mixdog 0.9.47 → 0.9.50

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -246,7 +246,7 @@ function _sanitizeInputSchema(schema, toolName) {
     // None of the branches' required lists are hoisted — callers that relied
     // on discriminated-union semantics will still function; the model simply
     // receives a union of the property surface with no hard-required constraint.
-    const mergedProps = {};
+    const mergedProps = { ...(schema.properties && typeof schema.properties === 'object' ? schema.properties : {}) };
     const branchDescs = [];
     for (const branch of Array.isArray(compound) ? compound : []) {
         if (branch && typeof branch === 'object' && branch.properties) {
@@ -317,7 +317,26 @@ function nativeAnthropicTools(opts) {
 function toAnthropicToolChoice(toolChoice) {
     return toolChoice === 'none' ? { type: 'none' } : undefined;
 }
-function deferredAnthropicTools(activeTools, opts) {
+function discoveredAnthropicToolNames(messages, opts, provider) {
+    const anthropicNative = new Set(['anthropic', 'anthropic-oauth']);
+    const discovered = new Set(
+        Array.isArray(opts?.session?.deferredDiscoveredTools)
+            ? opts.session.deferredDiscoveredTools.map((name) => String(name || '').trim()).filter(Boolean)
+            : [],
+    );
+    for (const message of Array.isArray(messages) ? messages : []) {
+        const native = message?.nativeToolSearch;
+        const source = String(native?.provider || '').toLowerCase();
+        if (source && source !== provider
+            && !(anthropicNative.has(source) && anthropicNative.has(provider))) continue;
+        for (const name of Array.isArray(native?.toolReferences) ? native.toolReferences : []) {
+            const key = String(name || '').trim();
+            if (key) discovered.add(key);
+        }
+    }
+    return discovered;
+}
+function deferredAnthropicTools(activeTools, messages, opts) {
     if (opts?.session?.deferredNativeTools !== true) return [];
     // A request whose ONLY tools are deferred is rejected by the API with
     // `400: At least one tool must have defer_loading=false` — happens on the
@@ -325,9 +344,10 @@ function deferredAnthropicTools(activeTools, opts) {
     // No active tools ⇒ send no deferred catalog either.
     if (!Array.isArray(activeTools) || activeTools.length === 0) return [];
     const active = new Set((activeTools || []).map((tool) => String(tool?.name || '').trim()).filter(Boolean));
+    const discovered = discoveredAnthropicToolNames(messages, opts, 'anthropic-oauth');
     const catalog = Array.isArray(opts.session.deferredToolCatalog) ? opts.session.deferredToolCatalog : [];
     return catalog
-        .filter((tool) => tool?.name && !active.has(String(tool.name)))
+        .filter((tool) => tool?.name && discovered.has(String(tool.name)) && !active.has(String(tool.name)))
         .map((tool) => ({ ...tool, deferLoading: true }));
 }
 
@@ -374,15 +394,19 @@ function toAnthropicMessages(messages) {
 
         if (m.role === 'tool') {
             const last = result[result.length - 1];
-            // Do not replay native deferred-loader `tool_reference` blocks from
-            // prior turns. They are tied to the exact Anthropic deferred-tool
-            // request that produced them; after /model or provider switches the
-            // new request may not carry the matching deferred tool surface and
-            // Anthropic rejects the history as a request validation error.
+            const native = m.nativeToolSearch;
+            const nativeProvider = String(native?.provider || '').toLowerCase();
+            const anthropicNative = new Set(['anthropic', 'anthropic-oauth']);
+            const references = (!nativeProvider || anthropicNative.has(nativeProvider))
+                && Array.isArray(native?.toolReferences)
+                ? native.toolReferences.map((name) => String(name || '').trim()).filter(Boolean)
+                : [];
             const block = {
                 type: 'tool_result',
                 tool_use_id: m.toolCallId || '',
-                content: normalizeContentForAnthropic(m.content),
+                content: references.length
+                    ? references.map((tool_name) => ({ type: 'tool_reference', tool_name }))
+                    : normalizeContentForAnthropic(m.content),
             };
             if (last?.role === 'user' && Array.isArray(last.content)) {
                 last.content.push(block);
@@ -627,7 +651,7 @@ function buildRequestBody(messages, model, tools, sendOpts) {
     if (systemBlocks.length) body.system = systemBlocks;
 
     const nativeTools = nativeAnthropicTools(opts);
-    const deferredTools = deferredAnthropicTools(tools || [], opts);
+    const deferredTools = deferredAnthropicTools(tools || [], chatMsgs, opts);
     if (tools?.length || nativeTools.length || deferredTools.length) {
         // No cache_control on tools — the systemBase BP already covers the
         // tools prefix via Anthropic's prompt cache prefix semantics (order:
@@ -1329,4 +1353,4 @@ export { parseSSEStream, _classifyMidstreamError, ANTHROPIC_MAX_MIDSTREAM_RETRIE
 
 // Test-only escape hatch for scripts/tool-smoke.mjs to verify the
 // catalog-driven max-tokens resolution without duplicating its logic.
-export const _test = { resolveMaxTokens };
+export const _test = { resolveMaxTokens, deferredAnthropicTools, sanitizeInputSchema: _sanitizeInputSchema };

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -231,7 +231,7 @@ function resolveMaxTokens(model) {
 }
 
 // Test-only escape hatch for scripts/anthropic-maxtokens-test.mjs.
-export const _test = { resolveMaxTokens };
+export const _test = { resolveMaxTokens, deferredAnthropicTools, sanitizeInputSchema: _sanitizeInputSchema };
 
 const MIN_THINKING_BUDGET = 1024;
 const THINKING_OUTPUT_RESERVE = 1024;
@@ -252,7 +252,7 @@ function _sanitizeInputSchema(schema, toolName) {
     }
     const compound = schema.oneOf || schema.anyOf || schema.allOf;
     if (!compound) return structuredClone(schema);
-    const mergedProps = {};
+    const mergedProps = { ...(schema.properties && typeof schema.properties === 'object' ? schema.properties : {}) };
     const branchDescs = [];
     for (const branch of Array.isArray(compound) ? compound : []) {
         if (branch && typeof branch === 'object' && branch.properties) {
@@ -324,16 +324,36 @@ function nativeAnthropicTools(opts) {
 function toAnthropicToolChoice(toolChoice) {
     return toolChoice === 'none' ? { type: 'none' } : undefined;
 }
-function deferredAnthropicTools(activeTools, opts) {
+function discoveredAnthropicToolNames(messages, opts, provider) {
+    const anthropicNative = new Set(['anthropic', 'anthropic-oauth']);
+    const discovered = new Set(
+        Array.isArray(opts?.session?.deferredDiscoveredTools)
+            ? opts.session.deferredDiscoveredTools.map((name) => String(name || '').trim()).filter(Boolean)
+            : [],
+    );
+    for (const message of Array.isArray(messages) ? messages : []) {
+        const native = message?.nativeToolSearch;
+        const source = String(native?.provider || '').toLowerCase();
+        if (source && source !== provider
+            && !(anthropicNative.has(source) && anthropicNative.has(provider))) continue;
+        for (const name of Array.isArray(native?.toolReferences) ? native.toolReferences : []) {
+            const key = String(name || '').trim();
+            if (key) discovered.add(key);
+        }
+    }
+    return discovered;
+}
+function deferredAnthropicTools(activeTools, messages, opts) {
     if (opts?.session?.deferredNativeTools !== true) return [];
     // Guard against an all-deferred tools array — the API rejects it with
     // `400: At least one tool must have defer_loading=false` (iteration-cap
     // final turn sends tools: []). See anthropic-oauth.mjs counterpart.
     if (!Array.isArray(activeTools) || activeTools.length === 0) return [];
     const active = new Set((activeTools || []).map((tool) => String(tool?.name || '').trim()).filter(Boolean));
+    const discovered = discoveredAnthropicToolNames(messages, opts, 'anthropic');
     const catalog = Array.isArray(opts.session.deferredToolCatalog) ? opts.session.deferredToolCatalog : [];
     return catalog
-        .filter((tool) => tool?.name && !active.has(String(tool.name)))
+        .filter((tool) => tool?.name && discovered.has(String(tool.name)) && !active.has(String(tool.name)))
         .map((tool) => ({ ...tool, deferLoading: true }));
 }
 function toAnthropicMessages(messages) {
@@ -376,15 +396,19 @@ function toAnthropicMessages(messages) {
         }
         if (m.role === 'tool') {
             const last = result[result.length - 1];
-            // Do not replay native deferred-loader `tool_reference` blocks from
-            // prior turns. They are tied to the exact Anthropic deferred-tool
-            // request that produced them; after /model or provider switches the
-            // new request may not carry the matching deferred tool surface and
-            // Anthropic rejects the history as a request validation error.
+            const native = m.nativeToolSearch;
+            const nativeProvider = String(native?.provider || '').toLowerCase();
+            const anthropicNative = new Set(['anthropic', 'anthropic-oauth']);
+            const references = (!nativeProvider || anthropicNative.has(nativeProvider))
+                && Array.isArray(native?.toolReferences)
+                ? native.toolReferences.map((name) => String(name || '').trim()).filter(Boolean)
+                : [];
             const block = {
                 type: 'tool_result',
                 tool_use_id: m.toolCallId || '',
-                content: normalizeContentForAnthropic(m.content),
+                content: references.length
+                    ? references.map((tool_name) => ({ type: 'tool_reference', tool_name }))
+                    : normalizeContentForAnthropic(m.content),
             };
             if (last?.role === 'user' && Array.isArray(last.content)) {
                 last.content.push(block);
@@ -620,7 +644,7 @@ export class AnthropicProvider {
         if (tools?.length || nativeTools.length) {
             // No cache_control on tools — the system BP covers tools via
             // Anthropic prefix semantics (order: tools → system → messages).
-            params.tools = [...nativeTools, ...toAnthropicTools([...(tools || []), ...deferredAnthropicTools(tools || [], opts)])];
+            params.tools = [...nativeTools, ...toAnthropicTools([...(tools || []), ...deferredAnthropicTools(tools || [], chatMsgs, opts)])];
         }
         // tool_choice only when tools are actually present (Anthropic rejects
         // tool_choice without tools). 'none' rides the hard-cap final turn to

package/src/runtime/agent/orchestrator/providers/custom-tool-wire.mjs

@@ -47,3 +47,31 @@ export function customToolCallFromResponseItem(item) {
 export function isCustomToolCallRecord(call) {
   return call?.nativeType === 'custom_tool_call';
 }
+
+export function nativeToolSearchCallInput(call) {
+  if (call?.nativeType !== 'tool_search_call') return null;
+  return {
+    type: 'tool_search_call',
+    call_id: call.id || '',
+    execution: 'client',
+    arguments: call.arguments && typeof call.arguments === 'object' ? call.arguments : {},
+  };
+}
+
+export function nativeToolSearchOutputInput(message, provider) {
+  const native = message?.nativeToolSearch;
+  const source = String(native?.provider || '').toLowerCase();
+  const target = String(provider || '').toLowerCase();
+  const openaiNative = new Set(['openai', 'openai-oauth']);
+  const sameNativeFamily = source === target
+    || (openaiNative.has(source) && openaiNative.has(target));
+  if (!native || (source && !sameNativeFamily)) return null;
+  if (!Array.isArray(native.openaiTools)) return null;
+  return {
+    type: 'tool_search_output',
+    call_id: message.toolCallId || '',
+    status: 'completed',
+    execution: 'client',
+    tools: native.openaiTools,
+  };
+}

package/src/runtime/agent/orchestrator/providers/openai-compat-wire.mjs

@@ -117,7 +117,7 @@ function functionToolFromSessionTool(t, name = t?.name) {
 export function toResponsesTools(tools, options = {}) {
     const provider = String(options?.provider || '').toLowerCase();
     const allowNativeToolSearch = options?.nativeToolSearch === true
-        || (options?.nativeToolSearch !== false && provider !== 'xai');
+        || (options?.nativeToolSearch !== false && (provider === 'openai' || provider === 'openai-oauth'));
     return tools.map((t) => {
         // load_tool advertises as the OpenAI-native `tool_search` wire type
         // (legacy 'tool_search' name still accepted for back-compat). xAI/Grok

package/src/runtime/agent/orchestrator/providers/openai-oauth-ws.mjs

@@ -570,6 +570,7 @@ export async function _acquireWithRetry({
                 if (err && typeof err === 'object') {
                     try { err.attempts = attempt; } catch {}
                     try { err.retryClassifier = classifier; } catch {}
+                    try { err.wsRetriesExhausted = true; } catch {}
                 }
                 try {
                     if (!process.env.MIXDOG_QUIET_PROVIDER_LOG) process.stderr.write(
@@ -580,15 +581,10 @@ export async function _acquireWithRetry({
             }
             // Schedule backoff and emit progress.
             const backoff = _backoffFor(attempt);
-            try {
-                if (!process.env.MIXDOG_QUIET_PROVIDER_LOG) process.stderr.write(
-                    `[openai-oauth-ws] worker retry ${attempt}/${attemptCap} (transient: ${classifier}, backoff ${backoff}ms)\n`,
-                );
-            } catch {}
             try {
                 onRetry?.({
                     attempt,
-                    max: attemptCap,
+                    max: attemptCap - 1,
                     classifier,
                     backoffMs: backoff,
                     error: err,
@@ -652,12 +648,6 @@ export async function sendViaWebSocket({
     traceProvider = 'openai-oauth',
     logSuppressedReasoningDeltas = true,
     warmupBody = null,
-    // Fast-fallback: when the caller has HTTP/SSE fallback enabled, cap the
-    // handshake acquire retry loop to a single attempt so a first
-    // acquire/first-byte failure surfaces immediately instead of burning the
-    // full exponential-backoff budget (measured 16.4s) before the caller can
-    // race HTTP. WS-only callers leave this false → full HANDSHAKE_MAX_ATTEMPTS.
-    fastFallback = false,
     // Test seams (undefined in production). Let the unit test drive the
     // retry state machine without opening real sockets or touching the
     // handshake-retry layer.
@@ -714,7 +704,6 @@ export async function sendViaWebSocket({
     // warmed. openai-oauth / openai-direct anchor by per-socket session_id, where
     // this carry-forward would not help and is therefore gated to xAI.
     let carryForwardCache = null;
-    const emittedProgress = [];
     const useCodexWsClientMetadata = traceProvider === 'openai-oauth';
     const codexMetadataContext = { poolKey, cacheKey, sendOpts };
     const codexHandshakeHeaders = useCodexWsClientMetadata
@@ -760,6 +749,22 @@ export async function sendViaWebSocket({
             });
         } catch {}
     };
+    // Single caller-visible recovery path for both handshake/acquire retries
+    // and retryable stream failures. The session/TUI stage bridge renders this
+    // as non-terminal reconnect progress; transport code must not also print it
+    // to stderr.
+    const emitReconnectProgress = ({ attempt, max, classifier }) => {
+        const retryAttempt = Number(attempt) || 1;
+        const retryMax = Number(max) || 1;
+        try {
+            onStageChange?.('reconnecting', {
+                attempt: retryAttempt,
+                max: retryMax,
+                classifier: classifier || null,
+                message: `Reconnecting... ${retryAttempt}/${retryMax}`,
+            });
+        } catch {}
+    };
 
     for (let attemptIndex = 0; attemptIndex <= MAX_MIDSTREAM_RETRIES; attemptIndex++) {
         const handshakeStart = performance.now();
@@ -778,16 +783,14 @@ export async function sendViaWebSocket({
                 // one is either torn down or in an unknown state.
                 forceFresh: forceFresh || attemptIndex > 0,
                 externalSignal,
-                // Fast-fallback caps the handshake acquire loop at 1 attempt so
-                // the caller can race HTTP immediately instead of waiting out
-                // the full backoff budget. Only the FIRST midstream attempt is
-                // capped — a midstream retry (attemptIndex>0) is already past
-                // the fallback decision and keeps the normal budget.
-                maxAttempts: (fastFallback && attemptIndex === 0) ? 1 : HANDSHAKE_MAX_ATTEMPTS,
+                maxAttempts: HANDSHAKE_MAX_ATTEMPTS,
                 onRetry: (info) => {
                     handshakeRetries += 1;
                     sendSpan.handshakeRetries += 1;
                     if (info?.classifier) handshakeRetryClassifiers.push(info.classifier);
+                    const attempt = Number(info?.attempt) || handshakeRetries;
+                    const max = Number(info?.max) || Math.max(HANDSHAKE_MAX_ATTEMPTS - 1, 1);
+                    emitReconnectProgress({ attempt, max, classifier: info?.classifier });
                 },
                 onBackoffSlept: (ms) => { sendSpan.retryBackoffMs += ms; },
             });
@@ -813,6 +816,9 @@ export async function sendViaWebSocket({
             // the caller's turn actually tripped on).
             if (attemptIndex > 0 && firstAttemptError) {
                 try { firstAttemptError.midstreamRetries = attemptIndex; } catch {}
+                if (err?.wsRetriesExhausted === true) {
+                    try { firstAttemptError.wsRetriesExhausted = true; } catch {}
+                }
                 emitSendSpan('error');
                 throw _stampTool(_stampLiveText(firstAttemptError));
             }
@@ -1109,16 +1115,7 @@ export async function sendViaWebSocket({
             _stampTool(err);
             const classifier = _classifyMidstreamError(err, midState);
             const retryLimit = classifier ? _midstreamRetryLimit(classifier) : 0;
-            // Fast-fallback: a first-byte timeout on the FIRST attempt means the
-            // socket opened but the server never ACKed — race HTTP now instead
-            // of burning a midstream retry (fresh acquire + first-byte window).
-            // Only suppresses the first_byte_timeout bucket on attemptIndex 0;
-            // ws_1006/1011 mid-stream drops still retry (a live socket that died
-            // is cheaper to re-acquire than to cold-fall-back).
-            const fastFallbackSkipRetry = fastFallback
-                && attemptIndex === 0
-                && (classifier === 'first_byte_timeout' || err?.firstByteTimeout === true);
-            if (classifier && attemptIndex < retryLimit && !fastFallbackSkipRetry) {
+            if (classifier && attemptIndex < retryLimit) {
                 // Retry-eligible: stash the first-attempt error, emit progress,
                 // and loop. The subsequent acquire uses forceFresh so no socket
                 // is shared between attempts.
@@ -1127,11 +1124,11 @@ export async function sendViaWebSocket({
                 try { err.midstreamClassifier = classifier; } catch {}
                 const retryNumber = attemptIndex + 1;
                 const backoff = _midstreamBackoffFor(retryNumber);
-                try {
-                    const line = `[openai-oauth-ws] mid-stream recovered: retry ${retryNumber}/${retryLimit} (cause: ${classifier}, backoff ${backoff}ms)\n`;
-                    if (!process.env.MIXDOG_QUIET_PROVIDER_LOG) process.stderr.write(line);
-                    emittedProgress.push(line);
-                } catch {}
+                emitReconnectProgress({
+                    attempt: retryNumber,
+                    max: retryLimit,
+                    classifier,
+                });
                 const sleepStart = performance.now();
                 try {
                     await _sleepWithAbort(backoff, externalSignal, _sleepFn);
@@ -1149,6 +1146,9 @@ export async function sendViaWebSocket({
                 // the user's turn actually tripped on), tag actual retry count.
                 try { firstAttemptError.midstreamRetries = attemptIndex; } catch {}
                 try { firstAttemptError.midstreamClassifier = firstAttemptClassifier; } catch {}
+                if (attemptIndex >= _midstreamRetryLimit(firstAttemptClassifier)) {
+                    try { firstAttemptError.wsRetriesExhausted = true; } catch {}
+                }
                 // Attach the retry attempt's error so post-mortem diagnostics
                 // can see WHY the retry also failed instead of silently
                 // dropping it. Use `cause` if free, else `suppressed`.

package/src/runtime/agent/orchestrator/providers/openai-oauth.mjs

@@ -51,6 +51,8 @@ import {
     customToolInputFromArguments,
     isCustomToolCallRecord,
     isResponsesFreeformTool,
+    nativeToolSearchCallInput,
+    nativeToolSearchOutputInput,
     toResponsesCustomTool,
 } from './custom-tool-wire.mjs';
 import {
@@ -401,6 +403,15 @@ function convertMessagesToResponsesInput(messages, opts = {}) {
                 if (mediaContent) pendingToolMedia.push(...mediaContent);
                 continue;
             }
+            const nativeSearchOutput = nativeToolSearchOutputInput(
+                m,
+                opts.nativeToolSearchProvider || 'openai-oauth',
+            );
+            if (nativeSearchOutput) {
+                out.push(nativeSearchOutput);
+                if (mediaContent) pendingToolMedia.push(...mediaContent);
+                continue;
+            }
             out.push({
                 type: 'function_call_output',
                 call_id: m.toolCallId || '',
@@ -419,7 +430,10 @@ function convertMessagesToResponsesInput(messages, opts = {}) {
             // reasoning in `input` triggers "Duplicate item".
             if (m.content) out.push(wireMessage('assistant', normalizeContentForOpenAIResponses(m.content, { role: 'assistant' })));
             for (const tc of m.toolCalls) {
-                if (isCustomToolCallRecord(tc)) {
+                const nativeSearchCall = nativeToolSearchCallInput(tc);
+                if (nativeSearchCall) {
+                    out.push(nativeSearchCall);
+                } else if (isCustomToolCallRecord(tc)) {
                     if (tc.id) customToolCallNameById.set(tc.id, tc.name || '');
                     out.push({
                         type: 'custom_tool_call',
@@ -450,8 +464,8 @@ function convertMessagesToResponsesInput(messages, opts = {}) {
 function toOpenAIResponsesTool(t) {
     if (t?.name === 'load_tool' || t?.name === 'tool_search') {
         return {
-            type: 'function',
-            name: 'load_tool',
+            type: 'tool_search',
+            execution: 'client',
             description: t.description,
             parameters: t.inputSchema,
         };
@@ -465,6 +479,8 @@ function toOpenAIResponsesTool(t) {
     };
 }
 
+export const _convertMessagesToResponsesInputForTest = convertMessagesToResponsesInput;
+
 // codex build_reasoning() (core/src/client.rs:785-805) only attaches the
 // reasoning object when model_info.supports_reasoning_summaries; models
 // without summary support get NO reasoning field at all. Mirror that via the
@@ -501,6 +517,7 @@ export function buildRequestBody(messages, model, tools, sendOpts) {
     const input = convertMessagesToResponsesInput(messages, {
         providerState: opts.providerState,
         model,
+        nativeToolSearchProvider: opts.promptCacheProvider || 'openai-oauth',
     });
     // Match the request body shape the OAuth backend expects so the
     // server-side auto-cache routes correctly. text.verbosity / include /
@@ -625,8 +642,11 @@ export class OpenAIOAuthProvider {
     name = 'openai-oauth';
     tokens = null;
     _refreshFallbackUntil = 0;
-    _forceHttpFallback = false;
-    _forceHttpFallbackUntil = 0;
+    // Sticky transport fallback is isolated by the WS pool/session key. A
+    // provider instance is shared across concurrent sessions, so singleton
+    // booleans here would let one unhealthy session force every other session
+    // onto HTTP.
+    _httpFallbackUntilByPoolKey = new Map();
     config;
     constructor(config) {
         this.config = config || {};
@@ -801,17 +821,17 @@ export class OpenAIOAuthProvider {
             return result;
         };
         const httpFallbackActive = () => {
-            if (this._forceHttpFallbackUntil > Date.now()) return true;
-            if (this._forceHttpFallback || this._forceHttpFallbackUntil) {
-                this._forceHttpFallback = false;
-                this._forceHttpFallbackUntil = 0;
+            if (!poolKey) return false;
+            const now = Date.now();
+            for (const [key, expiresAt] of this._httpFallbackUntilByPoolKey) {
+                if (!(expiresAt > now)) this._httpFallbackUntilByPoolKey.delete(key);
             }
-            return false;
+            return (this._httpFallbackUntilByPoolKey.get(poolKey) || 0) > now;
         };
         const markStickyHttpFallback = () => {
+            if (!poolKey) return;
             const ttlMs = _envPositiveInt('MIXDOG_OPENAI_OAUTH_HTTP_FALLBACK_STICKY_MS', 60_000);
-            this._forceHttpFallback = true;
-            this._forceHttpFallbackUntil = Date.now() + ttlMs;
+            this._httpFallbackUntilByPoolKey.set(poolKey, Date.now() + ttlMs);
         };
         const traceWsError = (err, stage = 'primary') => {
             try {
@@ -898,9 +918,8 @@ export class OpenAIOAuthProvider {
             // a fresh WS entry; only after the bounded WS retry budget is
             // exhausted does openai-oauth fall back to HTTP/SSE. This preserves
             // the hot WS/cache path for temporary blips while still preventing
-            // TUI-level hangs. Operators can opt into immediate HTTP fallback
-            // for diagnostics with MIXDOG_OPENAI_OAUTH_FAST_HTTP_FALLBACK=1.
-            fastFallback: httpFallbackEnabled && _envFlag('MIXDOG_OPENAI_OAUTH_FAST_HTTP_FALLBACK', false),
+            // TUI-level hangs. Sticky HTTP fallback is only armed after this
+            // bounded reconnect budget is exhausted.
             // codex-parity prewarm (generate:false full frame on a fresh
             // socket, wire-verified 2026-07-03). DEFAULT ON: R19(off) vs
             // R20(on) A/B shows prewarm removes ALL early-session zero-cache
@@ -951,7 +970,9 @@ export class OpenAIOAuthProvider {
                     return recordLiveModel(result);
                 } catch (retryErr) {
                     traceWsError(retryErr, 'auth_retry');
-                    if (httpFallbackEnabled && _shouldUseOpenAIHttpFallback(retryErr, externalSignal)) {
+                    if (httpFallbackEnabled
+                        && retryErr?.wsRetriesExhausted === true
+                        && _shouldUseOpenAIHttpFallback(retryErr, externalSignal)) {
                         try {
                             return await dispatchHttp(
                                 retryErr?.retryClassifier || retryErr?.code || retryErr?.message || 'ws_auth_retry_failed',
@@ -973,32 +994,18 @@ export class OpenAIOAuthProvider {
             const msg = err?.message || '';
             const isUnknownModel = status === 404
                 || /unknown[_\s-]?model|model[_\s-]?not[_\s-]?found/i.test(msg);
-            if (isUnknownModel && !opts._modelRetry) {
+            // Catalog recovery reissues the full turn. Once any text/tool
+            // output has escaped, that replay can duplicate rendered output or
+            // a dispatched side effect, so honor the same unsafe gate as auth
+            // retry and transport fallback.
+            if (isUnknownModel && !opts._modelRetry && !liveTextEmitted) {
                 process.stderr.write(`[openai-oauth-ws] unknown model — refreshing catalog + 1 retry\n`);
                 await this._refreshModelCache();
                 return this.send(messages, model, tools, { ...opts, _modelRetry: true });
             }
-            if (httpFallbackEnabled && _shouldUseOpenAIHttpFallback(err, externalSignal)) {
-                // Fast-path trace: the WS handshake acquire/first-byte failed on
-                // its FIRST attempt while fast-fallback was armed, so the
-                // remaining backoff retries were skipped and HTTP starts now.
-                // err.attempts===1 means the capped single-attempt path fired.
-                if (httpFallbackEnabled && Number(err?.attempts) === 1) {
-                    appendAgentTrace({
-                        sessionId: poolKey,
-                        iteration,
-                        kind: 'ws_fallback_fast',
-                        provider: 'openai-oauth',
-                        model: useModel,
-                        transport: 'websocket',
-                        elapsed_ms: Date.now() - _t1,
-                        payload: {
-                            elapsed_ms: Date.now() - _t1,
-                            classifier: err?.retryClassifier || err?.midstreamClassifier || null,
-                            code: err?.code || null,
-                        },
-                    });
-                }
+            if (httpFallbackEnabled
+                && err?.wsRetriesExhausted === true
+                && _shouldUseOpenAIHttpFallback(err, externalSignal)) {
                 try {
                     return await dispatchHttp(
                         err?.retryClassifier || err?.midstreamClassifier || err?.code || err?.message || 'ws_failed',

package/src/runtime/agent/orchestrator/providers/openai-ws-pool.mjs

@@ -41,6 +41,11 @@ export const WS_IDLE_MS = resolveTimeoutMs(
 );
 const WS_HANDSHAKE_TIMEOUT_MS = PROVIDER_WS_HANDSHAKE_TIMEOUT_MS;
 const WS_ACQUIRE_TIMEOUT_MS = PROVIDER_WS_ACQUIRE_TIMEOUT_MS;
+// A write that never reaches the ws callback is indistinguishable from a
+// wedged transport. Keep it under the same short bound as socket acquisition
+// so the caller can discard the entry and reconnect before arming stream
+// watchdogs.
+const WS_SEND_TIMEOUT_MS = WS_ACQUIRE_TIMEOUT_MS;
 const WS_PING_INTERVAL_MS = PROVIDER_WS_PING_INTERVAL_MS;
 const WS_PONG_TIMEOUT_MS = PROVIDER_WS_PONG_TIMEOUT_MS;
 const WS_LIVENESS_STALE_MS = PROVIDER_WS_LIVENESS_STALE_MS;
@@ -386,7 +391,7 @@ function _armLiveness(poolKey, entry) {
 // for a server event that will never arrive. Tag any failure with
 // `wsSendFailed=true` so _classifyMidstreamError routes the next attempt
 // through a fresh socket.
-export function _sendFrame(entry, frame, sendSpan = null) {
+export function _sendFrame(entry, frame, sendSpan = null, timeoutMs = WS_SEND_TIMEOUT_MS) {
     return new Promise((resolve, reject) => {
         const socket = entry?.socket;
         if (!socket || socket.readyState !== WebSocket.OPEN) {
@@ -409,18 +414,38 @@ export function _sendFrame(entry, frame, sendSpan = null) {
                 + (performance.now() - serializeStart);
         }
         _dumpFrame(payload);
+        let settled = false;
+        let timer = null;
+        const finish = (err = null) => {
+            if (settled) return;
+            settled = true;
+            if (timer) clearTimeout(timer);
+            if (!err) {
+                resolve();
+                return;
+            }
+            const sendErr = err instanceof Error ? err : new Error(String(err));
+            sendErr.wsSendFailed = true;
+            // A callback error/timeout leaves the transport state unknown.
+            // Drop it immediately; releaseWebSocket will also remove the entry
+            // from its pool, and the retry path force-acquires a fresh socket.
+            try { entry.closing = true; } catch {}
+            try { socket.terminate?.(); } catch {}
+            reject(sendErr);
+        };
+        const boundedTimeoutMs = Number.isFinite(timeoutMs) && timeoutMs > 0
+            ? timeoutMs
+            : WS_SEND_TIMEOUT_MS;
+        timer = setTimeout(() => {
+            finish(Object.assign(
+                new Error(`WS send callback timed out after ${boundedTimeoutMs}ms`),
+                { code: 'EWSSENDTIMEOUT', wsSendTimeoutMs: boundedTimeoutMs },
+            ));
+        }, boundedTimeoutMs);
         try {
-            // Do NOT await the send callback: on a wedged-but-OPEN socket the
-            // ws write callback may never fire, which would hang this Promise
-            // before _streamResponse arms its first-byte watchdog. Fire and
-            // resolve immediately; transport failures surface via the socket
-            // 'error'/'close' handlers and the first-byte watchdog.
-            socket.send(payload, () => {});
-            resolve();
+            socket.send(payload, (err) => finish(err || null));
         } catch (e) {
-            const err = e instanceof Error ? e : new Error(String(e));
-            err.wsSendFailed = true;
-            reject(err);
+            finish(e);
         }
     });
 }

package/src/runtime/agent/orchestrator/providers/retry-classifier.mjs

@@ -292,10 +292,10 @@ export function classifyMidstreamError(err, signals, policy = {}) {
 // userAbort / watchdogAbort / responseFailedPayload exactly as before.
 function _classifyMidstreamWs(err, state, attemptIndex, policy) {
   if (state.sawCompleted) return null
-  if (state.emittedToolCall) {
-    const _cc = Number(err?.wsCloseCode || state.wsCloseCode || 0)
-    if (!(_cc === 1000 && state.sawResponseCreated && !state.sawCompleted)) return null
-  }
+  // Once a tool call has been dispatched, no transport outcome is replay-safe.
+  // This includes a nominal close-1000 before response.completed: the tool may
+  // already be executing, so retry/fallback could duplicate its side effect.
+  if (state.emittedToolCall) return null
   if (state.emittedText || err?.liveTextEmitted) return null
   if (state.firstByteTimeout || err?.firstByteTimeout) {
     return _allowMidstream('first_byte_timeout', attemptIndex, policy)