@the-open-engine/zeroshot 6.7.1 → 6.8.0

package/scripts/release-recovery.js

@@ -0,0 +1,149 @@
+#!/usr/bin/env node
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync, spawnSync } = require('child_process');
+
+function run(command, args, options = {}) {
+  return execFileSync(command, args, {
+    encoding: 'utf8',
+    stdio: options.stdio || ['ignore', 'pipe', 'pipe'],
+    ...options,
+  }).trim();
+}
+
+function parseReleaseTag(tag) {
+  const match = String(tag || '').match(/^v(\d+\.\d+\.\d+)$/);
+  if (!match) throw new Error('release_tag must match vX.Y.Z');
+  return match[1];
+}
+
+function validateCommit(commit) {
+  if (!/^[0-9a-f]{40}$/.test(String(commit || ''))) {
+    throw new Error('release_commit must be a full lowercase commit SHA');
+  }
+  return commit;
+}
+
+function verifyImmutableSource(tag, commit) {
+  run('git', ['show-ref', '--verify', `refs/tags/${tag}`]);
+  const head = run('git', ['rev-parse', 'HEAD']);
+  const tagCommit = run('git', ['rev-list', '-n', '1', `refs/tags/${tag}`]);
+  if (head !== commit || tagCommit !== commit) {
+    throw new Error('checkout, protected tag, and release_commit must reference the same commit');
+  }
+  run('git', ['merge-base', '--is-ancestor', commit, 'origin/main']);
+}
+
+function npmPackageMetadata(name, version) {
+  const result = spawnSync(
+    'npm',
+    ['view', `${name}@${version}`, 'version', 'gitHead', 'dist.attestations', '--json'],
+    { encoding: 'utf8' }
+  );
+  if (result.status === 0) return JSON.parse(result.stdout);
+  if (/\bE404\b|is not in this registry|No match found/i.test(result.stderr || '')) return null;
+  throw new Error(`npm registry lookup failed: ${(result.stderr || result.stdout).trim()}`);
+}
+
+function verifyExistingNpmVersion(metadata, version, commit) {
+  if (metadata.version !== version) {
+    throw new Error(`npm returned ${metadata.version}; expected ${version}`);
+  }
+  if (metadata.gitHead !== commit) {
+    throw new Error(`npm gitHead ${metadata.gitHead || '(missing)'} does not match ${commit}`);
+  }
+  if (!metadata['dist.attestations']?.provenance) {
+    throw new Error('npm package exists without a provenance attestation');
+  }
+}
+
+function recoverNpm(name, version, commit) {
+  const existing = npmPackageMetadata(name, version);
+  if (existing) {
+    verifyExistingNpmVersion(existing, version, commit);
+    console.log(`${name}@${version} already exists with matching provenance; nothing to recover`);
+    return;
+  }
+
+  run('npm', ['version', version, '--no-git-tag-version', '--allow-same-version']);
+  run('npm', ['publish', '--access', 'public', '--provenance'], { stdio: 'inherit' });
+
+  const published = npmPackageMetadata(name, version);
+  if (!published) throw new Error(`${name}@${version} was not visible after publication`);
+  verifyExistingNpmVersion(published, version, commit);
+  console.log(`Recovered ${name}@${version}`);
+}
+
+function releaseExists(tag) {
+  const result = spawnSync('gh', ['release', 'view', tag], { encoding: 'utf8' });
+  if (result.status === 0) return true;
+  if (/release not found|HTTP 404/i.test(`${result.stdout}\n${result.stderr}`)) return false;
+  throw new Error(`GitHub Release lookup failed: ${(result.stderr || result.stdout).trim()}`);
+}
+
+function recoverGithubRelease(tag, commit, version) {
+  if (releaseExists(tag)) {
+    console.log(`GitHub Release ${tag} already exists; nothing to recover`);
+    return;
+  }
+
+  const notesPath = path.join(process.cwd(), 'docs', 'releases', `${tag}.md`);
+  const args = ['release', 'create', tag, '--verify-tag', '--target', commit, '--title', tag];
+  if (fs.existsSync(notesPath)) {
+    args.push('--notes-file', notesPath);
+  } else {
+    args.push('--generate-notes');
+    const tags = run('git', [
+      'tag',
+      '--list',
+      'v[0-9]*',
+      '--merged',
+      `${commit}^`,
+      '--sort=-version:refname',
+    ])
+      .split(/\r?\n/)
+      .filter(Boolean);
+    if (tags[0]) args.push('--notes-start-tag', tags[0]);
+  }
+
+  run('gh', args, { stdio: 'inherit' });
+  if (!releaseExists(tag)) throw new Error(`GitHub Release ${tag} was not created`);
+  console.log(`Recovered GitHub Release ${tag} for ${version}`);
+}
+
+function main() {
+  const action = process.env.RECOVERY_ACTION;
+  if (!['recover-npm', 'recover-github-release'].includes(action)) {
+    throw new Error('RECOVERY_ACTION must be recover-npm or recover-github-release');
+  }
+
+  const tag = process.env.RELEASE_TAG;
+  const commit = validateCommit(process.env.RELEASE_COMMIT);
+  const version = parseReleaseTag(tag);
+  verifyImmutableSource(tag, commit);
+
+  const packageJson = require('../package.json');
+  if (action === 'recover-npm') {
+    recoverNpm(packageJson.name, version, commit);
+  } else {
+    recoverGithubRelease(tag, commit, version);
+  }
+}
+
+if (require.main === module) {
+  try {
+    main();
+  } catch (error) {
+    console.error(`Release recovery failed: ${error.message}`);
+    process.exit(1);
+  }
+}
+
+module.exports = {
+  npmPackageMetadata,
+  parseReleaseTag,
+  releaseExists,
+  validateCommit,
+  verifyExistingNpmVersion,
+};

package/scripts/semantic-release-notes.js

@@ -0,0 +1,44 @@
+const fs = require('fs');
+const path = require('path');
+
+function curatedNotesPath(cwd, version) {
+  return path.join(cwd, 'docs', 'releases', `v${version}.md`);
+}
+
+function readCuratedNotes(cwd, version) {
+  const notesPath = curatedNotesPath(cwd, version);
+  if (!fs.existsSync(notesPath)) return null;
+
+  const notes = fs.readFileSync(notesPath, 'utf8').trim();
+  if (!notes) {
+    throw new Error(`Curated release notes are empty: ${notesPath}`);
+  }
+  return `${notes}\n`;
+}
+
+async function conventionalNotes(pluginConfig, context) {
+  const generator = await import('@semantic-release/release-notes-generator');
+  return generator.generateNotes(pluginConfig.conventional || {}, context);
+}
+
+async function generateNotesWithFallback(pluginConfig, context, fallback = conventionalNotes) {
+  const version = context.nextRelease?.version;
+  if (!version) throw new Error('nextRelease.version is required to generate release notes');
+
+  const curated = readCuratedNotes(context.cwd || process.cwd(), version);
+  if (curated) return curated;
+  const generated = await fallback(pluginConfig, context);
+  return generated;
+}
+
+async function generateNotes(pluginConfig, context) {
+  const notes = await generateNotesWithFallback(pluginConfig, context);
+  return notes;
+}
+
+module.exports = {
+  curatedNotesPath,
+  generateNotes,
+  generateNotesWithFallback,
+  readCuratedNotes,
+};

package/scripts/setup-merge-queue.sh

@@ -1,75 +1,79 @@
 #!/bin/bash
-# Setup GitHub merge queue and branch protection for zeroshot
-# Run once after creating the repo or to update settings
 
-set -e
+set -euo pipefail
 
 REPO="the-open-engine/zeroshot"
+MAIN_RULESET_NAME="Protect main trunk"
+TAG_RULESET_NAME="Make release tags immutable"
 
-echo "╔═══════════════════════════════════════════════════════════════════╗"
-echo "║  Setting up merge queue for $REPO                         ║"
-echo "╚═══════════════════════════════════════════════════════════════════╝"
-echo ""
-
-# Check gh is authenticated
 if ! gh auth status &>/dev/null; then
-  echo "❌ ERROR: Not authenticated with GitHub CLI"
-  echo "   Run: gh auth login"
+  echo "ERROR: Authenticate GitHub CLI with: gh auth login"
   exit 1
 fi
 
-# Check we have admin access
-if ! gh api "repos/$REPO" --jq '.permissions.admin' | grep -q true; then
-  echo "❌ ERROR: You need admin access to $REPO"
+if [[ "$(gh api "repos/$REPO" --jq '.permissions.admin')" != "true" ]]; then
+  echo "ERROR: Repository admin access is required"
   exit 1
 fi
 
-echo "✓ Authenticated with admin access"
-echo ""
-
-# ============================================================================
-# Configure 'dev' branch protection (merge target)
-# ============================================================================
-
-echo "→ Configuring 'dev' branch protection..."
-
-gh api --method PUT "repos/$REPO/branches/dev/protection" \
-  --input - <<EOF
-{
-  "required_status_checks": {
-    "strict": true,
-    "contexts": ["check", "install-matrix (ubuntu-latest, 20)", "install-matrix (macos-latest, 20)"]
-  },
-  "enforce_admins": false,
-  "required_pull_request_reviews": null,
-  "restrictions": null,
-  "allow_force_pushes": false,
-  "allow_deletions": false,
-  "required_linear_history": true,
-  "required_conversation_resolution": false
+upsert_ruleset() {
+  local name="$1"
+  local payload="$2"
+  local id
+  id="$(gh api "repos/$REPO/rulesets" --jq ".[] | select(.name == \"$name\") | .id" | head -1)"
+  if [[ -n "$id" ]]; then
+    gh api --method PUT "repos/$REPO/rulesets/$id" --input "$payload" >/dev/null
+  else
+    gh api --method POST "repos/$REPO/rulesets" --input "$payload" >/dev/null
+  fi
 }
-EOF
-
-echo "✓ 'dev' branch protection configured"
 
-# Enable merge queue for dev branch
-echo "→ Enabling merge queue for 'dev' branch..."
+main_payload="$(mktemp)"
+tag_payload="$(mktemp)"
+trap 'rm -f "$main_payload" "$tag_payload"' EXIT
 
-# Note: Merge queue requires GitHub Enterprise or public repos with Actions
-# Using the ruleset API which supports merge queue
-gh api --method POST "repos/$REPO/rulesets" \
-  --input - <<EOF 2>/dev/null || echo "   (ruleset may already exist)"
+cat > "$main_payload" <<'JSON'
 {
-  "name": "dev-merge-queue",
+  "name": "Protect main trunk",
   "target": "branch",
   "enforcement": "active",
   "conditions": {
     "ref_name": {
-      "include": ["refs/heads/dev"],
+      "include": ["refs/heads/main"],
       "exclude": []
     }
   },
   "rules": [
+    {"type": "deletion"},
+    {"type": "non_fast_forward"},
+    {"type": "required_linear_history"},
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": true,
+        "required_reviewers": [],
+        "require_code_owner_review": false,
+        "dismissal_restriction": {
+          "enabled": false,
+          "allowed_actors": []
+        },
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": true,
+        "allowed_merge_methods": ["squash"]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          {"context": "required", "integration_id": 15368},
+          {"context": "semantic", "integration_id": 15368}
+        ]
+      }
+    },
     {
       "type": "merge_queue",
       "parameters": {
@@ -82,49 +86,34 @@ gh api --method POST "repos/$REPO/rulesets" \
         "min_entries_to_merge_wait_minutes": 1
       }
     }
-  ]
+  ],
+  "bypass_actors": []
 }
-EOF
-
-echo "✓ Merge queue enabled for 'dev'"
+JSON
 
-# ============================================================================
-# Configure 'main' branch protection (release branch)
-# ============================================================================
-
-echo "→ Configuring 'main' branch protection..."
-
-gh api --method PUT "repos/$REPO/branches/main/protection" \
-  --input - <<EOF
+cat > "$tag_payload" <<'JSON'
 {
-  "required_status_checks": {
-    "strict": true,
-    "contexts": ["check", "install-matrix (ubuntu-latest, 20)", "install-matrix (macos-latest, 20)"]
-  },
-  "enforce_admins": false,
-  "required_pull_request_reviews": {
-    "required_approving_review_count": 1,
-    "dismiss_stale_reviews": true,
-    "require_code_owner_reviews": false
+  "name": "Make release tags immutable",
+  "target": "tag",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/tags/v*"],
+      "exclude": []
+    }
   },
-  "restrictions": null,
-  "allow_force_pushes": false,
-  "allow_deletions": false,
-  "required_linear_history": true,
-  "required_conversation_resolution": false
+  "rules": [
+    {"type": "deletion"},
+    {"type": "non_fast_forward"}
+  ],
+  "bypass_actors": []
 }
-EOF
+JSON
 
-echo "✓ 'main' branch protection configured"
+upsert_ruleset "$MAIN_RULESET_NAME" "$main_payload"
+upsert_ruleset "$TAG_RULESET_NAME" "$tag_payload"
 
-# ============================================================================
-# Configure repository settings
-# ============================================================================
-
-echo "→ Configuring repository settings..."
-
-gh api --method PATCH "repos/$REPO" \
-  --input - <<EOF
+gh api --method PATCH "repos/$REPO" --input - <<'JSON' >/dev/null
 {
   "allow_squash_merge": true,
   "allow_merge_commit": false,
@@ -134,37 +123,34 @@ gh api --method PATCH "repos/$REPO" \
   "delete_branch_on_merge": true,
   "allow_auto_merge": true
 }
-EOF
-
-echo "✓ Repository settings configured"
-
-# ============================================================================
-# Summary
-# ============================================================================
-
-echo ""
-echo "╔═══════════════════════════════════════════════════════════════════╗"
-echo "║  ✓ Merge queue setup complete!                                    ║"
-echo "╚═══════════════════════════════════════════════════════════════════╝"
-echo ""
-echo "Workflow:"
-echo "  feature-branch (local)"
-echo "  ↓"
-echo "  pre-push hook → lint + typecheck (~5s)"
-echo "  ↓"
-echo "  push to origin/feature-branch"
-echo "  ↓"
-echo "  gh pr create --base dev"
-echo "  ↓"
-echo "  CI runs tests on PR branch"
-echo "  ↓"
-echo "  gh pr merge --auto --squash → enters merge queue"
-echo "  ↓"
-echo "  Queue rebases PR on latest dev + runs CI again"
-echo "  ↓"
-echo "  Merge to dev (only if CI passes on rebased code)"
-echo ""
-echo "Release workflow:"
-echo "  gh pr create --base main --head dev --title \"Release\""
-echo "  → CI passes → merge → semantic-release publishes"
-echo ""
+JSON
+
+gh api --method PUT "repos/$REPO/environments/release" --input - <<'JSON' >/dev/null
+{
+  "deployment_branch_policy": {
+    "protected_branches": false,
+    "custom_branch_policies": true
+  }
+}
+JSON
+
+if ! gh api "repos/$REPO/environments/release/deployment-branch-policies" \
+  --jq '.branch_policies[] | select(.name == "main") | .id' | grep -q .; then
+  gh api --method POST "repos/$REPO/environments/release/deployment-branch-policies" \
+    -f name=main -f type=branch >/dev/null
+fi
+
+gh variable set RELEASE_AUTOMATION_ENABLED --repo "$REPO" --body false
+
+if gh api "repos/$REPO/branches/main/protection" >/dev/null 2>&1; then
+  gh api --method DELETE "repos/$REPO/branches/main/protection"
+fi
+
+while IFS= read -r ruleset_id; do
+  [[ -n "$ruleset_id" ]] && gh api --method DELETE "repos/$REPO/rulesets/$ruleset_id"
+done < <(
+  gh api "repos/$REPO/rulesets" \
+    --jq '.[] | select(.name == "dev-merge-queue" or .name == "main-merge-queue") | .id'
+)
+
+echo "Configured protected main trunk, merge queue, immutable release tags, and disabled release automation."

package/src/agent/agent-task-executor.js

@@ -23,6 +23,10 @@ const {
   prepareClaudeConfigDir,
   resolveRepoMcpConfigPath,
 } = require('../worktree-claude-config.js');
+const {
+  appendTaskRunModelArgs,
+  wrapTaskRunWithIsolatedSettings,
+} = require('../task-run-model-args.js');
 const { buildRawLogOnlyMetadata } = require('./context-replay-policy');
 
 function runCommandWithTimeout(command, args, options = {}, callback = null) {
@@ -722,14 +726,10 @@ function resolveOutputFormatConfig(agent) {
 
 function buildTaskRunArgs({ agent, providerName, modelSpec, runOutputFormat }) {
   const args = ['task', 'run', '--output-format', runOutputFormat, '--provider', providerName];
-
-  if (modelSpec?.model) {
-    args.push('--model', modelSpec.model);
-  }
-
-  if (modelSpec?.reasoningEffort) {
-    args.push('--reasoning-effort', modelSpec.reasoningEffort);
-  }
+  const modelSpecSource = agent._resolveModelSpecSource
+    ? agent._resolveModelSpecSource()
+    : 'direct';
+  appendTaskRunModelArgs(args, modelSpec, modelSpecSource);
 
   // Add verification mode flag if configured
   if (agent.config.verificationMode) {
@@ -1509,11 +1509,14 @@ async function spawnClaudeTaskIsolated(agent, context) {
   const { manager, clusterId } = agent.isolation;
   const providerName = agent._resolveProvider ? agent._resolveProvider() : 'claude';
   const modelSpec = resolveAgentModelSpec(agent);
+  const modelSpecSource = agent._resolveModelSpecSource
+    ? agent._resolveModelSpecSource()
+    : 'direct';
 
   agent._log(`📦 Agent ${agent.id}: Running task in isolated container using zeroshot task run...`);
 
   const { desiredOutputFormat, runOutputFormat } = resolveOutputFormatConfig(agent);
-  const command = [
+  let command = [
     'zeroshot',
     ...buildTaskRunArgs({
       agent,
@@ -1531,6 +1534,12 @@ async function spawnClaudeTaskIsolated(agent, context) {
   });
 
   command.push(finalContext);
+  command = wrapTaskRunWithIsolatedSettings(command, {
+    providerName,
+    settings: loadSettings(),
+    modelSpecSource,
+    modelSpec,
+  });
 
   // STEP 1: Spawn task and extract task ID (same as non-isolated mode)
   // Timeout for spawn phase - if CLI hangs during init (e.g., opencode 429 bug), kill it

package/src/agent-cli-provider/adapters/common.ts

@@ -99,7 +99,7 @@ export function validateModelIdFromCatalog(
   modelId: string | null | undefined
 ): string | null | undefined {
   if (!modelId) return modelId;
-  if (catalog[modelId] !== undefined) return modelId;
+  if (Object.prototype.hasOwnProperty.call(catalog, modelId)) return modelId;
   const validModels = Object.keys(catalog).join(', ');
   throw new InvalidProviderModelError(
     `Invalid model "${modelId}" for provider "${provider}". Valid models: ${validModels}.`

package/src/agent-cli-provider/adapters/opencode-models.ts

@@ -0,0 +1,100 @@
+import { unknownToMessage } from '../json';
+import {
+  InvalidProviderModelError,
+  type LevelModelSpec,
+  type LevelOverrides,
+  type ModelCatalogEntry,
+  type ModelLevel,
+  type ResolvedModelSpec,
+} from '../types';
+import { validateModelIdFromCatalog } from './common';
+
+export const MODEL_CATALOG: Readonly<Record<string, ModelCatalogEntry>> = {
+  'opencode/big-pickle': { rank: 1 },
+  'opencode/glm-4.7-free': { rank: 1 },
+  'opencode/gpt-5-nano': { rank: 1 },
+  'opencode/grok-code': { rank: 1 },
+  'opencode/minimax-m2.1-free': { rank: 1 },
+  'google/gemini-1.5-flash': { rank: 1 },
+  'google/gemini-1.5-flash-8b': { rank: 1 },
+  'google/gemini-1.5-pro': { rank: 1 },
+  'google/gemini-2.0-flash': { rank: 1 },
+  'google/gemini-2.0-flash-lite': { rank: 1 },
+  'google/gemini-2.5-flash': { rank: 1 },
+  'google/gemini-2.5-flash-image': { rank: 1 },
+  'google/gemini-2.5-flash-image-preview': { rank: 1 },
+  'google/gemini-2.5-flash-lite': { rank: 1 },
+  'google/gemini-2.5-flash-lite-preview-06-17': { rank: 1 },
+  'google/gemini-2.5-flash-lite-preview-09-2025': { rank: 1 },
+  'google/gemini-2.5-flash-preview-04-17': { rank: 1 },
+  'google/gemini-2.5-flash-preview-05-20': { rank: 1 },
+  'google/gemini-2.5-flash-preview-09-2025': { rank: 1 },
+  'google/gemini-2.5-flash-preview-tts': { rank: 1 },
+  'google/gemini-2.5-pro': { rank: 1 },
+  'google/gemini-2.5-pro-preview-05-06': { rank: 1 },
+  'google/gemini-2.5-pro-preview-06-05': { rank: 1 },
+  'google/gemini-2.5-pro-preview-tts': { rank: 1 },
+  'google/gemini-3-flash-preview': { rank: 1 },
+  'google/gemini-3-pro-preview': { rank: 1 },
+  'google/gemini-embedding-001': { rank: 1 },
+  'google/gemini-flash-latest': { rank: 1 },
+  'google/gemini-flash-lite-latest': { rank: 1 },
+  'google/gemini-live-2.5-flash': { rank: 1 },
+  'google/gemini-live-2.5-flash-preview-native-audio': { rank: 1 },
+  'openai/gpt-5.1-codex-max': { rank: 1 },
+  'openai/gpt-5.1-codex-mini': { rank: 1 },
+  'openai/gpt-5.2': { rank: 1 },
+  'openai/gpt-5.2-codex': { rank: 1 },
+};
+
+export const LEVEL_MAPPING: Readonly<Record<ModelLevel, LevelModelSpec>> = {
+  level1: { rank: 1, model: null, reasoningEffort: 'low' },
+  level2: { rank: 2, model: null, reasoningEffort: 'medium' },
+  level3: { rank: 3, model: null, reasoningEffort: 'high' },
+};
+
+function containsControlCharacter(value: string): boolean {
+  return Array.from(value).some((character) => {
+    const codePoint = character.codePointAt(0);
+    return codePoint !== undefined && (codePoint <= 0x1f || codePoint === 0x7f);
+  });
+}
+
+export function resolveModelSpec(level: ModelLevel, overrides?: LevelOverrides): ResolvedModelSpec {
+  const base = LEVEL_MAPPING[level] ?? LEVEL_MAPPING.level2;
+  const override = overrides?.[level];
+  const selectedModel = override?.model ?? base.model;
+  return {
+    level,
+    model:
+      override?.model === undefined || override.model === null
+        ? (validateModelId(selectedModel) ?? null)
+        : (validateConfiguredModelId(selectedModel) ?? null),
+    reasoningEffort: override?.reasoningEffort ?? base.reasoningEffort,
+  };
+}
+
+export function validateConfiguredModelId(
+  modelId: string | null | undefined
+): string | null | undefined {
+  if (modelId && Object.prototype.hasOwnProperty.call(MODEL_CATALOG, modelId)) return modelId;
+  if (typeof modelId !== 'string') return validateModelId(modelId);
+  const segments = modelId.split('/');
+  if (
+    segments.length >= 2 &&
+    segments.every(Boolean) &&
+    !/\s/u.test(modelId) &&
+    !containsControlCharacter(modelId)
+  ) {
+    return modelId;
+  }
+  throw new InvalidProviderModelError(
+    `Invalid configured model "${unknownToMessage(
+      modelId
+    )}" for provider "opencode". Expected "provider/model" with no whitespace, control characters, or empty path segments.`
+  );
+}
+
+export function validateModelId(modelId: string | null | undefined): string | null | undefined {
+  return validateModelIdFromCatalog('opencode', MODEL_CATALOG, modelId);
+}