@covibes/zeroshot 5.2.1 → 5.4.0

package/lib/provider-defaults.js

@@ -0,0 +1,62 @@
+/**
+ * Provider defaults module
+ *
+ * Separated from settings.js to break circular dependency:
+ * - settings.js requires provider defaults
+ * - providers require settings.js (for loadSettings, getClaudeCommand, etc.)
+ *
+ * CRITICAL: This module should NOT import from settings.js
+ */
+
+// Cache provider defaults to avoid repeated instantiation
+let _providerDefaultsCache = null;
+
+/**
+ * Build provider default settings by instantiating each provider
+ * and calling getDefaultSettings()
+ * @returns {Object} Map of provider name to default settings
+ */
+function buildProviderDefaults() {
+  const { listProviders, getProvider } = require('../src/providers');
+
+  const defaults = {};
+  for (const providerName of listProviders()) {
+    try {
+      const provider = getProvider(providerName);
+      defaults[providerName] = provider.getDefaultSettings();
+    } catch (error) {
+      // If provider fails to instantiate, use basic defaults
+      console.warn(`Warning: Could not get defaults for ${providerName}: ${error.message}`);
+      defaults[providerName] = {
+        maxLevel: 'level3',
+        minLevel: 'level1',
+        defaultLevel: 'level2',
+        levelOverrides: {},
+      };
+    }
+  }
+  return defaults;
+}
+
+/**
+ * Get or build cached provider defaults
+ * @returns {Object} Provider defaults
+ */
+function getProviderDefaults() {
+  if (!_providerDefaultsCache) {
+    _providerDefaultsCache = buildProviderDefaults();
+  }
+  return _providerDefaultsCache;
+}
+
+/**
+ * Clear the provider defaults cache (primarily for testing)
+ */
+function clearProviderDefaultsCache() {
+  _providerDefaultsCache = null;
+}
+
+module.exports = {
+  getProviderDefaults,
+  clearProviderDefaultsCache,
+};

package/lib/provider-detection.js

@@ -0,0 +1,59 @@
+const { execSync, spawnSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+function commandExists(command) {
+  if (!command) return false;
+  if (command.includes(path.sep)) {
+    return fs.existsSync(command);
+  }
+  try {
+    execSync(`command -v ${command}`, { stdio: 'pipe' });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function getCommandPath(command) {
+  if (!command) return null;
+  if (command.includes(path.sep)) {
+    return fs.existsSync(command) ? command : null;
+  }
+  try {
+    const output = execSync(`command -v ${command}`, { encoding: 'utf8', stdio: 'pipe' });
+    return output.trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+function getHelpOutput(command, args = []) {
+  if (!commandExists(command)) return '';
+
+  const attempt = (flag) => {
+    const result = spawnSync(command, [...args, flag], { encoding: 'utf8' });
+    const output = `${result.stdout || ''}${result.stderr || ''}`;
+    return output.trim();
+  };
+
+  const help = attempt('--help');
+  if (help) return help;
+
+  const alt = attempt('-h');
+  return alt || '';
+}
+
+function getVersionOutput(command, args = []) {
+  if (!commandExists(command)) return '';
+  const result = spawnSync(command, [...args, '--version'], { encoding: 'utf8' });
+  const output = `${result.stdout || ''}${result.stderr || ''}`;
+  return output.trim();
+}
+
+module.exports = {
+  commandExists,
+  getCommandPath,
+  getHelpOutput,
+  getVersionOutput,
+};

package/lib/provider-names.js

@@ -0,0 +1,57 @@
+const PROVIDER_ALIASES = {
+  anthropic: 'claude',
+  openai: 'codex',
+  google: 'gemini',
+  claude: 'claude',
+  codex: 'codex',
+  gemini: 'gemini',
+  opencode: 'opencode',
+};
+
+const VALID_PROVIDERS = ['claude', 'codex', 'gemini', 'opencode'];
+
+function normalizeProviderName(name) {
+  if (!name || typeof name !== 'string') return name;
+  const normalized = PROVIDER_ALIASES[name.toLowerCase()];
+  return normalized || name;
+}
+
+function normalizeProviderSettings(providerSettings) {
+  if (
+    !providerSettings ||
+    typeof providerSettings !== 'object' ||
+    Array.isArray(providerSettings)
+  ) {
+    return providerSettings;
+  }
+
+  const normalized = {};
+  const entries = Object.entries(providerSettings);
+  const aliasFirst = entries.sort(([left], [right]) => {
+    const leftIsCanonical = normalizeProviderName(left) === left;
+    const rightIsCanonical = normalizeProviderName(right) === right;
+    if (leftIsCanonical === rightIsCanonical) return 0;
+    return leftIsCanonical ? 1 : -1;
+  });
+
+  for (const [key, value] of aliasFirst) {
+    const canonical = normalizeProviderName(key);
+    if (!VALID_PROVIDERS.includes(canonical)) {
+      normalized[key] = value;
+      continue;
+    }
+    normalized[canonical] = {
+      ...(normalized[canonical] || {}),
+      ...(value || {}),
+    };
+  }
+
+  return normalized;
+}
+
+module.exports = {
+  PROVIDER_ALIASES,
+  VALID_PROVIDERS,
+  normalizeProviderName,
+  normalizeProviderSettings,
+};

package/lib/settings/claude-auth.js

@@ -0,0 +1,78 @@
+/**
+ * Claude authentication settings and helpers
+ * Extracted from settings.js for provider-specific isolation
+ */
+
+/**
+ * Anthropic API key prefix for validation
+ */
+const ANTHROPIC_KEY_PREFIX = 'sk-ant-';
+
+/**
+ * Environment variables used for Claude authentication
+ */
+const CLAUDE_AUTH_ENV_VARS = [
+  'ANTHROPIC_API_KEY',
+  'AWS_BEARER_TOKEN_BEDROCK',
+  'AWS_REGION',
+  'CLAUDE_CODE_USE_BEDROCK',
+];
+
+/**
+ * Validate an Anthropic API key format
+ * @param {string|null|undefined} key - API key to validate
+ * @returns {boolean} True if key is falsy OR starts with valid prefix
+ */
+function isValidAnthropicKey(key) {
+  return !key || key.startsWith(ANTHROPIC_KEY_PREFIX);
+}
+
+/**
+ * Check if Bedrock mode is active based on env and overrides
+ * @param {Object} [envOverrides={}] - Environment variable overrides to check
+ * @returns {boolean} True if Bedrock mode is active
+ */
+function isBedrockMode(envOverrides = {}) {
+  return (
+    envOverrides.CLAUDE_CODE_USE_BEDROCK === '1' || process.env.CLAUDE_CODE_USE_BEDROCK === '1'
+  );
+}
+
+/**
+ * Resolve Claude authentication environment variables from settings
+ * Bedrock takes priority over direct Anthropic API key AND OAuth session
+ * @param {Object} settings - Settings object from loadSettings()
+ * @returns {Object} Environment variables to set for Claude auth
+ */
+function resolveClaudeAuth(settings) {
+  const claudeSettings = settings.providerSettings?.claude || {};
+  const env = {};
+
+  // Bedrock takes priority over everything (including OAuth)
+  if (!process.env.AWS_BEARER_TOKEN_BEDROCK && claudeSettings.bedrockApiKey) {
+    env.AWS_BEARER_TOKEN_BEDROCK = claudeSettings.bedrockApiKey;
+    env.CLAUDE_CODE_USE_BEDROCK = '1';
+    if (claudeSettings.bedrockRegion && !process.env.AWS_REGION) {
+      env.AWS_REGION = claudeSettings.bedrockRegion;
+    }
+  } else if (process.env.AWS_BEARER_TOKEN_BEDROCK && !process.env.CLAUDE_CODE_USE_BEDROCK) {
+    // Auto-set CLAUDE_CODE_USE_BEDROCK if token present in env
+    env.CLAUDE_CODE_USE_BEDROCK = '1';
+  }
+
+  // Anthropic API key only if no Bedrock
+  const hasBedrock = env.AWS_BEARER_TOKEN_BEDROCK || process.env.AWS_BEARER_TOKEN_BEDROCK;
+  if (!process.env.ANTHROPIC_API_KEY && !hasBedrock && claudeSettings.anthropicApiKey) {
+    env.ANTHROPIC_API_KEY = claudeSettings.anthropicApiKey;
+  }
+
+  return env;
+}
+
+module.exports = {
+  ANTHROPIC_KEY_PREFIX,
+  CLAUDE_AUTH_ENV_VARS,
+  isValidAnthropicKey,
+  isBedrockMode,
+  resolveClaudeAuth,
+};

package/lib/settings.js

@@ -7,6 +7,20 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const { validateMountConfig, validateEnvPassthrough } = require('./docker-config');
+const {
+  VALID_PROVIDERS,
+  normalizeProviderName,
+  normalizeProviderSettings,
+} = require('./provider-names');
+
+// Lazy-loaded to avoid circular dependency (issue-providers → settings → issue-providers)
+let _issueProviderFns = null;
+function getIssueProviderFns() {
+  if (!_issueProviderFns) {
+    _issueProviderFns = require('../src/issue-providers');
+  }
+  return _issueProviderFns;
+}
 
 /**
  * Get settings file path (dynamically reads env var for testing)
@@ -14,9 +28,14 @@ const { validateMountConfig, validateEnvPassthrough } = require('./docker-config
  * @returns {string}
  */
 function getSettingsFile() {
-  return process.env.ZEROSHOT_SETTINGS_FILE || path.join(os.homedir(), '.zeroshot', 'settings.json');
+  return (
+    process.env.ZEROSHOT_SETTINGS_FILE || path.join(os.homedir(), '.zeroshot', 'settings.json')
+  );
 }
 
+// Import provider defaults from separate module to avoid circular dependency
+const { getProviderDefaults, clearProviderDefaultsCache } = require('./provider-defaults');
+
 /**
  * Model hierarchy for cost ceiling validation
  * Higher number = more expensive/capable model
@@ -28,15 +47,17 @@ const MODEL_HIERARCHY = {
 };
 
 const VALID_MODELS = Object.keys(MODEL_HIERARCHY);
+const LEVEL_RANKS = { level1: 1, level2: 2, level3: 3 };
 
 /**
- * Validate a requested model against the maxModel ceiling
+ * Validate a requested model against the maxModel ceiling and minModel floor
  * @param {string} requestedModel - Model the agent wants to use
  * @param {string} maxModel - Maximum allowed model (cost ceiling)
+ * @param {string|null} minModel - Minimum required model (cost floor)
  * @returns {string} The validated model
- * @throws {Error} If requested model exceeds ceiling
+ * @throws {Error} If requested model exceeds ceiling or falls below floor
  */
-function validateModelAgainstMax(requestedModel, maxModel) {
+function validateModelAgainstMax(requestedModel, maxModel, minModel = null) {
   if (!requestedModel) return maxModel; // Default to ceiling if unspecified
 
   if (!VALID_MODELS.includes(requestedModel)) {
@@ -52,12 +73,34 @@ function validateModelAgainstMax(requestedModel, maxModel) {
         `Either lower agent's model or raise maxModel.`
     );
   }
+
+  if (minModel) {
+    if (!VALID_MODELS.includes(minModel)) {
+      throw new Error(`Invalid minModel "${minModel}". Valid: ${VALID_MODELS.join(', ')}`);
+    }
+    if (MODEL_HIERARCHY[minModel] > MODEL_HIERARCHY[maxModel]) {
+      throw new Error(`minModel "${minModel}" cannot be higher than maxModel "${maxModel}".`);
+    }
+    if (MODEL_HIERARCHY[requestedModel] < MODEL_HIERARCHY[minModel]) {
+      throw new Error(
+        `Agent requests "${requestedModel}" but minModel is "${minModel}". ` +
+          `Either raise agent's model or lower minModel.`
+      );
+    }
+  }
+
   return requestedModel;
 }
 
-// Default settings
-const DEFAULT_SETTINGS = {
+// Default settings (base - without issue provider settings which are added dynamically)
+const DEFAULT_SETTINGS_BASE = {
   maxModel: 'opus', // Cost ceiling - agents cannot use models above this
+  minModel: null, // Cost floor - agents cannot use models below this (null = no minimum)
+  defaultProvider: 'claude',
+  get providerSettings() {
+    // Dynamically build from providers on first access
+    return getProviderDefaults();
+  },
   defaultConfig: 'conductor-bootstrap',
   defaultDocker: false,
   strictSchema: true, // true = reliable json output (default), false = live streaming (may crash - see bold-meadow-11)
@@ -70,7 +113,7 @@ const DEFAULT_SETTINGS = {
   // Example: 'ccr code' for claude-code-router integration
   claudeCommand: 'claude',
   // Docker isolation mounts - preset names or {host, container, readonly?} objects
-  // Valid presets: gh, git, ssh, aws, azure, kube, terraform, gcloud
+  // Valid presets: gh, git, ssh, aws, azure, kube, terraform, gcloud, claude, codex, gemini, opencode
   dockerMounts: ['gh', 'git', 'ssh'],
   // Extra env vars to pass to Docker container (in addition to preset-implied ones)
   // Supports: VAR (if set), VAR_* (pattern), VAR=value (forced), VAR= (empty)
@@ -78,22 +121,156 @@ const DEFAULT_SETTINGS = {
   // Container home directory - where $HOME resolves in container paths
   // Default: /home/node (matches zeroshot-cluster-base image)
   dockerContainerHome: '/home/node',
+  // Issue provider settings - defaultIssueSource is here, others come from providers
+  defaultIssueSource: 'github', // 'github' | 'gitlab' | 'jira' | 'azure-devops'
 };
 
+// Cache for merged defaults (base + issue provider settings)
+let _defaultSettingsCache = null;
+
+/**
+ * Get DEFAULT_SETTINGS with issue provider settings merged in
+ * Lazy-loaded to avoid circular dependency at module load time
+ */
+function getDefaultSettings() {
+  if (!_defaultSettingsCache) {
+    const issueProviderDefaults = getIssueProviderFns().getIssueProviderSettingsDefaults();
+    _defaultSettingsCache = {
+      ...DEFAULT_SETTINGS_BASE,
+      ...issueProviderDefaults,
+    };
+  }
+  return _defaultSettingsCache;
+}
+
+// For backward compatibility, export DEFAULT_SETTINGS as a getter
+const DEFAULT_SETTINGS = new Proxy(DEFAULT_SETTINGS_BASE, {
+  get(target, prop) {
+    // For known base properties, return from base
+    if (prop in target) {
+      return target[prop];
+    }
+    // For issue provider settings, get from merged defaults
+    const merged = getDefaultSettings();
+    return merged[prop];
+  },
+  has(target, prop) {
+    if (prop in target) return true;
+    const merged = getDefaultSettings();
+    return prop in merged;
+  },
+  ownKeys() {
+    const merged = getDefaultSettings();
+    return Object.keys(merged);
+  },
+  getOwnPropertyDescriptor(target, prop) {
+    const merged = getDefaultSettings();
+    if (prop in merged) {
+      return { enumerable: true, configurable: true, value: merged[prop] };
+    }
+    return undefined;
+  },
+});
+
+function mapLegacyModelToLevel(model) {
+  switch (model) {
+    case 'haiku':
+      return 'level1';
+    case 'sonnet':
+      return 'level2';
+    case 'opus':
+      return 'level3';
+    default:
+      return null;
+  }
+}
+
+function mergeProviderSettings(current, overrides) {
+  // Ensure current has all providers with their defaults
+  const providerDefaults = getProviderDefaults();
+  const merged = {};
+
+  for (const provider of VALID_PROVIDERS) {
+    merged[provider] = {
+      ...(providerDefaults[provider] || {}),
+      ...(current[provider] || {}),
+      ...(overrides?.[provider] || {}),
+    };
+    if (!merged[provider].levelOverrides) {
+      merged[provider].levelOverrides = {};
+    }
+  }
+  return merged;
+}
+
+function applyLegacyModelBounds(settings) {
+  if (!settings.providerSettings) return settings;
+  const claude = settings.providerSettings.claude || {};
+  const legacyMaxLevel = mapLegacyModelToLevel(settings.maxModel);
+  const legacyMinLevel = mapLegacyModelToLevel(settings.minModel);
+
+  if (legacyMaxLevel) {
+    claude.maxLevel = legacyMaxLevel;
+  }
+
+  if (legacyMinLevel) {
+    claude.minLevel = legacyMinLevel;
+  }
+
+  const minRank = LEVEL_RANKS[claude.minLevel] || LEVEL_RANKS.level1;
+  const maxRank = LEVEL_RANKS[claude.maxLevel] || LEVEL_RANKS.level3;
+  const defaultRank = LEVEL_RANKS[claude.defaultLevel] || LEVEL_RANKS.level2;
+
+  if (minRank > maxRank) {
+    claude.minLevel = 'level1';
+    claude.maxLevel = 'level3';
+  } else if (defaultRank < minRank) {
+    claude.defaultLevel = claude.minLevel;
+  } else if (defaultRank > maxRank) {
+    claude.defaultLevel = claude.maxLevel;
+  }
+
+  settings.providerSettings.claude = claude;
+  return settings;
+}
+
+function normalizeLoadedSettings(parsed) {
+  const normalized = { ...parsed };
+  if (parsed.defaultProvider) {
+    normalized.defaultProvider = normalizeProviderName(parsed.defaultProvider);
+  }
+  if (parsed.providerSettings) {
+    normalized.providerSettings = normalizeProviderSettings(parsed.providerSettings);
+  }
+  return normalized;
+}
+
 /**
  * Load settings from disk, merging with defaults
  */
 function loadSettings() {
   const settingsFile = getSettingsFile();
   if (!fs.existsSync(settingsFile)) {
-    return { ...DEFAULT_SETTINGS };
+    // Return a copy with resolved providerSettings
+    return {
+      ...DEFAULT_SETTINGS,
+      providerSettings: getProviderDefaults(),
+    };
   }
   try {
     const data = fs.readFileSync(settingsFile, 'utf8');
-    return { ...DEFAULT_SETTINGS, ...JSON.parse(data) };
+    const parsed = normalizeLoadedSettings(JSON.parse(data));
+    const merged = { ...DEFAULT_SETTINGS, ...parsed };
+    merged.defaultProvider =
+      normalizeProviderName(merged.defaultProvider) || DEFAULT_SETTINGS.defaultProvider;
+    merged.providerSettings = mergeProviderSettings(getProviderDefaults(), parsed.providerSettings);
+    return applyLegacyModelBounds(merged);
   } catch {
     console.error('Warning: Could not load settings, using defaults');
-    return { ...DEFAULT_SETTINGS };
+    return {
+      ...DEFAULT_SETTINGS,
+      providerSettings: getProviderDefaults(),
+    };
   }
 }
 
@@ -109,6 +286,51 @@ function saveSettings(settings) {
   fs.writeFileSync(settingsFile, JSON.stringify(settings, null, 2), 'utf8');
 }
 
+/**
+ * Validate claudeCommand setting
+ * @returns {string|null} Error message if invalid, null if valid
+ */
+function validateClaudeCommand(value) {
+  if (typeof value !== 'string') {
+    return 'claudeCommand must be a string';
+  }
+  if (value.trim().length === 0) {
+    return 'claudeCommand cannot be empty';
+  }
+  return null;
+}
+
+/**
+ * Validate providerSettings structure by delegating to provider implementations
+ * @returns {string|null} Error message if invalid, null if valid
+ */
+function validateProviderSettings(value) {
+  const normalizedSettings = normalizeProviderSettings(value);
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    return 'providerSettings must be an object';
+  }
+
+  // Lazy require to avoid circular dependency
+  const { getProvider } = require('../src/providers');
+
+  for (const [providerName, settings] of Object.entries(normalizedSettings || {})) {
+    if (!VALID_PROVIDERS.includes(providerName)) {
+      return `Unknown provider in providerSettings: ${providerName}`;
+    }
+
+    // Delegate validation to the provider
+    try {
+      const provider = getProvider(providerName);
+      const error = provider.validateSettings(settings);
+      if (error) return error;
+    } catch (err) {
+      return `Failed to validate ${providerName} settings: ${err.message}`;
+    }
+  }
+
+  return null;
+}
+
 /**
  * Validate a setting value
  * @returns {string|null} Error message if invalid, null if valid
@@ -122,19 +344,29 @@ function validateSetting(key, value) {
     return `Invalid model: ${value}. Valid models: ${VALID_MODELS.join(', ')}`;
   }
 
+  if (key === 'minModel' && value !== null && !VALID_MODELS.includes(value)) {
+    return `Invalid model: ${value}. Valid models: ${VALID_MODELS.join(', ')}, null`;
+  }
+
   if (key === 'logLevel' && !['quiet', 'normal', 'verbose'].includes(value)) {
     return `Invalid log level: ${value}. Valid levels: quiet, normal, verbose`;
   }
 
   if (key === 'claudeCommand') {
-    if (typeof value !== 'string') {
-      return 'claudeCommand must be a string';
-    }
-    if (value.trim().length === 0) {
-      return 'claudeCommand cannot be empty';
+    return validateClaudeCommand(value);
+  }
+
+  if (key === 'defaultProvider') {
+    const normalized = normalizeProviderName(value);
+    if (!VALID_PROVIDERS.includes(normalized)) {
+      return `Invalid provider: ${value}. Valid providers: ${VALID_PROVIDERS.join(', ')}`;
     }
   }
 
+  if (key === 'providerSettings') {
+    return validateProviderSettings(value);
+  }
+
   if (key === 'dockerMounts') {
     return validateMountConfig(value);
   }
@@ -143,15 +375,49 @@ function validateSetting(key, value) {
     return validateEnvPassthrough(value);
   }
 
+  // Issue source settings validation (grouped for maintainability)
+  const issueSourceError = validateIssueSourceSetting(key, value);
+  if (issueSourceError !== undefined) {
+    return issueSourceError;
+  }
+
   return null;
 }
 
+/**
+ * Validate issue source related settings
+ * Delegates to issue providers for provider-specific settings
+ * @param {string} key - Setting key
+ * @param {any} value - Setting value
+ * @returns {string|null|undefined} Error message, null if valid, undefined if not an issue source setting
+ */
+function validateIssueSourceSetting(key, value) {
+  // defaultIssueSource is handled here (not provider-specific)
+  if (key === 'defaultIssueSource') {
+    const { listProviders } = getIssueProviderFns();
+    const validSources = listProviders();
+    if (!validSources.includes(value)) {
+      return `Invalid issue source: ${value}. Valid: ${validSources.join(', ')}`;
+    }
+    return null;
+  }
+
+  // Delegate to issue providers for provider-specific settings
+  const { validateIssueProviderSetting } = getIssueProviderFns();
+  return validateIssueProviderSetting(key, value);
+}
+
 /**
  * Coerce value to correct type based on default value type
  */
 function coerceValue(key, value) {
   const defaultValue = DEFAULT_SETTINGS[key];
 
+  // Handle null values for minModel
+  if (key === 'minModel' && (value === 'null' || value === null)) {
+    return null;
+  }
+
   if (typeof defaultValue === 'boolean') {
     return value === 'true' || value === '1' || value === 'yes' || value === true;
   }
@@ -183,6 +449,21 @@ function coerceValue(key, value) {
     return value;
   }
 
+  if (key === 'providerSettings') {
+    if (typeof value === 'string') {
+      try {
+        return normalizeProviderSettings(JSON.parse(value));
+      } catch {
+        throw new Error(`Invalid JSON for providerSettings: ${value}`);
+      }
+    }
+    return normalizeProviderSettings(value);
+  }
+
+  if (key === 'defaultProvider') {
+    return normalizeProviderName(value);
+  }
+
   return value;
 }
 
@@ -213,6 +494,8 @@ module.exports = {
   MODEL_HIERARCHY,
   VALID_MODELS,
   validateModelAgainstMax,
+  // Provider defaults exports
+  clearProviderDefaultsCache,
   // Backward compatibility: SETTINGS_FILE as getter (reads env var dynamically)
   get SETTINGS_FILE() {
     return getSettingsFile();