Auto review fails on providers that require a per-session routing header (opencode-go: MissingSessionID) — the review request omits GenerateOptions.sessionId

[DMIAOCHEN]

环境

• dsh 0.2.0-rc.2（web profile，/permission auto）
• @deepseek-ai/dsh-experimental-auto-review 0.2.0-rc.2
• LLM 路由：pi-ai 内置目录 provider opencode-go，model deepseek-v4.1-flash（agent-default-model.reasoningEffort: high）
• 主对话完全正常；只有 Auto review 的审查请求失败

现象

开启 Auto review 后，每次工具调用（原生与 PTC 内层）都失败、fail-closed（工具体不执行）：

Error: Auto review of tool "pwsh" failed; its body was not executed: auto-review: reviewer ended with error INVALID_REQUEST: 400:
{"type":"MissingSessionID","message":"Request is missing x-opencode-session and cannot be routed efficiently. Please see https://opencode.ai/docs/go/#where-can-i-use-it"}

根因链

1. pi-ai（@earendil-works/pi-ai@0.87.1）的 dist/providers/opencode-headers.js 为 opencode / opencode-go 注入必需的路由头，条件是请求选项里带 sessionId：

   function withSessionHeader(options) {
     if (!options?.sessionId || hasHeader(options.headers, "x-opencode-session")) return options;
     return { ...options, headers: { ...options.headers, "x-opencode-session": options.sessionId } };
   }

2. packages/llm/llm-pi-ai/src/adapter.ts 的 streamWithSnapshot() 把请求的 sessionId 原样透传给 pi-ai：

   ...options.sessionId === undefined ? {} : { sessionId: String(options.sessionId) },
   headers: requestHeaders(profile.headers),

3. 主对话：agent-loop 强制每条请求携带 session id（packages/core/agent-loop/src/invariant.ts: "a loop-built request must carry a session id"；agent.ts 里 sessionId: this.session.id）→ 头存在 → 网关正常路由。

4. Auto review：packages/experimental/auto-review/src/index.ts 的 classifyRisk() 构造的 GenerateOptions 只包含 provider / model / system / messages / temperature: 0 / signal —— 没有 sessionId → pi-ai 不加头 → opencode 网关 400 MissingSessionID → reviewer 失败 → 该工具调用失败。

影响

凡是对请求路由有会话级要求的 provider（至少 opencode / opencode-go）都无法与 Auto review 共用：Auto 模式在这些路由下完全不可用（每次工具调用都会失败）。

现有绕过（及其代价）

• 避开该类 provider（改用不需要该头的路由）时 Auto 正常；
• 或在 provider profile 里声明静态头：headers: { x-opencode-session: <稳定值> }。因为 pi-ai 的 hasHeader 检查同时作用于主对话，主对话也会改用这个静态值，失去按会话的路由亲和（多会话时缓存/路由效率下降），所以只算权宜之计。

建议修复

让 reviewer 请求继承当前会话的 sessionId。它是传输层的路由元数据、不会进入审查内容，因此与 README 中"审查输入不含持久身份或来源"的设计并不冲突（隐私边界在审查内容，不在传输头）。

顺带一个同源建议：审查请求同样应当继承会话当前的 reasoning effort —— 相关缺陷另见 #8670（本条的根因是缺失 sessionId，那条是缺失 reasoningEffort，属于同一类"reviewer 请求未继承会话请求上下文"的问题）。

感谢！

[DMIAOCHEN]

Workaround available for this one. I hit it exactly as reported — a review route pinned to opencode-go failed on every call with MissingSessionID — and shipped a small plugin that covers this issue and #8670.

What it changes for this report: the review request now carries GenerateOptions.sessionId (taken from the session being reviewed), so a provider that requires the per-session routing header works instead of rejecting the call.

Also in the same plugin (the #8670 half): the request carries the session's reasoning level plus a capability-checked fallback level, and if a pinned review route cannot take that level, the review retries once without it instead of failing every call of that session.

Extra: a per-session reviewer-model picker — review with a different model than the one under review, stored per session, resettable to "follow the session model".

Install (dsh 0.2.0-rc.2, Node >= 22):

npx -y @deepseek-ai/dsh plugin --profile web add github:DMIAOCHEN/dsh-auto-review-plus#v0.1.1

then restart dsh web.

Disclosure — please read before installing:

• It re-registers the auto preset, and a shipped patch disables the official auto-review row while it is installed. Uninstalling restores the official one (live Auto sessions are migrated to Full access on uninstall).
• Verified end-to-end in a real session, including a pinned opencode-go review route. It is still one person's stopgap: it decides your approvals, so read the source (MIT, small) before trusting it.
• Derived from packages/experimental/auto-review and packages/client/ui-permission-presets; the upstream copyright line and the derived-file list are in NOTICE.
• It should be dropped as soon as this is fixed upstream — that is written into its README.

Repo + design notes: https://github.com/DMIAOCHEN/dsh-auto-review-plus