From 6091ff597e61e83c7c06e7dbc25968809a78c891 Mon Sep 17 00:00:00 2001 From: anojndr Date: Thu, 17 Sep 2026 18:02:31 +0700 Subject: [PATCH] fix(opencode): resolve 403 FreeTierError with canonical session format and valid User-Agent OpenCode upstream validates free-tier requests: User-Agent must be opencode/ (>= 1.17.0) and x-opencode-session must match canonical ses_ format. Default OPENCODE_UA to opencode/1.18.31, generate canonical descending session IDs, provide deterministic foreign session translation, and isolate credentials per-request. --- open-sse/executors/opencode.js | 134 ++++++++++++++++-- tests/unit/opencode-session.test.js | 202 ++++++++++++++++++++++++++++ 2 files changed, 323 insertions(+), 13 deletions(-) create mode 100644 tests/unit/opencode-session.test.js diff --git a/open-sse/executors/opencode.js b/open-sse/executors/opencode.js index fe77137c..ba6a16a0 100644 --- a/open-sse/executors/opencode.js +++ b/open-sse/executors/opencode.js @@ -7,19 +7,100 @@ import { resolveSessionId } from "../utils/sessionManager.js"; import { isMuseSparkModel } from "../providers/models/helpers.js"; import { ANTHROPIC_API_VERSION } from "../providers/shared.js"; -const OPENCODE_UA = "opencode"; +const OPENCODE_UA = "opencode/1.18.31"; +const MAX_SESSION_LENGTH = 256; +const SESSION_HEADER = "x-opencode-session"; +const SESSION_FIELD = "_opencodeSession"; +export const OPENCODE_SESSION_RE = /^ses_[0-9a-f]{12}[0-9A-Za-z]{14}$/; +const BASE62_CHARS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"; + +function hasValidOpencodeVersion(ua) { + const m = String(ua || "").match(/opencode\/(\d+)\.(\d+)(?:\.(\d+))?/i); + if (!m) return false; + const major = parseInt(m[1], 10); + const minor = parseInt(m[2], 10); + return major > 1 || (major === 1 && minor >= 17); +} + +// Models served by /zen/v1/responses; every other model stays on /chat/completions. const RESPONSES_MODELS = new Set([ "muse-spark-1.2-contributor-free", "muse-spark-1.3-contributor-free", ]); const MESSAGES_MODELS = new Set(["union-alpha"]); -function generateRequestId() { - return `msg_${crypto.randomUUID().replace(/-/g, "")}`; +let lastTimestamp = 0; +let counter = 0; + +function unstableRandom() { + const bytes = crypto.randomBytes(14); + let randomPart = ""; + for (let i = 0; i < 14; i++) { + randomPart += BASE62_CHARS[bytes[i] % 62]; + } + return randomPart; } -function generateSessionId() { - return `ses_${crypto.randomUUID().replace(/-/g, "")}`; +export function generateSessionId(timestamp = Date.now()) { + if (timestamp !== lastTimestamp) { + lastTimestamp = timestamp; + counter = 0; + } + counter++; + + const current = BigInt(timestamp) * 0x1000n + BigInt(counter); + const value = ~current; + const time = Array.from({ length: 6 }, (_, index) => + Number((value >> BigInt(40 - 8 * index)) & 0xffn) + .toString(16) + .padStart(2, "0") + ).join(""); + return `ses_${time}${unstableRandom()}`; +} + +export function generateRequestId(timestamp = Date.now()) { + const current = BigInt(timestamp) * 0x1000n + 1n; + const value = current; + const time = Array.from({ length: 6 }, (_, index) => + Number((value >> BigInt(40 - 8 * index)) & 0xffn) + .toString(16) + .padStart(2, "0") + ).join(""); + return `msg_${time}${unstableRandom()}`; +} + +export function translateSessionId(sessionId, clientTool = "") { + if (typeof sessionId === "string" && OPENCODE_SESSION_RE.test(sessionId.trim())) { + return sessionId.trim(); + } + const digest = crypto + .createHash("sha256") + .update(`opencode\0${clientTool || "generic"}\0${sessionId || ""}`) + .digest(); + const timeHex = digest.subarray(0, 6).toString("hex"); + let randomPart = ""; + for (let i = 6; i < 20; i++) { + randomPart += BASE62_CHARS[digest[i] % 62]; + } + return `ses_${timeHex}${randomPart}`; +} + +function normalizeSession(value) { + if (typeof value !== "string") return null; + const normalized = value.trim(); + if (!normalized || normalized.length > MAX_SESSION_LENGTH) return null; + return normalized; +} + +function nativeSession(headers) { + if (!headers || typeof headers !== "object") return null; + for (const [key, value] of Object.entries(headers)) { + if (key.toLowerCase() === SESSION_HEADER) { + const normalized = normalizeSession(value); + if (normalized && OPENCODE_SESSION_RE.test(normalized)) return normalized; + } + } + return null; } // Strip the thinking suffix "model(level)" so registry lookups hit the base id. @@ -36,15 +117,27 @@ function isMessagesModel(model) { return MESSAGES_MODELS.has(baseModelId(model)); } -function resolveOpencodeSession(body, credentials) { +function resolveOpencodeSession(body, credentials, providerSessionId, clientTool) { const headers = credentials?.rawHeaders || {}; - return resolveSessionId({ + const native = nativeSession(headers); + if (native) return native; + + let incoming = null; + for (const [key, value] of Object.entries(headers)) { + if (key.toLowerCase() === SESSION_HEADER) { + incoming = normalizeSession(value); + break; + } + } + + const resolved = incoming || normalizeSession(providerSessionId) || resolveSessionId({ headers, body, connectionId: credentials?.connectionId, scope: "opencode", - generate: generateSessionId, }); + + return resolved ? translateSessionId(resolved, clientTool) : generateSessionId(); } function normalizeOpencodeReasoning(model, body) { @@ -73,12 +166,21 @@ function normalizeOpencodeReasoning(model, body) { export class OpenCodeExecutor extends BaseExecutor { constructor() { super("opencode", PROVIDERS.opencode); - this._currentSessionId = null; + } + + prepareRequestCredentials({ body, credentials, providerSessionId, clientTool } = {}) { + const sourceCredentials = credentials || {}; + const resolved = resolveOpencodeSession(body, sourceCredentials, providerSessionId, clientTool); + + return { + ...sourceCredentials, + [SESSION_FIELD]: resolved, + }; } transformRequest(model, body, stream, credentials) { - this._currentSessionId = resolveOpencodeSession(body, credentials); - if (isResponsesModel(model)) { + if (body && typeof body === "object" && model && !body.model) body.model = model; + if (isResponsesModel(model) && body && typeof body === "object") { // Responses API names the output cap max_output_tokens and takes thinking // as reasoning:{effort,summary} — normalize the Chat fields at this boundary. if (body.max_output_tokens === undefined) { @@ -92,6 +194,10 @@ export class OpenCodeExecutor extends BaseExecutor { return injectReasoningContent({ provider: this.provider, model, body }); } + async execute(args) { + return super.execute({ ...args, credentials: this.prepareRequestCredentials(args) }); + } + buildUrl(model) { const base = this.config.baseUrl; if (isResponsesModel(model)) return `${base}/zen/v1/responses`; @@ -105,14 +211,16 @@ export class OpenCodeExecutor extends BaseExecutor { for (const [k, v] of Object.entries(raw)) lower[k.toLowerCase()] = v; const downstreamUa = lower["user-agent"] || ""; - const isOpencodeDownstream = downstreamUa.toLowerCase().includes("opencode"); + const isOpencodeDownstream = hasValidOpencodeVersion(downstreamUa); + + const session = credentials?.[SESSION_FIELD] || this.prepareRequestCredentials({ credentials })[SESSION_FIELD]; const headers = { "Content-Type": "application/json", "Authorization": "Bearer public", "User-Agent": isOpencodeDownstream ? downstreamUa : OPENCODE_UA, "x-opencode-client": lower["x-opencode-client"] || "desktop", - "x-opencode-session": lower["x-opencode-session"] || this._currentSessionId || generateSessionId(), + "x-opencode-session": session, "x-opencode-request": lower["x-opencode-request"] || generateRequestId(), "x-opencode-project": lower["x-opencode-project"] || "global", "Accept": stream ? "text/event-stream" : "*/*", diff --git a/tests/unit/opencode-session.test.js b/tests/unit/opencode-session.test.js new file mode 100644 index 00000000..4fef80fe --- /dev/null +++ b/tests/unit/opencode-session.test.js @@ -0,0 +1,202 @@ +import { beforeEach, describe, expect, it, vi } from "vitest"; + +const { fetchMock } = vi.hoisted(() => ({ + fetchMock: vi.fn(), +})); + +vi.mock("../../open-sse/utils/proxyFetch.js", () => ({ + proxyAwareFetch: fetchMock, +})); + +import { getExecutor } from "../../open-sse/executors/index.js"; +import { + OPENCODE_SESSION_RE, + generateSessionId, + generateRequestId, + translateSessionId, +} from "../../open-sse/executors/opencode.js"; + +function makeCredentials(overrides = {}) { + return { + connectionId: "conn_test", + rawHeaders: {}, + ...overrides, + }; +} + +function prepare(executor, overrides = {}) { + const credentials = overrides.credentials || makeCredentials(); + const prepared = executor.prepareRequestCredentials({ + body: overrides.body || { input: [{ type: "message", role: "user", content: [{ type: "input_text", text: "hello" }] }] }, + credentials, + providerSessionId: overrides.providerSessionId ?? "conversation-a", + clientTool: overrides.clientTool ?? "claude", + }); + return { credentials, prepared }; +} + +beforeEach(() => { + fetchMock.mockReset(); + fetchMock.mockResolvedValue(new Response("{}", { + status: 200, + headers: { "content-type": "application/json" }, + })); +}); + +describe("OpenCode Free Session ID Format", () => { + it("generates session IDs matching OpenCode canonical format (ses_ + 12 hex + 14 base62)", () => { + for (let i = 0; i < 20; i++) { + const id = generateSessionId(); + expect(id).toMatch(OPENCODE_SESSION_RE); + expect(id).toHaveLength(30); + } + }); + + it("generates request IDs matching OpenCode canonical format (msg_ + 12 hex + 14 base62)", () => { + for (let i = 0; i < 20; i++) { + const id = generateRequestId(); + expect(id).toMatch(/^msg_[0-9a-f]{12}[0-9A-Za-z]{14}$/); + expect(id).toHaveLength(30); + } + }); + + it("translates arbitrary sessions into valid OpenCode session format", () => { + const inputs = [ + "claude:550e8400-e29b-41d4-a716-446655440000", + "antigravity:conv-abc-123", + "session-from-codex", + "12345", + "", + ]; + for (const raw of inputs) { + const translated = translateSessionId(raw, "claude"); + expect(translated).toMatch(OPENCODE_SESSION_RE); + expect(translated).toHaveLength(30); + } + }); + + it("preserves already-valid OpenCode sessions without re-hashing", () => { + const valid = "ses_f534dfae8ffeCy4Ee4tLWNygDc"; + expect(translateSessionId(valid)).toBe(valid); + expect(translateSessionId(` ${valid} `)).toBe(valid); + }); +}); + +describe("OpenCode Free Executor Session Resolution", () => { + it("uses request-local session credentials without mutating source credentials", () => { + const executor = getExecutor("opencode"); + const { credentials, prepared } = prepare(executor); + + expect(executor.constructor.name).toBe("OpenCodeExecutor"); + expect(prepared).not.toBe(credentials); + expect(prepared._opencodeSession).toMatch(OPENCODE_SESSION_RE); + expect(credentials).not.toHaveProperty("_opencodeSession"); + expect(executor).not.toHaveProperty("_currentSessionId"); + }); + + it("preserves valid native x-opencode-session header case-insensitively", () => { + const executor = getExecutor("opencode"); + const valid = "ses_f534dfae8ffeCy4Ee4tLWNygDc"; + const { prepared } = prepare(executor, { + credentials: makeCredentials({ rawHeaders: { "X-OpenCode-Session": ` ${valid} ` } }), + }); + + expect(prepared._opencodeSession).toBe(valid); + }); + + it("translates invalid native x-opencode-session header into a valid session", () => { + const executor = getExecutor("opencode"); + const { prepared } = prepare(executor, { + credentials: makeCredentials({ rawHeaders: { "x-opencode-session": "invalid-session-uuid" } }), + }); + + expect(prepared._opencodeSession).toMatch(OPENCODE_SESSION_RE); + expect(prepared._opencodeSession).not.toBe("invalid-session-uuid"); + }); + + it("translates conversation session deterministically", () => { + const executor = getExecutor("opencode"); + const first = prepare(executor, { providerSessionId: "conversation-a", clientTool: "claude" }).prepared._opencodeSession; + const second = prepare(executor, { providerSessionId: "conversation-a", clientTool: "claude" }).prepared._opencodeSession; + + expect(first).toBe(second); + expect(first).toMatch(OPENCODE_SESSION_RE); + }); + + it("isolates different conversations and tools", () => { + const executor = getExecutor("opencode"); + const convA = prepare(executor, { providerSessionId: "conversation-a" }).prepared._opencodeSession; + const convB = prepare(executor, { providerSessionId: "conversation-b" }).prepared._opencodeSession; + const toolClaude = prepare(executor, { providerSessionId: "same", clientTool: "claude" }).prepared._opencodeSession; + const toolCodex = prepare(executor, { providerSessionId: "same", clientTool: "codex" }).prepared._opencodeSession; + + expect(convA).not.toBe(convB); + expect(toolClaude).not.toBe(toolCodex); + }); + + it("adds the valid session header to fetch requests", async () => { + const executor = getExecutor("opencode"); + const credentials = makeCredentials(); + const result = await executor.execute({ + model: "muse-spark-1.3-contributor-free", + body: { input: [{ type: "message", role: "user", content: [{ type: "input_text", text: "hello" }] }] }, + stream: false, + credentials, + providerSessionId: "conversation-fetch-test", + clientTool: "claude", + }); + + expect(result.headers["x-opencode-session"]).toMatch(OPENCODE_SESSION_RE); + expect(fetchMock).toHaveBeenCalledOnce(); + expect(fetchMock.mock.calls[0][1].headers["x-opencode-session"]).toBe(result.headers["x-opencode-session"]); + expect(fetchMock.mock.calls[0][1].headers["Authorization"]).toBe("Bearer public"); + expect(credentials).not.toHaveProperty("_opencodeSession"); + }); + + it("falls back to a valid generated session in buildHeaders when called standalone", () => { + const executor = getExecutor("opencode"); + const headers = executor.buildHeaders({}); + + expect(headers["x-opencode-session"]).toMatch(OPENCODE_SESSION_RE); + expect(headers["Authorization"]).toBe("Bearer public"); + }); + it("handles null or undefined body gracefully in transformRequest", () => { + const executor = getExecutor("opencode"); + expect(() => executor.transformRequest("muse-spark-1.3-contributor-free", null, false, {})).not.toThrow(); + expect(() => executor.transformRequest("big-pickle", undefined, false, {})).not.toThrow(); + }); +}); + +describe("OpenCode Free User-Agent Validation", () => { + it("defaults User-Agent to opencode/1.18.31 for non-opencode downstream clients", () => { + const executor = getExecutor("opencode"); + const headersNoUa = executor.buildHeaders({}); + expect(headersNoUa["User-Agent"]).toBe("opencode/1.18.31"); + + const headersClaude = executor.buildHeaders({ rawHeaders: { "user-agent": "Claude-Code/1.0" } }); + expect(headersClaude["User-Agent"]).toBe("opencode/1.18.31"); + }); + + it("replaces bare opencode with versioned opencode/1.18.31 to prevent 403 FreeTierError", () => { + const executor = getExecutor("opencode"); + const headers = executor.buildHeaders({ rawHeaders: { "user-agent": "opencode" } }); + expect(headers["User-Agent"]).toBe("opencode/1.18.31"); + }); + + it("upgrades outdated opencode versions (< 1.17) to prevent 426 Upgrade Required", () => { + const executor = getExecutor("opencode"); + const headers = executor.buildHeaders({ rawHeaders: { "user-agent": "opencode/1.15.0" } }); + expect(headers["User-Agent"]).toBe("opencode/1.18.31"); + }); + + it("preserves valid opencode versions (>= 1.17)", () => { + const executor = getExecutor("opencode"); + const headers118 = executor.buildHeaders({ + rawHeaders: { "user-agent": "opencode/1.18.31 ai-sdk/provider-utils/4.0.40 runtime/bun/1.3.14" }, + }); + expect(headers118["User-Agent"]).toBe("opencode/1.18.31 ai-sdk/provider-utils/4.0.40 runtime/bun/1.3.14"); + + const headersFuture = executor.buildHeaders({ rawHeaders: { "user-agent": "opencode/1.19.0" } }); + expect(headersFuture["User-Agent"]).toBe("opencode/1.19.0"); + }); +});