fix: resolve critical bugs across CLI codebase

Critical fixes:
- provider/models.ts: wrap JSON.parse in try/catch with timeout on fetch,
  add .catch() on setInterval refresh and initial startup
- cli/cmd/tui/context/sync.tsx: guard each non-blocking Promise with
  individual .catch(), replace non-null assertions (x.data!) with
  fallback defaults (x.data ?? {}), replace console.log with Log
- agent/critic.ts: change fail-safe from permissive (score 0.5, isSafe
  true) to blocking (score 0, isSafe false) on validation error
- cli/cmd/debug/agent.ts: remove new Function() code injection,
  replace with safe JSON relaxed-key parsing
- mcp/oauth-callback.ts: add 2s timeout and cleanup on isPortInUse()
  socket to prevent resource leak and hanging promises

High/Medium fixes:
- cli/cmd/web.ts: inform user to open browser manually on open() failure
- cli/upgrade.ts: log upgrade check and auto-upgrade failures instead
  of silently swallowing with .catch(() => {})
- global/index.ts: document empty catch block intention
- tool/registry.ts: replace `as any` with `as Record<string, unknown>`
- session/summary.ts: document intentional fire-and-forget pattern

https://claude.ai/code/session_01A8LkdCir3TS3uCbx9L8CAb

Author: claude

packages/opencode/src/agent/critic.ts

@@ -40,12 +40,12 @@ export namespace Critic {
 
         return result
       } catch (e) {
-        log.error("Critic validation failed, defaulting to cautious score", { error: e })
-        const fallback = {
-          score: 0.5,
-          justification: "Audit failed due to technical error.",
-          isSafe: true,
-        } as ValidationResult
+        log.error("Critic validation failed, blocking content for safety", { error: e })
+        const fallback: ValidationResult = {
+          score: 0,
+          justification: "Validation error — content blocked for safety.",
+          isSafe: false,
+        }
         GlobalBus.emit("event", { payload: { type: "critic.validated", ...fallback } })
         return fallback
       }

packages/opencode/src/cli/cmd/debug/agent.ts

@@ -95,11 +95,14 @@ function parseToolParams(input?: string) {
     try {
       return JSON.parse(trimmed)
     } catch (jsonError) {
+      // Try adding quotes around unquoted keys for relaxed JSON-like input:
+      // { foo: "bar" } → { "foo": "bar" }
       try {
-        return new Function(`return (${trimmed})`)()
-      } catch (evalError) {
+        const relaxed = trimmed.replace(/([{,]\s*)(\w+)\s*:/g, '$1"$2":')
+        return JSON.parse(relaxed)
+      } catch {
         throw new Error(
-          `Failed to parse --params. Use JSON or a JS object literal. JSON error: ${jsonError}. Eval error: ${evalError}.`,
+          `Failed to parse --params. Provide valid JSON (e.g. '{"key": "value"}'). Parse error: ${jsonError}`,
         )
       }
     }

packages/opencode/src/cli/cmd/tui/context/sync.tsx

@@ -356,7 +356,7 @@ export const { use: useSync, provider: SyncProvider } = createSimpleContext({
     const args = useArgs()
 
     async function bootstrap() {
-      console.log("bootstrapping")
+      Log.Default.info("bootstrapping")
       const start = Date.now() - 30 * 24 * 60 * 60 * 1000
       const sessionListPromise = sdk.client.session
         .list({ start: start })
@@ -408,24 +408,25 @@ export const { use: useSync, provider: SyncProvider } = createSimpleContext({
         })
         .then(() => {
           if (store.status !== "complete") setStore("status", "partial")
-          // non-blocking
+          // non-blocking — each call is individually guarded so one failure
+          // doesn't prevent the rest from completing
           Promise.all([
-            ...(args.continue ? [] : [sessionListPromise.then((sessions) => setStore("session", reconcile(sessions)))]),
-            sdk.client.command.list().then((x) => setStore("command", reconcile(x.data ?? []))),
-            sdk.client.lsp.status().then((x) => setStore("lsp", reconcile(x.data!))),
-            sdk.client.mcp.status().then((x) => setStore("mcp", reconcile(x.data!))),
-            sdk.client.experimental.resource.list().then((x) => setStore("mcp_resource", reconcile(x.data ?? {}))),
-            sdk.client.formatter.status().then((x) => setStore("formatter", reconcile(x.data!))),
+            ...(args.continue ? [] : [sessionListPromise.then((sessions) => setStore("session", reconcile(sessions))).catch(() => {})]),
+            sdk.client.command.list().then((x) => setStore("command", reconcile(x.data ?? []))).catch(() => {}),
+            sdk.client.lsp.status().then((x) => setStore("lsp", reconcile(x.data ?? {}))).catch(() => {}),
+            sdk.client.mcp.status().then((x) => setStore("mcp", reconcile(x.data ?? {}))).catch(() => {}),
+            sdk.client.experimental.resource.list().then((x) => setStore("mcp_resource", reconcile(x.data ?? {}))).catch(() => {}),
+            sdk.client.formatter.status().then((x) => setStore("formatter", reconcile(x.data ?? {}))).catch(() => {}),
             sdk.client.session.status().then((x) => {
-              setStore("session_status", reconcile(x.data!))
-            }),
-            sdk.client.provider.auth().then((x) => setStore("provider_auth", reconcile(x.data ?? {}))),
-            sdk.client.vcs.get().then((x) => setStore("vcs", reconcile(x.data))),
-            sdk.client.path.get().then((x) => setStore("path", reconcile(x.data!))),
-            syncWorkspaces(),
+              if (x.data) setStore("session_status", reconcile(x.data))
+            }).catch(() => {}),
+            sdk.client.provider.auth().then((x) => setStore("provider_auth", reconcile(x.data ?? {}))).catch(() => {}),
+            sdk.client.vcs.get().then((x) => setStore("vcs", reconcile(x.data))).catch(() => {}),
+            sdk.client.path.get().then((x) => { if (x.data) setStore("path", reconcile(x.data)) }).catch(() => {}),
+            syncWorkspaces().catch(() => {}),
           ]).then(() => {
             setStore("status", "complete")
-          })
+          }).catch(() => {})
         })
         .catch(async (e) => {
           Log.Default.error("tui bootstrap failed", {

packages/opencode/src/cli/cmd/web.ts

@@ -68,11 +68,15 @@ export const WebCommand = cmd({
       }
 
       // Open localhost in browser
-      open(localhostUrl.toString()).catch(() => {})
+      open(localhostUrl.toString()).catch(() => {
+        UI.println(UI.Style.TEXT_NORMAL, `  Open manually: ${localhostUrl}`)
+      })
     } else {
       const displayUrl = server.url.toString()
       UI.println(UI.Style.TEXT_INFO_BOLD + "  Web interface:    ", UI.Style.TEXT_NORMAL, displayUrl)
-      open(displayUrl).catch(() => {})
+      open(displayUrl).catch(() => {
+        UI.println(UI.Style.TEXT_NORMAL, `  Open manually: ${displayUrl}`)
+      })
     }
 
     await new Promise(() => {})

packages/opencode/src/cli/upgrade.ts

@@ -2,11 +2,16 @@ import { Bus } from "@/bus"
 import { Config } from "@/config/config"
 import { Flag } from "@/flag/flag"
 import { Installation } from "@/installation"
+import { Log } from "@/util/log"
+
+const log = Log.create({ service: "upgrade" })
 
 export async function upgrade() {
   const config = await Config.getGlobal()
   const method = await Installation.method()
-  const latest = await Installation.latest(method).catch(() => {})
+  const latest = await Installation.latest(method).catch((e) => {
+    log.info("failed to check for updates", { method, error: String(e) })
+  })
   if (!latest) return
 
   if (Flag.OPENCODE_ALWAYS_NOTIFY_UPDATE) {
@@ -27,5 +32,7 @@ export async function upgrade() {
   if (method === "unknown") return
   await Installation.upgrade(method, latest)
     .then(() => Bus.publish(Installation.Event.Updated, { version: latest }))
-    .catch(() => {})
+    .catch((e) => {
+      log.info("auto-upgrade failed", { version: latest, error: String(e) })
+    })
 }

packages/opencode/src/global/index.ts

@@ -58,7 +58,9 @@ export namespace Global {
             }),
           ),
         )
-      } catch (e) {}
+      } catch {
+        // Cache directory may not exist yet or items may be locked — safe to ignore
+      }
       await Filesystem.write(path.join(Global.Path.cache, "version"), CACHE_VERSION)
     }
   }

packages/opencode/src/mcp/oauth-callback.ts

@@ -184,11 +184,22 @@ export namespace McpOAuthCallback {
   export async function isPortInUse(): Promise<boolean> {
     return new Promise((resolve) => {
       const socket = createConnection(OAUTH_CALLBACK_PORT, "127.0.0.1")
-      socket.on("connect", () => {
+      const cleanup = () => {
+        socket.removeAllListeners()
         socket.destroy()
+      }
+      const timer = setTimeout(() => {
+        cleanup()
+        resolve(false)
+      }, 2000)
+      socket.on("connect", () => {
+        clearTimeout(timer)
+        cleanup()
         resolve(true)
       })
       socket.on("error", () => {
+        clearTimeout(timer)
+        cleanup()
         resolve(false)
       })
     })

packages/opencode/src/provider/models.ts

@@ -94,8 +94,15 @@ export namespace ModelsDev {
       .catch(() => undefined)
     if (snapshot) return snapshot
     if (Flag.OPENCODE_DISABLE_MODELS_FETCH) return {}
-    const json = await fetch(`${url()}/api.json`).then((x) => x.text())
-    return JSON.parse(json)
+    try {
+      const json = await fetch(`${url()}/api.json`, {
+        signal: AbortSignal.timeout(10_000),
+      }).then((x) => x.text())
+      return JSON.parse(json)
+    } catch (e) {
+      log.error("failed to fetch or parse models.dev", { error: String(e) })
+      return {}
+    }
   })
 
   export async function get() {
@@ -122,10 +129,14 @@ export namespace ModelsDev {
 }
 
 if (!Flag.OPENCODE_DISABLE_MODELS_FETCH && !process.argv.includes("--get-yargs-completions")) {
-  ModelsDev.refresh()
+  ModelsDev.refresh().catch((e) => {
+    log.error("initial models.dev refresh failed", { error: String(e) })
+  })
   setInterval(
-    async () => {
-      await ModelsDev.refresh()
+    () => {
+      ModelsDev.refresh().catch((e) => {
+        log.error("periodic models.dev refresh failed", { error: String(e) })
+      })
     },
     60 * 1000 * 60,
   ).unref()

packages/opencode/src/session/summary.ts

@@ -164,7 +164,9 @@ export namespace SessionSummary {
   const { runPromise } = makeRuntime(Service, defaultLayer)
 
   export const summarize = (input: { sessionID: SessionID; messageID: MessageID }) =>
-    void runPromise((svc) => svc.summarize(input)).catch(() => {})
+    void runPromise((svc) => svc.summarize(input)).catch(() => {
+      // Intentional fire-and-forget — summarization failure is non-critical
+    })
 
   export const DiffInput = z.object({
     sessionID: SessionID.zod,

packages/opencode/src/tool/registry.ts

@@ -78,7 +78,8 @@ export namespace ToolRegistry {
                     directory: ctx.directory,
                     worktree: ctx.worktree,
                   } as unknown as PluginToolContext
-                  const result = await def.execute(args as any, pluginCtx)
+                  // args is already validated by the AI SDK against the zod schema above
+                  const result = await def.execute(args as Record<string, unknown>, pluginCtx)
                   const out = await Truncate.output(result, {}, initCtx?.agent)
                   return {
                     title: "",