auto-review fails with HTTP 400 on providers that require a session header (e.g. OpenCode Go)

[SIGN0O]

Summary

When the Auto permission preset is active and the LLM route points at a provider that requires a per-conversation routing header, every tool call is rejected with a reviewer error, making the Auto preset unusable. The cause is that auto-review does not pass sessionId to ctx.llm.stream(), so the required request header is never injected.

Affected package

@deepseek-ai/dsh-experimental-auto-review@0.2.0-rc.2

Observed behavior

With the Auto preset selected, tool calls fail with:

auto-review: reviewer ended with error
INVALID_REQUEST: 400: {"type":"MissingSessionID","message":"Request is missing x-opencode-session and cannot be routed efficiently"}

This affects all tool calls, including trivial ones, because the reviewer runs before every call.

Switching away from the Auto preset (e.g. to workspace-write or danger-full-access) makes the problem disappear immediately — confirming the fault is in the reviewer's own LLM request rather than in tool execution.

Root cause

The chain is fully deterministic:

1. auto-review calls the LLM service without sessionId
(packages/experimental/auto-review/lib/index.js, classifyRisk):

const options = deepFreeze({
  provider: snapshot.provider,
  model: snapshot.model,
  system: REVIEW_POLICY,
  messages: [{ role: "user", content: [{ type: "text", text: reviewUserText(snapshot) }] }],
  temperature: 0,
  signal
});
return readDecision(ctx.llm.stream(options));

2. dsh-llm-pi-ai forwards the field only when present
(packages/llm/pi-ai/lib/index.js):

...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },

3. @earendil-works/pi-ai injects the header only when sessionId is set
(dist/providers/opencode-headers.js):

const OPENCODE_SESSION_HEADER = "x-opencode-session";
function withSessionHeader(options) {
  if (!options?.sessionId || hasHeader(options.headers, OPENCODE_SESSION_HEADER))
    return options;                                    // <- header never added
  return { ...options, headers: { ...options.headers, [OPENCODE_SESSION_HEADER]: options.sessionId } };
}

4. The gateway rejects the request with HTTP 400 MissingSessionID.

For comparison, the normal agent loop does pass it
(packages/agent/agent-loop/lib/index.js):

return markAgentLoopRequest(Object.freeze({
  ...header.config,
  messages: boundaryMessages,
  toolHistory: session.toolHistory(),
  ...header.tools !== void 0 ? { tools: header.tools } : {},
  sessionId: this.session.id,        // <- the reviewer omits this
  signal
}));

Suggested fix

classifyRisk(ctx, agent, exec, signal) already receives agent, and auto-review already destructures agent.session elsewhere in the same file. Adding the field appears to be a one-line change:

const options = deepFreeze({
  provider: snapshot.provider,
  model: snapshot.model,
  sessionId: agent.session.id,       // <- proposed addition
  system: REVIEW_POLICY,
  messages: [{ role: "user", content: [{ type: "text", text: reviewUserText(snapshot) }] }],
  temperature: 0,
  signal
});

Notes

• auto-review's own README documents that Auto must be enabled explicitly and is experimental; this report concerns the case where a user has enabled it.
• x-opencode-session is used by OpenCode's gateway for session affinity / cache routing. Providers that do not require such a header are unaffected, which is likely why this went unnoticed.
• I have not patched anything locally — reporting only, to avoid diverging from the shipped build.

Environment

• dsh 0.2.0-rc.2
• @deepseek-ai/dsh-experimental-auto-review 0.2.0-rc.2

[dongsheng123132]

Confirmed independently on Windows 11 / DSH Desktop 0.2.0-rc.2. Adding concrete log evidence and an isolated request-capture check to this report.

Observed failures

On 2026-10-03, two local sessions recorded 21 tool/result failures with MissingSessionID (assistant retellings were excluded from the count):

Session	Time range (UTC+8)	Failed calls	Tools
A	11:03:49–11:18:43	13	subagent, pwsh, web_search, glob, write
B	10:20:04–10:23:53	8	job_output, job_list, pwsh, read

Both used the opencode-go provider. In session A, switching from deepseek-v4.1-flash to deepseek-v4-pro did not help.

Representative tool result (arguments and private identifiers omitted):

Error: Auto review of tool "pwsh" failed; its body was not executed: auto-review: reviewer ended with error INVALID_REQUEST: 400: {"type":"MissingSessionID","message":"Request is missing x-opencode-session and cannot be routed efficiently. Please see https://opencode.ai/docs/go/#where-can-i-use-it"}

Installed bundle inspection

Verified the running Desktop executable and its app.asar, rather than relying on a separate globally installed CLI version:

• @deepseek-ai/dsh-desktop, dsh-experimental-auto-review, and dsh-llm-pi-ai: 0.2.0-rc.2.
• Bundled @earendil-works/pi-ai: 0.87.1.
• Auto-review's lib/index.js:399 constructs the reviewer options without sessionId.
• The pi-ai adapter's lib/index.js:1885 only forwards options.sessionId when present.
• Bundled pi-ai's dist/providers/opencode-headers.js:6 already supports adding x-opencode-session, but returns without adding it when options.sessionId is absent.

This confirms the missing field in the auxiliary reviewer request, even with the newer pi-ai header helper present.

Isolated verification

Extracted the shipped classifyRisk function into an isolated context with a mock agent whose session ID was session-demo-a, and captured the options sent to a mock llm.stream:

1. Shipped function: options.sessionId === undefined.
2. With only sessionId: agent.session.id added in memory: options.sessionId === 'session-demo-a'.

Both assertions passed. This checks request construction only; no live installation/configuration was patched and no paid model request was made for this check. A real end-to-end regression test is still needed.

Workaround observed in existing logs

Session B switched to deepseek-official / deepseek-flash at 10:24:35 (UTC+8). Subsequent logs contain 27 successful tool results and no further MissingSessionID errors (one unrelated error remains). This is an observed recovery in that session, not a guarantee for all environments.

Suggested regression coverage: reviewer requests preserve the owning session ID; different sessions stay distinct; the OpenCode adapter emits the corresponding header; and reviewer transport errors still prevent execution of the pending tool body.

Related reports: #5495, #6467 (older main-request header path), and #8512 (web-search auxiliary path).

All evidence above is sanitized; no credentials, local project paths, actual session identifiers, or user content are included.