mixdog 0.9.147 → 0.9.148

package/src/runtime/agent/orchestrator/providers/anthropic-sse.mjs

@@ -8,7 +8,7 @@ import { randomBytes } from 'crypto';
 import {
     PROVIDER_FIRST_BYTE_TIMEOUT_MS,
     PROVIDER_SSE_IDLE_WATCHDOG_ENABLED,
-    PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS,
+    PROVIDER_SSE_IDLE_TIMEOUT_MS,
     streamStalledError,
 } from '../stall-policy.mjs';
 import {
@@ -25,6 +25,10 @@ import {
 } from './lib/anthropic-native-blocks.mjs';
 import { parseProviderJsonBatch } from './stream-json-pool.mjs';
 import { stampStreamOutcome, STREAM_TRANSPORTS, STREAM_OUTCOME_VERSION } from './lib/stream-outcome.mjs';
+import {
+    anthropicFallbackProviderMetadata,
+    parseAnthropicFallbackBlock,
+} from './anthropic-server-fallback.mjs';
 
 /** Bounded mid-stream SSE retries (transient stream loss); shared with anthropic.mjs.
  *  Sourced from the single shared retry-budget table (MIDSTREAM_RETRY_POLICY.sse). */
@@ -132,20 +136,23 @@ function cloneNativeBlock(block) {
 }
 
 export async function parseSSEStream(response, signal, abortStream, onStreamDelta, onToolCall, state, onTextDelta, knownToolNames) {
-    // onStreamDelta is a semantic-progress callback. HTTP headers and raw SSE
-    // bytes prove transport health but must not refresh semantic watchdogs.
+    // Anthropic/Claude parity: every received SSE byte proves transport
+    // activity, including comment and named ping keepalives. Content kinds
+    // remain distinct on onStreamDelta so TTFT and visible-progress accounting
+    // do not mistake transport heartbeats for model output.
     const reader = response.body.getReader();
     const decoder = new TextDecoder();
-    // SEMANTIC idle window: reset only by real model events (message/content/
-    // tool deltas), NOT by raw keepalive bytes. A ping-only wedge therefore
-    // trips this within the window instead of hanging until the 30-min agent
-    // watchdog. See resetIdleTimer + the per-event reset in the loop below.
-    // state.semanticIdleTimeoutMs is a test/override seam (same shape as
-    // firstMessageTimeoutMs); production uses the shared env-backed default.
-    const SSE_IDLE_TIMEOUT_MS = Number.isFinite(Number(state?.semanticIdleTimeoutMs))
-        && Number(state.semanticIdleTimeoutMs) > 0
-        ? Number(state.semanticIdleTimeoutMs)
-        : PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS;
+    // Transport-idle window. The legacy semanticIdleTimeoutMs seam remains as
+    // a fallback for existing tests/callers, but production uses the shared
+    // byte/event inactivity policy.
+    const configuredIdleTimeoutMs = state?.transportIdleTimeoutMs ?? state?.semanticIdleTimeoutMs;
+    const SSE_IDLE_TIMEOUT_MS = Number.isFinite(Number(configuredIdleTimeoutMs))
+        && Number(configuredIdleTimeoutMs) > 0
+        ? Number(configuredIdleTimeoutMs)
+        : PROVIDER_SSE_IDLE_TIMEOUT_MS;
+    const idleWatchdogEnabled = typeof state?.transportIdleWatchdogEnabled === 'boolean'
+        ? state.transportIdleWatchdogEnabled
+        : PROVIDER_SSE_IDLE_WATCHDOG_ENABLED;
     const SSE_FIRST_MESSAGE_TIMEOUT_MS = Number.isFinite(Number(state?.firstMessageTimeoutMs))
         && Number(state.firstMessageTimeoutMs) > 0
         ? Number(state.firstMessageTimeoutMs)
@@ -215,6 +222,7 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
     let usage = { inputTokens: 0, outputTokens: 0, cachedTokens: 0, cacheWriteTokens: 0, raw: null };
     let stopReason = null;
     let stopDetails;
+    const fallbackEvents = [];
     let buffer = '';
     let idleTimedOut = false;
     let firstMessageTimedOut = false;
@@ -389,10 +397,7 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
     };
 
     const resetIdleTimer = () => {
-        // OFF by default. When disabled the
-        // idle timer never arms, so the stream is never killed on inactivity;
-        // the agent stall watchdog (600s) remains the dead-stream backstop.
-        if (!PROVIDER_SSE_IDLE_WATCHDOG_ENABLED) return;
+        if (!idleWatchdogEnabled) return;
         if (idleTimer) clearTimeout(idleTimer);
         idleTimer = setTimeout(() => {
             idleTimedOut = true;
@@ -413,9 +418,8 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                 const e = _attachStallPartial(streamStalledError('Anthropic OAuth SSE', SSE_IDLE_TIMEOUT_MS, { emittedToolCall: !!state?.emittedToolCall }));
                 const r = idleReject; idleReject = null; r(e);
             }
-        // Shared provider policy: short SEMANTIC-event inactivity catches the
-        // ping-only wedge where SSE starts, emits some deltas, then goes silent
-        // while `:ping` keepalives keep the transport socket warm.
+        // Only actual transport silence trips this. Anthropic keepalives prove
+        // that the generation connection is still alive.
         }, SSE_IDLE_TIMEOUT_MS);
         try { idleTimer.unref?.(); } catch {}
     };
@@ -438,11 +442,11 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
             }
             signal.addEventListener('abort', onAbort, { once: true });
         }
-        // Part A / reviewer fix: do NOT arm the SEMANTIC idle timer before the
+        // Do not arm the transport-idle timer before the
         // stream has produced its first event. A slow first response is governed
         // by armFirstMessageTimer() (first-byte window) alone; arming the
-        // semantic idle here could let it win and mis-abort a legitimately slow
-        // first response as a stall. The semantic idle is first armed at
+        // transport idle here could let it win and mis-abort a legitimately slow
+        // first response as a stall. The transport idle is first armed at
         // `message_start` (see below), so it only ever guards MID-stream silence.
         armFirstMessageTimer();
         streamLoop: while (true) {
@@ -471,18 +475,17 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
             }
             const { done, value } = chunk;
             if (done) break;
+            if (state?.sawMessageStart) resetIdleTimer();
+            try { onStreamDelta?.('transport'); } catch {}
             buffer += decoder.decode(value, { stream: true });
             const lines = buffer.split('\n');
             buffer = lines.pop() || '';
 
             for (const line of lines) {
                 if (line.startsWith(':')) {
-                    // SSE comment frame (Anthropic `:ping` keepalive). Keep it
-                    // at transport level only: comments must not refresh the
-                    // agent's semantic progress timestamp, or a ping-only 200
-                    // can look alive forever without message_start/content.
-                    // Crucially it also does NOT reset the SEMANTIC idle timer
-                    // below — a ping-only wedge must trip the idle abort.
+                    // SSE comment frame (Anthropic `:ping` keepalive). The raw
+                    // chunk already refreshed transport activity above; it is
+                    // intentionally not counted as visible model progress.
                     continue;
                 }
                 // Blank lines are SSE record separators — emitted after EVERY
@@ -504,18 +507,6 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                     // cancellation after this frame is relayed.
                     const [event] = await parseProviderJsonBatch([data]);
 
-                    // SEMANTIC idle reset (Part A): reset the idle timer ONLY for
-                    // real progress events, NOT for Anthropic keepalives. Anthropic
-                    // sends pings as a NAMED event (`event: ping` /
-                    // `data: {"type":"ping"}`), not just `:` comment frames, so a
-                    // named ping must be excluded here or a ping-only wedge keeps
-                    // the timer alive forever. Everything that is not a ping is a
-                    // genuine server event (message_start/content/tool/thinking
-                    // deltas, message_delta/stop, errors) and counts as progress.
-                    if (currentEvent !== 'ping' && event?.type !== 'ping') {
-                        resetIdleTimer();
-                    }
-
                     if (currentEvent === 'error' || event?.type === 'error' || event?.error) {
                         throw _anthropicSseError(event);
                     }
@@ -523,12 +514,9 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                     if (event.type === 'message_start' && event.message) {
                         clearFirstMessageTimer();
                         if (state) state.sawMessageStart = true;
-                        // The first protocol event proves the response transport
-                        // is live. Report it only here (never for raw bytes,
-                        // comments, or ping events), then separately report the
-                        // semantic message boundary. Content kinds remain
-                        // reasoning/text/tool-specific below.
-                        try { onStreamDelta?.('transport'); } catch {}
+                        resetIdleTimer();
+                        // Transport activity was already reported for the raw
+                        // chunk; this reports the semantic message boundary.
                         try { onStreamDelta?.('semantic'); } catch {}
                         if (event.message.model) model = event.message.model;
                         if (event.message.usage) {
@@ -541,6 +529,13 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
 
                     if (event.type === 'content_block_start') {
                         const block = event.content_block;
+                        const fallback = parseAnthropicFallbackBlock(block);
+                        if (fallback) {
+                            fallbackEvents.push(fallback);
+                            model = fallback.fallbackModel;
+                            contentBlockTypes.add('fallback');
+                            try { onStreamDelta?.('semantic'); } catch {}
+                        }
                         if (block?.type === 'tool_use') {
                             if (state) state.partialToolCall = true;
                             pendingToolInputs.set(event.index, {
@@ -757,7 +752,7 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                             // An invalid-args marker never fingerprint-collides with
                             // a real recovered call, so malformed native calls still
                             // dispatch (the marker path is unaffected).
-                            if (_toolDedupe.shouldDispatch(call.name, call.arguments)) {
+                            if (_toolDedupe.shouldDispatch(call.name, call.arguments, call.id)) {
                                 toolCalls.push(call);
                                 // Ordered replay copy of the dispatched call —
                                 // skipped/deduped calls stay out so a replayed
@@ -947,6 +942,7 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
             // assistantBlocks branch). Absent for every ordinary turn, which
             // keeps the existing text/thinking/tool_use lowering untouched.
             assistantBlocks: _orderedAssistantBlocks(),
+            providerMetadata: anthropicFallbackProviderMetadata(fallbackEvents),
         };
     } finally {
         if (idleTimer) clearTimeout(idleTimer);

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -8,7 +8,8 @@ import {
     anthropicMaxAttempts,
     anthropicRequestTimeoutMs,
     classifyError,
-    createStallRetryBudget,
+    markProviderRecoveryExhausted,
+    resolveStallRetryBudget,
     midstreamBackoffFor,
     sleepWithAbort,
     STREAM_STALL_RETRY_BUDGET_MS,
@@ -31,6 +32,8 @@ import {
     stampAnthropicStreamOutcome,
 } from './anthropic-sse.mjs';
 import { buildAnthropicBetaHeaders, supportsAnthropicFastMode } from './anthropic-betas.mjs';
+import { applyAnthropicServerFallback } from './anthropic-server-fallback.mjs';
+import { fastModeAvailable, noteFastModeCapacityError } from './anthropic-fast-mode.mjs';
 import {
     applyAnthropicEffortToBody,
     effortValuesForModel,
@@ -52,6 +55,7 @@ import {
     requestAnthropicTools as sharedRequestAnthropicTools,
     normalizeAnthropicNonStreamingResponse,
     resolveAnthropicCacheTtls as resolveCacheTtls,
+    resolveAnthropicMessageCacheSlots,
     sanitizeAnthropicInputSchema,
     toAnthropicToolChoice,
 } from './lib/anthropic-request-utils.mjs';
@@ -138,30 +142,16 @@ export class AnthropicProvider {
         // (cacheTier:'tier3') at ttls.tier3 — each its own system content block.
         const systemBlocks = buildSystemBlocks(systemMsgs, ttls.system, ttls.tier3);
 
-        // 4-BP budget: aligned with anthropic-oauth. tools BP is dropped —
-        // system BP covers the tools prefix via Anthropic prefix semantics
-        // (order: tools → system → messages). That frees 1 slot for
-        // messages-tail.
-        const toolsBpUsed = 0;
-        const systemBpUsed = systemBlocks.filter(b => b.cache_control).length;
-        const usedSlots = toolsBpUsed + systemBpUsed;
-        // Env override for BP strategy. ANTHROPIC_MSG_SLOTS=0 disables
-        // message caching entirely. Any value >=1 first marks the previous
-        // user text turn; a second free slot marks the tail.
-        const msgSlotsCap = Number.parseInt(process.env.ANTHROPIC_MSG_SLOTS, 10);
-        const defaultMsgSlots = Math.max(0, 4 - usedSlots);
-        const msgSlots = ttls.messages
-            ? (Number.isFinite(msgSlotsCap) && msgSlotsCap >= 0 ? Math.min(msgSlotsCap, defaultMsgSlots) : defaultMsgSlots)
-            : 0;
+        // Message-tail cache budget (4-BP layout + ANTHROPIC_MSG_SLOTS) is
+        // shared with anthropic-oauth — see resolveAnthropicMessageCacheSlots.
+        const messageCacheSlots = resolveAnthropicMessageCacheSlots(systemBlocks, ttls);
         // Build → sanitize (once, inside toAnthropicMessages) → mark. Markers
         // are applied to the FINAL sanitized array by invariant, so block
         // drops / inserts / reorders performed by the sanitizer can never move
         // or delete a marked block. NEVER sanitize again after this.
-        // msgSlots === 0 → message-tail disabled.
-        const tailTtl = msgSlots > 0 ? ttls.messages : null;
         const anthropicMessages = applyAnthropicCacheMarkers(
             toAnthropicMessages(chatMsgs),
-            { messageTtl: tailTtl, messageSlots: msgSlots },
+            messageCacheSlots,
         );
 
         const params = {
@@ -170,6 +160,9 @@ export class AnthropicProvider {
             system: systemBlocks.length ? systemBlocks : undefined,
             messages: anthropicMessages,
         };
+        applyAnthropicServerFallback(params, useModel, {
+            enabled: this.config?.disableBetaHeaders !== true && opts.serverFallback !== false,
+        });
         const requestTools = requestAnthropicTools(tools, chatMsgs, opts);
         if (requestTools.length) {
             // No cache_control on tools — the system BP covers tools via
@@ -201,7 +194,8 @@ export class AnthropicProvider {
             logTag: this.name,
         });
         // Fast mode → speed: "fast" on models Anthropic marks as speed-capable.
-        if (opts.fast === true && supportsAnthropicFastMode(useModel)) {
+        // Suppressed while the fast capacity pool is cooling down.
+        if (opts.fast === true && supportsAnthropicFastMode(useModel) && fastModeAvailable()) {
             params.speed = 'fast';
             this.fastModeBetaHeaderLatched = true;
         }
@@ -246,15 +240,28 @@ export class AnthropicProvider {
                     fastMode: this.fastModeBetaHeaderLatched,
                     toolSearch: hasDeferredTools,
                     effort: shouldIncludeEffortBeta(useModel, opts),
+                    serverFallback: params.fallbacks === 'default',
                 }),
             };
 
         const MAX_MIDSTREAM_RETRIES = ANTHROPIC_MAX_MIDSTREAM_RETRIES;
         let firstAttemptError = null;
         let firstAttemptClassifier = null;
-        // Send-scoped stall window: in-place stall retries share one wall
-        // clock starting at the first stall (see createStallRetryBudget).
-        const stallRetryBudget = createStallRetryBudget();
+        // Shared logical-send window: provider fallback and loop replay consume
+        // the same recovery budget.
+        const stallRetryBudget = resolveStallRetryBudget(opts);
+        const requireTransportRecoveryBudget = (error, controller) => {
+            if (stallRetryBudget.allowStallRetry()) return;
+            try {
+                process.stderr.write(
+                    `[${this.name}] transport recovery budget exhausted (${STREAM_STALL_RETRY_BUDGET_MS}ms since first failure)\n`,
+                );
+            } catch {}
+            try { controller?.abort?.(error); } catch {}
+            throw markProviderRecoveryExhausted(error, {
+                owner: `${this.name}-transport-budget`,
+            });
+        };
 
         const buildReturnFromParse = (parseResult) => {
             const usageRaw = parseResult.usage?.raw || null;
@@ -311,6 +318,9 @@ export class AnthropicProvider {
                 assistantBlocks: Array.isArray(parseResult.assistantBlocks) && parseResult.assistantBlocks.length
                     ? parseResult.assistantBlocks
                     : undefined,
+                ...(parseResult.providerMetadata && typeof parseResult.providerMetadata === 'object'
+                    ? { providerMetadata: parseResult.providerMetadata }
+                    : {}),
                 usage: {
                     inputTokens: input,
                     outputTokens: output,
@@ -356,6 +366,11 @@ export class AnthropicProvider {
                     },
                 );
                 return buildReturnFromParse(normalizeAnthropicNonStreamingResponse(message, useModel));
+            } catch (error) {
+                if (error instanceof AnthropicFallbackTriggeredError || totalSignal?.aborted) throw error;
+                throw markProviderRecoveryExhausted(error, {
+                    owner: `${this.name}-nonstreaming-fallback`,
+                });
             } finally {
                 lifetime.cleanup();
             }
@@ -379,6 +394,7 @@ export class AnthropicProvider {
                 try { streamingError.liveTextEmitted = true; streamingError.unsafeToRetry = true; } catch {}
                 throw streamingError;
             }
+            requireTransportRecoveryBudget(streamingError, streamController);
             return issueNonStreamingFallback(streamController, streamingError);
         };
 
@@ -469,6 +485,12 @@ export class AnthropicProvider {
                             model: useModel,
                             fallbackModel: opts._fallbackTriggered ? undefined : opts.fallbackModel,
                             onRetry: ({ attempt, lastErr, delayMs, delayReason }) => {
+                                // Long/unknown fast-pool window: replay at
+                                // standard speed rather than waiting it out.
+                                if (params?.speed === 'fast'
+                                    && noteFastModeCapacityError(lastErr, { fast: true }) !== 'retry-fast') {
+                                    delete params.speed;
+                                }
                                 const status = Number(lastErr?.httpStatus || lastErr?.status || lastErr?.response?.status || 0);
                                 if (status === 429) notifyCurrentAnthropicRateLimit(lastErr);
                                 const delayLabel = Number.isFinite(Number(delayMs))
@@ -628,17 +650,12 @@ export class AnthropicProvider {
                         && !midState.emittedToolCall
                         && !midState.partialToolCall
                         && !midState.emittedThinking) {
+                        requireTransportRecoveryBudget(err, streamController);
                         try { process.stderr.write(`[${this.name}] stream stalled with no exposure — retrying non-streaming\n`); } catch {}
                         return await issueNonStreamingFallback(streamController, err);
                     }
-                    if (classifier === 'stream_stalled' && !stallRetryBudget.allowStallRetry()) {
-                        try {
-                            process.stderr.write(
-                                `[${this.name}] stall retry budget exhausted (${STREAM_STALL_RETRY_BUDGET_MS}ms since first stall) — surfacing for fresh-request retry\n`,
-                            );
-                        } catch {}
-                        try { streamController.abort?.(err); } catch {}
-                        throw err;
+                    if (classifier === 'stream_stalled') {
+                        requireTransportRecoveryBudget(err, streamController);
                     }
                     if (classifier && attemptIndex < MAX_MIDSTREAM_RETRIES) {
                         firstAttemptError = err;
@@ -664,6 +681,12 @@ export class AnthropicProvider {
                         );
                         continue;
                     }
+                    if (classifier && attemptIndex >= MAX_MIDSTREAM_RETRIES) {
+                        markProviderRecoveryExhausted(err, {
+                            owner: `${this.name}-midstream`,
+                            attempts: attemptIndex + 1,
+                        });
+                    }
                     if (attemptIndex > 0 && firstAttemptError) {
                         try { err.midstreamRetries = attemptIndex; } catch {}
                         try { err.midstreamClassifier = firstAttemptClassifier; } catch {}

package/src/runtime/agent/orchestrator/providers/antigravity-oauth.mjs

@@ -86,6 +86,27 @@ function antigravityError(res, text, endpoint) {
     return err;
 }
 
+// Endpoint failover only makes sense when the HOST is the suspect. A
+// deterministic 4xx — malformed request, revoked/expired auth, permission
+// denial, unknown route — and a quota decision (429) are answers from the
+// account or the request itself: replaying them across every alternate host
+// repeats the identical rejection, hides the real error behind the last host's
+// message, and can duplicate an accepted-but-throttled generation. Only 5xx and
+// transport-level failures (status 0: DNS/connect/TLS/timeout) fail over.
+function antigravityFailoverEligible(err) {
+    if (err?.unsafeToRetry === true || err?.liveTextEmitted === true || err?.emittedToolCall === true) {
+        return false;
+    }
+    const status = Number(err?.status || err?.httpStatus || 0);
+    // Strictly 5xx or transport. status 0 means no HTTP response reached us at
+    // all (DNS/connect/TLS/first-byte timeout) — the only genuine "this host is
+    // the problem" evidence besides a server-side 5xx. ANY other answer,
+    // including a 3xx redirect the host chose to return, is that host's real
+    // reply and would be reproduced identically everywhere else.
+    if (status >= 500) return true;
+    return status === 0;
+}
+
 // A signed decimal derived from the first user turn, mirroring the real client.
 function deriveSessionId(contents) {
     const first = contents.find((c) => c?.role === 'user');
@@ -211,6 +232,9 @@ export class AntigravityOAuthProvider {
         const endpoints = this._endpointOrder();
         let lastErr = null;
         let response = null;
+        // One forced token refresh per send: a second 401 after a fresh token is
+        // a real authorization failure, not a stale bearer.
+        let refreshedAuth = false;
         try {
             for (let index = 0; index < endpoints.length; index += 1) {
                 const endpoint = endpoints[index];
@@ -275,10 +299,40 @@ export class AntigravityOAuthProvider {
                     break;
                 } catch (err) {
                     lastErr = err;
+                    const status = Number(err?.status || err?.httpStatus || 0);
+                    const emitted = err?.unsafeToRetry === true
+                        || err?.liveTextEmitted === true
+                        || err?.emittedToolCall === true;
+                    // A typed 401 says THIS access token is no longer accepted —
+                    // every host would reject it identically. Force one
+                    // credential refresh and replay the same endpoint instead of
+                    // failing over with the same dead token (and instead of
+                    // surfacing a re-login prompt for a token that only needed a
+                    // refresh). shouldRefresh() alone never covers this: a
+                    // server-side revocation/rotation happens while the local
+                    // expiry still looks valid.
+                    if (status === 401 && !emitted && !refreshedAuth) {
+                        refreshedAuth = true;
+                        let refreshed = null;
+                        try {
+                            refreshed = await this._ensureAuth({ fetchFn: this._fetch, force: true });
+                        } catch {
+                            // Refresh itself failed (revoked / no refresh token):
+                            // the original 401 is the actionable error.
+                            throw err;
+                        }
+                        // refreshTokens() preserves project_id/email, so only the
+                        // bearer changes; the already-serialized body stays valid.
+                        this._projectId = refreshed.projectId;
+                        headers.Authorization = `Bearer ${refreshed.accessToken}`;
+                        textLeakGuard = null;
+                        process.stderr.write('[antigravity] 401 — refreshed credentials and retrying once\n');
+                        index -= 1;
+                        continue;
+                    }
                     // Anything already streamed to the user must not be replayed on
                     // another endpoint, and a terminal decision is not transport luck.
-                    if (isLast || err?.unsafeToRetry === true || err?.liveTextEmitted === true
-                        || err?.emittedToolCall === true) {
+                    if (isLast || !antigravityFailoverEligible(err)) {
                         throw err;
                     }
                     process.stderr.write(`[antigravity] ${endpoint} failed (${err?.message || err}); trying next endpoint\n`);

package/src/runtime/agent/orchestrator/providers/cursor-auth.mjs

@@ -10,8 +10,30 @@ const LOGIN_URL = 'https://cursor.com/loginDeepControl';
 const POLL_URL = 'https://api2.cursor.sh/auth/poll';
 const REFRESH_URL = 'https://api2.cursor.sh/auth/exchange_user_api_key';
 const REFRESH_SKEW_MS = 5 * 60_000;
+// Upper bound for the SHARED token exchange. It replaces the first caller's
+// abort signal, which must never govern work every other waiter depends on.
+const REFRESH_TIMEOUT_MS = 30_000;
 let refreshInFlight = null;
 
+// Wait on the shared refresh while still honouring THIS caller's abort signal.
+// Aborting only ends this caller's wait; the exchange keeps running for the
+// remaining waiters and still publishes its result.
+function awaitSharedRefresh(promise, signal) {
+    if (!(signal instanceof AbortSignal)) return promise;
+    const abortError = () => (signal.reason instanceof Error
+        ? signal.reason
+        : new Error('Cursor token refresh wait aborted'));
+    if (signal.aborted) return Promise.reject(abortError());
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(abortError());
+        signal.addEventListener('abort', onAbort, { once: true });
+        promise.then(
+            (value) => { signal.removeEventListener('abort', onAbort); resolve(value); },
+            (err) => { signal.removeEventListener('abort', onAbort); reject(err); },
+        );
+    });
+}
+
 function credentialsPath() {
     const bound = boundProviderAuthPath('cursor-oauth');
     if (bound) return resolve(bound);
@@ -231,7 +253,15 @@ export async function resolveCursorOAuthAccessToken({ forceRefresh = false, fetc
             if (!latest.refresh_token) {
                 throw new Error('Cursor OAuth refresh token is unavailable. Open /providers in Mixdog to sign in again.');
             }
-            const next = await exchangeCursorToken(latest.refresh_token, { fetchFn, signal });
+            // Deliberately NOT the caller's signal: this exchange is shared by
+            // every concurrent waiter, so letting the first caller's abort
+            // (turn cancel / session close) kill it would fail the refresh for
+            // all of them and leave the process without a usable token. Its own
+            // timeout bounds the request instead.
+            const next = await exchangeCursorToken(latest.refresh_token, {
+                fetchFn,
+                signal: AbortSignal.timeout(REFRESH_TIMEOUT_MS),
+            });
             if (!process.env.CURSOR_ACCESS_TOKEN) {
                 saveCredentials(next);
             }
@@ -242,7 +272,9 @@ export async function resolveCursorOAuthAccessToken({ forceRefresh = false, fetc
             secret: true,
         })
             .finally(() => { refreshInFlight = null; });
+        // Every waiter may abandon its wait; keep the shared rejection observed.
+        refreshInFlight.catch(() => {});
     }
-    tokens = await refreshInFlight;
+    tokens = await awaitSharedRefresh(refreshInFlight, signal);
     return tokens.access_token;
 }

package/src/runtime/agent/orchestrator/providers/cursor-wire.mjs

@@ -117,7 +117,12 @@ function openCursorStream({ accessToken, path = RUN_PATH, url = API_URL }) {
         get alive() { return !closed; },
         write(bytes) {
             if (closed) return;
-            resetTimeout();
+            // Deliberately NOT resetTimeout(): frames written here (client
+            // heartbeat every 5s, tool results) are OUR traffic and say nothing
+            // about the server still being alive. Refreshing the deadline on
+            // every write let a silent server hold the connection open
+            // indefinitely, defeating the 120s silence bound this transport
+            // owns. Only 'response'/'data' from the server re-arm it.
             request.write(bytes);
         },
         close,
@@ -383,6 +388,56 @@ function storeActiveRun(key, active) {
     activeRuns.set(key, active);
 }
 
+// Tear down one stored run: drop it from the registry, stop its 5s heartbeat
+// interval, and close the Cursor bridge it was holding open.
+function closeActiveRun(key, active, error) {
+    if (!forgetActiveRun(key, active)) return false;
+    clearInterval(active.heartbeat);
+    try { active.bridge.close(error); } catch { /* already closing */ }
+    return true;
+}
+
+// A pending tool batch deliberately outlives its HTTP response: the bridge and
+// heartbeat stay up so the next request can resume the same Cursor run. That
+// connection belongs to the session that opened it, so a session close / turn
+// abort must reclaim it instead of leaving it connected until MEMORY_TTL_MS
+// (30 minutes) expires.
+export function closeCursorRunsForSession(sessionId, reason = 'session_closed') {
+    const scope = String(sessionId || '').trim();
+    if (!scope) return 0;
+    let closed = 0;
+    for (const [key, active] of [...activeRuns]) {
+        if (String(active?.sessionId || '') !== scope) continue;
+        if (closeActiveRun(key, active, new Error(`Cursor run closed (${reason})`))) closed += 1;
+    }
+    return closed;
+}
+
+// Process-wide drain (shutdown / exit): no run may keep the daemon's Cursor
+// sockets and heartbeat intervals alive past teardown.
+export function drainCursorRuns(reason = 'shutdown') {
+    let closed = 0;
+    for (const [key, active] of [...activeRuns]) {
+        if (closeActiveRun(key, active, new Error(`Cursor run drained (${reason})`))) closed += 1;
+    }
+    return closed;
+}
+
+// Session-close / drain hooks. Both globals are shared with the openai WS pool,
+// so chain the previously registered handler instead of overwriting it: whoever
+// loads first stays reachable, in either import order.
+const _priorCursorSessionCloseHook = globalThis.__mixdogCloseProviderConnectionsForSession;
+globalThis.__mixdogCloseProviderConnectionsForSession = (sessionId, reason) => {
+    try { _priorCursorSessionCloseHook?.(sessionId, reason); } finally {
+        closeCursorRunsForSession(sessionId, reason);
+    }
+};
+const _priorCursorDrainHook = globalThis.__mixdogDrainProviderConnections;
+globalThis.__mixdogDrainProviderConnections = (reason) => {
+    try { _priorCursorDrainHook?.(reason); } finally { drainCursorRuns(reason); }
+};
+process.on('exit', () => { drainCursorRuns('process-exit'); });
+
 function conversationKey(messages, sessionId = '') {
     const scope = String(sessionId || '').trim();
     if (scope) {
@@ -889,6 +944,9 @@ function createStreamResponse({
     cloudRule,
     model,
     key,
+    // Owning session, carried into the stored run so a session close can find
+    // and tear down the pending batch's bridge/heartbeat.
+    sessionId = '',
     sawTurnEnded = false,
 }) {
     const id = `chatcmpl-${crypto.randomUUID().replaceAll('-', '').slice(0, 28)}`;
@@ -944,6 +1002,7 @@ function createStreamResponse({
                     conversation,
                     tools,
                     cloudRule,
+                    sessionId,
                     pending: state.pending,
                     sawTurnEnded: state.sawTurnEnded,
                 });
@@ -1183,6 +1242,7 @@ export async function handleChatCompletion(body, accessToken) {
         cloudRule: parsed.systems.join('\n\n') || undefined,
         model,
         key,
+        sessionId,
     });
 }
 

package/src/runtime/agent/orchestrator/providers/gemini-stream.mjs

@@ -447,7 +447,6 @@ export async function consumeGeminiRestStreamResponse(response, { signal, onStre
             }
             const { done, value } = chunk;
             if (done) break;
-            resetIdleTimer();
             buffer += decoder.decode(value, { stream: true });
             const payloads = [];
             let lineEnd;
@@ -483,6 +482,12 @@ export async function consumeGeminiRestStreamResponse(response, { signal, onStre
                     relayedText += relayGeminiStreamText(t, { onTextDelta, textLeakGuard });
                 }
             }
+            // Re-arm on SEMANTIC progress only. A decoded SSE payload is real
+            // generation output; raw byte chunks (a partial data: line, blank
+            // keepalive lines, proxy padding) are not. Resetting on every read
+            // let a stalled generation that still dribbles bytes hold the idle
+            // watchdog off indefinitely.
+            if (parsedChunks.length) resetIdleTimer();
         }
         if (buffer.trim()) {
             const line = buffer.trim().replace(/\r$/, '');