mixdog 0.9.51 → 0.9.53

package/src/runtime/agent/orchestrator/providers/openai-ws.mjs

@@ -43,6 +43,53 @@ export function applyOpenAIDirectFastTier(body, model, opts) {
     return body;
 }
 
+function shouldFallbackDirectTransport(err, options) {
+    const status = Number(err?.httpStatus || err?.status || 0);
+    const unsafeToRetry = err?.liveTextEmitted === true
+        || err?.emittedToolCall === true
+        || err?.unsafeToRetry === true;
+    if (unsafeToRetry || options?.signal?.aborted || options?.enabled === false) return false;
+    // Public OpenAI can reject the WebSocket upgrade while still supporting
+    // the same request over HTTP/SSE. Only the shared transport's explicit
+    // handshake marker may turn these application-looking statuses into a
+    // one-shot transport fallback.
+    if (err?.wsFailurePhase === 'handshake'
+        && err?.wsHttpFallbackEligible === true
+        && [403, 404, 429].includes(status)) {
+        return true;
+    }
+    // These are application/auth/quota outcomes from the public Responses API,
+    // not evidence that WebSocket transport is unhealthy. Reissuing them over
+    // HTTP cannot recover and can duplicate an accepted throttled request.
+    if (status >= 400 && status < 500) return false;
+    return shouldFallbackTransport(err, options);
+}
+
+function directOpenAiHandshakeErrorPolicy({ status }) {
+    if ([403, 404, 429].includes(Number(status))) {
+        return { retry: false, httpFallback: true };
+    }
+    return null;
+}
+
+const DIRECT_WS_TEST_SEAM_KEYS = Object.freeze([
+    '_acquireWithRetryFn',
+    '_streamFn',
+    '_sendFrameFn',
+    '_sleepFn',
+    '_sendSpanTraceFn',
+    '_agentTraceFn',
+]);
+
+function directWebSocketTestSeams(value) {
+    if (!value || typeof value !== 'object') return {};
+    const out = {};
+    for (const key of DIRECT_WS_TEST_SEAM_KEYS) {
+        if (typeof value[key] === 'function') out[key] = value[key];
+    }
+    return out;
+}
+
 export class OpenAIDirectProvider {
     // input_tokens INCLUDES cached tokens (OpenAI convention). See registry.mjs.
     static inputExcludesCache = false;
@@ -56,7 +103,7 @@ export class OpenAIDirectProvider {
         if (!k) throw new Error('OPENAI_API_KEY not configured (providers.openai.apiKey)');
         return k;
     }
-    // Auth-recovery mirror of openai-compat.reloadApiKey: on a 401/403 the key
+    // Auth-recovery mirror of openai-compat.reloadApiKey: on a 401 the key
     // was likely rotated after this provider instance was built, so re-read
     // only OpenAI's environment/keychain sources before the single retry.
     // Returns the fresh key (or null if none) — no client to rebuild here since
@@ -140,7 +187,18 @@ export class OpenAIDirectProvider {
             iteration,
             useModel,
         };
-        const dispatchWs = (a) => sendViaWebSocket({
+        // Keep the same deterministic transport seams as openai-oauth. Besides
+        // making the direct path regression-testable without a live request,
+        // this lets embedded callers supply their already-instrumented
+        // Responses transports without changing the public request envelope.
+        const sendWs = typeof opts._sendViaWebSocketFn === 'function'
+            ? opts._sendViaWebSocketFn
+            : sendViaWebSocket;
+        const sendHttp = typeof opts._sendViaHttpSseFn === 'function'
+            ? opts._sendViaHttpSseFn
+            : sendViaHttpSse;
+        const wsTestSeams = directWebSocketTestSeams(opts._webSocketTestSeams);
+        const dispatchWs = (a) => sendWs({
             ...common,
             auth: a,
             sendOpts: opts,
@@ -151,12 +209,18 @@ export class OpenAIDirectProvider {
             // the OAuth/Codex handshake headers. Direct API-key auth pins its own
             // provider so it stays on the public (non-Codex) envelope.
             traceProvider: 'openai-direct',
+            // Narrow deterministic seams for transport-policy regression tests.
+            // Production callers never set this object.
+            ...wsTestSeams,
+            // Mandatory and deliberately applied AFTER sanitized test seams:
+            // no caller can disable or invert direct handshake provenance.
+            handshakeErrorPolicy: directOpenAiHandshakeErrorPolicy,
         });
         // WS→HTTP/SSE fallback mirrors the openai-oauth wrapper: the shared
         // HTTP transport now accepts auth.type==='openai-direct' (public
         // Responses endpoint + Bearer <apiKey>), so the api-key provider gets
-        // the same envelope. Gate via shouldFallbackTransport (denies
-        // 401/403/404/429 + liveTextEmitted/emittedToolCall/unsafeToRetry).
+        // the same envelope. The direct gate denies every application 4xx and
+        // any liveTextEmitted/emittedToolCall/unsafeToRetry outcome.
         const transportPolicy = resolveOpenAiTransportPolicy();
         const httpFallbackEnabled = transportPolicy.allowHttpFallback
             && _envFlag('MIXDOG_OPENAI_HTTP_FALLBACK', true);
@@ -164,7 +228,7 @@ export class OpenAIDirectProvider {
             if (!process.env.MIXDOG_QUIET_PROVIDER_LOG) {
                 process.stderr.write('[openai-ws] WebSocket unhealthy; falling back to HTTP/SSE\n');
             }
-            return sendViaHttpSse({ ...common, auth: a, opts, fetchFn: opts._fetchFn });
+            return sendHttp({ ...common, auth: a, opts, fetchFn: opts._fetchFn });
         };
         // Transport-policy switch (MIXDOG_OAI_TRANSPORT). 'http-sse' forces the
         // HTTP/SSE transport directly — no WS attempt, so skip the fallback log
@@ -172,7 +236,7 @@ export class OpenAIDirectProvider {
         // ('auto'/'ws-full'/'ws-delta') keep the WS-first path below; ws-full vs
         // ws-delta only affects the delta gate inside openai-ws-delta.mjs.
         if (transportPolicy.transport === 'http') {
-            return await sendViaHttpSse({ ...common, auth, opts, fetchFn: opts._fetchFn });
+            return await sendHttp({ ...common, auth, opts, fetchFn: opts._fetchFn });
         }
         try {
             return await dispatchWs(auth);
@@ -183,10 +247,12 @@ export class OpenAIDirectProvider {
             const unsafeToRetry = err?.liveTextEmitted === true
                 || err?.emittedToolCall === true
                 || err?.unsafeToRetry === true;
-            // (1) 401/403 → reload only OpenAI auth and retry once over WS.
-            //     shouldFallbackTransport denies 401/403, so this branch owns
-            //     its own guard.
-            if ((status === 401 || status === 403) && !unsafeToRetry) {
+            // (1) 401 → reload only OpenAI auth and retry once over WS.
+            // Ordinary 403 is a permission/policy decision, not evidence that
+            // an API key rotated. Match the OAuth path and keep it terminal.
+            // The direct fallback guard denies auth statuses, so this branch
+            // owns the single credential-reload replay.
+            if (status === 401 && err?.wsFailurePhase !== 'stream' && !unsafeToRetry) {
                 process.stderr.write(`[openai-ws] ${status} — reloading apiKey and retrying once\n`);
                 const freshKey = this.reloadApiKey();
                 if (freshKey) {
@@ -194,7 +260,7 @@ export class OpenAIDirectProvider {
                     try {
                         return await dispatchWs(retryAuth);
                     } catch (retryErr) {
-                        if (shouldFallbackTransport(retryErr, { signal: externalSignal, enabled: httpFallbackEnabled })) {
+                        if (shouldFallbackDirectTransport(retryErr, { signal: externalSignal, enabled: httpFallbackEnabled })) {
                             return await dispatchHttp(retryAuth);
                         }
                         throw retryErr;
@@ -204,7 +270,7 @@ export class OpenAIDirectProvider {
             }
             // (2) WS transport failure → HTTP/SSE fallback (predicate handles
             //     the safety denies).
-            if (shouldFallbackTransport(err, { signal: externalSignal, enabled: httpFallbackEnabled })) {
+            if (shouldFallbackDirectTransport(err, { signal: externalSignal, enabled: httpFallbackEnabled })) {
                 return await dispatchHttp(auth);
             }
             throw err;

package/src/runtime/agent/orchestrator/providers/opencode-go.mjs

@@ -20,11 +20,44 @@ const OPENCODE_GO_CONTEXT_WINDOWS = Object.freeze({
     'glm-5': 202752,
 });
 
-function isAnthropicGoModel(model) {
+export function isAnthropicGoModel(model) {
     const id = String(model || '').toLowerCase();
     return ANTHROPIC_MODEL_PREFIXES.some(prefix => id.startsWith(prefix));
 }
 
+export function resolveOpenCodeGoBaseURLs(configuredBaseURL) {
+    const presetBase = OPENAI_COMPAT_PRESETS['opencode-go'].baseURL;
+    const openai = String(configuredBaseURL || presetBase).replace(/\/+$/, '');
+    // Anthropic's SDK appends `/v1/messages` itself. Supplying the OpenAI base
+    // (`.../v1`) would therefore produce the invalid `.../v1/v1/messages`.
+    const anthropic = openai.replace(/\/v1$/i, '');
+    return { openai, anthropic };
+}
+
+export function openCodeGoEndpointForModel(model, configuredBaseURL) {
+    const bases = resolveOpenCodeGoBaseURLs(configuredBaseURL);
+    return isAnthropicGoModel(model)
+        ? `${bases.anthropic}/v1/messages`
+        : `${bases.openai}/chat/completions`;
+}
+
+export function normalizeOpenCodeGoResultUsage(result, anthropicRoute) {
+    if (!anthropicRoute || !result?.usage) return result;
+    const usage = result.usage;
+    const input = Number(usage.inputTokens) || 0;
+    const cached = Number(usage.cachedTokens) || 0;
+    const cacheWrite = Number(usage.cacheWriteTokens) || 0;
+    const inclusiveInput = input + cached + cacheWrite;
+    return {
+        ...result,
+        usage: {
+            ...usage,
+            inputTokens: inclusiveInput,
+            promptTokens: Math.max(Number(usage.promptTokens) || 0, inclusiveInput),
+        },
+    };
+}
+
 function opencodeGoContextWindow(_modelId, current = 0) {
     const native = Number(current);
     if (Number.isFinite(native) && native > 0) return native;
@@ -46,24 +79,29 @@ function opencodeGoReasoningLevels(model, current = null) {
 export class OpenCodeGoProvider {
     static inputExcludesCache = false;
     name = 'opencode-go';
+    config;
     openai;
     anthropic;
 
     constructor(config = {}) {
+        // Retain the outer account config for the common provider-admission
+        // lane. The delegated transports are intentionally not independently
+        // wrapped, so all model-family routes share this one 64-wide account.
+        this.config = config;
         const preset = OPENAI_COMPAT_PRESETS['opencode-go'];
-        const baseURL = config.baseURL || preset.baseURL;
-        this.openai = new OpenAICompatProvider('opencode-go', { ...config, baseURL });
+        const bases = resolveOpenCodeGoBaseURLs(config.baseURL || preset.baseURL);
+        this.openai = new OpenAICompatProvider('opencode-go', { ...config, baseURL: bases.openai });
         this.anthropic = new AnthropicProvider({
             ...config,
             name: 'opencode-go',
-            baseURL,
+            baseURL: bases.anthropic,
             disableBetaHeaders: true,
         });
     }
 
     async send(messages, model, tools, sendOpts) {
         if (isAnthropicGoModel(model)) {
-            return this.anthropic.send(messages, model, tools, {
+            const result = await this.anthropic.send(messages, model, tools, {
                 ...(sendOpts || {}),
                 cacheStrategy: {
                     tools: 'none',
@@ -72,6 +110,7 @@ export class OpenCodeGoProvider {
                     messages: 'none',
                 },
             });
+            return normalizeOpenCodeGoResultUsage(result, true);
         }
         return this.openai.send(messages, model, tools, sendOpts);
     }

package/src/runtime/agent/orchestrator/providers/registry.mjs

@@ -5,6 +5,7 @@ import {
     hasGrokOAuthCredentials,
 } from './oauth-credential-probes.mjs';
 import { refreshCatalog as refreshMetadataCatalog, warmModelMetadataCatalogs } from './model-catalog.mjs';
+import { wrapProviderAdmission } from './admission-scheduler.mjs';
 // OpenAI-compat provider names are self-declared by openai-compat-presets.mjs via
 // OPENAI_COMPAT_PRESETS. No parallel list maintained here.
 const providers = new Map();
@@ -15,6 +16,7 @@ const providerModulePromises = new Map();
 // byte identical to the live one, so lazy-init misses that re-run initProviders
 // don't churn (tear down + rebuild) every live provider instance on every call.
 const signatures = new Map();
+const KNOWN_INPUT_EXCLUDES_CACHE = new Set(['anthropic', 'anthropic-oauth']);
 
 // Module-level init serialization. agent-tool.mjs's ensureProvider() already
 // serializes inits per provider on a chain promise, but its gateOnPrior() lets
@@ -108,9 +110,9 @@ async function loadProviderCtor(name, signal = null) {
 
 function instantiateProvider(name, Ctor, cfg) {
     if (Object.prototype.hasOwnProperty.call(OPENAI_COMPAT_PRESETS, name) && name !== 'opencode-go') {
-        return new Ctor(name, cfg);
+        return wrapProviderAdmission(new Ctor(name, cfg), name);
     }
-    return new Ctor(cfg);
+    return wrapProviderAdmission(new Ctor(cfg), name);
 }
 
 export async function initProviders(config, { signal = null } = {}) {
@@ -232,21 +234,21 @@ export function getProvider(name) {
     if (name === 'anthropic-oauth' && hasAnthropicOAuthCredentials()) {
         const Ctor = providerCtors.get('anthropic-oauth');
         if (!Ctor) return undefined;
-        const inst = new Ctor({});
+        const inst = wrapProviderAdmission(new Ctor({}), name);
         providers.set(name, inst);
         return inst;
     }
     if (name === 'openai-oauth' && hasOpenAIOAuthCredentials()) {
         const Ctor = providerCtors.get('openai-oauth');
         if (!Ctor) return undefined;
-        const inst = new Ctor({});
+        const inst = wrapProviderAdmission(new Ctor({}), name);
         providers.set(name, inst);
         return inst;
     }
     if (name === 'grok-oauth' && hasGrokOAuthCredentials()) {
         const Ctor = providerCtors.get('grok-oauth');
         if (!Ctor) return undefined;
-        const inst = new Ctor({});
+        const inst = wrapProviderAdmission(new Ctor({}), name);
         providers.set(name, inst);
         return inst;
     }
@@ -261,15 +263,54 @@ export function getProvider(name) {
 // provider states its own answer — no central regex to keep in sync. Unknown /
 // unregistered providers default to false (the openai/gemini majority).
 export function providerInputExcludesCache(name) {
-    const p = getProvider(name);
-    if (p?.constructor?.inputExcludesCache === true) return true;
-    return String(name || '').toLowerCase().includes('anthropic');
+    const normalized = String(name || '').toLowerCase();
+    // Usage accounting is a pure lookup. In particular, never call
+    // getProvider() here: its OAuth miss path probes credentials and may lazily
+    // instantiate/register a provider.
+    const p = providers.get(normalized);
+    if (p?.constructor && typeof p.constructor.inputExcludesCache === 'boolean') {
+        return p.constructor.inputExcludesCache;
+    }
+    // A constructor may already be loaded even when the provider is currently
+    // absent during a route/config transition. Preserve its declaration, but
+    // never infer usage semantics from an arbitrary provider-name substring.
+    const Ctor = providerCtors.get(normalized);
+    if (Ctor && typeof Ctor.inputExcludesCache === 'boolean') {
+        return Ctor.inputExcludesCache;
+    }
+    // Built-in usage semantics must also be correct before lazy construction
+    // (including disabled providers in a fresh process).
+    return KNOWN_INPUT_EXCLUDES_CACHE.has(normalized);
 }
 export function getAllProviders() {
     // Defensive copy — callers must not mutate the live registry or retain
     // stale entries across re-init (initProviders rebuilds the map in place).
     return new Map(providers);
 }
+// Narrow synchronous test seam for the lazy-OAuth boundary. It models a
+// constructor whose module is already loaded while guaranteeing every touched
+// registry entry is restored, even when the assertion callback throws.
+export function _withLoadedProviderCtorForTest(name, Ctor, fn) {
+    const hadProvider = providers.has(name);
+    const priorProvider = providers.get(name);
+    const hadCtor = providerCtors.has(name);
+    const priorCtor = providerCtors.get(name);
+    const hadSignature = signatures.has(name);
+    const priorSignature = signatures.get(name);
+    providers.delete(name);
+    signatures.delete(name);
+    providerCtors.set(name, Ctor);
+    try {
+        return fn();
+    } finally {
+        if (hadProvider) providers.set(name, priorProvider);
+        else providers.delete(name);
+        if (hadCtor) providerCtors.set(name, priorCtor);
+        else providerCtors.delete(name);
+        if (hadSignature) signatures.set(name, priorSignature);
+        else signatures.delete(name);
+    }
+}
 // Background catalog warm-up. Each provider's listModels() either hits its
 // own cached model list (no-op) or fires a single HTTP refresh. Called from
 // agent.init() after providers are registered so the first agent dispatch call