backeer-opencode 0.8.2 → 0.10.0

package/dist/backeer-permission.js

@@ -1860,8 +1860,7 @@ import { homedir } from "node:os";
 import { join as join2 } from "node:path";
 
 // src/utilities.js
-var MAX_TRACKED_ITEMS = 500;
-var limit = (value, length = 1e3) => String(value ?? "").slice(0, length);
+var formatText = (value) => String(value ?? "");
 function enabled(value, fallback = true) {
   if (typeof value === "boolean") return value;
   if (typeof value !== "string") return fallback;
@@ -1875,10 +1874,9 @@ function stableHash(value) {
   }
   return (hash >>> 0).toString(16).padStart(8, "0");
 }
-function rememberBounded(map, key, value) {
+function remember(map, key, value) {
   map.delete(key);
   map.set(key, value);
-  while (map.size > MAX_TRACKED_ITEMS) map.delete(map.keys().next().value);
 }
 
 // src/reporter.js
@@ -1905,10 +1903,10 @@ function createOpenCodeReporter(client, levelValue) {
     const body = {
       service: "backeer-opencode",
       level: kind === "warning" ? "warn" : kind === "applied" || kind === "success" ? "info" : kind,
-      message: limit(message, 500)
+      message: formatText(message)
     };
     if (level === "debug" && detail) {
-      body.extra = { detail: limit(detail?.message ?? detail, 500) };
+      body.extra = { detail: formatText(detail?.message ?? detail) };
     }
     setTimeout(() => {
       void Promise.resolve(method.call(client.app, { body })).catch(() => {
@@ -1927,7 +1925,6 @@ function createOpenCodeReporter(client, levelValue) {
 function rememberRecent(map, key, value) {
   map.delete(key);
   map.set(key, value);
-  while (map.size > 100) map.delete(map.keys().next().value);
 }
 
 // src/live-bridge-config.js
@@ -1941,14 +1938,14 @@ function readCredential(file) {
   try {
     descriptor = openSync(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
     const stat = fstatSync(descriptor);
-    if (!stat.isFile() || stat.size > 4096 || process.platform !== "win32" && ((stat.mode & 63) !== 0 || stat.uid !== process.getuid())) {
+    if (!stat.isFile() || process.platform !== "win32" && ((stat.mode & 63) !== 0 || stat.uid !== process.getuid())) {
       throw new Error("invalid_file");
     }
     const token = readFileSync(descriptor, "utf8").trim();
-    if (!/^[A-Za-z0-9_-]{32,256}$/.test(token)) throw new Error("invalid_token");
+    if (!/^[A-Za-z0-9_-]{32,}$/.test(token)) throw new Error("invalid_token");
     return token;
   } catch {
-    throw new Error("Live control credential must be an owner-only regular file containing a 32\u2013256 character token");
+    throw new Error("Live control credential must be an owner-only regular file containing a token of at least 32 characters");
   } finally {
     if (descriptor !== void 0) closeSync(descriptor);
   }
@@ -2079,12 +2076,12 @@ function createDeliveryTracker() {
   return {
     begin(key) {
       if (states.has(key)) return false;
-      rememberBounded(states, key, "publishing");
+      remember(states, key, "publishing");
       return true;
     },
     succeed(key) {
       if (states.get(key) === "publishing") {
-        rememberBounded(states, key, "published");
+        remember(states, key, "published");
       }
     },
     fail(key) {
@@ -2101,7 +2098,7 @@ function createCompletionTracker() {
     let state = states.get(key);
     if (!state) {
       state = { complete: false, publishing: false, revision: 0 };
-      rememberBounded(states, key, state);
+      remember(states, key, state);
     }
     return state;
   }
@@ -2137,8 +2134,89 @@ function createCompletionTracker() {
   };
 }
 
+// src/live-bridge-events.js
+var ID = /^[A-Za-z0-9_-]+$/;
+var validBridgeID = (value) => typeof value === "string" && ID.test(value);
+function createBridgeSanitizer(secrets = []) {
+  const known = secrets.filter((value) => typeof value === "string" && value.length > 0);
+  const assistants = /* @__PURE__ */ new Map();
+  function text(value) {
+    if (typeof value !== "string") return "";
+    let result = value;
+    for (const secret of known) result = result.split(secret).join("[REDACTED]");
+    result = result.replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED PRIVATE KEY]").replace(/\bBearer\s+[^\s"'<>]+/gi, "Bearer [REDACTED]").replace(/\b(?:sk|bgi)_[A-Za-z0-9_-]{12,}|\bsk-[A-Za-z0-9_-]{12,}/g, "[REDACTED]").replace(/((?:api[_-]?key|access[_-]?token|secret|password|authorization)\s*[=:]\s*)[^\s,;]+/gi, "$1[REDACTED]");
+    return result;
+  }
+  function content(key, value) {
+    return { [key]: text(value) };
+  }
+  function sanitize(event) {
+    const p = event?.properties ?? event?.data ?? {};
+    const sessionID = p.sessionID ?? p.info?.sessionID ?? p.part?.sessionID;
+    if (!validBridgeID(sessionID) || sessionID === "global") return void 0;
+    const base = { type: event.type, sessionID, data: {} };
+    if (event.type === "message.updated") {
+      const info = p.info;
+      if (!validBridgeID(info?.id)) return void 0;
+      if (info.role === "assistant") {
+        assistants.set(info.id, sessionID);
+      }
+      return info.role === "assistant" ? { ...base, data: {
+        messageID: info.id,
+        completed: !!info.time?.completed,
+        failed: !!info.error
+      } } : void 0;
+    }
+    if (event.type === "message.part.updated") {
+      const part = p.part;
+      if (assistants.get(part?.messageID) !== sessionID) return void 0;
+      if (part.type === "text") return { ...base, type: "assistant.text", data: {
+        messageID: part.messageID,
+        ...content("text", part.text),
+        replace: true
+      } };
+      if (part.type !== "tool") return void 0;
+      const state = part.state ?? {};
+      return { ...base, type: "tool.status", data: {
+        tool: text(part.tool, 80),
+        status: text(state.status, 40),
+        ...state.status === "completed" ? content("output", state.output) : {},
+        ...state.status === "error" ? { failed: true } : {}
+      } };
+    }
+    if (event.type === "session.text.ended") return { ...base, type: "assistant.text", data: {
+      messageID: validBridgeID(p.assistantMessageID) ? p.assistantMessageID : void 0,
+      ...content("text", p.text),
+      replace: true
+    } };
+    if (["session.tool.called", "session.tool.success", "session.tool.failed"].includes(event.type)) {
+      return { ...base, type: "tool.status", data: {
+        status: event.type.split(".").at(-1),
+        ...event.type === "session.tool.success" ? content(
+          "output",
+          (p.content ?? []).filter((item) => item?.type === "text").map((item) => item.text).join("\n")
+        ) : {}
+      } };
+    }
+    if (["permission.asked", "question.asked", "question.v2.asked"].includes(event.type)) {
+      return { ...base, type: "approval.waiting", data: {
+        kind: event.type.split(".")[0],
+        ...event.type !== "permission.asked" && validBridgeID(p.id ?? p.requestID) ? { questionId: p.id ?? p.requestID } : {}
+      } };
+    }
+    if (["permission.replied", "question.replied", "question.v2.replied", "question.rejected", "question.v2.rejected"].includes(event.type)) {
+      return { ...base, type: "approval.settled", data: { kind: event.type.split(".")[0] } };
+    }
+    if (event.type === "session.status") return { ...base, data: {
+      status: ["idle", "busy", "retry"].includes(p.status?.type) ? p.status.type : "unknown"
+    } };
+    if (["session.idle", "session.error", "session.deleted"].includes(event.type)) return base;
+    return void 0;
+  }
+  return { sanitize, text, clear: () => assistants.clear() };
+}
+
 // src/http.js
-var RETRY_DELAYS_MS = [0, 500, 1500];
 var HttpError = class extends Error {
   constructor(message, status, responseBody = "") {
     super(message);
@@ -2169,16 +2247,16 @@ function sleep(milliseconds, signal2) {
   });
 }
 async function postJsonWithRetry(config, url, body, options = {}) {
-  const retryDelays = options.retryDelays ?? RETRY_DELAYS_MS;
-  for (let attempt = 0; attempt < retryDelays.length; attempt++) {
-    if (retryDelays[attempt] > 0) {
-      await sleep(retryDelays[attempt], options.signal);
-    }
-    if (options.signal?.aborted) throw new DOMException("Aborted", "AbortError");
+  const retryDelays = options.retryDelays;
+  const signal2 = options.signal ?? config.signal;
+  for (let attempt = 0; retryDelays === void 0 || attempt < retryDelays.length; attempt++) {
+    const retryDelay = retryDelays?.[attempt] ?? (attempt === 0 ? 0 : 3e3);
+    if (retryDelay > 0) await (options.sleepImplementation ?? sleep)(retryDelay, signal2);
+    if (signal2?.aborted) throw new DOMException("Aborted", "AbortError");
     const controller = new AbortController();
     const abort = () => controller.abort();
     const timeout = setTimeout(abort, options.timeoutMs ?? 5e3);
-    options.signal?.addEventListener("abort", abort, { once: true });
+    signal2?.addEventListener("abort", abort, { once: true });
     try {
       const response = await fetch(url, {
         method: "POST",
@@ -2190,22 +2268,22 @@ async function postJsonWithRetry(config, url, body, options = {}) {
         body: JSON.stringify(body),
         signal: controller.signal
       });
-      const responseBody = limit(await response.text(), 1e3);
+      const responseBody = await response.text();
       if (response.ok) return { status: response.status, responseBody };
-      if (!isRetryable(response.status) || attempt === retryDelays.length - 1) {
+      if (!isRetryable(response.status) || retryDelays !== void 0 && attempt === retryDelays.length - 1) {
         throw new HttpError(
           `HTTP request failed with status ${response.status}`,
           response.status,
-          responseBody
+          createBridgeSanitizer([config.token]).text(responseBody)
         );
       }
     } catch (error) {
-      if (options.signal?.aborted) throw new DOMException("Aborted", "AbortError");
+      if (signal2?.aborted) throw new DOMException("Aborted", "AbortError");
       if (error instanceof HttpError) throw error;
-      if (attempt === retryDelays.length - 1) throw error;
+      if (retryDelays !== void 0 && attempt === retryDelays.length - 1) throw error;
     } finally {
       clearTimeout(timeout);
-      options.signal?.removeEventListener("abort", abort);
+      signal2?.removeEventListener("abort", abort);
     }
   }
   throw new Error("HTTP retry loop ended unexpectedly");
@@ -2228,19 +2306,19 @@ async function publishPermission(config, reporter, request, directory, identity,
   const permissionType = request.permission ?? request.action ?? "unknown";
   const resources = Array.isArray(request.patterns) ? request.patterns.join(", ") : Array.isArray(request.resources) ? request.resources.join(", ") : "";
   const payload = [
-    { key: "Permission", value: limit(permissionType) },
-    { key: "Session", value: limit(identity.sessionID) },
-    { key: "Request ID", value: limit(identity.requestID) },
-    { key: "Patterns", value: limit(resources) },
-    { key: "Working directory", value: limit(directory) },
+    { key: "Permission", value: formatText(permissionType) },
+    { key: "Session", value: formatText(identity.sessionID) },
+    { key: "Request ID", value: formatText(identity.requestID) },
+    { key: "Patterns", value: formatText(resources) },
+    { key: "Working directory", value: formatText(directory) },
     { key: "Action protocol", value: ACTION_PROTOCOL },
     { key: "Available decisions", value: "once, always, reject" }
   ].filter((item) => item.value.length > 0);
   const result = await postJsonWithRetry(config, config.eventsEndpoint, {
     type: "application",
     severity: "warning",
-    title: `OpenCode permission required: ${limit(permissionType, 200)}`,
-    body: resources ? `OpenCode is waiting for approval to access: ${limit(resources, 500)}` : `OpenCode is waiting for approval for: ${limit(permissionType, 500)}`,
+    title: `OpenCode permission required: ${formatText(permissionType)}`,
+    body: resources ? `OpenCode is waiting for approval to access: ${formatText(resources)}` : `OpenCode is waiting for approval for: ${formatText(permissionType)}`,
     payload,
     externalId: identity.externalId,
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -2263,8 +2341,8 @@ function questionIdentity(request) {
 function formatQuestionOptions(options) {
   if (!Array.isArray(options)) return "";
   return options.map((option) => {
-    const label = limit(option?.label, 200);
-    const description = limit(option?.description, 500);
+    const label = formatText(option?.label);
+    const description = formatText(option?.description);
     if (!label) return "";
     return description ? `${label} \u2014 ${description}` : label;
   }).filter(Boolean).join(" | ");
@@ -2277,7 +2355,7 @@ async function resolveSessionTitle(client, directory, sessionID, reporter) {
       query: { directory },
       throwOnError: true
     });
-    return limit((result?.data ?? result)?.title);
+    return formatText((result?.data ?? result)?.title);
   } catch (error) {
     reporter.debug("Session title unavailable", error);
     return "";
@@ -2294,43 +2372,43 @@ async function publishQuestion(config, reporter, request, identity, client, dire
   );
   const payload = [
     { key: "OpenCode session", value: sessionTitle },
-    { key: "Session", value: limit(identity.sessionID) },
-    { key: "Request ID", value: limit(identity.requestID) },
+    { key: "Session", value: formatText(identity.sessionID) },
+    { key: "Request ID", value: formatText(identity.requestID) },
     { key: "Action protocol", value: QUESTION_ACTION_PROTOCOL },
     ...questions.flatMap((question, index) => {
       const suffix = questions.length > 1 ? ` ${index + 1}` : "";
       return [
-        { key: `Question title${suffix}`, value: limit(question?.header) },
-        { key: `Question${suffix}`, value: limit(question?.question) },
+        { key: `Question title${suffix}`, value: formatText(question?.header) },
+        { key: `Question${suffix}`, value: formatText(question?.question) },
         {
           key: `Options${suffix}`,
-          value: limit(formatQuestionOptions(question?.options))
+          value: formatText(formatQuestionOptions(question?.options))
         }
       ];
     })
   ].filter((item) => item.value.length > 0);
   const firstQuestion = questions[0];
   const actionQuestions = questions.map((question) => ({
-    header: limit(question?.header, 200),
-    question: limit(question?.question, 2e3),
-    options: Array.isArray(question?.options) ? question.options.slice(0, 20).map((option) => ({
-      label: limit(option?.label, 200),
-      description: limit(option?.description, 500)
+    header: formatText(question?.header),
+    question: formatText(question?.question),
+    options: Array.isArray(question?.options) ? question.options.map((option) => ({
+      label: formatText(option?.label),
+      description: formatText(option?.description)
     })).filter((option) => option.label) : [],
     multiple: question?.multiple === true,
     custom: question?.custom !== false
   }));
   const body = questions.map((question) => {
-    const header = limit(question?.header, 200);
-    const text = limit(question?.question, 500);
-    const options = limit(formatQuestionOptions(question?.options), 500);
+    const header = formatText(question?.header);
+    const text = formatText(question?.question);
+    const options = formatText(formatQuestionOptions(question?.options));
     return [header, text, options ? `Options: ${options}` : ""].filter(Boolean).join("\n");
   }).join("\n\n");
   const result = await postJsonWithRetry(config, config.eventsEndpoint, {
     type: "application",
     severity: "info",
-    title: `OpenCode question: ${limit(firstQuestion?.header, 200) || "Question"}`,
-    body: limit(body, 2e3),
+    title: `OpenCode question: ${formatText(firstQuestion?.header) || "Question"}`,
+    body: formatText(body),
     payload,
     externalId: identity.externalId,
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -2359,19 +2437,19 @@ async function publishTodoCompletion(config, reporter, request, eventID, client,
     request.sessionID,
     reporter
   );
-  const correlation = typeof eventID === "string" && eventID.length > 0 ? limit(eventID, 200) : stableHash(JSON.stringify(todos));
+  const correlation = typeof eventID === "string" && eventID.length > 0 ? formatText(eventID) : stableHash(JSON.stringify(todos));
   const externalId = `opencode-todo:${request.sessionID}:${correlation}`;
-  const visibleTodos = todos.slice(0, 20);
+  const visibleTodos = todos;
   const payload = [
     { key: "OpenCode session", value: sessionTitle },
     { key: "Completed tasks", value: String(todos.length) },
     ...visibleTodos.flatMap((todo, index) => [
-      { key: `Task ${index + 1}`, value: limit(todo?.content) },
-      { key: `Priority ${index + 1}`, value: limit(todo?.priority, 100) }
+      { key: `Task ${index + 1}`, value: formatText(todo?.content) },
+      { key: `Priority ${index + 1}`, value: formatText(todo?.priority) }
     ]),
     ...todos.length > visibleTodos.length ? [{ key: "Additional tasks", value: String(todos.length - visibleTodos.length) }] : []
   ].filter((item) => item.value.length > 0);
-  const summary = todos.slice(0, 5).map((todo) => limit(todo?.content, 200)).filter(Boolean).join(" \u2022 ");
+  const summary = todos.map((todo) => formatText(todo?.content)).filter(Boolean).join(" \u2022 ");
   const location = sessionTitle ? ` in ${sessionTitle}` : "";
   const body = [
     `All ${todos.length} OpenCode tasks completed${location}.`,
@@ -2381,7 +2459,7 @@ async function publishTodoCompletion(config, reporter, request, eventID, client,
     type: "application",
     severity: "info",
     title: "OpenCode todo list completed",
-    body: limit(body, 2e3),
+    body: formatText(body),
     payload,
     externalId,
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -2408,7 +2486,7 @@ import { randomUUID } from "node:crypto";
 import { statSync } from "node:fs";
 
 // src/updates.js
-var PLUGIN_VERSION = "0.8.2";
+var PLUGIN_VERSION = "0.10.0";
 var PACKAGE_NAME = "backeer-opencode";
 var NPM_REGISTRY_URL = "https://registry.npmjs.org";
 var CHECK_TIMEOUT_MS = 3e3;
@@ -2564,7 +2642,7 @@ async function probeSource(config, fetchImplementation = globalThis.fetch) {
       headers: { Authorization: `Bearer ${config.token}` },
       signal: controller.signal
     });
-    const responseBody = limit(await response.text(), 2e3);
+    const responseBody = formatText(await response.text());
     if (!response.ok) {
       throw new HttpError(
         `Gateway source check failed with status ${response.status}`,
@@ -2611,7 +2689,7 @@ async function buildDoctorReport(config, { fetchImplementation = globalThis.fetc
         text: result?.capabilities?.apns === true ? "Gateway APNs delivery is enabled" : "Gateway APNs delivery is disabled"
       });
     } catch (error) {
-      const detail = error instanceof HttpError && error.status === 401 ? "Source authentication rejected (HTTP 401)" : error?.name === "AbortError" ? "Gateway source check timed out" : `Gateway source check failed: ${limit(error?.message || error, 300)}`;
+      const detail = error instanceof HttpError && error.status === 401 ? "Source authentication rejected (HTTP 401)" : error?.name === "AbortError" ? "Gateway source check timed out" : `Gateway source check failed: ${formatText(error?.message || error)}`;
       checks.push({ ok: false, text: detail });
     }
   }
@@ -2648,7 +2726,6 @@ async function publishTestNotification(config, reporter) {
 }
 
 // src/feedback-session-store.js
-var MAX_QUEUED_MESSAGES = 20;
 var FeedbackSessionStore = class {
   constructor({ send, reporter, flushDelayMs = 150 }) {
     this.send = send;
@@ -2666,10 +2743,9 @@ var FeedbackSessionStore = class {
         blockers: /* @__PURE__ */ new Set(),
         queue: [],
         queued: /* @__PURE__ */ new Set(),
-        queueOverflowReported: false,
         flushTimer: void 0
       };
-      rememberBounded(this.sessions, sessionID, state);
+      remember(this.sessions, sessionID, state);
     }
     return state;
   }
@@ -2704,16 +2780,8 @@ var FeedbackSessionStore = class {
     const state = this.stateFor(sessionID);
     const key = `${sessionID}:${kind}:${message}`;
     if (state.queued.has(key)) return;
-    state.queue.push({ kind, message: limit(message, 300), key });
+    state.queue.push({ kind, message: formatText(message), key });
     state.queued.add(key);
-    if (state.queue.length > MAX_QUEUED_MESSAGES) {
-      const removed = state.queue.shift();
-      state.queued.delete(removed.key);
-      if (!state.queueOverflowReported) {
-        state.queueOverflowReported = true;
-        this.reporter.warning("Conversation feedback queue full \u2014 oldest message discarded");
-      }
-    }
     this.scheduleFlush(sessionID, state);
   }
   setIdle(sessionID, idle) {
@@ -2826,7 +2894,7 @@ async function sendSessionMessage(client, sessionID, text) {
 }
 function formatBackeerFeedback(kind, message) {
   const symbol = FEEDBACK_SYMBOLS[kind] ?? FEEDBACK_SYMBOLS.info;
-  return `\u25A3 Backeer | ${symbol} ${limit(message, 300)}`;
+  return `\u25A3 Backeer | ${symbol} ${formatText(message)}`;
 }
 function formatBackeerFeedbackBatch(items) {
   if (items.length === 1) {
@@ -2836,7 +2904,7 @@ function formatBackeerFeedbackBatch(items) {
     "\u25A3 Backeer",
     ...items.map((item) => {
       const symbol = FEEDBACK_SYMBOLS[item.kind] ?? FEEDBACK_SYMBOLS.info;
-      return `${symbol} ${limit(item.message, 300)}`;
+      return `${symbol} ${formatText(item.message)}`;
     })
   ].join("\n");
 }
@@ -3084,17 +3152,17 @@ var URL_WITH_QUERY = /\bhttps?:\/\/[^\s?#]+(?:\?[^\s#]*)?(?:#[^\s]*)?/gi;
 var WINDOWS_PATH = /\b[A-Za-z]:\\(?:[^\\\s]+\\)+[^\s]*/g;
 var POSIX_PATH = /(^|\s)\/(?:[^/\s]+\/)+[^\s]*/g;
 function sanitizeErrorMessage(value) {
-  return limit(value, 2e3).replace(CONTROL_CHARACTERS, " ").replace(BEARER_TOKEN, "Bearer [redacted]").replace(SECRET_ASSIGNMENT, "$1=[redacted]").replace(URL_WITH_QUERY, (value2) => {
+  return formatText(value).replace(CONTROL_CHARACTERS, " ").replace(BEARER_TOKEN, "Bearer [redacted]").replace(SECRET_ASSIGNMENT, "$1=[redacted]").replace(URL_WITH_QUERY, (value2) => {
     try {
       const url = new URL(value2);
       return `${url.origin}${url.pathname}`;
     } catch {
       return "[url redacted]";
     }
-  }).replace(WINDOWS_PATH, "[path redacted]").replace(POSIX_PATH, "$1[path redacted]").replace(/\s+/g, " ").trim().slice(0, 500);
+  }).replace(WINDOWS_PATH, "[path redacted]").replace(POSIX_PATH, "$1[path redacted]").replace(/\s+/g, " ").trim();
 }
 function safeErrorDetails(error) {
-  const name = limit(error?.name || "OpenCodeError", 100);
+  const name = formatText(error?.name || "OpenCodeError");
   const message = sanitizeErrorMessage(error?.data?.message ?? error?.message);
   const statusCode = Number.isInteger(error?.data?.statusCode) ? String(error.data.statusCode) : "";
   return { name, message, statusCode };
@@ -3107,7 +3175,7 @@ async function resolveSessionTitle2(client, directory, sessionID, reporter) {
       query: { directory },
       throwOnError: true
     });
-    return limit((result?.data ?? result)?.title);
+    return formatText((result?.data ?? result)?.title);
   } catch (error) {
     reporter.debug("Session title unavailable", error);
     return "";
@@ -3214,7 +3282,7 @@ async function publishSessionError({
     // Backeer/iOS currently support info, warning and critical severities.
     severity: "critical",
     title: "OpenCode task failed",
-    body: limit(body, 1e3),
+    body: formatText(body),
     payload: [
       { key: "OpenCode session", value: sessionTitle },
       { key: "Outcome", value: "Failed" },
@@ -3226,7 +3294,7 @@ async function publishSessionError({
   }, "Task failure sent");
 }
 async function publishOpenCodeUpdate({ config, reporter, version }) {
-  const safeVersion = limit(version, 100);
+  const safeVersion = formatText(version);
   await publish(config, reporter, void 0, void 0, {
     severity: "info",
     title: "OpenCode update available",
@@ -3236,8 +3304,8 @@ async function publishOpenCodeUpdate({ config, reporter, version }) {
   }, "OpenCode update sent");
 }
 function errorCorrelation(event, sessionState) {
-  if (typeof event?.id === "string" && event.id) return limit(event.id, 200);
-  if (sessionState?.lastAssistant?.id) return limit(sessionState.lastAssistant.id, 200);
+  if (typeof event?.id === "string" && event.id) return formatText(event.id);
+  if (sessionState?.lastAssistant?.id) return formatText(sessionState.lastAssistant.id);
   const details = safeErrorDetails(event?.properties?.error);
   return stableHash(`${details.name}:${details.statusCode}:${details.message}`);
 }
@@ -3277,7 +3345,7 @@ function createLifecycleController({
         lastAssistant: void 0,
         completedMessageID: ""
       };
-      rememberBounded(sessions, sessionID, state);
+      remember(sessions, sessionID, state);
     }
     return state;
   }
@@ -3312,7 +3380,7 @@ function createLifecycleController({
         client,
         directory,
         sessionID,
-        messageID: limit(assistant.id, 200),
+        messageID: formatText(assistant.id),
         durationMs,
         conversation
       }),
@@ -3359,7 +3427,7 @@ function createLifecycleController({
         client,
         directory,
         sessionID,
-        correlation: limit(correlation, 200),
+        correlation: formatText(correlation),
         attempt: status.attempt,
         next: status.next,
         conversation
@@ -3412,7 +3480,7 @@ function createLifecycleController({
         const version = event.properties?.version;
         if (typeof version !== "string" || !version.trim()) return;
         if (publishedUpdates.has(version)) return;
-        rememberBounded(publishedUpdates, version, true);
+        remember(publishedUpdates, version, true);
         dispatch(
           "OpenCode update could not be sent",
           sendUpdate({ config, reporter, version: version.trim() })
@@ -3428,7 +3496,7 @@ function createLifecycleController({
 
 // src/live-bridge.js
 import { createServer } from "node:http";
-import { randomUUID as randomUUID3, timingSafeEqual } from "node:crypto";
+import { randomUUID as randomUUID3, timingSafeEqual, createHash as createHash2 } from "node:crypto";
 import { resolve as resolve2 } from "node:path";
 
 // src/permission-command.js
@@ -3622,7 +3690,7 @@ async function openCommandStream(config, state, signal2, fetchImplementation) {
     signal: signal2
   });
   if (!response.ok) {
-    const responseBody = limit(await response.text(), 500);
+    const responseBody = formatText(await response.text());
     throw new HttpError(
       `Backeer command stream failed with status ${response.status}`,
       response.status,
@@ -3654,7 +3722,7 @@ async function consumeConnection({
   }
 }
 function streamErrorState(error, lastLoggedError, reconnectDelay, reporter) {
-  const message = error instanceof HttpError ? `${error.message}: ${error.responseBody}` : limit(error, 500);
+  const message = error instanceof HttpError ? `${error.message}: ${error.responseBody}` : formatText(error);
   if (message !== lastLoggedError) {
     const authenticationFailure = error instanceof HttpError && [401, 403].includes(error.status);
     reporter.error(
@@ -3664,7 +3732,7 @@ function streamErrorState(error, lastLoggedError, reconnectDelay, reporter) {
   }
   return {
     lastLoggedError: message,
-    reconnectDelay: error instanceof HttpError && [401, 403, 404].includes(error.status) ? 6e4 : reconnectDelay
+    reconnectDelay: error instanceof HttpError && [401, 403, 404].includes(error.status) ? 3e3 : reconnectDelay
   };
 }
 async function runCommandStream(config, reporter, {
@@ -3677,7 +3745,7 @@ async function runCommandStream(config, reporter, {
   stableConnectionMs = 5e3
 }) {
   const state = { lastEventID: "", framesReceived: 0 };
-  let reconnectDelay = 1e3;
+  let reconnectDelay = 3e3;
   let lastLoggedError = "";
   while (!signal2.aborted && hasPending()) {
     try {
@@ -3696,7 +3764,7 @@ async function runCommandStream(config, reporter, {
         now,
         stableConnectionMs,
         onStable: () => {
-          reconnectDelay = 1e3;
+          reconnectDelay = 3e3;
           lastLoggedError = "";
         }
       });
@@ -3708,7 +3776,7 @@ async function runCommandStream(config, reporter, {
     }
     if (!signal2.aborted && hasPending()) {
       await sleepImplementation(reconnectDelay, signal2);
-      reconnectDelay = Math.min(reconnectDelay * 2, 6e4);
+      reconnectDelay = 3e3;
     }
   }
 }
@@ -3796,7 +3864,7 @@ async function replyToQuestion(client, pending, response) {
 }
 async function postQuestionState(config, eventID, path, body = {}) {
   const url = new URL(`/v1/events/${encodeURIComponent(eventID)}/${path}`, config.origin);
-  await postJsonWithRetry(config, url, body, { retryDelays: [0, 500] });
+  await postJsonWithRetry(config, url, body);
 }
 function createPermissionController({
   config,
@@ -3852,7 +3920,7 @@ function createPermissionController({
   async function handleCommand(command) {
     if (!command || typeof command !== "object") return;
     if (!["opencode_permission_reply", "opencode_question_reply"].includes(command.type)) return;
-    if (typeof command.id !== "string" || command.id.length > 200) return;
+    if (typeof command.id !== "string") return;
     const previousAcknowledgement = completedCommands.get(command.id);
     if (previousAcknowledgement) {
       await acknowledgeCommand(config, command.id, previousAcknowledgement).catch((error) => reporter.warning("Decision receipt retry failed", error));
@@ -3902,7 +3970,7 @@ function createPermissionController({
       externalId: command.externalId,
       processedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    rememberBounded(completedCommands, command.id, acknowledgement);
+    remember(completedCommands, command.id, acknowledgement);
     if (isQuestion) {
       reportQuestionAcknowledgement(acknowledgement, pending, reporter, conversation);
     } else {
@@ -4009,8 +4077,8 @@ async function commonDirectory(directory) {
   return realpath(stdout.trim());
 }
 function approvedWorktreeSessions(value) {
-  if (!Array.isArray(value) || value.length > 16) return [];
-  return value.filter((item) => /^[A-Za-z0-9_-]{1,160}$/.test(item?.sessionID) && item.sessionID !== "global" && typeof item.directory === "string" && isAbsolute2(item.directory) && item.directory.length <= 4096);
+  if (!Array.isArray(value)) return [];
+  return value.filter((item) => /^[A-Za-z0-9_-]+$/.test(item?.sessionID) && item.sessionID !== "global" && typeof item.directory === "string" && isAbsolute2(item.directory));
 }
 function createSessionScope(directory, { resolveCommon = commonDirectory, approvedSessions = [] } = {}) {
   const observed = /* @__PURE__ */ new Map();
@@ -4021,7 +4089,6 @@ function createSessionScope(directory, { resolveCommon = commonDirectory, approv
     if (location === directory) {
       if (info.id) {
         observed.set(info.id, info.projectID);
-        if (observed.size > 256) observed.delete(observed.keys().next().value);
       }
       return true;
     }
@@ -4047,24 +4114,23 @@ function createV2LiveClient(ctx) {
     if (disposed) return info;
     await ownsSession(info);
     known.set(id, info);
-    if (known.size > 100) known.delete(known.keys().next().value);
     return info;
   }
   return {
     async list() {
       const refreshed = [];
       if (typeof ctx.session.list === "function") {
-        const result = await ctx.session.list({ directory: ctx.location.directory, limit: 100, order: "desc" });
+        const result = await ctx.session.list({ directory: ctx.location.directory, order: "desc" });
         const values = Array.isArray(result) ? result : result?.data;
         if (!Array.isArray(values)) throw new Error("Invalid native session list");
-        for (const info of values.slice(0, 100)) {
+        for (const info of values) {
           if (await ownsSession(info)) {
             refreshed.push(info);
             known.set(info.id, info);
           }
         }
       }
-      for (const id of [...known.keys()].slice(0, 100)) {
+      for (const id of [...known.keys()]) {
         if (refreshed.some((info) => info.id === id)) continue;
         try {
           refreshed.push(await get(id));
@@ -4166,100 +4232,13 @@ function createLiveConnectionNotifier(config, reporter) {
   };
 }
 
-// src/live-bridge-events.js
-var ID = /^[A-Za-z0-9_-]{1,160}$/;
-var validBridgeID = (value) => typeof value === "string" && ID.test(value);
-function createBridgeSanitizer(secrets = []) {
-  const known = secrets.filter((value) => typeof value === "string" && value.length > 0);
-  const assistants = /* @__PURE__ */ new Map();
-  function clipped(value, max = 12e3) {
-    if (typeof value !== "string") return { value: "", truncated: false };
-    let result = value.slice(0, 64e3);
-    for (const secret of known) result = result.split(secret).join("[REDACTED]");
-    result = result.replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED PRIVATE KEY]").replace(/\bBearer\s+[^\s"'<>]+/gi, "Bearer [REDACTED]").replace(/\b(?:sk|bgi)_[A-Za-z0-9_-]{12,}|\bsk-[A-Za-z0-9_-]{12,}/g, "[REDACTED]").replace(/((?:api[_-]?key|access[_-]?token|secret|password|authorization)\s*[=:]\s*)[^\s,;]+/gi, "$1[REDACTED]");
-    return { value: result.slice(0, max), truncated: value.length > 64e3 || result.length > max };
-  }
-  function text(value, max) {
-    return clipped(value, max).value;
-  }
-  function content(key, value) {
-    const result = clipped(value);
-    return { [key]: result.value, ...result.truncated ? { truncated: true } : {} };
-  }
-  function sanitize(event) {
-    const p = event?.properties ?? event?.data ?? {};
-    const sessionID = p.sessionID ?? p.info?.sessionID ?? p.part?.sessionID;
-    if (!validBridgeID(sessionID) || sessionID === "global") return void 0;
-    const base = { type: event.type, sessionID, data: {} };
-    if (event.type === "message.updated") {
-      const info = p.info;
-      if (!validBridgeID(info?.id)) return void 0;
-      if (info.role === "assistant") {
-        assistants.set(info.id, sessionID);
-        if (assistants.size > 256) assistants.delete(assistants.keys().next().value);
-      }
-      return info.role === "assistant" ? { ...base, data: {
-        messageID: info.id,
-        completed: !!info.time?.completed,
-        failed: !!info.error
-      } } : void 0;
-    }
-    if (event.type === "message.part.updated") {
-      const part = p.part;
-      if (assistants.get(part?.messageID) !== sessionID) return void 0;
-      if (part.type === "text") return { ...base, type: "assistant.text", data: {
-        messageID: part.messageID,
-        ...content("text", part.text),
-        replace: true
-      } };
-      if (part.type !== "tool") return void 0;
-      const state = part.state ?? {};
-      return { ...base, type: "tool.status", data: {
-        tool: text(part.tool, 80),
-        status: text(state.status, 40),
-        ...state.status === "completed" ? content("output", state.output) : {},
-        ...state.status === "error" ? { failed: true } : {}
-      } };
-    }
-    if (event.type === "session.text.ended") return { ...base, type: "assistant.text", data: {
-      messageID: validBridgeID(p.assistantMessageID) ? p.assistantMessageID : void 0,
-      ...content("text", p.text),
-      replace: true
-    } };
-    if (["session.tool.called", "session.tool.success", "session.tool.failed"].includes(event.type)) {
-      return { ...base, type: "tool.status", data: {
-        status: event.type.split(".").at(-1),
-        ...event.type === "session.tool.success" ? content(
-          "output",
-          (p.content ?? []).filter((item) => item?.type === "text").map((item) => item.text).join("\n")
-        ) : {}
-      } };
-    }
-    if (["permission.asked", "question.asked", "question.v2.asked"].includes(event.type)) {
-      return { ...base, type: "approval.waiting", data: {
-        kind: event.type.split(".")[0],
-        ...event.type !== "permission.asked" && validBridgeID(p.id ?? p.requestID) ? { questionId: p.id ?? p.requestID } : {}
-      } };
-    }
-    if (["permission.replied", "question.replied", "question.v2.replied", "question.rejected", "question.v2.rejected"].includes(event.type)) {
-      return { ...base, type: "approval.settled", data: { kind: event.type.split(".")[0] } };
-    }
-    if (event.type === "session.status") return { ...base, data: {
-      status: ["idle", "busy", "retry"].includes(p.status?.type) ? p.status.type : "unknown"
-    } };
-    if (["session.idle", "session.error", "session.deleted"].includes(event.type)) return base;
-    return void 0;
-  }
-  return { sanitize, text, clear: () => assistants.clear() };
-}
-
 // src/live-questions.js
 import { createHash } from "node:crypto";
 var invalid = (code = "invalid_question_answer", status = 422) => Object.assign(new Error(code), { code, status });
 function questionSnapshot(pending, text) {
-  if (!validBridgeID(pending?.id) || !validBridgeID(pending?.sessionID) || pending.sessionID === "global" || !Array.isArray(pending.questions) || !pending.questions.length || pending.questions.length > 16) throw invalid("unsupported_question");
+  if (!validBridgeID(pending?.id) || !validBridgeID(pending?.sessionID) || pending.sessionID === "global" || !Array.isArray(pending.questions) || !pending.questions.length) throw invalid("unsupported_question");
   const questions = pending.questions.map((question, index) => {
-    if (typeof question.question !== "string" || !Array.isArray(question.options) || question.options.length > 32 || question.options.some((option) => typeof option?.label !== "string") || new Set(question.options.map((option) => option.label)).size !== question.options.length) {
+    if (typeof question.question !== "string" || !Array.isArray(question.options) || question.options.some((option) => typeof option?.label !== "string") || new Set(question.options.map((option) => option.label)).size !== question.options.length) {
       throw invalid("unsupported_question");
     }
     return {
@@ -4282,14 +4261,13 @@ function questionSnapshot(pending, text) {
     ...pending.nativeRevision ? { nativeRevision: pending.nativeRevision } : {}
   })).digest("hex");
   const result = { questionId: pending.id, sessionID: pending.sessionID, revision, questions };
-  if (Buffer.byteLength(JSON.stringify(result)) > 3e4) throw invalid("question_too_large");
   return result;
 }
 function resolveQuestionAnswers(pending, answers) {
   if (!Array.isArray(answers) || answers.length !== pending.questions.length) throw invalid();
   const values = answers.map((answer, index) => {
     const question = pending.questions[index];
-    if (!answer || !Array.isArray(answer.choices) || answer.choices.length > 32 || Object.keys(answer).some((key) => !["choices", "text"].includes(key)) || new Set(answer.choices).size !== answer.choices.length || answer.choices.some((choice) => !Number.isInteger(choice) || choice < 0 || choice >= question.options.length) || answer.text !== void 0 && (typeof answer.text !== "string" || !answer.text.trim() || answer.text.length > 8e3)) throw invalid();
+    if (!answer || !Array.isArray(answer.choices) || Object.keys(answer).some((key) => !["choices", "text"].includes(key)) || new Set(answer.choices).size !== answer.choices.length || answer.choices.some((choice) => !Number.isInteger(choice) || choice < 0 || choice >= question.options.length) || answer.text !== void 0 && (typeof answer.text !== "string" || !answer.text.trim())) throw invalid();
     if (answer.text !== void 0 && question.custom !== true) throw invalid("custom_not_allowed");
     return [
       ...answer.choices.map((choice) => question.options[choice].label),
@@ -4302,7 +4280,6 @@ function resolveQuestionAnswers(pending, answers) {
 }
 
 // src/live-bridge.js
-var LIMITS = { events: 256, bytes: 2e6, clients: 8, commands: 1024, commandTTL: 864e5, body: 32768, requests: 16 };
 function failure(status, code) {
   return Object.assign(new Error(code), { status, code });
 }
@@ -4314,10 +4291,7 @@ function json(response, status, value) {
 }
 async function readBody(request) {
   const chunks = [];
-  let bytes = 0;
   for await (const chunk of request) {
-    bytes += chunk.length;
-    if (bytes > LIMITS.body) throw failure(413, "body_too_large");
     chunks.push(chunk);
   }
   try {
@@ -4342,45 +4316,44 @@ async function createLiveBridge({ config, client, directory, reporter }) {
   const sanitizer = createBridgeSanitizer([token, config.token]);
   const epoch = randomUUID3();
   const events = [], streams = /* @__PURE__ */ new Set(), commands = /* @__PURE__ */ new Map(), states = /* @__PURE__ */ new Map();
-  let sequence = 0, bytes = 0, active = 0, disposed = false, disposeTask;
-  let lookups = 0;
-  const lookupWaiters = /* @__PURE__ */ new Set();
+  let sequence = 0, disposed = false, disposeTask;
+  const lookupWaiters = /* @__PURE__ */ new Set(), lookups = /* @__PURE__ */ new Map();
   const cursor = () => `${epoch}:${sequence}`;
-  function lookup(id) {
+  function lookup(id, signal2) {
     if (disposed) return Promise.reject(failure(503, "bridge_closed"));
-    if (lookups >= 16) return Promise.reject(failure(429, "session_lookup_busy"));
-    lookups++;
+    let entry = lookups.get(id);
+    if (!entry) {
+      entry = { waiters: /* @__PURE__ */ new Set() };
+      lookups.set(id, entry);
+      const settled = (ok, value) => {
+        lookups.delete(id);
+        for (const finish of [...entry.waiters]) finish(ok, value);
+      };
+      Promise.resolve().then(() => api.get(id)).then((value) => settled(true, value), (error) => settled(false, error));
+    }
     return new Promise((resolve3, reject) => {
-      let finished = false;
-      const finish = (complete, value) => {
-        if (finished) return;
-        finished = true;
-        clearTimeout(timer);
+      const finish = (ok, value) => {
+        if (!entry.waiters.delete(finish)) return;
         lookupWaiters.delete(cancel);
-        complete(value);
+        signal2?.removeEventListener("abort", aborted);
+        if (ok) resolve3(value);
+        else reject(value);
       };
-      const cancel = () => finish(reject, failure(503, "bridge_closed"));
-      const timer = setTimeout(() => finish(reject, failure(504, "session_lookup_timed_out")), 1e3);
+      const cancel = () => finish(false, failure(503, "bridge_closed"));
+      const aborted = () => finish(false, failure(499, "request_cancelled"));
+      entry.waiters.add(finish);
       lookupWaiters.add(cancel);
-      Promise.resolve().then(() => api.get(id)).then(
-        (value) => {
-          lookups--;
-          finish(resolve3, value);
-        },
-        (error) => {
-          lookups--;
-          finish(reject, error);
-        }
-      );
+      signal2?.addEventListener("abort", aborted, { once: true });
+      if (signal2?.aborted) aborted();
     });
   }
-  async function session(id) {
+  async function session(id, signal2) {
     if (!validBridgeID(id) || id === "global") throw failure(400, "invalid_session");
     let info;
     try {
-      info = await lookup(id);
+      info = await lookup(id, signal2);
     } catch (error) {
-      if (["session_lookup_busy", "session_lookup_timed_out", "bridge_closed"].includes(error.code)) throw error;
+      if (["bridge_closed", "request_cancelled"].includes(error.code)) throw error;
       throw failure(404, "session_not_found");
     }
     if (info?.id !== id || typeof info.time?.archived === "number") {
@@ -4402,18 +4375,12 @@ async function createLiveBridge({ config, client, directory, reporter }) {
     const removed = streams.delete(stream);
     clearInterval(stream.heartbeat);
     stream.queue.length = 0;
-    stream.queuedBytes = 0;
     if (removed && !streams.size && !disposed) connectionNotifications.update(false);
   }
   function write(stream, value) {
     if (!streams.has(stream)) return;
     if (stream.blocked) {
       stream.queue.push(value);
-      stream.queuedBytes += Buffer.byteLength(value);
-      if (stream.queuedBytes > LIMITS.bytes) {
-        removeStream(stream);
-        stream.response.destroy();
-      }
       return;
     }
     if (!stream.response.write(value)) {
@@ -4433,25 +4400,13 @@ async function createLiveBridge({ config, client, directory, reporter }) {
     if (safe.type === "session.status") states.set(safe.sessionID, safe.data.status);
     if (safe.type === "session.idle") states.set(safe.sessionID, "idle");
     if (safe.type === "session.deleted") states.delete(safe.sessionID);
-    if (states.size > 256) states.delete(states.keys().next().value);
     const record = { id: `${epoch}:${++sequence}`, ...safe, timestamp: Date.now() };
-    let frame = `id: ${record.id}
-event: backeer.event
-data: ${JSON.stringify(record)}
-
-`;
-    if (Buffer.byteLength(frame) > 32768) {
-      record.data = { truncated: true };
-      frame = `id: ${record.id}
+    const frame = `id: ${record.id}
 event: backeer.event
 data: ${JSON.stringify(record)}
 
 `;
-    }
-    const size = Buffer.byteLength(frame);
-    events.push({ sequence, sessionID: record.sessionID, frame, size });
-    bytes += size;
-    while (events.length > LIMITS.events || bytes > LIMITS.bytes) bytes -= events.shift().size;
+    events.push({ sequence, sessionID: record.sessionID, frame });
     for (const stream of streams) if (!stream.sessionID || stream.sessionID === record.sessionID) write(stream, frame);
   }
   function authorized(request) {
@@ -4462,7 +4417,7 @@ data: ${JSON.stringify(record)}
   }
   function parseCursor(value) {
     if (!value) return { after: 0 };
-    const match = /^([a-f0-9-]{36}):(\d{1,16})$/.exec(value);
+    const match = /^([a-f0-9-]{36}):(\d+)$/.exec(value);
     if (!match) throw failure(400, "invalid_cursor");
     if (match[1] !== epoch) return { gap: "stream_restarted" };
     const after = Number(match[2]);
@@ -4471,9 +4426,6 @@ data: ${JSON.stringify(record)}
     return { after };
   }
   function cachedCommand(requestId, sessionID, signature) {
-    for (const [id, command] of commands) {
-      if (command.settled && Date.now() - command.created >= LIMITS.commandTTL) commands.delete(id);
-    }
     const existing = commands.get(requestId);
     if (existing && (existing.sessionID !== sessionID || existing.signature !== signature)) {
       throw failure(409, "request_id_conflict");
@@ -4483,7 +4435,6 @@ data: ${JSON.stringify(record)}
   async function execute(requestId, sessionID, signature, operation, questionId) {
     let command = cachedCommand(requestId, sessionID, signature);
     if (!command) {
-      if (commands.size >= LIMITS.commands) throw failure(429, "command_window_full");
       if (questionId && [...commands.values()].some((item) => item.sessionID === sessionID && item.questionId === questionId)) {
         throw failure(409, "question_reply_already_submitted");
       }
@@ -4491,8 +4442,6 @@ data: ${JSON.stringify(record)}
         sessionID,
         signature,
         questionId,
-        created: Date.now(),
-        settled: false,
         result: {
           requestId,
           sessionID,
@@ -4501,9 +4450,7 @@ data: ${JSON.stringify(record)}
         }
       };
       commands.set(requestId, command);
-      command.task = Promise.resolve().then(operation).finally(() => {
-        command.settled = true;
-      });
+      command.task = Promise.resolve().then(operation).then(() => void 0);
     }
     await command.task;
     return command.result;
@@ -4513,7 +4460,6 @@ data: ${JSON.stringify(record)}
     const pending = await api.questions(sessionID);
     if (!Array.isArray(pending)) throw failure(502, "invalid_question_list");
     const own = pending.filter((item) => item.sessionID === sessionID);
-    if (own.length > 16) throw failure(413, "too_many_questions");
     return own;
   }
   async function route(request, response) {
@@ -4521,10 +4467,9 @@ data: ${JSON.stringify(record)}
     if (request.headers["x-backeer-project"] !== void 0 && request.headers["x-backeer-project"] !== encodeURIComponent(directory)) {
       return json(response, 409, { error: "project_mismatch" });
     }
-    if (active >= LIMITS.requests) return json(response, 429, { error: "bridge_busy" });
-    active++;
-    const timeout = setTimeout(() => json(response, 504, { error: "request_timed_out" }), 15e3);
-    timeout.unref();
+    const controller = new AbortController();
+    const closed = () => controller.abort();
+    response.once("close", closed);
     try {
       const url = new URL(request.url, "http://127.0.0.1");
       if (url.username || url.password) throw failure(400, "invalid_url");
@@ -4533,7 +4478,7 @@ data: ${JSON.stringify(record)}
         const values = Array.isArray(result2) ? result2 : result2?.data;
         if (!Array.isArray(values)) throw failure(502, "invalid_session_list");
         const own = [];
-        for (const info of values.slice(0, 100)) {
+        for (const info of values) {
           if (!validBridgeID(info?.id) || typeof info.time?.archived === "number") continue;
           if (api.ownsSession ? await api.ownsSession(info) : (info.location?.directory ?? info.directory) === directory) own.push(info);
         }
@@ -4562,11 +4507,9 @@ data: ${JSON.stringify(record)}
       }
       if (request.method === "GET" && url.pathname === "/v1/events") {
         const selected = url.searchParams.get("sessionID") || void 0;
-        if (selected) await session(selected);
+        if (selected) await session(selected, controller.signal);
         const parsed = parseCursor(url.searchParams.get("after") ?? request.headers["last-event-id"]);
         if (response.headersSent) return;
-        if (streams.size >= LIMITS.clients) throw failure(429, "too_many_streams");
-        clearTimeout(timeout);
         response.writeHead(200, {
           "content-type": "text/event-stream",
           "cache-control": "no-cache, no-transform",
@@ -4585,8 +4528,7 @@ data: ${JSON.stringify({ reason: parsed.gap, cursor: cursor() })}
           sessionID: selected,
           heartbeat: void 0,
           blocked: false,
-          queue: [],
-          queuedBytes: 0
+          queue: []
         };
         streams.add(stream);
         connectionNotifications.update(true);
@@ -4597,7 +4539,6 @@ data: ${JSON.stringify({ reason: parsed.gap, cursor: cursor() })}
           stream.blocked = false;
           while (streams.has(stream) && !stream.blocked && stream.queue.length) {
             const next = stream.queue.shift();
-            stream.queuedBytes -= Buffer.byteLength(next);
             write(stream, next);
           }
         });
@@ -4615,13 +4556,12 @@ retry: ${LIVE_RECONNECT_MS}
         }
         return;
       }
-      const match = /^\/v1\/sessions\/([A-Za-z0-9_-]{1,160})(\/instructions|\/questions(?:\/([A-Za-z0-9_-]{1,160})\/answers)?)?$/.exec(url.pathname);
+      const match = /^\/v1\/sessions\/([A-Za-z0-9_-]+)(\/instructions|\/questions(?:\/([A-Za-z0-9_-]+)\/answers)?)?$/.exec(url.pathname);
       if (!match) throw failure(404, "route_not_found");
-      if (request.method === "GET" && !match[2]) return json(response, 200, await session(match[1]));
+      if (request.method === "GET" && !match[2]) return json(response, 200, await session(match[1], controller.signal));
       if (request.method === "GET" && match[2] === "/questions") {
-        await session(match[1]);
+        await session(match[1], controller.signal);
         const result2 = { questions: (await questions(match[1])).map((item) => questionSnapshot(item, sanitizer.text)) };
-        if (Buffer.byteLength(JSON.stringify(result2)) > 24e4) throw failure(413, "questions_too_large");
         return json(response, 200, result2);
       }
       if (request.method !== "POST" || !match[2]) throw failure(405, "method_not_allowed");
@@ -4629,8 +4569,8 @@ retry: ${LIVE_RECONNECT_MS}
       const body = await readBody(request);
       if (match[3]) {
         if (!body || !validBridgeID(body.requestId) || !/^[a-f0-9]{64}$/.test(body.revision) || Object.keys(body).some((key) => !["requestId", "revision", "answers"].includes(key))) throw failure(400, "invalid_question_answer");
-        await session(match[1]);
-        const signature2 = JSON.stringify({ questionId: match[3], revision: body.revision, answers: body.answers });
+        await session(match[1], controller.signal);
+        const signature2 = createHash2("sha256").update(JSON.stringify({ questionId: match[3], revision: body.revision, answers: body.answers })).digest("hex");
         const existing2 = cachedCommand(body.requestId, match[1], signature2);
         if (existing2) {
           await existing2.task;
@@ -4651,26 +4591,25 @@ retry: ${LIVE_RECONNECT_MS}
         ));
       }
       if (match[2] !== "/instructions") throw failure(405, "method_not_allowed");
-      if (!body || !validBridgeID(body.requestId) || typeof body.prompt !== "string" || !body.prompt.trim() || body.prompt.length > 16e3 || Object.keys(body).some((key) => !["requestId", "prompt"].includes(key))) throw failure(400, "invalid_instruction");
-      await session(match[1]);
+      if (!body || !validBridgeID(body.requestId) || typeof body.prompt !== "string" || !body.prompt.trim() || Object.keys(body).some((key) => !["requestId", "prompt"].includes(key))) throw failure(400, "invalid_instruction");
+      await session(match[1], controller.signal);
       if (response.headersSent || disposed) return;
-      const signature = JSON.stringify({ prompt: body.prompt });
+      const signature = createHash2("sha256").update(JSON.stringify({ prompt: body.prompt })).digest("hex");
       const existing = cachedCommand(body.requestId, match[1], signature);
       const result = await execute(body.requestId, match[1], signature, () => api.prompt(match[1], body.prompt));
       return json(response, existing ? 200 : 202, result);
     } catch (error) {
       json(response, error.status ?? 502, { error: error.code ?? "opencode_request_failed" });
     } finally {
-      active--;
-      clearTimeout(timeout);
+      response.removeListener("close", closed);
     }
   }
   const server = createServer((request, response) => {
     void route(request, response);
   });
-  server.requestTimeout = 15e3;
-  server.headersTimeout = 1e4;
-  server.keepAliveTimeout = 5e3;
+  server.requestTimeout = 0;
+  server.headersTimeout = 0;
+  server.keepAliveTimeout = 0;
   await new Promise((resolve3, reject) => {
     server.once("error", reject);
     server.listen(options.port ?? 43871, "127.0.0.1", () => {
@@ -4698,6 +4637,7 @@ retry: ${LIVE_RECONNECT_MS}
         events.length = 0;
         states.clear();
         commands.clear();
+        lookups.clear();
         sanitizer.clear();
         api.dispose?.();
       });
@@ -4719,6 +4659,8 @@ async function BackeerPlugin({ client, directory, feedback, v2 = false }, option
     bootstrapReporter.error("Plugin disabled \u2014 invalid configuration", error);
     return {};
   }
+  const shutdown = new AbortController();
+  config.signal = shutdown.signal;
   const reporter = createOpenCodeReporter(client, config.logLevel);
   const conversation = feedback ?? createConversationFeedback({ client, reporter });
   if (config.liveBridge.error) reporter.error("Live control disabled", config.liveBridge.error);
@@ -4878,6 +4820,7 @@ async function BackeerPlugin({ client, directory, feedback, v2 = false }, option
       await Promise.all([handleNotificationEvent(event), liveBridge.handle(event)]);
     },
     dispose: async () => {
+      shutdown.abort();
       await liveBridge.dispose();
       await permissionController.dispose();
       lifecycleController.dispose();
@@ -5461,7 +5404,7 @@ async function getFormApi(ctx, sessionID, { makeClient = exports_client.make, ow
 }
 
 // src/opencode-v2-client.js
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 async function nativeReply(operation) {
   try {
     return await operation();
@@ -5487,7 +5430,7 @@ function questionProperties(form) {
   return {
     id: form.id,
     sessionID: form.sessionID,
-    nativeRevision: createHash2("sha256").update(JSON.stringify({
+    nativeRevision: createHash3("sha256").update(JSON.stringify({
       id: form.id,
       sessionID: form.sessionID,
       title: form.title,