fix(opencode): stop treating an empty fault-state response as a finished turn

A provider that finishes with `finish: "error"` having produced nothing was being recorded as a normal
terminal state. The reason went onto the assistant message, no error object was ever built, `process()`
returned "continue", and the next pass through the prompt loop found a `finish` that was not "tool-calls"
with no tool calls beside it and simply broke — the `exiting loop` log, then idle. No error, no retry, and
from the outside an agent that stops mid-task for no stated reason. Bedrock does this intermittently:
eight times in one 48-hour stretch on `openai.gpt-5.6-sol`.

The empty case is now raised as a failure from the `step-finish` handler, before the snapshot and before
any part is written, so five spent attempts leave nothing behind in the timeline. That single failure is
the whole fix: `Effect.retry(SessionRetry.policy(…))` already wraps the stream drain with `llm.stream()`
inside it, so it buys the bounded five attempts, the backoff, the `retry` status, and — once those are
spent — `halt` storing a visible error and returning "stop". retry.ts, prompt.ts and the AI SDK adapter
are untouched. The neighbouring `provider-error` branch has always converted a stream event into a throw
exactly like this.

`ProviderError.ResponseStreamError` carries it because message-v2.ts already maps that to a retryable
`APIError`, and `APIError` is one of the eight members of the closed `AssistantErrorSchema` union. A
purpose-made error type would have to be added to that union, to core, and to the generated SDKs — which
this fork never regenerates — and any client on an older build would then fail to decode the message it
was stored on. The other candidate, `APICallError`, requires a fabricated `url`.

Raising it in the processor rather than the adapter is deliberate: two runtimes reach this state, the AI
SDK adapter passing the reason through and native Gemini's MALFORMED_FUNCTION_CALL, and a guard in the
adapter would silently miss Gemini. Both arrive here as one `step-finish`.

A turn that produced output must never be replayed — the retry re-sends the original request, so text
would be duplicated and tools would run twice. Those are reported instead: `"error"` after any output sets
a non-retryable `APIError` on the message and publishes it, which stops the loop with something on screen,
mirroring what prompt.ts already does for a content filter. Reasoning counts as output for this purpose,
since the reader has already seen it. `"unknown"` is replayed only when empty; on a turn that said
something it is an ordinary completion, and several providers return one.

Tests were confirmed to fail without the guards, not merely to pass with them: five of the six new
processor tests fail when both are removed, and the sixth asserts the guards do *not* fire on a normal
finish. The retry side gets the one genuinely new assertion — that this error classifies as retryable;
the five-attempt bound does not vary by error and is already covered.

Not reproducible on demand, so the tests are the verification. In production the signal is that
`exiting loop` should now be preceded by a `retry` status or a stored `APIError`; a message with
`finish="error"`, `error=null` and a straight drop to idle would mean the condition missed a case.

Upstreamable, and worth dropping once upstream lands an equivalent — anomalyco#31430 and anomalyco#41469,
where PR anomalyco#40531 covered only the `unknown` case.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: JDScript

FORK.md

@@ -174,6 +174,7 @@ upstream and cannot conflict.
 | `packages/session-ui/src/v2/components/prompt-input/index.tsx`   | `trailingControl` slot on the prompt action row                                 |
 | `packages/app/src/components/prompt-input-v2.tsx`                | Fills it (TPS, scanner, context usage), exposes `sessionId`, registers `/usage` |
 | `packages/app/src/pages/home/home-projects-view.tsx`             | Usage button in `HomeUtilityNav`, above settings and help                       |
+| `packages/opencode/src/session/processor.ts`                     | Raises an empty fault-state response as a retryable error instead of finishing  |
 
 ### Non-obvious choices worth keeping
 
@@ -204,6 +205,33 @@ upstream and cannot conflict.
   already a seam and is mounted for every session's composer, so the session entry point costs no extra
   upstream file. `CommandOption.slash` is the whole integration: `prompt-input-v2.tsx` builds its slash menu
   by filtering registered commands for that field.
+- **An empty response in a fault state is raised as an error from `processor.ts`, and only from there.** A
+  provider that finishes with `finish: "error"` having produced nothing used to stop the session in silence:
+  the reason went onto the message, no error object was ever built, and the next pass through the prompt loop
+  found a `finish` that was not `tool-calls` and broke (`exiting loop`). Bedrock does it intermittently. Three
+  things about the fix are easy to undo by accident:
+  - **`processor.ts` is the only seam, and that is not a compromise.** `Effect.retry(SessionRetry.policy(…))`
+    already wraps the stream drain while `llm.stream()` sits inside it, so one `Effect.fail` in the event
+    handler buys the bounded retry, the backoff, the `retry` status, and `halt` storing a visible error and
+    returning `"stop"`. `retry.ts`, `prompt.ts` and the AI SDK adapter need nothing. The neighbouring
+    `provider-error` branch has always done exactly this with a bare `throw`.
+  - **It must not move into `ai-sdk.ts`.** Two runtimes produce this state: the AI SDK adapter (which passes
+    the reason through) and native Gemini's `MALFORMED_FUNCTION_CALL` (`protocols/gemini.ts`). A guard in the
+    adapter silently misses Gemini. `processor.ts` sees both as one `step-finish`.
+  - **`ProviderError.ResponseStreamError`, not a purpose-made error type.** `message-v2.ts` already maps it to
+    a retryable `APIError`, and `APIError` is one of the eight members of the **closed** `AssistantErrorSchema`
+    union in `packages/schema/src/v1/session.ts`. A ninth member would mean editing that union, core, and the
+    generated SDKs — which this fork never regenerates — and any client on an older build would fail to decode
+    the message it was stored on. `APICallError` was the other candidate and needs a fabricated `url`.
+
+  Reasoning counts as produced output, so a reasoning-only turn is reported rather than replayed: a retry
+  re-sends the original request, and the reader has already seen the reasoning. A turn that produced anything
+  and _then_ reported `"error"` is likewise reported, never replayed. `"unknown"` is replayed only when empty —
+  on a turn that said something it is an ordinary completion, which several providers return.
+
+  Upstreamable, and worth dropping if upstream lands an equivalent: issues #31430 and #41469, where PR #40531
+  covered only the `unknown` case.
+
 - **The live TPS meter reads the sync store, not the SSE stream.** The TUI plugin it is ported from
   (`opencode-tps`, MIT — its README says the web UI cannot run it) subscribes to `message.part.delta`. There is
   no public event hook in this app, so doing the same would mean cutting seams into `server-sdk.tsx` and

packages/opencode/src/session/processor.ts

@@ -19,6 +19,7 @@ import { SessionRetry } from "./retry"
 import { SessionStatus } from "./status"
 import { SessionSummary } from "./summary"
 import type { Provider } from "@/provider/provider"
+import { ProviderError } from "@/provider/error" // FORK
 import { Question } from "@/question"
 import { errorMessage } from "@/util/error"
 import { isRecord } from "@/util/record"
@@ -72,6 +73,10 @@ interface ProcessorContext extends Input {
   needsCompaction: boolean
   currentText: SessionV1.TextPart | undefined
   reasoningMap: Record<string, SessionV1.ReasoningPart>
+  // FORK: whether this stream attempt produced anything a reader would have seen — text, reasoning or a tool
+  // call. Per attempt, not per step: reset where the stream is (re)opened, so a retry starts clean. Gates the
+  // empty-response guard in `step-finish`, which may only replay a turn that produced nothing.
+  produced: boolean
 }
 
 type StreamEvent = LLMEvent
@@ -111,6 +116,7 @@ const layer = Layer.effect(
         needsCompaction: false,
         currentText: undefined,
         reasoningMap: {},
+        produced: false, // FORK
       }
       let aborted = false
 
@@ -218,6 +224,9 @@ const layer = Layer.effect(
         name: string
         providerExecuted?: boolean
       }) {
+        // FORK: the one place all four tool events pass through. A turn that got as far as naming a tool must
+        // never be replayed — the retry re-sends the original request, so the tool would run twice.
+        ctx.produced = true
         const existing = yield* readToolCall(input.id)
         if (existing) {
           if (!input.providerExecuted || existing.part.metadata?.providerExecuted) return existing
@@ -294,6 +303,9 @@ const layer = Layer.effect(
           case "reasoning-delta":
             // Match dev: silently drop orphan deltas (no preceding reasoning-start).
             if (!(value.id in ctx.reasoningMap)) return
+            // FORK: reasoning counts as output — it is shown like any other part, so a retry would append a
+            // second copy of it.
+            if (value.text.length > 0) ctx.produced = true
             ctx.reasoningMap[value.id].text += value.text
             if (value.providerMetadata) ctx.reasoningMap[value.id].metadata = value.providerMetadata
             yield* session.updatePartDelta({
@@ -433,6 +445,20 @@ const layer = Layer.effect(
             return
 
           case "step-finish": {
+            // FORK: a fault-state finish with nothing to show for it is a failed request, not a finished
+            // turn. Recorded as a finish it stopped the session in silence — no error, no retry, straight to
+            // idle via prompt.ts's `exiting loop`. Failing is the whole fix: the retry policy already wraps
+            // this stream, so it brings the bounded attempts and the visible error on exhaustion.
+            //
+            // Raised before the snapshot and before any part is written, so spent attempts leave no
+            // step-finish parts behind. See FORK.md for why this error type and why not in the adapter.
+            if ((value.reason === "error" || value.reason === "unknown") && !ctx.produced) {
+              yield* Effect.fail(
+                new ProviderError.ResponseStreamError(
+                  `Provider returned no output and finished with reason "${value.reason}"`,
+                ),
+              )
+            }
             const completedSnapshot = yield* snapshot.track()
             yield* Effect.forEach(Object.keys(ctx.reasoningMap), finishReasoning)
             const usage = Session.getUsage({
@@ -443,6 +469,19 @@ const layer = Layer.effect(
             ctx.assistantMessage.finish = value.reason
             ctx.assistantMessage.cost += usage.cost
             ctx.assistantMessage.tokens = usage.tokens
+            // FORK: the other half — output first, then "error". Replaying it would duplicate text or re-run a
+            // tool, so it is reported instead; the error makes `process()` return "stop". Set before the
+            // `updateMessage` below so that write persists it.
+            //
+            // Never "unknown" here: an unmapped finish reason on a turn that produced output is an ordinary
+            // completion, and several providers return one.
+            if (value.reason === "error" && ctx.produced && !ctx.assistantMessage.error) {
+              ctx.assistantMessage.error = new SessionV1.APIError({
+                message: 'Provider reported finish reason "error" after producing partial output',
+                isRetryable: false,
+                metadata: { code: "ProviderResponseStreamError" },
+              }).toObject()
+            }
             yield* session.updatePart({
               id: PartID.ascending(),
               reason: value.reason,
@@ -454,6 +493,14 @@ const layer = Layer.effect(
               cost: usage.cost,
             })
             yield* session.updateMessage(ctx.assistantMessage)
+            // FORK: announced the way `halt` and prompt.ts's content-filter branch announce theirs; without
+            // it a client not re-reading the message would show no change.
+            if (ctx.assistantMessage.error) {
+              yield* events.publish(Session.Event.Error, {
+                sessionID: ctx.assistantMessage.sessionID,
+                error: ctx.assistantMessage.error,
+              })
+            }
             if (ctx.snapshot) {
               const patch = yield* snapshot.patch(ctx.snapshot)
               if (patch.files.length) {
@@ -498,6 +545,9 @@ const layer = Layer.effect(
 
           case "text-delta":
             if (!ctx.currentText) return
+            // FORK: on a delta, not on `text-start` — an empty response can still open and close a text
+            // block without putting a character in it.
+            if (value.text.length > 0) ctx.produced = true
             ctx.currentText.text += value.text
             if (value.providerMetadata) ctx.currentText.metadata = value.providerMetadata
             yield* session.updatePartDelta({
@@ -636,6 +686,8 @@ const layer = Layer.effect(
           yield* Effect.gen(function* () {
             ctx.currentText = undefined
             ctx.reasoningMap = {}
+            // FORK: inside the block `Effect.retry` re-runs, so each attempt is judged on its own output.
+            ctx.produced = false
             yield* status.set(ctx.sessionID, { type: "busy" })
             const stream = llm.stream(streamInput)
 

packages/opencode/test/session/processor-effect.test.ts

@@ -1112,3 +1112,200 @@ itFragmentFailure.live("session.processor effect tests retain partial legacy par
     { config: cfg },
   ),
 )
+
+// ---------------------------------------------------------------------------
+// FORK: empty provider responses. An empty fault is replayed; one that produced output is reported instead.
+//
+// On a stub `LLM.Service` rather than the HTTP mock, because `finish: "error"` cannot be reached through it —
+// the OpenAI-chat protocol maps every unrecognised finish_reason to "unknown". The counter is the assertion:
+// `stream()` runs once per attempt, so it says how many times the request was sent.
+// ---------------------------------------------------------------------------
+
+function countingLLM(streams: () => ReadonlyArray<ReadonlyArray<LLMEvent>>) {
+  const attempts = { count: 0 }
+  const all = streams()
+  const layer = Layer.succeed(
+    LLM.Service,
+    LLM.Service.of({
+      stream: () => {
+        const index = attempts.count++
+        return Stream.fromIterable(all[Math.min(index, all.length - 1)])
+      },
+    }),
+  )
+  return { attempts, layer }
+}
+
+const emptyStep = (reason: "error" | "unknown") => [
+  LLMEvent.stepStart({ index: 0 }),
+  LLMEvent.stepFinish({ index: 0, reason }),
+  LLMEvent.finish({ reason }),
+]
+
+const textStep = (text: string) => [
+  LLMEvent.stepStart({ index: 0 }),
+  LLMEvent.textStart({ id: "text-1" }),
+  LLMEvent.textDelta({ id: "text-1", text }),
+  LLMEvent.textEnd({ id: "text-1" }),
+  LLMEvent.stepFinish({ index: 0, reason: "stop" }),
+  LLMEvent.finish({ reason: "stop" }),
+]
+
+const run = (
+  name: string,
+  streams: () => ReadonlyArray<ReadonlyArray<LLMEvent>>,
+  check: (input: {
+    attempts: { count: number }
+    value: "stop" | "continue" | "compact"
+    message: SessionV1.Assistant
+    parts: SessionV1.Part[]
+    seen: string[]
+  }) => void,
+) => {
+  const { attempts, layer } = countingLLM(streams)
+  const scoped = testEffect(LayerNode.compile(root, [...replacements, [LLM.node, layer]]))
+  scoped.live(`session.processor effect tests ${name}`, () =>
+    provideTmpdirInstance(
+      (dir) =>
+        Effect.gen(function* () {
+          const { processors, session, provider } = yield* boot()
+          const events = yield* EventV2Bridge.Service
+          const chat = yield* session.create({})
+          const parent = yield* user(chat.id, name)
+          const msg = yield* assistant(chat.id, parent.id, path.resolve(dir))
+          const mdl = yield* provider.getModel(ref.providerID, ref.modelID)
+          const seen: string[] = []
+          const off = yield* events.listen((event) => {
+            seen.push(event.type)
+            return Effect.void
+          })
+          const handle = yield* processors.create({ assistantMessage: msg, sessionID: chat.id, model: mdl })
+
+          const value = yield* handle.process({
+            user: {
+              id: parent.id,
+              sessionID: chat.id,
+              role: "user",
+              time: parent.time,
+              agent: parent.agent,
+              model: { providerID: ref.providerID, modelID: ref.modelID },
+            } satisfies SessionV1.User,
+            sessionID: chat.id,
+            model: mdl,
+            agent: agent(),
+            system: [],
+            messages: [{ role: "user", content: name }],
+            tools: {},
+          })
+          yield* off
+
+          check({ attempts, value, message: handle.message, parts: yield* MessageV2.parts(msg.id), seen })
+        }),
+      { config: cfg },
+    ),
+  )
+}
+
+run(
+  "retry an empty error response and recover",
+  () => [emptyStep("error"), textStep("after")],
+  (r) => {
+    expect(r.attempts.count).toBe(2)
+    expect(r.value).toBe("continue")
+    expect(r.parts).toEqual(expect.arrayContaining([expect.objectContaining({ type: "text", text: "after" })]))
+    expect(r.message.error).toBeUndefined()
+    // The spent attempt must not leave its own step-finish behind.
+    expect(r.parts.filter((part) => part.type === "step-finish")).toHaveLength(1)
+  },
+)
+
+run(
+  "retry an empty unknown response and recover",
+  () => [emptyStep("unknown"), textStep("after")],
+  (r) => {
+    expect(r.attempts.count).toBe(2)
+    expect(r.value).toBe("continue")
+    expect(r.message.error).toBeUndefined()
+  },
+)
+
+run(
+  "do not retry an empty response that finished normally",
+  () => [
+    [
+      ...emptyStep("error").slice(0, 1),
+      LLMEvent.stepFinish({ index: 0, reason: "stop" }),
+      LLMEvent.finish({ reason: "stop" }),
+    ],
+  ],
+  (r) => {
+    expect(r.attempts.count).toBe(1)
+    expect(r.message.error).toBeUndefined()
+  },
+)
+
+run(
+  "report but never replay an error after text",
+  () => [
+    [
+      LLMEvent.stepStart({ index: 0 }),
+      LLMEvent.textStart({ id: "text-1" }),
+      LLMEvent.textDelta({ id: "text-1", text: "partial" }),
+      LLMEvent.textEnd({ id: "text-1" }),
+      LLMEvent.stepFinish({ index: 0, reason: "error" }),
+      LLMEvent.finish({ reason: "error" }),
+    ],
+  ],
+  (r) => {
+    expect(r.attempts.count).toBe(1)
+    expect(r.value).toBe("stop")
+    expect(r.message.error?.name).toBe("APIError")
+    expect(r.parts).toEqual(expect.arrayContaining([expect.objectContaining({ type: "text", text: "partial" })]))
+    expect(r.seen).toContain(Session.Event.Error.type)
+  },
+)
+
+run(
+  "report but never replay an error after reasoning",
+  () => [
+    [
+      LLMEvent.stepStart({ index: 0 }),
+      LLMEvent.reasoningStart({ id: "reasoning-1" }),
+      LLMEvent.reasoningDelta({ id: "reasoning-1", text: "thinking" }),
+      LLMEvent.reasoningEnd({ id: "reasoning-1" }),
+      LLMEvent.stepFinish({ index: 0, reason: "error" }),
+      LLMEvent.finish({ reason: "error" }),
+    ],
+  ],
+  (r) => {
+    expect(r.attempts.count).toBe(1)
+    expect(r.value).toBe("stop")
+    expect(r.message.error?.name).toBe("APIError")
+  },
+)
+
+run(
+  "report but never replay an error after a tool call",
+  () => [
+    [
+      LLMEvent.stepStart({ index: 0 }),
+      LLMEvent.toolInputStart({ id: "call-1", name: "lookup" }),
+      LLMEvent.toolInputEnd({ id: "call-1", name: "lookup" }),
+      LLMEvent.toolCall({ id: "call-1", name: "lookup", input: {}, providerExecuted: true }),
+      LLMEvent.toolResult({
+        id: "call-1",
+        name: "lookup",
+        result: { type: "text", value: "ok" },
+        providerExecuted: true,
+      }),
+      LLMEvent.stepFinish({ index: 0, reason: "error" }),
+      LLMEvent.finish({ reason: "error" }),
+    ],
+  ],
+  (r) => {
+    // The point of the whole guard: one send, so the tool ran exactly once.
+    expect(r.attempts.count).toBe(1)
+    expect(r.value).toBe("stop")
+    expect(r.parts.filter((part) => part.type === "tool")).toHaveLength(1)
+  },
+)

packages/opencode/test/session/retry.test.ts

@@ -257,6 +257,20 @@ describe("session.retry.retryable", () => {
     })
   })
 
+  // FORK: the classification half of the empty-response fix, and the only new part of it. Everything
+  // downstream — five bounded attempts, the backoff, the stored error — is shared machinery that does not vary
+  // by error, so `policy stops after five retries` above already covers the bound for this one too.
+  test("retries empty provider responses", () => {
+    const request = MessageV2.fromError(
+      new ProviderError.ResponseStreamError('Provider returned no output and finished with reason "error"'),
+      { providerID },
+    )
+    expect(SessionV1.APIError.isInstance(request)).toBe(true)
+    expect(SessionRetry.retryable(request, retryProvider)).toEqual({
+      message: 'Provider returned no output and finished with reason "error"',
+    })
+  })
+
   test("does not retry context overflow errors", () => {
     const error = new SessionV1.ContextOverflowError({
       message: "Input exceeds context window of this model",