@the-open-engine/zeroshot 6.7.2 → 6.8.1

package/src/agent-cli-provider/single-agent-runtime.ts

@@ -34,6 +34,11 @@ interface RuntimeProviderSettings {
   readonly gateway?: GatewayBuildOptions;
 }
 
+interface RuntimeCommandContext {
+  readonly cliFeatures: CliFeatureOverrides;
+  readonly authEnv: Readonly<Record<string, string>>;
+}
+
 export interface SingleAgentProviderCommandInput {
   readonly provider?: string | null;
   readonly context: string;
@@ -62,6 +67,7 @@ type MutableModelSpec = {
 
 const MODEL_LEVELS: readonly ModelLevel[] = ['level1', 'level2', 'level3'];
 const REASONING_EFFORTS: readonly ReasoningEffort[] = ['low', 'medium', 'high', 'xhigh', 'max'];
+const LEGACY_ISOLATED_PROVIDER_SETTINGS_ENV = 'ZEROSHOT_ISOLATED_PROVIDER_SETTINGS_JSON';
 const settingsModule: unknown = require('../../lib/settings');
 const providerDetectionModule: unknown = require('../../lib/provider-detection');
 const claudeAuthModule: unknown = require('../../lib/settings/claude-auth');
@@ -76,6 +82,7 @@ const resolveClaudeAuthFn = moduleFunction(claudeAuthModule, 'resolveClaudeAuth'
 export function prepareSingleAgentProviderCommand(
   input: SingleAgentProviderCommandInput
 ): PreparedSingleAgentProviderCommand {
+  rejectCallerSuppliedModelProvenance(input);
   const baseOptions = input.options ?? {};
   const settings = loadRuntimeSettings();
   const adapter = adapterForRuntimeInput(input.provider, settings);
@@ -86,7 +93,10 @@ export function prepareSingleAgentProviderCommand(
   );
   const cliFeatures = resolveRuntimeCliFeatures(adapter.id, baseOptions.cliFeatures);
   const authEnv = baseOptions.authEnv ?? resolveRuntimeAuthEnv(adapter.id, settings);
-  const options = buildRuntimeOptions(baseOptions, adapter, providerSettings, cliFeatures, authEnv);
+  const options = buildRuntimeOptions(baseOptions, adapter, providerSettings, {
+    cliFeatures,
+    authEnv,
+  });
   return {
     adapter,
     options,
@@ -128,8 +138,7 @@ function mergeAcpFailClosedCliFeatures(
     ...detected,
     ...overrides,
     supportsAcpStdio: detected.supportsAcpStdio && overrides.supportsAcpStdio !== false,
-    supportsPromptImages:
-      detected.supportsPromptImages && overrides.supportsPromptImages !== false,
+    supportsPromptImages: detected.supportsPromptImages && overrides.supportsPromptImages !== false,
     supportsLoadSession: detected.supportsLoadSession && overrides.supportsLoadSession !== false,
     supportsSessionCancel:
       detected.supportsSessionCancel && overrides.supportsSessionCancel !== false,
@@ -162,7 +171,9 @@ export function probeRuntimeProviderCli(provider: string): RuntimeProviderProbe
   }
 
   const helpText = stringResult(getHelpOutputFn(helpCommand.command, helpCommand.args)).trim();
-  const versionText = stringResult(getVersionOutputFn(helpCommand.command, helpCommand.args)).trim();
+  const versionText = stringResult(
+    getVersionOutputFn(helpCommand.command, helpCommand.args)
+  ).trim();
   const availabilityProbe = getProviderRegistryEntry(adapter.id).availabilityProbe ?? 'command';
 
   return {
@@ -177,8 +188,7 @@ function buildRuntimeOptions(
   baseOptions: BuildProviderCommandOptions,
   adapter: ProviderAdapter,
   providerSettings: RuntimeProviderSettings,
-  cliFeatures: CliFeatureOverrides,
-  authEnv: Readonly<Record<string, string>>
+  runtime: RuntimeCommandContext
 ): BuildProviderCommandOptions {
   const modelSpec = resolveRuntimeModelSpec(adapter, baseOptions.modelSpec, providerSettings);
   const gateway = resolveRuntimeGatewayOptions(
@@ -191,16 +201,16 @@ function buildRuntimeOptions(
     ...baseOptions,
     modelSpec,
     ...(gateway === undefined ? {} : { gateway }),
-    cliFeatures,
+    cliFeatures: runtime.cliFeatures,
   };
   if (baseOptions.jsonSchema && !supportsProviderCapability(adapter.id, 'jsonSchema')) {
-    if (!shouldIncludeAuthEnv(baseOptions, authEnv)) {
+    if (!shouldIncludeAuthEnv(baseOptions, runtime.authEnv)) {
       return { ...resolved, strictSchema: false };
     }
-    return { ...resolved, authEnv, strictSchema: false };
+    return { ...resolved, authEnv: runtime.authEnv, strictSchema: false };
   }
-  if (!shouldIncludeAuthEnv(baseOptions, authEnv)) return resolved;
-  return { ...resolved, authEnv };
+  if (!shouldIncludeAuthEnv(baseOptions, runtime.authEnv)) return resolved;
+  return { ...resolved, authEnv: runtime.authEnv };
 }
 
 function resolveRuntimeGatewayOptions(
@@ -218,23 +228,19 @@ function resolveRuntimeGatewayOptions(
       ? settingsGateway.headers
       : { ...(settingsGateway.headers ?? {}), ...requestGateway.headers };
   const mergedGateway: GatewayBuildOptions = {
-    ...(requestGateway.baseUrl ?? settingsGateway.baseUrl
+    ...((requestGateway.baseUrl ?? settingsGateway.baseUrl)
       ? { baseUrl: requestGateway.baseUrl ?? settingsGateway.baseUrl }
       : {}),
-    ...(requestGateway.apiKey ?? settingsGateway.apiKey
+    ...((requestGateway.apiKey ?? settingsGateway.apiKey)
       ? { apiKey: requestGateway.apiKey ?? settingsGateway.apiKey }
       : {}),
     ...(mergedHeaders === undefined ? {} : { headers: mergedHeaders }),
     model: requestGateway.model ?? modelSpec.model ?? settingsGateway.model ?? null,
-    ...(requestGateway.toolPolicy ?? settingsGateway.toolPolicy
+    ...((requestGateway.toolPolicy ?? settingsGateway.toolPolicy)
       ? { toolPolicy: requestGateway.toolPolicy ?? settingsGateway.toolPolicy }
       : {}),
   };
-  return resolveGatewayConfiguration(
-    mergedGateway,
-    'options.gateway',
-    cwd
-  );
+  return resolveGatewayConfiguration(mergedGateway, 'options.gateway', cwd);
 }
 
 function shouldIncludeAuthEnv(
@@ -286,7 +292,8 @@ function adapterForRuntimeInput(
   provider: string | null | undefined,
   settings: Record<string, unknown>
 ): ProviderAdapter {
-  const configured = provider ?? optionalString(settings.defaultProvider, 'settings.defaultProvider');
+  const configured =
+    provider ?? optionalString(settings.defaultProvider, 'settings.defaultProvider');
   return getProviderAdapter(configured ?? 'claude');
 }
 
@@ -309,16 +316,14 @@ function runtimeProviderSettings(
   );
   const gateway =
     provider === 'gateway'
-      ? normalizeGatewayBuildOptions(
-          providerSettings,
-          'settings.providerSettings.gateway',
-          cwd
-        )
+      ? normalizeGatewayBuildOptions(providerSettings, 'settings.providerSettings.gateway', cwd)
       : undefined;
   if (defaultLevel === undefined) {
     return gateway === undefined ? { levelOverrides } : { levelOverrides, gateway };
   }
-  return gateway === undefined ? { defaultLevel, levelOverrides } : { defaultLevel, levelOverrides, gateway };
+  return gateway === undefined
+    ? { defaultLevel, levelOverrides }
+    : { defaultLevel, levelOverrides, gateway };
 }
 
 function runtimeHelpCommand(provider: ProviderId): CommandParts {
@@ -333,7 +338,11 @@ function probeGatewayProvider(adapter: ProviderAdapter): RuntimeProviderProbe {
   try {
     const settings = loadRuntimeSettings();
     const providerSettings = runtimeProviderSettings(settings, 'gateway', process.cwd());
-    resolveGatewayConfiguration(providerSettings.gateway, 'settings.providerSettings.gateway', process.cwd());
+    resolveGatewayConfiguration(
+      providerSettings.gateway,
+      'settings.providerSettings.gateway',
+      process.cwd()
+    );
     return {
       available: true,
       helpText: 'Bundled gateway runner',
@@ -351,8 +360,20 @@ function probeGatewayProvider(adapter: ProviderAdapter): RuntimeProviderProbe {
 }
 
 function loadRuntimeSettings(): Record<string, unknown> {
-  const settings = loadSettingsFn();
-  return requiredRecord(settings, 'loadSettings');
+  if (Object.prototype.hasOwnProperty.call(process.env, LEGACY_ISOLATED_PROVIDER_SETTINGS_ENV)) {
+    throw new Error(
+      `${LEGACY_ISOLATED_PROVIDER_SETTINGS_ENV} is not a trusted settings channel; use the settings file.`
+    );
+  }
+  return requiredRecord(loadSettingsFn(), 'loadSettings');
+}
+
+function rejectCallerSuppliedModelProvenance(input: SingleAgentProviderCommandInput): void {
+  if (Object.prototype.hasOwnProperty.call(input, 'modelSpecSource')) {
+    throw new Error(
+      'modelSpecSource is not accepted at the child provider boundary; use modelLevel and effective provider settings.'
+    );
+  }
 }
 
 function moduleFunction(moduleValue: unknown, field: string): UnknownFunction {
@@ -456,10 +477,7 @@ function requiredRecord(value: unknown, field: string): Record<string, unknown>
   throw new Error(`${field} must be an object.`);
 }
 
-function stringRecordFromUnknown(
-  value: unknown,
-  field: string
-): Readonly<Record<string, string>> {
+function stringRecordFromUnknown(value: unknown, field: string): Readonly<Record<string, string>> {
   if (value === undefined || value === null) return {};
   const record = requiredRecord(value, field);
   const result: Record<string, string> = {};

package/src/agent-cli-provider/types.ts

@@ -367,6 +367,7 @@ export interface ProviderAdapter {
   createParserState(): ProviderParserState;
   resolveModelSpec(level: ModelLevel, overrides?: LevelOverrides): ResolvedModelSpec;
   validateModelId(modelId: string | null | undefined): string | null | undefined;
+  validateConfiguredModelId?(modelId: string | null | undefined): string | null | undefined;
   classifyError(error: unknown): ErrorClassification;
 }
 

package/src/agent-wrapper.js

@@ -103,10 +103,11 @@ class AgentWrapper {
       const taskRunner = options.taskRunner;
       this.mockSpawnFn = (args, { context }) => {
         const spec = this._resolveModelSpec();
+        const source = this._resolveModelSpecSource();
         return taskRunner.run(context, {
           agentId: this.id,
-          model: this._selectModel(),
-          modelSpec: spec,
+          ...(source === 'direct' ? { model: spec.model } : { modelLevel: spec.level }),
+          ...(spec.reasoningEffort ? { reasoningEffort: spec.reasoningEffort } : {}),
           provider: this._resolveProvider(),
           cwd: this.config.cwd || process.cwd(),
           worktreePath: this.worktree?.path || null,
@@ -222,6 +223,17 @@ class AgentWrapper {
     return applyReasoningOverride({ ...spec, level }, this.config.reasoningEffort);
   }
 
+  _resolveModelSpecSource() {
+    if (this.modelConfig.type === 'rules') {
+      for (const rule of this.modelConfig.rules) {
+        if (this._matchesIterationRange(rule.iterations)) {
+          return rule.model ? 'direct' : 'provider-level';
+        }
+      }
+    }
+    return this.modelConfig.model ? 'direct' : 'provider-level';
+  }
+
   /**
    * Publish a message to the message bus, always including sender_model
    * @private

package/src/claude-task-runner.js

@@ -13,6 +13,18 @@ const { normalizeProviderName } = require('../lib/provider-names');
 const { getProvider } = require('./providers');
 const { prependWorktreeToolBinToEnv } = require('./worktree-tooling-env');
 const { prepareClaudeConfigDir } = require('./worktree-claude-config');
+const {
+  appendTaskRunModelArgs,
+  wrapTaskRunWithIsolatedSettings,
+} = require('./task-run-model-args');
+
+function rejectCallerSuppliedModelProvenance(options) {
+  if (Object.prototype.hasOwnProperty.call(options, 'modelSpecSource')) {
+    throw new Error(
+      'modelSpecSource is derived from model versus modelLevel/default and cannot be supplied.'
+    );
+  }
+}
 
 function runCommand(command, args, options = {}, callback = null) {
   const timeout = options.timeout ?? 30000;
@@ -112,10 +124,11 @@ class ClaudeTaskRunner extends TaskRunner {
    * Execute a task via zeroshot CLI
    *
    * @param {string} context - Full prompt/context
-   * @param {{agentId?: string, model?: string, outputFormat?: string, jsonSchema?: any, strictSchema?: boolean, cwd?: string, worktreePath?: string|null, isolation?: any}} options - Execution options
+   * @param {{agentId?: string, model?: string, modelLevel?: string, modelSpec?: Object|null, reasoningEffort?: string, outputFormat?: string, jsonSchema?: any, strictSchema?: boolean, cwd?: string, worktreePath?: string|null, isolation?: any}} options - Execution options
    * @returns {Promise<{success: boolean, output: string, error: string|null, taskId?: string}>}
    */
   async run(context, options = {}) {
+    rejectCallerSuppliedModelProvenance(options);
     const {
       agentId = 'unknown',
       provider,
@@ -137,7 +150,7 @@ class ClaudeTaskRunner extends TaskRunner {
       providerName,
       settings
     );
-    const resolvedModelSpec = this._resolveModelSpec({
+    const modelSelection = this._resolveModelSelection({
       explicitModelSpec,
       model,
       reasoningEffort,
@@ -146,13 +159,13 @@ class ClaudeTaskRunner extends TaskRunner {
       providerSettings,
       levelOverrides,
     });
+    const resolvedModelSpec = modelSelection.modelSpec;
 
     // Isolation mode delegates to separate method
     if (isolation?.enabled) {
       return this._runIsolated(context, {
         ...options,
         provider: providerName,
-        modelSpec: resolvedModelSpec,
       });
     }
 
@@ -168,6 +181,7 @@ class ClaudeTaskRunner extends TaskRunner {
       providerName,
       runOutputFormat,
       resolvedModelSpec,
+      modelSpecSource: modelSelection.source,
       jsonSchema,
     });
 
@@ -204,25 +218,74 @@ class ClaudeTaskRunner extends TaskRunner {
     providerSettings,
     levelOverrides,
   }) {
-    if (explicitModelSpec) {
-      if (explicitModelSpec.model) {
-        providerModule.validateModelId(explicitModelSpec.model);
-      }
-      return explicitModelSpec;
-    }
+    return this._resolveModelSelection({
+      explicitModelSpec,
+      model,
+      reasoningEffort,
+      modelLevel,
+      providerModule,
+      providerSettings,
+      levelOverrides,
+    }).modelSpec;
+  }
 
+  _resolveModelSelection({
+    explicitModelSpec,
+    model,
+    reasoningEffort,
+    modelLevel,
+    providerModule,
+    providerSettings,
+    levelOverrides,
+  }) {
     if (model) {
       providerModule.validateModelId(model);
-      return { model, reasoningEffort };
+      return {
+        source: 'direct',
+        modelSpec: { model, reasoningEffort },
+      };
     }
 
-    const level = modelLevel || providerSettings.defaultLevel || providerModule.getDefaultLevel();
-    let resolvedModelSpec = providerModule.resolveModelSpec(level, levelOverrides);
-    if (reasoningEffort) {
-      resolvedModelSpec = { ...resolvedModelSpec, reasoningEffort };
+    if (explicitModelSpec?.model !== undefined) {
+      providerModule.validateModelId(explicitModelSpec.model);
+      return {
+        source: 'direct',
+        modelSpec: explicitModelSpec,
+      };
     }
 
-    return resolvedModelSpec;
+    return {
+      source: 'provider-level',
+      modelSpec: this._resolveProviderLevelModelSpec({
+        explicitModelSpec,
+        modelLevel,
+        reasoningEffort,
+        providerModule,
+        providerSettings,
+        levelOverrides,
+      }),
+    };
+  }
+
+  _resolveProviderLevelModelSpec({
+    explicitModelSpec,
+    modelLevel,
+    reasoningEffort,
+    providerModule,
+    providerSettings,
+    levelOverrides,
+  }) {
+    const level =
+      explicitModelSpec?.level ||
+      modelLevel ||
+      providerSettings.defaultLevel ||
+      providerModule.getDefaultLevel();
+    const resolvedModelSpec = providerModule.resolveModelSpec(level, levelOverrides);
+    const resolvedReasoningEffort = explicitModelSpec?.reasoningEffort || reasoningEffort;
+
+    return resolvedReasoningEffort
+      ? { ...resolvedModelSpec, reasoningEffort: resolvedReasoningEffort }
+      : resolvedModelSpec;
   }
 
   _resolveOutputFormat({ outputFormat, jsonSchema, strictSchema }) {
@@ -232,16 +295,16 @@ class ClaudeTaskRunner extends TaskRunner {
     return jsonSchema && outputFormat === 'json' && !strictSchema ? 'stream-json' : outputFormat;
   }
 
-  _buildRunArgs({ context, providerName, runOutputFormat, resolvedModelSpec, jsonSchema }) {
+  _buildRunArgs({
+    context,
+    providerName,
+    runOutputFormat,
+    resolvedModelSpec,
+    modelSpecSource = 'direct',
+    jsonSchema,
+  }) {
     const args = ['task', 'run', '--output-format', runOutputFormat, '--provider', providerName];
-
-    if (resolvedModelSpec?.model) {
-      args.push('--model', resolvedModelSpec.model);
-    }
-
-    if (resolvedModelSpec?.reasoningEffort) {
-      args.push('--reasoning-effort', resolvedModelSpec.reasoningEffort);
-    }
+    appendTaskRunModelArgs(args, resolvedModelSpec, modelSpecSource);
 
     // Pass schema to CLI only when using json output (strictSchema=true or no conflict)
     if (jsonSchema && runOutputFormat === 'json') {
@@ -542,20 +605,40 @@ class ClaudeTaskRunner extends TaskRunner {
   /**
    * Run task in isolated Docker container
    * @param {string} context
-   * @param {{agentId?: string, model?: string, outputFormat?: string, jsonSchema?: any, strictSchema?: boolean, isolation?: any}} options
+   * @param {{agentId?: string, provider?: string, model?: string, modelLevel?: string, modelSpec?: Object|null, reasoningEffort?: string, outputFormat?: string, jsonSchema?: any, strictSchema?: boolean, isolation?: any}} options
    * @returns {Promise<{success: boolean, output: string, error: string|null}>}
    */
   _runIsolated(context, options) {
+    rejectCallerSuppliedModelProvenance(options);
     const {
       agentId = 'unknown',
       provider = 'claude',
-      modelSpec = null,
+      model = null,
+      modelLevel = null,
+      modelSpec: explicitModelSpec = null,
+      reasoningEffort = null,
       outputFormat = 'stream-json',
       jsonSchema = null,
       strictSchema = false,
       isolation,
     } = options;
     const { manager, clusterId } = isolation;
+    const settings = loadSettings();
+    const { providerModule, providerSettings, levelOverrides } = this._getProviderContext(
+      provider,
+      settings
+    );
+    const modelSelection = this._resolveModelSelection({
+      explicitModelSpec,
+      model,
+      reasoningEffort,
+      modelLevel,
+      providerModule,
+      providerSettings,
+      levelOverrides,
+    });
+    const modelSpec = modelSelection.modelSpec;
+    const modelSpecSource = modelSelection.source;
 
     this._log(`📦 [${agentId}]: Running task in isolated container...`);
 
@@ -565,7 +648,7 @@ class ClaudeTaskRunner extends TaskRunner {
         ? 'stream-json'
         : desiredOutputFormat;
 
-    const command = [
+    let command = [
       'zeroshot',
       'task',
       'run',
@@ -575,13 +658,7 @@ class ClaudeTaskRunner extends TaskRunner {
       provider,
     ];
 
-    if (modelSpec?.model) {
-      command.push('--model', modelSpec.model);
-    }
-
-    if (modelSpec?.reasoningEffort) {
-      command.push('--reasoning-effort', modelSpec.reasoningEffort);
-    }
+    appendTaskRunModelArgs(command, modelSpec, modelSpecSource);
 
     if (jsonSchema && runOutputFormat === 'json') {
       command.push('--json-schema', JSON.stringify(jsonSchema));
@@ -597,16 +674,23 @@ class ClaudeTaskRunner extends TaskRunner {
     }
 
     command.push(finalContext);
+    command = wrapTaskRunWithIsolatedSettings(command, {
+      providerName: provider,
+      settings,
+      modelSpecSource,
+      modelSpec,
+    });
 
     return new Promise((resolve, reject) => {
       let output = '';
       let resolved = false;
 
       const proc = manager.spawnInContainer(clusterId, command, {
-        env:
-          provider === 'claude' && modelSpec?.model
+        env: {
+          ...(provider === 'claude' && modelSpec?.model
             ? { ANTHROPIC_MODEL: modelSpec.model, ZEROSHOT_BLOCK_ASK_USER: '1' }
-            : {},
+            : {}),
+        },
       });
 
       proc.stdout.on('data', (/** @type {Buffer} */ data) => {

package/src/config-validator.js

@@ -2053,8 +2053,8 @@ function validateProviderSettings(provider, providerSettings) {
         `Invalid model override (must be non-empty string) for provider "${provider}"`
       );
     }
-    if (override?.model) {
-      providerModule.validateModelId(override.model);
+    if (override?.model || (provider === 'opencode' && override?.model === '')) {
+      providerModule.resolveModelSpec(level, { [level]: override });
     }
     if (override?.reasoningEffort && !providerSupportsCapability(provider, 'reasoningEffort')) {
       throw new Error(

package/src/isolation-manager.js

@@ -727,7 +727,10 @@ class IsolationManager {
 
     args.push(containerId, ...command);
 
-    return spawn('docker', args, {
+    // spawn() throws on null bytes in argv; strip them before they get there.
+    const safeArgs = args.map((arg) => (typeof arg === 'string' ? arg.replace(/\0/g, '') : arg));
+
+    return spawn('docker', safeArgs, {
       stdio: ['pipe', 'pipe', 'pipe'],
       ...options.spawnOptions,
     });

package/src/providers/index.js

@@ -129,6 +129,11 @@ class RuntimeProvider extends BaseProvider {
     return this._adapter.validateModelId(modelId);
   }
 
+  validateConfiguredModelId(modelId) {
+    const validator = this._adapter.validateConfiguredModelId || this._adapter.validateModelId;
+    return validator(modelId);
+  }
+
   isRetryableError(err) {
     return helper.classifyProviderError(this.name, err).retryable;
   }