mixdog 0.9.53 → 0.9.55

package/src/runtime/shared/process-lifecycle.mjs

@@ -15,10 +15,12 @@ import {
   writeSync,
 } from 'node:fs';
 import { join } from 'node:path';
-import { execFileSync } from 'node:child_process';
-import { withFileLockSync } from './atomic-file.mjs';
+import { execFile } from 'node:child_process';
+import { isDeepStrictEqual, promisify } from 'node:util';
+import { withFileLock, withFileLockSync } from './atomic-file.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
 
+const execFileAsync = promisify(execFile);
 export const LIFECYCLE_LEDGER_MAX_BYTES = 64 * 1024;
 export const LIFECYCLE_LEDGER_KEEP_FILES = 2;
 const LEDGER_NAME = 'process-lifecycle.jsonl';
@@ -105,7 +107,35 @@ function appendEntry(active, entry) {
       const fd = openSync(active.ledger, 'a', 0o600);
       try {
         writeSync(fd, line, null, 'utf8');
-        fsyncSync(fd);
+      } finally {
+        closeSync(fd);
+      }
+      return statSync(active.ledger).size <= LIFECYCLE_LEDGER_MAX_BYTES;
+    }, {
+      timeoutMs: 0,
+      staleMs: LEDGER_LOCK_STALE_MS,
+    });
+  } catch {
+    return false;
+  }
+}
+
+async function appendEntryAsync(active, entry, shouldAppend) {
+  const staticLine = typeof entry === 'function' ? null : `${JSON.stringify(entry)}\n`;
+  if (staticLine && Buffer.byteLength(staticLine) > LIFECYCLE_LEDGER_MAX_BYTES) return false;
+  try {
+    return await withFileLock(active.lock, () => {
+      if (!shouldAppend()) return false;
+      const line = staticLine || `${JSON.stringify(entry())}\n`;
+      if (Buffer.byteLength(line) > LIFECYCLE_LEDGER_MAX_BYTES) return false;
+      boundPreviousLedger(active);
+      if (existsSync(active.ledger)
+        && statSync(active.ledger).size + Buffer.byteLength(line) > LIFECYCLE_LEDGER_MAX_BYTES) {
+        rotateLedger(active);
+      }
+      const fd = openSync(active.ledger, 'a', 0o600);
+      try {
+        writeSync(fd, line, null, 'utf8');
       } finally {
         closeSync(fd);
       }
@@ -126,18 +156,30 @@ function currentProcessIdentity() {
       ? { kind: 'start-seconds', value, method: 'uptime' }
       : null;
   }
-  return processIdentityForPid(process.pid);
+  return linuxProcessIdentity(process.pid);
+}
+
+function linuxProcessIdentity(pid) {
+  try {
+    const raw = readFileSync(`/proc/${pid}/stat`, 'utf8');
+    const fields = raw.slice(raw.lastIndexOf(') ') + 2).trim().split(/\s+/);
+    return fields[19] && /^\d+$/.test(fields[19])
+      ? { kind: 'linux-start-ticks', value: fields[19] }
+      : null;
+  } catch {
+    return null;
+  }
 }
 
-function windowsProcessIdentities(pids) {
+async function windowsProcessIdentities(pids) {
   const identities = new Map();
   if (pids.length === 0) return identities;
   try {
-    const out = execFileSync('powershell.exe', [
+    const { stdout } = await execFileAsync('powershell.exe', [
       '-NoProfile', '-NonInteractive', '-Command',
       `$ErrorActionPreference='SilentlyContinue'; Get-Process -Id @(${pids.join(',')}) | ForEach-Object { try { "$($_.Id):$(([DateTimeOffset]$_.StartTime).ToUnixTimeSeconds())" } catch {} }`,
     ], { encoding: 'utf8', timeout: 2000, windowsHide: true });
-    for (const line of String(out).split(/\r?\n/)) {
+    for (const line of String(stdout).split(/\r?\n/)) {
       const match = /^(\d+):(\d+)$/.exec(line.trim());
       if (!match) continue;
       const pid = Number(match[1]);
@@ -150,38 +192,33 @@ function windowsProcessIdentities(pids) {
   return identities;
 }
 
-function processIdentityForPid(pid) {
+async function processIdentityForPid(pid) {
   if (process.platform === 'linux') {
-    try {
-      const raw = readFileSync(`/proc/${pid}/stat`, 'utf8');
-      const fields = raw.slice(raw.lastIndexOf(') ') + 2).trim().split(/\s+/);
-      return fields[19] && /^\d+$/.test(fields[19])
-        ? { kind: 'linux-start-ticks', value: fields[19] }
-        : null;
-    } catch {
-      return null;
-    }
+    return linuxProcessIdentity(pid);
   }
   try {
     if (process.platform === 'win32') {
-      return windowsProcessIdentities([pid]).get(pid) || null;
+      return (await windowsProcessIdentities([pid])).get(pid) || null;
     }
-    const out = execFileSync('ps', ['-o', 'lstart=', '-p', String(pid)], {
+    const { stdout } = await execFileAsync('ps', ['-o', 'lstart=', '-p', String(pid)], {
       encoding: 'utf8',
       timeout: 2000,
       windowsHide: true,
     });
-    const value = Math.floor(Date.parse(String(out).trim()) / 1000);
+    const value = Math.floor(Date.parse(String(stdout).trim()) / 1000);
     return Number.isInteger(value) ? { kind: 'start-seconds', value, method: 'ps' } : null;
   } catch {
     return null;
   }
 }
 
-function processIdentitiesForPids(pids) {
+async function processIdentitiesForPids(pids) {
   const unique = [...new Set(pids)];
   if (process.platform !== 'win32') {
-    return new Map(unique.map((pid) => [pid, processIdentityForPid(pid)]));
+    return new Map(await Promise.all(unique.map(async (pid) => [
+      pid,
+      await processIdentityForPid(pid),
+    ])));
   }
 
   const identities = new Map();
@@ -190,7 +227,7 @@ function processIdentitiesForPids(pids) {
     if (pid === process.pid) identities.set(pid, currentProcessIdentity());
     else otherPids.push(pid);
   }
-  for (const [pid, identity] of windowsProcessIdentities(otherPids)) {
+  for (const [pid, identity] of await windowsProcessIdentities(otherPids)) {
     identities.set(pid, identity);
   }
   return identities;
@@ -217,7 +254,11 @@ function sameProcessIdentity(expected, observed) {
 function recordCurrent(reason, exitCode = null) {
   const active = sharedState().active;
   if (!active || !VALID_REASONS.has(reason)) return false;
-  return appendEntry(active, {
+  return appendEntry(active, lifecycleEntry(active, reason, exitCode));
+}
+
+function lifecycleEntry(active, reason, exitCode = null) {
+  return {
     version: 1,
     timestamp: new Date().toISOString(),
     pid: process.pid,
@@ -226,7 +267,7 @@ function recordCurrent(reason, exitCode = null) {
     exitCode: Number.isInteger(exitCode) ? exitCode : null,
     memory: memoryCounters(),
     cwd: active.cwd,
-  });
+  };
 }
 
 function recordPriorVanished(active, previous) {
@@ -240,6 +281,36 @@ function recordPriorVanished(active, previous) {
   });
 }
 
+function markerMatchesSnapshot(markerPath, previous) {
+  try {
+    const current = JSON.parse(readFileSync(markerPath, 'utf8'));
+    return current?.pid === previous.pid
+      && current?.token === previous.token
+      && isDeepStrictEqual(current?.processIdentity, previous.processIdentity);
+  } catch {
+    return false;
+  }
+}
+
+async function recordPriorVanishedAsync(active, markerPath, previous) {
+  const written = await appendEntryAsync(active, {
+    version: 1,
+    timestamp: new Date().toISOString(),
+    pid: previous.pid,
+    ppid: Number.isInteger(previous.ppid) ? previous.ppid : null,
+    reason: 'prior-process-vanished',
+    exitCode: null,
+  }, () => sharedState().active === active && markerMatchesSnapshot(markerPath, previous));
+  if (!written || sharedState().active !== active) return false;
+  if (!markerMatchesSnapshot(markerPath, previous)) return false;
+  try {
+    unlinkSync(markerPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function pidLiveness(pid) {
   if (!Number.isInteger(pid) || pid < 1 || pid > 2147483647) return 'unknown';
   try {
@@ -285,17 +356,20 @@ function scheduleProcessIdentityUpgrade(active) {
   const scheduleAttempt = (attempt) => {
     if (attempt >= IDENTITY_UPGRADE_DELAYS_MS.length) return;
     const timer = setTimeout(() => {
-      try {
-        if (sharedState().active !== active || !markerOwned(active)) return;
-        const processIdentity = processIdentityForPid(process.pid);
-        if (processIdentity && processIdentity.method !== 'uptime') {
-          const previousIdentity = active.processIdentity;
-          active.processIdentity = processIdentity;
-          if (writeMarker(active)) return;
-          active.processIdentity = previousIdentity;
-        }
-      } catch {}
-      scheduleAttempt(attempt + 1);
+      void (async () => {
+        try {
+          if (sharedState().active !== active || !markerOwned(active)) return;
+          const processIdentity = await processIdentityForPid(process.pid);
+          if (sharedState().active !== active || !markerOwned(active)) return;
+          if (processIdentity && processIdentity.method !== 'uptime') {
+            const previousIdentity = active.processIdentity;
+            active.processIdentity = processIdentity;
+            if (writeMarker(active)) return;
+            active.processIdentity = previousIdentity;
+          }
+        } catch {}
+        scheduleAttempt(attempt + 1);
+      })();
     }, IDENTITY_UPGRADE_DELAYS_MS[attempt]);
     timer.unref?.();
   };
@@ -325,14 +399,23 @@ function reapVanishedMarkers(active) {
       else if (liveness === 'dead' && recordPriorVanished(active, previous)) unlinkSync(markerPath);
     } catch {}
   }
-  const identities = processIdentitiesForPids(occupied.map(({ previous }) => previous.pid));
+  void reapOccupiedMarkers(active, occupied).catch(() => {});
+}
+
+async function reapOccupiedMarkers(active, occupied) {
+  const identities = await processIdentitiesForPids(occupied.map(({ previous }) => previous.pid));
+  if (sharedState().active !== active) return;
   for (const { markerPath, previous } of occupied) {
     try {
+      if (sharedState().active !== active) return;
+      if (!markerMatchesSnapshot(markerPath, previous)) continue;
       const identityMatch = sameProcessIdentity(
         previous.processIdentity,
         identities.get(previous.pid) || null,
       );
-      if (identityMatch === false && recordPriorVanished(active, previous)) unlinkSync(markerPath);
+      if (identityMatch === false) {
+        await recordPriorVanishedAsync(active, markerPath, previous);
+      }
     } catch {}
   }
 }
@@ -412,25 +495,63 @@ function strongerReason(current, candidate) {
   return (rank[candidate] ?? 0) > (rank[current] ?? -1) ? candidate : current;
 }
 
-export function finishProcessLifecycle(reason = 'clean-shutdown', exitCode = 0) {
-  const state = sharedState();
-  const active = state.active;
-  if (!active) return false;
+function accumulateProcessLifecycleFinish(active, reason, exitCode) {
   const finalReason = VALID_REASONS.has(reason) ? reason : 'clean-shutdown';
   const nextReason = strongerReason(active.finalReason, finalReason);
   if (nextReason !== active.finalReason || !Number.isInteger(active.finalExitCode)) {
     active.finalExitCode = exitCode;
   }
   active.finalReason = nextReason;
-  const written = recordCurrent(active.finalReason, active.finalExitCode);
-  if (!written) return false;
+}
+
+function claimProcessLifecycleFinish(reason, exitCode) {
+  const state = sharedState();
+  const active = state.active;
+  if (!active) return null;
+  accumulateProcessLifecycleFinish(active, reason, exitCode);
+  if (active.finishing) return null;
+  active.finishing = true;
+  return { state, active };
+}
+
+function completeProcessLifecycleFinish(state, active, written) {
+  if (!written) {
+    active.finishing = false;
+    return false;
+  }
   if (markerOwned(active)) {
-    try { unlinkSync(active.markerPath); } catch { return false; }
+    try { unlinkSync(active.markerPath); } catch {
+      active.finishing = false;
+      return false;
+    }
   }
   state.active = null;
   return true;
 }
 
+export function finishProcessLifecycle(reason = 'clean-shutdown', exitCode = 0) {
+  const claimed = claimProcessLifecycleFinish(reason, exitCode);
+  if (!claimed) return false;
+  const { state, active } = claimed;
+  return completeProcessLifecycleFinish(
+    state,
+    active,
+    appendEntry(active, lifecycleEntry(active, active.finalReason, active.finalExitCode)),
+  );
+}
+
+export async function finishProcessLifecycleAsync(reason = 'clean-shutdown', exitCode = 0) {
+  const claimed = claimProcessLifecycleFinish(reason, exitCode);
+  if (!claimed) return false;
+  const { state, active } = claimed;
+  const written = await appendEntryAsync(
+    active,
+    () => lifecycleEntry(active, active.finalReason, active.finalExitCode),
+    () => state.active === active && active.finishing,
+  );
+  return completeProcessLifecycleFinish(state, active, written);
+}
+
 export function lifecyclePathsForTest(directory) {
   return paths(directory);
 }

package/src/runtime/shared/process-shutdown.mjs

@@ -2,6 +2,7 @@
 
 import {
   finishProcessLifecycle,
+  finishProcessLifecycleAsync,
   recordCatchableFatal,
 } from './process-lifecycle.mjs';
 
@@ -125,7 +126,7 @@ export function installProcessSignalCleanup({
     }
     running = false;
     if (shouldExit) {
-      finishProcessLifecycle(
+      await finishProcessLifecycleAsync(
         cleanupFailed ? 'forced-cleanup' : error ? 'catchable-fatal-error' : 'clean-shutdown',
         code,
       );

package/src/session-runtime/model-route-api.mjs

@@ -45,7 +45,8 @@ export function createModelRouteApi(deps) {
     getConfigHasSecrets, getSearchRouteState, setSearchRouteState,
     cfgMod, reg, mgr, statusRoutes,
     resolveRoute, searchCapableFor, lookupModelMeta,
-    adoptConfig, saveConfigAndAdopt, ensureFullConfig, ensureProvidersReady,
+    adoptConfig, saveConfigAndAdopt, ensureFullConfig, awaitKeychainPrewarm,
+    ensureProvidersReady,
     persistLeadRoute, refreshRouteEffort,
     refreshStatuslineUsageSnapshot, scheduleStatuslineUsageRefresh,
     invalidateContextStatusCache, invalidateProviderCaches,
@@ -70,6 +71,7 @@ export function createModelRouteApi(deps) {
       }
       if (!selectedRoute) throw new Error('search route requires provider and model');
       if (isDefaultSearchRouteConfig(selectedRoute)) {
+        await awaitKeychainPrewarm();
         ensureFullConfig();
         const routeToSave = normalizeSearchRouteConfig({
           provider: SEARCH_DEFAULT_PROVIDER,
@@ -87,6 +89,7 @@ export function createModelRouteApi(deps) {
       if (!isSearchCapableProvider(selectedRoute.provider)) {
         throw new Error(`provider "${selectedRoute.provider}" does not support Mixdog native search`);
       }
+      await awaitKeychainPrewarm();
       ensureFullConfig();
       await ensureProvidersReady(ensureProviderEnabled(getConfig(), selectedRoute.provider));
       const modelMeta = await lookupModelMeta(selectedRoute.provider, selectedRoute.model);

package/src/session-runtime/native-search.mjs

@@ -11,6 +11,7 @@ export function createNativeSearch({
   getSession,
   getReg,
   ensureFullConfig,
+  awaitKeychainPrewarm,
   ensureProvidersReady,
   ensureProviderEnabled,
   normalizeSearchProviderId,
@@ -91,8 +92,9 @@ export function createNativeSearch({
     return { ...route, id: route.model, display: route.model, name: route.model };
   }
 
-  function nativeSearchRoutes() {
+  async function nativeSearchRoutes() {
     const route = getRoute();
+    await awaitKeychainPrewarm();
     const cfg = ensureFullConfig();
     const searchRoute = normalizeSearchRouteConfig(cfg.searchRoute) || normalizeSearchRouteConfig(getSearchRoute());
     setSearchRoute(searchRoute);
@@ -172,7 +174,7 @@ export function createNativeSearch({
     const route = getRoute();
     const session = getSession();
     const reg = getReg();
-    const candidates = nativeSearchRoutes();
+    const candidates = await nativeSearchRoutes();
     if (!candidates.length) {
       if (isDefaultSearchRouteConfig(getSearchRoute())) {
         throw new Error(`default search route requires the current main model to support native web search (${route?.provider || 'unknown'}/${route?.model || 'unknown'})`);

package/src/session-runtime/provider-auth-api.mjs

@@ -22,6 +22,7 @@ export function createProviderAuthApi({
   saveConfigAndAdopt,
   displayConfig,
   reloadFullConfig,
+  awaitKeychainPrewarm,
   invalidateProviderCaches,
   warmProviderModelCache,
   refreshProviderCatalogs,
@@ -52,6 +53,7 @@ export function createProviderAuthApi({
       return await getUsageDashboard(options);
     },
     async authenticateProvider(providerId, secret) {
+      await awaitKeychainPrewarm();
       const result = String(secret || '').trim()
         ? saveProviderApiKey(cfgMod, providerId, secret)
         : await loginOAuthProvider(cfgMod, providerId);
@@ -62,6 +64,7 @@ export function createProviderAuthApi({
       return result;
     },
     async loginOAuthProvider(providerId) {
+      await awaitKeychainPrewarm();
       const result = await loginOAuthProvider(cfgMod, providerId);
       reloadFullConfig();
       invalidateProviderCaches();
@@ -70,11 +73,13 @@ export function createProviderAuthApi({
       return result;
     },
     async beginOAuthProviderLogin(providerId) {
+      await awaitKeychainPrewarm();
       const result = await beginOAuthProviderLogin(cfgMod, providerId);
       reloadFullConfig();
       return {
         ...result,
-        waitForCallback: result.waitForCallback?.then((completed) => {
+        waitForCallback: result.waitForCallback?.then(async (completed) => {
+          await awaitKeychainPrewarm();
           reloadFullConfig();
           if (completed) {
             invalidateProviderCaches();
@@ -85,6 +90,7 @@ export function createProviderAuthApi({
         }),
         completeCode: async (code) => {
           const completed = await result.completeCode(code);
+          await awaitKeychainPrewarm();
           reloadFullConfig();
           invalidateProviderCaches();
           refreshProviderCatalogsSoon();
@@ -114,6 +120,7 @@ export function createProviderAuthApi({
       return result;
     },
     async loginOpenCodeGoUsage() {
+      await awaitKeychainPrewarm();
       const result = await loginOpenCodeGoUsage(cfgMod);
       reloadFullConfig();
       invalidateProviderCaches();

package/src/session-runtime/provider-models.mjs

@@ -27,6 +27,7 @@ export function createProviderModels({
   normalizeSearchProviderId,
   isSearchCapableProvider,
   ensureFullConfig,
+  awaitKeychainPrewarm,
   ensureProvidersReady,
   bootProfile,
   scheduleProviderModelWarmup,
@@ -100,7 +101,8 @@ export function createProviderModels({
     return sortProviderModels((rows || []).map(hydrateProviderModelRow));
   }
 
-  function enabledSearchProviderConfig() {
+  async function enabledSearchProviderConfig() {
+    await awaitKeychainPrewarm();
     ensureFullConfig();
     const out = {};
     for (const [name, providerConfig] of Object.entries(config().providers || {})) {
@@ -112,7 +114,7 @@ export function createProviderModels({
   }
 
   async function loadSearchProviderModelsFresh({ forceRefresh = false } = {}) {
-    const searchProviders = enabledSearchProviderConfig();
+    const searchProviders = await enabledSearchProviderConfig();
     const providerNames = Object.keys(searchProviders);
     if (!providerNames.length) return [];
     await ensureProvidersReady(config().providers || {});
@@ -163,7 +165,10 @@ export function createProviderModels({
   async function loadProviderModelsFresh({ forceRefresh = false, loadSecrets = true } = {}) {
     const startedAt = performance.now();
     profile('load:start', { forceRefresh, loadSecrets });
-    if (loadSecrets) ensureFullConfig();
+    if (loadSecrets) {
+      await awaitKeychainPrewarm();
+      ensureFullConfig();
+    }
     const providersStartedAt = performance.now();
     await ensureProvidersReady(config().providers || {});
     profile('providers-ready', { ms: (performance.now() - providersStartedAt).toFixed(1) });

package/src/session-runtime/resource-api.mjs

@@ -32,7 +32,7 @@ export function createResourceApi(deps) {
     saveConfigAndAdopt, connectConfiguredMcp, invalidatePreSessionToolSurface,
     recreateCurrentSessionIfReady, normalizeMcpServerInput, mcpStatus,
     skillsStatus, skillContent, addProjectSkill, pluginsStatus, getMemoryModule,
-    reloadFullConfig, getActiveTurnCount,
+    reloadFullConfig, awaitKeychainPrewarm, getActiveTurnCount,
   } = deps;
   // Per-server MCP toggle serialization. The synchronous config adopt in
   // setMcpServerEnabled has already made the intent durable; the heavy
@@ -105,6 +105,7 @@ export function createResourceApi(deps) {
       return mcpStatus();
     },
     async reconnectMcp() {
+      await awaitKeychainPrewarm();
       reloadFullConfig();
       const status = await connectConfiguredMcp({ reset: true });
       invalidatePreSessionToolSurface();

package/src/session-runtime/runtime-core.mjs

@@ -2,6 +2,7 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSy
 import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
 import { performance } from 'node:perf_hooks';
 import httpMod from 'node:http';
+import keychain from '../lib/keychain-cjs.cjs';
 import './hitch-profile.mjs';
 import { ensureStandaloneEnvironment } from '../standalone/seeds.mjs';
 import { createStandaloneAgent } from '../standalone/agent-tool.mjs';
@@ -285,6 +286,7 @@ export function __applyStandaloneToolDefaultsForTest(tool) {
 const resolveDefaultProvider = makeResolveDefaultProvider(isKnownProvider);
 const resolveRoute = makeResolveRoute(resolveDefaultProvider);
 const searchCapableFor = makeSearchCapableFor(normalizeSearchProviderId, isSearchCapableProvider);
+const KEYCHAIN_PREWARM_WAIT_MS = 5000;
 
 const outputStyleStatus = (dataDir = STANDALONE_DATA_DIR, opts = {}) => outputStyleStatusRaw(STANDALONE_ROOT, dataDir || STANDALONE_DATA_DIR, opts);
 // Workflow/agent pack loaders bound to this runtime's root/data layout.
@@ -346,6 +348,26 @@ export async function createMixdogSessionRuntime({
     dataDir: STANDALONE_DATA_DIR,
   });
   bootProfile('standalone-env:ready', { ms: (performance.now() - standaloneStartedAt).toFixed(1) });
+  const keychainPrewarmPromise = keychain.prewarmSecrets();
+  let keychainPrewarmWaitDone = false;
+  let keychainPrewarmWaitPromise = null;
+  function awaitKeychainPrewarm() {
+    if (keychainPrewarmWaitDone) return Promise.resolve();
+    keychainPrewarmWaitPromise ??= (async () => {
+      let timeoutId;
+      const deadline = new Promise((resolveDeadline) => {
+        timeoutId = setTimeout(resolveDeadline, KEYCHAIN_PREWARM_WAIT_MS);
+        timeoutId.unref?.();
+      });
+      try {
+        await Promise.race([keychainPrewarmPromise, deadline]);
+      } finally {
+        clearTimeout(timeoutId);
+        keychainPrewarmWaitDone = true;
+      }
+    })();
+    return keychainPrewarmWaitPromise;
+  }
 
   const importsStartedAt = performance.now();
   const [
@@ -958,6 +980,8 @@ export async function createMixdogSessionRuntime({
     mgr,
     dataDir: cfgMod.getPluginData(),
     cwd,
+    awaitKeychainPrewarm,
+    isKeychainPrewarmReady: () => keychainPrewarmWaitDone,
     // SubagentStart/SubagentStop: bridge internal worker spawn/finish to the
     // standard hook bus. agent_type is passed top-level via hookCommonPayload
     // (added to hook-bus buildEventPayload passthrough). Best-effort.
@@ -1250,6 +1274,7 @@ export async function createMixdogSessionRuntime({
   });
 
   async function ensureProvidersReady(providerConfig = config.providers || {}) {
+    await awaitKeychainPrewarm();
     const initKey = providerInitCacheKey(providerConfig);
     const existing = providerInitPromises.get(initKey);
     if (existing) return await existing;
@@ -1290,6 +1315,7 @@ export async function createMixdogSessionRuntime({
     getSession: () => session,
     getReg: () => reg,
     ensureFullConfig,
+    awaitKeychainPrewarm,
     ensureProvidersReady,
     ensureProviderEnabled,
     normalizeSearchProviderId,
@@ -1352,6 +1378,7 @@ export async function createMixdogSessionRuntime({
     normalizeSearchProviderId,
     isSearchCapableProvider,
     ensureFullConfig,
+    awaitKeychainPrewarm,
     ensureProvidersReady,
     bootProfile,
     scheduleProviderModelWarmup: () => scheduleProviderModelWarmupRef(),
@@ -1460,6 +1487,7 @@ export async function createMixdogSessionRuntime({
     const startedAt = performance.now();
     bootProfile('session:create:start', { mode, reason });
     const promise = (async () => {
+      await awaitKeychainPrewarm();
       ensureConfigForRouteProvider();
       await resolveMissingRouteModelForFirstTurn();
       requireModelRoute();
@@ -1591,6 +1619,7 @@ export async function createMixdogSessionRuntime({
     getProviderModelsPromise: () => providerModelCaches.providerModelsPromise,
     reloadFullConfig,
     ensureConfigForRouteProvider,
+    awaitKeychainPrewarm,
     ensureProvidersReady,
     ensureProviderEnabled,
     refreshStatuslineUsageSnapshot,
@@ -2053,6 +2082,7 @@ export async function createMixdogSessionRuntime({
     saveConfigAndAdopt,
     displayConfig,
     reloadFullConfig,
+    awaitKeychainPrewarm,
     invalidateProviderCaches,
     warmProviderModelCache,
     refreshProviderCatalogs: () => ensureProvidersReady(config.providers || {}).then(() => reg.refreshCatalogs()),
@@ -2120,6 +2150,7 @@ export async function createMixdogSessionRuntime({
     pluginsStatus,
     getMemoryModule,
     reloadFullConfig,
+    awaitKeychainPrewarm,
     getActiveTurnCount: () => activeTurnCount,
   });
   const modelRouteApi = createModelRouteApi({
@@ -2141,6 +2172,7 @@ export async function createMixdogSessionRuntime({
     adoptConfig,
     saveConfigAndAdopt,
     ensureFullConfig,
+    awaitKeychainPrewarm,
     ensureProvidersReady,
     persistLeadRoute,
     refreshRouteEffort,

package/src/session-runtime/session-turn-api.mjs

@@ -167,6 +167,7 @@ export function createSessionTurnApi(deps) {
           options.prefetch || null,
           {
             onTextDelta: options.onTextDelta,
+            onTextReset: options.onTextReset,
             onReasoningDelta: options.onReasoningDelta,
             onAssistantText: (text) => {
               if (getRemoteEnabled() && getTranscriptWriter()) {

package/src/session-runtime/warmup-schedulers.mjs

@@ -18,6 +18,7 @@ export function createWarmupSchedulers({
   getProviderModelsPromise,
   reloadFullConfig,
   ensureConfigForRouteProvider,
+  awaitKeychainPrewarm,
   ensureProvidersReady,
   ensureProviderEnabled,
   refreshStatuslineUsageSnapshot,
@@ -50,7 +51,7 @@ export function createWarmupSchedulers({
       return;
     }
     if (timers.providerWarmupTimer || isCloseRequested()) return;
-    timers.providerWarmupTimer = setTimeout(() => {
+    timers.providerWarmupTimer = setTimeout(async () => {
       timers.providerWarmupTimer = null;
       if (isCloseRequested()) return;
       if (!isFirstTurnCompleted() && !envFlag('MIXDOG_PROVIDER_WARMUP_BEFORE_FIRST_TURN')) {
@@ -64,6 +65,7 @@ export function createWarmupSchedulers({
       }
       const providersStartedAt = performance.now();
       try {
+        await awaitKeychainPrewarm();
         reloadFullConfig();
       } catch (error) {
         bootProfile('config:full-failed', { error: error?.message || String(error) });
@@ -151,6 +153,7 @@ export function createWarmupSchedulers({
         return;
       }
       try {
+        await awaitKeychainPrewarm();
         ensureConfigForRouteProvider();
         await ensureProvidersReady(ensureProviderEnabled(getConfig(), getRoute().provider));
         if (isCloseRequested()) return;
@@ -183,6 +186,7 @@ export function createWarmupSchedulers({
         return;
       }
       try {
+        await awaitKeychainPrewarm();
         ensureConfigForRouteProvider();
         await ensureProvidersReady(ensureProviderEnabled(getConfig(), getRoute().provider));
         if (isCloseRequested()) return;