pantheon-opencode 1.4.3 → 1.5.0-beta.2

package/scripts/mcp_resources_server.py

@@ -17,7 +17,7 @@ from pathlib import Path
 from typing import Any
 
 import yaml
-from _pantheon_paths import pantheon_home, pantheon_project
+from _pantheon_paths import has_symlink_component, pantheon_home, pantheon_project
 from eval_store import get_latest_eval, list_evals
 from mcp.server.fastmcp import FastMCP
 
@@ -25,6 +25,88 @@ from mcp.server.fastmcp import FastMCP
 _PANTHEON_HOME: Path = pantheon_home()
 _PANTHEON_PROJECT: Path | None = pantheon_project()
 
+
+def _within(path: Path, parent: Path) -> bool:
+    """Return whether ``path`` is contained by ``parent`` after resolution."""
+    try:
+        path.relative_to(parent)
+    except ValueError:
+        return False
+    return True
+
+
+def _safe_root(root: Path, parent: Path) -> Path | None:
+    """Return a physical resource root only when its layout is trusted.
+
+    Local ``.opencode`` and ``.pantheon`` directories are trust boundaries:
+    accepting either as a symlink would make all resources below it
+    untrusted, even when the link happens to point inside the project.
+    """
+    if parent.is_symlink() or has_symlink_component(parent):
+        return None
+    # Keep the project root lexical until this trust-boundary check.  This
+    # rejects PANTHEON_PROJECT/cwd symlinks instead of resolving them away.
+    if parent.name in {".opencode", ".pantheon"} and parent.parent.is_symlink():
+        return None
+    if root.is_symlink():
+        return None
+    if not root.exists() or not root.is_dir():
+        return None
+    parent_resolved = parent.resolve()
+    resolved = root.resolve()
+    if parent.name in {".opencode", ".pantheon"} and not _within(
+        parent_resolved, parent.parent.resolve()
+    ):
+        return None
+    return resolved if _within(resolved, parent_resolved) else None
+
+
+def _resource_root(name: str) -> Path | None:
+    """Choose a project-local root before the global installation root.
+
+    A present but unsafe project root is ignored rather than followed; this
+    preserves the global fallback while preventing symlink escapes.
+    """
+    candidates: list[tuple[Path, Path]] = []
+    if _PANTHEON_PROJECT is not None:
+        if name in {"agents", "skills"}:
+            local = _PANTHEON_PROJECT / ".opencode"
+            candidates.append((local / name, local))
+        elif name in {"deepwork", "memory-bank"}:
+            local = _PANTHEON_PROJECT / ".pantheon"
+            candidates.append((local / name, local))
+    candidates.append((_PANTHEON_HOME / name, _PANTHEON_HOME))
+    for root, parent in candidates:
+        safe = _safe_root(root, parent)
+        if safe is not None:
+            return safe
+    return None
+
+
+def _resource_roots(name: str) -> list[Path]:
+    """Return safe resource roots in local-first precedence order."""
+    roots: list[Path] = []
+    if _PANTHEON_PROJECT is not None:
+        base_name = ".opencode" if name in {"agents", "skills"} else ".pantheon"
+        base = _PANTHEON_PROJECT / base_name
+        local = _safe_root(base / name, base)
+        if local is not None:
+            roots.append(local)
+    global_root = _safe_root(_PANTHEON_HOME / name, _PANTHEON_HOME)
+    if global_root is not None:
+        roots.append(global_root)
+    return roots
+
+
+def _safe_child(root: Path, relative: str) -> Path | None:
+    """Resolve a child while rejecting every lexical symlink component."""
+    candidate = root / relative
+    if has_symlink_component(candidate):
+        return None
+    resolved = candidate.resolve()
+    return resolved if _within(resolved, root.resolve()) else None
+
+
 # ── FastMCP App ───────────────────────────────────────────────────────────────
 mcp = FastMCP(
     "Pantheon Resources",
@@ -67,17 +149,27 @@ def _get_role_from_frontmatter(frontmatter: dict[str, Any]) -> str:
 )
 async def list_agents() -> str:
     """Return a markdown list of all agents with their roles."""
-    agents_dir = _PANTHEON_HOME / "agents"
-    if not agents_dir.is_dir():
+    agents_dirs = _resource_roots("agents")
+    if not agents_dirs:
         return "Agents directory not found."
 
     agents: list[str] = []
-    for f in sorted(agents_dir.iterdir()):
-        if f.suffix == ".md" and f.stem.lower() != "readme":
-            frontmatter = _parse_yaml_frontmatter(f)
-            name = frontmatter.get("name", f.stem)
-            role = _get_role_from_frontmatter(frontmatter)
-            agents.append(f"- **{name}** — {role}")
+    seen: set[str] = set()
+    for agents_dir in agents_dirs:
+        for entry in sorted(agents_dir.iterdir()):
+            f = _safe_child(agents_dir, entry.name)
+            if (
+                f is not None
+                and f.is_file()
+                and f.suffix == ".md"
+                and f.stem.lower() != "readme"
+                and f.name not in seen
+            ):
+                seen.add(f.name)
+                frontmatter = _parse_yaml_frontmatter(f)
+                name = frontmatter.get("name", f.stem)
+                role = _get_role_from_frontmatter(frontmatter)
+                agents.append(f"- **{name}** — {role}")
 
     return "\n".join(agents) if agents else "No agents found."
 
@@ -88,19 +180,23 @@ async def list_agents() -> str:
 )
 async def list_skills() -> str:
     """Return a markdown list of all skills with descriptions."""
-    skills_dir = _PANTHEON_HOME / "skills"
-    if not skills_dir.is_dir():
+    skills_dirs = _resource_roots("skills")
+    if not skills_dirs:
         return "Skills directory not found."
 
     skills: list[str] = []
-    for f in sorted(skills_dir.iterdir()):
-        if f.is_dir():
-            skill_file = f / "SKILL.md"
-            if skill_file.exists():
-                frontmatter = _parse_yaml_frontmatter(skill_file)
-                name = frontmatter.get("name", f.name)
-                desc = frontmatter.get("description", "No description")
-                skills.append(f"- **{name}** — {desc}")
+    seen: set[str] = set()
+    for skills_dir in skills_dirs:
+        for entry in sorted(skills_dir.iterdir()):
+            f = _safe_child(skills_dir, entry.name)
+            if f is not None and f.is_dir() and f.name not in seen:
+                skill_file = _safe_child(f, "SKILL.md")
+                if skill_file is not None and skill_file.is_file():
+                    seen.add(f.name)
+                    frontmatter = _parse_yaml_frontmatter(skill_file)
+                    name = frontmatter.get("name", f.name)
+                    desc = frontmatter.get("description", "No description")
+                    skills.append(f"- **{name}** — {desc}")
 
     return "\n".join(skills) if skills else "No skills found."
 
@@ -111,10 +207,10 @@ async def list_skills() -> str:
 )
 async def get_routing() -> str:
     """Return the full content of routing.yml."""
-    routing_file = _PANTHEON_HOME / "routing.yml"
-    if not routing_file.exists() and _PANTHEON_PROJECT:
-        routing_file = _PANTHEON_PROJECT / "src" / "routing.yml"
-    if not routing_file.exists():
+    routing_file = _safe_child(_PANTHEON_HOME, "routing.yml")
+    if routing_file is None and _PANTHEON_PROJECT:
+        routing_file = _safe_child(_PANTHEON_PROJECT / "src", "routing.yml")
+    if routing_file is None or not routing_file.exists():
         return "routing.yml not found."
     return routing_file.read_text(encoding="utf-8")
 
@@ -128,11 +224,17 @@ async def get_routing() -> str:
 )
 async def get_agent(agent_name: str) -> str:
     """Return the full content of an agent file, case-insensitively."""
-    agents_dir = _PANTHEON_HOME / "agents"
     name_lower = agent_name.lower()
-    for f in agents_dir.iterdir():
-        if f.suffix == ".md" and f.stem.lower() == name_lower:
-            return f.read_text(encoding="utf-8")
+    for agents_dir in _resource_roots("agents"):
+        for entry in agents_dir.iterdir():
+            f = _safe_child(agents_dir, entry.name)
+            if (
+                f is not None
+                and f.is_file()
+                and f.suffix == ".md"
+                and f.stem.lower() == name_lower
+            ):
+                return f.read_text(encoding="utf-8")
     return f"Agent '{agent_name}' not found."
 
 
@@ -142,10 +244,11 @@ async def get_agent(agent_name: str) -> str:
 )
 async def get_deepwork_plan(slug: str) -> str:
     """Return PLAN.md content for a deepwork slug."""
-    if _PANTHEON_PROJECT is None:
+    deepwork_dir = _resource_root("deepwork")
+    if deepwork_dir is None:
         return f"Deepwork '{slug}' not found. (PANTHEON_PROJECT not set)"
-    plan_file = _PANTHEON_PROJECT / ".pantheon" / "deepwork" / slug / "PLAN.md"
-    if not plan_file.exists():
+    plan_file = _safe_child(deepwork_dir, f"{slug}/PLAN.md")
+    if plan_file is None or not plan_file.is_file():
         return f"Deepwork '{slug}' not found."
     return plan_file.read_text(encoding="utf-8")
 
@@ -157,10 +260,11 @@ async def get_deepwork_plan(slug: str) -> str:
 )
 async def get_deepwork_status(slug: str) -> str:
     """Return STATUS.md content for a deepwork slug, or a default message."""
-    if _PANTHEON_PROJECT is None:
+    deepwork_dir = _resource_root("deepwork")
+    if deepwork_dir is None:
         return "STATUS.md not found. (PANTHEON_PROJECT not set)"
-    status_file = _PANTHEON_PROJECT / ".pantheon" / "deepwork" / slug / "STATUS.md"
-    if not status_file.exists():
+    status_file = _safe_child(deepwork_dir, f"{slug}/STATUS.md")
+    if status_file is None or not status_file.is_file():
         return "STATUS.md not found. Current state: IN PROGRESS"
     return status_file.read_text(encoding="utf-8")
 
@@ -171,8 +275,9 @@ async def get_deepwork_status(slug: str) -> str:
 )
 async def get_skill(name: str) -> str:
     """Return SKILL.md content for a skill directory."""
-    skill_file = _PANTHEON_HOME / "skills" / name / "SKILL.md"
-    if not skill_file.exists():
+    skills_dir = _resource_root("skills")
+    skill_file = _safe_child(skills_dir, f"{name}/SKILL.md") if skills_dir else None
+    if skill_file is None or not skill_file.is_file():
         return f"Skill '{name}' not found."
     return skill_file.read_text(encoding="utf-8")
 
@@ -188,12 +293,11 @@ async def get_memory_bank(path: str) -> str:
     Security: resolves absolute path and verifies it stays within
     .pantheon/memory-bank/ to prevent directory traversal attacks.
     """
-    if _PANTHEON_PROJECT is None:
+    memory_dir = _resource_root("memory-bank")
+    if memory_dir is None:
         return "Memory bank not available. (PANTHEON_PROJECT not set)"
-    resolved = (_PANTHEON_PROJECT / ".pantheon" / "memory-bank" / path).resolve()
-    mb_dir = (_PANTHEON_PROJECT / ".pantheon" / "memory-bank").resolve()
-
-    if not str(resolved).startswith(str(mb_dir)):
+    resolved = _safe_child(memory_dir, path)
+    if resolved is None:
         return "Path traversal blocked: access denied."
 
     if not resolved.exists() or not resolved.is_file():

package/scripts/memory_mcp_server.py

@@ -25,7 +25,7 @@ import json
 import os
 import sqlite3
 import time
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any
 
@@ -198,7 +198,7 @@ def _parse_iso_ts(value: str) -> float:
     """
     dt = datetime.fromisoformat(value.replace("Z", "+00:00"))
     if dt.tzinfo is None:
-        dt = dt.replace(tzinfo=timezone.utc)
+        dt = dt.replace(tzinfo=UTC)
     return dt.timestamp()
 
 

package/scripts/probe-context-rehydrate.mjs

@@ -0,0 +1,240 @@
+#!/usr/bin/env node
+import { spawnSync } from 'node:child_process'
+/**
+ * Offline/ambiental probe for context_rehydrate and context_session_summary.
+ *
+ * The Python child imports the installed persistence server and exercises the
+ * real FastMCP tools against a temporary SQLite database. No OpenCode command,
+ * network call, LLM, or user database is involved. Missing package/runtime is
+ * NOT_TESTED/AMBIENTAL rather than a false PASS.
+ */
+import { existsSync, mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const requestedVersion = valueFor('--version')
+const jsonOutput = process.argv.includes('--json')
+const runtime = fileURLToPath(new URL('./mcp_persistence_server.py', import.meta.url))
+
+function valueFor(name) {
+  const index = process.argv.indexOf(name)
+  return index >= 0 ? process.argv[index + 1] : undefined
+}
+
+function emit(status, detail, checks = []) {
+  const result = { status, version: requestedVersion, detail, checks }
+  if (jsonOutput) process.stdout.write(JSON.stringify(result))
+  else process.stdout.write(`${status}: ${detail}\n`)
+  if (status === 'FAIL') process.exitCode = 1
+}
+
+function unavailable(detail) {
+  emit('NOT_TESTED', detail)
+}
+
+function pythonCandidates() {
+  const venvPython = process.env.HOME
+    ? join(process.env.HOME, '.config', 'opencode', '.venv', 'bin', 'python')
+    : undefined
+  return [process.env.PANTHEON_PYTHON, venvPython, 'python3'].filter(Boolean)
+}
+
+const PYTHON_HARNESS = `
+import asyncio
+import importlib.util
+import json
+import os
+import sys
+from pathlib import Path
+
+runtime_path = Path(sys.argv[1]).resolve()
+db_root = Path(sys.argv[2]).resolve()
+sys.path.insert(0, str(runtime_path.parent))
+sys.argv = [str(runtime_path), "--global-db", str(db_root / "global.db"),
+            "--project-db", str(db_root / "project.db")]
+
+spec = importlib.util.spec_from_file_location("probe_mcp_persistence", runtime_path)
+if spec is None or spec.loader is None:
+    raise RuntimeError("could not load persistence runtime")
+module = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(module)
+
+
+async def call(name, arguments):
+    result = await module.mcp.call_tool(name, arguments)
+    if isinstance(result, tuple):
+        structured = result[1]
+        if structured is not None:
+            if isinstance(structured, dict) and "result" in structured:
+                return structured["result"]
+            return structured
+        result = result[0]
+    if isinstance(result, dict):
+        return result
+    if not result:
+        return None
+    text = getattr(result[0], "text", str(result[0]))
+    try:
+        return json.loads(text)
+    except (TypeError, ValueError, json.JSONDecodeError):
+        return text
+
+
+async def main():
+    checks = []
+    slug = "context-rehydrate-probe"
+    session_id = "synthetic-session"
+    checkpoint = {
+        "version": 1,
+        "goal": {"id": "probe-goal", "objective": "verify context recovery",
+                 "status": "in_progress"},
+        "phase": {"current": 2, "total": 3, "name": "offline validation"},
+        "delegations": {"in_flight": [{"alias": "apo-probe", "agent": "apollo",
+                                         "task_id": "probe-task"}]},
+    }
+    tail = ["phase 1 complete", "phase 2 payload validated"]
+
+    # context_save creates the real session-qualified latest pointer. Keeping
+    # tail under its own key also tests the runtime's latest/tail fallback.
+    await call("context_save", {"slug": slug, "key": "tail",
+                                 "content": json.dumps(tail),
+                                 "session_id": session_id})
+    await call("context_save", {"slug": slug, "key": "phase:2",
+                                 "content": json.dumps(checkpoint),
+                                 "session_id": session_id})
+    latest = await call("context_get", {"slug": slug, "key": "latest",
+                                         "session_id": session_id})
+    stored_tail = await call("context_get", {"slug": slug, "key": "tail",
+                                              "session_id": session_id})
+    if latest is None or stored_tail is None:
+        raise AssertionError("synthetic latest/tail checkpoint payload is null")
+    checks.append("synthetic latest/tail/goal/phase/delegation checkpoint: PASS")
+
+    os.environ.pop("PANTHEON_COMPACTION", None)
+    os.environ.pop("PANTHEON_SESSION_END_SUMMARY", None)
+    blocks = await call("context_rehydrate", {"slug": slug})
+    summary = await call("context_session_summary", {"slug": slug})
+    if not isinstance(blocks, list) or not blocks:
+        raise AssertionError("context_rehydrate returned a null/empty payload")
+    if not isinstance(summary, str) or not summary:
+        raise AssertionError("context_session_summary returned a null/empty payload")
+    for fragment in ("verify context recovery", "phase 2/3", "apo-probe",
+                     "phase 2 payload validated"):
+        if not any(fragment in block for block in blocks) and fragment not in summary:
+            raise AssertionError(f"payload is missing {fragment!r}")
+    checks.append("context_rehydrate non-null payload: PASS")
+    checks.append("context_session_summary non-null payload: PASS")
+
+    missing_blocks = await call("context_rehydrate", {"slug": "probe-absent"})
+    missing_summary = await call("context_session_summary", {"slug": "probe-absent"})
+    if missing_blocks is not None or missing_summary is not None:
+        raise AssertionError("absent checkpoint must return null payloads")
+    checks.append("absence returns null: PASS")
+
+    expired_slug = "context-expired-probe"
+    await call("context_save", {"slug": expired_slug, "key": "phase:1",
+                                 "content": json.dumps(checkpoint), "ttl": -1,
+                                 "session_id": session_id})
+    expired_blocks = await call("context_rehydrate", {"slug": expired_slug})
+    expired_summary = await call("context_session_summary", {"slug": expired_slug})
+    if expired_blocks is not None or expired_summary is not None:
+        raise AssertionError("expired checkpoint must return null payloads")
+    checks.append("expiration returns null: PASS")
+
+    invalid_slug = "context-invalid-probe"
+    await call("context_save", {"slug": invalid_slug, "key": "phase:1",
+                                 "content": "not-json", "session_id": session_id})
+    invalid_blocks = await call("context_rehydrate", {"slug": invalid_slug})
+    invalid_summary = await call("context_session_summary", {"slug": invalid_slug})
+    if invalid_blocks is not None or invalid_summary is not None:
+        raise AssertionError("invalid checkpoint must return null payloads")
+    checks.append("invalid payload returns null: PASS")
+
+    os.environ["PANTHEON_COMPACTION"] = "off"
+    switched_blocks = await call("context_rehydrate", {"slug": slug})
+    if switched_blocks is not None:
+        raise AssertionError("PANTHEON_COMPACTION=off must return null")
+    os.environ.pop("PANTHEON_COMPACTION", None)
+    os.environ["PANTHEON_SESSION_END_SUMMARY"] = "off"
+    switched_summary = await call("context_session_summary", {"slug": slug})
+    if switched_summary is not None:
+        raise AssertionError("PANTHEON_SESSION_END_SUMMARY=off must return null")
+    checks.append("kill-switches return null: PASS")
+    print(json.dumps({"checks": checks}))
+
+
+asyncio.run(main())
+`
+
+async function main() {
+  if (requestedVersion !== 'v1' && requestedVersion !== 'v2') {
+    emit('FAIL', 'usage: --version v1|v2 [--json]')
+    return
+  }
+  if (!existsSync(runtime)) {
+    unavailable('installed package does not include mcp_persistence_server.py')
+    return
+  }
+
+  const root = mkdtempSync(join(tmpdir(), 'pantheon-context-probe-'))
+  const dbRoot = join(root, 'db')
+  const python = pythonCandidates().find((candidate) =>
+    candidate.includes('/') ? existsSync(candidate) : true,
+  )
+  if (!python) {
+    rmSync(root, { recursive: true, force: true })
+    unavailable('Python persistence runtime is not available')
+    return
+  }
+
+  try {
+    const child = spawnSync(python, ['-c', PYTHON_HARNESS, runtime, dbRoot], {
+      encoding: 'utf8',
+      timeout: 30000,
+      env: process.env,
+    })
+    if (child.error) {
+      const detail = child.error instanceof Error ? child.error.message : String(child.error)
+      if (/EACCES|permission denied|not found/i.test(detail)) {
+        emit('AMBIENTAL', `persistence runtime unavailable: ${detail}`)
+      } else {
+        unavailable(`persistence runtime unavailable: ${detail}`)
+      }
+      return
+    }
+    if (child.signal === 'SIGTERM') {
+      emit('AMBIENTAL', 'persistence probe timed out after 30s')
+      return
+    }
+    if (child.status !== 0) {
+      const detail = `${child.stderr || child.stdout || 'persistence probe failed'}`.trim()
+      if (
+        /No module named|ModuleNotFoundError|can't open file|No such file|importerror/i.test(detail)
+      ) {
+        unavailable(`persistence runtime unavailable: ${detail.slice(0, 320)}`)
+      } else {
+        emit('FAIL', `offline persistence checks failed: ${detail.slice(0, 320)}`)
+      }
+      return
+    }
+
+    const lines = child.stdout.trim().split('\n').filter(Boolean)
+    const payload = JSON.parse(lines.at(-1) || '')
+    if (!Array.isArray(payload.checks) || payload.checks.length < 6) {
+      emit('FAIL', 'offline persistence probe returned incomplete checks')
+      return
+    }
+    emit(
+      'PASS',
+      'offline synthetic persistence checks passed; no LLM or user DB was used',
+      payload.checks,
+    )
+  } catch (error) {
+    emit('FAIL', error instanceof Error ? error.message : String(error))
+  } finally {
+    rmSync(root, { recursive: true, force: true })
+  }
+}
+
+await main()