pantheon-opencode 1.5.1 → 1.5.2

package/CHANGELOG.md

@@ -18,6 +18,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## ✅ Closed Issues
 
+## [v1.5.2] - 2026-09-22
+
+## 🐞 Fixed
+- **install** — guard undefined collection in init (#174)
+- **release** — compare Zenodo file checksum in the format the API returns (#173)
 ## [v1.5.1] - 2026-09-22
 
 ## 🐞 Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pantheon-opencode",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "description": "Multi-agent orchestration for OpenCode — 14 specialized agents, TDD, Themis review gates.",
   "type": "module",
   "publishConfig": {

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pantheon",
   "publisher": "ils15",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "displayName": "Pantheon",
   "description": "Conductor-Delegate orchestration platform with 14 specialized agents, 21 skills, and OpenCode support.",
   "agents": "./src/agents",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.backends._legacy:_Backend"
 
 [project]
 name = "pantheon"
-version = "1.5.1"
+version = "1.5.2"
 description = "Multi-agent orchestration framework"
 requires-python = ">=3.11"
 dependencies = []

package/scripts/install/state.mjs

@@ -108,7 +108,32 @@ export function upgradeStateV1toV2(state) {
 }
 
 /**
- * Normalize any state to v2 (handles v1 → v2 upgrade).
+ * Guarantee the required v2 collections exist on a state object.
+ *
+ * A schema-v2 entry may be written by a partial writer — e.g. the postinstall
+ * version marker in sync-tui.mjs persisted only `pantheon_version` /
+ * `previous_version`, and writeState() then stamped it `schema_version: 2`.
+ * Such an entry has no `applied_migrations`, so the next `init` crashed in
+ * runMigrations() with
+ * "Cannot read properties of undefined (reading 'push')".
+ * Backfill the collections on read instead of trusting every writer.
+ * @param {object} state
+ * @returns {object} the same state object with required collections present
+ */
+function ensureV2Shape(state) {
+  if (!Array.isArray(state.applied_migrations)) state.applied_migrations = []
+  if (
+    !state.components ||
+    typeof state.components !== 'object' ||
+    Array.isArray(state.components)
+  ) {
+    state.components = upgradeStateV1toV2(state).components
+  }
+  return state
+}
+
+/**
+ * Normalize any state to v2 (handles v1 → v2 upgrade and partial v2 markers).
  * @param {object} state
  * @returns {object|null}
  */
@@ -116,7 +141,7 @@ function normalizeState(state) {
   if (!state || typeof state !== 'object') return null
   if (isV1State(state)) return upgradeStateV1toV2(state)
   if (!state.schema_version || state.schema_version < 2) return upgradeStateV1toV2(state)
-  return state
+  return ensureV2Shape(state)
 }
 
 /**

package/scripts/sync-tui.mjs

@@ -193,7 +193,7 @@ async function main() {
     // The plugin references in opencode.json already point INTO this package,
     // so only the copies would go stale after a package update.
     const { syncCopyArtifacts } = await import('./sync-artifacts.mjs')
-    const { readState, writeState } = await import('./install/state.mjs')
+    const { createInitialState, readState, writeState } = await import('./install/state.mjs')
     const pkgVersion = readVersion(join(ROOT, 'package.json')) ?? 'unknown'
     const synced = syncCopyArtifacts(configDir)
     if (synced.errors.length > 0) {
@@ -206,10 +206,16 @@ async function main() {
     // venv, MCP entries).
     try {
       const previous = readState(configDir)
-      writeState(configDir, {
-        pantheon_version: pkgVersion,
-        previous_version: previous?.pantheon_version ?? null,
-      })
+      // Preserve the existing v2 manifest (applied_migrations, components, …).
+      // Writing a bare { pantheon_version, previous_version } object stamped
+      // it `schema_version: 2` while dropping `applied_migrations`, and the
+      // next `init` crashed in runMigrations() reading `.push` on undefined.
+      const state = previous ?? createInitialState(pkgVersion)
+      if (previous?.pantheon_version && previous.pantheon_version !== pkgVersion) {
+        state.previous_version = previous.pantheon_version
+      }
+      state.pantheon_version = pkgVersion
+      writeState(configDir, state)
       if (previous?.pantheon_version && previous.pantheon_version !== pkgVersion) {
         console.log(
           `  ⚠️  Installation moved ${previous.pantheon_version} → ${pkgVersion}. ` +

package/scripts/zenodo-artifact.mjs

@@ -1,11 +1,75 @@
 import { createHash } from 'node:crypto'
 import { readFileSync } from 'node:fs'
 
+/** Hex digest length for every algorithm the Zenodo deposition API may report. */
+const DIGEST_LENGTH = { md5: 32, sha256: 64 }
+
 export function sha256File(path) {
   return createHash('sha256').update(readFileSync(path)).digest('hex')
 }
 
-export function findZenodoFile(record, filename, checksum) {
+export function md5File(path) {
+  return createHash('md5').update(readFileSync(path)).digest('hex')
+}
+
+/**
+ * Normalize a file checksum as returned by the Zenodo deposition files API.
+ *
+ * Zenodo computes an MD5 for every deposited file (developers.zenodo.org,
+ * "Deposition File" representation: "MD5 checksum of file, computed by our
+ * system"). The API emits it both as `md5:<hex>` and, because of a legacy
+ * serialization bug kept for backward compatibility (zenodo/zenodo#628), as a
+ * bare 32-character hex string without any algorithm prefix — the exact payload
+ * that broke the v1.5.1 run (e.g. `d3359dca2f998da8461abb3b84a32b6c`).
+ *
+ * A bare 64-character digest is treated as SHA-256, so if the API ever upgrades
+ * its algorithm the upload is still verified with a strong digest rather than
+ * accepted blindly. Anything unrecognized fails closed.
+ */
+export function parseZenodoChecksum(value) {
+  if (typeof value !== 'string') throw new Error('Zenodo file checksum is missing.')
+  const match = value
+    .trim()
+    .toLowerCase()
+    .match(/^(?:(md5|sha256):)?([0-9a-f]+)$/)
+  if (!match) throw new Error(`Unrecognized Zenodo checksum format: ${value}.`)
+  const algorithm =
+    match[1] ??
+    (match[2].length === DIGEST_LENGTH.md5
+      ? 'md5'
+      : match[2].length === DIGEST_LENGTH.sha256
+        ? 'sha256'
+        : null)
+  if (!algorithm) throw new Error(`Unrecognized Zenodo checksum length: ${value}.`)
+  if (match[2].length !== DIGEST_LENGTH[algorithm])
+    throw new Error(`Zenodo checksum length does not match ${algorithm}: ${value}.`)
+  return { algorithm, digest: match[2] }
+}
+
+function expectedDigests(expected) {
+  const provided = {}
+  if (typeof expected === 'string') {
+    const { algorithm, digest } = parseZenodoChecksum(expected)
+    provided[algorithm] = digest
+  } else if (expected && typeof expected === 'object') {
+    for (const [algorithm, digest] of Object.entries(expected)) {
+      if (digest === undefined || digest === null || digest === '') continue
+      if (!(algorithm in DIGEST_LENGTH))
+        throw new Error(`Unsupported local checksum algorithm: ${algorithm}.`)
+      if (
+        typeof digest !== 'string' ||
+        !new RegExp(`^[0-9a-f]{${DIGEST_LENGTH[algorithm]}}$`, 'i').test(digest.trim())
+      )
+        throw new Error(`Invalid local ${algorithm} checksum for verification.`)
+      provided[algorithm] = digest.trim().toLowerCase()
+    }
+  }
+  if (Object.keys(provided).length === 0)
+    throw new Error('A local checksum is required to verify the Zenodo upload.')
+  return provided
+}
+
+export function findZenodoFile(record, filename, expected) {
   if (!record || typeof record !== 'object' || !Array.isArray(record.files)) {
     throw new Error('Zenodo record did not contain a files array.')
   }
@@ -13,9 +77,18 @@ export function findZenodoFile(record, filename, checksum) {
   if (matches.length > 1) throw new Error(`Zenodo record contains duplicate file: ${filename}.`)
   if (matches.length === 0) return null
   const file = matches[0]
-  const expected = `sha256:${checksum}`
-  if (file.checksum !== expected) {
-    throw new Error(`Zenodo checksum mismatch for ${filename}.`)
+  const { algorithm, digest } = parseZenodoChecksum(file.checksum)
+  const provided = expectedDigests(expected)
+  const reference = provided[algorithm]
+  if (!reference) {
+    throw new Error(
+      `Zenodo reported a ${algorithm} checksum for ${filename} but no local ${algorithm} checksum was provided.`,
+    )
+  }
+  if (digest !== reference) {
+    throw new Error(
+      `Zenodo ${algorithm} checksum mismatch for ${filename}: expected ${reference}, received ${digest}.`,
+    )
   }
   return file
 }

package/src/plugins/tui/dist/tui.js

@@ -165,7 +165,7 @@ async function detectVersion(api) {
 			if (ver) return ver;
 		}
 	} catch {}
-	return "1.5.1";
+	return "1.5.2";
 }
 /**
 * usage-bar — AI subscription usage gauge for the opencode TUI.

package/src/plugins/tui/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pantheon-tui",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pantheon-tui",
-      "version": "1.5.1",
+      "version": "1.5.2",
       "license": "MIT",
       "dependencies": {
         "@opencode-ai/plugin": ">=1.14.0",

package/src/plugins/tui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pantheon-tui",
   "type": "module",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "description": "Pantheon TUI plugin — sidebar (version, preset, sessions, real-time delegations) + AI subscription usage gauges incl. OpenCode Go/Zen dollar limits (vendored, MIT)",
   "license": "MIT",
   "engines": {