pantheon-opencode 1.4.2 → 1.5.0-beta.1

package/scripts/validate-zenodo-release.mjs

@@ -0,0 +1,154 @@
+#!/usr/bin/env node
+/** Validate the immutable inputs used by the GitHub Release → Zenodo workflow. */
+
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { compareVersions } from './version-check.mjs'
+
+const SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/
+
+function validateHttpsUrl(value, name) {
+  let url
+  try {
+    url = new URL(value)
+  } catch {
+    throw new Error(`${name} must be an absolute HTTPS URL.`)
+  }
+  if (
+    url.protocol !== 'https:' ||
+    !url.hostname ||
+    url.username ||
+    url.password ||
+    /%(?![0-9A-Fa-f]{2})/.test(value) ||
+    /[\s{}\\|^`]/.test(value)
+  ) {
+    throw new Error(`${name} must be an absolute HTTPS URL without credentials.`)
+  }
+  return url
+}
+
+function maskHost(hostname) {
+  if (hostname.length <= 2) return '***'
+  return `${hostname[0]}***${hostname.at(-1)}`
+}
+
+export function summarizeZenodoConfiguration({
+  depositionsUrl,
+  filesUrlTemplate,
+  publishUrlTemplate,
+  creatorName,
+}) {
+  const values = [
+    ['ZENODO_DEPOSITIONS_URL', depositionsUrl, true],
+    ['ZENODO_FILES_URL_TEMPLATE', filesUrlTemplate, true],
+    ['ZENODO_PUBLISH_URL_TEMPLATE', publishUrlTemplate, true],
+    ['ZENODO_CREATOR_NAME', creatorName, false],
+  ]
+  return values.map(([name, value, isUrl]) => {
+    if (typeof value !== 'string' || !value) return { name, present: false }
+    if (!isUrl) return { name, present: true }
+    try {
+      const url = new URL(value.replaceAll('{id}', '1'))
+      return {
+        name,
+        present: true,
+        protocol: url.protocol,
+        host: maskHost(url.hostname),
+        hasWhitespace: /\s/.test(value),
+        hasCredentials: Boolean(url.username || url.password),
+      }
+    } catch {
+      return {
+        name,
+        present: true,
+        protocol: 'invalid',
+        host: '***',
+        hasWhitespace: /\s/.test(value),
+      }
+    }
+  })
+}
+
+export function zenodoTemplateUrl(template, id, name = 'Zenodo URL template') {
+  if (!Number.isSafeInteger(id) || id <= 0) throw new Error('Zenodo deposition id is invalid.')
+  if (typeof template !== 'string' || !template.includes('{id}'))
+    throw new Error(`${name} must contain the {id} placeholder.`)
+  return validateHttpsUrl(template.replaceAll('{id}', String(id)), name).href
+}
+
+export function zenodoDepositionUrl(depositionsUrl, id) {
+  if (!Number.isSafeInteger(id) || id <= 0) throw new Error('Zenodo deposition id is invalid.')
+  if (typeof depositionsUrl !== 'string')
+    throw new Error('ZENODO_DEPOSITIONS_URL must be an absolute HTTPS URL.')
+  const base = validateHttpsUrl(depositionsUrl, 'ZENODO_DEPOSITIONS_URL')
+  if (base.search || base.hash)
+    throw new Error('ZENODO_DEPOSITIONS_URL must not contain a query or fragment.')
+  return new URL(`${base.pathname.replace(/\/$/, '')}/${id}`, base.origin).href
+}
+
+export function validateZenodoConfiguration({
+  depositionsUrl,
+  filesUrlTemplate,
+  publishUrlTemplate,
+  creatorName,
+}) {
+  const base = validateHttpsUrl(depositionsUrl, 'ZENODO_DEPOSITIONS_URL')
+  for (const [name, template] of [
+    ['ZENODO_FILES_URL_TEMPLATE', filesUrlTemplate],
+    ['ZENODO_PUBLISH_URL_TEMPLATE', publishUrlTemplate],
+  ]) {
+    if (
+      typeof template !== 'string' ||
+      !template.includes('{id}') ||
+      template.replaceAll('{id}', '').match(/[{}]/) ||
+      template.includes('{{') ||
+      template.includes('}}')
+    ) {
+      throw new Error(`${name} must be an HTTPS URL template containing the {id} placeholder.`)
+    }
+    const url = new URL(zenodoTemplateUrl(template, 1, name))
+    if (url.origin !== base.origin) throw new Error(`${name} must use the Zenodo depositions host.`)
+  }
+  if (typeof creatorName !== 'string' || !creatorName.trim())
+    throw new Error('ZENODO_CREATOR_NAME must not be empty.')
+  return true
+}
+
+export function validateZenodoRelease(root, tag) {
+  if (!/^v/.test(tag)) throw new Error('Release tag must start with v.')
+  const version = tag.slice(1)
+  if (!SEMVER.test(version)) throw new Error('Release tag is not valid semver.')
+  const packageJson = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
+  if (packageJson.name !== 'pantheon-opencode' || packageJson.version !== version) {
+    throw new Error('Release tag does not match package.json.')
+  }
+  const manifests = compareVersions(root)
+  if (!manifests.ok) throw new Error('Release manifests are out of sync.')
+  const citationPath = join(root, 'CITATION.cff')
+  const citation = { present: existsSync(citationPath), version: null }
+  if (citation.present) {
+    const match = readFileSync(citationPath, 'utf8').match(/^version:\s*["']?([^"'\s]+)["']?\s*$/m)
+    if (!match) throw new Error('CITATION.cff is missing its version field.')
+    citation.version = match[1]
+    if (citation.version !== version)
+      throw new Error('CITATION.cff version differs from the release tag.')
+  }
+  return { tag, version, citation }
+}
+
+const isDirectRun = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href
+if (isDirectRun) {
+  try {
+    validateZenodoConfiguration({
+      depositionsUrl: process.env.ZENODO_DEPOSITIONS_URL,
+      filesUrlTemplate: process.env.ZENODO_FILES_URL_TEMPLATE,
+      publishUrlTemplate: process.env.ZENODO_PUBLISH_URL_TEMPLATE,
+      creatorName: process.env.ZENODO_CREATOR_NAME,
+    })
+    console.log(JSON.stringify(validateZenodoRelease(process.cwd(), process.env.RELEASE_TAG ?? '')))
+  } catch (error) {
+    console.error(`zenodo validation: ${error.message}`)
+    process.exit(1)
+  }
+}

package/scripts/zenodo-artifact.mjs

@@ -0,0 +1,21 @@
+import { createHash } from 'node:crypto'
+import { readFileSync } from 'node:fs'
+
+export function sha256File(path) {
+  return createHash('sha256').update(readFileSync(path)).digest('hex')
+}
+
+export function findZenodoFile(record, filename, checksum) {
+  if (!record || typeof record !== 'object' || !Array.isArray(record.files)) {
+    throw new Error('Zenodo record did not contain a files array.')
+  }
+  const matches = record.files.filter((file) => file?.filename === filename)
+  if (matches.length > 1) throw new Error(`Zenodo record contains duplicate file: ${filename}.`)
+  if (matches.length === 0) return null
+  const file = matches[0]
+  const expected = `sha256:${checksum}`
+  if (file.checksum !== expected) {
+    throw new Error(`Zenodo checksum mismatch for ${filename}.`)
+  }
+  return file
+}

package/scripts/zenodo-release-state.mjs

@@ -0,0 +1,53 @@
+const DOI_PATTERN = /^10\.\d{4,9}\/\S+$/
+const MARKER_PATTERN =
+  /<!-- zenodo-deposition:(?:id=(\d+);)?(?:doi=([^;\s]+);)?state=(pending|created|published)(?:;claim=([^\s]+))? -->/
+
+export function extractZenodoDoi(response) {
+  if (!response || typeof response !== 'object') return null
+  const candidates = [response.doi, response.metadata?.doi, response.links?.doi]
+  for (const candidate of candidates) {
+    if (typeof candidate === 'string' && DOI_PATTERN.test(candidate.trim())) return candidate.trim()
+  }
+  return null
+}
+
+export function validateZenodoResponse(response, { requireDoi = false } = {}) {
+  if (!response || typeof response !== 'object' || Array.isArray(response)) {
+    throw new Error('Zenodo response must be a JSON object.')
+  }
+  if (!Number.isSafeInteger(response.id) || response.id <= 0) {
+    throw new Error('Zenodo response did not contain a valid deposition id.')
+  }
+  const doi = extractZenodoDoi(response)
+  if (requireDoi && !doi) throw new Error('Zenodo response did not contain a valid DOI.')
+  return { id: response.id, doi }
+}
+
+export function parseZenodoMarker(body) {
+  const text = String(body ?? '')
+  const match = text.match(MARKER_PATTERN)
+  if (!match) {
+    const legacy = text.match(/<!-- zenodo-deposition-id:(\d+) -->/)
+    if (!legacy) return null
+    const id = Number(legacy[1])
+    if (!Number.isSafeInteger(id) || id <= 0)
+      throw new Error('Zenodo marker has an invalid deposition id.')
+    return { id, doi: null, state: 'created', claim: null }
+  }
+  const id = match[1] ? Number(match[1]) : null
+  if (match[1] && (!Number.isSafeInteger(id) || id <= 0))
+    throw new Error('Zenodo marker has an invalid deposition id.')
+  if (match[2] && !DOI_PATTERN.test(match[2])) throw new Error('Zenodo marker has an invalid DOI.')
+  return { id, doi: match[2] ?? null, state: match[3], claim: match[4] ?? null }
+}
+
+export function zenodoMarker({ id = null, doi = null, state, claim = null }) {
+  if (!['pending', 'created', 'published'].includes(state))
+    throw new Error('Zenodo marker state is invalid.')
+  if (id !== null && (!Number.isSafeInteger(id) || id <= 0))
+    throw new Error('Zenodo marker id is invalid.')
+  if (doi !== null && !DOI_PATTERN.test(doi)) throw new Error('Zenodo marker DOI is invalid.')
+  if (state !== 'pending' && id === null)
+    throw new Error('Created or published Zenodo markers require an id.')
+  return `<!-- zenodo-deposition:${id === null ? '' : `id=${id};`}${doi === null ? '' : `doi=${doi};`}state=${state}${claim === null ? '' : `;claim=${claim}`} -->`
+}

package/src/mcp/_pantheon_paths.py

@@ -34,11 +34,11 @@ def pantheon_home() -> Path:
     """
     env = os.environ.get("PANTHEON_HOME")
     if env:
-        return Path(env).expanduser().resolve()
+        return Path(env).expanduser().absolute()
 
     xdg = os.environ.get("XDG_CONFIG_HOME")
     if xdg:
-        return Path(xdg).expanduser().resolve() / "opencode"
+        return Path(xdg).expanduser().absolute() / "opencode"
 
     return Path.home() / ".config" / "opencode"
 
@@ -48,7 +48,8 @@ def pantheon_project() -> Path | None:
 
     Resolution priority:
     1. $PANTHEON_PROJECT env var (explicit override)
-    2. Current working directory (set by MCP client's cwd in opencode.json)
+    2. The validated logical ``$PWD`` supplied by the launcher
+    3. Current working directory (set by MCP client's cwd in opencode.json)
 
     Returns:
         Absolute Path to the project root, or None if neither is available
@@ -56,10 +57,50 @@ def pantheon_project() -> Path | None:
     """
     env = os.environ.get("PANTHEON_PROJECT")
     if env:
-        return Path(env).expanduser().resolve()
-
-    cwd = os.getcwd()
+        return Path(env).expanduser().absolute()
+
+    logical_cwd = os.environ.get("PWD")
+    try:
+        cwd = os.getcwd()
+    except OSError:
+        cwd = ""
+    if logical_cwd and _is_valid_logical_cwd(logical_cwd, cwd):
+        return Path(logical_cwd).expanduser().absolute()
     if cwd:
-        return Path(cwd).resolve()
+        return Path(cwd).absolute()
 
     return None
+
+
+def _is_valid_logical_cwd(logical_cwd: str, physical_cwd: str) -> bool:
+    """Validate a launcher-provided logical cwd without resolving its result.
+
+    ``PWD`` is trusted only when it is an existing directory naming the same
+    inode as the process cwd.  This preserves symlink spelling while rejecting
+    forged or stale environment values.
+    """
+    logical = Path(logical_cwd).expanduser()
+    if not logical.is_absolute() or not logical.is_dir():
+        return False
+    try:
+        return os.path.samefile(logical, physical_cwd)
+    except (OSError, ValueError):
+        return False
+
+
+def has_symlink_component(path: Path) -> bool:
+    """Return whether any existing lexical component of ``path`` is a symlink.
+
+    The lexical path is intentionally inspected before ``resolve()`` so a
+    symlink cannot be hidden by resolving to an otherwise trusted directory.
+    Missing trailing components are allowed; this keeps normal project paths
+    usable while still checking every existing ancestor.
+    """
+    current = Path(path.anchor) if path.is_absolute() else Path.cwd()
+    for component in path.parts[1:] if path.is_absolute() else path.parts:
+        if component in {"", "."}:
+            continue
+        current /= component
+        if current.is_symlink():
+            return True
+    return False

package/src/mcp/code_mode_server.py

@@ -18,8 +18,8 @@ from __future__ import annotations
 import asyncio
 import logging
 import os
-import signal
 import shutil
+import signal
 import stat
 import sys
 import time
@@ -28,7 +28,6 @@ from pathlib import Path
 from typing import Any
 
 import yaml
-
 from _pantheon_paths import pantheon_home, pantheon_project
 from mcp.server.fastmcp import FastMCP
 
@@ -133,6 +132,34 @@ def _detect_prlimit() -> str | None:
 # 1. /.opencode/.pantheon/code-mode/  (project install)
 # 2. /.pantheon/code-mode/            (legacy fallback)
 # 3. /.pantheon/code-mode/               (global fallback)
+# 4. .pantheon/code-mode/ shipped inside the installed package (tarball
+#    fallback — package.json `files` includes .pantheon/code-mode/**)
+
+
+def _packaged_scripts_dir() -> Path | None:
+    """Return the code-mode dir shipped inside the installed package, if any.
+
+    Walks up from this file looking for a `.pantheon/code-mode/` directory
+    (e.g. `<pkg>/.pantheon/code-mode` when installed from the tarball).
+    Returns None when no packaged copy exists.
+    """
+    try:
+        here = Path(__file__).resolve()
+    except Exception:
+        return None
+    for parent in [here.parent, *here.parents]:
+        try:
+            candidate = parent / ".pantheon" / "code-mode"
+        except Exception:
+            continue
+        try:
+            if candidate.is_dir():
+                return candidate
+        except OSError:
+            continue
+    return None
+
+
 _PANTHEON_HOME: Path = pantheon_home()
 _SCRIPTS_DIR_CANDIDATES: list[Path] = []
 _proj = pantheon_project()
@@ -146,6 +173,10 @@ for _candidate in _SCRIPTS_DIR_CANDIDATES:
     if _candidate.is_dir():
         SCRIPTS_DIR = _candidate
         break
+else:
+    _packaged = _packaged_scripts_dir()
+    if _packaged is not None:
+        SCRIPTS_DIR = _packaged
 
 # ── FastMCP App ───────────────────────────────────────────────────────────────
 mcp = FastMCP(

package/src/mcp/eval_store.py

@@ -138,7 +138,7 @@ def store_eval(
     except sqlite3.IntegrityError:
         conn.rollback()
         return {"error": f"Duplicate key or constraint violation: {key}"}
-    except Exception as e:  # noqa: BLE001
+    except Exception as e:
         conn.rollback()
         return {"error": f"Failed to store eval: {e}"}
     finally: