mixdog 0.9.55 → 0.9.59

package/scripts/tui-transcript-perf-test.mjs

@@ -13,6 +13,17 @@ import {
 import { createSessionFlow } from '../src/tui/engine/session-flow.mjs';
 import { createEngineApiA } from '../src/tui/engine/session-api.mjs';
 import { createRunTurn } from '../src/tui/engine/turn.mjs';
+import { createContextState } from '../src/tui/engine/context-state.mjs';
+import {
+  restoreTranscriptItems,
+  restoredAssistantTranscriptItems,
+  restoredTranscriptMetadata,
+} from '../src/tui/engine/session-api-ext.mjs';
+import {
+  attachAssistantTranscriptCompletion,
+  persistedAssistantTranscriptMetadata,
+} from '../src/runtime/agent/orchestrator/session/manager/ask-session.mjs';
+import { attachAssistantTranscriptMetadata } from '../src/runtime/agent/orchestrator/session/agent-loop.mjs';
 import {
   buildTranscriptRowIndexIncremental,
   transcriptItemsWithStableTail,
@@ -191,12 +202,16 @@ test('failed mid-turn compact leaves prior transcript items untouched', async ()
 
 test('stream flush keeps settled items identity and finalize appends one assistant', async () => {
   let identityStable = false;
+  let persistedAssistantMessage = null;
   const harness = makeTurnHarness(async (_text, options) => {
     const before = harness.getState().items;
     options.onTextDelta('settled line\n');
     await wait(30);
     identityStable = harness.getState().items === before;
     assert.match(harness.getState().streamingTail?.text || '', /settled line/);
+    persistedAssistantMessage = {
+      meta: { transcript: persistedAssistantTranscriptMetadata(options.transcriptMeta, Date.now()) },
+    };
     return { result: { content: 'settled line\n' }, session: { messages: [] } };
   });
 
@@ -207,6 +222,157 @@ test('stream flush keeps settled items identity and finalize appends one assista
   assert.equal(assistants.length, 1);
   assert.equal(assistants[0].streaming, false);
   assert.equal(assistants[0].text, 'settled line\n');
+  assert.equal(
+    restoredTranscriptMetadata(persistedAssistantMessage).at,
+    assistants[0].at,
+    'restored assistant timestamp must match its live creation timestamp',
+  );
+});
+
+test('no-delta final assistant persists the timestamp later used by the live item', async () => {
+  let persistedAssistantMessage = null;
+  const harness = makeTurnHarness(async (_text, options) => {
+    persistedAssistantMessage = {
+      meta: { transcript: persistedAssistantTranscriptMetadata(options.transcriptMeta, Date.now()) },
+    };
+    return { result: { content: 'final without deltas' }, session: { messages: [] } };
+  });
+
+  assert.equal(await harness.runTurn('go'), 'done');
+  const assistant = harness.getState().items.find((item) => item.kind === 'assistant');
+  assert.equal(assistant?.text, 'final without deltas');
+  assert.equal(restoredTranscriptMetadata(persistedAssistantMessage).at, assistant?.at);
+});
+
+test('assistant completion metadata survives session resume projection', () => {
+  const turnStartedAt = Date.parse('2026-07-18T01:00:00Z');
+  const messages = [
+    { role: 'user', content: 'Question', meta: { transcript: { at: turnStartedAt } } },
+    {
+      role: 'assistant',
+      content: 'Answer',
+      meta: { transcript: { at: turnStartedAt + 1_000, model: 'model-a' } },
+    },
+  ];
+  assert.equal(attachAssistantTranscriptCompletion(messages, {
+    status: 'done',
+    verb: 'Mapped',
+    elapsedMs: 2_000,
+  }, turnStartedAt), true);
+  let sequence = 0;
+  const restored = restoredAssistantTranscriptItems(messages[1], () => `restored-${++sequence}`);
+  assert.equal(restored.length, 2);
+  assert.deepEqual(restored[0], {
+    kind: 'assistant',
+    id: 'restored-1',
+    text: 'Answer',
+    at: turnStartedAt + 1_000,
+    model: 'model-a',
+  });
+  assert.deepEqual(restored[1], {
+    kind: 'turndone',
+    id: 'restored-2',
+    status: 'done',
+    verb: 'Mapped',
+    elapsedMs: 2_000,
+    at: turnStartedAt + 1_000,
+  });
+});
+
+test('cold transcript restore incrementally projects only the visible tail', () => {
+  let oldBodyReads = 0;
+  const oldMessages = Array.from({ length: 4_000 }, (_, index) => {
+    const message = { role: index % 2 === 0 ? 'user' : 'assistant' };
+    Object.defineProperty(message, 'content', {
+      enumerable: true,
+      get() {
+        oldBodyReads += 1;
+        return `old body ${index}`;
+      },
+    });
+    return message;
+  });
+  const recentMessages = Array.from({ length: 400 }, (_, index) => ({
+    role: index % 2 === 0 ? 'user' : 'assistant',
+    content: `recent body ${index}`,
+    ...(index % 2 === 1
+      ? { meta: { transcript: { completion: { status: 'done', elapsedMs: index } } } }
+      : {}),
+  }));
+  const messages = [...oldMessages, ...recentMessages];
+  const restored = restoreTranscriptItems(messages, {
+    sessionId: 'fast',
+    itemLimit: 64,
+  });
+  const recentFull = restoreTranscriptItems(recentMessages, { sessionId: 'recent' });
+
+  assert.equal(oldBodyReads, 0, 'tail restore must not read old message bodies');
+  assert.equal(restored.length, 64);
+  assert.deepEqual(
+    restored.map((item) => [item.kind, item.text || '', item.status || '']),
+    recentFull.slice(-64).map((item) => [item.kind, item.text || '', item.status || '']),
+  );
+  assert.match(restored[0].id, /^hist_fast_4\d{3}_\d+$/);
+});
+
+test('restored transcripts publish estimated context before a new provider turn', () => {
+  let state = {
+    stats: { inputTokens: 0, latestInputTokens: 0, latestPromptTokens: 0 },
+    busy: false,
+    spinner: null,
+    thinking: null,
+  };
+  const context = createContextState({
+    runtime: {
+      contextStatus: () => ({
+        contextWindow: 20_000,
+        currentEstimatedTokens: 1_250,
+        usedTokens: 1_250,
+        usedSource: 'estimated',
+        messages: { count: 2 },
+      }),
+    },
+    getState: () => state,
+    updateState: (patch) => { state = { ...state, ...patch }; },
+    getPendingSessionReset: () => false,
+  });
+  context.syncContextStats({ allowEstimated: true });
+  assert.equal(state.stats.currentContextTokens, 0);
+  assert.equal(state.stats.currentEstimatedContextTokens, 1_250);
+  assert.equal(state.stats.currentContextSource, 'estimated');
+});
+
+test('multi-tool preamble and final assistant preserve distinct live timestamps on restore', async () => {
+  const persistedAssistantMessages = [];
+  const takeAssistantTranscriptMetadata = (options) => {
+    const transcript = persistedAssistantTranscriptMetadata(options.transcriptMeta, Date.now());
+    delete options.transcriptMeta.assistantAt;
+    return transcript;
+  };
+  const harness = makeTurnHarness(async (_text, options) => {
+    options.onAssistantText('tool preamble');
+    await options.onToolCall(1, [{ id: 'call_1', name: 'grep', input: { pattern: 'x' } }]);
+    persistedAssistantMessages.push(attachAssistantTranscriptMetadata(
+      { role: 'assistant', content: 'tool preamble', toolCalls: [] },
+      { takeAssistantTranscriptMetadata: () => takeAssistantTranscriptMetadata(options) },
+    ));
+    options.onToolResult({ tool_call_id: 'call_1', content: 'ok' });
+    persistedAssistantMessages.push({
+      role: 'assistant',
+      content: 'final answer',
+      meta: { transcript: persistedAssistantTranscriptMetadata(options.transcriptMeta, Date.now()) },
+    });
+    return { result: { content: 'final answer' }, session: { messages: [] } };
+  });
+
+  assert.equal(await harness.runTurn('go'), 'done');
+  const liveAssistants = harness.getState().items.filter((item) => item.kind === 'assistant');
+  assert.equal(liveAssistants.length, 2);
+  assert.equal(new Set(liveAssistants.map((item) => item.at)).size, 2);
+  assert.deepEqual(
+    persistedAssistantMessages.map((message) => restoredTranscriptMetadata(message).at),
+    liveAssistants.map((item) => item.at),
+  );
 });
 
 test('abort after stream progress settles the tail and leaves no orphan', async () => {
@@ -516,6 +682,7 @@ test('transcript spill caps the live window and restores every item in order', (
   assert.deepEqual(live, original.slice(-live.length));
   assert.ok(live.length <= TRANSCRIPT_LIVE_ITEM_CAP);
   spill.reset();
+  spill.dispose();
 });
 
 test('spill restore succeeds before its asynchronous worker write completes', () => {

package/src/app.mjs

@@ -113,6 +113,29 @@ export async function run(argv = []) {
     );
     return 1;
   }
+  // Stale-bundle guard: a dist built before hot runtime sources caused weeks
+  // of ghost failures (compaction placeholder patches) that no longer existed
+  // in src. Sample a few hot files — a newer source than the bundle means the
+  // running behavior will NOT match the tree, so warn loudly.
+  try {
+    const { statSync } = await import('node:fs');
+    const bundleMtime = statSync(bundle).mtimeMs;
+    const hotSources = [
+      join(__dirname, 'runtime', 'agent', 'orchestrator', 'session', 'agent-loop.mjs'),
+      join(__dirname, 'runtime', 'agent', 'orchestrator', 'session', 'loop', 'stored-tool-args.mjs'),
+      join(__dirname, 'tui', 'engine', 'session-api-ext.mjs'),
+      join(__dirname, 'standalone', 'agent-tool.mjs'),
+    ];
+    const stale = hotSources.some((file) => {
+      try { return statSync(file).mtimeMs > bundleMtime + 1_000; } catch { return false; }
+    });
+    if (stale) {
+      process.stderr.write(
+        'mixdog: TUI bundle is OLDER than runtime sources — behavior will not match the tree.\n'
+        + '  Rebuild with: npm run build:tui\n',
+      );
+    }
+  } catch { /* advisory only */ }
   const { runTui } = await import('./tui/dist/index.mjs');
   bootProfile('tui:imported');
   return await runTui(opts);

package/src/cli.mjs

@@ -10,6 +10,12 @@ import { stagedChildExitCode } from './runtime/shared/staged-child-result.mjs';
 
 const argv = process.argv.slice(2);
 
+// React/ink resolve their build flavor from NODE_ENV at require time. Unset
+// NODE_ENV loads react-reconciler's DEVELOPMENT build, whose per-commit debug
+// bookkeeping consumed ~16% of TUI frame CPU under transcript load (cpuprofile
+// 2026-07-20). Default to production; an explicit NODE_ENV still wins.
+process.env.NODE_ENV ||= 'production';
+
 let swapped = false;
 const invocation = classifyCliInvocation(argv);
 const skipHostPrelude = invocation.kind === 'headless' || invocation.skipHostPrelude === true;

package/src/lib/keychain-cjs.cjs

@@ -128,7 +128,14 @@ function powershell(script) {
     // secret encryption/decryption. (pwsh/PS7 is intentionally not used: it does
     // not auto-load the ProtectedData assembly, so DPAPI silently fails there.)
     const exe = resolvePowershellExe();
+    const profiled = /^(1|true|yes|on)$/i.test(String(process.env.MIXDOG_BOOT_PROFILE || ''));
+    const startedAt = profiled ? Date.now() : 0;
     const r = run(exe, ['-NonInteractive', '-NoProfile', '-Command', script], { timeout: POWERSHELL_TIMEOUT_MS });
+    if (profiled) {
+        const caller = (new Error().stack || '').split('\n').slice(2, 5)
+            .map((line) => line.trim().replace(/\s+/g, '_')).join('<-');
+        try { process.stderr.write(`[mixdog-boot] keychain:sync-powershell ms=${Date.now() - startedAt} by=${caller}\n`); } catch {}
+    }
     if (r.error && r.error.code === 'ETIMEDOUT') {
         throw new Error(`[keychain] PowerShell DPAPI command timed out after ${POWERSHELL_TIMEOUT_MS}ms (host: ${exe})`);
     }
@@ -138,7 +145,7 @@ function powershell(script) {
     return r;
 }
 
-function powershellAsync(script) {
+function powershellAsync(script, input = null) {
     return new Promise((resolve) => {
         let child;
         try {
@@ -149,7 +156,7 @@ function powershellAsync(script) {
                     env: powershellEnv(),
                     shell: false,
                     windowsHide: true,
-                    stdio: ['ignore', 'pipe', 'pipe'],
+                    stdio: [input == null ? 'ignore' : 'pipe', 'pipe', 'pipe'],
                     timeout: POWERSHELL_TIMEOUT_MS,
                 },
             );
@@ -172,6 +179,10 @@ function powershellAsync(script) {
         };
         child.once('error', (error) => finish(null, error));
         child.once('close', (status) => finish(status));
+        if (input != null) {
+            child.stdin.on('error', () => { /* child exited early — close() reports it */ });
+            child.stdin.end(input);
+        }
     });
 }
 
@@ -348,30 +359,69 @@ function win32Get(account) {
     return out;
 }
 
+// Batch DPAPI decrypt used by prewarmSecrets: ONE PowerShell host decrypts
+// every ciphertext. Windows CreateProcess for powershell.exe is a SYNCHRONOUS
+// multi-hundred-ms operation on the calling thread (AV scanning), so the old
+// per-secret spawn fan-out froze the caller's event loop for N x spawn cost —
+// observed as a ~5s desktop boot stall with near-zero CPU. Accounts and
+// ciphertexts travel via stdin (never interpolated into the script); decrypted
+// values return base64-wrapped so arbitrary secret bytes survive the pipe.
+const PS_UNPROTECT_BATCH = [
+    'Add-Type -AssemblyName System.Security -ErrorAction SilentlyContinue;',
+    '[Console]::OutputEncoding = [System.Text.Encoding]::UTF8;',
+    '$scope = [System.Security.Cryptography.DataProtectionScope]::CurrentUser;',
+    'while (($line = [Console]::In.ReadLine()) -ne $null) {',
+    '  $parts = $line.Split("|", 2);',
+    '  if ($parts.Count -lt 2) { continue }',
+    '  try {',
+    '    $enc = [Convert]::FromBase64String($parts[1]);',
+    '    $dec = [System.Security.Cryptography.ProtectedData]::Unprotect($enc, $null, $scope);',
+    '    [Console]::Out.WriteLine($parts[0] + "|" + [Convert]::ToBase64String($dec));',
+    '  } catch {}',
+    '}',
+].join(' ');
+
 async function prewarmSecrets() {
     try {
         if (platform() !== 'win32' || KEYCHAIN_CACHE_TTL_MS === 0) return;
         const dir = secretsDir();
         const entries = await fs.promises.readdir(dir, { withFileTypes: true });
         const epoch = _cacheEpoch;
-        await Promise.all(entries
-            .filter((entry) => entry.isFile() && entry.name.endsWith('.dpapi'))
-            .map(async (entry) => {
-                const account = entry.name.slice(0, -'.dpapi'.length);
-                const generation = _cacheGenerations.get(account) || 0;
-                try {
-                    const b64 = (await fs.promises.readFile(path.join(dir, entry.name), 'utf8')).trim();
-                    if (!b64) return;
-                    const r = await powershellAsync(`& { ${PS_UNPROTECT} } '${b64}'`);
-                    const value = (r.stdout || '').trim();
-                    if (r.error || r.status !== 0 || !value) return;
-                    if (_cacheEpoch !== epoch || (_cacheGenerations.get(account) || 0) !== generation) return;
-                    _cacheSet(account, value);
-                } catch {
-                    // Individual corrupt, deleted, or undecryptable entries must
-                    // not prevent the remaining secrets from warming.
-                }
-            }));
+        const rows = [];
+        for (const entry of entries) {
+            if (!entry.isFile() || !entry.name.endsWith('.dpapi')) continue;
+            const account = entry.name.slice(0, -'.dpapi'.length);
+            try {
+                const b64 = (await fs.promises.readFile(path.join(dir, entry.name), 'utf8')).trim();
+                // Account names are filenames (no '|' on Windows) and ciphertexts
+                // are base64 — the line protocol below stays unambiguous.
+                if (b64) rows.push({ account, generation: _cacheGenerations.get(account) || 0, b64 });
+            } catch {
+                // Individual corrupt or deleted entries must not prevent the
+                // remaining secrets from warming.
+            }
+        }
+        if (rows.length === 0) return;
+        const r = await powershellAsync(
+            PS_UNPROTECT_BATCH,
+            rows.map((row) => `${row.account}|${row.b64}`).join('\n') + '\n',
+        );
+        if (r.error || r.status !== 0) return;
+        const generations = new Map(rows.map((row) => [row.account, row.generation]));
+        for (const line of String(r.stdout || '').split(/\r?\n/)) {
+            const separator = line.indexOf('|');
+            if (separator <= 0) continue;
+            const account = line.slice(0, separator);
+            if (!generations.has(account)) continue;
+            try {
+                const value = Buffer.from(line.slice(separator + 1), 'base64').toString('utf8');
+                if (!value) continue;
+                if (_cacheEpoch !== epoch || (_cacheGenerations.get(account) || 0) !== generations.get(account)) continue;
+                _cacheSet(account, value);
+            } catch {
+                // An undecodable row must not prevent the remaining secrets from warming.
+            }
+        }
     } catch {
         // Prewarming is an optional startup optimization and must never fail boot.
     }

package/src/runtime/agent/orchestrator/agent-runtime/agent-dispatch.mjs

@@ -285,7 +285,7 @@ export function makeAgentDispatch(opts = {}) {
     }
     const agent = opts.agent;
 
-    return async function agentDispatch({ prompt, preset: presetArg, sourceName: sourceNameArg, parentSignal: callParentSignal, idleTimeoutMs: callIdleTimeoutMs }) {
+    return async function agentDispatch({ prompt, preset: presetArg, sourceName: sourceNameArg, parentSignal: callParentSignal, idleTimeoutMs: callIdleTimeoutMs, cwd: callCwd }) {
         if (typeof prompt !== 'string' || !prompt) {
             throw new Error(`[agent-dispatch] prompt required for agent "${agent}"`);
         }
@@ -355,7 +355,9 @@ export function makeAgentDispatch(opts = {}) {
         // and the downstream skill-discovery path tolerates null. Combined
         // with the frozen agent skill meta-tools (collect.mjs) this keeps
         // every caller on the same provider cache shard.
-        const cwd = (typeof opts.cwd === 'string' && opts.cwd) ? opts.cwd : null;
+        const cwd = (typeof callCwd === 'string' && callCwd)
+            ? callCwd
+            : ((typeof opts.cwd === 'string' && opts.cwd) ? opts.cwd : null);
 
         // Unified dispatch: Pool B/C share bit-identical tools + system prompt
         // unless a hidden role declares a narrow toolSchemaProfile. Per-role

package/src/runtime/agent/orchestrator/agent-runtime/cache-strategy.mjs

@@ -10,7 +10,8 @@
  *   BP_1  system#1  (1h)  — shared tool policy + compact skill manifest
  *   BP_2  system#2  (1h)  — role/system rules (Lead / agent / hidden role)
  *   BP_3  system#3  (1h)  — stable memory/meta marker (sessionMarker system block; tier3)
- *   BP_4  messages  (5m agents/hidden; Lead linked to autoClear — see below) —
+ *   BP_4  messages  (1h public/hidden agents; Lead linked to autoClear,
+ *                    whose Anthropic default is 1h — see below) —
  *         sliding tool_result / prior user-text tail
  *
  * Tool schemas still sit before system in the provider prompt prefix. We do
@@ -19,8 +20,8 @@
  * agent worker tool schemas byte-stable is therefore still load-bearing.
  *
  * Tier 3 gets its own BP because memory/meta context is stable within the
- * session. The sliding messages BP handles tool_result accumulation and
- * per-call task/event data without pinning volatile text into the 1h tier.
+ * session. The sliding 1h messages BP handles tool_result accumulation and
+ * per-call task/event data while isolating volatile text from stable prefix BPs.
  *
  * Non-breakpoint providers:
  *   - OpenAI (public): prompt_cache_key + prompt_cache_retention=24h
@@ -73,18 +74,18 @@ function isOneShotMaintenanceAgent(agent) {
  * BP1~3 stay at 1h: the system/role/tier3 prefix is shared across sessions
  * (pool-stable), so the 2x write premium is amortized cross-session and the
  * warm window survives per-session gaps. The volatile message tail (BP4) is
- * per-session and trace data (2026-06) shows request gaps are p99 ≈ 4.5min —
- * 5m+ gaps mean a cold tail anyway, and the smart-compact path rebuilds the
- * history at that boundary. So hidden-agent and public-agent sessions keep
- * the cheaper 5m tail TTL (1.25x write vs 2x), aligned with the 5m
- * terminal-reap window for agents.
+ * per-session, but the 2026-07-16 6.8h trace supports a 1h tail: 24/25 Lead
+ * intra-session gaps over 5m were agent waits (5–27m), during which autoClear
+ * correctly cannot fire; 32.7% of agent intra-session gaps exceeded 5m due to
+ * long tool executions, with sessions surviving through reviewer fix-loop
+ * reuse; and no gap over 1h was observed. Tail-cost simulation (input-token
+ * equivalents) is Lead 1h=11.75M vs 5m=20.11M and agents 1h=14.46M vs
+ * 5m=45.04M: misses that rewrite the accumulated tail dominate the 2x-vs-1.25x
+ * write premium. Hidden and public-agent sessions therefore use a 1h tail.
  *
- * Lead sessions are linked to the user's autoClear idle-sweep config
- * instead of the fixed 5m default (see resolveLeadMessagesTtl): a Lead
- * session that autoClear will only reap after a long/never idle window
- * benefits from the 1h tail TTL (fewer writes over a long-lived session),
- * while a short idle-sweep window means the tail is going cold anyway and
- * 5m is cheaper to write.
+ * Lead sessions are linked to the user's autoClear idle-sweep config (see
+ * resolveLeadMessagesTtl); its Anthropic default is 1h, while explicit
+ * shorter overrides retain the shorter-sweep behavior.
  * (Tail TTL only affects explicit-breakpoint providers — Anthropic; no-op
  * elsewhere.)
  *
@@ -120,12 +121,12 @@ export function resolveCacheStrategy(agent, { autoClear } = {}) {
         return { tools: 'none', system: 'none', tier3: 'none', messages: 'none' };
     }
     if (getHiddenAgent(agent)) {
-        return { tools: 'none', system: '1h', tier3: '1h', messages: '5m' };
+        return { tools: 'none', system: '1h', tier3: '1h', messages: '1h' };
     }
     if (agent && agent !== 'lead') {
-        // Public (non-hidden, non-lead) agents keep the flat 5m tail — only
+        // Public (non-hidden, non-lead) agents keep the flat 1h tail — only
         // the Lead session's tail is linked to autoClear.
-        return { tools: 'none', system: '1h', tier3: '1h', messages: '5m' };
+        return { tools: 'none', system: '1h', tier3: '1h', messages: '1h' };
     }
     // Lead session (agent === 'lead', or no agent — raw/CLI callers default
     // to Lead behavior): message tail TTL is linked to autoClear (see

package/src/runtime/agent/orchestrator/agent-trace-format.mjs

@@ -21,6 +21,15 @@ const MIXDOG_SLOW_TOOL_TRACE_NAMES = new Set(
         .map((name) => name.trim())
         .filter(Boolean)
 );
+const RECOVERED_ERROR_MESSAGE_MAX_CHARS = 300;
+
+function compactRecoveredErrorMessage(value) {
+    if (value == null) return null;
+    const message = String(value);
+    return message.length > RECOVERED_ERROR_MESSAGE_MAX_CHARS
+        ? `${message.slice(0, 299)}…`
+        : message;
+}
 
 function traceAgentLoop({ sessionId, iteration, sendMs, messageCount, bodyBytesEst, agent = null }) {
     // Two emit modes, no behavior change either way:
@@ -67,6 +76,7 @@ function traceAgentCompact({
     model,
     error,
     error_code,
+    recovered_error,
     details,
 }) {
     appendAgentTrace({
@@ -96,6 +106,14 @@ function traceAgentCompact({
         model: model || null,
         error: error || null,
         error_code: error_code || null,
+        recovered_error: recovered_error && typeof recovered_error === 'object'
+            ? {
+                code: recovered_error.code ?? null,
+                // Capture already strips ANSI/newlines; retain this writer-side
+                // cap for any future compact-meta caller.
+                message: compactRecoveredErrorMessage(recovered_error.message),
+            }
+            : null,
         details: details && typeof details === 'object' ? details : null,
     });
 }

package/src/runtime/agent/orchestrator/providers/admission-scheduler.mjs

@@ -3,6 +3,10 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 
 export const PROVIDER_ACCOUNT_CONCURRENCY = 64;
 export const PROVIDER_ACCOUNT_MAX_QUEUE = 1024;
+// A cooldown longer than this is a quota-window block (subscription limit),
+// not a transient burst: parking requests silently for it would look like a
+// dead chat. Longer cooldowns fail fast with a visible error instead.
+export const PROVIDER_COOLDOWN_FAIL_FAST_MS = 60_000;
 const MAX_TIMEOUT_MS = 2_147_483_647;
 const currentAdmission = new AsyncLocalStorage();
 
@@ -23,6 +27,27 @@ function isAnthropicLane(key) {
     return provider === 'anthropic' || provider === 'anthropic-oauth';
 }
 
+function providerLabelForLane(key) {
+    const prefix = String(key).split(':', 1)[0];
+    const lower = prefix.toLowerCase();
+    if (lower === 'anthropic-oauth') return 'Anthropic OAuth';
+    if (lower === 'anthropic') return 'Anthropic';
+    return prefix;
+}
+
+// Compact duration without spaces/colons so err-text's `retryAfter=([^\s:]+)`
+// capture keeps the full value (e.g. 1h42m, 3m20s, 45s).
+function formatCooldownMs(ms) {
+    const totalSec = Math.max(1, Math.ceil((Number(ms) || 0) / 1000));
+    if (totalSec < 60) return `${totalSec}s`;
+    const totalMin = Math.floor(totalSec / 60);
+    const sec = totalSec % 60;
+    if (totalMin < 60) return sec ? `${totalMin}m${sec}s` : `${totalMin}m`;
+    const hr = Math.floor(totalMin / 60);
+    const min = totalMin % 60;
+    return min ? `${hr}h${min}m` : `${hr}h`;
+}
+
 function retryAfterMs(error, now) {
     const explicit = Number(error?.retryAfterMs);
     if (Number.isFinite(explicit) && explicit >= 0) return explicit;
@@ -47,6 +72,28 @@ export class ProviderAdmissionQueueOverflowError extends Error {
     }
 }
 
+/**
+ * Deterministic refusal while a long rate-limit cooldown is active. Surfaced
+ * to the caller immediately (turn fails with a visible error) instead of
+ * silently parking the request until the quota window resets. httpStatus 429
+ * routes it through the existing quota/rate-limit error presentation.
+ */
+export class ProviderCooldownError extends Error {
+    constructor(key, cooldownUntil, now) {
+        const remaining = Math.max(0, Number(cooldownUntil) - Number(now));
+        super(
+            `${providerLabelForLane(key)} rate-limit cooldown active; retryAfter=${formatCooldownMs(remaining)} — `
+            + 'wait for the quota window reset, or re-login / switch the provider account to continue now.',
+        );
+        this.name = 'ProviderCooldownError';
+        this.code = 'EPROVIDERCOOLDOWN';
+        this.httpStatus = 429;
+        this.laneKey = key;
+        this.cooldownUntil = cooldownUntil;
+        this.retryAfterMs = remaining;
+    }
+}
+
 /**
  * Per-account FIFO admission. Anthropic lanes use rate-limit cooldown and
  * additive recovery; other providers retain a fixed concurrency limit.
@@ -95,6 +142,12 @@ export class ProviderAdmissionScheduler {
             cooldownTimer: null,
         };
         this.lanes.set(laneKey, lane);
+        // Long cooldown = quota window. Fail fast with a visible error; short
+        // cooldowns (bursts) keep the silent park-and-drain smoothing below.
+        if (lane.adaptive && lane.cooldownUntil - this.now() > PROVIDER_COOLDOWN_FAIL_FAST_MS) {
+            this._scheduleCooldown(laneKey, lane);
+            return Promise.reject(new ProviderCooldownError(laneKey, lane.cooldownUntil, this.now()));
+        }
         if (lane.queue.length >= this.maxQueue) {
             return Promise.reject(new ProviderAdmissionQueueOverflowError(laneKey, this.maxQueue));
         }
@@ -120,6 +173,9 @@ export class ProviderAdmissionScheduler {
 
     _drain(key, lane) {
         if (lane.adaptive && lane.cooldownUntil > this.now()) {
+            if (lane.cooldownUntil - this.now() > PROVIDER_COOLDOWN_FAIL_FAST_MS) {
+                this._rejectQueueForCooldown(key, lane);
+            }
             this._scheduleCooldown(key, lane);
             return;
         }
@@ -187,9 +243,55 @@ export class ProviderAdmissionScheduler {
             Math.min(Number.MAX_SAFE_INTEGER, now + retryAfterMs(error, now)),
         );
         this._scheduleCooldown(key, lane);
+        // A quota-window cooldown must not leave already-queued requests
+        // hanging silently for hours — reject them with the same visible error
+        // the fail-fast admission path raises.
+        if (lane.cooldownUntil - now > PROVIDER_COOLDOWN_FAIL_FAST_MS) {
+            this._rejectQueueForCooldown(key, lane);
+        }
         return true;
     }
 
+    _rejectQueueForCooldown(key, lane) {
+        if (!lane.queue.length) return;
+        for (const item of lane.queue.splice(0)) {
+            if (item.canceled) {
+                this._detach(item);
+                continue;
+            }
+            item.canceled = true;
+            this._detach(item);
+            item.task = null;
+            item.reject(new ProviderCooldownError(key, lane.cooldownUntil, this.now()));
+        }
+    }
+
+    /**
+     * Clear rate-limit cooldowns (optionally for one provider). Called when
+     * provider credentials change — a re-login / account switch invalidates
+     * the old account's quota window, so requests must flow again immediately.
+     * Returns the number of lanes reset.
+     */
+    resetCooldowns(providerName = null) {
+        const wanted = providerName ? String(providerName).toLowerCase() : null;
+        let resetCount = 0;
+        for (const [key, lane] of [...this.lanes]) {
+            if (!lane.adaptive) continue;
+            if (wanted && String(key).split(':', 1)[0].toLowerCase() !== wanted) continue;
+            if (lane.cooldownUntil <= this.now() && lane.limit >= this.concurrency) continue;
+            lane.cooldownUntil = 0;
+            lane.limit = this.concurrency;
+            lane.recoverySuccesses = 0;
+            if (lane.cooldownTimer) {
+                this.clearTimer(lane.cooldownTimer);
+                lane.cooldownTimer = null;
+            }
+            resetCount += 1;
+            this._drain(key, lane);
+        }
+        return resetCount;
+    }
+
     _recordSuccess(lane) {
         if (!lane.adaptive || lane.limit >= this.concurrency) return;
         lane.recoverySuccesses += 1;
@@ -304,6 +406,15 @@ export function providerAdmissionKey(providerName, provider) {
 export const providerAdmissionScheduler = new ProviderAdmissionScheduler();
 const WRAPPED = Symbol.for('mixdog.providerAdmissionWrapped');
 
+/**
+ * Process-wide cooldown reset on the shared scheduler. Wired to provider auth
+ * mutations (login / API-key save / forget) so switching accounts resumes
+ * chat without a process restart.
+ */
+export function resetProviderAdmissionCooldowns(providerName = null) {
+    return providerAdmissionScheduler.resetCooldowns(providerName);
+}
+
 export function wrapProviderAdmission(provider, providerName, scheduler = providerAdmissionScheduler) {
     if (!provider || typeof provider.send !== 'function' || provider[WRAPPED]) return provider;
     const originalSend = provider.send;