pantheon-opencode 1.3.3 → 1.3.5-beta.52.c75b04d

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pantheon-opencode",
-  "version": "1.3.3",
+  "version": "1.3.5-beta.52.c75b04d",
   "description": "Multi-agent orchestration for OpenCode — 14 specialized agents, TDD, Themis review gates.",
   "publishConfig": {
     "access": "public",
@@ -10,6 +10,7 @@
     "postinstall": "node scripts/postinstall.mjs",
     "prepare": "husky",
     "setup": "node bin/pantheon-init.mjs init",
+    "build:agents-md": "node scripts/build-agents-md.mjs",
     "setup:lite": "node bin/pantheon-init.mjs init --clean --components agents,skills,instructions",
     "doctor": "node scripts/doctor.mjs",
     "prune": "node scripts/prune.mjs",
@@ -21,7 +22,7 @@
     "version:status": "node scripts/versioning.mjs status",
     "version:apply": "node scripts/versioning.mjs apply",
     "version:check": "node scripts/version-check.mjs",
-    "release:dry-run": "node scripts/versioning.mjs status && npm pack --dry-run",
+    "release:dry-run": "node scripts/versioning.mjs status && node scripts/release-notes.mjs && npm pack --dry-run",
     "publish:next": "npm publish --tag next --access public",
     "lint": "npx biome ci .",
     "typecheck": "npx tsc --noEmit",
@@ -30,7 +31,7 @@
     "hooks:install": "pre-commit install",
     "hooks:update": "pre-commit autoupdate",
     "test:security": "npm run secret-scan && node tests/test_install_mcp_vision.mjs && node tests/test_doctor_layers.mjs",
-    "test:node": "node --test tests/*.mjs",
+    "test:node": "node --test tests/*.mjs tests/pantheon/*.mjs",
     "test:ts": "for f in tests/pantheon/*.test.ts; do npx tsx \"$f\" || exit 1; done",
     "test": "python3 -m pytest tests/ -q 2>&1 || echo \"No tests found\"",
     "test:ci": "python3 -m pytest tests/ -q --tb=short 2>&1 || true"
@@ -64,7 +65,10 @@
     "scripts/hooks/**",
     "src/mcp/requirements*",
     "src/plugins/tui/**",
-    "src/skills/**"
+    "!src/plugins/tui/node_modules/**",
+    "src/skills/**",
+    "!**/__pycache__/**",
+    "!**/*.pyc"
   ],
   "dependencies": {
     "js-yaml": "^4.3.0",

package/scripts/build-agents-md.mjs

@@ -0,0 +1,195 @@
+#!/usr/bin/env node
+/**
+ * build-agents-md.mjs — Generate the repo AGENTS.md from canonical sources.
+ *
+ * AGENTS.md is the single instruction file BOTH OpenCode V1 and V2 load
+ * (V1 auto-discovers it, V2 loads it explicitly; the `instructions` config
+ * key is accepted-but-ignored by V2). To keep instruction content in parity
+ * across both versions without duplication, this script consolidates:
+ *
+ *   (a) a static header (project description + agent table + setup notes)
+ *   (b) every src/instructions/*.instructions.md body, embedded under a
+ *       `## <name>` section marker (name taken from frontmatter)
+ *
+ * into one generated AGENTS.md. src/instructions/*.instructions.md remains
+ * the source of truth — AGENTS.md is a committed build artifact, never
+ * hand-edited.
+ *
+ * Usage:
+ *   node scripts/build-agents-md.mjs            # write AGENTS.md to repo root
+ *   node scripts/build-agents-md.mjs --check    # exit 1 if AGENTS.md is stale
+ *
+ * No runtime dependencies (Node >= 18, stdlib only). Idempotent: running it
+ * twice produces byte-identical output.
+ */
+import { existsSync, readFileSync, readdirSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+export const ROOT = join(__dirname, '..')
+const INSTRUCTIONS_DIR = join(ROOT, 'src', 'instructions')
+const AGENTS_MD_PATH = join(ROOT, 'AGENTS.md')
+
+// ---------------------------------------------------------------------------
+// Static header — preserved verbatim from the original AGENTS.md (agent table,
+// setup notes, sandbox rules, conventions). Backticks are escaped for the
+// template literal.
+// ---------------------------------------------------------------------------
+const STATIC_HEADER = `# Pantheon Agent System — OpenCode
+
+This project uses the Pantheon multi-agent framework with 14 specialized agents.
+
+## Available Agents
+
+| Agent | Role |
+|-------|------|
+| @aphrodite | Frontend specialist — React 19, TypeScript strict, WCAG accessibility, responsive design, TDD, modern API patterns, deprecated npm detection. Calls apollo for discovery, sends to themis for review. |
+| @apollo | Read-only investigation scout — 3–10 parallel searches across codebase, external docs, and GitHub. Called by: athena, zeus, hermes, aphrodite, demeter. No edits, no commands. |
+| @athena | Strategic planner & architect — research-first, plan-only, never implements. Plans include quality gates (ruff/Biome, dep detection, LTS policy). Calls apollo for discovery. |
+| @demeter | Database specialist — SQLAlchemy 2.0, Alembic, query optimization, N+1 prevention, TDD migrations, modern DB libs. Calls apollo for discovery, sends to themis. |
+| @gaia | Remote sensing domain specialist — satellite image processing, spectral analysis, SAR, change detection, time series, ML/DL classification. Read-only analysis of geospatial data. |
+| @hephaestus | AI tooling & pipelines specialist — LangChain/LangGraph chains, RAG architecture, vector stores, embedding strategies. Forges AI infrastructure. Calls apollo, sends to themis. |
+| @hermes | Backend specialist — FastAPI, Python, async, TDD (RED→GREEN→REFACTOR), modern Python stdlib, obsolete lib detection. Calls apollo for discovery, sends to themis. |
+| @iris | GitHub operations specialist — branches, pull requests, issues, releases, tags. Called by zeus after review. Never pushes or merges without explicit human approval. Integrates with VS Code GitHub Pull Requests extension. |
+| @mnemosyne | Memory bank quality owner — initializes .pantheon/memory-bank/, writes ADRs and task records on explicit request. Called by zeus. Never invoked automatically after phases. |
+| @nyx | Observability & monitoring specialist — OpenTelemetry tracing, token/cost tracking, agent performance analytics, LangSmith integration. Calls apollo for discovery, sends to themis. |
+| @prometheus | Infrastructure + model provider specialist — Docker, CI/CD, multi-model routing, cost optimization, provider abstraction |
+| @talos | Hotfix express lane — direct fixes for small bugs, CSS, typos, minor logic. No TDD ceremony, no orchestration overhead. Standalone, no subagents. Escalates complex issues to zeus. |
+| @themis | Quality & security gate — ruff/Biome linting, dead/legacy code detection, OWASP Top 10, coverage >80%, correctness, deprecation audit. Called by implementers; escalates blockers to zeus. |
+| @zeus | Central orchestrator — never implements. Delegates to: athena, apollo, hermes, aphrodite, demeter, prometheus, themis, iris, mnemosyne, talos, hephaestus, nyx |
+
+## OpenCode Setup
+
+See [INSTALLATION.md](docs/INSTALLATION.md) for setup instructions.
+
+- Build: \`npm test\`
+- Test: \`npm test\`
+- Lint: \`npm run lint\`
+
+## Teste de Instalação Global (sandbox)
+
+Para validar a instalação global do pacote pantheon-opencode COMO UM USUÁRIO REAL, use o sandbox isolado em \`~/pantheon-sandbox/\` (fora do repo, HOME + prefix npm + venv próprios). O ambiente de dev mistura 3 instalações + config global + venv — NÃO serve para testar instalação/empacotamento.
+
+- Rodar: \`bash ~/pantheon-sandbox/run-test.sh\` (opencode mcp list 5/5 connected + doctor 0 erros + abre TUI isolado)
+- Regra para agentes: ao validar instalação global (npm pack, \`init\`, MCPs, hooks), usar o sandbox — NUNCA testar no ambiente de dev
+- Descarte: \`rm -rf ~/pantheon-sandbox\`
+- Detalhes: ver \`~/pantheon-sandbox/README.md\`
+
+## Conventions
+
+- TDD: Write failing test first, then implement
+- Coverage minimum: 80%
+- Async/await on all I/O
+- Type hints on all functions
+- PRs always update the README — every pull request must document newly added features, behaviors, env vars, or commands in the README before being opened.
+`
+
+// ---------------------------------------------------------------------------
+// Frontmatter parsing (stdlib only — no yaml dependency)
+// ---------------------------------------------------------------------------
+
+/**
+ * Parse YAML-ish frontmatter from an instruction file.
+ *
+ * Only the `name` field is extracted (single-line scalar). The frontmatter
+ * block itself is stripped from the embedded body.
+ *
+ * @param {string} content - Raw file content
+ * @returns {{ name: string, body: string } | null}
+ */
+function parseInstruction(content) {
+  const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?/)
+  if (!match) return null
+  const fm = match[1]
+  const nameMatch = fm.match(/^name:\s*["']?([^"'\r\n]+)["']?\s*$/m)
+  if (!nameMatch) return null
+  return {
+    name: nameMatch[1].trim(),
+    body: content.slice(match[0].length).trimEnd() + '\n',
+  }
+}
+
+/**
+ * Read all src/instructions/*.instructions.md files, sorted by filename for
+ * deterministic output.
+ *
+ * @returns {Array<{ file: string, name: string, body: string }>}
+ */
+export function readInstructions() {
+  if (!existsSync(INSTRUCTIONS_DIR)) return []
+  const files = readdirSync(INSTRUCTIONS_DIR)
+    .filter((f) => f.endsWith('.instructions.md'))
+    .sort()
+  const out = []
+  for (const file of files) {
+    const content = readFileSync(join(INSTRUCTIONS_DIR, file), 'utf8')
+    const parsed = parseInstruction(content)
+    if (parsed) out.push({ file, ...parsed })
+  }
+  return out
+}
+
+// ---------------------------------------------------------------------------
+// Generation
+// ---------------------------------------------------------------------------
+
+/**
+ * Generate the full AGENTS.md content.
+ *
+ * @param {Array<{ file: string, name: string, body: string }>} instructions
+ * @returns {string}
+ */
+export function generateAgentsMd(instructions) {
+  const sections = [
+    '<!-- Generated by scripts/build-agents-md.mjs — do not edit directly. -->',
+    '<!-- Source of truth: src/instructions/*.instructions.md (AGENTS.md is a committed build artifact). -->',
+    '',
+    STATIC_HEADER.trimEnd(),
+    '',
+    '---',
+    '',
+    '# Agent Instructions',
+    '',
+    'The following sections are consolidated from `src/instructions/*.instructions.md`',
+    'so both OpenCode V1 (auto-loads AGENTS.md) and V2 (loads AGENTS.md, ignores the',
+    '`instructions` config key) receive identical instruction content.',
+    '',
+  ]
+  for (const instr of instructions) {
+    sections.push(
+      `<!-- Source: src/instructions/${instr.file} -->`,
+      `## ${instr.name}`,
+      '',
+      instr.body.trimEnd(),
+      '',
+    )
+  }
+  return sections.join('\n').trimEnd() + '\n'
+}
+
+// ---------------------------------------------------------------------------
+// CLI entry point
+// ---------------------------------------------------------------------------
+
+function main() {
+  const checkOnly = process.argv.includes('--check')
+  const instructions = readInstructions()
+  const content = generateAgentsMd(instructions)
+
+  if (checkOnly) {
+    const existing = existsSync(AGENTS_MD_PATH) ? readFileSync(AGENTS_MD_PATH, 'utf8') : ''
+    if (existing !== content) {
+      console.error(`❌ AGENTS.md is stale — run: node scripts/build-agents-md.mjs`)
+      process.exit(1)
+    }
+    console.log(`✅ AGENTS.md is up to date (${instructions.length} instruction sections)`)
+    return
+  }
+
+  writeFileSync(AGENTS_MD_PATH, content, 'utf8')
+  const lines = content.split('\n').length
+  console.log(`✅ Generated AGENTS.md (${instructions.length} instruction sections, ${lines} lines)`)
+}
+
+main()

package/scripts/cost.mjs

@@ -26,6 +26,22 @@ function fail(message) {
   process.exitCode = 1
 }
 
+function assertCompatibleSchema(db) {
+  const table = db
+    .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'message'")
+    .get()
+  if (!table)
+    throw new Error('incompatible opencode.db schema: required "message" table is missing')
+  const columns = db.prepare('PRAGMA table_info(message)').all()
+  const names = new Set(columns.map((column) => column.name))
+  const missing = ['data', 'time_created'].filter((name) => !names.has(name))
+  if (missing.length > 0) {
+    throw new Error(
+      `incompatible opencode.db schema: message table is missing ${missing.join(', ')}; select the matching V1/V2 database`,
+    )
+  }
+}
+
 function main() {
   const [, , dbPath, daysArg] = process.argv
   const days = Number(daysArg ?? '7')
@@ -35,6 +51,7 @@ function main() {
 
   try {
     const db = new DatabaseSync(dbPath, { readOnly: true })
+    assertCompatibleSchema(db)
     const since = Date.now() - days * 86_400_000
     const rows = db.prepare('SELECT data FROM message WHERE time_created >= ?').all(since)
     db.close()

package/scripts/doctor.mjs

@@ -34,7 +34,7 @@ import { fileURLToPath } from 'node:url'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const ROOT = join(__dirname, '..')
-const AGENTS_DIR = join(ROOT, "src", "agents")
+const AGENTS_DIR = join(ROOT, 'src', 'agents')
 const PLATFORM_DIR = join(ROOT, 'platform')
 
 // All known platforms (must match platform/ subdirectories with adapter.json)
@@ -246,7 +246,9 @@ function checkAgentFiles(args) {
 
   // Determine which platforms to check
   if (!existsSync(PLATFORM_DIR)) {
-    info(`Platform component not distributed in this package — platform check skipped (${args.profile} profile)`)
+    info(
+      `Platform component not distributed in this package — platform check skipped (${args.profile} profile)`,
+    )
     return
   }
   const platformDirs = readdirSync(PLATFORM_DIR, { withFileTypes: true })
@@ -255,7 +257,9 @@ function checkAgentFiles(args) {
     .filter((name) => !args.platform || name === args.platform)
 
   if (platformDirs.length === 0) {
-    info(`No platform directories found in platform/ — platform check skipped (${args.profile} profile)`)
+    info(
+      `No platform directories found in platform/ — platform check skipped (${args.profile} profile)`,
+    )
     return
   }
 
@@ -377,7 +381,8 @@ function checkMcpConfig(args) {
 
     const mcp = cfg.data.mcp
     if (!mcp || typeof mcp !== 'object') {
-      if (requiredMcpNames.length > 0) error(`${cfg.label}: required MCPs missing — no "mcp" section`)
+      if (requiredMcpNames.length > 0)
+        error(`${cfg.label}: required MCPs missing — no "mcp" section`)
       else info(`${cfg.label}: no "mcp" section (${args.profile} profile — optional)`)
       continue
     }
@@ -450,7 +455,9 @@ function checkMcpConfig(args) {
       const exe = cmd[0]
       if (!exe.includes('/')) {
         // PATH-resolved executable — cannot verify statically; surface for manual check
-        info(`${cfg.label}: MCP "${name}" uses PATH executable "${exe}" (verify with \`which ${exe}\`)`)
+        info(
+          `${cfg.label}: MCP "${name}" uses PATH executable "${exe}" (verify with \`which ${exe}\`)`,
+        )
         continue
       }
       if (!existsSync(exe)) {
@@ -467,7 +474,8 @@ function checkMcpConfig(args) {
   if (requiredMcpNames.length > 0) {
     const configured = new Set(configs.flatMap((cfg) => Object.keys(cfg.data.mcp ?? {})))
     for (const required of requiredMcpNames) {
-      if (configured.has(required)) pass(`Required MCP "${required}" configured in an available config`)
+      if (configured.has(required))
+        pass(`Required MCP "${required}" configured in an available config`)
       else error(`Required MCP "${required}" not configured in any available config`)
     }
   }
@@ -535,12 +543,17 @@ function mcpInitializeSmoke(command, cwd, timeoutMs) {
         const msg = JSON.parse(line.trim())
         if (msg.id === 1 && msg.result) {
           const info = msg.result.serverInfo
-          const label = info?.name ? `${info.name}${info.version ? ` ${info.version}` : ''}` : undefined
+          const label = info?.name
+            ? `${info.name}${info.version ? ` ${info.version}` : ''}`
+            : undefined
           finish({ ok: true, serverName: label })
           return
         }
         if (msg.error) {
-          finish({ ok: false, reason: `initialize error: ${msg.error.code ?? ''} ${msg.error.message ?? ''}` })
+          finish({
+            ok: false,
+            reason: `initialize error: ${msg.error.code ?? ''} ${msg.error.message ?? ''}`,
+          })
         }
       } catch {
         /* not JSON yet — keep buffering */
@@ -592,7 +605,9 @@ async function checkMcpRuntimeSmoke(args) {
   for (const { name, command, cwd, source } of local) {
     const result = await mcpInitializeSmoke(command, cwd, 10000)
     if (result.ok) {
-      pass(`MCP "${name}" (${source}): initialize handshake OK${result.serverName ? ` — ${result.serverName}` : ''}`)
+      pass(
+        `MCP "${name}" (${source}): initialize handshake OK${result.serverName ? ` — ${result.serverName}` : ''}`,
+      )
     } else {
       error(`MCP "${name}" (${source}): ${result.reason}`)
     }
@@ -645,7 +660,9 @@ function checkPermissionMismatches(args) {
   // Locate the validation script
   const validator = join(ROOT, 'scripts', 'validate-agent-frontmatter.py')
   if (!existsSync(validator)) {
-    info(`validate-agent-frontmatter.py not found — optional helper skipped (${args.profile} profile)`)
+    info(
+      `validate-agent-frontmatter.py not found — optional helper skipped (${args.profile} profile)`,
+    )
     return
   }
 
@@ -876,12 +893,24 @@ function checkRequirementLine(line, installed) {
   const cmp = compareVersions(have, want)
   let ok = false
   switch (op) {
-    case '==': ok = cmp === 0; break
-    case '>=': ok = cmp >= 0; break
-    case '<=': ok = cmp <= 0; break
-    case '>': ok = cmp > 0; break
-    case '<': ok = cmp < 0; break
-    case '!=': ok = cmp !== 0; break
+    case '==':
+      ok = cmp === 0
+      break
+    case '>=':
+      ok = cmp >= 0
+      break
+    case '<=':
+      ok = cmp <= 0
+      break
+    case '>':
+      ok = cmp > 0
+      break
+    case '<':
+      ok = cmp < 0
+      break
+    case '!=':
+      ok = cmp !== 0
+      break
     case '~=': {
       const spec = parseVersion(want)
       const got = parseVersion(have)
@@ -961,12 +990,12 @@ function checkVenvLayer(args) {
  */
 export function summaryMessage(summaryCounts, summaryExitCode) {
   if (summaryCounts.error > 0 || summaryExitCode !== 0) {
-    const errorText = summaryCounts.error > 0
-      ? `${summaryCounts.error} blocking error(s) found`
-      : 'Blocking check failure'
-    const warningText = summaryCounts.warn > 0
-      ? `; ${summaryCounts.warn} warning(s) remain advisory`
-      : ''
+    const errorText =
+      summaryCounts.error > 0
+        ? `${summaryCounts.error} blocking error(s) found`
+        : 'Blocking check failure'
+    const warningText =
+      summaryCounts.warn > 0 ? `; ${summaryCounts.warn} warning(s) remain advisory` : ''
     return `❌ ${errorText}${warningText} — exit code ${summaryExitCode}`
   }
 
@@ -1005,6 +1034,11 @@ async function main() {
     process.exit(0)
   }
 
+  // Report the resolved validation profile up front (auto → global/sandbox)
+  // so callers — including the `doctor` CLI wrapper — can see which policy
+  // gate applied before any check output.
+  console.log(`Validation profile: ${args.profile}`)
+
   if (!existsSync(args.target)) {
     console.error(`❌ Target directory does not exist: ${args.target}`)
     process.exit(2)

package/scripts/hooks/on-subagent-delegation-stop.sh

@@ -383,12 +383,27 @@ fi
 # Emit a schema-compatible line: {event, timestamp, agent, status, reason,
 # session_id, result, delegation_id, task_id, duration_ms} — P0-2: the
 # delegation_id joins this record to the matching SubagentStart; task_id and
-# duration_ms ride in their OWN fields. Built with json.dumps so arbitrary
+# duration_ms ride in their OWN fields. 1.3.4: task_id is OMITTED when empty
+# (never "" — the real child id is always present when a job exists) and
+# duration_ms is emitted as a NUMBER (the plugin computes it; stringifying it
+# broke downstream aggregation). Built with json.dumps so arbitrary
 # reason/result text cannot break the JSON.
 LOG_LINE=$(python3 -c '
 import json
 import sys
-print(json.dumps({
+
+
+def _num(v):
+    """Best-effort numeric parse — the plugin duration_ms is a number; a
+    non-numeric value (e.g. unset) becomes null, never a string."""
+    try:
+        return int(float(v))
+    except (TypeError, ValueError):
+        return None
+
+
+task_id = sys.argv[8] or ""
+line = {
     "event": "SubagentStop",
     "timestamp": sys.argv[1],
     "agent": sys.argv[2],
@@ -397,9 +412,11 @@ print(json.dumps({
     "session_id": sys.argv[5],
     "result": sys.argv[6],
     "delegation_id": sys.argv[7],
-    "task_id": sys.argv[8],
-    "duration_ms": sys.argv[9] or None,
-}, ensure_ascii=False))
+}
+if task_id:
+    line["task_id"] = task_id
+line["duration_ms"] = _num(sys.argv[9])
+print(json.dumps(line, ensure_ascii=False))
 ' "$TIMESTAMP" "$AGENT_NAME" "$STATUS" "$REASON" "$SESSION_ID" "$RESULT_SNIPPET" "$DELEGATION_ID" "$TASK_ID" "$DURATION_MS")
 
 LOG_FILE="$LOG_DIR/delegations.log"