mixdog 0.9.174 → 1.0.0

package/src/runtime/agent/orchestrator/providers/gemini-schema.mjs

@@ -9,6 +9,11 @@ import { normalizeContentForGeminiParts, splitToolContentForGemini } from './med
 import { providerReplayItems } from './lib/provider-replay.mjs';
 import { ensureGeminiToolCallSignatures } from './gemini-history-signatures.mjs';
 
+// Bounds on persisted provider metadata replayed back into the prompt.
+const MAX_THOUGHT_SIGNATURE_CHARS = 16_384;
+const MAX_REPLAY_TEXT_CHARS = 1_000_000;
+const MAX_REPLAY_PARTS = 128;
+
 function explicitGeminiMediaPart(part) {
   if (!part || typeof part !== 'object') return null;
   const inline = part.inlineData || part.inline_data;
@@ -120,12 +125,6 @@ function toSchemaType(t) {
   return map[t] ?? SchemaType.STRING;
 }
 
-/**
- * Recursively convert a JSON Schema object to Gemini's FunctionDeclarationSchema.
- * Gemini requires `type` to be a SchemaType enum, not a plain string, and
- * accepts only a documented subset of JSON Schema. Project onto that subset
- * at every level and convert `const` into Gemini's string enum form.
- */
 const GEMINI_SCHEMA_FIELDS = new Set([
   'type',
   'format',
@@ -364,6 +363,12 @@ function flattenAllOf(input) {
   return { schema, hadAllOf };
 }
 
+/**
+ * Recursively convert a JSON Schema object to Gemini's FunctionDeclarationSchema.
+ * Gemini requires `type` to be a SchemaType enum, not a plain string, and
+ * accepts only a documented subset of JSON Schema. Project onto that subset
+ * at every level and convert `const` into Gemini's string enum form.
+ */
 function convertSchema(schema) {
   if (!schema || typeof schema !== 'object') return schema;
   const flattened = flattenAllOf(schema);
@@ -377,13 +382,10 @@ function convertSchema(schema) {
     if (!GEMINI_SCHEMA_FIELDS.has(k)) continue;
     result[k] = v;
   }
-  // Gemini's Schema validator requires every `enum` entry to be a string.
-  // An unrepresentable typed enum must become an explicit conflict schema;
-  // dropping it would broaden the accepted tool arguments.
-  // Gemini's schema dialect represents JSON Schema null unions with
-  // `nullable`, not a type array.
   if (result.type === undefined && (result.properties || result.required)) result.type = 'object';
   if (result.type === undefined && result.items) result.type = 'array';
+  // Gemini's schema dialect represents JSON Schema null unions with
+  // `nullable`, not a type array.
   const normalizedType = typeInfo(result);
   if (normalizedType.conflict) return schemaFallback(normalizedType.conflict);
   const rawType = normalizedType.type || undefined;
@@ -391,6 +393,9 @@ function convertSchema(schema) {
   else delete result.type;
   if (normalizedType.allowsNull && rawType) result.nullable = true;
   else if (result.nullable !== true) delete result.nullable;
+  // Gemini's Schema validator requires every `enum` entry to be a string.
+  // An unrepresentable typed enum must become an explicit conflict schema;
+  // dropping it would broaden the accepted tool arguments.
   const localEnum = enumValues(result);
   if (localEnum.conflict) return schemaFallback(localEnum.conflict);
   if (result.const !== undefined) {
@@ -504,34 +509,21 @@ function projectUnionBranches(result) {
   if (!result.anyOf.length) delete result.anyOf;
 }
 
+const TYPE_SPECIFIC_KEYWORDS = {
+  string: new Set(['minLength', 'maxLength', 'pattern', 'format']),
+  array: new Set(['minItems', 'maxItems', 'items']),
+  object: new Set(['minProperties', 'maxProperties', 'properties', 'required', 'propertyOrdering']),
+  number: new Set(['minimum', 'maximum']),
+  integer: new Set(['minimum', 'maximum']),
+};
+const ALL_TYPE_SPECIFIC_KEYWORDS = new Set(Object.values(TYPE_SPECIFIC_KEYWORDS).flatMap((set) => [...set]));
+
 /** Drop every keyword that does not belong to the resolved type, then sanity
  *  the surviving min/max pairs. Returns a conflict schema for an empty range,
  *  else null (the caller keeps `result`). */
 function pruneTypeSpecificKeywords(result, rawType) {
-  const typeSpecific = {
-    string: new Set(['minLength', 'maxLength', 'pattern', 'format']),
-    array: new Set(['minItems', 'maxItems', 'items']),
-    object: new Set(['minProperties', 'maxProperties', 'properties', 'required', 'propertyOrdering']),
-    number: new Set(['minimum', 'maximum']),
-    integer: new Set(['minimum', 'maximum']),
-  };
-  for (const key of [
-    'minLength',
-    'maxLength',
-    'pattern',
-    'format',
-    'minItems',
-    'maxItems',
-    'items',
-    'minProperties',
-    'maxProperties',
-    'properties',
-    'required',
-    'propertyOrdering',
-    'minimum',
-    'maximum',
-  ]) {
-    if (!typeSpecific[rawType]?.has(key)) delete result[key];
+  for (const key of ALL_TYPE_SPECIFIC_KEYWORDS) {
+    if (!TYPE_SPECIFIC_KEYWORDS[rawType]?.has(key)) delete result[key];
   }
   for (const [minKey, maxKey] of [
     ['minLength', 'maxLength'],
@@ -586,6 +578,7 @@ export function toGeminiTools(tools) {
     })),
   };
 }
+
 export function toGeminiNativeTools(nativeTools) {
   if (!Array.isArray(nativeTools)) return [];
   const out = [];
@@ -667,7 +660,7 @@ function toGeminiToolContent(message, toolNameByCallId, capabilities) {
   };
 }
 
-function toGeminiContent(message, _toolNameByCallId, capabilities) {
+function toGeminiContent(message, capabilities) {
   if (!message || message.role === 'system') return null;
   const orderedReplay =
     message.role === 'assistant' ? providerReplayItems(message, ['gemini', 'antigravity']) : undefined;
@@ -692,7 +685,11 @@ function toGeminiContent(message, _toolNameByCallId, capabilities) {
           ...(capabilities.functionPartIds && typeof tc.id === 'string' && tc.id ? { id: tc.id } : {}),
         },
       };
-      if (typeof tc.thoughtSignature === 'string' && tc.thoughtSignature && tc.thoughtSignature.length <= 16_384) {
+      if (
+        typeof tc.thoughtSignature === 'string' &&
+        tc.thoughtSignature &&
+        tc.thoughtSignature.length <= MAX_THOUGHT_SIGNATURE_CHARS
+      ) {
         part.thoughtSignature = tc.thoughtSignature;
       }
       parts.push(part);
@@ -711,13 +708,18 @@ function toGeminiContent(message, _toolNameByCallId, capabilities) {
 
 function geminiTextPartsFromMetadata(message) {
   const parts = message?.providerMetadata?.gemini?.textParts;
-  if (!Array.isArray(parts) || !parts.length || parts.length > 128) return null;
+  if (!Array.isArray(parts) || !parts.length || parts.length > MAX_REPLAY_PARTS) return null;
   const normalized = [];
   for (const part of parts) {
-    if (!part || typeof part !== 'object' || typeof part.text !== 'string' || part.text.length > 1_000_000) return null;
+    if (!part || typeof part !== 'object' || typeof part.text !== 'string' || part.text.length > MAX_REPLAY_TEXT_CHARS)
+      return null;
     const next = { text: part.text };
     if (part.thoughtSignature !== undefined) {
-      if (typeof part.thoughtSignature !== 'string' || !part.thoughtSignature || part.thoughtSignature.length > 16_384)
+      if (
+        typeof part.thoughtSignature !== 'string' ||
+        !part.thoughtSignature ||
+        part.thoughtSignature.length > MAX_THOUGHT_SIGNATURE_CHARS
+      )
         return null;
       next.thoughtSignature = part.thoughtSignature;
     }
@@ -729,7 +731,7 @@ function geminiTextPartsFromMetadata(message) {
 
 function geminiThoughtPartsFromMetadata(message) {
   const parts = message?.providerMetadata?.gemini?.thoughtParts;
-  if (!Array.isArray(parts) || !parts.length || parts.length > 128) return [];
+  if (!Array.isArray(parts) || !parts.length || parts.length > MAX_REPLAY_PARTS) return [];
   const normalized = [];
   for (const part of parts) {
     // Hidden prompt content is replayable only when every persisted part is
@@ -739,10 +741,10 @@ function geminiThoughtPartsFromMetadata(message) {
       !part ||
       typeof part !== 'object' ||
       typeof part.text !== 'string' ||
-      part.text.length > 1_000_000 ||
+      part.text.length > MAX_REPLAY_TEXT_CHARS ||
       typeof part.thoughtSignature !== 'string' ||
       !part.thoughtSignature ||
-      part.thoughtSignature.length > 16_384
+      part.thoughtSignature.length > MAX_THOUGHT_SIGNATURE_CHARS
     )
       return [];
     normalized.push({
@@ -791,7 +793,7 @@ export function toGeminiContents(messages, model = '', { repairToolSignatures =
       continue;
     }
     flushToolMedia();
-    const content = toGeminiContent(message, toolNameByCallId, capabilities);
+    const content = toGeminiContent(message, capabilities);
     if (content) contents.push(content);
   }
   flushToolMedia();
@@ -801,7 +803,7 @@ export function toGeminiContents(messages, model = '', { repairToolSignatures =
 function signedTextPart(part) {
   const out = { text: part.text };
   const signature = part.thoughtSignature || part.thought_signature;
-  if (typeof signature === 'string' && signature && signature.length <= 16_384) {
+  if (typeof signature === 'string' && signature && signature.length <= MAX_THOUGHT_SIGNATURE_CHARS) {
     out.thoughtSignature = signature;
   }
   return out;
@@ -864,7 +866,7 @@ export function parseToolCalls(parts) {
       // replay and anonymous ID inputs independent of that working copy.
       arguments: structuredClone(fc.args ?? {}),
     };
-    if (typeof sig === 'string' && sig && sig.length <= 16_384) {
+    if (typeof sig === 'string' && sig && sig.length <= MAX_THOUGHT_SIGNATURE_CHARS) {
       call.thoughtSignature = sig;
     }
     return call;

package/src/runtime/agent/orchestrator/providers/gemini-stream.mjs

@@ -16,7 +16,7 @@ import {
   providerTimeoutError,
   resolveTimeoutMs,
 } from '../stall-policy.mjs';
-import { knownToolNameSet, scanLeakedToolCalls, toolCallFingerprint } from './anthropic-leaked-toolcall.mjs';
+import { knownToolNameSet, scanLeakedToolCalls, toolCallFingerprint } from './lib/leaked-toolcall.mjs';
 import { traceHash, stableTraceStringify } from './trace-utils.mjs';
 import { parseGeminiTextPartMetadata } from './gemini-schema.mjs';
 import { parseProviderJsonBatch } from './stream-json-pool.mjs';
@@ -388,7 +388,7 @@ export function createGeminiTextLeakGuard({ knownToolNames, onTextDelta, onToolC
       return kept.length ? kept : undefined;
     },
     getLeakedToolCalls() {
-      return leakedCalls.length ? [...leakedCalls] : [];
+      return [...leakedCalls];
     },
     getRelayedText() {
       return relayedText;
@@ -396,6 +396,19 @@ export function createGeminiTextLeakGuard({ knownToolNames, onTextDelta, onToolC
   };
 }
 
+// Finalizes the guard at most once; both stream consumers reach it from
+// their failure and cleanup paths.
+function createLeakGuardFinalizer(textLeakGuard) {
+  let finalized = false;
+  return () => {
+    if (finalized) return;
+    finalized = true;
+    try {
+      textLeakGuard?.finalize();
+    } catch {}
+  };
+}
+
 // `unwrapChunk` adapts a transport that nests the Gemini payload one level
 // deeper. Cloud Code Assist (Antigravity) streams `{ response: { candidates … } }`
 // while the public API streams the candidates directly; everything downstream —
@@ -421,14 +434,7 @@ export async function consumeGeminiRestStreamResponse(
   const allChunks = [];
   let sawStreamChunk = false;
   let relayedText = '';
-  let leakGuardFinalized = false;
-  const finalizeLeakGuard = () => {
-    if (leakGuardFinalized) return;
-    leakGuardFinalized = true;
-    try {
-      textLeakGuard?.finalize();
-    } catch {}
-  };
+  const finalizeLeakGuard = createLeakGuardFinalizer(textLeakGuard);
   const watchdogs = createRestStreamWatchdogs({
     reader,
     label,
@@ -554,14 +560,7 @@ export async function consumeGeminiSdkStream(
   }
 ) {
   let relayedText = '';
-  let leakGuardFinalized = false;
-  const finalizeLeakGuard = () => {
-    if (leakGuardFinalized) return;
-    leakGuardFinalized = true;
-    try {
-      textLeakGuard?.finalize();
-    } catch {}
-  };
+  const finalizeLeakGuard = createLeakGuardFinalizer(textLeakGuard);
 
   const cancellation = createSdkStreamCancellation({ signal, label, cancelGeneration, cancellationGraceMs });
   const { abortError } = cancellation;
@@ -647,7 +646,7 @@ export async function consumeGeminiSdkStream(
     throw stampGeminiStreamFailure(failure, { relayedText, textLeakGuard, chunks: collectedChunks });
   } finally {
     reader?.stop();
-    if (signal && onSignalAbort) {
+    if (signal) {
       try {
         signal.removeEventListener('abort', onSignalAbort);
       } catch {}

package/src/runtime/agent/orchestrator/providers/gemini.mjs

@@ -1,7 +1,7 @@
 import { GoogleGenerativeAI } from '@google/generative-ai';
 import { getAgentApiKey } from '../../../shared/provider-api-key.mjs';
 import { canFallbackNonStreaming, emitProviderRetryStage, withRetry } from './retry-classifier.mjs';
-import { appendAgentTrace } from '../agent-trace.mjs';
+import { traceNonStreamingFallback } from './lib/transport-fallback-trace.mjs';
 import {
   PROVIDER_CACHE_CREATE_TIMEOUT_MS,
   PROVIDER_CACHE_CREATE_TOTAL_TIMEOUT_MS,
@@ -189,11 +189,7 @@ export class GeminiProvider {
     if (!canFallbackNonStreaming(streamErr, { signal })) return null;
     let aggregated;
     try {
-      try {
-        opts?.onStageChange?.('requesting');
-      } catch {
-        /* heartbeat best-effort */
-      }
+      signalRequesting(opts);
       aggregated = await generate(signal || undefined);
     } catch {
       return null;
@@ -209,26 +205,7 @@ export class GeminiProvider {
     } catch {
       /* best-effort */
     }
-    try {
-      appendAgentTrace({
-        sessionId: opts?.sessionId || opts?.session?.id || null,
-        iteration: Number.isFinite(Number(opts?.iteration)) ? Number(opts.iteration) : null,
-        kind: 'transport_fallback',
-        provider: 'gemini',
-        model,
-        transport: 'non-streaming',
-        payload: {
-          from: 'stream',
-          to: 'non-streaming',
-          reason: streamErr?.retryClassifier || streamErr?.code || streamErr?.message || 'stream_failed',
-          error_code: streamErr?.code || null,
-          error_http_status: Number(streamErr?.httpStatus || streamErr?.status || 0) || null,
-          error_classifier: streamErr?.retryClassifier || streamErr?.midstreamClassifier || null,
-        },
-      });
-    } catch {
-      /* best-effort */
-    }
+    traceNonStreamingFallback({ provider: 'gemini', model, opts, streamErr });
     return aggregated;
   }
 

package/src/runtime/agent/orchestrator/providers/grok-client-version.mjs

@@ -0,0 +1,41 @@
+import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
+
+// Grok CLI client version for the cli-chat-proxy version gate (HTTP 426).
+// Effective = env override, else max(floor, learned-from-426, live npm latest
+// of the official @xai-official/grok CLI).
+export const GROK_CLI_VERSION_FLOOR = '0.2.87';
+
+const live = createNpmVersionSource('@xai-official/grok');
+let envVersion;
+let learned = null;
+
+function envOverride() {
+  if (envVersion === undefined) envVersion = String(process.env.MIXDOG_GROK_CLIENT_VERSION || '').trim();
+  return envVersion;
+}
+
+/** Sync, never blocks: the version proxy/usage requests must send. */
+export function grokCliVersion() {
+  return envOverride() || maxSemver(GROK_CLI_VERSION_FLOOR, learned, live.sync());
+}
+
+/** Await before the first proxy/usage call so a cold start never sends the floor. */
+export async function warmGrokCliVersion() {
+  if (!envOverride()) await live.warm();
+}
+
+/** Learn a minimum stated in a 426 body; returns true when it raised the version. */
+export function learnGrokRequiredVersion(text) {
+  const m = String(text || '').match(/(?:minimum|required|at least|>=|newer than|upgrade to)\D{0,40}?(\d+\.\d+\.\d+)/i);
+  const required = m && maxSemver(m[1]);
+  if (!required || envOverride()) return false;
+  const before = grokCliVersion();
+  if (maxSemver(before, required) === before) return false;
+  learned = required;
+  return true;
+}
+
+export function grokClientVersionHeaders() {
+  const v = grokCliVersion();
+  return { 'x-grok-client-version': v, 'User-Agent': `xai-grok-build/${v}` };
+}

package/src/runtime/agent/orchestrator/providers/grok-oauth-login.mjs

@@ -1,24 +1,9 @@
-// Grok OAuth browser login + PKCE exchange.
-/**
- * Grok CLI OAuth provider ("Grok Build").
- *
- * Authenticates against xAI's shared OAuth client via PKCE (discovery at
- * https://auth.x.ai/.well-known/openid-configuration). Credentials come from
- * Mixdog's own token store (grok-oauth.json).
- *
- * Every OAuth inference request routes through cli-chat-proxy.grok.com/v1,
- * matching Grok Build's session-auth contract. Model discovery still merges
- * api.x.ai and proxy catalogs because each publishes a different subset.
- *
- * Inference is delegated to an inner OpenAICompatProvider('xai') — the only
- * preset wired for the Responses API — with the proxy URL + CLI headers
- * injected via config.extraHeaders, bearer swapped for the OAuth access token.
- */
+// Grok OAuth browser login + PKCE exchange against xAI's shared OAuth client
+// (the consent screen renders it as "Grok Build").
 import { createServer } from 'node:http';
 import { randomBytes } from 'node:crypto';
+import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
 import { createOAuthPkce, parseOAuthCodeInput } from './lib/oauth-pkce.mjs';
-
-// xAI's shared OAuth client. The consent screen renders this as "Grok Build".
 import {
   CLIENT_ID,
   SCOPE,
@@ -61,6 +46,7 @@ export async function exchangeAuthorizationCode({ discovery, pkce, code }) {
     // redirects so they can't be replayed to an untrusted host.
     redirect: 'error',
     signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
+    dispatcher: getLlmDispatcher(),
   });
   if (!tokenRes.ok) {
     const text = await tokenRes.text().catch(() => '');
@@ -128,9 +114,9 @@ export async function beginOAuthLogin() {
       }
       const code = u.searchParams.get('code');
       if (!code || u.searchParams.get('state') !== state) {
+        // Reject this request only; the valid callback may still arrive.
         res.writeHead(400);
         res.end('Invalid');
-        finish(null);
         return;
       }
       res.writeHead(200, { 'Content-Type': 'text/html' });

package/src/runtime/agent/orchestrator/providers/grok-oauth-tokens.mjs

@@ -1,19 +1,6 @@
-// Grok OAuth discovery, token storage/refresh, and proxy identity.
-/**
- * Grok CLI OAuth provider ("Grok Build").
- *
- * Authenticates against xAI's shared OAuth client via PKCE (discovery at
- * https://auth.x.ai/.well-known/openid-configuration). Credentials come from
- * Mixdog's own token store (grok-oauth.json).
- *
- * Every OAuth inference request routes through cli-chat-proxy.grok.com/v1,
- * matching Grok Build's session-auth contract. Model discovery still merges
- * api.x.ai and proxy catalogs because each publishes a different subset.
- *
- * Inference is delegated to an inner OpenAICompatProvider('xai') — the only
- * preset wired for the Responses API — with the proxy URL + CLI headers
- * injected via config.extraHeaders, bearer swapped for the OAuth access token.
- */
+// Grok OAuth discovery, token storage/refresh, and proxy identity. Discovery
+// is at https://auth.x.ai/.well-known/openid-configuration; credentials live
+// in Mixdog's own token store (grok-oauth.json).
 import { randomUUID } from 'node:crypto';
 import { readFileSync, existsSync, mkdirSync, statSync, unlinkSync } from 'node:fs';
 import { join, resolve } from 'node:path';
@@ -22,10 +9,16 @@ import { writeJsonAtomicSync, withFileLock } from '../../../shared/atomic-file.m
 import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
 import { createTimeoutSignal } from '../stall-policy.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
-import { decodeJwtPayload, expiryFromAccessToken, scrubOAuthSecrets } from './lib/oauth-token-utils.mjs';
+import { grokClientVersionHeaders } from './grok-client-version.mjs';
+import {
+  decodeJwtPayload,
+  expiryFromAccessToken,
+  normalizeExpiresAtMs as _normalizeExpiresAt,
+  oauthCredentialStatus,
+  scrubOAuthSecrets,
+} from './lib/oauth-token-utils.mjs';
 
 // xAI's shared OAuth client. The consent screen renders this as "Grok Build".
-
 export const CLIENT_ID = 'b1a00492-073a-47ea-816f-4c329264a828';
 const ISSUER = 'https://auth.x.ai';
 const DISCOVERY_URL = `${ISSUER}/.well-known/openid-configuration`;
@@ -47,25 +40,16 @@ export const TOKEN_REFRESH_SKEW_MS = 5 * 60_000;
 // OAuth models route here for inference, including api.x.ai-discovered ones.
 export const PROXY_BASE_URL = 'https://cli-chat-proxy.grok.com/v1';
 const GROK_CLIENT_IDENTIFIER = 'grok-shell';
-const GROK_CLI_VERSION_FALLBACK = '0.2.16';
-
-// Use a Mixdog-controlled client version for the proxy version gate.
-let _grokCliVersionCache = null;
-function grokCliVersion() {
-  if (_grokCliVersionCache) return _grokCliVersionCache;
-  _grokCliVersionCache = String(process.env.MIXDOG_GROK_CLIENT_VERSION || '').trim() || GROK_CLI_VERSION_FALLBACK;
-  return _grokCliVersionCache;
-}
 
 // Headers the Grok CLI sends to clear the proxy version gate — extracted from
 // the grok binary: x-grok-client-version (the actual 426 gate),
 // x-grok-client-identifier, and a matching User-Agent.
 export function proxyHeaders({ model, sendOpts, userId } = {}) {
-  const v = grokCliVersion();
+  const { 'x-grok-client-version': v, 'User-Agent': userAgent } = grokClientVersionHeaders();
   const headers = {
     'x-grok-client-version': v,
     'x-grok-client-identifier': GROK_CLIENT_IDENTIFIER,
-    'User-Agent': `xai-grok-build/${v}`,
+    'User-Agent': userAgent,
   };
   const sessionId = String(sendOpts?.sessionId || sendOpts?.session?.id || '').trim();
   const requestId = String(sendOpts?.requestId || '').trim() || (sendOpts ? randomUUID() : '');
@@ -93,7 +77,7 @@ export function resolveGrokOAuthResponsesTransport() {
 // catalog surfaces the coding model as grok-build-0.1; map the legacy ids to
 // it so a stale config selection doesn't hit a model-not-found. Exact table,
 // not a heuristic.
-export { normalizeGrokModelId } from './provider-model-identities.mjs';
+export { normalizeGrokModelId } from '../../../shared/llm/provider-model-identities.mjs';
 export const MODEL_CACHE_TTL_MS = 24 * 60 * 60_000;
 // Bump when the on-disk cache shape changes so stale-shape entries are
 // discarded instead of misread.
@@ -162,17 +146,7 @@ export function getRefreshLockPath() {
   return `${getOwnTokenPath()}.refresh.lock`;
 }
 
-// expires_at may arrive as a unix number or an ISO-8601 string. Normalize both
-// to epoch milliseconds; 0 means unknown.
-export function _normalizeExpiresAt(value) {
-  if (typeof value === 'string') {
-    const ms = Date.parse(value);
-    return Number.isFinite(ms) ? ms : 0;
-  }
-  const n = Number(value || 0);
-  if (!Number.isFinite(n) || n <= 0) return 0;
-  return n < 1e12 ? n * 1000 : n;
-}
+export { _normalizeExpiresAt };
 
 export function _identityFromAccessToken(token) {
   const payload = decodeJwtPayload(token);
@@ -276,49 +250,8 @@ export function describeGrokOAuthCredentials() {
     }
     const hasRefresh = Boolean(tokens.refresh_token);
     const expiresAt = _normalizeExpiresAt(tokens.expires_at);
-    const expiring = expiresAt > 0 && expiresAt < Date.now() + TOKEN_REFRESH_SKEW_MS;
-    const expired = expiresAt > 0 && expiresAt <= Date.now();
     const detail = tokens.source === 'own' ? 'Mixdog token store' : tokens.source || 'oauth';
-    if (!hasRefresh) {
-      return {
-        authenticated: expiresAt === 0 || !expired,
-        usable: expiresAt === 0 || !expired,
-        refreshable: false,
-        reauthRequired: expired,
-        status: expired ? 'Reauth Required' : 'Access Only',
-        detail: `${detail}; no refresh token`,
-        expiresAt,
-      };
-    }
-    if (expired)
-      return {
-        authenticated: true,
-        usable: false,
-        refreshable: true,
-        reauthRequired: false,
-        status: 'Refresh Required',
-        detail,
-        expiresAt,
-      };
-    if (expiring)
-      return {
-        authenticated: true,
-        usable: true,
-        refreshable: true,
-        reauthRequired: false,
-        status: 'Refresh Soon',
-        detail,
-        expiresAt,
-      };
-    return {
-      authenticated: true,
-      usable: true,
-      refreshable: true,
-      reauthRequired: false,
-      status: 'Valid',
-      detail,
-      expiresAt,
-    };
+    return oauthCredentialStatus({ hasRefresh, expiresAt, detail, refreshSkewMs: TOKEN_REFRESH_SKEW_MS });
   } catch (err) {
     return {
       authenticated: false,

package/src/runtime/agent/orchestrator/providers/grok-oauth.mjs

@@ -21,7 +21,6 @@ import { createTimeoutSignal } from '../stall-policy.mjs';
 import { getLlmDispatcher, preconnect } from '../../../shared/llm/http-agent.mjs';
 import { normalizeGrokToolSchemas } from './lib/grok-tool-schema.mjs';
 
-// xAI's shared OAuth client. The consent screen renders this as "Grok Build".
 import {
   INFERENCE_BASE_URL,
   TOKEN_REFRESH_SKEW_MS,
@@ -39,6 +38,7 @@ import {
   _setRefreshInFlight,
   refreshTokens,
 } from './grok-oauth-tokens.mjs';
+import { learnGrokRequiredVersion, warmGrokCliVersion } from './grok-client-version.mjs';
 export {
   hasGrokOAuthCredentials,
   describeGrokOAuthCredentials,
@@ -223,12 +223,17 @@ function _isDatedGrokChatModel(m) {
   return Boolean(m?.id) && !NON_CHAT_MODEL_RE.test(m.id) && Number(m.created) > 0;
 }
 
-function _markLatestGrok(models) {
+function _newestDatedGrokChatModel(models) {
   let best = null;
   for (const m of models) {
     if (!_isDatedGrokChatModel(m)) continue;
     if (!best || Number(m.created) > Number(best.created)) best = m;
   }
+  return best;
+}
+
+function _markLatestGrok(models) {
+  const best = _newestDatedGrokChatModel(models);
   if (best) best.latest = true;
 }
 
@@ -239,12 +244,7 @@ function _markLatestGrok(models) {
 function resolveLatestGrokModel() {
   const cached = _modelCache.loadSync();
   if (!Array.isArray(cached)) return null;
-  let best = null;
-  for (const m of cached) {
-    if (!_isDatedGrokChatModel(m)) continue;
-    if (!best || Number(m.created) > Number(best.created)) best = m;
-  }
-  return best?.id || null;
+  return _newestDatedGrokChatModel(cached)?.id || null;
 }
 
 async function ensureLatestGrokModel(provider) {
@@ -384,6 +384,7 @@ export class GrokOAuthProvider {
     }
     const useModel = normalizeGrokModelId(model || (await ensureLatestGrokModel(this)));
     const tokens = await this.ensureAuth();
+    await warmGrokCliVersion();
     const requestHeaders = proxyHeaders({
       model: useModel,
       sendOpts,
@@ -413,6 +414,22 @@ export class GrokOAuthProvider {
       // TYPED status only: a rejection whose only evidence is message
       // text is never treated as an auth failure worth re-issuing.
       const rejectedStatus = Number(err?.httpStatus || err?.status);
+      // 426 = client version gate. Retry once only when the body stated a
+      // minimum we did not already satisfy; nothing was emitted before it.
+      if (
+        rejectedStatus === 426 &&
+        err.liveTextEmitted !== true &&
+        err.emittedToolCall !== true &&
+        learnGrokRequiredVersion(err?.message)
+      ) {
+        const upgraded = proxyHeaders({ model: useModel, sendOpts, userId: tokens.user_id });
+        return await this._ensureInner(tokens.access_token, useModel, upgraded)._doSend(
+          messages,
+          useModel,
+          grokTools,
+          sendOpts
+        );
+      }
       if (rejectedStatus === 401 || rejectedStatus === 403) {
         // A stream-level rejection after text/tool dispatch cannot be safely
         // replayed: the client has already observed output or may have
@@ -467,6 +484,7 @@ export class GrokOAuthProvider {
     }
     const timeout = createTimeoutSignal(null, 10_000, 'grok-oauth proxy model list');
     try {
+      await warmGrokCliVersion();
       const res = await fetch(`${PROXY_BASE_URL}/models`, {
         method: 'GET',
         headers: { Authorization: `Bearer ${tokens.access_token}`, ...proxyHeaders() },

package/src/runtime/agent/orchestrator/providers/lib/anthropic-models.mjs

@@ -0,0 +1,8 @@
+// Offline fallback for both Anthropic routes when /v1/models is unavailable:
+// the current generation only, one id per family.
+export const MODELS = [
+  { id: 'claude-opus-5-5', name: 'Claude Opus 5.5', provider: 'anthropic', family: 'opus', contextWindow: 1000000 },
+  { id: 'claude-fable-5-1', name: 'Claude Fable 5.1', provider: 'anthropic', family: 'fable', contextWindow: 1000000 },
+  { id: 'claude-sonnet-5', name: 'Claude Sonnet 5', provider: 'anthropic', family: 'sonnet', contextWindow: 1000000 },
+];
+export const ANTHROPIC_VERSION = '2023-06-01';