@vantran-se/openchamber-web 1.23.0 → 1.24.3

package/server/lib/agent-tool/runtime.test.js

@@ -121,8 +121,8 @@ describe('managed agent tool runtime', () => {
     const pluginModule = await import(`${pathToFileURL(pluginPath).href}?both=${Date.now()}`);
     const { tool } = await pluginModule.OpenChamberPlugin();
 
-    const controlActions = tool.openchamber.args.action.enum;
-    const webActions = tool.openchamber_web.args.action.enum;
+    const controlActions = tool.openchamber.args.action.oneOf.map((entry) => entry.const);
+    const webActions = tool.openchamber_web.args.action.oneOf.map((entry) => entry.const);
     expect(webActions).toContain('browser.open');
     expect(controlActions).not.toContain('browser.open');
     expect(webActions).not.toContain('session.create');
@@ -133,6 +133,23 @@ describe('managed agent tool runtime', () => {
     expect(Object.keys(tool.openchamber.args.parameters.properties)).toContain('sessionId');
   });
 
+  it('keeps the action schema to one validator keyword', async () => {
+    // A node carrying both `enum` and `oneOf` is valid JSON Schema, but some
+    // OpenAI-compatible gateways reject it and answer with an empty completion
+    // instead of an error. `oneOf` is the keyword that stayed. Its branches
+    // carry the per-action descriptions the model reads.
+    const { runtime, dataDir } = await createRuntime();
+    await runtime.prepareManagedOpenCodeEnv();
+    const pluginPath = path.join(dataDir, 'agent-tool', 'openchamber-plugin.js');
+    const pluginModule = await import(`${pathToFileURL(pluginPath).href}?validator=${Date.now()}`);
+    const { tool } = await pluginModule.OpenChamberPlugin();
+
+    for (const entry of Object.values(tool)) {
+      expect(entry.args.action.oneOf).toBeInstanceOf(Array);
+      expect(entry.args.action).not.toHaveProperty('enum');
+    }
+  });
+
   it('accepts inputs passed beside the action, not only inside parameters', async () => {
     const { runtime, dataDir } = await createRuntime();
     const prepared = await runtime.prepareManagedOpenCodeEnv();
@@ -354,6 +371,75 @@ describe('managed agent tool runtime', () => {
     expect(response.body).toEqual(expect.objectContaining({ ok: true, action: 'projects.list' }));
   });
 
+  it.each([
+    ['0.0.0.0', 'http://127.0.0.1:3901/api/openchamber/agent-tool'],
+    ['::', 'http://127.0.0.1:3901/api/openchamber/agent-tool'],
+    [null, 'http://127.0.0.1:3901/api/openchamber/agent-tool'],
+    ['127.0.0.1', 'http://127.0.0.1:3901/api/openchamber/agent-tool'],
+    ['100.100.0.3', 'http://100.100.0.3:3901/api/openchamber/agent-tool'],
+    ['fd7a:115c::3', 'http://[fd7a:115c::3]:3901/api/openchamber/agent-tool'],
+  ])('points the callback at where a listener bound to %s answers', async (boundAddress, expectedUrl) => {
+    const { runtime } = await createRuntime({ getActiveHost: () => boundAddress });
+    const env = await runtime.prepareManagedOpenCodeEnv();
+    expect(env.OPENCHAMBER_AGENT_TOOL_URL).toBe(expectedUrl);
+  });
+
+  it.each([
+    ['100.100.0.3', '100.100.0.3', 200],
+    ['100.100.0.3', '::ffff:100.100.0.3', 200],
+    ['100.100.0.3', '100.100.0.7', 401],
+    ['fd7a:115c::3', 'fd7a:115c::3', 200],
+    ['fd7a:115c::3', 'fd7a:115c::7', 401],
+    ['0.0.0.0', '192.168.1.20', 401],
+    ['0.0.0.0', '0.0.0.0', 401],
+    [null, '192.168.1.20', 401],
+  ])('bound to %s, answers a token-bearing caller from %s with %i', async (boundAddress, remoteAddress, status) => {
+    const { runtime } = await createRuntime({ getActiveHost: () => boundAddress });
+    const env = await runtime.prepareManagedOpenCodeEnv();
+    const app = express();
+    app.use((req, _res, next) => {
+      Object.defineProperty(req.socket, 'remoteAddress', { value: remoteAddress, configurable: true });
+      next();
+    });
+    runtime.registerRoutes(app, express);
+
+    await request(app)
+      .post('/api/openchamber/agent-tool')
+      .set('authorization', `Bearer ${env.OPENCHAMBER_AGENT_TOOL_TOKEN}`)
+      .send({ input: { action: 'projects.list' } })
+      .expect(status);
+  });
+
+  it.each([
+    ['http://100.100.0.3:3901/api/openchamber/agent-tool', 'localhost,127.0.0.1', 'localhost,127.0.0.1,100.100.0.3'],
+    ['http://[fd7a:115c::3]:3901/api/openchamber/agent-tool', undefined, 'fd7a:115c::3'],
+    ['http://100.100.0.3:3901/api/openchamber/agent-tool', '100.100.0.3', '100.100.0.3'],
+    ['not a url', 'localhost', 'localhost'],
+  ])('keeps the callback %s away from an environment proxy', async (callbackUrl, existing, expected) => {
+    const { runtime, dataDir } = await createRuntime();
+    await runtime.prepareManagedOpenCodeEnv();
+    const keys = ['OPENCHAMBER_AGENT_TOOL_URL', 'NO_PROXY', 'no_proxy'];
+    const previous = keys.map((key) => process.env[key]);
+    try {
+      process.env.OPENCHAMBER_AGENT_TOOL_URL = callbackUrl;
+      for (const key of ['NO_PROXY', 'no_proxy']) {
+        if (existing === undefined) delete process.env[key];
+        else process.env[key] = existing;
+      }
+      const pluginPath = path.join(dataDir, 'agent-tool', 'openchamber-plugin.js');
+      const pluginModule = await import(`${pathToFileURL(pluginPath).href}?test=${Date.now()}`);
+      await pluginModule.OpenChamberPlugin();
+
+      expect(process.env.NO_PROXY).toBe(expected);
+      expect(process.env.no_proxy).toBe(expected);
+    } finally {
+      keys.forEach((key, index) => {
+        if (previous[index] === undefined) delete process.env[key];
+        else process.env[key] = previous[index];
+      });
+    }
+  });
+
   it('executes through the materialized plugin and authenticated callback', async () => {
     let activePort = null;
     const { runtime, dataDir } = await createRuntime({ getActivePort: () => activePort });

package/server/lib/changelog/update-notes.js

@@ -2,7 +2,7 @@
 //
 // The repo publishes `changelog/index.json` on `main`: one object per release,
 // newest first, with the app notes grouped as New / Improvements / Fixes /
-// Misc. This module fetches it and renders the releases between the installed
+// SDK / Misc. This module fetches it and renders the releases between the installed
 // version (exclusive) and the offered one (inclusive) as the Markdown the
 // dialog already understands: a `## [x.y.z] - YYYY-MM-DD` header per release,
 // the release title in bold, the intro, then the groups.
@@ -16,6 +16,7 @@ const GROUPS = [
   ['new', 'New'],
   ['improvements', 'Improvements'],
   ['fixes', 'Fixes'],
+  ['sdk', 'SDK'],
   ['misc', 'Misc'],
 ];
 

package/server/lib/changelog/update-notes.test.js

@@ -37,6 +37,25 @@ A short intro.
 - Faster.`);
   });
 
+  it('shows SDK notes between Fixes and Misc and omits an empty SDK group', () => {
+    const withSdk = [{
+      ...index[0],
+      app: { ...index[0].app, sdk: ['Actions: background execution.'], misc: ['Packaging update.'] },
+    }];
+    expect(renderUpdateNotes(withSdk, '1.2.2', '1.2.3', compare)).toContain(`### Fixes
+
+- Chat: no freeze.
+
+### SDK
+
+- Actions: background execution.
+
+### Misc
+
+- Packaging update.`);
+    expect(renderUpdateNotes([{ ...index[0], app: { sdk: [] } }], '1.2.2', '1.2.3', compare)).not.toContain('### SDK');
+  });
+
   it('returns null when nothing lies in the range or the payload is not an index', () => {
     expect(renderUpdateNotes(index, '1.2.3', '1.2.3', compare)).toBe(null);
     expect(renderUpdateNotes({ entries: [] }, '1.0.0', '9.9.9', compare)).toBe(null);

package/server/lib/event-stream/DOCUMENTATION.md

@@ -6,6 +6,7 @@ This module contains the OpenChamber message-stream WebSocket protocol and runti
 ## Entrypoints and structure
 - `packages/web/server/lib/event-stream/index.js`: public entrypoint re-exporting protocol and runtime helpers.
 - `packages/web/server/lib/event-stream/global-hub.js`: shared global upstream SSE hub for server-side subscribers and browser WS fan-out.
+- `packages/web/server/lib/event-stream/delta-coalescer.js`: merges consecutive `message.part.delta` events before replay and fan-out. Pure, with injectable clock and timers.
 - `packages/web/server/lib/event-stream/global-ws-bridge.js`: browser-facing global WS bridge that subscribes clients to the shared global hub.
 - `packages/web/server/lib/event-stream/directory-ws-bridge.js`: browser-facing per-directory WS bridge that owns one scoped upstream reader per connection.
 - `packages/web/server/lib/event-stream/protocol.js`: path constants, SSE envelope parsing, and WebSocket frame serialization helpers.
@@ -24,12 +25,16 @@ This module contains the OpenChamber message-stream WebSocket protocol and runti
 - `parseSseEventEnvelope(block)`: parses an SSE block into `{ eventId, directory, payload }`.
 - `sendMessageStreamWsFrame(socket, payload)`: serializes and sends a JSON WS frame.
 - `sendMessageStreamWsEvent(socket, payload, options)`: sends an event frame with optional `eventId` and `directory`.
+- `serializeMessageStreamWsEvent(payload, options)` and `sendSerializedMessageStreamWsFrame(socket, frame)` separate encoding from per-socket delivery. Delivery retains ready-state and backpressure checks.
 
 ### Runtime helpers
 - `createGlobalMessageStreamHub(...)`: creates a shared `/global/event` upstream SSE hub with event/status subscribers and bounded event-id replay.
 - `createGlobalUiEventBroadcaster({ sseClients, wsClients, writeSseEvent })`: returns a broadcaster that fans out the same synthetic UI event to SSE and WS clients.
 - `createMessageStreamWsRuntime(...)`: mounts the message-stream WS server, upgrade handler, and SSE-to-WS bridge onto the web HTTP server.
 
+### Coalescing helpers
+- `resolveDeltaCoalesceWindowMs(env)`: reads `OPENCHAMBER_EVENT_DELTA_COALESCE_MS`. Unset means 50ms, `0` turns coalescing off, and anything that is not a whole number from 0 to 1000 keeps the default with a warning.
+
 ### Upstream reader helpers
 - `DEFAULT_UPSTREAM_STALL_TIMEOUT_MS`: default idle timeout before an attached upstream SSE fetch is aborted for reconnect.
 - `DEFAULT_UPSTREAM_RECONNECT_DELAY_MS`: default delay between upstream reconnect attempts.
@@ -40,15 +45,35 @@ This module contains the OpenChamber message-stream WebSocket protocol and runti
 - OpenChamber still fetches OpenCode upstream event streams over SSE.
 - The web server creates one shared global message-stream hub. OpenCode watcher side effects and global WS clients subscribe to that hub, so there is one upstream `/global/event` SSE reader for both server-side processing and browser fan-out.
 - The global hub keeps a bounded replay buffer keyed by SSE `eventId` so reconnecting browser clients can receive buffered events after their requested `Last-Event-ID`.
+- Replay retains at most 2,048 events and 8 MiB of UTF-8 wire frames. It stores encoded frames rather than retaining parsed payloads as well. Encoding is shared with live WS fanout. An oversized event still reaches live clients in full, but clears the retained suffix so replay cannot cross its gap. A missing replay cursor returns `null`, distinct from a complete empty tail; the bridge sends `ready` with `replayReset: true` and no partial replay. The client retires its cursor and requests authoritative repair, including during the early-boot reconnect grace period. A stopped hub retains its bounded suffix for clients reconnecting after the last socket closed.
+- The hub numbers every event that arrives without an SSE id (`oc-<process>-<sequence>`). OpenCode 1.18 sends no ids at all, and an event without an id used to skip the replay buffer, so reconnecting clients had no cursor and lost whatever fell into the gap. The process prefix makes a cursor from before a server restart miss, which reports `replayReset`, instead of matching an unrelated sequence number.
 - Directory WS clients still attach one upstream `/event?directory=...` SSE reader per connection because directory streams are scoped.
 - If an upstream SSE stream stalls after the browser WS is already ready, the reader aborts that upstream fetch and reconnects upstream with `Last-Event-ID`, keeping the browser WS alive when recovery is fast.
 - When the shared global upstream reconnects after it was previously ready, the global WS bridge sends a fresh `ready` frame to already-ready browser clients. The browser treats this as a reconnect edge and can run scoped state repair without requiring the browser WS to close.
 - Health checks are reserved for initial upstream connect failures and explicit upstream-unavailable responses, not for ordinary stall recovery on an already-established stream.
 - Global synthetic events such as `openchamber:session-status`, `openchamber:session-activity`, `openchamber:notification`, and `openchamber:heartbeat` are preserved on the WS path, but heartbeat frames are emitted only while an upstream SSE stream is actively attached.
 - Global UI broadcasts are fan-out capable across both SSE and WS clients.
+- Global UI broadcasts serialize once per wire format, irrespective of client count. The SSE writer accepts an optional pre-serialized payload; isolated callers keep the two-argument contract. Failed or backpressured clients cannot block delivery to healthy clients.
 - The reusable upstream reader centralizes SSE fetch/parsing/reconnect behavior for the WS runtime and OpenCode watcher. Additional event consumers should move to it only with parity tests for their lifecycle and error semantics.
 - Browser transport concerns live in the WS bridge modules; server-side global stream ownership lives in `global-hub.js`.
 
+## Delta coalescing
+OpenCode publishes one `message.part.delta` per token fragment. A 5.7 KB answer measured 3,402 delta events of 1.7 characters each, 97% of all frames and 1.3 MB on the wire. The hub merges them before replay and fan-out, which cut that stream to 483 frames and 197 KB with identical text. Replay holds merged frames too, so its 2,048 entries cover about seven times more streaming time.
+
+Merging is lossless because of three rules. Change one only with the randomized test in `delta-coalescer.test.js` still passing.
+
+- Every event that is not a well-formed delta is a barrier. All pending text is emitted before it, so a delta never crosses a part snapshot or a status change.
+- Deltas of different part fields commute, so several stay pending at once. They are emitted in the order their latest fragment arrived, which keeps event ids in upstream order.
+- A merged event carries the id of its last fragment. A client cursor is the id of the last frame it received, so it always names a boundary between merged events.
+
+Pending text is bounded by time (the 50ms window), by size (64 KiB), and by part fields (64). Reaching a bound emits early. Nothing is dropped. The first delta after a quiet spell is emitted at once, so time to first text does not grow.
+
+The hub commits pending text when it stops, so it reaches the retained replay suffix, and the global bridge commits it before it marks a socket ready. A client readied later therefore receives exactly the events that arrived after it was ready, as it did before coalescing, and a reconnecting client receives the committed text through replay.
+
+Verified against a live server by dropping the socket every 150ms to 3s during a stream and resuming from the cursor: the reconstructed text matched byte for byte with no duplicate ids. Server-side hub subscribers receive merged events as well. None of them reads individual deltas.
+
+The directory WS bridge and the SSE proxy (`/api/global/event`, used by Capacitor) still forward unmerged events.
+
 ## Notes for contributors
 - Keep protocol helpers pure and small so they can be unit tested without spinning up a server.
 - Keep `runtime.js` focused on WebSocket upgrade and endpoint dispatch. Put global browser-client lifecycle in `global-ws-bridge.js`, directory stream lifecycle in `directory-ws-bridge.js`, and upstream stream sharing in `global-hub.js`.
@@ -56,6 +81,7 @@ This module contains the OpenChamber message-stream WebSocket protocol and runti
 - Keep global replay bounded; do not turn it into an unbounded event log.
 
 ## Testing
+- Run `bunx vitest run server/lib/event-stream` from `packages/web` for the whole module, including `delta-coalescer.test.js` and the resume-from-any-cursor cases in `global-hub.test.js`.
 - Run `bun test packages/web/server/lib/event-stream/protocol.test.js`
 - Run `bun test packages/web/server/lib/event-stream/upstream-reader.test.js`
 - Run `bun test packages/web/server/lib/event-stream/runtime.test.js`

package/server/lib/event-stream/delta-coalescer.test.js

@@ -0,0 +1,292 @@
+import { describe, expect, it } from 'vitest';
+
+import { createDeltaCoalescer, DELTA_COALESCE_WINDOW_MS, resolveDeltaCoalesceWindowMs } from './delta-coalescer.js';
+
+let nextId = 0;
+
+const delta = (partID, text, { messageID = 'msg_1', field = 'text', directory = '/repo', sessionID = 'ses_1' } = {}) => {
+  nextId += 1;
+  const id = String(nextId).padStart(6, '0');
+  const payload = { id, type: 'message.part.delta', properties: { sessionID, messageID, partID, field, delta: text } };
+  return { envelope: { eventId: id, directory, payload }, payload };
+};
+
+const other = (type, properties = {}) => {
+  nextId += 1;
+  const id = String(nextId).padStart(6, '0');
+  const payload = { id, type, properties };
+  return { envelope: { eventId: id, directory: '/repo', payload }, payload };
+};
+
+// A clock and timer queue the test advances by hand, so every assertion about
+// the window is exact instead of racing a real timeout.
+const createHarness = (options = {}) => {
+  let time = 1_000_000;
+  let timers = [];
+  let timerSeq = 0;
+  const emitted = [];
+  const coalescer = createDeltaCoalescer({
+    emit: (event) => emitted.push(event),
+    now: () => time,
+    setTimer: (callback, delay) => {
+      timerSeq += 1;
+      timers.push({ id: timerSeq, at: time + delay, callback });
+      return timerSeq;
+    },
+    clearTimer: (id) => {
+      timers = timers.filter((timer) => timer.id !== id);
+    },
+    ...options,
+  });
+  const advance = (ms) => {
+    const target = time + ms;
+    for (;;) {
+      const due = timers.filter((timer) => timer.at <= target).sort((left, right) => left.at - right.at)[0];
+      if (!due) break;
+      timers = timers.filter((timer) => timer !== due);
+      time = due.at;
+      due.callback();
+    }
+    time = target;
+  };
+  return { coalescer, emitted, advance, pendingTimers: () => timers.length };
+};
+
+const isDelta = (event) => event.payload.type === 'message.part.delta';
+const keyOf = (event) => `${event.payload.properties.messageID}:${event.payload.properties.partID}:${event.payload.properties.field}`;
+
+const textByKey = (events) => {
+  const text = new Map();
+  for (const event of events) {
+    if (!isDelta(event)) continue;
+    text.set(keyOf(event), (text.get(keyOf(event)) ?? '') + event.payload.properties.delta);
+  }
+  return text;
+};
+
+describe('delta coalescer', () => {
+  it('emits the first delta after a quiet spell at once and unchanged', () => {
+    const { coalescer, emitted } = createHarness();
+    const first = delta('prt_a', 'He');
+
+    coalescer.push(first);
+
+    expect(emitted).toEqual([first]);
+    expect(emitted[0]).toBe(first);
+  });
+
+  it('merges following deltas for one part field and carries the last fragment id', () => {
+    const { coalescer, emitted, advance, pendingTimers } = createHarness();
+    const fragments = [delta('prt_a', 'He'), delta('prt_a', 'll'), delta('prt_a', 'o,'), delta('prt_a', ' wor'), delta('prt_a', 'ld')];
+
+    for (const fragment of fragments) coalescer.push(fragment);
+    expect(emitted).toHaveLength(1);
+    advance(50);
+
+    expect(emitted).toHaveLength(2);
+    expect(emitted[1].payload.properties).toEqual({ sessionID: 'ses_1', messageID: 'msg_1', partID: 'prt_a', field: 'text', delta: 'llo, world' });
+    expect(emitted[1].envelope.eventId).toBe(fragments[4].envelope.eventId);
+    expect(emitted[1].payload.id).toBe(fragments[4].payload.id);
+    expect(emitted[1].envelope.payload).toBe(emitted[1].payload);
+    expect(pendingTimers()).toBe(0);
+    // Upstream objects are never mutated: other hub subscribers may hold them.
+    expect(fragments.map((fragment) => fragment.payload.properties.delta)).toEqual(['He', 'll', 'o,', ' wor', 'ld']);
+  });
+
+  it('never holds text longer than the window', () => {
+    const { coalescer, emitted, advance } = createHarness();
+    coalescer.push(delta('prt_a', 'a'));
+    coalescer.push(delta('prt_a', 'b'));
+
+    advance(49);
+    expect(emitted).toHaveLength(1);
+    advance(1);
+    expect(emitted).toHaveLength(2);
+  });
+
+  it('treats every other event as a barrier, so a delta never crosses a part snapshot', () => {
+    const { coalescer, emitted, advance } = createHarness();
+    const snapshot = other('message.part.updated', { part: { id: 'prt_a', messageID: 'msg_1', text: 'abc' } });
+
+    coalescer.push(delta('prt_a', 'a'));
+    coalescer.push(delta('prt_a', 'b'));
+    coalescer.push(delta('prt_a', 'c'));
+    coalescer.push(snapshot);
+    coalescer.push(delta('prt_a', 'd'));
+    coalescer.push(delta('prt_a', 'e'));
+    advance(50);
+
+    expect(emitted.map((event) => (isDelta(event) ? event.payload.properties.delta : event.payload.type)))
+      .toEqual(['a', 'bc', 'message.part.updated', 'de']);
+    expect(emitted[2]).toBe(snapshot);
+  });
+
+  it('keeps several part fields pending at once and emits them in upstream id order', () => {
+    const { coalescer, emitted, advance } = createHarness();
+    coalescer.push(delta('prt_lead', '.'));
+
+    coalescer.push(delta('prt_a', 'a1'));
+    coalescer.push(delta('prt_b', 'b1', { messageID: 'msg_2', sessionID: 'ses_2' }));
+    coalescer.push(delta('prt_a', 'a2'));
+    const lastB = delta('prt_b', 'b2', { messageID: 'msg_2', sessionID: 'ses_2' });
+    coalescer.push(lastB);
+    advance(50);
+
+    const merged = emitted.slice(1);
+    expect(merged.map((event) => event.payload.properties.delta)).toEqual(['a1a2', 'b1b2']);
+    expect(merged[1].envelope.eventId).toBe(lastB.envelope.eventId);
+    const ids = emitted.map((event) => event.envelope.eventId);
+    expect(ids).toEqual([...ids].sort());
+  });
+
+  it('does not merge the same part across directories, sessions, messages, or fields', () => {
+    const { coalescer, emitted, advance } = createHarness();
+    coalescer.push(delta('prt_lead', '.'));
+
+    coalescer.push(delta('prt_a', '1'));
+    coalescer.push(delta('prt_a', '2', { directory: '/other' }));
+    coalescer.push(delta('prt_a', '3', { messageID: 'msg_2' }));
+    coalescer.push(delta('prt_a', '4', { field: 'reasoning' }));
+    coalescer.push(delta('prt_a', '5', { sessionID: 'ses_2' }));
+    advance(50);
+
+    expect(emitted.slice(1).map((event) => event.payload.properties.delta)).toEqual(['1', '2', '3', '4', '5']);
+  });
+
+  it('bounds pending text by characters and by part fields, emitting early instead of dropping', () => {
+    const { coalescer, emitted } = createHarness({ maxPendingChars: 10, maxPendingKeys: 3 });
+    coalescer.push(delta('prt_lead', '.'));
+
+    let peakChars = 0;
+    for (let index = 0; index < 40; index += 1) {
+      coalescer.push(delta('prt_a', 'xyz'));
+      peakChars = Math.max(peakChars, coalescer.pendingSize().chars);
+    }
+    expect(peakChars).toBeLessThan(10 + 3);
+    expect(textByKey(emitted).get('msg_1:prt_a:text')).toBe('xyz'.repeat(40));
+
+    let peakKeys = 0;
+    for (let index = 0; index < 20; index += 1) {
+      coalescer.push(delta(`prt_k${index}`, 'k'));
+      peakKeys = Math.max(peakKeys, coalescer.pendingSize().keys);
+    }
+    expect(peakKeys).toBeLessThanOrEqual(3);
+    coalescer.flush();
+    expect(emitted.filter((event) => event.payload.properties.delta === 'k')).toHaveLength(20);
+  });
+
+  it('flushes on demand and leaves nothing pending', () => {
+    const { coalescer, emitted, pendingTimers } = createHarness();
+    coalescer.push(delta('prt_a', 'a'));
+    coalescer.push(delta('prt_a', 'b'));
+
+    coalescer.flush();
+
+    expect(emitted.map((event) => event.payload.properties.delta)).toEqual(['a', 'b']);
+    expect(coalescer.pendingSize()).toEqual({ keys: 0, chars: 0 });
+    expect(pendingTimers()).toBe(0);
+  });
+
+  it('passes a malformed delta through as a barrier instead of guessing', () => {
+    const { coalescer, emitted } = createHarness();
+    const malformed = other('message.part.delta', { messageID: 'msg_1', partID: 'prt_a', field: 'text', delta: 42 });
+
+    coalescer.push(delta('prt_a', 'a'));
+    coalescer.push(delta('prt_a', 'b'));
+    coalescer.push(malformed);
+
+    expect(emitted.map((event) => event.payload.properties.delta)).toEqual(['a', 'b', 42]);
+    expect(emitted[2]).toBe(malformed);
+  });
+
+  it('is a pass-through when the window is zero', () => {
+    const { coalescer, emitted } = createHarness({ windowMs: 0 });
+    const events = [delta('prt_a', 'a'), delta('prt_a', 'b'), delta('prt_a', 'c')];
+
+    for (const event of events) coalescer.push(event);
+
+    expect(emitted).toEqual(events);
+  });
+
+  // The properties that make coalescing safe, checked over arbitrary streams
+  // rather than the handful of shapes someone thought of.
+  it('loses, duplicates, and reorders nothing across randomized streams', () => {
+    let seed = 0x5eed;
+    const random = () => {
+      seed = (seed * 1664525 + 1013904223) % 4294967296;
+      return seed / 4294967296;
+    };
+
+    for (let round = 0; round < 40; round += 1) {
+      const { coalescer, emitted, advance } = createHarness({ maxPendingChars: 200, maxPendingKeys: 4 });
+      const raw = [];
+      const partCount = 1 + Math.floor(random() * 6);
+      for (let index = 0; index < 600; index += 1) {
+        const roll = random();
+        let event;
+        if (roll < 0.9) {
+          const part = Math.floor(random() * partCount);
+          event = delta(`prt_${part}`, `${index}|`.repeat(1 + Math.floor(random() * 3)), { messageID: `msg_${part % 2}` });
+        } else if (roll < 0.95) {
+          event = other('message.part.updated', { part: { id: `prt_${Math.floor(random() * partCount)}`, messageID: 'msg_0' } });
+        } else {
+          event = other('session.status', { sessionID: 'ses_1', status: { type: 'busy' } });
+        }
+        raw.push(event);
+        coalescer.push(event);
+        if (random() < 0.3) advance(Math.floor(random() * 80));
+      }
+      advance(1_000);
+
+      // Nothing lost or duplicated: every part field ends with the same text.
+      expect(textByKey(emitted)).toEqual(textByKey(raw));
+
+      // Every other event is delivered once, as the same object, in order.
+      expect(emitted.filter((event) => !isDelta(event))).toEqual(raw.filter((event) => !isDelta(event)));
+
+      // Barrier: the text delivered before each barrier is exactly the text
+      // that arrived before it.
+      for (const barrier of raw.filter((event) => !isDelta(event))) {
+        expect(textByKey(emitted.slice(0, emitted.indexOf(barrier)))).toEqual(textByKey(raw.slice(0, raw.indexOf(barrier))));
+      }
+
+      // Replay cursors: ids stay unique and in upstream order.
+      const ids = emitted.map((event) => event.envelope.eventId);
+      expect(new Set(ids).size).toBe(ids.length);
+      expect(ids).toEqual([...ids].sort());
+
+      expect(coalescer.pendingSize()).toEqual({ keys: 0, chars: 0 });
+    }
+  });
+
+  it('collapses a dense single-part stream to a few frames per window', () => {
+    const { coalescer, emitted, advance } = createHarness();
+
+    // 150 fragments a second for two seconds, the rate measured from OpenCode.
+    for (let index = 0; index < 300; index += 1) {
+      coalescer.push(delta('prt_a', 'ab'));
+      advance(index % 3 === 2 ? 8 : 6);
+    }
+    advance(50);
+
+    expect(textByKey(emitted).get('msg_1:prt_a:text')).toBe('ab'.repeat(300));
+    expect(emitted.length).toBeLessThanOrEqual(45);
+  });
+});
+
+describe('resolveDeltaCoalesceWindowMs', () => {
+  it('uses the default when unset and accepts zero as off', () => {
+    expect(resolveDeltaCoalesceWindowMs({})).toBe(DELTA_COALESCE_WINDOW_MS);
+    expect(resolveDeltaCoalesceWindowMs({ OPENCHAMBER_EVENT_DELTA_COALESCE_MS: ' ' })).toBe(DELTA_COALESCE_WINDOW_MS);
+    expect(resolveDeltaCoalesceWindowMs({ OPENCHAMBER_EVENT_DELTA_COALESCE_MS: '0' })).toBe(0);
+    expect(resolveDeltaCoalesceWindowMs({ OPENCHAMBER_EVENT_DELTA_COALESCE_MS: '25' })).toBe(25);
+  });
+
+  it('keeps the default and says so for anything that is not 0-1000 whole milliseconds', () => {
+    for (const value of ['-1', '1001', '12.5', 'fast', 'NaN', '1e9']) {
+      const warnings = [];
+      expect(resolveDeltaCoalesceWindowMs({ OPENCHAMBER_EVENT_DELTA_COALESCE_MS: value }, (message) => warnings.push(message))).toBe(DELTA_COALESCE_WINDOW_MS);
+      expect(warnings).toHaveLength(1);
+    }
+  });
+});

package/server/lib/event-stream/global-hub.js

@@ -1,8 +1,13 @@
+import { randomUUID } from 'node:crypto';
+
 import { createUpstreamSseReader } from './upstream-reader.js';
+import { serializeMessageStreamWsEvent } from './protocol.js';
+import { createDeltaCoalescer, DELTA_COALESCE_WINDOW_MS } from './delta-coalescer.js';
 
 // Raised from 512 → 2048 to improve recovery after brief disconnects during
 // long-running agent sessions where many events accumulate quickly.
 const MESSAGE_STREAM_GLOBAL_REPLAY_LIMIT = 2048;
+const MESSAGE_STREAM_GLOBAL_REPLAY_BYTES = 8 * 1024 * 1024;
 
 export function createGlobalMessageStreamHub({
   buildOpenCodeUrl,
@@ -11,10 +16,26 @@ export function createGlobalMessageStreamHub({
   upstreamStallTimeoutMs,
   upstreamReconnectDelayMs,
   replayLimit = MESSAGE_STREAM_GLOBAL_REPLAY_LIMIT,
+  replayByteLimit = MESSAGE_STREAM_GLOBAL_REPLAY_BYTES,
+  deltaCoalesceWindowMs = DELTA_COALESCE_WINDOW_MS,
 }) {
+  if (!Number.isSafeInteger(replayLimit) || replayLimit < 0 || !Number.isSafeInteger(replayByteLimit) || replayByteLimit < 0) {
+    throw new RangeError('Replay limits must be nonnegative safe integers');
+  }
   const eventSubscribers = new Set();
   const statusSubscribers = new Set();
   const replay = [];
+  let replayBytes = 0;
+  let latestEventId;
+  // OpenCode's event stream carries no SSE ids (verified on 1.18.30: not one
+  // frame in a full response), and an event without an id never entered the
+  // replay buffer, so a reconnecting browser had no cursor and every event in
+  // the gap was gone. The replay log is this hub's own, so the hub numbers
+  // what upstream leaves unnumbered. The per-process prefix makes a cursor
+  // from before a restart miss instead of matching an unrelated sequence
+  // number, which reports `replayReset` and sends the client to repair.
+  const replayIdPrefix = `oc-${randomUUID().slice(0, 8)}-`;
+  let replaySequence = 0;
 
   let controller = null;
   let reader = null;
@@ -44,15 +65,50 @@ export function createGlobalMessageStreamHub({
   const normalizeEvent = ({ envelope, payload }) => {
     const directory =
       typeof envelope?.directory === 'string' && envelope.directory.length > 0 ? envelope.directory : 'global';
-    const eventId = typeof envelope?.eventId === 'string' && envelope.eventId.length > 0 ? envelope.eventId : undefined;
+    const eventId = typeof envelope?.eventId === 'string' && envelope.eventId.length > 0
+      ? envelope.eventId
+      : `${replayIdPrefix}${String(++replaySequence).padStart(12, '0')}`;
+    let serializedFrame;
     return {
       envelope,
       payload,
       directory,
       eventId,
+      serialize() {
+        serializedFrame ??= serializeMessageStreamWsEvent(payload, { directory, eventId });
+        return serializedFrame;
+      },
     };
   };
 
+  // Replay and fan-out see the same committed sequence: an event enters the
+  // replay buffer in the same step that delivers it, so a client's cursor
+  // always names a frame the buffer can find.
+  const commitEvent = (event) => {
+    const normalized = normalizeEvent(event);
+    latestEventId = normalized.eventId;
+    const serializedFrame = normalized.serialize();
+    const bytes = Buffer.byteLength(serializedFrame);
+    if (bytes > replayByteLimit) {
+      // An oversized live event creates a hole: retain only a contiguous
+      // suffix after it, never replay an older prefix across the gap.
+      replay.length = 0;
+      replayBytes = 0;
+    } else {
+      replay.push({ eventId: normalized.eventId, serializedFrame, bytes });
+      replayBytes += bytes;
+      while (replay.length > replayLimit || replayBytes > replayByteLimit) {
+        replayBytes -= replay.shift().bytes;
+      }
+    }
+
+    for (const subscriber of Array.from(eventSubscribers)) {
+      notifySubscriber('event', subscriber, normalized);
+    }
+  };
+
+  const coalescer = createDeltaCoalescer({ emit: commitEvent, windowMs: deltaCoalesceWindowMs });
+
   const start = () => {
     if (reader) {
       return;
@@ -85,17 +141,7 @@ export function createGlobalMessageStreamHub({
         notifyStatus({ type: 'disconnect', reason });
       },
       onEvent(event) {
-        const normalized = normalizeEvent(event);
-        if (normalized.eventId) {
-          replay.push(normalized);
-          if (replay.length > replayLimit) {
-            replay.splice(0, replay.length - replayLimit);
-          }
-        }
-
-        for (const subscriber of Array.from(eventSubscribers)) {
-          notifySubscriber('event', subscriber, normalized);
-        }
+        coalescer.push(event);
       },
       onError(error) {
         if (controller?.signal.aborted) {
@@ -115,6 +161,8 @@ export function createGlobalMessageStreamHub({
 
   const stop = () => {
     connected = false;
+    // Text that already arrived belongs in the retained replay suffix.
+    coalescer.flush();
     reader?.stop();
     if (controller && !controller.signal.aborted) {
       controller.abort();
@@ -146,13 +194,20 @@ export function createGlobalMessageStreamHub({
         statusSubscribers.delete(subscriber);
       };
     },
+    // A client that becomes ready must not receive text from before it was
+    // ready merged into its first live delta, so the bridge commits pending
+    // deltas before it reads the replay tail.
+    flushPending() {
+      coalescer.flush();
+    },
     replayAfter(eventId) {
       if (!eventId) {
         return [];
       }
 
       const index = replay.findIndex((entry) => entry.eventId === eventId);
-      return index === -1 ? [] : replay.slice(index + 1);
+      if (eventId === latestEventId) return [];
+      return index === -1 ? null : replay.slice(index + 1);
     },
   };
 }