLAUDE_SECURESTORAGE_CONFIG_DIR,token:process.env.CLAUDE_CODE_OAUTH_TOKEN,prompt:require('fs').readFileSync(0,'utf8')}))`, { mode: 0o700 })
+  const previous = { PATH: process.env.PATH, EZ_ISOLATION: process.env.EZ_ISOLATION, EZ_EXECUTOR_TRANSPORT: process.env.EZ_EXECUTOR_TRANSPORT }
+  t.after(() => { for (const [key, value] of Object.entries(previous)) value === undefined ? delete process.env[key] : process.env[key] = value })
+  process.env.PATH = bin + path.delimiter + process.env.PATH
+  delete process.env.EZ_EXECUTOR_TRANSPORT
+  for (const isolation of [undefined, 'isolated']) {
+    if (isolation) process.env.EZ_ISOLATION = isolation; else delete process.env.EZ_ISOLATION
+    await ownerRun(controlDir, `r_claude_${isolation ?? 'host'}`)
+    const job = await startExecutorJob(['hello'], { workspace, controlDir, binDir: bin, cli: 'claude', runId: `r_claude_${isolation ?? 'host'}`, timeoutMs: 5000,
+      sessionId: '00000000-0000-4000-8000-000000000000', sharedWorkspace: shared, model: 'opus', effort: 'high', repairEnabled: false })
+    assert.equal(await new Promise(resolve => job.child.once('close', resolve)), 0); await job.cleanup()
+    const observed = JSON.parse(await readFile(path.join(workspace, 'observed.json'), 'utf8'))
+    assert.equal(observed.config, path.join(controlDir, 'cli', 'claude'))
+    assert.equal(observed.storage, isolation ? undefined : '')
+    assert.equal(observed.prompt, 'hello')
+    for (const directory of [controlDir, shared]) assert.equal(observed.args[observed.args.indexOf(directory) - 1], '--add-dir')
+    assert.deepEqual(observed.args.slice(-4), ['--model', 'opus', '--effort', 'high'])
+    assert.equal(observed.token, undefined)
+  }
+  const run = async (runId: string) => {
+    await ownerRun(controlDir, runId)
+    const job = await startExecutorJob(['hello'], { workspace, controlDir, binDir: bin, cli: 'claude', runId, timeoutMs: 5000, repairEnabled: false })
+    assert.equal(await new Promise(resolve => job.child.once('close', resolve)), 0); await job.cleanup()
+    return JSON.parse(await readFile(path.join(workspace, 'observed.json'), 'utf8'))
+  }
+  await writeFile(path.join(controlDir, 'cli', 'claude', 'oauth-token'), 'sk-ant-oat01-fixture_token-value\n', { mode: 0o600 })
+  assert.equal((await run('r_claude_token')).token, 'sk-ant-oat01-fixture_token-value')
+  await writeFile(path.join(controlDir, 'cli', 'claude', 'oauth-token'), 'bad token\n--flag', { mode: 0o600 })
+  await ownerRun(controlDir, 'r_claude_bad_token')
+  await assert.rejects(startExecutorJob(['hello'], { workspace, controlDir, binDir: bin, cli: 'claude', runId: 'r_claude_bad_token', timeoutMs: 5000, repairEnabled: false }), /Invalid Claude token binding/)
+})

package/test/failure.test.ts

@@ -100,7 +100,7 @@ test('failure capture, diagnosis, verified recovery and conditional quiet next t
  })
  try{
   await control.requestPairing(101,101);await control.approveOwner(101)
-  const owner=(await control.status()).owner!,execution=await control.captureChoice(initialPreset('grok')),start=Date.now()+2000
+  const owner=(await control.status()).owner!,execution=await control.captureChoice({...initialPreset('grok'),model:'fixture-model'}),start=Date.now()+2000
   await scheduler.save({id:'review',name:'Review failures',text:'Review failures',trigger:{everySeconds:60,start:new Date(start).toISOString()},when:'unreviewed-failures',enabled:true,owner,execution})
   await scheduler.tick(owner,runs,start)
   assert.equal((await runs.list()).length,0,'no model job for an empty inbox')
@@ -251,7 +251,7 @@ for (const intake of [true,false]) test(`relay shutdown terminates an in-flight
   await control.requestPairing(101,101);const owner=await control.approveOwner(101)
   if(intake) await relay.bot.handleUpdate({update_id:91,message:{message_id:91,date:0,text:'fixture',from:{id:101,is_bot:false,first_name:'Fixture'},chat:{id:101,type:'private',first_name:'Fixture'}}})
   else {
-   const scheduler=new Scheduler(dir),at=Date.now()+1000,execution=await control.captureChoice(initialPreset('grok'))
+   const scheduler=new Scheduler(dir),at=Date.now()+1000,execution=await control.captureChoice({...initialPreset('grok'),model:'fixture-model'})
    await scheduler.save({id:'fixture',name:'Fixture',text:'fixture',trigger:{at:new Date(at).toISOString()},enabled:true,owner,execution})
    await scheduler.tick(owner,runs,at)
   }
@@ -276,7 +276,7 @@ test('group members can inspect failures and wake review without exposing other
  const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
  const runs=new RunStore(dir),control=new ControlStore(dir,900000),scheduler=new Scheduler(dir)
  await control.requestPairing(101,-123,'Fixture');const owner=await control.approveOwner(-123,true)
- const execution=await control.captureChoice(initialPreset('grok'))
+ const execution=await control.captureChoice({...initialPreset('grok'),model:'fixture-model'})
  await runs.create({id:'tg_1',chatId:-123,telegramUserId:202,texts:['failed'],execution})
  await runs.patch('tg_1',{status:'failed',endedAt:new Date().toISOString()})
  await runs.create({id:'tg_2',chatId:-124,telegramUserId:202,texts:['private'],execution})
@@ -343,7 +343,7 @@ test('failed reviewer readback exposes its stop through show, list and resume un
  const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
  const control=new ControlStore(dir,1000),runs=new RunStore(dir),scheduler=new Scheduler(dir)
  await control.requestPairing(101,101);const owner=await control.approveOwner(101)
- const execution=await control.captureChoice(initialPreset('grok')),now=Date.now()+1000
+ const execution=await control.captureChoice({...initialPreset('grok'),model:'fixture-model'}),now=Date.now()+1000
  const s=await scheduler.save({id:'review',name:'Review',text:'Review failures',trigger:{everySeconds:60,start:new Date(now).toISOString()},when:'unreviewed-failures',enabled:true,owner,execution})
  await runs.create({id:'r_original',chatId:101,telegramUserId:101,texts:['Work'],execution});await runs.patch('r_original',{status:'failed'})
  await scheduler.tick(owner,runs,now)

package/test/files.test.ts

@@ -48,3 +48,47 @@ test('stages file into control attachments, never the workspace', async () => {
     await rm(tmp, { recursive: true, force: true })
   }
 })
+
+test('shared incoming document reader extracts PDF text and removes its staged file', async t => {
+  const {readChatAttachment}=await import('../src/files.js')
+  const {execFile}=await import('node:child_process'), {promisify}=await import('node:util')
+  try { await promisify(execFile)('pdftotext',['-v']) } catch { t.skip('Poppler is exercised in the Docker artifact test');return }
+  const dir=await mkdtemp('/tmp/ez-pdf-read-');t.after(()=>rm(dir,{recursive:true,force:true}))
+  const stream='BT /F1 12 Tf 20 80 Td (Shop opens at 7am.) Tj ET'
+  const objects=['<< /Type /Catalog /Pages 2 0 R >>','<< /Type /Pages /Kids [3 0 R] /Count 1 >>','<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Resources << /Font << /F1 4 0 R >> >> /Contents 5 0 R >>','<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>',`<< /Length ${stream.length} >>\nstream\n${stream}\nendstream`]
+  let pdf='%PDF-1.4\n';const offsets=[0]
+  for(const [i,value] of objects.entries()){offsets.push(Buffer.byteLength(pdf));pdf+=`${i+1} 0 obj\n${value}\nendobj\n`}
+  const xref=Buffer.byteLength(pdf);pdf+='xref\n0 6\n0000000000 65535 f \n'+offsets.slice(1).map(n=>String(n).padStart(10,'0')+' 00000 n \n').join('')+`trailer\n<< /Size 6 /Root 1 0 R >>\nstartxref\n${xref}\n%%EOF\n`
+  const result=await readChatAttachment(dir,'shop.pdf',Buffer.from(pdf));assert.match(result.text ?? '',/Shop opens at 7am\./);assert.equal(result.type,'pdf')
+  const {readdir}=await import('node:fs/promises');assert.deepEqual(await readdir(path.join(dir,'attachments')),[])
+  await assert.rejects(readChatAttachment(dir,'invalid.pdf',Buffer.from('%PDF-invalid')))
+})
+
+test('shared image read returns original pixels with native MIME and no staged residue',async t=>{
+ const {readChatAttachment}=await import('../src/files.js'),{readdir}=await import('node:fs/promises')
+ const dir=await mkdtemp('/tmp/ez-image-read-');t.after(()=>rm(dir,{recursive:true,force:true}))
+ const png=Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+ip1sAAAAASUVORK5CYII=','base64')
+ const result=await readChatAttachment(dir,'photo.png',png)
+ assert.equal(result.image?.mimeType,'image/png');assert.equal(result.image?.data,png.toString('base64'));assert.equal(result.text,undefined)
+ assert.deepEqual(await readdir(path.join(dir,'attachments')),[])
+ await assert.rejects(readChatAttachment(dir,'photo.png',Buffer.from('Spoofed image bytes')))
+})
+
+test('video read uses bounded native frames and removes temporary decoder files',async t=>{
+ const {readChatAttachment}=await import('../src/files.js'),{readdir}=await import('node:fs/promises'),{execFile}=await import('node:child_process'),{promisify}=await import('node:util')
+ const execute=promisify(execFile)
+ try {await execute('ffmpeg',['-version'])}catch{t.skip('FFmpeg is exercised in the Docker artifact test');return}
+ const dir=await mkdtemp('/tmp/ez-video-read-');t.after(()=>rm(dir,{recursive:true,force:true}))
+ const video=path.join(dir,'fixture.mp4')
+ await execute('ffmpeg',['-v','error','-f','lavfi','-i','color=c=blue:s=64x64:r=8','-f','lavfi','-i','sine=frequency=1000:sample_rate=24000','-t','1','-c:v','mpeg4','-c:a','aac',video])
+ const result=await readChatAttachment(dir,'video.mp4',await readFile(video))
+ assert.equal(result.type,'mp4');assert.ok((result.images?.length??0)>0);assert.ok((result.images?.length??0)<=8)
+ assert.ok(result.images?.every(image=>image.mimeType==='image/jpeg'));assert.ok(result.durationSeconds!<=120)
+ assert.deepEqual(await readdir(path.join(dir,'attachments')),[]);assert.ok(!(await readdir(dir)).some(name=>name.startsWith('video-')))
+})
+
+test('HEIF stills and audio-only M4A are not treated as MP4 video', () => {
+  const box = (brand: string) => Buffer.concat([Buffer.from([0, 0, 0, 24]), Buffer.from(`ftyp${brand}`), Buffer.alloc(12)])
+  for (const brand of ['heic', 'avif', 'mif1', 'M4A ']) assert.equal(detectFileType(box(brand)), 'unknown')
+  for (const brand of ['isom', 'mp42']) assert.equal(detectFileType(box(brand)), 'mp4')
+})

package/test/host-executor.test.ts

@@ -13,6 +13,8 @@ import { RunStore } from '../src/runs.js'
 import { packageVersion } from '../src/version.js'
 import { executionDefaults } from '../src/model-policy.js'
 import { workspaceLease } from '../src/plugins/workspace-lease.mjs'
+import { ControlStore } from '../src/control-state.js'
+import { Scripts } from '../src/scripts.js'
 
 test('host restart replaces a lock whose PID was reused by another process',async()=>{
   const root=await mkdtemp(path.join(tmpdir(),'ez-host-reused-pid-'))
@@ -265,13 +267,13 @@ test('one installed CLI executes two agent bindings with separate minds and sani
     await assert.rejects(serveHostExecutor({cli:'grok',agents},new AbortController().signal),/already running/)
     const directory=path.join(agents[0].controlDir,'host-executor')
     const runs=new RunStore(agents[0].controlDir)
-    await runs.create({id:'r_hold',chatId:101,telegramUserId:101,texts:['test'],scheduled:{id:'held',revision:'v1',dueAt:new Date().toISOString(),pairedAt:new Date().toISOString()}})
+    await runs.create({id:'r_hold',execution:{sessionId:crypto.randomUUID(),preset:{id:'fixture',name:'Fixture',cli:'grok',model:'fixture-model'}},chatId:101,telegramUserId:101,texts:['test'],scheduled:{id:'held',revision:'v1',dueAt:new Date().toISOString(),pairedAt:new Date().toISOString()}})
     await runs.patch('r_hold',{status:'running'})
-    await writeFile(path.join(directory,'r_hold.request.json'),JSON.stringify({texts:['test'],options:{cli:'grok'}}))
+    await writeFile(path.join(directory,'r_hold.request.json'),JSON.stringify({texts:['test'],options:{cli:'grok',model:'fixture-model'}}))
     for(let n=0;n<100;n++){try{await readFile(path.join(directory,'r_hold.process.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
-    await new RunStore(agents[0].controlDir).create({id:'r_schedule_queued',chatId:101,telegramUserId:101,texts:['test'],scheduled:{id:'shared',revision:'v1',dueAt:new Date().toISOString(),pairedAt:new Date().toISOString()}})
+    await new RunStore(agents[0].controlDir).create({id:'r_schedule_queued',execution:{sessionId:crypto.randomUUID(),preset:{id:'fixture',name:'Fixture',cli:'grok',model:'fixture-model'}},chatId:101,telegramUserId:101,texts:['test'],scheduled:{id:'shared',revision:'v1',dueAt:new Date().toISOString(),pairedAt:new Date().toISOString()}})
     await new RunStore(agents[0].controlDir).patch('r_schedule_queued',{status:'running'})
-    await writeFile(path.join(directory,'r_schedule_queued.request.json'),JSON.stringify({texts:['test'],options:{cli:'grok',sharedWorkspace:'/wrong'}}))
+    await writeFile(path.join(directory,'r_schedule_queued.request.json'),JSON.stringify({texts:['test'],options:{cli:'grok',model:'fixture-model',sharedWorkspace:'/wrong'}}))
     const otherDirectory=path.join(agents[1].controlDir,'host-executor')
     await ownerRun(agents[1].controlDir,'r_other_shared')
     await writeFile(path.join(otherDirectory,'r_other_shared.request.json'),JSON.stringify({texts:['test'],options:{cli:'grok'}}))
@@ -285,10 +287,10 @@ test('one installed CLI executes two agent bindings with separate minds and sani
       return output.trim().split('\n').map(line=>JSON.parse(line))
     }
     // Chat completes while this agent's scheduled turn stays active. A second
-    // scheduled turn still waits, and the shared lifecycle lease stays held.
+    // scheduled turn also completes, and the held job keeps the lifecycle lease.
     await completed(otherDirectory,'r_other_shared')
     const chatEvents=await completed(directory,'tg_42')
-    assert.ok(await readFile(path.join(directory,'r_schedule_queued.request.json')))
+    await completed(directory,'r_schedule_queued')
     assert.equal(await workspaceLease(agents[0].toolsHome),undefined)
     await ownerRun(agents[0].controlDir,'tg_43')
     await writeFile(path.join(directory,'tg_43.request.json'),JSON.stringify({texts:['Hold chat'],options:{cli:'grok'}}))
@@ -525,3 +527,44 @@ test('startup replaces prior catalog after provider policy changes even when dis
     assert.deepEqual(JSON.parse(await readFile(path.join(directory,'models.json'),'utf8')),[])
   } finally {abort.abort();await server;await rm(root,{recursive:true,force:true})}
 })
+
+test('host transport runs a registered script from the run record and refuses changed entry-point bytes', async () => {
+  const root=await mkdtemp(path.join(tmpdir(),'ez-host-script-'))
+  const workspace=path.join(root,'mind'),controlDir=path.join(root,'control'),directory=path.join(controlDir,'host-executor')
+  const abort=new AbortController();let server:Promise<void>|undefined
+  const oldToken=process.env.TELEGRAM_BOT_TOKEN
+  try {
+    await mkdir(workspace);await mkdir(directory,{recursive:true})
+    await writeFile(path.join(workspace,'guard.mjs'),"console.log(JSON.stringify({cwd:process.cwd(),args:process.argv.slice(2),due:process.env.EZ_DUE_AT,token:process.env.TELEGRAM_BOT_TOKEN}))\n")
+    process.env.TELEGRAM_BOT_TOKEN='must-not-reach-host-script'
+    await ownerRun(controlDir,'r_seed')
+    const owner=(await new ControlStore(controlDir,900000).status()).owner!
+    const registration=await new Scripts(controlDir).save({id:'guard',owner,workspace,entry:'guard.mjs',interpreter:'node',args:['saved'],timeoutSeconds:60},true)
+    const runs=new RunStore(controlDir)
+    const scripted=async(id:string)=>{
+      await runs.create({id,chatId:101,telegramUserId:101,texts:['[schedule]'],script:{id:'guard',args:['extra'],revision:registration.revision,sha256:registration.sha256},
+        scheduled:{id:'s_guard',revision:'rev1',dueAt:'2026-10-07T11:15:00.000Z',pairedAt:owner.pairedAt}})
+      await runs.patch(id,{status:'running'})
+      // The request cannot choose the command, script or workspace.
+      await writeFile(path.join(directory,`${id}.request.json`),JSON.stringify({texts:['x'],options:{workspace:'/wrong',cli:'grok',script:{id:'other',args:['injected']},timeoutMs:0}}))
+      let events:any[]=[]
+      for(let n=0;n<300;n++){try{events=(await readFile(path.join(directory,`${id}.events`),'utf8')).trim().split('\n').map(l=>JSON.parse(l));if(events.some(e=>e.stream==='exit'))break}catch{}await new Promise(r=>setTimeout(r,20))}
+      return events
+    }
+    server=serveHostExecutor({cli:'grok',agents:[{name:'test',workspace,controlDir,binDir:root}]},abort.signal,undefined,async()=>[])
+    const events=await scripted('r_schedule_script_ok')
+    assert.equal(events.find(e=>e.stream==='exit')?.code,0)
+    const result=JSON.parse(events.filter(e=>e.stream==='stdout').map(e=>e.text).join(''))
+    assert.equal(result.cwd,await realpath(workspace));assert.deepEqual(result.args,['saved','extra'])
+    assert.equal(result.due,'2026-10-07T11:15:00.000Z');assert.equal(result.token,undefined)
+    await writeFile(path.join(workspace,'guard.mjs'),"console.log('changed')\n")
+    const refused=await scripted('r_schedule_script_changed')
+    assert.equal(refused.find(e=>e.stream==='exit')?.code,1)
+    assert.equal(refused.filter(e=>e.stream==='stdout').length,0)
+    assert.match(refused.filter(e=>e.stream==='stderr').map(e=>e.text).join(''),/entry point changed since registration/)
+  }finally{
+    abort.abort();await server
+    if(oldToken===undefined)delete process.env.TELEGRAM_BOT_TOKEN;else process.env.TELEGRAM_BOT_TOKEN=oldToken
+    await rm(root,{recursive:true,force:true})
+  }
+})

package/test/install-json.test.mjs

@@ -0,0 +1,21 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { run, latestCodexVersion } from '../src/install-tools.mjs';
+
+test('Codex discovery parses stdout and retains failure diagnostics',async()=>{
+  const script=`process.stdout.write('"0.160.1"\\n');process.stderr.write('package manager notice\\n');`;
+  const invoke=(command,args,options)=>{
+    assert.equal(command,'pnpm');
+    assert.deepEqual(args,['view','@openai/codex@latest','version','--json','--registry','https://registry.npmjs.org/']);
+    assert.equal(options.stdoutOnly,true);
+    return run(process.execPath,['-e',script],options);
+  };
+  assert.equal(await latestCodexVersion(invoke,{command:'pnpm',args:[]}),'0.160.1');
+  await assert.rejects(run(process.execPath,['-e',script+'process.exitCode=1'],{stdoutOnly:true}),/package manager notice/);
+});
+
+test('Codex discovery rejects contaminated stdout without leaking it',async()=>{
+  await assert.rejects(latestCodexVersion(async()=> '"0.160.1"\nprivate-output'),{message:'Codex version discovery returned invalid JSON on stdout'});
+  for(const value of ['null','{}','["0.160.1"]','"latest"'])
+    await assert.rejects(latestCodexVersion(async()=>value),/Invalid latest Codex version/);
+});

package/test/install-tools.test.mjs

@@ -79,19 +79,20 @@ test('isolated deployments need no host ledger endpoint',async t=>{
 });
 test('same-artifact build retries do not spawn a second Docker build and reuse verified completed image',async t=>{
   const home=await fixture(t),source=path.join(home,'source');await fs.mkdir(source);await fs.writeFile(path.join(source,'package.json'),'{}');
-  let started,finish,count=0;const running=new Promise(r=>started=r),held=new Promise(r=>finish=r);
-  const invoke=async(cmd,args)=>{if(cmd==='npm')return JSON.stringify([{files:[{path:'package.json'}]}]);if(args[0]==='build'){count++;started();await held;}return 'sha256:fixture';};
+  let started,finish,count=0,latest='0.160.0';const running=new Promise(r=>started=r),held=new Promise(r=>finish=r);
+  const invoke=async(cmd,args)=>{if(cmd==='npm'&&args?.[0]==='view')return JSON.stringify(latest);if(cmd==='npm')return JSON.stringify([{files:[{path:'package.json'}]}]);if(args[0]==='build'){count++;started();await held;}return 'sha256:fixture';};
   const first=build({home,source},invoke);await running;
   assert.equal((await build({home,source},invoke)).state,'busy-or-interrupted');assert.equal(count,1);
   finish();const result=await first;assert.equal(result.state,'completed');
   assert.equal((await build({home,source},invoke)).reused,true);assert.equal(count,1);
   await fs.writeFile(path.join(source,'package.json'),'{"changed":true}');await build({home,source},invoke);assert.equal(count,2);
+  latest='0.160.1';const newer=await build({home,source},invoke);assert.equal(count,3);assert.equal(newer.codexVersion,latest);assert.notEqual(newer.image,result.image);
 });
 test('source checkouts build RCs only: clean reviewed commit plus increasing label',async t=>{
   const home=await fixture(t),source=path.join(home,'source');await fs.mkdir(source);await fs.writeFile(path.join(source,'package.json'),'{}');
   let inside=true,status='',built=[],toplevel=source;const sha='a'.repeat(40);
   const invoke=async(cmd,args)=>{
-    if(cmd==='npm')return JSON.stringify([{files:[{path:'package.json'}]}]);
+    if(cmd==='npm'&&args?.[0]==='view')return '"0.160.0"';if(cmd==='npm')return JSON.stringify([{files:[{path:'package.json'}]}]);
     if(cmd==='git'){
       if(!inside)throw Error('not a git repository');
       if(args[2]==='rev-parse'&&args[3]==='--show-toplevel')return toplevel;
@@ -120,13 +121,13 @@ test('source checkouts build RCs only: clean reviewed commit plus increasing lab
 });
 test('a failed build releases its own lock and leaves a failure receipt for diagnosis',async t=>{
   const home=await fixture(t),source=path.join(home,'source');await fs.mkdir(source);await fs.writeFile(path.join(source,'package.json'),'{}');
-  const invoke=async(cmd)=>{if(cmd==='npm')return JSON.stringify([{files:[{path:'package.json'}]}]);throw Error('Synthetic build failed');};
+  const invoke=async(cmd,args)=>{if(cmd==='npm'&&args?.[0]==='view')return '"0.160.0"';if(cmd==='npm')return JSON.stringify([{files:[{path:'package.json'}]}]);throw Error('Synthetic build failed');};
   await assert.rejects(build({home,source},invoke),/Synthetic/);
   const [id]=await fs.readdir(path.join(home,'builds'));const dir=path.join(home,'builds',id);
   assert.equal(JSON.parse(await fs.readFile(path.join(dir,'status.json'))).state,'failed');await assert.rejects(fs.access(path.join(dir,'lock')));
 });
 test('source changes during a build cannot produce a reusable success receipt',async t=>{
   const home=await fixture(t),source=path.join(home,'source');await fs.mkdir(source);await fs.writeFile(path.join(source,'package.json'),'{}');
-  const invoke=async(cmd,args)=>{if(cmd==='npm')return JSON.stringify([{files:[{path:'package.json'}]}]);if(args[0]==='build')await fs.writeFile(path.join(source,'package.json'),'{"changed":true}');return 'image';};
+  const invoke=async(cmd,args)=>{if(cmd==='npm'&&args?.[0]==='view')return '"0.160.0"';if(cmd==='npm')return JSON.stringify([{files:[{path:'package.json'}]}]);if(args[0]==='build')await fs.writeFile(path.join(source,'package.json'),'{"changed":true}');return 'image';};
   await assert.rejects(build({home,source},invoke),/changed during build/);
 });

package/test/native-tasks.test.ts

@@ -20,7 +20,7 @@ test('native tasks use verified control binding, sanitized environment and uncha
     const denied=await nativeTasks(home,['list']);assert.notEqual(denied.code,0);assert.match(denied.stderr,/Pair an owner/)
     const control=new ControlStore(controlDir,1000);await control.requestPairing(101,101);await control.approveOwner(101)
     const text='Read scan; $(must-not-run) /goal literal'
-    const saved=await nativeTasks(home,['create','native-fixture','--now','--text',text]);assert.equal(saved.code,0,saved.stderr)
+    const saved=await nativeTasks(home,['create','native-fixture','--model','fixture-model','--now','--text',text]);assert.equal(saved.code,0,saved.stderr)
     const value=JSON.parse(saved.stdout);assert.equal(value.text,text);assert.equal(value.execution.preset.cli,'grok')
     assert.equal(JSON.parse((await nativeTasks(home,['show','native-fixture'])).stdout).text,text)
     assert.equal((await nativeTasks(home,['remove','native-fixture'])).code,0)