pantheon-opencode 1.5.0-beta.8 → 1.5.0

package/scripts/hash_verify.py

@@ -1,192 +0,0 @@
-#!/usr/bin/env python3
-"""Hash-Anchored Edit Verification — standalone script.
-
-Verifies that file edits actually changed content by comparing SHA-256
-hashes before and after an edit. Detects failed/no-op edits.
-
-Usage:
-  python3 scripts/hash_verify.py <file> [--before-hash=<sha256>] [--diff-min-lines=10]
-  python3 scripts/hash_verify.py --staged           # Check all staged files
-  python3 scripts/hash_verify.py --batch <file>...  # Check multiple files
-"""
-
-import argparse
-import hashlib
-import subprocess
-import sys
-from pathlib import Path
-
-EXIT_SUCCESS = 0
-EXIT_FAILURE = 1
-EXIT_WARNING = 2
-
-
-def sha256_of(file: Path) -> str:
-    """Return hex SHA-256 of file content."""
-    return hashlib.sha256(file.read_bytes()).hexdigest()
-
-
-def compute_diff_size(file: Path) -> int:
-    """Return number of changed lines in working-tree diff."""
-    try:
-        result = subprocess.run(
-            ["git", "diff", "--", str(file)],
-            capture_output=True,
-            text=True,
-            timeout=5,
-            check=False,
-        )
-    except (subprocess.TimeoutExpired, FileNotFoundError):
-        return 0
-
-    diff = result.stdout
-    added = len(
-        [
-            line
-            for line in diff.split("\n")
-            if line.startswith("+") and not line.startswith("+++")
-        ]
-    )
-    removed = len(
-        [
-            line
-            for line in diff.split("\n")
-            if line.startswith("-") and not line.startswith("---")
-        ]
-    )
-    return added + removed
-
-
-def verify_file(file: Path, before_hash: str | None, diff_min_lines: int) -> dict:
-    """Verify a single file edit."""
-    if not file.exists():
-        return {"file": str(file), "status": "error", "message": "File does not exist"}
-
-    after_hash = sha256_of(file)
-
-    if before_hash:
-        # Compare explicit before/after hashes
-        if after_hash == before_hash:
-            return {
-                "file": str(file),
-                "status": "failed",
-                "hash_before": before_hash,
-                "hash_after": after_hash,
-                "message": "Hash unchanged — edit did not modify file content",
-            }
-    else:
-        # Auto-detect: check git diff
-        diff_changes = compute_diff_size(file)
-        if diff_changes == 0:
-            return {
-                "file": str(file),
-                "status": "failed",
-                "hash_after": after_hash,
-                "message": "No git diff detected — edit did not modify file",
-            }
-
-        if diff_changes < diff_min_lines:
-            return {
-                "file": str(file),
-                "status": "warning",
-                "hash_after": after_hash,
-                "diff_lines": diff_changes,
-                "message": f"Edit detected but diff is small ({diff_changes} lines vs min {diff_min_lines})",
-            }
-
-    return {
-        "file": str(file),
-        "status": "verified",
-        "hash_after": after_hash,
-        "message": "Edit verified — file content changed",
-    }
-
-
-def check_staged_files(diff_min_lines: int) -> list[dict]:
-    """Verify all staged (git-add'ed) files."""
-    try:
-        result = subprocess.run(
-            ["git", "diff", "--cached", "--name-only"],
-            capture_output=True,
-            text=True,
-            timeout=5,
-            check=False,
-        )
-    except (subprocess.TimeoutExpired, FileNotFoundError):
-        return [{"status": "error", "message": "Git not available"}]
-
-    staged = [f.strip() for f in result.stdout.split("\n") if f.strip()]
-    results = []
-    for fname in staged[:20]:  # limit to 20 files
-        fpath = Path(fname)
-        if fpath.exists():
-            results.append(verify_file(fpath, None, diff_min_lines))
-    return results
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser(
-        description="Hash-anchored edit verification — ensures file edits actually changed content."
-    )
-    parser.add_argument("files", nargs="*", help="File(s) to verify")
-    parser.add_argument(
-        "--before-hash", help="Expected SHA-256 hash before edit (for single-file mode)"
-    )
-    parser.add_argument(
-        "--diff-min-lines",
-        type=int,
-        default=3,
-        help="Minimum diff lines to consider edit meaningful (default: 3)",
-    )
-    parser.add_argument(
-        "--staged", action="store_true", help="Verify all staged files instead"
-    )
-    parser.add_argument(
-        "--batch", action="store_true", help="Treat positional args as batch file list"
-    )
-    args = parser.parse_args()
-
-    if args.staged:
-        results = check_staged_files(args.diff_min_lines)
-    elif args.batch or len(args.files) > 1:
-        results = [verify_file(Path(f), None, args.diff_min_lines) for f in args.files]
-    elif args.files:
-        results = [
-            verify_file(Path(args.files[0]), args.before_hash, args.diff_min_lines)
-        ]
-    else:
-        print("Usage: python3 scripts/hash_verify.py <file> [--before-hash=<sha256>]")
-        print("       python3 scripts/hash_verify.py --staged")
-        print("       python3 scripts/hash_verify.py --batch <file>...")
-        sys.exit(EXIT_FAILURE)
-
-    # Print results
-    any_failed = False
-    any_warning = False
-
-    for r in results:
-        status_tag = {
-            "verified": "✅",
-            "warning": "⚠️",
-            "failed": "❌",
-            "error": "❌",
-        }.get(r["status"], "❓")
-        print(f"{status_tag} {r['file']}: {r['message']}")
-        if r["status"] == "failed" or r["status"] == "error":
-            any_failed = True
-        elif r["status"] == "warning":
-            any_warning = True
-
-    if any_failed:
-        print("\n❌ HASH VERIFY FAILED — some edits did not modify files")
-        sys.exit(EXIT_FAILURE)
-    elif any_warning:
-        print("\n⚠️  HASH VERIFY PASSED WITH WARNINGS — small diffs detected")
-        sys.exit(EXIT_WARNING)
-    else:
-        print("\n✅ HASH VERIFY: all edits verified")
-        sys.exit(EXIT_SUCCESS)
-
-
-if __name__ == "__main__":
-    main()

package/scripts/install/component.mjs

@@ -1,24 +0,0 @@
-/**
- * component.mjs — Component resolution utilities for the OpenCode installer
- */
-
-/** Available component identifiers */
-export const COMPONENT_NAMES = [
-  'agents',
-  'skills',
-  'instructions',
-  'prompts',
-  'commands',
-  'plugins',
-  'runtime',
-]
-
-/**
- * Parse --components flag into a Set.
- * @param {string|string[]} spec - Comma-separated string or array of component names
- * @returns {Set<string>}
- */
-export function resolveComponents(spec) {
-  if (Array.isArray(spec)) return new Set(spec)
-  return new Set(spec.split(',').map((s) => s.trim()))
-}

package/scripts/install/migrate-config.mjs

@@ -1,302 +0,0 @@
-#!/usr/bin/env node
-/**
- * migrate-config.mjs — Standalone migration CLI with checkpoint crash recovery
- *
- * Runs configuration migrations with an atomic checkpoint system.
- * If the process crashes mid-migration, the checkpoint file persists
- * so that --resume picks up where it left off.
- *
- * Usage:
- *   node scripts/install/migrate-config.mjs --from=1.1.0 --to=1.1.1 --target=~/.config/opencode
- *   node scripts/install/migrate-config.mjs --resume --target=~/.config/opencode
- *   node scripts/install/migrate-config.mjs --list --target=~/.config/opencode
- *   node scripts/install/migrate-config.mjs --dry-run --from=1.1.0 --to=1.1.1
- */
-
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
-import { join } from 'node:path'
-import {
-  advanceCheckpoint,
-  listAppliedMigrations,
-  readCheckpoint,
-  removeCheckpoint,
-  resumePendingMigration,
-  writeCheckpoint,
-} from './migrate.mjs'
-import {
-  addMigrationRecord,
-  createInitialState,
-  readState,
-  updateVersion,
-  writeState,
-} from './state.mjs'
-
-// ---------------------------------------------------------------------------
-// Migration step definitions
-// Each step is an idempotent function(target, state, { dryRun }) => void
-// ---------------------------------------------------------------------------
-
-const MIGRATION_STEPS = {
-  /**
-   * migrate_state_v2: Upgrade install-state.json from schema v1 to v2.
-   * Adds schema_version field, components tracking, and migration history.
-   */
-  migrate_state_v2: (target, state, { dryRun }) => {
-    if (state.schema_version && state.schema_version >= 2) {
-      return
-    }
-    if (!dryRun) {
-      state.schema_version = 2
-      state.components = state.components || {
-        agents: { version: 1, status: 'pending' },
-        skills: { version: 1, status: 'pending' },
-        plugins: { version: 1, status: 'pending' },
-        runtime: { version: 1, status: 'pending' },
-      }
-      state.applied_migrations = state.applied_migrations || []
-      state.migration_checkpoint = null
-    }
-  },
-
-  /**
-   * update_schema: Ensure all v2 schema fields exist with defaults.
-   */
-  update_schema: (target, state, { dryRun }) => {
-    if (!dryRun) {
-      if (!state.components) {
-        state.components = {
-          agents: { version: 1, status: 'pending' },
-          skills: { version: 1, status: 'pending' },
-          plugins: { version: 1, status: 'pending' },
-          runtime: { version: 1, status: 'pending' },
-        }
-      }
-      for (const key of ['agents', 'skills', 'plugins', 'runtime']) {
-        if (!state.components[key]) {
-          state.components[key] = { version: 1, status: 'pending' }
-        }
-      }
-      state.applied_migrations = state.applied_migrations || []
-      if (state.migration_checkpoint === undefined) {
-        state.migration_checkpoint = null
-      }
-    }
-  },
-
-  /**
-   * migrate_plugins: Normalize plugin component tracking.
-   */
-  migrate_plugins: (target, state, { dryRun }) => {
-    if (!dryRun) {
-      if (!state.components) state.components = {}
-      const p = state.components.plugins || { version: 1, status: 'pending' }
-      p.version = Math.max(p.version || 0, 1)
-      state.components.plugins = p
-    }
-  },
-}
-
-// ---------------------------------------------------------------------------
-// Migration step ordering (a step runs ONLY after all predecessors complete)
-// ---------------------------------------------------------------------------
-
-const STEP_ORDER = Object.keys(MIGRATION_STEPS)
-
-/**
- * Resolve which steps to run based on from/to version comparison.
- * For now, runs all steps. In the future this can be gated by version.
- * @param {string} fromVersion
- * @param {string} toVersion
- * @returns {string[]} Ordered list of step names
- */
-function resolveSteps(fromVersion, toVersion) {
-  return [...STEP_ORDER]
-}
-
-// ---------------------------------------------------------------------------
-// CLI
-// ---------------------------------------------------------------------------
-
-function parseArgs() {
-  const args = process.argv.slice(2)
-  const result = {
-    from: null,
-    to: null,
-    target: process.cwd(),
-    dryRun: false,
-    resume: false,
-    list: false,
-    help: false,
-  }
-
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i]
-    if (arg === '--dry-run') result.dryRun = true
-    else if (arg === '--resume') result.resume = true
-    else if (arg === '--list') result.list = true
-    else if (arg === '--help' || arg === '-h') result.help = true
-    else if (arg.startsWith('--from=')) result.from = arg.split('=', 2)[1]
-    else if (arg.startsWith('--to=')) result.to = arg.split('=', 2)[1]
-    else if (arg.startsWith('--target=')) result.target = arg.split('=', 2)[1]
-    else if (arg === '--from') result.from = args[++i]
-    else if (arg === '--to') result.to = args[++i]
-    else if (arg === '--target') result.target = args[++i]
-  }
-
-  return result
-}
-
-function showHelp() {
-  console.log(`
-migrate-config.mjs — Pantheon configuration migration CLI
-
-Usage:
-  node scripts/install/migrate-config.mjs --from=1.1.0 --to=1.1.1 --target=~/.config/opencode
-  node scripts/install/migrate-config.mjs --resume --target=~/.config/opencode
-  node scripts/install/migrate-config.mjs --list --target=~/.config/opencode
-  node scripts/install/migrate-config.mjs --dry-run --from=1.1.0 --to=1.1.1
-  node scripts/install/migrate-config.mjs --help
-
-Options:
-  --from=<version>  Source version (required for new migrations)
-  --to=<version>    Target version (required for new migrations)
-  --target=<path>   Installation directory (default: cwd)
-  --dry-run         Preview without writing
-  --resume          Resume from pending checkpoint (crash recovery)
-  --list            Show applied migration history
-  --help            Show this help
-
-Crash Recovery:
-  If the process is interrupted mid-migration, a checkpoint file is left
-  at .pantheon/.migration-checkpoint. Run with --resume to continue.
-`)
-}
-
-function main() {
-  const config = parseArgs()
-
-  if (config.help) {
-    showHelp()
-    return
-  }
-
-  // ── List mode ──
-  if (config.list) {
-    const history = listAppliedMigrations(config.target)
-    if (!history.currentVersion) {
-      console.log('  \u2139\uFE0F  No install state found in: ' + config.target)
-      return
-    }
-    console.log(`  Current version: ${history.currentVersion}`)
-    console.log(`  Previous version: ${history.previousVersion || 'N/A'}`)
-    console.log(`  Applied migrations: ${history.migrations.length}`)
-    for (const m of history.migrations) {
-      const icon =
-        m.status === 'completed'
-          ? '\u2705'
-          : m.status === 'rolled_back'
-            ? '\u{1F504}'
-            : '\u26A0\uFE0F'
-      console.log(`    ${icon} ${m.from} \u2192 ${m.to} [${m.status}] (${m.applied_at})`)
-    }
-    return
-  }
-
-  // ── Resume mode ──
-  if (config.resume) {
-    const cp = resumePendingMigration(config.target)
-    if (!cp) {
-      console.log('  \u23ED\uFE0F  No pending checkpoint found — nothing to resume')
-      return
-    }
-    config.from = cp.from
-    config.to = cp.to
-  } else {
-    if (!config.from || !config.to) {
-      console.error('\u274C --from and --to are required (or use --resume)')
-      showHelp()
-      process.exit(1)
-    }
-  }
-
-  // ── Read state ──
-  let state = readState(config.target)
-  if (!state) {
-    state = createInitialState(config.from)
-    console.log(`  \u{1F4DD} Creating new install state (v${state.schema_version})`)
-    if (!config.dryRun) writeState(config.target, state)
-  } else {
-    console.log(
-      `  \u{1F4CB} Current state: v${state.schema_version}, version ${state.pantheon_version}`,
-    )
-  }
-
-  // ── Resolve checkpoint ──
-  let cp = readCheckpoint(config.target)
-
-  if (!cp) {
-    const steps = resolveSteps(config.from, config.to)
-    cp = writeCheckpoint(config.target, config.from, config.to, steps)
-    console.log(`  \u{1F4DD} Checkpoint written: ${config.from} \u2192 ${config.to}`)
-  } else {
-    console.log(
-      `  \u{1F504} Resuming from checkpoint (${cp.steps_completed.length} steps done, ${cp.steps_pending.length} remaining)`,
-    )
-  }
-
-  // ── Run pending steps ──
-  const stepsToRun = [...cp.steps_pending]
-  let failed = false
-
-  for (const step of stepsToRun) {
-    const stepFn = MIGRATION_STEPS[step]
-    if (!stepFn) {
-      console.warn(`  \u26A0\uFE0F  Unknown migration step: ${step} — skipping`)
-      if (!config.dryRun) {
-        advanceCheckpoint(config.target, step)
-      }
-      continue
-    }
-
-    console.log(`  \u25B6\uFE0F  Running: ${step}`)
-    try {
-      stepFn(config.target, state, { dryRun: config.dryRun })
-
-      if (!config.dryRun) {
-        advanceCheckpoint(config.target, step)
-        writeState(config.target, state)
-        console.log(`  \u2705 ${step} completed`)
-      } else {
-        console.log(`  \u2705 ${step} would complete (dry-run)`)
-      }
-    } catch (err) {
-      console.error(`  \u274C ${step} failed: ${err.message}`)
-      failed = true
-      break
-    }
-  }
-
-  // ── Finalize ──
-  if (failed) {
-    console.error(`\n  \u274C Migration failed at checkpoint.`)
-    console.error(
-      `     Resume with: node scripts/install/migrate-config.mjs --resume --target=${config.target}`,
-    )
-    process.exit(1)
-  }
-
-  if (!config.dryRun) {
-    updateVersion(state, config.to)
-    addMigrationRecord(state, config.from, config.to, 'completed')
-    removeCheckpoint(config.target)
-    writeState(config.target, state)
-    console.log(`\n  \u2705 Migration complete: ${config.from} \u2192 ${config.to}`)
-    console.log(`     State written to: ${join(config.target, '.pantheon', 'install-state.json')}`)
-  } else {
-    console.log(`\n  \u2705 Migration would complete (dry-run): ${config.from} \u2192 ${config.to}`)
-  }
-}
-
-if (process.argv[1] && import.meta.url === `file://${process.argv[1]}`) {
-  main()
-}

package/scripts/test-context-compression.sh

@@ -1,169 +0,0 @@
-#!/bin/bash
-# Test: Context Compression Pipeline
-# Simulates Themis APPROVED → triggers compress_context handoff
-#
-# Usage: bash scripts/test-context-compression.sh
-#
-# This script validates the prerequisites for the Level 2 context compression
-# pipeline and creates mock artifacts for end-to-end testing.
-
-set -euo pipefail
-
-echo "=== Context Compression Test ==="
-echo ""
-
-# Step 1: Verify prerequisites
-echo "[1/4] Checking prerequisites..."
-errors=0
-
-test -f skills/context-compression/SKILL.md || { echo "   ❌ SKILL.md not found"; errors=$((errors + 1)); }
-test -f agents/mnemosyne.agent.md || { echo "   ❌ mnemosyne.agent.md not found"; errors=$((errors + 1)); }
-test -f agents/zeus.agent.md || { echo "   ❌ zeus.agent.md not found"; errors=$((errors + 1)); }
-test -f routing.yml || { echo "   ❌ routing.yml not found"; errors=$((errors + 1)); }
-test -f skills/artifact-management/SKILL.md || { echo "   ❌ artifact-protocol.instructions.md not found"; errors=$((errors + 1)); }
-test -f .pantheon/memory-bank/01-active-context.md || { echo "   ❌ active-context.md not found"; errors=$((errors + 1)); }
-test -d .pantheon/memory-bank/.tmp || mkdir -p .pantheon/memory-bank/.tmp
-
-if [ -f scripts/scrub-secrets.py ]; then
-    echo "   ✅ scrub-secrets.py found (217 lines, $(grep -c 'def ' scripts/scrub-secrets.py || echo 0) functions)"
-else
-    echo "   ⚠️  scrub-secrets.py not found (will skip scrubbing)"
-fi
-
-# Verify compress_context handoff in routing.yml
-if grep -q "compress_context" routing.yml; then
-    HANDOFF_LINE=$(grep -n "compress_context" routing.yml | head -1 | cut -d: -f1)
-    echo "   ✅ compress_context handoff found in routing.yml at line $HANDOFF_LINE"
-else
-    echo "   ❌ compress_context handoff missing from routing.yml"
-    errors=$((errors + 1))
-fi
-
-# Verify ZZ artifact mention in artifact-protocol
-if grep -q "ZZ-phase" skills/artifact-management/SKILL.md; then
-    echo "   ✅ ZZ artifact format documented in artifact-protocol.instructions.md"
-else
-    echo "   ❌ ZZ artifact format missing from artifact-protocol.instructions.md"
-    errors=$((errors + 1))
-fi
-
-# Verify context-compression trigger was added to zeus.agent.md
-if grep -q "Context Compression Trigger" agents/zeus.agent.md; then
-    echo "   ✅ Context Compression Trigger section present in zeus.agent.md"
-else
-    echo "   ⚠️  Context Compression Trigger section not yet in zeus.agent.md"
-fi
-
-if [ "$errors" -gt 0 ]; then
-    echo "   ❌ $errors prerequisite(s) missing — aborting"
-    exit 1
-fi
-echo "   ✅ All prerequisites met"
-echo ""
-
-# Step 2: Create a mock IMPL artifact for testing
-echo "[2/4] Creating mock IMPL artifact..."
-
-cat > .pantheon/memory-bank/.tmp/IMPL-test-phase-hermes.md << 'ARTIFACT'
-# IMPL-test-phase-hermes
-**Date:** 2026-06-26  **Status:** Awaiting Compression Test
-
-## What Was Implemented
-- test/file.py — mock implementation for compression test
-- test/schema.py — mock schema migration for priority scoring test
-
-## Tests
-- ✅ 5 tests passing / Coverage: 87%
-
-## Notes for Themis
-This is a test artifact to validate the compression pipeline end-to-end.
-ARTIFACT
-
-cat > .pantheon/memory-bank/.tmp/IMPL-test-phase-demeter.md << 'ARTIFACT'
-# IMPL-test-phase-demeter
-**Date:** 2026-06-26  **Status:** Awaiting Compression Test
-
-## What Was Implemented
-- backend/migrations/0013_add_refresh_tokens.py — new refresh_tokens table
-- backend/models/token.py — Token model with FK to users
-
-## Tests
-- ✅ Migration tested: upgrade + downgrade both verified
-
-## Notes for Themis
-New table: refresh_tokens with (user_id, token_hash, expires_at, revoked_at)
-ARTIFACT
-
-echo "   ✅ 2 mock artifacts created (hermes + demeter)"
-echo ""
-
-# Step 3: Create mock subtask_summary for compression
-echo "[3/4] Creating mock subtask summaries..."
-
-cat > .pantheon/memory-bank/.tmp/subtask-hermes.json << 'JSON'
-{
-  "files_changed": ["test/file.py", "test/schema.py"],
-  "summary": "Added JWT auth endpoint with refresh token rotation",
-  "tests": "✅ All passing",
-  "coverage": "87%",
-  "status": "complete",
-  "blockers": null
-}
-JSON
-
-cat > .pantheon/memory-bank/.tmp/subtask-demeter.json << 'JSON'
-{
-  "files_changed": ["backend/migrations/0013_add_refresh_tokens.py", "backend/models/token.py"],
-  "summary": "Created refresh_tokens table with FK to users, hashed token, expires_at, revoked_at",
-  "tests": "✅ Migration upgrade + downgrade verified",
-  "coverage": "100%",
-  "status": "complete",
-  "blockers": null
-}
-JSON
-
-echo "   ✅ 2 mock subtask summaries created"
-echo ""
-
-# Step 4: Verify .tmp structure is writable and correct
-echo "[4/4] Verifying .tmp structure..."
-ls -la .pantheon/memory-bank/.tmp/
-echo ""
-echo "   ✅ .tmp structure looks correct"
-echo ""
-
-# Step 5: Validate scrub-secrets.py works
-echo "[5/4] Testing scrub-secrets.py (bonus)..."
-if [ -f scripts/scrub-secrets.py ]; then
-    # Test with a simple secret. The token is assembled at runtime so the
-    # shipped script never contains a literal `Bearer <token>` sequence (the
-    # redaction gate flags any such literal as a credential).
-    SCRUB_FIXTURE_TOKEN="my-test-token-12345"
-    SECRET_TEST=$(echo "Bearer ${SCRUB_FIXTURE_TOKEN}" | python3 scripts/scrub-secrets.py --stdin 2>/dev/null)
-    if echo "$SECRET_TEST" | grep -q "REDACTED"; then
-        echo "   ✅ scrub-secrets.py: secret detection working"
-    else
-        echo "   ⚠️  scrub-secrets.py: did not detect test secret (may need different pattern)"
-    fi
-fi
-echo ""
-
-echo "=== Test Complete ==="
-echo ""
-echo "Mock artifacts ready for compression pipeline test."
-echo ""
-echo "Next manual step: Trigger compress_context handoff:"
-echo "  @mnemosyne Run compression pipeline with test artifacts"
-echo ""
-echo "Expected output:"
-echo "  - .pantheon/memory-bank/.tmp/ZZ-test-context.md"
-echo "  - Updated 01-active-context.md with compressed entries"
-echo "  - Updated 02-progress-log.md with archived mock artifact"
-echo ""
-echo "Scoring verification (expected):"
-echo "  - subtask-hermes.json: JWT + endpoint + token keywords → HIGH (score ~0.71)"
-echo "  - subtask-demeter.json: migration + new table + FK keywords → CRITICAL (score ~0.83)"
-echo ""
-echo "To clean up test artifacts:"
-echo "  rm .pantheon/memory-bank/.tmp/IMPL-test-phase-*.md"
-echo "  rm .pantheon/memory-bank/.tmp/subtask-*.json"