paseo-omp: unexpected session-open exceptions are discarded without diagnostics

[Trevor-Mengel]

At commit 854f4e6, paseo-omp/server/provider/connection.ts:269 returns only the fallback for every error that is not an OmpPublicError:

function errorDetails(error: unknown, fallback: string): { message: string } {
  return { message: isOmpPublicError(error) ? error.message : fallback };
}

The session-open catch at line 800 calls this with OMP session failed to open, without retaining or logging the cause. We observed four failed opens on September 16 plus a fresh failed create after setting the supported per-call params.sessionDir. All surface the same message. Direct replication of the restricted spawn command reaches the RPC ready handshake, so the lost exception is the useful next diagnostic.

Please preserve a value-safe diagnostic at the collapse boundary (error class, sanitized message/stack and request correlation), while keeping the public response generic. Avoid logging environment, credential values or prompt content. A regression test should make an unexpected open exception visible in diagnostic output, without exposing those values.

Related local evidence: https://github.com/Trevor-Mengel/global-dev-governance/issues/377 . No credential data included.

[Trevor-Mengel]

The hidden exception is now reproduced on this host: get_state succeeds, then get_available_models fails with OMP RPC response exceeded command limits. The governed profile returns 53 models in 98,771 bytes; the generic response walk allows only 2,048 nodes. This is below the byte cap but above the node cap.

A scratch-only patch gives get_available_models a bounded 16,384-node budget, leaving generic state/command responses at 2,048. The regression fails before the patch, passes after, and still rejects oversized catalogs and oversized generic state. All 55 RPC tests pass; the same actual profile command through createOmpConnection reaches session.ready. Installed plugin source is unchanged.

Suggested patch and test (synthetic model data only):

diff --git a/paseo-omp/server/provider/omp-rpc.ts b/paseo-omp/server/provider/omp-rpc.ts
index 2a41f34..ab2904f 100644
--- a/paseo-omp/server/provider/omp-rpc.ts
+++ b/paseo-omp/server/provider/omp-rpc.ts
@@ -2116,7 +2116,10 @@ class OmpRpcProcess {
       isBranchHistory || isHistory
         ? Math.min(MAX_REASSEMBLED_FRAME_BYTES, this.reassembledFrameLimit)
         : 2 * 1024 * 1024;
-    const responseNodeLimit = isBranchHistory ? 4_096 : isHistory ? 400_000 : 2_048;
+    // A model catalog contains up to 256 structured models, so its aggregate
+    // node budget must exceed the small state/command-response budget.
+    const responseNodeLimit = isBranchHistory ? 4_096 : isHistory ? 400_000
+      : pending.command === "get_available_models" ? 16_384 : 2_048;
     if (
       boundedJsonBytes(
         frame,
diff --git a/paseo-omp/tests/omp-rpc.test.ts b/paseo-omp/tests/omp-rpc.test.ts
index a99eb5d..6c7b799 100644
--- a/paseo-omp/tests/omp-rpc.test.ts
+++ b/paseo-omp/tests/omp-rpc.test.ts
@@ -133,6 +133,39 @@ function nextEvent(
 }
 
 describe("OMP RPC transport", () => {
+  test("accepts a bounded multi-provider model catalog without relaxing other response limits", async () => {
+    const child = new FakeRpcChild();
+    let oversized = false;
+    const models = Array.from({ length: 53 }, (_, index) => ({
+      provider: `provider-${index % 3}`, id: `model-${index}`, reasoning: true,
+      thinking: { efforts: Array.from({ length: 16 }, (_, n) => `effort-${n}`), defaultLevel: "high" },
+      input: Array.from({ length: 16 }, (_, n) => `input-${n}`),
+      contextWindow: 200_000,
+    }));
+    observeCommands(child, command => {
+      if (command.type === "negotiate_protocol") {
+        child.write({ type: "response", id: command.id, success: true, data: { protocolVersion: 2 } });
+      } else if (command.type === "get_available_models") {
+        child.write({ type: "response", id: command.id, success: true, data: {
+          models: oversized ? models.map(model => ({ ...model, extra: Array(512).fill(0) })) : models,
+        } });
+      } else if (command.type === "get_state") {
+        child.write({ type: "response", id: command.id, success: true, data: { nested: models } });
+      }
+    });
+    const opening = runtimeFor(child).startSession({ cwd: "/repo", mode: "full" });
+    child.write(READY_FRAME);
+    const session = await opening;
+    try {
+      expect(await session.getAvailableModels()).toHaveLength(53);
+      await expect(session.getState()).rejects.toThrow("response exceeded command limits");
+      oversized = true;
+      await expect(session.getAvailableModels()).rejects.toThrow("response exceeded command limits");
+    } finally {
+      await session.close();
+    }
+  });
+
   test("sends steering and out-of-band commands with native wire shapes", async () => {
     const child = new FakeRpcChild();
     const launches: OmpSpawnRequest[] = [];