Port to OpenCode V2 with a provider-agnostic vision model - #6

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: dfd338ee-83c9-4647-a560-be760d4b7433

---

📥 Commits

Reviewing files that changed from the base of the PR and between 7a63931 and 459b94d.

---

📒 Files selected for processing (3)

• src/vision.ts
• test/plugin.test.ts
• test/vision.test.ts

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The plugin now uses the OpenCode v2 API. It resolves vision-model settings, transforms supported images for text-only active models, and registers context and compaction hooks. The changes also update package configuration, documentation, and tests.

Changes

Image transcription

Layer / File(s)	Summary
Vision settings and session lifecycle src/vision.ts, test/vision.test.ts	Settings resolve from plugin options or environment values. The describer submits images to restricted sessions, extracts assistant text, and handles timeouts and interruption cleanup.
Image content transformation src/transform.ts, test/transform.test.ts	Message and tool-result images are validated and replaced with descriptions or omission text. Descriptions use nonce markers, a bounded LRU cache, and a concurrency limit.
OpenCode v2 request hooks and packaging src/index.ts, src/capabilities.ts, src/config.ts, test/plugin.test.ts, test/capabilities.test.ts, test/config.test.ts, README.md, package.json, index.js	The plugin checks request-model image support and registers context and compaction hooks. Tests cover request handling, capability lookup, and setup guards. The README and package configuration describe the v2 plugin setup. index.js re-exports the built entry point.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant OpenCodeHost
  participant createEyesight
  participant HostModelList
  participant transcribeMessages
  participant createDescriber
  participant VisionSession
  OpenCodeHost->>createEyesight: invokes context or compaction hook
  createEyesight->>HostModelList: checks request model image support
  HostModelList-->>createEyesight: returns model data or lookup failure
  createEyesight->>transcribeMessages: transforms images for text-only model
  transcribeMessages->>createDescriber: requests image description
  createDescriber->>VisionSession: creates session and submits image
  VisionSession-->>createDescriber: returns assistant text

Loading

---

Merge Risk: ⚪ Minimal · up to 459b9

No actionable issue is established from the supplied changes; merge after normal checks.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 459b9

Additional histories containing images and descriptions are now retained rather than cleaned up. The design includes access restrictions and input controls, but isolation after completion and cleanup after interruption still require validation.

Retained concerns

• Medium · security · inferred: The base attempted to delete each auxiliary vision session after use; the new lifecycle intentionally retains image-bearing sessions and descriptions after success or failure. The 256-entry memory cache does not bound these retained histories, and cache misses can create further histories for images in old messages. This extends sensitive-data retention and makes its lifetime dependent on external retention controls. The behavior is documented, but those controls are not supplied; this is a privacy-lifecycle concern, not a verified disclosure.

Security review details

Security Blast Radius

• inferred — An attachment author or tool-response source can control image content processed through the configured provider when a known text-only request reaches the hooks. The relevant exposure is image content, derived descriptions, retained auxiliary histories, and provider resources available to the host. The supplied evidence does not establish additional tenant, environment, or administrative reach.

Security Findings and Attack Paths

• inferred — The supported PR-specific security concern is longer auxiliary-history retention, rather than a demonstrated permission bypass. Image content is explicitly submitted to a session that is no longer deleted by the plugin, extending the lifetime of an additional copy and its description.

Trust Boundaries and Controls

• observed — The image-loading boundary accepts supported inline representations, rejects remote URLs, and applies a 20 MB decoded-size limit. These controls avoid adding plugin-side remote retrieval and constrain individual images before description.
• observed — Descriptions cross back into the active request as untrusted text. Nonce-bearing delimiters, marker neutralisation, and a system notice distinguish image-derived content from instructions; the vision prompt also directs transcription rather than execution. These are instruction-level controls, not proof that arbitrary image instructions cannot influence a downstream response.
• inferred — Tool isolation after successful completion depends on persistent host permission enforcement because the retained session is no longer in the internal-ID set. Local tests establish live-session tool removal, but do not establish production permission behavior or subsequent retained-session requests. This remains an evidence gap rather than an observed escape.

Resilience and Maintainability Implications

• observed — The four-slot limiter bounds outer description promises, not every unsettled host operation. After bounded interruption, failed descriptions can return while detached cleanup still awaits work; the slot is then released even though the internal-session guard remains. Effective resource containment therefore depends on host cancellation behavior.

Hardening Proposals

• proposed — Define the retention and access policy for auxiliary image histories. If indefinite retention is unnecessary, use supported expiry or cleanup facilities; otherwise document the additional copies and their ownership explicitly.
• proposed — Validate persistent deny permissions, retained-session requests, and interruption completion against the supported production host. Where interruption cannot conclusively stop work, consider an outstanding-session budget that remains charged through recovery rather than only through the returned description promise.

---

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 47.06% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 17 functions across 7 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly summarizes the main changes: migration to OpenCode v2 and use of a provider-agnostic vision model.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

🧪 Generate unit tests (beta)

• Create a new PR

---

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.