pantheon-opencode 1.3.5 → 1.3.7

package/src/mcp/mcp_persistence_server.py

@@ -178,14 +178,15 @@ _global_root = (
 _global_db = _init_db(_global_root / "global.db")
 
 _project_db_instance = None
+_project_db_path: Path | None = None
 if args.project_db:
-    _project_db_instance = _init_db(Path(args.project_db))
+    _project_db_path = Path(args.project_db)
+    _project_db_instance = _init_db(_project_db_path)
 else:
     _proj = pantheon_project()
     if _proj:
-        _project_db_instance = _init_db(
-            _proj / ".pantheon" / "persistence" / "project.db"
-        )
+        _project_db_path = _proj / ".pantheon" / "persistence" / "project.db"
+        _project_db_instance = _init_db(_project_db_path)
 _project_db = _project_db_instance
 
 
@@ -262,7 +263,7 @@ async def kv_get(
     row = conn.execute(
         "SELECT value FROM kv_store "
         "WHERE namespace = ? AND key = ? "
-        "AND (expires_at IS NULL OR expires_at > datetime('now')) "
+        "AND (expires_at IS NULL OR datetime(expires_at) > datetime('now')) "
         "AND deleted_at IS NULL",
         (namespace, key),
     ).fetchone()
@@ -289,13 +290,13 @@ async def kv_stats(
     total = conn.execute("SELECT COUNT(*) FROM kv_store WHERE deleted_at IS NULL").fetchone()[0]
     expired = conn.execute(
         "SELECT COUNT(*) FROM kv_store "
-        "WHERE expires_at IS NOT NULL AND expires_at < datetime('now') "
+        "WHERE expires_at IS NOT NULL AND datetime(expires_at) < datetime('now') "
         "AND deleted_at IS NULL"
     ).fetchone()[0]
 
     ns_rows = conn.execute(
         "SELECT namespace, COUNT(*) as cnt, "
-        "SUM(CASE WHEN expires_at IS NOT NULL AND expires_at < datetime('now') THEN 1 ELSE 0 END) as expired_count "
+        "SUM(CASE WHEN expires_at IS NOT NULL AND datetime(expires_at) < datetime('now') THEN 1 ELSE 0 END) as expired_count "
         "FROM kv_store WHERE deleted_at IS NULL GROUP BY namespace ORDER BY cnt DESC"
     ).fetchall()
 
@@ -372,7 +373,7 @@ async def kv_list(
     rows = conn.execute(
         "SELECT key, value, created_at, expires_at FROM kv_store "
         "WHERE namespace = ? AND key LIKE ? "
-        "AND (expires_at IS NULL OR expires_at > datetime('now')) "
+        "AND (expires_at IS NULL OR datetime(expires_at) > datetime('now')) "
         "AND deleted_at IS NULL "
         "ORDER BY key LIMIT ?",
         (namespace, f"{prefix}%", limit),
@@ -426,7 +427,7 @@ async def kv_search(
         "JOIN kv_store ON kv_store_fts.rowid = kv_store.id "
         "WHERE kv_store_fts MATCH ? "
         "AND kv_store.deleted_at IS NULL "
-        "AND (kv_store.expires_at IS NULL OR kv_store.expires_at > datetime('now'))"
+        "AND (kv_store.expires_at IS NULL OR datetime(kv_store.expires_at) > datetime('now'))"
     )
     params: list[str | int] = [fts_query]
 
@@ -474,7 +475,7 @@ async def purge_expired(
     expired = conn.execute(
         "SELECT key FROM kv_store "
         "WHERE expires_at IS NOT NULL "
-        "AND expires_at < datetime('now') "
+        "AND datetime(expires_at) < datetime('now') "
         "AND deleted_at IS NULL",
     ).fetchall()
     expired_keys = [r[0] for r in expired]
@@ -490,7 +491,7 @@ async def purge_expired(
     conn.execute(
         "UPDATE kv_store SET deleted_at = datetime('now') "
         "WHERE expires_at IS NOT NULL "
-        "AND expires_at < datetime('now') "
+        "AND datetime(expires_at) < datetime('now') "
         "AND deleted_at IS NULL",
     )
     conn.commit()
@@ -516,7 +517,7 @@ def _opportunistic_auto_purge(conn: sqlite3.Connection, namespace: str, threshol
     conn.execute(
         "UPDATE kv_store SET deleted_at = datetime('now') "
         "WHERE namespace = ? AND expires_at IS NOT NULL "
-        "AND expires_at < datetime('now') AND deleted_at IS NULL",
+        "AND datetime(expires_at) < datetime('now') AND deleted_at IS NULL",
         (namespace,),
     )
     conn.commit()
@@ -659,7 +660,7 @@ async def context_get(
     row = conn.execute(
         "SELECT value FROM kv_store "
         "WHERE namespace = ? AND key = ? "
-        "AND (expires_at IS NULL OR expires_at > datetime('now')) "
+        "AND (expires_at IS NULL OR datetime(expires_at) > datetime('now')) "
         "AND deleted_at IS NULL",
         (ns, key),
     ).fetchone()
@@ -691,7 +692,7 @@ async def context_list(
     rows = conn.execute(
         "SELECT key, created_at, expires_at FROM kv_store "
         "WHERE namespace = ? "
-        "AND (expires_at IS NULL OR expires_at > datetime('now')) "
+        "AND (expires_at IS NULL OR datetime(expires_at) > datetime('now')) "
         "AND deleted_at IS NULL "
         "ORDER BY created_at DESC LIMIT 50",
         (ns,),
@@ -737,7 +738,7 @@ async def context_stats(
 
     expired = conn.execute(
         "SELECT COUNT(*) FROM kv_store "
-        "WHERE namespace = ? AND expires_at < datetime('now') "
+        "WHERE namespace = ? AND datetime(expires_at) < datetime('now') "
         "AND deleted_at IS NULL",
         (ns,),
     ).fetchone()[0]
@@ -773,15 +774,15 @@ async def context_stats(
     }
 
 def _resolve_db_path(scope: str) -> Path | None:
-    """Resolve the database file path for a given scope."""
+    """Resolve the database file path for a given scope.
+
+    Returns the actual path used at init (honoring an explicit
+    ``--project-db``), so deletelog writes and db_size stats land next to
+    the real database file.
+    """
     if scope == "global":
         return _global_root / "global.db"
-    if _project_db_instance:
-        # Find the project root from the project DB path
-        proj_root = pantheon_project()
-        if proj_root:
-            return proj_root / ".pantheon" / "persistence" / "project.db"
-    return None
+    return _project_db_path
 
 
 # ── Main Entrypoint ─────────────────────────────────────────────────────────────

package/src/mcp/mcp_resources_server.py

@@ -18,6 +18,7 @@ from typing import Any
 
 import yaml
 from _pantheon_paths import pantheon_home, pantheon_project
+from eval_store import get_latest_eval, list_evals
 from mcp.server.fastmcp import FastMCP
 
 # ── Path Resolution ──────────────────────────────────────────────────────────
@@ -201,6 +202,63 @@ async def get_memory_bank(path: str) -> str:
     return resolved.read_text(encoding="utf-8")
 
 
+# ── Plugin Eval Resources ─────────────────────────────────────────────────────
+
+
+def _valid_plugin_name(name: str) -> bool:
+    """Validate a plugin name for the eval resource (no traversal)."""
+    return bool(name) and "/" not in name and "\\" not in name and ".." not in name
+
+
+@mcp.resource(
+    "pantheon://eval",
+    description="List of evaluated plugins/skills with their latest "
+    "certification score (from the plugin_eval memory namespace)",
+)
+async def list_plugin_evals() -> str:
+    """Return a markdown list of evaluated plugins with latest scores."""
+    entries = list_evals()
+    if not entries:
+        return "No plugin evals recorded yet."
+
+    lines = ["# Plugin Eval Certification", ""]
+    for entry in entries:
+        name = entry.get("name", "?")
+        score = entry.get("metadata", {}).get("score", "?")
+        created = entry.get("created_at", "")
+        lines.append(f"- **{name}** — score {score} (evaluated {created})")
+    return "\n".join(lines)
+
+
+@mcp.resource(
+    "pantheon://eval/{plugin}",
+    description="Latest certification report for a plugin/skill "
+    "(from the plugin_eval memory namespace)",
+)
+async def get_plugin_eval(plugin: str) -> str:
+    """Return the latest eval certification report for a plugin.
+
+    Security: plugin names containing path separators or traversal
+    sequences are rejected before any lookup.
+    """
+    if not _valid_plugin_name(plugin):
+        return "Invalid plugin name: blocked."
+
+    entry = get_latest_eval(plugin)
+    if entry is None:
+        return f"No eval found for plugin '{plugin}'."
+
+    score = entry.get("metadata", {}).get("score", "?")
+    created = entry.get("created_at", "")
+    value = entry.get("value", "{}")
+    return (
+        f"# Eval Report: {plugin}\n\n"
+        f"**Score:** {score}\n"
+        f"**Evaluated:** {created}\n\n"
+        f"```json\n{value}\n```"
+    )
+
+
 # ── Main Entrypoint ───────────────────────────────────────────────────────────
 
 if __name__ == "__main__":

package/src/mcp/memory_mcp_server.py

@@ -25,6 +25,7 @@ import json
 import os
 import sqlite3
 import time
+from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 
@@ -186,10 +187,55 @@ def _parse_metadata(row: dict[str, Any]) -> dict[str, Any]:
 _RRF_CONST = 60
 
 
+def _parse_iso_ts(value: str) -> float:
+    """Parse an ISO 8601 UTC timestamp to epoch seconds.
+
+    Handles both aware ISO strings (``2026-08-21T10:00:00Z`` /
+    ``...+00:00``) and legacy naive rows from ``DEFAULT (datetime('now'))``
+    (``YYYY-MM-DD HH:MM:SS``, space separator, no TZ). Naive timestamps are
+    assumed UTC — SQLite's ``datetime('now')`` is UTC, so interpreting them
+    in the local timezone would skew freshness decay.
+    """
+    dt = datetime.fromisoformat(value.replace("Z", "+00:00"))
+    if dt.tzinfo is None:
+        dt = dt.replace(tzinfo=timezone.utc)
+    return dt.timestamp()
+
+
+def _fetch_created_at_map(
+    db: sqlite3.Connection, ids: list[int]
+) -> dict[int, str]:
+    """Fetch created_at timestamps for the given memory IDs.
+
+    Args:
+        db: Active SQLite connection.
+        ids: Memory row IDs to look up.
+
+    Returns:
+        Mapping of id -> created_at ISO string. Empty on failure.
+    """
+    created_at_map: dict[int, str] = {}
+    if not ids:
+        return created_at_map
+    try:
+        placeholders = ",".join("?" * len(ids))
+        rows = db.execute(
+            f"SELECT id, created_at FROM memories "
+            f"WHERE id IN ({placeholders})",
+            ids,
+        ).fetchall()
+        created_at_map = {r["id"]: r["created_at"] for r in rows}
+    except Exception:
+        created_at_map = {}
+    return created_at_map
+
+
 def _rrf_fuse(
     vec_ids: list[int],
     fts_ids: list[int],
     top_k: int,
+    created_at_map: dict[int, str] | None = None,
+    decay_days: float | None = None,
 ) -> list[tuple[int, float]]:
     """Reciprocal Rank Fusion of vector and FTS5 result ID lists.
 
@@ -197,6 +243,12 @@ def _rrf_fuse(
         vec_ids: Ordered list of IDs from vector search (most relevant first).
         fts_ids: Ordered list of IDs from FTS5 search (most relevant first).
         top_k: Maximum number of fused results to return.
+        created_at_map: Optional mapping of doc_id -> created_at ISO string,
+            used to compute freshness when ``decay_days`` is set.
+        decay_days: Optional freshness half-life in days. When set, each fused
+            score is multiplied by ``freshness = 2^(-days/decay_days)`` so
+            older entries rank lower. Default None = no decay (backward
+            compatible).
 
     Returns:
         List of (id, rrf_score) tuples sorted by descending score.
@@ -206,6 +258,19 @@ def _rrf_fuse(
         scores[doc_id] = 1.0 / (_RRF_CONST + rank)
     for rank, doc_id in enumerate(fts_ids, start=1):
         scores[doc_id] = scores.get(doc_id, 0.0) + 1.0 / (_RRF_CONST + rank)
+
+    if decay_days is not None and decay_days > 0 and created_at_map:
+        now = time.time()
+        for doc_id in list(scores):
+            created = created_at_map.get(doc_id)
+            if not created:
+                continue
+            try:
+                days = max(0.0, (now - _parse_iso_ts(created)) / 86400.0)
+            except (ValueError, TypeError):
+                continue
+            scores[doc_id] *= 2.0 ** (-days / decay_days)
+
     ranked = sorted(scores.items(), key=lambda x: (-x[1], x[0]))
     return ranked[:top_k]
 
@@ -282,12 +347,15 @@ def memory_store(
 @mcp.tool(
     description="Hybrid semantic search across memories. "
     "Combines vector cosine similarity and FTS5 BM25 keyword search "
-    "via Reciprocal Rank Fusion (RRF).",
+    "via Reciprocal Rank Fusion (RRF). Optional decay_days applies a "
+    "freshness half-life (2^(-days/decay_days)) so recent entries rank "
+    "higher; default None keeps the original rank-only behavior.",
 )
 def memory_search(  # noqa: PLR0912
     query: str,
     namespace: str | None = None,
     top_k: int = 5,
+    decay_days: float | None = None,
 ) -> list[dict[str, Any]]:
     """Hybrid search: vector + keyword fused via RRF.
 
@@ -299,6 +367,9 @@ def memory_search(  # noqa: PLR0912
         query: Search query text.
         namespace: Optional namespace filter.
         top_k: Maximum results (default 5, max 50).
+        decay_days: Optional freshness half-life in days. When set, fused
+            scores are multiplied by ``2^(-days_since_created/decay_days)``
+            so older entries rank lower. Default None = no decay.
 
     Returns:
         List of memory entries with score and metadata.
@@ -364,8 +435,14 @@ def memory_search(  # noqa: PLR0912
     except Exception:
         fts_ids = []
 
-    # 4. RRF fusion
-    fused = _rrf_fuse(vec_ids, fts_ids, top_k)
+    # 4. RRF fusion (optionally freshness-decayed)
+    candidate_ids = list(dict.fromkeys([*vec_ids, *fts_ids]))
+    created_at_map = (
+        _fetch_created_at_map(db, candidate_ids)
+        if decay_days is not None and decay_days > 0
+        else {}
+    )
+    fused = _rrf_fuse(vec_ids, fts_ids, top_k, created_at_map, decay_days)
 
     if not fused:
         return []

package/src/pantheon/auto-wake.ts

@@ -15,9 +15,9 @@
  * @module auto-wake
  */
 
+import { existsSync } from 'node:fs'
 import { readdir, readFile, rename } from 'node:fs/promises'
 import { join } from 'node:path'
-import { existsSync } from 'node:fs'
 
 /** Signal structure written by BackgroundJobBoard.writeSignal(). */
 export interface WakeSignal {
@@ -48,9 +48,7 @@ const DEFAULT_SIGNAL_DIR = '.pantheon/deepwork/board-signals'
  * @param signalDir  Directory to scan (default: `.pantheon/deepwork/board-signals`)
  * @returns List of wake signals from newly consumed files
  */
-export async function consumeWakeSignals(
-  signalDir?: string,
-): Promise<WakeSignal[]> {
+export async function consumeWakeSignals(signalDir?: string): Promise<WakeSignal[]> {
   const dir = signalDir ?? DEFAULT_SIGNAL_DIR
 
   // If the signal directory doesn't exist, there are no signals

package/src/pantheon/background-job-board.ts

@@ -23,7 +23,14 @@ const log = createPantheonLogger({ module: 'BackgroundJobBoard' })
 // ─── Types ─────────────────────────────────────────────────────────────
 
 /** Valid states for a background job. */
-export type BackgroundJobState = 'running' | 'completed' | 'error' | 'cancelled' | 'reconciled'
+export type BackgroundJobState =
+  | 'running'
+  | 'completed'
+  | 'error'
+  | 'startup_failed'
+  | 'startup_unknown'
+  | 'cancelled'
+  | 'reconciled'
 
 /** Terminal states that can transition to reconciled. */
 const TERMINAL_STATES: ReadonlySet<BackgroundJobState> = new Set([
@@ -38,9 +45,11 @@ const TERMINAL_STATES: ReadonlySet<BackgroundJobState> = new Set([
  * Only running → terminal, or same-terminal → same-terminal (idempotent re-notify).
  */
 const UPDATE_TRANSITIONS: Record<BackgroundJobState, ReadonlySet<BackgroundJobState>> = {
-  running: new Set(['completed', 'error', 'cancelled']),
+  running: new Set(['completed', 'error', 'startup_failed', 'startup_unknown', 'cancelled']),
   completed: new Set(['completed']),
   error: new Set(['error']),
+  startup_failed: new Set(['startup_failed']),
+  startup_unknown: new Set(['startup_unknown']),
   cancelled: new Set(['cancelled']),
   reconciled: new Set([]),
 }
@@ -101,7 +110,7 @@ export interface LaunchInput {
 /** Input for updating a job's status to a terminal state. */
 export interface StatusInput {
   taskID: string
-  state: 'completed' | 'error' | 'cancelled'
+  state: 'completed' | 'error' | 'startup_failed' | 'startup_unknown' | 'cancelled'
   resultSummary?: string
   error?: string
   timedOut?: boolean
@@ -289,7 +298,11 @@ export class BackgroundJobBoard {
     if (input.timedOut !== undefined) {
       job.timedOut = input.timedOut
     }
-    if (input.state === 'error') {
+    if (
+      input.state === 'error' ||
+      input.state === 'startup_failed' ||
+      input.state === 'startup_unknown'
+    ) {
       job.totalErrors++
     }
     if (input.timedOut) {

package/src/pantheon/comment-checker.ts

@@ -0,0 +1,48 @@
+/**
+ * Comment Checker — detects trivial/auto-generated comments that make code
+ * look machine-produced rather than human-written.
+ *
+ * Used by @themis (Layer 1: Surface review) to flag comments that add no
+ * information value and signal AI-generated code.
+ */
+
+/** Regex patterns matching trivial, uninformative comments. */
+export const TRIVIAL_PATTERNS: readonly RegExp[] = [
+  /#\s*increment\s+\w+/i,
+  /#\s*decrement\s+\w+/i,
+  /#\s*set\s+\w+/i,
+  /#\s*loop\s+over/i,
+  /#\s*(initialize|init)\s+\w+/i,
+  /#\s*(return|yield)\s+\w+/i,
+]
+
+export interface CommentCheckResult {
+  /** Number of trivial comments found (0 = clean). */
+  score: number
+  /** Human-readable descriptions of each flagged comment. */
+  flags: string[]
+}
+
+/**
+ * Scan source code for trivial comments that add no information value.
+ *
+ * Returns a score (count of trivial comments) and a list of flags describing
+ * each match. A score of 0 means no trivial comments were detected.
+ */
+export function checkCommentDensity(source: string): CommentCheckResult {
+  const flags: string[] = []
+  const lines = source.split('\n')
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i] as string
+    for (const pattern of TRIVIAL_PATTERNS) {
+      if (pattern.test(line)) {
+        const trimmed = line.trim()
+        flags.push(`Line ${i + 1}: trivial comment — "${trimmed}"`)
+        break // one flag per line, even if multiple patterns match
+      }
+    }
+  }
+
+  return { score: flags.length, flags }
+}