mixdog 0.9.1 → 0.9.2

package/src/runtime/agent/orchestrator/providers/openai-oauth.mjs

@@ -29,13 +29,17 @@ import {
     traceAgentUsage,
 } from '../agent-trace.mjs';
 import {
-    PROVIDER_GENERATE_TOTAL_TIMEOUT_MS,
     PROVIDER_HTTP_RESPONSE_TIMEOUT_MS,
+    PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS,
+    PROVIDER_SSE_IDLE_WATCHDOG_ENABLED,
+    streamStalledError,
     createTimeoutSignal,
+    createPassthroughSignal,
 } from '../stall-policy.mjs';
 import { populateHttpStatusFromMessage, shouldFallbackTransport } from './retry-classifier.mjs';
 import { getLlmDispatcher, preconnect } from '../../../shared/llm/http-agent.mjs';
 import { makeInvalidToolArgsMarker } from './openai-compat-stream.mjs';
+import { createLeakGuard, createToolCallDedupe, dedupeToolCallList } from './anthropic-leaked-toolcall.mjs';
 import {
     normalizeContentForOpenAIResponses,
     splitToolContentForOpenAIResponses,
@@ -160,6 +164,17 @@ function _displayCodexModel(id) {
     return id.replace(/-\d{4}-\d{2}-\d{2}$/, '');
 }
 
+function _positiveCodexContextWindow(value) {
+    const n = Number(value);
+    return Number.isFinite(n) && n > 0 ? Math.floor(n) : null;
+}
+
+function _codexContextWindowFromApi(m) {
+    return _positiveCodexContextWindow(m?.context_window)
+        || _positiveCodexContextWindow(m?.max_context_window)
+        || null;
+}
+
 function _normalizeCodexModel(m) {
     const id = m?.slug || m?.id;
     const family = _codexFamily(id);
@@ -182,8 +197,8 @@ function _normalizeCodexModel(m) {
         display: m?.display_name || id,
         family,
         provider: 'openai-oauth',
-        contextWindow: m?.context_window || m?.max_context_window || 1000000,
-        maxContextWindow: m?.max_context_window || null,
+        contextWindow: _codexContextWindowFromApi(m),
+        maxContextWindow: _positiveCodexContextWindow(m?.max_context_window),
         outputTokens: m?.max_output_tokens || m?.output_tokens || 32768,
         autoCompactTokenLimit: m?.auto_compact_token_limit || null,
         effectiveContextWindowPercent: m?.effective_context_window_percent || null,
@@ -773,11 +788,20 @@ export async function sendViaHttpSse({
     useModel,
     fetchFn = fetch,
 } = {}) {
-    const totalTimeout = createTimeoutSignal(
-        externalSignal,
-        PROVIDER_GENERATE_TOTAL_TIMEOUT_MS,
-        'OpenAI OAuth HTTP fallback total',
-    );
+    // P1 audit fix: no fixed wall-clock total cap on the HTTP/SSE fallback
+    // stream. The old createTimeoutSignal(..., PROVIDER_GENERATE_TOTAL_TIMEOUT_MS)
+    // killed a healthy, still-streaming turn purely on elapsed time, unlike
+    // every other streaming provider path (anthropic-oauth uses the same
+    // createPassthroughSignal pattern — see anthropic-oauth.mjs "Option A").
+    // The stream is bounded instead by:
+    //   (a) headerTimeout below (PROVIDER_HTTP_RESPONSE_TIMEOUT_MS) for a
+    //       socket that never sends the initial response,
+    //   (b) the SEMANTIC idle watchdog (_armSemanticIdle /
+    //       PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS), which resets on every
+    //       meaningful() chunk — a live stream stays alive, a truly silent
+    //       one still aborts, and
+    //   (c) externalSignal (client disconnect / replaced-by-newer-request).
+    const totalTimeout = createPassthroughSignal(externalSignal);
     const headerTimeout = createTimeoutSignal(
         totalTimeout.signal,
         PROVIDER_HTTP_RESPONSE_TIMEOUT_MS,
@@ -851,6 +875,33 @@ export async function sendViaHttpSse({
         if (totalTimeout.signal.aborted) _onTotalAbort();
         else totalTimeout.signal.addEventListener('abort', _onTotalAbort, { once: true });
     }
+    // SEMANTIC idle watchdog: reset ONLY on meaningful() (text/reasoning/tool
+    // deltas), never on raw bytes/keepalive frames, so a stream that emits some
+    // deltas then goes silent trips a short, named terminal failure instead of
+    // hanging until the 30-min agent watchdog. Disablable via the shared env.
+    let _semanticIdleTimer = null;
+    const _clearSemanticIdle = () => {
+        if (_semanticIdleTimer) { clearTimeout(_semanticIdleTimer); _semanticIdleTimer = null; }
+    };
+    const _armSemanticIdle = () => {
+        if (!PROVIDER_SSE_IDLE_WATCHDOG_ENABLED || !(PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS > 0)) return;
+        _clearSemanticIdle();
+        _semanticIdleTimer = setTimeout(() => {
+            _streamAbortReason = streamStalledError('OpenAI OAuth HTTP fallback', PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS, { emittedToolCall: emittedToolCallIds.size > 0 });
+            // Partial-final recovery parity with anthropic-oauth: attach the
+            // streamed partial state so the agent loop can accept a wedged FINAL
+            // no-tool summary as a successful partial-final instead of dropping
+            // the result. pendingToolUse gates out any mid-flight tool call.
+            try {
+                _streamAbortReason.partialContent = content;
+                _streamAbortReason.partialToolCalls = toolCalls.length ? toolCalls.slice() : undefined;
+                _streamAbortReason.pendingToolUse = pendingCalls.size > 0 || emittedToolCallIds.size > 0;
+                _streamAbortReason.partialModel = model || undefined;
+            } catch { /* best-effort enrichment */ }
+            try { reader.cancel(_streamAbortReason).catch(() => {}); } catch {}
+        }, PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS);
+        try { _semanticIdleTimer.unref?.(); } catch {}
+    };
     let buffer = '';
     let content = '';
     let model = '';
@@ -885,13 +936,75 @@ export async function sendViaHttpSse({
     // first complete frame still emits; only redundant re-emits are
     // suppressed.
     const emittedToolCallIds = new Set();
+    // Fix 2: cross-path name+args dedupe. A text-leaked synthetic and an
+    // identical native function_call must fire onToolCall exactly once.
+    const _toolDedupe = createToolCallDedupe();
     const emitToolCall = (call) => {
         if (!call || !call.id) return;
         if (emittedToolCallIds.has(call.id)) return;
         emittedToolCallIds.add(call.id);
+        if (!_toolDedupe.shouldDispatch(call.name, call.arguments)) return;
         try { onToolCall?.(call); } catch {}
     };
 
+    // Leaked tool-call guard. The model sometimes emits a tool call as plain
+    // text (XML `<invoke>`/`<function_calls>` or gpt-oss harmony
+    // `<|channel|>...to=functions.NAME...<|call|>`) inside
+    // `response.output_text.delta` instead of a native function_call. Route
+    // text through the guard so leaked calls are suppressed from the visible
+    // stream, synthesized (native `call_...` id shape), and dispatched like
+    // native ones. Known tool names come from the request body so recovery
+    // only fires for tools the model was actually offered. Additive: the
+    // native function_call path is untouched.
+    const _leakKnownTools = new Set(
+        (Array.isArray(body?.tools) ? body.tools : [])
+            .map((t) => (typeof t?.name === 'string' ? t.name : null))
+            .filter(Boolean),
+    );
+    const leakGuard = createLeakGuard({ knownToolNames: _leakKnownTools, harmony: true });
+    const dispatchLeakedCall = (recovered) => {
+        let args = recovered?.arguments;
+        if (args === null || typeof args !== 'object' || Array.isArray(args)) args = {};
+        const call = {
+            id: `call_leaked_${randomBytes(8).toString('hex')}`,
+            name: recovered.name,
+            arguments: args,
+        };
+        toolCalls.push(call);
+        emitToolCall(call);
+    };
+    const relayLeakText = (delta) => {
+        if (!leakGuard.enabled) {
+            content += delta || '';
+            if (delta && onTextDelta) {
+                emittedText = true;
+                try { onTextDelta(delta); } catch {}
+            }
+            return;
+        }
+        const { text, calls } = leakGuard.push(delta);
+        if (text) {
+            content += text;
+            if (onTextDelta) {
+                emittedText = true;
+                try { onTextDelta(text); } catch {}
+            }
+        }
+        for (const c of calls) dispatchLeakedCall(c);
+    };
+    const flushLeak = () => {
+        if (!leakGuard.enabled) return;
+        const { text, calls } = leakGuard.flush();
+        if (text) {
+            content += text;
+            if (onTextDelta) {
+                emittedText = true;
+                try { onTextDelta(text); } catch {}
+            }
+        }
+        for (const c of calls) dispatchLeakedCall(c);
+    };
+
     const pushWebSearchCall = (item) => {
         if (!item || item.type !== 'web_search_call') return;
         const key = item.id || JSON.stringify(item.action || item);
@@ -939,6 +1052,7 @@ export async function sendViaHttpSse({
     };
     const meaningful = () => {
         if (ttftMs == null) ttftMs = Date.now() - sseStartedAt;
+        _armSemanticIdle();
         try { onStreamDelta?.(); } catch {}
     };
     const handleEvent = (event) => {
@@ -949,12 +1063,8 @@ export async function sendViaHttpSse({
                 if (event.response?.id) responseId = event.response.id;
                 break;
             case 'response.output_text.delta':
-                content += event.delta || '';
                 meaningful();
-                if (event.delta && onTextDelta) {
-                    emittedText = true;
-                    try { onTextDelta(event.delta); } catch {}
-                }
+                relayLeakText(event.delta || '');
                 break;
             case 'response.reasoning_text.delta':
             case 'response.reasoning_summary_text.delta':
@@ -1030,7 +1140,20 @@ export async function sendViaHttpSse({
                 for (const item of resp.output || []) {
                     if (item.type === 'message') {
                         for (const part of item.content || []) {
-                            if (!content && part.type === 'output_text') content += part.text || '';
+                            if (!content && part.type === 'output_text') {
+                                // Completed-output fallback (no streamed text).
+                                // Route through the leak guard so a tool call
+                                // leaked only in the final bundle is recovered
+                                // rather than surfaced as visible content. push
+                                // with final=true flushes fully (no held tail).
+                                if (leakGuard.enabled) {
+                                    const { text, calls } = leakGuard.push(part.text || '', true);
+                                    content += text;
+                                    for (const c of calls) dispatchLeakedCall(c);
+                                } else {
+                                    content += part.text || '';
+                                }
+                            }
                             if (part.type === 'output_text') _pushOutputTextAnnotations(part, citations, citationKeys);
                         }
                     } else if (item.type === 'reasoning') {
@@ -1116,10 +1239,12 @@ export async function sendViaHttpSse({
 
     try {
         while (true) {
-            if (totalTimeout.signal.aborted) {
+            if (totalTimeout.signal?.aborted) {
+                _clearSemanticIdle();
                 const reason = totalTimeout.signal.reason;
                 throw reason instanceof Error ? reason : new Error('OpenAI OAuth HTTP fallback aborted');
             }
+            if (_streamAbortReason) throw _streamAbortReason;
             const { value, done } = await reader.read();
             if (done) break;
             buffer += decoder.decode(value, { stream: true });
@@ -1140,12 +1265,16 @@ export async function sendViaHttpSse({
             const event = _parseSseFrame(frame);
             if (event) handleEvent(event);
         }
+        // Flush any partial-sentinel tail held back mid-stream so legitimate
+        // trailing text is never lost (streamed-text path).
+        flushLeak();
     } catch (err) {
         // Live-text invariant: once a non-empty chunk has been relayed it
         // cannot be withdrawn — flag the error so no upstream layer retries.
         if (emittedText && err) { try { err.liveTextEmitted = true; err.unsafeToRetry = true; } catch {} }
         throw err;
     } finally {
+        _clearSemanticIdle();
         try { reader.releaseLock?.(); } catch {}
         if (_onTotalAbort && totalTimeout.signal) {
             try { totalTimeout.signal.removeEventListener('abort', _onTotalAbort); } catch {}
@@ -1186,15 +1315,27 @@ export async function sendViaHttpSse({
             serviceTier,
         });
     }
+    // Dedupe the returned array by name+args (Fix 2, array side): a synthetic
+    // leaked call and an identical native function_call must not both survive,
+    // else the agent loop executes the side-effecting tool twice.
+    const _returnedToolCalls = toolCalls.length
+        ? dedupeToolCallList(toolCalls.map(({ _pendingItemId, ...t }) => t))
+        : undefined;
     return {
         content,
         model: liveModel,
         reasoningItems: reasoningItems.length ? reasoningItems : undefined,
-        toolCalls: toolCalls.length ? toolCalls.map(({ _pendingItemId, ...t }) => t) : undefined,
+        toolCalls: _returnedToolCalls,
         citations: citations.length ? citations : undefined,
         webSearchCalls: webSearchCalls.length ? webSearchCalls : undefined,
         usage: usage || undefined,
         stopReason: stopReason || undefined,
+        // P1 audit fix: text-only max-output cutoff (openai-oauth HTTP/SSE
+        // fallback maps status:'incomplete'/reason=max_output_tokens to
+        // stopReason='length' above and treats it as success). Flag it so
+        // loop.mjs can surface a truncation warning instead of accepting
+        // silently-cut content as a clean final answer.
+        ...(stopReason === 'length' && content.length > 0 ? { truncated: true } : {}),
         responseId: responseId || undefined,
         serviceTier: serviceTier || undefined,
     };
@@ -1328,8 +1469,8 @@ export class OpenAIOAuthProvider {
         const onTextDelta = typeof opts.onTextDelta === 'function' ? opts.onTextDelta : null;
         const externalSignal = opts.signal || null;
         const _sendSessionId = opts.sessionId || '(none)';
-        const _sendRole = opts.role || '(none)';
-        if (process.env.MIXDOG_DEBUG_AGENT) { process.stderr.write(`[agent-trace] auth-start sessionHash=${createHash('sha256').update(String(_sendSessionId)).digest('hex').slice(0, 8)} role=${_sendRole} expiringInMs=${this.tokens?.expires_at ? this.tokens.expires_at - Date.now() : 'unknown'}\n`); }
+        const _sendAgent = opts.agent || '(none)';
+        if (process.env.MIXDOG_DEBUG_AGENT) { process.stderr.write(`[agent-trace] auth-start sessionHash=${createHash('sha256').update(String(_sendSessionId)).digest('hex').slice(0, 8)} agent=${_sendAgent} expiringInMs=${this.tokens?.expires_at ? this.tokens.expires_at - Date.now() : 'unknown'}\n`); }
         // Build request body in parallel with auth resolution. ensureAuth is
         // a no-op fast-path on cached tokens, but a refresh round-trip can
         // take 300ms+; the body build (message serialisation) overlaps cleanly.
@@ -1389,6 +1530,26 @@ export class OpenAIOAuthProvider {
             this._forceHttpFallback = true;
             this._forceHttpFallbackUntil = Date.now() + ttlMs;
         };
+        const traceWsError = (err, stage = 'primary') => {
+            try {
+                appendAgentTrace({
+                    sessionId: poolKey,
+                    iteration,
+                    kind: 'transport_error',
+                    provider: 'openai-oauth',
+                    model: useModel,
+                    transport: 'websocket',
+                    payload: {
+                        stage,
+                        error_code: err?.code || null,
+                        error_http_status: Number(err?.httpStatus || 0) || null,
+                        error_classifier: err?.retryClassifier || err?.midstreamClassifier || null,
+                        live_text_emitted: err?.liveTextEmitted === true || err?.unsafeToRetry === true,
+                        message: String(err?.message || err || '').slice(0, 500),
+                    },
+                });
+            } catch {}
+        };
         const dispatchHttp = async (reason, originalErr = null, { sticky = false } = {}) => {
             appendAgentTrace({
                 sessionId: poolKey,
@@ -1411,7 +1572,7 @@ export class OpenAIOAuthProvider {
                     process.stderr.write('[openai-oauth] WebSocket bypassed (forced); using HTTP/SSE\n');
                 }
             } else {
-                process.stderr.write(`[openai-oauth] WebSocket unhealthy (${reason}); falling back to HTTP/SSE\n`);
+                if (!process.env.MIXDOG_QUIET_PROVIDER_LOG) process.stderr.write(`[openai-oauth] WebSocket unhealthy (${reason}); falling back to HTTP/SSE\n`);
             }
             const result = await sendHttp({
                 auth,
@@ -1459,11 +1620,12 @@ export class OpenAIOAuthProvider {
         // Prefer WebSocket for hot cache/delta transport; fall back to HTTP/SSE
         // after retry-exhausted handshake/acquire/no-first-event failures.
         try {
-            if (process.env.MIXDOG_DEBUG_AGENT) { process.stderr.write(`[agent-trace] provider-send-start model=${useModel} role=${_sendRole} sessionHash=${createHash('sha256').update(String(_sendSessionId)).digest('hex').slice(0, 8)} iteration=${iteration ?? '(none)'}\n`); }
+            if (process.env.MIXDOG_DEBUG_AGENT) { process.stderr.write(`[agent-trace] provider-send-start model=${useModel} agent=${_sendAgent} sessionHash=${createHash('sha256').update(String(_sendSessionId)).digest('hex').slice(0, 8)} iteration=${iteration ?? '(none)'}\n`); }
             const result = await dispatchWs(false);
             if (process.env.MIXDOG_DEBUG_AGENT) { process.stderr.write(`[agent-trace] provider-send-end elapsed=${Date.now() - _t1}ms result=ok\n`); }
             return recordLiveModel(result);
         } catch (err) {
+            traceWsError(err, 'primary');
             const status = err?.httpStatus;
             // Live-text invariant: if the WS attempt already relayed a
             // non-empty text chunk to the client, NO recovery path may reissue
@@ -1482,6 +1644,7 @@ export class OpenAIOAuthProvider {
                     if (process.env.MIXDOG_DEBUG_AGENT) { process.stderr.write(`[agent-trace] provider-send-end elapsed=${Date.now() - _t1}ms result=ok\n`); }
                     return recordLiveModel(result);
                 } catch (retryErr) {
+                    traceWsError(retryErr, 'auth_retry');
                     if (_shouldUseOpenAIHttpFallback(retryErr, externalSignal)) {
                         try {
                             return await dispatchHttp(

package/src/runtime/agent/orchestrator/providers/openai-ws.mjs

@@ -71,6 +71,24 @@ export class OpenAIDirectProvider {
         // so gpt-5.4-mini can opt into Priority even when the OAuth catalog does
         // not advertise a Fast tier for its OAuth endpoint.
         applyOpenAIDirectFastTier(body, useModel, opts);
+        // P0 audit fix: buildRequestBody (openai-oauth.mjs) defaults
+        // store:false (env-gated, MIXDOG_OAI_STORE), which is correct for
+        // the openai-oauth ChatGPT-subscription backend — that backend keeps
+        // its own conversation state via the WS handshake session_id
+        // (see openai-oauth-ws.mjs "conversation slot ... in-memory prefix
+        // state"), independent of the public Responses API `store` field.
+        // The public OpenAI direct WS path below, however, talks to the real
+        // api.openai.com Responses API, where `previous_response_id`
+        // continuation is only valid when the anchored response was actually
+        // stored — store:false + previous_response_id is a broken
+        // combination there (the server has nothing to look up). This
+        // provider's WS transport always injects previous_response_id via
+        // openai-oauth-ws.mjs's delta path once a response id is cached, so
+        // force store:true here — same override xAI's Responses path takes
+        // (see openai-compat.mjs _doSendXaiResponses/_doSendXaiResponsesWebSocket:
+        // "the public endpoint currently returns previous_response_not_found
+        // ... unless the chain is stored").
+        body.store = true;
         // Public Responses API supports prompt_cache_retention='24h' at no
         // extra cost (same cached_input_tokens billing as the default 5–10
         // min in-memory cache). openai-oauth rejects the parameter, so it's

package/src/runtime/agent/orchestrator/providers/opencode-go-usage.mjs

@@ -1,6 +1,6 @@
-import { existsSync, readFileSync, mkdirSync } from 'node:fs';
-import * as fsp from 'node:fs/promises';
+import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { updateJsonAtomicSync } from '../../../shared/atomic-file.mjs';
 import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
 import { getOpenCodeGoAuthCookie } from '../../../shared/config.mjs';
 
@@ -53,12 +53,18 @@ function readJson(file) {
   }
 }
 
+// Synchronous atomic+lock write (updateJsonAtomicSync) instead of the prior
+// fire-and-forget fsp.writeFile: this cache is single-entry (one snapshot
+// per file, no cross-process merge), so the lock protects against a torn
+// write racing readers, not a lost-update merge. Only one write happens
+// per successful fetch (TTL-gated, at most once per LIVE_TTL_MS), so the
+// switch off async has no meaningful latency impact on the request path.
 function writeJson(file, value) {
-  diskJsonCache = { at: Date.now(), file, value };
+  let next = null;
   try {
-    mkdirSync(resolvePluginData(), { recursive: true });
-    void fsp.writeFile(file, JSON.stringify(value, null, 2), 'utf8').catch(() => {});
+    next = updateJsonAtomicSync(file, () => value, { lock: true, fsyncDir: true, timeoutMs: 1000 }); // best-effort cache write: short lock timeout, don't block on contention
   } catch {}
+  if (next) diskJsonCache = { at: Date.now(), file, value: next }; // only mirror on confirmed write, avoid phantom cache on lock timeout
 }
 
 function freshSnapshot(snapshot, ttlMs) {

package/src/runtime/agent/orchestrator/providers/registry.mjs

@@ -201,7 +201,8 @@ export function getProvider(name) {
 // unregistered providers default to false (the openai/gemini majority).
 export function providerInputExcludesCache(name) {
     const p = getProvider(name);
-    return p?.constructor?.inputExcludesCache === true;
+    if (p?.constructor?.inputExcludesCache === true) return true;
+    return String(name || '').toLowerCase().includes('anthropic');
 }
 export function getAllProviders() {
     // Defensive copy — callers must not mutate the live registry or retain

package/src/runtime/agent/orchestrator/providers/retry-classifier.mjs

@@ -126,7 +126,7 @@ export function classifyError(err) {
     || code === 'EAI_AGAIN' || code === 'ENOTFOUND' || code === 'EAI_NODATA'
     || code === 'ECONNREFUSED' || code === 'ENETUNREACH' || code === 'EHOSTUNREACH'
     || code === 'EPIPE'
-    || code === 'EPROVIDERTIMEOUT' || code === 'EGEMINITIMEOUT'
+    || code === 'EPROVIDERTIMEOUT' || code === 'EGEMINITIMEOUT' || code === 'ESTREAMSTALL'
     || code === 'EWSACQUIRETIMEOUT') {
     return 'transient'
   }
@@ -282,7 +282,7 @@ export function classifyMidstreamError(err, signals, policy = {}) {
 
 // Verbatim relocation of openai-oauth-ws's _classifyMidstreamError. `signals`
 // carries sawResponseCreated / sawCompleted / emittedText / emittedToolCall /
-// wsCloseCode / firstByteTimeout / firstMeaningfulTimeout / wsSendFailed /
+// wsCloseCode / firstByteTimeout / wsSendFailed /
 // userAbort / watchdogAbort / responseFailedPayload exactly as before.
 function _classifyMidstreamWs(err, state, attemptIndex, policy) {
   if (state.sawCompleted) return null
@@ -294,9 +294,6 @@ function _classifyMidstreamWs(err, state, attemptIndex, policy) {
   if (state.firstByteTimeout || err?.firstByteTimeout) {
     return _allowMidstream('first_byte_timeout', attemptIndex, policy)
   }
-  if (state.firstMeaningfulTimeout || err?.firstMeaningfulTimeout) {
-    return _allowMidstream('first_meaningful_timeout', attemptIndex, policy)
-  }
   if (err?.wsSendFailed || state.wsSendFailed) {
     return _allowMidstream('ws_send_failed', attemptIndex, policy)
   }
@@ -315,7 +312,12 @@ function _classifyMidstreamWs(err, state, attemptIndex, policy) {
 
   const name = err?.name || ''
   if (name === 'AgentStallAbortError') return _allowMidstream('agent_stall', attemptIndex, policy)
-  if (name === 'StreamStalledAbortError') return _allowMidstream('stream_stalled', attemptIndex, policy)
+  if (name === 'StreamStalledAbortError' || name === 'StreamStalledError' || err?.code === 'ESTREAMSTALL' || err?.streamStalled === true) {
+    // A stall that fired AFTER a tool call was emitted is unsafe to replay
+    // (double side-effect); surface it as terminal so the turn is not retried.
+    if (err?.unsafeToRetry === true) return null
+    return _allowMidstream('stream_stalled', attemptIndex, policy)
+  }
 
   if (state.watchdogAbort === 'AgentStallAbortError') return _allowMidstream('agent_stall', attemptIndex, policy)
   if (state.watchdogAbort === 'StreamStalledAbortError') return _allowMidstream('stream_stalled', attemptIndex, policy)
@@ -357,7 +359,12 @@ function _classifyMidstreamSse(err, state, attemptIndex, policy) {
 
   const name = err?.name || ''
   if (name === 'AgentStallAbortError') return 'agent_stall'
-  if (name === 'StreamStalledAbortError') return 'stream_stalled'
+  if (name === 'StreamStalledAbortError' || name === 'StreamStalledError' || err?.code === 'ESTREAMSTALL' || err?.streamStalled === true) {
+    // A stall AFTER a tool emit is unsafe to replay (double side-effect) →
+    // terminal (null), no mid-stream retry. Otherwise route to stream_stalled.
+    if (err?.unsafeToRetry === true) return null
+    return 'stream_stalled'
+  }
   if (state.watchdogAbort === 'AgentStallAbortError') return 'agent_stall'
   if (state.watchdogAbort === 'StreamStalledAbortError') return 'stream_stalled'
 
@@ -379,7 +386,7 @@ function _classifyMidstreamSse(err, state, attemptIndex, policy) {
 //    env-flag check (caller computes the flag and passes it).
 const TRANSPORT_FALLBACK_CLASSIFIERS = new Set([
   'timeout', 'reset', 'dns', 'refused', 'network', 'acquire_timeout', 'http_5xx',
-  'first_byte_timeout', 'first_meaningful_timeout',
+  'first_byte_timeout',
   'ws_1006', 'ws_1011', 'ws_1012', 'ws_1000', 'ws_4000', 'agent_stall', 'stream_stalled',
   'response_failed_disconnected', 'response_failed_network', 'response_failed_auth_expired',
   'ws_send_failed',
@@ -403,7 +410,6 @@ export function shouldFallbackTransport(err, { signal, enabled = true } = {}) {
   if (TRANSPORT_FALLBACK_CLASSIFIERS.has(classifier)) return true
   if (/^http_5\d\d$/.test(classifier)) return true
   if (err?.firstByteTimeout) return true
-  if (err?.firstMeaningfulTimeout) return true
   const msg = String(err?.message || '')
   return /opening handshake has timed out|socket hang up|acquire timed out|no first server event|no meaningful output/i.test(msg)
 }