pantheon-opencode 1.5.2 → 1.6.0-beta.1

package/scripts/validate-zenodo-release.mjs

@@ -1,154 +0,0 @@
-#!/usr/bin/env node
-/** Validate the immutable inputs used by the GitHub Release → Zenodo workflow. */
-
-import { existsSync, readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { pathToFileURL } from 'node:url'
-import { compareVersions } from './version-check.mjs'
-
-const SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/
-
-function validateHttpsUrl(value, name) {
-  let url
-  try {
-    url = new URL(value)
-  } catch {
-    throw new Error(`${name} must be an absolute HTTPS URL.`)
-  }
-  if (
-    url.protocol !== 'https:' ||
-    !url.hostname ||
-    url.username ||
-    url.password ||
-    /%(?![0-9A-Fa-f]{2})/.test(value) ||
-    /[\s{}\\|^`]/.test(value)
-  ) {
-    throw new Error(`${name} must be an absolute HTTPS URL without credentials.`)
-  }
-  return url
-}
-
-function maskHost(hostname) {
-  if (hostname.length <= 2) return '***'
-  return `${hostname[0]}***${hostname.at(-1)}`
-}
-
-export function summarizeZenodoConfiguration({
-  depositionsUrl,
-  filesUrlTemplate,
-  publishUrlTemplate,
-  creatorName,
-}) {
-  const values = [
-    ['ZENODO_DEPOSITIONS_URL', depositionsUrl, true],
-    ['ZENODO_FILES_URL_TEMPLATE', filesUrlTemplate, true],
-    ['ZENODO_PUBLISH_URL_TEMPLATE', publishUrlTemplate, true],
-    ['ZENODO_CREATOR_NAME', creatorName, false],
-  ]
-  return values.map(([name, value, isUrl]) => {
-    if (typeof value !== 'string' || !value) return { name, present: false }
-    if (!isUrl) return { name, present: true }
-    try {
-      const url = new URL(value.replaceAll('{id}', '1'))
-      return {
-        name,
-        present: true,
-        protocol: url.protocol,
-        host: maskHost(url.hostname),
-        hasWhitespace: /\s/.test(value),
-        hasCredentials: Boolean(url.username || url.password),
-      }
-    } catch {
-      return {
-        name,
-        present: true,
-        protocol: 'invalid',
-        host: '***',
-        hasWhitespace: /\s/.test(value),
-      }
-    }
-  })
-}
-
-export function zenodoTemplateUrl(template, id, name = 'Zenodo URL template') {
-  if (!Number.isSafeInteger(id) || id <= 0) throw new Error('Zenodo deposition id is invalid.')
-  if (typeof template !== 'string' || !template.includes('{id}'))
-    throw new Error(`${name} must contain the {id} placeholder.`)
-  return validateHttpsUrl(template.replaceAll('{id}', String(id)), name).href
-}
-
-export function zenodoDepositionUrl(depositionsUrl, id) {
-  if (!Number.isSafeInteger(id) || id <= 0) throw new Error('Zenodo deposition id is invalid.')
-  if (typeof depositionsUrl !== 'string')
-    throw new Error('ZENODO_DEPOSITIONS_URL must be an absolute HTTPS URL.')
-  const base = validateHttpsUrl(depositionsUrl, 'ZENODO_DEPOSITIONS_URL')
-  if (base.search || base.hash)
-    throw new Error('ZENODO_DEPOSITIONS_URL must not contain a query or fragment.')
-  return new URL(`${base.pathname.replace(/\/$/, '')}/${id}`, base.origin).href
-}
-
-export function validateZenodoConfiguration({
-  depositionsUrl,
-  filesUrlTemplate,
-  publishUrlTemplate,
-  creatorName,
-}) {
-  const base = validateHttpsUrl(depositionsUrl, 'ZENODO_DEPOSITIONS_URL')
-  for (const [name, template] of [
-    ['ZENODO_FILES_URL_TEMPLATE', filesUrlTemplate],
-    ['ZENODO_PUBLISH_URL_TEMPLATE', publishUrlTemplate],
-  ]) {
-    if (
-      typeof template !== 'string' ||
-      !template.includes('{id}') ||
-      template.replaceAll('{id}', '').match(/[{}]/) ||
-      template.includes('{{') ||
-      template.includes('}}')
-    ) {
-      throw new Error(`${name} must be an HTTPS URL template containing the {id} placeholder.`)
-    }
-    const url = new URL(zenodoTemplateUrl(template, 1, name))
-    if (url.origin !== base.origin) throw new Error(`${name} must use the Zenodo depositions host.`)
-  }
-  if (typeof creatorName !== 'string' || !creatorName.trim())
-    throw new Error('ZENODO_CREATOR_NAME must not be empty.')
-  return true
-}
-
-export function validateZenodoRelease(root, tag) {
-  if (!/^v/.test(tag)) throw new Error('Release tag must start with v.')
-  const version = tag.slice(1)
-  if (!SEMVER.test(version)) throw new Error('Release tag is not valid semver.')
-  const packageJson = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
-  if (packageJson.name !== 'pantheon-opencode' || packageJson.version !== version) {
-    throw new Error('Release tag does not match package.json.')
-  }
-  const manifests = compareVersions(root)
-  if (!manifests.ok) throw new Error('Release manifests are out of sync.')
-  const citationPath = join(root, 'CITATION.cff')
-  const citation = { present: existsSync(citationPath), version: null }
-  if (citation.present) {
-    const match = readFileSync(citationPath, 'utf8').match(/^version:\s*["']?([^"'\s]+)["']?\s*$/m)
-    if (!match) throw new Error('CITATION.cff is missing its version field.')
-    citation.version = match[1]
-    if (citation.version !== version)
-      throw new Error('CITATION.cff version differs from the release tag.')
-  }
-  return { tag, version, citation }
-}
-
-const isDirectRun = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href
-if (isDirectRun) {
-  try {
-    validateZenodoConfiguration({
-      depositionsUrl: process.env.ZENODO_DEPOSITIONS_URL,
-      filesUrlTemplate: process.env.ZENODO_FILES_URL_TEMPLATE,
-      publishUrlTemplate: process.env.ZENODO_PUBLISH_URL_TEMPLATE,
-      creatorName: process.env.ZENODO_CREATOR_NAME,
-    })
-    console.log(JSON.stringify(validateZenodoRelease(process.cwd(), process.env.RELEASE_TAG ?? '')))
-  } catch (error) {
-    console.error(`zenodo validation: ${error.message}`)
-    process.exit(1)
-  }
-}

package/scripts/zenodo-artifact.mjs

@@ -1,94 +0,0 @@
-import { createHash } from 'node:crypto'
-import { readFileSync } from 'node:fs'
-
-/** Hex digest length for every algorithm the Zenodo deposition API may report. */
-const DIGEST_LENGTH = { md5: 32, sha256: 64 }
-
-export function sha256File(path) {
-  return createHash('sha256').update(readFileSync(path)).digest('hex')
-}
-
-export function md5File(path) {
-  return createHash('md5').update(readFileSync(path)).digest('hex')
-}
-
-/**
- * Normalize a file checksum as returned by the Zenodo deposition files API.
- *
- * Zenodo computes an MD5 for every deposited file (developers.zenodo.org,
- * "Deposition File" representation: "MD5 checksum of file, computed by our
- * system"). The API emits it both as `md5:<hex>` and, because of a legacy
- * serialization bug kept for backward compatibility (zenodo/zenodo#628), as a
- * bare 32-character hex string without any algorithm prefix — the exact payload
- * that broke the v1.5.1 run (e.g. `d3359dca2f998da8461abb3b84a32b6c`).
- *
- * A bare 64-character digest is treated as SHA-256, so if the API ever upgrades
- * its algorithm the upload is still verified with a strong digest rather than
- * accepted blindly. Anything unrecognized fails closed.
- */
-export function parseZenodoChecksum(value) {
-  if (typeof value !== 'string') throw new Error('Zenodo file checksum is missing.')
-  const match = value
-    .trim()
-    .toLowerCase()
-    .match(/^(?:(md5|sha256):)?([0-9a-f]+)$/)
-  if (!match) throw new Error(`Unrecognized Zenodo checksum format: ${value}.`)
-  const algorithm =
-    match[1] ??
-    (match[2].length === DIGEST_LENGTH.md5
-      ? 'md5'
-      : match[2].length === DIGEST_LENGTH.sha256
-        ? 'sha256'
-        : null)
-  if (!algorithm) throw new Error(`Unrecognized Zenodo checksum length: ${value}.`)
-  if (match[2].length !== DIGEST_LENGTH[algorithm])
-    throw new Error(`Zenodo checksum length does not match ${algorithm}: ${value}.`)
-  return { algorithm, digest: match[2] }
-}
-
-function expectedDigests(expected) {
-  const provided = {}
-  if (typeof expected === 'string') {
-    const { algorithm, digest } = parseZenodoChecksum(expected)
-    provided[algorithm] = digest
-  } else if (expected && typeof expected === 'object') {
-    for (const [algorithm, digest] of Object.entries(expected)) {
-      if (digest === undefined || digest === null || digest === '') continue
-      if (!(algorithm in DIGEST_LENGTH))
-        throw new Error(`Unsupported local checksum algorithm: ${algorithm}.`)
-      if (
-        typeof digest !== 'string' ||
-        !new RegExp(`^[0-9a-f]{${DIGEST_LENGTH[algorithm]}}$`, 'i').test(digest.trim())
-      )
-        throw new Error(`Invalid local ${algorithm} checksum for verification.`)
-      provided[algorithm] = digest.trim().toLowerCase()
-    }
-  }
-  if (Object.keys(provided).length === 0)
-    throw new Error('A local checksum is required to verify the Zenodo upload.')
-  return provided
-}
-
-export function findZenodoFile(record, filename, expected) {
-  if (!record || typeof record !== 'object' || !Array.isArray(record.files)) {
-    throw new Error('Zenodo record did not contain a files array.')
-  }
-  const matches = record.files.filter((file) => file?.filename === filename)
-  if (matches.length > 1) throw new Error(`Zenodo record contains duplicate file: ${filename}.`)
-  if (matches.length === 0) return null
-  const file = matches[0]
-  const { algorithm, digest } = parseZenodoChecksum(file.checksum)
-  const provided = expectedDigests(expected)
-  const reference = provided[algorithm]
-  if (!reference) {
-    throw new Error(
-      `Zenodo reported a ${algorithm} checksum for ${filename} but no local ${algorithm} checksum was provided.`,
-    )
-  }
-  if (digest !== reference) {
-    throw new Error(
-      `Zenodo ${algorithm} checksum mismatch for ${filename}: expected ${reference}, received ${digest}.`,
-    )
-  }
-  return file
-}

package/scripts/zenodo-release-state.mjs

@@ -1,53 +0,0 @@
-const DOI_PATTERN = /^10\.\d{4,9}\/\S+$/
-const MARKER_PATTERN =
-  /<!-- zenodo-deposition:(?:id=(\d+);)?(?:doi=([^;\s]+);)?state=(pending|created|published)(?:;claim=([^\s]+))? -->/
-
-export function extractZenodoDoi(response) {
-  if (!response || typeof response !== 'object') return null
-  const candidates = [response.doi, response.metadata?.doi, response.links?.doi]
-  for (const candidate of candidates) {
-    if (typeof candidate === 'string' && DOI_PATTERN.test(candidate.trim())) return candidate.trim()
-  }
-  return null
-}
-
-export function validateZenodoResponse(response, { requireDoi = false } = {}) {
-  if (!response || typeof response !== 'object' || Array.isArray(response)) {
-    throw new Error('Zenodo response must be a JSON object.')
-  }
-  if (!Number.isSafeInteger(response.id) || response.id <= 0) {
-    throw new Error('Zenodo response did not contain a valid deposition id.')
-  }
-  const doi = extractZenodoDoi(response)
-  if (requireDoi && !doi) throw new Error('Zenodo response did not contain a valid DOI.')
-  return { id: response.id, doi }
-}
-
-export function parseZenodoMarker(body) {
-  const text = String(body ?? '')
-  const match = text.match(MARKER_PATTERN)
-  if (!match) {
-    const legacy = text.match(/<!-- zenodo-deposition-id:(\d+) -->/)
-    if (!legacy) return null
-    const id = Number(legacy[1])
-    if (!Number.isSafeInteger(id) || id <= 0)
-      throw new Error('Zenodo marker has an invalid deposition id.')
-    return { id, doi: null, state: 'created', claim: null }
-  }
-  const id = match[1] ? Number(match[1]) : null
-  if (match[1] && (!Number.isSafeInteger(id) || id <= 0))
-    throw new Error('Zenodo marker has an invalid deposition id.')
-  if (match[2] && !DOI_PATTERN.test(match[2])) throw new Error('Zenodo marker has an invalid DOI.')
-  return { id, doi: match[2] ?? null, state: match[3], claim: match[4] ?? null }
-}
-
-export function zenodoMarker({ id = null, doi = null, state, claim = null }) {
-  if (!['pending', 'created', 'published'].includes(state))
-    throw new Error('Zenodo marker state is invalid.')
-  if (id !== null && (!Number.isSafeInteger(id) || id <= 0))
-    throw new Error('Zenodo marker id is invalid.')
-  if (doi !== null && !DOI_PATTERN.test(doi)) throw new Error('Zenodo marker DOI is invalid.')
-  if (state !== 'pending' && id === null)
-    throw new Error('Created or published Zenodo markers require an id.')
-  return `<!-- zenodo-deposition:${id === null ? '' : `id=${id};`}${doi === null ? '' : `doi=${doi};`}state=${state}${claim === null ? '' : `;claim=${claim}`} -->`
-}

package/src/skills/orchestration-workflow/SKILL.md

@@ -1,311 +0,0 @@
----
-name: orchestration-workflow
-description: "Practical step-by-step walkthrough for orchestrating features end-to-end using the multi-agent system, from planning through deployment"
-context: fork
-globs: ["**/AGENTS.md", "**/agents/*.agent.md"]
-alwaysApply: false
----
-
-# Orchestration Workflow: Step-by-Step Guide
-
-Practical walkthrough for using the multi-agent system end-to-end. This is your "how-to" guide for orchestrating features from planning through production deployment.
-
----
-
-## Your First Feature (Real Example)
-
-**Scenario:** You want to add JWT authentication to your app.
-**Time:** ~6-8 hours total (spread across 1-2 days)
-**Team:** All agents working together
-**Result:** Complete feature with 95% coverage, security audit passed, ready to deploy
-
----
-
-## Step 1: Plan the Feature (30 minutes)
-
-### What You Do
-
-Open VS Code, start a chat with Copilot:
-
-```
-@athena: Plan JWT authentication with refresh tokens
-
-Requirements:
-- User login with email + password
-- JWT access token (15 min expiry)
-- Refresh token (7 day expiry)
-- Secure token storage (httpOnly cookies)
-- Token verification on protected routes
-- Rate limiting (5 attempts/min)
-- OWASP Top 10 compliant
-
-Please create a detailed 3-4 phase implementation plan.
-```
-
-### What Athena Does
-
-Athena researches patterns, calls Apollo for existing auth code, and creates:
-
-```
-📋 Plan: JWT Authentication
-├─ Phase 1: Database Schema (Demeter)
-│  ├─ Tasks: Create user + token tables
-│  ├─ Test requirements: 5 test cases
-│  └─ Risk: Zero-downtime migration
-├─ Phase 2: Backend Services (Hermes)
-│  ├─ Tasks: JWT service + endpoints
-│  ├─ Test requirements: 8 test cases
-│  └─ Risk: Token expiry edge cases
-├─ Phase 3: Frontend Integration (Aphrodite)
-│  ├─ Tasks: LoginForm + useAuth hook
-│  ├─ Test requirements: 6 test cases
-│  └─ Risk: Token refresh race condition
-└─ FAQ: Answers to common questions
-```
-
-### What You Do
-
-1. Review the plan presented by Athena in chat
-2. **Ask questions or approve**
-   - If concerns: `@athena: Please adjust plan because...`
-   - If approved: "Plan looks good, let's proceed"
-
-### ⏸️ PAUSE POINT 1: Plan Approval
-
-```
-Athena: ✅ Plan approved! Ready to orchestrate implementation
-Zeus: Starting Phase 1 - Database Schema
-```
-
----
-
-## Step 2: Orchestrate Implementation
-
-### Phase 1: Database Schema
-
-**Zeus delegates to Demeter:**
-```
-@demeter: Implement database schema for JWT auth
-
-Requirements:
-- User table: id, email, hashed_password
-- Token table: id, user_id, token, issued_at, expires_at, revoked_at
-- Indexes: user(email), token(user_id, token)
-
-TDD: RED → GREEN → REFACTOR
-Coverage target: >80%
-```
-
-**Demeter does:**
-1. Write FAILING migration test (RED)
-2. Write minimal migration (GREEN)
-3. Refactor (REFACTOR) — add types, indexes, constraints, timestamps
-
-**Demeter delivers:** Schema files + tests, >80% coverage
-
-**Themis reviews:** Coverage, security, performance, tests → APPROVED
-
-**Background dispatch for independent phases (OpenCode v1.16.2+):**
-If Phase 2 (backend) and Phase 3 (frontend) have no file dependencies, Zeus can dispatch both in **background** simultaneously and continue working while they execute. This eliminates the sequential wait.
-
-### ⏸️ PAUSE POINT 2: Phase Review
-
-```
-Zeus: "Phase 1 complete! Coverage: >80% ✅ Security: ✅ Tests: passing ✅
-Ready to continue to Phase 2?"
-
-User: "continue"
-```
-
-### Phase 2: Backend Services
-
-**Zeus delegates to Hermes:**
-```
-@hermes: Implement backend services for JWT auth
-
-Create:
-1. JWTService: generate, verify, refresh JWT
-2. AuthService: handle login/logout
-3. Auth endpoints: POST /auth/login, POST /auth/refresh, GET /auth/verify
-
-TDD: RED → GREEN → REFACTOR
-Coverage target: >80%
-```
-
-**Hermes does (TDD):**
-1. Write failing test for JWT generation (RED)
-2. Write minimal JWT service (GREEN)
-3. Refactor with proper types, error handling (REFACTOR)
-4. Repeat for all endpoints
-
-**Hermes delivers:** Services + tests, >80% coverage
-
-**Themis reviews:** Coverage, security (OWASP), performance → APPROVED
-
-### ⏸️ PAUSE POINT 2: Phase Review
-
-```
-Zeus: "Phase 2 complete! Coverage: >80% ✅ Security: OWASP ✅ Tests: passing ✅
-Ready to continue to Phase 3?"
-
-User: "continue"
-```
-
-### Phase 3: Frontend Integration
-
-**Zeus delegates to Aphrodite:**
-```
-@aphrodite: Implement frontend for JWT auth
-
-Create:
-1. LoginForm component
-2. useAuth hook for state management
-3. Protected route wrapper
-
-TDD: RED → GREEN → REFACTOR
-Coverage target: >80%
-```
-
-**Aphrodite does (TDD):**
-1. Write failing component test (RED)
-2. Write minimal component (GREEN)
-3. Refactor with proper accessibility, error handling (REFACTOR)
-
-**Aphrodite delivers:** Components + tests, >80% coverage
-
-**Themis reviews:** Coverage, accessibility, security → APPROVED
-
-### ⏸️ PAUSE POINT 2: Phase Review
-
-```
-Zeus: "Phase 3 complete! Coverage: >80% ✅ Accessibility: ✅ Tests: passing ✅
-All phases approved!"
-```
-
----
-
-## Step 3: Final Summary
-
-```
-✅ JWT Authentication Complete
-
-📊 Metrics:
-- 3 phases: Database, Backend, Frontend
-- >80% coverage across all layers
-- Security: OWASP compliant ✅
-- All tests passing ✅
-
-🚀 Ready to commit
-```
-
----
-
-## Step 4: Git Commit
-
-### ⏸️ PAUSE POINT 3: Git Commit
-
-```
-Zeus: "All phases approved! Ready to commit."
-
-Suggested commit message:
-feat: Add JWT authentication with refresh tokens
-
-- Create User + Token database schema
-- Implement JWTService + AuthService
-- Add login, refresh, verify endpoints
-- Create LoginForm + useAuth hook
-- Full TDD: >80% coverage
-- Security: OWASP Top 10 compliant
-
-User: git add -A && git commit -m "..."
-```
-
----
-
-## Quick Reference: Workflow Commands
-
-```bash
-# Step 1: Plan
-@athena: Plan [feature description]
-
-# Step 2: Orchestrate
-@zeus: Implement feature using plan
-
-# Step 3: At pause points
-# - Review phase results
-# - Approve before proceeding
-
-# Step 4: Commit
-git add -A
-git commit -m "feat: ..."
-
-# Step 5: Deploy
-git push origin [branch]
-```
-
----
-
-## Troubleshooting
-
-### Problem: Phase coverage is <80%
-**Solution:** Implementer adds missing test cases, re-runs coverage, Themis re-reviews.
-
-### Problem: Security audit found issue
-**Solution:** Relevant agent fixes (parameterized queries, input validation), re-audit, Themis approves.
-
-### Problem: Frontend accessibility below target
-**Solution:** Aphrodite improves ARIA labels, keyboard navigation, re-checks, Themis approves.
-
----
-
-## Common Patterns
-
-### Pattern 1: Simple Bug Fix (Skip Athena)
-```
-Discovery: @apollo: Find bug in authentication
-Fix:      @hermes: Fix the validation error
-Review:   @themis: Auto-invoked after fix
-Result:   Minimal change, minimal risk (~30 min)
-```
-
-### Pattern 2: Complex Feature (Full System)
-```
-Plan:        @athena: Plan architecture
-Orchestrate: @zeus: Implement using plan
-Result:      Complete feature, >80% coverage (1-2 days)
-```
-
-### Pattern 3: Database Optimization
-```
-Discovery:   @apollo: Find N+1 queries
-Optimize:    @demeter: Add indexes + optimize
-Review:      @themis: Auto-invoked
-Result:      10x faster queries (~2 hours)
-```
-
----
-
-## Pro Tips
-
-🎯 **Plan First** — Saves 2-3x rework time
-🎯 **Use Pause Points** — You control when to proceed
-🎯 **Trust Themis** — Code review catches issues early
-🎯 **Commit Atomically** — One phase = one commit
-🎯 **Test First** — RED tests before code
-🎯 **Coverage Matters** — <80% = blocked, no exceptions
-🎯 **Security First** — Themis enforces OWASP compliance
-🎯 **Background Dispatch** — Use OpenCode v1.16.2+ background agents to run independent phases in parallel without polling
-
----
-
-## Next Steps
-
-1. ✅ Read this guide
-2. ✅ Review agent reference in `agent-coordination/SKILL.md`
-3. ✅ Review TDD standards in `tdd-with-agents/SKILL.md`
-4. 🚀 Start your first feature: `@athena: Plan [your idea]`
-
----
-
-**Philosophy:** Plan → Orchestrate → Review → Commit → Deploy
-Every phase has a pause point where YOU control the outcome.