@the-open-engine/zeroshot 6.38.1 → 6.39.0

package/lib/stream-json-parser.js

@@ -1,69 +1,68 @@
+"use strict";
 /**
  * Provider-agnostic stream-json parser for `zeroshot logs`.
  *
  * Provider parsing is delegated to the helper-backed runtime provider facade.
  */
-
+// The runtime facade is maintained JavaScript; keep its original emitted require path.
+// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
 const { getProvider, listProviders } = require('../src/providers');
-
 function createProviderParsers() {
-  return listProviders().map((name) => getProvider(name));
+    return listProviders().map((name) => getProvider(name));
 }
-
 function stripTimestampPrefix(line) {
-  if (!line || typeof line !== 'string') return '';
-  let trimmed = line.trim().replace(/\r$/, '');
-  if (!trimmed) return '';
-
-  const tsMatch = trimmed.match(/^\[(\d{13})\](.*)$/);
-  if (tsMatch) trimmed = (tsMatch[2] || '').trimStart();
-
-  if (!trimmed.startsWith('{') && !trimmed.startsWith('[')) {
-    const pipeMatch = trimmed.match(/^[^|]{1,40}\|\s*(.*)$/);
-    if (pipeMatch) {
-      const afterPipe = (pipeMatch[1] || '').trimStart();
-      if (afterPipe.startsWith('{') || afterPipe.startsWith('[')) return afterPipe;
+    if (!line || typeof line !== 'string')
+        return '';
+    let trimmed = line.trim().replace(/\r$/, '');
+    if (!trimmed)
+        return '';
+    const tsMatch = /^\[(\d{13})\](.*)$/.exec(trimmed);
+    if (tsMatch)
+        trimmed = (tsMatch[2] || '').trimStart();
+    if (!trimmed.startsWith('{') && !trimmed.startsWith('[')) {
+        const pipeMatch = /^[^|]{1,40}\|\s*(.*)$/.exec(trimmed);
+        if (pipeMatch) {
+            const afterPipe = (pipeMatch[1] || '').trimStart();
+            if (afterPipe.startsWith('{') || afterPipe.startsWith('['))
+                return afterPipe;
+        }
     }
-  }
-
-  return trimmed;
+    return trimmed;
 }
-
+// The provider protocol intentionally permits one event, an event batch, or no event.
+// eslint-disable-next-line sonarjs/function-return-type
 function parseEvent(line, providerParsers = createProviderParsers()) {
-  const content = stripTimestampPrefix(line);
-  if (!content) return null;
-
-  for (const provider of providerParsers) {
-    const event = provider.parseEvent(content);
-    if (event) return event;
-  }
-
-  return null;
+    const content = stripTimestampPrefix(line);
+    let result = null;
+    if (content) {
+        for (const provider of providerParsers) {
+            const event = provider.parseEvent(content);
+            if (event) {
+                result = event;
+                break;
+            }
+        }
+    }
+    return result;
 }
-
 function collectEvent(events, event) {
-  if (!event) return;
-  if (Array.isArray(event)) {
-    events.push(...event);
-    return;
-  }
-  events.push(event);
+    if (!event)
+        return;
+    if (Array.isArray(event)) {
+        events.push(...event);
+        return;
+    }
+    events.push(event);
 }
-
 function parseChunk(chunk) {
-  const events = [];
-  const lines = String(chunk || '').split('\n');
-  const providerParsers = createProviderParsers();
-
-  for (const line of lines) {
-    if (!line.trim()) continue;
-    collectEvent(events, parseEvent(line, providerParsers));
-  }
-
-  return events;
+    const events = [];
+    const lines = String(chunk || '').split('\n');
+    const providerParsers = createProviderParsers();
+    for (const line of lines) {
+        if (!line.trim())
+            continue;
+        collectEvent(events, parseEvent(line, providerParsers));
+    }
+    return events;
 }
-
-module.exports = {
-  parseEvent,
-  parseChunk,
-};
+module.exports = { parseEvent, parseChunk };

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@the-open-engine/zeroshot",
-  "version": "6.38.1",
+  "version": "6.39.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@the-open-engine/zeroshot",
-      "version": "6.38.1",
+      "version": "6.39.0",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-open-engine/zeroshot",
-  "version": "6.38.1",
+  "version": "6.39.0",
   "description": "Independent executor–verifier orchestration for software changes.",
   "main": "src/orchestrator.js",
   "bin": {
@@ -29,7 +29,7 @@
     ]
   },
   "scripts": {
-    "pretest": "npm run build:agent-cli-provider && npm run build:target",
+    "pretest": "npm run build:agent-cli-provider && npm run build:target && npm run build:legacy-lib && npm run build:legacy-runtime && npm run build:task-lib",
     "test": "node tests/run-tests.js",
     "test:unit": "node tests/run-tests.js",
     "test:e2e": "mocha 'tests/e2e/**/*.test.js' --timeout 120000",
@@ -40,8 +40,11 @@
     "test:coverage:report": "c8 --reporter=html npm run test:unit && echo 'Coverage report generated at coverage/index.html'",
     "postinstall": "node scripts/postinstall.js",
     "start": "node cli/index.js",
-    "typecheck": "tsc --noEmit && npm run typecheck:cluster && npm run typecheck:hosted-target && npm run typecheck:hosted-session && npm run typecheck:target",
+    "typecheck": "tsc --noEmit && npm run typecheck:legacy-lib && npm run typecheck:legacy-runtime && npm run typecheck:task-lib && npm run typecheck:cluster && npm run typecheck:hosted-target && npm run typecheck:hosted-session && npm run typecheck:target",
     "typecheck:agent-cli-provider": "tsc --project tsconfig.agent-cli-provider.json",
+    "typecheck:legacy-lib": "tsc --project tsconfig.legacy-lib.json",
+    "typecheck:legacy-runtime": "tsc --project tsconfig.legacy-runtime.json",
+    "typecheck:task-lib": "tsc --project tsconfig.task-lib.json",
     "typecheck:hosted-target": "tsc --project tsconfig.hosted-target.json",
     "typecheck:hosted-session": "tsc --project tsconfig.hosted-session.json",
     "test:hosted": "npm run build:cluster && node --test tests/private-hosted-cli/*.test.js && npm run test:hosted-target",
@@ -51,10 +54,13 @@
     "typecheck:cluster": "tsc --project tsconfig.cluster.json",
     "lint:agent-cli-provider": "eslint \"src/agent-cli-provider/**/*.ts\" \"tests/agent-cli-provider/**/*.ts\"",
     "build:agent-cli-provider": "tsc --project tsconfig.agent-cli-provider.build.json",
+    "build:legacy-lib": "tsc --project tsconfig.legacy-lib.build.json",
+    "build:legacy-runtime": "tsc --project tsconfig.legacy-runtime.build.json",
+    "build:task-lib": "tsc --project tsconfig.task-lib.build.json",
     "build:target": "tsc --project tsconfig.target.build.json",
     "build:cluster": "npm run protocol:generate && tsc --project tsconfig.cluster.cjs.json && tsc --project tsconfig.cluster.esm.json && tsc --project tsconfig.hosted-target.cjs.json && tsc --project tsconfig.hosted-target.esm.json && tsc --project tsconfig.hosted-session.cjs.json && tsc --project tsconfig.hosted-session.esm.json && node scripts/build-cluster.js",
     "test:agent-cli-provider": "node --test tests/agent-cli-provider/*.test.js",
-    "test:omp": "npm run build:agent-cli-provider && node --test tests/agent-cli-provider/omp-*.test.js && node tests/run-tests.js 'tests/omp-rpc-watcher*.test.js' tests/omp-isolation-capability.test.js tests/omp-docker-auth.test.js tests/omp-docker-fresh-only.test.js",
+    "test:omp": "npm run build:agent-cli-provider && npm run build:task-lib && node --test tests/agent-cli-provider/omp-*.test.js && node tests/run-tests.js 'tests/omp-rpc-watcher*.test.js' tests/omp-isolation-capability.test.js tests/omp-docker-auth.test.js tests/omp-docker-fresh-only.test.js",
     "test:providers:live": "npm run build:agent-cli-provider && node scripts/live-provider-smoke.js",
     "check:agent-cli-provider": "npm run check:agent-cli-provider:ci",
     "check:agent-cli-provider:ci": "npm run typecheck:agent-cli-provider && npm run lint:agent-cli-provider && npm run build:agent-cli-provider && npm run test:agent-cli-provider",
@@ -90,9 +96,9 @@
     "release:preflight": "node scripts/release-preflight.js",
     "release:recover": "node scripts/release-recovery.js",
     "release:assert-published": "node scripts/assert-release-published.js",
-    "prepack": "npm run build:cluster && npm run build:target",
+    "prepack": "npm run build:cluster && npm run build:target && npm run build:legacy-lib && npm run build:legacy-runtime && npm run build:task-lib",
     "prepublishOnly": "npm run lint && npm run typecheck && npm run check:agent-cli-provider:ci",
-    "prepare": "npm run build:agent-cli-provider && npm run build:target && husky"
+    "prepare": "npm run build:agent-cli-provider && npm run build:target && npm run build:legacy-lib && npm run build:legacy-runtime && npm run build:task-lib && husky"
   },
   "c8": {
     "reporter": [

package/scripts/postinstall.js

@@ -1,8 +1,12 @@
 #!/usr/bin/env node
 
+const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
 
+const REPOSITORY_ROOT = path.join(__dirname, '..');
+const LEGACY_LIB_OUTPUT = path.join(REPOSITORY_ROOT, 'lib', 'path-check.js');
+const LEGACY_LIB_PROJECT = path.join(REPOSITORY_ROOT, 'tsconfig.legacy-lib.build.json');
 const LIFECYCLE_SCRIPTS = ['fix-node-pty-permissions.js', 'check-path.js'];
 const SETUP_INVITATION = 'Run zeroshot to finish setup.\n';
 
@@ -16,6 +20,22 @@ function shouldPrintSetupInvitation(env) {
   return globalInstall && !isTruthyEnvironmentFlag(env.CI);
 }
 
+function ensureLegacyLibBuild({
+  outputExists = fs.existsSync,
+  resolveCompiler = () => require.resolve('typescript/bin/tsc'),
+  runCompiler = spawnSync,
+} = {}) {
+  if (outputExists(LEGACY_LIB_OUTPUT)) return 0;
+
+  const result = runCompiler(
+    process.execPath,
+    [resolveCompiler(), '--project', LEGACY_LIB_PROJECT],
+    { stdio: 'inherit' }
+  );
+  if (result.error) throw result.error;
+  return result.status ?? 1;
+}
+
 function runLifecycleScript(scriptName) {
   const result = spawnSync(process.execPath, [path.join(__dirname, scriptName)], {
     stdio: 'inherit',
@@ -27,8 +47,12 @@ function runLifecycleScript(scriptName) {
 function runPostinstall({
   env = process.env,
   stdout = process.stdout,
+  ensureBuild = ensureLegacyLibBuild,
   runScript = runLifecycleScript,
 } = {}) {
+  const buildStatus = ensureBuild();
+  if (buildStatus !== 0) return buildStatus;
+
   for (const scriptName of LIFECYCLE_SCRIPTS) {
     const status = runScript(scriptName);
     if (status !== 0) return status;
@@ -47,8 +71,11 @@ if (require.main === module) {
 }
 
 module.exports = {
+  LEGACY_LIB_OUTPUT,
+  LEGACY_LIB_PROJECT,
   LIFECYCLE_SCRIPTS,
   SETUP_INVITATION,
+  ensureLegacyLibBuild,
   runPostinstall,
   shouldPrintSetupInvitation,
 };

package/scripts/rust-distribution.js

@@ -849,13 +849,7 @@ function run() {
   }
   if (command === 'smoke') {
     const binaryPath = path.resolve(argument('binary'));
-    const result = childProcess.spawnSync(binaryPath, [], { stdio: 'inherit' });
-    if (result.error) throw result.error;
-    if (result.signal || result.status !== 0) {
-      throw new Error(
-        `RUST_BINARY_SMOKE_FAILED: status=${result.status} signal=${result.signal || 'none'}`
-      );
-    }
+    smokeExecutable(binaryPath, 'RUST_BINARY_SMOKE_FAILED');
     process.stdout.write(`Rust release executable exited 0: ${binaryPath}\n`);
     return;
   }
@@ -871,13 +865,7 @@ function run() {
         declaration.executable
       );
       fs.writeFileSync(binaryPath, executable, { mode: 0o755 });
-      const result = childProcess.spawnSync(binaryPath, [], { stdio: 'inherit' });
-      if (result.error) throw result.error;
-      if (result.signal || result.status !== 0) {
-        throw new Error(
-          `RUST_ARCHIVE_SMOKE_FAILED: status=${result.status} signal=${result.signal || 'none'}`
-        );
-      }
+      smokeExecutable(binaryPath, 'RUST_ARCHIVE_SMOKE_FAILED');
     } finally {
       fs.rmSync(directory, { recursive: true, force: true });
     }
@@ -903,6 +891,26 @@ function run() {
   );
 }
 
+const SMOKE_GREETING = Buffer.from('zeroshot release smoke\n');
+
+function smokeExecutable(binaryPath, failureCode) {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'zeroshot-rust-executable-smoke-'));
+  try {
+    fs.writeFileSync(path.join(directory, 'greeting.txt'), SMOKE_GREETING);
+    const result = childProcess.spawnSync(binaryPath, ['--native-validate-greeting'], {
+      cwd: directory,
+      input: SMOKE_GREETING,
+      stdio: ['pipe', 'inherit', 'inherit'],
+    });
+    if (result.error) throw result.error;
+    if (result.signal || result.status !== 0) {
+      throw new Error(`${failureCode}: status=${result.status} signal=${result.signal || 'none'}`);
+    }
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+}
+
 if (require.main === module) {
   try {
     run();
@@ -926,6 +934,7 @@ module.exports = {
   packageTarget,
   parseChecksumManifest,
   sha256,
+  smokeExecutable,
   targetForHost,
   stageVersion,
   targets,

package/src/agent/agent-command-proofs-context.js

@@ -1,55 +1,45 @@
-const { normalizeCommandProofs } = require('../command-proofs');
-
+"use strict";
+function isCommandProofsModule(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        'normalizeCommandProofs' in value &&
+        typeof value.normalizeCommandProofs === 'function');
+}
+const commandProofsModule = require('../command-proofs');
+if (!isCommandProofsModule(commandProofsModule)) {
+    throw new TypeError('command-proofs must export normalizeCommandProofs');
+}
+const normalizeCommandProofs = commandProofsModule.normalizeCommandProofs;
 function appendProofDetails(lines, proof, index) {
-  const scope = proof.scope ? `, scope: ${proof.scope}` : '';
-  lines.push(`${index + 1}. id: ${proof.id}, profile: ${proof.profile}${scope}`);
-  if (proof.description) {
-    lines.push(`   description: ${proof.description}`);
-  }
-  lines.push(`   command: ${proof.command}`);
-  lines.push(`   helper: zeroshot cmdproof check ${proof.id}`);
+    const scope = proof.scope ? `, scope: ${proof.scope}` : '';
+    lines.push(`${index + 1}. id: ${proof.id}, profile: ${proof.profile}${scope}`);
+    if (proof.description) {
+        lines.push(`   description: ${proof.description}`);
+    }
+    lines.push(`   command: ${proof.command}`);
+    lines.push(`   helper: zeroshot cmdproof check ${proof.id}`);
 }
-
 function buildWorkerInstructions(lines) {
-  lines.push(
-    '',
-    'For these exact commands:',
-    '- Run `zeroshot cmdproof check <id>` instead of the raw command.',
-    '- Treat the helper exit code as the command exit code.',
-    '- If you need to mention evidence, include the helper output and the configured command id.',
-    ''
-  );
+    lines.push('', 'For these exact commands:', '- Run `zeroshot cmdproof check <id>` instead of the raw command.', '- Treat the helper exit code as the command exit code.', '- If you need to mention evidence, include the helper output and the configured command id.', '');
 }
-
 function buildValidatorInstructions(lines) {
-  lines.push(
-    '',
-    'For proof-backed validation:',
-    '- Run `zeroshot cmdproof check <id>` before considering the raw command.',
-    '- Use the helper output as quality-gate evidence.',
-    '- Only run the raw command directly if the helper itself is unavailable.',
-    ''
-  );
+    lines.push('', 'For proof-backed validation:', '- Run `zeroshot cmdproof check <id>` before considering the raw command.', '- Use the helper output as quality-gate evidence.', '- Only run the raw command directly if the helper itself is unavailable.', '');
 }
-
 function buildCommandProofsSection(config) {
-  const proofs = normalizeCommandProofs(config.commandProofs);
-  if (proofs.length === 0) {
-    return '';
-  }
-
-  const lines = ['## Reusable Command Proofs', '', 'Configured proof-backed commands:'];
-  proofs.forEach((proof, index) => appendProofDetails(lines, proof, index));
-
-  if (config.role === 'validator') {
-    buildValidatorInstructions(lines);
-  } else {
-    buildWorkerInstructions(lines);
-  }
-
-  return lines.join('\n');
+    const proofs = normalizeCommandProofs(config.commandProofs);
+    if (proofs.length === 0) {
+        return '';
+    }
+    const lines = ['## Reusable Command Proofs', '', 'Configured proof-backed commands:'];
+    proofs.forEach((proof, index) => appendProofDetails(lines, proof, index));
+    if (config.role === 'validator') {
+        buildValidatorInstructions(lines);
+    }
+    else {
+        buildWorkerInstructions(lines);
+    }
+    return lines.join('\n');
 }
-
 module.exports = {
-  buildCommandProofsSection,
+    buildCommandProofsSection,
 };

package/src/agent/agent-command-proofs-context.ts

@@ -0,0 +1,87 @@
+type StringList = string[];
+
+interface CommandProof {
+  id: string;
+  profile: string;
+  command: string;
+  scope?: string;
+  description?: string;
+}
+
+interface AgentCommandProofConfig {
+  role?: string;
+  commandProofs?: unknown;
+}
+
+interface CommandProofsModule {
+  normalizeCommandProofs(value: unknown): CommandProof[];
+}
+
+function isCommandProofsModule(value: unknown): value is CommandProofsModule {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    'normalizeCommandProofs' in value &&
+    typeof value.normalizeCommandProofs === 'function'
+  );
+}
+
+const commandProofsModule: unknown = require('../command-proofs');
+if (!isCommandProofsModule(commandProofsModule)) {
+  throw new TypeError('command-proofs must export normalizeCommandProofs');
+}
+const normalizeCommandProofs = commandProofsModule.normalizeCommandProofs;
+
+function appendProofDetails(lines: StringList, proof: CommandProof, index: number): void {
+  const scope = proof.scope ? `, scope: ${proof.scope}` : '';
+  lines.push(`${index + 1}. id: ${proof.id}, profile: ${proof.profile}${scope}`);
+  if (proof.description) {
+    lines.push(`   description: ${proof.description}`);
+  }
+  lines.push(`   command: ${proof.command}`);
+  lines.push(`   helper: zeroshot cmdproof check ${proof.id}`);
+}
+
+function buildWorkerInstructions(lines: StringList): void {
+  lines.push(
+    '',
+    'For these exact commands:',
+    '- Run `zeroshot cmdproof check <id>` instead of the raw command.',
+    '- Treat the helper exit code as the command exit code.',
+    '- If you need to mention evidence, include the helper output and the configured command id.',
+    ''
+  );
+}
+
+function buildValidatorInstructions(lines: StringList): void {
+  lines.push(
+    '',
+    'For proof-backed validation:',
+    '- Run `zeroshot cmdproof check <id>` before considering the raw command.',
+    '- Use the helper output as quality-gate evidence.',
+    '- Only run the raw command directly if the helper itself is unavailable.',
+    ''
+  );
+}
+
+function buildCommandProofsSection(config: AgentCommandProofConfig): string {
+  const proofs = normalizeCommandProofs(config.commandProofs);
+  if (proofs.length === 0) {
+    return '';
+  }
+
+  const lines = ['## Reusable Command Proofs', '', 'Configured proof-backed commands:'];
+  proofs.forEach((proof, index) => appendProofDetails(lines, proof, index));
+
+  if (config.role === 'validator') {
+    buildValidatorInstructions(lines);
+  } else {
+    buildWorkerInstructions(lines);
+  }
+
+  return lines.join('\n');
+}
+
+export = {
+  buildCommandProofsSection,
+};

package/src/agent/agent-config-settings.js

@@ -0,0 +1,19 @@
+"use strict";
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === 'string');
+}
+function isSettingsFacade(value) {
+    return (isRecord(value) &&
+        typeof value.loadSettings === 'function' &&
+        typeof value.validateModelAgainstMax === 'function' &&
+        isStringArray(value.VALID_MODELS));
+}
+const rawSettings = require('../../lib/settings');
+if (!isSettingsFacade(rawSettings)) {
+    throw new TypeError('settings module must expose model validation');
+}
+const verifiedSettings = rawSettings;
+module.exports = verifiedSettings;

package/src/agent/agent-config-settings.ts

@@ -0,0 +1,41 @@
+interface SettingsRecord extends Record<string, unknown> {
+  maxModel: string;
+  minModel?: string | null;
+  strictSchema?: boolean;
+}
+
+interface SettingsFacade {
+  loadSettings(): SettingsRecord;
+  validateModelAgainstMax(
+    requestedModel: string | null | undefined,
+    maxModel: string,
+    minModel?: string | null
+  ): string;
+  VALID_MODELS: readonly string[];
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function isStringArray(value: unknown): value is readonly string[] {
+  return Array.isArray(value) && value.every((entry) => typeof entry === 'string');
+}
+
+function isSettingsFacade(value: unknown): value is SettingsFacade {
+  return (
+    isRecord(value) &&
+    typeof value.loadSettings === 'function' &&
+    typeof value.validateModelAgainstMax === 'function' &&
+    isStringArray(value.VALID_MODELS)
+  );
+}
+
+const rawSettings: unknown = require('../../lib/settings');
+if (!isSettingsFacade(rawSettings)) {
+  throw new TypeError('settings module must expose model validation');
+}
+
+const verifiedSettings: SettingsFacade = rawSettings;
+
+export = verifiedSettings;