headlesscode 1.2.0 → 1.2.2

package/src/orchestrator/cli.ts

@@ -68,6 +68,7 @@ import {
 	TRIVIAL_DRIFT_AHEAD,
 } from "./git-sync.js"
 import { resolveModelForMode } from "../config/mode-models.js"
+import { openshellPreflight } from "../cloud/openshell-preflight.js"
 import { runPreflight, runLocalPreflight, type PreflightResult, type LocalPreflightResult } from "../llm/preflight.js"
 import { resolvePerModeEnv } from "../cli.js"
 
@@ -110,6 +111,7 @@ Options:
   --poll-interval-ms <n> Watcher poll interval (default: 5000)
   --memory-dir <path>    Phase 3 memory dir for workers (passed as HEADLESSCODE_MEMORY_DIR,
                          which run-worker.sh forwards as --memory-dir to each worker CLI)
+  --execution-provider <local|openshell> Worker runtime (default: local)
   --max-concurrent-sessions <n>  Phase 6 GLOBAL cap on concurrent sessions across
                          processes (default: $HEADLESSCODE_MAX_CONCURRENT_SESSIONS or 3).
                          When the cap is already reached this run ABORTS with a clear
@@ -195,6 +197,7 @@ Environment:
 interface OrchestrateOptions {
 	repo: string
 	issues: number[]
+	executionProvider: "local" | "openshell"
 	issuesJson?: string
 	/**
 	 * Fix 3: file a REAL GitHub issue for every synthetic --issues-json entry
@@ -301,6 +304,7 @@ export function parseOrchestrateArgs(argv: string[]): { options: OrchestrateOpti
 	const options: OrchestrateOptions = {
 		repo: "",
 		issues: [],
+		executionProvider: process.env.HEADLESSCODE_EXECUTION_PROVIDER === "openshell" ? "openshell" : "local",
 		mode: process.env.ORCHESTRATOR_MODE ?? "code",
 		reviewMode: "deepseek-reviewer",
 		review: true,
@@ -341,6 +345,12 @@ export function parseOrchestrateArgs(argv: string[]): { options: OrchestrateOpti
 		}
 
 		switch (flag) {
+			case "--execution-provider": {
+				const v = next()
+				if (v !== "local" && v !== "openshell") return { options, error: "--execution-provider must be local or openshell" }
+				options.executionProvider = v
+				break
+			}
 			case "--repo": {
 				const v = next()
 				if (v === undefined) {
@@ -1614,6 +1624,7 @@ export interface BuildSpawnEnvOptions {
 	repo: string
 	/** Harness mode for the workers (e.g. "code"). */
 	mode: string
+	executionProvider?: "local" | "openshell"
 	/** An explicit --model flag value, if the caller passed one — always wins (resolveModelForMode rule 1). */
 	explicitModel?: string
 	memoryDir?: string
@@ -1649,6 +1660,7 @@ export function buildSpawnEnv(options: BuildSpawnEnvOptions): { env: NodeJS.Proc
 		...(options.env ?? process.env),
 		TARGET_REPO: options.repo,
 		ORCHESTRATOR_MODE: options.mode,
+		HEADLESSCODE_EXECUTION_PROVIDER: options.executionProvider ?? process.env.HEADLESSCODE_EXECUTION_PROVIDER ?? "local",
 		// The resolved worker model must reach the spawner (and the workers it
 		// launches) — same pattern as HEADLESSCODE_PROJECT below.
 		...(workerModel ? { OPENROUTER_MODEL: workerModel } : {}),
@@ -2545,6 +2557,14 @@ export async function orchestrateMain(argv: string[]): Promise<number> {
 		process.stderr.write(`headlesscode orchestrate: not a git repo: ${repo}\n`)
 		return 2
 	}
+	if (!options.dryRun && options.executionProvider === "openshell") {
+		const issue = openshellPreflight()
+		if (issue) {
+			process.stderr.write(`headlesscode orchestrate: OpenShell preflight failed: ${issue}\n`)
+			return 2
+		}
+	}
+	process.env.HEADLESSCODE_EXECUTION_PROVIDER = options.executionProvider
 
 	let issues: SplitIssue[]
 	try {
@@ -2852,6 +2872,7 @@ export async function orchestrateMain(argv: string[]): Promise<number> {
 	const { env: spawnEnv, workerModel } = buildSpawnEnv({
 		repo,
 		mode: options.mode,
+		executionProvider: options.executionProvider,
 		explicitModel: options.model,
 		memoryDir: options.memoryDir,
 		maxIterations: options.maxIterations,
@@ -3032,6 +3053,7 @@ export async function orchestrateMain(argv: string[]): Promise<number> {
 						cwd: repo,
 						env: {
 							...process.env,
+							HEADLESSCODE_EXECUTION_PROVIDER: options.executionProvider,
 							HEADLESSCODE_ROOT: HARNESS_ROOT_TS,
 							...(options.memoryDir ? { HEADLESSCODE_MEMORY_DIR: path.resolve(options.memoryDir) } : {}),
 						},
@@ -3221,6 +3243,7 @@ export async function orchestrateMain(argv: string[]): Promise<number> {
 							cwd: repo,
 							env: {
 								...process.env,
+								HEADLESSCODE_EXECUTION_PROVIDER: options.executionProvider,
 								HEADLESSCODE_ROOT: HARNESS_ROOT_TS,
 								...(options.memoryDir ? { HEADLESSCODE_MEMORY_DIR: path.resolve(options.memoryDir) } : {}),
 							},
@@ -3376,6 +3399,7 @@ export async function orchestrateMain(argv: string[]): Promise<number> {
 							cwd: repo,
 							env: {
 								...process.env,
+								HEADLESSCODE_EXECUTION_PROVIDER: options.executionProvider,
 								HEADLESSCODE_ROOT: HARNESS_ROOT_TS,
 								...(options.memoryDir ? { HEADLESSCODE_MEMORY_DIR: path.resolve(options.memoryDir) } : {}),
 							},

package/src/orchestrator/reviewer.ts

@@ -36,6 +36,7 @@ import { getNativeTools } from "../vendor/zoo-code/src/core/prompts/tools/native
 import { addCustomInstructions } from "../vendor/zoo-code/src/core/prompts/sections/custom-instructions.js"
 import type { ChatTool, LlmClient, SessionResult } from "../engine/types.js"
 import type { SessionBudget } from "../budget/budget.js"
+import { runOpenShellSubsession } from "../cloud/openshell-subsession.js"
 
 /** Default location of the reviewer checklist, relative to the harness repo. */
 export const DEFAULT_REVIEW_PROMPT_PATH = "shared/prompts/review-mode-prompt.md"
@@ -210,6 +211,16 @@ export async function runReview(options: ReviewOptions): Promise<ReviewResult> {
 		maxIterations = 200,
 		budget,
 	} = options
+	if (process.env.HEADLESSCODE_EXECUTION_PROVIDER === "openshell" && !llmClient) {
+		try {
+			return await runOpenShellSubsession<ReviewResult>("review", workspaceRoot, {
+				workspaceRoot, mode, model, reviewPromptPath, taskText, issues, maxIterations, budget,
+			})
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error)
+			return { findings: [`[review session error] ${message}`], verdict: "error", summary: `Review session failed: ${message}` }
+		}
+	}
 
 	// 2026-08-27: verified live — a review session couldn't find the `curlee`
 	// compiler at all ("curlee runtime is not available in this environment"),

package/src/project-store.ts

@@ -95,11 +95,22 @@ export interface ProjectMetadata {
  */
 export function resolveProjectIdentity(workspaceRoot: string): ProjectIdentity {
 	const root = path.resolve(workspaceRoot)
+	// OpenShell runs an independent Git clone so its writable workspace does not
+	// expose host repository metadata. Preserve the original project's store key
+	// without mounting or reading the original repository path in the sandbox.
+	const identityRoot = process.env.HEADLESSCODE_PROJECT_IDENTITY_ROOT?.trim()
+	if (identityRoot && path.isAbsolute(identityRoot)) return { keySource: path.resolve(identityRoot), kind: "git" }
+	// Sandboxed workers may set these to a private Git directory so ordinary
+	// commits cannot touch shared host metadata. Project identity must still
+	// resolve through the workspace's real .git pointer and shared common dir.
+	const gitEnv = { ...process.env }
+	for (const key of ["GIT_DIR", "GIT_COMMON_DIR", "GIT_WORK_TREE", "GIT_NAMESPACE", "GIT_OBJECT_DIRECTORY", "GIT_ALTERNATE_OBJECT_DIRECTORIES", "GIT_INDEX_FILE"]) delete gitEnv[key]
 	// 1. Git repo → `--git-common-dir` (worktree-aware: resolves to the main
 	//    repo's .git from inside a worktree), parent = identity source.
 	try {
 		const out = execFileSync("git", ["rev-parse", "--git-common-dir"], {
 			cwd: root,
+			env: gitEnv,
 			encoding: "utf-8",
 			timeout: 10_000,
 			stdio: ["ignore", "pipe", "ignore"],

package/src/qa/qa.ts

@@ -49,6 +49,7 @@ import { addCustomInstructions } from "../vendor/zoo-code/src/core/prompts/secti
 import type { ChatTool, LlmClient, SessionResult } from "../engine/types.js"
 import type { MemoryStore } from "../memory/types.js"
 import type { SessionBudget } from "../budget/budget.js"
+import { runOpenShellSubsession } from "../cloud/openshell-subsession.js"
 
 /** Default mode slug used for QA sessions (the qa-agent mode). */
 export const DEFAULT_QA_MODE = "qa-agent"
@@ -246,6 +247,17 @@ export async function runQa(options: RunQaOptions): Promise<QaResult> {
 		memory = null,
 		project,
 	} = options
+	if (process.env.HEADLESSCODE_EXECUTION_PROVIDER === "openshell" && !llmClient) {
+		try {
+			return await runOpenShellSubsession<QaResult>("qa", workspaceRoot, {
+				workspaceRoot, mode, model, baseUrl, maxIterations, budget, project,
+				...(options.taskText ? { taskText: options.taskText } : {}),
+			})
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error)
+			return { verdict: "error", evidence: "", summary: `QA session failed: ${message}` }
+		}
+	}
 
 	// Detect whether the target repo actually defines the requested mode. If
 	// not, fall back to the generic checklist as a system prompt override.

package/src/watcher/cli.ts

@@ -32,6 +32,7 @@ import * as path from "node:path"
 
 import { Logger } from "../engine/logger.js"
 import { watchIssues, type SweepResult } from "./watch.js"
+import { openshellPreflight } from "../cloud/openshell-preflight.js"
 
 const WATCH_USAGE = `headlesscode watch — Phase 5 GitHub issue watcher
 
@@ -61,6 +62,7 @@ Options:
                          <repo>/.worktrees/.watcher-state.json)
   --mode <slug>          Harness mode for workers (default: code; forwarded
                          to the spawner as ORCHESTRATOR_MODE)
+  --execution-provider <local|openshell> Worker runtime (default: local)
   --qa                   Pass-through: record that a QA round should follow
                          each batch (see docs/phase5-issue-watcher.md)
   --deploy               Pass-through: record that a deploy gate should follow
@@ -92,6 +94,7 @@ export interface WatchCliOptions {
 	maxConcurrentSessions: number
 	stateFile?: string
 	mode: string
+	executionProvider: "local" | "openshell"
 	qa: boolean
 	deploy: boolean
 	memoryDir?: string
@@ -110,6 +113,7 @@ export function parseWatchArgs(argv: string[]): { options: WatchCliOptions; erro
 		maxPerSweep: 5,
 		maxConcurrentSessions: 3,
 		mode: "code",
+		executionProvider: process.env.HEADLESSCODE_EXECUTION_PROVIDER === "openshell" ? "openshell" : "local",
 		qa: false,
 		deploy: false,
 		dryRun: false,
@@ -135,6 +139,12 @@ export function parseWatchArgs(argv: string[]): { options: WatchCliOptions; erro
 		}
 
 		switch (flag) {
+			case "--execution-provider": {
+				const v = next()
+				if (v !== "local" && v !== "openshell") return { options, error: "--execution-provider must be local or openshell" }
+				options.executionProvider = v
+				break
+			}
 			case "--owner": {
 				const v = next()
 				if (v === undefined) {
@@ -300,6 +310,13 @@ export async function watchMain(argv: string[]): Promise<number> {
 			return 2
 		}
 	}
+	if (!options.dryRun && options.executionProvider === "openshell") {
+		const issue = openshellPreflight()
+		if (issue) {
+			process.stderr.write(`headlesscode watch: OpenShell preflight failed: ${issue}\n`)
+			return 2
+		}
+	}
 
 	const ghRepo = options.ghRepo ?? path.basename(repoRoot)
 	const logger = new Logger({ level: "info" })
@@ -328,6 +345,7 @@ export async function watchMain(argv: string[]): Promise<number> {
 			retryFailed: options.retryFailed,
 			dryRun: options.dryRun,
 			mode: options.mode,
+			executionProvider: options.executionProvider,
 			memoryDir: options.memoryDir,
 			qa: options.qa,
 			deploy: options.deploy,

package/src/watcher/watch.ts

@@ -129,6 +129,7 @@ export interface WatcherConfig {
 	spawn?: (batch: SpawnBatch) => SpawnResult | Promise<SpawnResult>
 	/** Harness mode for workers (forwarded to the spawner as ORCHESTRATOR_MODE). */
 	mode?: string
+	executionProvider?: "local" | "openshell"
 	/** Memory dir for workers (forwarded to the spawner as HEADLESSCODE_MEMORY_DIR). */
 	memoryDir?: string
 	/** Phase 4 pass-through: recorded on the batch entry (see docs). */
@@ -480,7 +481,7 @@ function batchId(): string {
  * with cwd = the target repo so `git rev-parse --show-toplevel` resolves).
  * No worktree creation happens in TS; the bash script remains the spawner.
  */
-export function defaultSpawn(batch: SpawnBatch, config: Pick<WatcherConfig, "mode" | "memoryDir">): SpawnResult {
+export function defaultSpawn(batch: SpawnBatch, config: Pick<WatcherConfig, "mode" | "memoryDir" | "executionProvider">): SpawnResult {
 	const issues: SplitIssue[] = [
 		{ number: batch.issue.number, title: batch.issue.title, body: batch.issue.body },
 	]
@@ -511,6 +512,7 @@ export function defaultSpawn(batch: SpawnBatch, config: Pick<WatcherConfig, "mod
 			...process.env,
 			TARGET_REPO: batch.repoRoot,
 			ORCHESTRATOR_MODE: config.mode ?? "code",
+			HEADLESSCODE_EXECUTION_PROVIDER: config.executionProvider ?? process.env.HEADLESSCODE_EXECUTION_PROVIDER ?? "local",
 			HEADLESSCODE_PROJECT: path.basename(batch.repoRoot),
 			...(config.memoryDir ? { HEADLESSCODE_MEMORY_DIR: path.resolve(config.memoryDir) } : {}),
 		},