mixdog 0.9.1 → 0.9.3

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -1,4 +1,4 @@
-import Anthropic from '@anthropic-ai/sdk';
+import { createRequire } from 'node:module';
 import { loadConfig } from '../config.mjs';
 import { sanitizeToolPairs, sanitizeAnthropicContentPairs } from '../session/context-utils.mjs';
 import { classifyError, midstreamBackoffFor, sleepWithAbort, withRetry } from './retry-classifier.mjs';
@@ -15,10 +15,27 @@ import {
     _classifyMidstreamError,
 } from './anthropic-oauth.mjs';
 import { buildAnthropicBetaHeaders, supportsAnthropicFastMode } from './anthropic-betas.mjs';
+import {
+    applyAnthropicEffortToBody,
+    effortValuesForModel,
+    shouldIncludeEffortBeta,
+} from './anthropic-effort.mjs';
 import { normalizeContentForAnthropic } from './media-normalization.mjs';
 import { enrichModels } from './model-catalog.mjs';
+import { makeModelCache } from './model-cache.mjs';
+import { resolveAnthropicMaxTokens } from './anthropic-max-tokens.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
 
+const require = createRequire(import.meta.url);
+let _Anthropic = null;
+function loadAnthropic() {
+    if (!_Anthropic) {
+        const mod = require('@anthropic-ai/sdk');
+        _Anthropic = mod.default || mod.Anthropic || mod;
+    }
+    return _Anthropic;
+}
+
 // Abort-aware mid-stream backoff sleep → shared sleepWithAbort
 // (retry-classifier.mjs). abortMessage preserves the prior fallback text.
 function _midstreamSleepWithAbort(ms, signal) {
@@ -117,6 +134,10 @@ function _defaultContextForModel(id, family) {
     return 200000;
 }
 
+function _capabilitySupported(capability) {
+    return capability === true || capability?.supported === true;
+}
+
 function _normalizeAnthropicModel(raw, provider = 'anthropic') {
     const id = raw?.id || raw?.name || raw?.model;
     if (!id) return null;
@@ -124,35 +145,64 @@ function _normalizeAnthropicModel(raw, provider = 'anthropic') {
     const family = familyMatch ? familyMatch[1].toLowerCase() : 'other';
     const dated = /-\d{8}$/.test(String(id));
     const versioned = !dated && /^claude-[a-z]+-\d+(?:-\d+)?$/i.test(String(id));
+    const effortValues = effortValuesForModel(raw?.capabilities, id);
     return {
         id,
         display: raw?.display_name || raw?.displayName || raw?.display || _prettyName(id, family),
         family,
         provider,
-        contextWindow: raw?.context_window || raw?.max_context_window || raw?.input_token_limit || raw?.inputTokenLimit || _defaultContextForModel(id, family),
-        outputTokens: raw?.max_output_tokens || raw?.output_token_limit || raw?.outputTokenLimit || null,
+        contextWindow: raw?.context_window || raw?.max_context_window || raw?.max_input_tokens || raw?.input_token_limit || raw?.inputTokenLimit || _defaultContextForModel(id, family),
+        outputTokens: raw?.max_tokens || raw?.max_output_tokens || raw?.output_token_limit || raw?.outputTokenLimit || null,
         tier: dated ? 'dated' : versioned ? 'version' : 'family',
         latest: false,
+        supportsReasoning: effortValues.length > 0 || _capabilitySupported(raw?.capabilities?.thinking),
+        reasoningOptions: effortValues.length ? [{ type: 'effort', values: effortValues }] : [],
     };
 }
 // Family-based heuristic so new model ids (including custom user-configured
 // ones) resolve a sensible max_tokens without requiring a code change.
+// The API-key provider has no catalog cache of its own — it reads the same
+// anthropic-oauth-models.json disk cache (read-only) that the OAuth provider
+// maintains. Both providers hit the same Anthropic /v1/models catalog, so a
+// per-model outputTokens entry is valid regardless of which auth path wrote
+// it. If this provider is ever run standalone without the OAuth provider
+// ever having populated the cache, loadSync() simply returns null and we
+// fall through to the shared static heuristic in anthropic-max-tokens.mjs.
+const ANTHROPIC_OAUTH_MODEL_CACHE_TTL_MS = 24 * 60 * 60_000;
+const _sharedOAuthModelCache = makeModelCache({
+    fileName: 'anthropic-oauth-models.json',
+    ttlMs: ANTHROPIC_OAUTH_MODEL_CACHE_TTL_MS,
+    version: 1,
+});
+
+// In-memory mirror populated by this provider's own listModels() fetch.
+// API-key-only installs never have the OAuth provider write the shared disk
+// cache, so without this mirror catalog outputTokens would stay invisible to
+// resolveMaxTokens until an OAuth session runs. listModels() results flow in
+// here (memory only — the disk cache stays OAuth-owned/read-only for us).
+let _apiKeyCatalogMirror = null;
+
+function _catalogOutputTokensFromSharedCache(model) {
+    if (!model) return null;
+    try {
+        const models = Array.isArray(_apiKeyCatalogMirror)
+            ? _apiKeyCatalogMirror
+            : _sharedOAuthModelCache.loadSync();
+        if (!Array.isArray(models)) return null;
+        const entry = models.find(m => m?.id === model);
+        const out = Number(entry?.outputTokens);
+        return Number.isFinite(out) && out > 0 ? out : null;
+    } catch {
+        return null;
+    }
+}
+
 function resolveMaxTokens(model) {
-    const id = String(model || '').toLowerCase();
-    if (id.includes('opus')) return 32768;
-    if (id.includes('sonnet')) return 16384;
-    if (id.includes('haiku')) return 8192;
-    return 8192;
+    return resolveAnthropicMaxTokens(model, { catalogLookup: _catalogOutputTokensFromSharedCache });
 }
 
-// Effort → thinking budget tokens (Anthropic extended thinking)
-const EFFORT_BUDGET = {
-    low: 1024,
-    medium: 4096,
-    high: 16384,
-    xhigh: 32768,
-    max: 32768,
-};
+// Test-only escape hatch for scripts/anthropic-maxtokens-test.mjs.
+export const _test = { resolveMaxTokens };
 
 const MIN_THINKING_BUDGET = 1024;
 const THINKING_OUTPUT_RESERVE = 1024;
@@ -389,7 +439,7 @@ export class AnthropicProvider {
         this.config = config;
         this.name = config.name || 'anthropic';
         const betaHeaders = config.disableBetaHeaders ? null : buildAnthropicBetaHeaders({ toolSearch: true });
-        this.client = new Anthropic({
+        this.client = new (loadAnthropic())({
             apiKey: config.apiKey || process.env.ANTHROPIC_API_KEY,
             ...(config.baseURL ? { baseURL: config.baseURL } : {}),
             defaultHeaders: { ...(betaHeaders ? { 'anthropic-beta': betaHeaders } : {}), ...(config.extraHeaders || {}) },
@@ -403,7 +453,7 @@ export class AnthropicProvider {
             if (newKey) {
                 this.config = { ...(this.config || {}), ...(cfg || {}), apiKey: newKey };
                 const betaHeaders = this.config.disableBetaHeaders ? null : buildAnthropicBetaHeaders({ toolSearch: true });
-                this.client = new Anthropic({
+                this.client = new (loadAnthropic())({
                     apiKey: newKey,
                     ...(this.config.baseURL ? { baseURL: this.config.baseURL } : {}),
                     defaultHeaders: { ...(betaHeaders ? { 'anthropic-beta': betaHeaders } : {}), ...(this.config.extraHeaders || {}) },
@@ -451,8 +501,7 @@ export class AnthropicProvider {
         const usedSlots = toolsBpUsed + systemBpUsed;
         // Env override for BP strategy. ANTHROPIC_MSG_SLOTS=0 disables
         // message caching entirely. Any value >=1 first marks the previous
-        // user text turn; a second free slot marks the tail. Mirrors
-        // anthropic-oauth.mjs for twin parity.
+        // user text turn; a second free slot marks the tail.
         const msgSlotsCap = Number.parseInt(process.env.ANTHROPIC_MSG_SLOTS, 10);
         const defaultMsgSlots = Math.max(0, 4 - usedSlots);
         const msgSlots = ttls.messages
@@ -481,16 +530,21 @@ export class AnthropicProvider {
             // Anthropic prefix semantics (order: tools → system → messages).
             params.tools = [...nativeTools, ...toAnthropicTools([...(tools || []), ...deferredAnthropicTools(tools || [], opts)])];
         }
-        // Effort → extended thinking budget. Gateway inherit mode may pass the
-        // exact OAuth client budget from the incoming Anthropic request.
-        const thinkingBudgetTokens = Number(opts.thinkingBudgetTokens);
-        const requestedThinkingBudget = Number.isFinite(thinkingBudgetTokens) && thinkingBudgetTokens > 0
-            ? thinkingBudgetTokens
-            : (opts.effort && EFFORT_BUDGET[opts.effort] ? EFFORT_BUDGET[opts.effort] : null);
-        const budgetTokens = clampThinkingBudgetTokens(requestedThinkingBudget, maxTokens);
-        if (budgetTokens) {
-            params.thinking = { type: 'enabled', budget_tokens: budgetTokens };
-        }
+        // Known tool names for the shared parseSSEStream leaked-tool-call guard
+        // (same guard fixes both Anthropic providers). Recovered leaked calls
+        // are only synthesized when they name a tool actually offered here.
+        const knownToolNames = new Set(
+            (Array.isArray(params.tools) ? params.tools : [])
+                .map((t) => (t && typeof t.name === 'string' ? t.name : null))
+                .filter(Boolean),
+        );
+        applyAnthropicEffortToBody(params, {
+            model: useModel,
+            opts,
+            maxTokens,
+            clampThinkingBudgetTokens,
+            logTag: this.name,
+        });
         // Fast mode → speed: "fast" on models Anthropic marks as speed-capable.
         if (opts.fast === true && supportsAnthropicFastMode(useModel)) {
             params.speed = 'fast';
@@ -524,12 +578,20 @@ export class AnthropicProvider {
             try { totalSignal.removeEventListener('abort', handler); } catch {}
         };
 
-        const betaHeaders = {
-            'anthropic-beta': buildAnthropicBetaHeaders({
-                fastMode: this.fastModeBetaHeaderLatched,
-                toolSearch: true,
-            }),
-        };
+        // Per-call headers override the client defaultHeaders, so the
+        // constructor-level disableBetaHeaders opt-out must be honoured here
+        // too — otherwise opencode-go's anthropic-compatible routing
+        // (disableBetaHeaders:true) would still send beta strings that a
+        // third-party endpoint may reject.
+        const betaHeaders = this.config?.disableBetaHeaders
+            ? null
+            : {
+                'anthropic-beta': buildAnthropicBetaHeaders({
+                    fastMode: this.fastModeBetaHeaderLatched,
+                    toolSearch: true,
+                    effort: shouldIncludeEffortBeta(useModel, opts),
+                }),
+            };
 
         const MAX_MIDSTREAM_RETRIES = ANTHROPIC_MAX_MIDSTREAM_RETRIES;
         let firstAttemptError = null;
@@ -623,7 +685,7 @@ export class AnthropicProvider {
                         async ({ signal: attemptSignal }) => {
                             const res = await this.client.messages.create(params, {
                                 signal: attemptSignal,
-                                headers: betaHeaders,
+                                ...(betaHeaders ? { headers: betaHeaders } : {}),
                             }).asResponse();
                             if (!res.ok) {
                                 const text = await res.text().catch(() => '');
@@ -676,11 +738,12 @@ export class AnthropicProvider {
                     const parseResult = await parseSSEStream(
                         response,
                         streamController.signal,
-                        () => streamController.abort(),
+                        (reason) => streamController.abort(reason),
                         onStreamDelta,
                         onToolCall,
                         midState,
                         onTextDelta,
+                        knownToolNames,
                     );
 
                     if (firstBytePoll) {
@@ -799,6 +862,9 @@ export class AnthropicProvider {
                 .map((m) => _normalizeAnthropicModel(m, this.name))
                 .filter(Boolean);
             const enriched = await enrichModels(normalized);
+            // Feed the resolver-visible mirror so API-key-only installs get
+            // catalog outputTokens without depending on the OAuth disk cache.
+            if (enriched.length) _apiKeyCatalogMirror = enriched.slice();
             return enriched.length ? enriched : MODELS;
         }
         catch (err) {

package/src/runtime/agent/orchestrator/providers/api-usage.mjs

@@ -1,8 +1,9 @@
-import { existsSync, mkdirSync, readFileSync } from 'node:fs';
-import * as fsp from 'node:fs/promises';
+import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { updateJsonAtomicSync } from '../../../shared/atomic-file.mjs';
 import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
 import { getAgentApiKey, getOpenAIUsageSessionKey } from '../../../shared/config.mjs';
+import { num, round } from './lib/usage-primitives.mjs';
 
 const CACHE_FILE = 'api-usage-cache.json';
 const LIVE_TTL_MS = 5 * 60_000;
@@ -10,19 +11,6 @@ const STALE_TTL_MS = 60 * 60_000;
 const DISK_JSON_MEMORY_TTL_MS = 1000;
 let diskJsonCache = { at: 0, file: '', value: null };
 
-function num(value, fallback = null) {
-  if (value === null || value === undefined || value === '') return fallback;
-  const n = Number(value);
-  return Number.isFinite(n) ? n : fallback;
-}
-
-function round(value, digits = 4) {
-  const n = Number(value);
-  if (!Number.isFinite(n)) return null;
-  const scale = 10 ** digits;
-  return Math.round(n * scale) / scale;
-}
-
 function cachePath() {
   return join(resolvePluginData(), CACHE_FILE);
 }
@@ -41,14 +29,6 @@ function readJson(file) {
   }
 }
 
-function writeJson(file, value) {
-  diskJsonCache = { at: Date.now(), file, value };
-  try {
-    mkdirSync(resolvePluginData(), { recursive: true });
-    void fsp.writeFile(file, JSON.stringify(value, null, 2), 'utf8').catch(() => {});
-  } catch {}
-}
-
 function cacheKey(provider) {
   return String(provider || '').trim().toLowerCase();
 }
@@ -68,16 +48,31 @@ export function readCachedApiUsageSnapshot(provider, { allowStale = true } = {})
 
 function writeCachedApiUsageSnapshot(provider, snapshot) {
   const file = cachePath();
-  const raw = readJson(file) || {};
-  const snapshots = raw.snapshots && typeof raw.snapshots === 'object' ? raw.snapshots : {};
-  writeJson(file, {
-    version: 1,
-    updatedAt: Date.now(),
-    snapshots: {
-      ...snapshots,
-      [cacheKey(provider)]: snapshot,
-    },
-  });
+  // Synchronous atomic+lock write (updateJsonAtomicSync) rather than the
+  // prior fire-and-forget fsp.writeFile: the read-modify-write of
+  // `snapshots` must happen inside the same file lock as the write, or two
+  // concurrent orchestrator processes updating different providers can
+  // clobber each other's snapshot merge (last writer wins, losing the
+  // other's entry). Usage snapshot writes are infrequent (once per
+  // provider per TTL window, not per-request), so trading the async/
+  // non-blocking write for lock+fsync-dir safety has no meaningful
+  // latency impact on the request path.
+  let next = null;
+  try {
+    next = updateJsonAtomicSync(file, (curRaw) => {
+      const cur = curRaw && typeof curRaw === 'object' ? curRaw : {};
+      const snapshots = cur.snapshots && typeof cur.snapshots === 'object' ? cur.snapshots : {};
+      return {
+        version: 1,
+        updatedAt: Date.now(),
+        snapshots: {
+          ...snapshots,
+          [cacheKey(provider)]: snapshot,
+        },
+      };
+    }, { lock: true, fsyncDir: true, timeoutMs: 1000 }); // best-effort cache write: short lock timeout, don't block on contention
+  } catch {}
+  if (next) diskJsonCache = { at: Date.now(), file, value: next };
 }
 
 function authHeaders(key, extra = {}) {

package/src/runtime/agent/orchestrator/providers/gemini.mjs

@@ -16,6 +16,7 @@ import {
 import { getLlmDispatcher, preconnect } from '../../../shared/llm/http-agent.mjs';
 import { traceHash, stableTraceStringify, summarizeTraceTools, traceTextShape } from './trace-utils.mjs';
 import { normalizeContentForGeminiParts, splitToolContentForGemini } from './media-normalization.mjs';
+import { scanLeakedToolCalls } from './anthropic-leaked-toolcall.mjs';
 
 const MODELS = [
     { id: 'gemini-3-flash-preview', name: 'Gemini 3 Flash Preview', provider: 'gemini', contextWindow: 1048576 },
@@ -31,12 +32,19 @@ const DEFAULT_MODEL = MODELS[0].id;
 // Gemini's /models has no `created` timestamp, so latest-resolution is
 // VERSION-based (parse gemini-X.Y) rather than release-date based.
 const MODEL_CACHE_TTL_MS = 24 * 60 * 60_000;
+// Bump when the on-disk cache shape changes so stale-shape entries are
+// discarded instead of misread.
+const GEMINI_MODEL_CACHE_SCHEMA_VERSION = 1;
 
 // De-dupes concurrent force-refreshes so they share one HTTP round-trip,
 // mirroring anthropic-oauth's _modelRefreshInFlight.
 let _modelRefreshInFlight = null;
 
-const _modelCache = makeModelCache({ fileName: 'gemini-models.json', ttlMs: MODEL_CACHE_TTL_MS });
+const _modelCache = makeModelCache({
+    fileName: 'gemini-models.json',
+    ttlMs: MODEL_CACHE_TTL_MS,
+    version: GEMINI_MODEL_CACHE_SCHEMA_VERSION,
+});
 
 // Mirror of anthropic-oauth.mjs _compareVersion: compare two gemini ids by the
 // X.Y version embedded in the id (gemini-3.5-flash -> [3, 5]). Falls back to a
@@ -182,6 +190,10 @@ function _geminiCachePrefixHash({ model, systemInstruction, geminiTools, content
 
 const GEMINI_GLOBAL_CACHE_MIN_LIVE_MS = 6 * 60 * 1000;
 const GEMINI_GLOBAL_CACHE_MAX_ENTRIES = 128;
+// Grace window before deleting a superseded cachedContents name (see the
+// cross-session race note at the L1341-1372 call site). Long enough that a
+// concurrent session still mid-flight on the old name has time to finish.
+const GEMINI_GLOBAL_CACHE_DELETE_GRACE_MS = 2 * 60 * 1000;
 const geminiGlobalCaches = new Map();
 const geminiGlobalCacheCreates = new Map();
 
@@ -294,7 +306,7 @@ function writeGeminiCacheTrace({ opts, model, systemInstruction, tools, contents
             provider: 'gemini',
             model,
             owner: session.owner || null,
-            role: session.role || null,
+            agent: session.agent || null,
             permission: session.permission || null,
             toolPermission: session.toolPermission || null,
             profileId: session.profileId || null,
@@ -412,7 +424,104 @@ function geminiChunkText(chunk) {
     return text;
 }
 
-async function consumeGeminiRestStreamResponse(response, { signal, onStreamDelta, onTextDelta, label }) {
+function relayGeminiStreamText(t, { onTextDelta, textLeakGuard }) {
+    if (!t) return;
+    if (textLeakGuard) textLeakGuard.feedText(t);
+    else if (onTextDelta) { try { onTextDelta(t); } catch {} }
+}
+
+/**
+ * Rolling scanner for tool calls leaked as plain XML/antml tags inside Gemini
+ * `part.text` streams. Mirrors the Anthropic OAuth guard: suppress tags from
+ * visible text, synthesize known-tool calls, dispatch via onToolCall.
+ */
+export function createGeminiTextLeakGuard({ knownToolNames, onTextDelta, onToolCall, onStreamDelta }) {
+    const _knownTools = knownToolNames instanceof Set
+        ? knownToolNames
+        : new Set(Array.isArray(knownToolNames) ? knownToolNames : []);
+    const _enabled = _knownTools.size > 0;
+    const _isKnownTool = (name) => _knownTools.has(name);
+    let leakBuffer = '';
+    const leakedCalls = [];
+    const dispatchedFingerprints = new Set();
+
+    const toolCallFingerprint = (name, args) => {
+        let a = args;
+        if (a === null || typeof a !== 'object' || Array.isArray(a)) a = {};
+        return traceHash(stableTraceStringify({ name: name || '', args: a }));
+    };
+
+    const dispatchLeakedCall = (recovered) => {
+        let args = recovered?.arguments;
+        if (args === null || typeof args !== 'object' || Array.isArray(args)) args = {};
+        const fp = toolCallFingerprint(recovered.name, args);
+        if (dispatchedFingerprints.has(fp)) return;
+        dispatchedFingerprints.add(fp);
+        const idHash = traceHash(stableTraceStringify({
+            name: recovered.name,
+            args,
+            leak: true,
+        })).slice(0, 16);
+        const call = {
+            id: `gemini_leaked_${idHash}`,
+            name: recovered.name,
+            arguments: args,
+        };
+        leakedCalls.push(call);
+        try { onToolCall?.(call); } catch {}
+        try { onStreamDelta?.(); } catch {}
+    };
+
+    const pumpLeakBuffer = (final) => {
+        if (!_enabled) return;
+        if (!leakBuffer && !final) return;
+        const { emit, calls, rest } = scanLeakedToolCalls(leakBuffer, { isKnownTool: _isKnownTool, final });
+        leakBuffer = rest;
+        if (emit && onTextDelta) {
+            try { onTextDelta(emit); } catch {}
+        }
+        for (const c of calls) dispatchLeakedCall(c);
+    };
+
+    return {
+        get enabled() { return _enabled; },
+        feedText(text) {
+            if (!text) return;
+            if (!_enabled) {
+                try { onTextDelta?.(text); } catch {}
+                return;
+            }
+            leakBuffer += text;
+            pumpLeakBuffer(false);
+        },
+        finalize() {
+            pumpLeakBuffer(true);
+        },
+        scrubAssistantText(raw) {
+            if (!raw) return '';
+            if (!_enabled) return raw;
+            const { emit, calls, rest } = scanLeakedToolCalls(raw, { isKnownTool: _isKnownTool, final: true });
+            for (const c of calls) dispatchLeakedCall(c);
+            return emit + rest;
+        },
+        filterNativeToolCalls(nativeCalls) {
+            if (!_enabled || !nativeCalls?.length) return nativeCalls;
+            const kept = [];
+            for (const call of nativeCalls) {
+                const fp = toolCallFingerprint(call?.name, call?.arguments);
+                if (dispatchedFingerprints.has(fp)) continue;
+                dispatchedFingerprints.add(fp);
+                kept.push(call);
+            }
+            return kept.length ? kept : undefined;
+        },
+        getLeakedToolCalls() {
+            return leakedCalls.length ? [...leakedCalls] : [];
+        },
+    };
+}
+
+async function consumeGeminiRestStreamResponse(response, { signal, onStreamDelta, onTextDelta, textLeakGuard, label }) {
     if (!response?.body) throw new Error(`${label}: missing response body`);
     const reader = response.body.getReader();
     const decoder = new TextDecoder();
@@ -509,9 +618,9 @@ async function consumeGeminiRestStreamResponse(response, { signal, onStreamDelta
                 }
                 allChunks.push(parsed);
                 try { onStreamDelta?.(); } catch {}
-                if (onTextDelta) {
+                if (onTextDelta || textLeakGuard) {
                     const t = geminiChunkText(parsed);
-                    if (t) { try { onTextDelta(t); } catch {} }
+                    relayGeminiStreamText(t, { onTextDelta, textLeakGuard });
                 }
             }
         }
@@ -528,9 +637,9 @@ async function consumeGeminiRestStreamResponse(response, { signal, onStreamDelta
                         }
                         allChunks.push(parsed);
                         try { onStreamDelta?.(); } catch {}
-                        if (onTextDelta) {
+                        if (onTextDelta || textLeakGuard) {
                             const t = geminiChunkText(parsed);
-                            if (t) { try { onTextDelta(t); } catch {} }
+                            relayGeminiStreamText(t, { onTextDelta, textLeakGuard });
                         }
                     } catch { /* skip malformed tail */ }
                 }
@@ -541,6 +650,7 @@ async function consumeGeminiRestStreamResponse(response, { signal, onStreamDelta
         if (idleTimer) clearTimeout(idleTimer);
         if (signal) signal.removeEventListener('abort', onAbort);
         try { reader.releaseLock(); } catch {}
+        try { textLeakGuard?.finalize(); } catch {}
     }
 
     const aggregated = aggregateGeminiStreamChunks(allChunks);
@@ -549,7 +659,7 @@ async function consumeGeminiRestStreamResponse(response, { signal, onStreamDelta
     return aggregated;
 }
 
-async function consumeGeminiSdkStream(streamResult, { signal, onStreamDelta, onTextDelta, label }) {
+async function consumeGeminiSdkStream(streamResult, { signal, onStreamDelta, onTextDelta, textLeakGuard, label }) {
     let sawStreamChunk = false;
     let idleTimedOut = false;
     let idleTimer = null;
@@ -665,9 +775,9 @@ async function consumeGeminiSdkStream(streamResult, { signal, onStreamDelta, onT
             }
             resetIdleTimer();
             try { onStreamDelta?.(); } catch {}
-            if (onTextDelta) {
+            if (onTextDelta || textLeakGuard) {
                 const t = geminiChunkText(step.value);
-                if (t) { try { onTextDelta(t); } catch {} }
+                relayGeminiStreamText(t, { onTextDelta, textLeakGuard });
             }
         }
         if (idleTimedOut) {
@@ -686,6 +796,7 @@ async function consumeGeminiSdkStream(streamResult, { signal, onStreamDelta, onT
         if (signal && onSignalAbort) {
             try { signal.removeEventListener('abort', onSignalAbort); } catch {}
         }
+        try { textLeakGuard?.finalize(); } catch {}
     }
 
     let response;
@@ -1241,11 +1352,44 @@ export class GeminiProvider {
             // Best-effort cleanup of the previous cache so storage cost only
             // accrues on the live revision. Fire-and-forget; TTL expiry covers
             // any delete failures.
+            //
+            // Cross-session race: `_geminiGlobalCacheNameIsLive` only checks
+            // whether `priorCacheName` still appears as *some* entry's live
+            // cacheName in `geminiGlobalCaches`. If another session sharing the
+            // same globalCacheKey already overwrote that map slot with a newer
+            // cache (via `_setGeminiGlobalCache`), the check sees "not live" for
+            // a name that a *different* in-flight session still holds in its own
+            // `providerState.gemini.cacheName` (captured earlier via
+            // `_attachGeminiCacheState` and possibly already in-flight inside a
+            // `generateContent`/`streamGenerateContent` call at L1470-1473).
+            // Deleting immediately can 404 that concurrent request server-side.
+            //
+            // Fix chosen: delay the DELETE by a grace period instead of adding
+            // refcounting/last-used-session tracking. Rationale (minimal-change,
+            // matches the module's existing "best-effort, TTL is the backstop"
+            // posture at L1342-1343):
+            //   - Any session that captured `priorCacheName` did so before this
+            //     create finished, so its in-flight (or next) turn using that
+            //     name almost certainly completes within a couple of minutes;
+            //     a short grace window is enough for it to either finish or move
+            //     on to a fresh cache attach.
+            //   - The server-side cache TTL (1h) already reclaims any cache we
+            //     fail to delete, so skipping/delaying deletion is safe — it
+            //     only costs a little extra storage for at most the grace
+            //     window, never correctness.
+            //   - Refcounting/session tracking would need to plumb per-session
+            //     liveness into a shared map across concurrent providers, which
+            //     is a much larger change for a purely cosmetic cost saving.
+            // Re-check liveness right before firing the DELETE too, in case the
+            // name became live again (e.g. re-attached) during the wait.
             const priorCacheName = state?.cacheName || null;
-            if (priorCacheName && priorCacheName !== cacheName && !_geminiGlobalCacheNameIsLive(priorCacheName)) {
-                const delUrl = `https://generativelanguage.googleapis.com/v1beta/${priorCacheName}?key=${encodeURIComponent(apiKey)}`;
-                fetch(delUrl, { method: 'DELETE', signal: AbortSignal.timeout(10_000), dispatcher: getLlmDispatcher() })
-                    .catch(() => { /* TTL expiry will reclaim it */ });
+            if (priorCacheName && priorCacheName !== cacheName) {
+                setTimeout(() => {
+                    if (_geminiGlobalCacheNameIsLive(priorCacheName)) return;
+                    const delUrl = `https://generativelanguage.googleapis.com/v1beta/${priorCacheName}?key=${encodeURIComponent(apiKey)}`;
+                    fetch(delUrl, { method: 'DELETE', signal: AbortSignal.timeout(10_000), dispatcher: getLlmDispatcher() })
+                        .catch(() => { /* TTL expiry will reclaim it */ });
+                }, GEMINI_GLOBAL_CACHE_DELETE_GRACE_MS).unref?.();
             }
             const createdAt = Date.now();
             const entry = {
@@ -1322,6 +1466,14 @@ export class GeminiProvider {
         const toolConfig = functionGeminiTools.length ? toGeminiToolConfig(opts.toolChoice) : undefined;
         try { opts.onStageChange?.('requesting'); } catch {}
 
+        const buildTextLeakGuard = () => createGeminiTextLeakGuard({
+            knownToolNames: tools?.map((t) => t.name).filter(Boolean) ?? [],
+            onTextDelta,
+            onToolCall,
+            onStreamDelta,
+        });
+        let textLeakGuard = null;
+
         // Explicit cachedContents (system + tools + prior-turn transcript).
         // Per Google docs, `tools` must be supplied on BOTH the cache create
         // call AND every subsequent generate_content call — the cache stores
@@ -1401,10 +1553,12 @@ export class GeminiProvider {
                             err.status = res.status;
                             throw err;
                         }
+                        textLeakGuard = buildTextLeakGuard();
                         return await consumeGeminiRestStreamResponse(res, {
                             signal: attemptSignal,
                             onStreamDelta,
                             onTextDelta,
+                            textLeakGuard,
                             label: 'Gemini REST streamGenerateContent',
                         });
                     },
@@ -1485,10 +1639,12 @@ export class GeminiProvider {
                             // timer but KEEP the parent link attached so a later
                             // abort during streaming still reaches the request.
                             clearConnectTimer();
+                            textLeakGuard = buildTextLeakGuard();
                             return await consumeGeminiSdkStream(streamResult, {
                                 signal: attemptSignal,
                                 onStreamDelta,
                                 onTextDelta,
+                                textLeakGuard,
                                 label: 'Gemini SDK streamGenerateContent',
                             });
                         } finally {
@@ -1519,10 +1675,21 @@ export class GeminiProvider {
         });
         const candidate = response.candidates?.[0] || null;
         const textParts = candidate?.content?.parts?.filter(p => 'text' in p) ?? [];
-        const content = textParts.map(p => 'text' in p ? p.text : '').join('');
-        const toolCalls = parseToolCalls(candidate?.content?.parts ?? []);
+        const rawContent = textParts.map(p => 'text' in p ? p.text : '').join('');
+        const content = textLeakGuard?.enabled
+            ? textLeakGuard.scrubAssistantText(rawContent)
+            : rawContent;
+        const leakedToolCalls = textLeakGuard?.getLeakedToolCalls() ?? [];
+        let nativeToolCalls = parseToolCalls(candidate?.content?.parts ?? []);
+        if (textLeakGuard?.enabled) {
+            nativeToolCalls = textLeakGuard.filterNativeToolCalls(nativeToolCalls);
+        }
+        let toolCalls = nativeToolCalls;
+        if (leakedToolCalls.length) {
+            toolCalls = toolCalls?.length ? [...toolCalls, ...leakedToolCalls] : leakedToolCalls;
+        }
         const citations = collectGeminiGroundingSources(candidate);
-        emitGeminiToolCalls(toolCalls, onToolCall);
+        emitGeminiToolCalls(nativeToolCalls, onToolCall);
         // Inspect candidate.finishReason — Gemini reports terminal status here.
         // Only STOP (and the legacy "FINISH_REASON_STOP") plus tool/function-
         // call paths represent a fully delivered turn. MAX_TOKENS / SAFETY /