pantheon-opencode 1.2.0 → 1.2.2

package/src/plugin.ts

@@ -1,6 +1,9 @@
+import type { Plugin, PluginInput } from '@opencode-ai/plugin'
 import type { PluginConfig } from 'opencode'
 import { BackgroundJobBoard } from './pantheon/background-job-board.ts'
 import { FilePersistenceAdapter } from './pantheon/file-persistence.ts'
+import { applyActivePresetToConfig } from './pantheon/presets.mjs'
+import { activePresetCandidates, createVisionHandler } from './pantheon/vision.ts'
 
 // ─── Background Job Board Singleton ────────────────────────────────────
 
@@ -8,17 +11,11 @@ const board = new BackgroundJobBoard({
   maxConcurrentPerAgent: 3,
   signalDir: '.pantheon/deepwork/board-signals',
 })
-
-// Wire up file-based persistence and recover orphaned jobs from crashes
 const persistence = new FilePersistenceAdapter('.pantheon/board/state.json')
 board.setPersistence(persistence)
-
-// Recover on startup — any jobs left in "running" state become "error"
-board.recoverRunningJobs().catch((err) =>
-  console.error('[Pantheon Plugin] Failed to recover running jobs:', err),
-)
-
-// Log board state changes to console for observability
+board
+  .recoverRunningJobs()
+  .catch((err) => console.error('[Pantheon Plugin] Failed to recover running jobs:', err))
 board.onTerminal((taskID: string) => {
   const job = board.get(taskID)
   if (job) {
@@ -29,29 +26,76 @@ board.onTerminal((taskID: string) => {
 })
 
 /**
- * Get the global BackgroundJobBoard singleton.
+ * Pantheon plugin for OpenCode. Pasted images are intercepted via the
+ * `chat.message` hook (proven to fire in opencode 1.18.11). When a provider
+ * key is available — env PANTHEON_OPENCODE_API_KEY / OPENCODE_API_KEY, or the
+ * opencode auth store for `opencode auth login` users — the image is
+ * described NATIVELY by the multimodal model via the opencode Zen
+ * OpenAI-compatible endpoint, and replaced with the text description — no MCP
+ * tool required. Without a key the legacy pattern applies: the image is
+ * replaced with a text instruction telling the model to call a vision MCP tool
+ * (default `pantheon_vision_vision_describe`). Either way the image never reaches
+ * the main provider, so text-only models cannot fail with an `image_url` error.
  *
- * All modules (Zeus, auto-wake, etc.) should access the board through this
- * function to ensure a single consistent state machine across the plugin.
+ * The canonical `pantheon-vision` MCP owns the standalone describe/OCR/analyze
+ * tools. The installed OpenCode plugin API exposes no stable pre-provider
+ * message hook (1.18.11 only exposes the experimental history transform), so
+ * that transform is retained as the runtime-compatible fallback. If a stable
+ * provider-bound hook is added, register the same sanitizer there instead of
+ * assuming this experimental hook is guaranteed to run.
+ *
+ * IMPORTANT (OpenCode 1.18.11 legacy loader): this module must export EXACTLY
+ * ONE function-valued export — the default plugin. The legacy loader does
+ * `Object.values(mod)` and invokes every function export as a plugin factory;
+ * any named function export (e.g. a re-exported helper like
+ * generateInjectionPrompt) is called with a PluginInput object and can throw.
+ * Helpers live in src/pantheon/vision.ts and are imported from there directly.
  */
-export function getBackgroundJobBoard(): BackgroundJobBoard {
-  return board
-}
+const plugin: Plugin = async (input: PluginInput) => {
+  const vision = createVisionHandler(input)
 
-export default {
-  name: 'pantheon',
-  version: '5.0.0',
-  description: 'Pantheon multi-agent orchestration platform',
-
-  hooks: {
+  return {
     config: async (config: PluginConfig) => {
       config.agentsPath = config.agentsPath ?? []
       config.agentsPath.push(new URL('./agents', import.meta.url).pathname)
-
       config.skillsPaths = config.skillsPaths ?? []
       config.skillsPaths.push(new URL('./skills', import.meta.url).pathname)
 
-      return config
+      // Apply the active model preset (`init --preset` / `set-tier` write
+      // .pantheon/active-preset.json): resolve it with the SAME candidate
+      // order the vision handler uses (project > XDG > HOME) and mutate the
+      // agent models / reasoning effort / fallback models + provider configs.
+      // Fail-safe: without an active preset the config is untouched; a missing
+      // provider key is logged and skipped — the hook must never break startup
+      // (set-tier already fail-fast validates keys at write time). Vision
+      // rotation stays in vision.ts, which resolves its model independently.
+      try {
+        const resolved = applyActivePresetToConfig(config, {
+          candidates: activePresetCandidates(),
+        })
+        if (resolved) {
+          console.log(
+            `[Pantheon Plugin] Applied model preset: ${resolved.name} (${resolved.source})`,
+          )
+        }
+      } catch {
+        // Fully STATIC warning — the thrown error object is tainted because
+        // presets.mjs constructs it with the provider's apiKeyEnv name (e.g.
+        // PANTHEON_OPENCODE_API_KEY), and CodeQL's clear-text logging dataflow
+        // flags ANY interpolation derived from it — including err.name and
+        // err.message. The env var name is not itself sensitive to log, but
+        // the scanner cannot distinguish it, so nothing derived from the error
+        // may appear here. Diagnostics (provider id + env var) are already
+        // emitted by applyActivePresetToConfig's own logger before it throws.
+        // The catch binding is intentionally omitted so no tainted value can
+        // ever reach this log line (CodeQL alert #11).
+        console.warn('[plugin] preset application failed (see logs for details)')
+      }
     },
-  },
-} satisfies PluginConfig
+    'chat.message': vision.chatMessage,
+    'experimental.chat.messages.transform': vision.messagesTransform,
+    event: vision.event,
+  }
+}
+
+export default plugin

package/src/plugins/hook-runner.ts

@@ -0,0 +1,186 @@
+/**
+ * hook-runner.ts — version-proof runner for the Pantheon security-hook layer.
+ *
+ * The previous plugin used the Bun Shell `$` injected by the opencode plugin
+ * API (`$.quiet().nothrow().timeout(...)`). `.timeout()` does not exist on the
+ * BunShell interface, so every hook crashed with a TypeError and the layer was
+ * removed (24-25/07). This runner uses ONLY `node:child_process` — stable
+ * across every Node >= 18 runtime and every opencode plugin loader version.
+ *
+ * Claude Code stdin protocol: the hook scripts receive
+ * `{tool_name, tool_input, agent_id, session_id}` as JSON on stdin. Scripts
+ * that read env vars instead (log-session-start.sh, on-subagent-delegation-*)
+ * get their fields mapped into the child env (SESSION_ID / AGENT_NAME /
+ * TASK_DESC) so both protocols work end to end.
+ *
+ * IMPORTANT (verified empirically): the `input:` option on the async
+ * `execFile()` API is silently ignored by Node — it only exists on
+ * spawnSync/execFileSync. This runner therefore writes stdin explicitly to a
+ * spawned child, which delivers the payload reliably.
+ *
+ * Hooks NEVER throw: every failure (missing script, timeout, non-zero exit)
+ * is returned as a structured HookResult so the opencode session can never be
+ * taken down by the security layer.
+ */
+import { spawn, type ChildProcessWithoutNullStreams } from 'node:child_process'
+import path from 'node:path'
+import type { Readable } from 'node:stream'
+import { fileURLToPath } from 'node:url'
+
+export const HOOK_TIMEOUT_MS = 15_000
+export const HOOK_MAX_BUFFER = 10 * 1024 * 1024
+
+/** Claude Code hook protocol payload. */
+export type HookPayload = {
+  tool_name?: string
+  tool_input?: unknown
+  agent_id?: string
+  session_id?: string
+}
+
+export type HookResult = {
+  code: number
+  stdout: string
+  stderr: string
+  signal: NodeJS.Signals | null
+  timedOut: boolean
+}
+
+export type RunHookOptions = {
+  env?: Record<string, string | undefined>
+  cwd?: string
+  timeout?: number
+}
+
+/**
+ * Resolve the hooks directory relative to this module — robust to any npm
+ * global-install prefix because it anchors on import.meta.url, not __dirname
+ * or process.cwd().
+ */
+export function resolveHooksDir(): string {
+  return fileURLToPath(new URL('../../scripts/hooks/', import.meta.url))
+}
+
+/**
+ * Map the Claude Code protocol payload into the child environment. Scripts
+ * that read env vars (log-session-start.sh, delegation audit scripts) rely on
+ * these; scripts that read stdin receive the full JSON via `input` in runHook.
+ * PATH is always preserved so `python3`/`bash` resolution inside the scripts
+ * is never affected by a stripped-down environment.
+ */
+export function hookEnv(
+  payload: HookPayload,
+  extra?: Record<string, string | undefined>,
+): NodeJS.ProcessEnv {
+  return {
+    ...process.env,
+    PATH: process.env.PATH ?? '',
+    SESSION_ID: payload.session_id ?? '',
+    AGENT_NAME: payload.agent_id ?? '',
+    TASK_DESC: payload.tool_name ?? '',
+    ...(extra ?? {}),
+  }
+}
+
+/**
+ * Run one hook script with the Claude Code protocol payload on stdin.
+ *
+ * @param script  file name inside scripts/hooks/ (e.g. "validate-tool-safety.sh")
+ * @param payload protocol payload translated from the opencode hook event
+ * @param opts    optional env overrides / cwd / timeout
+ * @returns      HookResult — NEVER throws; resolve with a non-zero code instead
+ */
+export function runHook(
+  script: string,
+  payload: HookPayload,
+  opts: RunHookOptions = {},
+): Promise<HookResult> {
+  const scriptPath = path.join(opts.cwd ?? resolveHooksDir(), script)
+  const timeout = opts.timeout ?? HOOK_TIMEOUT_MS
+
+  return new Promise<HookResult>((resolve) => {
+    const stdoutBuf: { value: string } = { value: '' }
+    const stderrBuf: { value: string } = { value: '' }
+    let settled = false
+
+    const settle = (result: HookResult) => {
+      if (!settled) {
+        settled = true
+        resolve(result)
+      }
+    }
+
+    const spawnOpts = {
+      timeout,
+      killSignal: 'SIGKILL' as const,
+      env: hookEnv(payload, opts.env),
+      // stdio:'pipe' is equivalent to ['pipe','pipe','pipe'] — it guarantees
+      // the child's stdin is OUR pipe, NEVER the opencode TUI's terminal
+      // (which would leave `cat`-style hooks blocked reading forever and hit
+      // the opencode core hook timeout).
+      stdio: 'pipe' as const,
+      windowsHide: true,
+      ...(opts.cwd !== undefined ? { cwd: opts.cwd } : {}),
+    }
+
+    // stdio:'pipe' picks the ChildProcessWithoutNullStreams overload — do not
+    // widen these option literals or child.stdin/stdout become nullable.
+    let child: ChildProcessWithoutNullStreams
+    try {
+      child = spawn(scriptPath, [], spawnOpts)
+    } catch (err) {
+      // Synchronous spawn failure (invalid args etc.) — never propagate.
+      settle({
+        code: 1,
+        stdout: '',
+        stderr: `spawn failed: ${err instanceof Error ? err.message : String(err)}`,
+        signal: null,
+        timedOut: false,
+      })
+      return
+    }
+
+    // The child may exit before we write stdin — swallow EPIPE instead of
+    // crashing the plugin process with an unhandled stream error.
+    child.stdin.on('error', () => {})
+
+    const collect = (stream: Readable, buf: { value: string }) => {
+      stream.setEncoding('utf-8')
+      stream.on('data', (chunk: string) => {
+        if (buf.value.length < HOOK_MAX_BUFFER) {
+          buf.value += chunk.slice(0, HOOK_MAX_BUFFER - buf.value.length)
+        }
+      })
+    }
+    collect(child.stdout, stdoutBuf)
+    collect(child.stderr, stderrBuf)
+
+    child.on('error', (err: NodeJS.ErrnoException) => {
+      // ENOENT / EACCES — script missing or not executable. Report, never throw.
+      settle({
+        code: 1,
+        stdout: stdoutBuf.value,
+        stderr: stderrBuf.value || `hook script failed to spawn: ${err.message}`,
+        signal: null,
+        timedOut: false,
+      })
+    })
+
+    child.on('close', (code, signal) => {
+      settle({
+        code: code ?? 1,
+        stdout: stdoutBuf.value,
+        stderr: stderrBuf.value,
+        signal,
+        timedOut: code === null && signal === 'SIGKILL',
+      })
+    })
+
+    // Deliver the Claude Code protocol JSON on stdin. stdin.end() runs
+    // UNCONDITIONALLY — even for an empty payload {} or a script that never
+    // reads stdin — so the child can never block waiting for input and hit
+    // the runtime hook timeout (reported as "Hook X timed out after 30000ms").
+    child.stdin.write(JSON.stringify(payload))
+    child.stdin.end()
+  })
+}

package/src/plugins/pantheon-hooks.ts

@@ -0,0 +1,153 @@
+/**
+ * pantheon-hooks.ts — Pantheon runtime security-hook plugin for OpenCode.
+ *
+ * Re-created per Council Synthesis 2026-08-05 (P0): the previous hook plugin
+ * was removed on 24-25/07 because it used the Bun Shell `$` from the plugin
+ * API, whose interface has NO `.timeout()` method — every hook crashed with
+ * `TypeError: $.quiet().nothrow().timeout is not a function`. The 10 functional
+ * scripts in scripts/hooks/ (gitleaks covers only staged files, NOT tool
+ * calls) were left orphaned. This plugin wires them back into the opencode
+ * runtime via `node:child_process` (version-proof — see hook-runner.ts).
+ *
+ * Hook mapping (Claude Code protocol payload {tool_name, tool_input,
+ * agent_id, session_id} delivered on the script stdin):
+ *   - tool.execute.before → validate-talos-scope.sh, scan-secrets.sh,
+ *     validate-tool-safety.sh + on-subagent-delegation-start.sh (only when the
+ *     tool is a delegation tool such as `task`, to keep the audit log honest)
+ *   - tool.execute.after  → format-multi-language.sh, log-session-start.sh +
+ *     on-subagent-delegation-stop.sh (delegation tool only)
+ *   - event session.created → log-session-start.sh, validate-post-conditions.sh
+ *
+ * Notes:
+ *   - `agent_id` is NOT present in the opencode tool.execute hook payloads
+ *     ({tool, sessionID, callID}), so it is passed as '' — validate-talos-scope
+ *     then takes its safe skip path; the agent-agnostic scan-secrets and
+ *     validate-tool-safety protections remain fully active.
+ *   - tool.execute hooks cannot hard-deny the tool call through this API
+ *     (the output only mutates args; real deny is the permission system), so
+ *     violations surface as stderr + non-zero exit codes logged below.
+ *   - Logging policy: non-zero exit → console.error (the security signal);
+ *     zero exit → SILENT by default. Audit scripts (log-session-start,
+ *     on-subagent-delegation-*) still write their log FILES (sessions.log,
+ *     delegations.log) from inside the .sh scripts — only the console echo is
+ *     suppressed so the chat/TUI stays clean. Set PANTHEON_HOOKS_LOG=1 (or
+ *     "debug") to re-enable the zero-exit console echo for debugging.
+ *     The env var is read once at plugin load time (opencode startup).
+ *   - Hooks NEVER throw: every body is try/catch'd and only logs.
+ *
+ * IMPORTANT (OpenCode 1.18.11 legacy loader): this module must export EXACTLY
+ * ONE function-valued export — the default plugin (see src/plugin.ts L47-52).
+ * Helpers live in ./hook-runner.ts and are imported from there.
+ */
+import type { Plugin } from '@opencode-ai/plugin'
+import { runHook, type HookPayload } from './hook-runner.ts'
+
+/** Tools that represent a subagent delegation (opencode `task` tool etc.). */
+const DELEGATION_TOOL_RE = /^(task|.*delegate.*|.*subagent.*)$/i
+
+/**
+ * When set to a truthy value ("1" or "debug"), zero-exit audit-hook output is
+ * echoed to the console (opt-in debugging). Default (unset): fully silent on
+ * success — the .sh scripts still persist their log FILES on disk; only the
+ * console echo is suppressed. Read at plugin load time.
+ */
+const AUDIT_LOG_ENABLED = (process.env.PANTHEON_HOOKS_LOG ?? '').trim() !== ''
+
+/** Scripts whose zero-exit stderr is relayed when PANTHEON_HOOKS_LOG is set. */
+const AUDIT_HOOKS = new Set([
+  'log-session-start.sh',
+  'on-subagent-delegation-start.sh',
+  'on-subagent-delegation-stop.sh',
+  'validate-post-conditions.sh',
+])
+
+function trim(s: string, max = 2000): string {
+  const t = s.trim()
+  return t.length > max ? `${t.slice(0, max)}…` : t
+}
+
+/** Translate the opencode hook event into the Claude Code protocol payload. */
+function payloadFor(
+  input: { tool: string; sessionID: string },
+  toolInput: unknown,
+): HookPayload {
+  return {
+    tool_name: input.tool,
+    tool_input: toolInput ?? {},
+    // tool.execute hooks carry no agent — '' lets talos-scope skip safely.
+    agent_id: (input as { agent?: { id?: string } }).agent?.id ?? '',
+    session_id: input.sessionID,
+  }
+}
+
+/** Run one hook with the logging policy; NEVER throw out of the hook. */
+async function safeRun(script: string, payload: HookPayload): Promise<void> {
+  try {
+    const result = await runHook(script, payload)
+    const tag = `[pantheon-hooks:${script}]`
+    if (result.code !== 0) {
+      console.error(
+        `${tag} exit ${result.code}${result.timedOut ? ' (timed out)' : ''}: ${trim(result.stderr || result.stdout || 'no output')}`,
+      )
+    } else if (AUDIT_LOG_ENABLED && AUDIT_HOOKS.has(script) && result.stderr.trim()) {
+      // Opt-in only (PANTHEON_HOOKS_LOG=1): audit scripts echo their FILE
+      // writes here for debugging. Default is silence — the .sh scripts
+      // already persist sessions.log / delegations.log on disk.
+      console.log(`${tag} ${trim(result.stderr)}`)
+    }
+  } catch (err) {
+    // runHook never throws, but the hook body must survive anything.
+    console.error(
+      `[pantheon-hooks:${script}] unexpected failure: ${err instanceof Error ? err.message : String(err)}`,
+    )
+  }
+}
+
+const plugin: Plugin = async () => {
+  return {
+    'tool.execute.before': async (input, output) => {
+      try {
+        const payload = payloadFor(input, output.args ?? {})
+        const hooks = [
+          'validate-talos-scope.sh',
+          'scan-secrets.sh',
+          'validate-tool-safety.sh',
+        ]
+        if (DELEGATION_TOOL_RE.test(input.tool)) {
+          hooks.push('on-subagent-delegation-start.sh')
+        }
+        await Promise.all(hooks.map((script) => safeRun(script, payload)))
+      } catch {
+        // Never let a hook take down the opencode session.
+      }
+    },
+    'tool.execute.after': async (input) => {
+      try {
+        const payload = payloadFor(input, input.args ?? {})
+        const hooks = ['format-multi-language.sh']
+        if (DELEGATION_TOOL_RE.test(input.tool)) {
+          hooks.push('on-subagent-delegation-stop.sh')
+        }
+        await Promise.all(hooks.map((script) => safeRun(script, payload)))
+      } catch {
+        // Never let a hook take down the opencode session.
+      }
+    },
+    event: async ({ event: ev }) => {
+      try {
+        if (ev.type === 'session.created') {
+          const payload: HookPayload = { session_id: ev.properties.info.id }
+          await Promise.all(
+            ['log-session-start.sh', 'validate-post-conditions.sh'].map((script) =>
+              safeRun(script, payload),
+            ),
+          )
+        }
+      } catch {
+        // Never let a hook take down the opencode session.
+      }
+    },
+  }
+}
+
+export default plugin

package/src/plugins/tui/dist/tui.d.ts

@@ -5,4 +5,4 @@ declare const plugin: TuiPluginModule & {
 };
 //#endregion
 export { plugin as default };
-//# sourceMappingURL=tui.d.ts.map
+//# sourceMappingURL=tui.d.ts.map

package/src/plugins/tui/dist/tui.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tui.d.ts","names":[],"sources":["../src/index.tsx"],"mappings":";;cAsbM,QAAQ;EAAoB"}
+{"version":3,"file":"tui.d.ts","names":[],"sources":["../src/index.tsx"],"mappings":";;cA8qCM,QAAQ;EAAoB"}