@openchambery/web 1.19.11 → 1.19.13-beta.1

package/server/lib/llm/DOCUMENTATION.md

@@ -29,27 +29,40 @@ The 1.18.4 client exposes `GET /provider`, `GET /config/providers`, and
    the response is JSON (`Content-Type` or a JSON object body). SPA / OpenCode
    HTML `200 <!doctype` is not generate — fall through to the throwaway path.
    Bundled 1.18.4 has no sessionless generate.
-2. Otherwise create a throwaway archived OpenCode session, deny every tool
-   (`client.tool.ids()` → `{ [id]: false }`), send our messages as
-   `system` + user text via `session.promptAsync` (v2 `session.prompt` only
-   forwards `{ id, prompt, delivery, resume }` and drops `model`/`parts` —
-   that produced empty assistant text and a 502). Contact file parts reuse the
-   existing OpenCode `{ type: 'file', mime, url, filename? }` delivery shape
-   (data URLs in the contact SQLite store — not a second attachment store) and
-   are forwarded on `promptAsync` only when the connected catalog marks that
-   model as image-capable (`modalities.input`, `input`, or `attachment`).
-   Non-vision models (for example deepseek-v4-flash) keep the `[image: …]`
-   description and any text-file bytes, and skip image data URLs so generate
-   cannot stall on unsupported vision parts. Non-image
-    text files are also inlined into the flattened prompt. Wait for idle via
-    `session.status` + `session.messages`, then delete the session. Throwaway
-    sessions are created with
-    `metadata.openchamber.llm.purpose = 'chat-completions'` (and archived
-    immediately) so sidebar visibility, session-index, session-title, and
-    notification/push fanout treat them as system-owned — same contract as
+2. Otherwise create a throwaway archived OpenCode session under a hidden
+   `openchamber-llm` agent whose frontmatter uses OpenCode 1.18
+   `permission: { "*": deny }` (not legacy `action`/`resource`/`effect` lists —
+   those load without a terminal `*` deny). `session.create` also sets
+   `permission: [{ permission: '*', pattern: '*', action: 'deny' }]` (SDK
+   PermissionRuleset; verified to round-trip on the session object). Deny every
+   catalog tool via `client.tool.ids()` → `{ [id]: false }` on `promptAsync`;
+   a `tool.ids` SDK/transport error fails generate (never silent empty deny).
+   Send messages as `system` + user text via `session.promptAsync` (v2
+   `session.prompt` only forwards `{ id, prompt, delivery, resume }` and drops
+   `model`/`parts` — that produced empty assistant text and a 502). Contact
+   file parts reuse the existing OpenCode `{ type: 'file', mime, url, filename? }`
+   delivery shape (data URLs in the contact SQLite store — not a second
+   attachment store) and are forwarded on `promptAsync` only when the connected
+   catalog marks that model as image-capable (`modalities.input`, `input`, or
+   `attachment`). Non-vision models (for example deepseek-v4-flash) keep the
+   `[image: …]` description and any text-file bytes, and skip image data URLs so
+   generate cannot stall on unsupported vision parts. Non-image text files are
+   also inlined into the flattened prompt. Wait for idle via `session.status` +
+   `session.messages`; a deterministic `session.messages` SDK error (for example
+   HTTP 400) fails generate immediately. Then delete the session and surface
+   delete SDK errors in diagnostics without erasing a successful text result.
+    Throwaway sessions use `metadata.openchamber.llm.purpose = 'chat-completions'`
+    (and archived immediately) so sidebar visibility, session-index, session-title,
+    and notification/push fanout treat them as system-owned — same contract as
     non-empty `smallModel.purpose`. This is a text generator only — never the
     contact transcript and never a coding SessionPrompt loop. Upstream
     `info.error.message` is forwarded on 502.
+    `ensureLlmTempDirectory` keeps one process-wide throwaway root (`openchamber-llm-…`).
+    Concurrent first callers share a single `mkdtemp` inflight; every caller still
+    writes/refreshes `.opencode/agent/<name>.md` after settle so a mid-flight ensure
+    cannot skip a newer agent body. Concurrent warm refreshes serialize through one
+    write chain (last committed body wins; no interleaved partial writes).
+    `stopLlmTempDirectory` clears the singleton for shutdown/tests.
 
 ### Internal token callback (in-process only)
 

package/server/lib/llm/catalog.js

@@ -5,8 +5,19 @@ const stringID = (value) => (typeof value === 'string' && value.trim() ? value.t
 const listIncludesImage = (value) => Array.isArray(value)
   && value.some((item) => String(item).toLowerCase() === 'image');
 
-function modelAcceptsImages(model) {
+/**
+ * Vision capability projection.
+ * Prefer authoritative OpenCode SDK Model.capabilities (`input.image` / `attachment`),
+ * then fall back to legacy modalities/input/attachment shapes used by older fixtures.
+ */
+export function modelAcceptsImages(model) {
   if (!isRecord(model)) return false;
+  if (isRecord(model.capabilities)) {
+    if (isRecord(model.capabilities.input) && typeof model.capabilities.input.image === 'boolean') {
+      return model.capabilities.input.image === true;
+    }
+    if (model.capabilities.attachment === true) return true;
+  }
   if (isRecord(model.modalities) && listIncludesImage(model.modalities.input)) return true;
   if (listIncludesImage(model.input)) return true;
   return model.attachment === true;
@@ -40,7 +51,12 @@ export function projectConnectedModels(source) {
       if (!isRecord(model)) continue;
       const modelID = stringID(model.id);
       if (!modelID) continue;
-      const entry = { providerID, modelID, name: stringID(model.name) || modelID, acceptsImages: modelAcceptsImages(model) };
+      const entry = {
+        providerID,
+        modelID,
+        name: stringID(model.name) || modelID,
+        acceptsImages: modelAcceptsImages(model),
+      };
       models.push(entry);
       providerModels.push({ id: modelID, name: entry.name });
     }
@@ -76,25 +92,84 @@ export function isConnectedModel(catalog, providerID, modelID) {
   return catalog.models.some((entry) => entry.providerID === providerID && entry.modelID === modelID);
 }
 
+/** Bound provider/config catalog loads so a pending SDK call cannot stall a contact lane. */
+export const CONNECTED_CATALOG_TIMEOUT_MS = 8_000;
+
+const isAbortError = (error) => (
+  error?.name === 'AbortError'
+  || error?.code === 'ABORT_ERR'
+  || (typeof error?.message === 'string' && /aborted|timed out/i.test(error.message))
+);
+
 /**
  * Load the connected catalog from an OpenCode SDK client.
  * Failure is distinct from a successful empty catalog.
+ * Uses a bounded AbortSignal (default 8s) on provider.list + config.providers.
+ *
+ * @param {object} client
+ * @param {{ signal?: AbortSignal, timeoutMs?: number }} [options]
  */
-export async function loadConnectedCatalog(client) {
-  const listed = await client.provider.list({});
-  if (listed?.error || !isRecord(listed?.data)) {
-    const error = new Error('OpenCode provider list is unavailable');
-    error.code = 'upstream_error';
-    throw error;
+export async function loadConnectedCatalog(client, options = {}) {
+  const timeoutMs = Number.isFinite(options.timeoutMs) && options.timeoutMs > 0
+    ? Math.trunc(options.timeoutMs)
+    : CONNECTED_CATALOG_TIMEOUT_MS;
+  const parentSignal = options.signal;
+  const controller = new AbortController();
+  const onParentAbort = () => {
+    try {
+      controller.abort(parentSignal?.reason instanceof Error
+        ? parentSignal.reason
+        : new Error('Connected catalog aborted'));
+    } catch {
+      // ignore
+    }
+  };
+  if (parentSignal) {
+    if (parentSignal.aborted) onParentAbort();
+    else parentSignal.addEventListener('abort', onParentAbort, { once: true });
   }
-  const configured = await client.config.providers({});
-  if (configured?.error || !isRecord(configured?.data)) {
-    const error = new Error('OpenCode provider catalog is unavailable');
-    error.code = 'upstream_error';
+  const timer = setTimeout(() => {
+    try {
+      controller.abort(new Error(`Connected catalog timed out after ${timeoutMs}ms`));
+    } catch {
+      // ignore
+    }
+  }, timeoutMs);
+  timer.unref?.();
+
+  const requestOptions = { signal: controller.signal };
+  try {
+    const listed = await client.provider.list({}, requestOptions);
+    if (listed?.error || !isRecord(listed?.data)) {
+      const error = new Error('OpenCode provider list is unavailable');
+      error.code = 'upstream_error';
+      throw error;
+    }
+    const configured = await client.config.providers({}, requestOptions);
+    if (configured?.error || !isRecord(configured?.data)) {
+      const error = new Error('OpenCode provider catalog is unavailable');
+      error.code = 'upstream_error';
+      throw error;
+    }
+    return projectConnectedModels({
+      connected: listed.data.connected,
+      providers: configured.data.providers,
+    });
+  } catch (error) {
+    if (controller.signal.aborted || isAbortError(error)) {
+      const timedOut = typeof error?.message === 'string' && /timed out/i.test(error.message)
+        || (controller.signal.reason instanceof Error && /timed out/i.test(controller.signal.reason.message));
+      const next = new Error(
+        timedOut
+          ? `Connected catalog timed out after ${timeoutMs}ms`
+          : 'Connected catalog request was aborted',
+      );
+      next.code = 'upstream_error';
+      throw next;
+    }
     throw error;
+  } finally {
+    clearTimeout(timer);
+    parentSignal?.removeEventListener?.('abort', onParentAbort);
   }
-  return projectConnectedModels({
-    connected: listed.data.connected,
-    providers: configured.data.providers,
-  });
 }

package/server/lib/llm/catalog.test.js

@@ -1,5 +1,11 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { loadConnectedCatalog, parseModelRef, projectConnectedModels } from './catalog.js'
+import {
+  CONNECTED_CATALOG_TIMEOUT_MS,
+  loadConnectedCatalog,
+  modelAcceptsImages,
+  parseModelRef,
+  projectConnectedModels,
+} from './catalog.js'
 
 describe('parseModelRef', () => {
   it('splits provider/model refs', () => {
@@ -22,6 +28,56 @@ describe('parseModelRef', () => {
   })
 })
 
+describe('modelAcceptsImages', () => {
+  it('prefers authoritative SDK capabilities.input.image (Grok-shaped)', () => {
+    // Real OpenCode Model shape from types.gen Model.capabilities
+    expect(modelAcceptsImages({
+      id: 'grok-4.6',
+      name: 'Grok 4.6',
+      capabilities: {
+        temperature: true,
+        reasoning: true,
+        attachment: true,
+        toolcall: true,
+        input: { text: true, audio: false, image: true, video: false, pdf: false },
+        output: { text: true, audio: false, image: false, video: false, pdf: false },
+        interleaved: false,
+      },
+    })).toBe(true)
+
+    expect(modelAcceptsImages({
+      id: 'deepseek-v4-flash',
+      capabilities: {
+        temperature: false,
+        reasoning: false,
+        attachment: false,
+        toolcall: true,
+        input: { text: true, audio: false, image: false, video: false, pdf: false },
+        output: { text: true, audio: false, image: false, video: false, pdf: false },
+        interleaved: false,
+      },
+    })).toBe(false)
+  })
+
+  it('does not let legacy attachment override explicit capabilities.input.image=false', () => {
+    expect(modelAcceptsImages({
+      attachment: true,
+      modalities: { input: ['text', 'image'] },
+      capabilities: {
+        attachment: false,
+        input: { text: true, image: false },
+      },
+    })).toBe(false)
+  })
+
+  it('falls back to legacy modalities/attachment when capabilities are absent', () => {
+    expect(modelAcceptsImages({ modalities: { input: ['text', 'image'] } })).toBe(true)
+    expect(modelAcceptsImages({ input: ['image'] })).toBe(true)
+    expect(modelAcceptsImages({ attachment: true })).toBe(true)
+    expect(modelAcceptsImages({ id: 'plain' })).toBe(false)
+  })
+})
+
 describe('projectConnectedModels', () => {
   it('projects only connected providers', () => {
     const catalog = projectConnectedModels({
@@ -46,21 +102,44 @@ describe('projectConnectedModels', () => {
     ])
   })
 
-  it('marks vision models from modalities or attachment', () => {
+  it('marks vision from SDK capabilities and legacy modalities', () => {
     const catalog = projectConnectedModels({
-      connected: ['openai'],
-      providers: [{
-        id: 'openai',
-        name: 'OpenAI',
-        models: {
-          'gpt-4o': { id: 'gpt-4o', name: 'GPT-4o', modalities: { input: ['text', 'image'] } },
-          'deepseek-v4-flash': { id: 'deepseek-v4-flash', name: 'deepseek-v4-flash' },
+      connected: ['openai', 'xai'],
+      providers: [
+        {
+          id: 'openai',
+          name: 'OpenAI',
+          models: {
+            'gpt-4o': { id: 'gpt-4o', name: 'GPT-4o', modalities: { input: ['text', 'image'] } },
+            'deepseek-v4-flash': { id: 'deepseek-v4-flash', name: 'deepseek-v4-flash' },
+          },
         },
-      }],
+        {
+          id: 'xai',
+          name: 'xAI',
+          models: {
+            'grok-4.6': {
+              id: 'grok-4.6',
+              name: 'Grok 4.6',
+              // Authoritative SDK shape — no modalities.input array
+              capabilities: {
+                temperature: true,
+                reasoning: true,
+                attachment: true,
+                toolcall: true,
+                input: { text: true, audio: false, image: true, video: false, pdf: false },
+                output: { text: true, audio: false, image: false, video: false, pdf: false },
+                interleaved: false,
+              },
+            },
+          },
+        },
+      ],
     })
     expect(catalog.models.find((model) => model.modelID === 'gpt-4o')?.acceptsImages).toBe(true)
+    expect(catalog.models.find((model) => model.modelID === 'grok-4.6')?.acceptsImages).toBe(true)
     expect(catalog.models.find((model) => model.modelID === 'deepseek-v4-flash')?.acceptsImages).toBe(false)
-    expect(catalog.connected).toEqual(['openai'])
+    expect(catalog.connected).toEqual(['openai', 'xai'])
   })
 })
 
@@ -75,4 +154,66 @@ describe('loadConnectedCatalog', () => {
       config: { providers: async () => ({ error: { status: 500 } }) },
     })).rejects.toThrow(/provider catalog/)
   })
+
+  it('passes AbortSignal to provider.list and config.providers', async () => {
+    const signals = []
+    const catalog = await loadConnectedCatalog({
+      provider: {
+        list: async (_params, options) => {
+          signals.push(options?.signal)
+          return { data: { connected: ['xai'] } }
+        },
+      },
+      config: {
+        providers: async (_params, options) => {
+          signals.push(options?.signal)
+          return {
+            data: {
+              providers: [{
+                id: 'xai',
+                name: 'xAI',
+                models: {
+                  'grok-4.6': {
+                    id: 'grok-4.6',
+                    name: 'Grok 4.6',
+                    capabilities: {
+                      input: { text: true, image: true },
+                      attachment: true,
+                    },
+                  },
+                },
+              }],
+            },
+          }
+        },
+      },
+    })
+    expect(signals).toHaveLength(2)
+    expect(signals[0]).toBeInstanceOf(AbortSignal)
+    expect(signals[1]).toBe(signals[0])
+    expect(catalog.models).toEqual([
+      expect.objectContaining({
+        providerID: 'xai',
+        modelID: 'grok-4.6',
+        acceptsImages: true,
+      }),
+    ])
+  })
+
+  it('fails closed when the catalog load exceeds the deadline', async () => {
+    await expect(loadConnectedCatalog({
+      provider: {
+        list: async (_params, options) => new Promise((resolve, reject) => {
+          const onAbort = () => reject(Object.assign(new Error('aborted'), { name: 'AbortError' }))
+          if (options?.signal?.aborted) onAbort()
+          else options?.signal?.addEventListener('abort', onAbort, { once: true })
+        }),
+      },
+      config: { providers: async () => ({ data: { providers: [] } }) },
+    }, { timeoutMs: 30 })).rejects.toMatchObject({
+      code: 'upstream_error',
+      message: expect.stringMatching(/timed out|aborted/i),
+    })
+    expect(CONNECTED_CATALOG_TIMEOUT_MS).toBeGreaterThan(0)
+  })
 })

package/server/lib/llm/generate.js

@@ -6,19 +6,34 @@ const SETTLE_POLL_MS = 250;
 const INCOMPLETE_ASSISTANT_SETTLE_PROBES = 2;
 const EMPTY_IDLE_PROBES = 5;
 
+/**
+ * Session-level deny-all. OpenCode 1.18 session.create serializes this
+ * PermissionRuleset shape (permission/pattern/action). Confirmed on local
+ * 1.18.23/1.18.29: create returns the same rule on the session object.
+ */
+export const LLM_SESSION_DENY_PERMISSION = Object.freeze([
+  Object.freeze({ permission: '*', pattern: '*', action: 'deny' }),
+]);
+
+/**
+ * Agent frontmatter for OpenCode 1.18. Runtime /agent metadata uses
+ * permission:[{permission,pattern,action}]. Markdown config accepts the
+ * PermissionActionConfig map (`"*": deny`) / scalar `deny` / tools:"*":false —
+ * not the legacy action/resource/effect list (that loads but does not add
+ * a terminal * deny, so build-like allows and skill guidance stay visible).
+ */
 const AGENT_MARKDOWN = `---
 mode: primary
 hidden: true
-permissions:
-  - action: "*"
-    resource: "*"
-    effect: deny
+permission:
+  "*": deny
 ---
 
 You generate responses for an application-owned assistant. Follow the supplied system instructions and response format.
 The application executes its registered tools, including openchamber-tool JSON fences in your response, and supplies their results on the next request.
 Emit the requested application tool call when an action requires one. Your native tool permissions describe this generator process; the application's supplied tool catalog describes the assistant's capabilities.
 Report execution and failures from supplied tool results only.
+Do not call native OpenCode tools, MCP tools, or skill tools. Native permissions are denied for this generator session.
 `;
 
 const isMissing = (result) =>
@@ -152,7 +167,11 @@ const waitForIdleAssistant = async ({ client, sessionID, directory, signal }) =>
         directory,
         limit: 20,
       }, { signal });
-      if (!messagesResult?.error && Array.isArray(messagesResult?.data)) {
+      if (messagesResult?.error) {
+        // Deterministic upstream failures (e.g. 400) must not look like "still settling".
+        failGenerate(`OpenCode LLM session.messages failed: ${sdkErrorMessage(messagesResult, 'messages failed')}`);
+      }
+      if (Array.isArray(messagesResult?.data)) {
         const lastInfo = readMessageInfo(messagesResult.data.at(-1));
         if (lastInfo?.role === 'assistant') {
           emptyIdleProbes = 0;
@@ -469,13 +488,23 @@ export async function generateOpenCodeText({
       ? clientFactory()
       : createOpencodeClient({ baseUrl, directory: workingDirectory, headers });
 
-    const toolIds = await client.tool.ids({ directory: workingDirectory }).catch(() => ({ data: [] }));
+    let toolIds;
+    try {
+      toolIds = await client.tool.ids({ directory: workingDirectory });
+    } catch (error) {
+      failGenerate(`OpenCode tool.ids failed: ${error?.message || 'tool.ids failed'}`);
+    }
+    if (toolIds?.error) {
+      failGenerate(`OpenCode tool.ids failed: ${sdkErrorMessage(toolIds, 'tool.ids failed')}`);
+    }
     const tools = deniedTools(Array.isArray(toolIds?.data) ? toolIds.data : []);
 
     const created = await client.session.create({
       directory: workingDirectory,
       title: '[openchamber-llm] generate',
       agent: LLM_AGENT_NAME,
+      // Session fence: deny every native OpenCode/MCP/skill tool for this throwaway.
+      permission: LLM_SESSION_DENY_PERMISSION,
       metadata: { openchamber: { llm: { purpose: 'chat-completions' } } },
     }, { signal: controller.signal });
     const sessionID = created?.data?.id;
@@ -548,7 +577,13 @@ export async function generateOpenCodeText({
       }
       unsubscribeDeltas = null;
       try {
-        await client.session.delete({ sessionID, directory: workingDirectory });
+        const deleted = await client.session.delete({ sessionID, directory: workingDirectory });
+        if (deleted?.error) {
+          console.warn(
+            '[llm] failed to delete throwaway OpenCode session:',
+            sdkErrorMessage(deleted, 'delete failed'),
+          );
+        }
       } catch (error) {
         console.warn('[llm] failed to delete throwaway OpenCode session:', error?.message || error);
       }
@@ -570,4 +605,5 @@ export const _test = {
   subscribeThrowawayTextDeltas,
   LLM_AGENT_NAME,
   AGENT_MARKDOWN,
+  LLM_SESSION_DENY_PERMISSION,
 };

package/server/lib/llm/generate.test.js

@@ -74,8 +74,11 @@ describe('generateOpenCodeText', () => {
       clientFactory: createOpencodeClient,
       ensureTempDirectory: async ({ agentMarkdown }) => {
         expect(agentMarkdown).toContain('openchamber-tool JSON fences')
-        expect(agentMarkdown).toContain('effect: deny')
+        expect(agentMarkdown).toMatch(/"\*"\s*:\s*deny/)
+        expect(agentMarkdown).toContain('permission:')
+        expect(agentMarkdown).not.toContain('effect: deny')
         expect(agentMarkdown).toContain('Report execution and failures from supplied tool results only.')
+        expect(agentMarkdown).toContain('Native permissions are denied')
         return '/tmp/openchamber-llm'
       },
       detect: async () => ({ available: false, mode: 'throwaway-session' }),
@@ -83,6 +86,8 @@ describe('generateOpenCodeText', () => {
 
     expect(create).toHaveBeenCalledWith(expect.objectContaining({
       title: expect.stringContaining('[openchamber-llm]'),
+      agent: 'openchamber-llm',
+      permission: [{ permission: '*', pattern: '*', action: 'deny' }],
       metadata: { openchamber: { llm: { purpose: 'chat-completions' } } },
     }), expect.anything())
     expect(update).toHaveBeenCalled()
@@ -417,6 +422,98 @@ describe('generateOpenCodeText', () => {
     expect(subscribers.size).toBe(0)
   })
 
+  it('throws when tool.ids returns an SDK error instead of denying nothing', async () => {
+    const remove = vi.fn(async () => ({ data: true }))
+    await expect(generateOpenCodeText({
+      buildOpenCodeUrl: () => 'http://127.0.0.1:4096',
+      getOpenCodeAuthHeaders: () => ({}),
+      providerID: 'opencode',
+      modelID: 'gpt-5-nano',
+      messages: [{ role: 'user', content: 'hi' }],
+      clientFactory: () => ({
+        session: {
+          create: vi.fn(async () => ({ data: { id: 'ses_tmp' } })),
+          update: vi.fn(),
+          prompt: vi.fn(),
+          promptAsync: vi.fn(),
+          status: vi.fn(),
+          messages: vi.fn(),
+          delete: remove,
+        },
+        tool: { ids: async () => ({ error: { status: 500, message: 'tool catalog unavailable' } }) },
+      }),
+      ensureTempDirectory: async () => '/tmp/openchamber-llm',
+      detect: async () => ({ available: false, mode: 'throwaway-session' }),
+    })).rejects.toMatchObject({
+      code: 'upstream_error',
+      message: expect.stringContaining('tool.ids failed'),
+    })
+    expect(remove).not.toHaveBeenCalled()
+  })
+
+  it('throws when session.messages returns a deterministic 400', async () => {
+    const remove = vi.fn(async () => ({ data: true }))
+    await expect(generateOpenCodeText({
+      buildOpenCodeUrl: () => 'http://127.0.0.1:4096',
+      getOpenCodeAuthHeaders: () => ({}),
+      providerID: 'opencode',
+      modelID: 'gpt-5-nano',
+      messages: [{ role: 'user', content: 'hi' }],
+      clientFactory: () => ({
+        session: {
+          create: async () => ({ data: { id: 'ses_tmp' } }),
+          update: async () => ({ data: { id: 'ses_tmp' } }),
+          prompt: vi.fn(),
+          promptAsync: async () => ({ response: { status: 204 } }),
+          status: async () => ({ data: { ses_tmp: { type: 'idle' } } }),
+          messages: async () => ({ error: { status: 400, message: 'OutputFormatJsonSchema' } }),
+          delete: remove,
+        },
+        tool: { ids: async () => ({ data: ['bash'] }) },
+      }),
+      ensureTempDirectory: async () => '/tmp/openchamber-llm',
+      detect: async () => ({ available: false, mode: 'throwaway-session' }),
+    })).rejects.toMatchObject({
+      code: 'upstream_error',
+      message: expect.stringMatching(/session\.messages failed.*400|OutputFormatJsonSchema/),
+    })
+    expect(remove).toHaveBeenCalled()
+  })
+
+  it('logs SDK delete errors without erasing a successful generate result', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    try {
+      const result = await generateOpenCodeText({
+        buildOpenCodeUrl: () => 'http://127.0.0.1:4096',
+        getOpenCodeAuthHeaders: () => ({}),
+        providerID: 'opencode',
+        modelID: 'gpt-5-nano',
+        messages: [{ role: 'user', content: 'hi' }],
+        clientFactory: () => ({
+          session: {
+            create: async () => ({ data: { id: 'ses_tmp' } }),
+            update: async () => ({ data: { id: 'ses_tmp' } }),
+            prompt: vi.fn(),
+            promptAsync: async () => ({ response: { status: 204 } }),
+            status: async () => ({ data: { ses_tmp: { type: 'idle' } } }),
+            messages: async () => ({ data: [completedAssistant('ok')] }),
+            delete: async () => ({ error: { status: 500, message: 'delete denied' } }),
+          },
+          tool: { ids: async () => ({ data: [] }) },
+        }),
+        ensureTempDirectory: async () => '/tmp/openchamber-llm',
+        detect: async () => ({ available: false, mode: 'throwaway-session' }),
+      })
+      expect(result).toEqual({ text: 'ok', source: 'throwaway-session' })
+      expect(warn).toHaveBeenCalledWith(
+        expect.stringContaining('[llm] failed to delete throwaway OpenCode session:'),
+        expect.stringContaining('delete denied'),
+      )
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
   it('does not invent deltas on the sessionless /generate JSON path', async () => {
     const onTextDelta = vi.fn()
     const subscribers = new Set()

package/server/lib/llm/temp-directory.js

@@ -6,28 +6,49 @@ import path from 'node:path';
 let tempDirectory = null;
 /** @type {Promise<string> | null} */
 let inflight = null;
+/** Serialize markdown refreshes so concurrent ensure cannot interleave one file. */
+let writeChain = Promise.resolve();
+
+const writeAgentMarkdown = async (root, agentName, agentMarkdown) => {
+  const agentDir = path.join(root, '.opencode', 'agent');
+  await fs.mkdir(agentDir, { recursive: true });
+  await fs.writeFile(path.join(agentDir, `${agentName}.md`), agentMarkdown, 'utf8');
+};
+
+const enqueueWrite = (work) => {
+  const run = writeChain.catch(() => {}).then(work);
+  writeChain = run.catch(() => {});
+  return run;
+};
 
 export async function ensureLlmTempDirectory({ agentName, agentMarkdown }) {
-  if (tempDirectory) return tempDirectory;
-  if (!inflight) {
-    inflight = (async () => {
-      const root = await fs.mkdtemp(path.join(os.tmpdir(), 'openchamber-llm-'));
-      const agentDir = path.join(root, '.opencode', 'agent');
-      await fs.mkdir(agentDir, { recursive: true });
-      await fs.writeFile(path.join(agentDir, `${agentName}.md`), agentMarkdown, 'utf8');
-      tempDirectory = root;
-      return root;
-    })().finally(() => {
-      inflight = null;
-    });
+  // Long-lived servers / HMR must refresh the hidden agent markdown so a
+  // permission-format fix is not stuck behind a stale temp directory.
+  // Concurrent first callers share one mkdtemp; every caller still writes its
+  // markdown after settle so a mid-flight ensure cannot skip a newer body.
+  // Concurrent warm writes are serialized (last committed body wins).
+  if (!tempDirectory) {
+    if (!inflight) {
+      inflight = (async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), 'openchamber-llm-'));
+        tempDirectory = root;
+        return root;
+      })().finally(() => {
+        inflight = null;
+      });
+    }
+    await inflight;
   }
-  return inflight;
+  const root = tempDirectory;
+  await enqueueWrite(() => writeAgentMarkdown(root, agentName, agentMarkdown));
+  return root;
 }
 
 export async function stopLlmTempDirectory() {
   const dir = tempDirectory;
   tempDirectory = null;
   inflight = null;
+  writeChain = Promise.resolve();
   if (!dir) return;
   try {
     await fs.rm(dir, { recursive: true, force: true });