@the-open-engine/zeroshot 6.23.0 → 6.25.0

package/src/omp-blob-root.js

@@ -0,0 +1,110 @@
+// Resolution of OMP's *shared* content-addressed blob store root, mirrored from the tagged
+// v17.2.1 source (`packages/utils/src/dirs.ts`: `getBlobsDir()` / `DirResolver`) rather than
+// invented by Zeroshot.
+//
+// Why this exists: OMP externalizes large payloads (images, provider data URLs) out of the session
+// JSONL into `<blobsDir>/<sha256-hex>` and leaves a nested `blob:sha256:<hex>` reference string
+// inside the JSONL record (`packages/coding-agent/src/session/blob-store.ts`). The store is shared
+// by every session on the machine and lives at `~/.omp/agent/blobs` by default — nowhere near
+// Zeroshot's per-task session partition. A resumed partition whose referenced blobs are missing is
+// an invalid continuation, so verification has to resolve them at this real root; and because the
+// root is shared, Zeroshot cleanup must never delete anything under it.
+//
+// Resolution order, exactly as `DirResolver`'s constructor computes it:
+//   profile      = normalize(OMP_PROFILE ?? PI_PROFILE)         // OMP_PROFILE wins; '' selects default
+//   configRoot   = ~/${PI_CONFIG_DIR || '.omp'}[/profiles/<profile>]
+//   defaultAgent = <configRoot>/agent
+//   agentDir     = profile ? defaultAgent : (resolve(PI_CODING_AGENT_DIR) || defaultAgent)
+//   dataBase     = (linux|darwin) && agentDir === defaultAgent && $XDG_DATA_HOME/omp[/profiles/<p>]
+//                  exists ? that : agentDir                      // XDG flattens the agent/ prefix
+//   blobsDir     = <dataBase>/blobs
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const APP_NAME = 'omp';
+const CONFIG_DIR_NAME = '.omp';
+// dirs.ts PROFILE_NAME_RE / WINDOWS_RESERVED_BASENAME_RE.
+const PROFILE_NAME_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}$/u;
+const WINDOWS_RESERVED_BASENAME_PATTERN = /^(?:CON|PRN|AUX|NUL|COM[0-9]|LPT[0-9])(?:\..*)?$/iu;
+
+/** dirs.ts normalizeProfileName, but total: an invalid name resolves to the default profile here
+ * instead of throwing. A resume against a profile OMP itself would reject cannot succeed anyway —
+ * the verifier will simply not find the referenced blobs and fail the continuation closed. */
+function normalizeProfileName(profile) {
+  const normalized = typeof profile === 'string' ? profile.trim() : '';
+  if (!normalized || normalized === 'default') return undefined;
+  if (
+    normalized === '.' ||
+    normalized === '..' ||
+    normalized.endsWith('.') ||
+    !PROFILE_NAME_PATTERN.test(normalized) ||
+    WINDOWS_RESERVED_BASENAME_PATTERN.test(normalized)
+  ) {
+    return undefined;
+  }
+  return normalized;
+}
+
+function activeProfile(env) {
+  return normalizeProfileName(
+    env.OMP_PROFILE !== undefined ? env.OMP_PROFILE : env.PI_PROFILE
+  );
+}
+
+function directoryExists(candidate) {
+  try {
+    return fs.statSync(candidate).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Absolute path of the shared OMP blob store for the current environment.
+ * `env`/`homedir`/`platform` are injectable for tests only; production callers pass nothing.
+ */
+function resolveOmpBlobsDir({
+  env = process.env,
+  homedir = os.homedir(),
+  platform = process.platform,
+} = {}) {
+  const profile = activeProfile(env);
+  const configDirName = env.PI_CONFIG_DIR || CONFIG_DIR_NAME;
+  const baseConfigRoot = path.join(homedir, configDirName);
+  const configRoot = profile ? path.join(baseConfigRoot, 'profiles', profile) : baseConfigRoot;
+
+  const defaultAgentDir = path.join(configRoot, 'agent');
+  // A named profile pins the agent dir to the profile root; PI_CODING_AGENT_DIR applies only in
+  // default mode (dirs.ts: `const agentDirOverride = profile ? undefined : options.agentDirOverride`).
+  const agentDirOverride = profile ? undefined : env.PI_CODING_AGENT_DIR;
+  const agentDir = agentDirOverride ? path.resolve(agentDirOverride) : defaultAgentDir;
+
+  let dataBase = agentDir;
+  if ((platform === 'linux' || platform === 'darwin') && agentDir === defaultAgentDir) {
+    const xdgDataHome = env.XDG_DATA_HOME;
+    if (xdgDataHome) {
+      const appRoot = path.join(xdgDataHome, APP_NAME);
+      const candidate = profile ? path.join(appRoot, 'profiles', profile) : appRoot;
+      if (directoryExists(candidate)) dataBase = candidate;
+    }
+  }
+
+  return path.join(dataBase, 'blobs');
+}
+
+/** True when `candidate` is the shared blob root or anything inside it. Cleanup uses this as a
+ * hard stop: a Zeroshot partition must never resolve into OMP's shared, cross-session CAS. */
+function isInsideOmpBlobsDir(candidate, options = {}) {
+  const blobsDir = resolveOmpBlobsDir(options);
+  const resolved = path.resolve(candidate);
+  return resolved === blobsDir || resolved.startsWith(blobsDir + path.sep);
+}
+
+module.exports = {
+  APP_NAME,
+  CONFIG_DIR_NAME,
+  isInsideOmpBlobsDir,
+  normalizeProfileName,
+  resolveOmpBlobsDir,
+};

package/src/omp-config-overlay.js

@@ -1,7 +1,7 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { randomUUID } = require('crypto');
+const { createHash, randomUUID } = require('crypto');
 
 const OVERLAY_PREFIX = 'zeroshot-omp-config-';
 const OMP_CONFIG_OVERLAY_DIR_PATTERN = /^zeroshot-omp-config-[A-Za-z0-9_-]+$/u;
@@ -62,6 +62,13 @@ bash:
     thresholdMs: 60000
 `;
 
+// Identity of the overlay *content*, not of any one temp file. A resumed session was produced
+// under whatever workflow-altering defaults this body pinned; if the body changes (a Zeroshot
+// upgrade retunes task.*/memory/advisor/async behaviour), continuing an old transcript under the
+// new rules is execution drift, so this digest is part of the OMP execution fingerprint recorded
+// with every resumable session (src/omp-execution-fingerprint.js).
+const OMP_CONFIG_OVERLAY_DIGEST = `sha256:${createHash('sha256').update(OVERLAY_BODY, 'utf8').digest('hex')}`;
+
 function createOmpConfigOverlay() {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), OVERLAY_PREFIX), { mode: 0o700 });
   try {
@@ -89,6 +96,7 @@ function isCanonicalOmpConfigOverlayDirectory(overlayDir) {
 }
 
 module.exports = {
+  OMP_CONFIG_OVERLAY_DIGEST,
   OMP_CONFIG_OVERLAY_DIR_PATTERN,
   OMP_CONFIG_OVERLAY_FILE_PATTERN,
   createOmpConfigOverlay,

package/src/omp-execution-fingerprint.js

@@ -0,0 +1,62 @@
+// The `executionFingerprint` recorded with every resumable OMP session (issue #866).
+//
+// A session transcript is only safely continuable under the same execution contract that produced
+// it. This digest binds that contract: the pinned OMP release, the Zeroshot config overlay's
+// content, the requested Zeroshot selectors (`--model`, `--thinking`, `--approval-mode`), and the
+// concrete provider/model/thinking level OMP actually reported for the turn. Any of those drifting
+// between the recording turn and a resume attempt — a Zeroshot upgrade that retunes the overlay, a
+// changed level mapping, an alias resolving to a different concrete model, a different thinking
+// level — makes the fingerprints differ, and the continuation is refused before the prompt.
+const { createHash } = require('crypto');
+const { OMP_CONFIG_OVERLAY_DIGEST } = require('./omp-config-overlay');
+
+/** Value of `--flag <value>` in an argv array, or '' when the flag is absent. */
+function flagValue(args, flag) {
+  if (!Array.isArray(args)) return '';
+  const index = args.indexOf(flag);
+  if (index < 0 || index + 1 >= args.length) return '';
+  const value = args[index + 1];
+  return typeof value === 'string' ? value : '';
+}
+
+/** The Zeroshot-requested half of the contract, readable from the command spec alone. */
+function requestedExecutionSelectors(commandSpec) {
+  const args = commandSpec?.args;
+  return {
+    modelSelector: flagValue(args, '--model'),
+    thinkingSelector: flagValue(args, '--thinking'),
+    approvalMode: flagValue(args, '--approval-mode'),
+  };
+}
+
+/**
+ * @param {object} params
+ * @param {string} params.expectedVersion pinned OMP release (OMP_SUPPORTED_VERSION)
+ * @param {object} params.commandSpec the spec OMP was actually spawned with
+ * @param {object} params.evidence OMP's reported session evidence (selectedProvider/Model, thinkingLevel)
+ * @param {string} [params.configOverlayDigest] injectable for tests only
+ * @returns {string} `sha256:<64-lower-hex>`
+ */
+function computeOmpExecutionFingerprint({
+  expectedVersion,
+  commandSpec,
+  evidence,
+  configOverlayDigest = OMP_CONFIG_OVERLAY_DIGEST,
+}) {
+  const fields = {
+    ompSupportedVersion: String(expectedVersion ?? ''),
+    configOverlayDigest: String(configOverlayDigest ?? ''),
+    ...requestedExecutionSelectors(commandSpec),
+    observedProvider: String(evidence?.selectedProvider ?? ''),
+    observedModel: String(evidence?.selectedModel ?? ''),
+    observedThinkingLevel: String(evidence?.thinkingLevel ?? ''),
+  };
+  const stable = {};
+  for (const key of Object.keys(fields).sort()) stable[key] = fields[key];
+  return `sha256:${createHash('sha256').update(JSON.stringify(stable), 'utf8').digest('hex')}`;
+}
+
+module.exports = {
+  computeOmpExecutionFingerprint,
+  requestedExecutionSelectors,
+};

package/src/omp-session-limits.js

@@ -0,0 +1,17 @@
+// Non-configurable bounds for OMP session partition verification (src/omp-session-verifier.js).
+// Every value is pinned exactly as specified by issue #866; do not derive these from settings or
+// environment — a configurable ceiling here would let a compromised/misbehaving OMP process (or a
+// hostile resumed partition) negotiate its own verification budget.
+const OMP_SESSION_LIMITS = Object.freeze({
+  maxSessionBytes: 268435456,
+  maxSessionRecords: 1000000,
+  maxArtifactEntries: 4096,
+  maxArtifactDepth: 16,
+  maxRelativePathBytes: 4096,
+  maxArtifactFileBytes: 268435456,
+  maxArtifactAggregateBytes: 536870912,
+  maxBlobReferences: 4096,
+  maxReferencedBlobBytes: 67108864,
+});
+
+module.exports = { OMP_SESSION_LIMITS };

package/src/omp-session-partition.js

@@ -0,0 +1,297 @@
+const fs = require('fs');
+const path = require('path');
+const { randomUUID } = require('crypto');
+const { isInsideOmpBlobsDir } = require('./omp-blob-root');
+
+// Every OMP session partition lives under <storageRoot>/omp-sessions/<uuid>/. storageRoot is the
+// owning cluster's storageDir for cluster-agent tasks or the standalone TASKS_DIR otherwise (see
+// task-lib/omp-storage-root.js) — never derived from prompt text or cwd. The shared OMP CAS blob
+// store is *not* under here at all (it is machine-wide, at pi-utils::getBlobsDir(); see
+// src/omp-blob-root.js), which is what makes per-task partition deletion safe.
+const OMP_SESSIONS_SUBDIR = 'omp-sessions';
+const PARTITION_ID_PATTERN =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+const DELETING_PREFIX = '.zeroshot-deleting-';
+
+const O_NOFOLLOW = fs.constants.O_NOFOLLOW ?? 0;
+const O_DIRECTORY = fs.constants.O_DIRECTORY ?? 0;
+// See src/omp-session-verifier.js: O_NONBLOCK stops a FIFO planted at one of these paths from
+// blocking the open forever; the fstat that follows still rejects the wrong type.
+const O_NONBLOCK = fs.constants.O_NONBLOCK ?? 0;
+
+function ompSessionsRoot(storageRoot) {
+  return path.join(path.resolve(storageRoot), OMP_SESSIONS_SUBDIR);
+}
+
+function partitionPathFor(storageRoot, partitionId) {
+  if (typeof partitionId !== 'string' || !PARTITION_ID_PATTERN.test(partitionId)) {
+    throw new Error(`Invalid OMP session partition id: ${partitionId}`);
+  }
+  return path.join(ompSessionsRoot(storageRoot), partitionId);
+}
+
+function generateOmpPartitionId() {
+  return randomUUID();
+}
+
+/** Owner-only (0700) directory creation. Idempotent: safe to call once the row referencing this
+ * partitionId is already durable (row-before-directory — see task-lib/runner.js). */
+function createOmpSessionPartitionDirectory(partitionPath) {
+  fs.mkdirSync(partitionPath, { recursive: true, mode: 0o700 });
+  if (process.platform !== 'win32') {
+    fs.chmodSync(partitionPath, 0o700);
+  }
+}
+
+/**
+ * Allocate a fresh, random, secret-free UUID partition directory under storageRoot in one step.
+ * Callers that must durably record the partitionId before the directory exists on disk (fresh
+ * task spawn — see task-lib/runner.js) should use generateOmpPartitionId/partitionPathFor and
+ * createOmpSessionPartitionDirectory separately instead, in that order.
+ */
+function allocateOmpSessionPartition(storageRoot) {
+  const partitionId = generateOmpPartitionId();
+  const partitionPath = partitionPathFor(storageRoot, partitionId);
+  createOmpSessionPartitionDirectory(partitionPath);
+  return { partitionId, path: partitionPath };
+}
+
+function identityOf(stat) {
+  return { device: String(stat.dev), inode: String(stat.ino) };
+}
+
+function sameIdentity(a, b) {
+  return Boolean(a) && Boolean(b) && a.device === b.device && a.inode === b.inode;
+}
+
+/** Descriptor-pinned directory identity: never follows a final symlink, and the returned identity
+ * describes the descriptor itself rather than a second pathname lookup. */
+function pinDirectoryIdentity(dirPath) {
+  const fd = fs.openSync(dirPath, fs.constants.O_RDONLY | O_NOFOLLOW | O_NONBLOCK | O_DIRECTORY);
+  try {
+    const stat = fs.fstatSync(fd);
+    if (!stat.isDirectory()) {
+      throw Object.assign(new Error(`${dirPath} is not a directory`), { code: 'ENOTDIR' });
+    }
+    return { identity: identityOf(stat), uid: stat.uid };
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+function currentUid() {
+  return typeof process.getuid === 'function' ? String(process.getuid()) : '0';
+}
+
+/**
+ * Phase 1 of deletion: validate the owner record against what is actually on disk and move the
+ * partition out of its canonical name.
+ *
+ * The check/use race (CodeQL js/file-system-race) is closed by *moving before deleting*: the
+ * partition is renamed, within its own parent, to an unguessable `.zeroshot-deleting-<uuid>` name
+ * and only then re-pinned. `rename(2)` is atomic, so after it succeeds the object under that fresh
+ * name can no longer be swapped by racing the original path; the post-rename identity comparison
+ * proves it is still the same directory that passed validation, and any mismatch aborts with the
+ * directory parked under its clearly-marked name rather than recursively deleting an unknown tree.
+ *
+ * Splitting the rename from the recursive removal is what lets a caller hold a *task-store* write
+ * fence across "no other row claims this partition" -> "the partition no longer answers to its
+ * canonical name" without also holding it across an arbitrarily long `rm -r`. See
+ * task-lib/omp-session-cleanup.js.
+ *
+ * Never throws.
+ *   `{staged:true, stagingPath}`          the directory is parked and the caller must remove it
+ *   `{staged:false, deleted:true, ...}`   there was nothing to delete
+ *   `{staged:false, deleted:false, ...}`  refused; preserve the owner record and warn
+ *
+ * @param {object} ownership canonical, already-validated task.ompSessionOwnership record
+ */
+function stageOmpSessionPartitionForDeletion(ownership) {
+  if (!ownership || typeof ownership !== 'object') {
+    return { staged: false, deleted: false, reason: 'no ownership record' };
+  }
+  const { partitionId, storageRoot, partitionPath, ownerUid, storageRootIdentity } = ownership;
+
+  if (ownerUid !== currentUid()) {
+    return {
+      staged: false,
+      deleted: false,
+      reason: `recorded owner uid ${ownerUid} is not the current uid ${currentUid()}`,
+    };
+  }
+
+  let expectedPartitionPath;
+  try {
+    expectedPartitionPath = partitionPathFor(storageRoot, partitionId);
+  } catch (error) {
+    return { staged: false, deleted: false, reason: error.message };
+  }
+  if (expectedPartitionPath !== partitionPath) {
+    return {
+      staged: false,
+      deleted: false,
+      reason: `${partitionPath} is not the canonical partition path for ${partitionId}`,
+    };
+  }
+  const root = ompSessionsRoot(storageRoot);
+  if (path.dirname(expectedPartitionPath) !== root) {
+    return {
+      staged: false,
+      deleted: false,
+      reason: `${expectedPartitionPath} does not resolve directly under ${root}`,
+    };
+  }
+  // Defence in depth: OMP's shared, cross-session CAS root must never be reachable from a
+  // partition path, whatever a tampered or migrated storageRoot claims.
+  if (isInsideOmpBlobsDir(expectedPartitionPath) || isInsideOmpBlobsDir(root)) {
+    return {
+      staged: false,
+      deleted: false,
+      reason: `${expectedPartitionPath} resolves inside the shared OMP blob store; refusing to delete`,
+    };
+  }
+
+  // omp-sessions/ is the directory the staging rename happens inside, so it has to be a real,
+  // owner-held directory reached without following a symlink before anything is moved into it.
+  let rootPin;
+  try {
+    rootPin = pinDirectoryIdentity(root);
+  } catch (error) {
+    if (error.code === 'ENOENT') return { staged: false, deleted: true, reason: 'already absent' };
+    return { staged: false, deleted: false, reason: `${root}: ${error.message}` };
+  }
+  if (String(rootPin.uid) !== currentUid()) {
+    return { staged: false, deleted: false, reason: `${root} is not owned by the current user` };
+  }
+
+  let storagePin;
+  try {
+    storagePin = pinDirectoryIdentity(path.resolve(storageRoot));
+  } catch (error) {
+    return { staged: false, deleted: false, reason: `${storageRoot}: ${error.message}` };
+  }
+  if (!sameIdentity(storagePin.identity, storageRootIdentity)) {
+    return {
+      staged: false,
+      deleted: false,
+      reason: `${storageRoot} identity ${storagePin.identity.device}:${storagePin.identity.inode} does not match the recorded ${storageRootIdentity?.device}:${storageRootIdentity?.inode}`,
+    };
+  }
+  if (String(storagePin.uid) !== currentUid()) {
+    return { staged: false, deleted: false, reason: `${storageRoot} is not owned by the current user` };
+  }
+
+  let before;
+  try {
+    before = pinDirectoryIdentity(expectedPartitionPath);
+  } catch (error) {
+    if (error.code === 'ENOENT') return { staged: false, deleted: true, reason: 'already absent' };
+    if (error.code === 'ELOOP' || error.code === 'EMLINK') {
+      return { staged: false, deleted: false, reason: `${expectedPartitionPath} is a symlink; refusing to delete` };
+    }
+    if (error.code === 'ENOTDIR') {
+      return {
+        staged: false,
+        deleted: false,
+        reason: `${expectedPartitionPath} is not a real directory; refusing to delete`,
+      };
+    }
+    return { staged: false, deleted: false, reason: error.message };
+  }
+  if (String(before.uid) !== currentUid()) {
+    return { staged: false, deleted: false, reason: `${expectedPartitionPath} is not owned by the current user` };
+  }
+  if (ownership.partitionIdentity && !sameIdentity(before.identity, ownership.partitionIdentity)) {
+    return {
+      staged: false,
+      deleted: false,
+      reason: `${expectedPartitionPath} identity ${before.identity.device}:${before.identity.inode} does not match the recorded ${ownership.partitionIdentity.device}:${ownership.partitionIdentity.inode}`,
+    };
+  }
+
+  const stagingPath = path.join(root, `${DELETING_PREFIX}${randomUUID()}`);
+  try {
+    fs.renameSync(expectedPartitionPath, stagingPath);
+  } catch (error) {
+    if (error.code === 'ENOENT') return { staged: false, deleted: true, reason: 'already absent' };
+    return { staged: false, deleted: false, reason: `could not stage ${expectedPartitionPath}: ${error.message}` };
+  }
+
+  let after;
+  try {
+    after = pinDirectoryIdentity(stagingPath);
+  } catch (error) {
+    return {
+      staged: false,
+      deleted: false,
+      reason: `staged ${stagingPath} could not be pinned (${error.message}); left in place for inspection`,
+    };
+  }
+  if (!sameIdentity(after.identity, before.identity)) {
+    return {
+      staged: false,
+      deleted: false,
+      reason: `${expectedPartitionPath} was substituted before deletion; the staged directory ${stagingPath} was left in place for inspection`,
+    };
+  }
+
+  return { staged: true, stagingPath };
+}
+
+/**
+ * Phase 2: remove a directory that {@link stageOmpSessionPartitionForDeletion} already parked under
+ * its unguessable staging name. Safe to run outside any lock — the tree no longer answers to a name
+ * anything else knows.
+ */
+function removeStagedOmpSessionPartition(stagingPath) {
+  // This is an exported recursive delete, so it re-derives that its argument really is a staging
+  // name this module minted — a direct `.zeroshot-deleting-*` child of an `omp-sessions/` root —
+  // rather than trusting the caller to have got it from stageOmpSessionPartitionForDeletion.
+  if (typeof stagingPath !== 'string' || !path.isAbsolute(stagingPath)) {
+    return { deleted: false, reason: `${stagingPath} is not an absolute staged partition path` };
+  }
+  if (!path.basename(stagingPath).startsWith(DELETING_PREFIX)) {
+    return { deleted: false, reason: `${stagingPath} is not a staged partition directory` };
+  }
+  if (path.basename(path.dirname(stagingPath)) !== OMP_SESSIONS_SUBDIR) {
+    return {
+      deleted: false,
+      reason: `${stagingPath} does not live directly under an ${OMP_SESSIONS_SUBDIR}/ root`,
+    };
+  }
+  try {
+    fs.rmSync(stagingPath, { recursive: true, force: true });
+  } catch (error) {
+    return { deleted: false, reason: `${stagingPath}: ${error.message}` };
+  }
+  return { deleted: true };
+}
+
+/**
+ * Validate, stage, and remove one owner-validated partition directory. Never the shared OMP CAS
+ * blob root, never anything outside `<storageRoot>/omp-sessions/`, and never a directory that is
+ * not the one the persisted ownership record describes.
+ *
+ * Never throws. `{deleted:false, reason}` means the caller must preserve the owner record and warn.
+ *
+ * @param {object} ownership canonical, already-validated task.ompSessionOwnership record
+ */
+function deleteOmpSessionPartition(ownership) {
+  const staged = stageOmpSessionPartitionForDeletion(ownership);
+  if (!staged.staged) return { deleted: staged.deleted === true, reason: staged.reason };
+  return removeStagedOmpSessionPartition(staged.stagingPath);
+}
+
+module.exports = {
+  DELETING_PREFIX,
+  OMP_SESSIONS_SUBDIR,
+  PARTITION_ID_PATTERN,
+  ompSessionsRoot,
+  partitionPathFor,
+  generateOmpPartitionId,
+  createOmpSessionPartitionDirectory,
+  allocateOmpSessionPartition,
+  stageOmpSessionPartitionForDeletion,
+  removeStagedOmpSessionPartition,
+  deleteOmpSessionPartition,
+};