pantheon-opencode 1.0.0

package/scripts/paths.py

@@ -0,0 +1,64 @@
+"""
+Pantheon XDG Path Utilities — XDG Base Directory compliant path resolution.
+
+Usage:
+    from paths import xdg_config_home, opencode_plans_dir
+
+Per the XDG Base Directory spec (XDG_CONFIG_HOME, XDG_DATA_HOME, XDG_STATE_HOME, XDG_CACHE_HOME).
+All fallback to their spec defaults when the env var is unset.
+"""
+
+import os
+from pathlib import Path
+
+
+def _from_env(var: str, default: str) -> Path:
+    value = os.environ.get(var)
+    if value is None or not value.strip():
+        value = default
+    return Path(os.path.expanduser(value.strip()))
+
+
+def xdg_config_home() -> Path:
+    """~/.config/ or $XDG_CONFIG_HOME"""
+    return _from_env("XDG_CONFIG_HOME", "~/.config")
+
+
+def xdg_data_home() -> Path:
+    """~/.local/share/ or $XDG_DATA_HOME"""
+    return _from_env("XDG_DATA_HOME", "~/.local/share")
+
+
+def xdg_state_home() -> Path:
+    """~/.local/state/ or $XDG_STATE_HOME"""
+    return _from_env("XDG_STATE_HOME", "~/.local/state")
+
+
+def xdg_cache_home() -> Path:
+    """~/.cache/ or $XDG_CACHE_HOME"""
+    return _from_env("XDG_CACHE_HOME", "~/.cache")
+
+
+def opencode_config_dir() -> Path:
+    """$XDG_CONFIG_HOME/opencode"""
+    return xdg_config_home() / "opencode"
+
+
+def opencode_plans_dir() -> Path:
+    """$XDG_CONFIG_HOME/opencode/platform/plans"""
+    return opencode_config_dir() / "platform" / "plans"
+
+
+def opencode_data_dir() -> Path:
+    """$XDG_DATA_HOME/opencode"""
+    return xdg_data_home() / "opencode"
+
+
+def opencode_sync_repo_dir() -> Path:
+    """$XDG_DATA_HOME/opencode/opencode-synced/repo"""
+    return opencode_data_dir() / "opencode-synced" / "repo"
+
+
+def pantheon_log_dir() -> Path:
+    """$XDG_STATE_HOME/pantheon/logs"""
+    return xdg_state_home() / "pantheon" / "logs"

package/scripts/prune_context.py

@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+"""prune_context.py — Tool Output Pruning (Level 2 Compression v2).
+Flags obsolete tool outputs in conversation history for pruning.
+Usage: python3 scripts/prune_context.py [--dry-run] [--turns=5]
+"""
+
+import argparse
+
+HIGH_AGE_TURNS = 10
+MID_AGE_TURNS = 5
+HIGH_LINES = 100
+MID_LINES = 50
+PRUNE_THRESHOLD = 0.5
+LOW_RELEVANCE_TYPES = ("read", "grep", "glob")
+HIGH_RELEVANCE_TYPES = ("test", "build")
+
+
+def score_output(lines: int, age_turns: int, output_type: str) -> float:
+    """Return relevance score 0.0-1.0. Lower = better to prune."""
+    score = 1.0
+    if age_turns > HIGH_AGE_TURNS:
+        score -= 0.3
+    elif age_turns > MID_AGE_TURNS:
+        score -= 0.15
+    if lines > HIGH_LINES:
+        score -= 0.2
+    elif lines > MID_LINES:
+        score -= 0.1
+    if output_type in LOW_RELEVANCE_TYPES:
+        score -= 0.1
+    if output_type in HIGH_RELEVANCE_TYPES:
+        score += 0.1
+    return max(0.0, min(1.0, score))
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--dry-run", action="store_true")
+    parser.add_argument("--turns", type=int, default=5, help="Min age in turns")
+    args = parser.parse_args()
+
+    candidates = [
+        {"file": "src/main.py", "lines": 120, "age": 7, "type": "read"},
+        {"file": "tests/test_auth.py", "lines": 45, "age": 3, "type": "test"},
+        {"file": "package.json", "lines": 60, "age": 12, "type": "read"},
+    ]
+
+    print(f"🔍 Context Pruning Scan (age threshold: {args.turns}+ turns)")
+    print("━" * 50)
+    prunable = []
+    for c in candidates:
+        s = score_output(c["lines"], c["age"], c["type"])
+        status = "🗑️ PRUNE" if s < PRUNE_THRESHOLD else "✅ KEEP"
+        if s < PRUNE_THRESHOLD:
+            prunable.append(c)
+        print(
+            f"  {status} | score: {s:.2f} | {c['file']} ({c['lines']}L, {c['age']}turns, {c['type']})"
+        )
+
+    print("━" * 50)
+    if args.dry_run:
+        print(
+            f"🔍 DRY RUN: {len(prunable)} candidates to prune (estimated ~{sum(c['lines'] for c in prunable)} lines)"
+        )
+    else:
+        print(
+            f"✅ {len(prunable)} outputs pruned (freed ~{sum(c['lines'] for c in prunable)} lines)"
+        )
+
+
+if __name__ == "__main__":
+    main()

package/scripts/release-bundle.mjs

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+
+/**
+ * release-bundle.mjs — Creates the distribution tar.gz for a Pantheon release.
+ *
+ * Packages all user-relevant files into pantheon-vX.Y.Z.tar.gz.
+ * Excludes build tooling (scripts/, .github/, node_modules/).
+ *
+ * Usage:
+ *   node scripts/release-bundle.mjs                      # reads version from package.json
+ *   node scripts/release-bundle.mjs --output ./dist      # custom output dir
+ *   node scripts/release-bundle.mjs --version 3.5.0     # explicit version
+ */
+
+import { execSync } from 'node:child_process'
+import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const ROOT = join(__dirname, '..')
+
+// ── Parse args ────────────────────────────────────────────────────────────────
+const args = process.argv.slice(2)
+function arg(flag) {
+  const i = args.indexOf(flag)
+  return i !== -1 ? args[i + 1] : null
+}
+
+const outputDir = arg('--output') ?? join(ROOT, 'dist')
+const version =
+  arg('--version') ?? JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf-8')).version
+
+const bundleName = `pantheon-v${version}`
+const stagingDir = join(ROOT, 'dist', `.staging-${bundleName}`)
+const outputTar = join(outputDir, `${bundleName}.tar.gz`)
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+function copy(src, dest) {
+  const srcPath = join(ROOT, src)
+  if (!existsSync(srcPath)) {
+    console.log(`  ⏭  skipped  ${src}  (not found)`)
+    return
+  }
+  const destPath = join(stagingDir, bundleName, dest ?? src)
+  mkdirSync(dirname(destPath), { recursive: true })
+  cpSync(srcPath, destPath, { recursive: true })
+  console.log(`  ✓  ${src}`)
+}
+
+// ── Stage files ───────────────────────────────────────────────────────────────
+console.log(`\nBuilding bundle: ${bundleName}`)
+
+if (existsSync(stagingDir)) rmSync(stagingDir, { recursive: true, force: true })
+mkdirSync(join(stagingDir, bundleName), { recursive: true })
+
+// Root documents
+copy('README.md')
+copy('AGENTS.md')
+copy('CHANGELOG.md')
+copy('CONTRIBUTING.md')
+copy('LICENSE')
+
+// Config
+copy('opencode.json')
+copy('plugin.json')
+
+// Shell helper
+copy('sync-opencode.sh')
+
+// Install script exposed at root (not nested under scripts/)
+copy('scripts/install.mjs', 'install.mjs')
+
+// Agent definitions
+copy('agents')
+copy('skills')
+copy('prompts')
+copy('platform')
+copy('instructions')
+copy('docs')
+copy('images')
+
+// Platform MCP configs
+copy('.vscode')
+copy('.cursor')
+copy('.claude')
+copy('platform/mcp/mcp-template.json')
+
+// ── Write a minimal package.json so install.mjs can resolve it ────────────────
+const minPkg = {
+  name: 'pantheon',
+  version,
+  description: 'Multi-agent orchestration platform for AI coding assistants',
+  type: 'module',
+}
+writeFileSync(join(stagingDir, bundleName, 'package.json'), `${JSON.stringify(minPkg, null, 2)}\n`)
+
+// ── Create tar.gz ─────────────────────────────────────────────────────────────
+if (!existsSync(outputDir)) mkdirSync(outputDir, { recursive: true })
+
+execSync(`tar czf "${outputTar}" -C "${stagingDir}" "${bundleName}"`, { stdio: 'inherit' })
+
+// ── Cleanup staging ───────────────────────────────────────────────────────────
+rmSync(stagingDir, { recursive: true, force: true })
+
+// ── Report ────────────────────────────────────────────────────────────────────
+const { size } = { size: execSync(`wc -c < "${outputTar}"`).toString().trim() }
+const kb = Math.round(Number(size) / 1024)
+console.log(`\n✅  ${outputTar}  (${kb} KB)`)

package/scripts/scrub-secrets.py

@@ -0,0 +1,282 @@
+# Auto-generated: resolved symlink from scrub_secrets.py
+#!/usr/bin/env python3
+"""
+scrub-secrets.py — Credential scrubber for Memory Bank promotions.
+
+Scrubs credentials, tokens, and secrets from text before promoting it
+to permanent memory bank files. Uses Python 3.9+ stdlib only.
+
+Usage:
+    python3 scripts/scrub-secrets.py --file path/to/file
+        # scrub in-place (with .bak backup)
+    python3 scripts/scrub-secrets.py --stdin
+        # read stdin, write scrubbed to stdout
+    python3 scripts/scrub-secrets.py --audit path/to/file
+        # only report, don't modify
+"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import re
+import sys
+from re import Match
+
+# ---------------------------------------------------------------------------
+# Pattern definitions — order matters (private keys first to catch multi-line)
+# ---------------------------------------------------------------------------
+
+
+def _make_redactor(pattern: str, replacement: str) -> tuple[re.Pattern, str]:
+    """Compile a pattern with DOTALL for multi-line."""
+    return (re.compile(pattern, re.DOTALL), replacement)
+
+
+REDACTORS: list[tuple[re.Pattern, str]] = [
+    # SSH private keys (multi-line, before generic private key)
+    _make_redactor(
+        r"-----BEGIN\s+OPENSSH\s+PRIVATE\s+KEY-----"
+        r".*?-----END\s+OPENSSH\s+PRIVATE\s+KEY-----",
+        "[SSH PRIVATE KEY REDACTED]",
+    ),
+    # Private keys (multi-line, must run before Bearer/JWT)
+    _make_redactor(
+        r"-----BEGIN\s+.*?PRIVATE\s+KEY-----"
+        r".*?-----END\s+.*?PRIVATE\s+KEY-----",
+        "[PRIVATE KEY REDACTED]",
+    ),
+    # Certificates (multi-line)
+    _make_redactor(
+        r"-----BEGIN\s+CERTIFICATE-----"
+        r".*?-----END\s+CERTIFICATE-----",
+        "[CERTIFICATE REDACTED]",
+    ),
+    # Bearer tokens
+    _make_redactor(
+        r"Bearer\s+[A-Za-z0-9\-._~+/]+=*",
+        "Bearer [REDACTED]",
+    ),
+    # JWTs
+    _make_redactor(
+        r"eyJ[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+",
+        "[JWT REDACTED]",
+    ),
+    # GitHub PATs
+    _make_redactor(
+        r"ghp_[A-Za-z0-9]{36}",
+        "[GITHUB TOKEN REDACTED]",
+    ),
+    # OpenAI keys
+    _make_redactor(
+        r"sk-[A-Za-z0-9\-_]{10,}",
+        "[OPENAI KEY REDACTED]",
+    ),
+    # API keys (api_key, api-key, apikey)
+    _make_redactor(
+        r"(api[_-]?key|apikey)\s*[=:]\s*['\"]?[A-Za-z0-9\-_]{8,}",
+        r"\1=[REDACTED]",
+    ),
+    # Passwords / tokens / secrets
+    _make_redactor(
+        r"(token|secret|password)\s*[=:]\s*['\"]?[A-Za-z0-9\-_]{8,}",
+        r"\1=[REDACTED]",
+    ),
+    # AWS Access Keys
+    _make_redactor(
+        r"AKIA[0-9A-Z]{16}",
+        "[AWS KEY REDACTED]",
+    ),
+    # Google API Keys
+    _make_redactor(
+        r"AIza[0-9A-Za-z\-_]{35}",
+        "[GOOGLE API KEY REDACTED]",
+    ),
+    # Slack tokens
+    _make_redactor(
+        r"xox[baprs]-[0-9a-zA-Z-]{20,}",
+        "[SLACK TOKEN REDACTED]",
+    ),
+    # Heroku API Keys (UUID format)
+    _make_redactor(
+        r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",
+        "[HEROKU API KEY REDACTED]",
+    ),
+    # Database connection strings (non-greedy to prevent over-matching)
+    _make_redactor(
+        r"postgresql\+?:\/\/.*?:.*?@",
+        "[POSTGRESQL CONNECTION REDACTED]",
+    ),
+    _make_redactor(
+        r"mysql\+?:\/\/.*?:.*?@",
+        "[MYSQL CONNECTION REDACTED]",
+    ),
+    _make_redactor(
+        r"redis\+?:\/\/.*?:.*?@",
+        "[REDIS CONNECTION REDACTED]",
+    ),
+    # .env export statements
+    _make_redactor(
+        r"export\s+\w+=['\"]?\S+",
+        "[ENV EXPORT REDACTED]",
+    ),
+]
+
+# Classification dispatch: prefix → label
+_CLASSIFIERS: list[tuple[str, str]] = [
+    ("-----BEGIN OPENSSH", "ssh_private_key"),
+    ("-----BEGIN CERTIFICATE", "certificate"),
+    ("-----BEGIN", "private_key"),
+    ("Bearer ", "bearer_token"),
+    ("eyJ", "jwt"),
+    ("ghp_", "github_pat"),
+    ("sk-", "openai_key"),
+    ("xox", "slack_token"),
+    ("AKIA", "aws_key"),
+    ("AIza", "google_api_key"),
+    ("postgresql://", "postgresql_conn"),
+    ("mysql://", "mysql_conn"),
+    ("redis://", "redis_conn"),
+    ("export ", "env_export"),
+]
+
+
+def _classify_match(matched: str) -> str:
+    """Return a human-readable label for a matched secret."""
+    for prefix, label in _CLASSIFIERS:
+        if matched.startswith(prefix):
+            return label
+    if re.match(r"api[_-]?key|apikey", matched, re.IGNORECASE):
+        return "api_key"
+    if re.match(r"(token|secret|password)\s*=", matched, re.IGNORECASE):
+        return "credential"
+    if re.match(
+        r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",
+        matched,
+    ):
+        return "heroku_uuid"
+    return "unknown_secret"
+
+
+def scrub(content: str) -> tuple[str, list[dict]]:
+    """Scrub secrets from *content*.
+
+    Returns (scrubbed_content, redactions) where each redaction dict has:
+        type        — human-readable label for the matched secret
+        position    — (start, end) tuple of character offsets in original
+        replacement — what the secret was replaced with
+
+    Each redactor runs independently so every match in the input is
+    captured exactly once.  Overlapping matches across *different* patterns
+    are possible but extremely unlikely given the pattern design.
+    """
+    redactions: list[dict] = []
+    scrubbed = content
+
+    for pattern, replacement in REDACTORS:
+        # Walk matches in reverse offset order so replacements don't shift
+        # positions of yet-unreplaced matches.
+        matches: list[Match] = list(pattern.finditer(scrubbed))
+        for m in reversed(matches):
+            start, end = m.start(), m.end()
+            matched_text = m.group(0)
+            resolved = m.expand(replacement) if "\\" in replacement else replacement
+
+            redactions.append(
+                {
+                    "type": _classify_match(matched_text),
+                    "position": (start, end),
+                    "replacement": resolved,
+                }
+            )
+            scrubbed = scrubbed[:start] + resolved + scrubbed[end:]
+
+    # Restore original order (positional, ascending)
+    redactions.reverse()
+    return scrubbed, redactions
+
+
+# ---------------------------------------------------------------------------
+# CLI
+# ---------------------------------------------------------------------------
+
+
+def _audit(path: str) -> None:
+    """Print what would be redacted without modifying the file."""
+    with open(path, encoding="utf-8") as fh:
+        content = fh.read()
+    _, redactions = scrub(content)
+    if not redactions:
+        print(f"[OK] {path}: no secrets found")
+        return
+    print(f"[SCAN] {path}: {len(redactions)} potential secret(s) found:")
+    for r in redactions:
+        print(f"   [{r['type']}] at {r['position']} -> {r['replacement']}")
+
+
+def _scrub_file(path: str) -> None:
+    """Scrub file in-place, creating a .bak backup."""
+    with open(path, encoding="utf-8") as fh:
+        content = fh.read()
+    scrubbed, redactions = scrub(content)
+    if not redactions:
+        print(f"[OK] {path}: no secrets found, file unchanged")
+        return
+    # Write backup
+    bak = path + ".bak"
+    if not os.path.exists(bak):
+        os.rename(path, bak)
+    else:
+        print(f"[WARN] {bak} already exists, skipping backup")
+    with open(path, "w", encoding="utf-8") as fh:
+        fh.write(scrubbed)
+    print(
+        f"[SECURE] {path}: {len(redactions)} secret(s) redacted "
+        f"({' + '.join(r['type'] for r in redactions)})"
+    )
+    print(f"   Backup: {bak}")
+
+
+def _scrub_stdin() -> None:
+    """Read stdin, write scrubbed output to stdout."""
+    content = sys.stdin.read()
+    scrubbed, redactions = scrub(content)
+    for r in redactions:
+        print(f"  [REDACTED {r['type']}]", file=sys.stderr)
+    sys.stdout.write(scrubbed)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        description="Scrub secrets from text before promoting to "
+        "permanent memory bank files.",
+    )
+    group = parser.add_mutually_exclusive_group(required=True)
+    group.add_argument(
+        "--file",
+        type=str,
+        help="Scrub file in-place (with .bak backup)",
+    )
+    group.add_argument(
+        "--stdin",
+        action="store_true",
+        help="Read stdin, write scrubbed to stdout",
+    )
+    group.add_argument(
+        "--audit",
+        type=str,
+        help="Only report what would be redacted",
+    )
+
+    args = parser.parse_args()
+
+    if args.file:
+        _scrub_file(args.file)
+    elif args.stdin:
+        _scrub_stdin()
+    elif args.audit:
+        _audit(args.audit)
+
+
+if __name__ == "__main__":
+    main()