@the-open-engine/zeroshot 6.1.0 → 6.3.0

package/cli/message-formatters-normal.js

@@ -7,6 +7,7 @@
  */
 
 const chalk = require('chalk');
+const { EVENT_COPY, formatMergeStatus } = require('./event-copy');
 
 /**
  * Format AGENT_LIFECYCLE events
@@ -115,7 +116,9 @@ function formatIssueOpened(msg, prefix, timestamp, shownNewTaskForCluster, print
  * @returns {boolean} True if message was handled
  */
 function formatImplementationReady(msg, prefix, timestamp, print = console.log) {
-  print(`${prefix} ${chalk.gray(timestamp)} ${chalk.bold.yellow('✅ IMPLEMENTATION READY')}`);
+  print(
+    `${prefix} ${chalk.gray(timestamp)} ${chalk.bold.yellow(`✅ ${EVENT_COPY.IMPLEMENTATION_READY.toUpperCase()}`)}`
+  );
 
   if (msg.content?.data?.commit) {
     print(
@@ -233,7 +236,9 @@ function formatPrCreated(msg, prefix, timestamp, print = console.log) {
 
   print(''); // Blank line before PR notification
   print(chalk.bold.green(`${'─'.repeat(60)}`));
-  print(`${prefix} ${chalk.gray(timestamp)} ${chalk.bold.green('🎉 PULL REQUEST CREATED')}`);
+  print(
+    `${prefix} ${chalk.gray(timestamp)} ${chalk.bold.green(`🎉 ${EVENT_COPY.PR_CREATED.toUpperCase()}`)}`
+  );
 
   if (prNumber) {
     print(`${prefix} ${chalk.gray('PR:')} ${chalk.cyan(`#${prNumber}`)}`);
@@ -242,6 +247,13 @@ function formatPrCreated(msg, prefix, timestamp, print = console.log) {
     print(`${prefix} ${chalk.gray('URL:')} ${chalk.blue(prUrl)}`);
   }
 
+  const mergeStatus = formatMergeStatus(msg.content?.data?.merged);
+  if (mergeStatus) {
+    print(
+      `${prefix} ${chalk.gray('Merge:')} ${mergeStatus === 'merged' ? chalk.green(mergeStatus) : chalk.yellow(mergeStatus)}`
+    );
+  }
+
   print(chalk.bold.green(`${'─'.repeat(60)}`));
   return true;
 }

package/cli/message-formatters-watch.js

@@ -9,6 +9,7 @@ const {
   getColorForSender,
   parseDataField,
 } = require('./message-formatter-utils');
+const { EVENT_COPY, formatMergeStatus } = require('./event-copy');
 
 /**
  * Format AGENT_ERROR for watch mode
@@ -49,7 +50,7 @@ function formatIssueOpened(msg, clusterPrefix) {
 function formatImplementationReady(msg, clusterPrefix) {
   const agentColor = getColorForSender(msg.sender);
   const agentName = agentColor(msg.sender);
-  const eventText = `${agentName} completed implementation`;
+  const eventText = `${agentName} ${EVENT_COPY.IMPLEMENTATION_READY.toLowerCase()}`;
   console.log(`${clusterPrefix} ${eventText}`);
 }
 
@@ -109,7 +110,11 @@ function formatPrCreated(msg, clusterPrefix) {
   const agentColor = getColorForSender(msg.sender);
   const agentName = agentColor(msg.sender);
   const prNum = msg.content?.data?.pr_number || '';
-  const eventText = `${agentName} created PR${prNum ? ` #${prNum}` : ''}`;
+  let eventText = `${agentName} ${EVENT_COPY.PR_CREATED.toLowerCase()}${prNum ? ` #${prNum}` : ''}`;
+  const mergeStatus = formatMergeStatus(msg.content?.data?.merged);
+  if (mergeStatus) {
+    eventText += chalk.dim(` — ${mergeStatus}`);
+  }
   console.log(`${clusterPrefix} ${eventText}`);
 }
 
@@ -182,4 +187,6 @@ function formatWatchMode(msg, isActive) {
 
 module.exports = {
   formatWatchMode,
+  formatImplementationReady,
+  formatPrCreated,
 };

package/cluster-hooks/block-ask-user-question.py

@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+"""
+PreToolUse hook to block AskUserQuestion in zeroshot agent mode.
+
+This hook is installed globally but ONLY activates when the environment
+variable ZEROSHOT_BLOCK_ASK_USER=1 is set. This keeps the blocking
+specific to zeroshot invocations without affecting normal Claude usage.
+
+Exit codes:
+- 0 with JSON: Normal execution (allow/deny decision)
+- 0 without output: No decision (pass through)
+"""
+
+import json
+import os
+import sys
+
+def main():
+    # Only activate in zeroshot mode (env var set by agent-wrapper)
+    if os.environ.get("ZEROSHOT_BLOCK_ASK_USER") != "1":
+        # Not in zeroshot mode - pass through without decision
+        sys.exit(0)
+
+    try:
+        input_data = json.load(sys.stdin)
+    except json.JSONDecodeError:
+        # Invalid input - let it through
+        sys.exit(0)
+
+    tool_name = input_data.get("tool_name", "")
+
+    if tool_name == "AskUserQuestion":
+        # Block the tool with a clear explanation
+        output = {
+            "hookSpecificOutput": {
+                "hookEventName": "PreToolUse",
+                "permissionDecision": "deny",
+                "permissionDecisionReason": (
+                    "AskUserQuestion is BLOCKED in zeroshot cluster mode. "
+                    "You are running non-interactively with no user to respond. "
+                    "Make autonomous decisions instead. "
+                    "If choosing between 'fix code' vs 'relax rules', ALWAYS fix the code."
+                )
+            }
+        }
+        print(json.dumps(output))
+        sys.exit(0)
+
+    # All other tools - no decision (let normal permissions apply)
+    sys.exit(0)
+
+if __name__ == "__main__":
+    main()

package/cluster-hooks/block-dangerous-git.py

@@ -0,0 +1,145 @@
+#!/usr/bin/env python3
+"""
+PreToolUse hook to block dangerous git commands in zeroshot worktree mode.
+
+This hook is installed globally but ONLY activates when the environment
+variable ZEROSHOT_WORKTREE=1 is set. This keeps the blocking specific to
+worktree-isolated zeroshot invocations.
+
+Blocks:
+- git stash (all forms) - hides work from other agents
+- git checkout -- <file> - discards uncommitted changes
+- git checkout -f / git checkout . - discards all local changes
+- git reset --hard - destroys commits AND changes
+- git push --force / -f - rewrites remote history
+- git clean -f/-fd - deletes untracked files
+- git branch -D - force deletes unmerged branch
+- git rebase -i / git add -i/-p - interactive (hangs in non-interactive mode)
+
+Exit codes:
+- 0 with JSON: Normal execution (allow/deny decision)
+- 0 without output: No decision (pass through)
+"""
+
+import json
+import os
+import re
+import sys
+from typing import Optional, Tuple
+
+
+# Patterns that should be BLOCKED
+# Each tuple: (pattern, reason, safe_alternative)
+DANGEROUS_PATTERNS = [
+    # Stash - hides work from other agents
+    (r"\bgit\s+stash\b",
+     "git stash hides work from other agents",
+     "Use 'git add -A && git commit -m \"WIP: ...\"' instead"),
+
+    # Checkout discarding changes
+    (r"\bgit\s+checkout\s+--\s+\S+",
+     "git checkout -- <file> discards uncommitted changes permanently",
+     "Commit your work first: 'git add -A && git commit -m \"WIP: ...\"'"),
+
+    (r"\bgit\s+checkout\s+-f\b",
+     "git checkout -f discards ALL local changes permanently",
+     "Commit your work first: 'git add -A && git commit -m \"WIP: ...\"'"),
+
+    (r"\bgit\s+checkout\s+\.\s*$",
+     "git checkout . discards all changes in the directory",
+     "Commit your work first: 'git add -A && git commit -m \"WIP: ...\"'"),
+
+    # Reset --hard
+    (r"\bgit\s+reset\s+--hard\b",
+     "git reset --hard destroys commits AND uncommitted changes",
+     "Use 'git reset --soft' to keep changes, or 'git revert' to undo commits"),
+
+    # Force push
+    (r"\bgit\s+push\s+--force\b",
+     "git push --force rewrites remote history",
+     "Use 'git push' (normal push) or 'git pull --rebase' to sync"),
+
+    (r"\bgit\s+push\s+-f\b",
+     "git push -f rewrites remote history",
+     "Use 'git push' (normal push) or 'git pull --rebase' to sync"),
+
+    # Clean with force
+    (r"\bgit\s+clean\s+-[fd]*f",
+     "git clean -f deletes untracked files permanently",
+     "Use 'git clean -n' (dry run) first to see what would be deleted"),
+
+    # Branch force delete
+    (r"\bgit\s+branch\s+-D\b",
+     "git branch -D force deletes unmerged branch",
+     "Use 'git branch -d' (lowercase) which only deletes merged branches"),
+
+    # Interactive commands (hang in non-interactive mode)
+    (r"\bgit\s+rebase\s+-i\b",
+     "git rebase -i is interactive and will hang in non-interactive mode",
+     "Use 'git reset --soft HEAD~N' to undo commits while keeping changes"),
+
+    (r"\bgit\s+add\s+-[ip]\b",
+     "git add -i/-p is interactive and will hang in non-interactive mode",
+     "Use 'git add <files>' or 'git add -A' instead"),
+]
+
+
+def check_command(command: str) -> Optional[Tuple[bool, str, str]]:
+    """Check if command matches any dangerous pattern.
+
+    Returns (matched, reason, alternative) if dangerous, None if safe.
+
+    NOTE: We do NOT use re.IGNORECASE because git flags are case-sensitive.
+    For example: 'git branch -d' (lowercase) is safe, 'git branch -D' (uppercase) is dangerous.
+    """
+    for pattern, reason, alternative in DANGEROUS_PATTERNS:
+        if re.search(pattern, command):
+            return (True, reason, alternative)
+    return None
+
+
+def main():
+    # Only activate in zeroshot worktree mode
+    if os.environ.get("ZEROSHOT_WORKTREE") != "1":
+        # Not in worktree mode - pass through without decision
+        sys.exit(0)
+
+    try:
+        input_data = json.load(sys.stdin)
+    except json.JSONDecodeError:
+        # Invalid input - let it through
+        sys.exit(0)
+
+    tool_name = input_data.get("tool_name", "")
+
+    # Only check Bash tool
+    if tool_name != "Bash":
+        sys.exit(0)
+
+    tool_input = input_data.get("tool_input", {})
+    command = tool_input.get("command", "")
+
+    # Check for dangerous patterns
+    result = check_command(command)
+    if result:
+        _, reason, alternative = result
+        output = {
+            "hookSpecificOutput": {
+                "hookEventName": "PreToolUse",
+                "permissionDecision": "deny",
+                "permissionDecisionReason": (
+                    f"[GIT-SAFE BLOCKED] {reason}\n\n"
+                    f"Safe alternative: {alternative}\n\n"
+                    "NO BYPASS EXISTS. Use the safe alternative above."
+                )
+            }
+        }
+        print(json.dumps(output))
+        sys.exit(0)
+
+    # Command is safe - no decision (let normal permissions apply)
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

package/lib/clusters-registry.js

@@ -0,0 +1,48 @@
+/**
+ * Single read/write path for clusters.json.
+ *
+ * All callers that need the raw registry (Orchestrator, id-detector, gc,
+ * socket-discovery, CLI) go through readClustersFileSync/writeClustersFileAtomic
+ * instead of ad-hoc JSON.parse(fs.readFileSync(...)) / fs.writeFileSync(...).
+ *
+ * Writes are atomic (temp file + rename) so a reader can never observe a
+ * partially-written file, even without taking the write lock. Callers that
+ * read-modify-write (Orchestrator._saveClusters) still need proper-lockfile
+ * around the whole operation to avoid losing concurrent updates.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+function clustersFilePath(storageDir) {
+  return path.join(storageDir, 'clusters.json');
+}
+
+/**
+ * Read clusters.json. Returns {} if missing or unparsable.
+ * @param {string} storageDir
+ * @returns {Object}
+ */
+function readClustersFileSync(storageDir) {
+  const clustersFile = clustersFilePath(storageDir);
+  if (!fs.existsSync(clustersFile)) {
+    return {};
+  }
+  const raw = fs.readFileSync(clustersFile, 'utf8');
+  return JSON.parse(raw);
+}
+
+/**
+ * Write clusters.json atomically (write to a pid-scoped temp file, then rename).
+ * rename(2) is atomic on the same filesystem, so no reader can observe a partial file.
+ * @param {string} storageDir
+ * @param {Object} data
+ */
+function writeClustersFileAtomic(storageDir, data) {
+  const clustersFile = clustersFilePath(storageDir);
+  const tmpPath = `${clustersFile}.tmp-${process.pid}`;
+  fs.writeFileSync(tmpPath, JSON.stringify(data, null, 2));
+  fs.renameSync(tmpPath, clustersFile);
+}
+
+module.exports = { clustersFilePath, readClustersFileSync, writeClustersFileAtomic };

package/lib/compose-utils.js

@@ -0,0 +1,101 @@
+/**
+ * Docker Compose teardown resolution for worktree cleanup.
+ *
+ * Zeroshot never runs `docker compose up` — any compose file found in a worktree
+ * belongs to the target repo, not to zeroshot. Tearing it down is only safe when
+ * the resolved Compose project name is scoped to the worktree directory itself
+ * (i.e. nothing pins it to the host's real, possibly-already-running project).
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const COMPOSE_FILENAMES = [
+  'docker-compose.yml',
+  'docker-compose.yaml',
+  'compose.yml',
+  'compose.yaml',
+];
+
+/**
+ * Reproduce Docker Compose's default project-name normalization
+ * (compose-go NormalizeProjectName: lowercase -> keep [a-z0-9_-] -> trim leading '_'/'-').
+ *
+ * @param {string} name
+ * @returns {string}
+ */
+function normalizeComposeProjectName(name) {
+  return name
+    .toLowerCase()
+    .replace(/[^a-z0-9_-]/g, '')
+    .replace(/^[-_]+/, '');
+}
+
+/**
+ * Decide whether it's safe to run `docker compose down` in a worktree, and with what args.
+ * Never includes `--volumes` — automatic cleanup must not delete named volumes.
+ * Skips teardown entirely when the Compose project name is pinned (top-level `name:`
+ * in the compose file, or `COMPOSE_PROJECT_NAME` env var), since that resolves to a
+ * shared/host project zeroshot did not create.
+ *
+ * @param {string} worktreePath - Path to the worktree directory
+ * @returns {{ shouldTeardown: boolean, reason?: string, composePath?: string, args?: string[] }}
+ */
+function resolveWorktreeComposeTeardown(worktreePath) {
+  let composePath = null;
+  for (const filename of COMPOSE_FILENAMES) {
+    const candidate = path.join(worktreePath, filename);
+    if (fs.existsSync(candidate)) {
+      composePath = candidate;
+      break;
+    }
+  }
+
+  if (!composePath) {
+    return { shouldTeardown: false, reason: 'no compose file' };
+  }
+
+  if (
+    typeof process.env.COMPOSE_PROJECT_NAME === 'string' &&
+    process.env.COMPOSE_PROJECT_NAME.trim() !== ''
+  ) {
+    return {
+      shouldTeardown: false,
+      reason: 'pinned compose project name (shared host project)',
+      composePath,
+    };
+  }
+
+  try {
+    const yaml = require('js-yaml');
+    const contents = fs.readFileSync(composePath, 'utf8');
+    const parsed = yaml.load(contents);
+    if (parsed && typeof parsed === 'object' && parsed.name) {
+      return {
+        shouldTeardown: false,
+        reason: 'pinned compose project name (shared host project)',
+        composePath,
+      };
+    }
+  } catch {
+    // Fail safe: if the compose file can't be read/parsed, we cannot confirm project
+    // identity is worktree-scoped, so never tear down.
+    return { shouldTeardown: false, reason: 'compose file unreadable or unparsable', composePath };
+  }
+
+  return {
+    shouldTeardown: true,
+    composePath,
+    args: [
+      'compose',
+      '-p',
+      normalizeComposeProjectName(path.basename(worktreePath)),
+      'down',
+      '--remove-orphans',
+      '--timeout',
+      '10',
+    ],
+  };
+}
+
+module.exports = { resolveWorktreeComposeTeardown, normalizeComposeProjectName };

package/lib/detached-startup.js

@@ -131,6 +131,7 @@ async function registerDetachedSetupCluster({
             prBase: runOptions.prBase,
             mergeQueue: runOptions.mergeQueue || false,
             closeIssue: runOptions.closeIssue || null,
+            autoMerge: Boolean(runOptions.ship),
             cwd: cwd || null,
           }
         : null,
@@ -146,6 +147,13 @@ async function registerDetachedSetupCluster({
   });
 }
 
+async function removeDetachedSetupCluster({ clusterId, storageDir }) {
+  await updateClustersFile(storageDir, (clusters) => {
+    delete clusters[clusterId];
+    return clusters;
+  });
+}
+
 async function markDetachedSetupFailed({ clusterId, storageDir, error, logPath }) {
   await updateClustersFile(storageDir, (clusters) => {
     const existing = clusters[clusterId] || { id: clusterId, createdAt: Date.now() };
@@ -215,6 +223,7 @@ module.exports = {
   isProcessAlive,
   markDetachedSetupFailed,
   registerDetachedSetupCluster,
+  removeDetachedSetupCluster,
   resolveWaitTimeoutMs,
   waitForClusterRegistration,
 };

package/lib/id-detector.js

@@ -11,6 +11,7 @@ const path = require('path');
 const fs = require('fs');
 const os = require('os');
 const Database = require('better-sqlite3');
+const { readClustersFileSync } = require('./clusters-registry');
 
 /**
  * Detect if ID is a cluster or task
@@ -20,19 +21,17 @@ const Database = require('better-sqlite3');
 function detectIdType(id) {
   const homeDir =
     process.env.ZEROSHOT_HOME || process.env.HOME || process.env.USERPROFILE || os.homedir();
-  const clusterFile = path.join(homeDir, '.zeroshot', 'clusters.json');
+  const storageDir = path.join(homeDir, '.zeroshot');
   const taskDbFile = path.join(homeDir, '.claude-zeroshot', 'store.db');
 
   // Check clusters
-  if (fs.existsSync(clusterFile)) {
-    try {
-      const clusters = JSON.parse(fs.readFileSync(clusterFile, 'utf8'));
-      if (clusters[id]) {
-        return 'cluster';
-      }
-    } catch {
-      // Ignore parse errors
+  try {
+    const clusters = readClustersFileSync(storageDir);
+    if (clusters[id]) {
+      return 'cluster';
     }
+  } catch {
+    // Ignore parse errors
   }
 
   // Check tasks in SQLite

package/lib/path-check.js

@@ -0,0 +1,63 @@
+/**
+ * Detects whether the npm global bin directory is on PATH, so we can warn
+ * the user when `npm install -g` succeeds but the `zeroshot` binary is
+ * unreachable (e.g. non-standard Node installs whose global bin dir isn't
+ * exported).
+ */
+
+const path = require('path');
+
+function getGlobalBinDir(installPrefix) {
+  if (process.platform === 'win32') {
+    return installPrefix;
+  }
+
+  return path.join(installPrefix, 'bin');
+}
+
+function isDirOnPath(dir, pathEnv = process.env.PATH || '') {
+  const resolvedDir = path.resolve(dir);
+
+  return pathEnv
+    .split(path.delimiter)
+    .filter((entry) => entry.length > 0)
+    .some((entry) => path.resolve(entry) === resolvedDir);
+}
+
+function getPathExportLine(dir) {
+  return `export PATH="${dir}:$PATH"`;
+}
+
+function checkBinDirOnPath(options = {}) {
+  if (process.platform === 'win32') {
+    return { onPath: true, binDir: null };
+  }
+
+  try {
+    const { getInstallPrefix } = require('../cli/lib/update-checker');
+    const installPrefix = options.installPrefix || getInstallPrefix(options);
+    const binDir = getGlobalBinDir(installPrefix);
+
+    return { onPath: isDirOnPath(binDir, options.pathEnv), binDir };
+  } catch {
+    return { onPath: true, binDir: null };
+  }
+}
+
+function printPathWarning(binDir) {
+  console.error(
+    `[zeroshot] Warning: ${binDir} is not on your PATH — the 'zeroshot' command may not be found.`
+  );
+  console.error(`  ${getPathExportLine(binDir)}`);
+  console.error(
+    '  Add this line to your shell profile (~/.zshrc, ~/.bashrc, or ~/.profile) to fix this permanently.'
+  );
+}
+
+module.exports = {
+  getGlobalBinDir,
+  isDirOnPath,
+  getPathExportLine,
+  checkBinDirOnPath,
+  printPathWarning,
+};

package/lib/run-mode.js

@@ -0,0 +1,22 @@
+function resolveRunMode(options) {
+  if (options.ship) return options.docker ? 'ship+docker' : 'ship';
+  if (options.pr) return options.docker ? 'pr+docker' : 'pr';
+  if (options.docker) return 'docker';
+  if (options.worktree) return 'worktree';
+  return null;
+}
+
+const RUN_MODE_LABELS = {
+  ship: 'ship (worktree + PR + auto-merge)',
+  'ship+docker': 'ship (docker + PR + auto-merge)',
+  pr: 'pr (worktree + PR)',
+  'pr+docker': 'pr (docker + PR)',
+  docker: 'docker (isolated container)',
+  worktree: 'worktree (isolated branch)',
+};
+
+function describeRunMode(mode) {
+  return RUN_MODE_LABELS[mode] || 'local (no isolation)';
+}
+
+module.exports = { resolveRunMode, describeRunMode };

package/lib/start-cluster.js

@@ -3,7 +3,9 @@ const { spawnSync } = require('child_process');
 const chalk = require('chalk');
 const { normalizeProviderName } = require('./provider-names');
 const { getProvider } = require('../src/providers');
+const { detectProvider } = require('../src/issue-providers');
 const TemplateResolver = require('../src/template-resolver');
+const { resolveRunMode } = require('./run-mode');
 
 const PACKAGE_ROOT = path.resolve(__dirname, '..');
 
@@ -96,35 +98,44 @@ function buildFileInput(file) {
   return { file };
 }
 
-function detectRunInput(inputArg) {
-  const isGitHubUrl = /^https?:\/\/github\.com\/[\w-]+\/[\w-]+\/issues\/\d+/.test(inputArg);
-  const isGitLabUrl = /gitlab\.(com|[\w.-]+)\/[\w-]+\/[\w-]+\/-\/issues\/\d+/.test(inputArg);
-  const isJiraUrl = /(atlassian\.net|jira\.[\w.-]+)\/browse\/[A-Z][A-Z0-9]+-\d+/.test(inputArg);
-  const isAzureUrl =
-    /dev\.azure\.com\/.*\/_workitems\/edit\/\d+/.test(inputArg) ||
-    /visualstudio\.com\/.*\/_workitems\/edit\/\d+/.test(inputArg);
-  const isJiraKey = /^[A-Z][A-Z0-9]+-\d+$/.test(inputArg);
-  const isIssueNumber = /^\d+$/.test(inputArg);
-  const isRepoIssue = /^[\w-]+\/[\w-]+#\d+$/.test(inputArg);
+function detectRunInput(inputArg, settings = {}, forceProvider = null) {
   const isMarkdownFile = /\.(md|markdown)$/i.test(inputArg);
-
-  if (
-    isGitHubUrl ||
-    isGitLabUrl ||
-    isJiraUrl ||
-    isAzureUrl ||
-    isJiraKey ||
-    isIssueNumber ||
-    isRepoIssue
-  ) {
-    return buildIssueInput(inputArg);
-  }
   if (isMarkdownFile) {
     return buildFileInput(inputArg);
   }
+
+  const ProviderClass = detectProvider(inputArg, settings, forceProvider);
+  if (ProviderClass) {
+    return buildIssueInput(inputArg);
+  }
+
   return buildTextInput(inputArg);
 }
 
+const STDIN_MARKER = '-';
+
+function isStdinInput(inputArg) {
+  return inputArg === STDIN_MARKER;
+}
+
+async function readStdinText(stream = process.stdin) {
+  const chunks = [];
+  for await (const chunk of stream) {
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks.map((chunk) => (Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk))))
+    .toString('utf8')
+    .trim();
+}
+
+function encodeStdinEnv(text) {
+  return Buffer.from(text, 'utf8').toString('base64');
+}
+
+function decodeStdinEnv(value) {
+  return Buffer.from(value, 'base64').toString('utf8');
+}
+
 function resolveProviderOverride(options = {}) {
   const override = options.provider || options.envProvider || process.env.ZEROSHOT_PROVIDER;
   if (!override || (typeof override === 'string' && !override.trim())) {
@@ -234,7 +245,7 @@ function buildStartOptions({
     isolationImage: firstTruthy(mergedOptions.dockerImage, process.env.ZEROSHOT_DOCKER_IMAGE),
     worktree: anyTruthy(mergedOptions.worktree, process.env.ZEROSHOT_WORKTREE === '1'),
     autoPr: anyTruthy(mergedOptions.pr, process.env.ZEROSHOT_PR === '1'),
-    autoMerge: process.env.ZEROSHOT_MERGE === '1',
+    autoMerge: Boolean(mergedOptions.ship),
     autoPush: process.env.ZEROSHOT_PUSH === '1',
     modelOverride: optionalValue(modelOverride),
     providerOverride: optionalValue(providerOverride),
@@ -246,6 +257,7 @@ function buildStartOptions({
     mergeQueue: resolveMergeQueue(mergedOptions),
     closeIssue: resolveCloseIssue(mergedOptions),
     ship: mergedOptions.ship,
+    runMode: resolveRunMode(mergedOptions) || null,
     requiredQualityGates: mergedOptions.requiredQualityGates,
     settings,
   };
@@ -310,6 +322,10 @@ module.exports = {
   buildIssueInput,
   buildFileInput,
   detectRunInput,
+  isStdinInput,
+  readStdinText,
+  encodeStdinEnv,
+  decodeStdinEnv,
   resolveProviderOverride,
   resolveConfigPath,
   loadClusterConfig,