@the-open-engine/zeroshot 6.28.0 → 6.29.0

package/lib/target/bounded-json.d.ts

@@ -0,0 +1,6 @@
+interface BoundedJsonErrors {
+    readonly tooLarge: () => Error;
+    readonly invalid: () => Error;
+}
+export declare function readBoundedJson(response: Response, maxBytes: number, errors: BoundedJsonErrors): Promise<unknown>;
+export {};

package/lib/target/bounded-json.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readBoundedJson = readBoundedJson;
+async function readBoundedJson(response, maxBytes, errors) {
+    const declared = response.headers.get('content-length');
+    if (declared !== null && Number(declared) > maxBytes)
+        throw errors.tooLarge();
+    const reader = response.body?.getReader();
+    if (!reader) {
+        const bytes = new Uint8Array(await response.arrayBuffer());
+        if (bytes.byteLength > maxBytes)
+            throw errors.tooLarge();
+        return parseJson(bytes, errors);
+    }
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > maxBytes) {
+            await reader.cancel();
+            throw errors.tooLarge();
+        }
+        chunks.push(value);
+    }
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return parseJson(bytes, errors);
+}
+function parseJson(bytes, errors) {
+    try {
+        return JSON.parse(new TextDecoder().decode(bytes));
+    }
+    catch {
+        throw errors.invalid();
+    }
+}

package/lib/target/device-flow.d.ts

@@ -24,6 +24,10 @@ export interface HttpTransport {
 export interface Clock {
     now(): number;
 }
+export interface DeviceIdentity {
+    readonly token: string;
+    readonly label: string;
+}
 export declare class DeviceFlowDeniedError extends Error {
     constructor();
 }
@@ -35,4 +39,4 @@ export declare class UnboundSessionError extends Error {
     constructor(verificationUri: string);
 }
 export declare function requestDeviceCode(deviceAuthorizationEndpoint: string, clientId: string, http: HttpTransport, signal?: AbortSignal): Promise<DeviceCodeResponse>;
-export declare function pollForToken(tokenEndpoint: string, clientId: string, deviceCode: string, interval: number, expiresIn: number, http: HttpTransport, clock?: Clock, signal?: AbortSignal): Promise<TokenResponse>;
+export declare function pollForToken(tokenEndpoint: string, clientId: string, deviceCode: string, interval: number, expiresIn: number, http: HttpTransport, clock?: Clock, signal?: AbortSignal, deviceIdentity?: DeviceIdentity): Promise<TokenResponse>;

package/lib/target/device-flow.js

@@ -60,7 +60,7 @@ async function requestDeviceCode(deviceAuthorizationEndpoint, clientId, http, si
     }
     return (await response.json());
 }
-async function pollForToken(tokenEndpoint, clientId, deviceCode, interval, expiresIn, http, clock = DEFAULT_CLOCK, signal) {
+async function pollForToken(tokenEndpoint, clientId, deviceCode, interval, expiresIn, http, clock = DEFAULT_CLOCK, signal, deviceIdentity) {
     const deadline = clock.now() + expiresIn * 1000;
     let currentInterval = interval;
     while (clock.now() < deadline) {
@@ -73,6 +73,11 @@ async function pollForToken(tokenEndpoint, clientId, deviceCode, interval, expir
             device_code: deviceCode,
             client_id: clientId,
         });
+        if (deviceIdentity) {
+            body.set('audience', 'admin');
+            body.set('device_token', deviceIdentity.token);
+            body.set('device_label', deviceIdentity.label);
+        }
         const init = {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },

package/lib/target/discovery.d.ts

@@ -4,6 +4,7 @@ export interface TargetSessionEndpoints {
     readonly tokenEndpoint: string;
     readonly revocationEndpoint?: string;
     readonly clientId: string;
+    readonly capsuleApiBaseUrl: string;
 }
 export declare class TargetDiscoveryError extends Error {
     constructor(message: string);

package/lib/target/discovery.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TargetDiscoveryError = void 0;
 exports.discoverTargetSessionEndpoints = discoverTargetSessionEndpoints;
+const bounded_json_ts_1 = require("./bounded-json.js");
 const DISCOVERY_PATH = '/.well-known/openengine-hosted-target';
 const MAX_DISCOVERY_BYTES = 64 * 1024;
 class TargetDiscoveryError extends Error {
@@ -43,40 +44,6 @@ function safeEndpoint(value, field, serviceOrigin) {
     }
     return endpoint.href;
 }
-async function readBoundedJson(response) {
-    const declaredLength = response.headers.get('content-length');
-    if (declaredLength !== null && Number(declaredLength) > MAX_DISCOVERY_BYTES) {
-        throw new TargetDiscoveryError('response exceeds the size limit');
-    }
-    if (!response.body)
-        return response.json();
-    const reader = response.body.getReader();
-    const chunks = [];
-    let total = 0;
-    while (true) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        total += value.byteLength;
-        if (total > MAX_DISCOVERY_BYTES) {
-            await reader.cancel();
-            throw new TargetDiscoveryError('response exceeds the size limit');
-        }
-        chunks.push(value);
-    }
-    const bytes = new Uint8Array(total);
-    let offset = 0;
-    for (const chunk of chunks) {
-        bytes.set(chunk, offset);
-        offset += chunk.byteLength;
-    }
-    try {
-        return JSON.parse(new TextDecoder().decode(bytes));
-    }
-    catch {
-        throw new TargetDiscoveryError('response is not valid JSON');
-    }
-}
 async function fetchDocument(http, url) {
     const response = await http.fetch(url, {
         method: 'GET',
@@ -86,7 +53,11 @@ async function fetchDocument(http, url) {
     if (!response.ok) {
         throw new TargetDiscoveryError(`request failed with status ${response.status}`);
     }
-    return record(await readBoundedJson(response), 'response');
+    const body = await (0, bounded_json_ts_1.readBoundedJson)(response, MAX_DISCOVERY_BYTES, {
+        tooLarge: () => new TargetDiscoveryError('response exceeds the size limit'),
+        invalid: () => new TargetDiscoveryError('response is not valid JSON'),
+    });
+    return record(body, 'response');
 }
 async function discoverTargetSessionEndpoints(targetUrl, http) {
     const target = new URL(targetUrl);
@@ -98,6 +69,11 @@ async function discoverTargetSessionEndpoints(targetUrl, http) {
         throw new TargetDiscoveryError('unsupported organization binding');
     }
     const oauth = record(discovery.oauth, 'oauth');
+    const capsuleProtocol = record(discovery.capsule_protocol, 'capsule_protocol');
+    if (capsuleProtocol.name !== 'openengine.capsules/v1' || capsuleProtocol.major_version !== 1) {
+        throw new TargetDiscoveryError('unsupported capsule protocol');
+    }
+    const capsuleApiBaseUrl = safeEndpoint(capsuleProtocol.base_url, 'capsule_protocol.base_url', target.origin).replace(/\/$/, '');
     const metadataUrl = safeEndpoint(oauth.metadata_url, 'oauth.metadata_url', target.origin);
     const deviceEndpoint = safeEndpoint(oauth.device_authorization_endpoint, 'oauth.device_authorization_endpoint', target.origin);
     const tokenEndpoint = safeEndpoint(oauth.token_endpoint, 'oauth.token_endpoint', target.origin);
@@ -116,5 +92,6 @@ async function discoverTargetSessionEndpoints(targetUrl, http) {
         tokenEndpoint,
         ...(revocationEndpoint === undefined ? {} : { revocationEndpoint }),
         clientId,
+        capsuleApiBaseUrl,
     };
 }

package/lib/target/hosted-run/client.d.ts

@@ -0,0 +1,26 @@
+import { type TargetAccessTokenProvider } from '../target-session.ts';
+import type { HostedRunDependencies, HostedRunIntent } from './contracts.ts';
+export declare const UUID: RegExp;
+export declare const TERMINAL_STATES: Set<string>;
+export interface HostedContext {
+    readonly targetName: string;
+    readonly organization: string;
+    readonly client: RunIntentClient;
+}
+export declare class HostedRunHttpError extends Error {
+    readonly status: number;
+    readonly code: string | null;
+    constructor(status: number, message: string, code?: string | null);
+}
+export declare class RunIntentClient {
+    private readonly baseUrl;
+    private readonly organization;
+    private readonly tokenProvider;
+    private readonly fetch;
+    constructor(baseUrl: string, organization: string, tokenProvider: TargetAccessTokenProvider, fetchImplementation: typeof globalThis.fetch);
+    submit(body: Record<string, unknown>, submissionKey: string): Promise<HostedRunIntent>;
+    get(intentId: string): Promise<HostedRunIntent>;
+    cancel(intentId: string): Promise<HostedRunIntent>;
+    private request;
+}
+export declare function context(targetName: string, deps: HostedRunDependencies): Promise<HostedContext>;

package/lib/target/hosted-run/client.js

@@ -0,0 +1,158 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RunIntentClient = exports.HostedRunHttpError = exports.TERMINAL_STATES = exports.UUID = void 0;
+exports.context = context;
+const credential_lock_ts_1 = require("../credential-lock.js");
+const credential_store_ts_1 = require("../credential-store.js");
+const discovery_ts_1 = require("../discovery.js");
+const target_registry_ts_1 = require("../target-registry.js");
+const target_session_ts_1 = require("../target-session.js");
+const bounded_json_ts_1 = require("../bounded-json.js");
+const MAX_RESPONSE_BYTES = 1024 * 1024;
+exports.UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+exports.TERMINAL_STATES = new Set(['succeeded', 'failed', 'cancelled', 'expired']);
+const RUN_INTENT_STATES = new Set([
+    'queued',
+    'provisioning',
+    'running',
+    'cancelling',
+    ...exports.TERMINAL_STATES,
+]);
+function wait(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+class HostedRunHttpError extends Error {
+    status;
+    code;
+    constructor(status, message, code = null) {
+        super(message);
+        this.name = 'HostedRunHttpError';
+        this.status = status;
+        this.code = code;
+    }
+}
+exports.HostedRunHttpError = HostedRunHttpError;
+function validateIntent(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Zero Cloud returned an invalid run intent');
+    }
+    const record = value;
+    if (typeof record['intent_id'] !== 'string' ||
+        !exports.UUID.test(record['intent_id']) ||
+        typeof record['state'] !== 'string' ||
+        !RUN_INTENT_STATES.has(record['state'])) {
+        throw new Error('Zero Cloud returned an invalid run intent');
+    }
+    const result = record['result'];
+    if (result !== null && (typeof result !== 'object' || Array.isArray(result))) {
+        throw new Error('Zero Cloud returned an invalid run intent result');
+    }
+    return record;
+}
+class RunIntentClient {
+    baseUrl;
+    organization;
+    tokenProvider;
+    fetch;
+    constructor(baseUrl, organization, tokenProvider, fetchImplementation) {
+        this.baseUrl = baseUrl.replace(/\/$/, '');
+        this.organization = organization;
+        this.tokenProvider = tokenProvider;
+        this.fetch = fetchImplementation;
+    }
+    async submit(body, submissionKey) {
+        let failure;
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            try {
+                return await this.request('', {
+                    method: 'POST',
+                    body: JSON.stringify(body),
+                    headers: { 'Idempotency-Key': submissionKey },
+                });
+            }
+            catch (error) {
+                failure = error;
+                if (error instanceof HostedRunHttpError && error.status < 500)
+                    throw error;
+                if (attempt === 0)
+                    await wait(250);
+            }
+        }
+        throw failure;
+    }
+    get(intentId) {
+        return this.request(`/${encodeURIComponent(intentId)}`, { method: 'GET' });
+    }
+    cancel(intentId) {
+        return this.request(`/${encodeURIComponent(intentId)}`, { method: 'DELETE' });
+    }
+    async request(suffix, options) {
+        const token = await this.tokenProvider.getAccessToken();
+        const url = `${this.baseUrl}/orgs/${encodeURIComponent(this.organization)}/run-intents${suffix}`;
+        const init = {
+            method: options.method,
+            redirect: 'error',
+            headers: {
+                Accept: 'application/json',
+                Authorization: `Bearer ${token}`,
+                'Content-Type': 'application/json',
+                ...options.headers,
+            },
+        };
+        if (options.body !== undefined)
+            init.body = options.body;
+        let response;
+        try {
+            response = await this.fetch(url, init);
+        }
+        catch (error) {
+            throw new Error(`Zero Cloud request failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const body = await (0, bounded_json_ts_1.readBoundedJson)(response, MAX_RESPONSE_BYTES, {
+            tooLarge: () => new Error('Zero Cloud response exceeded 1 MiB'),
+            invalid: () => new Error('Zero Cloud returned invalid JSON'),
+        });
+        if (!response.ok) {
+            const problem = body;
+            const code = typeof problem['code'] === 'string' ? problem['code'] : null;
+            const message = typeof problem['message'] === 'string' ? problem['message'] : 'request failed';
+            throw new HostedRunHttpError(response.status, `Zero Cloud ${response.status}: ${message}`, code);
+        }
+        return validateIntent(body);
+    }
+}
+exports.RunIntentClient = RunIntentClient;
+async function context(targetName, deps) {
+    const environment = deps.environment ?? process.env;
+    const target = (0, target_registry_ts_1.getTarget)(targetName, deps.settings);
+    if (!target)
+        throw new Error(`Target "${targetName}" not found.`);
+    const http = {
+        fetch: (url, init) => (deps.fetch ?? globalThis.fetch)(url, init),
+    };
+    const discovery = await (0, discovery_ts_1.discoverTargetSessionEndpoints)(target.url, http);
+    const ephemeralToken = environment['ZEROSHOT_TARGET_ACCESS_TOKEN']?.trim();
+    const ephemeralOrganization = environment['ZEROSHOT_TARGET_ORGANIZATION']?.trim();
+    if ((ephemeralToken && !ephemeralOrganization) || (!ephemeralToken && ephemeralOrganization)) {
+        throw new Error('ZEROSHOT_TARGET_ACCESS_TOKEN and ZEROSHOT_TARGET_ORGANIZATION must be provided together');
+    }
+    let organization;
+    let tokenProvider;
+    if (ephemeralToken && ephemeralOrganization) {
+        organization = ephemeralOrganization;
+        tokenProvider = { getAccessToken: async () => ephemeralToken };
+    }
+    else {
+        if (!target.organization) {
+            throw new Error(`Login required. Run: zeroshot target login ${targetName}`);
+        }
+        organization = target.organization.id;
+        const credentials = await credential_store_ts_1.KeyringCredentialStore.create();
+        tokenProvider = (0, target_session_ts_1.getAccessTokenProvider)(targetName, target, credentials, () => (0, credential_lock_ts_1.acquireTargetLock)(target.id), { http, discoveryEndpoints: discovery });
+    }
+    return {
+        targetName,
+        organization,
+        client: new RunIntentClient(discovery.capsuleApiBaseUrl, organization, tokenProvider, deps.fetch ?? globalThis.fetch),
+    };
+}

package/lib/target/hosted-run/commands.d.ts

@@ -0,0 +1,4 @@
+import type { HostedOptions, HostedRunDependencies, HostedRunIntent } from './contracts.ts';
+export declare function runHosted(input: string, options: HostedOptions, deps: HostedRunDependencies): Promise<HostedRunIntent | Record<string, unknown> | null>;
+export declare function statusHostedRun(targetName: string, intentId: string, shouldFollow: boolean, deps: HostedRunDependencies): Promise<HostedRunIntent | Record<string, unknown> | null>;
+export declare function cancelHostedRun(targetName: string, intentId: string, deps: HostedRunDependencies): Promise<HostedRunIntent>;

package/lib/target/hosted-run/commands.js

@@ -0,0 +1,113 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runHosted = runHosted;
+exports.statusHostedRun = statusHostedRun;
+exports.cancelHostedRun = cancelHostedRun;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const client_ts_1 = require("./client.js");
+const input_ts_1 = require("./input.js");
+const DEFAULT_MODEL = 'openai/gpt-5.4';
+const RUN_INTENT_VERSION = 'zeroshot.run-intent/v1';
+const MAX_RUN_INTENT_BYTES = 1024 * 1024 + 64 * 1024;
+const RUN_INTENT_POLL_MS = 500;
+function output(deps, value) {
+    (deps.stdout ?? process.stdout).write(`${value}\n`);
+}
+function wait(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+function displayState(intent) {
+    return intent.waiting_reason ? `${intent.state} (${intent.waiting_reason})` : intent.state;
+}
+function resumeCommand(value, intentId) {
+    return `zeroshot target status ${value.targetName} ${intentId} --follow`;
+}
+async function follow(value, initial, deps) {
+    let intent = initial;
+    let displayed = null;
+    for (;;) {
+        const state = displayState(intent);
+        if (state !== displayed) {
+            output(deps, `Run ${intent.intent_id}: ${state}`);
+            displayed = state;
+        }
+        if (client_ts_1.TERMINAL_STATES.has(intent.state))
+            break;
+        await (deps.delay ?? wait)(RUN_INTENT_POLL_MS);
+        intent = await value.client.get(intent.intent_id);
+    }
+    if (intent.state === 'succeeded') {
+        const summary = intent.result?.['summary'];
+        if (typeof summary === 'string' && summary)
+            output(deps, summary);
+        return intent.result;
+    }
+    const detail = intent.error_code ? ` (${intent.error_code})` : '';
+    throw new Error(`hosted run ${intent.state}${detail}`);
+}
+async function runHosted(input, options, deps) {
+    (0, input_ts_1.validateHostedOptions)(options);
+    const environment = deps.environment ?? process.env;
+    const resolved = await (0, input_ts_1.resolveHostedInput)(input, options, environment);
+    const value = await (0, client_ts_1.context)(options.target, deps);
+    const body = {
+        label: 'zeroshot-cli',
+        size: options.size ?? 'standard',
+        intent: {
+            version: RUN_INTENT_VERSION,
+            credentials: {
+                githubToken: (0, input_ts_1.githubToken)(environment),
+                openrouterApiKey: (0, input_ts_1.providerKey)(environment),
+                repository: resolved.repository,
+                model: options.model ?? DEFAULT_MODEL,
+            },
+            request: resolved.request,
+        },
+    };
+    if (Buffer.byteLength(JSON.stringify(body)) > MAX_RUN_INTENT_BYTES) {
+        throw new Error('hosted run intent exceeds the 1088 KiB upload limit');
+    }
+    const submissionKey = options.submissionKey ?? node_crypto_1.default.randomUUID();
+    let created;
+    try {
+        created = await value.client.submit(body, submissionKey);
+    }
+    catch (error) {
+        if (error instanceof client_ts_1.HostedRunHttpError)
+            throw error;
+        throw new Error(`${error instanceof Error ? error.message : String(error)}. Recover this submission by rerunning ` +
+            `the same command with --submission-key ${submissionKey}`, { cause: error });
+    }
+    output(deps, `Run ${created.intent_id} queued`);
+    output(deps, `Resume: ${resumeCommand(value, created.intent_id)}`);
+    if (options.detach)
+        return created;
+    output(deps, 'Ctrl+C disconnects without cancelling.');
+    return follow(value, created, deps);
+}
+async function statusHostedRun(targetName, intentId, shouldFollow, deps) {
+    if (!client_ts_1.UUID.test(intentId))
+        throw new Error('run intent id must be a UUID');
+    const value = await (0, client_ts_1.context)(targetName, deps);
+    const intent = await value.client.get(intentId);
+    if (!shouldFollow) {
+        output(deps, JSON.stringify(intent, null, 2));
+        return intent;
+    }
+    if (!client_ts_1.TERMINAL_STATES.has(intent.state)) {
+        output(deps, `Following ${intentId}; Ctrl+C disconnects without cancelling.`);
+        output(deps, `Resume: ${resumeCommand(value, intentId)}`);
+    }
+    return follow(value, intent, deps);
+}
+async function cancelHostedRun(targetName, intentId, deps) {
+    if (!client_ts_1.UUID.test(intentId))
+        throw new Error('run intent id must be a UUID');
+    const value = await (0, client_ts_1.context)(targetName, deps);
+    const intent = await value.client.cancel(intentId);
+    output(deps, `Run ${intent.intent_id}: ${displayState(intent)}`);
+    return intent;
+}

package/lib/target/hosted-run/contracts.d.ts

@@ -0,0 +1,49 @@
+import type { SettingsPort } from '../target-registry.ts';
+export interface HostedOptions {
+    readonly target?: string;
+    readonly repository?: string;
+    readonly model?: string;
+    readonly size?: string;
+    readonly submissionKey?: string;
+    readonly detach?: boolean;
+    readonly pr?: boolean;
+    readonly provider?: string;
+    readonly config?: string;
+    readonly docker?: boolean;
+    readonly worktree?: boolean;
+    readonly dockerImage?: string;
+    readonly strictSchema?: boolean;
+    readonly ship?: boolean;
+    readonly prBase?: string;
+    readonly mergeQueue?: boolean;
+    readonly closeIssue?: string;
+    readonly workers?: number;
+    readonly gitlab?: boolean;
+    readonly jira?: boolean;
+    readonly devops?: boolean;
+    readonly linear?: boolean;
+    readonly mount?: readonly string[];
+    readonly noMounts?: boolean;
+    readonly containerHome?: string;
+}
+export interface HostedRunIntent {
+    readonly intent_id: string;
+    readonly state: string;
+    readonly waiting_reason: string | null;
+    readonly result: Record<string, unknown> | null;
+    readonly error_code: string | null;
+    readonly [key: string]: unknown;
+}
+export interface HostedRunDependencies {
+    readonly settings: SettingsPort;
+    readonly environment?: NodeJS.ProcessEnv;
+    readonly fetch?: typeof globalThis.fetch;
+    readonly delay?: (milliseconds: number) => Promise<void>;
+    readonly stdout?: {
+        write(value: string): void;
+    };
+}
+export interface ResolvedInput {
+    readonly repository: string;
+    readonly request: Record<string, unknown>;
+}

package/lib/target/hosted-run/contracts.js

@@ -0,0 +1,3 @@
+"use strict";
+// Shared hosted-run command contracts.
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/target/hosted-run/input.d.ts

@@ -0,0 +1,5 @@
+import type { HostedOptions, ResolvedInput } from './contracts.ts';
+export declare function resolveHostedInput(input: string, options: HostedOptions, environment?: NodeJS.ProcessEnv): Promise<ResolvedInput>;
+export declare function githubToken(environment: NodeJS.ProcessEnv): string;
+export declare function providerKey(environment: NodeJS.ProcessEnv): string;
+export declare function validateHostedOptions(options: HostedOptions): void;