@cortexkit/opencode-magic-context 0.22.4 → 0.23.0

package/src/shared/live-server-client.ts

@@ -0,0 +1,152 @@
+/**
+ * Live-server client for the Channel 2 ctx_reduce ceiling nudge (a synthetic
+ * user `<system-reminder>` delivered via `promptAsync`).
+ *
+ * WHY a separate client instead of the plugin-provided `input.client`:
+ * OpenCode's plugin `input.client` routes through `Server.Default().app.fetch`,
+ * which uses a SEPARATE Effect `memoMap` from the live HTTP listener the UI
+ * uses. `SessionRunState` lives per-memoMap, so a plugin-origin `promptAsync`
+ * observes an "idle" runner while the live turn is still running, `ensureRunning`
+ * fails to coalesce, and OpenCode persists duplicate assistant children
+ * (upstream bug anomalyco/opencode#28202). Building a `createOpencodeClient`
+ * aimed at `input.serverUrl` via `globalThis.fetch` enters the SAME live
+ * listener, so `ensureRunning` sees the real run and coalesces — the synthetic
+ * message lands at the tail after the current assistant step.
+ *
+ * The live listener is only reachable on OpenCode Desktop (Electron+Node) and
+ * TUI launched with `--port 0`; plain TUI binds an internal listener that 404s
+ * `/session/*`. We probe once at init and cache per `serverUrl`. When
+ * unreachable, Channel 2 is DISABLED (Channel 1 + 85% force-materialization
+ * remain the backstop) — MC deliberately does NOT fall back to the in-process
+ * client because that would knowingly trigger #28202.
+ */
+
+import { createOpencodeClient } from "@opencode-ai/sdk";
+
+export type LiveServerClient = ReturnType<typeof createOpencodeClient>;
+
+const clientCache = new Map<string, LiveServerClient>();
+
+function cacheKey(serverUrl: string, directory: string): string {
+    return `${serverUrl}|${directory}`;
+}
+
+function normalizeServerUrl(serverUrl: string): string {
+    try {
+        return new URL(serverUrl).toString();
+    } catch {
+        return serverUrl;
+    }
+}
+
+/** Basic-auth header OpenCode expects when `OPENCODE_SERVER_PASSWORD` is set. */
+function serverAuthHeaders(): Record<string, string> | undefined {
+    const password = process.env.OPENCODE_SERVER_PASSWORD;
+    if (!password) return undefined;
+    const username = process.env.OPENCODE_SERVER_USERNAME ?? "opencode";
+    return {
+        Authorization: `Basic ${Buffer.from(`${username}:${password}`).toString("base64")}`,
+    };
+}
+
+/**
+ * Cached `createOpencodeClient` aimed at the live HTTP listener for the given
+ * `(serverUrl, directory)`. One client is reused across deliveries.
+ */
+export function getLiveServerClient(serverUrl: string, directory: string): LiveServerClient {
+    const key = cacheKey(serverUrl, directory);
+    const cached = clientCache.get(key);
+    if (cached) return cached;
+    const client = createOpencodeClient({
+        baseUrl: serverUrl,
+        directory,
+        headers: serverAuthHeaders(),
+        fetch: globalThis.fetch,
+    });
+    clientCache.set(key, client);
+    return client;
+}
+
+// Per-serverUrl wake decision + probe TTL. One plugin process can host multiple
+// OpenCode windows with different listener URLs, so the decision must be keyed.
+interface ProbeDecision {
+    reachable: boolean;
+    probedAt: number;
+}
+const wakeDecisionByServerUrl = new Map<string, ProbeDecision>();
+
+// Re-probe window: a transient 404/timeout shouldn't permanently disable
+// Channel 2 for the whole session lifetime (per council-r3).
+const PROBE_TTL_MS = 10 * 60_000;
+
+/**
+ * Probe whether `serverUrl` serves OpenCode's HTTP API within `timeoutMs`.
+ * `true` only when `/session` proves the API is usable: any 2xx, or 401/403
+ * (auth-protected listener still exists). `false` for 404 (plain TUI internal
+ * listener), 5xx, connection refused, DNS failure, timeout, or malformed URL.
+ * Records the result + timestamp in the per-serverUrl cache.
+ */
+export async function probeServerReachable(
+    serverUrl: string | undefined,
+    timeoutMs = 1500,
+): Promise<boolean> {
+    if (!serverUrl) return false;
+    const normalized = normalizeServerUrl(serverUrl);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let reachable = false;
+    try {
+        const probeUrl = new URL("/session", serverUrl).toString();
+        const res = await globalThis.fetch(probeUrl, {
+            method: "GET",
+            headers: serverAuthHeaders(),
+            signal: controller.signal,
+        });
+        reachable = res.ok || res.status === 401 || res.status === 403;
+    } catch {
+        reachable = false;
+    } finally {
+        clearTimeout(timer);
+        wakeDecisionByServerUrl.set(normalized, { reachable, probedAt: Date.now() });
+    }
+    return reachable;
+}
+
+/** Record a probe result directly (test helper / explicit override). */
+export function setLiveServerWakeAvailable(
+    serverUrl: string | undefined,
+    available: boolean,
+): void {
+    if (!serverUrl) return;
+    wakeDecisionByServerUrl.set(normalizeServerUrl(serverUrl), {
+        reachable: available,
+        probedAt: Date.now(),
+    });
+}
+
+/**
+ * Should Channel 2 deliver through the live-server client for `serverUrl`?
+ * Returns false when never probed or the last probe failed. A stale decision
+ * (older than the TTL) returns false so the caller re-probes before delivering.
+ */
+export function useLiveServerWake(serverUrl?: string): boolean {
+    if (!serverUrl) return false;
+    const decision = wakeDecisionByServerUrl.get(normalizeServerUrl(serverUrl));
+    if (!decision) return false;
+    if (Date.now() - decision.probedAt > PROBE_TTL_MS) return false;
+    return decision.reachable;
+}
+
+/** True when a usable (non-stale) probe decision exists, regardless of outcome. */
+export function hasFreshProbe(serverUrl?: string): boolean {
+    if (!serverUrl) return false;
+    const decision = wakeDecisionByServerUrl.get(normalizeServerUrl(serverUrl));
+    if (!decision) return false;
+    return Date.now() - decision.probedAt <= PROBE_TTL_MS;
+}
+
+/** Test helper — reset both caches between cases. */
+export function __resetLiveServerClientForTests(): void {
+    clientCache.clear();
+    wakeDecisionByServerUrl.clear();
+}

package/src/shared/prompt-context.ts

@@ -0,0 +1,135 @@
+/**
+ * Resolve the newest effective prompt context (agent + model + variant) for a
+ * session by reading recent messages from the OpenCode HTTP API.
+ *
+ * WHY: a Channel 2 ceiling nudge sends a synthetic user message via
+ * `promptAsync` with `noReply:false` (it DOES trigger an assistant turn).
+ * OpenCode's `createUserMessage` resolves variant relative to the chosen
+ * agent; passing model alone makes OpenCode pick the default agent whose model
+ * check then fails, bypassing the active variant and busting the provider
+ * prefix cache the prior turn warmed. So we pass agent + model + variant
+ * explicitly, mirroring the resolution AFT/opencode-xtra use for their wake
+ * notifications.
+ *
+ * Walk newest→oldest and merge field-by-field so the newest context-bearing
+ * message wins while older messages only fill fields it did not provide. Read
+ * BOTH the flat shape (`info.providerID`) used by AssistantMessage and the
+ * nested shape (`info.model.providerID`) used by UserMessage.
+ *
+ * Bounded via `query.limit` — the legacy `/session/{id}/message` endpoint
+ * hydrates the ENTIRE session without it (30k-45k messages on large sessions).
+ */
+
+export interface ResolvedPromptContext {
+    agent?: string;
+    model?: { providerID: string; modelID: string };
+    variant?: string;
+}
+
+interface RawInfo {
+    role?: string;
+    agent?: string;
+    variant?: string;
+    providerID?: string;
+    modelID?: string;
+    model?: { providerID?: string; modelID?: string; variant?: string };
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+    return typeof value === "object" && value !== null;
+}
+
+function extractMessages(response: unknown): unknown[] {
+    if (Array.isArray(response)) return response;
+    if (isRecord(response) && Array.isArray(response.data)) return response.data;
+    return [];
+}
+
+function extractFromMessage(message: unknown): ResolvedPromptContext | null {
+    if (!isRecord(message) || !isRecord(message.info)) return null;
+    const info = message.info as RawInfo;
+    const modelInfo = isRecord(info.model) ? info.model : undefined;
+
+    const agent = typeof info.agent === "string" ? info.agent : undefined;
+    const providerID =
+        typeof modelInfo?.providerID === "string"
+            ? modelInfo.providerID
+            : typeof info.providerID === "string"
+              ? info.providerID
+              : undefined;
+    const modelID =
+        typeof modelInfo?.modelID === "string"
+            ? modelInfo.modelID
+            : typeof info.modelID === "string"
+              ? info.modelID
+              : undefined;
+    const variant =
+        typeof modelInfo?.variant === "string"
+            ? modelInfo.variant
+            : typeof info.variant === "string"
+              ? info.variant
+              : undefined;
+
+    if (!agent && (!providerID || !modelID) && !variant) return null;
+    const out: ResolvedPromptContext = {};
+    if (agent) out.agent = agent;
+    if (providerID && modelID) out.model = { providerID, modelID };
+    if (variant) out.variant = variant;
+    return out;
+}
+
+function mergeContexts(
+    base: ResolvedPromptContext,
+    patch: ResolvedPromptContext,
+): ResolvedPromptContext {
+    return {
+        agent: base.agent ?? patch.agent,
+        model: base.model ?? patch.model,
+        variant: base.variant ?? patch.variant,
+    };
+}
+
+function isComplete(ctx: ResolvedPromptContext): boolean {
+    return Boolean(ctx.agent && ctx.model && ctx.variant);
+}
+
+const PROMPT_CONTEXT_MESSAGE_LIMIT = 50;
+
+export async function resolvePromptContext(
+    client: unknown,
+    sessionId: string,
+): Promise<ResolvedPromptContext | null> {
+    if (!client || !sessionId) return null;
+    const c = client as {
+        session?: {
+            messages?: (input: {
+                path: { id: string };
+                query?: { limit?: number };
+            }) => Promise<{ data?: unknown[] } | unknown[]>;
+        };
+    };
+    if (typeof c.session?.messages !== "function") return null;
+
+    let messages: unknown[] = [];
+    try {
+        const response = await c.session.messages({
+            path: { id: sessionId },
+            query: { limit: PROMPT_CONTEXT_MESSAGE_LIMIT },
+        });
+        messages = extractMessages(response);
+    } catch {
+        return null;
+    }
+    if (messages.length === 0) return null;
+
+    let result: ResolvedPromptContext = {};
+    for (let i = messages.length - 1; i >= 0; i -= 1) {
+        const ctx = extractFromMessage(messages[i]);
+        if (!ctx) continue;
+        result = mergeContexts(result, ctx);
+        if (isComplete(result)) return result;
+    }
+
+    if (!result.agent && !result.model && !result.variant) return null;
+    return result;
+}

package/src/shared/rpc-server.ts

@@ -1,4 +1,4 @@
-import { randomBytes } from "node:crypto";
+import { randomBytes, timingSafeEqual } from "node:crypto";
 import {
     mkdirSync,
     readdirSync,
@@ -14,6 +14,19 @@ import { isPidAlive, parseRpcPortFile, rpcPortDir, rpcPortFilePath } from "./rpc
 
 type RpcHandler = (params: Record<string, unknown>) => Promise<Record<string, unknown>>;
 
+/**
+ * Constant-time bearer-token comparison. `timingSafeEqual` throws on
+ * length-mismatched buffers, so guard on length first (the length itself is not
+ * secret — the token bytes are). Avoids leaking the token via response-timing on
+ * the loopback auth check.
+ */
+function tokensMatch(presented: string, expected: string): boolean {
+    const a = Buffer.from(presented, "utf8");
+    const b = Buffer.from(expected, "utf8");
+    if (a.length !== b.length) return false;
+    return timingSafeEqual(a, b);
+}
+
 export class MagicContextRpcServer {
     private server: Server | null = null;
     private port = 0;
@@ -149,9 +162,12 @@ export class MagicContextRpcServer {
         // Require the per-process bearer token on every side-effecting call.
         // The legitimate TUI client reads it from the same port file it used to
         // discover the port; a process that only guessed the port cannot.
+        // Constant-time compare so a local attacker can't byte-probe the token
+        // via response-timing (length-guard first, since timingSafeEqual throws
+        // on length mismatch).
         const auth = req.headers.authorization;
         const presented = typeof auth === "string" ? auth.replace(/^Bearer\s+/i, "") : "";
-        if (presented !== this.token) {
+        if (!tokensMatch(presented, this.token)) {
             res.writeHead(401, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ error: "Unauthorized" }));
             req.resume();

package/src/shared/rpc-types.ts

@@ -97,7 +97,6 @@ export interface StatusDetail extends SidebarSnapshot {
     activeBytes: number;
     lastResponseTime: number;
     lastNudgeTokens: number;
-    lastNudgeBand: string;
     lastTransformError: string | null;
     isSubagent: boolean;
     pendingOps: Array<{ tagId: number; operation: string }>;
@@ -118,9 +117,7 @@ export interface StatusDetail extends SidebarSnapshot {
      */
     executeThresholdTokens?: number;
     protectedTagCount: number;
-    nudgeInterval: number;
     historyBudgetPercentage: number;
-    nextNudgeAfter: number;
     historyBlockTokens: number;
     compressionBudget: number | null;
     compressionUsage: string | null;

package/src/shared/safe-notification-target.test.ts

@@ -0,0 +1,97 @@
+import { describe, expect, it } from "bun:test";
+import { isDefaultSessionTitle, waitForSafeNotificationTarget } from "./safe-notification-target";
+
+function clientWithTitle(title: string | undefined, calls?: { count: number }) {
+    return {
+        session: {
+            get: async (_input: unknown) => {
+                if (calls) calls.count += 1;
+                return { data: { title } };
+            },
+        },
+    };
+}
+
+describe("isDefaultSessionTitle", () => {
+    it("matches OpenCode default titles for parent and child sessions", () => {
+        expect(isDefaultSessionTitle("New session - 2026-06-10T15:33:11.538Z")).toBe(true);
+        expect(isDefaultSessionTitle("Child session - 2026-01-02T03:04:05.678Z")).toBe(true);
+    });
+
+    it("does not match real titles", () => {
+        expect(isDefaultSessionTitle("Quick test")).toBe(false);
+        expect(isDefaultSessionTitle("New session - notes")).toBe(false);
+        // Prefix alone isn't enough — the timestamp must match exactly,
+        // mirroring OpenCode's Session.isDefaultTitle.
+        expect(isDefaultSessionTitle("New session - 2026-06-10")).toBe(false);
+    });
+});
+
+describe("waitForSafeNotificationTarget", () => {
+    it("returns safe immediately for a titled session", async () => {
+        const calls = { count: 0 };
+        const result = await waitForSafeNotificationTarget(
+            clientWithTitle("Fix tagger collision", calls),
+            "ses-titled",
+            { attempts: 4, delayMs: 1 },
+        );
+        expect(result).toBe("safe");
+        expect(calls.count).toBe(1);
+    });
+
+    it("returns skip after exhausting attempts on a default-titled session", async () => {
+        const calls = { count: 0 };
+        const result = await waitForSafeNotificationTarget(
+            clientWithTitle("New session - 2026-06-10T15:33:11.538Z", calls),
+            "ses-fresh",
+            { attempts: 3, delayMs: 1 },
+        );
+        expect(result).toBe("skip");
+        expect(calls.count).toBe(3);
+    });
+
+    it("returns safe once the title flips to a real one mid-retry", async () => {
+        let call = 0;
+        const client = {
+            session: {
+                get: async () => {
+                    call += 1;
+                    return {
+                        data: {
+                            title: call < 2 ? "New session - 2026-06-10T15:33:11.538Z" : "Greeting",
+                        },
+                    };
+                },
+            },
+        };
+        const result = await waitForSafeNotificationTarget(client, "ses-flip", {
+            attempts: 4,
+            delayMs: 1,
+        });
+        expect(result).toBe("safe");
+        expect(call).toBe(2);
+    });
+
+    it("fails open when the client cannot report a title", async () => {
+        expect(
+            await waitForSafeNotificationTarget({}, "ses-no-api", { attempts: 2, delayMs: 1 }),
+        ).toBe("safe");
+        const throwing = {
+            session: {
+                get: async () => {
+                    throw new Error("transport down");
+                },
+            },
+        };
+        expect(
+            await waitForSafeNotificationTarget(throwing, "ses-throw", { attempts: 2, delayMs: 1 }),
+        ).toBe("safe");
+        // Direct-shape response (no `.data` wrapper) is also recognized.
+        const direct = {
+            session: { get: async () => ({ title: "Real title" }) },
+        };
+        expect(
+            await waitForSafeNotificationTarget(direct, "ses-direct", { attempts: 2, delayMs: 1 }),
+        ).toBe("safe");
+    });
+});

package/src/shared/safe-notification-target.ts

@@ -0,0 +1,102 @@
+import { log } from "./logger";
+
+/**
+ * Guard for ignored-message notification posting: only post into sessions
+ * that already carry a REAL title.
+ *
+ * Why: OpenCode's title generation (SessionPrompt.ensureTitle) silently and
+ * PERMANENTLY skips a session once it contains more than one non-synthetic
+ * user message. Our notification posts (config warnings, conflict warnings,
+ * schema-fence warnings, startup announcements) are `ignored: true` — hidden
+ * from the LLM — but NOT `synthetic: true`, so the title gate counts them as
+ * real user messages. A notification landing in a fresh session before the
+ * user's first prompt therefore suppressed that session's title forever
+ * (issue #129; only repros where the new session is the project's only one,
+ * e.g. fresh non-git directories).
+ *
+ * We deliberately do NOT mark our posts `synthetic: true` instead: the
+ * Desktop renderer (UserMessageDisplay) picks the first NON-synthetic text
+ * part, so synthetic would blank the message on Desktop — the only surface
+ * these posts exist for.
+ *
+ * ensureTitle short-circuits on `!isDefaultTitle(session.title)` before the
+ * message count, so posting into an already-titled session can never affect
+ * titling. Callers must NOT mark a notification as delivered when this guard
+ * returns "skip", so the next startup retries.
+ */
+
+/**
+ * Mirrors OpenCode's Session.isDefaultTitle (session.ts): a default title is
+ * `New session - <ISO>` or `Child session - <ISO>`.
+ */
+const DEFAULT_TITLE_RE =
+    /^(New session - |Child session - )\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+
+export function isDefaultSessionTitle(title: string): boolean {
+    return DEFAULT_TITLE_RE.test(title);
+}
+
+/**
+ * Read a session's current title via the SDK client. Returns null when the
+ * title cannot be determined (missing API, transport error, unexpected
+ * shape) — callers treat that as "fail open" and post, preserving delivery
+ * on clients/tests that don't expose session.get.
+ */
+async function readSessionTitle(client: unknown, sessionId: string): Promise<string | null> {
+    try {
+        const c = client as {
+            session?: { get?: (input: unknown) => unknown };
+        };
+        if (typeof c.session?.get !== "function") return null;
+        const raw = await Promise.resolve(c.session.get({ path: { id: sessionId } }));
+        // SDK response shapes vary across versions: `{ data: { title } }` or
+        // the session object directly.
+        const obj = raw as { data?: { title?: unknown }; title?: unknown } | null;
+        const title = obj && typeof obj === "object" ? (obj.data?.title ?? obj.title) : undefined;
+        return typeof title === "string" ? title : null;
+    } catch {
+        return null;
+    }
+}
+
+export interface SafeTargetOptions {
+    /** Total title checks before giving up (default 4). */
+    attempts?: number;
+    /** Delay between checks in ms (default 15s). */
+    delayMs?: number;
+}
+
+/**
+ * Resolve whether `sessionId` is safe to receive an ignored-message post.
+ *
+ * - "safe": the session has a real (non-default) title, or the title is
+ *   unreadable (fail-open).
+ * - "skip": the session still has OpenCode's default title after all
+ *   attempts — posting now could permanently suppress its title generation.
+ *   The caller must leave its delivered/seen marker unset so a later
+ *   startup retries.
+ *
+ * The retry window exists for the common startup case: plugin init fires a
+ * few seconds after launch, the user prompts shortly after, and the title
+ * lands within seconds of that first prompt.
+ */
+export async function waitForSafeNotificationTarget(
+    client: unknown,
+    sessionId: string,
+    options?: SafeTargetOptions,
+): Promise<"safe" | "skip"> {
+    const attempts = Math.max(1, options?.attempts ?? 4);
+    const delayMs = options?.delayMs ?? 15_000;
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
+        const title = await readSessionTitle(client, sessionId);
+        if (title === null) return "safe";
+        if (!isDefaultSessionTitle(title)) return "safe";
+        if (attempt < attempts - 1) {
+            await new Promise((resolve) => setTimeout(resolve, delayMs));
+        }
+    }
+    log(
+        `[magic-context] notification skipped: session ${sessionId} still has its default title (would suppress title generation); will retry on a later startup`,
+    );
+    return "skip";
+}

package/src/shared/tag-transcript.test.ts

@@ -159,7 +159,12 @@ describe("tagTranscript tool aggregation", () => {
             commit() {},
         };
 
-        const { targets } = tagTranscript("session-1", transcript, tagger, {} as ContextDatabase);
+        const { targets } = tagTranscript(
+            "session-1",
+            transcript,
+            tagger,
+            new FakeDb() as unknown as ContextDatabase,
+        );
 
         const firstTag = tagger.getToolTag("session-1", "read:32", "assistant-1");
         const secondTag = tagger.getToolTag("session-1", "read:32", "assistant-2");
@@ -185,7 +190,12 @@ describe("tagTranscript tool aggregation", () => {
             commit() {},
         };
 
-        const { targets } = tagTranscript("session-1", transcript, tagger, {} as ContextDatabase);
+        const { targets } = tagTranscript(
+            "session-1",
+            transcript,
+            tagger,
+            new FakeDb() as unknown as ContextDatabase,
+        );
         const tag = tagger.getToolTag("session-1", "read:99", "assistant-1");
 
         let result: "truncated" | "absent" | undefined;
@@ -210,7 +220,12 @@ describe("tagTranscript tool aggregation", () => {
             commit() {},
         };
 
-        const { targets } = tagTranscript("session-1", transcript, tagger, {} as ContextDatabase);
+        const { targets } = tagTranscript(
+            "session-1",
+            transcript,
+            tagger,
+            new FakeDb() as unknown as ContextDatabase,
+        );
         const tag = tagger.getToolTag("session-1", "read:multi", "assistant-1");
 
         expect(targets.size).toBe(1);
@@ -235,7 +250,12 @@ describe("tagTranscript tool aggregation", () => {
             commit() {},
         };
 
-        const { targets } = tagTranscript("session-1", transcript, tagger, {} as ContextDatabase);
+        const { targets } = tagTranscript(
+            "session-1",
+            transcript,
+            tagger,
+            new FakeDb() as unknown as ContextDatabase,
+        );
 
         const olderTag = tagger.getToolTag("session-1", "read:reused", "assistant-old");
         const nearestTag = tagger.getToolTag("session-1", "read:reused", "assistant-near");
@@ -272,9 +292,15 @@ describe("tagTranscript tool aggregation", () => {
 
         const tag = tagger.getToolTag("session-1", "read:image", "assistant-1");
         expect(tag).toBeDefined();
-        expect(tagger.byteSizes.get(tag ?? -1)).toBe(2);
-        expect(db.byteSizeUpdates).toHaveLength(1);
-        expect(db.byteSizeUpdates[0]?.tagNumber).toBe(tag);
-        expect(db.byteSizeUpdates[0]?.byteSize).toBeGreaterThan(512);
+        // byte_size is OUTPUT-only: the tag reserves at 0 on the tool_use
+        // occurrence (args live in inputByteSize), then updates to the real
+        // result payload size when the tool_result (incl. the non-text image
+        // block) is seen — proving non-text content is byte-accounted.
+        expect(tagger.byteSizes.get(tag ?? -1)).toBe(0);
+        // Two tool_result blocks (caption text + image) under one callId; the
+        // tag byte_size climbs to the LARGEST output block (the image > 512B).
+        const updatesForTag = db.byteSizeUpdates.filter((u) => u.tagNumber === tag);
+        expect(updatesForTag.length).toBeGreaterThanOrEqual(1);
+        expect(Math.max(...updatesForTag.map((u) => u.byteSize))).toBeGreaterThan(512);
     });
 });