pantheon-opencode 1.3.5 → 1.3.7

package/scripts/hooks/on-subagent-delegation-start.sh

@@ -24,10 +24,16 @@
 set -euo pipefail
 
 # Project-local by default; set XDG_STATE_HOME for system-wide logging
+# Anchor to PANTHEON_HOME or PANTHEON_PROJECT when available to avoid
+# CWD-dependent relative path ("logs/agent-sessions" wrote to cwd).
 if [ -n "${LOG_DIR:-}" ]; then
     LOG_DIR="$LOG_DIR"
 elif [ -n "${XDG_STATE_HOME:-}" ]; then
     LOG_DIR="$XDG_STATE_HOME/pantheon/hooks"
+elif [ -n "${PANTHEON_HOME:-}" ]; then
+    LOG_DIR="$PANTHEON_HOME/logs/agent-sessions"
+elif [ -n "${PANTHEON_PROJECT:-}" ]; then
+    LOG_DIR="$PANTHEON_PROJECT/logs/agent-sessions"
 else
     LOG_DIR="logs/agent-sessions"
 fi
@@ -133,20 +139,30 @@ echo "[DELEGATION] $AGENT_NAME started → $LOG_DIR/delegations.log" >&2
 
 # --- Dispatch-time validation: check target against routing.yml ---
 SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd -- "$SCRIPT_DIR/../.." && pwd)"
-ROUTING_FILE="$REPO_ROOT/routing.yml"
-if [ -f "$ROUTING_FILE" ] && [ -n "$AGENT_NAME" ] && [ "$AGENT_NAME" != "unknown" ]; then
+REPO_ROOT="$(cd -- "$SCRIPT_DIR/../.." 2>/dev/null && pwd)"
+
+# Find routing.yml: try repo root first, then PANTHEON_HOME, then PANTHEON_PROJECT.
+# Silently skip if none found (deployed users may not have routing.yml locally).
+ROUTING_FILE=""
+if [ -n "$REPO_ROOT" ] && [ -f "$REPO_ROOT/routing.yml" ]; then
+    ROUTING_FILE="$REPO_ROOT/routing.yml"
+elif [ -n "${PANTHEON_HOME:-}" ] && [ -f "$PANTHEON_HOME/routing.yml" ]; then
+    ROUTING_FILE="$PANTHEON_HOME/routing.yml"
+elif [ -n "${PANTHEON_PROJECT:-}" ] && [ -f "$PANTHEON_PROJECT/routing.yml" ]; then
+    ROUTING_FILE="$PANTHEON_PROJECT/routing.yml"
+fi
+
+if [ -n "$ROUTING_FILE" ] && [ -n "$AGENT_NAME" ] && [ "$AGENT_NAME" != "unknown" ]; then
     ESCAPED_AGENT_NAME=$(printf '%s\n' "$AGENT_NAME" | sed 's/[][(){}.^$*+?|\/\\-]/\\&/g')
     if grep -qE "^[[:space:]]*-[[:space:]]+target:[[:space:]]+$ESCAPED_AGENT_NAME[[:space:]]*$" "$ROUTING_FILE" 2>/dev/null; then
         echo "[VALIDATION] ✅ Target '$AGENT_NAME' found in routing.yml" >&2
     else
         echo "[VALIDATION] ⚠️ Target '$AGENT_NAME' NOT in routing.yml delegation rules" >&2
     fi
-elif [ -f "$ROUTING_FILE" ]; then
+elif [ -n "$ROUTING_FILE" ]; then
     echo "[VALIDATION] ⚠️ Could not identify the delegated agent (agent='$AGENT_NAME') — skipping routing.yml validation" >&2
-elif [ ! -f "$ROUTING_FILE" ]; then
-    echo "[VALIDATION] ⚠️ Could not read routing.yml for validation" >&2
 fi
+# else: no routing.yml found — silently skip (deployed users may not have it locally)
 
 # --- Cost estimation for delegation ---
 declare -A TIER_MAP

package/scripts/hooks/validate-post-conditions.sh

@@ -9,7 +9,7 @@ SESSION_ID=$(echo "$INPUT" | python3 -c "import sys,json; print(json.load(sys.st
 
 REVIEW_DIR=".pantheon/memory-bank/.tmp"
 if [ -d "$REVIEW_DIR" ]; then
-    REVIEW_COUNT=$(ls "$REVIEW_DIR"/REVIEW-* 2>/dev/null | wc -l)
+    REVIEW_COUNT=$(find "$REVIEW_DIR" -maxdepth 1 -name 'REVIEW-*' -type f 2>/dev/null | wc -l)
     if [ "$REVIEW_COUNT" -eq 0 ]; then
         echo "[POST-CONDITION] ⚠️ No REVIEW artifact found in $REVIEW_DIR/" >&2
         echo "[POST-CONDITION] 💡 Remember: implementation agents MUST call @themis for review" >&2

package/scripts/hooks/validate-tool-safety.sh

@@ -18,8 +18,11 @@ BLOCKED_PATTERNS=(
     "DROP\s+DATABASE"
     "TRUNCATE\s+TABLE"
     "DELETE\s+FROM\s+.*;?\s*$"
-    "rm\s+.*\s+--no-preserve-root"
-    ":(){ :|:& };:"
+    # DEAD PATTERN REMOVED: `rm\s+.*\s+--no-preserve-root` — redundant with
+    # pattern #1 which already blocks `rm -rf /` regardless of flags.
+    # DEAD PATTERN REMOVED: `:(){ :|:& };:` — fork bomb syntax never appears
+    # in real tool_input.command payloads (the entire stdin would need to be
+    # exactly this 13-char token with zero surrounding JSON/context).
     ">\s*/dev/\(sd[a-z]\|hd[a-z]\|disk[0-9]*\)"
     "dd\s+if=.*of=/dev/"
     "mkfs\."

package/scripts/install/agents-md.mjs

@@ -76,7 +76,9 @@ export function readCanonicalAgents() {
   if (!existsSync(AGENTS_DIR)) return []
 
   const files = readdirSync(AGENTS_DIR)
-    .filter((f) => (f.endsWith('.agent.md') || f.endsWith('.md')) && f.toLowerCase() !== 'readme.md')
+    .filter(
+      (f) => (f.endsWith('.agent.md') || f.endsWith('.md')) && f.toLowerCase() !== 'readme.md',
+    )
     .sort()
 
   const agents = []

package/scripts/install/cli-ui.mjs

@@ -95,22 +95,42 @@ export function summaryTable(items) {
   const bot = `\u2514${'\u2500'.repeat(nameWidth + 2)}\u2534${'\u2500'.repeat(statusWidth + 2)}\u2518`
 
   console.log(tag(top))
-  console.log(tag(`\u2502 ${'Componente'.padEnd(nameWidth)} \u2502 ${'Status'.padEnd(statusWidth)} \u2502`))
+  console.log(
+    tag(`\u2502 ${'Componente'.padEnd(nameWidth)} \u2502 ${'Status'.padEnd(statusWidth)} \u2502`),
+  )
   console.log(tag(sep))
   for (const item of items) {
-    console.log(tag(`\u2502 ${item.name.padEnd(nameWidth)} \u2502 ${String(item.status).padEnd(statusWidth)} \u2502`))
+    console.log(
+      tag(
+        `\u2502 ${item.name.padEnd(nameWidth)} \u2502 ${String(item.status).padEnd(statusWidth)} \u2502`,
+      ),
+    )
   }
   console.log(tag(bot))
 }
 
 export function spinner(message) {
-  const frames = ['\u280b', '\u2819', '\u2839', '\u2838', '\u283c', '\u2834', '\u2826', '\u2827', '\u2807', '\u280f']
+  const frames = [
+    '\u280b',
+    '\u2819',
+    '\u2839',
+    '\u2838',
+    '\u283c',
+    '\u2834',
+    '\u2826',
+    '\u2827',
+    '\u2807',
+    '\u280f',
+  ]
   let i = 0
   let running = true
 
   if (tty() && !_quiet) {
     const interval = setInterval(() => {
-      if (!running) { clearInterval(interval); return }
+      if (!running) {
+        clearInterval(interval)
+        return
+      }
       process.stdout.write(`\r${frames[i % frames.length]} ${tag(message)}...`)
       i++
     }, 80)

package/scripts/install/interactive.mjs

@@ -31,7 +31,10 @@ function teardownStdin() {
   }
 }
 
-export async function promptMultiSelect(options, { title = '', selected = new Set(), pageSize = 6 } = {}) {
+export async function promptMultiSelect(
+  options,
+  { title = '', selected = new Set(), pageSize = 6 } = {},
+) {
   if (options.length === 0) return new Set()
 
   const preSelected = selected instanceof Set ? selected : new Set(selected)
@@ -83,7 +86,11 @@ export async function promptMultiSelect(options, { title = '', selected = new Se
     const count = items.filter((i) => i.checked).length
     const total = items.length
     const noun = count === 1 ? 'selected' : 'selected'
-    lines.push(colors.dim(`(${count}/${total} ${noun}) — ${colors.cyan('↑')}${colors.dim('/')}${colors.cyan('↓')} navigate · ${colors.cyan('Space')}${colors.dim(' toggle · ')}${colors.cyan('Enter')}${colors.dim(' confirm')}`))
+    lines.push(
+      colors.dim(
+        `(${count}/${total} ${noun}) — ${colors.cyan('↑')}${colors.dim('/')}${colors.cyan('↓')} navigate · ${colors.cyan('Space')}${colors.dim(' toggle · ')}${colors.cyan('Enter')}${colors.dim(' confirm')}`,
+      ),
+    )
 
     const lineCount = lines.length
     if (previousLineCount > 0) cursorUp(previousLineCount)
@@ -247,7 +254,11 @@ export async function promptList(options, { title = '' } = {}) {
 
     if (hasMoreBelow) lines.push(colors.dim('  ...'))
 
-    lines.push(colors.dim(`(${colors.cyan('↑')}${colors.dim('/')}${colors.cyan('↓')} navigate · ${colors.cyan('Enter')}${colors.dim(' select')}`))
+    lines.push(
+      colors.dim(
+        `(${colors.cyan('↑')}${colors.dim('/')}${colors.cyan('↓')} navigate · ${colors.cyan('Enter')}${colors.dim(' select')}`,
+      ),
+    )
 
     const lineCount = lines.length
     if (previousLineCount > 0) cursorUp(previousLineCount)
@@ -307,9 +318,7 @@ export async function promptList(options, { title = '' } = {}) {
 }
 
 export async function runInteractiveInstall({ components = [], defaultComponents = [] } = {}) {
-  const defaultSet = new Set(
-    defaultComponents.length > 0 ? defaultComponents : components,
-  )
+  const defaultSet = new Set(defaultComponents.length > 0 ? defaultComponents : components)
 
   const componentOptions = [
     {
@@ -362,7 +371,9 @@ export async function runInteractiveInstall({ components = [], defaultComponents
 
   if (selectedComponents.size === 0) {
     process.stdout.write(`${colors.yellow('No components selected — using defaults\n')}`)
-    defaultSet.forEach((v) => selectedComponents.add(v))
+    defaultSet.forEach((v) => {
+      selectedComponents.add(v)
+    })
   }
 
   const targetOptions = [

package/scripts/install/migrate-config.mjs

@@ -16,20 +16,20 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
 import {
-  readState,
-  writeState,
-  createInitialState,
-  addMigrationRecord,
-  updateVersion,
-} from './state.mjs'
-import {
-  readCheckpoint,
-  writeCheckpoint,
   advanceCheckpoint,
+  listAppliedMigrations,
+  readCheckpoint,
   removeCheckpoint,
   resumePendingMigration,
-  listAppliedMigrations,
+  writeCheckpoint,
 } from './migrate.mjs'
+import {
+  addMigrationRecord,
+  createInitialState,
+  readState,
+  updateVersion,
+  writeState,
+} from './state.mjs'
 
 // ---------------------------------------------------------------------------
 // Migration step definitions
@@ -290,16 +290,10 @@ function main() {
     addMigrationRecord(state, config.from, config.to, 'completed')
     removeCheckpoint(config.target)
     writeState(config.target, state)
-    console.log(
-      `\n  \u2705 Migration complete: ${config.from} \u2192 ${config.to}`,
-    )
-    console.log(
-      `     State written to: ${join(config.target, '.pantheon', 'install-state.json')}`,
-    )
+    console.log(`\n  \u2705 Migration complete: ${config.from} \u2192 ${config.to}`)
+    console.log(`     State written to: ${join(config.target, '.pantheon', 'install-state.json')}`)
   } else {
-    console.log(
-      `\n  \u2705 Migration would complete (dry-run): ${config.from} \u2192 ${config.to}`,
-    )
+    console.log(`\n  \u2705 Migration would complete (dry-run): ${config.from} \u2192 ${config.to}`)
   }
 }
 

package/scripts/install/migrate.mjs

@@ -11,7 +11,7 @@
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { readState, writeState, createInitialState } from './state.mjs'
+import { createInitialState, readState, writeState } from './state.mjs'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const ROOT = join(__dirname, '..', '..')
@@ -243,9 +243,7 @@ export function rollbackMigration(target, version) {
   }
 
   const migrations = state.applied_migrations || []
-  const targetMigration = migrations.find(
-    (m) => m.to === version && m.status === 'completed',
-  )
+  const targetMigration = migrations.find((m) => m.to === version && m.status === 'completed')
   if (!targetMigration) {
     console.log(`  \u26A0\uFE0F  No completed migration found for version ${version}`)
     return { success: false, reason: 'Migration not found' }
@@ -341,7 +339,12 @@ function main() {
     console.log(`  Previous version: ${history.previousVersion || 'N/A'}`)
     console.log(`  Applied migrations: ${history.migrations.length}`)
     for (const m of history.migrations) {
-      const icon = m.status === 'completed' ? '\u2705' : m.status === 'rolled_back' ? '\u{1F504}' : '\u26A0\uFE0F'
+      const icon =
+        m.status === 'completed'
+          ? '\u2705'
+          : m.status === 'rolled_back'
+            ? '\u{1F504}'
+            : '\u26A0\uFE0F'
       console.log(`    ${icon} ${m.from} \u2192 ${m.to} [${m.status}] (${m.applied_at})`)
     }
     return

package/scripts/install/model-picker.mjs

@@ -55,7 +55,10 @@ export function writeActivePreset(
     copyFileSync(filePath, backupPath)
     backupMade = true
   }
-  writeFileSync(`${filePath}.tmp-${process.pid}`, `${JSON.stringify(buildActivePresetFile(presetName, source), null, 2)}\n`)
+  writeFileSync(
+    `${filePath}.tmp-${process.pid}`,
+    `${JSON.stringify(buildActivePresetFile(presetName, source), null, 2)}\n`,
+  )
   renameSync(`${filePath}.tmp-${process.pid}`, filePath)
   return { written: true, path: filePath, backupPath: backupMade ? backupPath : null }
 }

package/scripts/install/opencode.mjs

@@ -452,6 +452,7 @@ export async function installOpenCode(
       '_pantheon_paths.py',
       'mcp_persistence_server.py',
       'pantheon_vision_server.py',
+      'eval_store.py',
     ]
     const srcScriptsDir = join(ROOT, 'scripts')
     // Canonical MCP server sources live in src/mcp/. Map them explicitly so the
@@ -466,6 +467,7 @@ export async function installOpenCode(
       '_pantheon_paths.py': join(ROOT, 'src', 'mcp', '_pantheon_paths.py'),
       'mcp_persistence_server.py': join(ROOT, 'src', 'mcp', 'mcp_persistence_server.py'),
       'pantheon_vision_server.py': join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py'),
+      'eval_store.py': join(ROOT, 'src', 'mcp', 'eval_store.py'),
     }
     const dstScriptsDir = join(runtimeTarget, 'scripts')
     if (!dryRun) mkdirSync(dstScriptsDir, { recursive: true })

package/scripts/install/shared.mjs

@@ -15,10 +15,10 @@ import {
 import { basename, dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
-const REQUIRED_NODE_MAJOR = 18;
+const REQUIRED_NODE_MAJOR = 18
 if (parseInt(process.versions.node.split('.')[0], 10) < REQUIRED_NODE_MAJOR) {
-  console.error(`❌ Node.js >= ${REQUIRED_NODE_MAJOR} required (current: ${process.versions.node})`);
-  process.exit(1);
+  console.error(`❌ Node.js >= ${REQUIRED_NODE_MAJOR} required (current: ${process.versions.node})`)
+  process.exit(1)
 }
 
 import yaml from 'js-yaml'
@@ -33,7 +33,9 @@ export const PLATFORM_DIR = join(ROOT, 'platform')
 export function getAgentNames() {
   if (!existsSync(AGENTS_DIR)) return []
   return readdirSync(AGENTS_DIR)
-    .filter((f) => (f.endsWith('.agent.md') || f.endsWith('.md')) && f.toLowerCase() !== 'readme.md')
+    .filter(
+      (f) => (f.endsWith('.agent.md') || f.endsWith('.md')) && f.toLowerCase() !== 'readme.md',
+    )
     .map((f) => f.replace(/\.(agent\.)?md$/, ''))
     .sort()
 }

package/scripts/install/state.mjs

@@ -95,12 +95,15 @@ export function upgradeStateV1toV2(state) {
     updated_at: state.updated_at || now,
     migration_checkpoint: null,
     applied_migrations: Array.isArray(state.applied_migrations) ? state.applied_migrations : [],
-    components: state.components && typeof state.components === 'object' ? state.components : {
-      agents: { version: 1, status: 'installed' },
-      skills: { version: 1, status: 'installed' },
-      plugins: { version: 1, status: 'unknown' },
-      runtime: { version: 1, status: 'unknown' },
-    },
+    components:
+      state.components && typeof state.components === 'object'
+        ? state.components
+        : {
+            agents: { version: 1, status: 'installed' },
+            skills: { version: 1, status: 'installed' },
+            plugins: { version: 1, status: 'unknown' },
+            runtime: { version: 1, status: 'unknown' },
+          },
   }
 }
 

package/scripts/mcp_persistence_server.py

@@ -178,14 +178,15 @@ _global_root = (
 _global_db = _init_db(_global_root / "global.db")
 
 _project_db_instance = None
+_project_db_path: Path | None = None
 if args.project_db:
-    _project_db_instance = _init_db(Path(args.project_db))
+    _project_db_path = Path(args.project_db)
+    _project_db_instance = _init_db(_project_db_path)
 else:
     _proj = pantheon_project()
     if _proj:
-        _project_db_instance = _init_db(
-            _proj / ".pantheon" / "persistence" / "project.db"
-        )
+        _project_db_path = _proj / ".pantheon" / "persistence" / "project.db"
+        _project_db_instance = _init_db(_project_db_path)
 _project_db = _project_db_instance
 
 
@@ -262,7 +263,7 @@ async def kv_get(
     row = conn.execute(
         "SELECT value FROM kv_store "
         "WHERE namespace = ? AND key = ? "
-        "AND (expires_at IS NULL OR expires_at > datetime('now')) "
+        "AND (expires_at IS NULL OR datetime(expires_at) > datetime('now')) "
         "AND deleted_at IS NULL",
         (namespace, key),
     ).fetchone()
@@ -289,13 +290,13 @@ async def kv_stats(
     total = conn.execute("SELECT COUNT(*) FROM kv_store WHERE deleted_at IS NULL").fetchone()[0]
     expired = conn.execute(
         "SELECT COUNT(*) FROM kv_store "
-        "WHERE expires_at IS NOT NULL AND expires_at < datetime('now') "
+        "WHERE expires_at IS NOT NULL AND datetime(expires_at) < datetime('now') "
         "AND deleted_at IS NULL"
     ).fetchone()[0]
 
     ns_rows = conn.execute(
         "SELECT namespace, COUNT(*) as cnt, "
-        "SUM(CASE WHEN expires_at IS NOT NULL AND expires_at < datetime('now') THEN 1 ELSE 0 END) as expired_count "
+        "SUM(CASE WHEN expires_at IS NOT NULL AND datetime(expires_at) < datetime('now') THEN 1 ELSE 0 END) as expired_count "
         "FROM kv_store WHERE deleted_at IS NULL GROUP BY namespace ORDER BY cnt DESC"
     ).fetchall()
 
@@ -372,7 +373,7 @@ async def kv_list(
     rows = conn.execute(
         "SELECT key, value, created_at, expires_at FROM kv_store "
         "WHERE namespace = ? AND key LIKE ? "
-        "AND (expires_at IS NULL OR expires_at > datetime('now')) "
+        "AND (expires_at IS NULL OR datetime(expires_at) > datetime('now')) "
         "AND deleted_at IS NULL "
         "ORDER BY key LIMIT ?",
         (namespace, f"{prefix}%", limit),
@@ -426,7 +427,7 @@ async def kv_search(
         "JOIN kv_store ON kv_store_fts.rowid = kv_store.id "
         "WHERE kv_store_fts MATCH ? "
         "AND kv_store.deleted_at IS NULL "
-        "AND (kv_store.expires_at IS NULL OR kv_store.expires_at > datetime('now'))"
+        "AND (kv_store.expires_at IS NULL OR datetime(kv_store.expires_at) > datetime('now'))"
     )
     params: list[str | int] = [fts_query]
 
@@ -474,7 +475,7 @@ async def purge_expired(
     expired = conn.execute(
         "SELECT key FROM kv_store "
         "WHERE expires_at IS NOT NULL "
-        "AND expires_at < datetime('now') "
+        "AND datetime(expires_at) < datetime('now') "
         "AND deleted_at IS NULL",
     ).fetchall()
     expired_keys = [r[0] for r in expired]
@@ -490,7 +491,7 @@ async def purge_expired(
     conn.execute(
         "UPDATE kv_store SET deleted_at = datetime('now') "
         "WHERE expires_at IS NOT NULL "
-        "AND expires_at < datetime('now') "
+        "AND datetime(expires_at) < datetime('now') "
         "AND deleted_at IS NULL",
     )
     conn.commit()
@@ -516,7 +517,7 @@ def _opportunistic_auto_purge(conn: sqlite3.Connection, namespace: str, threshol
     conn.execute(
         "UPDATE kv_store SET deleted_at = datetime('now') "
         "WHERE namespace = ? AND expires_at IS NOT NULL "
-        "AND expires_at < datetime('now') AND deleted_at IS NULL",
+        "AND datetime(expires_at) < datetime('now') AND deleted_at IS NULL",
         (namespace,),
     )
     conn.commit()
@@ -659,7 +660,7 @@ async def context_get(
     row = conn.execute(
         "SELECT value FROM kv_store "
         "WHERE namespace = ? AND key = ? "
-        "AND (expires_at IS NULL OR expires_at > datetime('now')) "
+        "AND (expires_at IS NULL OR datetime(expires_at) > datetime('now')) "
         "AND deleted_at IS NULL",
         (ns, key),
     ).fetchone()
@@ -691,7 +692,7 @@ async def context_list(
     rows = conn.execute(
         "SELECT key, created_at, expires_at FROM kv_store "
         "WHERE namespace = ? "
-        "AND (expires_at IS NULL OR expires_at > datetime('now')) "
+        "AND (expires_at IS NULL OR datetime(expires_at) > datetime('now')) "
         "AND deleted_at IS NULL "
         "ORDER BY created_at DESC LIMIT 50",
         (ns,),
@@ -737,7 +738,7 @@ async def context_stats(
 
     expired = conn.execute(
         "SELECT COUNT(*) FROM kv_store "
-        "WHERE namespace = ? AND expires_at < datetime('now') "
+        "WHERE namespace = ? AND datetime(expires_at) < datetime('now') "
         "AND deleted_at IS NULL",
         (ns,),
     ).fetchone()[0]
@@ -773,15 +774,15 @@ async def context_stats(
     }
 
 def _resolve_db_path(scope: str) -> Path | None:
-    """Resolve the database file path for a given scope."""
+    """Resolve the database file path for a given scope.
+
+    Returns the actual path used at init (honoring an explicit
+    ``--project-db``), so deletelog writes and db_size stats land next to
+    the real database file.
+    """
     if scope == "global":
         return _global_root / "global.db"
-    if _project_db_instance:
-        # Find the project root from the project DB path
-        proj_root = pantheon_project()
-        if proj_root:
-            return proj_root / ".pantheon" / "persistence" / "project.db"
-    return None
+    return _project_db_path
 
 
 # ── Main Entrypoint ─────────────────────────────────────────────────────────────

package/scripts/mcp_resources_server.py

@@ -1,4 +1,3 @@
-# Auto-generated: resolved symlink from ../src/mcp/mcp_resources_server.py
 #!/usr/bin/env python3
 """Pantheon MCP Resources Server.
 
@@ -19,6 +18,7 @@ from typing import Any
 
 import yaml
 from _pantheon_paths import pantheon_home, pantheon_project
+from eval_store import get_latest_eval, list_evals
 from mcp.server.fastmcp import FastMCP
 
 # ── Path Resolution ──────────────────────────────────────────────────────────
@@ -112,6 +112,8 @@ async def list_skills() -> str:
 async def get_routing() -> str:
     """Return the full content of routing.yml."""
     routing_file = _PANTHEON_HOME / "routing.yml"
+    if not routing_file.exists() and _PANTHEON_PROJECT:
+        routing_file = _PANTHEON_PROJECT / "src" / "routing.yml"
     if not routing_file.exists():
         return "routing.yml not found."
     return routing_file.read_text(encoding="utf-8")
@@ -200,6 +202,63 @@ async def get_memory_bank(path: str) -> str:
     return resolved.read_text(encoding="utf-8")
 
 
+# ── Plugin Eval Resources ─────────────────────────────────────────────────────
+
+
+def _valid_plugin_name(name: str) -> bool:
+    """Validate a plugin name for the eval resource (no traversal)."""
+    return bool(name) and "/" not in name and "\\" not in name and ".." not in name
+
+
+@mcp.resource(
+    "pantheon://eval",
+    description="List of evaluated plugins/skills with their latest "
+    "certification score (from the plugin_eval memory namespace)",
+)
+async def list_plugin_evals() -> str:
+    """Return a markdown list of evaluated plugins with latest scores."""
+    entries = list_evals()
+    if not entries:
+        return "No plugin evals recorded yet."
+
+    lines = ["# Plugin Eval Certification", ""]
+    for entry in entries:
+        name = entry.get("name", "?")
+        score = entry.get("metadata", {}).get("score", "?")
+        created = entry.get("created_at", "")
+        lines.append(f"- **{name}** — score {score} (evaluated {created})")
+    return "\n".join(lines)
+
+
+@mcp.resource(
+    "pantheon://eval/{plugin}",
+    description="Latest certification report for a plugin/skill "
+    "(from the plugin_eval memory namespace)",
+)
+async def get_plugin_eval(plugin: str) -> str:
+    """Return the latest eval certification report for a plugin.
+
+    Security: plugin names containing path separators or traversal
+    sequences are rejected before any lookup.
+    """
+    if not _valid_plugin_name(plugin):
+        return "Invalid plugin name: blocked."
+
+    entry = get_latest_eval(plugin)
+    if entry is None:
+        return f"No eval found for plugin '{plugin}'."
+
+    score = entry.get("metadata", {}).get("score", "?")
+    created = entry.get("created_at", "")
+    value = entry.get("value", "{}")
+    return (
+        f"# Eval Report: {plugin}\n\n"
+        f"**Score:** {score}\n"
+        f"**Evaluated:** {created}\n\n"
+        f"```json\n{value}\n```"
+    )
+
+
 # ── Main Entrypoint ───────────────────────────────────────────────────────────
 
 if __name__ == "__main__":