fix(opencode): bound stalled provider streams and interrupts - #303

Closes #302

Change

wrapSSE retains the existing per-read timeout and also bounds time since non-empty generation progress for OpenAI-compatible SSE. Responses reasoning/text/tool-argument deltas and Chat content/reasoning/refusal/tool-argument/function-call deltas reset the generation deadline. Chat reasoning_details progress includes OpenRouter's non-empty reasoning.text, reasoning.summary, and reasoning.encrypted payloads. Mistral array-valued text and thinking parts count as progress. Transport-only comments and metadata do not.

SSE framing accepts LF, CRLF, CR, and mixed blank-line separators while treating CRLF as one indivisible line ending, including multiline data: events. The generation deadline reuses provider chunkTimeout (300,000 ms by default), preserving configured overrides and false opt-out. A stalled stream aborts the combined provider request, cancels the reader, and fails as ProviderResponseStreamError; the existing raw-read timeout remains unchanged.

The existing SessionPrompt → SessionRunState → Runner cancellation path is exercised through SessionPrompt.cancel; this change does not add a second cancellation controller. The processor regression verifies the classified timeout survives retries and a one-shot persistence failure through the existing #112 publication path.

Live route evidence (2026-10-19)

The incident report records three high-effort gpt-6.1-sol agent attempts that streamed for 2–4 minutes and then froze. It is symptom evidence, not a route trace. The referenced 28,853-byte brief was used read-only in a bounded direct LLM stream through LLM.Service → Provider → @ai-sdk/openai; tools were disabled, so this was not a complete reproduction of the brief-writer workflow.

The probe used Bun 1.4.2, @ai-sdk/openai 3.0.88, model swx-azure/gpt-6.1-sol, reasoning effort high, and the default 300,000 ms header and chunk timeouts. The measured provider implementation was committed as 9eeb67cab8013bf9d4e74031d6d297a216789381.

The request was POST https://swxcodexmodels.openai.azure.com/openai/v1/responses; the response was 200 text/event-stream; charset=utf-8, served by istio-envoy in East US. It completed in 18.642 seconds. The first raw chunk arrived at 1.418 seconds and the last at 18.608 seconds. The body had 66 raw chunks (105,757 bytes), 275 non-empty generation-progress frames (240 reasoning-summary deltas and 35 output-text deltas), and no SSE comment/keepalive frames. First raw/decoded generation progress arrived at 5.802/5.805 seconds, last at 18.604/18.605 seconds, with a 5.649-second maximum progress gap.

For this measured request, the response/SDK path was observed through the configured fetch; candidate B (an unwrapped or SDK-bypassed response) was not observed. Candidate A (keepalives continuing after generation stops) remains LIVE-UNOBSERVED: the probe completed normally and had no keepalive comments. The captain authorized proceeding from the controlled fixture alone; this PR does not claim candidate A was observed.

The isolated two-ESC TUI probe returned HTTP 200 from session.abort and rendered the session interrupted with the spinner gone; that live probe did not observe provider-body closure. The producer-driven SessionPrompt.cancel regression separately observes the provider fetch signal abort and loop/idle settlement.

Regression proof and focused checks

From packages/opencode:

TMPDIR=/tmp/opencode bun test --timeout 85000 test/session/llm.test.ts -t "bounds Foundry Responses|preserves slow Foundry reasoning progress|preserves Mistral array-valued thinking|recognizes Chat Completions progress fields|keeps OpenRouter structured reasoning_details"
# 5 pass, 76 assertions
TMPDIR=/tmp/opencode bun test --timeout 30000 test/provider/header-timeout.test.ts -t "chunkTimeout|headerTimeout"
# 8 pass, 14 assertions
TMPDIR=/tmp/opencode bun test --timeout 65000 test/session/prompt.test.ts -t "SessionPrompt.cancel aborts a progressing provider request and settles the drain|first-provider diagnostic identifies the held actual runner under its unchanged bound"
# 2 pass, 11 assertions
TMPDIR=/tmp/opencode bun test --timeout 110000 test/session/processor-effect.test.ts -t "session.processor retains the stalled Foundry error"
# 1 pass, 14 assertions

The mixed/multiline-CRLF Chat test failed at its completion assertion with the previous splitter, then passed with CRLF-atomic framing. Chat tests cover the progress fields and require empty content, text, summary, and encrypted reasoning payloads to retain the generation timeout. The OpenRouter test exercises the installed @openrouter/ai-sdk-provider through LLM.Service; the old classifier failed before recognizing reasoning.encrypted, and the updated test passes for text, encrypted, and summary deltas. The Mistral SDK-path regression verifies array-valued reasoning and text deltas over an interval longer than chunkTimeout.

Bounded absence proofs: when OpenAI progress recognition was disabled, the stalled LLM regression failed at its internal bound (stalled provider attempt did not fail within its bound). When state.cancel(sessionID) was temporarily replaced with Effect.void, the cancellation regression failed at its internal bound (cancelled prompt did not settle). Both implementations were restored and the focused tests passed green.

bun typecheck passed in packages/opencode and packages/core; the push hook ran bun turbo typecheck successfully in 30/30 packages. The PR-context changeset check passed (ok: #303 is recorded). Selected Prettier checks passed for the LLM regression file, provider config, generated SDK types, and OpenAPI schema. Full-file Prettier still reports pre-existing unrelated formatting suggestions in the existing provider, changeset, processor-test, and prompt-test files; no unrelated formatting was applied. ./packages/sdk/js/script/build.ts, bun dev generate > ../sdk/openapi.json, and bun run generate from packages/client regenerated/verified the public config descriptions.

The previous unit CI run on head 2429de1c83 had one prompt-test setup failure (Agent not found: build) before the provider boundary. After merging the updated base containing #301, the focused first-provider diagnostic and cancellation tests passed. Unit, typecheck, and e2e checks for the current head are running.

Independent review

Codex's actionable findings on multiline CRLF framing and OpenRouter reasoning_details text, summary, and encrypted payloads were fixed with red/green regressions. Its final response said no actionable regressions were identified, but the structured review gate marked it UNVERIFIED because the response was untagged. Gemini 3.1 Pro reviewed the full diff in read-only mode and reported no actionable regressions.

Follow-up and coordination

Issue #308 tracks a sanitized live trace after #302 lands and fm-spp resumes. It determines whether transport-only keepalives continued after progress stopped; it is post-landing verification, not a blocker. Issue #310 tracks broader non-text SSE progress and opaque-reasoning compatibility; duplicate #312 was closed in favor of #310.

PR #301 merged into swxtch as bf66f27de555be40f64c949699104c9d82e08758 and is included in this branch. Issue #302 was unassigned at pickup.

PR #303 remains draft against swxtch. The pushed head is 7359b71cd312e43d436270a42c2dc1e7827bb973 and matches the live PR head; the base is bf66f27de555be40f64c949699104c9d82e08758. GitHub unit, typecheck, and e2e checks are pending on this head. Do not mark ready or merge; firstmate owns review convergence and the final suite gate.