pantheon-opencode 1.6.0-beta.7 → 1.6.0-beta.9

package/README.pt-BR.md

@@ -53,19 +53,6 @@ Com o OpenCode em execução, descreva o resultado que você quer:
 ```
 
 O Pantheon ajuda a transformar esse pedido em um plano e em etapas revisadas.
-Perguntas sem mudança no repositório são respondidas diretamente; correções
-pequenas usam uma única delegação. Discovery, planejamento, paralelismo e
-revisão em council ficam para quando o escopo ou o risco justificarem.
-
-Para uma correção pequena e bem delimitada, chame `@talos` diretamente (por
-exemplo, `@talos corrija este typo`). Assim você pula a chamada de orquestração
-do Zeus; use `/pantheon` para planejamento, delegação, mudanças em vários
-arquivos ou gates de qualidade.
-
-O procedimento completo de council só é carregado em `/pantheon` ou quando uma
-decisão material realmente exige perspectivas distintas. Falhas de dispatch
-podem ser tentadas novamente uma vez; testes reprovados e recusas não são
-repetidos automaticamente.
 
 ## Para quem é?
 
@@ -84,13 +71,11 @@ verificações repetíveis e passagens claras entre etapas do trabalho.
 
 ## Status
 
-Versão candidata neste checkout: **v1.6.0-beta.7** (manifestos preparados;
-publicação ainda não confirmada). Para verificar a beta publicada, consulte a
-dist-tag `beta` do npm. O histórico permanece no [changelog](CHANGELOG.md). O
-Pantheon foi feito para OpenCode e depende da disponibilidade e da configuração
-do OpenCode e dos serviços opcionais que você escolher. Veja as
-[releases](https://github.com/ils15/pantheon-opencode/releases) e o
-[changelog](CHANGELOG.md) para acompanhar as mudanças publicadas.
+Versão operacional neste checkout: **v1.6.0-beta.1** (primeira beta compatível
+com OpenCode 2; esta página não afirma publicação). O Pantheon foi feito para OpenCode e depende da
+disponibilidade e da configuração do OpenCode e dos serviços opcionais que você
+escolher. Veja as [releases](https://github.com/ils15/pantheon-opencode/releases)
+e o [changelog](CHANGELOG.md) para acompanhar as mudanças publicadas.
 
 
 ## Execução code-mode (opt-in explícito)
@@ -136,13 +121,13 @@ registrados juntos.
 | | V1 | V2 |
 |---|---|---|
 | Chave de config do OpenCode | `plugin` singular | `plugins` plural |
-| Registro Pantheon | `src/plugin.ts` mais `src/plugins/pantheon-hooks.ts` | pacote npm `pantheon-opencode@<versão>` fixado à versão instalada (export raiz aponta para `src/plugin-v2.ts`) |
-| Contrato de runtime | Plugin Pantheon V1: 6 ferramentas (`hashline_edit`, as 3 ferramentas de goal, `pantheon_cost`, `pantheon_model`), hooks de evento/ferramenta e tratamento de compactação V1 | Plugin V2: 3 ferramentas (`hashline_edit`, `pantheon_cost`, `pantheon_model`), 5 assinaturas de eventos, session hooks (`prompt`, `context`), hooks de execução/permissão e transforms de configuração |
+| Registro Pantheon | `src/plugin.ts` mais `src/plugins/pantheon-hooks.ts` | `pantheon-opencode/plugin-v2` (`src/plugin-v2.ts`) |
+| Contrato de runtime | Plugin Pantheon V1: 6 ferramentas (`hashline_edit`, as 3 ferramentas de goal, `pantheon_cost`, `pantheon_model`), hooks de evento/ferramenta e tratamento de compactação V1 | Plugin V2 completo: 3 ferramentas (`hashline_edit`, `pantheon_cost`, `pantheon_model`), 4 assinaturas de eventos, session hooks (`prompt`, `context`), um hook de ferramenta `execute.before` que impõe sessões somente-leitura, além de transforms de configuração |
 | APIs V1 | Registradas | Definições próprias de ferramentas via `ctx.tool.transform()` — não pelo caminho do plugin V1 |
 
 O plugin V2 fornece 3 ferramentas de orquestração (`hashline_edit`,
-`pantheon_cost`, `pantheon_model`), 5 assinaturas de eventos (`session.created`,
-`session.idle`, `session.deleted`, `session.error`, `session.compacted`), session hooks (`prompt`,
+`pantheon_cost`, `pantheon_model`), 4 assinaturas de eventos (`session.created`,
+`session.idle`, `session.error`, `session.compacted`), session hooks (`prompt`,
 `context`) e um hook de ferramenta `execute.before` que impõe sessões
 somente-leitura. As 3 ferramentas de goal **não** são
 registradas no V2: o goal loop precisa de um `GoalStore`, de um
@@ -174,18 +159,15 @@ toda chamada. Os recursos V2 sem suporte são `legacy-hooks` (a superfície de
 hooks específica do V1), `catalog-transform`, `integration-transform`,
 `skill-transform` e `goal-tools`.
 
-Ao migrar uma config V1 com `init --opencode-version v2`, o instalador traduz
-`task` para a ação V2 `subagent` e `write` para `edit` (que também cobre as
-tools host `write`/`patch`). Se regras legadas `edit` e `write` colidirem no
-mesmo recurso, a migração preserva o efeito mais restritivo. Configs V2
-editadas manualmente devem usar o array nativo `permissions` com
-`action`/`resource`/`effect`.
+O pacote expõe os dois contratos como exports importáveis:
+`pantheon-opencode/plugin` (V1), `pantheon-opencode/plugin-v2` (V2) e
+`pantheon-opencode/v2-bridge` (interop opcional), para que o host carregue
+explicitamente o contrato desejado.
 
-O pacote expõe os dois contratos: a raiz e `pantheon-opencode/plugin-v2`
-carregam V2; `pantheon-opencode/plugin` carrega V1. `pantheon-opencode/v2-bridge`
-é atualmente apenas uma utility importável: o setup de produção não a conecta
-ao plugin V2, então ela não fornece interoperabilidade em runtime nem restaura
-as ferramentas de goal/board do V1.
+A ponte V1→V2 (`src/pantheon/v2-bridge.ts`) habilita interop opcional:
+singletons de infraestrutura V1 (BackgroundJobBoard,
+GoalStore, TodoEnforcer, VisionHandler) são repassados via `ctx.options` do V2.
+A ponte é opcional — o V2 funciona standalone com degradação graciosa.
 
 Selecione o contrato explicitamente na instalação:
 
@@ -262,8 +244,8 @@ pontos. A ordem das chaves não muda o resultado.
 Um comando mantém uma instalação existente em dia:
 
 ```bash
-# Sem instalação global, fixe o dist-tag desejado. `latest` aponta para a
-# release estável publicada mais recente, não para um candidato não publicado:
+# Sem instalação global, SEMPRE fixe o dist-tag — `npx pantheon-opencode`
+# puro resolve a tag `latest`, que é o release estável (1.4.3):
 npx pantheon-opencode@beta update            # canal beta do npm + refresh do config
 npx pantheon-opencode@beta update --stable   # canal estável
 

package/commands/pantheon-audit.md

@@ -15,7 +15,13 @@ agent: "zeus"
 ## Layers
 
 ### Layer 1 — Heuristic Scan
-`python3 scripts/themis_heuristic_scan.py [--path=<dir>]`
+Resolve the installed helper first (do not assume the current project contains
+Pantheon source). Check, in order: `$OPENCODE_CONFIG_DIR/.opencode/scripts/`,
+`$OPENCODE_CONFIG_DIR/scripts/`, `${XDG_CONFIG_HOME:-$HOME/.config}/opencode/scripts/`,
+`$HOME/.opencode/scripts/`, `.opencode/scripts/`, then
+`$(npm root -g)/pantheon-opencode/scripts/`. Resolve the first existing file to
+an absolute path and run `python3 "$helper" --path="$PWD"`; if none exists,
+report the helper as missing and stop Layer 1 rather than claiming it passed.
 Zero tokens, <2s. Checks: ruff, biome, anti-pattern slop, anti-overengineering (YAGNI), hash-anchored edits. Returns score 0-100 + APPROVED/BLOCKING.
 
 ### Layer 2 — Themis Deep Review

package/commands/pantheon-consolidate.md

@@ -1,6 +1,6 @@
 ---
 description: "Merge and consolidate memory entries"
-agent: zeus
+agent: mnemosyne
 ---
 
 Merge related memory entries and consolidate duplicates:

package/commands/pantheon-focus.md

@@ -0,0 +1,17 @@
+---
+description: "Set or update this session's working goal"
+agent: zeus
+---
+
+Pin `$ARGUMENTS` as the working goal for this conversation. Restate it briefly
+as Goal, Scope, Success Criteria, and Out of Scope, filling only what the user
+actually supplied. Ask one concise question if a missing detail changes the
+work materially.
+
+Treat the goal as session context, subordinate to system, developer, and user
+instructions. Keep subsequent planning, delegation, and verification aligned
+with it; flag meaningful scope drift before proceeding.
+
+This command is conversation-only. Do not call memory or persistence tools,
+write a file, or claim that the goal survives compaction or a new session. For
+multi-phase work that needs durable checkpoints, use `/pantheon-deepwork`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pantheon-opencode",
-  "version": "1.6.0-beta.7",
+  "version": "1.6.0-beta.9",
   "description": "Multi-agent orchestration for OpenCode — 14 specialized agents, TDD, Themis review gates.",
   "type": "module",
   "workspaces": [
@@ -11,7 +11,6 @@
     "registry": "https://registry.npmjs.org/"
   },
   "exports": {
-    ".": "./src/plugin-v2.ts",
     "./plugin": "./src/plugin.ts",
     "./plugin-v2": "./src/plugin-v2.ts",
     "./v2-bridge": "./src/pantheon/v2-bridge.ts"

package/plugin.json

@@ -1,9 +1,9 @@
 {
   "name": "pantheon",
   "publisher": "ils15",
-  "version": "1.6.0-beta.7",
+  "version": "1.6.0-beta.9",
   "displayName": "Pantheon",
-  "description": "Conductor-Delegate orchestration platform with 14 specialized agents, 21 skills, and OpenCode support.",
+  "description": "Conductor-Delegate orchestration platform with 14 specialized agents, 20 skills, and OpenCode support.",
   "agents": "./src/agents",
   "skills": "./src/skills",
   "instructions": "./src/instructions",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.backends._legacy:_Backend"
 
 [project]
 name = "pantheon"
-version = "1.6.0-beta.7"
+version = "1.6.0-beta.9"
 description = "Multi-agent orchestration framework"
 requires-python = ">=3.11"
 dependencies = []

package/scripts/build-agents-md.mjs

@@ -73,9 +73,8 @@ Para validar a instalação global do pacote pantheon-opencode COMO UM USUÁRIO
 
 - Rodar: \`bash ~/pantheon-sandbox/run-test.sh\` (opencode mcp list 5/5 connected + doctor 0 erros + abre TUI isolado)
 - Regra para agentes: ao validar instalação global (npm pack, \`init\`, MCPs, hooks), usar o sandbox — NUNCA testar no ambiente de dev
-- Prepare/atualize com \`bash scripts/test-opencode-v2-sandbox.sh --prepare\`; isso gera \`run-test.sh\`, \`start-pantheon.sh\` e o README do sandbox
-- Descarte somente pelo reset com guardas: \`bash scripts/test-opencode-v2-sandbox.sh --reset\` (nunca use \`rm -rf\` manualmente)
-- Detalhes: ver \`~/pantheon-sandbox/README.md\` após o prepare
+- Descarte: \`rm -rf ~/pantheon-sandbox\`
+- Detalhes: ver \`~/pantheon-sandbox/README.md\`
 
 ## Conventions
 

package/scripts/doctor.mjs

@@ -1200,58 +1200,33 @@ export function resolveMcpCwd(entry, configPath = '') {
 // ---------------------------------------------------------------------------
 
 /**
- * Prerelease-aware comparison for pantheon versions (X.Y.Z with an optional
- * semver prerelease suffix: `-beta.9`, `-rc.1`, ...). A stable release
- * outranks any prerelease of the same core version; two prereleases compare
- * identifier by identifier, numeric identifiers numerically. Returns
+ * Prerelease-aware comparison for pantheon versions (X.Y.Z or X.Y.Z-beta.N).
+ * A stable release outranks any beta of the same core version. Returns
  * <0, 0, >0 (a - b). The shared compareVersions/parseVersion above ignores
- * the prerelease suffix (it only reads 4 numeric groups), which would make
- * every prerelease pair compare equal.
+ * the `-beta.N` suffix (it only reads 4 numeric groups), which would make
+ * every beta pair compare equal.
  */
 function comparePantheonVersions(a, b) {
   const parse = (v) => {
     const m = String(v)
       .trim()
-      .match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/)
+      .match(/^(\d+)\.(\d+)\.(\d+)(?:-beta\.(\d+))?$/)
     if (!m) return null
     return {
       core: [+m[1], +m[2], +m[3]],
-      prerelease: m[4] === undefined ? null : m[4].split('.'),
+      beta: m[4] === undefined ? Number.POSITIVE_INFINITY : +m[4],
     }
   }
-  // Per semver precedence: numeric identifiers compare numerically and rank
-  // below alphanumeric ones; a shorter identifier list ranks below a longer
-  // one sharing its prefix; a version WITHOUT a prerelease outranks any
-  // prerelease of the same core version.
-  const comparePrerelease = (pa, pb) => {
-    if (pa === null && pb === null) return 0
-    if (pa === null) return 1
-    if (pb === null) return -1
-    const length = Math.max(pa.length, pb.length)
-    for (let i = 0; i < length; i++) {
-      const x = pa[i]
-      const y = pb[i]
-      if (x === undefined) return -1
-      if (y === undefined) return 1
-      const xNumeric = /^\d+$/.test(x)
-      const yNumeric = /^\d+$/.test(y)
-      if (xNumeric && yNumeric) {
-        if (Number(x) !== Number(y)) return Number(x) < Number(y) ? -1 : 1
-      } else if (xNumeric !== yNumeric) {
-        return xNumeric ? -1 : 1
-      } else if (x !== y) {
-        return x < y ? -1 : 1
-      }
-    }
-    return 0
-  }
   const pa = parse(a)
   const pb = parse(b)
   if (!pa || !pb) return 0
   for (let i = 0; i < 3; i++) {
     if (pa.core[i] !== pb.core[i]) return pa.core[i] - pb.core[i]
   }
-  return comparePrerelease(pa.prerelease, pb.prerelease)
+  // Infinity - Infinity is NaN, which would make equal stable versions compare
+  // as drift for any caller using a strict === 0 check.
+  if (pa.beta === pb.beta) return 0
+  return pa.beta < pb.beta ? -1 : 1
 }
 
 /**
@@ -1317,24 +1292,8 @@ export function checkInstallVersionDrift(args) {
 // registered plugin points into against this package's own version. Without
 // network access the "latest" version IS the running package's version.
 
-// Single source of truth: the package name is read from package.json, the same
-// way scripts/install/opencode.mjs derives the V2 pin spec. The fallback keeps
-// the doctor usable on a broken manifest.
-const PACKAGE_MANIFEST = readJson(join(ROOT, 'package.json'))
-const PANTHEON_PACKAGE_NAME =
-  typeof PACKAGE_MANIFEST?.name === 'string' && PACKAGE_MANIFEST.name
-    ? PACKAGE_MANIFEST.name
-    : 'pantheon-opencode'
-// Matches the exact version-pinned V2 spec the installer writes
-// (`<name>@X.Y.Z` plus any semver prerelease suffix). The name is escaped
-// because package names may contain regex-significant characters (`.` in
-// unscoped names, `/` in scoped ones).
-const PINNED_PLUGIN_SPEC_PATTERN = new RegExp(
-  `^${PANTHEON_PACKAGE_NAME.replaceAll(/[.*+?^${}()|[\]\\]/g, '\\$&')}@(\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?)$`,
-)
-
 /** Locates an installed copy of this package inside a dependency tree. */
-const INSTALLED_PACKAGE_MARKER = `/node_modules/${PANTHEON_PACKAGE_NAME}/`
+const INSTALLED_PACKAGE_MARKER = '/node_modules/pantheon-opencode/'
 
 /**
  * Return the installed-package root containing a plugin path, or null when the
@@ -1403,10 +1362,8 @@ export function collectRegisteredPluginRefs(configs) {
         if (typeof ref === 'string') {
           refs.push({ path: ref, configPath: cfg.path, configLabel: cfg.label })
         } else if (ref && typeof ref === 'object') {
-          // npm plugin entries carry their identity under `package`; local
-          // entries use `path`/`source`. Preserve either so H3 can inspect the
-          // exact pinned npm version as well as installed filesystem copies.
-          const objectPath = ['package', 'path', 'source', 'id', 'name'].find(
+          // Object-shaped entries carry their path under `path`/`source`.
+          const objectPath = ['path', 'source', 'id', 'name'].find(
             (k) => typeof ref[k] === 'string',
           )
           if (objectPath) {
@@ -1419,20 +1376,6 @@ export function collectRegisteredPluginRefs(configs) {
   return refs
 }
 
-/**
- * Read an exact version from the package-root plugin syntax written by the
- * V2 installer (`pantheon-opencode@1.6.0`), including ANY semver prerelease
- * suffix (`-beta.11`, `-rc.1`, ...). Unpinned and unrelated packages
- * deliberately return null: H3 cannot infer their resolved npm cache version.
- * @param {string} pluginRef
- * @returns {string|null}
- */
-function readPinnedPantheonPluginVersion(pluginRef) {
-  if (typeof pluginRef !== 'string') return null
-  const match = pluginRef.match(PINNED_PLUGIN_SPEC_PATTERN)
-  return match?.[1] ?? null
-}
-
 /**
  * Compare the version of the package each registered plugin points into (when
  * it is an installed copy under node_modules/pantheon-opencode) against this
@@ -1461,21 +1404,6 @@ export function checkPluginVersionDrift(args) {
   let compared = 0
   let driftReported = false
   for (const ref of refs) {
-    const pinnedNpmVersion = readPinnedPantheonPluginVersion(ref.path)
-    if (pinnedNpmVersion) {
-      const identity = `npm:${PANTHEON_PACKAGE_NAME}@${pinnedNpmVersion}`
-      if (seen.has(identity)) continue
-      seen.add(identity)
-      compared++
-
-      if (classifyPluginVersionDrift(pinnedNpmVersion, packageVersion) !== 'drift') continue
-      driftReported = true
-      warn(
-        `${ref.configLabel}: V2 plugin is pinned to ${PANTHEON_PACKAGE_NAME}@${pinnedNpmVersion}, but this package is v${packageVersion} — the registered tool surface may be stale. Run \`npx pantheon-opencode init\` to realign the pinned plugin version`,
-      )
-      continue
-    }
-
     const absolute = isAbsolute(ref.path) ? ref.path : resolve(dirname(ref.configPath), ref.path)
     const installed = readInstalledPluginVersion(absolute)
     if (!installed) continue
@@ -1514,29 +1442,21 @@ export function checkPluginVersionDrift(args) {
  * The V2 contract is the PLURAL `plugins` key; V1 is the singular `plugin` key.
  * So the key alone is not the test — a config can legitimately carry a
  * third-party entry in `plugins`. What identifies the generation is a Pantheon
- * V2 entry inside it. Recognises the canonical directory, an absolute path,
- * the package subpath export, and the version-pinned package-root entry emitted
- * by the installer. The exact package name is checked to avoid matching
- * similarly named third-party plugins.
+ * V2 entry inside it. Matched on the `plugin-v2` marker so all three real
+ * spellings are recognised: the canonical DIRECTORY (`src/plugin-v2`), an
+ * absolute path to it, and the package export (`pantheon-opencode/plugin-v2`).
  *
  * @param {unknown} ref
  * @returns {boolean}
  */
 function isV2PluginRef(ref) {
-  const candidates =
+  const candidate =
     typeof ref === 'string'
-      ? [ref]
+      ? ref
       : ref && typeof ref === 'object'
-        ? ['package', 'path', 'source', 'id', 'name']
-            .map((key) => ref[key])
-            .filter((value) => typeof value === 'string')
-        : []
-  return candidates.some(
-    (candidate) =>
-      candidate.includes('plugin-v2') ||
-      candidate === PANTHEON_PACKAGE_NAME ||
-      candidate.startsWith(`${PANTHEON_PACKAGE_NAME}@`),
-  )
+        ? (ref.path ?? ref.source ?? ref.id ?? ref.name)
+        : undefined
+  return typeof candidate === 'string' && candidate.includes('plugin-v2')
 }
 
 /**
@@ -1912,9 +1832,7 @@ export function classifyNodeSqliteProbe(probe) {
   if (probe.available) {
     return {
       status: 'ok',
-      message:
-        `node:sqlite available on ${probe.version} — read-only SQLite backend prerequisite satisfied; ` +
-        'doctor does not verify pantheon_cost tool registration',
+      message: `node:sqlite available on ${probe.version} — pantheon_cost read-only backend supported`,
     }
   }
   return {

package/scripts/hooks/scan-secrets.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# scan-secrets.sh — Pantheon PreToolUse Secret Scanning Hook
+# Detects hardcoded secrets in tool input. Logs ALWAYS (masked); the exit
+# code drives the plugin's hybrid blocking (see pantheon-hooks.ts):
+#
+#   exit 0 — no match.
+#   exit 1 — LOW_CONFIDENCE match only (header/KEY NAMES such as the Bifrost header
+#            alone, api_key=/password=/secret= without a recognizable token
+#            value). Advisory: the plugin logs + toasts, does NOT block.
+#   exit 2 — HIGH_CONFIDENCE match (real token formats: sk-bf-<token>,
+#            AKIA..., ghp_..., glpat-..., sk_live_/sk_test_..., xox[baprs]-...,
+#            Bearer <token>, JWT). The plugin BLOCKS the tool call (throws
+#            after logging — the only deliberate throw in the plugin).
+#
+# Matches are always MASKED (first 4 + last 4 chars for len>8, else "****")
+# before being echoed — the hook trail must never contain a raw secret value.
+set -euo pipefail
+
+HIGH_CONFIDENCE_PATTERNS=(
+    "AKIA[0-9A-Z]{16}"
+    "gh[pousr]_[A-Za-z0-9_]{36,}"
+    "glpat-[A-Za-z0-9_\\-]{20}"
+    "sk-[a-zA-Z0-9]{20,}"
+    "sk_live_[a-zA-Z0-9]{20,}"
+    "sk_test_[a-zA-Z0-9]{20,}"
+    "xox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24}"
+    "bearer\\s+[a-zA-Z0-9_\\-\\.]{20,}"
+    "eyJ[A-Za-z0-9_-]*\\.eyJ[A-Za-z0-9_-]*\\.[A-Za-z0-9_-]*"
+)
+
+LOW_CONFIDENCE_PATTERNS=(
+    # KEY/header NAMES without a recognizable token value — high false-positive
+    # rate (e.g. the Bifrost header alone, api_key=longvalue, password="x", secret="y"):
+    # advisory only, never blocks.
+    "[a-zA-Z0-9_-]*api[_-]?key[a-zA-Z0-9_-]*\\s*[:=]\\s*[\"']?[a-zA-Z0-9_\\-]{16,}[\"']?"
+    "[a-zA-Z0-9_-]*password[a-zA-Z0-9_-]*\\s*[:=]\\s*[\"'][^\"']{8,}[\"']"
+    "[a-zA-Z0-9_-]*secret[a-zA-Z0-9_-]*\\s*[:=]\\s*[\"'][^\"']{8,}[\"']"
+)
+
+# Keep provider-specific markers assembled so this scanner is not self-matched
+# by the repository secret test.
+BIFROST_HEADER="x""-bf-""vk"
+BIFROST_TOKEN_PREFIX="sk""-bf-"
+HIGH_CONFIDENCE_PATTERNS+=("${BIFROST_TOKEN_PREFIX}[A-Za-z0-9_-]{8,}")
+LOW_CONFIDENCE_PATTERNS+=("$BIFROST_HEADER")
+
+# Mask a matched secret for safe logging: first 4 + last 4 chars (len > 8),
+# else fully hidden — short matches must not be reconstructable by
+# concatenating the visible slices.
+mask_secret() {
+    local match="$1"
+    if [[ ${#match} -le 8 ]]; then
+        echo "****"
+    else
+        echo "${match:0:4}****${match: -4}"
+    fi
+}
+
+INPUT="${1:-${TOOL_INPUT:-}}"
+if [[ -z "$INPUT" ]] && [[ ! -t 0 ]]; then
+    INPUT=$(cat)
+fi
+
+if [[ -z "$INPUT" ]]; then
+    exit 0
+fi
+
+FOUND_HIGH=0
+FOUND_LOW=0
+
+for pattern in "${HIGH_CONFIDENCE_PATTERNS[@]}"; do
+    if echo "$INPUT" | grep -iqE "$pattern"; then
+        MATCH=$(echo "$INPUT" | grep -ioE "$pattern" | head -1)
+        echo "[SECRET SCAN] High-confidence secret detected: $(mask_secret "$MATCH") (pattern: $pattern)" >&2
+        FOUND_HIGH=1
+    fi
+done
+
+for pattern in "${LOW_CONFIDENCE_PATTERNS[@]}"; do
+    if echo "$INPUT" | grep -iqE "$pattern"; then
+        MATCH=$(echo "$INPUT" | grep -ioE "$pattern" | head -1)
+        echo "[SECRET SCAN] Potential secret detected (low confidence): $(mask_secret "$MATCH") (pattern: $pattern)" >&2
+        FOUND_LOW=1
+    fi
+done
+
+if [[ $FOUND_HIGH -eq 1 ]]; then
+    echo "[SECRET SCAN] High-confidence hardcoded secret detected. Tool call will be BLOCKED." >&2
+    exit 2
+fi
+
+if [[ $FOUND_LOW -eq 1 ]]; then
+    echo "[SECRET SCAN] Possible secret detected. Remove it and use environment variables or a vault." >&2
+    exit 1
+fi
+
+exit 0

package/scripts/install/config-migration.mjs

@@ -29,25 +29,14 @@ function deepClone(obj) {
 // V1 → V2 helpers
 // ---------------------------------------------------------------------------
 
-/** Action name mapping for permissions (V1 key → V2 action) */
+/** Action name mapping for permissions (V1 key → V2 action), including task → subagent. */
 const V1_PERMISSION_TO_ACTION = {
   bash: 'shell',
-  skill: 'skill',
-  edit: 'edit',
-  // V2 folds V1's `write` tool permission into the `edit` action, which also
-  // governs write and patch tools. Keep `edit` as the canonical reverse name.
-  write: 'edit',
   task: 'subagent',
-  websearch: 'websearch',
-  // passthrough unknowns
-}
-
-const V2_ACTION_TO_V1_PERMISSION = {
-  shell: 'bash',
   skill: 'skill',
   edit: 'edit',
-  subagent: 'task',
   websearch: 'websearch',
+  // passthrough unknowns
 }
 
 /**
@@ -61,41 +50,15 @@ const V2_ACTION_TO_V1_PERMISSION = {
  */
 function convertPermissionsV1toV2(permObj) {
   const result = []
-  const resultIndices = new Map()
-  const effectRank = { allow: 0, ask: 1, deny: 2 }
-
-  const appendPermission = (action, resource, effect) => {
-    const key = JSON.stringify([action, resource])
-    const previousIndex = resultIndices.get(key)
-    if (previousIndex === undefined) {
-      resultIndices.set(key, result.length)
-      result.push({ action, resource, effect })
-      return
-    }
-
-    const previous = result[previousIndex]
-    if (previous.effect === effect) return
-
-    // V1 keeps `edit` and `write` as separate permission keys; V2's `edit`
-    // action covers both. If their rules collide on one resource, retain the
-    // stricter effect rather than letting object order turn a deny into allow.
-    console.warn(
-      `[config-migration] Conflicting V1 permission aliases for ${action}:${resource}; keeping the more restrictive effect`,
-    )
-    if ((effectRank[effect] ?? 0) > (effectRank[previous.effect] ?? 0)) {
-      previous.effect = effect
-    }
-  }
-
   for (const [key, value] of Object.entries(permObj)) {
     const action = V1_PERMISSION_TO_ACTION[key] || key
     if (typeof value === 'string') {
       // Simple: { edit: "allow" } → [{ action: "edit", resource: "*", effect: "allow" }]
-      appendPermission(action, '*', value)
+      result.push({ action, resource: '*', effect: value })
     } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
       // Nested: { bash: { "git *": "allow" } } → [{ action: "shell", resource: "git *", effect: "allow" }]
       for (const [resource, effect] of Object.entries(value)) {
-        appendPermission(action, resource, effect)
+        result.push({ action, resource, effect })
       }
     } else {
       console.warn(`[config-migration] Unexpected permission value for "${key}":`, value)
@@ -109,9 +72,13 @@ function convertPermissionsV1toV2(permObj) {
  */
 function convertPermissionsV2toV1(permArray) {
   const result = {}
+  // Reverse action mapping: V2 action → V1 key
+  const ACTION_TO_V1 = Object.fromEntries(
+    Object.entries(V1_PERMISSION_TO_ACTION).map(([k, v]) => [v, k]),
+  )
 
   for (const { action, resource, effect } of permArray) {
-    const v1Key = V2_ACTION_TO_V1_PERMISSION[action] || action
+    const v1Key = ACTION_TO_V1[action] || action
     if (resource === '*') {
       result[v1Key] = effect
     } else {

package/scripts/install/interactive.mjs

@@ -329,7 +329,7 @@ export async function runInteractiveInstall({ components = [], defaultComponents
     {
       name: 'skills',
       value: 'skills',
-      description: `Reusable skill workflows (${21} skills)`,
+      description: `Reusable skill workflows (${20} skills)`,
     },
     {
       name: 'instructions',