@rynfar/meridian 1.70.0 → 1.71.1

package/plugin/meridian-v2.ts

@@ -18,11 +18,14 @@
 import * as Plugin from "@opencode-ai/plugin/promise/plugin"
 import { Model } from "@opencode-ai/schema/model"
 import type { CatalogDraft } from "@opencode-ai/plugin/promise/catalog"
+import { readFileSync, renameSync, rmSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
 import {
   PRIORITY_ATTESTATION_HEADER,
   createPriorityAttestation,
   deleteHeader,
   getHeader,
+  meridianConfigDirectory,
   setHeader,
   type MutableHeaders,
 } from "./priority-attestation"
@@ -36,6 +39,25 @@ const PARENT_SESSION_ONE_SHOTS = new Set(["title", "summary"])
 const ATTACHED_COMPACTION_AGENT = "compaction"
 const MODEL_DISCOVERY_TIMEOUT_MS = 3_000
 const PROVIDER_READY_POLL_MS = 25
+
+/**
+ * Catalog cache, for the cold-start gap (#1008).
+ *
+ * Discovery cannot begin until OpenCode has finished assembling the catalog, so
+ * the first request against a freshly started server used to see only
+ * OpenCode's built-in models.dev entries and rejected a Meridian-only variant
+ * with `provider.no-route`. Awaiting the catalog inside `setup` deadlocks the
+ * server, so the seed has to come from somewhere that is not the catalog: a
+ * plain file, read synchronously before the first transform runs.
+ *
+ * The entry records the base URL it was discovered from and is only applied to a
+ * provider still pointed at that URL, so repointing OpenCode at a different
+ * Meridian cannot apply another one's models.
+ */
+const CATALOG_CACHE_FILE = "opencode-v2-catalog.json"
+const CATALOG_CACHE_VERSION = 1
+/** Bounds how stale a seed can be if discovery never succeeds again. */
+const CATALOG_CACHE_TTL_MS = 7 * 24 * 60 * 60 * 1_000
 // The plugin tree does not import from src/, so this mirrors VALID_EFFORTS in
 // src/proxy/effort.ts. A test asserts the two stay identical. Filtering in this
 // order also gives every model its variants low -> max regardless of the order
@@ -152,6 +174,8 @@ export interface MeridianModel {
 
 export interface MeridianProviderModels {
   providerID: string
+  /** The URL these models came from, so a cached seed is never applied to another. */
+  baseURL?: string
   models: MeridianModel[]
 }
 
@@ -260,11 +284,17 @@ function isLegacyMeridianBaseURL(baseURL: unknown): boolean {
   }
 }
 
+export interface MeridianCatalogLoad {
+  /** Providers whose base URL still looks like Meridian, reachable or not. */
+  readonly configured: string[]
+  readonly discovered: MeridianProviderModels[]
+}
+
 export async function loadMeridianModels(
   catalog: MeridianCatalogClient,
   signal: AbortSignal,
   fetcher: ModelFetcher = globalThis.fetch,
-): Promise<MeridianProviderModels[]> {
+): Promise<MeridianCatalogLoad> {
   const deadline = Date.now() + MODEL_DISCOVERY_TIMEOUT_MS
   while (!signal.aborted) {
     const providers = await Promise.all([...MERIDIAN_PROVIDERS].map(async (providerID) => {
@@ -281,14 +311,176 @@ export async function loadMeridianModels(
     if (configured.length > 0) {
       const discovered = await Promise.all(configured.map(async ({ providerID, baseURL }) => {
         const models = await fetchMeridianModels(baseURL, signal, fetcher)
-        return models ? { providerID, models } : undefined
+        return models ? { providerID, baseURL: typeof baseURL === "string" ? baseURL : undefined, models } : undefined
       }))
-      return discovered.flatMap(result => result ? [result] : [])
+      return {
+        configured: configured.map(provider => provider.providerID),
+        discovered: discovered.flatMap(result => result ? [result] : []),
+      }
     }
-    if (Date.now() >= deadline) return []
+    if (Date.now() >= deadline) return { configured: [], discovered: [] }
     await new Promise<void>((resolve) => setTimeout(resolve, PROVIDER_READY_POLL_MS))
   }
-  return []
+  return { configured: [], discovered: [] }
+}
+
+export interface CachedProviderCatalog {
+  readonly baseURL: string
+  readonly models: readonly MeridianModel[]
+}
+
+export function catalogCachePath(): string {
+  return join(meridianConfigDirectory(), CATALOG_CACHE_FILE)
+}
+
+/**
+ * Validate a cache document as strictly as a discovery response.
+ *
+ * A corrupt or hand-edited file must seed nothing rather than write junk into
+ * the catalog, so every failure returns an empty map.
+ */
+export function parseCatalogCache(value: unknown, now: number): Map<string, CachedProviderCatalog> {
+  const entries = new Map<string, CachedProviderCatalog>()
+  if (!isRecord(value) || value.version !== CATALOG_CACHE_VERSION) return entries
+  if (!isRecord(value.providers)) return entries
+  for (const [providerID, entry] of Object.entries(value.providers)) {
+    if (!MERIDIAN_PROVIDERS.has(providerID) || !isRecord(entry)) continue
+    const { baseURL, fetchedAt } = entry
+    if (typeof baseURL !== "string" || meridianModelsURL(baseURL) === undefined) continue
+    if (typeof fetchedAt !== "number" || !Number.isSafeInteger(fetchedAt) || fetchedAt <= 0) continue
+    if (fetchedAt > now || now - fetchedAt > CATALOG_CACHE_TTL_MS) continue
+    const models = parseCachedModels(entry.models)
+    if (!models || models.length === 0) continue
+    entries.set(providerID, { baseURL, models })
+  }
+  return entries
+}
+
+function parseCachedModels(value: unknown): MeridianModel[] | undefined {
+  if (!Array.isArray(value)) return undefined
+  const models: MeridianModel[] = []
+  const ids = new Set<string>()
+  for (const item of value) {
+    if (!isRecord(item)) return undefined
+    const { id, name, contextWindow, efforts } = item
+    if (
+      typeof id !== "string"
+      || id.length === 0
+      || id.length > 256
+      || /[^\x21-\x7E]/.test(id)
+      || ids.has(id)
+      || typeof name !== "string"
+      || name.trim().length === 0
+      || name.length > 256
+      || typeof contextWindow !== "number"
+      || !Number.isSafeInteger(contextWindow)
+      || contextWindow <= 0
+      || !Array.isArray(efforts)
+      || efforts.some(effort => typeof effort !== "string" || !MERIDIAN_EFFORTS.includes(effort as never))
+    ) {
+      return undefined
+    }
+    ids.add(id)
+    models.push({ id, name, contextWindow, efforts: efforts as string[] })
+  }
+  return models
+}
+
+export function serializeCatalogCache(
+  discovered: readonly MeridianProviderModels[],
+  now: number,
+): string {
+  const providers: Record<string, unknown> = {}
+  for (const entry of discovered) {
+    if (typeof entry.baseURL !== "string" || entry.models.length === 0) continue
+    providers[entry.providerID] = { baseURL: entry.baseURL, fetchedAt: now, models: entry.models }
+  }
+  return `${JSON.stringify({ version: CATALOG_CACHE_VERSION, providers }, null, 2)}\n`
+}
+
+/**
+ * Drop the seed. Called when no Meridian-shaped provider is configured any
+ * more, so a later cold start cannot describe a provider this catalog no longer
+ * points at. Best effort, like the write.
+ */
+export function removeCatalogCache(remove: (path: string) => void = path => rmSync(path, { force: true })): void {
+  try {
+    remove(catalogCachePath())
+  } catch {
+    // Ignored on purpose: a stale seed is corrected by the next discovery.
+  }
+}
+
+/** Read the seed. Any failure — missing, unreadable, corrupt — seeds nothing. */
+export function readCatalogCache(
+  now: number,
+  read: (path: string) => string = path => readFileSync(path, "utf-8"),
+): Map<string, CachedProviderCatalog> {
+  try {
+    return parseCatalogCache(JSON.parse(read(catalogCachePath())), now)
+  } catch {
+    return new Map()
+  }
+}
+
+/**
+ * Persist the seed for the next cold start. Best effort: a cache we cannot write
+ * costs a deferred catalog on the next start, which is the old behaviour, so it
+ * must never interrupt a working session.
+ */
+export function writeCatalogCache(
+  discovered: readonly MeridianProviderModels[],
+  now: number,
+  write: (path: string, contents: string) => void = (path, contents) => {
+    // Rename onto the target so a concurrent reader never sees a partial file.
+    const temporary = `${path}.${process.pid}.tmp`
+    writeFileSync(temporary, contents, { encoding: "utf-8", mode: 0o600 })
+    renameSync(temporary, path)
+  },
+): void {
+  try {
+    const contents = serializeCatalogCache(discovered, now)
+    if (contents.includes('"providers": {}')) return
+    write(catalogCachePath(), contents)
+  } catch {
+    // Ignored on purpose: see above.
+  }
+}
+
+/**
+ * The only thing choosing a seed needs from the draft: whether a provider is
+ * still in the catalog. Narrower than `CatalogDraft` on purpose, so the decision
+ * stays unit-testable without standing up a whole branded provider record.
+ */
+export interface CatalogProviderProbe {
+  readonly provider: { get(providerID: string): unknown }
+}
+
+/**
+ * Choose what the transform should write: live discovery when it has landed,
+ * otherwise the cached seed.
+ *
+ * The seed cannot be validated against the provider's configured URL here. A
+ * draft `Provider.Info` exposes only `id`, `name`, `activation`, `package`,
+ * `integrationID` and `headers` — verified on beta-18866, where the whole
+ * record contains no URL at all. So the seed is applied optimistically to any
+ * Meridian provider that still exists in the catalog, and `discoverModels`
+ * corrects or drops it once it can read the real URL.
+ */
+export function resolveCatalogModels(
+  catalog: CatalogProviderProbe,
+  discovered: readonly MeridianProviderModels[],
+  cached: ReadonlyMap<string, CachedProviderCatalog>,
+): MeridianProviderModels[] {
+  if (discovered.length > 0) return [...discovered]
+  const seeded: MeridianProviderModels[] = []
+  for (const providerID of MERIDIAN_PROVIDERS) {
+    const entry = cached.get(providerID)
+    if (!entry) continue
+    if (!catalog.provider.get(providerID)) continue
+    seeded.push({ providerID, baseURL: entry.baseURL, models: [...entry.models] })
+  }
+  return seeded
 }
 
 /**
@@ -391,19 +583,41 @@ const MeridianV2Plugin = Plugin.define({
     const modelDiscoveryController = new AbortController()
     let discoveredModels: MeridianProviderModels[] = []
     let discoveryStarted = false
+    // Read synchronously, before the first transform can run. Awaiting the
+    // catalog here would deadlock the server, which is why the seed is a file
+    // and not a catalog read (#1008).
+    const cachedModels = readCatalogCache(Date.now())
 
     registered.push(await context.catalog.transform((catalog) => {
-      for (const discovered of discoveredModels) {
-        applyMeridianModels(catalog, discovered.providerID, discovered.models)
+      for (const entry of resolveCatalogModels(catalog, discoveredModels, cachedModels)) {
+        applyMeridianModels(catalog, entry.providerID, entry.models)
       }
     }))
 
     const discoverModels = async () => {
       if (discoveryStarted || modelDiscoveryController.signal.aborted) return false
-      const models = await loadMeridianModels(context.catalog, modelDiscoveryController.signal).catch(() => [])
-      if (models.length === 0 || modelDiscoveryController.signal.aborted) return false
+      const loaded = await loadMeridianModels(context.catalog, modelDiscoveryController.signal)
+        .catch((): MeridianCatalogLoad => ({ configured: [], discovered: [] }))
+      if (modelDiscoveryController.signal.aborted) return false
+      if (loaded.configured.length === 0) {
+        // Nothing here points at Meridian any more — the user repointed the
+        // provider. A seed from a previous run would describe a different
+        // endpoint, so drop it and rebuild the catalog without it.
+        if (cachedModels.size > 0) {
+          cachedModels.clear()
+          removeCatalogCache()
+          await context.catalog.reload()
+        }
+        return false
+      }
+      // Configured but unreachable: keep the seed. It is the last thing Meridian
+      // actually served, which beats OpenCode's models.dev entries.
+      if (loaded.discovered.length === 0) return false
       discoveryStarted = true
-      discoveredModels = models
+      discoveredModels = loaded.discovered
+      // Seed the next cold start before the reload, so a crash mid-reload still
+      // leaves the catalog available to the following process.
+      writeCatalogCache(loaded.discovered, Date.now())
       await context.catalog.reload()
       return true
     }

package/plugin/priority-attestation.ts

@@ -32,10 +32,20 @@ export interface PriorityAttestationSignInput {
   readonly issuedAt: number
 }
 
-function configDirectory(): string {
+/**
+ * Meridian's own configuration directory, as the plugin sees it.
+ *
+ * Exported because the V2 plugin also keeps its catalog cache here: the plugin
+ * tree must not import from src/, so this is the one place the resolution lives.
+ */
+export function meridianConfigDirectory(): string {
   return process.env.MERIDIAN_CONFIG_DIR ?? join(homedir(), ".config", "meridian")
 }
 
+function configDirectory(): string {
+  return meridianConfigDirectory()
+}
+
 export function priorityAttestationKeyPath(): string {
   return join(configDirectory(), PRIORITY_ATTESTATION_KEY_FILE)
 }