pantheon-opencode 1.6.0-beta.1 → 1.6.0-beta.10

package/scripts/probe-pantheon-cost.mjs

@@ -56,11 +56,48 @@ function setEnvironment(values) {
   }
 }
 
+/**
+ * Write the rows in the family the requested host generation actually uses.
+ *
+ * Call sites describe an assistant turn the way they always have
+ * (`role: 'assistant'`, plus a `phase`). This function translates that
+ * descriptor into what is on disk: for V2, `role` becomes the `type` COLUMN and
+ * `phase` is dropped, because a real V2 payload carries neither — measured, the
+ * `role` key is absent from 40052 of 40052 rows on a host 2.0.22 database.
+ *
+ * Keeping that translation in ONE place is the point: a fixture that wrote
+ * `role` into a session_message row asserts the V1 format under a V2 name, which
+ * is exactly how the stale V1 predicate in the CLI mirror stayed green — the
+ * synthetic database agreed with the bug instead of contradicting it.
+ */
 function createSyntheticDb(DatabaseSync, path, rows) {
   const db = new DatabaseSync(path)
-  db.exec('CREATE TABLE message (data TEXT NOT NULL, time_created INTEGER NOT NULL)')
-  const insert = db.prepare('INSERT INTO message (data, time_created) VALUES (?, ?)')
-  for (const data of rows) insert.run(JSON.stringify(data), Date.now())
+  if (requestedVersion === 'v2') {
+    db.exec(
+      'CREATE TABLE session_message (id TEXT, session_id TEXT, type TEXT, seq INTEGER, time_created INTEGER, time_updated INTEGER, data TEXT)',
+    )
+    const insert = db.prepare(
+      'INSERT INTO session_message (id, session_id, type, seq, time_created, time_updated, data) VALUES (?,?,?,?,?,?,?)',
+    )
+    rows.forEach((row, index) => {
+      const payload = { ...row }
+      delete payload.role
+      delete payload.phase
+      insert.run(
+        `msg_${index + 1}`,
+        'ses_probe',
+        row.role,
+        index + 1,
+        Date.now(),
+        Date.now(),
+        JSON.stringify(payload),
+      )
+    })
+  } else {
+    db.exec('CREATE TABLE message (data TEXT NOT NULL, time_created INTEGER NOT NULL)')
+    const insert = db.prepare('INSERT INTO message (data, time_created) VALUES (?, ?)')
+    for (const data of rows) insert.run(JSON.stringify(data), Date.now())
+  }
   db.close()
 }
 
@@ -129,7 +166,10 @@ async function main() {
   const root = mkdtempSync(join(tmpdir(), 'pantheon-cost-probe-'))
   const dataHome = join(root, 'data')
   const opencodeDir = join(dataHome, 'opencode')
-  const selectedDb = join(opencodeDir, requestedVersion === 'v2' ? 'opencode-v2.db' : 'opencode.db')
+  // Every real installation writes `opencode.db`; the v1/v2 distinction is the
+  // SCHEMA of that file, never its name. Deriving `opencode-v2.db` here made the
+  // probe assert a path that exists on no real machine.
+  const selectedDb = join(opencodeDir, 'opencode.db')
   const otherDb = join(root, 'other.db')
   const envDb = join(root, 'env.db')
   const explicitDb = join(root, 'explicit.db')
@@ -139,7 +179,9 @@ async function main() {
   try {
     mkdirSync(opencodeDir, { recursive: true })
     // These rows intentionally include a monetary-looking field to prove it is
-    // ignored; only input/output/total tokens may appear in the report.
+    // ignored; only input/output/total tokens may appear in the report. Every
+    // V2 phase reads back as `unknown` because the V2 reader emits that literal:
+    // a V2 payload carries no phase field for a reader to recover.
     const selectedRows =
       requestedVersion === 'v2'
         ? [
@@ -224,8 +266,8 @@ async function main() {
         selectedOutput,
         requestedVersion === 'v2'
           ? [
-              { agent: 'aphrodite', phase: 'plan', input: 8, output: 10, total: 18 },
-              { agent: 'zeus', phase: 'audit', input: 4, output: 6, total: 10 },
+              { agent: 'aphrodite', phase: 'unknown', input: 8, output: 10, total: 18 },
+              { agent: 'zeus', phase: 'unknown', input: 4, output: 6, total: 10 },
             ]
           : [
               { agent: 'hermes', phase: 'plan', input: 13, output: 24, total: 37 },
@@ -250,7 +292,12 @@ async function main() {
         {},
         { sessionID: 'cost-probe' },
       )
-      requireOutput(output, '| env-agent | override | 1 | 2 | 3 |', 'PANTHEON_COST_DB')
+      // V2 has no phase to report, so the same row reads back as 'unknown'.
+      requireOutput(
+        output,
+        `| env-agent | ${requestedVersion === 'v2' ? 'unknown' : 'override'} | 1 | 2 | 3 |`,
+        'PANTHEON_COST_DB',
+      )
       if (output.includes('wrong-version') || output.includes('env-agent') === false) {
         throw new Error('PANTHEON_COST_DB did not override the version-selected database')
       }
@@ -269,7 +316,11 @@ async function main() {
         {},
         { sessionID: 'cost-probe' },
       )
-      requireOutput(output, '| explicit-agent | explicit | 9 | 1 | 10 |', 'explicit dbPath')
+      requireOutput(
+        output,
+        `| explicit-agent | ${requestedVersion === 'v2' ? 'unknown' : 'explicit'} | 9 | 1 | 10 |`,
+        'explicit dbPath',
+      )
       if (output.includes('env-agent')) throw new Error('explicit dbPath did not take precedence')
       checks.push('explicit dbPath precedence: PASS')
     } finally {
@@ -287,11 +338,7 @@ async function main() {
         { sessionID: 'cost-probe' },
       )
       requireOutput(output, 'not found', 'missing DB')
-      requireOutput(
-        output,
-        requestedVersion === 'v2' ? 'opencode-v2.db' : 'opencode.db',
-        'selected missing DB path',
-      )
+      requireOutput(output, 'opencode.db', 'selected missing DB path')
       checks.push('missing DB: PASS')
     } finally {
       missingRestore()
@@ -302,7 +349,16 @@ async function main() {
     }).pantheon_cost.execute({}, { sessionID: 'cost-probe' })
     requireOutput(incompatibleOutput, 'incompatible opencode.db schema', 'incompatible schema')
     checks.push('incompatible schema: PASS')
-    emit('PASS', 'offline synthetic DB checks passed; no real DB was read', checks)
+    // Names the synthetic fixture that was built, because the previous wording
+    // ("no real DB was read") was true of every run and therefore true of the run
+    // in which the V2 ledger was read as V1 and silently dropped. A verdict that
+    // cannot fail is not a verdict: it stayed green across the exact defect it
+    // was meant to cover.
+    emit(
+      'PASS',
+      `${checks.length} synthetic ${requestedVersion} checks passed against a temporary opencode.db (no user database was read)`,
+      checks,
+    )
   } catch (error) {
     emit('FAIL', diagnostic(error), checks)
   } finally {

package/scripts/run-node-tests.mjs

@@ -0,0 +1,189 @@
+#!/usr/bin/env node
+/**
+ * Run `node --test` over an explicit file list, and FAIL when zero tests are collected.
+ *
+ * Why this exists: `node --test <glob>` exits 0 when the glob matches nothing (Node >= 22).
+ * A test script whose file set is absent from the checkout -- or absent from the published
+ * package, because the `files` allow-list omits it -- therefore reports success while
+ * collecting nothing. That is the worst possible failure mode for a release gate: it
+ * manufactures confidence.
+ *
+ * This runner closes that hole from two independent sides:
+ *   1. It expands the globs ITSELF and refuses to start the runner with zero files, so the
+ *      runner is never handed an unexpanded pattern that silently matches nothing.
+ *   2. After a run that exited 0, it re-reads the collected count from the machine-readable
+ *      TAP summary and fails closed when that count is 0, unparseable, or missing.
+ *
+ * Side 2 is deliberately independent of side 1: a future Node change to `--test` glob
+ * handling, a glob that expands to a directory of empty files, or an emptied test file all
+ * still get caught.
+ *
+ * Human-readable output is unchanged: the default `spec` reporter still goes to stdout, and
+ * the TAP reporter is diverted to a scratch file that is read once and deleted.
+ *
+ * Usage:
+ *   node scripts/run-node-tests.mjs [--label <name>] [-- <node flags...>] <glob>...
+ *
+ * Examples:
+ *   node scripts/run-node-tests.mjs 'tests/*.mjs' 'tests/pantheon/*.mjs'
+ *   node scripts/run-node-tests.mjs -- --experimental-test-coverage 'tests/*.mjs'
+ */
+import { spawnSync } from 'node:child_process'
+import { globSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = join(fileURLToPath(new URL('.', import.meta.url)), '..')
+
+function usage(message) {
+  console.error(`zero-test-guard: ${message}`)
+  console.error(
+    'usage: node scripts/run-node-tests.mjs [--label <name>] [-- <node flags...>] <glob>...',
+  )
+  process.exit(1)
+}
+
+/** Parse `[--label <name>] [-- <node flags...>] <glob>...`. */
+function parseArgs(argv) {
+  const separator = argv.indexOf('--')
+  const own = separator === -1 ? argv : argv.slice(0, separator)
+  const nodeFlags = separator === -1 ? [] : argv.slice(separator + 1)
+
+  let label = 'node tests'
+  const globs = []
+  for (let i = 0; i < own.length; i++) {
+    if (own[i] === '--label') {
+      const value = own[i + 1]
+      if (value === undefined) usage('--label requires a value')
+      label = value
+      i += 1
+      continue
+    }
+    if (own[i].startsWith('-')) usage(`unknown option ${own[i]}`)
+    globs.push(own[i])
+  }
+  if (globs.length === 0) usage('at least one glob is required')
+  return { label, globs, nodeFlags }
+}
+
+/**
+ * Expand globs to a deduped, ordered file list.
+ * Order follows the positional order of the globs so that the suite runs in the same order
+ * as the shell used to; within a glob, matches are sorted for determinism.
+ */
+function expand(globs) {
+  const files = []
+  const seen = new Set()
+  for (const pattern of globs) {
+    const matches = globSync(pattern, { cwd: ROOT })
+      .filter((match) => !match.includes('node_modules') && !match.includes('__pycache__'))
+      .sort()
+    for (const match of matches) {
+      if (seen.has(match)) continue
+      seen.add(match)
+      files.push(match)
+    }
+  }
+  return files
+}
+
+function reportMissingFiles(label, globs) {
+  console.error(`zero-test-guard: ${label} matched 0 test files — refusing to report success.`)
+  console.error(`  globs: ${globs.join(' ')}`)
+  console.error('  This is the "test suite silently passes when it collects nothing" failure.')
+  console.error('  Either the test files are missing from this checkout, or they are missing')
+  console.error('  from the published package (check the "files" allow-list in package.json).')
+}
+
+function reportZeroCollected(label, files) {
+  console.error(`zero-test-guard: ${label} collected 0 tests — refusing to report success.`)
+  console.error(`  ${files.length} file(s) matched, but not one test case was collected:`)
+  for (const file of files) console.error(`    ${file}`)
+}
+
+/**
+ * Count the real test cases collected in a TAP summary.
+ *
+ * Node counts a test FILE that declares no test cases as one passing "test"
+ * (`ok 1 - tests/foo.test.mjs`), so the summary's `# tests N` is >= the file count and
+ * can never reach 0 once any file matched. Relying on it alone would let a suite whose
+ * every test file was emptied out report success.
+ *
+ * The reliable discriminator is the subtest NAME: a file-level placeholder is named with
+ * the file path that was passed to the runner, a real test case is named with its test
+ * name. So a top-level subtest whose name is one of our matched paths is a placeholder
+ * and is not counted as a collected case.
+ *
+ * Returns null when the summary cannot be read or parsed -- the caller fails closed.
+ */
+function countCollectedTests(tapPath, files) {
+  let tap = ''
+  try {
+    tap = readFileSync(tapPath, 'utf8')
+  } catch {
+    return null
+  }
+  // The summary count is still asserted to exist: without it the stream is not TAP.
+  if (!/^#\s*tests\s+\d+\s*$/m.test(tap)) return null
+
+  const placeholders = new Set(files)
+  let collected = 0
+  for (const match of tap.matchAll(/^# Subtest: (.+)$/gm)) {
+    if (placeholders.has(match[1].trim())) continue
+    collected += 1
+  }
+  return collected
+}
+
+const { label, globs, nodeFlags } = parseArgs(process.argv.slice(2))
+const files = expand(globs)
+
+if (files.length === 0) {
+  reportMissingFiles(label, globs)
+  process.exit(1)
+}
+
+const scratch = mkdtempSync(join(tmpdir(), 'pantheon-node-tests-'))
+const tapPath = join(scratch, 'summary.tap')
+
+try {
+  const run = spawnSync(
+    process.execPath,
+    [
+      '--test',
+      '--test-reporter=spec',
+      '--test-reporter-destination=stdout',
+      '--test-reporter=tap',
+      `--test-reporter-destination=${tapPath}`,
+      ...nodeFlags,
+      ...files,
+    ],
+    { cwd: ROOT, stdio: 'inherit' },
+  )
+
+  if (run.error) {
+    console.error(`zero-test-guard: could not start the test runner: ${run.error.message}`)
+    process.exit(1)
+  }
+  if (run.signal) {
+    console.error(`zero-test-guard: the test runner was killed by ${run.signal}`)
+    process.exit(1)
+  }
+  // Real failures keep the runner's own exit code; the guard only speaks up when the
+  // runner claimed success it cannot justify.
+  if (run.status !== 0) process.exit(run.status)
+
+  const collected = countCollectedTests(tapPath, files)
+  if (collected === null) {
+    console.error('zero-test-guard: could not read the collected test count from the TAP summary.')
+    console.error('  Failing closed: an unreadable summary cannot certify that any test ran.')
+    process.exit(1)
+  }
+  if (collected === 0) {
+    reportZeroCollected(label, files)
+    process.exit(1)
+  }
+} finally {
+  rmSync(scratch, { recursive: true, force: true })
+}

package/scripts/sync-artifacts.mjs

@@ -19,10 +19,10 @@
  */
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs'
 import { join } from 'node:path'
+import { copyAgentPrompts, writeAgentsMdManaged } from './build-agents-md.mjs'
 
 import {
   collectSkillNames,
-  copyFiles,
   installSkills,
   ROOT,
   syncDir,
@@ -31,15 +31,16 @@ import {
 
 /** Canonical MCP script sources — mirrors installOpenCode phase 2.10. */
 const MCP_SCRIPTS = {
-  'mcp_resources_server.py': () => join(ROOT, 'src', 'mcp', 'mcp_resources_server.py'),
-  'code_mode_server.py': () => join(ROOT, 'src', 'mcp', 'code_mode_server.py'),
-  'memory_mcp_server.py': () => join(ROOT, 'src', 'mcp', 'memory_mcp_server.py'),
-  'mcp_persistence_server.py': () => join(ROOT, 'src', 'mcp', 'mcp_persistence_server.py'),
+  'mcp_resources.py': () => join(ROOT, 'src', 'mcp', 'mcp_resources.py'),
+  'code_mode.py': () => join(ROOT, 'src', 'mcp', 'code_mode.py'),
+  'memory_mcp.py': () => join(ROOT, 'src', 'mcp', 'memory_mcp.py'),
+  'mcp_persistence.py': () => join(ROOT, 'src', 'mcp', 'mcp_persistence.py'),
   '_pantheon_paths.py': () => join(ROOT, 'src', 'mcp', '_pantheon_paths.py'),
   'mcp_codemap_module.py': () => join(ROOT, 'src', 'mcp', 'mcp_codemap_module.py'),
-  'pantheon_vision_server.py': () => join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py'),
+  'pantheon_vision.py': () => join(ROOT, 'src', 'mcp', 'pantheon_vision.py'),
   'eval_store.py': () => join(ROOT, 'src', 'mcp', 'eval_store.py'),
   'scrub-secrets.py': () => join(ROOT, 'scripts', 'scrub-secrets.py'),
+  'themis_heuristic_scan.py': () => join(ROOT, 'scripts', 'themis_heuristic_scan.py'),
 }
 
 /**
@@ -59,7 +60,7 @@ export function syncCopyArtifacts(configDir) {
     const dstAgents = join(configDir, 'agents')
     if (existsSync(join(ROOT, 'src', 'agents'))) {
       mkdirSync(dstAgents, { recursive: true })
-      bump(copyFiles(join(ROOT, 'src', 'agents'), dstAgents, false))
+      bump(copyAgentPrompts(join(ROOT, 'src', 'agents'), dstAgents, false))
       const routing = join(ROOT, 'src', 'routing.yml')
       if (existsSync(routing)) {
         if (
@@ -82,15 +83,27 @@ export function syncCopyArtifacts(configDir) {
     result.errors.push(`skills: ${err.message}`)
   }
 
-  // ── instructions (AGENTS.md) ──
+  // ── instructions (global AGENTS.md artifact) ──
+  // The config dir is GLOBAL context: it receives the repo-agnostic global
+  // artifact, never the repository artifact. Managed-region writer keeps any
+  // user content around the markers intact.
   try {
-    const src = join(ROOT, 'AGENTS.md')
+    const src = join(ROOT, 'AGENTS.global.md')
     if (existsSync(src)) {
-      if (
-        writeIfChanged(join(configDir, 'AGENTS.md'), readFileSync(src, 'utf8'), false) === 'created'
-      ) {
+      const status = writeAgentsMdManaged(
+        join(configDir, 'AGENTS.md'),
+        readFileSync(src, 'utf8'),
+        false,
+      )
+      if (status === 'skipped') result.skipped++
+      else {
         result.created++
-      } else result.skipped++
+        if (status === 'merged') {
+          result.errors.push(
+            'instructions: non-generated content found in AGENTS.md — preserved around the Pantheon managed region',
+          )
+        }
+      }
     }
   } catch (err) {
     result.errors.push(`instructions: ${err.message}`)

package/scripts/sync-tui.mjs

@@ -14,6 +14,7 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync
 import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
+import { resolveOpenCodeVersion } from './install/opencode-version.mjs'
 
 const __dirname = fileURLToPath(new URL('.', import.meta.url))
 const ROOT = join(__dirname, '..')
@@ -63,7 +64,7 @@ function resolveConfigDir() {
  * The raw TSX source is never copied — the loader consumes only the bundle.
  * @returns {{ created: number, skipped: number }}
  */
-function copyPluginFiles(srcDir, dstDir) {
+function copyPluginFiles(srcDir, dstDir, version) {
   const result = { created: 0, skipped: 0 }
 
   mkdirSync(dstDir, { recursive: true })
@@ -87,11 +88,30 @@ function copyPluginFiles(srcDir, dstDir) {
   // package.json
   const pkgSrc = join(srcDir, 'package.json')
   if (existsSync(pkgSrc)) {
-    const content = readFileSync(pkgSrc, 'utf8')
+    const packageJson = JSON.parse(readFileSync(pkgSrc, 'utf8'))
+    if (version === 'v2' && packageJson.exports?.['./tui-v2']) {
+      packageJson.exports['./tui'] = packageJson.exports['./tui-v2']
+    }
+    const content = `${JSON.stringify(packageJson, null, 2)}\n`
     if (writeIfChanged(join(dstDir, 'package.json'), content)) result.created++
     else result.skipped++
   }
 
+  const tuiEntry = join(srcDir, version === 'v2' ? 'tui-v2.ts' : 'tui.ts')
+  if (existsSync(tuiEntry)) {
+    if (writeIfChanged(join(dstDir, 'tui.ts'), readFileSync(tuiEntry, 'utf8'))) result.created++
+    else result.skipped++
+  }
+
+  const v2ServerEntry = join(srcDir, 'index-v2.ts')
+  const v2ServerDestination = join(dstDir, 'index.ts')
+  if (version === 'v2' && existsSync(v2ServerEntry)) {
+    if (writeIfChanged(v2ServerDestination, readFileSync(v2ServerEntry, 'utf8'))) result.created++
+    else result.skipped++
+  } else if (existsSync(v2ServerDestination)) {
+    rmSync(v2ServerDestination, { force: true })
+  }
+
   // Keep the copied plugin installable with deterministic npm ci.
   const lockSrc = join(srcDir, 'package-lock.json')
   if (existsSync(lockSrc)) {
@@ -169,7 +189,8 @@ async function main() {
     const sourceVersion = readVersion(join(tuiSrcDir, 'package.json'))
 
     // Copy fresh files
-    const { created } = copyPluginFiles(tuiSrcDir, tuiCopyDir)
+    const version = resolveOpenCodeVersion('auto', { warn: (message) => console.warn(message) })
+    const { created } = copyPluginFiles(tuiSrcDir, tuiCopyDir, version)
 
     // Lockfile installation is the only accepted dependency path. Strip
     // global-context npm vars so a global postinstall can't trigger ECIGLOBAL.