Zeroshot v13.1.0

Changes since v13.0.0.

Features

Export retained hosted workspaces (#1481)

Add authenticated retained-workspace and checkpoint downloads for hosted
targets advertising export. Stream into private tar files and publish
without replacement only after complete transfer, cleaning up on failure
or cancellation.

Fixes

Stop on definitive forge branch-protection or permission push refusals (#1475)

When GitHub or GitLab definitively refuses the run-branch push because
of branch protection or missing push permission, Git delivery now ends
with a policy refusal (refusal / policy_denied) instead of
repair_required. Before this change, each such rejection sent
software-change back through the worker and both reviewers, even
though no agent change could alter the outcome. The refusal diagnostic
starts with an actionable line, then names the managed run branch and
includes the forge's bounded, credential-redacted message. Local work is
kept, so the run can be resumed once the forge policy or the delivery
credential allows the push.

Related: #1380. This
PR covers only the server-rejection classification. The issue's prompt
additions for delivery-enabled software-change are tracked separately.

Reserve remote publication for delivery (#1479)

Always tell the built-in software-change worker that delivery owns
remote publication: do not push branches or weaken forge restrictions.
Both reviewers reject repairs that do either, in every delivery mode,
including none.

This changes prompt text and its documented convention only. Together
with #1475, it completes #1380.

Closes #1380

Retain verifier evidence and map indices (#1478)

Retain bounded, redacted verifier evidence, exact completed loop counts,
and nested map indices across failed-run observations while preserving
primary causes and terminal freeze.

Report unavailable permission inspection in run logs (#1480)

Before each local Claude or Codex turn, Zeroshot inspects the CLI's
permission settings. Only a verified unset policy gets the automatic
bypass (--dangerously-skip-permissions /
--dangerously-bypass-approvals-and-sandbox). When inspection failed,
the turn fell back to native permissions, and only a timeout left any
trace, as a debug-level line. The other failures left nothing: the CLI
could not start, exited early, broke the exchange, returned a native or
JSON-RPC error, or sent a malformed, incomplete or oversized answer.
Unattended runs then lost their write access with no explanation in
zeroshot logs.

Now every one of these paths, including the timeout, writes one
error-level line to the node's run logs and retained output history. The
line names the harness and gives a bounded, redacted cause, for example:

Could not inspect Claude permission settings: the inspection process ended before answering; provider process exited with status 1; stderr: error: unknown option '--safe-mode'. Continuing without Zeroshot's automatic permission bypass; Claude's native permission behavior applies.

This change only adds diagnostics. Which permissions a turn gets, the
sixty-second / 4 MiB inspection budget, the required cleanup before the
model turn, cancellation, and node outcomes all stay the same. A turn
that succeeds under native permissions still succeeds.

Normalize generated merge request metadata (#1482)

Normalize generated GitLab descriptions and titles inside the adapter.
Slash-leading prose stays literal; titles become nonempty, nondraft and
bounded to 255 Unicode characters. Canonical metadata preserves original
titles once, surrounding human text, publication invariants and existing
API diagnostics.

Assessed Greptile feedback for PR #1482: no corrections were requested
or warranted. No new tracked changes were needed; integrated upstream
changes remain intact.

Upgrade

npm install -g @the-open-engine-company/zeroshot@13.1.0

Versions 10.4.0 through 10.8.0 cannot update themselves: zeroshot update fails with release archive contains unexpected entry restic (restic.exe on Windows). Upgrade those installations once with the npm command above.