@the-open-engine/zeroshot 6.27.0 → 6.29.0

package/src/target/hosted-run/input.ts

@@ -0,0 +1,199 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+
+import type { HostedOptions, ResolvedInput } from './contracts.ts';
+
+const SUBMISSION_KEY = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{12}$/i;
+const CAPSULE_SIZES = new Set(['tiny', 'small', 'standard', 'large']);
+
+function validRepository(value: string): boolean {
+  if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(value)) return false;
+  return value.split('/').every((segment) => segment !== '.' && segment !== '..');
+}
+
+function validModel(value: string): boolean {
+  return (
+    value.length <= 256 && /^[A-Za-z0-9][A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(value)
+  );
+}
+
+function repositoryFromRemote(cwd = process.cwd()): string | null {
+  let remote: string;
+  try {
+    remote = execFileSync('git', ['remote', 'get-url', 'origin'], {
+      cwd,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+  } catch {
+    return null;
+  }
+  const match = remote.match(
+    /^(?:git@github\.com:|ssh:\/\/git@github\.com\/|https?:\/\/github\.com\/)([^/]+\/[^/]+?)(?:\.git)?$/
+  );
+  const repository = match?.[1];
+  return repository && validRepository(repository) ? repository : null;
+}
+
+function isolationProfile(options: HostedOptions): string {
+  return options.pr ? 'isolation.pr@1' : 'isolation.worktree@1';
+}
+
+function providerProfile(options: HostedOptions): string {
+  return options.pr ? 'provider.codex-openrouter-pr@1' : 'provider.codex-openrouter@1';
+}
+
+function promptRequest(prompt: string, options: HostedOptions): Record<string, unknown> {
+  return {
+    source: 'prompt',
+    prompt,
+    artifacts: [],
+    isolationProfile: isolationProfile(options),
+    providerProfile: providerProfile(options),
+  };
+}
+
+function issueRequest(issue: string, options: HostedOptions): Record<string, unknown> {
+  return {
+    source: 'issue',
+    issue,
+    artifacts: [],
+    isolationProfile: isolationProfile(options),
+    providerProfile: providerProfile(options),
+  };
+}
+
+function issueInput(value: string, options: HostedOptions): ResolvedInput | null {
+  const shorthand = value.match(/^([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)#([1-9][0-9]*)$/);
+  if (shorthand?.[1] && shorthand[2] && validRepository(shorthand[1])) {
+    const issue = `https://github.com/${shorthand[1]}/issues/${shorthand[2]}`;
+    return { repository: shorthand[1], request: issueRequest(issue, options) };
+  }
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  const match = url.pathname.match(/^\/([^/]+)\/([^/]+)\/issues\/([1-9][0-9]*)\/?$/);
+  const repository = match?.[1] && match[2] ? `${match[1]}/${match[2]}` : '';
+  if (url.hostname !== 'github.com' || !match || !validRepository(repository)) return null;
+  return { repository, request: issueRequest(url.href, options) };
+}
+
+async function readStdin(): Promise<string> {
+  if (process.stdin.isTTY) throw new Error('zeroshot run - requires piped input');
+  const chunks: Buffer[] = [];
+  let bytes = 0;
+  for await (const chunk of process.stdin) {
+    const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    bytes += value.length;
+    if (bytes > 1024 * 1024) throw new Error('hosted task input exceeds 1 MiB');
+    chunks.push(value);
+  }
+  const value = Buffer.concat(chunks).toString('utf8').trim();
+  if (!value) throw new Error('hosted task input is empty');
+  return value;
+}
+
+function readTaskFile(filename: string): string | null {
+  const flags =
+    fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0);
+  let descriptor: number;
+  try {
+    descriptor = fs.openSync(filename, flags);
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException).code;
+    if (code === 'ENOENT' || code === 'ENOTDIR' || code === 'EISDIR') return null;
+    if (code === 'ELOOP') throw new Error(`hosted task file must not be a symlink: ${filename}`);
+    throw error;
+  }
+  try {
+    if (!fs.fstatSync(descriptor).isFile()) return null;
+    return fs.readFileSync(descriptor, 'utf8');
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+
+export async function resolveHostedInput(
+  input: string,
+  options: HostedOptions,
+  environment: NodeJS.ProcessEnv = process.env
+): Promise<ResolvedInput> {
+  const explicitIssue = issueInput(input, options);
+  if (explicitIssue) return explicitIssue;
+  const repository =
+    options.repository ?? environment['ZEROSHOT_REPOSITORY'] ?? repositoryFromRemote();
+  if (!validRepository(repository ?? '')) {
+    throw new Error(
+      'hosted runs need a GitHub repository; use org/repo#123, --repository owner/name, ' +
+        'ZEROSHOT_REPOSITORY, or run inside a GitHub checkout'
+    );
+  }
+  if (/^[1-9][0-9]*$/.test(input)) {
+    return { repository: repository!, request: issueRequest(input, options) };
+  }
+  const prompt = input === '-' ? await readStdin() : (readTaskFile(path.resolve(input)) ?? input);
+  if (!prompt.trim()) throw new Error('hosted task input is empty');
+  return { repository: repository!, request: promptRequest(prompt.trim(), options) };
+}
+
+export function githubToken(environment: NodeJS.ProcessEnv): string {
+  const configured = environment['GH_TOKEN'] ?? environment['GITHUB_TOKEN'];
+  if (configured?.trim()) return configured.trim();
+  try {
+    const token = execFileSync('gh', ['auth', 'token'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+    if (token) return token;
+  } catch {
+    // The actionable error below covers missing and unauthenticated gh alike.
+  }
+  throw new Error('hosted runs require GH_TOKEN/GITHUB_TOKEN or an authenticated gh CLI');
+}
+
+export function providerKey(environment: NodeJS.ProcessEnv): string {
+  const key = environment['OPENROUTER_API_KEY'];
+  if (!key?.trim()) throw new Error('hosted Codex runs require OPENROUTER_API_KEY');
+  return key.trim();
+}
+
+export function validateHostedOptions(options: HostedOptions): void {
+  const unsupported: ReadonlyArray<readonly [keyof HostedOptions, string]> = [
+    ['config', '--config'],
+    ['docker', '--docker'],
+    ['worktree', '--worktree'],
+    ['dockerImage', '--docker-image'],
+    ['strictSchema', '--strict-schema'],
+    ['ship', '--ship'],
+    ['prBase', '--pr-base'],
+    ['mergeQueue', '--merge-queue'],
+    ['closeIssue', '--close-issue'],
+    ['workers', '--workers'],
+    ['gitlab', '--gitlab'],
+    ['jira', '--jira'],
+    ['devops', '--devops'],
+    ['linear', '--linear'],
+    ['mount', '--mount'],
+    ['noMounts', '--no-mounts'],
+    ['containerHome', '--container-home'],
+  ];
+  const selected = unsupported
+    .filter(([name]) => options[name] !== undefined && options[name] !== false)
+    .map(([, flag]) => flag);
+  if (options.provider && options.provider !== 'codex') selected.push('--provider');
+  if (selected.length) throw new Error(`hosted runs do not support ${selected.join(', ')}`);
+  if (!options.target) throw new Error('hosted runs require --target');
+  if (options.model !== undefined && !validModel(options.model)) {
+    throw new Error('hosted runs require an exact provider/model slug');
+  }
+  if (!CAPSULE_SIZES.has(options.size ?? 'standard')) {
+    throw new Error('hosted runs require --size tiny, small, standard, or large');
+  }
+  if (options.submissionKey !== undefined && !SUBMISSION_KEY.test(options.submissionKey)) {
+    throw new Error('hosted runs require --submission-key to be a random UUID');
+  }
+}

package/src/target/hosted-run.ts

@@ -0,0 +1,8 @@
+export { HostedRunHttpError } from './hosted-run/client.ts';
+export { cancelHostedRun, runHosted, statusHostedRun } from './hosted-run/commands.ts';
+export { resolveHostedInput, validateHostedOptions } from './hosted-run/input.ts';
+export type {
+  HostedOptions,
+  HostedRunDependencies,
+  HostedRunIntent,
+} from './hosted-run/contracts.ts';

package/src/target/index.ts

@@ -0,0 +1,55 @@
+export {
+  CredentialStoreUnavailableError,
+  KeyringCredentialStore,
+  FakeCredentialStore,
+  targetServiceKey,
+  TARGET_ACCOUNT,
+  type TargetCredentialStore,
+} from './credential-store.ts';
+
+export { acquireTargetLock } from './credential-lock.ts';
+
+export {
+  requestDeviceCode,
+  pollForToken,
+  DeviceFlowDeniedError,
+  DeviceFlowExpiredError,
+  UnboundSessionError,
+  type DeviceCodeResponse,
+  type TokenResponse,
+  type HttpTransport,
+  type Clock,
+} from './device-flow.ts';
+
+export {
+  addTarget,
+  removeTarget,
+  getTarget,
+  listTargets,
+  updateTargetOrganization,
+  validateTargetName,
+  normalizeAndValidateUrl,
+  TargetNameInvalidError,
+  TargetNameExistsError,
+  TargetNotFoundError,
+  TargetUrlInvalidError,
+  type TargetRecord,
+  type SettingsPort,
+} from './target-registry.ts';
+
+export {
+  targetLogin,
+  refreshAccessToken,
+  getAccessTokenProvider,
+  revokeAndCleanup,
+  LoginRequiredError,
+  type BrowserOpener,
+  type TargetSessionDeps,
+  type TargetAccessTokenProvider,
+} from './target-session.ts';
+
+export {
+  discoverTargetSessionEndpoints,
+  TargetDiscoveryError,
+  type TargetSessionEndpoints,
+} from './discovery.ts';

package/src/target/target-registry.ts

@@ -0,0 +1,174 @@
+import crypto from 'node:crypto';
+
+export interface TargetRecord {
+  readonly id: string;
+  readonly url: string;
+  readonly adapterVersion: string;
+  readonly deviceToken: string;
+  readonly organization?: { readonly id: string; readonly name: string };
+  readonly createdAt: string;
+}
+
+export class TargetNameInvalidError extends Error {
+  constructor(name: string) {
+    super(
+      `Invalid target name "${name}". Must be 1-64 characters, alphanumeric and hyphens only.`,
+    );
+    this.name = 'TargetNameInvalidError';
+  }
+}
+
+export class TargetNameExistsError extends Error {
+  constructor(name: string) {
+    super(`Target "${name}" already exists. Remove it first or choose a different name.`);
+    this.name = 'TargetNameExistsError';
+  }
+}
+
+export class TargetNotFoundError extends Error {
+  constructor(name: string) {
+    super(`Target "${name}" not found.`);
+    this.name = 'TargetNotFoundError';
+  }
+}
+
+export class TargetUrlInvalidError extends Error {
+  constructor(url: string, reason: string) {
+    super(`Invalid target URL "${url}": ${reason}`);
+    this.name = 'TargetUrlInvalidError';
+  }
+}
+
+const TARGET_NAME_PATTERN = /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,62}[a-zA-Z0-9])?$/;
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
+
+export function validateTargetName(name: string): void {
+  if (!TARGET_NAME_PATTERN.test(name) || name.length > 64) {
+    throw new TargetNameInvalidError(name);
+  }
+}
+
+export function normalizeAndValidateUrl(rawUrl: string): string {
+  let parsed: URL;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new TargetUrlInvalidError(rawUrl, 'not a valid URL');
+  }
+
+  if (parsed.username || parsed.password) {
+    throw new TargetUrlInvalidError(rawUrl, 'URL must not contain userinfo');
+  }
+
+  if (parsed.search || parsed.hash) {
+    throw new TargetUrlInvalidError(rawUrl, 'URL must not contain query or fragment');
+  }
+
+  const isLoopback = LOOPBACK_HOSTS.has(parsed.hostname);
+  if (parsed.protocol !== 'https:' && !isLoopback) {
+    throw new TargetUrlInvalidError(rawUrl, 'HTTPS required for non-loopback targets');
+  }
+
+  let normalized = `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+  if (normalized.endsWith('/') && normalized.length > 1) {
+    normalized = normalized.slice(0, -1);
+  }
+  return normalized;
+}
+
+interface SettingsWithTargets {
+  _targets?: Record<string, TargetRecord>;
+  [key: string]: unknown;
+}
+
+export interface SettingsPort {
+  load(): SettingsWithTargets;
+  mutate(mutator: (settings: SettingsWithTargets) => void): void;
+}
+
+export function addTarget(
+  name: string,
+  rawUrl: string,
+  settings: SettingsPort,
+): TargetRecord {
+  validateTargetName(name);
+  const url = normalizeAndValidateUrl(rawUrl);
+
+  const existing = settings.load();
+  if (existing._targets?.[name]) {
+    throw new TargetNameExistsError(name);
+  }
+
+  const record: TargetRecord = {
+    id: crypto.randomUUID(),
+    url,
+    adapterVersion: 'v1',
+    deviceToken: crypto.randomUUID(),
+    createdAt: new Date().toISOString(),
+  };
+
+  settings.mutate((s) => {
+    if (!s._targets) {
+      s._targets = {};
+    }
+    s._targets[name] = record;
+  });
+
+  return record;
+}
+
+export function removeTarget(
+  name: string,
+  settings: SettingsPort,
+): TargetRecord {
+  const existing = settings.load();
+  const record = existing._targets?.[name];
+  if (!record) {
+    throw new TargetNotFoundError(name);
+  }
+
+  settings.mutate((s) => {
+    if (s._targets) {
+      delete s._targets[name];
+    }
+  });
+
+  return record;
+}
+
+export function getTarget(
+  name: string,
+  settings: SettingsPort,
+): TargetRecord | null {
+  const existing = settings.load();
+  return existing._targets?.[name] ?? null;
+}
+
+export function listTargets(
+  settings: SettingsPort,
+): Array<{ name: string; record: TargetRecord }> {
+  const existing = settings.load();
+  const targets = existing._targets ?? {};
+  return Object.entries(targets).map(([name, record]) => ({ name, record }));
+}
+
+export function updateTargetOrganization(
+  name: string,
+  organization: { id: string; name: string },
+  settings: SettingsPort,
+): void {
+  const existing = settings.load();
+  if (!existing._targets?.[name]) {
+    throw new TargetNotFoundError(name);
+  }
+
+  settings.mutate((s) => {
+    const target = s._targets?.[name];
+    if (target) {
+      (s._targets as Record<string, TargetRecord>)[name] = {
+        ...target,
+        organization,
+      };
+    }
+  });
+}

package/src/target/target-session.ts

@@ -0,0 +1,253 @@
+import type { TargetCredentialStore } from './credential-store.ts';
+import type { TargetRecord, SettingsPort } from './target-registry.ts';
+import {
+  requestDeviceCode,
+  pollForToken,
+  UnboundSessionError,
+  type HttpTransport,
+  type Clock,
+  type TokenResponse,
+} from './device-flow.ts';
+import { targetServiceKey, TARGET_ACCOUNT } from './credential-store.ts';
+import { updateTargetOrganization } from './target-registry.ts';
+
+export class LoginRequiredError extends Error {
+  readonly targetName: string;
+  constructor(targetName: string) {
+    super(`Login required. Run: zeroshot target login ${targetName}`);
+    this.name = 'LoginRequiredError';
+    this.targetName = targetName;
+  }
+}
+
+export interface BrowserOpener {
+  open(url: string): Promise<void>;
+}
+
+export interface TargetSessionDeps {
+  readonly http: HttpTransport;
+  readonly clock: Clock;
+  readonly browserOpener: BrowserOpener;
+  readonly stderr: { write(s: string): void };
+  readonly discoveryEndpoints: {
+    readonly deviceAuthorizationEndpoint: string;
+    readonly tokenEndpoint: string;
+    readonly revocationEndpoint?: string;
+    readonly clientId: string;
+    readonly capsuleApiBaseUrl: string;
+  };
+}
+
+export async function targetLogin(
+  targetName: string,
+  target: TargetRecord,
+  credentialStore: TargetCredentialStore,
+  acquireLock: () => Promise<() => Promise<void>>,
+  settings: SettingsPort,
+  deps: TargetSessionDeps
+): Promise<{ organization: { id: string; name: string } }> {
+  const { http, clock, browserOpener, stderr, discoveryEndpoints } = deps;
+  const { deviceAuthorizationEndpoint, tokenEndpoint, clientId } = discoveryEndpoints;
+
+  const codeResponse = await requestDeviceCode(deviceAuthorizationEndpoint, clientId, http);
+
+  stderr.write(
+    `\nOpen this URL to authorize:\n  ${codeResponse.verification_uri}\n\nEnter code: ${codeResponse.user_code}\n\n`
+  );
+
+  if (codeResponse.verification_uri_complete) {
+    try {
+      await browserOpener.open(codeResponse.verification_uri_complete);
+    } catch {
+      // Browser open is best-effort
+    }
+  }
+
+  const tokenResponse = await pollForToken(
+    tokenEndpoint,
+    clientId,
+    codeResponse.device_code,
+    codeResponse.interval,
+    codeResponse.expires_in,
+    http,
+    clock,
+    undefined,
+    { token: target.deviceToken, label: 'Zeroshot CLI' }
+  );
+
+  if (!tokenResponse.organization) {
+    throw new UnboundSessionError(codeResponse.verification_uri);
+  }
+
+  const serviceKey = targetServiceKey(target.id);
+  const release = await acquireLock();
+  try {
+    await credentialStore.set(serviceKey, TARGET_ACCOUNT, tokenResponse.refresh_token);
+  } finally {
+    await release();
+  }
+
+  updateTargetOrganization(targetName, tokenResponse.organization, settings);
+
+  return { organization: tokenResponse.organization };
+}
+
+export async function refreshAccessToken(
+  targetName: string,
+  target: TargetRecord,
+  credentialStore: TargetCredentialStore,
+  acquireLock: () => Promise<() => Promise<void>>,
+  deps: Pick<TargetSessionDeps, 'http' | 'discoveryEndpoints'>
+): Promise<{ accessToken: string; expiresIn: number }> {
+  const { http, discoveryEndpoints } = deps;
+  const { tokenEndpoint, revocationEndpoint, clientId } = discoveryEndpoints;
+  const serviceKey = targetServiceKey(target.id);
+
+  const release = await acquireLock();
+  try {
+    const currentRefreshToken = await credentialStore.get(serviceKey, TARGET_ACCOUNT);
+    if (!currentRefreshToken) {
+      throw new LoginRequiredError(targetName);
+    }
+
+    const body = new URLSearchParams({
+      grant_type: 'refresh_token',
+      refresh_token: currentRefreshToken,
+      client_id: clientId,
+      audience: 'capsule',
+    });
+
+    let tokenResponse: TokenResponse;
+    const response = await http.fetch(tokenEndpoint, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: body.toString(),
+      redirect: 'error',
+    });
+
+    if (!response.ok) {
+      const errorBody = (await response.json().catch(() => ({ error: 'unknown' }))) as {
+        error: string;
+      };
+      if (errorBody.error === 'invalid_grant') {
+        await credentialStore.delete(serviceKey, TARGET_ACCOUNT);
+        throw new LoginRequiredError(targetName);
+      }
+      throw new Error(`Token refresh failed (${response.status}): ${errorBody.error}`);
+    }
+
+    tokenResponse = (await response.json()) as TokenResponse;
+
+    try {
+      await credentialStore.set(serviceKey, TARGET_ACCOUNT, tokenResponse.refresh_token);
+    } catch {
+      await bestEffortRevoke(tokenResponse.refresh_token, revocationEndpoint, clientId, http);
+      await credentialStore.delete(serviceKey, TARGET_ACCOUNT);
+      throw new LoginRequiredError(targetName);
+    }
+
+    return { accessToken: tokenResponse.access_token, expiresIn: tokenResponse.expires_in };
+  } finally {
+    await release();
+  }
+}
+
+async function bestEffortRevoke(
+  token: string,
+  revocationEndpoint: string | undefined,
+  clientId: string,
+  http: HttpTransport
+): Promise<void> {
+  if (!revocationEndpoint) return;
+  try {
+    const body = new URLSearchParams({
+      token,
+      client_id: clientId,
+      token_type_hint: 'refresh_token',
+    });
+    await http.fetch(revocationEndpoint, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: body.toString(),
+      redirect: 'error',
+    });
+  } catch {
+    // Best-effort
+  }
+}
+
+export interface TargetAccessTokenProvider {
+  getAccessToken(signal?: AbortSignal): Promise<string>;
+}
+
+export function getAccessTokenProvider(
+  targetName: string,
+  target: TargetRecord,
+  credentialStore: TargetCredentialStore,
+  acquireLock: () => Promise<() => Promise<void>>,
+  deps: Pick<TargetSessionDeps, 'http' | 'discoveryEndpoints'>,
+  clock: Clock = { now: () => Date.now() }
+): TargetAccessTokenProvider {
+  let cachedToken: string | null = null;
+  let expiresAt = 0;
+
+  return {
+    async getAccessToken(_signal?: AbortSignal): Promise<string> {
+      if (cachedToken && clock.now() < expiresAt - 30_000) {
+        return cachedToken;
+      }
+      const result = await refreshAccessToken(
+        targetName,
+        target,
+        credentialStore,
+        acquireLock,
+        deps
+      );
+      cachedToken = result.accessToken;
+      expiresAt = clock.now() + result.expiresIn * 1000;
+      return result.accessToken;
+    },
+  };
+}
+
+export async function revokeAndCleanup(
+  target: TargetRecord,
+  credentialStore: TargetCredentialStore,
+  acquireLock: () => Promise<() => Promise<void>>,
+  deps: Pick<TargetSessionDeps, 'http' | 'discoveryEndpoints'>,
+  force: boolean
+): Promise<void> {
+  const { http, discoveryEndpoints } = deps;
+  const { revocationEndpoint, clientId } = discoveryEndpoints;
+  const serviceKey = targetServiceKey(target.id);
+
+  const release = await acquireLock();
+  try {
+    const refreshToken = await credentialStore.get(serviceKey, TARGET_ACCOUNT);
+    if (refreshToken && revocationEndpoint) {
+      const body = new URLSearchParams({
+        token: refreshToken,
+        client_id: clientId,
+        token_type_hint: 'refresh_token',
+      });
+      try {
+        const response = await http.fetch(revocationEndpoint, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          body: body.toString(),
+          redirect: 'error',
+        });
+        if (!response.ok && !force) {
+          throw new Error(
+            `Remote revocation failed (${response.status}). Use --force to remove anyway.`
+          );
+        }
+      } catch (err) {
+        if (!force) throw err;
+      }
+    }
+    await credentialStore.delete(serviceKey, TARGET_ACCOUNT);
+  } finally {
+    await release();
+  }
+}