@the-open-engine/zeroshot 6.38.1 → 6.39.1

package/lib/stream-json-parser.js

@@ -1,69 +1,68 @@
+"use strict";
 /**
  * Provider-agnostic stream-json parser for `zeroshot logs`.
  *
  * Provider parsing is delegated to the helper-backed runtime provider facade.
  */
-
+// The runtime facade is maintained JavaScript; keep its original emitted require path.
+// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
 const { getProvider, listProviders } = require('../src/providers');
-
 function createProviderParsers() {
-  return listProviders().map((name) => getProvider(name));
+    return listProviders().map((name) => getProvider(name));
 }
-
 function stripTimestampPrefix(line) {
-  if (!line || typeof line !== 'string') return '';
-  let trimmed = line.trim().replace(/\r$/, '');
-  if (!trimmed) return '';
-
-  const tsMatch = trimmed.match(/^\[(\d{13})\](.*)$/);
-  if (tsMatch) trimmed = (tsMatch[2] || '').trimStart();
-
-  if (!trimmed.startsWith('{') && !trimmed.startsWith('[')) {
-    const pipeMatch = trimmed.match(/^[^|]{1,40}\|\s*(.*)$/);
-    if (pipeMatch) {
-      const afterPipe = (pipeMatch[1] || '').trimStart();
-      if (afterPipe.startsWith('{') || afterPipe.startsWith('[')) return afterPipe;
+    if (!line || typeof line !== 'string')
+        return '';
+    let trimmed = line.trim().replace(/\r$/, '');
+    if (!trimmed)
+        return '';
+    const tsMatch = /^\[(\d{13})\](.*)$/.exec(trimmed);
+    if (tsMatch)
+        trimmed = (tsMatch[2] || '').trimStart();
+    if (!trimmed.startsWith('{') && !trimmed.startsWith('[')) {
+        const pipeMatch = /^[^|]{1,40}\|\s*(.*)$/.exec(trimmed);
+        if (pipeMatch) {
+            const afterPipe = (pipeMatch[1] || '').trimStart();
+            if (afterPipe.startsWith('{') || afterPipe.startsWith('['))
+                return afterPipe;
+        }
     }
-  }
-
-  return trimmed;
+    return trimmed;
 }
-
+// The provider protocol intentionally permits one event, an event batch, or no event.
+// eslint-disable-next-line sonarjs/function-return-type
 function parseEvent(line, providerParsers = createProviderParsers()) {
-  const content = stripTimestampPrefix(line);
-  if (!content) return null;
-
-  for (const provider of providerParsers) {
-    const event = provider.parseEvent(content);
-    if (event) return event;
-  }
-
-  return null;
+    const content = stripTimestampPrefix(line);
+    let result = null;
+    if (content) {
+        for (const provider of providerParsers) {
+            const event = provider.parseEvent(content);
+            if (event) {
+                result = event;
+                break;
+            }
+        }
+    }
+    return result;
 }
-
 function collectEvent(events, event) {
-  if (!event) return;
-  if (Array.isArray(event)) {
-    events.push(...event);
-    return;
-  }
-  events.push(event);
+    if (!event)
+        return;
+    if (Array.isArray(event)) {
+        events.push(...event);
+        return;
+    }
+    events.push(event);
 }
-
 function parseChunk(chunk) {
-  const events = [];
-  const lines = String(chunk || '').split('\n');
-  const providerParsers = createProviderParsers();
-
-  for (const line of lines) {
-    if (!line.trim()) continue;
-    collectEvent(events, parseEvent(line, providerParsers));
-  }
-
-  return events;
+    const events = [];
+    const lines = String(chunk || '').split('\n');
+    const providerParsers = createProviderParsers();
+    for (const line of lines) {
+        if (!line.trim())
+            continue;
+        collectEvent(events, parseEvent(line, providerParsers));
+    }
+    return events;
 }
-
-module.exports = {
-  parseEvent,
-  parseChunk,
-};
+module.exports = { parseEvent, parseChunk };

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@the-open-engine/zeroshot",
-  "version": "6.38.1",
+  "version": "6.39.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@the-open-engine/zeroshot",
-      "version": "6.38.1",
+      "version": "6.39.1",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
@@ -17,6 +17,7 @@
         "bun": "1.3.14",
         "chalk": "^4.1.2",
         "commander": "^14.0.2",
+        "js-yaml": "^4.3.1",
         "node-pty": "^1.1.0",
         "omelette": "^0.4.17",
         "open": "^10.1.0",
@@ -43,7 +44,6 @@
         "eslint-plugin-sonarjs": "^3.0.5",
         "eslint-plugin-unused-imports": "^4.3.0",
         "husky": "^9.1.7",
-        "js-yaml": "^4.2.0",
         "jscpd": "^3.5.10",
         "lint-staged": "^16.2.7",
         "mocha": "^11.7.5",
@@ -5155,7 +5155,6 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
       "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
-      "dev": true,
       "license": "Python-2.0"
     },
     "node_modules/argv-formatter": {
@@ -9177,10 +9176,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
-      "dev": true,
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "funding": [
         {
           "type": "github",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-open-engine/zeroshot",
-  "version": "6.38.1",
+  "version": "6.39.1",
   "description": "Independent executor–verifier orchestration for software changes.",
   "main": "src/orchestrator.js",
   "bin": {
@@ -29,7 +29,7 @@
     ]
   },
   "scripts": {
-    "pretest": "npm run build:agent-cli-provider && npm run build:target",
+    "pretest": "npm run build:agent-cli-provider && npm run build:target && npm run build:legacy-lib && npm run build:legacy-runtime && npm run build:task-lib",
     "test": "node tests/run-tests.js",
     "test:unit": "node tests/run-tests.js",
     "test:e2e": "mocha 'tests/e2e/**/*.test.js' --timeout 120000",
@@ -40,8 +40,11 @@
     "test:coverage:report": "c8 --reporter=html npm run test:unit && echo 'Coverage report generated at coverage/index.html'",
     "postinstall": "node scripts/postinstall.js",
     "start": "node cli/index.js",
-    "typecheck": "tsc --noEmit && npm run typecheck:cluster && npm run typecheck:hosted-target && npm run typecheck:hosted-session && npm run typecheck:target",
+    "typecheck": "tsc --noEmit && npm run typecheck:legacy-lib && npm run typecheck:legacy-runtime && npm run typecheck:task-lib && npm run typecheck:cluster && npm run typecheck:hosted-target && npm run typecheck:hosted-session && npm run typecheck:target",
     "typecheck:agent-cli-provider": "tsc --project tsconfig.agent-cli-provider.json",
+    "typecheck:legacy-lib": "tsc --project tsconfig.legacy-lib.json",
+    "typecheck:legacy-runtime": "tsc --project tsconfig.legacy-runtime.json",
+    "typecheck:task-lib": "tsc --project tsconfig.task-lib.json",
     "typecheck:hosted-target": "tsc --project tsconfig.hosted-target.json",
     "typecheck:hosted-session": "tsc --project tsconfig.hosted-session.json",
     "test:hosted": "npm run build:cluster && node --test tests/private-hosted-cli/*.test.js && npm run test:hosted-target",
@@ -51,10 +54,13 @@
     "typecheck:cluster": "tsc --project tsconfig.cluster.json",
     "lint:agent-cli-provider": "eslint \"src/agent-cli-provider/**/*.ts\" \"tests/agent-cli-provider/**/*.ts\"",
     "build:agent-cli-provider": "tsc --project tsconfig.agent-cli-provider.build.json",
+    "build:legacy-lib": "tsc --project tsconfig.legacy-lib.build.json",
+    "build:legacy-runtime": "tsc --project tsconfig.legacy-runtime.build.json",
+    "build:task-lib": "tsc --project tsconfig.task-lib.build.json",
     "build:target": "tsc --project tsconfig.target.build.json",
     "build:cluster": "npm run protocol:generate && tsc --project tsconfig.cluster.cjs.json && tsc --project tsconfig.cluster.esm.json && tsc --project tsconfig.hosted-target.cjs.json && tsc --project tsconfig.hosted-target.esm.json && tsc --project tsconfig.hosted-session.cjs.json && tsc --project tsconfig.hosted-session.esm.json && node scripts/build-cluster.js",
     "test:agent-cli-provider": "node --test tests/agent-cli-provider/*.test.js",
-    "test:omp": "npm run build:agent-cli-provider && node --test tests/agent-cli-provider/omp-*.test.js && node tests/run-tests.js 'tests/omp-rpc-watcher*.test.js' tests/omp-isolation-capability.test.js tests/omp-docker-auth.test.js tests/omp-docker-fresh-only.test.js",
+    "test:omp": "npm run build:agent-cli-provider && npm run build:task-lib && node --test tests/agent-cli-provider/omp-*.test.js && node tests/run-tests.js 'tests/omp-rpc-watcher*.test.js' tests/omp-isolation-capability.test.js tests/omp-docker-auth.test.js tests/omp-docker-fresh-only.test.js",
     "test:providers:live": "npm run build:agent-cli-provider && node scripts/live-provider-smoke.js",
     "check:agent-cli-provider": "npm run check:agent-cli-provider:ci",
     "check:agent-cli-provider:ci": "npm run typecheck:agent-cli-provider && npm run lint:agent-cli-provider && npm run build:agent-cli-provider && npm run test:agent-cli-provider",
@@ -90,9 +96,9 @@
     "release:preflight": "node scripts/release-preflight.js",
     "release:recover": "node scripts/release-recovery.js",
     "release:assert-published": "node scripts/assert-release-published.js",
-    "prepack": "npm run build:cluster && npm run build:target",
+    "prepack": "npm run build:cluster && npm run build:target && npm run build:legacy-lib && npm run build:legacy-runtime && npm run build:task-lib",
     "prepublishOnly": "npm run lint && npm run typecheck && npm run check:agent-cli-provider:ci",
-    "prepare": "npm run build:agent-cli-provider && npm run build:target && husky"
+    "prepare": "npm run build:agent-cli-provider && npm run build:target && npm run build:legacy-lib && npm run build:legacy-runtime && npm run build:task-lib && husky"
   },
   "c8": {
     "reporter": [
@@ -198,6 +204,7 @@
     "bun": "1.3.14",
     "chalk": "^4.1.2",
     "commander": "^14.0.2",
+    "js-yaml": "^4.3.1",
     "node-pty": "^1.1.0",
     "omelette": "^0.4.17",
     "open": "^10.1.0",
@@ -223,7 +230,6 @@
     "eslint-plugin-sonarjs": "^3.0.5",
     "eslint-plugin-unused-imports": "^4.3.0",
     "husky": "^9.1.7",
-    "js-yaml": "^4.2.0",
     "jscpd": "^3.5.10",
     "lint-staged": "^16.2.7",
     "mocha": "^11.7.5",
@@ -238,7 +244,7 @@
   },
   "overrides": {
     "cosmiconfig": {
-      "js-yaml": "4.2.0"
+      "js-yaml": "4.3.1"
     },
     "adm-zip": "0.6.0",
     "sharp": "0.35.3",

package/scripts/postinstall.js

@@ -1,8 +1,12 @@
 #!/usr/bin/env node
 
+const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
 
+const REPOSITORY_ROOT = path.join(__dirname, '..');
+const LEGACY_LIB_OUTPUT = path.join(REPOSITORY_ROOT, 'lib', 'path-check.js');
+const LEGACY_LIB_PROJECT = path.join(REPOSITORY_ROOT, 'tsconfig.legacy-lib.build.json');
 const LIFECYCLE_SCRIPTS = ['fix-node-pty-permissions.js', 'check-path.js'];
 const SETUP_INVITATION = 'Run zeroshot to finish setup.\n';
 
@@ -16,6 +20,22 @@ function shouldPrintSetupInvitation(env) {
   return globalInstall && !isTruthyEnvironmentFlag(env.CI);
 }
 
+function ensureLegacyLibBuild({
+  outputExists = fs.existsSync,
+  resolveCompiler = () => require.resolve('typescript/bin/tsc'),
+  runCompiler = spawnSync,
+} = {}) {
+  if (outputExists(LEGACY_LIB_OUTPUT)) return 0;
+
+  const result = runCompiler(
+    process.execPath,
+    [resolveCompiler(), '--project', LEGACY_LIB_PROJECT],
+    { stdio: 'inherit' }
+  );
+  if (result.error) throw result.error;
+  return result.status ?? 1;
+}
+
 function runLifecycleScript(scriptName) {
   const result = spawnSync(process.execPath, [path.join(__dirname, scriptName)], {
     stdio: 'inherit',
@@ -27,8 +47,12 @@ function runLifecycleScript(scriptName) {
 function runPostinstall({
   env = process.env,
   stdout = process.stdout,
+  ensureBuild = ensureLegacyLibBuild,
   runScript = runLifecycleScript,
 } = {}) {
+  const buildStatus = ensureBuild();
+  if (buildStatus !== 0) return buildStatus;
+
   for (const scriptName of LIFECYCLE_SCRIPTS) {
     const status = runScript(scriptName);
     if (status !== 0) return status;
@@ -47,8 +71,11 @@ if (require.main === module) {
 }
 
 module.exports = {
+  LEGACY_LIB_OUTPUT,
+  LEGACY_LIB_PROJECT,
   LIFECYCLE_SCRIPTS,
   SETUP_INVITATION,
+  ensureLegacyLibBuild,
   runPostinstall,
   shouldPrintSetupInvitation,
 };

package/scripts/rust-distribution.js

@@ -325,10 +325,7 @@ function stagedLockDependencies(cargoLock, workspaceCargoToml) {
 
 function stageCargoLock(cargoLock, version, workspaceCargoToml) {
   const targetPackage = workspaceLockPackage(cargoLock);
-  let stagedPackage = targetPackage.text.replace(
-    /^(version = ")[^"]+(")$/m,
-    `$1${version}$2`
-  );
+  let stagedPackage = targetPackage.text.replace(/^(version = ")[^"]+(")$/m, `$1${version}$2`);
   for (const dependency of stagedLockDependencies(cargoLock, workspaceCargoToml)) {
     const dependencyPattern = new RegExp(
       `^(\\s*")${escapeRegExp(dependency.name)}(?: [^"]+)?(",\\r?)$`,
@@ -339,10 +336,7 @@ function stageCargoLock(cargoLock, version, workspaceCargoToml) {
         `RUST_VERSION_STAGE_FAILED: Cargo.lock zeroshot-rust entry has no ${dependency.name} dependency`
       );
     }
-    stagedPackage = stagedPackage.replace(
-      dependencyPattern,
-      `$1${dependency.reference}$2`
-    );
+    stagedPackage = stagedPackage.replace(dependencyPattern, `$1${dependency.reference}$2`);
   }
   return (
     cargoLock.slice(0, targetPackage.start) +
@@ -359,10 +353,7 @@ function verifyStagedCargoLock(cargoLock, version, workspaceCargoToml) {
     );
   }
   for (const dependency of stagedLockDependencies(cargoLock, workspaceCargoToml)) {
-    const dependencyPattern = new RegExp(
-      `^\\s*"${escapeRegExp(dependency.reference)}",\\r?$`,
-      'm'
-    );
+    const dependencyPattern = new RegExp(`^\\s*"${escapeRegExp(dependency.reference)}",\\r?$`, 'm');
     if (!dependencyPattern.test(targetPackage.text)) {
       throw new Error(
         `${VERSION_ERROR}: Cargo.lock zeroshot-rust dependency ${dependency.name} is not coupled to ${dependency.version}`
@@ -400,8 +391,7 @@ function stageVersion(
 function checkVersionCoupling(tag, cargoToml, cargoLock, workspaceCargoToml) {
   const useRepositoryFiles = cargoToml === undefined;
   const manifest =
-    cargoToml ??
-    fs.readFileSync(path.join(repositoryRoot, 'zeroshot-rust', 'Cargo.toml'), 'utf8');
+    cargoToml ?? fs.readFileSync(path.join(repositoryRoot, 'zeroshot-rust', 'Cargo.toml'), 'utf8');
   const releaseVersion = normalizeVersion(tag);
   const manifestVersion = cargoVersion(manifest);
   if (releaseVersion !== manifestVersion) {
@@ -416,8 +406,7 @@ function checkVersionCoupling(tag, cargoToml, cargoLock, workspaceCargoToml) {
       : undefined);
   if (lock !== undefined) {
     const workspace =
-      workspaceCargoToml ??
-      fs.readFileSync(path.join(repositoryRoot, 'Cargo.toml'), 'utf8');
+      workspaceCargoToml ?? fs.readFileSync(path.join(repositoryRoot, 'Cargo.toml'), 'utf8');
     verifyStagedCargoLock(lock, releaseVersion, workspace);
   }
   return releaseVersion;
@@ -483,9 +472,7 @@ const SCRIPT_INSTALL_CONTRACTS = Object.freeze([
 ]);
 
 function invokesRustDistribution(step) {
-  return (
-    typeof step.run === 'string' && RUST_DISTRIBUTION_INVOCATION.test(step.run)
-  );
+  return typeof step.run === 'string' && RUST_DISTRIBUTION_INVOCATION.test(step.run);
 }
 
 function checkScriptInstall(job, { jobName, installName, command, checkoutRef }) {
@@ -507,9 +494,7 @@ function checkScriptInstall(job, { jobName, installName, command, checkoutRef })
       checkout.with.repository !== '${{ github.repository }}') ||
     checkout.with?.ref !== checkoutRef
   ) {
-    failIntegrity(
-      `${jobName} must checkout expected current repository source at workspace root`
-    );
+    failIntegrity(`${jobName} must checkout expected current repository source at workspace root`);
   }
   const installIndex = job.steps.indexOf(install);
   const checkoutIndex = job.steps.indexOf(checkout);
@@ -745,11 +730,12 @@ function hasValidSri(integrity) {
 }
 
 function checkScriptDependencies(packageManifest, packageLock) {
-  const directSpec = packageManifest.devDependencies?.['js-yaml'];
+  // js-yaml is a runtime dependency: lib/compose-utils.js requires it from the published package.
+  const directSpec = packageManifest.dependencies?.['js-yaml'];
   if (typeof directSpec !== 'string' || directSpec.length === 0) {
-    failIntegrity('rust-distribution.js requires a direct js-yaml devDependency');
+    failIntegrity('rust-distribution.js requires a direct js-yaml dependency');
   }
-  const lockSpec = packageLock.packages?.['']?.devDependencies?.['js-yaml'];
+  const lockSpec = packageLock.packages?.['']?.dependencies?.['js-yaml'];
   if (lockSpec !== directSpec) {
     failIntegrity('package-lock root js-yaml spec must match package.json');
   }
@@ -773,12 +759,8 @@ function checkRepository(
   shimTargets = JSON.parse(
     fs.readFileSync(path.join(repositoryRoot, 'npm', 'zeroshot-rust', 'targets.json'), 'utf8')
   ),
-  packageManifest = JSON.parse(
-    fs.readFileSync(path.join(repositoryRoot, 'package.json'), 'utf8')
-  ),
-  packageLock = JSON.parse(
-    fs.readFileSync(path.join(repositoryRoot, 'package-lock.json'), 'utf8')
-  )
+  packageManifest = JSON.parse(fs.readFileSync(path.join(repositoryRoot, 'package.json'), 'utf8')),
+  packageLock = JSON.parse(fs.readFileSync(path.join(repositoryRoot, 'package-lock.json'), 'utf8'))
 ) {
   let document;
   try {
@@ -849,13 +831,7 @@ function run() {
   }
   if (command === 'smoke') {
     const binaryPath = path.resolve(argument('binary'));
-    const result = childProcess.spawnSync(binaryPath, [], { stdio: 'inherit' });
-    if (result.error) throw result.error;
-    if (result.signal || result.status !== 0) {
-      throw new Error(
-        `RUST_BINARY_SMOKE_FAILED: status=${result.status} signal=${result.signal || 'none'}`
-      );
-    }
+    smokeExecutable(binaryPath, 'RUST_BINARY_SMOKE_FAILED');
     process.stdout.write(`Rust release executable exited 0: ${binaryPath}\n`);
     return;
   }
@@ -871,13 +847,7 @@ function run() {
         declaration.executable
       );
       fs.writeFileSync(binaryPath, executable, { mode: 0o755 });
-      const result = childProcess.spawnSync(binaryPath, [], { stdio: 'inherit' });
-      if (result.error) throw result.error;
-      if (result.signal || result.status !== 0) {
-        throw new Error(
-          `RUST_ARCHIVE_SMOKE_FAILED: status=${result.status} signal=${result.signal || 'none'}`
-        );
-      }
+      smokeExecutable(binaryPath, 'RUST_ARCHIVE_SMOKE_FAILED');
     } finally {
       fs.rmSync(directory, { recursive: true, force: true });
     }
@@ -903,6 +873,26 @@ function run() {
   );
 }
 
+const SMOKE_GREETING = Buffer.from('zeroshot release smoke\n');
+
+function smokeExecutable(binaryPath, failureCode) {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'zeroshot-rust-executable-smoke-'));
+  try {
+    fs.writeFileSync(path.join(directory, 'greeting.txt'), SMOKE_GREETING);
+    const result = childProcess.spawnSync(binaryPath, ['--native-validate-greeting'], {
+      cwd: directory,
+      input: SMOKE_GREETING,
+      stdio: ['pipe', 'inherit', 'inherit'],
+    });
+    if (result.error) throw result.error;
+    if (result.signal || result.status !== 0) {
+      throw new Error(`${failureCode}: status=${result.status} signal=${result.signal || 'none'}`);
+    }
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+}
+
 if (require.main === module) {
   try {
     run();
@@ -926,6 +916,7 @@ module.exports = {
   packageTarget,
   parseChecksumManifest,
   sha256,
+  smokeExecutable,
   targetForHost,
   stageVersion,
   targets,

package/src/agent/agent-command-proofs-context.js

@@ -1,55 +1,45 @@
-const { normalizeCommandProofs } = require('../command-proofs');
-
+"use strict";
+function isCommandProofsModule(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        'normalizeCommandProofs' in value &&
+        typeof value.normalizeCommandProofs === 'function');
+}
+const commandProofsModule = require('../command-proofs');
+if (!isCommandProofsModule(commandProofsModule)) {
+    throw new TypeError('command-proofs must export normalizeCommandProofs');
+}
+const normalizeCommandProofs = commandProofsModule.normalizeCommandProofs;
 function appendProofDetails(lines, proof, index) {
-  const scope = proof.scope ? `, scope: ${proof.scope}` : '';
-  lines.push(`${index + 1}. id: ${proof.id}, profile: ${proof.profile}${scope}`);
-  if (proof.description) {
-    lines.push(`   description: ${proof.description}`);
-  }
-  lines.push(`   command: ${proof.command}`);
-  lines.push(`   helper: zeroshot cmdproof check ${proof.id}`);
+    const scope = proof.scope ? `, scope: ${proof.scope}` : '';
+    lines.push(`${index + 1}. id: ${proof.id}, profile: ${proof.profile}${scope}`);
+    if (proof.description) {
+        lines.push(`   description: ${proof.description}`);
+    }
+    lines.push(`   command: ${proof.command}`);
+    lines.push(`   helper: zeroshot cmdproof check ${proof.id}`);
 }
-
 function buildWorkerInstructions(lines) {
-  lines.push(
-    '',
-    'For these exact commands:',
-    '- Run `zeroshot cmdproof check <id>` instead of the raw command.',
-    '- Treat the helper exit code as the command exit code.',
-    '- If you need to mention evidence, include the helper output and the configured command id.',
-    ''
-  );
+    lines.push('', 'For these exact commands:', '- Run `zeroshot cmdproof check <id>` instead of the raw command.', '- Treat the helper exit code as the command exit code.', '- If you need to mention evidence, include the helper output and the configured command id.', '');
 }
-
 function buildValidatorInstructions(lines) {
-  lines.push(
-    '',
-    'For proof-backed validation:',
-    '- Run `zeroshot cmdproof check <id>` before considering the raw command.',
-    '- Use the helper output as quality-gate evidence.',
-    '- Only run the raw command directly if the helper itself is unavailable.',
-    ''
-  );
+    lines.push('', 'For proof-backed validation:', '- Run `zeroshot cmdproof check <id>` before considering the raw command.', '- Use the helper output as quality-gate evidence.', '- Only run the raw command directly if the helper itself is unavailable.', '');
 }
-
 function buildCommandProofsSection(config) {
-  const proofs = normalizeCommandProofs(config.commandProofs);
-  if (proofs.length === 0) {
-    return '';
-  }
-
-  const lines = ['## Reusable Command Proofs', '', 'Configured proof-backed commands:'];
-  proofs.forEach((proof, index) => appendProofDetails(lines, proof, index));
-
-  if (config.role === 'validator') {
-    buildValidatorInstructions(lines);
-  } else {
-    buildWorkerInstructions(lines);
-  }
-
-  return lines.join('\n');
+    const proofs = normalizeCommandProofs(config.commandProofs);
+    if (proofs.length === 0) {
+        return '';
+    }
+    const lines = ['## Reusable Command Proofs', '', 'Configured proof-backed commands:'];
+    proofs.forEach((proof, index) => appendProofDetails(lines, proof, index));
+    if (config.role === 'validator') {
+        buildValidatorInstructions(lines);
+    }
+    else {
+        buildWorkerInstructions(lines);
+    }
+    return lines.join('\n');
 }
-
 module.exports = {
-  buildCommandProofsSection,
+    buildCommandProofsSection,
 };

package/src/agent/agent-command-proofs-context.ts

@@ -0,0 +1,87 @@
+type StringList = string[];
+
+interface CommandProof {
+  id: string;
+  profile: string;
+  command: string;
+  scope?: string;
+  description?: string;
+}
+
+interface AgentCommandProofConfig {
+  role?: string;
+  commandProofs?: unknown;
+}
+
+interface CommandProofsModule {
+  normalizeCommandProofs(value: unknown): CommandProof[];
+}
+
+function isCommandProofsModule(value: unknown): value is CommandProofsModule {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    'normalizeCommandProofs' in value &&
+    typeof value.normalizeCommandProofs === 'function'
+  );
+}
+
+const commandProofsModule: unknown = require('../command-proofs');
+if (!isCommandProofsModule(commandProofsModule)) {
+  throw new TypeError('command-proofs must export normalizeCommandProofs');
+}
+const normalizeCommandProofs = commandProofsModule.normalizeCommandProofs;
+
+function appendProofDetails(lines: StringList, proof: CommandProof, index: number): void {
+  const scope = proof.scope ? `, scope: ${proof.scope}` : '';
+  lines.push(`${index + 1}. id: ${proof.id}, profile: ${proof.profile}${scope}`);
+  if (proof.description) {
+    lines.push(`   description: ${proof.description}`);
+  }
+  lines.push(`   command: ${proof.command}`);
+  lines.push(`   helper: zeroshot cmdproof check ${proof.id}`);
+}
+
+function buildWorkerInstructions(lines: StringList): void {
+  lines.push(
+    '',
+    'For these exact commands:',
+    '- Run `zeroshot cmdproof check <id>` instead of the raw command.',
+    '- Treat the helper exit code as the command exit code.',
+    '- If you need to mention evidence, include the helper output and the configured command id.',
+    ''
+  );
+}
+
+function buildValidatorInstructions(lines: StringList): void {
+  lines.push(
+    '',
+    'For proof-backed validation:',
+    '- Run `zeroshot cmdproof check <id>` before considering the raw command.',
+    '- Use the helper output as quality-gate evidence.',
+    '- Only run the raw command directly if the helper itself is unavailable.',
+    ''
+  );
+}
+
+function buildCommandProofsSection(config: AgentCommandProofConfig): string {
+  const proofs = normalizeCommandProofs(config.commandProofs);
+  if (proofs.length === 0) {
+    return '';
+  }
+
+  const lines = ['## Reusable Command Proofs', '', 'Configured proof-backed commands:'];
+  proofs.forEach((proof, index) => appendProofDetails(lines, proof, index));
+
+  if (config.role === 'validator') {
+    buildValidatorInstructions(lines);
+  } else {
+    buildWorkerInstructions(lines);
+  }
+
+  return lines.join('\n');
+}
+
+export = {
+  buildCommandProofsSection,
+};