#342 fix(embedding): guard Windows Bun and support trusted headers

Summary

• disable in-process local Transformers/ONNX before import on Bun+Windows, including compatibility hosts exposing only globalThis.Bun
• degrade semantic lanes to keyword/full-text search and report the provider unavailable instead of repeatedly selecting it
• make OpenCode/Pi doctor report the target host correctly with remote/off remedies
• add trusted user-level embedding.headers; project configs cannot set them
• share runtime/doctor header construction so custom Authorization overrides api_key everywhere
• keep raw header values out of logs and durable state; hash normalized headers into a non-reversible provider identity so rotations reload the provider
• generate durable config docs for headers, Windows behavior, and current host-provider/OAuth limitation

Fixes #283
Fixes #332
Addresses #310

Host-provider boundary

The current OpenCode plugin SDK exposes no embedding hook or host OAuth delegation API. This PR implements the viable custom-header path without inventing an undocumented adapter.

Verification

• plugin full suite: 3,959 pass
• Pi full suite: 797 pass
• CLI full suite: 340 pass
• targeted plugin: 167 pass under artificial parallel load plus the one loaded timeout file passes 34/34 alone
• targeted CLI: 64 pass
• build, typecheck, lint, docs regeneration, and diff checks pass
• three Oracle review rounds: SHIP

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by cubic

Guards local embeddings under Bun on Windows and adds trusted user-level embedding.headers for openai-compatible requests. Prevents onnxruntime-node crashes, preserves keyword search, and supports header-only or non-Bearer auth without exposing secrets.

• Local embeddings on Bun+Windows: previously attempted ONNX load and could crash; now initialization is refused before import, the provider is never created, marked unavailable, and search falls back to keyword/FTS. Routing and doctor warn; the registry and coverage expose unavailableReason; status shows “Embedding unavailable … openai-compatible or off.” Windows under Node and Bun on macOS/Linux are unaffected.

• Remote headers and identity: adds user-level embedding.headers for openai-compatible. Schema validates names/values; a custom Authorization overrides api_key; header-only auth is supported. Runtime and probes share header construction; provider identity fingerprints normalized headers so rotation recreates the provider and re-embeds as needed. All header values are redacted from identity, logs, diagnostics, and config dumps; project config cannot set headers.

• Diagnostics: OpenCode and Pi doctor respect and validate headers, fail closed on invalid headers without echoing values, and warn (never pass) for local embeddings under Bun+Windows. OpenCode Desktop (Electron) is not treated as Bun.

• Migration

  • On Bun+Windows, set embedding.provider: "openai-compatible" for semantic search or "off" for keyword-only.
  • Put custom embedding headers in user-level config (embedding.headers); project configs cannot set them.
  • Configure endpoint and auth for remote embeddings; host-provider OAuth/credentials are not reused.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains.

No blocking failure remains.

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  C[Trusted user embedding config] --> R{Provider}
  R -->|local| H{Bun on Windows?}
  H -->|yes| U[Mark provider unavailable]
  U --> F[Keyword and FTS fallback]
  H -->|no| L[Load local Transformers and ONNX]
  R -->|openai-compatible| B[Build validated request headers]
  B --> A{Custom Authorization present?}
  A -->|yes| X[Use custom Authorization]
  A -->|no| K[Use api_key bearer token when configured]
  X --> E[Embedding endpoint]
  K --> E
  R -->|off| F

_{Reviews (3): Last reviewed commit: "test(cli): expect blanket header redacti..." | Re-trigger Greptile}