pantheon-opencode 1.4.3 → 1.5.0-beta.10

package/scripts/release-beta-version.mjs

@@ -1,80 +1,76 @@
 #!/usr/bin/env node
-/** Compute and optionally apply the beta version for a release PR. */
+/**
+ * release-beta-version.mjs — beta version helpers.
+ *
+ * The beta version is committed in the manifests (package.json) and never
+ * computed at release time. `nextBetaVersion` advances the committed version:
+ *
+ *   X.Y.Z-beta.N  ->  X.Y.Z-beta.(N+1)     (stay on the current beta line)
+ *   X.Y.Z         ->  X.Y.(Z+1)-beta.1     (start a fresh beta line)
+ *
+ * `applyBetaVersion` writes an already-decided beta version into every
+ * manifest and is retained for recovery tooling. The legacy PR+SHA scheme
+ * (`X.Y.Z-beta.<pr>.<sha7>`) is accepted by validation for backward
+ * compatibility only; it is no longer generated.
+ */
 
-import { readFileSync, writeFileSync } from 'node:fs'
-import { join } from 'node:path'
+import { SEMVER_PATTERN, validateInventory, writeInventoryVersion } from './manifest-inventory.mjs'
 
-export const MANIFESTS = [
-  { file: 'package.json', kind: 'json' },
-  { file: 'pyproject.toml', kind: 'toml' },
-  { file: 'plugin.json', kind: 'json' },
-  { file: 'src/plugins/tui/package.json', kind: 'json' },
-]
-
-const STABLE = /^(\d+)\.(\d+)\.(\d+)$/
+const STABLE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/
+// Current committed sequential beta line.
+const BETA_LINE = /^(\d+\.\d+\.\d+)-beta\.(\d+)$/
+// Legacy PR+SHA beta scheme, accepted for recovery only.
+const LEGACY_BETA = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)-beta\.[1-9]\d*\.[0-9a-f]{7}$/
+const BETA_RELEASE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)-beta\.[1-9]\d*$/
 
 export function nextStableVersion(latest, intent = 'patch') {
-  const match = STABLE.exec(String(latest))
-  if (!match) throw new Error(`npm latest is not a stable semver: "${latest}"`)
-  const [major, minor, patch] = match.slice(1).map(Number)
+  const match = STABLE.exec(String(latest).trim())
+  if (!match) throw new Error(`latest is not a stable semver: "${latest}"`)
   if (!['patch', 'minor', 'major'].includes(intent)) {
     throw new Error(`release intent must be patch, minor, or major: "${intent}"`)
   }
+  const [major, minor, patch] = match.slice(1).map(Number)
   if (intent === 'major') return `${major + 1}.0.0`
   if (intent === 'minor') return `${major}.${minor + 1}.0`
   return `${major}.${minor}.${patch + 1}`
 }
 
-export function betaVersion(latest, intent, pr, sha) {
-  if (!/^\d+$/.test(String(pr)) || Number(pr) < 1) throw new Error(`invalid PR number: "${pr}"`)
-  const shortSha = String(sha).slice(0, 7)
-  if (!/^[0-9a-f]{7,}$/i.test(shortSha)) throw new Error(`invalid commit SHA: "${sha}"`)
-  return `${nextStableVersion(latest, intent)}-beta.${pr}.${shortSha}`
-}
+/**
+ * Next beta version derived from the committed manifest version.
+ *
+ * @param {string} current committed version (e.g. "1.5.0-beta.2")
+ * @returns {string} the next sequential beta (e.g. "1.5.0-beta.3")
+ */
+export function nextBetaVersion(current) {
+  const value = String(current).trim()
+  const line = BETA_LINE.exec(value)
+  if (line) return `${line[1]}-beta.${Number(line[2]) + 1}`
 
-function writeVersion(root, { file, kind }, version) {
-  const path = join(root, file)
-  const raw = readFileSync(path, 'utf8')
-  if (kind === 'toml') {
-    const updated = raw.replace(/^(version\s*=\s*")[^"]+("\s*)$/m, `$1${version}$2`)
-    if (updated === raw) throw new Error(`no version field in ${file}`)
-    writeFileSync(path, updated)
-    return
-  }
-  const content = JSON.parse(raw)
-  content.version = version
-  writeFileSync(path, `${JSON.stringify(content, null, 2)}\n`)
-}
+  const stable = STABLE.exec(value)
+  if (stable) return `${nextStableVersion(value, 'patch')}-beta.1`
 
-export function applyBetaVersion(root, version) {
-  for (const manifest of MANIFESTS) writeVersion(root, manifest, version)
-  // Keep npm's lockfile metadata consistent without changing dependency data.
-  const lockPath = join(root, 'package-lock.json')
-  const lock = JSON.parse(readFileSync(lockPath, 'utf8'))
-  lock.version = version
-  if (lock.packages?.['']) lock.packages[''].version = version
-  writeFileSync(lockPath, `${JSON.stringify(lock, null, 2)}\n`)
+  // Any other prerelease (e.g. 1.5.0-rc.1): beta the next patch of its base.
+  const base = /^(\d+\.\d+\.\d+)-[0-9A-Za-z.-]+$/.exec(value)
+  if (!base) throw new Error(`cannot derive a beta version from: "${current}"`)
+  return `${nextStableVersion(base[1], 'patch')}-beta.1`
 }
 
-const args = new Map(
-  process.argv.slice(2).map((arg) => {
-    const [key, ...value] = arg.split('=')
-    return [key.replace(/^--/, ''), value.join('=')]
-  }),
-)
-
-if (args.has('latest')) {
-  try {
-    const version = betaVersion(
-      args.get('latest'),
-      args.get('intent') || 'patch',
-      args.get('pr'),
-      args.get('sha'),
+function validateReleaseVersion(version) {
+  if (typeof version !== 'string' || !SEMVER_PATTERN.test(version)) {
+    throw new Error(`invalid release semver: "${version}"`)
+  }
+  if (!BETA_RELEASE.test(version) && !LEGACY_BETA.test(version)) {
+    throw new Error(
+      `release version must be <base>-beta.<N> or legacy <base>-beta.<pr>.<7-char-sha>: "${version}"`,
     )
-    if (args.has('apply')) applyBetaVersion(process.cwd(), version)
-    console.log(version)
-  } catch (error) {
-    console.error(`release-beta-version: ${error.message}`)
-    process.exit(1)
   }
 }
+
+/** Preflight all six entries, then update metadata only. */
+export function applyBetaVersion(root, version) {
+  validateReleaseVersion(version)
+  const inventory = validateInventory(root, { allowVersionDivergence: true })
+  writeInventoryVersion(inventory, version)
+  const after = validateInventory(root)
+  if (after.sourceVersion !== version) throw new Error('beta version post-write validation failed')
+}

package/scripts/sync-artifacts.mjs

@@ -0,0 +1,169 @@
+/**
+ * sync-artifacts.mjs — postinstall freshness sync for copy-only artifacts.
+ *
+ * Guarantees that an `npm install -g pantheon-opencode` (or npx cache
+ * refresh) brings an EXISTING installation up to date for everything that is
+ * a pure byte-compare copy: agents + routing.yml, skills, AGENTS.md,
+ * commands, the runtime MCP scripts, the code-mode payload and tiers.json.
+ *
+ * Deliberately NOT done here (they belong to `pantheon-opencode init` /
+ * `update`, which the doctor points at when versions drift):
+ *   - opencode.json merge (config keys, plugin registration, MCP entries)
+ *   - venv/pip setup
+ *   - tui.json registration changes
+ *
+ * The user's opencode.json already references the installed package root for
+ * plugins, so after a package update those references hit the NEW code
+ * automatically; this sync refreshes the COPIES that would otherwise stay
+ * stale until the next manual init.
+ */
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs'
+import { join } from 'node:path'
+
+import {
+  collectSkillNames,
+  copyFiles,
+  installSkills,
+  ROOT,
+  syncDir,
+  writeIfChanged,
+} from './install/shared.mjs'
+
+/** Canonical MCP script sources — mirrors installOpenCode phase 2.10. */
+const MCP_SCRIPTS = {
+  'mcp_resources_server.py': () => join(ROOT, 'src', 'mcp', 'mcp_resources_server.py'),
+  'code_mode_server.py': () => join(ROOT, 'src', 'mcp', 'code_mode_server.py'),
+  'memory_mcp_server.py': () => join(ROOT, 'src', 'mcp', 'memory_mcp_server.py'),
+  'mcp_persistence_server.py': () => join(ROOT, 'src', 'mcp', 'mcp_persistence_server.py'),
+  '_pantheon_paths.py': () => join(ROOT, 'src', 'mcp', '_pantheon_paths.py'),
+  'mcp_codemap_module.py': () => join(ROOT, 'src', 'mcp', 'mcp_codemap_module.py'),
+  'pantheon_vision_server.py': () => join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py'),
+  'eval_store.py': () => join(ROOT, 'src', 'mcp', 'eval_store.py'),
+  'scrub-secrets.py': () => join(ROOT, 'scripts', 'scrub-secrets.py'),
+}
+
+/**
+ * Sync all copy-only artifacts from the installed package into configDir
+ * (the GLOBAL OpenCode config dir). Byte-compare idempotent; never throws.
+ * @returns {{ created: number, skipped: number, errors: string[] }}
+ */
+export function syncCopyArtifacts(configDir) {
+  const result = { created: 0, skipped: 0, errors: [] }
+  const bump = (r) => {
+    result.created += r.created
+    result.skipped += r.skipped
+  }
+
+  // ── agents + routing.yml ──
+  try {
+    const dstAgents = join(configDir, 'agents')
+    if (existsSync(join(ROOT, 'src', 'agents'))) {
+      mkdirSync(dstAgents, { recursive: true })
+      bump(copyFiles(join(ROOT, 'src', 'agents'), dstAgents, false))
+      const routing = join(ROOT, 'src', 'routing.yml')
+      if (existsSync(routing)) {
+        if (
+          writeIfChanged(join(configDir, 'routing.yml'), readFileSync(routing, 'utf8'), false) ===
+          'created'
+        ) {
+          result.created++
+        } else result.skipped++
+      }
+    }
+  } catch (err) {
+    result.errors.push(`agents: ${err.message}`)
+  }
+
+  // ── skills ──
+  try {
+    const names = collectSkillNames()
+    if (names.length > 0) bump(installSkills(names, configDir, false, ''))
+  } catch (err) {
+    result.errors.push(`skills: ${err.message}`)
+  }
+
+  // ── instructions (AGENTS.md) ──
+  try {
+    const src = join(ROOT, 'AGENTS.md')
+    if (existsSync(src)) {
+      if (
+        writeIfChanged(join(configDir, 'AGENTS.md'), readFileSync(src, 'utf8'), false) === 'created'
+      ) {
+        result.created++
+      } else result.skipped++
+    }
+  } catch (err) {
+    result.errors.push(`instructions: ${err.message}`)
+  }
+
+  // ── commands (*.md) ──
+  try {
+    const srcCmds = join(ROOT, 'commands')
+    if (existsSync(srcCmds)) {
+      bump(syncDir(srcCmds, join(configDir, 'commands'), false, false, (f) => f.endsWith('.md')))
+    }
+  } catch (err) {
+    result.errors.push(`commands: ${err.message}`)
+  }
+
+  // ── runtime payload (MCP scripts, code-mode, tiers) ──
+  try {
+    const dstScripts = join(configDir, 'scripts')
+    mkdirSync(dstScripts, { recursive: true })
+    for (const [name, srcFn] of Object.entries(MCP_SCRIPTS)) {
+      const src = srcFn()
+      if (!existsSync(src)) continue
+      const content = readFileSync(src, 'utf8')
+      const dst = join(dstScripts, name)
+      if (writeIfChanged(dst, content, false) === 'created') {
+        statSync(dst)
+        result.created++
+      } else result.skipped++
+    }
+
+    const req = join(ROOT, 'src', 'mcp', 'requirements-vision.txt')
+    if (existsSync(req)) {
+      if (
+        writeIfChanged(
+          join(configDir, 'requirements-vision.txt'),
+          readFileSync(req, 'utf8'),
+          false,
+        ) === 'created'
+      ) {
+        result.created++
+      } else result.skipped++
+    }
+
+    const srcCodeMode = join(ROOT, '.pantheon', 'code-mode')
+    const dstCodeMode = join(configDir, '.pantheon', 'code-mode')
+    if (existsSync(srcCodeMode)) {
+      bump(syncDir(srcCodeMode, dstCodeMode, false, false))
+    }
+
+    const srcTiers = join(ROOT, '.pantheon', 'tiers.json')
+    const dstTiers = join(configDir, '.pantheon', 'tiers.json')
+    if (existsSync(srcTiers)) {
+      if (writeIfChanged(dstTiers, readFileSync(srcTiers, 'utf8'), false) === 'created')
+        result.created++
+      else result.skipped++
+    }
+  } catch (err) {
+    result.errors.push(`runtime: ${err.message}`)
+  }
+
+  return result
+}
+
+/** Drop stale entries in dst that no longer exist in src (agents/skills dirs). */
+export function pruneMissing(srcDir, dstDir) {
+  if (!existsSync(srcDir) || !existsSync(dstDir)) return 0
+  const src = new Set(readdirSync(srcDir))
+  let removed = 0
+  for (const entry of readdirSync(dstDir)) {
+    if (!src.has(entry)) {
+      rmSync(join(dstDir, entry), { recursive: true, force: true })
+      removed++
+    }
+  }
+  return removed
+}

package/scripts/sync-tui.mjs

@@ -10,10 +10,10 @@
  * If the user hasn't initialized yet → do nothing (silent exit).
  */
 import { execSync } from 'node:child_process'
-import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
-import { fileURLToPath } from 'node:url'
+import { fileURLToPath, pathToFileURL } from 'node:url'
 
 const __dirname = fileURLToPath(new URL('.', import.meta.url))
 const ROOT = join(__dirname, '..')
@@ -58,7 +58,8 @@ function resolveConfigDir() {
 }
 
 /**
- * Copy plugin runtime files (dist/*, package.json, src/index.tsx) from srcDir
+ * Copy plugin runtime files (dist/*, package.json, package-lock.json,
+ * src/index.tsx) from srcDir
  * to dstDir. Skips files that are byte-identical.
  * @returns {{ created: number, skipped: number }}
  */
@@ -94,55 +95,147 @@ function copyPluginFiles(srcDir, dstDir) {
     else result.skipped++
   }
 
+  // Keep the copied plugin installable with deterministic npm ci.
+  const lockSrc = join(srcDir, 'package-lock.json')
+  if (existsSync(lockSrc)) {
+    const content = readFileSync(lockSrc, 'utf8')
+    if (writeIfChanged(join(dstDir, 'package-lock.json'), content)) result.created++
+    else result.skipped++
+  }
+
   return result
 }
 
-// ── Main ───────────────────────────────────────────────────────────────
+// ── npm env hygiene ────────────────────────────────────────────────────
 
-try {
-  const configDir = resolveConfigDir()
-  if (!configDir) {
-    // User hasn't run init yet — silent exit, no error
-    process.exit(0)
-  }
+/**
+ * npm lifecycle env vars that put a nested `npm ci` into global context and
+ * make it abort with ECIGLOBAL ("`npm ci` does not work for global packages").
+ * When the package itself is installed with `npm install -g`, npm injects these
+ * into the postinstall environment; the TUI dependency sync is a local
+ * operation and must never inherit them.
+ */
+const GLOBAL_NPM_ENV_KEYS = new Set([
+  'npm_config_global',
+  'npm_config_globalconfig',
+  'npm_config_prefix',
+  'npm_config_location',
+])
 
-  const tuiCopyDir = join(configDir, 'plugins', 'pantheon-tui')
-  if (!existsSync(tuiCopyDir)) {
-    // TUI plugin not installed — silent exit
-    process.exit(0)
+/**
+ * Return a copy of `env` with global-context npm config vars removed.
+ * Matching is case-insensitive so Windows-style uppercase keys are handled.
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {NodeJS.ProcessEnv}
+ */
+export function sanitizeNpmEnv(env = process.env) {
+  const clean = { ...env }
+  for (const key of Object.keys(clean)) {
+    if (GLOBAL_NPM_ENV_KEYS.has(key.toLowerCase())) delete clean[key]
   }
+  return clean
+}
 
-  // Source: TUI plugin inside the installed package
-  const tuiSrcDir = join(ROOT, 'src', 'plugins', 'tui')
-  if (!existsSync(tuiSrcDir)) {
-    // Source not found (shouldn't happen in a proper install)
-    process.exit(0)
-  }
+// ── Main ───────────────────────────────────────────────────────────────
+
+async function main() {
+  try {
+    const configDir = resolveConfigDir()
+    if (!configDir) {
+      // User hasn't run init yet — silent exit, no error
+      process.exit(0)
+    }
 
-  // Compare versions before copy
-  const installedVersion = readVersion(join(tuiCopyDir, 'package.json'))
-  const sourceVersion = readVersion(join(tuiSrcDir, 'package.json'))
+    const tuiCopyDir = join(configDir, 'plugins', 'pantheon-tui')
+    if (!existsSync(tuiCopyDir)) {
+      // beta.5: no TUI install (plugins component omitted) — skip the TUI
+      // sync but STILL refresh the copy-only artifacts below.
+      const { syncCopyArtifacts } = await import('./sync-artifacts.mjs')
+      const synced = syncCopyArtifacts(configDir)
+      if (synced.errors.length > 0) {
+        for (const e of synced.errors) console.error(`  ⚠️  artifact sync: ${e}`)
+      }
+      console.log(
+        `  Artifacts synced: ${synced.created} updated, ${synced.skipped} already current`,
+      )
+      return
+    }
 
-  // Copy fresh files
-  const { created, skipped } = copyPluginFiles(tuiSrcDir, tuiCopyDir)
+    // Source: TUI plugin inside the installed package
+    const tuiSrcDir = join(ROOT, 'src', 'plugins', 'tui')
+    if (!existsSync(tuiSrcDir)) {
+      throw new Error(`TUI plugin source not found: ${tuiSrcDir}`)
+    }
 
-  // Refresh dependencies in the copy
-  try {
-    execSync('npm install --omit=dev --no-audit', { cwd: tuiCopyDir, stdio: 'pipe' })
-  } catch {
-    // Non-fatal — deps may already be current
-  }
+    // Compare versions before copy
+    const installedVersion = readVersion(join(tuiCopyDir, 'package.json'))
+    const sourceVersion = readVersion(join(tuiSrcDir, 'package.json'))
+
+    // Copy fresh files
+    const { created } = copyPluginFiles(tuiSrcDir, tuiCopyDir)
+
+    // Lockfile installation is the only accepted dependency path. Strip
+    // global-context npm vars so a global postinstall can't trigger ECIGLOBAL.
+    execSync('npm ci --omit=dev --no-audit --no-fund', {
+      cwd: tuiCopyDir,
+      stdio: 'pipe',
+      env: sanitizeNpmEnv(),
+    })
+
+    // Log result
+    if (installedVersion && sourceVersion && installedVersion === sourceVersion && created === 0) {
+      console.log(`  TUI plugin already up to date (v${sourceVersion})`)
+    } else {
+      console.log(
+        `  TUI plugin updated to v${sourceVersion || 'latest'}${installedVersion ? ` (was v${installedVersion})` : ''}`,
+      )
+    }
 
-  // Log result
-  if (installedVersion && sourceVersion && installedVersion === sourceVersion && created === 0) {
-    console.log(`  TUI plugin already up to date (v${sourceVersion})`)
-  } else {
-    console.log(
-      `  TUI plugin updated to v${sourceVersion || 'latest'}${installedVersion ? ` (was v${installedVersion})` : ''}`,
-    )
+    // ── beta.5 freshness guarantee: refresh ALL copy-only artifacts ──
+    // Agents, skills, AGENTS.md, commands, MCP scripts, code-mode payload.
+    // The plugin references in opencode.json already point INTO this package,
+    // so only the copies would go stale after a package update.
+    const { syncCopyArtifacts } = await import('./sync-artifacts.mjs')
+    const { readState, writeState } = await import('./install/state.mjs')
+    const pkgVersion = readVersion(join(ROOT, 'package.json')) ?? 'unknown'
+    const synced = syncCopyArtifacts(configDir)
+    if (synced.errors.length > 0) {
+      for (const e of synced.errors) console.error(`  ⚠️  artifact sync: ${e}`)
+    }
+    console.log(`  Artifacts synced: ${synced.created} updated, ${synced.skipped} already current`)
+
+    // Version marker so doctor can detect a stale installation and point the
+    // user at `pantheon-opencode update` for the full refresh (config merge,
+    // venv, MCP entries).
+    try {
+      const previous = readState(configDir)
+      writeState(configDir, {
+        pantheon_version: pkgVersion,
+        previous_version: previous?.pantheon_version ?? null,
+      })
+      if (previous?.pantheon_version && previous.pantheon_version !== pkgVersion) {
+        console.log(
+          `  ⚠️  Installation moved ${previous.pantheon_version} → ${pkgVersion}. ` +
+            'Run `npx pantheon-opencode init` to refresh config/venv/MCP entries.',
+        )
+      }
+    } catch {
+      // Marker is best-effort — never fail the postinstall over it.
+    }
+  } catch (err) {
+    console.error(`❌ TUI sync failed: ${err.message}`)
+    process.exitCode = 1
   }
-} catch (err) {
-  // Postinstall scripts must never break npm install
-  console.warn(`⚠️  TUI sync skipped: ${err.message}`)
-  process.exit(0)
+}
+
+// Only run when invoked directly (`node scripts/sync-tui.mjs`). Importing this
+// module for unit tests must not trigger the side-effecting postinstall sync.
+const isDirectRun =
+  Boolean(process.argv[1]) && pathToFileURL(process.argv[1]).href === import.meta.url
+
+if (isDirectRun) {
+  main().catch((err) => {
+    console.error(`❌ TUI sync failed: ${err.message}`)
+    process.exitCode = 1
+  })
 }