@openchambery/web 1.19.21-beta.1 → 2.0.0-beta.1

package/server/lib/session-turn-pages/routes.js

@@ -1,4 +1,4 @@
-import { createOpencodeClient } from '@opencode-ai/sdk/v2';
+import { makeOpenCodeV2Client } from '../opencode/v2-client.js';
 import { projectMessageSummaryDiffCounts } from '../event-stream/diff-summary.js';
 import {
   projectMessagesPayloadForReasoning,
@@ -210,102 +210,235 @@ const requestSignal = (req, res) => {
   return controller.signal;
 };
 
-const createSdkClient = ({ buildOpenCodeUrl, getOpenCodeAuthHeaders }) => {
-  const baseUrl = buildOpenCodeUrl('/', '').replace(/\/$/, '');
-  const headers = typeof getOpenCodeAuthHeaders === 'function' ? getOpenCodeAuthHeaders() : {};
-  return createOpencodeClient({ baseUrl, headers });
+/**
+ * Native SessionMessageInfo carrier fields that become `parts`.
+ * Must not remain on `info` after normalize — otherwise
+ * includeReasoning=false can strip parts while leaking content/text.
+ */
+const MESSAGE_PART_CARRIER_KEYS = new Set(['content', 'text', 'files', 'parts', 'agents', 'skills']);
+
+const stripMessagePartCarriers = (value) => {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return value;
+  let changed = false;
+  const next = {};
+  for (const [key, field] of Object.entries(value)) {
+    if (MESSAGE_PART_CARRIER_KEYS.has(key)) {
+      changed = true;
+      continue;
+    }
+    next[key] = field;
+  }
+  return changed ? next : value;
 };
 
-const throwUpstream = (logger, label) => {
-  logger?.warn?.(label);
-  const error = new Error('upstream');
-  error.code = 'upstream';
-  throw error;
+/**
+ * Project SessionMessageInfo (or an already-projected {info, parts} row)
+ * into the host HTTP DTO. External route contract stays {info, parts}.
+ */
+const projectV2Parts = (entry) => {
+  if (Array.isArray(entry?.parts)) return entry.parts;
+  const messageID = typeof entry?.id === 'string' ? entry.id : '';
+  const sessionID = typeof entry?.sessionID === 'string' ? entry.sessionID : '';
+  const parts = [];
+  if (typeof entry?.text === 'string' && entry.text) {
+    parts.push({ id: `${messageID}:text`, sessionID, messageID, type: 'text', text: entry.text });
+  }
+  if (Array.isArray(entry?.files)) {
+    entry.files.forEach((file, index) => {
+      parts.push({
+        id: `${messageID}:file:${index}`,
+        sessionID,
+        messageID,
+        type: 'file',
+        mime: file?.mime || 'application/octet-stream',
+        url: file?.uri ?? file?.url,
+        ...(file?.name ? { filename: file.name } : {}),
+      });
+    });
+  }
+  if (Array.isArray(entry?.content)) {
+    entry.content.forEach((item, index) => {
+      const partID = item?.id || `${messageID}:content:${index}`;
+      if (item?.type === 'text') {
+        parts.push({ id: partID, sessionID, messageID, type: 'text', text: item.text ?? '' });
+      } else if (item?.type === 'reasoning') {
+        parts.push({ id: partID, sessionID, messageID, type: 'reasoning', text: item.text ?? '' });
+      } else if (item?.type === 'tool') {
+        parts.push({
+          id: partID,
+          sessionID,
+          messageID,
+          type: 'tool',
+          tool: item.name,
+          callID: item.id,
+          state: item.state ?? {},
+        });
+      }
+    });
+  }
+  return parts;
 };
 
-const createSdkFetchPage = ({ buildOpenCodeUrl, getOpenCodeAuthHeaders, logger }) => {
-  return async ({ sessionID, directory, before, limit, signal }) => {
-    const client = createSdkClient({ buildOpenCodeUrl, getOpenCodeAuthHeaders });
+const projectSessionMessage = (entry) => {
+  if (entry && typeof entry === 'object' && entry.info && typeof entry.info === 'object') {
+    const info = stripMessagePartCarriers(entry.info);
+    return {
+      info: info === entry.info ? entry.info : info,
+      parts: Array.isArray(entry.parts) ? entry.parts : [],
+    };
+  }
+  if (!entry || typeof entry !== 'object' || typeof entry.id !== 'string' || entry.id.length === 0) {
+    return entry;
+  }
+  const role = entry.type === 'user' || entry.type === 'assistant' ? entry.type : (entry.role ?? entry.type);
+  const info = {
+    ...stripMessagePartCarriers(entry),
+    id: entry.id,
+    sessionID: entry.sessionID,
+    role,
+    time: entry.time ?? { created: 0 },
+  };
+  return {
+    info,
+    parts: projectV2Parts(entry),
+  };
+};
 
-    const result = await client.session.messages({
+const projectRecords = (records) =>
+  (Array.isArray(records) ? records : []).map(projectSessionMessage);
+
+/**
+ * Host outbound order: normalize → slim/L1 bounds → reasoning strip.
+ * Slim/reasoning must run on `{info, parts}` so native `content` cannot
+ * rebuild filtered parts or leak through info expansion.
+ */
+const projectTurnPageRecords = (records, includeReasoning) =>
+  projectMessagesPayloadForReasoning(projectSlimParts(projectRecords(records)), includeReasoning);
+
+const projectReconcileRecords = (records, includeReasoning) =>
+  projectMessagesPayloadForReasoning(
+    projectMessageDiffSummaries(projectRecords(records)),
+    includeReasoning,
+  );
+
+const createV2FetchPage = ({ buildOpenCodeUrl, getOpenCodeAuthHeaders, logger }) => {
+  return async ({ sessionID, before, limit, signal }) => {
+    const baseUrl = buildOpenCodeUrl('/', '').replace(/\/$/, '');
+    const headers = typeof getOpenCodeAuthHeaders === 'function' ? getOpenCodeAuthHeaders() : {};
+    const client = makeOpenCodeV2Client({ baseUrl, authHeaders: headers });
+
+    const result = await client.message.list({
       sessionID,
-      ...(typeof directory === 'string' && directory.length > 0 ? { directory } : {}),
       ...(Number.isFinite(limit) ? { limit } : {}),
-      ...(typeof before === 'string' && before.length > 0 ? { before } : {}),
+      order: 'desc',
+      ...(typeof before === 'string' && before.length > 0 ? { cursor: before } : {}),
     }, { signal });
 
-    if (result?.error) {
-      throwUpstream(logger, '[session-turn-pages] session.messages SDK error');
-    }
-
-    const data = result?.data;
-    const records = Array.isArray(data)
-      ? data
-      : Array.isArray(data?.items)
-        ? data.items
-        : null;
-    if (!records) {
-      throwUpstream(logger, '[session-turn-pages] session.messages malformed payload');
+    const items = Array.isArray(result?.data) ? result.data : null;
+    if (!items) {
+      logger?.warn?.('[session-turn-pages] message.list malformed payload');
+      const error = new Error('upstream');
+      error.code = 'upstream';
+      throw error;
     }
 
-    const headerCursor = result?.response?.headers?.get?.('x-next-cursor');
-    const nextCursor = typeof headerCursor === 'string' && headerCursor.length > 0
-      ? headerCursor
-      : null;
+    const previous = result?.cursor?.previous;
+    const nextCursor = typeof previous === 'string' && previous.length > 0 ? previous : null;
 
     return {
-      records,
+      records: items.slice().reverse(),
       nextCursor,
       complete: nextCursor == null,
     };
   };
 };
 
+const createSdkClient = ({ buildOpenCodeUrl, getOpenCodeAuthHeaders }) => {
+  const baseUrl = buildOpenCodeUrl('/', '').replace(/\/$/, '');
+  const headers = typeof getOpenCodeAuthHeaders === 'function' ? getOpenCodeAuthHeaders() : {};
+  return makeOpenCodeV2Client({ baseUrl, authHeaders: headers });
+};
+
+const throwUpstream = (logger, label) => {
+  logger?.warn?.(label);
+  const error = new Error('upstream');
+  error.code = 'upstream';
+  throw error;
+};
+
+const getHttpStatus = (error) => {
+  const candidates = [error?.cause?.status, error?.status, error?.response?.status, error?.statusCode];
+  for (const value of candidates) {
+    if (Number.isFinite(value)) return value;
+  }
+  return undefined;
+};
+
+/**
+ * Real `@opencode/client` throws declared JSON bodies with `_tag`
+ * (e.g. MessageNotFoundError) — no HTTP status on the object. Also accept
+ * legacy status/code shapes from tests and older surfaces.
+ */
+const isNotFoundError = (error) => {
+  if (!error || typeof error !== 'object') return false;
+  const tag = error._tag ?? error.name;
+  if (tag === 'MessageNotFoundError' || tag === 'SessionNotFoundError') return true;
+  if (getHttpStatus(error) === 404) return true;
+  const code = error.code ?? error.type ?? error.error?.code ?? error.error?.type ?? error.error?._tag;
+  return code === 'not_found'
+    || code === 'NotFound'
+    || code === 'MessageNotFoundError'
+    || code === 'SessionNotFoundError';
+};
+
+const isAbortError = (error) => (
+  error?.name === 'AbortError'
+  || error?.code === 'aborted'
+  || error?.cause?.name === 'AbortError'
+);
+
 const createSdkFetchMessage = ({ buildOpenCodeUrl, getOpenCodeAuthHeaders, logger }) => {
-  return async ({ sessionID, messageID, directory, signal }) => {
+  return async ({ sessionID, messageID, signal }) => {
     const client = createSdkClient({ buildOpenCodeUrl, getOpenCodeAuthHeaders });
-    const result = await client.session.message({
-      sessionID,
-      messageID,
-      ...(typeof directory === 'string' && directory.length > 0 ? { directory } : {}),
-    }, { signal });
-
-    if (result?.error) {
-      const status = result?.response?.status;
-      if (status === 404) {
-        const error = new Error('not_found');
-        error.code = 'not_found';
-        throw error;
+    let result;
+    try {
+      result = await client.session.message({ sessionID, messageID }, { signal });
+    } catch (error) {
+      // Preserve abort so routes map 499; never fold into upstream 502.
+      if (isAbortError(error) || signal?.aborted) throw error;
+      if (isNotFoundError(error)) {
+        const notFound = new Error('not_found');
+        notFound.code = 'not_found';
+        throw notFound;
       }
       throwUpstream(logger, '[session-turn-pages] session.message SDK error');
     }
 
-    const data = result?.data;
+    const data = result?.data ?? result;
     if (!data || typeof data !== 'object' || Array.isArray(data)) {
       throwUpstream(logger, '[session-turn-pages] session.message malformed payload');
     }
-    return data;
+    return projectSessionMessage(data);
   };
 };
 
+/**
+ * L3 diff source. v2 SessionMessageInfo has no summary.diffs; keep failure
+ * explicit until the parent lands an authoritative per-message diff API.
+ * Do not substitute working-tree / vcs.diff here.
+ */
 const createSdkFetchDiff = ({ buildOpenCodeUrl, getOpenCodeAuthHeaders, logger }) => {
   return async ({ sessionID, messageID, directory, signal }) => {
-    const client = createSdkClient({ buildOpenCodeUrl, getOpenCodeAuthHeaders });
-    const result = await client.session.diff({
-      sessionID,
-      messageID,
-      ...(typeof directory === 'string' && directory.length > 0 ? { directory } : {}),
-    }, { signal });
-
-    if (result?.error) {
-      throwUpstream(logger, '[session-changes] session.diff SDK error');
-    }
-
-    const data = result?.data;
-    if (!Array.isArray(data)) {
-      throwUpstream(logger, '[session-changes] session.diff malformed payload');
+    const payload = await createSdkFetchMessage({
+      buildOpenCodeUrl,
+      getOpenCodeAuthHeaders,
+      logger,
+    })({ sessionID, messageID, directory, signal });
+    const diffs = payload?.info?.summary?.diffs;
+    if (!Array.isArray(diffs)) {
+      throwUpstream(logger, '[session-changes] session.message summary.diffs unavailable (L3 source pending)');
     }
-    return data;
+    return diffs;
   };
 };
 
@@ -441,7 +574,7 @@ export const registerSessionTurnPageRoutes = (app, dependencies = {}) => {
 
   const needsDefaultFetch = !injectedService || !injectedReconcileService;
   const defaultFetchPage = needsDefaultFetch
-    ? createSdkFetchPage({ buildOpenCodeUrl, getOpenCodeAuthHeaders, logger })
+    ? createV2FetchPage({ buildOpenCodeUrl, getOpenCodeAuthHeaders, logger })
     : null;
 
   const service = injectedService ?? createSessionTurnPageService({
@@ -514,8 +647,8 @@ export const registerSessionTurnPageRoutes = (app, dependencies = {}) => {
       }
 
       const includeReasoning = readIncludeReasoningQuery(req.query);
-      const records = projectMessagesPayloadForReasoning(
-        projectMessageDiffSummaries(Array.isArray(result.records) ? result.records : []),
+      const records = projectReconcileRecords(
+        Array.isArray(result.records) ? result.records : [],
         includeReasoning,
       );
 
@@ -609,10 +742,10 @@ export const registerSessionTurnPageRoutes = (app, dependencies = {}) => {
 
       // Turn-page responses (first packet and prepend) share slim-v1.
       // Reconcile stays on the other route and keeps full parts.
-      // includeReasoning=false drops type=reasoning parts after slim projection.
+      // Normalize native SessionMessageInfo first, then slim, then reasoning strip.
       const includeReasoning = readIncludeReasoningQuery(req.query);
-      const records = projectMessagesPayloadForReasoning(
-        projectSlimParts(result.records),
+      const records = projectTurnPageRecords(
+        Array.isArray(result.records) ? result.records : [],
         includeReasoning,
       );
       return res.status(200).json({
@@ -673,13 +806,13 @@ export const registerSessionTurnPageRoutes = (app, dependencies = {}) => {
         projectMessagesPayloadForReasoning(projectExactMessagePayload(payload), includeReasoning),
       );
     } catch (error) {
-      if (error?.name === 'AbortError' || error?.code === 'aborted') {
+      if (isAbortError(error) || error?.code === 'aborted') {
         if (!res.headersSent) {
           return res.status(499).json({ error: SAFE_ERRORS.aborted });
         }
         return undefined;
       }
-      if (error?.code === 'not_found') {
+      if (error?.code === 'not_found' || isNotFoundError(error)) {
         if (!res.headersSent) {
           return res.status(404).json({ error: 'not found', code: 'not_found' });
         }

package/server/lib/session-turn-pages/routes.test.js

@@ -1,7 +1,10 @@
 import { describe, expect, it, vi } from 'vitest';
 
+import { makeOpenCodeV2Client } from '../opencode/v2-client.js';
 import { registerSessionTurnPageRoutes } from './routes.js';
 
+vi.mock('../opencode/v2-client.js', () => ({ makeOpenCodeV2Client: vi.fn() }));
+
 const registry = () => {
   const routes = new Map();
   return {
@@ -163,6 +166,59 @@ describe('registerSessionTurnPageRoutes', () => {
     expect(kept.body.records[0].parts.some((part) => part.type === 'reasoning')).toBe(true);
   });
 
+  it('normalizes native SessionMessage content before slim+reasoning so content cannot leak', async () => {
+    const loadPage = vi.fn(async () => ({
+      ok: true,
+      records: [{
+        id: 'msg_a1',
+        sessionID: 'ses_1',
+        type: 'assistant',
+        time: { created: 1, completed: 2 },
+        agent: 'build',
+        model: { providerID: 'p', id: 'm' },
+        tokens: { input: 1, output: 2, reasoning: 9 },
+        content: [
+          { type: 'reasoning', text: 'SECRET_REASONING_BODY' },
+          { type: 'text', text: 'visible-answer' },
+          {
+            type: 'tool',
+            name: 'bash',
+            id: 'call_1',
+            state: { status: 'completed', title: 'ran', output: 'HUGE_TOOL_OUTPUT' },
+          },
+        ],
+      }],
+      turnCount: 0,
+      cursor: null,
+      complete: true,
+    }));
+    const { app, route } = registry();
+    registerSessionTurnPageRoutes(app, { sessionTurnPageService: { loadPage } });
+
+    const stripped = response();
+    await route('GET', ROUTE)({
+      params: { sessionID: 'ses_1' },
+      query: { includeReasoning: 'false' },
+      headers: {},
+    }, stripped);
+
+    expect(stripped.statusCode).toBe(200);
+    const record = stripped.body.records[0];
+    expect(record.info.id).toBe('msg_a1');
+    expect(record.info.role).toBe('assistant');
+    expect(record.info.tokens.reasoning).toBe(9);
+    expect(record.info.content).toBeUndefined();
+    expect(record.parts.every((part) => part.type !== 'reasoning')).toBe(true);
+    expect(record.parts.some((part) => part.type === 'text' && part.text === 'visible-answer')).toBe(true);
+    const tool = record.parts.find((part) => part.type === 'tool');
+    expect(tool.slim).toBe(true);
+    expect(tool.state.output).toBeUndefined();
+    expect(stripped.body.partsProjection).toBe('slim-v1');
+    const serialized = JSON.stringify(stripped.body);
+    expect(serialized).not.toContain('SECRET_REASONING_BODY');
+    expect(serialized).not.toContain('HUGE_TOOL_OUTPUT');
+  });
+
   it('maps upstream service errors to an upstream HTTP status', async () => {
     const loadPage = vi.fn(async () => ({
       ok: false,
@@ -637,6 +693,87 @@ describe('registerSessionTurnPageRoutes', () => {
     resolveLoad?.();
     await pending;
   });
+
+  it('default fetch uses message.list SessionMessageInfo[] + cursor and projects {info, parts}', async () => {
+    const list = vi.fn(async () => ({
+      data: [
+        { id: 'msg_a1', type: 'assistant', time: { created: 2, completed: 3 }, content: [{ type: 'text', text: 'ok' }] },
+        { id: 'msg_u1', type: 'user', time: { created: 1 }, text: 'hi' },
+      ],
+      cursor: { previous: null, next: null },
+    }));
+    makeOpenCodeV2Client.mockReturnValue({
+      message: { list },
+      session: { messages: undefined, status: undefined, abort: undefined },
+    });
+    const { app, route } = registry();
+    registerSessionTurnPageRoutes(app, {
+      buildOpenCodeUrl: () => 'http://open.code/',
+      getOpenCodeAuthHeaders: () => ({ Authorization: 'secret' }),
+    });
+    const res = response();
+    await route('GET', ROUTE)({
+      params: { sessionID: 'ses_1' },
+      query: { turns: '1' },
+      headers: {},
+    }, res);
+
+    expect(list).toHaveBeenCalledWith({
+      sessionID: 'ses_1',
+      limit: 100,
+      order: 'desc',
+    }, expect.objectContaining({ signal: expect.any(Object) }));
+    expect(res.statusCode).toBe(200);
+    expect(res.body.complete).toBe(true);
+    expect(res.body.records).toEqual([
+      expect.objectContaining({
+        info: expect.objectContaining({ id: 'msg_u1', role: 'user' }),
+        parts: [expect.objectContaining({ type: 'text', text: 'hi' })],
+      }),
+      expect.objectContaining({
+        info: expect.objectContaining({ id: 'msg_a1', role: 'assistant' }),
+        parts: [expect.objectContaining({ type: 'text', text: 'ok' })],
+      }),
+    ]);
+  });
+
+  it('default fetch throws on message.list failure and maps to upstream', async () => {
+    makeOpenCodeV2Client.mockReturnValue({
+      message: { list: vi.fn(async () => { throw Object.assign(new Error('upstream'), { status: 500 }); }) },
+    });
+    const { app, route } = registry();
+    registerSessionTurnPageRoutes(app, {
+      buildOpenCodeUrl: () => 'http://open.code/',
+      getOpenCodeAuthHeaders: () => ({}),
+    });
+    const res = response();
+    await route('GET', ROUTE)({
+      params: { sessionID: 'ses_1' },
+      query: { turns: '1' },
+      headers: {},
+    }, res);
+    expect(res.statusCode).toBeGreaterThanOrEqual(502);
+    expect(res.body).toMatchObject({ error: expect.stringMatching(/upstream/i) });
+  });
+
+  it('default fetch rejects HeyAPI data/error shapes without a SessionMessageInfo array', async () => {
+    makeOpenCodeV2Client.mockReturnValue({
+      message: { list: vi.fn(async () => ({ error: { status: 500 }, data: undefined })) },
+    });
+    const { app, route } = registry();
+    registerSessionTurnPageRoutes(app, {
+      buildOpenCodeUrl: () => 'http://open.code/',
+      getOpenCodeAuthHeaders: () => ({}),
+    });
+    const res = response();
+    await route('GET', ROUTE)({
+      params: { sessionID: 'ses_1' },
+      query: { turns: '1' },
+      headers: {},
+    }, res);
+    expect(res.statusCode).toBeGreaterThanOrEqual(502);
+    expect(res.body.records).toBeUndefined();
+  });
 });
 
 const EXACT_MESSAGE_ROUTE = '/api/session/:sessionID/message/:messageID';
@@ -752,6 +889,154 @@ describe('registerSessionTurnPageRoutes — exact message GET', () => {
     expect(res.statusCode).toBe(404);
     expect(res.body.code).toBe('not_found');
   });
+
+  it('maps AbortError to 499 and does not fold it into upstream 502', async () => {
+    const fetchExactMessage = vi.fn(async () => {
+      const error = new Error('aborted');
+      error.name = 'AbortError';
+      throw error;
+    });
+    const { app, route } = registry();
+    registerSessionTurnPageRoutes(app, {
+      sessionTurnPageService: { loadPage: vi.fn() },
+      fetchExactMessage,
+    });
+    const res = response();
+    await route('GET', EXACT_MESSAGE_ROUTE)({
+      params: { sessionID: 'ses_1', messageID: 'msg_1' },
+      query: {},
+      headers: {},
+    }, res);
+    expect(res.statusCode).toBe(499);
+    expect(res.statusCode).not.toBe(502);
+  });
+});
+
+describe('registerSessionTurnPageRoutes — real OpenCode.make + fake HTTP', () => {
+  const jsonResponse = (status, body) => ({
+    ok: status >= 200 && status < 300,
+    status,
+    headers: {
+      get: (name) => (String(name).toLowerCase() === 'content-type' ? 'application/json' : null),
+    },
+    json: async () => body,
+    text: async () => JSON.stringify(body ?? null),
+    arrayBuffer: async () => new TextEncoder().encode(JSON.stringify(body ?? null)).buffer,
+  });
+
+  it('session.message MessageNotFoundError _tag maps to HTTP 404 via real client', async () => {
+    const fetchImpl = vi.fn(async (url) => {
+      const path = String(url);
+      if (path.includes('/message/msg_missing')) {
+        return jsonResponse(404, {
+          _tag: 'MessageNotFoundError',
+          sessionID: 'ses_1',
+          messageID: 'msg_missing',
+          message: 'Message not found',
+        });
+      }
+      return jsonResponse(500, { _tag: 'UnknownError', message: 'unexpected' });
+    });
+    const { makeOpenCodeV2Client: realMake } = await vi.importActual('../opencode/v2-client.js');
+    makeOpenCodeV2Client.mockImplementation(({ baseUrl, authHeaders }) =>
+      realMake({ baseUrl, authHeaders, fetchImpl }));
+
+    const { app, route } = registry();
+    registerSessionTurnPageRoutes(app, {
+      sessionTurnPageService: { loadPage: vi.fn() },
+      buildOpenCodeUrl: () => 'http://open.code/',
+      getOpenCodeAuthHeaders: () => ({ Authorization: 'Basic test' }),
+    });
+    const res = response();
+    await route('GET', EXACT_MESSAGE_ROUTE)({
+      params: { sessionID: 'ses_1', messageID: 'msg_missing' },
+      query: {},
+      headers: {},
+    }, res);
+
+    expect(res.statusCode).toBe(404);
+    expect(res.body.code).toBe('not_found');
+    expect(fetchImpl).toHaveBeenCalled();
+  });
+
+  it('exact message serializes native assistant with reasoning strip and L1 slim', async () => {
+    const nativeAssistant = {
+      id: 'msg_a1',
+      type: 'assistant',
+      time: { created: 10, completed: 20 },
+      agent: 'build',
+      model: { providerID: 'openai', id: 'gpt' },
+      tokens: { input: 3, output: 4, reasoning: 7 },
+      content: [
+        { type: 'reasoning', text: 'PRIVATE_CHAIN' },
+        { type: 'text', text: 'hello-world' },
+      ],
+      // Host may still see legacy summary on some mirrors; L1 must slim it.
+      summary: {
+        diffs: [{
+          file: 'a.ts',
+          status: 'modified',
+          additions: 1,
+          deletions: 0,
+          patch: 'PATCH_BODY_SHOULD_NOT_LEAVE',
+        }],
+      },
+    };
+    const fetchImpl = vi.fn(async () => jsonResponse(200, { data: nativeAssistant }));
+    const { makeOpenCodeV2Client: realMake } = await vi.importActual('../opencode/v2-client.js');
+    makeOpenCodeV2Client.mockImplementation(({ baseUrl, authHeaders }) =>
+      realMake({ baseUrl, authHeaders, fetchImpl }));
+
+    const { app, route } = registry();
+    registerSessionTurnPageRoutes(app, {
+      sessionTurnPageService: { loadPage: vi.fn() },
+      buildOpenCodeUrl: () => 'http://open.code/',
+      getOpenCodeAuthHeaders: () => ({}),
+    });
+
+    const stripped = response();
+    await route('GET', EXACT_MESSAGE_ROUTE)({
+      params: { sessionID: 'ses_1', messageID: 'msg_a1' },
+      query: { includeReasoning: 'false' },
+      headers: {},
+    }, stripped);
+
+    expect(stripped.statusCode).toBe(200);
+    expect(stripped.body.info.id).toBe('msg_a1');
+    expect(stripped.body.info.role).toBe('assistant');
+    expect(stripped.body.info.content).toBeUndefined();
+    expect(stripped.body.info.tokens.reasoning).toBe(7);
+    expect(stripped.body.parts.every((part) => part.type !== 'reasoning')).toBe(true);
+    expect(stripped.body.parts.some((part) => part.type === 'text' && part.text === 'hello-world')).toBe(true);
+    expect(stripped.body.info.summary?.diffs?.[0]?.patch).toBeUndefined();
+    expect(JSON.stringify(stripped.body)).not.toContain('PRIVATE_CHAIN');
+    expect(JSON.stringify(stripped.body)).not.toContain('PATCH_BODY_SHOULD_NOT_LEAVE');
+  });
+
+  it('preserves abort from real client transport instead of 502', async () => {
+    const fetchImpl = vi.fn(async () => {
+      const error = new Error('The operation was aborted');
+      error.name = 'AbortError';
+      throw error;
+    });
+    const { makeOpenCodeV2Client: realMake } = await vi.importActual('../opencode/v2-client.js');
+    makeOpenCodeV2Client.mockImplementation(({ baseUrl, authHeaders }) =>
+      realMake({ baseUrl, authHeaders, fetchImpl }));
+
+    const { app, route } = registry();
+    registerSessionTurnPageRoutes(app, {
+      sessionTurnPageService: { loadPage: vi.fn() },
+      buildOpenCodeUrl: () => 'http://open.code/',
+      getOpenCodeAuthHeaders: () => ({}),
+    });
+    const res = response();
+    await route('GET', EXACT_MESSAGE_ROUTE)({
+      params: { sessionID: 'ses_1', messageID: 'msg_1' },
+      query: {},
+      headers: {},
+    }, res);
+    expect(res.statusCode).toBe(499);
+  });
 });
 
 describe('registerSessionTurnPageRoutes — changes API', () => {