@the-open-engine/zeroshot 6.7.1 → 6.7.2

package/cli/index.js

@@ -1597,21 +1597,87 @@ function reportNoActiveAgents(status, id) {
   }
 }
 
-function printAttachableAgentList(id, activeAgents) {
-  console.log(chalk.yellow(`\nCluster ${id} - attachable agents:\n`));
-  for (const agent of activeAgents) {
+async function inspectAgentAttachment(agent, socketDiscovery, readTask = readTaskFromDisk) {
+  if (!agent.currentTaskId) {
+    return { agent, state: 'starting', task: null, socketPath: null };
+  }
+
+  const task = await readTask(agent.currentTaskId);
+  if (task?.pid && !task.attachable) {
+    return { agent, state: 'non_attachable', task, socketPath: null };
+  }
+
+  const socketPath = task?.socketPath || socketDiscovery.getTaskSocketPath(agent.currentTaskId);
+  if (await socketDiscovery.isSocketAlive(socketPath)) {
+    return { agent, state: 'attachable', task, socketPath };
+  }
+  return { agent, state: 'unavailable', task, socketPath };
+}
+
+function printLiveAttachableAgents(attachments) {
+  for (const { agent } of attachments) {
     const modelLabel = agent.model ? chalk.dim(` [${agent.model}]`) : '';
-    if (agent.currentTaskId) {
-      console.log(
-        `  ${chalk.cyan(agent.id)}${modelLabel} → task ${chalk.green(agent.currentTaskId)}`
-      );
-      console.log(chalk.dim(`    zeroshot attach ${agent.currentTaskId}`));
-    } else {
-      console.log(`  ${chalk.cyan(agent.id)}${modelLabel} → ${chalk.yellow('starting...')}`);
-      console.log(chalk.dim(`    (task ID not yet assigned, try again in a moment)`));
-    }
+    console.log(
+      `  ${chalk.cyan(agent.id)}${modelLabel} → task ${chalk.green(agent.currentTaskId)}`
+    );
+    console.log(chalk.dim(`    zeroshot attach ${agent.currentTaskId}`));
+  }
+}
+
+function printNonAttachableAgents(id, attachments) {
+  if (attachments.length === 0) {
+    return;
+  }
+
+  console.log(chalk.yellow('\nRunning without PTY attach support:'));
+  for (const { agent, task } of attachments) {
+    const modelLabel = agent.model ? chalk.dim(` [${agent.model}]`) : '';
+    const providerLabel = task?.provider ? chalk.dim(` [provider: ${task.provider}]`) : '';
+    console.log(
+      `  ${chalk.cyan(agent.id)}${modelLabel} → task ${chalk.green(agent.currentTaskId)}${providerLabel}`
+    );
+  }
+  console.log(chalk.dim(`  Follow output instead: zeroshot logs ${id} -f`));
+}
+
+function printUnavailableAgents(attachments) {
+  if (attachments.length === 0) {
+    return;
+  }
+
+  console.log(chalk.yellow('\nActive agents without a live attach socket:'));
+  for (const { agent, state } of attachments) {
+    const modelLabel = agent.model ? chalk.dim(` [${agent.model}]`) : '';
+    const detail =
+      state === 'starting'
+        ? 'task ID not yet assigned'
+        : `task ${agent.currentTaskId} socket not ready`;
+    console.log(`  ${chalk.cyan(agent.id)}${modelLabel} → ${chalk.yellow(detail)}`);
+  }
+}
+
+async function printAttachableAgentList(
+  id,
+  activeAgents,
+  socketDiscovery,
+  readTask = readTaskFromDisk
+) {
+  const inspected = await Promise.all(
+    activeAgents.map((agent) => inspectAgentAttachment(agent, socketDiscovery, readTask))
+  );
+  const attachable = inspected.filter(({ state }) => state === 'attachable');
+  const nonAttachable = inspected.filter(({ state }) => state === 'non_attachable');
+  const unavailable = inspected.filter(({ state }) => ['starting', 'unavailable'].includes(state));
+
+  console.log(chalk.yellow(`\nCluster ${id} - attachable agents:\n`));
+  if (attachable.length === 0) {
+    console.log(chalk.dim('  No live attach sockets.'));
+  } else {
+    printLiveAttachableAgents(attachable);
+    console.log(chalk.dim('\nAttach to an agent by running: zeroshot attach <taskId>'));
   }
-  console.log(chalk.dim('\nAttach to an agent by running: zeroshot attach <taskId>'));
+  printNonAttachableAgents(id, nonAttachable);
+  printUnavailableAgents(unavailable);
 }
 
 function reportMissingAgent(agentName, status) {
@@ -1648,6 +1714,27 @@ async function reportClusterStatusUnavailable(err, socketDiscovery) {
   }
 }
 
+async function readTaskFromDisk(taskId) {
+  try {
+    const { getTask } = await import('../task-lib/store.js');
+    return getTask(taskId);
+  } catch {
+    return null;
+  }
+}
+
+function reportAgentTaskNotAttachable(id, agent, task) {
+  console.error(
+    chalk.yellow(
+      `Agent '${agent.id}' is running task ${agent.currentTaskId} without PTY attach support`
+    )
+  );
+  if (task.provider) {
+    console.error(chalk.dim(`Provider: ${task.provider}`));
+  }
+  console.error(chalk.dim(`Follow output instead: zeroshot logs ${id} -f`));
+}
+
 async function resolveClusterSocketPath(id, options, socketDiscovery) {
   const cluster = readClusterFromDisk(id);
   ensureClusterRunning(cluster, id);
@@ -1662,7 +1749,7 @@ async function resolveClusterSocketPath(id, options, socketDiscovery) {
     }
 
     if (!options.agent) {
-      printAttachableAgentList(id, activeAgents);
+      await printAttachableAgentList(id, activeAgents, socketDiscovery);
       return null;
     }
 
@@ -1680,7 +1767,12 @@ async function resolveClusterSocketPath(id, options, socketDiscovery) {
     console.log(
       chalk.dim(`Attaching to agent ${options.agent} via task ${agent.currentTaskId}...`)
     );
-    return socketDiscovery.getTaskSocketPath(agent.currentTaskId);
+    const task = await readTaskFromDisk(agent.currentTaskId);
+    if (task?.pid && !task.attachable) {
+      reportAgentTaskNotAttachable(id, agent, task);
+      return null;
+    }
+    return task?.socketPath || socketDiscovery.getTaskSocketPath(agent.currentTaskId);
   } catch (err) {
     await reportClusterStatusUnavailable(err, socketDiscovery);
     return null;
@@ -5860,4 +5952,10 @@ if (require.main === module) {
   });
 }
 
-module.exports = { applyModelOverrideToConfig, renderRecentMessagesToTerminal, resolveRunMode };
+module.exports = {
+  applyModelOverrideToConfig,
+  inspectAgentAttachment,
+  printAttachableAgentList,
+  renderRecentMessagesToTerminal,
+  resolveRunMode,
+};

package/lib/git-remote-utils.js

@@ -5,6 +5,63 @@
 
 const { execSync } = require('../src/lib/safe-exec');
 
+function hasInvalidGitRefCharacter(value) {
+  for (const character of value) {
+    const codePoint = character.codePointAt(0);
+    if (codePoint <= 0x20 || codePoint === 0x7f || '~^:?*[\\'.includes(character)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Normalize a Git remote name using the same ref-format rules Git applies to
+ * refs/remotes/<name>. Keeping this next to detection prevents a discovered
+ * remote from being rejected later by a narrower consumer-specific allowlist.
+ *
+ * @param {unknown} value - Candidate remote name
+ * @returns {string|null} Normalized remote name, or null when invalid
+ */
+function normalizeGitRemoteName(value) {
+  if (typeof value !== 'string') {
+    return null;
+  }
+
+  const name = value.trim();
+  if (
+    name.length === 0 ||
+    name.endsWith('.') ||
+    name.includes('..') ||
+    name.includes('@{') ||
+    hasInvalidGitRefCharacter(name)
+  ) {
+    return null;
+  }
+
+  const components = name.split('/');
+  if (
+    components.some(
+      (component) =>
+        component.length === 0 || component.startsWith('.') || component.endsWith('.lock')
+    )
+  ) {
+    return null;
+  }
+
+  return name;
+}
+
+/**
+ * Quote one argument for the POSIX shell snippets embedded in agent prompts.
+ *
+ * @param {string} value - Argument to quote
+ * @returns {string} Single-quoted shell argument
+ */
+function quoteShellArgument(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+
 /**
  * Parse git remote URL into structured provider context.
  * Supports GitHub, GitLab, and Azure DevOps (cloud + self-hosted).
@@ -140,19 +197,43 @@ function detectGitContext(cwd = process.cwd()) {
   }
 
   try {
-    // Try to get remote URL (origin by default)
-    const remoteUrl = execSync('git remote get-url origin', {
+    const remoteOutput = execSync('git remote -v', {
       cwd,
       stdio: 'pipe',
       encoding: 'utf8',
-    }).trim();
+    });
 
-    if (!remoteUrl) {
-      return null;
+    const supportedRemotes = new Map();
+    for (const line of remoteOutput.split(/\r?\n/)) {
+      const match = line.match(/^(\S+)\s+(.+)\s+\(fetch\)$/);
+      if (!match) {
+        continue;
+      }
+
+      const [, remoteCandidate, remoteUrl] = match;
+      const remote = normalizeGitRemoteName(remoteCandidate);
+      if (!remote) {
+        continue;
+      }
+      const context = parseGitRemoteUrl(remoteUrl);
+      if (context && !supportedRemotes.has(remote)) {
+        supportedRemotes.set(remote, { ...context, remote });
+      }
+    }
+
+    // Preserve existing behavior whenever origin is usable. Without origin,
+    // select a remote only when there is exactly one supported target. Guessing
+    // between multiple repositories could push code or create a PR in the wrong
+    // place, so ambiguous configurations deliberately fail closed.
+    if (supportedRemotes.has('origin')) {
+      return supportedRemotes.get('origin');
     }
 
-    // Parse the remote URL to extract provider context
-    return parseGitRemoteUrl(remoteUrl);
+    if (supportedRemotes.size === 1) {
+      return supportedRemotes.values().next().value;
+    }
+
+    return null;
   } catch {
     // No remote configured or command failed
     return null;
@@ -160,6 +241,8 @@ function detectGitContext(cwd = process.cwd()) {
 }
 
 module.exports = {
+  normalizeGitRemoteName,
+  quoteShellArgument,
   parseGitRemoteUrl,
   detectGitContext,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-open-engine/zeroshot",
-  "version": "6.7.1",
+  "version": "6.7.2",
   "description": "Multi-agent orchestration engine for Claude, Codex, and Gemini",
   "main": "src/orchestrator.js",
   "bin": {
@@ -17,18 +17,8 @@
       "main"
     ],
     "plugins": [
-      [
-        "@semantic-release/commit-analyzer",
-        {
-          "releaseRules": [
-            {
-              "type": "release",
-              "release": "minor"
-            }
-          ]
-        }
-      ],
-      "@semantic-release/release-notes-generator",
+      "@semantic-release/commit-analyzer",
+      "./scripts/semantic-release-notes.js",
       [
         "@semantic-release/npm",
         {
@@ -75,6 +65,7 @@
     "check:all": "npm run check && npm run deadcode:all",
     "release": "semantic-release",
     "release:preflight": "node scripts/release-preflight.js",
+    "release:recover": "node scripts/release-recovery.js",
     "release:assert-published": "node scripts/assert-release-published.js",
     "prepublishOnly": "npm run lint && npm run typecheck && npm run check:agent-cli-provider:ci",
     "prepare": "npm run build:agent-cli-provider && husky"
@@ -151,8 +142,8 @@
     "proper-lockfile": "^4.1.2"
   },
   "devDependencies": {
-    "@semantic-release/changelog": "^6.0.3",
-    "@semantic-release/git": "^10.0.1",
+    "@commitlint/cli": "^19.8.1",
+    "@commitlint/config-conventional": "^19.8.1",
     "@semantic-release/github": "^11.0.6",
     "@types/better-sqlite3": "^7.6.13",
     "@types/node": "^25.0.3",

package/protocol/openengine-cluster/v1/worker.schema.json

@@ -821,6 +821,26 @@
             "profile"
           ],
           "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "profile": {
+              "const": "openengine.worker.builtin/v1"
+            },
+            "protocol": {
+              "const": "builtin"
+            },
+            "version": {
+              "const": "1"
+            }
+          },
+          "required": [
+            "protocol",
+            "version",
+            "profile"
+          ],
+          "type": "object"
         }
       ]
     }
@@ -1166,6 +1186,33 @@
             "worker",
             "binding"
           ]
+        },
+        {
+          "properties": {
+            "binding": {
+              "properties": {
+                "protocol": {
+                  "const": "builtin"
+                }
+              },
+              "required": [
+                "protocol"
+              ]
+            },
+            "credentialRequirements": {
+              "maxItems": 0
+            },
+            "worker": {
+              "not": {
+                "const": "legacy.zeroshot.ship@1"
+              }
+            }
+          },
+          "required": [
+            "worker",
+            "binding",
+            "credentialRequirements"
+          ]
         }
       ]
     }

package/scripts/assert-release-published.js

@@ -1,6 +1,10 @@
 #!/usr/bin/env node
 
+const fs = require('fs');
+const https = require('https');
+const path = require('path');
 const { execFileSync } = require('child_process');
+const { releaseTypeForMessages } = require('./release-preflight');
 
 const DEFAULT_ATTEMPTS = 24;
 const DEFAULT_DELAY_MS = 5000;
@@ -17,6 +21,87 @@ function npmLatest(name) {
   return JSON.parse(run('npm', ['view', name, 'dist-tags.latest', '--json']));
 }
 
+function npmReleaseMetadata(name, version) {
+  return JSON.parse(
+    run('npm', ['view', `${name}@${version}`, 'version', 'gitHead', 'dist.attestations', '--json'])
+  );
+}
+
+function httpsJson(url) {
+  return new Promise((resolve, reject) => {
+    const request = https.get(url, { headers: { Accept: 'application/json' } }, (response) => {
+      let body = '';
+      response.setEncoding('utf8');
+      response.on('data', (chunk) => {
+        body += chunk;
+      });
+      response.on('end', () => {
+        if (response.statusCode < 200 || response.statusCode >= 300) {
+          reject(new Error(`HTTP ${response.statusCode} from ${url}: ${body}`));
+          return;
+        }
+        resolve(JSON.parse(body));
+      });
+    });
+    request.on('error', reject);
+  });
+}
+
+function provenanceStatement(attestations) {
+  const provenance = attestations.attestations?.find(
+    (attestation) => attestation.predicateType === 'https://slsa.dev/provenance/v1'
+  );
+  const payload = provenance?.bundle?.dsseEnvelope?.payload;
+  if (!payload) throw new Error('npm provenance statement is missing');
+  return JSON.parse(Buffer.from(payload, 'base64').toString('utf8'));
+}
+
+function verifyProvenance(statement, expectedCommit) {
+  const workflow = statement.predicate?.buildDefinition?.externalParameters?.workflow;
+  if (workflow?.repository !== 'https://github.com/the-open-engine/zeroshot') {
+    throw new Error(`unexpected provenance repository: ${workflow?.repository || '(missing)'}`);
+  }
+  if (workflow?.path !== '.github/workflows/release.yml') {
+    throw new Error(`unexpected provenance workflow: ${workflow?.path || '(missing)'}`);
+  }
+
+  const resolved = statement.predicate?.buildDefinition?.resolvedDependencies || [];
+  if (!resolved.some((dependency) => dependency.digest?.gitCommit === expectedCommit)) {
+    throw new Error(`provenance does not resolve to release commit ${expectedCommit}`);
+  }
+}
+
+function githubRelease(tag) {
+  return JSON.parse(run('gh', ['release', 'view', tag, '--json', 'tagName,body,url,publishedAt']));
+}
+
+function verifyCuratedNotes(tag, release) {
+  const notesPath = path.join(process.cwd(), 'docs', 'releases', `${tag}.md`);
+  if (!fs.existsSync(notesPath)) return;
+  const expected = fs.readFileSync(notesPath, 'utf8').trim();
+  const actual = String(release.body || '').trim();
+  if (actual !== expected) {
+    throw new Error(`GitHub Release ${tag} does not match ${notesPath}`);
+  }
+}
+
+function verifyInstalledCli(name, version) {
+  const packageSpec = `${name}@${version}`;
+  const reported = run('npm', [
+    'exec',
+    '--yes',
+    `--package=${packageSpec}`,
+    '--',
+    'zeroshot',
+    '--version',
+  ]);
+  if (!reported.split(/\s+/).includes(version)) {
+    throw new Error(`installed CLI reported ${reported}; expected ${version}`);
+  }
+  run('npm', ['exec', '--yes', `--package=${packageSpec}`, '--', 'zeroshot', '--help']);
+  run('npm', ['exec', '--yes', `--package=${packageSpec}`, '--', 'zeroshot', 'list']);
+}
+
 function tagsPointingAtHead() {
   run('git', ['fetch', '--tags', '--force']);
   return run('git', ['tag', '--points-at', 'HEAD', '--list', 'v[0-9]*'])
@@ -25,6 +110,18 @@ function tagsPointingAtHead() {
     .filter(Boolean);
 }
 
+function latestReachableReleaseTag() {
+  return run('git', ['describe', '--tags', '--abbrev=0', '--match', 'v[0-9]*']);
+}
+
+function commitMessagesSince(tag) {
+  const output = run('git', ['log', '--format=%B%x1e', `${tag}..HEAD`]);
+  return output
+    .split('\x1e')
+    .map((message) => message.trim())
+    .filter(Boolean);
+}
+
 function releaseTagParts(tag) {
   const match = tag.match(/^v(\d+)\.(\d+)\.(\d+)$/);
   if (!match) return null;
@@ -80,6 +177,12 @@ async function main() {
   const expectedTag = latestReleaseTag(headTags);
 
   if (!expectedTag) {
+    const previousTag = latestReachableReleaseTag();
+    const releaseType = releaseTypeForMessages(commitMessagesSince(previousTag));
+    if (!releaseType) {
+      console.log('No release-worthy commits since the latest tag; no publication expected');
+      return;
+    }
     throw new Error('expected a vX.Y.Z release tag to point at HEAD after release');
   }
 
@@ -89,6 +192,27 @@ async function main() {
 
   console.log(`npm latest for ${name}: ${latest}`);
 
+  const expectedCommit = run('git', ['rev-parse', 'HEAD']);
+  const metadata = npmReleaseMetadata(name, expectedVersion);
+  if (metadata.version !== expectedVersion) {
+    throw new Error(`npm metadata returned ${metadata.version}; expected ${expectedVersion}`);
+  }
+  if (metadata.gitHead !== expectedCommit) {
+    throw new Error(`npm gitHead ${metadata.gitHead || '(missing)'} does not match HEAD`);
+  }
+
+  const attestationUrl = metadata['dist.attestations']?.url;
+  if (!attestationUrl) throw new Error('npm attestation URL is missing');
+  const attestations = await httpsJson(attestationUrl);
+  verifyProvenance(provenanceStatement(attestations), expectedCommit);
+
+  const release = githubRelease(expectedTag);
+  if (release.tagName !== expectedTag) {
+    throw new Error(`GitHub Release tag ${release.tagName} does not match ${expectedTag}`);
+  }
+  verifyCuratedNotes(expectedTag, release);
+  verifyInstalledCli(name, expectedVersion);
+
   console.log(`Release publication verified: ${name}@${latest}`);
 }
 
@@ -101,7 +225,11 @@ if (require.main === module) {
 
 module.exports = {
   latestReleaseTag,
+  latestReachableReleaseTag,
+  npmReleaseMetadata,
   npmLatest,
+  provenanceStatement,
   tagsPointingAtHead,
+  verifyProvenance,
   waitForNpmLatest,
 };

package/scripts/release-dry-run.js

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+'use strict';
+
+const { execFileSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const projectRoot = path.resolve(__dirname, '..');
+
+function runGit(args) {
+  execFileSync('git', args, {
+    cwd: projectRoot,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+}
+
+function pluginName(plugin) {
+  return Array.isArray(plugin) ? plugin[0] : plugin;
+}
+
+function validationPlugins(releaseConfig) {
+  const allowed = new Set([
+    '@semantic-release/commit-analyzer',
+    './scripts/semantic-release-notes.js',
+  ]);
+  return releaseConfig.plugins.filter((plugin) => allowed.has(pluginName(plugin)));
+}
+
+async function main() {
+  const branch = process.env.GITHUB_REF_NAME?.trim();
+  if (!branch) throw new Error('GITHUB_REF_NAME is required for a release dry run');
+  runGit(['check-ref-format', `refs/heads/${branch}`]);
+
+  const packageJson = require('../package.json');
+  const releaseConfig = packageJson.release;
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'zeroshot-release-dry-run-'));
+  const mirrorPath = path.join(tempRoot, 'candidate.git');
+
+  try {
+    runGit(['init', '--bare', mirrorPath]);
+    runGit([
+      '--git-dir',
+      mirrorPath,
+      'fetch',
+      projectRoot,
+      `+HEAD:refs/heads/${branch}`,
+      '+refs/tags/*:refs/tags/*',
+    ]);
+    runGit(['--git-dir', mirrorPath, 'symbolic-ref', 'HEAD', `refs/heads/${branch}`]);
+
+    const semanticRelease = (await import('semantic-release')).default;
+    const result = await semanticRelease(
+      {
+        ...releaseConfig,
+        branches: [branch],
+        repositoryUrl: mirrorPath,
+        plugins: validationPlugins(releaseConfig),
+        dryRun: true,
+        ci: false,
+      },
+      {
+        cwd: projectRoot,
+        env: process.env,
+      }
+    );
+
+    if (!result) {
+      console.log('RELEASE_DRY_RUN_RESULT=no-release');
+      return;
+    }
+
+    console.log(`RELEASE_DRY_RUN_RESULT=${result.nextRelease.version}`);
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});