pantheon-opencode 1.4.2 → 1.5.0-beta.1

package/src/mcp/mcp_resources_server.py

@@ -17,7 +17,7 @@ from pathlib import Path
 from typing import Any
 
 import yaml
-from _pantheon_paths import pantheon_home, pantheon_project
+from _pantheon_paths import has_symlink_component, pantheon_home, pantheon_project
 from eval_store import get_latest_eval, list_evals
 from mcp.server.fastmcp import FastMCP
 
@@ -25,6 +25,88 @@ from mcp.server.fastmcp import FastMCP
 _PANTHEON_HOME: Path = pantheon_home()
 _PANTHEON_PROJECT: Path | None = pantheon_project()
 
+
+def _within(path: Path, parent: Path) -> bool:
+    """Return whether ``path`` is contained by ``parent`` after resolution."""
+    try:
+        path.relative_to(parent)
+    except ValueError:
+        return False
+    return True
+
+
+def _safe_root(root: Path, parent: Path) -> Path | None:
+    """Return a physical resource root only when its layout is trusted.
+
+    Local ``.opencode`` and ``.pantheon`` directories are trust boundaries:
+    accepting either as a symlink would make all resources below it
+    untrusted, even when the link happens to point inside the project.
+    """
+    if parent.is_symlink() or has_symlink_component(parent):
+        return None
+    # Keep the project root lexical until this trust-boundary check.  This
+    # rejects PANTHEON_PROJECT/cwd symlinks instead of resolving them away.
+    if parent.name in {".opencode", ".pantheon"} and parent.parent.is_symlink():
+        return None
+    if root.is_symlink():
+        return None
+    if not root.exists() or not root.is_dir():
+        return None
+    parent_resolved = parent.resolve()
+    resolved = root.resolve()
+    if parent.name in {".opencode", ".pantheon"} and not _within(
+        parent_resolved, parent.parent.resolve()
+    ):
+        return None
+    return resolved if _within(resolved, parent_resolved) else None
+
+
+def _resource_root(name: str) -> Path | None:
+    """Choose a project-local root before the global installation root.
+
+    A present but unsafe project root is ignored rather than followed; this
+    preserves the global fallback while preventing symlink escapes.
+    """
+    candidates: list[tuple[Path, Path]] = []
+    if _PANTHEON_PROJECT is not None:
+        if name in {"agents", "skills"}:
+            local = _PANTHEON_PROJECT / ".opencode"
+            candidates.append((local / name, local))
+        elif name in {"deepwork", "memory-bank"}:
+            local = _PANTHEON_PROJECT / ".pantheon"
+            candidates.append((local / name, local))
+    candidates.append((_PANTHEON_HOME / name, _PANTHEON_HOME))
+    for root, parent in candidates:
+        safe = _safe_root(root, parent)
+        if safe is not None:
+            return safe
+    return None
+
+
+def _resource_roots(name: str) -> list[Path]:
+    """Return safe resource roots in local-first precedence order."""
+    roots: list[Path] = []
+    if _PANTHEON_PROJECT is not None:
+        base_name = ".opencode" if name in {"agents", "skills"} else ".pantheon"
+        base = _PANTHEON_PROJECT / base_name
+        local = _safe_root(base / name, base)
+        if local is not None:
+            roots.append(local)
+    global_root = _safe_root(_PANTHEON_HOME / name, _PANTHEON_HOME)
+    if global_root is not None:
+        roots.append(global_root)
+    return roots
+
+
+def _safe_child(root: Path, relative: str) -> Path | None:
+    """Resolve a child while rejecting every lexical symlink component."""
+    candidate = root / relative
+    if has_symlink_component(candidate):
+        return None
+    resolved = candidate.resolve()
+    return resolved if _within(resolved, root.resolve()) else None
+
+
 # ── FastMCP App ───────────────────────────────────────────────────────────────
 mcp = FastMCP(
     "Pantheon Resources",
@@ -67,17 +149,27 @@ def _get_role_from_frontmatter(frontmatter: dict[str, Any]) -> str:
 )
 async def list_agents() -> str:
     """Return a markdown list of all agents with their roles."""
-    agents_dir = _PANTHEON_HOME / "agents"
-    if not agents_dir.is_dir():
+    agents_dirs = _resource_roots("agents")
+    if not agents_dirs:
         return "Agents directory not found."
 
     agents: list[str] = []
-    for f in sorted(agents_dir.iterdir()):
-        if f.suffix == ".md" and f.stem.lower() != "readme":
-            frontmatter = _parse_yaml_frontmatter(f)
-            name = frontmatter.get("name", f.stem)
-            role = _get_role_from_frontmatter(frontmatter)
-            agents.append(f"- **{name}** — {role}")
+    seen: set[str] = set()
+    for agents_dir in agents_dirs:
+        for entry in sorted(agents_dir.iterdir()):
+            f = _safe_child(agents_dir, entry.name)
+            if (
+                f is not None
+                and f.is_file()
+                and f.suffix == ".md"
+                and f.stem.lower() != "readme"
+                and f.name not in seen
+            ):
+                seen.add(f.name)
+                frontmatter = _parse_yaml_frontmatter(f)
+                name = frontmatter.get("name", f.stem)
+                role = _get_role_from_frontmatter(frontmatter)
+                agents.append(f"- **{name}** — {role}")
 
     return "\n".join(agents) if agents else "No agents found."
 
@@ -88,19 +180,23 @@ async def list_agents() -> str:
 )
 async def list_skills() -> str:
     """Return a markdown list of all skills with descriptions."""
-    skills_dir = _PANTHEON_HOME / "skills"
-    if not skills_dir.is_dir():
+    skills_dirs = _resource_roots("skills")
+    if not skills_dirs:
         return "Skills directory not found."
 
     skills: list[str] = []
-    for f in sorted(skills_dir.iterdir()):
-        if f.is_dir():
-            skill_file = f / "SKILL.md"
-            if skill_file.exists():
-                frontmatter = _parse_yaml_frontmatter(skill_file)
-                name = frontmatter.get("name", f.name)
-                desc = frontmatter.get("description", "No description")
-                skills.append(f"- **{name}** — {desc}")
+    seen: set[str] = set()
+    for skills_dir in skills_dirs:
+        for entry in sorted(skills_dir.iterdir()):
+            f = _safe_child(skills_dir, entry.name)
+            if f is not None and f.is_dir() and f.name not in seen:
+                skill_file = _safe_child(f, "SKILL.md")
+                if skill_file is not None and skill_file.is_file():
+                    seen.add(f.name)
+                    frontmatter = _parse_yaml_frontmatter(skill_file)
+                    name = frontmatter.get("name", f.name)
+                    desc = frontmatter.get("description", "No description")
+                    skills.append(f"- **{name}** — {desc}")
 
     return "\n".join(skills) if skills else "No skills found."
 
@@ -111,10 +207,10 @@ async def list_skills() -> str:
 )
 async def get_routing() -> str:
     """Return the full content of routing.yml."""
-    routing_file = _PANTHEON_HOME / "routing.yml"
-    if not routing_file.exists() and _PANTHEON_PROJECT:
-        routing_file = _PANTHEON_PROJECT / "src" / "routing.yml"
-    if not routing_file.exists():
+    routing_file = _safe_child(_PANTHEON_HOME, "routing.yml")
+    if routing_file is None and _PANTHEON_PROJECT:
+        routing_file = _safe_child(_PANTHEON_PROJECT / "src", "routing.yml")
+    if routing_file is None or not routing_file.exists():
         return "routing.yml not found."
     return routing_file.read_text(encoding="utf-8")
 
@@ -128,11 +224,17 @@ async def get_routing() -> str:
 )
 async def get_agent(agent_name: str) -> str:
     """Return the full content of an agent file, case-insensitively."""
-    agents_dir = _PANTHEON_HOME / "agents"
     name_lower = agent_name.lower()
-    for f in agents_dir.iterdir():
-        if f.suffix == ".md" and f.stem.lower() == name_lower:
-            return f.read_text(encoding="utf-8")
+    for agents_dir in _resource_roots("agents"):
+        for entry in agents_dir.iterdir():
+            f = _safe_child(agents_dir, entry.name)
+            if (
+                f is not None
+                and f.is_file()
+                and f.suffix == ".md"
+                and f.stem.lower() == name_lower
+            ):
+                return f.read_text(encoding="utf-8")
     return f"Agent '{agent_name}' not found."
 
 
@@ -142,10 +244,11 @@ async def get_agent(agent_name: str) -> str:
 )
 async def get_deepwork_plan(slug: str) -> str:
     """Return PLAN.md content for a deepwork slug."""
-    if _PANTHEON_PROJECT is None:
+    deepwork_dir = _resource_root("deepwork")
+    if deepwork_dir is None:
         return f"Deepwork '{slug}' not found. (PANTHEON_PROJECT not set)"
-    plan_file = _PANTHEON_PROJECT / ".pantheon" / "deepwork" / slug / "PLAN.md"
-    if not plan_file.exists():
+    plan_file = _safe_child(deepwork_dir, f"{slug}/PLAN.md")
+    if plan_file is None or not plan_file.is_file():
         return f"Deepwork '{slug}' not found."
     return plan_file.read_text(encoding="utf-8")
 
@@ -157,10 +260,11 @@ async def get_deepwork_plan(slug: str) -> str:
 )
 async def get_deepwork_status(slug: str) -> str:
     """Return STATUS.md content for a deepwork slug, or a default message."""
-    if _PANTHEON_PROJECT is None:
+    deepwork_dir = _resource_root("deepwork")
+    if deepwork_dir is None:
         return "STATUS.md not found. (PANTHEON_PROJECT not set)"
-    status_file = _PANTHEON_PROJECT / ".pantheon" / "deepwork" / slug / "STATUS.md"
-    if not status_file.exists():
+    status_file = _safe_child(deepwork_dir, f"{slug}/STATUS.md")
+    if status_file is None or not status_file.is_file():
         return "STATUS.md not found. Current state: IN PROGRESS"
     return status_file.read_text(encoding="utf-8")
 
@@ -171,8 +275,9 @@ async def get_deepwork_status(slug: str) -> str:
 )
 async def get_skill(name: str) -> str:
     """Return SKILL.md content for a skill directory."""
-    skill_file = _PANTHEON_HOME / "skills" / name / "SKILL.md"
-    if not skill_file.exists():
+    skills_dir = _resource_root("skills")
+    skill_file = _safe_child(skills_dir, f"{name}/SKILL.md") if skills_dir else None
+    if skill_file is None or not skill_file.is_file():
         return f"Skill '{name}' not found."
     return skill_file.read_text(encoding="utf-8")
 
@@ -188,12 +293,11 @@ async def get_memory_bank(path: str) -> str:
     Security: resolves absolute path and verifies it stays within
     .pantheon/memory-bank/ to prevent directory traversal attacks.
     """
-    if _PANTHEON_PROJECT is None:
+    memory_dir = _resource_root("memory-bank")
+    if memory_dir is None:
         return "Memory bank not available. (PANTHEON_PROJECT not set)"
-    resolved = (_PANTHEON_PROJECT / ".pantheon" / "memory-bank" / path).resolve()
-    mb_dir = (_PANTHEON_PROJECT / ".pantheon" / "memory-bank").resolve()
-
-    if not str(resolved).startswith(str(mb_dir)):
+    resolved = _safe_child(memory_dir, path)
+    if resolved is None:
         return "Path traversal blocked: access denied."
 
     if not resolved.exists() or not resolved.is_file():

package/src/mcp/pantheon_vision_server.py

@@ -277,7 +277,7 @@ def _strip_provider_prefix(model: str) -> str:
     model ID is rejected by the gateway with a 401 ("Model ... is not
     supported"). Models without a ``/`` are returned unchanged.
     """
-    prefix, separator, model_name = model.rpartition("/")
+    _prefix, separator, model_name = model.rpartition("/")
     return model_name if separator else model