opencode-rag-plugin 1.19.4 → 1.19.8

package/dist/embedder/http.js

@@ -67,6 +67,48 @@ function destroyAllPooledConnections() {
     connectionPool.clear();
 }
 export { destroyAllPooledConnections };
+/**
+ * Fetch a URL through the configured proxy, applying the proxy to
+ * HTTP(S)_PROXY env vars for the duration of the request (serialized).
+ *
+ * Used by health checks and other one-off requests that do not go
+ * through {@link postJson}.
+ */
+export async function fetchWithProxy(urlString, init, proxy) {
+    const authHeader = buildProxyAuthHeader(proxy);
+    const envOverride = applyProxyEnv(proxy);
+    const [savedHttpProxy, savedHttpsProxy] = [process.env.HTTP_PROXY, process.env.HTTPS_PROXY];
+    return proxyRequestQueue.then(async () => {
+        try {
+            if (envOverride) {
+                process.env.HTTP_PROXY = envOverride.httpProxy;
+                process.env.HTTPS_PROXY = envOverride.httpsProxy;
+            }
+            const headers = { ...init.headers };
+            if (authHeader) {
+                headers["Proxy-Authorization"] = authHeader;
+            }
+            return await fetch(urlString, {
+                method: init.method ?? "GET",
+                headers,
+                body: init.body,
+                signal: init.signal,
+            });
+        }
+        finally {
+            if (envOverride) {
+                if (savedHttpProxy === undefined)
+                    delete process.env.HTTP_PROXY;
+                else
+                    process.env.HTTP_PROXY = savedHttpProxy;
+                if (savedHttpsProxy === undefined)
+                    delete process.env.HTTPS_PROXY;
+                else
+                    process.env.HTTPS_PROXY = savedHttpsProxy;
+            }
+        }
+    });
+}
 /**
  * Check whether a hostname refers to the local machine.
  *
@@ -150,8 +192,8 @@ function applyProxyEnv(proxy) {
  * @param redirectCount - Internal redirect counter (starts at 0)
  * @returns A promise resolving to an HttpResponseLike
  */
-export function directRequest(url, body, headers, timeoutMs, redirectCount = 0) {
-    return sendRawHttpRequest(url, body, headers, timeoutMs, redirectCount);
+export function directRequest(url, body, headers, timeoutMs, redirectCount = 0, signal) {
+    return sendRawHttpRequest(url, body, headers, timeoutMs, redirectCount, signal);
 }
 const CRLF = Buffer.from("\r\n");
 /** Build the full raw HTTP/1.1 request buffer (headers + JSON body). */
@@ -241,7 +283,7 @@ function parseResponse(buffer) {
     return { status, headers, body };
 }
 /** Raw HTTP/1.1 POST over TCP/TLS with connection pooling, redirect following, and timeout. */
-async function sendRawHttpRequest(url, body, headers, timeoutMs, redirectCount) {
+async function sendRawHttpRequest(url, body, headers, timeoutMs, redirectCount, signal) {
     const requestBuffer = buildRequestPayload(body, headers, url);
     const port = url.port ? Number(url.port) : url.protocol === "https:" ? 443 : 80;
     const isHttps = url.protocol === "https:";
@@ -259,6 +301,7 @@ async function sendRawHttpRequest(url, body, headers, timeoutMs, redirectCount)
                 return;
             settled = true;
             clearTimeout(timeout);
+            signal?.removeEventListener("abort", onAbort);
             fn();
         };
         const timeout = setTimeout(() => {
@@ -267,6 +310,16 @@ async function sendRawHttpRequest(url, body, headers, timeoutMs, redirectCount)
                 reject(new Error(`Request timed out after ${timeoutMs}ms`));
             });
         }, timeoutMs);
+        // Wire the caller's AbortSignal through to the raw socket (F2.1)
+        const onAbort = () => {
+            if (settled)
+                return;
+            settle(() => {
+                socket.destroy();
+                reject(new DOMException("The operation was aborted.", "AbortError"));
+            });
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
         const releaseOrDestroy = () => {
             if (responseConnectionClose) {
                 socket.destroy();
@@ -369,7 +422,8 @@ async function sendRawHttpRequest(url, body, headers, timeoutMs, redirectCount)
         typeof location === "string" &&
         location.length > 0) {
         if (redirectCount >= 5) {
-            const text = `Redirect limit exceeded for ${url.toString()}`;
+            // Strip the query string — it may contain API keys (e.g. `?key=...`)
+            const text = `Redirect limit exceeded for ${url.origin}${url.pathname}`;
             return {
                 ok: false,
                 status: response.status,
@@ -389,7 +443,7 @@ async function sendRawHttpRequest(url, body, headers, timeoutMs, redirectCount)
         const safeHeaders = sameOrigin
             ? headers
             : Object.fromEntries(Object.entries(headers).filter(([key]) => key.toLowerCase() !== "authorization"));
-        return sendRawHttpRequest(redirectUrl, body, safeHeaders, timeoutMs, redirectCount + 1);
+        return sendRawHttpRequest(redirectUrl, body, safeHeaders, timeoutMs, redirectCount + 1, signal);
     }
     const text = response.body.toString("utf8");
     return {
@@ -421,7 +475,7 @@ export async function postJson(urlString, body, headers, timeoutMs, proxy, signa
     const url = new URL(urlString);
     const bypassProxy = isLocalhost(url.hostname) || matchesNoProxy(url.hostname, proxy?.noProxy);
     if (bypassProxy || !proxy?.url) {
-        return directRequest(url, body, headers, timeoutMs);
+        return directRequest(url, body, headers, timeoutMs, 0, signal);
     }
     return postJsonViaFetch(urlString, body, headers, timeoutMs, proxy, signal);
 }

package/dist/embedder/ollama.d.ts

@@ -12,6 +12,7 @@ import type { ProxyConfig } from "../core/config.js";
    * @param timeoutMs - Request timeout in milliseconds (default 120000)
  * @param proxy - Optional proxy configuration
  * @param logLevel - Optional logging level for debug output
+ * @param keepAlive - Optional Ollama keep_alive value sent with /api/embed requests (e.g. "-1")
  */
 export declare class OllamaProvider implements EmbeddingProvider {
     readonly name = "ollama";
@@ -21,7 +22,8 @@ export declare class OllamaProvider implements EmbeddingProvider {
     private readonly timeoutMs;
     private proxy?;
     private readonly logLevel?;
-    constructor(baseUrl: string, model: string, apiKey?: string, timeoutMs?: number, proxy?: ProxyConfig, logLevel?: string);
+    private readonly keepAlive?;
+    constructor(baseUrl: string, model: string, apiKey?: string, timeoutMs?: number, proxy?: ProxyConfig, logLevel?: string, keepAlive?: string);
     private getLogFilePath;
     private debug;
     embed(texts: string[], _purpose?: "query" | "document"): Promise<number[][]>;

package/dist/embedder/ollama.js

@@ -10,6 +10,7 @@ import { appendDebugLog } from "../core/fileLogger.js";
    * @param timeoutMs - Request timeout in milliseconds (default 120000)
  * @param proxy - Optional proxy configuration
  * @param logLevel - Optional logging level for debug output
+ * @param keepAlive - Optional Ollama keep_alive value sent with /api/embed requests (e.g. "-1")
  */
 export class OllamaProvider {
     name = "ollama";
@@ -19,13 +20,15 @@ export class OllamaProvider {
     timeoutMs;
     proxy;
     logLevel;
-    constructor(baseUrl, model, apiKey, timeoutMs = 120000, proxy, logLevel) {
+    keepAlive;
+    constructor(baseUrl, model, apiKey, timeoutMs = 120000, proxy, logLevel, keepAlive) {
         this.baseUrl = baseUrl.replace(/\/+$/, "");
         this.model = model;
         this.apiKey = apiKey;
         this.timeoutMs = timeoutMs;
         this.proxy = proxy;
         this.logLevel = logLevel;
+        this.keepAlive = keepAlive;
     }
     getLogFilePath() {
         return path.resolve(process.cwd(), ".opencode", "opencode-rag.log");
@@ -44,7 +47,14 @@ export class OllamaProvider {
         }
         this.debug(`OllamaProvider requesting ${texts.length} embedding vector${texts.length === 1 ? "" : "s"}`);
         try {
-            const response = await postJson(`${this.baseUrl}/embed`, { model: this.model, input: texts.length === 1 ? texts[0] : texts }, headers, this.timeoutMs, this.proxy);
+            const body = {
+                model: this.model,
+                input: texts.length === 1 ? texts[0] : texts,
+            };
+            if (this.keepAlive) {
+                body.keep_alive = this.keepAlive;
+            }
+            const response = await postJson(`${this.baseUrl}/embed`, body, headers, this.timeoutMs, this.proxy);
             if (!response.ok) {
                 const body = await response.text();
                 throw new Error(`Ollama embedding failed (${response.status}): ${body}`);

package/dist/eval/session-logger.js

@@ -15,6 +15,13 @@ export function createSessionLogger(storePath) {
                         const info = props.info;
                         if (!info || info.role !== "assistant")
                             return;
+                        // message.updated fires repeatedly DURING streaming — only record
+                        // completed messages (time.completed/finish/error set), otherwise
+                        // every token chunk triggers a synchronous disk write on the
+                        // event hot path and the log fills with redundant entries.
+                        const isFinal = !!info.time?.completed || !!info.finish || !!info.error;
+                        if (!isFinal)
+                            return;
                         const ev = {
                             ts: Date.now(),
                             event: "message",

package/dist/eval/storage.js

@@ -19,6 +19,10 @@ export function validateSessionID(sessionID) {
 /** Append a single event to a session's JSONL log file. Creates the directory and file if needed. */
 export function appendSessionEvent(storePath, event) {
     try {
+        // Guard against path traversal / malformed IDs — never write outside the
+        // eval directory.
+        if (!validateSessionID(event.sessionID))
+            return;
         const dir = getEvalDir(storePath);
         mkdirSync(dir, { recursive: true });
         const filePath = getSessionPath(storePath, event.sessionID);
@@ -31,6 +35,8 @@ export function appendSessionEvent(storePath, event) {
 /** Read all events for a session from its JSONL log file. Returns an empty array if the file does not exist or cannot be read. */
 export function readSessionEvents(storePath, sessionID) {
     try {
+        if (!validateSessionID(sessionID))
+            return [];
         const filePath = getSessionPath(storePath, sessionID);
         const content = readFileSync(filePath, "utf8");
         const lines = content.split("\n").filter((l) => l.trim().length > 0);
@@ -58,6 +64,8 @@ export function listSessionIDs(storePath) {
 /** Delete a session's JSONL log file from disk. Silently succeeds if the file does not exist. */
 export function deleteSession(storePath, sessionID) {
     try {
+        if (!validateSessionID(sessionID))
+            return;
         const filePath = getSessionPath(storePath, sessionID);
         if (existsSync(filePath)) {
             unlinkSync(filePath);

package/dist/indexer/git-diff.d.ts

@@ -23,7 +23,7 @@ export declare function getCurrentCommit(cwd: string): string | null;
  *
  * @param cwd - A path inside the repository.
  * @param fromCommit - The commit SHA to diff against.
- * @returns A diff result, or `null` if the git command fails.
+ * @returns A diff result, or `null` if the git command fails or the commit is invalid.
  */
 export declare function getChangedFilesSince(cwd: string, fromCommit: string): GitDiffResult | null;
 /**

package/dist/indexer/git-diff.js

@@ -45,9 +45,13 @@ export function getCurrentCommit(cwd) {
  *
  * @param cwd - A path inside the repository.
  * @param fromCommit - The commit SHA to diff against.
- * @returns A diff result, or `null` if the git command fails.
+ * @returns A diff result, or `null` if the git command fails or the commit is invalid.
  */
 export function getChangedFilesSince(cwd, fromCommit) {
+    // The commit value originates from a manifest file — validate it strictly
+    // so a crafted manifest can never inject git options via argv.
+    if (!/^[0-9a-f]{7,40}$/i.test(fromCommit))
+        return null;
     try {
         const changedRaw = execFileSync("git", ["diff", "--name-only", "--diff-filter=ACMRT", fromCommit, "HEAD"], {
             cwd, encoding: "utf-8", timeout: 10000, stdio: ["ignore", "pipe", "ignore"],