pantheon-opencode 1.5.0-beta.1 → 1.5.0-beta.11

package/scripts/sync-tui.mjs

@@ -13,7 +13,7 @@ import { execSync } from 'node:child_process'
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
-import { fileURLToPath } from 'node:url'
+import { fileURLToPath, pathToFileURL } from 'node:url'
 
 const __dirname = fileURLToPath(new URL('.', import.meta.url))
 const ROOT = join(__dirname, '..')
@@ -106,68 +106,136 @@ function copyPluginFiles(srcDir, dstDir) {
   return result
 }
 
-// ── Main ───────────────────────────────────────────────────────────────
-
-try {
-  const configDir = resolveConfigDir()
-  if (!configDir) {
-    // User hasn't run init yet — silent exit, no error
-    process.exit(0)
-  }
+// ── npm env hygiene ────────────────────────────────────────────────────
 
-  const tuiCopyDir = join(configDir, 'plugins', 'pantheon-tui')
-  if (!existsSync(tuiCopyDir)) {
-    // TUI plugin not installed — silent exit
-    process.exit(0)
-  }
+/**
+ * npm lifecycle env vars that put a nested `npm ci` into global context and
+ * make it abort with ECIGLOBAL ("`npm ci` does not work for global packages").
+ * When the package itself is installed with `npm install -g`, npm injects these
+ * into the postinstall environment; the TUI dependency sync is a local
+ * operation and must never inherit them.
+ */
+const GLOBAL_NPM_ENV_KEYS = new Set([
+  'npm_config_global',
+  'npm_config_globalconfig',
+  'npm_config_prefix',
+  'npm_config_location',
+])
 
-  // Source: TUI plugin inside the installed package
-  const tuiSrcDir = join(ROOT, 'src', 'plugins', 'tui')
-  if (!existsSync(tuiSrcDir)) {
-    // Source not found (shouldn't happen in a proper install)
-    process.exit(0)
+/**
+ * Return a copy of `env` with global-context npm config vars removed.
+ * Matching is case-insensitive so Windows-style uppercase keys are handled.
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {NodeJS.ProcessEnv}
+ */
+export function sanitizeNpmEnv(env = process.env) {
+  const clean = { ...env }
+  for (const key of Object.keys(clean)) {
+    if (GLOBAL_NPM_ENV_KEYS.has(key.toLowerCase())) delete clean[key]
   }
+  return clean
+}
 
-  // Compare versions before copy
-  const installedVersion = readVersion(join(tuiCopyDir, 'package.json'))
-  const sourceVersion = readVersion(join(tuiSrcDir, 'package.json'))
-
-  // Copy fresh files
-  const { created } = copyPluginFiles(tuiSrcDir, tuiCopyDir)
+// ── Main ───────────────────────────────────────────────────────────────
 
-  // Refresh dependencies in the copy. npm install is only allowed when the
-  // operator explicitly opts into the non-deterministic legacy fallback.
+async function main() {
   try {
-    execSync('npm ci --omit=dev --no-audit --no-fund', { cwd: tuiCopyDir, stdio: 'pipe' })
-  } catch (err) {
-    if (process.env.PANTHEON_ALLOW_NPM_INSTALL_FALLBACK === '1') {
-      console.warn(`⚠️  npm ci failed; explicit fallback enabled: ${err.message}`)
-      try {
-        execSync('npm install --omit=dev --no-audit --no-fund --package-lock=false', {
-          cwd: tuiCopyDir,
-          stdio: 'pipe',
-        })
-      } catch (fallbackError) {
-        console.warn(`⚠️  TUI dependency refresh skipped: ${fallbackError.message}`)
+    const configDir = resolveConfigDir()
+    if (!configDir) {
+      // User hasn't run init yet — silent exit, no error
+      process.exit(0)
+    }
+
+    const tuiCopyDir = join(configDir, 'plugins', 'pantheon-tui')
+    if (!existsSync(tuiCopyDir)) {
+      // beta.5: no TUI install (plugins component omitted) — skip the TUI
+      // sync but STILL refresh the copy-only artifacts below.
+      const { syncCopyArtifacts } = await import('./sync-artifacts.mjs')
+      const synced = syncCopyArtifacts(configDir)
+      if (synced.errors.length > 0) {
+        for (const e of synced.errors) console.error(`  ⚠️  artifact sync: ${e}`)
       }
+      console.log(
+        `  Artifacts synced: ${synced.created} updated, ${synced.skipped} already current`,
+      )
+      return
+    }
+
+    // Source: TUI plugin inside the installed package
+    const tuiSrcDir = join(ROOT, 'src', 'plugins', 'tui')
+    if (!existsSync(tuiSrcDir)) {
+      throw new Error(`TUI plugin source not found: ${tuiSrcDir}`)
+    }
+
+    // Compare versions before copy
+    const installedVersion = readVersion(join(tuiCopyDir, 'package.json'))
+    const sourceVersion = readVersion(join(tuiSrcDir, 'package.json'))
+
+    // Copy fresh files
+    const { created } = copyPluginFiles(tuiSrcDir, tuiCopyDir)
+
+    // Lockfile installation is the only accepted dependency path. Strip
+    // global-context npm vars so a global postinstall can't trigger ECIGLOBAL.
+    execSync('npm ci --omit=dev --no-audit --no-fund', {
+      cwd: tuiCopyDir,
+      stdio: 'pipe',
+      env: sanitizeNpmEnv(),
+    })
+
+    // Log result
+    if (installedVersion && sourceVersion && installedVersion === sourceVersion && created === 0) {
+      console.log(`  TUI plugin already up to date (v${sourceVersion})`)
     } else {
-      console.warn(
-        `⚠️  TUI dependency refresh skipped after npm ci failure. Set ` +
-          `PANTHEON_ALLOW_NPM_INSTALL_FALLBACK=1 to explicitly allow npm install: ${err.message}`,
+      console.log(
+        `  TUI plugin updated to v${sourceVersion || 'latest'}${installedVersion ? ` (was v${installedVersion})` : ''}`,
       )
     }
-  }
 
-  // Log result
-  if (installedVersion && sourceVersion && installedVersion === sourceVersion && created === 0) {
-    console.log(`  TUI plugin already up to date (v${sourceVersion})`)
-  } else {
-    console.log(
-      `  TUI plugin updated to v${sourceVersion || 'latest'}${installedVersion ? ` (was v${installedVersion})` : ''}`,
-    )
+    // ── beta.5 freshness guarantee: refresh ALL copy-only artifacts ──
+    // Agents, skills, AGENTS.md, commands, MCP scripts, code-mode payload.
+    // The plugin references in opencode.json already point INTO this package,
+    // so only the copies would go stale after a package update.
+    const { syncCopyArtifacts } = await import('./sync-artifacts.mjs')
+    const { readState, writeState } = await import('./install/state.mjs')
+    const pkgVersion = readVersion(join(ROOT, 'package.json')) ?? 'unknown'
+    const synced = syncCopyArtifacts(configDir)
+    if (synced.errors.length > 0) {
+      for (const e of synced.errors) console.error(`  ⚠️  artifact sync: ${e}`)
+    }
+    console.log(`  Artifacts synced: ${synced.created} updated, ${synced.skipped} already current`)
+
+    // Version marker so doctor can detect a stale installation and point the
+    // user at `pantheon-opencode update` for the full refresh (config merge,
+    // venv, MCP entries).
+    try {
+      const previous = readState(configDir)
+      writeState(configDir, {
+        pantheon_version: pkgVersion,
+        previous_version: previous?.pantheon_version ?? null,
+      })
+      if (previous?.pantheon_version && previous.pantheon_version !== pkgVersion) {
+        console.log(
+          `  ⚠️  Installation moved ${previous.pantheon_version} → ${pkgVersion}. ` +
+            'Run `npx pantheon-opencode init` to refresh config/venv/MCP entries.',
+        )
+      }
+    } catch {
+      // Marker is best-effort — never fail the postinstall over it.
+    }
+  } catch (err) {
+    console.error(`❌ TUI sync failed: ${err.message}`)
+    process.exitCode = 1
   }
-} catch (err) {
-  // Postinstall scripts must never break npm install
-  console.warn(`⚠️  TUI sync skipped: ${err.message}`)
-  process.exit(0)
+}
+
+// Only run when invoked directly (`node scripts/sync-tui.mjs`). Importing this
+// module for unit tests must not trigger the side-effecting postinstall sync.
+const isDirectRun =
+  Boolean(process.argv[1]) && pathToFileURL(process.argv[1]).href === import.meta.url
+
+if (isDirectRun) {
+  main().catch((err) => {
+    console.error(`❌ TUI sync failed: ${err.message}`)
+    process.exitCode = 1
+  })
 }