pantheon-opencode 1.6.0-beta.11 → 1.6.0-beta.13

package/scripts/versioning.mjs

@@ -111,7 +111,15 @@ function analyzeConventionalCommits(since) {
 function prepareManifests(newVersion) {
   if (!SEMVER_PATTERN.test(newVersion)) throw new Error(`invalid version: ${newVersion}`)
   const inventory = validateInventory(ROOT, { allowVersionDivergence: true })
-  return { inventory, updates: prepareInventoryVersion(inventory, newVersion) }
+  const releaseMetadataFiles = new Set(
+    inventory.documents
+      .filter(({ entry }) => entry.role === 'metadata')
+      .map(({ entry }) => entry.file),
+  )
+  const updates = prepareInventoryVersion(inventory, newVersion).filter(
+    ({ path }) => !releaseMetadataFiles.has(path.slice(ROOT.length + 1)),
+  )
+  return { inventory, updates }
 }
 
 /**

package/skills-lock.json

@@ -1,6 +1,6 @@
 {
   "src/skills/agent-coordination/SKILL.md": "d4bd70c18bc5726ea6784fe0a9c514446ca313e4c3ba4d658a0ff6658001aece",
-  "src/skills/artifact-management/SKILL.md": "91d68c8f2d1b642725adfc6df11e55865a8491aca690dc27d02ea7c778d49d41",
+  "src/skills/artifact-management/SKILL.md": "24dc1ca4660246ef37c3d3a5b246b7f63e3739f0ef741ed0a2e21d9abd3e9165",
   "src/skills/auto-continue/SKILL.md": "3fd4167b2e015510aec428098d27bb15854ba239c4dc7a064177d62e2353af86",
   "src/skills/clonedeps/SKILL.md": "3e0b43cf96da98c83699dc48db3fd58fbfda84b9022bb70d3747875c81c3e124",
   "src/skills/code-review-checklist/SKILL.md": "6445513ab880efdb1005861ae13cb9a215f80b9d260f6278499f60771e07858c",
@@ -9,7 +9,7 @@
   "src/skills/git-workflow-and-versioning/SKILL.md": "685a94041f1b4ce2a430301f517b89102055696267c369a7e8fb191606659276",
   "src/skills/incremental-implementation/SKILL.md": "7065ddb45da3c6b6751de07f290e92e6cb072e949a2e3aaae13ee7762f0a70fc",
   "src/skills/loop-engineering/SKILL.md": "f804e545821b9cca8fe0ec517307ed902446f28c2ca8ff9194c0f987cf7229e3",
-  "src/skills/memory-bank/SKILL.md": "4717cf18b43550c9f02cfab810968b97a5b2584f00a15516ecba643c80cdc110",
+  "src/skills/memory-bank/SKILL.md": "7fd7a65cd48f68793f60afa0d18b87692957888c7dad414213907b5e83d76395",
   "src/skills/reflect/SKILL.md": "4c7608c2a55cb8a50ac90fc0e2446bdf25e7914b1748cb7731c311d13c29dfdd",
   "src/skills/security-hardening/SKILL.md": "6d637e122421f7bc3b751f04854ad343a5a5d35249458bc8939233138fd3f20d",
   "src/skills/session-goal/SKILL.md": "3a708d15a59a6bff2dd32ff7ead6548ecccc7be8d39437fee3133ea6254b6134",
@@ -18,5 +18,5 @@
   "src/skills/tdd-with-agents/SKILL.md": "9d20607ea34fc3e02c7e3ef5186b103d84196bd9a13aaadd55a44f41339125da",
   "src/skills/verification-planning/SKILL.md": "14186446ef51e1ba2c87b337e8d5f86e566d805156ab21fba2a75f8c4a99df3f",
   "src/skills/visual-review-pipeline/SKILL.md": "f6e65ff75a9325c38e0e9dde8e87f09b873e14e490936ef48aa80201bb68fe10",
-  "src/skills/worktrees/SKILL.md": "0033c5f8a50f210f31f0256ba8cc0fd99c65674a2aabedb05d8e69447b5ec218"
+  "src/skills/worktrees/SKILL.md": "9cf2b036e90d9ff7c6deb786ad7bab2cb78d6bf39166a67d5cbeafc29f593c6e"
 }

package/src/agents/mnemosyne.md

@@ -84,7 +84,7 @@ Mnemosyne executes the expanded compression pipeline. When Zeus delegates compre
    - IMPL/REVIEW artifacts to archive
    - Next phase agent info
 
-2. **Scrub**: Automatic — `memory_store` MCP server applies regex scrub before persisting. No manual steps.
+2. **Privacy check**: Never store secrets, credentials, or tokens in durable memory. The current `memory_store` handler stores submitted values and metadata; automatic regex scrubbing/redaction is not guaranteed. Omit sensitive content or redact it before storing.
 
 3. **Write ZZ artifact**: Create `.pantheon/memory-bank/.tmp/ZZ-phase{N}-context.md` with:
    - From/To agent info
@@ -112,7 +112,7 @@ Mnemosyne executes the expanded compression pipeline. When Zeus delegates compre
 
 ### Write Protocol
 - Atomic write: .tmp → fsync → validate → rename
-- Scrubbing: automatic via MCP layer on persistence
+- Secret handling: omit or manually redact secrets before durable storage; do not rely on automatic MCP scrubbing.
 
 ### Safety
 - NEVER compress ADR notes, active PLAN, NEEDS_REVISION/FAILED reviews
@@ -154,6 +154,11 @@ Use this only when the user or Zeus explicitly asks to preserve a reusable resul
 
 **Use only for an explicit request to preserve one reusable result.** Background completion, Apollo discovery, and `subtask_summary` return are not triggers for durable storage.
 
+`pantheon-memory` stores durable SQLite entries with no entry TTL. Its search is
+FTS5/BM25 lexical matching only, with no semantic/vector fallback. Never store
+secrets, credentials, or tokens: the MCP stores submitted values and metadata
+without guaranteed automatic scrubbing.
+
 **Command:** `@mnemosyne Store <concise reusable result>`
 
 **What it does:**

package/src/instructions/memory-protocol.instructions.md

@@ -16,8 +16,8 @@ These rules apply to all agents; each agent file may add domain-specific rules.
 - Use a targeted query (`top_k=2`); do not search the whole prompt by default. Missing or irrelevant results never block current work.
 
 ### Persistence
-- A memory write is optional and conditional on a write tool being exposed and permitted in the active session. Search permission does not imply write permission; in the reported Beta 10 Zeus root, `memory_store` is not exposed/granted.
-- Store at most one concise, reusable top-level result; never persist routine child summaries, phase updates, test logs, or temporary state. Confirm a successful write before claiming persistence.
+- Tool grants vary by agent/runtime. Zeus's installed allowlist has `memory_search` and temporary `context_save`/`context_get` checkpoints, but no durable writes; Mnemosyne's includes `memory_store` and other durable-memory tools. Use only tools exposed and permitted in the active session.
+- Store at most one concise, reusable top-level result; never persist routine child summaries, phase updates, test logs, or temporary state. Confirm a successful write before claiming persistence. Never store secrets, credentials, or tokens. `memory_store` stores submitted values and metadata without guaranteed redaction; omit sensitive content or redact it before storage.
 - If no write tool is available or the write did not succeed, say that the information was not persisted. Do not imply automatic memory storage or recovery. Add ADRs to the memory bank only when explicitly requested.
 
 ### Relevance and permanent records

package/src/instructions/zeus-memory-operations.instructions.md

@@ -19,9 +19,10 @@ Use a recent, directly matching decision only after checking current context;
 otherwise treat it as background, never as authority to skip a needed review.
 
 Persist only reusable, material decisions, and only if a memory-write tool is
-explicitly exposed and permitted in the active root tool list. The reported Beta
-10 Zeus root has `memory_search` but no `memory_store` grant/tool; search access
-does not imply write access. If a write tool is available, use
+explicitly exposed and permitted. Inspect the active tool grants/catalog to
+determine availability; temporary `context_save`/`context_get` checkpoints are
+not durable memory writes. Search access does not imply write access. If a write
+tool is available and permitted, use
 `key="council:<yyyy-mm-dd>:<slug>"`, JSON-stringify both `value` and `metadata`,
 and confirm success before claiming persistence. Otherwise tell the user the
 decision was not persisted. Keep any saved record concise: question, recommendation,

package/src/pantheon/v2-unsupported.mjs

@@ -21,9 +21,8 @@
  * So a `.mjs` import is the only form all three consumers can share, and it
  * matches the existing `src/pantheon/presets.mjs` + `.d.mts` precedent.
  *
- * NOT the reason: type-stripping. `package.json#engines` admits
- * `^22.22.2 || ^24.15.0 || >=26.0.0`, every admitted version already defaults to
- * unflagged type-stripping (it landed in 22.18.0), so that argument would not
+ * NOT the reason: type-stripping. `package.json#engines` admits Node >=26.4.0,
+ * which defaults to unflagged type-stripping (it landed in 22.18.0), so that argument would not
  * have held on any admitted version. The live hazard is that `engines` is not
  * ENFORCED: a Node 20 user can run `doctor` and would get no type-stripping,
  * which is an argument for a runtime version check, not for this file's shape.

package/src/plugins/tui/dist/tui-v2.js

@@ -477,7 +477,7 @@ function Sidebar(props) {
 		setProp(_el$, "width", "100%");
 		setProp(_el$, "padding", 1);
 		setProp(_el$2, "attributes", 1);
-		insert(_el$2, `Pantheon v1.6.0-beta.11`);
+		insert(_el$2, `Pantheon v1.6.0-beta.13`);
 		insertNode(_el$3, createTextNode(`OpenCode V2 · plugin TUI ativo`));
 		insert(_el$, createComponent(Show, {
 			get when() {
@@ -623,7 +623,7 @@ function HomeStatus(props) {
 	const muted = () => props.context.theme?.text?.muted ?? props.context.theme?.text?.base;
 	return (() => {
 		var _el$20 = createElement("text");
-		insert(_el$20, () => `Pantheon v1.6.0-beta.11${preset().name ? ` ⚡ ${preset().name}` : ""}`);
+		insert(_el$20, () => `Pantheon v1.6.0-beta.13${preset().name ? ` ⚡ ${preset().name}` : ""}`);
 		effect((_$p) => setProp(_el$20, "fg", muted(), _$p));
 		return _el$20;
 	})();

package/src/plugins/tui/dist/tui.js

@@ -167,7 +167,7 @@ async function detectVersion(api) {
 			if (ver) return ver;
 		}
 	} catch {}
-	return "1.6.0-beta.11";
+	return "1.6.0-beta.13";
 }
 /**
 * usage-bar — AI subscription usage gauge for the opencode TUI.

package/src/plugins/tui/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pantheon-tui",
-  "version": "1.6.0-beta.11",
+  "version": "1.6.0-beta.13",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pantheon-tui",
-      "version": "1.6.0-beta.11",
+      "version": "1.6.0-beta.13",
       "license": "MIT",
       "dependencies": {
         "@opencode-ai/plugin": "1.18.33",
@@ -20,7 +20,7 @@
         "tsdown": "0.23.0"
       },
       "engines": {
-        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+        "node": ">=26.4.0"
       },
       "peerDependencies": {
         "@opencode-ai/plugin": "1.18.33",

package/src/plugins/tui/package.json

@@ -1,11 +1,11 @@
 {
   "name": "pantheon-tui",
   "type": "module",
-  "version": "1.6.0-beta.11",
+  "version": "1.6.0-beta.13",
   "description": "Pantheon TUI plugin — V1 rich sidebar and usage gauges; native V2 status, session and delegation sidebar",
   "license": "MIT",
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": ">=26.4.0"
   },
   "exports": {
     "./tui": "./dist/tui.js",

package/src/skills/artifact-management/SKILL.md

@@ -23,12 +23,16 @@ All ephemeral artifacts live in `.pantheon/memory-bank/.tmp/` — gitignored and
 │   ├── IMPL-phase1-hermes.md
 │   ├── IMPL-phase1-aphrodite.md
 │   └── REVIEW-<feature>.md
-├── _notes/                ← COMMITTED — permanent ADRs
+├── _notes/                ← permanent ADRs; Git tracking follows repository policy
 │   └── ADR-<topic>.md
 ├── 01-active-context.md
 └── 02-progress-log.md
 ```
 
+Memory Bank files are not automatically versioned or shared across clones.
+Check the repository's ignore/commit policy before relying on `_tasks/` records
+or other files being tracked; `_tasks/` may be Git-ignored.
+
 ---
 
 ## Artifact Types

package/src/skills/memory-bank/SKILL.md

@@ -16,7 +16,7 @@ Complete guide to Pantheon memory bank — structure, rules, optimization, and m
 
 | System | Where | Owner | Lifetime | Purpose |
 |--------|-------|-------|----------|---------|
-| **Memory Bank** | `.pantheon/memory-bank/` | Team | Permanent, versioned | Project context: architecture, patterns, progress |
+| **Memory Bank** | `.pantheon/memory-bank/` | Team | Files persist in the working tree; Git tracking depends on repository ignore/commit policy | Project context: architecture, patterns, progress |
 | **VS Code `/memories/`** | `.vscode/` or workspace | Agent | Session/repo scoped | Atomic facts, conversation plans |
 
 ---
@@ -39,6 +39,10 @@ Complete guide to Pantheon memory bank — structure, rules, optimization, and m
     └── NOTE0001-topic.md   ← Architectural decisions, findings
 ```
 
+Memory Bank files are not automatically synchronized across clones. In
+particular, `_tasks/` records may be Git-ignored; only files tracked and
+committed under the repository's policy are shared through Git.
+
 ### File Update Frequency
 
 | File | Fill when | Update frequency |

package/src/skills/worktrees/SKILL.md

@@ -16,28 +16,47 @@ Use git worktrees to create isolated working directories for parallel or experim
 
 ## Setup
 
+Use this persistent external default for new worktrees:
+
+```text
+<project-parent>/.pantheon-worktrees/<exact-repository-directory-basename>/<task>
+```
+
+Resolve the project directory to an absolute path, then use its exact final
+directory basename as the repository component; spaces are valid and must not
+be normalized into a potentially colliding slug. For example, a project at
+`/home/user/My Project` uses
+`/home/user/.pantheon-worktrees/My Project/feature-name`. Replace
+`<task>` with a short descriptive task name. This keeps worktrees outside
+the project and reuses the same location across agent sessions.
+
 ```bash
-# Create a worktree
-git worktree add ../project-feature-x feature-x
+# Create a worktree at the recommended external location
+git worktree add "/home/user/.pantheon-worktrees/My Project/feature-name" task-branch
+
+# List worktrees and their absolute paths
+git worktree list --porcelain
 
-# List worktrees
-git worktree list
+# Only after the user explicitly authorizes removal, remove that exact worktree
+git worktree remove "/home/user/.pantheon-worktrees/My Project/feature-name"
 
-# Remove a worktree
-git worktree remove ../project-feature-x
+# Only after the user explicitly authorizes branch deletion
+git branch -d task-branch
 ```
 
 ## Workflow
 
-1. Create worktree: `git worktree add ../<name> <branch>`
+1. Resolve the project directory to an absolute path and create the worktree at `<project-parent>/.pantheon-worktrees/<exact-repository-directory-basename>/<task>`.
 2. Work in the worktree directory
 3. Commit and push from within the worktree
-4. Clean up: `git worktree remove ../<name>`
-5. Delete branch if no longer needed
+4. Leave the worktree and branch in place when the task is done unless the user explicitly authorizes removal or deletion.
+5. If authorized, remove only the exact worktree path above; delete its branch only with separate explicit user authorization.
 
 ## Rules
 - Never create worktrees inside the main project directory
-- Name worktrees descriptively: `../project-auth-refactor`
-- Remove worktrees when done (they consume disk space)
+- Use the persistent external default `<project-parent>/.pantheon-worktrees/<exact-repository-directory-basename>/<task>`
+- Use the exact repository directory basename (spaces included); do not normalize it into a lossy slug
+- Name worktrees descriptively, for example `feature-name` or `auth-refactor`
+- Never remove a worktree or delete a branch unless the user explicitly authorizes that action
 - Worktrees share the same git history — pushing from a worktree is the same as pushing from main
 - Escalate to @iris for branch management if unsure