@the-open-engine/zeroshot 6.7.0 → 6.7.2

package/src/agent-cli-provider/adapters/claude.ts

@@ -4,7 +4,6 @@ import {
   type ClaudeCliFeatures,
   type CommandSpec,
   type ErrorClassification,
-  InvalidProviderModelError,
   type LevelModelSpec,
   type LevelOverrides,
   type ModelCatalogEntry,
@@ -28,8 +27,23 @@ import { parseClaudeEvent } from './claude-parser';
 
 const MODEL_CATALOG: Readonly<Record<string, ModelCatalogEntry>> = {
   haiku: { rank: 1 },
+  'claude-haiku-4-5': { rank: 1 },
+  'claude-haiku-4-5-20251001': { rank: 1 },
   sonnet: { rank: 2 },
+  'claude-sonnet-4-5': { rank: 2 },
+  'claude-sonnet-4-5-20250929': { rank: 2 },
+  'claude-sonnet-4-6': { rank: 2 },
+  'claude-sonnet-5': { rank: 2 },
   opus: { rank: 3 },
+  'claude-opus-4-5': { rank: 3 },
+  'claude-opus-4-5-20251101': { rank: 3 },
+  'claude-opus-4-6': { rank: 3 },
+  'claude-opus-4-7': { rank: 3 },
+  'claude-opus-4-8': { rank: 3 },
+  fable: { rank: 3 },
+  'claude-fable-5': { rank: 3 },
+  'claude-mythos-5': { rank: 3 },
+  'claude-mythos-preview': { rank: 3 },
 };
 
 const LEVEL_MAPPING: Readonly<Record<ModelLevel, LevelModelSpec>> = {
@@ -50,6 +64,7 @@ function detectCliFeatures(helpText?: string | null): ClaudeCliFeatures {
     supportsIncludePartials: unknown ? true : /--include-partial-messages/.test(help),
     supportsVerbose: unknown ? true : /--verbose/.test(help),
     supportsModel: unknown ? true : /--model/.test(help),
+    supportsEffort: unknown ? true : /--effort/.test(help),
     unknown,
   };
 }
@@ -86,6 +101,9 @@ function addModelArgs(args: string[], options: BuildProviderCommandOptions): voi
   if (options.modelSpec?.model && features.supportsModel !== false) {
     args.push('--model', options.modelSpec.model);
   }
+  if (options.modelSpec?.reasoningEffort && features.supportsEffort !== false) {
+    args.push('--effort', options.modelSpec.reasoningEffort);
+  }
 }
 
 function addAutoApproveArgs(args: string[], options: BuildProviderCommandOptions): void {
@@ -139,6 +157,15 @@ function collectWarnings(options: BuildProviderCommandOptions): WarningMetadata[
       )
     );
   }
+  if (options.modelSpec?.reasoningEffort && features.supportsEffort === false) {
+    warnings.push(
+      warning(
+        'claude',
+        'claude-reasoning',
+        'Claude CLI does not support --effort; skipping reasoningEffort.'
+      )
+    );
+  }
   return warnings;
 }
 
@@ -176,16 +203,7 @@ function resolveModelSpec(level: ModelLevel, overrides?: LevelOverrides): Resolv
 }
 
 function validateModelId(modelId: string | null | undefined): string | null | undefined {
-  try {
-    return validateModelIdFromCatalog('claude', MODEL_CATALOG, modelId);
-  } catch (error) {
-    if (modelId && (modelId === 'opus-4.6' || modelId === 'claude-opus-4-6')) {
-      throw new InvalidProviderModelError(
-        `Invalid model "${modelId}" for provider "claude". Use canonical model ids: haiku, sonnet, opus.`
-      );
-    }
-    throw error;
-  }
+  return validateModelIdFromCatalog('claude', MODEL_CATALOG, modelId);
 }
 
 function classifyError(error: unknown): ErrorClassification {

package/src/agent-cli-provider/adapters/codex.ts

@@ -27,6 +27,10 @@ import { parseCodexEvent } from './codex-parser';
 const MODEL_CATALOG: Readonly<Record<string, ModelCatalogEntry>> = {
   'gpt-5.4': { rank: 2 },
   'gpt-5.5': { rank: 3 },
+  'gpt-5.6': { rank: 3 },
+  'gpt-5.6-sol': { rank: 3 },
+  'gpt-5.6-terra': { rank: 2 },
+  'gpt-5.6-luna': { rank: 1 },
 };
 
 const LEVEL_MAPPING: Readonly<Record<ModelLevel, LevelModelSpec>> = {

package/src/agent-cli-provider/adapters/common.ts

@@ -100,8 +100,9 @@ export function validateModelIdFromCatalog(
 ): string | null | undefined {
   if (!modelId) return modelId;
   if (catalog[modelId] !== undefined) return modelId;
+  const validModels = Object.keys(catalog).join(', ');
   throw new InvalidProviderModelError(
-    `Invalid model "${modelId}" for provider "${provider}". Use a model listed in provider settings/catalog.`
+    `Invalid model "${modelId}" for provider "${provider}". Valid models: ${validModels}.`
   );
 }
 

package/src/agent-cli-provider/contract-options.ts

@@ -13,7 +13,7 @@ import type {
 
 const OUTPUT_FORMATS: readonly OutputFormat[] = ['text', 'json', 'stream-json'];
 const MODEL_LEVELS: readonly ModelLevel[] = ['level1', 'level2', 'level3'];
-const REASONING_EFFORTS: readonly ReasoningEffort[] = ['low', 'medium', 'high', 'xhigh'];
+const REASONING_EFFORTS: readonly ReasoningEffort[] = ['low', 'medium', 'high', 'xhigh', 'max'];
 const CLI_FEATURE_FIELDS = [
   'supportsOutputFormat',
   'supportsStreamJson',
@@ -22,6 +22,7 @@ const CLI_FEATURE_FIELDS = [
   'supportsIncludePartials',
   'supportsVerbose',
   'supportsModel',
+  'supportsEffort',
   'supportsJson',
   'supportsOutputSchema',
   'supportsDir',

package/src/agent-cli-provider/index.ts

@@ -91,6 +91,7 @@ export type {
   ProviderId,
   ProviderRegistryEntry,
   RedactionMetadata,
+  ReasoningEffort,
   ResolvedGatewayBuildOptions,
   ResolvedModelSpec,
   ResultEvent,

package/src/agent-cli-provider/provider-registry.ts

@@ -160,7 +160,7 @@ export const providerRegistry = [
     capabilities: {
       ...STANDARD_CAPABILITIES,
       jsonSchema: true,
-      reasoningEffort: false,
+      reasoningEffort: true,
     },
     docs: {
       label: 'Claude',

package/src/agent-cli-provider/single-agent-runtime.ts

@@ -61,7 +61,7 @@ type MutableModelSpec = {
 };
 
 const MODEL_LEVELS: readonly ModelLevel[] = ['level1', 'level2', 'level3'];
-const REASONING_EFFORTS: readonly ReasoningEffort[] = ['low', 'medium', 'high', 'xhigh'];
+const REASONING_EFFORTS: readonly ReasoningEffort[] = ['low', 'medium', 'high', 'xhigh', 'max'];
 const settingsModule: unknown = require('../../lib/settings');
 const providerDetectionModule: unknown = require('../../lib/provider-detection');
 const claudeAuthModule: unknown = require('../../lib/settings/claude-auth');
@@ -420,7 +420,13 @@ function optionalModelLevel(value: unknown, field: string): ModelLevel | undefin
 
 function optionalReasoningEffort(value: unknown, field: string): ReasoningEffort | undefined {
   if (value === undefined) return undefined;
-  if (value === 'low' || value === 'medium' || value === 'high' || value === 'xhigh') {
+  if (
+    value === 'low' ||
+    value === 'medium' ||
+    value === 'high' ||
+    value === 'xhigh' ||
+    value === 'max'
+  ) {
     return value;
   }
   throw new Error(`${field} must be one of: ${REASONING_EFFORTS.join(', ')}.`);

package/src/agent-cli-provider/types.ts

@@ -15,7 +15,7 @@ export type ProviderId = (typeof providerIds)[number];
 export type ProviderAlias = (typeof providerAliases)[number];
 export type KnownProviderName = ProviderId | ProviderAlias;
 export type ModelLevel = 'level1' | 'level2' | 'level3';
-export type ReasoningEffort = 'low' | 'medium' | 'high' | 'xhigh';
+export type ReasoningEffort = 'low' | 'medium' | 'high' | 'xhigh' | 'max';
 export type OutputFormat = 'text' | 'json' | 'stream-json';
 export type {
   ProviderCapabilities,
@@ -95,6 +95,7 @@ export interface ClaudeCliFeatures extends BaseCliFeatures {
   readonly supportsIncludePartials: boolean;
   readonly supportsVerbose: boolean;
   readonly supportsModel: boolean;
+  readonly supportsEffort: boolean;
 }
 
 export interface CodexCliFeatures extends BaseCliFeatures {
@@ -186,6 +187,7 @@ export interface CliFeatureOverrides {
   readonly supportsIncludePartials?: boolean;
   readonly supportsVerbose?: boolean;
   readonly supportsModel?: boolean;
+  readonly supportsEffort?: boolean;
   readonly supportsJson?: boolean;
   readonly supportsOutputSchema?: boolean;
   readonly supportsDir?: boolean;

package/src/agent-wrapper.js

@@ -81,8 +81,15 @@ class AgentWrapper {
     // LIVENESS DETECTION - Track output freshness to detect stuck agents
     /** @type {number | null} */
     this.lastOutputTime = null; // Timestamp of last output received
+    /** @type {number | null} */
+    this.taskStartedAt = null; // Timestamp used for absolute task timeout
     /** @type {NodeJS.Timeout | null} */
     this.livenessCheckInterval = null; // Interval for health checks
+    this.consecutiveStaleWarnings = 0;
+    this.livenessTerminationStarted = false;
+    this.livenessTerminationContext = null;
+    this.livenessTerminationAttempts = 0;
+    this.livenessTerminationRetryAt = 0;
     this.staleDuration = normalizedConfig.staleDuration;
     this.enableLivenessCheck = normalizedConfig.enableLivenessCheck;
 
@@ -499,8 +506,8 @@ class AgentWrapper {
    * Kill current task
    * @private
    */
-  _killTask() {
-    return killTask(this);
+  _killTask(reason) {
+    return killTask(this, reason);
   }
 
   /**

package/src/agents/git-pusher-template.js

@@ -275,6 +275,7 @@ const hasSufficientEvidence = latestValidatorMessages.every((r) => {
 return hasSufficientEvidence;`;
 
 const { readRepoSettings } = require('../../lib/repo-settings');
+const { normalizeGitRemoteName, quoteShellArgument } = require('../../lib/git-remote-utils');
 const { resolveRequiredQualityGates } = require('../quality-gates');
 
 function getSafeBranchName(value) {
@@ -313,6 +314,35 @@ function normalizeCloseIssueMode(value) {
   return null;
 }
 
+function normalizeIssueNumber(value) {
+  const candidate = typeof value === 'number' ? String(value) : value;
+  if (typeof candidate !== 'string') return 'unknown';
+  const trimmed = candidate.trim();
+  return /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(trimmed) ? trimmed : 'unknown';
+}
+
+function normalizeIssueTitle(value) {
+  if (typeof value !== 'string' || value.trim() === '') return 'Implementation';
+  const normalized = [...value]
+    .map((character) => {
+      const codePoint = character.codePointAt(0);
+      return codePoint < 0x20 || codePoint === 0x7f ? ' ' : character;
+    })
+    .join('')
+    .trim();
+  return normalized || 'Implementation';
+}
+
+function resolveIssueContext(options) {
+  const issueNumber = normalizeIssueNumber(options.issueNumber);
+  const issueTitle = normalizeIssueTitle(options.issueTitle);
+  const issueReference =
+    options.includeIssueReference === false || issueNumber === 'unknown'
+      ? ''
+      : `Closes #${issueNumber}`;
+  return { issueNumber, issueTitle, issueReference };
+}
+
 /**
  * Resolve GitHub configuration from CLI options and repo settings.
  * Priority: CLI options > repo settings (.zeroshot/settings.json) > defaults
@@ -321,12 +351,20 @@ function normalizeCloseIssueMode(value) {
  * @param {string} [options.prBase] - Target branch for PRs
  * @param {boolean} [options.mergeQueue] - Use GitHub merge queue
  * @param {string} [options.closeIssue] - When to close issue: auto|always|never
+ * @param {string} [options.gitRemote=origin] - Remote to push the implementation branch to
+ * @param {string|number} [options.issueNumber] - Typed issue identifier for prompt commands
+ * @param {string} [options.issueTitle] - Typed issue title for prompt commands
+ * @param {boolean} [options.includeIssueReference] - Include the closing reference in PR text
  * @returns {Object} Resolved configuration
  */
 function resolveGitHubConfig(options = {}) {
   const repoSettingsResult = readRepoSettings(options.cwd || process.cwd());
   const repoSettings = repoSettingsResult.settings || {};
   const repoGithub = repoSettings.github || {};
+  const gitRemote = normalizeGitRemoteName(options.gitRemote ?? 'origin');
+  if (!gitRemote) {
+    throw new Error(`Invalid git remote name '${options.gitRemote}'`);
+  }
 
   // CLI options override repo settings
   const prBase = getSafeBranchName(options.prBase) || getSafeBranchName(repoGithub.prBase);
@@ -347,7 +385,14 @@ function resolveGitHubConfig(options = {}) {
     options.autoMerge === true ||
     (options.autoMerge !== false && parseBool(repoGithub.autoMerge) === true);
 
-  return { prBase, useMergeQueue, closeIssueMode, autoMerge };
+  return {
+    prBase,
+    useMergeQueue,
+    closeIssueMode,
+    autoMerge,
+    gitRemote,
+    issueContext: resolveIssueContext(options),
+  };
 }
 
 /**
@@ -358,13 +403,16 @@ function resolveGitHubConfig(options = {}) {
  * @returns {Object|null} Platform configuration or null if unsupported
  */
 function getPlatformConfig(platform, config = {}) {
-  const { prBase, useMergeQueue, closeIssueMode, autoMerge } = config;
+  const { prBase, useMergeQueue, closeIssueMode, autoMerge, gitRemote } = config;
+  const issueContext = config.issueContext || resolveIssueContext({});
+  const issueTitleArgument = quoteShellArgument(`feat: ${issueContext.issueTitle}`);
+  const issueReferenceArgument = quoteShellArgument(issueContext.issueReference);
 
   const PLATFORM_CONFIGS = {
     github: {
       prName: 'PR',
       prNameLower: 'pull request',
-      createCmd: `gh pr create${prBase ? ` --base ${prBase}` : ''} --title "feat: {{issue_title}}" --body "Closes #{{issue_number}}"`,
+      createCmd: `gh pr create${prBase ? ` --base ${prBase}` : ''} --title ${issueTitleArgument} --body ${issueReferenceArgument}`,
       mergeCmd: useMergeQueue
         ? `PR_ID="$(timeout 30 gh pr view --json id --jq .id)"
 gh api graphql -f query='mutation($id:ID!){enqueuePullRequest(input:{pullRequestId:$id}){mergeQueueEntry{state}}}' -f id="$PR_ID"
@@ -380,24 +428,26 @@ for i in $(seq 1 90); do if timeout 30 gh pr view --json mergedAt --jq .mergedAt
       usesMergeQueue: useMergeQueue,
       closeIssueMode: closeIssueMode || 'never',
       autoMerge: Boolean(autoMerge),
+      gitRemote,
+      issueContext,
     },
     gitlab: {
       prName: 'MR',
       prNameLower: 'merge request',
-      createCmd:
-        'glab mr create --title "feat: {{issue_title}}" --description "Closes #{{issue_number}}"',
+      createCmd: `glab mr create --title ${issueTitleArgument} --description ${issueReferenceArgument}`,
       mergeCmd: 'glab mr merge --auto-merge',
       mergeFallbackCmd: 'glab mr merge',
       prUrlExample: 'https://gitlab.com/owner/repo/-/merge_requests/123',
       outputFields: { urlField: 'mr_url', numberField: 'mr_number', mergedField: 'merged' },
       closeIssueMode: closeIssueMode || 'never',
       autoMerge: Boolean(autoMerge),
+      gitRemote,
+      issueContext,
     },
     'azure-devops': {
       prName: 'PR',
       prNameLower: 'pull request',
-      createCmd:
-        'az repos pr create --title "feat: {{issue_title}}" --description "Closes #{{issue_number}}"',
+      createCmd: `az repos pr create --title ${issueTitleArgument} --description ${issueReferenceArgument}`,
       mergeCmd: 'az repos pr update --id <PR_ID> --auto-complete true',
       mergeFallbackCmd: 'az repos pr update --id <PR_ID> --status completed',
       prUrlExample: 'https://dev.azure.com/org/project/_git/repo/pullrequest/123',
@@ -411,6 +461,8 @@ for i in $(seq 1 90); do if timeout 30 gh pr view --json mergedAt --jq .mergedAt
       requiresPrIdExtraction: true,
       closeIssueMode: closeIssueMode || 'never',
       autoMerge: Boolean(autoMerge),
+      gitRemote,
+      issueContext,
     },
   };
 
@@ -430,8 +482,20 @@ const SUPPORTED_PLATFORMS = ['github', 'gitlab', 'azure-devops'];
  * @returns {string} The complete review-mode prompt
  */
 function generateReviewModePrompt(config) {
-  const { prName, prNameLower, createCmd, prUrlExample, outputFields, requiresPrIdExtraction } =
-    config;
+  const {
+    prName,
+    prNameLower,
+    createCmd,
+    prUrlExample,
+    outputFields,
+    requiresPrIdExtraction,
+    gitRemote,
+    issueContext,
+  } = config;
+  const gitRemoteArgument = quoteShellArgument(gitRemote);
+  const commitMessageArgument = quoteShellArgument(
+    `feat: implement #${issueContext.issueNumber} - ${issueContext.issueTitle}`
+  );
 
   return `CRITICAL: ALL VALIDATORS APPROVED. YOU ARE A TRANSPORT-ONLY GIT PUSHER.
 
@@ -467,13 +531,13 @@ Run this. If nothing to commit, output JSON with ${outputFields.urlField}: null
 
 ### STEP 3: Commit the changes (MANDATORY if there are changes)
 \`\`\`bash
-git commit -m "feat: implement #{{issue_number}} - {{issue_title}}"
+git commit -m ${commitMessageArgument}
 \`\`\`
 Run this command. Do not skip it.
 
-### STEP 4: Push to origin (MANDATORY)
+### STEP 4: Push to ${gitRemote} (MANDATORY)
 \`\`\`bash
-git push -u origin HEAD
+git push -u -- ${gitRemoteArgument} HEAD
 \`\`\`
 Run this. If it fails, do not edit files, rebase, or resolve conflicts. Output blocked JSON with the failure summary.
 
@@ -543,7 +607,14 @@ function generatePrompt(config) {
     usesMergeQueue,
     closeIssueMode,
     autoMerge,
+    gitRemote,
+    issueContext,
   } = config;
+  const gitRemoteArgument = quoteShellArgument(gitRemote);
+  const issueNumberArgument = quoteShellArgument(issueContext.issueNumber);
+  const commitMessageArgument = quoteShellArgument(
+    `feat: implement #${issueContext.issueNumber} - ${issueContext.issueTitle}`
+  );
 
   if (!autoMerge) {
     return generateReviewModePrompt(config);
@@ -627,13 +698,13 @@ Run this. If nothing to commit, output JSON with ${outputFields.urlField}: null
 
 ### STEP 3: Commit the changes (MANDATORY if there are changes)
 \`\`\`bash
-git commit -m "feat: implement #{{issue_number}} - {{issue_title}}"
+git commit -m ${commitMessageArgument}
 \`\`\`
 Run this command. Do not skip it.
 
-### STEP 4: Push to origin (MANDATORY)
+### STEP 4: Push to ${gitRemote} (MANDATORY)
 \`\`\`bash
-git push -u origin HEAD
+git push -u -- ${gitRemoteArgument} HEAD
 \`\`\`
 Run this. If it fails, do not edit files, rebase, or resolve conflicts. Output blocked JSON with the failure summary.
 
@@ -665,8 +736,8 @@ ${
   closeIssueMode !== 'never'
     ? `### STEP 7: Close the issue (MANDATORY)
 \`\`\`bash
-if [ "{{issue_number}}" != "unknown" ]; then
-  ISSUE_STATE="$(gh issue view {{issue_number}} --json state --jq .state 2>/dev/null || true)"
+if [ ${issueNumberArgument} != "unknown" ]; then
+  ISSUE_STATE="$(gh issue view ${issueNumberArgument} --json state --jq .state 2>/dev/null || true)"
   if [ "$ISSUE_STATE" = "OPEN" ]; then
     BASE_BRANCH="${rebaseBranch || 'main'}"
     DEFAULT_BRANCH="$(gh repo view --json defaultBranchRef --jq .defaultBranchRef.name 2>/dev/null || true)"
@@ -682,9 +753,9 @@ if [ "{{issue_number}}" != "unknown" ]; then
     if [ "$SHOULD_CLOSE" = "1" ]; then
   PR_URL="$(gh pr view --json url --jq .url 2>/dev/null || true)"
   if [ -n "$PR_URL" ]; then
-    gh issue close {{issue_number}} --comment "Implemented in $PR_URL"
+    gh issue close ${issueNumberArgument} --comment "Implemented in $PR_URL"
   else
-    gh issue close {{issue_number}} --comment "Implemented"
+    gh issue close ${issueNumberArgument} --comment "Implemented"
   fi
     fi
   fi
@@ -728,6 +799,10 @@ If blocked before creating a ${prName}, output:
  * @param {string} [options.prBase] - Target branch for PRs
  * @param {boolean} [options.mergeQueue] - Use GitHub merge queue
  * @param {string} [options.closeIssue] - When to close issue: auto|always|never
+ * @param {string} [options.gitRemote=origin] - Remote to push the implementation branch to
+ * @param {string|number} [options.issueNumber] - Typed issue identifier for prompt commands
+ * @param {string} [options.issueTitle] - Typed issue title for prompt commands
+ * @param {boolean} [options.includeIssueReference] - Include the closing reference in PR text
  * @param {Array} [options.requiredQualityGates] - Required handoff quality gates
  * @param {boolean} [options.autoMerge] - Merge the PR (--ship). False stops after PR creation (--pr).
  * @returns {Object} Agent configuration object

package/src/attach/socket-discovery.js

@@ -1,20 +1,18 @@
 /**
  * Socket Discovery - Utilities for socket path management
  *
- * Socket locations:
- * - Tasks: ~/.zeroshot/sockets/task-<id>.sock
- * - Clusters: ~/.zeroshot/sockets/cluster-<id>.sock (cluster-level, future)
- * - Agents: ~/.zeroshot/sockets/cluster-<id>/<agent-id>.sock
+ * Socket locations are allocated by socket-paths.js under a short, per-user
+ * runtime directory so long HOME paths cannot exceed Unix socket limits.
  */
 
 const path = require('path');
 const fs = require('fs');
-const os = require('os');
 const net = require('net');
 const { readClustersFileSync } = require('../../lib/clusters-registry');
+const socketPaths = require('./socket-paths');
 
-const ZEROSHOT_DIR = path.join(os.homedir(), '.zeroshot');
-const SOCKET_DIR = path.join(ZEROSHOT_DIR, 'sockets');
+const ZEROSHOT_DIR = path.join(socketPaths.resolveHomeDir(), '.zeroshot');
+const SOCKET_DIR = socketPaths.getSocketDir();
 
 /**
  * Check if an ID is a known cluster by looking up clusters.json
@@ -35,9 +33,7 @@ function isKnownCluster(id) {
  * Ensure socket directory exists
  */
 function ensureSocketDir() {
-  if (!fs.existsSync(SOCKET_DIR)) {
-    fs.mkdirSync(SOCKET_DIR, { recursive: true });
-  }
+  socketPaths.ensureSocketDir();
 }
 
 /**
@@ -46,8 +42,7 @@ function ensureSocketDir() {
  * @returns {string} - Socket path
  */
 function getTaskSocketPath(taskId) {
-  ensureSocketDir();
-  return path.join(SOCKET_DIR, `${taskId}.sock`);
+  return socketPaths.getTaskSocketPath(taskId);
 }
 
 /**
@@ -57,11 +52,7 @@ function getTaskSocketPath(taskId) {
  * @returns {string} - Socket path
  */
 function getAgentSocketPath(clusterId, agentId) {
-  const clusterDir = path.join(SOCKET_DIR, clusterId);
-  if (!fs.existsSync(clusterDir)) {
-    fs.mkdirSync(clusterDir, { recursive: true });
-  }
-  return path.join(clusterDir, `${agentId}.sock`);
+  return socketPaths.getAgentSocketPath(clusterId, agentId);
 }
 
 /**
@@ -81,8 +72,7 @@ function getSocketPath(id, agentId = null) {
       return getAgentSocketPath(id, agentId);
     }
     // Cluster-level socket (future use)
-    ensureSocketDir();
-    return path.join(SOCKET_DIR, `${id}.sock`);
+    return socketPaths.getClusterSocketPath(id);
   }
   // Unknown format, treat as task
   return getTaskSocketPath(id);

package/src/attach/socket-paths.js

@@ -0,0 +1,85 @@
+/**
+ * Deterministic attach socket paths.
+ *
+ * Unix-domain sockets have a small path budget (104 bytes on macOS). Keep the
+ * live socket namespace independent from HOME while retaining one namespace
+ * per OS user and Zeroshot home.
+ */
+
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const SOCKET_ROOT = process.platform === 'win32' ? null : '/tmp';
+const SOCKET_DIR_MODE = 0o700;
+
+function shortHash(value) {
+  return crypto.createHash('sha256').update(value).digest('hex').slice(0, 16);
+}
+
+function userNamespace() {
+  if (typeof process.getuid === 'function') {
+    return String(process.getuid());
+  }
+  return shortHash(os.userInfo().username);
+}
+
+function resolveHomeDir(env = process.env) {
+  return env.ZEROSHOT_HOME || env.HOME || env.USERPROFILE || os.homedir();
+}
+
+function getSocketDir(homeDir = resolveHomeDir()) {
+  if (process.platform === 'win32') {
+    return path.join(homeDir, '.zeroshot', 'sockets');
+  }
+  return path.join(SOCKET_ROOT, `zeroshot-${userNamespace()}-${shortHash(homeDir)}`);
+}
+
+function assertSafeSocketDir(socketDir) {
+  const stat = fs.lstatSync(socketDir);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error(`Attach socket path is not a directory: ${socketDir}`);
+  }
+  if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
+    throw new Error(`Attach socket directory is not owned by the current user: ${socketDir}`);
+  }
+}
+
+function ensureOwnedDirectory(socketDir) {
+  fs.mkdirSync(socketDir, { recursive: true, mode: SOCKET_DIR_MODE });
+  assertSafeSocketDir(socketDir);
+  if (process.platform !== 'win32') {
+    fs.chmodSync(socketDir, SOCKET_DIR_MODE);
+  }
+  return socketDir;
+}
+
+function ensureSocketDir(homeDir = resolveHomeDir()) {
+  const socketDir = getSocketDir(homeDir);
+  return ensureOwnedDirectory(socketDir);
+}
+
+function getTaskSocketPath(taskId, homeDir = resolveHomeDir()) {
+  return path.join(ensureSocketDir(homeDir), `${taskId}.sock`);
+}
+
+function getAgentSocketPath(clusterId, agentId, homeDir = resolveHomeDir()) {
+  const clusterDir = path.join(ensureSocketDir(homeDir), clusterId);
+  ensureOwnedDirectory(clusterDir);
+  return path.join(clusterDir, `${agentId}.sock`);
+}
+
+function getClusterSocketPath(clusterId, homeDir = resolveHomeDir()) {
+  return path.join(ensureSocketDir(homeDir), `${clusterId}.sock`);
+}
+
+module.exports = {
+  SOCKET_DIR_MODE,
+  resolveHomeDir,
+  getSocketDir,
+  ensureSocketDir,
+  getTaskSocketPath,
+  getAgentSocketPath,
+  getClusterSocketPath,
+};

package/src/config-validator.js

@@ -21,6 +21,9 @@ const { getProvider } = require('./providers');
 const { CAPABILITIES } = require('./providers/capabilities');
 const { GUIDANCE_TOPICS } = require('./guidance-topics');
 
+const REASONING_EFFORTS = Object.freeze(['low', 'medium', 'high', 'xhigh', 'max']);
+const REASONING_EFFORT_LABEL = REASONING_EFFORTS.join('|');
+
 const HOOK_ACTION_TOPIC_CONTRACTS = Object.freeze({
   verify_pull_request: Object.freeze([
     { topic: 'CLUSTER_COMPLETE', keys: null },
@@ -2054,14 +2057,13 @@ function validateProviderSettings(provider, providerSettings) {
       providerModule.validateModelId(override.model);
     }
     if (override?.reasoningEffort && !providerSupportsCapability(provider, 'reasoningEffort')) {
-      throw new Error(`reasoningEffort overrides are only supported for Codex and Opencode`);
+      throw new Error(
+        `reasoningEffort overrides are only supported for Claude, Codex, and Opencode`
+      );
     }
-    if (
-      override?.reasoningEffort &&
-      !['low', 'medium', 'high', 'xhigh'].includes(override.reasoningEffort)
-    ) {
+    if (override?.reasoningEffort && !REASONING_EFFORTS.includes(override.reasoningEffort)) {
       throw new Error(
-        `Invalid reasoningEffort "${override.reasoningEffort}" (low|medium|high|xhigh)`
+        `Invalid reasoningEffort "${override.reasoningEffort}" (${REASONING_EFFORT_LABEL})`
       );
     }
   }
@@ -2172,12 +2174,9 @@ function validateModelRulesSupport(agent, provider, providerModule, levels, warn
 function validateReasoningEffortSupport(agent, provider, warnings) {
   if (agent.reasoningEffort && !providerSupportsCapability(provider, 'reasoningEffort')) {
     warnings.push(`Agent "${agent.id}" sets reasoningEffort but ${provider} does not support it`);
-  } else if (
-    agent.reasoningEffort &&
-    !['low', 'medium', 'high', 'xhigh'].includes(agent.reasoningEffort)
-  ) {
+  } else if (agent.reasoningEffort && !REASONING_EFFORTS.includes(agent.reasoningEffort)) {
     warnings.push(
-      `Agent "${agent.id}" has invalid reasoningEffort "${agent.reasoningEffort}" (low|medium|high|xhigh)`
+      `Agent "${agent.id}" has invalid reasoningEffort "${agent.reasoningEffort}" (${REASONING_EFFORT_LABEL})`
     );
   }
 }