pantheon-opencode 1.6.0-beta.10 → 1.6.0-beta.12

package/scripts/build-agents-md.mjs

@@ -35,6 +35,8 @@ import { execFileSync } from 'node:child_process'
 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { ACTIONS, fingerprintOutput, isRecording, recordChange } from './install/plan.mjs'
+import { assertNoSymlinkAncestors, assertPathWithin, verifyRegularFile } from './install/verify.mjs'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 export const ROOT = join(__dirname, '..')
@@ -323,16 +325,41 @@ export function generateProjectAgentsMd(git = readGitInfo()) {
  * @param {boolean} [dryRun=false] - Do not write when true
  * @returns {'created' | 'skipped' | 'updated' | 'upgraded' | 'merged'}
  */
-export function writeAgentsMdManaged(filePath, generated, dryRun = false) {
+export function writeAgentsMdManaged(filePath, generated, dryRun = false, recorder = null) {
+  assertPathWithin(dirname(filePath), filePath)
+  assertNoSymlinkAncestors(filePath)
   const existing = existsSync(filePath) ? readFileSync(filePath, 'utf8') : null
   if (existing === null) {
     if (!dryRun) {
+      assertNoSymlinkAncestors(dirname(filePath))
       mkdirSync(dirname(filePath), { recursive: true })
+      assertNoSymlinkAncestors(filePath)
       writeFileSync(filePath, generated, 'utf8')
+      verifyRegularFile(filePath, generated)
     }
+    recordChange(
+      {
+        path: filePath,
+        action: ACTIONS.CREATE,
+        bytes: Buffer.byteLength(generated, 'utf8'),
+        outputFingerprint: fingerprintOutput(generated),
+      },
+      recorder,
+    )
     return 'created'
   }
-  if (existing === generated) return 'skipped'
+  if (existing === generated) {
+    recordChange(
+      {
+        path: filePath,
+        action: ACTIONS.UNCHANGED,
+        bytes: Buffer.byteLength(existing, 'utf8'),
+        outputFingerprint: fingerprintOutput(existing),
+      },
+      recorder,
+    )
+    return 'skipped'
+  }
 
   const begin = existing.indexOf(MANAGED_BEGIN)
   const end = existing.indexOf(MANAGED_END)
@@ -340,22 +367,71 @@ export function writeAgentsMdManaged(filePath, generated, dryRun = false) {
     const before = existing.slice(0, begin)
     const after = existing.slice(end + MANAGED_END.length)
     const next = `${before}${generated}${after}`
-    if (next === existing) return 'skipped'
-    if (!dryRun) writeFileSync(filePath, next, 'utf8')
+    if (next === existing) {
+      recordChange(
+        {
+          path: filePath,
+          action: ACTIONS.UNCHANGED,
+          bytes: Buffer.byteLength(existing, 'utf8'),
+          outputFingerprint: fingerprintOutput(existing),
+        },
+        recorder,
+      )
+      return 'skipped'
+    }
+    if (!dryRun) {
+      assertNoSymlinkAncestors(filePath)
+      writeFileSync(filePath, next, 'utf8')
+      verifyRegularFile(filePath, next)
+    }
+    recordChange(
+      {
+        path: filePath,
+        action: ACTIONS.UPDATE,
+        bytes: Buffer.byteLength(next, 'utf8'),
+        outputFingerprint: fingerprintOutput(next),
+      },
+      recorder,
+    )
     return before.trim() === '' && after.trim() === '' ? 'updated' : 'merged'
   }
 
   if (existing.startsWith(GENERATED_BY)) {
     // Legacy format: the header declares the whole file machine-generated.
-    if (!dryRun) writeFileSync(filePath, generated, 'utf8')
+    if (!dryRun) {
+      assertNoSymlinkAncestors(filePath)
+      writeFileSync(filePath, generated, 'utf8')
+      verifyRegularFile(filePath, generated)
+    }
+    recordChange(
+      {
+        path: filePath,
+        action: ACTIONS.UPDATE,
+        bytes: Buffer.byteLength(generated, 'utf8'),
+        outputFingerprint: fingerprintOutput(generated),
+      },
+      recorder,
+    )
     return 'upgraded'
   }
 
   // Foreign content: preserve it verbatim and append the managed region.
+  const separator = existing.endsWith('\n') ? '\n' : '\n\n'
+  const payload = `${existing}${separator}${generated}`
   if (!dryRun) {
-    const separator = existing.endsWith('\n') ? '\n' : '\n\n'
-    writeFileSync(filePath, `${existing}${separator}${generated}`, 'utf8')
+    assertNoSymlinkAncestors(filePath)
+    writeFileSync(filePath, payload, 'utf8')
+    verifyRegularFile(filePath, payload)
   }
+  recordChange(
+    {
+      path: filePath,
+      action: ACTIONS.UPDATE,
+      bytes: Buffer.byteLength(payload, 'utf8'),
+      outputFingerprint: fingerprintOutput(payload),
+    },
+    recorder,
+  )
   return 'merged'
 }
 
@@ -423,11 +499,23 @@ export function generateAgentPrompt(agentName, prompt, instructions = readInstru
  * @param {string} targetDir - OpenCode agents directory
  * @param {boolean} dryRun - Do not write when true
  * @param {boolean} existingOnly - Refresh installed prompts without adding missing agents
+ * @param {(change: object) => void} [recorder] - optional change recorder for --dry-run preview
  * @returns {{ created: number, skipped: number }}
  */
-export function copyAgentPrompts(sourceDir, targetDir, dryRun = false, existingOnly = false) {
+export function copyAgentPrompts(
+  sourceDir,
+  targetDir,
+  dryRun = false,
+  existingOnly = false,
+  recorder = null,
+) {
+  assertNoSymlinkAncestors(targetDir)
   const instructions = readInstructions()
-  if (!dryRun && !existingOnly) mkdirSync(targetDir, { recursive: true })
+  if (!dryRun && !existingOnly) {
+    assertNoSymlinkAncestors(targetDir)
+    mkdirSync(targetDir, { recursive: true })
+    assertNoSymlinkAncestors(targetDir)
+  }
   let created = 0
   let skipped = 0
   for (const file of readdirSync(sourceDir)
@@ -439,13 +527,41 @@ export function copyAgentPrompts(sourceDir, targetDir, dryRun = false, existingO
     const agentName = file.replace(/\.md$/, '')
     const output = generateAgentPrompt(agentName, readFileSync(sourcePath, 'utf8'), instructions)
     const targetPath = join(targetDir, file)
+    assertPathWithin(targetDir, targetPath)
+    assertNoSymlinkAncestors(targetPath)
     if (existingOnly && !existsSync(targetPath)) continue
     const existing = existsSync(targetPath) ? readFileSync(targetPath, 'utf8') : null
     if (existing === output) {
       skipped++
+      if (isRecording(recorder)) {
+        recordChange(
+          {
+            path: targetPath,
+            action: ACTIONS.UNCHANGED,
+            bytes: Buffer.byteLength(output, 'utf8'),
+            outputFingerprint: fingerprintOutput(output),
+          },
+          recorder,
+        )
+      }
     } else {
-      if (!dryRun) writeFileSync(targetPath, output, 'utf8')
+      if (!dryRun) {
+        assertNoSymlinkAncestors(targetPath)
+        writeFileSync(targetPath, output, 'utf8')
+        verifyRegularFile(targetPath, output)
+      }
       created++
+      if (isRecording(recorder)) {
+        recordChange(
+          {
+            path: targetPath,
+            action: existing === null ? ACTIONS.CREATE : ACTIONS.UPDATE,
+            bytes: Buffer.byteLength(output, 'utf8'),
+            outputFingerprint: fingerprintOutput(output),
+          },
+          recorder,
+        )
+      }
     }
   }
   return { created, skipped }
@@ -504,6 +620,8 @@ function main() {
 
   writeFileSync(AGENTS_GLOBAL_MD_PATH, global, 'utf8')
   writeFileSync(AGENTS_MD_PATH, project, 'utf8')
+  verifyRegularFile(AGENTS_GLOBAL_MD_PATH, global)
+  verifyRegularFile(AGENTS_MD_PATH, project)
   console.log(
     `✅ Generated AGENTS.md (${logicalLineCount(project)} lines) + AGENTS.global.md ` +
       `(${logicalLineCount(global)} lines, ${sharedCount} shared instruction sections)`,

package/scripts/check-plugin-v2-coverage.mjs

@@ -3,8 +3,8 @@ import { mkdtempSync, readdirSync, readFileSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
+import { isSupportedNodeVersion, MIN_SUPPORTED_NODE_VERSION } from './node-engine-policy.mjs'
 
-export const REQUIRED_NODE_VERSION = 'v24.15.0'
 export const LINE_THRESHOLD_NUMERATOR = 4
 export const LINE_THRESHOLD_DENOMINATOR = 5
 
@@ -103,13 +103,13 @@ export function parseTargetLcov(report, repoRoot, targetPath) {
   const found = integerField(exactlyOneField(lines, 'LF'), 'LF', 1)
   const hit = integerField(exactlyOneField(lines, 'LH'), 'LH', 0)
   if (hit > found) throw new Error(`LH ${hit} exceeds LF ${found}`)
-  if (found !== lineRecords.size) {
-    throw new Error(`LF ${found} does not equal ${lineRecords.size} unique DA entries`)
+  if (lineRecords.size > found) {
+    throw new Error(`LF ${found} is less than ${lineRecords.size} unique DA entries`)
   }
 
   const coveredRecords = [...lineRecords.values()].filter((count) => count > 0).length
-  if (hit !== coveredRecords) {
-    throw new Error(`LH ${hit} does not equal ${coveredRecords} covered DA entries`)
+  if (hit < coveredRecords) {
+    throw new Error(`LH ${hit} is less than ${coveredRecords} covered DA entries`)
   }
 
   return {
@@ -142,9 +142,9 @@ function listTypeScriptTests(repoRoot) {
 }
 
 function runCoverage() {
-  if (process.version !== REQUIRED_NODE_VERSION) {
+  if (!isSupportedNodeVersion(process.versions.node)) {
     throw new Error(
-      `plugin-v2 coverage requires Node ${REQUIRED_NODE_VERSION}; got ${process.version}`,
+      `plugin-v2 coverage requires Node.js >= ${MIN_SUPPORTED_NODE_VERSION}; got ${process.version}`,
     )
   }
 

package/scripts/doctor.mjs

@@ -30,6 +30,9 @@ import { basename, dirname, isAbsolute, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 import { listV2UnsupportedFeatures } from '../src/pantheon/v2-unsupported.mjs'
+import { classifyFileInventory } from './install/file-inventory.mjs'
+import { readState } from './install/state.mjs'
+import { isSupportedNodeVersion, MIN_SUPPORTED_NODE_VERSION } from './node-engine-policy.mjs'
 
 // ---------------------------------------------------------------------------
 // Paths
@@ -47,6 +50,9 @@ const counts = { pass: 0, warn: 0, error: 0, info: 0 }
 
 const results = []
 let exitCode = 0
+let jsonMode = false
+let jsonOriginalWrite = null
+let jsonArgs = null
 
 // ---------------------------------------------------------------------------
 // CLI arg parsing
@@ -58,6 +64,7 @@ function parseArgs(argv) {
     platform: null,
     fix: false,
     verbose: false,
+    json: false,
     help: false,
     profile: process.env.PANTHEON_PROFILE ?? 'auto',
   }
@@ -73,6 +80,9 @@ function parseArgs(argv) {
       case '--verbose':
         args.verbose = true
         break
+      case '--json':
+        args.json = true
+        break
       case '--profile':
         args.profile = argv[++i] ?? 'auto'
         break
@@ -123,22 +133,22 @@ const ICON = {
   info: '\u2139\uFE0F', // ℹ️
 }
 
-function emit(category, message) {
+function emit(category, message, metadata = {}) {
   counts[category]++
-  results.push({ category, message })
+  results.push({ category, message, ...metadata })
   if (category === 'pass' && !process.argv.includes('--verbose')) return
   const prefix = ICON[category] ?? category
   console.log(`  ${prefix} ${message}`)
 }
 
-function pass(msg) {
-  emit('pass', msg)
+function pass(msg, metadata = {}) {
+  emit('pass', msg, metadata)
 }
-function warn(msg) {
-  emit('warn', msg)
+function warn(msg, metadata = {}) {
+  emit('warn', msg, metadata)
 }
-function error(msg) {
-  emit('error', msg)
+function error(msg, metadata = {}) {
+  emit('error', msg, metadata)
   exitCode = 2
 }
 function info(msg) {
@@ -159,7 +169,8 @@ function showHelp() {
    node scripts/doctor.mjs                              auto-detect, cwd
    node scripts/doctor.mjs --target /path/to/project     target project
    node scripts/doctor.mjs --profile global|lite|sandbox profile policy
-   node scripts/doctor.mjs --fix                         attempt auto-fixes
+  node scripts/doctor.mjs --fix                         attempt auto-fixes
+  node scripts/doctor.mjs --json                        read-only JSON report
    node scripts/doctor.mjs --verbose                     detailed output
    node scripts/doctor.mjs --help                        show this help
 
@@ -1265,6 +1276,7 @@ export function checkInstallVersionDrift(args) {
     warn(
       `Package v${pkgVersion} is newer than the last-synced installation (v${installed}) — ` +
         'run `npx pantheon-opencode update` (or re-run init) to refresh config, venv and MCP entries',
+      { code: 'install_version_drift', classification: 'advisory' },
     )
     return 'package-newer'
   }
@@ -1272,6 +1284,7 @@ export function checkInstallVersionDrift(args) {
     warn(
       `Installation marker (v${installed}) is newer than this package (v${pkgVersion}) — ` +
         'the doctor is running from a different install than the last sync',
+      { code: 'install_version_drift', classification: 'advisory' },
     )
     return 'install-newer'
   }
@@ -1841,13 +1854,47 @@ export function classifyNodeSqliteProbe(probe) {
   }
 }
 
+/** Classify the Node package-support policy independently of feature probes. */
+export function classifyNodePackageRuntime(version) {
+  if (isSupportedNodeVersion(version)) {
+    return {
+      status: 'supported',
+      code: 'node_version_supported',
+      message: `Node.js v${String(version).replace(/^v/, '')} meets Pantheon's package requirement (>= ${MIN_SUPPORTED_NODE_VERSION})`,
+    }
+  }
+  return {
+    status: 'unsupported',
+    code: 'node_version_unsupported',
+    message: `Pantheon requires Node.js >= ${MIN_SUPPORTED_NODE_VERSION}; current runtime is v${String(version).replace(/^v/, '')}`,
+  }
+}
+
 function checkNodeRuntime() {
   section('K. Node Runtime')
+  const packageRuntime = classifyNodePackageRuntime(process.versions.node)
+  if (packageRuntime.status === 'supported') {
+    pass(packageRuntime.message, {
+      code: packageRuntime.code,
+      classification: 'runtime',
+    })
+  } else {
+    error(packageRuntime.message, { code: packageRuntime.code, classification: 'runtime' })
+  }
+
+  // This capability check is independent of the package support floor: it
+  // describes pantheon_cost's optional backend, not Pantheon's Node support.
   const outcome = classifyNodeSqliteProbe(probeNodeSqlite())
   if (outcome.status === 'ok') {
-    pass(outcome.message)
+    pass(outcome.message, {
+      code: 'node_sqlite_supported',
+      classification: 'capability',
+    })
   } else {
-    warn(outcome.message)
+    warn(outcome.message, {
+      code: 'node_sqlite_unsupported',
+      classification: 'capability',
+    })
     info(
       `Upgrade to Node >= ${NODE_SQLITE_MIN} (or a runtime with node:sqlite) to enable pantheon_cost`,
     )
@@ -1898,22 +1945,156 @@ function printSummary(targetPath) {
 // Main
 // ---------------------------------------------------------------------------
 
+async function checkInstallerFileInventory(args) {
+  const state = readState(args.target)
+  if (!state) return
+  const selectedComponents = [
+    'agents',
+    'skills',
+    'instructions',
+    'prompts',
+    'commands',
+    'plugins',
+    'runtime',
+  ]
+  let desiredFiles = new Map()
+  let desiredUnavailable = true
+  let selectedLayouts = {}
+  try {
+    const { installOpenCode, isGlobalConfigDir } = await import('./install/opencode.mjs')
+    const preview = await installOpenCode(args.target, true, false, selectedComponents, {
+      version: 'auto',
+      quiet: true,
+      quietPlan: true,
+      planOnly: true,
+      headless: true,
+    })
+    desiredFiles = new Map(
+      (preview?.files ?? [])
+        .filter((file) => typeof file.outputFingerprint === 'string')
+        .map((file) => [file.path, { sha256: file.outputFingerprint }]),
+    )
+    const layout = isGlobalConfigDir(args.target)
+      ? 'global'
+      : preview?.openCodeVersion === 'v2'
+        ? 'project-v2'
+        : 'project-v1'
+    selectedLayouts = Object.fromEntries(selectedComponents.map((component) => [component, layout]))
+    desiredUnavailable = false
+  } catch {
+    // Doctor remains advisory if a source/layout preview cannot be computed.
+    // The fallback labels equal recorded hashes explicitly, never as current.
+  }
+  let report
+  try {
+    report = classifyFileInventory(args.target, state, {
+      desiredFiles,
+      desiredUnavailable,
+      selectedComponents,
+      selectedLayouts,
+    })
+  } catch {
+    warn('Installer file inventory could not be safely inspected.', {
+      code: 'installer_inventory_unreadable',
+      classification: 'ambiguous',
+    })
+    return
+  }
+  if (report.legacyAmbiguous) {
+    warn('Legacy installed files have no ownership inventory; cleanup requires manual review.', {
+      code: 'installer_inventory_legacy_unknown',
+      classification: 'ambiguous',
+    })
+  }
+  const recordedCurrent = report.entries.filter(
+    (entry) => entry.classification === 'recorded-current',
+  ).length
+  if (recordedCurrent > 0) {
+    emit(
+      'info',
+      `${recordedCurrent} inventoried file(s) match their recorded install hashes; current package payload was not compared.`,
+      { code: 'installer_file_recorded_current', classification: 'recorded-current' },
+    )
+  }
+  for (const entry of report.entries) {
+    if (entry.classification === 'modified') {
+      warn(`Installer-owned file was modified and will be preserved: ${entry.path}`, {
+        code: 'installer_file_modified',
+        classification: 'modified',
+      })
+    } else if (entry.classification === 'missing') {
+      warn(`Previously installer-owned file is missing: ${entry.path}`, {
+        code: 'installer_file_missing',
+        classification: 'missing',
+      })
+    } else if (entry.classification === 'update-drift') {
+      warn(`Installer source has a newer version of an unchanged owned file: ${entry.path}`, {
+        code: 'installer_file_update_available',
+        classification: 'update-drift',
+      })
+    } else if (entry.classification === 'stale-owned') {
+      warn(`Stale installer-owned file is eligible for reviewed cleanup: ${entry.path}`, {
+        code: 'installer_file_stale_owned',
+        classification: 'stale-owned',
+      })
+    } else if (entry.classification === 'ambiguous') {
+      warn(`Installer ownership is ambiguous for ${entry.path}; file preserved.`, {
+        code: 'installer_file_ambiguous',
+        classification: 'ambiguous',
+      })
+    }
+  }
+}
+
 async function main() {
   const args = parseArgs(process.argv)
+  jsonMode = args.json
+  jsonArgs = args
+  if (jsonMode) {
+    jsonOriginalWrite = process.stdout.write
+    process.stdout.write = () => true
+  }
 
   if (args.help) {
+    if (jsonMode) {
+      process.stdout.write = jsonOriginalWrite
+      jsonOriginalWrite = null
+    }
     showHelp()
-    process.exit(0)
+    process.exitCode = 0
+    return
+  }
+
+  if (args.json && args.fix) {
+    writeDoctorJson(
+      {
+        schema_version: 1,
+        command: 'doctor',
+        status: 'error',
+        target: resolve(args.target),
+        profile: args.profile,
+        summary: { ...counts, exit_code: 1 },
+        findings: [{ category: 'error', code: 'json_fix_unsupported', classification: 'usage' }],
+      },
+      1,
+    )
+    return
   }
 
   // Report the resolved validation profile up front (auto → global/sandbox)
   // so callers — including the `doctor` CLI wrapper — can see which policy
   // gate applied before any check output.
-  console.log(`Validation profile: ${args.profile}`)
+  if (!jsonMode) console.log(`Validation profile: ${args.profile}`)
 
   if (!existsSync(args.target)) {
-    console.error(`❌ Target directory does not exist: ${args.target}`)
-    process.exit(2)
+    if (jsonMode) {
+      error(`Target directory does not exist: ${args.target}`)
+      writeDoctorJson(createDoctorJsonReport(args), exitCode)
+    } else {
+      console.error(`❌ Target directory does not exist: ${args.target}`)
+      process.exitCode = 2
+    }
+    return
   }
 
   // Verify it looks like a Pantheon project or an OpenCode install target.
@@ -1944,7 +2125,14 @@ async function main() {
   checkCodeModeManifest(args)
   checkInstallVersionDrift(args)
   checkPluginVersionDrift(args)
-  await checkMcpRuntimeSmoke(args)
+  await checkInstallerFileInventory(args)
+  if (jsonMode) {
+    info('MCP runtime smoke skipped to keep --json read-only')
+    results.at(-1).code = 'mcp_runtime_smoke_skipped'
+    results.at(-1).classification = 'not_run'
+  } else {
+    await checkMcpRuntimeSmoke(args)
+  }
   checkPermissionMismatches(args)
   checkSyncStatus(args)
   checkGitStatus(args)
@@ -1954,13 +2142,48 @@ async function main() {
   checkV2UnsupportedFeatures(args)
 
   printSummary(args.target)
+  if (jsonMode) writeDoctorJson(createDoctorJsonReport(args), exitCode)
+  else process.exitCode = exitCode
+}
 
-  process.exit(exitCode)
+function createDoctorJsonReport(args) {
+  return {
+    schema_version: 1,
+    command: 'doctor',
+    status: exitCode === 2 ? 'error' : counts.warn > 0 ? 'warning' : 'ok',
+    target: resolve(args.target),
+    profile: args.profile,
+    summary: { ...counts, exit_code: exitCode },
+    findings: results,
+  }
+}
+
+function writeDoctorJson(report, code) {
+  const writer = jsonOriginalWrite ?? process.stdout.write
+  process.stdout.write = writer
+  jsonOriginalWrite = null
+  writer.call(process.stdout, `${JSON.stringify(report)}\n`)
+  process.exitCode = code
 }
 
 if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
   main().catch((err) => {
-    console.error(`❌ Doctor crashed: ${err.stack ?? err.message}`)
-    process.exit(2)
+    if (jsonMode) {
+      writeDoctorJson(
+        {
+          schema_version: 1,
+          command: 'doctor',
+          status: 'error',
+          target: jsonArgs ? resolve(jsonArgs.target) : null,
+          profile: jsonArgs?.profile ?? null,
+          summary: { ...counts, exit_code: 2 },
+          findings: [{ category: 'error', code: 'doctor_failure', classification: 'error' }],
+        },
+        2,
+      )
+    } else {
+      console.error(`❌ Doctor crashed: ${err.stack ?? err.message}`)
+      process.exitCode = 2
+    }
   })
 }