pantheon-opencode 1.3.5 → 1.3.7

package/src/mcp/code_mode_server.py

@@ -16,10 +16,18 @@ Or via MCP client (stdio transport):
 from __future__ import annotations
 
 import asyncio
+import logging
 import os
+import signal
+import shutil
 import stat
+import sys
+import time
 from contextlib import suppress
 from pathlib import Path
+from typing import Any
+
+import yaml
 
 from _pantheon_paths import pantheon_home, pantheon_project
 from mcp.server.fastmcp import FastMCP
@@ -27,6 +35,98 @@ from mcp.server.fastmcp import FastMCP
 # ── Constants ─────────────────────────────────────────────────────────────────
 ALLOWED_EXTENSIONS: frozenset[str] = frozenset({".sh", ".py"})
 SCRIPT_TIMEOUT: int = 30
+# Hard ceiling for frontmatter `timeout:` overrides — no script may pin the
+# executor for longer than 5 minutes.
+MAX_SCRIPT_TIMEOUT: int = 300
+
+# ── Env Allowlist ──────────────────────────────────────────────────────────────
+# Only these variables are passed to script subprocesses.  Everything else
+# (secrets, cloud credentials, etc.) is stripped to limit blast radius.
+_CODE_MODE_ENV_ALLOWLIST: frozenset[str] = frozenset({
+    "PATH",
+    "HOME",
+    "LANG",
+    "PANTHEON_HOME",
+    "PANTHEON_PROJECT",
+    "OPENAI_API_KEY",
+    "OPENAI_BASE_URL",
+    "EVAL_JUDGE_MODEL",
+    "SHELL",
+    "USER",
+})
+
+# Optional extra vars that callers may opt-in to pass through.  Populate
+# this set at startup if needed (e.g. ``CODE_MODE_EXTRA_ENV.add("MY_VAR")``).
+CODE_MODE_EXTRA_ENV: set[str] = set()
+
+# Safe defaults when the host env is completely empty.
+_SAFE_DEFAULTS: dict[str, str] = {
+    "PATH": "/usr/local/bin:/usr/bin:/bin",
+    "HOME": "/tmp",
+}
+
+_log = logging.getLogger(__name__)
+
+
+def _build_script_env(
+    host_env: dict[str, str] | None = None,
+) -> dict[str, str]:
+    """Construct a minimal env dict for script subprocesses.
+
+    Only allowlisted vars (plus any in ``CODE_MODE_EXTRA_ENV``) are
+    forwarded from *host_env* (defaults to ``os.environ``).  Missing
+    allowlisted vars receive safe defaults from ``_SAFE_DEFAULTS``.
+
+    Returns a **new** dict — the input is never mutated.
+    """
+    if host_env is None:
+        host_env = dict(os.environ)
+
+    allowed = _CODE_MODE_ENV_ALLOWLIST | CODE_MODE_EXTRA_ENV
+    env: dict[str, str] = {}
+
+    for key in allowed:
+        if key in host_env:
+            env[key] = host_env[key]
+        elif key in _SAFE_DEFAULTS:
+            env[key] = _SAFE_DEFAULTS[key]
+
+    # Always ensure PATH is present even if allowlist + defaults both miss it.
+    if "PATH" not in env:
+        env["PATH"] = _SAFE_DEFAULTS.get("PATH", "/usr/local/bin:/usr/bin:/bin")
+
+    return env
+
+
+def _prlimit_prefix(
+    prlimit_path: str | None,
+    timeout_s: int = SCRIPT_TIMEOUT,
+) -> list[str] | None:
+    """Return a ``prlimit`` command prefix to wrap a subprocess, or *None*.
+
+    On Linux with ``prlimit`` available the prefix adds:
+      --nproc=512  --as=1073741824  --cpu=<timeout_s + 5>
+
+    On non-Linux or when *prlimit_path* is falsy, returns *None* (fail-open).
+    """
+    if not prlimit_path:
+        return None
+
+    cpu_limit = timeout_s + 5
+    return [
+        prlimit_path,
+        "--nproc=512",
+        "--as=1073741824",  # 1 GiB in bytes
+        f"--cpu={cpu_limit}",
+        "--",
+    ]
+
+
+def _detect_prlimit() -> str | None:
+    """Return the path to ``prlimit`` if available, else *None*."""
+    if sys.platform != "linux":
+        return None
+    return shutil.which("prlimit")
 
 # ── Scripts Directory Resolution ─────────────────────────────────────────────
 # Priority:
@@ -87,12 +187,16 @@ def _validate_script_name(script_name: str) -> Path:
 
 
 def _format_output(
-    stdout: str, stderr: str, exit_code: int, timed_out: bool = False
+    stdout: str,
+    stderr: str,
+    exit_code: int,
+    timed_out: bool = False,
+    timeout_s: int = SCRIPT_TIMEOUT,
 ) -> str:
     """Format script execution output into a readable string."""
     parts: list[str] = []
     if timed_out:
-        parts.append(f"[TIMEOUT] Script exceeded {SCRIPT_TIMEOUT}s limit")
+        parts.append(f"[TIMEOUT] Script exceeded {timeout_s}s limit")
     if stdout:
         parts.append(stdout)
     if stderr:
@@ -101,6 +205,123 @@ def _format_output(
     return "\n".join(parts)
 
 
+# ── Script Metadata (YAML frontmatter) ────────────────────────────────────────
+# Optional comment-style frontmatter at the top of a script (after an optional
+# shebang). Comment lines keep the script a valid executable in both bash and
+# python while carrying metadata:
+#
+#     #!/usr/bin/env python3
+#     # ---
+#     # description: Runs the checkpoint save
+#     # timeout: 5
+#     # allowed_args:
+#     #   - compress
+#     #   - --text
+#     # ---
+#
+# Supported keys: description (str), timeout (int seconds, overrides the 30s
+# default), allowed_args (list of allowed CLI args — validated on execute).
+
+
+def _parse_frontmatter(script_path: Path) -> dict[str, Any]:
+    """Parse comment-style YAML frontmatter from a script.
+
+    Returns an empty dict when the script has no frontmatter or the block is
+    malformed (fail-open — never blocks execution).
+    """
+    try:
+        text = script_path.read_text(encoding="utf-8")
+    except OSError:
+        return {}
+    lines = text.splitlines()
+
+    # Locate the opening delimiter: a comment line that is exactly "# ---".
+    # Only scan the header region (before the first non-comment code line).
+    start: int | None = None
+    for i, line in enumerate(lines):
+        stripped = line.strip()
+        if stripped == "# ---":
+            start = i
+            break
+        if i > 0 and stripped and not stripped.startswith("#"):
+            break
+    if start is None:
+        return {}
+
+    body_lines: list[str] = []
+    for j in range(start + 1, len(lines)):
+        stripped = lines[j].strip()
+        if stripped == "# ---":
+            break
+        if not stripped.startswith("#"):
+            return {}  # non-comment line inside the block → not frontmatter
+        body_lines.append(stripped[1:].lstrip() if stripped.startswith("# ") else stripped[1:])
+    else:
+        return {}  # no closing delimiter
+
+    try:
+        data = yaml.safe_load("\n".join(body_lines))
+    except yaml.YAMLError:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _script_timeout(script_path: Path) -> int:
+    """Per-script timeout override from frontmatter, capped at MAX_SCRIPT_TIMEOUT.
+
+    Honors any positive integer `timeout:` from the script frontmatter, but
+    never returns more than 300s (5 min) regardless of what frontmatter asks.
+    """
+    timeout = _parse_frontmatter(script_path).get("timeout")
+    if isinstance(timeout, int) and timeout > 0:
+        return min(timeout, MAX_SCRIPT_TIMEOUT)
+    return SCRIPT_TIMEOUT
+
+
+def _validate_args(script_path: Path, args: list[str]) -> str | None:
+    """Validate args against the frontmatter ``allowed_args`` allowlist.
+
+    Returns an error message when a passed arg is not allowed, else None.
+    A missing or malformed allowlist fails open (no restriction).
+    """
+    allowed = _parse_frontmatter(script_path).get("allowed_args")
+    if allowed is None:
+        return None
+    if not isinstance(allowed, list) or not all(isinstance(a, str) for a in allowed):
+        return None
+    denied = [a for a in args if a not in allowed]
+    if denied:
+        return (
+            f"Argument(s) {denied} not allowed for script '{script_path.name}'. "
+            f"Allowed: {allowed}"
+        )
+    return None
+
+
+def _build_result(
+    stdout: str,
+    stderr: str,
+    exit_code: int,
+    timed_out: bool,
+    duration_ms: int,
+    metadata: dict[str, Any],
+    json_output: bool,
+    timeout_s: int,
+) -> str | dict[str, Any]:
+    """Build the tool result in plain-text or structured JSON form."""
+    if json_output:
+        return {
+            "stdout": stdout,
+            "stderr": stderr,
+            "exit_code": exit_code,
+            "timed_out": timed_out,
+            "duration_ms": duration_ms,
+            "timeout_s": timeout_s,
+            "metadata": metadata,
+        }
+    return _format_output(stdout, stderr, exit_code, timed_out, timeout_s)
+
+
 # ── Static Resources ──────────────────────────────────────────────────────────
 
 
@@ -126,15 +347,20 @@ async def list_code_mode_scripts() -> str:
 
 @mcp.resource(
     "pantheon://code-mode/scripts/{script_name}",
-    description="Content of a code-mode script by name",
+    description="Content of a code-mode script by name, with parsed frontmatter metadata",
 )
 async def get_code_mode_script(script_name: str) -> str:
-    """Return the source content of a code-mode script."""
+    """Return the source content of a code-mode script plus its metadata."""
     try:
         script_path = _validate_script_name(script_name)
-        return script_path.read_text(encoding="utf-8")
     except ValueError as e:
         return str(e)
+    metadata = _parse_frontmatter(script_path)
+    source = script_path.read_text(encoding="utf-8")
+    if not metadata:
+        return source
+    meta_lines = "\n".join(f"{k}: {v}" for k, v in sorted(metadata.items()))
+    return f"# metadata\n{meta_lines}\n\n{source}"
 
 
 # ── Tools ─────────────────────────────────────────────────────────────────────
@@ -142,16 +368,27 @@ async def get_code_mode_script(script_name: str) -> str:
 
 @mcp.tool(
     name="execute_code_script",
-    description="Run a .sh/.py script from .pantheon/code-mode/ "
-    "with optional args. 30s timeout.",
+    description="Run a .sh/.py script from .pantheon/code-mode/ with optional args. "
+    "30s default timeout (override via YAML frontmatter `timeout`). "
+    "Set json_output=true for structured JSON output.",
 )
-async def execute_code_script(script_name: str, args: list[str] | None = None) -> str:
+async def execute_code_script(
+    script_name: str,
+    args: list[str] | None = None,
+    json_output: bool = False,
+) -> str | dict[str, Any]:
     """Execute a code-mode script with confinement and timeout.
 
     Args:
         script_name: Name of the script in the code-mode directory.
         args: Optional CLI arguments forwarded to the subprocess (e.g.
             ``["compress", "--text", "..."]``). Defaults to no args.
+        json_output: When True, return a structured dict with stdout, stderr,
+            exit_code, duration_ms, timed_out and frontmatter metadata
+            instead of the plain-text summary.
+
+    Returns:
+        Plain-text summary (default) or structured dict (json_output=True).
     """
     args = args or []
     try:
@@ -159,6 +396,13 @@ async def execute_code_script(script_name: str, args: list[str] | None = None) -
     except ValueError as e:
         return str(e)
 
+    metadata = _parse_frontmatter(script_path)
+    denied = _validate_args(script_path, args)
+    if denied is not None:
+        return denied
+
+    timeout_s = _script_timeout(script_path)
+
     # Ensure script is executable
     if not os.access(script_path, os.X_OK):
         with suppress(OSError):
@@ -166,34 +410,76 @@ async def execute_code_script(script_name: str, args: list[str] | None = None) -
             script_path.chmod(mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
 
     script_dir = script_path.parent
+    started = time.monotonic()
+
+    # ── Build sanitized env & optional prlimit prefix ────────────────────
+    env_dict = _build_script_env()
+    prlimit = _prlimit_prefix(_detect_prlimit(), timeout_s)
+
+    # Command: optionally wrapped with prlimit for resource limits.
+    if prlimit is not None:
+        cmd = [*prlimit, str(script_path), *args]
+    else:
+        cmd = [str(script_path), *args]
+
     try:
         proc = await asyncio.create_subprocess_exec(
-            str(script_path),
-            *args,
+            *cmd,
             cwd=str(script_dir),
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.PIPE,
+            env=env_dict,
+            start_new_session=True,
         )
         try:
             stdout, stderr = await asyncio.wait_for(
-                proc.communicate(), timeout=SCRIPT_TIMEOUT
+                proc.communicate(), timeout=timeout_s
             )
-            return _format_output(
+            duration_ms = int((time.monotonic() - started) * 1000)
+            return _build_result(
                 stdout.decode("utf-8", errors="replace"),
                 stderr.decode("utf-8", errors="replace"),
                 proc.returncode or 0,
+                timed_out=False,
+                duration_ms=duration_ms,
+                metadata=metadata,
+                json_output=json_output,
+                timeout_s=timeout_s,
             )
         except TimeoutError:
-            proc.kill()
+            # Kill the entire process group so child processes don't survive.
+            try:
+                os.killpg(os.getpgid(proc.pid), signal.SIGKILL)
+            except (ProcessLookupError, OSError):
+                proc.kill()  # fallback: kill main process only
             await proc.wait()
-            return _format_output("", "", -1, timed_out=True)
+            duration_ms = int((time.monotonic() - started) * 1000)
+            return _build_result(
+                "", "", -1, timed_out=True, duration_ms=duration_ms,
+                metadata=metadata, json_output=json_output, timeout_s=timeout_s,
+            )
     except FileNotFoundError:
-        return (
-            f"Script '{script_name}' not found "
-            f"or interpreter missing.\n--- exit code: -1"
+        return _build_result(
+            "",
+            f"Script '{script_name}' not found or interpreter missing.",
+            -1,
+            timed_out=False,
+            duration_ms=0,
+            metadata=metadata,
+            json_output=json_output,
+            timeout_s=timeout_s,
         )
     except OSError as e:
-        return f"Failed to execute script: {e}\n--- exit code: -1"
+        return _build_result(
+            "",
+            f"Failed to execute script: {e}",
+            -1,
+            timed_out=False,
+            duration_ms=0,
+            metadata=metadata,
+            json_output=json_output,
+            timeout_s=timeout_s,
+        )
 
 
 # ── Main Entrypoint ───────────────────────────────────────────────────────────

package/src/mcp/eval_store.py

@@ -0,0 +1,233 @@
+#!/usr/bin/env python3
+"""Plugin eval certification storage — ``plugin_eval`` memory namespace.
+
+Thin stdlib-only wrapper around the memory SQLite DB (same schema as
+``src/mcp/memory_mcp_server.py``) for plugin-eval certification results.
+
+Namespace: ``plugin_eval``
+Key format: ``eval:<name>:<date>``  (e.g. ``eval:tdd-with-agents:2026-08-21``)
+Metadata:   ``{"type": "eval", "score": N}``
+
+Follows the ``council_decisions`` namespace pattern (same shape, different
+namespace). Write path is used by the eval scripts (``eval-static.py``);
+read path is used by the resources server (``pantheon://eval`` resources).
+
+Deliberately dependency-free (stdlib only) so it can be loaded from
+``.pantheon/code-mode/`` scripts via importlib without sys.path games.
+The memory DB path resolution mirrors ``_pantheon_paths.pantheon_home()``
+(canonical source) — kept inline to avoid the import.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sqlite3
+import time
+from datetime import date
+from pathlib import Path
+from typing import Any
+
+NAMESPACE = "plugin_eval"
+
+# Minimal schema — matches memory_mcp_server.SCHEMA_SQL for the memories
+# table (vec/FTS tables are initialized by the memory MCP server on first
+# run; eval entries remain readable via list/recall regardless).
+_SCHEMA_SQL = """
+CREATE TABLE IF NOT EXISTS memories (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    namespace TEXT NOT NULL DEFAULT 'default',
+    key TEXT,
+    value TEXT NOT NULL,
+    metadata TEXT NOT NULL DEFAULT '{}',
+    created_at TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_memories_ns_key
+    ON memories(namespace, key);
+"""
+
+
+# ── Path resolution ───────────────────────────────────────────────────────────
+
+
+def _db_path() -> Path:
+    """Return the memory SQLite DB path (mirrors pantheon_home())."""
+    env = os.environ.get("PANTHEON_HOME")
+    if env:
+        return Path(env).expanduser().resolve() / "memory" / "memory.db"
+    xdg = os.environ.get("XDG_CONFIG_HOME")
+    if xdg:
+        return Path(xdg).expanduser().resolve() / "opencode" / "memory" / "memory.db"
+    return Path.home() / ".config" / "opencode" / "memory" / "memory.db"
+
+
+def _connect() -> sqlite3.Connection:
+    """Open (creating if needed) the memory DB with row access."""
+    path = _db_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    conn = sqlite3.connect(str(path))
+    conn.row_factory = sqlite3.Row
+    conn.execute("PRAGMA journal_mode=WAL")
+    conn.executescript(_SCHEMA_SQL)
+    return conn
+
+
+def _now_iso() -> str:
+    """Return current UTC time as ISO 8601 string."""
+    return time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+
+
+def _parse_metadata(raw: str) -> dict[str, Any]:
+    """Parse the metadata JSON field, defaulting to {} on failure."""
+    try:
+        return json.loads(raw) if raw else {}
+    except json.JSONDecodeError:
+        return {}
+
+
+def _entry_from_row(row: sqlite3.Row) -> dict[str, Any]:
+    """Convert a memory row to a plain dict with parsed metadata."""
+    entry = dict(row)
+    entry["metadata"] = _parse_metadata(entry.get("metadata", "{}"))
+    return entry
+
+
+# ── Write path (eval scripts) ─────────────────────────────────────────────────
+
+
+def store_eval(
+    name: str,
+    report: dict[str, Any],
+    score: int,
+    when: str | None = None,
+) -> dict[str, Any]:
+    """Store an eval certification result in the ``plugin_eval`` namespace.
+
+    Args:
+        name: Plugin/skill/agent name (used in the key).
+        report: The eval report dict (JSON-serialized as the value).
+        score: Numeric certification score (0-100), stored in metadata.
+        when: Optional ISO date for the key (default: today).
+
+    Returns:
+        Dict with id, namespace, key, status — or {"error": ...} on
+        duplicate key / failure.
+    """
+    key = f"eval:{name}:{when or date.today().isoformat()}"
+    value = json.dumps(report, ensure_ascii=False)
+    metadata = json.dumps({"type": "eval", "score": int(score)})
+    now = _now_iso()
+
+    conn = _connect()
+    try:
+        cur = conn.execute(
+            """INSERT INTO memories (namespace, key, value, metadata,
+             created_at, updated_at)
+               VALUES (?, ?, ?, ?, ?, ?)""",
+            [NAMESPACE, key, value, metadata, now, now],
+        )
+        conn.commit()
+        return {
+            "id": cur.lastrowid,
+            "namespace": NAMESPACE,
+            "key": key,
+            "status": "stored",
+        }
+    except sqlite3.IntegrityError:
+        conn.rollback()
+        return {"error": f"Duplicate key or constraint violation: {key}"}
+    except Exception as e:  # noqa: BLE001
+        conn.rollback()
+        return {"error": f"Failed to store eval: {e}"}
+    finally:
+        conn.close()
+
+
+# ── Read path (resources server) ──────────────────────────────────────────────
+
+
+def list_evals(limit: int = 100) -> list[dict[str, Any]]:
+    """List the latest eval entry per plugin, newest eval date first.
+
+    Returns a list of entry dicts (id, namespace, key, value, metadata,
+    created_at) with an extra ``name`` field parsed from the key. Only the
+    most recent entry per plugin name is returned, ordered by the eval
+    date embedded in the key (``eval:<name>:<date>``) descending.
+
+    Args:
+        limit: Maximum entries (default 100).
+
+    Returns:
+        List of entry dicts, newest eval date first. Empty if none exist.
+    """
+    limit = max(1, min(500, int(limit)))
+    conn = _connect()
+    try:
+        rows = conn.execute(
+            """SELECT id, namespace, key, value, metadata, created_at
+               FROM memories WHERE namespace = ? ORDER BY id DESC""",
+            [NAMESPACE],
+        ).fetchall()
+    except sqlite3.Error:
+        return []
+    finally:
+        conn.close()
+
+    # Latest entry per plugin name, keyed by the eval date in the key.
+    latest: dict[str, tuple[str, dict[str, Any]]] = {}
+    for row in rows:
+        entry = _entry_from_row(row)
+        name, when = _name_and_date(entry.get("key", ""))
+        if name is None:
+            continue
+        if name not in latest or when > latest[name][0]:
+            entry["name"] = name
+            latest[name] = (when, entry)
+
+    ordered = sorted(latest.values(), key=lambda t: t[0], reverse=True)
+    return [entry for _, entry in ordered[:limit]]
+
+
+def get_latest_eval(name: str) -> dict[str, Any] | None:
+    """Return the latest eval entry for a plugin name, or None.
+
+    Args:
+        name: Plugin/skill/agent name.
+
+    Returns:
+        Entry dict (with parsed metadata and ``name``) or None.
+    """
+    conn = _connect()
+    try:
+        # Exact prefix match via substr (NOT LIKE): plugin names may contain
+        # '_' or '%', which would act as wildcards under LIKE semantics.
+        prefix = f"eval:{name}:"
+        rows = conn.execute(
+            """SELECT id, namespace, key, value, metadata, created_at
+               FROM memories
+               WHERE namespace = ? AND substr(key, 1, length(?)) = ?
+               ORDER BY created_at DESC, id DESC LIMIT 1""",
+            [NAMESPACE, prefix, prefix],
+        ).fetchall()
+    except sqlite3.Error:
+        return None
+    finally:
+        conn.close()
+
+    if not rows:
+        return None
+    entry = _entry_from_row(rows[0])
+    entry["name"] = name
+    return entry
+
+
+def _name_and_date(key: str) -> tuple[str | None, str]:
+    """Split an ``eval:<name>:<date>`` key into (name, date)."""
+    if not key.startswith("eval:"):
+        return None, ""
+    parts = key.split(":")
+    if len(parts) < 3:
+        return None, ""
+    return ":".join(parts[1:-1]) or None, parts[-1]