zcoder.zsh v0.8.0 — External workers and runtime hardening

zcoder.zsh v0.8.0

v0.8.0 adds explicitly authorized workspace-editing workers for external coding
harnesses, makes model tool execution and transport recovery more reliable, and
hardens Zsh file, terminal, temporary-storage, and shutdown boundaries.

Highlights

External coding workers

• /claude!, /codex!, /agy!, and /opencode! run one explicitly
  workspace-editing harness invocation, while the commands without ! remain
  read-only consultations.
• Each provider uses its native edit mode or sandbox. Worker prompts confine
  changes to the selected workspace and withhold unrelated authority such as
  installing, deploying, committing, pushing, or publishing.
• Worker reports use distinct transcript roles and enter Ollama context as
  untrusted reports. The main agent is told to inspect the current workspace
  instead of accepting a worker's claims as proof.
• Editing workers are disabled in the sysadmin profile because their internal
  commands cannot participate in zcoder's mandatory per-command approval flow.
• Local and remote availability discovery now identifies which harness CLIs
  exist on the host that owns the workspace. Protocol-1 remote peers remain
  compatible when they omit the new capability field.

More reliable model and tool execution

• Multiple emitted tool calls execute sequentially in model order, including
  edit-and-verify sequences. Every call retains its own argument validation,
  workspace boundary, safety guard, command approval, result, and error.
• finish remains exclusive turn control: mixing it with work rejects only the
  invalid completion call instead of discarding already completed work.
• The system prompt, tool schema, and rejection output now share one exact
  unified-diff contract with valid and invalid examples, numeric hunk guidance,
  and a focused retry path after malformed patches.
• Ollama payloads contain exactly one leading system record. Runtime recovery
  and external-harness context use template-safe user records, including when
  older saved sessions contain mid-conversation system entries.
• A transient connection failure before any Ollama response receives one
  bounded replay. Response timeouts remain non-retryable so a long generation
  is not silently restarted from scratch.

Native Zsh runtime hardening

• HTTP requests, remote responses, debug records, and workspace file writes now
  handle partial syswrite results until every byte is written or a real error
  occurs.
• Command output, patch data, asynchronous HTTP results, delegate exchanges,
  and MCP broker files share an atomically created process-private runtime
  directory with group and other access disabled.
• Workspace writes reject dangling symlinks and non-regular targets, then open
  the validated final path with nofollow. Debug logs likewise reject symlink
  targets, keep a private owned descriptor, and enforce owner-only permissions.
• Model, tool, and project text printed directly to a terminal renders control
  bytes visibly, preventing OSC, escape, carriage-return, and backspace data
  from altering approval or transcript displays. Redirected output remains
  exact for scripts.
• Signal traps now preserve conventional interrupt and termination statuses,
  prevent cleanup re-entry, close owned descriptors, reap workers, and remove
  private runtime storage once.

Compatibility and verification

• Zsh 5.8 or newer
• Ollama with a tool-capable model
• Existing session, MCP, authentication, and protocol-1 remote formats remain
  compatible
• 730 automated tests passing, including partial writes, private runtime
  permissions, terminal controls, dangling symlinks, debug-log confinement,
  external workers, remote capability discovery, multi-call execution, patch
  recovery, and transport replay
• CLI smoke checks for version, resolved project instructions, Agent Skills,
  and MCP registry listing

For the full documentation, see the documentation index.