fix(audit): address Athena council findings from solo v0.10.1+ audit

Council flagged concrete correctness and observability bugs introduced (or
left untouched) by the recent tokenizer/sidebar work. All fixes apply to
uncommitted changes so no shipped behavior regresses.

Correctness fixes:

- `strip-content.ts` — `stripReasoningFromMergedAssistants` now strips
  `thinking` and `redacted_thinking` part types in addition to OpenCode's
  internal `reasoning`. Opus 4.7 emits wire-format `thinking` parts, and the
  workaround's whole purpose (keep thinking at position 0 in the merged
  Anthropic block) requires handling every reasoning-like type. Without
  this, two consecutive assistants each carrying a `thinking` block pass
  through unchanged and produce the exact "thinking blocks … cannot be
  modified" 400 the function was written to prevent. Adds 3 new tests
  covering `thinking`-typed consecutive runs and mixed type sequences.
- `messages-transform.ts` — distinguish SQLITE_BUSY (transient, log and
  skip) from persistent non-BUSY errors (log with full detail and persist a
  summary into `session_meta.last_transform_error`). The sidebar already
  reads that field, so persistent schema/programming failures now surface
  as a visible failure indicator instead of disabling magic-context
  silently forever.
- `event-handler.ts` + `event-payloads.ts` — invalidate the per-message
  token cache on `message.updated` (per-message, falls back to session-wide
  when the event lacks a message id) and on `session.compacted`
  (session-wide, since native compaction restructures messages).
  `MessageUpdatedAssistantInfo` gains an optional `messageID` sourced from
  `info.id`.

Hardening fixes:

- `inject-compartments.ts` — memory trim-to-budget now uses `estimateTokens`
  instead of chars/4, matching the rest of the plugin's token math. Removes
  the last unit-mismatched budget path in the injection pipeline.
- `image-token-estimate.ts` — `readUint32BE` now coerces via `>>> 0` so
  PNG headers with MSB-set bytes produce the correct unsigned value
  instead of a negative int that bypasses the `< 1` fallback. Removes
  dead `|| 0` in the WebP lossy parser; the `& 0x3fff` mask already
  produces a non-negative result.

Tests:

- `transform-index-staleness.test.ts` — the "clears reasoning before
  dropped messages" regression expected `m-reason-b`'s `thinking` to
  survive after pruning, but that expectation was only valid while
  `stripReasoningFromMergedAssistants` ignored `thinking` parts (the bug
  fixed in #2 above). Updated the assertion and comment to reflect the
  correct interaction: after pruning collapses adjacent assistants, the
  merge-strip correctly removes `thinking` from every assistant past the
  first in the run, even when the watermark wouldn't reach it.

Verified: 535 plugin tests pass, typecheck clean, build clean, lint clean
(pre-existing Intentional: warnings only).

Skipped findings (documented in synthesis.md):
- #10 self-heal oscillation (sticky-date already stabilizes main variance)
- #11 non-image attachments counted as 0 (would require document tokenization)
- #12 residual clamp masks drift (clamp-to-0 is more user-friendly than negative)

Author: ualtinok

packages/plugin/src/hooks/magic-context/event-handler.ts

@@ -39,7 +39,7 @@ import {
     resolveSessionId,
 } from "./event-resolvers";
 import { clearNoteNudgeState } from "./note-nudger";
-import type { NudgePlacementStore } from "./transform";
+import { clearMessageTokensCache, type NudgePlacementStore } from "./transform";
 import { clearCompressorCooldown } from "./transform-compartment-phase";
 
 const CONTEXT_USAGE_TTL_MS = 60 * 60 * 1000;
@@ -215,6 +215,17 @@ export function createEventHandler(deps: EventHandlerDeps) {
                 return;
             }
 
+            // Invalidate this message's cached token contribution. The message
+            // content is finalized at this event — if a prior transform pass
+            // happened to cache partial/streaming content (or the message is
+            // being edited/retried), the next pass must recompute. We fall
+            // back to session-wide clear when the event lacks a message id.
+            if (info.messageID) {
+                clearMessageTokensCache(info.sessionID, info.messageID);
+            } else {
+                clearMessageTokensCache(info.sessionID);
+            }
+
             const now = Date.now();
             const usageTokens = [
                 info.tokens?.input,
@@ -400,6 +411,10 @@ export function createEventHandler(deps: EventHandlerDeps) {
                     );
                 }
 
+                // Invalidate this message's cached token contribution so the
+                // next transform pass recomputes without stale data.
+                clearMessageTokensCache(info.sessionID, info.messageID);
+
                 deps.onSessionCacheInvalidated?.(info.sessionID);
                 sessionLog(
                     info.sessionID,
@@ -429,6 +444,10 @@ export function createEventHandler(deps: EventHandlerDeps) {
             } catch (error) {
                 sessionLog(sessionId, "event session.compacted marker cleanup failed:", error);
             }
+            // Compaction restructures messages (deletes/replaces some). Clear the
+            // per-message token cache for the whole session so the next transform
+            // pass recomputes against the new shape instead of serving stale counts.
+            clearMessageTokensCache(sessionId);
             deps.onSessionCacheInvalidated?.(sessionId);
             return;
         }
@@ -453,6 +472,7 @@ export function createEventHandler(deps: EventHandlerDeps) {
             deps.contextUsageMap.delete(sessionId);
             deps.tagger.cleanup(sessionId);
             clearCompressorCooldown(sessionId);
+            clearMessageTokensCache(sessionId);
             return;
         }
     };

packages/plugin/src/hooks/magic-context/event-payloads.ts

@@ -23,6 +23,9 @@ export interface MessageUpdatedAssistantInfo {
     role: "assistant";
     finish?: string;
     sessionID: string;
+    /** OpenCode assistant message id. Undefined only when the event payload
+     *  doesn't include one (older SDK versions or malformed events). */
+    messageID?: string;
     providerID?: string;
     modelID?: string;
     tokens?: {
@@ -92,6 +95,7 @@ export function getMessageUpdatedAssistantInfo(
         role: "assistant",
         finish: typeof info.finish === "string" ? info.finish : undefined,
         sessionID: info.sessionID,
+        messageID: typeof info.id === "string" ? info.id : undefined,
         providerID: typeof info.providerID === "string" ? info.providerID : undefined,
         modelID: typeof info.modelID === "string" ? info.modelID : undefined,
         tokens: {

packages/plugin/src/hooks/magic-context/image-token-estimate.ts

@@ -133,9 +133,11 @@ function parseWebpDimensions(b: Uint8Array): { w: number; h: number } | null {
     if (b[8] !== 0x57 || b[9] !== 0x45 || b[10] !== 0x42 || b[11] !== 0x50) return null; // WEBP
     const variant = String.fromCharCode(b[12]!, b[13]!, b[14]!, b[15]!);
     if (variant === "VP8 ") {
-        // Lossy: width/height at bytes 26-29 (14-bit each, little-endian)
-        const w = ((b[26]! | (b[27]! << 8)) & 0x3fff) || 0;
-        const h = ((b[28]! | (b[29]! << 8)) & 0x3fff) || 0;
+        // Lossy: width/height at bytes 26-29 (14-bit each, little-endian).
+        // The `& 0x3fff` already produces a non-negative 14-bit result; no
+        // extra `|| 0` fallback is needed.
+        const w = (b[26]! | (b[27]! << 8)) & 0x3fff;
+        const h = (b[28]! | (b[29]! << 8)) & 0x3fff;
         if (w && h) return { w, h };
     } else if (variant === "VP8L") {
         // Lossless: 14-bit width/height starting byte 21
@@ -166,5 +168,11 @@ function parseGifDimensions(b: Uint8Array): { w: number; h: number } | null {
 }
 
 function readUint32BE(b: Uint8Array, offset: number): number {
-    return (b[offset]! << 24) | (b[offset + 1]! << 16) | (b[offset + 2]! << 8) | b[offset + 3]!;
+    // `>>> 0` coerces to an unsigned 32-bit integer. Without it, a byte with
+    // the MSB set produces a negative value (JS bitwise ops are 32-bit
+    // signed), which would bypass downstream `< 1` guards and produce
+    // wrong token counts for malformed/untrusted PNG headers.
+    return (
+        ((b[offset]! << 24) | (b[offset + 1]! << 16) | (b[offset + 2]! << 8) | b[offset + 3]!) >>> 0
+    );
 }

packages/plugin/src/hooks/magic-context/inject-compartments.ts

@@ -9,6 +9,7 @@ import { CATEGORY_PRIORITY } from "../../features/magic-context/memory/constants
 import { getMemoriesByProject } from "../../features/magic-context/memory/storage-memory";
 import type { Memory, MemoryCategory } from "../../features/magic-context/memory/types";
 import { sessionLog } from "../../shared/logger";
+import { estimateTokens } from "./read-session-formatting";
 import type { MessageLike } from "./tag-messages";
 
 export interface PreparedCompartmentInjection {
@@ -72,8 +73,6 @@ export function renderMemoryBlock(memories: Memory[]): string | null {
     return `<project-memory>\n${sections.join("\n")}\n</project-memory>`;
 }
 
-const CHARS_PER_TOKEN_ESTIMATE = 4;
-
 /** Constraint keywords that signal a memory encodes a rule rather than a description. */
 const CONSTRAINT_KEYWORDS = /\b(must|never|always|cannot|should not|must not)\b/i;
 
@@ -101,7 +100,10 @@ function utilityTier(m: Memory): number {
  *   4. shorter content first (fit more memories in budget)
  *   5. deterministic id tiebreaker for cache stability
  *
- * Estimates ~4 chars per token for budget enforcement.
+ * Uses the real Claude tokenizer (via estimateTokens) so the trim stays
+ * consistent with the rest of the plugin's token math — mismatching units
+ * (chars/4 here vs real tokens elsewhere) caused either under- or
+ * over-injection of memories, depending on memory content shape.
  */
 function trimMemoriesToBudget(
     sessionId: string,
@@ -129,8 +131,10 @@ function trimMemoriesToBudget(
     let usedTokens = 0;
 
     for (const memory of sorted) {
-        // Estimate: category tag overhead (~20 chars) + "- " prefix + content
-        const memoryTokens = Math.ceil((memory.content.length + 22) / CHARS_PER_TOKEN_ESTIMATE);
+        // Estimate the rendered memory line ("- {content}") plus category-tag
+        // overhead using the real tokenizer. The 22-char overhead models the
+        // opening/closing XML tags amortized per item.
+        const memoryTokens = estimateTokens(`- ${memory.content}`) + 6;
         if (usedTokens + memoryTokens > budgetTokens) {
             break;
         }

packages/plugin/src/hooks/magic-context/strip-content.test.ts

@@ -724,5 +724,177 @@ describe("strip-content", () => {
                 expect(a2.parts).toHaveLength(1);
             });
         });
+
+        describe("#given a single assistant with reasoning NOT at content position 0", () => {
+            it("#then strips the reasoning (would land at non-zero in merged block)", () => {
+                const u = message("u", "user", [{ type: "text", text: "q" }]);
+                const a1 = message("a1", "assistant", [
+                    { type: "text", text: "t1" },
+                    { type: "reasoning", text: "r1" },
+                    { type: "text", text: "t2" },
+                ]);
+                const messages = [u, a1];
+
+                const stripped = stripReasoningFromMergedAssistants(messages);
+
+                expect(stripped).toBe(1);
+                expect(a1.parts.map((p) => (p as { type: string }).type)).toEqual(["text", "text"]);
+            });
+        });
+
+        describe("#given a single assistant with step-start before reasoning", () => {
+            it("#then keeps the reasoning (step-start is metadata AI SDK ignores)", () => {
+                const u = message("u", "user", [{ type: "text", text: "q" }]);
+                const a1 = message("a1", "assistant", [
+                    { type: "step-start" },
+                    { type: "reasoning", text: "r1" },
+                    { type: "text", text: "t1" },
+                ]);
+                const messages = [u, a1];
+
+                const stripped = stripReasoningFromMergedAssistants(messages);
+
+                expect(stripped).toBe(0);
+                expect(a1.parts).toHaveLength(3);
+            });
+        });
+
+        describe("#given a single assistant with many interleaved reasoning parts", () => {
+            it("#then keeps only the first reasoning and strips the rest", () => {
+                // Mirrors the worst-case observed in opus-4.7 output: one OpenCode
+                // message with many reasoning parts interleaved with text/tool.
+                const u = message("u", "user", [{ type: "text", text: "go" }]);
+                const a1 = message("a1", "assistant", [
+                    { type: "step-start" },
+                    { type: "reasoning", text: "r1" },
+                    { type: "text", text: "t1" },
+                    { type: "reasoning", text: "r2" },
+                    { type: "reasoning", text: "r3" },
+                    { type: "reasoning", text: "r4" },
+                    { type: "reasoning", text: "r5" },
+                    { type: "tool", state: { status: "completed" } },
+                    { type: "step-finish" },
+                ]);
+                const messages = [u, a1];
+
+                const stripped = stripReasoningFromMergedAssistants(messages);
+
+                expect(stripped).toBe(4);
+                expect(a1.parts.map((p) => (p as { type: string }).type)).toEqual([
+                    "step-start",
+                    "reasoning",
+                    "text",
+                    "tool",
+                    "step-finish",
+                ]);
+            });
+        });
+
+        describe("#given first assistant has text before reasoning, second has reasoning at pos 0", () => {
+            it("#then strips reasoning from BOTH (can't repair the run)", () => {
+                // Because reasoning in a1 is NOT at content position 0, we strip
+                // it. Subsequent assistants in the same run lose reasoning too,
+                // since only one reasoning per run is allowed.
+                const u = message("u", "user", [{ type: "text", text: "q" }]);
+                const a1 = message("a1", "assistant", [
+                    { type: "text", text: "t1" },
+                    { type: "reasoning", text: "r1" },
+                ]);
+                const a2 = message("a2", "assistant", [
+                    { type: "reasoning", text: "r2" },
+                    { type: "text", text: "t2" },
+                ]);
+                const messages = [u, a1, a2];
+
+                const stripped = stripReasoningFromMergedAssistants(messages);
+
+                expect(stripped).toBe(2);
+                expect(a1.parts.map((p) => (p as { type: string }).type)).toEqual(["text"]);
+                expect(a2.parts.map((p) => (p as { type: string }).type)).toEqual(["text"]);
+            });
+        });
+
+        describe("#given two consecutive assistants each with 'thinking' (wire-format) parts", () => {
+            it("#then keeps thinking on the first and strips from the second", () => {
+                // opus-4.7 can produce wire-format "thinking" parts (not just
+                // OpenCode's internal "reasoning"). The merge-workaround must
+                // treat them the same, otherwise the merged Anthropic block
+                // ends up with thinking interleaved — the exact 400 error this
+                // function exists to prevent.
+                const u = message("u", "user", [{ type: "text", text: "go" }]);
+                const a1 = message("a1", "assistant", [
+                    { type: "thinking", thinking: "t1-think", signature: "sig1" },
+                    { type: "text", text: "r1" },
+                ]);
+                const a2 = message("a2", "assistant", [
+                    { type: "thinking", thinking: "t2-think", signature: "sig2" },
+                    { type: "text", text: "r2" },
+                ]);
+                const messages = [u, a1, a2];
+
+                const stripped = stripReasoningFromMergedAssistants(messages);
+
+                expect(stripped).toBe(1);
+                expect(a1.parts).toHaveLength(2);
+                expect((a1.parts[0] as { type: string }).type).toBe("thinking");
+                expect(a2.parts).toHaveLength(1);
+                expect((a2.parts[0] as { type: string }).type).toBe("text");
+            });
+        });
+
+        describe("#given mixed reasoning/thinking/redacted_thinking types across a run", () => {
+            it("#then treats all three as reasoning-like (keep first, strip rest)", () => {
+                const u = message("u", "user", [{ type: "text", text: "go" }]);
+                const a1 = message("a1", "assistant", [
+                    { type: "reasoning", text: "r1" },
+                    { type: "text", text: "answer1" },
+                ]);
+                const a2 = message("a2", "assistant", [
+                    { type: "thinking", thinking: "t2", signature: "sig2" },
+                    { type: "text", text: "answer2" },
+                ]);
+                const a3 = message("a3", "assistant", [
+                    { type: "redacted_thinking", data: "opaque3" },
+                    { type: "text", text: "answer3" },
+                ]);
+                const messages = [u, a1, a2, a3];
+
+                const stripped = stripReasoningFromMergedAssistants(messages);
+
+                // Keep a1.reasoning (first-in-run, position 0), strip a2.thinking
+                // and a3.redacted_thinking.
+                expect(stripped).toBe(2);
+                expect(a1.parts.map((p) => (p as { type: string }).type)).toEqual([
+                    "reasoning",
+                    "text",
+                ]);
+                expect(a2.parts.map((p) => (p as { type: string }).type)).toEqual(["text"]);
+                expect(a3.parts.map((p) => (p as { type: string }).type)).toEqual(["text"]);
+            });
+        });
+
+        describe("#given first assistant has text before a thinking-typed block", () => {
+            it("#then strips the thinking block from first AND second assistant", () => {
+                // If thinking is NOT at content position 0 in the first
+                // assistant, no thinking can land at position 0 of the merged
+                // block — so strip from every assistant in the run.
+                const u = message("u", "user", [{ type: "text", text: "q" }]);
+                const a1 = message("a1", "assistant", [
+                    { type: "text", text: "prelude" },
+                    { type: "thinking", thinking: "t1", signature: "sig1" },
+                ]);
+                const a2 = message("a2", "assistant", [
+                    { type: "thinking", thinking: "t2", signature: "sig2" },
+                    { type: "text", text: "answer" },
+                ]);
+                const messages = [u, a1, a2];
+
+                const stripped = stripReasoningFromMergedAssistants(messages);
+
+                expect(stripped).toBe(2);
+                expect(a1.parts.map((p) => (p as { type: string }).type)).toEqual(["text"]);
+                expect(a2.parts.map((p) => (p as { type: string }).type)).toEqual(["text"]);
+            });
+        });
     });
 });