mixdog 0.9.0 → 0.9.2

package/src/runtime/agent/orchestrator/providers/model-catalog.mjs

@@ -14,9 +14,10 @@
  * a stale number.
  */
 
-import { existsSync, readFileSync, writeFileSync } from 'fs';
+import { existsSync, readFileSync } from 'fs';
 import { join } from 'path';
 import { getPluginData } from '../config.mjs';
+import { writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
 
 const CATALOG_URL = 'https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json';
 const CATALOG_CACHE_FILE = 'litellm-catalog.json';
@@ -187,7 +188,7 @@ async function _loadCatalogImpl() {
         if (!res.ok) throw new Error('HTTP ' + res.status);
         const data = await res.json();
         try {
-            writeFileSync(cachePath(), JSON.stringify({ fetchedAt: Date.now(), data }));
+            writeJsonAtomicSync(cachePath(), { fetchedAt: Date.now(), data }, { lock: true, compact: true, fsyncDir: true, timeoutMs: 1000 });
         } catch { /* cache is best-effort */ }
         _memCache = data;
         _memCacheAt = Date.now();
@@ -239,7 +240,7 @@ async function _loadModelsDevImpl() {
         if (!res.ok) throw new Error('HTTP ' + res.status);
         const data = await res.json();
         try {
-            writeFileSync(mdCachePath(), JSON.stringify({ fetchedAt: Date.now(), data }));
+            writeJsonAtomicSync(mdCachePath(), { fetchedAt: Date.now(), data }, { lock: true, compact: true, fsyncDir: true, timeoutMs: 1000 });
         } catch { /* cache is best-effort */ }
         _mdCache = data;
         _mdCacheAt = Date.now();
@@ -430,12 +431,12 @@ export async function enrichModels(models) {
             outputCostPerM: meta.outputCostPerM,
             cacheReadCostPerM: meta.cacheReadCostPerM,
             cacheWriteCostPerM: meta.cacheWriteCostPerM,
-            supportsVision: meta.supportsVision,
-            supportsFunctionCalling: meta.supportsFunctionCalling,
+            supportsVision: m.supportsVision === true || meta.supportsVision,
+            supportsFunctionCalling: m.supportsFunctionCalling === true || meta.supportsFunctionCalling,
             supportsWebSearch: meta.supportsWebSearch || m.supportsWebSearch === true,
-            supportsPromptCaching: meta.supportsPromptCaching,
-            supportsReasoning: meta.supportsReasoning,
-            reasoningOptions: meta.reasoningOptions || m.reasoningOptions || [],
+            supportsPromptCaching: m.supportsPromptCaching === true || meta.supportsPromptCaching,
+            supportsReasoning: m.supportsReasoning === true || meta.supportsReasoning,
+            reasoningOptions: m.reasoningOptions?.length ? m.reasoningOptions : (meta.reasoningOptions || []),
             reasoningContentField: meta.reasoningContentField || m.reasoningContentField || null,
             mode: meta.mode || m.mode || null,
         };
@@ -472,3 +473,12 @@ export async function warmModelMetadataCatalogs() {
     const [litellm] = await Promise.all([loadCatalog(), loadModelsDevCatalog()]);
     return litellm;
 }
+
+/** Fire-and-forget warm of both in-memory catalog caches (disk-first, then remote). */
+export async function warmCatalogsInBackground() {
+    try {
+        await Promise.all([loadCatalog(), loadModelsDevCatalog()]);
+    } catch {
+        /* never throw — boot/statusline must not fail on catalog warm */
+    }
+}

package/src/runtime/agent/orchestrator/providers/openai-compat-stream.mjs

@@ -1,12 +1,28 @@
 import {
     PROVIDER_FIRST_BYTE_TIMEOUT_MS,
-    PROVIDER_SSE_IDLE_TIMEOUT_MS,
     PROVIDER_SSE_IDLE_WATCHDOG_ENABLED,
+    PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS,
+    streamStalledError,
     createTimeoutSignal,
     providerTimeoutError,
 } from '../stall-policy.mjs';
 import { populateHttpStatusFromMessage } from './retry-classifier.mjs';
 import { customToolCallFromResponseItem } from './custom-tool-wire.mjs';
+import { createLeakGuard, createToolCallDedupe, dedupeToolCallList } from './anthropic-leaked-toolcall.mjs';
+import { randomBytes } from 'crypto';
+
+// Synthesize a native-shaped OpenAI tool call from a recovered leaked call.
+// Matches the `call_...` id scheme the native Responses/Chat paths use so the
+// dispatch loop and any downstream tool_result reference line up.
+function synthLeakedOpenAICall(recovered) {
+    let args = recovered?.arguments;
+    if (args === null || typeof args !== 'object' || Array.isArray(args)) args = {};
+    return {
+        id: `call_leaked_${randomBytes(8).toString('hex')}`,
+        name: recovered.name,
+        arguments: args,
+    };
+}
 
 function truncatedCompatStreamError(label, detail) {
     return Object.assign(
@@ -87,17 +103,29 @@ function firstByteCompatStreamError(label) {
     return err;
 }
 
-async function nextAsyncWithWatchdog(iterator, { signal, idleMs, idleEnabled, idleLabel } = {}) {
+async function nextAsyncWithWatchdog(iterator, { signal, idleMs, idleEnabled, idleLabel, emittedToolCall } = {}) {
     let idleTimer = null;
     let idleReject = null;
     let idleTimedOut = false;
+    // Double-dispatch guard (reviewer High): if a tool call was already emitted
+    // this stream, a stall must be unsafe-to-retry so withRetry() won't replay
+    // the turn and re-run the side-effecting tool. `emittedToolCall` may be a
+    // boolean or a getter evaluated at abort time (state mutates mid-stream).
+    const didEmitToolCall = () => {
+        try { return typeof emittedToolCall === 'function' ? !!emittedToolCall() : !!emittedToolCall; }
+        catch { return false; }
+    };
     const armIdle = () => {
         if (!idleEnabled || !(idleMs > 0)) return;
         if (idleTimer) clearTimeout(idleTimer);
         idleTimer = setTimeout(() => {
             idleTimedOut = true;
-            const e = providerTimeoutError(idleLabel || 'compat SSE idle', idleMs);
-            e.code = 'ETIMEDOUT';
+            // SEMANTIC idle abort: this timer is (re)armed only around waiting
+            // for the NEXT stream event, so keepalive/comment frames the SDK
+            // filters out cannot keep it alive. Throw the named terminal
+            // StreamStalledError so the retry-classifier treats it as a stream
+            // failure (owner gets notified) rather than a user cancel.
+            const e = streamStalledError(idleLabel || 'compat SSE', idleMs, { emittedToolCall: didEmitToolCall() });
             if (idleReject) {
                 const r = idleReject;
                 idleReject = null;
@@ -143,7 +171,7 @@ async function nextAsyncWithWatchdog(iterator, { signal, idleMs, idleEnabled, id
         return result;
     } catch (err) {
         if (idleTimer) clearTimeout(idleTimer);
-        if (idleTimedOut) throw providerTimeoutError(idleLabel || 'compat SSE idle', idleMs);
+        if (idleTimedOut) throw streamStalledError(idleLabel || 'compat SSE', idleMs, { emittedToolCall: didEmitToolCall() });
         throw err;
     }
 }
@@ -213,6 +241,15 @@ function emitCompatToolCallOnce(state, call, onToolCall) {
     const key = `id:${call.id}`;
     if (!state.emittedToolCallKeys) state.emittedToolCallKeys = new Set();
     if (state.emittedToolCallKeys.has(key)) return false;
+    // Fix 2: cross-path name+args dedupe. A synthesized text-leaked call and an
+    // identical native tool_call must fire onToolCall exactly once. state._toolDedupe
+    // is created per stream; when absent (older callers) behavior is unchanged.
+    if (state._toolDedupe && !state._toolDedupe.shouldDispatch(call.name, call.arguments)) {
+        // Still mark the id as emitted so later id-frames for the same native
+        // call don't retry, but do NOT invoke onToolCall (already dispatched).
+        state.emittedToolCallKeys.add(key);
+        return false;
+    }
     state.emittedToolCallKeys.add(key);
     state.emittedToolCall = true;
     const { _pendingItemId, ...cleanCall } = call;
@@ -257,11 +294,14 @@ function isMaxOutputIncompleteReason(reason) {
     return /^(?:max_output_tokens|max_tokens|length|output_token_limit)$/i.test(String(reason || '').trim());
 }
 
-export async function consumeCompatChatCompletionStream(stream, { signal, label, onStreamDelta, onToolCall, onTextDelta, parseToolCalls } = {}) {
+export async function consumeCompatChatCompletionStream(stream, { signal, label, onStreamDelta, onToolCall, onTextDelta, parseToolCalls, knownToolNames } = {}) {
     const iterator = stream[Symbol.asyncIterator]();
     const firstByteTimeout = createTimeoutSignal(signal, PROVIDER_FIRST_BYTE_TIMEOUT_MS, `${label} first byte`);
     const idleEnabled = PROVIDER_SSE_IDLE_WATCHDOG_ENABLED;
-    const idleMs = PROVIDER_SSE_IDLE_TIMEOUT_MS;
+    // Per-event (last-event-relative) SEMANTIC idle: nextAsyncWithWatchdog arms
+    // the timer only while awaiting the NEXT stream event, so a stream that
+    // emits some deltas then goes silent trips it within the window.
+    const idleMs = PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS;
     let sawFirstEvent = false;
     let content = '';
     let reasoningContent = '';
@@ -276,6 +316,46 @@ export async function consumeCompatChatCompletionStream(stream, { signal, label,
     let rawUsage = null;
     const toolAcc = new Map();
     const toolBucketState = { _orderSeq: 0, _nextAnonId: 0, _lastAnonKey: null };
+    // Fix 2: one dedupe per stream, shared by the synthetic leaked-call
+    // dispatch and every native emit so an identical (name,args) fires once.
+    const _toolDedupe = createToolCallDedupe();
+    // Leaked tool-call guard: the model sometimes emits a tool call as plain
+    // text (XML `<invoke>`/`<function_calls>` or gpt-oss harmony
+    // `<|channel|>...to=functions.NAME...<|call|>`) inside `delta.content`
+    // instead of a native `tool_calls` delta. Route content through the guard
+    // so leaked calls are suppressed from visible text, synthesized, and
+    // dispatched like native calls. Additive: the native tool_calls path is
+    // untouched. Harmony detection is opt-in here (gpt-oss compat backends).
+    const leakGuard = createLeakGuard({ knownToolNames, harmony: true });
+    const dispatchLeakedCall = (recovered) => {
+        const call = synthLeakedOpenAICall(recovered);
+        const emitState = { emittedToolCallKeys: new Set(), _toolDedupe };
+        emitCompatToolCallOnce(emitState, call, onToolCall);
+        return call;
+    };
+    const leakedCalls = [];
+    const relayText = (delta) => {
+        const { text, calls } = leakGuard.push(delta);
+        if (text) {
+            content += text;
+            if (onTextDelta) {
+                emittedText = true;
+                try { onTextDelta(text); } catch {}
+            }
+        }
+        for (const c of calls) leakedCalls.push(dispatchLeakedCall(c));
+    };
+    const flushLeak = () => {
+        const { text, calls } = leakGuard.flush();
+        if (text) {
+            content += text;
+            if (onTextDelta) {
+                emittedText = true;
+                try { onTextDelta(text); } catch {}
+            }
+        }
+        for (const c of calls) leakedCalls.push(dispatchLeakedCall(c));
+    };
     try {
         while (true) {
             const { value: chunk, done } = await nextAsyncWithWatchdog(iterator, {
@@ -285,6 +365,9 @@ export async function consumeCompatChatCompletionStream(stream, { signal, label,
                 idleMs,
                 idleEnabled: sawFirstEvent && idleEnabled,
                 idleLabel: `${label} SSE idle`,
+                // A stall after a tool call has already been dispatched (native
+                // or recovered-leaked) must be unsafe-to-retry (no double-run).
+                emittedToolCall: () => leakedCalls.length > 0 || toolAcc.size > 0,
             });
             if (done) break;
             if (!sawFirstEvent) {
@@ -296,12 +379,18 @@ export async function consumeCompatChatCompletionStream(stream, { signal, label,
             if (chunk?.model) model = chunk.model;
             const choice = chunk?.choices?.[0];
             if (choice?.delta?.content) {
-                content += choice.delta.content;
-                // Live text relay (gateway): explicit assistant text delta.
+                // Live text relay (gateway): explicit assistant text delta,
+                // routed through the leaked-tool-call guard (which appends to
+                // `content`, forwards visible text, and recovers leaked calls).
                 // reasoning_content + tool_calls deltas stay off this path.
-                if (onTextDelta) {
-                    emittedText = true;
-                    try { onTextDelta(choice.delta.content); } catch {}
+                if (leakGuard.enabled) {
+                    relayText(choice.delta.content);
+                } else {
+                    content += choice.delta.content;
+                    if (onTextDelta) {
+                        emittedText = true;
+                        try { onTextDelta(choice.delta.content); } catch {}
+                    }
                 }
             }
             if (typeof choice?.delta?.reasoning_content === 'string') {
@@ -311,9 +400,23 @@ export async function consumeCompatChatCompletionStream(stream, { signal, label,
             if (choice?.finish_reason) stopReason = choice.finish_reason;
             if (chunk?.usage) rawUsage = chunk.usage;
         }
+        // Flush any partial-sentinel tail held back mid-stream so legitimate
+        // trailing text is never lost.
+        if (leakGuard.enabled) flushLeak();
     } catch (err) {
         // Any mid-stream failure after live text was relayed is non-retryable.
         if (emittedText) throw markErrorLiveTextEmitted(err);
+        // Partial-final recovery parity: on a mid-stream stall, attach the
+        // streamed partial state so the loop can accept a wedged FINAL no-tool
+        // summary as partial-final success. pendingToolUse gates out any
+        // in-flight/emitted tool call.
+        if (err?.streamStalled === true) {
+            try {
+                err.partialContent = content;
+                err.pendingToolUse = toolAcc.size > 0 || leakedCalls.length > 0;
+                err.partialModel = model || undefined;
+            } catch { /* best-effort */ }
+        }
         throw err;
     } finally {
         firstByteTimeout.cleanup();
@@ -356,9 +459,18 @@ export async function consumeCompatChatCompletionStream(stream, { signal, label,
         throw err;
     }
     if (Array.isArray(toolCalls) && toolCalls.length) {
-        const emitState = { emittedToolCallKeys: new Set() };
+        const emitState = { emittedToolCallKeys: new Set(), _toolDedupe };
         for (const call of toolCalls) emitCompatToolCallOnce(emitState, call, onToolCall);
     }
+    // Fold recovered leaked calls into the returned toolCalls so the dispatch
+    // loop treats them exactly like native ones. They were already emitted via
+    // onToolCall in relayText/flushLeak, so no re-dispatch here. Dedupe the
+    // final array by name+args (Fix 2, array side): a synthetic leaked call and
+    // an identical native tool_call must not both remain, else the loop runs
+    // the side-effecting tool twice.
+    if (leakedCalls.length) {
+        toolCalls = dedupeToolCallList([...(Array.isArray(toolCalls) ? toolCalls : []), ...leakedCalls]);
+    }
     return {
         response,
         model,
@@ -370,7 +482,7 @@ export async function consumeCompatChatCompletionStream(stream, { signal, label,
     };
 }
 
-function handleCompatResponsesStreamEvent(event, state, { label, parseResponsesToolCalls, responseOutputText, onStreamDelta, onToolCall, onTextDelta }) {
+function handleCompatResponsesStreamEvent(event, state, { label, parseResponsesToolCalls, responseOutputText, onStreamDelta, onToolCall, onTextDelta, relayLeakText }) {
     if (!event || typeof event.type !== 'string') return;
     const pushToolSearchCall = (item) => {
         if (!item || item.type !== 'tool_search_call') return;
@@ -399,12 +511,17 @@ function handleCompatResponsesStreamEvent(event, state, { label, parseResponsesT
             if (event.response?.id) state.responseId = event.response.id;
             break;
         case 'response.output_text.delta':
-            state.content += event.delta || '';
             state.sawOutput = true;
             try { onStreamDelta?.(); } catch {}
-            if (event.delta && onTextDelta) {
-                state.emittedText = true;
-                try { onTextDelta(event.delta); } catch {}
+            // Route assistant text through the leaked-tool-call guard (appends
+            // to state.content, forwards visible text, recovers leaked calls).
+            if (relayLeakText) relayLeakText(event.delta || '');
+            else {
+                state.content += event.delta || '';
+                if (event.delta && onTextDelta) {
+                    state.emittedText = true;
+                    try { onTextDelta(event.delta); } catch {}
+                }
             }
             break;
         case 'response.output_item.added':
@@ -413,13 +530,23 @@ function handleCompatResponsesStreamEvent(event, state, { label, parseResponsesT
                     name: event.item.name || '',
                     callId: event.item.call_id || '',
                 });
+                state.toolInFlight = true;
+            } else if (event.item?.type === 'custom_tool_call') {
+                state.toolInFlight = true;
             }
             try { onStreamDelta?.(); } catch {}
             break;
         case 'response.function_call_arguments.delta':
+            // A tool call's args are streaming — mark tool work in-flight so a
+            // mid-args stall is NEVER accepted as a text-only partial-final.
+            state.toolInFlight = true;
             try { onStreamDelta?.(); } catch {}
             break;
         case 'response.custom_tool_call_input.delta':
+            // Custom-tool input streams before output_item.done records the call
+            // in pendingCalls; flag it so a mid-input stall gates out partial-
+            // final success (otherwise a tool-bearing turn looks text-only).
+            state.toolInFlight = true;
             try { onStreamDelta?.(); } catch {}
             break;
         case 'response.function_call_arguments.done': {
@@ -555,11 +682,13 @@ export async function consumeCompatResponsesStream(stream, {
     onTextDelta,
     parseResponsesToolCalls,
     responseOutputText,
+    knownToolNames,
 } = {}) {
     const iterator = stream[Symbol.asyncIterator]();
     const firstByteTimeout = createTimeoutSignal(signal, PROVIDER_FIRST_BYTE_TIMEOUT_MS, `${label} first byte`);
     const idleEnabled = PROVIDER_SSE_IDLE_WATCHDOG_ENABLED;
-    const idleMs = PROVIDER_SSE_IDLE_TIMEOUT_MS;
+    // Per-event (last-event-relative) SEMANTIC idle — see the Chat path note.
+    const idleMs = PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS;
     const state = {
         content: '',
         model: '',
@@ -572,13 +701,51 @@ export async function consumeCompatResponsesStream(stream, {
         completed: false,
         completedResponse: null,
         sawOutput: false,
+        // Fix 2: cross-path name+args dedupe shared by synthetic leaked-call
+        // dispatch and every native emit in this Responses stream.
+        _toolDedupe: createToolCallDedupe(),
         // Gateway live-text relay invariant: set once a non-empty text chunk
         // has been forwarded. A later failure is non-retryable (rendered text
         // cannot be withdrawn; a retry would concatenate attempts).
         emittedText: false,
     };
     let sawFirstEvent = false;
-    const deps = { label, parseResponsesToolCalls, responseOutputText, onStreamDelta, onToolCall, onTextDelta };
+    // Leaked tool-call guard for the Responses text stream. Same recovery as
+    // the Chat path: leaked XML/harmony tool syntax in `output_text.delta` is
+    // suppressed from visible text, synthesized, and dispatched like native.
+    const leakGuard = createLeakGuard({ knownToolNames, harmony: true });
+    const leakedCalls = [];
+    const dispatchLeakedCall = (recovered) => {
+        const call = synthLeakedOpenAICall(recovered);
+        emitCompatToolCallOnce(state, call, onToolCall);
+        leakedCalls.push(call);
+    };
+    const relayLeakText = leakGuard.enabled
+        ? (delta) => {
+            const { text, calls } = leakGuard.push(delta);
+            if (text) {
+                state.content += text;
+                if (onTextDelta) {
+                    state.emittedText = true;
+                    try { onTextDelta(text); } catch {}
+                }
+            }
+            for (const c of calls) dispatchLeakedCall(c);
+        }
+        : null;
+    const flushLeak = () => {
+        if (!leakGuard.enabled) return;
+        const { text, calls } = leakGuard.flush();
+        if (text) {
+            state.content += text;
+            if (onTextDelta) {
+                state.emittedText = true;
+                try { onTextDelta(text); } catch {}
+            }
+        }
+        for (const c of calls) dispatchLeakedCall(c);
+    };
+    const deps = { label, parseResponsesToolCalls, responseOutputText, onStreamDelta, onToolCall, onTextDelta, relayLeakText };
     try {
         while (true) {
             const { value: event, done } = await nextAsyncWithWatchdog(iterator, {
@@ -586,6 +753,9 @@ export async function consumeCompatResponsesStream(stream, {
                 idleMs,
                 idleEnabled: sawFirstEvent && idleEnabled,
                 idleLabel: `${label} SSE idle`,
+                // Unsafe-to-retry once any tool call (native or recovered-leaked)
+                // has been emitted this stream — avoid a double side-effect.
+                emittedToolCall: () => state.emittedToolCall || leakedCalls.length > 0,
             });
             if (done) break;
             if (!sawFirstEvent) {
@@ -594,7 +764,21 @@ export async function consumeCompatResponsesStream(stream, {
             }
             handleCompatResponsesStreamEvent(event, state, deps);
         }
+        flushLeak();
     } catch (err) {
+        // Partial-final recovery parity: attach streamed partial state so a
+        // wedged FINAL no-tool summary can be accepted as partial-final success.
+        if (err?.streamStalled === true) {
+            try {
+                err.partialContent = state.content || '';
+                err.pendingToolUse = state.emittedToolCall === true
+                    || leakedCalls.length > 0
+                    || (state.pendingCalls && state.pendingCalls.size > 0)
+                    || (Array.isArray(state.toolCalls) && state.toolCalls.length > 0)
+                    || state.toolInFlight === true;
+                err.partialModel = state.model || undefined;
+            } catch { /* best-effort */ }
+        }
         throw markUnsafeRetryIfToolEmitted(err, state);
     } finally {
         firstByteTimeout.cleanup();
@@ -618,9 +802,14 @@ export async function consumeCompatResponsesStream(stream, {
         output_text: state.content,
         output: [],
     };
-    const toolCalls = state.toolCalls.length
+    let toolCalls = state.toolCalls.length
         ? state.toolCalls.map(({ _pendingItemId, ...t }) => t)
         : parseResponsesToolCalls(response, label);
+    // Fold recovered leaked calls in (already emitted via onToolCall above).
+    // Dedupe by name+args so an identical native+synthetic pair can't run twice.
+    if (leakedCalls.length) {
+        toolCalls = dedupeToolCallList([...(Array.isArray(toolCalls) ? toolCalls : []), ...leakedCalls]);
+    }
     return {
         response,
         content: state.content || responseOutputText(response),