mobygate 0.8.1 → 0.8.2

package/CHANGELOG.md

@@ -4,6 +4,73 @@ All notable changes to mobygate are documented here. Format loosely follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version numbers are
 [Semantic Versioning](https://semver.org/).
 
+## [0.8.2] — 2026-04-28
+
+Multi-agent fixes. Found the day after v0.8.1 shipped, while testing
+three OpenClaw bots (Mobius/Lux/Mercury) in parallel on the same
+machine. Both bugs were invisible without the v0.8.1 inspector.
+
+### Fixed
+
+- **Session-key collision when multiple agents share a boilerplate
+  prefix in their system prompt.** v0.7.1's auto-derive hashed the
+  first 500 characters of the system prompt; OpenClaw's "You are a
+  personal assistant running inside OpenClaw…" preamble fills more
+  than that, so the per-agent personality content (loaded later from
+  workspace SOUL.md / IDENTITY.md / etc.) didn't reach the hash. Two
+  separate agents (Lux on sonnet-4-6, Mercury on sonnet-4-6) collided
+  onto the same auto-key when given the same first user message
+  ("@Lux @Mercury Hi"). Same key → same SDK session reuse → cache
+  thrash and potential session-state mixing.
+
+  Bumped `SYSTEM_TRIM` from 500 → 20000 chars. Verified against real
+  captured request bodies that collided in v0.8.1 — they now hash to
+  distinct keys (`auto_b0371e5c…` vs `auto_2b90afd7…`).
+
+  SHA-256 cost on 20kB is ~10-20µs per request, irrelevant in the
+  hot path.
+
+- **Model map silently downgraded `claude-sonnet-4-6` to retired
+  `claude-sonnet-4-5-20250929`.** When the v0.8.0 model map was
+  written, the Claude Agent SDK didn't recognize the un-dated
+  `claude-sonnet-4-6` alias and we worked around it by routing to the
+  most recent dated 4-5. The SDK has since added native 4-6 support,
+  but mobygate kept the workaround in place. Result: clients (OpenClaw
+  Lux/Mercury) configured for sonnet-4-6 were having their requests
+  rewritten to the retired 4-5-20250929 dated id. Anthropic accepted
+  the call but the response wasn't billing into the user's "Sonnet
+  only" quota — it was showing 0% used despite live traffic. Likely
+  Claude was falling back internally to opus or returning a
+  zero-billed degraded response.
+
+  Fix: route `claude-sonnet-4-6` through directly. Also updated
+  `claude-sonnet-4` and the `sonnet` shorthand to point at 4-6
+  (current latest) instead of the retired dated 4-5 entry. Explicit
+  `claude-sonnet-4-5` requests still route to the dated id for
+  backward compatibility.
+
+  Discovery: the inspector showed Lux/Mercury captures all stamped
+  with `model: claude-sonnet-4-6` (correct from the request side) but
+  Anthropic's quota panel reported 0% sonnet usage. The server.log's
+  `model=claude-sonnet-4-6 → claude-sonnet-4-5-20250929` translation
+  line was the smoking gun.
+
+### Notes
+
+The proper long-term fix is for clients to pass an explicit
+`X-Session-Id` header per agent (mobygate has supported this since
+v0.7.1 — it always wins over auto-derive). This bump is a defensive
+measure for clients that don't.
+
+Discovery flow is a nice validation of the v0.8.1 inspector: the
+collision was invisible at the OpenClaw level (each bot's replies
+arrived correctly because OpenClaw maintains its own per-agent SDK
+state) but jumped out as soon as the captures were sorted by session
+key in the inspector — two different model requests with the same
+session-key, with bootstrap text 55kB long but identical first 500
+chars. Without the inspector, this would have surfaced as
+unpredictable cache hit rates and been blamed on Anthropic.
+
 ## [0.8.1] — 2026-04-27
 
 Diagnostic visibility release. Adds a request/response capture system,

package/lib/session-derive.js

@@ -40,6 +40,12 @@
  *     user message from history mid-conversation, the auto-key changes
  *     and the SDK starts a new session. One turn of double-billing,
  *     then we're back on the new key. Acceptable.
+ *   - **Multi-agent collisions** (fixed in v0.8.2): two agents that
+ *     share boilerplate at the start of their system prompt previously
+ *     collided onto one session key when the trim window only covered
+ *     the boilerplate. SYSTEM_TRIM was raised from 500 to 20000 chars
+ *     to capture the per-agent personality content that follows the
+ *     shared preamble. See note on the constant below for details.
  *
  * Opt-out: `X-Session-Id: none` tells us the client explicitly wants
  * stateless behavior — we return null and the request flows through
@@ -51,7 +57,20 @@
 import { createHash } from 'crypto';
 
 const HASH_LEN = 16;
-const SYSTEM_TRIM = 500;
+// SYSTEM_TRIM was 500 in v0.7.1 — large enough for casual single-agent
+// scenarios (Hermes, single-bot OpenClaw) but caused collisions when
+// multiple agents shared a common boilerplate prefix. Observed in v0.8.1
+// production: Lux + Mercury (two OpenClaw agents) both started their
+// system prompt with the OpenClaw "You are a personal assistant…"
+// boilerplate that filled the first ~500 chars, so their personality
+// markers (loaded from per-agent SOUL.md / IDENTITY.md / etc.) didn't
+// reach the hash and they collided onto the same session key.
+//
+// Bumping to 20kB covers realistic agent system prompts including
+// rich workspace bootstrap (Lux: ~42kB, Mercury: ~80kB total — but
+// the first 20kB has more than enough divergence to fingerprint each).
+// SHA-256 cost on 20kB is ~10-20µs, irrelevant per request.
+const SYSTEM_TRIM = 20000;
 const USER_TRIM = 500;
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mobygate",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "OpenAI-compatible local proxy for Claude Max. The Möbius-strip gateway: OpenAI shape in, Claude Max out.",
   "type": "module",
   "main": "server.js",

package/server.js

@@ -168,6 +168,17 @@ for (const sig of ['SIGTERM', 'SIGINT', 'SIGHUP']) {
 // Opus 4.7 ships a native 1M-context variant addressed as `claude-opus-4-7[1m]`.
 // Default opus aliases route to the 1M form to match the advertised context window.
 // Pass `claude-opus-4-7-200k` for the standard (cheaper) 200k variant.
+//
+// History: the sonnet-4-6 entry previously mapped to the dated
+// `claude-sonnet-4-5-20250929` because at the time, the SDK didn't
+// recognize `claude-sonnet-4-6` natively. The SDK has since added
+// native support for the un-dated 4-6 alias, so sonnet-4-6 requests
+// were silently being downgraded to retired 4-5-20250929. This caused
+// the "Sonnet only" Anthropic quota to show 0% usage even when Lux
+// and Mercury (configured for sonnet-4-6) were chatting actively —
+// the SDK was accepting the retired model id but Claude was likely
+// falling back to opus or returning a zero-billed response. Fixed in
+// v0.8.2 by routing 4-6 through directly.
 const MODEL_MAP = {
   'claude-opus-4': 'claude-opus-4-7[1m]',
   'claude-opus-4-6': 'claude-opus-4-6',
@@ -175,13 +186,13 @@ const MODEL_MAP = {
   'claude-opus-4-7[1m]': 'claude-opus-4-7[1m]',
   'claude-opus-4-7-1m': 'claude-opus-4-7[1m]',
   'claude-opus-4-7-200k': 'claude-opus-4-7',
-  'claude-sonnet-4': 'claude-sonnet-4-5-20250929',
-  'claude-sonnet-4-5': 'claude-sonnet-4-5-20250929',
-  'claude-sonnet-4-6': 'claude-sonnet-4-5-20250929', // SDK resolves 4-6 to non-existent dated version
+  'claude-sonnet-4': 'claude-sonnet-4-6',         // current latest sonnet
+  'claude-sonnet-4-5': 'claude-sonnet-4-5-20250929', // explicit request for older 4-5
+  'claude-sonnet-4-6': 'claude-sonnet-4-6',       // SDK now supports natively; was retired-mapped before v0.8.2
   'claude-haiku-4': 'claude-haiku-4-5-20251001',
   'claude-haiku-4-5': 'claude-haiku-4-5-20251001',
   'opus': 'claude-opus-4-7[1m]',
-  'sonnet': 'claude-sonnet-4-5-20250929',
+  'sonnet': 'claude-sonnet-4-6',                  // current latest sonnet
   'haiku': 'claude-haiku-4-5-20251001',
 };