pantheon-opencode 1.6.0-beta.10 → 1.6.0-beta.12

package/scripts/reconcile.mjs

@@ -0,0 +1,325 @@
+#!/usr/bin/env node
+/** Preview or remove only files proven stale by the install ownership inventory. */
+import {
+  closeSync,
+  constants,
+  existsSync,
+  fsyncSync,
+  openSync,
+  readFileSync,
+  writeFileSync,
+} from 'node:fs'
+import { homedir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { applyFileDriftPlan, classifyFileInventory } from './install/file-inventory.mjs'
+import { readState } from './install/state.mjs'
+import { assertNoSymlinkAncestors, verifyRegularFile } from './install/verify.mjs'
+
+const VALID_COMPONENTS = [
+  'agents',
+  'skills',
+  'instructions',
+  'prompts',
+  'commands',
+  'plugins',
+  'runtime',
+]
+const DEFAULT_COMPONENTS = [...VALID_COMPONENTS]
+
+export function parseArgs(argv) {
+  const args = {
+    project: false,
+    global: false,
+    target: null,
+    components: null,
+    apply: false,
+    dryRun: false,
+    yes: false,
+    savePlan: null,
+    applyPlan: null,
+    help: false,
+  }
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]
+    if (arg === '--project') args.project = true
+    else if (arg === '--global') args.global = true
+    else if (arg === '--target') {
+      const target = argv[++i]
+      if (!target || target.startsWith('--')) throw new Error('--target requires a path')
+      args.target = target
+    } else if (arg === '--components') args.components = argv[++i] ?? null
+    else if (arg === '--apply') args.apply = true
+    else if (arg === '--dry-run') args.dryRun = true
+    else if (arg === '--yes' || arg === '-y') args.yes = true
+    else if (arg === '--save-plan') args.savePlan = argv[++i] ?? null
+    else if (arg === '--apply-plan') args.applyPlan = argv[++i] ?? null
+    else if (arg === '--help' || arg === '-h') args.help = true
+    else throw new Error(`Unknown reconcile option: ${arg}`)
+  }
+  if (!args.applyPlan && !args.help) {
+    if (args.project && (args.global || args.target !== null)) {
+      throw new Error('--project cannot be combined with --global or --target')
+    }
+    if (!args.project && !args.global && args.target === null) {
+      throw new Error('Choose a target scope: --project, --global, or --target PATH')
+    }
+  }
+  if (args.components !== null) {
+    args.components = args.components
+      .split(',')
+      .map((item) => item.trim())
+      .filter(Boolean)
+    if (
+      args.components.length === 0 ||
+      args.components.some((item) => !VALID_COMPONENTS.includes(item))
+    ) {
+      throw new Error(
+        `--components must be a comma-separated list of: ${VALID_COMPONENTS.join(', ')}`,
+      )
+    }
+    args.components = [...new Set(args.components)]
+  }
+  if (args.apply && args.applyPlan) throw new Error('Use either --apply or --apply-plan, not both')
+  if (args.dryRun && (args.apply || args.applyPlan)) {
+    throw new Error('--dry-run cannot be combined with an apply option')
+  }
+  if (args.savePlan && (args.apply || args.applyPlan))
+    throw new Error('--save-plan is available only during preview')
+  if (args.yes && !args.apply && !args.applyPlan)
+    throw new Error('--yes requires --apply or --apply-plan')
+  if (args.applyPlan && (args.project || args.global || args.target || args.components)) {
+    throw new Error('--apply-plan uses the target and components embedded in the reviewed plan')
+  }
+  return args
+}
+
+function printHelp() {
+  console.log(`
+pantheon-opencode reconcile — review and remove exact stale installer-owned files
+
+Usage:
+  pantheon-opencode reconcile --project [--dry-run] [--components agents,skills] [--save-plan <file>]
+  pantheon-opencode reconcile --global [--target PATH] [--dry-run] [--components agents,skills]
+  pantheon-opencode reconcile --target PATH [--dry-run] [--components agents,skills]
+  pantheon-opencode reconcile --project --apply [--yes]
+  pantheon-opencode reconcile --apply-plan <file> --yes
+
+Use --global for the global OpenCode config target, or --target PATH for an explicit
+target. An explicit target is project-scoped unless combined with --global, which
+selects the flat global layout for that path. Preview is read-only. Apply removes only unchanged, inventoried stale files;
+legacy, modified, missing, symlinked, and ambiguous files are preserved.
+`)
+}
+
+function resolveTarget(args) {
+  if (args.target) return resolve(args.target)
+  if (args.project) return resolve(process.cwd())
+  return resolve(join(homedir(), '.config', 'opencode'))
+}
+
+function layoutFor({ global, version }) {
+  return Object.fromEntries(
+    VALID_COMPONENTS.map((component) => [
+      component,
+      global ? 'global' : version === 'v2' ? 'project-v2' : 'project-v1',
+    ]),
+  )
+}
+
+async function buildReview(target, components, global) {
+  if (!existsSync(target)) throw new Error(`Target directory does not exist: ${target}`)
+  const state = readState(target)
+  if (!state)
+    throw new Error('No readable installer state found; unowned legacy files will not be removed')
+  const { installOpenCode } = await import('./install/opencode.mjs')
+  const desired = await installOpenCode(target, true, false, components, {
+    version: 'auto',
+    global,
+    quiet: true,
+    quietPlan: true,
+    planOnly: true,
+    headless: true,
+  })
+  const desiredFiles = new Map(
+    (desired?.files ?? [])
+      .filter((file) => typeof file.outputFingerprint === 'string')
+      .map((file) => [file.path, { sha256: file.outputFingerprint }]),
+  )
+  const selectedLayouts = layoutFor({ global, version: desired?.openCodeVersion })
+  const report = classifyFileInventory(target, state, {
+    desiredFiles,
+    selectedComponents: components,
+    selectedLayouts,
+  })
+  return {
+    state,
+    report,
+    desiredFiles,
+    selectedLayouts,
+    components,
+    plan: {
+      schema_version: 1,
+      command: 'reconcile',
+      target: resolve(target),
+      selected_components: components,
+      selected_layouts: selectedLayouts,
+      inventory_fingerprint: report.inventoryFingerprint,
+      manual_review: report.manualReview,
+      operations: report.operations,
+    },
+  }
+}
+
+function safePlanShape(plan) {
+  return (
+    plan &&
+    plan.schema_version === 1 &&
+    plan.command === 'reconcile' &&
+    typeof plan.target === 'string' &&
+    Array.isArray(plan.selected_components) &&
+    plan.selected_components.every((component) => VALID_COMPONENTS.includes(component)) &&
+    plan.selected_layouts &&
+    typeof plan.selected_layouts === 'object' &&
+    typeof plan.inventory_fingerprint === 'string' &&
+    Array.isArray(plan.operations)
+  )
+}
+
+function savePlan(filePath, plan) {
+  const destination = resolve(filePath)
+  assertNoSymlinkAncestors(destination)
+  const descriptor = openSync(
+    destination,
+    constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL,
+    0o600,
+  )
+  const contents = `${JSON.stringify(plan, null, 2)}\n`
+  try {
+    writeFileSync(descriptor, contents, 'utf8')
+    fsyncSync(descriptor)
+  } finally {
+    closeSync(descriptor)
+  }
+  verifyRegularFile(destination, contents)
+  return destination
+}
+
+async function authorize(plan, args) {
+  const count = plan.operations.length
+  console.log(`Reviewed ${count} exact stale-owned file(s) under ${plan.target}:`)
+  for (const operation of plan.operations) console.log(`  remove ${operation.path}`)
+  if (plan.operations.length === 0) return true
+  if (args.yes) return true
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    console.error(
+      'Apply requested without authorization. Re-run with --apply --yes or --apply-plan FILE --yes.',
+    )
+    process.exitCode = 2
+    return false
+  }
+  const readline = await import('node:readline/promises')
+  const prompt = readline.createInterface({ input: process.stdin, output: process.stdout })
+  try {
+    const answer = await prompt.question('Remove exactly these files? [y/N] ')
+    return ['y', 'yes'].includes(answer.trim().toLowerCase())
+  } finally {
+    prompt.close()
+  }
+}
+
+function printReport(report) {
+  console.log('Installer file ownership report:')
+  if (report.legacyAmbiguous) {
+    console.log(
+      '  manual-review Legacy files without inventory are unknown and will never be auto-deleted.',
+    )
+  }
+  for (const entry of report.entries) {
+    const suffix = entry.reason ? ` (${entry.reason})` : ''
+    console.log(`  ${entry.classification.padEnd(14)} ${entry.path}${suffix}`)
+  }
+  console.log(
+    `  ${report.operations.length} stale-owned regular file(s) eligible for reviewed removal.`,
+  )
+}
+
+async function runApplyPlan(plan, args) {
+  if (!safePlanShape(plan) || plan.manual_review === true) {
+    throw new Error('Reviewed reconcile plan is invalid or marked for manual review')
+  }
+  const target = resolve(plan.target)
+  const components = plan.selected_components
+  const review = await buildReview(target, components, plan.selected_layouts?.agents === 'global')
+  if (JSON.stringify(review.plan.operations) !== JSON.stringify(plan.operations)) {
+    throw new Error('Reviewed reconcile operation set drifted; no files were removed')
+  }
+  const reviewed = {
+    target,
+    operations: plan.operations,
+    inventoryFingerprint: plan.inventory_fingerprint,
+    manualReview: plan.manual_review,
+  }
+  if (!(await authorize(reviewed, args))) return
+  const result = applyFileDriftPlan(target, review.state, reviewed, {
+    desiredFiles: review.desiredFiles,
+    selectedComponents: components,
+    selectedLayouts: review.selectedLayouts,
+  })
+  console.log(`Removed ${result.removed.length} file(s).`)
+  if (result.backupDir) console.log(`Restorable backup: ${result.backupDir}`)
+}
+
+export async function main(argv = process.argv.slice(2)) {
+  let args
+  try {
+    args = parseArgs(argv)
+  } catch (error) {
+    console.error(`❌ ${error.message}`)
+    process.exitCode = 1
+    return
+  }
+  if (args.help) return printHelp()
+
+  if (args.applyPlan) {
+    try {
+      const plan = JSON.parse(readFileSync(resolve(args.applyPlan), 'utf8'))
+      await runApplyPlan(plan, args)
+    } catch (error) {
+      console.error(`❌ ${error.message}`)
+      process.exitCode = 3
+    }
+    return
+  }
+
+  const target = resolveTarget(args)
+  const components = args.components ?? DEFAULT_COMPONENTS
+  try {
+    const review = await buildReview(target, components, args.global)
+    printReport(review.report)
+    if (args.savePlan) {
+      const savedPath = savePlan(args.savePlan, review.plan)
+      console.log(`Reviewed plan saved: ${savedPath}`)
+      return
+    }
+    if (!args.apply) {
+      console.log('Preview only; no files were written or removed.')
+      return
+    }
+    if (!(await authorize(review.plan, args))) return
+    const result = applyFileDriftPlan(target, review.state, review.report, {
+      desiredFiles: review.desiredFiles,
+      selectedComponents: components,
+      selectedLayouts: review.selectedLayouts,
+    })
+    console.log(`Removed ${result.removed.length} file(s).`)
+    if (result.backupDir) console.log(`Restorable backup: ${result.backupDir}`)
+  } catch (error) {
+    console.error(`❌ ${error.message}`)
+    process.exitCode = 1
+  }
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  await main()
+}

package/scripts/restore.mjs

@@ -0,0 +1,222 @@
+#!/usr/bin/env node
+/**
+ * restore.mjs — Pantheon exact-restore CLI (Beta 11 Setup, phase 2).
+ *
+ * Restores a backup set created by the installer back into the config dir,
+ * reproducing each file byte-for-byte and re-applying its recorded mode. The
+ * restore is itself reversible: the CURRENT state is backed up first.
+ *
+ * Safety contract:
+ *   - the backup manifest is verified (hash of every backed-up file) before any
+ *     restore; a tampered or incomplete set is refused outright;
+ *   - the backup-vs-current diff is shown BY PATH ONLY (never file contents);
+ *   - writing requires explicit authorization (`--yes`); a non-TTY run without
+ *     `--yes` previews and exits without writing.
+ *
+ * Usage:
+ *   pantheon-opencode restore [--project] [--from <dir>] [--dry-run] [--yes]
+ *
+ * Exit codes:
+ *   0 = restored (or preview shown with --dry-run)
+ *   1 = refused (missing/tampered backup, or no authorization)
+ *   2 = usage error
+ */
+
+import { existsSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { isAbsolute, join, resolve } from 'node:path'
+
+import {
+  backupRoot,
+  createBackupSet,
+  isBackupDirName,
+  listBackupSets,
+  planRestore,
+  restoreBackupSet,
+  verifyBackupSet,
+} from './install/backup.mjs'
+
+/**
+ * Resolve the config dir whose `opencode.json` the installer manages.
+ * `--project` targets the CWD; otherwise XDG / PANTHEON_HOME.
+ * @param {{ project?: boolean }} opts
+ * @returns {string}
+ */
+export function resolveConfigDir({ project = false } = {}) {
+  if (project) return resolve(process.cwd())
+  if (process.env.PANTHEON_HOME) return resolve(process.env.PANTHEON_HOME)
+  const base = process.env.XDG_CONFIG_HOME || join(homedir(), '.config')
+  return join(base, 'opencode')
+}
+
+export function parseArgs(argv) {
+  const args = { project: false, from: null, dryRun: false, yes: false, help: false }
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]
+    switch (arg) {
+      case '--project':
+        args.project = true
+        break
+      case '--dry-run':
+        args.dryRun = true
+        break
+      case '--yes':
+      case '-y':
+        args.yes = true
+        break
+      case '--from':
+        args.from = argv[++i] ?? null
+        break
+      case '--help':
+      case '-h':
+        args.help = true
+        break
+      default:
+        break
+    }
+  }
+  return args
+}
+
+export function showHelp() {
+  console.log(`
+pantheon-opencode restore — restore an exact installer backup
+
+Usage:
+  pantheon-opencode restore                       restore newest backup (global config)
+  pantheon-opencode restore --project             restore newest backup (project)
+  pantheon-opencode restore --from <dir>          restore a specific backup set
+  pantheon-opencode restore --dry-run             preview only (writes nothing)
+  pantheon-opencode restore --yes                 authorize the write (non-interactive)
+
+A backup set lives under <config-dir>/.pantheon/backups/<timestamp>/.
+Restore reproduces each file byte-for-byte and re-applies its recorded mode.
+File contents are never printed.
+`)
+}
+
+/**
+ * Choose the backup set to restore.
+ * @param {string} configDir
+ * @param {string|null} from
+ * @returns {{ dir: string, name: string } | null}
+ */
+export function pickBackupSet(configDir, from) {
+  if (from) {
+    // Accept either a bare timestamp set name (resolved under the backups root)
+    // or an explicit directory path.
+    if (isBackupDirName(from)) {
+      const dir = join(backupRoot(configDir), from)
+      return existsSync(dir) ? { dir, name: from } : null
+    }
+    const dir = isAbsolute(from) ? from : resolve(process.cwd(), from)
+    if (!existsSync(dir)) return null
+    return { dir, name: dir.split(/[\\/]/).pop() }
+  }
+  return listBackupSets(configDir)[0] ?? null
+}
+
+/**
+ * @param {object} opts
+ * @param {string} opts.configDir
+ * @param {string} opts.backupDir
+ * @param {boolean} [opts.dryRun]
+ * @param {boolean} [opts.yes]
+ * @returns {Promise<{ ok: boolean, code: number, entries?: object[] }>}
+ */
+export async function runRestore({ configDir, backupDir, dryRun = false, yes = false }) {
+  const verify = verifyBackupSet(backupDir)
+  if (!verify.ok) {
+    console.error(
+      `❌ Refusing to restore: backup failed integrity verification (${verify.reason ?? 'hash mismatch'}).`,
+    )
+    return { ok: false, code: 1 }
+  }
+
+  const plan = planRestore(backupDir, configDir)
+  if (plan.error) {
+    console.error(`❌ Refusing to restore: ${plan.error}.`)
+    return { ok: false, code: 1 }
+  }
+
+  const counts = { create: 0, update: 0, remove: 0, unchanged: 0 }
+  for (const entry of plan.entries) counts[entry.action] += 1
+
+  console.log('')
+  console.log(`Restore plan — ${configDir}`)
+  console.log(`  from   ${backupDir}`)
+  for (const entry of plan.entries) {
+    if (entry.action === 'unchanged') continue
+    console.log(`  ${entry.action.padEnd(9)} ${entry.relativePath}`)
+  }
+  console.log(
+    `  ${counts.create} create · ${counts.update} update · ${counts.remove} remove · ${counts.unchanged} unchanged`,
+  )
+
+  if (dryRun) {
+    console.log('  (dry-run) No files were written.')
+    return { ok: true, code: 0, entries: plan.entries }
+  }
+
+  if (!yes) {
+    // Reuse the shared confirm semantics (default NO). An interactive TTY may
+    // authorize without --yes; a non-TTY run must never proceed silently.
+    const tty = Boolean(process.stdin.isTTY && process.stdout.isTTY)
+    if (!tty) {
+      console.error('❌ Refusing to restore without authorization. Re-run with --yes.')
+      return { ok: false, code: 1 }
+    }
+    const { promptReview } = await import('./install/interactive.mjs')
+    const accepted = await promptReview('Restore these changes?', { default: false })
+    if (!accepted) {
+      console.log('  Nothing restored.')
+      return { ok: true, code: 0, entries: plan.entries }
+    }
+  }
+
+  // Reversible: snapshot the CURRENT state of exactly the affected paths first.
+  // Retention is DISABLED here (`keep: 0`): a retention pass at this point could
+  // delete the very set being restored once 5 older sets already exist (the new
+  // snapshot would be the 6th, and pruning would drop the oldest two — including
+  // the source). Apply still prunes; restore never deletes backups.
+  const { dir: preDir } = createBackupSet({
+    configDir,
+    entries: plan.manifest.entries.map((e) => e.relativePath),
+    packageVersion: plan.manifest.packageVersion,
+    keep: 0,
+  })
+  console.log(`  pre-restore backup: ${preDir}`)
+
+  restoreBackupSet(backupDir, configDir, { dryRun: false })
+  console.log(`  ✅ Restored ${plan.entries.length} path(s).`)
+  return { ok: true, code: 0, entries: plan.entries }
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2))
+  if (args.help) {
+    showHelp()
+    return
+  }
+  const configDir = resolveConfigDir({ project: args.project })
+  const backup = pickBackupSet(configDir, args.from)
+  if (!backup) {
+    console.error(`❌ No backup set found under ${backupRoot(configDir)}`)
+    process.exitCode = 1
+    return
+  }
+  const result = await runRestore({
+    configDir,
+    backupDir: backup.dir,
+    dryRun: args.dryRun,
+    yes: args.yes,
+  })
+  if (!result.ok) process.exitCode = result.code
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  main().catch((err) => {
+    console.error(`❌ Restore failed: ${err instanceof Error ? err.message : String(err)}`)
+    process.exitCode = 1
+  })
+}