mixdog 0.9.45 → 0.9.46

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-credentials.mjs

@@ -11,6 +11,7 @@ import { join, resolve } from 'path';
 import { createServer } from 'http';
 import { randomBytes, createHash } from 'crypto';
 import { writeJsonAtomicSync, withFileLock } from '../../../shared/atomic-file.mjs';
+import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
 import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
 
@@ -71,6 +72,8 @@ function _pushUnique(list, value) {
 }
 
 export function credentialCandidates() {
+    const bound = boundProviderAuthPath('anthropic-oauth');
+    if (bound) return [resolve(bound)];
     const explicit = process.env.ANTHROPIC_OAUTH_CREDENTIALS_PATH;
     if (explicit) return [resolve(explicit)];
     return [DEFAULT_CREDENTIALS_PATH];

package/src/runtime/agent/orchestrator/providers/anthropic-sse.mjs

@@ -83,6 +83,9 @@ function _anthropicSseError(event) {
 }
 
 export async function parseSSEStream(response, signal, abortStream, onStreamDelta, onToolCall, state, onTextDelta, knownToolNames) {
+    // parseSSEStream is entered only after Anthropic returned an HTTP response.
+    // Headers prove transport health, but are not a semantic model event.
+    try { onStreamDelta?.('transport'); } catch {}
     const reader = response.body.getReader();
     const decoder = new TextDecoder();
     // SEMANTIC idle window: reset only by real model events (message/content/
@@ -159,7 +162,7 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
         toolCalls.push(call);
         if (state) state.emittedToolCall = true;
         try { onToolCall?.(call); } catch {}
-        try { onStreamDelta?.(); } catch {}
+        try { onStreamDelta?.('tool'); } catch {}
     };
 
     // Feed accumulated text through the scanner. On `final` nothing is held
@@ -172,6 +175,7 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
         leakFenceState = fenceState;
         if (emit) {
             content += emit;
+            try { onStreamDelta?.('text'); } catch {}
             if (onTextDelta) {
                 if (state) state.emittedText = true;
                 try { onTextDelta(emit); } catch {}
@@ -327,6 +331,7 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
             }
             const { done, value } = chunk;
             if (done) break;
+            try { onStreamDelta?.('transport'); } catch {}
 
             buffer += decoder.decode(value, { stream: true });
             const lines = buffer.split('\n');
@@ -377,6 +382,7 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                     if (event.type === 'message_start' && event.message) {
                         clearFirstMessageTimer();
                         if (state) state.sawMessageStart = true;
+                        try { onStreamDelta?.('semantic'); } catch {}
                         if (event.message.model) model = event.message.model;
                         if (event.message.usage) {
                             usage.inputTokens = event.message.usage.input_tokens || 0;
@@ -405,6 +411,8 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                                     type: 'redacted_thinking',
                                     data: typeof block.data === 'string' ? block.data : '',
                                 });
+                                hasThinkingContent = true;
+                                try { onStreamDelta?.('reasoning'); } catch {}
                             } else {
                                 // Seed an ordered thinking block; deltas below
                                 // append text + signature into this same slot.
@@ -427,7 +435,6 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                         // ttftMs was always null and reported as 0ms.
                         if (state && !state.ttftAt) state.ttftAt = Date.now();
                         if (delta?.type === 'text_delta') {
-                            try { onStreamDelta?.(); } catch {}
                             // Live text relay (gateway): forward the explicit
                             // text chunk. thinking/signature/input_json deltas
                             // intentionally stay off this path.
@@ -450,6 +457,9 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                                     if (state) state.emittedText = true;
                                     try { onTextDelta(delta.text); } catch {}
                                 }
+                                if (delta.text) {
+                                    try { onStreamDelta?.('text'); } catch {}
+                                }
                             }
                         }
                         if (delta?.type === 'thinking_delta' || delta?.type === 'signature_delta') {
@@ -474,14 +484,17 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                             } else {
                                 tb.signature += delta.signature || '';
                             }
-                            try { onStreamDelta?.(); } catch {}
+                            if ((delta.type === 'thinking_delta' && delta.thinking)
+                                || (delta.type === 'signature_delta' && delta.signature)) {
+                                try { onStreamDelta?.('reasoning'); } catch {}
+                            }
                         }
                         if (delta?.type === 'input_json_delta') {
                             const pending = pendingToolInputs.get(event.index);
                             if (pending) {
                                 pending.inputJson += delta.partial_json || '';
                             }
-                            try { onStreamDelta?.(); } catch {}
+                            try { onStreamDelta?.('tool'); } catch {}
                         }
                     }
 
@@ -539,7 +552,7 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                                 // pending promises by call.id so order is safe.
                                 try { onToolCall?.(call); } catch {}
                             }
-                            try { onStreamDelta?.(); } catch {}
+                            try { onStreamDelta?.('tool'); } catch {}
                         }
                     }
 

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -1,5 +1,5 @@
 import { createRequire } from 'node:module';
-import { loadConfig } from '../config.mjs';
+import { getAgentApiKey } from '../../../shared/provider-api-key.mjs';
 import { sanitizeToolPairs, sanitizeAnthropicContentPairs, foldUserTextIntoToolResultTail } from '../session/context-utils.mjs';
 import { classifyError, midstreamBackoffFor, sleepWithAbort, withRetry, retryAfterMsFromError } from './retry-classifier.mjs';
 import { traceAgentUsage } from '../agent-trace.mjs';
@@ -538,11 +538,11 @@ export class AnthropicProvider {
     }
     reloadApiKey() {
         try {
-            const freshConfig = loadConfig();
-            const cfg = freshConfig.providers?.[this.name] || freshConfig.providers?.anthropic;
-            const newKey = cfg?.apiKey || this.config.apiKey || (this.name === 'anthropic' ? process.env.ANTHROPIC_API_KEY : null);
+            const newKey = getAgentApiKey(this.name)
+                || this.config.apiKey
+                || (this.name === 'anthropic' ? process.env.ANTHROPIC_API_KEY : null);
             if (newKey) {
-                this.config = { ...(this.config || {}), ...(cfg || {}), apiKey: newKey };
+                this.config = { ...(this.config || {}), apiKey: newKey };
                 const betaHeaders = this.config.disableBetaHeaders ? null : buildAnthropicBetaHeaders({ toolSearch: true });
                 this.client = new (loadAnthropic())({
                     apiKey: newKey,
@@ -564,7 +564,7 @@ export class AnthropicProvider {
         } catch (err) {
             if (err.message && (err.message.includes('401') || err.message.includes('403'))
                 && !err.liveTextEmitted && !err.emittedToolCall && !err.unsafeToRetry) {
-                process.stderr.write(`[provider] Auth error, re-reading config...\n`);
+                process.stderr.write(`[provider] Auth error, re-reading provider authentication...\n`);
                 this.reloadApiKey();
                 return await this._doSend(messages, model, tools, sendOpts);
             }

package/src/runtime/agent/orchestrator/providers/gemini.mjs

@@ -1,5 +1,5 @@
 import { GoogleGenerativeAI } from '@google/generative-ai';
-import { loadConfig } from '../config.mjs';
+import { getAgentApiKey } from '../../../shared/provider-api-key.mjs';
 import { makeModelCache } from './model-cache.mjs';
 import { withRetry } from './retry-classifier.mjs';
 import { traceAgentUsage, appendAgentTrace } from '../agent-trace.mjs';
@@ -151,14 +151,14 @@ export class GeminiProvider {
 
     reloadApiKey() {
         try {
-            const freshConfig = loadConfig();
-            const cfg = freshConfig.providers?.gemini;
-            const newKey = cfg?.apiKey || process.env.GEMINI_API_KEY;
+            const newKey = getAgentApiKey('gemini')
+                || this.config?.apiKey
+                || process.env.GEMINI_API_KEY;
             if (newKey) {
                 // Keep this.config in sync so REST/cache paths (which read the
                 // key via _getApiKey() → this.config.apiKey) don't keep using
                 // the stale key after a rotation; genAI alone is not enough.
-                this.config = { ...(this.config || {}), ...(cfg || {}), apiKey: newKey };
+                this.config = { ...(this.config || {}), apiKey: newKey };
                 this.genAI = new GoogleGenerativeAI(newKey);
             }
         } catch { /* best effort */ }
@@ -481,7 +481,7 @@ export class GeminiProvider {
                 if (err.liveTextEmitted === true || err.emittedToolCall === true || err.unsafeToRetry === true) {
                     throw err;
                 }
-                process.stderr.write(`[provider] Auth error, re-reading config...\n`);
+                process.stderr.write(`[provider] Auth error, re-reading provider authentication...\n`);
                 this.reloadApiKey();
                 return await this._doSend(messages, model, tools, sendOpts);
             }

package/src/runtime/agent/orchestrator/providers/grok-oauth.mjs

@@ -20,9 +20,10 @@
 import { createServer } from 'http';
 import { randomBytes, createHash } from 'crypto';
 import { readFileSync, existsSync, mkdirSync, statSync, unlinkSync } from 'fs';
-import { join } from 'path';
+import { join, resolve } from 'path';
 import { getPluginData } from '../config.mjs';
 import { writeJsonAtomicSync, withFileLock } from '../../../shared/atomic-file.mjs';
+import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
 import { enrichModels, getModelMetadataSync } from './model-catalog.mjs';
 import { sanitizeModelList } from './model-list-sanitize.mjs';
 import { makeModelCache } from './model-cache.mjs';
@@ -175,6 +176,10 @@ async function fetchDiscovery() {
 
 // --- Token store ---
 function getOwnTokenPath() {
+    const bound = boundProviderAuthPath('grok-oauth');
+    if (bound) return resolve(bound);
+    const explicit = process.env.GROK_OAUTH_CREDENTIALS_PATH;
+    if (explicit) return resolve(explicit);
     const dir = getPluginData();
     if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
     return join(dir, 'grok-oauth.json');
@@ -579,6 +584,120 @@ export async function ensureLatestGrokModel(provider) {
 
 let _modelRefreshInFlight = null;
 
+// Grok's gRPC tool registry rejects a root anyOf/oneOf when even one branch is
+// not an object. Keep this adapter local to OAuth Grok requests: other
+// providers may support the original union schema. Tool definitions are never
+// mutated, so callers can safely reuse them for later requests.
+function schemasDeepEqual(left, right) {
+    if (Object.is(left, right)) return true;
+    if (!left || !right || typeof left !== 'object' || typeof right !== 'object') return false;
+    if (Array.isArray(left) || Array.isArray(right)) {
+        return Array.isArray(left) && Array.isArray(right)
+            && left.length === right.length
+            && left.every((value, index) => schemasDeepEqual(value, right[index]));
+    }
+    const leftKeys = Object.keys(left).sort();
+    const rightKeys = Object.keys(right).sort();
+    return leftKeys.length === rightKeys.length
+        && leftKeys.every((key, index) => key === rightKeys[index]
+            && schemasDeepEqual(left[key], right[key]));
+}
+
+function pureAnyOfAlternatives(schema) {
+    return schema && typeof schema === 'object' && !Array.isArray(schema)
+        && Object.keys(schema).length === 1
+        && Array.isArray(schema.anyOf)
+        ? schema.anyOf
+        : [schema];
+}
+
+function mergeGrokObjectBranchProperties(objectBranches) {
+    const properties = {};
+    for (const branch of objectBranches) {
+        for (const [name, schema] of Object.entries(branch.properties || {})) {
+            if (!Object.prototype.hasOwnProperty.call(properties, name)) {
+                properties[name] = schema;
+                continue;
+            }
+            if (schemasDeepEqual(properties[name], schema)) continue;
+            const alternatives = [
+                ...pureAnyOfAlternatives(properties[name]),
+                ...pureAnyOfAlternatives(schema),
+            ];
+            const deduped = alternatives.reduce(
+                (unique, alternative) => unique.some(item => schemasDeepEqual(item, alternative))
+                    ? unique
+                    : [...unique, alternative],
+                [],
+            );
+            properties[name] = deduped.length === 1 ? deduped[0] : { anyOf: deduped };
+        }
+    }
+    return properties;
+}
+
+function normalizeGrokToolSchema(schema) {
+    if (!schema || typeof schema !== 'object' || Array.isArray(schema)
+        || (!Array.isArray(schema.anyOf) && !Array.isArray(schema.oneOf))) {
+        return schema;
+    }
+
+    const { anyOf, oneOf, ...root } = schema;
+    const branches = [...(Array.isArray(anyOf) ? anyOf : []), ...(Array.isArray(oneOf) ? oneOf : [])];
+    const objectBranches = branches.filter((branch) => branch && typeof branch === 'object' && !Array.isArray(branch)
+        && (branch.type === 'object'
+            || (Array.isArray(branch.type) && branch.type.includes('object'))
+            || (branch.properties && typeof branch.properties === 'object')));
+
+    // A function's arguments must be an object even if its original union has
+    // no explicit object alternative. The permissive fallback still retains
+    // root-level metadata such as description and additionalProperties.
+    if (!objectBranches.length) {
+        return {
+            ...root,
+            type: 'object',
+            ...(!Object.prototype.hasOwnProperty.call(root, 'additionalProperties')
+                ? { additionalProperties: true }
+                : {}),
+        };
+    }
+
+    const properties = objectBranches.some(branch => branch.properties) || root.properties
+        ? {
+            ...mergeGrokObjectBranchProperties(objectBranches),
+            ...(root.properties || {}),
+        }
+        : undefined;
+    const branchRequiredInEvery = (Array.isArray(objectBranches[0].required) ? objectBranches[0].required : [])
+        .filter(key => objectBranches.every(branch => Array.isArray(branch.required) && branch.required.includes(key)));
+    const required = [...new Set([
+        ...(Array.isArray(root.required) ? root.required : []),
+        ...branchRequiredInEvery,
+    ])];
+    const { properties: _rootProperties, required: _rootRequired, ...rootWithoutPropertiesOrRequired } = root;
+    const mergedObjectBranches = Object.assign({}, ...objectBranches);
+    const {
+        properties: _branchProperties,
+        required: _branchRequired,
+        ...mergedObjectBranchesWithoutPropertiesOrRequired
+    } = mergedObjectBranches;
+    return {
+        ...mergedObjectBranchesWithoutPropertiesOrRequired,
+        ...rootWithoutPropertiesOrRequired,
+        type: 'object',
+        ...(properties ? { properties } : {}),
+        ...(required.length ? { required } : {}),
+    };
+}
+
+function normalizeGrokToolSchemas(tools) {
+    if (!Array.isArray(tools)) return tools;
+    return tools.map((tool) => {
+        const inputSchema = normalizeGrokToolSchema(tool?.inputSchema);
+        return inputSchema === tool?.inputSchema ? tool : { ...tool, inputSchema };
+    });
+}
+
 export class GrokOAuthProvider {
     // OpenAI-compatible usage: prompt_tokens includes cached. See registry.mjs.
     static inputExcludesCache = false;
@@ -692,6 +811,7 @@ export class GrokOAuthProvider {
         );
         const tokens = await this.ensureAuth();
         const inner = this._ensureInner(tokens.access_token, useModel);
+        const grokTools = normalizeGrokToolSchemas(tools);
         try {
             // Call _doSend directly, bypassing OpenAICompatProvider.send()'s
             // own 401 handler — that one reloads a static apiKey from config,
@@ -699,7 +819,7 @@ export class GrokOAuthProvider {
             // Caller's model passes through (or catalog-top default), with
             // retired aliases normalized. api.x.ai exposes the full grok-4.x
             // catalog to this token — no single-model lock.
-            return await inner._doSend(messages, useModel, tools, sendOpts);
+            return await inner._doSend(messages, useModel, grokTools, sendOpts);
         } catch (err) {
             // Refresh-and-retry only on 401 (stale/expired access token).
             // Resolve the status from the structured field (falling back to the
@@ -712,7 +832,7 @@ export class GrokOAuthProvider {
                 process.stderr.write('[grok-oauth] 401, force-refreshing token...\n');
                 const fresh = await this.ensureAuth({ forceRefresh: true });
                 const retryInner = this._ensureInner(fresh.access_token, useModel);
-                return await retryInner._doSend(messages, useModel, tools, sendOpts);
+                return await retryInner._doSend(messages, useModel, grokTools, sendOpts);
             }
             throw err;
         }

package/src/runtime/agent/orchestrator/providers/oauth-credential-probes.mjs

@@ -58,7 +58,10 @@ export function hasAnthropicOAuthCredentials() {
 
 export function hasOpenAIOAuthCredentials() {
   return memoProbe('openai-oauth', () => {
-    const paths = [join(resolvePluginData(), 'openai-oauth.json')];
+    const paths = [
+      process.env.OPENAI_OAUTH_CREDENTIALS_PATH,
+      join(resolvePluginData(), 'openai-oauth.json'),
+    ].filter(Boolean);
     for (const path of paths) {
         const raw = readJsonIfExists(path);
         if (raw?.access_token && raw?.refresh_token) return true;
@@ -69,7 +72,13 @@ export function hasOpenAIOAuthCredentials() {
 
 export function hasGrokOAuthCredentials() {
   return memoProbe('grok-oauth', () => {
-    const own = readJsonIfExists(join(resolvePluginData(), 'grok-oauth.json'));
-    return !!(own?.access_token && own?.refresh_token);
+    const paths = [
+      process.env.GROK_OAUTH_CREDENTIALS_PATH,
+      join(resolvePluginData(), 'grok-oauth.json'),
+    ].filter(Boolean);
+    return paths.some((path) => {
+      const own = readJsonIfExists(path);
+      return !!(own?.access_token && own?.refresh_token);
+    });
   });
 }