@the-open-engine/zeroshot 6.3.0 → 6.5.0

package/lib/settings.js

@@ -33,6 +33,14 @@ function getSettingsFile() {
   );
 }
 
+/**
+ * Whether the global settings file exists on disk (vs. running on defaults).
+ * @returns {boolean}
+ */
+function settingsFileExists() {
+  return fs.existsSync(getSettingsFile());
+}
+
 // Import provider defaults from separate module to avoid circular dependency
 const { getProviderDefaults, clearProviderDefaultsCache } = require('./provider-defaults');
 
@@ -103,6 +111,7 @@ const DEFAULT_SETTINGS_BASE = {
   },
   defaultConfig: 'conductor-bootstrap',
   defaultDocker: false,
+  defaultDelivery: 'none', // 'none' | 'pr' | 'ship' - folded into resolveEffectiveRunPlan same as defaultDocker
   strictSchema: true, // true = reliable json output (default), false = live streaming (may crash - see bold-meadow-11)
   logLevel: 'normal',
   // Auto-update settings
@@ -113,7 +122,7 @@ const DEFAULT_SETTINGS_BASE = {
   // Example: 'ccr code' for claude-code-router integration
   claudeCommand: 'claude',
   // Docker isolation mounts - preset names or {host, container, readonly?} objects
-  // Valid presets: gh, git, ssh, aws, azure, kube, terraform, gcloud, claude, codex, gemini, opencode
+  // Valid presets: infrastructure presets plus provider ids from the provider registry
   dockerMounts: ['gh', 'git', 'ssh'],
   // Extra env vars to pass to Docker container (in addition to preset-implied ones)
   // Supports: VAR (if set), VAR_* (pattern), VAR=value (forced), VAR= (empty)
@@ -323,7 +332,7 @@ function validateProviderSettings(value) {
 
   for (const [providerName, settings] of Object.entries(normalizedSettings || {})) {
     if (!VALID_PROVIDERS.includes(providerName)) {
-      return `Unknown provider in providerSettings: ${providerName}`;
+      return `Unknown provider in providerSettings: ${providerName}. Valid providers: ${VALID_PROVIDERS.join(', ')}`;
     }
 
     // Delegate validation to the provider
@@ -391,6 +400,10 @@ function validateSetting(key, value) {
     return `Invalid log level: ${value}. Valid levels: quiet, normal, verbose`;
   }
 
+  if (key === 'defaultDelivery' && !['none', 'pr', 'ship'].includes(value)) {
+    return `Invalid defaultDelivery: ${value}. Valid: none, pr, ship`;
+  }
+
   if (key === 'claudeCommand') {
     return validateClaudeCommand(value);
   }
@@ -528,6 +541,7 @@ module.exports = {
   coerceValue,
   DEFAULT_SETTINGS,
   getSettingsFile,
+  settingsFileExists,
   getClaudeCommand,
   // Model validation exports
   MODEL_HIERARCHY,
@@ -535,6 +549,7 @@ module.exports = {
   validateModelAgainstMax,
   // Provider defaults exports
   clearProviderDefaultsCache,
+  mapLegacyModelToLevel,
   // Backward compatibility: SETTINGS_FILE as getter (reads env var dynamically)
   get SETTINGS_FILE() {
     return getSettingsFile();

package/lib/setup-apply.js

@@ -0,0 +1,300 @@
+/**
+ * `zeroshot setup apply` — writes decisions from #A's plan/decision contract
+ * (lib/setup-plan.js) to global settings, repo-local settings, and the undo
+ * journal (lib/setup-journal.js).
+ *
+ * Fail-closed: every input decisionId + value is resolved and validated
+ * against its domain before ANY write happens. Writes are then applied only
+ * to settings keys a run-mode resolver actually reads (setup-plan.js's
+ * CONSUMED_PATHS/isConsumedPath — the same set that filters proposedWrites)
+ * — a settings key nobody reads is dead config, the exact drift the
+ * canonical-path rule (issue #605) forbids.
+ */
+
+const { resolveDecisionPath, domainFor, isConsumedPath, CONSUMED_PATHS } = require('./setup-plan');
+const { validateMountConfig, validateEnvPassthrough } = require('./docker-config');
+const { VALID_PROVIDERS } = require('./provider-names');
+const { VALID_MODELS, mapLegacyModelToLevel } = require('./settings');
+const {
+  loadJournal,
+  saveJournal,
+  upsertJournalEntry,
+  getNestedValue,
+  setNestedValue,
+  deepEqual,
+} = require('./setup-journal');
+
+const SECRET_PATTERN = /token|secret|password|api[_-]?key|credential/i;
+
+function assertSecretSafePath(targetPath) {
+  if (SECRET_PATTERN.test(targetPath)) {
+    throw new Error(`Refusing to write secret-shaped settings path: ${targetPath}`);
+  }
+}
+
+function domainError(decisionId, value) {
+  return new Error(
+    `Invalid value for decision "${decisionId}": expected ${domainFor(decisionId)}, got ${JSON.stringify(value)}`
+  );
+}
+
+// Resolves a submitted decision value into the raw form actually stored at
+// its target settings path, validating it against #A's domain first.
+// (defaultIsolation's domain is worktree|docker|none, but its target path is
+// the boolean settings.defaultDocker — this is where that translation lives.)
+function convertDecisionValue({ decisionId, value, globalSettings, deps }) {
+  switch (decisionId) {
+    case 'defaultProvider':
+      if (typeof value !== 'string' || !deps.VALID_PROVIDERS.includes(value)) {
+        throw domainError(decisionId, value);
+      }
+      return value;
+
+    case 'defaultIsolation':
+      if (!['worktree', 'docker', 'none'].includes(value)) throw domainError(decisionId, value);
+      return value === 'docker';
+
+    case 'allowLocalNoIsolation':
+      if (typeof value !== 'boolean') throw domainError(decisionId, value);
+      return value;
+
+    case 'defaultDelivery':
+      if (!['none', 'pr', 'ship'].includes(value)) throw domainError(decisionId, value);
+      return value;
+
+    case 'defaultIssueSource':
+      if (typeof value !== 'string' || !deps.listIssueProviders().includes(value)) {
+        throw domainError(decisionId, value);
+      }
+      return value;
+
+    case 'prBase':
+      if (typeof value !== 'string' || value.trim() === '') throw domainError(decisionId, value);
+      return value;
+
+    case 'dockerMounts': {
+      const err = validateMountConfig(value);
+      if (err) throw new Error(`Invalid value for decision "${decisionId}": ${err}`);
+      return value;
+    }
+
+    case 'dockerEnvPassthrough': {
+      const err = validateEnvPassthrough(value);
+      if (err) throw new Error(`Invalid value for decision "${decisionId}": ${err}`);
+      return value;
+    }
+
+    case 'updatePolicy':
+      if (!['off', 'notify', 'auto'].includes(value)) throw domainError(decisionId, value);
+      return value;
+
+    default:
+      if (decisionId.startsWith('providerLevel.')) {
+        if (!value || typeof value !== 'object' || Array.isArray(value)) {
+          throw domainError(decisionId, value);
+        }
+        for (const key of ['min', 'default', 'max']) {
+          if (!VALID_MODELS.includes(value[key])) throw domainError(decisionId, value);
+        }
+        const providerName = decisionId.slice('providerLevel.'.length);
+        const existing = getNestedValue(globalSettings, `providerSettings.${providerName}`) || {};
+        return {
+          ...existing,
+          minLevel: mapLegacyModelToLevel(value.min),
+          defaultLevel: mapLegacyModelToLevel(value.default),
+          maxLevel: mapLegacyModelToLevel(value.max),
+        };
+      }
+      throw new Error(`Unknown decision ID: ${decisionId}`);
+  }
+}
+
+function defaultApplyDeps() {
+  const fs = require('fs');
+  const { loadSettings, saveSettings } = require('./settings');
+  const { readRepoSettings, writeRepoSettings } = require('./repo-settings');
+  const { checkGhAuth } = require('../src/preflight');
+  const { listProviders: listIssueProviders } = require('../src/issue-providers');
+
+  return {
+    readFile: (filePath) => fs.readFileSync(filePath, 'utf8'),
+    loadSettings,
+    saveSettings,
+    readRepoSettings,
+    writeRepoSettings,
+    checkGhAuth,
+    listIssueProviders,
+    VALID_PROVIDERS,
+    now: () => new Date().toISOString(),
+  };
+}
+
+// Phase 1: resolve + validate EVERY input decision before any write happens
+// (fail-closed — a single bad decisionId or out-of-domain value rejects the
+// whole request, never a partial apply).
+function resolveAndValidateDecisions(input, globalSettings, deps) {
+  const resolved = [];
+  for (const [decisionId, value] of Object.entries(input)) {
+    const target = resolveDecisionPath(decisionId);
+    if (!target) {
+      throw new Error(`Unknown decision ID: ${decisionId}`);
+    }
+    assertSecretSafePath(target.path);
+    const writeValue = convertDecisionValue({ decisionId, value, globalSettings, deps });
+    resolved.push({ decisionId, target, inputValue: value, writeValue });
+  }
+  return resolved;
+}
+
+// Decides the outcome for a single resolved decision: a skip (with reason)
+// or the write to perform. Returns the write descriptor rather than mutating
+// anything, so the caller controls when settings objects/journal are touched.
+function resolveDecisionOutcome(
+  { decisionId, target, inputValue, writeValue },
+  { globalSettings, repoSettings, allowRiskyDefaults }
+) {
+  const settingsObj = target.scope === 'repo' ? repoSettings : globalSettings;
+  const currentValue = getNestedValue(settingsObj, target.path) ?? null;
+  const base = { decisionId, from: currentValue, to: writeValue };
+
+  if (decisionId === 'defaultDelivery' && inputValue === 'ship' && !allowRiskyDefaults) {
+    return { result: { ...base, applied: false, skippedReason: 'requires-explicit-opt-in' } };
+  }
+  if (!isConsumedPath(target.scope, target.path)) {
+    return { result: { ...base, applied: false, skippedReason: 'no-consumer' } };
+  }
+  if (deepEqual(currentValue, writeValue)) {
+    return { result: { ...base, applied: false, skippedReason: 'unchanged' } };
+  }
+
+  return {
+    result: { ...base, applied: true },
+    write: {
+      settingsObj,
+      scope: target.scope,
+      path: target.path,
+      writeValue,
+      priorValue: currentValue,
+    },
+  };
+}
+
+// Applies one decision's write to its in-memory settings object and journals
+// it (deferred persistence — the caller flushes to disk once at the end).
+function applyWrite(write, { repoRoot, journal, deps }) {
+  setNestedValue(write.settingsObj, write.path, write.writeValue);
+  upsertJournalEntry(journal, {
+    scope: write.scope,
+    path: write.path,
+    repoRoot: write.scope === 'repo' ? repoRoot : null,
+    priorValue: write.priorValue,
+    appliedValue: write.writeValue,
+    appliedAt: deps.now(),
+  });
+  return write.scope;
+}
+
+function persistIfDirty({
+  globalDirty,
+  repoDirty,
+  globalSettings,
+  repoSettings,
+  repoRoot,
+  journal,
+  deps,
+}) {
+  if (globalDirty) deps.saveSettings(globalSettings);
+  if (repoDirty) deps.writeRepoSettings(repoRoot, repoSettings);
+  if (globalDirty || repoDirty) saveJournal(journal);
+}
+
+// Phase 2: write every resolved decision, journaling each mutation and
+// skipping (never throwing) decisions that are unchanged, risky-without-optin,
+// or targeted at a settings key no resolver consumes.
+function writeResolvedDecisions(
+  resolved,
+  { globalSettings, repoSettings, repoRoot, journal, allowRiskyDefaults, deps }
+) {
+  const results = [];
+  let globalDirty = false;
+  let repoDirty = false;
+
+  for (const decision of resolved) {
+    const { result, write } = resolveDecisionOutcome(decision, {
+      globalSettings,
+      repoSettings,
+      allowRiskyDefaults,
+    });
+    results.push(result);
+    if (!write) continue;
+
+    const scope = applyWrite(write, { repoRoot, journal, deps });
+    if (scope === 'repo') repoDirty = true;
+    else globalDirty = true;
+  }
+
+  persistIfDirty({ globalDirty, repoDirty, globalSettings, repoSettings, repoRoot, journal, deps });
+
+  return results;
+}
+
+/**
+ * Apply a decisions file `{ "<decisionId>": <value>, ... }` to settings.
+ *
+ * @param {Object} params
+ * @param {string} params.decisionsPath - Path to the decisions JSON file.
+ * @param {string} params.cwd - Working directory (for repo-scope settings lookup).
+ * @param {boolean} [params.allowRiskyDefaults] - Required to store defaultDelivery='ship'.
+ * @param {Object} [params.deps] - Injected dependencies (for testing).
+ * @returns {Array<{decisionId: string, applied: boolean, from: *, to: *, skippedReason?: string}>}
+ */
+function applyDecisions({ decisionsPath, cwd, allowRiskyDefaults = false, deps = {} }) {
+  const resolvedDeps = { ...defaultApplyDeps(), ...deps };
+
+  let input;
+  try {
+    input = JSON.parse(resolvedDeps.readFile(decisionsPath));
+  } catch (err) {
+    throw new Error(`Failed to read decisions file "${decisionsPath}": ${err.message}`);
+  }
+  if (!input || typeof input !== 'object' || Array.isArray(input)) {
+    throw new Error('Decisions file must be a JSON object of { decisionId: value }');
+  }
+
+  const globalSettings = resolvedDeps.loadSettings();
+  const { repoRoot, settings: repoSettingsRaw } = resolvedDeps.readRepoSettings(cwd);
+  const repoSettings = repoSettingsRaw || {};
+
+  const resolved = resolveAndValidateDecisions(input, globalSettings, resolvedDeps);
+
+  const results = writeResolvedDecisions(resolved, {
+    globalSettings,
+    repoSettings,
+    repoRoot,
+    journal: loadJournal(),
+    allowRiskyDefaults,
+    deps: resolvedDeps,
+  });
+
+  // Never store provider-auth secrets: print the login command instead.
+  const issueSourceApplied = results.find(
+    (r) => r.decisionId === 'defaultIssueSource' && r.applied
+  );
+  if (issueSourceApplied && issueSourceApplied.to === 'github') {
+    const auth = resolvedDeps.checkGhAuth();
+    if (!auth || !auth.authenticated) {
+      console.log('Run: gh auth login');
+    }
+  }
+
+  return results;
+}
+
+module.exports = {
+  applyDecisions,
+  resolveAndValidateDecisions,
+  writeResolvedDecisions,
+  assertSecretSafePath,
+  isConsumedPath,
+  CONSUMED_PATHS,
+};

package/lib/setup-journal.js

@@ -0,0 +1,109 @@
+/**
+ * Undo journal for `zeroshot setup apply` / `zeroshot setup undo`.
+ *
+ * One journal entry per setting this setup owns: { scope, path, repoRoot,
+ * priorValue, appliedValue, appliedAt }. `priorValue: null` means the key
+ * did not exist before apply, so undo deletes it rather than restoring it.
+ * Shared by lib/setup-apply.js (writer) and lib/setup-undo.js (reader) so the
+ * nested-path mutation and equality semantics can't drift between the two.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { getSettingsFile } = require('./settings');
+const { getNestedValue } = require('./setup-plan');
+
+function getJournalPath() {
+  return path.join(path.dirname(getSettingsFile()), 'setup-undo-journal.json');
+}
+
+function loadJournal() {
+  const journalPath = getJournalPath();
+  if (!fs.existsSync(journalPath)) {
+    return { version: 1, entries: [] };
+  }
+  try {
+    const parsed = JSON.parse(fs.readFileSync(journalPath, 'utf8'));
+    if (!parsed || !Array.isArray(parsed.entries)) {
+      return { version: 1, entries: [] };
+    }
+    return parsed;
+  } catch {
+    return { version: 1, entries: [] };
+  }
+}
+
+function saveJournal(journal) {
+  const journalPath = getJournalPath();
+  fs.mkdirSync(path.dirname(journalPath), { recursive: true });
+  fs.writeFileSync(journalPath, JSON.stringify(journal, null, 2), 'utf8');
+}
+
+function entryKey(entry) {
+  return `${entry.scope}:${entry.repoRoot || ''}:${entry.path}`;
+}
+
+// Re-applying an already-journaled write updates appliedValue/appliedAt but
+// keeps the original priorValue — that's the true pre-apply state undo must
+// restore to, and it must not drift across repeated `apply` runs.
+function upsertJournalEntry(journal, entry) {
+  const key = entryKey(entry);
+  const existingIndex = journal.entries.findIndex((e) => entryKey(e) === key);
+  if (existingIndex === -1) {
+    journal.entries.push(entry);
+    return;
+  }
+  journal.entries[existingIndex] = {
+    ...entry,
+    priorValue: journal.entries[existingIndex].priorValue,
+  };
+}
+
+function setNestedValue(target, pathStr, value) {
+  const keys = pathStr.split('.');
+  let node = target;
+  for (let i = 0; i < keys.length - 1; i++) {
+    const key = keys[i];
+    if (typeof node[key] !== 'object' || node[key] === null) {
+      node[key] = {};
+    }
+    node = node[key];
+  }
+  node[keys[keys.length - 1]] = value;
+}
+
+function deleteNestedKey(target, pathStr) {
+  const keys = pathStr.split('.');
+  let node = target;
+  for (let i = 0; i < keys.length - 1; i++) {
+    const key = keys[i];
+    if (typeof node[key] !== 'object' || node[key] === null) return;
+    node = node[key];
+  }
+  delete node[keys[keys.length - 1]];
+}
+
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null || typeof a !== 'object' || typeof b !== 'object') return false;
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  if (Array.isArray(a)) {
+    if (a.length !== b.length) return false;
+    return a.every((v, i) => deepEqual(v, b[i]));
+  }
+  const aKeys = Object.keys(a);
+  const bKeys = Object.keys(b);
+  if (aKeys.length !== bKeys.length) return false;
+  return aKeys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && deepEqual(a[k], b[k]));
+}
+
+module.exports = {
+  getJournalPath,
+  loadJournal,
+  saveJournal,
+  upsertJournalEntry,
+  getNestedValue,
+  setNestedValue,
+  deleteNestedKey,
+  deepEqual,
+};