fix(opencode-go): isolate sessionless requests with request-scoped affinity

docs-site/src/content/docs/reference/configuration/providers.md

@@ -949,6 +949,17 @@ receive the default only when the setting is absent; custom renamed entries keep
 value and do not acquire this default by destination matching. Chat model routes keep their
 existing protocol. The stateless flag does not force Responses streaming into JSON.
 
+## OpenCode Go session affinity
+
+Requests routed to OpenCode Go destinations carry session affinity via the `x-opencode-session` header:
+
+- Operator configuration: if the provider configuration specifies `x-opencode-session`, that value is preserved verbatim.
+- Client request header: if an incoming request provides `x-opencode-session`, it is treated as client session identity and derived into a canonical `ocx_<hash>` session id.
+- Real conversation identity: when an incoming request carries conversation metadata, `conversation_id`, or `parent_message_id`, OpenCodex derives a stable conversation-scoped session lane.
+- Sessionless requests: requests without conversation identity (such as capability probes or standalone requests) receive an isolated, request-scoped ephemeral session lane allocated once per request lifecycle. This ephemeral identity remains stable across route retries, policy fallback attempts, and internal request fanout (such as Claude translation or compaction), preventing missing-header 400 errors while avoiding session collision between concurrent requests.
+
+Non-Go destinations remain unaffected and do not receive the session header.
+
 ## OpenCode Go reasoning efforts
 
 Go catalog rows preserve their configured reasoning efforts exactly, including during

src/providers/opencode-go-transport.ts

@@ -1,4 +1,4 @@
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import type { OcxProviderConfig } from "../types";
 import { registryEntryForProviderDestination } from "./registry";
 
@@ -22,20 +22,27 @@ export function deriveOpenCodeGoSessionId(sessionLane: string): string {
   return `ocx_${digest}`;
 }
 
-/** Add per-conversation Go affinity only to the canonical fixed-key destination. */
+/**
+ * Add per-conversation Go affinity only to the canonical fixed-key destination.
+ *
+ * When an explicit or WeakMap-allocated session lane is provided, it is hashed into
+ * a stable session id. If an unlinked caller passes undefined, randomUUID() serves
+ * as a standalone fallback to satisfy Console Go header requirements without asserting
+ * cross-request stability.
+ */
 export function resolveOpenCodeGoTransport<T extends OcxProviderConfig>(
   provider: T,
   sessionLane: string | undefined,
 ): T {
   if (registryEntryForProviderDestination(provider)?.id !== "opencode-go") return provider;
-  if (!sessionLane) return provider;
+  const effectiveLane = sessionLane || randomUUID();
   if (hasHeaderCaseInsensitive(provider.headers, OPENCODE_GO_SESSION_HEADER)) return provider;
 
   return {
     ...provider,
     headers: {
       ...(provider.headers ?? {}),
-      [OPENCODE_GO_SESSION_HEADER]: deriveOpenCodeGoSessionId(sessionLane),
+      [OPENCODE_GO_SESSION_HEADER]: deriveOpenCodeGoSessionId(effectiveLane),
     },
   };
 }

src/server/chat-completions.ts

@@ -26,7 +26,7 @@ import { NoEligiblePolicyCandidateError, UnknownRoutingPolicyError, routeModel }
 import { evidenceFromBody } from "../routing/request-evidence";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
 import { resolveOpenCodeGoTransport } from "../providers/opencode-go-transport";
-import { normalizeLogConversationId, sessionLaneIdFromRequest } from "./request-log-conversation";
+import { getOrAllocateRequestSessionLane, linkRequestSessionLane, normalizeLogConversationId, sessionLaneIdFromRequest } from "./request-log-conversation";
 import type { OcxConfig } from "../types";
 import { readJsonRequestBody, resolveInboundBodyLimitBytes } from "./request-decompress";
 import {
@@ -143,7 +143,7 @@ async function handleChatCompletionsWithBudget(
   try {
     const route = routeModel(config, chatBody.model as string, evidenceFromBody(chatBody));
     route.provider = resolveOpenCodeGoTransport(route.provider,
-      sessionLaneIdFromRequest(req.headers) ?? normalizeLogConversationId(req.headers.get("x-opencode-session")));
+      getOrAllocateRequestSessionLane(req));
     // Settle the wire once so every branch below reads the adapter this model will
     // actually use, not the provider-wide default (#404).
     route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, "chat");
@@ -305,6 +305,7 @@ async function handleChatCompletionsWithBudget(
     headers,
     body: internalBodyJson,
   });
+  linkRequestSessionLane(req, internalReq);
 
   let nativeLogged = false;
   const finalizeNativeLog = (status: number, meta: { terminalStatus?: RequestLogEntry["terminalStatus"]; closeReason: "terminal" | "client_cancel" | "non_stream" }) => {

src/server/claude-messages.ts

@@ -36,7 +36,7 @@ import { resolveWireProtocolOverride } from "./adapter-resolve";
 import type { OcxConfig } from "../types";
 import { readJsonRequestBody, resolveInboundBodyLimitBytes } from "./request-decompress";
 import { addFinalRequestLog, httpStatusForRequestLogTerminal, recordFirstOutput, type RequestLogContext, type RequestLogEntry } from "./request-log";
-import { conversationIdFromClaudeMetadata, normalizeLogConversationId, sessionLaneIdFromRequest } from "./request-log-conversation";
+import { conversationIdFromClaudeMetadata, linkRequestSessionLane, normalizeLogConversationId, sessionLaneIdFromRequest } from "./request-log-conversation";
 import { responseWithDeferredRequestLog } from "./relay";
 import { handleResponses } from "./responses";
 import {
@@ -897,6 +897,7 @@ async function handleClaudeMessagesWithBudget(
         headers,
         body: JSON.stringify(internalBody),
       });
+      linkRequestSessionLane(req, internalReq);
     } finally {
       reservation.release();
     }

src/server/request-log-conversation.ts

@@ -2,7 +2,7 @@
  * Best-effort chat/session correlation for Logs / usage.jsonl (#330).
  * Opaque ids only — never persist raw emails or Claude Desktop system-hash fallbacks.
  */
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 
 /** Reject absurdly long client strings before hashing (DoS / JSONL bloat). */
 export const LOG_CONVERSATION_ID_INPUT_MAX = 4096;
@@ -217,3 +217,32 @@ export function summarizeConversationLogs(entries: readonly TotalsSource[]): Con
     unmeteredRequests,
   };
 }
+
+const requestAllocatedSessionLanes = new WeakMap<Request, string>();
+
+/**
+ * Link session lane identity from a source Request to an internal/child Request.
+ * Preserves ephemeral allocated lanes across internal request translation/fanout.
+ */
+export function linkRequestSessionLane(sourceReq: Request, targetReq: Request): void {
+  const lane = getOrAllocateRequestSessionLane(sourceReq);
+  requestAllocatedSessionLanes.set(targetReq, lane);
+}
+
+/**
+ * Resolve or allocate a request-scoped session lane identity.
+ * If the request has an explicit session lane (headers or x-opencode-session), use it.
+ * Otherwise, allocates an ephemeral UUID once per admitted request, retained across retries.
+ */
+export function getOrAllocateRequestSessionLane(req: Request): string {
+  const explicit = sessionLaneIdFromRequest(req.headers)
+    ?? normalizeLogConversationId(req.headers.get("x-opencode-session"));
+  if (explicit) return explicit;
+
+  let allocated = requestAllocatedSessionLanes.get(req);
+  if (!allocated) {
+    allocated = randomUUID();
+    requestAllocatedSessionLanes.set(req, allocated);
+  }
+  return allocated;
+}

src/server/responses/compact.ts

@@ -157,7 +157,7 @@ import {
 } from "./core";
 import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, safeOriginLabel } from "./fetch-helpers";
 import { mapCodexAuthContextErrorToResponse, nativeMainRefreshFailureResponse } from "./codex-auth-error";
-import { sessionLaneIdFromRequest } from "../request-log-conversation";
+import { linkRequestSessionLane, sessionLaneIdFromRequest } from "../request-log-conversation";
 import { recallComboForLane } from "./combo-session-recall";
 
 export const COMPACT_RESPONSE_MAX_BYTES = 32 * 1024 * 1024;
@@ -1101,6 +1101,7 @@ export async function handleResponsesCompact(
           body: JSON.stringify({ ...raw, model: fallbackModel }),
           signal: req.signal,
         });
+        linkRequestSessionLane(req, fallbackReq);
         try {
           const fallback = await handleResponsesCompact(
             fallbackReq,
@@ -1149,6 +1150,7 @@ export async function handleResponsesCompact(
     headers: internalHeaders,
     body: JSON.stringify(internalBody),
   });
+  linkRequestSessionLane(req, internalReq);
   const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal, turnAdmissionLease, ...(admission ? { admission } : {}) });
   if (!response.ok) return response;
   let json: { output?: unknown[]; status?: unknown; error?: unknown };

src/server/responses/core.ts

@@ -322,6 +322,8 @@ import {
   conversationIdFromResponsesRequest,
   normalizeLogConversationId,
   reasoningReplayConversationIdFromResponsesRequest,
+  getOrAllocateRequestSessionLane,
+  linkRequestSessionLane,
   sessionLaneIdFromRequest,
   sessionIdHeaderFromRequest,
 } from "../request-log-conversation";
@@ -2452,7 +2454,7 @@ async function applyFinalRouteRequestNormalization(args: {
   // Settle the wire once so logging, fast-mode, auth, and sidecars read the adapter
   // this request will actually use (#404).
   route.provider = resolveOpenCodeGoTransport(route.provider,
-    sessionLaneIdFromRequest(req.headers) ?? normalizeLogConversationId(req.headers.get("x-opencode-session")));
+    getOrAllocateRequestSessionLane(req));
   route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire);
   if (preserveAnthropicResponseModel) parsed._responseModelId = responseModelId;
   logCtx.model = route.modelId;
@@ -2816,6 +2818,7 @@ export async function handleComboResponses(
       headers: childHeaders,
       body: JSON.stringify(childBody),
     });
+    linkRequestSessionLane(req, childRequest);
     let resolvedAuth: CodexAuthContext | undefined;
     let terminalRecorder: ((status: ResponsesTerminalStatus, httpStatusOverride?: number) => void) | undefined;
     const started = Date.now();

src/server/responses/policy-fallback.ts

@@ -8,6 +8,7 @@ import { handleResponses as handleResponsesCore } from "./core";
 import { requestPacingOverloadResponse } from "./pacing-overload";
 import { captureExplicitOpenAiCallerAuth } from "../../providers/openai-sidecar";
 import { captureCallerDirectAuth } from "../../providers/caller-authorization";
+import { linkRequestSessionLane } from "../request-log-conversation";
 
 type CoreHandler = typeof handleResponsesCore;
 type CoreOptions = Parameters<CoreHandler>[3];
@@ -56,12 +57,14 @@ function requestWithCandidate(
   headers.delete("content-encoding");
   headers.delete("content-length");
   headers.set("content-type", "application/json");
-  return new Request(req.url, {
+  const retryRequest = new Request(req.url, {
     method: req.method,
     headers,
     body: JSON.stringify({ ...rawBody, model: `${candidate.provider}/${candidate.model}` }),
     signal: req.signal,
   });
+  linkRequestSessionLane(req, retryRequest);
+  return retryRequest;
 }
 
 function errorCodeFromText(text: string): string | undefined {