Compare commits

..

1 Commits

Author SHA1 Message Date
diegosouzapw
4b6c652b48 fix(providers): correct opencode-zen muse-spark context length and Responses auth header (#12681, #12633)
- Declare the real ~1M contextLength/maxOutputTokens on the muse-spark-1.2 /
  muse-spark-1.2-contributor-free registry entries (opencode + opencode-zen)
  instead of silently falling back to the 200000 provider default (#12681).
- Send x-api-key instead of Authorization: Bearer for the openai-responses
  format on the main OpenCode Zen host, fixing a 401 on Muse Spark
  Contributor's /v1/responses route; scoped by baseUrl so opencode-go (a
  different upstream) keeps Bearer (#12633).
2026-09-10 14:16:31 -03:00
16 changed files with 135 additions and 296 deletions

View File

@@ -0,0 +1 @@
- fix(providers): send `x-api-key` instead of `Authorization: Bearer` for OpenCode Zen's `/v1/responses` endpoint (Muse Spark Contributor models), fixing a 401 on OmniRoute's auth header (#12633)

View File

@@ -0,0 +1 @@
- fix(models): declare the real ~1M contextLength for OpenCode Zen's Muse Spark 1.2 models instead of falling back to the 200000 provider default (#12681)

View File

@@ -1 +0,0 @@
- fix(cache): fold tool_choice/tools/response_format into the semantic cache signature so a cached tool_calls response can no longer be replayed for a request whose tool policy forbids it (#12734)

View File

@@ -30,17 +30,25 @@ export const opencodeProvider: RegistryEntry = {
// content (see issue #10867). The opencode provider is passthrough, so
// declaring them here only sets the wire format / capability flags — the
// live upstream model list already advertises both ids.
// #12681: real window confirmed against the opencode-go registry's own
// muse-spark-1.2-contributor entries (contextLength: 1048576, maxOutputTokens:
// 131072) — without an explicit value here resolution fell back to the
// provider-wide defaultContextLength (200000), understating the real window.
{
id: "muse-spark-1.2",
name: "Muse Spark 1.2",
supportsReasoning: true,
targetFormat: "openai-responses",
contextLength: 1048576,
maxOutputTokens: 131072,
},
{
id: "muse-spark-1.2-contributor-free",
name: "Muse Spark 1.2 Contributor Free",
supportsReasoning: true,
targetFormat: "openai-responses",
contextLength: 1048576,
maxOutputTokens: 131072,
},
{ id: "deepseek-v4-flash-free", name: "DeepSeek V4 Flash Free", supportsReasoning: true },
// #6998: 2026-07-14 refresh — the upstream free tier rotated its lineup;

View File

@@ -63,11 +63,17 @@ export const opencode_zenProvider: RegistryEntry = {
// targetFormat declaration, so requests routed here still hit
// /chat/completions with a mismatched or unanswerable body and the
// upstream returns an empty message.
// #12681: real window confirmed against the opencode-go registry's own
// muse-spark-1.2-contributor entries (contextLength: 1048576, maxOutputTokens:
// 131072) — without an explicit value here resolution fell back to the
// provider-wide defaultContextLength (200000), understating the real window.
{
id: "muse-spark-1.2",
name: "Muse Spark 1.2",
supportsReasoning: true,
targetFormat: "openai-responses",
contextLength: 1048576,
maxOutputTokens: 131072,
},
// Explicit wire-format overlay of the base opencode provider's muse-spark entry
// (targetFormat: openai-responses). Keep in sync with base on catalog syncs.
@@ -76,6 +82,8 @@ export const opencode_zenProvider: RegistryEntry = {
name: "Muse Spark 1.2 Contributor Free",
supportsReasoning: true,
targetFormat: "openai-responses",
contextLength: 1048576,
maxOutputTokens: 131072,
},
// ── DeepSeek ────────────────────────────────────────────────

View File

@@ -31,6 +31,13 @@ import {
import { isOpencodeGeoBlocked, proxyKeyOf } from "./opencodeGeoBlock.ts";
import { isNetworkRotationSharedEgressGuardEnabled } from "@/shared/utils/featureFlags";
/**
* The main OpenCode Zen host, shared by the `opencode` and `opencode-zen`
* registry entries. Used to scope the `x-api-key` auth override (#12633) away
* from `opencode-go`, which serves a different upstream (`.../zen/go/v1`).
*/
const ZEN_BASE_URL = "https://opencode.ai/zen/v1";
/**
* Per-account proxy configuration, persisted by NoAuthAccountCard under
* `providerSpecificData.accountProxies` (keyed by the account id, which the UI
@@ -776,6 +783,20 @@ export class OpencodeExecutor extends BaseExecutor {
}
}
/**
* #12633: OpenCode Zen's `/v1/responses` endpoint (reached when
* `_requestFormat === "openai-responses"`, e.g. Muse Spark Contributor
* models) requires `x-api-key`, not `Authorization: Bearer` — unlike the
* default `/chat/completions` endpoint on the same host, which accepts
* Bearer. Scoped by baseUrl (not provider id/alias) so this only applies to
* the main Zen host (`opencode` / `opencode-zen`, both `https://opencode.ai/zen/v1`)
* and never to opencode-go, which serves Responses-format models from a
* different upstream (`https://opencode.ai/zen/go/v1`) that expects Bearer.
*/
private usesZenApiKeyAuth(): boolean {
return this._requestFormat === "openai-responses" && this.config?.baseUrl === ZEN_BASE_URL;
}
buildHeaders(
credentials: ProviderCredentials | null,
stream = true,
@@ -792,7 +813,7 @@ export class OpencodeExecutor extends BaseExecutor {
: undefined;
if (key) {
if (this._requestFormat === "claude") {
if (this._requestFormat === "claude" || this.usesZenApiKeyAuth()) {
headers["x-api-key"] = key;
} else {
headers["Authorization"] = `Bearer ${key}`;

View File

@@ -29,13 +29,7 @@ export async function checkSemanticCache({
semanticCacheEnabled: boolean;
// Only the fields this read path actually touches are named; everything else
// on the request body stays `unknown` via the index signature.
body: Record<string, unknown> & {
temperature?: number;
top_p?: number;
tool_choice?: unknown;
tools?: unknown;
response_format?: unknown;
};
body: Record<string, unknown> & { temperature?: number; top_p?: number };
clientRawRequest: { headers?: unknown } | null;
model: string;
provider: string;
@@ -57,8 +51,7 @@ export async function checkSemanticCache({
body.messages ?? body.input,
body.temperature,
body.top_p,
apiKeyId ?? undefined,
{ toolChoice: body.tool_choice, tools: body.tools, responseFormat: body.response_format }
apiKeyId ?? undefined
);
const cached = getCachedResponse(signature);
if (cached) {

View File

@@ -22,9 +22,6 @@ type CacheBody = {
input?: unknown;
temperature?: number;
top_p?: number;
tool_choice?: unknown;
tools?: unknown;
response_format?: unknown;
};
type UsageLike = { prompt_tokens?: number; completion_tokens?: number } | null | undefined;
@@ -68,12 +65,7 @@ export function storeSemanticCacheResponse(
args.body.messages ?? args.body.input,
args.body.temperature,
args.body.top_p,
args.apiKeyId ?? undefined,
{
toolChoice: args.body.tool_choice,
tools: args.body.tools,
responseFormat: args.body.response_format,
}
args.apiKeyId ?? undefined
);
const tokensSaved = args.usage?.prompt_tokens + args.usage?.completion_tokens || 0;
deps.setCachedResponse(signature, args.model, args.translatedResponse, tokensSaved);

View File

@@ -23,9 +23,6 @@ type CacheBody = {
input?: unknown;
temperature?: number;
top_p?: number;
tool_choice?: unknown;
tools?: unknown;
response_format?: unknown;
};
export interface StreamingSemanticCacheStoreDeps {
@@ -72,12 +69,7 @@ function writeStreamingCacheEntry(
args.body.messages ?? args.body.input,
args.body.temperature,
args.body.top_p,
args.apiKeyId ?? undefined,
{
toolChoice: args.body.tool_choice,
tools: args.body.tools,
responseFormat: args.body.response_format,
}
args.apiKeyId ?? undefined
);
const tokensSaved = streamTokensSaved(args.streamUsage);
deps.setCachedResponse(sig, args.model, cleanBody, tokensSaved);

View File

@@ -137,43 +137,6 @@ export function clearMemoryCache(): void {
// ─── Signature Generation ─────────────────
/**
* Behavior-changing generation constraints that MUST be folded into the cache signature
* (#12734). Without these, a cached response produced under one `tool_choice`/`tools`/
* `response_format` could be replayed for a later request that forbids or changes that
* behavior (e.g. a cached `tool_calls` response served to a `tool_choice: "none"` request).
*/
export interface SignatureConstraints {
toolChoice?: unknown;
tools?: unknown;
responseFormat?: unknown;
}
/** Normalize a single tool definition, keeping only the fields that define its policy. */
function normalizeTool(tool: unknown): unknown {
const record = asRecord(tool);
const fn = asRecord(record.function);
if (Object.keys(fn).length === 0 && Object.keys(record).length === 0) return tool;
return {
type: typeof record.type === "string" ? record.type : "function",
function: {
name: fn.name,
description: fn.description,
parameters: fn.parameters,
},
};
}
/**
* Normalize `tools` for consistent hashing (mirrors `normalizeConversation` for messages):
* strips volatile/irrelevant fields while keeping name/description/parameters, which are
* what actually define the tool policy a cached response was generated under.
*/
function normalizeTools(tools: unknown): unknown {
if (!Array.isArray(tools) || tools.length === 0) return undefined;
return tools.map(normalizeTool);
}
/**
* Generate deterministic cache signature from request params.
* @param {string} model
@@ -181,8 +144,6 @@ function normalizeTools(tools: unknown): unknown {
* @param {number} temperature
* @param {number} topP
* @param {string} [apiKeyId] - API key ID for per-key isolation (prevents cross-user cache hits)
* @param {SignatureConstraints} [constraints] - tool_choice/tools/response_format (#12734):
* these change model behavior and must not collide with a signature computed without them.
* @returns {string} hex signature
*/
export function generateSignature(
@@ -190,17 +151,13 @@ export function generateSignature(
conversation,
temperature = 0,
topP = 1,
apiKeyId?: string,
constraints?: SignatureConstraints
apiKeyId?: string
) {
const payload = JSON.stringify({
model,
messages: normalizeConversation(conversation),
temperature,
top_p: topP,
tool_choice: constraints?.toolChoice,
tools: normalizeTools(constraints?.tools),
response_format: constraints?.responseFormat,
});
const digest = crypto.createHash("sha256").update(payload).digest("hex");
// Per-key cache isolation (#3740) namespaces the signature with the apiKeyId as a

View File

@@ -135,38 +135,3 @@ test("missing usage → tokensSaved coerces to 0 (NaN || 0)", () => {
storeSemanticCacheResponse(baseArgs({ usage: undefined }), deps);
assert.equal(stored[0].tokens, 0);
});
// #12734: tool_choice/tools/response_format must reach generateSignature so a cached
// tool_calls response cannot be replayed under a stricter tool policy.
test("signature is called with tool_choice/tools/response_format from body (#12734)", () => {
let captured: unknown[] = [];
const { deps } = makeDeps({
generateSignature: (...a: unknown[]) => {
captured = a;
return "sig";
},
});
const tools = [{ type: "function", function: { name: "get_weather" } }];
storeSemanticCacheResponse(
baseArgs({
body: {
messages: [{ role: "user", content: "hi" }],
temperature: 0,
top_p: 1,
tool_choice: "none",
tools,
response_format: { type: "json_object" },
},
}),
deps
);
// args: (model, messages ?? input, temperature, top_p, apiKeyId, constraints)
const constraints = captured[5] as {
toolChoice: unknown;
tools: unknown;
responseFormat: unknown;
};
assert.equal(constraints.toolChoice, "none");
assert.deepEqual(constraints.tools, tools);
assert.deepEqual(constraints.responseFormat, { type: "json_object" });
});

View File

@@ -180,14 +180,12 @@ function makeHitArgs(overrides: Record<string, unknown> = {}) {
// Seed the cache under the EXACT signature checkSemanticCache rebuilds for `args`.
function seedHit(args: ReturnType<typeof makeHitArgs>["args"], response: unknown) {
const body = args.body as Record<string, unknown>;
const signature = generateSignature(
args.model,
body.messages ?? body.input,
args.body.messages ?? (args.body as Record<string, unknown>).input,
args.body.temperature,
body.top_p,
args.apiKeyId ?? undefined,
{ toolChoice: body.tool_choice, tools: body.tools, responseFormat: body.response_format }
(args.body as Record<string, unknown>).top_p,
args.apiKeyId ?? undefined
);
setCachedResponse(signature, args.model, response);
return signature;
@@ -494,76 +492,3 @@ test("checkSemanticCache HIT includes X-OmniRoute-Cache-Latency: synthetic heade
"HIT response carries X-OmniRoute-Cache-Latency: synthetic marker"
);
});
// ─── tool_choice / tools / response_format must be part of the signature (#12734) ────────────
test("#12734: cached tool_calls response must NOT be replayed for tool_choice: 'none'", async () => {
clearCache();
const messages = [{ role: "user", content: "what is 2+2?" }];
const toolCallResponse = {
id: "chatcmpl-tool-calls",
choices: [
{
index: 0,
finish_reason: "tool_calls",
message: {
role: "assistant",
content: null,
tool_calls: [
{ id: "call_1", type: "function", function: { name: "memory_search", arguments: "{}" } },
],
},
},
],
usage: { prompt_tokens: 10, completion_tokens: 5, total_tokens: 15 },
};
// Stored under a body with NO tool_choice (mirrors the real pipeline: the cache check
// runs before memory/skill tool injection, so the signature it stores under never saw
// tool_choice at all).
const { args: storeArgs } = makeHitArgs({ body: { model: "gpt-4o", messages, temperature: 0 } });
seedHit(storeArgs, toolCallResponse);
const { args: forbidArgs } = makeHitArgs({
body: { model: "gpt-4o", messages, temperature: 0, tool_choice: "none" },
});
const result = await checkSemanticCache(forbidArgs as Parameters<typeof checkSemanticCache>[0]);
assert.equal(
result,
null,
"a tool_choice:'none' request must be a cache MISS against a tool_calls response cached without tool_choice"
);
});
test("#12734: identical tool_choice/tools/response_format across requests still HITs", async () => {
clearCache();
const messages = [{ role: "user", content: "what is the weather?" }];
const tools = [
{
type: "function",
function: { name: "get_weather", description: "Get the weather", parameters: { type: "object" } },
},
];
const cached = {
id: "chatcmpl-tool-config-hit",
choices: [
{ index: 0, message: { role: "assistant", content: "sunny" }, finish_reason: "stop" },
],
usage: { prompt_tokens: 8, completion_tokens: 2, total_tokens: 10 },
};
const body = {
model: "gpt-4o",
messages,
temperature: 0,
tool_choice: "auto",
tools,
response_format: { type: "json_object" },
};
const { args: storeArgs } = makeHitArgs({ body });
seedHit(storeArgs, cached);
const { args: readArgs } = makeHitArgs({ body: { ...body } });
const result = await checkSemanticCache(readArgs as Parameters<typeof checkSemanticCache>[0]);
assert.ok(result, "identical tool_choice/tools/response_format must still HIT");
});

View File

@@ -127,38 +127,3 @@ test("a throwing dep is swallowed (fail-open, non-critical)", () => {
});
assert.doesNotThrow(() => storeStreamingSemanticCacheResponse(baseArgs(), deps));
});
// #12734: tool_choice/tools/response_format must reach generateSignature so a cached
// tool_calls streaming response cannot be replayed under a stricter tool policy.
test("signature is called with tool_choice/tools/response_format from body (#12734)", () => {
let captured: unknown[] = [];
const { deps } = makeDeps({
generateSignature: (...a: unknown[]) => {
captured = a;
return "sig";
},
});
const tools = [{ type: "function", function: { name: "get_weather" } }];
storeStreamingSemanticCacheResponse(
baseArgs({
body: {
messages: [{ role: "user", content: "hi" }],
temperature: 0,
top_p: 1,
tool_choice: "none",
tools,
response_format: { type: "json_object" },
},
}),
deps
);
// args: (model, messages ?? input, temperature, top_p, apiKeyId, constraints)
const constraints = captured[5] as {
toolChoice: unknown;
tools: unknown;
responseFormat: unknown;
};
assert.equal(constraints.toolChoice, "none");
assert.deepEqual(constraints.tools, tools);
assert.deepEqual(constraints.responseFormat, { type: "json_object" });
});

View File

@@ -0,0 +1,54 @@
import test from "node:test";
import assert from "node:assert/strict";
import { OpencodeExecutor } from "../../open-sse/executors/opencode.ts";
test("#12633: openai-responses format on opencode-zen sends x-api-key, not Authorization Bearer", () => {
const executor = new OpencodeExecutor("opencode-zen");
executor._requestFormat = "openai-responses";
const headers = executor.buildHeaders(
{ apiKey: "sk-zen-test" },
true,
null,
"muse-spark-1.2-contributor-free"
);
assert.equal(headers["x-api-key"], "sk-zen-test");
assert.equal(headers["Authorization"], undefined);
});
test("#12633: openai-responses format on the base opencode (oc) provider also sends x-api-key", () => {
const executor = new OpencodeExecutor("opencode");
executor._requestFormat = "openai-responses";
const headers = executor.buildHeaders(
{ apiKey: "sk-oc-test" },
true,
null,
"muse-spark-1.2-contributor-free"
);
assert.equal(headers["x-api-key"], "sk-oc-test");
assert.equal(headers["Authorization"], undefined);
});
test("#12633: openai-responses format on opencode-go (different upstream endpoint) keeps Authorization Bearer", () => {
const executor = new OpencodeExecutor("opencode-go");
executor._requestFormat = "openai-responses";
const headers = executor.buildHeaders(
{ apiKey: "sk-go-test" },
true,
null,
"muse-spark-1.2-contributor"
);
assert.equal(headers["Authorization"], "Bearer sk-go-test");
assert.equal(headers["x-api-key"], undefined);
});
test("#12633: claude format keeps sending x-api-key (unchanged behavior)", () => {
const executor = new OpencodeExecutor("opencode-zen");
executor._requestFormat = "claude";
const headers = executor.buildHeaders({ apiKey: "sk-claude-test" }, true, null, "some-model");
assert.equal(headers["x-api-key"], "sk-claude-test");
assert.equal(headers["Authorization"], undefined);
});

View File

@@ -0,0 +1,33 @@
import { test } from "node:test";
import assert from "node:assert/strict";
import { REGISTRY } from "../../open-sse/config/providerRegistry.ts";
import { getTokenLimit } from "../../open-sse/services/contextManager.ts";
test("#12681: opencode registry declares an explicit real contextLength for muse-spark-1.2 models", () => {
const opencode = REGISTRY["opencode"];
const museSpark = opencode.models.find((m) => m.id === "muse-spark-1.2");
const museSparkFree = opencode.models.find((m) => m.id === "muse-spark-1.2-contributor-free");
assert.notEqual(
museSpark?.contextLength,
undefined,
"muse-spark-1.2 should declare its own real contextLength instead of relying on the 200000 provider default"
);
assert.notEqual(
museSparkFree?.contextLength,
undefined,
"muse-spark-1.2-contributor-free should declare its own real contextLength instead of relying on the 200000 provider default"
);
});
test("#12681: opencode-zen registry declares an explicit real contextLength for muse-spark-1.2 models", () => {
const zen = REGISTRY["opencode-zen"];
const museSpark = zen.models.find((m) => m.id === "muse-spark-1.2");
const museSparkFree = zen.models.find((m) => m.id === "muse-spark-1.2-contributor-free");
assert.notEqual(museSpark?.contextLength, undefined);
assert.notEqual(museSparkFree?.contextLength, undefined);
});
test("#12681: contextManager.getTokenLimit resolves muse-spark-1.2-contributor-free to its real 1M+ window, not the 200000 provider default", () => {
assert.equal(getTokenLimit("opencode", "muse-spark-1.2-contributor-free"), 1048576);
assert.equal(getTokenLimit("opencode-zen", "muse-spark-1.2-contributor-free"), 1048576);
});

View File

@@ -107,81 +107,6 @@ describe("Semantic Cache", () => {
const sigKeyless = generateSignature("gpt-4o", messages, 0, 1, undefined);
assert.notEqual(sigKeyed, sigKeyless);
});
// #12734: tool_choice/tools/response_format change model behavior and must not be
// ignored by the signature — otherwise a cached tool_calls response can be replayed
// for a request whose tool policy forbids it.
describe("tool_choice / tools / response_format (#12734)", () => {
const messages = [{ role: "user", content: "what is 2+2?" }];
it("generates different signatures for different tool_choice ('auto' vs 'none')", () => {
const sig1 = generateSignature("gpt-4o", messages, 0, 1, undefined, {
toolChoice: "auto",
});
const sig2 = generateSignature("gpt-4o", messages, 0, 1, undefined, {
toolChoice: "none",
});
assert.notEqual(sig1, sig2);
});
it("generates different signatures for a forced-function tool_choice", () => {
const sig1 = generateSignature("gpt-4o", messages, 0, 1, undefined, {
toolChoice: "auto",
});
const sig2 = generateSignature("gpt-4o", messages, 0, 1, undefined, {
toolChoice: { type: "function", function: { name: "get_weather" } },
});
assert.notEqual(sig1, sig2);
});
it("generates different signatures for no tool_choice vs an explicit one (the #12734 collision)", () => {
const sigNoToolChoice = generateSignature("gpt-4o", messages, 0, 1);
const sigWithToolChoice = generateSignature("gpt-4o", messages, 0, 1, undefined, {
toolChoice: "none",
});
assert.notEqual(sigNoToolChoice, sigWithToolChoice);
});
it("generates different signatures for different tools arrays", () => {
const tools1 = [{ type: "function", function: { name: "get_weather", parameters: {} } }];
const tools2 = [{ type: "function", function: { name: "get_stock_price", parameters: {} } }];
const sig1 = generateSignature("gpt-4o", messages, 0, 1, undefined, { tools: tools1 });
const sig2 = generateSignature("gpt-4o", messages, 0, 1, undefined, { tools: tools2 });
assert.notEqual(sig1, sig2);
});
it("generates different signatures for different response_format", () => {
const sig1 = generateSignature("gpt-4o", messages, 0, 1, undefined, {
responseFormat: { type: "text" },
});
const sig2 = generateSignature("gpt-4o", messages, 0, 1, undefined, {
responseFormat: { type: "json_object" },
});
assert.notEqual(sig1, sig2);
});
it("generates identical signatures when constraints are identical (no hit-rate regression)", () => {
const tools = [{ type: "function", function: { name: "get_weather", parameters: {} } }];
const constraints = {
toolChoice: "auto",
tools,
responseFormat: { type: "json_object" },
};
const sig1 = generateSignature("gpt-4o", messages, 0, 1, undefined, constraints);
const sig2 = generateSignature("gpt-4o", messages, 0, 1, undefined, {
toolChoice: "auto",
tools: [{ type: "function", function: { name: "get_weather", parameters: {} } }],
responseFormat: { type: "json_object" },
});
assert.equal(sig1, sig2);
});
it("generates identical signatures for omitted constraints vs an explicitly empty constraints object", () => {
const sig1 = generateSignature("gpt-4o", messages, 0, 1, undefined);
const sig2 = generateSignature("gpt-4o", messages, 0, 1, undefined, {});
assert.equal(sig1, sig2);
});
});
});
describe("isCacheableForRead", () => {