@the-open-engine/zeroshot 6.4.0 → 6.6.0

package/scripts/live-provider-smoke.js

@@ -0,0 +1,221 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const helper = require('../lib/agent-cli-provider');
+
+const SENTINEL = process.env.ZEROSHOT_LIVE_SENTINEL || 'ZEROSHOT_LIVE_SMOKE_OK';
+const TIMEOUT_MS = Number(process.env.ZEROSHOT_LIVE_TIMEOUT_MS || 120000);
+const DEFAULT_PROMPT = `Reply with exactly this text and nothing else: ${SENTINEL}`;
+
+function fail(message) {
+  console.error(message);
+  process.exitCode = 1;
+}
+
+function usage() {
+  return [
+    'Live provider smoke requires explicit provider selection.',
+    '',
+    'Examples:',
+    '  ZEROSHOT_LIVE_PROVIDERS=all npm run test:providers:live',
+    '  ZEROSHOT_LIVE_PROVIDERS=claude,codex,gemini npm run test:providers:live',
+    '  ZEROSHOT_LIVE_PROVIDERS=pi npm run test:providers:live',
+    '  ZEROSHOT_LIVE_PROVIDERS=copilot npm run test:providers:live',
+    '  ZEROSHOT_LIVE_PROVIDERS=gateway \\',
+    '    ZEROSHOT_LIVE_GATEWAY_BASE_URL=https://openrouter.ai/api/v1 \\',
+    '    ZEROSHOT_LIVE_GATEWAY_API_KEY=... \\',
+    '    ZEROSHOT_LIVE_GATEWAY_MODEL=openai/gpt-5.4 \\',
+    '    npm run test:providers:live',
+    '',
+    'This command invokes real provider CLIs or a real gateway endpoint. It is intentionally',
+    'not part of the normal CI suite because it can require user auth and paid API calls.',
+  ].join('\n');
+}
+
+function parseProviders() {
+  const raw = process.env.ZEROSHOT_LIVE_PROVIDERS;
+  if (!raw) {
+    console.error(usage());
+    process.exit(2);
+  }
+
+  const providers = [];
+  const allProviders = helper.listProviderAdapters();
+  for (const item of raw.split(',')) {
+    const trimmed = item.trim();
+    if (trimmed.toLowerCase() === 'all') {
+      for (const provider of allProviders) {
+        if (!providers.includes(provider)) providers.push(provider);
+      }
+      continue;
+    }
+
+    const normalized = helper.normalizeProviderName(trimmed);
+    if (!normalized) continue;
+    if (!allProviders.includes(normalized)) {
+      throw new Error(
+        `Unknown provider "${item}". Valid providers: ${allProviders.join(', ')}, all`
+      );
+    }
+    if (!providers.includes(normalized)) providers.push(normalized);
+  }
+
+  if (providers.length === 0) {
+    throw new Error('ZEROSHOT_LIVE_PROVIDERS did not contain any provider names.');
+  }
+  return providers;
+}
+
+function readJsonEnv(key) {
+  const value = process.env[key];
+  if (!value) return undefined;
+  try {
+    return JSON.parse(value);
+  } catch (error) {
+    throw new Error(`${key} must be valid JSON: ${error.message}`);
+  }
+}
+
+function liveGatewayOptions(cwd) {
+  const baseUrl = process.env.ZEROSHOT_LIVE_GATEWAY_BASE_URL;
+  const apiKey = process.env.ZEROSHOT_LIVE_GATEWAY_API_KEY;
+  const model = process.env.ZEROSHOT_LIVE_GATEWAY_MODEL;
+  const headers = readJsonEnv('ZEROSHOT_LIVE_GATEWAY_HEADERS_JSON');
+
+  for (const [key, value] of [
+    ['ZEROSHOT_LIVE_GATEWAY_BASE_URL', baseUrl],
+    ['ZEROSHOT_LIVE_GATEWAY_API_KEY', apiKey],
+    ['ZEROSHOT_LIVE_GATEWAY_MODEL', model],
+  ]) {
+    if (!value) throw new Error(`gateway live smoke requires ${key}.`);
+  }
+
+  return {
+    cwd,
+    gateway: {
+      baseUrl,
+      apiKey,
+      model,
+      ...(headers === undefined ? {} : { headers }),
+      toolPolicy: {
+        roots: ['.'],
+        commands: [],
+      },
+    },
+  };
+}
+
+function providerOptions(provider, cwd) {
+  if (provider === 'gateway') return liveGatewayOptions(cwd);
+
+  return {
+    cwd,
+    outputFormat: 'stream-json',
+  };
+}
+
+function eventText(event) {
+  if (!event || typeof event !== 'object') return '';
+  if (event.type === 'text' || event.type === 'thinking') return event.text || '';
+  if (event.type === 'result') {
+    return [event.result, event.text, event.message].filter(Boolean).join('\n');
+  }
+  return '';
+}
+
+function summarizeResult(envelope) {
+  if (!envelope || typeof envelope !== 'object') return 'no envelope';
+  if (!envelope.ok) {
+    const error = envelope.error || {};
+    return `${error.code || 'error'}: ${error.message || 'unknown failure'}`;
+  }
+
+  const result = envelope.result || {};
+  const events = Array.isArray(result.events) ? result.events : [];
+  const text = events.map(eventText).join('\n').trim();
+  const last = events.at(-1);
+  return JSON.stringify(
+    {
+      provider: envelope.provider,
+      exitCode: result.exitCode,
+      signal: result.signal,
+      timedOut: result.timedOut,
+      classification: result.classification || null,
+      eventCount: events.length,
+      lastEventType: last && typeof last === 'object' ? last.type : null,
+      text: text.slice(0, 500),
+    },
+    null,
+    2
+  );
+}
+
+function assertSmokePassed(provider, response) {
+  if (response.exitCode !== 0) {
+    throw new Error(
+      `${provider} contract exited ${response.exitCode}: ${summarizeResult(response.envelope)}`
+    );
+  }
+  if (!response.envelope.ok) {
+    throw new Error(`${provider} returned a contract error: ${summarizeResult(response.envelope)}`);
+  }
+
+  const result = response.envelope.result || {};
+  const events = Array.isArray(result.events) ? result.events : [];
+  const text = events.map(eventText).join('\n');
+  const finalResult = events.findLast((event) => event && event.type === 'result');
+
+  if (result.timedOut) {
+    throw new Error(`${provider} timed out after ${result.timeoutMs || TIMEOUT_MS}ms.`);
+  }
+  if (finalResult && finalResult.success === false) {
+    throw new Error(
+      `${provider} produced a failed result event: ${summarizeResult(response.envelope)}`
+    );
+  }
+  if (!text.includes(SENTINEL)) {
+    throw new Error(
+      `${provider} did not return sentinel ${SENTINEL}.\nResult:\n${summarizeResult(response.envelope)}`
+    );
+  }
+}
+
+async function smokeProvider(provider) {
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), `zeroshot-live-${provider}-`));
+  try {
+    const prompt = process.env.ZEROSHOT_LIVE_PROMPT || DEFAULT_PROMPT;
+    const response = await helper.runProviderExecutable(
+      JSON.stringify({
+        schemaVersion: 1,
+        command: 'invoke',
+        provider,
+        context: prompt,
+        options: providerOptions(provider, tempDir),
+        timeoutMs: TIMEOUT_MS,
+      })
+    );
+
+    assertSmokePassed(provider, response);
+    console.log(`✓ ${provider} live smoke returned ${SENTINEL}`);
+  } finally {
+    fs.rmSync(tempDir, { recursive: true, force: true });
+  }
+}
+
+async function main() {
+  const providers = parseProviders();
+  console.log(`Running live provider smoke for: ${providers.join(', ')}`);
+  console.log(`Sentinel: ${SENTINEL}`);
+
+  for (const provider of providers) {
+    await smokeProvider(provider);
+  }
+}
+
+main().catch((error) => {
+  fail(error.stack || error.message || String(error));
+});

package/scripts/release-preflight.js

@@ -0,0 +1,236 @@
+#!/usr/bin/env node
+
+const fs = require('fs');
+const https = require('https');
+const { execFileSync } = require('child_process');
+
+const RELEASE_ORDER = ['patch', 'minor', 'major'];
+const REQUIRED_PLUGINS = [
+  '@semantic-release/commit-analyzer',
+  '@semantic-release/release-notes-generator',
+  '@semantic-release/npm',
+  '@semantic-release/github',
+];
+const FORBIDDEN_EFFECTIVE_PLUGINS = new Set([
+  '@semantic-release/changelog',
+  '@semantic-release/git',
+]);
+
+function normalizePlugin(plugin) {
+  return Array.isArray(plugin) ? plugin[0] : plugin;
+}
+
+function releaseRank(type) {
+  return RELEASE_ORDER.indexOf(type);
+}
+
+function maxReleaseType(current, candidate) {
+  if (!candidate) return current;
+  if (!current) return candidate;
+  return releaseRank(candidate) > releaseRank(current) ? candidate : current;
+}
+
+function analyzeMessage(message) {
+  const firstLine = String(message || '')
+    .split(/\r?\n/, 1)[0]
+    .trim();
+  if (!firstLine) return null;
+  if (/BREAKING CHANGE:|BREAKING-CHANGE:/m.test(message)) return 'major';
+
+  const separator = firstLine.indexOf(': ');
+  if (separator <= 0) return null;
+
+  const header = firstLine.slice(0, separator);
+  const breaking = header.endsWith('!');
+  const typeAndScope = breaking ? header.slice(0, -1) : header;
+  const scopeStart = typeAndScope.indexOf('(');
+  const type = scopeStart === -1 ? typeAndScope : typeAndScope.slice(0, scopeStart);
+
+  if (!/^[a-z][a-z0-9-]*$/i.test(type)) return null;
+  if (breaking) return 'major';
+
+  switch (type) {
+    case 'release':
+    case 'feat':
+      return 'minor';
+    case 'fix':
+    case 'perf':
+      return 'patch';
+    default:
+      return null;
+  }
+}
+
+function getPluginNames(releaseConfig) {
+  return (releaseConfig.plugins || []).map(normalizePlugin);
+}
+
+function validateReleaseConfig(packageJson) {
+  const releaseConfig = packageJson.release;
+  if (!releaseConfig || typeof releaseConfig !== 'object') {
+    throw new Error(
+      'package.json#release is required so it takes precedence over stale .releaserc files'
+    );
+  }
+
+  const branches = Array.isArray(releaseConfig.branches)
+    ? releaseConfig.branches
+    : [releaseConfig.branches].filter(Boolean);
+  if (!branches.includes('main')) {
+    throw new Error('package.json#release.branches must include main');
+  }
+
+  const pluginNames = getPluginNames(releaseConfig);
+  for (const required of REQUIRED_PLUGINS) {
+    if (!pluginNames.includes(required)) {
+      throw new Error(`package.json#release.plugins is missing ${required}`);
+    }
+  }
+
+  for (const forbidden of FORBIDDEN_EFFECTIVE_PLUGINS) {
+    if (pluginNames.includes(forbidden)) {
+      throw new Error(
+        `${forbidden} must not be in the effective release config for protected main`
+      );
+    }
+  }
+
+  const npmPlugin = releaseConfig.plugins.find(
+    (plugin) => normalizePlugin(plugin) === '@semantic-release/npm'
+  );
+  const npmOptions = Array.isArray(npmPlugin) ? npmPlugin[1] || {} : {};
+  if (npmOptions.npmPublish !== true) {
+    throw new Error('@semantic-release/npm must publish to npm');
+  }
+
+  return pluginNames;
+}
+
+function readJson(path) {
+  return JSON.parse(fs.readFileSync(path, 'utf8'));
+}
+
+function git(args) {
+  return execFileSync('git', args, { encoding: 'utf8' }).trim();
+}
+
+function latestReleaseTag() {
+  return git(['describe', '--tags', '--abbrev=0', '--match', 'v[0-9]*']);
+}
+
+function commitMessagesSince(tag) {
+  const output = git(['log', '--format=%B%x1e', `${tag}..HEAD`]);
+  return output
+    .split('\x1e')
+    .map((message) => message.trim())
+    .filter(Boolean);
+}
+
+function prTitleFromEvent() {
+  const eventPath = process.env.GITHUB_EVENT_PATH;
+  if (!eventPath || !fs.existsSync(eventPath)) return null;
+  const event = readJson(eventPath);
+  return event.pull_request?.title || null;
+}
+
+function prNumberFromMergeQueueRef() {
+  const refName = process.env.GITHUB_REF_NAME || process.env.GITHUB_REF || '';
+  const match = refName.match(/(?:^|\/)pr-(\d+)-/);
+  return match ? match[1] : null;
+}
+
+function githubJson(path) {
+  const token = process.env.GITHUB_TOKEN;
+  const repository = process.env.GITHUB_REPOSITORY;
+  if (!token || !repository) return Promise.resolve(null);
+
+  return new Promise((resolve, reject) => {
+    const request = https.request(
+      {
+        hostname: 'api.github.com',
+        path: `/repos/${repository}${path}`,
+        headers: {
+          Accept: 'application/vnd.github+json',
+          Authorization: `Bearer ${token}`,
+          'User-Agent': 'zeroshot-release-preflight',
+          'X-GitHub-Api-Version': '2022-11-28',
+        },
+      },
+      (response) => {
+        let body = '';
+        response.setEncoding('utf8');
+        response.on('data', (chunk) => {
+          body += chunk;
+        });
+        response.on('end', () => {
+          if (response.statusCode < 200 || response.statusCode >= 300) {
+            reject(new Error(`GitHub API ${path} returned ${response.statusCode}: ${body}`));
+            return;
+          }
+          resolve(JSON.parse(body));
+        });
+      }
+    );
+    request.on('error', reject);
+    request.end();
+  });
+}
+
+async function prTitleFromMergeQueue() {
+  const number = prNumberFromMergeQueueRef();
+  if (!number) return null;
+  const pull = await githubJson(`/pulls/${number}`);
+  return pull?.title || null;
+}
+
+async function releaseSignal() {
+  const tag = latestReleaseTag();
+  const messages = commitMessagesSince(tag);
+  let releaseType = null;
+  for (const message of messages) {
+    releaseType = maxReleaseType(releaseType, analyzeMessage(message));
+  }
+
+  let title = prTitleFromEvent();
+  if (!title) title = await prTitleFromMergeQueue();
+  releaseType = maxReleaseType(releaseType, analyzeMessage(title));
+
+  return {
+    latestTag: tag,
+    commitCount: messages.length,
+    prTitle: title,
+    releaseType,
+  };
+}
+
+async function main() {
+  const packageJson = readJson('package.json');
+  const pluginNames = validateReleaseConfig(packageJson);
+  const signal = await releaseSignal();
+
+  console.log(`Effective release plugins: ${pluginNames.join(', ')}`);
+  console.log(`Latest release tag: ${signal.latestTag}`);
+  console.log(`Commits since tag: ${signal.commitCount}`);
+  if (signal.prTitle) console.log(`Release PR title: ${signal.prTitle}`);
+
+  if (!signal.releaseType) {
+    throw new Error(
+      'Release promotion would publish nothing; use a release-worthy PR title/commit'
+    );
+  }
+
+  console.log(`Release preflight passed: ${signal.releaseType}`);
+}
+
+if (require.main === module) {
+  main().catch((error) => {
+    console.error(`Release preflight failed: ${error.message}`);
+    process.exit(1);
+  });
+}
+
+module.exports = {
+  analyzeMessage,
+  maxReleaseType,
+  validateReleaseConfig,
+};

package/src/agent/agent-lifecycle.js

@@ -61,10 +61,6 @@ async function createValidatorIsolation(agent, isolationConfig) {
 
   const cluster = agent.cluster || {};
   const workDir = agent.config?.cwd || cluster.worktree?.path || cluster.cwd || process.cwd();
-  const image = isolationConfig.image;
-  await IsolationManager.ensureImage(image);
-
-  const manager = new IsolationManager({ image });
   const providerName = normalizeProviderName(
     (agent._resolveProvider && agent._resolveProvider()) ||
       cluster.config?.forceProvider ||
@@ -72,6 +68,11 @@ async function createValidatorIsolation(agent, isolationConfig) {
       loadSettings().defaultProvider ||
       'claude'
   );
+  // Run validators on the provider's image variant (installs its CLI as a Docker-cached layer).
+  const image = IsolationManager.imageForProvider(providerName, isolationConfig.image);
+  await IsolationManager.ensureImage(image, true, IsolationManager.providerBuildArgs(providerName));
+
+  const manager = new IsolationManager({ image });
 
   const isolationClusterId = `${cluster.id}-validators`;
   const containerId = await manager.createContainer(isolationClusterId, {

package/src/agent/agent-quality-gate-schema.js

@@ -41,11 +41,11 @@ function buildQualityGateSchema() {
           required: ['command', 'exitCode', 'output'],
         },
         completedAt: {
-          type: ['string', 'number'],
+          anyOf: [{ type: 'string' }, { type: 'number' }],
           description: 'When the gate completed, as an ISO string or numeric timestamp.',
         },
         timestamp: {
-          type: ['string', 'number'],
+          anyOf: [{ type: 'string' }, { type: 'number' }],
           description: 'Alternate completion timestamp, as an ISO string or numeric timestamp.',
         },
         stale: {

package/src/agent/agent-task-executor.js

@@ -14,12 +14,15 @@ const { spawn, spawnSync } = require('child_process');
 const path = require('path');
 const fs = require('fs');
 const os = require('os');
-const { parseProviderChunk } = require('../providers');
+const { parseProviderChunk, getProvider } = require('../providers');
 const { getTask } = require('../../task-lib/store.js');
 const { loadSettings } = require('../../lib/settings.js');
 const { resolveClaudeAuth } = require('../../lib/settings/claude-auth.js');
 const { prependWorktreeToolBinToEnv } = require('../worktree-tooling-env.js');
-const { prepareClaudeConfigDir } = require('../worktree-claude-config.js');
+const {
+  prepareClaudeConfigDir,
+  resolveRepoMcpConfigPath,
+} = require('../worktree-claude-config.js');
 const { buildRawLogOnlyMetadata } = require('./context-replay-policy');
 
 function runCommandWithTimeout(command, args, options = {}, callback = null) {
@@ -733,9 +736,45 @@ function buildTaskRunArgs({ agent, providerName, modelSpec, runOutputFormat }) {
     args.push('--json-schema', schema);
   }
 
+  // MCP servers: providers whose CLI accepts an MCP config flag (e.g. Copilot's
+  // --additional-mcp-config) cannot use the Claude config-dir overlay, so forward the repo's
+  // `.mcp.json` (the same MCP source Claude consumes) inline via `--mcp-config`.
+  for (const mcpArg of resolveMcpConfigArgs(agent, providerName)) {
+    args.push(mcpArg);
+  }
+
   return args;
 }
 
+/**
+ * Build the `--mcp-config` args for a task-run invocation, or [] when they don't apply.
+ *
+ * Only providers whose adapter models an MCP config CLI flag receive it — Claude consumes MCP via
+ * the config-dir `.mcp.json` overlay (see prepareClaudeConfigDir) and needs no flag. The repo
+ * `.mcp.json` content is inlined (not passed as an @<path> reference) so the identical value works
+ * under local, worktree, and Docker isolation without host/container path translation.
+ */
+function resolveMcpConfigArgs(agent, providerName) {
+  if (!providerModelsMcpConfigFlag(providerName)) return [];
+
+  const mcpPath = resolveRepoMcpConfigPath({
+    cwd: agent.config?.cwd || process.cwd(),
+    worktreePath: agent.worktree?.path || null,
+  });
+  if (!mcpPath) return [];
+
+  const content = fs.readFileSync(mcpPath, 'utf8').trim();
+  if (content.length === 0) return [];
+
+  return ['--mcp-config', content];
+}
+
+/** True when the provider's adapter models an MCP config CLI flag (currently only Copilot). */
+function providerModelsMcpConfigFlag(providerName) {
+  const adapter = getProvider(providerName).adapter;
+  return 'supportsMcpConfig' in adapter.detectCliFeatures('');
+}
+
 function maybeLogStreamJsonNotice(agent, runOutputFormat) {
   if (agent.config.jsonSchema && runOutputFormat !== 'json' && !agent.quiet) {
     agent._log(