pantheon-opencode 1.6.0-beta.5 → 1.6.0-beta.6

package/AGENTS.md

@@ -271,7 +271,7 @@ Each agent file defines overrides in its `## 🧠 Memory Protocol` section:
 
 Para otimizar decisoes de delegacao e reduzir gasto de tokens:
 
-1. **memory_search(task_prompt, top_k=2)** antes de aplicar a arvore de roteamento
+1. **memory_search(query=task_prompt, top_k=2)** antes de aplicar a arvore de roteamento
 2. Se score > 0.85 → reutiliza agente + background_mode do cache
 3. Se score ≤ 0.85 → aplica regras estaticas e memory_store() com:
    - key: deleg:<task_type>
@@ -284,8 +284,8 @@ Para otimizar decisoes de delegacao e reduzir gasto de tokens:
    as a string (got object). json.dumps it first. Example: metadata='{"type":
    "decision", "score": 0.9}'`.
 
-4. **kv_store("deleg:<pattern>", ...)** para padroes recorrentes de delegacao
-5. **kv_get("deleg:<pattern>")** para reusar decisoes ja tomadas
+4. **kv_store(namespace="deleg", key="deleg:<pattern>", value=...)** para padroes recorrentes de delegacao
+5. **kv_get(namespace="deleg", key="deleg:<pattern>")** para reusar decisoes ja tomadas
 
 Isso elimina ~300 tokens de reasoning por delegacao quando o cache acerta.
 
@@ -299,7 +299,7 @@ After every `/pantheon` council synthesis completes, Zeus stores:
 memory_store({
   namespace: "council_decisions",
   key: "council:<yyyy-mm-dd>:<slug>",
-  value: {
+  value: JSON.stringify({
     question: "original question",
     specialists: ["@agent1", "@agent2"],
     recommendation: "final recommendation",
@@ -310,7 +310,7 @@ memory_store({
     themis_audit: "approved|issues",
     precedent_used: false,
     timestamp: "<ISO-8601>"
-  },
+  }),
   metadata: JSON.stringify({
     type: "council_decision",
     specialist_count: N,
@@ -328,7 +328,7 @@ encoded as a string (got object). json.dumps it first. Example: metadata='{"type
 ### Read Path (Precedent Fast-Path)
 Before dispatching a new council, Zeus runs:
 ```
-memory_search(question, top_k=2, namespace="council_decisions")
+memory_search(query=question, top_k=2, namespace="council_decisions")
 ```
 
 Result interpretation:
@@ -426,16 +426,16 @@ All session state lives in **pantheon-persistence** (namespace `checkpoint:<slug
 No file I/O, no checkpoint_session.py — TTL (4h) handles cleanup automatically.
 
 ### Heartbeat Check
-- If `context_get(slug, "heartbeat")` returns a checkin older than 300s, log a stall warning and resume
+- If `context_get(slug=slug, key="heartbeat", session_id=SESSION_ID)` returns a checkin older than 300s, log a stall warning and resume
 - Write heartbeat after every anti-stall recovery action:
   ```
-  context_save(slug, "heartbeat", json({"status": "alive", "last_action": "...", "turn_count": N}))
+  context_save(slug=slug, key="heartbeat", content=JSON.stringify({"status": "alive", "last_action": "...", "turn_count": N}), session_id=SESSION_ID)
   ```
 
 ### Checkpoint Auto-Save (Pré-Compactação)
 Before ANY delegate dispatch, save a checkpoint:
 ```
-context_save(slug, "phase:N", json({
+context_save(slug=slug, key="phase:N", content=JSON.stringify({
   "phase": {"current": N, "total": M, "name": "..."},
   "turn_count": N, "agent": "...", "summary": "..."
 }), session_id=SESSION_ID)
@@ -456,15 +456,15 @@ o Zeus DEVE salvar o estado atual:
 2. Salve heartbeat + phase atual + tarefas pendentes
 3. Só então permita que a compactação prossiga
 ```
-# Ao iniciar sessão:
-result = context_save(slug, "init", session_state)
+# Ao iniciar sessão (session_id é REQUIRED — use o id da sessão corrente):
+result = context_save(slug=slug, key="init", content=JSON.stringify(session_state), session_id=SESSION_ID)
 SESSION_ID = result.session_id   # ← guarde para toda a sessão
 
 # Antes de CADA delegação:
-context_save(slug, f"pre:{agent}", current_state, session_id=SESSION_ID)
+context_save(slug=slug, key=f"pre:{agent}", content=JSON.stringify(current_state), session_id=SESSION_ID)
 
 # Após retorno do agente:
-context_save(slug, f"post:{agent}", result_state, session_id=SESSION_ID)
+context_save(slug=slug, key=f"post:{agent}", content=JSON.stringify(result_state), session_id=SESSION_ID)
 ```
 Isso garante que o estado sobreviva à compactação — o "latest" pointer
 sempre aponta para o checkpoint mais recente, mesmo após compactação.
@@ -473,9 +473,9 @@ sempre aponta para o checkpoint mais recente, mesmo após compactação.
 ### Context Retrieval
 Next-phase agents retrieve previous context via:
 ```
-context_get(slug, "latest")        # most recent checkpoint
-context_get(slug, "phase:3")      # specific phase
-context_list(slug)                 # all checkpoints
+context_get(slug=slug, session_id=SESSION_ID)                    # most recent checkpoint ("latest" is the default key)
+context_get(slug=slug, key="phase:3", session_id=SESSION_ID)     # specific phase
+context_list(slug=slug, session_id=SESSION_ID)                   # all checkpoints
 ```
 
 ### Long-Session Progress
@@ -535,7 +535,7 @@ sequenceDiagram
     participant T as Themis (Audit + Moderator)
 
     U->>Z: /pantheon [--research] question
-    Z->>M: memory_search(council_decisions)
+    Z->>M: memory_search(query, namespace="council_decisions")
     alt Precedent found (score > 0.85)
         M-->>Z: ⚠️ Cached decision
         Z->>U: Fast-path precedent
@@ -584,7 +584,7 @@ sequenceDiagram
 ## Dispatch Sequence (9-Step Protocol)
 
 ### Step 0 — Precedent Fast-Path (Fase 1)
-Run the precedent read path defined in `## Memory Protocol > Council Decisions Namespace` (`memory_search(query, top_k=2, namespace="council_decisions")`). If no precedent applies, proceed to Step 0b.
+Run the precedent read path defined in `## Memory Protocol > Council Decisions Namespace` (`memory_search(query=question, top_k=2, namespace="council_decisions")`). If no precedent applies, proceed to Step 0b.
 
 ### Step 0b — Apollo Pre-Scan (Fase 2, --research flag)
 If `/pantheon --research <question>`: dispatch @apollo with 30s timeout. Inject findings as `shared_context` into ALL specialist prompts. Skip if flag absent.

package/CHANGELOG.md

@@ -18,6 +18,20 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## ✅ Closed Issues
 
+## [v1.6.0-beta.6] - 2026-10-05
+
+<!-- Add new changes here. Running `node scripts/versioning.mjs apply` will
+     move this section to a versioned entry and reset the template below. -->
+
+## 🆕 What's New
+
+- **Política de suporte documentada: a linha 1.6.x é a ÚLTIMA compatível com OpenCode 1.X.** A partir de **1.7, toda release é breaking change com alvo em OpenCode 2.** O limite está escrito no `README.md` (seção "Compatibility and support policy", com matriz de suporte) e em `docs/INSTALLATION.md` (seção "OpenCode V1/V2 — contrato de plugin"), não duplicado em um documento novo: os dois arquivos já eram o ponto de entrada do contrato de plugin, e um terceiro documento seria um terceiro lugar para divergir. O texto distingue as duas células da linha 1.6.x — a célula 1.X é o contrato V1 (6 tools, lifecycle do board, hooks V1, compaction V1) e a célula OpenCode 2 é o contrato V2, que é real porém **menor**: 3 tools, sem as `pantheon_goal_*` e sem a matriz de delegação caller→target. **O suporte a OpenCode 2 na linha 1.6 é documentado como parcial, e não como completo**, por duas razões verificadas: (a) o canário de ferramentas V2 foi escrito contra `opencode 2.0.22`, host que não é publicado em nenhum canal npm — contra o `@opencode-ai/cli` instalável o mesmo canário falha 12/12, porque `/api/experimental/session/{id}/wait` foi promovido para `/api/session/{id}/wait` (404 no caminho antigo) e `ctx.tool.list` não existe mais; corrigindo apenas a rota, 10/12 passam no mesmo host, o que caracteriza descasamento canário/host e não regressão medida do plugin (issue #216, PR #213); (b) não existe perna V1 de validação end-to-end — `scripts/test-opencode-v2-sandbox.sh` é V2-only e rejeita `--run v1` — portanto a versão exata de host 1.X exercitada end-to-end pela linha 1.6 fica registrada como **não verificada**, e o caminho 1.X é sustentado pelo pin de dependência (`@opencode-ai/plugin` / `@opencode-ai/sdk` `1.18.33`), pelos testes unitários do gate de geração e pelos testes end-to-end do installer sobre a config emitida.
+
+## 🐞 Fixed
+
+- **Os exemplos de chamada MCP nos arquivos de prompt ensinavam um contrato que não existe no schema real.** Um `pantheon-persistence.kv_get` ao vivo foi rejeitado com `namespace: Missing key`; a linha que o produziu foi `src/agents/zeus.md:189` (`depth = kv_get("deleg:depth") ?? 0`), cuja cópia instalada em `~/.config/opencode/agents/zeus.md` é a que executou. A causa não era o servidor MCP: os arquivos de agente e de instrução ensinavam chamadas posicionais sem `namespace`, enquanto o schema real é `kv_get({ namespace /* obrigatório, sem default */, key, scope? })` — `kv_store.namespace` é igualmente obrigatório e `kv_store.value` é `str`. **A correção está nos docs, e não em adicionar um `namespace` default:** um default escreveria estado de coordenação no namespace errado silenciosamente, então *obrigatório* é o desenho correto. A mesma classe de defeito foi corrigida em `context_save` (posicional, com um helper `json()` inexistente e sem o `session_id` obrigatório → forma por palavra-chave com `content=JSON.stringify(...)`), em `memory_store` (`value` precisa ser uma string JSON codificada → agora iguala o padrão já correto de `metadata`, o que resolveu uma aut contradição no mesmo arquivo), na aritmética de profundidade (envolvida em `String(...)`, porque `kv_store.value` é `str` e não `int`) e em `memory_search(query, ...)` → `query=` em todas as instâncias. `AGENTS.md` é artefato gerado e foi reconstruído, nunca editado à mão.
+- **Um bypass de permissão vivo: `edit: deny` não cobria `hashline_edit`.** A regra `edit: deny` é avaliada por nome de ferramenta, e `hashline_edit` não é `edit` — então os agentes restritos a `edit: deny` (`zeus`, `athena`, `iris`, `nyx`, `themis`) podiam editar arquivos assim mesmo, escrevendo no disco por um caminho que a negação não cobria. `hashline_edit: deny` foi adicionado a esses cinco agentes. **Não era uma condição de corrida nem um erro de configuração: era uma tabela de permissões incompleta**, o que significa que a negação nunca esteve de fato aplicada a quem só deveria ler.
+- **`test:node` reportava sucesso tendo coletado zero testes.** `node --test <glob>` sai com 0 quando o glob não expande (Node >= 22), e foi exatamente o que aconteceu: um glob que nunca expandiu produziu um gate verde que não executou nada. Pior, `tests/` estava ausente da allow-list `files` do pacote, então um consumidor que rodasse `npm test` recebia esse verde. Agora os scripts de teste falham em voz alta quando a coleta é zero, e a guarda tem teste próprio (`tests/run-node-tests.test.mjs`) que a dirige como subprocesso — o contrato é o código de saída, então testá-la em processo não provaria nada.
 ## [v1.6.0-beta.5] - 2026-10-05
 
 &lt;!-- Add new changes here. Running `node scripts/versioning.mjs apply` will

package/README.md

@@ -31,7 +31,9 @@ way to plan work, make progress, check results, and keep useful project context.
 ## Start in 2 minutes
 
 Requirements: [OpenCode 1.18.4+](https://opencode.ai/docs/) and Node.js
-22.22.2+ (or 24.15.0+ / 26+).
+22.22.2+ (or 24.15.0+ / 26+). For which OpenCode generation each Pantheon
+release line supports, see
+[Compatibility and support policy](#compatibility-and-support-policy).
 
 Pantheon declares `engines.node` as `^22.22.2 || ^24.15.0 || >=26.0.0`. The
 floor reflects what the dependency tree actually needs — the transitive
@@ -89,6 +91,81 @@ services you choose to use. Check the
 [releases](https://github.com/ils15/pantheon-opencode/releases) and
 [changelog](CHANGELOG.md) for the latest published changes.
 
+## Compatibility and support policy
+
+> ### ⚠️ 1.6.x is the LAST line that supports OpenCode 1.X
+>
+> **OpenCode 1.X support ends after the 1.6 line.** From **1.7 onward, every
+> release is a breaking change targeting OpenCode 2.** A 1.6.x install is the
+> last one that runs on an OpenCode 1.X host; do not plan an upgrade across the
+> 1.6 → 1.7 boundary while your host is still on OpenCode 1.X.
+
+| Pantheon line | OpenCode 1.X host | OpenCode 2 host |
+|---|---|---|
+| **1.6.x** (current line) | **Supported.** V1 plugin contract | Supported, reduced surface — V2 contract |
+| **1.7 and later** | **Not supported.** Breaking change | Target of the 1.7+ work |
+
+Both columns of the 1.6.x row are real, and they are not the same claim. Read
+[the plugin contract](#opencode-v1v2--dual-version-160-beta1) for what each
+generation actually registers.
+
+### What "supported on OpenCode 1.X" concretely means
+
+On the 1.6 line, an OpenCode 1.X host gets the **V1 plugin**:
+`src/plugin.ts` plus `src/plugins/pantheon-hooks.ts`, registered under the
+singular `plugin` config key. That surface registers 6 tools
+(`hashline_edit`, the 3 `pantheon_goal_*` tools, `pantheon_cost`,
+`pantheon_model`), the BackgroundJobBoard lifecycle, the V1 event/tool hooks and
+the V1 compaction path. It is selected automatically: the generation gate
+(`--opencode-version`, else `OPENCODE_VERSION`, else a `OPENCODE_BIN` basename of
+`opencode2`, else a `--version` probe where major ≥ 2 selects V2) resolves a 1.X
+host to V1.
+
+The two generations are exclusive. The installer strips Pantheon references from
+both config shapes and registers only the selected one, so a 1.X host never
+loads the V2 plugin and a V2 host never loads the V1 plugin. Forcing V2 on a 1.X
+host is an unsupported mixed/wrong-generation configuration, not a supported mode.
+
+### What the OpenCode 2 path is — and is not
+
+**Not inert.** The V2 path (`src/plugin-v2`, registered as a directory because
+the V2 loader rejects bare file paths) registers real tools with real
+`input`/`output` schemas via `ctx.tool.transform()`, 5 event subscriptions,
+session hooks and a tool `execute.before` hook that enforces read-only sessions.
+It is a smaller surface than V1 by design, not a stub: the 3 goal tools and the
+V1 caller→target delegation matrix are absent, and `getUnsupportedFeatures()`
+reports that as `goal-tools` and `delegation-matrix`.
+
+**Not complete either, and the V2 support claim is currently narrowed.** Two
+facts, both recorded in this repository rather than smoothed over:
+
+- **The host-backed V2 gate is red on the installable OpenCode CLI.** The V2 tool
+  canary (`tests/canary/plugin-v2-tool-canary.test.mjs`) was written against
+  `opencode 2.0.22`, which no npm channel publishes. Against the installable
+  `@opencode-ai/cli` host, `/api/experimental/session/{id}/wait` has been
+  promoted to `/api/session/{id}/wait` (the old path 404s) and `ctx.tool.list`
+  is absent, so the canary fails 12/12 there. That is a canary/host-generation
+  mismatch, not a measured plugin regression — with only the route renamed, 10/12
+  pass on the same host, including the edit being applied and the mutant still
+  caught. Tracked as [issue
+  #216](https://github.com/ils15/pantheon-opencode/issues/216); the fail-closed
+  CI change is [PR #213](https://github.com/ils15/pantheon-opencode/pull/213).
+- **The 2.x host claims in `src/plugin-v2.ts` are measured against `2.0.22`
+  specifically**, not against the current installable CLI. Re-measurement
+  against the current host is outstanding and is tracked in the same issue.
+
+Treat the 1.6 line's OpenCode 2 support as **real but partial**, and do not read
+the 1.6.x row as "OpenCode 2 is finished".
+
+### Verified against which OpenCode versions
+
+| What | Verified against | How |
+|---|---|---|
+| V1 plugin + generation gate | The OpenCode 1.18.x line. This package pins `@opencode-ai/plugin` and `@opencode-ai/sdk` to `1.18.33`; the highest published `opencode-ai` host package (the one shipping the `opencode` binary) is `1.18.34` | Dependency pin (`package.json`); generation-gate unit tests over injected host banners; installer end-to-end tests asserting the emitted `opencode.json` shape |
+| V2 plugin tool surface | `opencode 2.0.22` (the host the canary was written against) | `tests/canary/plugin-v2-tool-canary.test.mjs`, driving `hashline_edit` through a real `opencode serve` |
+| V2 against the current installable CLI | **Not verified.** Canary fails 12/12; see issue #216 | — |
+| Exact 1.X host version the 1.6 line is exercised against end-to-end | **Unverified.** No V1 host leg exists: the sandbox runner is V2-only and `--run v1` is rejected | — |
+
 ## Delegation (native `task()`)
 
 Pantheon delegates exclusively through OpenCode's native `task()` child-session
@@ -301,6 +378,11 @@ Key order does not matter.
 
 ## Updating between releases (beta.5+)
 
+> **Read [Compatibility and support policy](#compatibility-and-support-policy)
+> before upgrading across a line boundary.** 1.6.x is the last line that
+> supports an OpenCode 1.X host; 1.7+ is breaking-change territory targeting
+> OpenCode 2. Within the 1.6 line, `update` is the supported path.
+
 One command keeps an existing installation current:
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pantheon-opencode",
-  "version": "1.6.0-beta.5",
+  "version": "1.6.0-beta.6",
   "description": "Multi-agent orchestration for OpenCode — 14 specialized agents, TDD, Themis review gates.",
   "type": "module",
   "workspaces": [
@@ -41,12 +41,12 @@
     "hooks:install": "pre-commit install",
     "hooks:update": "pre-commit autoupdate",
     "test:security": "npm run secret-scan",
-    "test:node": "node --test tests/*.mjs tests/pantheon/*.mjs",
-    "coverage": "echo 'Node coverage (report-only, NO threshold is enforced).' && echo 'Covers: the .mjs/.js modules under scripts/, src/ and bin/ that test:node exercises.' && echo 'Does NOT cover: test:ts (hand-rolled tsx loop, no node --test runner) and test:ci (pytest).' && echo '             TypeScript under src/ (41 files) is therefore entirely unmeasured here.' && echo '' && node --test --experimental-test-coverage --test-coverage-include='scripts/**/*.mjs' --test-coverage-include='src/**/*.mjs' --test-coverage-include='src/**/*.js' --test-coverage-include='bin/**/*.mjs' tests/*.mjs tests/pantheon/*.mjs",
+    "test:node": "node scripts/run-node-tests.mjs --label 'test:node' 'tests/*.mjs' 'tests/pantheon/*.mjs'",
+    "coverage": "echo 'Node coverage (report-only, NO threshold is enforced).' && echo 'Covers: the .mjs/.js modules under scripts/, src/ and bin/ that test:node exercises.' && echo 'Does NOT cover: test:ts (hand-rolled tsx loop, no node --test runner) and test:ci (pytest).' && echo '             TypeScript under src/ (41 files) is therefore entirely unmeasured here.' && echo '' && node scripts/run-node-tests.mjs --label 'coverage' -- --experimental-test-coverage --test-coverage-include='scripts/**/*.mjs' --test-coverage-include='src/**/*.mjs' --test-coverage-include='src/**/*.js' --test-coverage-include='bin/**/*.mjs' 'tests/*.mjs' 'tests/pantheon/*.mjs'",
     "coverage:plugin-v2": "node scripts/check-plugin-v2-coverage.mjs",
     "test:ts": "for f in tests/pantheon/*.test.ts; do if [ \"$f\" = tests/pantheon/plugin-v2-contract.test.ts ]; then NODE_OPTIONS=--conditions=import tsx \"$f\"; else tsx \"$f\"; fi || exit 1; done",
-    "test:hooks": "node --test tests/pantheon/plugin-v2-hook-canary.test.mjs",
-    "test:tool-canary": "node --test tests/canary/plugin-v2-tool-canary.test.mjs",
+    "test:hooks": "node scripts/run-node-tests.mjs --label 'test:hooks' 'tests/pantheon/plugin-v2-hook-canary.test.mjs'",
+    "test:tool-canary": "node scripts/run-node-tests.mjs --label 'test:tool-canary' 'tests/canary/plugin-v2-tool-canary.test.mjs'",
     "test:all": "npm run test:ci && npm run test:node && npm run test:ts",
     "test": "npm run test:all",
     "test:ci": "python3 -m pytest -q --tb=short 2>&1"

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pantheon",
   "publisher": "ils15",
-  "version": "1.6.0-beta.5",
+  "version": "1.6.0-beta.6",
   "displayName": "Pantheon",
   "description": "Conductor-Delegate orchestration platform with 14 specialized agents, 21 skills, and OpenCode support.",
   "agents": "./src/agents",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.backends._legacy:_Backend"
 
 [project]
 name = "pantheon"
-version = "1.6.0-beta.5"
+version = "1.6.0-beta.6"
 description = "Multi-agent orchestration framework"
 requires-python = ">=3.11"
 dependencies = []

package/scripts/run-node-tests.mjs

@@ -0,0 +1,189 @@
+#!/usr/bin/env node
+/**
+ * Run `node --test` over an explicit file list, and FAIL when zero tests are collected.
+ *
+ * Why this exists: `node --test <glob>` exits 0 when the glob matches nothing (Node >= 22).
+ * A test script whose file set is absent from the checkout -- or absent from the published
+ * package, because the `files` allow-list omits it -- therefore reports success while
+ * collecting nothing. That is the worst possible failure mode for a release gate: it
+ * manufactures confidence.
+ *
+ * This runner closes that hole from two independent sides:
+ *   1. It expands the globs ITSELF and refuses to start the runner with zero files, so the
+ *      runner is never handed an unexpanded pattern that silently matches nothing.
+ *   2. After a run that exited 0, it re-reads the collected count from the machine-readable
+ *      TAP summary and fails closed when that count is 0, unparseable, or missing.
+ *
+ * Side 2 is deliberately independent of side 1: a future Node change to `--test` glob
+ * handling, a glob that expands to a directory of empty files, or an emptied test file all
+ * still get caught.
+ *
+ * Human-readable output is unchanged: the default `spec` reporter still goes to stdout, and
+ * the TAP reporter is diverted to a scratch file that is read once and deleted.
+ *
+ * Usage:
+ *   node scripts/run-node-tests.mjs [--label <name>] [-- <node flags...>] <glob>...
+ *
+ * Examples:
+ *   node scripts/run-node-tests.mjs 'tests/*.mjs' 'tests/pantheon/*.mjs'
+ *   node scripts/run-node-tests.mjs -- --experimental-test-coverage 'tests/*.mjs'
+ */
+import { spawnSync } from 'node:child_process'
+import { globSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = join(fileURLToPath(new URL('.', import.meta.url)), '..')
+
+function usage(message) {
+  console.error(`zero-test-guard: ${message}`)
+  console.error(
+    'usage: node scripts/run-node-tests.mjs [--label <name>] [-- <node flags...>] <glob>...',
+  )
+  process.exit(1)
+}
+
+/** Parse `[--label <name>] [-- <node flags...>] <glob>...`. */
+function parseArgs(argv) {
+  const separator = argv.indexOf('--')
+  const own = separator === -1 ? argv : argv.slice(0, separator)
+  const nodeFlags = separator === -1 ? [] : argv.slice(separator + 1)
+
+  let label = 'node tests'
+  const globs = []
+  for (let i = 0; i < own.length; i++) {
+    if (own[i] === '--label') {
+      const value = own[i + 1]
+      if (value === undefined) usage('--label requires a value')
+      label = value
+      i += 1
+      continue
+    }
+    if (own[i].startsWith('-')) usage(`unknown option ${own[i]}`)
+    globs.push(own[i])
+  }
+  if (globs.length === 0) usage('at least one glob is required')
+  return { label, globs, nodeFlags }
+}
+
+/**
+ * Expand globs to a deduped, ordered file list.
+ * Order follows the positional order of the globs so that the suite runs in the same order
+ * as the shell used to; within a glob, matches are sorted for determinism.
+ */
+function expand(globs) {
+  const files = []
+  const seen = new Set()
+  for (const pattern of globs) {
+    const matches = globSync(pattern, { cwd: ROOT })
+      .filter((match) => !match.includes('node_modules') && !match.includes('__pycache__'))
+      .sort()
+    for (const match of matches) {
+      if (seen.has(match)) continue
+      seen.add(match)
+      files.push(match)
+    }
+  }
+  return files
+}
+
+function reportMissingFiles(label, globs) {
+  console.error(`zero-test-guard: ${label} matched 0 test files — refusing to report success.`)
+  console.error(`  globs: ${globs.join(' ')}`)
+  console.error('  This is the "test suite silently passes when it collects nothing" failure.')
+  console.error('  Either the test files are missing from this checkout, or they are missing')
+  console.error('  from the published package (check the "files" allow-list in package.json).')
+}
+
+function reportZeroCollected(label, files) {
+  console.error(`zero-test-guard: ${label} collected 0 tests — refusing to report success.`)
+  console.error(`  ${files.length} file(s) matched, but not one test case was collected:`)
+  for (const file of files) console.error(`    ${file}`)
+}
+
+/**
+ * Count the real test cases collected in a TAP summary.
+ *
+ * Node counts a test FILE that declares no test cases as one passing "test"
+ * (`ok 1 - tests/foo.test.mjs`), so the summary's `# tests N` is >= the file count and
+ * can never reach 0 once any file matched. Relying on it alone would let a suite whose
+ * every test file was emptied out report success.
+ *
+ * The reliable discriminator is the subtest NAME: a file-level placeholder is named with
+ * the file path that was passed to the runner, a real test case is named with its test
+ * name. So a top-level subtest whose name is one of our matched paths is a placeholder
+ * and is not counted as a collected case.
+ *
+ * Returns null when the summary cannot be read or parsed -- the caller fails closed.
+ */
+function countCollectedTests(tapPath, files) {
+  let tap = ''
+  try {
+    tap = readFileSync(tapPath, 'utf8')
+  } catch {
+    return null
+  }
+  // The summary count is still asserted to exist: without it the stream is not TAP.
+  if (!/^#\s*tests\s+\d+\s*$/m.test(tap)) return null
+
+  const placeholders = new Set(files)
+  let collected = 0
+  for (const match of tap.matchAll(/^# Subtest: (.+)$/gm)) {
+    if (placeholders.has(match[1].trim())) continue
+    collected += 1
+  }
+  return collected
+}
+
+const { label, globs, nodeFlags } = parseArgs(process.argv.slice(2))
+const files = expand(globs)
+
+if (files.length === 0) {
+  reportMissingFiles(label, globs)
+  process.exit(1)
+}
+
+const scratch = mkdtempSync(join(tmpdir(), 'pantheon-node-tests-'))
+const tapPath = join(scratch, 'summary.tap')
+
+try {
+  const run = spawnSync(
+    process.execPath,
+    [
+      '--test',
+      '--test-reporter=spec',
+      '--test-reporter-destination=stdout',
+      '--test-reporter=tap',
+      `--test-reporter-destination=${tapPath}`,
+      ...nodeFlags,
+      ...files,
+    ],
+    { cwd: ROOT, stdio: 'inherit' },
+  )
+
+  if (run.error) {
+    console.error(`zero-test-guard: could not start the test runner: ${run.error.message}`)
+    process.exit(1)
+  }
+  if (run.signal) {
+    console.error(`zero-test-guard: the test runner was killed by ${run.signal}`)
+    process.exit(1)
+  }
+  // Real failures keep the runner's own exit code; the guard only speaks up when the
+  // runner claimed success it cannot justify.
+  if (run.status !== 0) process.exit(run.status)
+
+  const collected = countCollectedTests(tapPath, files)
+  if (collected === null) {
+    console.error('zero-test-guard: could not read the collected test count from the TAP summary.')
+    console.error('  Failing closed: an unreadable summary cannot certify that any test ran.')
+    process.exit(1)
+  }
+  if (collected === 0) {
+    reportZeroCollected(label, files)
+    process.exit(1)
+  }
+} finally {
+  rmSync(scratch, { recursive: true, force: true })
+}

package/skills-lock.json

@@ -1,7 +1,7 @@
 {
   "src/skills/agent-coordination/SKILL.md": "cfd040ef29e3dd0fd5e0e67773874facf7c06e3284898afe1fddba4456c3f1aa",
   "src/skills/artifact-management/SKILL.md": "c60e493666bedf46e9113d0dd20106489d5c5a73905e1370fcfc1c0d71c59185",
-  "src/skills/auto-continue/SKILL.md": "4fe256d44ee9828d622a0d8b63cfc6bb39a317189a9ccf19494a6efd4527a7a9",
+  "src/skills/auto-continue/SKILL.md": "a7a4ec7ab35970bec36bcc286b95881b43a75e3bcdb626a17ebb9e397dd1a708",
   "src/skills/clonedeps/SKILL.md": "3e0b43cf96da98c83699dc48db3fd58fbfda84b9022bb70d3747875c81c3e124",
   "src/skills/code-review-checklist/SKILL.md": "0e59367c65ef4608db80a0674279f32cfc3f67dca7236f233b61a47fe506579f",
   "src/skills/codemap/SKILL.md": "87af5271e1576e154cadff313eab16264b726e43d094520736b7a5b03b409a4a",

package/src/agents/aphrodite.md

@@ -122,7 +122,7 @@ Frontend: `tdd-with-agents`, `visual-review-pipeline`, `incremental-implementati
 
 
 ## Session Context Retrieval
-When dispatched by Zeus, call context_get(slug, "latest", session_id=SESSION_ID)
+When dispatched by Zeus, call context_get(slug=slug, key="latest", session_id=SESSION_ID)
 if session_slug is provided in dispatch metadata. Apply any "remaining_tasks",
 "current_phase", or "gotchas" from the retrieved context.
 If context_get returns None, proceed fresh (first phase or expired session).

package/src/agents/athena.md

@@ -15,6 +15,7 @@ skills:
   - memory-bank
 permission:
   edit: deny
+  hashline_edit: deny
   bash: deny
   read: allow
   grep: allow

package/src/agents/demeter.md

@@ -111,7 +111,7 @@ Compress working context with the `context-compression` skill (L1, Pantheon-nati
 
 
 ## Session Context Retrieval
-When dispatched by Zeus, call context_get(slug, "latest", session_id=SESSION_ID)
+When dispatched by Zeus, call context_get(slug=slug, key="latest", session_id=SESSION_ID)
 if session_slug is provided in dispatch metadata. Apply any "remaining_tasks",
 "current_phase", or "gotchas" from the retrieved context.
 If context_get returns None, proceed fresh (first phase or expired session).

package/src/agents/hephaestus.md

@@ -64,7 +64,7 @@ Compress working context with the `context-compression` skill (L1, Pantheon-nati
 
 
 ## Session Context Retrieval
-When dispatched by Zeus, call context_get(slug, "latest", session_id=SESSION_ID)
+When dispatched by Zeus, call context_get(slug=slug, key="latest", session_id=SESSION_ID)
 if session_slug is provided in dispatch metadata. Apply any "remaining_tasks",
 "current_phase", or "gotchas" from the retrieved context.
 If context_get returns None, proceed fresh (first phase or expired session).

package/src/agents/hermes.md

@@ -270,7 +270,7 @@ Implementação: `tdd-with-agents`, `incremental-implementation`, `code-review-c
 
 
 ## Session Context Retrieval
-When dispatched by Zeus, call context_get(slug, "latest", session_id=SESSION_ID)
+When dispatched by Zeus, call context_get(slug=slug, key="latest", session_id=SESSION_ID)
 if session_slug is provided in dispatch metadata. Apply any "remaining_tasks",
 "current_phase", or "gotchas" from the retrieved context.
 If context_get returns None, proceed fresh (first phase or expired session).

package/src/agents/iris.md

@@ -11,6 +11,7 @@ permission:
     gh *: allow
   webfetch: allow
   edit: deny
+  hashline_edit: deny
   task:
     "*": deny
 temperature: 0.2

package/src/agents/nyx.md

@@ -9,6 +9,7 @@ permission:
   bash: allow
   webfetch: allow
   edit: deny
+  hashline_edit: deny
   task:
     "*": deny
 temperature: 0.1

package/src/agents/themis.md

@@ -8,6 +8,7 @@ permission:
   grep: allow
   bash: allow
   edit: deny
+  hashline_edit: deny
   task:
     "*": deny
 temperature: 0.1

package/src/agents/zeus.md

@@ -5,6 +5,7 @@ reasoning_effort: medium
 permission:
   read: allow
   edit: deny
+  hashline_edit: deny
   bash: deny
   task:
     "*": allow
@@ -32,7 +33,7 @@ skills:
 ## Memory Protocol
 
 **Auto-Store:** Ao receber subtask_summary, chame `memory_store()` com summary/files_changed/tests/status. Sempre.
-**Pre-work:** `memory_search("<feature>", top_k=3)` antes de planejar qualquer coisa.
+**Pre-work:** `memory_search(query="<feature>", top_k=3)` antes de planejar qualquer coisa.
 
 ## Golden Rule
 
@@ -79,7 +80,7 @@ O fluxo é SEMPRE: **Planejar → Especificar → Delegar → Revisar**. Zeus nu
 Antes de usar a arvore de roteamento, consulte o memory:
 
 ```
-memory_search(task_prompt, top_k=2)
+memory_search(query=task_prompt, top_k=2)
   → score > 0.85?
     SIM → usa resultado cacheado (agent, background, pattern)
     NAO → aplica arvore de roteamento + memory_store() pra proxima vez
@@ -90,8 +91,8 @@ memory_search(task_prompt, top_k=2)
 Para padroes de delegacao recorrentes, grave no KV:
 
 ```
-kv_store("delegation:<pattern>", "{agent: ..., background: true/false}")
-kv_get("delegation:<pattern>") → reusa decisao sem memory_search
+kv_store(namespace="deleg", key="delegation:<pattern>", value="{agent: ..., background: true/false}")
+kv_get(namespace="deleg", key="delegation:<pattern>") → reusa decisao sem memory_search
 ```
 
 ### Telemetria de delegacao (Nyx P1-3)
@@ -186,12 +187,12 @@ Wave announcement obrigatorio.
 Limite maximo de 2 niveis de nesting: Zeus -> subagente -> sub-subagente.
 
 ```
-depth = kv_get("deleg:depth") ?? 0
+depth = kv_get(namespace="deleg", key="deleg:depth") ?? 0
 if depth >= 2 → NAO delegar, ESCALAR para o usuario
-else → kv_store("deleg:depth", depth + 1)
+else → kv_store(namespace="deleg", key="deleg:depth", value=String(depth + 1))
 
 Quando subagente retornar:
-  kv_store("deleg:depth", max(0, depth - 1))
+  kv_store(namespace="deleg", key="deleg:depth", value=String(max(0, depth - 1)))
 ```
 
 Zeus (nivel 0) -> Apollo/Hermes (nivel 1) -> sub-subagente (nivel 2 max).
@@ -220,7 +221,7 @@ Quando um subagente RECUSA ou retorna "escopo fora do meu dominio" (ex: edit: de
 
 - **Causa provavel:** agente errado selecionado no roteamento (match por palavra-chave, nao por capacidade).
 - **ACAO:** RE-ROTEAR imediatamente para o agente correto — NAO retry com prompt reformulado.
-- Registre o caso no cache de delegacao (`kv_store("deleg:<pattern>", ...)` para aprendizado futuro).
+- Registre o caso no cache de delegacao (`kv_store(namespace="deleg", key="deleg:<pattern>", value=...)` para aprendizado futuro).
 - Recusa legitima do agente = comportamento correto do guard; o defeito esta na selecao (zeus), nao no agente.
 
 ## TODO Enforcer (Auto-Retry)
@@ -237,7 +238,7 @@ Apos task_status(wait=true), verifique:
     "reviewer-only", "fora do meu dominio", ou similar negativa de dominio)?
       SIM → NAO retry com prompt rephrased.
             RE-ROTEAR para o agente correto (ver "Taxonomia de Recusa (P0-3)").
-            Registre o caso: kv_store("deleg:<pattern>", "{agente_correto, ...}").
+            Registre o caso: kv_store(namespace="deleg", key="deleg:<pattern>", value="{agente_correto, ...}").
 
     FALHA REAL (timeout, crash, resposta vazia, context exceeded)?
       SIM → retry 1x com prompt rephrased (diferente, mais especifico)

package/src/instructions/memory-protocol.instructions.md

@@ -54,7 +54,7 @@ Each agent file defines overrides in its `## 🧠 Memory Protocol` section:
 
 Para otimizar decisoes de delegacao e reduzir gasto de tokens:
 
-1. **memory_search(task_prompt, top_k=2)** antes de aplicar a arvore de roteamento
+1. **memory_search(query=task_prompt, top_k=2)** antes de aplicar a arvore de roteamento
 2. Se score > 0.85 → reutiliza agente + background_mode do cache
 3. Se score ≤ 0.85 → aplica regras estaticas e memory_store() com:
    - key: deleg:<task_type>
@@ -67,8 +67,8 @@ Para otimizar decisoes de delegacao e reduzir gasto de tokens:
    as a string (got object). json.dumps it first. Example: metadata='{"type":
    "decision", "score": 0.9}'`.
 
-4. **kv_store("deleg:<pattern>", ...)** para padroes recorrentes de delegacao
-5. **kv_get("deleg:<pattern>")** para reusar decisoes ja tomadas
+4. **kv_store(namespace="deleg", key="deleg:<pattern>", value=...)** para padroes recorrentes de delegacao
+5. **kv_get(namespace="deleg", key="deleg:<pattern>")** para reusar decisoes ja tomadas
 
 Isso elimina ~300 tokens de reasoning por delegacao quando o cache acerta.
 
@@ -82,7 +82,7 @@ After every `/pantheon` council synthesis completes, Zeus stores:
 memory_store({
   namespace: "council_decisions",
   key: "council:<yyyy-mm-dd>:<slug>",
-  value: {
+  value: JSON.stringify({
     question: "original question",
     specialists: ["@agent1", "@agent2"],
     recommendation: "final recommendation",
@@ -93,7 +93,7 @@ memory_store({
     themis_audit: "approved|issues",
     precedent_used: false,
     timestamp: "<ISO-8601>"
-  },
+  }),
   metadata: JSON.stringify({
     type: "council_decision",
     specialist_count: N,
@@ -111,7 +111,7 @@ encoded as a string (got object). json.dumps it first. Example: metadata='{"type
 ### Read Path (Precedent Fast-Path)
 Before dispatching a new council, Zeus runs:
 ```
-memory_search(question, top_k=2, namespace="council_decisions")
+memory_search(query=question, top_k=2, namespace="council_decisions")
 ```
 
 Result interpretation:

package/src/instructions/zeus-anti-stall.instructions.md

@@ -56,16 +56,16 @@ All session state lives in **pantheon-persistence** (namespace `checkpoint:<slug
 No file I/O, no checkpoint_session.py — TTL (4h) handles cleanup automatically.
 
 ### Heartbeat Check
-- If `context_get(slug, "heartbeat")` returns a checkin older than 300s, log a stall warning and resume
+- If `context_get(slug=slug, key="heartbeat", session_id=SESSION_ID)` returns a checkin older than 300s, log a stall warning and resume
 - Write heartbeat after every anti-stall recovery action:
   ```
-  context_save(slug, "heartbeat", json({"status": "alive", "last_action": "...", "turn_count": N}))
+  context_save(slug=slug, key="heartbeat", content=JSON.stringify({"status": "alive", "last_action": "...", "turn_count": N}), session_id=SESSION_ID)
   ```
 
 ### Checkpoint Auto-Save (Pré-Compactação)
 Before ANY delegate dispatch, save a checkpoint:
 ```
-context_save(slug, "phase:N", json({
+context_save(slug=slug, key="phase:N", content=JSON.stringify({
   "phase": {"current": N, "total": M, "name": "..."},
   "turn_count": N, "agent": "...", "summary": "..."
 }), session_id=SESSION_ID)
@@ -86,15 +86,15 @@ o Zeus DEVE salvar o estado atual:
 2. Salve heartbeat + phase atual + tarefas pendentes
 3. Só então permita que a compactação prossiga
 ```
-# Ao iniciar sessão:
-result = context_save(slug, "init", session_state)
+# Ao iniciar sessão (session_id é REQUIRED — use o id da sessão corrente):
+result = context_save(slug=slug, key="init", content=JSON.stringify(session_state), session_id=SESSION_ID)
 SESSION_ID = result.session_id   # ← guarde para toda a sessão
 
 # Antes de CADA delegação:
-context_save(slug, f"pre:{agent}", current_state, session_id=SESSION_ID)
+context_save(slug=slug, key=f"pre:{agent}", content=JSON.stringify(current_state), session_id=SESSION_ID)
 
 # Após retorno do agente:
-context_save(slug, f"post:{agent}", result_state, session_id=SESSION_ID)
+context_save(slug=slug, key=f"post:{agent}", content=JSON.stringify(result_state), session_id=SESSION_ID)
 ```
 Isso garante que o estado sobreviva à compactação — o "latest" pointer
 sempre aponta para o checkpoint mais recente, mesmo após compactação.
@@ -103,9 +103,9 @@ sempre aponta para o checkpoint mais recente, mesmo após compactação.
 ### Context Retrieval
 Next-phase agents retrieve previous context via:
 ```
-context_get(slug, "latest")        # most recent checkpoint
-context_get(slug, "phase:3")      # specific phase
-context_list(slug)                 # all checkpoints
+context_get(slug=slug, session_id=SESSION_ID)                    # most recent checkpoint ("latest" is the default key)
+context_get(slug=slug, key="phase:3", session_id=SESSION_ID)     # specific phase
+context_list(slug=slug, session_id=SESSION_ID)                   # all checkpoints
 ```
 
 ### Long-Session Progress

package/src/instructions/zeus-council-synthesis.instructions.md

@@ -36,7 +36,7 @@ sequenceDiagram
     participant T as Themis (Audit + Moderator)
 
     U->>Z: /pantheon [--research] question
-    Z->>M: memory_search(council_decisions)
+    Z->>M: memory_search(query, namespace="council_decisions")
     alt Precedent found (score > 0.85)
         M-->>Z: ⚠️ Cached decision
         Z->>U: Fast-path precedent
@@ -85,7 +85,7 @@ sequenceDiagram
 ## Dispatch Sequence (9-Step Protocol)
 
 ### Step 0 — Precedent Fast-Path (Fase 1)
-Run the precedent read path defined in `## Memory Protocol > Council Decisions Namespace` (`memory_search(query, top_k=2, namespace="council_decisions")`). If no precedent applies, proceed to Step 0b.
+Run the precedent read path defined in `## Memory Protocol > Council Decisions Namespace` (`memory_search(query=question, top_k=2, namespace="council_decisions")`). If no precedent applies, proceed to Step 0b.
 
 ### Step 0b — Apollo Pre-Scan (Fase 2, --research flag)
 If `/pantheon --research <question>`: dispatch @apollo with 30s timeout. Inject findings as `shared_context` into ALL specialist prompts. Skip if flag absent.

package/src/plugins/tui/dist/tui.js

@@ -167,7 +167,7 @@ async function detectVersion(api) {
 			if (ver) return ver;
 		}
 	} catch {}
-	return "1.6.0-beta.5";
+	return "1.6.0-beta.6";
 }
 /**
 * usage-bar — AI subscription usage gauge for the opencode TUI.

package/src/plugins/tui/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pantheon-tui",
-  "version": "1.6.0-beta.5",
+  "version": "1.6.0-beta.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pantheon-tui",
-      "version": "1.6.0-beta.5",
+      "version": "1.6.0-beta.6",
       "license": "MIT",
       "dependencies": {
         "@opencode-ai/plugin": "1.18.33",

package/src/plugins/tui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pantheon-tui",
   "type": "module",
-  "version": "1.6.0-beta.5",
+  "version": "1.6.0-beta.6",
   "description": "Pantheon TUI plugin — sidebar (version, preset, sessions, real-time delegations) + AI subscription usage gauges incl. OpenCode Go/Zen dollar limits (vendored, MIT)",
   "license": "MIT",
   "engines": {

package/src/skills/auto-continue/SKILL.md

@@ -163,19 +163,19 @@ Should I now run the migration tests? [waiting]
 Session state is **not** file-based. It lives in **pantheon-persistence** under the
 `checkpoint:<slug>` namespace and is cleaned up automatically by a 4h TTL.
 
-Write state with `context_save(slug, key, value, session_id=...)` and read it back with
-`context_get(slug, "latest", session_id=...)`. Capture `session_id` from the first `context_save`
+Write state with `context_save(slug=slug, key=key, content=JSON.stringify(state), session_id=...)` and read it back with
+`context_get(slug=slug, key="latest", session_id=...)`. Capture `session_id` from the first `context_save`
 of the session and reuse it for the rest of the session, so the `latest` pointer survives
 compaction.
 
 ### Heartbeat Check
-- If `context_get(slug, "heartbeat")` returns a checkin older than 300s, log a stall warning and resume
+- If `context_get(slug=slug, key="heartbeat", session_id=...)` returns a checkin older than 300s, log a stall warning and resume
 - Write a heartbeat after every anti-stall recovery action
 
 ### Checkpoint Rules
 1. Save a checkpoint before **every** delegate dispatch and after every agent returns
 2. Include current phase, turn count, and remaining tasks
-3. On resume: `context_get(slug, "latest")` restores the most recent checkpoint
+3. On resume: `context_get(slug=slug, key="latest", session_id=...)` restores the most recent checkpoint
 
 > Do not create `heartbeat.json`, `checkpoint-<N>.json`, or `session.json` under
 > `.pantheon/deepwork/`. That file-based mechanism is retired — TTL handles cleanup, and reading