mixdog 0.9.14 → 0.9.16

package/src/output-styles/simple.md

@@ -12,34 +12,32 @@ Practical concise — outcome-first handoffs for coding work: summarize the
 result, do not narrate or explain the change.
 
 - Open with the outcome in one sentence: done, blocked, or awaiting a decision.
-- Summarize at the concept level: name the behavior and direction, not the code
-  path. Cite a symbol/path only as an anchor, never as the explanation.
+- Summarize at the concept level: name the behavior and direction, not the
+  code path; cite a symbol/path only as an anchor, never as the explanation.
 - Compress by cutting content (filler, hedging, pleasantries, restated facts),
-  not by clipping grammar: keep natural, complete sentences in the user's
-  language — never telegraph-style stub endings. Technical terms and code stay
-  exact.
-- Summarize what the change accomplishes rather than listing every file and how
-  each was edited. Name a path (`file_path:line_number`) only when the reader
-  truly needs it to navigate — not as a per-file changelog.
-- Keep controlled detail: usually 1–3 short bullets or 2–3 sentences total.
-  State each point once — outcome or fix direction, not both restated. No
-  step-by-step narration or file/line inventory.
-- Size budget: roughly HALF the Default style and TWICE Minimal — per point one
-  rendered line, whole reply ~5–7 lines. Above that you are writing Default;
+  not grammar: keep natural, complete sentences in the user's language — never
+  telegraph-style stub endings. Technical terms and code stay exact.
+- Summarize what the change accomplishes, not a per-file changelog. Name a
+  path (`file_path:line_number`) only when the reader truly needs it to
+  navigate.
+- Controlled detail: usually 1–3 short bullets or 2–3 sentences total; state
+  each point once — outcome or fix direction, not both. No step-by-step
+  narration or file/line inventory.
+- Size budget: roughly HALF the Default style and TWICE Minimal — one rendered
+  line per point, whole reply ~5–7 lines. Above that you are writing Default;
   below ~3 lines consider whether prose (Minimal) reads better.
 - Layout: one idea per bullet, ONE line each (two only when a verbatim
-  path/error forces it). Lead each item with a short bold key phrase. Put a
-  blank line between multi-line list items — never emit a dense wall of text.
-- If a point runs past one line, cut the elaboration instead of wrapping; detail
-  beyond the key phrase + one clause belongs to the Default style.
-- On final handoffs, optional labels such as `바뀐 점`, `확인한 것`, and
-  `남은 리스크/다음 단계` fit Korean-facing profiles; use plain English labels
-  when the thread is English. Do not label interim progress.
+  path/error forces it), led with a short bold key phrase; blank line between
+  multi-line list items — never a dense wall of text. If a point runs past one
+  line, cut the elaboration — detail beyond key phrase + one clause belongs to
+  Default.
+- Final handoffs may use labels like `바뀐 점`, `확인한 것`,
+  `남은 리스크/다음 단계` for Korean-facing profiles (plain English labels in
+  English threads); do not label interim progress.
 - Synthesize agent or retrieval results; never forward raw reports, long file
   lists, tool traces, or session metadata.
-- Do not hide blockers, failed verification, or required follow-up; state them
-  in one short clause.
+- Do not hide blockers, failed verification, or required follow-up — state
+  them in one short clause; if verification was not run, say so once.
 - Keep paths, commands, symbols, API names, code, and exact errors verbatim.
-- Skip filler, acknowledgments, hedging, and repeated conclusions; if
-  verification was not run, say so once.
+- Skip filler, acknowledgments, hedging, and repeated conclusions.
 - Never name this style unless asked.

package/src/rules/agent/00-core.md

@@ -1,19 +1,20 @@
 # Agent Constraints
 
 - Use English for agent task communication.
-- NEVER PREAMBLE: no tool-call preambles, status/progress narration, "I
-  will..." setup, or transition text before tool calls.
-- If tools are needed, call them immediately. Emit text only for the final
-  handoff after tool work is done.
+- ONE TURN = ONE BATCH: emit all independent tool calls of a step in the same
+  turn; a lone read-only call that could have ridden the previous turn is a
+  wasted round-trip.
+- NEVER PREAMBLE: no status/progress narration, "I will..." setup, or any text
+  before tool calls — call needed tools immediately; emit text only for the
+  final handoff after tool work is done.
 - Final handoff: minimum characters, maximum information for Lead. Follow the
-  role's stricter output contract if defined; else emit fragments — outcome
-  (1 line), key `file:line`(s), verification result, material risks (only if
+  role's stricter output contract if defined; else fragments — outcome (1
+  line), key `file:line`(s), verification result, material risks (only if
   any).
-- Density over length: never repeat what Lead already knows (the brief, the
-  process, how you searched); state only what changed and where to look.
-  Verification = command + result in one line. Same fact twice = delete one.
-- Handoff cap ~30 lines unless `Deliver:` raises it — a safety ceiling, not
-  a target.
+- Never repeat what Lead already knows (the brief, the process, how you
+  searched); state only what changed and where to look. Verification =
+  command + result in one line. Same fact twice = delete one.
+- Handoff cap ~30 lines unless `Deliver:` raises it — a ceiling, not a target.
 - Banned as pure cost: report headings, markdown tables (unless requested),
   prose narration, raw logs/tool traces, speculative next-checks, restated
   brief, articles/politeness.

package/src/rules/agent/30-explorer.md

@@ -6,28 +6,29 @@ kind: retrieval
 
 # Role: explorer
 
-You are a one-shot locator, not a researcher. You find WHERE, never WHY —
-no understanding code, explaining behaviour, or tracing logic. Coordinates
-are the entire deliverable.
+Coordinate locator. Deliverable = WHERE as `path:line`, never WHY — no
+explaining or tracing. You ARE the `explore` tool: never call it; shared
+rules pointing at `explore` don't apply — use grep/code_graph/find/glob
+directly.
 
-Default shape: ONE maximal-batch turn, then the answer. Fire everything at
-once: a single `grep` whose pattern[] carries ALL literal strings/errors/
-identifier guesses — synonyms, casings, variants — plus `code_graph`/`find`/
-`glob` in the SAME turn when useful. Width is free, turns are not.
+Credibility is mechanical: hit = line/path contains ANY query token or
+obvious synonym. No other standard — "is this the real implementation" is
+the caller's question. Sole exception: a generic-word-only match (schema,
+handler, config, resolver…) with no SPECIFIC query token (product/library/
+domain name) = zero, not a hit.
 
-Answer straight from search output: hits already carry `path:line` — never
-spend a turn on `read` to confirm or polish an anchor. `dist`/generated
-hits are leads, not answers: trace them to source.
+Rule zero — after EVERY tool result: ≥1 `path:line` matching a query
+token → answer NOW with those coordinates; no verify, no re-grep, no
+ranking; mark weak anchors `?`. Zero → one more batch if budget remains.
+No third branch: "hits exist but I want better ones" IS branch one.
 
-Budget: 5 turns of maximal batches. Credible `path:line` on screen means the
-search is OVER — answer in that turn; no verifying or collecting extras;
-mark weak anchors `?`. Turns 2-5 exist ONLY for a zero-anchor turn 1: derive
-new tokens from returned paths/names or widen scope, packing ALL candidates
-into the next batch. Concept queries: grep implementation vocabulary
-(file/dir names, symbol fragments, config keys). `EXPLORATION_FAILED` only
-after all 5 turns found zero anchors — giving up early is as wrong as
-over-searching; at turn 5 answer best-so-far.
+Turns: 3 tool turns HARD max; start each tool message with `turn N/3`.
+Turn 1 → answer; turns 2-3 are miss-recovery only, and must change tokens
+OR scope — never reword. One turn = ONE batch of AT MOST 5 calls: a single
+grep packing ALL variants in pattern[] plus code_graph/find/glob; a 6th
+call = packing failure. Flow/how questions: return first matching entry
+anchors (≤5); the caller traces the chain.
 
-Answer format, nothing else:
-- up to 5 lines: `path:line — symbol/name — short reason` (append `?` if weak)
-- or `EXPLORATION_FAILED`
+Answer, nothing else: up to 5 lines `path:line — symbol — short reason`
+(`?` if weak), or `EXPLORATION_FAILED` — only after 3 turns of zero
+anchors, or when every anchor matches only generic words.

package/src/rules/lead/01-general.md

@@ -1,11 +1,11 @@
 # General
 
-- Omit direct names, honorifics, headings, and labels in preambles.
-- Preambles are optional: use only when they add user-visible value, keep to
-  one short sentence, skip routine lookup narration.
+- Preambles are optional: one short sentence only when it adds user-visible
+  value; no direct names, honorifics, headings, labels, or routine lookup
+  narration.
 - Destructive/hard-to-reverse actions require explicit confirmation.
-- Never push, build, or deploy without an explicit user request.
-  Implementation approval is not deploy approval.
-- Proactively handle what you can first rather than deferring to the user;
-  propose only the parts needing a decision, consultatively ("Shall we
-  proceed this way?").
+- Never push, build, or deploy without an explicit user request —
+  implementation approval is not deploy approval.
+- Handle what you can proactively rather than deferring to the user; propose
+  only the parts needing a decision, consultatively ("Shall we proceed this
+  way?").

package/src/rules/lead/02-channels.md

@@ -1,3 +1,3 @@
-# Channels
-
-- Channel features are handled by the runtime.
+# Channels
+
+- Channel features are handled by the runtime.

package/src/rules/lead/lead-brief.md

@@ -1,21 +1,20 @@
 # Lead Brief Contract
 
 - Brief = one-line fragments `Goal:` `Anchors:` `Allow/Forbid:` `Deliver:`
-  `Verify:` (+`Stop:` heavy-worker). No role-known rules, background, or
-  motivation — minimum characters, maximum information.
-- Density over length: every line must carry information the agent cannot
-  know — never restate role rules, prior context, or the same fact twice.
-  A brief that feels long is a scope problem; split the scope, don't pad.
-- Anchors = `file:line` + one-line conclusion each. Never paste log/code
-  bodies; the agent reads the file itself.
-- Instruct by outcome ("make X behave Y"), not by method (no code snippets,
-  no step-by-step edits) unless the method IS the requirement.
+  `Verify:` (+`Stop:` heavy-worker). Minimum characters, maximum information:
+  no background/motivation, no role-known rules; never restate prior context
+  or the same fact twice. A brief that feels long is a scope problem — split
+  the scope, don't pad.
+- Anchors = `file:line` + one-line conclusion each; never paste log/code
+  bodies — the agent reads the file itself.
+- Instruct by outcome ("make X behave Y"), not method (no code snippets, no
+  step-by-step edits) unless the method IS the requirement.
 - `Deliver:` states output size/shape (e.g. "fragments <=15 lines", "verdict
-  + top-3 risks", "detail to file, path only"). Never request a long report
+  + top-3 risks", "detail to file, path only"); never request a long report
   in the handoff itself.
 - Full brief only on fresh spawn or `respawned: true` (dead-tag send = cold
-  session; re-supply anchors). Live-session follow-ups = delta only; never
-  restate Goal/rules.
+  session; re-supply anchors); live-session follow-ups = delta only, never
+  restating Goal/rules.
 - Never `send` mid-run; batch all adjustments into ONE follow-up after
   completion. Interrupt only to cancel.
 - All agent communication in English.

package/src/rules/shared/01-tool.md

@@ -4,18 +4,29 @@
   prior result — including edit loops: batch the post-edit verification read
   with the next target's lookup.
 - Pick by target: symbols/callers/deps → `code_graph`; exact text in a verified
-  scope → `grep`; unknown path/name → `find`; structure → `glob`; dirs →
-  `list`; verified file → `read`; broad unknown with no anchor → `explore`.
-  Never `grep`/`read` guessed paths.
-- One concept → one batched `grep pattern:[...]` with
-  `output_mode:"content_with_context"` (or one `code_graph symbols[]`). Refine
-  from returned paths; never repeat equivalent patterns or scopes.
-- On miss/error, normalize the target once and switch tool; on a plausible hit,
-  stop and answer from the framed context.
-- Retrieval serves the NEXT action (edit, answer, handoff), not certainty. One
-  anchor is enough to act on; re-reading/re-grepping an area seen this session
-  is waste. When acting and looking are both possible, act.
-- `read` uses `offset`/`limit` only. For 2+ spans from known file(s), make one
-  batched `read` with `{path,offset,limit}` region objects. Adjacent spans in
-  one file (within a few hundred lines) are ONE window, not repeated reads.
+  scope → `grep`; dirs → `list`; verified file → `read`.
+  Locating files: concept-level or cross-file questions ("where is X handled",
+  "how does Y flow") → `explore`, even when you could guess a keyword — its
+  fan-out spends explorer context, not yours, and guess-and-retry keywords
+  belong to it, not grep. Confident name fragment → `find`; exact name
+  pattern → `glob`; exact content literal → `grep`. Flow/trace with a known
+  symbol → `code_graph`, never `explore` — it returns entry-point anchors
+  only; follow the chain yourself. Never `grep`/`read` guessed paths.
+- One concept → ONE search call: all synonyms/variants in one
+  `grep pattern:[...]` (or `code_graph symbols[]`), scopes as `path[]`;
+  single-pattern bursts = packing failure. A second call on the same concept
+  is a defect unless the first returned zero — then change tokens or scope,
+  never reword.
+- Content-mode `grep` always carries `-C 5`+ ; re-reading the same file after
+  a content grep is a wasted round-trip. Bare match lines = existence checks
+  only.
+- Any path not returned by a tool this session is a guess: find first, then
+  grep/read the returned path. On ENOENT the next call is find on the
+  basename — never a second guess or the same path with changed args.
+- Retrieval serves the NEXT action (edit, answer, handoff), not certainty:
+  the FIRST anchor ends the search — no verifying, ranking, or re-checking a
+  hit already on screen. When acting and looking are both possible, act.
+- `read` uses `offset`/`limit` only; 2+ spans from known file(s) = ONE batched
+  `read` with `{path,offset,limit}` regions. Adjacent spans in one file
+  (within a few hundred lines) are ONE window, not repeated reads.
 - Don't mix `apply_patch` with shell or other state-changing calls in one turn.

package/src/runtime/agent/orchestrator/agent-trace-format.mjs

@@ -207,12 +207,13 @@ function _redactLogText(text) {
 function classifyToolFailure(resultText, toolName) {
     const text = String(resultText ?? '').toLowerCase();
     if (/requires either|invalid arguments|unknown parameter|must be|schema|expected|required|old_string is .*>=/.test(text)) return 'schema/args';
-    if (/enoent|cannot find|not found at this path|path does not exist|no such file|file not found in graph|unreadable/.test(text)) return 'path/cwd';
+    if (/not in allow-list|not allowed/.test(text)) return 'permission';
+    if (String(toolName || '') === 'shell' || /^\s*\[exit code:\s*\d+\]/i.test(String(resultText ?? ''))) return 'command-exit';
+    if (/enoent|cannot find|not found at this path|path does not exist|no such file|file not found in graph|unreadable/.test(text)) return 'path/enoent';
     if (/timed out|timeout|interrupted|aborted/.test(text)) return 'timeout/abort';
     if (/hunk rejected|patch failed|context mismatch|expected first old\/context|context not found/.test(text)) return 'patch/context';
-    if (/not in allow-list|permission|denied|forbidden|not allowed/.test(text)) return 'permission';
+    if (/permission|denied|forbidden/.test(text)) return 'permission';
     if (/unknown tool|tool.*not.*available|missing.*tool/.test(text)) return 'tool-surface';
-    if (String(toolName || '') === 'shell' || /^\s*\[exit code:\s*\d+\]/i.test(String(resultText ?? ''))) return 'command-exit';
     return 'runtime/failure';
 }
 

package/src/runtime/agent/orchestrator/config.mjs

@@ -149,7 +149,7 @@ function buildDefaultConfig(options = {}) {
     const providers = {};
     // API providers — enabled if env key exists
     for (const [name, envKey] of Object.entries(AGENT_PROVIDER_ENV)) {
-        const apiKey = process.env[envKey];
+        const apiKey = detectCredentials ? process.env[envKey] : undefined;
         providers[name] = {
             enabled: !!apiKey,
             apiKey: apiKey || undefined,

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -24,7 +24,7 @@ import {
     resolveAnthropicModelAfter404,
     ensureLatestAnthropicModel,
 } from './anthropic-model-resolve.mjs';
-import { sanitizeToolPairs, sanitizeAnthropicContentPairs } from '../session/context-utils.mjs';
+import { sanitizeToolPairs, sanitizeAnthropicContentPairs, foldUserTextIntoToolResultTail } from '../session/context-utils.mjs';
 import {
     TOKEN_REFRESH_SKEW_MS,
     resolveCliVersion,
@@ -303,6 +303,11 @@ function nativeAnthropicTools(opts) {
 }
 function deferredAnthropicTools(activeTools, opts) {
     if (opts?.session?.deferredNativeTools !== true) return [];
+    // A request whose ONLY tools are deferred is rejected by the API with
+    // `400: At least one tool must have defer_loading=false` — happens on the
+    // iteration-cap final turn (loop sends tools: [] to force a text answer).
+    // No active tools ⇒ send no deferred catalog either.
+    if (!Array.isArray(activeTools) || activeTools.length === 0) return [];
     const active = new Set((activeTools || []).map((tool) => String(tool?.name || '').trim()).filter(Boolean));
     const catalog = Array.isArray(opts.session.deferredToolCatalog) ? opts.session.deferredToolCatalog : [];
     return catalog
@@ -362,6 +367,14 @@ function toAnthropicMessages(messages) {
             continue;
         }
 
+        // Claude Code parity: fold a user text turn that directly follows a
+        // tool_result turn into that tool_result's content. A sibling text
+        // turn after tool_result renders as `</function_results>\n\nHuman:`
+        // on the wire and trains the model toward 3-token empty end_turn
+        // completions (see foldUserTextIntoToolResultTail).
+        if (m.role === 'user' && foldUserTextIntoToolResultTail(result, normalizeContentForAnthropic(m.content))) {
+            continue;
+        }
         result.push({ role: m.role, content: normalizeContentForAnthropic(m.content) });
     }
     return sanitizeAnthropicContentPairs(result);
@@ -1055,6 +1068,14 @@ export class AnthropicOAuthProvider {
                     if (attemptIndex > 0 && firstAttemptError) {
                         try { firstAttemptError.midstreamRetries = attemptIndex; } catch {}
                         try { firstAttemptError.midstreamClassifier = firstAttemptClassifier; } catch {}
+                        // firstAttemptError is what actually propagates here when
+                        // live text was emitted this attempt — stamp the unsafe
+                        // flags onto IT too, else upstream sees an unmarked error
+                        // and retries, duplicating already-streamed output.
+                        try {
+                            firstAttemptError.liveTextEmitted = true;
+                            firstAttemptError.unsafeToRetry = true;
+                        } catch {}
                         throw firstAttemptError;
                     }
                     throw err;

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -1,6 +1,6 @@
 import { createRequire } from 'node:module';
 import { loadConfig } from '../config.mjs';
-import { sanitizeToolPairs, sanitizeAnthropicContentPairs } from '../session/context-utils.mjs';
+import { sanitizeToolPairs, sanitizeAnthropicContentPairs, foldUserTextIntoToolResultTail } from '../session/context-utils.mjs';
 import { classifyError, midstreamBackoffFor, sleepWithAbort, withRetry } from './retry-classifier.mjs';
 import { traceAgentUsage } from '../agent-trace.mjs';
 import {
@@ -310,6 +310,10 @@ function nativeAnthropicTools(opts) {
 }
 function deferredAnthropicTools(activeTools, opts) {
     if (opts?.session?.deferredNativeTools !== true) return [];
+    // Guard against an all-deferred tools array — the API rejects it with
+    // `400: At least one tool must have defer_loading=false` (iteration-cap
+    // final turn sends tools: []). See anthropic-oauth.mjs counterpart.
+    if (!Array.isArray(activeTools) || activeTools.length === 0) return [];
     const active = new Set((activeTools || []).map((tool) => String(tool?.name || '').trim()).filter(Boolean));
     const catalog = Array.isArray(opts.session.deferredToolCatalog) ? opts.session.deferredToolCatalog : [];
     return catalog
@@ -366,6 +370,12 @@ function toAnthropicMessages(messages) {
             }
             continue;
         }
+        // Claude Code parity: fold a user text turn that directly follows a
+        // tool_result turn into that tool_result's content (empty end_turn
+        // livelock prevention; see foldUserTextIntoToolResultTail).
+        if (m.role === 'user' && foldUserTextIntoToolResultTail(result, normalizeContentForAnthropic(m.content))) {
+            continue;
+        }
         result.push({ role: m.role, content: normalizeContentForAnthropic(m.content) });
     }
     return sanitizeAnthropicContentPairs(result);
@@ -808,6 +818,16 @@ export class AnthropicProvider {
                         if (attemptIndex > 0 && firstAttemptError) {
                             try { firstAttemptError.midstreamRetries = attemptIndex; } catch {}
                             try { firstAttemptError.midstreamClassifier = firstAttemptClassifier; } catch {}
+                            // firstAttemptError (from an earlier retried attempt)
+                            // is what actually propagates when live text was
+                            // emitted this attempt — stamp the unsafe/partial
+                            // flags onto IT too, otherwise upstream sees an
+                            // unmarked error and retries, duplicating streamed
+                            // output.
+                            try {
+                                firstAttemptError.liveTextEmitted = true;
+                                firstAttemptError.unsafeToRetry = true;
+                            } catch {}
                             throw firstAttemptError;
                         }
                         throw err;

package/src/runtime/agent/orchestrator/providers/gemini-stream.mjs

@@ -47,22 +47,38 @@ export function geminiTruncatedStreamError(message) {
 // stall after visible output was silently retried. Visible-text stalls also
 // gain streamStalled + partialContent so the loop's partial-final path can
 // keep the streamed output instead of dropping the turn.
-export function stampGeminiStreamFailure(err, { relayedText = '', textLeakGuard = null } = {}) {
+export function stampGeminiStreamFailure(err, { relayedText = '', textLeakGuard = null, sawFunctionCall = false } = {}) {
     if (!err || typeof err !== 'object') return err;
     const leaked = (textLeakGuard?.getLeakedToolCalls?.() || []).length > 0;
     const visible = relayedText.length > 0;
+    // A native functionCall chunk (not a text-leaked one) is also an in-flight
+    // tool use — replaying would double-dispatch, and partial-final must NOT
+    // treat it as a clean no-tool summary.
+    const pendingTool = leaked || sawFunctionCall === true;
     try {
         if (visible) { err.liveTextEmitted = true; err.unsafeToRetry = true; }
-        if (leaked) { err.emittedToolCall = true; err.unsafeToRetry = true; }
-        if (visible && !leaked && err.code === 'EGEMINITIMEOUT') {
+        if (pendingTool) { err.emittedToolCall = true; err.unsafeToRetry = true; }
+        // TRUNCATED_STREAM EOF after visible output must also carry the
+        // partial-final stamps (streamStalled/partialContent), aligning with the
+        // compat streams — otherwise live output is dropped instead of kept.
+        if (visible && !leaked
+            && (err.code === 'EGEMINITIMEOUT' || err.code === 'TRUNCATED_STREAM' || err.truncatedStream === true)) {
             err.streamStalled = true;
             if (typeof err.partialContent !== 'string') err.partialContent = relayedText;
-            if (err.pendingToolUse === undefined) err.pendingToolUse = false;
+            if (err.pendingToolUse === undefined) err.pendingToolUse = pendingTool;
         }
     } catch { /* best-effort */ }
     return err;
 }
 
+// True when a streamed Gemini chunk carries a native functionCall part (as
+// opposed to a tool call leaked as plain text, tracked by textLeakGuard).
+export function geminiChunkHasFunctionCall(chunk) {
+    const parts = chunk?.candidates?.[0]?.content?.parts;
+    if (!Array.isArray(parts)) return false;
+    return parts.some((p) => p && p.functionCall);
+}
+
 /**
  * Aggregate streamed GenerateContentResponse chunks into one response object
  * (same shape as a non-streaming generateContent JSON body).
@@ -245,6 +261,7 @@ export async function consumeGeminiRestStreamResponse(response, { signal, onStre
     let idleTimer = null;
     let idleReject = null;
     let relayedText = '';
+    let sawFunctionCall = false;
 
     let firstByteTimer = setTimeout(() => {
         try { reader.cancel('first byte timeout'); } catch {}
@@ -332,6 +349,7 @@ export async function consumeGeminiRestStreamResponse(response, { signal, onStre
                 }
                 allChunks.push(parsed);
                 try { onStreamDelta?.(); } catch {}
+                if (!sawFunctionCall && geminiChunkHasFunctionCall(parsed)) sawFunctionCall = true;
                 if (onTextDelta || textLeakGuard) {
                     const t = geminiChunkText(parsed);
                     if (t) relayedText += t;
@@ -352,6 +370,7 @@ export async function consumeGeminiRestStreamResponse(response, { signal, onStre
                         }
                         allChunks.push(parsed);
                         try { onStreamDelta?.(); } catch {}
+                        if (!sawFunctionCall && geminiChunkHasFunctionCall(parsed)) sawFunctionCall = true;
                         if (onTextDelta || textLeakGuard) {
                             const t = geminiChunkText(parsed);
                             if (t) relayedText += t;
@@ -362,7 +381,7 @@ export async function consumeGeminiRestStreamResponse(response, { signal, onStre
             }
         }
     } catch (err) {
-        throw stampGeminiStreamFailure(err, { relayedText, textLeakGuard });
+        throw stampGeminiStreamFailure(err, { relayedText, textLeakGuard, sawFunctionCall });
     } finally {
         clearFirstByteTimer();
         if (idleTimer) clearTimeout(idleTimer);
@@ -380,7 +399,7 @@ export async function consumeGeminiRestStreamResponse(response, { signal, onStre
     try {
         assertGeminiStreamCompleted({ sawStreamChunk, finishReason, label });
     } catch (err) {
-        throw stampGeminiStreamFailure(err, { relayedText, textLeakGuard });
+        throw stampGeminiStreamFailure(err, { relayedText, textLeakGuard, sawFunctionCall });
     }
     return aggregated;
 }
@@ -393,6 +412,7 @@ export async function consumeGeminiSdkStream(streamResult, { signal, onStreamDel
     let firstByteTimer = null;
     let inFlightReject = null;
     let relayedText = '';
+    let sawFunctionCall = false;
 
     const armFirstByteTimer = () => {
         if (firstByteTimer) clearTimeout(firstByteTimer);
@@ -504,6 +524,7 @@ export async function consumeGeminiSdkStream(streamResult, { signal, onStreamDel
             resetIdleTimer();
             if (step.value) collectedChunks.push(step.value);
             try { onStreamDelta?.(); } catch {}
+            if (!sawFunctionCall && geminiChunkHasFunctionCall(step.value)) sawFunctionCall = true;
             if (onTextDelta || textLeakGuard) {
                 const t = geminiChunkText(step.value);
                 if (t) relayedText += t;
@@ -519,7 +540,7 @@ export async function consumeGeminiSdkStream(streamResult, { signal, onStreamDel
             const reason = signal.reason;
             throw reason instanceof Error ? reason : new Error(`${label} aborted`);
         }
-        throw stampGeminiStreamFailure(err, { relayedText, textLeakGuard });
+        throw stampGeminiStreamFailure(err, { relayedText, textLeakGuard, sawFunctionCall });
     } finally {
         clearFirstByteTimer();
         if (idleTimer) clearTimeout(idleTimer);
@@ -559,7 +580,7 @@ export async function consumeGeminiSdkStream(streamResult, { signal, onStreamDel
     try {
         assertGeminiStreamCompleted({ sawStreamChunk, finishReason, label });
     } catch (err) {
-        throw stampGeminiStreamFailure(err, { relayedText, textLeakGuard });
+        throw stampGeminiStreamFailure(err, { relayedText, textLeakGuard, sawFunctionCall });
     }
     return raw;
 }

package/src/runtime/agent/orchestrator/providers/gemini.mjs

@@ -68,7 +68,7 @@ const DEFAULT_MODEL = MODELS[0].id;
 const MODEL_CACHE_TTL_MS = 24 * 60 * 60_000;
 // Bump when the on-disk cache shape changes so stale-shape entries are
 // discarded instead of misread.
-const GEMINI_MODEL_CACHE_SCHEMA_VERSION = 1;
+const GEMINI_MODEL_CACHE_SCHEMA_VERSION = 2;
 
 // De-dupes concurrent force-refreshes so they share one HTTP round-trip,
 // mirroring anthropic-oauth's _modelRefreshInFlight.
@@ -155,6 +155,10 @@ export class GeminiProvider {
             const cfg = freshConfig.providers?.gemini;
             const newKey = cfg?.apiKey || process.env.GEMINI_API_KEY;
             if (newKey) {
+                // Keep this.config in sync so REST/cache paths (which read the
+                // key via _getApiKey() → this.config.apiKey) don't keep using
+                // the stale key after a rotation; genAI alone is not enough.
+                this.config = { ...(this.config || {}), ...(cfg || {}), apiKey: newKey };
                 this.genAI = new GoogleGenerativeAI(newKey);
             }
         } catch { /* best effort */ }
@@ -871,10 +875,11 @@ export class GeminiProvider {
         if (!res.ok) throw new Error(`gemini list_models ${res.status}`);
         const data = await res.json();
         const items = Array.isArray(data?.models) ? data.models : [];
-        // Filter to Gemini family; skip embedding/imagen endpoints.
+        // Filter to Gemini family; skip embedding/imagen and non-coding SKUs
+        // (robotics, computer-use) that the chat picker should never show.
         const normalized = items
             .filter(m => (m?.name || '').includes('gemini'))
-            .filter(m => !/embedding|aqa|imagen/.test(m?.name || ''))
+            .filter(m => !/embedding|aqa|imagen|robotics|computer-use/.test(m?.name || ''))
             .map(m => {
                 const id = (m.name || '').replace(/^models\//, '');
                 const family = /flash-lite/.test(id) ? 'gemini-flash-lite'
@@ -886,8 +891,11 @@ export class GeminiProvider {
                     display: m.displayName || id,
                     family,
                     provider: 'gemini',
-                    contextWindow: m.inputTokenLimit || 1000000,
-                    outputTokens: m.outputTokenLimit || 8192,
+                    // No fabricated fallbacks: when the API omits limits leave
+                    // them null so enrichModels can fill from the catalog and
+                    // the picker shows no context label instead of a fake 1M.
+                    contextWindow: m.inputTokenLimit || null,
+                    outputTokens: m.outputTokenLimit || null,
                     tier: 'version',
                     latest: false,
                     description: m.description || '',

package/src/runtime/agent/orchestrator/providers/grok-oauth.mjs

@@ -250,7 +250,7 @@ function saveTokens(tokens) {
         expires_at: tokens.expires_at || 0,
         token_endpoint: tokens.token_endpoint || null,
         user_id: tokens.user_id || tokens.userId || _identityFromAccessToken(tokens.access_token).user_id || undefined,
-    }, { lock: true, fsyncDir: true });
+    }, { lock: true, fsyncDir: true, mode: 0o600, secret: true });
 }
 
 function _scrubTokens(text) {

package/src/runtime/agent/orchestrator/providers/model-list-sanitize.mjs

@@ -41,6 +41,7 @@ const NON_CHAT_RE = new RegExp(
       'dall[-_]?e', 'sora', 'imagen', 'imagine', 'veo', 'kling', 'runway',
       'realtime', 'transcribe', 'transcription', 'diarize',
       'guard', 'safety', 'classifier',
+      'robotics', 'computer[-_]?use',
     ].join('|') +
     ')([-_/\\s]|$)',
   'i',
@@ -64,6 +65,15 @@ const NON_LLM_ID_PATTERNS = [
   /^gpt-audio(\b|-)/i,               // gpt-audio, gpt-audio-mini, gpt-audio-1.5
   /^gpt-realtime(\b|-)/i,            // gpt-realtime*, gpt-realtime-mini
   /-tts(\b|-)/i,                      // any *-tts SKU
+  // Purpose-specific SKUs that report mode:'chat' but are never useful for a
+  // coding agent (embodied/robotics, browser computer-use, audio-native,
+  // customtools picker-duplicate variants).
+  /(^|-)robotics(\b|-)/i,             // gemini-robotics-er-*
+  /computer[-_]?use/i,                // gemini-2.5-computer-use-preview-*
+  /native[-_]?audio/i,                // gemini-2.5-flash-native-audio-*
+  /-customtools(\b|-|$)/i,            // gemini-3.1-pro-preview-customtools
+  /^codex-auto-review$/i,             // Codex backend auto-review model, not a picker choice
+  /^grok-build$/i,                    // proxy alias duplicating grok-build-0.1 (exact — 0.1 stays)
 ];
 
 function _isNonLlmId(lid) {
@@ -89,6 +99,7 @@ const LEGACY_PATTERNS = [
   /^claude-(1|2|3|instant)(\b|-|\.)/i,
   // Gemini legacy — gemini-1*, gemini-pro. gemini-2/3 not matched.
   /^gemini-1(\b|-|\.)/i,
+  /^gemini-2\.0(\b|-|\.)/i,
   /^gemini-pro(\b|-)/i,
   // Grok legacy — grok-1/2/3 and grok-beta. The digit boundary stops grok-3
   // from catching grok-4.20-beta.