@the-open-engine/zeroshot 6.7.1 → 6.7.2

package/src/agents/git-pusher-template.js

@@ -275,6 +275,7 @@ const hasSufficientEvidence = latestValidatorMessages.every((r) => {
 return hasSufficientEvidence;`;
 
 const { readRepoSettings } = require('../../lib/repo-settings');
+const { normalizeGitRemoteName, quoteShellArgument } = require('../../lib/git-remote-utils');
 const { resolveRequiredQualityGates } = require('../quality-gates');
 
 function getSafeBranchName(value) {
@@ -313,6 +314,35 @@ function normalizeCloseIssueMode(value) {
   return null;
 }
 
+function normalizeIssueNumber(value) {
+  const candidate = typeof value === 'number' ? String(value) : value;
+  if (typeof candidate !== 'string') return 'unknown';
+  const trimmed = candidate.trim();
+  return /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(trimmed) ? trimmed : 'unknown';
+}
+
+function normalizeIssueTitle(value) {
+  if (typeof value !== 'string' || value.trim() === '') return 'Implementation';
+  const normalized = [...value]
+    .map((character) => {
+      const codePoint = character.codePointAt(0);
+      return codePoint < 0x20 || codePoint === 0x7f ? ' ' : character;
+    })
+    .join('')
+    .trim();
+  return normalized || 'Implementation';
+}
+
+function resolveIssueContext(options) {
+  const issueNumber = normalizeIssueNumber(options.issueNumber);
+  const issueTitle = normalizeIssueTitle(options.issueTitle);
+  const issueReference =
+    options.includeIssueReference === false || issueNumber === 'unknown'
+      ? ''
+      : `Closes #${issueNumber}`;
+  return { issueNumber, issueTitle, issueReference };
+}
+
 /**
  * Resolve GitHub configuration from CLI options and repo settings.
  * Priority: CLI options > repo settings (.zeroshot/settings.json) > defaults
@@ -321,12 +351,20 @@ function normalizeCloseIssueMode(value) {
  * @param {string} [options.prBase] - Target branch for PRs
  * @param {boolean} [options.mergeQueue] - Use GitHub merge queue
  * @param {string} [options.closeIssue] - When to close issue: auto|always|never
+ * @param {string} [options.gitRemote=origin] - Remote to push the implementation branch to
+ * @param {string|number} [options.issueNumber] - Typed issue identifier for prompt commands
+ * @param {string} [options.issueTitle] - Typed issue title for prompt commands
+ * @param {boolean} [options.includeIssueReference] - Include the closing reference in PR text
  * @returns {Object} Resolved configuration
  */
 function resolveGitHubConfig(options = {}) {
   const repoSettingsResult = readRepoSettings(options.cwd || process.cwd());
   const repoSettings = repoSettingsResult.settings || {};
   const repoGithub = repoSettings.github || {};
+  const gitRemote = normalizeGitRemoteName(options.gitRemote ?? 'origin');
+  if (!gitRemote) {
+    throw new Error(`Invalid git remote name '${options.gitRemote}'`);
+  }
 
   // CLI options override repo settings
   const prBase = getSafeBranchName(options.prBase) || getSafeBranchName(repoGithub.prBase);
@@ -347,7 +385,14 @@ function resolveGitHubConfig(options = {}) {
     options.autoMerge === true ||
     (options.autoMerge !== false && parseBool(repoGithub.autoMerge) === true);
 
-  return { prBase, useMergeQueue, closeIssueMode, autoMerge };
+  return {
+    prBase,
+    useMergeQueue,
+    closeIssueMode,
+    autoMerge,
+    gitRemote,
+    issueContext: resolveIssueContext(options),
+  };
 }
 
 /**
@@ -358,13 +403,16 @@ function resolveGitHubConfig(options = {}) {
  * @returns {Object|null} Platform configuration or null if unsupported
  */
 function getPlatformConfig(platform, config = {}) {
-  const { prBase, useMergeQueue, closeIssueMode, autoMerge } = config;
+  const { prBase, useMergeQueue, closeIssueMode, autoMerge, gitRemote } = config;
+  const issueContext = config.issueContext || resolveIssueContext({});
+  const issueTitleArgument = quoteShellArgument(`feat: ${issueContext.issueTitle}`);
+  const issueReferenceArgument = quoteShellArgument(issueContext.issueReference);
 
   const PLATFORM_CONFIGS = {
     github: {
       prName: 'PR',
       prNameLower: 'pull request',
-      createCmd: `gh pr create${prBase ? ` --base ${prBase}` : ''} --title "feat: {{issue_title}}" --body "Closes #{{issue_number}}"`,
+      createCmd: `gh pr create${prBase ? ` --base ${prBase}` : ''} --title ${issueTitleArgument} --body ${issueReferenceArgument}`,
       mergeCmd: useMergeQueue
         ? `PR_ID="$(timeout 30 gh pr view --json id --jq .id)"
 gh api graphql -f query='mutation($id:ID!){enqueuePullRequest(input:{pullRequestId:$id}){mergeQueueEntry{state}}}' -f id="$PR_ID"
@@ -380,24 +428,26 @@ for i in $(seq 1 90); do if timeout 30 gh pr view --json mergedAt --jq .mergedAt
       usesMergeQueue: useMergeQueue,
       closeIssueMode: closeIssueMode || 'never',
       autoMerge: Boolean(autoMerge),
+      gitRemote,
+      issueContext,
     },
     gitlab: {
       prName: 'MR',
       prNameLower: 'merge request',
-      createCmd:
-        'glab mr create --title "feat: {{issue_title}}" --description "Closes #{{issue_number}}"',
+      createCmd: `glab mr create --title ${issueTitleArgument} --description ${issueReferenceArgument}`,
       mergeCmd: 'glab mr merge --auto-merge',
       mergeFallbackCmd: 'glab mr merge',
       prUrlExample: 'https://gitlab.com/owner/repo/-/merge_requests/123',
       outputFields: { urlField: 'mr_url', numberField: 'mr_number', mergedField: 'merged' },
       closeIssueMode: closeIssueMode || 'never',
       autoMerge: Boolean(autoMerge),
+      gitRemote,
+      issueContext,
     },
     'azure-devops': {
       prName: 'PR',
       prNameLower: 'pull request',
-      createCmd:
-        'az repos pr create --title "feat: {{issue_title}}" --description "Closes #{{issue_number}}"',
+      createCmd: `az repos pr create --title ${issueTitleArgument} --description ${issueReferenceArgument}`,
       mergeCmd: 'az repos pr update --id <PR_ID> --auto-complete true',
       mergeFallbackCmd: 'az repos pr update --id <PR_ID> --status completed',
       prUrlExample: 'https://dev.azure.com/org/project/_git/repo/pullrequest/123',
@@ -411,6 +461,8 @@ for i in $(seq 1 90); do if timeout 30 gh pr view --json mergedAt --jq .mergedAt
       requiresPrIdExtraction: true,
       closeIssueMode: closeIssueMode || 'never',
       autoMerge: Boolean(autoMerge),
+      gitRemote,
+      issueContext,
     },
   };
 
@@ -430,8 +482,20 @@ const SUPPORTED_PLATFORMS = ['github', 'gitlab', 'azure-devops'];
  * @returns {string} The complete review-mode prompt
  */
 function generateReviewModePrompt(config) {
-  const { prName, prNameLower, createCmd, prUrlExample, outputFields, requiresPrIdExtraction } =
-    config;
+  const {
+    prName,
+    prNameLower,
+    createCmd,
+    prUrlExample,
+    outputFields,
+    requiresPrIdExtraction,
+    gitRemote,
+    issueContext,
+  } = config;
+  const gitRemoteArgument = quoteShellArgument(gitRemote);
+  const commitMessageArgument = quoteShellArgument(
+    `feat: implement #${issueContext.issueNumber} - ${issueContext.issueTitle}`
+  );
 
   return `CRITICAL: ALL VALIDATORS APPROVED. YOU ARE A TRANSPORT-ONLY GIT PUSHER.
 
@@ -467,13 +531,13 @@ Run this. If nothing to commit, output JSON with ${outputFields.urlField}: null
 
 ### STEP 3: Commit the changes (MANDATORY if there are changes)
 \`\`\`bash
-git commit -m "feat: implement #{{issue_number}} - {{issue_title}}"
+git commit -m ${commitMessageArgument}
 \`\`\`
 Run this command. Do not skip it.
 
-### STEP 4: Push to origin (MANDATORY)
+### STEP 4: Push to ${gitRemote} (MANDATORY)
 \`\`\`bash
-git push -u origin HEAD
+git push -u -- ${gitRemoteArgument} HEAD
 \`\`\`
 Run this. If it fails, do not edit files, rebase, or resolve conflicts. Output blocked JSON with the failure summary.
 
@@ -543,7 +607,14 @@ function generatePrompt(config) {
     usesMergeQueue,
     closeIssueMode,
     autoMerge,
+    gitRemote,
+    issueContext,
   } = config;
+  const gitRemoteArgument = quoteShellArgument(gitRemote);
+  const issueNumberArgument = quoteShellArgument(issueContext.issueNumber);
+  const commitMessageArgument = quoteShellArgument(
+    `feat: implement #${issueContext.issueNumber} - ${issueContext.issueTitle}`
+  );
 
   if (!autoMerge) {
     return generateReviewModePrompt(config);
@@ -627,13 +698,13 @@ Run this. If nothing to commit, output JSON with ${outputFields.urlField}: null
 
 ### STEP 3: Commit the changes (MANDATORY if there are changes)
 \`\`\`bash
-git commit -m "feat: implement #{{issue_number}} - {{issue_title}}"
+git commit -m ${commitMessageArgument}
 \`\`\`
 Run this command. Do not skip it.
 
-### STEP 4: Push to origin (MANDATORY)
+### STEP 4: Push to ${gitRemote} (MANDATORY)
 \`\`\`bash
-git push -u origin HEAD
+git push -u -- ${gitRemoteArgument} HEAD
 \`\`\`
 Run this. If it fails, do not edit files, rebase, or resolve conflicts. Output blocked JSON with the failure summary.
 
@@ -665,8 +736,8 @@ ${
   closeIssueMode !== 'never'
     ? `### STEP 7: Close the issue (MANDATORY)
 \`\`\`bash
-if [ "{{issue_number}}" != "unknown" ]; then
-  ISSUE_STATE="$(gh issue view {{issue_number}} --json state --jq .state 2>/dev/null || true)"
+if [ ${issueNumberArgument} != "unknown" ]; then
+  ISSUE_STATE="$(gh issue view ${issueNumberArgument} --json state --jq .state 2>/dev/null || true)"
   if [ "$ISSUE_STATE" = "OPEN" ]; then
     BASE_BRANCH="${rebaseBranch || 'main'}"
     DEFAULT_BRANCH="$(gh repo view --json defaultBranchRef --jq .defaultBranchRef.name 2>/dev/null || true)"
@@ -682,9 +753,9 @@ if [ "{{issue_number}}" != "unknown" ]; then
     if [ "$SHOULD_CLOSE" = "1" ]; then
   PR_URL="$(gh pr view --json url --jq .url 2>/dev/null || true)"
   if [ -n "$PR_URL" ]; then
-    gh issue close {{issue_number}} --comment "Implemented in $PR_URL"
+    gh issue close ${issueNumberArgument} --comment "Implemented in $PR_URL"
   else
-    gh issue close {{issue_number}} --comment "Implemented"
+    gh issue close ${issueNumberArgument} --comment "Implemented"
   fi
     fi
   fi
@@ -728,6 +799,10 @@ If blocked before creating a ${prName}, output:
  * @param {string} [options.prBase] - Target branch for PRs
  * @param {boolean} [options.mergeQueue] - Use GitHub merge queue
  * @param {string} [options.closeIssue] - When to close issue: auto|always|never
+ * @param {string} [options.gitRemote=origin] - Remote to push the implementation branch to
+ * @param {string|number} [options.issueNumber] - Typed issue identifier for prompt commands
+ * @param {string} [options.issueTitle] - Typed issue title for prompt commands
+ * @param {boolean} [options.includeIssueReference] - Include the closing reference in PR text
  * @param {Array} [options.requiredQualityGates] - Required handoff quality gates
  * @param {boolean} [options.autoMerge] - Merge the PR (--ship). False stops after PR creation (--pr).
  * @returns {Object} Agent configuration object

package/src/attach/socket-discovery.js

@@ -1,20 +1,18 @@
 /**
  * Socket Discovery - Utilities for socket path management
  *
- * Socket locations:
- * - Tasks: ~/.zeroshot/sockets/task-<id>.sock
- * - Clusters: ~/.zeroshot/sockets/cluster-<id>.sock (cluster-level, future)
- * - Agents: ~/.zeroshot/sockets/cluster-<id>/<agent-id>.sock
+ * Socket locations are allocated by socket-paths.js under a short, per-user
+ * runtime directory so long HOME paths cannot exceed Unix socket limits.
  */
 
 const path = require('path');
 const fs = require('fs');
-const os = require('os');
 const net = require('net');
 const { readClustersFileSync } = require('../../lib/clusters-registry');
+const socketPaths = require('./socket-paths');
 
-const ZEROSHOT_DIR = path.join(os.homedir(), '.zeroshot');
-const SOCKET_DIR = path.join(ZEROSHOT_DIR, 'sockets');
+const ZEROSHOT_DIR = path.join(socketPaths.resolveHomeDir(), '.zeroshot');
+const SOCKET_DIR = socketPaths.getSocketDir();
 
 /**
  * Check if an ID is a known cluster by looking up clusters.json
@@ -35,9 +33,7 @@ function isKnownCluster(id) {
  * Ensure socket directory exists
  */
 function ensureSocketDir() {
-  if (!fs.existsSync(SOCKET_DIR)) {
-    fs.mkdirSync(SOCKET_DIR, { recursive: true });
-  }
+  socketPaths.ensureSocketDir();
 }
 
 /**
@@ -46,8 +42,7 @@ function ensureSocketDir() {
  * @returns {string} - Socket path
  */
 function getTaskSocketPath(taskId) {
-  ensureSocketDir();
-  return path.join(SOCKET_DIR, `${taskId}.sock`);
+  return socketPaths.getTaskSocketPath(taskId);
 }
 
 /**
@@ -57,11 +52,7 @@ function getTaskSocketPath(taskId) {
  * @returns {string} - Socket path
  */
 function getAgentSocketPath(clusterId, agentId) {
-  const clusterDir = path.join(SOCKET_DIR, clusterId);
-  if (!fs.existsSync(clusterDir)) {
-    fs.mkdirSync(clusterDir, { recursive: true });
-  }
-  return path.join(clusterDir, `${agentId}.sock`);
+  return socketPaths.getAgentSocketPath(clusterId, agentId);
 }
 
 /**
@@ -81,8 +72,7 @@ function getSocketPath(id, agentId = null) {
       return getAgentSocketPath(id, agentId);
     }
     // Cluster-level socket (future use)
-    ensureSocketDir();
-    return path.join(SOCKET_DIR, `${id}.sock`);
+    return socketPaths.getClusterSocketPath(id);
   }
   // Unknown format, treat as task
   return getTaskSocketPath(id);

package/src/attach/socket-paths.js

@@ -0,0 +1,85 @@
+/**
+ * Deterministic attach socket paths.
+ *
+ * Unix-domain sockets have a small path budget (104 bytes on macOS). Keep the
+ * live socket namespace independent from HOME while retaining one namespace
+ * per OS user and Zeroshot home.
+ */
+
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const SOCKET_ROOT = process.platform === 'win32' ? null : '/tmp';
+const SOCKET_DIR_MODE = 0o700;
+
+function shortHash(value) {
+  return crypto.createHash('sha256').update(value).digest('hex').slice(0, 16);
+}
+
+function userNamespace() {
+  if (typeof process.getuid === 'function') {
+    return String(process.getuid());
+  }
+  return shortHash(os.userInfo().username);
+}
+
+function resolveHomeDir(env = process.env) {
+  return env.ZEROSHOT_HOME || env.HOME || env.USERPROFILE || os.homedir();
+}
+
+function getSocketDir(homeDir = resolveHomeDir()) {
+  if (process.platform === 'win32') {
+    return path.join(homeDir, '.zeroshot', 'sockets');
+  }
+  return path.join(SOCKET_ROOT, `zeroshot-${userNamespace()}-${shortHash(homeDir)}`);
+}
+
+function assertSafeSocketDir(socketDir) {
+  const stat = fs.lstatSync(socketDir);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error(`Attach socket path is not a directory: ${socketDir}`);
+  }
+  if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
+    throw new Error(`Attach socket directory is not owned by the current user: ${socketDir}`);
+  }
+}
+
+function ensureOwnedDirectory(socketDir) {
+  fs.mkdirSync(socketDir, { recursive: true, mode: SOCKET_DIR_MODE });
+  assertSafeSocketDir(socketDir);
+  if (process.platform !== 'win32') {
+    fs.chmodSync(socketDir, SOCKET_DIR_MODE);
+  }
+  return socketDir;
+}
+
+function ensureSocketDir(homeDir = resolveHomeDir()) {
+  const socketDir = getSocketDir(homeDir);
+  return ensureOwnedDirectory(socketDir);
+}
+
+function getTaskSocketPath(taskId, homeDir = resolveHomeDir()) {
+  return path.join(ensureSocketDir(homeDir), `${taskId}.sock`);
+}
+
+function getAgentSocketPath(clusterId, agentId, homeDir = resolveHomeDir()) {
+  const clusterDir = path.join(ensureSocketDir(homeDir), clusterId);
+  ensureOwnedDirectory(clusterDir);
+  return path.join(clusterDir, `${agentId}.sock`);
+}
+
+function getClusterSocketPath(clusterId, homeDir = resolveHomeDir()) {
+  return path.join(ensureSocketDir(homeDir), `${clusterId}.sock`);
+}
+
+module.exports = {
+  SOCKET_DIR_MODE,
+  resolveHomeDir,
+  getSocketDir,
+  ensureSocketDir,
+  getTaskSocketPath,
+  getAgentSocketPath,
+  getClusterSocketPath,
+};