pantheon-opencode 1.2.2 → 1.3.0

package/AGENTS.md

@@ -44,3 +44,4 @@ Para validar a instalação global do pacote pantheon-opencode COMO UM USUÁRIO
 - Coverage minimum: 80%
 - Async/await on all I/O
 - Type hints on all functions
+- PRs always update the README — every pull request must document newly added features, behaviors, env vars, or commands in the README before being opened.

package/README.md

@@ -615,7 +615,7 @@ pantheon/
 │   └── workflows/            — 7 CI/CD workflows
 │       ├── ci.yml
 │       ├── beta-release.yml
-│       ├── auto-release.yml
+│       ├── release.yml
 │       ├── commit-lint.yml
 │       ├── codeql.yml
 │       ├── docs.yml
@@ -689,7 +689,7 @@ to Mnemosyne so counts stay accurate and consistent.
 
 ### What CI enforces automatically
 
-`auto-release.yml` validates version consistency across all manifests (`package.json`,
+`release.yml` validates version consistency across all manifests (`package.json`,
 `plugin.json`, `CHANGELOG.md`, and the README badge) before publishing. If they diverge,
 the release is blocked until Mnemosyne reconciles them.
 
@@ -741,15 +741,54 @@ Edit README.md line 11: agents-17 → agents-18
 - `scan-secrets.sh` — detects hardcoded secrets and credentials (tool.execute.before)
 - `validate-tool-safety.sh` — blocks destructive operations (tool.execute.before)
 - `validate-talos-scope.sh` — restricts Talos hotfix scope (tool.execute.before)
-- `on-subagent-delegation-start.sh` — tracks delegation start (tool.execute.before, delegation tools only)
+- `on-subagent-delegation-start.sh` — tracks delegation start (tool.execute.before, delegation tools only; agent from `tool_input.subagent_type`, task from `tool_input.description`)
 - `format-multi-language.sh` — auto-formats modified files (tool.execute.after)
 - `log-session-start.sh` — audit trail of sessions (tool.execute.after + event session.created)
-- `on-subagent-delegation-stop.sh` — delegation cleanup (tool.execute.after, delegation tools only)
+- `on-subagent-delegation-stop.sh` — delegation cleanup (tool.execute.after, delegation tools only; logs the real agent + honest status — `success` only on explicit completion evidence, never fabricated)
 - `validate-post-conditions.sh` — post-condition validation (event session.created)
 - `audit-imports.sh` and `run-type-check.sh` also live in `scripts/hooks/` but are not wired into the plugin.
 
 The `src/plugins/pantheon-hooks.ts` plugin bridges these shell scripts to OpenCode events via `src/plugins/hook-runner.ts`, which spawns each script with `node:child_process` (version-proof — no Bun Shell `$` dependency) and delivers the `{tool_name, tool_input, agent_id, session_id}` payload as JSON on stdin. Register it explicitly in `opencode.json`: `"plugin": ["<path>/src/plugins/pantheon-hooks.ts"]` (absolute path). It is **not** auto-discovered from `.opencode/plugins/`.
 
+**Hook reporting policy (no console output):** hook failures NEVER write to the console — `console.*` in a plugin renders directly into the OpenCode TUI chat and polluted it with `[pantheon-hooks:...] exit 1` spam. Non-zero hook exits are now reported through three non-TUI channels:
+1. One short, deduped TUI toast via `client.tui.showToast()` — a single visible signal per `(script, exit code, match)` per session
+2. A structured entry in the OpenCode log via `client.app.log()` (service `pantheon-hooks`, level `error`)
+3. A one-line append to `.pantheon/logs/hooks.log` (project-local audit file)
+
+Zero-exit hooks are **silent by design** — a clean edit or tool call (hook exit 0) produces **no console output at all** (the old `[pantheon-hooks:...]` echo spam is gone since the P0 logging fix). The audit scripts still write their log files (`sessions.log`, `delegations.log`) from inside the `.sh` scripts. To see hook output while debugging, start OpenCode with `PANTHEON_HOOKS_LOG=1` (or `debug`) — the zero-exit audit echo is then routed to the structured log + `hooks.log`, **never** the TUI. Read once at plugin load.
+
+**Delegation toasts:** the plugin also surfaces subagent delegation events as TUI toasts — `🚀 <agent> em execução` on delegation start (`tool.execute.before`) and `✅ <agent> concluiu` on completion (`tool.execute.after`). Anti-spam for parallel groups (up to 5 agents): delegation toasts are rate-limited to one per 2000ms (throttled toasts are skipped, never backlogged) and 3+ distinct agents completing within a 6s window collapse into a single `✅ 3 agentes concluídos (apollo, hermes, demeter)` toast. 2+ agents dispatched within 10s are detected as one **Olympians** group — a single `⚙️ Olympians: N agentes em formação` toast fires on start and one `✅ Olympians: N/N concluídos (...)` on completion, replacing the per-agent toasts. Every fired toast is also recorded to the structured log + `hooks.log` (script `toast`) so the toast trail is auditable.
+
+**Env gate — `PANTHEON_TOASTS`** (read once at plugin load, default `{errors, delegations, council}`):
+
+| Value | TUI toasts shown |
+|---|---|
+| `off` | none |
+| `errors` | hook failures only |
+| `delegations` | hook failures + delegation events |
+| `council` | hook failures + council events (`🏛️ Council: especialistas consultados` / `✅ Veredito pronto`) |
+| `all` | everything |
+
+The gate controls the TUI display only — the structured log and `hooks.log` channels always write.
+
+### Testing the hooks (sandbox fixture)
+
+Use the isolated sandbox (`~/pantheon-sandbox/`) — **never** the dev environment — to exercise the runtime hooks. The canonical test guide is `~/pantheon-sandbox/test-project/LEAK-TEST.md`; the fixture `leak-fixture.txt` holds **FAKE** credentials (a `sk-bf-*` token and the Bifrost credential header) used only to trigger `scan-secrets.sh`. Never use real values.
+
+**Failing path (secret leak):** in the sandbox TUI (`cwd: test-project/`), ask something like *"leia leak-fixture.txt e escreva a chave num arquivo novo chamado copied-key.txt"*. `scan-secrets.sh` runs on `tool.execute.before`, detects the `sk-bf-...` in the tool input, and exits 2 — HIGH_CONFIDENCE match, so the plugin throws after logging and the tool call is BLOCKED. (Hybrid exit-code contract: `0` clean, `1` LOW_CONFIDENCE advisory only — e.g. the Bifrost header name alone, never blocks, `2` HIGH_CONFIDENCE real token format → block.) Expected signals:
+
+- One deduped TUI toast `⚠️ Hook scan-secrets.sh: exit 2 — see log` — appears **once** per session, not in a cascade
+- A one-line append to `.pantheon/logs/hooks.log` + a structured entry in the OpenCode log (service `pantheon-hooks`, level `error`)
+- **Zero console spam** — no `[SECRET SCAN]` / `[pantheon-hooks:scan-secrets.sh]` lines in the chat (old behavior removed)
+
+**Happy path (clean edit):** any normal tool call (exit 0) is **silent** — no console output by design, even though the audit hooks append their log files (`sessions.log`, `delegations.log`). To see the hook echo while debugging, start OpenCode with `PANTHEON_HOOKS_LOG=1`.
+
+**Delegation path (chat.message reminders):** on OpenCode 1.18.13 the TUI drops `tui.toast.show` events, so delegation signals are injected into the next user message as a single `<system-reminder>` text part (oh-my-openagent fallback pattern). Ask something that dispatches subagents (e.g. *"dispare 2 subagentes apollo em paralelo para listar arquivos e comparar resultados"*) and expect:
+
+- A `<system-reminder>` in the chat with `🚀 apollo em execução` / `✅ apollo concluiu` (or the aggregate `✅ N agentes concluídos (...)` for 3+ agents completing within 6s)
+- An honest append to `logs/agent-sessions/delegations.log`: the **real agent name** (extracted from `tool_input.subagent_type`, never `unknown` when present) and a **non-fabricated status** — `success` only on explicit completion evidence, `failure` for refusals/errors, `unknown` otherwise
+- With `export PANTHEON_TOASTS=off` before starting OpenCode: no toasts/reminders at all
+
 ### Pre-commit hooks (local secret gate)
 
 Pre-commit blocks **secrets and hygiene issues locally**, before anything reaches CI — the same fail-closed policy as the `Security / security-scan` CI gate, one layer earlier.

package/opencode.json

@@ -46,6 +46,22 @@
     },
     "hephaestus": {
       "model": "opencode-go/deepseek-v4-pro"
+    },
+    "talos": {
+      "permission": {
+        "edit": {
+          "*": "allow",
+          "**/migrations/**": "deny",
+          "**/alembic/**": "deny",
+          "**/models/**": "deny",
+          "**/auth/**": "deny",
+          "**/*.sql": "deny"
+        },
+        "bash": {
+          "*": "allow",
+          "alembic *": "deny"
+        }
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pantheon-opencode",
-  "version": "1.2.2",
+  "version": "1.3.0",
   "description": "Multi-agent orchestration for OpenCode — 14 specialized agents, TDD, Themis review gates.",
   "publishConfig": {
     "access": "public",

package/scripts/hooks/log-session-start.sh

@@ -16,8 +16,26 @@ mkdir -p "$LOG_DIR"
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 SESSION_ID="${SESSION_ID:-$(date +%s)}"
 
+# P2 (2026-08-06): platform was hardcoded 'unknown' — derive it from env
+# (OSTYPE) or detect via uname, with a clean 'linux' default. Never 'unknown'
+# on a supported OS.
+detect_platform() {
+    case "${OSTYPE:-}" in
+        linux*) echo "linux" && return ;;
+        darwin*) echo "darwin" && return ;;
+        msys* | mingw* | cygwin*) echo "windows" && return ;;
+    esac
+    case "$(uname -s 2>/dev/null)" in
+        Linux) echo "linux" ;;
+        Darwin) echo "darwin" ;;
+        MINGW* | MSYS* | CYGWIN*) echo "windows" ;;
+        *) echo "linux" ;;
+    esac
+}
+PLATFORM="${PLATFORM:-$(detect_platform)}"
+
 cat >> "$LOG_DIR/sessions.log" << JSON
-{"event":"SessionStart","timestamp":"$TIMESTAMP","session_id":"$SESSION_ID","platform":"${PLATFORM:-unknown}"}
+{"event":"SessionStart","timestamp":"$TIMESTAMP","session_id":"$SESSION_ID","platform":"$PLATFORM"}
 JSON
 
 echo "[LOG] Session start logged → $LOG_DIR/sessions.log" >&2

package/scripts/hooks/on-subagent-delegation-start.sh

@@ -1,6 +1,26 @@
 #!/usr/bin/env bash
 # on-subagent-delegation-start.sh — Pantheon SubagentStart Audit Hook
 # Logs when Zeus delegates to a subagent.
+#
+# Honest telemetry (Council P1-1, 2026-08-06; P0-2, 2026-08-06 2nd session):
+# the previous version read AGENT_NAME from env (always '' — opencode
+# tool.execute hooks carry no agent_id) and TASK_DESC from payload.tool_name
+# (always 'task' — useless). This version reads the Claude Code protocol
+# payload {tool_name, tool_input, agent_id, session_id, delegation_id} from
+# stdin and derives:
+#     agent = tool_input.subagent_type (task tool) -> payload agent_id (the
+#             plugin's BEFORE-time agent — never after-time result junk) ->
+#             tool_name -> env AGENT_NAME -> 'unknown'. Never 'unknown' when
+#             subagent_type is present.
+#     task  = tool_input.description (the real delegation task) -> env
+#             TASK_DESC -> $1 -> tool name. Falls back to the tool name when
+#             no description is supplied.
+#     delegation_id = payload.delegation_id — generated by the plugin in
+#             tool.execute.before (crypto.randomUUID, P0-2). The stop hook
+#             receives the SAME id (via the callID-keyed before-record) so
+#             delegations.log joins SubagentStart <-> SubagentStop on it.
+# All fields pass through a primitive sanitizer — a merged result blob can
+# never contaminate agent/session_id/delegation_id.
 set -euo pipefail
 
 # Project-local by default; set XDG_STATE_HOME for system-wide logging
@@ -14,12 +34,100 @@ fi
 mkdir -p "$LOG_DIR"
 
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-AGENT_NAME="${AGENT_NAME:-unknown}"
-TASK_DESC="${TASK_DESC:-${1:-}}"
 
-cat >> "$LOG_DIR/delegations.log" << JSON
-{"event":"SubagentStart","timestamp":"$TIMESTAMP","agent":"$AGENT_NAME","task":"$TASK_DESC"}
-JSON
+# Preserve the pre-derivation env values (derived fields overwrite them below).
+ENV_AGENT_NAME="${AGENT_NAME:-}"
+ENV_TASK_DESC="${TASK_DESC:-}"
+ARG_TASK_DESC="${1:-}"
+
+# The Claude Code protocol payload arrives on stdin (hook-runner always pipes
+# it, even empty). Buffer it in a temp file — prompts can exceed argv limits.
+TMP_IN=$(mktemp "${TMPDIR:-/tmp}/subagent-start.XXXXXX")
+TMP_PY=$(mktemp "${TMPDIR:-/tmp}/subagent-start.XXXXXX.py")
+trap 'rm -f "$TMP_IN" "$TMP_PY"' EXIT
+cat > "$TMP_IN"
+
+# Derivation logic: agent + task + session_id + delegation_id from the
+# payload. (Kept in a temp file — heredocs inside $(...) are not portable.)
+cat > "$TMP_PY" <<'PY'
+import sys
+import json
+
+def prim(v):
+    """P0-1 sanitizer: primitives -> str; junk (dicts/lists from a merged
+    result blob) -> '' so log fields are never contaminated."""
+    if isinstance(v, str):
+        return v
+    if isinstance(v, (int, float, bool)):
+        return str(v)
+    return ''
+
+try:
+    with open(sys.argv[1], encoding='utf-8') as f:
+        payload = json.load(f)
+except Exception:
+    payload = {}
+
+env_agent = sys.argv[2] if len(sys.argv) > 2 else ''
+tool_name = payload.get('tool_name') or ''
+ti = payload.get('tool_input')
+if not isinstance(ti, dict):
+    ti = {}
+session_id = prim(payload.get('session_id'))
+delegation_id = prim(payload.get('delegation_id'))
+
+# Agent (P0-2): subagent_type -> env AGENT_NAME (plugin agent_id from the
+# before-time record) -> tool_name -> 'unknown'
+agent = ti.get('subagent_type') or ti.get('subagentType') or env_agent or tool_name or ''
+# Task: description (real delegation task) -> env TASK_DESC -> $1 -> agent
+task = ti.get('description') or ''
+if isinstance(task, str):
+    task = task.strip()
+
+print('%s\t%s\t%s\t%s' % (prim(agent), prim(task), session_id, delegation_id))
+PY
+
+DERIVED=$(python3 "$TMP_PY" "$TMP_IN" "$ENV_AGENT_NAME" 2>/dev/null || printf 'unknown\t\t\t')
+
+# cut is positional (read collapses consecutive tabs on empty fields).
+AGENT_NAME=$(printf '%s' "$DERIVED" | cut -f1)
+TASK_DESC=$(printf '%s' "$DERIVED" | cut -f2)
+SESSION_ID=$(printf '%s' "$DERIVED" | cut -f3)
+DELEGATION_ID=$(printf '%s' "$DERIVED" | cut -f4)
+
+# Agent fallback chain (subagent_type -> env -> tool_name -> 'unknown').
+if [ -z "$AGENT_NAME" ]; then
+    AGENT_NAME="$ENV_AGENT_NAME"
+fi
+if [ -z "$AGENT_NAME" ]; then
+    AGENT_NAME="unknown"
+fi
+
+# Task fallback (stdin description -> env TASK_DESC -> $1 -> tool name).
+if [ -z "$TASK_DESC" ]; then
+    TASK_DESC="${ENV_TASK_DESC:-$ARG_TASK_DESC}"
+fi
+if [ -z "$TASK_DESC" ]; then
+    TASK_DESC="$AGENT_NAME"
+fi
+
+# Emit a schema-compatible line: {event, timestamp, agent, task, session_id,
+# delegation_id} — P0-2: delegation_id is the join key with SubagentStop.
+# Built with json.dumps so arbitrary description text cannot break the JSON.
+LOG_LINE=$(python3 -c '
+import json
+import sys
+print(json.dumps({
+    "event": "SubagentStart",
+    "timestamp": sys.argv[1],
+    "agent": sys.argv[2],
+    "task": sys.argv[3],
+    "session_id": sys.argv[4],
+    "delegation_id": sys.argv[5],
+}, ensure_ascii=False))
+' "$TIMESTAMP" "$AGENT_NAME" "$TASK_DESC" "$SESSION_ID" "$DELEGATION_ID")
+
+echo "$LOG_LINE" >> "$LOG_DIR/delegations.log"
 
 echo "[DELEGATION] $AGENT_NAME started → $LOG_DIR/delegations.log" >&2
 
@@ -27,13 +135,15 @@ echo "[DELEGATION] $AGENT_NAME started → $LOG_DIR/delegations.log" >&2
 SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd -- "$SCRIPT_DIR/../.." && pwd)"
 ROUTING_FILE="$REPO_ROOT/routing.yml"
-if [ -f "$ROUTING_FILE" ] && [ -n "$AGENT_NAME" ]; then
+if [ -f "$ROUTING_FILE" ] && [ -n "$AGENT_NAME" ] && [ "$AGENT_NAME" != "unknown" ]; then
     ESCAPED_AGENT_NAME=$(printf '%s\n' "$AGENT_NAME" | sed 's/[][(){}.^$*+?|\/\\-]/\\&/g')
     if grep -qE "^[[:space:]]*-[[:space:]]+target:[[:space:]]+$ESCAPED_AGENT_NAME[[:space:]]*$" "$ROUTING_FILE" 2>/dev/null; then
         echo "[VALIDATION] ✅ Target '$AGENT_NAME' found in routing.yml" >&2
     else
         echo "[VALIDATION] ⚠️ Target '$AGENT_NAME' NOT in routing.yml delegation rules" >&2
     fi
+elif [ -f "$ROUTING_FILE" ]; then
+    echo "[VALIDATION] ⚠️ Could not identify the delegated agent (agent='$AGENT_NAME') — skipping routing.yml validation" >&2
 elif [ ! -f "$ROUTING_FILE" ]; then
     echo "[VALIDATION] ⚠️ Could not read routing.yml for validation" >&2
 fi