mixdog 0.9.52 → 0.9.53

package/scripts/provider-contract-test.mjs

@@ -1,6 +1,10 @@
 #!/usr/bin/env node
 import test from 'node:test';
 import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
 
 import {
     OpenAICompatProvider,
@@ -10,6 +14,7 @@ import {
 } from '../src/runtime/agent/orchestrator/providers/openai-compat.mjs';
 import { consumeCompatChatCompletionStream } from '../src/runtime/agent/orchestrator/providers/openai-compat-stream.mjs';
 import { GrokOAuthProvider } from '../src/runtime/agent/orchestrator/providers/grok-oauth.mjs';
+import { sendViaWebSocket } from '../src/runtime/agent/orchestrator/providers/openai-oauth-ws.mjs';
 import {
     OpenCodeGoProvider,
     isAnthropicGoModel,
@@ -17,6 +22,11 @@ import {
     resolveOpenCodeGoBaseURLs,
 } from '../src/runtime/agent/orchestrator/providers/opencode-go.mjs';
 import { uncachedInputTokensForProvider } from '../src/runtime/agent/orchestrator/session/manager/usage-metrics.mjs';
+import { resolveTraceUsageInput } from '../src/runtime/agent/orchestrator/agent-trace.mjs';
+import {
+    billableInputTokensForProvider,
+    isInclusiveProvider,
+} from '../src/runtime/shared/llm/cost.mjs';
 
 function stream(events) {
     return {
@@ -173,17 +183,143 @@ test('OpenCode Go normalizes both route families to inclusive provider usage', a
     provider.openai = { send: async () => openaiRaw };
     const anthropic = await provider.send([], 'minimax-m3', [], {});
     assert.equal(OpenCodeGoProvider.inputExcludesCache, false);
+    assert.equal(isInclusiveProvider('opencode-go'), true);
     assert.equal(anthropic.usage.inputTokens, 100);
     assert.equal(anthropic.usage.promptTokens, 100);
     assert.equal(uncachedInputTokensForProvider('opencode-go', anthropic.usage.inputTokens, 35, 5), 60);
+    assert.equal(billableInputTokensForProvider('opencode-go', 100, 35, 5), 60);
+    assert.deepEqual(resolveTraceUsageInput({
+        provider: 'opencode-go',
+        inputTokens: 60,
+        cachedTokens: 35,
+        cacheWriteTokens: 5,
+        inputTokensInclusive: false,
+    }), {
+        uncachedInputTokens: 60,
+        promptTokens: 100,
+    });
     assert.equal(anthropic.usage.inputTokens, 100, 'context footprint is inclusive');
 
     const openai = await provider.send([], 'glm-5.2', [], {});
     assert.equal(openai, openaiRaw);
     assert.equal(uncachedInputTokensForProvider('opencode-go', openai.usage.inputTokens, 40, 0), 60);
+    assert.equal(billableInputTokensForProvider('opencode-go', 100, 40, 0), 60);
+    assert.deepEqual(resolveTraceUsageInput({
+        provider: 'opencode-go',
+        inputTokens: 100,
+        cachedTokens: 40,
+        cacheWriteTokens: 0,
+    }), {
+        uncachedInputTokens: 60,
+        promptTokens: 100,
+    });
     assert.equal(openai.usage.inputTokens, 100, 'context footprint remains inclusive');
 });
 
+test('OpenCode Go Anthropic delegation traces additive inner usage before inclusive outer normalization', (t) => {
+    const tempDir = mkdtempSync(join(tmpdir(), 'mixdog-opencode-go-trace-'));
+    const tracePath = join(tempDir, 'agent-trace.jsonl');
+    t.after(() => rmSync(tempDir, { recursive: true, force: true }));
+
+    const openCodeGoUrl = new URL('../src/runtime/agent/orchestrator/providers/opencode-go.mjs', import.meta.url).href;
+    const anthropicUrl = new URL('../src/runtime/agent/orchestrator/providers/anthropic.mjs', import.meta.url).href;
+    const traceUrl = new URL('../src/runtime/agent/orchestrator/agent-trace.mjs', import.meta.url).href;
+    const fixture = `
+        const { OpenCodeGoProvider } = await import(${JSON.stringify(openCodeGoUrl)});
+        const { AnthropicProvider } = await import(${JSON.stringify(anthropicUrl)});
+        const { drainAgentTrace } = await import(${JSON.stringify(traceUrl)});
+
+        const encoder = new TextEncoder();
+        const events = [
+            { type: 'message_start', message: {
+                model: 'minimax-m3',
+                usage: {
+                    input_tokens: 60,
+                    cache_read_input_tokens: 35,
+                    cache_creation_input_tokens: 5,
+                },
+            } },
+            { type: 'message_delta', delta: { stop_reason: 'end_turn' }, usage: { output_tokens: 5 } },
+            { type: 'message_stop' },
+        ];
+        const chunks = events.map((event) => encoder.encode(
+            'event: ' + event.type + '\\ndata: ' + JSON.stringify(event) + '\\n\\n'
+        ));
+        let chunkIndex = 0;
+        const response = {
+            ok: true,
+            status: 200,
+            headers: new Map(),
+            body: { getReader() {
+                return {
+                    read() {
+                        return chunkIndex < chunks.length
+                            ? Promise.resolve({ done: false, value: chunks[chunkIndex++] })
+                            : Promise.resolve({ done: true, value: undefined });
+                    },
+                    cancel() { return Promise.resolve(); },
+                    releaseLock() {},
+                };
+            } },
+        };
+
+        const inner = Object.create(AnthropicProvider.prototype);
+        inner.name = 'opencode-go';
+        inner.config = { disableBetaHeaders: true };
+        inner.fastModeBetaHeaderLatched = false;
+        inner.client = { messages: { create() {
+            return { asResponse: async () => response };
+        } } };
+
+        const outer = Object.create(OpenCodeGoProvider.prototype);
+        outer.anthropic = inner;
+        outer.openai = { send() { throw new Error('wrong OpenCode Go route'); } };
+        const result = await outer.send(
+            [{ role: 'user', content: 'fixture' }],
+            'minimax-m3',
+            [],
+            { sessionId: 'opencode-go-additive-trace' },
+        );
+        await drainAgentTrace();
+        process.stdout.write(JSON.stringify(result.usage));
+    `;
+    const child = spawnSync(process.execPath, ['--input-type=module', '-e', fixture], {
+        cwd: new URL('..', import.meta.url),
+        encoding: 'utf8',
+        env: {
+            ...process.env,
+            MIXDOG_AGENT_TRACE_DISABLE: '0',
+            MIXDOG_AGENT_TRACE_LOCAL_DISABLE: '0',
+            MIXDOG_AGENT_TRACE_PATH: tracePath,
+        },
+    });
+    assert.equal(child.status, 0, child.stderr || child.stdout);
+
+    const outerUsage = JSON.parse(child.stdout);
+    assert.deepEqual(outerUsage, {
+        inputTokens: 100,
+        outputTokens: 5,
+        cachedTokens: 35,
+        cacheWriteTokens: 5,
+        promptTokens: 100,
+    });
+    const traceRows = readFileSync(tracePath, 'utf8')
+        .trim()
+        .split(/\r?\n/)
+        .map((line) => JSON.parse(line));
+    const innerUsage = traceRows.find((row) => (
+        row.kind === 'usage_raw'
+        && row.session_id === 'opencode-go-additive-trace'
+    ));
+    assert.ok(innerUsage, 'delegated Anthropic route must emit usage_raw');
+    assert.equal(innerUsage.payload.provider, 'opencode-go');
+    assert.equal(innerUsage.input_tokens, 60);
+    assert.equal(innerUsage.cached_tokens, 35);
+    assert.equal(innerUsage.cache_write_tokens, 5);
+    assert.equal(innerUsage.uncached_input_tokens, 60);
+    assert.equal(innerUsage.prompt_tokens, 100);
+});
+
 test('constructing Grok OAuth is network inert', () => {
     const provider = new GrokOAuthProvider({
         preconnectFn: () => { throw new Error('constructor attempted outbound preconnect'); },
@@ -266,3 +402,124 @@ test('Grok OAuth does not refresh/replay a 401 after visible tool dispatch', asy
     assert.equal(dispatched, 1);
     assert.equal(authCalls, 1);
 });
+
+test('xAI WS to HTTP fallback preserves completed warmup usage and cost ticks', async (t) => {
+    const priorTransport = process.env.MIXDOG_OAI_TRANSPORT;
+    process.env.MIXDOG_OAI_TRANSPORT = 'auto';
+    t.after(() => {
+        if (priorTransport == null) delete process.env.MIXDOG_OAI_TRANSPORT;
+        else process.env.MIXDOG_OAI_TRANSPORT = priorTransport;
+    });
+    const provider = new OpenAICompatProvider('xai', {
+        apiKey: 'fixture',
+        preconnect: false,
+        responsesTransport: 'websocket',
+    });
+    const warmup = {
+        requestBody: { generate: false },
+        usage: { inputTokens: 10, outputTokens: 1, cachedTokens: 4, promptTokens: 10, raw: { cost_in_usd_ticks: 100 } },
+    };
+    provider._doSendXaiResponsesWebSocket = async () => {
+        const err = Object.assign(new Error('upgrade required'), { httpStatus: 426 });
+        Object.defineProperty(err, '__warmup', { value: warmup });
+        throw err;
+    };
+    provider._doSendXaiResponses = async () => ({
+        content: 'fallback',
+        usage: { inputTokens: 20, outputTokens: 2, cachedTokens: 5, promptTokens: 20, raw: { cost_in_usd_ticks: 200 }, costUsd: 0.00000002 },
+    });
+    const result = await provider._doSend([], 'grok-4.5', [], {});
+    assert.equal(result.usage.inputTokens, 30);
+    assert.equal(result.usage.mainInputTokens, 20);
+    assert.equal(result.usage.raw.cost_in_usd_ticks, 300);
+    assert.equal(result.usage.costUsd, 0.00000003);
+});
+
+test('xAI WS warmup billing exposes only main request usage as context', async () => {
+    let streams = 0;
+    const result = await sendViaWebSocket({
+        auth: { type: 'xai', apiKey: 'fixture' },
+        body: { model: 'grok-4.5', input: [{ role: 'user', content: 'main' }] },
+        sendOpts: {},
+        externalSignal: null,
+        poolKey: 'xai-warmup-accounting',
+        cacheKey: 'xai-warmup-accounting',
+        iteration: 1,
+        useModel: 'grok-4.5',
+        traceProvider: 'xai',
+        includeResponseId: true,
+        warmupBody: { model: 'grok-4.5', input: [], generate: false },
+        _acquireWithRetryFn: async () => ({ entry: { socket: { close() {} } }, reused: false }),
+        _sendFrameFn: async () => {},
+        _streamFn: async ({ state }) => {
+            streams += 1;
+            return state.warmup
+                ? {
+                    content: '',
+                    model: 'grok-4.5',
+                    toolCalls: [],
+                    usage: { inputTokens: 10, outputTokens: 1, cachedTokens: 4, promptTokens: 10, raw: { cost_in_usd_ticks: 100 } },
+                    responseId: 'warm',
+                    responseItems: [],
+                }
+                : {
+                    content: 'done',
+                    model: 'grok-4.5',
+                    toolCalls: [],
+                    usage: { inputTokens: 20, outputTokens: 2, cachedTokens: 5, promptTokens: 20, raw: { cost_in_usd_ticks: 200 } },
+                    responseId: 'main',
+                    responseItems: [],
+                    closeSocket: true,
+                };
+        },
+        _agentTraceFn: () => {},
+        _sendSpanTraceFn: () => {},
+    });
+    assert.equal(streams, 2);
+    assert.equal(result.usage.inputTokens, 30);
+    assert.equal(result.usage.mainInputTokens, 20);
+    assert.equal(result.usage.raw.cost_in_usd_ticks, 300);
+});
+
+test('xAI safe 401 replay carries completed warmup into the retry', async () => {
+    const provider = new OpenAICompatProvider('xai', { apiKey: 'fixture', preconnect: false });
+    const warmup = { usage: { inputTokens: 10 } };
+    let attempts = 0;
+    provider.reloadApiKey = () => {};
+    provider._doSend = async (_messages, _model, _tools, opts) => {
+        attempts += 1;
+        if (attempts === 1) {
+            const err = Object.assign(new Error('401'), { httpStatus: 401 });
+            Object.defineProperty(err, '__warmup', { value: warmup });
+            throw err;
+        }
+        assert.equal(opts._carriedWarmup, warmup);
+        return { content: 'retried' };
+    };
+    assert.equal((await provider.send([], 'grok-4.5', [], {})).content, 'retried');
+    assert.equal(attempts, 2);
+});
+
+test('Grok OAuth safe 401 replay carries completed warmup to refreshed xAI inner', async () => {
+    const provider = Object.create(GrokOAuthProvider.prototype);
+    provider.config = { preconnect: false };
+    const warmup = { usage: { inputTokens: 10 } };
+    let authCalls = 0;
+    provider.ensureAuth = async ({ forceRefresh = false } = {}) => {
+        authCalls += 1;
+        return { access_token: forceRefresh ? 'fresh' : 'stale' };
+    };
+    provider._ensureInner = (token) => ({
+        _doSend: async (_messages, _model, _tools, opts) => {
+            if (token === 'stale') {
+                const err = Object.assign(new Error('401'), { httpStatus: 401 });
+                Object.defineProperty(err, '__warmup', { value: warmup });
+                throw err;
+            }
+            assert.equal(opts._carriedWarmup, warmup);
+            return { content: 'retried' };
+        },
+    });
+    assert.equal((await provider.send([], 'grok-4.5', [], {})).content, 'retried');
+    assert.equal(authCalls, 2);
+});

package/scripts/provider-toolcall-test.mjs

@@ -71,7 +71,10 @@ import {
 import { buildAnthropicBetaHeaders } from '../src/runtime/agent/orchestrator/providers/anthropic-betas.mjs';
 import { PATCH_TOOL_DEFS } from '../src/runtime/agent/orchestrator/tools/patch-tool-defs.mjs';
 import { sendViaHttpSse } from '../src/runtime/agent/orchestrator/providers/openai-oauth-http-sse.mjs';
-import { buildRequestBody as buildOpenAIOAuthRequestBody } from '../src/runtime/agent/orchestrator/providers/openai-oauth.mjs';
+import {
+    OpenAIOAuthProvider,
+    buildRequestBody as buildOpenAIOAuthRequestBody,
+} from '../src/runtime/agent/orchestrator/providers/openai-oauth.mjs';
 import { _convertMessagesToResponsesInputForTest } from '../src/runtime/agent/orchestrator/providers/openai-oauth.mjs';
 import { OpenAIDirectProvider } from '../src/runtime/agent/orchestrator/providers/openai-ws.mjs';
 
@@ -1053,6 +1056,46 @@ test('gemini cache usage: official cached token fields are subsets of prompt tok
     assert.notEqual(sdkAlias.inputTokens, 0, 'snake_case SDK aliases must remain visible to provider return usage');
 });
 
+test('gemini cache usage: total fallback excludes candidate and thought output tokens', () => {
+    const camelCase = _resolveGeminiCacheUsage({
+        usageMetadata: {
+            totalTokenCount: 1000,
+            candidatesTokenCount: 150,
+            thoughtsTokenCount: 50,
+        },
+    });
+    assert.equal(camelCase.inputTokens, 800);
+
+    const snakeCase = _resolveGeminiCacheUsage({
+        usageMetadata: {
+            total_token_count: 1200,
+            candidates_token_count: 175,
+            thoughts_token_count: 25,
+        },
+    });
+    assert.equal(snakeCase.inputTokens, 1000);
+
+    const promptWins = _resolveGeminiCacheUsage({
+        usageMetadata: {
+            promptTokenCount: 900,
+            totalTokenCount: 1200,
+            candidatesTokenCount: 250,
+            thoughtsTokenCount: 50,
+        },
+    });
+    assert.equal(promptWins.inputTokens, 900);
+
+    const explicitZero = _resolveGeminiCacheUsage({
+        usageMetadata: {
+            prompt_token_count: 0,
+            total_token_count: 1200,
+            candidates_token_count: 175,
+            thoughts_token_count: 25,
+        },
+    });
+    assert.equal(explicitZero.inputTokens, 0);
+});
+
 test('gemini cache usage: clamps over-reported cache and falls back only for attached cachedContent', () => {
     const clamped = _resolveGeminiCacheUsage({
         usageMetadata: { promptTokenCount: 100, cachedContentTokenCount: 150 },
@@ -2237,21 +2280,28 @@ test('openai oauth ws delta: warmup generate:false does not force request_proper
     const prevTransport = process.env.MIXDOG_OAI_TRANSPORT;
     try {
         process.env.MIXDOG_OAI_TRANSPORT = 'ws-delta';
-        const warmupBody = { model: 'gpt-5.5', generate: false, input: [{ type: 'message', role: 'user', content: 'prev' }] };
-        const body = { model: 'gpt-5.5', input: [warmupBody.input[0], { type: 'message', role: 'user', content: 'next' }] };
+        const warmupBody = { model: 'gpt-5.5', generate: false, input: [] };
+        const body = { model: 'gpt-5.5', input: [{ type: 'message', role: 'user', content: 'first real input' }] };
         const entry = {
-            lastRequestSansInput: _stableStringify(_sansInput(warmupBody)),
+            lastRequestSansInput: _stableStringify(_sansInput(warmupBody, { normalizeWarmupGenerate: true })),
             lastResponseId: 'resp_warm',
-            lastRequestInput: [warmupBody.input[0]],
+            lastRequestInput: [],
             lastResponseItems: [],
         };
-        assert.equal(_sansInput(warmupBody).generate, undefined);      // warmup marker normalized out
-        const delta = _computeDelta({ entry, body });
+        assert.equal(_sansInput(warmupBody, { normalizeWarmupGenerate: true }).generate, undefined);
+        const delta = _computeDelta({ entry, body, traceProvider: 'openai-oauth' });
         assert.equal(delta.mode, 'delta');
-        assert.deepEqual(delta.frame.input, [body.input[1]]);
+        assert.equal(delta.frame.previous_response_id, 'resp_warm');
+        assert.deepEqual(delta.frame.input, body.input);
         // Non-warmup generate difference still breaks the delta.
-        const genEntry = { ...entry, lastRequestSansInput: _stableStringify(_sansInput({ ...warmupBody, generate: true })) };
-        const genChanged = _computeDelta({ entry: genEntry, body });
+        const genEntry = {
+            ...entry,
+            lastRequestSansInput: _stableStringify(_sansInput(
+                { ...warmupBody, generate: true },
+                { normalizeWarmupGenerate: true },
+            )),
+        };
+        const genChanged = _computeDelta({ entry: genEntry, body, traceProvider: 'openai-oauth' });
         assert.equal(genChanged.mode, 'full');
         assert.equal(genChanged.reason, 'request_properties_changed');
     } finally {
@@ -2260,6 +2310,118 @@ test('openai oauth ws delta: warmup generate:false does not force request_proper
     }
 });
 
+test('xAI keeps generate:false in the property guard and falls back to a full frame', () => {
+    const prevTransport = process.env.MIXDOG_OAI_TRANSPORT;
+    try {
+        process.env.MIXDOG_OAI_TRANSPORT = 'ws-delta';
+        const warmupBody = { model: 'grok-4', generate: false, input: [] };
+        const body = { model: 'grok-4', input: [{ role: 'user', content: 'real request' }] };
+        const entry = {
+            lastRequestSansInput: _stableStringify(_sansInput(warmupBody)),
+            lastResponseId: 'xai-warm',
+            lastRequestInput: [],
+            lastResponseItems: [],
+        };
+        assert.equal(_sansInput(warmupBody).generate, false);
+        const delta = _computeDelta({ entry, body, traceProvider: 'xai' });
+        assert.equal(delta.mode, 'full');
+        assert.equal(delta.reason, 'request_properties_changed');
+        assert.equal(delta.frame.previous_response_id, undefined);
+        assert.deepEqual(delta.frame.input, body.input);
+    } finally {
+        if (prevTransport == null) delete process.env.MIXDOG_OAI_TRANSPORT;
+        else process.env.MIXDOG_OAI_TRANSPORT = prevTransport;
+    }
+});
+
+test('OpenAI OAuth startup prewarm sends no transcript and anchors the first real WS request', async () => {
+    const savedEnv = Object.fromEntries([
+        'MIXDOG_OAI_TRANSPORT',
+        'MIXDOG_OPENAI_OAUTH_WS_WARMUP',
+        'MIXDOG_AGENT_TRACE_DISABLE',
+    ].map((name) => [name, process.env[name]]));
+    Object.assign(process.env, {
+        MIXDOG_OAI_TRANSPORT: 'ws-delta',
+        MIXDOG_OPENAI_OAUTH_WS_WARMUP: '1',
+        MIXDOG_AGENT_TRACE_DISABLE: '1',
+    });
+    try {
+        const provider = new OpenAIOAuthProvider({});
+        provider.ensureAuth = async () => ({ access_token: 'test-token' });
+        const liveInput = [{
+            type: 'message',
+            role: 'user',
+            content: [{ type: 'input_text', text: 'live-transcript-must-appear-once' }],
+        }];
+        const body = {
+            model: 'gpt-5.5',
+            instructions: 'base instructions',
+            input: liveInput,
+            tools: [{ type: 'function', name: 'read', parameters: { type: 'object' } }],
+            stream: true,
+            background: false,
+            prompt_cache_key: 'prewarm-parity-test',
+        };
+        const frames = [];
+        let streams = 0;
+        const result = await provider.send([], 'gpt-5.5', [], {
+            sessionId: 'prewarm-parity-test',
+            _prebuiltBody: body,
+            _sendViaWebSocketFn: (args) => sendViaWebSocket({
+                ...args,
+                _acquireWithRetryFn: async () => ({ entry: { socket: { close() {} } }, reused: false }),
+                _sendFrameFn: async (_entry, frame) => frames.push(JSON.parse(JSON.stringify(frame))),
+                _streamFn: async ({ state }) => {
+                    streams += 1;
+                    return state.warmup
+                        ? {
+                            content: '',
+                            model: 'gpt-5.5',
+                            toolCalls: [],
+                            usage: { inputTokens: 10, outputTokens: 0, cachedTokens: 0, promptTokens: 10 },
+                            responseId: 'warm-1',
+                            responseItems: [],
+                        }
+                        : {
+                            content: 'done',
+                            model: 'gpt-5.5',
+                            toolCalls: [],
+                            usage: { inputTokens: 20, outputTokens: 1, cachedTokens: 10, promptTokens: 20 },
+                            responseId: 'resp-1',
+                            responseItems: [],
+                            closeSocket: true,
+                        };
+                },
+                _agentTraceFn: () => {},
+                _sendSpanTraceFn: () => {},
+            }),
+        });
+
+        assert.equal(streams, 2);
+        assert.equal(frames.length, 2);
+        const [warmup, followUp] = frames;
+        assert.equal(warmup.type, 'response.create');
+        assert.equal(warmup.generate, false);
+        assert.deepEqual(warmup.input, []);
+        assert.equal(warmup.instructions, body.instructions);
+        assert.deepEqual(warmup.tools, body.tools);
+        assert.equal(warmup.stream, undefined);
+        assert.equal(warmup.background, undefined);
+        assert.equal(JSON.stringify(warmup).includes('live-transcript-must-appear-once'), false);
+        assert.equal(followUp.type, 'response.create');
+        assert.equal(followUp.previous_response_id, 'warm-1');
+        assert.deepEqual(followUp.input, liveInput);
+        assert.equal(JSON.stringify(followUp).match(/live-transcript-must-appear-once/g)?.length, 1);
+        assert.equal(result.usage.inputTokens, 30, 'warmup remains included in billable totals');
+        assert.equal(result.usage.mainInputTokens, 20, 'main context snapshot remains separate');
+    } finally {
+        for (const [name, value] of Object.entries(savedEnv)) {
+            if (value == null) delete process.env[name];
+            else process.env[name] = value;
+        }
+    }
+});
+
 test('openai oauth ws delta: native tool_search output replays with canonical fields', () => {
     const prevTransport = process.env.MIXDOG_OAI_TRANSPORT;
     try {

package/scripts/session-orphan-sweep-test.mjs

@@ -55,13 +55,26 @@ test('mature closed on-disk orphan absent from summary index gets tombstone-swep
         };
         writeFileSync(join(sessionsDir, `${orphan.id}.json`), JSON.stringify(orphan));
 
+        // (3) A shared-store tombstone whose id still has local in-flight work.
+        // It must be excluded before unlink, otherwise that work's late save
+        // could recreate an open session after the tombstone disappears.
+        const locallyLive = {
+            ...orphan,
+            id: 'sess_shared_tombstone_locally_live',
+        };
+        writeFileSync(join(sessionsDir, `${locallyLive.id}.json`), JSON.stringify(locallyLive));
+
         // Index contains ONLY the indexed session — the orphan is absent.
         const rows = _writeSummaryIndex([_sessionSummary(indexed)]);
         assert.equal(rows.length, 1, 'index seeded with exactly one row');
         assert.ok(!rows.some((r) => r.id === orphan.id), 'orphan is absent from the summary index');
 
         // Tombstone-only pass (no idle sweep) with a 1h maturity threshold.
-        const result = sweepStaleSessions({ sweepIdle: false, tombstoneMaxAgeMs: ONE_HOUR });
+        const result = sweepStaleSessions({
+            sweepIdle: false,
+            tombstoneMaxAgeMs: ONE_HOUR,
+            isSessionLive: (id) => id === locallyLive.id,
+        });
 
         assert.equal(result.tombstonesCleaned, 1, 'the orphan tombstone was reclaimed');
         assert.ok(
@@ -76,6 +89,19 @@ test('mature closed on-disk orphan absent from summary index gets tombstone-swep
             existsSync(join(sessionsDir, `${indexed.id}.json`)),
             'fresh open indexed session was preserved',
         );
+        assert.ok(
+            existsSync(join(sessionsDir, `${locallyLive.id}.json`)),
+            'locally live shared-store tombstone was excluded before unlink',
+        );
+        const afterLocalWork = sweepStaleSessions({
+            sweepIdle: false,
+            tombstoneMaxAgeMs: ONE_HOUR,
+            isSessionLive: () => false,
+        });
+        assert.ok(
+            afterLocalWork.tombstoneDetails.some((d) => d.id === locallyLive.id),
+            'protected tombstone is reclaimed once local work settles',
+        );
     } finally {
         try { rmSync(dataDir, { recursive: true, force: true }); } catch { /* ignore */ }
         delete process.env.MIXDOG_DATA_DIR;

package/src/lib/keychain-cjs.cjs

@@ -12,36 +12,46 @@ const KEYCHAIN_TIMEOUT_MS = Number(process.env.MIXDOG_KEYCHAIN_TIMEOUT_MS || 150
 const POWERSHELL_TIMEOUT_MS = KEYCHAIN_TIMEOUT_MS;
 
 // ---------------------------------------------------------------------------
-// getSecret read cache — avoid redundant platform-calls within TTL.
+// getSecret read cache — collapse repeated reads during a turn while bounding
+// cross-process staleness. Misses are never cached, so a token saved by another
+// process becomes visible immediately; hits expire so rotations are observed.
 // ---------------------------------------------------------------------------
 const KEYCHAIN_CACHE_TTL_MS = (() => {
-    const v = parseInt(process.env.MIXDOG_KEYCHAIN_CACHE_TTL_MS, 10);
-    return Number.isFinite(v) ? v : 300000;
+    const value = Number(process.env.MIXDOG_KEYCHAIN_CACHE_TTL_MS);
+    return Number.isFinite(value) && value >= 0 ? value : 30000;
 })();
-/** @type {Map<string, {value: (string|null), ts: number}> | null} */
-let _secretCache = null;
+/** @type {Map<string, {value: string, expiresAt: number}>} */
+const _secretCache = new Map();
 
 function _cacheGet(account) {
-    if (KEYCHAIN_CACHE_TTL_MS <= 0) return undefined;
-    if (!_secretCache) return undefined;
-    const entry = _secretCache.get(account);
+    const key = `${SERVICE}\0${account}`;
+    const entry = _secretCache.get(key);
     if (!entry) return undefined;
-    if (Date.now() - entry.ts >= KEYCHAIN_CACHE_TTL_MS) {
-        _secretCache.delete(account);
+    if (entry.expiresAt <= Date.now()) {
+        _secretCache.delete(key);
         return undefined;
     }
-    return entry.value; // may be null (cached miss)
+    return entry.value;
 }
 
 function _cacheSet(account, value) {
-    if (KEYCHAIN_CACHE_TTL_MS <= 0) return;
-    if (!_secretCache) _secretCache = new Map();
-    _secretCache.set(account, { value, ts: Date.now() });
+    if (value == null || KEYCHAIN_CACHE_TTL_MS === 0) return;
+    _secretCache.set(`${SERVICE}\0${account}`, {
+        value,
+        expiresAt: Date.now() + KEYCHAIN_CACHE_TTL_MS,
+    });
 }
 
 function _cacheInvalidate(account) {
-    if (!_secretCache) return;
-    _secretCache.delete(account);
+    _secretCache.delete(`${SERVICE}\0${account}`);
+}
+
+function invalidateSecretCache(account) {
+    if (account == null) {
+        _secretCache.clear();
+        return;
+    }
+    _cacheInvalidate(account);
 }
 
 // CommonJS module: cannot import the ESM src/shared/wsl.mjs, so inline an
@@ -332,13 +342,16 @@ function hasSecret(account) {
 }
 
 function setSecret(account, value) {
-    switch (platform()) {
-        case 'darwin': darwinSet(account, value); break;
-        case 'linux':  linuxSet(account, value); break;
-        case 'win32':  win32Set(account, value); break;
-        default: throw new Error(`[keychain] unsupported platform: ${process.platform}`);
+    try {
+        switch (platform()) {
+            case 'darwin': darwinSet(account, value); break;
+            case 'linux':  linuxSet(account, value); break;
+            case 'win32':  win32Set(account, value); break;
+            default: throw new Error(`[keychain] unsupported platform: ${process.platform}`);
+        }
+    } finally {
+        _cacheInvalidate(account);
     }
-    _cacheSet(account, value);
 }
 
 function deleteSecret(account) {
@@ -354,4 +367,4 @@ function deleteSecret(account) {
     }
 }
 
-module.exports = { getSecret, setSecret, deleteSecret, hasSecret, SERVICE };
+module.exports = { getSecret, setSecret, deleteSecret, hasSecret, invalidateSecretCache, SERVICE };