pantheon-opencode 1.5.0-beta.6 → 1.5.0-beta.7

package/CHANGELOG.md

@@ -18,6 +18,51 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## ✅ Closed Issues
 
+## [v1.5.0-beta.7] - 2026-09-13
+
+<!-- Add new changes here. Running `node scripts/versioning.mjs apply` will
+     move this section to a versioned entry and reset the template below. -->
+
+## 🆕 What's New
+
+- **Cost CLI fallback + `PANTHEON_NODE`:** `pantheon_cost` falls back to a
+  read-only `node scripts/cost.mjs` subprocess when `node:sqlite` is
+  unavailable in the host runtime (for example under Bun). The fallback
+  resolves a real Node.js binary — `PANTHEON_NODE` first, then `node` on
+  `PATH` — probes it for `node:sqlite` support (Node.js >= 22.5), and runs it
+  with an argument array, never a shell. Previously the tool returned
+  `status: UNSUPPORTED` with no fallback.
+- **Delegation engine contract (ADR-0011):** legacy `pantheon_delegate` remains
+  the default engine through v1.5.x; native delegation is opt-in and
+  experimental via `PANTHEON_DELEGATE_MODE=native` until v1.6. See
+  [ADR-0011](https://github.com/ils15/pantheon-opencode/pull/126) (Proposed).
+
+## 🐞 Fixed
+
+- **Legacy read-only bypass on retry (P0):** a retried delegation now
+  re-applies read-only enforcement (the same rule as the initial child) and
+  registers the retry session, closing the bypass where a retried child could
+  write despite `read_only: true` or being a read-only agent.
+- **Kill-switch scope (P0):** `PANTHEON_DELEGATION=off` now also disables the
+  legacy engine, not only the native manager — the legacy delegate/read/list
+  tools throw as documented.
+- **Delegation signal leak (P1):** the legacy finalize path now deletes the
+  auto-wake signal file, so terminal delegations no longer leave stale
+  `.signal.json` artifacts behind.
+- **Crash recovery is durable (P1):** `recoverRunningJobs` persists the
+  `error` state, marks the job `terminalUnreconciled`, and emits the terminal
+  signal plus notification for every reaped job instead of updating memory
+  only.
+- **Atomic concurrency (P1):** `registerLaunch` validates
+  `maxConcurrentPerAgent` before any mutation, so concurrent dispatches cannot
+  both claim the last slot. A refused launch tears down the orphan child
+  session (read-only unregister plus `session.delete`) and the retry path
+  re-validates the same limit.
+- **Legacy board hygiene (P1):** the legacy finalize path now runs
+  `pruneCompleted` and `enforceEntryCap`, matching the native manager and
+  preventing unbounded board growth.
+- **Resilient V2 events:** a native child refused by the per-agent limit is
+  logged and skipped instead of aborting the rest of the event handler.
 ## [v1.5.0-beta.6] - 2026-09-12
 
 <!-- Add new changes here. Running `node scripts/versioning.mjs apply` will

package/README.md

@@ -76,22 +76,43 @@ availability and configuration of OpenCode and any optional services you choose
 to use. Check the [releases](https://github.com/ils15/pantheon-opencode/releases)
 and [changelog](CHANGELOG.md) for the latest published changes.
 
-## Native delegation mode
+## Delegation engines (legacy default, native opt-in)
 
-Set `PANTHEON_DELEGATE_MODE=native` to use OpenCode's native child-session
-delegation. Native mode is strict: it does not use foreground fallback, model
-failover, or retry; it performs a lazy capability probe on the first dispatch,
-and includes the resulting status in the delegation receipt.
+Pantheon exposes two delegation engines behind one tool surface:
+
+- **Legacy (default)** — `pantheon_delegate`, the original engine registered by
+  the V1 plugin. No configuration is required.
+- **Native (opt-in, experimental)** — OpenCode's native `task()` child-session
+  engine, selected with `PANTHEON_DELEGATE_MODE=native`. Native is strict: it
+  does not use foreground fallback, model failover, or retry; it performs a
+  lazy capability probe on the first dispatch and includes the resulting
+  status in the delegation receipt.
+
+Legacy stays the default for v1.5.x; native is not promoted to default until
+v1.6. See [ADR-0011](.pantheon/memory-bank/adr/0011-delegation-engine-contract.md)
+(Proposed) for the engine contract, rationale, and migration prerequisites.
+
+**Kill-switch:** set `PANTHEON_DELEGATION=off` (case-insensitive) to disable
+delegation entirely. The switch covers **both** engines — the legacy
+`pantheon_delegate`/read/list tools throw, and the native manager throws too.
 
 ## Cost tool backend
 
-`pantheon_cost` has one backend: read-only `node:sqlite` against the selected
-`opencode.db`. On Node versions without `node:sqlite` (Node < 22.5), the tool
-returns `status: UNSUPPORTED`; it has no CLI fallback. Database failures return
-a contract status such as `UNAVAILABLE` or
-`CORRUPT_DATA` and include diagnostic detail, including captured stderr when
+`pantheon_cost` prefers a read-only `node:sqlite` backend against the selected
+`opencode.db`. When `node:sqlite` is unavailable in the host runtime (for
+example under Bun), the tool falls back to spawning `node scripts/cost.mjs` as
+a read-only subprocess. The fallback resolves a real Node.js binary —
+`PANTHEON_NODE` first, then `node` on `PATH` — verifies it supports
+`node:sqlite` (Node.js >= 22.5), and runs the script with an argument array,
+never a shell. If neither source resolves, the tool returns `status:
+UNSUPPORTED`. Database failures return a contract status such as `UNAVAILABLE`
+or `CORRUPT_DATA` and include diagnostic detail, including captured stderr when
 available.
 
+| Variable | Default | Purpose |
+|----------|---------|---------|
+| `PANTHEON_NODE` | `node` from `PATH` | Path to a Node.js >= 22.5 binary used by the CLI fallback; an explicit path must exist and be executable, otherwise the tool fails fast instead of ignoring the override |
+
 
 ## Code-mode execution (explicit opt-in)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pantheon-opencode",
-  "version": "1.5.0-beta.6",
+  "version": "1.5.0-beta.7",
   "description": "Multi-agent orchestration for OpenCode — 14 specialized agents, TDD, Themis review gates.",
   "type": "module",
   "publishConfig": {
@@ -41,8 +41,9 @@
     "test:security": "npm run secret-scan",
     "test:node": "node --test tests/*.mjs tests/pantheon/*.mjs",
     "test:ts": "for f in tests/pantheon/*.test.ts; do if [ \"$f\" = tests/pantheon/plugin-v2-contract.test.ts ]; then NODE_OPTIONS=--conditions=import tsx \"$f\"; else tsx \"$f\"; fi || exit 1; done",
-    "test": "python3 -m pytest tests/ -q 2>&1; status=$?; if [ \"$status\" -eq 5 ]; then echo \"No tests found\"; fi; exit \"$status\"",
-    "test:ci": "python3 -m pytest tests/ -q --tb=short 2>&1"
+    "test:all": "npm run test:ci && npm run test:node && npm run test:ts",
+    "test": "npm run test:all",
+    "test:ci": "python3 -m pytest -q --tb=short 2>&1"
   },
   "bin": {
     "pantheon-opencode": "bin/pantheon-init.mjs"

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pantheon",
   "publisher": "ils15",
-  "version": "1.5.0-beta.6",
+  "version": "1.5.0-beta.7",
   "displayName": "Pantheon",
   "description": "Conductor-Delegate orchestration platform with 14 specialized agents, 21 skills, and OpenCode support.",
   "agents": "./src/agents",

package/pyproject.toml

@@ -4,13 +4,21 @@ build-backend = "setuptools.backends._legacy:_Backend"
 
 [project]
 name = "pantheon"
-version = "1.5.0-beta.6"
+version = "1.5.0-beta.7"
 description = "Multi-agent orchestration framework"
 requires-python = ">=3.11"
 dependencies = []
 
 [tool.pytest.ini_options]
-testpaths = ["tests"]
+# `tests/` holds the main suite; the two entries below are orphaned test
+# modules that live next to the code they cover and are collected here so
+# pytest (and therefore `npm test`) exercises them instead of letting them
+# rot as dead code.
+testpaths = [
+    "tests",
+    "scripts/vector_memory/test_memory.py",
+    "benchmarks/beta2/test_beta2.py",
+]
 asyncio_mode = "auto"
 addopts = "-v --tb=short"
 

package/scripts/mcp_persistence_server.py

@@ -777,13 +777,32 @@ def _validate_heartbeat(heartbeat: object) -> None:
         raise ValueError("heartbeat.turn_count must be a non-negative integer")
 
 
+def _validate_version_metadata(version: object) -> None:
+    """Validate optional checkpoint ``version`` metadata leniently.
+
+    ``version`` is opaque application metadata (rehydrate does not consume it),
+    not a persistence requirement. It may be a positive integer, a JSON float
+    such as ``1.0``, or a version label like ``"1.5.0-beta.2"``. Absent/null
+    versions and any non-empty string remain valid, preserving existing integer
+    checkpoints while allowing forward-compatible labels. Only bools, empty
+    strings, non-finite/zero/negative numbers, and structured values are
+    rejected.
+    """
+    if version is None:
+        return
+    if isinstance(version, bool):
+        raise ValueError("version must be a positive integer or version label")
+    if isinstance(version, (int, float)):
+        if not 1 <= version < float("inf"):
+            raise ValueError("version must be a positive integer or version label")
+        return
+    if not isinstance(version, str) or not version.strip():
+        raise ValueError("version must be a positive integer or version label")
+
+
 def _validate_checkpoint_shape(checkpoint: dict) -> None:
     """Validate bounded structured checkpoint fields without sanitizing them."""
-    version = checkpoint.get("version")
-    if version is not None and (
-        isinstance(version, bool) or not isinstance(version, int) or version < 1
-    ):
-        raise ValueError("version must be a positive integer")
+    _validate_version_metadata(checkpoint.get("version"))
     validators = (
         ("goal", _validate_goal),
         ("phase", _validate_phase),

package/scripts/versioning.mjs

@@ -21,8 +21,8 @@
  */
 
 import { execFileSync } from 'node:child_process'
-import { readFileSync } from 'node:fs'
-import { dirname, join } from 'node:path'
+import { existsSync, readFileSync } from 'node:fs'
+import { basename, dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import {
   commitPreparedUpdates,
@@ -37,6 +37,8 @@ const __dirname = dirname(fileURLToPath(import.meta.url))
 const ROOT = join(__dirname, '..')
 
 const CHANGELOG_PATH = join(ROOT, 'CHANGELOG.md')
+const ZENODO_PATH = join(ROOT, '.zenodo.json')
+const CITATION_PATH = join(ROOT, 'CITATION.cff')
 
 // ---------------------------------------------------------------------------
 // Git helpers
@@ -111,6 +113,90 @@ function prepareManifests(newVersion) {
   return { inventory, updates: prepareInventoryVersion(inventory, newVersion) }
 }
 
+/**
+ * Serialize `.zenodo.json` the way Biome 2.x formats it: objects stay expanded
+ * (matching `JSON.stringify(value, null, 2)`), while arrays containing only
+ * primitives are collapsed onto one line when they fit within the line width.
+ * A plain `JSON.stringify` emits the `keywords` array multiline, which Biome
+ * collapses — reintroducing a lint failure on the next release bump.
+ *
+ * @param {unknown} value parsed JSON document
+ * @param {number} [lineWidth] formatter line width (matches biome.json)
+ * @returns {string} Biome-compatible JSON with a trailing newline
+ */
+function formatZenodoJson(value, lineWidth = 100) {
+  const indent = (depth) => '  '.repeat(depth)
+  const render = (node, depth, column) => {
+    if (Array.isArray(node)) {
+      if (node.length === 0) return '[]'
+      const primitiveOnly = node.every((item) => item === null || typeof item !== 'object')
+      if (primitiveOnly) {
+        const inline = `[${node.map((item) => JSON.stringify(item)).join(', ')}]`
+        if (column + inline.length <= lineWidth) return inline
+      }
+      const body = node
+        .map((item) => `${indent(depth + 1)}${render(item, depth + 1, indent(depth + 1).length)}`)
+        .join(',\n')
+      return `[\n${body}\n${indent(depth)}]`
+    }
+    if (node !== null && typeof node === 'object') {
+      const entries = Object.entries(node)
+      if (entries.length === 0) return '{}'
+      const body = entries
+        .map(([key, item]) => {
+          const keyPrefix = `${indent(depth + 1)}${JSON.stringify(key)}: `
+          return `${keyPrefix}${render(item, depth + 1, keyPrefix.length)}`
+        })
+        .join(',\n')
+      return `{\n${body}\n${indent(depth)}}`
+    }
+    return JSON.stringify(node)
+  }
+  return `${render(value, 0, 0)}\n`
+}
+
+/**
+ * Keep the Zenodo deposition metadata (.zenodo.json) and the citation file
+ * (CITATION.cff) aligned with the version and date being released. Zenodo's
+ * release validator hard-fails when CITATION.cff version differs from the
+ * release tag, so these must be bumped together with the manifests.
+ */
+function prepareReleaseMetadata(newVersion, dateStr) {
+  if (!SEMVER_PATTERN.test(newVersion)) throw new Error(`invalid version: ${newVersion}`)
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(dateStr)) throw new Error(`invalid date: ${dateStr}`)
+  const tagUrl = `https://github.com/ils15/pantheon-opencode/releases/tag/v${newVersion}`
+  const updates = []
+
+  if (existsSync(ZENODO_PATH)) {
+    const zenodo = JSON.parse(readFileSync(ZENODO_PATH, 'utf8'))
+    const zenodoPrevious = typeof zenodo.version === 'string' ? zenodo.version : null
+    if (zenodoPrevious && zenodoPrevious !== newVersion && typeof zenodo.description === 'string') {
+      zenodo.description = zenodo.description.replaceAll(zenodoPrevious, newVersion)
+    }
+    zenodo.version = newVersion
+    zenodo.publication_date = dateStr
+    zenodo.url = tagUrl
+    updates.push({ path: ZENODO_PATH, content: formatZenodoJson(zenodo) })
+  }
+
+  if (existsSync(CITATION_PATH)) {
+    const citationRaw = readFileSync(CITATION_PATH, 'utf8')
+    const citationMatch = /^version:\s*["']?([^"'\s]+)["']?\s*$/m.exec(citationRaw)
+    const citationPrevious = citationMatch ? citationMatch[1] : null
+    let citation = citationRaw
+    if (citationPrevious && citationPrevious !== newVersion) {
+      citation = citation.replaceAll(`Pantheon v${citationPrevious}`, `Pantheon v${newVersion}`)
+    }
+    citation = citation
+      .replace(/^version:.*$/m, `version: ${newVersion}`)
+      .replace(/^date-released:.*$/m, `date-released: ${dateStr}`)
+      .replace(/^url:.*$/m, `url: ${tagUrl}`)
+    updates.push({ path: CITATION_PATH, content: citation })
+  }
+
+  return updates
+}
+
 // ---------------------------------------------------------------------------
 // CHANGELOG updater
 //
@@ -243,8 +329,8 @@ function contentHasUnreleased() {
   return readFileSync(CHANGELOG_PATH, 'utf8').includes('## [Unreleased]')
 }
 
-function commitPreparedRelease(manifestPlan, changelogPlan) {
-  const updates = [...manifestPlan.updates]
+function commitPreparedRelease(manifestPlan, changelogPlan, metadataUpdates = []) {
+  const updates = [...manifestPlan.updates, ...metadataUpdates]
   if (changelogPlan.changed) {
     updates.push({ path: CHANGELOG_PATH, content: changelogPlan.content })
   }
@@ -252,6 +338,9 @@ function commitPreparedRelease(manifestPlan, changelogPlan) {
   for (const document of manifestPlan.inventory.documents) {
     console.log(`  ✓ ${document.entry.file} → ${manifestPlan.version}`)
   }
+  for (const { path } of metadataUpdates) {
+    console.log(`  ✓ ${basename(path)} → ${manifestPlan.version}`)
+  }
   if (changelogPlan.changed) {
     console.log(
       changelogPlan.notesGenerated
@@ -314,7 +403,11 @@ switch (command) {
       console.log(`Bumping ${current} → ${newVersion} (beta)`)
       const changelogPlan = prepareUnreleased(newVersion, date)
       const manifestPlan = prepareManifests(newVersion)
-      commitPreparedRelease({ ...manifestPlan, version: newVersion }, changelogPlan)
+      commitPreparedRelease(
+        { ...manifestPlan, version: newVersion },
+        changelogPlan,
+        prepareReleaseMetadata(newVersion, date),
+      )
       console.log(`\nDone. Commit the version inventory and CHANGELOG as v${newVersion}.`)
       console.log(`Tag v${newVersion} will be created by the release workflow after merge to main.`)
       break
@@ -347,7 +440,11 @@ switch (command) {
       const notesBody = generateNotes()
       const changelogPlan = prepareUnreleased(current, date, notesBody)
       const manifestPlan = prepareManifests(current)
-      commitPreparedRelease({ ...manifestPlan, version: current }, changelogPlan)
+      commitPreparedRelease(
+        { ...manifestPlan, version: current },
+        changelogPlan,
+        prepareReleaseMetadata(current, date),
+      )
       console.log(`Tag v${current} will be created by the release workflow after merge to main.`)
       break
     }
@@ -360,7 +457,11 @@ switch (command) {
     const notesBody = generateNotes()
     const changelogPlan = prepareUnreleased(newVersion, date, notesBody)
     const manifestPlan = prepareManifests(newVersion)
-    commitPreparedRelease({ ...manifestPlan, version: newVersion }, changelogPlan)
+    commitPreparedRelease(
+      { ...manifestPlan, version: newVersion },
+      changelogPlan,
+      prepareReleaseMetadata(newVersion, date),
+    )
     console.log(`\nDone. Commit the version inventory and CHANGELOG as v${newVersion}.`)
     console.log(`Tag v${newVersion} will be created by the release workflow after merge to main.`)
     break

package/src/agents/mnemosyne.md

@@ -34,7 +34,7 @@ permission:
   bash: deny
   read: allow
   grep: allow
-  edit: deny
+  edit: allow
   task:
     "*": deny
 ---

package/src/mcp/mcp_persistence_server.py

@@ -777,13 +777,32 @@ def _validate_heartbeat(heartbeat: object) -> None:
         raise ValueError("heartbeat.turn_count must be a non-negative integer")
 
 
+def _validate_version_metadata(version: object) -> None:
+    """Validate optional checkpoint ``version`` metadata leniently.
+
+    ``version`` is opaque application metadata (rehydrate does not consume it),
+    not a persistence requirement. It may be a positive integer, a JSON float
+    such as ``1.0``, or a version label like ``"1.5.0-beta.2"``. Absent/null
+    versions and any non-empty string remain valid, preserving existing integer
+    checkpoints while allowing forward-compatible labels. Only bools, empty
+    strings, non-finite/zero/negative numbers, and structured values are
+    rejected.
+    """
+    if version is None:
+        return
+    if isinstance(version, bool):
+        raise ValueError("version must be a positive integer or version label")
+    if isinstance(version, (int, float)):
+        if not 1 <= version < float("inf"):
+            raise ValueError("version must be a positive integer or version label")
+        return
+    if not isinstance(version, str) or not version.strip():
+        raise ValueError("version must be a positive integer or version label")
+
+
 def _validate_checkpoint_shape(checkpoint: dict) -> None:
     """Validate bounded structured checkpoint fields without sanitizing them."""
-    version = checkpoint.get("version")
-    if version is not None and (
-        isinstance(version, bool) or not isinstance(version, int) or version < 1
-    ):
-        raise ValueError("version must be a positive integer")
+    _validate_version_metadata(checkpoint.get("version"))
     validators = (
         ("goal", _validate_goal),
         ("phase", _validate_phase),

package/src/pantheon/background-job-board.ts

@@ -222,15 +222,28 @@ export class BackgroundJobBoard {
   async recoverRunningJobs(): Promise<void> {
     if (!this.persistence) return
     const records = await this.persistence.loadAllJobs()
+    const recoveredIDs: string[] = []
     for (const record of records) {
       if (record.state === 'running') {
         record.state = 'error'
         record.lastStatusError = 'Process restarted — job marked as errored'
         record.updatedAt = Date.now()
+        record.completedAt = Date.now()
         record.totalErrors++
+        record.terminalUnreconciled = true
+        recoveredIDs.push(record.taskID)
       }
       this.jobs.set(record.taskID, record)
     }
+    // Persist + signal + notify for each recovered job (write-ahead-log pattern)
+    for (const taskID of recoveredIDs) {
+      const job = this.jobs.get(taskID)
+      if (job) {
+        await this.persistRecord(job)
+        await this.writeSignal(job)
+        this.notifyTerminal(job.taskID)
+      }
+    }
   }
 
   // ─── Core Operations ────────────────────────────────────────────────
@@ -240,6 +253,16 @@ export class BackgroundJobBoard {
    * The job starts in the `running` state with a generated alias.
    */
   async registerLaunch(input: LaunchInput): Promise<BackgroundJobRecord> {
+    // Atomic concurrency check: validate BEFORE any mutation or await.
+    // JavaScript's single-threaded event loop guarantees this check + set
+    // cannot be interleaved with another registerLaunch call.
+    if (!this.canDispatch(input.agent)) {
+      throw new Error(
+        `Concurrency limit reached for agent "${input.agent}" ` +
+          `(${this.getRunningCount(input.agent)} running, max ${this.options.maxConcurrentPerAgent})`,
+      )
+    }
+
     const prefix = getAgentPrefix(input.agent)
     let sessionCounters = this.aliasCounters.get(input.parentSessionID)
     if (!sessionCounters) {

package/src/pantheon/cost-command.ts

@@ -15,14 +15,19 @@
  *
  * @module cost-command
  */
-import { existsSync } from 'node:fs'
+import { execFile } from 'node:child_process'
+import { accessSync, constants, existsSync, statSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { join } from 'node:path'
+import { delimiter, dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
 import { z } from 'zod'
 
 import type { ToolContextLike } from './delegation.ts'
 import type { NativeTaskStatus } from './native-task-status.ts'
 
+const __filename = fileURLToPath(import.meta.url)
+const __dirname = dirname(__filename)
+
 /** One aggregated token row (per agent and phase). */
 export interface CostRow {
   agent: string
@@ -37,6 +42,8 @@ export interface CostCommandOptions {
   dbPath?: string
   /** Injectable loader for tests; production always loads node:sqlite. */
   sqliteLoader?: () => Promise<SqliteModule>
+  /** Injectable CLI-fallback process boundary (tests / unusual runtimes). */
+  cliFallback?: CliFallbackDeps
 }
 
 export type OpenCodeVersion = 'v1' | 'v2'
@@ -220,6 +227,230 @@ function renderMarkdown(rows: readonly CostRow[], days: number): string {
   return lines.join('\n')
 }
 
+// ─── CLI fallback: resolve a REAL Node, not the plugin runtime ──────────
+//
+// Under Bun (the runtime that motivates this fallback), process.execPath IS
+// the Bun binary, which has no node:sqlite — so spawning it could never work.
+// Resolve a genuine Node instead: PANTHEON_NODE → `node` on PATH → clear error.
+
+/** First Node release exposing the built-in `node:sqlite` module. */
+const NODE_SQLITE_MIN_VERSION = '22.5'
+
+/** Minimal injectable child-process boundary (tests / unusual runtimes). */
+export type ExecFileLike = (
+  file: string,
+  args: readonly string[],
+) => Promise<{ stdout: string; stderr?: string }>
+
+/** Injectables so the fallback never depends on the real machine in tests. */
+export interface CliFallbackDeps {
+  /** Environment for PANTHEON_NODE / PATH lookup. Default: process.env. */
+  env?: NodeJS.ProcessEnv
+  /** Child-process boundary. Default: node:child_process.execFile. */
+  execFile?: ExecFileLike
+  /** Executable predicate used by the PANTHEON_NODE / PATH lookups. */
+  isExecutable?: (path: string) => boolean
+}
+
+/** A real Node executable located for the CLI fallback. */
+export interface ResolvedNode {
+  path: string
+  source: 'env' | 'path'
+}
+
+type ExecFailure = Error & { stdout?: string; stderr?: string }
+
+function defaultIsExecutable(path: string): boolean {
+  try {
+    accessSync(path, constants.X_OK)
+    return statSync(path).isFile()
+  } catch {
+    return false
+  }
+}
+
+function defaultExecFile(
+  file: string,
+  args: readonly string[],
+): Promise<{ stdout: string; stderr: string }> {
+  return new Promise((resolve, reject) => {
+    execFile(file, [...args], { encoding: 'utf8' }, (error, stdout, stderr) => {
+      if (error) {
+        // execFile's callback error does not always carry the captured output;
+        // attach it so callers can surface cost.mjs's structured {ok:false}.
+        const failure = error as ExecFailure
+        if (typeof failure.stdout !== 'string') failure.stdout = stdout
+        if (typeof failure.stderr !== 'string') failure.stderr = stderr
+        reject(failure)
+        return
+      }
+      resolve({ stdout, stderr })
+    })
+  })
+}
+
+/** Scan PATH (no shell) for a `node` executable. */
+export function resolveNodeFromPath(
+  env: NodeJS.ProcessEnv,
+  isExecutable: (path: string) => boolean = defaultIsExecutable,
+): string | undefined {
+  const pathValue = env.PATH ?? env.Path ?? ''
+  if (pathValue === '') return undefined
+  const isWindows = process.platform === 'win32'
+  const extensions = isWindows
+    ? (env.PATHEXT ?? '.EXE;.CMD;.BAT;.COM').split(';').filter((ext) => ext !== '')
+    : ['']
+  for (const dir of pathValue.split(delimiter)) {
+    if (dir === '') continue
+    for (const ext of extensions) {
+      const candidate = join(dir, `node${ext}`)
+      if (isExecutable(candidate)) return candidate
+    }
+  }
+  return undefined
+}
+
+/**
+ * Resolve a REAL Node.js binary for the CLI fallback.
+ *
+ * Order: PANTHEON_NODE (must exist and be executable — an explicit override
+ * that is unusable fails fast instead of being silently ignored) → `node`
+ * from PATH. Returns undefined only when neither source is available.
+ */
+export function resolveNodeExecutable(
+  env: NodeJS.ProcessEnv = process.env,
+  isExecutable: (path: string) => boolean = defaultIsExecutable,
+): ResolvedNode | undefined {
+  const explicit = env.PANTHEON_NODE
+  if (explicit !== undefined && explicit.trim() !== '') {
+    if (isExecutable(explicit)) return { path: explicit, source: 'env' }
+    throw new Error(
+      `PANTHEON_NODE is set to "${explicit}" but that is not an existing executable file`,
+    )
+  }
+  const fromPath = resolveNodeFromPath(env, isExecutable)
+  return fromPath === undefined ? undefined : { path: fromPath, source: 'path' }
+}
+
+function execErrorMessage(err: unknown): string {
+  if (err instanceof Error) {
+    const failure = err as ExecFailure
+    const stderr = typeof failure.stderr === 'string' ? failure.stderr.trim() : ''
+    if (stderr !== '') return stderr
+    return failure.message
+  }
+  return String(err)
+}
+
+function tryParseJson(text: string): unknown {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return undefined
+  }
+}
+
+function truncateForError(text: string): string {
+  const trimmed = text.trim()
+  return trimmed.length > 200 ? `${trimmed.slice(0, 200)}…` : trimmed
+}
+
+/** Probe the resolved binary for built-in node:sqlite support. */
+async function assertNodeSqliteSupport(
+  nodePath: string,
+  execFileAsync: ExecFileLike,
+): Promise<void> {
+  try {
+    await execFileAsync(nodePath, ['-e', "require('node:sqlite')"])
+  } catch (err: unknown) {
+    throw new Error(
+      `resolved Node binary "${nodePath}" does not support node:sqlite (Node.js >= ${NODE_SQLITE_MIN_VERSION} required): ${execErrorMessage(err)}`,
+    )
+  }
+}
+
+/** Pull the structured failure message cost.mjs prints to stdout (exit 1). */
+function extractScriptFailure(err: unknown): string {
+  const failure = err as { stdout?: unknown; stderr?: unknown }
+  const stdout = typeof failure.stdout === 'string' ? failure.stdout : ''
+  const parsed = tryParseJson(stdout)
+  if (parsed !== null && typeof parsed === 'object') {
+    const record = parsed as { ok?: unknown; error?: unknown }
+    if (record.ok === false && typeof record.error === 'string' && record.error !== '') {
+      return record.error
+    }
+  }
+  const stderr = typeof failure.stderr === 'string' ? failure.stderr.trim() : ''
+  if (stderr !== '') return stderr
+  return execErrorMessage(err)
+}
+
+/**
+ * Spawn `node scripts/cost.mjs` as a CLI fallback when node:sqlite is
+ * unavailable in the plugin process (e.g. Bun runtime). Returns CostRow[] by
+ * parsing the JSON the script writes to stdout.
+ *
+ * Resolves a REAL Node binary (PANTHEON_NODE → PATH): process.execPath under
+ * Bun is the Bun binary, which cannot run node:sqlite. The resolved binary is
+ * probed for node:sqlite support and the script is always run read-only with
+ * an argument array (never a shell).
+ */
+export async function queryWithCliFallback(
+  dbPath: string,
+  days: number,
+  deps?: CliFallbackDeps,
+): Promise<CostRow[]> {
+  const env = deps?.env ?? process.env
+  const execFileAsync = deps?.execFile ?? defaultExecFile
+  const isExecutable = deps?.isExecutable ?? defaultIsExecutable
+
+  const costScript = join(__dirname, '..', '..', 'scripts', 'cost.mjs')
+  if (!existsSync(costScript)) {
+    throw new Error(`CLI fallback script not found: ${costScript}`)
+  }
+
+  const node = resolveNodeExecutable(env, isExecutable)
+  if (node === undefined) {
+    throw new Error(
+      `no Node.js executable found for the node:sqlite CLI fallback: set PANTHEON_NODE to a Node.js >= ${NODE_SQLITE_MIN_VERSION} binary or put "node" on PATH`,
+    )
+  }
+
+  await assertNodeSqliteSupport(node.path, execFileAsync)
+
+  let stdout: string
+  try {
+    ;({ stdout } = await execFileAsync(node.path, [
+      costScript,
+      '--db-path',
+      dbPath,
+      '--days',
+      String(days),
+    ]))
+  } catch (err: unknown) {
+    // cost.mjs sets exitCode=1 (execFile rejects) and writes {ok:false,error}
+    // to stdout before exiting — surface that structured failure.
+    throw new Error(`CLI fallback failed: ${extractScriptFailure(err)}`)
+  }
+
+  const parsed = tryParseJson(stdout)
+  if (parsed === null || typeof parsed !== 'object') {
+    throw new Error(`CLI fallback returned non-JSON output: ${truncateForError(stdout)}`)
+  }
+  const record = parsed as { ok?: unknown; rows?: unknown; error?: unknown }
+  if (record.ok !== true) {
+    const detail =
+      typeof record.error === 'string' && record.error !== ''
+        ? record.error
+        : 'unexpected response shape from scripts/cost.mjs'
+    throw new Error(`CLI fallback failed: ${detail}`)
+  }
+  if (!Array.isArray(record.rows)) {
+    throw new Error('CLI fallback failed: scripts/cost.mjs response is missing the rows array')
+  }
+  return record.rows as CostRow[]
+}
+
 export function createCostCommand(options?: CostCommandOptions): CostCommand {
   const loadSqlite =
     options?.sqliteLoader ?? (async () => (await import('node:sqlite')) as SqliteModule)
@@ -269,7 +500,22 @@ export function createCostCommand(options?: CostCommandOptions): CostCommand {
           `opencode.db not found (expected at ${expected}). No token history is available until opencode has stored session data.`,
         )
       }
-      const sqlite = await loadSqlite()
+      let sqlite: SqliteModule | undefined
+      try {
+        sqlite = await loadSqlite()
+      } catch (loadErr: unknown) {
+        // node:sqlite unavailable (e.g. Bun runtime) — fall back to CLI.
+        const status = statusForError(loadErr)
+        if (status === 'UNSUPPORTED') {
+          try {
+            const rows = await queryWithCliFallback(dbPath, days, options?.cliFallback)
+            return `status: OK\n${renderMarkdown(rows, days)}`
+          } catch (cliErr: unknown) {
+            return failure(statusForError(cliErr), diagnostic(cliErr))
+          }
+        }
+        throw loadErr
+      }
       const rows = await queryWithNodeSqlite(dbPath, days, sqlite)
       return `status: OK\n${renderMarkdown(rows, days)}`
     } catch (err: unknown) {

package/src/pantheon/delegation-finalize.ts

@@ -144,9 +144,25 @@ export interface DelegationOptions {
   promptTimeoutMs?: number
   /** Poll interval used by the bootstrap watchdog. */
   bootstrapPollIntervalMs?: number
+  /**
+   * Max completed jobs to keep per agent after pruning (default: 10).
+   * Matches the native delegate-manager default.
+   */
+  keepCompleted?: number
+  /**
+   * Hard cap on total board entries (default: 50).
+   * Matches the native delegate-manager default.
+   */
+  maxEntries?: number
   /** Injectable clock/sleeper for deterministic watchdog tests. */
   now?: () => number
   sleep?: (ms: number) => Promise<void>
+  /**
+   * Kill-switch: when false, all delegation tools (delegate/read/list) throw
+   * immediately. Mirrors `PANTHEON_DELEGATION=off` from the native manager.
+   * Defaults to true (delegation enabled) when not specified.
+   */
+  delegationEnabled?: boolean
 }
 
 /** Dependencies threaded to the finalize path. */
@@ -370,5 +386,21 @@ export async function finalizeDelegation(
     // Terminal in a DIFFERENT state (e.g. timeout already recorded) — the
     // report above still captures this finalize; the board state stands.
   }
+
+  // P1-1: Delete the auto-wake signal file to prevent leaks. The board
+  // writes .signal.json on every terminal transition, but the legacy path
+  // never called deleteSignal — only the native delegate-manager did.
+  // The consumer (auto-wake.ts consumeWakeSignals) is intentionally NOT
+  // wired in the event hook: finalizeDelegation already handles the
+  // terminal transition, so consuming signals would be redundant and risks
+  // double-processing. deleteSignal on finalize is sufficient.
+  await deps.board.deleteSignal(job.alias)
+
+  // P1-4: Prune old completed jobs and enforce the hard entry cap. The
+  // native delegate-manager called these in settle(), but the legacy
+  // finalize path omitted them, allowing unbounded board growth.
+  await deps.board.pruneCompleted(deps.options.keepCompleted ?? 10)
+  await deps.board.enforceEntryCap(deps.options.maxEntries ?? 50)
+
   return deps.board.get(childSessionID) ?? job
 }

package/src/pantheon/delegation.ts

@@ -740,10 +740,54 @@ export function createDelegationTools(input: CreateDelegationToolsInput): Delega
     return finalizeDelegationReport(deps, childSessionID, opts)
   }
 
+  // Kill-switch gate: when delegationEnabled is explicitly false (mirrors
+  // PANTHEON_DELEGATION=off from the native manager), all legacy tools throw.
+  function guardEnabled(): void {
+    if (options.delegationEnabled === false) {
+      throw new Error('pantheon delegation disabled (PANTHEON_DELEGATION=off)')
+    }
+  }
+
+  /**
+   * Best-effort teardown of a child session whose `registerLaunch` was refused
+   * because the per-agent concurrency limit was hit between the pre-check and
+   * the registration (a race with another concurrent dispatch). Removes every
+   * side effect of the aborted dispatch — known-child marker, read-only
+   * registry entry and any reserved budget slot — then deletes the session when
+   * the host client exposes `session.delete`. Never throws: cleanup must not
+   * mask the original rejection.
+   */
+  async function abortRejectedLaunch(
+    childSessionID: string,
+    wasReadOnly: boolean,
+    refund?: { key: string | undefined; reserved: boolean },
+  ): Promise<void> {
+    knownChildren.delete(childSessionID)
+    if (wasReadOnly) readOnlyRegistry.unregister(childSessionID)
+    if (refund?.reserved && refund.key !== undefined) {
+      budgetUsage.set(refund.key, Math.max(0, (budgetUsage.get(refund.key) ?? 1) - 1))
+    }
+    // The plugin's adapted client (adaptDelegationClient) does not expose
+    // session.delete, and older hosts may not either. Delete best-effort so the
+    // abandoned session is not left behind; the registry cleanup above already
+    // removes the side effects that matter for read-only enforcement.
+    const session = client.session as {
+      delete?: (input: { path: { id: string } }) => Promise<unknown>
+    }
+    if (typeof session.delete !== 'function') return
+    try {
+      await session.delete({ path: { id: childSessionID } })
+    } catch (err: unknown) {
+      const reason = err instanceof Error ? err.message : String(err)
+      log.warn(`[pantheon-delegate] failed to delete orphan session ${childSessionID}: ${reason}`)
+    }
+  }
+
   const pantheon_delegate: DelegationTool<typeof delegateArgs> = {
     description: buildDelegateDescription(options),
     args: delegateArgs,
     execute: async (args, ctx) => {
+      guardEnabled()
       if (!isRootSession(ctx.sessionID)) {
         throw new Error(
           `pantheon_delegate rejected: session ${ctx.sessionID} is a sub-session — only root sessions can delegate`,
@@ -871,13 +915,27 @@ export function createDelegationTools(input: CreateDelegationToolsInput): Delega
         readOnlyRegistry.register(childSessionID, entry)
       }
 
-      const job = await board.registerLaunch({
-        taskID: childSessionID,
-        parentSessionID: ctx.sessionID,
-        agent: args.agent,
-        description: args.description ?? effectivePrompt,
-        objective: effectivePrompt,
-      })
+      let job: BackgroundJobRecord
+      try {
+        job = await board.registerLaunch({
+          taskID: childSessionID,
+          parentSessionID: ctx.sessionID,
+          agent: args.agent,
+          description: args.description ?? effectivePrompt,
+          objective: effectivePrompt,
+        })
+      } catch (err: unknown) {
+        // Concurrency race: another dispatch claimed the last slot after the
+        // pre-check above but before this registration. Undo every side effect
+        // of the aborted dispatch so no orphan session/registry survives, then
+        // surface a clear rejection.
+        const reason = err instanceof Error ? err.message : String(err)
+        await abortRejectedLaunch(childSessionID, readOnly, {
+          key: budgetKey,
+          reserved: budgetReserved,
+        })
+        return `pantheon_delegate rejected: ${reason}`
+      }
 
       // Timeout manager: cleared on finalize, unref'd so the timer never
       // keeps the process alive on its own.
@@ -968,13 +1026,34 @@ export function createDelegationTools(input: CreateDelegationToolsInput): Delega
       const retryID = retry.id
       knownChildren.add(retryID)
       options.registerChildSession?.(retryID, ctx.sessionID)
-      const retryJob = await board.registerLaunch({
-        taskID: retryID,
-        parentSessionID: ctx.sessionID,
-        agent: args.agent,
-        description: args.description ?? effectivePrompt,
-        objective: effectivePrompt,
-      })
+
+      // Phase 4 read-only enforcement for the retry: recalculate readOnly
+      // (same logic as the initial child at :866-872) and register the retry
+      // session so the plugin's tool.execute.before guard enforces it.
+      const retryReadOnly =
+        args.read_only === true || (options.readOnlyAgents?.has(args.agent.toLowerCase()) ?? false)
+      if (retryReadOnly) {
+        const entry: { agent: string; readOnlyFlag?: boolean } = { agent: args.agent }
+        if (args.read_only !== undefined) entry.readOnlyFlag = args.read_only
+        readOnlyRegistry.register(retryID, entry)
+      }
+
+      let retryJob: BackgroundJobRecord
+      try {
+        retryJob = await board.registerLaunch({
+          taskID: retryID,
+          parentSessionID: ctx.sessionID,
+          agent: args.agent,
+          description: args.description ?? effectivePrompt,
+          objective: effectivePrompt,
+        })
+      } catch (err: unknown) {
+        // Same race as the initial child: the retry registration can be
+        // refused. Clean up the retry session + registry entry before failing.
+        const reason = err instanceof Error ? err.message : String(err)
+        await abortRejectedLaunch(retryID, retryReadOnly)
+        return `pantheon_delegate rejected: ${reason} (retry)`
+      }
       const retryTimer = setTimeout(() => {
         timers.delete(retryID)
         void finalize(retryID, {
@@ -1035,6 +1114,7 @@ export function createDelegationTools(input: CreateDelegationToolsInput): Delega
       'Resolves by alias or task ID.',
     args: readArgs,
     execute: async (args, ctx) => {
+      guardEnabled()
       const job = board.resolve(ctx.sessionID, args.id)
       if (!job) {
         return `Unknown delegation "${args.id}" for this session. Use pantheon_delegation_list to see active delegations.`
@@ -1093,6 +1173,7 @@ export function createDelegationTools(input: CreateDelegationToolsInput): Delega
       'List background delegations for the current session, with [unread] for finished jobs.',
     args: listArgs,
     execute: async (_args, ctx) => {
+      guardEnabled()
       const jobs = board.list(ctx.sessionID)
       if (jobs.length === 0) return 'No background delegations for this session.'
 

package/src/pantheon/v2-events.ts

@@ -104,12 +104,20 @@ export function createV2EventDispatcher(deps: V2EventDeps): V2EventDispatcher {
             } else {
               // Native task(background=true) child: register on the board
               // atomically (skip if V1 idle hook or re-dispatch already claimed it).
-              await deps.board.registerLaunchIfAbsent({
-                taskID: info.id,
-                parentSessionID: info.parentID,
-                agent: 'native',
-                description: `native child ${info.id}`,
-              })
+              try {
+                await deps.board.registerLaunchIfAbsent({
+                  taskID: info.id,
+                  parentSessionID: info.parentID,
+                  agent: 'native',
+                  description: `native child ${info.id}`,
+                })
+              } catch (err) {
+                // The per-agent concurrency limit can refuse the launch. Do not
+                // abort the rest of the handler: this child is simply not
+                // mirrored on the board, while finalize/idle dispatch for every
+                // other event must still run.
+                log.warn(`[Pantheon V2] native child ${info.id} not mirrored on board:`, err)
+              }
             }
           }
         }

package/src/plugins/tui/dist/tui.js

@@ -164,7 +164,7 @@ async function detectVersion(api) {
 			if (ver) return ver;
 		}
 	} catch {}
-	return "1.5.0-beta.6";
+	return "1.5.0-beta.7";
 }
 /**
 * usage-bar — AI subscription usage gauge for the opencode TUI.

package/src/plugins/tui/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pantheon-tui",
-  "version": "1.5.0-beta.6",
+  "version": "1.5.0-beta.7",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pantheon-tui",
-      "version": "1.5.0-beta.6",
+      "version": "1.5.0-beta.7",
       "license": "MIT",
       "dependencies": {
         "@opencode-ai/plugin": ">=1.14.0",

package/src/plugins/tui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pantheon-tui",
   "type": "module",
-  "version": "1.5.0-beta.6",
+  "version": "1.5.0-beta.7",
   "description": "Pantheon TUI plugin — sidebar (version, preset, sessions, real-time delegations) + AI subscription usage gauges incl. OpenCode Go/Zen dollar limits (vendored, MIT)",
   "license": "MIT",
   "exports": {