@the-open-engine/zeroshot 6.7.2 → 6.8.0

package/src/claude-task-runner.js

@@ -13,6 +13,18 @@ const { normalizeProviderName } = require('../lib/provider-names');
 const { getProvider } = require('./providers');
 const { prependWorktreeToolBinToEnv } = require('./worktree-tooling-env');
 const { prepareClaudeConfigDir } = require('./worktree-claude-config');
+const {
+  appendTaskRunModelArgs,
+  wrapTaskRunWithIsolatedSettings,
+} = require('./task-run-model-args');
+
+function rejectCallerSuppliedModelProvenance(options) {
+  if (Object.prototype.hasOwnProperty.call(options, 'modelSpecSource')) {
+    throw new Error(
+      'modelSpecSource is derived from model versus modelLevel/default and cannot be supplied.'
+    );
+  }
+}
 
 function runCommand(command, args, options = {}, callback = null) {
   const timeout = options.timeout ?? 30000;
@@ -112,10 +124,11 @@ class ClaudeTaskRunner extends TaskRunner {
    * Execute a task via zeroshot CLI
    *
    * @param {string} context - Full prompt/context
-   * @param {{agentId?: string, model?: string, outputFormat?: string, jsonSchema?: any, strictSchema?: boolean, cwd?: string, worktreePath?: string|null, isolation?: any}} options - Execution options
+   * @param {{agentId?: string, model?: string, modelLevel?: string, modelSpec?: Object|null, reasoningEffort?: string, outputFormat?: string, jsonSchema?: any, strictSchema?: boolean, cwd?: string, worktreePath?: string|null, isolation?: any}} options - Execution options
    * @returns {Promise<{success: boolean, output: string, error: string|null, taskId?: string}>}
    */
   async run(context, options = {}) {
+    rejectCallerSuppliedModelProvenance(options);
     const {
       agentId = 'unknown',
       provider,
@@ -137,7 +150,7 @@ class ClaudeTaskRunner extends TaskRunner {
       providerName,
       settings
     );
-    const resolvedModelSpec = this._resolveModelSpec({
+    const modelSelection = this._resolveModelSelection({
       explicitModelSpec,
       model,
       reasoningEffort,
@@ -146,13 +159,13 @@ class ClaudeTaskRunner extends TaskRunner {
       providerSettings,
       levelOverrides,
     });
+    const resolvedModelSpec = modelSelection.modelSpec;
 
     // Isolation mode delegates to separate method
     if (isolation?.enabled) {
       return this._runIsolated(context, {
         ...options,
         provider: providerName,
-        modelSpec: resolvedModelSpec,
       });
     }
 
@@ -168,6 +181,7 @@ class ClaudeTaskRunner extends TaskRunner {
       providerName,
       runOutputFormat,
       resolvedModelSpec,
+      modelSpecSource: modelSelection.source,
       jsonSchema,
     });
 
@@ -204,25 +218,74 @@ class ClaudeTaskRunner extends TaskRunner {
     providerSettings,
     levelOverrides,
   }) {
-    if (explicitModelSpec) {
-      if (explicitModelSpec.model) {
-        providerModule.validateModelId(explicitModelSpec.model);
-      }
-      return explicitModelSpec;
-    }
+    return this._resolveModelSelection({
+      explicitModelSpec,
+      model,
+      reasoningEffort,
+      modelLevel,
+      providerModule,
+      providerSettings,
+      levelOverrides,
+    }).modelSpec;
+  }
 
+  _resolveModelSelection({
+    explicitModelSpec,
+    model,
+    reasoningEffort,
+    modelLevel,
+    providerModule,
+    providerSettings,
+    levelOverrides,
+  }) {
     if (model) {
       providerModule.validateModelId(model);
-      return { model, reasoningEffort };
+      return {
+        source: 'direct',
+        modelSpec: { model, reasoningEffort },
+      };
     }
 
-    const level = modelLevel || providerSettings.defaultLevel || providerModule.getDefaultLevel();
-    let resolvedModelSpec = providerModule.resolveModelSpec(level, levelOverrides);
-    if (reasoningEffort) {
-      resolvedModelSpec = { ...resolvedModelSpec, reasoningEffort };
+    if (explicitModelSpec?.model !== undefined) {
+      providerModule.validateModelId(explicitModelSpec.model);
+      return {
+        source: 'direct',
+        modelSpec: explicitModelSpec,
+      };
     }
 
-    return resolvedModelSpec;
+    return {
+      source: 'provider-level',
+      modelSpec: this._resolveProviderLevelModelSpec({
+        explicitModelSpec,
+        modelLevel,
+        reasoningEffort,
+        providerModule,
+        providerSettings,
+        levelOverrides,
+      }),
+    };
+  }
+
+  _resolveProviderLevelModelSpec({
+    explicitModelSpec,
+    modelLevel,
+    reasoningEffort,
+    providerModule,
+    providerSettings,
+    levelOverrides,
+  }) {
+    const level =
+      explicitModelSpec?.level ||
+      modelLevel ||
+      providerSettings.defaultLevel ||
+      providerModule.getDefaultLevel();
+    const resolvedModelSpec = providerModule.resolveModelSpec(level, levelOverrides);
+    const resolvedReasoningEffort = explicitModelSpec?.reasoningEffort || reasoningEffort;
+
+    return resolvedReasoningEffort
+      ? { ...resolvedModelSpec, reasoningEffort: resolvedReasoningEffort }
+      : resolvedModelSpec;
   }
 
   _resolveOutputFormat({ outputFormat, jsonSchema, strictSchema }) {
@@ -232,16 +295,16 @@ class ClaudeTaskRunner extends TaskRunner {
     return jsonSchema && outputFormat === 'json' && !strictSchema ? 'stream-json' : outputFormat;
   }
 
-  _buildRunArgs({ context, providerName, runOutputFormat, resolvedModelSpec, jsonSchema }) {
+  _buildRunArgs({
+    context,
+    providerName,
+    runOutputFormat,
+    resolvedModelSpec,
+    modelSpecSource = 'direct',
+    jsonSchema,
+  }) {
     const args = ['task', 'run', '--output-format', runOutputFormat, '--provider', providerName];
-
-    if (resolvedModelSpec?.model) {
-      args.push('--model', resolvedModelSpec.model);
-    }
-
-    if (resolvedModelSpec?.reasoningEffort) {
-      args.push('--reasoning-effort', resolvedModelSpec.reasoningEffort);
-    }
+    appendTaskRunModelArgs(args, resolvedModelSpec, modelSpecSource);
 
     // Pass schema to CLI only when using json output (strictSchema=true or no conflict)
     if (jsonSchema && runOutputFormat === 'json') {
@@ -542,20 +605,40 @@ class ClaudeTaskRunner extends TaskRunner {
   /**
    * Run task in isolated Docker container
    * @param {string} context
-   * @param {{agentId?: string, model?: string, outputFormat?: string, jsonSchema?: any, strictSchema?: boolean, isolation?: any}} options
+   * @param {{agentId?: string, provider?: string, model?: string, modelLevel?: string, modelSpec?: Object|null, reasoningEffort?: string, outputFormat?: string, jsonSchema?: any, strictSchema?: boolean, isolation?: any}} options
    * @returns {Promise<{success: boolean, output: string, error: string|null}>}
    */
   _runIsolated(context, options) {
+    rejectCallerSuppliedModelProvenance(options);
     const {
       agentId = 'unknown',
       provider = 'claude',
-      modelSpec = null,
+      model = null,
+      modelLevel = null,
+      modelSpec: explicitModelSpec = null,
+      reasoningEffort = null,
       outputFormat = 'stream-json',
       jsonSchema = null,
       strictSchema = false,
       isolation,
     } = options;
     const { manager, clusterId } = isolation;
+    const settings = loadSettings();
+    const { providerModule, providerSettings, levelOverrides } = this._getProviderContext(
+      provider,
+      settings
+    );
+    const modelSelection = this._resolveModelSelection({
+      explicitModelSpec,
+      model,
+      reasoningEffort,
+      modelLevel,
+      providerModule,
+      providerSettings,
+      levelOverrides,
+    });
+    const modelSpec = modelSelection.modelSpec;
+    const modelSpecSource = modelSelection.source;
 
     this._log(`📦 [${agentId}]: Running task in isolated container...`);
 
@@ -565,7 +648,7 @@ class ClaudeTaskRunner extends TaskRunner {
         ? 'stream-json'
         : desiredOutputFormat;
 
-    const command = [
+    let command = [
       'zeroshot',
       'task',
       'run',
@@ -575,13 +658,7 @@ class ClaudeTaskRunner extends TaskRunner {
       provider,
     ];
 
-    if (modelSpec?.model) {
-      command.push('--model', modelSpec.model);
-    }
-
-    if (modelSpec?.reasoningEffort) {
-      command.push('--reasoning-effort', modelSpec.reasoningEffort);
-    }
+    appendTaskRunModelArgs(command, modelSpec, modelSpecSource);
 
     if (jsonSchema && runOutputFormat === 'json') {
       command.push('--json-schema', JSON.stringify(jsonSchema));
@@ -597,16 +674,23 @@ class ClaudeTaskRunner extends TaskRunner {
     }
 
     command.push(finalContext);
+    command = wrapTaskRunWithIsolatedSettings(command, {
+      providerName: provider,
+      settings,
+      modelSpecSource,
+      modelSpec,
+    });
 
     return new Promise((resolve, reject) => {
       let output = '';
       let resolved = false;
 
       const proc = manager.spawnInContainer(clusterId, command, {
-        env:
-          provider === 'claude' && modelSpec?.model
+        env: {
+          ...(provider === 'claude' && modelSpec?.model
             ? { ANTHROPIC_MODEL: modelSpec.model, ZEROSHOT_BLOCK_ASK_USER: '1' }
-            : {},
+            : {}),
+        },
       });
 
       proc.stdout.on('data', (/** @type {Buffer} */ data) => {

package/src/config-validator.js

@@ -2053,8 +2053,8 @@ function validateProviderSettings(provider, providerSettings) {
         `Invalid model override (must be non-empty string) for provider "${provider}"`
       );
     }
-    if (override?.model) {
-      providerModule.validateModelId(override.model);
+    if (override?.model || (provider === 'opencode' && override?.model === '')) {
+      providerModule.resolveModelSpec(level, { [level]: override });
     }
     if (override?.reasoningEffort && !providerSupportsCapability(provider, 'reasoningEffort')) {
       throw new Error(

package/src/providers/index.js

@@ -129,6 +129,11 @@ class RuntimeProvider extends BaseProvider {
     return this._adapter.validateModelId(modelId);
   }
 
+  validateConfiguredModelId(modelId) {
+    const validator = this._adapter.validateConfiguredModelId || this._adapter.validateModelId;
+    return validator(modelId);
+  }
+
   isRetryableError(err) {
     return helper.classifyProviderError(this.name, err).retryable;
   }

package/src/task-run-model-args.js

@@ -0,0 +1,155 @@
+/**
+ * Append a resolved model selection to a nested `zeroshot task run` invocation.
+ *
+ * Direct requests use the public, catalog-strict `--model` channel.
+ * Provider-level selections carry only their level. The child must resolve the
+ * concrete model again from its effective provider settings.
+ *
+ * @param {string[]} args
+ * @param {Object|null|undefined} modelSpec
+ * @param {'direct'|'provider-level'} [modelSpecSource]
+ * @returns {string[]}
+ */
+function appendTaskRunModelArgs(args, modelSpec, modelSpecSource = 'direct') {
+  if (modelSpecSource === 'provider-level') {
+    if (!modelSpec?.level) {
+      throw new Error('Provider-level task model selections require a model level');
+    }
+    args.push('--model-level', modelSpec.level);
+  } else if (modelSpec?.model) {
+    args.push('--model', modelSpec.model);
+  }
+
+  if (modelSpec?.reasoningEffort) {
+    args.push('--reasoning-effort', modelSpec.reasoningEffort);
+  }
+
+  return args;
+}
+
+const ISOLATED_SETTINGS_FILE_ENV = 'ZEROSHOT_SETTINGS_FILE';
+const ISOLATED_SETTINGS_FILE_MARKER = 'ZEROSHOT_DOCKER_SETTINGS_FILE';
+const LEGACY_ISOLATED_PROVIDER_SETTINGS_ENV = 'ZEROSHOT_ISOLATED_PROVIDER_SETTINGS_JSON';
+const SETTINGS_BOOTSTRAP_SCRIPT = String.raw`
+const childProcess = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const snapshot = process.argv[1];
+const command = process.argv[2];
+const args = process.argv.slice(3);
+const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'zeroshot-isolated-settings-'));
+const settingsFile = path.join(directory, 'settings.json');
+
+try {
+  fs.writeFileSync(settingsFile, snapshot, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+  const result = childProcess.spawnSync(command, args, {
+    stdio: 'inherit',
+    env: {
+      ...process.env,
+      ${ISOLATED_SETTINGS_FILE_ENV}: settingsFile,
+      ${ISOLATED_SETTINGS_FILE_MARKER}: '1',
+    },
+  });
+  if (result.error) throw result.error;
+  process.exitCode = result.status === null ? 1 : result.status;
+} finally {
+  fs.rmSync(directory, { recursive: true, force: true });
+}
+`.trim();
+
+/**
+ * Wrap an isolated task command with a Docker-only, temporary settings-file
+ * bootstrap. The snapshot is a closed projection containing only the selected
+ * OpenCode level and its model. It never contains arbitrary provider settings,
+ * credentials, or caller-owned keys.
+ *
+ * @param {string[]} command
+ * @param {{providerName: string, settings: Object, modelSpecSource: 'direct'|'provider-level', modelSpec: Object|null|undefined}} context
+ * @returns {string[]}
+ */
+function wrapTaskRunWithIsolatedSettings(command, context) {
+  const { providerName, settings, modelSpecSource, modelSpec } = context;
+  if (providerName !== 'opencode' || modelSpecSource !== 'provider-level') return command;
+  const snapshot = buildIsolatedSettingsSnapshot(settings, modelSpec);
+  if (snapshot === null) return command;
+  return ['node', '-e', SETTINGS_BOOTSTRAP_SCRIPT, snapshot, ...command];
+}
+
+function buildIsolatedSettingsSnapshot(settings, modelSpec) {
+  const level = modelSpec?.level;
+  if (!['level1', 'level2', 'level3'].includes(level)) {
+    throw permanentError(
+      'Provider-level isolated OpenCode selections require a valid model level.'
+    );
+  }
+
+  const providerSettings = ownRecordValue(settings, 'providerSettings', 'settings') ?? {};
+  const opencodeSettings = ownRecordValue(
+    providerSettings,
+    'opencode',
+    'settings.providerSettings'
+  );
+  const levelOverrides = ownRecordValue(
+    opencodeSettings,
+    'levelOverrides',
+    'settings.providerSettings.opencode'
+  );
+  const levelOverride = ownRecordValue(
+    levelOverrides,
+    level,
+    'settings.providerSettings.opencode.levelOverrides'
+  );
+  const configuredModel =
+    levelOverride && Object.prototype.hasOwnProperty.call(levelOverride, 'model')
+      ? levelOverride.model
+      : null;
+  if (configuredModel !== null && typeof configuredModel !== 'string') {
+    throw permanentError(`Configured isolated OpenCode ${level} model must be a string or null.`);
+  }
+  if (modelSpec?.model !== configuredModel) {
+    throw permanentError(
+      `Provider-level model "${modelSpec?.model}" does not match the effective isolated ${modelSpec?.level} model "${configuredModel}".`
+    );
+  }
+  if (configuredModel === null) return null;
+
+  return JSON.stringify({
+    providerSettings: {
+      opencode: {
+        levelOverrides: {
+          [level]: { model: configuredModel },
+        },
+      },
+    },
+  });
+}
+
+function ownRecordValue(record, key, field) {
+  if (record === null || record === undefined) return undefined;
+  if (typeof record !== 'object' || Array.isArray(record)) {
+    throw permanentError(`${field} must be an object.`);
+  }
+  if (!Object.prototype.hasOwnProperty.call(record, key)) return undefined;
+  const value = record[key];
+  if (value === null || value === undefined) return undefined;
+  if (typeof value !== 'object' || Array.isArray(value)) {
+    throw permanentError(`${field}.${key} must be an object.`);
+  }
+  return value;
+}
+
+function permanentError(message) {
+  const error = new Error(message);
+  error.permanent = true;
+  return error;
+}
+
+module.exports = {
+  ISOLATED_SETTINGS_FILE_ENV,
+  ISOLATED_SETTINGS_FILE_MARKER,
+  LEGACY_ISOLATED_PROVIDER_SETTINGS_ENV,
+  appendTaskRunModelArgs,
+  wrapTaskRunWithIsolatedSettings,
+};

package/task-lib/runner.js

@@ -7,6 +7,11 @@ import { createRequire } from 'module';
 
 const require = createRequire(import.meta.url);
 const { prepareSingleAgentProviderCommand } = require('./provider-helper-runtime.js');
+const {
+  ISOLATED_SETTINGS_FILE_ENV,
+  ISOLATED_SETTINGS_FILE_MARKER,
+  LEGACY_ISOLATED_PROVIDER_SETTINGS_ENV,
+} = require('../src/task-run-model-args.js');
 export {
   isOwnedProcessTreeRunning,
   isProcessRunning,
@@ -25,10 +30,10 @@ export function spawnTask(prompt, options = {}) {
 
   const outputFormat = resolveOutputFormat(options);
   const jsonSchema = resolveJsonSchema(options, outputFormat);
-  const prepared = prepareSingleAgentProviderCommand({
-    provider: options.provider || null,
-    context: prompt,
-    options: buildProviderOptions(options, outputFormat, jsonSchema, cwd),
+  const prepared = prepareTaskProviderCommandFromResolved(prompt, options, {
+    outputFormat,
+    jsonSchema,
+    cwd,
   });
   const providerName = prepared.adapter.id;
   const modelSpec = prepared.options.modelSpec;
@@ -72,6 +77,24 @@ export function spawnTask(prompt, options = {}) {
   return task;
 }
 
+export function prepareTaskProviderCommand(prompt, options = {}) {
+  const outputFormat = resolveOutputFormat(options);
+  return prepareTaskProviderCommandFromResolved(prompt, options, {
+    outputFormat,
+    jsonSchema: resolveJsonSchema(options, outputFormat),
+    cwd: options.cwd || process.cwd(),
+  });
+}
+
+function prepareTaskProviderCommandFromResolved(prompt, options, runtime) {
+  const modelSelection = resolveRequestedModelSelection(options);
+  return prepareSingleAgentProviderCommand({
+    provider: options.provider || null,
+    context: prompt,
+    options: buildProviderOptions(options, runtime, modelSelection),
+  });
+}
+
 function resolveOutputFormat(options) {
   return options.outputFormat || 'stream-json';
 }
@@ -85,13 +108,13 @@ function resolveJsonSchema(options, outputFormat) {
   return jsonSchema;
 }
 
-function buildProviderOptions(options, outputFormat, jsonSchema, cwd) {
+function buildProviderOptions(options, runtime, modelSelection) {
   return {
-    outputFormat,
-    jsonSchema,
-    cwd,
+    outputFormat: runtime.outputFormat,
+    jsonSchema: runtime.jsonSchema,
+    cwd: runtime.cwd,
     autoApprove: true,
-    ...modelSpecOption(options),
+    ...(modelSelection === undefined ? {} : { modelSpec: modelSelection.modelSpec }),
     ...mcpConfigOption(options),
     ...(options.resume ? { resumeSessionId: options.resume } : {}),
     ...(options.continue ? { continueSession: true } : {}),
@@ -104,27 +127,32 @@ function mcpConfigOption(options) {
   return { mcpConfig: entries };
 }
 
-function modelSpecOption(options) {
-  const modelSpec = resolveRequestedModelSpec(options);
-  return modelSpec === undefined ? {} : { modelSpec };
-}
+function resolveRequestedModelSelection(options) {
+  if (Object.prototype.hasOwnProperty.call(options, 'configuredModel')) {
+    throw new Error(
+      '--configured-model is not supported; configure providerSettings levelOverrides instead'
+    );
+  }
 
-function resolveRequestedModelSpec(options) {
   if (options.model) {
-    return {
-      model: options.model,
-      ...(options.reasoningEffort ? { reasoningEffort: options.reasoningEffort } : {}),
-    };
+    return directModelSelection(options);
   }
 
-  if (options.reasoningEffort) {
-    return {
-      ...(options.modelLevel ? { level: options.modelLevel } : {}),
-      reasoningEffort: options.reasoningEffort,
-    };
-  }
-  if (options.modelLevel) return { level: options.modelLevel };
-  return undefined;
+  return providerLevelSelection(options);
+}
+
+function directModelSelection(options) {
+  const modelSpec = { model: options.model };
+  if (options.reasoningEffort) modelSpec.reasoningEffort = options.reasoningEffort;
+  return { modelSpec };
+}
+
+function providerLevelSelection(options) {
+  if (!options.reasoningEffort && !options.modelLevel) return undefined;
+  const modelSpec = {};
+  if (options.modelLevel) modelSpec.level = options.modelLevel;
+  if (options.reasoningEffort) modelSpec.reasoningEffort = options.reasoningEffort;
+  return { modelSpec };
 }
 
 function buildTaskRecord({ id, prompt, cwd, options, logFile, providerName, modelSpec }) {
@@ -189,6 +217,7 @@ function resolveWatcherScript(options, providerName) {
 }
 
 function spawnWatcher({ watcherScript, id, cwd, logFile, finalArgs, watcherConfig }) {
+  const watcherEnv = buildWatcherEnv();
   const watcher = fork(
     watcherScript,
     [id, cwd, logFile, JSON.stringify(finalArgs), JSON.stringify(watcherConfig)],
@@ -196,9 +225,20 @@ function spawnWatcher({ watcherScript, id, cwd, logFile, finalArgs, watcherConfi
       detached: true,
       stdio: 'ignore',
       windowsHide: true,
+      env: watcherEnv,
     }
   );
 
   watcher.unref();
   watcher.disconnect(); // Close IPC channel so parent can exit
 }
+
+export function buildWatcherEnv(sourceEnv = process.env) {
+  const watcherEnv = { ...sourceEnv };
+  delete watcherEnv[LEGACY_ISOLATED_PROVIDER_SETTINGS_ENV];
+  if (watcherEnv[ISOLATED_SETTINGS_FILE_MARKER] === '1') {
+    delete watcherEnv[ISOLATED_SETTINGS_FILE_ENV];
+    delete watcherEnv[ISOLATED_SETTINGS_FILE_MARKER];
+  }
+  return watcherEnv;
+}