pantheon-opencode 1.2.0 → 1.2.2

package/AGENTS.md

@@ -29,6 +29,15 @@ See [INSTALLATION.md](docs/INSTALLATION.md) for setup instructions.
 - Test: `npm test`
 - Lint: `npm run lint`
 
+## Teste de Instalação Global (sandbox)
+
+Para validar a instalação global do pacote pantheon-opencode COMO UM USUÁRIO REAL, use o sandbox isolado em `~/pantheon-sandbox/` (fora do repo, HOME + prefix npm + venv próprios). O ambiente de dev mistura 3 instalações + config global + venv — NÃO serve para testar instalação/empacotamento.
+
+- Rodar: `bash ~/pantheon-sandbox/run-test.sh` (opencode mcp list 5/5 connected + doctor 0 erros + abre TUI isolado)
+- Regra para agentes: ao validar instalação global (npm pack, `init`, MCPs, hooks), usar o sandbox — NUNCA testar no ambiente de dev
+- Descarte: `rm -rf ~/pantheon-sandbox`
+- Detalhes: ver `~/pantheon-sandbox/README.md`
+
 ## Conventions
 
 - TDD: Write failing test first, then implement

package/README.md

@@ -172,6 +172,9 @@ npx pantheon-opencode init
 # Headless mode — for CI and automation
 npx pantheon-opencode init --headless
 
+# (Optional) Install + activate a model routing preset
+npx pantheon-opencode init --preset go-fast
+
 # (Optional) Install MCP servers + skills + TUI plugin
 npm run setup
 
@@ -182,7 +185,7 @@ opencode
 
 > **Modes:** Interactive TUI with checkbox selection (default TTY), or `--headless` for scripts/CI.
 > **Minimal:** `--headless --no-mcp` installs only agents (~2s).
-> **Full:** `--headless` also creates Python venv + MCP servers (memory, persistence, KV).
+> **Full:** `--headless` also creates Python venv + MCP servers (memory, persistence, KV, vision).
 
 ---
 
@@ -418,6 +421,76 @@ subscription (OpenCode Go, Copilot Pro, Claude Pro, etc.).
 
 ---
 
+## Model Routing Presets
+
+The abstract tiers above are pinned to concrete `provider/model` IDs by **6 built-in model presets**. Each preset maps all 14 agents to a specific model plus a reasoning effort per role (planners/reviewers, implementers, scouts). **Zero-mutation default**: without an active preset, agents run on OpenCode's default model — behavior is unchanged.
+
+### Presets
+
+| Preset | Provider | Planners/Reviewers | Implementers | Scouts |
+|--------|----------|--------------------|--------------|--------|
+| `go-deepseek` | opencode (Zen) | `opencode/deepseek-v4-pro` | `opencode/deepseek-v4-flash` | `opencode/deepseek-v4-flash-free` |
+| `go-fast` | opencode-go | `opencode-go/deepseek-v4-flash` — all 14 agents, effort `low` | | |
+| `go-claude` | anthropic | `anthropic/claude-opus-4-8` | `anthropic/claude-sonnet-5` | `anthropic/claude-haiku-4-5` |
+| `go-openai` | openai | `openai/gpt-5.6-sol` | `openai/gpt-5.6-terra` | `openai/gpt-5.6-luna-fast` |
+| `go-premium` | opencode-go | GLM-5.1 (zeus), DeepSeek V4 Pro (athena), Qwen3.7 Max (themis) | MiniMax M2.7 (hermes, hephaestus), Kimi K2.6 (aphrodite), Qwen3.7 Plus (demeter), GLM-5.2 (prometheus) | DeepSeek V4 Flash (scouts) |
+| `go-free` | opencode (Zen free, $0) | Big Pickle (zeus), Nemotron 3 Ultra Free (athena) | DeepSeek V4 Flash Free | North Mini Code Free (scouts) |
+
+The exact per-agent mapping (model + reasoning effort + fallbacks) lives in the `presets:` block of [src/routing.yml](src/routing.yml).
+
+### Requirements
+
+- **Env vars** — checked fail-fast (CLI and plugin) when the selected preset uses the provider:
+  - `PANTHEON_OPENCODE_API_KEY` — `opencode` + `opencode-go` providers (`go-deepseek`, `go-fast`, `go-premium`, `go-free`)
+  - `PANTHEON_ANTHROPIC_API_KEY` — `anthropic` provider (`go-claude`)
+  - `PANTHEON_OPENAI_API_KEY` — `openai` provider (`go-openai`)
+- **OpenCode Go subscription** required for `go-fast` / `go-premium`.
+- **OpenCode Zen free tier** for `go-free` — note `nemotron-3-ultra-free` has known intermittent failures ([opencode#38028](https://github.com/opencode/opencode/issues/38028)); fall back to `go-fast` if flaky.
+
+### Commands
+
+```bash
+# Install + activate a preset
+npx pantheon-opencode init --preset go-fast
+
+# Switch preset (global config; --project for project-local; --dry-run to preview)
+pantheon-opencode set-tier go-deepseek
+pantheon-opencode set-tier go-fast --project
+pantheon-opencode set-tier go-fast --dry-run
+
+# Clear preset — back to the zero-mutation default
+pantheon-opencode set-tier none
+
+# No name → lists available presets (none, go-deepseek, go-fast, go-claude, go-openai, go-premium, go-free)
+pantheon-opencode set-tier
+```
+
+**Env override (CI/headless)** — wins over the file:
+
+```bash
+export PANTHEON_MODEL_PRESET=go-deepseek
+```
+
+### How it works
+
+- The active selection is persisted to `.pantheon/active-preset.json` — `{version, preset, source, updated_at}` — written atomically (tmp file + rename) with a `.bak` backup of the previous file. It applies on the next OpenCode startup (no hot-swap); the plugin's `hooks.config` injects it.
+- **Resolution precedence**: `PANTHEON_MODEL_PRESET` env → first existing `.pantheon/active-preset.json` (project → `~/.config/opencode` → `~/.opencode`) → **none** (defaults).
+- **Partial semantics**: a preset overrides only the agents it lists; unlisted agents inherit the invoking primary agent's model.
+- Interactive picker during `init`: one prompt listing the 6 presets (select by number or name, blank to skip). It never touches your `opencode.json` — the choice is injected at startup instead. The file format also supports an optional `overrides` block (per-agent `model`/`variant`, per-provider `baseURL`/`apiKeyEnv`) merged over the preset definition.
+- **Capability normalization**: requested reasoning effort is clamped to each model family's ceiling (`deepseek-v4-flash` max `medium`; claude models strip the variant entirely — Anthropic uses thinking).
+- **fallback_models**: per-agent ordered fallback list where configured (e.g. `go-deepseek` sets `[opencode/mimo-v2.5]` for every agent).
+
+### Quick smoke test
+
+```bash
+export PANTHEON_OPENCODE_API_KEY=...
+pantheon-opencode set-tier go-fast --project
+opencode run "hello" 2>&1 | grep "Pantheon"
+# expect: [Pantheon Plugin] Model preset active: go-fast (source: file)
+```
+
+---
+
 ## Quick Start
 
 ### 1. Install Pantheon
@@ -664,19 +737,43 @@ Edit README.md line 11: agents-17 → agents-18
 - Hardcoded secret detection
 - Minimum 80% test coverage (hard block)
 
-**Agent hooks enforce at runtime (`scripts/hooks/` + `.opencode/plugins/pantheon-hooks.ts`):**
-- `scan-secrets.sh` — detects hardcoded secrets and credentials (PreToolUse)
-- `validate-tool-safety.sh` — blocks destructive operations (PreToolUse)
-- `validate-talos-scope.sh` — restricts Talos hotfix scope (PreToolUse)
-- `on-subagent-delegation-start.sh` — tracks delegation start (PreToolUse)
-- `format-multi-language.sh` — auto-formats modified files (PostToolUse)
-- `log-session-start.sh` — audit trail of sessions (PostToolUse)
-- `on-subagent-delegation-stop.sh` — delegation cleanup (PostToolUse)
-- `validate-post-conditions.sh` — post-condition validation (event)
-- `audit-imports.sh` — detects wildcard imports and suspicious patterns (PostToolUse)
-- `run-type-check.sh` — runs mypy/tsc if config exists (PostToolUse)
+**Agent hooks enforce at runtime (`scripts/hooks/` + `src/plugins/pantheon-hooks.ts`):**
+- `scan-secrets.sh` — detects hardcoded secrets and credentials (tool.execute.before)
+- `validate-tool-safety.sh` — blocks destructive operations (tool.execute.before)
+- `validate-talos-scope.sh` — restricts Talos hotfix scope (tool.execute.before)
+- `on-subagent-delegation-start.sh` — tracks delegation start (tool.execute.before, delegation tools only)
+- `format-multi-language.sh` — auto-formats modified files (tool.execute.after)
+- `log-session-start.sh` — audit trail of sessions (tool.execute.after + event session.created)
+- `on-subagent-delegation-stop.sh` — delegation cleanup (tool.execute.after, delegation tools only)
+- `validate-post-conditions.sh` — post-condition validation (event session.created)
+- `audit-imports.sh` and `run-type-check.sh` also live in `scripts/hooks/` but are not wired into the plugin.
+
+The `src/plugins/pantheon-hooks.ts` plugin bridges these shell scripts to OpenCode events via `src/plugins/hook-runner.ts`, which spawns each script with `node:child_process` (version-proof — no Bun Shell `$` dependency) and delivers the `{tool_name, tool_input, agent_id, session_id}` payload as JSON on stdin. Register it explicitly in `opencode.json`: `"plugin": ["<path>/src/plugins/pantheon-hooks.ts"]` (absolute path). It is **not** auto-discovered from `.opencode/plugins/`.
+
+### Pre-commit hooks (local secret gate)
+
+Pre-commit blocks **secrets and hygiene issues locally**, before anything reaches CI — the same fail-closed policy as the `Security / security-scan` CI gate, one layer earlier.
+
+**Install (one-time, per clone):**
+
+```bash
+pip install pre-commit
+npm run hooks:install   # -> pre-commit install
+```
+
+**What the hooks verify (`.pre-commit-config.yaml`):**
+
+| Hook | Checks |
+|---|---|
+| `gitleaks` (v8.24.3) | Hardcoded secrets in the staged diff — Bifrost credential values (`sk-bf-*`), private keys, GitHub/npm/AWS/Google/Slack tokens, `sk-*` keys. Uses `.gitleaks.toml`, redacted output, exit code 2 |
+| `secret-scan` (local, `scripts/secret-scan.mjs`) | Bifrost MCP credential header + value patterns + literal API key / `Authorization: Bearer` values in versionable files |
+| `trailing-whitespace`, `end-of-file-fixer` | Formatting hygiene (auto-fixed) |
+| `check-json`, `check-yaml`, `check-toml` | Config file syntax |
+| `check-merge-conflict`, `check-added-large-files` (max 5 MB), `forbid-new-submodules` | Repo hygiene |
+
+**Security policy:** any secret found **blocks the commit** (fail-fast, no `--no-verify` exceptions). If a secret is flagged, **rotate it immediately** — do not "fix" the scan, do not force the commit.
 
-The `.opencode/plugins/pantheon-hooks.ts` plugin bridges these shell scripts to OpenCode events. OpenCode auto-discovers plugins from `.opencode/plugins/` when running from the project directory.
+**Update hooks:** `npm run hooks:update` (runs `pre-commit autoupdate`).
 
 ---
 
@@ -745,6 +842,6 @@ Pantheon draws from the broader multi-agent landscape while diverging in key way
 
 ---
 
-**License:** MIT  
-**Architecture Pattern:** Conductor-Delegate  
+**License:** MIT
+**Architecture Pattern:** Conductor-Delegate
 **Mythology:** Greek (Zeus, Athena, Apollo, Hermes, Aphrodite, Talos, Themis, Mnemosyne, Gaia, Hephaestus, Nyx, Prometheus, Demeter, Iris)

package/bin/pantheon-init.mjs

@@ -8,6 +8,7 @@
  * installOpenCode() from scripts/install/opencode.mjs.
  */
 import fs from 'fs';
+import os from 'os';
 import path from 'path';
 import { fileURLToPath } from 'url';
 
@@ -33,6 +34,11 @@ function printUsage() {
   console.log('  npx pantheon-opencode init --interactive  # Force interactive TUI mode');
   console.log('  npx pantheon-opencode init --headless     # Force non-interactive mode');
   console.log('  npx pantheon-opencode init -y             # Skip confirmations, use defaults');
+  console.log('  npx pantheon-opencode init --preset <name> # Install and activate model preset');
+  console.log('  npx pantheon-opencode set-tier <name>      # Set active model preset (global)');
+  console.log('  npx pantheon-opencode set-tier <name> --project  # Set active model preset (project)');
+  console.log('  npx pantheon-opencode prune               # List legacy artifacts (dry-run)');
+  console.log('  npx pantheon-opencode prune --apply       # Remove stale backups');
   console.log('  npx pantheon-opencode --help              # Show this help');
 }
 
@@ -40,8 +46,92 @@ async function main() {
   const args = process.argv.slice(2);
   const command = args[0];
 
+  // prune handles its own --help (delegated to scripts/prune.mjs), so its
+  // dispatch must run BEFORE the generic --help check.
+  if (command === 'prune') {
+    const { spawnSync } = await import('child_process');
+    const pruneScript = path.join(ROOT, 'scripts', 'prune.mjs');
+    const result = spawnSync(process.execPath, [pruneScript, ...args.slice(1)], {
+      stdio: 'inherit',
+      cwd: ROOT,
+    });
+    process.exit(result.status ?? 1);
+  }
+
   if (args.includes('--help')) { printUsage(); process.exit(0); }
 
+  if (command === 'set-tier') {
+    const isProject = args.includes('--project');
+    const isDryRun = args.includes('--dry-run');
+    const name = args[1];
+
+    const { loadPresetDefs } = await import('../src/pantheon/presets.mjs');
+    const { writeActivePreset } = await import('../scripts/install/model-picker.mjs');
+    const presets = loadPresetDefs();
+    const presetList = `none, ${Object.keys(presets).join(', ')}`;
+
+    if (!name) {
+      console.error('❌ set-tier requires a preset name');
+      console.error(`   Available: ${presetList}`);
+      process.exit(1);
+    }
+    if (name !== 'none' && !presets[name]) {
+      console.error(`❌ Unknown preset "${name}"`);
+      console.error(`   Available: ${presetList}`);
+      process.exit(1);
+    }
+
+    // Fail-fast: every provider's API key env var must be set before writing
+    if (name !== 'none') {
+      for (const [pid, provider] of Object.entries(presets[name].providers || {})) {
+        if (!process.env[provider.apiKeyEnv]) {
+          console.error(`❌ Missing required API key configuration for provider "${pid}"`);
+          console.error('   Set the provider API key environment variable and retry.');
+          process.exit(1);
+        }
+      }
+    }
+
+    const presetDir = isProject
+      ? process.cwd()
+      : path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config'), 'opencode');
+    const filePath = path.join(presetDir, '.pantheon', 'active-preset.json');
+    const bakPath = path.join(presetDir, '.pantheon', 'active-preset.json.bak');
+
+    let prevName = '(none)';
+    if (fs.existsSync(filePath)) {
+      try {
+        prevName = JSON.parse(fs.readFileSync(filePath, 'utf8')).preset || '(unknown)';
+      } catch { prevName = '(unknown)'; }
+    }
+
+    if (name === 'none') {
+      if (isDryRun) {
+        console.log('[dry-run] Would clear model preset');
+      } else {
+        if (fs.existsSync(filePath)) {
+          fs.mkdirSync(path.dirname(bakPath), { recursive: true });
+          fs.copyFileSync(filePath, bakPath);
+          fs.rmSync(filePath, { force: true });
+        }
+        console.log('Model preset cleared. Using opencode defaults.');
+        console.log(`   Backup: ${bakPath}`);
+      }
+      return;
+    }
+
+    const result = writeActivePreset(presetDir, name, { dryRun: isDryRun, source: 'cli' });
+
+    console.log(`Model preset set: ${prevName} → ${name}`);
+    for (const [agent, spec] of Object.entries(presets[name].agents || {})) {
+      console.log(`   ${agent}: ${spec.model} [${spec.reasoning_effort}]`);
+    }
+    const providerNames = Object.keys(presets[name].providers || {});
+    console.log(`   Providers: ${providerNames.join(', ') || 'none'}`);
+    if (result.backupPath) console.log(`   Backup: ${result.backupPath}`);
+    return;
+  }
+
   if (command === 'init' || !command) {
     const isProject = args.includes('--project');
     const isDryRun = args.includes('--dry-run');
@@ -51,6 +141,8 @@ async function main() {
     const forceInteractive = args.includes('--interactive');
     const forceHeadless = args.includes('--headless');
     const autoYes = args.includes('--yes') || args.includes('-y');
+    const presetIndex = args.indexOf('--preset');
+    const presetOpt = presetIndex >= 0 ? (args[presetIndex + 1] ?? null) : null;
 
     const components = ['agents', 'skills', 'instructions', 'commands', 'plugins'];
     if (!skipMCP) components.push('runtime');
@@ -75,6 +167,7 @@ async function main() {
         interactive: forceInteractive,
         headless: forceHeadless,
         yes: autoYes,
+        preset: presetOpt,
       });
     } catch (err) {
       console.error(`❌ Installation failed: ${err.message}\n   Run with --no-mcp to skip Python dependencies:\n     npx pantheon-opencode init --no-mcp\n   Or retry with --force to recreate the venv:\n     npx pantheon-opencode init --force`);

package/commands/pantheon-vision.md

@@ -0,0 +1,67 @@
+---
+description: "Configure Pantheon vision interactively: auth check, mode (native|tool|auto), vision model, tool fallback. Saves to opencode-vision.json. Usage: /pantheon-vision"
+agent: hermes
+---
+# /pantheon-vision — Configure Vision
+
+**What:** Walks the user through configuring Pantheon's image-vision plugin
+(native multimodal model via the opencode Zen endpoint, or MCP tool fallback).
+**Usage:** `/pantheon-vision [--global]`
+**When:** First-time setup, changing the vision model, troubleshooting images
+not being described, switching between native and tool mode.
+
+## Steps
+
+1. **Check connectivity & key source**
+   - Read the opencode auth store: `<data dir>/auth.json`
+     (default `~/.local/share/opencode/auth.json`, provider entries
+     `opencode-go` then `opencode`) via `readOpencodeAuthToken`.
+   - Report whether the user is connected (`opencode auth login`) or has an
+     env key (`PANTHEON_OPENCODE_API_KEY` / `OPENCODE_API_KEY`).
+   - **Never log or echo the token itself** — only connected/not connected.
+
+2. **Show current status**
+   - Effective mode precedence: env `PANTHEON_VISION_MODE` > config file
+     `mode` > default `auto`.
+   - Read the current config file if present (project `.opencode/opencode-vision.json`
+     then user `~/.config/opencode/opencode-vision.json`).
+
+3. **Ask what to set (interactive)**
+   - **Mode:** `native` | `tool` | `auto`
+     - `native` — describe images via the multimodal model directly (needs key)
+      - `tool` — always use the MCP tool fallback (`imageAnalysisTool`)
+     - `auto` — try native first, fall back to the tool (default)
+   - **Vision model:** e.g. `opencode-go/mimo-v2.5`, `opencode-go/minimax-m3`,
+     or an explicit override (precedence: env `PANTHEON_VISION_MODEL` > config
+     `visionModel` > active preset `vision.model` > default `opencode-go/mimo-v2.5`).
+    - **Tool fallback:** `imageAnalysisTool` (default
+      `pantheon_vision_vision_describe`). Bifrost is opt-in only when
+      explicitly selected here or through `PANTHEON_VISION_TOOL`.
+
+4. **Save the config**
+   - Default: project config `.opencode/opencode-vision.json`
+     (merged with the user config `~/.config/opencode/opencode-vision.json`;
+     project wins on conflicts).
+   - `--global` → write to `~/.config/opencode/opencode-vision.json`.
+   - Shape:
+     ```json
+     {
+       "mode": "auto",
+       "visionModel": "opencode-go/mimo-v2.5",
+        "imageAnalysisTool": "pantheon_vision_vision_describe"
+     }
+     ```
+   - Optional fields also supported: `models` (model wildcard patterns),
+     `promptTemplate` (with `{imageList}`/`{imageCount}`/`{toolName}`/`{userText}`).
+
+5. **Wrap up**
+   - Tell the user to restart opencode (config is read at startup / per turn)
+     and test by pasting an image with a question.
+   - If no key and no auth store entry exist, recommend `opencode auth login`
+     (native mode) or leaving the tool fallback enabled.
+
+## Rules
+
+- Do NOT print tokens or auth.json contents.
+- Do NOT overwrite existing config keys not being changed — merge.
+- If the config file is corrupted JSON, warn and ask before overwriting.

package/opencode.json

@@ -1,5 +1,15 @@
 {
   "$schema": "https://opencode.ai/config.json",
+  "provider": {
+    "opencode-go": {
+      "models": {
+        "mimo-v2.5": {
+          "attachment": true,
+          "modalities": { "input": ["text", "image"] }
+        }
+      }
+    }
+  },
   "default_agent": "zeus",
   "subagent_depth": 2,
   "model": "opencode-go/deepseek-v4-flash",
@@ -18,19 +28,13 @@
       "pip *": "allow"
     }
   },
-  "instructions": [
-    "AGENTS.md",
-    "src/instructions/*.instructions.md"
-  ],
-  "plugin": [],
+  "instructions": ["AGENTS.md", "src/instructions/*.instructions.md"],
+  "plugin": ["/home/ils15/pantheon/src/plugins/pantheon-hooks.ts"],
   "mcp": {
     "bifrost": {
       "type": "remote",
       "url": "https://llm.ofertachina.cloud/mcp",
-      "enabled": true,
-      "headers": {
-        "x-bf-vk": "sk-bf-a5a9b5b0-45fc-414d-8e4d-f9beb8c49a6d"
-      }
+      "enabled": true
     }
   },
   "agent": {
@@ -44,4 +48,4 @@
       "model": "opencode-go/deepseek-v4-pro"
     }
   }
-}
+}

package/package.json

@@ -1,28 +1,36 @@
 {
   "name": "pantheon-opencode",
-  "version": "1.2.0",
-  "description": "Multi-agent orchestration for OpenCode \u2014 14 specialized agents, TDD, Themis review gates.",
+  "version": "1.2.2",
+  "description": "Multi-agent orchestration for OpenCode — 14 specialized agents, TDD, Themis review gates.",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs",
+    "prepare": "husky",
     "setup": "node bin/pantheon-init.mjs init",
     "setup:lite": "node bin/pantheon-init.mjs init --clean --components agents,skills,instructions",
     "doctor": "node scripts/doctor.mjs",
+    "prune": "node scripts/prune.mjs",
     "init": "node bin/pantheon-init.mjs init",
     "opencode": "OPENCODE_EXPERIMENTAL_BACKGROUND_SUBAGENTS=true opencode",
     "start": "OPENCODE_EXPERIMENTAL_BACKGROUND_SUBAGENTS=true opencode",
     "prepublishOnly": "node scripts/validate-routing.mjs",
-    "postpublish": "node -e \"console.log('\u2705 Published pantheon-opencode v' + require('./package.json').version + ' to npm')\"",
+    "postpublish": "node -e \"console.log('✅ Published pantheon-opencode v' + require('./package.json').version + ' to npm')\"",
     "version:status": "node scripts/versioning.mjs status",
     "version:apply": "node scripts/versioning.mjs apply",
+    "version:check": "node scripts/version-check.mjs",
     "release:dry-run": "node scripts/versioning.mjs status && npm pack --dry-run",
     "publish:next": "npm publish --tag next --access public",
     "lint": "npx biome ci .",
     "typecheck": "npx tsc --noEmit",
     "audit": "npm audit --audit-level=high",
+    "secret-scan": "node scripts/secret-scan.mjs",
+    "hooks:install": "pre-commit install",
+    "hooks:update": "pre-commit autoupdate",
+    "test:security": "npm run secret-scan && node tests/test_install_mcp_vision.mjs && node tests/test_doctor_layers.mjs",
+    "test:node": "node --test tests/*.mjs",
     "test": "python3 -m pytest tests/ -q 2>&1 || echo \"No tests found\"",
     "test:ci": "python3 -m pytest tests/ -q --tb=short 2>&1 || true"
   },
@@ -50,6 +58,9 @@
     "scripts/*.mjs",
     "src/mcp/*.sh",
     "src/routing.yml",
+    "src/pantheon/**",
+    "src/plugins/**",
+    "scripts/hooks/**",
     "src/mcp/requirements*",
     "src/plugins/tui/**",
     "src/skills/**"
@@ -60,12 +71,17 @@
   "devDependencies": {
     "@commitlint/cli": "^19.8.0",
     "@commitlint/config-conventional": "^19.8.0",
+    "@opencode-ai/plugin": "1.18.11",
     "husky": "^9.1.7"
   },
   "repository": {
     "type": "git",
     "url": "https://github.com/ils15/pantheon-opencode.git"
   },
+  "homepage": "https://github.com/ils15/pantheon-opencode",
+  "bugs": {
+    "url": "https://github.com/ils15/pantheon-opencode/issues"
+  },
   "keywords": [
     "github",
     "copilot",
@@ -80,4 +96,4 @@
     "node": ">=18"
   },
   "preferGlobal": true
-}
+}

package/scripts/_pantheon_paths.py

@@ -64,5 +64,3 @@ def pantheon_project() -> Path | None:
         return Path(cwd).resolve()
 
     return None
-
-

package/scripts/changelog-extract.mjs

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+/**
+ * changelog-extract.mjs — print a version section from CHANGELOG.md
+ *
+ * The release workflow needs the CHANGELOG entry for the version it is about
+ * to tag. This script extracts the body of `## [<version>] - YYYY-MM-DD`
+ * (leading `v` tolerated, date optional) and prints it to stdout. When the
+ * section is missing it exits 1, so the workflow fails loudly: "add the
+ * section in the version-bump PR".
+ *
+ * Usage:
+ *   node scripts/changelog-extract.mjs 1.2.1
+ *   node scripts/changelog-extract.mjs v1.2.1 --changelog /path/to/CHANGELOG.md
+ */
+
+import { readFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+const DEFAULT_CHANGELOG = join(dirname(fileURLToPath(import.meta.url)), '..', 'CHANGELOG.md')
+
+/** Escape regex metacharacters so a version like 1.0.0 matches literally. */
+function escapeRegExp(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+/**
+ * Extract the body of a version section from changelog text.
+ *
+ * Finds the heading `## [<version>] - YYYY-MM-DD` (leading `v` and the date
+ * are optional) and returns everything after the heading line up to the next
+ * `## [` heading (or end of text). The `## [Unreleased]` heading is never
+ * matched, even when asked for explicitly.
+ *
+ * @param {string} changelogText - full CHANGELOG.md content
+ * @param {string} version - e.g. "1.2.1" or "v1.2.1"
+ * @returns {{found: boolean, body: string|null}} body is null when not found
+ */
+export function extractSection(changelogText, version) {
+  const normalized = String(version).trim().replace(/^v/i, '')
+  if (!normalized || /^unreleased$/i.test(normalized)) {
+    return { found: false, body: null }
+  }
+
+  const escaped = escapeRegExp(normalized)
+  // Single-line heading: `## [v?1.2.1]` optionally followed by ` - YYYY-MM-DD`.
+  // [ \t] (not \s) keeps the match from crossing newlines; the lookahead
+  // requires end-of-line or whitespace so `[1.0.0-beta]` can never match `1.0.0`.
+  const headingRe = new RegExp(
+    `^##[ \\t]+\\[v?${escaped}\\](?:[ \\t]*-[ \\t]*\\d{4}-\\d{2}-\\d{2})?(?=[ \\t]|$)`,
+    'm',
+  )
+  const match = headingRe.exec(changelogText)
+  if (!match) return { found: false, body: null }
+
+  // Advance past the heading line (match.index may point mid-line).
+  const newline = changelogText.indexOf('\n', match.index)
+  const start = newline === -1 ? changelogText.length : newline + 1
+
+  // Body ends at the next `## [` heading or end of text.
+  const nextHeading = /^##[ \t]+\[/m.exec(changelogText.slice(start))
+  const end = nextHeading ? start + nextHeading.index : changelogText.length
+
+  return { found: true, body: changelogText.slice(start, end).trim() }
+}
+
+const isDirectRun = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href
+
+if (isDirectRun) {
+  const args = process.argv.slice(2)
+  let changelogPath = DEFAULT_CHANGELOG
+  let version = null
+
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i]
+    if (arg === '--changelog') {
+      changelogPath = args[i + 1]
+      i += 1
+      continue
+    }
+    if (arg.startsWith('--changelog=')) {
+      changelogPath = arg.slice('--changelog='.length)
+      continue
+    }
+    version = arg
+  }
+
+  if (!version) {
+    console.error('Usage: node scripts/changelog-extract.mjs <version> [--changelog <path>]')
+    process.exitCode = 2
+  } else {
+    let text
+    try {
+      text = readFileSync(changelogPath, 'utf-8')
+    } catch {
+      console.error(`changelog-extract: cannot read ${changelogPath}`)
+      process.exitCode = 1
+    }
+
+    if (text !== undefined) {
+      const { found, body } = extractSection(text, version)
+      if (!found) {
+        console.error(`changelog-extract: section [${version}] not found in ${changelogPath}`)
+        console.error('Add the section in the version-bump PR — the release workflow requires it.')
+        process.exitCode = 1
+      } else {
+        process.stdout.write(`${body}\n`)
+        process.exitCode = 0
+      }
+    }
+  }
+}