@jc_stack/ez-agents 0.1.0-beta.46 → 0.1.0-beta.48

package/test/plugin-broker.test.mjs

@@ -182,3 +182,67 @@ test('broker rejects resolve and invoke for a revoked run', async t => {
     await serving;
   }
 });
+
+test('scheduled preflight uses authoritative configuration and rejects writes or stale revisions', async t => {
+  const f = await fixture(t);
+  const { Scheduler } = await import('../src/scheduler.js');
+  const { createLedgerHandler, serveDeliverySocket } = await import('../src/delivery-socket.js');
+  const control = new ControlStore(f.controlDir, 1000);
+  const owner = (await control.status()).owner;
+  const scheduler = new Scheduler(f.controlDir);
+  const schedule = await scheduler.save({id:'check', name:'Check', text:'Saved worker', enabled:true, owner,
+    execution:{sessionId:randomUUID(),preset:{id:'test',name:'test',cli:'codex',model:'fixture-model'}},
+    trigger:{everySeconds:60,start:new Date().toISOString()},preflight:{on:'eligible',checks:[{alias:'sample',args:['queue']}]}});
+  const ledger = await serveDeliverySocket(f.controlDir, createLedgerHandler(f.controlDir,{wake:()=>{},status:()=>({polling:false,applicationOnly:true,telegramConfigured:false,version:'fixture'})}));
+  t.after(()=>ledger.stop());
+  await fs.writeFile(path.join(f.fake,'docker'), `#!${process.execPath}\nprocess.stdout.write(JSON.stringify({schemaVersion:1,eligible:true,count:1,fingerprint:'a'.repeat(64),observedAt:new Date().toISOString()}));\n`, {mode:0o700});
+  const previousPath=process.env.PATH;process.env.PATH=f.fake+path.delimiter+previousPath;
+  const binding=await loadPluginBrokerBinding({home:f.home,workspace:f.workspace,controlDir:f.controlDir,socket:f.socket,hostConfig:f.hostConfig,timeoutMs:10000});
+  const abort=new AbortController(),serving=servePluginBroker(binding,abort.signal);
+  try {
+    await waitForSocket(f.socket);
+    const payload={version:1,id:randomUUID(),operation:'preflight',scheduleId:schedule.id,revision:schedule.revision};
+    assert.equal((await request(f.socket,{...payload,args:['write']})).ok,false);
+    assert.equal((await request(f.socket,{...payload,revision:randomUUID()})).ok,false);
+    assert.equal((await request(f.socket,payload)).ok,false); // undeclared read-only command
+    const file=path.join(f.home,'registry.json'),registry=JSON.parse(await fs.readFile(file,'utf8'));
+    registry.plugins.sample.manifest.commands.sample.exposure={receivesExternalContent:true,changesRecords:false,sendsExternally:false,requiresReview:false};
+    await fs.writeFile(file,JSON.stringify(registry));
+    const accepted=await request(f.socket,payload);assert.equal(accepted.ok,true);assert.equal(accepted.result.eligible,true);
+    await scheduler.save({...schedule,enabled:false});
+    assert.equal((await request(f.socket,payload)).ok,false);
+  } finally {abort.abort();await serving;process.env.PATH=previousPath;}
+});
+
+test('task launch broker admits only its fixed application command and writes no bearer into receipts',async t=>{
+  const {createServer}=await import('node:http');
+  const {Tasks}=await import('../src/tasks.js');const {EventSources}=await import('../src/event-sources.js');
+  const {ApplicationBindings}=await import('../src/application-channel.js');const {serveTestLedger}=await import('./helpers/ledger.js');
+  const f=await fixture(t), runs=new RunStore(f.controlDir), control=new ControlStore(f.controlDir,900000);
+  const sourceSocket=path.join(f.root,'source.sock');const provider=createServer(async(req,res)=>{
+    let raw='';for await(const c of req)raw+=c;const v=JSON.parse(raw);
+    res.end(JSON.stringify({ok:true,data:v.command==='events-head'?{cursor:0,accountId:'fixture-account',taskProtocol:'message-v1'}:{}}));
+  });await new Promise(r=>provider.listen(sourceSocket,r));
+  const tasks=new Tasks(f.controlDir),owner=(await control.status()).owner;
+  await new EventSources(f.controlDir).register('fixture',sourceSocket,owner);
+  const task=await tasks.ownerCall(f.runId,'start',{sourceId:'fixture',conversationId:'discussion-a',purpose:'Synthetic discussion',context:'Only synthetic records',hours:1});
+  const taskRun='event_'+hash(task.id);await runs.patch(taskRun,{status:'running'});
+  const bindings=new ApplicationBindings(f.controlDir);await bindings.register('browser','z'.repeat(48),owner);
+  await bindings.taskLaunch('browser',{command:'sample',args:['launch','--task'],tasks:[task.id]});
+  const token='c'.repeat(64),ticketHash=hash(token),grant=await tasks.workerCall(taskRun,'application_launch',{application:'browser',ticketHash});
+  const input={taskId:task.id,taskToken:token,expiresAt:grant.expiresAt};
+  const ledger=await serveTestLedger(f.controlDir);
+  const binding=await loadPluginBrokerBinding({home:f.home,workspace:f.workspace,controlDir:f.controlDir,socket:f.socket,hostConfig:f.hostConfig,timeoutMs:10000});
+  const oldPath=process.env.PATH;process.env.PATH=f.fake+path.delimiter+oldPath;
+  const abort=new AbortController(),serving=servePluginBroker(binding,abort.signal);
+  try{
+    await waitForSocket(f.socket);
+    const denied=await request(f.socket,{version:1,id:randomUUID(),operation:'resolve',runId:taskRun,alias:'sample'});assert.equal(denied.ok,false);
+    const launch=await request(f.socket,{version:1,id:randomUUID(),operation:'task-launch',runId:taskRun,stdin:JSON.stringify(input)});
+    assert.equal(launch.ok,true,launch.error);assert.equal(launch.stdout,'broker-ok');assert.equal(launch.receipt.status,'completed');
+    const receipt=await fs.readFile(launch.receiptPath,'utf8');assert(!receipt.includes(token));assert(!receipt.includes('taskToken'));
+    const wrong=await request(f.socket,{version:1,id:randomUUID(),operation:'task-launch',runId:f.runId,stdin:JSON.stringify(input)});assert.equal(wrong.ok,false);
+    await bindings.taskLaunch('browser',null);
+    const revoked=await request(f.socket,{version:1,id:randomUUID(),operation:'task-launch',runId:taskRun,stdin:JSON.stringify(input)});assert.equal(revoked.ok,false);
+  }finally{abort.abort();await serving;process.env.PATH=oldPath;await ledger.stop();provider.closeAllConnections();await new Promise(r=>provider.close(r));}
+});

package/test/plugin-manager.test.mjs

@@ -652,3 +652,23 @@ test('writable folders require an explicit per-folder grant and can be revoked',
  assert.equal((await compose(config,record)).services.sample.volumes.find(v=>v.target==='/data/files').read_only,true);
  await assert.rejects(f.call('plugins','folder-unbind','sample','--service','sample','--target','/data/files','--writable'),/Supply/);
 });
+
+test('command admission waits for a live short lock without removing it',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ let release,started;
+ const ready=new Promise(resolve=>started=resolve),hold=new Promise(resolve=>release=resolve);
+ const writer=locked(f.home,async()=>{started();await hold;});
+ await ready;
+ const call=f.call('sample','read');
+ await new Promise(resolve=>setTimeout(resolve,100));
+ assert.equal(JSON.parse(await fs.readFile(path.join(f.home,'registry.lock'),'utf8')).pid,process.pid);
+ release();await writer;
+ assert.deepEqual(JSON.parse((await call).stdout),['read']);
+});
+
+test('bounded lock admission times out without stealing an interrupted lock',async t=>{
+ const f=await fixture(t),file=path.join(f.home,'registry.lock');
+ await fs.mkdir(f.home,{recursive:true});await fs.writeFile(file,'preserved');
+ await assert.rejects(locked(f.home,async()=>assert.fail('must not enter'),{waitMs:50}),/Registry busy/);
+ assert.equal(await fs.readFile(file,'utf8'),'preserved');
+});

package/test/private-speech-config.test.ts

@@ -0,0 +1,22 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import {mkdtempSync,writeFileSync,openSync,closeSync,rmSync} from 'node:fs'
+import {spawnSync} from 'node:child_process'
+import {join} from 'node:path'
+import {loadConfig} from '../src/config.js'
+
+test('installed private descriptor admits speech selectors and keeps speech keys out of the executor', () => {
+  const dir=mkdtempSync('/tmp/ez-speech-env-'),file=join(dir,'relay.env'),key='synthetic-private-speech-marker'
+  try {
+    writeFileSync(file,`OPENROUTER_API_KEY=${key}\nEZ_SPEECH_PROVIDER=invalid-private-selector\nEZ_SPEECH_MODEL=fish-audio/s2.1-pro-free:free\n`,{mode:0o600})
+    let fd=openSync(file,'r')
+    const invalid=spawnSync(process.execPath,['--import','tsx','docker/run.ts','start'],{encoding:'utf8',timeout:15000,env:{PATH:process.env.PATH,EZ_APPLICATION_PORT:'8787'},stdio:['ignore','pipe','pipe',fd]});closeSync(fd)
+    assert.equal(invalid.status,1);assert.match(invalid.stderr,/Invalid EZ_SPEECH_PROVIDER/);assert.ok(!invalid.stderr.includes(key))
+    writeFileSync(file,`OPENROUTER_API_KEY=${key}\nEZ_SPEECH_PROVIDER=openrouter\nEZ_SPEECH_MODEL=fish-audio/s2.1-pro-free:free\n`,{mode:0o600})
+    fd=openSync(file,'r')
+    const child=spawnSync(process.execPath,['--import','tsx','docker/run.ts','exec',process.execPath,'-e',"if(process.env.OPENROUTER_API_KEY||process.env.EZ_SPEECH_PROVIDER)process.exit(91);console.log('isolated')"],{encoding:'utf8',timeout:15000,env:{PATH:process.env.PATH},stdio:['ignore','pipe','pipe',fd]});closeSync(fd)
+    assert.equal(child.status,0,child.stderr);assert.equal(child.stdout.trim(),'isolated')
+    const config=loadConfig({EZ_APPLICATION_PORT:'8787',OPENROUTER_API_KEY:key,EZ_SPEECH_PROVIDER:'openrouter',EZ_SPEECH_MODEL:'fish-audio/s2.1-pro-free:free'})
+    assert.equal(config.openrouterApiKey,key);assert.equal(config.speechProvider,'openrouter');assert.equal(config.speechModel,'fish-audio/s2.1-pro-free:free')
+  } finally {rmSync(dir,{recursive:true,force:true})}
+})

package/test/run-evidence.test.ts

@@ -0,0 +1,78 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { createHash } from 'node:crypto'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { ownerRun } from './helpers/owner-run.js'
+import { serveTestLedger } from './helpers/ledger.js'
+import { RunStore } from '../src/runs.js'
+import { ControlStore } from '../src/control-state.js'
+import { runEvidence, projectRunEvidence } from '../src/run-evidence.js'
+
+async function fixture(t: test.TestContext) {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-evidence-'))
+  await ownerRun(dir, 'owner_run')
+  const ledger = await serveTestLedger(dir)
+  t.after(async () => { await ledger.stop(); await rm(dir, { recursive: true, force: true }) })
+  return { dir, runs: new RunStore(dir), owner: (await new ControlStore(dir, 1000).status()).owner! }
+}
+
+test('CLI projects operational proof without sessions, failure prose or delivered text', async t => {
+  const { dir, runs } = await fixture(t)
+  const secret = 'private-session-or-token'
+  await runs.patch('owner_run', { nativeSessionId: secret, failureReason: secret,
+    failure: { error: secret, relayVersion: '0.1.0-beta.47' } })
+  const sent = await runs.enqueueMessage('owner_run', 'private financial report')
+  await runs.claimOutbox(sent.id); await runs.markOutboxSent(sent.id, [7])
+  const uncertain = await runs.enqueueMessage('owner_run', 'uncertain report')
+  await runs.claimOutbox(uncertain.id); await runs.failOutbox(uncertain.id, secret, true)
+  const control = await new ControlStore(dir, 1000).status()
+  const { stdout } = await promisify(execFile)(process.execPath, ['bin/ezenciel-agents-schedule.mjs', 'evidence'], {
+    env: { ...process.env, EZ_CONTROL_DIR: dir, EZ_RUN_ID: 'owner_run' },
+  })
+  const result = JSON.parse(stdout)
+  assert.equal(result.runs.length, 1)
+  assert.ok(!stdout.includes(secret) && !stdout.includes('private financial report') && !stdout.includes('uncertain report'))
+  const receipts = result.runs[0].deliveries
+  assert.equal(receipts.find((r: any) => r.id === sent.id).receiptVerified, true)
+  assert.equal(receipts.find((r: any) => r.id === sent.id).content.sha256, createHash('sha256').update('private financial report').digest('hex'))
+  assert.equal(receipts.find((r: any) => r.id === uncertain.id).state, 'unknown')
+  assert.equal(receipts.find((r: any) => r.id === uncertain.id).receiptVerified, false)
+  assert.equal(result.runs[0].toolDelegationMetadata.state, 'unavailable')
+  assert.deepEqual(await new ControlStore(dir, 1000).status(), control)
+})
+
+test('pages require an unchanged snapshot and exact identity', async t => {
+  const { dir, runs } = await fixture(t)
+  await ownerRun(dir, 'second_run')
+  const first = await runEvidence(dir, { limit: 1 })
+  assert.equal(first.coverage.total, 2)
+  assert.equal(first.coverage.nextOffset, 1)
+  const second = await runEvidence(dir, { limit: 1, offset: 1, expected: first.snapshotSha256 })
+  assert.equal(second.coverage.nextOffset, null)
+  assert.notEqual(second.runs[0].id, first.runs[0].id)
+  await assert.rejects(runEvidence(dir, { offset: 1 }), /requires/)
+  await runs.patch('second_run', { status: 'completed' })
+  await assert.rejects(runEvidence(dir, { offset: 1, expected: first.snapshotSha256 }), /changed/)
+  await assert.rejects(runEvidence(dir, { runId: '../owner_run' }), /identifier/)
+  for (const options of [{ limit: 101 }, { offset: -1 }, { offset: 0.5 }, { expected: 'bad' }])
+    await assert.rejects(runEvidence(dir, options))
+})
+
+test('revoked owners, restricted callers and unrelated bindings are excluded', async t => {
+  const { dir, runs, owner } = await fixture(t)
+  const stranger = await runs.create({ id: 'other_owner', chatId: 202, telegramUserId: 202, texts: ['secret'] })
+  const external = await ownerRun(dir, 'external', { sourceId: 'test', bindingId: 'binding', eventIds: ['1'] })
+  const old = { ...(await runs.get('owner_run'))!, id: 'old_run', scheduled: { id: 'schedule', revision: 'rev', dueAt: '2026-01-01T00:00:00Z', pairedAt: 'old-pairing' } }
+  const app = { ...(await runs.get('owner_run'))!, id: 'app_run', delivery: { bindingId: 'private', scope: 'private' } }
+  assert.deepEqual(projectRunEvidence([stranger, external, old, app], [], owner), [])
+  await assert.rejects(runEvidence(dir, { callerRunId: 'external' }), /blocked/)
+  await runs.patch('owner_run', { replyOnly: true })
+  await assert.rejects(runEvidence(dir, { callerRunId: 'owner_run' }), /Telegram owner/)
+  await assert.rejects(runEvidence(dir, { runId: 'other_owner' }), /Unknown/)
+  await new ControlStore(dir, 1000).revokeOwner()
+  await assert.rejects(runEvidence(dir), /No authorized owner/)
+})

package/test/schedule-cli.test.ts

@@ -10,6 +10,8 @@ import { ControlStore } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
 import { initialPreset } from '../src/ai.js'
 import { serveTestLedger } from './helpers/ledger.js'
+import { Scheduler } from '../src/scheduler.js'
+import { callDeliverySocket, socketPathFor } from '../src/delivery-socket.js'
 const exec=promisify(execFile),bin=fileURLToPath(new URL('../bin/ezenciel-agents-schedule.mjs',import.meta.url))
 test('public scheduler CLI saves literal text, reads back, edits, pauses, and rejects external or finished callers',async t=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-schedule-cli-'));t.after(()=>rm(dir,{recursive:true,force:true}))
@@ -25,10 +27,11 @@ test('public scheduler CLI saves literal text, reads back, edits, pauses, and re
   const context=JSON.parse((await exec(process.execPath,[bin,'context'],{env})).stdout)
   assert.deepEqual(context.run.texts,['owner request']);assert.equal(context.busyReplies,undefined)
  await assert.rejects(exec(process.execPath,[bin,'context'],{env:{...env,EZ_RUN_ID:''}}),/active owner run/)
- const args=['create','test','--at','2027-09-09T09:00:00+04:00','--text','Literal $(do-not-execute) /goal objective']
+ await assert.rejects(exec(process.execPath,[bin,'create','missing-model','--now','--text','Do work'],{env}),/saved explicit model/)
+ const args=['create','test','--model','fixture-model','--at','2027-09-09T09:00:00+04:00','--text','Literal $(do-not-execute) /goal objective']
  const saved=JSON.parse((await exec(process.execPath,[bin,...args],{env})).stdout)
  assert.equal(saved.text,args.at(-1));assert.equal(saved.execution.preset.cli,'grok')
- assert.equal(saved.execution.preset.model,undefined);assert.equal(saved.execution.preset.effort,undefined)
+ assert.equal(saved.execution.preset.model,'fixture-model');assert.equal(saved.execution.preset.effort,undefined)
  await assert.rejects(exec(process.execPath,[bin,'create','blocked','--at','2027-09-09T09:00:00+04:00','--text','test','--model','gpt-5.6-terra','--effort','bad option'],{env}),/Invalid reasoning effort/)
  const astra=JSON.parse((await exec(process.execPath,[bin,'create','astra','--at','2027-09-09T10:00:00+04:00','--text','Astra task','--model','gpt-6-astra'],{env})).stdout)
  assert.equal(astra.execution.preset.model,'gpt-6-astra');assert.equal(astra.execution.preset.effort,undefined)
@@ -68,6 +71,47 @@ test('executor PATH exposes the extensionless scheduler command',async()=>{
   assert.match((await exec(command,['--help'])).stdout,/Creates a scheduled task/)
 })
 
+test('trigger uses saved task settings after a chat switch, preserves cadence and reconciles its request key',async t=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-trigger-cli-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
+ const control=new ControlStore(dir,1000),runs=new RunStore(dir),scheduler=new Scheduler(dir)
+ await control.requestPairing(101,101);await control.approveOwner(101)
+ const owner=(await control.status()).owner!
+ const execution={sessionId:crypto.randomUUID(),preset:{id:'task',name:'Saved task',cli:'codex',model:'gpt-6-astra',effort:'medium'}}
+ const saved=await scheduler.save({id:'daily',name:'Daily',text:'Literal /goal task',owner,execution,enabled:true,trigger:{cron:'5 7 * * 1-5',timezone:'America/New_York',start:'2027-01-01T00:00:00Z'}},true)
+ const next=await scheduler.pendingOccurrence(saved)
+ const chat=await control.captureChoice({...initialPreset('codex'),model:'fixture-model'})
+ await control.savePreset({id:'chat',name:'Chat',cli:'codex',model:'gpt-6-luna',effort:'max'})
+ await control.selectPreset('chat',chat.sessionId)
+ assert.equal((await control.status()).ai?.selectedId,'chat')
+ const env={...process.env,EZ_CONTROL_DIR:dir,EZ_RUN_ID:''}
+ const args=[bin,'trigger','daily','--key','smoke-1']
+ const first=JSON.parse((await exec(process.execPath,args,{env})).stdout)
+ assert.equal(first.status,'queued');assert.deepEqual(first.execution.preset,execution.preset)
+ assert.notEqual(first.execution.sessionId,execution.sessionId)
+ assert.equal(first.scheduled.id,saved.id);assert.equal(first.scheduled.revision,saved.revision)
+ assert.equal(first.texts[1],saved.text)
+ assert.deepEqual(await scheduler.get('daily'),saved);assert.equal(await scheduler.pendingOccurrence(saved),next)
+ const retry=JSON.parse((await exec(process.execPath,args,{env})).stdout)
+ assert.equal(retry.id,first.id);assert.equal((await runs.list()).length,1)
+ await assert.rejects(exec(process.execPath,[bin,'trigger','daily','--key','different'],{env}),/queued or running/)
+ await assert.rejects(exec(process.execPath,[...args,'--model','gpt-6-luna'],{env}),/overrides are not allowed/)
+ await runs.patch(first.id,{status:'completed'})
+ const parallel=await Promise.allSettled(['smoke-2','smoke-3'].map(key=>callDeliverySocket(socketPathFor(dir),{op:'triggerSchedule',payload:{scheduleId:'daily',revision:saved.revision,key}})))
+ assert.equal(parallel.filter(r=>r.status==='fulfilled').length,1,'concurrent trigger keys cannot overlap')
+ for(const run of await runs.list())await runs.patch(run.id,{status:'completed'})
+ const restricted=await runs.create({chatId:101,telegramUserId:101,texts:[],execution,external:{sourceId:'source',bindingId:'binding',eventIds:['event']}})
+ await runs.patch(restricted.id,{status:'running'})
+ await assert.rejects(callDeliverySocket(socketPathFor(dir),{op:'triggerSchedule',payload:{scheduleId:'daily',revision:saved.revision,key:'restricted',callerRunId:restricted.id}}),/blocked/)
+ await assert.rejects(callDeliverySocket(socketPathFor(dir),{op:'triggerSchedule',payload:{scheduleId:'daily',revision:'stale',key:'stale'}}),/changed/)
+ await assert.rejects(exec(process.execPath,[bin,'trigger','daily','--key','../bad'],{env}),/Invalid record identifier/)
+ await scheduler.enable('daily',false)
+ await assert.rejects(exec(process.execPath,[bin,'trigger','daily','--key','paused'],{env}),/disabled/)
+ await scheduler.enable('daily',true)
+ await control.revokeOwner();await control.requestPairing(202,202);await control.approveOwner(202)
+ await assert.rejects(exec(process.execPath,[bin,'trigger','daily','--key','wrong-owner'],{env}),/ownership mismatch/)
+})
+
 
 test('deferred literal input retains owner-scoped conversation through source metadata',async t=>{
  const {Scheduler}=await import('../src/scheduler.js')
@@ -75,7 +119,7 @@ test('deferred literal input retains owner-scoped conversation through source me
  const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
  const control=new ControlStore(dir,1000),runs=new RunStore(dir)
  await control.requestPairing(101,101);await control.approveOwner(101)
- const execution=await control.captureChoice(initialPreset('codex'))
+ const execution=await control.captureChoice({...initialPreset('codex'),model:'fixture-model'})
  await runs.create({id:'tg_1',chatId:101,telegramUserId:101,texts:['Use the blue ledger'],execution})
  await runs.patch('tg_1',{status:'completed'})
  await runs.create({id:'tg_2',chatId:101,telegramUserId:101,texts:['Do the same for March'],execution})

package/test/schedule-preflight.test.ts

@@ -0,0 +1,49 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import {mkdtemp,rm,readFile} from 'node:fs/promises'
+import {join} from 'node:path'
+import {tmpdir} from 'node:os'
+import {randomUUID} from 'node:crypto'
+import {Scheduler} from '../src/scheduler.js'
+import {RunStore} from '../src/runs.js'
+import {validPreflight,combinePreflight} from '../src/schedule-preflight.js'
+const packet=(eligible:boolean,fingerprint='a'.repeat(64))=>({eligible,fingerprint,count:eligible?1:0,observedAt:new Date().toISOString()})
+test('preflight skips empty/unchanged work, admits saved worker once, and fails closed',async t=>{
+ const dir=await mkdtemp(join(tmpdir(),'schedule-preflight-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ let result=packet(false),failed=false
+ const scheduler=new Scheduler(dir,async()=>{if(failed)throw Error('Provider unavailable');return result}),runs=new RunStore(dir)
+ const owner={telegramUserId:42,telegramChatId:42,pairedAt:new Date().toISOString()},start=Date.now()+10000
+ const input={id:'preflight',name:'Check',text:'Do role work',enabled:true,owner,execution:{sessionId:randomUUID(),preset:{id:'test',name:'test',cli:'codex',model:'fixture-model'}},trigger:{everySeconds:60,start:new Date(start).toISOString()},preflight:{on:'changed' as const,checks:[{alias:'provider-work',args:['--field','Role=RoleX']}]}}
+ const s=await scheduler.save(input)
+ await scheduler.tick(owner,runs,start);assert.equal((await runs.list()).length,0)
+ result=packet(true,'b'.repeat(64));await scheduler.tick(owner,runs,start+60000)
+ const [run]=await runs.list();assert.deepEqual(run.execution,s.execution)
+ await scheduler.tick(owner,runs,start+120000);assert.equal((await runs.list()).length,1)
+ await runs.patch(run.id,{status:'completed'});await scheduler.tick(owner,runs,start+180000);assert.equal((await runs.list()).length,1)
+ failed=true;await scheduler.tick(owner,runs,start+240000);assert.equal((await runs.list()).length,1);assert.equal((await scheduler.preflightReceipt(s)).state,'unavailable')
+ failed=false;result=packet(false);await assert.rejects(()=>scheduler.trigger(s.id,s.revision,'empty',owner,runs),/no eligible/)
+ result=packet(true,'c'.repeat(64));await scheduler.tick(owner,runs,start+300000);assert.equal((await runs.list()).length,2)
+})
+test('only bounded literal commands and fresh typed packets enter admission',()=>{
+ assert.equal(validPreflight({on:'eligible',checks:[{alias:'queue',args:['x']}] }),true)
+ assert.equal(validPreflight({on:'eligible',checks:[{alias:'queue',args:['x\nwrite']}] }),false)
+ assert.throws(()=>combinePreflight([{schemaVersion:1,...packet(true),eligible:'true'}]),/Invalid/)
+ assert.throws(()=>combinePreflight([{schemaVersion:1,...packet(true),observedAt:'2000-01-01T00:00:00Z'}]),/stale/)
+ assert.equal(combinePreflight([{schemaVersion:1,...packet(false)},{schemaVersion:1,...packet(true)}]).eligible,true)
+})
+
+test('manual preflight before the first tick preserves future recurrence',async t=>{
+ const dir=await mkdtemp(join(tmpdir(),'schedule-preflight-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ const scheduler=new Scheduler(dir,async()=>packet(true)),runs=new RunStore(dir)
+ const owner={telegramUserId:42,telegramChatId:42,pairedAt:new Date().toISOString()}
+ const s=await scheduler.save({id:'manual',name:'Manual',text:'Work',enabled:true,owner,
+  execution:{sessionId:randomUUID(),preset:{id:'test',name:'test',cli:'codex',model:'fixture-model'}},
+  trigger:{everySeconds:60,start:new Date(Date.now()+60000).toISOString()},
+  preflight:{on:'eligible',checks:[{alias:'provider-work',args:[]}]}})
+ const next=await scheduler.pendingOccurrence(s)
+ const manual=await scheduler.trigger(s.id,s.revision,'first',owner,runs)
+ assert.equal(await scheduler.pendingOccurrence(s),next)
+ await runs.patch(manual.id,{status:'completed'})
+ await scheduler.tick(owner,runs,next!)
+ assert.equal((await runs.list()).length,2)
+})

package/test/scheduled-tasks.test.ts

@@ -9,7 +9,7 @@ import { scheduledTaskDetailText, scheduledTasksText } from '../src/scheduled-ta
 import { RunStore } from '../src/runs.js'
 
 const owner = { telegramUserId: 101, telegramChatId: 101, pairedAt: '2026-09-11T00:00:00.000Z' }
-const execution = { sessionId: randomUUID(), preset: { id: 'fixture', name: 'Fixture', cli: 'codex' } }
+const execution = { sessionId: randomUUID(), preset: { id: 'fixture', name: 'Fixture', cli: 'codex', model: 'fixture-model' } }
 
 test('scheduled task view is read-only, owner-bound, and shows active task prompts and effective AI settings', async (t) => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-scheduled-tasks-'))
@@ -40,7 +40,7 @@ test('scheduled task view is read-only, owner-bound, and shows active task promp
   const active = await scheduler.listActiveReadOnly(await runs.list())
   const text = scheduledTasksText(active, owner)
 
-  assert.equal(text, '📅 Scheduled tasks · 1 active\n\nAll times UTC. Use /tasks 1 for task details.\n\n1 · Daily report\n  ● Active\n  Next · Thu, Jan 1 · 05:00 UTC\n  Last · ✓ Completed · Thu, Jan 1 · 05:04 UTC\n  codex · client default · default effort\n  Read the ledger and send the owner a concise report.')
+  assert.equal(text, '📅 Scheduled tasks · 1 active\n\nAll times UTC. Use /tasks 1 for task details.\n\n1 · Daily report\n  ● Active\n  Next · Thu, Jan 1 · 05:00 UTC\n  Last · ✓ Completed · Thu, Jan 1 · 05:04 UTC\n  codex · fixture-model · default effort\n  Read the ledger and send the owner a concise report.')
   assert.match(scheduledTaskDetailText(active.find(schedule => schedule.id === saved.id)!, 1), /Last run\n✓ Completed · Thu, Jan 1 · 05:04 UTC/)
   assert.doesNotMatch(text, /Other owner task|This must never be visible/)
   assert.equal(await readFile(join(scheduleDir, 'owner-task.json'), 'utf8'), before)

package/test/scheduler-host.test.ts

@@ -20,17 +20,32 @@ test('host transport keeps chat responsive beside a schedule in the bound mind',
  const old={...EXECUTOR_REGISTRY.grok},token=process.env.TELEGRAM_BOT_TOKEN
  EXECUTOR_REGISTRY.grok.command=process.execPath;EXECUTOR_REGISTRY.grok.buildArgs=()=>[script]
  process.env.TELEGRAM_BOT_TOKEN='never-in-child'
- const abort=new AbortController(),server=serveHostExecutor({cli:'grok',agents:[{name:'test',workspace,controlDir,binDir:root}]},abort.signal)
+ const abort=new AbortController(),server=serveHostExecutor({cli:'grok',agents:[{name:'test',workspace,controlDir,binDir:root}]},abort.signal,undefined,async()=>[{cli:'grok',model:'fixture-model',name:'Fixture',efforts:[]}])
  const dir=join(controlDir,'host-executor'),runs=new RunStore(controlDir),id='r_schedule_fixture'
  const exists=async(file:string)=>readFile(join(dir,file),'utf8').catch(()=>'')
  try{
   await until(async()=>Boolean(await exists('heartbeat.json')))
-  await runs.create({id,chatId:101,telegramUserId:101,texts:['slow'],execution:{sessionId:randomUUID(),preset:{id:'fixture',name:'Fixture',cli:'grok'}},scheduled:{id:'s',revision:'v',dueAt:new Date().toISOString(),pairedAt:'paired'}})
-  const submit=async(id:string)=>writeFile(join(dir,id+'.request.json'),JSON.stringify({texts:['fixture'],options:{workspace:'/evil',controlDir:'/evil',cli:'grok',timeoutMs:1}}))
+  await runs.create({id,chatId:101,telegramUserId:101,texts:['slow'],execution:{sessionId:randomUUID(),preset:{id:'fixture',name:'Fixture',cli:'grok',model:'fixture-model'}},scheduled:{id:'s',revision:'v',dueAt:new Date().toISOString(),pairedAt:'paired'}})
+  const submit=async(id:string)=>writeFile(join(dir,id+'.request.json'),JSON.stringify({texts:['fixture'],options:{workspace:'/evil',controlDir:'/evil',cli:'grok',model:'fixture-model',timeoutMs:1}}))
   await ownerRun(controlDir,'tg_1')
+  for(const [badId,savedModel,requestedModel,reason] of [
+    ['r_schedule_missing',undefined,undefined,'saved explicit model'],
+    ['r_schedule_mismatch','fixture-model','wrong-model','does not match'],
+  ] as const){
+    await runs.create({id:badId,chatId:101,telegramUserId:101,texts:['blocked'],execution:{sessionId:randomUUID(),preset:{id:'fixture',name:'Fixture',cli:'grok',model:savedModel}},scheduled:{id:badId,revision:'v',dueAt:new Date().toISOString(),pairedAt:'paired'}})
+    await runs.patch(badId,{status:'running'})
+    await writeFile(join(dir,badId+'.request.json'),JSON.stringify({texts:['blocked'],options:{cli:'grok',model:requestedModel}}))
+    await until(async()=> (await exists(badId+'.events')).includes('"stream":"exit"'))
+    assert.match(await exists(badId+'.events'),new RegExp(reason))
+    assert.equal(await exists(badId+'.process.json'),'','host must reject before engine spawn')
+  }
   await runs.patch(id,{status:'running'})
   await submit(id)
   await until(async()=>Boolean(await exists(id+'.process.json')))
+  const parallel='r_schedule_parallel'
+  await runs.create({id:parallel,chatId:101,telegramUserId:101,texts:['parallel'],execution:{sessionId:randomUUID(),preset:{id:'fixture',name:'Fixture',cli:'grok',model:'fixture-model'}},scheduled:{id:'parallel',revision:'v',dueAt:new Date().toISOString(),pairedAt:'paired'}})
+  await runs.patch(parallel,{status:'running'});await submit(parallel)
+  await until(async()=>Boolean(await exists(parallel+'.process.json')))
   await submit('tg_1')
   await until(async()=>(await exists('tg_1.events')).includes('"stream":"exit","code":0'))
   assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
@@ -49,6 +64,9 @@ test('host transport keeps chat responsive beside a schedule in the bound mind',
   assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
   await writeFile(join(dir,id+'.cancel'),'')
   await until(async()=>(await exists(id+'.events')).includes('"stream":"exit"'))
+  assert.ok(!(await exists(parallel+'.events')).includes('"stream":"exit"'))
+  await writeFile(join(dir,parallel+'.cancel'),'')
+  await until(async()=>(await exists(parallel+'.events')).includes('"stream":"exit"'))
   await until(async()=>(await exists('tg_1.events')).includes('"stream":"exit","code":0'))
   await until(async()=>(await exists('tg_2.events')).includes('"stream":"exit","code":0'))
   const main=JSON.parse(stdout(await exists('tg_1.events')))

package/test/scheduler-relay.test.ts

@@ -11,9 +11,54 @@ import { ControlStore } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
 import { Scheduler } from '../src/scheduler.js'
 import { initialPreset } from '../src/ai.js'
+import type { ExecutorOptions } from '../src/executor.js'
 
 const until=async(check:()=>Promise<boolean>)=>{for(let i=0;i<200;i++){if(await check())return;await new Promise(r=>setTimeout(r,20))}throw new Error('Timed out')}
 
+test('executor admission rejects a legacy queued schedule with no model before spawning',async()=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-missing-task-model-')),control=new ControlStore(dir,1000),runs=new RunStore(dir),scheduler=new Scheduler(dir)
+ let launches=0
+ const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'codex',telegramBotToken:'fixture'},async()=>{
+  launches++;throw new Error('Must not launch')
+ })
+ relay.bot.api.config.use(async()=>({ok:true,result:{message_id:42}}) as never)
+ try{
+  await control.requestPairing(101,101);await control.approveOwner(101)
+  const owner=(await control.status()).owner!,execution=await control.captureChoice({...initialPreset('codex'),model:'saved-model'})
+  const due=Date.now()+2000
+  const saved=await scheduler.save({id:'legacy',name:'Legacy',text:'Work',owner,execution,enabled:true,trigger:{at:new Date(due).toISOString()}},true)
+  const run=await runs.create({id:'r_schedule_legacy',chatId:101,telegramUserId:101,texts:['Work'],
+   execution:{...execution,preset:{...execution.preset,model:undefined}},
+   scheduled:{id:saved.id,revision:saved.revision,dueAt:new Date(due).toISOString(),pairedAt:owner.pairedAt}})
+  await relay.drainSources()
+  assert.equal((await runs.get(run.id))?.status,'failed');assert.equal(launches,0)
+  assert.equal((await scheduler.get(saved.id)).execution!.preset.model,'saved-model')
+ }finally{await relay.stop();await rm(dir,{recursive:true,force:true})}
+})
+
+test('manual task trigger launches its saved model in a fresh native session after chat switches AI',async()=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-trigger-launch-')),control=new ControlStore(dir,1000),runs=new RunStore(dir),scheduler=new Scheduler(dir)
+ let launched:ExecutorOptions | undefined
+ const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'codex',telegramBotToken:'fixture'},async(_texts,options)=>{
+  launched=options
+  const child=spawn(process.execPath,['-e','setTimeout(()=>{},10)'],{detached:process.platform!=='win32'})
+  await once(child,'spawn');return {child,cleanup:async()=>{},stdout:''}
+ })
+ try{
+  await control.requestPairing(101,101);await control.approveOwner(101)
+  const owner=(await control.status()).owner!,chat=await control.captureChoice(initialPreset('codex'))
+  await control.savePreset({id:'chat',name:'Chat',cli:'codex',model:'gpt-6-luna',effort:'max'})
+  await control.selectPreset('chat',chat.sessionId)
+  const saved=await scheduler.save({id:'daily',name:'Daily',text:'Saved work',owner,execution:{sessionId:chat.sessionId,preset:{id:'daily',name:'Daily model',cli:'codex',model:'gpt-6-astra',effort:'medium'}},enabled:true,trigger:{at:'2027-01-01T00:00:00Z'}},true)
+  const run=await scheduler.trigger(saved.id,saved.revision,'launch-smoke',owner,runs)
+  await relay.drainSources();await until(async()=> (await runs.get(run.id))?.status==='completed')
+  assert.equal(launched?.model,'gpt-6-astra');assert.equal(launched?.effort,'medium')
+  assert.equal(launched?.nativeSession,true);assert.equal(launched?.isResume,false)
+  assert.notEqual(launched?.sessionId,chat.sessionId)
+  assert.equal((await control.status()).ai?.selectedId,'chat')
+ }finally{await relay.stop();await rm(dir,{recursive:true,force:true})}
+})
+
 // Adversarial: the relay must not reserve wrapper semantics for an
 // update-shaped run id or a stale attention notice.
 test('a wrapper-shaped run id has no maintenance treatment and a stale notice is inert',async()=>{
@@ -44,10 +89,10 @@ test('a wrapper-shaped run id has no maintenance treatment and a stale notice is
  }finally{await relay.stop();await rm(dir,{recursive:true,force:true})}
 })
 
-test('Slack application replies beside a schedule and keeps both streams serial',async()=>{
+test('Slack application replies beside schedules configured to stay serial',async()=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-slack-scheduled-')),runs=new RunStore(dir),scheduler=new Scheduler(dir),control=new ControlStore(dir,1000)
  const children=new Map<string,ReturnType<typeof spawn>>()
- const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture'},async(_texts,options)=>{
+ const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture',scheduledConcurrency:1},async(_texts,options)=>{
   const child=spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:process.platform!=='win32'})
   children.set(options.runId,child);await once(child,'spawn')
   if(!options.runId.startsWith('r_schedule_'))await runs.enqueueMessage(options.runId,'Slack reply')
@@ -55,7 +100,7 @@ test('Slack application replies beside a schedule and keeps both streams serial'
  })
  try{
   await control.requestPairing(101,101);await control.approveOwner(101)
-  const owner=(await control.status()).owner!,execution=await control.captureChoice(initialPreset('grok'))
+  const owner=(await control.status()).owner!,execution=await control.captureChoice({...initialPreset('grok'),model:'fixture-model'})
   const due=Date.now()+10000
   for(const id of ['first','second'])await scheduler.save({id,name:id,text:'Long work',trigger:{at:new Date(due).toISOString()},enabled:true,owner,execution})
   await scheduler.tick(owner,runs,due);await relay.drainSources()
@@ -103,7 +148,7 @@ test('owner chat replies while a scheduled CLI keeps running; targeted cancellat
  relay.bot.api.config.use(async(_prev,method,payload)=>{if(method==='sendMessage')replies.push((payload as {text:string}).text);return {ok:true,result:{message_id:42}} as never})
  try{
   await control.requestPairing(101,101);await control.approveOwner(101)
-  const owner=(await control.status()).owner!,execution=await control.captureChoice(initialPreset('grok'))
+  const owner=(await control.status()).owner!,execution=await control.captureChoice({...initialPreset('grok'),model:'fixture-model'})
   const due=Date.now()+2000
   await scheduler.save({id:'slow',name:'Slow',text:'Long work',trigger:{at:new Date(due).toISOString()},enabled:true,owner,execution})
   await scheduler.tick(owner,runs,due);await relay.drainSources()
@@ -131,3 +176,38 @@ test('owner chat replies while a scheduled CLI keeps running; targeted cancellat
   await rm(dir,{recursive:true,force:true})
  }
 })
+
+for(const limit of [undefined,2])test(`scheduled admission bounds independent native jobs at ${limit ?? 6} and releases a cancelled slot`,async()=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-parallel-schedules-')),control=new ControlStore(dir,1000),runs=new RunStore(dir),scheduler=new Scheduler(dir)
+ const children=new Map<string,ReturnType<typeof spawn>>(),optionsSeen:ExecutorOptions[]=[]
+ const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture',scheduledConcurrency:limit},async(_texts,options)=>{
+  optionsSeen.push(options)
+  const child=spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:process.platform!=='win32'})
+  children.set(options.runId,child);await once(child,'spawn');return {child,cleanup:async()=>{},stdout:''}
+ })
+ try{
+  await control.requestPairing(101,101);await control.approveOwner(101)
+  const owner=(await control.status()).owner!,execution=await control.captureChoice({...initialPreset('grok'),model:'saved-model',effort:'medium'})
+  const jobs: Awaited<ReturnType<Scheduler['trigger']>>[]=[]
+  for(let n=0;n<(limit ?? 6)+1;n++){
+   const saved=await scheduler.save({id:`job${n}`,name:`Job${n}`,text:'Finite test',owner,execution,enabled:true,trigger:{at:'2027-01-01T00:00:00Z'}},true)
+   jobs.push(await scheduler.trigger(saved.id,saved.revision,`key${n}`,owner,runs))
+  }
+  await Promise.all([relay.drainSources(),relay.drainSources()])
+  assert.equal((await runs.list()).filter(r=>r.status==='running').length,limit ?? 6)
+  assert.equal((await runs.get(jobs.at(-1)!.id))?.status,'queued')
+  assert.equal(new Set(optionsSeen.map(o=>o.sessionId)).size,limit ?? 6)
+  for(const options of optionsSeen){assert.equal(options.model,'saved-model');assert.equal(options.effort,'medium');assert.equal(options.nativeSession,true);assert.equal(options.isResume,false)}
+  const foreground=await runs.create({id:'tg_parallel_chat',chatId:101,telegramUserId:101,texts:['Owner chat'],execution})
+  await relay.drainSources();assert.equal((await runs.get(foreground.id))?.status,'running')
+  assert.equal(children.size,(limit ?? 6)+1)
+  await scheduler.cancel(jobs[0].id);await relay.drainSources()
+  await until(async()=> (await runs.get(jobs[0].id))?.status==='cancelled')
+  await relay.drainSources();assert.equal((await runs.get(jobs.at(-1)!.id))?.status,'running')
+  for(const job of jobs.slice(1))assert.equal((await runs.get(job.id))?.status,'running')
+ }finally{
+  await relay.stop()
+  await until(async()=>!(await runs.list()).some(r=>r.status==='running'))
+  await rm(dir,{recursive:true,force:true})
+ }
+})

package/test/scheduler.test.ts

@@ -28,7 +28,7 @@ const fixture=async(t:any)=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-schedules-'));t.after(()=>rm(dir,{recursive:true,force:true}))
  const scheduler=new Scheduler(dir), runs=new RunStore(dir), now=Date.now()+10000
  const owner={telegramUserId:101,telegramChatId:101,pairedAt:new Date().toISOString()}
- const input={id:'test',name:'Test',text:'Do the work',owner,execution:{sessionId:randomUUID(),preset:{id:'fixture',name:'Fixture',cli:'codex'}},enabled:true,trigger:{at:new Date(now).toISOString()}}
+ const input={id:'test',name:'Test',text:'Do the work',owner,execution:{sessionId:randomUUID(),preset:{id:'fixture',name:'Fixture',cli:'codex',model:'fixture-model'}},enabled:true,trigger:{at:new Date(now).toISOString()}}
  return {dir,scheduler,runs,now,owner,input}
 }
 test('durable dispatch survives cursor-write crash without duplicating an occurrence',async t=>{
@@ -158,3 +158,23 @@ test('ordinary recurring work still runs after a non-interrupted failure', async
  await f.scheduler.tick(f.owner,f.runs,f.now+60000)
  assert.equal((await f.runs.list()).length,2)
 })
+
+test('missing models cannot be saved, dispatched or triggered; legacy settings remain readable for repair',async t=>{
+ const f=await fixture(t)
+ const missing={...f.input,execution:{...f.input.execution,preset:{...f.input.execution.preset,model:undefined}}}
+ await assert.rejects(f.scheduler.save(missing),/saved explicit model/)
+ const saved=await f.scheduler.save(f.input,true),next=await f.scheduler.pendingOccurrence(saved)
+ const file=join(f.dir,'schedules/test.json')
+ await writeFile(file,JSON.stringify({...saved,execution:missing.execution}))
+ const legacy=await f.scheduler.get(saved.id)
+ assert.equal(legacy.execution!.preset.model,undefined)
+ await f.scheduler.tick(f.owner,f.runs,f.now)
+ assert.equal((await f.runs.list()).length,0)
+ assert.equal(await f.scheduler.pendingOccurrence(legacy),next,'blocked dispatch must preserve the pending occurrence')
+ await assert.rejects(f.scheduler.trigger(saved.id,saved.revision,'legacy',f.owner,f.runs),/saved explicit model/)
+ const repaired=await f.scheduler.save({...legacy,execution:f.input.execution})
+ await f.scheduler.tick(f.owner,f.runs,f.now)
+ const [run]=await f.runs.list()
+ assert.equal(run.execution?.preset.model,f.input.execution.preset.model)
+ assert.equal(run.scheduled?.revision,repaired.revision)
+})