pantheon-opencode 1.5.0-beta.9 → 1.5.0

package/src/pantheon/auto-wake.ts

@@ -1,85 +0,0 @@
-/**
- * Auto-Wake Consumer — scans signal files from the BackgroundJobBoard
- * and returns completed job signals for Zeus to process.
- *
- * Signal files are created by the board on every terminal state transition
- * (completed/error/cancelled). This module consumes them atomically by
- * reading the `.signal.json` content, then renaming to `.consumed.json`,
- * preventing race conditions where the same signal is processed twice.
- *
- * The rename is the commit point: if Zeus crashes between the read and the
- * rename, the `.signal.json` file remains and will be re-processed on restart.
- * This gives **at-least-once** delivery, which is acceptable because the board's
- * `markReconciled()` is idempotent.
- *
- * @module auto-wake
- */
-
-import { existsSync } from 'node:fs'
-import { readdir, readFile, rename } from 'node:fs/promises'
-import { join } from 'node:path'
-
-/** Signal structure written by BackgroundJobBoard.writeSignal(). */
-export interface WakeSignal {
-  taskID: string
-  alias: string
-  agent: string
-  state: string
-  summary: string | null
-  timestamp: number
-}
-
-/** Default signal directory (matches BoardOptions.signalDir default in plugin.ts). */
-const DEFAULT_SIGNAL_DIR = '.pantheon/deepwork/board-signals'
-
-/**
- * Scan the signal directory for `*.signal.json` files, atomically consume
- * each by renaming to `*.consumed.json`, and return the parsed signals.
- *
- * Safe to call multiple times — already-consumed files (`.consumed.json`)
- * are ignored, and the atomic rename prevents double-processing.
- *
- * The flow per signal file:
- * 1. Read the `.signal.json` content
- * 2. Rename `.signal.json` → `.consumed.json` (atomic: OS-level rename)
- * 3. If rename succeeds, push the signal into the result
- * 4. If rename fails (another process consumed it first), skip
- *
- * @param signalDir  Directory to scan (default: `.pantheon/deepwork/board-signals`)
- * @returns List of wake signals from newly consumed files
- */
-export async function consumeWakeSignals(signalDir?: string): Promise<WakeSignal[]> {
-  const dir = signalDir ?? DEFAULT_SIGNAL_DIR
-
-  // If the signal directory doesn't exist, there are no signals
-  if (!existsSync(dir)) {
-    return []
-  }
-
-  const entries = await readdir(dir, { withFileTypes: true })
-  const signals: WakeSignal[] = []
-
-  for (const entry of entries) {
-    if (!entry.isFile()) continue
-    if (!entry.name.endsWith('.signal.json')) continue
-
-    const signalPath = join(dir, entry.name)
-    const consumedName = entry.name.replace(/\.signal\.json$/, '.consumed.json')
-    const consumedPath = join(dir, consumedName)
-
-    try {
-      // Step 1: Read the file content
-      const content = await readFile(signalPath, 'utf-8')
-      const data = JSON.parse(content) as WakeSignal
-
-      // Step 2: Atomically rename — this is the commit point.
-      // If this fails, the .signal.json remains and we'll retry next call.
-      await rename(signalPath, consumedPath)
-
-      // Step 3: Only add to results after successful rename
-      signals.push(data)
-    } catch {}
-  }
-
-  return signals
-}

package/src/pantheon/chat-reminders.ts

@@ -1,9 +0,0 @@
-/**
- * Retired transcript-notification module.
- *
- * Delegation lifecycle state must not be queued for delivery into user
- * messages. Visibility is provided by the board/list/read tools and TUI
- * toasts; this intentionally exports no delivery API.
- *
- * @module chat-reminders
- */

package/src/pantheon/comment-checker.ts

@@ -1,48 +0,0 @@
-/**
- * Comment Checker — detects trivial/auto-generated comments that make code
- * look machine-produced rather than human-written.
- *
- * Used by @themis (Layer 1: Surface review) to flag comments that add no
- * information value and signal AI-generated code.
- */
-
-/** Regex patterns matching trivial, uninformative comments. */
-export const TRIVIAL_PATTERNS: readonly RegExp[] = [
-  /#\s*increment\s+\w+/i,
-  /#\s*decrement\s+\w+/i,
-  /#\s*set\s+\w+/i,
-  /#\s*loop\s+over/i,
-  /#\s*(initialize|init)\s+\w+/i,
-  /#\s*(return|yield)\s+\w+/i,
-]
-
-export interface CommentCheckResult {
-  /** Number of trivial comments found (0 = clean). */
-  score: number
-  /** Human-readable descriptions of each flagged comment. */
-  flags: string[]
-}
-
-/**
- * Scan source code for trivial comments that add no information value.
- *
- * Returns a score (count of trivial comments) and a list of flags describing
- * each match. A score of 0 means no trivial comments were detected.
- */
-export function checkCommentDensity(source: string): CommentCheckResult {
-  const flags: string[] = []
-  const lines = source.split('\n')
-
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i] as string
-    for (const pattern of TRIVIAL_PATTERNS) {
-      if (pattern.test(line)) {
-        const trimmed = line.trim()
-        flags.push(`Line ${i + 1}: trivial comment — "${trimmed}"`)
-        break // one flag per line, even if multiple patterns match
-      }
-    }
-  }
-
-  return { score: flags.length, flags }
-}

package/src/pantheon/compaction-assert.ts

@@ -1,160 +0,0 @@
-/**
- * Compaction Re-Assert (release-134 Phase 4) — detect fresh state after
- * compaction without writing to the chat transcript.
- *
- * WHY: after a session is compacted, the system state may have changed since
- * the summary was built (new background delegations launched, results
- * delivered, goals updated). The compacted session's context is frozen at
- * summary time — the model would operate on stale state.
- *
- * HOW: the compaction lifecycle keeps the board and goal stores authoritative;
- * the `experimental.session.compacting` hook builds the context that is
- * consumed by the compaction itself. Chat is never used as a delivery channel.
- *
- * Deliberately NOT `session.promptAsync({noReply:true})`: the sprint 4+7
- * spike refuted noReply as a push mechanism on this opencode build (nothing
- * is delivered to the parent).
- *
- * FAIL-OPEN: every source (board list and goals list) is wrapped —
- * a failure logs a warn via the silence-by-default logger and the hook never
- * throws. A session with NO fresh state (nothing running/unread/goals) is a
- * SILENT skip (no warn). The block is capped at
- * REASSERT_MAX_LINES item lines (1 header) so it stays compact.
- *
- * Pure TypeScript — zero runtime deps beyond the board/goal types.
- *
- * @module compaction-assert
- */
-import type { BackgroundJobBoard } from './background-job-board.ts'
-import type { CompactionGoalSource } from './delegation-compaction.ts'
-import { createPantheonLogger } from './logger.ts'
-
-// Silence-by-default TUI policy (pantheon-hooks L42-58): console echo is
-// opt-in via PANTHEON_HOOKS_LOG=1. `deps.logger` injection stays for tests.
-const log = createPantheonLogger({ module: 'pantheon-compaction' })
-
-// ─── Constants ─────────────────────────────────────────────────────────
-
-/** Max fresh-state item lines (running + unread + goals) in the block. */
-export const REASSERT_MAX_LINES = 10
-
-/** Header line — tells the model the summary may be stale. */
-export const REASSERT_HEADER = 'State re-assertion after compaction — the summary may be stale:'
-
-// ─── Types ─────────────────────────────────────────────────────────────
-
-/** Dependencies threaded to reassertAfterCompaction (wired from plugin.ts). */
-export interface CompactionAssertDeps {
-  /** The session whose compaction context is being prepared. */
-  sessionID: string
-  /** Board query surface — `list` is all the re-assertion needs. */
-  board: Pick<BackgroundJobBoard, 'list'>
-  /** Goal source for the goals block (optional — same gating as Phase 2). */
-  goals?: CompactionGoalSource
-  /** Injectable warn logger (testable). Defaults to silence-by-default. */
-  logger?: { warn: (message: string) => void }
-  /** Non-chat delivery sink (for example a pending `output.context` block). */
-  deliverContext?: (context: string[]) => void | Promise<void>
-}
-
-// ─── Formatting ────────────────────────────────────────────────────────
-
-/** One-line terminal status label, mirroring formatForPrompt. */
-function terminalLabel(state: string): string {
-  switch (state) {
-    case 'completed':
-      return 'OK'
-    case 'error':
-      return 'ERR'
-    case 'cancelled':
-      return 'CAN'
-    default:
-      return state.toUpperCase()
-  }
-}
-
-/** Collapse whitespace and truncate a description/objective. */
-function truncate(text: string, max = 80): string {
-  const flat = text.trim().replace(/\s+/g, ' ')
-  return flat.length <= max ? flat : `${flat.slice(0, max)}…`
-}
-
-// ─── Build ─────────────────────────────────────────────────────────────
-
-/**
- * Build the compact fresh-state lines: running delegations first (active work
- * is the freshest signal), then unread terminal delegations, then active
- * goals (only while the line budget allows). Returns undefined when there is
- * nothing to assert (silent skip) or a source failed (warn + skip).
- */
-async function buildStateLines(
-  deps: CompactionAssertDeps,
-  warn: (message: string) => void,
-): Promise<string[] | undefined> {
-  const lines: string[] = []
-  try {
-    const jobs = deps.board.list(deps.sessionID)
-    const running = jobs
-      .filter((j) => j.state === 'running')
-      .sort((a, b) => a.launchedAt - b.launchedAt)
-    const unread = jobs
-      .filter((j) => j.terminalUnreconciled)
-      .sort((a, b) => b.updatedAt - a.updatedAt)
-
-    for (const job of running) {
-      if (lines.length >= REASSERT_MAX_LINES) break
-      lines.push(`  running [${job.alias}] ${job.agent} — ${truncate(job.description)}`)
-    }
-    for (const job of unread) {
-      if (lines.length >= REASSERT_MAX_LINES) break
-      lines.push(
-        `  unread [${job.alias}] ${job.agent} — ${truncate(job.description)} — ${terminalLabel(job.state)}`,
-      )
-    }
-
-    const source = deps.goals
-    if (lines.length < REASSERT_MAX_LINES && source !== undefined && source.enabled) {
-      const goals = await source.list(deps.sessionID)
-      for (const goal of goals.filter((g) => g.status !== 'done')) {
-        if (lines.length >= REASSERT_MAX_LINES) break
-        lines.push(`  goal [${goal.id}] ${truncate(goal.objective)} — ${goal.status}`)
-      }
-    }
-  } catch (err: unknown) {
-    const reason = err instanceof Error ? err.message : String(err)
-    warn(`compaction re-assert failed for session ${deps.sessionID}: ${reason}`)
-    return undefined
-  }
-  return lines.length === 0 ? undefined : lines
-}
-
-/**
- * Re-assert fresh state for a compacted session and return the context block
- * to the non-chat caller. The caller can hand this array to OpenCode's
- * `output.context` or persist it through the board; constructing it here and
- * throwing it away would make the hook a no-op.
- *
- * Returns the fresh-state context when found, or undefined when there was
- * nothing to assert (silent skip) or a source failed (warned). NEVER throws —
- * the event hook must never break the session.
- */
-export async function reassertAfterCompaction(
-  deps: CompactionAssertDeps,
-): Promise<string[] | undefined> {
-  // Silence-by-default logger: file-only warn, console echo opt-in via
-  // PANTHEON_HOOKS_LOG=1 (TUI pollution policy, pantheon-hooks L42-58).
-  const warn = deps.logger?.warn ?? ((message: string) => log.warn(message))
-  try {
-    const lines = await buildStateLines(deps, warn)
-    if (lines === undefined) return undefined
-    // This is a context return value, not a chat message. The caller owns the
-    // supported delivery path (output.context or persisted board state).
-    const context = [REASSERT_HEADER, ...lines]
-    await deps.deliverContext?.(context)
-    return context
-  } catch (err: unknown) {
-    const reason = err instanceof Error ? err.message : String(err)
-    warn(`compaction re-assert failed for session ${deps.sessionID}: ${reason}`)
-    return undefined
-  }
-}

package/src/pantheon/compaction-handoff.ts

@@ -1,304 +0,0 @@
-/**
- * Compaction handoff coordinator.
- *
- * Coordinates the handoff of a compaction checkpoint from in-memory state to
- * durable persistence. The coordinator is deliberately dependency-free: it
- * does not import plugin, board, MCP, hooks, or provider modules.
- */
-
-export interface HandoffRecord {
-  digest: string
-  payload: string
-  version: number
-  sessionId: string
-  leaseToken: string
-}
-
-export interface PersistencePort {
-  prepare(input: HandoffRecord): Promise<void>
-  read(sessionId: string, key: string): Promise<HandoffRecord | null>
-  commit(sessionId: string, key: string, record: HandoffRecord): Promise<void>
-}
-
-export interface MemoryPort {
-  publishImmutable(sessionId: string, key: string, record: HandoffRecord): Promise<void>
-  readByIdempotencyKey(key: string): Promise<HandoffRecord | null>
-}
-
-export type HandoffStatus =
-  | 'COMMITTED'
-  | 'UNAVAILABLE'
-  | 'CONFLICT'
-  | 'NOT_SUPPORTED'
-  | 'INVALID_INPUT'
-
-/** Maximum allowed integer version value. */
-export const MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER
-
-/** Maximum encoded payload size in bytes (128 KiB). */
-export const MAX_PAYLOAD_BYTES = 65_536
-
-/** Maximum length of URL-safe identifiers. */
-export const MAX_ID_LENGTH = 128
-
-const URL_SAFE_PATTERN = /^[A-Za-z0-9._~-]+$/
-const DIGEST_PATTERN = /^[a-f0-9]{64}$/
-
-/** Validate a URL-safe identifier: 1-128 chars, no control characters. */
-function isValidIdentifier(value: unknown): value is string {
-  if (typeof value !== 'string') {
-    return false
-  }
-  if (value.length < 1 || value.length > MAX_ID_LENGTH) {
-    return false
-  }
-  if (value.length > 0 && !URL_SAFE_PATTERN.test(value)) {
-    return false
-  }
-  return true
-}
-
-/** Validate a lease token: 1-128 chars, no control characters. */
-function isValidLeaseToken(value: unknown): value is string {
-  if (typeof value !== 'string') {
-    return false
-  }
-  if (value.length < 1 || value.length > MAX_ID_LENGTH) {
-    return false
-  }
-  for (const char of value) {
-    const code = char.charCodeAt(0)
-    if (code < 0x20 || code === 0x7f) {
-      return false
-    }
-  }
-  return true
-}
-
-/** Validate a positive integer version within the safe integer range. */
-function isValidVersion(value: unknown): value is number {
-  return (
-    typeof value === 'number' && Number.isInteger(value) && value > 0 && value <= MAX_SAFE_INTEGER
-  )
-}
-
-/** Validate a 64-character lowercase hex digest. */
-function isValidDigest(value: unknown): value is string {
-  return typeof value === 'string' && DIGEST_PATTERN.test(value)
-}
-
-/**
- * Validate that a payload is UTF-8 encodable and contains no NUL or control
- * characters (tab, LF, and CR are permitted).
- */
-function isValidPayload(value: unknown): value is string {
-  if (typeof value !== 'string') {
-    return false
-  }
-  if (value.length < 1 || value.length > MAX_PAYLOAD_BYTES) {
-    return false
-  }
-
-  const bytes = Buffer.byteLength(value, 'utf8')
-  if (bytes < 1 || bytes > MAX_PAYLOAD_BYTES) {
-    return false
-  }
-  if (value.includes('\0')) {
-    return false
-  }
-
-  for (const char of value) {
-    const code = char.charCodeAt(0)
-    if (code < 0x20 && code !== 0x09 && code !== 0x0a && code !== 0x0d) {
-      return false
-    }
-  }
-  return true
-}
-
-/**
- * Compute the digest over the exact UTF-8 encoded bytes of a payload.
- */
-export function computeDigest(payload: string): string {
-  const bytes = Buffer.from(payload, 'utf8')
-  let hash = ''
-  for (const byte of bytes) {
-    hash += byte.toString(16).padStart(2, '0')
-  }
-  return hash
-}
-
-/** Create a result describing a failed validation. */
-function invalid(message: string): { status: 'INVALID_INPUT'; message: string } {
-  return { status: 'INVALID_INPUT', message }
-}
-
-/** Create a result describing a missing dependency. */
-function notSupported(): { status: 'NOT_SUPPORTED' } {
-  return { status: 'NOT_SUPPORTED' }
-}
-
-/** Create a result describing a conflict. */
-function conflict(message: string): { status: 'CONFLICT'; message: string } {
-  return { status: 'CONFLICT', message }
-}
-
-/** Create a result describing an unavailable memory port. */
-function unavailable(message: string): { status: 'UNAVAILABLE'; message: string } {
-  return { status: 'UNAVAILABLE', message }
-}
-
-/** Create a successful committed result. */
-function committed(digest: string): { status: 'COMMITTED'; digest: string } {
-  return { status: 'COMMITTED', digest }
-}
-
-/**
- * Compaction handoff coordinator.
- *
- * The coordinator drives the handoff FSM:
- *
- *   no record -> prepare -> PREPARED -> memory.publishImmutable
- *   -> memory.readByIdempotencyKey -> persistence.commit -> COMMITTED
- *
- * It never retries after memory becomes unavailable; the PREPARED state is
- * left intact for a later explicit attempt.
- */
-export class CompactionHandoffCoordinator {
-  private readonly persistence: PersistencePort | undefined
-  private readonly memory: MemoryPort | undefined
-
-  constructor(persistence?: PersistencePort, memory?: MemoryPort) {
-    this.persistence = persistence
-    this.memory = memory
-  }
-
-  /**
-   * Attempt to hand off a compaction checkpoint.
-   *
-   * Returns immediately with INVALID_INPUT if any argument fails validation.
-   * Returns NOT_SUPPORTED if either required port is missing.
-   * Returns CONFLICT for digest or lease/version mismatches.
-   * Returns UNAVAILABLE if the memory port cannot publish/read the record.
-   * Returns COMMITTED when the record is durably committed.
-   */
-  async prepare(
-    sessionId: string,
-    idempotencyKey: string,
-    leaseToken: string,
-    version: number,
-    digest: string,
-    payload: string,
-  ): Promise<{ status: HandoffStatus; key?: string; digest?: string; message?: string }> {
-    // Validation first: no port calls are made before this block completes.
-    if (
-      !isValidIdentifier(sessionId) ||
-      !isValidIdentifier(idempotencyKey) ||
-      !isValidLeaseToken(leaseToken) ||
-      !isValidVersion(version) ||
-      !isValidDigest(digest) ||
-      !isValidPayload(payload)
-    ) {
-      return invalid('Invalid handoff input')
-    }
-
-    if (this.persistence === undefined || this.memory === undefined) {
-      return notSupported()
-    }
-
-    const _key = `${sessionId}:${idempotencyKey}`
-
-    // Check for an existing committed record before preparing a new one.
-    const existingRecord = await this.persistence.read(sessionId, idempotencyKey)
-    if (existingRecord !== null) {
-      if (existingRecord.digest === digest && existingRecord.sessionId === sessionId) {
-        // Idempotent replay: same digest and session. Verify lease/version match.
-        if (existingRecord.leaseToken !== leaseToken || existingRecord.version !== version) {
-          return conflict('Stale lease or version')
-        }
-
-        // Verify the record is also in memory. If missing, try to recover by publishing once.
-        let memoryRecord: HandoffRecord | null = null
-        try {
-          memoryRecord = await this.memory.readByIdempotencyKey(idempotencyKey)
-        } catch {
-          return unavailable('Memory port unavailable')
-        }
-
-        if (memoryRecord === null) {
-          // Recovery: memory lost the record but persistence has it. Publish once.
-          try {
-            await this.memory.publishImmutable(sessionId, idempotencyKey, existingRecord)
-          } catch (_error) {
-            return unavailable('Memory port unavailable')
-          }
-          try {
-            memoryRecord = await this.memory.readByIdempotencyKey(idempotencyKey)
-          } catch (_error) {
-            return unavailable('Memory port unavailable')
-          }
-        }
-
-        if (memoryRecord === null) {
-          return unavailable('Record not found in memory')
-        }
-
-        await this.persistence.commit(sessionId, idempotencyKey, existingRecord)
-        return committed(memoryRecord.digest)
-      }
-      // Different digest or session: conflict.
-      return conflict('Digest or session mismatch')
-    }
-
-    // Phase 1: prepare in persistence (PREPARED).
-    await this.persistence.prepare({ digest, payload, version, sessionId, leaseToken })
-
-    // Phase 2: publish the record to memory. If memory is unavailable, the
-    // coordinator stays in PREPARED and never retries automatically.
-    try {
-      await this.memory.publishImmutable(sessionId, idempotencyKey, {
-        digest,
-        payload,
-        version,
-        sessionId,
-        leaseToken,
-      })
-    } catch (_error) {
-      return unavailable('Memory port unavailable')
-    }
-
-    // Phase 3: read back from memory by idempotency key.
-    let memoryRecord: HandoffRecord | null = null
-    try {
-      memoryRecord = await this.memory.readByIdempotencyKey(idempotencyKey)
-    } catch (_error) {
-      return unavailable('Memory port unavailable')
-    }
-
-    if (memoryRecord === null) {
-      return unavailable('Record not found in memory')
-    }
-
-    // Stale lease or version check.
-    if (memoryRecord.leaseToken !== leaseToken || memoryRecord.version !== version) {
-      return conflict('Stale lease or version')
-    }
-
-    // Idempotent replay: same key and session is a success.
-    // The memory record is authoritative for recovery after crash.
-    if (memoryRecord.sessionId === sessionId) {
-      // Phase 4: commit to persistence.
-      try {
-        await this.persistence.commit(sessionId, idempotencyKey, memoryRecord)
-      } catch (_error) {
-        return conflict('Persistence commit failed')
-      }
-      return committed(memoryRecord.digest)
-    }
-
-    // Same key, different digest or session: conflict.
-    return conflict('Digest or session mismatch')
-  }
-}
-
-export default CompactionHandoffCoordinator