@the-open-engine/zeroshot 6.38.0 → 6.39.0

package/src/config-router.ts

@@ -0,0 +1,131 @@
+/**
+ * Config Router - Maps 2D classification to parameterized templates
+ *
+ * Single source of truth for: Complexity × TaskType → { base, params }
+ * Used by both logic-engine.js (trigger evaluation) and agent-wrapper.js (transform scripts)
+ */
+
+interface AgentConfigModule {
+  DEFAULT_MAX_ITERATIONS: number;
+}
+
+function isAgentConfigModule(value: unknown): value is AgentConfigModule {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    'DEFAULT_MAX_ITERATIONS' in value &&
+    typeof value.DEFAULT_MAX_ITERATIONS === 'number'
+  );
+}
+
+const agentConfig: unknown = require('./agent/agent-config');
+if (!isAgentConfigModule(agentConfig)) {
+  throw new TypeError('agent-config must export a numeric DEFAULT_MAX_ITERATIONS');
+}
+const { DEFAULT_MAX_ITERATIONS } = agentConfig;
+
+type BaseConfigName = 'debug-workflow' | 'full-workflow' | 'single-worker' | 'worker-validator';
+type ModelLevel = 'level1' | 'level2' | 'level3';
+
+interface ConfigOptions {
+  autoPr?: boolean;
+}
+
+interface ConfigParams {
+  task_type: string;
+  complexity: string;
+  max_tokens: number;
+  max_iterations: number;
+  worker_level?: ModelLevel;
+  validator_level?: ModelLevel;
+  investigator_level?: ModelLevel;
+  fixer_level?: ModelLevel;
+  tester_level?: ModelLevel;
+  planner_level?: ModelLevel;
+  validator_count?: number;
+}
+
+interface RoutedConfig {
+  base: BaseConfigName;
+  params: ConfigParams;
+}
+
+/**
+ * Get cluster config based on complexity and task type
+ */
+function getConfig(
+  complexity: string,
+  taskType: string,
+  options: ConfigOptions = {}
+): RoutedConfig {
+  const isPrMode = options.autoPr === true || process.env.ZEROSHOT_PR === '1';
+
+  const getBase = (): BaseConfigName => {
+    if (taskType === 'DEBUG' && complexity !== 'TRIVIAL') {
+      return 'debug-workflow';
+    }
+    if (complexity === 'TRIVIAL' && isPrMode && taskType !== 'INQUIRY') {
+      return 'worker-validator';
+    }
+    if (complexity === 'TRIVIAL') {
+      return 'single-worker';
+    }
+    if (complexity === 'SIMPLE') {
+      return 'worker-validator';
+    }
+    return 'full-workflow';
+  };
+
+  const getLevel = (role: string): ModelLevel => {
+    if (complexity === 'CRITICAL' && role === 'planner') return 'level3';
+    if (complexity === 'TRIVIAL') return 'level1';
+    return 'level2';
+  };
+
+  const getValidatorCount = (): number => {
+    if (complexity === 'TRIVIAL') return 0;
+    if (complexity === 'SIMPLE') return 1;
+    if (complexity === 'STANDARD') return 2;
+    // CRITICAL uses two-stage validation pipeline (validators loaded dynamically via meta-coordinator)
+    // Setting validator_count=0 signals that inline validators should be skipped
+    if (complexity === 'CRITICAL') return 0;
+    return 1;
+  };
+
+  const getMaxTokens = (): number => {
+    if (complexity === 'TRIVIAL') return 50000;
+    if (complexity === 'SIMPLE') return 100000;
+    if (complexity === 'STANDARD') return 100000;
+    if (complexity === 'CRITICAL') return 150000;
+    return 100000;
+  };
+
+  const base = getBase();
+
+  const params: ConfigParams = {
+    task_type: taskType,
+    complexity,
+    max_tokens: getMaxTokens(),
+    max_iterations: DEFAULT_MAX_ITERATIONS,
+  };
+
+  if (base === 'single-worker') {
+    params.worker_level = getLevel('worker');
+  } else if (base === 'worker-validator') {
+    params.worker_level = getLevel('worker');
+    params.validator_level = getLevel('validator');
+  } else if (base === 'debug-workflow') {
+    params.investigator_level = getLevel('planner');
+    params.fixer_level = getLevel('worker');
+    params.tester_level = getLevel('validator');
+  } else if (base === 'full-workflow') {
+    params.planner_level = getLevel('planner');
+    params.worker_level = getLevel('worker');
+    params.validator_level = getLevel('validator');
+    params.validator_count = getValidatorCount();
+  }
+
+  return { base, params };
+}
+
+export = { getConfig };

package/src/copy-worker.js

@@ -1,43 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
 /**
  * Copy Worker - Worker thread for parallel file copying
  *
  * Handles copying a batch of files from source to destination.
  * Used by IsolationManager._copyDirExcluding() for parallel copying.
  */
-
-const { parentPort, workerData } = require('worker_threads');
-const fs = require('fs');
-const path = require('path');
-
-const { files, sourceBase, destBase } = workerData;
-
+const fs = require("fs");
+const path = require("path");
+const worker_threads_1 = require("worker_threads");
+function isCopyWorkerData(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        'files' in value &&
+        Array.isArray(value.files) &&
+        value.files.every((entry) => typeof entry === 'string') &&
+        'sourceBase' in value &&
+        typeof value.sourceBase === 'string' &&
+        'destBase' in value &&
+        typeof value.destBase === 'string');
+}
+function errorCode(error) {
+    if (typeof error === 'object' && error !== null && 'code' in error) {
+        return typeof error.code === 'string' ? error.code : null;
+    }
+    return null;
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+const rawWorkerData = worker_threads_1.workerData;
+if (!isCopyWorkerData(rawWorkerData)) {
+    throw new TypeError('copy worker requires files, sourceBase, and destBase');
+}
+const { files, sourceBase, destBase } = rawWorkerData;
 let copied = 0;
 let skipped = 0;
 const errors = [];
-
 for (const relativePath of files) {
-  const srcPath = path.join(sourceBase, relativePath);
-  const destPath = path.join(destBase, relativePath);
-
-  try {
-    // Ensure parent directory exists
-    const destDir = path.dirname(destPath);
-    if (!fs.existsSync(destDir)) {
-      fs.mkdirSync(destDir, { recursive: true });
+    const srcPath = path.join(sourceBase, relativePath);
+    const destPath = path.join(destBase, relativePath);
+    try {
+        // Ensure parent directory exists
+        const destDir = path.dirname(destPath);
+        if (!fs.existsSync(destDir)) {
+            fs.mkdirSync(destDir, { recursive: true });
+        }
+        // Copy the file
+        fs.copyFileSync(srcPath, destPath);
+        copied++;
     }
-
-    // Copy the file
-    fs.copyFileSync(srcPath, destPath);
-    copied++;
-  } catch (err) {
-    // Skip files we can't copy (permission denied, broken symlinks, etc.)
-    if (err.code === 'EACCES' || err.code === 'EPERM' || err.code === 'ENOENT') {
-      skipped++;
-      continue;
+    catch (error) {
+        // Skip files we can't copy (permission denied, broken symlinks, etc.)
+        const code = errorCode(error);
+        if (code === 'EACCES' || code === 'EPERM' || code === 'ENOENT') {
+            skipped++;
+            continue;
+        }
+        errors.push({ file: relativePath, error: errorMessage(error) });
     }
-    errors.push({ file: relativePath, error: err.message });
-  }
 }
-
 // Report results back to main thread
-parentPort.postMessage({ copied, skipped, errors });
+if (!worker_threads_1.parentPort) {
+    throw new Error('copy worker requires a parent port');
+}
+worker_threads_1.parentPort.postMessage({ copied, skipped, errors });

package/src/copy-worker.ts

@@ -0,0 +1,75 @@
+/**
+ * Copy Worker - Worker thread for parallel file copying
+ *
+ * Handles copying a batch of files from source to destination.
+ * Used by IsolationManager._copyDirExcluding() for parallel copying.
+ */
+import fs = require('fs');
+import path = require('path');
+import { parentPort, workerData } from 'worker_threads';
+interface CopyWorkerData {
+  files: string[];
+  sourceBase: string;
+  destBase: string;
+}
+interface CopyError {
+  file: string;
+  error: string;
+}
+function isCopyWorkerData(value: unknown): value is CopyWorkerData {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    'files' in value &&
+    Array.isArray(value.files) &&
+    value.files.every((entry: unknown) => typeof entry === 'string') &&
+    'sourceBase' in value &&
+    typeof value.sourceBase === 'string' &&
+    'destBase' in value &&
+    typeof value.destBase === 'string'
+  );
+}
+function errorCode(error: unknown): string | null {
+  if (typeof error === 'object' && error !== null && 'code' in error) {
+    return typeof error.code === 'string' ? error.code : null;
+  }
+  return null;
+}
+function errorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+const rawWorkerData: unknown = workerData;
+if (!isCopyWorkerData(rawWorkerData)) {
+  throw new TypeError('copy worker requires files, sourceBase, and destBase');
+}
+const { files, sourceBase, destBase } = rawWorkerData;
+let copied = 0;
+let skipped = 0;
+const errors: CopyError[] = [];
+for (const relativePath of files) {
+  const srcPath = path.join(sourceBase, relativePath);
+  const destPath = path.join(destBase, relativePath);
+  try {
+    // Ensure parent directory exists
+    const destDir = path.dirname(destPath);
+    if (!fs.existsSync(destDir)) {
+      fs.mkdirSync(destDir, { recursive: true });
+    }
+    // Copy the file
+    fs.copyFileSync(srcPath, destPath);
+    copied++;
+  } catch (error: unknown) {
+    // Skip files we can't copy (permission denied, broken symlinks, etc.)
+    const code = errorCode(error);
+    if (code === 'EACCES' || code === 'EPERM' || code === 'ENOENT') {
+      skipped++;
+      continue;
+    }
+    errors.push({ file: relativePath, error: errorMessage(error) });
+  }
+}
+// Report results back to main thread
+if (!parentPort) {
+  throw new Error('copy worker requires a parent port');
+}
+parentPort.postMessage({ copied, skipped, errors });

package/src/darwin-keychain-boundary.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Darwin worker Keychain boundary (issue #704).
  *
@@ -15,46 +16,41 @@
  * Docker isolation never reaches this code path, and non-darwin platforms are
  * left untouched. Set ZEROSHOT_ALLOW_INTERACTIVE_KEYCHAIN=1 to opt out.
  */
-
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { randomUUID } = require('node:crypto');
-
+const node_crypto_1 = require("node:crypto");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
 const SHIM_DIR_RELATIVE_PATH = path.join('.zeroshot', 'keychain-shim');
 const REAL_SECURITY_PATH = '/usr/bin/security';
 const OPT_OUT_ENV_VAR = 'ZEROSHOT_ALLOW_INTERACTIVE_KEYCHAIN';
-
 function shellQuote(value) {
-  return `'${String(value).replace(/'/g, `'\\''`)}'`;
+    return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
 }
-
 function buildSecurityShimScript(realSecurityPath) {
-  return `#!/bin/sh
+    return `#!/bin/sh
 # Managed by Zeroshot (src/darwin-keychain-boundary.js). Do not edit.
 #
 # Non-interactive Zeroshot workers must not open the logged-in user's GUI
 # Keychain session (SecurityAgent). Interactive \`security\` invocations fail
 # closed here; every other subcommand is passed through to the real binary so
 # provider authentication keeps working.
-
 REAL_SECURITY=${shellQuote(realSecurityPath)}
-
 if [ "\${${OPT_OUT_ENV_VAR}:-0}" = "1" ]; then
   exec "$REAL_SECURITY" "$@"
 fi
-
 fail_closed() {
   echo "zeroshot: blocked interactive 'security' invocation from a non-interactive worker (argv: $*)." >&2
   echo "zeroshot: this cluster has no interactive Keychain session, so SecurityAgent prompts are disabled." >&2
-  echo "zeroshot: run the cluster with Docker isolation or configure explicit credentials for the tool that attempted Keychain access." >&2
+  echo "zeroshot: run the cluster with Docker isolation or configure explicit credentials for the tool that "\
+"attempted Keychain access." >&2
   echo "zeroshot: set ${OPT_OUT_ENV_VAR}=1 to restore interactive Keychain access." >&2
   exit 1
 }
-
 # \`security\` without arguments enters interactive mode.
 [ "$#" -eq 0 ] && fail_closed
-
 # Global options precede the subcommand. -i (interactive) and -p (prompt,
 # implies -i) must not reach the real binary; option letters may be bundled
 # (e.g. -qi). Scanning stops at the first non-option token (the subcommand).
@@ -65,110 +61,83 @@ for arg in "$@"; do
     *) break ;;
   esac
 done
-
 exec "$REAL_SECURITY" "$@"
 `;
 }
-
-/**
- * Create (or refresh) the managed shim directory containing the `security`
- * wrapper. Idempotent: the script is only rewritten when its content changes.
- *
- * @param {object} [options]
- * @param {string} [options.shimBaseDir] - Shim directory (tests only); defaults to ~/.zeroshot/keychain-shim.
- * @param {string} [options.realSecurityPath] - Real binary to exec (tests only); defaults to /usr/bin/security.
- * @returns {string} Absolute path of the shim directory.
- */
+/** Create or refresh the managed directory containing the `security` shim. */
 function ensureDarwinKeychainShimDir(options = {}) {
-  const shimDir = options.shimBaseDir || path.join(os.homedir(), SHIM_DIR_RELATIVE_PATH);
-  const script = buildSecurityShimScript(options.realSecurityPath || REAL_SECURITY_PATH);
-  const shimPath = path.join(shimDir, 'security');
-
-  fs.mkdirSync(shimDir, { recursive: true });
-
-  let existing = null;
-  try {
-    existing = fs.readFileSync(shimPath, 'utf8');
-  } catch {
-    // Missing or unreadable: (re)write below.
-  }
-  if (existing !== script) {
-    const tempPath = path.join(shimDir, `.security.${process.pid}.${randomUUID()}.tmp`);
+    const shimDir = options.shimBaseDir || path.join(os.homedir(), SHIM_DIR_RELATIVE_PATH);
+    const script = buildSecurityShimScript(options.realSecurityPath || REAL_SECURITY_PATH);
+    const shimPath = path.join(shimDir, 'security');
+    fs.mkdirSync(shimDir, { recursive: true });
+    let existing = null;
     try {
-      fs.writeFileSync(tempPath, script, { mode: 0o755, flag: 'wx' });
-      // The creation mode is subject to umask. Set the final mode before the
-      // rename so the live path is never observable as non-executable.
-      fs.chmodSync(tempPath, 0o755);
-      fs.renameSync(tempPath, shimPath);
-    } catch (error) {
-      try {
-        // Remove any unpublished partial file without masking the publication
-        // failure that caused this cleanup path.
-        fs.rmSync(tempPath, { force: true });
-      } catch (cleanupError) {
-        error.message += ` Cleanup also failed: ${cleanupError.message}.`;
-      }
-      throw error;
+        existing = fs.readFileSync(shimPath, 'utf8');
+    }
+    catch {
+        // Missing or unreadable: (re)write below.
     }
-  } else {
-    // An existing matching shim may have drifted permissions.
-    fs.chmodSync(shimPath, 0o755);
-  }
-
-  return shimDir;
+    if (existing !== script) {
+        const tempPath = path.join(shimDir, `.security.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`);
+        try {
+            fs.writeFileSync(tempPath, script, { mode: 0o755, flag: 'wx' });
+            // The creation mode is subject to umask. Set the final mode before the
+            // rename so the live path is never observable as non-executable.
+            fs.chmodSync(tempPath, 0o755);
+            fs.renameSync(tempPath, shimPath);
+        }
+        catch (error) {
+            try {
+                // Remove any unpublished partial file without masking the publication
+                // failure that caused this cleanup path.
+                fs.rmSync(tempPath, { force: true });
+            }
+            catch (cleanupError) {
+                if (error instanceof Error) {
+                    error.message += ` Cleanup also failed: ${errorMessage(cleanupError)}.`;
+                }
+            }
+            throw error;
+        }
+    }
+    else {
+        // An existing matching shim may have drifted permissions.
+        fs.chmodSync(shimPath, 0o755);
+    }
+    return shimDir;
 }
-
-/**
- * Prepend the Keychain boundary shim to a worker spawn env's PATH.
- *
- * No-op off darwin and when the operator opted out via
- * ZEROSHOT_ALLOW_INTERACTIVE_KEYCHAIN=1. Fails closed (throws) when the shim
- * cannot be installed: spawning the worker anyway would silently re-expose the
- * interactive Keychain session.
- *
- * @param {object} env - Spawn env to mutate (also returned).
- * @param {object} [options]
- * @param {string} [options.platform] - Platform override (tests only).
- * @param {string} [options.shimBaseDir] - See ensureDarwinKeychainShimDir.
- * @param {string} [options.realSecurityPath] - See ensureDarwinKeychainShimDir.
- * @returns {object} The same env object.
- */
+/** Prepend the Keychain boundary shim to a worker spawn environment's PATH. */
 function applyDarwinKeychainBoundaryToEnv(env, options = {}) {
-  const platform = options.platform || process.platform;
-  if (platform !== 'darwin') {
-    return env;
-  }
-  if (env[OPT_OUT_ENV_VAR] === '1' || process.env[OPT_OUT_ENV_VAR] === '1') {
+    const platform = options.platform || process.platform;
+    if (platform !== 'darwin') {
+        return env;
+    }
+    if (env[OPT_OUT_ENV_VAR] === '1' || process.env[OPT_OUT_ENV_VAR] === '1') {
+        return env;
+    }
+    let shimDir;
+    try {
+        shimDir = ensureDarwinKeychainShimDir(options);
+    }
+    catch (error) {
+        throw new Error(`Failed to install the darwin Keychain boundary shim: ${errorMessage(error)}. ` +
+            `Non-interactive workers must not reach the interactive Keychain session; ` +
+            `use Docker isolation or set ${OPT_OUT_ENV_VAR}=1 to opt out.`);
+    }
+    // Darwin environment keys are case-sensitive: descendants consult PATH,
+    // never a differently-cased key such as Path. Preserve empty components
+    // because POSIX interprets them as the current directory. An absent PATH
+    // retains Node/libuv's default Unix search path after the shim, while an
+    // explicitly empty PATH retains its empty component (`<shim>:`).
+    const existingEntries = env.PATH === undefined
+        ? ['/usr/bin', '/bin']
+        : String(env.PATH)
+            .split(path.delimiter)
+            .filter((entry) => entry !== shimDir);
+    env.PATH = [shimDir, ...existingEntries].join(path.delimiter);
     return env;
-  }
-
-  let shimDir;
-  try {
-    shimDir = ensureDarwinKeychainShimDir(options);
-  } catch (error) {
-    throw new Error(
-      `Failed to install the darwin Keychain boundary shim: ${error.message}. ` +
-        `Non-interactive workers must not reach the interactive Keychain session; ` +
-        `use Docker isolation or set ${OPT_OUT_ENV_VAR}=1 to opt out.`
-    );
-  }
-
-  // Darwin environment keys are case-sensitive: descendants consult PATH,
-  // never a differently-cased key such as Path. Preserve empty components
-  // because POSIX interprets them as the current directory. An absent PATH
-  // retains Node/libuv's default Unix search path after the shim, while an
-  // explicitly empty PATH retains its empty component (`<shim>:`).
-  const existingEntries =
-    env.PATH === undefined
-      ? ['/usr/bin', '/bin']
-      : String(env.PATH)
-          .split(path.delimiter)
-          .filter((entry) => entry !== shimDir);
-  env.PATH = [shimDir, ...existingEntries].join(path.delimiter);
-  return env;
 }
-
 module.exports = {
-  applyDarwinKeychainBoundaryToEnv,
-  ensureDarwinKeychainShimDir,
+    applyDarwinKeychainBoundaryToEnv,
+    ensureDarwinKeychainShimDir,
 };