Keep OpenCode worker model selection separate from the default

src/main/global-fetch-call-site-audit.test.ts

@@ -22,6 +22,8 @@ const AUDITED_GLOBAL_FETCH_LINES = new Map<string, number>([
   ['main/gitea/client.ts', 1],
   // Generated OpenCode claim source consumes JSON or cancels its body in finally.
   ['main/opencode/opencode-startup-prompt-source.ts', 1],
+  // Authenticated loopback preflight consumes bounded JSON and cancels every body in finally.
+  ['main/opencode/opencode-launch-model-context.ts', 1],
   ['main/orca-profiles/profile-cloud-client.ts', 1],
   ['main/orca-profiles/profile-cloud-org-members-client.ts', 1],
   ['main/rate-limits/codex-fetcher.ts', 3],

src/main/opencode/opencode-launch-model-config.test.ts

@@ -0,0 +1,76 @@
+import { describe, expect, it } from 'vitest'
+import { resolveOpenCodeLaunchModelConfig } from './opencode-launch-model-config'
+
+describe('per-launch OpenCode model config', () => {
+  it('retains credentials, permissions and other agents while overriding the resolved primary model', () => {
+    const original = {
+      model: 'provider/old',
+      default_agent: 'reviewer',
+      providers: {
+        custom: { apiKey: 'placeholder-key', models: { preferred: { name: 'Preferred' } } }
+      },
+      permissions: [{ tool: 'shell', action: 'ask' }],
+      agents: {
+        reviewer: { model: 'provider/agent-old', system: 'Review only', permissions: [] },
+        build: { model: 'provider/build', steps: 5 },
+        nested: { mode: 'subagent', model: 'provider/nested' }
+      }
+    }
+    const configContent = JSON.stringify(original)
+    const merged = resolveOpenCodeLaunchModelConfig({
+      configContent,
+      primaryAgent: 'reviewer',
+      model: 'provider/preferred'
+    })
+    expect(merged).not.toBeNull()
+    expect(JSON.parse(merged ?? 'null')).toEqual({
+      ...original,
+      model: 'provider/preferred',
+      agents: {
+        ...original.agents,
+        reviewer: { ...original.agents.reviewer, model: 'provider/preferred' }
+      }
+    })
+    expect(configContent).toBe(JSON.stringify(original))
+  })
+
+  it('adds an override for the externally resolved built-in primary agent without guessing its name', () => {
+    expect(
+      resolveOpenCodeLaunchModelConfig({
+        configContent: undefined,
+        primaryAgent: 'plan',
+        model: 'provider/preferred'
+      })
+    ).toBe('{"model":"provider/preferred","agents":{"plan":{"model":"provider/preferred"}}}')
+  })
+
+  it.each(['{', 'null', '[]', '{"agents":[]}', '{"agents":{"build":null}}'])(
+    'refuses malformed inline config %s',
+    (configContent) => {
+      expect(
+        resolveOpenCodeLaunchModelConfig({
+          configContent,
+          primaryAgent: 'build',
+          model: 'provider/a'
+        })
+      ).toBeNull()
+    }
+  )
+
+  it('refuses oversized config and absent resolved preferences', () => {
+    expect(
+      resolveOpenCodeLaunchModelConfig({
+        configContent: ' '.repeat(1_048_577),
+        primaryAgent: 'build',
+        model: 'provider/a'
+      })
+    ).toBeNull()
+    expect(
+      resolveOpenCodeLaunchModelConfig({
+        configContent: '{}',
+        primaryAgent: '',
+        model: 'provider/a'
+      })
+    ).toBeNull()
+  })
+})

src/main/opencode/opencode-launch-model-config.ts

@@ -0,0 +1,33 @@
+import { z } from 'zod'
+
+const launchConfig = z
+  .object({ agents: z.record(z.string(), z.record(z.string(), z.unknown())).optional() })
+  .passthrough()
+
+export function resolveOpenCodeLaunchModelConfig(options: {
+  configContent: string | undefined
+  primaryAgent: string
+  model: string
+}): string | null {
+  if (!options.primaryAgent || !options.model || (options.configContent?.length ?? 0) > 1_048_576) {
+    return null
+  }
+  try {
+    const raw: unknown = options.configContent?.trim() ? JSON.parse(options.configContent) : {}
+    const parsed = launchConfig.safeParse(raw)
+    if (!parsed.success) {
+      return null
+    }
+    const config = parsed.data
+    return JSON.stringify({
+      ...config,
+      model: options.model,
+      agents: {
+        ...config.agents,
+        [options.primaryAgent]: { ...config.agents?.[options.primaryAgent], model: options.model }
+      }
+    })
+  } catch {
+    return null
+  }
+}

src/main/opencode/opencode-launch-model-context-cleanup.test.ts

@@ -0,0 +1,137 @@
+import { z } from 'zod'
+import { ChildProcess } from 'node:child_process'
+import { PassThrough } from 'node:stream'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { spawnProcess } from '../../shared/child-process/run-process'
+import {
+  forceTerminateProcessTree,
+  signalProcessTree
+} from '../../shared/child-process/process-tree-termination'
+import { probeOpenCodeLaunchModelContext } from './opencode-launch-model-context'
+import { readFetchResponseJsonWithinLimit } from '../../shared/fetch-response-body'
+
+vi.mock('../../shared/child-process/run-process', () => ({ spawnProcess: vi.fn() }))
+vi.mock('../../shared/child-process/process-tree-termination', () => ({
+  signalProcessTree: vi.fn(),
+  forceTerminateProcessTree: vi.fn()
+}))
+
+vi.mock('../../shared/fetch-response-body', () => ({ readFetchResponseJsonWithinLimit: vi.fn() }))
+
+class ProbeChild extends ChildProcess {
+  override stdin = new PassThrough()
+  override stdout = new PassThrough()
+  override stderr = new PassThrough()
+  override pid = 123456
+  override exitCode: number | null = null
+  override stdio: [PassThrough, PassThrough, PassThrough, undefined, undefined] = [
+    this.stdin,
+    this.stdout,
+    this.stderr,
+    undefined,
+    undefined
+  ]
+}
+
+const directory = '/private/project'
+const model = { id: 'model-b', providerID: 'private-proof', enabled: true }
+const snapshot = {
+  model: { location: { directory }, data: [model] },
+  agent: {
+    location: { directory },
+    data: [{ id: 'build', mode: 'primary', hidden: false, model }]
+  },
+  'model/default': { location: { directory }, data: model },
+  config: [{ type: 'document', info: { default_agent: 'build' } }]
+}
+const platform = Object.getOwnPropertyDescriptor(process, 'platform')
+let child: ProbeChild
+let closeDuringFetch = false
+function close() {
+  child.exitCode = 0
+  child.emit('exit', 0, null)
+  child.emit('close', 0, null)
+}
+const options = { executable: '/private/opencode', cwd: directory, env: {} }
+
+describe('OpenCode model probe termination evidence', () => {
+  beforeEach(() => {
+    vi.resetAllMocks()
+    vi.mocked(readFetchResponseJsonWithinLimit).mockImplementation((response) => response.json())
+    child = new ProbeChild()
+    closeDuringFetch = false
+    vi.mocked(spawnProcess).mockImplementation(() => {
+      queueMicrotask(() => child.stdout.write('server listening on http://127.0.0.1:45678\n'))
+      return child
+    })
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async (input: URL) => {
+        const endpoint = z
+          .enum(['model', 'agent', 'model/default', 'config'])
+          .parse(input.pathname.slice('/api/'.length))
+        const response = snapshot[endpoint]
+        if (closeDuringFetch && endpoint === 'config') {
+          queueMicrotask(close)
+        }
+        return new Response(JSON.stringify(response), { status: 200 })
+      })
+    )
+    vi.mocked(signalProcessTree).mockImplementation(async () => {
+      close()
+      return true
+    })
+    vi.mocked(forceTerminateProcessTree).mockResolvedValue(false)
+  })
+
+  afterEach(() => {
+    if (platform) {
+      Object.defineProperty(process, 'platform', platform)
+    }
+    vi.unstubAllGlobals()
+  })
+
+  it('cancels all unread responses if the bounded body reader fails', async () => {
+    const cancel = vi.fn()
+    vi.mocked(readFetchResponseJsonWithinLimit).mockRejectedValue(new Error('body_reader_failed'))
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => new Response(new ReadableStream({ cancel }), { status: 200 }))
+    )
+    expect(await probeOpenCodeLaunchModelContext(options)).toBeNull()
+    expect(cancel).toHaveBeenCalledTimes(4)
+    expect(signalProcessTree).toHaveBeenCalledOnce()
+  })
+
+  it('accepts an already-closed Windows probe without signaling its former pid', async () => {
+    Object.defineProperty(process, 'platform', { value: 'win32' })
+    closeDuringFetch = true
+    vi.mocked(signalProcessTree).mockResolvedValue(false)
+    expect(await probeOpenCodeLaunchModelContext(options)).toMatchObject({ primaryAgent: 'build' })
+    expect(signalProcessTree).not.toHaveBeenCalled()
+    expect(forceTerminateProcessTree).not.toHaveBeenCalled()
+  })
+
+  it('does not force a POSIX group after the graceful close', async () => {
+    Object.defineProperty(process, 'platform', { value: 'darwin' })
+    expect(await probeOpenCodeLaunchModelContext(options)).toMatchObject({ primaryAgent: 'build' })
+    expect(signalProcessTree).toHaveBeenCalledOnce()
+    expect(forceTerminateProcessTree).not.toHaveBeenCalled()
+  })
+
+  it('keeps a root exit with inherited pipes unverified and avoids its former pid', async () => {
+    vi.mocked(signalProcessTree).mockImplementation(async () => {
+      child.exitCode = 0
+      child.emit('exit', 0, null)
+      return false
+    })
+    expect(await probeOpenCodeLaunchModelContext(options)).toBeNull()
+    expect(forceTerminateProcessTree).not.toHaveBeenCalled()
+  })
+
+  it('requires verified termination when a still-live probe does not close', async () => {
+    vi.mocked(signalProcessTree).mockResolvedValue(true)
+    expect(await probeOpenCodeLaunchModelContext(options)).toBeNull()
+    expect(forceTerminateProcessTree).toHaveBeenCalledOnce()
+  })
+})