mixdog 0.9.0 → 0.9.2

package/src/runtime/agent/orchestrator/providers/openai-oauth-ws.mjs

@@ -4,7 +4,7 @@
  * Single dispatch path for the openai-oauth provider (SSE removed in
  * v0.6.117). Uses the `responses_websockets=2026-02-06` beta WebSocket
  * upgrade on chatgpt.com/backend-api/codex/responses. Per-session
- * connections are pooled (5 min idle TTL, up to 8 parallel sockets per
+ * connections are pooled (configurable idle TTL, up to 8 parallel sockets per
  * key) so subsequent tool-loop iterations can send only the incremental
  * `input` delta plus `previous_response_id`, skipping the full
  * tools/system/history prefix each turn.
@@ -33,14 +33,26 @@ import {
     traceAgentUsage,
     appendAgentTrace,
 } from '../agent-trace.mjs';
-import { jitterDelayMs, populateHttpStatusFromMessage } from './retry-classifier.mjs';
+import {
+    classifyHandshakeError,
+    classifyMidstreamError,
+    createStreamSafetyStamps,
+    jitterDelayMs,
+    MIDSTREAM_RETRY_POLICY,
+    populateHttpStatusFromMessage,
+    sleepWithAbort,
+} from './retry-classifier.mjs';
 import { makeInvalidToolArgsMarker } from './openai-compat-stream.mjs';
+import { createLeakGuard, createToolCallDedupe, dedupeToolCallList } from './anthropic-leaked-toolcall.mjs';
 import {
     PROVIDER_RETRY_MAX_ATTEMPTS,
     PROVIDER_WS_ACQUIRE_TIMEOUT_MS,
-    PROVIDER_WS_FIRST_MEANINGFUL_TIMEOUT_MS,
     PROVIDER_WS_HANDSHAKE_TIMEOUT_MS,
     PROVIDER_WS_INTER_CHUNK_TIMEOUT_MS,
+    PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS,
+    PROVIDER_SSE_IDLE_WATCHDOG_ENABLED,
+    streamStalledError,
+    resolveTimeoutMs,
 } from '../stall-policy.mjs';
 import { customToolCallFromResponseItem } from './custom-tool-wire.mjs';
 
@@ -50,17 +62,19 @@ const CODEX_WS_URL = 'wss://chatgpt.com/backend-api/codex/responses';
 const CODEX_OAUTH_ORIGINATOR = 'codex_cli_rs';
 const OPENAI_WS_URL = 'wss://api.openai.com/v1/responses';
 const XAI_WS_URL = 'wss://api.x.ai/v1/responses';
-const WS_IDLE_MS = 5 * 60_000;
+const WS_IDLE_MS = resolveTimeoutMs(
+    'MIXDOG_PROVIDER_WS_IDLE_MS',
+    20 * 60_000,
+    { minMs: 60_000, maxMs: 60 * 60_000 },
+);
 const WS_HANDSHAKE_TIMEOUT_MS = PROVIDER_WS_HANDSHAKE_TIMEOUT_MS;
 const WS_ACQUIRE_TIMEOUT_MS = PROVIDER_WS_ACQUIRE_TIMEOUT_MS;
-// Pre-stream watchdog uses the shared provider deadline so it fails before
-// the 5-minute session slow warning.
-const WS_FIRST_MEANINGFUL_MS = PROVIDER_WS_FIRST_MEANINGFUL_TIMEOUT_MS;
 // Pre-`response.created` deadline. Once the socket is open and the
 // response.create frame is sent, a healthy server emits response.created
 // within seconds. If it stalls past this short bound the socket has wedged
 // post-upgrade with zero server events — treat it as a fast, retryable
-// first-byte timeout rather than waiting the longer first-meaningful window.
+// first-byte timeout. This is the ONLY pre-stream watchdog; once any server
+// event arrives the single inter-chunk idle timer below takes over.
 // Only this short window is shortened; the post-`response.created`
 // inter-chunk / reasoning span keeps the longer deadlines below.
 const WS_PRE_RESPONSE_CREATED_MS = (() => {
@@ -69,11 +83,22 @@ const WS_PRE_RESPONSE_CREATED_MS = (() => {
     if (Number.isFinite(n) && n > 0) return Math.min(Math.max(n, 1_000), 120_000);
     return 10_000;
 })();
-// Inter-chunk inactivity after first meaningful output.
+// Single inter-chunk idle timer. Resets on EVERY received frame (matches codex
+// responses_websocket.rs timeout(idle_timeout, ws_stream.next()) and mixdog
+// anthropic-oauth resetIdleTimer on every chunk).
 const WS_INTER_CHUNK_MS = PROVIDER_WS_INTER_CHUNK_TIMEOUT_MS;
-const MIDSTREAM_WS_TRANSIENT_RETRY_LIMIT = 4;
-const MIDSTREAM_DEFAULT_RETRY_LIMIT = 2;
-const MIDSTREAM_BACKOFF_MS = [250, 1000, 2000, 4000];
+// Mid-stream retry budgets + backoff now live in the shared MIDSTREAM_RETRY_POLICY
+// table (retry-classifier.mjs). These aliases keep the local call sites readable
+// and ensure the numbers exist in exactly ONE place.
+const MIDSTREAM_WS_TRANSIENT_RETRY_LIMIT = MIDSTREAM_RETRY_POLICY.ws.transientCloseRetries;
+const MIDSTREAM_DEFAULT_RETRY_LIMIT = MIDSTREAM_RETRY_POLICY.ws.defaultRetries;
+const MIDSTREAM_BACKOFF_MS = MIDSTREAM_RETRY_POLICY.ws.backoff;
+// Policy object passed to the shared classifyMidstreamError for the WS path.
+const WS_MIDSTREAM_POLICY = {
+    mode: 'ws',
+    transientCloseRetries: MIDSTREAM_RETRY_POLICY.ws.transientCloseRetries,
+    defaultRetries: MIDSTREAM_RETRY_POLICY.ws.defaultRetries,
+};
 
 // Handshake retry policy. The `ws` library surfaces a bare
 // `Opening handshake has timed out` Error after handshakeTimeout; transient
@@ -1216,11 +1241,11 @@ export async function _streamResponse({
     logSuppressedReasoningDeltas = true,
     traceProvider = 'openai-oauth',
     _timeouts = null,
+    knownToolNames = null,
 }) {
     const errLabel = _wsErrLabel(traceProvider);
     const socket = entry.socket;
     const preResponseCreatedMs = _positiveInt(_timeouts?.preResponseCreatedMs, WS_PRE_RESPONSE_CREATED_MS);
-    const firstMeaningfulMs = _positiveInt(_timeouts?.firstMeaningfulMs, WS_FIRST_MEANINGFUL_MS);
     const interChunkMs = _positiveInt(_timeouts?.interChunkMs, WS_INTER_CHUNK_MS);
     const _streamingStart = Date.now();
     let _firstDeltaEmitted = false;
@@ -1236,6 +1261,19 @@ export async function _streamResponse({
     const citations = [];
     const citationKeys = new Set();
     const pendingCalls = new Map();
+    // Tool-work-in-flight flag: set the moment a function/custom tool call's
+    // input starts streaming (before it lands in pendingCalls/toolCalls).
+    // Gates partial-final SUCCESS so a stall mid tool-input never looks text-only.
+    let _toolInFlight = false;
+    // Fix 2: cross-path name+args dedupe. A text-leaked synthetic and an
+    // identical native function_call must fire onToolCall exactly once. Every
+    // dispatch site routes through emitToolCallDedupe.
+    const _toolDedupe = createToolCallDedupe();
+    const emitToolCallDedupe = (call) => {
+        if (!_toolDedupe.shouldDispatch(call?.name, call?.arguments)) return;
+        midState.emittedToolCall = true;
+        try { onToolCall?.(call); } catch {}
+    };
     // Reasoning items collected from response.output_item.done (or salvaged
     // from response.completed.response.output). The request still includes
     // `reasoning.encrypted_content` so the server keeps emitting the blobs,
@@ -1323,8 +1361,7 @@ export async function _streamResponse({
         const call = customToolCallFromResponseItem(item);
         if (!call || toolCalls.some((existing) => existing.id === call.id)) return;
         toolCalls.push(call);
-        midState.emittedToolCall = true;
-        try { onToolCall?.(call); } catch {}
+        emitToolCallDedupe(call);
     };
     const pushToolSearchCall = (item) => {
         if (!item || item.type !== 'tool_search_call') return;
@@ -1337,9 +1374,60 @@ export async function _streamResponse({
             nativeType: 'tool_search_call',
         };
         toolCalls.push(call);
+        emitToolCallDedupe(call);
+    };
+    // Leaked tool-call guard. The model sometimes emits a tool call as plain
+    // text (XML `<invoke>`/`<function_calls>` or gpt-oss harmony
+    // `<|channel|>...to=functions.NAME...<|call|>`) inside
+    // `response.output_text.delta` instead of a native function_call. Route
+    // text through the guard so leaked calls are suppressed from the visible
+    // stream, synthesized (native `call_...` id shape), and dispatched like
+    // native ones. Additive: the native function_call path is untouched.
+    const leakGuard = createLeakGuard({ knownToolNames, harmony: true });
+    const dispatchLeakedCall = (recovered) => {
+        let args = recovered?.arguments;
+        if (args === null || typeof args !== 'object' || Array.isArray(args)) args = {};
+        const call = {
+            id: `call_leaked_${randomBytes(8).toString('hex')}`,
+            name: recovered.name,
+            arguments: args,
+        };
+        if (!_toolDedupe.shouldDispatch(call.name, call.arguments)) return;
+        toolCalls.push(call);
         midState.emittedToolCall = true;
         try { onToolCall?.(call); } catch {}
     };
+    const relayLeakText = (delta) => {
+        if (!leakGuard.enabled) {
+            content += delta || '';
+            if (delta && onTextDelta) {
+                if (state) state.emittedText = true;
+                try { onTextDelta(delta); } catch {}
+            }
+            return;
+        }
+        const { text, calls } = leakGuard.push(delta);
+        if (text) {
+            content += text;
+            if (onTextDelta) {
+                if (state) state.emittedText = true;
+                try { onTextDelta(text); } catch {}
+            }
+        }
+        for (const c of calls) dispatchLeakedCall(c);
+    };
+    const flushLeak = () => {
+        if (!leakGuard.enabled) return;
+        const { text, calls } = leakGuard.flush();
+        if (text) {
+            content += text;
+            if (onTextDelta) {
+                if (state) state.emittedText = true;
+                try { onTextDelta(text); } catch {}
+            }
+        }
+        for (const c of calls) dispatchLeakedCall(c);
+    };
     const logReasoningDeltaSuppression = () => {
         if (!logSuppressedReasoningDeltas) return;
         const total = reasoningTextDeltaCount + reasoningSummaryTextDeltaCount + reasoningOtherDeltaCount;
@@ -1368,6 +1456,16 @@ export async function _streamResponse({
     let messageHandler = null;
     let closeHandler = null;
     let errorHandler = null;
+    // SEMANTIC idle timer (pi per-event parity): distinct from the inter-chunk
+    // timer, which resets on EVERY frame (rate_limits/metadata/keepalive keep
+    // the socket "alive"). This timer resets ONLY on meaningful output deltas
+    // (text/reasoning/tool args — the same events that call onStreamDelta) so a
+    // stream that emits some deltas then goes silent (server keepalive frames
+    // only) trips a short, named terminal StreamStalledError instead of coasting
+    // to the 300s inter-chunk cap / 30-min agent watchdog.
+    let semanticIdleTimer = null;
+    const semanticIdleMs = PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS;
+    const semanticIdleEnabled = PROVIDER_SSE_IDLE_WATCHDOG_ENABLED && semanticIdleMs > 0;
 
     return new Promise((resolve, reject) => {
         // Pre-stream watchdog: the timer fires if the server never sends a
@@ -1375,10 +1473,10 @@ export async function _streamResponse({
         // after our last frame. The socket is open and the response.create
         // frame was sent, but no server event has come back — a wedged
         // post-upgrade socket. Healthy servers ack within seconds, so this
-        // window is intentionally short (~25s). Once response.created (or
-        // any other meaningful event) arrives, the timer is cancelled and
-        // the longer inter-chunk inactivity watchdog takes over — silent
-        // gaps mid-reasoning (openai-oauth spending 50s+ producing reasoning
+        // window is intentionally short (WS_PRE_RESPONSE_CREATED_MS, ~10s).
+        // Once ANY server event arrives, resetIdle() cancels this watchdog and
+        // the single inter-chunk idle timer takes over — silent gaps
+        // mid-reasoning (openai-oauth spending 50s+ producing reasoning
         // tokens) are normal and should not abort the turn.
         const armPreStreamWatchdog = () => {
             if (idleTimer) clearTimeout(idleTimer);
@@ -1410,8 +1508,6 @@ export async function _streamResponse({
             }, preResponseCreatedMs);
         };
         let interChunkTimer = null;
-        let firstMeaningfulTimer = null;
-        let firstMeaningfulSeen = false;
         const traceWsTimeout = (event, timeoutMs) => {
             try {
                 const iteration = Number(midState.iteration);
@@ -1426,7 +1522,6 @@ export async function _streamResponse({
                     attempt_index: Number.isFinite(attemptIndex) ? attemptIndex : null,
                     warmup: midState.warmup === true,
                     saw_response_created: midState.sawResponseCreated === true,
-                    first_meaningful_seen: firstMeaningfulSeen === true,
                 };
                 appendAgentTrace({
                     sessionId: midState.sessionId || null,
@@ -1443,29 +1538,6 @@ export async function _streamResponse({
                 idleTimer = null;
             }
         };
-        const clearFirstMeaningfulWatchdog = () => {
-            if (firstMeaningfulTimer) {
-                clearTimeout(firstMeaningfulTimer);
-                firstMeaningfulTimer = null;
-            }
-        };
-        const armFirstMeaningfulWatchdog = () => {
-            if (firstMeaningfulSeen || firstMeaningfulMs <= 0) return;
-            clearFirstMeaningfulWatchdog();
-            firstMeaningfulTimer = setTimeout(() => {
-                if (process.env.MIXDOG_DEBUG_AGENT) {
-                    process.stderr.write(`[agent-trace] ws-timeout kind=first-meaningful afterMs=${firstMeaningfulMs}\n`);
-                }
-                traceWsTimeout('first_meaningful_timeout', firstMeaningfulMs);
-                const err = new Error(`WS stream: no meaningful output within ${firstMeaningfulMs}ms after response.created`);
-                err.wsCloseCode = 4000;
-                err.firstMeaningfulTimeout = true;
-                midState.firstMeaningfulTimeout = true;
-                terminalError = err;
-                try { socket.close(4000, 'first_meaningful_timeout'); } catch {}
-                finish();
-            }, firstMeaningfulMs);
-        };
         const resetInterChunk = () => {
             if (interChunkTimer) clearTimeout(interChunkTimer);
             interChunkTimer = setTimeout(() => {
@@ -1480,30 +1552,49 @@ export async function _streamResponse({
                 finish();
             }, interChunkMs);
         };
-        const onResponseCreated = () => {
-            clearPreStreamWatchdog();
-            if (!firstMeaningfulSeen) armFirstMeaningfulWatchdog();
-            else resetInterChunk();
+        // pi per-event idle: (re)armed only on meaningful output deltas via
+        // bumpSemanticIdle(). Keepalive/metadata frames DON'T touch it, so a
+        // deltas-then-silent wedge trips this short semantic window.
+        const resetSemanticIdle = () => {
+            if (!semanticIdleEnabled) return;
+            if (semanticIdleTimer) clearTimeout(semanticIdleTimer);
+            semanticIdleTimer = setTimeout(() => {
+                traceWsTimeout('semantic_idle_timeout', semanticIdleMs);
+                terminalError = streamStalledError('Responses WS', semanticIdleMs, { emittedToolCall: !!midState?.emittedToolCall });
+                // Partial-final recovery parity: attach streamed partial state so
+                // a wedged FINAL no-tool summary can be accepted as partial-final
+                // success by the loop. pendingToolUse gates out mid-flight tools.
+                try {
+                    terminalError.partialContent = content;
+                    terminalError.partialToolCalls = toolCalls.length ? toolCalls.slice() : undefined;
+                    terminalError.pendingToolUse = pendingCalls.size > 0
+                        || !!midState?.emittedToolCall
+                        || toolCalls.length > 0
+                        || _toolInFlight === true;
+                    terminalError.partialModel = model || undefined;
+                } catch { /* best-effort enrichment */ }
+                try { terminalError.wsCloseCode = 4000; } catch {}
+                try { socket.close(4000, 'semantic_idle_timeout'); } catch {}
+                finish();
+            }, semanticIdleMs);
+            try { semanticIdleTimer.unref?.(); } catch {}
         };
-        // Called on every event that carries real output tokens or tool
-        // progress. `response.created` is only an ACK and must not count here:
-        // a wedged openai-oauth stream can ACK immediately and then never produce
-        // text/reasoning/tool deltas, holding the prompt-cache lane for the
-        // full inter-chunk window.
-        const onMeaningfulOutput = () => {
-            if (!firstMeaningfulSeen) {
-                firstMeaningfulSeen = true;
-                clearPreStreamWatchdog();
-                clearFirstMeaningfulWatchdog();
-            }
+        // Single idle reset — called on EVERY parsed server event (matches
+        // codex, which resets one idle timer on every received WS frame). Any
+        // frame proves the socket is live; there is no separate "meaningful
+        // output" gate. Also clears the pre-stream watchdog defensively in case
+        // the first event is not response.created.
+        const resetIdle = () => {
+            clearPreStreamWatchdog();
             resetInterChunk();
         };
-        // resetIdle kept for compat; metadata frames no longer disarm pre-stream watchdog.
-        const resetIdle = () => { /* noop — only onMeaningfulOutput() disarms */ };
+        // Meaningful-output progress bump: called by the same delta cases that
+        // call onStreamDelta (text/reasoning/tool args). Arms the semantic idle.
+        const bumpSemanticIdle = () => { resetSemanticIdle(); };
         const cleanup = () => {
             if (idleTimer) clearTimeout(idleTimer);
-            clearFirstMeaningfulWatchdog();
             if (interChunkTimer) { clearTimeout(interChunkTimer); interChunkTimer = null; }
+            if (semanticIdleTimer) { clearTimeout(semanticIdleTimer); semanticIdleTimer = null; }
             if (keepaliveTimer) { clearInterval(keepaliveTimer); keepaliveTimer = null; }
             if (messageHandler) socket.off('message', messageHandler);
             if (closeHandler) socket.off('close', closeHandler);
@@ -1512,6 +1603,9 @@ export async function _streamResponse({
         };
         const finish = () => {
             logReasoningDeltaSuppression();
+            // Flush any partial-sentinel tail held back mid-stream so
+            // legitimate trailing text is never lost (streamed-text path).
+            flushLeak();
             cleanup();
             if (terminalError) { reject(terminalError); return; }
             resolve({
@@ -1519,11 +1613,17 @@ export async function _streamResponse({
                 model,
                 reasoningItems: reasoningItems.length ? reasoningItems : undefined,
                 responseItems: responseItemsAdded.length ? responseItemsAdded : undefined,
-                toolCalls: toolCalls.length ? toolCalls : undefined,
+                // Dedupe by name+args (Fix 2, array side) so an identical
+                // synthetic-leaked + native pair can't run the tool twice.
+                toolCalls: toolCalls.length ? dedupeToolCallList(toolCalls) : undefined,
                 citations: citations.length ? citations : undefined,
                 webSearchCalls: webSearchCalls.length ? webSearchCalls : undefined,
                 usage,
                 stopReason: stopReason || undefined,
+                // P1 audit fix: mirror the HTTP/SSE fallback's truncated flag
+                // for the WS path (sendViaWebSocket spreads this result
+                // through to the provider caller unchanged).
+                ...(stopReason === 'length' && content.length > 0 ? { truncated: true } : {}),
                 incompleteReason: incompleteReason || undefined,
                 responseId: responseId || undefined,
                 serviceTier: responseServiceTier || undefined,
@@ -1532,7 +1632,10 @@ export async function _streamResponse({
 
         messageHandler = (data) => {
             resetIdle();
-            // Do NOT call onStreamDelta for every frame — metadata/keepalive frames
+            // resetIdle() above resets the SINGLE inter-chunk idle timer on
+            // EVERY received frame (codex parity) — response.created, metadata,
+            // rate_limits, and all deltas keep the socket alive. Separately, do
+            // NOT call onStreamDelta for every frame — metadata/keepalive frames
             // must not reset the agent stall watchdog's lastStreamDeltaAt. Only
             // meaningful output (text delta / tool call) updates that timestamp.
             const text = typeof data === 'string' ? data : data.toString('utf-8');
@@ -1554,13 +1657,11 @@ export async function _streamResponse({
                     midState.sawResponseCreated = true;
                     if (event.response?.model) model = event.response.model;
                     if (event.response?.id) responseId = event.response.id;
-                    // Server ack: cancel only the pre-created watchdog. Keep
-                    // a separate first-meaningful watchdog armed until real
-                    // model progress arrives.
-                    onResponseCreated();
+                    // Server ack (first event). resetIdle() at the top of
+                    // messageHandler already cleared the pre-stream watchdog and
+                    // armed the single idle timer — no extra bookkeeping here.
                     break;
                 case 'response.output_text.delta':
-                    content += event.delta || '';
                     try {
                         if (!_firstDeltaEmitted) {
                             _firstDeltaEmitted = true;
@@ -1570,6 +1671,7 @@ export async function _streamResponse({
                         }
                         onStreamDelta?.();
                     } catch {}
+                    bumpSemanticIdle();
                     // Live text relay (gateway): forward the raw text chunk so
                     // the client renders first tokens before the final replay.
                     // Tool-call/argument deltas intentionally stay off this path.
@@ -1577,11 +1679,10 @@ export async function _streamResponse({
                     // cannot be withdrawn, so flag the attempt so a later
                     // mid-stream/truncated failure is NOT retried (retry would
                     // concatenate a second attempt onto rendered text).
-                    if (event.delta && onTextDelta) {
-                        if (state) state.emittedText = true;
-                        try { onTextDelta(event.delta); } catch {}
-                    }
-                    onMeaningfulOutput();
+                    // Routed through the leaked-tool-call guard: appends to
+                    // `content`, forwards visible text via onTextDelta, and
+                    // recovers/dispatches any leaked known-tool call.
+                    relayLeakText(event.delta || '');
                     break;
                 case 'response.reasoning_text.delta':
                 case 'response.reasoning_summary_text.delta':
@@ -1589,16 +1690,12 @@ export async function _streamResponse({
                     else reasoningSummaryTextDeltaCount += 1;
                     // Reasoning text is live model progress — refresh
                     // lastStreamDeltaAt so stream-watchdog does not flag a
-                    // long reasoning span as a stall. It also counts as
-                    // liveness for the local pre-stream / inter-chunk
-                    // watchdogs: a long reasoning span without any
-                    // output_text delta would otherwise trip the
-                    // first-meaningful timer and abort an otherwise healthy
-                    // stream. Reasoning is still suppressed from user
-                    // content (no `content +=` here) — only the watchdog
-                    // timers are reset.
+                    // long reasoning span as a stall. The local WS idle timer
+                    // was already reset by resetIdle() at the top of
+                    // messageHandler. Reasoning is still suppressed from user
+                    // content (no `content +=` here).
                     try { onStreamDelta?.(); } catch {}
-                    onMeaningfulOutput();
+                    bumpSemanticIdle();
                     break;
                 case 'response.output_item.added':
                     if (event.item?.type === 'function_call') {
@@ -1606,16 +1703,20 @@ export async function _streamResponse({
                             name: event.item.name || '',
                             callId: event.item.call_id || '',
                         });
-                        onMeaningfulOutput();
+                        _toolInFlight = true;
+                    } else if (event.item?.type === 'custom_tool_call') {
+                        _toolInFlight = true;
                     }
                     break;
                 case 'response.function_call_arguments.delta':
+                    _toolInFlight = true;
                     try { onStreamDelta?.(); } catch {}
-                    onMeaningfulOutput();
+                    bumpSemanticIdle();
                     break;
                 case 'response.custom_tool_call_input.delta':
+                    _toolInFlight = true;
                     try { onStreamDelta?.(); } catch {}
-                    onMeaningfulOutput();
+                    bumpSemanticIdle();
                     break;
                 case 'response.function_call_arguments.done': {
                     const itemId = event.item_id || '';
@@ -1646,8 +1747,7 @@ export async function _streamResponse({
                     if (pending?.callId && pending?.name) {
                         const call = { id: pending.callId, name: pending.name, arguments: args };
                         toolCalls.push(call);
-                        midState.emittedToolCall = true;
-                        try { onToolCall?.(call); } catch {}
+                        emitToolCallDedupe(call);
                     } else {
                         // Synthesizing a `tc_${Date.now()}` callId here would
                         // make the next turn fail to match the model's
@@ -1667,7 +1767,7 @@ export async function _streamResponse({
                         });
                     }
                     try { onStreamDelta?.(); } catch {}
-                    onMeaningfulOutput();
+                    bumpSemanticIdle();
                     break;
                 }
                 case 'response.output_item.done':
@@ -1681,11 +1781,9 @@ export async function _streamResponse({
                     if (event.item?.type === 'web_search_call') pushWebSearchCall(event.item);
                     if (event.item?.type === 'tool_search_call') {
                         pushToolSearchCall(event.item);
-                        onMeaningfulOutput();
                     }
                     if (event.item?.type === 'custom_tool_call') {
                         pushCustomToolCall(event.item);
-                        onMeaningfulOutput();
                     }
                     break;
                 case 'response.completed': {
@@ -1717,7 +1815,18 @@ export async function _streamResponse({
                             if (!content && item.type === 'message') {
                                 for (const c of item.content || []) {
                                     if (c.type === 'output_text') {
-                                        content += c.text || '';
+                                        // Completed-output fallback (no streamed
+                                        // text). Route through the leak guard so
+                                        // a tool call leaked only in the final
+                                        // bundle is recovered, not surfaced as
+                                        // visible content. final=true → full flush.
+                                        if (leakGuard.enabled) {
+                                            const { text, calls } = leakGuard.push(c.text || '', true);
+                                            content += text;
+                                            for (const lc of calls) dispatchLeakedCall(lc);
+                                        } else {
+                                            content += c.text || '';
+                                        }
                                         pushOutputTextAnnotations(c);
                                     }
                                 }
@@ -1753,8 +1862,7 @@ export async function _streamResponse({
                                     if (tc.id && tc.name) {
                                         delete tc._deferred;
                                         delete tc._pendingItemId;
-                                        midState.emittedToolCall = true;
-                                        try { onToolCall?.(tc); } catch {}
+                                        emitToolCallDedupe(tc);
                                     }
                                 }
                             }
@@ -1891,6 +1999,13 @@ export async function _streamResponse({
                         && event.type.startsWith('response.reasoning')
                         && event.type.endsWith('.delta')) {
                         reasoningOtherDeltaCount += 1;
+                        // These ARE live model progress (reviewer Medium): a
+                        // provider that emits only these reasoning variants for a
+                        // long span would otherwise trip the SEMANTIC idle abort.
+                        // Refresh both the watchdog and the semantic idle timer,
+                        // matching the named reasoning_text.delta case above.
+                        try { onStreamDelta?.(); } catch {}
+                        bumpSemanticIdle();
                     }
                     // Trace-only events (response.in_progress, etc.)
                     break;
@@ -1997,34 +2112,12 @@ export async function _streamResponse({
  *   'http_5xx' (with specific status e.g. 'http_503') — server overload
  *   null      — not retryable
  */
+// Thin re-export wrapper: handshake classification now lives in the shared
+// retry-classifier (classifyHandshakeError). Kept here as a named export so
+// internal call sites (_acquireWithRetry) and any external importer keep
+// resolving the same symbol.
 export function _classifyHandshakeError(err) {
-    if (!err) return null;
-    const code = err.code || '';
-    const msg = String(err.message || '');
-    const status = Number(err.httpStatus || 0);
-
-    // Permanent HTTP (auth / quota / not-found) short-circuits.
-    if (status === 401 || status === 403 || status === 404 || status === 429) {
-        return null;
-    }
-    // 5xx transient.
-    if (status >= 500 && status < 600) {
-        return `http_${status}`;
-    }
-
-    // Node errno codes.
-    if (code === 'ECONNRESET') return 'reset';
-    if (code === 'EAI_AGAIN' || code === 'ENOTFOUND' || code === 'EAI_NODATA') return 'dns';
-    if (code === 'ECONNREFUSED') return 'refused';
-    if (code === 'ETIMEDOUT' || code === 'ESOCKETTIMEDOUT') return 'timeout';
-    if (code === 'EWSACQUIRETIMEOUT') return 'acquire_timeout';
-    if (code === 'ENETUNREACH' || code === 'EHOSTUNREACH' || code === 'EPIPE') return 'network';
-
-    // `ws` library's handshake-timeout path: thrown as a bare Error.
-    if (/opening handshake has timed out/i.test(msg)) return 'timeout';
-    if (/socket hang up/i.test(msg)) return 'reset';
-
-    return null;
+    return classifyHandshakeError(err);
 }
 
 /**
@@ -2048,9 +2141,6 @@ export function _classifyHandshakeError(err) {
  *                          response.create frame sent, but the server never
  *                          emitted response.created within the short
  *                          pre-stream deadline. Fast-fail retryable.
- *   'first_meaningful_timeout' — server ACKed response.created, then emitted
- *                          no real text/reasoning/tool progress before the
- *                          first-meaningful deadline.
  *   'response_failed_network'       — response.failed with network_error
  *   'response_failed_disconnected'  — response.failed with stream_disconnected
  *
@@ -2065,128 +2155,25 @@ export function _classifyHandshakeError(err) {
  *   - HTTP 401 / 403 / 429 surfaced on the error
  *   - state.attemptIndex has reached the classifier-specific retry budget
  */
+// Thin wrapper: the full WS mid-stream decision tree now lives in the shared
+// classifyMidstreamError (retry-classifier.mjs, policy.mode='ws'). Kept as a
+// named export so internal call sites and any external importer keep resolving
+// the same symbol. Behavior is byte-identical — the shared function is the
+// relocated original, with the per-classifier budget gating supplied by
+// WS_MIDSTREAM_POLICY (transientCloseRetries=4, defaultRetries=2).
 export function _classifyMidstreamError(err, state) {
-    if (!state) return null;
-    const attemptIndex = state.attemptIndex | 0;
-    // Already completed (shouldn't throw, but defensive).
-    if (state.sawCompleted) return null;
-    // Any tool call already surfaced to the caller — retrying would
-    // normally duplicate the side effect. EXCEPTION: ws_1000 truncation
-    // (server-side normal close after response.created, before completion)
-    // leaves the caller with an orphaned tool_use that the next turn cannot
-    // pair to a tool_result, which the provider rejects with a hard 400.
-    // The duplicate-side-effect risk is preferable to deterministic worker
-    // death, especially for detached agents that re-dispatch idempotently.
-    if (state.emittedToolCall) {
-        const _cc = Number(err?.wsCloseCode || state.wsCloseCode || 0);
-        if (!(_cc === 1000 && state.sawResponseCreated && !state.sawCompleted)) return null;
-    }
-    // Live-text invariant: once a non-empty text chunk has been relayed to the
-    // client (gateway live mode), the rendered output cannot be withdrawn and a
-    // retry would concatenate a second attempt. Treat every subsequent
-    // mid-stream/truncated failure as final — never retry.
-    if (state.emittedText || err?.liveTextEmitted) return null;
-    // Post-upgrade-no-first-event: the socket opened, our response.create
-    // frame was sent, but the server never emitted a single event before
-    // the short pre-`response.created` watchdog fired. The handshake retry
-    // layer only sees pre-upgrade failures and the legacy pre-stream gate
-    // below would deny this case (sawResponseCreated === false). Tag it
-    // here as a fast retryable bucket so the worker reconnects within
-    // seconds instead of stalling for the full first-meaningful window.
-    if (state.firstByteTimeout || err?.firstByteTimeout) {
-        return _allowMidstreamRetry('first_byte_timeout', attemptIndex);
-    }
-    if (state.firstMeaningfulTimeout || err?.firstMeaningfulTimeout) {
-        return _allowMidstreamRetry('first_meaningful_timeout', attemptIndex);
-    }
-    // _sendFrame failure (socket not OPEN, send callback errored, JSON
-    // serialize threw). Always retryable: caller will forceFresh next
-    // attempt so the wedged socket is dropped.
-    if (err?.wsSendFailed || state.wsSendFailed) {
-        return _allowMidstreamRetry('ws_send_failed', attemptIndex);
-    }
-    // Pre-stream failures normally belong to the handshake retry layer. BUT
-    // WS close 1011 / 1012 can fire after the 101 upgrade but BEFORE the
-    // first response.created event when the server's keepalive times out or
-    // the service restarts. Neither the handshake retry layer (it only sees
-    // pre-upgrade failures) nor the existing mid-stream gate covers this
-    // window, so permit bounded retry here for those two codes only.
-    if (!state.sawResponseCreated) {
-        const closeCode = Number(err?.wsCloseCode || state.wsCloseCode || 0);
-        if (closeCode !== 1011 && closeCode !== 1012) return null;
-    }
-    // User/caller abort — never retry.
-    if (state.userAbort) return null;
-
-    if (!err) return null;
-    const status = Number(err?.httpStatus || 0);
-    if (status === 401 || status === 403 || status === 429) return null;
-    // Transient 5xx surfaced via populateHttpStatusFromMessage (case 'error'
-    // and case 'response.failed' branches sniff server-supplied text like
-    // "Our servers are currently overloaded" and assign httpStatus=503).
-    // Allow one bounded mid-stream retry on the same budget as the WS close-
-    // code buckets above so server-side overload no longer leaks straight
-    // to the caller without a single retry attempt.
-    if (status >= 500 && status < 600) {
-        return _allowMidstreamRetry(`http_${status}`, attemptIndex);
-    }
-
-    const name = err?.name || '';
-    if (name === 'AgentStallAbortError') return _allowMidstreamRetry('agent_stall', attemptIndex);
-    if (name === 'StreamStalledAbortError') return _allowMidstreamRetry('stream_stalled', attemptIndex);
-
-    // Watchdog abort surfaced via externalSignal handler → err is the reason
-    // itself. state.watchdogAbort captures the class name when the error
-    // shape was preserved but the name was stripped by some wrapper.
-    if (state.watchdogAbort === 'AgentStallAbortError') return _allowMidstreamRetry('agent_stall', attemptIndex);
-    if (state.watchdogAbort === 'StreamStalledAbortError') return _allowMidstreamRetry('stream_stalled', attemptIndex);
-
-    // WS close codes: prefer the decorated property, fall back to state.
-    const closeCode = Number(err?.wsCloseCode || state.wsCloseCode || 0);
-    if (closeCode === 1006) return _allowMidstreamRetry('ws_1006', attemptIndex);
-    if (closeCode === 1011) return _allowMidstreamRetry('ws_1011', attemptIndex);
-    if (closeCode === 1012) return _allowMidstreamRetry('ws_1012', attemptIndex);
-    // Private 4xxx codes from a server/proxy are auth/policy/application closes;
-    // never treat them as transient. 4000 is our local pre-stream watchdog code.
-    if (closeCode >= 4000 && closeCode < 5000 && closeCode !== 4000) return null;
-    if (closeCode === 4000) return _allowMidstreamRetry('ws_4000', attemptIndex);
-    // Server-side normal close (1000) AFTER response.created but BEFORE
-    // response.completed = truncated stream; legitimate transient. The
-    // pre-stream gate above already rejects 1000 before sawResponseCreated
-    // (handshake retry layer owns that window).
-    if (closeCode === 1000 && state.sawResponseCreated && !state.sawCompleted) return _allowMidstreamRetry('ws_1000', attemptIndex);
-
-    // response.failed payload mentioning network_error / stream_disconnected.
-    // xAI's gRPC backend periodically rotates auth context (server-side TTL)
-    // and surfaces "Auth context expired" as a response.failed event. The
-    // attemptIndex > 0 path in sendViaWebSocket forces a fresh WS handshake,
-    // which re-authenticates — so a single bounded retry recovers the turn
-    // instead of letting the worker die mid-session.
-    const failed = err?.responseFailed || state.responseFailedPayload;
-    if (failed) {
-        try {
-            const blob = JSON.stringify(failed).toLowerCase();
-            if (blob.includes('stream_disconnected')) return _allowMidstreamRetry('response_failed_disconnected', attemptIndex);
-            if (blob.includes('network_error')) return _allowMidstreamRetry('response_failed_network', attemptIndex);
-            if (blob.includes('auth context expired')) return _allowMidstreamRetry('response_failed_auth_expired', attemptIndex);
-        } catch {}
-    }
-
-    // Unknown → default-deny (don't risk a second full-cost turn for an error
-    // class we haven't proven is transient).
-    return null;
+    return classifyMidstreamError(err, state, WS_MIDSTREAM_POLICY);
 }
 
+// Per-classifier retry budget, used by the sendViaWebSocket loop to bound the
+// attempt count once classifyMidstreamError returns a bucket. Mirrors the
+// shared _midstreamLimitFor(ws) — the numbers come from MIDSTREAM_RETRY_POLICY.
 function _midstreamRetryLimit(classifier) {
     return classifier === 'ws_1006' || classifier === 'ws_1011'
         ? MIDSTREAM_WS_TRANSIENT_RETRY_LIMIT
         : MIDSTREAM_DEFAULT_RETRY_LIMIT;
 }
 
-function _allowMidstreamRetry(classifier, attemptIndex) {
-    return attemptIndex < _midstreamRetryLimit(classifier) ? classifier : null;
-}
-
 function _midstreamBackoffFor(retryNumber) {
     const raw = MIDSTREAM_BACKOFF_MS[Math.min(Math.max(retryNumber, 1), MIDSTREAM_BACKOFF_MS.length) - 1];
     return jitterDelayMs(raw);
@@ -2200,25 +2187,11 @@ function _backoffFor(attempt) {
 
 const _defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
-async function _sleepWithAbort(ms, externalSignal, sleepFn = _defaultSleep) {
-    if (!ms) return;
-    if (!externalSignal) {
-        await sleepFn(ms);
-        return;
-    }
-    await new Promise((resolve, reject) => {
-        const t = setTimeout(() => {
-            externalSignal.removeEventListener('abort', onAbort);
-            resolve();
-        }, ms);
-        const onAbort = () => {
-            clearTimeout(t);
-            const reason = externalSignal.reason;
-            reject(reason instanceof Error ? reason : new Error('OpenAI OAuth WS retry backoff aborted'));
-        };
-        if (externalSignal.aborted) { onAbort(); return; }
-        externalSignal.addEventListener('abort', onAbort, { once: true });
-    });
+// Abort-aware backoff sleep → shared sleepWithAbort (retry-classifier.mjs). The
+// abortMessage preserves the prior fallback text when the abort reason is not an
+// Error; _sleepFn (test seam) is threaded through as the no-signal sleep impl.
+function _sleepWithAbort(ms, externalSignal, sleepFn = _defaultSleep) {
+    return sleepWithAbort(ms, externalSignal, sleepFn, 'OpenAI OAuth WS retry backoff aborted');
 }
 
 /**
@@ -2274,7 +2247,7 @@ export async function _acquireWithRetry({
                     try { err.retryClassifier = classifier; } catch {}
                 }
                 try {
-                    process.stderr.write(
+                    if (!process.env.MIXDOG_QUIET_PROVIDER_LOG) process.stderr.write(
                         `[openai-oauth-ws] handshake failed after ${attempt}/${HANDSHAKE_MAX_ATTEMPTS} attempts: ${err?.message || err}\n`,
                     );
                 } catch {}
@@ -2283,7 +2256,7 @@ export async function _acquireWithRetry({
             // Schedule backoff and emit progress.
             const backoff = _backoffFor(attempt);
             try {
-                process.stderr.write(
+                if (!process.env.MIXDOG_QUIET_PROVIDER_LOG) process.stderr.write(
                     `[openai-oauth-ws] worker retry ${attempt}/${HANDSHAKE_MAX_ATTEMPTS} (transient: ${classifier}, backoff ${backoff}ms)\n`,
                 );
             } catch {}
@@ -2371,6 +2344,14 @@ export async function sendViaWebSocket({
     const MAX_MIDSTREAM_RETRIES = MIDSTREAM_WS_TRANSIENT_RETRY_LIMIT;
     let firstAttemptError = null;
     let firstAttemptClassifier = null;
+    // Known tool names for the leaked-tool-call guard in _streamResponse.
+    // Derived from the exact request body so a recovered leaked call only
+    // synthesizes when it names a tool actually offered to this request.
+    const knownToolNames = new Set(
+        (Array.isArray(body?.tools) ? body.tools : [])
+            .map((t) => (typeof t?.name === 'string' ? t.name : null))
+            .filter(Boolean),
+    );
     // Live-text invariant across attempts: once ANY attempt has relayed a
     // non-empty text chunk to the client, no error thrown out of this function
     // may omit the liveTextEmitted/unsafeToRetry markers — otherwise an
@@ -2379,23 +2360,15 @@ export async function sendViaWebSocket({
     // already-rendered output. A text-emitting attempt is never retry-eligible
     // (_classifyMidstreamError returns null on emittedText), so the surfaced
     // error is frequently an EARLIER attempt's firstAttemptError that never saw
-    // the marker; _stampLiveText re-applies it on every throw path.
-    let liveTextEmittedAcrossAttempts = false;
-    const _stampLiveText = (e) => {
-        if (liveTextEmittedAcrossAttempts && e) {
-            try { e.liveTextEmitted = true; e.unsafeToRetry = true; } catch {}
-        }
-        return e;
-    };
-    // Tool-call relay invariant: same latch pattern as live text — once a tool
-    // call was forwarded, surfaced errors must block HTTP fallback / reissue.
-    let toolEmittedAcrossAttempts = false;
-    const _stampTool = (e) => {
-        if (toolEmittedAcrossAttempts && e) {
-            try { e.emittedToolCall = true; e.unsafeToRetry = true; } catch {}
-        }
-        return e;
-    };
+    // the marker; stampText re-applies it on every throw path. The latch state
+    // + stamp semantics now come from the shared createStreamSafetyStamps()
+    // factory (retry-classifier.mjs) — identical to the former _stampLiveText /
+    // _stampTool closures. markText()/markTool() set the latch (replacing the
+    // liveTextEmittedAcrossAttempts / toolEmittedAcrossAttempts booleans);
+    // stampText/stampTool re-apply the markers on every throw.
+    const _safetyStamps = createStreamSafetyStamps();
+    const _stampLiveText = _safetyStamps.stampText;
+    const _stampTool = _safetyStamps.stampTool;
     // Server-side xAI conversation anchor preserved across mid-stream
     // retries. xAI keys its conversation by previous_response_id alone
     // (sessionToken is null for xAI in _mintSessionToken); a forceFresh
@@ -2639,6 +2612,7 @@ export async function sendViaWebSocket({
                 logSuppressedReasoningDeltas,
                 traceProvider,
                 _timeouts: streamTimeouts,
+                knownToolNames,
             });
         } catch (err) {
             // Snapshot the xAI conversation anchor BEFORE releasing the
@@ -2665,10 +2639,10 @@ export async function sendViaWebSocket({
                 // Latch across attempts: even though THIS error is never
                 // retry-eligible once text is out, a later/earlier surfaced
                 // error (firstAttemptError) must still carry the marker.
-                liveTextEmittedAcrossAttempts = true;
+                _safetyStamps.markText();
             }
             if (midState.emittedToolCall) {
-                toolEmittedAcrossAttempts = true;
+                _safetyStamps.markTool();
             }
             _stampLiveText(err);
             _stampTool(err);
@@ -2685,7 +2659,7 @@ export async function sendViaWebSocket({
                 const backoff = _midstreamBackoffFor(retryNumber);
                 try {
                     const line = `[openai-oauth-ws] mid-stream recovered: retry ${retryNumber}/${retryLimit} (cause: ${classifier}, backoff ${backoff}ms)\n`;
-                    process.stderr.write(line);
+                    if (!process.env.MIXDOG_QUIET_PROVIDER_LOG) process.stderr.write(line);
                     emittedProgress.push(line);
                 } catch {}
                 await _sleepWithAbort(backoff, externalSignal, _sleepFn);
@@ -2794,8 +2768,8 @@ export async function sendViaWebSocket({
                 transport: 'websocket',
                 ws_mode: mode,
                 ws_pre_response_created_timeout_ms: WS_PRE_RESPONSE_CREATED_MS,
-                ws_first_meaningful_timeout_ms: WS_FIRST_MEANINGFUL_MS,
                 ws_inter_chunk_timeout_ms: WS_INTER_CHUNK_MS,
+                ws_idle_ms: WS_IDLE_MS,
                 iteration_delta_tokens: deltaTokens,
                 reused_connection: reused,
                 requested_service_tier: requestedServiceTier,