@the-open-engine/zeroshot 6.3.0 → 6.5.0

package/scripts/live-provider-smoke.js

@@ -0,0 +1,221 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const helper = require('../lib/agent-cli-provider');
+
+const SENTINEL = process.env.ZEROSHOT_LIVE_SENTINEL || 'ZEROSHOT_LIVE_SMOKE_OK';
+const TIMEOUT_MS = Number(process.env.ZEROSHOT_LIVE_TIMEOUT_MS || 120000);
+const DEFAULT_PROMPT = `Reply with exactly this text and nothing else: ${SENTINEL}`;
+
+function fail(message) {
+  console.error(message);
+  process.exitCode = 1;
+}
+
+function usage() {
+  return [
+    'Live provider smoke requires explicit provider selection.',
+    '',
+    'Examples:',
+    '  ZEROSHOT_LIVE_PROVIDERS=all npm run test:providers:live',
+    '  ZEROSHOT_LIVE_PROVIDERS=claude,codex,gemini npm run test:providers:live',
+    '  ZEROSHOT_LIVE_PROVIDERS=pi npm run test:providers:live',
+    '  ZEROSHOT_LIVE_PROVIDERS=copilot npm run test:providers:live',
+    '  ZEROSHOT_LIVE_PROVIDERS=gateway \\',
+    '    ZEROSHOT_LIVE_GATEWAY_BASE_URL=https://openrouter.ai/api/v1 \\',
+    '    ZEROSHOT_LIVE_GATEWAY_API_KEY=... \\',
+    '    ZEROSHOT_LIVE_GATEWAY_MODEL=openai/gpt-5.4 \\',
+    '    npm run test:providers:live',
+    '',
+    'This command invokes real provider CLIs or a real gateway endpoint. It is intentionally',
+    'not part of the normal CI suite because it can require user auth and paid API calls.',
+  ].join('\n');
+}
+
+function parseProviders() {
+  const raw = process.env.ZEROSHOT_LIVE_PROVIDERS;
+  if (!raw) {
+    console.error(usage());
+    process.exit(2);
+  }
+
+  const providers = [];
+  const allProviders = helper.listProviderAdapters();
+  for (const item of raw.split(',')) {
+    const trimmed = item.trim();
+    if (trimmed.toLowerCase() === 'all') {
+      for (const provider of allProviders) {
+        if (!providers.includes(provider)) providers.push(provider);
+      }
+      continue;
+    }
+
+    const normalized = helper.normalizeProviderName(trimmed);
+    if (!normalized) continue;
+    if (!allProviders.includes(normalized)) {
+      throw new Error(
+        `Unknown provider "${item}". Valid providers: ${allProviders.join(', ')}, all`
+      );
+    }
+    if (!providers.includes(normalized)) providers.push(normalized);
+  }
+
+  if (providers.length === 0) {
+    throw new Error('ZEROSHOT_LIVE_PROVIDERS did not contain any provider names.');
+  }
+  return providers;
+}
+
+function readJsonEnv(key) {
+  const value = process.env[key];
+  if (!value) return undefined;
+  try {
+    return JSON.parse(value);
+  } catch (error) {
+    throw new Error(`${key} must be valid JSON: ${error.message}`);
+  }
+}
+
+function liveGatewayOptions(cwd) {
+  const baseUrl = process.env.ZEROSHOT_LIVE_GATEWAY_BASE_URL;
+  const apiKey = process.env.ZEROSHOT_LIVE_GATEWAY_API_KEY;
+  const model = process.env.ZEROSHOT_LIVE_GATEWAY_MODEL;
+  const headers = readJsonEnv('ZEROSHOT_LIVE_GATEWAY_HEADERS_JSON');
+
+  for (const [key, value] of [
+    ['ZEROSHOT_LIVE_GATEWAY_BASE_URL', baseUrl],
+    ['ZEROSHOT_LIVE_GATEWAY_API_KEY', apiKey],
+    ['ZEROSHOT_LIVE_GATEWAY_MODEL', model],
+  ]) {
+    if (!value) throw new Error(`gateway live smoke requires ${key}.`);
+  }
+
+  return {
+    cwd,
+    gateway: {
+      baseUrl,
+      apiKey,
+      model,
+      ...(headers === undefined ? {} : { headers }),
+      toolPolicy: {
+        roots: ['.'],
+        commands: [],
+      },
+    },
+  };
+}
+
+function providerOptions(provider, cwd) {
+  if (provider === 'gateway') return liveGatewayOptions(cwd);
+
+  return {
+    cwd,
+    outputFormat: 'stream-json',
+  };
+}
+
+function eventText(event) {
+  if (!event || typeof event !== 'object') return '';
+  if (event.type === 'text' || event.type === 'thinking') return event.text || '';
+  if (event.type === 'result') {
+    return [event.result, event.text, event.message].filter(Boolean).join('\n');
+  }
+  return '';
+}
+
+function summarizeResult(envelope) {
+  if (!envelope || typeof envelope !== 'object') return 'no envelope';
+  if (!envelope.ok) {
+    const error = envelope.error || {};
+    return `${error.code || 'error'}: ${error.message || 'unknown failure'}`;
+  }
+
+  const result = envelope.result || {};
+  const events = Array.isArray(result.events) ? result.events : [];
+  const text = events.map(eventText).join('\n').trim();
+  const last = events.at(-1);
+  return JSON.stringify(
+    {
+      provider: envelope.provider,
+      exitCode: result.exitCode,
+      signal: result.signal,
+      timedOut: result.timedOut,
+      classification: result.classification || null,
+      eventCount: events.length,
+      lastEventType: last && typeof last === 'object' ? last.type : null,
+      text: text.slice(0, 500),
+    },
+    null,
+    2
+  );
+}
+
+function assertSmokePassed(provider, response) {
+  if (response.exitCode !== 0) {
+    throw new Error(
+      `${provider} contract exited ${response.exitCode}: ${summarizeResult(response.envelope)}`
+    );
+  }
+  if (!response.envelope.ok) {
+    throw new Error(`${provider} returned a contract error: ${summarizeResult(response.envelope)}`);
+  }
+
+  const result = response.envelope.result || {};
+  const events = Array.isArray(result.events) ? result.events : [];
+  const text = events.map(eventText).join('\n');
+  const finalResult = events.findLast((event) => event && event.type === 'result');
+
+  if (result.timedOut) {
+    throw new Error(`${provider} timed out after ${result.timeoutMs || TIMEOUT_MS}ms.`);
+  }
+  if (finalResult && finalResult.success === false) {
+    throw new Error(
+      `${provider} produced a failed result event: ${summarizeResult(response.envelope)}`
+    );
+  }
+  if (!text.includes(SENTINEL)) {
+    throw new Error(
+      `${provider} did not return sentinel ${SENTINEL}.\nResult:\n${summarizeResult(response.envelope)}`
+    );
+  }
+}
+
+async function smokeProvider(provider) {
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), `zeroshot-live-${provider}-`));
+  try {
+    const prompt = process.env.ZEROSHOT_LIVE_PROMPT || DEFAULT_PROMPT;
+    const response = await helper.runProviderExecutable(
+      JSON.stringify({
+        schemaVersion: 1,
+        command: 'invoke',
+        provider,
+        context: prompt,
+        options: providerOptions(provider, tempDir),
+        timeoutMs: TIMEOUT_MS,
+      })
+    );
+
+    assertSmokePassed(provider, response);
+    console.log(`✓ ${provider} live smoke returned ${SENTINEL}`);
+  } finally {
+    fs.rmSync(tempDir, { recursive: true, force: true });
+  }
+}
+
+async function main() {
+  const providers = parseProviders();
+  console.log(`Running live provider smoke for: ${providers.join(', ')}`);
+  console.log(`Sentinel: ${SENTINEL}`);
+
+  for (const provider of providers) {
+    await smokeProvider(provider);
+  }
+}
+
+main().catch((error) => {
+  fail(error.stack || error.message || String(error));
+});

package/src/agent/agent-lifecycle.js

@@ -61,10 +61,6 @@ async function createValidatorIsolation(agent, isolationConfig) {
 
   const cluster = agent.cluster || {};
   const workDir = agent.config?.cwd || cluster.worktree?.path || cluster.cwd || process.cwd();
-  const image = isolationConfig.image;
-  await IsolationManager.ensureImage(image);
-
-  const manager = new IsolationManager({ image });
   const providerName = normalizeProviderName(
     (agent._resolveProvider && agent._resolveProvider()) ||
       cluster.config?.forceProvider ||
@@ -72,6 +68,11 @@ async function createValidatorIsolation(agent, isolationConfig) {
       loadSettings().defaultProvider ||
       'claude'
   );
+  // Run validators on the provider's image variant (installs its CLI as a Docker-cached layer).
+  const image = IsolationManager.imageForProvider(providerName, isolationConfig.image);
+  await IsolationManager.ensureImage(image, true, IsolationManager.providerBuildArgs(providerName));
+
+  const manager = new IsolationManager({ image });
 
   const isolationClusterId = `${cluster.id}-validators`;
   const containerId = await manager.createContainer(isolationClusterId, {
@@ -200,6 +201,8 @@ function start(agent) {
  * @returns {Promise<void>}
  */
 async function stop(agent) {
+  stopLivenessCheck(agent);
+
   if (!agent.running) {
     return;
   }

package/src/agent/agent-quality-gate-schema.js

@@ -41,11 +41,11 @@ function buildQualityGateSchema() {
           required: ['command', 'exitCode', 'output'],
         },
         completedAt: {
-          type: ['string', 'number'],
+          anyOf: [{ type: 'string' }, { type: 'number' }],
           description: 'When the gate completed, as an ISO string or numeric timestamp.',
         },
         timestamp: {
-          type: ['string', 'number'],
+          anyOf: [{ type: 'string' }, { type: 'number' }],
           description: 'Alternate completion timestamp, as an ISO string or numeric timestamp.',
         },
         stale: {

package/src/agent/agent-task-executor.js

@@ -14,12 +14,15 @@ const { spawn, spawnSync } = require('child_process');
 const path = require('path');
 const fs = require('fs');
 const os = require('os');
-const { parseProviderChunk } = require('../providers');
+const { parseProviderChunk, getProvider } = require('../providers');
 const { getTask } = require('../../task-lib/store.js');
 const { loadSettings } = require('../../lib/settings.js');
 const { resolveClaudeAuth } = require('../../lib/settings/claude-auth.js');
 const { prependWorktreeToolBinToEnv } = require('../worktree-tooling-env.js');
-const { prepareClaudeConfigDir } = require('../worktree-claude-config.js');
+const {
+  prepareClaudeConfigDir,
+  resolveRepoMcpConfigPath,
+} = require('../worktree-claude-config.js');
 const { buildRawLogOnlyMetadata } = require('./context-replay-policy');
 
 function runCommandWithTimeout(command, args, options = {}, callback = null) {
@@ -733,9 +736,45 @@ function buildTaskRunArgs({ agent, providerName, modelSpec, runOutputFormat }) {
     args.push('--json-schema', schema);
   }
 
+  // MCP servers: providers whose CLI accepts an MCP config flag (e.g. Copilot's
+  // --additional-mcp-config) cannot use the Claude config-dir overlay, so forward the repo's
+  // `.mcp.json` (the same MCP source Claude consumes) inline via `--mcp-config`.
+  for (const mcpArg of resolveMcpConfigArgs(agent, providerName)) {
+    args.push(mcpArg);
+  }
+
   return args;
 }
 
+/**
+ * Build the `--mcp-config` args for a task-run invocation, or [] when they don't apply.
+ *
+ * Only providers whose adapter models an MCP config CLI flag receive it — Claude consumes MCP via
+ * the config-dir `.mcp.json` overlay (see prepareClaudeConfigDir) and needs no flag. The repo
+ * `.mcp.json` content is inlined (not passed as an @<path> reference) so the identical value works
+ * under local, worktree, and Docker isolation without host/container path translation.
+ */
+function resolveMcpConfigArgs(agent, providerName) {
+  if (!providerModelsMcpConfigFlag(providerName)) return [];
+
+  const mcpPath = resolveRepoMcpConfigPath({
+    cwd: agent.config?.cwd || process.cwd(),
+    worktreePath: agent.worktree?.path || null,
+  });
+  if (!mcpPath) return [];
+
+  const content = fs.readFileSync(mcpPath, 'utf8').trim();
+  if (content.length === 0) return [];
+
+  return ['--mcp-config', content];
+}
+
+/** True when the provider's adapter models an MCP config CLI flag (currently only Copilot). */
+function providerModelsMcpConfigFlag(providerName) {
+  const adapter = getProvider(providerName).adapter;
+  return 'supportsMcpConfig' in adapter.detectCliFeatures('');
+}
+
 function maybeLogStreamJsonNotice(agent, runOutputFormat) {
   if (agent.config.jsonSchema && runOutputFormat !== 'json' && !agent.quiet) {
     agent._log(

package/src/agent-cli-provider/acp-stdio-runner.ts

@@ -0,0 +1,314 @@
+/* eslint-disable max-lines-per-function */
+import { spawn } from 'node:child_process';
+import { omitProcessControlEnv, omitUnsafeProviderEnv } from './env-safety';
+import type { CommandSpec, ProviderId } from './types';
+import type { ProcessResult, ProcessRunnerOptions } from './process-runner';
+
+const DEFAULT_TIMEOUT_KILL_GRACE_MS = 100;
+
+interface JsonRpcRequest {
+  readonly jsonrpc: '2.0';
+  readonly id: number;
+  readonly method: string;
+  readonly params: Record<string, unknown>;
+}
+
+interface JsonRpcResponse {
+  readonly jsonrpc?: string;
+  readonly id?: number | string | null;
+  readonly result?: unknown;
+  readonly error?: unknown;
+}
+
+interface PendingRequest {
+  resolve(response: JsonRpcResponse): void;
+  reject(error: Error): void;
+}
+
+function spawnOptions(commandSpec: CommandSpec): {
+  readonly shell: false;
+  readonly env: NodeJS.ProcessEnv;
+  readonly stdio: ['pipe', 'pipe', 'pipe'];
+  cwd?: string;
+} {
+  const options: {
+    readonly shell: false;
+    readonly env: NodeJS.ProcessEnv;
+    readonly stdio: ['pipe', 'pipe', 'pipe'];
+    cwd?: string;
+  } = {
+    shell: false,
+    env: { ...omitProcessControlEnv(process.env), ...omitUnsafeProviderEnv(commandSpec.env) },
+    stdio: ['pipe', 'pipe', 'pipe'],
+  };
+  if (commandSpec.cwd !== undefined) options.cwd = commandSpec.cwd;
+  return options;
+}
+
+function processResult(input: {
+  readonly stdout: readonly Buffer[];
+  readonly stderr: readonly Buffer[];
+  readonly exitCode: number | null;
+  readonly signal: string | null;
+  readonly startedAt: number;
+  readonly timedOut: boolean;
+  readonly timeoutMs?: number;
+}): ProcessResult {
+  return {
+    stdout: Buffer.concat(input.stdout).toString('utf8'),
+    stderr: Buffer.concat(input.stderr).toString('utf8'),
+    exitCode: input.exitCode,
+    signal: input.signal,
+    durationMs: Date.now() - input.startedAt,
+    timedOut: input.timedOut,
+    ...(input.timedOut && input.timeoutMs !== undefined ? { timeoutMs: input.timeoutMs } : {}),
+  };
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function parseProtocolLine(line: string): Record<string, unknown> {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(line);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : 'Unknown JSON parse error.';
+    throw new Error(`malformed ACP stdout JSON: ${reason}`);
+  }
+  if (!isRecord(parsed)) throw new Error('malformed ACP stdout JSON: expected a JSON object.');
+  return parsed;
+}
+
+function createPromptParams(sessionId: string, prompt: string): Record<string, unknown> {
+  return {
+    sessionId,
+    prompt: [
+      {
+        role: 'user',
+        content: [{ type: 'text', text: prompt }],
+      },
+    ],
+  };
+}
+
+export function runAcpStdioPrompt(
+  provider: ProviderId,
+  commandSpec: CommandSpec,
+  prompt: string,
+  options: ProcessRunnerOptions = {}
+): Promise<ProcessResult> {
+  return new Promise<ProcessResult>((resolve, reject) => {
+    const startedAt = Date.now();
+    const stdout: Buffer[] = [];
+    const stderr: Buffer[] = [];
+    const child = spawn(commandSpec.binary, [...commandSpec.args], spawnOptions(commandSpec));
+    const pending = new Map<number, PendingRequest>();
+    let stdoutBuffer = '';
+    let nextId = 1;
+    let timedOut = false;
+    let protocolFailure: Error | null = null;
+    let sessionId: string | null = null;
+    let closeResolved = false;
+    let timeout: NodeJS.Timeout | undefined;
+    let timeoutKill: NodeJS.Timeout | undefined;
+
+    function cleanupTimers(): void {
+      if (timeout !== undefined) clearTimeout(timeout);
+      if (timeoutKill !== undefined) clearTimeout(timeoutKill);
+    }
+
+    function finalize(exitCode: number | null, signal: string | null): void {
+      if (closeResolved) return;
+      closeResolved = true;
+      cleanupTimers();
+      if (protocolFailure) {
+        const failureMessage = protocolFailure.message;
+        if (!stderr.some((chunk) => chunk.toString('utf8').includes(failureMessage))) {
+          stderr.push(Buffer.from(`${failureMessage}\n`, 'utf8'));
+        }
+      }
+      const effectiveExitCode =
+        protocolFailure && exitCode === 0 && signal === null ? 1 : exitCode;
+      resolve(
+        processResult({
+          stdout,
+          stderr,
+          exitCode: effectiveExitCode,
+          signal,
+          startedAt,
+          timedOut,
+          ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),
+        })
+      );
+    }
+
+    function failClosed(message: string): void {
+      if (protocolFailure) return;
+      protocolFailure = new Error(`${provider} ACP stdio fail-closed: ${message}`);
+      for (const request of pending.values()) {
+        request.reject(protocolFailure);
+      }
+      pending.clear();
+      if (sessionId && child.stdin && !child.stdin.destroyed) {
+        child.stdin.write(
+          `${JSON.stringify({
+            jsonrpc: '2.0',
+            method: 'session/cancel',
+            params: { sessionId },
+          })}\n`
+        );
+      }
+      child.stdin?.end();
+      child.kill('SIGTERM');
+    }
+
+    function handleProtocolMessage(message: Record<string, unknown>): void {
+      const responseId = typeof message.id === 'number' ? message.id : null;
+      if (responseId !== null && (message.result !== undefined || message.error !== undefined)) {
+        const request = pending.get(responseId);
+        if (request) {
+          pending.delete(responseId);
+          request.resolve(message);
+        }
+        return;
+      }
+
+      const method = typeof message.method === 'string' ? message.method : null;
+      if (!method) return;
+      if (method === 'session/update') return;
+      if (method.startsWith('_')) return;
+      if (method === 'session/request_permission') {
+        failClosed('unsupported session/request_permission callback.');
+        return;
+      }
+      if (method.startsWith('fs/')) {
+        failClosed(`unsupported ${method} callback.`);
+        return;
+      }
+      if (method.startsWith('terminal/')) {
+        failClosed(`unsupported ${method} callback.`);
+        return;
+      }
+      if (method.startsWith('session/')) {
+        failClosed(`unsupported ${method} session-control callback.`);
+      }
+    }
+
+    function consumeStdoutLine(line: string): void {
+      try {
+        handleProtocolMessage(parseProtocolLine(line));
+      } catch (error) {
+        failClosed(error instanceof Error ? error.message : 'malformed ACP stdout JSON.');
+      }
+    }
+
+    function flushStdoutRemainder(): void {
+      const line = stdoutBuffer.trim();
+      stdoutBuffer = '';
+      if (line) consumeStdoutLine(line);
+    }
+
+    function flushStdout(data: Buffer): void {
+      stdout.push(data);
+      stdoutBuffer += data.toString('utf8');
+      let newline = stdoutBuffer.indexOf('\n');
+      while (newline !== -1) {
+        const line = stdoutBuffer.slice(0, newline).trim();
+        stdoutBuffer = stdoutBuffer.slice(newline + 1);
+        if (line) consumeStdoutLine(line);
+        newline = stdoutBuffer.indexOf('\n');
+      }
+    }
+
+    function sendRequest(method: string, params: Record<string, unknown>): Promise<JsonRpcResponse> {
+      const id = nextId;
+      nextId += 1;
+      const request: JsonRpcRequest = {
+        jsonrpc: '2.0',
+        id,
+        method,
+        params,
+      };
+      return new Promise<JsonRpcResponse>((requestResolve, requestReject) => {
+        pending.set(id, { resolve: requestResolve, reject: requestReject });
+        child.stdin?.write(`${JSON.stringify(request)}\n`);
+      });
+    }
+
+    async function driveProtocol(): Promise<void> {
+      const initialize = await sendRequest('initialize', {
+        protocolVersion: 1,
+        clientInfo: {
+          name: '@the-open-engine/zeroshot',
+          version: '1',
+        },
+        clientCapabilities: {
+          fs: false,
+          terminal: false,
+          promptCapabilities: {
+            image: false,
+          },
+        },
+      });
+      if (initialize.error !== undefined) {
+        child.stdin?.end();
+        return;
+      }
+
+      const session = await sendRequest('session/new', {
+        cwd: commandSpec.cwd ?? process.cwd(),
+        mcpServers: [],
+      });
+      if (session.error !== undefined) {
+        child.stdin?.end();
+        return;
+      }
+      const sessionResult = isRecord(session.result) ? session.result : {};
+      const nextSessionId = typeof sessionResult.sessionId === 'string' ? sessionResult.sessionId : null;
+      if (!nextSessionId) {
+        failClosed('session/new response omitted sessionId.');
+        return;
+      }
+      sessionId = nextSessionId;
+
+      await sendRequest('session/prompt', createPromptParams(sessionId, prompt));
+      child.stdin?.end();
+    }
+
+    if (options.timeoutMs !== undefined) {
+      timeout = setTimeout(() => {
+        timedOut = true;
+        if (sessionId && child.stdin && !child.stdin.destroyed) {
+          child.stdin.write(
+            `${JSON.stringify({
+              jsonrpc: '2.0',
+              method: 'session/cancel',
+              params: { sessionId },
+            })}\n`
+          );
+        }
+        child.kill('SIGTERM');
+        timeoutKill = setTimeout(() => {
+          if (!closeResolved) child.kill('SIGKILL');
+        }, options.timeoutKillGraceMs ?? DEFAULT_TIMEOUT_KILL_GRACE_MS);
+      }, options.timeoutMs);
+    }
+
+    child.stdout?.on('data', flushStdout);
+    child.stdout?.once('end', flushStdoutRemainder);
+    child.stderr?.on('data', (data: Buffer) => stderr.push(data));
+    child.once('error', (error) => {
+      cleanupTimers();
+      reject(error);
+    });
+    child.once('close', (exitCode, signal) => {
+      finalize(exitCode, signal);
+    });
+
+    driveProtocol().catch((error: unknown) => {
+      failClosed(error instanceof Error ? error.message : 'ACP protocol failed.');
+    });
+  });
+}