@wolfx/opencode-magic-context 0.26.0 → 0.27.2

package/src/shared/model-suggestion-retry.ts

@@ -6,18 +6,36 @@ import { parseProviderModel } from "./resolve-fallbacks";
 
 type Client = ReturnType<typeof createOpencodeClient>;
 
-type PromptBody = {
+/** Max time to wait for the best-effort child-session abort HTTP call before
+ *  giving up on its response (the abort still proceeds server-side). Keeps a
+ *  wedged abort endpoint from masking the original timeout/abort error. */
+const ABORT_CALL_TIMEOUT_MS = 3000;
+
+export type PromptBody = {
     model?: { providerID: string; modelID: string };
     [key: string]: unknown;
 };
 
-type PromptArgs = {
+export type PromptArgs = {
     path: { id: string };
     body: PromptBody;
     signal?: AbortSignal;
     [key: string]: unknown;
 };
 
+export interface PromptAttemptInfo {
+    /** Human-readable model label used in logs ("primary" or "provider/model"). */
+    label: string;
+    /** Zero-based attempt index: 0 is primary, 1+ are fallback models. */
+    attemptIndex: number;
+    /** True for configured fallback models, false for the primary attempt. */
+    isFallback: boolean;
+    /** Total attempted models including the primary and all configured fallbacks. */
+    totalAttempts: number;
+    /** Explicit model override for this attempt, when one was supplied. */
+    model?: { providerID: string; modelID: string };
+}
+
 export interface PromptRetryOptions {
     timeoutMs?: number;
     /** External abort signal — cancels the in-flight LLM prompt immediately when aborted */
@@ -47,6 +65,29 @@ export interface PromptRetryOptions {
     callContext?: string;
 }
 
+export interface ValidatedPromptRetryOptions<TOutput, TValidated> extends PromptRetryOptions {
+    /**
+     * Fetch the output produced by the just-completed prompt attempt. This is
+     * intentionally caller-owned because OpenCode exposes results via session
+     * messages and each caller validates a different shape.
+     */
+    fetchOutput: (args: PromptArgs, attempt: PromptAttemptInfo) => Promise<TOutput>;
+    /**
+     * Validate and optionally transform the fetched output. Throw to reject this
+     * model's output and advance to the next configured fallback model.
+     */
+    validateOutput: (
+        output: TOutput,
+        attempt: PromptAttemptInfo,
+    ) => TValidated | Promise<TValidated>;
+}
+
+export interface ValidatedPromptRetryResult<TOutput, TValidated> {
+    output: TOutput;
+    validated: TValidated;
+    attempt: PromptAttemptInfo;
+}
+
 export interface ModelSuggestionInfo {
     providerID: string;
     modelID: string;
@@ -171,7 +212,15 @@ async function promptWithTimeout(
  */
 async function abortChildRun(client: Client, sessionId: string): Promise<void> {
     try {
-        await client.session.abort({ path: { id: sessionId } });
+        // Bound the abort call: it's best-effort cleanup, and if the abort
+        // endpoint itself stalls (the runner is wedged) an unbounded await here
+        // would hang the caller and MASK the original timeout/abort error that we
+        // still need to surface. Race against a short timer; the abort keeps
+        // running server-side regardless of whether we wait for its response.
+        await Promise.race([
+            client.session.abort({ path: { id: sessionId } }),
+            new Promise<void>((resolve) => setTimeout(resolve, ABORT_CALL_TIMEOUT_MS)),
+        ]);
     } catch (error) {
         log(`[model-retry] child session abort failed for ${sessionId}: ${String(error)}`);
     }
@@ -368,3 +417,132 @@ export async function promptSyncWithModelSuggestionRetry(
     );
     throw lastError ?? new Error("All fallback models failed");
 }
+
+async function attemptAndValidate<TOutput, TValidated>(
+    client: Client,
+    args: PromptArgs,
+    timeoutMs: number,
+    signal: AbortSignal | undefined,
+    callContext: string,
+    attempt: PromptAttemptInfo,
+    options: ValidatedPromptRetryOptions<TOutput, TValidated>,
+): Promise<ValidatedPromptRetryResult<TOutput, TValidated>> {
+    await attemptOnce(client, args, timeoutMs, signal, callContext, attempt.label);
+    const output = await options.fetchOutput(args, attempt);
+    const validated = await options.validateOutput(output, attempt);
+    return { output, validated, attempt };
+}
+
+/**
+ * Run a prompt with model fallback support, but accept an attempt only after the
+ * caller validates the model's actual output. This covers "empty success" cases
+ * where the provider/OpenCode prompt call completes successfully but the subagent
+ * produced no usable assistant text / JSON.
+ *
+ * The happy path is still one prompt + one caller-owned output fetch: callers
+ * should use the returned output instead of fetching messages a second time.
+ * Validation failures are retryable across configured fallback models. If every
+ * attempt produces invalid output (or otherwise fails retryably), the first
+ * failure is re-thrown so callers surface the original failure semantics.
+ */
+export async function promptSyncWithValidatedOutputRetry<TOutput, TValidated = TOutput>(
+    client: Client,
+    args: PromptArgs,
+    options: ValidatedPromptRetryOptions<TOutput, TValidated>,
+): Promise<ValidatedPromptRetryResult<TOutput, TValidated>> {
+    const timeoutMs = options.timeoutMs ?? 300_000;
+    const callContext = options.callContext ?? "subagent";
+    const fallbacks = options.fallbackModels ?? [];
+
+    const explicitPrimaryLabel =
+        args.body.model?.providerID && args.body.model.modelID
+            ? `${args.body.model.providerID}/${args.body.model.modelID}`
+            : "primary";
+    const totalAttempts = fallbacks.length + 1;
+
+    let firstError: unknown = null;
+    let lastError: unknown = null;
+
+    try {
+        return await attemptAndValidate(
+            client,
+            args,
+            timeoutMs,
+            options.signal,
+            callContext,
+            {
+                label: explicitPrimaryLabel,
+                attemptIndex: 0,
+                isFallback: false,
+                totalAttempts,
+                model: args.body.model,
+            },
+            options,
+        );
+    } catch (error) {
+        firstError = error;
+        lastError = error;
+        if (isNonRetryable(error, options.signal)) throw error;
+
+        if (fallbacks.length === 0) {
+            throw error;
+        }
+
+        log(
+            `[${callContext}] primary (${explicitPrimaryLabel}) failed validation/prompt: ${shortErr(error)}; trying ${fallbacks.length} fallback(s)`,
+        );
+    }
+
+    for (let i = 0; i < fallbacks.length; i += 1) {
+        const parsed = parseProviderModel(fallbacks[i]);
+        if (!parsed) {
+            log(`[${callContext}] skipping invalid fallback spec: ${fallbacks[i]}`);
+            continue;
+        }
+
+        const label = `${parsed.providerID}/${parsed.modelID}`;
+        const attemptArgs: PromptArgs = {
+            ...args,
+            body: { ...args.body, model: parsed },
+        };
+        const attempt: PromptAttemptInfo = {
+            label,
+            attemptIndex: i + 1,
+            isFallback: true,
+            totalAttempts,
+            model: parsed,
+        };
+
+        try {
+            const result = await attemptAndValidate(
+                client,
+                attemptArgs,
+                timeoutMs,
+                options.signal,
+                callContext,
+                attempt,
+                options,
+            );
+            log(
+                `[${callContext}] fallback succeeded with ${label} (attempt ${i + 2}/${fallbacks.length + 1})`,
+            );
+            return result;
+        } catch (error) {
+            if (firstError === null) firstError = error;
+            lastError = error;
+            if (isNonRetryable(error, options.signal)) throw error;
+
+            const remaining = fallbacks.length - i - 1;
+            if (remaining > 0) {
+                log(
+                    `[${callContext}] ${label} failed validation/prompt: ${shortErr(error)}; ${remaining} fallback(s) left`,
+                );
+            }
+        }
+    }
+
+    log(
+        `[${callContext}] all models exhausted; tried: ${[explicitPrimaryLabel, ...fallbacks].join(", ")}; original error: ${shortErr(firstError)}; last error: ${shortErr(lastError)}`,
+    );
+    throw firstError ?? lastError ?? new Error("All fallback models failed validation");
+}

package/src/shared/models-dev-cache.test.ts

@@ -6,7 +6,9 @@ import {
     clearModelsDevCache,
     getModelsDevCacheState,
     getSdkContextLimit,
+    refreshModelLimitsAfterAuthOnce,
     refreshModelLimitsFromApi,
+    resetAuthRewarmLatchForTest,
 } from "./models-dev-cache";
 
 /**
@@ -198,6 +200,86 @@ describe("models-dev-cache (SDK-only)", () => {
         });
     });
 
+    describe("after-auth re-warm (once per process)", () => {
+        // The startup warm can run before provider auth is loaded, caching a raw
+        // pre-downshift limit (gpt-5.5 922k) that then survives restarts and is
+        // never corrected by the too-low-only recovery. The first usage event
+        // proves auth is live; one re-warm there overwrites the stale value.
+        function makeCountingClient(input: number) {
+            let calls = 0;
+            return {
+                client: {
+                    config: {
+                        providers: async () => {
+                            calls++;
+                            return {
+                                data: {
+                                    providers: [
+                                        {
+                                            id: "openai",
+                                            models: { "gpt-5.5": { limit: { input } } },
+                                        },
+                                    ],
+                                },
+                            };
+                        },
+                    },
+                },
+                calls: () => calls,
+            };
+        }
+
+        test("re-warm overwrites a stale pre-auth limit and runs only once per process", async () => {
+            resetAuthRewarmLatchForTest();
+            // Pre-auth startup warm cached the raw 922k.
+            await refreshModelLimitsFromApi(
+                makeClient([{ id: "openai", models: { "gpt-5.5": { limit: { input: 922000 } } } }]),
+            );
+            expect(getSdkContextLimit("openai", "gpt-5.5")).toBe(922000);
+
+            // First usage: auth is live, providers() now reports the 272k cap.
+            const { client, calls } = makeCountingClient(272000);
+            await refreshModelLimitsAfterAuthOnce(client);
+            expect(getSdkContextLimit("openai", "gpt-5.5")).toBe(272000);
+            expect(calls()).toBe(1);
+
+            // Subsequent usage events are a no-op (latch held).
+            await refreshModelLimitsAfterAuthOnce(client);
+            await refreshModelLimitsAfterAuthOnce(client);
+            expect(calls()).toBe(1);
+        });
+
+        test("a failed re-warm resets the latch so a later usage event retries", async () => {
+            resetAuthRewarmLatchForTest();
+            let calls = 0;
+            const flaky = {
+                config: {
+                    providers: async () => {
+                        calls++;
+                        // First attempt: empty payload (auth still settling) → no warm.
+                        if (calls === 1) return { data: { providers: [] } };
+                        return {
+                            data: {
+                                providers: [
+                                    {
+                                        id: "openai",
+                                        models: { "gpt-5.5": { limit: { input: 272000 } } },
+                                    },
+                                ],
+                            },
+                        };
+                    },
+                },
+            };
+            await refreshModelLimitsAfterAuthOnce(flaky);
+            expect(getSdkContextLimit("openai", "gpt-5.5")).toBeUndefined();
+            // Latch was reset on failure, so the next event retries and succeeds.
+            await refreshModelLimitsAfterAuthOnce(flaky);
+            expect(getSdkContextLimit("openai", "gpt-5.5")).toBe(272000);
+            expect(calls).toBe(2);
+        });
+    });
+
     describe("startup retry", () => {
         test("retries when the provider payload is empty, then succeeds", async () => {
             let calls = 0;

package/src/shared/models-dev-cache.ts

@@ -210,6 +210,41 @@ export async function refreshModelLimitsFromApi(
     }
 }
 
+// Once-per-process latch for the after-auth re-warm below.
+let authRewarmDone = false;
+
+/**
+ * Re-warm the limit cache ONCE per process, after auth is provably live.
+ *
+ * The startup warm (index.ts) can run before the user's provider auth is
+ * loaded. When it does, an auth-conditional limit patch hasn't applied yet, so
+ * `config.providers()` returns the RAW catalog limit (e.g. OpenAI gpt-5.5 OAuth
+ * is downshifted to a 272k input cap by OpenCode's Codex auth plugin only when
+ * `ctx.auth.type === "oauth"`; before auth loads it reports the raw 922k). That
+ * too-high value gets cached AND persisted as last-known-good, survives
+ * restarts, and the existing recovery only re-resolves a too-LOW limit
+ * (overflow / `percentage > 100`), so a too-HIGH one never self-corrects: the
+ * sidebar shows huge headroom while the backend rejects at the real cap (#179).
+ *
+ * The first `message.updated` carrying usage tokens proves a request succeeded,
+ * so auth + providers are fully resolved. Re-warming there overwrites any stale
+ * pre-auth limit with the live auth-adjusted one. Idempotent and cheap: a single
+ * `config.providers()` round-trip, then a no-op for the rest of the process. The
+ * latch is set before the await so concurrent `message.updated` events don't
+ * stack duplicate warms; a failed warm resets it so a later message retries.
+ */
+export async function refreshModelLimitsAfterAuthOnce(client: OpencodeClientLike): Promise<void> {
+    if (authRewarmDone) return;
+    authRewarmDone = true;
+    const ok = await refreshModelLimitsOnce(client);
+    if (!ok) authRewarmDone = false;
+}
+
+/** Test-only: reset the after-auth re-warm latch between cases. */
+export function resetAuthRewarmLatchForTest(): void {
+    authRewarmDone = false;
+}
+
 /** Single SDK fetch + cache rebuild. Returns true when providers were loaded. */
 async function refreshModelLimitsOnce(client: OpencodeClientLike): Promise<boolean> {
     try {

package/src/shared/redaction.test.ts

@@ -0,0 +1,84 @@
+/// <reference types="bun-types" />
+
+import { describe, expect, test } from "bun:test";
+
+import { hasShareabilitySensitiveText, redactSecretText } from "./redaction";
+
+describe("redactSecretText — token counts and scalar diagnostics stay visible", () => {
+    test("keeps numeric/boolean values whose key merely contains a secret word", () => {
+        // These log shapes are counts/flags, not secrets, so they must stay readable.
+        expect(redactSecretText("tokens.input=45000 cache.read=0 cache.write=0")).toBe(
+            "tokens.input=45000 cache.read=0 cache.write=0",
+        );
+        expect(redactSecretText("hasUsageTokens=true")).toBe("hasUsageTokens=true");
+        expect(redactSecretText("totalInputTokens=132000")).toBe("totalInputTokens=132000");
+        expect(redactSecretText("max_tokens=4096")).toBe("max_tokens=4096");
+    });
+
+    test("keeps quoted numeric values matched only on the key word", () => {
+        expect(redactSecretText('"max_tokens": "4096"')).toBe('"max_tokens": "4096"');
+    });
+
+    test("still redacts real secret string values", () => {
+        // High-entropy / non-scalar values must always be redacted; only bare
+        // numeric/boolean scalars are exempt from the key-based match.
+        expect(redactSecretText("api_key=sk-abc123XYZsecretvalue")).toContain("<REDACTED:");
+        expect(redactSecretText("api_key=sk-abc123XYZsecretvalue")).not.toContain(
+            "sk-abc123XYZsecretvalue",
+        );
+        expect(redactSecretText('"auth_token": "tok_live_9f8e7d6c5b"')).toContain("<REDACTED:");
+    });
+
+    test("value-shaped secret patterns still fire independent of key name", () => {
+        // A bearer/JWT value is caught by its own pattern even if its key is bland.
+        expect(redactSecretText("Authorization: Bearer abc123def456ghi789")).toContain(
+            "<REDACTED:bearer>",
+        );
+        expect(redactSecretText("blob=eyJhbGciOi.eyJzdWIiOiIx.SflKxwRJSMeKKF2QT4")).toContain(
+            "<JWT_REDACTED>",
+        );
+    });
+});
+
+describe("hasShareabilitySensitiveText", () => {
+    test("safe project facts are shareable", () => {
+        expect(
+            hasShareabilitySensitiveText(
+                "The historian runs as a hidden subagent and never busts the prompt cache.",
+            ),
+        ).toBe(false);
+        expect(
+            hasShareabilitySensitiveText("Migration v45 adds the retrospective watermark column."),
+        ).toBe(false);
+    });
+
+    test("flags inline key:value / key=value secrets the keyed redactor misses in prose", () => {
+        expect(hasShareabilitySensitiveText("Set api_key: sk-live-abc123 in the env.")).toBe(true);
+        expect(hasShareabilitySensitiveText("password=hunter2 for the staging box")).toBe(true);
+        expect(hasShareabilitySensitiveText("client_secret = abcdef in the OAuth app")).toBe(true);
+    });
+
+    test("flags Windows forward-slash home (sanitizePathString only rewrites backslash form)", () => {
+        expect(hasShareabilitySensitiveText("logs are under C:/Users/ufuk/AppData/mc")).toBe(true);
+    });
+
+    test("flags ~/ rooted personal paths", () => {
+        expect(hasShareabilitySensitiveText("config lives at ~/.config/opencode/x.jsonc")).toBe(
+            true,
+        );
+    });
+
+    test("flags local / private endpoints", () => {
+        expect(hasShareabilitySensitiveText("embed endpoint is http://localhost:1234/v1")).toBe(
+            true,
+        );
+        expect(hasShareabilitySensitiveText("the box answers on 127.0.0.1:8080")).toBe(true);
+        expect(hasShareabilitySensitiveText("LAN host 192.168.1.42 runs the model")).toBe(true);
+        expect(hasShareabilitySensitiveText("internal 10.0.0.5 endpoint")).toBe(true);
+    });
+
+    test("a public IP / port alone is not flagged by the private-range rules", () => {
+        // 8.8.8.8 is public; no private-range or localhost pattern should match.
+        expect(hasShareabilitySensitiveText("DNS resolver at 8.8.8.8")).toBe(false);
+    });
+});