@the-open-engine/zeroshot 6.22.0 → 6.23.0

package/src/command-cleanup-ownership.js

@@ -0,0 +1,307 @@
+const { lstat, realpath, rm, unlink } = require('fs/promises');
+const { lstatSync, realpathSync, rmSync, unlinkSync } = require('fs');
+const { tmpdir } = require('os');
+const { basename, dirname, isAbsolute, resolve } = require('path');
+
+const {
+  isCanonicalClaudeSettingsOverlayDirectory,
+  isClaudeSettingsOverlayDirectory,
+} = require('./worktree-claude-config');
+const { isCanonicalOmpConfigOverlayDirectory } = require('./omp-config-overlay');
+
+const CLEANUP_METADATA_KEYS = ['kind', 'path', 'provider', 'reason'];
+const SCHEMA_DIRECTORY_PATTERN = /^zeroshot-schema-[A-Za-z0-9_-]+$/u;
+const SCHEMA_FILE_PATTERN =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\.json$/u;
+const POLICY_DIRECTORY_PATTERN = /^zeroshot-gemini-policy-[A-Za-z0-9_-]+$/u;
+const POLICY_FILE_PATTERN =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\.toml$/u;
+const OPENCODE_CONFIG_DIRECTORY_PATTERN = /^zeroshot-opencode-config-[A-Za-z0-9_-]+$/u;
+
+function assertClosedCleanupMetadata(cleanupPath, metadata) {
+  if (!metadata || typeof metadata !== 'object' || Array.isArray(metadata)) {
+    throw new Error(`Refusing cleanup without closed ownership metadata: ${cleanupPath}`);
+  }
+  const keys = Object.keys(metadata).sort();
+  if (
+    keys.length !== CLEANUP_METADATA_KEYS.length ||
+    keys.some((key, index) => key !== CLEANUP_METADATA_KEYS[index])
+  ) {
+    throw new Error(`Refusing cleanup with open ownership metadata: ${cleanupPath}`);
+  }
+  if (metadata.path !== cleanupPath) {
+    throw new Error(`Refusing cleanup with mismatched ownership path: ${cleanupPath}`);
+  }
+}
+
+function createCleanupPlan(commandSpec) {
+  if (!Array.isArray(commandSpec?.cleanup) || !Array.isArray(commandSpec?.cleanupMetadata)) {
+    throw new Error('Refusing cleanup with malformed cleanup collections');
+  }
+  if (commandSpec.cleanup.length !== commandSpec.cleanupMetadata.length) {
+    throw new Error('Refusing cleanup without one closed metadata receipt per path');
+  }
+  const uniquePaths = new Set(commandSpec.cleanup);
+  if (uniquePaths.size !== commandSpec.cleanup.length) {
+    throw new Error('Refusing cleanup with duplicate cleanup paths');
+  }
+
+  return commandSpec.cleanup.map((cleanupPath) => {
+    if (typeof cleanupPath !== 'string' || cleanupPath.length === 0) {
+      throw new Error('Refusing cleanup with a non-string or empty path');
+    }
+    const matches = commandSpec.cleanupMetadata.filter(
+      (metadata) => metadata?.path === cleanupPath
+    );
+    if (matches.length !== 1) {
+      throw new Error(`Refusing cleanup without exact ownership metadata: ${cleanupPath}`);
+    }
+    assertClosedCleanupMetadata(cleanupPath, matches[0]);
+    return { cleanupPath, metadata: matches[0] };
+  });
+}
+
+function isCanonicalNamedTempDirectory(cleanupPath, pattern) {
+  return (
+    isAbsolute(cleanupPath) &&
+    resolve(cleanupPath) === cleanupPath &&
+    dirname(cleanupPath) === resolve(tmpdir()) &&
+    pattern.test(basename(cleanupPath))
+  );
+}
+
+function assertOwnedNamedTempDirectory(cleanupPath, pattern) {
+  if (!isCanonicalNamedTempDirectory(cleanupPath, pattern)) {
+    throw new Error(`Refusing unowned temporary directory cleanup: ${cleanupPath}`);
+  }
+  let stat;
+  try {
+    stat = lstatSync(cleanupPath);
+  } catch (error) {
+    if (error?.code === 'ENOENT') return true;
+    throw error;
+  }
+  const tempRoot = realpathSync(tmpdir());
+  const realDirectory = realpathSync(cleanupPath);
+  if (
+    stat.isSymbolicLink() ||
+    !stat.isDirectory() ||
+    dirname(realDirectory) !== tempRoot ||
+    basename(realDirectory) !== basename(cleanupPath)
+  ) {
+    throw new Error(`Refusing unowned temporary directory cleanup: ${cleanupPath}`);
+  }
+  return false;
+}
+
+function assertOwnedOmpConfigDirectory(cleanupPath) {
+  if (!isCanonicalOmpConfigOverlayDirectory(cleanupPath)) {
+    throw new Error(`Refusing unowned temporary directory cleanup: ${cleanupPath}`);
+  }
+  let stat;
+  try {
+    stat = lstatSync(cleanupPath);
+  } catch (error) {
+    if (error?.code === 'ENOENT') return true;
+    throw error;
+  }
+  const tempRoot = realpathSync(tmpdir());
+  const realDirectory = realpathSync(cleanupPath);
+  const ownedByProcess = typeof process.getuid !== 'function' || stat.uid === process.getuid();
+  const privateMode = process.platform === 'win32' || (stat.mode & 0o777) === 0o700;
+  if (
+    stat.isSymbolicLink() ||
+    !stat.isDirectory() ||
+    !ownedByProcess ||
+    !privateMode ||
+    dirname(realDirectory) !== tempRoot ||
+    basename(realDirectory) !== basename(cleanupPath)
+  ) {
+    throw new Error(`Refusing unowned temporary directory cleanup: ${cleanupPath}`);
+  }
+  return false;
+}
+
+function assertOwnedTempDirectory(cleanupPath, metadata) {
+  const isOpenCodeConfig =
+    metadata.provider === 'opencode' && metadata.reason === 'isolated-config';
+  if (isOpenCodeConfig) {
+    return assertOwnedNamedTempDirectory(cleanupPath, OPENCODE_CONFIG_DIRECTORY_PATTERN);
+  }
+
+  const isOmpConfig = metadata.provider === 'omp' && metadata.reason === 'isolated-config';
+  if (isOmpConfig) {
+    return assertOwnedOmpConfigDirectory(cleanupPath);
+  }
+
+  if (
+    metadata.provider !== 'claude' ||
+    metadata.reason !== 'settings-overlay' ||
+    !isCanonicalClaudeSettingsOverlayDirectory(cleanupPath)
+  ) {
+    throw new Error(`Refusing unowned temporary directory cleanup: ${cleanupPath}`);
+  }
+  if (isClaudeSettingsOverlayDirectory(cleanupPath)) {
+    return false;
+  }
+  try {
+    lstatSync(cleanupPath);
+  } catch (error) {
+    if (error?.code === 'ENOENT') return true;
+    throw error;
+  }
+  throw new Error(`Refusing unowned temporary directory cleanup: ${cleanupPath}`);
+}
+
+function assertCanonicalSchemaPath(cleanupPath, metadata) {
+  const isCodexSchema =
+    metadata.kind === 'temp-file' &&
+    metadata.provider === 'codex' &&
+    metadata.reason === 'output-schema';
+  const isGeminiPolicy =
+    metadata.kind === 'temp-file' &&
+    metadata.provider === 'gemini' &&
+    metadata.reason === 'admin-policy';
+  if (
+    (!isCodexSchema && !isGeminiPolicy) ||
+    !isAbsolute(cleanupPath) ||
+    resolve(cleanupPath) !== cleanupPath
+  ) {
+    throw new Error(
+      `Refusing unowned ${isGeminiPolicy ? 'admin-policy' : 'output-schema'} cleanup: ${cleanupPath}`
+    );
+  }
+  const ownedDirectory = dirname(cleanupPath);
+  const matchesOwnedName = isCodexSchema
+    ? SCHEMA_DIRECTORY_PATTERN.test(basename(ownedDirectory)) &&
+      SCHEMA_FILE_PATTERN.test(basename(cleanupPath))
+    : POLICY_DIRECTORY_PATTERN.test(basename(ownedDirectory)) &&
+      POLICY_FILE_PATTERN.test(basename(cleanupPath));
+  if (dirname(ownedDirectory) !== resolve(tmpdir()) || !matchesOwnedName) {
+    throw new Error(
+      `Refusing non-canonical ${isGeminiPolicy ? 'admin-policy' : 'output-schema'} cleanup: ${cleanupPath}`
+    );
+  }
+}
+
+async function assertOwnedSchemaFile(cleanupPath, metadata) {
+  assertCanonicalSchemaPath(cleanupPath, metadata);
+  const schemaDirectory = dirname(cleanupPath);
+  const [tempRoot, realSchemaDirectory, directoryStat, schemaStat] = await Promise.all([
+    realpath(tmpdir()),
+    realpath(schemaDirectory),
+    lstat(schemaDirectory),
+    lstat(cleanupPath),
+  ]);
+  if (
+    directoryStat.isSymbolicLink() ||
+    !directoryStat.isDirectory() ||
+    dirname(realSchemaDirectory) !== tempRoot ||
+    basename(realSchemaDirectory) !== basename(schemaDirectory) ||
+    schemaStat.isSymbolicLink() ||
+    !schemaStat.isFile()
+  ) {
+    throw new Error(`Refusing non-regular or escaped output-schema cleanup: ${cleanupPath}`);
+  }
+}
+
+function assertOwnedSchemaFileSync(cleanupPath, metadata) {
+  assertCanonicalSchemaPath(cleanupPath, metadata);
+  const schemaDirectory = dirname(cleanupPath);
+  const tempRoot = realpathSync(tmpdir());
+  const realSchemaDirectory = realpathSync(schemaDirectory);
+  const directoryStat = lstatSync(schemaDirectory);
+  const schemaStat = lstatSync(cleanupPath);
+  if (
+    directoryStat.isSymbolicLink() ||
+    !directoryStat.isDirectory() ||
+    dirname(realSchemaDirectory) !== tempRoot ||
+    basename(realSchemaDirectory) !== basename(schemaDirectory) ||
+    schemaStat.isSymbolicLink() ||
+    !schemaStat.isFile()
+  ) {
+    throw new Error(`Refusing non-regular or escaped output-schema cleanup: ${cleanupPath}`);
+  }
+}
+
+async function removeCleanupPath(cleanupPath, metadata) {
+  if (metadata.kind === 'temp-directory') {
+    if (assertOwnedTempDirectory(cleanupPath, metadata)) return;
+    await rm(cleanupPath, { recursive: true, force: true });
+    return;
+  }
+  await assertOwnedSchemaFile(cleanupPath, metadata);
+  await unlink(cleanupPath);
+}
+
+function removeCleanupPathSync(cleanupPath, metadata) {
+  if (metadata.kind === 'temp-directory') {
+    if (assertOwnedTempDirectory(cleanupPath, metadata)) return;
+    rmSync(cleanupPath, { recursive: true, force: true });
+    return;
+  }
+  assertOwnedSchemaFileSync(cleanupPath, metadata);
+  unlinkSync(cleanupPath);
+}
+
+/**
+ * Build one idempotent cleanup owner for a provider command. Callers may run it
+ * only after the persisted provider termination boundary is terminal.
+ */
+function createCommandSpecCleanup(commandSpec, logFailure) {
+  let started = false;
+  let result = true;
+
+  return {
+    async run() {
+      if (started) return result;
+      started = true;
+      let cleanupPlan;
+      try {
+        cleanupPlan = createCleanupPlan(commandSpec);
+      } catch (error) {
+        logFailure('<command-cleanup>', error);
+        result = false;
+        return result;
+      }
+      let succeeded = true;
+      for (const { cleanupPath, metadata } of cleanupPlan) {
+        try {
+          await removeCleanupPath(cleanupPath, metadata);
+        } catch (error) {
+          if (error?.code === 'ENOENT') continue;
+          succeeded = false;
+          logFailure(cleanupPath, error);
+        }
+      }
+      result = succeeded;
+      return result;
+    },
+    runSync() {
+      if (started) return result;
+      started = true;
+      let cleanupPlan;
+      try {
+        cleanupPlan = createCleanupPlan(commandSpec);
+      } catch (error) {
+        logFailure('<command-cleanup>', error);
+        result = false;
+        return result;
+      }
+      let succeeded = true;
+      for (const { cleanupPath, metadata } of cleanupPlan) {
+        try {
+          removeCleanupPathSync(cleanupPath, metadata);
+        } catch (error) {
+          if (error?.code === 'ENOENT') continue;
+          succeeded = false;
+          logFailure(cleanupPath, error);
+        }
+      }
+      result = succeeded;
+      return result;
+    },
+  };
+}
+
+module.exports = { createCommandSpecCleanup };

package/src/omp-config-overlay.js

@@ -0,0 +1,96 @@
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { randomUUID } = require('crypto');
+
+const OVERLAY_PREFIX = 'zeroshot-omp-config-';
+const OMP_CONFIG_OVERLAY_DIR_PATTERN = /^zeroshot-omp-config-[A-Za-z0-9_-]+$/u;
+const OMP_CONFIG_OVERLAY_FILE_PATTERN =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\.yml$/u;
+
+// Verified against tagged v17.2.1 source: packages/coding-agent/src/config/settings-schema.ts
+// (key types/defaults) and packages/coding-agent/src/main.ts (HOST_DEFAULTED_SETTING_PATHS /
+// RPC_BACKGROUND_DEFAULTED_SETTING_PATHS). RPC mode (docs/rpc.md) only re-applies its own
+// neutral defaults for task.*/memory.backend/memories.enabled/advisor.*/tier.advisor/
+// async.*/bash.autoBackground.* when a path is completely unconfigured at every settings
+// layer; `todo.*` is explicitly caller-controlled and never host-defaulted in RPC mode
+// (main.ts: "embedders need project-level opt-outs for reminder/prelude prompt injection").
+// A host's ~/.omp/agent/config.yml or project .omp/config.yml can therefore change one of
+// these workflow-altering namespaces out from under an unattended RPC worker. This overlay
+// pins every one of them to its schema built-in default plus marketplace.autoUpdate off, so
+// Zeroshot's worker behavior never depends on the host machine's OMP config. It deliberately
+// never sets context/skills/rules/extensions/mcp keys, which keep flowing from native
+// project/user config underneath this overlay.
+const OVERLAY_BODY = `# Zeroshot-owned OMP safety overlay — do not add model/profile settings.
+marketplace:
+  autoUpdate: "off"
+todo:
+  enabled: true
+  reminders: true
+  remindersMax: 3
+  eager: "default"
+task:
+  isolation:
+    mode: "none"
+    apply: true
+    merge: "patch"
+    commits: "generic"
+  eager: "default"
+  batch: true
+  maxConcurrency: 32
+  maxRecursionDepth: 2
+  disabledAgents: []
+  agentModelOverrides: {}
+  agentPrewalk: {}
+memory:
+  backend: "off"
+memories:
+  enabled: false
+advisor:
+  enabled: false
+  subagents: false
+  syncBacklog: "off"
+  immuneTurns: 3
+tier:
+  advisor: "none"
+async:
+  enabled: true
+  maxJobs: 100
+bash:
+  autoBackground:
+    enabled: false
+    thresholdMs: 60000
+`;
+
+function createOmpConfigOverlay() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), OVERLAY_PREFIX), { mode: 0o700 });
+  try {
+    const file = path.join(dir, `${randomUUID()}.yml`);
+    fs.writeFileSync(file, OVERLAY_BODY, { flag: 'wx', mode: 0o600 });
+    if (process.platform !== 'win32') {
+      fs.chmodSync(dir, 0o700);
+      fs.chmodSync(file, 0o600);
+    }
+    return { dir, file };
+  } catch (error) {
+    fs.rmSync(dir, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+function isCanonicalOmpConfigOverlayDirectory(overlayDir) {
+  if (typeof overlayDir !== 'string' || !overlayDir || path.resolve(overlayDir) !== overlayDir) {
+    return false;
+  }
+  return (
+    path.dirname(overlayDir) === path.resolve(os.tmpdir()) &&
+    OMP_CONFIG_OVERLAY_DIR_PATTERN.test(path.basename(overlayDir))
+  );
+}
+
+module.exports = {
+  OMP_CONFIG_OVERLAY_DIR_PATTERN,
+  OMP_CONFIG_OVERLAY_FILE_PATTERN,
+  createOmpConfigOverlay,
+  isCanonicalOmpConfigOverlayDirectory,
+};

package/src/orchestrator.js

@@ -46,7 +46,11 @@ const { generateName } = require('./name-generator');
 const configValidator = require('./config-validator');
 const TemplateResolver = require('./template-resolver');
 const { loadSettings } = require('../lib/settings');
-const { normalizeProviderName, getDefaultProviderId } = require('../lib/provider-names');
+const {
+  normalizeProviderName,
+  getDefaultProviderId,
+  providerSupportsCapability,
+} = require('../lib/provider-names');
 const { resolveRunPlan } = require('../lib/run-plan');
 const { isProcessRunning } = require('../lib/process-liveness');
 const { getProvider } = require('./providers');
@@ -1819,14 +1823,19 @@ class Orchestrator {
     let isolationImage = null;
 
     if (options.isolation) {
+      // Resolve the provider first so the capability gate and the cluster's image variant (which
+      // installs the provider CLI as a Docker-cached layer) both see the same provider. Providers
+      // baked into the base image (e.g. Claude) resolve back to the base image unchanged.
+      const providerName = this._resolveClusterProvider(config);
+      if (!providerSupportsCapability(providerName, 'dockerIsolation')) {
+        throw new Error(
+          `Provider ${providerName} does not support Docker isolation; run without --docker (worktree isolation is supported).`
+        );
+      }
       if (!IsolationManager.isDockerAvailable()) {
         throw new Error('Docker is not available. Install Docker to use --docker mode.');
       }
 
-      // Resolve the provider first so the cluster runs on that provider's image variant, which
-      // installs the provider CLI as a Docker-cached layer. Providers baked into the base image
-      // (e.g. Claude) resolve back to the base image unchanged.
-      const providerName = this._resolveClusterProvider(config);
       const baseImage = options.isolationImage || 'zeroshot-cluster-base';
       const image = IsolationManager.imageForProvider(providerName, baseImage);
       await IsolationManager.ensureImage(
@@ -1850,6 +1859,12 @@ class Orchestrator {
       });
       this._log(`[Orchestrator] Container created: ${containerId} (workDir: ${workDir})`);
     } else if (options.worktree) {
+      const providerName = this._resolveClusterProvider(config);
+      if (!providerSupportsCapability(providerName, 'worktreeIsolation')) {
+        throw new Error(
+          `Provider ${providerName} does not support worktree isolation; run without --worktree.`
+        );
+      }
       const workDir = options.cwd || process.cwd();
 
       isolationManager = new IsolationManager({});

package/src/preflight.js

@@ -24,6 +24,7 @@ const {
   getDefaultProviderId,
   getProviderMetadata,
   normalizeProviderName,
+  providerSupportsCapability,
   resolveProviderCommand,
 } = require('../lib/provider-names');
 const { detectGitContext } = require('../lib/git-remote-utils');
@@ -441,6 +442,32 @@ function validateGatewayProvider() {
   };
 }
 
+function validateProviderIsolationCapabilities(providerName, options) {
+  const errors = [];
+  if (options.requireDocker && !providerSupportsCapability(providerName, 'dockerIsolation')) {
+    errors.push(
+      formatError(
+        'Provider does not support Docker isolation',
+        `Provider "${providerName}" does not advertise dockerIsolation`,
+        [
+          'Run without --docker (worktree isolation may be supported)',
+          'Or select a different provider',
+        ]
+      )
+    );
+  }
+  if (options.requireGit && !providerSupportsCapability(providerName, 'worktreeIsolation')) {
+    errors.push(
+      formatError(
+        'Provider does not support worktree isolation',
+        `Provider "${providerName}" does not advertise worktreeIsolation`,
+        ['Run without --worktree/--pr/--ship', 'Or select a different provider']
+      )
+    );
+  }
+  return errors;
+}
+
 function validateProvider(providerName, options) {
   let metadata;
   try {
@@ -456,14 +483,19 @@ function validateProvider(providerName, options) {
     };
   }
 
+  const isolationErrors = validateProviderIsolationCapabilities(providerName, options);
+
   if (metadata.command.kind === 'configured-claude') {
-    return validateClaudeProvider(options);
+    const result = validateClaudeProvider(options);
+    return { errors: [...isolationErrors, ...result.errors], warnings: result.warnings };
   }
   if (providerName === 'gateway') {
-    return validateGatewayProvider();
+    const result = validateGatewayProvider();
+    return { errors: [...isolationErrors, ...result.errors], warnings: result.warnings };
   }
 
-  return validateRegistryCliProvider(providerName);
+  const result = validateRegistryCliProvider(providerName);
+  return { errors: [...isolationErrors, ...result.errors], warnings: result.warnings };
 }
 
 function validateRegistryCliProvider(providerName) {