@jc_stack/ez-agents 0.1.0-beta.47 → 0.1.0-beta.48

package/src/updates/runtime.mjs

@@ -6,6 +6,7 @@ import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { spawn } from 'node:child_process';
 import { parseEnv } from 'node:util';
+import { tmpdir } from 'node:os';
 import { atomic, compose, snapshot, checkFolders } from '../plugins/manager.mjs';
 import { read, state, eligibility, jobPath, cleanupStaleBackups } from './control.mjs';
 import { bindUpdates } from './binding.mjs';
@@ -62,9 +63,42 @@ export async function relayServices(config) {
   const env = await fs.readFile(path.join(config.deploymentDir,'docker.env'),'utf8').catch(() => '');
   return parseEnv(env).EZ_EXECUTOR_TRANSPORT === 'local' ? ['relay','plugin-broker'] : ['relay'];
 }
-async function refreshBroker(config, run) {
-  if ((await relayServices(config)).includes('plugin-broker'))
-    await run('docker', [...relayArgs(config), 'restart', 'plugin-broker']);
+// Explicitly rebind single-file mounts after atomic replacement. Pin the running image
+// while recreating only the broker with this deployment's Compose identity.
+export async function refreshBroker(config, run=execute, image) {
+  if (!(await relayServices(config)).includes('plugin-broker')) return null;
+  const args=relayArgs(config);
+  if(image===undefined) {
+    const id=(await run('docker',[...args,'ps','-q','plugin-broker'],{stdoutOnly:true,timeout:15000})).trim();
+    if(!/^[a-f0-9]{12,64}$/i.test(id))throw Error('Expected one installed isolated broker');
+    image=(await run('docker',['inspect','--format','{{.Image}}',id],{stdoutOnly:true,timeout:15000})).trim();
+  }
+  if(!/^sha256:[a-f0-9]{64}$/.test(image))throw Error('Cannot pin broker image');
+  const temporary=await fs.mkdtemp(path.join(tmpdir(),'ez-broker-refresh-'));
+  try {
+    const pin=path.join(temporary,'image.env');
+    await fs.writeFile(pin,`EZ_RELAY_IMAGE=${image}\n`,{mode:0o600});
+    await run('docker',[...args,'--env-file',pin,'up','-d','--no-deps','--force-recreate','--no-build','--pull','never','--wait','--wait-timeout','90','plugin-broker']);
+    const current=(await run('docker',[...args,'ps','-q','plugin-broker'],{stdoutOnly:true,timeout:15000})).trim();
+    if(!/^[a-f0-9]{12,64}$/i.test(current)||(await run('docker',['inspect','--format','{{.Image}}',current],{stdoutOnly:true,timeout:15000})).trim()!==image)
+      throw Error('Recreated broker image does not match the intended installed image');
+    const hostConfig=config.hostConfig||path.join(config.deploymentDir,'host-executor.json');
+    const home=path.dirname(hostConfig)===config.deploymentDir
+      ? (await read(hostConfig)).agents?.find(agent=>agent.workspace===config.workspace)?.toolsHome : undefined;
+    if(typeof home!=='string'||!path.isAbsolute(home))throw Error('Missing broker registry binding');
+    const files=[hostConfig,path.join(home,'registry.json'),path.join(home,'config.json')];
+    const hashes=await Promise.all(files.map(async file=>digest(await fs.readFile(file))));
+    // Supply trusted read-only code so rollback can check an older image that
+    // predates this diagnostic. Its validators still come from that image.
+    const diagnostic=await fs.readFile(new URL('../../docker/broker-readiness.mjs',import.meta.url),'utf8');
+    const probe=JSON.parse(await run('docker',[...args,'exec','-T','plugin-broker','node','--import','/app/node_modules/tsx/dist/loader.mjs',
+      '--input-type=module','-e',diagnostic,...hashes],{stdoutOnly:true,timeout:60000}));
+    if(probe.version!==1||probe.ready!==true||probe.hostSha256!==hashes[0]||probe.registrySha256!==hashes[1]||probe.configSha256!==hashes[2])
+      throw Error('Invalid isolated broker readiness readback');
+    // A concurrent writer invalidates the readback; never silently accept it.
+    for(let i=0;i<files.length;i++)if(digest(await fs.readFile(files[i]))!==hashes[i])throw Error('Broker binding changed during verification');
+    return probe;
+  }finally {await fs.rm(temporary,{recursive:true,force:true});}
 }
 const healthCodes = new Set(['RELAY_UNREADABLE','RELAY_NOT_POLLING','RELAY_STALE','HOST_UNREADABLE','HOST_STALE','PLUGIN_BROKER_UNREADABLE']);
 async function healthEvidence(config,run) {
@@ -143,7 +177,11 @@ export async function perform(home,job,hooks) {
       await textAtomic(envFile,env);
       await bindUpdates(home,path.join(config.deploymentDir,'host-executor.json'),root);
       await hooks.startHost(root);
-      await run('docker',[...relayArgs(config),'up','-d','--wait','--wait-timeout','90','--no-build',...(await relayServices(config))]);
+      await run('docker',[...relayArgs(config),'up','-d','--wait','--wait-timeout','90','--no-build','relay']);
+      if((await relayServices(config)).includes('plugin-broker')) {
+        const brokerImage=(await run('docker',['image','inspect','--format','{{.Id}}',image],{stdoutOnly:true})).trim();
+        job.brokerReadiness=await refreshBroker(config,run,brokerImage);
+      }
     } else {
       const old=next.old.record,r=await read(path.join(home,'registry.json'));
       const secrets=await read(path.join(home,'packages',job.target,'secrets.json')).catch(e=>{if(e.code==='ENOENT')return {};throw e;});
@@ -163,7 +201,7 @@ export async function perform(home,job,hooks) {
       r.plugins[job.target]=candidate;
       for(const alias of Object.keys(candidate.manifest.commands))r.commands[alias]=job.target;
       await atomic(path.join(home,'registry.json'),r);
-      await refreshBroker(config,run);
+      job.brokerReadiness=await refreshBroker(config,run);
       job.runtimeVerified=running;
     }
     job.status='completed';job.endedAt=new Date().toISOString();await save();
@@ -195,12 +233,13 @@ export async function recover(home,job,hooks) {
         await textAtomic(path.join(config.deploymentDir,'docker.env'),job.rollback.env);
         await bindUpdates(home,path.join(config.deploymentDir,'host-executor.json'),job.rollback.packageRoot);
         await hooks.startHost(job.rollback.packageRoot);
-        if(!retained)await run('docker',[...relayArgs(config),'up','-d','--wait','--wait-timeout','90','--no-build',...(await relayServices(config))]);
+        if(!retained)await run('docker',[...relayArgs(config),'up','-d','--wait','--wait-timeout','90','--no-build','relay']);
+        job.rollbackBrokerReadiness=await refreshBroker(config,run,pinned);
       } else {
         const b=job.rollback;
         await run('docker',[...pluginArgs(b.record),'stop']);
         await atomic(b.record.compose,b.compose);await atomic(path.join(home,'registry.json'),b.registry);
-        await refreshBroker(config,run);
+        job.rollbackBrokerReadiness=await refreshBroker(config,run);
         if(b.running)await run('docker',[...pluginArgs(b.record),'up','-d','--wait','--wait-timeout','90','--no-build']);
       }
       job.status='rolled-back';

package/test/ai.test.ts

@@ -632,3 +632,43 @@ test('private channel model choices do not consume owner preset slots', async ()
     assert.deepEqual((await store.applicationSession(scope))?.preset, readback.preset)
   } finally { await rm(dir, {recursive:true, force:true}) }
 })
+
+test('detected presets do not count against the saved AI cap', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-ai-cap-'))
+  try {
+    const store = new ControlStore(dir, 1000)
+    const initial = initialPreset('codex')
+    await store.captureChoice(initial)
+    for (let n = 1; n < 11; n++) await store.savePreset({...initial, id:`saved-${n}`, name:`Saved ${n}`})
+    await store.syncClientPresets(initial, ['claude', 'grok'].map(cli => ({id:`detected_${cli}`, cli, name:`${cli} · client default`})))
+    assert.equal((await store.status()).ai!.presets.length, 13)
+    const next = {id:'one-more', name:'One more', cli:'claude', model:'sonnet', effort:'medium'}
+    await store.savePreset(next)
+    await assert.rejects(store.savePreset({...next, id:'too-many', name:'Too many'}), /at most 12/)
+  } finally { await rm(dir, {recursive:true, force:true}) }
+})
+
+test('Claude catalog projects only aliases and efforts from the installed native help', async () => {
+  const help = `Options:
+  --effort <level>                      Effort level for the current session
+                                        (low, medium, high, xhigh, max)
+  --model <model>                       Model for the current session. Provide
+                                        an alias for the latest model (e.g.
+                                        'fable', 'opus', or 'sonnet') or a
+                                        model's full name.
+  -n, --name <name>                     Set a display name ('ignored')
+`
+  const calls: string[][] = []
+  const models = await readModels('/nonexistent', async cli => cli === 'claude', undefined, undefined, undefined, undefined, undefined, undefined,
+    async (args) => { calls.push(args); return help })
+  assert.deepEqual(calls, [['--help']])
+  assert.deepEqual(models, [
+    { cli: 'claude', name: 'claude · client default', efforts: [] },
+    ...['fable', 'opus', 'sonnet'].map(model => ({ cli: 'claude', model, name: `claude · ${model}`, efforts: ['low', 'medium', 'high', 'xhigh', 'max'] })),
+  ])
+  for (const unavailable of [async () => { throw new Error('not runnable') }, async () => 'Usage: claude'])
+    assert.deepEqual(await readModels('/nonexistent', async cli => cli === 'claude', undefined, undefined, undefined, undefined, undefined, undefined, unavailable),
+      [{ cli: 'claude', name: 'claude · client default', efforts: [] }])
+  await validateSelection({ id: 'c', name: 'c', cli: 'claude', model: 'opus', effort: 'xhigh' }, models, async () => true)
+  await assert.rejects(validateSelection({ id: 'c', name: 'c', cli: 'claude', model: 'opus-guess' }, models, async () => true), /not in the installed client catalog/)
+})

package/test/application-channel.test.ts

@@ -1,7 +1,7 @@
 import test from 'node:test'
 import { request as httpRequest } from 'node:http'
 import assert from 'node:assert/strict'
-import { mkdtemp, rm, writeFile, readFile } from 'node:fs/promises'
+import { mkdtemp, rm, writeFile, readFile, chown, stat } from 'node:fs/promises'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { spawnSync } from 'node:child_process'
@@ -435,3 +435,18 @@ test('shareTelegram bindings list Telegram intake and admit one run with context
   await runs.patch(finished.id,{status:'completed'})
   assert.equal((await attach(finished.id,sharedToken,{context:{}})).status,409)
 })
+
+test('administrator task grant replacement preserves the runtime file owner', {skip:process.getuid?.()!==0},async()=>{
+  const dir=await mkdtemp(join(tmpdir(),'ez-app-grant-owner-'))
+  try {
+    const who=await owner(dir),bindings=new ApplicationBindings(dir)
+    await bindings.register('voice',token(),who)
+    const file=join(dir,'application-bindings.json')
+    await chown(file,20000,20000)
+    await bindings.taskLaunch('voice',{command:'voice',args:['launch','--task'],tasks:['task_'+'a'.repeat(32)]})
+    const saved=await stat(file)
+    assert.equal(saved.uid,20000);assert.equal(saved.gid,20000);assert.equal(saved.mode&0o777,0o600)
+    await bindings.taskLaunch('voice',null)
+    const disabled=await stat(file);assert.equal(disabled.uid,20000);assert.equal(disabled.gid,20000)
+  }finally{await rm(dir,{recursive:true,force:true})}
+})

package/test/audio.test.ts

@@ -1,3 +1,4 @@
+import {execFileSync} from 'node:child_process'
 import test from 'node:test'
 import assert from 'node:assert/strict'
 import { pcmToWav, encodeOggOpus, transcribeAudio, synthesizeSpeech, SpeechCreditsDepletedError } from '../src/audio.js'
@@ -91,3 +92,21 @@ test('synthesizeSpeech rejects empty text', async () => {
     /Cannot synthesize speech for empty text/,
   )
 })
+
+
+test('OpenRouter uses the existing renderer and encoder for real Ogg Opus and WAV without provider fallback', async t => {
+  const mp3=execFileSync('ffmpeg',['-f','s16le','-ar','24000','-ac','1','-i','pipe:0','-f','mp3','pipe:1'],{input:Buffer.alloc(48000),stdio:['pipe','pipe','ignore']})
+  t.mock.method(globalThis,'fetch',async (url:string,options:RequestInit) => {
+    assert.equal(url,'https://openrouter.ai/api/v1/audio/speech')
+    assert.equal(new Headers(options.headers).get('authorization'),'Bearer fixture-key')
+    assert.deepEqual(JSON.parse(String(options.body)),{model:'fish-audio/s2.1-pro-free:free',input:'Fixture',response_format:'mp3'})
+    return new Response(mp3,{headers:{'content-type':'audio/mpeg'}})
+  })
+  const options={speechProvider:'openrouter' as const,openrouterApiKey:'fixture-key',geminiApiKey:'unused'}
+  const ogg=await synthesizeSpeech('Fixture',options)
+  assert.equal(ogg.mimeType,'audio/ogg');assert.equal(ogg.buffer.subarray(0,4).toString(),'OggS');assert.ok(ogg.buffer.includes(Buffer.from('OpusHead')))
+  const wav=await synthesizeSpeech('Fixture',{...options,format:'wav'})
+  assert.equal(wav.buffer.subarray(0,4).toString(),'RIFF');assert.equal(wav.buffer.readUInt32LE(24),24000)
+  t.mock.method(globalThis,'fetch',async () => new Response('private provider detail',{status:429}))
+  await assert.rejects(synthesizeSpeech('Fixture',options), /error 429/)
+})

package/test/config.test.ts

@@ -84,3 +84,11 @@ test('Telegram transport is inferred from a valid token; legacy flag contradicti
   assert.equal(loadConfig({ EZ_TELEGRAM_ENABLED: 'false', EZ_APPLICATION_PORT: '8110' }).telegramEnabled, false)
   assert.equal(loadConfig({ TELEGRAM_BOT_TOKEN: token, EZ_TELEGRAM_ENABLED: 'true' }).telegramEnabled, true)
 })
+
+test('scheduled concurrency defaults to six and accepts only positive integers',()=>{
+ const env={EZ_APPLICATION_PORT:'8110'}
+ assert.equal(loadConfig(env).scheduledConcurrency,6)
+ assert.equal(loadConfig({...env,EZ_SCHEDULED_CONCURRENCY:'2'}).scheduledConcurrency,2)
+ for(const value of ['0','-1','1.5','bad','9007199254740992'])
+  assert.throws(()=>loadConfig({...env,EZ_SCHEDULED_CONCURRENCY:value}),/EZ_SCHEDULED_CONCURRENCY must be a positive integer/)
+})

package/test/executor.test.ts

@@ -372,3 +372,40 @@ test('external local owner chat preserves literal input and admission rejects fo
     if(prior.transport===undefined)delete process.env.EZ_EXECUTOR_TRANSPORT;else process.env.EZ_EXECUTOR_TRANSPORT=prior.transport
   }
 })
+
+test('Claude runs with agent-bound configuration, shared login and the agent directories', {skip:process.platform==='win32'}, async t => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-claude-home-'))
+  t.after(() => rm(root, { recursive: true, force: true }))
+  const bin = path.join(root, 'bin'), workspace = path.join(root, 'mind'), controlDir = path.join(root, 'control'), shared = path.join(root, 'shared')
+  await mkdir(bin); await mkdir(workspace)
+  await writeFile(path.join(bin, 'claude'), `#!${process.execPath}\nrequire('fs').writeFileSync('observed.json',JSON.stringify({args:process.argv.slice(2),config:process.env.CLAUDE_CONFIG_DIR,storage:process.env.CLAUDE_SECURESTORAGE_CONFIG_DIR,token:process.env.CLAUDE_CODE_OAUTH_TOKEN,prompt:require('fs').readFileSync(0,'utf8')}))`, { mode: 0o700 })
+  const previous = { PATH: process.env.PATH, EZ_ISOLATION: process.env.EZ_ISOLATION, EZ_EXECUTOR_TRANSPORT: process.env.EZ_EXECUTOR_TRANSPORT }
+  t.after(() => { for (const [key, value] of Object.entries(previous)) value === undefined ? delete process.env[key] : process.env[key] = value })
+  process.env.PATH = bin + path.delimiter + process.env.PATH
+  delete process.env.EZ_EXECUTOR_TRANSPORT
+  for (const isolation of [undefined, 'isolated']) {
+    if (isolation) process.env.EZ_ISOLATION = isolation; else delete process.env.EZ_ISOLATION
+    await ownerRun(controlDir, `r_claude_${isolation ?? 'host'}`)
+    const job = await startExecutorJob(['hello'], { workspace, controlDir, binDir: bin, cli: 'claude', runId: `r_claude_${isolation ?? 'host'}`, timeoutMs: 5000,
+      sessionId: '00000000-0000-4000-8000-000000000000', sharedWorkspace: shared, model: 'opus', effort: 'high', repairEnabled: false })
+    assert.equal(await new Promise(resolve => job.child.once('close', resolve)), 0); await job.cleanup()
+    const observed = JSON.parse(await readFile(path.join(workspace, 'observed.json'), 'utf8'))
+    assert.equal(observed.config, path.join(controlDir, 'cli', 'claude'))
+    assert.equal(observed.storage, isolation ? undefined : '')
+    assert.equal(observed.prompt, 'hello')
+    for (const directory of [controlDir, shared]) assert.equal(observed.args[observed.args.indexOf(directory) - 1], '--add-dir')
+    assert.deepEqual(observed.args.slice(-4), ['--model', 'opus', '--effort', 'high'])
+    assert.equal(observed.token, undefined)
+  }
+  const run = async (runId: string) => {
+    await ownerRun(controlDir, runId)
+    const job = await startExecutorJob(['hello'], { workspace, controlDir, binDir: bin, cli: 'claude', runId, timeoutMs: 5000, repairEnabled: false })
+    assert.equal(await new Promise(resolve => job.child.once('close', resolve)), 0); await job.cleanup()
+    return JSON.parse(await readFile(path.join(workspace, 'observed.json'), 'utf8'))
+  }
+  await writeFile(path.join(controlDir, 'cli', 'claude', 'oauth-token'), 'sk-ant-oat01-fixture_token-value\n', { mode: 0o600 })
+  assert.equal((await run('r_claude_token')).token, 'sk-ant-oat01-fixture_token-value')
+  await writeFile(path.join(controlDir, 'cli', 'claude', 'oauth-token'), 'bad token\n--flag', { mode: 0o600 })
+  await ownerRun(controlDir, 'r_claude_bad_token')
+  await assert.rejects(startExecutorJob(['hello'], { workspace, controlDir, binDir: bin, cli: 'claude', runId: 'r_claude_bad_token', timeoutMs: 5000, repairEnabled: false }), /Invalid Claude token binding/)
+})

package/test/files.test.ts

@@ -48,3 +48,47 @@ test('stages file into control attachments, never the workspace', async () => {
     await rm(tmp, { recursive: true, force: true })
   }
 })
+
+test('shared incoming document reader extracts PDF text and removes its staged file', async t => {
+  const {readChatAttachment}=await import('../src/files.js')
+  const {execFile}=await import('node:child_process'), {promisify}=await import('node:util')
+  try { await promisify(execFile)('pdftotext',['-v']) } catch { t.skip('Poppler is exercised in the Docker artifact test');return }
+  const dir=await mkdtemp('/tmp/ez-pdf-read-');t.after(()=>rm(dir,{recursive:true,force:true}))
+  const stream='BT /F1 12 Tf 20 80 Td (Shop opens at 7am.) Tj ET'
+  const objects=['<< /Type /Catalog /Pages 2 0 R >>','<< /Type /Pages /Kids [3 0 R] /Count 1 >>','<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Resources << /Font << /F1 4 0 R >> >> /Contents 5 0 R >>','<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>',`<< /Length ${stream.length} >>\nstream\n${stream}\nendstream`]
+  let pdf='%PDF-1.4\n';const offsets=[0]
+  for(const [i,value] of objects.entries()){offsets.push(Buffer.byteLength(pdf));pdf+=`${i+1} 0 obj\n${value}\nendobj\n`}
+  const xref=Buffer.byteLength(pdf);pdf+='xref\n0 6\n0000000000 65535 f \n'+offsets.slice(1).map(n=>String(n).padStart(10,'0')+' 00000 n \n').join('')+`trailer\n<< /Size 6 /Root 1 0 R >>\nstartxref\n${xref}\n%%EOF\n`
+  const result=await readChatAttachment(dir,'shop.pdf',Buffer.from(pdf));assert.match(result.text ?? '',/Shop opens at 7am\./);assert.equal(result.type,'pdf')
+  const {readdir}=await import('node:fs/promises');assert.deepEqual(await readdir(path.join(dir,'attachments')),[])
+  await assert.rejects(readChatAttachment(dir,'invalid.pdf',Buffer.from('%PDF-invalid')))
+})
+
+test('shared image read returns original pixels with native MIME and no staged residue',async t=>{
+ const {readChatAttachment}=await import('../src/files.js'),{readdir}=await import('node:fs/promises')
+ const dir=await mkdtemp('/tmp/ez-image-read-');t.after(()=>rm(dir,{recursive:true,force:true}))
+ const png=Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+ip1sAAAAASUVORK5CYII=','base64')
+ const result=await readChatAttachment(dir,'photo.png',png)
+ assert.equal(result.image?.mimeType,'image/png');assert.equal(result.image?.data,png.toString('base64'));assert.equal(result.text,undefined)
+ assert.deepEqual(await readdir(path.join(dir,'attachments')),[])
+ await assert.rejects(readChatAttachment(dir,'photo.png',Buffer.from('Spoofed image bytes')))
+})
+
+test('video read uses bounded native frames and removes temporary decoder files',async t=>{
+ const {readChatAttachment}=await import('../src/files.js'),{readdir}=await import('node:fs/promises'),{execFile}=await import('node:child_process'),{promisify}=await import('node:util')
+ const execute=promisify(execFile)
+ try {await execute('ffmpeg',['-version'])}catch{t.skip('FFmpeg is exercised in the Docker artifact test');return}
+ const dir=await mkdtemp('/tmp/ez-video-read-');t.after(()=>rm(dir,{recursive:true,force:true}))
+ const video=path.join(dir,'fixture.mp4')
+ await execute('ffmpeg',['-v','error','-f','lavfi','-i','color=c=blue:s=64x64:r=8','-f','lavfi','-i','sine=frequency=1000:sample_rate=24000','-t','1','-c:v','mpeg4','-c:a','aac',video])
+ const result=await readChatAttachment(dir,'video.mp4',await readFile(video))
+ assert.equal(result.type,'mp4');assert.ok((result.images?.length??0)>0);assert.ok((result.images?.length??0)<=8)
+ assert.ok(result.images?.every(image=>image.mimeType==='image/jpeg'));assert.ok(result.durationSeconds!<=120)
+ assert.deepEqual(await readdir(path.join(dir,'attachments')),[]);assert.ok(!(await readdir(dir)).some(name=>name.startsWith('video-')))
+})
+
+test('HEIF stills and audio-only M4A are not treated as MP4 video', () => {
+  const box = (brand: string) => Buffer.concat([Buffer.from([0, 0, 0, 24]), Buffer.from(`ftyp${brand}`), Buffer.alloc(12)])
+  for (const brand of ['heic', 'avif', 'mif1', 'M4A ']) assert.equal(detectFileType(box(brand)), 'unknown')
+  for (const brand of ['isom', 'mp42']) assert.equal(detectFileType(box(brand)), 'mp4')
+})

package/test/host-executor.test.ts

@@ -13,6 +13,8 @@ import { RunStore } from '../src/runs.js'
 import { packageVersion } from '../src/version.js'
 import { executionDefaults } from '../src/model-policy.js'
 import { workspaceLease } from '../src/plugins/workspace-lease.mjs'
+import { ControlStore } from '../src/control-state.js'
+import { Scripts } from '../src/scripts.js'
 
 test('host restart replaces a lock whose PID was reused by another process',async()=>{
   const root=await mkdtemp(path.join(tmpdir(),'ez-host-reused-pid-'))
@@ -285,10 +287,10 @@ test('one installed CLI executes two agent bindings with separate minds and sani
       return output.trim().split('\n').map(line=>JSON.parse(line))
     }
     // Chat completes while this agent's scheduled turn stays active. A second
-    // scheduled turn still waits, and the shared lifecycle lease stays held.
+    // scheduled turn also completes, and the held job keeps the lifecycle lease.
     await completed(otherDirectory,'r_other_shared')
     const chatEvents=await completed(directory,'tg_42')
-    assert.ok(await readFile(path.join(directory,'r_schedule_queued.request.json')))
+    await completed(directory,'r_schedule_queued')
     assert.equal(await workspaceLease(agents[0].toolsHome),undefined)
     await ownerRun(agents[0].controlDir,'tg_43')
     await writeFile(path.join(directory,'tg_43.request.json'),JSON.stringify({texts:['Hold chat'],options:{cli:'grok'}}))
@@ -525,3 +527,44 @@ test('startup replaces prior catalog after provider policy changes even when dis
     assert.deepEqual(JSON.parse(await readFile(path.join(directory,'models.json'),'utf8')),[])
   } finally {abort.abort();await server;await rm(root,{recursive:true,force:true})}
 })
+
+test('host transport runs a registered script from the run record and refuses changed entry-point bytes', async () => {
+  const root=await mkdtemp(path.join(tmpdir(),'ez-host-script-'))
+  const workspace=path.join(root,'mind'),controlDir=path.join(root,'control'),directory=path.join(controlDir,'host-executor')
+  const abort=new AbortController();let server:Promise<void>|undefined
+  const oldToken=process.env.TELEGRAM_BOT_TOKEN
+  try {
+    await mkdir(workspace);await mkdir(directory,{recursive:true})
+    await writeFile(path.join(workspace,'guard.mjs'),"console.log(JSON.stringify({cwd:process.cwd(),args:process.argv.slice(2),due:process.env.EZ_DUE_AT,token:process.env.TELEGRAM_BOT_TOKEN}))\n")
+    process.env.TELEGRAM_BOT_TOKEN='must-not-reach-host-script'
+    await ownerRun(controlDir,'r_seed')
+    const owner=(await new ControlStore(controlDir,900000).status()).owner!
+    const registration=await new Scripts(controlDir).save({id:'guard',owner,workspace,entry:'guard.mjs',interpreter:'node',args:['saved'],timeoutSeconds:60},true)
+    const runs=new RunStore(controlDir)
+    const scripted=async(id:string)=>{
+      await runs.create({id,chatId:101,telegramUserId:101,texts:['[schedule]'],script:{id:'guard',args:['extra'],revision:registration.revision,sha256:registration.sha256},
+        scheduled:{id:'s_guard',revision:'rev1',dueAt:'2026-10-07T11:15:00.000Z',pairedAt:owner.pairedAt}})
+      await runs.patch(id,{status:'running'})
+      // The request cannot choose the command, script or workspace.
+      await writeFile(path.join(directory,`${id}.request.json`),JSON.stringify({texts:['x'],options:{workspace:'/wrong',cli:'grok',script:{id:'other',args:['injected']},timeoutMs:0}}))
+      let events:any[]=[]
+      for(let n=0;n<300;n++){try{events=(await readFile(path.join(directory,`${id}.events`),'utf8')).trim().split('\n').map(l=>JSON.parse(l));if(events.some(e=>e.stream==='exit'))break}catch{}await new Promise(r=>setTimeout(r,20))}
+      return events
+    }
+    server=serveHostExecutor({cli:'grok',agents:[{name:'test',workspace,controlDir,binDir:root}]},abort.signal,undefined,async()=>[])
+    const events=await scripted('r_schedule_script_ok')
+    assert.equal(events.find(e=>e.stream==='exit')?.code,0)
+    const result=JSON.parse(events.filter(e=>e.stream==='stdout').map(e=>e.text).join(''))
+    assert.equal(result.cwd,await realpath(workspace));assert.deepEqual(result.args,['saved','extra'])
+    assert.equal(result.due,'2026-10-07T11:15:00.000Z');assert.equal(result.token,undefined)
+    await writeFile(path.join(workspace,'guard.mjs'),"console.log('changed')\n")
+    const refused=await scripted('r_schedule_script_changed')
+    assert.equal(refused.find(e=>e.stream==='exit')?.code,1)
+    assert.equal(refused.filter(e=>e.stream==='stdout').length,0)
+    assert.match(refused.filter(e=>e.stream==='stderr').map(e=>e.text).join(''),/entry point changed since registration/)
+  }finally{
+    abort.abort();await server
+    if(oldToken===undefined)delete process.env.TELEGRAM_BOT_TOKEN;else process.env.TELEGRAM_BOT_TOKEN=oldToken
+    await rm(root,{recursive:true,force:true})
+  }
+})

package/test/install-json.test.mjs

@@ -0,0 +1,21 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { run, latestCodexVersion } from '../src/install-tools.mjs';
+
+test('Codex discovery parses stdout and retains failure diagnostics',async()=>{
+  const script=`process.stdout.write('"0.160.1"\\n');process.stderr.write('package manager notice\\n');`;
+  const invoke=(command,args,options)=>{
+    assert.equal(command,'pnpm');
+    assert.deepEqual(args,['view','@openai/codex@latest','version','--json','--registry','https://registry.npmjs.org/']);
+    assert.equal(options.stdoutOnly,true);
+    return run(process.execPath,['-e',script],options);
+  };
+  assert.equal(await latestCodexVersion(invoke,{command:'pnpm',args:[]}),'0.160.1');
+  await assert.rejects(run(process.execPath,['-e',script+'process.exitCode=1'],{stdoutOnly:true}),/package manager notice/);
+});
+
+test('Codex discovery rejects contaminated stdout without leaking it',async()=>{
+  await assert.rejects(latestCodexVersion(async()=> '"0.160.1"\nprivate-output'),{message:'Codex version discovery returned invalid JSON on stdout'});
+  for(const value of ['null','{}','["0.160.1"]','"latest"'])
+    await assert.rejects(latestCodexVersion(async()=>value),/Invalid latest Codex version/);
+});

package/test/plugin-broker.test.mjs

@@ -182,3 +182,67 @@ test('broker rejects resolve and invoke for a revoked run', async t => {
     await serving;
   }
 });
+
+test('scheduled preflight uses authoritative configuration and rejects writes or stale revisions', async t => {
+  const f = await fixture(t);
+  const { Scheduler } = await import('../src/scheduler.js');
+  const { createLedgerHandler, serveDeliverySocket } = await import('../src/delivery-socket.js');
+  const control = new ControlStore(f.controlDir, 1000);
+  const owner = (await control.status()).owner;
+  const scheduler = new Scheduler(f.controlDir);
+  const schedule = await scheduler.save({id:'check', name:'Check', text:'Saved worker', enabled:true, owner,
+    execution:{sessionId:randomUUID(),preset:{id:'test',name:'test',cli:'codex',model:'fixture-model'}},
+    trigger:{everySeconds:60,start:new Date().toISOString()},preflight:{on:'eligible',checks:[{alias:'sample',args:['queue']}]}});
+  const ledger = await serveDeliverySocket(f.controlDir, createLedgerHandler(f.controlDir,{wake:()=>{},status:()=>({polling:false,applicationOnly:true,telegramConfigured:false,version:'fixture'})}));
+  t.after(()=>ledger.stop());
+  await fs.writeFile(path.join(f.fake,'docker'), `#!${process.execPath}\nprocess.stdout.write(JSON.stringify({schemaVersion:1,eligible:true,count:1,fingerprint:'a'.repeat(64),observedAt:new Date().toISOString()}));\n`, {mode:0o700});
+  const previousPath=process.env.PATH;process.env.PATH=f.fake+path.delimiter+previousPath;
+  const binding=await loadPluginBrokerBinding({home:f.home,workspace:f.workspace,controlDir:f.controlDir,socket:f.socket,hostConfig:f.hostConfig,timeoutMs:10000});
+  const abort=new AbortController(),serving=servePluginBroker(binding,abort.signal);
+  try {
+    await waitForSocket(f.socket);
+    const payload={version:1,id:randomUUID(),operation:'preflight',scheduleId:schedule.id,revision:schedule.revision};
+    assert.equal((await request(f.socket,{...payload,args:['write']})).ok,false);
+    assert.equal((await request(f.socket,{...payload,revision:randomUUID()})).ok,false);
+    assert.equal((await request(f.socket,payload)).ok,false); // undeclared read-only command
+    const file=path.join(f.home,'registry.json'),registry=JSON.parse(await fs.readFile(file,'utf8'));
+    registry.plugins.sample.manifest.commands.sample.exposure={receivesExternalContent:true,changesRecords:false,sendsExternally:false,requiresReview:false};
+    await fs.writeFile(file,JSON.stringify(registry));
+    const accepted=await request(f.socket,payload);assert.equal(accepted.ok,true);assert.equal(accepted.result.eligible,true);
+    await scheduler.save({...schedule,enabled:false});
+    assert.equal((await request(f.socket,payload)).ok,false);
+  } finally {abort.abort();await serving;process.env.PATH=previousPath;}
+});
+
+test('task launch broker admits only its fixed application command and writes no bearer into receipts',async t=>{
+  const {createServer}=await import('node:http');
+  const {Tasks}=await import('../src/tasks.js');const {EventSources}=await import('../src/event-sources.js');
+  const {ApplicationBindings}=await import('../src/application-channel.js');const {serveTestLedger}=await import('./helpers/ledger.js');
+  const f=await fixture(t), runs=new RunStore(f.controlDir), control=new ControlStore(f.controlDir,900000);
+  const sourceSocket=path.join(f.root,'source.sock');const provider=createServer(async(req,res)=>{
+    let raw='';for await(const c of req)raw+=c;const v=JSON.parse(raw);
+    res.end(JSON.stringify({ok:true,data:v.command==='events-head'?{cursor:0,accountId:'fixture-account',taskProtocol:'message-v1'}:{}}));
+  });await new Promise(r=>provider.listen(sourceSocket,r));
+  const tasks=new Tasks(f.controlDir),owner=(await control.status()).owner;
+  await new EventSources(f.controlDir).register('fixture',sourceSocket,owner);
+  const task=await tasks.ownerCall(f.runId,'start',{sourceId:'fixture',conversationId:'discussion-a',purpose:'Synthetic discussion',context:'Only synthetic records',hours:1});
+  const taskRun='event_'+hash(task.id);await runs.patch(taskRun,{status:'running'});
+  const bindings=new ApplicationBindings(f.controlDir);await bindings.register('browser','z'.repeat(48),owner);
+  await bindings.taskLaunch('browser',{command:'sample',args:['launch','--task'],tasks:[task.id]});
+  const token='c'.repeat(64),ticketHash=hash(token),grant=await tasks.workerCall(taskRun,'application_launch',{application:'browser',ticketHash});
+  const input={taskId:task.id,taskToken:token,expiresAt:grant.expiresAt};
+  const ledger=await serveTestLedger(f.controlDir);
+  const binding=await loadPluginBrokerBinding({home:f.home,workspace:f.workspace,controlDir:f.controlDir,socket:f.socket,hostConfig:f.hostConfig,timeoutMs:10000});
+  const oldPath=process.env.PATH;process.env.PATH=f.fake+path.delimiter+oldPath;
+  const abort=new AbortController(),serving=servePluginBroker(binding,abort.signal);
+  try{
+    await waitForSocket(f.socket);
+    const denied=await request(f.socket,{version:1,id:randomUUID(),operation:'resolve',runId:taskRun,alias:'sample'});assert.equal(denied.ok,false);
+    const launch=await request(f.socket,{version:1,id:randomUUID(),operation:'task-launch',runId:taskRun,stdin:JSON.stringify(input)});
+    assert.equal(launch.ok,true,launch.error);assert.equal(launch.stdout,'broker-ok');assert.equal(launch.receipt.status,'completed');
+    const receipt=await fs.readFile(launch.receiptPath,'utf8');assert(!receipt.includes(token));assert(!receipt.includes('taskToken'));
+    const wrong=await request(f.socket,{version:1,id:randomUUID(),operation:'task-launch',runId:f.runId,stdin:JSON.stringify(input)});assert.equal(wrong.ok,false);
+    await bindings.taskLaunch('browser',null);
+    const revoked=await request(f.socket,{version:1,id:randomUUID(),operation:'task-launch',runId:taskRun,stdin:JSON.stringify(input)});assert.equal(revoked.ok,false);
+  }finally{abort.abort();await serving;process.env.PATH=oldPath;await ledger.stop();provider.closeAllConnections();await new Promise(r=>provider.close(r));}
+});

package/test/plugin-manager.test.mjs

@@ -652,3 +652,23 @@ test('writable folders require an explicit per-folder grant and can be revoked',
  assert.equal((await compose(config,record)).services.sample.volumes.find(v=>v.target==='/data/files').read_only,true);
  await assert.rejects(f.call('plugins','folder-unbind','sample','--service','sample','--target','/data/files','--writable'),/Supply/);
 });
+
+test('command admission waits for a live short lock without removing it',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ let release,started;
+ const ready=new Promise(resolve=>started=resolve),hold=new Promise(resolve=>release=resolve);
+ const writer=locked(f.home,async()=>{started();await hold;});
+ await ready;
+ const call=f.call('sample','read');
+ await new Promise(resolve=>setTimeout(resolve,100));
+ assert.equal(JSON.parse(await fs.readFile(path.join(f.home,'registry.lock'),'utf8')).pid,process.pid);
+ release();await writer;
+ assert.deepEqual(JSON.parse((await call).stdout),['read']);
+});
+
+test('bounded lock admission times out without stealing an interrupted lock',async t=>{
+ const f=await fixture(t),file=path.join(f.home,'registry.lock');
+ await fs.mkdir(f.home,{recursive:true});await fs.writeFile(file,'preserved');
+ await assert.rejects(locked(f.home,async()=>assert.fail('must not enter'),{waitMs:50}),/Registry busy/);
+ assert.equal(await fs.readFile(file,'utf8'),'preserved');
+});

package/test/private-speech-config.test.ts

@@ -0,0 +1,22 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import {mkdtempSync,writeFileSync,openSync,closeSync,rmSync} from 'node:fs'
+import {spawnSync} from 'node:child_process'
+import {join} from 'node:path'
+import {loadConfig} from '../src/config.js'
+
+test('installed private descriptor admits speech selectors and keeps speech keys out of the executor', () => {
+  const dir=mkdtempSync('/tmp/ez-speech-env-'),file=join(dir,'relay.env'),key='synthetic-private-speech-marker'
+  try {
+    writeFileSync(file,`OPENROUTER_API_KEY=${key}\nEZ_SPEECH_PROVIDER=invalid-private-selector\nEZ_SPEECH_MODEL=fish-audio/s2.1-pro-free:free\n`,{mode:0o600})
+    let fd=openSync(file,'r')
+    const invalid=spawnSync(process.execPath,['--import','tsx','docker/run.ts','start'],{encoding:'utf8',timeout:15000,env:{PATH:process.env.PATH,EZ_APPLICATION_PORT:'8787'},stdio:['ignore','pipe','pipe',fd]});closeSync(fd)
+    assert.equal(invalid.status,1);assert.match(invalid.stderr,/Invalid EZ_SPEECH_PROVIDER/);assert.ok(!invalid.stderr.includes(key))
+    writeFileSync(file,`OPENROUTER_API_KEY=${key}\nEZ_SPEECH_PROVIDER=openrouter\nEZ_SPEECH_MODEL=fish-audio/s2.1-pro-free:free\n`,{mode:0o600})
+    fd=openSync(file,'r')
+    const child=spawnSync(process.execPath,['--import','tsx','docker/run.ts','exec',process.execPath,'-e',"if(process.env.OPENROUTER_API_KEY||process.env.EZ_SPEECH_PROVIDER)process.exit(91);console.log('isolated')"],{encoding:'utf8',timeout:15000,env:{PATH:process.env.PATH},stdio:['ignore','pipe','pipe',fd]});closeSync(fd)
+    assert.equal(child.status,0,child.stderr);assert.equal(child.stdout.trim(),'isolated')
+    const config=loadConfig({EZ_APPLICATION_PORT:'8787',OPENROUTER_API_KEY:key,EZ_SPEECH_PROVIDER:'openrouter',EZ_SPEECH_MODEL:'fish-audio/s2.1-pro-free:free'})
+    assert.equal(config.openrouterApiKey,key);assert.equal(config.speechProvider,'openrouter');assert.equal(config.speechModel,'fish-audio/s2.1-pro-free:free')
+  } finally {rmSync(dir,{recursive:true,force:true})}
+})

package/test/run-evidence.test.ts

@@ -0,0 +1,78 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { createHash } from 'node:crypto'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { ownerRun } from './helpers/owner-run.js'
+import { serveTestLedger } from './helpers/ledger.js'
+import { RunStore } from '../src/runs.js'
+import { ControlStore } from '../src/control-state.js'
+import { runEvidence, projectRunEvidence } from '../src/run-evidence.js'
+
+async function fixture(t: test.TestContext) {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-evidence-'))
+  await ownerRun(dir, 'owner_run')
+  const ledger = await serveTestLedger(dir)
+  t.after(async () => { await ledger.stop(); await rm(dir, { recursive: true, force: true }) })
+  return { dir, runs: new RunStore(dir), owner: (await new ControlStore(dir, 1000).status()).owner! }
+}
+
+test('CLI projects operational proof without sessions, failure prose or delivered text', async t => {
+  const { dir, runs } = await fixture(t)
+  const secret = 'private-session-or-token'
+  await runs.patch('owner_run', { nativeSessionId: secret, failureReason: secret,
+    failure: { error: secret, relayVersion: '0.1.0-beta.47' } })
+  const sent = await runs.enqueueMessage('owner_run', 'private financial report')
+  await runs.claimOutbox(sent.id); await runs.markOutboxSent(sent.id, [7])
+  const uncertain = await runs.enqueueMessage('owner_run', 'uncertain report')
+  await runs.claimOutbox(uncertain.id); await runs.failOutbox(uncertain.id, secret, true)
+  const control = await new ControlStore(dir, 1000).status()
+  const { stdout } = await promisify(execFile)(process.execPath, ['bin/ezenciel-agents-schedule.mjs', 'evidence'], {
+    env: { ...process.env, EZ_CONTROL_DIR: dir, EZ_RUN_ID: 'owner_run' },
+  })
+  const result = JSON.parse(stdout)
+  assert.equal(result.runs.length, 1)
+  assert.ok(!stdout.includes(secret) && !stdout.includes('private financial report') && !stdout.includes('uncertain report'))
+  const receipts = result.runs[0].deliveries
+  assert.equal(receipts.find((r: any) => r.id === sent.id).receiptVerified, true)
+  assert.equal(receipts.find((r: any) => r.id === sent.id).content.sha256, createHash('sha256').update('private financial report').digest('hex'))
+  assert.equal(receipts.find((r: any) => r.id === uncertain.id).state, 'unknown')
+  assert.equal(receipts.find((r: any) => r.id === uncertain.id).receiptVerified, false)
+  assert.equal(result.runs[0].toolDelegationMetadata.state, 'unavailable')
+  assert.deepEqual(await new ControlStore(dir, 1000).status(), control)
+})
+
+test('pages require an unchanged snapshot and exact identity', async t => {
+  const { dir, runs } = await fixture(t)
+  await ownerRun(dir, 'second_run')
+  const first = await runEvidence(dir, { limit: 1 })
+  assert.equal(first.coverage.total, 2)
+  assert.equal(first.coverage.nextOffset, 1)
+  const second = await runEvidence(dir, { limit: 1, offset: 1, expected: first.snapshotSha256 })
+  assert.equal(second.coverage.nextOffset, null)
+  assert.notEqual(second.runs[0].id, first.runs[0].id)
+  await assert.rejects(runEvidence(dir, { offset: 1 }), /requires/)
+  await runs.patch('second_run', { status: 'completed' })
+  await assert.rejects(runEvidence(dir, { offset: 1, expected: first.snapshotSha256 }), /changed/)
+  await assert.rejects(runEvidence(dir, { runId: '../owner_run' }), /identifier/)
+  for (const options of [{ limit: 101 }, { offset: -1 }, { offset: 0.5 }, { expected: 'bad' }])
+    await assert.rejects(runEvidence(dir, options))
+})
+
+test('revoked owners, restricted callers and unrelated bindings are excluded', async t => {
+  const { dir, runs, owner } = await fixture(t)
+  const stranger = await runs.create({ id: 'other_owner', chatId: 202, telegramUserId: 202, texts: ['secret'] })
+  const external = await ownerRun(dir, 'external', { sourceId: 'test', bindingId: 'binding', eventIds: ['1'] })
+  const old = { ...(await runs.get('owner_run'))!, id: 'old_run', scheduled: { id: 'schedule', revision: 'rev', dueAt: '2026-01-01T00:00:00Z', pairedAt: 'old-pairing' } }
+  const app = { ...(await runs.get('owner_run'))!, id: 'app_run', delivery: { bindingId: 'private', scope: 'private' } }
+  assert.deepEqual(projectRunEvidence([stranger, external, old, app], [], owner), [])
+  await assert.rejects(runEvidence(dir, { callerRunId: 'external' }), /blocked/)
+  await runs.patch('owner_run', { replyOnly: true })
+  await assert.rejects(runEvidence(dir, { callerRunId: 'owner_run' }), /Telegram owner/)
+  await assert.rejects(runEvidence(dir, { runId: 'other_owner' }), /Unknown/)
+  await new ControlStore(dir, 1000).revokeOwner()
+  await assert.rejects(runEvidence(dir), /No authorized owner/)
+})