@the-open-engine/zeroshot 6.38.1 → 6.39.0

package/src/legacy-lib/docker-config.ts

@@ -0,0 +1,282 @@
+interface MountPreset {
+  host: string;
+  container: string;
+  readonly: boolean;
+  hostEnv?: string;
+}
+
+interface ProviderDockerConfig {
+  envPassthrough: readonly string[];
+  mount?: MountPreset;
+}
+
+interface ProviderMetadata {
+  docker: ProviderDockerConfig;
+  id: string;
+}
+
+interface ProviderNamesFacade {
+  listProviderMetadata(): readonly ProviderMetadata[];
+}
+
+interface CredentialPathFacade {
+  expandProviderCredentialPath(pathValue: string): string;
+}
+
+interface ProviderEnvAuthResult {
+  ok: boolean;
+  satisfiedOneOf: boolean;
+  malformed: string[];
+  message: string;
+}
+
+interface DockerEnvAuthFacade {
+  isUsableEnvValue(value: unknown): value is string;
+  isUsableHttpUrl(value: unknown): boolean;
+  validateEnvPassthrough(value: unknown): string | null;
+  validateProviderEnvAuth(
+    providerId: string,
+    forwardedEnv: Readonly<Record<string, string | undefined>> | null | undefined
+  ): ProviderEnvAuthResult;
+}
+
+interface CustomMount {
+  host?: string;
+  container?: string;
+  readonly?: boolean;
+}
+
+interface ResolvedMount {
+  host: string;
+  container: string;
+  readonly: boolean;
+}
+
+interface ResolveMountOptions {
+  containerHome?: string;
+}
+
+interface ExpandedEnv {
+  name: string;
+  value: string | null;
+  forced: boolean;
+}
+
+// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+const providerNames: ProviderNamesFacade = require('./provider-names');
+// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+const credentialPaths: CredentialPathFacade = require('./provider-credential-path');
+// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+const dockerEnvAuth: DockerEnvAuthFacade = require('./docker-env-auth');
+
+const { listProviderMetadata } = providerNames;
+const { expandProviderCredentialPath } = credentialPaths;
+const {
+  isUsableEnvValue,
+  isUsableHttpUrl,
+  validateEnvPassthrough,
+  validateProviderEnvAuth,
+} = dockerEnvAuth;
+
+const BASE_MOUNT_PRESETS: Readonly<Record<string, MountPreset>> = {
+  gh: { host: '~/.config/gh', container: '$HOME/.config/gh', readonly: false },
+  git: { host: '~/.gitconfig', container: '$HOME/.gitconfig', readonly: true },
+  ssh: { host: '~/.ssh', container: '$HOME/.ssh', readonly: true },
+  aws: { host: '~/.aws', container: '$HOME/.aws', readonly: true },
+  azure: { host: '~/.azure', container: '$HOME/.azure', readonly: true },
+  kube: { host: '~/.kube', container: '$HOME/.kube', readonly: true },
+  terraform: { host: '~/.terraform.d', container: '$HOME/.terraform.d', readonly: false },
+  gcloud: { host: '~/.config/gcloud', container: '$HOME/.config/gcloud', readonly: true },
+};
+
+const BASE_ENV_PRESETS: Readonly<Record<string, readonly string[]>> = {
+  aws: ['AWS_REGION', 'AWS_DEFAULT_REGION', 'AWS_PROFILE', 'AWS_PAGER='],
+  azure: ['AZURE_SUBSCRIPTION_ID', 'AZURE_TENANT_ID', 'AZURE_CLIENT_ID'],
+  gcloud: ['CLOUDSDK_CORE_PROJECT', 'GOOGLE_CLOUD_PROJECT'],
+  kube: ['KUBECONFIG'],
+  terraform: ['TF_VAR_*'],
+};
+
+function listProviderDockerPresetEntries(): Array<readonly [string, ProviderDockerConfig]> {
+  return listProviderMetadata().map((metadata) => [metadata.id, metadata.docker]);
+}
+
+function listProviderMountEntries(): Array<readonly [string, MountPreset]> {
+  const entries: Array<readonly [string, MountPreset]> = [];
+  for (const [providerId, docker] of listProviderDockerPresetEntries()) {
+    if (docker.mount) {
+      entries.push([providerId, docker.mount]);
+    }
+  }
+  return entries;
+}
+
+const MOUNT_PRESETS: Readonly<Record<string, MountPreset>> = Object.freeze({
+  ...BASE_MOUNT_PRESETS,
+  ...Object.fromEntries(listProviderMountEntries()),
+});
+
+const ENV_PRESETS: Readonly<Record<string, readonly string[]>> = Object.freeze({
+  ...BASE_ENV_PRESETS,
+  ...Object.fromEntries(
+    listProviderDockerPresetEntries().map(([providerId, docker]) => [
+      providerId,
+      [...docker.envPassthrough],
+    ])
+  ),
+});
+
+const PROVIDER_ENV_ONLY_PRESETS: ReadonlySet<string> = Object.freeze(
+  new Set(
+    listProviderDockerPresetEntries()
+      .filter(([, docker]) => !docker.mount && docker.envPassthrough.length > 0)
+      .map(([providerId]) => providerId)
+  )
+);
+
+function isCustomMount(value: unknown): value is CustomMount {
+  return typeof value === 'object' && value !== null;
+}
+
+function resolveMountItem(item: unknown, containerHome: string): ResolvedMount[] {
+  if (typeof item === 'string') {
+    const preset = MOUNT_PRESETS[item];
+    if (!preset) {
+      if (PROVIDER_ENV_ONLY_PRESETS.has(item)) {
+        return [];
+      }
+      throw new Error(
+        `Unknown mount preset: "${item}". Valid presets: ${Object.keys(MOUNT_PRESETS).join(', ')}. ` +
+          `Env-only presets (no mount): ${[...PROVIDER_ENV_ONLY_PRESETS].join(', ')}`
+      );
+    }
+    const overriddenHost =
+      typeof preset.hostEnv === 'string' && process.env[preset.hostEnv]?.trim()
+        ? expandProviderCredentialPath(`$${preset.hostEnv}`)
+        : preset.host;
+    return [
+      {
+        host: overriddenHost,
+        container: preset.container.replace(/\$HOME/g, containerHome),
+        readonly: preset.readonly,
+      },
+    ];
+  }
+
+  if (isCustomMount(item)) {
+    if (!item.host || !item.container) {
+      throw new Error('Custom mount must have "host" and "container" properties');
+    }
+    return [
+      {
+        host: item.host,
+        container: item.container.replace(/\$HOME/g, containerHome),
+        readonly: item.readonly !== false,
+      },
+    ];
+  }
+
+  throw new Error(
+    `Invalid mount config: ${JSON.stringify(item)}. Use preset name or {host, container, readonly?}`
+  );
+}
+
+function resolveMounts(config: unknown, options: ResolveMountOptions = {}): ResolvedMount[] {
+  if (!Array.isArray(config)) {
+    throw new Error('dockerMounts must be an array');
+  }
+
+  const containerHome = options.containerHome || '/root';
+  return config.flatMap((item: unknown) => resolveMountItem(item, containerHome));
+}
+
+function resolveEnvs(mountConfig: readonly unknown[], extraEnvs: readonly string[] = []): string[] {
+  const envs = new Set(extraEnvs);
+
+  for (const item of mountConfig) {
+    if (typeof item === 'string') {
+      const preset = ENV_PRESETS[item];
+      if (preset) {
+        for (const envVar of preset) {
+          envs.add(envVar);
+        }
+      }
+    }
+  }
+
+  return [...envs];
+}
+
+function expandEnvPatterns(
+  envVars: readonly string[],
+  env: Readonly<Record<string, string | undefined>> = process.env
+): ExpandedEnv[] {
+  const result: ExpandedEnv[] = [];
+
+  for (const envVar of envVars) {
+    if (envVar.includes('=')) {
+      const separator = envVar.indexOf('=');
+      result.push({
+        name: envVar.slice(0, separator),
+        value: envVar.slice(separator + 1),
+        forced: true,
+      });
+    } else if (envVar.endsWith('*')) {
+      const prefix = envVar.slice(0, -1);
+      for (const key of Object.keys(env)) {
+        if (key.startsWith(prefix)) {
+          result.push({ name: key, value: null, forced: false });
+        }
+      }
+    } else {
+      result.push({ name: envVar, value: null, forced: false });
+    }
+  }
+
+  return result;
+}
+
+function validateMountConfig(value: unknown): string | null {
+  if (!Array.isArray(value)) {
+    return 'dockerMounts must be an array';
+  }
+
+  for (const item of value) {
+    if (typeof item === 'string') {
+      if (!MOUNT_PRESETS[item] && !PROVIDER_ENV_ONLY_PRESETS.has(item)) {
+        return (
+          `Unknown mount preset: "${item}". Valid: ${Object.keys(MOUNT_PRESETS).join(', ')}. ` +
+          `Env-only presets (no mount): ${[...PROVIDER_ENV_ONLY_PRESETS].join(', ')}`
+        );
+      }
+    } else if (isCustomMount(item)) {
+      if (!item.host) {
+        return 'Custom mount missing "host" property';
+      }
+      if (!item.container) {
+        return 'Custom mount missing "container" property';
+      }
+      if (item.readonly !== undefined && typeof item.readonly !== 'boolean') {
+        return '"readonly" must be a boolean';
+      }
+    } else {
+      return `Invalid mount: ${JSON.stringify(item)}. Use preset name or {host, container, readonly?}`;
+    }
+  }
+
+  return null;
+}
+
+export = {
+  MOUNT_PRESETS,
+  ENV_PRESETS,
+  PROVIDER_ENV_ONLY_PRESETS,
+  resolveMounts,
+  resolveEnvs,
+  expandEnvPatterns,
+  isUsableEnvValue,
+  isUsableHttpUrl,
+  validateMountConfig,
+  validateEnvPassthrough,
+  validateProviderEnvAuth,
+};

package/src/legacy-lib/docker-env-auth.ts

@@ -0,0 +1,116 @@
+import { URL } from 'url';
+
+interface ProviderEnvAuth {
+  requireOneOf?: readonly string[];
+  requireTogether?: readonly (readonly string[])[];
+  requireUrl?: readonly string[];
+}
+
+interface ProviderMetadata {
+  docker?: {
+    envAuth?: ProviderEnvAuth;
+  };
+}
+
+interface ProviderNamesFacade {
+  getProviderMetadata(providerId: string): ProviderMetadata;
+}
+
+interface ProviderEnvAuthResult {
+  ok: boolean;
+  satisfiedOneOf: boolean;
+  malformed: string[];
+  message: string;
+}
+
+// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+const providerNames: ProviderNamesFacade = require('./provider-names');
+
+const ENV_SPEC_PATTERN = /^[A-Z_][A-Z0-9_]*(\*|=.*)?$/i;
+
+function validateEnvPassthrough(value: unknown): string | null {
+  if (!Array.isArray(value)) {
+    return 'dockerEnvPassthrough must be an array';
+  }
+
+  for (const item of value) {
+    if (typeof item !== 'string') {
+      return `Invalid env var: ${JSON.stringify(item)}. Must be a string`;
+    }
+    if (!ENV_SPEC_PATTERN.test(item)) {
+      return `Invalid env var spec: "${item}". Use VAR, VAR_*, or VAR=value`;
+    }
+  }
+
+  return null;
+}
+
+function isUsableEnvValue(value: unknown): value is string {
+  return typeof value === 'string' && value.trim() !== '';
+}
+
+function isUsableHttpUrl(value: unknown): boolean {
+  if (!isUsableEnvValue(value)) {
+    return false;
+  }
+  let parsed: URL;
+  try {
+    parsed = new URL(value.trim());
+  } catch {
+    return false;
+  }
+  return parsed.protocol === 'http:' || parsed.protocol === 'https:';
+}
+
+function validateProviderEnvAuth(
+  providerId: string,
+  forwardedEnv: Readonly<Record<string, string | undefined>> | null | undefined
+): ProviderEnvAuthResult {
+  const metadata = providerNames.getProviderMetadata(providerId);
+  const envAuth = metadata.docker && metadata.docker.envAuth;
+  if (!envAuth) {
+    return { ok: true, satisfiedOneOf: true, malformed: [], message: '' };
+  }
+
+  const requireUrl = new Set(envAuth.requireUrl || []);
+  const valueOf = (name: string): string | undefined =>
+    forwardedEnv ? forwardedEnv[name] : undefined;
+  const isSet = (name: string): boolean =>
+    requireUrl.has(name) ? isUsableHttpUrl(valueOf(name)) : isUsableEnvValue(valueOf(name));
+
+  const requireOneOf = envAuth.requireOneOf || [];
+  const satisfiedOneOf = requireOneOf.length === 0 || requireOneOf.some(isSet);
+
+  const malformed: string[] = [];
+  for (const name of requireUrl) {
+    if (isUsableEnvValue(valueOf(name)) && !isUsableHttpUrl(valueOf(name))) {
+      malformed.push(`${name} is set but is not a usable http(s) URL`);
+    }
+  }
+
+  for (const group of envAuth.requireTogether || []) {
+    const missing = group.filter((name) => !isSet(name));
+    if (missing.length > 0 && missing.length < group.length) {
+      malformed.push(`${group.join(' + ')} must be set together (missing ${missing.join(', ')})`);
+    }
+  }
+
+  const reasons = [...malformed];
+  if (!satisfiedOneOf) {
+    reasons.push(`one of ${requireOneOf.join(', ')} must be set to a non-empty value`);
+  }
+
+  return {
+    ok: malformed.length === 0 && satisfiedOneOf,
+    satisfiedOneOf,
+    malformed,
+    message: reasons.join('; '),
+  };
+}
+
+export = {
+  isUsableEnvValue,
+  isUsableHttpUrl,
+  validateEnvPassthrough,
+  validateProviderEnvAuth,
+};

package/src/legacy-lib/git-remote-utils.ts

@@ -0,0 +1,244 @@
+/**
+ * Git remote URL parsing and provider detection.
+ * Automatically detects issue provider from git remote URL.
+ */
+
+interface ExecSyncOptions {
+  cwd: string;
+  encoding: 'utf8';
+  stdio: 'pipe';
+}
+
+type ExecSync = (command: string, options: ExecSyncOptions) => string;
+
+interface SafeExecFacade {
+  execSync: ExecSync;
+}
+
+interface HostedGitContext {
+  provider: 'github' | 'gitlab';
+  host: string;
+  org: string;
+  repo: string;
+  fullRepo: string;
+}
+
+interface AzureDevOpsGitContext {
+  provider: 'azure-devops';
+  host: string;
+  azureOrg: string;
+  azureProject: string;
+  repo: string;
+}
+
+type GitContext = HostedGitContext | AzureDevOpsGitContext;
+type GitContextWithRemote = GitContext & { remote: string };
+
+// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+const safeExec: SafeExecFacade = require('../src/lib/safe-exec');
+const { execSync } = safeExec;
+
+function hasInvalidGitRefCharacter(value: string): boolean {
+  for (const character of value) {
+    const codePoint = character.codePointAt(0);
+    if (
+      codePoint === undefined ||
+      codePoint <= 0x20 ||
+      codePoint === 0x7f ||
+      '~^:?*[\\'.includes(character)
+    ) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Normalize a Git remote name using the same ref-format rules Git applies to
+ * refs/remotes/<name>. Keeping this next to detection prevents a discovered
+ * remote from being rejected later by a narrower consumer-specific allowlist.
+ */
+function normalizeGitRemoteName(value: unknown): string | null {
+  if (typeof value !== 'string') {
+    return null;
+  }
+
+  const name = value.trim();
+  if (
+    name.length === 0 ||
+    name.endsWith('.') ||
+    name.includes('..') ||
+    name.includes('@{') ||
+    hasInvalidGitRefCharacter(name)
+  ) {
+    return null;
+  }
+
+  const components = name.split('/');
+  if (
+    components.some(
+      (component) =>
+        component.length === 0 || component.startsWith('.') || component.endsWith('.lock')
+    )
+  ) {
+    return null;
+  }
+
+  return name;
+}
+
+/** Quote one argument for the POSIX shell snippets embedded in agent prompts. */
+function quoteShellArgument(value: string): string {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+
+/**
+ * Parse git remote URL into structured provider context.
+ * Supports GitHub, GitLab, and Azure DevOps (cloud + self-hosted).
+ * Handles both HTTPS and SSH URL formats.
+ */
+function parseGitRemoteUrl(remoteUrl: unknown): GitContext | null {
+  if (!remoteUrl || typeof remoteUrl !== 'string') {
+    return null;
+  }
+
+  const url = remoteUrl.trim();
+
+  // Normalize SSH URLs to HTTPS format for easier parsing
+  // git@host:path → https://host/path
+  let normalizedUrl = url;
+  const sshMatch = /^git@([^:]+):(.+)$/.exec(url);
+  if (sshMatch) {
+    const host = sshMatch[1];
+    const remotePath = sshMatch[2];
+    if (host !== undefined && remotePath !== undefined) {
+      normalizedUrl = `https://${host}/${remotePath}`;
+    }
+  }
+
+  // Remove .git suffix if present
+  normalizedUrl = normalizedUrl.replace(/\.git$/, '');
+
+  // Azure DevOps: https://dev.azure.com/org/project/_git/repo
+  // Azure Legacy: https://org.visualstudio.com/project/_git/repo
+  // Azure SSH: git@ssh.dev.azure.com:v3/org/project/repo
+  const azureMatch =
+    /https:\/\/dev\.azure\.com\/([^/]+)\/([^/]+)\/_git\/([^/]+)/.exec(normalizedUrl) ||
+    /https:\/\/([^.]+)\.visualstudio\.com\/([^/]+)\/_git\/([^/]+)/.exec(normalizedUrl) ||
+    /https:\/\/ssh\.dev\.azure\.com\/v3\/([^/]+)\/([^/]+)\/([^/]+)/.exec(normalizedUrl);
+
+  if (azureMatch) {
+    const orgPart = azureMatch[1];
+    const project = azureMatch[2];
+    const repo = azureMatch[3];
+    if (orgPart === undefined || project === undefined || repo === undefined) {
+      return null;
+    }
+    const isLegacy = normalizedUrl.includes('visualstudio.com');
+    const azureOrg = isLegacy
+      ? `https://${orgPart}.visualstudio.com`
+      : `https://dev.azure.com/${orgPart}`;
+
+    return {
+      provider: 'azure-devops',
+      host: isLegacy ? `${orgPart}.visualstudio.com` : 'dev.azure.com',
+      azureOrg,
+      azureProject: project,
+      repo,
+    };
+  }
+
+  // GitHub: https://github.com/org/repo
+  // GitLab: https://gitlab.com/org/repo (or self-hosted)
+  // Generic: https://host/org/repo
+  const httpsMatch = /https?:\/\/([^/]+)\/([^/]+)\/([^/]+)/.exec(normalizedUrl);
+  if (httpsMatch) {
+    const host = httpsMatch[1];
+    const org = httpsMatch[2];
+    const repo = httpsMatch[3];
+    if (host === undefined || org === undefined || repo === undefined) {
+      return null;
+    }
+
+    let provider: HostedGitContext['provider'];
+    if (host === 'github.com') {
+      provider = 'github';
+    } else if (host.includes('gitlab')) {
+      provider = 'gitlab';
+    } else {
+      return null;
+    }
+
+    return {
+      provider,
+      host,
+      org,
+      repo,
+      fullRepo: `${org}/${repo}`,
+    };
+  }
+
+  return null;
+}
+
+/**
+ * Detect git repository context from current working directory.
+ * Returns provider context extracted from git remote URL.
+ */
+function detectGitContext(cwd = process.cwd()): GitContextWithRemote | null {
+  try {
+    execSync('git rev-parse --git-dir', {
+      cwd,
+      stdio: 'pipe',
+      encoding: 'utf8',
+    });
+  } catch {
+    return null;
+  }
+
+  try {
+    const remoteOutput = execSync('git remote -v', {
+      cwd,
+      stdio: 'pipe',
+      encoding: 'utf8',
+    });
+
+    const supportedRemotes = new Map<string, GitContextWithRemote>();
+    for (const line of remoteOutput.split(/\r?\n/)) {
+      const match = /^(\S+)\s+(.+)\s+\(fetch\)$/.exec(line);
+      if (!match) {
+        continue;
+      }
+
+      const remoteCandidate = match[1];
+      const remoteUrl = match[2];
+      const remote = normalizeGitRemoteName(remoteCandidate);
+      if (!remote || remoteUrl === undefined) {
+        continue;
+      }
+      const context = parseGitRemoteUrl(remoteUrl);
+      if (context && !supportedRemotes.has(remote)) {
+        supportedRemotes.set(remote, { ...context, remote });
+      }
+    }
+
+    if (supportedRemotes.has('origin')) {
+      return supportedRemotes.get('origin') ?? null;
+    }
+
+    if (supportedRemotes.size === 1) {
+      return supportedRemotes.values().next().value ?? null;
+    }
+
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+export = {
+  normalizeGitRemoteName,
+  quoteShellArgument,
+  parseGitRemoteUrl,
+  detectGitContext,
+};

package/src/legacy-lib/id-detector.ts

@@ -0,0 +1,57 @@
+/**
+ * ID Detector - Determines if an ID is a task or cluster
+ *
+ * Strategy:
+ * 1. Check if ID exists in cluster storage
+ * 2. If not, check if ID exists in task storage (SQLite)
+ * 3. Return type: 'cluster', 'task', or null
+ */
+
+import path = require('path');
+import fs = require('fs');
+import os = require('os');
+import Database = require('better-sqlite3');
+import clustersRegistry = require('./clusters-registry');
+
+type IdType = 'cluster' | 'task' | null;
+
+function hasClusterId(clusters: unknown, id: string): boolean {
+  return Boolean(Reflect.get(Object(clusters), id));
+}
+
+/** Detect if an ID belongs to a cluster or task. */
+function detectIdType(id: string): IdType {
+  const homeDir =
+    process.env.ZEROSHOT_HOME ||
+    process.env.HOME ||
+    process.env.USERPROFILE ||
+    os.homedir();
+  const storageDir = path.join(homeDir, '.zeroshot');
+  const taskDbFile = path.join(homeDir, '.claude-zeroshot', 'store.db');
+
+  try {
+    const clusters = clustersRegistry.readClustersFileSync(storageDir);
+    if (hasClusterId(clusters, id)) {
+      return 'cluster';
+    }
+  } catch {
+    // Ignore parse errors
+  }
+
+  if (fs.existsSync(taskDbFile)) {
+    try {
+      const db = new Database(taskDbFile, { readonly: true, timeout: 5000 });
+      const row: unknown = db.prepare('SELECT id FROM tasks WHERE id = ?').get(id);
+      db.close();
+      if (row) {
+        return 'task';
+      }
+    } catch {
+      // Ignore DB errors
+    }
+  }
+
+  return null;
+}
+
+export = { detectIdType };

package/src/legacy-lib/js-yaml.d.ts

@@ -0,0 +1,3 @@
+declare module 'js-yaml' {
+  export function load(input: string): unknown;
+}