@jc_stack/ez-agents 0.1.0-beta.50 → 0.1.0-beta.52

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.1.0-beta.52
+
+- Restore isolated executor startup with existing named volumes and a private, root-owned read-only container binding. Host file ownership and permissions remain unchanged.
+- Start a missing isolated executor when native requests are queued, while retaining the live-run drain and single-worker ownership checks.
+
+
+## 0.1.0-beta.51
+
+- Keep native runs alive during handoff-compatible core upgrades. The retiring executor finishes existing work while its replacement accepts new requests; the relay adopts runs without replay and preserves schedule holds, cancellation and settled delivery receipts. Isolated agents migrate once while idle to a separate, unprivileged executor container; later compatible upgrades preserve its running generation. Older runtimes without the handoff contract retain the full native-work drain.
+- Prepare compatible-upgrade workspace and native-client backups before pausing admission or stopping the relay, so large histories do not extend the swap outage. Rollback restores code and configuration without rewinding active native state.
+- Make stop requests reach handed-off native work even while its observer is starting. A failed cancellation write leaves the observer active and reports the failed stop request.
+- Show paused schedules in `/tasks` and task details with a paused label and no next run. Editing a paused schedule keeps it paused.
+- Replace the oldest unused saved AI choice when the saved-choice limit is reached, preserving the selected, default and recently used choices.
+- Use the isolated native client's own catalog for AI selection, so available models such as Sonnet appear without relying on a host catalog.
+
+Beta limits: live fresh-host/reboot acceptance and live compatible upgrades during active native work on the VM and Mac remain pending. Synthetic container lifecycle checks and an idle EzStocks OVH private-candidate upgrade passed; these do not establish live active-run or provider acceptance. Publication does not establish an installed-agent upgrade or authorize provider/domain writes.
+
 ## 0.1.0-beta.50
 
 - Share memory across engines through the workspace. New workspaces seed a short `## Memory` note (durable facts in `memory/`, one per file, indexed in `memory/MEMORY.md`); every engine loads `AGENTS.md`, so Codex and Claude read the same files. When a chat conversation is replaced (`/new`, the New button, web app new, or an AI/provider switch), its engine gets one silent turn in that native session to save durable facts; nothing is delivered and the engine decides what to write.

package/docker/isolated-executor-smoke.mjs

@@ -0,0 +1,35 @@
+// Synthetic private binding and existing-volume acceptance; no provider access.
+import * as fs from 'node:fs/promises';
+import path from 'node:path';
+import {tmpdir} from 'node:os';
+import {randomUUID} from 'node:crypto';
+import {execute} from '../src/updates/runtime.mjs';
+import {executorBindingArchive,executorVolumes} from '../src/updates/supervisor.mjs';
+const root=await fs.mkdtemp(path.join(tmpdir(),'ez-executor-smoke-'));
+const project='ez-executor-smoke-'+randomUUID().slice(0,8),volume=project+'-existing';
+const file=path.join(root,'compose.json'),image=process.env.EZ_RELAY_IMAGE||'ezenciel-agents:local';
+const binding={agents:[{workspace:'/synthetic',binDir:'/app/bin'}]};
+const code=`const fs=require('fs'),assert=require('assert/strict');const p='/run/executor.json',s=fs.statSync(p),d=fs.statSync('/run');assert.equal(process.getuid(),1001);assert.equal(s.uid,0);assert.equal(s.gid,1000);assert.equal(s.mode&511,288);assert.equal(d.uid,0);assert.equal(d.mode&18,0);assert.deepEqual(JSON.parse(fs.readFileSync(p)),${JSON.stringify(binding)});for(const fn of [()=>fs.writeFileSync(p,'changed'),()=>fs.chmodSync(p,384),()=>fs.unlinkSync(p)])assert.throws(fn,e=>['EACCES','EPERM','EROFS'].includes(e.code));assert.equal(fs.readFileSync('/ipc/marker','utf8'),'retained');console.log('Private readonly binding and retained volume passed');`;
+const worker={image,user:'1001:1000',network_mode:'none',cap_drop:['ALL'],security_opt:['no-new-privileges:true'],entrypoint:['node','-e',code],volumes:[{type:'volume',source:'ipc',target:'/ipc'}]};
+const args=['compose','--project-name',project,'--file',file];
+try {
+ await execute('docker',['volume','create',volume]);
+ await execute('docker',['run','--rm','--network','none','--user','0:0','--mount',`type=volume,source=${volume},target=/ipc`,'--entrypoint','node',image,'-e',"require('fs').writeFileSync('/ipc/marker','retained')"]);
+ await fs.writeFile(file,JSON.stringify({services:{executor:worker},volumes:executorVolumes({volumes:{ipc:{name:volume}}},worker)}),{mode:0o600});
+ await execute('docker',[...args,'create','--no-build','executor']);
+ const cid=(await execute('docker',[...args,'ps','-aq','executor'],{stdoutOnly:true})).trim();
+ await execute('docker',['cp','-',`${cid}:/run`],{input:executorBindingArchive(binding,1000)});
+ console.log(await execute('docker',['start','-a',cid]));
+ const exit=(await execute('docker',['inspect','--format','{{.State.ExitCode}}',cid],{stdoutOnly:true})).trim();
+ if(exit!=='0')throw Error('Executor binding acceptance failed');
+ await execute('docker',[...args,'down']);
+ const retained=(await execute('docker',['volume','inspect','--format','{{.Name}}',volume],{stdoutOnly:true})).trim();
+ if(retained!==volume)throw Error('External volume identity changed');
+ // Rejected archive input must fail cleanly, with no uncaught stdin EPIPE.
+ await execute('docker',['cp','-',`${project}-missing:/run`],{input:Buffer.alloc(1024*1024)}).then(()=>{throw Error('Missing container copy succeeded');},()=>{});
+ console.log('PASS: unprivileged executor reads only its private binding; writes, chmod and unlink fail; external volume preserved.');
+} finally {
+ await execute('docker',[...args,'down']).catch(()=>{});
+ await execute('docker',['volume','rm',volume]).catch(()=>{});
+ await fs.rm(root,{recursive:true,force:true});
+}

package/docs/docker-runtime.md

@@ -151,8 +151,7 @@ record, or an adoption failure) is recorded failed and interrupted, which holds
 its schedule until an explicit edit; the host is asked to cancel it. A request
 the host had not claimed before the relay stopped is failed by the host without
 starting. Records older than 24 hours are ignored, and the file is removed on
-every start. Queued runs and deliveries are still dropped, and messages a run
-sends while no relay is up fail and need a retry.
+every start. Queued runs are still dropped. Accepted deliveries are drained before listener shutdown completes; settled receipts for handed-off runs move with the handoff. A connection failure during a declared upgrade swap waits for the relay; an accepted timeout is never retried.
 A `409 Conflict` still requires the operator to stop the competing poller; it
 remains unhealthy after the startup grace. Pending and uncertain deliveries keep
 their existing receipt semantics; executor stdout is not replayed as a reply.
@@ -392,3 +391,14 @@ The isolated executor image includes Node, jq and Python 3 (`python` and
 remain behind installed plugins. Registered command admission waits up to five
 seconds for the short registry lock; lifecycle changes still fail closed, and
 no caller removes an existing lock. Serialize calls when a plugin requires it.
+
+## Isolated executor generations
+
+A handoff-capable supervisor runs the existing native file transport in a separate
+unprivileged per-agent container. It derives workspace/control mounts and the image
+from the owning relay deployment, adds only a read-only executor binding, and gives
+the worker no relay secrets, provider secret environment or Docker socket. Native
+credential homes stay in the existing control volume. Only the active generation
+claims work; retired generations keep cancellation and per-run liveness until
+their last process exits. The supervisor removes their temporary Compose resources.
+The first upgrade from an embedded isolated executor drains before this migration.

package/docs/releasing.md

@@ -22,6 +22,7 @@ separate release bot is not required.
    audit advances. Baseline CI does not validate a newly published native version.
    Managed installs and upgrades keep their existing native version selection.
    Main relay: `EZ_RELAY_IMAGE=ez-release-runtime node docker/smoke.mjs`.
+   Isolated executor: `EZ_RELAY_IMAGE=ez-release-runtime node docker/isolated-executor-smoke.mjs`.
    The WhatsApp Compose overlay has no separate relay image; verify its
    provider integration with the synthetic plugin smoke in `docs/plugins.md`.
 4. Create an artifact with `npm pack --ignore-scripts`. Inspect its file list,

package/docs/scheduling.md

@@ -21,7 +21,8 @@ ezenciel-agents-schedule cancel RUN_ID
 ```
 
 Use `--text-file` for longer instructions. `edit ID` replaces the complete schedule
-with a new revision; use the same trigger/name/text flags as `create`.
+with a new revision; use the same trigger/name/text flags as `create`. It keeps
+the paused/enabled state: an edited paused task stays paused until `resume`.
 An edit keeps a future pending occurrence when its trigger is unchanged;
 otherwise the edited rule begins at its next future occurrence. Editing does
 not replay missed work from an old start date. Use `--now` to request a new
@@ -338,9 +339,11 @@ messages, read private sessions, trigger work or certify owning results.
 
 The prompt controls diagnosis, authorized recovery and quiet notification behavior. Inspect prior effects and receipts before retrying anything. A failed review run itself remains visible as a new failure for the next occurrence.
 
-The Telegram Scheduled tasks menu lists enabled schedules that still have a pending
-occurrence or a queued/running occurrence. Finished one-time tasks, paused
-schedules and revisions stopped for review are hidden. Each entry shows the
+The Telegram Scheduled tasks menu lists paused schedules alongside enabled schedules
+that still have a pending occurrence or a queued/running occurrence. Paused tasks
+are labeled Paused and have no next run; an existing queued/running occurrence
+keeps its execution state visible. Finished enabled one-time tasks and enabled
+revisions stopped for review are hidden. Each entry shows the
 frequency with the cron timezone, the saved primary and fallback setups in order
 (CLI, login profile, model and effort), next occurrence in UTC (or queued/running state),
 and the first sentence of its saved invocation

package/docs/upgrades.md

@@ -16,7 +16,12 @@ automatic channel for core and plugins without a saved policy. Existing explicit
 stable or manual policies are preserved. The owner may select either per target.
 The main target and installed plugins version independently.
 
-Core upgrades leave channel admission open while native work runs, then pause it after work is idle and recheck races. Plugin upgrades build while native work continues. Activation closes the existing registry admission lock, drains in-flight plugin command leases, and replaces the plugin under that lock. New native plugin calls wait for admission; an outdated revision fails before provider execution and must be rediscovered. No admitted provider operation is replayed. The shared broker and native sessions remain running. Core upgrades still require the full native-work drain. A plugin update also retains that drain if an operator replaced the broker’s single-file host binding (for example to approve new network pins), because that case still requires broker recreation.
+Handoff-compatible core upgrades build while native work continues and pause admission only for activation. The current native executor retires from claiming new work; the replacement claims new requests while the retiring generation finishes its existing runs. The relay adopts those runs without replay, preserving their schedule holds, cancellation and settled delivery receipts. The supervisor reloads only after native work is idle, so OS service process-group cleanup cannot kill a retiring generation. Plugin upgrades build while native work continues. Activation closes the existing registry admission lock, drains in-flight plugin command leases, and replaces the plugin under that lock. New native plugin calls wait for admission; an outdated revision fails before provider execution and must be rediscovered. No admitted provider operation is replayed. The shared broker and native sessions remain running. Older runtimes without the handoff contract retain the full native-work drain. Isolated agents migrate once after live native work finishes to a separate, unprivileged executor container. Pending requests remain queued for that executor; its private binding is copied into the container as root-owned, group-readable and not writable by the configured runtime user. Existing named volumes are attached as external volumes. It uses the same file transport; later relay/runtime upgrades preserve that executor generation. No native CLI or provider credentials move to the host. A plugin update also retains that drain if an operator replaced the broker’s single-file host binding (for example to approve new network pins), because that case still requires broker recreation.
+
+Compatible main upgrades also finish their advisory workspace/native-client
+backup before closing admission or stopping the relay. Large native histories do
+not extend the swap's delivery outage. These live-state copies are best effort;
+rollback restores code and configuration, never the backup over active state.
 
 The owner chooses the saved update policy. The host supervisor owns
 interruption-safe replacement. There is one host service per agent, not a second
@@ -58,6 +63,19 @@ restart and verify. Do not recreate the agent or its registry. Subsequent
 compatible upgrades are agent-owned. Noncanonical/multi-agent host configuration
 files require migration to one canonical deployment per service first.
 
+## Recovering an isolated-executor startup defect
+
+If an older supervisor cannot start its isolated executor, queued requests can
+prevent that same supervisor from installing its correction. Use an exact,
+reviewed newer package's `src/updates/supervisor.mjs DEPLOYMENT_DIRECTORY` as the
+existing OS service's temporary entry point. First verify that no native run is
+active. Keep the same service user, environment, registry, deployment and queued
+requests; do not edit published package files or delete claims. This CLI runs the
+same supervisor and retains the active package binding until normal upgrade
+activation. Let existing queued jobs finish, then prepare and apply the corrected
+release through `ez updates`. Restore the retained bootstrap entry point after
+the active package and running services verify the corrected version.
+
 ## Package-manager preflight and repair
 
 Before installing candidate dependencies or stopping services, the supervisor
@@ -153,7 +171,7 @@ is required. Stable automation excludes prereleases, major changes and 0.x minor
 changes. Beta policy permits compatible prereleases. Downgrades are rejected;
 rollback is a recovery operation for the previous installation only.
 
-`apply` records one durable queued job. **For a core upgrade, the agent must finish its turn after queuing it** so the supervisor can drain native work. A plugin upgrade can complete while that turn continues; only plugin-call admission is held during activation. Calls already executing finish first.
+`apply` records one durable queued job. **For a core upgrade from a runtime without the handoff contract, the agent must finish its turn after queuing it** so the supervisor can drain native work. New compatible runtimes can swap while native work continues. A plugin upgrade can complete while that turn continues; only plugin-call admission is held during activation. Calls already executing finish first.
 One job at a time; an unresolved recovery blocks new upgrades. The agent processes
 multiple requested packages over successive update requests.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jc_stack/ez-agents",
-  "version": "0.1.0-beta.50",
+  "version": "0.1.0-beta.52",
   "private": false,
   "type": "module",
   "description": "A lightweight foundation for persistent business AI assistants using existing AI harnesses, workspaces and plugins.",
@@ -112,7 +112,9 @@
     "protocol": 1,
     "kind": "main",
     "stateSchema": 1,
-    "mainProtocol": 1
+    "mainProtocol": 1,
+    "runHandoff": 1,
+    "containerExecutor": 1
   },
   "exports": {
     "./application-client": "./src/application-client.mjs",

package/src/ai-cli.ts

@@ -5,6 +5,7 @@ import { mkdir, readFile } from 'node:fs/promises'
 import { authProfileStatus, readModels, presetProvider, sameChoice, sameEngine, validateSelection, type AiPreset, type ModelChoice } from './ai.js'
 import { cliHome } from './auth-profile.js'
 import { ControlStore } from './control-state.js'
+import { resolveIsolation } from './isolation.js'
 
 const usage='Usage: ezenciel-agents-ai list | select --cli <installed-cli> [--auth-profile <name>] [--provider <provider>] [--model <model>] [--effort <effort>] | default | profiles | profile add --cli codex|claude --auth-profile <name>'
 const {values,positionals}=parseArgs({allowPositionals:true,options:{help:{type:'boolean'},cli:{type:'string'},'auth-profile':{type:'string'},provider:{type:'string'},model:{type:'string'},effort:{type:'string'}}})
@@ -15,8 +16,9 @@ if(values.help){
 if (!process.env.EZ_CONTROL_DIR) throw new Error('Use this agent’s bound control directory')
 const controlDir=process.env.EZ_CONTROL_DIR
 const authProfile=values['auth-profile']
-const catalog=():Promise<ModelChoice[]>=>readFile(join(controlDir,'host-executor','models.json'),'utf8')
-  .then(text=>JSON.parse(text)).catch(()=>readModels(undefined,undefined,join(controlDir,'cli','codex'),undefined,undefined,undefined,controlDir))
+const catalog=():Promise<ModelChoice[]>=>(process.env.EZ_AI_CATALOG==='host'||(process.env.EZ_AI_CATALOG===undefined&&resolveIsolation(process.env)==='host-capable'))
+  ? readFile(join(controlDir,'host-executor','models.json'),'utf8').then(text=>JSON.parse(text))
+  : readModels(undefined,undefined,join(controlDir,'cli','codex'),undefined,undefined,undefined,controlDir)
 if(positionals[0]==='list')console.log(JSON.stringify(await catalog()))
 else if(positionals[0]==='profiles')console.log(JSON.stringify(await authProfileStatus(controlDir)))
 else if(positionals[0]==='profile' && positionals[1]==='add'){

package/src/control-state.ts

@@ -763,10 +763,16 @@ export class ControlStore {
       await requireControlGuard(state, guard)
       if (!state.ai) throw new Error('AI settings not initialized')
       // Auto-detected client defaults come and go with installed clients; only
-      // owner-saved choices count toward the cap.
-      if (state.ai.presets.filter((p) => !p.id.startsWith('detected_')).length >= 12 && !state.ai.presets.some((p) => p.id === preset.id))
-        throw new Error('Keep it small: at most 12 saved AIs.')
-      state.ai.presets = [...state.ai.presets.filter((p) => p.id !== preset.id), persistedPreset(preset)]
+      // owner-saved choices count toward the cap. Conversations keep their own
+      // preset copy, so at the cap the oldest unreferenced choice makes room.
+      const ai = state.ai
+      const saved = ai.presets.filter((p) => !p.id.startsWith('detected_'))
+      if (saved.length >= 12 && !ai.presets.some((p) => p.id === preset.id)) {
+        const kept = new Set([ai.selectedId, ai.defaultId, ...(ai.recentIds ?? [])])
+        const oldest = saved.find((p) => !kept.has(p.id))!
+        ai.presets = ai.presets.filter((p) => p.id !== oldest.id)
+      }
+      ai.presets = [...ai.presets.filter((p) => p.id !== preset.id), persistedPreset(preset)]
       await this.writeState(state)
     })
   }

package/src/delivery-socket-client.mjs

@@ -78,7 +78,7 @@ const readEndpoint = async controlDir => {
   } catch { return null }
 }
 
-export const callDeliverySocket = async (socketPath, op, timeoutMs = 130_000) => {
+const callOnce = async (socketPath, op, timeoutMs) => {
   const id = `${Date.now().toString(36)}_${Math.floor(Math.random() * 0xffffff).toString(16)}`
   try {
     return await exchange(() => createConnection(socketPath), { id, ...op }, timeoutMs, socketPath)
@@ -104,3 +104,17 @@ export const deliverySocketAlive = async (socketPath, timeoutMs = 2000) => {
     return false
   }
 }
+
+// Only retry connection failures during a declared runtime swap. No frame was
+// accepted in that case. Timeouts, provider failures and uncertain writes fail.
+export const callDeliverySocket = async (socketPath, op, timeoutMs = 130_000) => {
+  const until=Date.now()+120000;
+  for(;;){
+    try{return await callOnce(socketPath,op,timeoutMs);}
+    catch(error){
+      if(!error?.connectFailure||op.op!=='enqueue'||Date.now()>=until)throw error;
+      try{await readFile(path.join(path.dirname(socketPath),'upgrade-pause.json'),'utf8');}catch{throw error;}
+      await new Promise(resolve=>setTimeout(resolve,250));
+    }
+  }
+};

package/src/delivery-socket.ts

@@ -83,7 +83,7 @@ export const authorizeRun = async (controlDir: string, runId: string): Promise<R
 const encode = (value: unknown): string => `${JSON.stringify(value)}\n`
 
 export type DeliveryEndpoint = { host: '127.0.0.1'; port: number; token: string }
-export type DeliveryServeOptions = { tcpPort?: number }
+export type DeliveryServeOptions = { tcpPort?: number; beforeClose?: () => Promise<void> }
 const endpointFile = 'delivery-endpoint.json'
 const tokensMatch = (candidate: unknown, token: string): boolean =>
   typeof candidate === 'string' && candidate.length === token.length && timingSafeEqual(Buffer.from(candidate), Buffer.from(token))
@@ -94,6 +94,8 @@ export const serveDeliverySocket = async (
   options: DeliveryServeOptions = {},
 ): Promise<{ socketPath: string; endpoint: DeliveryEndpoint | null; stop: () => Promise<void> }> => {
   const socketPath = deliverySocketPath(controlDir)
+  let closing=false
+  const admissions=new Set<Promise<void>>()
   await rm(socketPath, { force: true }).catch(() => {})
   const attach = (socket: Socket, token: string | null): void => {
     let buffer = ''
@@ -105,7 +107,8 @@ export const serveDeliverySocket = async (
         const line = buffer.slice(0, newline)
         buffer = buffer.slice(newline + 1)
         if (!line.trim()) continue
-        void (async () => {
+        let admission=false
+        const work=(async () => {
           let id: unknown = null
           try {
             const envelope = JSON.parse(line) as { id?: unknown; token?: unknown; op?: unknown; payload?: unknown }
@@ -116,12 +119,19 @@ export const serveDeliverySocket = async (
             // re-verifies owner authority server-side.
             if (token !== null && !tokensMatch(envelope.token, token)) { socket.destroy(); return }
             const { token: _token, ...request } = envelope
+            if(request.op==='enqueue'){
+              if(closing)throw Error('Delivery relay is shutting down; message was not accepted')
+              admission=true
+            }
             const result = await handle(request as DeliverySocketOp)
             socket.write(encode({ id, ok: true, result: result ?? null }))
           } catch (error) {
             socket.write(encode({ id, ok: false, error: error instanceof Error ? error.message : String(error ?? 'Unknown error') }))
           }
         })()
+        // Only finite admission handlers are a drain barrier; a receipt wait
+        // completes after the relay's delivery pump flushes the accepted items.
+        if(admission){admissions.add(work);void work.finally(()=>admissions.delete(work))}
       }
     })
   }
@@ -176,9 +186,13 @@ export const serveDeliverySocket = async (
     socketPath,
     endpoint,
     stop: async () => {
-      await new Promise<void>((resolve) => server.close(() => resolve()))
+      closing=true
+      const closed=Promise.all([new Promise<void>((resolve) => server.close(() => resolve())),
+        ...(tcpServer ? [new Promise<void>((resolve) => tcpServer!.close(() => resolve()))] : [])])
+      await Promise.all(admissions)
+      await options.beforeClose?.()
+      await closed
       await rm(socketPath, { force: true }).catch(() => {})
-      if (tcpServer) await new Promise<void>((resolve) => tcpServer.close(() => resolve()))
       if (tcpEndpoint) await rm(path.join(controlDir, endpointFile), { force: true }).catch(() => {})
     },
   }

package/src/executor.ts

@@ -1,7 +1,8 @@
 import { executionDefaults } from './model-policy.js'
 import { startTaskExecutor } from './task-executor.js'
 import { deliverySocketPath } from './delivery-socket.js'
-import { mkdtemp, rm, writeFile, mkdir, symlink, readFile } from 'node:fs/promises'
+import { mkdtemp, rm, writeFile, mkdir, symlink, readFile, rename } from 'node:fs/promises'
+import { randomUUID } from 'node:crypto'
 import { accessSync, openSync, closeSync, constants as fsConstants } from 'node:fs'
 import { tmpdir, homedir } from 'node:os'
 import path from 'node:path'
@@ -13,9 +14,17 @@ import { DESKTOP_UNAVAILABLE } from './desktop-bridge.js'
 import { macosWorkspaceProfile, workspaceSiblingDenies } from './workspace-confine.js'
 import { Scripts, type ScriptRunRef } from './scripts.js'
 import { claudeAuthEnvironment, cliHome, provisionedHome } from './auth-profile.js'
+import { isHostRunId } from './host-executor-protocol.js'
+
+const hostCancelFiles = new WeakMap<ChildProcess, string>()
+const hostCancelFile = (controlDir: string, runId: string): string => {
+  if (!isHostRunId(runId)) throw new Error('Invalid host executor run ID')
+  return path.join(controlDir, 'host-executor', runId + '.cancel')
+}
 
 export type ExecutorOptions = {
   repairEnabled?: boolean
+  catalogTransport?: 'host' | 'local'
   workspace: string
   timeoutMs: number
   runId: string
@@ -79,7 +88,7 @@ export const executorEnvironment = (environment: NodeJS.ProcessEnv = process.env
 }
 
 export const executorJobEnv = (
-  options: Pick<ExecutorOptions, 'runId' | 'controlDir' | 'binDir' | 'toolsHome' | 'repairEnabled'> & { workspace?: string },
+  options: Pick<ExecutorOptions, 'runId' | 'controlDir' | 'binDir' | 'toolsHome' | 'repairEnabled' | 'catalogTransport'> & { workspace?: string },
   environment: NodeJS.ProcessEnv = process.env,
 ): NodeJS.ProcessEnv => {
   const base = executorEnvironment(environment)
@@ -88,6 +97,7 @@ export const executorJobEnv = (
     ...base,
     PATH: pathValue,
     EZ_RUN_ID: options.runId,
+    EZ_AI_CATALOG: options.catalogTransport ?? (environment.EZ_EXECUTOR_TRANSPORT==='host' ? 'host' : 'local'),
     EZ_CONTROL_DIR: options.controlDir,
     ...(options.workspace ? { EZ_AGENT_WORKSPACE: options.workspace } : {}),
     EZ_DELIVERY_SOCKET: deliverySocketPath(options.controlDir),
@@ -340,22 +350,33 @@ export const executorInvocation = (command: string, args: string[]) => {
     : { command, args }
 }
 
+// The isolated worker uses the same file transport as the host worker, but
+// stays in its own container. A published worker binding must never fall back
+// to local execution when its heartbeat expires.
+export const usesFileTransport = async (controlDir: string, env: NodeJS.ProcessEnv = process.env): Promise<boolean> => {
+  if (env.EZ_CONTAINER_EXECUTOR === '1') return false
+  if (env.EZ_EXECUTOR_TRANSPORT === 'host') return true
+  try { return JSON.parse(await readFile(path.join(controlDir,'host-executor/heartbeat.json'),'utf8')).containerExecutor === true }
+  catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error; return false }
+}
+
 export const startExecutorJob = async (
   texts: string[],
   options: ExecutorOptions,
 ): Promise<{ child: ChildProcess; cleanup: () => Promise<void>; stdout: string }> => {
-  if (options.script && process.env.EZ_EXECUTOR_TRANSPORT !== 'host') return startScriptJob(options as ExecutorOptions & { script: ScriptLaunch })
+  const host = await usesFileTransport(options.controlDir)
+  const cancelFile = host ? hostCancelFile(options.controlDir, options.runId) : undefined
+  if (options.script && !host) return startScriptJob(options as ExecutorOptions & { script: ScriptLaunch })
   options = executionDefaults(executorKey(options.cli), options)
   // Named credential homes are owner-provisioned; fail closed before any launch state.
   if (options.authProfile !== undefined) await provisionedHome(options.controlDir, executorKey(options.cli), options.authProfile)
   // Routing is caller-owned: a restricted task run goes to the task runner
   // unless the host transport must ship it across the boundary first.
-  if (options.taskRun && process.env.EZ_EXECUTOR_TRANSPORT !== 'host') return startTaskExecutor(options)
+  if (options.taskRun && !host) return startTaskExecutor(options)
   if (options.nativeSession && !/^[a-zA-Z0-9_-]+$/.test(options.runId)) throw new Error('Invalid native task run ID')
   if (options.codexSandbox !== undefined && (options.codexSandbox !== 'external' || process.env.EZ_EXECUTOR_TRANSPORT !== 'local' || options.taskRun || executorKey(options.cli) !== 'codex')) throw new Error('External Codex sandbox requires an owner-authorized native local run')
   const outputDirectory = await mkdtemp(path.join(tmpdir(), 'ezenciel-agents-'))
   const key = executorKey(options.cli)
-  const host = process.env.EZ_EXECUTOR_TRANSPORT === 'host'
   const gui = !host && key === 'codex-gui'
   const nativeSession = !host && key === 'codex' && options.nativeSession === true
   // Literal input plus the caller-provided trigger line. No coaching,
@@ -458,6 +479,7 @@ export const startExecutorJob = async (
     stdio: ['pipe', 'pipe', 'pipe'],
     detached: process.platform !== 'win32',
   })
+  if (cancelFile) hostCancelFiles.set(child, cancelFile)
   await new Promise<void>((resolve, reject) => {
     child.once('spawn', resolve)
     child.once('error', reject)
@@ -502,9 +524,11 @@ export const startGrokJob = startExecutorJob
 
 // Watch a host-transport run a previous relay submitted; it is never resubmitted.
 export const attachHostJob = async (controlDir: string, runId: string): Promise<ChildProcess> => {
+  const cancelFile = hostCancelFile(controlDir, runId)
   const invocation = executorInvocation(process.execPath, ['--import', fileURLToPath(new URL('../node_modules/tsx/dist/loader.mjs', import.meta.url)),
     fileURLToPath(new URL('./host-executor-client.ts', import.meta.url)), controlDir, runId, '--attach'])
   const child = spawn(invocation.command, invocation.args, { env: executorEnvironment(), stdio: ['ignore', 'pipe', 'pipe'], detached: process.platform !== 'win32' })
+  hostCancelFiles.set(child, cancelFile)
   await new Promise<void>((resolve, reject) => { child.once('spawn', resolve); child.once('error', reject) })
   return child
 }
@@ -552,11 +576,27 @@ export const nativeSessionId = (cli: string, line: string): string | undefined =
   } catch {}
 }
 
-const terminating = new WeakSet<ChildProcess>()
-export const terminateJob = (child: ChildProcess, inspect = processSnapshot): void => {
-  if (!child.pid || child.exitCode !== null || child.signalCode !== null || terminating.has(child)) return
-  terminating.add(child)
-  void (async () => {
+const terminating = new WeakMap<ChildProcess, Promise<boolean>>()
+export const terminateJob = (child: ChildProcess, inspect = processSnapshot): Promise<boolean> => {
+  const pending = terminating.get(child)
+  if (pending) return pending
+  if (!child.pid || child.exitCode !== null || child.signalCode !== null) return Promise.resolve(true)
+  const work = (async () => {
+    const cancelFile = hostCancelFiles.get(child)
+    if (cancelFile) {
+      // The observer may still be loading, or unable to handle a signal. Commit
+      // the native worker's stop request before terminating that observer.
+      const temporary = cancelFile + '.' + process.pid + '.' + randomUUID() + '.tmp'
+      try {
+        await mkdir(path.dirname(cancelFile), { recursive: true, mode: 0o700 })
+        await writeFile(temporary, '', { mode: 0o600, flag: 'wx' })
+        await rename(temporary, cancelFile)
+      } catch (error) {
+        await rm(temporary, { force: true }).catch(() => {})
+        console.error('Cannot request host executor cancellation; observer remains active', error)
+        return false
+      }
+    }
     const targets = new Set([child.pid!])
     // Native tool terminals can start separate process groups. Capture ancestry
     // before stopping the CLI, while those children still have their parent.
@@ -584,5 +624,9 @@ export const terminateJob = (child: ChildProcess, inspect = processSnapshot): vo
       void processSnapshot().then(current => signal(matchingProcessIds(identities, current), 'SIGKILL'))
         .catch(error => console.error('Cannot inspect executor descendants for escalation', error))
     }, 3000)
+    return true
   })()
+  terminating.set(child, work)
+  void work.then(stopped => { if (!stopped) terminating.delete(child) })
+  return work
 }

package/src/host-executor-client.ts

@@ -50,7 +50,10 @@ try {
     // Drain completion first. A brief missing file at the shared-filesystem
     // boundary must not cancel a healthy job or hide its terminal result.
     try {
-      const heartbeat = JSON.parse(await readFile(path.join(directory,'heartbeat.json'),'utf8'))
+      const claimed = await stat(base+'.running.json').then(()=>true,error=>{if(error.code==='ENOENT')return false;throw error})
+      const heartbeat = claimed
+        ? {at:(await stat(base+'.events')).mtimeMs}
+        : JSON.parse(await readFile(path.join(directory,'heartbeat.json'),'utf8'))
       if (!Number.isFinite(heartbeat.at)) throw new Error('Invalid host CLI heartbeat')
       lastHeartbeat = heartbeat.at
     } catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error }