mixdog 0.9.2 → 0.9.4

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -22,6 +22,9 @@ import {
 } from './anthropic-effort.mjs';
 import { normalizeContentForAnthropic } from './media-normalization.mjs';
 import { enrichModels } from './model-catalog.mjs';
+import { sanitizeModelList } from './model-list-sanitize.mjs';
+import { makeModelCache } from './model-cache.mjs';
+import { resolveAnthropicMaxTokens } from './anthropic-max-tokens.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
 
 const require = createRequire(import.meta.url);
@@ -79,12 +82,30 @@ function resolveCacheTtls(opts) {
         if (v === 'none') return null;
         return fallback;
     };
-    return {
+    const resolved = {
         tools: pick('tools', null),
         system: pick('system', CACHE_TTL_STABLE),
         tier3: pick('tier3', CACHE_TTL_STABLE),
         messages: pick('messages', CACHE_TTL_STABLE),
     };
+    // A partial cacheStrategy override (e.g. {system:'5m'} while tier3/
+    // messages default to '1h') can put a longer TTL after a shorter one in
+    // request order, which Anthropic rejects: 1h breakpoints must all appear
+    // before any 5m breakpoint. Normalize left-to-right in wire order
+    // (system -> tier3 -> messages; tools is emitted before system and is
+    // excluded from the run) so a later layer is downgraded to the earliest
+    // shorter TTL seen so far — never re-promoted. Layers set to null ('none')
+    // emit no breakpoint at all, so they neither violate nor constrain
+    // ordering and are skipped. Mirrors anthropic-oauth.mjs.
+    const ttlRank = (ttl) => (ttl === CACHE_TTL_STABLE ? 2 : 1); // 1h=2, 5m=1
+    let minRank = Infinity;
+    for (const layer of ['system', 'tier3', 'messages']) {
+        if (!resolved[layer]) continue;
+        const rank = ttlRank(resolved[layer]);
+        if (rank > minRank) resolved[layer] = CACHE_TTL_VOLATILE;
+        else minRank = rank;
+    }
+    return resolved;
 }
 
 function buildSystemBlocks(systemMsgs, systemTtl, tier3Ttl) {
@@ -100,10 +121,20 @@ function buildSystemBlocks(systemMsgs, systemTtl, tier3Ttl) {
             }))
             .filter(it => it.text)
         : [];
+    // Anthropic caps cache_control breakpoints at 4 per request; defensively
+    // cap it here too so an unexpectedly large systemMsgs array can never
+    // mark more than 4 blocks (extras keep their text, just lose the
+    // cache_control breakpoint, not the block itself). Mirrors
+    // anthropic-oauth.mjs.
+    const MAX_SYSTEM_BREAKPOINTS = 4;
+    let bpCount = 0;
     return items.map(it => {
         const block = { type: 'text', text: it.text };
         const ttl = it.tier === 'tier3' ? tier3Ttl : systemTtl;
-        if (ttl) block.cache_control = ttl;
+        if (ttl && bpCount < MAX_SYSTEM_BREAKPOINTS) {
+            block.cache_control = ttl;
+            bpCount++;
+        }
         return block;
     });
 }
@@ -159,14 +190,49 @@ function _normalizeAnthropicModel(raw, provider = 'anthropic') {
 }
 // Family-based heuristic so new model ids (including custom user-configured
 // ones) resolve a sensible max_tokens without requiring a code change.
+// The API-key provider has no catalog cache of its own — it reads the same
+// anthropic-oauth-models.json disk cache (read-only) that the OAuth provider
+// maintains. Both providers hit the same Anthropic /v1/models catalog, so a
+// per-model outputTokens entry is valid regardless of which auth path wrote
+// it. If this provider is ever run standalone without the OAuth provider
+// ever having populated the cache, loadSync() simply returns null and we
+// fall through to the shared static heuristic in anthropic-max-tokens.mjs.
+const ANTHROPIC_OAUTH_MODEL_CACHE_TTL_MS = 24 * 60 * 60_000;
+const _sharedOAuthModelCache = makeModelCache({
+    fileName: 'anthropic-oauth-models.json',
+    ttlMs: ANTHROPIC_OAUTH_MODEL_CACHE_TTL_MS,
+    version: 1,
+});
+
+// In-memory mirror populated by this provider's own listModels() fetch.
+// API-key-only installs never have the OAuth provider write the shared disk
+// cache, so without this mirror catalog outputTokens would stay invisible to
+// resolveMaxTokens until an OAuth session runs. listModels() results flow in
+// here (memory only — the disk cache stays OAuth-owned/read-only for us).
+let _apiKeyCatalogMirror = null;
+
+function _catalogOutputTokensFromSharedCache(model) {
+    if (!model) return null;
+    try {
+        const models = Array.isArray(_apiKeyCatalogMirror)
+            ? _apiKeyCatalogMirror
+            : _sharedOAuthModelCache.loadSync();
+        if (!Array.isArray(models)) return null;
+        const entry = models.find(m => m?.id === model);
+        const out = Number(entry?.outputTokens);
+        return Number.isFinite(out) && out > 0 ? out : null;
+    } catch {
+        return null;
+    }
+}
+
 function resolveMaxTokens(model) {
-    const id = String(model || '').toLowerCase();
-    if (id.includes('opus')) return 32768;
-    if (id.includes('sonnet')) return 16384;
-    if (id.includes('haiku')) return 8192;
-    return 8192;
+    return resolveAnthropicMaxTokens(model, { catalogLookup: _catalogOutputTokensFromSharedCache });
 }
 
+// Test-only escape hatch for scripts/anthropic-maxtokens-test.mjs.
+export const _test = { resolveMaxTokens };
+
 const MIN_THINKING_BUDGET = 1024;
 const THINKING_OUTPUT_RESERVE = 1024;
 
@@ -464,8 +530,7 @@ export class AnthropicProvider {
         const usedSlots = toolsBpUsed + systemBpUsed;
         // Env override for BP strategy. ANTHROPIC_MSG_SLOTS=0 disables
         // message caching entirely. Any value >=1 first marks the previous
-        // user text turn; a second free slot marks the tail. Mirrors
-        // anthropic-oauth.mjs for twin parity.
+        // user text turn; a second free slot marks the tail.
         const msgSlotsCap = Number.parseInt(process.env.ANTHROPIC_MSG_SLOTS, 10);
         const defaultMsgSlots = Math.max(0, 4 - usedSlots);
         const msgSlots = ttls.messages
@@ -825,7 +890,10 @@ export class AnthropicProvider {
             const normalized = items
                 .map((m) => _normalizeAnthropicModel(m, this.name))
                 .filter(Boolean);
-            const enriched = await enrichModels(normalized);
+            const enriched = sanitizeModelList(await enrichModels(normalized), { provider: this.name });
+            // Feed the resolver-visible mirror so API-key-only installs get
+            // catalog outputTokens without depending on the OAuth disk cache.
+            if (enriched.length) _apiKeyCatalogMirror = enriched.slice();
             return enriched.length ? enriched : MODELS;
         }
         catch (err) {

package/src/runtime/agent/orchestrator/providers/api-usage.mjs

@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { updateJsonAtomicSync } from '../../../shared/atomic-file.mjs';
 import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
 import { getAgentApiKey, getOpenAIUsageSessionKey } from '../../../shared/config.mjs';
+import { num, round } from './lib/usage-primitives.mjs';
 
 const CACHE_FILE = 'api-usage-cache.json';
 const LIVE_TTL_MS = 5 * 60_000;
@@ -10,19 +11,6 @@ const STALE_TTL_MS = 60 * 60_000;
 const DISK_JSON_MEMORY_TTL_MS = 1000;
 let diskJsonCache = { at: 0, file: '', value: null };
 
-function num(value, fallback = null) {
-  if (value === null || value === undefined || value === '') return fallback;
-  const n = Number(value);
-  return Number.isFinite(n) ? n : fallback;
-}
-
-function round(value, digits = 4) {
-  const n = Number(value);
-  if (!Number.isFinite(n)) return null;
-  const scale = 10 ** digits;
-  return Math.round(n * scale) / scale;
-}
-
 function cachePath() {
   return join(resolvePluginData(), CACHE_FILE);
 }

package/src/runtime/agent/orchestrator/providers/codex-client-meta.mjs

@@ -0,0 +1,81 @@
+/**
+ * codex-client-meta.mjs — codex client identity headers for the OpenAI OAuth
+ * transports.
+ *
+ * codex-rs sends two client-identity headers on EVERY request including the
+ * WS handshake:
+ *  - `User-Agent: codex_cli_rs/<version> (<os> <ver>; <arch>) <terminal>`
+ *    (login/src/auth/default_client.rs get_codex_user_agent + default_headers)
+ *  - `version: <CARGO_PKG_VERSION>` via the built-in provider http_headers
+ *    (model-provider-info/src/lib.rs:339-343), merged into the WS handshake by
+ *    merge_request_headers (codex-api/src/endpoint/responses_websocket.rs).
+ * The backend uses these for client gating (model catalog visibility measured
+ * 2026-07-03) and plausibly for x-codex-turn-state issuance / sticky
+ * cache-node routing, so mixdog mirrors both.
+ */
+import os from 'node:os';
+
+// Offline fallback only; live value refreshes from npm (24h TTL, in-process).
+export const CODEX_CLIENT_VERSION_FLOOR = '0.142.5';
+const VERSION_TTL_MS = 24 * 60 * 60_000;
+let _cache = { value: null, fetchedAt: 0 };
+let _refreshInFlight = null;
+
+async function _refresh() {
+    try {
+        const res = await fetch('https://registry.npmjs.org/@openai/codex/latest', {
+            signal: AbortSignal.timeout(5_000),
+        });
+        if (res.ok) {
+            const j = await res.json();
+            const v = String(j?.version || '').trim();
+            if (/^\d+\.\d+\.\d+/.test(v)) {
+                _cache = { value: v, fetchedAt: Date.now() };
+                return v;
+            }
+        }
+    } catch { /* offline — keep floor */ }
+    _cache = { value: CODEX_CLIENT_VERSION_FLOOR, fetchedAt: Date.now() };
+    return CODEX_CLIENT_VERSION_FLOOR;
+}
+
+/**
+ * Sync accessor for hot request paths: returns the cached npm version when
+ * fresh, otherwise kicks a background refresh and returns the floor. The
+ * handshake must never await a registry fetch.
+ */
+export function codexClientVersionSync() {
+    if (_cache.value && Date.now() - _cache.fetchedAt < VERSION_TTL_MS) return _cache.value;
+    if (!_refreshInFlight) {
+        _refreshInFlight = _refresh().finally(() => { _refreshInFlight = null; });
+    }
+    return _cache.value || CODEX_CLIENT_VERSION_FLOOR;
+}
+
+function _osType() {
+    // codex os_info reports "Windows"/"Mac OS"/"Linux"; node os.type() gives
+    // Windows_NT/Darwin/Linux. Map to codex's vocabulary.
+    const t = os.type();
+    if (t === 'Windows_NT') return 'Windows';
+    if (t === 'Darwin') return 'Mac OS';
+    return t;
+}
+
+function _arch() {
+    // codex reports rust-style arch tokens.
+    const a = os.arch();
+    if (a === 'x64') return 'x86_64';
+    if (a === 'arm64') return 'aarch64';
+    return a;
+}
+
+/** codex_cli_rs/<version> (<os> <ver>; <arch>) <terminal> */
+export function codexUserAgent() {
+    const terminal = String(process.env.TERM_PROGRAM || 'unknown').trim() || 'unknown';
+    return `codex_cli_rs/${codexClientVersionSync()} (${_osType()} ${os.release()}; ${_arch()}) ${terminal}`;
+}
+
+/** Bare version header value — codex built-in provider http_headers "version". */
+export function codexVersionHeader() {
+    return codexClientVersionSync();
+}

package/src/runtime/agent/orchestrator/providers/gemini-cache.mjs

@@ -0,0 +1,248 @@
+/**
+ * gemini-cache.mjs — Gemini explicit cachedContents prefix accounting:
+ * token estimation, prefix hashing, the process-global cache registry
+ * (create de-dupe + prune), cache-state attach, usage resolution, and the
+ * cache trace writer.
+ *
+ * Extracted from gemini.mjs (no behavior change). Owns the module-level
+ * geminiGlobalCaches / geminiGlobalCacheCreates maps. gemini.mjs imports
+ * these helpers; no re-export needed (all names are internal to the
+ * provider — none were part of the module's external surface).
+ */
+import { traceHash, stableTraceStringify, summarizeTraceTools, traceTextShape } from './trace-utils.mjs';
+
+function summarizeTracePart(part) {
+    if (!part || typeof part !== 'object') return { type: typeof part };
+    if ('text' in part) {
+        return { type: 'text', ...traceTextShape(part.text) };
+    }
+    if (part.functionCall) {
+        return {
+            type: 'functionCall',
+            name: part.functionCall.name || null,
+            argsHash: traceHash(stableTraceStringify(part.functionCall.args || {})),
+        };
+    }
+    if (part.functionResponse) {
+        const response = part.functionResponse.response || {};
+        const responseShape = stableTraceStringify(response);
+        return {
+            type: 'functionResponse',
+            name: part.functionResponse.name || null,
+            responseChars: responseShape.length,
+            responseHash: traceHash(responseShape),
+        };
+    }
+    return { type: Object.keys(part).sort().join('|') || 'unknown' };
+}
+
+function summarizeTraceContents(contents) {
+    const summaries = (contents || []).map((content, index) => ({
+        index,
+        role: content?.role || null,
+        parts: Array.isArray(content?.parts) ? content.parts.map(summarizeTracePart) : [],
+    }));
+    if (summaries.length <= 12) return summaries;
+    return [
+        ...summaries.slice(0, 8),
+        { omittedTurns: summaries.length - 12 },
+        ...summaries.slice(-4),
+    ];
+}
+
+// Gemini cachedContents API rejects prefixes below the model-specific minimum
+// (Gemini 2.0/2.5 = 2048 tokens, Gemini 3.x = 4096 tokens) with HTTP 400
+// "Cached content is too small". Estimating chars/4 ≈ tokens lets us skip the
+// roundtrip when the prefix cannot satisfy the invariant. Estimate undercount
+// is harmless (we attempt and get the same 400 we would have skipped); overcount
+// is harmless (we skip, fall back to implicit cache).
+export function _estimateGeminiCacheTokens(systemInstruction, geminiTools, contents) {
+    let chars = 0;
+    if (typeof systemInstruction === 'string') chars += systemInstruction.length;
+    if (Array.isArray(geminiTools) && geminiTools.length) {
+        try { chars += JSON.stringify(geminiTools).length; } catch {}
+    }
+    if (Array.isArray(contents) && contents.length > 1) {
+        for (let i = 0; i < contents.length - 1; i++) {
+            try { chars += JSON.stringify(contents[i]?.parts ?? '').length; } catch {}
+        }
+    }
+    return Math.ceil(chars / 4);
+}
+
+export function _geminiCacheMinTokens(model) {
+    return /^gemini-3/i.test(String(model || '')) ? 4096 : 2048;
+}
+
+export function _geminiCachePrefixCount(contents) {
+    return Array.isArray(contents) && contents.length > 1 ? contents.length - 1 : 0;
+}
+
+export function _geminiCachePrefixContents(contents, prefixCount) {
+    if (!Array.isArray(contents) || prefixCount <= 0) return [];
+    return contents.slice(0, prefixCount).map(c => {
+        const r = c?.role;
+        const safeRole = (r === 'model' || r === 'user') ? r : 'user';
+        return {
+            role: safeRole,
+            parts: Array.isArray(c?.parts) ? c.parts : [],
+        };
+    });
+}
+
+export function _geminiCachePrefixHash({ model, systemInstruction, geminiTools, contents, prefixCount }) {
+    return traceHash(stableTraceStringify({
+        model: model || null,
+        systemInstruction: systemInstruction || '',
+        tools: geminiTools || [],
+        contents: _geminiCachePrefixContents(contents, prefixCount),
+    }));
+}
+
+export const GEMINI_GLOBAL_CACHE_MIN_LIVE_MS = 6 * 60 * 1000;
+export const GEMINI_GLOBAL_CACHE_MAX_ENTRIES = 128;
+// Grace window before deleting a superseded cachedContents name (see the
+// cross-session race note at the delete call site in gemini.mjs). Long enough
+// that a concurrent session still mid-flight on the old name has time to finish.
+export const GEMINI_GLOBAL_CACHE_DELETE_GRACE_MS = 2 * 60 * 1000;
+export const geminiGlobalCaches = new Map();
+export const geminiGlobalCacheCreates = new Map();
+
+export function _geminiGlobalCacheKey({ apiKey, model, cachePrefixHash, cachePrefixContentCount }) {
+    return traceHash(stableTraceStringify({
+        apiKeyHash: traceHash(apiKey || ''),
+        model: model || null,
+        cachePrefixHash,
+        cachePrefixContentCount,
+    }));
+}
+
+export function _pruneGeminiGlobalCaches(now = Date.now()) {
+    for (const [key, entry] of geminiGlobalCaches) {
+        if (!entry?.cacheName || Number(entry.cacheExpiresAt || 0) <= now) {
+            geminiGlobalCaches.delete(key);
+        }
+    }
+    while (geminiGlobalCaches.size > GEMINI_GLOBAL_CACHE_MAX_ENTRIES) {
+        const oldest = geminiGlobalCaches.keys().next().value;
+        if (oldest === undefined) break;
+        geminiGlobalCaches.delete(oldest);
+    }
+}
+
+export function _getGeminiGlobalCache(key, now = Date.now()) {
+    _pruneGeminiGlobalCaches(now);
+    const entry = geminiGlobalCaches.get(key);
+    if (!entry?.cacheName) return null;
+    if ((entry.cacheExpiresAt || 0) - now <= GEMINI_GLOBAL_CACHE_MIN_LIVE_MS) {
+        geminiGlobalCaches.delete(key);
+        return null;
+    }
+    entry.lastUsedAt = now;
+    return entry;
+}
+
+export function _setGeminiGlobalCache(key, entry) {
+    if (!key || !entry?.cacheName) return;
+    geminiGlobalCaches.set(key, {
+        ...entry,
+        lastUsedAt: Date.now(),
+    });
+    _pruneGeminiGlobalCaches();
+}
+
+export function _geminiGlobalCacheNameIsLive(cacheName, now = Date.now()) {
+    if (!cacheName) return false;
+    for (const entry of geminiGlobalCaches.values()) {
+        if (entry?.cacheName === cacheName && Number(entry.cacheExpiresAt || 0) > now) return true;
+    }
+    return false;
+}
+
+export function _attachGeminiCacheState(opts, entry, currentIter) {
+    if (!entry?.cacheName) return;
+    opts.providerState = {
+        ...(opts.providerState || {}),
+        gemini: {
+            cacheName: entry.cacheName,
+            cacheCreatedAt: entry.cacheCreatedAt,
+            cacheCreatedAtIter: currentIter,
+            cacheExpiresAt: entry.cacheExpiresAt,
+            cacheModel: entry.cacheModel,
+            cacheTokenSize: entry.cacheTokenSize,
+            cachePrefixContentCount: entry.cachePrefixContentCount,
+            cachePrefixHash: entry.cachePrefixHash,
+        },
+    };
+}
+
+export function _resolveGeminiCacheUsage({ usageMetadata, cachedContent, providerState }) {
+    const inputTokens = Number(usageMetadata?.promptTokenCount || usageMetadata?.totalTokenCount || 0) || 0;
+    const reportedCachedTokens = Number(usageMetadata?.cachedContentTokenCount || 0) || 0;
+    const cachedFallbackTokens = cachedContent
+        ? Number(providerState?.gemini?.cacheTokenSize || 0) || 0
+        : 0;
+    const rawCachedTokens = reportedCachedTokens > 0 ? reportedCachedTokens : cachedFallbackTokens;
+    const cachedTokens = inputTokens > 0 ? Math.min(rawCachedTokens, inputTokens) : rawCachedTokens;
+    const cacheTokenSource = reportedCachedTokens > 0
+        ? 'usage_metadata'
+        : (cachedFallbackTokens > 0 ? 'cache_create_fallback' : 'none');
+    return {
+        inputTokens,
+        reportedCachedTokens,
+        cachedFallbackTokens,
+        cachedTokens,
+        cacheTokenSource,
+    };
+}
+
+export function writeGeminiCacheTrace({ opts, model, systemInstruction, tools, contents, usageMetadata, cachedContent }) {
+    if (process.env.MIXDOG_GEMINI_CACHE_TRACE !== '1') return;
+    try {
+        const session = opts?.session || {};
+        const {
+            inputTokens,
+            reportedCachedTokens,
+            cachedFallbackTokens,
+            cachedTokens,
+            cacheTokenSource,
+        } = _resolveGeminiCacheUsage({
+            usageMetadata,
+            cachedContent,
+            providerState: opts?.providerState,
+        });
+        const toolShape = summarizeTraceTools(tools);
+        const trace = {
+            event: 'generate',
+            provider: 'gemini',
+            model,
+            owner: session.owner || null,
+            agent: session.agent || null,
+            permission: session.permission || null,
+            toolPermission: session.toolPermission || null,
+            profileId: session.profileId || null,
+            sourceType: session.sourceType || null,
+            sourceName: session.sourceName || null,
+            sessionIdHash: opts?.sessionId ? traceHash(opts.sessionId) : null,
+            providerCacheKeyHash: opts?.providerCacheKey ? traceHash(opts.providerCacheKey) : null,
+            promptCacheKeyHash: opts?.promptCacheKey ? traceHash(opts.promptCacheKey) : null,
+            systemChars: systemInstruction ? systemInstruction.length : 0,
+            systemHash: systemInstruction ? traceHash(systemInstruction) : null,
+            toolCount: Array.isArray(tools) ? tools.length : 0,
+            toolSchemaHash: traceHash(stableTraceStringify(toolShape)),
+            contentTurnCount: Array.isArray(contents) ? contents.length : 0,
+            contents: summarizeTraceContents(contents),
+            inputTokens,
+            cachedTokens,
+            reportedCachedTokens,
+            cachedFallbackTokens,
+            cacheTokenSource,
+            cacheAttached: !!cachedContent,
+            cachePrefixContentCount: opts?.providerState?.gemini?.cachePrefixContentCount ?? null,
+            cacheHitRate: inputTokens > 0 ? Number((cachedTokens / inputTokens).toFixed(6)) : null,
+        };
+        process.stderr.write(`[gemini-cache-trace] ${JSON.stringify(trace)}\n`);
+    } catch (err) {
+        process.stderr.write(`[gemini-cache-trace] failed: ${err?.message || err}\n`);
+    }
+}