pantheon-opencode 1.6.0-beta.7 → 1.6.0-beta.8

package/scripts/install/opencode.mjs

@@ -135,6 +135,74 @@ export const MANAGED_FIELDS = Object.freeze([
   'disable_model_invocation',
 ])
 
+const PANTHEON_MCP_SERVERS = Object.freeze([
+  'pantheon-resources',
+  'pantheon-memory',
+  'pantheon-code-mode',
+  'pantheon-persistence',
+  'pantheon-vision',
+])
+
+function normalizeMcpPermissionSegment(value) {
+  return value.replace(/[^a-zA-Z0-9_]/g, '_')
+}
+
+/**
+ * Translate an agent's `mcp_tools` frontmatter into per-tool native
+ * permissions. V1 matches the original server-tool names; V2 normalizes
+ * punctuation to underscores. Emitting both spellings keeps the same source
+ * metadata valid for either host. Unlisted bundled Pantheon servers default to
+ * deny; unrelated user MCP servers are not touched.
+ *
+ * @param {Record<string, 'all' | string[]>} mcpTools
+ * @returns {Record<string, 'allow' | 'deny'>}
+ */
+export function deriveNativeMcpPermissions(mcpTools) {
+  if (mcpTools === null || typeof mcpTools !== 'object' || Array.isArray(mcpTools)) {
+    throw new TypeError('mcp_tools must be an object keyed by MCP server name')
+  }
+
+  const servers = new Set([...PANTHEON_MCP_SERVERS, ...Object.keys(mcpTools)])
+  const permissions = {}
+
+  for (const server of servers) {
+    if (!/^[a-zA-Z0-9._-]+$/.test(server)) {
+      throw new TypeError(`mcp_tools server name is invalid: ${server}`)
+    }
+    const tools = Object.hasOwn(mcpTools, server) ? mcpTools[server] : []
+    if (
+      tools !== 'all' &&
+      (!Array.isArray(tools) ||
+        tools.some((tool) => typeof tool !== 'string' || !/^[a-zA-Z0-9._-]+$/.test(tool)))
+    ) {
+      throw new TypeError(`mcp_tools.${server} must be "all" or an array of tool names`)
+    }
+
+    const serverAliases = new Set([server, normalizeMcpPermissionSegment(server)])
+    for (const alias of serverAliases) permissions[`${alias}_*`] = 'deny'
+  }
+
+  for (const server of servers) {
+    const tools = Object.hasOwn(mcpTools, server) ? mcpTools[server] : []
+    const serverAliases = new Set([server, normalizeMcpPermissionSegment(server)])
+    if (tools === 'all') {
+      for (const alias of serverAliases) permissions[`${alias}_*`] = 'allow'
+      continue
+    }
+
+    for (const tool of tools) {
+      const toolAliases = new Set([tool, normalizeMcpPermissionSegment(tool)])
+      for (const serverAlias of serverAliases) {
+        for (const toolAlias of toolAliases) {
+          permissions[`${serverAlias}_${toolAlias}`] = 'allow'
+        }
+      }
+    }
+  }
+
+  return permissions
+}
+
 function deepClone(value) {
   return JSON.parse(JSON.stringify(value))
 }
@@ -226,26 +294,23 @@ function mergeMissing(target, source) {
 }
 
 /**
- * Resolve a plugin ref from the repository-root opencode.json to its stable
- * installed form.
+ * Resolve a plugin ref from the repository-root opencode.json to a path INSIDE
+ * the installed package.
  *
  * Only exact Pantheon plugin identities are resolved into the installed
  * package. In particular, a third-party absolute path ending in
  * `src/plugin.ts` or `src/plugins/pantheon-hooks.ts` is not evidence that the
- * plugin belongs to Pantheon and must be preserved verbatim. V1 remains a pair
- * of package-local paths; V2 uses an exact npm version so it is independent of
- * the installer's global prefix or transient npx cache.
+ * plugin belongs to Pantheon and must be preserved verbatim.
  */
 export function resolveInstalledPlugin(plugin) {
   if (typeof plugin !== 'string') return plugin
   const normalized = normalizePluginRef(plugin)
-  if (normalized === PANTHEON_V2_PLUGIN || normalized === PANTHEON_V2_LEGACY_FILE) {
-    return PANTHEON_V2_PACKAGE_SPEC
-  }
   if (PANTHEON_PLUGIN_IDENTITIES.has(normalized)) return join(ROOT, normalized)
+  // Legacy V2 file ref (pre-directory-contract): migrate to the installed
+  // plugin directory so the beta loader accepts the entry.
+  if (normalized === PANTHEON_V2_LEGACY_FILE) return join(ROOT, PANTHEON_V2_PLUGIN)
   const identity = managedPluginIdentity(plugin)
   if (identity !== null && isAbsolute(normalized)) {
-    if (identity === PANTHEON_V2_PLUGIN) return PANTHEON_V2_PACKAGE_SPEC
     return INSTALLED_PANTHEON_PLUGIN_PATHS.get(identity) ?? plugin
   }
   return plugin
@@ -267,14 +332,7 @@ const PANTHEON_V2_PLUGIN = 'src/plugin-v2'
 const PANTHEON_V2_LEGACY_FILE = 'src/plugin-v2.ts'
 const PANTHEON_V1_EXPORT = 'pantheon-opencode/plugin'
 const PANTHEON_V2_EXPORT = 'pantheon-opencode/plugin-v2'
-const PACKAGE_MANIFEST = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf8'))
-const PANTHEON_V2_PACKAGE_SPEC = `${PACKAGE_MANIFEST.name}@${PACKAGE_MANIFEST.version}`
-// Installation origin probe: npm copies (global prefix, npx cache) always live
-// under a `node_modules` directory; a repo checkout does not. From a checkout —
-// or between a version bump and its publish — the V2 pin above names a version
-// that may not exist on the npm registry yet, and the host cannot resolve it
-// until publish. Advisory only: the install itself is structurally correct.
-const RUNNING_FROM_NPM_INSTALL = import.meta.url.includes('/node_modules/')
+const PANTHEON_PACKAGE_REF = /^pantheon-opencode(?:@[^/]+)?(?:\/(plugin|plugin-v2))?$/
 const PANTHEON_PLUGIN_IDENTITIES = new Set([
   PANTHEON_V1_PLUGIN,
   PANTHEON_V1_HOOKS,
@@ -303,14 +361,22 @@ function managedPluginIdentity(ref) {
   const normalized = normalizePluginRef(ref)
   if (typeof normalized !== 'string') return null
 
+  // Older installs registered the package root itself (often pinned to a
+  // beta version) in OpenCode's plural `plugins` list. Treat all exact npm
+  // specs for this package as managed so an update removes the old cached
+  // copy before registering the current package path. Do not match similarly
+  // named third-party packages such as `pantheon-opencode-fork`.
+  const packageRef = normalized.match(PANTHEON_PACKAGE_REF)
+  if (packageRef !== null) {
+    if (packageRef[1] === 'plugin') return PANTHEON_V1_PLUGIN
+    return PANTHEON_V2_PLUGIN
+  }
+
   if (PANTHEON_PLUGIN_IDENTITIES.has(normalized)) return normalized
   if (normalized === PANTHEON_V2_LEGACY_FILE) return PANTHEON_V2_PLUGIN
   if (normalized === PANTHEON_V1_EXPORT || normalized.startsWith(`${PANTHEON_V1_EXPORT}@`)) {
     return PANTHEON_V1_PLUGIN
   }
-  if (normalized === PACKAGE_MANIFEST.name || normalized.startsWith(`${PACKAGE_MANIFEST.name}@`)) {
-    return PANTHEON_V2_PLUGIN
-  }
   if (normalized === PANTHEON_V2_EXPORT || normalized.startsWith(`${PANTHEON_V2_EXPORT}@`)) {
     return PANTHEON_V2_PLUGIN
   }
@@ -1154,6 +1220,12 @@ export async function installOpenCode(
       if (fm.permission) {
         agent.permission = JSON.parse(JSON.stringify(fm.permission))
       }
+      if (fm.mcp_tools !== undefined) {
+        agent.permission = {
+          ...(agent.permission ?? {}),
+          ...deriveNativeMcpPermissions(fm.mcp_tools),
+        }
+      }
 
       config[name] = agent
     }
@@ -1266,12 +1338,16 @@ export async function installOpenCode(
   // --------------------------------------------------------------------
   // B.5.1 Hermetic plugin resolution (packaging fix)
   // --------------------------------------------------------------------
-  // A developer running from a checkout may have a repository-root
-  // opencode.json with machine-specific plugin paths. V1 rewrites its two
-  // managed entries to paths under the installed package. V2 instead writes
-  // the exact package-root npm spec so it survives global-prefix and npx-cache
-  // changes; a source-checkout V2 install warns that the version may not yet
-  // exist on npm. Third-party paths remain untouched in either generation.
+  // A developer running from a checkout has a repository-root opencode.json
+  // that may reference plugins via developer-machine absolute paths (e.g.
+  // <dev>/pantheon/.../src/plugin.ts or
+  // <dev>/pantheon/.../src/plugins/pantheon-hooks.ts). Copying those
+  // verbatim into the user's config would break every global install on any
+  // other machine. resolveInstalledPlugin() rewrites each entry to the plugin
+  // file inside the INSTALLED package (derived from ROOT — never hardcoded),
+  // so both dev and global installs resolve to a path that actually exists.
+  // The source opencode.json keeps its dev path for local development; the
+  // transform happens at install/sync time only.
 
   if (version === 'v1') {
     // V1 loads the singular `plugin` list. Remove every Pantheon V2 entry from
@@ -1332,13 +1408,18 @@ export async function installOpenCode(
         }
       }
     }
-    // V2 plugin entries are resolved by OpenCode as npm packages. Pin the
-    // exact current version and use the package-root export, which is the V2
-    // default plugin. Unlike an absolute path into ROOT, this survives moving
-    // between a global install and an npx cache; unlike an unpinned package,
-    // it cannot silently change underneath an existing config. Legacy local
-    // directory/file refs are recognized via managedPluginIdentity and are
-    // replaced here.
+    // The beta resolves every `plugins` entry through npm install, so an
+    // `a/b` shorthand (e.g. the published `pantheon-opencode/plugin-v2`
+    // export) is treated as a GitHub repo and dies with NpmInstallFailedError
+    // (beta log evidence). The beta loader additionally requires each entry
+    // to be a DIRECTORY with a real index.js/index.ts — a file path warns
+    // "must be a directory" and a symlink is ignored (sandbox probe
+    // evidence). Register the V2 plugin DIRECTORY inside the INSTALLED
+    // package — exactly like V1's ensurePantheonPlugin, but pointing at
+    // src/plugin-v2 whose index.ts shim re-exports the real entry.
+    // Legacy refs (npm shorthand, the old src/plugin-v2.ts file path) are
+    // recognized via managedPluginIdentity and already stripped above, so
+    // they migrate here.
     const resolvedV2 = resolveInstalledPlugin(PANTHEON_V2_PLUGIN)
     config.plugins = config.plugins.filter(
       (plugin) => pluginReferenceIdentity(plugin) !== pluginReferenceIdentity(resolvedV2),
@@ -1522,16 +1603,6 @@ export async function installOpenCode(
       configToWrite.plugins,
       config.context_sandbox,
     )
-
-    // Bootstrap chicken-and-egg: the pin names the CURRENT package version,
-    // which exists on the registry only after publish. From an npm install
-    // (global prefix / npx cache) that is the published version by
-    // construction; from a repo checkout the pin may point at an unpublished
-    // version the host cannot resolve. Warn instead of failing — the config is
-    // structurally correct and the pin realigns once the version is out.
-    if (!RUNNING_FROM_NPM_INSTALL) {
-      warning(S.v2UnpublishedPin(PANTHEON_V2_PACKAGE_SPEC))
-    }
   }
 
   const configContent = `${JSON.stringify(configToWrite, null, 2)}\n`

package/scripts/install/strings.mjs

@@ -47,10 +47,6 @@ const TABLE = {
     prereqMissing:
       'runtime prerequisites missing — install the tools above, or re-run with --no-mcp to install without Python MCP servers',
     v2Migrating: 'Migrating config to V2 native format...',
-    v2UnpublishedPin: (spec) =>
-      `V2 plugin is pinned to ${spec}, but this installer is running from a source checkout — ` +
-      'that version may not be published to npm yet, so OpenCode cannot resolve the pin until it is. ' +
-      'Run the installer from the published package (npx pantheon-opencode init) to avoid this.',
     // summary (printSummary)
     summaryInstalled: (target) => `OpenCode installed in ${target}`,
     summaryWithErrors: (target) => `Installation finished WITH ERRORS in ${target}`,
@@ -99,10 +95,6 @@ const TABLE = {
     prereqMissing:
       'pré-requisitos do runtime ausentes — instale as ferramentas acima, ou rode de novo com --no-mcp para instalar sem os MCPs Python',
     v2Migrating: 'Migrando config para o formato nativo V2...',
-    v2UnpublishedPin: (spec) =>
-      `Plugin V2 fixado em ${spec}, mas este installer está rodando de um checkout do código-fonte — ` +
-      'essa versão pode ainda não estar publicada no npm, então o OpenCode não resolve o pin até a publicação. ' +
-      'Rode o installer pelo pacote publicado (npx pantheon-opencode init) para evitar isso.',
     // summary (printSummary)
     summaryInstalled: (target) => `OpenCode instalado em ${target}`,
     summaryWithErrors: (target) => `Instalação concluída COM ERROS em ${target}`,

package/scripts/probe-pantheon-cost.mjs

@@ -8,10 +8,9 @@
  * temporary synthetic opencode database. A missing fixture runtime is also
  * AMBIENTAL rather than a false PASS.
  */
-import { copyFileSync, existsSync, mkdirSync, mkdtempSync, rmSync, symlinkSync } from 'node:fs'
+import { existsSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { fileURLToPath, pathToFileURL } from 'node:url'
 
 const requestedVersion = valueFor('--version')
 const jsonOutput = process.argv.includes('--json')
@@ -152,27 +151,19 @@ async function main() {
     return
   }
 
-  const root = mkdtempSync(join(tmpdir(), 'pantheon-cost-probe-'))
   let DatabaseSync
   let createCostCommand
   try {
     ;({ DatabaseSync } = await import('node:sqlite'))
-    // Node's built-in TS stripping deliberately refuses files under
-    // node_modules. Exercise the shipped command from an isolated temp copy
-    // while resolving its runtime dependencies through the installed package.
-    const runtimeSource = join(root, 'cost-command.ts')
-    const packageNodeModules = fileURLToPath(new URL('../node_modules/', import.meta.url))
-    copyFileSync(fileURLToPath(source), runtimeSource)
-    symlinkSync(packageNodeModules, join(root, 'node_modules'), 'dir')
-    ;({ createCostCommand } = await import(pathToFileURL(runtimeSource).href))
+    ;({ createCostCommand } = await import(source.href))
   } catch (error) {
-    rmSync(root, { recursive: true, force: true })
     ambiental(
       `pantheon_cost fixture runtime unavailable: ${error instanceof Error ? error.message : String(error)}`,
     )
     return
   }
 
+  const root = mkdtempSync(join(tmpdir(), 'pantheon-cost-probe-'))
   const dataHome = join(root, 'data')
   const opencodeDir = join(dataHome, 'opencode')
   // Every real installation writes `opencode.db`; the v1/v2 distinction is the
@@ -263,7 +254,6 @@ async function main() {
 
     const restore = setEnvironment({
       XDG_DATA_HOME: dataHome,
-      OPENCODE_DB: undefined,
       PANTHEON_OPENCODE_VERSION: requestedVersion,
       PANTHEON_COST_DB: undefined,
     })
@@ -294,7 +284,6 @@ async function main() {
 
     const envRestore = setEnvironment({
       XDG_DATA_HOME: dataHome,
-      OPENCODE_DB: undefined,
       PANTHEON_OPENCODE_VERSION: requestedVersion,
       PANTHEON_COST_DB: envDb,
     })
@@ -319,7 +308,6 @@ async function main() {
 
     const explicitRestore = setEnvironment({
       XDG_DATA_HOME: dataHome,
-      OPENCODE_DB: undefined,
       PANTHEON_OPENCODE_VERSION: requestedVersion,
       PANTHEON_COST_DB: envDb,
     })
@@ -341,7 +329,6 @@ async function main() {
 
     const missingRestore = setEnvironment({
       XDG_DATA_HOME: join(root, 'missing-data'),
-      OPENCODE_DB: undefined,
       PANTHEON_OPENCODE_VERSION: requestedVersion,
       PANTHEON_COST_DB: undefined,
     })