@jc_stack/ez-agents 0.1.0-beta.47 → 0.1.0-beta.49

package/src/control-state.ts

@@ -2,7 +2,8 @@ import { assertEffort } from './model-policy.js'
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto'
 import { mkdir, open, readFile, rename, rm, writeFile } from 'node:fs/promises'
 import path from 'node:path'
-import { isPreset, persistedPreset, presetProvider, type AiPreset, type ExecutionChoice, type ModelChoice } from './ai.js'
+import { isPreset, persistedPreset, presetProvider, sameEngine, type AiPreset, type ExecutionChoice, type ModelChoice } from './ai.js'
+import { isAuthProfile } from './auth-profile.js'
 
 export type Owner = {
   id?: string
@@ -58,6 +59,8 @@ export type SessionState = {
   sessionId: string
   hasStarted: boolean
   cli?: string
+  // Bound with cli at creation: a native session never resumes under another home.
+  authProfile?: string
   nativeSessionId?: string
   title?: string
   archived?: boolean
@@ -129,7 +132,8 @@ const isState = (value: unknown): value is ControlState => {
     (s.archived === undefined || typeof s.archived === 'boolean') &&
     (s.applicationScope === undefined || /^[a-f0-9]{64}$/.test(s.applicationScope)) &&
     (s.telegramShared === undefined || typeof s.telegramShared === 'boolean') &&
-    (s.preset === undefined || (isPreset(s.preset) && s.preset.cli === s.cli))
+    (s.authProfile === undefined || (isAuthProfile(s.authProfile) && s.cli !== undefined)) &&
+    (s.preset === undefined || (isPreset(s.preset) && sameEngine(s.preset, s)))
   return (
     candidate.version === 1 &&
     Array.isArray(candidate.pending) &&
@@ -150,9 +154,11 @@ const isState = (value: unknown): value is ControlState => {
 export const sessionTitle = (session: SessionState): string =>
   session.title || `Conversation ${session.sessionId.slice(0, 8)}`
 
+const engineOf = (preset: AiPreset) => ({ cli: preset.cli, ...(preset.authProfile ? { authProfile: preset.authProfile } : {}) })
+
 const rememberPreset = (state: ControlState) => {
   const preset = state.ai?.presets.find(p => p.id === state.ai!.selectedId)
-  if (state.activeSession && preset && state.activeSession.cli === preset.cli)
+  if (state.activeSession && preset && sameEngine(state.activeSession, preset))
     state.activeSession.preset = preset
 }
 
@@ -486,8 +492,8 @@ export class ControlStore {
       const ai = state.ai
       // Older sessions did not record their model. Reuse a known preset for the
       // same CLI; never resume an engine ID through a different client.
-      const preset = session.preset ?? ai?.presets.find(p => p.cli === session.cli)
-      if (!ai || !preset || preset.cli !== session.cli)
+      const preset = session.preset ?? ai?.presets.find(p => sameEngine(p, session))
+      if (!ai || !preset || !sameEngine(preset, session))
         throw new Error('This older conversation has no saved AI binding. Start a new conversation.')
       if (session.hasStarted && ['codex', 'codex-gui', 'opencode'].includes(session.cli!) && !session.nativeSessionId)
         throw new Error('This conversation has no native session ID. Start a new conversation.')
@@ -537,10 +543,11 @@ export class ControlStore {
       const state = await this.readState()
       await requireControlGuard(state, guard)
       if (expectedSession !== undefined && (state.activeSession?.sessionId ?? null) !== expectedSession) throw new Error('Conversation changed. Refresh controls before trying again.')
+      const fallback = state.ai?.presets.find((p) => p.id === state.ai!.defaultId)
       const next: SessionState = {
         sessionId: crypto.randomUUID(),
         hasStarted: false,
-        cli: state.ai?.presets.find((p) => p.id === state.ai!.defaultId)?.cli,
+        ...(fallback ? engineOf(fallback) : {}),
       }
       rememberPreset(state)
       if (state.activeSession) (state.sessions ??= []).push(state.activeSession)
@@ -624,25 +631,25 @@ export class ControlStore {
     const settledPreset = settledAi?.presets.find((p) => p.id === settledAi.selectedId)
     const session = settled.activeSession
     if (settledPreset && session && (session.cli || session.hasStarted) &&
-      !(session.cli === settledPreset.cli && session.hasStarted && session.preset &&
+      !(sameEngine(session, settledPreset) && session.hasStarted && session.preset &&
         presetProvider(session.preset) !== presetProvider(settledPreset)) &&
-      (session.cli !== settledPreset.cli || JSON.stringify(session.preset) === JSON.stringify(settledPreset)) &&
+      (!sameEngine(session, settledPreset) || JSON.stringify(session.preset) === JSON.stringify(settledPreset)) &&
       Boolean(session.title || session.hasStarted || !title?.trim()))
       return { sessionId: session.sessionId, preset: settledPreset }
     return this.withLock(async () => {
       const state = await this.readState()
       state.ai ??= { presets: [persistedPreset(initial)], defaultId: initial.id, selectedId: initial.id, recentIds: [] }
       const preset = state.ai.presets.find((p) => p.id === state.ai!.selectedId)!
-      state.activeSession ??= { sessionId: crypto.randomUUID(), hasStarted: false, cli: preset.cli }
-      if (!state.activeSession.cli && !state.activeSession.hasStarted) state.activeSession.cli = preset.cli
-      if (state.activeSession.cli === preset.cli) {
+      state.activeSession ??= { sessionId: crypto.randomUUID(), hasStarted: false, ...engineOf(preset) }
+      if (!state.activeSession.cli && !state.activeSession.hasStarted) Object.assign(state.activeSession, engineOf(preset))
+      if (sameEngine(state.activeSession, preset)) {
         const previous = state.activeSession.preset
         // A provider change starts a separate native context. Model and effort
         // changes are native turn settings within the existing conversation.
         if (state.activeSession.hasStarted && previous &&
             presetProvider(previous) !== presetProvider(preset)) {
           ;(state.sessions ??= []).push(state.activeSession)
-          state.activeSession = { sessionId: crypto.randomUUID(), hasStarted: false, cli: preset.cli, preset }
+          state.activeSession = { sessionId: crypto.randomUUID(), hasStarted: false, ...engineOf(preset), preset }
         } else {
           state.activeSession.preset = preset
         }
@@ -675,14 +682,14 @@ export class ControlStore {
         state.ai!.selectedId = session.preset!.id
       }
       if (previous?.preset) {
-        if (requested && requested.cli !== previous.cli) throw new Error('Application request conflicts with existing session engine')
+        if (requested && !sameEngine(requested, previous)) throw new Error('Application request conflicts with existing session engine')
         if (requested) previous.preset = requested
         activate(previous)
         if (shareTelegram || requested) await this.writeState(state)
         return { sessionId: previous.sessionId, preset: previous.preset }
       }
       const preset = requested ?? state.ai.presets.find(item => item.id === state.ai!.selectedId)!
-      const session: SessionState = { sessionId: crypto.randomUUID(), hasStarted: false, cli: preset.cli, preset, applicationScope: scope }
+      const session: SessionState = { sessionId: crypto.randomUUID(), hasStarted: false, ...engineOf(preset), preset, applicationScope: scope }
       state.sessions.push(session)
       activate(session)
       await this.writeState(state)
@@ -705,7 +712,7 @@ export class ControlStore {
         throw new Error('Application scope is shared; use shared controls')
       const nextPreset = preset ?? state.ai?.presets.find(item => item.id === state.ai!.defaultId)
       if (!nextPreset || !isPreset(nextPreset)) throw new Error('Invalid application AI selection')
-      if (preset && previous?.cli === preset.cli) {
+      if (preset && previous && sameEngine(previous, preset)) {
         previous.preset = persistedPreset(preset)
         await this.writeState(state)
         return previous
@@ -714,7 +721,7 @@ export class ControlStore {
       // the old immutable session ID; private history stays absent from /chats.
       if (previous) previous.archived = true
       const next: SessionState = {sessionId:crypto.randomUUID(), hasStarted:false,
-        cli:nextPreset.cli, preset:persistedPreset(nextPreset), applicationScope:scope}
+        ...engineOf(nextPreset), preset:persistedPreset(nextPreset), applicationScope:scope}
       ;(state.sessions ??= []).push(next)
       await this.writeState(state)
       return next
@@ -725,8 +732,8 @@ export class ControlStore {
     const state = await this.status()
     const session = state.activeSession?.sessionId === choice.sessionId ? state.activeSession
       : state.sessions?.find((s) => s.sessionId === choice.sessionId)
-    if (!session || session.cli !== choice.preset.cli)
-      throw new Error('Conversation has no matching CLI binding. Use New conversation explicitly; files are preserved.')
+    if (!session?.cli || !sameEngine(session, choice.preset))
+      throw new Error('Conversation has no matching CLI binding for this client and auth profile. Use New conversation explicitly; files are preserved.')
     if (session.hasStarted && ['codex', 'codex-gui', 'opencode'].includes(session.cli) && !session.nativeSessionId)
       throw new Error('Native session ID missing. Use New conversation explicitly; no automatic reset.')
     return session
@@ -755,7 +762,9 @@ export class ControlStore {
       const state = await this.readState()
       await requireControlGuard(state, guard)
       if (!state.ai) throw new Error('AI settings not initialized')
-      if (state.ai.presets.length >= 12 && !state.ai.presets.some((p) => p.id === preset.id))
+      // Auto-detected client defaults come and go with installed clients; only
+      // owner-saved choices count toward the cap.
+      if (state.ai.presets.filter((p) => !p.id.startsWith('detected_')).length >= 12 && !state.ai.presets.some((p) => p.id === preset.id))
         throw new Error('Keep it small: at most 12 saved AIs.')
       state.ai.presets = [...state.ai.presets.filter((p) => p.id !== preset.id), persistedPreset(preset)]
       await this.writeState(state)
@@ -772,16 +781,16 @@ export class ControlStore {
       assertEffort(preset.effort, preset.model, preset.cli)
       if ((state.activeSession?.sessionId ?? null) !== expectedSession) throw new Error('Menu expired. Open Choose AI again.')
       const current = ai.presets.find((p) => p.id === ai.selectedId)!
-      if (state.activeSession && (current.cli !== preset.cli || presetProvider(current) !== presetProvider(preset) || !state.activeSession.cli) && !fresh) return false
+      if (state.activeSession && (!sameEngine(current, preset) || presetProvider(current) !== presetProvider(preset) || !state.activeSession.cli) && !fresh) return false
       if (fresh || !state.activeSession) {
         rememberPreset(state)
         if (state.activeSession) (state.sessions ??= []).push(state.activeSession)
-        state.activeSession = { sessionId: crypto.randomUUID(), hasStarted: false, cli: preset.cli, preset: persistedPreset(preset) }
+        state.activeSession = { sessionId: crypto.randomUUID(), hasStarted: false, ...engineOf(preset), preset: persistedPreset(preset) }
       }
       ai.selectedId = id
       // Persist the conversation's choice now, even if the owner switches chats
       // or restarts before sending another message. Queued choices are snapshots.
-      if (state.activeSession.cli === preset.cli && (!state.activeSession.preset || presetProvider(state.activeSession.preset) === presetProvider(preset)))
+      if (sameEngine(state.activeSession, preset) && (!state.activeSession.preset || presetProvider(state.activeSession.preset) === presetProvider(preset)))
         state.activeSession.preset = persistedPreset(preset)
       ai.recentIds = [id, ...(ai.recentIds ?? []).filter((recentId) => recentId !== id)].slice(0, 3)
       await this.writeState(state)

package/src/delivery-socket-client.d.mts

@@ -2,3 +2,5 @@ export type DeliverySocketRequest = { op: string; payload?: unknown }
 export function deliverySocketPath(controlDir: string): string
 export function callDeliverySocket(socketPath: string, op: DeliverySocketRequest, timeoutMs?: number): Promise<unknown>
 export function deliverySocketAlive(socketPath: string, timeoutMs?: number): Promise<boolean>
+
+export function callLocalSocket(socketPath:string, envelope:Record<string,unknown>, timeoutMs?:number):Promise<unknown>

package/src/delivery-socket-client.mjs

@@ -67,6 +67,8 @@ const exchange = (connect, envelope, timeoutMs, target) => new Promise((resolve,
   socket.write(encode(envelope))
 })
 
+export const callLocalSocket = (socketPath, envelope, timeoutMs = 130000) => exchange(() => createConnection(socketPath), envelope, timeoutMs, socketPath)
+
 const readEndpoint = async controlDir => {
   try {
     const value = JSON.parse(await readFile(path.join(controlDir, endpointName), 'utf8'))

package/src/delivery-socket.ts

@@ -1,3 +1,5 @@
+import { sameOwner } from './control-state.js'
+import { ApplicationBindings } from './application-channel.js'
 import { createServer, type Server, type Socket } from 'node:net'
 import { randomBytes, timingSafeEqual } from 'node:crypto'
 import { rename, rm, writeFile } from 'node:fs/promises'
@@ -9,6 +11,8 @@ import { deliveredMessages } from './message-history.js'
 import { readOnlyOwner, requireOwnerExecution } from './execution-authority.js'
 import { telegramOwner } from './control-state.js'
 import { Scheduler } from './scheduler.js'
+import {Tasks} from './tasks.js'
+import { runEvidence, type EvidenceOptions } from './run-evidence.js'
 
 // Stateless pipe transport. The relay owns the runs/outbox ledger in process
 // memory; engine children, plugin children and the host executor reach it
@@ -28,16 +32,19 @@ export { deliverySocketPath }
 export type DeliverySocketOp =
   | { op: 'ping' }
   | { op: 'status' }
+  | { op: 'schedulePreflight'; payload?: Record<string, unknown> }
   | { op: 'triggerSchedule'; payload: { scheduleId: string; revision: string; key: string; callerRunId?: string } }
   | { op: 'enqueue'; payload: Record<string, unknown> }
   | { op: 'wait'; payload: { id: string; timeoutMs?: number } }
   | { op: 'get'; payload: { runId: string } }
   | { op: 'list'; payload?: Record<string, never> }
   | { op: 'patch'; payload: { runId: string; change: Record<string, unknown> } }
+  | { op: 'taskApplication'; payload: {runId:string;ticketHash:string} }
   | { op: 'authorize'; payload: { runId: string } }
   | { op: 'receipt'; payload: { context: unknown; id: string } }
   | { op: 'history'; payload: { runId: string; limit?: number; messageId?: number } }
   | { op: 'deliveryStatus'; payload?: Record<string, never> }
+  | { op: 'evidence'; payload: EvidenceOptions }
   | { op: 'approvalCheck'; payload: { actionId: string } }
   | { op: 'latestReply'; payload?: Record<string, never> }
 
@@ -210,12 +217,23 @@ export const createLedgerHandler = (controlDir: string, hooks: LedgerHooks): Del
           queued: all.filter((run) => run.status === 'queued').length,
         }
       }
+      case 'schedulePreflight': {
+        const {scheduleId,revision}=op.payload ?? {}
+        if(!nonEmptyString(scheduleId) || !nonEmptyString(revision)) throw Error('Schedule preflight identity required')
+        const scheduler=new Scheduler(controlDir),s=await scheduler.get(scheduleId),owner=await readOnlyOwner(controlDir)
+        if(!owner || !sameOwner(owner,s.owner) || !s.enabled || s.revision!==revision || !s.preflight) throw Error('Schedule preflight binding unavailable')
+        if(s.delivery) {
+          const binding=(await new ApplicationBindings(controlDir).list()).find(b=>b.bindingId===s.delivery!.bindingId)
+          if(!binding || !sameOwner(owner,binding.owner)) throw Error('Schedule preflight delivery revoked')
+        }
+        return s.preflight
+      }
       case 'triggerSchedule': {
         const {scheduleId,revision,key,callerRunId}=op.payload ?? {}
         if (!nonEmptyString(scheduleId) || !nonEmptyString(revision) || !nonEmptyString(key)) throw new Error('Task ID, revision and request key are required')
         if (callerRunId !== undefined) {
           const caller=await requireOwnerExecution(controlDir,callerRunId)
-          if (caller.replyOnly || (caller.scheduled && caller.scheduled.pairedAt !== (await readOnlyOwner(controlDir))?.pairedAt)) throw new Error('Scheduling requires an active owner-authorized run')
+          if (caller.replyOnly || caller.script || (caller.scheduled && caller.scheduled.pairedAt !== (await readOnlyOwner(controlDir))?.pairedAt)) throw new Error('Scheduling requires an active owner-authorized run')
         }
         const owner=await readOnlyOwner(controlDir)
         if (!owner) throw new Error('Pair an owner before scheduling')
@@ -300,8 +318,14 @@ export const createLedgerHandler = (controlDir: string, hooks: LedgerHooks): Del
         const payload = (op.payload ?? {}) as { runId?: unknown; change?: unknown }
         if (typeof payload.runId !== 'string' || !payload.runId) throw new Error('Run ID is required')
         if (!payload.change || typeof payload.change !== 'object') throw new Error('Patch change is required')
+        // Setup attempts select what the host admits; only the relay records them.
+        if ('attempts' in payload.change) throw new Error('Setup attempts are relay-owned')
         return runs.patch(payload.runId, payload.change as never)
       }
+      case 'taskApplication': {
+        const p=op.payload as {runId:string;ticketHash:string}
+        return new Tasks(controlDir).authorizeApplicationLaunch(p.runId,p.ticketHash)
+      }
       case 'authorize': {
         const runId = (op.payload as { runId?: unknown } | undefined)?.runId
         if (typeof runId !== 'string' || !runId) throw new Error('Run ID is required')
@@ -321,6 +345,7 @@ export const createLedgerHandler = (controlDir: string, hooks: LedgerHooks): Del
           ...(payload.messageId === undefined ? {} : { messageId: payload.messageId as number }),
         })
       }
+      case 'evidence': return runEvidence(controlDir, op.payload ?? {})
       case 'deliveryStatus': return runs.deliveryStatus()
       case 'approvalCheck': {
         const actionId = (op.payload as { actionId?: unknown } | undefined)?.actionId

package/src/event-sources.ts

@@ -27,11 +27,11 @@ async function atomic(path: string, data: unknown) {
   try { await fd.writeFile(JSON.stringify(data)); await fd.sync() } finally { await fd.close() }
   await rename(tmp, path)
 }
-export function sourceCall(socketPath: string, command: string, args = {}): Promise<any> {
+export function sourceCall(socketPath: string, command: string, args = {}, maxResponseBytes = 256000): Promise<any> {
   return new Promise((resolve, reject) => {
     const req = request({ socketPath, path: '/', method: 'POST', timeout: 3000 }, res => {
       let body = ''
-      res.on('data', chunk => { body += chunk; if (Buffer.byteLength(body) > 256000) req.destroy(new Error('Event-source response too large')) })
+      res.on('data', chunk => { body += chunk; if (Buffer.byteLength(body) > maxResponseBytes) req.destroy(new Error('Event-source response too large')) })
       res.on('error', () => reject(new Error('Event-source response interrupted')))
       res.on('end', () => {
         try { const result = JSON.parse(body); if (res.statusCode !== 200 || result.ok !== true) throw new Error(); resolve(result.data) }

package/src/executor.ts

@@ -11,6 +11,8 @@ import { createInterface } from 'node:readline'
 import { fileURLToPath } from 'node:url'
 import { DESKTOP_UNAVAILABLE } from './desktop-bridge.js'
 import { macosWorkspaceProfile, workspaceSiblingDenies } from './workspace-confine.js'
+import { Scripts, type ScriptRunRef } from './scripts.js'
+import { claudeAuthEnvironment, cliHome, provisionedHome } from './auth-profile.js'
 
 export type ExecutorOptions = {
   repairEnabled?: boolean
@@ -34,12 +36,18 @@ export type ExecutorOptions = {
   model?: string
   effort?: string
   provider?: string
+  // Named owner-provisioned credential home; unset keeps the agent default.
+  authProfile?: string
   codexSandbox?: 'external'
   codexAutoCompactTokens?: number
   codexProvider?: CodexProviderBinding
   onSession?: (id: string) => Promise<void>
+  // Registered script occurrence: invoke it directly, never a native CLI.
+  script?: ScriptLaunch
 }
 
+export type ScriptLaunch = ScriptRunRef & { scheduleId: string; scheduleRevision: string; dueAt: string }
+
 export type CodexProviderBinding = {
   id: string
   name: string
@@ -71,7 +79,7 @@ export const executorEnvironment = (environment: NodeJS.ProcessEnv = process.env
 }
 
 export const executorJobEnv = (
-  options: Pick<ExecutorOptions, 'runId' | 'controlDir' | 'binDir' | 'toolsHome' | 'repairEnabled'>,
+  options: Pick<ExecutorOptions, 'runId' | 'controlDir' | 'binDir' | 'toolsHome' | 'repairEnabled'> & { workspace?: string },
   environment: NodeJS.ProcessEnv = process.env,
 ): NodeJS.ProcessEnv => {
   const base = executorEnvironment(environment)
@@ -81,6 +89,7 @@ export const executorJobEnv = (
     PATH: pathValue,
     EZ_RUN_ID: options.runId,
     EZ_CONTROL_DIR: options.controlDir,
+    ...(options.workspace ? { EZ_AGENT_WORKSPACE: options.workspace } : {}),
     EZ_DELIVERY_SOCKET: deliverySocketPath(options.controlDir),
     EZ_REPAIR_ENABLED: String(options.repairEnabled !== false),
     ...(options.toolsHome ? {BUILDX_CONFIG:path.join(options.toolsHome,'buildx')} : {}),
@@ -89,6 +98,10 @@ export const executorJobEnv = (
 
 export const grokJobEnv = executorJobEnv
 
+// The selected native CLI is not installed or not executable. Nothing ran, so a
+// scheduled occurrence may advance to its next setup.
+export class CliUnavailableError extends Error {}
+
 // Package binDir is Ez tools (ezenciel-agents-message). Native CLIs come from the
 // host PATH so one agent's wrapper cannot retarget another agent's CODEX_HOME.
 export const resolveHostCommand = (command: string, pathValue = process.env.PATH): string => {
@@ -101,14 +114,14 @@ export const resolveHostCommand = (command: string, pathValue = process.env.PATH
       return candidate
     } catch { /* try the next PATH entry */ }
   }
-  throw new Error(`Native CLI ${command} is not executable on the host PATH`)
+  throw new CliUnavailableError(`Native CLI ${command} is not executable on the host PATH`)
 }
 export type CliAdapter = {
   name: string
   command: string
   description: string
   buildArgs: (
-    options: Pick<ExecutorOptions, 'workspace' | 'sessionId' | 'isResume' | 'model' | 'effort' | 'toolsHome' | 'sharedWorkspace' | 'additionalWorkspaces' | 'codexAutoCompactTokens' | 'codexSandbox' | 'codexProvider'> & { controlDir?: string },
+    options: Pick<ExecutorOptions, 'workspace' | 'sessionId' | 'isResume' | 'model' | 'effort' | 'toolsHome' | 'sharedWorkspace' | 'additionalWorkspaces' | 'codexAutoCompactTokens' | 'codexSandbox' | 'codexProvider' | 'nativeSession'> & { controlDir?: string },
     promptFile: string,
     promptText: string,
   ) => string[]
@@ -155,6 +168,11 @@ export const EXECUTOR_REGISTRY: Record<string, CliAdapter> = {
         args.push('--session-id', opts.sessionId)
       }
       args.push('--print', '--dangerously-skip-permissions')
+      // Scheduled runs stream structured events so core can tell a provider
+      // rejection before work from a failure after work began.
+      if (opts.nativeSession) args.push('--output-format', 'stream-json', '--verbose')
+      for (const directory of [opts.controlDir, opts.sharedWorkspace, ...(opts.additionalWorkspaces ?? []), opts.toolsHome])
+        if (directory) args.push('--add-dir', directory)
       if (opts.model) args.push('--model', opts.model)
       if (opts.effort) args.push('--effort', opts.effort)
       return args
@@ -285,6 +303,9 @@ export const opencodeDataHome = (controlDir: string): string | undefined => {
   } catch { return undefined }
 }
 
+// Agent-bound Claude Code configuration directory (CLAUDE_CONFIG_DIR).
+export const claudeConfigHome = (controlDir: string, authProfile?: string): string => cliHome(controlDir, 'claude', authProfile)
+
 // Pi resolves its provider/model catalog from an agent dir (settings.json,
 // auth.json). Only a path is ever returned, never a secret.
 export const piAgentDir = (controlDir: string): string | undefined => {
@@ -323,7 +344,10 @@ export const startExecutorJob = async (
   texts: string[],
   options: ExecutorOptions,
 ): Promise<{ child: ChildProcess; cleanup: () => Promise<void>; stdout: string }> => {
+  if (options.script && process.env.EZ_EXECUTOR_TRANSPORT !== 'host') return startScriptJob(options as ExecutorOptions & { script: ScriptLaunch })
   options = executionDefaults(executorKey(options.cli), options)
+  // Named credential homes are owner-provisioned; fail closed before any launch state.
+  if (options.authProfile !== undefined) await provisionedHome(options.controlDir, executorKey(options.cli), options.authProfile)
   // Routing is caller-owned: a restricted task run goes to the task runner
   // unless the host transport must ship it across the boundary first.
   if (options.taskRun && process.env.EZ_EXECUTOR_TRANSPORT !== 'host') return startTaskExecutor(options)
@@ -365,7 +389,7 @@ export const startExecutorJob = async (
   }
   if (!host && !gui && command === 'codex') {
     // Share the existing authentication, never the user's memory/config/sessions.
-    const base = path.join(options.controlDir, 'cli', 'codex')
+    const base = await provisionedHome(options.controlDir, 'codex', options.authProfile)
     const home = nativeSession ? path.join(base,'tasks',options.runId) : base
     await mkdir(home, {recursive:true,mode:0o700})
     if(nativeSession){
@@ -375,9 +399,10 @@ export const startExecutorJob = async (
       try{await writeFile(path.join(home,'config.toml'),await readFile(path.join(base,'config.toml')),{flag:'wx',mode:0o600})}
       catch(error){if(!['ENOENT','EEXIST'].includes((error as NodeJS.ErrnoException).code || ''))throw error}
     }
-    // Isolated agents keep auth in this CODEX_HOME. Host-capable may link the
-    // installer login. Never replace an existing binding.
-    const authLinks = process.env.EZ_ISOLATION === 'isolated'
+    // Isolated agents and named profiles keep auth in this CODEX_HOME. The
+    // host-capable default may link the installer login. Never replace an
+    // existing binding.
+    const authLinks = process.env.EZ_ISOLATION === 'isolated' || options.authProfile !== undefined
       ? nativeSession ? [[path.join(home, 'auth.json'), path.join(base, 'auth.json')]] : []
       : [[path.join(base, 'auth.json'), path.join(homedir(), '.codex', 'auth.json')],
         ...(nativeSession ? [[path.join(home, 'auth.json'), path.join(base, 'auth.json')]] : [])]
@@ -387,6 +412,22 @@ export const startExecutorJob = async (
     }
     environment.CODEX_HOME = home
   }
+  if (!host && !gui && key === 'claude') {
+    // Mirror the Codex binding: agent-bound settings, memory, plugins and
+    // sessions; never the user's personal ~/.claude configuration.
+    const home = await provisionedHome(options.controlDir, 'claude', options.authProfile)
+    await mkdir(home, {recursive:true,mode:0o700})
+    // Host-capable default homes share the installer login only. An empty
+    // secure storage dir makes Claude use its default credential store (macOS
+    // Keychain entry or ~/.claude/.credentials.json) in place, so token
+    // refreshes stay shared rather than diverging through a copy. Isolated
+    // agents and named profiles keep their own login inside CLAUDE_CONFIG_DIR.
+    // The host executor runs unlabelled, so this matches the Codex auth-link
+    // check, not resolveIsolation(). An optional owner-provisioned long-lived
+    // token (`claude setup-token`) never refreshes, so one file can be copied
+    // to every agent without them invalidating each other's OAuth session.
+    Object.assign(environment, await claudeAuthEnvironment(home, options.authProfile))
+  }
   if (!host && !gui && key === 'opencode') {
     // Point OpenCode at the agent-bound data home (cli/opencode/auth.json)
     // when the owner provisioned it. Host runs keep the installer login;
@@ -459,6 +500,39 @@ export const startExecutorJob = async (
 
 export const startGrokJob = startExecutorJob
 
+// Spawn a verified registered script with the executor identity, environment
+// allowlist and workspace confinement. No shell, model, prompt or native session.
+export const startScriptJob = async (
+  options: ExecutorOptions & { script: ScriptLaunch },
+): Promise<{ child: ChildProcess; cleanup: () => Promise<void>; stdout: string }> => {
+  const { script } = options
+  for (const value of [options.runId, script.scheduleId, script.scheduleRevision]) if (!/^[a-zA-Z0-9_-]+$/.test(value)) throw new Error('Invalid script run binding')
+  if (!Number.isFinite(Date.parse(script.dueAt))) throw new Error('Invalid script due time')
+  const environment: NodeJS.ProcessEnv = {
+    ...executorJobEnv(options),
+    EZ_SCHEDULE_ID: script.scheduleId, EZ_SCHEDULE_REVISION: script.scheduleRevision, EZ_DUE_AT: script.dueAt,
+    EZ_SCRIPT_ID: script.id, EZ_SCRIPT_REVISION: script.revision, EZ_SCRIPT_SHA256: script.sha256,
+  }
+  const verified = await new Scripts(options.controlDir).verifiedInvocation(script, options.workspace, environment.PATH)
+  let invocation = executorInvocation(verified.command, verified.args)
+  let profileDirectory: string | undefined
+  const denies = process.platform === 'darwin' ? workspaceSiblingDenies(options.workspace) : []
+  if (denies.length) {
+    profileDirectory = await mkdtemp(path.join(tmpdir(), 'ezenciel-agents-'))
+    const profile = path.join(profileDirectory, 'workspace.sb')
+    await writeFile(profile, macosWorkspaceProfile(denies, [options.controlDir, options.binDir, options.toolsHome, options.sharedWorkspace,
+      ...(options.additionalWorkspaces ?? [])].filter((value): value is string => Boolean(value))), { mode: 0o600 })
+    invocation = { command: 'sandbox-exec', args: ['-f', profile, invocation.command, ...invocation.args] }
+  }
+  const cleanup = async () => { if (profileDirectory) await rm(profileDirectory, { recursive: true, force: true }) }
+  const child = spawn(invocation.command, invocation.args, {
+    cwd: options.workspace, env: environment, stdio: ['ignore', 'pipe', 'pipe'], detached: process.platform !== 'win32', shell: false,
+  })
+  await new Promise<void>((resolve, reject) => { child.once('spawn', resolve); child.once('error', reject) })
+    .catch(async (error) => { await cleanup(); throw error })
+  return { child, cleanup, stdout: '' }
+}
+
 // Structured client events only. Model text is never interpreted or sent to chat.
 export const nativeSessionId = (cli: string, line: string): string | undefined => {
   try {

package/src/files.ts

@@ -1,8 +1,10 @@
-import { mkdir, readFile, writeFile, realpath, stat } from 'node:fs/promises'
+import { mkdir, readFile, writeFile, realpath, stat, mkdtemp, readdir, rm, unlink } from 'node:fs/promises'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
 import { randomUUID } from 'node:crypto'
 import path from 'node:path'
 
-export type DetectedFileType = 'pdf' | 'jpeg' | 'png' | 'webp' | 'text' | 'unknown'
+export type DetectedFileType = 'pdf' | 'jpeg' | 'png' | 'webp' | 'text' | 'mp4' | 'unknown'
 
 export const detectFileType = (buffer: Buffer): DetectedFileType => {
   if (buffer.length >= 5 && buffer.subarray(0, 5).toString('ascii') === '%PDF-') {
@@ -31,6 +33,9 @@ export const detectFileType = (buffer: Buffer): DetectedFileType => {
   ) {
     return 'webp'
   }
+  // ISO-BMFF also carries HEIF/AVIF stills and audio-only M4A; only video brands are MP4.
+  if (buffer.length >= 12 && buffer.subarray(4,8).toString('ascii') === 'ftyp' &&
+    !/^(hei[cmsx]|hev[cmsx]|mif1|msf1|avi[fs]|M4[ABP] |F4A )$/.test(buffer.subarray(8,12).toString('latin1'))) return 'mp4'
   try {
     new TextDecoder('utf-8', { fatal: true }).decode(buffer)
     if (!buffer.includes(0)) return 'text'
@@ -108,7 +113,46 @@ export const stageChatAttachment = async (stagingRoot: string, name: string, byt
   if (!bytes.length || bytes.length > MAX_INCOMING_ATTACHMENT_BYTES || type === 'unknown' ||
     (type === 'text' && !/\.(txt|md|markdown)$/i.test(name))) throw new Error('Invalid application attachment: unsupported type or size')
   const staged = await stageIncomingFile(stagingRoot, name, bytes)
-  const kind = ['jpeg', 'png', 'webp'].includes(staged.fileType) ? 'image' : 'document'
+  const kind = ['jpeg', 'png', 'webp'].includes(staged.fileType) ? 'image' : staged.fileType === 'mp4' ? 'video' : 'document'
   return { text: `[Attached ${kind} staged at ${staged.fullPath} (type: ${staged.fileType}, size: ${bytes.length} bytes)]${comment ? `\n\nCaption: ${comment}` : ''}`,
     attachment: {path: staged.fullPath, type: staged.fileType}, fullPath: staged.fullPath }
 }
+
+// Shared inbound staging/validation with Telegram; restricted correspondence
+// can read only this already-authorized input, never arbitrary workspace paths.
+export async function readChatAttachment(stagingRoot: string, name: string, bytes: Buffer) {
+  const staged = await stageChatAttachment(stagingRoot, name, bytes, '')
+  // Untrusted media parsers never inherit relay secrets.
+  const execute = (command: string, args: string[], options: {timeout:number;maxBuffer:number}) =>
+    promisify(execFile)(command, args, {...options, env: {PATH: process.env.PATH ?? '/usr/bin:/bin'}})
+  try {
+    if (['jpeg','png','webp'].includes(staged.attachment.type)) return {name:sanitizeFileName(name),type:staged.attachment.type,bytes:bytes.length,image:{data:bytes.toString('base64'),mimeType:`image/${staged.attachment.type}`}}
+    if (staged.attachment.type === 'mp4') {
+      const directory = await mkdtemp(path.join(stagingRoot,'video-'))
+      try {
+        const probe = JSON.parse((await execute('ffprobe',['-v','error','-protocol_whitelist','file,pipe','-show_entries','format=duration:stream=codec_type','-of','json',staged.fullPath],{timeout:3000,maxBuffer:8000})).stdout)
+        const durationSeconds = Number(probe.format?.duration)
+        if (!Number.isFinite(durationSeconds) || durationSeconds <= 0 || durationSeconds > 120 || !probe.streams?.some((stream:{codec_type:string})=>stream.codec_type==='video')) throw Error('Video must contain a visual track and be at most 120 seconds')
+        await execute('ffmpeg',['-v','error','-nostdin','-protocol_whitelist','file,pipe','-enable_drefs','0','-use_absolute_path','0','-i',staged.fullPath,'-an','-vf',`fps=fps=${8/durationSeconds}:start_time=0,scale=640:-2`,'-frames:v','8','-q:v','3',path.join(directory,'frame-%02d.jpg')],{timeout:20000,maxBuffer:8000})
+        const names=(await readdir(directory)).filter(name=>/^frame-\d{2}\.jpg$/.test(name)).sort()
+        const images=[];let total=0
+        for (const frame of names) {
+          const image=await readFile(path.join(directory,frame));total+=image.length
+          if (total>1024*1024 || detectFileType(image)!=='jpeg') throw Error('Video frames exceed the bounded image limit')
+          images.push({data:image.toString('base64'),mimeType:'image/jpeg'})
+        }
+        if (!images.length) throw Error('Video has no decodable frames')
+        return {name:sanitizeFileName(name),type:'mp4',bytes:bytes.length,durationSeconds,frames:images.map((_,index)=>({frame:index+1,seconds:index*durationSeconds/8})),images}
+      } finally { await rm(directory,{recursive:true,force:true}) }
+    }
+    const limit = 256000
+    const text = staged.attachment.type === 'text' ? new TextDecoder('utf-8', {fatal:true}).decode(bytes)
+      : (await execute('pdftotext', ['-enc','UTF-8','-layout',staged.fullPath,'-'], {timeout:20000,maxBuffer:limit + 1}).catch(error => {
+        if ((error as {code?:unknown}).code === 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER') throw Error('Extracted document exceeds the 256000-byte text limit')
+        throw error
+      })).stdout
+    if (!text.trim()) throw Error('Document has no extractable text; scanned PDFs require OCR')
+    if (Buffer.byteLength(text) > limit) throw Error('Extracted document exceeds the 256000-byte text limit')
+    return { name: sanitizeFileName(name), type: staged.attachment.type, bytes: bytes.length, text }
+  } finally { await unlink(staged.fullPath) }
+}