pantheon-opencode 1.6.0-beta.5 → 1.6.0-beta.7

package/scripts/install/shared.mjs

@@ -7,6 +7,7 @@ import {
   copyFileSync,
   cpSync,
   existsSync,
+  lstatSync,
   mkdirSync,
   readdirSync,
   readFileSync,
@@ -257,17 +258,105 @@ export function copyFiles(srcDir, dstDir, dryRun, renameMap = null, clean = fals
   return { created, skipped }
 }
 
-export function writeIfChanged(filePath, content, dryRun) {
-  const existing = existsSync(filePath) ? readFileSync(filePath, 'utf8') : null
+/**
+ * `lstat` that returns `null` instead of throwing for an absent path.
+ *
+ * Deliberately `lstat`, not `stat`/`existsSync`: both of those follow the link,
+ * so a DANGLING symlink reads as absent and the atomic rename below would then
+ * silently replace the link itself. `lstat` sees the link and lets the write
+ * guard refuse it.
+ */
+function lstatOrNull(filePath) {
+  try {
+    return lstatSync(filePath)
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Read a path's raw text, or `null` when it cannot be read (absent, dangling
+ * symlink target, permission error). The caller decides what "unreadable"
+ * means; this never throws.
+ */
+function readFileOrNull(filePath) {
+  try {
+    return readFileSync(filePath, 'utf8')
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Atomically create/overwrite a text file, skipping an unchanged write.
+ *
+ * @param {string} filePath - destination path
+ * @param {string} content - full file content
+ * @param {boolean} dryRun - when true, compute the outcome without writing
+ * @param {object} [options]
+ * @param {string|null} [options.expectedContent] - the raw content the caller
+ *   read this path from, if any. When supplied, the write proceeds only if the
+ *   on-disk content STILL matches it — compared once up front AND again
+ *   immediately before the rename; otherwise it returns `'conflict'` and leaves
+ *   the file alone. This is a best-effort COMPARE-BEFORE-WRITE guard, NOT a
+ *   filesystem CAS: the final re-read and the rename are still two syscalls, so
+ *   a writer that lands between them is not prevented. What it does close is
+ *   the window the installer actually races with — a config the caller parsed
+ *   going stale during the same run — and it keeps the target and the `.bak`
+ *   consistent with the bytes that were checked.
+ * @param {(existing: string|null) => void} [options.beforeRecheck] - runs after
+ *   the initial content check and before the last-moment re-read. Injection
+ *   point so tests can simulate a concurrent writer landing in the window;
+ *   production callers omit it (undefined is a no-op).
+ * @param {(existing: string|null) => void} [options.beforeSwap] - runs after the
+ *   expected-content checks pass and immediately before the rename, so side
+ *   effects that must not fire on a conflict (e.g. the `.bak` copy) live here.
+ * @returns {'created'|'skipped'|'conflict'}
+ */
+export function writeIfChanged(filePath, content, dryRun, options = {}) {
+  const { expectedContent, beforeSwap, beforeRecheck } = options
+
+  // Refuse to write through/over a symlink. A dangling symlink is invisible to
+  // existsSync, and rename-over-link would replace the link rather than its
+  // target — both are silent redirections the installer must not perform.
+  const stat = lstatOrNull(filePath)
+  if (stat?.isSymbolicLink()) {
+    throw new Error(`Refusing to write through symlink: ${filePath}`)
+  }
+
+  const existing = stat === null ? null : readFileOrNull(filePath)
   if (existing === content) {
     return 'skipped'
   }
+  if (expectedContent !== undefined && existing !== expectedContent) {
+    // The file changed since the caller read it (or appeared/disappeared).
+    // Do not clobber the newer content; the caller decides how to react.
+    return 'conflict'
+  }
   if (!dryRun) {
+    // Seam for a concurrent writer to land between the read above and the
+    // re-read below. No production caller passes this.
+    if (typeof beforeRecheck === 'function') beforeRecheck(existing)
+
     // Atomic write: write a temp sibling and rename over the target so a
     // crash mid-write can never leave a truncated file behind (rename is
     // atomic within the same directory).
     const tmpPath = `${filePath}.tmp-${process.pid}`
     writeFileSync(tmpPath, content, 'utf8')
+
+    // Last-moment re-read. The initial compare and this rename are separate
+    // syscalls, so a concurrent writer can land in between; re-check the
+    // expected bytes immediately before the swap. On a mismatch, drop the temp
+    // and leave the target AND any existing `.bak` byte-identical.
+    if (expectedContent !== undefined) {
+      const current = readFileOrNull(filePath)
+      if (current !== expectedContent) {
+        rmSync(tmpPath, { force: true })
+        return 'conflict'
+      }
+    }
+
+    if (typeof beforeSwap === 'function') beforeSwap(existing)
     renameSync(tmpPath, filePath)
   }
   return 'created'
@@ -277,12 +366,31 @@ export function writeIfChanged(filePath, content, dryRun) {
  * beta.5: write the user's opencode.json with a same-directory backup of the
  * previous content. The installer rewrites the whole config; a `.bak` gives
  * the user a one-step recovery if a merge ever goes wrong.
+ *
+ * The backup is created INSIDE the `beforeSwap` hook, so it fires only after
+ * both expected-content checks pass (the initial compare and the last-moment
+ * re-read before the rename). A conflict observed at either point leaves the
+ * target AND any pre-existing `.bak` untouched, rather than overwriting the
+ * user's last known-good backup with a stale copy on a no-op write.
+ *
+ * @param {string} filePath
+ * @param {string} content
+ * @param {boolean} dryRun
+ * @param {object} [options] - forwarded to {@link writeIfChanged}
  */
-export function writeConfigWithBackup(filePath, content, dryRun) {
-  if (!dryRun && existsSync(filePath)) {
-    copyFileSync(filePath, `${filePath}.bak`)
-  }
-  return writeIfChanged(filePath, content, dryRun)
+export function writeConfigWithBackup(filePath, content, dryRun, options = {}) {
+  return writeIfChanged(filePath, content, dryRun, {
+    expectedContent: options.expectedContent,
+    beforeRecheck: options.beforeRecheck,
+    beforeSwap: (existing) => {
+      if (existing === null) return
+      try {
+        copyFileSync(filePath, `${filePath}.bak`)
+      } catch {
+        // Best-effort: a backup failure must not block the install.
+      }
+    },
+  })
 }
 
 /**

package/scripts/install/strings.mjs

@@ -47,6 +47,10 @@ const TABLE = {
     prereqMissing:
       'runtime prerequisites missing — install the tools above, or re-run with --no-mcp to install without Python MCP servers',
     v2Migrating: 'Migrating config to V2 native format...',
+    v2UnpublishedPin: (spec) =>
+      `V2 plugin is pinned to ${spec}, but this installer is running from a source checkout — ` +
+      'that version may not be published to npm yet, so OpenCode cannot resolve the pin until it is. ' +
+      'Run the installer from the published package (npx pantheon-opencode init) to avoid this.',
     // summary (printSummary)
     summaryInstalled: (target) => `OpenCode installed in ${target}`,
     summaryWithErrors: (target) => `Installation finished WITH ERRORS in ${target}`,
@@ -95,6 +99,10 @@ const TABLE = {
     prereqMissing:
       'pré-requisitos do runtime ausentes — instale as ferramentas acima, ou rode de novo com --no-mcp para instalar sem os MCPs Python',
     v2Migrating: 'Migrando config para o formato nativo V2...',
+    v2UnpublishedPin: (spec) =>
+      `Plugin V2 fixado em ${spec}, mas este installer está rodando de um checkout do código-fonte — ` +
+      'essa versão pode ainda não estar publicada no npm, então o OpenCode não resolve o pin até a publicação. ' +
+      'Rode o installer pelo pacote publicado (npx pantheon-opencode init) para evitar isso.',
     // summary (printSummary)
     summaryInstalled: (target) => `OpenCode instalado em ${target}`,
     summaryWithErrors: (target) => `Instalação concluída COM ERROS em ${target}`,

package/scripts/probe-pantheon-cost.mjs

@@ -8,9 +8,10 @@
  * temporary synthetic opencode database. A missing fixture runtime is also
  * AMBIENTAL rather than a false PASS.
  */
-import { existsSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs'
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, rmSync, symlinkSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
 
 const requestedVersion = valueFor('--version')
 const jsonOutput = process.argv.includes('--json')
@@ -151,19 +152,27 @@ async function main() {
     return
   }
 
+  const root = mkdtempSync(join(tmpdir(), 'pantheon-cost-probe-'))
   let DatabaseSync
   let createCostCommand
   try {
     ;({ DatabaseSync } = await import('node:sqlite'))
-    ;({ createCostCommand } = await import(source.href))
+    // Node's built-in TS stripping deliberately refuses files under
+    // node_modules. Exercise the shipped command from an isolated temp copy
+    // while resolving its runtime dependencies through the installed package.
+    const runtimeSource = join(root, 'cost-command.ts')
+    const packageNodeModules = fileURLToPath(new URL('../node_modules/', import.meta.url))
+    copyFileSync(fileURLToPath(source), runtimeSource)
+    symlinkSync(packageNodeModules, join(root, 'node_modules'), 'dir')
+    ;({ createCostCommand } = await import(pathToFileURL(runtimeSource).href))
   } catch (error) {
+    rmSync(root, { recursive: true, force: true })
     ambiental(
       `pantheon_cost fixture runtime unavailable: ${error instanceof Error ? error.message : String(error)}`,
     )
     return
   }
 
-  const root = mkdtempSync(join(tmpdir(), 'pantheon-cost-probe-'))
   const dataHome = join(root, 'data')
   const opencodeDir = join(dataHome, 'opencode')
   // Every real installation writes `opencode.db`; the v1/v2 distinction is the
@@ -254,6 +263,7 @@ async function main() {
 
     const restore = setEnvironment({
       XDG_DATA_HOME: dataHome,
+      OPENCODE_DB: undefined,
       PANTHEON_OPENCODE_VERSION: requestedVersion,
       PANTHEON_COST_DB: undefined,
     })
@@ -284,6 +294,7 @@ async function main() {
 
     const envRestore = setEnvironment({
       XDG_DATA_HOME: dataHome,
+      OPENCODE_DB: undefined,
       PANTHEON_OPENCODE_VERSION: requestedVersion,
       PANTHEON_COST_DB: envDb,
     })
@@ -308,6 +319,7 @@ async function main() {
 
     const explicitRestore = setEnvironment({
       XDG_DATA_HOME: dataHome,
+      OPENCODE_DB: undefined,
       PANTHEON_OPENCODE_VERSION: requestedVersion,
       PANTHEON_COST_DB: envDb,
     })
@@ -329,6 +341,7 @@ async function main() {
 
     const missingRestore = setEnvironment({
       XDG_DATA_HOME: join(root, 'missing-data'),
+      OPENCODE_DB: undefined,
       PANTHEON_OPENCODE_VERSION: requestedVersion,
       PANTHEON_COST_DB: undefined,
     })

package/scripts/run-node-tests.mjs

@@ -0,0 +1,189 @@
+#!/usr/bin/env node
+/**
+ * Run `node --test` over an explicit file list, and FAIL when zero tests are collected.
+ *
+ * Why this exists: `node --test <glob>` exits 0 when the glob matches nothing (Node >= 22).
+ * A test script whose file set is absent from the checkout -- or absent from the published
+ * package, because the `files` allow-list omits it -- therefore reports success while
+ * collecting nothing. That is the worst possible failure mode for a release gate: it
+ * manufactures confidence.
+ *
+ * This runner closes that hole from two independent sides:
+ *   1. It expands the globs ITSELF and refuses to start the runner with zero files, so the
+ *      runner is never handed an unexpanded pattern that silently matches nothing.
+ *   2. After a run that exited 0, it re-reads the collected count from the machine-readable
+ *      TAP summary and fails closed when that count is 0, unparseable, or missing.
+ *
+ * Side 2 is deliberately independent of side 1: a future Node change to `--test` glob
+ * handling, a glob that expands to a directory of empty files, or an emptied test file all
+ * still get caught.
+ *
+ * Human-readable output is unchanged: the default `spec` reporter still goes to stdout, and
+ * the TAP reporter is diverted to a scratch file that is read once and deleted.
+ *
+ * Usage:
+ *   node scripts/run-node-tests.mjs [--label <name>] [-- <node flags...>] <glob>...
+ *
+ * Examples:
+ *   node scripts/run-node-tests.mjs 'tests/*.mjs' 'tests/pantheon/*.mjs'
+ *   node scripts/run-node-tests.mjs -- --experimental-test-coverage 'tests/*.mjs'
+ */
+import { spawnSync } from 'node:child_process'
+import { globSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = join(fileURLToPath(new URL('.', import.meta.url)), '..')
+
+function usage(message) {
+  console.error(`zero-test-guard: ${message}`)
+  console.error(
+    'usage: node scripts/run-node-tests.mjs [--label <name>] [-- <node flags...>] <glob>...',
+  )
+  process.exit(1)
+}
+
+/** Parse `[--label <name>] [-- <node flags...>] <glob>...`. */
+function parseArgs(argv) {
+  const separator = argv.indexOf('--')
+  const own = separator === -1 ? argv : argv.slice(0, separator)
+  const nodeFlags = separator === -1 ? [] : argv.slice(separator + 1)
+
+  let label = 'node tests'
+  const globs = []
+  for (let i = 0; i < own.length; i++) {
+    if (own[i] === '--label') {
+      const value = own[i + 1]
+      if (value === undefined) usage('--label requires a value')
+      label = value
+      i += 1
+      continue
+    }
+    if (own[i].startsWith('-')) usage(`unknown option ${own[i]}`)
+    globs.push(own[i])
+  }
+  if (globs.length === 0) usage('at least one glob is required')
+  return { label, globs, nodeFlags }
+}
+
+/**
+ * Expand globs to a deduped, ordered file list.
+ * Order follows the positional order of the globs so that the suite runs in the same order
+ * as the shell used to; within a glob, matches are sorted for determinism.
+ */
+function expand(globs) {
+  const files = []
+  const seen = new Set()
+  for (const pattern of globs) {
+    const matches = globSync(pattern, { cwd: ROOT })
+      .filter((match) => !match.includes('node_modules') && !match.includes('__pycache__'))
+      .sort()
+    for (const match of matches) {
+      if (seen.has(match)) continue
+      seen.add(match)
+      files.push(match)
+    }
+  }
+  return files
+}
+
+function reportMissingFiles(label, globs) {
+  console.error(`zero-test-guard: ${label} matched 0 test files — refusing to report success.`)
+  console.error(`  globs: ${globs.join(' ')}`)
+  console.error('  This is the "test suite silently passes when it collects nothing" failure.')
+  console.error('  Either the test files are missing from this checkout, or they are missing')
+  console.error('  from the published package (check the "files" allow-list in package.json).')
+}
+
+function reportZeroCollected(label, files) {
+  console.error(`zero-test-guard: ${label} collected 0 tests — refusing to report success.`)
+  console.error(`  ${files.length} file(s) matched, but not one test case was collected:`)
+  for (const file of files) console.error(`    ${file}`)
+}
+
+/**
+ * Count the real test cases collected in a TAP summary.
+ *
+ * Node counts a test FILE that declares no test cases as one passing "test"
+ * (`ok 1 - tests/foo.test.mjs`), so the summary's `# tests N` is >= the file count and
+ * can never reach 0 once any file matched. Relying on it alone would let a suite whose
+ * every test file was emptied out report success.
+ *
+ * The reliable discriminator is the subtest NAME: a file-level placeholder is named with
+ * the file path that was passed to the runner, a real test case is named with its test
+ * name. So a top-level subtest whose name is one of our matched paths is a placeholder
+ * and is not counted as a collected case.
+ *
+ * Returns null when the summary cannot be read or parsed -- the caller fails closed.
+ */
+function countCollectedTests(tapPath, files) {
+  let tap = ''
+  try {
+    tap = readFileSync(tapPath, 'utf8')
+  } catch {
+    return null
+  }
+  // The summary count is still asserted to exist: without it the stream is not TAP.
+  if (!/^#\s*tests\s+\d+\s*$/m.test(tap)) return null
+
+  const placeholders = new Set(files)
+  let collected = 0
+  for (const match of tap.matchAll(/^# Subtest: (.+)$/gm)) {
+    if (placeholders.has(match[1].trim())) continue
+    collected += 1
+  }
+  return collected
+}
+
+const { label, globs, nodeFlags } = parseArgs(process.argv.slice(2))
+const files = expand(globs)
+
+if (files.length === 0) {
+  reportMissingFiles(label, globs)
+  process.exit(1)
+}
+
+const scratch = mkdtempSync(join(tmpdir(), 'pantheon-node-tests-'))
+const tapPath = join(scratch, 'summary.tap')
+
+try {
+  const run = spawnSync(
+    process.execPath,
+    [
+      '--test',
+      '--test-reporter=spec',
+      '--test-reporter-destination=stdout',
+      '--test-reporter=tap',
+      `--test-reporter-destination=${tapPath}`,
+      ...nodeFlags,
+      ...files,
+    ],
+    { cwd: ROOT, stdio: 'inherit' },
+  )
+
+  if (run.error) {
+    console.error(`zero-test-guard: could not start the test runner: ${run.error.message}`)
+    process.exit(1)
+  }
+  if (run.signal) {
+    console.error(`zero-test-guard: the test runner was killed by ${run.signal}`)
+    process.exit(1)
+  }
+  // Real failures keep the runner's own exit code; the guard only speaks up when the
+  // runner claimed success it cannot justify.
+  if (run.status !== 0) process.exit(run.status)
+
+  const collected = countCollectedTests(tapPath, files)
+  if (collected === null) {
+    console.error('zero-test-guard: could not read the collected test count from the TAP summary.')
+    console.error('  Failing closed: an unreadable summary cannot certify that any test ran.')
+    process.exit(1)
+  }
+  if (collected === 0) {
+    reportZeroCollected(label, files)
+    process.exit(1)
+  }
+} finally {
+  rmSync(scratch, { recursive: true, force: true })
+}

package/scripts/sync-artifacts.mjs

@@ -19,10 +19,10 @@
  */
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs'
 import { join } from 'node:path'
+import { copyAgentPrompts } from './build-agents-md.mjs'
 
 import {
   collectSkillNames,
-  copyFiles,
   installSkills,
   ROOT,
   syncDir,
@@ -59,7 +59,7 @@ export function syncCopyArtifacts(configDir) {
     const dstAgents = join(configDir, 'agents')
     if (existsSync(join(ROOT, 'src', 'agents'))) {
       mkdirSync(dstAgents, { recursive: true })
-      bump(copyFiles(join(ROOT, 'src', 'agents'), dstAgents, false))
+      bump(copyAgentPrompts(join(ROOT, 'src', 'agents'), dstAgents, false))
       const routing = join(ROOT, 'src', 'routing.yml')
       if (existsSync(routing)) {
         if (