@covibes/zeroshot 5.3.0 → 5.4.0

package/lib/settings.js

@@ -13,6 +13,15 @@ const {
   normalizeProviderSettings,
 } = require('./provider-names');
 
+// Lazy-loaded to avoid circular dependency (issue-providers → settings → issue-providers)
+let _issueProviderFns = null;
+function getIssueProviderFns() {
+  if (!_issueProviderFns) {
+    _issueProviderFns = require('../src/issue-providers');
+  }
+  return _issueProviderFns;
+}
+
 /**
  * Get settings file path (dynamically reads env var for testing)
  * Using a getter ensures tests can override the path at runtime
@@ -24,6 +33,9 @@ function getSettingsFile() {
   );
 }
 
+// Import provider defaults from separate module to avoid circular dependency
+const { getProviderDefaults, clearProviderDefaultsCache } = require('./provider-defaults');
+
 /**
  * Model hierarchy for cost ceiling validation
  * Higher number = more expensive/capable model
@@ -80,30 +92,14 @@ function validateModelAgainstMax(requestedModel, maxModel, minModel = null) {
   return requestedModel;
 }
 
-// Default settings
-const DEFAULT_SETTINGS = {
+// Default settings (base - without issue provider settings which are added dynamically)
+const DEFAULT_SETTINGS_BASE = {
   maxModel: 'opus', // Cost ceiling - agents cannot use models above this
   minModel: null, // Cost floor - agents cannot use models below this (null = no minimum)
   defaultProvider: 'claude',
-  providerSettings: {
-    claude: {
-      maxLevel: 'level3',
-      minLevel: 'level1',
-      defaultLevel: 'level2',
-      levelOverrides: {},
-    },
-    codex: {
-      maxLevel: 'level3',
-      minLevel: 'level1',
-      defaultLevel: 'level2',
-      levelOverrides: {},
-    },
-    gemini: {
-      maxLevel: 'level3',
-      minLevel: 'level1',
-      defaultLevel: 'level2',
-      levelOverrides: {},
-    },
+  get providerSettings() {
+    // Dynamically build from providers on first access
+    return getProviderDefaults();
   },
   defaultConfig: 'conductor-bootstrap',
   defaultDocker: false,
@@ -117,7 +113,7 @@ const DEFAULT_SETTINGS = {
   // Example: 'ccr code' for claude-code-router integration
   claudeCommand: 'claude',
   // Docker isolation mounts - preset names or {host, container, readonly?} objects
-  // Valid presets: gh, git, ssh, aws, azure, kube, terraform, gcloud, claude, codex, gemini
+  // Valid presets: gh, git, ssh, aws, azure, kube, terraform, gcloud, claude, codex, gemini, opencode
   dockerMounts: ['gh', 'git', 'ssh'],
   // Extra env vars to pass to Docker container (in addition to preset-implied ones)
   // Supports: VAR (if set), VAR_* (pattern), VAR=value (forced), VAR= (empty)
@@ -125,8 +121,57 @@ const DEFAULT_SETTINGS = {
   // Container home directory - where $HOME resolves in container paths
   // Default: /home/node (matches zeroshot-cluster-base image)
   dockerContainerHome: '/home/node',
+  // Issue provider settings - defaultIssueSource is here, others come from providers
+  defaultIssueSource: 'github', // 'github' | 'gitlab' | 'jira' | 'azure-devops'
 };
 
+// Cache for merged defaults (base + issue provider settings)
+let _defaultSettingsCache = null;
+
+/**
+ * Get DEFAULT_SETTINGS with issue provider settings merged in
+ * Lazy-loaded to avoid circular dependency at module load time
+ */
+function getDefaultSettings() {
+  if (!_defaultSettingsCache) {
+    const issueProviderDefaults = getIssueProviderFns().getIssueProviderSettingsDefaults();
+    _defaultSettingsCache = {
+      ...DEFAULT_SETTINGS_BASE,
+      ...issueProviderDefaults,
+    };
+  }
+  return _defaultSettingsCache;
+}
+
+// For backward compatibility, export DEFAULT_SETTINGS as a getter
+const DEFAULT_SETTINGS = new Proxy(DEFAULT_SETTINGS_BASE, {
+  get(target, prop) {
+    // For known base properties, return from base
+    if (prop in target) {
+      return target[prop];
+    }
+    // For issue provider settings, get from merged defaults
+    const merged = getDefaultSettings();
+    return merged[prop];
+  },
+  has(target, prop) {
+    if (prop in target) return true;
+    const merged = getDefaultSettings();
+    return prop in merged;
+  },
+  ownKeys() {
+    const merged = getDefaultSettings();
+    return Object.keys(merged);
+  },
+  getOwnPropertyDescriptor(target, prop) {
+    const merged = getDefaultSettings();
+    if (prop in merged) {
+      return { enumerable: true, configurable: true, value: merged[prop] };
+    }
+    return undefined;
+  },
+});
+
 function mapLegacyModelToLevel(model) {
   switch (model) {
     case 'haiku':
@@ -141,10 +186,14 @@ function mapLegacyModelToLevel(model) {
 }
 
 function mergeProviderSettings(current, overrides) {
-  const merged = { ...current };
+  // Ensure current has all providers with their defaults
+  const providerDefaults = getProviderDefaults();
+  const merged = {};
+
   for (const provider of VALID_PROVIDERS) {
     merged[provider] = {
-      ...current[provider],
+      ...(providerDefaults[provider] || {}),
+      ...(current[provider] || {}),
       ...(overrides?.[provider] || {}),
     };
     if (!merged[provider].levelOverrides) {
@@ -202,7 +251,11 @@ function normalizeLoadedSettings(parsed) {
 function loadSettings() {
   const settingsFile = getSettingsFile();
   if (!fs.existsSync(settingsFile)) {
-    return { ...DEFAULT_SETTINGS };
+    // Return a copy with resolved providerSettings
+    return {
+      ...DEFAULT_SETTINGS,
+      providerSettings: getProviderDefaults(),
+    };
   }
   try {
     const data = fs.readFileSync(settingsFile, 'utf8');
@@ -210,14 +263,14 @@ function loadSettings() {
     const merged = { ...DEFAULT_SETTINGS, ...parsed };
     merged.defaultProvider =
       normalizeProviderName(merged.defaultProvider) || DEFAULT_SETTINGS.defaultProvider;
-    merged.providerSettings = mergeProviderSettings(
-      DEFAULT_SETTINGS.providerSettings,
-      parsed.providerSettings
-    );
+    merged.providerSettings = mergeProviderSettings(getProviderDefaults(), parsed.providerSettings);
     return applyLegacyModelBounds(merged);
   } catch {
     console.error('Warning: Could not load settings, using defaults');
-    return { ...DEFAULT_SETTINGS };
+    return {
+      ...DEFAULT_SETTINGS,
+      providerSettings: getProviderDefaults(),
+    };
   }
 }
 
@@ -233,6 +286,51 @@ function saveSettings(settings) {
   fs.writeFileSync(settingsFile, JSON.stringify(settings, null, 2), 'utf8');
 }
 
+/**
+ * Validate claudeCommand setting
+ * @returns {string|null} Error message if invalid, null if valid
+ */
+function validateClaudeCommand(value) {
+  if (typeof value !== 'string') {
+    return 'claudeCommand must be a string';
+  }
+  if (value.trim().length === 0) {
+    return 'claudeCommand cannot be empty';
+  }
+  return null;
+}
+
+/**
+ * Validate providerSettings structure by delegating to provider implementations
+ * @returns {string|null} Error message if invalid, null if valid
+ */
+function validateProviderSettings(value) {
+  const normalizedSettings = normalizeProviderSettings(value);
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    return 'providerSettings must be an object';
+  }
+
+  // Lazy require to avoid circular dependency
+  const { getProvider } = require('../src/providers');
+
+  for (const [providerName, settings] of Object.entries(normalizedSettings || {})) {
+    if (!VALID_PROVIDERS.includes(providerName)) {
+      return `Unknown provider in providerSettings: ${providerName}`;
+    }
+
+    // Delegate validation to the provider
+    try {
+      const provider = getProvider(providerName);
+      const error = provider.validateSettings(settings);
+      if (error) return error;
+    } catch (err) {
+      return `Failed to validate ${providerName} settings: ${err.message}`;
+    }
+  }
+
+  return null;
+}
+
 /**
  * Validate a setting value
  * @returns {string|null} Error message if invalid, null if valid
@@ -255,12 +353,7 @@ function validateSetting(key, value) {
   }
 
   if (key === 'claudeCommand') {
-    if (typeof value !== 'string') {
-      return 'claudeCommand must be a string';
-    }
-    if (value.trim().length === 0) {
-      return 'claudeCommand cannot be empty';
-    }
+    return validateClaudeCommand(value);
   }
 
   if (key === 'defaultProvider') {
@@ -271,33 +364,7 @@ function validateSetting(key, value) {
   }
 
   if (key === 'providerSettings') {
-    const normalizedSettings = normalizeProviderSettings(value);
-    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
-      return 'providerSettings must be an object';
-    }
-    for (const [provider, settings] of Object.entries(normalizedSettings || {})) {
-      if (!VALID_PROVIDERS.includes(provider)) {
-        return `Unknown provider in providerSettings: ${provider}`;
-      }
-      if (typeof settings !== 'object' || settings === null) {
-        return `providerSettings.${provider} must be an object`;
-      }
-      if (settings.maxLevel && !LEVEL_RANKS[settings.maxLevel]) {
-        return `Invalid maxLevel for ${provider}: ${settings.maxLevel}`;
-      }
-      if (settings.minLevel && !LEVEL_RANKS[settings.minLevel]) {
-        return `Invalid minLevel for ${provider}: ${settings.minLevel}`;
-      }
-      if (settings.defaultLevel && !LEVEL_RANKS[settings.defaultLevel]) {
-        return `Invalid defaultLevel for ${provider}: ${settings.defaultLevel}`;
-      }
-      if (
-        settings.levelOverrides &&
-        (typeof settings.levelOverrides !== 'object' || Array.isArray(settings.levelOverrides))
-      ) {
-        return `levelOverrides for ${provider} must be an object`;
-      }
-    }
+    return validateProviderSettings(value);
   }
 
   if (key === 'dockerMounts') {
@@ -308,9 +375,38 @@ function validateSetting(key, value) {
     return validateEnvPassthrough(value);
   }
 
+  // Issue source settings validation (grouped for maintainability)
+  const issueSourceError = validateIssueSourceSetting(key, value);
+  if (issueSourceError !== undefined) {
+    return issueSourceError;
+  }
+
   return null;
 }
 
+/**
+ * Validate issue source related settings
+ * Delegates to issue providers for provider-specific settings
+ * @param {string} key - Setting key
+ * @param {any} value - Setting value
+ * @returns {string|null|undefined} Error message, null if valid, undefined if not an issue source setting
+ */
+function validateIssueSourceSetting(key, value) {
+  // defaultIssueSource is handled here (not provider-specific)
+  if (key === 'defaultIssueSource') {
+    const { listProviders } = getIssueProviderFns();
+    const validSources = listProviders();
+    if (!validSources.includes(value)) {
+      return `Invalid issue source: ${value}. Valid: ${validSources.join(', ')}`;
+    }
+    return null;
+  }
+
+  // Delegate to issue providers for provider-specific settings
+  const { validateIssueProviderSetting } = getIssueProviderFns();
+  return validateIssueProviderSetting(key, value);
+}
+
 /**
  * Coerce value to correct type based on default value type
  */
@@ -398,6 +494,8 @@ module.exports = {
   MODEL_HIERARCHY,
   VALID_MODELS,
   validateModelAgainstMax,
+  // Provider defaults exports
+  clearProviderDefaultsCache,
   // Backward compatibility: SETTINGS_FILE as getter (reads env var dynamically)
   get SETTINGS_FILE() {
     return getSettingsFile();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@covibes/zeroshot",
-  "version": "5.3.0",
+  "version": "5.4.0",
   "description": "Multi-agent orchestration engine for Claude, Codex, and Gemini",
   "main": "src/orchestrator.js",
   "bin": {
@@ -118,6 +118,8 @@
     "depcheck": "^1.4.7",
     "eslint": "^9.39.1",
     "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-security": "^3.0.1",
+    "eslint-plugin-sonarjs": "^3.0.5",
     "eslint-plugin-unused-imports": "^4.3.0",
     "husky": "^9.1.7",
     "jscpd": "^3.5.10",
@@ -131,7 +133,10 @@
     "unimported": "^1.31.0"
   },
   "overrides": {
-    "xml2js": "^0.5.0"
+    "xml2js": "^0.5.0",
+    "diff": ">=8.0.3",
+    "tar": ">=7.5.3",
+    "undici": ">=7.18.2"
   },
   "lint-staged": {
     "*.{js,mjs,cjs}": [

package/scripts/setup-merge-queue.sh

@@ -0,0 +1,170 @@
+#!/bin/bash
+# Setup GitHub merge queue and branch protection for zeroshot
+# Run once after creating the repo or to update settings
+
+set -e
+
+REPO="covibes/zeroshot"
+
+echo "╔═══════════════════════════════════════════════════════════════════╗"
+echo "║  Setting up merge queue for $REPO                         ║"
+echo "╚═══════════════════════════════════════════════════════════════════╝"
+echo ""
+
+# Check gh is authenticated
+if ! gh auth status &>/dev/null; then
+  echo "❌ ERROR: Not authenticated with GitHub CLI"
+  echo "   Run: gh auth login"
+  exit 1
+fi
+
+# Check we have admin access
+if ! gh api "repos/$REPO" --jq '.permissions.admin' | grep -q true; then
+  echo "❌ ERROR: You need admin access to $REPO"
+  exit 1
+fi
+
+echo "✓ Authenticated with admin access"
+echo ""
+
+# ============================================================================
+# Configure 'dev' branch protection (merge target)
+# ============================================================================
+
+echo "→ Configuring 'dev' branch protection..."
+
+gh api --method PUT "repos/$REPO/branches/dev/protection" \
+  --input - <<EOF
+{
+  "required_status_checks": {
+    "strict": true,
+    "contexts": ["check", "install-matrix (ubuntu-latest, 20)", "install-matrix (macos-latest, 20)"]
+  },
+  "enforce_admins": false,
+  "required_pull_request_reviews": null,
+  "restrictions": null,
+  "allow_force_pushes": false,
+  "allow_deletions": false,
+  "required_linear_history": true,
+  "required_conversation_resolution": false
+}
+EOF
+
+echo "✓ 'dev' branch protection configured"
+
+# Enable merge queue for dev branch
+echo "→ Enabling merge queue for 'dev' branch..."
+
+# Note: Merge queue requires GitHub Enterprise or public repos with Actions
+# Using the ruleset API which supports merge queue
+gh api --method POST "repos/$REPO/rulesets" \
+  --input - <<EOF 2>/dev/null || echo "   (ruleset may already exist)"
+{
+  "name": "dev-merge-queue",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/heads/dev"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {
+      "type": "merge_queue",
+      "parameters": {
+        "check_response_timeout_minutes": 30,
+        "grouping_strategy": "ALLGREEN",
+        "max_entries_to_build": 5,
+        "max_entries_to_merge": 5,
+        "merge_method": "SQUASH",
+        "min_entries_to_merge": 1,
+        "min_entries_to_merge_wait_minutes": 1
+      }
+    }
+  ]
+}
+EOF
+
+echo "✓ Merge queue enabled for 'dev'"
+
+# ============================================================================
+# Configure 'main' branch protection (release branch)
+# ============================================================================
+
+echo "→ Configuring 'main' branch protection..."
+
+gh api --method PUT "repos/$REPO/branches/main/protection" \
+  --input - <<EOF
+{
+  "required_status_checks": {
+    "strict": true,
+    "contexts": ["check", "install-matrix (ubuntu-latest, 20)", "install-matrix (macos-latest, 20)"]
+  },
+  "enforce_admins": false,
+  "required_pull_request_reviews": {
+    "required_approving_review_count": 1,
+    "dismiss_stale_reviews": true,
+    "require_code_owner_reviews": false
+  },
+  "restrictions": null,
+  "allow_force_pushes": false,
+  "allow_deletions": false,
+  "required_linear_history": true,
+  "required_conversation_resolution": false
+}
+EOF
+
+echo "✓ 'main' branch protection configured"
+
+# ============================================================================
+# Configure repository settings
+# ============================================================================
+
+echo "→ Configuring repository settings..."
+
+gh api --method PATCH "repos/$REPO" \
+  --input - <<EOF
+{
+  "allow_squash_merge": true,
+  "allow_merge_commit": false,
+  "allow_rebase_merge": false,
+  "squash_merge_commit_title": "PR_TITLE",
+  "squash_merge_commit_message": "PR_BODY",
+  "delete_branch_on_merge": true,
+  "allow_auto_merge": true
+}
+EOF
+
+echo "✓ Repository settings configured"
+
+# ============================================================================
+# Summary
+# ============================================================================
+
+echo ""
+echo "╔═══════════════════════════════════════════════════════════════════╗"
+echo "║  ✓ Merge queue setup complete!                                    ║"
+echo "╚═══════════════════════════════════════════════════════════════════╝"
+echo ""
+echo "Workflow:"
+echo "  feature-branch (local)"
+echo "  ↓"
+echo "  pre-push hook → lint + typecheck (~5s)"
+echo "  ↓"
+echo "  push to origin/feature-branch"
+echo "  ↓"
+echo "  gh pr create --base dev"
+echo "  ↓"
+echo "  CI runs tests on PR branch"
+echo "  ↓"
+echo "  gh pr merge --auto --squash → enters merge queue"
+echo "  ↓"
+echo "  Queue rebases PR on latest dev + runs CI again"
+echo "  ↓"
+echo "  Merge to dev (only if CI passes on rebased code)"
+echo ""
+echo "Release workflow:"
+echo "  gh pr create --base main --head dev --title \"Release\""
+echo "  → CI passes → merge → semantic-release publishes"
+echo ""