headlesscode 1.2.1 → 1.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "headlesscode",
-	"version": "1.2.1",
+	"version": "1.2.2",
 	"description": "Standalone headless coding-agent harness: runs the Zoo Code agent loop (prompts, tools, modes) without a VS Code UI, driven by CLI, HTTP, and parallel worktree orchestration.",
 	"license": "Apache-2.0",
 	"repository": {
@@ -41,6 +41,7 @@
 		"dev": "tsx src/index.ts",
 		"start": "tsx src/cli.ts",
 		"cli": "tsx src/cli.ts",
+		"monitor:pilot": "tsx scripts/monitor-pilot/run.ts",
 		"test": "node scripts/run-tests.mjs",
 		"prepublishOnly": "npm ci && npm test"
 	},

package/shared/openshell/headlesscode-openrouter.yaml

@@ -0,0 +1,21 @@
+id: headlesscode-openrouter
+display_name: HeadlessCode OpenRouter
+description: OpenRouter inference access for HeadlessCode workers running in Node.js
+category: inference
+inference_capable: true
+credentials:
+  - name: api_key
+    description: OpenRouter API key
+    env_vars: [HEADLESSCODE_OPENROUTER_API_KEY]
+    required: true
+    auth_style: bearer
+    header_name: authorization
+discovery:
+  credentials: [api_key]
+endpoints:
+  - host: openrouter.ai
+    port: 443
+    protocol: rest
+    access: read-write
+    enforcement: enforce
+binaries: [/usr/local/bin/node]

package/shared/openshell/headlesscode-policy.yaml

@@ -0,0 +1,21 @@
+version: 1
+filesystem_policy:
+  include_workdir: true
+  read_only:
+    - /usr
+    - /lib
+    - /lib64
+    - /etc
+    - /proc
+    - /dev/urandom
+    - /var/log
+  read_write:
+    - /sandbox
+    - /tmp
+    - /dev/null
+landlock:
+  compatibility: hard_requirement
+process:
+  run_as_user: sandbox
+  run_as_group: sandbox
+network_policies: {}

package/src/cli.ts

@@ -44,6 +44,7 @@ import { costHistoryCliMain } from "./orchestrator/cost-history-cli.js"
 import { resolvePermissions, type PermissionsConfig } from "./permissions/config.js"
 import { resolveModelForMode, resolveReasoningEffortForMode } from "./config/mode-models.js"
 import { improveMain } from "./rsi/controller.js"
+import { openShellSessionMain } from "./cloud/openshell-session.js"
 
 const VERSION = "0.1.0"
 
@@ -187,6 +188,9 @@ Usage:
   headlesscode --dry-run [options]          # build system prompt + validate config, no LLM call
 
 Subcommands:
+  headlesscode openshell-session --repo <path> --task <text> --policy <path>
+              Run one task in an OpenShell sandbox and keep its Git worktree
+              for review. See \`openshell-session --help\` for options.
   headlesscode improve --repo <path> [--model <id>] [--population <n>] [--dry-run]
               Run a bounded recursive self-improvement generation. Candidates
               use isolated git worktrees; evaluator/scoring paths are protected.
@@ -721,6 +725,32 @@ export function parseArgs(argv: string[]): { options: CliOptions; error?: string
 }
 
 export async function main(argv: string[] = process.argv.slice(2)): Promise<number> {
+	if (argv[0] === "openshell-review-session" || argv[0] === "openshell-qa-session") {
+		let payload: Record<string, unknown>
+		try {
+			payload = JSON.parse(Buffer.from(argv[1] ?? "", "base64url").toString("utf8")) as Record<string, unknown>
+		} catch {
+			process.stderr.write("headlesscode: invalid OpenShell session payload\n")
+			return 2
+		}
+		if (argv[0] === "openshell-review-session") {
+			const { runReview } = await import("./orchestrator/reviewer.js")
+			const result = await runReview(payload as unknown as Parameters<typeof runReview>[0])
+			process.stdout.write(`HEADLESSCODE_RESULT_JSON:${JSON.stringify(result)}\n`)
+			return 0
+		}
+		const { runQa } = await import("./qa/qa.js")
+		const result = await runQa(payload as unknown as Parameters<typeof runQa>[0])
+		process.stdout.write(`HEADLESSCODE_RESULT_JSON:${JSON.stringify(result)}\n`)
+		return 0
+	}
+	if (argv[0] === "openshell-worker") {
+		const { openShellWorkerMain } = await import("./cloud/openshell-worker.js")
+		return openShellWorkerMain(argv.slice(1))
+	}
+	if (argv[0] === "openshell-session") {
+		return openShellSessionMain(argv.slice(1))
+	}
 	// Bounded recursive self-improvement: the supervisor owns the evaluator,
 	// archive, and selection logic while each candidate runs in its own
 	// worktree. See docs/recursive-self-improvement.md.

package/src/cloud/openshell-preflight.ts

@@ -0,0 +1,16 @@
+import { spawnSync } from "node:child_process"
+import * as fs from "node:fs"
+
+export function openshellPreflight(): string | undefined {
+	const policy = process.env.HEADLESSCODE_OPENSHELL_POLICY
+	if (!policy || !fs.existsSync(policy)) return "set HEADLESSCODE_OPENSHELL_POLICY to an existing base policy YAML"
+	if (!process.env.HEADLESSCODE_OPENROUTER_API_KEY) return "set HEADLESSCODE_OPENROUTER_API_KEY so OpenShell can provide the imported credential profile"
+	const version = spawnSync("openshell", ["--version"], { encoding: "utf8", timeout: 5000 })
+	if (version.error || version.status !== 0) return "OpenShell CLI is unavailable"
+	const gateway = spawnSync("openshell", ["gateway", "info"], { encoding: "utf8", timeout: 10000 })
+	const output = `${gateway.stdout ?? ""}${gateway.stderr ?? ""}`
+	if (gateway.error || gateway.status !== 0 || !/Status:\s+healthy/i.test(output)) {
+		return `OpenShell gateway is not healthy${output.trim() ? ": " + output.trim() : ""}`
+	}
+	return undefined
+}