fix(opencode): handle child approvals, stops, and model catalogs

[t3dotgg]

OpenCode could hide approval and question prompts from child sessions after a resume or reconnect. Turn races could also accept work after a stop, complete the wrong turn, or leave stop callers waiting. Model refresh, server authentication, and missing catalog entries had separate consistency problems.

This change verifies session ancestry, recovers pending child requests, and limits recovery work to the current prompt generation. Asked-event ancestry recovery continues while the native request is live. If a terminal event supersedes that request but ancestry remains unknown, terminal recovery stops after five attempts and removes its retry entry. Each session serializes prompt sends. A stop cancels a pending prompt request before it sends the native abort, and a canceled send exits as interrupted instead of persisting a running turn. Admission recovery keeps a buffered idle when the exact prompt echo arrives before or after the prompt HTTP response. Bounded message and status checks then reconcile that idle and the first idle after an interruption without reconnecting SSE. Both recovery requests read the stopped state first, then verify the current session, admission, turn, prompt generation, and cancellation before they change state. A stale response cannot clear the next prompt's admission. A polled busy status immediately enables output after an interruption. A final cancellation check runs before sendTurn returns. A genuine session error now releases pending stop callers.

OpenCode inventory and text generation share one lazy local server. Local settings passwords override OPENCODE_SERVER_PASSWORD; otherwise the inherited environment password is used by the server and every SDK client. External servers use only their configured password. Every connection passes an authenticated health and minimum-version check before inventory or session work.

OpenCode catalogs refresh when a client subscribes to server config or requests a manual refresh. Periodic OpenCode catalog polling remains off. A failed refresh keeps the last good models, slash commands, and skills. The shared helper closes 30 seconds after its last borrower releases it, so a later refresh rereads native configuration files. T3 Code does not own external OpenCode servers, which can need their own reload or restart.

Web scopes both missing-model option dispatch and trigger-label handling to OpenCode. If an OpenCode model is missing from the catalog, dispatch keeps the thread or draft's exact provider instance, model, and saved option values. The trigger shows the stored model identifier instead of falling back to the first catalog option. The picker shows an Unavailable row, respects hidden models, and remains usable while the provider reports a warning or error. Other providers validate dispatch options against live descriptors and keep their existing first-option trigger fallback. Mobile thread settings include the shared manual model refresh action.

Verification: 334 focused tests pass. This includes 179 server tests across seven files, 80 of which are adapter tests, one selected ProviderService interruption test, three subscribeServerConfig tests, 149 web tests across six files, and two mobile refresh tests. Scoped server, web, and mobile typechecks pass. Targeted lint, formatting, and git diff --check pass.

A loopback fault test reproduced the send-after-stop race on commit 3d0dc050 and verified the repaired code. The baseline accepted the held prompt after stop completed and wrote the sandbox file after turn.aborted. The repaired code canceled the prompt before the proxy forwarded it, made zero model calls, and did not write the file. A separate authenticated OpenCode 1.18.23 control recovered and resolved two child requests, left no pending requests, and completed the parent with five loopback model calls. No live data or real model account was used. No browser or emulator verification was run.

Made by GPT-5.6 Sol with the T3 Code Codex harness.

---

Note

High Risk
Changes sit in OpenCode session lifecycle, stop/interrupt coordination, and child approval routing—areas where race bugs directly affect correctness and user safety.

Overview
Mobile thread settings now carry an environmentId through the settings session and expose a Refresh models header action (Android and iOS). Refresh runs serverEnvironment.refreshProviders for that environment via a small helper that deduplicates in-flight taps and surfaces discovery failures in an alert.

OpenCode driver wiring constructs a shared OpenCodeServerOwner for text generation and provider checks, and turns off settings-triggered and interval catalog polling for the managed OpenCode snapshot (checkProviderOnSettingsChange: false, refreshOnInterval: false).

OpenCode adapter tests expand heavily: the runtime mock gains session status, permissions, questions, abort signals, and richer event streaming. New cases cover connection timeouts, concurrent session starts, stop/teardown races, steer admission vs idle/status ordering, interrupt and turnless abort behavior, and child-session approval/question routing plus recovery on resume.

^{Reviewed by Cursor Bugbot for commit 66e3e7a. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Rework OpenCodeAdapter child approvals, stops, and unavailable model catalog handling

• Reworks sendTurn, interrupt, and session startup in OpenCodeAdapter to serialize prompt submissions with a Semaphore, correlate by generated messageID, and coordinate cancellation via Deferred so aborts are acknowledged by either API or event stream
• Adds routing for child-session permission/question events via isOpenCodeChildRequestEvent, emitPendingOpenCodeRequest, and emitTerminalOpenCodeRequest with de-duplication and parent-session relation retries
• Introduces OpenCodeServerOwner for shared, lazily-started local OpenCode servers with a 30s idle TTL, concurrent borrower tracking, and process-exit invalidation
• Adds server version validation against MINIMUM_OPENCODE_VERSION ("1.14.19") via verifyOpenCodeServerVersion with a 5s health-check timeout; local servers inject OPENCODE_SERVER_PASSWORD into the child environment, external servers receive only settings-provided passwords
• Preserves unavailable OpenCode model selections across catalog refreshes: mergeProviderSnapshot retains prior slashCommands/skills under retention conditions, and the web/mobile pickers render an "Unavailable" badge while keeping saved options for dispatch
• Risk: runOpenCodeSdk signature changed to require an AbortSignal parameter; all callers in opencodeRuntime.ts are updated. makeOpenCodeTextGeneration no longer accepts an environment argument and delegates server lifecycle to OpenCodeServerOwner — out-of-tree callers of either will break.

^{Macroscope summarized 66e3e7a.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b4443b9a-5395-46c0-8721-ac6d86282288

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−56 B (−0.4%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−60 B (−0.9%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	55.5 KiB	−88 B (−0.2%)	66.4 KiB	✅
Codex	Live turn messages	11	9	−2 (−18.2%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−20 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−9 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−11 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	11	10	−1 (−9.1%)	21	✅

Baseline: 8f49132 · PR result: 66e3e7a · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR substantially changes OpenCode server lifecycle, authentication and permission handling, provider refresh behavior, and turn/child-request processing across server, web, and mobile production paths. Its broad stateful runtime impact and security-sensitive connection changes require human review despite the extensive tests and experienced authorship.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Effect service conventions review: two related findings on the new OpenCodeServerOwner module and how it is handed to its consumers. Everything else in the diff (namespace imports from effect/* subpaths, canonical module placement at apps/server/src/provider/OpenCodeServerOwner.ts, scoped resource ownership, error handling moved from OpenCodeTextGeneration.ts) looks consistent with the conventions.

^{Posted via Macroscope — Effect Service Conventions}