Unknown tool name written to DB before repair callback fires; stuck pending part permanently kills session on Bedrock (400 toolUse.name constraint) #28989

Activity

1. nabilfreeman commented on May 23, 2026

   

   nabilfreeman

   on May 23, 2026

   Last edited by nabilfreeman

   ContributorAuthor

   More actions

   Tracing this further — there are two viable upstream fixes and a working plugin workaround for anyone hitting this today.

   Option A: Include "invalid" in activeTools (minimal change)

   The deadlock is caused by two interacting decisions: (1) the repair callback returns "invalid", and (2) "invalid" is excluded from activeTools. If the sentinel is allowed in activeTools, the repair succeeds end-to-end — the SDK calls the sentinel's execute function, the part resolves to completed with an error message, and the session continues normally.

   // packages/opencode/src/session/llm.ts:356
   - activeTools: Object.keys(sortedTools).filter((x) => x !== "invalid"),
   + activeTools: Object.keys(sortedTools),

   The "invalid" tool already has a schema ({ tool: string, error: string }) and an execute handler in packages/opencode/src/tool/invalid.ts. The exclusion from activeTools appears intended to prevent the model from calling "invalid" deliberately — but it also blocks the repair callback from completing successfully, creating the deadlock.

   Option B: Validate the tool name before persisting (prevents DB poisoning at the source)

   In processor.ts, check the tool name before writing to the database. If the name would fail the provider constraint, skip the write — the repair callback will reroute to the "invalid" sentinel anyway:

   // packages/opencode/src/session/processor.ts, in the tool-input-start case
   const VALID_TOOL_NAME_RE = /^[a-zA-Z0-9_-]+$/
   
   case "tool-input-start":
     if (!VALID_TOOL_NAME_RE.test(value.toolName)) {
       // Don't persist — repair callback will reroute to "invalid" sentinel
       return
     }
     const part = yield* session.updatePart({ ... })

   This prevents the poisoning at the source. The trade-off is ensuring ctx.toolcalls tracking stays consistent when the write is skipped.

   ---

   Plugin Workaround

   For anyone who can't wait for an upstream fix, here's a hardened plugin that prevents the session death using two layers of defense:

   • Belt — experimental.chat.messages.transform scrubs stuck pending/running parts with invalid names before every inference call (fired at prompt.ts:1810 and compaction.ts:407). Operates per-message so a malformed entry in one message never blocks scrubbing of later messages.
   • Suspenders — the event hook listens for message.part.updated and deletes poisoned parts from the DB via DELETE /session/:sid/message/:mid/part/:pid (handlers/session.ts:366, no busy-guard, safe during an active session). Keeps the DB clean across restarts so the Belt only needs to act once.

   The plugin is completely silent — no console output, no changes to the conversation the model sees.

   // plugins/invalid-tool-guard/index.ts
   import type { Plugin } from "@opencode-ai/plugin"
   import type { Part } from "@opencode-ai/sdk"
   
   /** Valid tool names satisfy Bedrock's toolUse.name constraint */
   const VALID_TOOL_NAME_RE = /^[a-zA-Z0-9_-]+$/
   
   /** Validates IDs are safe to interpolate into URL path segments */
   const SAFE_ID_RE = /^[a-zA-Z0-9_-]+$/
   
   /**
    * Returns true if the part is a tool call stuck in pending/running with an
    * invalid name — either the "invalid" sentinel or a name that fails the
    * provider's tool name constraint.
    */
   function isPoisonedToolPart(part: Part): boolean {
     if (!part || part.type !== "tool") return false
     if (!part.state) return false
   
     const status = part.state.status
     if (status !== "pending" && status !== "running") return false
   
     // Case 1: The "invalid" sentinel injected by opencode's repair callback
     if (part.tool === "invalid") return true
   
     // Case 2: A malformed name (missing, empty, or chars outside provider constraint)
     if (typeof part.tool !== "string" || !VALID_TOOL_NAME_RE.test(part.tool)) return true
   
     return false
   }
   
   const server: Plugin = async (input) => {
     const { serverUrl } = input
   
     return {
       /**
        * Belt: scrub poisoned parts from the message array before every inference
        * call (prompt.ts:1810) and compaction (compaction.ts:407).
        *
        * Per-message try/catch: a malformed entry in one message is skipped without
        * aborting scrubbing of later messages.
        *
        * Mutation contract: msg.parts = msg.parts.filter(...) mutates in-place.
        * Replacing output.messages with a new array is a silent no-op — the consumer
        * holds the original reference.
        */
       "experimental.chat.messages.transform": async (_input, output) => {
         for (const msg of output.messages) {
           try {
             if (msg.info.role !== "assistant") continue
             msg.parts = msg.parts.filter((part) => !isPoisonedToolPart(part))
           } catch {
             // skip this message, continue processing the rest
           }
         }
       },
   
       /**
        * Suspenders: delete poisoned parts from the DB as soon as they appear.
        * IDs are validated before URL construction to reject crafted events with
        * path-traversal characters.
        */
       event: async ({ event }: { event: unknown }) => {
         try {
           const e = event as { type: string; properties: { part: Part } }
           if (e.type !== "message.part.updated") return
   
           const part = e.properties?.part
           if (!part) return
           if (!isPoisonedToolPart(part)) return
   
           if (
             !SAFE_ID_RE.test(part.sessionID) ||
             !SAFE_ID_RE.test(part.messageID) ||
             !SAFE_ID_RE.test(part.id)
           ) return
   
           const url = new URL(
             `/session/${encodeURIComponent(part.sessionID)}/message/${encodeURIComponent(part.messageID)}/part/${encodeURIComponent(part.id)}`,
             serverUrl,
           )
           await fetch(url.toString(), { method: "DELETE" })
         } catch {
           // Deletion failure is non-fatal — Belt still protects inference
         }
       },
     }
   }
   
   export default { id: "invalid-tool-guard", server }

   Save as plugins/invalid-tool-guard/index.ts (or .js) in your project root. OpenCode auto-discovers {plugin,plugins}/*.{ts,js} from the project root. No build step needed — Bun imports .ts natively.

   The Belt protects every inference call; the Suspenders keep the DB clean across restarts.

   👍React with 👍1Reacted by nullbio
2. github-actions

   assigned

   jlongster

   on May 23, 2026
3. rekram1-node

   assigned

   rekram1-node

   and unassigned

   jlongster

   on May 24, 2026
4. github-actions commented on Jul 24, 2026

   

   github-actionsBot

   on Jul 24, 2026 – with GitHub Actions

   Contributor

   More actions

   To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.
5. github-actions

   closed this as not plannedon Jul 24, 2026