pantheon-opencode 1.6.0-beta.1 → 1.6.0-beta.11

package/scripts/validate-sandbox-install.mjs

@@ -0,0 +1,138 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto'
+import { readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const PACKAGE_REF = /^(?:npm:)?pantheon-opencode(?:@[^/]+)?(?:\/(?:plugin|plugin-v2))?$/
+export const SANDBOX_SOURCE_FILES = [
+  'bin/pantheon-init.mjs',
+  'scripts/install/config-migration.mjs',
+  'scripts/install/opencode.mjs',
+  'scripts/validate-sandbox-install.mjs',
+  'src/plugin-v2.ts',
+]
+
+function readJson(path, label) {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'))
+  } catch (error) {
+    throw new Error(`cannot read ${label} at ${path}: ${error.message}`)
+  }
+}
+
+function pluginReferences(config) {
+  const refs = []
+  for (const key of ['plugin', 'plugins']) {
+    const value = config?.[key]
+    const entries = Array.isArray(value) ? value : value === undefined ? [] : [value]
+    for (const entry of entries) {
+      if (typeof entry === 'string') refs.push(entry)
+      else if (entry && typeof entry === 'object' && !Array.isArray(entry)) {
+        for (const field of ['package', 'id', 'name', 'path', 'source']) {
+          if (typeof entry[field] === 'string') refs.push(entry[field])
+        }
+      }
+    }
+  }
+  return refs
+}
+
+/**
+ * Prove that the sandbox is executing the package built from this checkout and
+ * that the project config cannot silently load an older npm-cached Pantheon.
+ */
+export function validateSandboxInstall({ repoDir, installDir, projectConfig, configPaths = [] }) {
+  const sourcePackagePath = join(resolve(repoDir), 'package.json')
+  const installedPackagePath = join(resolve(installDir), 'package.json')
+  const sourcePackage = readJson(sourcePackagePath, 'checkout package manifest')
+  const installedPackage = readJson(installedPackagePath, 'sandbox package manifest')
+  if (sourcePackage.version !== installedPackage.version) {
+    throw new Error(
+      `sandbox package version ${installedPackage.version} does not match checkout ${sourcePackage.version}`,
+    )
+  }
+
+  const sourceHash = createHash('sha256')
+  for (const relativePath of SANDBOX_SOURCE_FILES) {
+    let source
+    let installed
+    try {
+      source = readFileSync(join(resolve(repoDir), relativePath))
+      installed = readFileSync(join(resolve(installDir), relativePath))
+    } catch (error) {
+      throw new Error(`cannot compare package source ${relativePath}: ${error.message}`)
+    }
+    if (!source.equals(installed)) {
+      throw new Error(`installed package source differs from checkout: ${relativePath}`)
+    }
+    sourceHash.update(relativePath).update('\0').update(installed).update('\0')
+  }
+
+  const expectedPluginPath = resolve(installDir, 'src', 'plugin-v2')
+  const allConfigPaths = [...new Set([projectConfig, ...configPaths].map((path) => resolve(path)))]
+  let activeProjectPluginCount = 0
+  for (const configPath of allConfigPaths) {
+    const config = readJson(configPath, 'active OpenCode config')
+    if (!config || typeof config !== 'object' || Array.isArray(config)) {
+      throw new Error(`active OpenCode config must be an object: ${configPath}`)
+    }
+    for (const ref of pluginReferences(config)) {
+      const normalized = ref.replaceAll('\\', '/').replace(/\/$/, '')
+      if (PACKAGE_REF.test(normalized)) {
+        throw new Error(`stale Pantheon package reference in ${configPath}: ${ref}`)
+      }
+      if (resolve(ref) === expectedPluginPath) {
+        if (configPath === resolve(projectConfig)) activeProjectPluginCount += 1
+      }
+    }
+  }
+  if (activeProjectPluginCount !== 1) {
+    throw new Error(
+      `project config must reference the sandbox V2 plugin exactly once; found ${activeProjectPluginCount}: ${resolve(projectConfig)}`,
+    )
+  }
+
+  return {
+    status: 'PASS',
+    version: installedPackage.version,
+    sourceSha256: sourceHash.digest('hex'),
+  }
+}
+
+function parseArgs(args) {
+  const options = { configPaths: [] }
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i]
+    if (arg === '--config') options.configPaths.push(args[++i])
+    else if (['--repo', '--install', '--project-config'].includes(arg))
+      options[arg.slice(2).replace('-', '')] = args[++i]
+    else throw new Error(`unknown argument: ${arg}`)
+  }
+  for (const required of ['repo', 'install', 'projectconfig']) {
+    if (!options[required])
+      throw new Error(
+        `missing required option --${required.replace('projectconfig', 'project-config')}`,
+      )
+  }
+  return {
+    repoDir: options.repo,
+    installDir: options.install,
+    projectConfig: options.projectconfig,
+    configPaths: options.configPaths,
+  }
+}
+
+function main() {
+  try {
+    const result = validateSandboxInstall(parseArgs(process.argv.slice(2)))
+    process.stdout.write(
+      `Sandbox install proof: ${result.status} (version ${result.version}, source sha256 ${result.sourceSha256})\n`,
+    )
+  } catch (error) {
+    process.stderr.write(`Sandbox install proof: FAIL — ${error.message}\n`)
+    process.exitCode = 1
+  }
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) main()

package/scripts/versioning.mjs

@@ -24,6 +24,7 @@ import { execFileSync } from 'node:child_process'
 import { existsSync, readFileSync } from 'node:fs'
 import { basename, dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { mergeUnreleasedIntoVersion } from './changelog-merge.mjs'
 import {
   commitPreparedUpdates,
   prepareInventoryVersion,
@@ -471,6 +472,17 @@ switch (command) {
   case 'changelog': {
     const version = arg || getCurrentVersion()
     const date = new Date().toISOString().slice(0, 10)
+    const currentChangelog = readFileSync(CHANGELOG_PATH, 'utf-8')
+    const mergePlan = mergeUnreleasedIntoVersion(currentChangelog, version)
+    if (mergePlan) {
+      if (mergePlan.changed) {
+        commitPreparedUpdates([{ path: CHANGELOG_PATH, content: mergePlan.content }])
+        console.log(`  ✓ CHANGELOG: merged [Unreleased] into existing [v${version}]`)
+      } else {
+        console.log(`  ✓ CHANGELOG: [Unreleased] is empty; [v${version}] unchanged`)
+      }
+      break
+    }
     const changelogPlan = prepareUnreleased(version, date)
     if (changelogPlan.changed) {
       commitPreparedUpdates([{ path: CHANGELOG_PATH, content: changelogPlan.content }])
@@ -492,7 +504,7 @@ Commands:
                        --beta: advance the committed X.Y.Z-beta.N line and
                        promote [Unreleased] → [vX.Y.Z-beta.N] in CHANGELOG
   beta                 Alias for 'apply --beta'
-  changelog [version]  Promote [Unreleased] → [vX.Y.Z] without bumping
+  changelog [version]  Promote [Unreleased], or merge into an existing version section
 
 Release flow (stable):
   1. node scripts/versioning.mjs apply [minor]