@the-open-engine/zeroshot 6.7.2 → 6.8.0

package/src/agent/agent-task-executor.js

@@ -23,6 +23,10 @@ const {
   prepareClaudeConfigDir,
   resolveRepoMcpConfigPath,
 } = require('../worktree-claude-config.js');
+const {
+  appendTaskRunModelArgs,
+  wrapTaskRunWithIsolatedSettings,
+} = require('../task-run-model-args.js');
 const { buildRawLogOnlyMetadata } = require('./context-replay-policy');
 
 function runCommandWithTimeout(command, args, options = {}, callback = null) {
@@ -722,14 +726,10 @@ function resolveOutputFormatConfig(agent) {
 
 function buildTaskRunArgs({ agent, providerName, modelSpec, runOutputFormat }) {
   const args = ['task', 'run', '--output-format', runOutputFormat, '--provider', providerName];
-
-  if (modelSpec?.model) {
-    args.push('--model', modelSpec.model);
-  }
-
-  if (modelSpec?.reasoningEffort) {
-    args.push('--reasoning-effort', modelSpec.reasoningEffort);
-  }
+  const modelSpecSource = agent._resolveModelSpecSource
+    ? agent._resolveModelSpecSource()
+    : 'direct';
+  appendTaskRunModelArgs(args, modelSpec, modelSpecSource);
 
   // Add verification mode flag if configured
   if (agent.config.verificationMode) {
@@ -1509,11 +1509,14 @@ async function spawnClaudeTaskIsolated(agent, context) {
   const { manager, clusterId } = agent.isolation;
   const providerName = agent._resolveProvider ? agent._resolveProvider() : 'claude';
   const modelSpec = resolveAgentModelSpec(agent);
+  const modelSpecSource = agent._resolveModelSpecSource
+    ? agent._resolveModelSpecSource()
+    : 'direct';
 
   agent._log(`📦 Agent ${agent.id}: Running task in isolated container using zeroshot task run...`);
 
   const { desiredOutputFormat, runOutputFormat } = resolveOutputFormatConfig(agent);
-  const command = [
+  let command = [
     'zeroshot',
     ...buildTaskRunArgs({
       agent,
@@ -1531,6 +1534,12 @@ async function spawnClaudeTaskIsolated(agent, context) {
   });
 
   command.push(finalContext);
+  command = wrapTaskRunWithIsolatedSettings(command, {
+    providerName,
+    settings: loadSettings(),
+    modelSpecSource,
+    modelSpec,
+  });
 
   // STEP 1: Spawn task and extract task ID (same as non-isolated mode)
   // Timeout for spawn phase - if CLI hangs during init (e.g., opencode 429 bug), kill it

package/src/agent-cli-provider/adapters/common.ts

@@ -99,7 +99,7 @@ export function validateModelIdFromCatalog(
   modelId: string | null | undefined
 ): string | null | undefined {
   if (!modelId) return modelId;
-  if (catalog[modelId] !== undefined) return modelId;
+  if (Object.prototype.hasOwnProperty.call(catalog, modelId)) return modelId;
   const validModels = Object.keys(catalog).join(', ');
   throw new InvalidProviderModelError(
     `Invalid model "${modelId}" for provider "${provider}". Valid models: ${validModels}.`

package/src/agent-cli-provider/adapters/opencode-models.ts

@@ -0,0 +1,100 @@
+import { unknownToMessage } from '../json';
+import {
+  InvalidProviderModelError,
+  type LevelModelSpec,
+  type LevelOverrides,
+  type ModelCatalogEntry,
+  type ModelLevel,
+  type ResolvedModelSpec,
+} from '../types';
+import { validateModelIdFromCatalog } from './common';
+
+export const MODEL_CATALOG: Readonly<Record<string, ModelCatalogEntry>> = {
+  'opencode/big-pickle': { rank: 1 },
+  'opencode/glm-4.7-free': { rank: 1 },
+  'opencode/gpt-5-nano': { rank: 1 },
+  'opencode/grok-code': { rank: 1 },
+  'opencode/minimax-m2.1-free': { rank: 1 },
+  'google/gemini-1.5-flash': { rank: 1 },
+  'google/gemini-1.5-flash-8b': { rank: 1 },
+  'google/gemini-1.5-pro': { rank: 1 },
+  'google/gemini-2.0-flash': { rank: 1 },
+  'google/gemini-2.0-flash-lite': { rank: 1 },
+  'google/gemini-2.5-flash': { rank: 1 },
+  'google/gemini-2.5-flash-image': { rank: 1 },
+  'google/gemini-2.5-flash-image-preview': { rank: 1 },
+  'google/gemini-2.5-flash-lite': { rank: 1 },
+  'google/gemini-2.5-flash-lite-preview-06-17': { rank: 1 },
+  'google/gemini-2.5-flash-lite-preview-09-2025': { rank: 1 },
+  'google/gemini-2.5-flash-preview-04-17': { rank: 1 },
+  'google/gemini-2.5-flash-preview-05-20': { rank: 1 },
+  'google/gemini-2.5-flash-preview-09-2025': { rank: 1 },
+  'google/gemini-2.5-flash-preview-tts': { rank: 1 },
+  'google/gemini-2.5-pro': { rank: 1 },
+  'google/gemini-2.5-pro-preview-05-06': { rank: 1 },
+  'google/gemini-2.5-pro-preview-06-05': { rank: 1 },
+  'google/gemini-2.5-pro-preview-tts': { rank: 1 },
+  'google/gemini-3-flash-preview': { rank: 1 },
+  'google/gemini-3-pro-preview': { rank: 1 },
+  'google/gemini-embedding-001': { rank: 1 },
+  'google/gemini-flash-latest': { rank: 1 },
+  'google/gemini-flash-lite-latest': { rank: 1 },
+  'google/gemini-live-2.5-flash': { rank: 1 },
+  'google/gemini-live-2.5-flash-preview-native-audio': { rank: 1 },
+  'openai/gpt-5.1-codex-max': { rank: 1 },
+  'openai/gpt-5.1-codex-mini': { rank: 1 },
+  'openai/gpt-5.2': { rank: 1 },
+  'openai/gpt-5.2-codex': { rank: 1 },
+};
+
+export const LEVEL_MAPPING: Readonly<Record<ModelLevel, LevelModelSpec>> = {
+  level1: { rank: 1, model: null, reasoningEffort: 'low' },
+  level2: { rank: 2, model: null, reasoningEffort: 'medium' },
+  level3: { rank: 3, model: null, reasoningEffort: 'high' },
+};
+
+function containsControlCharacter(value: string): boolean {
+  return Array.from(value).some((character) => {
+    const codePoint = character.codePointAt(0);
+    return codePoint !== undefined && (codePoint <= 0x1f || codePoint === 0x7f);
+  });
+}
+
+export function resolveModelSpec(level: ModelLevel, overrides?: LevelOverrides): ResolvedModelSpec {
+  const base = LEVEL_MAPPING[level] ?? LEVEL_MAPPING.level2;
+  const override = overrides?.[level];
+  const selectedModel = override?.model ?? base.model;
+  return {
+    level,
+    model:
+      override?.model === undefined || override.model === null
+        ? (validateModelId(selectedModel) ?? null)
+        : (validateConfiguredModelId(selectedModel) ?? null),
+    reasoningEffort: override?.reasoningEffort ?? base.reasoningEffort,
+  };
+}
+
+export function validateConfiguredModelId(
+  modelId: string | null | undefined
+): string | null | undefined {
+  if (modelId && Object.prototype.hasOwnProperty.call(MODEL_CATALOG, modelId)) return modelId;
+  if (typeof modelId !== 'string') return validateModelId(modelId);
+  const segments = modelId.split('/');
+  if (
+    segments.length >= 2 &&
+    segments.every(Boolean) &&
+    !/\s/u.test(modelId) &&
+    !containsControlCharacter(modelId)
+  ) {
+    return modelId;
+  }
+  throw new InvalidProviderModelError(
+    `Invalid configured model "${unknownToMessage(
+      modelId
+    )}" for provider "opencode". Expected "provider/model" with no whitespace, control characters, or empty path segments.`
+  );
+}
+
+export function validateModelId(modelId: string | null | undefined): string | null | undefined {
+  return validateModelIdFromCatalog('opencode', MODEL_CATALOG, modelId);
+}

package/src/agent-cli-provider/adapters/opencode.ts

@@ -11,14 +11,9 @@ import {
   type BuildProviderCommandOptions,
   type CommandSpec,
   type ErrorClassification,
-  type LevelModelSpec,
-  type LevelOverrides,
-  type ModelCatalogEntry,
-  type ModelLevel,
   type OpencodeCliFeatures,
   type OutputEvent,
   type ProviderAdapter,
-  type ResolvedModelSpec,
   type WarningMetadata,
 } from '../types';
 import {
@@ -26,55 +21,16 @@ import {
   commandSpec,
   createParserState,
   optionFeatures,
-  resolveModelSpecWithConfig,
   unsupportedSessionControlWarnings,
-  validateModelIdFromCatalog,
   warning,
 } from './common';
-
-const MODEL_CATALOG: Readonly<Record<string, ModelCatalogEntry>> = {
-  'opencode/big-pickle': { rank: 1 },
-  'opencode/glm-4.7-free': { rank: 1 },
-  'opencode/gpt-5-nano': { rank: 1 },
-  'opencode/grok-code': { rank: 1 },
-  'opencode/minimax-m2.1-free': { rank: 1 },
-  'google/gemini-1.5-flash': { rank: 1 },
-  'google/gemini-1.5-flash-8b': { rank: 1 },
-  'google/gemini-1.5-pro': { rank: 1 },
-  'google/gemini-2.0-flash': { rank: 1 },
-  'google/gemini-2.0-flash-lite': { rank: 1 },
-  'google/gemini-2.5-flash': { rank: 1 },
-  'google/gemini-2.5-flash-image': { rank: 1 },
-  'google/gemini-2.5-flash-image-preview': { rank: 1 },
-  'google/gemini-2.5-flash-lite': { rank: 1 },
-  'google/gemini-2.5-flash-lite-preview-06-17': { rank: 1 },
-  'google/gemini-2.5-flash-lite-preview-09-2025': { rank: 1 },
-  'google/gemini-2.5-flash-preview-04-17': { rank: 1 },
-  'google/gemini-2.5-flash-preview-05-20': { rank: 1 },
-  'google/gemini-2.5-flash-preview-09-2025': { rank: 1 },
-  'google/gemini-2.5-flash-preview-tts': { rank: 1 },
-  'google/gemini-2.5-pro': { rank: 1 },
-  'google/gemini-2.5-pro-preview-05-06': { rank: 1 },
-  'google/gemini-2.5-pro-preview-06-05': { rank: 1 },
-  'google/gemini-2.5-pro-preview-tts': { rank: 1 },
-  'google/gemini-3-flash-preview': { rank: 1 },
-  'google/gemini-3-pro-preview': { rank: 1 },
-  'google/gemini-embedding-001': { rank: 1 },
-  'google/gemini-flash-latest': { rank: 1 },
-  'google/gemini-flash-lite-latest': { rank: 1 },
-  'google/gemini-live-2.5-flash': { rank: 1 },
-  'google/gemini-live-2.5-flash-preview-native-audio': { rank: 1 },
-  'openai/gpt-5.1-codex-max': { rank: 1 },
-  'openai/gpt-5.1-codex-mini': { rank: 1 },
-  'openai/gpt-5.2': { rank: 1 },
-  'openai/gpt-5.2-codex': { rank: 1 },
-};
-
-const LEVEL_MAPPING: Readonly<Record<ModelLevel, LevelModelSpec>> = {
-  level1: { rank: 1, model: null, reasoningEffort: 'low' },
-  level2: { rank: 2, model: null, reasoningEffort: 'medium' },
-  level3: { rank: 3, model: null, reasoningEffort: 'high' },
-};
+import {
+  LEVEL_MAPPING,
+  MODEL_CATALOG,
+  resolveModelSpec,
+  validateConfiguredModelId,
+  validateModelId,
+} from './opencode-models';
 
 function detectCliFeatures(helpText?: string | null): OpencodeCliFeatures {
   const help = helpText ?? '';
@@ -244,20 +200,6 @@ function parseEvent(line: string): OutputEvent | null {
   return null;
 }
 
-function resolveModelSpec(level: ModelLevel, overrides?: LevelOverrides): ResolvedModelSpec {
-  return resolveModelSpecWithConfig({
-    mapping: LEVEL_MAPPING,
-    defaultLevel: 'level2',
-    level,
-    overrides,
-    validateModelId,
-  });
-}
-
-function validateModelId(modelId: string | null | undefined): string | null | undefined {
-  return validateModelIdFromCatalog('opencode', MODEL_CATALOG, modelId);
-}
-
 function classifyError(error: unknown): ErrorClassification {
   return classifyBaseProviderError(error, [], []);
 }
@@ -285,5 +227,6 @@ export const opencodeAdapter: ProviderAdapter = {
   createParserState: () => createParserState('opencode'),
   resolveModelSpec,
   validateModelId,
+  validateConfiguredModelId,
   classifyError,
 };

package/src/agent-cli-provider/single-agent-runtime.ts

@@ -34,6 +34,11 @@ interface RuntimeProviderSettings {
   readonly gateway?: GatewayBuildOptions;
 }
 
+interface RuntimeCommandContext {
+  readonly cliFeatures: CliFeatureOverrides;
+  readonly authEnv: Readonly<Record<string, string>>;
+}
+
 export interface SingleAgentProviderCommandInput {
   readonly provider?: string | null;
   readonly context: string;
@@ -62,6 +67,7 @@ type MutableModelSpec = {
 
 const MODEL_LEVELS: readonly ModelLevel[] = ['level1', 'level2', 'level3'];
 const REASONING_EFFORTS: readonly ReasoningEffort[] = ['low', 'medium', 'high', 'xhigh', 'max'];
+const LEGACY_ISOLATED_PROVIDER_SETTINGS_ENV = 'ZEROSHOT_ISOLATED_PROVIDER_SETTINGS_JSON';
 const settingsModule: unknown = require('../../lib/settings');
 const providerDetectionModule: unknown = require('../../lib/provider-detection');
 const claudeAuthModule: unknown = require('../../lib/settings/claude-auth');
@@ -76,6 +82,7 @@ const resolveClaudeAuthFn = moduleFunction(claudeAuthModule, 'resolveClaudeAuth'
 export function prepareSingleAgentProviderCommand(
   input: SingleAgentProviderCommandInput
 ): PreparedSingleAgentProviderCommand {
+  rejectCallerSuppliedModelProvenance(input);
   const baseOptions = input.options ?? {};
   const settings = loadRuntimeSettings();
   const adapter = adapterForRuntimeInput(input.provider, settings);
@@ -86,7 +93,10 @@ export function prepareSingleAgentProviderCommand(
   );
   const cliFeatures = resolveRuntimeCliFeatures(adapter.id, baseOptions.cliFeatures);
   const authEnv = baseOptions.authEnv ?? resolveRuntimeAuthEnv(adapter.id, settings);
-  const options = buildRuntimeOptions(baseOptions, adapter, providerSettings, cliFeatures, authEnv);
+  const options = buildRuntimeOptions(baseOptions, adapter, providerSettings, {
+    cliFeatures,
+    authEnv,
+  });
   return {
     adapter,
     options,
@@ -128,8 +138,7 @@ function mergeAcpFailClosedCliFeatures(
     ...detected,
     ...overrides,
     supportsAcpStdio: detected.supportsAcpStdio && overrides.supportsAcpStdio !== false,
-    supportsPromptImages:
-      detected.supportsPromptImages && overrides.supportsPromptImages !== false,
+    supportsPromptImages: detected.supportsPromptImages && overrides.supportsPromptImages !== false,
     supportsLoadSession: detected.supportsLoadSession && overrides.supportsLoadSession !== false,
     supportsSessionCancel:
       detected.supportsSessionCancel && overrides.supportsSessionCancel !== false,
@@ -162,7 +171,9 @@ export function probeRuntimeProviderCli(provider: string): RuntimeProviderProbe
   }
 
   const helpText = stringResult(getHelpOutputFn(helpCommand.command, helpCommand.args)).trim();
-  const versionText = stringResult(getVersionOutputFn(helpCommand.command, helpCommand.args)).trim();
+  const versionText = stringResult(
+    getVersionOutputFn(helpCommand.command, helpCommand.args)
+  ).trim();
   const availabilityProbe = getProviderRegistryEntry(adapter.id).availabilityProbe ?? 'command';
 
   return {
@@ -177,8 +188,7 @@ function buildRuntimeOptions(
   baseOptions: BuildProviderCommandOptions,
   adapter: ProviderAdapter,
   providerSettings: RuntimeProviderSettings,
-  cliFeatures: CliFeatureOverrides,
-  authEnv: Readonly<Record<string, string>>
+  runtime: RuntimeCommandContext
 ): BuildProviderCommandOptions {
   const modelSpec = resolveRuntimeModelSpec(adapter, baseOptions.modelSpec, providerSettings);
   const gateway = resolveRuntimeGatewayOptions(
@@ -191,16 +201,16 @@ function buildRuntimeOptions(
     ...baseOptions,
     modelSpec,
     ...(gateway === undefined ? {} : { gateway }),
-    cliFeatures,
+    cliFeatures: runtime.cliFeatures,
   };
   if (baseOptions.jsonSchema && !supportsProviderCapability(adapter.id, 'jsonSchema')) {
-    if (!shouldIncludeAuthEnv(baseOptions, authEnv)) {
+    if (!shouldIncludeAuthEnv(baseOptions, runtime.authEnv)) {
       return { ...resolved, strictSchema: false };
     }
-    return { ...resolved, authEnv, strictSchema: false };
+    return { ...resolved, authEnv: runtime.authEnv, strictSchema: false };
   }
-  if (!shouldIncludeAuthEnv(baseOptions, authEnv)) return resolved;
-  return { ...resolved, authEnv };
+  if (!shouldIncludeAuthEnv(baseOptions, runtime.authEnv)) return resolved;
+  return { ...resolved, authEnv: runtime.authEnv };
 }
 
 function resolveRuntimeGatewayOptions(
@@ -218,23 +228,19 @@ function resolveRuntimeGatewayOptions(
       ? settingsGateway.headers
       : { ...(settingsGateway.headers ?? {}), ...requestGateway.headers };
   const mergedGateway: GatewayBuildOptions = {
-    ...(requestGateway.baseUrl ?? settingsGateway.baseUrl
+    ...((requestGateway.baseUrl ?? settingsGateway.baseUrl)
       ? { baseUrl: requestGateway.baseUrl ?? settingsGateway.baseUrl }
       : {}),
-    ...(requestGateway.apiKey ?? settingsGateway.apiKey
+    ...((requestGateway.apiKey ?? settingsGateway.apiKey)
       ? { apiKey: requestGateway.apiKey ?? settingsGateway.apiKey }
       : {}),
     ...(mergedHeaders === undefined ? {} : { headers: mergedHeaders }),
     model: requestGateway.model ?? modelSpec.model ?? settingsGateway.model ?? null,
-    ...(requestGateway.toolPolicy ?? settingsGateway.toolPolicy
+    ...((requestGateway.toolPolicy ?? settingsGateway.toolPolicy)
       ? { toolPolicy: requestGateway.toolPolicy ?? settingsGateway.toolPolicy }
       : {}),
   };
-  return resolveGatewayConfiguration(
-    mergedGateway,
-    'options.gateway',
-    cwd
-  );
+  return resolveGatewayConfiguration(mergedGateway, 'options.gateway', cwd);
 }
 
 function shouldIncludeAuthEnv(
@@ -286,7 +292,8 @@ function adapterForRuntimeInput(
   provider: string | null | undefined,
   settings: Record<string, unknown>
 ): ProviderAdapter {
-  const configured = provider ?? optionalString(settings.defaultProvider, 'settings.defaultProvider');
+  const configured =
+    provider ?? optionalString(settings.defaultProvider, 'settings.defaultProvider');
   return getProviderAdapter(configured ?? 'claude');
 }
 
@@ -309,16 +316,14 @@ function runtimeProviderSettings(
   );
   const gateway =
     provider === 'gateway'
-      ? normalizeGatewayBuildOptions(
-          providerSettings,
-          'settings.providerSettings.gateway',
-          cwd
-        )
+      ? normalizeGatewayBuildOptions(providerSettings, 'settings.providerSettings.gateway', cwd)
       : undefined;
   if (defaultLevel === undefined) {
     return gateway === undefined ? { levelOverrides } : { levelOverrides, gateway };
   }
-  return gateway === undefined ? { defaultLevel, levelOverrides } : { defaultLevel, levelOverrides, gateway };
+  return gateway === undefined
+    ? { defaultLevel, levelOverrides }
+    : { defaultLevel, levelOverrides, gateway };
 }
 
 function runtimeHelpCommand(provider: ProviderId): CommandParts {
@@ -333,7 +338,11 @@ function probeGatewayProvider(adapter: ProviderAdapter): RuntimeProviderProbe {
   try {
     const settings = loadRuntimeSettings();
     const providerSettings = runtimeProviderSettings(settings, 'gateway', process.cwd());
-    resolveGatewayConfiguration(providerSettings.gateway, 'settings.providerSettings.gateway', process.cwd());
+    resolveGatewayConfiguration(
+      providerSettings.gateway,
+      'settings.providerSettings.gateway',
+      process.cwd()
+    );
     return {
       available: true,
       helpText: 'Bundled gateway runner',
@@ -351,8 +360,20 @@ function probeGatewayProvider(adapter: ProviderAdapter): RuntimeProviderProbe {
 }
 
 function loadRuntimeSettings(): Record<string, unknown> {
-  const settings = loadSettingsFn();
-  return requiredRecord(settings, 'loadSettings');
+  if (Object.prototype.hasOwnProperty.call(process.env, LEGACY_ISOLATED_PROVIDER_SETTINGS_ENV)) {
+    throw new Error(
+      `${LEGACY_ISOLATED_PROVIDER_SETTINGS_ENV} is not a trusted settings channel; use the settings file.`
+    );
+  }
+  return requiredRecord(loadSettingsFn(), 'loadSettings');
+}
+
+function rejectCallerSuppliedModelProvenance(input: SingleAgentProviderCommandInput): void {
+  if (Object.prototype.hasOwnProperty.call(input, 'modelSpecSource')) {
+    throw new Error(
+      'modelSpecSource is not accepted at the child provider boundary; use modelLevel and effective provider settings.'
+    );
+  }
 }
 
 function moduleFunction(moduleValue: unknown, field: string): UnknownFunction {
@@ -456,10 +477,7 @@ function requiredRecord(value: unknown, field: string): Record<string, unknown>
   throw new Error(`${field} must be an object.`);
 }
 
-function stringRecordFromUnknown(
-  value: unknown,
-  field: string
-): Readonly<Record<string, string>> {
+function stringRecordFromUnknown(value: unknown, field: string): Readonly<Record<string, string>> {
   if (value === undefined || value === null) return {};
   const record = requiredRecord(value, field);
   const result: Record<string, string> = {};

package/src/agent-cli-provider/types.ts

@@ -367,6 +367,7 @@ export interface ProviderAdapter {
   createParserState(): ProviderParserState;
   resolveModelSpec(level: ModelLevel, overrides?: LevelOverrides): ResolvedModelSpec;
   validateModelId(modelId: string | null | undefined): string | null | undefined;
+  validateConfiguredModelId?(modelId: string | null | undefined): string | null | undefined;
   classifyError(error: unknown): ErrorClassification;
 }
 

package/src/agent-wrapper.js

@@ -103,10 +103,11 @@ class AgentWrapper {
       const taskRunner = options.taskRunner;
       this.mockSpawnFn = (args, { context }) => {
         const spec = this._resolveModelSpec();
+        const source = this._resolveModelSpecSource();
         return taskRunner.run(context, {
           agentId: this.id,
-          model: this._selectModel(),
-          modelSpec: spec,
+          ...(source === 'direct' ? { model: spec.model } : { modelLevel: spec.level }),
+          ...(spec.reasoningEffort ? { reasoningEffort: spec.reasoningEffort } : {}),
           provider: this._resolveProvider(),
           cwd: this.config.cwd || process.cwd(),
           worktreePath: this.worktree?.path || null,
@@ -222,6 +223,17 @@ class AgentWrapper {
     return applyReasoningOverride({ ...spec, level }, this.config.reasoningEffort);
   }
 
+  _resolveModelSpecSource() {
+    if (this.modelConfig.type === 'rules') {
+      for (const rule of this.modelConfig.rules) {
+        if (this._matchesIterationRange(rule.iterations)) {
+          return rule.model ? 'direct' : 'provider-level';
+        }
+      }
+    }
+    return this.modelConfig.model ? 'direct' : 'provider-level';
+  }
+
   /**
    * Publish a message to the message bus, always including sender_model
    * @private