@the-open-engine/zeroshot 6.7.2 → 6.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-open-engine/zeroshot",
-  "version": "6.7.2",
+  "version": "6.8.1",
   "description": "Multi-agent orchestration engine for Claude, Codex, and Gemini",
   "main": "src/orchestrator.js",
   "bin": {

package/scripts/assert-release-published.js

@@ -2,6 +2,7 @@
 
 const fs = require('fs');
 const https = require('https');
+const os = require('os');
 const path = require('path');
 const { execFileSync } = require('child_process');
 const { releaseTypeForMessages } = require('./release-preflight');
@@ -9,8 +10,8 @@ const { releaseTypeForMessages } = require('./release-preflight');
 const DEFAULT_ATTEMPTS = 24;
 const DEFAULT_DELAY_MS = 5000;
 
-function run(command, args) {
-  return execFileSync(command, args, { encoding: 'utf8' }).trim();
+function run(command, args, options = {}) {
+  return execFileSync(command, args, { encoding: 'utf8', ...options }).trim();
 }
 
 function packageName() {
@@ -85,21 +86,50 @@ function verifyCuratedNotes(tag, release) {
   }
 }
 
-function verifyInstalledCli(name, version) {
+function verifyInstalledCli(name, version, options = {}) {
   const packageSpec = `${name}@${version}`;
-  const reported = run('npm', [
-    'exec',
-    '--yes',
-    `--package=${packageSpec}`,
-    '--',
-    'zeroshot',
-    '--version',
-  ]);
-  if (!reported.split(/\s+/).includes(version)) {
-    throw new Error(`installed CLI reported ${reported}; expected ${version}`);
+  const execute = options.execute || run;
+  const makeTempRoot =
+    options.makeTempRoot ||
+    (() => fs.mkdtempSync(path.join(os.tmpdir(), 'zeroshot-release-cli-')));
+  const removeTempRoot =
+    options.removeTempRoot ||
+    ((root) => {
+      fs.rmSync(root, { recursive: true, force: true });
+    });
+  const platform = options.platform || process.platform;
+  const prefix = makeTempRoot();
+
+  try {
+    execute('npm', [
+      'install',
+      '--global',
+      '--prefix',
+      prefix,
+      '--no-audit',
+      '--no-fund',
+      packageSpec,
+    ]);
+
+    const executable = path.join(
+      prefix,
+      platform === 'win32' ? 'zeroshot.cmd' : 'bin',
+      ...(platform === 'win32' ? [] : ['zeroshot'])
+    );
+    const isolatedEnv = {
+      ...process.env,
+      HOME: prefix,
+      USERPROFILE: prefix,
+    };
+    const reported = execute(executable, ['--version'], { env: isolatedEnv });
+    if (!reported.split(/\s+/).includes(version)) {
+      throw new Error(`installed CLI reported ${reported}; expected ${version}`);
+    }
+    execute(executable, ['--help'], { env: isolatedEnv });
+    execute(executable, ['list'], { env: isolatedEnv });
+  } finally {
+    removeTempRoot(prefix);
   }
-  run('npm', ['exec', '--yes', `--package=${packageSpec}`, '--', 'zeroshot', '--help']);
-  run('npm', ['exec', '--yes', `--package=${packageSpec}`, '--', 'zeroshot', 'list']);
 }
 
 function tagsPointingAtHead() {
@@ -149,28 +179,74 @@ function sleep(ms) {
   });
 }
 
+function nextRetryDelay(attempt, attempts, delayMs, options) {
+  if (attempt >= attempts) return null;
+  if (options.deadline === undefined) return delayMs;
+
+  const now = options.now || Date.now;
+  const remainingMs = options.deadline - now();
+  if (remainingMs <= 0) return null;
+  return Math.min(delayMs, remainingMs);
+}
+
 async function waitForNpmLatest(name, expectedVersion, options = {}) {
   const attempts =
     options.attempts || Number(process.env.RELEASE_ASSERT_ATTEMPTS || DEFAULT_ATTEMPTS);
   const delayMs =
     options.delayMs || Number(process.env.RELEASE_ASSERT_DELAY_MS || DEFAULT_DELAY_MS);
+  const wait = options.sleep || sleep;
 
   let latest = null;
   for (let attempt = 1; attempt <= attempts; attempt += 1) {
     latest = npmLatest(name);
     if (latest === expectedVersion) return latest;
 
-    if (attempt < attempts) {
+    const retryDelay = nextRetryDelay(attempt, attempts, delayMs, options);
+    if (retryDelay !== null) {
       console.log(
         `npm latest for ${name} is ${latest}; waiting for ${expectedVersion} (${attempt}/${attempts})`
       );
-      await sleep(delayMs);
+      await wait(retryDelay);
+    } else {
+      break;
     }
   }
 
   throw new Error(`expected npm latest for ${name} to be ${expectedVersion}, got ${latest}`);
 }
 
+async function waitForPublishedArtifact(label, check, options = {}) {
+  const attempts =
+    options.attempts || Number(process.env.RELEASE_ASSERT_ATTEMPTS || DEFAULT_ATTEMPTS);
+  const delayMs =
+    options.delayMs || Number(process.env.RELEASE_ASSERT_DELAY_MS || DEFAULT_DELAY_MS);
+  const wait = options.sleep || sleep;
+  let lastError = null;
+  let attemptsMade = 0;
+
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    attemptsMade = attempt;
+    try {
+      return await check();
+    } catch (error) {
+      lastError = error;
+      const retryDelay = nextRetryDelay(attempt, attempts, delayMs, options);
+      if (retryDelay !== null) {
+        console.log(
+          `${label} is not ready: ${error.message}; retrying (${attempt}/${attempts})`
+        );
+        await wait(retryDelay);
+      } else {
+        break;
+      }
+    }
+  }
+
+  throw new Error(
+    `${label} did not become ready after ${attemptsMade} attempts: ${lastError?.message || 'unknown error'}`
+  );
+}
+
 async function main() {
   const name = packageName();
   const headTags = tagsPointingAtHead();
@@ -188,30 +264,62 @@ async function main() {
 
   console.log(`tags on HEAD: ${headTags.join(', ') || '(none)'}`);
   const expectedVersion = expectedTag.slice(1);
-  const latest = await waitForNpmLatest(name, expectedVersion);
+  const retryAttempts = Number(process.env.RELEASE_ASSERT_ATTEMPTS || DEFAULT_ATTEMPTS);
+  const retryDelayMs = Number(process.env.RELEASE_ASSERT_DELAY_MS || DEFAULT_DELAY_MS);
+  const retryOptions = {
+    attempts: retryAttempts,
+    delayMs: retryDelayMs,
+    deadline: Date.now() + retryAttempts * retryDelayMs,
+  };
+  const latest = await waitForNpmLatest(name, expectedVersion, retryOptions);
 
   console.log(`npm latest for ${name}: ${latest}`);
 
   const expectedCommit = run('git', ['rev-parse', 'HEAD']);
-  const metadata = npmReleaseMetadata(name, expectedVersion);
-  if (metadata.version !== expectedVersion) {
-    throw new Error(`npm metadata returned ${metadata.version}; expected ${expectedVersion}`);
-  }
-  if (metadata.gitHead !== expectedCommit) {
-    throw new Error(`npm gitHead ${metadata.gitHead || '(missing)'} does not match HEAD`);
-  }
+  const metadata = await waitForPublishedArtifact(
+    'npm release metadata',
+    () => {
+      const result = npmReleaseMetadata(name, expectedVersion);
+      if (result.version !== expectedVersion) {
+        throw new Error(`npm metadata returned ${result.version}; expected ${expectedVersion}`);
+      }
+      if (result.gitHead !== expectedCommit) {
+        throw new Error(`npm gitHead ${result.gitHead || '(missing)'} does not match HEAD`);
+      }
+      if (!result['dist.attestations']?.url) {
+        throw new Error('npm attestation URL is missing');
+      }
+      return result;
+    },
+    retryOptions
+  );
 
-  const attestationUrl = metadata['dist.attestations']?.url;
-  if (!attestationUrl) throw new Error('npm attestation URL is missing');
-  const attestations = await httpsJson(attestationUrl);
-  verifyProvenance(provenanceStatement(attestations), expectedCommit);
+  await waitForPublishedArtifact(
+    'npm provenance',
+    async () => {
+      const attestations = await httpsJson(metadata['dist.attestations'].url);
+      verifyProvenance(provenanceStatement(attestations), expectedCommit);
+    },
+    retryOptions
+  );
 
-  const release = githubRelease(expectedTag);
-  if (release.tagName !== expectedTag) {
-    throw new Error(`GitHub Release tag ${release.tagName} does not match ${expectedTag}`);
-  }
-  verifyCuratedNotes(expectedTag, release);
-  verifyInstalledCli(name, expectedVersion);
+  await waitForPublishedArtifact(
+    'GitHub Release',
+    () => {
+      const release = githubRelease(expectedTag);
+      if (release.tagName !== expectedTag) {
+        throw new Error(`GitHub Release tag ${release.tagName} does not match ${expectedTag}`);
+      }
+      verifyCuratedNotes(expectedTag, release);
+    },
+    retryOptions
+  );
+
+  await waitForPublishedArtifact(
+    'installed CLI',
+    () => verifyInstalledCli(name, expectedVersion),
+    retryOptions
+  );
 
   console.log(`Release publication verified: ${name}@${latest}`);
 }
@@ -230,6 +338,8 @@ module.exports = {
   npmLatest,
   provenanceStatement,
   tagsPointingAtHead,
+  verifyInstalledCli,
   verifyProvenance,
   waitForNpmLatest,
+  waitForPublishedArtifact,
 };

package/src/agent/agent-task-executor.js

@@ -23,6 +23,10 @@ const {
   prepareClaudeConfigDir,
   resolveRepoMcpConfigPath,
 } = require('../worktree-claude-config.js');
+const {
+  appendTaskRunModelArgs,
+  wrapTaskRunWithIsolatedSettings,
+} = require('../task-run-model-args.js');
 const { buildRawLogOnlyMetadata } = require('./context-replay-policy');
 
 function runCommandWithTimeout(command, args, options = {}, callback = null) {
@@ -722,14 +726,10 @@ function resolveOutputFormatConfig(agent) {
 
 function buildTaskRunArgs({ agent, providerName, modelSpec, runOutputFormat }) {
   const args = ['task', 'run', '--output-format', runOutputFormat, '--provider', providerName];
-
-  if (modelSpec?.model) {
-    args.push('--model', modelSpec.model);
-  }
-
-  if (modelSpec?.reasoningEffort) {
-    args.push('--reasoning-effort', modelSpec.reasoningEffort);
-  }
+  const modelSpecSource = agent._resolveModelSpecSource
+    ? agent._resolveModelSpecSource()
+    : 'direct';
+  appendTaskRunModelArgs(args, modelSpec, modelSpecSource);
 
   // Add verification mode flag if configured
   if (agent.config.verificationMode) {
@@ -875,8 +875,11 @@ function spawnTaskProcess({ agent, ctPath, args, cwd, spawnEnv }) {
   // Timeout for spawn phase - if CLI hangs during init (e.g., opencode 429 bug), kill it
   const SPAWN_TIMEOUT_MS = 30000; // 30 seconds to spawn task
 
+  // spawn() throws on null bytes in argv; strip them before they get there.
+  const safeArgs = args.map((arg) => (typeof arg === 'string' ? arg.replace(/\0/g, '') : arg));
+
   return new Promise((resolve, reject) => {
-    const proc = spawn(ctPath, args, {
+    const proc = spawn(ctPath, safeArgs, {
       cwd,
       stdio: ['ignore', 'pipe', 'pipe'],
       env: spawnEnv,
@@ -1509,11 +1512,14 @@ async function spawnClaudeTaskIsolated(agent, context) {
   const { manager, clusterId } = agent.isolation;
   const providerName = agent._resolveProvider ? agent._resolveProvider() : 'claude';
   const modelSpec = resolveAgentModelSpec(agent);
+  const modelSpecSource = agent._resolveModelSpecSource
+    ? agent._resolveModelSpecSource()
+    : 'direct';
 
   agent._log(`📦 Agent ${agent.id}: Running task in isolated container using zeroshot task run...`);
 
   const { desiredOutputFormat, runOutputFormat } = resolveOutputFormatConfig(agent);
-  const command = [
+  let command = [
     'zeroshot',
     ...buildTaskRunArgs({
       agent,
@@ -1531,6 +1537,12 @@ async function spawnClaudeTaskIsolated(agent, context) {
   });
 
   command.push(finalContext);
+  command = wrapTaskRunWithIsolatedSettings(command, {
+    providerName,
+    settings: loadSettings(),
+    modelSpecSource,
+    modelSpec,
+  });
 
   // STEP 1: Spawn task and extract task ID (same as non-isolated mode)
   // Timeout for spawn phase - if CLI hangs during init (e.g., opencode 429 bug), kill it
@@ -2357,6 +2369,7 @@ async function killIsolatedTask(agent, currentTask, taskId, reason, code) {
 module.exports = {
   ensureAskUserQuestionHook,
   spawnClaudeTask,
+  spawnTaskProcess,
   followClaudeTaskLogs,
   followClaudeTaskLogsIsolated,
   waitForTaskReady,

package/src/agent-cli-provider/adapters/claude.ts

@@ -40,6 +40,7 @@ const MODEL_CATALOG: Readonly<Record<string, ModelCatalogEntry>> = {
   'claude-opus-4-6': { rank: 3 },
   'claude-opus-4-7': { rank: 3 },
   'claude-opus-4-8': { rank: 3 },
+  'claude-opus-5': { rank: 3 },
   fable: { rank: 3 },
   'claude-fable-5': { rank: 3 },
   'claude-mythos-5': { rank: 3 },

package/src/agent-cli-provider/adapters/codex.ts

@@ -29,8 +29,11 @@ const MODEL_CATALOG: Readonly<Record<string, ModelCatalogEntry>> = {
   'gpt-5.5': { rank: 3 },
   'gpt-5.6': { rank: 3 },
   'gpt-5.6-sol': { rank: 3 },
+  'openai.gpt-5.6-sol': { rank: 3 },
   'gpt-5.6-terra': { rank: 2 },
+  'openai.gpt-5.6-terra': { rank: 2 },
   'gpt-5.6-luna': { rank: 1 },
+  'openai.gpt-5.6-luna': { rank: 1 },
 };
 
 const LEVEL_MAPPING: Readonly<Record<ModelLevel, LevelModelSpec>> = {

package/src/agent-cli-provider/adapters/common.ts

@@ -99,7 +99,7 @@ export function validateModelIdFromCatalog(
   modelId: string | null | undefined
 ): string | null | undefined {
   if (!modelId) return modelId;
-  if (catalog[modelId] !== undefined) return modelId;
+  if (Object.prototype.hasOwnProperty.call(catalog, modelId)) return modelId;
   const validModels = Object.keys(catalog).join(', ');
   throw new InvalidProviderModelError(
     `Invalid model "${modelId}" for provider "${provider}". Valid models: ${validModels}.`

package/src/agent-cli-provider/adapters/opencode-models.ts

@@ -0,0 +1,100 @@
+import { unknownToMessage } from '../json';
+import {
+  InvalidProviderModelError,
+  type LevelModelSpec,
+  type LevelOverrides,
+  type ModelCatalogEntry,
+  type ModelLevel,
+  type ResolvedModelSpec,
+} from '../types';
+import { validateModelIdFromCatalog } from './common';
+
+export const MODEL_CATALOG: Readonly<Record<string, ModelCatalogEntry>> = {
+  'opencode/big-pickle': { rank: 1 },
+  'opencode/glm-4.7-free': { rank: 1 },
+  'opencode/gpt-5-nano': { rank: 1 },
+  'opencode/grok-code': { rank: 1 },
+  'opencode/minimax-m2.1-free': { rank: 1 },
+  'google/gemini-1.5-flash': { rank: 1 },
+  'google/gemini-1.5-flash-8b': { rank: 1 },
+  'google/gemini-1.5-pro': { rank: 1 },
+  'google/gemini-2.0-flash': { rank: 1 },
+  'google/gemini-2.0-flash-lite': { rank: 1 },
+  'google/gemini-2.5-flash': { rank: 1 },
+  'google/gemini-2.5-flash-image': { rank: 1 },
+  'google/gemini-2.5-flash-image-preview': { rank: 1 },
+  'google/gemini-2.5-flash-lite': { rank: 1 },
+  'google/gemini-2.5-flash-lite-preview-06-17': { rank: 1 },
+  'google/gemini-2.5-flash-lite-preview-09-2025': { rank: 1 },
+  'google/gemini-2.5-flash-preview-04-17': { rank: 1 },
+  'google/gemini-2.5-flash-preview-05-20': { rank: 1 },
+  'google/gemini-2.5-flash-preview-09-2025': { rank: 1 },
+  'google/gemini-2.5-flash-preview-tts': { rank: 1 },
+  'google/gemini-2.5-pro': { rank: 1 },
+  'google/gemini-2.5-pro-preview-05-06': { rank: 1 },
+  'google/gemini-2.5-pro-preview-06-05': { rank: 1 },
+  'google/gemini-2.5-pro-preview-tts': { rank: 1 },
+  'google/gemini-3-flash-preview': { rank: 1 },
+  'google/gemini-3-pro-preview': { rank: 1 },
+  'google/gemini-embedding-001': { rank: 1 },
+  'google/gemini-flash-latest': { rank: 1 },
+  'google/gemini-flash-lite-latest': { rank: 1 },
+  'google/gemini-live-2.5-flash': { rank: 1 },
+  'google/gemini-live-2.5-flash-preview-native-audio': { rank: 1 },
+  'openai/gpt-5.1-codex-max': { rank: 1 },
+  'openai/gpt-5.1-codex-mini': { rank: 1 },
+  'openai/gpt-5.2': { rank: 1 },
+  'openai/gpt-5.2-codex': { rank: 1 },
+};
+
+export const LEVEL_MAPPING: Readonly<Record<ModelLevel, LevelModelSpec>> = {
+  level1: { rank: 1, model: null, reasoningEffort: 'low' },
+  level2: { rank: 2, model: null, reasoningEffort: 'medium' },
+  level3: { rank: 3, model: null, reasoningEffort: 'high' },
+};
+
+function containsControlCharacter(value: string): boolean {
+  return Array.from(value).some((character) => {
+    const codePoint = character.codePointAt(0);
+    return codePoint !== undefined && (codePoint <= 0x1f || codePoint === 0x7f);
+  });
+}
+
+export function resolveModelSpec(level: ModelLevel, overrides?: LevelOverrides): ResolvedModelSpec {
+  const base = LEVEL_MAPPING[level] ?? LEVEL_MAPPING.level2;
+  const override = overrides?.[level];
+  const selectedModel = override?.model ?? base.model;
+  return {
+    level,
+    model:
+      override?.model === undefined || override.model === null
+        ? (validateModelId(selectedModel) ?? null)
+        : (validateConfiguredModelId(selectedModel) ?? null),
+    reasoningEffort: override?.reasoningEffort ?? base.reasoningEffort,
+  };
+}
+
+export function validateConfiguredModelId(
+  modelId: string | null | undefined
+): string | null | undefined {
+  if (modelId && Object.prototype.hasOwnProperty.call(MODEL_CATALOG, modelId)) return modelId;
+  if (typeof modelId !== 'string') return validateModelId(modelId);
+  const segments = modelId.split('/');
+  if (
+    segments.length >= 2 &&
+    segments.every(Boolean) &&
+    !/\s/u.test(modelId) &&
+    !containsControlCharacter(modelId)
+  ) {
+    return modelId;
+  }
+  throw new InvalidProviderModelError(
+    `Invalid configured model "${unknownToMessage(
+      modelId
+    )}" for provider "opencode". Expected "provider/model" with no whitespace, control characters, or empty path segments.`
+  );
+}
+
+export function validateModelId(modelId: string | null | undefined): string | null | undefined {
+  return validateModelIdFromCatalog('opencode', MODEL_CATALOG, modelId);
+}

package/src/agent-cli-provider/adapters/opencode.ts

@@ -11,14 +11,9 @@ import {
   type BuildProviderCommandOptions,
   type CommandSpec,
   type ErrorClassification,
-  type LevelModelSpec,
-  type LevelOverrides,
-  type ModelCatalogEntry,
-  type ModelLevel,
   type OpencodeCliFeatures,
   type OutputEvent,
   type ProviderAdapter,
-  type ResolvedModelSpec,
   type WarningMetadata,
 } from '../types';
 import {
@@ -26,55 +21,16 @@ import {
   commandSpec,
   createParserState,
   optionFeatures,
-  resolveModelSpecWithConfig,
   unsupportedSessionControlWarnings,
-  validateModelIdFromCatalog,
   warning,
 } from './common';
-
-const MODEL_CATALOG: Readonly<Record<string, ModelCatalogEntry>> = {
-  'opencode/big-pickle': { rank: 1 },
-  'opencode/glm-4.7-free': { rank: 1 },
-  'opencode/gpt-5-nano': { rank: 1 },
-  'opencode/grok-code': { rank: 1 },
-  'opencode/minimax-m2.1-free': { rank: 1 },
-  'google/gemini-1.5-flash': { rank: 1 },
-  'google/gemini-1.5-flash-8b': { rank: 1 },
-  'google/gemini-1.5-pro': { rank: 1 },
-  'google/gemini-2.0-flash': { rank: 1 },
-  'google/gemini-2.0-flash-lite': { rank: 1 },
-  'google/gemini-2.5-flash': { rank: 1 },
-  'google/gemini-2.5-flash-image': { rank: 1 },
-  'google/gemini-2.5-flash-image-preview': { rank: 1 },
-  'google/gemini-2.5-flash-lite': { rank: 1 },
-  'google/gemini-2.5-flash-lite-preview-06-17': { rank: 1 },
-  'google/gemini-2.5-flash-lite-preview-09-2025': { rank: 1 },
-  'google/gemini-2.5-flash-preview-04-17': { rank: 1 },
-  'google/gemini-2.5-flash-preview-05-20': { rank: 1 },
-  'google/gemini-2.5-flash-preview-09-2025': { rank: 1 },
-  'google/gemini-2.5-flash-preview-tts': { rank: 1 },
-  'google/gemini-2.5-pro': { rank: 1 },
-  'google/gemini-2.5-pro-preview-05-06': { rank: 1 },
-  'google/gemini-2.5-pro-preview-06-05': { rank: 1 },
-  'google/gemini-2.5-pro-preview-tts': { rank: 1 },
-  'google/gemini-3-flash-preview': { rank: 1 },
-  'google/gemini-3-pro-preview': { rank: 1 },
-  'google/gemini-embedding-001': { rank: 1 },
-  'google/gemini-flash-latest': { rank: 1 },
-  'google/gemini-flash-lite-latest': { rank: 1 },
-  'google/gemini-live-2.5-flash': { rank: 1 },
-  'google/gemini-live-2.5-flash-preview-native-audio': { rank: 1 },
-  'openai/gpt-5.1-codex-max': { rank: 1 },
-  'openai/gpt-5.1-codex-mini': { rank: 1 },
-  'openai/gpt-5.2': { rank: 1 },
-  'openai/gpt-5.2-codex': { rank: 1 },
-};
-
-const LEVEL_MAPPING: Readonly<Record<ModelLevel, LevelModelSpec>> = {
-  level1: { rank: 1, model: null, reasoningEffort: 'low' },
-  level2: { rank: 2, model: null, reasoningEffort: 'medium' },
-  level3: { rank: 3, model: null, reasoningEffort: 'high' },
-};
+import {
+  LEVEL_MAPPING,
+  MODEL_CATALOG,
+  resolveModelSpec,
+  validateConfiguredModelId,
+  validateModelId,
+} from './opencode-models';
 
 function detectCliFeatures(helpText?: string | null): OpencodeCliFeatures {
   const help = helpText ?? '';
@@ -244,20 +200,6 @@ function parseEvent(line: string): OutputEvent | null {
   return null;
 }
 
-function resolveModelSpec(level: ModelLevel, overrides?: LevelOverrides): ResolvedModelSpec {
-  return resolveModelSpecWithConfig({
-    mapping: LEVEL_MAPPING,
-    defaultLevel: 'level2',
-    level,
-    overrides,
-    validateModelId,
-  });
-}
-
-function validateModelId(modelId: string | null | undefined): string | null | undefined {
-  return validateModelIdFromCatalog('opencode', MODEL_CATALOG, modelId);
-}
-
 function classifyError(error: unknown): ErrorClassification {
   return classifyBaseProviderError(error, [], []);
 }
@@ -285,5 +227,6 @@ export const opencodeAdapter: ProviderAdapter = {
   createParserState: () => createParserState('opencode'),
   resolveModelSpec,
   validateModelId,
+  validateConfiguredModelId,
   classifyError,
 };