@jc_stack/ez-agents 0.1.0-beta.47 → 0.1.0-beta.49

package/test/private-speech-config.test.ts

@@ -0,0 +1,22 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import {mkdtempSync,writeFileSync,openSync,closeSync,rmSync} from 'node:fs'
+import {spawnSync} from 'node:child_process'
+import {join} from 'node:path'
+import {loadConfig} from '../src/config.js'
+
+test('installed private descriptor admits speech selectors and keeps speech keys out of the executor', () => {
+  const dir=mkdtempSync('/tmp/ez-speech-env-'),file=join(dir,'relay.env'),key='synthetic-private-speech-marker'
+  try {
+    writeFileSync(file,`OPENROUTER_API_KEY=${key}\nEZ_SPEECH_PROVIDER=invalid-private-selector\nEZ_SPEECH_MODEL=fish-audio/s2.1-pro-free:free\n`,{mode:0o600})
+    let fd=openSync(file,'r')
+    const invalid=spawnSync(process.execPath,['--import','tsx','docker/run.ts','start'],{encoding:'utf8',timeout:15000,env:{PATH:process.env.PATH,EZ_APPLICATION_PORT:'8787'},stdio:['ignore','pipe','pipe',fd]});closeSync(fd)
+    assert.equal(invalid.status,1);assert.match(invalid.stderr,/Invalid EZ_SPEECH_PROVIDER/);assert.ok(!invalid.stderr.includes(key))
+    writeFileSync(file,`OPENROUTER_API_KEY=${key}\nEZ_SPEECH_PROVIDER=openrouter\nEZ_SPEECH_MODEL=fish-audio/s2.1-pro-free:free\n`,{mode:0o600})
+    fd=openSync(file,'r')
+    const child=spawnSync(process.execPath,['--import','tsx','docker/run.ts','exec',process.execPath,'-e',"if(process.env.OPENROUTER_API_KEY||process.env.EZ_SPEECH_PROVIDER)process.exit(91);console.log('isolated')"],{encoding:'utf8',timeout:15000,env:{PATH:process.env.PATH},stdio:['ignore','pipe','pipe',fd]});closeSync(fd)
+    assert.equal(child.status,0,child.stderr);assert.equal(child.stdout.trim(),'isolated')
+    const config=loadConfig({EZ_APPLICATION_PORT:'8787',OPENROUTER_API_KEY:key,EZ_SPEECH_PROVIDER:'openrouter',EZ_SPEECH_MODEL:'fish-audio/s2.1-pro-free:free'})
+    assert.equal(config.openrouterApiKey,key);assert.equal(config.speechProvider,'openrouter');assert.equal(config.speechModel,'fish-audio/s2.1-pro-free:free')
+  } finally {rmSync(dir,{recursive:true,force:true})}
+})

package/test/run-evidence.test.ts

@@ -0,0 +1,78 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { createHash } from 'node:crypto'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { ownerRun } from './helpers/owner-run.js'
+import { serveTestLedger } from './helpers/ledger.js'
+import { RunStore } from '../src/runs.js'
+import { ControlStore } from '../src/control-state.js'
+import { runEvidence, projectRunEvidence } from '../src/run-evidence.js'
+
+async function fixture(t: test.TestContext) {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-evidence-'))
+  await ownerRun(dir, 'owner_run')
+  const ledger = await serveTestLedger(dir)
+  t.after(async () => { await ledger.stop(); await rm(dir, { recursive: true, force: true }) })
+  return { dir, runs: new RunStore(dir), owner: (await new ControlStore(dir, 1000).status()).owner! }
+}
+
+test('CLI projects operational proof without sessions, failure prose or delivered text', async t => {
+  const { dir, runs } = await fixture(t)
+  const secret = 'private-session-or-token'
+  await runs.patch('owner_run', { nativeSessionId: secret, failureReason: secret,
+    failure: { error: secret, relayVersion: '0.1.0-beta.47' } })
+  const sent = await runs.enqueueMessage('owner_run', 'private financial report')
+  await runs.claimOutbox(sent.id); await runs.markOutboxSent(sent.id, [7])
+  const uncertain = await runs.enqueueMessage('owner_run', 'uncertain report')
+  await runs.claimOutbox(uncertain.id); await runs.failOutbox(uncertain.id, secret, true)
+  const control = await new ControlStore(dir, 1000).status()
+  const { stdout } = await promisify(execFile)(process.execPath, ['bin/ezenciel-agents-schedule.mjs', 'evidence'], {
+    env: { ...process.env, EZ_CONTROL_DIR: dir, EZ_RUN_ID: 'owner_run' },
+  })
+  const result = JSON.parse(stdout)
+  assert.equal(result.runs.length, 1)
+  assert.ok(!stdout.includes(secret) && !stdout.includes('private financial report') && !stdout.includes('uncertain report'))
+  const receipts = result.runs[0].deliveries
+  assert.equal(receipts.find((r: any) => r.id === sent.id).receiptVerified, true)
+  assert.equal(receipts.find((r: any) => r.id === sent.id).content.sha256, createHash('sha256').update('private financial report').digest('hex'))
+  assert.equal(receipts.find((r: any) => r.id === uncertain.id).state, 'unknown')
+  assert.equal(receipts.find((r: any) => r.id === uncertain.id).receiptVerified, false)
+  assert.equal(result.runs[0].toolDelegationMetadata.state, 'unavailable')
+  assert.deepEqual(await new ControlStore(dir, 1000).status(), control)
+})
+
+test('pages require an unchanged snapshot and exact identity', async t => {
+  const { dir, runs } = await fixture(t)
+  await ownerRun(dir, 'second_run')
+  const first = await runEvidence(dir, { limit: 1 })
+  assert.equal(first.coverage.total, 2)
+  assert.equal(first.coverage.nextOffset, 1)
+  const second = await runEvidence(dir, { limit: 1, offset: 1, expected: first.snapshotSha256 })
+  assert.equal(second.coverage.nextOffset, null)
+  assert.notEqual(second.runs[0].id, first.runs[0].id)
+  await assert.rejects(runEvidence(dir, { offset: 1 }), /requires/)
+  await runs.patch('second_run', { status: 'completed' })
+  await assert.rejects(runEvidence(dir, { offset: 1, expected: first.snapshotSha256 }), /changed/)
+  await assert.rejects(runEvidence(dir, { runId: '../owner_run' }), /identifier/)
+  for (const options of [{ limit: 101 }, { offset: -1 }, { offset: 0.5 }, { expected: 'bad' }])
+    await assert.rejects(runEvidence(dir, options))
+})
+
+test('revoked owners, restricted callers and unrelated bindings are excluded', async t => {
+  const { dir, runs, owner } = await fixture(t)
+  const stranger = await runs.create({ id: 'other_owner', chatId: 202, telegramUserId: 202, texts: ['secret'] })
+  const external = await ownerRun(dir, 'external', { sourceId: 'test', bindingId: 'binding', eventIds: ['1'] })
+  const old = { ...(await runs.get('owner_run'))!, id: 'old_run', scheduled: { id: 'schedule', revision: 'rev', dueAt: '2026-01-01T00:00:00Z', pairedAt: 'old-pairing' } }
+  const app = { ...(await runs.get('owner_run'))!, id: 'app_run', delivery: { bindingId: 'private', scope: 'private' } }
+  assert.deepEqual(projectRunEvidence([stranger, external, old, app], [], owner), [])
+  await assert.rejects(runEvidence(dir, { callerRunId: 'external' }), /blocked/)
+  await runs.patch('owner_run', { replyOnly: true })
+  await assert.rejects(runEvidence(dir, { callerRunId: 'owner_run' }), /Telegram owner/)
+  await assert.rejects(runEvidence(dir, { runId: 'other_owner' }), /Unknown/)
+  await new ControlStore(dir, 1000).revokeOwner()
+  await assert.rejects(runEvidence(dir), /No authorized owner/)
+})

package/test/schedule-preflight.test.ts

@@ -0,0 +1,49 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import {mkdtemp,rm,readFile} from 'node:fs/promises'
+import {join} from 'node:path'
+import {tmpdir} from 'node:os'
+import {randomUUID} from 'node:crypto'
+import {Scheduler} from '../src/scheduler.js'
+import {RunStore} from '../src/runs.js'
+import {validPreflight,combinePreflight} from '../src/schedule-preflight.js'
+const packet=(eligible:boolean,fingerprint='a'.repeat(64))=>({eligible,fingerprint,count:eligible?1:0,observedAt:new Date().toISOString()})
+test('preflight skips empty/unchanged work, admits saved worker once, and fails closed',async t=>{
+ const dir=await mkdtemp(join(tmpdir(),'schedule-preflight-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ let result=packet(false),failed=false
+ const scheduler=new Scheduler(dir,async()=>{if(failed)throw Error('Provider unavailable');return result}),runs=new RunStore(dir)
+ const owner={telegramUserId:42,telegramChatId:42,pairedAt:new Date().toISOString()},start=Date.now()+10000
+ const input={id:'preflight',name:'Check',text:'Do role work',enabled:true,owner,execution:{sessionId:randomUUID(),preset:{id:'test',name:'test',cli:'codex',model:'fixture-model'}},trigger:{everySeconds:60,start:new Date(start).toISOString()},preflight:{on:'changed' as const,checks:[{alias:'provider-work',args:['--field','Role=RoleX']}]}}
+ const s=await scheduler.save(input)
+ await scheduler.tick(owner,runs,start);assert.equal((await runs.list()).length,0)
+ result=packet(true,'b'.repeat(64));await scheduler.tick(owner,runs,start+60000)
+ const [run]=await runs.list();assert.deepEqual(run.execution,s.execution)
+ await scheduler.tick(owner,runs,start+120000);assert.equal((await runs.list()).length,1)
+ await runs.patch(run.id,{status:'completed'});await scheduler.tick(owner,runs,start+180000);assert.equal((await runs.list()).length,1)
+ failed=true;await scheduler.tick(owner,runs,start+240000);assert.equal((await runs.list()).length,1);assert.equal((await scheduler.preflightReceipt(s)).state,'unavailable')
+ failed=false;result=packet(false);await assert.rejects(()=>scheduler.trigger(s.id,s.revision,'empty',owner,runs),/no eligible/)
+ result=packet(true,'c'.repeat(64));await scheduler.tick(owner,runs,start+300000);assert.equal((await runs.list()).length,2)
+})
+test('only bounded literal commands and fresh typed packets enter admission',()=>{
+ assert.equal(validPreflight({on:'eligible',checks:[{alias:'queue',args:['x']}] }),true)
+ assert.equal(validPreflight({on:'eligible',checks:[{alias:'queue',args:['x\nwrite']}] }),false)
+ assert.throws(()=>combinePreflight([{schemaVersion:1,...packet(true),eligible:'true'}]),/Invalid/)
+ assert.throws(()=>combinePreflight([{schemaVersion:1,...packet(true),observedAt:'2000-01-01T00:00:00Z'}]),/stale/)
+ assert.equal(combinePreflight([{schemaVersion:1,...packet(false)},{schemaVersion:1,...packet(true)}]).eligible,true)
+})
+
+test('manual preflight before the first tick preserves future recurrence',async t=>{
+ const dir=await mkdtemp(join(tmpdir(),'schedule-preflight-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ const scheduler=new Scheduler(dir,async()=>packet(true)),runs=new RunStore(dir)
+ const owner={telegramUserId:42,telegramChatId:42,pairedAt:new Date().toISOString()}
+ const s=await scheduler.save({id:'manual',name:'Manual',text:'Work',enabled:true,owner,
+  execution:{sessionId:randomUUID(),preset:{id:'test',name:'test',cli:'codex',model:'fixture-model'}},
+  trigger:{everySeconds:60,start:new Date(Date.now()+60000).toISOString()},
+  preflight:{on:'eligible',checks:[{alias:'provider-work',args:[]}]}})
+ const next=await scheduler.pendingOccurrence(s)
+ const manual=await scheduler.trigger(s.id,s.revision,'first',owner,runs)
+ assert.equal(await scheduler.pendingOccurrence(s),next)
+ await runs.patch(manual.id,{status:'completed'})
+ await scheduler.tick(owner,runs,next!)
+ assert.equal((await runs.list()).length,2)
+})

package/test/scheduler-host.test.ts

@@ -42,6 +42,10 @@ test('host transport keeps chat responsive beside a schedule in the bound mind',
   await runs.patch(id,{status:'running'})
   await submit(id)
   await until(async()=>Boolean(await exists(id+'.process.json')))
+  const parallel='r_schedule_parallel'
+  await runs.create({id:parallel,chatId:101,telegramUserId:101,texts:['parallel'],execution:{sessionId:randomUUID(),preset:{id:'fixture',name:'Fixture',cli:'grok',model:'fixture-model'}},scheduled:{id:'parallel',revision:'v',dueAt:new Date().toISOString(),pairedAt:'paired'}})
+  await runs.patch(parallel,{status:'running'});await submit(parallel)
+  await until(async()=>Boolean(await exists(parallel+'.process.json')))
   await submit('tg_1')
   await until(async()=>(await exists('tg_1.events')).includes('"stream":"exit","code":0'))
   assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
@@ -60,6 +64,9 @@ test('host transport keeps chat responsive beside a schedule in the bound mind',
   assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
   await writeFile(join(dir,id+'.cancel'),'')
   await until(async()=>(await exists(id+'.events')).includes('"stream":"exit"'))
+  assert.ok(!(await exists(parallel+'.events')).includes('"stream":"exit"'))
+  await writeFile(join(dir,parallel+'.cancel'),'')
+  await until(async()=>(await exists(parallel+'.events')).includes('"stream":"exit"'))
   await until(async()=>(await exists('tg_1.events')).includes('"stream":"exit","code":0'))
   await until(async()=>(await exists('tg_2.events')).includes('"stream":"exit","code":0'))
   const main=JSON.parse(stdout(await exists('tg_1.events')))

package/test/scheduler-relay.test.ts

@@ -32,7 +32,7 @@ test('executor admission rejects a legacy queued schedule with no model before s
    scheduled:{id:saved.id,revision:saved.revision,dueAt:new Date(due).toISOString(),pairedAt:owner.pairedAt}})
   await relay.drainSources()
   assert.equal((await runs.get(run.id))?.status,'failed');assert.equal(launches,0)
-  assert.equal((await scheduler.get(saved.id)).execution.preset.model,'saved-model')
+  assert.equal((await scheduler.get(saved.id)).execution!.preset.model,'saved-model')
  }finally{await relay.stop();await rm(dir,{recursive:true,force:true})}
 })
 
@@ -89,10 +89,10 @@ test('a wrapper-shaped run id has no maintenance treatment and a stale notice is
  }finally{await relay.stop();await rm(dir,{recursive:true,force:true})}
 })
 
-test('Slack application replies beside a schedule and keeps both streams serial',async()=>{
+test('Slack application replies beside schedules configured to stay serial',async()=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-slack-scheduled-')),runs=new RunStore(dir),scheduler=new Scheduler(dir),control=new ControlStore(dir,1000)
  const children=new Map<string,ReturnType<typeof spawn>>()
- const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture'},async(_texts,options)=>{
+ const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture',scheduledConcurrency:1},async(_texts,options)=>{
   const child=spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:process.platform!=='win32'})
   children.set(options.runId,child);await once(child,'spawn')
   if(!options.runId.startsWith('r_schedule_'))await runs.enqueueMessage(options.runId,'Slack reply')
@@ -176,3 +176,38 @@ test('owner chat replies while a scheduled CLI keeps running; targeted cancellat
   await rm(dir,{recursive:true,force:true})
  }
 })
+
+for(const limit of [undefined,2])test(`scheduled admission bounds independent native jobs at ${limit ?? 6} and releases a cancelled slot`,async()=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-parallel-schedules-')),control=new ControlStore(dir,1000),runs=new RunStore(dir),scheduler=new Scheduler(dir)
+ const children=new Map<string,ReturnType<typeof spawn>>(),optionsSeen:ExecutorOptions[]=[]
+ const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture',scheduledConcurrency:limit},async(_texts,options)=>{
+  optionsSeen.push(options)
+  const child=spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:process.platform!=='win32'})
+  children.set(options.runId,child);await once(child,'spawn');return {child,cleanup:async()=>{},stdout:''}
+ })
+ try{
+  await control.requestPairing(101,101);await control.approveOwner(101)
+  const owner=(await control.status()).owner!,execution=await control.captureChoice({...initialPreset('grok'),model:'saved-model',effort:'medium'})
+  const jobs: Awaited<ReturnType<Scheduler['trigger']>>[]=[]
+  for(let n=0;n<(limit ?? 6)+1;n++){
+   const saved=await scheduler.save({id:`job${n}`,name:`Job${n}`,text:'Finite test',owner,execution,enabled:true,trigger:{at:'2027-01-01T00:00:00Z'}},true)
+   jobs.push(await scheduler.trigger(saved.id,saved.revision,`key${n}`,owner,runs))
+  }
+  await Promise.all([relay.drainSources(),relay.drainSources()])
+  assert.equal((await runs.list()).filter(r=>r.status==='running').length,limit ?? 6)
+  assert.equal((await runs.get(jobs.at(-1)!.id))?.status,'queued')
+  assert.equal(new Set(optionsSeen.map(o=>o.sessionId)).size,limit ?? 6)
+  for(const options of optionsSeen){assert.equal(options.model,'saved-model');assert.equal(options.effort,'medium');assert.equal(options.nativeSession,true);assert.equal(options.isResume,false)}
+  const foreground=await runs.create({id:'tg_parallel_chat',chatId:101,telegramUserId:101,texts:['Owner chat'],execution})
+  await relay.drainSources();assert.equal((await runs.get(foreground.id))?.status,'running')
+  assert.equal(children.size,(limit ?? 6)+1)
+  await scheduler.cancel(jobs[0].id);await relay.drainSources()
+  await until(async()=> (await runs.get(jobs[0].id))?.status==='cancelled')
+  await relay.drainSources();assert.equal((await runs.get(jobs.at(-1)!.id))?.status,'running')
+  for(const job of jobs.slice(1))assert.equal((await runs.get(job.id))?.status,'running')
+ }finally{
+  await relay.stop()
+  await until(async()=>!(await runs.list()).some(r=>r.status==='running'))
+  await rm(dir,{recursive:true,force:true})
+ }
+})

package/test/scheduler.test.ts

@@ -167,7 +167,7 @@ test('missing models cannot be saved, dispatched or triggered; legacy settings r
  const file=join(f.dir,'schedules/test.json')
  await writeFile(file,JSON.stringify({...saved,execution:missing.execution}))
  const legacy=await f.scheduler.get(saved.id)
- assert.equal(legacy.execution.preset.model,undefined)
+ assert.equal(legacy.execution!.preset.model,undefined)
  await f.scheduler.tick(f.owner,f.runs,f.now)
  assert.equal((await f.runs.list()).length,0)
  assert.equal(await f.scheduler.pendingOccurrence(legacy),next,'blocked dispatch must preserve the pending occurrence')

package/test/script-schedules.test.ts

@@ -0,0 +1,219 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { execFile, spawn } from 'node:child_process'
+import { promisify } from 'node:util'
+import { once } from 'node:events'
+import { chmod, mkdir, mkdtemp, readFile, rm, symlink, writeFile, access } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { fileURLToPath } from 'node:url'
+import { createRelay } from '../src/index.js'
+import { ControlStore } from '../src/control-state.js'
+import { RunStore, type RunRecord } from '../src/runs.js'
+import { Scheduler } from '../src/scheduler.js'
+import { Scripts } from '../src/scripts.js'
+import { initialPreset } from '../src/ai.js'
+import { startExecutorJob, type ExecutorOptions } from '../src/executor.js'
+import { serveTestLedger } from './helpers/ledger.js'
+
+const exec = promisify(execFile), bin = fileURLToPath(new URL('../bin/ezenciel-agents-schedule.mjs', import.meta.url))
+const until = async (check: () => Promise<boolean>, tries = 400) => { for (let i = 0; i < tries; i++) { if (await check()) return; await new Promise(r => setTimeout(r, 25)) } throw new Error('Timed out') }
+const alive = (pid: number) => { try { process.kill(pid, 0); return true } catch { return false } }
+
+// The script records only what it was given; it never prints secrets.
+const fixture = `import { writeFileSync } from 'node:fs'
+import { spawn } from 'node:child_process'
+const mode = process.argv[2]
+const env = Object.fromEntries(Object.entries(process.env).filter(([k]) => k.startsWith('EZ_')))
+writeFileSync('out-' + process.env.EZ_RUN_ID + '.json', JSON.stringify({ argv: process.argv.slice(2), env,
+  leaked: ['TELEGRAM_BOT_TOKEN', 'EZ_TEST_SECRET', 'OPENAI_API_KEY'].filter(k => process.env[k] !== undefined) }))
+console.log('routine check ok token=abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOP')
+console.error('diagnostic line')
+if (mode === 'hang') {
+  const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' })
+  writeFileSync('child-' + process.env.EZ_RUN_ID + '.pid', String(child.pid))
+  setInterval(() => {}, 1000)
+}
+if (mode === 'fail') process.exit(3)
+`
+
+const setup = async () => {
+  const root = await mkdtemp(join(tmpdir(), 'ez-script-schedules-'))
+  const dir = join(root, 'control'), workspace = join(root, 'workspace'), fakeBin = join(root, 'bin')
+  await Promise.all([mkdir(dir), mkdir(join(workspace, 'scripts'), { recursive: true }), mkdir(fakeBin)])
+  await writeFile(join(workspace, 'scripts', 'guard.mjs'), fixture)
+  // Any native engine launch would leave this marker: script runs must not start one.
+  for (const engine of ['codex', 'claude', 'grok']) {
+    await writeFile(join(fakeBin, engine), `#!/bin/sh\necho "$0" >> ${JSON.stringify(join(root, 'llm-invocations'))}\n`)
+    await chmod(join(fakeBin, engine), 0o755)
+  }
+  const control = new ControlStore(dir, 1000)
+  await control.requestPairing(101, 101); await control.approveOwner(101)
+  const owner = (await control.status()).owner!
+  return { root, dir, workspace, fakeBin, control, owner, runs: new RunStore(dir), scheduler: new Scheduler(dir), scripts: new Scripts(dir) }
+}
+
+test('script registration confines the entry point, rejects shell strings and records the entry hash', async t => {
+  const f = await setup(); t.after(() => rm(f.root, { recursive: true, force: true }))
+  const base = { id: 'guard', owner: f.owner, workspace: f.workspace, interpreter: 'node', args: [], timeoutSeconds: 60 }
+  const saved = await f.scripts.save({ ...base, entry: 'scripts/guard.mjs' }, true)
+  assert.equal(saved.entry, join('scripts', 'guard.mjs')); assert.match(saved.sha256, /^[a-f0-9]{64}$/)
+  await assert.rejects(f.scripts.save({ ...base, entry: 'scripts/guard.mjs' }, true), /already registered/)
+  await writeFile(join(f.root, 'outside.mjs'), 'process.exit(0)')
+  await assert.rejects(f.scripts.save({ ...base, id: 'escape', entry: '../outside.mjs' }, true), /inside the agent workspace/)
+  await symlink(join(f.root, 'outside.mjs'), join(f.workspace, 'link.mjs'))
+  await assert.rejects(f.scripts.save({ ...base, id: 'escape', entry: 'link.mjs' }, true), /inside the agent workspace/)
+  await assert.rejects(f.scripts.save({ ...base, id: 'shell', entry: 'scripts/guard.mjs', interpreter: 'node -e "x"' }, true), /not a shell command/)
+  await assert.rejects(f.scripts.save({ ...base, id: 'shell', entry: 'scripts/guard.mjs', interpreter: 'sh;rm' }, true), /not a shell command/)
+  await assert.rejects(f.scripts.save({ ...base, id: 'missing', entry: 'scripts/guard.mjs', interpreter: 'no-such-interpreter-ez' }, true), /not installed/)
+  await assert.rejects(f.scripts.save({ ...base, id: 'Bad ID', entry: 'scripts/guard.mjs' }, true), /Script ID/)
+  // An interpreter inside the workspace would be unhashed code.
+  await writeFile(join(f.workspace, 'run.sh'), '#!/bin/sh\n'); await chmod(join(f.workspace, 'run.sh'), 0o755)
+  await assert.rejects(f.scripts.save({ ...base, id: 'local', entry: 'scripts/guard.mjs', interpreter: join(f.workspace, 'run.sh') }, true), /outside the agent workspace/)
+  await assert.rejects(f.scripts.save({ ...base, id: 'local', entry: 'scripts/guard.mjs', interpreter: 'run.sh', pathValue: '.' }, true), /not installed/)
+  // Another owner's registration cannot be scheduled.
+  const other = { ...f.owner, generation: '00000000-0000-4000-8000-000000000000', pairedAt: new Date(Date.parse(f.owner.pairedAt) + 1000).toISOString() }
+  await assert.rejects(f.scheduler.save({ id: 'stranger', name: 'x', text: '', owner: other, enabled: true, trigger: { at: '2027-01-01T00:00:00Z' }, script: { id: 'guard', args: [] } }, true), /outside this owner binding/)
+})
+
+test('agent registers and schedules a script natively; script runs cannot change scripts or schedules', async t => {
+  const f = await setup(); t.after(() => rm(f.root, { recursive: true, force: true }))
+  const ledger = await serveTestLedger(f.dir); t.after(() => ledger.stop())
+  const execution = await f.control.captureChoice(initialPreset('codex'))
+  const turn = await f.runs.create({ chatId: 101, telegramUserId: 101, texts: ['register it'], execution })
+  await f.runs.patch(turn.id, { status: 'running' })
+  const env = { ...process.env, EZ_CONTROL_DIR: f.dir, EZ_RUN_ID: turn.id, EZ_AGENT_WORKSPACE: f.workspace }
+  const cli = async (...args: string[]) => JSON.parse((await exec(process.execPath, [bin, ...args], { env, cwd: f.workspace })).stdout)
+  const registered = await cli('script', 'register', 'book-freshness', '--file', 'scripts/guard.mjs', '--interpreter', 'node', '--timeout-seconds', '120')
+  assert.equal(registered.interpreter, 'node'); assert.equal(registered.timeoutSeconds, 120)
+  await assert.rejects(cli('create', 'bad', '--script', 'book-freshness', '--model', 'gpt-6-astra', '--now'), /run no model/)
+  await assert.rejects(cli('create', 'bad', '--script', 'unknown', '--now'), /not registered/)
+  const schedule = await cli('create', 'actual-book-freshness-guard', '--script', 'book-freshness', '--arg=--quiet', '--cron', '15 * * * *', '--timezone', 'Asia/Dubai')
+  assert.equal(schedule.executionType, 'script'); assert.deepEqual(schedule.script, { id: 'book-freshness', args: ['--quiet'] })
+  assert.equal(schedule.execution, undefined); assert.equal(schedule.text, '')
+  const shown = await cli('script', 'show', 'book-freshness')
+  assert.equal(shown.matchesRegistration, true); assert.deepEqual(shown.schedules, ['actual-book-freshness-guard'])
+  await assert.rejects(cli('script', 'remove', 'book-freshness'), /used by schedules/)
+  // An existing agent schedule remains readable beside it.
+  const agent = await cli('create', 'daily', '--text', 'Prepare the report', '--model', 'gpt-6-astra', '--at', '2027-09-09T09:00:00+04:00')
+  assert.equal(agent.executionType, 'agent'); assert.equal(agent.execution.preset.model, 'gpt-6-astra')
+
+  const scriptRun = await f.runs.create({ chatId: 101, telegramUserId: 101, texts: ['[schedule]'],
+    script: { id: 'book-freshness', args: [], revision: registered.revision, sha256: registered.sha256 },
+    scheduled: { id: 'actual-book-freshness-guard', revision: schedule.revision, dueAt: new Date().toISOString(), pairedAt: f.owner.pairedAt } })
+  await f.runs.patch(scriptRun.id, { status: 'running' })
+  const asScript = { env: { ...env, EZ_RUN_ID: scriptRun.id }, cwd: f.workspace }
+  for (const args of [['script', 'update', 'book-freshness'], ['script', 'register', 'other', '--file', 'scripts/guard.mjs', '--interpreter', 'node'],
+    ['edit', 'actual-book-freshness-guard', '--script', 'book-freshness', '--now'], ['pause', 'daily'], ['trigger', 'daily', '--key', 'k']])
+    await assert.rejects(exec(process.execPath, [bin, ...args], asScript), /Script runs cannot change scripts or schedules/)
+  assert.equal(JSON.parse((await exec(process.execPath, [bin, 'script', 'show', 'book-freshness'], asScript)).stdout).id, 'book-freshness')
+  // A relative --file resolves from the caller's directory, stored relative to the workspace.
+  const nested = JSON.parse((await exec(process.execPath, [bin, 'script', 'register', 'nested', '--file', 'guard.mjs', '--interpreter', 'node'], { env, cwd: join(f.workspace, 'scripts') })).stdout)
+  assert.equal(nested.entry, join('scripts', 'guard.mjs'))
+})
+
+test('script CLI creates, preserves and explicitly clears preflight gates', async t => {
+ const f=await setup();t.after(()=>rm(f.root,{recursive:true,force:true}))
+ const ledger=await serveTestLedger(f.dir);t.after(()=>ledger.stop())
+ await f.scripts.save({id:'guard',owner:f.owner,workspace:f.workspace,entry:'scripts/guard.mjs',interpreter:'node',args:[],timeoutSeconds:60},true)
+ const preflight={on:'eligible',checks:[{alias:'provider-work',args:[]}]},file=join(f.root,'preflight.json')
+ await writeFile(file,JSON.stringify(preflight))
+ const env={...process.env,EZ_CONTROL_DIR:f.dir,EZ_RUN_ID:'',EZ_AGENT_WORKSPACE:f.workspace}
+ const cli=async(...args:string[])=>JSON.parse((await exec(process.execPath,[bin,...args],{env,cwd:f.workspace})).stdout)
+ const options=['--script','guard','--at','2027-09-09T09:00:00+04:00']
+ const created=await cli('create','gated',...options,'--preflight-file',file)
+ assert.deepEqual(created.preflight,preflight)
+ const edited=await cli('edit','gated',...options,'--name','Renamed')
+ assert.deepEqual(edited.preflight,preflight)
+ const cleared=await cli('edit','gated',...options,'--clear-preflight')
+ assert.equal(cleared.preflight,undefined)
+})
+
+test('script schedules run with zero LLM invocations, exact revision receipts, isolation and fail-safe integrity', async t => {
+  const f = await setup(); t.after(() => rm(f.root, { recursive: true, force: true }))
+  const savedEnv = { PATH: process.env.PATH, TELEGRAM_BOT_TOKEN: process.env.TELEGRAM_BOT_TOKEN, EZ_TEST_SECRET: process.env.EZ_TEST_SECRET }
+  process.env.PATH = `${f.fakeBin}:${process.env.PATH}`; process.env.TELEGRAM_BOT_TOKEN = '123456:secret-token-value-for-tests-only'; process.env.EZ_TEST_SECRET = 'do-not-inherit'
+  t.after(() => { for (const [k, v] of Object.entries(savedEnv)) { if (v === undefined) delete process.env[k]; else process.env[k] = v } })
+  const agentLaunches: ExecutorOptions[] = []
+  const relay = createRelay({ workspace: f.workspace, controlDir: f.dir, pairingTtlMs: 1000, executorTimeoutMs: 0, executorCli: 'codex', telegramBotToken: 'fixture' },
+    async (texts, options) => {
+      if (options.script) return startExecutorJob(texts, options)
+      agentLaunches.push(options)
+      const child = spawn(process.execPath, ['-e', 'setTimeout(()=>{},10)'], { detached: true }); await once(child, 'spawn')
+      return { child, cleanup: async () => {}, stdout: '' }
+    })
+  relay.bot.api.config.use(async () => ({ ok: true, result: { message_id: 42 } }) as never)
+  t.after(() => relay.stop())
+  const registration = await f.scripts.save({ id: 'book-freshness', owner: f.owner, workspace: f.workspace, entry: 'scripts/guard.mjs', interpreter: 'node', args: ['ok'], timeoutSeconds: 60 }, true)
+  const schedule = await f.scheduler.save({ id: 'guard', name: 'Guard', text: '', owner: f.owner, enabled: true, trigger: { cron: '15 * * * *', timezone: 'Asia/Dubai', start: new Date().toISOString() }, script: { id: 'book-freshness', args: ['extra'] } }, true)
+  const finished = (id: string) => until(async () => ['completed', 'failed', 'cancelled'].includes((await f.runs.get(id))?.status ?? ''))
+  const output = async (run: RunRecord) => JSON.parse(await readFile(join(f.workspace, `out-${run.id}.json`), 'utf8'))
+
+  // Manual trigger.
+  const manual = await f.scheduler.trigger(schedule.id, schedule.revision, 'smoke-1', f.owner, f.runs)
+  await relay.drainSources(); await finished(manual.id)
+  const done = (await f.runs.get(manual.id))!
+  assert.equal(done.status, 'completed'); assert.equal(done.exitCode, 0); assert.equal(done.execution, undefined)
+  assert.deepEqual(done.script, { id: 'book-freshness', args: ['extra'], revision: registration.revision, sha256: registration.sha256 })
+  assert.ok(done.startedAt && done.endedAt && done.createdAt <= done.startedAt)
+  assert.match(done.output!, /routine check ok/); assert.match(done.output!, /diagnostic line/); assert.doesNotMatch(done.output!, /abcdefghijklmnopqrstuvwxyz0123456789ABCDEF/)
+  const seen = await output(done)
+  assert.deepEqual(seen.argv, ['ok', 'extra']); assert.deepEqual(seen.leaked, [])
+  assert.equal(seen.env.EZ_RUN_ID, manual.id); assert.equal(seen.env.EZ_SCHEDULE_ID, 'guard'); assert.equal(seen.env.EZ_SCHEDULE_REVISION, schedule.revision)
+  assert.equal(seen.env.EZ_DUE_AT, done.scheduled!.dueAt); assert.equal(seen.env.EZ_SCRIPT_REVISION, registration.revision); assert.equal(seen.env.EZ_SCRIPT_SHA256, registration.sha256)
+  assert.equal((await relay.drainOutbox(), (await f.runs.pendingOutbox()).length), 0)
+
+  // Natural occurrence through the existing tick.
+  const due = await f.scheduler.pendingOccurrence(schedule)
+  await f.scheduler.tick(f.owner, f.runs, due!)
+  const natural = (await f.runs.list()).find(r => r.id !== manual.id && r.scheduled?.id === 'guard')!
+  assert.equal(natural.scheduled!.dueAt, new Date(due!).toISOString())
+  await relay.drainSources(); await finished(natural.id)
+  assert.equal((await f.runs.get(natural.id))?.status, 'completed')
+  await assert.rejects(access(join(f.root, 'llm-invocations')))
+  assert.equal(agentLaunches.length, 0)
+
+  // Changed entry-point bytes refuse to run until an explicit update.
+  await writeFile(join(f.workspace, 'scripts', 'guard.mjs'), fixture + '\n// edited\n')
+  const tampered = await f.scheduler.trigger(schedule.id, schedule.revision, 'tampered', f.owner, f.runs)
+  await relay.drainSources(); await finished(tampered.id)
+  const refused = (await f.runs.get(tampered.id))!
+  assert.equal(refused.status, 'failed'); assert.match(refused.failure!.error, /entry point changed since registration/)
+  await assert.rejects(readFile(join(f.workspace, `out-${tampered.id}.json`)))
+  const updated = await f.scripts.save({ id: 'book-freshness', owner: f.owner, workspace: f.workspace, entry: 'scripts/guard.mjs', interpreter: 'node', args: ['hang'], timeoutSeconds: 60 }, false)
+  assert.notEqual(updated.sha256, registration.sha256)
+
+  // Cancellation stops the script and its children; overlap is refused meanwhile.
+  const long = await f.scheduler.trigger(schedule.id, schedule.revision, 'long', f.owner, f.runs)
+  await relay.drainSources()
+  const childPid = Number(await until(async () => { try { await access(join(f.workspace, `child-${long.id}.pid`)); return true } catch { return false } })
+    .then(() => readFile(join(f.workspace, `child-${long.id}.pid`), 'utf8')))
+  assert.ok(alive(childPid))
+  assert.equal((await f.runs.get(long.id))?.script?.revision, updated.revision)
+  await assert.rejects(f.scheduler.trigger(schedule.id, schedule.revision, 'overlap', f.owner, f.runs), /queued or running/)
+  const before = (await f.runs.list()).length
+  await f.scheduler.tick(f.owner, f.runs, (await f.scheduler.pendingOccurrence(schedule))! + 3600_000)
+  assert.equal((await f.runs.list()).length, before)
+  await f.scheduler.cancel(long.id); await relay.drainSources(); await finished(long.id)
+  assert.equal((await f.runs.get(long.id))?.status, 'cancelled')
+  await until(async () => !alive(childPid))
+
+  // A bounded timeout terminates the process; it is a failure, never retried.
+  await f.scripts.save({ id: 'book-freshness', owner: f.owner, workspace: f.workspace, entry: 'scripts/guard.mjs', interpreter: 'node', args: ['hang'], timeoutSeconds: 1 }, false)
+  const slow = await f.scheduler.trigger(schedule.id, schedule.revision, 'slow', f.owner, f.runs)
+  await relay.drainSources(); await finished(slow.id)
+  const timedOut = (await f.runs.get(slow.id))!
+  assert.equal(timedOut.status, 'failed'); assert.equal(timedOut.failureReason, 'script-timeout'); assert.equal(timedOut.timedOut, true)
+  const slowChild = Number(await readFile(join(f.workspace, `child-${slow.id}.pid`), 'utf8'))
+  await until(async () => !alive(slowChild))
+  await relay.drainSources()
+  assert.equal((await f.runs.list()).filter(r => r.scheduled?.id === 'guard' && r.status === 'queued').length, 0)
+
+  // An existing LLM schedule still launches its native engine settings.
+  const execution = await f.control.captureChoice({ ...initialPreset('codex'), model: 'gpt-6-astra' })
+  const agent = await f.scheduler.save({ id: 'report', name: 'Report', text: 'Prepare the report', owner: f.owner, execution, enabled: true, trigger: { at: '2027-01-01T00:00:00Z' } }, true)
+  const agentRun = await f.scheduler.trigger(agent.id, agent.revision, 'agent', f.owner, f.runs)
+  await relay.drainSources(); await finished(agentRun.id)
+  assert.equal((await f.runs.get(agentRun.id))?.status, 'completed')
+  assert.equal(agentLaunches.length, 1); assert.equal(agentLaunches[0].model, 'gpt-6-astra'); assert.equal(agentLaunches[0].nativeSession, true)
+})