@the-open-engine/zeroshot 6.22.0 → 6.24.0

package/src/omp-config-overlay.js

@@ -0,0 +1,96 @@
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { randomUUID } = require('crypto');
+
+const OVERLAY_PREFIX = 'zeroshot-omp-config-';
+const OMP_CONFIG_OVERLAY_DIR_PATTERN = /^zeroshot-omp-config-[A-Za-z0-9_-]+$/u;
+const OMP_CONFIG_OVERLAY_FILE_PATTERN =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\.yml$/u;
+
+// Verified against tagged v17.2.1 source: packages/coding-agent/src/config/settings-schema.ts
+// (key types/defaults) and packages/coding-agent/src/main.ts (HOST_DEFAULTED_SETTING_PATHS /
+// RPC_BACKGROUND_DEFAULTED_SETTING_PATHS). RPC mode (docs/rpc.md) only re-applies its own
+// neutral defaults for task.*/memory.backend/memories.enabled/advisor.*/tier.advisor/
+// async.*/bash.autoBackground.* when a path is completely unconfigured at every settings
+// layer; `todo.*` is explicitly caller-controlled and never host-defaulted in RPC mode
+// (main.ts: "embedders need project-level opt-outs for reminder/prelude prompt injection").
+// A host's ~/.omp/agent/config.yml or project .omp/config.yml can therefore change one of
+// these workflow-altering namespaces out from under an unattended RPC worker. This overlay
+// pins every one of them to its schema built-in default plus marketplace.autoUpdate off, so
+// Zeroshot's worker behavior never depends on the host machine's OMP config. It deliberately
+// never sets context/skills/rules/extensions/mcp keys, which keep flowing from native
+// project/user config underneath this overlay.
+const OVERLAY_BODY = `# Zeroshot-owned OMP safety overlay — do not add model/profile settings.
+marketplace:
+  autoUpdate: "off"
+todo:
+  enabled: true
+  reminders: true
+  remindersMax: 3
+  eager: "default"
+task:
+  isolation:
+    mode: "none"
+    apply: true
+    merge: "patch"
+    commits: "generic"
+  eager: "default"
+  batch: true
+  maxConcurrency: 32
+  maxRecursionDepth: 2
+  disabledAgents: []
+  agentModelOverrides: {}
+  agentPrewalk: {}
+memory:
+  backend: "off"
+memories:
+  enabled: false
+advisor:
+  enabled: false
+  subagents: false
+  syncBacklog: "off"
+  immuneTurns: 3
+tier:
+  advisor: "none"
+async:
+  enabled: true
+  maxJobs: 100
+bash:
+  autoBackground:
+    enabled: false
+    thresholdMs: 60000
+`;
+
+function createOmpConfigOverlay() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), OVERLAY_PREFIX), { mode: 0o700 });
+  try {
+    const file = path.join(dir, `${randomUUID()}.yml`);
+    fs.writeFileSync(file, OVERLAY_BODY, { flag: 'wx', mode: 0o600 });
+    if (process.platform !== 'win32') {
+      fs.chmodSync(dir, 0o700);
+      fs.chmodSync(file, 0o600);
+    }
+    return { dir, file };
+  } catch (error) {
+    fs.rmSync(dir, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+function isCanonicalOmpConfigOverlayDirectory(overlayDir) {
+  if (typeof overlayDir !== 'string' || !overlayDir || path.resolve(overlayDir) !== overlayDir) {
+    return false;
+  }
+  return (
+    path.dirname(overlayDir) === path.resolve(os.tmpdir()) &&
+    OMP_CONFIG_OVERLAY_DIR_PATTERN.test(path.basename(overlayDir))
+  );
+}
+
+module.exports = {
+  OMP_CONFIG_OVERLAY_DIR_PATTERN,
+  OMP_CONFIG_OVERLAY_FILE_PATTERN,
+  createOmpConfigOverlay,
+  isCanonicalOmpConfigOverlayDirectory,
+};

package/src/orchestrator.js

@@ -46,7 +46,11 @@ const { generateName } = require('./name-generator');
 const configValidator = require('./config-validator');
 const TemplateResolver = require('./template-resolver');
 const { loadSettings } = require('../lib/settings');
-const { normalizeProviderName, getDefaultProviderId } = require('../lib/provider-names');
+const {
+  normalizeProviderName,
+  getDefaultProviderId,
+  providerSupportsCapability,
+} = require('../lib/provider-names');
 const { resolveRunPlan } = require('../lib/run-plan');
 const { isProcessRunning } = require('../lib/process-liveness');
 const { getProvider } = require('./providers');
@@ -1819,20 +1823,31 @@ class Orchestrator {
     let isolationImage = null;
 
     if (options.isolation) {
+      // Resolve the provider first so the capability gate and the cluster's image variant (which
+      // installs the provider CLI as a Docker-cached layer) both see the same provider. Providers
+      // baked into the base image (e.g. Claude) resolve back to the base image unchanged.
+      const providerName = this._resolveClusterProvider(config);
+      if (!providerSupportsCapability(providerName, 'dockerIsolation')) {
+        throw new Error(
+          `Provider ${providerName} does not support Docker isolation; run without --docker (worktree isolation is supported).`
+        );
+      }
       if (!IsolationManager.isDockerAvailable()) {
         throw new Error('Docker is not available. Install Docker to use --docker mode.');
       }
 
-      // Resolve the provider first so the cluster runs on that provider's image variant, which
-      // installs the provider CLI as a Docker-cached layer. Providers baked into the base image
-      // (e.g. Claude) resolve back to the base image unchanged.
-      const providerName = this._resolveClusterProvider(config);
+      // Pre-effect platform probe: fail before any workspace/container side effect when the
+      // Docker engine cannot run the provider's registry-owned platform (e.g. OMP's linux/amd64).
+      const platform = IsolationManager.providerDockerPlatform(providerName);
+      IsolationManager.assertPlatformSupported(platform);
+
       const baseImage = options.isolationImage || 'zeroshot-cluster-base';
       const image = IsolationManager.imageForProvider(providerName, baseImage);
       await IsolationManager.ensureImage(
         image,
         true,
-        IsolationManager.providerBuildArgs(providerName)
+        IsolationManager.providerBuildArgs(providerName, options.containerHome || '/home/node'),
+        platform
       );
       isolationImage = image;
 
@@ -1847,9 +1862,16 @@ class Orchestrator {
         mounts: options.mounts,
         containerHome: options.containerHome,
         provider: providerName,
+        platform,
       });
       this._log(`[Orchestrator] Container created: ${containerId} (workDir: ${workDir})`);
     } else if (options.worktree) {
+      const providerName = this._resolveClusterProvider(config);
+      if (!providerSupportsCapability(providerName, 'worktreeIsolation')) {
+        throw new Error(
+          `Provider ${providerName} does not support worktree isolation; run without --worktree.`
+        );
+      }
       const workDir = options.cwd || process.cwd();
 
       isolationManager = new IsolationManager({});
@@ -2833,11 +2855,14 @@ class Orchestrator {
     }
 
     const providerName = this._resolveClusterProvider(cluster.config);
+    const platform = IsolationManager.providerDockerPlatform(providerName);
+    IsolationManager.assertPlatformSupported(platform);
     const newContainerId = await cluster.isolation.manager.createContainer(clusterId, {
       workDir,
       image: cluster.isolation.image,
       reuseExistingWorkspace: true,
       provider: providerName,
+      platform,
     });
 
     this._log(`[Orchestrator] New container created: ${newContainerId}`);

package/src/preflight.js

@@ -24,6 +24,7 @@ const {
   getDefaultProviderId,
   getProviderMetadata,
   normalizeProviderName,
+  providerSupportsCapability,
   resolveProviderCommand,
 } = require('../lib/provider-names');
 const { detectGitContext } = require('../lib/git-remote-utils');
@@ -441,6 +442,32 @@ function validateGatewayProvider() {
   };
 }
 
+function validateProviderIsolationCapabilities(providerName, options) {
+  const errors = [];
+  if (options.requireDocker && !providerSupportsCapability(providerName, 'dockerIsolation')) {
+    errors.push(
+      formatError(
+        'Provider does not support Docker isolation',
+        `Provider "${providerName}" does not advertise dockerIsolation`,
+        [
+          'Run without --docker (worktree isolation may be supported)',
+          'Or select a different provider',
+        ]
+      )
+    );
+  }
+  if (options.requireGit && !providerSupportsCapability(providerName, 'worktreeIsolation')) {
+    errors.push(
+      formatError(
+        'Provider does not support worktree isolation',
+        `Provider "${providerName}" does not advertise worktreeIsolation`,
+        ['Run without --worktree/--pr/--ship', 'Or select a different provider']
+      )
+    );
+  }
+  return errors;
+}
+
 function validateProvider(providerName, options) {
   let metadata;
   try {
@@ -456,14 +483,19 @@ function validateProvider(providerName, options) {
     };
   }
 
+  const isolationErrors = validateProviderIsolationCapabilities(providerName, options);
+
   if (metadata.command.kind === 'configured-claude') {
-    return validateClaudeProvider(options);
+    const result = validateClaudeProvider(options);
+    return { errors: [...isolationErrors, ...result.errors], warnings: result.warnings };
   }
   if (providerName === 'gateway') {
-    return validateGatewayProvider();
+    const result = validateGatewayProvider();
+    return { errors: [...isolationErrors, ...result.errors], warnings: result.warnings };
   }
 
-  return validateRegistryCliProvider(providerName);
+  const result = validateRegistryCliProvider(providerName);
+  return { errors: [...isolationErrors, ...result.errors], warnings: result.warnings };
 }
 
 function validateRegistryCliProvider(providerName) {
@@ -519,7 +551,7 @@ function validateGhRequirement() {
   return errors;
 }
 
-function validateDockerRequirement() {
+function validateDockerRequirement(providerName) {
   const errors = [];
   const docker = checkDocker();
   if (!docker.available) {
@@ -535,6 +567,19 @@ function validateDockerRequirement() {
             ]
       )
     );
+    return errors;
+  }
+
+  try {
+    const IsolationManager = require('./isolation-manager');
+    IsolationManager.assertPlatformSupported(IsolationManager.providerDockerPlatform(providerName));
+  } catch (err) {
+    errors.push(
+      formatError('Docker cannot run required platform', err.message, [
+        'Install Buildx and run: docker run --privileged --rm tonistiigi/binfmt --install amd64',
+        'Or run Zeroshot on a native amd64 Docker host',
+      ])
+    );
   }
 
   return errors;
@@ -700,7 +745,7 @@ async function runPreflight(options = {}) {
 
   // 6. Check Docker (if required)
   if (options.requireDocker) {
-    errors.push(...validateDockerRequirement());
+    errors.push(...validateDockerRequirement(providerName));
   }
 
   // 7. Check git repo (if required for worktree isolation)

package/src/watcher-prompt-channel.js

@@ -0,0 +1,209 @@
+/**
+ * Private parent -> detached-watcher prompt channel.
+ *
+ * The OMP prompt is task content (repository text, instructions, whatever a caller pasted in), so
+ * it must never travel in the watcher's argv: `ps` and /proc/<pid>/cmdline expose argv to every
+ * local user for the entire lifetime of a long-lived watcher. task-lib/runner.js therefore hands
+ * the prompt to task-lib/rpc-watcher.js over the anonymous stdin pipe fork() creates for it. The
+ * pipe has exactly two ends and no name, so nothing is written to the filesystem, the task log, or
+ * the ledger while the prompt is in transit.
+ *
+ * Framing is a newline-terminated JSON header followed by exactly `promptBytes` UTF-8 bytes. That
+ * declared length is what lets the receiver tell a complete payload apart from an absent,
+ * truncated, over-long, or over-contract one, so it can fail closed instead of prompting the
+ * provider with a partial instruction.
+ */
+
+const { TextDecoder } = require('util');
+
+const PROMPT_CHANNEL_KIND = 'zeroshot-watcher-prompt-v1';
+
+// The header is a single short JSON object ({"kind":"...","promptBytes":1048576} is 56 bytes), so a
+// peer that never sends a newline must not be able to make the receiver buffer without bound before
+// the declared payload length is even known.
+const MAX_PROMPT_CHANNEL_HEADER_BYTES = 256;
+
+class WatcherPromptChannelError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = 'WatcherPromptChannelError';
+    this.code = code;
+  }
+}
+
+function encodeWatcherPromptFrame(prompt) {
+  const body = Buffer.from(prompt, 'utf8');
+  const header = `${JSON.stringify({ kind: PROMPT_CHANNEL_KIND, promptBytes: body.byteLength })}\n`;
+  return Buffer.concat([Buffer.from(header, 'utf8'), body]);
+}
+
+/**
+ * Write the framed prompt into the watcher's stdin pipe and close the write end.
+ *
+ * The receiver owns fail-closed handling for a short or missing payload, so a watcher that already
+ * exited (a cancellation requested before spawn closes the read end) has to surface here as a
+ * swallowed EPIPE rather than as an unhandled 'error' that would take down the spawning process.
+ */
+function sendWatcherPrompt(stream, prompt) {
+  stream.on('error', () => {});
+  stream.end(encodeWatcherPromptFrame(prompt));
+}
+
+function parsePromptChannelHeader(headerText, maxBytes) {
+  let header;
+  try {
+    header = JSON.parse(headerText);
+  } catch {
+    throw new WatcherPromptChannelError(
+      'malformed-header',
+      'Prompt channel header is not valid JSON.'
+    );
+  }
+  if (header === null || typeof header !== 'object' || header.kind !== PROMPT_CHANNEL_KIND) {
+    throw new WatcherPromptChannelError(
+      'malformed-header',
+      `Prompt channel header is not a ${PROMPT_CHANNEL_KIND} frame.`
+    );
+  }
+  const { promptBytes } = header;
+  if (!Number.isSafeInteger(promptBytes) || promptBytes < 0) {
+    throw new WatcherPromptChannelError(
+      'malformed-header',
+      "Prompt channel header has an invalid 'promptBytes' value."
+    );
+  }
+  if (promptBytes > maxBytes) {
+    throw new WatcherPromptChannelError(
+      'prompt-too-large',
+      `Prompt channel declared ${promptBytes} bytes, above the ${maxBytes}-byte contract.`
+    );
+  }
+  return promptBytes;
+}
+
+/**
+ * Read exactly one framed prompt off `stream`, or reject with a WatcherPromptChannelError.
+ *
+ * Every rejection path is a fail-closed one: an absent channel, a header that never arrives, a
+ * declared length above `maxBytes`, a payload that ends short of (or overruns) the declared length,
+ * and invalid UTF-8 all reject rather than resolving with partial text.
+ */
+function receiveWatcherPrompt(stream, { maxBytes }) {
+  return new Promise((resolve, reject) => {
+    if (!stream || typeof stream.on !== 'function' || stream.isTTY) {
+      reject(
+        new WatcherPromptChannelError(
+          'absent',
+          'No private prompt pipe is attached to this watcher.'
+        )
+      );
+      return;
+    }
+
+    let buffer = Buffer.alloc(0);
+    let declaredBytes = null;
+    let settled = false;
+
+    function detach() {
+      stream.removeListener('data', onData);
+      stream.removeListener('end', onEnd);
+      stream.removeListener('error', onError);
+      // destroy() can emit 'error' after the listeners above are gone, which would otherwise throw
+      // as an unhandled 'error' event and mask the real channel outcome.
+      stream.on('error', () => {});
+      try {
+        stream.destroy();
+      } catch {
+        // Already released; nothing further to close.
+      }
+    }
+
+    function fail(code, message) {
+      if (settled) return;
+      settled = true;
+      detach();
+      reject(new WatcherPromptChannelError(code, message));
+    }
+
+    function succeed(prompt) {
+      if (settled) return;
+      settled = true;
+      detach();
+      resolve(prompt);
+    }
+
+    function readHeader() {
+      const newlineIndex = buffer.indexOf(0x0a);
+      if (newlineIndex === -1) {
+        if (buffer.byteLength > MAX_PROMPT_CHANNEL_HEADER_BYTES) {
+          fail(
+            'malformed-header',
+            `Prompt channel header exceeded ${MAX_PROMPT_CHANNEL_HEADER_BYTES} bytes without a newline.`
+          );
+        }
+        return false;
+      }
+      const headerText = buffer.subarray(0, newlineIndex).toString('utf8');
+      buffer = buffer.subarray(newlineIndex + 1);
+      try {
+        declaredBytes = parsePromptChannelHeader(headerText, maxBytes);
+      } catch (error) {
+        fail(error.code, error.message);
+        return false;
+      }
+      return true;
+    }
+
+    function consume() {
+      if (declaredBytes === null && !readHeader()) return;
+      if (buffer.byteLength > declaredBytes) {
+        fail(
+          'overlong-payload',
+          `Prompt channel delivered more than the declared ${declaredBytes} bytes.`
+        );
+        return;
+      }
+      if (buffer.byteLength < declaredBytes) return;
+      let prompt;
+      try {
+        prompt = new TextDecoder('utf-8', { fatal: true }).decode(buffer);
+      } catch {
+        fail('invalid-utf8', 'Prompt channel payload is not valid UTF-8.');
+        return;
+      }
+      succeed(prompt);
+    }
+
+    function onData(chunk) {
+      if (settled) return;
+      buffer = Buffer.concat([buffer, chunk]);
+      consume();
+    }
+
+    function onEnd() {
+      fail(
+        'truncated',
+        declaredBytes === null
+          ? 'Prompt channel closed before a complete header arrived.'
+          : `Prompt channel closed after ${buffer.byteLength} of ${declaredBytes} declared bytes.`
+      );
+    }
+
+    function onError(error) {
+      fail('channel-error', `Prompt channel failed: ${error.message}`);
+    }
+
+    stream.on('data', onData);
+    stream.on('end', onEnd);
+    stream.on('error', onError);
+  });
+}
+
+module.exports = {
+  MAX_PROMPT_CHANNEL_HEADER_BYTES,
+  PROMPT_CHANNEL_KIND,
+  WatcherPromptChannelError,
+  encodeWatcherPromptFrame,
+  receiveWatcherPrompt,
+  sendWatcherPrompt,
+};