pantheon-opencode 1.4.3 → 1.5.0-beta.10

package/scripts/mcp_resources_server.py

@@ -17,7 +17,7 @@ from pathlib import Path
 from typing import Any
 
 import yaml
-from _pantheon_paths import pantheon_home, pantheon_project
+from _pantheon_paths import has_symlink_component, pantheon_home, pantheon_project
 from eval_store import get_latest_eval, list_evals
 from mcp.server.fastmcp import FastMCP
 
@@ -25,6 +25,88 @@ from mcp.server.fastmcp import FastMCP
 _PANTHEON_HOME: Path = pantheon_home()
 _PANTHEON_PROJECT: Path | None = pantheon_project()
 
+
+def _within(path: Path, parent: Path) -> bool:
+    """Return whether ``path`` is contained by ``parent`` after resolution."""
+    try:
+        path.relative_to(parent)
+    except ValueError:
+        return False
+    return True
+
+
+def _safe_root(root: Path, parent: Path) -> Path | None:
+    """Return a physical resource root only when its layout is trusted.
+
+    Local ``.opencode`` and ``.pantheon`` directories are trust boundaries:
+    accepting either as a symlink would make all resources below it
+    untrusted, even when the link happens to point inside the project.
+    """
+    if parent.is_symlink() or has_symlink_component(parent):
+        return None
+    # Keep the project root lexical until this trust-boundary check.  This
+    # rejects PANTHEON_PROJECT/cwd symlinks instead of resolving them away.
+    if parent.name in {".opencode", ".pantheon"} and parent.parent.is_symlink():
+        return None
+    if root.is_symlink():
+        return None
+    if not root.exists() or not root.is_dir():
+        return None
+    parent_resolved = parent.resolve()
+    resolved = root.resolve()
+    if parent.name in {".opencode", ".pantheon"} and not _within(
+        parent_resolved, parent.parent.resolve()
+    ):
+        return None
+    return resolved if _within(resolved, parent_resolved) else None
+
+
+def _resource_root(name: str) -> Path | None:
+    """Choose a project-local root before the global installation root.
+
+    A present but unsafe project root is ignored rather than followed; this
+    preserves the global fallback while preventing symlink escapes.
+    """
+    candidates: list[tuple[Path, Path]] = []
+    if _PANTHEON_PROJECT is not None:
+        if name in {"agents", "skills"}:
+            local = _PANTHEON_PROJECT / ".opencode"
+            candidates.append((local / name, local))
+        elif name in {"deepwork", "memory-bank"}:
+            local = _PANTHEON_PROJECT / ".pantheon"
+            candidates.append((local / name, local))
+    candidates.append((_PANTHEON_HOME / name, _PANTHEON_HOME))
+    for root, parent in candidates:
+        safe = _safe_root(root, parent)
+        if safe is not None:
+            return safe
+    return None
+
+
+def _resource_roots(name: str) -> list[Path]:
+    """Return safe resource roots in local-first precedence order."""
+    roots: list[Path] = []
+    if _PANTHEON_PROJECT is not None:
+        base_name = ".opencode" if name in {"agents", "skills"} else ".pantheon"
+        base = _PANTHEON_PROJECT / base_name
+        local = _safe_root(base / name, base)
+        if local is not None:
+            roots.append(local)
+    global_root = _safe_root(_PANTHEON_HOME / name, _PANTHEON_HOME)
+    if global_root is not None:
+        roots.append(global_root)
+    return roots
+
+
+def _safe_child(root: Path, relative: str) -> Path | None:
+    """Resolve a child while rejecting every lexical symlink component."""
+    candidate = root / relative
+    if has_symlink_component(candidate):
+        return None
+    resolved = candidate.resolve()
+    return resolved if _within(resolved, root.resolve()) else None
+
+
 # ── FastMCP App ───────────────────────────────────────────────────────────────
 mcp = FastMCP(
     "Pantheon Resources",
@@ -67,17 +149,27 @@ def _get_role_from_frontmatter(frontmatter: dict[str, Any]) -> str:
 )
 async def list_agents() -> str:
     """Return a markdown list of all agents with their roles."""
-    agents_dir = _PANTHEON_HOME / "agents"
-    if not agents_dir.is_dir():
+    agents_dirs = _resource_roots("agents")
+    if not agents_dirs:
         return "Agents directory not found."
 
     agents: list[str] = []
-    for f in sorted(agents_dir.iterdir()):
-        if f.suffix == ".md" and f.stem.lower() != "readme":
-            frontmatter = _parse_yaml_frontmatter(f)
-            name = frontmatter.get("name", f.stem)
-            role = _get_role_from_frontmatter(frontmatter)
-            agents.append(f"- **{name}** — {role}")
+    seen: set[str] = set()
+    for agents_dir in agents_dirs:
+        for entry in sorted(agents_dir.iterdir()):
+            f = _safe_child(agents_dir, entry.name)
+            if (
+                f is not None
+                and f.is_file()
+                and f.suffix == ".md"
+                and f.stem.lower() != "readme"
+                and f.name not in seen
+            ):
+                seen.add(f.name)
+                frontmatter = _parse_yaml_frontmatter(f)
+                name = frontmatter.get("name", f.stem)
+                role = _get_role_from_frontmatter(frontmatter)
+                agents.append(f"- **{name}** — {role}")
 
     return "\n".join(agents) if agents else "No agents found."
 
@@ -88,19 +180,23 @@ async def list_agents() -> str:
 )
 async def list_skills() -> str:
     """Return a markdown list of all skills with descriptions."""
-    skills_dir = _PANTHEON_HOME / "skills"
-    if not skills_dir.is_dir():
+    skills_dirs = _resource_roots("skills")
+    if not skills_dirs:
         return "Skills directory not found."
 
     skills: list[str] = []
-    for f in sorted(skills_dir.iterdir()):
-        if f.is_dir():
-            skill_file = f / "SKILL.md"
-            if skill_file.exists():
-                frontmatter = _parse_yaml_frontmatter(skill_file)
-                name = frontmatter.get("name", f.name)
-                desc = frontmatter.get("description", "No description")
-                skills.append(f"- **{name}** — {desc}")
+    seen: set[str] = set()
+    for skills_dir in skills_dirs:
+        for entry in sorted(skills_dir.iterdir()):
+            f = _safe_child(skills_dir, entry.name)
+            if f is not None and f.is_dir() and f.name not in seen:
+                skill_file = _safe_child(f, "SKILL.md")
+                if skill_file is not None and skill_file.is_file():
+                    seen.add(f.name)
+                    frontmatter = _parse_yaml_frontmatter(skill_file)
+                    name = frontmatter.get("name", f.name)
+                    desc = frontmatter.get("description", "No description")
+                    skills.append(f"- **{name}** — {desc}")
 
     return "\n".join(skills) if skills else "No skills found."
 
@@ -111,10 +207,10 @@ async def list_skills() -> str:
 )
 async def get_routing() -> str:
     """Return the full content of routing.yml."""
-    routing_file = _PANTHEON_HOME / "routing.yml"
-    if not routing_file.exists() and _PANTHEON_PROJECT:
-        routing_file = _PANTHEON_PROJECT / "src" / "routing.yml"
-    if not routing_file.exists():
+    routing_file = _safe_child(_PANTHEON_HOME, "routing.yml")
+    if routing_file is None and _PANTHEON_PROJECT:
+        routing_file = _safe_child(_PANTHEON_PROJECT / "src", "routing.yml")
+    if routing_file is None or not routing_file.exists():
         return "routing.yml not found."
     return routing_file.read_text(encoding="utf-8")
 
@@ -128,11 +224,17 @@ async def get_routing() -> str:
 )
 async def get_agent(agent_name: str) -> str:
     """Return the full content of an agent file, case-insensitively."""
-    agents_dir = _PANTHEON_HOME / "agents"
     name_lower = agent_name.lower()
-    for f in agents_dir.iterdir():
-        if f.suffix == ".md" and f.stem.lower() == name_lower:
-            return f.read_text(encoding="utf-8")
+    for agents_dir in _resource_roots("agents"):
+        for entry in agents_dir.iterdir():
+            f = _safe_child(agents_dir, entry.name)
+            if (
+                f is not None
+                and f.is_file()
+                and f.suffix == ".md"
+                and f.stem.lower() == name_lower
+            ):
+                return f.read_text(encoding="utf-8")
     return f"Agent '{agent_name}' not found."
 
 
@@ -142,10 +244,11 @@ async def get_agent(agent_name: str) -> str:
 )
 async def get_deepwork_plan(slug: str) -> str:
     """Return PLAN.md content for a deepwork slug."""
-    if _PANTHEON_PROJECT is None:
+    deepwork_dir = _resource_root("deepwork")
+    if deepwork_dir is None:
         return f"Deepwork '{slug}' not found. (PANTHEON_PROJECT not set)"
-    plan_file = _PANTHEON_PROJECT / ".pantheon" / "deepwork" / slug / "PLAN.md"
-    if not plan_file.exists():
+    plan_file = _safe_child(deepwork_dir, f"{slug}/PLAN.md")
+    if plan_file is None or not plan_file.is_file():
         return f"Deepwork '{slug}' not found."
     return plan_file.read_text(encoding="utf-8")
 
@@ -157,10 +260,11 @@ async def get_deepwork_plan(slug: str) -> str:
 )
 async def get_deepwork_status(slug: str) -> str:
     """Return STATUS.md content for a deepwork slug, or a default message."""
-    if _PANTHEON_PROJECT is None:
+    deepwork_dir = _resource_root("deepwork")
+    if deepwork_dir is None:
         return "STATUS.md not found. (PANTHEON_PROJECT not set)"
-    status_file = _PANTHEON_PROJECT / ".pantheon" / "deepwork" / slug / "STATUS.md"
-    if not status_file.exists():
+    status_file = _safe_child(deepwork_dir, f"{slug}/STATUS.md")
+    if status_file is None or not status_file.is_file():
         return "STATUS.md not found. Current state: IN PROGRESS"
     return status_file.read_text(encoding="utf-8")
 
@@ -171,8 +275,9 @@ async def get_deepwork_status(slug: str) -> str:
 )
 async def get_skill(name: str) -> str:
     """Return SKILL.md content for a skill directory."""
-    skill_file = _PANTHEON_HOME / "skills" / name / "SKILL.md"
-    if not skill_file.exists():
+    skills_dir = _resource_root("skills")
+    skill_file = _safe_child(skills_dir, f"{name}/SKILL.md") if skills_dir else None
+    if skill_file is None or not skill_file.is_file():
         return f"Skill '{name}' not found."
     return skill_file.read_text(encoding="utf-8")
 
@@ -188,12 +293,11 @@ async def get_memory_bank(path: str) -> str:
     Security: resolves absolute path and verifies it stays within
     .pantheon/memory-bank/ to prevent directory traversal attacks.
     """
-    if _PANTHEON_PROJECT is None:
+    memory_dir = _resource_root("memory-bank")
+    if memory_dir is None:
         return "Memory bank not available. (PANTHEON_PROJECT not set)"
-    resolved = (_PANTHEON_PROJECT / ".pantheon" / "memory-bank" / path).resolve()
-    mb_dir = (_PANTHEON_PROJECT / ".pantheon" / "memory-bank").resolve()
-
-    if not str(resolved).startswith(str(mb_dir)):
+    resolved = _safe_child(memory_dir, path)
+    if resolved is None:
         return "Path traversal blocked: access denied."
 
     if not resolved.exists() or not resolved.is_file():

package/scripts/memory_mcp_server.py

@@ -25,7 +25,7 @@ import json
 import os
 import sqlite3
 import time
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any
 
@@ -198,7 +198,7 @@ def _parse_iso_ts(value: str) -> float:
     """
     dt = datetime.fromisoformat(value.replace("Z", "+00:00"))
     if dt.tzinfo is None:
-        dt = dt.replace(tzinfo=timezone.utc)
+        dt = dt.replace(tzinfo=UTC)
     return dt.timestamp()
 
 

package/scripts/package-evidence.mjs

@@ -0,0 +1,242 @@
+#!/usr/bin/env node
+/** Build and verify the single immutable npm package evidence artifact. */
+
+import { execFileSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
+import {
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { isAbsolute, join } from 'node:path'
+import { validateInventory } from './manifest-inventory.mjs'
+
+const CI_ARGS = ['ci', '--ignore-scripts', '--omit=dev', '--no-audit', '--no-fund']
+const REQUIRED_PAYLOAD = [
+  'package/package.json',
+  'package/plugin.json',
+  'package/pyproject.toml',
+  'package/src/plugins/tui/package.json',
+  'package/src/plugins/tui/package-lock.json',
+  'package/src/plugin.ts',
+  'package/src/plugin-v2.ts',
+  'package/src/pantheon/v2-bridge.ts',
+  'package/src/plugins/tui/dist/tui.js',
+  'package/src/plugins/tui/dist/server.js',
+  'package/bin/pantheon-init.mjs',
+  'package/scripts/doctor.mjs',
+  'package/.pantheon/code-mode/compress-inline.py',
+]
+
+function fail(message) {
+  throw new Error(message)
+}
+
+function resolveTargetSha(root, supplied) {
+  const raw =
+    supplied ?? execFileSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' })
+  const sha = String(raw).trim().toLowerCase()
+  if (!/^[0-9a-f]{40}$/.test(sha))
+    fail('target SHA must be a full lowercase 40-character hexadecimal SHA')
+  return sha
+}
+
+function createOutputDirectory(outputDir) {
+  const directory = outputDir ?? mkdtempSync(join(tmpdir(), 'pantheon-package-evidence-'))
+  mkdirSync(directory, { recursive: true })
+  if (readdirSync(directory).length !== 0) fail(`output directory must be empty: ${directory}`)
+  return { directory }
+}
+
+function packOnce(root, outputDir) {
+  const raw = execFileSync(
+    'npm',
+    ['pack', '--ignore-scripts', '--json', '--pack-destination', outputDir],
+    { cwd: root, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 },
+  )
+  let result
+  try {
+    result = JSON.parse(raw)
+  } catch (error) {
+    fail(`npm pack returned malformed JSON: ${error.message}`)
+  }
+  if (!Array.isArray(result) || result.length !== 1 || typeof result[0]?.filename !== 'string') {
+    fail('npm pack must produce exactly one JSON result')
+  }
+  const tgzFiles = readdirSync(outputDir).filter((name) => name.endsWith('.tgz'))
+  if (tgzFiles.length !== 1)
+    fail(`package evidence requires exactly one .tgz, found ${tgzFiles.length}`)
+  if (tgzFiles[0] !== result[0].filename)
+    fail('npm pack result does not identify the sole .tgz artifact')
+  return join(outputDir, tgzFiles[0])
+}
+
+function validateArchiveEntries(tarball) {
+  const listing = execFileSync('tar', ['-tzf', tarball], { encoding: 'utf8' })
+  const entries = listing.split('\n').filter(Boolean)
+  if (entries.length === 0) fail('package tarball is empty')
+  for (const entry of entries) {
+    const normalized = entry.replace(/\/$/, '')
+    const parts = normalized.split('/')
+    if (
+      isAbsolute(normalized) ||
+      normalized.includes('\\') ||
+      parts.includes('..') ||
+      (!normalized.startsWith('package/') && normalized !== 'package')
+    ) {
+      fail(`unsafe package archive entry: ${entry}`)
+    }
+  }
+  const detailed = execFileSync('tar', ['-tvzf', tarball], { encoding: 'utf8' })
+  for (const line of detailed.split('\n').filter(Boolean)) {
+    if (/^[lh]/i.test(line)) fail(`package archive contains a link entry: ${line}`)
+  }
+  return new Set(entries)
+}
+
+function extractSafely(tarball, workDir) {
+  const extractionRoot = join(workDir, 'extract')
+  mkdirSync(extractionRoot)
+  validateArchiveEntries(tarball)
+  execFileSync(
+    'tar',
+    ['-xzf', tarball, '--directory', extractionRoot, '--no-same-owner', '--no-same-permissions'],
+    { encoding: 'utf8' },
+  )
+  const realRoot = realpathSync(extractionRoot)
+  const walk = (current) => {
+    const stat = lstatSync(current)
+    if (stat.isSymbolicLink()) fail(`package archive extraction contains a symlink: ${current}`)
+    const resolved = realpathSync(current)
+    if (resolved !== realRoot && !resolved.startsWith(`${realRoot}/`)) {
+      fail(`package archive extraction escaped its temporary directory: ${current}`)
+    }
+    if (stat.isDirectory()) for (const name of readdirSync(current)) walk(join(current, name))
+  }
+  walk(extractionRoot)
+  return join(extractionRoot, 'package')
+}
+
+function validatePayload(packageRoot, inventory) {
+  for (const relativePath of REQUIRED_PAYLOAD) {
+    const path = join(packageRoot, relativePath.replace(/^package\//, ''))
+    if (!existsSync(path) || !lstatSync(path).isFile())
+      fail(`required package payload is missing: ${relativePath}`)
+  }
+  for (const document of inventory.documents) {
+    const { entry, path: sourcePath } = document
+    const packagedPath = join(packageRoot, entry.file)
+    if (entry.role === 'lock' && entry.file === 'package-lock.json' && !existsSync(packagedPath)) {
+      // npm-packlist excludes the package root lockfile by policy. It remains
+      // validated below as source evidence, but is not fabricated in the tgz.
+      continue
+    }
+    if (!existsSync(packagedPath) || !lstatSync(packagedPath).isFile())
+      fail(`versioned package payload is missing: package/${entry.file}`)
+    if (sha256(sourcePath) !== sha256(packagedPath))
+      fail(`published package payload differs from source: ${entry.file}`)
+  }
+}
+
+function collectLockfileEvidence(inventory, entries, packageRoot) {
+  return inventory.documents
+    .filter(({ entry }) => entry.role === 'lock')
+    .map(({ entry, data, path: sourcePath }) => {
+      const archivePath = `package/${entry.file}`
+      const packagedPath = join(packageRoot, entry.file)
+      const publishedInTarball = entries.has(archivePath)
+      return {
+        file: entry.file,
+        sourceSha256: sha256(sourcePath),
+        publishedSha256: publishedInTarball ? sha256(packagedPath) : null,
+        sourceName: data.name,
+        sourceVersion: data.version,
+        lockfileVersion: data.lockfileVersion,
+        parity: 'validated-against-manifest',
+        publishedInTarball,
+      }
+    })
+}
+
+function installProductionDependencies(root) {
+  // The root package-lock.json is source evidence only: npm-packlist omits it
+  // from the root of an npm package, so root ci must validate the source tree.
+  execFileSync('npm', CI_ARGS, { cwd: root, stdio: 'inherit' })
+  execFileSync('npm', CI_ARGS, {
+    cwd: join(root, 'src', 'plugins', 'tui'),
+    stdio: 'inherit',
+  })
+}
+
+function sha256(path) {
+  return createHash('sha256').update(readFileSync(path)).digest('hex')
+}
+
+export function createPackageEvidence(root, { outputDir, targetSha } = {}) {
+  const inventory = validateInventory(root)
+  const sha = resolveTargetSha(root, targetSha)
+  const output = createOutputDirectory(outputDir)
+  let workDir
+  try {
+    const tarball = packOnce(root, output.directory)
+    workDir = mkdtempSync(join(tmpdir(), 'pantheon-package-evidence-check-'))
+    const entries = validateArchiveEntries(tarball)
+    const packageRoot = extractSafely(tarball, workDir)
+    validatePayload(packageRoot, inventory)
+    installProductionDependencies(root)
+    const digest = sha256(tarball)
+    if (!/^[0-9a-f]{64}$/.test(digest)) fail('tarball SHA-256 is not lowercase 64-hex')
+    const metadata = {
+      version: inventory.sourceVersion,
+      targetSha: sha,
+      tarballSha256: digest,
+      tarball: tarball.split('/').at(-1),
+      lockfilePolicy: {
+        rootPackageLockfile: entries.has('package/package-lock.json')
+          ? 'published-by-npm-pack'
+          : 'omitted-by-npm-pack',
+        note: entries.has('package/package-lock.json')
+          ? 'npm pack published the root package-lock.json; lockfile parity is validated and recorded as source evidence, while tarball validation covers only the payload npm pack publishes.'
+          : 'npm pack omits the package root package-lock.json by policy; lockfile parity is validated and recorded as source evidence, while tarball validation covers only the payload npm pack publishes.',
+      },
+      lockfileEvidence: collectLockfileEvidence(inventory, entries, packageRoot),
+    }
+    writeFileSync(join(output.directory, 'metadata.json'), `${JSON.stringify(metadata, null, 2)}\n`)
+    writeFileSync(join(output.directory, 'version'), `${metadata.version}\n`)
+    writeFileSync(join(output.directory, 'target-sha'), `${metadata.targetSha}\n`)
+    writeFileSync(join(output.directory, 'tarball-sha256'), `${metadata.tarballSha256}\n`)
+    return { ...metadata, outputDir: output.directory, tarball }
+  } catch (error) {
+    rmSync(output.directory, { recursive: true, force: true })
+    throw error
+  } finally {
+    if (workDir) rmSync(workDir, { recursive: true, force: true })
+  }
+}
+
+function parseOptions(args) {
+  const options = {}
+  for (const arg of args) {
+    const match = /^--(output-dir|target-sha)=(.*)$/.exec(arg)
+    if (!match) fail(`unsupported package evidence option: ${arg}`)
+    options[match[1] === 'output-dir' ? 'outputDir' : 'targetSha'] = match[2]
+  }
+  return options
+}
+
+if (process.argv[1]?.endsWith('package-evidence.mjs')) {
+  try {
+    const evidence = createPackageEvidence(process.cwd(), parseOptions(process.argv.slice(2)))
+    console.log(JSON.stringify(evidence))
+  } catch (error) {
+    console.error(`package-evidence: ${error.message}`)
+    process.exit(1)
+  }
+}