pantheon-opencode 1.5.2 → 1.6.0-beta.10

package/scripts/validate-routing.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+
 /**
  * validate-routing.mjs — Validate routing.yml consistency
  *
@@ -14,10 +15,11 @@
  *   node scripts/validate-routing.mjs --verbose   # show all entries checked
  */
 
+import { createHash } from 'node:crypto'
 import { existsSync, readdirSync, readFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import yaml from 'js-yaml'
+import { load } from 'js-yaml'
 import { validatePresetDefs } from '../src/pantheon/presets.mjs'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
@@ -50,7 +52,7 @@ if (!existsSync(routingPath)) {
   console.error('❌ routing.yml not found')
   process.exit(1)
 }
-const routing = yaml.load(readFileSync(routingPath, 'utf8'))
+const routing = load(readFileSync(routingPath, 'utf8'))
 
 console.log('🔍 Validating routing.yml...\n')
 
@@ -106,6 +108,44 @@ for (const [name, info] of Object.entries(routing.agents || {})) {
   }
 }
 
+// B2. skills-lock.json must match src/skills/*/SKILL.md exactly — content
+// digests stay in sync, and the set of locked paths equals the set on disk
+// (so adding/removing a skill without updating the lock fails the gate).
+console.log('\n  skills-lock.json integrity:')
+const lockPath = join(ROOT, 'skills-lock.json')
+let skillLock = null
+try {
+  skillLock = JSON.parse(readFileSync(lockPath, 'utf8'))
+} catch (err) {
+  check(false, `skills-lock.json missing or malformed: ${err.message}`)
+}
+if (skillLock && typeof skillLock === 'object' && !Array.isArray(skillLock)) {
+  const lockedFiles = Object.keys(skillLock).sort()
+  const skillFiles = existsSync(srcSkillsDir)
+    ? readdirSync(srcSkillsDir)
+        .filter((d) => existsSync(join(srcSkillsDir, d, 'SKILL.md')))
+        .map((d) => `src/skills/${d}/SKILL.md`)
+        .sort()
+    : []
+  console.log(`  Locked skills: ${lockedFiles.length} (on disk: ${skillFiles.length})`)
+
+  for (const rel of skillFiles) {
+    const actual = createHash('sha256')
+      .update(readFileSync(join(ROOT, rel)))
+      .digest('hex')
+    check(
+      skillLock[rel] === actual,
+      `skills-lock.json stale for "${rel}": expected ${actual}, got ${skillLock[rel] ?? 'no entry'}`,
+    )
+  }
+  for (const rel of lockedFiles) {
+    check(
+      skillFiles.includes(rel),
+      `skills-lock.json lists "${rel}" but that SKILL.md does not exist`,
+    )
+  }
+}
+
 // C. Handoff validation
 console.log(
   `\n  Handoff definitions: ${Object.keys(routing.handoffs || {}).length} agents with handoffs`,
@@ -213,7 +253,7 @@ function parseFrontmatter(filePath) {
   const match = content.match(FRONTMATTER_RE)
   if (!match) return null
   try {
-    return yaml.load(match[1])
+    return load(match[1])
   } catch {
     return null
   }

package/scripts/validate-sandbox-install.mjs

@@ -0,0 +1,138 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto'
+import { readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const PACKAGE_REF = /^(?:npm:)?pantheon-opencode(?:@[^/]+)?(?:\/(?:plugin|plugin-v2))?$/
+export const SANDBOX_SOURCE_FILES = [
+  'bin/pantheon-init.mjs',
+  'scripts/install/config-migration.mjs',
+  'scripts/install/opencode.mjs',
+  'scripts/validate-sandbox-install.mjs',
+  'src/plugin-v2.ts',
+]
+
+function readJson(path, label) {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'))
+  } catch (error) {
+    throw new Error(`cannot read ${label} at ${path}: ${error.message}`)
+  }
+}
+
+function pluginReferences(config) {
+  const refs = []
+  for (const key of ['plugin', 'plugins']) {
+    const value = config?.[key]
+    const entries = Array.isArray(value) ? value : value === undefined ? [] : [value]
+    for (const entry of entries) {
+      if (typeof entry === 'string') refs.push(entry)
+      else if (entry && typeof entry === 'object' && !Array.isArray(entry)) {
+        for (const field of ['package', 'id', 'name', 'path', 'source']) {
+          if (typeof entry[field] === 'string') refs.push(entry[field])
+        }
+      }
+    }
+  }
+  return refs
+}
+
+/**
+ * Prove that the sandbox is executing the package built from this checkout and
+ * that the project config cannot silently load an older npm-cached Pantheon.
+ */
+export function validateSandboxInstall({ repoDir, installDir, projectConfig, configPaths = [] }) {
+  const sourcePackagePath = join(resolve(repoDir), 'package.json')
+  const installedPackagePath = join(resolve(installDir), 'package.json')
+  const sourcePackage = readJson(sourcePackagePath, 'checkout package manifest')
+  const installedPackage = readJson(installedPackagePath, 'sandbox package manifest')
+  if (sourcePackage.version !== installedPackage.version) {
+    throw new Error(
+      `sandbox package version ${installedPackage.version} does not match checkout ${sourcePackage.version}`,
+    )
+  }
+
+  const sourceHash = createHash('sha256')
+  for (const relativePath of SANDBOX_SOURCE_FILES) {
+    let source
+    let installed
+    try {
+      source = readFileSync(join(resolve(repoDir), relativePath))
+      installed = readFileSync(join(resolve(installDir), relativePath))
+    } catch (error) {
+      throw new Error(`cannot compare package source ${relativePath}: ${error.message}`)
+    }
+    if (!source.equals(installed)) {
+      throw new Error(`installed package source differs from checkout: ${relativePath}`)
+    }
+    sourceHash.update(relativePath).update('\0').update(installed).update('\0')
+  }
+
+  const expectedPluginPath = resolve(installDir, 'src', 'plugin-v2')
+  const allConfigPaths = [...new Set([projectConfig, ...configPaths].map((path) => resolve(path)))]
+  let activeProjectPluginCount = 0
+  for (const configPath of allConfigPaths) {
+    const config = readJson(configPath, 'active OpenCode config')
+    if (!config || typeof config !== 'object' || Array.isArray(config)) {
+      throw new Error(`active OpenCode config must be an object: ${configPath}`)
+    }
+    for (const ref of pluginReferences(config)) {
+      const normalized = ref.replaceAll('\\', '/').replace(/\/$/, '')
+      if (PACKAGE_REF.test(normalized)) {
+        throw new Error(`stale Pantheon package reference in ${configPath}: ${ref}`)
+      }
+      if (resolve(ref) === expectedPluginPath) {
+        if (configPath === resolve(projectConfig)) activeProjectPluginCount += 1
+      }
+    }
+  }
+  if (activeProjectPluginCount !== 1) {
+    throw new Error(
+      `project config must reference the sandbox V2 plugin exactly once; found ${activeProjectPluginCount}: ${resolve(projectConfig)}`,
+    )
+  }
+
+  return {
+    status: 'PASS',
+    version: installedPackage.version,
+    sourceSha256: sourceHash.digest('hex'),
+  }
+}
+
+function parseArgs(args) {
+  const options = { configPaths: [] }
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i]
+    if (arg === '--config') options.configPaths.push(args[++i])
+    else if (['--repo', '--install', '--project-config'].includes(arg))
+      options[arg.slice(2).replace('-', '')] = args[++i]
+    else throw new Error(`unknown argument: ${arg}`)
+  }
+  for (const required of ['repo', 'install', 'projectconfig']) {
+    if (!options[required])
+      throw new Error(
+        `missing required option --${required.replace('projectconfig', 'project-config')}`,
+      )
+  }
+  return {
+    repoDir: options.repo,
+    installDir: options.install,
+    projectConfig: options.projectconfig,
+    configPaths: options.configPaths,
+  }
+}
+
+function main() {
+  try {
+    const result = validateSandboxInstall(parseArgs(process.argv.slice(2)))
+    process.stdout.write(
+      `Sandbox install proof: ${result.status} (version ${result.version}, source sha256 ${result.sourceSha256})\n`,
+    )
+  } catch (error) {
+    process.stderr.write(`Sandbox install proof: FAIL — ${error.message}\n`)
+    process.exitCode = 1
+  }
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) main()

package/scripts/versioning.mjs

@@ -24,6 +24,7 @@ import { execFileSync } from 'node:child_process'
 import { existsSync, readFileSync } from 'node:fs'
 import { basename, dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { mergeUnreleasedIntoVersion } from './changelog-merge.mjs'
 import {
   commitPreparedUpdates,
   prepareInventoryVersion,
@@ -471,6 +472,17 @@ switch (command) {
   case 'changelog': {
     const version = arg || getCurrentVersion()
     const date = new Date().toISOString().slice(0, 10)
+    const currentChangelog = readFileSync(CHANGELOG_PATH, 'utf-8')
+    const mergePlan = mergeUnreleasedIntoVersion(currentChangelog, version)
+    if (mergePlan) {
+      if (mergePlan.changed) {
+        commitPreparedUpdates([{ path: CHANGELOG_PATH, content: mergePlan.content }])
+        console.log(`  ✓ CHANGELOG: merged [Unreleased] into existing [v${version}]`)
+      } else {
+        console.log(`  ✓ CHANGELOG: [Unreleased] is empty; [v${version}] unchanged`)
+      }
+      break
+    }
     const changelogPlan = prepareUnreleased(version, date)
     if (changelogPlan.changed) {
       commitPreparedUpdates([{ path: CHANGELOG_PATH, content: changelogPlan.content }])
@@ -492,7 +504,7 @@ Commands:
                        --beta: advance the committed X.Y.Z-beta.N line and
                        promote [Unreleased] → [vX.Y.Z-beta.N] in CHANGELOG
   beta                 Alias for 'apply --beta'
-  changelog [version]  Promote [Unreleased] → [vX.Y.Z] without bumping
+  changelog [version]  Promote [Unreleased], or merge into an existing version section
 
 Release flow (stable):
   1. node scripts/versioning.mjs apply [minor]