omnilane 0.8.3 → 0.9.0

package/scripts/dispatch.sh

@@ -52,7 +52,7 @@ flags:
                          before any provider call or job state
   --mode advise|work     advise (read-only, default) or work (may edit files)
   --workdir DIR          working directory handed to the vendor CLI
-  --vendor V             pin one configured vendor (codex|claude|grok|gemini|kimi|qwen|opencode|openrouter)
+  --vendor V             pin one configured vendor (codex|claude|grok|gemini|kimi|qwen|opencode|openrouter|deepseek|zai|mistral|groq|cerebras)
   --model M              override the routed model
   --effort E             override the routed effort
   --timeout SECONDS      cap each CLI call (default 600)
@@ -363,7 +363,7 @@ validate_routing() {
           lane_invalid=1
           break
         fi
-        if ! [[ "$vendor" =~ ^(codex|claude|grok|gemini|kimi|qwen|opencode|openrouter|exec|off)$ ]]; then
+        if ! [[ "$vendor" =~ ^(${OMNILANE_VENDOR_ALT}|off)$ ]]; then
           printf 'FAIL %s unknown-vendor=%s\n' "$lane" "$vendor"
           lane_invalid=1
           break
@@ -489,8 +489,8 @@ TASK="$2"
 # A typo like --mode advice must not fall through to the write-enabled branch.
 [[ "$MODE" == "advise" || "$MODE" == "work" ]] || { echo "omnilane: invalid --mode (advise|work)" >&2; exit 2; }
 if [[ -n "$OVERRIDE_VENDOR" ]] &&
-   ! [[ "$OVERRIDE_VENDOR" =~ ^(codex|claude|grok|gemini|kimi|qwen|opencode|openrouter)$ ]]; then
-  echo "omnilane: invalid vendor (codex|claude|grok|gemini|kimi|qwen|opencode|openrouter)" >&2
+   ! [[ "$OVERRIDE_VENDOR" =~ ^(${OMNILANE_OVERRIDE_VENDOR_ALT})$ ]]; then
+  echo "omnilane: invalid vendor (${OMNILANE_OVERRIDE_VENDOR_ALT})" >&2
   exit 2
 fi
 

package/scripts/doctor.sh

@@ -140,6 +140,44 @@ else
   report FAIL watchdog "timeout, gtimeout, and perl are all unavailable"
 fi
 
+# Vendor CLI availability. Runners resolve each vendor's binary through a *_BIN
+# override (default name otherwise) and source local.sh, so probe the same way
+# in a subshell — set +u because a machine-local local.sh may reference its own
+# unset vars, and the subshell keeps any side effects out of this report.
+vendor_line="$(
+  set +u
+  [[ -f "$OMNILANE_HOME/local.sh" ]] && . "$OMNILANE_HOME/local.sh" 2>/dev/null
+  present=""; absent=""
+  for spec in "codex:${CODEX_BIN:-codex}" "claude:${CLAUDE_BIN:-claude}" \
+              "grok:${GROK_BIN:-grok}" "gemini:${AGY_BIN:-agy}" \
+              "kimi:${KIMI_BIN:-kimi}" "qwen:${QWEN_BIN:-qwen}" \
+              "opencode:${OPENCODE_BIN:-opencode}"; do
+    name="${spec%%:*}"; bin="${spec#*:}"
+    if command -v "$bin" >/dev/null 2>&1; then present="$present $name"; else absent="$absent $name"; fi
+  done
+  # Direct-API vendors (OpenAI-compatible, no CLI): reachable iff curl exists
+  # and the matching API key is set. Keep aligned with
+  # OMNILANE_DIRECT_API_VENDORS in lib/common.sh.
+  if command -v curl >/dev/null 2>&1; then
+    for spec in "openrouter:${OPENROUTER_API_KEY:-}" "deepseek:${DEEPSEEK_API_KEY:-}" \
+                "zai:${ZAI_API_KEY:-}" "mistral:${MISTRAL_API_KEY:-}" \
+                "groq:${GROQ_API_KEY:-}" "cerebras:${CEREBRAS_API_KEY:-}"; do
+      name="${spec%%:*}"; key="${spec#*:}"
+      if [[ -n "$key" ]]; then present="$present $name"; else absent="$absent $name"; fi
+    done
+  else
+    absent="$absent openrouter deepseek zai mistral groq cerebras"
+  fi
+  printf '%s|%s' "${present# }" "${absent# }"
+)"
+vendor_present="${vendor_line%%|*}"
+vendor_absent="${vendor_line#*|}"
+if [[ -n "$vendor_present" ]]; then
+  report PASS vendors "present: $vendor_present${vendor_absent:+; missing: $vendor_absent}"
+else
+  report WARN vendors "no vendor CLI reachable${vendor_absent:+ (missing: $vendor_absent)}; every lane degrades to off"
+fi
+
 if command -v python3 >/dev/null 2>&1; then
   if python3 -c 'import sys; raise SystemExit(0 if sys.version_info >= (3, 9) else 1)' \
       >/dev/null 2>&1; then

package/scripts/jobs.sh

@@ -48,7 +48,7 @@ die() {
   exit "$rc"
 }
 
-USAGE_TEXT="usage: jobs.sh [--json] list|status ID|result ID|tail ID [--lines N]|retry ID [--background]|stats [--last N]|wait ID [--timeout N]|audit [--last N]|prune [--keep N] [--older-than DAYS] [--apply]|help"
+USAGE_TEXT="usage: jobs.sh [--json] list [--lane L] [--vendor V] [--status running|done]|status ID|result ID|tail ID [--lines N]|retry ID [--background]|stats [--last N] [--lane L] [--vendor V]|wait ID [--timeout N]|cancel ID|rm ID|audit [--last N]|prune [--keep N] [--older-than DAYS] [--apply]|help"
 
 usage() {
   die 2 "$USAGE_TEXT"
@@ -132,7 +132,7 @@ read_job_pid() {
 
 parse_stats_metadata() {
   local value="$1"
-  local metadata_re='^\{"lane":"([a-z][a-z0-9-]*)","vendor":"(codex|claude|grok|gemini|kimi|qwen|opencode|openrouter|exec)"(,|})'
+  local metadata_re='^\{"lane":"([a-z][a-z0-9-]*)","vendor":"('"$OMNILANE_VENDOR_ALT"')"(,|})'
   STATS_LANE=""
   STATS_VENDOR=""
   [[ "$value" =~ $metadata_re ]] || return 1
@@ -143,7 +143,7 @@ parse_stats_metadata() {
 parse_audit_metadata() {
   local value="$1" metadata_re
   local json_string='([^"\\]|\\["\\/bfnrt]|\\u[0-9a-fA-F]{4})*'
-  metadata_re="^\\{\"lane\":\"[a-z][a-z0-9-]*\",\"vendor\":\"(codex|claude|grok|gemini|kimi|qwen|opencode|openrouter|exec)\",\"model\":\"${json_string}\",\"effort\":\"${json_string}\",\"timeout\":(0|[1-9][0-9]*),\"job_timeout\":(null|0|[1-9][0-9]*),\"mode\":\"(advise|work)\",\"workdir\":\"${json_string}\",\"candidate\":\"[1-9][0-9]*/[1-9][0-9]*\",\"started\":\"[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z\"\\}$"
+  metadata_re="^\\{\"lane\":\"[a-z][a-z0-9-]*\",\"vendor\":\"(${OMNILANE_VENDOR_ALT})\",\"model\":\"${json_string}\",\"effort\":\"${json_string}\",\"timeout\":(0|[1-9][0-9]*),\"job_timeout\":(null|0|[1-9][0-9]*),\"mode\":\"(advise|work)\",\"workdir\":\"${json_string}\",\"candidate\":\"[1-9][0-9]*/[1-9][0-9]*\",\"started\":\"[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z\"\\}$"
   [[ "$value" =~ $metadata_re ]]
 }
 
@@ -252,7 +252,7 @@ case "${1:-}" in
     read_public_metadata "$JOB_DIR/meta.json" || {
       die 1 "cannot retry: unreadable job metadata"
     }
-    retry_re='^\{"lane":"([a-z][a-z0-9-]*)","vendor":"(codex|claude|grok|gemini|kimi|qwen|opencode|openrouter|exec)","model":"([^"\\]*)","effort":"([^"\\]*)","timeout":([1-9][0-9]*),"job_timeout":([1-9][0-9]*|null),"mode":"(advise|work)","workdir":"([^"\\]*)",'
+    retry_re='^\{"lane":"([a-z][a-z0-9-]*)","vendor":"('"$OMNILANE_VENDOR_ALT"')","model":"([^"\\]*)","effort":"([^"\\]*)","timeout":([1-9][0-9]*),"job_timeout":([1-9][0-9]*|null),"mode":"(advise|work)","workdir":"([^"\\]*)",'
     [[ "$PUBLIC_METADATA" =~ $retry_re ]] || {
       die 1 "cannot retry: job metadata is not safely parseable"
     }
@@ -420,18 +420,27 @@ case "${1:-}" in
     [[ "$findings" -eq 0 ]] || exit 1 ;;
   stats)
     limit=100
+    filter_lane=""; filter_vendor=""
     shift
     while [[ $# -gt 0 ]]; do
       case "$1" in
         --last)
           [[ $# -ge 2 ]] || usage
           limit="$2"; shift 2 ;;
+        --lane)
+          [[ $# -ge 2 ]] || usage
+          filter_lane="$2"; shift 2 ;;
+        --vendor)
+          [[ $# -ge 2 ]] || usage
+          filter_vendor="$2"; shift 2 ;;
         *) usage ;;
       esac
     done
     [[ "$limit" =~ ^[1-9][0-9]{0,3}$ && "$limit" -le 10000 ]] || {
       die 2 "invalid --last value (want 1..10000)"
     }
+    [[ -z "$filter_lane" || "$filter_lane" =~ ^[a-z][a-z0-9-]*$ ]] || die 2 "invalid --lane value"
+    [[ -z "$filter_vendor" ]] || omnilane_known_vendor "$filter_vendor" || die 2 "invalid --vendor value"
     sampled=0
     succeeded=0
     failed=0
@@ -451,8 +460,21 @@ case "${1:-}" in
     fi
     if [[ ${#ids[@]} -gt 0 ]]; then
       while IFS= read -r id; do
-        sampled=$((sampled + 1))
         job_dir="$JOBS/$id"
+        # Resolve lane/vendor first so a --lane/--vendor filter can exclude a job
+        # before it counts toward any aggregate.
+        meta_ok=0
+        metadata_path="$job_dir/meta.json"
+        if read_public_metadata "$metadata_path" &&
+           parse_stats_metadata "$PUBLIC_METADATA"; then
+          meta_ok=1
+        fi
+        if [[ -n "$filter_lane" || -n "$filter_vendor" ]]; then
+          [[ "$meta_ok" -eq 1 ]] || continue
+          [[ -z "$filter_lane" || "$filter_lane" == "$STATS_LANE" ]] || continue
+          [[ -z "$filter_vendor" || "$filter_vendor" == "$STATS_VENDOR" ]] || continue
+        fi
+        sampled=$((sampled + 1))
         exit_path="$job_dir/exit"
         if [[ -e "$exit_path" || -L "$exit_path" ]]; then
           if read_exit_code "$exit_path"; then
@@ -467,9 +489,7 @@ case "${1:-}" in
         else
           running=$((running + 1))
         fi
-        metadata_path="$job_dir/meta.json"
-        if read_public_metadata "$metadata_path" &&
-           parse_stats_metadata "$PUBLIC_METADATA"; then
+        if [[ "$meta_ok" -eq 1 ]]; then
           lanes+=("$STATS_LANE")
           vendors+=("$STATS_VENDOR")
         else
@@ -501,7 +521,22 @@ case "${1:-}" in
       fi
     fi ;;
   list)
-    [[ $# -eq 1 ]] || usage
+    filter_lane=""; filter_vendor=""; filter_status=""
+    shift
+    while [[ $# -gt 0 ]]; do
+      case "$1" in
+        --lane)   [[ $# -ge 2 ]] || usage; filter_lane="$2"; shift 2 ;;
+        --vendor) [[ $# -ge 2 ]] || usage; filter_vendor="$2"; shift 2 ;;
+        --status) [[ $# -ge 2 ]] || usage; filter_status="$2"; shift 2 ;;
+        *) usage ;;
+      esac
+    done
+    [[ -z "$filter_lane" || "$filter_lane" =~ ^[a-z][a-z0-9-]*$ ]] || die 2 "invalid --lane value"
+    [[ -z "$filter_vendor" ]] || omnilane_known_vendor "$filter_vendor" || die 2 "invalid --vendor value"
+    case "$filter_status" in
+      ""|running|done) ;;
+      *) die 2 "invalid --status value (want running or done)" ;;
+    esac
     if [[ ! -d "$JOBS" ]]; then
       [[ "$JSON_MODE" -eq 0 ]] || printf '{"schema_version":1,"command":"list","ok":true,"jobs":[]}\n'
       exit 0
@@ -519,6 +554,7 @@ case "${1:-}" in
     fi
     [[ "$JSON_MODE" -eq 0 ]] || printf '{"schema_version":1,"command":"list","ok":true,"jobs":['
     json_first=1
+    shown=0
     while IFS= read -r id; do
       state="running"
       exit_json="null"
@@ -555,6 +591,21 @@ case "${1:-}" in
       elif [[ -e "$metadata_path" || -L "$metadata_path" ]]; then
         metadata_status="invalid"
       fi
+      if [[ -n "$filter_status" ]]; then
+        case "$json_state" in
+          done) [[ "$filter_status" == "done" ]] || continue ;;
+          running) [[ "$filter_status" == "running" ]] || continue ;;
+          *) continue ;;
+        esac
+      fi
+      if [[ -n "$filter_lane" || -n "$filter_vendor" ]]; then
+        if [[ "$metadata_status" == "valid" ]] && parse_stats_metadata "$metadata"; then
+          [[ -z "$filter_lane" || "$filter_lane" == "$STATS_LANE" ]] || continue
+          [[ -z "$filter_vendor" || "$filter_vendor" == "$STATS_VENDOR" ]] || continue
+        else
+          continue
+        fi
+      fi
       if [[ "$JSON_MODE" -eq 1 ]]; then
         [[ "$json_first" -eq 1 ]] || printf ','
         json_first=0
@@ -563,7 +614,9 @@ case "${1:-}" in
       else
         printf '%s  %s  %s\n' "$id" "$state" "$metadata"
       fi
-    done < <(printf '%s\n' "${ids[@]}" | LC_ALL=C sort -r | sed -n '1,20p')
+      shown=$((shown + 1))
+      if [[ "$shown" -ge 20 ]]; then break; fi
+    done < <(printf '%s\n' "${ids[@]}" | LC_ALL=C sort -r)
     [[ "$JSON_MODE" -eq 0 ]] || printf ']}\n' ;;
   status)
     [[ $# -eq 2 ]] || usage
@@ -672,6 +725,75 @@ case "${1:-}" in
       fi
       sleep 1
     done ;;
+  cancel)
+    [[ "$JSON_MODE" -eq 0 && $# -eq 2 ]] || usage
+    select_job "$2"
+    exit_path="$JOB_DIR/exit"
+    if [[ -e "$exit_path" || -L "$exit_path" ]]; then
+      if read_exit_code "$exit_path"; then
+        echo "already finished (exit $RECORDED_EXIT)"
+      else
+        echo "already finished (invalid exit metadata)"
+      fi
+      exit 0
+    fi
+    pid=""; pid_state="missing"
+    if [[ -e "$JOB_DIR/pid" || -L "$JOB_DIR/pid" ]]; then
+      if read_job_pid "$JOB_DIR/pid"; then pid="$RECORDED_PID"; pid_state="valid"; else pid_state="invalid"; fi
+    fi
+    if [[ "$pid_state" != "valid" ]] || ! kill -0 "$pid" 2>/dev/null; then
+      echo "not running (no live worker to cancel)"
+      exit 0
+    fi
+    # Background workers run as their own process-group leader (dispatch `set -m`),
+    # and that leader traps SIGTERM to record a best-effort exit code. Signal the
+    # whole group so the vendor CLI child dies too and the worker writes its exit.
+    cancel_grp="$pid"
+    cancel_pgid="$(ps -o pgid= -p "$pid" 2>/dev/null | tr -d '[:space:]' || true)"
+    [[ "$cancel_pgid" =~ ^[1-9][0-9]*$ ]] && cancel_grp="$cancel_pgid"
+    kill -TERM "-$cancel_grp" 2>/dev/null || kill -TERM "$pid" 2>/dev/null || true
+    cancel_waited=0
+    while [[ "$cancel_waited" -lt 5 ]]; do
+      if [[ -e "$exit_path" || -L "$exit_path" ]]; then break; fi
+      if ! kill -0 "$pid" 2>/dev/null; then break; fi
+      sleep 1; cancel_waited=$((cancel_waited + 1))
+    done
+    if kill -0 "$pid" 2>/dev/null; then
+      # The TERM trap did not fire in time; SIGKILL cannot be trapped, so no exit
+      # gets recorded — force the group down and record the terminal state below.
+      kill -KILL "-$cancel_grp" 2>/dev/null || kill -KILL "$pid" 2>/dev/null || true
+      sleep 1
+    fi
+    if [[ -e "$exit_path" || -L "$exit_path" ]]; then
+      if read_exit_code "$exit_path"; then
+        echo "cancelled (exit $RECORDED_EXIT)"
+      else
+        echo "cancelled (invalid exit metadata)"
+      fi
+    elif kill -0 "$pid" 2>/dev/null; then
+      die 1 "cancel could not terminate worker pid $pid"
+    else
+      (umask 077; printf '137\n' > "$exit_path")
+      echo "cancelled (exit 137)"
+    fi
+    exit 0 ;;
+  rm)
+    [[ "$JSON_MODE" -eq 0 && $# -eq 2 ]] || usage
+    select_job "$2"
+    exit_path="$JOB_DIR/exit"
+    # Refuse to delete a job whose worker is still alive: removing the directory
+    # out from under a running worker would strand it writing into a deleted path.
+    # A recorded exit (finished) or a dead pid (crashed worker) is safe to remove.
+    if [[ ! -e "$exit_path" && ! -L "$exit_path" ]]; then
+      if [[ -e "$JOB_DIR/pid" || -L "$JOB_DIR/pid" ]] &&
+         read_job_pid "$JOB_DIR/pid" && kill -0 "$RECORDED_PID" 2>/dev/null; then
+        die 1 "job is running (pid $RECORDED_PID); cancel it first"
+      fi
+    fi
+    # select_job already proved $JOB_DIR is a real child dir, never a symlink.
+    /bin/rm -rf "$JOB_DIR"
+    echo "removed $2"
+    exit 0 ;;
   result)
     [[ $# -eq 2 ]] || usage
     select_job "$2"

package/scripts/lib/common.sh

@@ -64,6 +64,57 @@ write_current_pid_file() {
   mv "$tmp" "$path"
 }
 
+# ---- Vendor registry (single source of truth) ---------------------------
+# Two vendor kinds. CLI-agent vendors run a local binary (see vendor_bin).
+# Direct-API vendors are OpenAI-compatible /chat/completions endpoints driven
+# by run-openai-compat.sh (curl + an API key, no CLI). To add an
+# OpenAI-compatible vendor: add its name to OMNILANE_DIRECT_API_VENDORS, add a
+# vendor_api_spec row, add a runners/run-<name>.sh wrapper, and a model row in
+# configure.sh. Every validation site derives from these lists.
+OMNILANE_CLI_VENDORS="codex claude grok gemini kimi qwen opencode"
+OMNILANE_DIRECT_API_VENDORS="openrouter deepseek zai mistral groq cerebras"
+
+# Pipe-joined vendor alternations for =~ checks and JSON metadata regexes.
+# _OVERRIDE covers what --vendor may pin (no exec/off); _ALT adds the "exec"
+# bring-your-own gate. Built from the lists above — the single source of truth.
+OMNILANE_OVERRIDE_VENDOR_ALT=""
+for _omnilane_v in $OMNILANE_CLI_VENDORS $OMNILANE_DIRECT_API_VENDORS; do
+  OMNILANE_OVERRIDE_VENDOR_ALT="${OMNILANE_OVERRIDE_VENDOR_ALT:+$OMNILANE_OVERRIDE_VENDOR_ALT|}$_omnilane_v"
+done
+unset _omnilane_v
+# shellcheck disable=SC2034  # consumed by jobs.sh/dispatch.sh which source this file
+OMNILANE_VENDOR_ALT="$OMNILANE_OVERRIDE_VENDOR_ALT|exec"
+
+# Direct-API vendor -> "BASE_URL_DEFAULT|KEY_ENV|MODEL_HINT". Base URL is
+# overridable per vendor via <VENDOR>_BASE_URL (e.g. DEEPSEEK_BASE_URL).
+vendor_api_spec() {
+  case "$1" in
+    openrouter) echo "https://openrouter.ai/api/v1|OPENROUTER_API_KEY|anthropic/claude-sonnet-4" ;;
+    deepseek)   echo "https://api.deepseek.com|DEEPSEEK_API_KEY|deepseek-chat" ;;
+    zai)        echo "https://api.z.ai/api/openai/v1|ZAI_API_KEY|glm-4.6" ;;
+    mistral)    echo "https://api.mistral.ai/v1|MISTRAL_API_KEY|devstral-latest" ;;
+    groq)       echo "https://api.groq.com/openai/v1|GROQ_API_KEY|qwen/qwen3.6-27b" ;;
+    cerebras)   echo "https://api.cerebras.ai/v1|CEREBRAS_API_KEY|qwen-3-32b" ;;
+    *)          echo "" ;;
+  esac
+}
+
+vendor_is_direct_api() { # 0 if vendor is an OpenAI-compatible direct-API vendor
+  local _v
+  # Exact token match — a substring `case` would accept adjacent-pair strings
+  # like "openrouter deepseek".
+  for _v in $OMNILANE_DIRECT_API_VENDORS; do [[ "$1" == "$_v" ]] && return 0; done
+  return 1
+}
+
+omnilane_known_vendor() { # 0 if vendor is dispatchable (CLI, direct-API, or exec)
+  local _v
+  for _v in $OMNILANE_CLI_VENDORS $OMNILANE_DIRECT_API_VENDORS exec; do
+    [[ "$1" == "$_v" ]] && return 0
+  done
+  return 1
+}
+
 vendor_bin() { # vendor -> binary (honors local.sh overrides)
   case "$1" in
     codex)  echo "${CODEX_BIN:-codex}" ;;
@@ -82,9 +133,12 @@ vendor_available() {
   # checked at dispatch time (the chain resolver cannot see it here).
   # "vote" is the built-in multi-model panel: needs >=2 voters, checked at dispatch.
   [[ "$1" == "exec" || "$1" == "vote" ]] && return 0
-  # "openrouter" is direct-API (no CLI): available iff curl and a key exist.
-  if [[ "$1" == "openrouter" ]]; then
-    command -v curl >/dev/null 2>&1 && [[ -n "${OPENROUTER_API_KEY:-}" ]]
+  # Direct-API vendors have no CLI: available iff curl and their API key exist.
+  if vendor_is_direct_api "$1"; then
+    local spec key_env
+    spec="$(vendor_api_spec "$1")"
+    key_env="${spec#*|}"; key_env="${key_env%%|*}"
+    command -v curl >/dev/null 2>&1 && [[ -n "${!key_env:-}" ]]
     return
   fi
   local b; b="$(vendor_bin "$1")"

package/scripts/runners/run-cerebras.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# omnilane runner: Cerebras (OpenAI-compatible direct API). Thin wrapper over
+# run-openai-compat.sh; endpoint and default model live in vendor_api_spec.
+# Override the endpoint with CEREBRAS_BASE_URL; needs CEREBRAS_API_KEY.
+export OMNILANE_OAI_VENDOR=cerebras
+exec "$(dirname "${BASH_SOURCE[0]}")/run-openai-compat.sh" "$@"

package/scripts/runners/run-deepseek.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# omnilane runner: DeepSeek (OpenAI-compatible direct API). Thin wrapper over
+# run-openai-compat.sh; endpoint and default model live in vendor_api_spec.
+# Override the endpoint with DEEPSEEK_BASE_URL; needs DEEPSEEK_API_KEY.
+export OMNILANE_OAI_VENDOR=deepseek
+exec "$(dirname "${BASH_SOURCE[0]}")/run-openai-compat.sh" "$@"

package/scripts/runners/run-groq.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# omnilane runner: Groq (OpenAI-compatible direct API). Thin wrapper over
+# run-openai-compat.sh; endpoint and default model live in vendor_api_spec.
+# Override the endpoint with GROQ_BASE_URL; needs GROQ_API_KEY.
+export OMNILANE_OAI_VENDOR=groq
+exec "$(dirname "${BASH_SOURCE[0]}")/run-openai-compat.sh" "$@"

package/scripts/runners/run-mistral.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# omnilane runner: Mistral (OpenAI-compatible direct API). Thin wrapper over
+# run-openai-compat.sh; endpoint and default model live in vendor_api_spec.
+# Override the endpoint with MISTRAL_BASE_URL; needs MISTRAL_API_KEY.
+export OMNILANE_OAI_VENDOR=mistral
+exec "$(dirname "${BASH_SOURCE[0]}")/run-openai-compat.sh" "$@"

package/scripts/runners/run-openai-compat.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# omnilane runner: any OpenAI-compatible /chat/completions endpoint.
+#
+# Usage: run-openai-compat.sh MODE WORKDIR MODEL EFFORT PROMPT_FILE OUTPUT_FILE
+#   Driven by run-<vendor>.sh wrappers that export OMNILANE_OAI_VENDOR. Like the
+#   openrouter runner this is pure inference over HTTPS — no agentic loop, so
+#   work mode is a hard error, not a silent read-only downgrade.
+#
+# Base URL, API-key env var, and a model hint come from vendor_api_spec. The
+# base URL is overridable per vendor via <VENDOR>_BASE_URL. EFFORT is accepted
+# for interface parity only. Needs curl and the vendor's API key; python3
+# builds/parses the JSON so prompt content never needs shell escaping.
+
+source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh"
+
+MODE="$1"; WORKDIR="$2"; MODEL="$3"; EFFORT="$4"; PROMPT_FILE="$5"; OUTPUT_FILE="$6"
+: "$WORKDIR" "$EFFORT" # parity with the uniform runner interface
+
+fail() { echo "omnilane: $1" > "${OUTPUT_FILE}.stderr.log"; exit 2; }
+
+VENDOR="${OMNILANE_OAI_VENDOR:?run-openai-compat.sh must be invoked via a run-<vendor>.sh wrapper}"
+SPEC="$(vendor_api_spec "$VENDOR")"
+[[ -n "$SPEC" ]] || fail "unknown OpenAI-compatible vendor '$VENDOR'"
+BASE_DEFAULT="${SPEC%%|*}"
+MODEL_HINT="${SPEC##*|}"
+KEY_ENV="${SPEC#*|}"; KEY_ENV="${KEY_ENV%%|*}"
+
+VENDOR_UPPER="$(printf '%s' "$VENDOR" | tr '[:lower:]' '[:upper:]')"
+BASE_OVERRIDE_VAR="${VENDOR_UPPER}_BASE_URL"
+BASE_URL="${!BASE_OVERRIDE_VAR:-$BASE_DEFAULT}"
+API_KEY="${!KEY_ENV:-}"
+RUN_TIMEOUT="${OMNILANE_TIMEOUT:-600}"
+
+[[ "$MODE" == "advise" ]] || fail "$VENDOR is inference-only: use --mode advise (work mode needs an agentic CLI vendor like opencode)"
+[[ -n "$API_KEY" ]] || fail "$KEY_ENV is not set"
+[[ -n "$MODEL" && "$MODEL" != "-" ]] || fail "$VENDOR needs an explicit model slug (e.g. $MODEL_HINT)"
+command -v curl >/dev/null 2>&1 || fail "curl not found"
+command -v python3 >/dev/null 2>&1 || fail "python3 not found"
+
+truncate_payload "$PROMPT_FILE" 140000
+
+REQUEST_FILE="${OUTPUT_FILE}.request.json"
+RESPONSE_FILE="${OUTPUT_FILE}.response.json"
+# Keep the API key out of the process argument list (ps-visible): curl reads the
+# Authorization header from a 0600 file, not a -H command-line flag.
+HEADER_FILE="${OUTPUT_FILE}.headers"
+cleanup() { rm "$REQUEST_FILE" "$RESPONSE_FILE" "$HEADER_FILE" 2>/dev/null || true; }
+trap cleanup EXIT
+( umask 077; printf 'Authorization: Bearer %s\n' "$API_KEY" > "$HEADER_FILE" )
+
+python3 - "$MODEL" "$PROMPT_FILE" > "$REQUEST_FILE" <<'PY'
+import json, sys
+model, prompt_file = sys.argv[1], sys.argv[2]
+with open(prompt_file, encoding="utf-8", errors="replace") as f:
+    prompt = f.read()
+json.dump({"model": model, "messages": [{"role": "user", "content": prompt}]},
+          sys.stdout)
+PY
+
+set +e
+run_with_timeout "$RUN_TIMEOUT" curl -sS --fail-with-body \
+  --max-time "$RUN_TIMEOUT" \
+  -H "@$HEADER_FILE" \
+  -H "Content-Type: application/json" \
+  -X POST "$BASE_URL/chat/completions" \
+  --data-binary "@$REQUEST_FILE" \
+  > "$RESPONSE_FILE" 2> "${OUTPUT_FILE}.stderr.log"
+RC=$?
+set -e
+
+if [[ "$RC" -ne 0 ]]; then
+  # Surface the API error body (never the key) alongside curl's own stderr.
+  [[ -s "$RESPONSE_FILE" ]] && cat "$RESPONSE_FILE" >> "${OUTPUT_FILE}.stderr.log"
+  exit "$RC"
+fi
+
+set +e
+python3 - "$VENDOR" "$RESPONSE_FILE" > "${OUTPUT_FILE}.tmp" 2>> "${OUTPUT_FILE}.stderr.log" <<'PY'
+import json, sys
+vendor = sys.argv[1]
+with open(sys.argv[2], encoding="utf-8", errors="replace") as f:
+    data = json.load(f)
+if "error" in data:
+    print(f"omnilane: {vendor} API error: {data['error']}", file=sys.stderr)
+    sys.exit(1)
+content = data["choices"][0]["message"]["content"]
+sys.stdout.write(content if isinstance(content, str) else json.dumps(content))
+PY
+RC=$?
+set -e
+
+# Empty output is a failure, not a silent rc=0 success.
+if ! grep -q '[^[:space:]]' "${OUTPUT_FILE}.tmp" 2>/dev/null; then
+  echo "omnilane: $VENDOR produced no output" >> "${OUTPUT_FILE}.stderr.log"
+  if [[ "$RC" -eq 0 ]]; then RC=1; fi
+fi
+
+[[ -f "${OUTPUT_FILE}.tmp" ]] && mv "${OUTPUT_FILE}.tmp" "$OUTPUT_FILE"
+[[ -s "${OUTPUT_FILE}.stderr.log" ]] || rm "${OUTPUT_FILE}.stderr.log" 2>/dev/null || true
+exit "$RC"

package/scripts/runners/run-openrouter.sh

@@ -1,86 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
-
-# omnilane runner: OpenRouter direct API (no CLI dependency)
-#
-# Usage: run-openrouter.sh MODE WORKDIR MODEL EFFORT PROMPT_FILE OUTPUT_FILE
-#   MODE = advise only. This vendor is pure inference over HTTPS — it has no
-#   agentic loop and cannot edit files, so work mode is a hard error rather
-#   than a silent read-only downgrade.
-#
-# MODEL is an OpenRouter model slug (e.g. anthropic/claude-sonnet-4). EFFORT
-# is accepted for interface parity only. Needs OPENROUTER_API_KEY and curl;
-# python3 builds/parses the JSON so prompt content never needs shell escaping.
-
-source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh"
-
-MODE="$1"; WORKDIR="$2"; MODEL="$3"; EFFORT="$4"; PROMPT_FILE="$5"; OUTPUT_FILE="$6"
-: "$WORKDIR" "$EFFORT" # parity with the uniform runner interface
-
-OPENROUTER_BASE_URL="${OPENROUTER_BASE_URL:-https://openrouter.ai/api/v1}"
-RUN_TIMEOUT="${OMNILANE_TIMEOUT:-600}"
-
-fail() { echo "omnilane: $1" > "${OUTPUT_FILE}.stderr.log"; exit 2; }
-
-[[ "$MODE" == "advise" ]] || fail "openrouter is inference-only: use --mode advise (work mode needs an agentic CLI vendor like opencode)"
-[[ -n "${OPENROUTER_API_KEY:-}" ]] || fail "OPENROUTER_API_KEY is not set"
-[[ -n "$MODEL" && "$MODEL" != "-" ]] || fail "openrouter needs an explicit model slug (e.g. anthropic/claude-sonnet-4)"
-command -v curl >/dev/null 2>&1 || fail "curl not found"
-command -v python3 >/dev/null 2>&1 || fail "python3 not found"
-
-truncate_payload "$PROMPT_FILE" 140000
-
-REQUEST_FILE="${OUTPUT_FILE}.request.json"
-RESPONSE_FILE="${OUTPUT_FILE}.response.json"
-cleanup() { rm "$REQUEST_FILE" "$RESPONSE_FILE" 2>/dev/null || true; }
-trap cleanup EXIT
-
-python3 - "$MODEL" "$PROMPT_FILE" > "$REQUEST_FILE" <<'PY'
-import json, sys
-model, prompt_file = sys.argv[1], sys.argv[2]
-with open(prompt_file, encoding="utf-8", errors="replace") as f:
-    prompt = f.read()
-json.dump({"model": model, "messages": [{"role": "user", "content": prompt}]},
-          sys.stdout)
-PY
-
-set +e
-run_with_timeout "$RUN_TIMEOUT" curl -sS --fail-with-body \
-  --max-time "$RUN_TIMEOUT" \
-  -H "Authorization: Bearer $OPENROUTER_API_KEY" \
-  -H "Content-Type: application/json" \
-  -X POST "$OPENROUTER_BASE_URL/chat/completions" \
-  --data-binary "@$REQUEST_FILE" \
-  > "$RESPONSE_FILE" 2> "${OUTPUT_FILE}.stderr.log"
-RC=$?
-set -e
-
-if [[ "$RC" -ne 0 ]]; then
-  # Surface the API error body (never the key) alongside curl's own stderr.
-  [[ -s "$RESPONSE_FILE" ]] && cat "$RESPONSE_FILE" >> "${OUTPUT_FILE}.stderr.log"
-  exit "$RC"
-fi
-
-set +e
-python3 - "$RESPONSE_FILE" > "${OUTPUT_FILE}.tmp" 2>> "${OUTPUT_FILE}.stderr.log" <<'PY'
-import json, sys
-with open(sys.argv[1], encoding="utf-8", errors="replace") as f:
-    data = json.load(f)
-if "error" in data:
-    print(f"omnilane: openrouter API error: {data['error']}", file=sys.stderr)
-    sys.exit(1)
-content = data["choices"][0]["message"]["content"]
-sys.stdout.write(content if isinstance(content, str) else json.dumps(content))
-PY
-RC=$?
-set -e
-
-# Empty output is a failure, not a silent rc=0 success.
-if ! grep -q '[^[:space:]]' "${OUTPUT_FILE}.tmp" 2>/dev/null; then
-  echo "omnilane: openrouter produced no output" >> "${OUTPUT_FILE}.stderr.log"
-  [[ "$RC" -eq 0 ]] && RC=1
-fi
-
-[[ -f "${OUTPUT_FILE}.tmp" ]] && mv "${OUTPUT_FILE}.tmp" "$OUTPUT_FILE"
-[[ -s "${OUTPUT_FILE}.stderr.log" ]] || rm "${OUTPUT_FILE}.stderr.log" 2>/dev/null || true
-exit "$RC"
+# omnilane runner: OpenRouter (OpenAI-compatible direct API). Thin wrapper over
+# run-openai-compat.sh; endpoint and default model live in vendor_api_spec.
+# Override the endpoint with OPENROUTER_BASE_URL; needs OPENROUTER_API_KEY.
+export OMNILANE_OAI_VENDOR=openrouter
+exec "$(dirname "${BASH_SOURCE[0]}")/run-openai-compat.sh" "$@"

package/scripts/runners/run-zai.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# omnilane runner: Z.ai GLM (OpenAI-compatible direct API). Thin wrapper over
+# run-openai-compat.sh; endpoint and default model live in vendor_api_spec.
+# Override the endpoint with ZAI_BASE_URL; needs ZAI_API_KEY.
+export OMNILANE_OAI_VENDOR=zai
+exec "$(dirname "${BASH_SOURCE[0]}")/run-openai-compat.sh" "$@"