pantheon-opencode 1.6.0-beta.3 → 1.6.0-beta.5

package/{src/mcp/mcp_resources_server.py → scripts/mcp_resources.py}

@@ -7,7 +7,7 @@ Provides MCP resources for the Pantheon agent framework:
   plans/status, memory-bank files
 
 Usage:
-    python scripts/mcp_resources_server.py
+    python scripts/mcp_resources.py
 """
 
 from __future__ import annotations
@@ -19,7 +19,7 @@ from typing import Any
 import yaml
 from _pantheon_paths import has_symlink_component, pantheon_home, pantheon_project
 from eval_store import get_latest_eval, list_evals
-from mcp.server.fastmcp import FastMCP
+from fastmcp import FastMCP
 
 # ── Path Resolution ──────────────────────────────────────────────────────────
 _PANTHEON_HOME: Path = pantheon_home()

package/scripts/{memory_mcp_server.py → memory_mcp.py}

@@ -19,7 +19,7 @@ Tools:
     memory_stats   — DB statistics
 
 Usage:
-    python scripts/memory_mcp_server.py
+    python scripts/memory_mcp.py
 """
 
 from __future__ import annotations
@@ -33,7 +33,7 @@ from pathlib import Path
 from typing import Annotated, Any
 
 from _pantheon_paths import pantheon_home
-from mcp.server.fastmcp import FastMCP
+from fastmcp import FastMCP
 from pydantic import BeforeValidator, Field
 
 # ── Paths ─────────────────────────────────────────────────────────────────────

package/scripts/probe-context-rehydrate.mjs

@@ -15,7 +15,7 @@ import { fileURLToPath } from 'node:url'
 
 const requestedVersion = valueFor('--version')
 const jsonOutput = process.argv.includes('--json')
-const runtime = fileURLToPath(new URL('./mcp_persistence_server.py', import.meta.url))
+const runtime = fileURLToPath(new URL('./mcp_persistence.py', import.meta.url))
 
 function valueFor(name) {
   const index = process.argv.indexOf(name)
@@ -63,6 +63,12 @@ spec.loader.exec_module(module)
 
 async def call(name, arguments):
     result = await module.mcp.call_tool(name, arguments)
+    structured = getattr(result, "structured_content", None)
+    if structured is not None:
+        metadata = getattr(result, "meta", None) or {}
+        if metadata.get("fastmcp", {}).get("wrap_result"):
+            return structured.get("result") if isinstance(structured, dict) else structured
+        return structured
     if isinstance(result, tuple):
         structured = result[1]
         if structured is not None:
@@ -186,7 +192,7 @@ async function main() {
     return
   }
   if (!existsSync(runtime)) {
-    unavailable('installed package does not include mcp_persistence_server.py')
+    unavailable('installed package does not include mcp_persistence.py')
     return
   }
 

package/scripts/probe-pantheon-cost.mjs

@@ -56,11 +56,48 @@ function setEnvironment(values) {
   }
 }
 
+/**
+ * Write the rows in the family the requested host generation actually uses.
+ *
+ * Call sites describe an assistant turn the way they always have
+ * (`role: 'assistant'`, plus a `phase`). This function translates that
+ * descriptor into what is on disk: for V2, `role` becomes the `type` COLUMN and
+ * `phase` is dropped, because a real V2 payload carries neither — measured, the
+ * `role` key is absent from 40052 of 40052 rows on a host 2.0.22 database.
+ *
+ * Keeping that translation in ONE place is the point: a fixture that wrote
+ * `role` into a session_message row asserts the V1 format under a V2 name, which
+ * is exactly how the stale V1 predicate in the CLI mirror stayed green — the
+ * synthetic database agreed with the bug instead of contradicting it.
+ */
 function createSyntheticDb(DatabaseSync, path, rows) {
   const db = new DatabaseSync(path)
-  db.exec('CREATE TABLE message (data TEXT NOT NULL, time_created INTEGER NOT NULL)')
-  const insert = db.prepare('INSERT INTO message (data, time_created) VALUES (?, ?)')
-  for (const data of rows) insert.run(JSON.stringify(data), Date.now())
+  if (requestedVersion === 'v2') {
+    db.exec(
+      'CREATE TABLE session_message (id TEXT, session_id TEXT, type TEXT, seq INTEGER, time_created INTEGER, time_updated INTEGER, data TEXT)',
+    )
+    const insert = db.prepare(
+      'INSERT INTO session_message (id, session_id, type, seq, time_created, time_updated, data) VALUES (?,?,?,?,?,?,?)',
+    )
+    rows.forEach((row, index) => {
+      const payload = { ...row }
+      delete payload.role
+      delete payload.phase
+      insert.run(
+        `msg_${index + 1}`,
+        'ses_probe',
+        row.role,
+        index + 1,
+        Date.now(),
+        Date.now(),
+        JSON.stringify(payload),
+      )
+    })
+  } else {
+    db.exec('CREATE TABLE message (data TEXT NOT NULL, time_created INTEGER NOT NULL)')
+    const insert = db.prepare('INSERT INTO message (data, time_created) VALUES (?, ?)')
+    for (const data of rows) insert.run(JSON.stringify(data), Date.now())
+  }
   db.close()
 }
 
@@ -129,7 +166,10 @@ async function main() {
   const root = mkdtempSync(join(tmpdir(), 'pantheon-cost-probe-'))
   const dataHome = join(root, 'data')
   const opencodeDir = join(dataHome, 'opencode')
-  const selectedDb = join(opencodeDir, requestedVersion === 'v2' ? 'opencode-v2.db' : 'opencode.db')
+  // Every real installation writes `opencode.db`; the v1/v2 distinction is the
+  // SCHEMA of that file, never its name. Deriving `opencode-v2.db` here made the
+  // probe assert a path that exists on no real machine.
+  const selectedDb = join(opencodeDir, 'opencode.db')
   const otherDb = join(root, 'other.db')
   const envDb = join(root, 'env.db')
   const explicitDb = join(root, 'explicit.db')
@@ -139,7 +179,9 @@ async function main() {
   try {
     mkdirSync(opencodeDir, { recursive: true })
     // These rows intentionally include a monetary-looking field to prove it is
-    // ignored; only input/output/total tokens may appear in the report.
+    // ignored; only input/output/total tokens may appear in the report. Every
+    // V2 phase reads back as `unknown` because the V2 reader emits that literal:
+    // a V2 payload carries no phase field for a reader to recover.
     const selectedRows =
       requestedVersion === 'v2'
         ? [
@@ -224,8 +266,8 @@ async function main() {
         selectedOutput,
         requestedVersion === 'v2'
           ? [
-              { agent: 'aphrodite', phase: 'plan', input: 8, output: 10, total: 18 },
-              { agent: 'zeus', phase: 'audit', input: 4, output: 6, total: 10 },
+              { agent: 'aphrodite', phase: 'unknown', input: 8, output: 10, total: 18 },
+              { agent: 'zeus', phase: 'unknown', input: 4, output: 6, total: 10 },
             ]
           : [
               { agent: 'hermes', phase: 'plan', input: 13, output: 24, total: 37 },
@@ -250,7 +292,12 @@ async function main() {
         {},
         { sessionID: 'cost-probe' },
       )
-      requireOutput(output, '| env-agent | override | 1 | 2 | 3 |', 'PANTHEON_COST_DB')
+      // V2 has no phase to report, so the same row reads back as 'unknown'.
+      requireOutput(
+        output,
+        `| env-agent | ${requestedVersion === 'v2' ? 'unknown' : 'override'} | 1 | 2 | 3 |`,
+        'PANTHEON_COST_DB',
+      )
       if (output.includes('wrong-version') || output.includes('env-agent') === false) {
         throw new Error('PANTHEON_COST_DB did not override the version-selected database')
       }
@@ -269,7 +316,11 @@ async function main() {
         {},
         { sessionID: 'cost-probe' },
       )
-      requireOutput(output, '| explicit-agent | explicit | 9 | 1 | 10 |', 'explicit dbPath')
+      requireOutput(
+        output,
+        `| explicit-agent | ${requestedVersion === 'v2' ? 'unknown' : 'explicit'} | 9 | 1 | 10 |`,
+        'explicit dbPath',
+      )
       if (output.includes('env-agent')) throw new Error('explicit dbPath did not take precedence')
       checks.push('explicit dbPath precedence: PASS')
     } finally {
@@ -287,11 +338,7 @@ async function main() {
         { sessionID: 'cost-probe' },
       )
       requireOutput(output, 'not found', 'missing DB')
-      requireOutput(
-        output,
-        requestedVersion === 'v2' ? 'opencode-v2.db' : 'opencode.db',
-        'selected missing DB path',
-      )
+      requireOutput(output, 'opencode.db', 'selected missing DB path')
       checks.push('missing DB: PASS')
     } finally {
       missingRestore()
@@ -302,7 +349,16 @@ async function main() {
     }).pantheon_cost.execute({}, { sessionID: 'cost-probe' })
     requireOutput(incompatibleOutput, 'incompatible opencode.db schema', 'incompatible schema')
     checks.push('incompatible schema: PASS')
-    emit('PASS', 'offline synthetic DB checks passed; no real DB was read', checks)
+    // Names the synthetic fixture that was built, because the previous wording
+    // ("no real DB was read") was true of every run and therefore true of the run
+    // in which the V2 ledger was read as V1 and silently dropped. A verdict that
+    // cannot fail is not a verdict: it stayed green across the exact defect it
+    // was meant to cover.
+    emit(
+      'PASS',
+      `${checks.length} synthetic ${requestedVersion} checks passed against a temporary opencode.db (no user database was read)`,
+      checks,
+    )
   } catch (error) {
     emit('FAIL', diagnostic(error), checks)
   } finally {

package/scripts/sync-artifacts.mjs

@@ -31,13 +31,13 @@ import {
 
 /** Canonical MCP script sources — mirrors installOpenCode phase 2.10. */
 const MCP_SCRIPTS = {
-  'mcp_resources_server.py': () => join(ROOT, 'src', 'mcp', 'mcp_resources_server.py'),
-  'code_mode_server.py': () => join(ROOT, 'src', 'mcp', 'code_mode_server.py'),
-  'memory_mcp_server.py': () => join(ROOT, 'src', 'mcp', 'memory_mcp_server.py'),
-  'mcp_persistence_server.py': () => join(ROOT, 'src', 'mcp', 'mcp_persistence_server.py'),
+  'mcp_resources.py': () => join(ROOT, 'src', 'mcp', 'mcp_resources.py'),
+  'code_mode.py': () => join(ROOT, 'src', 'mcp', 'code_mode.py'),
+  'memory_mcp.py': () => join(ROOT, 'src', 'mcp', 'memory_mcp.py'),
+  'mcp_persistence.py': () => join(ROOT, 'src', 'mcp', 'mcp_persistence.py'),
   '_pantheon_paths.py': () => join(ROOT, 'src', 'mcp', '_pantheon_paths.py'),
   'mcp_codemap_module.py': () => join(ROOT, 'src', 'mcp', 'mcp_codemap_module.py'),
-  'pantheon_vision_server.py': () => join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py'),
+  'pantheon_vision.py': () => join(ROOT, 'src', 'mcp', 'pantheon_vision.py'),
   'eval_store.py': () => join(ROOT, 'src', 'mcp', 'eval_store.py'),
   'scrub-secrets.py': () => join(ROOT, 'scripts', 'scrub-secrets.py'),
 }

package/scripts/test-opencode-v2-sandbox.sh

@@ -241,11 +241,11 @@ try:
 except OSError:
     raise SystemExit(1)
 expected = {
-    "code_mode_server.py",
-    "memory_mcp_server.py",
-    "mcp_persistence_server.py",
-    "mcp_resources_server.py",
-    "pantheon_vision_server.py",
+    "code_mode.py",
+    "memory_mcp.py",
+    "mcp_persistence.py",
+    "mcp_resources.py",
+    "pantheon_vision.py",
 }
 pattern = re.compile(
     r"spawning process \{\s*"
@@ -515,11 +515,11 @@ try:
 except OSError:
     raise SystemExit(1)
 expected = {
-    "code_mode_server.py",
-    "memory_mcp_server.py",
-    "mcp_persistence_server.py",
-    "mcp_resources_server.py",
-    "pantheon_vision_server.py",
+    "code_mode.py",
+    "memory_mcp.py",
+    "mcp_persistence.py",
+    "mcp_resources.py",
+    "pantheon_vision.py",
 }
 pattern = re.compile(
     r"spawning process \{\s*"
@@ -642,11 +642,11 @@ config_path = Path(os.environ["CONFIG_PATH"])
 runtime_dir = os.environ["RUNTIME_DIR"]
 python_bin = os.environ["MCP_PYTHON"]
 managed = {
-    "pantheon-code-mode": "code_mode_server.py",
-    "pantheon-memory": "memory_mcp_server.py",
-    "pantheon-persistence": "mcp_persistence_server.py",
-    "pantheon-resources": "mcp_resources_server.py",
-    "pantheon-vision": "pantheon_vision_server.py",
+    "pantheon-code-mode": "code_mode.py",
+    "pantheon-memory": "memory_mcp.py",
+    "pantheon-persistence": "mcp_persistence.py",
+    "pantheon-resources": "mcp_resources.py",
+    "pantheon-vision": "pantheon_vision.py",
 }
 try:
     config = json.loads(config_path.read_text(encoding="utf-8"))
@@ -829,7 +829,7 @@ else
 fi
 
 echo "--- Gate (b): pantheon://agents CONTENT check ---"
-RESOURCES_SRV="$PANTHEON_GLOBAL/scripts/mcp_resources_server.py"
+RESOURCES_SRV="$PANTHEON_GLOBAL/scripts/mcp_resources.py"
 if [ ! -f "$RESOURCES_SRV" ]; then
   record_status "pantheon://agents resource" "FAIL" "resources server not found at $RESOURCES_SRV"
 else
@@ -1013,11 +1013,11 @@ config_path = Path(os.environ["CONFIG_PATH"])
 runtime_dir = os.environ["RUNTIME_DIR"]
 python_bin = os.environ["MCP_PYTHON"]
 managed = {
-    "pantheon-code-mode": "code_mode_server.py",
-    "pantheon-memory": "memory_mcp_server.py",
-    "pantheon-persistence": "mcp_persistence_server.py",
-    "pantheon-resources": "mcp_resources_server.py",
-    "pantheon-vision": "pantheon_vision_server.py",
+    "pantheon-code-mode": "code_mode.py",
+    "pantheon-memory": "memory_mcp.py",
+    "pantheon-persistence": "mcp_persistence.py",
+    "pantheon-resources": "mcp_resources.py",
+    "pantheon-vision": "pantheon_vision.py",
 }
 
 try:

package/scripts/validate-routing.mjs

@@ -19,7 +19,7 @@ import { createHash } from 'node:crypto'
 import { existsSync, readdirSync, readFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import yaml from 'js-yaml'
+import { load } from 'js-yaml'
 import { validatePresetDefs } from '../src/pantheon/presets.mjs'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
@@ -52,7 +52,7 @@ if (!existsSync(routingPath)) {
   console.error('❌ routing.yml not found')
   process.exit(1)
 }
-const routing = yaml.load(readFileSync(routingPath, 'utf8'))
+const routing = load(readFileSync(routingPath, 'utf8'))
 
 console.log('🔍 Validating routing.yml...\n')
 
@@ -253,7 +253,7 @@ function parseFrontmatter(filePath) {
   const match = content.match(FRONTMATTER_RE)
   if (!match) return null
   try {
-    return yaml.load(match[1])
+    return load(match[1])
   } catch {
     return null
   }

package/skills-lock.json

@@ -5,7 +5,7 @@
   "src/skills/clonedeps/SKILL.md": "3e0b43cf96da98c83699dc48db3fd58fbfda84b9022bb70d3747875c81c3e124",
   "src/skills/code-review-checklist/SKILL.md": "0e59367c65ef4608db80a0674279f32cfc3f67dca7236f233b61a47fe506579f",
   "src/skills/codemap/SKILL.md": "87af5271e1576e154cadff313eab16264b726e43d094520736b7a5b03b409a4a",
-  "src/skills/context-compression/SKILL.md": "ebc721c715c1fa20e4ebf5177007fde94e001540b16cef4316393a665633c16f",
+  "src/skills/context-compression/SKILL.md": "9c65c132beb0dc7bd20335cfd7f41c589f5168a72dcf5d51740bc66f2865e027",
   "src/skills/git-workflow-and-versioning/SKILL.md": "685a94041f1b4ce2a430301f517b89102055696267c369a7e8fb191606659276",
   "src/skills/incremental-implementation/SKILL.md": "7065ddb45da3c6b6751de07f290e92e6cb072e949a2e3aaae13ee7762f0a70fc",
   "src/skills/loop-engineering/SKILL.md": "f804e545821b9cca8fe0ec517307ed902446f28c2ca8ff9194c0f987cf7229e3",

package/src/agents/apollo.md

@@ -38,7 +38,10 @@ mcp_tools:
 - Generate structured summaries (not raw dumps)
 
 ### 2. External Research
-- Web search via bifrost MCP tools for documentation, blog posts, GitHub repos
+- Web search through whatever web-search MCP the USER has configured — Pantheon
+  bundles none and does not assume one. If no search tool is available, skip
+  external search and say so; never present an unverified recollection as a
+  citation.
 - Context7 for library documentation
 - Read URLs with webfetch for known resource URLs
 
@@ -50,7 +53,9 @@ mcp_tools:
 ##  TOOLS NOT AVAILABLE
 - bash - forbidden (cannot run commands)
 - edit - forbidden (read-only agent)
-- bifrost - use bifrost MCP tools for search
+- Web search by default - no search MCP is bundled or pre-configured. Use one
+  ONLY if the user's own config exposes it; otherwise state that external search
+  was unavailable instead of improvising.
 
 ## MCP Security
 - Never embed credentials in URLs (grep for token=, key=, secret=)

package/src/agents/zeus.md

@@ -284,7 +284,35 @@ in `task-result-guard.ts` (plugin `tool.execute.after` chain): an
 empty/whitespace-only result is converted into an explicit error so a silent
 child failure is never mistaken for success. No manual retry helper is required.
 
-### /cost — pantheon_cost tool (WIRED no plugin)
+### /cost — pantheon_cost tool (disponivel com o version gate corrigido)
+`pantheon_cost` volta a existir assim que o version gate corrigido estiver
+instalado **e após o usuário re-rodar `init`**: em host 2.x, `auto` resolve
+para `v2` e registra o entry de diretorio `src/plugin-v2`, que expoe
+exatamente 3 tools — `hashline_edit`, `pantheon_cost` e `pantheon_model`
+(V2 nao registra as 3 goal tools; ver `docs/INSTALLATION.md` ->
+"OpenCode V1/V2 — contrato de plugin").
+**Caveat**: a tool so reaparece para quem re-rodar `init` depois do fix. O
+`postinstall` nao re-executa `init`, entao ate la o config existente continua
+resolvendo para V1 e a tool segue ausente — nesse estado, tratar `/cost` como
+indisponivel.
+
+Causa raiz como era na tag `1.6.0-beta.4` (registro para quem ainda tem um
+install quebrado): o host `opencode v2.0.22` rejeita caminhos de arquivo `.ts` nos
+arrays de plugin do config (recusa `configured plugin path must be a directory`,
+medida em runtime nesse host; o repo so registra a parafrase `must be a
+directory`), e a selecao de geracao caia sempre em V1 — a geracao V1 escreve
+entradas `.ts` sob a chave singular `plugin` (`config.plugin`, o bloco de merge
+em `scripts/install/opencode.mjs`) e o host descarta todas, logo nenhum
+modulo Pantheon entra no processo Node. **O que mudou**: `resolveOpenCodeVersion`
+agora tem default `'auto'` nos dois call sites e no proprio signature, e `auto`
+consulta o host. Precedencia `auto`: flag explicito > `OPENCODE_VERSION` >
+basename `opencode2` > probe `--version` do host (major >= 2 => v2) > soft-fail
+para V1 com warning visivel. Precedencia e criterios do probe estao em
+`docs/INSTALLATION.md` -> "OpenCode V1/V2 — contrato de plugin".
+
+Comportamento da tool — **NAO VERIFICADO em runtime**: em 1.6.0-beta.4 o modulo
+(`src/pantheon/cost-command.ts`) nunca era carregado no processo, e o fix nao foi
+exercitado end-to-end, entao este descritivo permanece nao verificado.
 `pantheon_cost({ days?: number })` le o `opencode.db` READ-ONLY usando o backend
 unico `node:sqlite`; se indisponivel, retorna `UNSUPPORTED`, sem fallback. Devolve tabela markdown de custo + tokens por
 agente nos ultimos N dias (default 7). Uso: quando Nyx pedir visibilidade de

package/src/instructions/memory-protocol.instructions.md

@@ -58,8 +58,14 @@ Para otimizar decisoes de delegacao e reduzir gasto de tokens:
 2. Se score > 0.85 → reutiliza agente + background_mode do cache
 3. Se score ≤ 0.85 → aplica regras estaticas e memory_store() com:
    - key: deleg:<task_type>
-   - value: {agent, background, pattern}
-   - metadata: {type: "decision", score: N}
+   - value: JSON.stringify({agent, background, pattern})
+   - metadata: JSON.stringify({type: "decision", score: N})
+
+   `value` E `metadata` sao JSON-encoded strings — o runtime exige que o
+   chamador serialize os dois. Objeto cru em `metadata` e rejeitado pelo
+   `BeforeValidator` do servidor com `metadata must be a JSON object encoded
+   as a string (got object). json.dumps it first. Example: metadata='{"type":
+   "decision", "score": 0.9}'`.
 
 4. **kv_store("deleg:<pattern>", ...)** para padroes recorrentes de delegacao
 5. **kv_get("deleg:<pattern>")** para reusar decisoes ja tomadas
@@ -88,14 +94,19 @@ memory_store({
     precedent_used: false,
     timestamp: "<ISO-8601>"
   },
-  metadata: {
+  metadata: JSON.stringify({
     type: "council_decision",
     specialist_count: N,
     model_tier_used: "premium|default|fast"
-  }
+  })
 })
 ```
 `value` is JSON-serialized before storing (the MCP `memory_store.value` argument is a string).
+`metadata` works the same way — it is a JSON object encoded as a **string**, so pass
+`JSON.stringify({...})`. A raw object is rejected with `metadata must be a JSON object
+encoded as a string (got object). json.dumps it first. Example: metadata='{"type":
+"decision", "score": 0.9}'` (enforced by a `BeforeValidator` in
+`memory_mcp.py`). **Both `value` and `metadata` must be serialized by the caller.**
 
 ### Read Path (Precedent Fast-Path)
 Before dispatching a new council, Zeus runs:

package/src/instructions/zeus-anti-stall.instructions.md

@@ -66,9 +66,17 @@ No file I/O, no checkpoint_session.py — TTL (4h) handles cleanup automatically
 Before ANY delegate dispatch, save a checkpoint:
 ```
 context_save(slug, "phase:N", json({
-  "phase": N, "turn_count": N, "agent": "...", "summary": "..."
+  "phase": {"current": N, "total": M, "name": "..."},
+  "turn_count": N, "agent": "...", "summary": "..."
 }), session_id=SESSION_ID)
 ```
+**`content.phase` must be an OBJECT, not a bare number.** `{"phase": 1}` is rejected with
+`context_save: content.phase must be an object (got number)`. The server reads `current`
+and `total` (non-negative ints) and `name` (string, max 256 **bytes** — the guard
+measures `len(value.encode())`, so multi-byte characters count as more than one). That
+set is not closed: any other key inside `phase` is accepted and ignored, never an
+error. The `"phase:N"` slot KEY above is unrelated to `content.phase` and stays a plain
+string.
 All checkpoints auto-expire after 4h (TTL=14400).
 
 ### Gatilho de Pré-Compactação (Anti-perda de estado)

package/src/mcp/{code_mode_server.py → code_mode.py}

@@ -5,12 +5,12 @@ Provides a confined execution environment for orchestration scripts
 via MCP tools and resources.
 
 Usage:
-    python scripts/code_mode_server.py
+    python scripts/code_mode.py
 
 Or via MCP client (stdio transport):
     pantheon-code-mode:
         command: python
-        args: ["scripts/code_mode_server.py"]
+        args: ["scripts/code_mode.py"]
 """
 
 from __future__ import annotations
@@ -36,7 +36,7 @@ from typing import Any
 
 import yaml
 from _pantheon_paths import pantheon_home, pantheon_project
-from mcp.server.fastmcp import FastMCP
+from fastmcp import FastMCP
 
 # ── Constants ─────────────────────────────────────────────────────────────────
 ALLOWED_EXTENSIONS: frozenset[str] = frozenset({".sh", ".py"})

package/src/mcp/eval_store.py

@@ -2,7 +2,7 @@
 """Plugin eval certification storage — ``plugin_eval`` memory namespace.
 
 Thin stdlib-only wrapper around the memory SQLite DB (same schema as
-``src/mcp/memory_mcp_server.py``) for plugin-eval certification results.
+``src/mcp/memory_mcp.py``) for plugin-eval certification results.
 
 Namespace: ``plugin_eval``
 Key format: ``eval:<name>:<date>``  (e.g. ``eval:tdd-with-agents:2026-08-21``)
@@ -30,7 +30,7 @@ from typing import Any
 
 NAMESPACE = "plugin_eval"
 
-# Minimal schema — matches memory_mcp_server.SCHEMA_SQL for the memories
+# Minimal schema — matches memory_mcp.SCHEMA_SQL for the memories
 # table (vec/FTS tables are initialized by the memory MCP server on first
 # run; eval entries remain readable via list/recall regardless).
 _SCHEMA_SQL = """

package/src/mcp/{mcp_persistence_server.py → mcp_persistence.py}

@@ -5,7 +5,7 @@ Key-Value store with FTS5 full-text search, TTL-based expiration,
 and namespace isolation. Uses SQLite with zero external dependencies.
 
 Usage:
-    python scripts/mcp_persistence_server.py
+    python scripts/mcp_persistence.py
 """
 
 from __future__ import annotations
@@ -25,7 +25,7 @@ from pathlib import Path
 from typing import Annotated
 
 from _pantheon_paths import pantheon_home, pantheon_project
-from mcp.server.fastmcp import FastMCP
+from fastmcp import FastMCP
 from pydantic import Field
 
 # ── Schema ──────────────────────────────────────────────────────────────────────

package/{scripts/mcp_resources_server.py → src/mcp/mcp_resources.py}

@@ -7,7 +7,7 @@ Provides MCP resources for the Pantheon agent framework:
   plans/status, memory-bank files
 
 Usage:
-    python scripts/mcp_resources_server.py
+    python scripts/mcp_resources.py
 """
 
 from __future__ import annotations
@@ -19,7 +19,7 @@ from typing import Any
 import yaml
 from _pantheon_paths import has_symlink_component, pantheon_home, pantheon_project
 from eval_store import get_latest_eval, list_evals
-from mcp.server.fastmcp import FastMCP
+from fastmcp import FastMCP
 
 # ── Path Resolution ──────────────────────────────────────────────────────────
 _PANTHEON_HOME: Path = pantheon_home()

package/src/mcp/{memory_mcp_server.py → memory_mcp.py}

@@ -19,7 +19,7 @@ Tools:
     memory_stats   — DB statistics
 
 Usage:
-    python scripts/memory_mcp_server.py
+    python scripts/memory_mcp.py
 """
 
 from __future__ import annotations
@@ -34,7 +34,7 @@ from pathlib import Path
 from typing import Annotated, Any
 
 from _pantheon_paths import pantheon_home
-from mcp.server.fastmcp import FastMCP
+from fastmcp import FastMCP
 from pydantic import BeforeValidator, Field
 
 try:

package/src/mcp/{pantheon_vision_server.py → pantheon_vision.py}

@@ -24,7 +24,7 @@ from typing import Any
 from urllib.parse import unquote, urlparse
 
 import httpx
-from mcp.server.fastmcp import FastMCP
+from fastmcp import FastMCP
 
 mcp = FastMCP("pantheon-vision")
 

package/src/mcp/requirements-mcp.txt

@@ -1,10 +1,12 @@
 # Pantheon MCP runtime dependencies — EXACT pins (issue #21)
-# Pinned to the versions validated in the sandbox venv (2026-08-05).
-# Update deliberately via: pip install -U <pkg> && pip freeze | grep -iE '^(mcp|fastmcp|pyyaml)'
+# Coordinated MCP SDK/FastMCP major migration (Dependabot PRs #140 and #188).
+# Update deliberately via: pip install -U <pkg> && pip freeze | grep -iE '^(mcp|fastmcp|pyyaml|httpx)=='
 # Memory search is FTS5 (SQLite stdlib): sqlite-vec and fastembed were removed
 # with the vector pipeline — the server no longer imports either.
-mcp==1.29.0
-fastmcp==3.4.6
+mcp==2.2.0
+fastmcp==4.0.10
 pydantic==2.12.5
 pydantic-settings==2.14.2
 pyyaml==6.0.3
+# Vision imports httpx; MCP 2.2.0 provides httpx2, a different package.
+httpx==0.28.1

package/src/mcp/requirements-vision.txt

@@ -1,5 +1,5 @@
-mcp==1.29.0
-fastmcp==3.4.6
+mcp==2.2.0
+fastmcp==4.0.10
 pydantic==2.12.5
 pydantic-settings==2.14.2
 httpx==0.28.1