@the-open-engine/zeroshot 6.24.0 → 6.25.1

package/src/agent-cli-provider/adapters/omp.ts

@@ -4,6 +4,7 @@ import { appendJsonSchemaPrompt } from '../schema';
 import { isRecord, unknownToMessage } from '../json';
 import { OMP_REMEDIATION, OMP_SUPPORTED_VERSION } from '../omp-release';
 import { parseNormalizedOmpRpcEventLine } from '../omp-rpc-events';
+import type { OmpSessionLaunch } from '../omp-rpc-session';
 import {
   InvalidProviderModelError,
   type BuildProviderCommandOptions,
@@ -180,8 +181,13 @@ function detectCliFeatures(helpText?: string | null, versionText?: string | null
   };
 }
 
+function resolveOmpSessionLaunch(options: BuildProviderCommandOptions): OmpSessionLaunch {
+  return options.ompSession ?? { kind: 'none' };
+}
+
 function assertRequiredOmpFeatures(options: BuildProviderCommandOptions): void {
   const features = optionFeatures(options);
+  const session = resolveOmpSessionLaunch(options);
   const required: ReadonlyArray<readonly [boolean | undefined, string]> = [
     [features.versionMatches, `exact OMP version ${OMP_SUPPORTED_VERSION}`],
     [features.supportsRpcMode, '"rpc" mode'],
@@ -190,6 +196,10 @@ function assertRequiredOmpFeatures(options: BuildProviderCommandOptions): void {
     [features.supportsApprovalMode, '--approval-mode'],
     [features.supportsNoTitle, '--no-title'],
     [features.supportsNoSession, '--no-session'],
+    ...(session.kind === 'none'
+      ? []
+      : ([[features.supportsSessionDir, '--session-dir']] as const)),
+    ...(session.kind === 'resume' ? ([[features.supportsResume, '--resume']] as const) : []),
   ];
   const missing = required.filter(([supported]) => supported === false).map(([, label]) => label);
   if (missing.length === 0) return;
@@ -203,16 +213,35 @@ function assertRequiredOmpFeatures(options: BuildProviderCommandOptions): void {
 }
 
 function failClosedUnsupportedSessionControl(options: BuildProviderCommandOptions): void {
-  const hasResumeSessionId = options.resumeSessionId !== undefined;
-  if (!hasResumeSessionId && !options.continueSession) return;
-  const field = hasResumeSessionId ? 'options.resumeSessionId' : 'options.continueSession';
-  throw contractError({
-    code: 'invalid-field',
-    field,
-    exitCode: 2,
-    message:
-      'OMP RPC lane runs sessionless (--no-session) in this slice; resume/continue session control is capability-gated off (sessionResume: false).',
-  });
+  if (options.continueSession) {
+    throw contractError({
+      code: 'invalid-field',
+      field: 'options.continueSession',
+      exitCode: 2,
+      message: 'OMP RPC lane never supports --continue; continuation is always an explicit verified --resume partition.',
+    });
+  }
+  const hasVerifiedResume = resolveOmpSessionLaunch(options).kind === 'resume';
+  if (options.resumeSessionId !== undefined && !hasVerifiedResume) {
+    throw contractError({
+      code: 'invalid-field',
+      field: 'options.resumeSessionId',
+      exitCode: 2,
+      message:
+        'OMP RPC lane requires a verified session partition (options.ompSession.kind === "resume") to resume; a bare session ID cannot be trusted.',
+    });
+  }
+}
+
+function sessionArgs(session: OmpSessionLaunch): readonly string[] {
+  switch (session.kind) {
+    case 'none':
+      return ['--no-session'];
+    case 'fresh':
+      return ['--session-dir', session.partition.path];
+    case 'resume':
+      return ['--session-dir', session.partition.path, '--resume', session.file.path];
+  }
 }
 
 function rejectMcpConfig(options: BuildProviderCommandOptions): void {
@@ -257,8 +286,9 @@ function buildCommand(_context: string, options: BuildProviderCommandOptions = {
   const modelSelector = resolveModelSelector(options);
   const warnings = collectWarnings(options);
   const overlay = createOmpConfigOverlay();
+  const session = resolveOmpSessionLaunch(options);
 
-  const args: string[] = ['--mode', 'rpc', '--no-session', '--model', modelSelector];
+  const args: string[] = ['--mode', 'rpc', ...sessionArgs(session), '--model', modelSelector];
   if (options.modelSpec?.reasoningEffort) {
     args.push('--thinking', options.modelSpec.reasoningEffort);
   }

package/src/agent-cli-provider/omp-rpc-driver.ts

@@ -464,6 +464,20 @@ export function runOmpRpcTask(
       // (agent_end / a delayed prompt_result), not by this function returning.
     }
 
+    // Present on both the get_state response's `data` and a `session_info_update` event frame per
+    // docs/rpc.md; either may carry only a subset, so callers merge this onto prior evidence
+    // rather than replacing it wholesale.
+    function sessionFieldsFromRecord(
+      record: Record<string, unknown>
+    ): Partial<Pick<OmpRpcSessionEvidence, 'sessionId' | 'sessionFile'>> {
+      const sessionId = getString(record, 'sessionId');
+      const sessionFile = getString(record, 'sessionFile');
+      return {
+        ...(sessionId !== null ? { sessionId } : {}),
+        ...(sessionFile !== null ? { sessionFile } : {}),
+      };
+    }
+
     function sessionEvidenceFromState(
       stateResponse: Record<string, unknown> | null
     ): Omit<OmpRpcSessionEvidence, 'phase'> {
@@ -471,15 +485,27 @@ export function runOmpRpcTask(
       const data = getRecord(stateResponse, 'data');
       const model = data ? getRecord(data, 'model') : null;
       return {
-        sessionId: null,
-        sessionFile: null,
+        ...UNKNOWN_SESSION_EVIDENCE,
+        ...(data ? sessionFieldsFromRecord(data) : {}),
         selectedProvider: (model ? getString(model, 'provider') : null) ?? '',
         selectedModel: (model ? getString(model, 'id') : null) ?? '',
         thinkingLevel: (data ? getString(data, 'thinkingLevel') : null) ?? '',
       };
     }
 
-    function dispatchFrame(frame: OmpRpcInboundFrame): void {
+    // session_info_update is a builtin slash-command side channel (docs/rpc.md) that can carry a
+    // later-observed sessionId/sessionFile than the initial get_state snapshot. Returning the
+    // hooks.onSession() promise (rather than fire-and-forget) lets a persistence failure surface
+    // through the same enqueue()/state.chain .catch() -> failPermanently() path as every other
+    // dispatch failure, instead of being silently swallowed.
+    function handleSessionInfoUpdate(frame: OmpRpcInboundFrame): Promise<void> | void {
+      const updates = sessionFieldsFromRecord(frame);
+      if (Object.keys(updates).length === 0) return;
+      state.sessionEvidence = { ...state.sessionEvidence, ...updates };
+      return hooks.onSession({ ...state.sessionEvidence, phase: 'ready' });
+    }
+
+    function dispatchFrame(frame: OmpRpcInboundFrame): void | Promise<void> {
       if (state.terminal) return; // Frames after the terminal frame are dropped.
       if (!state.readyReceived) {
         dispatchReadyFrame(frame);
@@ -513,6 +539,8 @@ export function runOmpRpcTask(
         case 'agent_end':
           handleAgentEnd();
           return;
+        case 'session_info_update':
+          return handleSessionInfoUpdate(frame);
         default:
           if (state.promptSent) emitNormalized(frame);
       }

package/src/agent-cli-provider/omp-rpc-session.ts

@@ -1,6 +1,6 @@
-// Session-launch types for the OMP RPC v2 driver. This slice launches sessionless
-// (`--no-session`) only; `fresh`/`resume` are typed for Subissue 4's session-flag activation but
-// are unreachable from any caller in this slice.
+// Session-launch types for the OMP RPC v2 driver. `none` keeps the Docker-only sessionless launch
+// (`--no-session`); `fresh`/`resume` carry a verified partition (and, for resume, a verified
+// session file) allocated and checked by the JS task-lib layer — never a raw, unverified path.
 
 export interface VerifiedOmpPartition {
   readonly path: string;

package/src/agent-cli-provider/provider-registry.ts

@@ -486,6 +486,12 @@ export const providerRegistry = [
     // Written out explicitly rather than spread from STANDARD_CAPABILITIES, which defaults
     // dockerIsolation to true; OMP's Docker path is env/broker-only and sessionless (see
     // AGENTS.md OMP Docker section) rather than the standard credential-mount + resume shape.
+    // sessionResume is true as of issue #866: verified UUID partitions, two-phase file
+    // verification, and the owner-fenced ownership FSM (task-lib/omp-session-ownership.js) are
+    // live end to end for host, worktree, detached cluster-agent, and standalone manual resume.
+    // The two are independent: an isolated (Docker) OMP task allocates no session partition at all
+    // and launches `--no-session`, so `sessionResume: true` never implies a resumable container
+    // turn (task-lib/runner.js#resolveOmpSessionPlan, OMP_SESSIONLESS_ENV).
     capabilities: {
       dockerIsolation: true,
       worktreeIsolation: true,
@@ -494,7 +500,7 @@ export const providerRegistry = [
       streamJson: true,
       thinkingMode: true,
       reasoningEffort: true,
-      sessionResume: false,
+      sessionResume: true,
       webSearch: false,
     },
     docs: {

package/src/agent-cli-provider/types.ts

@@ -12,6 +12,7 @@ import type {
   StructuredOutputProviderRegistryEntry,
   UnstructuredOutputProviderRegistryEntry,
 } from './provider-registry';
+import type { OmpSessionLaunch } from './omp-rpc-session';
 
 export type ProviderId = (typeof providerIds)[number];
 export type ProviderAlias = (typeof providerAliases)[number];
@@ -329,6 +330,9 @@ export interface BuildProviderCommandOptions {
   readonly autoApprove?: boolean;
   readonly resumeSessionId?: string;
   readonly continueSession?: boolean;
+  // OMP-only: a verified session launch (none/fresh/resume) built from a checked partition —
+  // never a raw session id string. See src/agent-cli-provider/omp-rpc-session.ts.
+  readonly ompSession?: OmpSessionLaunch;
   readonly webSearch?: boolean;
   readonly claudeSettingsFile?: string;
   readonly cliFeatures?: CliFeatureOverrides;

package/src/omp-blob-root.js

@@ -0,0 +1,110 @@
+// Resolution of OMP's *shared* content-addressed blob store root, mirrored from the tagged
+// v17.2.1 source (`packages/utils/src/dirs.ts`: `getBlobsDir()` / `DirResolver`) rather than
+// invented by Zeroshot.
+//
+// Why this exists: OMP externalizes large payloads (images, provider data URLs) out of the session
+// JSONL into `<blobsDir>/<sha256-hex>` and leaves a nested `blob:sha256:<hex>` reference string
+// inside the JSONL record (`packages/coding-agent/src/session/blob-store.ts`). The store is shared
+// by every session on the machine and lives at `~/.omp/agent/blobs` by default — nowhere near
+// Zeroshot's per-task session partition. A resumed partition whose referenced blobs are missing is
+// an invalid continuation, so verification has to resolve them at this real root; and because the
+// root is shared, Zeroshot cleanup must never delete anything under it.
+//
+// Resolution order, exactly as `DirResolver`'s constructor computes it:
+//   profile      = normalize(OMP_PROFILE ?? PI_PROFILE)         // OMP_PROFILE wins; '' selects default
+//   configRoot   = ~/${PI_CONFIG_DIR || '.omp'}[/profiles/<profile>]
+//   defaultAgent = <configRoot>/agent
+//   agentDir     = profile ? defaultAgent : (resolve(PI_CODING_AGENT_DIR) || defaultAgent)
+//   dataBase     = (linux|darwin) && agentDir === defaultAgent && $XDG_DATA_HOME/omp[/profiles/<p>]
+//                  exists ? that : agentDir                      // XDG flattens the agent/ prefix
+//   blobsDir     = <dataBase>/blobs
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const APP_NAME = 'omp';
+const CONFIG_DIR_NAME = '.omp';
+// dirs.ts PROFILE_NAME_RE / WINDOWS_RESERVED_BASENAME_RE.
+const PROFILE_NAME_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}$/u;
+const WINDOWS_RESERVED_BASENAME_PATTERN = /^(?:CON|PRN|AUX|NUL|COM[0-9]|LPT[0-9])(?:\..*)?$/iu;
+
+/** dirs.ts normalizeProfileName, but total: an invalid name resolves to the default profile here
+ * instead of throwing. A resume against a profile OMP itself would reject cannot succeed anyway —
+ * the verifier will simply not find the referenced blobs and fail the continuation closed. */
+function normalizeProfileName(profile) {
+  const normalized = typeof profile === 'string' ? profile.trim() : '';
+  if (!normalized || normalized === 'default') return undefined;
+  if (
+    normalized === '.' ||
+    normalized === '..' ||
+    normalized.endsWith('.') ||
+    !PROFILE_NAME_PATTERN.test(normalized) ||
+    WINDOWS_RESERVED_BASENAME_PATTERN.test(normalized)
+  ) {
+    return undefined;
+  }
+  return normalized;
+}
+
+function activeProfile(env) {
+  return normalizeProfileName(
+    env.OMP_PROFILE !== undefined ? env.OMP_PROFILE : env.PI_PROFILE
+  );
+}
+
+function directoryExists(candidate) {
+  try {
+    return fs.statSync(candidate).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Absolute path of the shared OMP blob store for the current environment.
+ * `env`/`homedir`/`platform` are injectable for tests only; production callers pass nothing.
+ */
+function resolveOmpBlobsDir({
+  env = process.env,
+  homedir = os.homedir(),
+  platform = process.platform,
+} = {}) {
+  const profile = activeProfile(env);
+  const configDirName = env.PI_CONFIG_DIR || CONFIG_DIR_NAME;
+  const baseConfigRoot = path.join(homedir, configDirName);
+  const configRoot = profile ? path.join(baseConfigRoot, 'profiles', profile) : baseConfigRoot;
+
+  const defaultAgentDir = path.join(configRoot, 'agent');
+  // A named profile pins the agent dir to the profile root; PI_CODING_AGENT_DIR applies only in
+  // default mode (dirs.ts: `const agentDirOverride = profile ? undefined : options.agentDirOverride`).
+  const agentDirOverride = profile ? undefined : env.PI_CODING_AGENT_DIR;
+  const agentDir = agentDirOverride ? path.resolve(agentDirOverride) : defaultAgentDir;
+
+  let dataBase = agentDir;
+  if ((platform === 'linux' || platform === 'darwin') && agentDir === defaultAgentDir) {
+    const xdgDataHome = env.XDG_DATA_HOME;
+    if (xdgDataHome) {
+      const appRoot = path.join(xdgDataHome, APP_NAME);
+      const candidate = profile ? path.join(appRoot, 'profiles', profile) : appRoot;
+      if (directoryExists(candidate)) dataBase = candidate;
+    }
+  }
+
+  return path.join(dataBase, 'blobs');
+}
+
+/** True when `candidate` is the shared blob root or anything inside it. Cleanup uses this as a
+ * hard stop: a Zeroshot partition must never resolve into OMP's shared, cross-session CAS. */
+function isInsideOmpBlobsDir(candidate, options = {}) {
+  const blobsDir = resolveOmpBlobsDir(options);
+  const resolved = path.resolve(candidate);
+  return resolved === blobsDir || resolved.startsWith(blobsDir + path.sep);
+}
+
+module.exports = {
+  APP_NAME,
+  CONFIG_DIR_NAME,
+  isInsideOmpBlobsDir,
+  normalizeProfileName,
+  resolveOmpBlobsDir,
+};

package/src/omp-config-overlay.js

@@ -1,7 +1,7 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { randomUUID } = require('crypto');
+const { createHash, randomUUID } = require('crypto');
 
 const OVERLAY_PREFIX = 'zeroshot-omp-config-';
 const OMP_CONFIG_OVERLAY_DIR_PATTERN = /^zeroshot-omp-config-[A-Za-z0-9_-]+$/u;
@@ -62,6 +62,13 @@ bash:
     thresholdMs: 60000
 `;
 
+// Identity of the overlay *content*, not of any one temp file. A resumed session was produced
+// under whatever workflow-altering defaults this body pinned; if the body changes (a Zeroshot
+// upgrade retunes task.*/memory/advisor/async behaviour), continuing an old transcript under the
+// new rules is execution drift, so this digest is part of the OMP execution fingerprint recorded
+// with every resumable session (src/omp-execution-fingerprint.js).
+const OMP_CONFIG_OVERLAY_DIGEST = `sha256:${createHash('sha256').update(OVERLAY_BODY, 'utf8').digest('hex')}`;
+
 function createOmpConfigOverlay() {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), OVERLAY_PREFIX), { mode: 0o700 });
   try {
@@ -89,6 +96,7 @@ function isCanonicalOmpConfigOverlayDirectory(overlayDir) {
 }
 
 module.exports = {
+  OMP_CONFIG_OVERLAY_DIGEST,
   OMP_CONFIG_OVERLAY_DIR_PATTERN,
   OMP_CONFIG_OVERLAY_FILE_PATTERN,
   createOmpConfigOverlay,

package/src/omp-execution-fingerprint.js

@@ -0,0 +1,62 @@
+// The `executionFingerprint` recorded with every resumable OMP session (issue #866).
+//
+// A session transcript is only safely continuable under the same execution contract that produced
+// it. This digest binds that contract: the pinned OMP release, the Zeroshot config overlay's
+// content, the requested Zeroshot selectors (`--model`, `--thinking`, `--approval-mode`), and the
+// concrete provider/model/thinking level OMP actually reported for the turn. Any of those drifting
+// between the recording turn and a resume attempt — a Zeroshot upgrade that retunes the overlay, a
+// changed level mapping, an alias resolving to a different concrete model, a different thinking
+// level — makes the fingerprints differ, and the continuation is refused before the prompt.
+const { createHash } = require('crypto');
+const { OMP_CONFIG_OVERLAY_DIGEST } = require('./omp-config-overlay');
+
+/** Value of `--flag <value>` in an argv array, or '' when the flag is absent. */
+function flagValue(args, flag) {
+  if (!Array.isArray(args)) return '';
+  const index = args.indexOf(flag);
+  if (index < 0 || index + 1 >= args.length) return '';
+  const value = args[index + 1];
+  return typeof value === 'string' ? value : '';
+}
+
+/** The Zeroshot-requested half of the contract, readable from the command spec alone. */
+function requestedExecutionSelectors(commandSpec) {
+  const args = commandSpec?.args;
+  return {
+    modelSelector: flagValue(args, '--model'),
+    thinkingSelector: flagValue(args, '--thinking'),
+    approvalMode: flagValue(args, '--approval-mode'),
+  };
+}
+
+/**
+ * @param {object} params
+ * @param {string} params.expectedVersion pinned OMP release (OMP_SUPPORTED_VERSION)
+ * @param {object} params.commandSpec the spec OMP was actually spawned with
+ * @param {object} params.evidence OMP's reported session evidence (selectedProvider/Model, thinkingLevel)
+ * @param {string} [params.configOverlayDigest] injectable for tests only
+ * @returns {string} `sha256:<64-lower-hex>`
+ */
+function computeOmpExecutionFingerprint({
+  expectedVersion,
+  commandSpec,
+  evidence,
+  configOverlayDigest = OMP_CONFIG_OVERLAY_DIGEST,
+}) {
+  const fields = {
+    ompSupportedVersion: String(expectedVersion ?? ''),
+    configOverlayDigest: String(configOverlayDigest ?? ''),
+    ...requestedExecutionSelectors(commandSpec),
+    observedProvider: String(evidence?.selectedProvider ?? ''),
+    observedModel: String(evidence?.selectedModel ?? ''),
+    observedThinkingLevel: String(evidence?.thinkingLevel ?? ''),
+  };
+  const stable = {};
+  for (const key of Object.keys(fields).sort()) stable[key] = fields[key];
+  return `sha256:${createHash('sha256').update(JSON.stringify(stable), 'utf8').digest('hex')}`;
+}
+
+module.exports = {
+  computeOmpExecutionFingerprint,
+  requestedExecutionSelectors,
+};

package/src/omp-session-limits.js

@@ -0,0 +1,41 @@
+// Non-configurable bounds for OMP session partition verification (src/omp-session-verifier.js).
+// Every value is pinned exactly as specified by issue #866; do not derive these from settings or
+// environment — a configurable ceiling here would let a compromised/misbehaving OMP process (or a
+// hostile resumed partition) negotiate its own verification budget.
+const OMP_SESSION_LIMITS = Object.freeze({
+  maxSessionBytes: 268435456,
+  maxSessionRecords: 1000000,
+  maxArtifactEntries: 4096,
+  maxArtifactDepth: 16,
+  maxRelativePathBytes: 4096,
+  maxArtifactFileBytes: 268435456,
+  maxArtifactAggregateBytes: 536870912,
+  maxBlobReferences: 4096,
+  maxReferencedBlobBytes: 67108864,
+});
+
+/**
+ * The largest single JSONL record the verifier will buffer, DERIVED from the constants above
+ * rather than chosen — it is `maxReferencedBlobBytes`, and it is not a new knob (there is nothing
+ * to configure and no caller may override it).
+ *
+ * Why a per-record bound is needed at all: `maxSessionBytes` bounds the *file*, not a line within
+ * it. A hostile 256 MiB session with no newline in it is one record, and buffering it would cost
+ * the raw bytes, a concatenated copy, a UTF-16 string for JSON.parse, and the parsed value — a
+ * multi-hundred-megabyte spike driven entirely by the attacker's choice of where to put newlines.
+ *
+ * Why this value: `maxReferencedBlobBytes` is the issue's own answer to "how large may one
+ * addressable unit of session content be". OMP externalizes anything bigger than a message to the
+ * shared CAS store (blob-store.ts) and leaves only a 76-byte `blob:sha256:<hex>` reference in the
+ * record, so a legitimate record is orders of magnitude smaller than this; the bound exists to cap
+ * the pathological case, not to constrain real transcripts.
+ *
+ * Remaining allocation, exactly: verification buffers at most MAX_SESSION_RECORD_BYTES of raw
+ * record bytes, and `JSON.parse` necessarily materializes that record as one UTF-16 string plus its
+ * parsed value. Peak per-record cost is therefore O(MAX_SESSION_RECORD_BYTES) and independent of
+ * `maxSessionBytes`, the record count, and the file's newline placement. Nothing else in the
+ * verifier accumulates session, artifact, or blob bytes.
+ */
+const MAX_SESSION_RECORD_BYTES = OMP_SESSION_LIMITS.maxReferencedBlobBytes;
+
+module.exports = { OMP_SESSION_LIMITS, MAX_SESSION_RECORD_BYTES };