pantheon-opencode 1.2.0 → 1.2.1

package/scripts/install/model-picker.mjs

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+/**
+ * model-picker.mjs — interactive model preset selection + persistence
+ *
+ * Used by the installer (interactive prompt) and the `pantheon-opencode`
+ * CLI. Writes the active preset marker to <presetDir>/.pantheon/active-preset.json
+ * which the plugin (src/plugin.ts) reads on startup via resolveActivePreset().
+ */
+import { copyFileSync, existsSync, mkdirSync, renameSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { createInterface } from 'node:readline/promises'
+import { loadPresetDefs } from '../../src/pantheon/presets.mjs'
+
+/**
+ * Build the active-preset.json payload (version 1).
+ *
+ * @param {string} presetName
+ * @param {string} [source] 'cli' | 'interactive'
+ * @returns {{version: number, preset: string, source: string, updated_at: string}}
+ */
+export function buildActivePresetFile(presetName, source = 'cli') {
+  return {
+    version: 1,
+    preset: presetName,
+    source,
+    updated_at: new Date().toISOString(),
+  }
+}
+
+/**
+ * Persist the active preset marker, backing up any previous file to .bak.
+ *
+ * @param {string} presetDir install target (project root or global opencode dir)
+ * @param {string} presetName
+ * @param {{dryRun?: boolean, source?: string, logger?: object}} [opts]
+ * @returns {{written: boolean, path: string, backupPath: string|null}}
+ */
+export function writeActivePreset(
+  presetDir,
+  presetName,
+  { dryRun = false, source = 'cli', logger = console } = {},
+) {
+  const dir = join(presetDir, '.pantheon')
+  const filePath = join(dir, 'active-preset.json')
+  const backupPath = join(dir, 'active-preset.json.bak')
+
+  if (dryRun) {
+    logger.log?.(`[dry-run] Would write model preset "${presetName}" to ${filePath}`)
+    return { written: false, path: filePath, backupPath: null }
+  }
+
+  mkdirSync(dir, { recursive: true })
+  let backupMade = false
+  if (existsSync(filePath)) {
+    copyFileSync(filePath, backupPath)
+    backupMade = true
+  }
+  writeFileSync(`${filePath}.tmp-${process.pid}`, `${JSON.stringify(buildActivePresetFile(presetName, source), null, 2)}\n`)
+  renameSync(`${filePath}.tmp-${process.pid}`, filePath)
+  return { written: true, path: filePath, backupPath: backupMade ? backupPath : null }
+}
+
+/**
+ * Interactive model preset picker. Asks the user to choose a preset; persists
+ * the choice unless dryRun. `rl` may be injected for tests; otherwise a
+ * readline/promises interface on stdin/stdout is created and closed.
+ *
+ * @param {{presetDir?: string, presets?: object, dryRun?: boolean, logger?: object, rl?: object}} [opts]
+ * @returns {Promise<string|null>} chosen preset name or null (skipped/unknown)
+ */
+export async function runModelPicker({
+  presetDir,
+  presets,
+  dryRun = false,
+  logger = console,
+  rl,
+} = {}) {
+  const defs = presets ?? loadPresetDefs()
+  const names = Object.keys(defs)
+  if (names.length === 0) {
+    logger.warn?.('Model presets: no presets defined in routing.yml')
+    return null
+  }
+
+  const list = names.map((n, i) => `  ${i + 1}) ${n} — ${defs[n].description ?? ''}`).join('\n')
+  const rli = rl ?? createInterface({ input: process.stdin, output: process.stdout })
+  try {
+    const answer = await rli.question(
+      `\nModel presets (number or name; blank to skip):\n${list}\n> `,
+    )
+    const trimmed = (answer ?? '').trim()
+    if (trimmed === '' || trimmed.toLowerCase() === 'none') {
+      logger.log?.('Skipping model preset selection.')
+      return null
+    }
+    let name = null
+    if (names.includes(trimmed)) {
+      name = trimmed
+    } else {
+      const idx = Number(trimmed)
+      if (Number.isInteger(idx) && idx >= 1 && idx <= names.length) {
+        name = names[idx - 1]
+      }
+    }
+    if (!name) {
+      logger.warn?.(`Unknown preset "${trimmed}" — skipping model preset selection.`)
+      return null
+    }
+    if (!dryRun) {
+      writeActivePreset(presetDir, name, { dryRun: false, source: 'interactive', logger })
+    } else {
+      logger.log?.(`[dry-run] Would set model preset "${name}"`)
+    }
+    return name
+  } finally {
+    if (!rl) rli.close()
+  }
+}

package/scripts/install/opencode.mjs

@@ -3,12 +3,33 @@
  * opencode.mjs — OpenCode platform installer
  */
 
-import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs'
 import { homedir } from 'node:os'
 import { join, resolve } from 'node:path'
+import {
+  bullet,
+  colors,
+  configure,
+  error,
+  info,
+  printSummary,
+  section,
+  spinner,
+  step,
+  success,
+  warning,
+} from './cli-ui.mjs'
 import { healthCheck } from './health-check.mjs'
 import { detectVersion, runMigrations } from './migrate.mjs'
-import { colors, configure, section, step, success, warning, error, info, bullet, spinner, printSummary } from './cli-ui.mjs'
+import { installPlugin, registerPlugin, unregisterPlugin } from './plugin.mjs'
 import {
   collectSkillNames,
   copyFiles,
@@ -20,11 +41,17 @@ import {
   syncDir,
   writeIfChanged,
 } from './shared.mjs'
-import { setupVenv } from './venv.mjs'
-import { installPlugin, registerPlugin, unregisterPlugin } from './plugin.mjs'
-import { resolveComponents } from './component.mjs'
-
-const COMPONENT_NAMES = ['agents', 'skills', 'instructions', 'prompts', 'commands', 'plugins', 'runtime']
+import { setupVenv, venvPythonPath } from './venv.mjs'
+
+const COMPONENT_NAMES = [
+  'agents',
+  'skills',
+  'instructions',
+  'prompts',
+  'commands',
+  'plugins',
+  'runtime',
+]
 
 function deepClone(value) {
   return JSON.parse(JSON.stringify(value))
@@ -63,7 +90,7 @@ function mergeMissing(target, source) {
  * Global installs use a flat layout: agents/ skills/ commands/ plugins/
  * Project installs use the .opencode/ sub-directory layout.
  */
-function isGlobalConfigDir(target) {
+export function isGlobalConfigDir(target) {
   // Primary: ~/.opencode (actual OpenCode installation)
   const homeDir = resolve(join(homedir(), '.opencode'))
   if (resolve(target) === homeDir) return true
@@ -261,9 +288,12 @@ export async function installOpenCode(
       try {
         const cfg = JSON.parse(readFileSync(cfgPath, 'utf8'))
         let changed = false
-        if (cfg.subagent_depth === undefined) { cfg.subagent_depth = 2; changed = true }
+        if (cfg.subagent_depth === undefined) {
+          cfg.subagent_depth = 2
+          changed = true
+        }
         if (changed && !dryRun) {
-          writeFileSync(cfgPath, JSON.stringify(cfg, null, 2) + '\n')
+          writeFileSync(cfgPath, `${JSON.stringify(cfg, null, 2)}\n`)
           success('subagent_depth: 2 added to opencode.json')
         }
       } catch (e) {
@@ -314,12 +344,16 @@ export async function installOpenCode(
       'scrub-secrets.py',
       '_pantheon_paths.py',
       'mcp_persistence_server.py',
+      'pantheon_vision_server.py',
     ]
     const srcScriptsDir = join(ROOT, 'scripts')
+    const canonicalMcpScripts = {
+      'pantheon_vision_server.py': join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py'),
+    }
     const dstScriptsDir = join(runtimeTarget, 'scripts')
     if (!dryRun) mkdirSync(dstScriptsDir, { recursive: true })
     for (const script of mcpScripts) {
-      const src = join(srcScriptsDir, script)
+      const src = canonicalMcpScripts[script] || join(srcScriptsDir, script)
       if (!existsSync(src)) {
         warning(`Script not found: ${src}`)
         stats.errors++
@@ -341,6 +375,18 @@ export async function installOpenCode(
       } else stats.skipped++
     }
 
+    // Keep Vision's dependency contract available to the installed runtime.
+    const visionRequirements = join(ROOT, 'src', 'mcp', 'requirements-vision.txt')
+    if (existsSync(visionRequirements)) {
+      const destination = join(runtimeTarget, 'requirements-vision.txt')
+      const status = writeIfChanged(destination, readFileSync(visionRequirements, 'utf8'), dryRun)
+      if (status === 'created') stats.created++
+      else stats.skipped++
+    } else {
+      warning(`Requirements file not found: ${visionRequirements}`)
+      stats.errors++
+    }
+
     // ── Code-mode scripts ──
     const srcCodeModeDir = join(ROOT, '.pantheon', 'code-mode')
     const dstCodeModeDir = join(runtimeTarget, '.pantheon', 'code-mode')
@@ -604,10 +650,16 @@ export async function installOpenCode(
   // --------------------------------------------------------------------
   if (componentSet.has('runtime')) {
     config.mcp = config.mcp || {}
+    // P1-3: derive the MCP python from the SAME venv layout setupVenv
+    // creates (<target>/.venv via venvPythonPath). For project installs the
+    // runtime payload lives under <target>/.opencode (runtimeTarget), but the
+    // venv is created at <target>/.venv — pointing MCP commands at
+    // runtimeTarget/.venv would reference an executable that never exists.
     const runtimeTarget = isGlobal ? target : join(target, '.opencode')
-    const pythonPath = process.platform === 'win32' ? 'python' : 'python3'
-    const venvPython = join(runtimeTarget, '.venv', 'bin', 'python3')
-    const memoryPython = existsSync(venvPython) ? venvPython : pythonPath
+    const venvPython = venvPythonPath(target)
+    // Point the config at the venv even on a first install; setupVenv runs
+    // later in this function and creates this path before OpenCode starts.
+    const memoryPython = venvPython
 
     // Only add if not already configured by user
     if (!config.mcp['pantheon-resources']) {
@@ -642,6 +694,14 @@ export async function installOpenCode(
         enabled: true,
       }
     }
+    if (!config.mcp['pantheon-vision']) {
+      config.mcp['pantheon-vision'] = {
+        type: 'local',
+        cwd: runtimeTarget,
+        command: [memoryPython, 'scripts/pantheon_vision_server.py'],
+        enabled: true,
+      }
+    }
 
     // Default MCP permissions
     config.permission = config.permission || {}
@@ -658,6 +718,9 @@ export async function installOpenCode(
     if (!config.permission.mcp['pantheon-persistence']) {
       config.permission.mcp['pantheon-persistence'] = 'allow'
     }
+    if (!config.permission.mcp['pantheon-vision']) {
+      config.permission.mcp['pantheon-vision'] = 'ask'
+    }
   }
 
   const configContent = `${JSON.stringify(config, null, 2)}\n`
@@ -707,7 +770,7 @@ export async function installOpenCode(
       }
     } catch (err) {
       error(`Setup failed: ${err.message}`)
-      throw err  // Fatal — abort installation
+      throw err // Fatal — abort installation
     }
   }
 
@@ -718,18 +781,38 @@ export async function installOpenCode(
 
     process.stdout.write('\n')
     process.stdout.write(`  ${colors.bold(colors.green('Installation complete'))}\n`)
-    process.stdout.write(`  ${colors.dim('\u2500'.repeat(Math.min(process.stdout.columns || 60, 60)))}\n`)
+    process.stdout.write(
+      `  ${colors.dim('\u2500'.repeat(Math.min(process.stdout.columns || 60, 60)))}\n`,
+    )
     process.stdout.write(`  ${colors.green('\u2713')} ${created} component(s) installed\n`)
-    if (skipped > 0) process.stdout.write(`  ${colors.dim('\u2014')} ${skipped} already up-to-date\n`)
-    if (errors > 0) process.stdout.write(`  ${colors.yellow('\u26a0')} ${errors} error(s) encountered\n`)
+    if (skipped > 0)
+      process.stdout.write(`  ${colors.dim('\u2014')} ${skipped} already up-to-date\n`)
+    if (errors > 0)
+      process.stdout.write(`  ${colors.yellow('\u26a0')} ${errors} error(s) encountered\n`)
     process.stdout.write('\n')
     process.stdout.write(`  ${colors.bold('Next steps:')}\n`)
     process.stdout.write(`  ${colors.dim('\u2022')} Configure agents in opencode.json\n`)
     process.stdout.write(`  ${colors.dim('\u2022')} Add MCP servers in mcp.json\n`)
     process.stdout.write(`  ${colors.dim('\u2022')} Run 'opencode doctor' to verify\n`)
-    process.stdout.write(`  ${colors.dim('\u2022')} Run 'opencode' to start using Pantheon agents\n`)
+    process.stdout.write(
+      `  ${colors.dim('\u2022')} Run 'opencode' to start using Pantheon agents\n`,
+    )
     process.stdout.write('\n')
   } else {
     printSummary(target, ['opencode'], stats)
   }
+
+  // -----------------------------------------------------------------------
+  // 5. Model preset selection (--components agents). Interactive picker runs
+  //    unless autoYes (use defaults) or an explicit --preset was given.
+  // -----------------------------------------------------------------------
+  if (interactive && !dryRun && !autoYes && !opts.preset) {
+    const { runModelPicker } = await import('./model-picker.mjs')
+    await runModelPicker({ presetDir: target, logger: console })
+  }
+
+  if (opts.preset && !dryRun) {
+    const { writeActivePreset } = await import('./model-picker.mjs')
+    writeActivePreset(target, opts.preset, { source: 'cli' })
+  }
 }

package/scripts/install/venv.mjs

@@ -17,6 +17,25 @@ import { fileURLToPath } from 'node:url'
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const ROOT = join(__dirname, '..', '..')
 
+/**
+ * Resolve the python executable of the venv that setupVenv creates for a
+ * target. Single source of truth for the venv layout: the venv always lives
+ * at <target>/.venv — even for PROJECT installs, where the runtime payload
+ * goes to <target>/.opencode. MCP commands and health checks MUST derive
+ * their python from here (never from a runtime sub-directory), or a project
+ * install would point at <target>/.opencode/.venv/bin/python3, which
+ * setupVenv never creates (P1-3).
+ *
+ * @param {string} target - target installation directory
+ * @returns {string} absolute path to the venv python executable
+ */
+export function venvPythonPath(target) {
+  const venvPath = join(target, '.venv')
+  return process.platform === 'win32'
+    ? join(venvPath, 'Scripts', 'python.exe')
+    : join(venvPath, 'bin', 'python3')
+}
+
 /**
  * Set up a Python virtual environment and install MCP dependencies.
  *
@@ -26,7 +45,7 @@ const ROOT = join(__dirname, '..', '..')
  */
 export function setupVenv(target, { dryRun = false, skipInstall = false, force = false } = {}) {
   const venvPath = join(target, '.venv')
-  const pythonBin = join(venvPath, 'bin', 'python3')
+  const pythonBin = venvPythonPath(target)
 
   // Step 1: Force recreate venv if --force
   if (force && existsSync(venvPath)) {
@@ -94,7 +113,11 @@ export function setupVenv(target, { dryRun = false, skipInstall = false, force =
         if (r2.status !== 0) {
           throw new Error(
             'Failed to install MCP dependencies. ' +
-            'Try: PIP_USER=0 ' + pip + ' install -r ' + reqFile + ' --break-system-packages'
+              'Try: PIP_USER=0 ' +
+              pip +
+              ' install -r ' +
+              reqFile +
+              ' --break-system-packages',
           )
         }
       }

package/scripts/install-mcp.mjs

@@ -23,7 +23,7 @@
 import { execSync } from 'node:child_process'
 import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { dirname, join } from 'node:path'
+import { dirname, join, resolve } from 'node:path'
 import { createInterface } from 'node:readline'
 import { fileURLToPath } from 'node:url'
 
@@ -171,11 +171,31 @@ const MCPS = {
     name: 'Pantheon Resources',
     description: 'Pantheon framework resources — agents, skills, routing, deepwork, memory bank',
     platforms: {
-      opencode: { type: 'local', command: join(ROOT, '.venv/bin/python3'), args: [join(ROOT, 'scripts/mcp_resources_server.py')] },
-      vscode: { type: 'stdio', command: join(ROOT, '.venv/bin/python3'), args: [join(ROOT, 'scripts/mcp_resources_server.py')] },
-      cursor: { type: 'local', command: join(ROOT, '.venv/bin/python3'), args: [join(ROOT, 'scripts/mcp_resources_server.py')] },
-      claude: { type: 'local', command: join(ROOT, '.venv/bin/python3'), args: [join(ROOT, 'scripts/mcp_resources_server.py')] },
-      windsurf: { type: 'local', command: join(ROOT, '.venv/bin/python3'), args: [join(ROOT, 'scripts/mcp_resources_server.py')] },
+      opencode: {
+        type: 'local',
+        command: join(ROOT, '.venv/bin/python3'),
+        args: [join(ROOT, 'scripts/mcp_resources_server.py')],
+      },
+      vscode: {
+        type: 'stdio',
+        command: join(ROOT, '.venv/bin/python3'),
+        args: [join(ROOT, 'scripts/mcp_resources_server.py')],
+      },
+      cursor: {
+        type: 'local',
+        command: join(ROOT, '.venv/bin/python3'),
+        args: [join(ROOT, 'scripts/mcp_resources_server.py')],
+      },
+      claude: {
+        type: 'local',
+        command: join(ROOT, '.venv/bin/python3'),
+        args: [join(ROOT, 'scripts/mcp_resources_server.py')],
+      },
+      windsurf: {
+        type: 'local',
+        command: join(ROOT, '.venv/bin/python3'),
+        args: [join(ROOT, 'scripts/mcp_resources_server.py')],
+      },
     },
     env: [],
     validate: async () => {
@@ -191,11 +211,31 @@ const MCPS = {
     name: 'Pantheon Code Mode',
     description: 'Execute orchestration scripts from .pantheon/code-mode/ directory',
     platforms: {
-      opencode: { type: 'local', command: join(ROOT, '.venv/bin/python3'), args: [join(ROOT, 'scripts/code_mode_server.py')] },
-      vscode: { type: 'stdio', command: join(ROOT, '.venv/bin/python3'), args: [join(ROOT, 'scripts/code_mode_server.py')] },
-      cursor: { type: 'local', command: join(ROOT, '.venv/bin/python3'), args: [join(ROOT, 'scripts/code_mode_server.py')] },
-      claude: { type: 'local', command: join(ROOT, '.venv/bin/python3'), args: [join(ROOT, 'scripts/code_mode_server.py')] },
-      windsurf: { type: 'local', command: join(ROOT, '.venv/bin/python3'), args: [join(ROOT, 'scripts/code_mode_server.py')] },
+      opencode: {
+        type: 'local',
+        command: join(ROOT, '.venv/bin/python3'),
+        args: [join(ROOT, 'scripts/code_mode_server.py')],
+      },
+      vscode: {
+        type: 'stdio',
+        command: join(ROOT, '.venv/bin/python3'),
+        args: [join(ROOT, 'scripts/code_mode_server.py')],
+      },
+      cursor: {
+        type: 'local',
+        command: join(ROOT, '.venv/bin/python3'),
+        args: [join(ROOT, 'scripts/code_mode_server.py')],
+      },
+      claude: {
+        type: 'local',
+        command: join(ROOT, '.venv/bin/python3'),
+        args: [join(ROOT, 'scripts/code_mode_server.py')],
+      },
+      windsurf: {
+        type: 'local',
+        command: join(ROOT, '.venv/bin/python3'),
+        args: [join(ROOT, 'scripts/code_mode_server.py')],
+      },
     },
     env: [],
     validate: async () => {
@@ -278,6 +318,49 @@ const MCPS = {
       return { ok: false, message: 'scripts/mcp_persistence_server.py not found' }
     },
   },
+  'pantheon-vision': {
+    tier: 1,
+    name: 'Pantheon Vision',
+    description:
+      'Image description, OCR, and structured analysis through the OpenCode vision gateway',
+    requirements: join(ROOT, 'src', 'mcp', 'requirements-vision.txt'),
+    platforms: {
+      opencode: {
+        type: 'local',
+        command: join(ROOT, '.venv/bin/python3'),
+        args: [join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py')],
+      },
+      vscode: {
+        type: 'stdio',
+        command: join(ROOT, '.venv/bin/python3'),
+        args: [join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py')],
+      },
+      claude: {
+        type: 'local',
+        command: join(ROOT, '.venv/bin/python3'),
+        args: [join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py')],
+      },
+      cursor: {
+        type: 'local',
+        command: join(ROOT, '.venv/bin/python3'),
+        args: [join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py')],
+      },
+      windsurf: {
+        type: 'local',
+        command: join(ROOT, '.venv/bin/python3'),
+        args: [join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py')],
+      },
+    },
+    env: [],
+    validate: async () => {
+      const sourcePath = join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py')
+      const requirementsPath = join(ROOT, 'src', 'mcp', 'requirements-vision.txt')
+      if (existsSync(sourcePath) && existsSync(requirementsPath)) {
+        return { ok: true, message: 'canonical server source and isolated requirements present' }
+      }
+      return { ok: false, message: 'canonical vision source or requirements not found' }
+    },
+  },
   docker: {
     tier: 2,
     name: 'Docker MCP',
@@ -790,7 +873,7 @@ function logValidation(mcpKey, result) {
 // Main
 // ---------------------------------------------------------------------------
 
-async function main() {
+export async function main() {
   const args = parseArgs(process.argv)
 
   if (args.help) {
@@ -918,4 +1001,6 @@ async function main() {
   process.exit(progress.errors.length > 0 ? 1 : 0)
 }
 
-main()
+if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) {
+  main()
+}

package/scripts/mcp_persistence_server.py

@@ -233,7 +233,7 @@ async def kv_store(
 
     # Opportunistic auto-purge: if namespace has >500 entries, purge expired
     _opportunistic_auto_purge(conn, namespace)
-    
+
     return {"status": "stored", "namespace": namespace, "key": key}
 
 

package/scripts/secret-scan.mjs

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+
+/** Scan versionable files without printing secret values. */
+
+import { execFileSync } from 'node:child_process'
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const bifrostHeader = ['x', '-bf-', 'vk'].join('')
+const bifrostTokenPrefix = ['sk', '-bf-'].join('')
+const apiKeyName = ['api', 'Key'].join('')
+const authorizationName = ['Author', 'ization'].join('')
+
+const escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+
+// Files that may reference credential PATTERN NAMES (not values): gitleaks
+// config, security policy, scan tooling and its fixtures. Keep in sync with
+// the [allowlist] paths in .gitleaks.toml.
+export const allowlistedFiles = new Set([
+  '.gitleaks.toml',
+  '.gitleaksignore',
+  'SECURITY.md',
+  'scripts/secret-scan.mjs',
+  'tests/test_secret_scan.mjs',
+])
+
+const patterns = [
+  { label: 'Bifrost credential header', regex: new RegExp(escapeRegExp(bifrostHeader), 'i') },
+  {
+    label: 'Bifrost credential value',
+    regex: new RegExp(`${escapeRegExp(bifrostTokenPrefix)}[A-Za-z0-9_-]{8,}`, 'i'),
+  },
+  {
+    label: 'literal API key value',
+    regex: new RegExp(
+      `["']${escapeRegExp(apiKeyName)}["']\\s*[:=]\\s*["'](?!\\$\\{|process\\.env|os\\.getenv|env:)[^"']{12,}["']`,
+      'i',
+    ),
+  },
+  {
+    label: 'literal Authorization bearer value',
+    regex: new RegExp(
+      `["']${escapeRegExp(authorizationName)}["']\\s*[:=]\\s*["']Bearer\\s+[A-Za-z0-9._-]{12,}["']`,
+      'i',
+    ),
+  },
+]
+
+export function scanText(text, file = '<text>') {
+  return patterns.filter(({ regex }) => regex.test(text)).map(({ label }) => ({ file, label }))
+}
+
+export function versionableFiles() {
+  return execFileSync('git', ['ls-files', '-z', '--cached', '--others', '--exclude-standard'], {
+    encoding: 'buffer',
+  })
+    .toString()
+    .split('\0')
+    .filter(Boolean)
+}
+
+export function scanVersionableFiles() {
+  const findings = []
+  for (const file of versionableFiles()) {
+    if (allowlistedFiles.has(file)) continue
+    let text
+    try {
+      const content = readFileSync(file)
+      if (content.includes(0)) continue
+      text = content.toString('utf8')
+    } catch {
+      continue
+    }
+    findings.push(...scanText(text, file))
+  }
+  return findings
+}
+
+if (fileURLToPath(import.meta.url) === resolve(process.argv[1])) {
+  const findings = scanVersionableFiles()
+  if (findings.length > 0) {
+    for (const finding of findings) console.error(`[SECRET SCAN] ${finding.file}: ${finding.label}`)
+    process.exitCode = 1
+  } else {
+    console.log('Secret scan passed: no versionable Bifrost/API credentials detected.')
+  }
+}

package/scripts/uninstall.mjs

@@ -36,14 +36,14 @@ const PANTHEON_AGENT_NAMES = [
   'themis',
   'prometheus',
   'hephaestus',
-  
-  
+
+
   'nyx',
   'gaia',
   'iris',
   'mnemosyne',
   'talos',
-  
+
 ]
 
 const PLATFORM_LABELS = {

package/scripts/validate-routing.mjs

@@ -18,6 +18,7 @@ import { existsSync, readdirSync, readFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import yaml from 'js-yaml'
+import { validatePresetDefs } from '../src/pantheon/presets.mjs'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const ROOT = join(__dirname, '..')
@@ -150,6 +151,20 @@ for (const [name, info] of Object.entries(routing.agents || {})) {
   }
 }
 
+// F. Model preset validation
+const presetDefs = routing.presets || {}
+console.log(`\n  Model presets: ${Object.keys(presetDefs).length} defined`)
+
+const presetKnownAgents = routingAgents.filter((a) => a !== 'zen' && a !== 'zeus_copilot')
+const presetValidation = validatePresetDefs(presetDefs, { agents: presetKnownAgents })
+for (const err of presetValidation.errors) {
+  check(false, `Preset ${err}`)
+}
+for (const w of presetValidation.warnings) {
+  warn(`Preset ${w}`)
+}
+console.log(`  Presets defined: ${Object.keys(presetDefs).length}`)
+
 // Summary
 console.log(`\n${'='.repeat(50)}`)
 const status = failures === 0 ? '✅ PASSED' : `❌ FAILED (${failures}/${checks} checks failed)`