pantheon-opencode 1.5.0-beta.2 → 1.5.0-beta.4

package/src/pantheon/token-opt.ts

@@ -35,6 +35,13 @@
 
 import type { ToonValue } from './toon-codec.ts'
 
+export {
+  type HostToolCeilingSource,
+  probeToolCeiling,
+  type ToolCeilingResult,
+  type ToolCeilingSnapshot,
+} from './tool-ceiling.ts'
+
 // ─── Deterministic token estimator (WS0 extension, tokens-only) ──────────
 
 /** Nominal chars-per-token ratio (fixed so measurements are comparable). */
@@ -220,17 +227,10 @@ export interface C9FilterResult {
   /**
    * Quality-floor signal (never silent on empty):
    * - `ok` — at least one chunk selected;
-   * - `empty-input` — no chunks retrieved at all (fallback: proceed without
-   *   injected context, caller should log `notice`);
-   * - `all-dropped` — chunks existed but none survived cutoff/top-k and no
-   *   lexical query fallback was available;
-   * - `fallback-relative` — the absolute cutoff rejected every chunk, but a
-   *   query-matching lexical/relative ranking selected auditable low-score
-   *   chunks;
-   * - `nonsense` — a supplied query had no lexical overlap, so nothing is
-   *   injected.
+   * - `empty-input` — no chunks retrieved at all;
+   * - `all-dropped` — chunks existed but none survived cutoff/top-k.
    */
-  signal: 'ok' | 'empty-input' | 'all-dropped' | 'fallback-relative' | 'nonsense'
+  signal: 'ok' | 'empty-input' | 'all-dropped'
   /** Human-readable alert for the non-`ok` signals (null when `ok`). */
   notice: string | null
   /**
@@ -245,13 +245,13 @@ export interface C9FilterResult {
 
 /**
  * Filter scored chunks per category: drop below cutoff, keep top-k by
- * score desc. An optional query enables only the explicit low-score fallback.
+ * score desc. Scores must come from retrieval; text is never used as a proxy.
  * The injected context cost is debited (`injectedTokens`).
  */
 export function c9Filter(
   chunks: readonly C9Chunk[],
   perCategoryOrOptions?: Readonly<Record<string, C9CategoryConfig>> | C9FilterOptions | string,
-  query?: string,
+  _query?: string,
 ): C9FilterResult {
   const isOptions = isC9FilterOptions(perCategoryOrOptions)
   const perCategory =
@@ -260,12 +260,6 @@ export function c9Filter(
       : isOptions
         ? perCategoryOrOptions.perCategory
         : perCategoryOrOptions
-  const filterQuery =
-    typeof perCategoryOrOptions === 'string'
-      ? (query ?? perCategoryOrOptions)
-      : isOptions
-        ? (query ?? perCategoryOrOptions.query)
-        : query
   const byCategory = new Map<string, C9Chunk[]>()
   for (const chunk of chunks) {
     const group = byCategory.get(chunk.category)
@@ -288,41 +282,15 @@ export function c9Filter(
     dropped.push(...group.filter((c) => c.score < cutoff))
     dropped.push(...eligible.slice(topK))
   }
-  let signal: C9FilterResult['signal'] =
+  const signal: C9FilterResult['signal'] =
     chunks.length === 0 ? 'empty-input' : selected.length === 0 ? 'all-dropped' : 'ok'
-  let notice =
+  const notice =
     signal === 'empty-input'
-      ? 'C9: empty input — no chunks retrieved; fallback: proceed without injected context'
+      ? 'C9: empty input — no chunks retrieved; proceed without injected context'
       : signal === 'all-dropped'
-        ? 'C9: all chunks dropped by cutoff/top-k; fallback: relax cutoff/top-k or proceed without context'
+        ? 'C9: all chunks dropped by cutoff/top-k; no context was injected'
         : null
 
-  // Keep the absolute cutoff intact. This fallback is deliberately entered
-  // only after it rejects every chunk, and only lexical overlap can authorize
-  // injecting one of those low-score chunks.
-  if (chunks.length > 0 && selected.length === 0 && filterQuery !== undefined) {
-    const queryTerms = lexicalTerms(filterQuery)
-    const fallbackSelected =
-      queryTerms.length > 0 ? relativeLexicalSelection(byCategory, perCategory, queryTerms) : []
-    if (fallbackSelected.length > 0) {
-      selected.push(...fallbackSelected)
-      signal = 'fallback-relative'
-      notice =
-        `C9: absolute cutoff ${C9_DEFAULT_CUTOFF} yielded no eligible chunks; ` +
-        `lexical/relative fallback selected ${fallbackSelected.length} auditable ` +
-        `low-score chunk(s) (${queryTerms.length} query term(s)); selected scores remain below cutoff`
-    } else if (filterQuery.trim().length > 0) {
-      signal = 'nonsense'
-      notice =
-        'C9: query has no lexical overlap with low-score chunks; fallback returned zero and no context was injected'
-    }
-  }
-
-  if (selected.length > 0 && signal === 'fallback-relative') {
-    const selectedSet = new Set(selected)
-    dropped.length = 0
-    dropped.push(...chunks.filter((chunk) => !selectedSet.has(chunk)))
-  }
   const context = buildC9Context(selected)
   return {
     selected,
@@ -384,15 +352,6 @@ function telemetry(
   }
 }
 
-function hasLexicalOverlap(query: string, chunks: readonly C9Chunk[]): boolean {
-  const queryTerms = lexicalTerms(query)
-  if (queryTerms.length === 0) return false
-  return chunks.some((chunk) => {
-    const chunkTerms = new Set(lexicalTerms(chunk.text))
-    return queryTerms.some((term) => chunkTerms.has(term))
-  })
-}
-
 /**
  * Prepare auditable context without performing retrieval or side effects.
  *
@@ -429,13 +388,8 @@ export function prepareC9Context(
     }
   }
 
-  const context =
-    filtered.signal === 'nonsense' ||
-    (filtered.signal === 'ok' && !hasLexicalOverlap(batch.query, filtered.selected))
-      ? ''
-      : buildC9Context(filtered.selected)
-  const signal =
-    context.length === 0 && filtered.signal === 'ok' ? ('nonsense' as const) : filtered.signal
+  const context = buildC9Context(filtered.selected)
+  const signal = filtered.signal
   const selectedCount = context.length === 0 ? 0 : filtered.selected.length
   const droppedCount = context.length === 0 ? candidateCount : filtered.dropped.length
   const recall = context.length === 0 && filtered.signal === 'ok' ? 0 : filtered.recall
@@ -446,52 +400,6 @@ export function prepareC9Context(
   }
 }
 
-/** Normalize query/text terms without introducing a semantic or runtime dependency. */
-function lexicalTerms(value: string): string[] {
-  return [
-    ...new Set(
-      value
-        .normalize('NFKD')
-        .replace(/\p{M}/gu, '')
-        .toLowerCase()
-        .match(/[\p{L}\p{N}]+/gu)
-        ?.filter((term) => term.length > 1) ?? [],
-    ),
-  ]
-}
-
-/** Select only query-matching low-score chunks, ranked lexically then relatively. */
-function relativeLexicalSelection(
-  byCategory: Map<string, C9Chunk[]>,
-  perCategory: Readonly<Record<string, C9CategoryConfig>> | undefined,
-  queryTerms: string[],
-): C9Chunk[] {
-  const selected: C9Chunk[] = []
-  for (const [category, group] of byCategory) {
-    const config = perCategory?.[category]
-    const topK = config?.topK ?? C9_DEFAULT_TOP_K
-    const maxScore = Math.max(...group.map((chunk) => chunk.score), 0)
-    const ranked = group
-      .map((chunk, index) => {
-        const textSet = new Set(lexicalTerms(chunk.text))
-        const overlap = queryTerms.filter((term) => textSet.has(term)).length
-        const lexicalScore = overlap / queryTerms.length
-        const relativeScore = maxScore > 0 ? chunk.score / maxScore : 0
-        return { chunk, index, lexicalScore, relativeScore }
-      })
-      .filter((entry) => entry.lexicalScore > 0)
-      .sort(
-        (left, right) =>
-          right.lexicalScore - left.lexicalScore ||
-          right.relativeScore - left.relativeScore ||
-          right.chunk.score - left.chunk.score ||
-          left.index - right.index,
-      )
-    selected.push(...ranked.slice(0, topK).map((entry) => entry.chunk))
-  }
-  return selected
-}
-
 function isC9FilterOptions(
   value: Readonly<Record<string, C9CategoryConfig>> | C9FilterOptions | string | undefined,
 ): value is C9FilterOptions {

package/src/pantheon/tool-ceiling.ts

@@ -0,0 +1,159 @@
+/** Host-real context ceiling probe for C9/tool filtering. */
+
+import type { PluginInput } from '@opencode-ai/plugin'
+import { createPantheonLogger, type PantheonLogger } from './logger.ts'
+import type { NativeTaskStatus } from './native-task-status.ts'
+
+export interface ToolCeilingSnapshot {
+  usage: { inputTokens: number; outputTokens: number }
+  limit: { contextTokens: number }
+  supportsToolFiltering: boolean
+}
+
+export type ToolCeilingResult =
+  | {
+      status: 'OK'
+      ceiling: number
+      usage: ToolCeilingSnapshot['usage']
+      limit: ToolCeilingSnapshot['limit']
+    }
+  | { status: Exclude<NativeTaskStatus, 'OK'>; detail: string }
+
+export type HostToolCeilingSource = () => unknown | Promise<unknown>
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function isFiniteNonNegative(value: unknown): value is number {
+  return typeof value === 'number' && Number.isFinite(value) && value >= 0
+}
+
+function isSnapshot(value: unknown): value is ToolCeilingSnapshot {
+  if (!isRecord(value) || !isRecord(value.usage) || !isRecord(value.limit)) return false
+  return (
+    isFiniteNonNegative(value.usage.inputTokens) &&
+    isFiniteNonNegative(value.usage.outputTokens) &&
+    isFiniteNonNegative(value.limit.contextTokens) &&
+    typeof value.supportsToolFiltering === 'boolean'
+  )
+}
+
+/** Probe exact host usage/limit without estimation, fallback, or retry. */
+export async function probeToolCeiling(source?: HostToolCeilingSource): Promise<ToolCeilingResult> {
+  if (source === undefined)
+    return { status: 'UNSUPPORTED', detail: 'host SDK exposes no context probe' }
+
+  let raw: unknown
+  try {
+    raw = await source()
+  } catch (error: unknown) {
+    return { status: 'UNAVAILABLE', detail: error instanceof Error ? error.message : String(error) }
+  }
+  if (!isSnapshot(raw))
+    return { status: 'CORRUPT_DATA', detail: 'host context probe returned malformed data' }
+  if (raw.supportsToolFiltering === false) {
+    return { status: 'UNSUPPORTED', detail: 'host SDK does not filter tools' }
+  }
+  const used = raw.usage.inputTokens + raw.usage.outputTokens
+  if (used > raw.limit.contextTokens) {
+    return { status: 'CORRUPT_DATA', detail: 'host usage exceeds context limit' }
+  }
+  return {
+    status: 'OK',
+    ceiling: raw.limit.contextTokens - used,
+    usage: raw.usage,
+    limit: raw.limit,
+  }
+}
+
+/**
+ * Read a ceiling from the actual OpenCode SDK event and provider catalogue.
+ *
+ * `message.updated` is the SDK's runtime usage source (`info.tokens`). The
+ * provider catalogue supplies the selected model's context limit and its
+ * `capabilities.toolcall` flag. This adapter intentionally does not accept a
+ * caller-provided snapshot/callback, so tests cannot accidentally turn a
+ * fixture into a claimed host probe.
+ */
+export async function probeToolCeilingFromHost(
+  client: PluginInput['client'],
+  event: unknown,
+): Promise<ToolCeilingResult> {
+  if (!isRecord(event) || event.type !== 'message.updated' || !isRecord(event.properties)) {
+    return { status: 'UNSUPPORTED', detail: 'host SDK event has no message usage' }
+  }
+  const info = event.properties.info
+  if (
+    !isRecord(info) ||
+    typeof info.providerID !== 'string' ||
+    typeof info.modelID !== 'string' ||
+    !isRecord(info.tokens)
+  ) {
+    return { status: 'UNSUPPORTED', detail: 'host SDK message has no token usage' }
+  }
+  const providerID = info.providerID as string
+  const modelID = info.modelID as string
+  const tokens = info.tokens as Record<string, unknown>
+
+  let providersResult: unknown
+  try {
+    providersResult = await client.config.providers()
+  } catch (error: unknown) {
+    return { status: 'UNAVAILABLE', detail: error instanceof Error ? error.message : String(error) }
+  }
+  if (!isRecord(providersResult) || providersResult.error !== undefined) {
+    return { status: 'UNAVAILABLE', detail: 'host SDK provider catalogue unavailable' }
+  }
+  const data = providersResult.data
+  if (!isRecord(data) || !Array.isArray(data.providers)) {
+    return { status: 'CORRUPT_DATA', detail: 'host SDK provider catalogue malformed' }
+  }
+
+  const provider = data.providers.find(
+    (candidate) =>
+      isRecord(candidate) &&
+      candidate.id === providerID &&
+      isRecord(candidate.models) &&
+      isRecord(candidate.models[modelID]),
+  )
+  if (!isRecord(provider) || !isRecord(provider.models)) {
+    return { status: 'UNSUPPORTED', detail: 'host SDK model metadata unavailable' }
+  }
+  const model = provider.models[modelID]
+  if (!isRecord(model) || !isRecord(model.limit) || !isRecord(model.capabilities)) {
+    return { status: 'UNSUPPORTED', detail: 'host SDK model ceiling capability unavailable' }
+  }
+
+  return probeToolCeiling(() => ({
+    usage: { inputTokens: tokens.input, outputTokens: tokens.output },
+    limit: { contextTokens: (model.limit as Record<string, unknown>).context },
+    supportsToolFiltering: (model.capabilities as Record<string, unknown>).toolcall,
+  }))
+}
+
+const log = createPantheonLogger({ module: 'pantheon-tool-ceiling' })
+
+/**
+ * Handle the host usage event and retain the result for the compaction hook.
+ * Malformed SDK events are diagnostic-only: they must never break the event
+ * pipeline or create an entry under an invalid session identifier.
+ */
+export async function handleToolCeilingEvent(
+  client: PluginInput['client'],
+  event: unknown,
+  ceilings: Map<string, ToolCeilingResult>,
+  logger: Pick<PantheonLogger, 'warn'> = log,
+): Promise<ToolCeilingResult> {
+  const sessionID = (
+    event as { properties?: { info?: { sessionID?: unknown } } } | null | undefined
+  )?.properties?.info?.sessionID
+  if (typeof sessionID !== 'string' || sessionID.trim() === '') {
+    logger.warn('[Pantheon Plugin] message.updated event has no valid sessionID')
+    return { status: 'UNSUPPORTED', detail: 'host SDK event has no valid sessionID' }
+  }
+
+  const result = await probeToolCeilingFromHost(client, event)
+  ceilings.set(sessionID, result)
+  return result
+}

package/src/pantheon/v2-events.ts

@@ -94,13 +94,22 @@ export function createV2EventDispatcher(deps: V2EventDeps): V2EventDispatcher {
   return {
     handleEvent: async (event: V2SessionEvent): Promise<boolean> => {
       try {
-        // session.created → seed hierarchy
+        // session.created → seed hierarchy + board put-if-absent for native children
         if (event.type === 'session.created') {
           const info = event.properties?.info as SessionInfo | undefined
           if (info) {
             deps.registerSession?.(info)
             if (info.parentID === undefined) {
               deps.addRootSession?.(info.id)
+            } else {
+              // Native task(background=true) child: register on the board
+              // atomically (skip if V1 idle hook or re-dispatch already claimed it).
+              await deps.board.registerLaunchIfAbsent({
+                taskID: info.id,
+                parentSessionID: info.parentID,
+                agent: 'native',
+                description: `native child ${info.id}`,
+              })
             }
           }
         }

package/src/plugin.ts

@@ -46,6 +46,7 @@ import {
 } from './pantheon/presets.mjs'
 import { safeSessionPath } from './pantheon/session-guard.ts'
 import { StepCapTracker } from './pantheon/step-cap.ts'
+import { createTaskResultGuard } from './pantheon/task-result-guard.ts'
 import {
   TODO_ENFORCER_DEFAULTS,
   TodoEnforcer,
@@ -53,6 +54,7 @@ import {
   todoEnforcerEnabledFromEnv,
 } from './pantheon/todo-enforcer.ts'
 import { TodoPreserver } from './pantheon/todo-preserve.ts'
+import { handleToolCeilingEvent, type ToolCeilingResult } from './pantheon/tool-ceiling.ts'
 import { checkTuiVersionStaleness } from './pantheon/tui-version-check.ts'
 import { activePresetCandidates, createVisionHandler } from './pantheon/vision.ts'
 
@@ -165,6 +167,7 @@ const COMPACTION_MAX_ITEMS = 10
 const rootSessions = new Set<string>()
 const sessionHierarchy = new SessionHierarchyRegistry()
 const sessionAgents = new Map<string, string>()
+const sessionToolCeilings = new Map<string, ToolCeilingResult>()
 
 /**
  * Seed resumed root sessions without making OpenCode startup depend on the
@@ -504,13 +507,18 @@ const plugin: Plugin = async (input: PluginInput) => {
     },
   }
   const sandboxHandler = createContextSandbox(sandboxConfig)
+  // Task Result Guard (2026-09-10): detect empty task() results from native
+  // opencode subagent calls and convert to explicit errors. Runs FIRST in the
+  // chain so the error message is visible even if later handlers skip.
+  const taskResultGuard = createTaskResultGuard()
   const combinedAfter: typeof readEnhancer = async (input, output) => {
+    await taskResultGuard(input, output)
     await sandboxHandler(input, output)
     await readEnhancer(input, output)
   }
 
   // Wave 4 (PR #46): /cost — delegation cost + token visibility. Reads
-  // opencode.db read-only (node:sqlite, falls back to scripts/cost.mjs).
+  // opencode.db read-only via the single node:sqlite backend.
   // Fully wired (unlike dispatch-guard, which is manual-orchestration-only
   // because opencode 1.18.x cannot intercept task completion via hooks).
   const costCommand = createCostCommand()
@@ -615,6 +623,9 @@ const plugin: Plugin = async (input: PluginInput) => {
       if (ev.type === 'session.compacted') {
         await todoPreserver.onCompacted(ev.properties.sessionID)
       }
+      if (ev.type === 'message.updated') {
+        await handleToolCeilingEvent(input.client, ev, sessionToolCeilings)
+      }
       // Phase 3: observe completion on child sessions → finalizeDelegation.
       // The board transition fires onTerminal → the file-only audit log (no
       // chat delivery — see the onTerminal listener above). Unknown sessions
@@ -680,6 +691,13 @@ const plugin: Plugin = async (input: PluginInput) => {
             list: (sessionID: string) => todoEnforcer.listPendingTodos(sessionID),
           },
         })
+        const ceiling = sessionToolCeilings.get(_input.sessionID)
+        if (ceiling?.status === 'OK') {
+          output.context.push(
+            `<tool_ceiling remaining_context_tokens="${ceiling.ceiling}">` +
+              'Use the remaining host-reported context budget when selecting tools.</tool_ceiling>',
+          )
+        }
         if (blocks.length > 0) {
           output.context.push(...blocks)
         }

package/src/plugins/tui/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pantheon-tui",
-  "version": "1.5.0",
+  "version": "1.5.0-beta.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pantheon-tui",
-      "version": "1.5.0",
+      "version": "1.5.0-beta.4",
       "license": "MIT",
       "dependencies": {
         "@opencode-ai/plugin": ">=1.14.0",

package/src/plugins/tui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pantheon-tui",
   "type": "module",
-  "version": "1.5.0",
+  "version": "1.5.0-beta.4",
   "description": "Pantheon TUI plugin — sidebar (version, preset, sessions, real-time delegations) + AI subscription usage gauges incl. OpenCode Go/Zen dollar limits (vendored, MIT)",
   "license": "MIT",
   "exports": {