@jc_stack/ez-agents 0.1.0-beta.46 → 0.1.0-beta.48

package/test/script-schedules.test.ts

@@ -0,0 +1,219 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { execFile, spawn } from 'node:child_process'
+import { promisify } from 'node:util'
+import { once } from 'node:events'
+import { chmod, mkdir, mkdtemp, readFile, rm, symlink, writeFile, access } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { fileURLToPath } from 'node:url'
+import { createRelay } from '../src/index.js'
+import { ControlStore } from '../src/control-state.js'
+import { RunStore, type RunRecord } from '../src/runs.js'
+import { Scheduler } from '../src/scheduler.js'
+import { Scripts } from '../src/scripts.js'
+import { initialPreset } from '../src/ai.js'
+import { startExecutorJob, type ExecutorOptions } from '../src/executor.js'
+import { serveTestLedger } from './helpers/ledger.js'
+
+const exec = promisify(execFile), bin = fileURLToPath(new URL('../bin/ezenciel-agents-schedule.mjs', import.meta.url))
+const until = async (check: () => Promise<boolean>, tries = 400) => { for (let i = 0; i < tries; i++) { if (await check()) return; await new Promise(r => setTimeout(r, 25)) } throw new Error('Timed out') }
+const alive = (pid: number) => { try { process.kill(pid, 0); return true } catch { return false } }
+
+// The script records only what it was given; it never prints secrets.
+const fixture = `import { writeFileSync } from 'node:fs'
+import { spawn } from 'node:child_process'
+const mode = process.argv[2]
+const env = Object.fromEntries(Object.entries(process.env).filter(([k]) => k.startsWith('EZ_')))
+writeFileSync('out-' + process.env.EZ_RUN_ID + '.json', JSON.stringify({ argv: process.argv.slice(2), env,
+  leaked: ['TELEGRAM_BOT_TOKEN', 'EZ_TEST_SECRET', 'OPENAI_API_KEY'].filter(k => process.env[k] !== undefined) }))
+console.log('routine check ok token=abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOP')
+console.error('diagnostic line')
+if (mode === 'hang') {
+  const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' })
+  writeFileSync('child-' + process.env.EZ_RUN_ID + '.pid', String(child.pid))
+  setInterval(() => {}, 1000)
+}
+if (mode === 'fail') process.exit(3)
+`
+
+const setup = async () => {
+  const root = await mkdtemp(join(tmpdir(), 'ez-script-schedules-'))
+  const dir = join(root, 'control'), workspace = join(root, 'workspace'), fakeBin = join(root, 'bin')
+  await Promise.all([mkdir(dir), mkdir(join(workspace, 'scripts'), { recursive: true }), mkdir(fakeBin)])
+  await writeFile(join(workspace, 'scripts', 'guard.mjs'), fixture)
+  // Any native engine launch would leave this marker: script runs must not start one.
+  for (const engine of ['codex', 'claude', 'grok']) {
+    await writeFile(join(fakeBin, engine), `#!/bin/sh\necho "$0" >> ${JSON.stringify(join(root, 'llm-invocations'))}\n`)
+    await chmod(join(fakeBin, engine), 0o755)
+  }
+  const control = new ControlStore(dir, 1000)
+  await control.requestPairing(101, 101); await control.approveOwner(101)
+  const owner = (await control.status()).owner!
+  return { root, dir, workspace, fakeBin, control, owner, runs: new RunStore(dir), scheduler: new Scheduler(dir), scripts: new Scripts(dir) }
+}
+
+test('script registration confines the entry point, rejects shell strings and records the entry hash', async t => {
+  const f = await setup(); t.after(() => rm(f.root, { recursive: true, force: true }))
+  const base = { id: 'guard', owner: f.owner, workspace: f.workspace, interpreter: 'node', args: [], timeoutSeconds: 60 }
+  const saved = await f.scripts.save({ ...base, entry: 'scripts/guard.mjs' }, true)
+  assert.equal(saved.entry, join('scripts', 'guard.mjs')); assert.match(saved.sha256, /^[a-f0-9]{64}$/)
+  await assert.rejects(f.scripts.save({ ...base, entry: 'scripts/guard.mjs' }, true), /already registered/)
+  await writeFile(join(f.root, 'outside.mjs'), 'process.exit(0)')
+  await assert.rejects(f.scripts.save({ ...base, id: 'escape', entry: '../outside.mjs' }, true), /inside the agent workspace/)
+  await symlink(join(f.root, 'outside.mjs'), join(f.workspace, 'link.mjs'))
+  await assert.rejects(f.scripts.save({ ...base, id: 'escape', entry: 'link.mjs' }, true), /inside the agent workspace/)
+  await assert.rejects(f.scripts.save({ ...base, id: 'shell', entry: 'scripts/guard.mjs', interpreter: 'node -e "x"' }, true), /not a shell command/)
+  await assert.rejects(f.scripts.save({ ...base, id: 'shell', entry: 'scripts/guard.mjs', interpreter: 'sh;rm' }, true), /not a shell command/)
+  await assert.rejects(f.scripts.save({ ...base, id: 'missing', entry: 'scripts/guard.mjs', interpreter: 'no-such-interpreter-ez' }, true), /not installed/)
+  await assert.rejects(f.scripts.save({ ...base, id: 'Bad ID', entry: 'scripts/guard.mjs' }, true), /Script ID/)
+  // An interpreter inside the workspace would be unhashed code.
+  await writeFile(join(f.workspace, 'run.sh'), '#!/bin/sh\n'); await chmod(join(f.workspace, 'run.sh'), 0o755)
+  await assert.rejects(f.scripts.save({ ...base, id: 'local', entry: 'scripts/guard.mjs', interpreter: join(f.workspace, 'run.sh') }, true), /outside the agent workspace/)
+  await assert.rejects(f.scripts.save({ ...base, id: 'local', entry: 'scripts/guard.mjs', interpreter: 'run.sh', pathValue: '.' }, true), /not installed/)
+  // Another owner's registration cannot be scheduled.
+  const other = { ...f.owner, generation: '00000000-0000-4000-8000-000000000000', pairedAt: new Date(Date.parse(f.owner.pairedAt) + 1000).toISOString() }
+  await assert.rejects(f.scheduler.save({ id: 'stranger', name: 'x', text: '', owner: other, enabled: true, trigger: { at: '2027-01-01T00:00:00Z' }, script: { id: 'guard', args: [] } }, true), /outside this owner binding/)
+})
+
+test('agent registers and schedules a script natively; script runs cannot change scripts or schedules', async t => {
+  const f = await setup(); t.after(() => rm(f.root, { recursive: true, force: true }))
+  const ledger = await serveTestLedger(f.dir); t.after(() => ledger.stop())
+  const execution = await f.control.captureChoice(initialPreset('codex'))
+  const turn = await f.runs.create({ chatId: 101, telegramUserId: 101, texts: ['register it'], execution })
+  await f.runs.patch(turn.id, { status: 'running' })
+  const env = { ...process.env, EZ_CONTROL_DIR: f.dir, EZ_RUN_ID: turn.id, EZ_AGENT_WORKSPACE: f.workspace }
+  const cli = async (...args: string[]) => JSON.parse((await exec(process.execPath, [bin, ...args], { env, cwd: f.workspace })).stdout)
+  const registered = await cli('script', 'register', 'book-freshness', '--file', 'scripts/guard.mjs', '--interpreter', 'node', '--timeout-seconds', '120')
+  assert.equal(registered.interpreter, 'node'); assert.equal(registered.timeoutSeconds, 120)
+  await assert.rejects(cli('create', 'bad', '--script', 'book-freshness', '--model', 'gpt-6-astra', '--now'), /run no model/)
+  await assert.rejects(cli('create', 'bad', '--script', 'unknown', '--now'), /not registered/)
+  const schedule = await cli('create', 'actual-book-freshness-guard', '--script', 'book-freshness', '--arg=--quiet', '--cron', '15 * * * *', '--timezone', 'Asia/Dubai')
+  assert.equal(schedule.executionType, 'script'); assert.deepEqual(schedule.script, { id: 'book-freshness', args: ['--quiet'] })
+  assert.equal(schedule.execution, undefined); assert.equal(schedule.text, '')
+  const shown = await cli('script', 'show', 'book-freshness')
+  assert.equal(shown.matchesRegistration, true); assert.deepEqual(shown.schedules, ['actual-book-freshness-guard'])
+  await assert.rejects(cli('script', 'remove', 'book-freshness'), /used by schedules/)
+  // An existing agent schedule remains readable beside it.
+  const agent = await cli('create', 'daily', '--text', 'Prepare the report', '--model', 'gpt-6-astra', '--at', '2027-09-09T09:00:00+04:00')
+  assert.equal(agent.executionType, 'agent'); assert.equal(agent.execution.preset.model, 'gpt-6-astra')
+
+  const scriptRun = await f.runs.create({ chatId: 101, telegramUserId: 101, texts: ['[schedule]'],
+    script: { id: 'book-freshness', args: [], revision: registered.revision, sha256: registered.sha256 },
+    scheduled: { id: 'actual-book-freshness-guard', revision: schedule.revision, dueAt: new Date().toISOString(), pairedAt: f.owner.pairedAt } })
+  await f.runs.patch(scriptRun.id, { status: 'running' })
+  const asScript = { env: { ...env, EZ_RUN_ID: scriptRun.id }, cwd: f.workspace }
+  for (const args of [['script', 'update', 'book-freshness'], ['script', 'register', 'other', '--file', 'scripts/guard.mjs', '--interpreter', 'node'],
+    ['edit', 'actual-book-freshness-guard', '--script', 'book-freshness', '--now'], ['pause', 'daily'], ['trigger', 'daily', '--key', 'k']])
+    await assert.rejects(exec(process.execPath, [bin, ...args], asScript), /Script runs cannot change scripts or schedules/)
+  assert.equal(JSON.parse((await exec(process.execPath, [bin, 'script', 'show', 'book-freshness'], asScript)).stdout).id, 'book-freshness')
+  // A relative --file resolves from the caller's directory, stored relative to the workspace.
+  const nested = JSON.parse((await exec(process.execPath, [bin, 'script', 'register', 'nested', '--file', 'guard.mjs', '--interpreter', 'node'], { env, cwd: join(f.workspace, 'scripts') })).stdout)
+  assert.equal(nested.entry, join('scripts', 'guard.mjs'))
+})
+
+test('script CLI creates, preserves and explicitly clears preflight gates', async t => {
+ const f=await setup();t.after(()=>rm(f.root,{recursive:true,force:true}))
+ const ledger=await serveTestLedger(f.dir);t.after(()=>ledger.stop())
+ await f.scripts.save({id:'guard',owner:f.owner,workspace:f.workspace,entry:'scripts/guard.mjs',interpreter:'node',args:[],timeoutSeconds:60},true)
+ const preflight={on:'eligible',checks:[{alias:'provider-work',args:[]}]},file=join(f.root,'preflight.json')
+ await writeFile(file,JSON.stringify(preflight))
+ const env={...process.env,EZ_CONTROL_DIR:f.dir,EZ_RUN_ID:'',EZ_AGENT_WORKSPACE:f.workspace}
+ const cli=async(...args:string[])=>JSON.parse((await exec(process.execPath,[bin,...args],{env,cwd:f.workspace})).stdout)
+ const options=['--script','guard','--at','2027-09-09T09:00:00+04:00']
+ const created=await cli('create','gated',...options,'--preflight-file',file)
+ assert.deepEqual(created.preflight,preflight)
+ const edited=await cli('edit','gated',...options,'--name','Renamed')
+ assert.deepEqual(edited.preflight,preflight)
+ const cleared=await cli('edit','gated',...options,'--clear-preflight')
+ assert.equal(cleared.preflight,undefined)
+})
+
+test('script schedules run with zero LLM invocations, exact revision receipts, isolation and fail-safe integrity', async t => {
+  const f = await setup(); t.after(() => rm(f.root, { recursive: true, force: true }))
+  const savedEnv = { PATH: process.env.PATH, TELEGRAM_BOT_TOKEN: process.env.TELEGRAM_BOT_TOKEN, EZ_TEST_SECRET: process.env.EZ_TEST_SECRET }
+  process.env.PATH = `${f.fakeBin}:${process.env.PATH}`; process.env.TELEGRAM_BOT_TOKEN = '123456:secret-token-value-for-tests-only'; process.env.EZ_TEST_SECRET = 'do-not-inherit'
+  t.after(() => { for (const [k, v] of Object.entries(savedEnv)) { if (v === undefined) delete process.env[k]; else process.env[k] = v } })
+  const agentLaunches: ExecutorOptions[] = []
+  const relay = createRelay({ workspace: f.workspace, controlDir: f.dir, pairingTtlMs: 1000, executorTimeoutMs: 0, executorCli: 'codex', telegramBotToken: 'fixture' },
+    async (texts, options) => {
+      if (options.script) return startExecutorJob(texts, options)
+      agentLaunches.push(options)
+      const child = spawn(process.execPath, ['-e', 'setTimeout(()=>{},10)'], { detached: true }); await once(child, 'spawn')
+      return { child, cleanup: async () => {}, stdout: '' }
+    })
+  relay.bot.api.config.use(async () => ({ ok: true, result: { message_id: 42 } }) as never)
+  t.after(() => relay.stop())
+  const registration = await f.scripts.save({ id: 'book-freshness', owner: f.owner, workspace: f.workspace, entry: 'scripts/guard.mjs', interpreter: 'node', args: ['ok'], timeoutSeconds: 60 }, true)
+  const schedule = await f.scheduler.save({ id: 'guard', name: 'Guard', text: '', owner: f.owner, enabled: true, trigger: { cron: '15 * * * *', timezone: 'Asia/Dubai', start: new Date().toISOString() }, script: { id: 'book-freshness', args: ['extra'] } }, true)
+  const finished = (id: string) => until(async () => ['completed', 'failed', 'cancelled'].includes((await f.runs.get(id))?.status ?? ''))
+  const output = async (run: RunRecord) => JSON.parse(await readFile(join(f.workspace, `out-${run.id}.json`), 'utf8'))
+
+  // Manual trigger.
+  const manual = await f.scheduler.trigger(schedule.id, schedule.revision, 'smoke-1', f.owner, f.runs)
+  await relay.drainSources(); await finished(manual.id)
+  const done = (await f.runs.get(manual.id))!
+  assert.equal(done.status, 'completed'); assert.equal(done.exitCode, 0); assert.equal(done.execution, undefined)
+  assert.deepEqual(done.script, { id: 'book-freshness', args: ['extra'], revision: registration.revision, sha256: registration.sha256 })
+  assert.ok(done.startedAt && done.endedAt && done.createdAt <= done.startedAt)
+  assert.match(done.output!, /routine check ok/); assert.match(done.output!, /diagnostic line/); assert.doesNotMatch(done.output!, /abcdefghijklmnopqrstuvwxyz0123456789ABCDEF/)
+  const seen = await output(done)
+  assert.deepEqual(seen.argv, ['ok', 'extra']); assert.deepEqual(seen.leaked, [])
+  assert.equal(seen.env.EZ_RUN_ID, manual.id); assert.equal(seen.env.EZ_SCHEDULE_ID, 'guard'); assert.equal(seen.env.EZ_SCHEDULE_REVISION, schedule.revision)
+  assert.equal(seen.env.EZ_DUE_AT, done.scheduled!.dueAt); assert.equal(seen.env.EZ_SCRIPT_REVISION, registration.revision); assert.equal(seen.env.EZ_SCRIPT_SHA256, registration.sha256)
+  assert.equal((await relay.drainOutbox(), (await f.runs.pendingOutbox()).length), 0)
+
+  // Natural occurrence through the existing tick.
+  const due = await f.scheduler.pendingOccurrence(schedule)
+  await f.scheduler.tick(f.owner, f.runs, due!)
+  const natural = (await f.runs.list()).find(r => r.id !== manual.id && r.scheduled?.id === 'guard')!
+  assert.equal(natural.scheduled!.dueAt, new Date(due!).toISOString())
+  await relay.drainSources(); await finished(natural.id)
+  assert.equal((await f.runs.get(natural.id))?.status, 'completed')
+  await assert.rejects(access(join(f.root, 'llm-invocations')))
+  assert.equal(agentLaunches.length, 0)
+
+  // Changed entry-point bytes refuse to run until an explicit update.
+  await writeFile(join(f.workspace, 'scripts', 'guard.mjs'), fixture + '\n// edited\n')
+  const tampered = await f.scheduler.trigger(schedule.id, schedule.revision, 'tampered', f.owner, f.runs)
+  await relay.drainSources(); await finished(tampered.id)
+  const refused = (await f.runs.get(tampered.id))!
+  assert.equal(refused.status, 'failed'); assert.match(refused.failure!.error, /entry point changed since registration/)
+  await assert.rejects(readFile(join(f.workspace, `out-${tampered.id}.json`)))
+  const updated = await f.scripts.save({ id: 'book-freshness', owner: f.owner, workspace: f.workspace, entry: 'scripts/guard.mjs', interpreter: 'node', args: ['hang'], timeoutSeconds: 60 }, false)
+  assert.notEqual(updated.sha256, registration.sha256)
+
+  // Cancellation stops the script and its children; overlap is refused meanwhile.
+  const long = await f.scheduler.trigger(schedule.id, schedule.revision, 'long', f.owner, f.runs)
+  await relay.drainSources()
+  const childPid = Number(await until(async () => { try { await access(join(f.workspace, `child-${long.id}.pid`)); return true } catch { return false } })
+    .then(() => readFile(join(f.workspace, `child-${long.id}.pid`), 'utf8')))
+  assert.ok(alive(childPid))
+  assert.equal((await f.runs.get(long.id))?.script?.revision, updated.revision)
+  await assert.rejects(f.scheduler.trigger(schedule.id, schedule.revision, 'overlap', f.owner, f.runs), /queued or running/)
+  const before = (await f.runs.list()).length
+  await f.scheduler.tick(f.owner, f.runs, (await f.scheduler.pendingOccurrence(schedule))! + 3600_000)
+  assert.equal((await f.runs.list()).length, before)
+  await f.scheduler.cancel(long.id); await relay.drainSources(); await finished(long.id)
+  assert.equal((await f.runs.get(long.id))?.status, 'cancelled')
+  await until(async () => !alive(childPid))
+
+  // A bounded timeout terminates the process; it is a failure, never retried.
+  await f.scripts.save({ id: 'book-freshness', owner: f.owner, workspace: f.workspace, entry: 'scripts/guard.mjs', interpreter: 'node', args: ['hang'], timeoutSeconds: 1 }, false)
+  const slow = await f.scheduler.trigger(schedule.id, schedule.revision, 'slow', f.owner, f.runs)
+  await relay.drainSources(); await finished(slow.id)
+  const timedOut = (await f.runs.get(slow.id))!
+  assert.equal(timedOut.status, 'failed'); assert.equal(timedOut.failureReason, 'script-timeout'); assert.equal(timedOut.timedOut, true)
+  const slowChild = Number(await readFile(join(f.workspace, `child-${slow.id}.pid`), 'utf8'))
+  await until(async () => !alive(slowChild))
+  await relay.drainSources()
+  assert.equal((await f.runs.list()).filter(r => r.scheduled?.id === 'guard' && r.status === 'queued').length, 0)
+
+  // An existing LLM schedule still launches its native engine settings.
+  const execution = await f.control.captureChoice({ ...initialPreset('codex'), model: 'gpt-6-astra' })
+  const agent = await f.scheduler.save({ id: 'report', name: 'Report', text: 'Prepare the report', owner: f.owner, execution, enabled: true, trigger: { at: '2027-01-01T00:00:00Z' } }, true)
+  const agentRun = await f.scheduler.trigger(agent.id, agent.revision, 'agent', f.owner, f.runs)
+  await relay.drainSources(); await finished(agentRun.id)
+  assert.equal((await f.runs.get(agentRun.id))?.status, 'completed')
+  assert.equal(agentLaunches.length, 1); assert.equal(agentLaunches[0].model, 'gpt-6-astra'); assert.equal(agentLaunches[0].nativeSession, true)
+})

package/test/task-native.test.ts

@@ -1,10 +1,12 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises'
+import { mkdtemp, mkdir, writeFile, rm, readFile } from 'node:fs/promises'
 import { createServer } from 'node:http'
+import {createServer as createNetServer} from 'node:net'
 import { spawn, execFile } from 'node:child_process'
 import { promisify } from 'node:util'
 import { fileURLToPath } from 'node:url'
+import { createHash } from 'node:crypto'
 import { homedir } from 'node:os'
 import { taskArguments, taskModelCatalog, TASK_CODEX_VERSION } from '../src/task-executor.js'
 import { Tasks } from '../src/tasks.js'
@@ -12,33 +14,60 @@ import { ownerRun } from './helpers/owner-run.js'
 import { EventSources } from '../src/event-sources.js'
 import { ControlStore } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
+import {ApplicationBindings} from '../src/application-channel.js'
 import { taskRequests } from '../src/task-rpc.js'
 
 // Real bundled model metadata plus native CLI, synthetic endpoint, no credentials or provider sends.
 // Unknown fixture model names miss model-driven tool overrides.
 // Run explicitly with EZ_TEST_NATIVE_TASKS=1 after installing the audited CLI.
 test('native restricted task has only bounded MCP tools, ignores private guidance, and executes broker calls', { skip: !process.env.EZ_TEST_NATIVE_TASKS, timeout: 30000 }, async () => {
+  assert.equal((await promisify(execFile)('codex',['--version'])).stdout.trim(), `codex-cli ${TASK_CODEX_VERSION}`)
   const root = await mkdtemp('/tmp/ez-native-task-'), directory = `${root}/task`, home = `${root}/home`
   await mkdir(directory); await mkdir(home)
   await writeFile(`${root}/AGENTS.md`, 'PRIVATE_CANARY_DO_NOT_LOAD')
   await writeFile(`${home}/config.toml`, 'invalid = [ syntax')
   const requests: any[] = [], sends: any[] = []
+  const incoming={id:'1',conversationId:'contact-a',receivedAt:Date.now()+1000,text:'shop.txt attached'}
+  const png=Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+ip1sAAAAASUVORK5CYII=','base64')
+  const videoPath = `${root}/fixture.mp4`
+  await promisify(execFile)('ffmpeg',['-v','error','-f','lavfi','-i','color=c=blue:s=64x64:d=1','-c:v','mpeg4',videoPath])
+  const video=await readFile(videoPath)
   const provider = createServer(async (req, res) => {
     let body = ''; for await (const chunk of req) body += chunk
     const { command, args } = JSON.parse(body)
-    res.end(JSON.stringify({ ok: true, data: command === 'events-head' ? { cursor: 0, accountId: 'fixture-account', taskProtocol: 'message-v1' }
+    res.end(JSON.stringify({ ok: true, data: command === 'events-head' ? { cursor: 0, accountId: 'fixture-account', taskProtocol: 'message-v1',taskVoice:true }
+      : command === 'events-check' ? {events:[incoming,{...incoming,id:'2',text:'image.png attached'},{...incoming,id:'3',text:'video.mp4 attached; speech transcript: Shop closes at 6pm.'}]}
+      : command === 'task-document' && args.incomingId === '3' ? {name:'video.mp4',data:video.toString('base64'),sha256:createHash('sha256').update(video).digest('hex')}
+      : command === 'task-document' && args.incomingId === '2' ? {name:'image.png',data:png.toString('base64'),sha256:createHash('sha256').update(png).digest('hex')}
+      : command === 'task-document' ? {name:'shop.txt',data:Buffer.from('Shop opens at 7am.').toString('base64'),sha256:createHash('sha256').update('Shop opens at 7am.').digest('hex')}
       : command === 'task-send' ? (sends.push(args), { ...args, state: 'accepted' }) : {} }))
   })
   await new Promise<void>(r => provider.listen(`${root}/p.sock`, r))
   await ownerRun(root, 'owner')
   await new EventSources(root).register('fixture', `${root}/p.sock`, (await new ControlStore(root, 900000).status()).owner!)
-  const tasks = new Tasks(root), drain = taskRequests(tasks)
+  const tasks = new Tasks(root,async () => ({buffer:Buffer.from('OggSfixture OpusHead'),mimeType:'audio/ogg'})), drain = taskRequests(tasks)
   const proposal: any = await tasks.ownerCall('owner', 'start', { sourceId: 'fixture', conversationId: 'contact-a', purpose: 'Book dinner without payment', context: 'Two people at 7pm', hours: 1 })
   assert.equal(proposal.state, 'active')
-  const runs = new RunStore(root), run = (await runs.list()).find(r => r.taskId)!
+  const runs = new RunStore(root), run = await runs.create({id:'event_document_fixture',taskId:proposal.id,chatId:101,telegramUserId:101,texts:[],external:{sourceId:'fixture',bindingId:(await tasks.get(proposal.id))!.bindingId,eventIds:['1','2','3']}})
   await runs.patch(run.id, { status: 'running' })
+  const bindings=new ApplicationBindings(root), owner=(await new ControlStore(root,900000).status()).owner!
+  await bindings.register('browser','z'.repeat(48),owner)
+  await bindings.taskLaunch('browser',{command:'fixture',args:['launch','--task'],tasks:[proposal.id]})
+  let launchRequests=0
+  const launchSocket=`${root}/launch.sock`
+  const launchBroker=createNetServer(socket=>{
+    let raw='';socket.on('data',chunk=>{raw+=chunk;if(!raw.includes('\n'))return;void(async()=>{
+      const request=JSON.parse(raw.trim()),input=JSON.parse(request.stdin)
+      assert.equal(request.operation,'task-launch');assert.equal(request.runId,run.id)
+      assert.equal(input.taskId,proposal.id)
+      const grant=await tasks.authorizeApplicationLaunch(run.id,createHash('sha256').update(input.taskToken).digest('hex'))
+      assert.equal(grant.launch.command,'fixture');assert.deepEqual(grant.launch.args,['launch','--task'])
+      launchRequests++
+      socket.end(JSON.stringify({version:1,id:request.id,ok:true,code:0,stdout:JSON.stringify({launch:{url:'https://fixture.example/#launch='+ 'e'.repeat(64),expiresAt:Date.now()+300000}})})+'\n')
+    })().catch(error=>socket.end(JSON.stringify({ok:false,error:error.message})+'\n'))})
+  });await new Promise<void>(r=>launchBroker.listen(launchSocket,r))
   const sequence = [
-    ['context', {}], ['send', { text: 'Is a table for two available at 7pm?', key: 'first' }],
+    ['context', {}], ['browser_link',{application:'browser'}], ['read_attachment',{incomingId:'1'}], ['read_attachment',{incomingId:'2'}], ['read_attachment',{incomingId:'3'}], ['send', { text: 'Is a table for two available at 7pm?', key: 'first', voice:true }],
     ['note', { text: 'Awaiting confirmation' }], ['complete', { text: 'Request sent; no booking confirmation received.' }],
     ['send', { text: 'A completed task cannot send', key: 'second' }],
   ]
@@ -61,30 +90,39 @@ test('native restricted task has only bounded MCP tools, ignores private guidanc
   try {
     const entry = new URL('../src/task-mcp.ts', import.meta.url).href
     await writeFile(`${root}/broker.mjs`, `if(process.env.HOME !== ${JSON.stringify(homedir())}) throw Error('Broker lost host CLI configuration'); await import(${JSON.stringify(entry)});`)
-    const broker = [process.execPath, '--import', fileURLToPath(new URL('../node_modules/tsx/dist/loader.mjs', import.meta.url)), `${root}/broker.mjs`, root, run.id]
+    const broker = [process.execPath, '--import', fileURLToPath(new URL('../node_modules/tsx/dist/loader.mjs', import.meta.url)), `${root}/broker.mjs`, root, run.id,'','[]','["browser"]']
     const catalog = await promisify(execFile)('codex', ['debug', 'models', '--bundled'], { maxBuffer: 4 * 1024 * 1024 });
     await writeFile(`${root}/models.json`, JSON.stringify(taskModelCatalog(JSON.parse(catalog.stdout))));
-    const args = taskArguments(directory, broker, JSON.stringify({event:'task_activated',taskId:proposal.id}), undefined, {model:'gpt-6-astra'})
+    const args = taskArguments(directory, broker, JSON.stringify({event:'task_activated',taskId:proposal.id}), ['context','browser_link','read_attachment','send','note','report','complete'], {model:'gpt-6-astra'}, {EZ_PLUGIN_BROKER_SOCKET:launchSocket,EZ_DELIVERY_SOCKET:`${root}/delivery.sock`})
     args.splice(-1, 0, '--disable', 'enable_request_compression', '-c', 'model_provider="fixture"', '-c', `model_providers.fixture={name="fixture",base_url="http://127.0.0.1:${(server.address() as any).port}/v1",wire_api="responses",requires_openai_auth=false}`)
     child = spawn('codex', args, { cwd: directory, env: { PATH: process.env.PATH, HOME: home, CODEX_HOME: home }, stdio: ['pipe', 'pipe', 'pipe'] })
     child.stdin!.end(JSON.stringify({event:'task_activated',taskId:proposal.id}));
     let stderr = ''; child.stderr!.on('data', c => { stderr += c }); child.stdout!.resume()
     const code = await new Promise(r => child!.on('close', r))
     assert.equal(code, 0, `Requires audited Codex ${TASK_CODEX_VERSION}: ${stderr}`)
-    assert.ok(requests.length === 6, 'Native tool call completed a second model turn')
+    assert.equal(launchRequests,1, 'Native MCP uses the installed isolated broker launcher without tools home')
+    assert.ok(requests.length === 10, 'Native tool call completed a second model turn')
     assert.ok(!JSON.stringify(requests).includes('PRIVATE_CANARY_DO_NOT_LOAD'))
+    assert.ok(JSON.stringify(requests).includes('https://fixture.example/#launch='))
+    assert.ok(!JSON.stringify(requests).includes('taskToken'))
     const messages=requests[0].input.filter((v:any)=>v.role==='user')
     assert.ok(messages.some((m:any)=>m.content.some((c:any)=>c.text===JSON.stringify({event:'task_activated',taskId:proposal.id}))))
     const tools = requests[0].tools ?? requests[0].input.find((v: any) => v.type === 'additional_tools')?.tools
     assert.deepEqual(tools.filter((t: any) => t.type === 'function').map((t: any) => t.name).sort(), ['list_mcp_resource_templates', 'list_mcp_resources', 'read_mcp_resource', 'request_user_input'])
     const namespaces = tools.filter((t: any) => t.type === 'namespace')
     assert.equal(namespaces.length, 1); assert.equal(namespaces[0].name, 'mcp__ez')
-    assert.deepEqual(namespaces[0].tools.map((t: any) => t.name).sort(), ['complete', 'context', 'note', 'report', 'send'])
-    assert.match(JSON.stringify(requests[5].input), /inactive or expired/)
-    assert.equal(sends.length, 1); assert.equal(sends[0].conversationId, 'contact-a')
+    assert.deepEqual(namespaces[0].tools.map((t: any) => t.name).sort(), ['browser_link','complete', 'context', 'note', 'read_attachment', 'report', 'send'])
+    assert.match(JSON.stringify(requests.at(-1).input), /inactive or expired/)
+    assert.ok(JSON.stringify(requests).includes('Shop opens at 7am.'))
+    assert.ok(JSON.stringify(requests).includes('data:image/'), 'Native CLI forwards MCP images into vision input: '+JSON.stringify(requests.map(request=>request.input)))
+    assert.ok(JSON.stringify(requests).includes('durationSeconds'), 'Native input includes video frame metadata')
+    assert.ok(JSON.stringify(requests).includes('Shop closes at 6pm.'))
+    const videoTurn=requests[5].input
+    assert.ok(JSON.stringify(videoTurn).includes('data:image/'), 'Native CLI receives sampled video frames as vision input')
+    assert.equal(sends.length, 1);assert.equal(Buffer.from(sends[0].audio.data,'base64').toString(),'OggSfixture OpusHead'); assert.equal(sends[0].conversationId, 'contact-a')
     assert.equal((await tasks.get(proposal.id))!.state, 'completed')
   } finally {
-    child?.kill(); clearInterval(timer); server.closeAllConnections(); await new Promise<void>(r => server.close(() => r()))
+    child?.kill(); clearInterval(timer); await new Promise<void>(r=>launchBroker.close(()=>r())); server.closeAllConnections(); await new Promise<void>(r => server.close(() => r()))
     provider.closeAllConnections(); await new Promise<void>(r => provider.close(() => r()))
     await rm(root, { recursive: true, force: true })
   }

package/test/tasks.test.ts

@@ -15,16 +15,17 @@ import { requireOwnerExecution } from '../src/execution-authority.js'
 import { execFile } from 'node:child_process'
 import { promisify } from 'node:util'
 
-async function fixture(t: test.TestContext, channelOwner = false) {
+async function fixture(t: test.TestContext, channelOwner = false, speech?: (text:string) => Promise<{buffer:Buffer;mimeType:string}>) {
   const dir = await mkdtemp('/tmp/ez-task-test-'), socket = join(dir, 's.sock')
   let accountId = 'account-a', events: SourceEvent[] = [], uncertain = false
   const sends: any[] = [], watches: any[] = []
   const server = createServer(async (req, res) => {
     let text = ''; for await (const chunk of req) text += chunk
     const { command, args } = JSON.parse(text)
-    const data = command === 'events-head' ? { cursor: 0, accountId, taskProtocol: 'message-v1', persistentWatch: true, wildcardWatch: true }
+    const data = command === 'events-head' ? { cursor: 0, accountId, taskProtocol: 'message-v1', persistentWatch: true, wildcardWatch: true, taskVoice: true }
       : command === 'task-watch' ? (watches.push(args), { watching: args.conversationId })
       : command === 'events-check' ? { events: events.filter(e => args.ids.includes(e.id)) }
+      : command === 'task-document' ? {name:'shop.txt',data:Buffer.from('Shop opens at 7am.').toString('base64'),sha256:createHash('sha256').update('Shop opens at 7am.').digest('hex')}
       : command === 'task-send' ? (sends.push(args), { ...args, state: uncertain ? 'uncertain' : 'accepted', receiptId: 'provider-1' }) : {}
     res.end(JSON.stringify({ ok: true, data }))
   })
@@ -35,7 +36,7 @@ async function fixture(t: test.TestContext, channelOwner = false) {
     await runs.create({ id: 'owner', ownerId: ownerId(owner), ownerEpoch: ownerEpoch(owner), texts: ['Own this conversation'] })
     await runs.patch('owner', { status: 'running' })
   } else await ownerRun(dir, 'owner')
-  const control = new ControlStore(dir, 900000), sources = new EventSources(dir), runs = new RunStore(dir), tasks = new Tasks(dir)
+  const control = new ControlStore(dir, 900000), sources = new EventSources(dir), runs = new RunStore(dir), tasks = new Tasks(dir,speech)
   await sources.register('generic', socket, (await control.status()).owner!)
   t.after(async () => { server.closeAllConnections(); await new Promise<void>(r => server.close(() => r())); await rm(dir, { recursive: true, force: true }) })
   async function proposal() {
@@ -247,7 +248,7 @@ test('approved initial task crosses the real host file client and uses a fresh r
   const { isHostRunId } = await import('../src/host-executor-protocol.js')
   const f = await fixture(t), { run } = await f.activate()
   assert.ok(isHostRunId(run.id))
-  await writeFile(join(f.dir, 'codex'), `#!${process.execPath}\nif(process.argv[2]==='--version')console.log('codex-cli 0.153.4');else if(process.argv[2]==='debug')console.log(JSON.stringify({models:[{slug:'fixture',tool_mode:'code_mode_only',apply_patch_tool_type:'freeform',multi_agent_version:'v2'}]}));else console.log(JSON.stringify({cwd:process.cwd(),args:process.argv.slice(2),control:process.env.EZ_CONTROL_DIR}));`, { mode: 0o700 })
+  await writeFile(join(f.dir, 'codex'), `#!${process.execPath}\nif(process.argv[2]==='--version')console.log('codex-cli 0.160.1');else if(process.argv[2]==='debug')console.log(JSON.stringify({models:[{slug:'fixture',tool_mode:'code_mode_only',apply_patch_tool_type:'freeform',multi_agent_version:'v2'}]}));else console.log(JSON.stringify({cwd:process.cwd(),args:process.argv.slice(2),control:process.env.EZ_CONTROL_DIR}));`, { mode: 0o700 })
   const priorPath = process.env.PATH
   process.env.PATH = `${f.dir}:${priorPath}`
   const abort = new AbortController(), host = serveHostExecutor({ cli: 'codex', agents: [{ name: 'test', workspace: f.dir, controlDir: f.dir, binDir: f.dir }] }, abort.signal)
@@ -341,3 +342,95 @@ test('public grants enforce persisted hourly and cumulative admission budgets',a
   assert.equal(await f.tasks.admitPublic(proposal.id),'revoked')
   assert.equal((await f.tasks.get(proposal.id))?.state,'revoked')
 })
+
+
+test('voice reuses task send authority and receipt keys, rechecks the account after synthesis, and never falls back to text', async t => {
+  let generated = 0, changed = false
+  let changeAccount: (value:string) => void
+  const f = await fixture(t,false,async text => {
+    generated++; assert.equal(text, 'Spoken fixture')
+    if(changed)changeAccount('replaced')
+    return {buffer:Buffer.from('OggSfixture OpusHead'),mimeType:'audio/ogg'}
+  })
+  changeAccount = f.account
+  const {run} = await f.activate()
+  const sent = await f.tasks.workerCall(run.id,'send',{text:'Spoken fixture',key:'spoken',voice:true})
+  assert.ok('state' in sent);assert.equal(sent.state,'accepted');assert.equal(generated,1);assert.equal(f.sends.length,1)
+  assert.equal(Buffer.from(f.sends[0].audio.data,'base64').toString(),'OggSfixture OpusHead')
+  await f.tasks.workerCall(run.id,'send',{text:'Spoken fixture',key:'spoken',voice:true})
+  assert.equal(generated,1);assert.equal(f.sends.length,1)
+  await assert.rejects(f.tasks.workerCall(run.id,'send',{text:'Spoken fixture',key:'spoken'}), /different text/)
+  changed=true
+  assert.equal((await f.tasks.workerCall(run.id,'send',{text:'Spoken fixture',key:'changed',voice:true}) as {state:string}).state,'uncertain')
+  assert.equal(f.sends.length,1)
+})
+
+test('voice generation failure is a definite non-send: no text, no stored operation, same key retryable', async t => {
+  let generated=0
+  const f=await fixture(t,false,async () => { if(++generated===1)throw new Error('provider failed'); return {buffer:Buffer.from('OggSfixture OpusHead'),mimeType:'audio/ogg'} })
+  const {run, taskId}=await f.activate()
+  await assert.rejects(f.tasks.workerCall(run.id,'send',{text:'Spoken fixture',key:'failed',voice:true}),/provider failed/)
+  assert.equal(f.sends.length,0);assert.equal(Object.hasOwn((await f.tasks.get(taskId))!.operations,'failed'),false)
+  assert.equal((await f.tasks.workerCall(run.id,'send',{text:'Spoken fixture',key:'failed',voice:true}) as {state:string}).state,'accepted')
+  assert.equal(generated,2);assert.equal(f.sends.length,1)
+})
+
+
+test('a cancelled worker cannot dispatch a voice generated after stop', async t => {
+  let stop: () => Promise<unknown>
+  const f=await fixture(t,false,async () => { await stop(); return {buffer:Buffer.from('OggSfixture OpusHead'),mimeType:'audio/ogg'} })
+  const {run}=await f.activate();stop=()=>f.runs.patch(run.id,{status:'cancelled'})
+  assert.equal((await f.tasks.workerCall(run.id,'send',{text:'Spoken fixture',key:'stopped',voice:true}) as {state:string}).state,'uncertain')
+  assert.equal(f.sends.length,0)
+})
+
+test('incoming documents use shared staging and never expose another event or owner path', async t => {
+ const f=await fixture(t), {taskId}=await f.activate(), task=(await f.tasks.get(taskId))!
+ const row={id:'1',conversationId:'contact-a',receivedAt:Date.now(),text:'Document attached'};f.rows([row])
+ const run=await f.runs.create({id:'event_document',taskId,chatId:101,telegramUserId:101,texts:[],external:{sourceId:'generic',bindingId:task.bindingId,eventIds:['1']}})
+ await f.runs.patch(run.id,{status:'running'})
+ const document:any=await f.tasks.workerCall(run.id,'read_attachment',{incomingId:'1'})
+ assert.equal(document.text,'Shop opens at 7am.');assert.equal(document.name,'shop.txt');assert.equal(document.type,'text')
+ await assert.rejects(f.tasks.workerCall(run.id,'read_attachment',{incomingId:'2'}),/outside/)
+ await assert.rejects(f.tasks.workerCall(run.id,'read_attachment',{incomingId:'/etc/passwd'}),/outside/)
+ f.rows([{...row,conversationId:'contact-b'}]);await assert.rejects(f.tasks.workerCall(run.id,'read_attachment',{incomingId:'1'}),/correspondence/)
+})
+
+test('explicit application launch continues restricted task; cross-task, owner mode, revocation and replay changes fail closed',async t=>{
+  const {ApplicationBindings,ApplicationChannel}=await import('../src/application-channel.js')
+  const {initialPreset}=await import('../src/ai.js')
+  const f=await fixture(t), {taskId,run}=await f.activate(), owner=(await f.control.status()).owner!
+  const bindings=new ApplicationBindings(f.dir), binding=(await bindings.register('browser','x'.repeat(48),owner))!
+  const token='a'.repeat(64),ticketHash=createHash('sha256').update(token).digest('hex')
+  await assert.rejects(f.tasks.workerCall(run.id,'application_launch',{application:'browser',ticketHash}),/not authorized/)
+  await bindings.taskLaunch('browser',{command:'fixture',args:['launch','--task'],tasks:[taskId]})
+  const grant=await f.tasks.workerCall(run.id,'application_launch',{application:'browser',ticketHash}) as {taskId:string;expiresAt:number}
+  assert.equal(grant.taskId,taskId)
+  assert(!(await readFile(join(f.dir,'task-applications',ticketHash+'.json'),'utf8')).includes(token))
+  const admission=await f.tasks.authorizeApplicationLaunch(run.id,ticketHash)
+  assert.deepEqual(admission.launch,{command:'fixture',args:['launch','--task'],tasks:[taskId]})
+  await assert.rejects(f.tasks.authorizeApplicationLaunch('owner',ticketHash))
+  const app=new ApplicationChannel({controlDir:f.dir,initial:initialPreset('codex'),wake(){},async cancel(){}})
+  const input={requestId:'voice-test',scope:'task:'+taskId,text:'When is the booking?',taskToken:token}
+  await assert.rejects(app.submit(binding.bindingId,{...input,followOwner:true}),/Invalid application task/)
+  await assert.rejects(app.submit(binding.bindingId,{...input,scope:'task:other'}),/scope/)
+  const delegated=await app.submit(binding.bindingId,input)
+  assert.equal(delegated.taskId,taskId);assert.equal(delegated.version,2)
+  assert.equal((await app.submit(binding.bindingId,input)).id,delegated.id)
+  await assert.rejects(app.submit(binding.bindingId,{...input,text:'Changed request'}),/conflicts/)
+  await f.runs.patch(delegated.id,{status:'running'})
+  const context=await f.tasks.workerCall(delegated.id,'context',{}) as {notes:string[];request:string;context:string}
+  assert.match(context.context,/Two people/);assert.equal(context.request,input.text)
+  await f.tasks.workerCall(delegated.id,'note',{text:'Discussion-only voice result'})
+  const reply=await f.tasks.workerCall(delegated.id,'send',{key:'answer',text:'7pm'}) as {receipt:{queued:string}}
+  assert.equal(f.sends.length,0)
+  const outbox=(await f.runs.pendingOutbox()).find(x=>x.id===reply.receipt.queued)!
+  await app.deliver(delegated,outbox)
+  assert.deepEqual((await app.snapshot(binding.bindingId,delegated.id)).messages.map(m=>m.text),['7pm'])
+  const other=(await bindings.register('other','y'.repeat(48),owner))!
+  await bindings.taskLaunch('other',{command:'fixture',args:['launch'],tasks:'all'})
+  await assert.rejects(app.submit(other.bindingId,{...input,requestId:'other'}),/revoked/)
+  await bindings.taskLaunch('browser',null)
+  await assert.rejects(f.tasks.authorize(delegated),/revoked/)
+  await assert.rejects(app.snapshot(binding.bindingId,delegated.id),/revoked/)
+})