@jc_stack/ez-agents 0.1.0-beta.48 → 0.1.0-beta.49

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.1.0-beta.49
+
+- Upgrade compatible plugins while native work continues, draining in-flight plugin calls for activation and preserving rollback. Core updates still wait for idle.
+- Keep separate named Codex and Claude native login homes, with account-bound conversations, profile-aware model selection and fail-closed admission.
+- Try ordered saved setups for a scheduled task only after a typed failure before work begins. Hooks, model/tool activity, access denial, cancellation and uncertain transport stop fallback; quota rejection skips the same native CLI/provider scope.
+- Preserve each scheduled attempt's captured auth profile and admit only the active setup on the host transport.
+
+Beta limits: live fresh-host/reboot acceptance, two-real-account channel switching and real exhausted-account/provider rejection remain pending. Fallback applies to scheduled agent tasks only; OpenCode/Pi/Grok advance only when their CLI is unavailable. The fallback command does not select named profiles, and different credentials do not establish independent quota allowances. Publication does not establish an installed-agent upgrade or authorize provider/domain writes.
+
 ## 0.1.0-beta.48
 
 - Skip empty or unchanged scheduled work through owner-configured installed read-only plugin preflight. Invalid or unavailable reads fail closed; saved execution settings and recurring timing remain intact. The bound plugin broker is required.

package/docker/broker-update-smoke.mjs

@@ -6,8 +6,8 @@ import path from 'node:path';
 import assert from 'node:assert/strict';
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { atomic, snapshot } from '../src/plugins/manager.mjs';
-import { execute, refreshBroker } from '../src/updates/runtime.mjs';
+import { atomic, snapshot, publishBrokerPlugins } from '../src/plugins/manager.mjs';
+import { execute, refreshBroker, verifyBroker, brokerNeedsRefresh } from '../src/updates/runtime.mjs';
 const docker=(...args)=>execFileSync('docker',args,{encoding:'utf8',stdio:['ignore','pipe','pipe'],timeout:120000}).trim();
 const hash=bytes=>createHash('sha256').update(bytes).digest('hex');
 if(process.argv[2]!=='--inside') {
@@ -69,6 +69,20 @@ if(process.argv[2]!=='--inside') {
   assert.equal((await mounted()).trim(),ready.hostSha256);assert.equal((await prepare()).trim(),'prepared');
   assert.equal(ready.plugins[0].revision,b.revision);
   console.log(JSON.stringify({stage:'activation',oldBroker,newBroker,relay,hostSha256:ready.hostSha256,registrySha256:ready.registrySha256,revision:b.revision}));
+  // With the current host binding already approving both revisions, plugin-only
+  // activation/rollback must leave the broker socket and relay intact.
+  await publish(a);await publishBrokerPlugins(home,controlDir);
+  const pluginRollback=await verifyBroker(config);
+  assert.equal(pluginRollback.plugins[0].revision,a.revision);
+  assert.equal(await container('plugin-broker'),newBroker);assert.equal(await container('relay'),relay);
+  assert.equal(await brokerNeedsRefresh(config),false);assert.equal((await prepare()).trim(),'prepared');
+  await publish(b);await publishBrokerPlugins(home,controlDir);
+  const pluginActivation=await verifyBroker(config);
+  assert.equal(pluginActivation.plugins[0].revision,b.revision);
+  assert.equal(await container('plugin-broker'),newBroker);assert.equal(await container('relay'),relay);
+  assert.equal((await prepare()).trim(),'prepared');
+  console.log('PASS plugin activation/rollback: current registry accepted; broker and relay IDs preserved');
+
   await atomic(hostConfig,host([a.revision]));
   await assert.rejects(refreshBroker(config),/STRUCTURAL_READINESS_FAILED/);await assert.rejects(prepare(),/not pinned/);
   console.log('PASS unapproved B remains rejected after recreation');

package/docker/upgrade-smoke.mjs

@@ -14,7 +14,7 @@ const exec=promisify(execFile),root=await fs.realpath(await fs.mkdtemp(path.join
 const source=path.join(root,'source'),home=path.join(root,'tools'),mind=path.join(root,'mind'),control=path.join(root,'control');
 const input=path.resolve(process.env.EZ_WHATSAPP_SOURCE||new URL('../../ez_whatsapp',import.meta.url).pathname);
 const bin=new URL('../bin/ezenciel-agents-tools.mjs',import.meta.url).pathname;
-const call=async(...args)=>JSON.parse((await exec(process.execPath,[bin,'--home',home,...args],{maxBuffer:4*1024*1024})).stdout);
+const call=async(...args)=>JSON.parse((await exec(process.execPath,[bin,'--home',home,...args],{cwd:mind,maxBuffer:4*1024*1024})).stdout);
 let record;
 try {
  for(const dir of [source,mind,control])await fs.mkdir(dir);

package/docs/architecture/ai-selection.md

@@ -12,7 +12,11 @@ Each named conversation saves its model and reasoning level. Switching back thro
 `/ai` shows the current choice and saves changes immediately. Changing model or
 reasoning level on the same client and provider preserves the conversation's name
 and native history; subsequent turns pass the new settings to the native engine.
-Changing client or provider starts a separate native conversation. Old bindings
+Changing client, provider or auth profile starts a separate native conversation.
+A conversation records its client and auth profile when created; launch rejects a
+choice for another profile, so a native session never resumes under another
+account. Provisioned profiles appear as additional catalog entries for their
+client (see [auth profiles](../docker-runtime.md#auth-profiles)). Old bindings
 remain available so accepted work can finish and owners can reopen their chats.
 
 Grok/Claude accept caller-selected native UUIDs. Codex/OpenCode generate IDs, so

package/docs/docker-runtime.md

@@ -295,6 +295,34 @@ Without any login, Claude turns fail closed with the native "not logged in"
 error. Host-capable agents use the same agent-bound directory but share the
 installer login in place (`CLAUDE_SECURESTORAGE_CONFIG_DIR` empty).
 
+## Auth profiles
+
+One agent can keep several owner-provisioned Codex or Claude logins, for example
+a work and a personal account. Each named profile is a separate native home,
+`control/cli/profiles/<name>/<cli>` (`CODEX_HOME` or `CLAUDE_CONFIG_DIR`), with
+its own credentials, configuration and native sessions. The unnamed default
+keeps the bindings above unchanged. Create the empty home and get the exact
+native login command with:
+
+```sh
+ezenciel-agents-ai profile add --cli claude --auth-profile work
+```
+
+Then the owner logs in once with the printed command, inside the relay for
+isolated agents. Claude may instead use a `claude setup-token` token in that
+home's `oauth-token` (mode `600`). Ez never reads, copies or prints the
+credential. A named profile never links the host login or another home: an
+unprovisioned or logged-out profile fails closed with the native error.
+`ezenciel-agents-ai profiles` reports each home's login status (logged in,
+method, credential file names) from the native CLI without tokens or account
+identifiers.
+
+Select a profile with `ezenciel-agents-ai select --cli claude --auth-profile work`,
+the profile entries in Choose AI, or `ezenciel-agents-schedule create ...
+--auth-profile work`. A conversation is bound to its CLI and profile; changing
+profile starts a new native conversation, and a run whose request names another
+profile than its captured choice is rejected before launch.
+
 ## OpenCode auth
 
 Isolated agents run the image OpenCode with `XDG_DATA_HOME` set to the

package/docs/scheduling.md

@@ -55,6 +55,47 @@ Paused, stale-owner, overlapping or held tasks and unmet conditions cannot be
 triggered. Historical deferred tasks keep their source context
 available through `ezenciel-agents-schedule context`.
 
+## Ordered setup fallback
+
+An agent task may list up to three fallback setups after its saved one, for
+example `claude · opus → claude · sonnet → codex · gpt-6-sol`:
+
+```sh
+ezenciel-agents-schedule create --name Daily --cli claude --model opus \
+  --cron '0 9 * * *' --timezone Asia/Dubai --text 'Prepare the daily report.' \
+  --fallback cli=claude,model=sonnet,effort=medium --fallback cli=codex,model=gpt-6-sol
+```
+
+`edit` keeps the saved fallbacks unless `--fallback` replaces them or
+`--clear-fallbacks` removes them. Setups must be distinct and each needs a model.
+
+Core advances to the next setup only with typed evidence that nothing ran: the
+CLI is not installed or executable, or the provider rejected the turn before any
+model output, tool or hook item (quota/rate limit, billing, overload, server
+error, unavailable model or bad request). It stops, without replay, on access
+denial (authentication, account or organization), cancellation, relay shutdown,
+a schedule edit, a policy or unknown error, an interrupted transport, or any
+failure after work began. Evidence comes from structured events only: Codex
+native-session `codexErrorInfo` and Claude `stream-json` error fields (scheduled
+Claude runs use `--output-format stream-json`; the host forwards only a compact
+startup summary). Other engines advance only when their CLI is unavailable.
+
+A quota rejection skips the remaining setups in the same quota scope: the native
+client (`claude`, `codex` including desktop and custom Codex providers, `grok`)
+or the upstream provider for OpenCode/Pi models. A different credential alone is
+never treated as an independent allowance. Each setup runs at most once per
+occurrence.
+
+Every attempt keeps the same run ID, occurrence, schedule revision, workspace,
+delivery binding and scheduled concurrency slot, in a fresh native session.
+`run RUN_ID` shows `attempts`: each setup, quota scope, outcome, failure category
+(`cli-unavailable`, `quota`, `provider-rejected`, `access-denied`,
+`after-work-began`, `uncertain`, or `same-quota-scope` for a skipped setup), exit
+code and reported reset time. If every setup is unavailable the run fails with
+reason `setups-unavailable`, a summary of each setup, and an owner notice on
+Telegram-bound tasks. Core never purchases credits, enables overage or consumes
+reset credits; the next regular occurrence runs normally.
+
 ## Registered script schedules
 
 A schedule has one execution type. **Agent** schedules run the saved prompt with

package/docs/upgrades.md

@@ -16,7 +16,7 @@ automatic channel for core and plugins without a saved policy. Existing explicit
 stable or manual policies are preserved. The owner may select either per target.
 The main target and installed plugins version independently.
 
-Queued upgrades leave channel admission open while native work runs. The supervisor pauses admission only after work is idle and releases that pause if a turn raced the check.
+Core upgrades leave channel admission open while native work runs, then pause it after work is idle and recheck races. Plugin upgrades build while native work continues. Activation closes the existing registry admission lock, drains in-flight plugin command leases, and replaces the plugin under that lock. New native plugin calls wait for admission; an outdated revision fails before provider execution and must be rediscovered. No admitted provider operation is replayed. The shared broker and native sessions remain running. Core upgrades still require the full native-work drain. A plugin update also retains that drain if an operator replaced the broker’s single-file host binding (for example to approve new network pins), because that case still requires broker recreation.
 
 The owner chooses the saved update policy. The host supervisor owns
 interruption-safe replacement. There is one host service per agent, not a second
@@ -153,9 +153,7 @@ is required. Stable automation excludes prereleases, major changes and 0.x minor
 changes. Beta policy permits compatible prereleases. Downgrades are rejected;
 rollback is a recovery operation for the previous installation only.
 
-`apply` records one durable queued job. **The agent must finish its turn after
-queuing it.** It must not wait for completion in that same turn. The supervisor
-pauses new run admission, drains already-started work, then consumes the job.
+`apply` records one durable queued job. **For a core upgrade, the agent must finish its turn after queuing it** so the supervisor can drain native work. A plugin upgrade can complete while that turn continues; only plugin-call admission is held during activation. Calls already executing finish first.
 One job at a time; an unresolved recovery blocks new upgrades. The agent processes
 multiple requested packages over successive update requests.
 
@@ -294,12 +292,8 @@ Actual update transactions retain their existing admission, drain and rollback r
 
 ### Isolated broker readiness
 
-Isolated activation and rollback explicitly recreate only `plugin-broker` with
-`--no-deps --force-recreate --no-build --pull never --wait`. Plugin-only refresh
-pins the installed broker image ID; main activation uses the newly built image
-and rollback uses the recorded old image. This refreshes the narrow read-only
-host-configuration file mount after atomic replacement. The relay and native
-sessions are preserved during plugin-only refresh. Host-capable updates do not
+Isolated core activation and rollback explicitly recreate only `plugin-broker` with
+`--no-deps --force-recreate --no-build --pull never --wait`. Core activation uses the newly built image and rollback uses the recorded old image to refresh the single-file host binding. Plugin-only activation and rollback change directory-mounted registry files, verify the existing broker in place, and refresh its generated plugin-version inventory. They preserve the broker socket, relay and native sessions. Host-capable updates do not
 start a broker. Existing update admission and drain remain authoritative.
 
 Socket health is liveness only. Before reporting completion, the updater runs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jc_stack/ez-agents",
-  "version": "0.1.0-beta.48",
+  "version": "0.1.0-beta.49",
   "private": false,
   "type": "module",
   "description": "A lightweight foundation for persistent business AI assistants using existing AI harnesses, workspaces and plugins.",

package/src/ai-cli.ts

@@ -1,38 +1,51 @@
 import { parseArgs } from 'node:util'
 import { randomBytes } from 'node:crypto'
 import { join } from 'node:path'
-import { readFile } from 'node:fs/promises'
-import { readModels, presetProvider, validateSelection, type AiPreset } from './ai.js'
+import { mkdir, readFile } from 'node:fs/promises'
+import { authProfileStatus, readModels, presetProvider, sameChoice, sameEngine, validateSelection, type AiPreset, type ModelChoice } from './ai.js'
+import { cliHome } from './auth-profile.js'
 import { ControlStore } from './control-state.js'
 
-const {values,positionals}=parseArgs({allowPositionals:true,options:{help:{type:'boolean'},cli:{type:'string'},provider:{type:'string'},model:{type:'string'},effort:{type:'string'}}})
+const usage='Usage: ezenciel-agents-ai list | select --cli <installed-cli> [--auth-profile <name>] [--provider <provider>] [--model <model>] [--effort <effort>] | default | profiles | profile add --cli codex|claude --auth-profile <name>'
+const {values,positionals}=parseArgs({allowPositionals:true,options:{help:{type:'boolean'},cli:{type:'string'},'auth-profile':{type:'string'},provider:{type:'string'},model:{type:'string'},effort:{type:'string'}}})
 if(values.help){
-  console.log('Usage: ezenciel-agents-ai list | select --cli <installed-cli> [--provider <provider>] [--model <model>] [--effort <effort>] | default\nChoose only values returned by list. Selection affects subsequent messages; default makes the selected AI the choice for new conversations. Queued work is unchanged.')
+  console.log(`${usage}\nChoose only values returned by list. Selection affects subsequent messages; default makes the selected AI the choice for new conversations. Queued work is unchanged.\nAuth profiles are separate owner-provisioned Codex/Claude logins with their own configuration and sessions; changing profile starts a new conversation. profile add creates an empty home and prints the native login command for the owner to run; profiles reports read-only login status without secrets.`)
   process.exit(0)
 }
 if (!process.env.EZ_CONTROL_DIR) throw new Error('Use this agent’s bound control directory')
-const catalog=await readFile(join(process.env.EZ_CONTROL_DIR,'host-executor','models.json'),'utf8')
-  .then(text=>JSON.parse(text)).catch(()=>readModels(undefined,undefined,join(process.env.EZ_CONTROL_DIR!,'cli','codex'),undefined,undefined,undefined,process.env.EZ_CONTROL_DIR))
-if(positionals[0]==='list')console.log(JSON.stringify(catalog))
+const controlDir=process.env.EZ_CONTROL_DIR
+const authProfile=values['auth-profile']
+const catalog=():Promise<ModelChoice[]>=>readFile(join(controlDir,'host-executor','models.json'),'utf8')
+  .then(text=>JSON.parse(text)).catch(()=>readModels(undefined,undefined,join(controlDir,'cli','codex'),undefined,undefined,undefined,controlDir))
+if(positionals[0]==='list')console.log(JSON.stringify(await catalog()))
+else if(positionals[0]==='profiles')console.log(JSON.stringify(await authProfileStatus(controlDir)))
+else if(positionals[0]==='profile' && positionals[1]==='add'){
+  if(!authProfile)throw new Error('profile add requires --auth-profile <name>')
+  const home=cliHome(controlDir,values.cli||'',authProfile)
+  const created=await mkdir(home,{recursive:true,mode:0o700})
+  const login=values.cli==='codex' ? `CODEX_HOME=${home} codex login`
+    : `CLAUDE_CONFIG_DIR=${home} claude auth login (or store a \`claude setup-token\` token in ${home}/oauth-token, mode 600)`
+  console.log(JSON.stringify({cli:values.cli,authProfile,home,created:created!==undefined,ownerLogin:login}))
+}
 else if(positionals[0]==='default'){
-  const control=new ControlStore(process.env.EZ_CONTROL_DIR,900000)
+  const control=new ControlStore(controlDir,900000)
   const state=await control.status()
   const selected=state.ai?.presets.find(p=>p.id===state.ai?.selectedId)
   if(!selected)throw new Error('No selected AI')
-  await validateSelection(selected,catalog)
+  await validateSelection(selected,await catalog())
   await control.defaultPreset(selected.id)
   console.log(JSON.stringify({default:selected,applies:'new conversations; current and queued work unchanged'}))
 }
 else if(positionals[0]==='select'){
-  const preset:AiPreset={id:randomBytes(8).toString('hex'),name:[values.provider,values.model||values.cli,values.effort].filter(Boolean).join(' · '),cli:values.cli||'',provider:values.provider,model:values.model,effort:values.effort}
-  await validateSelection(preset,catalog)
-  const control=new ControlStore(process.env.EZ_CONTROL_DIR,900000)
+  const preset:AiPreset={id:randomBytes(8).toString('hex'),name:[values.provider,values.model||values.cli,values.effort].filter(Boolean).join(' · ')+(authProfile ? ` @${authProfile}` : ''),cli:values.cli||'',provider:values.provider,...(authProfile ? {authProfile} : {}),model:values.model,effort:values.effort}
+  await validateSelection(preset,await catalog())
+  const control=new ControlStore(controlDir,900000)
   const state=await control.status()
   if(!state.ai)throw new Error('Agent AI settings are not initialized')
-  const existing=state.ai.presets.find(p=>p.cli===preset.cli&&p.provider===preset.provider&&p.model===preset.model&&p.effort===preset.effort)
+  const existing=state.ai.presets.find(p=>sameChoice(p,preset))
   const selected=existing||preset
   if(!existing)await control.savePreset(selected)
   const current=state.ai.presets.find(p=>p.id===state.ai!.selectedId)!
-  await control.selectPreset(selected.id,state.activeSession?.sessionId??null,current.cli!==selected.cli||presetProvider(current)!==presetProvider(selected)||Boolean(state.activeSession&&!state.activeSession.cli))
+  await control.selectPreset(selected.id,state.activeSession?.sessionId??null,!sameEngine(current,selected)||presetProvider(current)!==presetProvider(selected)||Boolean(state.activeSession&&!state.activeSession.cli))
   console.log(JSON.stringify({selected,defaultUnchanged:true,applies:'subsequent messages; queued work keeps its captured choice'}))
-}else throw new Error('Use list, select --cli <installed-cli> [--provider <provider>] [--model <model>] [--effort <effort>], or default')
+}else throw new Error(usage)

package/src/ai.ts

@@ -5,12 +5,20 @@ import { execFile } from 'node:child_process'
 import { promisify } from 'node:util'
 import { homedir } from 'node:os'
 import { join, delimiter } from 'node:path'
-import { executorEnvironment, executorInvocation, executorKey, resolveExecutor } from './executor.js'
+import { CliUnavailableError, executorEnvironment, executorInvocation, executorKey, resolveExecutor } from './executor.js'
 import { desktopCodexPath } from './desktop-bridge.js'
+import { AUTH_PROFILE_CLIS, claudeAuthEnvironment, cliHome, isAuthProfile, listAuthProfiles } from './auth-profile.js'
 
-export type AiPreset = { id: string; name: string; cli: string; provider?: string; model?: string; effort?: string }
-export type ExecutionChoice = { sessionId: string; preset: AiPreset }
-export type ModelChoice = { cli: string; provider?: string; model?: string; name: string; efforts: string[] }
+export type AiPreset = { id: string; name: string; cli: string; provider?: string; authProfile?: string; model?: string; effort?: string }
+// Optional ordered fallbacks are tried only for a scheduled occurrence that never started work.
+export type ExecutionChoice = { sessionId: string; preset: AiPreset; fallbacks?: AiPreset[] }
+export const MAX_FALLBACKS = 3
+export type ModelChoice = { cli: string; provider?: string; authProfile?: string; model?: string; name: string; efforts: string[] }
+type Engine = { cli?: string; authProfile?: string }
+// A native conversation belongs to one client and one credential home.
+export const sameEngine = (a: Engine, b: Engine) => a.cli === b.cli && a.authProfile === b.authProfile
+export const sameChoice = (a: Omit<AiPreset, 'id' | 'name'>, b: Omit<AiPreset, 'id' | 'name'>) =>
+  sameEngine(a, b) && a.provider === b.provider && a.model === b.model && a.effort === b.effort
 const safe = (s: unknown): s is string => typeof s === 'string' && /^[a-zA-Z0-9_./:-]{1,160}$/.test(s)
 const knownClis = ['grok', 'codex', 'codex-gui', 'claude', 'opencode', 'pi']
 const nativeEffort = (cli: string, effort: string) =>
@@ -20,13 +28,15 @@ export const isPreset = (p: unknown): p is AiPreset => {
   const v = p as AiPreset
   return safe(v.id) && typeof v.name === 'string' && v.name.length > 0 && v.name.length <= 80 &&
     knownClis.includes(v.cli) &&
-    (v.provider === undefined || safe(v.provider)) && (v.model === undefined || safe(v.model)) && (v.effort === undefined || safe(v.effort))
+    (v.provider === undefined || safe(v.provider)) && (v.model === undefined || safe(v.model)) && (v.effort === undefined || safe(v.effort)) &&
+    (v.authProfile === undefined || (isAuthProfile(v.authProfile) && AUTH_PROFILE_CLIS.includes(v.cli)))
 }
 export const isExecutionChoice = (v: unknown): v is ExecutionChoice => {
   const c = v as ExecutionChoice | undefined
-  return Boolean(c && /^[0-9a-f-]{36}$/i.test(c.sessionId) && isPreset(c.preset))
+  return Boolean(c && /^[0-9a-f-]{36}$/i.test(c.sessionId) && isPreset(c.preset) &&
+    (c.fallbacks === undefined || (Array.isArray(c.fallbacks) && c.fallbacks.length > 0 && c.fallbacks.length <= MAX_FALLBACKS && c.fallbacks.every(isPreset))))
 }
-export const presetLabel = (p: AiPreset) => `${p.cli}${p.provider ? ` (${p.provider})` : ''} · ${p.model || 'client default'} · ${p.effort || 'default effort'}`
+export const presetLabel = (p: AiPreset) => `${p.cli}${p.authProfile ? `@${p.authProfile}` : ''}${p.provider ? ` (${p.provider})` : ''} · ${p.model || 'client default'} · ${p.effort || 'default effort'}`
 // OpenCode encodes its provider in the native provider/model identifier.
 export const presetProvider = (p: AiPreset) => p.cli === 'opencode' ? p.model?.split('/')[0] : p.provider
 // The seed delegates model selection to the native client. Project its resolved
@@ -206,7 +216,11 @@ export const readModels = async (home = homedir(), available = installed, codexH
   // establish which models Pi can execute.
   if (!allow && await available('pi')) models.push({ cli: 'pi', name: 'Pi · client default', efforts: [] })
   const curated = await readCuratedModels(curationDir)
-  if (!curated.length) return models
+  const profiles = await listAuthProfiles(curationDir)
+  // Each provisioned profile offers its client's entries under its own home.
+  const withProfiles = (listed: ModelChoice[]) => [...listed, ...profiles.flatMap(({ cli, authProfile }) =>
+    listed.filter((model) => model.cli === cli).map((model) => ({ ...model, authProfile, name: `${authProfile} · ${model.name}`.slice(0, 80) })))]
+  if (!curated.length) return withProfiles(models)
   const scoped: ModelChoice[] = []
   for (const entry of curated) {
     if (!(await available(entry.cli))) continue
@@ -216,7 +230,7 @@ export const readModels = async (home = homedir(), available = installed, codexH
   }
   const key = (m: { cli: string; provider?: string; model?: string }) => `${m.cli}‖${m.provider ?? ''}‖${m.model ?? ''}`
   const curatedKeys = new Set(scoped.map(key))
-  return [...scoped, ...models.filter((m) => !curatedKeys.has(key(m)))]
+  return withProfiles([...scoped, ...models.filter((m) => !curatedKeys.has(key(m)))])
 }
 export const opencodeCatalogModels = async (
   opencodeRunner?: (args: string[]) => Promise<string>,
@@ -252,9 +266,59 @@ export const opencodeProviderAllowlist = (env: NodeJS.ProcessEnv = process.env):
 
 export const validateSelection = async (p: AiPreset, catalog: ModelChoice[], available = installed): Promise<void> => {
   assertEffort(p.effort, p.model, p.cli)
-  if (!isPreset(p) || !(await available(p.cli))) throw new Error('This CLI is not installed.')
-  if (!p.provider && !p.model && !p.effort) return
-  const model = catalog.find((m) => m.cli === p.cli && m.provider === p.provider && m.model === p.model)
+  if (!isPreset(p)) throw new Error('This CLI is not installed.')
+  if (!(await available(p.cli))) throw new CliUnavailableError('This CLI is not installed.')
+  if (!p.provider && !p.authProfile && !p.model && !p.effort) return
+  if (p.authProfile && !p.provider && !p.model && !p.effort) {
+    if (!catalog.some((m) => sameEngine(m, p))) throw new Error('This auth profile is not provisioned for the selected CLI.')
+    return
+  }
+  const model = catalog.find((m) => sameEngine(m, p) && m.provider === p.provider && m.model === p.model)
   if (!model || (p.effort && !model.efforts.includes(p.effort)))
     throw new Error('This model/effort is not in the installed client catalog. Refresh the client and try again; no fallback was selected.')
 }
+
+export type AuthProfileStatus = { cli: string; authProfile: string | null; provisioned: boolean; sharesHostLogin: boolean
+  credentialFiles: string[]; loggedIn: boolean | null; method: string | null }
+type StatusRunner = (command: string, args: string[], env: NodeJS.ProcessEnv, cwd: string) => Promise<{ code: number | null; stdout: string; stderr: string }>
+const nativeStatus: StatusRunner = (command, args, env, cwd) => new Promise((resolve) => {
+  const invocation = executorInvocation(command, args)
+  execFile(invocation.command, invocation.args, { env, cwd, timeout: 8000, maxBuffer: 1024 * 1024 }, (error, stdout, stderr) =>
+    resolve({ code: error ? (typeof error.code === 'number' ? error.code : null) : 0, stdout: String(stdout), stderr: String(stderr) }))
+})
+const credentialNames: Record<string, string[]> = { codex: ['auth.json'], claude: ['oauth-token', '.credentials.json'] }
+
+// Read-only auth diagnostics per credential home. Native status runs with the
+// same home and credential environment as execution; only whitelisted fields
+// are projected, never tokens, account identifiers or raw native output.
+export const authProfileStatus = async (controlDir: string, available = installed, run = nativeStatus,
+  isolated = process.env.EZ_ISOLATION === 'isolated'): Promise<AuthProfileStatus[]> => {
+  const homes: { cli: string; authProfile?: string }[] = [...AUTH_PROFILE_CLIS.map((cli) => ({ cli })), ...await listAuthProfiles(controlDir)]
+  const statuses: AuthProfileStatus[] = []
+  for (const { cli, authProfile } of homes) {
+    if (!authProfile && !(await available(cli))) continue
+    const home = cliHome(controlDir, cli, authProfile)
+    const provisioned = await access(home).then(() => true, () => false)
+    const credentialFiles: string[] = []
+    for (const name of credentialNames[cli]) if (await access(join(home, name)).then(() => true, () => false)) credentialFiles.push(name)
+    let loggedIn: boolean | null = null, method: string | null = null
+    if (provisioned) {
+      try {
+        if (cli === 'codex') {
+          const result = await run('codex', ['login', 'status'], { ...executorEnvironment(), CODEX_HOME: home }, home)
+          loggedIn = result.code === null ? null : result.code === 0
+          // Codex prints its login status on stderr.
+          const text = result.stdout + result.stderr
+          method = loggedIn ? /chatgpt/i.test(text) ? 'chatgpt' : /api key/i.test(text) ? 'api-key' : 'other' : null
+        } else {
+          const result = await run('claude', ['auth', 'status', '--json'], { ...executorEnvironment(), ...await claudeAuthEnvironment(home, authProfile, isolated) }, home)
+          const status = result.code === null ? undefined : JSON.parse(result.stdout) as { loggedIn?: unknown; authMethod?: unknown }
+          loggedIn = status ? status.loggedIn === true : null
+          method = loggedIn && safe(status?.authMethod) ? status.authMethod : null
+        }
+      } catch { loggedIn = false }
+    }
+    statuses.push({ cli, authProfile: authProfile ?? null, provisioned, sharesHostLogin: !isolated && !authProfile, credentialFiles, loggedIn, method })
+  }
+  return statuses
+}

package/src/application-channel.ts

@@ -6,7 +6,7 @@ import { ControlStore, sessionTitle, telegramOwner, type ControlGuard, type Owne
 import { RunStore, type RunRecord, type OutboxItem } from './runs.js'
 import { ownsRun } from './identity.js'
 import { applicationId, validApplicationOrigin } from './application-origin.js'
-import { isPreset, type AiPreset, type ModelChoice } from './ai.js'
+import { isPreset, sameChoice, sameEngine, type AiPreset, type ModelChoice } from './ai.js'
 import { MAX_INCOMING_ATTACHMENT_BYTES, stageChatAttachment } from './files.js'
 import { assertEffort } from './model-policy.js'
 import { ApprovalStore } from './approval.js'
@@ -158,7 +158,7 @@ export class ApplicationChannel {
     const value = input as {action?: unknown; expectedSession?: unknown; sessionId?: unknown; presetId?: unknown; cli?: unknown; provider?: unknown; model?: unknown; effort?: unknown}
     if (!value || !['new','switch','select','model'].includes(String(value.action)) ||
       !(value.expectedSession === null || (typeof value.expectedSession === 'string' && /^[a-f0-9-]{36}$/.test(value.expectedSession)))) throw new Error('Invalid application control request')
-    const fields = {new:[],switch:['sessionId'],select:['presetId'],model:['cli','provider','model','effort']}[value.action as 'new'|'switch'|'select'|'model']!
+    const fields = {new:[],switch:['sessionId'],select:['presetId'],model:['cli','provider','authProfile','model','effort']}[value.action as 'new'|'switch'|'select'|'model']!
     if (Object.keys(value).some(key => !['action','expectedSession',...fields].includes(key))) throw new Error('Invalid application control fields')
     const control = new ControlStore(this.options.controlDir, 900000)
     const expected = value.expectedSession as string | null
@@ -181,7 +181,7 @@ export class ApplicationChannel {
       await controls.select(preset, expected, guard)
     }
     if (value.action === 'model') {
-      const model = (await controls.catalog()).find(item => item.cli === value.cli && item.provider === value.provider && item.model === value.model)
+      const model = (await controls.catalog()).find(item => sameEngine(item, value as {cli?:string;authProfile?:string}) && item.provider === value.provider && item.model === value.model)
       if (!model || (value.effort !== undefined && (typeof value.effort !== 'string' || !model.efforts.includes(value.effort)))) throw new Error('Invalid application model selection')
       await this.sharedBinding(bindingId)
       const preset = await controls.saveSelection(model, value.effort as string | undefined, guard)
@@ -211,10 +211,10 @@ export class ApplicationChannel {
     const owner = await this.sharedBinding(bindingId, false)
     const controls = this.options.aiControls
     if (!controls) throw new Error('Application controls unavailable')
-    const value = input as {action?:unknown; expectedSession?:unknown; presetId?:unknown; cli?:unknown; provider?:unknown; model?:unknown; effort?:unknown}
+    const value = input as {action?:unknown; expectedSession?:unknown; presetId?:unknown; cli?:unknown; provider?:unknown; authProfile?:unknown; model?:unknown; effort?:unknown}
     if (!value || !['new','select','model'].includes(String(value.action)) ||
       !(value.expectedSession===null || (typeof value.expectedSession==='string' && /^[a-f0-9-]{36}$/.test(value.expectedSession)))) throw new Error('Invalid application control request')
-    const fields = {new:[],select:['presetId'],model:['cli','provider','model','effort']}[value.action as 'new'|'select'|'model']!
+    const fields = {new:[],select:['presetId'],model:['cli','provider','authProfile','model','effort']}[value.action as 'new'|'select'|'model']!
     if (Object.keys(value).some(key=>!['action','expectedSession',...fields].includes(key))) throw new Error('Invalid application control fields')
     const hashedScope = applicationScope(bindingId,scope)
     const guard:ControlGuard = {owner,applicationScope:hashedScope,expectedSession:value.expectedSession as string|null,
@@ -231,7 +231,7 @@ export class ApplicationChannel {
       await controls.validate(preset)
     }
     if (value.action==='model') {
-      const model = (await controls.catalog()).find(item=>item.cli===value.cli && item.provider===value.provider && item.model===value.model)
+      const model = (await controls.catalog()).find(item=>sameEngine(item,value as {cli?:string;authProfile?:string}) && item.provider===value.provider && item.model===value.model)
       if (!model || (value.effort!==undefined && (typeof value.effort!=='string' || !model.efforts.includes(value.effort)))) throw new Error('Invalid application model selection')
       preset = await controls.saveSelection(model,value.effort as string|undefined,guard)
     }
@@ -257,7 +257,7 @@ export class ApplicationChannel {
         const run=await this.runs.create({id,ownerId:ownerId(access.task.owner),ownerEpoch:ownerEpoch(access.task.owner),taskId:access.task.id,texts:[v.text],execution:access.execution,application:{bindingId,scope,requestId:v.requestId,taskAccess:ticketHash}})
         this.options.wake();return run
       }
-      const value = input as { requestId?: unknown; scope?: unknown; text?: unknown; attachment?: { name?: unknown; data?: unknown }; context?: Record<string, unknown>; expectedNativeSessionId?: unknown; activateTelegram?: unknown; followTelegram?: unknown; ai?: { cli?: unknown; provider?: unknown; model?: unknown; effort?: unknown } }
+      const value = input as { requestId?: unknown; scope?: unknown; text?: unknown; attachment?: { name?: unknown; data?: unknown }; context?: Record<string, unknown>; expectedNativeSessionId?: unknown; activateTelegram?: unknown; followTelegram?: unknown; ai?: { cli?: unknown; provider?: unknown; authProfile?: unknown; model?: unknown; effort?: unknown } }
       if (!value || !applicationId(value.requestId) || !applicationId(value.scope) || typeof value.text !== 'string' || (!value.text.trim() && value.attachment === undefined) || value.text.length > 16000 || Object.keys(value).some(key => !['requestId','scope','text','attachment','context','expectedNativeSessionId','activateTelegram','followTelegram','ai'].includes(key))) throw new Error('Invalid application request')
       if (value.expectedNativeSessionId !== undefined && (typeof value.expectedNativeSessionId !== 'string' || !/^[a-zA-Z0-9_-]{1,160}$/.test(value.expectedNativeSessionId))) throw new Error('Invalid application native session assertion')
       if (value.activateTelegram !== undefined && typeof value.activateTelegram !== 'boolean') throw new Error('Invalid application Telegram activation')
@@ -266,7 +266,7 @@ export class ApplicationChannel {
       let requestedPreset: AiPreset | undefined
       if (value.ai !== undefined) {
         const candidate = { ...value.ai, id: 'application', name: 'Application selection' }
-        if (!value.ai || Object.keys(value.ai).some(key => !['cli', 'provider', 'model', 'effort'].includes(key)) || !isPreset(candidate)) throw new Error('Invalid application AI selection')
+        if (!value.ai || Object.keys(value.ai).some(key => !['cli', 'provider', 'authProfile', 'model', 'effort'].includes(key)) || !isPreset(candidate)) throw new Error('Invalid application AI selection')
         assertEffort(candidate.effort, candidate.model, candidate.cli)
         requestedPreset = candidate
       }
@@ -289,7 +289,7 @@ export class ApplicationChannel {
       const existing = await this.runs.get(id)
       if (existing) {
         await this.bindings.authorize(existing)
-        if (requestedPreset && (existing.execution?.preset.cli !== requestedPreset.cli || existing.execution?.preset.provider !== requestedPreset.provider || existing.execution?.preset.model !== requestedPreset.model || existing.execution?.preset.effort !== requestedPreset.effort)) throw new Error('Application request ID conflicts with prior AI selection')
+        if (requestedPreset && (!existing.execution || !sameChoice(existing.execution.preset, requestedPreset))) throw new Error('Application request ID conflicts with prior AI selection')
         if (Boolean(existing.application?.followTelegram) !== Boolean(value.followTelegram) || existing.application?.scope !== value.scope || (existing.application?.inputText ?? existing.texts[0]) !== value.text || existing.application?.attachmentHash !== attachmentHash) throw new Error('Application request ID conflicts with prior scope or text')
         return existing // Retried context never replaces already admitted capabilities.
       }

package/src/auth-profile.ts

@@ -0,0 +1,53 @@
+import { lstat, readdir, readFile } from 'node:fs/promises'
+import path from 'node:path'
+
+// Owner-provisioned named credential homes beside the agent default binding.
+// Unset keeps control/cli/<cli>; a name selects control/cli/profiles/<name>/<cli>
+// with its own credentials, configuration and native sessions. Ez never stores,
+// copies or prints credentials; the native CLI logs in inside the home.
+export const AUTH_PROFILE_CLIS: readonly string[] = ['codex', 'claude']
+export const isAuthProfile = (value: unknown): value is string =>
+  typeof value === 'string' && /^[a-z][a-z0-9-]{0,31}$/.test(value)
+
+export const cliHome = (controlDir: string, cli: string, authProfile?: string): string => {
+  if (authProfile === undefined) return path.join(controlDir, 'cli', cli)
+  if (!isAuthProfile(authProfile) || !AUTH_PROFILE_CLIS.includes(cli)) throw new Error('Invalid auth profile selection')
+  return path.join(controlDir, 'cli', 'profiles', authProfile, cli)
+}
+
+const realDirectory = (directory: string) => lstat(directory).then(stat => stat.isDirectory(), () => false)
+
+// A named home exists only once the owner provisioned it as a real directory.
+// Execution never creates, links or falls back from it.
+export const provisionedHome = async (controlDir: string, cli: string, authProfile?: string): Promise<string> => {
+  const home = cliHome(controlDir, cli, authProfile)
+  if (authProfile !== undefined && !await realDirectory(home)) throw new Error(`Auth profile ${authProfile} is not provisioned for ${cli}`)
+  return home
+}
+
+export const listAuthProfiles = async (controlDir?: string): Promise<{ cli: string; authProfile: string }[]> => {
+  if (!controlDir) return []
+  const names = await readdir(path.join(controlDir, 'cli', 'profiles')).catch(() => [] as string[])
+  const found: { cli: string; authProfile: string }[] = []
+  for (const authProfile of names.filter(isAuthProfile).sort())
+    for (const cli of AUTH_PROFILE_CLIS)
+      if (await realDirectory(cliHome(controlDir, cli, authProfile))) found.push({ cli, authProfile })
+  return found
+}
+
+// Claude credentials for one home. Host-capable default homes share the
+// installer login in place; named homes and isolated agents use only their
+// own store, plus an optional owner-provisioned long-lived `oauth-token`.
+export const claudeAuthEnvironment = async (home: string, authProfile?: string, isolated = process.env.EZ_ISOLATION === 'isolated'): Promise<NodeJS.ProcessEnv> => {
+  const environment: NodeJS.ProcessEnv = { CLAUDE_CONFIG_DIR: home }
+  if (!isolated && authProfile === undefined) environment.CLAUDE_SECURESTORAGE_CONFIG_DIR = ''
+  const token = await readFile(path.join(home, 'oauth-token'), 'utf8').then(value => value.trim(), (error: NodeJS.ErrnoException) => {
+    if (error.code === 'ENOENT') return undefined
+    throw error
+  })
+  if (token !== undefined) {
+    if (!/^[A-Za-z0-9._-]{20,512}$/.test(token)) throw new Error('Invalid Claude token binding')
+    environment.CLAUDE_CODE_OAUTH_TOKEN = token
+  }
+  return environment
+}

package/src/codex-session.ts

@@ -5,6 +5,7 @@ import { createInterface } from 'node:readline'
 import { fileURLToPath } from 'node:url'
 import path from 'node:path'
 import { terminateJob, validateCodexProvider, type CodexProviderBinding } from './executor.js'
+import { codexRejection, codexResetAt, startupLine } from './setup-fallback.js'
 
 type Options = {workspace:string;controlDir:string;toolsHome?:string;sharedWorkspace?:string;additionalWorkspaces?:string[];model?:string;effort?:string;prompt:string;codexSandbox?:'external';codexProvider?:CodexProviderBinding}
 type Message = {id?:number;method?:string;params?:any;result?:any;error?:{message:string;code?:number}}
@@ -17,7 +18,7 @@ export async function runCodexSession(options:Options, io:{launch?:()=>ChildProc
   const provider = options.codexProvider ? validateCodexProvider(options.codexProvider) : undefined
   const child=io.launch?.() ?? spawn('codex',['app-server','--stdio','--disable','memories','--enable','skip_host_skill_discovery'],{cwd:options.workspace,env:process.env,stdio:['pipe','pipe','pipe']})
   const emit=io.emit ?? (line=>process.stdout.write(line+'\n'))
-  let id=0,threadId:string|undefined,activeTurn:string|undefined,finished=false,sawTurn=false,hadGoal=false
+  let id=0,threadId:string|undefined,activeTurn:string|undefined,finished=false,sawTurn=false,hadGoal=false,workBegan=false,resetAt:string|undefined
   let resolveDone!:(code:number)=>void
   const done=new Promise<number>(resolve=>{resolveDone=resolve})
   const pending=new Map<number,{resolve:(value:any)=>void;reject:(error:Error)=>void;timer:ReturnType<typeof setTimeout>}>()
@@ -38,7 +39,10 @@ export async function runCodexSession(options:Options, io:{launch?:()=>ChildProc
     finish(0)
   }
   child.stderr?.pipe(process.stderr)
-  child.on('error',fail)
+  child.on('error',error=>{
+    if((error as NodeJS.ErrnoException).code==='ENOENT')emit(startupLine({workBegan:false,rejection:{category:'cli-unavailable'}}))
+    fail(error)
+  })
   child.stdin?.on('error',fail)
   child.once('close',()=>{
     for(const p of pending.values()){clearTimeout(p.timer);p.reject(new Error('Codex app-server closed'))}
@@ -57,16 +61,23 @@ export async function runCodexSession(options:Options, io:{launch?:()=>ChildProc
       // Never turn an unexpected approval/elicitation request into permission.
       send({id:message.id,error:{code:-32601,message:`Unsupported unattended request: ${message.method}`}});fail(new Error(`Codex requires attention: ${message.method}`));return
     }
+    if(message.method==='account/rateLimits/updated')resetAt=codexResetAt(message.params?.rateLimits) ?? resetAt
     if(message.params?.threadId!==threadId)return
     if(message.method==='turn/started'){activeTurn=message.params.turn.id;sawTurn=true}
+    // Any item beyond the echoed input means the provider accepted the turn.
+    if(message.method==='item/started' && message.params.item?.type!=='userMessage' && !workBegan){workBegan=true;emit(startupLine({workBegan}))}
     if(message.method==='thread/goal/updated')settled(message.params.goal)
     if(message.method==='thread/goal/cleared')settled(null)
     if(message.method==='turn/completed'){
       if(activeTurn===message.params.turn.id)activeTurn=undefined
       if(message.params.turn.status!=='completed'){
         if(message.params.turn.status==='interrupted')finish(130)
-        else fail(new Error(redactFailure(typeof message.params.turn.error?.message==='string'
+        else {
+          const category=workBegan ? undefined : codexRejection(message.params.turn.error?.codexErrorInfo)
+          if(category)emit(startupLine({workBegan,rejection:{category,...(category==='quota' && resetAt ? {resetAt} : {})}}))
+          fail(new Error(redactFailure(typeof message.params.turn.error?.message==='string'
           ? message.params.turn.error.message : 'Native turn failed without error details')))
+        }
         return
       }
       // Completion of a turn is not completion of a native goal. The native