@the-open-engine/zeroshot 6.39.1 → 6.39.2

package/src/orchestrator.js

@@ -307,6 +307,9 @@ class Orchestrator {
     this.closed = false;
     this._conductorWatchdogs = new Set();
     this._clusterRunBoundaries = new Map();
+    // Successful auto-cleanup closes and removes the live cluster before a foreground caller can
+    // build its authoritative result. Preserve only the bounded terminal handoff for this process.
+    this._finalRuns = new Map();
 
     // Track if clusters are loaded (for lazy loading pattern)
     this._clustersLoaded = options.skipLoad === true;
@@ -2430,6 +2433,7 @@ class Orchestrator {
     cluster.pid = null; // Clear PID - cluster is no longer running
 
     if (shouldAutoCleanWorktree) {
+      this._captureFinalRun(clusterId, cluster);
       // Close message bus and ledger (same as kill() path)
       cluster.messageBus.close();
     }
@@ -2562,6 +2566,35 @@ class Orchestrator {
         cluster.messageBus.close();
       }
     }
+    this._finalRuns.clear();
+  }
+
+  _captureFinalRun(clusterId, cluster) {
+    const snapshot = cluster.messageBus.readSnapshot(clusterId);
+    const terminalMessages = ['CLUSTER_COMPLETE', 'CLUSTER_FAILED']
+      .flatMap((topic) => cluster.messageBus.query({ cluster_id: clusterId, topic }))
+      .sort((left, right) => {
+        const a = BigInt(left.sequence);
+        const b = BigInt(right.sequence);
+        return a < b ? -1 : a > b ? 1 : 0;
+      });
+    this._finalRuns.set(clusterId, {
+      snapshot,
+      terminalMessages,
+      status: {
+        id: clusterId,
+        state: cluster.state,
+        isZombie: false,
+        pid: null,
+        createdAt: cluster.createdAt,
+        agents: cluster.agents.map((agent) => agent.getState()),
+        messageCount: snapshot.messageCount,
+        setupLogPath: cluster.setupLogPath || null,
+        setupStage: cluster.setupStage || null,
+        failureInfo: cluster.failureInfo || null,
+        runMode: cluster.runMode || null,
+      },
+    });
   }
 
   /**
@@ -4300,11 +4333,16 @@ Continue from where you left off. Review your previous output to understand what
    * @returns {Object} Cluster status
    */
   getStatus(clusterId) {
+    const finalRun = this._finalRuns.get(clusterId);
+    if (finalRun) return finalRun.status;
     const cluster = this.clusters.get(clusterId);
     if (!cluster) {
       throw new Error(`Cluster ${clusterId} not found`);
     }
+    return this._getLiveStatus(clusterId, cluster);
+  }
 
+  _getLiveStatus(clusterId, cluster) {
     // Detect zombie clusters: state=running but no backing process
     let state = cluster.state;
     let isZombie = false;
@@ -4388,6 +4426,10 @@ Continue from where you left off. Review your previous output to understand what
     return this.clusters.get(clusterId);
   }
 
+  getFinalRun(clusterId) {
+    return this._finalRuns.get(clusterId) || null;
+  }
+
   /**
    * Export cluster conversation
    * @param {String} clusterId - Cluster ID

package/src/preflight.js

@@ -29,6 +29,10 @@ const {
 } = require('../lib/provider-names');
 const { detectGitContext } = require('../lib/git-remote-utils');
 const { readKeychainCredentials } = require('./claude-credentials');
+const {
+  TASK_EXECUTION_CONTEXT_ENV,
+  resolveTaskExecutionContext,
+} = require('./task-execution-context');
 
 /**
  * Validation result
@@ -164,6 +168,13 @@ function checkClaudeAuth() {
     ...(method && { method }),
   });
 
+  // Claude Code supports gateway bearer authentication independently of Anthropic API keys.
+  // This is the documented path for OpenRouter and enterprise LLM gateways, where
+  // ANTHROPIC_API_KEY is intentionally present but empty to avoid credential conflicts.
+  if (process.env.ANTHROPIC_AUTH_TOKEN) {
+    return authResult(true, null, 'auth_token');
+  }
+
   // Check for Bedrock bearer token (highest priority)
   if (process.env.AWS_BEARER_TOKEN_BEDROCK) {
     if (!process.env.AWS_REGION) {
@@ -481,7 +492,7 @@ function validateProviderExecutionSettings(providerName, settings, options) {
     return [];
   }
 
-  const executionContext = options.requireDocker ? 'docker' : 'detached';
+  const executionContext = resolvePreflightExecutionContext(options);
   const error = metadata.settingsValidator(providerSettings, { executionContext });
   if (!error) return [];
 
@@ -519,11 +530,20 @@ function validateProvider(providerName, options) {
     return { errors: [...isolationErrors, ...result.errors], warnings: result.warnings };
   }
 
-  const result = validateRegistryCliProvider(providerName);
+  const result = validateRegistryCliProvider(
+    providerName,
+    resolvePreflightExecutionContext(options)
+  );
   return { errors: [...isolationErrors, ...result.errors], warnings: result.warnings };
 }
 
-function validateRegistryCliProvider(providerName) {
+function resolvePreflightExecutionContext(options) {
+  const executionContext =
+    options.executionContext ?? (options.requireDocker ? 'docker' : 'detached');
+  return resolveTaskExecutionContext({ [TASK_EXECUTION_CONTEXT_ENV]: executionContext });
+}
+
+function validateRegistryCliProvider(providerName, executionContext) {
   const metadata = getProviderMetadata(providerName);
   const { command } = resolveProviderCommand(providerName);
   const installSteps = metadata.installInstructions.split('\n').filter(Boolean);
@@ -537,7 +557,7 @@ function validateRegistryCliProvider(providerName) {
   }
 
   const { getProvider } = require('./providers');
-  if (getProvider(providerName).isAvailable()) {
+  if (getProvider(providerName).isAvailable({ executionContext })) {
     return { errors: [], warnings: [] };
   }
 
@@ -642,6 +662,7 @@ function validateGitRequirement() {
  * @param {boolean} options.quiet - Suppress success messages
  * @param {string} options.claudeCommand - Custom Claude command (from settings)
  * @param {string} options.provider - Provider override
+ * @param {'host'|'detached'|'docker'|'benchmark'} options.executionContext - Provider execution boundary
  * @returns {ValidationResult}
  */
 async function runPreflight(options = {}) {
@@ -670,10 +691,14 @@ async function runPreflight(options = {}) {
   const providerName = normalizeProviderName(
     options.provider || settings.defaultProvider || getDefaultProviderId()
   );
+  const providerOptions = {
+    ...options,
+    executionContext: resolvePreflightExecutionContext(options),
+  };
 
-  const providerResult = validateProvider(providerName, options);
+  const providerResult = validateProvider(providerName, providerOptions);
   errors.push(...providerResult.errors);
-  errors.push(...validateProviderExecutionSettings(providerName, settings, options));
+  errors.push(...validateProviderExecutionSettings(providerName, settings, providerOptions));
   warnings.push(...providerResult.warnings);
 
   // 4. Check issue provider CLI (if required)

package/src/providers/index.js

@@ -32,13 +32,13 @@ class RuntimeProvider extends BaseProvider {
     return this._adapter;
   }
 
-  isAvailable() {
+  isAvailable(context = {}) {
     if (this._usesBundledRunner()) {
-      return helper.probeRuntimeProviderCli(this.name).available;
+      return helper.probeRuntimeProviderCli(this.name, undefined, undefined, context).available;
     }
     const { command } = resolveProviderCommand(this.name);
     if (!commandExists(command)) return false;
-    return helper.probeRuntimeProviderCli(this.name).available;
+    return helper.probeRuntimeProviderCli(this.name, undefined, undefined, context).available;
   }
 
   getCliPath() {

package/src/task-execution-context.js

@@ -0,0 +1,22 @@
+'use strict';
+
+const TASK_EXECUTION_CONTEXT_ENV = 'ZEROSHOT_TASK_EXECUTION_CONTEXT';
+const TASK_EXECUTION_CONTEXTS = Object.freeze(['host', 'detached', 'docker', 'benchmark']);
+const taskExecutionContexts = new Set(TASK_EXECUTION_CONTEXTS);
+
+function resolveTaskExecutionContext(environment = process.env) {
+  const context = environment[TASK_EXECUTION_CONTEXT_ENV];
+  if (context === undefined) return 'detached';
+  if (!taskExecutionContexts.has(context)) {
+    throw new Error(
+      `${TASK_EXECUTION_CONTEXT_ENV} must be one of: ${TASK_EXECUTION_CONTEXTS.join(', ')}.`
+    );
+  }
+  return context;
+}
+
+module.exports = {
+  TASK_EXECUTION_CONTEXT_ENV,
+  TASK_EXECUTION_CONTEXTS,
+  resolveTaskExecutionContext,
+};

package/src/watcher-prompt-channel.js

@@ -4,7 +4,7 @@
  * The OMP prompt is task content (repository text, instructions, whatever a caller pasted in), so
  * it must never travel in the watcher's argv: `ps` and /proc/<pid>/cmdline expose argv to every
  * local user for the entire lifetime of a long-lived watcher. task-lib/runner.js therefore hands
- * the prompt to task-lib/rpc-watcher.js over the anonymous stdin pipe fork() creates for it. The
+ * the prompt to task-lib/rpc-watcher.js over its anonymous stdin pipe. The
  * pipe has exactly two ends and no name, so nothing is written to the filesystem, the task log, or
  * the ledger while the prompt is in transit.
  *

package/src/worktree-claude-config.js

@@ -12,6 +12,11 @@ const CLAUDE_SETTINGS_ENV = 'ZEROSHOT_CLAUDE_SETTINGS_FILE';
 const CLAUDE_MCP_CONFIG_ENV = 'ZEROSHOT_CLAUDE_MCP_CONFIG_FILE';
 const ASK_USER_HOOK = 'block-ask-user-question.py';
 const DANGEROUS_GIT_HOOK = 'block-dangerous-git.py';
+const ALTERNATE_BACKEND_ENV = [
+    'CLAUDE_CODE_USE_BEDROCK',
+    'CLAUDE_CODE_USE_VERTEX',
+    'CLAUDE_CODE_USE_FOUNDRY',
+];
 function isMutableRecord(value) {
     return typeof value === 'object' && value !== null;
 }
@@ -109,6 +114,25 @@ function ensureDangerousGitHook(targetClaudeDir) {
         writeSettings(settingsPath, settings);
     }
 }
+function ensureExplicitGatewayBackend(targetClaudeDir, environment) {
+    if (!environment.ANTHROPIC_AUTH_TOKEN?.trim() || !environment.ANTHROPIC_BASE_URL?.trim())
+        return;
+    const overlayDir = requireTargetClaudeDir(targetClaudeDir);
+    const settingsPath = path.join(overlayDir, SETTINGS_BASENAME);
+    const settings = readSettings(settingsPath);
+    const existingEnv = settings.env;
+    let env = {};
+    if (existingEnv !== undefined) {
+        if (!isMutableRecord(existingEnv)) {
+            throw new TypeError('Claude settings env must be an object.');
+        }
+        env = { ...existingEnv };
+    }
+    for (const name of ALTERNATE_BACKEND_ENV)
+        env[name] = '0';
+    settings.env = env;
+    writeSettings(settingsPath, settings);
+}
 function prepareClaudeSettingsOverlay(options = {}) {
     const overlayDir = fs.mkdtempSync(path.join(os.tmpdir(), OVERLAY_PREFIX));
     fs.chmodSync(overlayDir, 0o700);
@@ -116,6 +140,7 @@ function prepareClaudeSettingsOverlay(options = {}) {
         ensureAskUserQuestionHook(overlayDir);
         if (options.includeDangerousGit)
             ensureDangerousGitHook(overlayDir);
+        ensureExplicitGatewayBackend(overlayDir, options.environment || process.env);
         return path.join(overlayDir, SETTINGS_BASENAME);
     }
     catch (error) {

package/src/worktree-claude-config.ts

@@ -19,6 +19,7 @@ interface HookEntry {
 
 interface OverlayOptions {
   includeDangerousGit?: boolean;
+  environment?: NodeJS.ProcessEnv;
 }
 
 interface WorktreeOptions {
@@ -34,6 +35,11 @@ const CLAUDE_SETTINGS_ENV = 'ZEROSHOT_CLAUDE_SETTINGS_FILE';
 const CLAUDE_MCP_CONFIG_ENV = 'ZEROSHOT_CLAUDE_MCP_CONFIG_FILE';
 const ASK_USER_HOOK = 'block-ask-user-question.py';
 const DANGEROUS_GIT_HOOK = 'block-dangerous-git.py';
+const ALTERNATE_BACKEND_ENV = [
+  'CLAUDE_CODE_USE_BEDROCK',
+  'CLAUDE_CODE_USE_VERTEX',
+  'CLAUDE_CODE_USE_FOUNDRY',
+] as const;
 
 function isMutableRecord(value: unknown): value is MutableRecord {
   return typeof value === 'object' && value !== null;
@@ -155,12 +161,34 @@ function ensureDangerousGitHook(targetClaudeDir: unknown): void {
   }
 }
 
+function ensureExplicitGatewayBackend(
+  targetClaudeDir: unknown,
+  environment: NodeJS.ProcessEnv
+): void {
+  if (!environment.ANTHROPIC_AUTH_TOKEN?.trim() || !environment.ANTHROPIC_BASE_URL?.trim()) return;
+  const overlayDir = requireTargetClaudeDir(targetClaudeDir);
+  const settingsPath = path.join(overlayDir, SETTINGS_BASENAME);
+  const settings = readSettings(settingsPath);
+  const existingEnv = settings.env;
+  let env: MutableRecord = {};
+  if (existingEnv !== undefined) {
+    if (!isMutableRecord(existingEnv)) {
+      throw new TypeError('Claude settings env must be an object.');
+    }
+    env = { ...existingEnv };
+  }
+  for (const name of ALTERNATE_BACKEND_ENV) env[name] = '0';
+  settings.env = env;
+  writeSettings(settingsPath, settings);
+}
+
 function prepareClaudeSettingsOverlay(options: OverlayOptions = {}): string {
   const overlayDir = fs.mkdtempSync(path.join(os.tmpdir(), OVERLAY_PREFIX));
   fs.chmodSync(overlayDir, 0o700);
   try {
     ensureAskUserQuestionHook(overlayDir);
     if (options.includeDangerousGit) ensureDangerousGitHook(overlayDir);
+    ensureExplicitGatewayBackend(overlayDir, options.environment || process.env);
     return path.join(overlayDir, SETTINGS_BASENAME);
   } catch (error) {
     fs.rmSync(overlayDir, { recursive: true, force: true });

package/task-lib/runner.js

@@ -1,5 +1,5 @@
-import { fork } from 'child_process';
-import { join, dirname, resolve as resolvePath } from 'path';
+import { execFileSync, spawn } from 'child_process';
+import { isAbsolute, join, dirname, relative, resolve as resolvePath } from 'path';
 import { fileURLToPath } from 'url';
 import { mkdirSync } from 'fs';
 import { LOGS_DIR } from './config.js';
@@ -17,6 +17,8 @@ import {
 import { createRequire } from 'module';
 
 const require = createRequire(import.meta.url);
+const { resolveTaskExecutionContext } = require('../src/task-execution-context.js');
+export { resolveTaskExecutionContext };
 const {
   buildOmpPrompt,
   getProviderRegistryEntry,
@@ -43,8 +45,6 @@ const {
   partitionPathFor,
   createOmpSessionPartitionDirectory,
 } = require('../src/omp-session-partition');
-const TASK_EXECUTION_CONTEXT_ENV = 'ZEROSHOT_TASK_EXECUTION_CONTEXT';
-const TASK_EXECUTION_CONTEXTS = new Set(['host', 'detached', 'docker', 'benchmark']);
 export {
   isOwnedProcessTreeRunning,
   isProcessRunning,
@@ -401,8 +401,22 @@ function resolveOutputFormat(options) {
 }
 
 function resolveJsonSchema(options, outputFormat) {
-  let jsonSchema = options.jsonSchema || null;
-  if (jsonSchema && outputFormat !== 'json') {
+  let jsonSchema = options.jsonSchema ?? null;
+  if (typeof jsonSchema === 'string') {
+    try {
+      jsonSchema = JSON.parse(jsonSchema);
+    } catch (error) {
+      throw new Error(`--json-schema must be valid JSON: ${error.message}`);
+    }
+  }
+  if (
+    jsonSchema !== null &&
+    typeof jsonSchema !== 'boolean' &&
+    (typeof jsonSchema !== 'object' || Array.isArray(jsonSchema))
+  ) {
+    throw new Error('--json-schema must be a boolean or JSON Schema object.');
+  }
+  if (jsonSchema !== null && outputFormat !== 'json') {
     console.warn('Warning: --json-schema requires --output-format json, ignoring schema');
     jsonSchema = null;
   }
@@ -411,11 +425,13 @@ function resolveJsonSchema(options, outputFormat) {
 
 function buildProviderOptions(options, runtime, modelSelection) {
   const structuredOutputRecovery = options.structuredOutputRecovery === true;
+  const executionContext = resolveTaskExecutionContext();
   return {
     outputFormat: runtime.outputFormat,
     jsonSchema: runtime.jsonSchema,
     cwd: runtime.cwd,
-    executionContext: resolveTaskExecutionContext(),
+    ...codexGitMetadataOption(options, runtime.cwd, executionContext),
+    executionContext,
     autoApprove: !structuredOutputRecovery,
     ...(modelSelection === undefined ? {} : { modelSpec: modelSelection.modelSpec }),
     ...(structuredOutputRecovery ? {} : mcpConfigOption(options)),
@@ -430,15 +446,35 @@ function buildProviderOptions(options, runtime, modelSelection) {
   };
 }
 
-export function resolveTaskExecutionContext(environment = process.env) {
-  const context = environment[TASK_EXECUTION_CONTEXT_ENV];
-  if (context === undefined) return 'detached';
-  if (!TASK_EXECUTION_CONTEXTS.has(context)) {
-    throw new Error(
-      `${TASK_EXECUTION_CONTEXT_ENV} must be one of: ${[...TASK_EXECUTION_CONTEXTS].join(', ')}.`
-    );
+function codexGitMetadataOption(options, cwd, executionContext) {
+  const settings = loadSettings();
+  const providerName = normalizeProviderName(
+    options.provider || settings.defaultProvider || getDefaultProviderId()
+  );
+  if (providerName !== 'codex') return {};
+  if (executionContext === 'docker' || executionContext === 'benchmark') return {};
+  const directories = resolveCodexGitMetadataDirectories(cwd);
+  return directories.length === 0 ? {} : { additionalWritableDirectories: directories };
+}
+
+export function resolveCodexGitMetadataDirectories(cwd, runGit = execFileSync) {
+  try {
+    const raw = runGit('git', ['rev-parse', '--git-common-dir'], {
+      cwd,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    const commonDirectory = resolvePath(cwd, raw.trim());
+    const fromWorkspace = relative(resolvePath(cwd), commonDirectory);
+    const outsideWorkspace =
+      isAbsolute(fromWorkspace) ||
+      fromWorkspace === '..' ||
+      fromWorkspace.startsWith('../') ||
+      fromWorkspace.startsWith('..\\');
+    return outsideWorkspace ? [commonDirectory] : [];
+  } catch {
+    return [];
   }
-  return context;
 }
 
 function claudeSettingsFileOption() {
@@ -655,14 +691,14 @@ function resolveWatcherScript(options, providerName, invoke) {
 function spawnWatcher({ watcherScript, id, cwd, logFile, finalArgs, watcherConfig, rpcPrompt }) {
   const sendsPrompt = typeof rpcPrompt === 'string';
   const watcherEnv = buildWatcherEnv();
-  const watcher = fork(
-    watcherScript,
-    [id, cwd, logFile, JSON.stringify(finalArgs), JSON.stringify(watcherConfig)],
+  const watcher = spawn(
+    process.execPath,
+    [watcherScript, id, cwd, logFile, JSON.stringify(finalArgs), JSON.stringify(watcherConfig)],
     {
       detached: true,
-      // A prompt-carrying lane needs a real pipe on fd 0 to receive it; every other lane keeps
-      // stdio fully ignored. fork() requires an explicit 'ipc' slot once stdio is an array.
-      stdio: sendsPrompt ? ['pipe', 'ignore', 'ignore', 'ipc'] : 'ignore',
+      // A prompt-carrying lane needs only a private stdin pipe; detached watchers have no parent
+      // messaging contract, so an IPC channel would add a second, racy wrapper-lifetime owner.
+      stdio: sendsPrompt ? ['pipe', 'ignore', 'ignore'] : 'ignore',
       windowsHide: true,
       env: watcherEnv,
     }
@@ -673,7 +709,6 @@ function spawnWatcher({ watcherScript, id, cwd, logFile, finalArgs, watcherConfi
   if (sendsPrompt) sendWatcherPrompt(watcher.stdin, rpcPrompt);
 
   watcher.unref();
-  watcher.disconnect(); // Close IPC channel so parent can exit
 }
 
 export function buildWatcherEnv(sourceEnv = process.env) {