opencode-rag-plugin 1.19.4 → 1.19.5

package/dist/embedder/factory.js

@@ -1,4 +1,4 @@
-import { isOpenAiCompatible } from "../core/provider-defaults.js";
+import { isOpenAiCompatible, supportsEmbedding } from "../core/provider-defaults.js";
 import { OllamaProvider } from "./ollama.js";
 import { OpenAIProvider } from "./openai.js";
 import { CohereProvider } from "./cohere.js";
@@ -17,6 +17,12 @@ import pLimit from "p-limit";
 export function createEmbedder(config) {
     const { provider, baseUrl, model, apiKey, proxy, timeoutMs } = config.embedding;
     const effectiveTimeoutMs = timeoutMs ?? 120000;
+    // Fail fast for chat-only providers (groq, deepseek, anthropic, google)
+    // — proceeding would surface a cryptic failure at index time.
+    if (!supportsEmbedding(provider)) {
+        throw new Error(`Provider "${provider}" does not support embeddings. ` +
+            "Use an embedding-capable provider (ollama, openai, cohere, nvidia, azure, mistral, together, fireworks).");
+    }
     if (provider === "ollama") {
         return new OllamaProvider(baseUrl, model, apiKey, effectiveTimeoutMs, proxy, config.logging.level);
     }
@@ -34,6 +40,15 @@ export function createEmbedder(config) {
     }
     throw new Error(`Unknown embedding provider: ${provider}`);
 }
+/**
+ * HTTP statuses that indicate a permanent failure — retrying cannot help
+ * (auth errors, bad requests, missing resources). Providers raise these as
+ * Error objects whose messages contain the status code.
+ */
+const PERMANENT_STATUS_RE = /\(?(400|401|403|404|422)\)?/;
+function isPermanentError(err) {
+    return PERMANENT_STATUS_RE.test(err instanceof Error ? err.message : String(err));
+}
 /**
  * Embed a list of texts in batches with optional concurrency control and per-batch retry.
  *
@@ -41,9 +56,11 @@ export function createEmbedder(config) {
  * (or concurrently when `concurrency > 1`). When concurrency is limited, uses
  * `p-limit` to cap the number of in-flight requests.
  *
- * Each batch is retried up to `retryMax` times with exponential backoff. If all
- * retries are exhausted, the batch is skipped and empty arrays are returned for
- * those texts so the caller can still process successfully embedded batches.
+ * Each batch is retried up to `retryMax` times with exponential backoff (only
+ * for transient failures — auth/validation errors are not retried). If all
+ * retries are exhausted or the provider returns a mismatched embedding count,
+ * the batch is skipped and empty arrays are returned for those texts so the
+ * caller can still process successfully embedded batches.
  *
  * @param embedder - The embedding provider to use
  * @param texts - Array of text strings to embed
@@ -67,13 +84,27 @@ export async function embedBatch(embedder, texts, batchSize = 10, purpose, concu
     async function embedWithRetry(batchTexts) {
         for (let attempt = 0; attempt <= retryMax; attempt++) {
             try {
-                return await embedder.embed(batchTexts, purpose);
+                const embeddings = await embedder.embed(batchTexts, purpose);
+                // Validate the response shape: a count mismatch would silently attach
+                // vectors to the wrong chunks downstream; a dimension mismatch would
+                // poison the store. Treat both as a retryable batch failure.
+                if (embeddings.length !== batchTexts.length) {
+                    throw new Error(`Embedding provider returned ${embeddings.length} vectors for ${batchTexts.length} texts`);
+                }
+                const dims = new Set(embeddings.map((v) => v.length));
+                if (dims.size > 1 || dims.has(0)) {
+                    throw new Error(`Embedding provider returned inconsistent vector dimensions: ${[...dims].join(", ")}`);
+                }
+                return embeddings;
             }
             catch (err) {
-                if (attempt < retryMax) {
-                    const delay = retryBaseDelayMs * Math.pow(2, attempt);
+                if (attempt < retryMax && !isPermanentError(err)) {
+                    const delay = retryBaseDelayMs * Math.pow(2, attempt) * (0.8 + Math.random() * 0.4);
                     await new Promise(resolve => setTimeout(resolve, delay));
                 }
+                else if (attempt >= retryMax || isPermanentError(err)) {
+                    return null;
+                }
             }
         }
         return null;
@@ -99,7 +130,9 @@ export async function embedBatch(embedder, texts, batchSize = 10, purpose, concu
     const batchResults = await Promise.all(batches.map((batch) => limit(async () => {
         const embeddings = await embedWithRetry(batch.texts);
         const flatResult = embeddings ?? batch.texts.map(() => []);
-        completedCount += embeddings?.length ?? 0;
+        // Count processed TEXTS (not returned vectors) so failed batches
+        // still advance progress towards the total.
+        completedCount += batch.texts.length;
         onProgress?.(completedCount, texts.length);
         return { index: batch.index, embeddings: flatResult };
     })));

package/dist/embedder/health.js

@@ -1,4 +1,4 @@
-import { postJson } from "./http.js";
+import { fetchWithProxy, postJson } from "./http.js";
 /**
  * Check connectivity and model availability for all configured providers.
  * Returns one result per configured model (embedding + description + image_description if enabled).
@@ -42,10 +42,10 @@ async function checkDescriptionModel(config, _timeoutMs) {
         return checkOllamaChat(baseUrl, model, descTimeout, desc.proxy);
     }
     if (provider === "anthropic") {
-        return checkAnthropicChat(baseUrl, model, apiKey, descTimeout);
+        return checkAnthropicChat(baseUrl, model, apiKey, descTimeout, desc.proxy);
     }
     if (provider === "google") {
-        return checkGoogleChat(baseUrl, model, apiKey, descTimeout);
+        return checkGoogleChat(baseUrl, model, apiKey, descTimeout, desc.proxy);
     }
     // OpenAI-compatible chat endpoint
     return checkOpenAiChat(baseUrl, model, apiKey, descTimeout, desc.proxy);
@@ -62,10 +62,10 @@ async function checkImageDescriptionModel(config, _timeoutMs) {
         return checkOllamaChat(baseUrl, model, imgTimeout, img.proxy, "image_description");
     }
     if (provider === "anthropic") {
-        return checkAnthropicChat(baseUrl, model, apiKey, imgTimeout, "image_description");
+        return checkAnthropicChat(baseUrl, model, apiKey, imgTimeout, img.proxy, "image_description");
     }
     if (provider === "google") {
-        return checkGoogleChat(baseUrl, model, apiKey, imgTimeout, "image_description");
+        return checkGoogleChat(baseUrl, model, apiKey, imgTimeout, img.proxy, "image_description");
     }
     // OpenAI-compatible chat endpoint
     return checkOpenAiChat(baseUrl, model, apiKey, imgTimeout, img.proxy, "image_description");
@@ -125,16 +125,16 @@ async function checkOllamaChat(baseUrl, model, timeoutMs, proxy, type = "descrip
  * Check OpenAI-compatible embedding endpoint via the /models endpoint
  * to validate the API key without consuming embedding tokens.
  */
-async function checkOpenAiEmbed(baseUrl, model, apiKey, timeoutMs, _proxy) {
+async function checkOpenAiEmbed(baseUrl, model, apiKey, timeoutMs, proxy) {
     if (!apiKey) {
         return { provider: "openai", model, type: "embedding", status: "error", error: "No API key configured" };
     }
     const url = `${baseUrl.replace(/\/+$/, "")}/models`;
     try {
-        const response = await fetch(url, {
+        const response = await fetchWithProxy(url, {
             headers: { Authorization: `Bearer ${apiKey}` },
             signal: AbortSignal.timeout(Math.min(timeoutMs ?? 15000, 15000)),
-        });
+        }, proxy);
         if (response.ok) {
             return { provider: "openai", model, type: "embedding", status: "ok" };
         }
@@ -150,16 +150,16 @@ async function checkOpenAiEmbed(baseUrl, model, apiKey, timeoutMs, _proxy) {
     }
 }
 /** Check OpenAI-compatible chat endpoint via the /models endpoint. */
-async function checkOpenAiChat(baseUrl, model, apiKey, timeoutMs, _proxy, type = "description") {
+async function checkOpenAiChat(baseUrl, model, apiKey, timeoutMs, proxy, type = "description") {
     if (!apiKey) {
         return { provider: "openai", model, type, status: "error", error: "No API key configured" };
     }
     const url = `${baseUrl.replace(/\/+$/, "")}/models`;
     try {
-        const response = await fetch(url, {
+        const response = await fetchWithProxy(url, {
             headers: { Authorization: `Bearer ${apiKey}` },
             signal: AbortSignal.timeout(Math.min(timeoutMs ?? 15000, 15000)),
-        });
+        }, proxy);
         if (response.ok) {
             return { provider: "openai", model, type, status: "ok" };
         }
@@ -196,13 +196,13 @@ async function checkCohereEmbed(baseUrl, model, apiKey, timeoutMs, proxy) {
 }
 // ── Anthropic check ────────────────────────────────────────────
 /** Check Anthropic chat endpoint by sending a minimal message. */
-async function checkAnthropicChat(baseUrl, model, apiKey, timeoutMs, type = "description") {
+async function checkAnthropicChat(baseUrl, model, apiKey, timeoutMs, proxy, type = "description") {
     if (!apiKey) {
         return { provider: "anthropic", model, type, status: "error", error: "No API key configured" };
     }
     const url = `${baseUrl.replace(/\/+$/, "")}/messages`;
     try {
-        const response = await fetch(url, {
+        const response = await fetchWithProxy(url, {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
@@ -215,7 +215,7 @@ async function checkAnthropicChat(baseUrl, model, apiKey, timeoutMs, type = "des
                 messages: [{ role: "user", content: "hi" }],
             }),
             signal: AbortSignal.timeout(Math.min(timeoutMs ?? 15000, 15000)),
-        });
+        }, proxy);
         if (response.ok) {
             return { provider: "anthropic", model, type, status: "ok" };
         }
@@ -232,20 +232,20 @@ async function checkAnthropicChat(baseUrl, model, apiKey, timeoutMs, type = "des
 }
 // ── Google Gemini check ────────────────────────────────────────
 /** Check Google Gemini chat endpoint by sending a minimal generateContent request. */
-async function checkGoogleChat(baseUrl, model, apiKey, timeoutMs, type = "description") {
+async function checkGoogleChat(baseUrl, model, apiKey, timeoutMs, proxy, type = "description") {
     if (!apiKey) {
         return { provider: "google", model, type, status: "error", error: "No API key configured" };
     }
-    const url = `${baseUrl.replace(/\/+$/, "")}/models/${model}:generateContent?key=${apiKey}`;
+    const url = `${baseUrl.replace(/\/+$/, "")}/models/${model}:generateContent`;
     try {
-        const response = await fetch(url, {
+        const response = await fetchWithProxy(url, {
             method: "POST",
-            headers: { "Content-Type": "application/json" },
+            headers: { "Content-Type": "application/json", "x-goog-api-key": apiKey },
             body: JSON.stringify({
                 contents: [{ parts: [{ text: "hi" }] }],
             }),
             signal: AbortSignal.timeout(Math.min(timeoutMs ?? 15000, 15000)),
-        });
+        }, proxy);
         if (response.ok) {
             return { provider: "google", model, type, status: "ok" };
         }

package/dist/embedder/http.d.ts

@@ -12,6 +12,19 @@ export interface HttpResponseLike {
 /** Destroy all pooled TCP/TLS sockets and clear the connection pool. */
 declare function destroyAllPooledConnections(): void;
 export { destroyAllPooledConnections };
+/**
+ * Fetch a URL through the configured proxy, applying the proxy to
+ * HTTP(S)_PROXY env vars for the duration of the request (serialized).
+ *
+ * Used by health checks and other one-off requests that do not go
+ * through {@link postJson}.
+ */
+export declare function fetchWithProxy(urlString: string, init: {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+    signal?: AbortSignal;
+}, proxy?: ProxyConfig): Promise<Response>;
 /**
  * Check whether a hostname refers to the local machine.
  *
@@ -43,7 +56,7 @@ export declare function matchesNoProxy(hostname: string, noProxy?: string): bool
  * @param redirectCount - Internal redirect counter (starts at 0)
  * @returns A promise resolving to an HttpResponseLike
  */
-export declare function directRequest(url: URL, body: unknown, headers: Record<string, string>, timeoutMs: number, redirectCount?: number): Promise<HttpResponseLike>;
+export declare function directRequest(url: URL, body: unknown, headers: Record<string, string>, timeoutMs: number, redirectCount?: number, signal?: AbortSignal): Promise<HttpResponseLike>;
 /**
  * POST JSON to a URL, optionally routing through a proxy.
  *

package/dist/embedder/http.js

@@ -67,6 +67,48 @@ function destroyAllPooledConnections() {
     connectionPool.clear();
 }
 export { destroyAllPooledConnections };
+/**
+ * Fetch a URL through the configured proxy, applying the proxy to
+ * HTTP(S)_PROXY env vars for the duration of the request (serialized).
+ *
+ * Used by health checks and other one-off requests that do not go
+ * through {@link postJson}.
+ */
+export async function fetchWithProxy(urlString, init, proxy) {
+    const authHeader = buildProxyAuthHeader(proxy);
+    const envOverride = applyProxyEnv(proxy);
+    const [savedHttpProxy, savedHttpsProxy] = [process.env.HTTP_PROXY, process.env.HTTPS_PROXY];
+    return proxyRequestQueue.then(async () => {
+        try {
+            if (envOverride) {
+                process.env.HTTP_PROXY = envOverride.httpProxy;
+                process.env.HTTPS_PROXY = envOverride.httpsProxy;
+            }
+            const headers = { ...init.headers };
+            if (authHeader) {
+                headers["Proxy-Authorization"] = authHeader;
+            }
+            return await fetch(urlString, {
+                method: init.method ?? "GET",
+                headers,
+                body: init.body,
+                signal: init.signal,
+            });
+        }
+        finally {
+            if (envOverride) {
+                if (savedHttpProxy === undefined)
+                    delete process.env.HTTP_PROXY;
+                else
+                    process.env.HTTP_PROXY = savedHttpProxy;
+                if (savedHttpsProxy === undefined)
+                    delete process.env.HTTPS_PROXY;
+                else
+                    process.env.HTTPS_PROXY = savedHttpsProxy;
+            }
+        }
+    });
+}
 /**
  * Check whether a hostname refers to the local machine.
  *
@@ -150,8 +192,8 @@ function applyProxyEnv(proxy) {
  * @param redirectCount - Internal redirect counter (starts at 0)
  * @returns A promise resolving to an HttpResponseLike
  */
-export function directRequest(url, body, headers, timeoutMs, redirectCount = 0) {
-    return sendRawHttpRequest(url, body, headers, timeoutMs, redirectCount);
+export function directRequest(url, body, headers, timeoutMs, redirectCount = 0, signal) {
+    return sendRawHttpRequest(url, body, headers, timeoutMs, redirectCount, signal);
 }
 const CRLF = Buffer.from("\r\n");
 /** Build the full raw HTTP/1.1 request buffer (headers + JSON body). */
@@ -241,7 +283,7 @@ function parseResponse(buffer) {
     return { status, headers, body };
 }
 /** Raw HTTP/1.1 POST over TCP/TLS with connection pooling, redirect following, and timeout. */
-async function sendRawHttpRequest(url, body, headers, timeoutMs, redirectCount) {
+async function sendRawHttpRequest(url, body, headers, timeoutMs, redirectCount, signal) {
     const requestBuffer = buildRequestPayload(body, headers, url);
     const port = url.port ? Number(url.port) : url.protocol === "https:" ? 443 : 80;
     const isHttps = url.protocol === "https:";
@@ -259,6 +301,7 @@ async function sendRawHttpRequest(url, body, headers, timeoutMs, redirectCount)
                 return;
             settled = true;
             clearTimeout(timeout);
+            signal?.removeEventListener("abort", onAbort);
             fn();
         };
         const timeout = setTimeout(() => {
@@ -267,6 +310,16 @@ async function sendRawHttpRequest(url, body, headers, timeoutMs, redirectCount)
                 reject(new Error(`Request timed out after ${timeoutMs}ms`));
             });
         }, timeoutMs);
+        // Wire the caller's AbortSignal through to the raw socket (F2.1)
+        const onAbort = () => {
+            if (settled)
+                return;
+            settle(() => {
+                socket.destroy();
+                reject(new DOMException("The operation was aborted.", "AbortError"));
+            });
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
         const releaseOrDestroy = () => {
             if (responseConnectionClose) {
                 socket.destroy();
@@ -369,7 +422,8 @@ async function sendRawHttpRequest(url, body, headers, timeoutMs, redirectCount)
         typeof location === "string" &&
         location.length > 0) {
         if (redirectCount >= 5) {
-            const text = `Redirect limit exceeded for ${url.toString()}`;
+            // Strip the query string — it may contain API keys (e.g. `?key=...`)
+            const text = `Redirect limit exceeded for ${url.origin}${url.pathname}`;
             return {
                 ok: false,
                 status: response.status,
@@ -389,7 +443,7 @@ async function sendRawHttpRequest(url, body, headers, timeoutMs, redirectCount)
         const safeHeaders = sameOrigin
             ? headers
             : Object.fromEntries(Object.entries(headers).filter(([key]) => key.toLowerCase() !== "authorization"));
-        return sendRawHttpRequest(redirectUrl, body, safeHeaders, timeoutMs, redirectCount + 1);
+        return sendRawHttpRequest(redirectUrl, body, safeHeaders, timeoutMs, redirectCount + 1, signal);
     }
     const text = response.body.toString("utf8");
     return {
@@ -421,7 +475,7 @@ export async function postJson(urlString, body, headers, timeoutMs, proxy, signa
     const url = new URL(urlString);
     const bypassProxy = isLocalhost(url.hostname) || matchesNoProxy(url.hostname, proxy?.noProxy);
     if (bypassProxy || !proxy?.url) {
-        return directRequest(url, body, headers, timeoutMs);
+        return directRequest(url, body, headers, timeoutMs, 0, signal);
     }
     return postJsonViaFetch(urlString, body, headers, timeoutMs, proxy, signal);
 }

package/dist/eval/session-logger.js

@@ -15,6 +15,13 @@ export function createSessionLogger(storePath) {
                         const info = props.info;
                         if (!info || info.role !== "assistant")
                             return;
+                        // message.updated fires repeatedly DURING streaming — only record
+                        // completed messages (time.completed/finish/error set), otherwise
+                        // every token chunk triggers a synchronous disk write on the
+                        // event hot path and the log fills with redundant entries.
+                        const isFinal = !!info.time?.completed || !!info.finish || !!info.error;
+                        if (!isFinal)
+                            return;
                         const ev = {
                             ts: Date.now(),
                             event: "message",

package/dist/eval/storage.js

@@ -19,6 +19,10 @@ export function validateSessionID(sessionID) {
 /** Append a single event to a session's JSONL log file. Creates the directory and file if needed. */
 export function appendSessionEvent(storePath, event) {
     try {
+        // Guard against path traversal / malformed IDs — never write outside the
+        // eval directory.
+        if (!validateSessionID(event.sessionID))
+            return;
         const dir = getEvalDir(storePath);
         mkdirSync(dir, { recursive: true });
         const filePath = getSessionPath(storePath, event.sessionID);
@@ -31,6 +35,8 @@ export function appendSessionEvent(storePath, event) {
 /** Read all events for a session from its JSONL log file. Returns an empty array if the file does not exist or cannot be read. */
 export function readSessionEvents(storePath, sessionID) {
     try {
+        if (!validateSessionID(sessionID))
+            return [];
         const filePath = getSessionPath(storePath, sessionID);
         const content = readFileSync(filePath, "utf8");
         const lines = content.split("\n").filter((l) => l.trim().length > 0);
@@ -58,6 +64,8 @@ export function listSessionIDs(storePath) {
 /** Delete a session's JSONL log file from disk. Silently succeeds if the file does not exist. */
 export function deleteSession(storePath, sessionID) {
     try {
+        if (!validateSessionID(sessionID))
+            return;
         const filePath = getSessionPath(storePath, sessionID);
         if (existsSync(filePath)) {
             unlinkSync(filePath);

package/dist/indexer/git-diff.d.ts

@@ -23,7 +23,7 @@ export declare function getCurrentCommit(cwd: string): string | null;
  *
  * @param cwd - A path inside the repository.
  * @param fromCommit - The commit SHA to diff against.
- * @returns A diff result, or `null` if the git command fails.
+ * @returns A diff result, or `null` if the git command fails or the commit is invalid.
  */
 export declare function getChangedFilesSince(cwd: string, fromCommit: string): GitDiffResult | null;
 /**

package/dist/indexer/git-diff.js

@@ -45,9 +45,13 @@ export function getCurrentCommit(cwd) {
  *
  * @param cwd - A path inside the repository.
  * @param fromCommit - The commit SHA to diff against.
- * @returns A diff result, or `null` if the git command fails.
+ * @returns A diff result, or `null` if the git command fails or the commit is invalid.
  */
 export function getChangedFilesSince(cwd, fromCommit) {
+    // The commit value originates from a manifest file — validate it strictly
+    // so a crafted manifest can never inject git options via argv.
+    if (!/^[0-9a-f]{7,40}$/i.test(fromCommit))
+        return null;
     try {
         const changedRaw = execFileSync("git", ["diff", "--name-only", "--diff-filter=ACMRT", fromCommit, "HEAD"], {
             cwd, encoding: "utf-8", timeout: 10000, stdio: ["ignore", "pipe", "ignore"],