pantheon-opencode 1.2.0 → 1.2.2

package/scripts/secret-scan.mjs

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+
+/** Scan versionable files without printing secret values. */
+
+import { execFileSync } from 'node:child_process'
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const bifrostHeader = ['x', '-bf-', 'vk'].join('')
+const bifrostTokenPrefix = ['sk', '-bf-'].join('')
+const apiKeyName = ['api', 'Key'].join('')
+const authorizationName = ['Author', 'ization'].join('')
+
+const escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+
+// Files that may reference credential PATTERN NAMES (not values): gitleaks
+// config, security policy, scan tooling and its fixtures. Keep in sync with
+// the [allowlist] paths in .gitleaks.toml.
+export const allowlistedFiles = new Set([
+  '.gitleaks.toml',
+  '.gitleaksignore',
+  'SECURITY.md',
+  'scripts/secret-scan.mjs',
+  'tests/test_secret_scan.mjs',
+])
+
+const patterns = [
+  { label: 'Bifrost credential header', regex: new RegExp(escapeRegExp(bifrostHeader), 'i') },
+  {
+    label: 'Bifrost credential value',
+    regex: new RegExp(`${escapeRegExp(bifrostTokenPrefix)}[A-Za-z0-9_-]{8,}`, 'i'),
+  },
+  {
+    label: 'literal API key value',
+    regex: new RegExp(
+      `["']${escapeRegExp(apiKeyName)}["']\\s*[:=]\\s*["'](?!\\$\\{|process\\.env|os\\.getenv|env:)[^"']{12,}["']`,
+      'i',
+    ),
+  },
+  {
+    label: 'literal Authorization bearer value',
+    regex: new RegExp(
+      `["']${escapeRegExp(authorizationName)}["']\\s*[:=]\\s*["']Bearer\\s+[A-Za-z0-9._-]{12,}["']`,
+      'i',
+    ),
+  },
+]
+
+export function scanText(text, file = '<text>') {
+  return patterns.filter(({ regex }) => regex.test(text)).map(({ label }) => ({ file, label }))
+}
+
+export function versionableFiles() {
+  return execFileSync('git', ['ls-files', '-z', '--cached', '--others', '--exclude-standard'], {
+    encoding: 'buffer',
+  })
+    .toString()
+    .split('\0')
+    .filter(Boolean)
+}
+
+export function scanVersionableFiles() {
+  const findings = []
+  for (const file of versionableFiles()) {
+    if (allowlistedFiles.has(file)) continue
+    let text
+    try {
+      const content = readFileSync(file)
+      if (content.includes(0)) continue
+      text = content.toString('utf8')
+    } catch {
+      continue
+    }
+    findings.push(...scanText(text, file))
+  }
+  return findings
+}
+
+if (fileURLToPath(import.meta.url) === resolve(process.argv[1])) {
+  const findings = scanVersionableFiles()
+  if (findings.length > 0) {
+    for (const finding of findings) console.error(`[SECRET SCAN] ${finding.file}: ${finding.label}`)
+    process.exitCode = 1
+  } else {
+    console.log('Secret scan passed: no versionable Bifrost/API credentials detected.')
+  }
+}

package/scripts/uninstall.mjs

@@ -36,14 +36,14 @@ const PANTHEON_AGENT_NAMES = [
   'themis',
   'prometheus',
   'hephaestus',
-  
-  
+
+
   'nyx',
   'gaia',
   'iris',
   'mnemosyne',
   'talos',
-  
+
 ]
 
 const PLATFORM_LABELS = {

package/scripts/validate-routing.mjs

@@ -18,6 +18,7 @@ import { existsSync, readdirSync, readFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import yaml from 'js-yaml'
+import { validatePresetDefs } from '../src/pantheon/presets.mjs'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const ROOT = join(__dirname, '..')
@@ -150,6 +151,20 @@ for (const [name, info] of Object.entries(routing.agents || {})) {
   }
 }
 
+// F. Model preset validation
+const presetDefs = routing.presets || {}
+console.log(`\n  Model presets: ${Object.keys(presetDefs).length} defined`)
+
+const presetKnownAgents = routingAgents.filter((a) => a !== 'zen' && a !== 'zeus_copilot')
+const presetValidation = validatePresetDefs(presetDefs, { agents: presetKnownAgents })
+for (const err of presetValidation.errors) {
+  check(false, `Preset ${err}`)
+}
+for (const w of presetValidation.warnings) {
+  warn(`Preset ${w}`)
+}
+console.log(`  Presets defined: ${Object.keys(presetDefs).length}`)
+
 // Summary
 console.log(`\n${'='.repeat(50)}`)
 const status = failures === 0 ? '✅ PASSED' : `❌ FAILED (${failures}/${checks} checks failed)`

package/scripts/version-check.mjs

@@ -0,0 +1,146 @@
+#!/usr/bin/env node
+/**
+ * version-check.mjs — Single source of truth enforcement
+ *
+ * package.json is the SOURCE OF TRUTH for the Pantheon version.
+ * Every other manifest (pyproject.toml, plugin.json, src/plugins/tui/package.json)
+ * MUST carry the same version. This script:
+ *
+ *   - compares every manifest against package.json and prints a divergence
+ *     table when they differ (exit code 1),
+ *   - with --fix, rewrites each divergent manifest to the package.json version.
+ *
+ * Mirrors the MANIFEST_FILES list in scripts/versioning.mjs so `apply`
+ * and `check` can never drift apart.
+ *
+ * Usage:
+ *   node scripts/version-check.mjs          # verify (exit 0 = in sync)
+ *   node scripts/version-check.mjs --fix    # sync all manifests
+ */
+
+import { readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+/** Same set of manifests as versioning.mjs (minus package.json itself). */
+export const MANIFESTS = [
+  { name: 'pyproject.toml', file: 'pyproject.toml', kind: 'toml' },
+  { name: 'plugin.json', file: 'plugin.json', kind: 'json' },
+  { name: 'src/plugins/tui/package.json', file: join('src', 'plugins', 'tui', 'package.json'), kind: 'json' },
+]
+
+function readTomlVersion(filePath) {
+  const text = readFileSync(filePath, 'utf-8')
+  const match = text.match(/^version\s*=\s*"([^"]+)"/m)
+  if (!match) throw new Error(`no version field in ${filePath}`)
+  return match[1]
+}
+
+function readJsonVersion(filePath) {
+  return JSON.parse(readFileSync(filePath, 'utf-8')).version
+}
+
+function readManifestVersion(filePath, kind) {
+  try {
+    return kind === 'toml' ? readTomlVersion(filePath) : readJsonVersion(filePath)
+  } catch {
+    return null
+  }
+}
+
+function writeManifestVersion(filePath, kind, version) {
+  if (kind === 'toml') {
+    const text = readFileSync(filePath, 'utf-8')
+    const updated = text.replace(/^(version\s*=\s*")[^"]+(")/m, `$1${version}$2`)
+    writeFileSync(filePath, updated)
+  } else {
+    const content = JSON.parse(readFileSync(filePath, 'utf-8'))
+    content.version = version
+    writeFileSync(filePath, `${JSON.stringify(content, null, 2)}\n`)
+  }
+}
+
+/**
+ * Compare every manifest version against package.json (source of truth).
+ *
+ * @param {string} root - repository root containing package.json + manifests
+ * @returns {{source: string, manifests: Array<{name: string, version: string|null, ok: boolean}>, ok: boolean}}
+ *   - source: version read from package.json
+ *   - manifests: per-manifest {name, version (null when unreadable), ok}
+ *   - ok: true when every manifest matches the source version
+ */
+export function compareVersions(root) {
+  const source = JSON.parse(readFileSync(join(root, 'package.json'), 'utf-8')).version
+  const manifests = MANIFESTS.map(({ name, file, kind }) => {
+    const version = readManifestVersion(join(root, file), kind)
+    return { name, version, ok: version === source }
+  })
+  return { source, manifests, ok: manifests.every((m) => m.ok) }
+}
+
+/**
+ * Rewrite every divergent manifest to the package.json version.
+ *
+ * @param {string} root - repository root
+ * @returns {number} count of manifests rewritten
+ */
+export function syncToSource(root) {
+  const { source, manifests } = compareVersions(root)
+  let changed = 0
+  for (const manifest of manifests) {
+    if (manifest.ok) continue
+    const def = MANIFESTS.find((m) => m.name === manifest.name)
+    writeManifestVersion(join(root, def.file), def.kind, source)
+    changed += 1
+  }
+  return changed
+}
+
+function printDivergenceTable(result) {
+  const rows = [
+    ['manifest', 'version', 'status'],
+    ...result.manifests.map((m) => [m.name, m.version ?? 'MISSING', m.ok ? 'ok' : 'DIVERGENT']),
+  ]
+  const widths = rows[0].map((_, i) => Math.max(...rows.map((row) => row[i].length)))
+  console.log(`Source of truth: package.json → v${result.source}\n`)
+  for (const row of rows) {
+    console.log(row.map((cell, i) => cell.padEnd(widths[i])).join('  '))
+  }
+  console.log('')
+}
+
+const isDirectRun =
+  process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href
+
+if (isDirectRun) {
+  // npm scripts run from the package root, so the working directory is the
+  // repository root to check. Explicit cwd keeps the CLI testable.
+  const root = process.cwd()
+  const fix = process.argv.includes('--fix')
+  let result
+  try {
+    result = compareVersions(root)
+  } catch (error) {
+    console.error(`version-check: cannot read package.json — ${error.message}`)
+    process.exit(1)
+  }
+
+  if (result.ok) {
+    console.log(`✓ All manifests match package.json v${result.source}`)
+    process.exit(0)
+  }
+
+  printDivergenceTable(result)
+  if (fix) {
+    const changed = syncToSource(root)
+    const after = compareVersions(root)
+    if (after.ok) {
+      console.log(`✓ Synced ${changed} manifest(s) to v${after.source}`)
+      process.exit(0)
+    }
+    console.error(`version-check: sync incomplete — ${after.manifests.filter((m) => !m.ok).length} manifest(s) still divergent`)
+    process.exit(1)
+  }
+  console.error('version-check: manifests out of sync (run with --fix to sync)')
+  process.exit(1)
+}

package/scripts/versioning.mjs

@@ -29,7 +29,7 @@ const MANIFEST_FILES = [
   'pyproject.toml',
   'package.json',
   'plugin.json',
-  '.github/plugin/plugin.json',
+  'src/plugins/tui/package.json',
 ]
 
 const CHANGELOG_PATH = join(ROOT, 'CHANGELOG.md')
@@ -47,8 +47,11 @@ function run(cmd) {
 }
 
 function getLatestTag() {
-  // Use numerically highest tag, not just nearest git ancestor
-  const tag = run("git tag -l 'v[0-9]*.[0-9]*.[0-9]*' | sort -V | tail -1")
+  // Stable tags only: strict vX.Y.Z with NO pre-release suffix.
+  // The loose glob `v[0-9]*.[0-9]*.[0-9]*` ALSO matches v1.2.0-beta.9.*
+  // (the trailing `*` swallows the -beta suffix), which would poison the
+  // version gate — so filter strictly before sorting.
+  const tag = run("git tag -l 'v*' | grep -E '^v[0-9]+\\.[0-9]+\\.[0-9]+$' | sort -V | tail -1")
   return tag || 'v0.0.0'
 }
 
@@ -207,13 +210,15 @@ switch (command) {
     const latestVer = latestTag.replace(/^v/, '')
 
     // If package.json is already ahead of the latest tag, someone bumped
-    // without tagging — warn and use the current version as-is.
+    // without tagging — warn and use the current version as-is. Tags are
+    // workflow-owned, so there is nothing to create here.
     if (current !== latestVer) {
       console.log(`⚠ package.json (${current}) already ahead of latest tag (${latestTag}).`)
       console.log(`  Syncing all manifests to ${current} and promoting CHANGELOG.`)
       updateManifests(current)
       const date = new Date().toISOString().slice(0, 10)
       promoteUnreleased(current, date)
+      console.log(`Tag v${current} will be created by the release workflow after merge to main.`)
       break
     }
 
@@ -226,16 +231,10 @@ switch (command) {
     promoteUnreleased(newVersion, date)
     console.log(`\nDone. Commit with: git add -A && git commit -m "chore(release): v${newVersion}"`)
 
-    // Create git tag
-    try {
-      const tag = `v${newVersion}`
-      execSync(`git tag -a ${tag} -m "chore(release): ${tag}"`, { stdio: 'inherit' })
-      console.log(`Tag ${tag} created locally. Push: git push origin ${tag}`)
-      console.log(`Auto-release will trigger on main after merge.`)
-    } catch (e) {
-      console.warn(`Tag creation failed: ${e.message}`)
-      console.log('Create manually: git tag -a v' + newVersion + ' -m "chore(release): v' + newVersion + '"')
-    }
+    // Tags are owned by the release workflow — never create them locally.
+    // A local tag on a pre-merge commit drifts from the merged main state
+    // (the untagged-v1.2.1 root cause) and would desync the version gate.
+    console.log(`Tag v${newVersion} will be created by the release workflow after merge to main.`)
     break
   }
 

package/src/agents/hermes.md

@@ -50,7 +50,7 @@ permission:
 
 You are the **BACKEND TASK IMPLEMENTER** (Hermes) called by Zeus to implement FastAPI endpoints, services, and routers. Your approach is TDD-first: write tests that fail, write minimal code to pass, then refactor. You focus purely on implementation following provided plans.
 
-## Core Capabilities 
+## Core Capabilities
 
 ### 1. **Test-Driven Development**
 See `skill: tdd-with-agents` for the full TDD cycle.
@@ -67,7 +67,7 @@ See `skill: tdd-with-agents` for the full TDD cycle.
 - Return clear, structured results
 - Report readiness for next phase
 
-### 4. **Parallel Execution Mode** 
+### 4. **Parallel Execution Mode**
 - **You can run simultaneously with @aphrodite and @demeter** when scopes don't overlap
 - Your scope: backend files only (routers, services, tests)
 - Signal clearly when your phase is done so Themis can review

package/src/agents/mnemosyne.md

@@ -98,7 +98,7 @@ Mnemosyne executes the expanded compression pipeline. When Zeus delegates compre
 
 5. **Archive IMPL/REVIEW**: Append to `02-progress-log.md` (same as Level 1)
 
-6. **Update Cross-References**: 
+6. **Update Cross-References**:
    - Append new entries to `_xref/index.md`
    - Increment `_xref/_next_id.json`
 

package/src/agents/zeus.md

@@ -81,7 +81,7 @@ Antes de usar a arvore de roteamento, consulte o memory:
 
 ```
 memory_search(task_prompt, top_k=2)
-  → score > 0.85? 
+  → score > 0.85?
     SIM → usa resultado cacheado (agent, background, pattern)
     NAO → aplica arvore de roteamento + memory_store() pra proxima vez
 ```

package/src/mcp/_pantheon_paths.py

@@ -63,5 +63,3 @@ def pantheon_project() -> Path | None:
         return Path(cwd).resolve()
 
     return None
-
-