pantheon-opencode 1.6.0-beta.5 → 1.6.0-beta.7

package/src/plugin-v2.ts

@@ -12,15 +12,15 @@
  *   session, and the shared `createEnforcementGuard` throws to deny
  *   `hashline_edit` / `pantheon_model` / `edit` / `write` / `bash` / `task`.
  *   See `registerV2ToolHooks`.
- * - The SAME `execute.before` hook runs scripts/hooks/scan-secrets.sh over the
- *   tool input and throws on exit 2 (high-confidence token match). This is the
+ * - The SAME `execute.before` hook scans serialized tool input in-process and
+ *   throws on a high-confidence token match. This is the
  *   ONLY hard security block on the V2 surface. It is wired HERE, not delegated
  *   to `src/plugins/pantheon-hooks.ts`: opencode.json declares only
  *   `src/plugin-v2` in `plugins`, so the V1 plugin never loads on a V2-only
  *   install and V1's identical block was inert by construction.
 
- * - A tool `execute.after` hook and a permission hook, registered as
- *   registration points with no V2-side behaviour
+ * - A tool `execute.after` hook and a permission hook, with permission
+ *   evaluation enforcing the caller/target matrix for Pantheon agents
  *
  * Every tool registered through `draft.add` MUST declare `output`, and its
  * `execute` MUST resolve to a value carrying `output`. The host enforces the
@@ -88,14 +88,22 @@ import {
   type ToolExecuteBeforeInput,
   type ToolExecuteBeforeOutput,
 } from './pantheon/delegation-enforce.ts'
+import { scanSecretPayload } from './pantheon/secret-scanner.ts'
 import {
   getV2BridgeFromContext,
   type PantheonV2Bridge,
   type V2ContextLike,
 } from './pantheon/v2-bridge.ts'
+import {
+  type AuthoritativeSession,
+  evaluateV2Delegation,
+  PANTHEON_AGENTS,
+  type V2PermissionEvent,
+  v2ResourceTarget,
+} from './pantheon/v2-delegation-enforce.ts'
+import { createV2ExecuteAfter, resolveV2SandboxConfig } from './pantheon/v2-execute-after.ts'
 import { createV2ToolDefinitions, type V2ToolResult } from './pantheon/v2-tools.ts'
 import { V2_UNSUPPORTED_FEATURE_SEED } from './pantheon/v2-unsupported.mjs'
-import { type HookPayload, runHook } from './plugins/hook-runner.ts'
 
 // ─── Unsupported Features Registry ───────────────────────────────────────
 
@@ -220,12 +228,15 @@ interface V2EventDomain {
 /**
  * The minimal shape of `ctx.permission`.
  *
- * Only a hook name and a handler: the plugin registers `evaluate` as a
- * registration point and deliberately runs no V2-side permission logic, so no
- * richer payload type is claimed here.
+ * The V2.0.25 live contract supplies an `evaluate` event with `resources`;
+ * runtime validation remains defensive because SDK declarations omit this
+ * domain and the host may evolve independently.
  */
 interface V2PermissionDomain {
-  hook?: (name: string, handler: (event: unknown) => void | Promise<void>) => Promise<unknown>
+  hook?: (
+    name: string,
+    handler: (event: unknown, output?: unknown) => void | Promise<void>,
+  ) => Promise<unknown>
 }
 
 /**
@@ -237,6 +248,7 @@ interface V2PermissionDomain {
  */
 interface V2SessionDomain {
   hook?: (name: string, handler: (event: unknown) => void | Promise<void>) => Promise<unknown>
+  get?: (sessionID: string) => Promise<unknown>
 }
 
 /** `PluginContext` plus the four domains 1.18.x omits. See the module header. */
@@ -719,15 +731,12 @@ async function registerV2SessionHooks(context: PluginContext): Promise<boolean>
 // ─── V2 Secret Scan ─────────────────────────────────────────────────────
 
 /**
- * High-confidence secret token formats — MIRRORS `SECRET_MASK_RE` in
- * src/plugins/pantheon-hooks.ts (V1) and `HIGH_CONFIDENCE_PATTERNS` in
- * scripts/hooks/scan-secrets.sh.
+ * High-confidence secret token formats used to redact unrelated runtime logs.
+ * Detection itself is shared with V1 in `pantheon/secret-scanner.ts`.
  *
- * Duplicated rather than imported because the V1 module is a separate plugin
- * that is NOT loaded on a V2-only install (see the module header), and pulling
- * it in for one regex would resurrect exactly the V1-hook coupling V2 exists to
- * remove. The drift risk is real and is asserted by a test in
- * tests/pantheon/plugin-v2-contract.test.ts.
+ * This separate log-redaction expression is not the runtime detector. It is
+ * kept local because it masks arbitrary log strings, while the shared scanner
+ * returns masked findings and never returns raw payload content.
  *
  * Applied to every log line this module writes, so a hook trail can never
  * contain a raw credential. Header/KEY names (the Bifrost header alone,
@@ -742,7 +751,7 @@ function maskSecret(text: string): string {
 }
 
 /**
- * Message thrown when scan-secrets.sh exits 2 (a high-confidence token match).
+ * Message thrown when a high-confidence token match is detected.
  *
  * This is the only deliberate throw on the V2 surface. opencode's
  * Plugin.trigger has no catch around hook invocations, so the rejection
@@ -760,6 +769,91 @@ function maskSecret(text: string): string {
 const SECRET_BLOCK_MESSAGE =
   '[plugin-v2] Blocked: high-confidence secret detected in tool input — see .pantheon/logs/hooks.log'
 
+/**
+ * Message thrown when the scanner cannot validate or serialize the tool input.
+ * Invalid scanner input is a deliberate fail-CLOSED denial.
+ *
+ * English and user-facing, like {@link SECRET_BLOCK_MESSAGE}. It carries no
+ * scanner output on purpose: a scan that failed mid-flight may still be holding
+ * the raw payload, and the denial must not become the leak it exists to prevent.
+ */
+const SECRET_SCAN_UNAVAILABLE_MESSAGE =
+  '[plugin-v2] Blocked: the secret scanner could not complete, so this tool call was denied (fail-closed) — see .pantheon/logs/hooks.log'
+
+const SECRET_SCAN_MARKER = '[SECRET SCAN]'
+
+type SecretScanPayload = {
+  tool_name?: string
+  tool_input?: unknown
+  agent_id?: string
+  session_id?: string
+}
+
+type SecretScanHookResult = {
+  code: number
+  stdout: string
+  stderr: string
+  signal: NodeJS.Signals | null
+  timedOut: boolean
+}
+
+type SecretScanFailureReason = 'scanner-malformed-output' | 'scanner-unexpected-exit'
+
+type SecretScanDecision =
+  | { action: 'allow' }
+  | { action: 'advisory' }
+  | { action: 'block' }
+  | { action: 'fail-closed'; reason: SecretScanFailureReason }
+
+function evaluateSecretScanResult(scan: SecretScanHookResult): SecretScanDecision {
+  if (scan.timedOut || scan.signal !== null) {
+    return { action: 'fail-closed', reason: 'scanner-unexpected-exit' }
+  }
+  if (!Number.isInteger(scan.code)) {
+    return { action: 'fail-closed', reason: 'scanner-malformed-output' }
+  }
+  if (scan.code === 0) return { action: 'allow' }
+  if (scan.code === 2) return { action: 'block' }
+  if (scan.code === 1) {
+    return scan.stderr.includes(SECRET_SCAN_MARKER)
+      ? { action: 'advisory' }
+      : { action: 'fail-closed', reason: 'scanner-malformed-output' }
+  }
+  return { action: 'fail-closed', reason: 'scanner-unexpected-exit' }
+}
+
+/** Convert the pure scanner result into the existing fail-closed verdict shape. */
+async function scanSecretInProcess(payload: SecretScanPayload): Promise<SecretScanHookResult> {
+  const result = scanSecretPayload(payload)
+  const reports =
+    result.status === 'block' || result.status === 'advisory'
+      ? result.findings.map(
+          (finding) =>
+            `[SECRET SCAN] ${finding.confidence}-confidence match: ${finding.masked} (pattern: ${finding.pattern})`,
+        )
+      : []
+  const code = result.status === 'clean' ? 0 : result.status === 'block' ? 2 : 1
+  const stderr =
+    result.status === 'invalid'
+      ? 'scanner input validation failed'
+      : result.status === 'block'
+        ? `${reports.join('\n')}\n[SECRET SCAN] High-confidence hardcoded secret detected. Tool call will be BLOCKED.`
+        : result.status === 'advisory'
+          ? `${reports.join('\n')}\n[SECRET SCAN] Possible secret detected. Remove it and use environment variables or a vault.`
+          : ''
+  return { code, stdout: '', stderr, signal: null, timedOut: false }
+}
+
+let secretScanRunner: (payload: SecretScanPayload) => Promise<SecretScanHookResult> =
+  scanSecretInProcess
+
+/** Test-only seam for exercising malformed scanner verdicts without a host. */
+export function setV2SecretScanRunnerForTests(
+  runner: ((payload: SecretScanPayload) => Promise<SecretScanHookResult>) | null,
+): void {
+  secretScanRunner = runner ?? scanSecretInProcess
+}
+
 /**
  * Append one masked, ISO-stamped line to .pantheon/logs/hooks.log under the
  * working directory, and return whether it landed.
@@ -831,41 +925,11 @@ interface V2ToolExecuteBeforeEvent {
  * tool — `hashline_edit` and `pantheon_model` are denied here for exactly the
  * reason they are denied in V1.
  *
- * Deliberately NOT passed `getSessionAgent` / `isRootSession` / `isChildSession`.
- * There are TWO distinct reasons, and conflating them is what produced a wrong
- * causal chain here once already — keep them apart:
- *
- * 1. MISSING `getSessionAgent` (wiring). This is what would deny every
- *    `task()` call. V2 learns the active agent from the `execute.before` event
- *    itself and keeps no session→agent map, so there is no lookup to hand the
- *    guard. The guard would call `isDelegationAllowed(undefined, target)`,
- *    which returns `false`, and throw "caller agent is unavailable" — for
- *    every caller, including Zeus. Note what is NOT happening: an unseeded
- *    `isRootSession` would *pass* the root gate (`isRoot` reports `true` for an
- *    unknown session), so the hierarchy is not what denies here.
- *
- * 2. UNWIRED HIERARCHY (design). `SessionHierarchyRegistry` is what gates
- *    exactly two things, and nothing else: the depth-2 child deny
- *    (`isChildSession`) and the root-session gate (`isRootSession`). Left
- *    unseeded, `isChild` is `false` for every session, so depth-2 would never
- *    fire on a genuine child — a hierarchy that cannot tell a child from a root
- *    is not a trustworthy input to either check.
- *
- *    "Unwired", not "impossible": the V2 `session.created` event carries
- *    `properties.info: Session` including `parentID?`, the same field V1 seeds
- *    from on the same event, so one line in `onSessionCreated` would seed live
- *    sessions (see its docstring). What has no V2 equivalent is V1's SECOND
- *    source, the `client.session.list()` startup seed — V2's `PluginContext`
- *    exposes no `client`. Whether a live 2.0.22 host populates `info.parentID`
- *    is UNVERIFIED; no canary reads an event payload. So the correct summary is
- *    "seeded for nothing", not "unseedable", and the guard's omission is right
- *    today for the weaker reason that nothing seeds it at all.
- *
- * Omitting all three skips the branch wholesale: the guard only enters it when
- * `options?.isRootSession !== undefined`. `task` is still denied inside a
- * read-only session via the blocked-tool list, so depth-2 holds for
- * apollo/gaia; the caller/target matrix itself is NOT enforced on V2. That is
- * a known gap, not a covered case.
+ * Caller/target delegation authorization is separate: V2's
+ * `permission.evaluate` hook resolves the authoritative caller from the host
+ * session and applies the matrix in `v2-delegation-enforce.ts`. Keeping the
+ * responsibilities separate avoids treating this mutating-tool deny list as
+ * the delegation policy.
  */
 const v2EnforcementGuard = createEnforcementGuard({
   getReadOnlySessions: () => readOnlyRegistry.sessionIDs(),
@@ -912,7 +976,9 @@ function adaptV2ExecuteBeforeEvent(event: unknown): {
  *   ctx.tool.hook("execute.before", handler) — pre-execution guard
  *   ctx.tool.hook("execute.after", handler)  — post-execution augment
  *
- * Returns true if any hooks were registered.
+ * Returns true only if the security-critical `execute.before` hook registered.
+ * The post-execution hook is optional and cannot make an unprotected tool
+ * surface ready.
  */
 async function registerV2ToolHooks(context: PluginContext): Promise<boolean> {
   const toolCtx = hostDomains(context).tool
@@ -921,8 +987,6 @@ async function registerV2ToolHooks(context: PluginContext): Promise<boolean> {
     return false
   }
 
-  let registered = false
-
   try {
     // "execute.before" — read-only enforcement. Throwing from this handler
     // DENIES the tool call and the host surfaces the message to the session,
@@ -945,61 +1009,70 @@ async function registerV2ToolHooks(context: PluginContext): Promise<boolean> {
       // propagating to the host, not be swallowed as a scanner failure.
       await v2EnforcementGuard(input, output)
 
-      // High-confidence secret scan (scripts/hooks/scan-secrets.sh). This is the
+      // In-process high-confidence secret scan. This is the
       // ONLY hard block on the V2 surface, and it exists here — rather than via
       // `src/plugins/pantheon-hooks.ts` — because that module is a separate
       // plugin that is never loaded on a V2-only install: opencode.json
-      // `plugins` declares only `src/plugin-v2`. V1's scan-secrets block was
-      // therefore inert by construction, not by misconfiguration.
+      // `plugins` declares only `src/plugin-v2`. Both V1 and V2 import the same
+      // scanner module so this remains active on either install surface.
       //
-      // exit 2 → block. exit 1 (low-confidence header/KEY names) → advisory,
-      // logged only. A scanner failure (missing script, timeout) is fail-OPEN:
-      // runHook never rejects, and an infrastructure error must not deny
-      // unrelated tool calls.
+      // Clean → allow. Low-confidence match → advisory. High-confidence match
+      // or malformed/non-serializable input → deny this tool call.
       let blockError: Error | null = null
       try {
-        const payload: HookPayload = {
+        const payload: SecretScanPayload = {
           tool_name: input.tool,
-          tool_input: output.args ?? {},
+          tool_input: output.args,
           agent_id: typeof agent === 'string' ? agent : '',
           session_id: input.sessionID,
         }
-        const scan = await runHook('scan-secrets.sh', payload)
-        if (scan.code === 2) {
+        const scan = await secretScanRunner(payload)
+        const decision = evaluateSecretScanResult(scan)
+        if (decision.action === 'block') {
           appendV2HookLog(SECRET_BLOCK_MESSAGE)
           appendV2HookLog(scan.stderr)
           blockError = new Error(SECRET_BLOCK_MESSAGE)
-        } else if (scan.code === 1) {
-          // Advisory: log only, never block.
+        } else if (decision.action === 'advisory') {
+          // The pure scanner reports masked matches only.
           appendV2HookLog(scan.stderr)
+        } else if (decision.action === 'fail-closed') {
+          // Never persist scanner output from an invalid verdict.
+          appendV2HookLog(`${SECRET_SCAN_UNAVAILABLE_MESSAGE} (${decision.reason})`)
+          blockError = new Error(SECRET_SCAN_UNAVAILABLE_MESSAGE)
         }
       } catch {
-        // Never let the scanner take down the session — runHook resolves a
-        // structured result instead of rejecting, so this is belt-and-braces.
+        // Keep the enforcement fail-closed if the scanner unexpectedly throws.
+        appendV2HookLog(SECRET_SCAN_UNAVAILABLE_MESSAGE)
+        blockError = new Error(SECRET_SCAN_UNAVAILABLE_MESSAGE)
       }
       if (blockError !== null) throw blockError
     })
-    registered = true
   } catch {
-    // Tool before-hook not supported
+    // Never proceed to Pantheon tool registration without this guard. The host
+    // may still expose its own built-in tools; this marker does not claim to
+    // block or scan native host tool paths.
+    return false
   }
 
   try {
-    // "execute.after" — hashline read enhance + context sandbox.
+    // "execute.after" — the V1 parity chain (task-result-guard →
+    // context-sandbox → read-enhancer) rebuilt on the V2 event shape.
     //
-    // Registration point only: there is no V2-side behaviour here. The
-    // enhancer/sandbox live in the V1 path (`pantheon-hooks.ts` +
-    // `context-sandbox.ts`), a separate plugin instance that is not loaded when
-    // only `plugin-v2` is configured.
-    await toolCtx.hook('execute.after', (_event: unknown) => {
-      // Intentionally empty.
+    // This IS behaviour, not a registration point: on a V2-only install the V1
+    // `pantheon-hooks` plugin is not loaded, so this handler is the only thing
+    // that truncates oversized output and tags `read` with hashline refs.
+    // The sandbox config comes from `ctx.options.context_sandbox` (the V2 copy
+    // the installer writes — V2.0.25 drops the V1 top-level key), resolved with
+    // the same resolver V1 uses.
+    const v2ExecuteAfter = createV2ExecuteAfter({
+      sandbox: resolveV2SandboxConfig(context.options),
     })
-    registered = true
+    await toolCtx.hook('execute.after', (event: unknown) => v2ExecuteAfter(event))
   } catch {
-    // Tool after-hook not supported
+    markUnsupported('tool-execute-after-hook')
   }
 
-  return registered
+  return true
 }
 
 // ─── V2 Permission Hook ─────────────────────────────────────────────────
@@ -1008,12 +1081,13 @@ async function registerV2ToolHooks(context: PluginContext): Promise<boolean> {
  * Register permission hook via V2 ctx.permission.hook.
  *
  * The V2 permission.hook API (when available) provides:
- *   ctx.permission.hook("evaluate", handler) — custom permission logic
+ *   ctx.permission.hook("evaluate", handler) — host permission evaluation
  *
  * Returns true if the hook was registered.
  */
 async function registerV2PermissionHook(context: PluginContext): Promise<boolean> {
-  const permCtx = hostDomains(context).permission
+  const domains = hostDomains(context)
+  const permCtx = domains.permission
 
   if (!permCtx?.hook) {
     markUnsupported('permission-hook')
@@ -1021,12 +1095,79 @@ async function registerV2PermissionHook(context: PluginContext): Promise<boolean
   }
 
   try {
-    await permCtx.hook('evaluate', (_event: unknown) => {
-      // Registration point only — no V2-side permission logic. Read-only
-      // enforcement does NOT run here: it runs in the `execute.before` handler
-      // above, which is the hook the host consults before a tool executes. Do
-      // not read this as "the V1 guards cover it": V1 is a different plugin
-      // instance and is not loaded when only `plugin-v2` is configured.
+    await permCtx.hook('evaluate', async (rawEvent: unknown, rawOutput?: unknown) => {
+      const event = rawEvent as V2PermissionEvent | null
+      const output =
+        rawOutput !== null && typeof rawOutput === 'object'
+          ? (rawOutput as { status?: unknown })
+          : undefined
+      const statusBefore = output?.status
+      const writeProof = (statusAfter: unknown): void => {
+        const proofPath = process.env.PANTHEON_HOOK_CANARY_PERMISSION_PROOF
+        if (!proofPath || !event || !Array.isArray(event.resources)) return
+        try {
+          appendFileSync(
+            proofPath,
+            `permission.evaluate ${JSON.stringify({
+              resources: event.resources,
+              agent: event.agent,
+              sessionID: event.sessionID,
+              effect: event.effect,
+              eventFields: ['resources', 'agent', 'sessionID', 'effect'].filter((key) =>
+                Object.hasOwn(event, key),
+              ),
+              outputPresent: output !== undefined,
+              statusBefore: statusBefore ?? null,
+              statusAfter: statusAfter ?? null,
+            })}\n`,
+          )
+        } catch {
+          // Instrumentation is best-effort and must not affect permission flow.
+        }
+      }
+      const deny = (): void => {
+        if (!output) {
+          writeProof(undefined)
+          throw new Error('permission output is unavailable; denying V2 permission evaluation')
+        }
+        output.status = 'deny'
+        writeProof(output.status)
+      }
+
+      if (output?.status === 'deny') {
+        writeProof(output.status)
+        return // explicit host deny is final
+      }
+      if (event == null || !Array.isArray(event.resources)) {
+        deny()
+        return
+      }
+      const targets = event.resources.map(v2ResourceTarget)
+      if (targets.some((target) => target === undefined)) {
+        deny()
+        return
+      }
+      const hasPantheonTarget = targets.some((target) => PANTHEON_AGENTS.has(target ?? ''))
+      let session: AuthoritativeSession | undefined
+      if (hasPantheonTarget) {
+        try {
+          const sessionID = typeof event.sessionID === 'string' ? event.sessionID : ''
+          if (!sessionID || !domains.session?.get) throw new Error('session lookup unavailable')
+          const retrieved = await domains.session.get(sessionID)
+          if (retrieved === null || typeof retrieved !== 'object')
+            throw new Error('invalid session')
+          session = retrieved as AuthoritativeSession
+        } catch {
+          deny()
+          return
+        }
+      }
+
+      // Native-only resources remain under host policy. If a Pantheon target
+      // appears anywhere, the shared policy evaluates the complete resource set.
+      const decision = evaluateV2Delegation(event, session, output?.status)
+      if (decision === 'deny') deny()
+      else writeProof(output?.status)
     })
     return true
   } catch {
@@ -1115,13 +1256,30 @@ export const plugin = define({
       }
     })
 
-    // ─── Phase 2: V2 Tool Registration (best-effort) ─────────────────
-    const toolsRegistered = await registerV2Tools(context).catch(() => false)
-    if (!toolsRegistered) {
+    // ─── Phase 2: Required V2 execute.before enforcement ──────────────
+    // Register the scanner/read-only gate before any Pantheon V2 tools can be
+    // added. A missing/rejected hook disables the custom Pantheon tool surface;
+    // native host built-ins may still remain available and are not claimed to
+    // be covered by this plugin guard.
+    const toolHooksRegistered = await registerV2ToolHooks(context).catch(() => false)
+    if (!toolHooksRegistered) {
+      markUnsupported('tool-execute-hooks')
+      markUnsupported('secret-scan-hook')
+      markUnsupported('pantheon-tools-disabled')
+      console.error(
+        '[Pantheon V2] Secret-scanning enforcement is unavailable; Pantheon V2 tools were not registered. Native host tools may remain available and are not covered by this guard.',
+      )
+    }
+
+    // ─── Phase 3: V2 Tool Registration (guarded) ─────────────────────
+    const toolsRegistered = toolHooksRegistered
+      ? await registerV2Tools(context).catch(() => false)
+      : false
+    if (!toolsRegistered && toolHooksRegistered) {
       markUnsupported('tool-transform')
     }
 
-    // ─── Phase 3: V2 Event Subscription (best-effort) ────────────────
+    // ─── Phase 4: V2 Event Subscription (best-effort) ────────────────
     const eventCleanup = subscribeV2Events(context)
     if (eventCleanup) {
       activeCleanups.push(eventCleanup)
@@ -1129,18 +1287,12 @@ export const plugin = define({
       markUnsupported('event-stream')
     }
 
-    // ─── Phase 4: V2 Session Hooks (best-effort) ─────────────────────
+    // ─── Phase 5: V2 Session Hooks (best-effort) ─────────────────────
     const sessionHooksRegistered = await registerV2SessionHooks(context).catch(() => false)
     if (!sessionHooksRegistered) {
       markUnsupported('session-hooks')
     }
 
-    // ─── Phase 5: V2 Tool Hooks (best-effort) ────────────────────────
-    const toolHooksRegistered = await registerV2ToolHooks(context).catch(() => false)
-    if (!toolHooksRegistered) {
-      markUnsupported('tool-execute-hooks')
-    }
-
     // ─── Phase 6: V2 Permission Hook (best-effort) ───────────────────
     await registerV2PermissionHook(context).catch(() => false)