@jc_stack/ez-agents 0.1.0-beta.47 → 0.1.0-beta.49

package/test/setup-fallback.test.ts

@@ -0,0 +1,245 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { spawn } from 'node:child_process'
+import { once } from 'node:events'
+import { createRelay } from '../src/index.js'
+import { ControlStore } from '../src/control-state.js'
+import { RunStore, activeSetup } from '../src/runs.js'
+import { Scheduler } from '../src/scheduler.js'
+import { CliUnavailableError, EXECUTOR_REGISTRY, type ExecutorOptions } from '../src/executor.js'
+import { codexRejection, nextSetup, quotaScope, startupObserver, startupLine } from '../src/setup-fallback.js'
+import type { AiPreset } from '../src/ai.js'
+
+const until=async(check:()=>Promise<boolean>)=>{for(let i=0;i<250;i++){if(await check())return;await new Promise(r=>setTimeout(r,20))}throw new Error('Timed out')}
+const setup=(id:string,cli:string,model:string):AiPreset=>({id,name:id,cli,model})
+const claudeA=setup('claude-a','claude','opus'),claudeB=setup('claude-b','claude','sonnet')
+const codexA=setup('codex-a','codex','gpt-6-sol'),codexB=setup('codex-b','codex','gpt-6-astra')
+const observe=(...lines:unknown[])=>{const o=startupObserver();o.write(lines.map(l=>typeof l==='string'?l:JSON.stringify(l)).join('\n')+'\n');return o.result()}
+
+test('startup observer advances only on typed rejection before any work',()=>{
+  assert.deepEqual(observe({type:'system',subtype:'init'},{type:'rate_limit_event',rate_limit_info:{status:'rejected',resetsAt:1791460800}},{type:'assistant',error:'rate_limit',message:{content:[]}},{type:'result',is_error:true}),
+    {workBegan:false,rejection:{category:'quota',resetAt:'2026-10-08T12:00:00.000Z'}})
+  assert.equal(observe({type:'assistant',error:'authentication_failed'}).rejection?.category,'access-denied')
+  assert.equal(observe({type:'assistant',error:'model_not_found'}).rejection?.category,'provider-rejected')
+  // Real output, unknown errors and unparseable lines all count as work.
+  assert.equal(observe({type:'assistant',message:{content:[{type:'tool_use'}]}},{type:'assistant',error:'rate_limit'}).workBegan,true)
+  assert.equal(observe({type:'assistant',error:'unknown'}).workBegan,true)
+  assert.equal(observe('plain text').workBegan,true)
+  for (const subtype of ['hook_started','hook_progress','hook_response','unknown'])
+    assert.equal(observe({type:'system',subtype},{type:'assistant',error:'rate_limit'}).workBegan,true)
+  // Ez transport summaries (Codex native session, host-forwarded Claude) and session metadata.
+  assert.deepEqual(observe({type:'thread.started',thread_id:'t'},startupLine({workBegan:false,rejection:{category:'cli-unavailable'}})),{workBegan:false,rejection:{category:'cli-unavailable'}})
+  assert.equal(observe(startupLine({workBegan:true}),startupLine({workBegan:false,rejection:{category:'quota'}})).workBegan,true)
+})
+
+test('only scheduled Claude runs stream structured events',()=>{
+  assert.deepEqual(EXECUTOR_REGISTRY.claude.buildArgs({workspace:'/w',nativeSession:true},'','').slice(-3),['--output-format','stream-json','--verbose'])
+  assert.ok(!EXECUTOR_REGISTRY.claude.buildArgs({workspace:'/w'},'','').includes('stream-json'))
+})
+
+test('codex errors map to categories; policy and context errors never advance',()=>{
+  assert.equal(codexRejection('usageLimitExceeded'),'quota')
+  assert.equal(codexRejection('unauthorized'),'access-denied')
+  assert.equal(codexRejection('serverOverloaded'),'provider-rejected')
+  assert.equal(codexRejection({responseTooManyFailedAttempts:{httpStatusCode:429}}),'quota')
+  assert.equal(codexRejection({httpConnectionFailed:{httpStatusCode:403}}),'access-denied')
+  for(const info of ['cyberPolicy','contextWindowExceeded','other',{httpConnectionFailed:{httpStatusCode:null}},undefined]) assert.equal(codexRejection(info),undefined)
+})
+
+test('a quota rejection skips later setups in the same scope, even with different credentials',()=>{
+  assert.equal(quotaScope(claudeA),quotaScope(claudeB))
+  assert.equal(quotaScope({...codexA,provider:'bridge'}),quotaScope(codexB))
+  assert.equal(quotaScope({id:'p',name:'p',cli:'pi',model:'opencode-go/m'}),quotaScope({id:'o',name:'o',cli:'opencode',model:'opencode-go/x'}))
+  const first={preset:claudeA,quotaScope:'claude',outcome:'failed' as const,category:'quota' as const}
+  const next=nextSetup([claudeA,claudeB,codexA,codexB],[first])
+  assert.equal(next.preset,codexA);assert.deepEqual(next.skipped.map(s=>[s.preset.id,s.outcome,s.category]),[['claude-b','skipped','same-quota-scope']])
+  // A non-quota rejection (model unavailable) leaves the scope eligible.
+  assert.equal(nextSetup([claudeA,claudeB],[{...first,category:'provider-rejected'}]).preset,claudeB)
+})
+
+type Script={lines?:unknown[];code?:number;unavailable?:boolean;hold?:boolean}
+const fixture=async(name:string,scripts:Script[],fallbacks=[claudeB,codexA,codexB],primary=claudeA)=>{
+  const dir=await mkdtemp(join(tmpdir(),`ez-fallback-${name}-`)),control=new ControlStore(dir,1000),runs=new RunStore(dir),scheduler=new Scheduler(dir)
+  const launches:ExecutorOptions[]=[],admitted:(AiPreset|undefined)[]=[],sent:string[]=[]
+  const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'codex',telegramBotToken:'fixture'},async(_texts,options)=>{
+    const script=scripts[launches.length] ?? {code:0}
+    launches.push(options);admitted.push(activeSetup((await runs.get(options.runId))!))
+    if(script.unavailable)throw new CliUnavailableError(`Native CLI ${options.cli} is not executable on the host PATH`)
+    const out=(script.lines ?? []).map(l=>typeof l==='string'?l:JSON.stringify(l)).join('\n')
+    const child=spawn(process.execPath,['-e',`process.stdout.write(${JSON.stringify(out ? out+'\n' : '')});setTimeout(()=>process.exit(${script.code ?? 0}),${script.hold ? 60000 : 10})`],{detached:process.platform!=='win32'})
+    await once(child,'spawn');return {child,cleanup:async()=>{},stdout:''}
+  })
+  relay.bot.api.config.use(async(_prev,method,payload)=>{if(method==='sendMessage')sent.push((payload as {text:string}).text);return {ok:true,result:{message_id:42}} as never})
+  await control.requestPairing(101,101);await control.approveOwner(101)
+  const owner=(await control.status()).owner!
+  const saved=await scheduler.save({id:'daily',name:'Daily',text:'Saved work',owner,execution:{sessionId:'00000000-0000-4000-8000-000000000000',preset:primary,fallbacks},enabled:true,trigger:{at:'2027-01-01T00:00:00Z'}},true)
+  const run=await scheduler.trigger(saved.id,saved.revision,'fallback-'+name,owner,runs)
+  await relay.drainSources()
+  return {dir,runs,scheduler,relay,run,launches,admitted,sent,done:async()=>{await until(async()=>['completed','failed','cancelled'].includes((await runs.get(run.id))!.status));return (await runs.get(run.id))!},
+    close:async()=>{await relay.stop();await rm(dir,{recursive:true,force:true})}}
+}
+const quota={type:'assistant',error:'rate_limit'},work={type:'assistant',message:{content:[{type:'text',text:'working'}]}}
+
+test('a quota rejection before work advances within the same occurrence, skipping the exhausted scope',async()=>{
+  const f=await fixture('advance',[{lines:[{type:'rate_limit_event',rate_limit_info:{status:'rejected',resetsAt:1791460800}},quota],code:1},{lines:[startupLine({workBegan:true})],code:0}])
+  try{
+    const run=await f.done()
+    assert.equal(run.status,'completed');assert.equal(run.id,f.run.id)
+    assert.deepEqual(f.launches.map(l=>[l.cli,l.model,l.runId,l.nativeSession]),[['claude','opus',f.run.id,true],['codex','gpt-6-sol',f.run.id,true]])
+    assert.notEqual(f.launches[0].sessionId,f.launches[1].sessionId)
+    assert.deepEqual(f.admitted.map(p=>p?.id),['claude-a','codex-a'])
+    assert.deepEqual(run.attempts!.map(a=>[a.preset.id,a.outcome,a.category,a.resetAt]),[
+      ['claude-a','failed','quota','2026-10-08T12:00:00.000Z'],['claude-b','skipped','same-quota-scope',undefined],['codex-a','completed',undefined,undefined]])
+    assert.equal((await f.runs.list()).filter(r=>r.scheduled?.id==='daily').length,1)
+  }finally{await f.close()}
+})
+
+test('failure after work began, access denial and unknown failures stop without replay',async()=>{
+  for(const [name,lines,category] of [['partial',[work,quota],'after-work-began'],['hook',[{type:'system',subtype:'hook_started'},quota],'after-work-began'],['denied',[{type:'assistant',error:'authentication_failed'}],'access-denied'],['silent',[],'uncertain']] as const){
+    const f=await fixture(name,[{lines:[...lines],code:1}])
+    try{
+      const run=await f.done()
+      assert.equal(run.status,'failed',name);assert.equal(f.launches.length,1,name)
+      assert.deepEqual(run.attempts!.map(a=>[a.preset.id,a.outcome,a.category]),[['claude-a','failed',category]],name)
+    }finally{await f.close()}
+  }
+})
+
+test('each scheduled attempt launches with its own captured auth profile',async()=>{
+  const primary={...claudeA,authProfile:'work'}
+  const f=await fixture('profile',[{lines:[{type:'assistant',error:'model_not_found'}],code:1},{lines:[work],code:0}],[claudeB],primary)
+  try{
+    assert.equal((await f.done()).status,'completed')
+    assert.deepEqual(f.launches.map(l=>[l.cli,l.model,l.authProfile]),[['claude','opus','work'],['claude','sonnet',undefined]])
+  }finally{await f.close()}
+})
+
+test('cancellation stops the chain',async()=>{
+  const f=await fixture('cancel',[{lines:[quota],hold:true}])
+  try{
+    await until(async()=>Boolean((await f.runs.get(f.run.id))?.pid))
+    await f.scheduler.cancel(f.run.id)
+    await f.relay.drainSources()
+    const run=await f.done()
+    assert.equal(run.status,'cancelled');assert.equal(f.launches.length,1)
+    assert.deepEqual(run.attempts!.map(a=>a.outcome),['cancelled'])
+  }finally{await f.close()}
+})
+
+test('when every setup is unavailable the run reports each setup clearly',async()=>{
+  const f=await fixture('none',[{unavailable:true},{unavailable:true}],[codexA])
+  try{
+    const run=await f.done()
+    assert.equal(run.status,'failed');assert.equal(run.failureReason,'setups-unavailable')
+    assert.deepEqual(run.attempts!.map(a=>[a.preset.id,a.category]),[['claude-a','cli-unavailable'],['codex-a','cli-unavailable']])
+    assert.match(run.failure!.error,/Every task setup was unavailable: claude · opus .*\(cli-unavailable\); codex · gpt-6-sol/)
+    assert.match(f.sent.join('\n'),/could not start\. Every task setup was unavailable/)
+  }finally{await f.close()}
+})
+
+test('schedules reject duplicate or excess setups and the socket cannot rewrite attempts',async()=>{
+  const dir=await mkdtemp(join(tmpdir(),'ez-fallback-validate-')),control=new ControlStore(dir,1000),scheduler=new Scheduler(dir)
+  try{
+    await control.requestPairing(101,101);await control.approveOwner(101)
+    const owner=(await control.status()).owner!,base={id:'t',name:'T',text:'Work',owner,enabled:true,trigger:{at:'2027-01-01T00:00:00Z'}}
+    const execution=(fallbacks:AiPreset[])=>({sessionId:'00000000-0000-4000-8000-000000000000',preset:claudeA,fallbacks})
+    await assert.rejects(scheduler.save({...base,execution:execution([{...claudeA,id:'copy'}])}),/distinct/)
+    await assert.rejects(scheduler.save({...base,execution:execution([claudeB,codexA,codexB,setup('x','codex','other')])}),/AI selection/)
+    await assert.rejects(scheduler.save({...base,execution:execution([{...codexA,model:undefined}])}),/explicit model/)
+    const forged=[{preset:setup('forged','claude','opus-max'),quotaScope:'claude',outcome:'running' as const}]
+    assert.equal(activeSetup({execution:execution([claudeB]),attempts:forged}),undefined)
+    const {serveTestLedger}=await import('./helpers/ledger.js'),{callDeliverySocket,socketPathFor}=await import('../src/delivery-socket.js')
+    const ledger=await serveTestLedger(dir)
+    try{
+      const run=await new RunStore(dir).create({chatId:101,telegramUserId:101,texts:['x'],execution:execution([claudeB])})
+      await assert.rejects(callDeliverySocket(socketPathFor(dir),{op:'patch',payload:{runId:run.id,change:{attempts:forged}}}),/relay-owned/)
+    }finally{await ledger.stop()}
+  }finally{await rm(dir,{recursive:true,force:true})}
+})
+
+test('host transport admits only the active task setup and profile, forwards only Claude startup summaries',async()=>{
+  const root=await mkdtemp(join(tmpdir(),'ez-fallback-host-')),workspace=join(root,'mind'),controlDir=join(root,'control'),directory=join(controlDir,'host-executor')
+  const {mkdir,writeFile,readFile}=await import('node:fs/promises'),{serveHostExecutor}=await import('../src/host-executor.js')
+  const abort=new AbortController(),launched:{cli?:string;model?:string;authProfile?:string}[]=[],oldPath=process.env.PATH
+  const primary={...claudeA,authProfile:'work'}
+  let server:Promise<void>|undefined
+  try{
+    await mkdir(workspace,{recursive:true});await mkdir(directory,{recursive:true});await mkdir(join(root,'bin'))
+    await writeFile(join(root,'bin','claude'),'#!/bin/sh\nexit 0\n',{mode:0o700})
+    process.env.PATH=join(root,'bin')+':'+oldPath
+    const control=new ControlStore(controlDir,900_000);await control.requestPairing(101,101);await control.approveOwner(101)
+    const owner=(await control.status()).owner!,runs=new RunStore(controlDir),id='r_schedule_fallback'
+    await runs.create({id,chatId:101,telegramUserId:101,texts:['work'],execution:{sessionId:'00000000-0000-4000-8000-000000000000',preset:primary,fallbacks:[claudeB]},
+      scheduled:{id:'daily',revision:'rev',dueAt:new Date().toISOString(),pairedAt:owner.pairedAt}})
+    await runs.patch(id,{status:'running',attempts:[{preset:primary,quotaScope:'claude',outcome:'running'}]})
+    server=serveHostExecutor({cli:'claude',agents:[{name:'t',workspace,controlDir,binDir:join(root,'bin')}]},abort.signal,async(_texts,options)=>{
+      launched.push({cli:options.cli,model:options.model,authProfile:options.authProfile})
+      const lines=options.model==='opus'?[JSON.stringify({type:'system',subtype:'init'}),JSON.stringify({type:'assistant',error:'model_not_found',message:{content:[{type:'text',text:'secret tool output'}]}})].join('\n')+'\n':''
+      const child=spawn(process.execPath,['-e',`process.stdout.write(${JSON.stringify(lines)});process.exit(1)`])
+      return {child,cleanup:async()=>{},stdout:''}
+    },async()=>[{cli:'claude',authProfile:'work',model:'opus',name:'Work',efforts:[]}])
+    const events=async()=>{for(let n=0;n<150;n++){try{const text=await readFile(join(directory,id+'.events'),'utf8');if(text.includes('"stream":"exit"'))return text}catch{};await new Promise(r=>setTimeout(r,20))}throw new Error('No exit event')}
+    const request=(options:object)=>writeFile(join(directory,id+'.request.json'),JSON.stringify({texts:['work'],options}))
+    for(let n=0;n<100 && !await readFile(join(directory,'heartbeat.json')).then(()=>true,()=>false);n++)await new Promise(r=>setTimeout(r,20))
+    await request({cli:'claude',model:'opus',authProfile:'work'})
+    const first=await events()
+    const summaries=first.trim().split('\n').map(l=>JSON.parse(l)).filter(e=>e.stream==='stdout').flatMap(e=>e.text.trim().split('\n').map((l:string)=>JSON.parse(l)))
+    assert.ok(summaries.every((e:{type:string})=>e.type==='ez.startup'))
+    assert.deepEqual(summaries.at(-1),{type:'ez.startup',workBegan:false,rejection:{category:'provider-rejected'}})
+    assert.doesNotMatch(first,/secret tool output/)
+    const {rm:remove}=await import('node:fs/promises');await remove(join(directory,id+'.events'))
+    // The relay advances: the next attempt reuses the run ID.
+    await runs.patch(id,{attempts:[{preset:primary,quotaScope:'claude',outcome:'failed',category:'provider-rejected'},{preset:claudeB,quotaScope:'claude',outcome:'running'}]})
+    await request({cli:'claude',model:'sonnet'})
+    await events();await remove(join(directory,id+'.events'))
+    assert.deepEqual(launched.map(l=>[l.cli,l.model,l.authProfile]),[['claude','opus','work'],['claude','sonnet',undefined]])
+    await request({cli:'claude',model:'sonnet',authProfile:'work'})
+    assert.match(await events(),/auth profile does not match its captured AI selection/)
+    await remove(join(directory,id+'.events'))
+    // A request for a setup other than the active attempt is refused before launch.
+    await request({cli:'claude',model:'opus'})
+    assert.match(await events(),/does not match its saved task model/)
+    assert.equal(launched.length,2)
+  }finally{abort.abort();await server;process.env.PATH=oldPath;await rm(root,{recursive:true,force:true})}
+})
+
+test('Codex native session reports typed pre-work rejection and work start',async(t)=>{
+  t.mock.method(console,'error',()=>{})
+  const {runCodexSession}=await import('../src/codex-session.js')
+  for(const worked of [false,true]){
+    const program=`const rl=require('readline').createInterface({input:process.stdin});const send=x=>process.stdout.write(JSON.stringify(x)+'\\n');
+const event=(method,params)=>send({method,params:{threadId:'th',...params}});
+rl.on('line',line=>{const q=JSON.parse(line);if(!q.id)return;
+if(q.method==='initialize')return send({id:q.id,result:{}});
+if(q.method==='thread/start')return send({id:q.id,result:{thread:{id:'th'}}});
+if(q.method==='turn/start'){send({id:q.id,result:{turn:{id:'one'}}});event('turn/started',{turn:{id:'one'}});
+ event('item/started',{item:{type:'userMessage'}});${worked ? "event('item/started',{item:{type:'agentMessage'}});" : ''}
+ send({method:'account/rateLimits/updated',params:{rateLimits:{primary:{usedPercent:100,resetsAt:1791460800}}}});
+ event('turn/completed',{turn:{id:'one',status:'failed',error:{message:'limit',codexErrorInfo:'usageLimitExceeded'}}})}});setInterval(()=>{},1000);`
+    const output:string[]=[]
+    const code=await runCodexSession({workspace:'/tmp',controlDir:'/tmp/control',model:'gpt-6-sol',prompt:'work'},{launch:()=>spawn(process.execPath,['-e',program],{stdio:['pipe','pipe','pipe'],detached:process.platform!=='win32'}),emit:line=>output.push(line)})
+    assert.equal(code,1)
+    const o=startupObserver();o.write(output.join('\n')+'\n')
+    assert.deepEqual(o.result(),worked ? {workBegan:true,rejection:undefined} : {workBegan:false,rejection:{category:'quota',resetAt:'2026-10-08T12:00:00.000Z'}})
+  }
+})
+
+test('schedule CLI saves ordered fallbacks, preserves them on edit and clears them explicitly',async t=>{
+  const {execFile}=await import('node:child_process'),{promisify}=await import('node:util'),{fileURLToPath}=await import('node:url'),{serveTestLedger}=await import('./helpers/ledger.js')
+  const exec=promisify(execFile),bin=fileURLToPath(new URL('../bin/ezenciel-agents-schedule.mjs',import.meta.url))
+  const dir=await mkdtemp(join(tmpdir(),'ez-fallback-cli-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+  const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
+  const control=new ControlStore(dir,1000);await control.requestPairing(101,101);await control.approveOwner(101)
+  const env={...process.env,EZ_CONTROL_DIR:dir,EZ_RUN_ID:''}
+  const cli=async(...args:string[])=>JSON.parse((await exec(process.execPath,[bin,...args],{env})).stdout)
+  const when=['--at','2027-09-09T09:00:00+04:00','--text','Work']
+  const saved=await cli('create','chain','--cli','claude','--model','opus',...when,'--fallback','cli=claude,model=sonnet,effort=medium','--fallback','cli=codex,model=gpt-6-sol')
+  assert.deepEqual(saved.execution.fallbacks.map((p:AiPreset)=>[p.cli,p.model,p.effort]),[['claude','sonnet','medium'],['codex','gpt-6-sol',undefined]])
+  assert.deepEqual((await cli('edit','chain','--cli','claude','--model','opus',...when)).execution.fallbacks,saved.execution.fallbacks)
+  assert.equal((await cli('edit','chain','--cli','claude','--model','opus',...when,'--clear-fallbacks')).execution.fallbacks,undefined)
+  await assert.rejects(exec(process.execPath,[bin,'create','bad','--cli','claude','--model','opus',...when,'--fallback','cli=codex'],{env}),/cli=EXECUTOR,model=MODEL/)
+  await assert.rejects(exec(process.execPath,[bin,'create','dup','--cli','claude','--model','opus',...when,'--fallback','cli=claude,model=opus'],{env}),/distinct/)
+})

package/test/task-native.test.ts

@@ -1,10 +1,12 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises'
+import { mkdtemp, mkdir, writeFile, rm, readFile } from 'node:fs/promises'
 import { createServer } from 'node:http'
+import {createServer as createNetServer} from 'node:net'
 import { spawn, execFile } from 'node:child_process'
 import { promisify } from 'node:util'
 import { fileURLToPath } from 'node:url'
+import { createHash } from 'node:crypto'
 import { homedir } from 'node:os'
 import { taskArguments, taskModelCatalog, TASK_CODEX_VERSION } from '../src/task-executor.js'
 import { Tasks } from '../src/tasks.js'
@@ -12,33 +14,60 @@ import { ownerRun } from './helpers/owner-run.js'
 import { EventSources } from '../src/event-sources.js'
 import { ControlStore } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
+import {ApplicationBindings} from '../src/application-channel.js'
 import { taskRequests } from '../src/task-rpc.js'
 
 // Real bundled model metadata plus native CLI, synthetic endpoint, no credentials or provider sends.
 // Unknown fixture model names miss model-driven tool overrides.
 // Run explicitly with EZ_TEST_NATIVE_TASKS=1 after installing the audited CLI.
 test('native restricted task has only bounded MCP tools, ignores private guidance, and executes broker calls', { skip: !process.env.EZ_TEST_NATIVE_TASKS, timeout: 30000 }, async () => {
+  assert.equal((await promisify(execFile)('codex',['--version'])).stdout.trim(), `codex-cli ${TASK_CODEX_VERSION}`)
   const root = await mkdtemp('/tmp/ez-native-task-'), directory = `${root}/task`, home = `${root}/home`
   await mkdir(directory); await mkdir(home)
   await writeFile(`${root}/AGENTS.md`, 'PRIVATE_CANARY_DO_NOT_LOAD')
   await writeFile(`${home}/config.toml`, 'invalid = [ syntax')
   const requests: any[] = [], sends: any[] = []
+  const incoming={id:'1',conversationId:'contact-a',receivedAt:Date.now()+1000,text:'shop.txt attached'}
+  const png=Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+ip1sAAAAASUVORK5CYII=','base64')
+  const videoPath = `${root}/fixture.mp4`
+  await promisify(execFile)('ffmpeg',['-v','error','-f','lavfi','-i','color=c=blue:s=64x64:d=1','-c:v','mpeg4',videoPath])
+  const video=await readFile(videoPath)
   const provider = createServer(async (req, res) => {
     let body = ''; for await (const chunk of req) body += chunk
     const { command, args } = JSON.parse(body)
-    res.end(JSON.stringify({ ok: true, data: command === 'events-head' ? { cursor: 0, accountId: 'fixture-account', taskProtocol: 'message-v1' }
+    res.end(JSON.stringify({ ok: true, data: command === 'events-head' ? { cursor: 0, accountId: 'fixture-account', taskProtocol: 'message-v1',taskVoice:true }
+      : command === 'events-check' ? {events:[incoming,{...incoming,id:'2',text:'image.png attached'},{...incoming,id:'3',text:'video.mp4 attached; speech transcript: Shop closes at 6pm.'}]}
+      : command === 'task-document' && args.incomingId === '3' ? {name:'video.mp4',data:video.toString('base64'),sha256:createHash('sha256').update(video).digest('hex')}
+      : command === 'task-document' && args.incomingId === '2' ? {name:'image.png',data:png.toString('base64'),sha256:createHash('sha256').update(png).digest('hex')}
+      : command === 'task-document' ? {name:'shop.txt',data:Buffer.from('Shop opens at 7am.').toString('base64'),sha256:createHash('sha256').update('Shop opens at 7am.').digest('hex')}
       : command === 'task-send' ? (sends.push(args), { ...args, state: 'accepted' }) : {} }))
   })
   await new Promise<void>(r => provider.listen(`${root}/p.sock`, r))
   await ownerRun(root, 'owner')
   await new EventSources(root).register('fixture', `${root}/p.sock`, (await new ControlStore(root, 900000).status()).owner!)
-  const tasks = new Tasks(root), drain = taskRequests(tasks)
+  const tasks = new Tasks(root,async () => ({buffer:Buffer.from('OggSfixture OpusHead'),mimeType:'audio/ogg'})), drain = taskRequests(tasks)
   const proposal: any = await tasks.ownerCall('owner', 'start', { sourceId: 'fixture', conversationId: 'contact-a', purpose: 'Book dinner without payment', context: 'Two people at 7pm', hours: 1 })
   assert.equal(proposal.state, 'active')
-  const runs = new RunStore(root), run = (await runs.list()).find(r => r.taskId)!
+  const runs = new RunStore(root), run = await runs.create({id:'event_document_fixture',taskId:proposal.id,chatId:101,telegramUserId:101,texts:[],external:{sourceId:'fixture',bindingId:(await tasks.get(proposal.id))!.bindingId,eventIds:['1','2','3']}})
   await runs.patch(run.id, { status: 'running' })
+  const bindings=new ApplicationBindings(root), owner=(await new ControlStore(root,900000).status()).owner!
+  await bindings.register('browser','z'.repeat(48),owner)
+  await bindings.taskLaunch('browser',{command:'fixture',args:['launch','--task'],tasks:[proposal.id]})
+  let launchRequests=0
+  const launchSocket=`${root}/launch.sock`
+  const launchBroker=createNetServer(socket=>{
+    let raw='';socket.on('data',chunk=>{raw+=chunk;if(!raw.includes('\n'))return;void(async()=>{
+      const request=JSON.parse(raw.trim()),input=JSON.parse(request.stdin)
+      assert.equal(request.operation,'task-launch');assert.equal(request.runId,run.id)
+      assert.equal(input.taskId,proposal.id)
+      const grant=await tasks.authorizeApplicationLaunch(run.id,createHash('sha256').update(input.taskToken).digest('hex'))
+      assert.equal(grant.launch.command,'fixture');assert.deepEqual(grant.launch.args,['launch','--task'])
+      launchRequests++
+      socket.end(JSON.stringify({version:1,id:request.id,ok:true,code:0,stdout:JSON.stringify({launch:{url:'https://fixture.example/#launch='+ 'e'.repeat(64),expiresAt:Date.now()+300000}})})+'\n')
+    })().catch(error=>socket.end(JSON.stringify({ok:false,error:error.message})+'\n'))})
+  });await new Promise<void>(r=>launchBroker.listen(launchSocket,r))
   const sequence = [
-    ['context', {}], ['send', { text: 'Is a table for two available at 7pm?', key: 'first' }],
+    ['context', {}], ['browser_link',{application:'browser'}], ['read_attachment',{incomingId:'1'}], ['read_attachment',{incomingId:'2'}], ['read_attachment',{incomingId:'3'}], ['send', { text: 'Is a table for two available at 7pm?', key: 'first', voice:true }],
     ['note', { text: 'Awaiting confirmation' }], ['complete', { text: 'Request sent; no booking confirmation received.' }],
     ['send', { text: 'A completed task cannot send', key: 'second' }],
   ]
@@ -61,30 +90,39 @@ test('native restricted task has only bounded MCP tools, ignores private guidanc
   try {
     const entry = new URL('../src/task-mcp.ts', import.meta.url).href
     await writeFile(`${root}/broker.mjs`, `if(process.env.HOME !== ${JSON.stringify(homedir())}) throw Error('Broker lost host CLI configuration'); await import(${JSON.stringify(entry)});`)
-    const broker = [process.execPath, '--import', fileURLToPath(new URL('../node_modules/tsx/dist/loader.mjs', import.meta.url)), `${root}/broker.mjs`, root, run.id]
+    const broker = [process.execPath, '--import', fileURLToPath(new URL('../node_modules/tsx/dist/loader.mjs', import.meta.url)), `${root}/broker.mjs`, root, run.id,'','[]','["browser"]']
     const catalog = await promisify(execFile)('codex', ['debug', 'models', '--bundled'], { maxBuffer: 4 * 1024 * 1024 });
     await writeFile(`${root}/models.json`, JSON.stringify(taskModelCatalog(JSON.parse(catalog.stdout))));
-    const args = taskArguments(directory, broker, JSON.stringify({event:'task_activated',taskId:proposal.id}), undefined, {model:'gpt-6-astra'})
+    const args = taskArguments(directory, broker, JSON.stringify({event:'task_activated',taskId:proposal.id}), ['context','browser_link','read_attachment','send','note','report','complete'], {model:'gpt-6-astra'}, {EZ_PLUGIN_BROKER_SOCKET:launchSocket,EZ_DELIVERY_SOCKET:`${root}/delivery.sock`})
     args.splice(-1, 0, '--disable', 'enable_request_compression', '-c', 'model_provider="fixture"', '-c', `model_providers.fixture={name="fixture",base_url="http://127.0.0.1:${(server.address() as any).port}/v1",wire_api="responses",requires_openai_auth=false}`)
     child = spawn('codex', args, { cwd: directory, env: { PATH: process.env.PATH, HOME: home, CODEX_HOME: home }, stdio: ['pipe', 'pipe', 'pipe'] })
     child.stdin!.end(JSON.stringify({event:'task_activated',taskId:proposal.id}));
     let stderr = ''; child.stderr!.on('data', c => { stderr += c }); child.stdout!.resume()
     const code = await new Promise(r => child!.on('close', r))
     assert.equal(code, 0, `Requires audited Codex ${TASK_CODEX_VERSION}: ${stderr}`)
-    assert.ok(requests.length === 6, 'Native tool call completed a second model turn')
+    assert.equal(launchRequests,1, 'Native MCP uses the installed isolated broker launcher without tools home')
+    assert.ok(requests.length === 10, 'Native tool call completed a second model turn')
     assert.ok(!JSON.stringify(requests).includes('PRIVATE_CANARY_DO_NOT_LOAD'))
+    assert.ok(JSON.stringify(requests).includes('https://fixture.example/#launch='))
+    assert.ok(!JSON.stringify(requests).includes('taskToken'))
     const messages=requests[0].input.filter((v:any)=>v.role==='user')
     assert.ok(messages.some((m:any)=>m.content.some((c:any)=>c.text===JSON.stringify({event:'task_activated',taskId:proposal.id}))))
     const tools = requests[0].tools ?? requests[0].input.find((v: any) => v.type === 'additional_tools')?.tools
     assert.deepEqual(tools.filter((t: any) => t.type === 'function').map((t: any) => t.name).sort(), ['list_mcp_resource_templates', 'list_mcp_resources', 'read_mcp_resource', 'request_user_input'])
     const namespaces = tools.filter((t: any) => t.type === 'namespace')
     assert.equal(namespaces.length, 1); assert.equal(namespaces[0].name, 'mcp__ez')
-    assert.deepEqual(namespaces[0].tools.map((t: any) => t.name).sort(), ['complete', 'context', 'note', 'report', 'send'])
-    assert.match(JSON.stringify(requests[5].input), /inactive or expired/)
-    assert.equal(sends.length, 1); assert.equal(sends[0].conversationId, 'contact-a')
+    assert.deepEqual(namespaces[0].tools.map((t: any) => t.name).sort(), ['browser_link','complete', 'context', 'note', 'read_attachment', 'report', 'send'])
+    assert.match(JSON.stringify(requests.at(-1).input), /inactive or expired/)
+    assert.ok(JSON.stringify(requests).includes('Shop opens at 7am.'))
+    assert.ok(JSON.stringify(requests).includes('data:image/'), 'Native CLI forwards MCP images into vision input: '+JSON.stringify(requests.map(request=>request.input)))
+    assert.ok(JSON.stringify(requests).includes('durationSeconds'), 'Native input includes video frame metadata')
+    assert.ok(JSON.stringify(requests).includes('Shop closes at 6pm.'))
+    const videoTurn=requests[5].input
+    assert.ok(JSON.stringify(videoTurn).includes('data:image/'), 'Native CLI receives sampled video frames as vision input')
+    assert.equal(sends.length, 1);assert.equal(Buffer.from(sends[0].audio.data,'base64').toString(),'OggSfixture OpusHead'); assert.equal(sends[0].conversationId, 'contact-a')
     assert.equal((await tasks.get(proposal.id))!.state, 'completed')
   } finally {
-    child?.kill(); clearInterval(timer); server.closeAllConnections(); await new Promise<void>(r => server.close(() => r()))
+    child?.kill(); clearInterval(timer); await new Promise<void>(r=>launchBroker.close(()=>r())); server.closeAllConnections(); await new Promise<void>(r => server.close(() => r()))
     provider.closeAllConnections(); await new Promise<void>(r => provider.close(() => r()))
     await rm(root, { recursive: true, force: true })
   }

package/test/tasks.test.ts

@@ -15,16 +15,17 @@ import { requireOwnerExecution } from '../src/execution-authority.js'
 import { execFile } from 'node:child_process'
 import { promisify } from 'node:util'
 
-async function fixture(t: test.TestContext, channelOwner = false) {
+async function fixture(t: test.TestContext, channelOwner = false, speech?: (text:string) => Promise<{buffer:Buffer;mimeType:string}>) {
   const dir = await mkdtemp('/tmp/ez-task-test-'), socket = join(dir, 's.sock')
   let accountId = 'account-a', events: SourceEvent[] = [], uncertain = false
   const sends: any[] = [], watches: any[] = []
   const server = createServer(async (req, res) => {
     let text = ''; for await (const chunk of req) text += chunk
     const { command, args } = JSON.parse(text)
-    const data = command === 'events-head' ? { cursor: 0, accountId, taskProtocol: 'message-v1', persistentWatch: true, wildcardWatch: true }
+    const data = command === 'events-head' ? { cursor: 0, accountId, taskProtocol: 'message-v1', persistentWatch: true, wildcardWatch: true, taskVoice: true }
       : command === 'task-watch' ? (watches.push(args), { watching: args.conversationId })
       : command === 'events-check' ? { events: events.filter(e => args.ids.includes(e.id)) }
+      : command === 'task-document' ? {name:'shop.txt',data:Buffer.from('Shop opens at 7am.').toString('base64'),sha256:createHash('sha256').update('Shop opens at 7am.').digest('hex')}
       : command === 'task-send' ? (sends.push(args), { ...args, state: uncertain ? 'uncertain' : 'accepted', receiptId: 'provider-1' }) : {}
     res.end(JSON.stringify({ ok: true, data }))
   })
@@ -35,7 +36,7 @@ async function fixture(t: test.TestContext, channelOwner = false) {
     await runs.create({ id: 'owner', ownerId: ownerId(owner), ownerEpoch: ownerEpoch(owner), texts: ['Own this conversation'] })
     await runs.patch('owner', { status: 'running' })
   } else await ownerRun(dir, 'owner')
-  const control = new ControlStore(dir, 900000), sources = new EventSources(dir), runs = new RunStore(dir), tasks = new Tasks(dir)
+  const control = new ControlStore(dir, 900000), sources = new EventSources(dir), runs = new RunStore(dir), tasks = new Tasks(dir,speech)
   await sources.register('generic', socket, (await control.status()).owner!)
   t.after(async () => { server.closeAllConnections(); await new Promise<void>(r => server.close(() => r())); await rm(dir, { recursive: true, force: true }) })
   async function proposal() {
@@ -247,7 +248,7 @@ test('approved initial task crosses the real host file client and uses a fresh r
   const { isHostRunId } = await import('../src/host-executor-protocol.js')
   const f = await fixture(t), { run } = await f.activate()
   assert.ok(isHostRunId(run.id))
-  await writeFile(join(f.dir, 'codex'), `#!${process.execPath}\nif(process.argv[2]==='--version')console.log('codex-cli 0.160.0');else if(process.argv[2]==='debug')console.log(JSON.stringify({models:[{slug:'fixture',tool_mode:'code_mode_only',apply_patch_tool_type:'freeform',multi_agent_version:'v2'}]}));else console.log(JSON.stringify({cwd:process.cwd(),args:process.argv.slice(2),control:process.env.EZ_CONTROL_DIR}));`, { mode: 0o700 })
+  await writeFile(join(f.dir, 'codex'), `#!${process.execPath}\nif(process.argv[2]==='--version')console.log('codex-cli 0.160.1');else if(process.argv[2]==='debug')console.log(JSON.stringify({models:[{slug:'fixture',tool_mode:'code_mode_only',apply_patch_tool_type:'freeform',multi_agent_version:'v2'}]}));else console.log(JSON.stringify({cwd:process.cwd(),args:process.argv.slice(2),control:process.env.EZ_CONTROL_DIR}));`, { mode: 0o700 })
   const priorPath = process.env.PATH
   process.env.PATH = `${f.dir}:${priorPath}`
   const abort = new AbortController(), host = serveHostExecutor({ cli: 'codex', agents: [{ name: 'test', workspace: f.dir, controlDir: f.dir, binDir: f.dir }] }, abort.signal)
@@ -341,3 +342,95 @@ test('public grants enforce persisted hourly and cumulative admission budgets',a
   assert.equal(await f.tasks.admitPublic(proposal.id),'revoked')
   assert.equal((await f.tasks.get(proposal.id))?.state,'revoked')
 })
+
+
+test('voice reuses task send authority and receipt keys, rechecks the account after synthesis, and never falls back to text', async t => {
+  let generated = 0, changed = false
+  let changeAccount: (value:string) => void
+  const f = await fixture(t,false,async text => {
+    generated++; assert.equal(text, 'Spoken fixture')
+    if(changed)changeAccount('replaced')
+    return {buffer:Buffer.from('OggSfixture OpusHead'),mimeType:'audio/ogg'}
+  })
+  changeAccount = f.account
+  const {run} = await f.activate()
+  const sent = await f.tasks.workerCall(run.id,'send',{text:'Spoken fixture',key:'spoken',voice:true})
+  assert.ok('state' in sent);assert.equal(sent.state,'accepted');assert.equal(generated,1);assert.equal(f.sends.length,1)
+  assert.equal(Buffer.from(f.sends[0].audio.data,'base64').toString(),'OggSfixture OpusHead')
+  await f.tasks.workerCall(run.id,'send',{text:'Spoken fixture',key:'spoken',voice:true})
+  assert.equal(generated,1);assert.equal(f.sends.length,1)
+  await assert.rejects(f.tasks.workerCall(run.id,'send',{text:'Spoken fixture',key:'spoken'}), /different text/)
+  changed=true
+  assert.equal((await f.tasks.workerCall(run.id,'send',{text:'Spoken fixture',key:'changed',voice:true}) as {state:string}).state,'uncertain')
+  assert.equal(f.sends.length,1)
+})
+
+test('voice generation failure is a definite non-send: no text, no stored operation, same key retryable', async t => {
+  let generated=0
+  const f=await fixture(t,false,async () => { if(++generated===1)throw new Error('provider failed'); return {buffer:Buffer.from('OggSfixture OpusHead'),mimeType:'audio/ogg'} })
+  const {run, taskId}=await f.activate()
+  await assert.rejects(f.tasks.workerCall(run.id,'send',{text:'Spoken fixture',key:'failed',voice:true}),/provider failed/)
+  assert.equal(f.sends.length,0);assert.equal(Object.hasOwn((await f.tasks.get(taskId))!.operations,'failed'),false)
+  assert.equal((await f.tasks.workerCall(run.id,'send',{text:'Spoken fixture',key:'failed',voice:true}) as {state:string}).state,'accepted')
+  assert.equal(generated,2);assert.equal(f.sends.length,1)
+})
+
+
+test('a cancelled worker cannot dispatch a voice generated after stop', async t => {
+  let stop: () => Promise<unknown>
+  const f=await fixture(t,false,async () => { await stop(); return {buffer:Buffer.from('OggSfixture OpusHead'),mimeType:'audio/ogg'} })
+  const {run}=await f.activate();stop=()=>f.runs.patch(run.id,{status:'cancelled'})
+  assert.equal((await f.tasks.workerCall(run.id,'send',{text:'Spoken fixture',key:'stopped',voice:true}) as {state:string}).state,'uncertain')
+  assert.equal(f.sends.length,0)
+})
+
+test('incoming documents use shared staging and never expose another event or owner path', async t => {
+ const f=await fixture(t), {taskId}=await f.activate(), task=(await f.tasks.get(taskId))!
+ const row={id:'1',conversationId:'contact-a',receivedAt:Date.now(),text:'Document attached'};f.rows([row])
+ const run=await f.runs.create({id:'event_document',taskId,chatId:101,telegramUserId:101,texts:[],external:{sourceId:'generic',bindingId:task.bindingId,eventIds:['1']}})
+ await f.runs.patch(run.id,{status:'running'})
+ const document:any=await f.tasks.workerCall(run.id,'read_attachment',{incomingId:'1'})
+ assert.equal(document.text,'Shop opens at 7am.');assert.equal(document.name,'shop.txt');assert.equal(document.type,'text')
+ await assert.rejects(f.tasks.workerCall(run.id,'read_attachment',{incomingId:'2'}),/outside/)
+ await assert.rejects(f.tasks.workerCall(run.id,'read_attachment',{incomingId:'/etc/passwd'}),/outside/)
+ f.rows([{...row,conversationId:'contact-b'}]);await assert.rejects(f.tasks.workerCall(run.id,'read_attachment',{incomingId:'1'}),/correspondence/)
+})
+
+test('explicit application launch continues restricted task; cross-task, owner mode, revocation and replay changes fail closed',async t=>{
+  const {ApplicationBindings,ApplicationChannel}=await import('../src/application-channel.js')
+  const {initialPreset}=await import('../src/ai.js')
+  const f=await fixture(t), {taskId,run}=await f.activate(), owner=(await f.control.status()).owner!
+  const bindings=new ApplicationBindings(f.dir), binding=(await bindings.register('browser','x'.repeat(48),owner))!
+  const token='a'.repeat(64),ticketHash=createHash('sha256').update(token).digest('hex')
+  await assert.rejects(f.tasks.workerCall(run.id,'application_launch',{application:'browser',ticketHash}),/not authorized/)
+  await bindings.taskLaunch('browser',{command:'fixture',args:['launch','--task'],tasks:[taskId]})
+  const grant=await f.tasks.workerCall(run.id,'application_launch',{application:'browser',ticketHash}) as {taskId:string;expiresAt:number}
+  assert.equal(grant.taskId,taskId)
+  assert(!(await readFile(join(f.dir,'task-applications',ticketHash+'.json'),'utf8')).includes(token))
+  const admission=await f.tasks.authorizeApplicationLaunch(run.id,ticketHash)
+  assert.deepEqual(admission.launch,{command:'fixture',args:['launch','--task'],tasks:[taskId]})
+  await assert.rejects(f.tasks.authorizeApplicationLaunch('owner',ticketHash))
+  const app=new ApplicationChannel({controlDir:f.dir,initial:initialPreset('codex'),wake(){},async cancel(){}})
+  const input={requestId:'voice-test',scope:'task:'+taskId,text:'When is the booking?',taskToken:token}
+  await assert.rejects(app.submit(binding.bindingId,{...input,followOwner:true}),/Invalid application task/)
+  await assert.rejects(app.submit(binding.bindingId,{...input,scope:'task:other'}),/scope/)
+  const delegated=await app.submit(binding.bindingId,input)
+  assert.equal(delegated.taskId,taskId);assert.equal(delegated.version,2)
+  assert.equal((await app.submit(binding.bindingId,input)).id,delegated.id)
+  await assert.rejects(app.submit(binding.bindingId,{...input,text:'Changed request'}),/conflicts/)
+  await f.runs.patch(delegated.id,{status:'running'})
+  const context=await f.tasks.workerCall(delegated.id,'context',{}) as {notes:string[];request:string;context:string}
+  assert.match(context.context,/Two people/);assert.equal(context.request,input.text)
+  await f.tasks.workerCall(delegated.id,'note',{text:'Discussion-only voice result'})
+  const reply=await f.tasks.workerCall(delegated.id,'send',{key:'answer',text:'7pm'}) as {receipt:{queued:string}}
+  assert.equal(f.sends.length,0)
+  const outbox=(await f.runs.pendingOutbox()).find(x=>x.id===reply.receipt.queued)!
+  await app.deliver(delegated,outbox)
+  assert.deepEqual((await app.snapshot(binding.bindingId,delegated.id)).messages.map(m=>m.text),['7pm'])
+  const other=(await bindings.register('other','y'.repeat(48),owner))!
+  await bindings.taskLaunch('other',{command:'fixture',args:['launch'],tasks:'all'})
+  await assert.rejects(app.submit(other.bindingId,{...input,requestId:'other'}),/revoked/)
+  await bindings.taskLaunch('browser',null)
+  await assert.rejects(f.tasks.authorize(delegated),/revoked/)
+  await assert.rejects(app.snapshot(binding.bindingId,delegated.id),/revoked/)
+})