@jc_stack/ez-agents 0.1.0-beta.47 → 0.1.0-beta.49

package/test/ai.test.ts

@@ -632,3 +632,43 @@ test('private channel model choices do not consume owner preset slots', async ()
     assert.deepEqual((await store.applicationSession(scope))?.preset, readback.preset)
   } finally { await rm(dir, {recursive:true, force:true}) }
 })
+
+test('detected presets do not count against the saved AI cap', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-ai-cap-'))
+  try {
+    const store = new ControlStore(dir, 1000)
+    const initial = initialPreset('codex')
+    await store.captureChoice(initial)
+    for (let n = 1; n < 11; n++) await store.savePreset({...initial, id:`saved-${n}`, name:`Saved ${n}`})
+    await store.syncClientPresets(initial, ['claude', 'grok'].map(cli => ({id:`detected_${cli}`, cli, name:`${cli} · client default`})))
+    assert.equal((await store.status()).ai!.presets.length, 13)
+    const next = {id:'one-more', name:'One more', cli:'claude', model:'sonnet', effort:'medium'}
+    await store.savePreset(next)
+    await assert.rejects(store.savePreset({...next, id:'too-many', name:'Too many'}), /at most 12/)
+  } finally { await rm(dir, {recursive:true, force:true}) }
+})
+
+test('Claude catalog projects only aliases and efforts from the installed native help', async () => {
+  const help = `Options:
+  --effort <level>                      Effort level for the current session
+                                        (low, medium, high, xhigh, max)
+  --model <model>                       Model for the current session. Provide
+                                        an alias for the latest model (e.g.
+                                        'fable', 'opus', or 'sonnet') or a
+                                        model's full name.
+  -n, --name <name>                     Set a display name ('ignored')
+`
+  const calls: string[][] = []
+  const models = await readModels('/nonexistent', async cli => cli === 'claude', undefined, undefined, undefined, undefined, undefined, undefined,
+    async (args) => { calls.push(args); return help })
+  assert.deepEqual(calls, [['--help']])
+  assert.deepEqual(models, [
+    { cli: 'claude', name: 'claude · client default', efforts: [] },
+    ...['fable', 'opus', 'sonnet'].map(model => ({ cli: 'claude', model, name: `claude · ${model}`, efforts: ['low', 'medium', 'high', 'xhigh', 'max'] })),
+  ])
+  for (const unavailable of [async () => { throw new Error('not runnable') }, async () => 'Usage: claude'])
+    assert.deepEqual(await readModels('/nonexistent', async cli => cli === 'claude', undefined, undefined, undefined, undefined, undefined, undefined, unavailable),
+      [{ cli: 'claude', name: 'claude · client default', efforts: [] }])
+  await validateSelection({ id: 'c', name: 'c', cli: 'claude', model: 'opus', effort: 'xhigh' }, models, async () => true)
+  await assert.rejects(validateSelection({ id: 'c', name: 'c', cli: 'claude', model: 'opus-guess' }, models, async () => true), /not in the installed client catalog/)
+})

package/test/application-channel.test.ts

@@ -1,7 +1,7 @@
 import test from 'node:test'
 import { request as httpRequest } from 'node:http'
 import assert from 'node:assert/strict'
-import { mkdtemp, rm, writeFile, readFile } from 'node:fs/promises'
+import { mkdtemp, rm, writeFile, readFile, chown, stat } from 'node:fs/promises'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { spawnSync } from 'node:child_process'
@@ -435,3 +435,18 @@ test('shareTelegram bindings list Telegram intake and admit one run with context
   await runs.patch(finished.id,{status:'completed'})
   assert.equal((await attach(finished.id,sharedToken,{context:{}})).status,409)
 })
+
+test('administrator task grant replacement preserves the runtime file owner', {skip:process.getuid?.()!==0},async()=>{
+  const dir=await mkdtemp(join(tmpdir(),'ez-app-grant-owner-'))
+  try {
+    const who=await owner(dir),bindings=new ApplicationBindings(dir)
+    await bindings.register('voice',token(),who)
+    const file=join(dir,'application-bindings.json')
+    await chown(file,20000,20000)
+    await bindings.taskLaunch('voice',{command:'voice',args:['launch','--task'],tasks:['task_'+'a'.repeat(32)]})
+    const saved=await stat(file)
+    assert.equal(saved.uid,20000);assert.equal(saved.gid,20000);assert.equal(saved.mode&0o777,0o600)
+    await bindings.taskLaunch('voice',null)
+    const disabled=await stat(file);assert.equal(disabled.uid,20000);assert.equal(disabled.gid,20000)
+  }finally{await rm(dir,{recursive:true,force:true})}
+})

package/test/audio.test.ts

@@ -1,3 +1,4 @@
+import {execFileSync} from 'node:child_process'
 import test from 'node:test'
 import assert from 'node:assert/strict'
 import { pcmToWav, encodeOggOpus, transcribeAudio, synthesizeSpeech, SpeechCreditsDepletedError } from '../src/audio.js'
@@ -91,3 +92,21 @@ test('synthesizeSpeech rejects empty text', async () => {
     /Cannot synthesize speech for empty text/,
   )
 })
+
+
+test('OpenRouter uses the existing renderer and encoder for real Ogg Opus and WAV without provider fallback', async t => {
+  const mp3=execFileSync('ffmpeg',['-f','s16le','-ar','24000','-ac','1','-i','pipe:0','-f','mp3','pipe:1'],{input:Buffer.alloc(48000),stdio:['pipe','pipe','ignore']})
+  t.mock.method(globalThis,'fetch',async (url:string,options:RequestInit) => {
+    assert.equal(url,'https://openrouter.ai/api/v1/audio/speech')
+    assert.equal(new Headers(options.headers).get('authorization'),'Bearer fixture-key')
+    assert.deepEqual(JSON.parse(String(options.body)),{model:'fish-audio/s2.1-pro-free:free',input:'Fixture',response_format:'mp3'})
+    return new Response(mp3,{headers:{'content-type':'audio/mpeg'}})
+  })
+  const options={speechProvider:'openrouter' as const,openrouterApiKey:'fixture-key',geminiApiKey:'unused'}
+  const ogg=await synthesizeSpeech('Fixture',options)
+  assert.equal(ogg.mimeType,'audio/ogg');assert.equal(ogg.buffer.subarray(0,4).toString(),'OggS');assert.ok(ogg.buffer.includes(Buffer.from('OpusHead')))
+  const wav=await synthesizeSpeech('Fixture',{...options,format:'wav'})
+  assert.equal(wav.buffer.subarray(0,4).toString(),'RIFF');assert.equal(wav.buffer.readUInt32LE(24),24000)
+  t.mock.method(globalThis,'fetch',async () => new Response('private provider detail',{status:429}))
+  await assert.rejects(synthesizeSpeech('Fixture',options), /error 429/)
+})

package/test/auth-profiles.test.ts

@@ -0,0 +1,187 @@
+import { ownerRun } from './helpers/owner-run.js'
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { lstat, mkdir, mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises'
+import { spawn, spawnSync } from 'node:child_process'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { startExecutorJob } from '../src/executor.js'
+import { ControlStore } from '../src/control-state.js'
+import { RunStore } from '../src/runs.js'
+import { serveHostExecutor } from '../src/host-executor.js'
+import { authProfileStatus, initialPreset, readModels, validateSelection, type AiPreset } from '../src/ai.js'
+
+const restoreEnv = (keys: string[]) => {
+  const prior = Object.fromEntries(keys.map(key => [key, process.env[key]]))
+  return () => { for (const [key, value] of Object.entries(prior)) value === undefined ? delete process.env[key] : process.env[key] = value }
+}
+
+test('each Claude and Codex profile runs only with its own home and credentials', {skip:process.platform==='win32'}, async t => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-profiles-'))
+  t.after(() => rm(root, { recursive: true, force: true }))
+  t.after(restoreEnv(['PATH', 'HOME', 'EZ_ISOLATION', 'EZ_EXECUTOR_TRANSPORT']))
+  const bin = path.join(root, 'bin'), workspace = path.join(root, 'mind'), controlDir = path.join(root, 'control')
+  await mkdir(bin); await mkdir(workspace)
+  const observed = path.join(root, 'observed.json')
+  for (const cli of ['claude', 'codex']) await writeFile(path.join(bin, cli), `#!${process.execPath}
+const fs=require('fs'),p=require('path');let auth=null
+try{auth=fs.lstatSync(p.join(process.env.CODEX_HOME,'auth.json')).isSymbolicLink()?'link:'+fs.readlinkSync(p.join(process.env.CODEX_HOME,'auth.json')):'file'}catch{}
+fs.writeFileSync(${JSON.stringify(observed)},JSON.stringify({config:process.env.CLAUDE_CONFIG_DIR,storage:process.env.CLAUDE_SECURESTORAGE_CONFIG_DIR,token:process.env.CLAUDE_CODE_OAUTH_TOKEN,codexHome:process.env.CODEX_HOME,auth}))`, { mode: 0o700 })
+  process.env.PATH = bin + path.delimiter + process.env.PATH
+  process.env.HOME = root
+  delete process.env.EZ_ISOLATION; delete process.env.EZ_EXECUTOR_TRANSPORT
+  const tokens = { work: 'sk-ant-oat01-work_profile_token', personal: 'sk-ant-oat01-personal_profile_token' }
+  for (const [name, token] of Object.entries(tokens)) {
+    await mkdir(path.join(controlDir, 'cli', 'profiles', name, 'claude'), { recursive: true })
+    await writeFile(path.join(controlDir, 'cli', 'profiles', name, 'claude', 'oauth-token'), token, { mode: 0o600 })
+    await mkdir(path.join(controlDir, 'cli', 'profiles', name, 'codex'), { recursive: true })
+    await writeFile(path.join(controlDir, 'cli', 'profiles', name, 'codex', 'auth.json'), '{}', { mode: 0o600 })
+  }
+  let n = 0
+  const run = async (cli: string, authProfile?: string) => {
+    const runId = `r_profile_${n++}`
+    await ownerRun(controlDir, runId)
+    await rm(observed, { force: true })
+    const job = await startExecutorJob(['hello'], { workspace, controlDir, binDir: bin, cli, authProfile, runId, timeoutMs: 5000, repairEnabled: false })
+    assert.equal(await new Promise(resolve => job.child.once('close', resolve)), 0); await job.cleanup()
+    return JSON.parse(await readFile(observed, 'utf8'))
+  }
+  // Default bindings are unchanged: shared host login.
+  const claudeDefault = await run('claude')
+  assert.equal(claudeDefault.config, path.join(controlDir, 'cli', 'claude')); assert.equal(claudeDefault.storage, ''); assert.equal(claudeDefault.token, undefined)
+  const codexDefault = await run('codex')
+  assert.equal(codexDefault.codexHome, path.join(controlDir, 'cli', 'codex')); assert.equal(codexDefault.auth, `link:${path.join(root, '.codex', 'auth.json')}`)
+  // Named profiles use only their own store: no shared secure storage, no host link.
+  for (const [name, token] of Object.entries(tokens)) {
+    const claude = await run('claude', name)
+    assert.deepEqual(claude, { config: path.join(controlDir, 'cli', 'profiles', name, 'claude'), token, auth: null })
+    const codex = await run('codex', name)
+    assert.deepEqual(codex, { codexHome: path.join(controlDir, 'cli', 'profiles', name, 'codex'), auth: 'file' })
+  }
+  // Unprovisioned or unsupported profiles fail closed before any process starts.
+  for (const [cli, authProfile, error] of [['claude', 'missing', /not provisioned/], ['codex', 'missing', /not provisioned/], ['opencode', 'work', /Invalid auth profile/], ['claude', '../work', /Invalid auth profile/]] as const) {
+    await ownerRun(controlDir, `r_reject_${n}`); await rm(observed, { force: true })
+    await assert.rejects(startExecutorJob(['hello'], { workspace, controlDir, binDir: bin, cli, authProfile, runId: `r_reject_${n++}`, timeoutMs: 5000, repairEnabled: false }), error)
+    await assert.rejects(stat(observed))
+  }
+  assert.equal((await lstat(path.join(controlDir, 'cli', 'profiles'))).isDirectory(), true)
+  await assert.rejects(stat(path.join(controlDir, 'cli', 'profiles', 'missing')))
+})
+
+test('a conversation stays bound to its auth profile and never resumes under another', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-profile-sessions-'))
+  try {
+    const store = new ControlStore(root, 900000)
+    await store.aiState(initialPreset('claude'))
+    const work: AiPreset = { id: 'work', name: 'Claude work', cli: 'claude', authProfile: 'work', model: 'opus' }
+    const personal: AiPreset = { id: 'personal', name: 'Claude personal', cli: 'claude', authProfile: 'personal', model: 'opus' }
+    for (const preset of [work, personal]) await store.savePreset(preset)
+    const first = await store.captureChoice(initialPreset('claude'))
+    await store.markSessionStarted(first.sessionId)
+    // A profile change is a new conversation, never an in-place settings change.
+    assert.equal(await store.selectPreset('work', first.sessionId), false)
+    assert.equal(await store.selectPreset('work', first.sessionId, true), true)
+    const working = await store.captureChoice(initialPreset('claude'))
+    assert.notEqual(working.sessionId, first.sessionId)
+    assert.equal((await store.executionSession(working)).authProfile, 'work')
+    await store.markSessionStarted(working.sessionId)
+    // A choice that names another account for this session is rejected at launch.
+    await assert.rejects(store.executionSession({ sessionId: working.sessionId, preset: personal }), /matching CLI binding/)
+    await assert.rejects(store.executionSession({ sessionId: first.sessionId, preset: work }), /matching CLI binding/)
+    // Switching back restores that conversation's own account.
+    assert.equal(await store.selectPreset('personal', working.sessionId, true), true)
+    const restored = await store.switchSession(working.sessionId)
+    assert.equal(restored.authProfile, 'work')
+    assert.equal((await store.captureChoice(initialPreset('claude'))).preset.authProfile, 'work')
+  } finally { await rm(root, { recursive: true, force: true }) }
+})
+
+test('catalog offers provisioned profiles only; host refuses a request that changes the captured profile', {skip:process.platform==='win32'}, async t => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-profile-host-'))
+  t.after(() => rm(root, { recursive: true, force: true }))
+  t.after(restoreEnv(['PATH']))
+  const workspace = path.join(root, 'mind'), controlDir = path.join(root, 'control'), bin = path.join(root, 'bin'), directory = path.join(controlDir, 'host-executor')
+  await mkdir(workspace, { recursive: true }); await mkdir(bin); await mkdir(directory, { recursive: true })
+  for (const cli of ['codex', 'claude']) await writeFile(path.join(bin, cli), '#!/bin/sh\nexit 0\n', { mode: 0o700 })
+  await mkdir(path.join(controlDir, 'cli', 'profiles', 'work', 'claude'), { recursive: true })
+  process.env.PATH = bin + path.delimiter + process.env.PATH
+  const catalog = await readModels(root, undefined, path.join(controlDir, 'cli', 'codex'), undefined, undefined, undefined, controlDir)
+  assert.deepEqual(catalog.filter(model => model.authProfile), [{ cli: 'claude', name: 'work · claude · client default', efforts: [], authProfile: 'work' }])
+  await validateSelection({ id: 'w', name: 'w', cli: 'claude', authProfile: 'work' }, catalog)
+  await assert.rejects(validateSelection({ id: 'p', name: 'p', cli: 'claude', authProfile: 'personal' }, catalog), /not provisioned/)
+
+  const runs = new RunStore(controlDir)
+  await ownerRun(controlDir, 'r_seed')
+  const execution = { sessionId: '00000000-0000-4000-8000-000000000001', preset: { id: 'work', name: 'work', cli: 'claude', authProfile: 'work' } }
+  for (const id of ['r_wrong', 'r_right', 'r_dropped']) {
+    await runs.create({ id, chatId: 101, telegramUserId: 101, texts: ['hello'], execution })
+    await runs.patch(id, { status: 'running' })
+  }
+  const abort = new AbortController(), launched: string[] = []
+  const server = serveHostExecutor({ cli: 'codex', agents: [{ name: 'test', workspace, controlDir, binDir: bin }] }, abort.signal, async (_texts, options) => {
+    launched.push(`${options.runId}:${options.authProfile}`)
+    return { child: spawn(process.execPath, ['-e', 'process.exit(0)']), cleanup: async () => {}, stdout: '' }
+  }, async () => catalog)
+  try {
+    const exit = async (id: string, options: Record<string, unknown>) => {
+      await writeFile(path.join(directory, `${id}.request.json`), JSON.stringify({ texts: ['hello'], options }))
+      for (let n = 0; n < 200; n++) {
+        const events = await readFile(path.join(directory, `${id}.events`), 'utf8').catch(() => '')
+        const code = events.match(/"stream":"exit","code":(\d+)/)?.[1]
+        if (code !== undefined) return { code: Number(code), events }
+        await new Promise(resolve => setTimeout(resolve, 20))
+      }
+      throw new Error('host request did not finish')
+    }
+    for (const [id, options] of [['r_wrong', { authProfile: 'personal' }], ['r_dropped', {}]] as const) {
+      const result = await exit(id, { cli: 'claude', sessionId: execution.sessionId, ...options })
+      assert.equal(result.code, 1); assert.match(result.events, /does not match its captured AI selection/)
+    }
+    assert.equal((await exit('r_right', { cli: 'claude', authProfile: 'work', sessionId: execution.sessionId })).code, 0)
+    assert.deepEqual(launched, ['r_right:work'])
+  } finally { abort.abort(); await server }
+})
+
+test('profile setup and diagnostics never print credentials or account identity', {skip:process.platform==='win32'}, async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-profile-cli-'))
+  try {
+    const controlDir = path.join(root, 'control'), bin = path.join(root, 'bin')
+    await mkdir(bin)
+    await writeFile(path.join(bin, 'claude'), `#!/bin/sh
+if [ "$1" = auth ]; then
+  if [ -n "$CLAUDE_CODE_OAUTH_TOKEN" ]; then echo '{"loggedIn":true,"authMethod":"oauth_token","email":"owner@example.com","orgId":"org-secret"}'; exit 0; fi
+  echo '{"loggedIn":false,"authMethod":"none"}'; exit 1
+fi
+exit 0
+`, { mode: 0o700 })
+    await writeFile(path.join(bin, 'codex'), '#!/bin/sh\n[ -f "$CODEX_HOME/auth.json" ] && { echo "Logged in using ChatGPT (owner@example.com)" >&2; exit 0; }\necho "Not logged in"; exit 1\n', { mode: 0o700 })
+    const store = new ControlStore(controlDir, 900000); await store.aiState(initialPreset('claude'))
+    const env = { ...process.env, HOME: root, PATH: bin + path.delimiter + process.env.PATH, EZ_CONTROL_DIR: controlDir }
+    const ai = (...args: string[]) => spawnSync(process.execPath, [fileURLToPath(new URL('../bin/ezenciel-agents-ai.mjs', import.meta.url)), ...args], { env, encoding: 'utf8' })
+    for (const [cli, name] of [['claude', 'work'], ['claude', 'personal'], ['codex', 'work']]) {
+      const added = ai('profile', 'add', '--cli', cli, '--auth-profile', name)
+      assert.equal(added.status, 0, added.stderr)
+      const home = path.join(controlDir, 'cli', 'profiles', name, cli)
+      assert.equal(JSON.parse(added.stdout).home, home)
+      assert.equal((await stat(home)).mode & 0o777, 0o700)
+    }
+    assert.notEqual(ai('profile', 'add', '--cli', 'opencode', '--auth-profile', 'work').status, 0)
+    await writeFile(path.join(controlDir, 'cli', 'profiles', 'work', 'claude', 'oauth-token'), 'sk-ant-oat01-never_printed_token', { mode: 0o600 })
+    await writeFile(path.join(controlDir, 'cli', 'profiles', 'work', 'codex', 'auth.json'), '{"tokens":"never-printed"}', { mode: 0o600 })
+    const profiles = ai('profiles')
+    assert.equal(profiles.status, 0, profiles.stderr)
+    for (const secret of ['never_printed', 'never-printed', 'owner@example.com', 'org-secret']) assert.equal(profiles.stdout.includes(secret), false)
+    const byKey = Object.fromEntries((JSON.parse(profiles.stdout) as Awaited<ReturnType<typeof authProfileStatus>>).map(item => [`${item.cli}@${item.authProfile}`, item]))
+    assert.deepEqual(byKey['claude@work'], { cli: 'claude', authProfile: 'work', provisioned: true, sharesHostLogin: false, credentialFiles: ['oauth-token'], loggedIn: true, method: 'oauth_token' })
+    assert.equal(byKey['claude@personal'].loggedIn, false)
+    assert.deepEqual(byKey['codex@work'], { cli: 'codex', authProfile: 'work', provisioned: true, sharesHostLogin: false, credentialFiles: ['auth.json'], loggedIn: true, method: 'chatgpt' })
+    assert.equal(byKey['claude@null'].sharesHostLogin, true)
+    // Selecting a provisioned profile binds a fresh conversation to it.
+    const selected = ai('select', '--cli', 'claude', '--auth-profile', 'work')
+    assert.equal(selected.status, 0, selected.stderr)
+    assert.equal((await store.status()).activeSession?.authProfile, 'work')
+    assert.notEqual(ai('select', '--cli', 'claude', '--auth-profile', 'unknown').status, 0)
+    assert.equal((await store.status()).activeSession?.authProfile, 'work')
+  } finally { await rm(root, { recursive: true, force: true }) }
+})

package/test/config.test.ts

@@ -84,3 +84,11 @@ test('Telegram transport is inferred from a valid token; legacy flag contradicti
   assert.equal(loadConfig({ EZ_TELEGRAM_ENABLED: 'false', EZ_APPLICATION_PORT: '8110' }).telegramEnabled, false)
   assert.equal(loadConfig({ TELEGRAM_BOT_TOKEN: token, EZ_TELEGRAM_ENABLED: 'true' }).telegramEnabled, true)
 })
+
+test('scheduled concurrency defaults to six and accepts only positive integers',()=>{
+ const env={EZ_APPLICATION_PORT:'8110'}
+ assert.equal(loadConfig(env).scheduledConcurrency,6)
+ assert.equal(loadConfig({...env,EZ_SCHEDULED_CONCURRENCY:'2'}).scheduledConcurrency,2)
+ for(const value of ['0','-1','1.5','bad','9007199254740992'])
+  assert.throws(()=>loadConfig({...env,EZ_SCHEDULED_CONCURRENCY:value}),/EZ_SCHEDULED_CONCURRENCY must be a positive integer/)
+})

package/test/executor.test.ts

@@ -372,3 +372,40 @@ test('external local owner chat preserves literal input and admission rejects fo
     if(prior.transport===undefined)delete process.env.EZ_EXECUTOR_TRANSPORT;else process.env.EZ_EXECUTOR_TRANSPORT=prior.transport
   }
 })
+
+test('Claude runs with agent-bound configuration, shared login and the agent directories', {skip:process.platform==='win32'}, async t => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-claude-home-'))
+  t.after(() => rm(root, { recursive: true, force: true }))
+  const bin = path.join(root, 'bin'), workspace = path.join(root, 'mind'), controlDir = path.join(root, 'control'), shared = path.join(root, 'shared')
+  await mkdir(bin); await mkdir(workspace)
+  await writeFile(path.join(bin, 'claude'), `#!${process.execPath}\nrequire('fs').writeFileSync('observed.json',JSON.stringify({args:process.argv.slice(2),config:process.env.CLAUDE_CONFIG_DIR,storage:process.env.CLAUDE_SECURESTORAGE_CONFIG_DIR,token:process.env.CLAUDE_CODE_OAUTH_TOKEN,prompt:require('fs').readFileSync(0,'utf8')}))`, { mode: 0o700 })
+  const previous = { PATH: process.env.PATH, EZ_ISOLATION: process.env.EZ_ISOLATION, EZ_EXECUTOR_TRANSPORT: process.env.EZ_EXECUTOR_TRANSPORT }
+  t.after(() => { for (const [key, value] of Object.entries(previous)) value === undefined ? delete process.env[key] : process.env[key] = value })
+  process.env.PATH = bin + path.delimiter + process.env.PATH
+  delete process.env.EZ_EXECUTOR_TRANSPORT
+  for (const isolation of [undefined, 'isolated']) {
+    if (isolation) process.env.EZ_ISOLATION = isolation; else delete process.env.EZ_ISOLATION
+    await ownerRun(controlDir, `r_claude_${isolation ?? 'host'}`)
+    const job = await startExecutorJob(['hello'], { workspace, controlDir, binDir: bin, cli: 'claude', runId: `r_claude_${isolation ?? 'host'}`, timeoutMs: 5000,
+      sessionId: '00000000-0000-4000-8000-000000000000', sharedWorkspace: shared, model: 'opus', effort: 'high', repairEnabled: false })
+    assert.equal(await new Promise(resolve => job.child.once('close', resolve)), 0); await job.cleanup()
+    const observed = JSON.parse(await readFile(path.join(workspace, 'observed.json'), 'utf8'))
+    assert.equal(observed.config, path.join(controlDir, 'cli', 'claude'))
+    assert.equal(observed.storage, isolation ? undefined : '')
+    assert.equal(observed.prompt, 'hello')
+    for (const directory of [controlDir, shared]) assert.equal(observed.args[observed.args.indexOf(directory) - 1], '--add-dir')
+    assert.deepEqual(observed.args.slice(-4), ['--model', 'opus', '--effort', 'high'])
+    assert.equal(observed.token, undefined)
+  }
+  const run = async (runId: string) => {
+    await ownerRun(controlDir, runId)
+    const job = await startExecutorJob(['hello'], { workspace, controlDir, binDir: bin, cli: 'claude', runId, timeoutMs: 5000, repairEnabled: false })
+    assert.equal(await new Promise(resolve => job.child.once('close', resolve)), 0); await job.cleanup()
+    return JSON.parse(await readFile(path.join(workspace, 'observed.json'), 'utf8'))
+  }
+  await writeFile(path.join(controlDir, 'cli', 'claude', 'oauth-token'), 'sk-ant-oat01-fixture_token-value\n', { mode: 0o600 })
+  assert.equal((await run('r_claude_token')).token, 'sk-ant-oat01-fixture_token-value')
+  await writeFile(path.join(controlDir, 'cli', 'claude', 'oauth-token'), 'bad token\n--flag', { mode: 0o600 })
+  await ownerRun(controlDir, 'r_claude_bad_token')
+  await assert.rejects(startExecutorJob(['hello'], { workspace, controlDir, binDir: bin, cli: 'claude', runId: 'r_claude_bad_token', timeoutMs: 5000, repairEnabled: false }), /Invalid Claude token binding/)
+})

package/test/files.test.ts

@@ -48,3 +48,47 @@ test('stages file into control attachments, never the workspace', async () => {
     await rm(tmp, { recursive: true, force: true })
   }
 })
+
+test('shared incoming document reader extracts PDF text and removes its staged file', async t => {
+  const {readChatAttachment}=await import('../src/files.js')
+  const {execFile}=await import('node:child_process'), {promisify}=await import('node:util')
+  try { await promisify(execFile)('pdftotext',['-v']) } catch { t.skip('Poppler is exercised in the Docker artifact test');return }
+  const dir=await mkdtemp('/tmp/ez-pdf-read-');t.after(()=>rm(dir,{recursive:true,force:true}))
+  const stream='BT /F1 12 Tf 20 80 Td (Shop opens at 7am.) Tj ET'
+  const objects=['<< /Type /Catalog /Pages 2 0 R >>','<< /Type /Pages /Kids [3 0 R] /Count 1 >>','<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Resources << /Font << /F1 4 0 R >> >> /Contents 5 0 R >>','<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>',`<< /Length ${stream.length} >>\nstream\n${stream}\nendstream`]
+  let pdf='%PDF-1.4\n';const offsets=[0]
+  for(const [i,value] of objects.entries()){offsets.push(Buffer.byteLength(pdf));pdf+=`${i+1} 0 obj\n${value}\nendobj\n`}
+  const xref=Buffer.byteLength(pdf);pdf+='xref\n0 6\n0000000000 65535 f \n'+offsets.slice(1).map(n=>String(n).padStart(10,'0')+' 00000 n \n').join('')+`trailer\n<< /Size 6 /Root 1 0 R >>\nstartxref\n${xref}\n%%EOF\n`
+  const result=await readChatAttachment(dir,'shop.pdf',Buffer.from(pdf));assert.match(result.text ?? '',/Shop opens at 7am\./);assert.equal(result.type,'pdf')
+  const {readdir}=await import('node:fs/promises');assert.deepEqual(await readdir(path.join(dir,'attachments')),[])
+  await assert.rejects(readChatAttachment(dir,'invalid.pdf',Buffer.from('%PDF-invalid')))
+})
+
+test('shared image read returns original pixels with native MIME and no staged residue',async t=>{
+ const {readChatAttachment}=await import('../src/files.js'),{readdir}=await import('node:fs/promises')
+ const dir=await mkdtemp('/tmp/ez-image-read-');t.after(()=>rm(dir,{recursive:true,force:true}))
+ const png=Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+ip1sAAAAASUVORK5CYII=','base64')
+ const result=await readChatAttachment(dir,'photo.png',png)
+ assert.equal(result.image?.mimeType,'image/png');assert.equal(result.image?.data,png.toString('base64'));assert.equal(result.text,undefined)
+ assert.deepEqual(await readdir(path.join(dir,'attachments')),[])
+ await assert.rejects(readChatAttachment(dir,'photo.png',Buffer.from('Spoofed image bytes')))
+})
+
+test('video read uses bounded native frames and removes temporary decoder files',async t=>{
+ const {readChatAttachment}=await import('../src/files.js'),{readdir}=await import('node:fs/promises'),{execFile}=await import('node:child_process'),{promisify}=await import('node:util')
+ const execute=promisify(execFile)
+ try {await execute('ffmpeg',['-version'])}catch{t.skip('FFmpeg is exercised in the Docker artifact test');return}
+ const dir=await mkdtemp('/tmp/ez-video-read-');t.after(()=>rm(dir,{recursive:true,force:true}))
+ const video=path.join(dir,'fixture.mp4')
+ await execute('ffmpeg',['-v','error','-f','lavfi','-i','color=c=blue:s=64x64:r=8','-f','lavfi','-i','sine=frequency=1000:sample_rate=24000','-t','1','-c:v','mpeg4','-c:a','aac',video])
+ const result=await readChatAttachment(dir,'video.mp4',await readFile(video))
+ assert.equal(result.type,'mp4');assert.ok((result.images?.length??0)>0);assert.ok((result.images?.length??0)<=8)
+ assert.ok(result.images?.every(image=>image.mimeType==='image/jpeg'));assert.ok(result.durationSeconds!<=120)
+ assert.deepEqual(await readdir(path.join(dir,'attachments')),[]);assert.ok(!(await readdir(dir)).some(name=>name.startsWith('video-')))
+})
+
+test('HEIF stills and audio-only M4A are not treated as MP4 video', () => {
+  const box = (brand: string) => Buffer.concat([Buffer.from([0, 0, 0, 24]), Buffer.from(`ftyp${brand}`), Buffer.alloc(12)])
+  for (const brand of ['heic', 'avif', 'mif1', 'M4A ']) assert.equal(detectFileType(box(brand)), 'unknown')
+  for (const brand of ['isom', 'mp42']) assert.equal(detectFileType(box(brand)), 'mp4')
+})

package/test/host-executor.test.ts

@@ -13,6 +13,8 @@ import { RunStore } from '../src/runs.js'
 import { packageVersion } from '../src/version.js'
 import { executionDefaults } from '../src/model-policy.js'
 import { workspaceLease } from '../src/plugins/workspace-lease.mjs'
+import { ControlStore } from '../src/control-state.js'
+import { Scripts } from '../src/scripts.js'
 
 test('host restart replaces a lock whose PID was reused by another process',async()=>{
   const root=await mkdtemp(path.join(tmpdir(),'ez-host-reused-pid-'))
@@ -285,10 +287,10 @@ test('one installed CLI executes two agent bindings with separate minds and sani
       return output.trim().split('\n').map(line=>JSON.parse(line))
     }
     // Chat completes while this agent's scheduled turn stays active. A second
-    // scheduled turn still waits, and the shared lifecycle lease stays held.
+    // scheduled turn also completes, and the held job keeps the lifecycle lease.
     await completed(otherDirectory,'r_other_shared')
     const chatEvents=await completed(directory,'tg_42')
-    assert.ok(await readFile(path.join(directory,'r_schedule_queued.request.json')))
+    await completed(directory,'r_schedule_queued')
     assert.equal(await workspaceLease(agents[0].toolsHome),undefined)
     await ownerRun(agents[0].controlDir,'tg_43')
     await writeFile(path.join(directory,'tg_43.request.json'),JSON.stringify({texts:['Hold chat'],options:{cli:'grok'}}))
@@ -525,3 +527,44 @@ test('startup replaces prior catalog after provider policy changes even when dis
     assert.deepEqual(JSON.parse(await readFile(path.join(directory,'models.json'),'utf8')),[])
   } finally {abort.abort();await server;await rm(root,{recursive:true,force:true})}
 })
+
+test('host transport runs a registered script from the run record and refuses changed entry-point bytes', async () => {
+  const root=await mkdtemp(path.join(tmpdir(),'ez-host-script-'))
+  const workspace=path.join(root,'mind'),controlDir=path.join(root,'control'),directory=path.join(controlDir,'host-executor')
+  const abort=new AbortController();let server:Promise<void>|undefined
+  const oldToken=process.env.TELEGRAM_BOT_TOKEN
+  try {
+    await mkdir(workspace);await mkdir(directory,{recursive:true})
+    await writeFile(path.join(workspace,'guard.mjs'),"console.log(JSON.stringify({cwd:process.cwd(),args:process.argv.slice(2),due:process.env.EZ_DUE_AT,token:process.env.TELEGRAM_BOT_TOKEN}))\n")
+    process.env.TELEGRAM_BOT_TOKEN='must-not-reach-host-script'
+    await ownerRun(controlDir,'r_seed')
+    const owner=(await new ControlStore(controlDir,900000).status()).owner!
+    const registration=await new Scripts(controlDir).save({id:'guard',owner,workspace,entry:'guard.mjs',interpreter:'node',args:['saved'],timeoutSeconds:60},true)
+    const runs=new RunStore(controlDir)
+    const scripted=async(id:string)=>{
+      await runs.create({id,chatId:101,telegramUserId:101,texts:['[schedule]'],script:{id:'guard',args:['extra'],revision:registration.revision,sha256:registration.sha256},
+        scheduled:{id:'s_guard',revision:'rev1',dueAt:'2026-10-07T11:15:00.000Z',pairedAt:owner.pairedAt}})
+      await runs.patch(id,{status:'running'})
+      // The request cannot choose the command, script or workspace.
+      await writeFile(path.join(directory,`${id}.request.json`),JSON.stringify({texts:['x'],options:{workspace:'/wrong',cli:'grok',script:{id:'other',args:['injected']},timeoutMs:0}}))
+      let events:any[]=[]
+      for(let n=0;n<300;n++){try{events=(await readFile(path.join(directory,`${id}.events`),'utf8')).trim().split('\n').map(l=>JSON.parse(l));if(events.some(e=>e.stream==='exit'))break}catch{}await new Promise(r=>setTimeout(r,20))}
+      return events
+    }
+    server=serveHostExecutor({cli:'grok',agents:[{name:'test',workspace,controlDir,binDir:root}]},abort.signal,undefined,async()=>[])
+    const events=await scripted('r_schedule_script_ok')
+    assert.equal(events.find(e=>e.stream==='exit')?.code,0)
+    const result=JSON.parse(events.filter(e=>e.stream==='stdout').map(e=>e.text).join(''))
+    assert.equal(result.cwd,await realpath(workspace));assert.deepEqual(result.args,['saved','extra'])
+    assert.equal(result.due,'2026-10-07T11:15:00.000Z');assert.equal(result.token,undefined)
+    await writeFile(path.join(workspace,'guard.mjs'),"console.log('changed')\n")
+    const refused=await scripted('r_schedule_script_changed')
+    assert.equal(refused.find(e=>e.stream==='exit')?.code,1)
+    assert.equal(refused.filter(e=>e.stream==='stdout').length,0)
+    assert.match(refused.filter(e=>e.stream==='stderr').map(e=>e.text).join(''),/entry point changed since registration/)
+  }finally{
+    abort.abort();await server
+    if(oldToken===undefined)delete process.env.TELEGRAM_BOT_TOKEN;else process.env.TELEGRAM_BOT_TOKEN=oldToken
+    await rm(root,{recursive:true,force:true})
+  }
+})

package/test/install-json.test.mjs

@@ -0,0 +1,21 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { run, latestCodexVersion } from '../src/install-tools.mjs';
+
+test('Codex discovery parses stdout and retains failure diagnostics',async()=>{
+  const script=`process.stdout.write('"0.160.1"\\n');process.stderr.write('package manager notice\\n');`;
+  const invoke=(command,args,options)=>{
+    assert.equal(command,'pnpm');
+    assert.deepEqual(args,['view','@openai/codex@latest','version','--json','--registry','https://registry.npmjs.org/']);
+    assert.equal(options.stdoutOnly,true);
+    return run(process.execPath,['-e',script],options);
+  };
+  assert.equal(await latestCodexVersion(invoke,{command:'pnpm',args:[]}),'0.160.1');
+  await assert.rejects(run(process.execPath,['-e',script+'process.exitCode=1'],{stdoutOnly:true}),/package manager notice/);
+});
+
+test('Codex discovery rejects contaminated stdout without leaking it',async()=>{
+  await assert.rejects(latestCodexVersion(async()=> '"0.160.1"\nprivate-output'),{message:'Codex version discovery returned invalid JSON on stdout'});
+  for(const value of ['null','{}','["0.160.1"]','"latest"'])
+    await assert.rejects(latestCodexVersion(async()=>value),/Invalid latest Codex version/);
+});

package/test/plugin-broker.test.mjs

@@ -182,3 +182,70 @@ test('broker rejects resolve and invoke for a revoked run', async t => {
     await serving;
   }
 });
+
+test('scheduled preflight uses authoritative configuration and rejects writes or stale revisions', async t => {
+  const f = await fixture(t);
+  const { Scheduler } = await import('../src/scheduler.js');
+  const { createLedgerHandler, serveDeliverySocket } = await import('../src/delivery-socket.js');
+  const control = new ControlStore(f.controlDir, 1000);
+  const owner = (await control.status()).owner;
+  const scheduler = new Scheduler(f.controlDir);
+  const schedule = await scheduler.save({id:'check', name:'Check', text:'Saved worker', enabled:true, owner,
+    execution:{sessionId:randomUUID(),preset:{id:'test',name:'test',cli:'codex',model:'fixture-model'}},
+    trigger:{everySeconds:60,start:new Date().toISOString()},preflight:{on:'eligible',checks:[{alias:'sample',args:['queue']}]}});
+  const ledger = await serveDeliverySocket(f.controlDir, createLedgerHandler(f.controlDir,{wake:()=>{},status:()=>({polling:false,applicationOnly:true,telegramConfigured:false,version:'fixture'})}));
+  t.after(()=>ledger.stop());
+  await fs.writeFile(path.join(f.fake,'docker'), `#!${process.execPath}\nprocess.stdout.write(JSON.stringify({schemaVersion:1,eligible:true,count:1,fingerprint:'a'.repeat(64),observedAt:new Date().toISOString()}));\n`, {mode:0o700});
+  const previousPath=process.env.PATH;process.env.PATH=f.fake+path.delimiter+previousPath;
+  const binding=await loadPluginBrokerBinding({home:f.home,workspace:f.workspace,controlDir:f.controlDir,socket:f.socket,hostConfig:f.hostConfig,timeoutMs:10000});
+  const abort=new AbortController(),serving=servePluginBroker(binding,abort.signal);
+  try {
+    await waitForSocket(f.socket);
+    const payload={version:1,id:randomUUID(),operation:'preflight',scheduleId:schedule.id,revision:schedule.revision};
+    assert.equal((await request(f.socket,{...payload,args:['write']})).ok,false);
+    assert.equal((await request(f.socket,{...payload,revision:randomUUID()})).ok,false);
+    assert.equal((await request(f.socket,payload)).ok,false); // undeclared read-only command
+    const file=path.join(f.home,'registry.json'),registry=JSON.parse(await fs.readFile(file,'utf8'));
+    registry.plugins.sample.manifest.commands.sample.exposure={receivesExternalContent:true,changesRecords:false,sendsExternally:false,requiresReview:false};
+    await fs.writeFile(file,JSON.stringify(registry));
+    const accepted=await request(f.socket,payload);assert.equal(accepted.ok,true);assert.equal(accepted.result.eligible,true);
+    await fs.writeFile(path.join(f.fake,'docker'), `#!${process.execPath}\nprocess.stdout.write('SECRET-token-xyz');\n`, {mode:0o700});
+    const invalid=await request(f.socket,payload);assert.equal(invalid.ok,false);
+    assert.equal(invalid.error,'Scheduled plugin preflight returned invalid output');assert(!JSON.stringify(invalid).includes('SECRET-token-xyz'));
+    await scheduler.save({...schedule,enabled:false});
+    assert.equal((await request(f.socket,payload)).ok,false);
+  } finally {abort.abort();await serving;process.env.PATH=previousPath;}
+});
+
+test('task launch broker admits only its fixed application command and writes no bearer into receipts',async t=>{
+  const {createServer}=await import('node:http');
+  const {Tasks}=await import('../src/tasks.js');const {EventSources}=await import('../src/event-sources.js');
+  const {ApplicationBindings}=await import('../src/application-channel.js');const {serveTestLedger}=await import('./helpers/ledger.js');
+  const f=await fixture(t), runs=new RunStore(f.controlDir), control=new ControlStore(f.controlDir,900000);
+  const sourceSocket=path.join(f.root,'source.sock');const provider=createServer(async(req,res)=>{
+    let raw='';for await(const c of req)raw+=c;const v=JSON.parse(raw);
+    res.end(JSON.stringify({ok:true,data:v.command==='events-head'?{cursor:0,accountId:'fixture-account',taskProtocol:'message-v1'}:{}}));
+  });await new Promise(r=>provider.listen(sourceSocket,r));
+  const tasks=new Tasks(f.controlDir),owner=(await control.status()).owner;
+  await new EventSources(f.controlDir).register('fixture',sourceSocket,owner);
+  const task=await tasks.ownerCall(f.runId,'start',{sourceId:'fixture',conversationId:'discussion-a',purpose:'Synthetic discussion',context:'Only synthetic records',hours:1});
+  const taskRun='event_'+hash(task.id);await runs.patch(taskRun,{status:'running'});
+  const bindings=new ApplicationBindings(f.controlDir);await bindings.register('browser','z'.repeat(48),owner);
+  await bindings.taskLaunch('browser',{command:'sample',args:['launch','--task'],tasks:[task.id]});
+  const token='c'.repeat(64),ticketHash=hash(token),grant=await tasks.workerCall(taskRun,'application_launch',{application:'browser',ticketHash});
+  const input={taskId:task.id,taskToken:token,expiresAt:grant.expiresAt};
+  const ledger=await serveTestLedger(f.controlDir);
+  const binding=await loadPluginBrokerBinding({home:f.home,workspace:f.workspace,controlDir:f.controlDir,socket:f.socket,hostConfig:f.hostConfig,timeoutMs:10000});
+  const oldPath=process.env.PATH;process.env.PATH=f.fake+path.delimiter+oldPath;
+  const abort=new AbortController(),serving=servePluginBroker(binding,abort.signal);
+  try{
+    await waitForSocket(f.socket);
+    const denied=await request(f.socket,{version:1,id:randomUUID(),operation:'resolve',runId:taskRun,alias:'sample'});assert.equal(denied.ok,false);
+    const launch=await request(f.socket,{version:1,id:randomUUID(),operation:'task-launch',runId:taskRun,stdin:JSON.stringify(input)});
+    assert.equal(launch.ok,true,launch.error);assert.equal(launch.stdout,'broker-ok');assert.equal(launch.receipt.status,'completed');
+    const receipt=await fs.readFile(launch.receiptPath,'utf8');assert(!receipt.includes(token));assert(!receipt.includes('taskToken'));
+    const wrong=await request(f.socket,{version:1,id:randomUUID(),operation:'task-launch',runId:f.runId,stdin:JSON.stringify(input)});assert.equal(wrong.ok,false);
+    await bindings.taskLaunch('browser',null);
+    const revoked=await request(f.socket,{version:1,id:randomUUID(),operation:'task-launch',runId:taskRun,stdin:JSON.stringify(input)});assert.equal(revoked.ok,false);
+  }finally{abort.abort();await serving;process.env.PATH=oldPath;await ledger.stop();provider.closeAllConnections();await new Promise(r=>provider.close(r));}
+});

package/test/plugin-manager.test.mjs

@@ -652,3 +652,47 @@ test('writable folders require an explicit per-folder grant and can be revoked',
  assert.equal((await compose(config,record)).services.sample.volumes.find(v=>v.target==='/data/files').read_only,true);
  await assert.rejects(f.call('plugins','folder-unbind','sample','--service','sample','--target','/data/files','--writable'),/Supply/);
 });
+
+test('command admission waits for a live short lock without removing it',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ let release,started;
+ const ready=new Promise(resolve=>started=resolve),hold=new Promise(resolve=>release=resolve);
+ const writer=locked(f.home,async()=>{started();await hold;});
+ await ready;
+ const call=f.call('sample','read');
+ await new Promise(resolve=>setTimeout(resolve,100));
+ assert.equal(JSON.parse(await fs.readFile(path.join(f.home,'registry.lock'),'utf8')).pid,process.pid);
+ release();await writer;
+ assert.deepEqual(JSON.parse((await call).stdout),['read']);
+});
+
+test('bounded lock admission times out without stealing an interrupted lock',async t=>{
+ const f=await fixture(t),file=path.join(f.home,'registry.lock');
+ await fs.mkdir(f.home,{recursive:true});await fs.writeFile(file,'preserved');
+ await assert.rejects(locked(f.home,async()=>assert.fail('must not enter'),{waitMs:50}),/Registry busy/);
+ assert.equal(await fs.readFile(file,'utf8'),'preserved');
+});
+
+
+test('cancelled plugin upgrade drain preserves live invocation and releases admission lock',async t=>{
+ const f=await fixture(t),controller=new AbortController();
+ const directory=path.join(f.home,'command-invocations');await fs.mkdir(directory,{recursive:true});
+ const lease=path.join(directory,'00000000-0000-4000-8000-000000000000.json');
+ await fs.writeFile(lease,JSON.stringify({pid:process.pid,container:'active-call'}));
+ let activated=false;
+ const drain=locked(f.home,async()=>{activated=true;},{drainInvocations:true,signal:controller.signal});
+ for(let n=0;n<100&&!await fs.access(path.join(f.home,'registry.lock')).then(()=>true,()=>false);n++)await new Promise(resolve=>setTimeout(resolve,10));
+ controller.abort();await assert.rejects(drain,{name:'AbortError'});assert.equal(activated,false);
+ await fs.access(lease);await assert.rejects(fs.access(path.join(f.home,'registry.lock')),{code:'ENOENT'});
+});
+
+
+test('native call cancelled while admission is closed never acquires an invocation lease',async t=>{
+ const f=await fixture(t),controller=new AbortController();await fs.mkdir(f.home,{recursive:true});
+ let entered,release;const ready=new Promise(resolve=>entered=resolve),hold=new Promise(resolve=>release=resolve);
+ const activation=locked(f.home,async()=>{entered();await hold;});await ready;
+ const call=prepareCommand(f.home,'sample',[],{invocation:true,signal:controller.signal});
+ controller.abort();await assert.rejects(call,{name:'AbortError'});
+ await assert.rejects(fs.access(path.join(f.home,'command-invocations')),{code:'ENOENT'});
+ release();await activation;
+});