From 2e018f70f2d13080de3dd5fda8720acf77ebd296 Mon Sep 17 00:00:00 2001
From: "opencode-agent[bot]"
 <219766164+opencode-agent[bot]@users.noreply.github.com>
Date: Wed, 16 Sep 2026 16:47:21 +0000
Subject: [PATCH] fix(stats): guard oversized model names (#49363)

Co-authored-by: adamdotdevin <2363879+adamdotdevin@users.noreply.github.com>
---
 packages/stats/core/src/domain/inference.test.ts   | 14 ++++++++++++++
 packages/stats/core/src/domain/inference.ts        |  9 +++++++--
 .../stats/core/src/domain/model-normalization.ts   |  4 +++-
 3 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/packages/stats/core/src/domain/inference.test.ts b/packages/stats/core/src/domain/inference.test.ts
index 8f6dbeaf023..7660d174dcb 100644
--- a/packages/stats/core/src/domain/inference.test.ts
+++ b/packages/stats/core/src/domain/inference.test.ts
@@ -57,6 +57,20 @@ describe("inference stat normalization", () => {
     expect(statProvider("unknown", "", "custom-provider")).toBe("custom-provider")
   })
 
+  test("maps oversized model ids to unknown before aggregation", () => {
+    expect(statModel("x".repeat(256), "")).toBe("x".repeat(256))
+    expect(statModel("x".repeat(257), "")).toBe("unknown")
+    expect(statModel("big-pickle", `provider/${"x".repeat(257)}`)).toBe("unknown")
+
+    const [query] = buildStatsQueries(new Date("2026-09-16T00:00:00.000Z"), new Date("2026-09-16T04:00:00.000Z"), {
+      namespace: "inference",
+      table: "generation",
+      dataset: "zen",
+    })
+    expect(query).toContain("WHEN length(")
+    expect(query).toContain(") > 256 THEN 'unknown'")
+  })
+
   test("keeps stealth model usage without exposing the route provider", () => {
     expect(statProvider("omen-alpha", "gpt-test-model", "test-provider")).toBe("unknown")
     expect(statProvider("OMEN-ALPHA-free:global", "gpt-test-model", "test-provider")).toBe("unknown")
diff --git a/packages/stats/core/src/domain/inference.ts b/packages/stats/core/src/domain/inference.ts
index 2b695e4ad94..963516625dd 100644
--- a/packages/stats/core/src/domain/inference.ts
+++ b/packages/stats/core/src/domain/inference.ts
@@ -6,6 +6,7 @@ import {
   EXCLUDED_MODELS,
   FREE_MODELS,
   MODEL_AUTHOR_RULES,
+  MODEL_NAME_MAX_LENGTH,
   MODEL_NAME_ALIASES,
   RETIRED_STAT_PROVIDERS,
   STEALTH_MODELS,
@@ -466,12 +467,16 @@ function statModelSql(model: string, providerModel: string) {
       WHEN lower(${model}) = 'big-pickle' THEN regexp_replace(NULLIF(${providerModel}, ''), '^.*/', '')
       ELSE ${model}
     END, '(-free|:free|:global)+$', '')`
-  return `COALESCE(NULLIF(CASE
+  const value = `CASE
 ${Object.entries(MODEL_NAME_ALIASES)
   .map(([from, to]) => `      WHEN lower(${normalized}) = ${sqlString(from)} THEN ${sqlString(to)}`)
   .join("\n")}
       ELSE ${normalized}
-    END, ''), 'unknown')`
+    END`
+  return `CASE
+      WHEN length(${value}) > ${MODEL_NAME_MAX_LENGTH} THEN 'unknown'
+      ELSE COALESCE(NULLIF(${value}, ''), 'unknown')
+    END`
 }
 
 function freeTierSql(tier: string, model: string) {
diff --git a/packages/stats/core/src/domain/model-normalization.ts b/packages/stats/core/src/domain/model-normalization.ts
index 4f0ec064882..b2bffd5fc3e 100644
--- a/packages/stats/core/src/domain/model-normalization.ts
+++ b/packages/stats/core/src/domain/model-normalization.ts
@@ -16,6 +16,7 @@ export const MODEL_AUTHOR_RULES = [
 export const EXCLUDED_MODELS = new Set(["alpha-gpt-next"])
 export const STEALTH_MODELS = new Set(["omen-alpha"])
 export const FREE_MODELS = new Set(["gpt-5-nano", "grok-code", "big-pickle"])
+export const MODEL_NAME_MAX_LENGTH = 256
 export const MODEL_NAME_ALIASES: Record<string, string> = {
   "deepseek-flash": "deepseek-v4.1-flash",
   "deepseek-v4-flash-0731": "deepseek-v4-flash",
@@ -41,7 +42,8 @@ export function modelAuthor(value: string | undefined) {
 export function statModel(model: string | undefined, providerModel: string | undefined) {
   const normalized = normalizeInferenceModel(model)
   const resolved = normalized === "big-pickle" ? normalizeInferenceModel(providerModel?.split("/").at(-1)) : normalized
-  return MODEL_NAME_ALIASES[resolved.toLowerCase()] ?? resolved
+  const value = MODEL_NAME_ALIASES[resolved.toLowerCase()] ?? resolved
+  return value.length > MODEL_NAME_MAX_LENGTH ? "unknown" : value
 }
 
 export function statProvider(