@jc_stack/ez-agents 0.1.0-beta.47 → 0.1.0-beta.48

package/test/schedule-preflight.test.ts

@@ -0,0 +1,49 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import {mkdtemp,rm,readFile} from 'node:fs/promises'
+import {join} from 'node:path'
+import {tmpdir} from 'node:os'
+import {randomUUID} from 'node:crypto'
+import {Scheduler} from '../src/scheduler.js'
+import {RunStore} from '../src/runs.js'
+import {validPreflight,combinePreflight} from '../src/schedule-preflight.js'
+const packet=(eligible:boolean,fingerprint='a'.repeat(64))=>({eligible,fingerprint,count:eligible?1:0,observedAt:new Date().toISOString()})
+test('preflight skips empty/unchanged work, admits saved worker once, and fails closed',async t=>{
+ const dir=await mkdtemp(join(tmpdir(),'schedule-preflight-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ let result=packet(false),failed=false
+ const scheduler=new Scheduler(dir,async()=>{if(failed)throw Error('Provider unavailable');return result}),runs=new RunStore(dir)
+ const owner={telegramUserId:42,telegramChatId:42,pairedAt:new Date().toISOString()},start=Date.now()+10000
+ const input={id:'preflight',name:'Check',text:'Do role work',enabled:true,owner,execution:{sessionId:randomUUID(),preset:{id:'test',name:'test',cli:'codex',model:'fixture-model'}},trigger:{everySeconds:60,start:new Date(start).toISOString()},preflight:{on:'changed' as const,checks:[{alias:'provider-work',args:['--field','Role=RoleX']}]}}
+ const s=await scheduler.save(input)
+ await scheduler.tick(owner,runs,start);assert.equal((await runs.list()).length,0)
+ result=packet(true,'b'.repeat(64));await scheduler.tick(owner,runs,start+60000)
+ const [run]=await runs.list();assert.deepEqual(run.execution,s.execution)
+ await scheduler.tick(owner,runs,start+120000);assert.equal((await runs.list()).length,1)
+ await runs.patch(run.id,{status:'completed'});await scheduler.tick(owner,runs,start+180000);assert.equal((await runs.list()).length,1)
+ failed=true;await scheduler.tick(owner,runs,start+240000);assert.equal((await runs.list()).length,1);assert.equal((await scheduler.preflightReceipt(s)).state,'unavailable')
+ failed=false;result=packet(false);await assert.rejects(()=>scheduler.trigger(s.id,s.revision,'empty',owner,runs),/no eligible/)
+ result=packet(true,'c'.repeat(64));await scheduler.tick(owner,runs,start+300000);assert.equal((await runs.list()).length,2)
+})
+test('only bounded literal commands and fresh typed packets enter admission',()=>{
+ assert.equal(validPreflight({on:'eligible',checks:[{alias:'queue',args:['x']}] }),true)
+ assert.equal(validPreflight({on:'eligible',checks:[{alias:'queue',args:['x\nwrite']}] }),false)
+ assert.throws(()=>combinePreflight([{schemaVersion:1,...packet(true),eligible:'true'}]),/Invalid/)
+ assert.throws(()=>combinePreflight([{schemaVersion:1,...packet(true),observedAt:'2000-01-01T00:00:00Z'}]),/stale/)
+ assert.equal(combinePreflight([{schemaVersion:1,...packet(false)},{schemaVersion:1,...packet(true)}]).eligible,true)
+})
+
+test('manual preflight before the first tick preserves future recurrence',async t=>{
+ const dir=await mkdtemp(join(tmpdir(),'schedule-preflight-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ const scheduler=new Scheduler(dir,async()=>packet(true)),runs=new RunStore(dir)
+ const owner={telegramUserId:42,telegramChatId:42,pairedAt:new Date().toISOString()}
+ const s=await scheduler.save({id:'manual',name:'Manual',text:'Work',enabled:true,owner,
+  execution:{sessionId:randomUUID(),preset:{id:'test',name:'test',cli:'codex',model:'fixture-model'}},
+  trigger:{everySeconds:60,start:new Date(Date.now()+60000).toISOString()},
+  preflight:{on:'eligible',checks:[{alias:'provider-work',args:[]}]}})
+ const next=await scheduler.pendingOccurrence(s)
+ const manual=await scheduler.trigger(s.id,s.revision,'first',owner,runs)
+ assert.equal(await scheduler.pendingOccurrence(s),next)
+ await runs.patch(manual.id,{status:'completed'})
+ await scheduler.tick(owner,runs,next!)
+ assert.equal((await runs.list()).length,2)
+})

package/test/scheduler-host.test.ts

@@ -42,6 +42,10 @@ test('host transport keeps chat responsive beside a schedule in the bound mind',
   await runs.patch(id,{status:'running'})
   await submit(id)
   await until(async()=>Boolean(await exists(id+'.process.json')))
+  const parallel='r_schedule_parallel'
+  await runs.create({id:parallel,chatId:101,telegramUserId:101,texts:['parallel'],execution:{sessionId:randomUUID(),preset:{id:'fixture',name:'Fixture',cli:'grok',model:'fixture-model'}},scheduled:{id:'parallel',revision:'v',dueAt:new Date().toISOString(),pairedAt:'paired'}})
+  await runs.patch(parallel,{status:'running'});await submit(parallel)
+  await until(async()=>Boolean(await exists(parallel+'.process.json')))
   await submit('tg_1')
   await until(async()=>(await exists('tg_1.events')).includes('"stream":"exit","code":0'))
   assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
@@ -60,6 +64,9 @@ test('host transport keeps chat responsive beside a schedule in the bound mind',
   assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
   await writeFile(join(dir,id+'.cancel'),'')
   await until(async()=>(await exists(id+'.events')).includes('"stream":"exit"'))
+  assert.ok(!(await exists(parallel+'.events')).includes('"stream":"exit"'))
+  await writeFile(join(dir,parallel+'.cancel'),'')
+  await until(async()=>(await exists(parallel+'.events')).includes('"stream":"exit"'))
   await until(async()=>(await exists('tg_1.events')).includes('"stream":"exit","code":0'))
   await until(async()=>(await exists('tg_2.events')).includes('"stream":"exit","code":0'))
   const main=JSON.parse(stdout(await exists('tg_1.events')))

package/test/scheduler-relay.test.ts

@@ -32,7 +32,7 @@ test('executor admission rejects a legacy queued schedule with no model before s
    scheduled:{id:saved.id,revision:saved.revision,dueAt:new Date(due).toISOString(),pairedAt:owner.pairedAt}})
   await relay.drainSources()
   assert.equal((await runs.get(run.id))?.status,'failed');assert.equal(launches,0)
-  assert.equal((await scheduler.get(saved.id)).execution.preset.model,'saved-model')
+  assert.equal((await scheduler.get(saved.id)).execution!.preset.model,'saved-model')
  }finally{await relay.stop();await rm(dir,{recursive:true,force:true})}
 })
 
@@ -89,10 +89,10 @@ test('a wrapper-shaped run id has no maintenance treatment and a stale notice is
  }finally{await relay.stop();await rm(dir,{recursive:true,force:true})}
 })
 
-test('Slack application replies beside a schedule and keeps both streams serial',async()=>{
+test('Slack application replies beside schedules configured to stay serial',async()=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-slack-scheduled-')),runs=new RunStore(dir),scheduler=new Scheduler(dir),control=new ControlStore(dir,1000)
  const children=new Map<string,ReturnType<typeof spawn>>()
- const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture'},async(_texts,options)=>{
+ const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture',scheduledConcurrency:1},async(_texts,options)=>{
   const child=spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:process.platform!=='win32'})
   children.set(options.runId,child);await once(child,'spawn')
   if(!options.runId.startsWith('r_schedule_'))await runs.enqueueMessage(options.runId,'Slack reply')
@@ -176,3 +176,38 @@ test('owner chat replies while a scheduled CLI keeps running; targeted cancellat
   await rm(dir,{recursive:true,force:true})
  }
 })
+
+for(const limit of [undefined,2])test(`scheduled admission bounds independent native jobs at ${limit ?? 6} and releases a cancelled slot`,async()=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-parallel-schedules-')),control=new ControlStore(dir,1000),runs=new RunStore(dir),scheduler=new Scheduler(dir)
+ const children=new Map<string,ReturnType<typeof spawn>>(),optionsSeen:ExecutorOptions[]=[]
+ const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture',scheduledConcurrency:limit},async(_texts,options)=>{
+  optionsSeen.push(options)
+  const child=spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:process.platform!=='win32'})
+  children.set(options.runId,child);await once(child,'spawn');return {child,cleanup:async()=>{},stdout:''}
+ })
+ try{
+  await control.requestPairing(101,101);await control.approveOwner(101)
+  const owner=(await control.status()).owner!,execution=await control.captureChoice({...initialPreset('grok'),model:'saved-model',effort:'medium'})
+  const jobs: Awaited<ReturnType<Scheduler['trigger']>>[]=[]
+  for(let n=0;n<(limit ?? 6)+1;n++){
+   const saved=await scheduler.save({id:`job${n}`,name:`Job${n}`,text:'Finite test',owner,execution,enabled:true,trigger:{at:'2027-01-01T00:00:00Z'}},true)
+   jobs.push(await scheduler.trigger(saved.id,saved.revision,`key${n}`,owner,runs))
+  }
+  await Promise.all([relay.drainSources(),relay.drainSources()])
+  assert.equal((await runs.list()).filter(r=>r.status==='running').length,limit ?? 6)
+  assert.equal((await runs.get(jobs.at(-1)!.id))?.status,'queued')
+  assert.equal(new Set(optionsSeen.map(o=>o.sessionId)).size,limit ?? 6)
+  for(const options of optionsSeen){assert.equal(options.model,'saved-model');assert.equal(options.effort,'medium');assert.equal(options.nativeSession,true);assert.equal(options.isResume,false)}
+  const foreground=await runs.create({id:'tg_parallel_chat',chatId:101,telegramUserId:101,texts:['Owner chat'],execution})
+  await relay.drainSources();assert.equal((await runs.get(foreground.id))?.status,'running')
+  assert.equal(children.size,(limit ?? 6)+1)
+  await scheduler.cancel(jobs[0].id);await relay.drainSources()
+  await until(async()=> (await runs.get(jobs[0].id))?.status==='cancelled')
+  await relay.drainSources();assert.equal((await runs.get(jobs.at(-1)!.id))?.status,'running')
+  for(const job of jobs.slice(1))assert.equal((await runs.get(job.id))?.status,'running')
+ }finally{
+  await relay.stop()
+  await until(async()=>!(await runs.list()).some(r=>r.status==='running'))
+  await rm(dir,{recursive:true,force:true})
+ }
+})

package/test/scheduler.test.ts

@@ -167,7 +167,7 @@ test('missing models cannot be saved, dispatched or triggered; legacy settings r
  const file=join(f.dir,'schedules/test.json')
  await writeFile(file,JSON.stringify({...saved,execution:missing.execution}))
  const legacy=await f.scheduler.get(saved.id)
- assert.equal(legacy.execution.preset.model,undefined)
+ assert.equal(legacy.execution!.preset.model,undefined)
  await f.scheduler.tick(f.owner,f.runs,f.now)
  assert.equal((await f.runs.list()).length,0)
  assert.equal(await f.scheduler.pendingOccurrence(legacy),next,'blocked dispatch must preserve the pending occurrence')

package/test/script-schedules.test.ts

@@ -0,0 +1,219 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { execFile, spawn } from 'node:child_process'
+import { promisify } from 'node:util'
+import { once } from 'node:events'
+import { chmod, mkdir, mkdtemp, readFile, rm, symlink, writeFile, access } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { fileURLToPath } from 'node:url'
+import { createRelay } from '../src/index.js'
+import { ControlStore } from '../src/control-state.js'
+import { RunStore, type RunRecord } from '../src/runs.js'
+import { Scheduler } from '../src/scheduler.js'
+import { Scripts } from '../src/scripts.js'
+import { initialPreset } from '../src/ai.js'
+import { startExecutorJob, type ExecutorOptions } from '../src/executor.js'
+import { serveTestLedger } from './helpers/ledger.js'
+
+const exec = promisify(execFile), bin = fileURLToPath(new URL('../bin/ezenciel-agents-schedule.mjs', import.meta.url))
+const until = async (check: () => Promise<boolean>, tries = 400) => { for (let i = 0; i < tries; i++) { if (await check()) return; await new Promise(r => setTimeout(r, 25)) } throw new Error('Timed out') }
+const alive = (pid: number) => { try { process.kill(pid, 0); return true } catch { return false } }
+
+// The script records only what it was given; it never prints secrets.
+const fixture = `import { writeFileSync } from 'node:fs'
+import { spawn } from 'node:child_process'
+const mode = process.argv[2]
+const env = Object.fromEntries(Object.entries(process.env).filter(([k]) => k.startsWith('EZ_')))
+writeFileSync('out-' + process.env.EZ_RUN_ID + '.json', JSON.stringify({ argv: process.argv.slice(2), env,
+  leaked: ['TELEGRAM_BOT_TOKEN', 'EZ_TEST_SECRET', 'OPENAI_API_KEY'].filter(k => process.env[k] !== undefined) }))
+console.log('routine check ok token=abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOP')
+console.error('diagnostic line')
+if (mode === 'hang') {
+  const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' })
+  writeFileSync('child-' + process.env.EZ_RUN_ID + '.pid', String(child.pid))
+  setInterval(() => {}, 1000)
+}
+if (mode === 'fail') process.exit(3)
+`
+
+const setup = async () => {
+  const root = await mkdtemp(join(tmpdir(), 'ez-script-schedules-'))
+  const dir = join(root, 'control'), workspace = join(root, 'workspace'), fakeBin = join(root, 'bin')
+  await Promise.all([mkdir(dir), mkdir(join(workspace, 'scripts'), { recursive: true }), mkdir(fakeBin)])
+  await writeFile(join(workspace, 'scripts', 'guard.mjs'), fixture)
+  // Any native engine launch would leave this marker: script runs must not start one.
+  for (const engine of ['codex', 'claude', 'grok']) {
+    await writeFile(join(fakeBin, engine), `#!/bin/sh\necho "$0" >> ${JSON.stringify(join(root, 'llm-invocations'))}\n`)
+    await chmod(join(fakeBin, engine), 0o755)
+  }
+  const control = new ControlStore(dir, 1000)
+  await control.requestPairing(101, 101); await control.approveOwner(101)
+  const owner = (await control.status()).owner!
+  return { root, dir, workspace, fakeBin, control, owner, runs: new RunStore(dir), scheduler: new Scheduler(dir), scripts: new Scripts(dir) }
+}
+
+test('script registration confines the entry point, rejects shell strings and records the entry hash', async t => {
+  const f = await setup(); t.after(() => rm(f.root, { recursive: true, force: true }))
+  const base = { id: 'guard', owner: f.owner, workspace: f.workspace, interpreter: 'node', args: [], timeoutSeconds: 60 }
+  const saved = await f.scripts.save({ ...base, entry: 'scripts/guard.mjs' }, true)
+  assert.equal(saved.entry, join('scripts', 'guard.mjs')); assert.match(saved.sha256, /^[a-f0-9]{64}$/)
+  await assert.rejects(f.scripts.save({ ...base, entry: 'scripts/guard.mjs' }, true), /already registered/)
+  await writeFile(join(f.root, 'outside.mjs'), 'process.exit(0)')
+  await assert.rejects(f.scripts.save({ ...base, id: 'escape', entry: '../outside.mjs' }, true), /inside the agent workspace/)
+  await symlink(join(f.root, 'outside.mjs'), join(f.workspace, 'link.mjs'))
+  await assert.rejects(f.scripts.save({ ...base, id: 'escape', entry: 'link.mjs' }, true), /inside the agent workspace/)
+  await assert.rejects(f.scripts.save({ ...base, id: 'shell', entry: 'scripts/guard.mjs', interpreter: 'node -e "x"' }, true), /not a shell command/)
+  await assert.rejects(f.scripts.save({ ...base, id: 'shell', entry: 'scripts/guard.mjs', interpreter: 'sh;rm' }, true), /not a shell command/)
+  await assert.rejects(f.scripts.save({ ...base, id: 'missing', entry: 'scripts/guard.mjs', interpreter: 'no-such-interpreter-ez' }, true), /not installed/)
+  await assert.rejects(f.scripts.save({ ...base, id: 'Bad ID', entry: 'scripts/guard.mjs' }, true), /Script ID/)
+  // An interpreter inside the workspace would be unhashed code.
+  await writeFile(join(f.workspace, 'run.sh'), '#!/bin/sh\n'); await chmod(join(f.workspace, 'run.sh'), 0o755)
+  await assert.rejects(f.scripts.save({ ...base, id: 'local', entry: 'scripts/guard.mjs', interpreter: join(f.workspace, 'run.sh') }, true), /outside the agent workspace/)
+  await assert.rejects(f.scripts.save({ ...base, id: 'local', entry: 'scripts/guard.mjs', interpreter: 'run.sh', pathValue: '.' }, true), /not installed/)
+  // Another owner's registration cannot be scheduled.
+  const other = { ...f.owner, generation: '00000000-0000-4000-8000-000000000000', pairedAt: new Date(Date.parse(f.owner.pairedAt) + 1000).toISOString() }
+  await assert.rejects(f.scheduler.save({ id: 'stranger', name: 'x', text: '', owner: other, enabled: true, trigger: { at: '2027-01-01T00:00:00Z' }, script: { id: 'guard', args: [] } }, true), /outside this owner binding/)
+})
+
+test('agent registers and schedules a script natively; script runs cannot change scripts or schedules', async t => {
+  const f = await setup(); t.after(() => rm(f.root, { recursive: true, force: true }))
+  const ledger = await serveTestLedger(f.dir); t.after(() => ledger.stop())
+  const execution = await f.control.captureChoice(initialPreset('codex'))
+  const turn = await f.runs.create({ chatId: 101, telegramUserId: 101, texts: ['register it'], execution })
+  await f.runs.patch(turn.id, { status: 'running' })
+  const env = { ...process.env, EZ_CONTROL_DIR: f.dir, EZ_RUN_ID: turn.id, EZ_AGENT_WORKSPACE: f.workspace }
+  const cli = async (...args: string[]) => JSON.parse((await exec(process.execPath, [bin, ...args], { env, cwd: f.workspace })).stdout)
+  const registered = await cli('script', 'register', 'book-freshness', '--file', 'scripts/guard.mjs', '--interpreter', 'node', '--timeout-seconds', '120')
+  assert.equal(registered.interpreter, 'node'); assert.equal(registered.timeoutSeconds, 120)
+  await assert.rejects(cli('create', 'bad', '--script', 'book-freshness', '--model', 'gpt-6-astra', '--now'), /run no model/)
+  await assert.rejects(cli('create', 'bad', '--script', 'unknown', '--now'), /not registered/)
+  const schedule = await cli('create', 'actual-book-freshness-guard', '--script', 'book-freshness', '--arg=--quiet', '--cron', '15 * * * *', '--timezone', 'Asia/Dubai')
+  assert.equal(schedule.executionType, 'script'); assert.deepEqual(schedule.script, { id: 'book-freshness', args: ['--quiet'] })
+  assert.equal(schedule.execution, undefined); assert.equal(schedule.text, '')
+  const shown = await cli('script', 'show', 'book-freshness')
+  assert.equal(shown.matchesRegistration, true); assert.deepEqual(shown.schedules, ['actual-book-freshness-guard'])
+  await assert.rejects(cli('script', 'remove', 'book-freshness'), /used by schedules/)
+  // An existing agent schedule remains readable beside it.
+  const agent = await cli('create', 'daily', '--text', 'Prepare the report', '--model', 'gpt-6-astra', '--at', '2027-09-09T09:00:00+04:00')
+  assert.equal(agent.executionType, 'agent'); assert.equal(agent.execution.preset.model, 'gpt-6-astra')
+
+  const scriptRun = await f.runs.create({ chatId: 101, telegramUserId: 101, texts: ['[schedule]'],
+    script: { id: 'book-freshness', args: [], revision: registered.revision, sha256: registered.sha256 },
+    scheduled: { id: 'actual-book-freshness-guard', revision: schedule.revision, dueAt: new Date().toISOString(), pairedAt: f.owner.pairedAt } })
+  await f.runs.patch(scriptRun.id, { status: 'running' })
+  const asScript = { env: { ...env, EZ_RUN_ID: scriptRun.id }, cwd: f.workspace }
+  for (const args of [['script', 'update', 'book-freshness'], ['script', 'register', 'other', '--file', 'scripts/guard.mjs', '--interpreter', 'node'],
+    ['edit', 'actual-book-freshness-guard', '--script', 'book-freshness', '--now'], ['pause', 'daily'], ['trigger', 'daily', '--key', 'k']])
+    await assert.rejects(exec(process.execPath, [bin, ...args], asScript), /Script runs cannot change scripts or schedules/)
+  assert.equal(JSON.parse((await exec(process.execPath, [bin, 'script', 'show', 'book-freshness'], asScript)).stdout).id, 'book-freshness')
+  // A relative --file resolves from the caller's directory, stored relative to the workspace.
+  const nested = JSON.parse((await exec(process.execPath, [bin, 'script', 'register', 'nested', '--file', 'guard.mjs', '--interpreter', 'node'], { env, cwd: join(f.workspace, 'scripts') })).stdout)
+  assert.equal(nested.entry, join('scripts', 'guard.mjs'))
+})
+
+test('script CLI creates, preserves and explicitly clears preflight gates', async t => {
+ const f=await setup();t.after(()=>rm(f.root,{recursive:true,force:true}))
+ const ledger=await serveTestLedger(f.dir);t.after(()=>ledger.stop())
+ await f.scripts.save({id:'guard',owner:f.owner,workspace:f.workspace,entry:'scripts/guard.mjs',interpreter:'node',args:[],timeoutSeconds:60},true)
+ const preflight={on:'eligible',checks:[{alias:'provider-work',args:[]}]},file=join(f.root,'preflight.json')
+ await writeFile(file,JSON.stringify(preflight))
+ const env={...process.env,EZ_CONTROL_DIR:f.dir,EZ_RUN_ID:'',EZ_AGENT_WORKSPACE:f.workspace}
+ const cli=async(...args:string[])=>JSON.parse((await exec(process.execPath,[bin,...args],{env,cwd:f.workspace})).stdout)
+ const options=['--script','guard','--at','2027-09-09T09:00:00+04:00']
+ const created=await cli('create','gated',...options,'--preflight-file',file)
+ assert.deepEqual(created.preflight,preflight)
+ const edited=await cli('edit','gated',...options,'--name','Renamed')
+ assert.deepEqual(edited.preflight,preflight)
+ const cleared=await cli('edit','gated',...options,'--clear-preflight')
+ assert.equal(cleared.preflight,undefined)
+})
+
+test('script schedules run with zero LLM invocations, exact revision receipts, isolation and fail-safe integrity', async t => {
+  const f = await setup(); t.after(() => rm(f.root, { recursive: true, force: true }))
+  const savedEnv = { PATH: process.env.PATH, TELEGRAM_BOT_TOKEN: process.env.TELEGRAM_BOT_TOKEN, EZ_TEST_SECRET: process.env.EZ_TEST_SECRET }
+  process.env.PATH = `${f.fakeBin}:${process.env.PATH}`; process.env.TELEGRAM_BOT_TOKEN = '123456:secret-token-value-for-tests-only'; process.env.EZ_TEST_SECRET = 'do-not-inherit'
+  t.after(() => { for (const [k, v] of Object.entries(savedEnv)) { if (v === undefined) delete process.env[k]; else process.env[k] = v } })
+  const agentLaunches: ExecutorOptions[] = []
+  const relay = createRelay({ workspace: f.workspace, controlDir: f.dir, pairingTtlMs: 1000, executorTimeoutMs: 0, executorCli: 'codex', telegramBotToken: 'fixture' },
+    async (texts, options) => {
+      if (options.script) return startExecutorJob(texts, options)
+      agentLaunches.push(options)
+      const child = spawn(process.execPath, ['-e', 'setTimeout(()=>{},10)'], { detached: true }); await once(child, 'spawn')
+      return { child, cleanup: async () => {}, stdout: '' }
+    })
+  relay.bot.api.config.use(async () => ({ ok: true, result: { message_id: 42 } }) as never)
+  t.after(() => relay.stop())
+  const registration = await f.scripts.save({ id: 'book-freshness', owner: f.owner, workspace: f.workspace, entry: 'scripts/guard.mjs', interpreter: 'node', args: ['ok'], timeoutSeconds: 60 }, true)
+  const schedule = await f.scheduler.save({ id: 'guard', name: 'Guard', text: '', owner: f.owner, enabled: true, trigger: { cron: '15 * * * *', timezone: 'Asia/Dubai', start: new Date().toISOString() }, script: { id: 'book-freshness', args: ['extra'] } }, true)
+  const finished = (id: string) => until(async () => ['completed', 'failed', 'cancelled'].includes((await f.runs.get(id))?.status ?? ''))
+  const output = async (run: RunRecord) => JSON.parse(await readFile(join(f.workspace, `out-${run.id}.json`), 'utf8'))
+
+  // Manual trigger.
+  const manual = await f.scheduler.trigger(schedule.id, schedule.revision, 'smoke-1', f.owner, f.runs)
+  await relay.drainSources(); await finished(manual.id)
+  const done = (await f.runs.get(manual.id))!
+  assert.equal(done.status, 'completed'); assert.equal(done.exitCode, 0); assert.equal(done.execution, undefined)
+  assert.deepEqual(done.script, { id: 'book-freshness', args: ['extra'], revision: registration.revision, sha256: registration.sha256 })
+  assert.ok(done.startedAt && done.endedAt && done.createdAt <= done.startedAt)
+  assert.match(done.output!, /routine check ok/); assert.match(done.output!, /diagnostic line/); assert.doesNotMatch(done.output!, /abcdefghijklmnopqrstuvwxyz0123456789ABCDEF/)
+  const seen = await output(done)
+  assert.deepEqual(seen.argv, ['ok', 'extra']); assert.deepEqual(seen.leaked, [])
+  assert.equal(seen.env.EZ_RUN_ID, manual.id); assert.equal(seen.env.EZ_SCHEDULE_ID, 'guard'); assert.equal(seen.env.EZ_SCHEDULE_REVISION, schedule.revision)
+  assert.equal(seen.env.EZ_DUE_AT, done.scheduled!.dueAt); assert.equal(seen.env.EZ_SCRIPT_REVISION, registration.revision); assert.equal(seen.env.EZ_SCRIPT_SHA256, registration.sha256)
+  assert.equal((await relay.drainOutbox(), (await f.runs.pendingOutbox()).length), 0)
+
+  // Natural occurrence through the existing tick.
+  const due = await f.scheduler.pendingOccurrence(schedule)
+  await f.scheduler.tick(f.owner, f.runs, due!)
+  const natural = (await f.runs.list()).find(r => r.id !== manual.id && r.scheduled?.id === 'guard')!
+  assert.equal(natural.scheduled!.dueAt, new Date(due!).toISOString())
+  await relay.drainSources(); await finished(natural.id)
+  assert.equal((await f.runs.get(natural.id))?.status, 'completed')
+  await assert.rejects(access(join(f.root, 'llm-invocations')))
+  assert.equal(agentLaunches.length, 0)
+
+  // Changed entry-point bytes refuse to run until an explicit update.
+  await writeFile(join(f.workspace, 'scripts', 'guard.mjs'), fixture + '\n// edited\n')
+  const tampered = await f.scheduler.trigger(schedule.id, schedule.revision, 'tampered', f.owner, f.runs)
+  await relay.drainSources(); await finished(tampered.id)
+  const refused = (await f.runs.get(tampered.id))!
+  assert.equal(refused.status, 'failed'); assert.match(refused.failure!.error, /entry point changed since registration/)
+  await assert.rejects(readFile(join(f.workspace, `out-${tampered.id}.json`)))
+  const updated = await f.scripts.save({ id: 'book-freshness', owner: f.owner, workspace: f.workspace, entry: 'scripts/guard.mjs', interpreter: 'node', args: ['hang'], timeoutSeconds: 60 }, false)
+  assert.notEqual(updated.sha256, registration.sha256)
+
+  // Cancellation stops the script and its children; overlap is refused meanwhile.
+  const long = await f.scheduler.trigger(schedule.id, schedule.revision, 'long', f.owner, f.runs)
+  await relay.drainSources()
+  const childPid = Number(await until(async () => { try { await access(join(f.workspace, `child-${long.id}.pid`)); return true } catch { return false } })
+    .then(() => readFile(join(f.workspace, `child-${long.id}.pid`), 'utf8')))
+  assert.ok(alive(childPid))
+  assert.equal((await f.runs.get(long.id))?.script?.revision, updated.revision)
+  await assert.rejects(f.scheduler.trigger(schedule.id, schedule.revision, 'overlap', f.owner, f.runs), /queued or running/)
+  const before = (await f.runs.list()).length
+  await f.scheduler.tick(f.owner, f.runs, (await f.scheduler.pendingOccurrence(schedule))! + 3600_000)
+  assert.equal((await f.runs.list()).length, before)
+  await f.scheduler.cancel(long.id); await relay.drainSources(); await finished(long.id)
+  assert.equal((await f.runs.get(long.id))?.status, 'cancelled')
+  await until(async () => !alive(childPid))
+
+  // A bounded timeout terminates the process; it is a failure, never retried.
+  await f.scripts.save({ id: 'book-freshness', owner: f.owner, workspace: f.workspace, entry: 'scripts/guard.mjs', interpreter: 'node', args: ['hang'], timeoutSeconds: 1 }, false)
+  const slow = await f.scheduler.trigger(schedule.id, schedule.revision, 'slow', f.owner, f.runs)
+  await relay.drainSources(); await finished(slow.id)
+  const timedOut = (await f.runs.get(slow.id))!
+  assert.equal(timedOut.status, 'failed'); assert.equal(timedOut.failureReason, 'script-timeout'); assert.equal(timedOut.timedOut, true)
+  const slowChild = Number(await readFile(join(f.workspace, `child-${slow.id}.pid`), 'utf8'))
+  await until(async () => !alive(slowChild))
+  await relay.drainSources()
+  assert.equal((await f.runs.list()).filter(r => r.scheduled?.id === 'guard' && r.status === 'queued').length, 0)
+
+  // An existing LLM schedule still launches its native engine settings.
+  const execution = await f.control.captureChoice({ ...initialPreset('codex'), model: 'gpt-6-astra' })
+  const agent = await f.scheduler.save({ id: 'report', name: 'Report', text: 'Prepare the report', owner: f.owner, execution, enabled: true, trigger: { at: '2027-01-01T00:00:00Z' } }, true)
+  const agentRun = await f.scheduler.trigger(agent.id, agent.revision, 'agent', f.owner, f.runs)
+  await relay.drainSources(); await finished(agentRun.id)
+  assert.equal((await f.runs.get(agentRun.id))?.status, 'completed')
+  assert.equal(agentLaunches.length, 1); assert.equal(agentLaunches[0].model, 'gpt-6-astra'); assert.equal(agentLaunches[0].nativeSession, true)
+})

package/test/task-native.test.ts

@@ -1,10 +1,12 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises'
+import { mkdtemp, mkdir, writeFile, rm, readFile } from 'node:fs/promises'
 import { createServer } from 'node:http'
+import {createServer as createNetServer} from 'node:net'
 import { spawn, execFile } from 'node:child_process'
 import { promisify } from 'node:util'
 import { fileURLToPath } from 'node:url'
+import { createHash } from 'node:crypto'
 import { homedir } from 'node:os'
 import { taskArguments, taskModelCatalog, TASK_CODEX_VERSION } from '../src/task-executor.js'
 import { Tasks } from '../src/tasks.js'
@@ -12,33 +14,60 @@ import { ownerRun } from './helpers/owner-run.js'
 import { EventSources } from '../src/event-sources.js'
 import { ControlStore } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
+import {ApplicationBindings} from '../src/application-channel.js'
 import { taskRequests } from '../src/task-rpc.js'
 
 // Real bundled model metadata plus native CLI, synthetic endpoint, no credentials or provider sends.
 // Unknown fixture model names miss model-driven tool overrides.
 // Run explicitly with EZ_TEST_NATIVE_TASKS=1 after installing the audited CLI.
 test('native restricted task has only bounded MCP tools, ignores private guidance, and executes broker calls', { skip: !process.env.EZ_TEST_NATIVE_TASKS, timeout: 30000 }, async () => {
+  assert.equal((await promisify(execFile)('codex',['--version'])).stdout.trim(), `codex-cli ${TASK_CODEX_VERSION}`)
   const root = await mkdtemp('/tmp/ez-native-task-'), directory = `${root}/task`, home = `${root}/home`
   await mkdir(directory); await mkdir(home)
   await writeFile(`${root}/AGENTS.md`, 'PRIVATE_CANARY_DO_NOT_LOAD')
   await writeFile(`${home}/config.toml`, 'invalid = [ syntax')
   const requests: any[] = [], sends: any[] = []
+  const incoming={id:'1',conversationId:'contact-a',receivedAt:Date.now()+1000,text:'shop.txt attached'}
+  const png=Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+ip1sAAAAASUVORK5CYII=','base64')
+  const videoPath = `${root}/fixture.mp4`
+  await promisify(execFile)('ffmpeg',['-v','error','-f','lavfi','-i','color=c=blue:s=64x64:d=1','-c:v','mpeg4',videoPath])
+  const video=await readFile(videoPath)
   const provider = createServer(async (req, res) => {
     let body = ''; for await (const chunk of req) body += chunk
     const { command, args } = JSON.parse(body)
-    res.end(JSON.stringify({ ok: true, data: command === 'events-head' ? { cursor: 0, accountId: 'fixture-account', taskProtocol: 'message-v1' }
+    res.end(JSON.stringify({ ok: true, data: command === 'events-head' ? { cursor: 0, accountId: 'fixture-account', taskProtocol: 'message-v1',taskVoice:true }
+      : command === 'events-check' ? {events:[incoming,{...incoming,id:'2',text:'image.png attached'},{...incoming,id:'3',text:'video.mp4 attached; speech transcript: Shop closes at 6pm.'}]}
+      : command === 'task-document' && args.incomingId === '3' ? {name:'video.mp4',data:video.toString('base64'),sha256:createHash('sha256').update(video).digest('hex')}
+      : command === 'task-document' && args.incomingId === '2' ? {name:'image.png',data:png.toString('base64'),sha256:createHash('sha256').update(png).digest('hex')}
+      : command === 'task-document' ? {name:'shop.txt',data:Buffer.from('Shop opens at 7am.').toString('base64'),sha256:createHash('sha256').update('Shop opens at 7am.').digest('hex')}
       : command === 'task-send' ? (sends.push(args), { ...args, state: 'accepted' }) : {} }))
   })
   await new Promise<void>(r => provider.listen(`${root}/p.sock`, r))
   await ownerRun(root, 'owner')
   await new EventSources(root).register('fixture', `${root}/p.sock`, (await new ControlStore(root, 900000).status()).owner!)
-  const tasks = new Tasks(root), drain = taskRequests(tasks)
+  const tasks = new Tasks(root,async () => ({buffer:Buffer.from('OggSfixture OpusHead'),mimeType:'audio/ogg'})), drain = taskRequests(tasks)
   const proposal: any = await tasks.ownerCall('owner', 'start', { sourceId: 'fixture', conversationId: 'contact-a', purpose: 'Book dinner without payment', context: 'Two people at 7pm', hours: 1 })
   assert.equal(proposal.state, 'active')
-  const runs = new RunStore(root), run = (await runs.list()).find(r => r.taskId)!
+  const runs = new RunStore(root), run = await runs.create({id:'event_document_fixture',taskId:proposal.id,chatId:101,telegramUserId:101,texts:[],external:{sourceId:'fixture',bindingId:(await tasks.get(proposal.id))!.bindingId,eventIds:['1','2','3']}})
   await runs.patch(run.id, { status: 'running' })
+  const bindings=new ApplicationBindings(root), owner=(await new ControlStore(root,900000).status()).owner!
+  await bindings.register('browser','z'.repeat(48),owner)
+  await bindings.taskLaunch('browser',{command:'fixture',args:['launch','--task'],tasks:[proposal.id]})
+  let launchRequests=0
+  const launchSocket=`${root}/launch.sock`
+  const launchBroker=createNetServer(socket=>{
+    let raw='';socket.on('data',chunk=>{raw+=chunk;if(!raw.includes('\n'))return;void(async()=>{
+      const request=JSON.parse(raw.trim()),input=JSON.parse(request.stdin)
+      assert.equal(request.operation,'task-launch');assert.equal(request.runId,run.id)
+      assert.equal(input.taskId,proposal.id)
+      const grant=await tasks.authorizeApplicationLaunch(run.id,createHash('sha256').update(input.taskToken).digest('hex'))
+      assert.equal(grant.launch.command,'fixture');assert.deepEqual(grant.launch.args,['launch','--task'])
+      launchRequests++
+      socket.end(JSON.stringify({version:1,id:request.id,ok:true,code:0,stdout:JSON.stringify({launch:{url:'https://fixture.example/#launch='+ 'e'.repeat(64),expiresAt:Date.now()+300000}})})+'\n')
+    })().catch(error=>socket.end(JSON.stringify({ok:false,error:error.message})+'\n'))})
+  });await new Promise<void>(r=>launchBroker.listen(launchSocket,r))
   const sequence = [
-    ['context', {}], ['send', { text: 'Is a table for two available at 7pm?', key: 'first' }],
+    ['context', {}], ['browser_link',{application:'browser'}], ['read_attachment',{incomingId:'1'}], ['read_attachment',{incomingId:'2'}], ['read_attachment',{incomingId:'3'}], ['send', { text: 'Is a table for two available at 7pm?', key: 'first', voice:true }],
     ['note', { text: 'Awaiting confirmation' }], ['complete', { text: 'Request sent; no booking confirmation received.' }],
     ['send', { text: 'A completed task cannot send', key: 'second' }],
   ]
@@ -61,30 +90,39 @@ test('native restricted task has only bounded MCP tools, ignores private guidanc
   try {
     const entry = new URL('../src/task-mcp.ts', import.meta.url).href
     await writeFile(`${root}/broker.mjs`, `if(process.env.HOME !== ${JSON.stringify(homedir())}) throw Error('Broker lost host CLI configuration'); await import(${JSON.stringify(entry)});`)
-    const broker = [process.execPath, '--import', fileURLToPath(new URL('../node_modules/tsx/dist/loader.mjs', import.meta.url)), `${root}/broker.mjs`, root, run.id]
+    const broker = [process.execPath, '--import', fileURLToPath(new URL('../node_modules/tsx/dist/loader.mjs', import.meta.url)), `${root}/broker.mjs`, root, run.id,'','[]','["browser"]']
     const catalog = await promisify(execFile)('codex', ['debug', 'models', '--bundled'], { maxBuffer: 4 * 1024 * 1024 });
     await writeFile(`${root}/models.json`, JSON.stringify(taskModelCatalog(JSON.parse(catalog.stdout))));
-    const args = taskArguments(directory, broker, JSON.stringify({event:'task_activated',taskId:proposal.id}), undefined, {model:'gpt-6-astra'})
+    const args = taskArguments(directory, broker, JSON.stringify({event:'task_activated',taskId:proposal.id}), ['context','browser_link','read_attachment','send','note','report','complete'], {model:'gpt-6-astra'}, {EZ_PLUGIN_BROKER_SOCKET:launchSocket,EZ_DELIVERY_SOCKET:`${root}/delivery.sock`})
     args.splice(-1, 0, '--disable', 'enable_request_compression', '-c', 'model_provider="fixture"', '-c', `model_providers.fixture={name="fixture",base_url="http://127.0.0.1:${(server.address() as any).port}/v1",wire_api="responses",requires_openai_auth=false}`)
     child = spawn('codex', args, { cwd: directory, env: { PATH: process.env.PATH, HOME: home, CODEX_HOME: home }, stdio: ['pipe', 'pipe', 'pipe'] })
     child.stdin!.end(JSON.stringify({event:'task_activated',taskId:proposal.id}));
     let stderr = ''; child.stderr!.on('data', c => { stderr += c }); child.stdout!.resume()
     const code = await new Promise(r => child!.on('close', r))
     assert.equal(code, 0, `Requires audited Codex ${TASK_CODEX_VERSION}: ${stderr}`)
-    assert.ok(requests.length === 6, 'Native tool call completed a second model turn')
+    assert.equal(launchRequests,1, 'Native MCP uses the installed isolated broker launcher without tools home')
+    assert.ok(requests.length === 10, 'Native tool call completed a second model turn')
     assert.ok(!JSON.stringify(requests).includes('PRIVATE_CANARY_DO_NOT_LOAD'))
+    assert.ok(JSON.stringify(requests).includes('https://fixture.example/#launch='))
+    assert.ok(!JSON.stringify(requests).includes('taskToken'))
     const messages=requests[0].input.filter((v:any)=>v.role==='user')
     assert.ok(messages.some((m:any)=>m.content.some((c:any)=>c.text===JSON.stringify({event:'task_activated',taskId:proposal.id}))))
     const tools = requests[0].tools ?? requests[0].input.find((v: any) => v.type === 'additional_tools')?.tools
     assert.deepEqual(tools.filter((t: any) => t.type === 'function').map((t: any) => t.name).sort(), ['list_mcp_resource_templates', 'list_mcp_resources', 'read_mcp_resource', 'request_user_input'])
     const namespaces = tools.filter((t: any) => t.type === 'namespace')
     assert.equal(namespaces.length, 1); assert.equal(namespaces[0].name, 'mcp__ez')
-    assert.deepEqual(namespaces[0].tools.map((t: any) => t.name).sort(), ['complete', 'context', 'note', 'report', 'send'])
-    assert.match(JSON.stringify(requests[5].input), /inactive or expired/)
-    assert.equal(sends.length, 1); assert.equal(sends[0].conversationId, 'contact-a')
+    assert.deepEqual(namespaces[0].tools.map((t: any) => t.name).sort(), ['browser_link','complete', 'context', 'note', 'read_attachment', 'report', 'send'])
+    assert.match(JSON.stringify(requests.at(-1).input), /inactive or expired/)
+    assert.ok(JSON.stringify(requests).includes('Shop opens at 7am.'))
+    assert.ok(JSON.stringify(requests).includes('data:image/'), 'Native CLI forwards MCP images into vision input: '+JSON.stringify(requests.map(request=>request.input)))
+    assert.ok(JSON.stringify(requests).includes('durationSeconds'), 'Native input includes video frame metadata')
+    assert.ok(JSON.stringify(requests).includes('Shop closes at 6pm.'))
+    const videoTurn=requests[5].input
+    assert.ok(JSON.stringify(videoTurn).includes('data:image/'), 'Native CLI receives sampled video frames as vision input')
+    assert.equal(sends.length, 1);assert.equal(Buffer.from(sends[0].audio.data,'base64').toString(),'OggSfixture OpusHead'); assert.equal(sends[0].conversationId, 'contact-a')
     assert.equal((await tasks.get(proposal.id))!.state, 'completed')
   } finally {
-    child?.kill(); clearInterval(timer); server.closeAllConnections(); await new Promise<void>(r => server.close(() => r()))
+    child?.kill(); clearInterval(timer); await new Promise<void>(r=>launchBroker.close(()=>r())); server.closeAllConnections(); await new Promise<void>(r => server.close(() => r()))
     provider.closeAllConnections(); await new Promise<void>(r => provider.close(() => r()))
     await rm(root, { recursive: true, force: true })
   }