pantheon-opencode 1.6.0-beta.11 → 1.6.0-beta.12

package/scripts/install/verify.mjs

@@ -0,0 +1,128 @@
+import {
+  closeSync,
+  fsyncSync,
+  lstatSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+} from 'node:fs'
+import { isAbsolute, parse, relative, resolve, sep } from 'node:path'
+
+/** Reject symlinked path components before a managed filesystem operation. */
+export function assertNoSymlinkAncestors(filePath, { includeLeaf = true } = {}) {
+  const absolute = resolve(filePath)
+  const root = parse(absolute).root
+  const parts = absolute.slice(root.length).split(sep).filter(Boolean)
+  const checked = parts.slice(0, includeLeaf ? parts.length : Math.max(0, parts.length - 1))
+  let current = root
+  for (const [index, part] of checked.entries()) {
+    current = current ? `${current}${current.endsWith(sep) ? '' : sep}${part}` : part
+    let info
+    try {
+      info = lstatSync(current)
+    } catch (error) {
+      if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') return true
+      throw error
+    }
+    if (info.isSymbolicLink()) throw new Error(`Path contains a symlink: ${current}`)
+    if (index < checked.length - 1 && !info.isDirectory()) {
+      throw new Error(`Path ancestor is not a directory: ${current}`)
+    }
+  }
+  return true
+}
+
+/** Require a destination to remain lexically inside its selected target. */
+export function assertPathWithin(rootPath, destinationPath) {
+  const root = resolve(rootPath)
+  const destination = resolve(destinationPath)
+  const fromRoot = relative(root, destination)
+  if (fromRoot === '..' || fromRoot.startsWith(`..${sep}`) || isAbsolute(fromRoot)) {
+    throw new Error(`Path escapes selected target: ${destinationPath}`)
+  }
+  return true
+}
+
+/** Validate lexical containment and reject links before deleting a path. */
+export function assertSafeRemoval(rootPath, destinationPath) {
+  assertPathWithin(rootPath, destinationPath)
+  assertNoSymlinkAncestors(destinationPath)
+  return true
+}
+
+/** Read back a regular-file write without ever including file contents in errors. */
+export function verifyRegularFile(filePath, expected) {
+  const info = lstatSync(filePath)
+  if (!info.isFile() || info.isSymbolicLink()) {
+    throw new Error(`Managed-file write did not produce a regular file: ${filePath}`)
+  }
+  const actual = readFileSync(filePath)
+  const expectedBuffer = Buffer.isBuffer(expected) ? expected : Buffer.from(expected)
+  if (!actual.equals(expectedBuffer)) {
+    throw new Error(`Managed-file read-back verification failed: ${filePath}`)
+  }
+  return true
+}
+
+/**
+ * Atomically write a managed file using a private, exclusively-created temp.
+ * Existing destinations are replaced only after path checks and a temp read-back.
+ */
+export function writeFileAtomically(filePath, content) {
+  const temporary = `${filePath}.tmp-${process.pid}`
+  assertNoSymlinkAncestors(filePath)
+  assertRegularFileOrMissing(filePath)
+  assertNoSymlinkAncestors(temporary)
+
+  let fd
+  let createdTemporary = false
+  try {
+    fd = openSync(temporary, 'wx', 0o600)
+    createdTemporary = true
+    writeFileSync(fd, content)
+    fsyncSync(fd)
+    closeSync(fd)
+    fd = undefined
+
+    verifyRegularFile(temporary, content)
+    assertNoSymlinkAncestors(filePath)
+    assertRegularFileOrMissing(filePath)
+    renameSync(temporary, filePath)
+    createdTemporary = false
+    verifyRegularFile(filePath, content)
+  } finally {
+    if (fd !== undefined) closeSync(fd)
+    if (createdTemporary) {
+      try {
+        assertNoSymlinkAncestors(temporary)
+        unlinkSync(temporary)
+      } catch {
+        // Preserve the write error; do not follow or remove an unsafe path.
+      }
+    }
+  }
+}
+
+function assertRegularFileOrMissing(filePath) {
+  try {
+    const info = lstatSync(filePath)
+    if (!info.isFile() || info.isSymbolicLink()) {
+      throw new Error(`Refusing to replace non-regular file: ${filePath}`)
+    }
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error
+  }
+}
+
+/** Verify a managed path was removed, without following symlinks. */
+export function verifyPathRemoved(filePath) {
+  try {
+    lstatSync(filePath)
+  } catch (error) {
+    if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') return true
+    throw error
+  }
+  throw new Error(`Managed-path removal verification failed: ${filePath}`)
+}

package/scripts/install/vision-prompt.mjs

@@ -20,6 +20,7 @@ import { copyFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { writeConfigWithBackup } from './shared.mjs'
+import { verifyRegularFile } from './verify.mjs'
 
 const CONFIG_FILENAME = 'opencode-vision.json'
 /** `provider/model` — exactly one slash, no surrounding whitespace. */
@@ -87,6 +88,7 @@ export function mergeVisionModel(
       if (existing === null) return
       try {
         copyFileSync(configPath, `${configPath}.bak`)
+        verifyRegularFile(`${configPath}.bak`, readFileSync(configPath))
       } catch {
         // Best-effort: a backup failure must not block the write.
       }

package/scripts/install-mcp.mjs

@@ -238,7 +238,7 @@ export const MCPS = {
     tier: 1,
     name: 'Pantheon Memory',
     description:
-      'Pantheon Memory MCP Server — persistent memory with semantic search, recall, knowledge graph, compression, and verification',
+      'Pantheon Memory MCP Server — persistent SQLite memory with FTS5/BM25 keyword search, exact-key recall, and explicit maintenance; no embedding/vector search',
     platforms: {
       opencode: {
         type: 'local',

package/scripts/manifest-inventory.mjs

@@ -57,6 +57,18 @@ export const MANIFEST_INVENTORY = Object.freeze([
     name: 'pantheon-tui',
     valuePath: ['name'],
   }),
+  Object.freeze({
+    id: 'zenodo-release-metadata',
+    role: 'metadata',
+    file: '.zenodo.json',
+    kind: 'json',
+  }),
+  Object.freeze({
+    id: 'citation-release-metadata',
+    role: 'metadata',
+    file: 'CITATION.cff',
+    kind: 'cff',
+  }),
   Object.freeze({
     id: 'root-lock',
     role: 'lock',
@@ -76,7 +88,7 @@ export const MANIFEST_INVENTORY = Object.freeze([
 ])
 
 export const VERSION_MANIFEST_INVENTORY = Object.freeze(
-  MANIFEST_INVENTORY.filter(({ role }) => role === 'manifest'),
+  MANIFEST_INVENTORY.filter(({ role }) => role !== 'lock'),
 )
 
 export const LOCK_INVENTORY = Object.freeze(
@@ -99,11 +111,18 @@ function readToml(file, text) {
   return parsed
 }
 
+function readCff(file, text) {
+  const match = /^version:\s*([^\s#]+)\s*(?:#.*)?$/m.exec(text)
+  if (!match) throw new Error(`${file} is missing top-level version metadata`)
+  return { version: match[1] }
+}
+
 function readDocument(root, entry) {
   const path = join(root, entry.file)
   if (!existsSync(path)) throw new Error(`manifest inventory file is missing: ${entry.file}`)
   const text = readFileSync(path, 'utf8')
   if (entry.kind === 'toml') return { entry, path, text, data: readToml(entry.file, text) }
+  if (entry.kind === 'cff') return { entry, path, text, data: readCff(entry.file, text) }
   let data
   try {
     data = JSON.parse(text)
@@ -175,6 +194,24 @@ function validateLock(document, manifestsByFile, allowVersionDivergence) {
   if (!allowVersionDivergence && rootPackage.version !== manifestVersionValue) {
     throw new Error(`${entry.file} packages[""] version diverges from ${entry.packageFile}`)
   }
+
+  if (entry.file === 'package-lock.json') {
+    const tuiManifest = manifestsByFile.get('src/plugins/tui/package.json')
+    const tuiWorkspace = data.packages?.['src/plugins/tui']
+    if (!tuiManifest) throw new Error('package-lock.json has no TUI workspace manifest partner')
+    if (!tuiWorkspace || typeof tuiWorkspace !== 'object' || Array.isArray(tuiWorkspace)) {
+      throw new Error('package-lock.json is missing packages["src/plugins/tui"]')
+    }
+    if (tuiWorkspace.name !== 'pantheon-tui') {
+      throw new Error('package-lock.json TUI workspace name must be pantheon-tui')
+    }
+    assertSemver(tuiWorkspace.version, 'package-lock.json TUI workspace version')
+    if (!allowVersionDivergence && tuiWorkspace.version !== manifestVersion(tuiManifest)) {
+      throw new Error(
+        'package-lock.json TUI workspace version diverges from src/plugins/tui/package.json',
+      )
+    }
+  }
 }
 
 /** Read and validate every entry before a caller is allowed to write anything. */
@@ -186,7 +223,7 @@ export function validateInventory(root, { allowVersionDivergence = false } = {})
       .map((document) => [document.entry.file, document]),
   )
   const versions = documents
-    .filter(({ entry }) => entry.role === 'manifest')
+    .filter(({ entry }) => entry.role === 'manifest' || entry.role === 'metadata')
     .map((document) => ({ file: document.entry.file, version: manifestVersion(document) }))
   documents.filter(({ entry }) => entry.role === 'manifest').forEach(manifestName)
   const sourceVersion = versions[0].version
@@ -309,8 +346,17 @@ function replaceTomlProjectVersion(text, version, file) {
 
 function prepareDocumentVersion(document, version) {
   const { entry, text } = document
+  if (entry.role === 'metadata') {
+    const current = manifestVersion(document)
+    return text.split(current).join(version)
+  }
   if (entry.kind === 'toml') return replaceTomlProjectVersion(text, version, entry.file)
-  const paths = entry.role === 'lock' ? [['version'], ['packages', '', 'version']] : [['version']]
+  const paths =
+    entry.role === 'lock'
+      ? entry.file === 'package-lock.json'
+        ? [['version'], ['packages', '', 'version'], ['packages', 'src/plugins/tui', 'version']]
+        : [['version'], ['packages', '', 'version']]
+      : [['version']]
   return replaceJsonStringValues(text, paths, version, entry.file)
 }
 

package/scripts/node-engine-policy.mjs

@@ -0,0 +1,74 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+export const MIN_SUPPORTED_NODE_VERSION = '26.4.0'
+export const REQUIRED_NODE_ENGINE_RANGE = `>=${MIN_SUPPORTED_NODE_VERSION}`
+
+function parseNodeVersion(version) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([^+]+))?(?:\+([\w.-]+))?$/.exec(String(version))
+  if (!match) return null
+  return { parts: match.slice(1, 4).map(Number), prerelease: match[4] !== undefined }
+}
+
+/** Return whether a runtime version meets Pantheon's supported Node floor. */
+export function isSupportedNodeVersion(version) {
+  const parsed = parseNodeVersion(version)
+  const minimum = parseNodeVersion(MIN_SUPPORTED_NODE_VERSION)
+  if (!parsed || !minimum || parsed.prerelease) return false
+  for (let index = 0; index < minimum.parts.length; index += 1) {
+    if (parsed.parts[index] !== minimum.parts[index]) {
+      return parsed.parts[index] > minimum.parts[index]
+    }
+  }
+  return true
+}
+
+function readJson(root, file, errors) {
+  try {
+    const document = JSON.parse(readFileSync(join(root, file), 'utf8'))
+    if (!document || typeof document !== 'object' || Array.isArray(document)) {
+      throw new Error('expected a JSON object')
+    }
+    return document
+  } catch (error) {
+    errors.push(`${file}: ${error.message}`)
+    return null
+  }
+}
+
+function checkEngineRange(value, label, errors) {
+  if (value !== REQUIRED_NODE_ENGINE_RANGE) {
+    errors.push(`${label} must declare engines.node as "${REQUIRED_NODE_ENGINE_RANGE}"`)
+  }
+}
+
+/** Validate Node support claims in package manifests and their npm locks. */
+export function validateNodeEnginePolicy(root) {
+  const errors = []
+  const rootPackage = readJson(root, 'package.json', errors)
+  const tuiPackage = readJson(root, 'src/plugins/tui/package.json', errors)
+  const rootLock = readJson(root, 'package-lock.json', errors)
+  const tuiLock = readJson(root, 'src/plugins/tui/package-lock.json', errors)
+
+  if (rootPackage) checkEngineRange(rootPackage.engines?.node, 'package.json', errors)
+  if (tuiPackage) checkEngineRange(tuiPackage.engines?.node, 'src/plugins/tui/package.json', errors)
+
+  const rootLockPackage = rootLock?.packages?.['']
+  if (!rootLockPackage) errors.push('package-lock.json is missing packages[""]')
+  else checkEngineRange(rootLockPackage.engines?.node, 'package-lock.json packages[""]', errors)
+
+  const workspacePackage = rootLock?.packages?.['src/plugins/tui']
+  if (!workspacePackage) errors.push('package-lock.json is missing the TUI workspace package')
+  else checkEngineRange(workspacePackage.engines?.node, 'package-lock.json TUI workspace', errors)
+
+  const tuiLockPackage = tuiLock?.packages?.['']
+  if (!tuiLockPackage) errors.push('src/plugins/tui/package-lock.json is missing packages[""]')
+  else
+    checkEngineRange(
+      tuiLockPackage.engines?.node,
+      'src/plugins/tui/package-lock.json packages[""]',
+      errors,
+    )
+
+  return errors
+}

package/scripts/package-evidence.mjs

@@ -17,6 +17,7 @@ import {
 import { tmpdir } from 'node:os'
 import { isAbsolute, join } from 'node:path'
 import { validateInventory } from './manifest-inventory.mjs'
+import { validateNodeEnginePolicy } from './node-engine-policy.mjs'
 
 const CI_ARGS = ['ci', '--ignore-scripts', '--omit=dev', '--no-audit', '--no-fund']
 const REQUIRED_PAYLOAD = [
@@ -32,6 +33,8 @@ const REQUIRED_PAYLOAD = [
   'package/src/plugins/tui/dist/server.js',
   'package/bin/pantheon-init.mjs',
   'package/scripts/doctor.mjs',
+  'package/scripts/node-engine-policy.mjs',
+  'package/scripts/validate-node-engine-policy.mjs',
   'package/.pantheon/code-mode/compress-inline.py',
 ]
 
@@ -132,6 +135,7 @@ function validatePayload(packageRoot, inventory) {
   }
   for (const document of inventory.documents) {
     const { entry, path: sourcePath } = document
+    if (entry.role === 'metadata') continue
     const packagedPath = join(packageRoot, entry.file)
     if (entry.role === 'lock' && entry.file === 'package-lock.json' && !existsSync(packagedPath)) {
       // npm-packlist excludes the package root lockfile by policy. It remains
@@ -181,6 +185,8 @@ function sha256(path) {
 
 export function createPackageEvidence(root, { outputDir, targetSha } = {}) {
   const inventory = validateInventory(root)
+  const engineErrors = validateNodeEnginePolicy(root)
+  if (engineErrors.length) fail(engineErrors.join('; '))
   const sha = resolveTargetSha(root, targetSha)
   const output = createOutputDirectory(outputDir)
   let workDir

package/scripts/postinstall.mjs

@@ -5,14 +5,13 @@
  * Runs after `npm install` completes. Validates environment and prints
  * setup instructions. Does NOT install Pantheon platform components.
  */
-const REQUIRED_NODE_MAJOR = 18
-const nodeMajor = parseInt(process.versions.node.split('.')[0], 10)
+import { isSupportedNodeVersion, MIN_SUPPORTED_NODE_VERSION } from './node-engine-policy.mjs'
 
 try {
   // Validate Node.js version
-  if (nodeMajor < REQUIRED_NODE_MAJOR) {
+  if (!isSupportedNodeVersion(process.versions.node)) {
     console.error(
-      `❌ Node.js >= ${REQUIRED_NODE_MAJOR} required (current: ${process.versions.node})`,
+      `❌ Pantheon requires Node.js >= ${MIN_SUPPORTED_NODE_VERSION} (current: ${process.versions.node})`,
     )
     process.exit(1)
   }