opencode-zen-freex 0.2.7 → 0.2.9

package/tool-response.mjs

@@ -1,21 +1,33 @@
-const MAX_BYTES = 32 * 1024 * 1024;
+import { MAX_BYTES, STALE_BODY_HEADERS } from "./stream.mjs";
+
+// The limit as a failure's message names it, from the one place it is set:
+// stream.mjs owns the number, and this guard reads the same bytes through it.
+const LIMIT = `${MAX_BYTES / (1024 * 1024)} MiB`;
 const encoder = new TextEncoder();
 
-class GuardError extends Error {}
+class GuardError extends Error {
+  constructor(message, code = "upstream_error") {
+    super(message);
+    this.code = code;
+  }
+}
 
 function headersFor(response) {
   const headers = new Headers(response.headers);
-  headers.delete("content-length");
-  headers.delete("content-encoding");
+  for (const name of STALE_BODY_HEADERS) headers.delete(name);
   return headers;
 }
 
-function failure(protocol, message, stream = false) {
+// failure answers the error a client reads. `code` says what went wrong
+// where the shape has room for it: only a call of no tool the agent has is
+// an undeclared one, and a limit, a truncation or a malformed upstream is
+// not.
+function failure(protocol, message, stream = false, code = "upstream_error") {
   if (protocol === "anthropic") return { type: "error", error: { type: "api_error", message } };
   if (protocol === "responses") {
     return stream
-      ? { type: "error", code: "undeclared_tool", message }
-      : { error: { type: "upstream_error", code: "undeclared_tool", message } };
+      ? { type: "error", code, message }
+      : { error: { type: "upstream_error", code, message } };
   }
   return { error: { message, type: "upstream_error" } };
 }
@@ -198,7 +210,7 @@ function checkSnapshots(data, protocol, checkName) {
     if (isCall(protocol, value)) {
       const name = checkName(value.name);
       if (name == null) {
-        if (!holder) throw new GuardError(droppedNote(value.name));
+        if (!holder) throw new GuardError(droppedNote(value.name), "undeclared_tool");
         holder[key] = inPlaceOf(protocol, value, droppedNote(value.name));
         changed = true;
         left++;
@@ -267,7 +279,7 @@ function chatBuffer(checkName) {
     bytes += size;
     state.bytes += size;
     if (bytes > MAX_BYTES)
-      throw new GuardError("Pending upstream tools exceed the 32 MiB buffer limit");
+      throw new GuardError(`Pending upstream tools exceed the ${LIMIT} buffer limit`);
   }
   function stateFor(index, data) {
     if (!pending.has(index)) {
@@ -289,7 +301,10 @@ function chatBuffer(checkName) {
     return pending.get(index);
   }
   // Choices that streamed text, and those whose every call was left out
-  // (whose later "tool_calls" finish is a stop).
+  // (whose later "tool_calls" finish is a stop). The second is per round: a
+  // later round that buffers a call for the same choice is judged on what it
+  // holds, not on the round before it, so the mark is dropped as soon as that
+  // call arrives.
   const wrote = new Set();
   const ended = new Set();
   function complete(state, index) {
@@ -308,6 +323,14 @@ function chatBuffer(checkName) {
     }
     return delta;
   }
+  // What a choice the buffer flushes at [DONE] ended as: tool use when the
+  // delta it publishes carries calls, the legacy field when it carries that,
+  // and a plain stop otherwise.
+  function ending(delta) {
+    if (delta.tool_calls?.length) return "tool_calls";
+    if (delta.function_call) return "function_call";
+    return "stop";
+  }
   function remove(index) {
     const state = pending.get(index);
     if (state) bytes -= state.bytes;
@@ -319,6 +342,10 @@ function chatBuffer(checkName) {
     },
     clear() {
       pending.clear();
+      // Everything this buffer holds, not only the bytes: a cleared buffer
+      // has no round to judge.
+      wrote.clear();
+      ended.clear();
       bytes = 0;
     },
     apply(data) {
@@ -330,7 +357,12 @@ function chatBuffer(checkName) {
         if (typeof delta.content === "string" && delta.content) wrote.add(position(choice.index));
         if (delta.tool_calls == null && delta.function_call == null) continue;
         changed = true;
-        const state = stateFor(position(choice.index), data);
+        // A call buffered now opens a round of its own for this choice: a
+        // choice that finished as a plain stop because every call of an
+        // earlier round was left out is judged again on what this one holds.
+        const at = position(choice.index);
+        ended.delete(at);
+        const state = stateFor(at, data);
         for (const fragment of list(delta.tool_calls)) {
           if (!object(fragment) || (fragment.type != null && fragment.type !== "function")) {
             throw new GuardError("Unsupported upstream tool delta");
@@ -381,9 +413,16 @@ function chatBuffer(checkName) {
     },
     finish() {
       if (!pending.size) return null;
-      const choices = [...pending]
-        .sort(([a], [b]) => a - b)
-        .map(([index, state]) => ({ index, delta: complete(state, index), finish_reason: null }));
+      const choices = [...pending].sort(([a], [b]) => a - b).map(([index, state]) => {
+        const delta = complete(state, index);
+        // The case this buffer exists for is an upstream that closes with
+        // [DONE] before sending a finish chunk: the calls it buffered are
+        // published here, and the choice has to say the turn ended in tool
+        // use. A null reason reads as no ending at all, and "stop" as a plain
+        // one — either way a client keyed on finish_reason never runs a call
+        // it was handed.
+        return { index, delta, finish_reason: ending(delta) };
+      });
       const metadata = pending.values().next().value.metadata;
       pending.clear();
       bytes = 0;
@@ -485,6 +524,46 @@ function snapshotStream(protocol, checkName) {
   };
 }
 
+// A reply that is not a stream is read whole before it is checked, so it is
+// read through the same limit a streamed reply's events are: a body past it
+// is a 502, rather than the whole of it sitting in memory first.
+async function readBounded(response) {
+  const reader = response.body?.getReader();
+  if (!reader) return "";
+  const parts = [];
+  let bytes = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      bytes += value.byteLength;
+      if (bytes > MAX_BYTES)
+        throw new GuardError(`Upstream response exceeds the ${LIMIT} buffer limit`);
+      parts.push(value);
+    }
+  } finally {
+    // Whatever ended the read — the limit, a malformed body, or the end of
+    // it — this body is never read again, so the reader is loosed and the
+    // stream cancelled. This was the one place in the package that abandoned
+    // a body without cancelling it (measured: no cancellation past the limit,
+    // and the source still pulled after the 502), which leaves an upstream
+    // writing into a socket nobody reads. The cancel's own failure is not
+    // swallowed, and the lock is released whether it threw or not.
+    try {
+      await reader.cancel();
+    } finally {
+      reader.releaseLock();
+    }
+  }
+  const all = new Uint8Array(bytes);
+  let offset = 0;
+  for (const part of parts) {
+    all.set(part, offset);
+    offset += part.length;
+  }
+  return new TextDecoder().decode(all);
+}
+
 function parseJSON(text) {
   let value;
   try {
@@ -519,7 +598,7 @@ async function* framesFrom(reader) {
   function append(value) {
     eventBytes += value.byteLength;
     if (eventBytes > MAX_BYTES)
-      throw new GuardError("Upstream SSE event exceeds the 32 MiB buffer limit");
+      throw new GuardError(`Upstream SSE event exceeds the ${LIMIT} buffer limit`);
     if (value.byteLength) {
       parts.push(value);
       lineBytes += value.byteLength;
@@ -546,7 +625,7 @@ async function* framesFrom(reader) {
         start = 1;
       }
       if (eventBytes > MAX_BYTES)
-        throw new GuardError("Upstream SSE event exceeds the 32 MiB buffer limit");
+        throw new GuardError(`Upstream SSE event exceeds the ${LIMIT} buffer limit`);
       skipLF = false;
       if (pendingFrame) {
         const frame = pendingFrame;
@@ -559,7 +638,7 @@ async function* framesFrom(reader) {
       if (value[offset] !== 10 && value[offset] !== 13) continue;
       append(value.subarray(start, offset));
       if (++eventBytes > MAX_BYTES)
-        throw new GuardError("Upstream SSE event exceeds the 32 MiB buffer limit");
+        throw new GuardError(`Upstream SSE event exceeds the ${LIMIT} buffer limit`);
       const bytes = new Uint8Array(lineBytes);
       let cursor = 0;
       for (const part of parts) {
@@ -584,7 +663,7 @@ async function* framesFrom(reader) {
           rawLine += "\n";
           offset++;
           if (++eventBytes > MAX_BYTES)
-            throw new GuardError("Upstream SSE event exceeds the 32 MiB buffer limit");
+            throw new GuardError(`Upstream SSE event exceeds the ${LIMIT} buffer limit`);
         } else if (offset + 1 === value.length) skipLF = true;
       }
       start = offset + 1;
@@ -768,9 +847,16 @@ function guardedStream(response, protocol, checkName, endCutShort) {
               return;
             }
             if (frame.name !== "error" && frame.text.trim() === "[DONE]") {
-              if (protocol !== "chat")
+              // [DONE] is what ends a Chat stream, and a valid end-of-stream
+              // sentinel for a Responses or Messages one that has already
+              // reported its own terminal event (response.completed,
+              // response.incomplete, message_stop) — a gateway in front of the
+              // upstream may append it. Before that event it claims an ending
+              // the protocol never reported, and the frame is refused; the
+              // collapse path reads the same bytes the same way.
+              if (protocol !== "chat" && !completed)
                 throw new GuardError("Unexpected upstream completion marker");
-              const final = chat.finish();
+              const final = chat ? chat.finish() : null;
               completed = true;
               controller.enqueue(encoder.encode((final ? encodeEvent(final) : "") + frame.raw));
               return;
@@ -826,7 +912,7 @@ function guardedStream(response, protocol, checkName, endCutShort) {
             controller.enqueue(
               encoder.encode(
                 encodeEvent(
-                  failure(protocol, error.message, true),
+                  failure(protocol, error.message, true, error.code),
                   protocol === "chat" ? "" : "error",
                 ),
               ),
@@ -865,16 +951,15 @@ export async function guardToolResponse(response, protocol, policy, options = {}
       headers,
     });
   }
-  const text = await response.text();
   let value;
   let status = response.status;
   try {
-    value = parseJSON(text);
+    value = parseJSON(await readBounded(response));
     checkSnapshots(value, protocol, checkName);
   } catch (error) {
     if (!(error instanceof GuardError)) throw error;
     status = 502;
-    value = failure(protocol, error.message);
+    value = failure(protocol, error.message, false, error.code);
   }
   headers.set("content-type", "application/json");
   return new Response(JSON.stringify(value), { status, headers });

package/capture.mjs

@@ -1,203 +0,0 @@
-// Recaptures fingerprint.json from a real OpenCode.
-//
-// The free tier reads the wording of the tools it knows by name out of the
-// request body and refuses the request when it differs from its own copy. That
-// copy moves with OpenCode, so the one held here goes stale — and a stale copy
-// looks exactly like a working one until somebody is refused. This is how a new
-// one is taken, so that refreshing it is a command and not an archaeology
-// exercise.
-//
-//   bun run capture            # writes fingerprint.json
-//   bun run capture -- --dry   # reports what changed, writes nothing
-//
-// Needs opencode on PATH (https://opencode.ai) and bun. Nothing goes to Zen: the
-// OpenCode under test is pointed at a server running here, and the request it
-// makes is the thing being read.
-
-import { spawn } from "node:child_process";
-import { readFileSync } from "node:fs";
-import { mkdtempSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { PROFILES } from "./core-tools.mjs";
-
-const PORT = Number(process.env.CAPTURE_PORT ?? 8791);
-const DRY = process.argv.includes("--dry");
-const HERE = import.meta.dir;
-const FINGERPRINT = join(HERE, "fingerprint.json");
-
-// The names Zen reads. Everything else a host declares is ignored by it.
-const READ = ["bash", "glob", "grep", "read", "write", "edit"];
-
-// The capture host's own scratch directory and OS banner belong to the machine
-// the capture ran on, not to the tool. These are put back to something neutral
-// so the capture is not tied to one machine.
-const NEUTRALISE = [
-  [/Be aware: OS: [^\n]*/g, "Be aware: OS: linux, Shell: bash"],
-  [/Use `[^`]*` for temporary work outside the workspace\./g, "Use `/tmp` for temporary work outside the workspace."],
-  [/Use `[A-Za-z]:\\[^`]*`/g, "Use `/tmp`"],
-];
-// Zen compares roughly the first 700 characters and ignores the rest; 1200
-// leaves margin, and the tail is where a note to the model goes.
-const KEEP = 1200;
-
-const capturedPath = join(tmpdir(), `zen-capture-${process.pid}.json`);
-const server = Bun.serve({
-  port: PORT,
-  hostname: "127.0.0.1",
-  async fetch(request) {
-    const url = new URL(request.url);
-    if (url.pathname.endsWith("/models"))
-      return Response.json({ object: "list", data: [{ id: "big-pickle", object: "model", owned_by: "opencode" }] });
-    // OpenCode makes more than one request (a short one for the title, then the
-    // real one). The one worth reading is the longest, since it is the one that
-    // carries the full toolset.
-    const body = await request.text();
-    let previous = { agent: null, body: "" };
-    try {
-      previous = JSON.parse(readFileSync(capturedPath, "utf8"));
-    } catch {}
-    if (body.length > previous.body.length)
-      await Bun.write(capturedPath, JSON.stringify({ agent: request.headers.get("user-agent"), body }));
-    return new Response(
-      [
-        'data: {"id":"c1","object":"chat.completion.chunk","created":1,"model":"big-pickle","choices":[{"index":0,"delta":{"role":"assistant","content":"OK"},"finish_reason":null}]}',
-        'data: {"id":"c1","object":"chat.completion.chunk","created":1,"model":"big-pickle","choices":[{"index":0,"delta":{},"finish_reason":"stop"}]}',
-        "data: [DONE]",
-        "",
-      ].join("\n\n"),
-      { headers: { "content-type": "text/event-stream" } },
-    );
-  },
-});
-
-const home = mkdtempSync(join(tmpdir(), "zen-capture-home-"));
-// Where OpenCode looks for its config is XDG_CONFIG_HOME/opencode, and the
-// three XDG directories are pointed at `home` below.
-const config = join(home, "config", "opencode", "opencode.json");
-await Bun.write(
-  config,
-  JSON.stringify({ provider: { opencode: { options: { baseURL: `http://127.0.0.1:${PORT}/v1` } } } }),
-);
-
-console.log(`listening on 127.0.0.1:${PORT}, running opencode against it`);
-let ran = true;
-const code = await new Promise((done) => {
-  const child = spawn("opencode", ["run", "-m", "opencode/big-pickle", "Say OK."], {
-    env: {
-      ...process.env,
-      XDG_DATA_HOME: join(home, "data"),
-      XDG_CONFIG_HOME: join(home, "config"),
-      XDG_CACHE_HOME: join(home, "cache"),
-    },
-    stdio: ["ignore", "ignore", "inherit"],
-  });
-  child.on("error", () => {
-    console.error("could not run opencode; install it from https://opencode.ai and put it on PATH");
-    ran = false;
-    done(1);
-  });
-  child.on("exit", (value) => done(value ?? 0));
-});
-server.stop(true);
-if (!ran) process.exit(1);
-
-let request;
-try {
-  request = JSON.parse(readFileSync(capturedPath, "utf8"));
-} catch {
-  console.error("no request was captured; opencode did not reach the local server");
-  process.exit(1);
-}
-
-const body = JSON.parse(request.body);
-const tools = {};
-for (const raw of body.tools ?? []) {
-  const tool = raw.function ?? raw;
-  if (!tool?.name || !READ.includes(tool.name) || !tool.description) continue;
-  tools[tool.name] = {
-    name: tool.name,
-    description: NEUTRALISE.reduce((text, [find, to]) => text.replace(find, to), tool.description).slice(0, KEEP),
-    parameters: tool.parameters,
-  };
-}
-
-const missing = READ.filter((name) => !tools[name]);
-if (missing.length) {
-  console.error(
-    `the captured request has no ${missing.join(", ")}; this OpenCode no longer sends them, so it cannot be captured this way`,
-  );
-  process.exit(1);
-}
-for (const [name, tool] of Object.entries(tools))
-  if (tool.description.length < 100) {
-    console.error(`${name}'s description looks truncated (${tool.description.length} chars); not writing`);
-    process.exit(1);
-}
-
-// Which generation this client is: the names it sends say so.
-const generation = body.tools.some((t) => (t.function ?? t).name === "shell") ? "2.x" : "1.x";
-const required = generation === "2.x" ? ["shell", "read"] : ["bash", "glob", "grep", "read"];
-const absent = required.filter((name) => !tools[name]);
-if (absent.length) {
-  console.error(`a ${generation} request must carry ${absent.join(", ")}, and the capture does not`);
-  process.exit(1);
-}
-
-// Which protocol was captured, since each of 1.x's protocols bundles its own
-// provider-utils and a capture must not overwrite the ones it did not observe.
-const protocol = body.input !== undefined && body.messages === undefined ? "responses" : "chat";
-
-console.log(`\nagent:  ${request.agent}`);
-console.log(`tools:  ${Object.keys(tools).join(", ")}  (${generation}, ${protocol})`);
-if (code !== 0) console.log(`(opencode exited ${code}; its request was still captured)`);
-
-const agent = parseAgent(request.agent);
-if (agent.providerUtils) agent.providerUtils = { ...PROFILES[generation]?.agent?.providerUtils, [protocol]: agent.providerUtils[protocol] };
-
-const before = PROFILES[generation];
-const agentChanged = JSON.stringify(before?.agent) !== JSON.stringify(agent);
-let changed = 0;
-for (const name of Object.keys(tools)) {
-  if (JSON.stringify(before?.tools?.[name]) !== JSON.stringify(tools[name])) changed++;
-  console.log(`  ${name.padEnd(6)} ${JSON.stringify(before?.tools?.[name]) === JSON.stringify(tools[name]) ? "unchanged" : "CHANGED"}  ${tools[name].description.length} chars`);
-}
-if (agent.providerUtils)
-  console.log(`  agent  ${agentChanged ? "CHANGED" : "unchanged"}  ${protocol} provider-utils kept separate from the others`);
-
-if (DRY) {
-  const what = [changed ? `${changed} tool(s)` : null, agentChanged ? "the agent" : null].filter(Boolean);
-  console.log(`\n${what.length ? `${what.join(" and ")} would change.` : "Nothing would change."} Nothing written (--dry).`);
-  process.exit(what.length ? 1 : 0);
-}
-
-if (!changed && !agentChanged) {
-  console.log("\nnothing changed.");
-  process.exit(0);
-}
-
-const next = JSON.parse(readFileSync(FINGERPRINT, "utf8"));
-next.profiles[generation] = { agent, required, tools };
-await Bun.write(FINGERPRINT, JSON.stringify(next, null, 2) + "\n");
-console.log(`\nwrote ${FINGERPRINT} for ${generation}. Now run \`bun run check:gate\` and commit if it passes.`);
-
-// The User-Agent is stored the way agentFor() reads it back, which is not
-// necessarily the same split the raw header used.
-function parseAgent(agent) {
-  const twoPart = /^opencode\/(\d[^ ]*) ai-sdk\/provider-utils\/(\S+) (\S+)$/.exec(agent ?? "");
-  if (twoPart) {
-    const [, opencode, providerUtils, runtime] = twoPart;
-    return {
-      opencode,
-      providerUtils: { chat: providerUtils, responses: providerUtils, anthropic: providerUtils },
-      runtime,
-    };
-  }
-  const threePart = /^opencode\/([a-z]+)\/(\d[^/]*)\/([a-z-]+)$/.exec(agent ?? "");
-  if (threePart) {
-    const [, channel, opencode, client] = threePart;
-    return { channel, opencode, client };
-  }
-  console.error(`\ncould not read \`${agent}\` as an OpenCode User-Agent; write PROFILES[${generation}].agent by hand`);
-  process.exit(1);
-}