@jc_stack/ez-agents 0.1.0-beta.48 → 0.1.0-beta.50

package/src/executor.ts

@@ -12,6 +12,7 @@ import { fileURLToPath } from 'node:url'
 import { DESKTOP_UNAVAILABLE } from './desktop-bridge.js'
 import { macosWorkspaceProfile, workspaceSiblingDenies } from './workspace-confine.js'
 import { Scripts, type ScriptRunRef } from './scripts.js'
+import { claudeAuthEnvironment, cliHome, provisionedHome } from './auth-profile.js'
 
 export type ExecutorOptions = {
   repairEnabled?: boolean
@@ -35,6 +36,8 @@ export type ExecutorOptions = {
   model?: string
   effort?: string
   provider?: string
+  // Named owner-provisioned credential home; unset keeps the agent default.
+  authProfile?: string
   codexSandbox?: 'external'
   codexAutoCompactTokens?: number
   codexProvider?: CodexProviderBinding
@@ -95,6 +98,10 @@ export const executorJobEnv = (
 
 export const grokJobEnv = executorJobEnv
 
+// The selected native CLI is not installed or not executable. Nothing ran, so a
+// scheduled occurrence may advance to its next setup.
+export class CliUnavailableError extends Error {}
+
 // Package binDir is Ez tools (ezenciel-agents-message). Native CLIs come from the
 // host PATH so one agent's wrapper cannot retarget another agent's CODEX_HOME.
 export const resolveHostCommand = (command: string, pathValue = process.env.PATH): string => {
@@ -107,14 +114,14 @@ export const resolveHostCommand = (command: string, pathValue = process.env.PATH
       return candidate
     } catch { /* try the next PATH entry */ }
   }
-  throw new Error(`Native CLI ${command} is not executable on the host PATH`)
+  throw new CliUnavailableError(`Native CLI ${command} is not executable on the host PATH`)
 }
 export type CliAdapter = {
   name: string
   command: string
   description: string
   buildArgs: (
-    options: Pick<ExecutorOptions, 'workspace' | 'sessionId' | 'isResume' | 'model' | 'effort' | 'toolsHome' | 'sharedWorkspace' | 'additionalWorkspaces' | 'codexAutoCompactTokens' | 'codexSandbox' | 'codexProvider'> & { controlDir?: string },
+    options: Pick<ExecutorOptions, 'workspace' | 'sessionId' | 'isResume' | 'model' | 'effort' | 'toolsHome' | 'sharedWorkspace' | 'additionalWorkspaces' | 'codexAutoCompactTokens' | 'codexSandbox' | 'codexProvider' | 'nativeSession'> & { controlDir?: string },
     promptFile: string,
     promptText: string,
   ) => string[]
@@ -161,6 +168,9 @@ export const EXECUTOR_REGISTRY: Record<string, CliAdapter> = {
         args.push('--session-id', opts.sessionId)
       }
       args.push('--print', '--dangerously-skip-permissions')
+      // Scheduled runs stream structured events so core can tell a provider
+      // rejection before work from a failure after work began.
+      if (opts.nativeSession) args.push('--output-format', 'stream-json', '--verbose')
       for (const directory of [opts.controlDir, opts.sharedWorkspace, ...(opts.additionalWorkspaces ?? []), opts.toolsHome])
         if (directory) args.push('--add-dir', directory)
       if (opts.model) args.push('--model', opts.model)
@@ -294,7 +304,7 @@ export const opencodeDataHome = (controlDir: string): string | undefined => {
 }
 
 // Agent-bound Claude Code configuration directory (CLAUDE_CONFIG_DIR).
-export const claudeConfigHome = (controlDir: string): string => path.join(controlDir, 'cli', 'claude')
+export const claudeConfigHome = (controlDir: string, authProfile?: string): string => cliHome(controlDir, 'claude', authProfile)
 
 // Pi resolves its provider/model catalog from an agent dir (settings.json,
 // auth.json). Only a path is ever returned, never a secret.
@@ -336,6 +346,8 @@ export const startExecutorJob = async (
 ): Promise<{ child: ChildProcess; cleanup: () => Promise<void>; stdout: string }> => {
   if (options.script && process.env.EZ_EXECUTOR_TRANSPORT !== 'host') return startScriptJob(options as ExecutorOptions & { script: ScriptLaunch })
   options = executionDefaults(executorKey(options.cli), options)
+  // Named credential homes are owner-provisioned; fail closed before any launch state.
+  if (options.authProfile !== undefined) await provisionedHome(options.controlDir, executorKey(options.cli), options.authProfile)
   // Routing is caller-owned: a restricted task run goes to the task runner
   // unless the host transport must ship it across the boundary first.
   if (options.taskRun && process.env.EZ_EXECUTOR_TRANSPORT !== 'host') return startTaskExecutor(options)
@@ -377,7 +389,7 @@ export const startExecutorJob = async (
   }
   if (!host && !gui && command === 'codex') {
     // Share the existing authentication, never the user's memory/config/sessions.
-    const base = path.join(options.controlDir, 'cli', 'codex')
+    const base = await provisionedHome(options.controlDir, 'codex', options.authProfile)
     const home = nativeSession ? path.join(base,'tasks',options.runId) : base
     await mkdir(home, {recursive:true,mode:0o700})
     if(nativeSession){
@@ -387,9 +399,10 @@ export const startExecutorJob = async (
       try{await writeFile(path.join(home,'config.toml'),await readFile(path.join(base,'config.toml')),{flag:'wx',mode:0o600})}
       catch(error){if(!['ENOENT','EEXIST'].includes((error as NodeJS.ErrnoException).code || ''))throw error}
     }
-    // Isolated agents keep auth in this CODEX_HOME. Host-capable may link the
-    // installer login. Never replace an existing binding.
-    const authLinks = process.env.EZ_ISOLATION === 'isolated'
+    // Isolated agents and named profiles keep auth in this CODEX_HOME. The
+    // host-capable default may link the installer login. Never replace an
+    // existing binding.
+    const authLinks = process.env.EZ_ISOLATION === 'isolated' || options.authProfile !== undefined
       ? nativeSession ? [[path.join(home, 'auth.json'), path.join(base, 'auth.json')]] : []
       : [[path.join(base, 'auth.json'), path.join(homedir(), '.codex', 'auth.json')],
         ...(nativeSession ? [[path.join(home, 'auth.json'), path.join(base, 'auth.json')]] : [])]
@@ -402,28 +415,18 @@ export const startExecutorJob = async (
   if (!host && !gui && key === 'claude') {
     // Mirror the Codex binding: agent-bound settings, memory, plugins and
     // sessions; never the user's personal ~/.claude configuration.
-    const home = claudeConfigHome(options.controlDir)
+    const home = await provisionedHome(options.controlDir, 'claude', options.authProfile)
     await mkdir(home, {recursive:true,mode:0o700})
-    environment.CLAUDE_CONFIG_DIR = home
-    // Host-capable agents share the installer login only. An empty secure
-    // storage dir makes Claude use its default credential store (macOS
+    // Host-capable default homes share the installer login only. An empty
+    // secure storage dir makes Claude use its default credential store (macOS
     // Keychain entry or ~/.claude/.credentials.json) in place, so token
     // refreshes stay shared rather than diverging through a copy. Isolated
-    // agents keep their own login inside CLAUDE_CONFIG_DIR. The host executor
-    // runs unlabelled, so this matches the Codex auth-link check, not
-    // resolveIsolation().
-    if (process.env.EZ_ISOLATION !== 'isolated') environment.CLAUDE_SECURESTORAGE_CONFIG_DIR = ''
-    // Optional owner-provisioned long-lived token (`claude setup-token`). It
-    // never refreshes, so one file can be copied to every agent without the
-    // agents invalidating each other's OAuth session.
-    const token = await readFile(path.join(home, 'oauth-token'), 'utf8').then(value => value.trim(), (error: NodeJS.ErrnoException) => {
-      if (error.code === 'ENOENT') return undefined
-      throw error
-    })
-    if (token !== undefined) {
-      if (!/^[A-Za-z0-9._-]{20,512}$/.test(token)) throw new Error('Invalid Claude token binding')
-      environment.CLAUDE_CODE_OAUTH_TOKEN = token
-    }
+    // agents and named profiles keep their own login inside CLAUDE_CONFIG_DIR.
+    // The host executor runs unlabelled, so this matches the Codex auth-link
+    // check, not resolveIsolation(). An optional owner-provisioned long-lived
+    // token (`claude setup-token`) never refreshes, so one file can be copied
+    // to every agent without them invalidating each other's OAuth session.
+    Object.assign(environment, await claudeAuthEnvironment(home, options.authProfile))
   }
   if (!host && !gui && key === 'opencode') {
     // Point OpenCode at the agent-bound data home (cli/opencode/auth.json)
@@ -497,6 +500,15 @@ export const startExecutorJob = async (
 
 export const startGrokJob = startExecutorJob
 
+// Watch a host-transport run a previous relay submitted; it is never resubmitted.
+export const attachHostJob = async (controlDir: string, runId: string): Promise<ChildProcess> => {
+  const invocation = executorInvocation(process.execPath, ['--import', fileURLToPath(new URL('../node_modules/tsx/dist/loader.mjs', import.meta.url)),
+    fileURLToPath(new URL('./host-executor-client.ts', import.meta.url)), controlDir, runId, '--attach'])
+  const child = spawn(invocation.command, invocation.args, { env: executorEnvironment(), stdio: ['ignore', 'pipe', 'pipe'], detached: process.platform !== 'win32' })
+  await new Promise<void>((resolve, reject) => { child.once('spawn', resolve); child.once('error', reject) })
+  return child
+}
+
 // Spawn a verified registered script with the executor identity, environment
 // allowlist and workspace confinement. No shell, model, prompt or native session.
 export const startScriptJob = async (

package/src/host-executor-client.ts

@@ -1,17 +1,29 @@
 // File transport across the Docker/host boundary. The host chooses the CLI,
 // workspace and environment; a request cannot choose a command or credentials.
-import { mkdir, readFile, writeFile, rename, rm } from 'node:fs/promises'
+import { mkdir, readFile, writeFile, rename, rm, stat } from 'node:fs/promises'
 import path from 'node:path'
 import { isHostRunId } from './host-executor-protocol.js'
-const [control, id] = process.argv.slice(2)
-if (!control || !isHostRunId(id || '')) throw new Error('Invalid executor binding')
+const [control, id, mode] = process.argv.slice(2)
+if (!control || !isHostRunId(id || '') || (mode !== undefined && mode !== '--attach')) throw new Error('Invalid executor binding')
 const directory = path.join(control, 'host-executor')
 await mkdir(directory, {recursive:true, mode:0o700})
-let input = ''
-for await (const chunk of process.stdin) input += chunk
 const base = path.join(directory, id)
-await writeFile(base+'.tmp', input, {mode:0o600, flag:'wx'})
-await rename(base+'.tmp', base+'.request.json')
+if (mode === '--attach') {
+  // A previous relay submitted this run: watch it, never resubmit. Without a
+  // request, claim or event record its outcome is unknown.
+  // Check in lifecycle order: claim renames the request, and the host writes
+  // the exit event before removing the claim, so a live run is always seen.
+  const exists = (suffix: string) => stat(base+suffix).then(() => true, error => { if (error.code === 'ENOENT') return false; throw error })
+  if (!await exists('.request.json') && !await exists('.running.json') && !await exists('.events')) {
+    console.error('Handed-off host run has no request, claim or result; its outcome is unknown')
+    process.exit(1)
+  }
+} else {
+  let input = ''
+  for await (const chunk of process.stdin) input += chunk
+  await writeFile(base+'.tmp', input, {mode:0o600, flag:'wx'})
+  await rename(base+'.tmp', base+'.request.json')
+}
 let interrupted = false
 for (const signal of ['SIGTERM','SIGINT'] as const) process.once(signal, () => {
   if (interrupted) return

package/src/host-executor.ts

@@ -7,9 +7,11 @@ import { mkdir, readFile, writeFile, readdir, rename, rm, appendFile, realpath }
 import path from 'node:path'
 import { isHostRunId } from './host-executor-protocol.js'
 import { fileURLToPath } from 'node:url'
-import { startExecutorJob, terminateJob, resolveExecutor, validateCodexProvider, type CodexProviderBinding, type ExecutorOptions } from './executor.js'
+import { CliUnavailableError, startExecutorJob, terminateJob, resolveExecutor, validateCodexProvider, type CodexProviderBinding, type ExecutorOptions } from './executor.js'
+import { activeSetup } from './runs.js'
+import { startupLine, startupObserver } from './setup-fallback.js'
 import { parseIsolationClass, type IsolationClass } from './isolation.js'
-import { readModels, validateSelection, validateOpencodeProviders, type ModelChoice } from './ai.js'
+import { readModels, sameEngine, validateSelection, validateOpencodeProviders, type ModelChoice } from './ai.js'
 import type { ChildProcess } from 'node:child_process'
 import { packageVersion } from './version.js'
 import { installedPluginVersions } from './software-status.js'
@@ -48,6 +50,8 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
       new Set(installation.agents.map(a=>a.controlDir)).size !== installation.agents.length)
     throw new Error('Each agent requires a separate workspace and control directory')
   const active = new Map<string, ChildProcess>()
+  // A fallback attempt reuses its run ID; claim it only after the prior attempt's cleanup.
+  const claimed = new Set<string>()
   const tasks = new Set<Promise<void>>()
   let catalogRefresh: Promise<void> | undefined
   const locks: string[] = []
@@ -148,6 +152,7 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
         for (const file of await readdir(directory)) {
           if (!file.endsWith('.request.json') || !isHostRunId(file.slice(0,-13))) continue
           const id=file.slice(0,-13)
+          if (claimed.has(path.join(directory,id))) continue
           let run
           try {
             run = await readRun(agent.controlDir, id)
@@ -170,6 +175,7 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
             activeWorkspaces.set(agent, workspace)
           }
           workspace.lanes.set(id, scheduled)
+          claimed.add(base)
           // Keep plugin workspace invocations excluded until all native jobs finish.
           const releaseWorkspace = async () => {
             workspace.lanes.delete(id)
@@ -179,11 +185,12 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
             }
           }
           try { await rename(base+'.request.json',base+'.running.json') }
-          catch (error) { await releaseWorkspace(); throw error }
+          catch (error) { claimed.delete(base); await releaseWorkspace(); throw error }
           const task=(async()=>{
             let job: Awaited<ReturnType<typeof startExecutorJob>> | undefined
             let cancellation: ReturnType<typeof setInterval> | undefined
             let writes=Promise.resolve()
+            let observeClaude=false
             const emit=(event:unknown)=>{writes=writes.then(()=>appendFile(base+'.events',JSON.stringify(event)+'\n',{mode:0o600}))}
             try {
               try { await readFile(base+'.cancel'); throw new Error('Cancelled') } catch(error) { if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error }
@@ -203,12 +210,20 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
                   script:{...run.script,scheduleId:run.scheduled.id,scheduleRevision:run.scheduled.revision,dueAt:run.scheduled.dueAt}}
                 job=await launch(request.texts,options)
               } else {
+                const cli = opts.cli || installation.cli
                 if (run?.scheduled) {
-                  assertScheduledModel(run.execution?.preset.model)
-                  if (opts.model !== run.execution!.preset.model) throw new Error('Scheduled run model does not match its saved task model')
+                  const setup = activeSetup(run)
+                  assertScheduledModel(setup?.model)
+                  if (opts.model !== setup!.model || cli !== setup!.cli) throw new Error('Scheduled run model does not match its saved task model')
+                  observeClaude = cli === 'claude'
                 }
-                const cli = opts.cli || installation.cli
                 resolveExecutor(cli)
+                // The credential home comes from the authorized run's captured
+                // choice; a request can never move it to another account.
+                const captured = run?.scheduled ? activeSetup(run) : run?.execution?.preset
+                if ((opts.authProfile !== undefined || (captured?.cli === cli && captured.authProfile !== undefined)) &&
+                    !(captured && sameEngine(captured, {cli, authProfile: opts.authProfile})))
+                  throw new Error('Run auth profile does not match its captured AI selection')
                 const provider = cli === 'codex' && opts.provider
                   ? (agent.codexProviders ?? []).map(validateCodexProvider).find(candidate=>candidate.id===opts.provider)
                   : undefined
@@ -221,17 +236,24 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
                 // Admission and execution must use the same catalog snapshot. A
                 // transient native-client probe failure must not reject a model
                 // that the host just advertised to the relay and application.
-                if (cli !== installation.cli) await validateSelection({id:'selected',name:'Selected model',cli,provider:opts.provider,model,effort:opts.effort},JSON.parse(await readFile(path.join(directory,'models.json'),'utf8')))
+                if (cli !== installation.cli || opts.authProfile !== undefined) await validateSelection({id:'selected',name:'Selected model',cli,provider:opts.provider,authProfile:opts.authProfile,model,effort:opts.effort},JSON.parse(await readFile(path.join(directory,'models.json'),'utf8')))
                 const options:ExecutorOptions={workspace:agent.workspace,controlDir:agent.controlDir,binDir:agent.binDir,toolsHome:agent.toolsHome,sharedWorkspace,additionalWorkspaces:additionalWorkspaces.get(agent),cli,
                   runId:path.basename(base),timeoutMs:0,repairEnabled:opts.repairEnabled,
-                  sessionId:opts.sessionId,isResume:opts.isResume,model,effort:opts.effort,provider:opts.provider,codexAutoCompactTokens:opts.codexAutoCompactTokens,codexProvider:provider,
+                  sessionId:opts.sessionId,isResume:opts.isResume,model,effort:opts.effort,provider:opts.provider,authProfile:opts.authProfile,codexAutoCompactTokens:opts.codexAutoCompactTokens,codexProvider:provider,
                   promptSuffix:runPromptSuffix(run),taskRun:Boolean(run?.taskId),nativeSession:Boolean(run?.scheduled)}
                 job=await launch(request.texts,options)
               }
               active.set(base,job.child)
               await writeFile(base+'.process.json',JSON.stringify({pid:job.child.pid}),{mode:0o600})
               if(signal.aborted)terminateJob(job.child)
-              job.child.stdout?.on('data',chunk=>emit({stream:'stdout',text:chunk.toString()}))
+              // Scheduled Claude streams every event; forward only the startup summary.
+              const startup = observeClaude ? startupObserver() : undefined
+              let summary = ''
+              job.child.stdout?.setEncoding('utf8').on('data',(chunk:string)=>{
+                if (!startup) return emit({stream:'stdout',text:chunk})
+                startup.write(chunk)
+                if (startup.summary() !== summary) { summary = startup.summary(); emit({stream:'stdout',text:summary+'\n'}) }
+              })
               job.child.stderr?.on('data',chunk=>emit({stream:'stderr',text:chunk.toString()}))
               cancellation=setInterval(()=>{void readFile(base+'.cancel').then(()=>terminateJob(job!.child)).catch(()=>{})},250)
               const code=await new Promise<number>(resolve=>job!.child.once('close',code=>resolve(code??1)))
@@ -239,7 +261,9 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
               await job.cleanup()
               job = undefined
               emit({stream:'exit',code})
-            } catch (error) { emit({stream:'stderr',text:'Host CLI execution failed: '+redactFailure(error instanceof Error ? error.message : 'Unknown error')+'\n'}); emit({stream:'exit',code:1}) }
+            } catch (error) {
+              if (error instanceof CliUnavailableError) emit({stream:'stdout',text:startupLine({workBegan:false,rejection:{category:'cli-unavailable'}})+'\n'})
+              emit({stream:'stderr',text:'Host CLI execution failed: '+redactFailure(error instanceof Error ? error.message : 'Unknown error')+'\n'}); emit({stream:'exit',code:1}) }
             finally {
               if(cancellation)clearInterval(cancellation)
               await job?.cleanup().catch(() => {})
@@ -249,6 +273,7 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
               await rm(base+'.cancel',{force:true})
               active.delete(base)
               await releaseWorkspace()
+              claimed.delete(base)
             }
           })()
           tasks.add(task); void task.finally(()=>tasks.delete(task))