mixdog 0.9.33 → 0.9.34

package/src/repl.mjs

@@ -161,6 +161,11 @@ export async function runRepl({ provider: providerName, model, toolMode = 'full'
       let streamedText = '';
       let printedAny = false;
       let printedToolCard = false;
+      // After the blank line emitted above, the cursor sits at a fresh line
+      // start. Track this so tool cards don't insert extra blank-line "pops":
+      // a leading newline is only needed to break away from un-terminated
+      // streamed text, never between consecutive cards.
+      let atLineStart = true;
       try {
         const runtime = await ensureRuntime();
         const { result } = await runtime.ask(
@@ -169,13 +174,16 @@ export async function runRepl({ provider: providerName, model, toolMode = 'full'
             onToolCall: async (_iter, calls) => {
               for (const c of calls || []) {
                 printedToolCard = true;
-                stdout.write('\n' + (await renderToolCardLazy(c)) + '\n');
+                const lead = atLineStart ? '' : '\n';
+                stdout.write(lead + (await renderToolCardLazy(c)) + '\n');
+                atLineStart = true;
               }
           },
             onTextDelta: (chunk) => {
               printedAny = true;
               streamedText += chunk;
               stdout.write(chunk);
+              atLineStart = chunk.endsWith('\n');
             },
             onUsageDelta: (delta) => applyUsageDelta(stats, delta),
           },

package/src/rules/shared/01-tool.md

@@ -39,5 +39,7 @@
   `apply_patch` and the `shell` that checks it in separate turns — not for
   ordering (same-turn calls run in emit order), but because you must SEE the
   patch result before verifying: a same-turn shell is already emitted and
-  can't react to a failed or partial patch. Batch the patches this turn,
-  verify them all in ONE shell call the next. Anything else stays parallel.
+  can't react to a failed or partial patch. Put all known edits in ONE patch
+  this turn, in the order they should apply; later mutations skip after an
+  earlier patch failure. Verify all edits in ONE shell call next turn. Anything
+  else stays parallel.

package/src/runtime/agent/orchestrator/providers/codex-client-meta.mjs

@@ -69,13 +69,35 @@ function _arch() {
     return a;
 }
 
+/**
+ * Originator token codex sends on every request (`codex_cli_rs`).
+ *
+ * Opt-in parity override: an operator can pin the exact originator a known-good
+ * codex build reports via MIXDOG_CODEX_ORIGINATOR when the backend fingerprints
+ * on it. Unset (default) keeps `codex_cli_rs`, so wire behavior is unchanged.
+ */
+export function codexOriginator() {
+    const override = String(process.env.MIXDOG_CODEX_ORIGINATOR || '').trim();
+    return override || 'codex_cli_rs';
+}
+
 /** codex_cli_rs/<version> (<os> <ver>; <arch>) <terminal> */
 export function codexUserAgent() {
+    // Opt-in parity override: pin an exact codex User-Agent string
+    // (MIXDOG_CODEX_USER_AGENT) when the auto-derived os/arch/terminal tuple
+    // drifts from the real codex build the backend expects. Unset = default.
+    const override = String(process.env.MIXDOG_CODEX_USER_AGENT || '').trim();
+    if (override) return override;
     const terminal = String(process.env.TERM_PROGRAM || 'unknown').trim() || 'unknown';
     return `codex_cli_rs/${codexClientVersionSync()} (${_osType()} ${os.release()}; ${_arch()}) ${terminal}`;
 }
 
 /** Bare version header value — codex built-in provider http_headers "version". */
 export function codexVersionHeader() {
+    // Opt-in parity override: pin an exact `version` header
+    // (MIXDOG_CODEX_VERSION) instead of the npm-derived value. Unset = default
+    // (live npm version, floor fallback), so behavior is unchanged.
+    const override = String(process.env.MIXDOG_CODEX_VERSION || '').trim();
+    if (override) return override;
     return codexClientVersionSync();
 }

package/src/runtime/agent/orchestrator/providers/gemini-cache.mjs

@@ -177,8 +177,27 @@ export function _attachGeminiCacheState(opts, entry, currentIter) {
 }
 
 export function _resolveGeminiCacheUsage({ usageMetadata, cachedContent, providerState }) {
-    const inputTokens = Number(usageMetadata?.promptTokenCount || usageMetadata?.totalTokenCount || 0) || 0;
-    const reportedCachedTokens = Number(usageMetadata?.cachedContentTokenCount || 0) || 0;
+    const firstFinite = (...values) => {
+        for (const value of values) {
+            const n = Number(value);
+            if (Number.isFinite(n) && n > 0) return n;
+        }
+        return 0;
+    };
+    const inputTokens = firstFinite(
+        usageMetadata?.promptTokenCount,
+        usageMetadata?.prompt_token_count,
+        usageMetadata?.totalTokenCount,
+        usageMetadata?.total_token_count,
+    );
+    const reportedCachedTokens = firstFinite(
+        // generateContent UsageMetadata field.
+        usageMetadata?.cachedContentTokenCount,
+        usageMetadata?.cached_content_token_count,
+        // Newer SDK convenience alias documented for implicit cache hits.
+        usageMetadata?.totalCachedTokens,
+        usageMetadata?.total_cached_tokens,
+    );
     const cachedFallbackTokens = cachedContent
         ? Number(providerState?.gemini?.cacheTokenSize || 0) || 0
         : 0;

package/src/runtime/agent/orchestrator/providers/gemini.mjs

@@ -782,7 +782,8 @@ export class GeminiProvider {
         const um = response.usageMetadata || null;
         // Hoist cachedTokens so the returned usage block can reuse the
         // exact value the trace already recorded (including the
-        // cachedFallback when cachedContentTokenCount under-reports).
+        // cachedFallback when cachedContentTokenCount / total_cached_tokens
+        // under-reports).
         let cachedTokens = 0;
         if (um) {
             const {

package/src/runtime/agent/orchestrator/providers/grok-oauth.mjs

@@ -88,17 +88,24 @@ function proxyHeaders() {
     };
 }
 
-function resolveGrokOAuthResponsesTransport(config, proxy) {
-    // Proxy-only models route through cli-chat-proxy.grok.com; the shared xAI
-    // WebSocket connector targets api.x.ai, so keep proxy models on HTTP.
-    if (proxy) return 'http';
+function resolveGrokOAuthResponsesTransport(config) {
+    // An explicit Grok-specific transport setting is the escape hatch and wins
+    // for EVERY Grok model, api.x.ai and proxy-only alike — e.g. pin 'http' to
+    // force proxy-only models back onto cli-chat-proxy.grok.com over HTTP.
     const raw = config?.responsesTransport
         ?? config?.transport
         ?? process.env.MIXDOG_GROK_OAUTH_RESPONSES_TRANSPORT
         ?? process.env.MIXDOG_GROK_OAUTH_TRANSPORT
         ?? '';
     const mode = String(raw).trim().toLowerCase();
-    return mode || 'http';
+    if (mode) return mode;
+    // No Grok-specific override: leave the field unset so ALL api.x.ai-capable
+    // Grok models honor the shared MIXDOG_OAI_TRANSPORT switch. Proxy-only
+    // grok-build is included: the shared xAI WebSocket connector targets the
+    // fixed wss://api.x.ai/v1/responses endpoint (not the proxy baseURL), and a
+    // live probe confirmed grok-build serves there with the OAuth token. No
+    // implicit HTTP pin — the proxy baseURL is only used when HTTP is selected.
+    return undefined;
 }
 
 // Retired model aliases xAI no longer exposes by their old ids. The live
@@ -639,10 +646,9 @@ export class GrokOAuthProvider {
             ...this.config,
             apiKey: token,
             baseURL: proxy ? PROXY_BASE_URL : INFERENCE_BASE_URL,
-            // Default to the proven HTTP Responses transport for Grok OAuth.
-            // Non-proxy api.x.ai models can opt into the shared xAI WebSocket
-            // connector via config/env; proxy-only models stay HTTP because
-            // the WS connector targets api.x.ai, not the Grok CLI proxy.
+            // All Grok models — proxy-only grok-build included — inherit the
+            // shared xAI transport switch (WS→api.x.ai by default). An explicit
+            // Grok-specific http setting is the escape hatch back to the proxy.
             responsesTransport: resolveGrokOAuthResponsesTransport(this.config, proxy),
             // Proxy-only models additionally need the Grok CLI client headers to
             // clear the proxy version gate (HTTP 426 otherwise).

package/src/runtime/agent/orchestrator/providers/openai-compat.mjs

@@ -18,6 +18,10 @@ import {
     resolveTimeoutMs,
 } from '../stall-policy.mjs';
 import { OPENAI_COMPAT_PRESETS } from './openai-compat-presets.mjs';
+import {
+    resolveResponsesTransportPolicy,
+    RESPONSES_TRANSPORT_CAPABILITIES,
+} from './openai-transport-policy.mjs';
 import {
     summarizeTraceMessages,
     extractCompatCachedTokens,
@@ -191,11 +195,27 @@ export class OpenAICompatProvider {
         // TLS handshake after an idle gap. Fire-and-forget; never awaited.
         preconnect(this.baseURL);
         if (this.name === 'xai' && useXaiResponsesApi(opts, this.config)) {
-            if (useXaiResponsesWebSocket(opts, this.config)) {
+            // Shared Responses transport switch (MIXDOG_OAI_TRANSPORT), capability-
+            // gated for xAI/Grok. Provider-local HTTP pins still win: Grok
+            // proxy-only models set responsesTransport:'http' because the WS
+            // connector targets api.x.ai, not cli-chat-proxy.grok.com.
+            const xaiTransportPolicy = resolveResponsesTransportPolicy(
+                process.env,
+                RESPONSES_TRANSPORT_CAPABILITIES.xai,
+            );
+            const configuredPreferWebSocket = useXaiResponsesWebSocket(opts, this.config);
+            const preferWebSocket = configuredPreferWebSocket === false
+                ? false
+                : xaiTransportPolicy.mode === 'http-sse'
+                ? false
+                : xaiTransportPolicy.transport === 'ws'
+                    ? true
+                    : configuredPreferWebSocket;
+            if (preferWebSocket) {
                 try {
                     return await this._doSendXaiResponsesWebSocket(messages, useModel, tools, opts);
                 } catch (err) {
-                    if (_shouldFallbackXaiWsToHttp(err, opts.signal)) {
+                    if (xaiTransportPolicy.allowHttpFallback && _shouldFallbackXaiWsToHttp(err, opts.signal)) {
                         const reason = err?.midstreamClassifier || err?.retryClassifier || err?.code || err?.message || 'ws_failed';
                         process.stderr.write(`[xai:responses] WebSocket unhealthy (${reason}); falling back to HTTP/SSE\n`);
                         try {
@@ -659,6 +679,16 @@ export class OpenAICompatProvider {
             : null;
         const iteration = Number.isFinite(Number(opts.iteration)) ? Number(opts.iteration) : null;
         let cacheLane = null;
+        // Fast-fallback only shortens the WS handshake retry budget when the
+        // HTTP/SSE fallback is actually enabled for this call. With no-fallback
+        // (allowHttpFallback=false) the WS path must keep its FULL retry budget,
+        // mirroring openai-oauth's httpFallbackEnabled gate.
+        const xaiTransportPolicy = resolveResponsesTransportPolicy(
+            process.env,
+            RESPONSES_TRANSPORT_CAPABILITIES.xai,
+        );
+        const httpFallbackEnabled = xaiTransportPolicy.allowHttpFallback
+            && _envFlag('MIXDOG_XAI_WS_HTTP_FALLBACK', true);
         const scheduled = await withXaiResponsesCacheLane({
             opts,
             config: this.config,
@@ -692,8 +722,9 @@ export class OpenAICompatProvider {
                 // enabled (outer catch → _shouldFallbackXaiWsToHttp), a first
                 // acquire/first-byte failure should skip remaining WS
                 // handshake retries instead of burning the retry budget
-                // before HTTP starts.
-                fastFallback: _envFlag('MIXDOG_XAI_WS_HTTP_FALLBACK', true),
+                // before HTTP starts. Gated on httpFallbackEnabled so a
+                // no-fallback config keeps the full WS retry budget.
+                fastFallback: httpFallbackEnabled,
             });
         });
         const result = scheduled.value;

package/src/runtime/agent/orchestrator/providers/openai-oauth-ws.mjs

@@ -63,6 +63,8 @@ import {
     parseToolSearchArgs,
     _streamResponse,
 } from './openai-ws-stream.mjs';
+import { _buildResponseCreateFrame } from './openai-ws-delta.mjs';
+import { resolveOpenAiTransportPolicy } from './openai-transport-policy.mjs';
 
 // Legacy import paths for scripts/tool-smoke.mjs, mixdog-session-runtime.mjs
 // (drainOpenaiWsPool), scripts/provider-toolcall-test.mjs (parseToolSearchArgs,
@@ -74,6 +76,7 @@ export {
     parseToolSearchArgs,
     _streamResponse,
     _cacheObservation as _cacheObservationForTest,
+    _warmupContinuityTrace as _warmupContinuityTraceForTest,
 };
 
 globalThis.__mixdogOpenaiWsRuntimeLoaded = true;
@@ -234,33 +237,53 @@ function _codexInstallationId(sendOpts) {
         || `mixdog-${_hashText(`${process.env.USERPROFILE || process.env.HOME || ''}:${process.cwd()}`, 32)}`;
 }
 
-function _codexMetadataBase(entry, { poolKey, cacheKey, sendOpts } = {}) {
+function _codexMetadataBase(entry, { poolKey, cacheKey, sendOpts, handshake = false } = {}) {
     const sessionId = _cleanMetaString(sendOpts?.codexSessionId || sendOpts?.session?.codexSessionId || poolKey || cacheKey)
         || 'mixdog-session';
     const threadId = _cleanMetaString(sendOpts?.threadId || sendOpts?.codexThreadId || sendOpts?.session?.threadId || cacheKey || sessionId)
         || sessionId;
-    const turnId = _cleanMetaString(sendOpts?.turnId || sendOpts?.codexTurnId || sendOpts?.session?.turnId || sessionId)
-        || sessionId;
-    const windowId = _cleanMetaString(sendOpts?.windowId || sendOpts?.codexWindowId || sendOpts?.session?.windowId)
-        || `${threadId}:1`;
     const installationId = _codexInstallationId(sendOpts);
     const startedAt = Number.isFinite(Number(sendOpts?.turnStartedAtUnixMs))
         ? Math.floor(Number(sendOpts.turnStartedAtUnixMs))
         : _sessionStartedAtUnixMs(sessionId);
     const requestKind = _codexRequestKind(sendOpts, sessionId);
+    const wireParity = process.env.MIXDOG_OAI_CODEX_WIRE_PARITY === '1';
+    // codex opens the WS with a prewarm (empty turn_id) BEFORE issuing the
+    // real turn (client.rs). Our handshake headers are built once, up-front,
+    // and were carrying a turn_id (= sessionId) — i.e. presenting the
+    // handshake as a live turn. Under wire parity, treat the handshake as the
+    // prewarm so its turn_id is empty, matching codex. Default (parity off) is
+    // unchanged: the wireParity gate below leaves turnId as before.
+    const isPrewarm = requestKind === 'prewarm' || handshake === true;
+    const explicitTurnId = _cleanMetaString(sendOpts?.turnId || sendOpts?.codexTurnId || sendOpts?.session?.turnId);
+    const explicitWindowId = _cleanMetaString(sendOpts?.windowId || sendOpts?.codexWindowId || sendOpts?.session?.windowId);
+    const turnId = wireParity && isPrewarm
+        ? ''
+        : (explicitTurnId || sessionId);
+    // Under wire parity the handshake IS the prewarm (empty turn_id above), so
+    // its request_kind must be 'prewarm' too — codex tags the prewarm request
+    // as prewarm, not turn (client.rs). Previously we emptied turn_id but left
+    // request_kind='turn', presenting the prewarm as a live turn. Default
+    // (parity off) is unchanged: requestKind passes through untouched.
+    const effectiveRequestKind = wireParity && isPrewarm ? 'prewarm' : requestKind;
+    const windowId = explicitWindowId
+        || `${threadId}:${wireParity ? 0 : 1}`;
     const turnMetadata = {
         installation_id: installationId,
         session_id: sessionId,
         thread_id: threadId,
         turn_id: turnId,
         window_id: windowId,
-        request_kind: requestKind,
+        request_kind: effectiveRequestKind,
         // Richer codex turn-metadata fields (responses_metadata.rs:264-280:
         // thread_source "user" per protocol.rs:2751-2765, sandbox label).
         // A/B 2026-07-04 (rvA/rvB interleaved, 24 sessions/arm): no effect
         // (it2 full 3 vs 2, miss 2 vs 3 — noise). Default OFF; keep the knob
         // for future probes if the backend starts gating on payload richness.
-        ...(process.env.MIXDOG_OAI_TURN_METADATA_RICH === '1' ? {
+        // Codex WS metadata parity (opt-in): the richer turn-metadata fields
+        // codex emits (responses_metadata.rs:264-280) also go on the wire under
+        // MIXDOG_OAI_CODEX_WIRE_PARITY. Default (both flags off) is unchanged.
+        ...((process.env.MIXDOG_OAI_TURN_METADATA_RICH === '1' || wireParity) ? {
             thread_source: 'user',
             sandbox: 'read-only',
         } : {}),
@@ -332,10 +355,22 @@ function _codexWsCompatibilityHeaders(context = {}) {
         delete headers['x-codex-turn-metadata'];
     }
     // probe === '1' | 'true' | 'yes' | 'on' | 'turn-metadata' => full set as built above.
+    // Turn-state gate experiment bundle (MIXDOG_OAI_CODEX_TURN_STATE_GATE): the
+    // debugger's hypothesis is that x-codex-turn-state issuance also wants the
+    // parent-thread header present, independent of MIXDOG_OAI_TURN_METADATA.
+    // Attach it (= thread_id) when the gate is explicitly enabled and the probe
+    // above didn't already set it. Default OFF; composes with the probe.
+    const gate = String(process.env.MIXDOG_OAI_CODEX_TURN_STATE_GATE || '').trim().toLowerCase();
+    if (['1', 'true', 'yes', 'on'].includes(gate) && !headers['x-codex-parent-thread-id']) {
+        const parentThreadId = _cleanMetaString(context?.sendOpts?.parentThreadId
+            || context?.sendOpts?.codexParentThreadId
+            || metadata.thread_id);
+        if (parentThreadId) headers['x-codex-parent-thread-id'] = parentThreadId;
+    }
     return headers;
 }
 
-function _withCodexWsClientMetadata(frame, entry, enabled, context = {}) {
+export function _withCodexWsClientMetadata(frame, entry, enabled, context = {}) {
     if (!enabled || !frame || typeof frame !== 'object') return frame;
     const base = _codexMetadataBase(entry, context);
     const metadata = {
@@ -347,10 +382,24 @@ function _withCodexWsClientMetadata(frame, entry, enabled, context = {}) {
         // codex scopes x-codex-turn-state to ONE turn (client.rs:263-279 —
         // "must not send it between different turns"). Pooled sockets span
         // turns, so key the stored token by the turn that captured it and
-        // drop it when the turn changes.
-        if (entry.turnState && entry.turnStateTurnId && entry.turnStateTurnId !== base.turn_id) {
-            entry.turnState = null;
-            entry.turnStateTurnId = null;
+        // drop it when the turn changes. turnState is captured at handshake
+        // (pool) / mid-stream (ws-stream) without knowing the owning turn, so
+        // attribute it to the FIRST turn that observes it here; once turn_id
+        // moves off that owner, drop the stale token. (Previously
+        // turnStateTurnId was checked but never assigned, so this guard was
+        // dead and stale turn-state could leak across turns under parity.)
+        if (entry.turnState) {
+            // An empty turn_id (parity prewarm) is a VALID owner attribution, not
+            // "unassigned". Test against null/undefined so a prewarm-owned token
+            // (turn_id '') is retired once turn_id advances to the real turn,
+            // instead of being reattributed onto it. Default (parity off) never
+            // produces an empty turn_id, so this is unchanged there.
+            if (entry.turnStateTurnId == null) {
+                entry.turnStateTurnId = base.turn_id;
+            } else if (entry.turnStateTurnId !== base.turn_id) {
+                entry.turnState = null;
+                entry.turnStateTurnId = null;
+            }
         }
         entry.currentTurnId = base.turn_id;
     }
@@ -402,6 +451,33 @@ function _cacheObservation({ entry, result }) {
     };
 }
 
+// Warmup→first-real continuity trace (Codex prewarm_websocket parity
+// observability). Pure/deterministic so it unit-tests without a live socket.
+// The R23 finding forbids the post-warmup request rewrite, so parity is
+// asserted via metrics instead of behavior: does the warmup's response_id
+// become the anchor the FIRST real request chains from, and what is the
+// hit/miss outcome of the first up-to-3 real requests on the socket.
+export function _warmupContinuityTrace({
+    warmupUsed,
+    warmupResponseId,
+    priorEntryResponseId,
+    sentPrevResponseId,
+    earlyCacheMisses,
+} = {}) {
+    const misses = Array.isArray(earlyCacheMisses) ? earlyCacheMisses.slice(0, 3) : [];
+    // The first real request is a full frame (no prev_id, per R23), so its
+    // anchor is what the entry held at build time — which the warmup wrote.
+    const firstRealPrevId = sentPrevResponseId || priorEntryResponseId || null;
+    return {
+        warmup_first_real_prev_id: firstRealPrevId,
+        warmup_chain_continuous: !!warmupUsed
+            && !!warmupResponseId
+            && firstRealPrevId === warmupResponseId,
+        early_cache_misses: misses,
+        early_cache_miss_count: misses.filter(Boolean).length,
+    };
+}
+
 /**
  * Run `_acquire({auth, poolKey, cacheKey})` with bounded exponential-backoff
  * retry on transient handshake failures. The injection seams (`_acquire`,
@@ -600,7 +676,7 @@ export async function sendViaWebSocket({
     const useCodexWsClientMetadata = traceProvider === 'openai-oauth';
     const codexMetadataContext = { poolKey, cacheKey, sendOpts };
     const codexHandshakeHeaders = useCodexWsClientMetadata
-        ? _codexWsCompatibilityHeaders(codexMetadataContext)
+        ? _codexWsCompatibilityHeaders({ ...codexMetadataContext, handshake: true })
         : null;
 
     for (let attemptIndex = 0; attemptIndex <= MAX_MIDSTREAM_RETRIES; attemptIndex++) {
@@ -725,8 +801,27 @@ export async function sendViaWebSocket({
             // has no prior request state. A reused pooled socket with a live
             // chain must go straight to the real request.
             if (warmupBody && typeof warmupBody === 'object' && attemptIndex === 0 && !entry.lastResponseId) {
-                const warmupFrame = { type: 'response.create', ...warmupBody };
-                const wireWarmupFrame = _withCodexWsClientMetadata(warmupFrame, entry, useCodexWsClientMetadata, codexMetadataContext);
+                // Codex WS prewarm parity (opt-in): codex's prewarm frame is a
+                // minimal generate:false request that omits transport-only
+                // fields (stream/background) on the wire (prewarm_websocket,
+                // client.rs:1673-1705). Under MIXDOG_OAI_CODEX_WIRE_PARITY force
+                // that omission for the warmup frame too; default is unchanged.
+                const warmupWireParity = process.env.MIXDOG_OAI_CODEX_WIRE_PARITY === '1';
+                const parityWarmupBody = warmupWireParity
+                    ? { ...warmupBody, input: [], generate: false }
+                    : warmupBody;
+                const warmupFrame = _buildResponseCreateFrame(parityWarmupBody, { omitTransportFields: warmupWireParity });
+                const warmupMetadataContext = warmupWireParity
+                    ? {
+                        ...codexMetadataContext,
+                        sendOpts: {
+                            ...(codexMetadataContext?.sendOpts || {}),
+                            requestKind: 'prewarm',
+                            codexRequestKind: 'prewarm',
+                        },
+                    }
+                    : codexMetadataContext;
+                const wireWarmupFrame = _withCodexWsClientMetadata(warmupFrame, entry, useCodexWsClientMetadata, warmupMetadataContext);
                 wireFrameHadTurnState = !!wireWarmupFrame?.client_metadata?.['x-codex-turn-state'];
                 wireFrameMetadataTrace = _metadataTrace(wireWarmupFrame?.client_metadata);
                 await _sendFrameFn(entry, wireWarmupFrame);
@@ -761,8 +856,8 @@ export async function sendViaWebSocket({
                     throw new Error('Responses WS warmup completed without response id');
                 }
                 entry.lastResponseId = warmupResult.responseId;
-                entry.lastRequestSansInput = _stableStringify(_sansInput(warmupBody));
-                const warmupInputArr = Array.isArray(warmupBody.input) ? warmupBody.input : [];
+                entry.lastRequestSansInput = _stableStringify(_sansInput(parityWarmupBody));
+                const warmupInputArr = Array.isArray(parityWarmupBody.input) ? parityWarmupBody.input : [];
                 entry.lastRequestInput = _cloneJson(warmupInputArr);
                 entry.lastResponseItems = _cloneJson(Array.isArray(warmupResult.responseItems) ? warmupResult.responseItems : []);
                 entry.lastInputLen = warmupInputArr.length;
@@ -800,7 +895,7 @@ export async function sendViaWebSocket({
                 // Delta opt-in still chains via entry.lastResponseId above.
             }
 
-            const delta = _computeDelta({ entry, body: requestBody });
+            const delta = _computeDelta({ entry, body: requestBody, traceProvider });
             ({ mode, frame } = delta);
             deltaReason = delta.reason || null;
             strippedResponseItems = delta.strippedResponseItems || 0;
@@ -1093,6 +1188,22 @@ export async function sendViaWebSocket({
             _num(entry.promptCacheMaxCachedTokens, 0),
             cacheObservation.cachedTokens,
         );
+        // Early-session cache-miss ledger (first up-to-3 real requests on this
+        // socket) for the warmup→first-real continuity trace below. Warmup
+        // itself is excluded — this block only runs on the real send.
+        if (!Array.isArray(entry.earlyCacheMisses)) entry.earlyCacheMisses = [];
+        if (entry.earlyCacheMisses.length < 3) {
+            entry.earlyCacheMisses.push(
+                cacheObservation.actualMiss ? (cacheObservation.missReason || 'miss') : false,
+            );
+        }
+        const warmupContinuity = _warmupContinuityTrace({
+            warmupUsed: !!warmupResult,
+            warmupResponseId: warmupResult?.responseId || null,
+            priorEntryResponseId,
+            sentPrevResponseId,
+            earlyCacheMisses: entry.earlyCacheMisses,
+        });
         // Extra WS-specific observability: transport + per-iteration delta bytes.
         try {
             const transportPayload = {
@@ -1140,6 +1251,7 @@ export async function sendViaWebSocket({
                 frame_has_instructions: typeof frame.instructions === 'string' && frame.instructions.length > 0,
                 warmup_used: !!warmupResult,
                 warmup_response_id: warmupResult?.responseId || null,
+                ...warmupContinuity,
                 tool_call_count: resultToolCallCount,
                 keep_socket: keepSocket,
                 keep_response_chain: keepResponseChain,

package/src/runtime/agent/orchestrator/providers/openai-oauth.mjs

@@ -17,6 +17,7 @@ import { writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
 import { makeModelCache } from './model-cache.mjs';
 
 import { sendViaWebSocket } from './openai-oauth-ws.mjs';
+import { resolveOpenAiTransportPolicy } from './openai-transport-policy.mjs';
 import {
     buildStableProviderPromptCacheKey,
     resolveProviderPromptCacheLane,
@@ -398,9 +399,13 @@ function convertMessagesToResponsesInput(messages, opts = {}) {
     const out = [];
     const pendingToolMedia = [];
     const customToolCallNameById = new Map();
+    const wireParity = process.env.MIXDOG_OAI_CODEX_WIRE_PARITY === '1';
+    const wireMessage = (role, content) => (wireParity
+        ? { type: 'message', role, content, internal_chat_message_metadata_passthrough: {} }
+        : { role, content });
     const flushToolMedia = () => {
         if (!pendingToolMedia.length) return;
-        out.push({ role: 'user', content: pendingToolMedia.splice(0) });
+        out.push(wireMessage('user', pendingToolMedia.splice(0)));
     };
     for (const m of messages) {
         if (!m || m.role === 'system') continue;
@@ -442,7 +447,7 @@ function convertMessagesToResponsesInput(messages, opts = {}) {
             // for the WS_IDLE_MS window even after a socket close).
             // Server-side state already preserves the prefix; sending
             // reasoning in `input` triggers "Duplicate item".
-            if (m.content) out.push({ role: 'assistant', content: normalizeContentForOpenAIResponses(m.content, { role: 'assistant' }) });
+            if (m.content) out.push(wireMessage('assistant', normalizeContentForOpenAIResponses(m.content, { role: 'assistant' })));
             for (const tc of m.toolCalls) {
                 if (tc.nativeType === 'tool_search_call' || tc.name === 'load_tool' || tc.name === 'tool_search') {
                     out.push({
@@ -470,10 +475,10 @@ function convertMessagesToResponsesInput(messages, opts = {}) {
             }
             continue;
         }
-        out.push({
-            role: m.role === 'assistant' ? 'assistant' : 'user',
-            content: normalizeContentForOpenAIResponses(m.content, { role: m.role }),
-        });
+        out.push(wireMessage(
+            m.role === 'assistant' ? 'assistant' : 'user',
+            normalizeContentForOpenAIResponses(m.content, { role: m.role }),
+        ));
     }
     flushToolMedia();
     return out;
@@ -812,7 +817,9 @@ export class OpenAIOAuthProvider {
         // Fast-fallback is only meaningful when HTTP/SSE fallback is actually
         // configured for this provider; WS-only paths keep the full handshake
         // retry budget. This mirrors _shouldUseOpenAIHttpFallback's `enabled`.
-        const httpFallbackEnabled = _envFlag('MIXDOG_OPENAI_OAUTH_HTTP_FALLBACK', true);
+        const transportPolicy = resolveOpenAiTransportPolicy();
+        const httpFallbackEnabled = transportPolicy.allowHttpFallback
+            && _envFlag('MIXDOG_OPENAI_HTTP_FALLBACK', true);
         const _t1 = Date.now();
         const recordLiveModel = (result) => {
             if (result?.model && !_codexCatalogHas(result.model)) {
@@ -936,9 +943,12 @@ export class OpenAIOAuthProvider {
                 ? { ...body, generate: false }
                 : null,
         });
-        if (opts.forceHttpFallback === true
-            || httpFallbackActive()
-            || _envFlag('MIXDOG_OPENAI_OAUTH_FORCE_HTTP_FALLBACK', false)) {
+        if (transportPolicy.transport === 'http'
+            || (transportPolicy.allowHttpFallback && (
+                opts.forceHttpFallback === true
+                || httpFallbackActive()
+                || _envFlag('MIXDOG_OPENAI_OAUTH_FORCE_HTTP_FALLBACK', false)
+            ))) {
             return dispatchHttp('forced');
         }
 
@@ -970,7 +980,7 @@ export class OpenAIOAuthProvider {
                     return recordLiveModel(result);
                 } catch (retryErr) {
                     traceWsError(retryErr, 'auth_retry');
-                    if (_shouldUseOpenAIHttpFallback(retryErr, externalSignal)) {
+                    if (httpFallbackEnabled && _shouldUseOpenAIHttpFallback(retryErr, externalSignal)) {
                         try {
                             return await dispatchHttp(
                                 retryErr?.retryClassifier || retryErr?.code || retryErr?.message || 'ws_auth_retry_failed',
@@ -997,7 +1007,7 @@ export class OpenAIOAuthProvider {
                 await this._refreshModelCache();
                 return this.send(messages, model, tools, { ...opts, _modelRetry: true });
             }
-            if (_shouldUseOpenAIHttpFallback(err, externalSignal)) {
+            if (httpFallbackEnabled && _shouldUseOpenAIHttpFallback(err, externalSignal)) {
                 // Fast-path trace: the WS handshake acquire/first-byte failed on
                 // its FIRST attempt while fast-fallback was armed, so the
                 // remaining backoff retries were skipped and HTTP starts now.