@the-open-engine/zeroshot 6.7.1 → 6.7.2

package/src/isolation-manager.js

@@ -28,6 +28,7 @@ const { readRepoSettings } = require('../lib/repo-settings');
 const { provisionClaudeCredentials } = require('./claude-credentials');
 
 const DEFAULT_WORKTREE_SETUP_TIMEOUT_MS = 15 * 60 * 1000;
+const FRESH_BASE_REF_PREFIX = 'refs/zeroshot/base-fetch';
 
 function runSync(command, args, options = {}) {
   const timeout = options.timeout ?? 30000;
@@ -48,6 +49,61 @@ function runShellSync(command, options = {}) {
   return runSync('/bin/bash', ['-lc', command], options);
 }
 
+function resolveCommit(repoRoot, ref) {
+  return runSync('git', ['rev-parse', '--verify', `${ref}^{commit}`], {
+    cwd: repoRoot,
+    encoding: 'utf8',
+    stdio: 'pipe',
+  }).trim();
+}
+
+function deleteTemporaryBaseRef(repoRoot, temporaryRef) {
+  try {
+    runSync('git', ['update-ref', '-d', temporaryRef], {
+      cwd: repoRoot,
+      encoding: 'utf8',
+      stdio: 'pipe',
+    });
+  } catch (err) {
+    console.warn(
+      `[IsolationManager] Warning: failed to remove temporary base ref ${temporaryRef}: ${err.message}`
+    );
+  }
+}
+
+function fetchFreshRemoteBase(repoRoot, remoteName, branch) {
+  const temporaryRef = `${FRESH_BASE_REF_PREFIX}/${crypto.randomBytes(16).toString('hex')}`;
+
+  try {
+    runSync(
+      'git',
+      [
+        'fetch',
+        '--atomic',
+        '--no-tags',
+        '--no-write-fetch-head',
+        '--refmap=',
+        '--',
+        remoteName,
+        `+refs/heads/${branch}:${temporaryRef}`,
+      ],
+      {
+        cwd: repoRoot,
+        encoding: 'utf8',
+        stdio: 'pipe',
+      }
+    );
+
+    return {
+      baseSha: resolveCommit(repoRoot, temporaryRef),
+      temporaryRef,
+    };
+  } catch (err) {
+    deleteTemporaryBaseRef(repoRoot, temporaryRef);
+    throw err;
+  }
+}
+
 function expandHomePath(value) {
   if (!value) return value;
   if (value === '~') return os.homedir();
@@ -127,7 +183,7 @@ class IsolationManager {
     this.containers = new Map(); // clusterId -> containerId
     this.isolatedDirs = new Map(); // clusterId -> { path, originalDir }
     this.clusterConfigDirs = new Map(); // clusterId -> configDirPath
-    this.worktrees = new Map(); // clusterId -> { path, branch, repoRoot }
+    this.worktrees = new Map(); // clusterId -> { path, branch, repoRoot, baseRef, baseSha }
     this._exitWatchers = new Map(); // clusterId -> ChildProcess
   }
 
@@ -1443,7 +1499,7 @@ class IsolationManager {
    * Creates a git worktree at ~/.zeroshot/worktrees/{clusterId}
    * @param {string} clusterId - Cluster ID
    * @param {string} workDir - Original working directory (must be a git repo)
-   * @returns {{ path: string, branch: string, repoRoot: string }}
+   * @returns {{ path: string, branch: string, repoRoot: string, baseRef: string, baseSha: string }}
    */
   createWorktreeIsolation(clusterId, workDir, options = {}) {
     if (!this._isGitRepo(workDir)) {
@@ -1485,8 +1541,10 @@ class IsolationManager {
    * @param {string} workDir - Original working directory
    * @param {object} [options] - Worktree creation options
    * @param {string} [options.baseRef] - Git ref to base the worktree branch on
+   * @param {string} [options.remoteName=origin] - Remote used by a remote base ref
+   * @param {boolean} [options.requireFreshBase=false] - Require a freshly fetched remote base
    * @param {number} [options.worktreeSetupTimeoutMs] - Setup command timeout in milliseconds
-   * @returns {{ path: string, branch: string, repoRoot: string }}
+   * @returns {{ path: string, branch: string, repoRoot: string, baseRef: string, baseSha: string }}
    */
   createWorktree(clusterId, workDir, options = {}) {
     const repoRoot = this._getGitRoot(workDir);
@@ -1560,20 +1618,42 @@ class IsolationManager {
     }
     const worktreeSetupTimeoutMs = resolveWorktreeSetupTimeoutMs(repoSettings, options);
 
-    // Best-effort ensure origin/<branch> exists locally if requested.
-    if (worktreeBaseRef && worktreeBaseRef.startsWith('origin/')) {
-      const branch = worktreeBaseRef.slice('origin/'.length);
-      try {
-        runSync('git', ['fetch', 'origin', branch], {
-          cwd: repoRoot,
-          encoding: 'utf8',
-          stdio: 'pipe',
-        });
-      } catch {
-        // ignore
+    const baseRef = worktreeBaseRef || 'HEAD';
+    const remoteName = options.remoteName || 'origin';
+    let baseSha;
+    let temporaryBaseRef = null;
+
+    if (worktreeBaseRef && worktreeBaseRef.startsWith(`${remoteName}/`)) {
+      const branch = worktreeBaseRef.slice(remoteName.length + 1);
+      const remoteTrackingRef = `refs/remotes/${remoteName}/${branch}`;
+
+      if (options.requireFreshBase === true) {
+        const freshBase = fetchFreshRemoteBase(repoRoot, remoteName, branch);
+        baseSha = freshBase.baseSha;
+        temporaryBaseRef = freshBase.temporaryRef;
+      } else {
+        try {
+          runSync(
+            'git',
+            ['fetch', '--no-tags', '--', remoteName, `+refs/heads/${branch}:${remoteTrackingRef}`],
+            {
+              cwd: repoRoot,
+              encoding: 'utf8',
+              stdio: 'pipe',
+            }
+          );
+        } catch {
+          // Repository worktree settings historically allowed an offline cached remote ref.
+        }
+        baseSha = resolveCommit(repoRoot, remoteTrackingRef);
       }
+    } else {
+      baseSha = resolveCommit(repoRoot, baseRef);
     }
 
+    console.log(`[IsolationManager] Worktree base ref: ${baseRef}`);
+    console.log(`[IsolationManager] Worktree base commit: ${baseSha}`);
+
     // Create branch name from cluster ID (e.g., cluster-cosmic-meteor-87 -> zeroshot/cosmic-meteor-87)
     const baseBranchName = `zeroshot/${clusterId.replace(/^cluster-/, '')}`;
     let branchName = baseBranchName;
@@ -1581,44 +1661,18 @@ class IsolationManager {
     // Worktree path in persistent location (survives reboots)
     const worktreePath = path.join(os.homedir(), '.zeroshot', 'worktrees', clusterId);
 
-    // Ensure parent directory exists
-    const parentDir = path.dirname(worktreePath);
-    if (!fs.existsSync(parentDir)) {
-      fs.mkdirSync(parentDir, { recursive: true });
-    }
-
-    // Best-effort cleanup of stale worktree metadata and directory.
-    // IMPORTANT: If a previous run deleted the directory without deregistering the worktree,
-    // git may keep the branch "checked out" and block deletion/reuse.
     try {
-      runSync('git', ['worktree', 'remove', '--force', worktreePath], {
-        cwd: repoRoot,
-        encoding: 'utf8',
-        stdio: 'pipe',
-      });
-    } catch {
-      // ignore
-    }
-    try {
-      runSync('git', ['worktree', 'prune'], { cwd: repoRoot, encoding: 'utf8', stdio: 'pipe' });
-    } catch {
-      // ignore
-    }
-    try {
-      fs.rmSync(worktreePath, { recursive: true, force: true });
-    } catch {
-      // ignore
-    }
-
-    const baseRef = worktreeBaseRef || 'HEAD';
-    console.log(`[IsolationManager] Worktree base ref: ${baseRef}`);
-    console.log(`[IsolationManager] Worktree path: ${worktreePath}`);
+      // Ensure parent directory exists
+      const parentDir = path.dirname(worktreePath);
+      if (!fs.existsSync(parentDir)) {
+        fs.mkdirSync(parentDir, { recursive: true });
+      }
 
-    // Create worktree with new branch based on baseRef (retry on branch collision/in-use)
-    for (let attempt = 0; attempt < 10; attempt++) {
-      // Best-effort delete if branch exists and is not in use by another worktree.
+      // Best-effort cleanup of stale worktree metadata and directory.
+      // IMPORTANT: If a previous run deleted the directory without deregistering the worktree,
+      // git may keep the branch "checked out" and block deletion/reuse.
       try {
-        runSync('git', ['branch', '-D', branchName], {
+        runSync('git', ['worktree', 'remove', '--force', worktreePath], {
           cwd: repoRoot,
           encoding: 'utf8',
           stdio: 'pipe',
@@ -1626,38 +1680,72 @@ class IsolationManager {
       } catch {
         // ignore
       }
-
       try {
-        runSync('git', ['worktree', 'add', '-b', branchName, worktreePath, baseRef], {
+        runSync('git', ['worktree', 'prune'], {
           cwd: repoRoot,
           encoding: 'utf8',
           stdio: 'pipe',
         });
-        console.log(`[IsolationManager] Worktree setup phase: created branch ${branchName}`);
-        break;
-      } catch (err) {
-        const stderr = (
-          err && (err.stderr || err.message) ? String(err.stderr || err.message) : ''
-        ).toLowerCase();
-        const isBranchCollision =
-          stderr.includes('already exists') ||
-          stderr.includes('cannot delete branch') ||
-          stderr.includes('checked out');
-
-        if (attempt < 9 && isBranchCollision) {
-          branchName = `${baseBranchName}-${crypto.randomBytes(3).toString('hex')}`;
-          try {
-            runSync('git', ['worktree', 'prune'], {
-              cwd: repoRoot,
-              encoding: 'utf8',
-              stdio: 'pipe',
-            });
-          } catch {
-            // ignore
+      } catch {
+        // ignore
+      }
+      try {
+        fs.rmSync(worktreePath, { recursive: true, force: true });
+      } catch {
+        // ignore
+      }
+
+      console.log(`[IsolationManager] Worktree path: ${worktreePath}`);
+
+      // Create worktree with new branch based on baseRef (retry on branch collision/in-use)
+      for (let attempt = 0; attempt < 10; attempt++) {
+        // Best-effort delete if branch exists and is not in use by another worktree.
+        try {
+          runSync('git', ['branch', '-D', branchName], {
+            cwd: repoRoot,
+            encoding: 'utf8',
+            stdio: 'pipe',
+          });
+        } catch {
+          // ignore
+        }
+
+        try {
+          runSync('git', ['worktree', 'add', '-b', branchName, worktreePath, baseSha], {
+            cwd: repoRoot,
+            encoding: 'utf8',
+            stdio: 'pipe',
+          });
+          console.log(`[IsolationManager] Worktree setup phase: created branch ${branchName}`);
+          break;
+        } catch (err) {
+          const stderr = (
+            err && (err.stderr || err.message) ? String(err.stderr || err.message) : ''
+          ).toLowerCase();
+          const isBranchCollision =
+            stderr.includes('already exists') ||
+            stderr.includes('cannot delete branch') ||
+            stderr.includes('checked out');
+
+          if (attempt < 9 && isBranchCollision) {
+            branchName = `${baseBranchName}-${crypto.randomBytes(3).toString('hex')}`;
+            try {
+              runSync('git', ['worktree', 'prune'], {
+                cwd: repoRoot,
+                encoding: 'utf8',
+                stdio: 'pipe',
+              });
+            } catch {
+              // ignore
+            }
+            continue;
           }
-          continue;
+          throw err;
         }
-        throw err;
+      }
+    } finally {
+      if (temporaryBaseRef) {
+        deleteTemporaryBaseRef(repoRoot, temporaryBaseRef);
       }
     }
 
@@ -1684,6 +1772,8 @@ class IsolationManager {
       path: worktreePath,
       branch: branchName,
       repoRoot,
+      baseRef,
+      baseSha,
     };
   }
 

package/src/orchestrator.js

@@ -224,6 +224,7 @@ function buildPrOptions(options, requiredQualityGates) {
     prBase: options.prBase || null,
     mergeQueue: options.mergeQueue || false,
     closeIssue: options.closeIssue || null,
+    gitRemote: options.gitRemote || null,
     autoMerge,
     ...(requiredQualityGates.length > 0 ? { requiredQualityGates } : {}),
     cwd: options.cwd || process.cwd(),
@@ -1266,6 +1267,8 @@ class Orchestrator {
         const { detectGitContext } = require('../lib/git-remote-utils');
         const gitContext = detectGitContext(options.cwd);
         cluster.gitPlatform = gitContext?.provider || null;
+        options.gitRemote = gitContext?.remote || options.gitRemote || null;
+        cluster.prOptions = buildPrOptions(options, requiredQualityGates);
 
         if (cluster.gitPlatform) {
           this._log(`[Orchestrator] Git platform detected: ${cluster.gitPlatform.toUpperCase()}`);
@@ -1796,18 +1799,30 @@ class Orchestrator {
       const workDir = options.cwd || process.cwd();
 
       isolationManager = new IsolationManager({});
-      // `prBase` is the PR target branch. Use that same local ref as the
-      // worktree base so repo-local integration commits are not skipped.
+      const { detectGitContext } = require('../lib/git-remote-utils');
+      const gitContext = detectGitContext(workDir);
+      if (gitContext?.remote) {
+        options.gitRemote = gitContext.remote;
+      }
+
+      // `prBase` is the PR target branch. Base isolated work on its refreshed
+      // remote-tracking ref so a stale local branch cannot change the plan.
       const worktreeOptions = {};
       if (options.prBase) {
-        worktreeOptions.baseRef = options.prBase;
-        this._log(`[Orchestrator] Using worktree base ref: ${options.prBase}`);
+        const remoteName = options.gitRemote || 'origin';
+        worktreeOptions.baseRef = `${remoteName}/${options.prBase}`;
+        if (remoteName !== 'origin') {
+          worktreeOptions.remoteName = remoteName;
+        }
+        worktreeOptions.requireFreshBase = true;
+        this._log(`[Orchestrator] Using worktree base ref: ${worktreeOptions.baseRef}`);
       }
       worktreeInfo = isolationManager.createWorktreeIsolation(clusterId, workDir, worktreeOptions);
 
       this._log(`[Orchestrator] Starting cluster in worktree isolation mode`);
       this._log(`[Orchestrator] Worktree: ${worktreeInfo.path}`);
       this._log(`[Orchestrator] Branch: ${worktreeInfo.branch}`);
+      this._log(`[Orchestrator] Worktree base commit: ${worktreeInfo.baseSha}`);
     }
 
     return { isolationManager, containerId, worktreeInfo, image: isolationImage };
@@ -1870,16 +1885,13 @@ class Orchestrator {
       closeIssue: options.closeIssue,
       requiredQualityGates: options.requiredQualityGates,
       autoMerge: resolveRunPlan(options).autoMerge,
+      gitRemote: gitContext?.remote || options.gitRemote,
+      issueNumber: inputData.number,
+      issueTitle: inputData.title,
+      includeIssueReference: !skipCloseIssue,
       cwd: options.cwd,
     });
 
-    // Template replacement for issue context
-    const issueRef = skipCloseIssue ? '' : `Closes #${inputData.number || 'unknown'}`;
-    gitPusherConfig.prompt = gitPusherConfig.prompt
-      .replace(/\{\{issue_number\}\}/g, inputData.number || 'unknown')
-      .replace(/\{\{issue_title\}\}/g, inputData.title || 'Implementation')
-      .replace(/Closes #\{\{issue_number\}\}/g, issueRef);
-
     config.agents.push(gitPusherConfig);
     this._log(
       `[Orchestrator] Injected ${platform}-git-pusher agent (issue: ${inputData.number || 'N/A'}, PR platform: ${platform.toUpperCase()})`
@@ -2649,31 +2661,68 @@ class Orchestrator {
   }
 
   _resolveFailureInfo(cluster, clusterId) {
-    if (cluster.failureInfo) {
-      return cluster.failureInfo.agentId ? cluster.failureInfo : null;
+    const persistedFailure = cluster.failureInfo?.agentId ? cluster.failureInfo : null;
+    if (persistedFailure) {
+      if (!this._hasDurableProgressAfterFailure(cluster, clusterId, persistedFailure)) {
+        return persistedFailure;
+      }
+      this._log(
+        `[Orchestrator] Ignoring recovered registry failure from ${persistedFailure.agentId}; durable task progress followed it`
+      );
     }
 
     const errors = cluster.messageBus.query({
       cluster_id: clusterId,
       topic: 'AGENT_ERROR',
-      limit: 10,
       order: 'desc',
     });
 
-    if (errors.length === 0) {
-      return null;
+    for (const error of errors) {
+      const failureInfo = {
+        agentId: error.sender,
+        taskId: error.content?.data?.taskId || null,
+        iteration: error.content?.data?.iteration || 0,
+        error: error.content?.data?.error || error.content?.text,
+        timestamp: error.timestamp,
+      };
+      if (this._hasDurableProgressAfterFailure(cluster, clusterId, failureInfo)) {
+        this._log(
+          `[Orchestrator] Ignoring recovered ledger failure from ${error.sender}; durable task progress followed it`
+        );
+        continue;
+      }
+
+      this._log(`[Orchestrator] Found failure from ledger: ${failureInfo.agentId}`);
+      return failureInfo;
     }
 
-    const firstError = errors[0];
-    const failureInfo = {
-      agentId: firstError.sender,
-      taskId: firstError.content?.data?.taskId || null,
-      iteration: firstError.content?.data?.iteration || 0,
-      error: firstError.content?.data?.error || firstError.content?.text,
-      timestamp: firstError.timestamp,
-    };
-    this._log(`[Orchestrator] Found failure from ledger: ${failureInfo.agentId}`);
-    return failureInfo;
+    return null;
+  }
+
+  _hasDurableProgressAfterFailure(cluster, clusterId, failureInfo) {
+    const failureIteration = failureInfo.iteration;
+    const failureTimestamp = failureInfo.timestamp;
+    return cluster.messageBus
+      .query({
+        cluster_id: clusterId,
+        topic: 'AGENT_LIFECYCLE',
+        sender: failureInfo.agentId,
+        since: failureTimestamp,
+      })
+      .some((message) => {
+        const event = message.content?.data?.event;
+        if (!['TASK_STARTED', 'TASK_COMPLETED'].includes(event)) {
+          return false;
+        }
+
+        const iteration = message.content?.data?.iteration;
+        return (
+          (Number.isFinite(failureTimestamp) && message.timestamp > failureTimestamp) ||
+          (Number.isInteger(failureIteration) &&
+            Number.isInteger(iteration) &&
+            iteration > failureIteration)
+        );
+      });
   }
 
   _requireFailedAgent(clusterId, cluster, failureInfo) {
@@ -3996,7 +4045,6 @@ Continue from where you left off. Review your previous output to understand what
         }
       }
 
-      // Generate platform-specific git-pusher agent from template
       const {
         generateGitPusherAgent,
         isPlatformSupported,
@@ -4008,18 +4056,19 @@ Continue from where you left off. Review your previous output to understand what
         );
       }
 
-      // Use persisted PR options from cluster state (or empty for repo settings fallback)
-      const gitPusherConfig = generateGitPusherAgent(platform, cluster.prOptions || {});
-
       // Get issue context from ledger
       const issueMsg = cluster.messageBus.ledger.findLast({ topic: 'ISSUE_OPENED' });
       const issueNumber = issueMsg?.content?.data?.number || 'unknown';
       const issueTitle = issueMsg?.content?.data?.title || 'Implementation';
 
-      // Inject issue context into prompt
-      gitPusherConfig.prompt = gitPusherConfig.prompt
-        .replace(/\{\{issue_number\}\}/g, issueNumber)
-        .replace(/\{\{issue_title\}\}/g, issueTitle);
+      // Generate the final prompt in one typed assembly pass. Issue values are
+      // resolved before the shell-quoted remote is inserted, so placeholder-like
+      // remote names cannot be rewritten by issue context.
+      const gitPusherConfig = generateGitPusherAgent(platform, {
+        ...(cluster.prOptions || {}),
+        issueNumber,
+        issueTitle,
+      });
 
       await this._opAddAgents(cluster, { agents: [gitPusherConfig] }, context);
       this._log(`    [--pr mode] Injected ${platform}-git-pusher agent`);

package/task-lib/attachable-watcher.js

@@ -5,10 +5,8 @@
  * Runs detached from parent, provides Unix socket for attach clients.
  */
 
-import { appendFileSync, existsSync, mkdirSync, unlinkSync } from 'fs';
+import { appendFileSync, unlinkSync } from 'fs';
 import { unlink } from 'fs/promises';
-import { join } from 'path';
-import { homedir } from 'os';
 import { updateTask } from './store.js';
 import {
   detectProviderFatalError,
@@ -72,6 +70,7 @@ process.on('unhandledRejection', (reason) => {
 
 const require = createRequire(import.meta.url);
 const { AttachServer } = require('../src/attach');
+const { getTaskSocketPath } = require('../src/attach/socket-paths');
 const { normalizeProviderName } = require('../lib/provider-names');
 
 const taskId = taskIdArg;
@@ -88,12 +87,7 @@ const commandSpec = config.commandSpec || {
 commandSpecCleanup = commandSpec.cleanup || [];
 let server = null;
 
-const SOCKET_DIR = join(homedir(), '.zeroshot', 'sockets');
-const socketPath = join(SOCKET_DIR, `${taskId}.sock`);
-
-if (!existsSync(SOCKET_DIR)) {
-  mkdirSync(SOCKET_DIR, { recursive: true });
-}
+const socketPath = getTaskSocketPath(taskId);
 
 function log(msg) {
   appendFileSync(logFile, msg);

package/task-lib/commands/run.js

@@ -1,5 +1,5 @@
 import chalk from 'chalk';
-import { spawnTask } from '../runner.js';
+import { shouldUseAttachableWatcher, spawnTask } from '../runner.js';
 
 export async function runTask(prompt, options = {}) {
   if (!prompt || prompt.trim().length === 0) {
@@ -46,8 +46,23 @@ export async function runTask(prompt, options = {}) {
   console.log(chalk.dim(`  Log: ${task.logFile}`));
   console.log(chalk.dim(`  CWD: ${task.cwd}`));
 
+  const attachSupported = shouldUseAttachableWatcher(
+    {
+      jsonSchema: outputFormat === 'json' ? jsonSchema : null,
+    },
+    task.provider
+  );
+
   console.log(chalk.dim('\nCommands:'));
-  console.log(chalk.dim(`  zeroshot attach ${task.id}    # Attach to task (Ctrl+B d to detach)`));
+  if (attachSupported) {
+    console.log(chalk.dim(`  zeroshot attach ${task.id}    # Attach to task (Ctrl+B d to detach)`));
+  } else {
+    console.log(
+      chalk.dim(
+        `  Attach unavailable: ${task.provider} strict structured output uses a non-PTY watcher`
+      )
+    );
+  }
   console.log(chalk.dim(`  zeroshot logs ${task.id}      # View output`));
   console.log(chalk.dim(`  zeroshot logs -f ${task.id}   # Follow output`));
   console.log(chalk.dim(`  zeroshot status ${task.id}    # Check status`));

package/task-lib/runner.js

@@ -53,7 +53,13 @@ export function spawnTask(prompt, options = {}) {
     providerName,
     commandSpec
   );
-  const watcherScript = resolveWatcherScript(options);
+  const watcherScript = resolveWatcherScript(
+    {
+      attachable: options.attachable,
+      jsonSchema,
+    },
+    providerName
+  );
   spawnWatcher({
     watcherScript,
     id,
@@ -165,8 +171,20 @@ function buildWatcherCommandSpec(commandSpec) {
   return watcherCommandSpec;
 }
 
-function resolveWatcherScript(options) {
-  const useAttachable = options.attachable !== false && !options.jsonSchema;
+export function shouldUseAttachableWatcher(options, providerName) {
+  if (options.attachable === false) {
+    return false;
+  }
+
+  // Claude strict structured output still needs the non-PTY watcher. Claude
+  // can treat PTY notifications as streaming commands and reject the run.
+  // Other providers, including Codex, support their structured-output mode in
+  // the attachable PTY watcher and must not lose the advertised attach socket.
+  return !(providerName === 'claude' && options.jsonSchema);
+}
+
+function resolveWatcherScript(options, providerName) {
+  const useAttachable = shouldUseAttachableWatcher(options, providerName);
   return useAttachable ? join(__dirname, 'attachable-watcher.js') : join(__dirname, 'watcher.js');
 }