@covibes/zeroshot 4.1.2 → 4.1.4

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+## [4.1.4](https://github.com/covibes/zeroshot/compare/v4.1.3...v4.1.4) (2026-01-06)
+
+
+### Bug Fixes
+
+* **ci:** enforce CI testing for all releases ([3fad703](https://github.com/covibes/zeroshot/commit/3fad703fb6eb6b7ac8f98400466bac92329c8561))
+
+## [4.1.3](https://github.com/covibes/zeroshot/compare/v4.1.2...v4.1.3) (2026-01-06)
+
+
+### Bug Fixes
+
+* **package:** include scripts/ in npm package files ([4bd5991](https://github.com/covibes/zeroshot/commit/4bd599163df5c7b7f9309f07c4af4b1ec5e7bf38))
+* **preflight:** support macOS Keychain auth detection ([#35](https://github.com/covibes/zeroshot/issues/35)) ([a6f0880](https://github.com/covibes/zeroshot/commit/a6f08807eb2b44b241800a2240a76bf6dbedceca))
+
 ## [4.1.2](https://github.com/covibes/zeroshot/compare/v4.1.1...v4.1.2) (2026-01-05)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@covibes/zeroshot",
-  "version": "4.1.2",
+  "version": "4.1.4",
   "description": "Multi-agent orchestration engine for Claude - cluster coordinator and CLI",
   "main": "src/orchestrator.js",
   "bin": {
@@ -14,6 +14,7 @@
     "test": "mocha 'tests/**/*.test.js'",
     "test:coverage": "c8 npm test",
     "test:coverage:report": "c8 --reporter=html npm test && echo 'Coverage report generated at coverage/index.html'",
+    "postinstall": "node scripts/fix-node-pty-permissions.js",
     "start": "node cli/index.js",
     "typecheck": "tsc --noEmit",
     "lint": "eslint .",
@@ -81,6 +82,7 @@
     "cluster-templates/",
     "hooks/",
     "docker/",
+    "scripts/",
     "README.md",
     "LICENSE",
     "CHANGELOG.md"
@@ -94,7 +96,7 @@
     "chalk": "^4.1.2",
     "commander": "^14.0.2",
     "md-to-pdf": "^5.2.5",
-    "node-pty": "^1.0.0",
+    "node-pty": "^1.1.0",
     "omelette": "^0.4.17",
     "pidusage": "^4.0.1",
     "proper-lockfile": "^4.1.2"

package/scripts/fix-node-pty-permissions.js

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+/**
+ * Fix node-pty spawn-helper permissions.
+ *
+ * node-pty prebuilds ship with spawn-helper lacking execute permission (mode 644).
+ * This causes "posix_spawnp failed" errors on macOS/Linux.
+ *
+ * Upstream bug: https://github.com/microsoft/node-pty/issues/XXX
+ * (File issue if not already reported)
+ *
+ * This script runs as postinstall to fix it automatically.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+// Skip on Windows - chmod doesn't apply
+if (process.platform === 'win32') {
+  process.exit(0);
+}
+
+const prebuildsDir = path.join(__dirname, '..', 'node_modules', 'node-pty', 'prebuilds');
+
+if (!fs.existsSync(prebuildsDir)) {
+  // node-pty not installed yet or using compiled version
+  process.exit(0);
+}
+
+let fixed = 0;
+let errors = 0;
+
+try {
+  const platforms = fs.readdirSync(prebuildsDir).filter(f => {
+    try {
+      return fs.statSync(path.join(prebuildsDir, f)).isDirectory();
+    } catch {
+      return false;
+    }
+  });
+
+  for (const platform of platforms) {
+    // Only fix Unix platforms (darwin, linux)
+    if (!platform.startsWith('darwin') && !platform.startsWith('linux')) {
+      continue;
+    }
+
+    const helper = path.join(prebuildsDir, platform, 'spawn-helper');
+    try {
+      if (!fs.existsSync(helper)) continue;
+
+      const stat = fs.statSync(helper);
+      // Check if not executable (missing user execute bit)
+      if (!(stat.mode & 0o100)) {
+        fs.chmodSync(helper, 0o755);
+        fixed++;
+      }
+    } catch (err) {
+      // Log but don't fail install - permission fix is best-effort
+      console.warn(`[postinstall] Warning: Could not fix ${helper}: ${err.message}`);
+      errors++;
+    }
+  }
+} catch (err) {
+  // Don't fail install on unexpected errors
+  console.warn(`[postinstall] Warning: node-pty permission fix failed: ${err.message}`);
+  process.exit(0);
+}
+
+if (fixed > 0) {
+  console.log(`[postinstall] Fixed node-pty spawn-helper permissions (${fixed} platform(s))`);
+}
+
+if (errors > 0) {
+  console.warn(`[postinstall] ${errors} platform(s) could not be fixed - may need manual chmod`);
+}

package/scripts/record-demo.sh

@@ -0,0 +1,279 @@
+#!/bin/bash
+# record-demo.sh - Create ephemeral project, run zeroshot demo, record it, cleanup
+#
+# Usage:
+#   ./scripts/record-demo.sh              # Interactive mode (you run zeroshot manually)
+#   ./scripts/record-demo.sh --record     # Record with asciinema automatically
+#
+# Output: zeroshot-demo.cast (asciinema recording)
+# Convert to gif: agg zeroshot-demo.cast zeroshot-demo.gif --idle-time-limit 2
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+DEMO_DIR=""
+RECORD_MODE=false
+FORCE_MODE=false
+LOCK_FILE="/tmp/zeroshot-demo-recording.lock"
+CAST_FILE="$REPO_ROOT/zeroshot-demo.cast"
+
+# Check for existing recording session
+check_existing_session() {
+    # Check lock file
+    if [[ -f "$LOCK_FILE" ]]; then
+        local old_pid
+        old_pid=$(cat "$LOCK_FILE" 2>/dev/null || echo "")
+        if [[ -n "$old_pid" ]] && kill -0 "$old_pid" 2>/dev/null; then
+            echo "ERROR: Recording already in progress (PID $old_pid)"
+            echo "Kill it with: kill $old_pid"
+            exit 1
+        fi
+        # Stale lock file
+        rm -f "$LOCK_FILE"
+    fi
+
+    # Check for any asciinema processes recording to our file
+    local existing_asciinema
+    existing_asciinema=$(pgrep -f "asciinema.*zeroshot-demo.cast" 2>/dev/null || true)
+    if [[ -n "$existing_asciinema" ]]; then
+        echo "ERROR: Existing asciinema process(es) found: $existing_asciinema"
+        echo "Kill them with: pkill -f 'asciinema.*zeroshot-demo.cast'"
+        exit 1
+    fi
+
+    # Check for any running zeroshot clusters
+    local existing_zeroshot
+    existing_zeroshot=$(pgrep -f "zeroshot.*rate limiting" 2>/dev/null || true)
+    if [[ -n "$existing_zeroshot" ]]; then
+        echo "ERROR: Existing zeroshot process(es) found: $existing_zeroshot"
+        echo "Kill them with: pkill -f 'zeroshot.*rate limiting'"
+        exit 1
+    fi
+}
+
+# Parse args
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --record) RECORD_MODE=true; shift ;;
+        --force|-f) FORCE_MODE=true; shift ;;
+        *) echo "Unknown option: $1"; exit 1 ;;
+    esac
+done
+
+# Cleanup on exit
+cleanup() {
+    # Remove lock file
+    rm -f "$LOCK_FILE"
+
+    if [[ -n "$DEMO_DIR" && -d "$DEMO_DIR" ]]; then
+        echo ""
+        echo "Cleaning up $DEMO_DIR..."
+        rm -rf "$DEMO_DIR"
+        echo "Done."
+    fi
+}
+trap cleanup EXIT
+
+# Check for conflicts before doing anything
+check_existing_session
+
+# Create temp project
+DEMO_DIR=$(mktemp -d -t zeroshot-demo-XXXXXX)
+echo "Creating demo project in $DEMO_DIR"
+
+cd "$DEMO_DIR"
+
+# Initialize package.json
+cat > package.json << 'EOF'
+{
+  "name": "demo-api",
+  "version": "1.0.0",
+  "type": "commonjs",
+  "scripts": {
+    "dev": "ts-node src/index.ts",
+    "build": "tsc",
+    "start": "node dist/index.js"
+  }
+}
+EOF
+
+# Install dependencies (quiet)
+echo "Installing dependencies..."
+npm install --silent express typescript ts-node @types/express @types/node
+
+# Create tsconfig
+cat > tsconfig.json << 'EOF'
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "commonjs",
+    "strict": true,
+    "esModuleInterop": true,
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src/**/*"]
+}
+EOF
+
+# Create minimal server with users "database"
+mkdir -p src
+
+cat > src/db.ts << 'EOF'
+// Simple in-memory database
+export interface User {
+  id: number;
+  username: string;
+  email: string;
+  password_hash: string;
+  avatar: string;
+  created_at: Date;
+}
+
+export const users: User[] = [
+  {
+    id: 1,
+    username: "alice",
+    email: "alice@example.com",
+    password_hash: "$2b$10$X7VYKzPQ...",
+    avatar: "https://example.com/alice.jpg",
+    created_at: new Date("2024-01-15"),
+  },
+  {
+    id: 2,
+    username: "bob",
+    email: "bob@example.com",
+    password_hash: "$2b$10$Y8WZLaQR...",
+    avatar: "https://example.com/bob.jpg",
+    created_at: new Date("2024-02-20"),
+  },
+];
+EOF
+
+cat > src/index.ts << 'EOF'
+import express from "express";
+
+const app = express();
+const PORT = 3000;
+
+app.use(express.json());
+
+// Health check
+app.get("/health", (_, res) => {
+  res.json({ status: "ok" });
+});
+
+app.listen(PORT, () => {
+  console.log(`Server running on http://localhost:${PORT}`);
+});
+EOF
+
+# Initialize git repo
+git init --quiet
+git add -A
+git commit --quiet -m "Initial commit: Express API with users database"
+
+echo ""
+echo "=========================================="
+echo "Demo project ready!"
+echo "=========================================="
+echo ""
+echo "Directory: $DEMO_DIR"
+echo ""
+echo "Suggested demo task:"
+echo "  zeroshot 'Add PUT /users/:id endpoint to update user profile'"
+echo ""
+
+if [[ "$RECORD_MODE" == "true" ]]; then
+    echo "Recording with asciinema..."
+    echo ""
+
+    # Check asciinema is installed
+    if ! command -v asciinema &> /dev/null; then
+        echo "Error: asciinema not installed. Run: pip install asciinema"
+        exit 1
+    fi
+
+    # Warn if cast file exists (skip with --force)
+    if [[ -f "$CAST_FILE" ]] && [[ "$FORCE_MODE" != "true" ]]; then
+        echo "WARNING: $CAST_FILE already exists!"
+        echo "Previous recording will be OVERWRITTEN."
+        echo ""
+        read -p "Continue? [y/N] " -n 1 -r
+        echo ""
+        if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+            echo "Aborted."
+            exit 1
+        fi
+    fi
+
+    # Create lock file with our PID
+    echo $$ > "$LOCK_FILE"
+
+    # Record the session
+    # CRITICAL: Use bash -l -c to get full PATH (includes npm global binaries)
+    ZEROSHOT_PATH=$(which zeroshot)
+    TASK="Add rate limiting middleware: sliding window algorithm (not fixed window), per-IP tracking with in-memory store and automatic TTL cleanup to prevent memory leaks, configurable limits per endpoint. Return 429 Too Many Requests with Retry-After header (seconds until reset) and X-RateLimit-Remaining header on ALL responses. Must handle both IPv4 and IPv6, normalizing IPv6 to consistent format."
+
+    # SIGNAL ISOLATION: Use setsid to create new session, completely immune to terminal signals
+    # The recording process will NOT be killed by Ctrl+C or signals to this script
+    # We wait for it explicitly and only cleanup AFTER it naturally completes
+    echo "Starting recording in isolated session (immune to Ctrl+C)..."
+    echo "To kill it manually: pkill -f 'asciinema.*zeroshot-demo.cast'"
+    echo ""
+
+    # Disable cleanup trap during recording - we'll handle it manually
+    trap - EXIT
+
+    # Start asciinema in new session (setsid) so it's immune to our signals
+    # Save the session leader PID so we can wait for it
+    setsid bash -c "
+        # Ignore all signals - this recording WILL NOT DIE
+        trap '' INT TERM HUP QUIT
+
+        cd '$DEMO_DIR'
+        asciinema rec \
+            --overwrite \
+            --title 'Zeroshot Demo' \
+            --command \"bash -l -c '$ZEROSHOT_PATH \\\"$TASK\\\"'\" \
+            '$CAST_FILE'
+    " &
+    RECORDING_PID=$!
+
+    # Update lock file with the actual recording PID
+    echo $RECORDING_PID > "$LOCK_FILE"
+
+    echo "Recording started (session PID: $RECORDING_PID)"
+    echo "Waiting for recording to complete..."
+    echo ""
+
+    # Wait for recording to finish - this script will NOT kill it on Ctrl+C
+    # Ignore signals while waiting
+    trap '' INT TERM HUP
+    wait $RECORDING_PID 2>/dev/null || true
+
+    # Recording finished naturally - now cleanup
+    echo ""
+    echo "Recording saved to: $CAST_FILE"
+    echo ""
+    echo "Convert to gif with:"
+    echo "  agg $CAST_FILE $REPO_ROOT/zeroshot-demo.gif --idle-time-limit 2"
+
+    # Now do cleanup
+    rm -f "$LOCK_FILE"
+    if [[ -n "$DEMO_DIR" && -d "$DEMO_DIR" ]]; then
+        echo ""
+        echo "Cleaning up $DEMO_DIR..."
+        rm -rf "$DEMO_DIR"
+        echo "Done."
+    fi
+else
+    echo "Interactive mode - run zeroshot manually:"
+    echo ""
+    echo "  cd $DEMO_DIR"
+    echo "  zeroshot 'Add PUT /users/:id endpoint to update user profile'"
+    echo ""
+    echo "Press Enter when done to cleanup..."
+    read -r
+fi

package/scripts/test-install.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+# Test zeroshot installation on any platform
+# Run: ./scripts/test-install.sh
+
+set -e
+
+echo "=== Zeroshot Install Test ==="
+echo "Platform: $(uname -s) $(uname -m)"
+echo "Node: $(node --version)"
+echo "npm: $(npm --version)"
+echo ""
+
+echo "1. Installing dependencies..."
+npm install
+
+echo ""
+echo "2. Linking CLI..."
+npm link
+
+echo ""
+echo "3. Testing CLI commands..."
+
+echo "   zeroshot --version"
+zeroshot --version
+
+echo ""
+echo "   zeroshot --help"
+zeroshot --help | head -20
+
+echo ""
+echo "   zeroshot list"
+zeroshot list 2>/dev/null || echo "   (no clusters yet - this is expected)"
+
+echo ""
+echo "   zeroshot config list"
+zeroshot config list
+
+echo ""
+echo "=== ALL TESTS PASSED ==="
+echo "Zeroshot installed successfully on $(uname -s)!"

package/src/preflight.js

@@ -84,9 +84,31 @@ function getClaudeVersion() {
   }
 }
 
+/**
+ * Check macOS Keychain for Claude Code credentials
+ * @returns {{ authenticated: boolean, error: string | null }}
+ */
+function checkMacOsKeychain() {
+  if (os.platform() !== 'darwin') {
+    return { authenticated: false, error: 'Not macOS' };
+  }
+
+  try {
+    // Check if Claude Code credentials exist in Keychain
+    execSync('security find-generic-password -s "Claude Code-credentials"', {
+      encoding: 'utf8',
+      stdio: 'pipe',
+      timeout: 2000,
+    });
+    return { authenticated: true, error: null };
+  } catch {
+    return { authenticated: false, error: 'No credentials in Keychain' };
+  }
+}
+
 /**
  * Check Claude CLI authentication status
- * @returns {{ authenticated: boolean, error: string | null, configDir: string }}
+ * @returns {{ authenticated: boolean, error: string | null, configDir: string, method?: string }}
  */
 function checkClaudeAuth() {
   const configDir = process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude');
@@ -94,6 +116,20 @@ function checkClaudeAuth() {
 
   // Check if credentials file exists
   if (!fs.existsSync(credentialsPath)) {
+    // No credentials file - check macOS Keychain as fallback
+    // Only use Keychain when using default config dir (not custom CLAUDE_CONFIG_DIR)
+    const isDefaultConfigDir = !process.env.CLAUDE_CONFIG_DIR;
+    if (isDefaultConfigDir) {
+      const keychainResult = checkMacOsKeychain();
+      if (keychainResult.authenticated) {
+        return {
+          authenticated: true,
+          error: null,
+          configDir,
+          method: 'keychain',
+        };
+      }
+    }
     return {
       authenticated: false,
       error: 'No credentials file found',

package/task-lib/commands/list.js

@@ -38,7 +38,7 @@ export function listTasks(options = {}) {
 
       const statusColor =
         {
-          running: chalk.blue,
+          running: chalk.green,
           completed: chalk.green,
           failed: chalk.red,
           stale: chalk.yellow,
@@ -75,7 +75,7 @@ export function listTasks(options = {}) {
 
       const statusColor =
         {
-          running: chalk.blue,
+          running: chalk.green,
           completed: chalk.green,
           failed: chalk.red,
           stale: chalk.yellow,

package/task-lib/commands/status.js

@@ -18,7 +18,7 @@ export function showStatus(taskId) {
 
   const statusColor =
     {
-      running: chalk.blue,
+      running: chalk.green,
       completed: chalk.green,
       failed: chalk.red,
     }[task.status] || chalk.yellow;

package/task-lib/tui.js

@@ -283,7 +283,7 @@ class TaskTUI {
     const items = this.tasks.map((task) => {
       const statusIcon =
         {
-          running: '{blue-fg}●{/}',
+          running: '{green-fg}●{/}',
           completed: '{green-fg}●{/}',
           failed: '{red-fg}●{/}',
           stale: '{yellow-fg}●{/}',
@@ -372,7 +372,7 @@ class TaskTUI {
 
   getStatusColor(status) {
     const colors = {
-      running: '{blue-fg}running{/}',
+      running: '{green-fg}running{/}',
       completed: '{green-fg}completed{/}',
       failed: '{red-fg}failed{/}',
       stale: '{yellow-fg}stale{/}',