pantheon-opencode 1.3.5 → 1.3.7

package/README.md

@@ -2,7 +2,7 @@
 <h1 align="center">Pantheon</h1>
 
 <p align="center">
-  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/version-v1.3.4-blue" alt="Version"></a>
+  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/version-v1.3.6--beta-blue" alt="Version"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue" alt="License"></a>
   <a href="docs/agents/README.md"><img src="https://img.shields.io/badge/agents-14-purple" alt="Agents"></a>
   <a href="src/skills/README.md"><img src="https://img.shields.io/badge/skills-21-orange" alt="Skills"></a>
@@ -278,6 +278,38 @@ agent in `background_delegation.read_only_agents` (`apollo`, `gaia`), registers
 the child session as read-only — the `tool.execute.before` guard denies
 `edit`/`write`/`bash`/`task` inside that session.
 
+**R1 — Per-error-type retry + provider cooldown (LiteLLM pattern):**
+`retry_policy` in `src/routing.yml` maps an error class (`auth`, `rate_limit`,
+`timeout`, `other`) to max retries before escalating — `auth` is never retried
+(0), `rate_limit` gets 3, `timeout` 2, `other` 1. Retries use exponential
+backoff (base 1s, doubling, capped 30s). `cooldown` (`allowed_fails`,
+`cooldown_time_seconds`) skips a provider for the configured window after that
+many consecutive failures; a success resets the counter. Enforcement lives in
+`RetryPolicyEngine` (`src/pantheon/retry-policy.ts`) and the R1 path of
+`zeusDelegateWithRetry` (`src/pantheon/zeus-delegate-with-retry.ts`) — pass
+`retryPolicy`/`cooldown`/`provider` to `createZeusRetryHelper`. In-memory only
+(no Redis).
+
+**R4 — Per-agent step caps:** `agents.<name>.max_steps` in `src/routing.yml`
+gives each agent a step budget (e.g. `apollo: 25`, `themis: 25`, `athena: 15`).
+When an agent reaches `max_steps` it is forced to summarize-and-stop: a
+delegation to an already-capped agent is skipped with a `[STEP CAP REACHED]`
+summary (no child session created), and a dispatch that hits the cap appends a
+stop instruction to the prompt. Enforcement: `StepCapTracker`
+(`src/pantheon/step-cap.ts`) wired into `pantheon_delegate`. The tracker is
+**permanent-per-process** — counters accumulate for the process lifetime and
+are intentionally not reset on success/session end (a per-session reset would
+let an agent exceed its process budget).
+
+**O5 — Permission globs for delegation:** `permission.task` in `src/routing.yml`
+controls which subagents an agent may invoke via glob patterns (last matching
+rule wins). A deny removes the agent from the delegate tool description
+entirely (not just blocks the call) — preventing circular delegation at the
+permission layer. Default `"*": allow` keeps the existing runtime matrix
+(zeus → anyone; athena/hermes → apollo only). Enforcement:
+`src/pantheon/permission-globs.ts` + the `permissionTask` option on
+`createDelegationTools` / `createEnforcementGuard`.
+
 **Compaction carry-forward:** during context compaction, running and unread
 terminal delegations (capped at `background_delegation.max_compaction_items`,
 default 10) are carried into the compacted context so the parent doesn't lose

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pantheon-opencode",
-  "version": "1.3.5",
+  "version": "1.3.7",
   "description": "Multi-agent orchestration for OpenCode — 14 specialized agents, TDD, Themis review gates.",
   "publishConfig": {
     "access": "public",
@@ -33,8 +33,8 @@
     "test:security": "npm run secret-scan && node tests/test_install_mcp_vision.mjs && node tests/test_doctor_layers.mjs",
     "test:node": "node --test tests/*.mjs tests/pantheon/*.mjs",
     "test:ts": "for f in tests/pantheon/*.test.ts; do npx tsx \"$f\" || exit 1; done",
-    "test": "python3 -m pytest tests/ -q 2>&1 || echo \"No tests found\"",
-    "test:ci": "python3 -m pytest tests/ -q --tb=short 2>&1 || true"
+    "test": "python3 -m pytest tests/ -q 2>&1; status=$?; if [ \"$status\" -eq 5 ]; then echo \"No tests found\"; fi; exit \"$status\"",
+    "test:ci": "python3 -m pytest tests/ -q --tb=short 2>&1"
   },
   "bin": {
     "pantheon-opencode": "bin/pantheon-init.mjs"

package/scripts/_pantheon_paths.py

@@ -1,4 +1,3 @@
-# Auto-generated: resolved symlink from ../src/mcp/_pantheon_paths.py
 #!/usr/bin/env python3
 """Pantheon path resolution — global install + project root detection.
 

package/scripts/build-agents-md.mjs

@@ -22,7 +22,7 @@
  * No runtime dependencies (Node >= 18, stdlib only). Idempotent: running it
  * twice produces byte-identical output.
  */
-import { existsSync, readFileSync, readdirSync, writeFileSync } from 'node:fs'
+import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -189,7 +189,9 @@ function main() {
 
   writeFileSync(AGENTS_MD_PATH, content, 'utf8')
   const lines = content.split('\n').length
-  console.log(`✅ Generated AGENTS.md (${instructions.length} instruction sections, ${lines} lines)`)
+  console.log(
+    `✅ Generated AGENTS.md (${instructions.length} instruction sections, ${lines} lines)`,
+  )
 }
 
 main()

package/scripts/code_mode_server.py

@@ -16,10 +16,18 @@ Or via MCP client (stdio transport):
 from __future__ import annotations
 
 import asyncio
+import logging
 import os
+import signal
+import shutil
 import stat
+import sys
+import time
 from contextlib import suppress
 from pathlib import Path
+from typing import Any
+
+import yaml
 
 from _pantheon_paths import pantheon_home, pantheon_project
 from mcp.server.fastmcp import FastMCP
@@ -27,12 +35,104 @@ from mcp.server.fastmcp import FastMCP
 # ── Constants ─────────────────────────────────────────────────────────────────
 ALLOWED_EXTENSIONS: frozenset[str] = frozenset({".sh", ".py"})
 SCRIPT_TIMEOUT: int = 30
+# Hard ceiling for frontmatter `timeout:` overrides — no script may pin the
+# executor for longer than 5 minutes.
+MAX_SCRIPT_TIMEOUT: int = 300
+
+# ── Env Allowlist ──────────────────────────────────────────────────────────────
+# Only these variables are passed to script subprocesses.  Everything else
+# (secrets, cloud credentials, etc.) is stripped to limit blast radius.
+_CODE_MODE_ENV_ALLOWLIST: frozenset[str] = frozenset({
+    "PATH",
+    "HOME",
+    "LANG",
+    "PANTHEON_HOME",
+    "PANTHEON_PROJECT",
+    "OPENAI_API_KEY",
+    "OPENAI_BASE_URL",
+    "EVAL_JUDGE_MODEL",
+    "SHELL",
+    "USER",
+})
+
+# Optional extra vars that callers may opt-in to pass through.  Populate
+# this set at startup if needed (e.g. ``CODE_MODE_EXTRA_ENV.add("MY_VAR")``).
+CODE_MODE_EXTRA_ENV: set[str] = set()
+
+# Safe defaults when the host env is completely empty.
+_SAFE_DEFAULTS: dict[str, str] = {
+    "PATH": "/usr/local/bin:/usr/bin:/bin",
+    "HOME": "/tmp",
+}
+
+_log = logging.getLogger(__name__)
+
+
+def _build_script_env(
+    host_env: dict[str, str] | None = None,
+) -> dict[str, str]:
+    """Construct a minimal env dict for script subprocesses.
+
+    Only allowlisted vars (plus any in ``CODE_MODE_EXTRA_ENV``) are
+    forwarded from *host_env* (defaults to ``os.environ``).  Missing
+    allowlisted vars receive safe defaults from ``_SAFE_DEFAULTS``.
+
+    Returns a **new** dict — the input is never mutated.
+    """
+    if host_env is None:
+        host_env = dict(os.environ)
+
+    allowed = _CODE_MODE_ENV_ALLOWLIST | CODE_MODE_EXTRA_ENV
+    env: dict[str, str] = {}
+
+    for key in allowed:
+        if key in host_env:
+            env[key] = host_env[key]
+        elif key in _SAFE_DEFAULTS:
+            env[key] = _SAFE_DEFAULTS[key]
+
+    # Always ensure PATH is present even if allowlist + defaults both miss it.
+    if "PATH" not in env:
+        env["PATH"] = _SAFE_DEFAULTS.get("PATH", "/usr/local/bin:/usr/bin:/bin")
+
+    return env
+
+
+def _prlimit_prefix(
+    prlimit_path: str | None,
+    timeout_s: int = SCRIPT_TIMEOUT,
+) -> list[str] | None:
+    """Return a ``prlimit`` command prefix to wrap a subprocess, or *None*.
+
+    On Linux with ``prlimit`` available the prefix adds:
+      --nproc=512  --as=1073741824  --cpu=<timeout_s + 5>
+
+    On non-Linux or when *prlimit_path* is falsy, returns *None* (fail-open).
+    """
+    if not prlimit_path:
+        return None
+
+    cpu_limit = timeout_s + 5
+    return [
+        prlimit_path,
+        "--nproc=512",
+        "--as=1073741824",  # 1 GiB in bytes
+        f"--cpu={cpu_limit}",
+        "--",
+    ]
+
+
+def _detect_prlimit() -> str | None:
+    """Return the path to ``prlimit`` if available, else *None*."""
+    if sys.platform != "linux":
+        return None
+    return shutil.which("prlimit")
 
 # ── Scripts Directory Resolution ─────────────────────────────────────────────
 # Priority:
-# 1. $PANTHEON_HOME/.pantheon/code-mode/   (global install)
-# 2. $PANTHEON_PROJECT/.opencode/.pantheon/code-mode/  (project install)
-# 3. $PANTHEON_PROJECT/.pantheon/code-mode/            (legacy fallback)
+# 1. /.opencode/.pantheon/code-mode/  (project install)
+# 2. /.pantheon/code-mode/            (legacy fallback)
+# 3. /.pantheon/code-mode/               (global fallback)
 _PANTHEON_HOME: Path = pantheon_home()
 _SCRIPTS_DIR_CANDIDATES: list[Path] = []
 _proj = pantheon_project()
@@ -87,12 +187,16 @@ def _validate_script_name(script_name: str) -> Path:
 
 
 def _format_output(
-    stdout: str, stderr: str, exit_code: int, timed_out: bool = False
+    stdout: str,
+    stderr: str,
+    exit_code: int,
+    timed_out: bool = False,
+    timeout_s: int = SCRIPT_TIMEOUT,
 ) -> str:
     """Format script execution output into a readable string."""
     parts: list[str] = []
     if timed_out:
-        parts.append(f"[TIMEOUT] Script exceeded {SCRIPT_TIMEOUT}s limit")
+        parts.append(f"[TIMEOUT] Script exceeded {timeout_s}s limit")
     if stdout:
         parts.append(stdout)
     if stderr:
@@ -101,6 +205,123 @@ def _format_output(
     return "\n".join(parts)
 
 
+# ── Script Metadata (YAML frontmatter) ────────────────────────────────────────
+# Optional comment-style frontmatter at the top of a script (after an optional
+# shebang). Comment lines keep the script a valid executable in both bash and
+# python while carrying metadata:
+#
+#     #!/usr/bin/env python3
+#     # ---
+#     # description: Runs the checkpoint save
+#     # timeout: 5
+#     # allowed_args:
+#     #   - compress
+#     #   - --text
+#     # ---
+#
+# Supported keys: description (str), timeout (int seconds, overrides the 30s
+# default), allowed_args (list of allowed CLI args — validated on execute).
+
+
+def _parse_frontmatter(script_path: Path) -> dict[str, Any]:
+    """Parse comment-style YAML frontmatter from a script.
+
+    Returns an empty dict when the script has no frontmatter or the block is
+    malformed (fail-open — never blocks execution).
+    """
+    try:
+        text = script_path.read_text(encoding="utf-8")
+    except OSError:
+        return {}
+    lines = text.splitlines()
+
+    # Locate the opening delimiter: a comment line that is exactly "# ---".
+    # Only scan the header region (before the first non-comment code line).
+    start: int | None = None
+    for i, line in enumerate(lines):
+        stripped = line.strip()
+        if stripped == "# ---":
+            start = i
+            break
+        if i > 0 and stripped and not stripped.startswith("#"):
+            break
+    if start is None:
+        return {}
+
+    body_lines: list[str] = []
+    for j in range(start + 1, len(lines)):
+        stripped = lines[j].strip()
+        if stripped == "# ---":
+            break
+        if not stripped.startswith("#"):
+            return {}  # non-comment line inside the block → not frontmatter
+        body_lines.append(stripped[1:].lstrip() if stripped.startswith("# ") else stripped[1:])
+    else:
+        return {}  # no closing delimiter
+
+    try:
+        data = yaml.safe_load("\n".join(body_lines))
+    except yaml.YAMLError:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _script_timeout(script_path: Path) -> int:
+    """Per-script timeout override from frontmatter, capped at MAX_SCRIPT_TIMEOUT.
+
+    Honors any positive integer `timeout:` from the script frontmatter, but
+    never returns more than 300s (5 min) regardless of what frontmatter asks.
+    """
+    timeout = _parse_frontmatter(script_path).get("timeout")
+    if isinstance(timeout, int) and timeout > 0:
+        return min(timeout, MAX_SCRIPT_TIMEOUT)
+    return SCRIPT_TIMEOUT
+
+
+def _validate_args(script_path: Path, args: list[str]) -> str | None:
+    """Validate args against the frontmatter ``allowed_args`` allowlist.
+
+    Returns an error message when a passed arg is not allowed, else None.
+    A missing or malformed allowlist fails open (no restriction).
+    """
+    allowed = _parse_frontmatter(script_path).get("allowed_args")
+    if allowed is None:
+        return None
+    if not isinstance(allowed, list) or not all(isinstance(a, str) for a in allowed):
+        return None
+    denied = [a for a in args if a not in allowed]
+    if denied:
+        return (
+            f"Argument(s) {denied} not allowed for script '{script_path.name}'. "
+            f"Allowed: {allowed}"
+        )
+    return None
+
+
+def _build_result(
+    stdout: str,
+    stderr: str,
+    exit_code: int,
+    timed_out: bool,
+    duration_ms: int,
+    metadata: dict[str, Any],
+    json_output: bool,
+    timeout_s: int,
+) -> str | dict[str, Any]:
+    """Build the tool result in plain-text or structured JSON form."""
+    if json_output:
+        return {
+            "stdout": stdout,
+            "stderr": stderr,
+            "exit_code": exit_code,
+            "timed_out": timed_out,
+            "duration_ms": duration_ms,
+            "timeout_s": timeout_s,
+            "metadata": metadata,
+        }
+    return _format_output(stdout, stderr, exit_code, timed_out, timeout_s)
+
+
 # ── Static Resources ──────────────────────────────────────────────────────────
 
 
@@ -126,15 +347,20 @@ async def list_code_mode_scripts() -> str:
 
 @mcp.resource(
     "pantheon://code-mode/scripts/{script_name}",
-    description="Content of a code-mode script by name",
+    description="Content of a code-mode script by name, with parsed frontmatter metadata",
 )
 async def get_code_mode_script(script_name: str) -> str:
-    """Return the source content of a code-mode script."""
+    """Return the source content of a code-mode script plus its metadata."""
     try:
         script_path = _validate_script_name(script_name)
-        return script_path.read_text(encoding="utf-8")
     except ValueError as e:
         return str(e)
+    metadata = _parse_frontmatter(script_path)
+    source = script_path.read_text(encoding="utf-8")
+    if not metadata:
+        return source
+    meta_lines = "\n".join(f"{k}: {v}" for k, v in sorted(metadata.items()))
+    return f"# metadata\n{meta_lines}\n\n{source}"
 
 
 # ── Tools ─────────────────────────────────────────────────────────────────────
@@ -142,16 +368,27 @@ async def get_code_mode_script(script_name: str) -> str:
 
 @mcp.tool(
     name="execute_code_script",
-    description="Run a .sh/.py script from .pantheon/code-mode/ "
-    "with optional args. 30s timeout.",
+    description="Run a .sh/.py script from .pantheon/code-mode/ with optional args. "
+    "30s default timeout (override via YAML frontmatter `timeout`). "
+    "Set json_output=true for structured JSON output.",
 )
-async def execute_code_script(script_name: str, args: list[str] | None = None) -> str:
+async def execute_code_script(
+    script_name: str,
+    args: list[str] | None = None,
+    json_output: bool = False,
+) -> str | dict[str, Any]:
     """Execute a code-mode script with confinement and timeout.
 
     Args:
         script_name: Name of the script in the code-mode directory.
         args: Optional CLI arguments forwarded to the subprocess (e.g.
             ``["compress", "--text", "..."]``). Defaults to no args.
+        json_output: When True, return a structured dict with stdout, stderr,
+            exit_code, duration_ms, timed_out and frontmatter metadata
+            instead of the plain-text summary.
+
+    Returns:
+        Plain-text summary (default) or structured dict (json_output=True).
     """
     args = args or []
     try:
@@ -159,6 +396,13 @@ async def execute_code_script(script_name: str, args: list[str] | None = None) -
     except ValueError as e:
         return str(e)
 
+    metadata = _parse_frontmatter(script_path)
+    denied = _validate_args(script_path, args)
+    if denied is not None:
+        return denied
+
+    timeout_s = _script_timeout(script_path)
+
     # Ensure script is executable
     if not os.access(script_path, os.X_OK):
         with suppress(OSError):
@@ -166,34 +410,76 @@ async def execute_code_script(script_name: str, args: list[str] | None = None) -
             script_path.chmod(mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
 
     script_dir = script_path.parent
+    started = time.monotonic()
+
+    # ── Build sanitized env & optional prlimit prefix ────────────────────
+    env_dict = _build_script_env()
+    prlimit = _prlimit_prefix(_detect_prlimit(), timeout_s)
+
+    # Command: optionally wrapped with prlimit for resource limits.
+    if prlimit is not None:
+        cmd = [*prlimit, str(script_path), *args]
+    else:
+        cmd = [str(script_path), *args]
+
     try:
         proc = await asyncio.create_subprocess_exec(
-            str(script_path),
-            *args,
+            *cmd,
             cwd=str(script_dir),
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.PIPE,
+            env=env_dict,
+            start_new_session=True,
         )
         try:
             stdout, stderr = await asyncio.wait_for(
-                proc.communicate(), timeout=SCRIPT_TIMEOUT
+                proc.communicate(), timeout=timeout_s
             )
-            return _format_output(
+            duration_ms = int((time.monotonic() - started) * 1000)
+            return _build_result(
                 stdout.decode("utf-8", errors="replace"),
                 stderr.decode("utf-8", errors="replace"),
                 proc.returncode or 0,
+                timed_out=False,
+                duration_ms=duration_ms,
+                metadata=metadata,
+                json_output=json_output,
+                timeout_s=timeout_s,
             )
         except TimeoutError:
-            proc.kill()
+            # Kill the entire process group so child processes don't survive.
+            try:
+                os.killpg(os.getpgid(proc.pid), signal.SIGKILL)
+            except (ProcessLookupError, OSError):
+                proc.kill()  # fallback: kill main process only
             await proc.wait()
-            return _format_output("", "", -1, timed_out=True)
+            duration_ms = int((time.monotonic() - started) * 1000)
+            return _build_result(
+                "", "", -1, timed_out=True, duration_ms=duration_ms,
+                metadata=metadata, json_output=json_output, timeout_s=timeout_s,
+            )
     except FileNotFoundError:
-        return (
-            f"Script '{script_name}' not found "
-            f"or interpreter missing.\n--- exit code: -1"
+        return _build_result(
+            "",
+            f"Script '{script_name}' not found or interpreter missing.",
+            -1,
+            timed_out=False,
+            duration_ms=0,
+            metadata=metadata,
+            json_output=json_output,
+            timeout_s=timeout_s,
         )
     except OSError as e:
-        return f"Failed to execute script: {e}\n--- exit code: -1"
+        return _build_result(
+            "",
+            f"Failed to execute script: {e}",
+            -1,
+            timed_out=False,
+            duration_ms=0,
+            metadata=metadata,
+            json_output=json_output,
+            timeout_s=timeout_s,
+        )
 
 
 # ── Main Entrypoint ───────────────────────────────────────────────────────────

package/scripts/doctor.mjs

@@ -351,30 +351,41 @@ function checkAgentFiles(args) {
 // Check B: MCP Configuration
 // ---------------------------------------------------------------------------
 
+/** Resolve the effective OpenCode user config directory. */
+export function resolveOpenCodeConfigDir(env = process.env) {
+  if (env.PANTHEON_HOME) return resolve(env.PANTHEON_HOME)
+  const base = env.XDG_CONFIG_HOME || join(env.HOME ?? homedir(), '.config')
+  return join(base, 'opencode')
+}
+
 /**
  * Collect every reachable opencode.json (project → repository → user config)
  * with its parsed content, for the config, spawn-path and runtime layers.
  * @returns {{label:string, path:string, data:object}[]}
  */
-function collectMcpConfigs(args) {
+export function collectMcpConfigs(args) {
   const candidates = [
     { label: 'project root', path: join(args.target, 'opencode.json') },
     { label: 'repository root', path: join(ROOT, 'opencode.json') },
   ]
 
-  // Also check user config if target matches Pantheon ROOT
-  if (args.target === ROOT) {
-    candidates.push({
-      label: 'user config',
-      path: join(ROOT, '.opencode', 'opencode.json'),
-    })
-  } else {
-    const homeConfig = join(process.env.HOME ?? '~', '.config', 'opencode', 'opencode.json')
-    candidates.push({ label: 'user config', path: homeConfig })
-  }
+  // OpenCode resolves user configuration independently of cwd. Keep the
+  // project-local .opencode config for repository checks, but always include
+  // the effective user config so a sandbox HOME is not mistaken for cwd.
+  candidates.push({
+    label: 'project .opencode config',
+    path: join(args.target, '.opencode', 'opencode.json'),
+  })
+  candidates.push({
+    label: 'user config',
+    path: join(resolveOpenCodeConfigDir(args.env ?? process.env), 'opencode.json'),
+  })
 
   const configs = []
+  const seen = new Set()
   for (const c of candidates) {
+    if (seen.has(c.path)) continue
+    seen.add(c.path)
     const data = readJson(c.path)
     if (data) {
       configs.push({ label: c.label, data, path: c.path })
@@ -391,7 +402,9 @@ function checkMcpConfig(args) {
 
   if (configs.length === 0) {
     if (requiredMcpNames.length > 0) {
-      error(`No opencode.json found; required MCPs missing: ${requiredMcpNames.join(', ')}`)
+      error(
+        `No opencode.json found (searched project/repository and ${resolveOpenCodeConfigDir(args.env ?? process.env)}); required MCPs missing: ${requiredMcpNames.join(', ')}`,
+      )
     } else {
       info(`No opencode.json found for ${args.profile} profile — MCP check skipped`)
     }
@@ -950,7 +963,7 @@ function checkRequirementLine(line, installed) {
 function checkVenvLayer(args) {
   section('F. Runtime Layer — Venv, Python & Dependencies')
 
-  const configDir = join(homedir(), '.config', 'opencode')
+  const configDir = resolveOpenCodeConfigDir()
   const venvPython = join(configDir, '.venv', 'bin', 'python3')
 
   if (!existsSync(venvPython)) {

package/scripts/hooks/format-multi-language.sh

@@ -16,9 +16,12 @@ import sys, json
 d = json.load(sys.stdin)
 print(d.get('tool_name', ''))
 " 2>/dev/null || echo "")
+  # Normalize to lowercase — opencode sends lowercase (edit/write/bash),
+  # Claude Code protocol may send capitalized (Edit/Write/Bash).
+  TOOL_NAME_LOWER=$(echo "$TOOL_NAME" | tr '[:upper:]' '[:lower:]')
 
-  case "$TOOL_NAME" in
-    Edit|Write)
+  case "$TOOL_NAME_LOWER" in
+    edit|write)
       JSON_PATH=$(echo "$STDIN_JSON" | python3 -c "
 import sys, json
 d = json.load(sys.stdin)
@@ -28,7 +31,7 @@ print(d.get('tool_input', {}).get('file_path', ''))
         FILE_PATH="$JSON_PATH"
       fi
       ;;
-    Bash)
+    bash)
       COMMAND=$(echo "$STDIN_JSON" | python3 -c "
 import sys, json
 d = json.load(sys.stdin)

package/scripts/hooks/log-session-start.sh

@@ -4,10 +4,16 @@
 set -euo pipefail
 
 # Project-local by default; set XDG_STATE_HOME for system-wide logging
+# Anchor to PANTHEON_HOME or PANTHEON_PROJECT when available to avoid
+# CWD-dependent relative path ("logs/agent-sessions" wrote to cwd).
 if [ -n "${LOG_DIR:-}" ]; then
     LOG_DIR="$LOG_DIR"
 elif [ -n "${XDG_STATE_HOME:-}" ]; then
     LOG_DIR="$XDG_STATE_HOME/pantheon/hooks"
+elif [ -n "${PANTHEON_HOME:-}" ]; then
+    LOG_DIR="$PANTHEON_HOME/logs/agent-sessions"
+elif [ -n "${PANTHEON_PROJECT:-}" ]; then
+    LOG_DIR="$PANTHEON_PROJECT/logs/agent-sessions"
 else
     LOG_DIR="logs/agent-sessions"
 fi