@openchambery/web 1.19.7-beta.24 → 1.19.7-beta.26

package/server/lib/event-stream/reasoning-projection.test.js

@@ -0,0 +1,300 @@
+import { describe, expect, it } from 'vitest';
+
+import {
+  createReasoningOutboundFilter,
+  createSseBlockSplitter,
+  filterSseBlock,
+  projectMessagesPayloadForReasoning,
+  projectMessagesPayloadWithoutReasoning,
+  readIncludeReasoningFromUrl,
+  readIncludeReasoningQuery,
+  shouldIncludeReasoning,
+  stripIncludeReasoningParam,
+} from './reasoning-projection.js';
+
+describe('shouldIncludeReasoning / query helpers', () => {
+  it('only treats the strict string false as disabled', () => {
+    expect(shouldIncludeReasoning(undefined)).toBe(true);
+    expect(shouldIncludeReasoning(null)).toBe(true);
+    expect(shouldIncludeReasoning('')).toBe(true);
+    expect(shouldIncludeReasoning('true')).toBe(true);
+    expect(shouldIncludeReasoning('0')).toBe(true);
+    expect(shouldIncludeReasoning('False')).toBe(true);
+    expect(shouldIncludeReasoning(false)).toBe(true);
+    expect(shouldIncludeReasoning('false')).toBe(false);
+    expect(shouldIncludeReasoning(['false'])).toBe(false);
+  });
+
+  it('reads Express query and URL forms', () => {
+    expect(readIncludeReasoningQuery({ includeReasoning: 'false' })).toBe(false);
+    expect(readIncludeReasoningQuery({})).toBe(true);
+    expect(readIncludeReasoningFromUrl('/api/event?includeReasoning=false')).toBe(false);
+    expect(readIncludeReasoningFromUrl('/api/event')).toBe(true);
+  });
+
+  it('strips includeReasoning from upstream paths', () => {
+    expect(stripIncludeReasoningParam('/event?directory=/tmp&includeReasoning=false&x=1'))
+      .toBe('/event?directory=%2Ftmp&x=1');
+    expect(stripIncludeReasoningParam('/event?directory=/tmp')).toBe('/event?directory=/tmp');
+  });
+});
+
+describe('HTTP snapshot projection', () => {
+  it('drops reasoning parts and keeps tokens.reasoning', () => {
+    const record = {
+      info: { id: 'msg_1', tokens: { input: 1, output: 2, reasoning: 99 } },
+      parts: [
+        { id: 'p_r', type: 'reasoning', text: 'secret chain' },
+        { id: 'p_t', type: 'text', text: 'hello' },
+      ],
+    };
+    const projected = projectMessagesPayloadWithoutReasoning(record);
+    expect(projected.info.tokens.reasoning).toBe(99);
+    expect(projected.parts).toEqual([{ id: 'p_t', type: 'text', text: 'hello' }]);
+    expect(JSON.stringify(projected)).not.toContain('secret chain');
+    expect(record.parts).toHaveLength(2);
+  });
+
+  it('projects list / records / cache envelopes with identity when unchanged', () => {
+    const withReasoning = {
+      info: { id: 'm1', tokens: { reasoning: 3 } },
+      parts: [{ type: 'reasoning', text: 'nope' }, { type: 'text', text: 'ok' }],
+    };
+    expect(projectMessagesPayloadWithoutReasoning([withReasoning])[0].parts).toEqual([
+      { type: 'text', text: 'ok' },
+    ]);
+    const page = projectMessagesPayloadWithoutReasoning({ records: [withReasoning], turnCount: 1 });
+    expect(page.records[0].parts).toHaveLength(1);
+    expect(page.turnCount).toBe(1);
+
+    const cache = projectMessagesPayloadWithoutReasoning({
+      available: true,
+      record: withReasoning,
+      records: [withReasoning],
+    });
+    expect(cache.record.parts).toHaveLength(1);
+    expect(projectMessagesPayloadForReasoning(withReasoning, true)).toBe(withReasoning);
+
+    const plain = { info: { id: 'm' }, parts: [{ type: 'text', text: 'x' }] };
+    const list = [plain];
+    expect(projectMessagesPayloadWithoutReasoning(list)).toBe(list);
+    expect(projectMessagesPayloadWithoutReasoning(plain)).toBe(plain);
+  });
+});
+
+describe('stateful stream filter', () => {
+  it('strips version suffixes for dispatch but keeps original type on kept events', () => {
+    const filter = createReasoningOutboundFilter();
+
+    expect(filter.projectEvent({
+      type: 'session.next.reasoning.delta.1',
+      properties: { delta: 'think' },
+    })).toBeNull();
+    expect(filter.projectEvent({
+      type: 'session.next.reasoning.delta',
+      data: { delta: 'think' },
+    })).toBeNull();
+
+    // properties envelope + versioned type
+    expect(filter.projectEvent({
+      type: 'message.part.updated.1',
+      properties: {
+        part: { id: 'p_r', messageID: 'm1', type: 'reasoning', text: 'chain' },
+      },
+    })).toBeNull();
+
+    // data envelope + versioned type — learn text, keep original type string
+    const textUpdated = {
+      type: 'message.part.updated.1',
+      data: {
+        part: { id: 'p_t', messageID: 'm1', type: 'text', text: 'hi' },
+      },
+    };
+    expect(filter.projectEvent(textUpdated)).toBe(textUpdated);
+    expect(textUpdated.type).toBe('message.part.updated.1');
+
+    const textDelta = {
+      type: 'message.part.delta.1',
+      data: { messageID: 'm1', partID: 'p_t', field: 'text', delta: '!' },
+    };
+    expect(filter.projectEvent(textDelta)).toBe(textDelta);
+
+    // reasoning learned via properties; delta via data still drops
+    filter.projectEvent({
+      type: 'message.part.updated',
+      properties: { part: { id: 'p_r2', messageID: 'm1', type: 'reasoning', text: '' } },
+    });
+    expect(filter.projectEvent({
+      type: 'message.part.delta.1',
+      data: { messageID: 'm1', partID: 'p_r2', field: 'text', delta: 'secret' },
+    })).toBeNull();
+  });
+
+  it('drops explicit reasoning fields and unknown part deltas', () => {
+    const filter = createReasoningOutboundFilter();
+    expect(filter.projectEvent({
+      type: 'message.part.delta',
+      properties: { messageID: 'm1', partID: 'u', field: 'reasoning_content', delta: 'x' },
+    })).toBeNull();
+    expect(filter.projectEvent({
+      type: 'message.part.delta',
+      properties: { messageID: 'm1', partID: 'never', field: 'text', delta: 'leak?' },
+    })).toBeNull();
+  });
+
+  it('forgets classification and bounds the map', () => {
+    const filter = createReasoningOutboundFilter();
+    filter.projectEvent({
+      type: 'message.part.updated',
+      properties: { part: { id: 'p1', messageID: 'm1', type: 'text' } },
+    });
+    expect(filter.knownPartCount()).toBe(1);
+    filter.projectEvent({
+      type: 'message.part.removed',
+      properties: { messageID: 'm1', partID: 'p1' },
+    });
+    expect(filter.knownPartCount()).toBe(0);
+
+    for (let i = 0; i < 8200; i += 1) {
+      filter.projectEvent({
+        type: 'message.part.updated',
+        properties: { part: { id: `p_${i}`, messageID: 'm_big', type: 'text' } },
+      });
+    }
+    expect(filter.knownPartCount()).toBeLessThanOrEqual(8192);
+    filter.dispose();
+    expect(filter.knownPartCount()).toBe(0);
+  });
+
+  it('does not mutate original objects when stripping embedded parts', () => {
+    const filter = createReasoningOutboundFilter();
+    const original = {
+      type: 'message.updated',
+      properties: {
+        info: { id: 'm1', tokens: { reasoning: 7 } },
+        parts: [
+          { id: 'r', type: 'reasoning', text: 'hidden' },
+          { id: 't', type: 'text', text: 'visible' },
+        ],
+      },
+    };
+    const projected = filter.projectEvent(original);
+    expect(projected).not.toBe(original);
+    expect(original.properties.parts).toHaveLength(2);
+    expect(projected.properties.parts).toEqual([{ id: 't', type: 'text', text: 'visible' }]);
+  });
+});
+
+describe('SSE filter + CR-safe splitter', () => {
+  it('preserves wire identity for kept events and drops reasoning', () => {
+    const filter = createReasoningOutboundFilter();
+    const keptBlock = 'id: evt-1\ndata: {"type":"message.part.updated","properties":{"part":{"id":"p","messageID":"m","type":"text","text":"hi"}}}';
+    const droppedBlock = 'id: evt-2\ndata: {"type":"session.next.reasoning.delta","properties":{"delta":"no"}}';
+    const wrappedDrop = 'id: evt-3\ndata: {"directory":"/repo","payload":{"type":"session.next.reasoning.delta.1","properties":{"delta":"x"}}}';
+    const wrappedKeep = 'id: evt-4\ndata: {"directory":"/repo","payload":{"type":"server.connected","properties":{}}}';
+
+    expect(filterSseBlock(keptBlock, filter)).toBe(`${keptBlock}\n\n`);
+    expect(filterSseBlock(droppedBlock, filter)).toBeNull();
+    expect(filterSseBlock(wrappedDrop, filter)).toBeNull();
+    expect(filterSseBlock(wrappedKeep, filter)).toContain('"directory":"/repo"');
+  });
+
+  it('does not split one event when CRLF straddles chunk boundaries', () => {
+    const splitter = createSseBlockSplitter();
+    // Multi-line data event with CRLF, split after lone CR of first line ending.
+    const full = 'id: 1\r\ndata: {"type":"text","n":1}\r\ndata: more\r\n\r\n';
+    const cut = full.indexOf('\r') + 1; // after first CR of first line's CRLF
+    expect(full[cut - 1]).toBe('\r');
+    expect(full[cut]).toBe('\n');
+
+    const first = splitter.push(full.slice(0, cut));
+    expect(first).toEqual([]); // must not complete on lone CR→LF
+    const second = splitter.push(full.slice(cut));
+    expect(second).toHaveLength(1);
+    expect(second[0]).toContain('id: 1');
+    expect(second[0]).toContain('data: more');
+    expect(second[0]).not.toMatch(/^\s*$/);
+  });
+
+  it('handles per-character chunking and UTF-8 multi-byte without leaking reasoning', () => {
+    const filter = createReasoningOutboundFilter();
+    const splitter = createSseBlockSplitter();
+    const stream =
+      'id: a\ndata: {"type":"message.part.updated","properties":{"part":{"id":"t","messageID":"m","type":"text","text":"你好"}}}\n\n'
+      + 'id: b\ndata: {"type":"session.next.reasoning.delta","properties":{"delta":"secret"}}\n\n'
+      + 'id: c\ndata: {"type":"message.part.delta","properties":{"messageID":"m","partID":"t","field":"text","delta":"!"}}\n\n';
+
+    const bytes = new TextEncoder().encode(stream);
+    const out = [];
+    for (let i = 0; i < bytes.length; i += 1) {
+      for (const block of splitter.push(bytes.subarray(i, i + 1))) {
+        const filtered = filterSseBlock(block, filter);
+        if (filtered) out.push(filtered);
+      }
+    }
+    for (const block of splitter.finish()) {
+      const filtered = filterSseBlock(block, filter);
+      if (filtered) out.push(filtered);
+    }
+
+    expect(out).toHaveLength(2);
+    expect(out.join('')).toContain('"type":"message.part.updated"');
+    expect(out.join('')).toContain('"type":"message.part.delta"');
+    expect(out.join('')).toContain('你好');
+    expect(out.join('')).not.toContain('reasoning');
+    expect(out.join('')).not.toContain('secret');
+  });
+
+  it('keeps event order across mixed CRLF chunk splits', () => {
+    const splitter = createSseBlockSplitter();
+    const chunks = [
+      'id: 1\r\ndata: {"n":1}\r',
+      '\n\r\nid: 2\r\ndata: {"n":2}\r\n\r\n',
+    ];
+    const blocks = [];
+    for (const chunk of chunks) blocks.push(...splitter.push(chunk));
+    blocks.push(...splitter.finish());
+    expect(blocks.map((b) => JSON.parse(b.split('\n').find((l) => l.startsWith('data:')).slice(5)).n))
+      .toEqual([1, 2]);
+  });
+});
+
+describe('performance: 10k reasoning deltas', () => {
+  it('drops 10k reasoning deltas while still emitting known text deltas', () => {
+    const disabled = createReasoningOutboundFilter();
+    disabled.projectEvent({
+      type: 'message.part.updated',
+      properties: { part: { id: 'p_text', messageID: 'm1', type: 'text', text: '' } },
+    });
+    disabled.projectEvent({
+      type: 'message.part.updated',
+      properties: { part: { id: 'p_reason', messageID: 'm1', type: 'reasoning', text: '' } },
+    });
+
+    let disabledEvents = 0;
+    let disabledBodyBytes = 0;
+    for (let i = 0; i < 10_000; i += 1) {
+      const out = disabled.projectEvent({
+        type: 'message.part.delta',
+        properties: {
+          messageID: 'm1',
+          partID: 'p_reason',
+          field: 'text',
+          delta: `reasoning-token-${i}-xxxxxxxx`,
+        },
+      });
+      if (out != null) {
+        disabledEvents += 1;
+        disabledBodyBytes += JSON.stringify(out).length;
+      }
+    }
+
+    const textDelta = {
+      type: 'message.part.delta',
+      properties: { messageID: 'm1', partID: 'p_text', field: 'text', delta: 'hello-world' },
+    };
+    expect(disabled.projectEvent(textDelta)).toBe(textDelta);
+    expect(disabledEvents).toBe(0);
+    expect(disabledBodyBytes).toBe(0);
+  });
+});

package/server/lib/event-stream/runtime.js

@@ -10,6 +10,10 @@ import {
 import { createGlobalMessageStreamHub } from './global-hub.js';
 import { createGlobalMessageStreamWsBridge } from './global-ws-bridge.js';
 import { acceptDirectoryMessageStreamWsConnection } from './directory-ws-bridge.js';
+import {
+  createReasoningOutboundFilter,
+  shouldIncludeReasoning,
+} from './reasoning-projection.js';
 import {
   DEFAULT_UPSTREAM_RECONNECT_DELAY_MS,
   DEFAULT_UPSTREAM_STALL_TIMEOUT_MS,
@@ -95,10 +99,15 @@ export function createMessageStreamWsRuntime({
     const isGlobalStream = pathname === MESSAGE_STREAM_GLOBAL_WS_PATH;
     const requestedLastEventId = requestUrl.searchParams.get('lastEventId')?.trim() || '';
     const requestedDirectory = requestUrl.searchParams.get('directory')?.trim() || '';
+    // OpenChamber projection only — never forwarded to OpenCode upstream URLs.
+    // Default (include) path keeps reasoningFilter null for zero send-path overhead.
+    const includeReasoning = shouldIncludeReasoning(requestUrl.searchParams.get('includeReasoning'));
+    const reasoningFilter = includeReasoning ? null : createReasoningOutboundFilter();
 
     if (isGlobalStream) {
       globalBridge.accept(socket, {
         requestedLastEventId,
+        reasoningFilter,
       });
       return;
     }
@@ -107,6 +116,7 @@ export function createMessageStreamWsRuntime({
       socket,
       requestedLastEventId,
       requestedDirectory,
+      reasoningFilter,
       buildOpenCodeUrl,
       getOpenCodeAuthHeaders,
       processForwardedEventPayload,

package/server/lib/event-stream/runtime.test.js

@@ -127,6 +127,59 @@ describe('event stream broadcaster', () => {
 });
 
 describe('message stream websocket runtime', () => {
+  it('filters reasoning events per connection when includeReasoning=false', async () => {
+    const server = new EventEmitter();
+    const wsClients = new Set();
+
+    const runtime = createMessageStreamWsRuntime({
+      server,
+      uiAuthController: null,
+      isRequestOriginAllowed: async () => true,
+      rejectWebSocketUpgrade() {
+        throw new Error('upgrade should not be used in this test');
+      },
+      buildOpenCodeUrl: (path) => `http://127.0.0.1:4096${path}`,
+      getOpenCodeAuthHeaders: () => ({}),
+      processForwardedEventPayload() {},
+      wsClients,
+      upstreamReconnectDelayMs: 0,
+      fetchImpl: async (_url, options) => createSseResponse({
+        signal: options.signal,
+        holdOpen: true,
+        blocks: [
+          'id: evt-1\ndata: {"type":"message.part.updated","properties":{"part":{"id":"p_r","messageID":"m1","type":"reasoning","text":"secret"}}}\n\n',
+          'id: evt-2\ndata: {"type":"message.part.updated","properties":{"part":{"id":"p_t","messageID":"m1","type":"text","text":"hi"}}}\n\n',
+          'id: evt-3\ndata: {"type":"session.next.reasoning.delta","properties":{"delta":"nope"}}\n\n',
+          'id: evt-4\ndata: {"type":"message.part.delta","properties":{"messageID":"m1","partID":"p_t","field":"text","delta":"!"}}\n\n',
+        ],
+      }),
+    });
+
+    const filtered = new FakeSocket();
+    const full = new FakeSocket();
+    runtime.wsServer.emit('connection', filtered, { url: '/api/global/event/ws?includeReasoning=false' });
+    runtime.wsServer.emit('connection', full, { url: '/api/global/event/ws' });
+
+    await new Promise((resolve) => setTimeout(resolve, 20));
+
+    const filteredEvents = filtered.sent.filter((frame) => frame.type === 'event');
+    const fullEvents = full.sent.filter((frame) => frame.type === 'event');
+
+    expect(filteredEvents.some((frame) => frame.payload?.type === 'session.next.reasoning.delta')).toBe(false);
+    expect(filteredEvents.some((frame) => frame.payload?.properties?.part?.type === 'reasoning')).toBe(false);
+    expect(JSON.stringify(filteredEvents)).not.toContain('secret');
+    expect(filteredEvents.some((frame) => frame.payload?.type === 'message.part.updated'
+      && frame.payload?.properties?.part?.type === 'text')).toBe(true);
+    expect(filteredEvents.some((frame) => frame.payload?.type === 'message.part.delta')).toBe(true);
+
+    expect(fullEvents.some((frame) => frame.payload?.properties?.part?.type === 'reasoning')).toBe(true);
+    expect(fullEvents.some((frame) => frame.payload?.type === 'session.next.reasoning.delta')).toBe(true);
+
+    filtered.close();
+    full.close();
+    await runtime.close();
+  });
+
   it('shares one global upstream SSE reader across multiple websocket clients', async () => {
     const server = new EventEmitter();
     const wsClients = new Set();

package/server/lib/opencode/DOCUMENTATION.md

@@ -377,7 +377,8 @@ When adding or changing Host HTTP APIs that mobile/desktop clients reach over Pr
 - `registerOpenCodeProxy(app, dependencies)`: registers OpenCode proxy routes and middleware.
 - `resolveSessionTurnAdmissionRequest(req)`: extracts the directory/session scope for client POST turn endpoints so queue automatic admission can be invalidated without delaying the proxied request.
 - Owns:
-  - SSE forwarders: `GET /api/global/event`, `GET /api/event`
+  - SSE forwarders: `GET /api/global/event`, `GET /api/event` (optional `includeReasoning=false` parse-filters reasoning events on the Host send path; param never forwarded upstream; enabled path remains byte passthrough)
+  - Official session.messages list: `GET /api/session/:sessionID/message` (optional `includeReasoning=false` strips reasoning parts; exact message GET is owned by session-turn-pages)
   - Session message forwarder: `POST /api/session/:sessionId/message`
   - Generic `/api/*` forwarding with hop-by-hop header filtering
   - Windows `/session` merge fallback path behavior

package/server/lib/opencode/proxy.js

@@ -11,6 +11,15 @@ import {
   extractDirectoryFromRequest,
   isDirectoryTurnAdmissionPath,
 } from './instance-recovery-runtime.js';
+import {
+  createReasoningOutboundFilter,
+  createSseBlockSplitter,
+  filterSseBlock,
+  projectMessagesPayloadForReasoning,
+  readIncludeReasoningFromUrl,
+  readIncludeReasoningQuery,
+  stripIncludeReasoningParam,
+} from '../event-stream/reasoning-projection.js';
 
 export const createDirectoryQueryCanonicalizer = ({ realpath, ...cacheOptions } = {}) => {
   const realpathCache = createRealpathCache({ fallbackOnError: true, realpath, ...cacheOptions });
@@ -379,6 +388,14 @@ export const registerOpenCodeProxy = (app, deps) => {
     let connectTimedOut = false;
     let writeQueue = Promise.resolve(true);
     const sseBoundary = createSseBoundaryTracker();
+    const requestUrl = typeof req.originalUrl === 'string' && req.originalUrl.length > 0
+      ? req.originalUrl
+      : (typeof req.url === 'string' ? req.url : '');
+    // OpenChamber projection control — never forwarded to OpenCode.
+    const includeReasoning = readIncludeReasoningQuery(req.query)
+      && readIncludeReasoningFromUrl(requestUrl);
+    const reasoningFilter = includeReasoning ? null : createReasoningOutboundFilter();
+    const sseSplitter = includeReasoning ? null : createSseBlockSplitter();
 
     req.on('close', closeUpstream);
 
@@ -400,10 +417,9 @@ export const registerOpenCodeProxy = (app, deps) => {
     };
 
     try {
-      const requestUrl = typeof req.originalUrl === 'string' && req.originalUrl.length > 0
-        ? req.originalUrl
-        : (typeof req.url === 'string' ? req.url : '');
-      const upstreamPath = requestUrl.startsWith('/api') ? requestUrl.slice(4) || '/' : requestUrl;
+      // Strip includeReasoning before building the upstream OpenCode path.
+      const strippedUrl = stripIncludeReasoningParam(requestUrl);
+      const upstreamPath = strippedUrl.startsWith('/api') ? strippedUrl.slice(4) || '/' : strippedUrl;
       const headers = normalizeForwardedDirectoryHeaders(
         collectForwardProxyHeaders(req.headers, getOpenCodeAuthHeaders())
       );
@@ -495,10 +511,40 @@ export const registerOpenCodeProxy = (app, deps) => {
         }
         if (value && value.length > 0) {
           resetStallTimer();
-          sseBoundary.observe(value);
-          const canContinue = await enqueueSseWrite(value);
-          if (!canContinue) {
-            break;
+          if (includeReasoning) {
+            // Enabled path: byte-identical passthrough (existing behavior).
+            sseBoundary.observe(value);
+            const canContinue = await enqueueSseWrite(value);
+            if (!canContinue) {
+              break;
+            }
+          } else {
+            // Disabled path: parse SSE blocks, drop reasoning, re-serialize.
+            // Preserves id/event lines and GlobalEvent wrap when unchanged drop-only.
+            const blocks = sseSplitter.push(value);
+            let canContinue = true;
+            for (const block of blocks) {
+              const filtered = filterSseBlock(block, reasoningFilter);
+              if (!filtered) {
+                continue;
+              }
+              sseBoundary.observe(filtered);
+              canContinue = await enqueueSseWrite(filtered);
+              if (!canContinue) break;
+            }
+            if (!canContinue) {
+              break;
+            }
+          }
+        }
+      }
+
+      if (!includeReasoning && sseSplitter) {
+        for (const block of sseSplitter.finish()) {
+          const filtered = filterSseBlock(block, reasoningFilter);
+          if (filtered) {
+            sseBoundary.observe(filtered);
+            await enqueueSseWrite(filtered);
           }
         }
       }
@@ -524,6 +570,7 @@ export const registerOpenCodeProxy = (app, deps) => {
     } finally {
       clearConnectTimer();
       clearStallTimer();
+      reasoningFilter?.dispose?.();
       if (heartbeatTimer) {
         clearTimeout(heartbeatTimer);
         heartbeatTimer = null;
@@ -584,7 +631,7 @@ export const registerOpenCodeProxy = (app, deps) => {
 
   const forwardSanitizedSessionListRequest = async (req, res, next, logLabel) => {
     try {
-      const upstreamPath = await getRequestUpstreamPath(req);
+      const upstreamPath = stripIncludeReasoningParam(await getRequestUpstreamPath(req));
       const result = await fetchSessionListPayload(upstreamPath, { req });
 
       res.status(result.upstream.status);
@@ -617,6 +664,47 @@ export const registerOpenCodeProxy = (app, deps) => {
     }
   };
 
+  /**
+   * Official session.messages list (`GET /api/session/:id/message`).
+   * When includeReasoning=false, strip reasoning parts from the JSON body.
+   * includeReasoning is never forwarded upstream.
+   */
+  const forwardSessionMessagesListRequest = async (req, res, next) => {
+    try {
+      const includeReasoning = readIncludeReasoningQuery(req.query);
+      const upstreamPath = stripIncludeReasoningParam(await getRequestUpstreamPath(req));
+      const result = await fetchSessionListPayload(upstreamPath, { req });
+
+      res.status(result.upstream.status);
+      applyForwardProxyResponseHeaders(result.upstream.headers, res);
+
+      if (!result.isJson) {
+        res.setHeader('content-type', result.contentType);
+        res.end(result.bodyText);
+        return;
+      }
+
+      if (result.parseError || result.payload == null) {
+        res.setHeader('content-type', result.contentType);
+        res.end(result.bodyText);
+        return;
+      }
+
+      res.setHeader('content-type', result.contentType);
+      res.json(projectMessagesPayloadForReasoning(result.payload, includeReasoning));
+    } catch (error) {
+      if (isAbortError(error)) {
+        return;
+      }
+      console.error('[proxy] OpenCode session.messages proxy error:', error?.message ?? error);
+      if (!res.headersSent) {
+        res.status(503).json({ error: 'OpenCode service unavailable' });
+        return;
+      }
+      next(error);
+    }
+  };
+
   // Ensure API prefix is detected before proxying
   app.use('/api', (_req, _res, next) => {
     ensureOpenCodeApiPrefix();
@@ -776,6 +864,12 @@ export const registerOpenCodeProxy = (app, deps) => {
     return forwardSanitizedSessionListRequest(req, res, next, 'session.list');
   });
 
+  // Official session.messages list (not exact message — that is owned by
+  // session-turn-pages and registered before this proxy).
+  app.get('/api/session/:sessionID/message', (req, res, next) => {
+    return forwardSessionMessagesListRequest(req, res, next);
+  });
+
   app.get('/api/global/event', forwardSseRequest);
   app.get('/api/event', forwardSseRequest);