mixdog 0.9.41 → 0.9.44

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -6,6 +6,8 @@ import { randomUUID } from 'crypto';
 import { smartReadTruncate } from '../tools/builtin/read-formatting.mjs';
 import { shutdownStdioChild, killStdioChildTreeFast } from './child-tree.mjs';
 import { readServicePort, markServiceUnreachable, isConnRefuseError } from '../../../shared/service-discovery.mjs';
+import { makeToolEnvelope, normalizeToolEnvelope } from '../session/tool-envelope.mjs';
+import { classifyResultKind } from '../session/result-classification.mjs';
 // --- Types ---
 /** Known auto-detect targets: port file path relative to tmpdir.
  *  Note: `mixdog` used to self-loopback via active-instance.json's
@@ -215,6 +217,16 @@ export async function executeMcpTool(name, args) {
             throw new Error(`Tool call failed: ${firstMsg}; retry after reconnect also failed: ${retryMsg}`);
         }
     }
+    const normalized = normalizeToolEnvelope(normalizeMcpToolResult(result));
+    const text = capMcpOutput(normalized.result);
+    return normalized.explicitSuccess
+        ? makeToolEnvelope(text, [], { explicitSuccess: true })
+        : text;
+}
+
+// Preserve MCP failure metadata across the object→string boundary. The
+// session loop classifies the canonical Error: prefix as toolKind:error.
+export function normalizeMcpToolResult(result) {
     const content = result.content;
     let text;
     if (Array.isArray(content)) {
@@ -224,7 +236,11 @@ export async function executeMcpTool(name, args) {
     } else {
         text = typeof content === 'string' ? content : JSON.stringify(content);
     }
-    return capMcpOutput(text);
+    if (result.isError === true) return !text.startsWith('Error:') ? `Error: ${text}` : text;
+    if (result.isError === false && classifyResultKind(text) === 'error') {
+        return makeToolEnvelope(text, [], { explicitSuccess: true });
+    }
+    return text;
 }
 
 // MCP per-tool-call timeout. Default 2min: a hung/unresponsive MCP server

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-credentials.mjs

@@ -53,7 +53,10 @@ const OAUTH_SUCCESS_REDIRECT_URL = process.env.ANTHROPIC_OAUTH_SUCCESS_REDIRECT_
 const OAUTH_LOGIN_TIMEOUT_MS = 5 * 60_000;
 const OAUTH_TOKEN_TIMEOUT_MS = 30_000;
 
-export const DEFAULT_CLI_VERSION = '2.1.77';
+// Anthropic's token edge validates the Claude Code client identity. Keep this
+// fallback aligned with the current official CLI while retaining the env
+// override for seats where Claude Code is updated ahead of Mixdog.
+export const DEFAULT_CLI_VERSION = '2.1.207';
 
 export function resolveCliVersion() {
     return process.env.MIXDOG_CLI_VERSION
@@ -210,14 +213,41 @@ export function _normalizeExpiresAt(value) {
     return value < 1e12 ? value * 1000 : value;
 }
 
-export function _scrubTokens(text) {
-    return String(text || '')
-        .replace(/Bearer [A-Za-z0-9._\-]+/g, 'Bearer [REDACTED]')
+export function _scrubTokens(text, secretValues = []) {
+    let scrubbed = String(text || '')
+        .replace(/Bearer [A-Za-z0-9._\-]+/gi, 'Bearer [REDACTED]')
         .replace(/sk-ant-[A-Za-z0-9._\-]+/g, '[REDACTED]')
         .replace(/"access[Tt]oken"\s*:\s*"[^"]+"/g, '"accessToken":"[REDACTED]"')
         .replace(/"refresh[Tt]oken"\s*:\s*"[^"]+"/g, '"refreshToken":"[REDACTED]"')
         .replace(/"access_token"\s*:\s*"[^"]+"/g, '"access_token":"[REDACTED]"')
         .replace(/"refresh_token"\s*:\s*"[^"]+"/g, '"refresh_token":"[REDACTED]"');
+    // Token services sometimes echo submitted values in non-JSON diagnostics.
+    // Scrub the exact request secrets as a final guard without logging them.
+    for (const secret of secretValues) {
+        if (typeof secret === 'string' && secret) {
+            scrubbed = scrubbed.split(secret).join('[REDACTED]');
+        }
+    }
+    return scrubbed;
+}
+
+function _tokenEndpointError(operation, status, text, secretValues = []) {
+    const safeDetail = _scrubTokens(text, secretValues)
+        .replace(/\s+/g, ' ')
+        .trim()
+        .slice(0, 500);
+    const detail = safeDetail ? `: ${safeDetail}` : '';
+    const compatibility = status === 403
+        ? (
+            ` Anthropic returned HTTP 403 for a request sent as claude-cli/${resolveCliVersion()}.`
+            + ' Possible causes include OAuth client compatibility, account or scope policy,'
+            + ' an intercepting proxy/VPN/WAF, or regional endpoint restrictions.'
+            + ' Verify the account has Claude Code access and the required scopes;'
+            + ' update Mixdog or set MIXDOG_CLI_VERSION to the installed official Claude Code version;'
+            + ' then retry sign-in via /providers without an intercepting network layer if applicable.'
+        )
+        : '';
+    return new Error(`${operation} ${status}${detail}.${compatibility}`);
 }
 
 export function isAnthropicOAuthRefreshDisabled() {
@@ -261,7 +291,15 @@ async function _refreshOAuthCredentialsUnlocked(creds) {
         try { json = text ? JSON.parse(text) : null; } catch { /* handled below */ }
         if (!res.ok) {
             const isInvalidGrant = text.includes('invalid_grant') || json?.error === 'invalid_grant';
-            throw Object.assign(new Error(`token refresh ${res.status}: ${_scrubTokens(text).slice(0, 200)}`), { isInvalidGrant });
+            throw Object.assign(
+                _tokenEndpointError(
+                    'token refresh',
+                    res.status,
+                    text,
+                    [creds.refreshToken, creds.accessToken],
+                ),
+                { isInvalidGrant },
+            );
         }
 
         const accessToken = json?.access_token || json?.accessToken;
@@ -495,7 +533,12 @@ async function exchangeAuthorizationCode({ pkce, code, state, redirectUri }) {
     });
     if (!tokenRes.ok) {
         const text = await tokenRes.text().catch(() => '');
-        throw new Error(`[anthropic-oauth] token exchange ${tokenRes.status}: ${_scrubTokens(text).slice(0, 500)}`);
+        throw _tokenEndpointError(
+            '[anthropic-oauth] token exchange',
+            tokenRes.status,
+            text,
+            [cleanCode, pkce.verifier, state],
+        );
     }
     const json = await tokenRes.json();
     const accessToken = json?.access_token || json?.accessToken;

package/src/runtime/agent/orchestrator/providers/anthropic-sse.mjs

@@ -111,6 +111,7 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
     let toolCalls = [];
     let usage = { inputTokens: 0, outputTokens: 0, cachedTokens: 0, cacheWriteTokens: 0, raw: null };
     let stopReason = null;
+    let stopDetails;
     let buffer = '';
     let idleTimedOut = false;
     let firstMessageTimedOut = false;
@@ -546,6 +547,18 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                         if (event.delta?.stop_reason) {
                             stopReason = event.delta.stop_reason;
                         }
+                        if (event.delta && (event.delta.stop_details != null || event.delta.category != null)) {
+                            const details = event.delta.stop_details;
+                            stopDetails = details && typeof details === 'object' && !Array.isArray(details)
+                                ? {
+                                    ...details,
+                                    ...(event.delta.category != null ? { category: event.delta.category } : {}),
+                                }
+                                : {
+                                    ...(details != null ? { value: details } : {}),
+                                    ...(event.delta.category != null ? { category: event.delta.category } : {}),
+                                };
+                        }
                         if (event.usage) {
                             usage.outputTokens = event.usage.output_tokens || 0;
                             usage.raw = { ...(usage.raw || {}), ...event.usage };
@@ -615,6 +628,7 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
             toolCalls: toolCalls.length ? toolCalls : undefined,
             usage,
             stopReason,
+            stopDetails,
             hasThinkingContent,
             contentBlockTypes: Array.from(contentBlockTypes),
             // Ordered extended-thinking blocks (verbatim thinking text +

package/src/runtime/agent/orchestrator/providers/grok-oauth.mjs

@@ -22,7 +22,7 @@ import { randomBytes, createHash } from 'crypto';
 import { readFileSync, existsSync, mkdirSync, statSync, unlinkSync } from 'fs';
 import { join } from 'path';
 import { getPluginData } from '../config.mjs';
-import { writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
+import { writeJsonAtomicSync, withFileLock } from '../../../shared/atomic-file.mjs';
 import { enrichModels, getModelMetadataSync } from './model-catalog.mjs';
 import { sanitizeModelList } from './model-list-sanitize.mjs';
 import { makeModelCache } from './model-cache.mjs';
@@ -180,6 +180,10 @@ function getOwnTokenPath() {
     return join(dir, 'grok-oauth.json');
 }
 
+function getRefreshLockPath() {
+    return `${getOwnTokenPath()}.refresh.lock`;
+}
+
 // expires_at may arrive as a unix number or an ISO-8601 string. Normalize both
 // to epoch milliseconds; 0 means unknown.
 function _normalizeExpiresAt(value) {
@@ -369,32 +373,53 @@ async function _postRefresh(tokens) {
     }
 }
 
-// 16 mixdog processes share one grok-oauth.json and xAI rotates refresh
-// tokens single-use. Re-read the store immediately before the network POST so
-// a peer's just-completed rotation is adopted instead of spending our
-// (now-stale) refresh_token; on invalid_grant, re-read once and retry with a
-// peer-rotated refresh_token before propagating.
+// Mixdog processes share one grok-oauth.json and xAI rotates refresh tokens
+// single-use. Hold a cross-process lease across the re-read, exchange, and
+// atomic save so only one process can spend a generation.
 async function refreshTokens(tokens, { force = false } = {}) {
     if (!tokens?.refresh_token) {
         throw new Error('[grok-oauth] refresh token not available — open /providers in mixdog to sign in again');
     }
-    const disk = _loadOwnTokens();
-    const validAfter = Date.now() + (force ? 0 : TOKEN_REFRESH_SKEW_MS);
-    if (disk?.access_token && disk.access_token !== tokens.access_token
-        && (!disk.expires_at || disk.expires_at >= validAfter)) {
-        return disk;
-    }
-    try {
-        return await _postRefresh(tokens);
-    } catch (err) {
-        if (err?.isInvalidGrant) {
-            const rotated = _loadOwnTokens();
-            if (rotated?.refresh_token && rotated.refresh_token !== tokens.refresh_token) {
-                return await _postRefresh(rotated);
+
+    return withFileLock(getRefreshLockPath(), async () => {
+        const validAfter = Date.now() + (force ? 0 : TOKEN_REFRESH_SKEW_MS);
+        const disk = _loadOwnTokens();
+        // A waiter that entered with the prior generation adopts the winner's
+        // persisted, valid token instead of rotating it again. xAI may rotate
+        // only the refresh token while reissuing the same access token.
+        const diskGenerationChanged = disk?.access_token
+            && (disk.access_token !== tokens.access_token
+                || disk.refresh_token !== tokens.refresh_token);
+        if (diskGenerationChanged
+            && (!disk.expires_at || disk.expires_at >= validAfter)) {
+            return disk;
+        }
+
+        const current = disk || tokens;
+        try {
+            return await _postRefresh(current);
+        } catch (err) {
+            if (err?.isInvalidGrant) {
+                // A writer that does not participate in this lease may still
+                // have won the rotation while the request was in flight.
+                // Adopt its valid generation; only exchange it when it cannot
+                // satisfy this caller.
+                const rotated = _loadOwnTokens();
+                if (rotated?.refresh_token && rotated.refresh_token !== current.refresh_token) {
+                    if (rotated.access_token
+                        && (!rotated.expires_at || rotated.expires_at >= validAfter)) {
+                        return rotated;
+                    }
+                    return await _postRefresh(rotated);
+                }
             }
+            throw err;
         }
-        throw err;
-    }
+    }, {
+        timeoutMs: 120_000,
+        staleMs: 120_000,
+        secret: true,
+    });
 }
 
 // --- Model catalog cache (24h disk TTL) ---

package/src/runtime/agent/orchestrator/providers/media-normalization.mjs

@@ -1,3 +1,5 @@
+import { createHash } from 'node:crypto';
+
 const DEFAULT_IMAGE_MIME = 'image/png';
 
 function cleanMimeType(value) {
@@ -96,6 +98,9 @@ function contentParts(content) {
     if (content && typeof content === 'object' && Array.isArray(content.content)) {
         return content.content;
     }
+    if (content && typeof content === 'object'
+        && (imageUrlFromPart(content) || imageFileIdFromPart(content)
+            || imageFileUriFromPart(content) || geminiInlineInfo(content))) return [content];
     return null;
 }
 
@@ -108,9 +113,61 @@ function jsonFallbackFromPart(block) {
 }
 
 export function contentHasImage(content) {
+    return contentImageCount(content) > 0;
+}
+
+export function contentImageCount(content) {
+    return contentImageDescriptors(content).length;
+}
+
+function positiveDimension(...values) {
+    for (const value of values) {
+        const number = Number(value);
+        if (Number.isFinite(number) && number > 0) return number;
+    }
+    return null;
+}
+
+function imageIdentity(kind, value, mimeType = '') {
+    return createHash('sha256')
+        .update(`${kind}\0${mimeType}\0`)
+        .update(String(value || ''))
+        .digest('hex');
+}
+
+function imageDescriptor(part) {
+    if (!part || typeof part !== 'object') return null;
+    const info = imageInfo(part);
+    const inline = geminiInlineInfo(part);
+    const url = imageUrlFromPart(part);
+    const fileId = imageFileIdFromPart(part);
+    const fileUri = imageFileUriFromPart(part);
+    if (!info && !inline && !url && !fileId && !fileUri) return null;
+    const imageUrl = part.image_url && typeof part.image_url === 'object' ? part.image_url : null;
+    const source = part.source && typeof part.source === 'object' ? part.source : null;
+    const inlineData = part.inlineData || part.inline_data;
+    const dimensions = part.dimensions && typeof part.dimensions === 'object' ? part.dimensions : null;
+    const width = positiveDimension(part.width, dimensions?.width, imageUrl?.width, source?.width, inlineData?.width);
+    const height = positiveDimension(part.height, dimensions?.height, imageUrl?.height, source?.height, inlineData?.height);
+    const detail = String(part.detail ?? imageUrl?.detail ?? source?.detail ?? inlineData?.detail ?? 'auto').toLowerCase();
+    if (info || inline) {
+        const raw = info || inline;
+        return {
+            identity: imageIdentity('inline', raw.data, raw.mimeType),
+            width,
+            height,
+            detail,
+        };
+    }
+    if (fileId) return { identity: imageIdentity('file-id', fileId), width, height, detail };
+    if (fileUri) return { identity: imageIdentity('file-uri', fileUri.fileUri, fileUri.mimeType), width, height, detail };
+    return { identity: imageIdentity('url', url), width, height, detail };
+}
+
+export function contentImageDescriptors(content) {
     const parts = contentParts(content);
-    if (!parts) return false;
-    return parts.some((part) => !!imageUrlFromPart(part) || !!imageFileIdFromPart(part) || !!imageFileUriFromPart(part) || !!geminiInlineInfo(part));
+    if (!parts) return [];
+    return parts.map(imageDescriptor).filter(Boolean);
 }
 
 export function contentToText(content, fallback = '') {

package/src/runtime/agent/orchestrator/providers/retry-classifier.mjs

@@ -325,7 +325,11 @@ function _classifyMidstreamWs(err, state, attemptIndex, policy) {
   }
   if (!state.sawResponseCreated) {
     const closeCode = Number(err?.wsCloseCode || state.wsCloseCode || 0)
-    if (closeCode !== 1011 && closeCode !== 1012) return null
+    // An abnormal close before response.created has not produced any response
+    // bytes to the caller. It is therefore safe to reconnect and replay under
+    // the normal ws_1006 bounded retry policy (text/tool emission was denied
+    // above before reaching this gate).
+    if (closeCode !== 1006 && closeCode !== 1011 && closeCode !== 1012) return null
   }
   if (state.userAbort) return null
 

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -145,6 +145,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
     let lastUsage;
     let firstTurnUsage;
     let response;
+    let lastSendTools = tools;
     let contextOverflowRetryUsed = false;
     // Set when the hard iteration-cap break below fires. Consumed at the final
     // return to tag terminationReason='iteration_cap' so a worker that exhausts
@@ -281,6 +282,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
     // the loop as an explicit empty termination instead.
     let _emptyNudgeStreak = 0;
     const EMPTY_NUDGE_MAX = 3;
+    let _refusalRetryUsed = false;
     let _maxOutputRecoveryCount = 0;
     const _maxOutputContentParts = [];
     // Claude Code parity: queued prompt/task notifications are attached after a
@@ -435,6 +437,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         const sendTools = _capFinalToolsDisabled
             ? tools
             : (forcedFirstToolDef && toolCallsTotal === 0 ? [forcedFirstToolDef] : tools);
+        lastSendTools = sendTools;
         // Eager-dispatch queue: when the provider streams a tool-call event,
         // start read-only tools immediately so execution overlaps with the
         // remaining SSE parse. Writes and unknown tools wait until send()
@@ -572,6 +575,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                     // additive — callers that ignore these fields keep working.
                     deltaCachedRead: response.usage.cachedTokens || 0,
                     deltaCacheWrite: response.usage.cacheWriteTokens || 0,
+                    sendTools,
                     ts: Date.now(),
                 });
             } catch { /* best-effort — never break the loop */ }
@@ -633,6 +637,19 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                 };
                 break;
             }
+            if (!hasContent && stopReason === 'refusal') {
+                if (_refusalRetryUsed) {
+                    process.stderr.write(`[loop] safety-classifier refusal persisted after one context-changing retry (sess=${sessionId || 'unknown'}); ending loop as refusal termination.\n`);
+                    break;
+                }
+                _refusalRetryUsed = true;
+                messages.push({
+                    role: 'user',
+                    content: '[mixdog-runtime] The previous completion was refused by the provider safety classifier (stopReason=refusal). Do not repeat it. Complete your assigned output within policy by omitting or reframing disallowed content; if no compliant output is possible, briefly state the refusal.',
+                    meta: { source: 'refusal-recovery', attempt: 1 },
+                });
+                continue;
+            }
             if (!hasContent && !isHidden) {
                 _emptyNudgeStreak += 1;
                 if (_emptyNudgeStreak > EMPTY_NUDGE_MAX) {
@@ -751,6 +768,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         ...response,
         usage: lastUsage || response.usage,
         lastTurnUsage: response.usage,
+        lastSendTools,
         firstTurnUsage: firstTurnUsage || response.usage,
         iterations,
         toolCallsTotal,