pantheon-opencode 1.6.0-beta.3 → 1.6.0-beta.4

package/CHANGELOG.md

@@ -18,6 +18,28 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## ✅ Closed Issues
 
+## [v1.6.0-beta.4] - 2026-10-03
+
+<!-- Add new changes here. Running `node scripts/versioning.mjs apply` will
+     move this section to a versioned entry and reset the template below. -->
+
+## 🆕 What's New
+
+- **Canário host-backed que dirige `hashline_edit` end-to-end** (`tests/canary/plugin-v2-tool-canary.test.mjs`, 12 casos): carrega `src/plugin-v2.ts` pelo loader real do host `opencode 2.0.22` e registra `Object.keys(ctx)` de dentro do host — medidos, `tool`/`event`/`permission`/`session` existem e `catalog` não. É o primeiro gate que dirige uma ferramenta do Pantheon por um host real. O canário existente só dirige o `read` embutido, e foi por isso que `draft.add()` sem `output` sobreviveu 26 dias com todos os testes verdes.
+- **Os quatro domínios que o SDK `@opencode-ai/plugin` não tipa** (`tool`, `event`, `permission`, `session`) passaram a uma declaração estrutural local (`HostPluginContext`) e **um** cast documentado (`hostDomains()`), no lugar de seis `as unknown as Record<string, unknown>` que não verificavam tipo nenhum. Todo membro continua opcional e todo chamador reconferir antes de usar. A linha estável do SDK é `1.18.x` e não carrega o contrato do host — `1.18.34` (`latest`) é idêntica a `1.18.33`, então seguir o `dev` diário resolveria pior, não melhor.
+
+## 🐞 Fixed
+
+- `pantheon_cost` respondia `CORRUPT_DATA` em **toda** chamada contra o host 2.0.22: exigia a tabela `message`, que não existe nesse banco. Os tokens de assistant **estão** legíveis em `session_message`. **Não é renomeação:** `session_message` tem coluna `data`, mas não tem a chave `role` dentro dela — `json_type(data,'$.role')` é nulo em **0 de 40 307** linhas válidas. O V1 marca turnos de assistant com `data.role`; o V2 marca pela **coluna** `type`. Trocar apenas o nome da tabela casaria com nada e devolveria `status: OK` em silêncio. A detecção passa a ser por **presença de tabela**, porque as duas famílias coexistem em bancos migrados.
+- `PANTHEON_OPENCODE_VERSION` nunca selecionou o schema: só mudava o **nome do arquivo**, e `opencode-v2.db` é o isolamento do sandbox via `OPENCODE_DB`, não um banco de host 2.x. A distinção v1/v2 é o **schema detectado**; a variável agora apenas restringe um conjunto já detectado e falha rápido quando pede uma família ausente.
+- `scripts/cost.mjs` duplicava o mesmo bug literal, com o mesmo assert — o fallback continuava morto. `probe-pantheon-cost.mjs` acompanha.
+- O report agora **declara a cobertura temporal** que ele mediu (janela varrida, linha mais antiga), em vez de apresentar totais como se cobrissem meses.
+
+## ⚠️ Known Issues
+
+- O canário **host-backed pula no CI**: o runner não tem binário `opencode`. O skip é **visível** no log (`::notice`), e os dois casos sem host rodam incondicionalmente, com `PANTHEON_TOOL_CANARY_BIN` apontado para um caminho inexistente. Rodar de verdade exige um modo no script de sandbox — **não feito**.
+- A cobertura de custo do banco v2 é de **~8,3 dias** nesta máquina (primeiro registro em 2026-09-25). O histórico v1 (~96 dias) fica num diretório irmão com nome de epoch, que **não** é contrato e por isso não é descoberto automaticamente. Quem quiser aponta `PANTHEON_COST_DB`.
+- `metadata.phase` nunca existiu em v1 nem em v2 — medido: 0 linhas de `session_message` têm `$.metadata.phase` nem `$.phase`. A coluna Phase sempre foi `unknown`. Não é regressão, é feature que nunca funcionou.
 ## [v1.6.0-beta.3] - 2026-10-03
 
 &lt;!-- Add new changes here. Running `node scripts/versioning.mjs apply` will

package/README.md

@@ -50,6 +50,8 @@ opencode
 The installer guides you through the available setup. For optional MCP servers,
 project-local installation, or non-interactive setup, see the
 [installation guide](docs/INSTALLATION.md).
+The bundled Python MCP servers use the pinned MCP SDK 2.2.0 and standalone
+FastMCP 4.0.10 runtime; see the [MCP guide](docs/MCP.md).
 
 ## A simple example
 
@@ -242,13 +244,23 @@ Pantheon references from both config shapes before writing only the selected
 Pantheon registration. Third-party entries are not converted or claimed by
 this rule.
 
-The V1-only `pantheon_cost` report can select its database with
-`PANTHEON_OPENCODE_VERSION=v1` or `v2` (`opencode.db` or `opencode-v2.db`).
-`PANTHEON_COST_DB=/absolute/path/to/opencode.db` takes precedence over the
-version selector, and an explicit `dbPath` supplied by the tool caller takes
-precedence over both. The resolver never probes the other version's database
-and reports an actionable error when the selected DB is missing or has an
-incompatible schema.
+The `pantheon_cost` report resolves its database by PATH, in this order: an
+explicit `dbPath` supplied by the tool caller, then
+`PANTHEON_COST_DB=/absolute/path/to/opencode.db`, then `OPENCODE_DB`, then the
+XDG default `opencode.db`. There is no per-version filename in that chain:
+`opencode-v2.db` is not a host 2.x database — it is the name a sandbox gives
+its own state database through `OPENCODE_DB`.
+
+The v1/v2 distinction is the DETECTED SCHEMA, not the file name. The report
+looks for the `message` and `session_message` tables and reads whichever the
+open database actually holds, because a migrated database carries both
+families at once. `PANTHEON_OPENCODE_VERSION=v1|v2` selects no file: it only
+narrows an already-detected set to one table family, and fails fast when the
+value is neither `v1` nor `v2` or when the requested family is not there. Left
+unset, every detected family is read. A database carrying neither table comes
+back as an actionable error (`CORRUPT_DATA`), and a ledger that exists but
+yields no readable tokens as `UNSUPPORTED` — never as a successful empty
+report.
 
 The installer still writes the compatibility settings required by the selected
 OpenCode host, such as `experimental.subagent_depth`; this does not convert a

package/README.pt-BR.md

@@ -179,13 +179,23 @@ instalador remove referências Pantheon das duas formas de config antes de
 gravar apenas o registro Pantheon selecionado. Entradas de terceiros não são
 convertidas nem reivindicadas por essa regra.
 
-O relatório `pantheon_cost`, disponível nos plugins V1 e V2, pode selecionar o banco com
-`PANTHEON_OPENCODE_VERSION=v1` ou `v2` (`opencode.db` ou `opencode-v2.db`).
-`PANTHEON_COST_DB=/caminho/absoluto/para/opencode.db` tem precedência sobre o
-seletor de versão, e um `dbPath` explícito fornecido pelo chamador da
-ferramenta tem precedência sobre ambos. O resolver nunca consulta o banco da
-outra versão e reporta um erro acionável quando o banco selecionado está
-ausente ou com schema incompatível.
+O relatório `pantheon_cost`, disponível nos plugins V1 e V2, resolve o banco por
+CAMINHO, nesta ordem: um `dbPath` explícito fornecido pelo chamador da
+ferramenta, depois `PANTHEON_COST_DB=/caminho/absoluto/para/opencode.db`,
+depois `OPENCODE_DB`, e por fim o padrão do XDG `opencode.db`. Não há nome de
+arquivo por versão nessa cadeia: `opencode-v2.db` não é um banco de um host 2.x
+— é o nome que um sandbox dá ao próprio banco de estado via `OPENCODE_DB`.
+
+A distinção v1/v2 é o SCHEMA DETECTADO, não o nome do arquivo. O relatório
+procura as tabelas `message` e `session_message` e lê aquele que o banco aberto
+realmente tiver, porque um banco migrado carrega as duas famílias ao mesmo
+tempo. `PANTHEON_OPENCODE_VERSION=v1|v2` não seleciona arquivo nenhum: apenas
+estreita um conjunto já detectado para uma família de tabelas, e falha rápido
+quando o valor não é `v1` nem `v2` ou quando a família pedida não existe lá.
+Sem a variável, todas as famílias detectadas são lidas. Um banco sem nenhuma
+das duas tabelas volta como erro acionável (`CORRUPT_DATA`), e um ledger que
+existe mas não produz tokens legíveis como `UNSUPPORTED` — nunca como um
+relatório vazio com sucesso.
 
 O instalador continua gravando as configurações de compatibilidade exigidas
 pelo host OpenCode selecionado, como `experimental.subagent_depth`; isso não

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pantheon-opencode",
-  "version": "1.6.0-beta.3",
+  "version": "1.6.0-beta.4",
   "description": "Multi-agent orchestration for OpenCode — 14 specialized agents, TDD, Themis review gates.",
   "type": "module",
   "workspaces": [
@@ -46,6 +46,7 @@
     "coverage:plugin-v2": "node scripts/check-plugin-v2-coverage.mjs",
     "test:ts": "for f in tests/pantheon/*.test.ts; do if [ \"$f\" = tests/pantheon/plugin-v2-contract.test.ts ]; then NODE_OPTIONS=--conditions=import tsx \"$f\"; else tsx \"$f\"; fi || exit 1; done",
     "test:hooks": "node --test tests/pantheon/plugin-v2-hook-canary.test.mjs",
+    "test:tool-canary": "node --test tests/canary/plugin-v2-tool-canary.test.mjs",
     "test:all": "npm run test:ci && npm run test:node && npm run test:ts",
     "test": "npm run test:all",
     "test:ci": "python3 -m pytest -q --tb=short 2>&1"
@@ -97,21 +98,22 @@
     "!**/*.pyc"
   ],
   "dependencies": {
-    "@opencode-ai/plugin": "1.18.30",
-    "js-yaml": "^4.3.2",
-    "zod": "4.1.8"
+    "@opencode-ai/plugin": "1.18.33",
+    "js-yaml": "^5.4.2",
+    "zod": "4.1.8",
+    "@opencode-ai/sdk": "1.18.33"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.13",
-    "@commitlint/cli": "21.2.2",
-    "@commitlint/config-conventional": "21.2.2",
+    "@biomejs/biome": "2.5.14",
+    "@commitlint/cli": "21.2.3",
+    "@commitlint/config-conventional": "21.2.3",
     "ajv": "8.20.0",
     "husky": "^9.1.7",
-    "tsx": "4.23.13",
-    "typescript": "6.0.3"
+    "tsx": "4.23.15",
+    "typescript": "7.0.2"
   },
   "overrides": {
-    "rolldown": "1.2.0"
+    "rolldown": "1.2.7"
   },
   "repository": {
     "type": "git",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pantheon",
   "publisher": "ils15",
-  "version": "1.6.0-beta.3",
+  "version": "1.6.0-beta.4",
   "displayName": "Pantheon",
   "description": "Conductor-Delegate orchestration platform with 14 specialized agents, 21 skills, and OpenCode support.",
   "agents": "./src/agents",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.backends._legacy:_Backend"
 
 [project]
 name = "pantheon"
-version = "1.6.0-beta.3"
+version = "1.6.0-beta.4"
 description = "Multi-agent orchestration framework"
 requires-python = ">=3.11"
 dependencies = []

package/scripts/code_mode_server.py

@@ -36,7 +36,7 @@ from typing import Any
 
 import yaml
 from _pantheon_paths import pantheon_home, pantheon_project
-from mcp.server.fastmcp import FastMCP
+from fastmcp import FastMCP
 
 # ── Constants ─────────────────────────────────────────────────────────────────
 ALLOWED_EXTENSIONS: frozenset[str] = frozenset({".sh", ".py"})

package/scripts/cost.mjs

@@ -3,19 +3,42 @@
  * cost.mjs — read-only token aggregation from opencode.db.
  *
  * CLI fallback for the `pantheon_cost` tool when node:sqlite is unavailable
- * in the plugin process. Uses node:sqlite itself and prints a single JSON
- * object to stdout:
- *   { ok: true, days, rows: [{agent, phase, tokensInput, tokensOutput, tokensTotal}] }
+ * in the plugin process. Prints a single JSON object to stdout:
+ *   { ok: true, days, rows: [{agent, phase, tokensInput, tokensOutput, tokensTotal}], coverage }
  *   { ok: false, error: "<message>" }          (exit code 1)
  *
- * NEVER writes to the database — opened read-only. Malformed rows are
- * skipped; assistant messages carry the authoritative token usage.
+ * ## This file is a MIRROR of src/pantheon/cost-command.ts
+ *
+ * It cannot import that module — it exists precisely to run on a plain Node
+ * where the plugin runtime cannot — so the two implementations duplicate the
+ * same contract on purpose:
+ *   - ledger families are detected by TABLE PRESENCE, never by filename and
+ *     never by a pinned host generation;
+ *   - PANTHEON_OPENCODE_VERSION only NARROWS an already-detected set;
+ *   - V1 marks assistant turns with `data.role`, V2 with the `type` COLUMN
+ *     (V2 payloads carry no `role` key at all);
+ *   - the coverage counters mean the same thing in both, because the caller
+ *     feeds them to the same diagnosis.
+ *
+ * Every one of those was a real divergence once: this script kept the V1
+ * predicate and dropped 100% of a V2 ledger, while the caller reported a
+ * successful, empty report. A change to one side that is not made on the other
+ * is a regression, not a refactor.
+ *
+ * NEVER writes to the database — opened read-only. Malformed rows are skipped;
+ * assistant messages carry the authoritative token usage.
  *
  * Usage: node scripts/cost.mjs --db-path <dbPath> --days <days>
  */
 import { existsSync } from 'node:fs'
 import { DatabaseSync } from 'node:sqlite'
 
+/** Ledger families a host database can carry; a migrated one carries both. */
+const COST_SOURCES = ['message', 'session_message']
+
+/** Which family each host generation stores its ledger in. */
+const VERSION_SOURCES = { v1: 'message', v2: 'session_message' }
+
 /**
  * Fail via exitCode + natural process exit (NEVER process.exit right after
  * stdout.write — the pipe is async and the write can be truncated).
@@ -26,22 +49,201 @@ function fail(message) {
   process.exitCode = 1
 }
 
-function assertCompatibleSchema(db) {
-  const table = db
-    .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'message'")
-    .get()
-  if (!table)
-    throw new Error('incompatible opencode.db schema: required "message" table is missing')
-  const columns = db.prepare('PRAGMA table_info(message)').all()
-  const names = new Set(columns.map((column) => column.name))
-  const missing = ['data', 'time_created'].filter((name) => !names.has(name))
+/** Read and validate the optional host-generation selector. */
+function requestedVersion() {
+  const configured = process.env.PANTHEON_OPENCODE_VERSION
+  if (configured === undefined || configured === '') return undefined
+  if (configured !== 'v1' && configured !== 'v2') {
+    throw new Error(`invalid PANTHEON_OPENCODE_VERSION "${configured}"; expected "v1" or "v2"`)
+  }
+  return configured
+}
+
+/**
+ * Detect the ledger families by TABLE PRESENCE, then narrow if asked.
+ *
+ * Presence is the only reliable discriminator: every real installation writes
+ * `opencode.db`, and a migrated database carries BOTH families at once.
+ */
+function resolveSources(db) {
+  const present = new Set(
+    db
+      .prepare(
+        "SELECT name FROM sqlite_master WHERE type = 'table' AND name IN ('message', 'session_message')",
+      )
+      .all()
+      .map((row) => String(row.name)),
+  )
+  const detected = COST_SOURCES.filter((source) => present.has(source))
+  if (detected.length === 0) {
+    throw new Error(
+      'incompatible opencode.db schema: neither the "message" nor the "session_message" table exists, so there is no token ledger to read',
+    )
+  }
+  const requested = requestedVersion()
+  if (requested === undefined) return detected
+  const narrowed = detected.filter((source) => source === VERSION_SOURCES[requested])
+  if (narrowed.length === 0) {
+    throw new Error(
+      `incompatible opencode.db schema: PANTHEON_OPENCODE_VERSION=${requested} selected no table family, but this database contains ${detected.join(' and ')}`,
+    )
+  }
+  return narrowed
+}
+
+/** The columns this reader needs from the family it is about to query. */
+function assertColumns(db, source) {
+  const names = new Set(
+    db
+      .prepare(`PRAGMA table_info(${source})`)
+      .all()
+      .map((column) => String(column.name)),
+  )
+  const required =
+    source === 'session_message' ? ['data', 'time_created', 'type'] : ['data', 'time_created']
+  const missing = required.filter((name) => !names.has(name))
   if (missing.length > 0) {
     throw new Error(
-      `incompatible opencode.db schema: message table is missing ${missing.join(', ')}; select the matching V1/V2 database`,
+      `incompatible opencode.db schema: ${source} table is missing ${missing.join(', ')}; select a database whose token layout this build understands`,
     )
   }
 }
 
+/**
+ * Parse one payload. Returns undefined for anything unparseable, which is how
+ * both readers treat it: the V1 counter requires json_valid(data) and the V2
+ * aggregate does too, so a malformed row contributes to nothing.
+ *
+ * Deliberately NOT unwrapping a nested `data` string: the in-process reader
+ * extracts `$.role`/`$.agent` from the TOP level, so a wrapped payload yields
+ * NULL there and is dropped. Unwrapping here would resurrect rows the primary
+ * path cannot see, and the two readers would disagree on the same file.
+ */
+function readPayload(data) {
+  try {
+    const parsed = JSON.parse(String(data))
+    return typeof parsed === 'object' && parsed !== null ? parsed : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/** CAST(json_extract(...) AS INTEGER) semantics: absent or non-numeric → 0. */
+function toToken(value) {
+  const parsed = Number(value)
+  return Number.isFinite(parsed) ? parsed : 0
+}
+
+/**
+ * Map key for one aggregated row.
+ *
+ * NUL-separated: agent names cannot contain it, so an agent whose name ends
+ * in the phase cannot collide with a phase-only row.
+ */
+function rowKey(agent, phase) {
+  return `${agent}\u0000${phase}`
+}
+
+/** Read one family.
+ *
+ * `assistantRows` follows the per-generation discriminator exactly, including
+ * the asymmetry that matters: V2 counts an assistant row by its COLUMN whether
+ * or not the payload parses, because that counter SQL has no json_valid gate.
+ */
+function readSource(db, source, since) {
+  const windowRow = db
+    .prepare(
+      `SELECT COUNT(*) AS scanned, MIN(time_created) AS windowStart FROM ${source} WHERE time_created >= ?`,
+    )
+    .get(since)
+  const databaseRow = db.prepare(`SELECT MIN(time_created) AS databaseStart FROM ${source}`).get()
+  const select = source === 'session_message' ? 'SELECT type, data' : 'SELECT data'
+  const rows = db.prepare(`${select} FROM ${source} WHERE time_created >= ?`).all(since)
+
+  const groups = new Map()
+  let assistantRows = 0
+  for (const row of rows) {
+    const info = readPayload(row.data)
+    if (source === 'session_message') {
+      if (row.type !== 'assistant') continue
+      assistantRows += 1
+      if (info === undefined) continue
+    } else {
+      if (info === undefined || info.role !== 'assistant') continue
+      assistantRows += 1
+    }
+    const rawAgent = info.agent
+    const agent = rawAgent == null ? '' : typeof rawAgent === 'string' ? rawAgent : String(rawAgent)
+    if (agent === '') continue
+    // V2 has no phase anywhere: its SQL emits the literal, so the mirror does
+    // too rather than inventing a column the reader never had.
+    const metadata = info.metadata
+    const phase =
+      source === 'session_message'
+        ? 'unknown'
+        : (typeof info.phase === 'string' && info.phase) ||
+          (typeof metadata?.phase === 'string' && metadata.phase) ||
+          'unknown'
+    const tokensInput = toToken(info.tokens?.input)
+    const tokensOutput = toToken(info.tokens?.output)
+    const key = rowKey(agent, phase)
+    const acc = groups.get(key) ?? {
+      agent,
+      phase,
+      tokensInput: 0,
+      tokensOutput: 0,
+      tokensTotal: 0,
+    }
+    acc.tokensInput += tokensInput
+    acc.tokensOutput += tokensOutput
+    acc.tokensTotal += tokensInput + tokensOutput
+    groups.set(key, acc)
+  }
+
+  return {
+    groups,
+    scanned: Number(windowRow?.scanned ?? 0) || 0,
+    windowStart: numberOrUndefined(windowRow?.windowStart),
+    databaseStart: numberOrUndefined(databaseRow?.databaseStart),
+    assistantRows,
+  }
+}
+
+function numberOrUndefined(value) {
+  if (value === null || value === undefined) return undefined
+  const parsed = Number(value)
+  return Number.isFinite(parsed) ? parsed : undefined
+}
+
+/**
+ * The same verdict the in-process reader reaches, with the same phrase: the
+ * caller maps "no readable token source" to UNSUPPORTED, so emitting anything
+ * softer here would resurrect the silent-empty-report failure this replaced.
+ *
+ * `scanned === 0` is NOT unreadable — an empty window is a real, reportable
+ * answer, and only a ledger that was found and could not be read is a fault.
+ */
+function diagnoseUnreadableLedger(coverage, rows, days) {
+  if (coverage.scanned === 0) return undefined
+  const tables = coverage.sources.join(' and ')
+  if (coverage.assistantRows === 0) {
+    return (
+      `no readable token source: ${coverage.scanned} row(s) were scanned in the last ${days} day(s) ` +
+      `but none matched the assistant discriminator of ${tables}, so no usage can be attributed. ` +
+      'This is an unrecognised ledger layout, not an empty one; point PANTHEON_COST_DB at a ' +
+      'database whose token layout this build understands.'
+    )
+  }
+  if (!rows.some((row) => row.tokensInput !== 0 || row.tokensOutput !== 0)) {
+    return (
+      `no readable token source: ${coverage.assistantRows} assistant row(s) were found in ${tables} ` +
+      'but none carried both an attributable agent and a token payload, so no usage can be ' +
+      'attributed. This is an unrecognised ledger layout, not an empty one.'
+    )
+  }
+  return undefined
+}
+
 function main() {
   const argv = process.argv.slice(2)
   const valueFor = (name) => {
@@ -56,44 +258,45 @@ function main() {
 
   try {
     const db = new DatabaseSync(dbPath, { readOnly: true })
-    assertCompatibleSchema(db)
+    const sources = resolveSources(db)
+    for (const source of sources) assertColumns(db, source)
     const since = Date.now() - days * 86_400_000
-    const rows = db.prepare('SELECT data FROM message WHERE time_created >= ?').all(since)
-    db.close()
 
     const byAgent = new Map()
-    for (const row of rows) {
-      try {
-        const outer = JSON.parse(String(row.data))
-        const info = typeof outer.data === 'string' ? JSON.parse(outer.data) : outer
-        if (info.role !== 'assistant') continue
-        const agent = typeof info.agent === 'string' && info.agent !== '' ? info.agent : null
-        if (!agent) continue
-        const metadata = info.metadata
-        const phase =
-          (typeof info.phase === 'string' && info.phase) ||
-          (typeof metadata?.phase === 'string' && metadata.phase) ||
-          'unknown'
-        const tokensInput = Number(info.tokens?.input) || 0
-        const tokensOutput = Number(info.tokens?.output) || 0
-        const key = `${agent}\u0000${phase}`
+    const coverage = { sources: [], scanned: 0, assistantRows: 0 }
+    const note = (key, value) => {
+      if (value === undefined) return
+      const current = coverage[key]
+      coverage[key] = current === undefined ? value : Math.min(current, value)
+    }
+    for (const source of sources) {
+      const read = readSource(db, source, since)
+      for (const row of read.groups.values()) {
+        const key = rowKey(row.agent, row.phase)
         const acc = byAgent.get(key) ?? {
-          agent,
-          phase,
+          agent: row.agent,
+          phase: row.phase,
           tokensInput: 0,
           tokensOutput: 0,
           tokensTotal: 0,
         }
-        acc.tokensInput += tokensInput
-        acc.tokensOutput += tokensOutput
-        acc.tokensTotal += tokensInput + tokensOutput
+        acc.tokensInput += row.tokensInput
+        acc.tokensOutput += row.tokensOutput
+        acc.tokensTotal += row.tokensInput + row.tokensOutput
         byAgent.set(key, acc)
-      } catch {
-        // Skip malformed rows — a partial ledger never breaks the report.
       }
+      coverage.sources.push(source)
+      coverage.scanned += read.scanned
+      coverage.assistantRows += read.assistantRows
+      note('windowStart', read.windowStart)
+      note('databaseStart', read.databaseStart)
     }
+    db.close()
+
     const result = [...byAgent.values()].sort((a, b) => b.tokensTotal - a.tokensTotal)
-    process.stdout.write(JSON.stringify({ ok: true, days, rows: result }))
+    const unreadable = diagnoseUnreadableLedger(coverage, result, days)
+    if (unreadable !== undefined) return fail(unreadable)
+    process.stdout.write(JSON.stringify({ ok: true, days, rows: result, coverage }))
   } catch (err) {
     fail(err instanceof Error ? err.message : String(err))
   }

package/scripts/install/agents-md.mjs

@@ -21,7 +21,7 @@
 import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import yaml from 'js-yaml'
+import { load } from 'js-yaml'
 
 // ---------------------------------------------------------------------------
 // Paths
@@ -47,7 +47,7 @@ function parseAgentFrontmatter(content) {
   if (!match) return null
 
   try {
-    const fm = yaml.load(match[1])
+    const fm = load(match[1])
     if (!fm || typeof fm !== 'object' || !fm.name) return null
     return {
       name: String(fm.name),

package/scripts/install/health-check.mjs

@@ -173,13 +173,20 @@ export function healthCheck(target, { dryRun = false, pythonTarget = target } =
   if (python) {
     const mcpResult = spawnSync(
       python,
-      ['-c', 'from mcp.server.fastmcp import FastMCP; print(FastMCP.__module__)'],
+      [
+        '-c',
+        'import importlib.metadata as metadata; from fastmcp import FastMCP; ' +
+          'print(f\'mcp={metadata.version("mcp")} fastmcp={metadata.version("fastmcp")} {FastMCP.__module__}\')',
+      ],
       { stdio: 'pipe' },
     )
     if (mcpResult.status === 0) {
       results.passed.push({ check: 'mcp-sdk', detail: mcpResult.stdout.toString().trim() })
     } else {
-      results.failed.push({ check: 'mcp-sdk', detail: 'NOT INSTALLED — all MCP servers will fail' })
+      results.failed.push({
+        check: 'mcp-sdk',
+        detail: 'MCP SDK or standalone FastMCP is unavailable — all MCP servers will fail',
+      })
     }
   }
   // Check 4: the memory server's only search backend is the stdlib's own

package/scripts/install/shared.mjs

@@ -24,7 +24,7 @@ if (parseInt(process.versions.node.split('.')[0], 10) < REQUIRED_NODE_MAJOR) {
   process.exit(1)
 }
 
-import yaml from 'js-yaml'
+import { dump, load } from 'js-yaml'
 
 export const __dirname = dirname(fileURLToPath(import.meta.url))
 export const ROOT = join(__dirname, '..', '..')
@@ -326,10 +326,10 @@ export function collectSkillNames() {
  * Returns { fm: object, body: string } or null if no frontmatter.
  */
 export function parseFrontmatter(content) {
-  const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/)
+  const match = content.match(/^---\r?\n([\s\S]*?)(?:\r?\n)?---\r?\n?([\s\S]*)$/)
   if (!match) return null
   return {
-    fm: yaml.load(match[1]) ?? {},
+    fm: match[1].trim() ? (load(match[1]) ?? {}) : {},
     body: match[2],
   }
 }
@@ -339,9 +339,9 @@ export function parseFrontmatter(content) {
  * Uses long-line mode and avoids unnecessary quoting.
  */
 export function serializeFm(fm) {
-  return yaml.dump(fm, {
+  return dump(fm, {
     lineWidth: -1,
-    quotingType: '"',
+    quoteStyle: 'double',
     forceQuotes: false,
     noRefs: true,
   })

package/scripts/mcp_persistence_server.py

@@ -25,7 +25,7 @@ from pathlib import Path
 from typing import Annotated
 
 from _pantheon_paths import pantheon_home, pantheon_project
-from mcp.server.fastmcp import FastMCP
+from fastmcp import FastMCP
 from pydantic import Field
 
 # ── Schema ──────────────────────────────────────────────────────────────────────

package/scripts/mcp_resources_server.py

@@ -19,7 +19,7 @@ from typing import Any
 import yaml
 from _pantheon_paths import has_symlink_component, pantheon_home, pantheon_project
 from eval_store import get_latest_eval, list_evals
-from mcp.server.fastmcp import FastMCP
+from fastmcp import FastMCP
 
 # ── Path Resolution ──────────────────────────────────────────────────────────
 _PANTHEON_HOME: Path = pantheon_home()

package/scripts/memory_mcp_server.py

@@ -33,7 +33,7 @@ from pathlib import Path
 from typing import Annotated, Any
 
 from _pantheon_paths import pantheon_home
-from mcp.server.fastmcp import FastMCP
+from fastmcp import FastMCP
 from pydantic import BeforeValidator, Field
 
 # ── Paths ─────────────────────────────────────────────────────────────────────

package/scripts/probe-context-rehydrate.mjs

@@ -63,6 +63,12 @@ spec.loader.exec_module(module)
 
 async def call(name, arguments):
     result = await module.mcp.call_tool(name, arguments)
+    structured = getattr(result, "structured_content", None)
+    if structured is not None:
+        metadata = getattr(result, "meta", None) or {}
+        if metadata.get("fastmcp", {}).get("wrap_result"):
+            return structured.get("result") if isinstance(structured, dict) else structured
+        return structured
     if isinstance(result, tuple):
         structured = result[1]
         if structured is not None: