@the-open-engine/zeroshot 6.27.0 → 6.29.0

package/scripts/opcore-agent-tool-overlays.js

@@ -0,0 +1,154 @@
+const fs = require('node:fs');
+const path = require('node:path');
+const { pathToFileURL } = require('node:url');
+
+const writeTools = new Set(['write']);
+const editTools = new Set(['edit']);
+const multiEditTools = new Set(['multiedit', 'multi_edit']);
+const applyPatchTools = new Set(['applypatch', 'apply_patch']);
+let editApiPromise;
+
+function firstString(...values) {
+  return values.find((value) => typeof value === 'string');
+}
+
+function isRecord(value) {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function firstRecord(...values) {
+  return values.find(isRecord);
+}
+
+function requiredString(value, name) {
+  if (value === undefined) throw new Error(`${name} must be a string`);
+  return value;
+}
+
+function resolveTargetPath(repoRoot, filePath) {
+  const absolute = path.isAbsolute(filePath)
+    ? path.resolve(filePath)
+    : path.resolve(repoRoot, filePath);
+  const relative = path.relative(repoRoot, absolute);
+  if (
+    !relative ||
+    relative.startsWith('..') ||
+    path.isAbsolute(relative) ||
+    relative.split(path.sep).includes('..')
+  ) {
+    throw new Error(`pre-write target must stay inside the repo: ${filePath}`);
+  }
+  return relative.replaceAll('\\', '/');
+}
+
+function extractToolRequest(envelope) {
+  const nested = firstRecord(envelope.tool, envelope.toolCall, envelope.tool_call);
+  const toolName = firstString(
+    envelope.tool_name,
+    envelope.toolName,
+    envelope.name,
+    nested?.name,
+    nested?.tool_name,
+    nested?.toolName
+  );
+  if (!toolName) return null;
+  return {
+    toolName,
+    normalizedToolName: toolName.toLowerCase().replaceAll('-', '_'),
+    input:
+      firstRecord(
+        envelope.tool_input,
+        envelope.toolInput,
+        envelope.input,
+        nested?.input,
+        nested?.tool_input,
+        nested?.toolInput
+      ) || envelope,
+    cwd: firstString(envelope.cwd),
+  };
+}
+
+function writeOverlay(repoRoot, input) {
+  return {
+    action: 'write',
+    path: resolveTargetPath(
+      repoRoot,
+      requiredString(firstString(input.file_path, input.filePath, input.path), 'file_path')
+    ),
+    content: requiredString(firstString(input.content, input.text), 'content'),
+  };
+}
+
+function editOverlay(repoRoot, input) {
+  const relative = resolveTargetPath(
+    repoRoot,
+    requiredString(firstString(input.file_path, input.filePath, input.path), 'file_path')
+  );
+  const oldString = requiredString(firstString(input.old_string, input.oldString), 'old_string');
+  const newString = requiredString(firstString(input.new_string, input.newString), 'new_string');
+  const existing = fs.readFileSync(path.resolve(repoRoot, relative), 'utf8');
+  if (!existing.includes(oldString)) throw new Error(`old_string was not found in ${relative}`);
+  return { action: 'write', path: relative, content: existing.replace(oldString, newString) };
+}
+
+function multiEditOverlay(repoRoot, input) {
+  const relative = resolveTargetPath(
+    repoRoot,
+    requiredString(firstString(input.file_path, input.filePath, input.path), 'file_path')
+  );
+  let content = fs.readFileSync(path.resolve(repoRoot, relative), 'utf8');
+  for (const edit of Array.isArray(input.edits) ? input.edits : []) {
+    if (!isRecord(edit)) throw new Error(`MultiEdit edit for ${relative} must be an object`);
+    const oldString = requiredString(firstString(edit.old_string, edit.oldString), 'old_string');
+    const newString = requiredString(firstString(edit.new_string, edit.newString), 'new_string');
+    if (!content.includes(oldString)) throw new Error(`old_string was not found in ${relative}`);
+    content = content.replace(oldString, newString);
+  }
+  return { action: 'write', path: relative, content };
+}
+
+function loadEditApi() {
+  if (!editApiPromise) {
+    const opcoreEntrypoint = require.resolve('opcore');
+    const editModule = path.resolve(
+      path.dirname(opcoreEntrypoint),
+      '../node_modules/@the-open-engine/opcore-edit/dist/index.js'
+    );
+    editApiPromise = import(pathToFileURL(editModule).href);
+  }
+  return editApiPromise;
+}
+
+async function patchOverlays(repoRoot, input) {
+  const patch = firstString(input.command, input.patch);
+  if (!patch) return [];
+  const { createNodeEditWorkspace, createPatchEditPlan, isCodexApplyPatch } = await loadEditApi();
+  if (!isCodexApplyPatch(patch)) return [];
+  const workspace = await createNodeEditWorkspace({ repoRoot });
+  const planned = await createPatchEditPlan(workspace, {
+    repo: { repoRoot },
+    validation: { required: false },
+    patch,
+  });
+  if (!planned.ok) throw new Error(planned.refusal.message);
+  return Object.entries(planned.afterState).flatMap(([filePath, content]) => {
+    if (content === undefined) return [];
+    return [
+      {
+        action: content === null ? 'delete' : 'write',
+        path: filePath,
+        ...(content === null ? {} : { content }),
+      },
+    ];
+  });
+}
+
+function overlaysForTool(repoRoot, tool) {
+  if (writeTools.has(tool.normalizedToolName)) return [writeOverlay(repoRoot, tool.input)];
+  if (editTools.has(tool.normalizedToolName)) return [editOverlay(repoRoot, tool.input)];
+  if (multiEditTools.has(tool.normalizedToolName)) return [multiEditOverlay(repoRoot, tool.input)];
+  if (applyPatchTools.has(tool.normalizedToolName)) return patchOverlays(repoRoot, tool.input);
+  return [];
+}
+
+module.exports = { extractToolRequest, isRecord, overlaysForTool };

package/scripts/opcore-introduced-check.js

@@ -0,0 +1,290 @@
+#!/usr/bin/env node
+
+const { isUtf8 } = require('node:buffer');
+const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const TYPESCRIPT_AUTHORITIES = [
+  'tsconfig.agent-cli-provider.json',
+  'tsconfig.cluster.json',
+  'tsconfig.hosted-session.json',
+  'tsconfig.hosted-target.json',
+  'tsconfig.target.json',
+];
+
+const DEFAULT_CHECKS = [
+  'typescript.syntax',
+  'typescript.types',
+  'typescript.import-graph',
+  'typescript.dead-code',
+  'typescript.function-metrics',
+  'typescript.relevant-tests',
+  'typescript.file-length',
+  'rust.source-hygiene',
+  'rust.fmt',
+  'rust.cargo-check',
+  'rust.clippy',
+  'rust.rustdoc',
+  'rust.import-graph',
+  'rust.dead-code',
+  'rust.graph-signals',
+  'rust.file-length',
+  'rust.function-metrics',
+  'clone.duplication',
+].join(',');
+
+function run(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    cwd: options.cwd,
+    encoding: options.encoding ?? 'buffer',
+    env: options.env ?? process.env,
+    maxBuffer: 64 * 1024 * 1024,
+    timeout: options.timeout ?? 300_000,
+  });
+  if (result.error) throw result.error;
+  return result;
+}
+
+function git(repo, args, options = {}) {
+  const result = run('git', args, {
+    cwd: repo,
+    encoding: options.encoding ?? 'buffer',
+    env: options.env,
+  });
+  if (result.status !== 0) {
+    const stderr = Buffer.isBuffer(result.stderr) ? result.stderr.toString('utf8') : result.stderr;
+    throw new Error(`git ${args[0]} failed: ${stderr.trim() || `exit ${result.status}`}`);
+  }
+  return result.stdout;
+}
+
+function withoutGitLocalEnv(repo) {
+  const names = git(repo, ['rev-parse', '--local-env-vars'], { encoding: 'utf8' })
+    .split('\n')
+    .filter(Boolean);
+  const env = { ...process.env };
+  for (const name of names) delete env[name];
+  return env;
+}
+
+function valueOption(argv, index) {
+  const arg = argv[index];
+  for (const key of ['base', 'checks']) {
+    const flag = `--${key}`;
+    if (arg === flag) return { key, value: argv[index + 1], consumed: 1 };
+    if (arg.startsWith(`${flag}=`)) return { key, value: arg.slice(flag.length + 1), consumed: 0 };
+  }
+  return null;
+}
+
+function parseArgs(argv) {
+  const options = { base: 'HEAD', checks: DEFAULT_CHECKS, staged: false };
+  let index = 0;
+  while (index < argv.length) {
+    const arg = argv[index];
+    if (arg === '--staged') {
+      options.staged = true;
+      index += 1;
+      continue;
+    }
+    if (arg === '--json') {
+      index += 1;
+      continue;
+    }
+    const option = valueOption(argv, index);
+    if (!option) throw new Error(`Unsupported Opcore introduced-check argument: ${arg}`);
+    options[option.key] = option.value;
+    index += option.consumed + 1;
+  }
+  if (!options.base) throw new Error('--base requires a Git revision');
+  if (options.staged && options.base !== 'HEAD') {
+    throw new Error('--staged cannot be combined with a non-HEAD --base');
+  }
+  return options;
+}
+
+function nulTokens(buffer) {
+  return buffer
+    .toString('utf8')
+    .split('\0')
+    .filter((token) => token.length > 0);
+}
+
+function parseChanges(repo, options) {
+  const args = options.staged
+    ? ['diff', '--cached', '--name-status', '-z', '--find-renames', 'HEAD', '--']
+    : ['diff', '--name-status', '-z', '--find-renames', options.base, '--'];
+  const tokens = nulTokens(git(repo, args));
+  const changes = [];
+
+  for (let index = 0; index < tokens.length; ) {
+    const status = tokens[index++];
+    const kind = status[0];
+    if (kind === 'R' || kind === 'C') {
+      changes.push({ kind, oldPath: tokens[index++], path: tokens[index++] });
+    } else if ('AMDT'.includes(kind)) {
+      changes.push({ kind, path: tokens[index++] });
+    } else {
+      throw new Error(`Unsupported Git change status: ${status}`);
+    }
+  }
+
+  if (!options.staged) {
+    for (const untrackedPath of nulTokens(
+      git(repo, ['ls-files', '--others', '--exclude-standard', '-z', '--'])
+    )) {
+      changes.push({ kind: 'A', path: untrackedPath });
+    }
+  }
+
+  const byPath = new Map();
+  for (const change of changes) byPath.set(change.path, change);
+  return [...byPath.values()];
+}
+
+function safePath(root, relativePath) {
+  const absolute = path.resolve(root, relativePath);
+  const relative = path.relative(root, absolute);
+  if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) {
+    throw new Error(`Changed path escapes repository root: ${relativePath}`);
+  }
+  return absolute;
+}
+
+function readAfter(repo, change, staged) {
+  let content;
+  if (staged) {
+    content = git(repo, ['show', `:${change.path}`]);
+  } else {
+    const absolute = safePath(repo, change.path);
+    const stat = fs.lstatSync(absolute);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+      throw new Error(`Opcore introduced gate supports regular changed files only: ${change.path}`);
+    }
+    content = fs.readFileSync(absolute);
+  }
+  return isUtf8(content) && !content.includes(0) ? content.toString('utf8') : null;
+}
+
+function copyPolicy(repo, baseline) {
+  const source = path.join(repo, '.opcore', 'config');
+  if (!fs.existsSync(source)) return;
+  const target = path.join(baseline, '.opcore', 'config');
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.copyFileSync(source, target);
+}
+
+function linkDependencies(repo, baseline) {
+  const source = path.join(repo, 'node_modules');
+  const target = path.join(baseline, 'node_modules');
+  if (fs.existsSync(source) && !fs.existsSync(target)) fs.symlinkSync(source, target, 'dir');
+}
+
+function normalizeBaselineRename(baseline, change) {
+  if (change.kind !== 'R') return;
+  const source = safePath(baseline, change.oldPath);
+  const target = safePath(baseline, change.path);
+  if (!fs.existsSync(source)) return;
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.renameSync(source, target);
+}
+
+function createRequest(repo, baseline, changes, options) {
+  const overlays = [];
+  const files = [];
+  for (const change of changes) {
+    normalizeBaselineRename(baseline, change);
+    if (change.kind === 'D') {
+      overlays.push({ action: 'delete', path: change.path });
+      files.push(change.path);
+      continue;
+    }
+    const content = readAfter(repo, change, options.staged);
+    if (content === null) continue;
+    overlays.push({ action: 'write', path: change.path, content });
+    files.push(change.path);
+  }
+  for (const authority of TYPESCRIPT_AUTHORITIES) {
+    if (fs.existsSync(safePath(baseline, authority))) files.push(authority);
+  }
+
+  return {
+    requestId: `zeroshot-opcore-introduced-${process.pid}`,
+    repo: { repoRoot: baseline },
+    scope: { kind: 'files', files: [...new Set(files)] },
+    graph: { mode: 'optional', provider: 'opcore-graph' },
+    overlays,
+    ...(options.checks ? { checks: options.checks.split(',').filter(Boolean) } : {}),
+    reportMode: 'introduced',
+  };
+}
+
+function runOpcoreDirect(repo, args, env = process.env) {
+  const entrypoint = require.resolve('opcore');
+  return run(process.execPath, [entrypoint, ...args], {
+    cwd: repo,
+    encoding: 'utf8',
+    env: {
+      ...env,
+      PATH: `${path.join(repo, 'node_modules', '.bin')}${path.delimiter}${env.PATH || ''}`,
+    },
+  });
+}
+
+function emit(result) {
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  process.exitCode = result.status ?? 1;
+}
+
+function main() {
+  const options = parseArgs(process.argv.slice(2));
+  const repo = git(process.cwd(), ['rev-parse', '--show-toplevel'], {
+    encoding: 'utf8',
+  }).trim();
+  git(repo, ['rev-parse', '--verify', `${options.base}^{commit}`]);
+  const changes = parseChanges(repo, options);
+  if (changes.length === 0) {
+    emit(runOpcoreDirect(repo, ['check', '--changed', '--json']));
+    return;
+  }
+
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'zeroshot-opcore-baseline-'));
+  const baseline = path.join(tempRoot, 'repo');
+  try {
+    const baselineEnv = withoutGitLocalEnv(repo);
+    git(repo, ['clone', '--quiet', '--shared', '--no-checkout', repo, baseline], {
+      env: baselineEnv,
+    });
+    git(baseline, ['checkout', '--quiet', '--detach', options.base], {
+      env: baselineEnv,
+    });
+    linkDependencies(repo, baseline);
+    copyPolicy(repo, baseline);
+    const request = createRequest(repo, baseline, changes, options);
+    if (request.overlays.length === 0) {
+      emit(runOpcoreDirect(repo, ['check', '--changed', '--json']));
+      return;
+    }
+    const requestPath = path.join(tempRoot, 'validation-request.json');
+    fs.writeFileSync(requestPath, `${JSON.stringify(request)}\n`);
+    emit(
+      runOpcoreDirect(
+        baseline,
+        ['validate', 'hypothetical', '--request-file', requestPath, '--json'],
+        baselineEnv
+      )
+    );
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+}
+
+try {
+  main();
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+}

package/src/agent-cli-provider/adapters/codex.ts

@@ -28,6 +28,7 @@ import { parseCodexEvent } from './codex-parser';
 
 const MODEL_CATALOG: Readonly<Record<string, ModelCatalogEntry>> = {
   'gpt-5.4': { rank: 2 },
+  'openai/gpt-5.4': { rank: 2 },
   'gpt-5.5': { rank: 3 },
   'gpt-5.6': { rank: 3 },
   'gpt-5.6-sol': { rank: 3 },

package/src/isolation-manager.js

@@ -36,6 +36,20 @@ const { provisionClaudeCredentials } = require('./claude-credentials');
 
 const DEFAULT_WORKTREE_SETUP_TIMEOUT_MS = 15 * 60 * 1000;
 const FRESH_BASE_REF_PREFIX = 'refs/zeroshot/base-fetch';
+const DEFAULT_MIN_DISK_GB = 10;
+
+function minimumDiskGigabytes(environment = process.env) {
+  const configured = environment.ZEROSHOT_MIN_DISK_GB;
+  if (configured === undefined) return DEFAULT_MIN_DISK_GB;
+  if (typeof configured !== 'string' || !/^[1-9][0-9]*$/.test(configured)) {
+    throw new Error('ZEROSHOT_MIN_DISK_GB must be an integer between 1 and 1000');
+  }
+  const minimum = Number(configured);
+  if (!Number.isSafeInteger(minimum) || minimum > 1000) {
+    throw new Error('ZEROSHOT_MIN_DISK_GB must be an integer between 1 and 1000');
+  }
+  return minimum;
+}
 
 function runSync(command, args, options = {}) {
   const timeout = options.timeout ?? 30000;
@@ -2026,7 +2040,7 @@ class IsolationManager {
     // Disk space guard: prevent worktree creation when disk is critically low.
     // Uses standalone gc module (no Orchestrator dependency — avoids circular require).
     const { gcOrphanedWorktrees, getDiskSpace, countOrphanedWorktrees } = require('./lib/gc');
-    const MIN_DISK_GB = 10;
+    const MIN_DISK_GB = minimumDiskGigabytes();
     const AUTO_GC_THRESHOLD_PERCENT = 80;
 
     const diskCheck = getDiskSpace(os.homedir());
@@ -2399,3 +2413,4 @@ class IsolationManager {
 }
 
 module.exports = IsolationManager;
+module.exports.minimumDiskGigabytes = minimumDiskGigabytes;

package/src/target/bounded-json.ts

@@ -0,0 +1,48 @@
+interface BoundedJsonErrors {
+  readonly tooLarge: () => Error;
+  readonly invalid: () => Error;
+}
+
+export async function readBoundedJson(
+  response: Response,
+  maxBytes: number,
+  errors: BoundedJsonErrors
+): Promise<unknown> {
+  const declared = response.headers.get('content-length');
+  if (declared !== null && Number(declared) > maxBytes) throw errors.tooLarge();
+
+  const reader = response.body?.getReader();
+  if (!reader) {
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    if (bytes.byteLength > maxBytes) throw errors.tooLarge();
+    return parseJson(bytes, errors);
+  }
+
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel();
+      throw errors.tooLarge();
+    }
+    chunks.push(value);
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return parseJson(bytes, errors);
+}
+
+function parseJson(bytes: Uint8Array, errors: BoundedJsonErrors): unknown {
+  try {
+    return JSON.parse(new TextDecoder().decode(bytes));
+  } catch {
+    throw errors.invalid();
+  }
+}

package/src/target/credential-lock.ts

@@ -0,0 +1,35 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+// @ts-expect-error no declaration file for proper-lockfile
+import lockfile from 'proper-lockfile';
+
+const LOCK_STALE_MS = 10_000;
+const LOCK_RETRIES = 100;
+const LOCK_RETRY_MIN_TIMEOUT_MS = 50;
+const LOCK_RETRY_MAX_TIMEOUT_MS = 5_000;
+
+export async function acquireTargetLock(targetId: string): Promise<() => Promise<void>> {
+  const lockDir = path.join(os.homedir(), '.zeroshot');
+  await fs.mkdir(lockDir, { recursive: true });
+
+  const lockTarget = path.join(lockDir, `target-${targetId}.lock`);
+  try {
+    await fs.writeFile(lockTarget, '', { flag: 'wx' });
+  } catch (err: unknown) {
+    if ((err as NodeJS.ErrnoException).code !== 'EEXIST') throw err;
+  }
+
+  const release = await lockfile.lock(lockTarget, {
+    stale: LOCK_STALE_MS,
+    retries: {
+      retries: LOCK_RETRIES,
+      minTimeout: LOCK_RETRY_MIN_TIMEOUT_MS,
+      maxTimeout: LOCK_RETRY_MAX_TIMEOUT_MS,
+    },
+  });
+
+  return async () => {
+    await release();
+  };
+}

package/src/target/credential-store.ts

@@ -0,0 +1,107 @@
+export class CredentialStoreUnavailableError extends Error {
+  constructor(message?: string) {
+    super(
+      message ??
+        'OS secure store unavailable. Install libsecret (Linux), or run on macOS/Windows. No plaintext fallback.',
+    );
+    this.name = 'CredentialStoreUnavailableError';
+  }
+}
+
+export interface TargetCredentialStore {
+  get(service: string, account: string): Promise<string | null>;
+  set(service: string, account: string, token: string): Promise<void>;
+  delete(service: string, account: string): Promise<void>;
+}
+
+export function targetServiceKey(targetId: string): string {
+  return `zeroshot-target-${targetId}`;
+}
+
+export const TARGET_ACCOUNT = 'refresh-token';
+
+export class KeyringCredentialStore implements TargetCredentialStore {
+  private readonly Entry: new (service: string, account: string) => {
+    getPassword(): string;
+    setPassword(password: string): void;
+    deletePassword(): void;
+  };
+
+  private constructor(
+    Entry: new (service: string, account: string) => {
+      getPassword(): string;
+      setPassword(password: string): void;
+      deletePassword(): void;
+    },
+  ) {
+    this.Entry = Entry;
+  }
+
+  static async create(): Promise<KeyringCredentialStore> {
+    let keyringModule: { Entry: new (service: string, account: string) => {
+      getPassword(): string;
+      setPassword(password: string): void;
+      deletePassword(): void;
+    } };
+    try {
+      keyringModule = await import('@napi-rs/keyring') as typeof keyringModule;
+    } catch {
+      throw new CredentialStoreUnavailableError();
+    }
+    if (!keyringModule.Entry) {
+      throw new CredentialStoreUnavailableError();
+    }
+    return new KeyringCredentialStore(keyringModule.Entry);
+  }
+
+  async get(service: string, account: string): Promise<string | null> {
+    try {
+      const entry = new this.Entry(service, account);
+      return entry.getPassword();
+    } catch {
+      return null;
+    }
+  }
+
+  async set(service: string, account: string, token: string): Promise<void> {
+    const entry = new this.Entry(service, account);
+    entry.setPassword(token);
+  }
+
+  async delete(service: string, account: string): Promise<void> {
+    try {
+      const entry = new this.Entry(service, account);
+      entry.deletePassword();
+    } catch {
+      // Already deleted or not present
+    }
+  }
+}
+
+export class FakeCredentialStore implements TargetCredentialStore {
+  private readonly store = new Map<string, string>();
+
+  private key(service: string, account: string): string {
+    return `${service}::${account}`;
+  }
+
+  async get(service: string, account: string): Promise<string | null> {
+    return this.store.get(this.key(service, account)) ?? null;
+  }
+
+  async set(service: string, account: string, token: string): Promise<void> {
+    this.store.set(this.key(service, account), token);
+  }
+
+  async delete(service: string, account: string): Promise<void> {
+    this.store.delete(this.key(service, account));
+  }
+
+  has(service: string, account: string): boolean {
+    return this.store.has(this.key(service, account));
+  }
+
+  clear(): void {
+    this.store.clear();
+  }
+}