@rynfar/meridian 1.69.0 → 1.71.0

package/plugin/meridian-v2.ts

@@ -16,11 +16,16 @@
  */
 
 import * as Plugin from "@opencode-ai/plugin/promise/plugin"
+import { Model } from "@opencode-ai/schema/model"
+import type { CatalogDraft } from "@opencode-ai/plugin/promise/catalog"
+import { readFileSync, renameSync, rmSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
 import {
   PRIORITY_ATTESTATION_HEADER,
   createPriorityAttestation,
   deleteHeader,
   getHeader,
+  meridianConfigDirectory,
   setHeader,
   type MutableHeaders,
 } from "./priority-attestation"
@@ -29,8 +34,37 @@ import {
 export const SUPPORTED_OPENCODE_V2_VERSION = "0.0.0-beta-18314"
 
 const MERIDIAN_PROVIDERS = new Set(["anthropic", "meridian"])
+const MERIDIAN_CATALOG_PROVIDER = "meridian"
 const PARENT_SESSION_ONE_SHOTS = new Set(["title", "summary"])
 const ATTACHED_COMPACTION_AGENT = "compaction"
+const MODEL_DISCOVERY_TIMEOUT_MS = 3_000
+const PROVIDER_READY_POLL_MS = 25
+
+/**
+ * Catalog cache, for the cold-start gap (#1008).
+ *
+ * Discovery cannot begin until OpenCode has finished assembling the catalog, so
+ * the first request against a freshly started server used to see only
+ * OpenCode's built-in models.dev entries and rejected a Meridian-only variant
+ * with `provider.no-route`. Awaiting the catalog inside `setup` deadlocks the
+ * server, so the seed has to come from somewhere that is not the catalog: a
+ * plain file, read synchronously before the first transform runs.
+ *
+ * The entry records the base URL it was discovered from and is only applied to a
+ * provider still pointed at that URL, so repointing OpenCode at a different
+ * Meridian cannot apply another one's models.
+ */
+const CATALOG_CACHE_FILE = "opencode-v2-catalog.json"
+const CATALOG_CACHE_VERSION = 1
+/** Bounds how stale a seed can be if discovery never succeeds again. */
+const CATALOG_CACHE_TTL_MS = 7 * 24 * 60 * 60 * 1_000
+// The plugin tree does not import from src/, so this mirrors VALID_EFFORTS in
+// src/proxy/effort.ts. A test asserts the two stay identical. Filtering in this
+// order also gives every model its variants low -> max regardless of the order
+// the proxy happens to serialise its capability object in.
+const MERIDIAN_EFFORTS = ["low", "medium", "high", "xhigh", "max"] as const
+
+export const MERIDIAN_V2_EFFORTS: readonly string[] = MERIDIAN_EFFORTS
 
 const SESSION_AFFINITY_HEADERS = [
   "x-opencode-session",
@@ -131,6 +165,356 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value)
 }
 
+export interface MeridianModel {
+  id: string
+  name: string
+  contextWindow: number
+  efforts: string[]
+}
+
+export interface MeridianProviderModels {
+  providerID: string
+  /** The URL these models came from, so a cached seed is never applied to another. */
+  baseURL?: string
+  models: MeridianModel[]
+}
+
+type MeridianCatalogClient = {
+  provider: {
+    get(input: { providerID: string }): Promise<unknown>
+  }
+  reload(): Promise<void>
+}
+
+type ModelFetcher = (input: string | URL | Request, init?: RequestInit) => Promise<Response>
+
+export function meridianModelsURL(baseURL: unknown): string | undefined {
+  if (typeof baseURL !== "string" || baseURL.length === 0) return undefined
+  try {
+    const url = new URL(baseURL)
+    if (url.protocol !== "http:" && url.protocol !== "https:") return undefined
+    url.search = ""
+    url.hash = ""
+    if (!url.pathname.endsWith("/")) url.pathname += "/"
+    // OpenCode's Anthropic provider carries the API version in the base URL
+    // (`http://127.0.0.1:3456/v1`), which is also the shape the V2 package gate
+    // configures. Appending `v1/models` there requests `/v1/v1/models`, a 404
+    // that silently disables discovery, so resolve `models` against an existing
+    // version segment instead.
+    const endpoint = /(?:^|\/)v1\/$/.test(url.pathname) ? "models" : "v1/models"
+    return new URL(endpoint, url).toString()
+  } catch {
+    return undefined
+  }
+}
+
+export function parseMeridianModels(value: unknown): MeridianModel[] | undefined {
+  if (!isRecord(value) || !Array.isArray(value.data)) return undefined
+
+  const models: MeridianModel[] = []
+  const ids = new Set<string>()
+  for (const item of value.data) {
+    if (!isRecord(item)) return undefined
+    const id = item.id
+    const name = item.display_name
+    const contextWindow = item.context_window
+    if (
+      typeof id !== "string"
+      || id.length === 0
+      || id.length > 256
+      || /[^\x21-\x7E]/.test(id)
+      || ids.has(id)
+      || typeof name !== "string"
+      || name.trim().length === 0
+      || name.length > 256
+      || typeof contextWindow !== "number"
+      || !Number.isSafeInteger(contextWindow)
+      || contextWindow <= 0
+    ) {
+      return undefined
+    }
+    const capabilities = isRecord(item.capabilities) ? item.capabilities : undefined
+    const effort = capabilities && isRecord(capabilities.effort) ? capabilities.effort : undefined
+    const efforts = MERIDIAN_EFFORTS.filter((level) => isRecord(effort?.[level]) && effort[level].supported === true)
+    ids.add(id)
+    models.push({ id, name, contextWindow, efforts })
+  }
+  return models
+}
+
+export async function fetchMeridianModels(
+  baseURL: unknown,
+  signal: AbortSignal,
+  fetcher: ModelFetcher = globalThis.fetch,
+): Promise<MeridianModel[] | undefined> {
+  const url = meridianModelsURL(baseURL)
+  if (!url || signal.aborted) return undefined
+
+  const controller = new AbortController()
+  const abort = () => controller.abort()
+  const timeout = setTimeout(abort, MODEL_DISCOVERY_TIMEOUT_MS)
+  timeout.unref?.()
+  signal.addEventListener("abort", abort, { once: true })
+  try {
+    const response = await fetcher(url, { signal: controller.signal })
+    if (!response.ok) return undefined
+    return parseMeridianModels(await response.json())
+  } catch {
+    return undefined
+  } finally {
+    clearTimeout(timeout)
+    signal.removeEventListener("abort", abort)
+  }
+}
+
+function meridianProviderBaseURL(value: unknown): unknown {
+  if (!isRecord(value)) return undefined
+  const provider = isRecord(value.data) ? value.data : value
+  if (!isRecord(provider.settings)) return undefined
+  return provider.settings.baseURL
+}
+
+function isLegacyMeridianBaseURL(baseURL: unknown): boolean {
+  if (typeof baseURL !== "string") return false
+  try {
+    const { hostname } = new URL(baseURL)
+    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]"
+  } catch {
+    return false
+  }
+}
+
+export interface MeridianCatalogLoad {
+  /** Providers whose base URL still looks like Meridian, reachable or not. */
+  readonly configured: string[]
+  readonly discovered: MeridianProviderModels[]
+}
+
+export async function loadMeridianModels(
+  catalog: MeridianCatalogClient,
+  signal: AbortSignal,
+  fetcher: ModelFetcher = globalThis.fetch,
+): Promise<MeridianCatalogLoad> {
+  const deadline = Date.now() + MODEL_DISCOVERY_TIMEOUT_MS
+  while (!signal.aborted) {
+    const providers = await Promise.all([...MERIDIAN_PROVIDERS].map(async (providerID) => {
+      try {
+        const baseURL = meridianProviderBaseURL(await catalog.provider.get({ providerID }))
+        if (providerID === MERIDIAN_CATALOG_PROVIDER && meridianModelsURL(baseURL) === undefined) return undefined
+        if (providerID !== MERIDIAN_CATALOG_PROVIDER && !isLegacyMeridianBaseURL(baseURL)) return undefined
+        return { providerID, baseURL }
+      } catch {
+        return undefined
+      }
+    }))
+    const configured = providers.flatMap(provider => provider ? [provider] : [])
+    if (configured.length > 0) {
+      const discovered = await Promise.all(configured.map(async ({ providerID, baseURL }) => {
+        const models = await fetchMeridianModels(baseURL, signal, fetcher)
+        return models ? { providerID, baseURL: typeof baseURL === "string" ? baseURL : undefined, models } : undefined
+      }))
+      return {
+        configured: configured.map(provider => provider.providerID),
+        discovered: discovered.flatMap(result => result ? [result] : []),
+      }
+    }
+    if (Date.now() >= deadline) return { configured: [], discovered: [] }
+    await new Promise<void>((resolve) => setTimeout(resolve, PROVIDER_READY_POLL_MS))
+  }
+  return { configured: [], discovered: [] }
+}
+
+export interface CachedProviderCatalog {
+  readonly baseURL: string
+  readonly models: readonly MeridianModel[]
+}
+
+export function catalogCachePath(): string {
+  return join(meridianConfigDirectory(), CATALOG_CACHE_FILE)
+}
+
+/**
+ * Validate a cache document as strictly as a discovery response.
+ *
+ * A corrupt or hand-edited file must seed nothing rather than write junk into
+ * the catalog, so every failure returns an empty map.
+ */
+export function parseCatalogCache(value: unknown, now: number): Map<string, CachedProviderCatalog> {
+  const entries = new Map<string, CachedProviderCatalog>()
+  if (!isRecord(value) || value.version !== CATALOG_CACHE_VERSION) return entries
+  if (!isRecord(value.providers)) return entries
+  for (const [providerID, entry] of Object.entries(value.providers)) {
+    if (!MERIDIAN_PROVIDERS.has(providerID) || !isRecord(entry)) continue
+    const { baseURL, fetchedAt } = entry
+    if (typeof baseURL !== "string" || meridianModelsURL(baseURL) === undefined) continue
+    if (typeof fetchedAt !== "number" || !Number.isSafeInteger(fetchedAt) || fetchedAt <= 0) continue
+    if (fetchedAt > now || now - fetchedAt > CATALOG_CACHE_TTL_MS) continue
+    const models = parseCachedModels(entry.models)
+    if (!models || models.length === 0) continue
+    entries.set(providerID, { baseURL, models })
+  }
+  return entries
+}
+
+function parseCachedModels(value: unknown): MeridianModel[] | undefined {
+  if (!Array.isArray(value)) return undefined
+  const models: MeridianModel[] = []
+  const ids = new Set<string>()
+  for (const item of value) {
+    if (!isRecord(item)) return undefined
+    const { id, name, contextWindow, efforts } = item
+    if (
+      typeof id !== "string"
+      || id.length === 0
+      || id.length > 256
+      || /[^\x21-\x7E]/.test(id)
+      || ids.has(id)
+      || typeof name !== "string"
+      || name.trim().length === 0
+      || name.length > 256
+      || typeof contextWindow !== "number"
+      || !Number.isSafeInteger(contextWindow)
+      || contextWindow <= 0
+      || !Array.isArray(efforts)
+      || efforts.some(effort => typeof effort !== "string" || !MERIDIAN_EFFORTS.includes(effort as never))
+    ) {
+      return undefined
+    }
+    ids.add(id)
+    models.push({ id, name, contextWindow, efforts: efforts as string[] })
+  }
+  return models
+}
+
+export function serializeCatalogCache(
+  discovered: readonly MeridianProviderModels[],
+  now: number,
+): string {
+  const providers: Record<string, unknown> = {}
+  for (const entry of discovered) {
+    if (typeof entry.baseURL !== "string" || entry.models.length === 0) continue
+    providers[entry.providerID] = { baseURL: entry.baseURL, fetchedAt: now, models: entry.models }
+  }
+  return `${JSON.stringify({ version: CATALOG_CACHE_VERSION, providers }, null, 2)}\n`
+}
+
+/**
+ * Drop the seed. Called when no Meridian-shaped provider is configured any
+ * more, so a later cold start cannot describe a provider this catalog no longer
+ * points at. Best effort, like the write.
+ */
+export function removeCatalogCache(remove: (path: string) => void = path => rmSync(path, { force: true })): void {
+  try {
+    remove(catalogCachePath())
+  } catch {
+    // Ignored on purpose: a stale seed is corrected by the next discovery.
+  }
+}
+
+/** Read the seed. Any failure — missing, unreadable, corrupt — seeds nothing. */
+export function readCatalogCache(
+  now: number,
+  read: (path: string) => string = path => readFileSync(path, "utf-8"),
+): Map<string, CachedProviderCatalog> {
+  try {
+    return parseCatalogCache(JSON.parse(read(catalogCachePath())), now)
+  } catch {
+    return new Map()
+  }
+}
+
+/**
+ * Persist the seed for the next cold start. Best effort: a cache we cannot write
+ * costs a deferred catalog on the next start, which is the old behaviour, so it
+ * must never interrupt a working session.
+ */
+export function writeCatalogCache(
+  discovered: readonly MeridianProviderModels[],
+  now: number,
+  write: (path: string, contents: string) => void = (path, contents) => {
+    // Rename onto the target so a concurrent reader never sees a partial file.
+    const temporary = `${path}.${process.pid}.tmp`
+    writeFileSync(temporary, contents, { encoding: "utf-8", mode: 0o600 })
+    renameSync(temporary, path)
+  },
+): void {
+  try {
+    const contents = serializeCatalogCache(discovered, now)
+    if (contents.includes('"providers": {}')) return
+    write(catalogCachePath(), contents)
+  } catch {
+    // Ignored on purpose: see above.
+  }
+}
+
+/**
+ * The only thing choosing a seed needs from the draft: whether a provider is
+ * still in the catalog. Narrower than `CatalogDraft` on purpose, so the decision
+ * stays unit-testable without standing up a whole branded provider record.
+ */
+export interface CatalogProviderProbe {
+  readonly provider: { get(providerID: string): unknown }
+}
+
+/**
+ * Choose what the transform should write: live discovery when it has landed,
+ * otherwise the cached seed.
+ *
+ * The seed cannot be validated against the provider's configured URL here. A
+ * draft `Provider.Info` exposes only `id`, `name`, `activation`, `package`,
+ * `integrationID` and `headers` — verified on beta-18866, where the whole
+ * record contains no URL at all. So the seed is applied optimistically to any
+ * Meridian provider that still exists in the catalog, and `discoverModels`
+ * corrects or drops it once it can read the real URL.
+ */
+export function resolveCatalogModels(
+  catalog: CatalogProviderProbe,
+  discovered: readonly MeridianProviderModels[],
+  cached: ReadonlyMap<string, CachedProviderCatalog>,
+): MeridianProviderModels[] {
+  if (discovered.length > 0) return [...discovered]
+  const seeded: MeridianProviderModels[] = []
+  for (const providerID of MERIDIAN_PROVIDERS) {
+    const entry = cached.get(providerID)
+    if (!entry) continue
+    if (!catalog.provider.get(providerID)) continue
+    seeded.push({ providerID, baseURL: entry.baseURL, models: [...entry.models] })
+  }
+  return seeded
+}
+
+/**
+ * Write Meridian's advertised models over the assembled V2 catalog.
+ *
+ * Meridian is authoritative for what it will actually serve: the context window
+ * follows the signed-in subscription (Sonnet stays 200k so a 1M turn is not
+ * billed as Extra Usage), and the effort levels are the ones the proxy accepts.
+ * OpenCode's built-in models.dev entries disagree — beta-18866 advertises a 1M
+ * Sonnet — so an entry that already exists must be corrected, not skipped.
+ *
+ * This does not overwrite user configuration. V2 layers `providers.<id>.models`
+ * on top of plugin transforms, verified live on beta-18866: a configured
+ * `claude-opus-5` override survived a transform that wrote a different name and
+ * context to the same model.
+ */
+export function applyMeridianModels(
+  catalog: CatalogDraft,
+  providerID: string,
+  models: readonly MeridianModel[],
+): void {
+  for (const model of models) {
+    catalog.model.update(providerID, model.id, (entry) => {
+      entry.name = model.name
+      entry.limit.context = model.contextWindow
+      entry.variants = model.efforts.map((effort) => ({
+        id: Model.VariantID.make(effort),
+        headers: {},
+        body: { effort },
+      }))
+    })
+  }
+}
+
 async function withTimeout<T>(pending: Promise<T>, timeoutMs: number): Promise<T | undefined> {
   let timer: ReturnType<typeof setTimeout> | undefined
   const timedOut = new Promise<undefined>((resolve) => {
@@ -196,6 +580,55 @@ const MeridianV2Plugin = Plugin.define({
       pending: Promise<ResolvedAgentMetadata>
     }>()
     const registered: Array<{ dispose: () => Promise<void> }> = []
+    const modelDiscoveryController = new AbortController()
+    let discoveredModels: MeridianProviderModels[] = []
+    let discoveryStarted = false
+    // Read synchronously, before the first transform can run. Awaiting the
+    // catalog here would deadlock the server, which is why the seed is a file
+    // and not a catalog read (#1008).
+    const cachedModels = readCatalogCache(Date.now())
+
+    registered.push(await context.catalog.transform((catalog) => {
+      for (const entry of resolveCatalogModels(catalog, discoveredModels, cachedModels)) {
+        applyMeridianModels(catalog, entry.providerID, entry.models)
+      }
+    }))
+
+    const discoverModels = async () => {
+      if (discoveryStarted || modelDiscoveryController.signal.aborted) return false
+      const loaded = await loadMeridianModels(context.catalog, modelDiscoveryController.signal)
+        .catch((): MeridianCatalogLoad => ({ configured: [], discovered: [] }))
+      if (modelDiscoveryController.signal.aborted) return false
+      if (loaded.configured.length === 0) {
+        // Nothing here points at Meridian any more — the user repointed the
+        // provider. A seed from a previous run would describe a different
+        // endpoint, so drop it and rebuild the catalog without it.
+        if (cachedModels.size > 0) {
+          cachedModels.clear()
+          removeCatalogCache()
+          await context.catalog.reload()
+        }
+        return false
+      }
+      // Configured but unreachable: keep the seed. It is the last thing Meridian
+      // actually served, which beats OpenCode's models.dev entries.
+      if (loaded.discovered.length === 0) return false
+      discoveryStarted = true
+      discoveredModels = loaded.discovered
+      // Seed the next cold start before the reload, so a crash mid-reload still
+      // leaves the catalog available to the following process.
+      writeCatalogCache(loaded.discovered, Date.now())
+      await context.catalog.reload()
+      return true
+    }
+
+    const catalogEvents = context.event.subscribe({ signal: modelDiscoveryController.signal })
+    void (async () => {
+      for await (const event of catalogEvents) {
+        if (event.type !== "catalog.updated") continue
+        if (await discoverModels()) return
+      }
+    })().catch(() => {})
 
     const resolveAgentTraits = (agent: string, refresh = false): Promise<ResolvedAgentMetadata> => {
       const cached = traitsByAgent.get(agent)
@@ -320,11 +753,15 @@ const MeridianV2Plugin = Plugin.define({
         }, { providerID }))
       }
     } catch (error) {
+      // Setup never returns its cleanup on this path, so the discovery
+      // subscription and its poll loop would otherwise outlive the failure.
+      modelDiscoveryController.abort()
       await Promise.allSettled(registered.map(({ dispose }) => dispose()))
       throw error
     }
 
     return async () => {
+      modelDiscoveryController.abort()
       const results = await Promise.allSettled(registered.map(({ dispose }) => dispose()))
       const failures = results.flatMap(result => result.status === "rejected" ? [result.reason] : [])
       if (failures.length > 0) throw new AggregateError(failures, "Failed to dispose Meridian V2 hooks")

package/plugin/priority-attestation.ts

@@ -32,10 +32,20 @@ export interface PriorityAttestationSignInput {
   readonly issuedAt: number
 }
 
-function configDirectory(): string {
+/**
+ * Meridian's own configuration directory, as the plugin sees it.
+ *
+ * Exported because the V2 plugin also keeps its catalog cache here: the plugin
+ * tree must not import from src/, so this is the one place the resolution lives.
+ */
+export function meridianConfigDirectory(): string {
   return process.env.MERIDIAN_CONFIG_DIR ?? join(homedir(), ".config", "meridian")
 }
 
+function configDirectory(): string {
+  return meridianConfigDirectory()
+}
+
 export function priorityAttestationKeyPath(): string {
   return join(configDirectory(), PRIORITY_ATTESTATION_KEY_FILE)
 }