fix: [#1052] bundled cleanup — 5 deferred items + 3 review-fixes

.husky/pre-push

@@ -18,3 +18,7 @@ if (process.versions.bun !== expectedBunVersion) {
 }
 '
 bun typecheck
+# altimate_change — #1052 D8: scan pushed content for internal-tracker refs
+# (see RULES in the script for the specific patterns). Silent on clean;
+# exits 1 on hit. Bypass with SKIP_TRACKER_CHECK=1 for genuine emergencies.
+bun script/check-tracker-leaks.ts

CONTRIBUTING.md

@@ -39,6 +39,8 @@ https://github.com/anomalyco/models.dev
   bun dev
   ```
 
+`bun install` sets up the pre-push hook via `husky` — subsequent `git push` runs a bun-version check, `bun typecheck`, and a scan for internal-tracker references. If the tracker scan blocks you legitimately (extremely unlikely on this public repo), bypass with `SKIP_TRACKER_CHECK=1 git push`.
+
 ### Running against a different directory
 
 By default, `bun dev` runs Altimate Code in the `packages/opencode` directory. To run it against a different directory or repository:

packages/opencode/script/build.ts

@@ -6,6 +6,8 @@ import path from "path"
 import { fileURLToPath } from "url"
 import { createRequire } from "node:module"
 import solidPlugin from "@opentui/solid/bun-plugin"
+// altimate_change — #1052 D10: sha256 for the per-target build-inputs stamp.
+import { createHash } from "node:crypto"
 
 const __filename = fileURLToPath(import.meta.url)
 const __dirname = path.dirname(__filename)
@@ -523,6 +525,122 @@ for (const item of targets) {
       2,
     ),
   )
+
+  // altimate_change start — #1052 D10: emit a build-inputs stamp so the
+  // smoke-test staleness guard can compare against ALL binary-embedded inputs,
+  // not just src/ + script/ mtimes.
+  //
+  // The previous guard (m5) walked src/ + script/ for the newest mtime — good
+  // for the common case but blind to changes in CHANGELOG.md, migrations,
+  // bundled skills, the models.dev snapshot, the parser worker, and the
+  // per-platform altimate-core prebuild. Editing any of those without touching
+  // a .ts file would leave the guard silent and the binary silently stale.
+  //
+  // Stamp format: JSON with one entry per input, sha256 of file content. Read
+  // side rehashes each listed path and compares; any mismatch → stale. Paths
+  // are REPO_ROOT-relative so entries under packages/tui, packages/core, the
+  // workspace-root package.json, bun.lock, etc. resolve without munging.
+  const REPO_ROOT = path.resolve(dir, "../..")
+  const stampInputs: Array<{ path: string; sha256: string }> = []
+  const addFile = (absPath: string) => {
+    try {
+      const buf = fs.readFileSync(absPath)
+      const rel = path.relative(REPO_ROOT, absPath)
+      const hash = createHash("sha256").update(buf).digest("hex")
+      stampInputs.push({ path: rel, sha256: hash })
+    } catch {
+      // Missing file: silently skip. The stamp only covers what actually
+      // shipped; a file the build didn't need doesn't invalidate the guard.
+    }
+  }
+  // CHANGELOG.md
+  addFile(changelogPath)
+  // Migrations
+  for (const m of migrationDirs) addFile(path.join(dir, "migration", m, "migration.sql"))
+  // Skills bundled via .opencode/skills/
+  for (const entry of skillEntries) addFile(path.join(skillsRoot, entry.name, "SKILL.md"))
+  // Generated models snapshot (build.ts rewrote it before we got here)
+  addFile(path.join(dir, "src/provider/models-snapshot.ts"))
+  // opentui parser worker
+  addFile(parserWorker)
+  // Per-target altimate-core NAPI prebuild
+  addFile(platformNodeSrc)
+  // altimate_change — #1052 D10 review-fix (M2): package.json + bun.lock cover
+  // dependency-version bumps that change what Bun.build embeds. Without these,
+  // `bun install` bumping a bundled dep would leave the stamp reporting fresh.
+  // Include per-package package.json in the workspace walk below.
+  addFile(path.join(REPO_ROOT, "package.json"))
+  addFile(path.join(REPO_ROOT, "bun.lock"))
+  // Also include tsconfig files that affect compiled output shape
+  // (bot review: tsconfig changes can flip target/moduleResolution).
+  addFile(path.join(dir, "tsconfig.json"))
+  // src/ + script/ TypeScript tree — hash every file the compiler actually saw
+  // (same extension filter build.ts globs for embedding).
+  const IGNORED = new Set(["node_modules", ".turbo", ".cache", "dist", "target"])
+  const walk = (root: string): void => {
+    let entries: fs.Dirent[]
+    try {
+      entries = fs.readdirSync(root, { withFileTypes: true })
+    } catch {
+      return
+    }
+    for (const entry of entries) {
+      if (entry.name.startsWith(".")) continue
+      if (IGNORED.has(entry.name)) continue
+      const full = path.join(root, entry.name)
+      if (entry.isDirectory()) {
+        walk(full)
+        continue
+      }
+      if (!/\.(tsx?|json|txt|md)$/.test(entry.name)) continue
+      addFile(full)
+    }
+  }
+  walk(path.join(dir, "src"))
+  walk(path.join(dir, "script"))
+  // altimate_change — #1052 D10 review-fix (M2): also hash every workspace
+  // package's src/ tree. `packages/opencode/src` imports from
+  // `@opencode-ai/{core,tui,util,plugin,sdk,server,cli,...}` and
+  // `@altimateai/{dbt-tools,drivers}` — Bun.build follows these imports and
+  // bundles them into the binary transitively. The original stamp walked only
+  // packages/opencode, so edits under any sibling workspace package would leave
+  // the binary silently stale. Enumerate `packages/*/src` at build time (rather
+  // than hard-coding names) so new packages get covered automatically.
+  const packagesRoot = path.resolve(REPO_ROOT, "packages")
+  try {
+    for (const pkg of fs.readdirSync(packagesRoot, { withFileTypes: true })) {
+      if (!pkg.isDirectory() || pkg.name.startsWith(".")) continue
+      // Skip packages/opencode — already covered by the walks above.
+      if (pkg.name === "opencode") continue
+      const pkgSrc = path.join(packagesRoot, pkg.name, "src")
+      if (fs.existsSync(pkgSrc)) walk(pkgSrc)
+      // Each workspace package.json influences its resolution/exports and could
+      // change what ends up in the binary even when its src/ files are unchanged.
+      const pkgJson = path.join(packagesRoot, pkg.name, "package.json")
+      if (fs.existsSync(pkgJson)) addFile(pkgJson)
+    }
+  } catch {
+    // packages/ missing (unlikely at build time) — skip; addFile() ignores non-existent paths anyway.
+  }
+  // Deterministic order so the aggregate hash is stable across build runs.
+  stampInputs.sort((a, b) => a.path.localeCompare(b.path))
+  const aggregate = createHash("sha256")
+    .update(stampInputs.map((i) => `${i.path}\t${i.sha256}`).join("\n"))
+    .digest("hex")
+  await Bun.file(`dist/${name}/bin/build-inputs.json`).write(
+    JSON.stringify(
+      {
+        target: name,
+        version: Script.version,
+        aggregate,
+        inputs: stampInputs,
+      },
+      null,
+      2,
+    ),
+  )
+  // altimate_change end
+
   binaries[name] = Script.version
 }
 

packages/opencode/src/provider/models.ts

@@ -121,12 +121,35 @@ export namespace ModelsDev {
       const result = await Filesystem.readJson(Flag.OPENCODE_MODELS_PATH ?? filepath).catch(() => {})
       if (result) return result
       const result2 = await fetchApi()
-      if (result2.ok) {
-        await Filesystem.write(filepath, result2.text).catch((e) => {
-          log.error("Failed to write models cache", { error: e })
+      // altimate_change — #1052 D14 review-fix (M3): fetchApi returning a non-2xx
+      // (e.g. 5xx with an HTML error body) previously fell through to
+      // `JSON.parse(<HTML>)` and crashed with SyntaxError. Return an empty
+      // catalog instead — callers already tolerate empty results (Provider.state
+      // just yields no models.dev-derived providers, which is the same UX as
+      // running with OPENCODE_DISABLE_MODELS_FETCH=1). Pre-D14 this rarely
+      // fired because the eager refresh usually warmed the disk cache; post-D14
+      // more first-calls fall through to fetch, so more chances to hit the crash.
+      //
+      // Bot-review follow-up: a 2xx can still carry HTML or truncated JSON
+      // (proxies, load-balancer error pages that respond 200, mid-stream
+      // truncation). Try to parse first; only cache + return on success. On
+      // parse failure, log and return empty — same graceful-degradation path
+      // as the non-2xx branch, and we don't poison the disk cache with junk.
+      if (!result2.ok) return {}
+      let parsed: Record<string, unknown>
+      try {
+        parsed = JSON.parse(result2.text)
+      } catch (e) {
+        log.error("models.dev returned non-JSON body; not caching", {
+          error: e,
+          firstBytes: result2.text.slice(0, 120),
         })
+        return {}
       }
-      return JSON.parse(result2.text)
+      await Filesystem.write(filepath, result2.text).catch((e) => {
+        log.error("Failed to write models cache", { error: e })
+      })
+      return parsed
     })
   })
 
@@ -152,18 +175,38 @@ export namespace ModelsDev {
 }
 
 if (!Flag.OPENCODE_DISABLE_MODELS_FETCH && !process.argv.includes("--get-yargs-completions")) {
-  // altimate_change start — upstream_fix: bridge merge removed the setTimeout(...,0)
-  // wrapper. Defer the initial refresh past the current microtask so that
-  // Installation.USER_AGENT (used inside refresh()) is fully initialized — we hit
-  // a circular-dep issue on cold start without this. See altimate commit 980efaab64.
-  setTimeout(() => {
-    ModelsDev.refresh()
-    setInterval(
-      async () => {
-        await ModelsDev.refresh()
-      },
-      60 * 1000 * 60,
-    ).unref()
-  }, 0)
+  // altimate_change start — #1052 D14: drop the eager import-time ModelsDev.refresh().
+  //
+  // The previous `setTimeout(() => ModelsDev.refresh(), 0)` fired a fetch to
+  // https://models.dev/api.json at module import. Its `AbortSignal.timeout(10000)`
+  // cannot cancel a synchronous `getaddrinfo()` — under Linux `unshare --net`
+  // (Verdaccio sanity Phase 3 [10/10] on Ubuntu CI runners) the DNS call blocked
+  // long enough that the pending fetch held the event loop past command
+  // completion and SIGTERM landed before any bytes flushed. That blocked the
+  // v0.9.4 release.
+  //
+  // Callers that need model data use `ModelsDev.Data()`, which resolves in this
+  // priority order: (1) local disk cache, (2) bundled snapshot at
+  // `models-snapshot.ts` (embedded in release binaries — regenerated at each
+  // build; dev-mode builds without the snapshot fall through to fetch), (3)
+  // `Flock.withLock(...) → fetchApi()` only when both are absent. Release
+  // binaries therefore have release-time model metadata even on a cold-start
+  // with no network. Long-running processes (TUI, serve) still receive updates
+  // via the hourly `setInterval` below (`.unref()`'d so it never blocks exit).
+  //
+  // Trade-off: without an eager fetch, models added to models.dev between
+  // releases would not appear until the hourly interval below fires. The
+  // fire-and-forget refresh() below narrows that window without holding the
+  // event loop — a microtask can't itself keep Bun alive, and if the fetch it
+  // schedules is still in flight at process-exit, the snapshot covers callers
+  // on the next run. The load-bearing part of the D14 fix (removing the
+  // setTimeout(...,0)-wrapped fetch that kept the loop alive) is preserved.
+  //
+  // If this reintroduces the unshare-net hang on CI, drop the Promise.then
+  // line — the snapshot alone still keeps release binaries functional offline.
+  Promise.resolve().then(() => ModelsDev.refresh().catch(() => {}))
+  setInterval(async () => {
+    await ModelsDev.refresh()
+  }, 60 * 60 * 1000).unref()
   // altimate_change end
 }

packages/opencode/test/install/smoke-test-binary.test.ts

@@ -19,6 +19,8 @@ import { describe, test, expect } from "bun:test"
 import { spawnSync, execFileSync } from "child_process"
 import path from "path"
 import fs from "fs"
+// altimate_change — #1052 D10: sha256 for stamp-based staleness check.
+import { createHash } from "node:crypto"
 import { tmpdir } from "../fixture/fixture"
 
 const PKG_DIR = path.resolve(import.meta.dir, "../..")
@@ -148,16 +150,76 @@ function isBinaryStale(binaryPath: string): boolean {
 }
 // altimate_change end
 
+// altimate_change start — #1052 D10: stamp-based staleness check.
+// build.ts emits `dist/<target>/bin/build-inputs.json` next to each binary,
+// listing every file the binary embedded (CHANGELOG, migrations, skills,
+// models-snapshot, parser worker, altimate-core prebuild, src/, script/) with
+// sha256. This function rehashes each listed input; any mismatch means the
+// binary no longer reflects the current sources. Falls back to the mtime walk
+// above when the stamp is missing (older builds, or fallback for `--single`
+// runs before the stamp landed).
+type BuildStamp = {
+  target: string
+  version: string
+  aggregate: string
+  inputs: Array<{ path: string; sha256: string }>
+}
+function readBuildStamp(binaryPath: string): BuildStamp | undefined {
+  const stampPath = path.join(path.dirname(binaryPath), "build-inputs.json")
+  try {
+    if (!fs.existsSync(stampPath)) return undefined
+    const parsed = JSON.parse(fs.readFileSync(stampPath, "utf-8")) as BuildStamp
+    if (!parsed?.inputs?.length) return undefined
+    return parsed
+  } catch {
+    return undefined
+  }
+}
+function sha256File(absPath: string): string | undefined {
+  try {
+    return createHash("sha256").update(fs.readFileSync(absPath)).digest("hex")
+  } catch {
+    return undefined
+  }
+}
+function isBinaryStaleFromStamp(binaryPath: string): boolean | "no-stamp" {
+  const stamp = readBuildStamp(binaryPath)
+  if (!stamp) return "no-stamp"
+  // altimate_change — #1052 D10 review-fix (M2): stamp paths are now REPO_ROOT-
+  // relative so entries under packages/tui, packages/core, workspace-root
+  // package.json, bun.lock, etc. resolve correctly without further munging.
+  for (const { path: rel, sha256 } of stamp.inputs) {
+    const abs = path.join(REPO_ROOT, rel)
+    const current = sha256File(abs)
+    if (current === undefined) return true // input vanished → binary can't reflect current tree
+    if (current !== sha256) return true
+  }
+  return false
+}
+// altimate_change end
+
 describe("compiled binary smoke test", () => {
   const binary = findLocalBinary()
-  const stale = binary ? isBinaryStale(binary) : false
+  // altimate_change — #1052 D10: prefer the stamp-based staleness check; fall
+  // back to the mtime walk when the stamp is absent (older `bun run build:local`
+  // runs, or targets built before the stamp landed).
+  const stampVerdict = binary ? isBinaryStaleFromStamp(binary) : ("no-stamp" as const)
+  const stale =
+    binary === undefined
+      ? false
+      : stampVerdict === "no-stamp"
+        ? isBinaryStale(binary)
+        : stampVerdict
   const skip = !binary || stale
   const runTest = skip ? test.skip : test
 
   if (!binary) {
     test.skip("no local build found — run `bun run build:local` first", () => {})
   } else if (stale) {
-    test.skip("local binary is older than the newest src/ or script/ file — run `bun run build:local` to refresh", () => {})
+    test.skip(
+      "local binary is stale (build-inputs stamp mismatch or newer src/script mtime) — run `bun run build:local` to refresh",
+      () => {},
+    )
   }
 
   runTest("binary starts and prints version", () => {

packages/opencode/test/lib/cli-process.ts

@@ -24,6 +24,8 @@ import { Deferred, Duration, Effect, Layer, Queue, Scope, Stream } from "effect"
 import { FetchHttpClient, HttpClient } from "effect/unstable/http"
 import { ChildProcess } from "effect/unstable/process"
 import path from "node:path"
+// altimate_change — #1052 D11: fsPromises for the pre-retry DB scrub.
+import * as fsPromises from "node:fs/promises"
 import { TestLLMServer } from "./llm-server"
 import { testProviderConfig } from "./test-provider"
 import { it } from "./effect"
@@ -293,6 +295,16 @@ export function withCliFixture<A, E>(
       // 60s spawn on top of the first (CodeRabbit v0.9.4 review finding).
       // Cap the retry at max(remaining, 15s) — enough for a warm-cache spawn
       // + cold-SQLite open without granting an unbounded second window.
+      //
+      // Before retrying, clean the SQLite state the first attempt may have
+      // written before hitting the lock (#1052 D11). `opencode run` writes
+      // session + tracing state at boot; if the first attempt got as far as
+      // opening the DB and taking a partial write before the WAL checkpoint
+      // collision, a naive retry would either see the partial state or
+      // double-write. Nuke the DB files (they live under this fixture's
+      // isolated XDG_DATA_HOME) so the second attempt starts from a clean
+      // slate. Other fixture state (config, home files) is preserved so
+      // tests that inject setup into `home` still see it.
       return Effect.gen(function* () {
         const startedAt = Date.now()
         const originalTimeoutMs = opts?.timeoutMs ?? 60_000
@@ -307,6 +319,21 @@ export function withCliFixture<A, E>(
           `[cli-process] child hit \`database is locked\` on first attempt (exit=${first.exitCode}); retrying once. ` +
             `If you see this often, the SQLite WAL/checkpoint contention has moved from transient to systematic.`,
         )
+        // Scrub SQLite state so the retry is idempotent (see block comment above).
+        // The DB path pattern matches the CLI's own file layout under XDG_DATA_HOME.
+        yield* Effect.promise(async () => {
+          const dbDir = path.join(home, ".local/share/altimate-code")
+          try {
+            const entries = await fsPromises.readdir(dbDir)
+            await Promise.all(
+              entries
+                .filter((e) => /^opencode.*\.db(-wal|-shm)?$/.test(e))
+                .map((e) => fsPromises.rm(path.join(dbDir, e), { force: true })),
+            )
+          } catch {
+            // Directory absent or unreadable — nothing to clean. Retry proceeds.
+          }
+        })
         const elapsed = Date.now() - startedAt
         const remaining = Math.max(originalTimeoutMs - elapsed, 15_000)
         const second = yield* spawn(argv, { ...opts, timeoutMs: remaining })