pantheon-opencode 1.5.0-beta.1 → 1.5.0-beta.11

package/src/pantheon/provider-capabilities.ts

@@ -0,0 +1,221 @@
+/**
+ * Exact provider usage contract and the independent V1/V2 capability probes.
+ *
+ * This module deliberately does not inspect credentials, call a provider, read
+ * the TUI, calculate percentages, or derive token counts from text. A provider
+ * is supported only when it supplies the complete numeric contract below.
+ *
+ * @module provider-capabilities
+ */
+
+/** The only capability statuses exposed by the usage contract. */
+export const USAGE_STATUS = {
+  SUPPORTED: 'SUPPORTED',
+  UNSUPPORTED: 'UNSUPPORTED',
+} as const
+
+export type UsageStatus = (typeof USAGE_STATUS)[keyof typeof USAGE_STATUS]
+
+/** Exact token counters supplied by the provider. No totals are inferred. */
+export interface ExactProviderUsage {
+  inputTokens: number
+  outputTokens: number
+}
+
+/** Exact context limit supplied by the provider. */
+export interface ExactProviderLimit {
+  contextTokens: number
+}
+
+/**
+ * Minimum complete provider payload accepted by either capability probe.
+ * `resetAt`, when present, is an exact non-negative numeric provider value;
+ * date strings and other reset representations are unsupported.
+ */
+export interface ExactProviderUsageData {
+  sessionId: string
+  providerId: string
+  modelId: string
+  usage: ExactProviderUsage
+  limit: ExactProviderLimit
+  resetAt?: number
+}
+
+/** Stream event metadata required for de-duplication and freshness ordering. */
+export interface ProviderUsageEvent extends ExactProviderUsageData {
+  eventId: string
+  partId: string
+  /** Optional provider sequence. When supplied, it must be an integer. */
+  sequence?: number
+  /** Optional provider observation time in milliseconds or another numeric scale. */
+  observedAt?: number
+}
+
+/** A complete snapshot that has passed the exact contract validation. */
+export interface ProviderUsageSnapshot extends ProviderUsageEvent {}
+
+export type CapabilityProbeVersion = 'v1' | 'v2'
+
+export type CapabilityProbeReason =
+  | 'MISSING_SESSION_ID'
+  | 'MISSING_PROVIDER_ID'
+  | 'MISSING_MODEL_ID'
+  | 'MISSING_USAGE'
+  | 'MISSING_LIMIT'
+  | 'INVALID_USAGE'
+  | 'INVALID_LIMIT'
+  | 'INVALID_RESET'
+
+export type ProviderCapabilityResult =
+  | {
+      apiVersion: CapabilityProbeVersion
+      status: typeof USAGE_STATUS.SUPPORTED
+      data: ExactProviderUsageData
+    }
+  | {
+      apiVersion: CapabilityProbeVersion
+      status: typeof USAGE_STATUS.UNSUPPORTED
+      reason: CapabilityProbeReason
+    }
+
+type UnknownRecord = Record<string, unknown>
+
+function isRecord(value: unknown): value is UnknownRecord {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function isNonEmptyString(value: unknown): value is string {
+  return typeof value === 'string' && value.trim().length > 0
+}
+
+function isFiniteNonNegativeNumber(value: unknown): value is number {
+  return typeof value === 'number' && Number.isFinite(value) && value >= 0
+}
+
+function hasOnlyKeys(value: UnknownRecord, allowed: readonly string[]): boolean {
+  return Object.keys(value).every((key) => allowed.includes(key))
+}
+
+function unsupported(
+  apiVersion: CapabilityProbeVersion,
+  reason: CapabilityProbeReason,
+): ProviderCapabilityResult {
+  return { apiVersion, status: USAGE_STATUS.UNSUPPORTED, reason }
+}
+
+/**
+ * Validate the complete exact payload without coercion or estimation.
+ *
+ * This is intentionally shared only as a validator. V1 and V2 entry points
+ * below remain separate capability probes and do not fall back to one another.
+ */
+function probeExactData(
+  apiVersion: CapabilityProbeVersion,
+  input: unknown,
+): ProviderCapabilityResult {
+  if (!isRecord(input)) return unsupported(apiVersion, 'MISSING_SESSION_ID')
+
+  if (!isNonEmptyString(input.sessionId)) {
+    return unsupported(apiVersion, 'MISSING_SESSION_ID')
+  }
+  if (!isNonEmptyString(input.providerId)) {
+    return unsupported(apiVersion, 'MISSING_PROVIDER_ID')
+  }
+  if (!isNonEmptyString(input.modelId)) {
+    return unsupported(apiVersion, 'MISSING_MODEL_ID')
+  }
+  if (!isRecord(input.usage)) return unsupported(apiVersion, 'MISSING_USAGE')
+  if (!isRecord(input.limit)) return unsupported(apiVersion, 'MISSING_LIMIT')
+  if (!hasOnlyKeys(input.usage, ['inputTokens', 'outputTokens'])) {
+    return unsupported(apiVersion, 'INVALID_USAGE')
+  }
+  if (!hasOnlyKeys(input.limit, ['contextTokens'])) {
+    return unsupported(apiVersion, 'INVALID_LIMIT')
+  }
+
+  const usage = input.usage
+  if (!isFiniteNonNegativeNumber(usage.inputTokens)) {
+    return unsupported(apiVersion, 'INVALID_USAGE')
+  }
+  if (!isFiniteNonNegativeNumber(usage.outputTokens)) {
+    return unsupported(apiVersion, 'INVALID_USAGE')
+  }
+
+  const limit = input.limit
+  if (!isFiniteNonNegativeNumber(limit.contextTokens)) {
+    return unsupported(apiVersion, 'INVALID_LIMIT')
+  }
+
+  let resetAt: number | undefined
+  if ('reset' in input) return unsupported(apiVersion, 'INVALID_RESET')
+  if ('resetAt' in input) {
+    const value = input.resetAt
+    if (!isFiniteNonNegativeNumber(value)) return unsupported(apiVersion, 'INVALID_RESET')
+    resetAt = value
+  }
+
+  const data: ExactProviderUsageData = {
+    sessionId: input.sessionId,
+    providerId: input.providerId,
+    modelId: input.modelId,
+    usage: {
+      inputTokens: usage.inputTokens,
+      outputTokens: usage.outputTokens,
+    },
+    limit: { contextTokens: limit.contextTokens },
+  }
+  if (resetAt !== undefined) data.resetAt = resetAt
+
+  return { apiVersion, status: USAGE_STATUS.SUPPORTED, data }
+}
+
+/**
+ * Probe the V1 exact payload shape supplied by a caller.
+ *
+ * V1 does not inherit V2 capability, credentials, cache, or lifecycle data.
+ * The caller must pass the exact payload after its host-specific extraction.
+ */
+export function probeV1Capability(input: unknown): ProviderCapabilityResult {
+  return probeExactData('v1', input)
+}
+
+/**
+ * Probe the V2 exact payload shape supplied by a caller.
+ *
+ * V2 is intentionally independent from V1: no V1 event, retry, cache, or
+ * fallback value is consulted when the exact payload is absent.
+ */
+export function probeV2Capability(input: unknown): ProviderCapabilityResult {
+  return probeExactData('v2', input)
+}
+
+/** Validate one complete stream event using the same exact data contract. */
+export function validateProviderUsageEvent(input: unknown): ProviderUsageEvent | null {
+  if (!isRecord(input)) return null
+  if (!isNonEmptyString(input.eventId) || !isNonEmptyString(input.partId)) return null
+
+  const data = probeExactData('v1', input)
+  if (data.status !== USAGE_STATUS.SUPPORTED) return null
+
+  let sequence: number | undefined
+  if ('sequence' in input) {
+    const value = input.sequence
+    if (!isFiniteNonNegativeNumber(value) || !Number.isInteger(value)) return null
+    sequence = value
+  }
+  let observedAt: number | undefined
+  if ('observedAt' in input) {
+    const value = input.observedAt
+    if (!isFiniteNonNegativeNumber(value)) return null
+    observedAt = value
+  }
+
+  const event: ProviderUsageEvent = {
+    ...data.data,
+    eventId: input.eventId,
+    partId: input.partId,
+  }
+  if (sequence !== undefined) event.sequence = sequence
+  if (observedAt !== undefined) event.observedAt = observedAt
+  return event
+}

package/src/pantheon/provider-stream-tracker.ts

@@ -0,0 +1,182 @@
+/**
+ * Pure provider stream usage tracker.
+ *
+ * The tracker stores only complete exact provider snapshots. It has no timers,
+ * polling, persistence, TUI dependency, provider client, credential fallback,
+ * token/cost estimation, or compaction/FSM integration.
+ *
+ * @module provider-stream-tracker
+ */
+
+import {
+  type ProviderUsageEvent,
+  type ProviderUsageSnapshot,
+  USAGE_STATUS,
+  type UsageStatus,
+  validateProviderUsageEvent,
+} from './provider-capabilities.ts'
+
+export type TrackerUpdateReason = 'PUBLISHED' | 'DUPLICATE' | 'STALE' | 'OUT_OF_SCOPE' | 'INVALID'
+
+export interface ProviderStreamTrackerOptions {
+  /** Optional exact stream scope. Events from another stream are unsupported. */
+  sessionId?: string
+  providerId?: string
+  modelId?: string
+  /** Injectable sink called only after a complete snapshot is stored. */
+  onSnapshot?: (snapshot: ProviderUsageSnapshot) => void
+}
+
+export interface ProviderStreamTrackerResult {
+  status: UsageStatus
+  published: boolean
+  reason: TrackerUpdateReason
+  snapshot?: ProviderUsageSnapshot
+}
+
+export interface ProviderStreamTracker {
+  /** Ingest one raw event without coercion or heuristic recovery. */
+  ingest(input: unknown): ProviderStreamTrackerResult
+  /** Read one complete snapshot for an isolated session/provider/model stream. */
+  getSnapshot(
+    sessionId: string,
+    providerId: string,
+    modelId: string,
+  ): ProviderUsageSnapshot | undefined
+  /** Read all complete snapshots, each isolated by stream identity. */
+  snapshots(): ProviderUsageSnapshot[]
+  /** Remove all in-memory stream state. */
+  clear(): void
+}
+
+interface StreamState {
+  snapshot: ProviderUsageSnapshot
+  eventIds: Set<string>
+  partIds: Set<string>
+  orderKind?: 'sequence' | 'observedAt'
+  orderValue?: number
+}
+
+function streamKey(sessionId: string, providerId: string, modelId: string): string {
+  return JSON.stringify([sessionId, providerId, modelId])
+}
+
+function copySnapshot(snapshot: ProviderUsageSnapshot): ProviderUsageSnapshot {
+  const copy: ProviderUsageSnapshot = {
+    eventId: snapshot.eventId,
+    partId: snapshot.partId,
+    sessionId: snapshot.sessionId,
+    providerId: snapshot.providerId,
+    modelId: snapshot.modelId,
+    usage: { ...snapshot.usage },
+    limit: { ...snapshot.limit },
+  }
+  if (snapshot.resetAt !== undefined) copy.resetAt = snapshot.resetAt
+  if (snapshot.sequence !== undefined) copy.sequence = snapshot.sequence
+  if (snapshot.observedAt !== undefined) copy.observedAt = snapshot.observedAt
+  return copy
+}
+
+function result(
+  status: UsageStatus,
+  reason: TrackerUpdateReason,
+  snapshot?: ProviderUsageSnapshot,
+): ProviderStreamTrackerResult {
+  return snapshot === undefined
+    ? { status, published: false, reason }
+    : { status, published: true, reason, snapshot: copySnapshot(snapshot) }
+}
+
+function isInScope(event: ProviderUsageEvent, options: ProviderStreamTrackerOptions): boolean {
+  return (
+    (options.sessionId === undefined || options.sessionId === event.sessionId) &&
+    (options.providerId === undefined || options.providerId === event.providerId) &&
+    (options.modelId === undefined || options.modelId === event.modelId)
+  )
+}
+
+function isStale(event: ProviderUsageEvent, state: StreamState): boolean {
+  if (event.sequence !== undefined) {
+    if (state.orderKind === 'sequence' && state.orderValue !== undefined) {
+      return event.sequence <= state.orderValue
+    }
+    return false
+  }
+
+  if (event.observedAt !== undefined) {
+    if (state.orderKind === 'observedAt' && state.orderValue !== undefined) {
+      return event.observedAt <= state.orderValue
+    }
+    return state.orderKind === 'sequence'
+  }
+
+  return state.orderKind !== undefined
+}
+
+function updateOrder(event: ProviderUsageEvent, state: StreamState): void {
+  if (event.sequence !== undefined) {
+    state.orderKind = 'sequence'
+    state.orderValue = event.sequence
+  } else if (event.observedAt !== undefined) {
+    state.orderKind = 'observedAt'
+    state.orderValue = event.observedAt
+  }
+}
+
+/**
+ * Create an in-memory tracker. With no scope options, multiple streams are
+ * tracked independently by their session/provider/model identity.
+ */
+export function createProviderStreamTracker(
+  options: ProviderStreamTrackerOptions = {},
+): ProviderStreamTracker {
+  const streams = new Map<string, StreamState>()
+
+  return {
+    ingest(input: unknown): ProviderStreamTrackerResult {
+      const event = validateProviderUsageEvent(input)
+      if (event === null) return result(USAGE_STATUS.UNSUPPORTED, 'INVALID')
+      if (!isInScope(event, options)) return result(USAGE_STATUS.UNSUPPORTED, 'OUT_OF_SCOPE')
+
+      const key = streamKey(event.sessionId, event.providerId, event.modelId)
+      const state = streams.get(key)
+      if (state?.eventIds.has(event.eventId) || state?.partIds.has(event.partId)) {
+        return result(USAGE_STATUS.SUPPORTED, 'DUPLICATE')
+      }
+
+      if (state !== undefined && isStale(event, state)) {
+        state.eventIds.add(event.eventId)
+        state.partIds.add(event.partId)
+        return result(USAGE_STATUS.SUPPORTED, 'STALE')
+      }
+
+      const nextState: StreamState = state ?? {
+        snapshot: event,
+        eventIds: new Set<string>(),
+        partIds: new Set<string>(),
+      }
+      nextState.snapshot = event
+      nextState.eventIds.add(event.eventId)
+      nextState.partIds.add(event.partId)
+      updateOrder(event, nextState)
+      streams.set(key, nextState)
+
+      const snapshot = copySnapshot(event)
+      options.onSnapshot?.(snapshot)
+      return result(USAGE_STATUS.SUPPORTED, 'PUBLISHED', snapshot)
+    },
+
+    getSnapshot(sessionId: string, providerId: string, modelId: string) {
+      const state = streams.get(streamKey(sessionId, providerId, modelId))
+      return state === undefined ? undefined : copySnapshot(state.snapshot)
+    },
+
+    snapshots() {
+      return [...streams.values()].map((state) => copySnapshot(state.snapshot))
+    },
+
+    clear() {
+      streams.clear()
+    },
+  }
+}

package/src/pantheon/shared-board.ts

@@ -0,0 +1,37 @@
+/**
+ * Process-wide BackgroundJobBoard singleton shared by every Pantheon plugin
+ * surface (src/plugin.ts V1, src/plugins/pantheon-hooks.ts).
+ *
+ * WHY globalThis and not a module-level `const`: opencode loads each plugin
+ * TWICE from two different filesystem paths (the installed npm package AND
+ * the repo source — see src/pantheon/plugin-once.ts). Each load is a separate
+ * module instance, so a plain ESM singleton would yield TWO boards: the
+ * native-task mirror in pantheon-hooks would register jobs on one instance
+ * while the finalize path (session.idle + idle scan in plugin.ts) listens on
+ * the other, and the job would never finalize. A globalThis-anchored value is
+ * process-global by construction, deduping both module copies.
+ *
+ * The persistence file and signal dir are RELATIVE paths — the board operates
+ * against the opencode project root (the cwd of the plugin process), matching
+ * the pre-existing plugin.ts wiring exactly.
+ */
+import { BackgroundJobBoard } from './background-job-board.ts'
+import { FilePersistenceAdapter } from './file-persistence.ts'
+
+const BOARD_KEY = '__pantheonSharedBoard'
+
+/** Construction inputs mirror the original plugin.ts module-scope board. */
+const BOARD_OPTIONS = {
+  maxConcurrentPerAgent: 3,
+  signalDir: '.pantheon/deepwork/board-signals',
+} as const
+
+export function getSharedBoard(): BackgroundJobBoard {
+  const host = globalThis as { [BOARD_KEY]?: BackgroundJobBoard }
+  const existing = host[BOARD_KEY]
+  if (existing instanceof BackgroundJobBoard) return existing
+  const board = new BackgroundJobBoard(BOARD_OPTIONS)
+  board.setPersistence(new FilePersistenceAdapter('.pantheon/board/state.json'))
+  host[BOARD_KEY] = board
+  return board
+}

package/src/pantheon/task-result-guard.ts

@@ -0,0 +1,107 @@
+/**
+ * Task Result Guard — detects empty task() results from native opencode
+ * subagent calls and converts them to explicit errors.
+ *
+ * Bug context (reproduced 2026-09-10): task() native creates a child session
+ * that inherits the parent transcript. When the payload exceeds the provider's
+ * admission limit (e.g. free-tier max_outstanding_uncached_prefill_tokens=1000
+ * vs 57k incoming tokens), the stream errors with BackendAdmissionRejected.
+ * The error is NOT propagated — the child loop exits normally, the child
+ * session goes idle with zero assistant/tool output, and opencode marks the
+ * task as `completed` with empty content. The parent LLM receives an empty
+ * result and proceeds as if the task succeeded.
+ *
+ * The guard intercepts this in the `tool.execute.after` hook: when the tool
+ * is `task` and the output is empty/whitespace-only, it replaces the output
+ * with an explicit error message so the parent sees a failure, not silence.
+ *
+ * Pure TypeScript — zero runtime dependencies. Meant to be wired into the
+ * `combinedAfter` hook chain in plugin.ts alongside the sandbox and read
+ * enhancer handlers.
+ *
+ * @module task-result-guard
+ */
+
+import { createPantheonLogger } from './logger.ts'
+
+const log = createPantheonLogger({ module: 'pantheon-task-result-guard' })
+
+// ─── Types ─────────────────────────────────────────────────────────────
+
+/** Input shape of the opencode `tool.execute.after` hook. */
+export interface TaskGuardInput {
+  tool: string
+  sessionID: string
+  callID: string
+  args: unknown
+}
+
+/** Output shape of the opencode `tool.execute.after` hook (mutable). */
+export interface TaskGuardOutput {
+  title?: string
+  output: string
+  metadata?: Record<string, unknown>
+}
+
+/** The `tool.execute.after` handler shape. */
+export type TaskResultGuardHandler = (
+  input: TaskGuardInput,
+  output: TaskGuardOutput,
+) => Promise<void>
+
+export interface TaskResultGuardOptions {
+  /** Injectable logger (defaults to the Pantheon file log). */
+  logger?: { warn: (message: string) => void }
+}
+
+// ─── Constants ─────────────────────────────────────────────────────────
+
+/**
+ * The error message injected when a task() result is empty.
+ * Matches the existing delegation-finalize.ts contract:
+ * "Child session produced no assistant or tool output".
+ */
+export const EMPTY_TASK_ERROR =
+  'ERROR: task() returned empty output — child session produced no assistant or tool output. ' +
+  'This typically means the provider rejected the request (admission control / rate limit) ' +
+  'or the child session crashed before producing any response. ' +
+  'Consider using pantheon_delegate (clean context) instead of task() for large payloads.'
+
+// ─── Implementation ────────────────────────────────────────────────────
+
+/**
+ * Whether a result carries any text content (whitespace-only counts as empty).
+ */
+function isEmptyOutput(output: unknown): boolean {
+  if (output == null) return true
+  if (typeof output !== 'string') return true
+  return output.trim() === ''
+}
+
+/**
+ * Create a task result guard handler for the `tool.execute.after` hook.
+ *
+ * When the tool is `task` and the output is empty/whitespace-only, replaces
+ * the output with an explicit error message. All other tools pass through
+ * untouched.
+ *
+ * @returns A `ToolExecuteAfterHandler`-compatible async function.
+ */
+export function createTaskResultGuard(options?: TaskResultGuardOptions): TaskResultGuardHandler {
+  const warn = options?.logger?.warn ?? ((message: string) => log.warn(message))
+
+  return async (input: TaskGuardInput, output: TaskGuardOutput): Promise<void> => {
+    // Only intercept the `task` tool — all others pass through untouched.
+    if (input.tool !== 'task') return
+
+    // Only flag truly empty results — non-empty content is the happy path.
+    if (!isEmptyOutput(output.output)) return
+
+    warn(
+      `[task-result-guard] Empty task() result detected on session ${input.sessionID} ` +
+        `(callID=${input.callID}). Replacing with explicit error.`,
+    )
+
+    output.output = EMPTY_TASK_ERROR
+  }
+}