@jc_stack/ez-agents 0.1.0-beta.48 → 0.1.0-beta.49

package/test/auth-profiles.test.ts

@@ -0,0 +1,187 @@
+import { ownerRun } from './helpers/owner-run.js'
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { lstat, mkdir, mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises'
+import { spawn, spawnSync } from 'node:child_process'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { startExecutorJob } from '../src/executor.js'
+import { ControlStore } from '../src/control-state.js'
+import { RunStore } from '../src/runs.js'
+import { serveHostExecutor } from '../src/host-executor.js'
+import { authProfileStatus, initialPreset, readModels, validateSelection, type AiPreset } from '../src/ai.js'
+
+const restoreEnv = (keys: string[]) => {
+  const prior = Object.fromEntries(keys.map(key => [key, process.env[key]]))
+  return () => { for (const [key, value] of Object.entries(prior)) value === undefined ? delete process.env[key] : process.env[key] = value }
+}
+
+test('each Claude and Codex profile runs only with its own home and credentials', {skip:process.platform==='win32'}, async t => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-profiles-'))
+  t.after(() => rm(root, { recursive: true, force: true }))
+  t.after(restoreEnv(['PATH', 'HOME', 'EZ_ISOLATION', 'EZ_EXECUTOR_TRANSPORT']))
+  const bin = path.join(root, 'bin'), workspace = path.join(root, 'mind'), controlDir = path.join(root, 'control')
+  await mkdir(bin); await mkdir(workspace)
+  const observed = path.join(root, 'observed.json')
+  for (const cli of ['claude', 'codex']) await writeFile(path.join(bin, cli), `#!${process.execPath}
+const fs=require('fs'),p=require('path');let auth=null
+try{auth=fs.lstatSync(p.join(process.env.CODEX_HOME,'auth.json')).isSymbolicLink()?'link:'+fs.readlinkSync(p.join(process.env.CODEX_HOME,'auth.json')):'file'}catch{}
+fs.writeFileSync(${JSON.stringify(observed)},JSON.stringify({config:process.env.CLAUDE_CONFIG_DIR,storage:process.env.CLAUDE_SECURESTORAGE_CONFIG_DIR,token:process.env.CLAUDE_CODE_OAUTH_TOKEN,codexHome:process.env.CODEX_HOME,auth}))`, { mode: 0o700 })
+  process.env.PATH = bin + path.delimiter + process.env.PATH
+  process.env.HOME = root
+  delete process.env.EZ_ISOLATION; delete process.env.EZ_EXECUTOR_TRANSPORT
+  const tokens = { work: 'sk-ant-oat01-work_profile_token', personal: 'sk-ant-oat01-personal_profile_token' }
+  for (const [name, token] of Object.entries(tokens)) {
+    await mkdir(path.join(controlDir, 'cli', 'profiles', name, 'claude'), { recursive: true })
+    await writeFile(path.join(controlDir, 'cli', 'profiles', name, 'claude', 'oauth-token'), token, { mode: 0o600 })
+    await mkdir(path.join(controlDir, 'cli', 'profiles', name, 'codex'), { recursive: true })
+    await writeFile(path.join(controlDir, 'cli', 'profiles', name, 'codex', 'auth.json'), '{}', { mode: 0o600 })
+  }
+  let n = 0
+  const run = async (cli: string, authProfile?: string) => {
+    const runId = `r_profile_${n++}`
+    await ownerRun(controlDir, runId)
+    await rm(observed, { force: true })
+    const job = await startExecutorJob(['hello'], { workspace, controlDir, binDir: bin, cli, authProfile, runId, timeoutMs: 5000, repairEnabled: false })
+    assert.equal(await new Promise(resolve => job.child.once('close', resolve)), 0); await job.cleanup()
+    return JSON.parse(await readFile(observed, 'utf8'))
+  }
+  // Default bindings are unchanged: shared host login.
+  const claudeDefault = await run('claude')
+  assert.equal(claudeDefault.config, path.join(controlDir, 'cli', 'claude')); assert.equal(claudeDefault.storage, ''); assert.equal(claudeDefault.token, undefined)
+  const codexDefault = await run('codex')
+  assert.equal(codexDefault.codexHome, path.join(controlDir, 'cli', 'codex')); assert.equal(codexDefault.auth, `link:${path.join(root, '.codex', 'auth.json')}`)
+  // Named profiles use only their own store: no shared secure storage, no host link.
+  for (const [name, token] of Object.entries(tokens)) {
+    const claude = await run('claude', name)
+    assert.deepEqual(claude, { config: path.join(controlDir, 'cli', 'profiles', name, 'claude'), token, auth: null })
+    const codex = await run('codex', name)
+    assert.deepEqual(codex, { codexHome: path.join(controlDir, 'cli', 'profiles', name, 'codex'), auth: 'file' })
+  }
+  // Unprovisioned or unsupported profiles fail closed before any process starts.
+  for (const [cli, authProfile, error] of [['claude', 'missing', /not provisioned/], ['codex', 'missing', /not provisioned/], ['opencode', 'work', /Invalid auth profile/], ['claude', '../work', /Invalid auth profile/]] as const) {
+    await ownerRun(controlDir, `r_reject_${n}`); await rm(observed, { force: true })
+    await assert.rejects(startExecutorJob(['hello'], { workspace, controlDir, binDir: bin, cli, authProfile, runId: `r_reject_${n++}`, timeoutMs: 5000, repairEnabled: false }), error)
+    await assert.rejects(stat(observed))
+  }
+  assert.equal((await lstat(path.join(controlDir, 'cli', 'profiles'))).isDirectory(), true)
+  await assert.rejects(stat(path.join(controlDir, 'cli', 'profiles', 'missing')))
+})
+
+test('a conversation stays bound to its auth profile and never resumes under another', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-profile-sessions-'))
+  try {
+    const store = new ControlStore(root, 900000)
+    await store.aiState(initialPreset('claude'))
+    const work: AiPreset = { id: 'work', name: 'Claude work', cli: 'claude', authProfile: 'work', model: 'opus' }
+    const personal: AiPreset = { id: 'personal', name: 'Claude personal', cli: 'claude', authProfile: 'personal', model: 'opus' }
+    for (const preset of [work, personal]) await store.savePreset(preset)
+    const first = await store.captureChoice(initialPreset('claude'))
+    await store.markSessionStarted(first.sessionId)
+    // A profile change is a new conversation, never an in-place settings change.
+    assert.equal(await store.selectPreset('work', first.sessionId), false)
+    assert.equal(await store.selectPreset('work', first.sessionId, true), true)
+    const working = await store.captureChoice(initialPreset('claude'))
+    assert.notEqual(working.sessionId, first.sessionId)
+    assert.equal((await store.executionSession(working)).authProfile, 'work')
+    await store.markSessionStarted(working.sessionId)
+    // A choice that names another account for this session is rejected at launch.
+    await assert.rejects(store.executionSession({ sessionId: working.sessionId, preset: personal }), /matching CLI binding/)
+    await assert.rejects(store.executionSession({ sessionId: first.sessionId, preset: work }), /matching CLI binding/)
+    // Switching back restores that conversation's own account.
+    assert.equal(await store.selectPreset('personal', working.sessionId, true), true)
+    const restored = await store.switchSession(working.sessionId)
+    assert.equal(restored.authProfile, 'work')
+    assert.equal((await store.captureChoice(initialPreset('claude'))).preset.authProfile, 'work')
+  } finally { await rm(root, { recursive: true, force: true }) }
+})
+
+test('catalog offers provisioned profiles only; host refuses a request that changes the captured profile', {skip:process.platform==='win32'}, async t => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-profile-host-'))
+  t.after(() => rm(root, { recursive: true, force: true }))
+  t.after(restoreEnv(['PATH']))
+  const workspace = path.join(root, 'mind'), controlDir = path.join(root, 'control'), bin = path.join(root, 'bin'), directory = path.join(controlDir, 'host-executor')
+  await mkdir(workspace, { recursive: true }); await mkdir(bin); await mkdir(directory, { recursive: true })
+  for (const cli of ['codex', 'claude']) await writeFile(path.join(bin, cli), '#!/bin/sh\nexit 0\n', { mode: 0o700 })
+  await mkdir(path.join(controlDir, 'cli', 'profiles', 'work', 'claude'), { recursive: true })
+  process.env.PATH = bin + path.delimiter + process.env.PATH
+  const catalog = await readModels(root, undefined, path.join(controlDir, 'cli', 'codex'), undefined, undefined, undefined, controlDir)
+  assert.deepEqual(catalog.filter(model => model.authProfile), [{ cli: 'claude', name: 'work · claude · client default', efforts: [], authProfile: 'work' }])
+  await validateSelection({ id: 'w', name: 'w', cli: 'claude', authProfile: 'work' }, catalog)
+  await assert.rejects(validateSelection({ id: 'p', name: 'p', cli: 'claude', authProfile: 'personal' }, catalog), /not provisioned/)
+
+  const runs = new RunStore(controlDir)
+  await ownerRun(controlDir, 'r_seed')
+  const execution = { sessionId: '00000000-0000-4000-8000-000000000001', preset: { id: 'work', name: 'work', cli: 'claude', authProfile: 'work' } }
+  for (const id of ['r_wrong', 'r_right', 'r_dropped']) {
+    await runs.create({ id, chatId: 101, telegramUserId: 101, texts: ['hello'], execution })
+    await runs.patch(id, { status: 'running' })
+  }
+  const abort = new AbortController(), launched: string[] = []
+  const server = serveHostExecutor({ cli: 'codex', agents: [{ name: 'test', workspace, controlDir, binDir: bin }] }, abort.signal, async (_texts, options) => {
+    launched.push(`${options.runId}:${options.authProfile}`)
+    return { child: spawn(process.execPath, ['-e', 'process.exit(0)']), cleanup: async () => {}, stdout: '' }
+  }, async () => catalog)
+  try {
+    const exit = async (id: string, options: Record<string, unknown>) => {
+      await writeFile(path.join(directory, `${id}.request.json`), JSON.stringify({ texts: ['hello'], options }))
+      for (let n = 0; n < 200; n++) {
+        const events = await readFile(path.join(directory, `${id}.events`), 'utf8').catch(() => '')
+        const code = events.match(/"stream":"exit","code":(\d+)/)?.[1]
+        if (code !== undefined) return { code: Number(code), events }
+        await new Promise(resolve => setTimeout(resolve, 20))
+      }
+      throw new Error('host request did not finish')
+    }
+    for (const [id, options] of [['r_wrong', { authProfile: 'personal' }], ['r_dropped', {}]] as const) {
+      const result = await exit(id, { cli: 'claude', sessionId: execution.sessionId, ...options })
+      assert.equal(result.code, 1); assert.match(result.events, /does not match its captured AI selection/)
+    }
+    assert.equal((await exit('r_right', { cli: 'claude', authProfile: 'work', sessionId: execution.sessionId })).code, 0)
+    assert.deepEqual(launched, ['r_right:work'])
+  } finally { abort.abort(); await server }
+})
+
+test('profile setup and diagnostics never print credentials or account identity', {skip:process.platform==='win32'}, async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-profile-cli-'))
+  try {
+    const controlDir = path.join(root, 'control'), bin = path.join(root, 'bin')
+    await mkdir(bin)
+    await writeFile(path.join(bin, 'claude'), `#!/bin/sh
+if [ "$1" = auth ]; then
+  if [ -n "$CLAUDE_CODE_OAUTH_TOKEN" ]; then echo '{"loggedIn":true,"authMethod":"oauth_token","email":"owner@example.com","orgId":"org-secret"}'; exit 0; fi
+  echo '{"loggedIn":false,"authMethod":"none"}'; exit 1
+fi
+exit 0
+`, { mode: 0o700 })
+    await writeFile(path.join(bin, 'codex'), '#!/bin/sh\n[ -f "$CODEX_HOME/auth.json" ] && { echo "Logged in using ChatGPT (owner@example.com)" >&2; exit 0; }\necho "Not logged in"; exit 1\n', { mode: 0o700 })
+    const store = new ControlStore(controlDir, 900000); await store.aiState(initialPreset('claude'))
+    const env = { ...process.env, HOME: root, PATH: bin + path.delimiter + process.env.PATH, EZ_CONTROL_DIR: controlDir }
+    const ai = (...args: string[]) => spawnSync(process.execPath, [fileURLToPath(new URL('../bin/ezenciel-agents-ai.mjs', import.meta.url)), ...args], { env, encoding: 'utf8' })
+    for (const [cli, name] of [['claude', 'work'], ['claude', 'personal'], ['codex', 'work']]) {
+      const added = ai('profile', 'add', '--cli', cli, '--auth-profile', name)
+      assert.equal(added.status, 0, added.stderr)
+      const home = path.join(controlDir, 'cli', 'profiles', name, cli)
+      assert.equal(JSON.parse(added.stdout).home, home)
+      assert.equal((await stat(home)).mode & 0o777, 0o700)
+    }
+    assert.notEqual(ai('profile', 'add', '--cli', 'opencode', '--auth-profile', 'work').status, 0)
+    await writeFile(path.join(controlDir, 'cli', 'profiles', 'work', 'claude', 'oauth-token'), 'sk-ant-oat01-never_printed_token', { mode: 0o600 })
+    await writeFile(path.join(controlDir, 'cli', 'profiles', 'work', 'codex', 'auth.json'), '{"tokens":"never-printed"}', { mode: 0o600 })
+    const profiles = ai('profiles')
+    assert.equal(profiles.status, 0, profiles.stderr)
+    for (const secret of ['never_printed', 'never-printed', 'owner@example.com', 'org-secret']) assert.equal(profiles.stdout.includes(secret), false)
+    const byKey = Object.fromEntries((JSON.parse(profiles.stdout) as Awaited<ReturnType<typeof authProfileStatus>>).map(item => [`${item.cli}@${item.authProfile}`, item]))
+    assert.deepEqual(byKey['claude@work'], { cli: 'claude', authProfile: 'work', provisioned: true, sharesHostLogin: false, credentialFiles: ['oauth-token'], loggedIn: true, method: 'oauth_token' })
+    assert.equal(byKey['claude@personal'].loggedIn, false)
+    assert.deepEqual(byKey['codex@work'], { cli: 'codex', authProfile: 'work', provisioned: true, sharesHostLogin: false, credentialFiles: ['auth.json'], loggedIn: true, method: 'chatgpt' })
+    assert.equal(byKey['claude@null'].sharesHostLogin, true)
+    // Selecting a provisioned profile binds a fresh conversation to it.
+    const selected = ai('select', '--cli', 'claude', '--auth-profile', 'work')
+    assert.equal(selected.status, 0, selected.stderr)
+    assert.equal((await store.status()).activeSession?.authProfile, 'work')
+    assert.notEqual(ai('select', '--cli', 'claude', '--auth-profile', 'unknown').status, 0)
+    assert.equal((await store.status()).activeSession?.authProfile, 'work')
+  } finally { await rm(root, { recursive: true, force: true }) }
+})

package/test/plugin-broker.test.mjs

@@ -209,6 +209,9 @@ test('scheduled preflight uses authoritative configuration and rejects writes or
     registry.plugins.sample.manifest.commands.sample.exposure={receivesExternalContent:true,changesRecords:false,sendsExternally:false,requiresReview:false};
     await fs.writeFile(file,JSON.stringify(registry));
     const accepted=await request(f.socket,payload);assert.equal(accepted.ok,true);assert.equal(accepted.result.eligible,true);
+    await fs.writeFile(path.join(f.fake,'docker'), `#!${process.execPath}\nprocess.stdout.write('SECRET-token-xyz');\n`, {mode:0o700});
+    const invalid=await request(f.socket,payload);assert.equal(invalid.ok,false);
+    assert.equal(invalid.error,'Scheduled plugin preflight returned invalid output');assert(!JSON.stringify(invalid).includes('SECRET-token-xyz'));
     await scheduler.save({...schedule,enabled:false});
     assert.equal((await request(f.socket,payload)).ok,false);
   } finally {abort.abort();await serving;process.env.PATH=previousPath;}

package/test/plugin-manager.test.mjs

@@ -672,3 +672,27 @@ test('bounded lock admission times out without stealing an interrupted lock',asy
  await assert.rejects(locked(f.home,async()=>assert.fail('must not enter'),{waitMs:50}),/Registry busy/);
  assert.equal(await fs.readFile(file,'utf8'),'preserved');
 });
+
+
+test('cancelled plugin upgrade drain preserves live invocation and releases admission lock',async t=>{
+ const f=await fixture(t),controller=new AbortController();
+ const directory=path.join(f.home,'command-invocations');await fs.mkdir(directory,{recursive:true});
+ const lease=path.join(directory,'00000000-0000-4000-8000-000000000000.json');
+ await fs.writeFile(lease,JSON.stringify({pid:process.pid,container:'active-call'}));
+ let activated=false;
+ const drain=locked(f.home,async()=>{activated=true;},{drainInvocations:true,signal:controller.signal});
+ for(let n=0;n<100&&!await fs.access(path.join(f.home,'registry.lock')).then(()=>true,()=>false);n++)await new Promise(resolve=>setTimeout(resolve,10));
+ controller.abort();await assert.rejects(drain,{name:'AbortError'});assert.equal(activated,false);
+ await fs.access(lease);await assert.rejects(fs.access(path.join(f.home,'registry.lock')),{code:'ENOENT'});
+});
+
+
+test('native call cancelled while admission is closed never acquires an invocation lease',async t=>{
+ const f=await fixture(t),controller=new AbortController();await fs.mkdir(f.home,{recursive:true});
+ let entered,release;const ready=new Promise(resolve=>entered=resolve),hold=new Promise(resolve=>release=resolve);
+ const activation=locked(f.home,async()=>{entered();await hold;});await ready;
+ const call=prepareCommand(f.home,'sample',[],{invocation:true,signal:controller.signal});
+ controller.abort();await assert.rejects(call,{name:'AbortError'});
+ await assert.rejects(fs.access(path.join(f.home,'command-invocations')),{code:'ENOENT'});
+ release();await activation;
+});

package/test/setup-fallback.test.ts

@@ -0,0 +1,245 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { spawn } from 'node:child_process'
+import { once } from 'node:events'
+import { createRelay } from '../src/index.js'
+import { ControlStore } from '../src/control-state.js'
+import { RunStore, activeSetup } from '../src/runs.js'
+import { Scheduler } from '../src/scheduler.js'
+import { CliUnavailableError, EXECUTOR_REGISTRY, type ExecutorOptions } from '../src/executor.js'
+import { codexRejection, nextSetup, quotaScope, startupObserver, startupLine } from '../src/setup-fallback.js'
+import type { AiPreset } from '../src/ai.js'
+
+const until=async(check:()=>Promise<boolean>)=>{for(let i=0;i<250;i++){if(await check())return;await new Promise(r=>setTimeout(r,20))}throw new Error('Timed out')}
+const setup=(id:string,cli:string,model:string):AiPreset=>({id,name:id,cli,model})
+const claudeA=setup('claude-a','claude','opus'),claudeB=setup('claude-b','claude','sonnet')
+const codexA=setup('codex-a','codex','gpt-6-sol'),codexB=setup('codex-b','codex','gpt-6-astra')
+const observe=(...lines:unknown[])=>{const o=startupObserver();o.write(lines.map(l=>typeof l==='string'?l:JSON.stringify(l)).join('\n')+'\n');return o.result()}
+
+test('startup observer advances only on typed rejection before any work',()=>{
+  assert.deepEqual(observe({type:'system',subtype:'init'},{type:'rate_limit_event',rate_limit_info:{status:'rejected',resetsAt:1791460800}},{type:'assistant',error:'rate_limit',message:{content:[]}},{type:'result',is_error:true}),
+    {workBegan:false,rejection:{category:'quota',resetAt:'2026-10-08T12:00:00.000Z'}})
+  assert.equal(observe({type:'assistant',error:'authentication_failed'}).rejection?.category,'access-denied')
+  assert.equal(observe({type:'assistant',error:'model_not_found'}).rejection?.category,'provider-rejected')
+  // Real output, unknown errors and unparseable lines all count as work.
+  assert.equal(observe({type:'assistant',message:{content:[{type:'tool_use'}]}},{type:'assistant',error:'rate_limit'}).workBegan,true)
+  assert.equal(observe({type:'assistant',error:'unknown'}).workBegan,true)
+  assert.equal(observe('plain text').workBegan,true)
+  for (const subtype of ['hook_started','hook_progress','hook_response','unknown'])
+    assert.equal(observe({type:'system',subtype},{type:'assistant',error:'rate_limit'}).workBegan,true)
+  // Ez transport summaries (Codex native session, host-forwarded Claude) and session metadata.
+  assert.deepEqual(observe({type:'thread.started',thread_id:'t'},startupLine({workBegan:false,rejection:{category:'cli-unavailable'}})),{workBegan:false,rejection:{category:'cli-unavailable'}})
+  assert.equal(observe(startupLine({workBegan:true}),startupLine({workBegan:false,rejection:{category:'quota'}})).workBegan,true)
+})
+
+test('only scheduled Claude runs stream structured events',()=>{
+  assert.deepEqual(EXECUTOR_REGISTRY.claude.buildArgs({workspace:'/w',nativeSession:true},'','').slice(-3),['--output-format','stream-json','--verbose'])
+  assert.ok(!EXECUTOR_REGISTRY.claude.buildArgs({workspace:'/w'},'','').includes('stream-json'))
+})
+
+test('codex errors map to categories; policy and context errors never advance',()=>{
+  assert.equal(codexRejection('usageLimitExceeded'),'quota')
+  assert.equal(codexRejection('unauthorized'),'access-denied')
+  assert.equal(codexRejection('serverOverloaded'),'provider-rejected')
+  assert.equal(codexRejection({responseTooManyFailedAttempts:{httpStatusCode:429}}),'quota')
+  assert.equal(codexRejection({httpConnectionFailed:{httpStatusCode:403}}),'access-denied')
+  for(const info of ['cyberPolicy','contextWindowExceeded','other',{httpConnectionFailed:{httpStatusCode:null}},undefined]) assert.equal(codexRejection(info),undefined)
+})
+
+test('a quota rejection skips later setups in the same scope, even with different credentials',()=>{
+  assert.equal(quotaScope(claudeA),quotaScope(claudeB))
+  assert.equal(quotaScope({...codexA,provider:'bridge'}),quotaScope(codexB))
+  assert.equal(quotaScope({id:'p',name:'p',cli:'pi',model:'opencode-go/m'}),quotaScope({id:'o',name:'o',cli:'opencode',model:'opencode-go/x'}))
+  const first={preset:claudeA,quotaScope:'claude',outcome:'failed' as const,category:'quota' as const}
+  const next=nextSetup([claudeA,claudeB,codexA,codexB],[first])
+  assert.equal(next.preset,codexA);assert.deepEqual(next.skipped.map(s=>[s.preset.id,s.outcome,s.category]),[['claude-b','skipped','same-quota-scope']])
+  // A non-quota rejection (model unavailable) leaves the scope eligible.
+  assert.equal(nextSetup([claudeA,claudeB],[{...first,category:'provider-rejected'}]).preset,claudeB)
+})
+
+type Script={lines?:unknown[];code?:number;unavailable?:boolean;hold?:boolean}
+const fixture=async(name:string,scripts:Script[],fallbacks=[claudeB,codexA,codexB],primary=claudeA)=>{
+  const dir=await mkdtemp(join(tmpdir(),`ez-fallback-${name}-`)),control=new ControlStore(dir,1000),runs=new RunStore(dir),scheduler=new Scheduler(dir)
+  const launches:ExecutorOptions[]=[],admitted:(AiPreset|undefined)[]=[],sent:string[]=[]
+  const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'codex',telegramBotToken:'fixture'},async(_texts,options)=>{
+    const script=scripts[launches.length] ?? {code:0}
+    launches.push(options);admitted.push(activeSetup((await runs.get(options.runId))!))
+    if(script.unavailable)throw new CliUnavailableError(`Native CLI ${options.cli} is not executable on the host PATH`)
+    const out=(script.lines ?? []).map(l=>typeof l==='string'?l:JSON.stringify(l)).join('\n')
+    const child=spawn(process.execPath,['-e',`process.stdout.write(${JSON.stringify(out ? out+'\n' : '')});setTimeout(()=>process.exit(${script.code ?? 0}),${script.hold ? 60000 : 10})`],{detached:process.platform!=='win32'})
+    await once(child,'spawn');return {child,cleanup:async()=>{},stdout:''}
+  })
+  relay.bot.api.config.use(async(_prev,method,payload)=>{if(method==='sendMessage')sent.push((payload as {text:string}).text);return {ok:true,result:{message_id:42}} as never})
+  await control.requestPairing(101,101);await control.approveOwner(101)
+  const owner=(await control.status()).owner!
+  const saved=await scheduler.save({id:'daily',name:'Daily',text:'Saved work',owner,execution:{sessionId:'00000000-0000-4000-8000-000000000000',preset:primary,fallbacks},enabled:true,trigger:{at:'2027-01-01T00:00:00Z'}},true)
+  const run=await scheduler.trigger(saved.id,saved.revision,'fallback-'+name,owner,runs)
+  await relay.drainSources()
+  return {dir,runs,scheduler,relay,run,launches,admitted,sent,done:async()=>{await until(async()=>['completed','failed','cancelled'].includes((await runs.get(run.id))!.status));return (await runs.get(run.id))!},
+    close:async()=>{await relay.stop();await rm(dir,{recursive:true,force:true})}}
+}
+const quota={type:'assistant',error:'rate_limit'},work={type:'assistant',message:{content:[{type:'text',text:'working'}]}}
+
+test('a quota rejection before work advances within the same occurrence, skipping the exhausted scope',async()=>{
+  const f=await fixture('advance',[{lines:[{type:'rate_limit_event',rate_limit_info:{status:'rejected',resetsAt:1791460800}},quota],code:1},{lines:[startupLine({workBegan:true})],code:0}])
+  try{
+    const run=await f.done()
+    assert.equal(run.status,'completed');assert.equal(run.id,f.run.id)
+    assert.deepEqual(f.launches.map(l=>[l.cli,l.model,l.runId,l.nativeSession]),[['claude','opus',f.run.id,true],['codex','gpt-6-sol',f.run.id,true]])
+    assert.notEqual(f.launches[0].sessionId,f.launches[1].sessionId)
+    assert.deepEqual(f.admitted.map(p=>p?.id),['claude-a','codex-a'])
+    assert.deepEqual(run.attempts!.map(a=>[a.preset.id,a.outcome,a.category,a.resetAt]),[
+      ['claude-a','failed','quota','2026-10-08T12:00:00.000Z'],['claude-b','skipped','same-quota-scope',undefined],['codex-a','completed',undefined,undefined]])
+    assert.equal((await f.runs.list()).filter(r=>r.scheduled?.id==='daily').length,1)
+  }finally{await f.close()}
+})
+
+test('failure after work began, access denial and unknown failures stop without replay',async()=>{
+  for(const [name,lines,category] of [['partial',[work,quota],'after-work-began'],['hook',[{type:'system',subtype:'hook_started'},quota],'after-work-began'],['denied',[{type:'assistant',error:'authentication_failed'}],'access-denied'],['silent',[],'uncertain']] as const){
+    const f=await fixture(name,[{lines:[...lines],code:1}])
+    try{
+      const run=await f.done()
+      assert.equal(run.status,'failed',name);assert.equal(f.launches.length,1,name)
+      assert.deepEqual(run.attempts!.map(a=>[a.preset.id,a.outcome,a.category]),[['claude-a','failed',category]],name)
+    }finally{await f.close()}
+  }
+})
+
+test('each scheduled attempt launches with its own captured auth profile',async()=>{
+  const primary={...claudeA,authProfile:'work'}
+  const f=await fixture('profile',[{lines:[{type:'assistant',error:'model_not_found'}],code:1},{lines:[work],code:0}],[claudeB],primary)
+  try{
+    assert.equal((await f.done()).status,'completed')
+    assert.deepEqual(f.launches.map(l=>[l.cli,l.model,l.authProfile]),[['claude','opus','work'],['claude','sonnet',undefined]])
+  }finally{await f.close()}
+})
+
+test('cancellation stops the chain',async()=>{
+  const f=await fixture('cancel',[{lines:[quota],hold:true}])
+  try{
+    await until(async()=>Boolean((await f.runs.get(f.run.id))?.pid))
+    await f.scheduler.cancel(f.run.id)
+    await f.relay.drainSources()
+    const run=await f.done()
+    assert.equal(run.status,'cancelled');assert.equal(f.launches.length,1)
+    assert.deepEqual(run.attempts!.map(a=>a.outcome),['cancelled'])
+  }finally{await f.close()}
+})
+
+test('when every setup is unavailable the run reports each setup clearly',async()=>{
+  const f=await fixture('none',[{unavailable:true},{unavailable:true}],[codexA])
+  try{
+    const run=await f.done()
+    assert.equal(run.status,'failed');assert.equal(run.failureReason,'setups-unavailable')
+    assert.deepEqual(run.attempts!.map(a=>[a.preset.id,a.category]),[['claude-a','cli-unavailable'],['codex-a','cli-unavailable']])
+    assert.match(run.failure!.error,/Every task setup was unavailable: claude · opus .*\(cli-unavailable\); codex · gpt-6-sol/)
+    assert.match(f.sent.join('\n'),/could not start\. Every task setup was unavailable/)
+  }finally{await f.close()}
+})
+
+test('schedules reject duplicate or excess setups and the socket cannot rewrite attempts',async()=>{
+  const dir=await mkdtemp(join(tmpdir(),'ez-fallback-validate-')),control=new ControlStore(dir,1000),scheduler=new Scheduler(dir)
+  try{
+    await control.requestPairing(101,101);await control.approveOwner(101)
+    const owner=(await control.status()).owner!,base={id:'t',name:'T',text:'Work',owner,enabled:true,trigger:{at:'2027-01-01T00:00:00Z'}}
+    const execution=(fallbacks:AiPreset[])=>({sessionId:'00000000-0000-4000-8000-000000000000',preset:claudeA,fallbacks})
+    await assert.rejects(scheduler.save({...base,execution:execution([{...claudeA,id:'copy'}])}),/distinct/)
+    await assert.rejects(scheduler.save({...base,execution:execution([claudeB,codexA,codexB,setup('x','codex','other')])}),/AI selection/)
+    await assert.rejects(scheduler.save({...base,execution:execution([{...codexA,model:undefined}])}),/explicit model/)
+    const forged=[{preset:setup('forged','claude','opus-max'),quotaScope:'claude',outcome:'running' as const}]
+    assert.equal(activeSetup({execution:execution([claudeB]),attempts:forged}),undefined)
+    const {serveTestLedger}=await import('./helpers/ledger.js'),{callDeliverySocket,socketPathFor}=await import('../src/delivery-socket.js')
+    const ledger=await serveTestLedger(dir)
+    try{
+      const run=await new RunStore(dir).create({chatId:101,telegramUserId:101,texts:['x'],execution:execution([claudeB])})
+      await assert.rejects(callDeliverySocket(socketPathFor(dir),{op:'patch',payload:{runId:run.id,change:{attempts:forged}}}),/relay-owned/)
+    }finally{await ledger.stop()}
+  }finally{await rm(dir,{recursive:true,force:true})}
+})
+
+test('host transport admits only the active task setup and profile, forwards only Claude startup summaries',async()=>{
+  const root=await mkdtemp(join(tmpdir(),'ez-fallback-host-')),workspace=join(root,'mind'),controlDir=join(root,'control'),directory=join(controlDir,'host-executor')
+  const {mkdir,writeFile,readFile}=await import('node:fs/promises'),{serveHostExecutor}=await import('../src/host-executor.js')
+  const abort=new AbortController(),launched:{cli?:string;model?:string;authProfile?:string}[]=[],oldPath=process.env.PATH
+  const primary={...claudeA,authProfile:'work'}
+  let server:Promise<void>|undefined
+  try{
+    await mkdir(workspace,{recursive:true});await mkdir(directory,{recursive:true});await mkdir(join(root,'bin'))
+    await writeFile(join(root,'bin','claude'),'#!/bin/sh\nexit 0\n',{mode:0o700})
+    process.env.PATH=join(root,'bin')+':'+oldPath
+    const control=new ControlStore(controlDir,900_000);await control.requestPairing(101,101);await control.approveOwner(101)
+    const owner=(await control.status()).owner!,runs=new RunStore(controlDir),id='r_schedule_fallback'
+    await runs.create({id,chatId:101,telegramUserId:101,texts:['work'],execution:{sessionId:'00000000-0000-4000-8000-000000000000',preset:primary,fallbacks:[claudeB]},
+      scheduled:{id:'daily',revision:'rev',dueAt:new Date().toISOString(),pairedAt:owner.pairedAt}})
+    await runs.patch(id,{status:'running',attempts:[{preset:primary,quotaScope:'claude',outcome:'running'}]})
+    server=serveHostExecutor({cli:'claude',agents:[{name:'t',workspace,controlDir,binDir:join(root,'bin')}]},abort.signal,async(_texts,options)=>{
+      launched.push({cli:options.cli,model:options.model,authProfile:options.authProfile})
+      const lines=options.model==='opus'?[JSON.stringify({type:'system',subtype:'init'}),JSON.stringify({type:'assistant',error:'model_not_found',message:{content:[{type:'text',text:'secret tool output'}]}})].join('\n')+'\n':''
+      const child=spawn(process.execPath,['-e',`process.stdout.write(${JSON.stringify(lines)});process.exit(1)`])
+      return {child,cleanup:async()=>{},stdout:''}
+    },async()=>[{cli:'claude',authProfile:'work',model:'opus',name:'Work',efforts:[]}])
+    const events=async()=>{for(let n=0;n<150;n++){try{const text=await readFile(join(directory,id+'.events'),'utf8');if(text.includes('"stream":"exit"'))return text}catch{};await new Promise(r=>setTimeout(r,20))}throw new Error('No exit event')}
+    const request=(options:object)=>writeFile(join(directory,id+'.request.json'),JSON.stringify({texts:['work'],options}))
+    for(let n=0;n<100 && !await readFile(join(directory,'heartbeat.json')).then(()=>true,()=>false);n++)await new Promise(r=>setTimeout(r,20))
+    await request({cli:'claude',model:'opus',authProfile:'work'})
+    const first=await events()
+    const summaries=first.trim().split('\n').map(l=>JSON.parse(l)).filter(e=>e.stream==='stdout').flatMap(e=>e.text.trim().split('\n').map((l:string)=>JSON.parse(l)))
+    assert.ok(summaries.every((e:{type:string})=>e.type==='ez.startup'))
+    assert.deepEqual(summaries.at(-1),{type:'ez.startup',workBegan:false,rejection:{category:'provider-rejected'}})
+    assert.doesNotMatch(first,/secret tool output/)
+    const {rm:remove}=await import('node:fs/promises');await remove(join(directory,id+'.events'))
+    // The relay advances: the next attempt reuses the run ID.
+    await runs.patch(id,{attempts:[{preset:primary,quotaScope:'claude',outcome:'failed',category:'provider-rejected'},{preset:claudeB,quotaScope:'claude',outcome:'running'}]})
+    await request({cli:'claude',model:'sonnet'})
+    await events();await remove(join(directory,id+'.events'))
+    assert.deepEqual(launched.map(l=>[l.cli,l.model,l.authProfile]),[['claude','opus','work'],['claude','sonnet',undefined]])
+    await request({cli:'claude',model:'sonnet',authProfile:'work'})
+    assert.match(await events(),/auth profile does not match its captured AI selection/)
+    await remove(join(directory,id+'.events'))
+    // A request for a setup other than the active attempt is refused before launch.
+    await request({cli:'claude',model:'opus'})
+    assert.match(await events(),/does not match its saved task model/)
+    assert.equal(launched.length,2)
+  }finally{abort.abort();await server;process.env.PATH=oldPath;await rm(root,{recursive:true,force:true})}
+})
+
+test('Codex native session reports typed pre-work rejection and work start',async(t)=>{
+  t.mock.method(console,'error',()=>{})
+  const {runCodexSession}=await import('../src/codex-session.js')
+  for(const worked of [false,true]){
+    const program=`const rl=require('readline').createInterface({input:process.stdin});const send=x=>process.stdout.write(JSON.stringify(x)+'\\n');
+const event=(method,params)=>send({method,params:{threadId:'th',...params}});
+rl.on('line',line=>{const q=JSON.parse(line);if(!q.id)return;
+if(q.method==='initialize')return send({id:q.id,result:{}});
+if(q.method==='thread/start')return send({id:q.id,result:{thread:{id:'th'}}});
+if(q.method==='turn/start'){send({id:q.id,result:{turn:{id:'one'}}});event('turn/started',{turn:{id:'one'}});
+ event('item/started',{item:{type:'userMessage'}});${worked ? "event('item/started',{item:{type:'agentMessage'}});" : ''}
+ send({method:'account/rateLimits/updated',params:{rateLimits:{primary:{usedPercent:100,resetsAt:1791460800}}}});
+ event('turn/completed',{turn:{id:'one',status:'failed',error:{message:'limit',codexErrorInfo:'usageLimitExceeded'}}})}});setInterval(()=>{},1000);`
+    const output:string[]=[]
+    const code=await runCodexSession({workspace:'/tmp',controlDir:'/tmp/control',model:'gpt-6-sol',prompt:'work'},{launch:()=>spawn(process.execPath,['-e',program],{stdio:['pipe','pipe','pipe'],detached:process.platform!=='win32'}),emit:line=>output.push(line)})
+    assert.equal(code,1)
+    const o=startupObserver();o.write(output.join('\n')+'\n')
+    assert.deepEqual(o.result(),worked ? {workBegan:true,rejection:undefined} : {workBegan:false,rejection:{category:'quota',resetAt:'2026-10-08T12:00:00.000Z'}})
+  }
+})
+
+test('schedule CLI saves ordered fallbacks, preserves them on edit and clears them explicitly',async t=>{
+  const {execFile}=await import('node:child_process'),{promisify}=await import('node:util'),{fileURLToPath}=await import('node:url'),{serveTestLedger}=await import('./helpers/ledger.js')
+  const exec=promisify(execFile),bin=fileURLToPath(new URL('../bin/ezenciel-agents-schedule.mjs',import.meta.url))
+  const dir=await mkdtemp(join(tmpdir(),'ez-fallback-cli-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+  const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
+  const control=new ControlStore(dir,1000);await control.requestPairing(101,101);await control.approveOwner(101)
+  const env={...process.env,EZ_CONTROL_DIR:dir,EZ_RUN_ID:''}
+  const cli=async(...args:string[])=>JSON.parse((await exec(process.execPath,[bin,...args],{env})).stdout)
+  const when=['--at','2027-09-09T09:00:00+04:00','--text','Work']
+  const saved=await cli('create','chain','--cli','claude','--model','opus',...when,'--fallback','cli=claude,model=sonnet,effort=medium','--fallback','cli=codex,model=gpt-6-sol')
+  assert.deepEqual(saved.execution.fallbacks.map((p:AiPreset)=>[p.cli,p.model,p.effort]),[['claude','sonnet','medium'],['codex','gpt-6-sol',undefined]])
+  assert.deepEqual((await cli('edit','chain','--cli','claude','--model','opus',...when)).execution.fallbacks,saved.execution.fallbacks)
+  assert.equal((await cli('edit','chain','--cli','claude','--model','opus',...when,'--clear-fallbacks')).execution.fallbacks,undefined)
+  await assert.rejects(exec(process.execPath,[bin,'create','bad','--cli','claude','--model','opus',...when,'--fallback','cli=codex'],{env}),/cli=EXECUTOR,model=MODEL/)
+  await assert.rejects(exec(process.execPath,[bin,'create','dup','--cli','claude','--model','opus',...when,'--fallback','cli=claude,model=opus'],{env}),/distinct/)
+})

package/test/updates.test.mjs

@@ -9,11 +9,11 @@ import { createServer } from 'node:net';
 import { promisify } from 'node:util';
 import { extract, digest, version, newer, compatible } from '../src/updates/artifact.mjs';
 import { prepare, submit, command, read, jobPath, eligibility, jobs, cleanupStaleBackups, reviewedPluginDeploymentMigration } from '../src/updates/control.mjs';
-import { perform, environment, packageManager, backupStateDirectory, execute } from '../src/updates/runtime.mjs';
+import { perform, environment, packageManager, backupStateDirectory, execute, brokerNeedsRefresh } from '../src/updates/runtime.mjs';
 import { atomic, snapshot, compose, prepareCommand } from '../src/plugins/manager.mjs';
 import { bindUpdates } from '../src/updates/binding.mjs';
 import { status as runtimeStatus } from '../src/updates/status.mjs';
-import { providerEnvironment, queueAutomatic, waitForHostHeartbeat, withIdleUpgrade } from '../src/updates/supervisor.mjs';
+import { providerEnvironment, queueAutomatic, waitForHostHeartbeat, withIdleUpgrade, withUpgrade } from '../src/updates/supervisor.mjs';
 const exec=promisify(execFile);
 
 test('structured runtime output excludes warnings but failures retain diagnostics',async()=>{
@@ -120,6 +120,7 @@ function runtime(f,{fail,stopped=false,buildArgs={CODEX_CLI_VERSION:'0.156.1'},l
   if(args.at(-1)==='--version')return '10.30.3';
   if(args.includes('config'))return JSON.stringify({services:{relay:{build:{args:buildArgs}}}});
   if(args.includes('ps'))return stopped?'':'a'.repeat(64);
+  if(args.some(arg=>arg.includes("const fs=require('fs'),crypto=require('crypto')")))return digest(await fs.readFile(path.join(f.config.deploymentDir,'host-executor.json')));
   if(args.some(arg=>arg.includes('EZ_BROKER_STRUCTURAL_READINESS_FAILED'))) {const [hostSha256,registrySha256,configSha256]=args.slice(-3);return JSON.stringify({version:1,ready:true,hostSha256,registrySha256,configSha256,plugins:[]});}
   if(args[0]==='image'&&args[1]==='inspect')return 'sha256:'+'b'.repeat(64);
   if(args.includes('--force-recreate'))brokerImage=(await fs.readFile(args[args.lastIndexOf('--env-file')+1],'utf8')).trim().split('=')[1];
@@ -387,7 +388,7 @@ test('plugin updates register additive command routes on an unchanged deployment
  const dispatch=await prepareCommand(f.home,'query',[]);assert.deepEqual(dispatch.argv.slice(-4),['node','sample','/app/bin/example.mjs','query']);
  assert(r.calls.some(call=>call.includes('up')));
 });
-test('isolated plugin replacement recreates only the pinned broker and verifies activation and rollback',async t=>{
+test('isolated plugin replacement preserves the live broker and verifies activation and rollback',async t=>{
  const f=await fixture(t,'plugin');
  await fs.appendFile(path.join(f.config.deploymentDir,'docker.env'),'EZ_EXECUTOR_TRANSPORT=local\n');
  const job=await queued(f),r=runtime(f),execute=r.execute;
@@ -407,10 +408,11 @@ test('isolated plugin replacement recreates only the pinned broker and verifies
  const interrupted=await read(path.join(jobPath(f.home,job.id),'job.json'));interrupted.status='applying';
  assert.equal((await perform(f.home,interrupted,r)).status,'rolled-back');
  assert.equal(observed,'0.1.0');assert.equal(interrupted.rollbackBrokerReadiness.ready,true);
- assert.equal(r.calls.filter(call=>call.includes('--force-recreate')).length,2);
+ assert.equal(r.calls.filter(call=>call.includes('--force-recreate')).length,0);
  assert(!r.calls.some(call=>call.includes('restart')||call[0]==='stopHost'));
+ assert.equal((await read(path.join(f.agent.controlDir,'plugin-broker-plugins.json'))).plugins[0].version,'0.1.0');
 });
-for(const boundary of ['recreate','probe','readback'])test(`isolated broker ${boundary} failure cannot complete an update`,async t=>{
+for(const boundary of ['probe','readback'])test(`isolated broker ${boundary} failure cannot complete an update`,async t=>{
  const f=await fixture(t,'plugin');await fs.appendFile(path.join(f.config.deploymentDir,'docker.env'),'EZ_EXECUTOR_TRANSPORT=local\n');
  const job=await queued(f),r=runtime(f),base=r.execute;
  r.execute=async(c,a,o)=>{
@@ -698,3 +700,54 @@ for(const mode of ['exact','wrong-image','unhealthy']) test(`recovery reuses onl
  assert.equal(calls.some(c=>c.includes('stop')),mode!=='exact');
  assert.equal((await read(path.join(f.home,'config.json'))).packageRoot,f.old);
 });
+
+
+test('plugin upgrade builds during a native turn, then gates and drains calls for activation',async t=>{
+ const f=await fixture(t,'plugin'),job=await queued(f),r=runtime(f),execute=r.execute;
+ await fs.mkdir(path.join(f.agent.controlDir,'host-executor'));
+ await atomic(path.join(f.agent.controlDir,'host-executor/task.running.json'),{pid:process.pid});
+ let built,continueBuild;
+ const building=new Promise(resolve=>built=resolve),hold=new Promise(resolve=>continueBuild=resolve);
+ r.execute=async(command,args,options)=>{
+  if(args.includes('build')) {
+   await assert.rejects(fs.access(path.join(f.home,'registry.lock')),{code:'ENOENT'});
+   built();await hold;
+  }
+  return execute(command,args,options);
+ };
+ const upgrade=withUpgrade(f.agent.controlDir,job,new AbortController().signal,()=>perform(f.home,job,r),{isIdle:async()=>false});
+ await building;
+ const oldCall=await prepareCommand(f.home,'sample',[],{invocation:true});
+ continueBuild();
+ for(let n=0;n<100&&!await fs.access(path.join(f.home,'registry.lock')).then(()=>true,()=>false);n++)await new Promise(resolve=>setTimeout(resolve,10));
+ await fs.access(path.join(f.home,'registry.lock'));
+ assert(!r.calls.some(call=>call.includes('stop')));
+ let admitted=false;
+ const nextCall=prepareCommand(f.home,'sample',[],{invocation:true}).then(command=>{admitted=true;return command;});
+ await new Promise(resolve=>setTimeout(resolve,50));assert.equal(admitted,false);
+ await oldCall.release();
+ assert.equal((await upgrade).status,'completed');
+ const command=await nextCall;assert.equal(command.revision,(await read(path.join(f.home,'registry.json'))).plugins.sample.revision);await command.release();
+ await fs.access(path.join(f.agent.controlDir,'host-executor/task.running.json'));
+ await assert.rejects(fs.access(path.join(f.agent.controlDir,'upgrade-pause.json')),{code:'ENOENT'});
+ assert(!r.calls.some(call=>call[0]==='stopHost'||call.includes('--force-recreate')));
+});
+
+test('core upgrades still defer for active work; cancelled plugin admission never applies',async t=>{
+ const root=await fs.mkdtemp(path.join(tmpdir(),'ez-plugin-admission-'));t.after(()=>fs.rm(root,{recursive:true,force:true}));
+ const controller=new AbortController();let applied=0;
+ await withUpgrade(root,{id:'core',target:'main'},controller.signal,async()=>applied++,{isIdle:async()=>false});assert.equal(applied,0);
+ controller.abort();await withUpgrade(root,{id:'plugin',target:'sample'},controller.signal,async()=>applied++);assert.equal(applied,0);
+});
+
+
+test('changed single-file broker binding retains full native drain and broker recreation',async t=>{
+ const f=await fixture(t,'plugin'),job=await queued(f),r=runtime(f);
+ await fs.appendFile(path.join(f.config.deploymentDir,'docker.env'),'EZ_EXECUTOR_TRANSPORT=local\n');
+ const execute=r.execute;r.execute=async(c,a,o)=>a.some(arg=>arg.includes("const fs=require('fs'),crypto=require('crypto')"))?'0'.repeat(64):execute(c,a,o);
+ assert.equal(await brokerNeedsRefresh(f.config,r.execute),true);
+ let applied=false;
+ await withUpgrade(f.agent.controlDir,job,new AbortController().signal,async()=>{applied=true;},{requiresIdle:true,isIdle:async()=>false});assert.equal(applied,false);
+ assert.equal((await perform(f.home,job,{...r,refreshPluginBroker:true})).status,'completed');
+ assert.equal(r.calls.filter(call=>call.includes('--force-recreate')).length,1);
+});