pantheon-opencode 1.5.2 → 1.6.0-beta.10

package/scripts/changelog-merge.mjs

@@ -0,0 +1,161 @@
+/**
+ * Merge pending [Unreleased] notes into an already-promoted version section.
+ * This supports release candidates whose versioned changelog section exists
+ * before the final beta changes are ready, without creating a duplicate entry
+ * or advancing the package version.
+ */
+
+const UNRELEASED_TEMPLATE = `
+
+<!-- Add new changes here. Running \`node scripts/versioning.mjs apply\` will
+     move this section to a versioned entry and reset the template below. -->
+
+## 🆕 What's New
+
+## 🐞 Fixed
+
+## ⚠️ Known Issues
+
+## ✅ Closed Issues
+`
+
+const TEMPLATE_COMMENT = /<!-- Add new changes here\.[\s\S]*?reset the template below\. -->/g
+const ESCAPED_TEMPLATE_COMMENT =
+  /&lt;!-- Add new changes here\.[\s\S]*?reset the template below\. --&gt;/g
+
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+function findSection(lines, heading) {
+  const matches = []
+  for (let index = 0; index < lines.length; index += 1) {
+    if (lines[index] === heading) matches.push(index)
+  }
+  if (matches.length > 1) throw new Error(`CHANGELOG.md has duplicate section: ${heading}`)
+  if (matches.length === 0) return null
+  const start = matches[0]
+  let end = start + 1
+  while (end < lines.length && !/^## \[/.test(lines[end])) end += 1
+  return { start, end }
+}
+
+function parseBody(body) {
+  const withoutComments = body.replace(TEMPLATE_COMMENT, '').replace(ESCAPED_TEMPLATE_COMMENT, '')
+  const lines = withoutComments.split('\n')
+  const preamble = []
+  const sections = new Map()
+  let current = null
+
+  for (const line of lines) {
+    const heading = /^## (.+)$/.exec(line)
+    if (heading) {
+      current = heading[1]
+      if (!sections.has(current)) sections.set(current, [])
+      continue
+    }
+    if (current === null) preamble.push(line)
+    else sections.get(current).push(line)
+  }
+
+  const meaningful = (items) => items.join('\n').trim().length > 0
+  for (const [heading, content] of sections) {
+    if (!meaningful(content)) sections.delete(heading)
+    else {
+      sections.set(
+        heading,
+        content
+          .join('\n')
+          .replace(/\n{3,}/g, '\n\n')
+          .trim()
+          .split('\n'),
+      )
+    }
+  }
+  return {
+    preamble: preamble.join('\n').trim(),
+    sections,
+  }
+}
+
+function mergeBodies(existingBody, pendingBody) {
+  const existing = parseBody(existingBody)
+  const pending = parseBody(pendingBody)
+  const preamble = [existing.preamble, pending.preamble].filter(Boolean).join('\n\n')
+  const sections = new Map(existing.sections)
+
+  for (const [heading, content] of pending.sections) {
+    if (!sections.has(heading)) {
+      sections.set(heading, content)
+      continue
+    }
+    const previous = sections.get(heading)
+    const previousText = previous.join('\n').trim()
+    const pendingText = content.join('\n').trim()
+    sections.set(heading, [`${previousText}\n\n${pendingText}`])
+  }
+
+  const rendered = []
+  if (preamble) rendered.push(preamble)
+  for (const [heading, content] of sections) {
+    if (rendered.length > 0) rendered.push('')
+    rendered.push(`## ${heading}`, '', content.join('\n').trim())
+  }
+  return rendered.join('\n').trim()
+}
+
+/**
+ * Merge [Unreleased] into an existing exact version heading, preserving its
+ * date and existing notes. Returns null when the version section does not yet
+ * exist so the caller can use the normal promotion path.
+ *
+ * @param {string} changelogText complete changelog
+ * @param {string} version semantic version, with or without a leading v
+ * @returns {{changed: boolean, content: string}|null}
+ */
+export function mergeUnreleasedIntoVersion(changelogText, version) {
+  const normalized = String(version).trim().replace(/^v/i, '')
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(normalized)) {
+    throw new Error(`invalid changelog version: ${version}`)
+  }
+
+  const lines = changelogText.split('\n')
+  const unreleased = findSection(lines, '## [Unreleased]')
+  if (!unreleased) throw new Error('CHANGELOG.md is missing the [Unreleased] section')
+
+  const escaped = escapeRegExp(normalized)
+  const targetPattern = new RegExp(`^## \\[v?${escaped}\\](?: - \\d{4}-\\d{2}-\\d{2})?$`)
+  const targetMatches = []
+  for (let index = 0; index < lines.length; index += 1) {
+    if (targetPattern.test(lines[index])) targetMatches.push(index)
+  }
+  if (targetMatches.length > 1) {
+    throw new Error(`CHANGELOG.md has duplicate version sections: ${normalized}`)
+  }
+  if (targetMatches.length === 0) return null
+
+  const target = findSection(lines, lines[targetMatches[0]])
+  if (!target) throw new Error(`CHANGELOG.md is missing version section: ${normalized}`)
+
+  const pendingBody = lines.slice(unreleased.start + 1, unreleased.end).join('\n')
+  const existingBody = lines.slice(target.start + 1, target.end).join('\n')
+  const mergedBody = mergeBodies(existingBody, pendingBody)
+  const afterTarget = [lines[target.start], '', mergedBody].join('\n').trimEnd()
+  const updatedLines = [
+    ...lines.slice(0, target.start),
+    afterTarget,
+    ...(target.end < lines.length ? [''] : []),
+    ...lines.slice(target.end),
+  ]
+    .join('\n')
+    .split('\n')
+  const updatedUnreleased = findSection(updatedLines, '## [Unreleased]')
+  if (!updatedUnreleased) throw new Error('merged CHANGELOG.md lost the [Unreleased] section')
+  const content = [
+    ...updatedLines.slice(0, updatedUnreleased.start),
+    `## [Unreleased]${UNRELEASED_TEMPLATE}`,
+    ...updatedLines.slice(updatedUnreleased.end),
+  ].join('\n')
+
+  return { changed: content !== changelogText, content }
+}

package/scripts/check-plugin-v2-coverage.mjs

@@ -0,0 +1,213 @@
+import { spawnSync } from 'node:child_process'
+import { mkdtempSync, readdirSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+export const REQUIRED_NODE_VERSION = 'v24.15.0'
+export const LINE_THRESHOLD_NUMERATOR = 4
+export const LINE_THRESHOLD_DENOMINATOR = 5
+
+function integerField(value, name, minimum) {
+  const label = minimum === 0 ? 'non-negative' : 'positive'
+  if (!/^\d+$/.test(value)) {
+    throw new Error(`${name} must be a ${label} integer`)
+  }
+  const parsed = Number(value)
+  if (!Number.isSafeInteger(parsed) || parsed < minimum) {
+    throw new Error(`${name} must be a ${label} integer`)
+  }
+  return parsed
+}
+
+function normalizeSourcePath(source, repoRoot) {
+  const path = source.startsWith('file:') ? fileURLToPath(source) : source
+  return resolve(repoRoot, path)
+}
+
+function exactlyOneField(lines, name) {
+  const values = lines.filter((line) => line.startsWith(`${name}:`))
+  if (values.length !== 1) {
+    throw new Error(`target LCOV record must contain exactly one ${name} field`)
+  }
+  return values[0].slice(name.length + 1)
+}
+
+function optionalPair(lines, foundName, hitName) {
+  const foundFields = lines.filter((line) => line.startsWith(`${foundName}:`))
+  const hitFields = lines.filter((line) => line.startsWith(`${hitName}:`))
+  if (foundFields.length === 0 && hitFields.length === 0) return null
+  if (foundFields.length !== 1 || hitFields.length !== 1) {
+    throw new Error(`target LCOV record must contain one ${foundName}/${hitName} pair`)
+  }
+
+  const found = integerField(foundFields[0].slice(foundName.length + 1), foundName, 0)
+  const hit = integerField(hitFields[0].slice(hitName.length + 1), hitName, 0)
+  if (hit > found) throw new Error(`${hitName} ${hit} exceeds ${foundName} ${found}`)
+  return { hit, found }
+}
+
+/** Parse and validate the single LCOV record for the exact target source. */
+export function parseTargetLcov(report, repoRoot, targetPath) {
+  if (typeof report !== 'string' || report.trim() === '') {
+    throw new Error('LCOV report is empty')
+  }
+  const normalizedRoot = resolve(repoRoot)
+  const normalizedTarget = resolve(targetPath)
+  const records = []
+  let current = []
+  for (const line of report.split(/\r?\n/)) {
+    if (line === 'end_of_record') {
+      if (current.length > 0) records.push(current)
+      current = []
+    } else if (line.trim() !== '') {
+      current.push(line)
+    }
+  }
+  if (current.length > 0) records.push(current)
+
+  const targetRecords = []
+  for (const lines of records) {
+    const sourceFields = lines.filter((line) => line.startsWith('SF:'))
+    const matchingSources = sourceFields.filter(
+      (line) => normalizeSourcePath(line.slice(3), normalizedRoot) === normalizedTarget,
+    )
+    if (matchingSources.length === 0) continue
+    if (sourceFields.length !== 1 || matchingSources.length !== 1) {
+      throw new Error('target LCOV record must contain exactly one SF entry')
+    }
+    targetRecords.push(lines)
+  }
+
+  if (targetRecords.length !== 1) {
+    throw new Error(
+      `expected exactly one LCOV record for ${normalizedTarget}; found ${targetRecords.length} LCOV records`,
+    )
+  }
+
+  const lines = targetRecords[0]
+  const lineRecords = new Map()
+  for (const entry of lines.filter((line) => line.startsWith('DA:'))) {
+    const fields = entry.slice(3).split(',')
+    if (fields.length < 2 || fields.length > 3) {
+      throw new Error('DA entry must contain a line number and execution count')
+    }
+    const lineNumber = integerField(fields[0], 'DA line number', 1)
+    const count = integerField(fields[1], 'DA count', 0)
+    if (lineRecords.has(lineNumber)) {
+      throw new Error(`duplicate DA line number ${lineNumber}`)
+    }
+    lineRecords.set(lineNumber, count)
+  }
+
+  const found = integerField(exactlyOneField(lines, 'LF'), 'LF', 1)
+  const hit = integerField(exactlyOneField(lines, 'LH'), 'LH', 0)
+  if (hit > found) throw new Error(`LH ${hit} exceeds LF ${found}`)
+  if (found !== lineRecords.size) {
+    throw new Error(`LF ${found} does not equal ${lineRecords.size} unique DA entries`)
+  }
+
+  const coveredRecords = [...lineRecords.values()].filter((count) => count > 0).length
+  if (hit !== coveredRecords) {
+    throw new Error(`LH ${hit} does not equal ${coveredRecords} covered DA entries`)
+  }
+
+  return {
+    sourcePath: normalizedTarget,
+    lines: { hit, found },
+    branches: optionalPair(lines, 'BRF', 'BRH'),
+    functions: optionalPair(lines, 'FNF', 'FNH'),
+  }
+}
+
+/** Compare using integer arithmetic so the 80% boundary cannot round down. */
+export function passesLineThreshold(coverage) {
+  return (
+    BigInt(coverage.lines.hit) * BigInt(LINE_THRESHOLD_DENOMINATOR) >=
+    BigInt(coverage.lines.found) * BigInt(LINE_THRESHOLD_NUMERATOR)
+  )
+}
+
+function formatMetric(metric) {
+  if (metric == null || metric.found === 0) return 'not reported'
+  return `${metric.hit}/${metric.found} (${((metric.hit / metric.found) * 100).toFixed(2)}%)`
+}
+
+function listTypeScriptTests(repoRoot) {
+  const directory = join(repoRoot, 'tests', 'pantheon')
+  return readdirSync(directory)
+    .filter((file) => file.endsWith('.test.ts'))
+    .sort()
+    .map((file) => join(directory, file))
+}
+
+function runCoverage() {
+  if (process.version !== REQUIRED_NODE_VERSION) {
+    throw new Error(
+      `plugin-v2 coverage requires Node ${REQUIRED_NODE_VERSION}; got ${process.version}`,
+    )
+  }
+
+  const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+  const targetPath = resolve(repoRoot, 'src', 'plugin-v2.ts')
+  const testFiles = listTypeScriptTests(repoRoot)
+  if (testFiles.length === 0) throw new Error('no tests/pantheon/*.test.ts files found')
+
+  const tempRoot = mkdtempSync(join(tmpdir(), 'pantheon-plugin-v2-coverage-'))
+  try {
+    const lcovPath = join(tempRoot, 'coverage.lcov')
+    const nodeOptions = [process.env.NODE_OPTIONS, '--conditions=import'].filter(Boolean).join(' ')
+    const args = [
+      '--experimental-test-coverage',
+      '--enable-source-maps',
+      '--import',
+      'tsx',
+      '--test',
+      '--test-concurrency=1',
+      '--test-reporter=spec',
+      '--test-reporter=lcov',
+      '--test-reporter-destination=stdout',
+      `--test-reporter-destination=${lcovPath}`,
+      ...testFiles,
+    ]
+    const result = spawnSync(process.execPath, args, {
+      cwd: repoRoot,
+      encoding: 'utf8',
+      env: { ...process.env, NODE_OPTIONS: nodeOptions },
+      maxBuffer: 32 * 1024 * 1024,
+    })
+    if (result.stdout) process.stdout.write(result.stdout)
+    if (result.stderr) process.stderr.write(result.stderr)
+    if (result.error) throw new Error(`TypeScript test command failed: ${result.error.message}`)
+    if (result.status !== 0) {
+      throw new Error(`TypeScript test command exited ${result.status ?? 'without a status'}`)
+    }
+
+    let report
+    try {
+      report = readFileSync(lcovPath, 'utf8')
+    } catch (error) {
+      throw new Error(`LCOV report was not generated: ${error.message}`)
+    }
+    const coverage = parseTargetLcov(report, repoRoot, targetPath)
+    console.log(`Coverage source: ${coverage.sourcePath}`)
+    console.log(`Lines: ${formatMetric(coverage.lines)}`)
+    console.log(`Branches (informational): ${formatMetric(coverage.branches)}`)
+    console.log(`Functions (informational): ${formatMetric(coverage.functions)}`)
+    if (!passesLineThreshold(coverage)) {
+      throw new Error('src/plugin-v2.ts line coverage is below the required 80%')
+    }
+    console.log('src/plugin-v2.ts line coverage: PASS (>= 80%)')
+  } finally {
+    rmSync(tempRoot, { recursive: true, force: true })
+  }
+}
+
+if (process.argv[1] && pathToFileURL(resolve(process.argv[1])).href === import.meta.url) {
+  try {
+    runCoverage()
+  } catch (error) {
+    console.error(`Plugin V2 coverage gate: ${error.message}`)
+    process.exitCode = 1
+  }
+}

package/scripts/ci-validate-yaml.py

@@ -1,5 +1,6 @@
 #!/usr/bin/env python3
 """Validate agent YAML frontmatter in CI."""
+
 import os
 import re
 import sys
@@ -7,18 +8,19 @@ import sys
 import yaml
 
 errors = 0
-for f in sorted(os.listdir('src/agents')):
-    if not f.endswith('.md'):
+for f in sorted(os.listdir("src/agents")):
+    if not f.endswith(".md"):
         continue
     with open(f"src/agents/{f}", encoding="utf-8") as agent_file:
         content = agent_file.read()
-    match = re.match(r'^---\n(.*?)\n---', content, re.DOTALL)
+    match = re.match(r"^---\n(.*?)\n---", content, re.DOTALL)
     if match:
         try:
             yaml.safe_load(match.group(1))
         except yaml.YAMLError as e:
-            print(f'FAIL: {f}: {e}')
+            print(f"FAIL: {f}: {e}")
             errors += 1
 
-print(f'{sum(1 for _ in os.listdir("src/agents") if _.endswith(".md")) - errors}/{sum(1 for _ in os.listdir("src/agents") if _.endswith(".md"))} agents valid')
+agent_count = sum(1 for _ in os.listdir("src/agents") if _.endswith(".md"))
+print(f"{agent_count - errors}/{agent_count} agents valid")
 sys.exit(errors)

package/scripts/{code_mode_server.py → code_mode.py}

@@ -5,12 +5,12 @@ Provides a confined execution environment for orchestration scripts
 via MCP tools and resources.
 
 Usage:
-    python scripts/code_mode_server.py
+    python scripts/code_mode.py
 
 Or via MCP client (stdio transport):
     pantheon-code-mode:
         command: python
-        args: ["scripts/code_mode_server.py"]
+        args: ["scripts/code_mode.py"]
 """
 
 from __future__ import annotations
@@ -20,6 +20,11 @@ import hashlib
 import json
 import logging
 import os
+
+try:
+    import resource
+except (ImportError, OSError, ValueError):  # pragma: no cover - platform-specific
+    resource = None  # type: ignore[assignment]
 import shutil
 import signal
 import stat
@@ -31,7 +36,7 @@ from typing import Any
 
 import yaml
 from _pantheon_paths import pantheon_home, pantheon_project
-from mcp.server.fastmcp import FastMCP
+from fastmcp import FastMCP
 
 # ── Constants ─────────────────────────────────────────────────────────────────
 ALLOWED_EXTENSIONS: frozenset[str] = frozenset({".sh", ".py"})
@@ -125,6 +130,88 @@ def _build_script_env(
     return env
 
 
+# Additional tasks a sandboxed script may create beyond the UID's current
+# count. RLIMIT_NPROC is a per-real-UID limit on the *total* number of
+# processes AND threads, so the sandbox floor must clear everything the host
+# already owns before a script can fork at all. This headroom is the actual
+# anti-fork-bomb budget: the script still cannot exceed current + headroom.
+NPROC_HEADROOM: int = 64
+
+
+def _uid_task_count() -> int | None:
+    """Count the tasks (processes + threads) this real UID already owns.
+
+    The kernel compares the post-fork total against RLIMIT_NPROC, so this is
+    the number the sandbox limit has to exceed. Returns *None* when the count
+    cannot be established (no readable ``/proc``), which makes the caller
+    fail open on ``--nproc`` rather than pin a value that may be too low and
+    break every script.
+
+    The tally is one too high per process: ``/proc/<pid>/task`` already lists
+    the thread-group leader, so the extra ``1`` counts it twice. That bias
+    only widens the derived limit (the fail-open direction), so it is left in
+    place deliberately.
+    """
+    uid = os.getuid()
+    count = 0
+    try:
+        pids = os.listdir("/proc")
+    except OSError:
+        return None
+    for pid in pids:
+        if not pid.isdigit():
+            continue
+        proc_dir = f"/proc/{pid}"
+        try:
+            if os.stat(proc_dir).st_uid != uid:
+                continue
+            # ``/proc/<pid>/task`` already includes the thread-group leader,
+            # so the extra 1 counts it twice (over-count by one per process).
+            count += 1 + len(os.listdir(f"{proc_dir}/task"))
+        except OSError:
+            # Process exited between listdir and stat, or is not ours to read.
+            continue
+    return count
+
+
+def _sandbox_nproc() -> str | None:
+    """Return the ``--nproc`` value for a sandboxed script, or *None*.
+
+    Derived from the host rather than hardcoded: the value is the UID's
+    current task count plus ``NPROC_HEADROOM``, clamped to the hard limit
+    (``prlimit`` fails with EPERM above it, and an unprivileged process cannot
+    raise its soft limit past the hard one).
+
+    Returns *None* when the count or the limit cannot be read, in which case
+    the caller omits ``--nproc``. ``--as`` and ``--cpu`` still apply, so the
+    sandbox keeps its memory and CPU boundaries.
+    """
+    current = _uid_task_count()
+    if current is None:
+        _log.warning(
+            "code-mode: cannot count this UID's tasks; omitting --nproc, so "
+            "the sandboxed script's fork budget is unbounded"
+        )
+        return None
+    if resource is None:
+        _log.warning(
+            "code-mode: cannot read RLIMIT_NPROC; omitting --nproc, so the "
+            "sandboxed script's fork budget is unbounded"
+        )
+        return None
+    try:
+        _soft, hard = resource.getrlimit(resource.RLIMIT_NPROC)
+    except (OSError, ValueError):
+        _log.warning(
+            "code-mode: cannot read RLIMIT_NPROC; omitting --nproc, so the "
+            "sandboxed script's fork budget is unbounded"
+        )
+        return None
+    if hard == getattr(resource, "RLIM_INFINITY", -1):
+        return str(current + NPROC_HEADROOM)
+    return str(max(1, min(current + NPROC_HEADROOM, hard)))
+
+
 def _prlimit_prefix(
     prlimit_path: str | None,
     timeout_s: int = SCRIPT_TIMEOUT,
@@ -132,21 +219,34 @@ def _prlimit_prefix(
     """Return a ``prlimit`` command prefix to wrap a subprocess, or *None*.
 
     On Linux with ``prlimit`` available the prefix adds:
-      --nproc=512  --as=1073741824  --cpu=<timeout_s + 5>
-
-    On non-Linux or when *prlimit_path* is falsy, returns *None* (fail-open).
+      --nproc=<uid task count + NPROC_HEADROOM>  --as=1073741824
+      --cpu=<timeout_s + 5>
+
+    ``--nproc`` is derived per invocation by :func:`_sandbox_nproc` rather
+    than hardcoded. RLIMIT_NPROC is a per-real-UID total across processes AND
+    threads, so a fixed value below the host's current usage makes the very
+    first ``fork()`` inside the sandbox fail with EAGAIN — which is exactly
+    what a hardcoded ``--nproc=512`` did on a host already running more than
+    512 tasks. The isolation property is unchanged: a script still cannot
+    create more than ``NPROC_HEADROOM`` additional tasks.
+
+    On non-Linux, when *prlimit_path* is falsy, or when the nproc limit cannot
+    be derived, the flag is omitted (fail-open); ``--as``/``--cpu`` remain.
     """
     if not prlimit_path:
         return None
 
     cpu_limit = timeout_s + 5
-    return [
-        prlimit_path,
-        "--nproc=512",
+    prefix = [prlimit_path]
+    nproc = _sandbox_nproc()
+    if nproc is not None:
+        prefix.append(f"--nproc={nproc}")
+    prefix += [
         "--as=1073741824",  # 1 GiB in bytes
         f"--cpu={cpu_limit}",
         "--",
     ]
+    return prefix
 
 
 def _detect_prlimit() -> str | None:
@@ -226,7 +326,9 @@ def _packaged_scripts_dir() -> Path | None:
     return None
 
 
-def _resolve_scripts_dir(candidates: list[Path], *, allow_packaged: bool = True) -> Path | None:
+def _resolve_scripts_dir(
+    candidates: list[Path], *, allow_packaged: bool = True
+) -> Path | None:
     """Select the first usable candidate, optionally trying the package copy."""
     for candidate in candidates:
         if _has_usable_scripts(candidate):
@@ -377,9 +479,7 @@ def _load_manifest(scripts_dir: Path | None = None) -> dict[str, str]:
         ) from None
 
     if not isinstance(data, dict):
-        raise ManifestError(
-            "CORRUPT_DATA", "Code-mode manifest must be a JSON object."
-        )
+        raise ManifestError("CORRUPT_DATA", "Code-mode manifest must be a JSON object.")
 
     if data.get("version") != 1:
         raise ManifestError(
@@ -527,7 +627,6 @@ def _contract_result(
     return f"[{status}] {message}"
 
 
-
 def _format_output(
     stdout: str,
     stderr: str,
@@ -818,22 +917,15 @@ async def execute_code_script(
                 timeout_s=timeout_s,
                 status="TIMEOUT",
             )
-    except FileNotFoundError:
-        return _build_result(
-            "",
-            f"Script '{script_name}' not found or interpreter missing.",
-            -1,
-            timed_out=False,
-            duration_ms=0,
-            metadata=metadata,
-            json_output=json_output,
-            timeout_s=timeout_s,
-            status="UNAVAILABLE",
-        )
     except OSError as e:
+        error = (
+            f"Script '{script_name}' not found or interpreter missing."
+            if isinstance(e, FileNotFoundError)
+            else f"Failed to execute script: {e}"
+        )
         return _build_result(
             "",
-            f"Failed to execute script: {e}",
+            error,
             -1,
             timed_out=False,
             duration_ms=0,