mixdog 0.9.1 → 0.9.3

package/src/runtime/agent/orchestrator/providers/openai-oauth-ws.mjs

@@ -4,15 +4,15 @@
  * Single dispatch path for the openai-oauth provider (SSE removed in
  * v0.6.117). Uses the `responses_websockets=2026-02-06` beta WebSocket
  * upgrade on chatgpt.com/backend-api/codex/responses. Per-session
- * connections are pooled (5 min idle TTL, up to 8 parallel sockets per
+ * connections are pooled (configurable idle TTL, up to 8 parallel sockets per
  * key) so subsequent tool-loop iterations can send only the incremental
  * `input` delta plus `previous_response_id`, skipping the full
  * tools/system/history prefix each turn.
  *
- * References:
- * - pi-mono packages/ai/src/providers/openai-codex-responses.ts
- *   (acquireWebSocket/release, get_incremental_items delta logic).
- * - openai/codex codex-rs/core/src/client.rs (turn-state echo header).
+ * Incremental-input reuse is decided by diffing against the cached request
+ * the socket last sent (see _sansInput below), and requests carry a
+ * turn-state echo header so the backend can correlate WS frames to the
+ * in-flight turn.
  *
  * Exposes:
  *   sendViaWebSocket({ auth, body, sendOpts, onStreamDelta, onToolCall,
@@ -43,12 +43,16 @@ import {
     sleepWithAbort,
 } from './retry-classifier.mjs';
 import { makeInvalidToolArgsMarker } from './openai-compat-stream.mjs';
+import { createLeakGuard, createToolCallDedupe, dedupeToolCallList } from './anthropic-leaked-toolcall.mjs';
 import {
     PROVIDER_RETRY_MAX_ATTEMPTS,
     PROVIDER_WS_ACQUIRE_TIMEOUT_MS,
-    PROVIDER_WS_FIRST_MEANINGFUL_TIMEOUT_MS,
     PROVIDER_WS_HANDSHAKE_TIMEOUT_MS,
     PROVIDER_WS_INTER_CHUNK_TIMEOUT_MS,
+    PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS,
+    PROVIDER_SSE_IDLE_WATCHDOG_ENABLED,
+    streamStalledError,
+    resolveTimeoutMs,
 } from '../stall-policy.mjs';
 import { customToolCallFromResponseItem } from './custom-tool-wire.mjs';
 
@@ -58,17 +62,19 @@ const CODEX_WS_URL = 'wss://chatgpt.com/backend-api/codex/responses';
 const CODEX_OAUTH_ORIGINATOR = 'codex_cli_rs';
 const OPENAI_WS_URL = 'wss://api.openai.com/v1/responses';
 const XAI_WS_URL = 'wss://api.x.ai/v1/responses';
-const WS_IDLE_MS = 5 * 60_000;
+const WS_IDLE_MS = resolveTimeoutMs(
+    'MIXDOG_PROVIDER_WS_IDLE_MS',
+    20 * 60_000,
+    { minMs: 60_000, maxMs: 60 * 60_000 },
+);
 const WS_HANDSHAKE_TIMEOUT_MS = PROVIDER_WS_HANDSHAKE_TIMEOUT_MS;
 const WS_ACQUIRE_TIMEOUT_MS = PROVIDER_WS_ACQUIRE_TIMEOUT_MS;
-// Pre-stream watchdog uses the shared provider deadline so it fails before
-// the 5-minute session slow warning.
-const WS_FIRST_MEANINGFUL_MS = PROVIDER_WS_FIRST_MEANINGFUL_TIMEOUT_MS;
 // Pre-`response.created` deadline. Once the socket is open and the
 // response.create frame is sent, a healthy server emits response.created
 // within seconds. If it stalls past this short bound the socket has wedged
 // post-upgrade with zero server events — treat it as a fast, retryable
-// first-byte timeout rather than waiting the longer first-meaningful window.
+// first-byte timeout. This is the ONLY pre-stream watchdog; once any server
+// event arrives the single inter-chunk idle timer below takes over.
 // Only this short window is shortened; the post-`response.created`
 // inter-chunk / reasoning span keeps the longer deadlines below.
 const WS_PRE_RESPONSE_CREATED_MS = (() => {
@@ -77,7 +83,8 @@ const WS_PRE_RESPONSE_CREATED_MS = (() => {
     if (Number.isFinite(n) && n > 0) return Math.min(Math.max(n, 1_000), 120_000);
     return 10_000;
 })();
-// Inter-chunk inactivity after first meaningful output.
+// Single inter-chunk idle timer. Resets on EVERY received frame — any frame,
+// including metadata/keepalive, proves the socket is live.
 const WS_INTER_CHUNK_MS = PROVIDER_WS_INTER_CHUNK_TIMEOUT_MS;
 // Mid-stream retry budgets + backoff now live in the shared MIDSTREAM_RETRY_POLICY
 // table (retry-classifier.mjs). These aliases keep the local call sites readable
@@ -101,8 +108,8 @@ const WS_MIDSTREAM_POLICY = {
 // decision and just double the user-visible latency.
 // Aligned to the cross-provider default (retry-classifier DEFAULT_MAX_ATTEMPTS=5,
 // anthropic-oauth MAX_ATTEMPTS=5, withRetry-using providers all default to 5).
-// Previously 3 — bumped for parity so every provider exhausts the same number
-// of transient-5xx attempts before surfacing failure to the caller.
+// Bumped from 3 so this provider exhausts the same number of transient-5xx
+// attempts as the others before surfacing failure to the caller.
 const HANDSHAKE_MAX_ATTEMPTS = PROVIDER_RETRY_MAX_ATTEMPTS;
 const HANDSHAKE_BACKOFF_BASE_MS = 500;
 const HANDSHAKE_BACKOFF_CAP_MS = 5000;
@@ -934,9 +941,9 @@ function releaseWebSocket({ entry, poolKey, keep }) {
     _scheduleIdleClose(poolKey, entry);
 }
 
-// Port of pi-mono get_incremental_items: if the cached request (sans input)
-// matches the current one and the current input starts with the cached input,
-// return only the tail. Otherwise return the full input (fresh turn).
+// If the cached request (sans input) matches the current one and the current
+// input starts with the cached input, return only the tail. Otherwise return
+// the full input (fresh turn).
 function _sansInput(body) {
     const { input: _ignored, previous_response_id: _prevIgnored, ...rest } = body;
     return rest;
@@ -1206,19 +1213,23 @@ function _wsErrLabel(p) {
     return 'OpenAI OAuth WS';
 }
 // tool_search_call.arguments parse. Module-scope (exported) for direct test
-// coverage. Native convergence (openai-oauth / anthropic-oauth / opencode): same policy
-// as the function_call_arguments.done path and openai-oauth _parseJsonObject —
+// coverage. Same policy as the function_call_arguments.done path and
+// openai-oauth _parseJsonObject —
 // object passes through; null/non-string/empty/whitespace → {} (no args); a
 // non-empty string that fails JSON.parse is deterministic bad JSON, surfaced
 // as an invalid-args MARKER (not silently swallowed to {}) so the dispatch
 // loop returns an is_error tool_result and the model self-corrects in the same
 // turn.
 export function parseToolSearchArgs(value) {
-    if (value && typeof value === 'object') return value;
+    if (value && typeof value === 'object') {
+        // Reject arrays — the tool_search schema is an object
+        // ({query,select,limit}); an array must never pass through as args.
+        return Array.isArray(value) ? {} : value;
+    }
     if (typeof value !== 'string' || !value.trim()) return {};
     try {
         const parsed = JSON.parse(value);
-        return parsed && typeof parsed === 'object' ? parsed : {};
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
     } catch (err) {
         return makeInvalidToolArgsMarker(value, err instanceof Error ? err.message : String(err));
     }
@@ -1233,11 +1244,11 @@ export async function _streamResponse({
     logSuppressedReasoningDeltas = true,
     traceProvider = 'openai-oauth',
     _timeouts = null,
+    knownToolNames = null,
 }) {
     const errLabel = _wsErrLabel(traceProvider);
     const socket = entry.socket;
     const preResponseCreatedMs = _positiveInt(_timeouts?.preResponseCreatedMs, WS_PRE_RESPONSE_CREATED_MS);
-    const firstMeaningfulMs = _positiveInt(_timeouts?.firstMeaningfulMs, WS_FIRST_MEANINGFUL_MS);
     const interChunkMs = _positiveInt(_timeouts?.interChunkMs, WS_INTER_CHUNK_MS);
     const _streamingStart = Date.now();
     let _firstDeltaEmitted = false;
@@ -1253,6 +1264,19 @@ export async function _streamResponse({
     const citations = [];
     const citationKeys = new Set();
     const pendingCalls = new Map();
+    // Tool-work-in-flight flag: set the moment a function/custom tool call's
+    // input starts streaming (before it lands in pendingCalls/toolCalls).
+    // Gates partial-final SUCCESS so a stall mid tool-input never looks text-only.
+    let _toolInFlight = false;
+    // Fix 2: cross-path name+args dedupe. A text-leaked synthetic and an
+    // identical native function_call must fire onToolCall exactly once. Every
+    // dispatch site routes through emitToolCallDedupe.
+    const _toolDedupe = createToolCallDedupe();
+    const emitToolCallDedupe = (call) => {
+        if (!_toolDedupe.shouldDispatch(call?.name, call?.arguments)) return;
+        midState.emittedToolCall = true;
+        try { onToolCall?.(call); } catch {}
+    };
     // Reasoning items collected from response.output_item.done (or salvaged
     // from response.completed.response.output). The request still includes
     // `reasoning.encrypted_content` so the server keeps emitting the blobs,
@@ -1340,8 +1364,7 @@ export async function _streamResponse({
         const call = customToolCallFromResponseItem(item);
         if (!call || toolCalls.some((existing) => existing.id === call.id)) return;
         toolCalls.push(call);
-        midState.emittedToolCall = true;
-        try { onToolCall?.(call); } catch {}
+        emitToolCallDedupe(call);
     };
     const pushToolSearchCall = (item) => {
         if (!item || item.type !== 'tool_search_call') return;
@@ -1354,9 +1377,60 @@ export async function _streamResponse({
             nativeType: 'tool_search_call',
         };
         toolCalls.push(call);
+        emitToolCallDedupe(call);
+    };
+    // Leaked tool-call guard. The model sometimes emits a tool call as plain
+    // text (XML `<invoke>`/`<function_calls>` or gpt-oss harmony
+    // `<|channel|>...to=functions.NAME...<|call|>`) inside
+    // `response.output_text.delta` instead of a native function_call. Route
+    // text through the guard so leaked calls are suppressed from the visible
+    // stream, synthesized (native `call_...` id shape), and dispatched like
+    // native ones. Additive: the native function_call path is untouched.
+    const leakGuard = createLeakGuard({ knownToolNames, harmony: true });
+    const dispatchLeakedCall = (recovered) => {
+        let args = recovered?.arguments;
+        if (args === null || typeof args !== 'object' || Array.isArray(args)) args = {};
+        const call = {
+            id: `call_leaked_${randomBytes(8).toString('hex')}`,
+            name: recovered.name,
+            arguments: args,
+        };
+        if (!_toolDedupe.shouldDispatch(call.name, call.arguments)) return;
+        toolCalls.push(call);
         midState.emittedToolCall = true;
         try { onToolCall?.(call); } catch {}
     };
+    const relayLeakText = (delta) => {
+        if (!leakGuard.enabled) {
+            content += delta || '';
+            if (delta && onTextDelta) {
+                if (state) state.emittedText = true;
+                try { onTextDelta(delta); } catch {}
+            }
+            return;
+        }
+        const { text, calls } = leakGuard.push(delta);
+        if (text) {
+            content += text;
+            if (onTextDelta) {
+                if (state) state.emittedText = true;
+                try { onTextDelta(text); } catch {}
+            }
+        }
+        for (const c of calls) dispatchLeakedCall(c);
+    };
+    const flushLeak = () => {
+        if (!leakGuard.enabled) return;
+        const { text, calls } = leakGuard.flush();
+        if (text) {
+            content += text;
+            if (onTextDelta) {
+                if (state) state.emittedText = true;
+                try { onTextDelta(text); } catch {}
+            }
+        }
+        for (const c of calls) dispatchLeakedCall(c);
+    };
     const logReasoningDeltaSuppression = () => {
         if (!logSuppressedReasoningDeltas) return;
         const total = reasoningTextDeltaCount + reasoningSummaryTextDeltaCount + reasoningOtherDeltaCount;
@@ -1385,6 +1459,16 @@ export async function _streamResponse({
     let messageHandler = null;
     let closeHandler = null;
     let errorHandler = null;
+    // SEMANTIC idle timer: distinct from the inter-chunk
+    // timer, which resets on EVERY frame (rate_limits/metadata/keepalive keep
+    // the socket "alive"). This timer resets ONLY on meaningful output deltas
+    // (text/reasoning/tool args — the same events that call onStreamDelta) so a
+    // stream that emits some deltas then goes silent (server keepalive frames
+    // only) trips a short, named terminal StreamStalledError instead of coasting
+    // to the 300s inter-chunk cap / 30-min agent watchdog.
+    let semanticIdleTimer = null;
+    const semanticIdleMs = PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS;
+    const semanticIdleEnabled = PROVIDER_SSE_IDLE_WATCHDOG_ENABLED && semanticIdleMs > 0;
 
     return new Promise((resolve, reject) => {
         // Pre-stream watchdog: the timer fires if the server never sends a
@@ -1392,10 +1476,10 @@ export async function _streamResponse({
         // after our last frame. The socket is open and the response.create
         // frame was sent, but no server event has come back — a wedged
         // post-upgrade socket. Healthy servers ack within seconds, so this
-        // window is intentionally short (~25s). Once response.created (or
-        // any other meaningful event) arrives, the timer is cancelled and
-        // the longer inter-chunk inactivity watchdog takes over — silent
-        // gaps mid-reasoning (openai-oauth spending 50s+ producing reasoning
+        // window is intentionally short (WS_PRE_RESPONSE_CREATED_MS, ~10s).
+        // Once ANY server event arrives, resetIdle() cancels this watchdog and
+        // the single inter-chunk idle timer takes over — silent gaps
+        // mid-reasoning (openai-oauth spending 50s+ producing reasoning
         // tokens) are normal and should not abort the turn.
         const armPreStreamWatchdog = () => {
             if (idleTimer) clearTimeout(idleTimer);
@@ -1427,8 +1511,6 @@ export async function _streamResponse({
             }, preResponseCreatedMs);
         };
         let interChunkTimer = null;
-        let firstMeaningfulTimer = null;
-        let firstMeaningfulSeen = false;
         const traceWsTimeout = (event, timeoutMs) => {
             try {
                 const iteration = Number(midState.iteration);
@@ -1443,7 +1525,6 @@ export async function _streamResponse({
                     attempt_index: Number.isFinite(attemptIndex) ? attemptIndex : null,
                     warmup: midState.warmup === true,
                     saw_response_created: midState.sawResponseCreated === true,
-                    first_meaningful_seen: firstMeaningfulSeen === true,
                 };
                 appendAgentTrace({
                     sessionId: midState.sessionId || null,
@@ -1460,29 +1541,6 @@ export async function _streamResponse({
                 idleTimer = null;
             }
         };
-        const clearFirstMeaningfulWatchdog = () => {
-            if (firstMeaningfulTimer) {
-                clearTimeout(firstMeaningfulTimer);
-                firstMeaningfulTimer = null;
-            }
-        };
-        const armFirstMeaningfulWatchdog = () => {
-            if (firstMeaningfulSeen || firstMeaningfulMs <= 0) return;
-            clearFirstMeaningfulWatchdog();
-            firstMeaningfulTimer = setTimeout(() => {
-                if (process.env.MIXDOG_DEBUG_AGENT) {
-                    process.stderr.write(`[agent-trace] ws-timeout kind=first-meaningful afterMs=${firstMeaningfulMs}\n`);
-                }
-                traceWsTimeout('first_meaningful_timeout', firstMeaningfulMs);
-                const err = new Error(`WS stream: no meaningful output within ${firstMeaningfulMs}ms after response.created`);
-                err.wsCloseCode = 4000;
-                err.firstMeaningfulTimeout = true;
-                midState.firstMeaningfulTimeout = true;
-                terminalError = err;
-                try { socket.close(4000, 'first_meaningful_timeout'); } catch {}
-                finish();
-            }, firstMeaningfulMs);
-        };
         const resetInterChunk = () => {
             if (interChunkTimer) clearTimeout(interChunkTimer);
             interChunkTimer = setTimeout(() => {
@@ -1497,30 +1555,49 @@ export async function _streamResponse({
                 finish();
             }, interChunkMs);
         };
-        const onResponseCreated = () => {
-            clearPreStreamWatchdog();
-            if (!firstMeaningfulSeen) armFirstMeaningfulWatchdog();
-            else resetInterChunk();
+        // pi per-event idle: (re)armed only on meaningful output deltas via
+        // bumpSemanticIdle(). Keepalive/metadata frames DON'T touch it, so a
+        // deltas-then-silent wedge trips this short semantic window.
+        const resetSemanticIdle = () => {
+            if (!semanticIdleEnabled) return;
+            if (semanticIdleTimer) clearTimeout(semanticIdleTimer);
+            semanticIdleTimer = setTimeout(() => {
+                traceWsTimeout('semantic_idle_timeout', semanticIdleMs);
+                terminalError = streamStalledError('Responses WS', semanticIdleMs, { emittedToolCall: !!midState?.emittedToolCall });
+                // Partial-final recovery: attach streamed partial state so
+                // a wedged FINAL no-tool summary can be accepted as partial-final
+                // success by the loop. pendingToolUse gates out mid-flight tools.
+                try {
+                    terminalError.partialContent = content;
+                    terminalError.partialToolCalls = toolCalls.length ? toolCalls.slice() : undefined;
+                    terminalError.pendingToolUse = pendingCalls.size > 0
+                        || !!midState?.emittedToolCall
+                        || toolCalls.length > 0
+                        || _toolInFlight === true;
+                    terminalError.partialModel = model || undefined;
+                } catch { /* best-effort enrichment */ }
+                try { terminalError.wsCloseCode = 4000; } catch {}
+                try { socket.close(4000, 'semantic_idle_timeout'); } catch {}
+                finish();
+            }, semanticIdleMs);
+            try { semanticIdleTimer.unref?.(); } catch {}
         };
-        // Called on every event that carries real output tokens or tool
-        // progress. `response.created` is only an ACK and must not count here:
-        // a wedged openai-oauth stream can ACK immediately and then never produce
-        // text/reasoning/tool deltas, holding the prompt-cache lane for the
-        // full inter-chunk window.
-        const onMeaningfulOutput = () => {
-            if (!firstMeaningfulSeen) {
-                firstMeaningfulSeen = true;
-                clearPreStreamWatchdog();
-                clearFirstMeaningfulWatchdog();
-            }
+        // Single idle reset — called on EVERY parsed server event (matches
+        // codex, which resets one idle timer on every received WS frame). Any
+        // frame proves the socket is live; there is no separate "meaningful
+        // output" gate. Also clears the pre-stream watchdog defensively in case
+        // the first event is not response.created.
+        const resetIdle = () => {
+            clearPreStreamWatchdog();
             resetInterChunk();
         };
-        // resetIdle kept for compat; metadata frames no longer disarm pre-stream watchdog.
-        const resetIdle = () => { /* noop — only onMeaningfulOutput() disarms */ };
+        // Meaningful-output progress bump: called by the same delta cases that
+        // call onStreamDelta (text/reasoning/tool args). Arms the semantic idle.
+        const bumpSemanticIdle = () => { resetSemanticIdle(); };
         const cleanup = () => {
             if (idleTimer) clearTimeout(idleTimer);
-            clearFirstMeaningfulWatchdog();
             if (interChunkTimer) { clearTimeout(interChunkTimer); interChunkTimer = null; }
+            if (semanticIdleTimer) { clearTimeout(semanticIdleTimer); semanticIdleTimer = null; }
             if (keepaliveTimer) { clearInterval(keepaliveTimer); keepaliveTimer = null; }
             if (messageHandler) socket.off('message', messageHandler);
             if (closeHandler) socket.off('close', closeHandler);
@@ -1529,6 +1606,9 @@ export async function _streamResponse({
         };
         const finish = () => {
             logReasoningDeltaSuppression();
+            // Flush any partial-sentinel tail held back mid-stream so
+            // legitimate trailing text is never lost (streamed-text path).
+            flushLeak();
             cleanup();
             if (terminalError) { reject(terminalError); return; }
             resolve({
@@ -1536,11 +1616,17 @@ export async function _streamResponse({
                 model,
                 reasoningItems: reasoningItems.length ? reasoningItems : undefined,
                 responseItems: responseItemsAdded.length ? responseItemsAdded : undefined,
-                toolCalls: toolCalls.length ? toolCalls : undefined,
+                // Dedupe by name+args (Fix 2, array side) so an identical
+                // synthetic-leaked + native pair can't run the tool twice.
+                toolCalls: toolCalls.length ? dedupeToolCallList(toolCalls) : undefined,
                 citations: citations.length ? citations : undefined,
                 webSearchCalls: webSearchCalls.length ? webSearchCalls : undefined,
                 usage,
                 stopReason: stopReason || undefined,
+                // P1 audit fix: mirror the HTTP/SSE fallback's truncated flag
+                // for the WS path (sendViaWebSocket spreads this result
+                // through to the provider caller unchanged).
+                ...(stopReason === 'length' && content.length > 0 ? { truncated: true } : {}),
                 incompleteReason: incompleteReason || undefined,
                 responseId: responseId || undefined,
                 serviceTier: responseServiceTier || undefined,
@@ -1549,7 +1635,10 @@ export async function _streamResponse({
 
         messageHandler = (data) => {
             resetIdle();
-            // Do NOT call onStreamDelta for every frame — metadata/keepalive frames
+            // resetIdle() above resets the SINGLE inter-chunk idle timer on
+            // EVERY received frame — response.created, metadata,
+            // rate_limits, and all deltas keep the socket alive. Separately, do
+            // NOT call onStreamDelta for every frame — metadata/keepalive frames
             // must not reset the agent stall watchdog's lastStreamDeltaAt. Only
             // meaningful output (text delta / tool call) updates that timestamp.
             const text = typeof data === 'string' ? data : data.toString('utf-8');
@@ -1571,13 +1660,11 @@ export async function _streamResponse({
                     midState.sawResponseCreated = true;
                     if (event.response?.model) model = event.response.model;
                     if (event.response?.id) responseId = event.response.id;
-                    // Server ack: cancel only the pre-created watchdog. Keep
-                    // a separate first-meaningful watchdog armed until real
-                    // model progress arrives.
-                    onResponseCreated();
+                    // Server ack (first event). resetIdle() at the top of
+                    // messageHandler already cleared the pre-stream watchdog and
+                    // armed the single idle timer — no extra bookkeeping here.
                     break;
                 case 'response.output_text.delta':
-                    content += event.delta || '';
                     try {
                         if (!_firstDeltaEmitted) {
                             _firstDeltaEmitted = true;
@@ -1587,6 +1674,7 @@ export async function _streamResponse({
                         }
                         onStreamDelta?.();
                     } catch {}
+                    bumpSemanticIdle();
                     // Live text relay (gateway): forward the raw text chunk so
                     // the client renders first tokens before the final replay.
                     // Tool-call/argument deltas intentionally stay off this path.
@@ -1594,11 +1682,10 @@ export async function _streamResponse({
                     // cannot be withdrawn, so flag the attempt so a later
                     // mid-stream/truncated failure is NOT retried (retry would
                     // concatenate a second attempt onto rendered text).
-                    if (event.delta && onTextDelta) {
-                        if (state) state.emittedText = true;
-                        try { onTextDelta(event.delta); } catch {}
-                    }
-                    onMeaningfulOutput();
+                    // Routed through the leaked-tool-call guard: appends to
+                    // `content`, forwards visible text via onTextDelta, and
+                    // recovers/dispatches any leaked known-tool call.
+                    relayLeakText(event.delta || '');
                     break;
                 case 'response.reasoning_text.delta':
                 case 'response.reasoning_summary_text.delta':
@@ -1606,16 +1693,12 @@ export async function _streamResponse({
                     else reasoningSummaryTextDeltaCount += 1;
                     // Reasoning text is live model progress — refresh
                     // lastStreamDeltaAt so stream-watchdog does not flag a
-                    // long reasoning span as a stall. It also counts as
-                    // liveness for the local pre-stream / inter-chunk
-                    // watchdogs: a long reasoning span without any
-                    // output_text delta would otherwise trip the
-                    // first-meaningful timer and abort an otherwise healthy
-                    // stream. Reasoning is still suppressed from user
-                    // content (no `content +=` here) — only the watchdog
-                    // timers are reset.
+                    // long reasoning span as a stall. The local WS idle timer
+                    // was already reset by resetIdle() at the top of
+                    // messageHandler. Reasoning is still suppressed from user
+                    // content (no `content +=` here).
                     try { onStreamDelta?.(); } catch {}
-                    onMeaningfulOutput();
+                    bumpSemanticIdle();
                     break;
                 case 'response.output_item.added':
                     if (event.item?.type === 'function_call') {
@@ -1623,26 +1706,37 @@ export async function _streamResponse({
                             name: event.item.name || '',
                             callId: event.item.call_id || '',
                         });
-                        onMeaningfulOutput();
+                        _toolInFlight = true;
+                    } else if (event.item?.type === 'custom_tool_call') {
+                        _toolInFlight = true;
+                    } else if (event.item?.type === 'tool_search_call') {
+                        // Mark tool_search in-flight at item-added time, same
+                        // as function_call/custom_tool_call above, so the
+                        // semantic-idle stall gate's pendingToolUse never
+                        // drops a mid-flight tool_search before
+                        // response.output_item.done.
+                        _toolInFlight = true;
                     }
                     break;
                 case 'response.function_call_arguments.delta':
+                    _toolInFlight = true;
                     try { onStreamDelta?.(); } catch {}
-                    onMeaningfulOutput();
+                    bumpSemanticIdle();
                     break;
                 case 'response.custom_tool_call_input.delta':
+                    _toolInFlight = true;
                     try { onStreamDelta?.(); } catch {}
-                    onMeaningfulOutput();
+                    bumpSemanticIdle();
                     break;
                 case 'response.function_call_arguments.done': {
                     const itemId = event.item_id || '';
                     const pending = pendingCalls.get(itemId);
                     // function_call_arguments.done is a completion signal:
                     // empty/whitespace → no args ({}); a non-empty string that
-                    // fails JSON.parse is deterministic bad JSON. Native
-                    // convergence: surface an invalid-args MARKER (not silent
-                    // {}) so the dispatch loop returns an is_error tool_result
-                    // and the model re-issues valid JSON in the same turn.
+                    // fails JSON.parse is deterministic bad JSON. Surface an
+                    // invalid-args MARKER (not silent {}) so the dispatch loop
+                    // returns an is_error tool_result and the model re-issues
+                    // valid JSON in the same turn.
                     let args = {};
                     {
                         const _argText = typeof event.arguments === 'string' ? event.arguments : '';
@@ -1663,8 +1757,7 @@ export async function _streamResponse({
                     if (pending?.callId && pending?.name) {
                         const call = { id: pending.callId, name: pending.name, arguments: args };
                         toolCalls.push(call);
-                        midState.emittedToolCall = true;
-                        try { onToolCall?.(call); } catch {}
+                        emitToolCallDedupe(call);
                     } else {
                         // Synthesizing a `tc_${Date.now()}` callId here would
                         // make the next turn fail to match the model's
@@ -1684,7 +1777,7 @@ export async function _streamResponse({
                         });
                     }
                     try { onStreamDelta?.(); } catch {}
-                    onMeaningfulOutput();
+                    bumpSemanticIdle();
                     break;
                 }
                 case 'response.output_item.done':
@@ -1698,11 +1791,9 @@ export async function _streamResponse({
                     if (event.item?.type === 'web_search_call') pushWebSearchCall(event.item);
                     if (event.item?.type === 'tool_search_call') {
                         pushToolSearchCall(event.item);
-                        onMeaningfulOutput();
                     }
                     if (event.item?.type === 'custom_tool_call') {
                         pushCustomToolCall(event.item);
-                        onMeaningfulOutput();
                     }
                     break;
                 case 'response.completed': {
@@ -1734,7 +1825,18 @@ export async function _streamResponse({
                             if (!content && item.type === 'message') {
                                 for (const c of item.content || []) {
                                     if (c.type === 'output_text') {
-                                        content += c.text || '';
+                                        // Completed-output fallback (no streamed
+                                        // text). Route through the leak guard so
+                                        // a tool call leaked only in the final
+                                        // bundle is recovered, not surfaced as
+                                        // visible content. final=true → full flush.
+                                        if (leakGuard.enabled) {
+                                            const { text, calls } = leakGuard.push(c.text || '', true);
+                                            content += text;
+                                            for (const lc of calls) dispatchLeakedCall(lc);
+                                        } else {
+                                            content += c.text || '';
+                                        }
                                         pushOutputTextAnnotations(c);
                                     }
                                 }
@@ -1770,8 +1872,7 @@ export async function _streamResponse({
                                     if (tc.id && tc.name) {
                                         delete tc._deferred;
                                         delete tc._pendingItemId;
-                                        midState.emittedToolCall = true;
-                                        try { onToolCall?.(tc); } catch {}
+                                        emitToolCallDedupe(tc);
                                     }
                                 }
                             }
@@ -1908,6 +2009,13 @@ export async function _streamResponse({
                         && event.type.startsWith('response.reasoning')
                         && event.type.endsWith('.delta')) {
                         reasoningOtherDeltaCount += 1;
+                        // These ARE live model progress (reviewer Medium): a
+                        // provider that emits only these reasoning variants for a
+                        // long span would otherwise trip the SEMANTIC idle abort.
+                        // Refresh both the watchdog and the semantic idle timer,
+                        // matching the named reasoning_text.delta case above.
+                        try { onStreamDelta?.(); } catch {}
+                        bumpSemanticIdle();
                     }
                     // Trace-only events (response.in_progress, etc.)
                     break;
@@ -2043,9 +2151,6 @@ export function _classifyHandshakeError(err) {
  *                          response.create frame sent, but the server never
  *                          emitted response.created within the short
  *                          pre-stream deadline. Fast-fail retryable.
- *   'first_meaningful_timeout' — server ACKed response.created, then emitted
- *                          no real text/reasoning/tool progress before the
- *                          first-meaningful deadline.
  *   'response_failed_network'       — response.failed with network_error
  *   'response_failed_disconnected'  — response.failed with stream_disconnected
  *
@@ -2152,7 +2257,7 @@ export async function _acquireWithRetry({
                     try { err.retryClassifier = classifier; } catch {}
                 }
                 try {
-                    process.stderr.write(
+                    if (!process.env.MIXDOG_QUIET_PROVIDER_LOG) process.stderr.write(
                         `[openai-oauth-ws] handshake failed after ${attempt}/${HANDSHAKE_MAX_ATTEMPTS} attempts: ${err?.message || err}\n`,
                     );
                 } catch {}
@@ -2161,7 +2266,7 @@ export async function _acquireWithRetry({
             // Schedule backoff and emit progress.
             const backoff = _backoffFor(attempt);
             try {
-                process.stderr.write(
+                if (!process.env.MIXDOG_QUIET_PROVIDER_LOG) process.stderr.write(
                     `[openai-oauth-ws] worker retry ${attempt}/${HANDSHAKE_MAX_ATTEMPTS} (transient: ${classifier}, backoff ${backoff}ms)\n`,
                 );
             } catch {}
@@ -2249,6 +2354,14 @@ export async function sendViaWebSocket({
     const MAX_MIDSTREAM_RETRIES = MIDSTREAM_WS_TRANSIENT_RETRY_LIMIT;
     let firstAttemptError = null;
     let firstAttemptClassifier = null;
+    // Known tool names for the leaked-tool-call guard in _streamResponse.
+    // Derived from the exact request body so a recovered leaked call only
+    // synthesizes when it names a tool actually offered to this request.
+    const knownToolNames = new Set(
+        (Array.isArray(body?.tools) ? body.tools : [])
+            .map((t) => (typeof t?.name === 'string' ? t.name : null))
+            .filter(Boolean),
+    );
     // Live-text invariant across attempts: once ANY attempt has relayed a
     // non-empty text chunk to the client, no error thrown out of this function
     // may omit the liveTextEmitted/unsafeToRetry markers — otherwise an
@@ -2509,6 +2622,7 @@ export async function sendViaWebSocket({
                 logSuppressedReasoningDeltas,
                 traceProvider,
                 _timeouts: streamTimeouts,
+                knownToolNames,
             });
         } catch (err) {
             // Snapshot the xAI conversation anchor BEFORE releasing the
@@ -2555,7 +2669,7 @@ export async function sendViaWebSocket({
                 const backoff = _midstreamBackoffFor(retryNumber);
                 try {
                     const line = `[openai-oauth-ws] mid-stream recovered: retry ${retryNumber}/${retryLimit} (cause: ${classifier}, backoff ${backoff}ms)\n`;
-                    process.stderr.write(line);
+                    if (!process.env.MIXDOG_QUIET_PROVIDER_LOG) process.stderr.write(line);
                     emittedProgress.push(line);
                 } catch {}
                 await _sleepWithAbort(backoff, externalSignal, _sleepFn);
@@ -2664,8 +2778,8 @@ export async function sendViaWebSocket({
                 transport: 'websocket',
                 ws_mode: mode,
                 ws_pre_response_created_timeout_ms: WS_PRE_RESPONSE_CREATED_MS,
-                ws_first_meaningful_timeout_ms: WS_FIRST_MEANINGFUL_MS,
                 ws_inter_chunk_timeout_ms: WS_INTER_CHUNK_MS,
+                ws_idle_ms: WS_IDLE_MS,
                 iteration_delta_tokens: deltaTokens,
                 reused_connection: reused,
                 requested_service_tier: requestedServiceTier,