mixdog 0.9.92 → 0.9.94

package/src/rules/shared/01-tool.md

@@ -1,34 +1,36 @@
 # Tool Use
 
-- Before the first call, gather every known facet in one tool message; one
-  shortest route per facet: broad/uncertain→`explore` (roles without it:
-  `find`); partial path/name→`find`; verified root+wildcard→`glob`;
-  quoted/non-identifier literal or regex→`grep`; exact code identifier/
-  relation→`code_graph` before grep; known file/span→`read` directly without
-  `grep`; verified directory→`list`; known edit→`apply_patch` (span already
-  seen; else `read`/`grep` first); program/state change→`shell`; web/current
-  external info→`search`.
-- Shortest total calls, maximum batching — every turn: all independent calls
-  in one concurrent message (shell included); combine variants/symbols/
-  scopes/paths/queries per call; same-file regions as one real
-  `{path,offset,limit}` array; graph targets as arrays; `explore` facets in
-  one `query[]` (max 8, no rephrased duplicates); all new edits in one patch.
-  Distinct facets, not alternative routes; sequential singles only for a
-  step whose arguments require the previous result — fixed follow-ups
-  (pinned installs, known writes) go in the same batch; only apply_patch
-  executes in order.
+- Before the first call, gather every known facet — environment, capability,
+  artifact, failure checks — in one bounded tool message, one shortest route
+  per facet: broad/uncertain→`explore` (roles without it: `find`); known
+  name fragment→`find`; verified root+wildcard→`glob`; text/code→`grep`;
+  symbol body/relation→`code_graph`; known file/span→`read`, not `grep`;
+  verified directory→`list`; known edit→`apply_patch`; program/state
+  change→`shell`; web/current info→`search`.
+- A turn is a plan, not a step: emit every already-determined call in one
+  concurrent message, merged per tool — one `shell` chain (`&&`/`;`), one
+  `read`, one `apply_patch` with verification in `post_shell`. In-message
+  order is guaranteed — edits land before the shell that checks them — so
+  produce and its check always ride one message, never a follow-up turn.
+  Distinct facets only — never two routes per facet. The archetype is two
+  turns — one message observes through the dedicated tools (`shell` beside
+  them, not instead of them), one chain produces and proves itself; a new
+  turn exists only at a true data dependency.
 - Verified paths: project root, session cwd, user-provided, tool-returned.
   `find` first for guessed path/name fragments; on ENOENT, find the basename.
   Retry `EXPLORATION_FAILED` once with changed tokens.
 - Stop when evidence covers the deliverable: a returned `path:line` or
-  nonzero `content_with_context` result is final — act on it (inspecting it
-  via read/code_graph is valid); only zero/error results justify changed
-  tokens or scope. Don't re-locate, re-verify, or reread returned spans.
-- `apply_patch` is the primary edit tool: send the patch as soon as target
-  path and new content are known. Hunk context comes verbatim from the newest
-  tool output of that span (`read`/`grep`/your own patch — post-patch content
-  after edits), never retyped from memory; one look-up beats a failed patch.
-  A same-turn shell after `apply_patch` runs once the patch lands.
+  nonzero `content_with_context` result is final for its returned range. Read
+  is allowed for new/uncovered lines; do not call read when grep/read already
+  fully covers the requested range. Only zero/error results justify new scope.
+- Verify in proportion to risk, appended to the producing chain (`shell`
+  tail or `post_shell`) — one decisive boundary probe covering its failure
+  modes. A pass is final — observed matching output IS the verification,
+  never re-checked in a later turn; on failure fix and rerun only what
+  failed. Optional diagnostics non-fatal; report verified vs assumed.
+- `apply_patch` is the primary edit tool: once target path and new content are
+  known, include the patch in the current tool batch, hunk context verbatim
+  from the newest tool output of that span (post-patch content after edits).
 - After starting or receiving a background task, end the turn — its
   completion notification resumes the work. Never poll, sleep-loop, or block;
   explicit wait only for a result the current turn cannot proceed without.

package/src/runtime/agent/orchestrator/agent-runtime/cache-strategy.mjs

@@ -120,18 +120,31 @@ export function resolveCacheStrategy(agent, { autoClear } = {}) {
     if (isOneShotMaintenanceAgent(agent)) {
         return { tools: 'none', system: 'none', tier3: 'none', messages: 'none' };
     }
+    // Operator override for the BP4 (messages-tail) TTL. Short-lived
+    // rapid-turn deployments (bench-style: session dies in <15min) never
+    // benefit from a 1h tail across its premium window, so '5m' trades the
+    // 2x write premium (1h, $10/M) down to 1.25x ($6.25/M) and deactivates
+    // the 1h volatile-content anchor guard. Product defaults below stay
+    // untouched when the env is unset.
+    const envMessagesTtl = (process.env.MIXDOG_CACHE_MESSAGES_TTL || '').trim();
+    const applyEnv = (strategy) => {
+        if (envMessagesTtl === '1h' || envMessagesTtl === '5m' || envMessagesTtl === 'none') {
+            return { ...strategy, messages: envMessagesTtl };
+        }
+        return strategy;
+    };
     if (getHiddenAgent(agent)) {
-        return { tools: 'none', system: '1h', tier3: '1h', messages: '1h' };
+        return applyEnv({ tools: 'none', system: '1h', tier3: '1h', messages: '1h' });
     }
     if (agent && agent !== 'lead') {
         // Public (non-hidden, non-lead) agents keep the flat 1h tail — only
         // the Lead session's tail is linked to autoClear.
-        return { tools: 'none', system: '1h', tier3: '1h', messages: '1h' };
+        return applyEnv({ tools: 'none', system: '1h', tier3: '1h', messages: '1h' });
     }
     // Lead session (agent === 'lead', or no agent — raw/CLI callers default
     // to Lead behavior): message tail TTL is linked to autoClear (see
     // resolveLeadMessagesTtl).
-    return { tools: 'none', system: '1h', tier3: '1h', messages: resolveLeadMessagesTtl(autoClear) };
+    return applyEnv({ tools: 'none', system: '1h', tier3: '1h', messages: resolveLeadMessagesTtl(autoClear) });
 }
 
 /**

package/src/runtime/agent/orchestrator/agent-trace-format.mjs

@@ -1,6 +1,6 @@
 import { createHash } from 'crypto';
 import { countJsonNextCalls } from './tools/next-call-utils.mjs';
-import { splitGrepLinePrefix } from './tools/builtin/grep-formatting.mjs';
+import { parseGrepContextHeader, splitGrepLinePrefix } from './tools/builtin/grep-formatting.mjs';
 import {
     appendAgentTrace,
     normalizeSessionId,
@@ -236,7 +236,27 @@ export function parseGrepCoverage(resultText, toolName, toolArgs, resultKind) {
     const out = [];
     const seen = new Set();
     let sectionPath = null;
+    let rawSourceLinesRemaining = 0;
+    const addLine = (path, lineNo) => {
+        if (!path || !Number.isInteger(lineNo) || lineNo < 1 || out.length >= GREP_COVERAGE_MAX) return;
+        const key = `${path}\0${lineNo}`;
+        if (seen.has(key)) return;
+        seen.add(key);
+        out.push({ path: String(path).replace(/\\/g, '/'), line: lineNo });
+    };
     for (const line of String(resultText ?? '').split(/\r?\n/)) {
+        if (rawSourceLinesRemaining > 0) {
+            rawSourceLinesRemaining--;
+            continue;
+        }
+        const header = parseGrepContextHeader(line);
+        if (header) {
+            for (let lineNo = header.startLine; lineNo <= header.endLine && out.length < GREP_COVERAGE_MAX; lineNo++) {
+                addLine(header.path, lineNo);
+            }
+            rawSourceLinesRemaining = header.sourceLineCount;
+            continue;
+        }
         const section = line.match(/^# grep (.+)$/);
         if (section) {
             if (!section[1].startsWith('pattern:')) sectionPath = section[1];
@@ -252,11 +272,7 @@ export function parseGrepCoverage(resultText, toolName, toolArgs, resultKind) {
         const path = split?.path || (omitted ? toolArgs.path : null) || (sectionOmitted ? sectionPath : null);
         const lineNo = split?.lineNo || (omitted ? Number(omitted[1]) : null)
             || (sectionOmitted ? Number(sectionOmitted[1]) : null);
-        if (!path || !Number.isInteger(lineNo) || lineNo < 1) continue;
-        const key = `${path}\0${lineNo}`;
-        if (seen.has(key)) continue;
-        seen.add(key);
-        out.push({ path: String(path).replace(/\\/g, '/'), line: lineNo });
+        addLine(path, lineNo);
         if (out.length >= GREP_COVERAGE_MAX) break;
     }
     return out.length ? out : null;

package/src/runtime/agent/orchestrator/agent-trace.mjs

@@ -38,6 +38,22 @@ function extractCachedTokens(usage) {
     return 0;
 }
 
+function extractCacheWriteTokens(usage) {
+    const candidates = [
+        usage?.input_tokens_details?.cache_write_tokens,
+        usage?.prompt_tokens_details?.cache_write_tokens,
+        usage?.inputTokensDetails?.cacheWriteTokens,
+        usage?.promptTokensDetails?.cacheWriteTokens,
+        usage?.cache_write_tokens,
+        usage?.cacheWriteTokens,
+    ];
+    for (const value of candidates) {
+        const n = Number(value);
+        if (Number.isFinite(n)) return n;
+    }
+    return 0;
+}
+
 // Lightweight fingerprint of the conversation prefix. Hashes the first 4096
 // characters of JSON.stringify(messages) — enough to detect prefix mutation
 // across iterations (which invalidates the provider prompt cache) without
@@ -267,6 +283,7 @@ export {
     appendAgentTrace,
     drainAgentTrace,
     estimateProviderPayloadBytes,
+    extractCacheWriteTokens,
     extractCachedTokens,
     messagePrefixHash,
     traceAgentFetch,

package/src/runtime/agent/orchestrator/context/collect.mjs

@@ -275,7 +275,7 @@ export function buildSkillToolEnvelope(name, content, skillDir) {
     };
 }
 
-function compactSkillManifestText(value, max = 180) {
+function compactSkillManifestText(value, max = 100) {
     const text = String(value || '').replace(/\s+/g, ' ').trim();
     return text.length > max ? `${text.slice(0, Math.max(1, max - 3))}...` : text;
 }
@@ -374,6 +374,11 @@ function sanitizeMcpInstructionText(text, max = MCP_INSTRUCTION_MAX_CHARS) {
 /**
  * Per-server MCP initialize instructions for deferred-pool tools only.
  * Empty when no instructions or no matching deferred MCP tools → omit block.
+ * Emits ONLY the server heading + instruction body: the per-server tool names
+ * are deliberately NOT repeated here — every pool tool is already listed once
+ * (with its description) in <available-deferred-tools>, and re-listing ~30
+ * names per server doubled the MCP share of the BP1 prefix (2026-08-05 audit).
+ * Server membership stays evident from the mcp__<server>__ name prefix.
  */
 function buildMcpInstructionsManifest(mcpServerInstructions, poolNames) {
     const map = mcpServerInstructions && typeof mcpServerInstructions === 'object'
@@ -400,8 +405,7 @@ function buildMcpInstructionsManifest(mcpServerInstructions, poolNames) {
     for (const server of servers) {
         const safeServer = sanitizeMcpManifestServerName(server);
         const body = sanitizeMcpInstructionText(map[server]);
-        const tools = [...toolsByServer.get(server)].sort((a, b) => a.localeCompare(b));
-        lines.push(`## ${safeServer}`, body, ...tools.map((tool) => `- ${tool}`));
+        lines.push(`## ${safeServer}`, body);
     }
     lines.push('</mcp-instructions>');
     return lines.join('\n');
@@ -528,6 +532,7 @@ export function buildSkillToolDefs(skills, { ownerIsAgentSession = false } = {})
                     name: { type: 'string', description: 'Skill name' },
                 },
                 required: ['name'],
+                additionalProperties: false,
             },
         },
     ];

package/src/runtime/agent/orchestrator/providers/anthropic-effort.mjs

@@ -208,7 +208,15 @@ export function applyAnthropicEffortToBody(
         // modelSupportsEffort() allowlist so older models never receive it.
         // Set unconditionally (independent of `normalized`) so effort-capable
         // turns always carry adaptive thinking + round-trip signatures.
-        body.thinking = { type: 'adaptive', display: 'summarized' };
+        // MIXDOG_ANTHROPIC_THINKING_DISPLAY=omitted (operator/bench knob):
+        // CC-parity mode — no thinking blocks come back, so nothing is
+        // replayed into later requests (saves the 1h cache-write + re-read on
+        // accumulated thinking) at the cost of losing visible reasoning and
+        // cross-iteration thinking continuity. Default stays summarized.
+        const display = (process.env.MIXDOG_ANTHROPIC_THINKING_DISPLAY || '').trim() === 'omitted'
+            ? 'omitted'
+            : 'summarized';
+        body.thinking = { type: 'adaptive', display };
         // Adaptive/4.7+ models reject any non-default sampling param with a 400.
         delete body.temperature;
         delete body.top_p;

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -64,6 +64,18 @@ import {
     stampAnthropicStreamOutcome,
 } from './anthropic-sse.mjs';
 import { buildAnthropicBetaHeaders, supportsAnthropicFastMode } from './anthropic-betas.mjs';
+import { gzipSync } from 'node:zlib';
+
+// Request-body gzip gate (see the fetch site below). Env kill-switch
+// (MIXDOG_ANTHROPIC_REQ_GZIP=0) plus a process-wide latch flipped on the
+// first 400 response to a compressed request. Small bodies skip compression:
+// below ~8KB the CPU + header cost outweighs the upload saving.
+const ANTHROPIC_REQ_GZIP_MIN_BYTES = 8 * 1024;
+let _anthropicReqGzipLatch = false;
+function _anthropicReqGzipDisabled() {
+    return _anthropicReqGzipLatch || process.env.MIXDOG_ANTHROPIC_REQ_GZIP === '0';
+}
+function _disableAnthropicReqGzip() { _anthropicReqGzipLatch = true; }
 import {
     applyAnthropicEffortToBody,
     effortValuesForModel,
@@ -654,7 +666,16 @@ export class AnthropicOAuthProvider {
                 // provider-visible cache breakpoint off the cached one — the
                 // exact COLD-turn bug this change fixes. Order is fixed:
                 // build → sanitize (once) → mark → JSON.stringify.
-                const response = await fetch(API_URL, {
+                // Request-body gzip (probe-verified 2026-08-04: /v1/messages
+                // returns 200 for Content-Encoding: gzip, 400 for zstd). Large
+                // turn bodies (system prompt + history, typically 50-100KB+)
+                // compress ~5-10x, trimming upload time off every call's
+                // header wait. Latch OFF process-wide on the first 400 seen on
+                // a compressed request and retry that attempt uncompressed, so
+                // a server-side behavior change can never wedge the session.
+                const rawBody = Buffer.from(JSON.stringify(requestBody));
+                const useGzip = !_anthropicReqGzipDisabled() && rawBody.length >= ANTHROPIC_REQ_GZIP_MIN_BYTES;
+                const sendAttempt = (gz) => fetch(API_URL, {
                     method: 'POST',
                     headers: {
                         'Authorization': `Bearer ${accessToken}`,
@@ -669,11 +690,18 @@ export class AnthropicOAuthProvider {
                         'user-agent': `claude-cli/${resolveCliVersion()} (external, sdk-cli)`,
                         'x-app': 'cli',
                         'Content-Type': 'application/json',
+                        ...(gz ? { 'Content-Encoding': 'gzip' } : {}),
                     },
-                    body: JSON.stringify(requestBody),
+                    body: gz ? gzipSync(rawBody) : rawBody,
                     signal: controller.signal,
                     dispatcher: getLlmDispatcher(),
                 });
+                let response = await sendAttempt(useGzip);
+                if (useGzip && response.status === 400) {
+                    _disableAnthropicReqGzip();
+                    try { await response.arrayBuffer(); } catch { /* drain best-effort */ }
+                    response = await sendAttempt(false);
+                }
 
                 traceAgentFetch({
                     sessionId,
@@ -780,25 +808,13 @@ export class AnthropicOAuthProvider {
         // clock starting at the first stall (see createStallRetryBudget).
         const stallRetryBudget = createStallRetryBudget();
 
-        const recoverNonStreaming = async (midState, streamingError, controller) => {
-            const exposedChars = Number(midState?.emittedTextChars) || 0;
-            if (!onTextReset || exposedChars <= 0
-                || midState.emittedToolCall || midState.partialToolCall || midState.emittedThinking) {
-                try { streamingError.liveTextEmitted = true; streamingError.unsafeToRetry = true; } catch {}
-                throw streamingError;
-            }
-            let resetAccepted = false;
-            try {
-                resetAccepted = await onTextReset({
-                    chars: exposedChars,
-                    reason: 'anthropic-streaming-fallback',
-                }) === true;
-            } catch {}
-            if (!resetAccepted) {
-                try { streamingError.liveTextEmitted = true; streamingError.unsafeToRetry = true; } catch {}
-                throw streamingError;
-            }
-            try { controller?.abort?.(streamingError); } catch {}
+        // Core non-streaming re-issue: abort the dead stream and repeat the
+        // SAME request with stream:false. Shared by the exposed-text recovery
+        // (which must first get the owner's onTextReset acknowledgement) and
+        // the no-exposure stall fallback below (trivially safe — nothing was
+        // relayed or dispatched, so there is nothing to withdraw or replay).
+        const issueNonStreamingFallback = async (controller, abortReason) => {
+            try { controller?.abort?.(abortReason); } catch {}
             try { onStageChange?.('requesting', { transport: 'non-streaming-fallback' }); } catch {}
             let fallback = await requestWithRetry(creds.accessToken, { ...body, stream: false });
             if (fallback.response.status === 401) {
@@ -825,6 +841,27 @@ export class AnthropicOAuthProvider {
             }
         };
 
+        const recoverNonStreaming = async (midState, streamingError, controller) => {
+            const exposedChars = Number(midState?.emittedTextChars) || 0;
+            if (!onTextReset || exposedChars <= 0
+                || midState.emittedToolCall || midState.partialToolCall || midState.emittedThinking) {
+                try { streamingError.liveTextEmitted = true; streamingError.unsafeToRetry = true; } catch {}
+                throw streamingError;
+            }
+            let resetAccepted = false;
+            try {
+                resetAccepted = await onTextReset({
+                    chars: exposedChars,
+                    reason: 'anthropic-streaming-fallback',
+                }) === true;
+            } catch {}
+            if (!resetAccepted) {
+                try { streamingError.liveTextEmitted = true; streamingError.unsafeToRetry = true; } catch {}
+                throw streamingError;
+            }
+            return issueNonStreamingFallback(controller, streamingError);
+        };
+
         try {
         for (let attemptIndex = 0; attemptIndex <= MAX_MIDSTREAM_RETRIES; attemptIndex++) {
             let response, controller, cancelHandler;
@@ -1057,6 +1094,27 @@ export class AnthropicOAuthProvider {
                     continue;
                 }
                 const classifier = _classifyMidstreamError(err, midState);
+                // CC-parity stall recovery (2026-08-03 v3 postmortem): a
+                // stalled stream that exposed NOTHING (no text/thinking
+                // relayed, no tool emitted) is re-issued NON-STREAMING instead
+                // of retrying the same streaming shape. Effort-mode models can
+                // legitimately think in silence past any streaming idle
+                // window; an in-place streaming retry re-runs the same silent
+                // generation into the same timer (observed live: deterministic
+                // 4×~138s beheading, ~552s per turn), while the non-streaming
+                // transport simply waits for the full body (bounded by
+                // PROVIDER_NONSTREAM_TOTAL_TIMEOUT_MS). Claude Code does
+                // exactly this on its watchdog aborts. Replay is trivially
+                // safe here — nothing was relayed or dispatched.
+                if (classifier === 'stream_stalled'
+                    && _outcome?.replayUnsafe !== true
+                    && !midState.emittedText
+                    && !midState.emittedToolCall
+                    && !midState.partialToolCall
+                    && !midState.emittedThinking) {
+                    try { process.stderr.write('[anthropic-oauth] stream stalled with no exposure — retrying non-streaming\n'); } catch {}
+                    return await issueNonStreamingFallback(controller, err);
+                }
                 if (classifier === 'stream_stalled' && !stallRetryBudget.allowStallRetry()) {
                     try { process.stderr.write(`[anthropic-oauth] stall retry budget exhausted (${STREAM_STALL_RETRY_BUDGET_MS}ms since first stall) — surfacing for fresh-request retry\n`); } catch {}
                     try { controller?.abort?.(err); } catch { /* best-effort teardown */ }

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -320,25 +320,11 @@ export class AnthropicProvider {
             };
         };
 
-        const recoverNonStreaming = async (midState, streamingError, streamController) => {
-            const exposedChars = Number(midState?.emittedTextChars) || 0;
-            if (!onTextReset || exposedChars <= 0
-                || midState.emittedToolCall || midState.partialToolCall || midState.emittedThinking) {
-                try { streamingError.liveTextEmitted = true; streamingError.unsafeToRetry = true; } catch {}
-                throw streamingError;
-            }
-            let resetAccepted = false;
-            try {
-                resetAccepted = await onTextReset({
-                    chars: exposedChars,
-                    reason: 'anthropic-streaming-fallback',
-                }) === true;
-            } catch {}
-            if (!resetAccepted) {
-                try { streamingError.liveTextEmitted = true; streamingError.unsafeToRetry = true; } catch {}
-                throw streamingError;
-            }
-            try { streamController.abort?.(streamingError); } catch {}
+        // Core non-streaming re-issue shared by the exposed-text recovery
+        // (onTextReset-gated) and the no-exposure stall fallback (trivially
+        // safe — nothing was relayed or dispatched). Mirrors anthropic-oauth.
+        const issueNonStreamingFallback = async (streamController, abortReason) => {
+            try { streamController.abort?.(abortReason); } catch {}
             try { onStageChange?.('requesting', { transport: 'non-streaming-fallback' }); } catch {}
             const nonStreamingParams = { ...params, stream: false };
             const message = await withRetry(
@@ -362,6 +348,27 @@ export class AnthropicProvider {
             return buildReturnFromParse(normalizeAnthropicNonStreamingResponse(message, useModel));
         };
 
+        const recoverNonStreaming = async (midState, streamingError, streamController) => {
+            const exposedChars = Number(midState?.emittedTextChars) || 0;
+            if (!onTextReset || exposedChars <= 0
+                || midState.emittedToolCall || midState.partialToolCall || midState.emittedThinking) {
+                try { streamingError.liveTextEmitted = true; streamingError.unsafeToRetry = true; } catch {}
+                throw streamingError;
+            }
+            let resetAccepted = false;
+            try {
+                resetAccepted = await onTextReset({
+                    chars: exposedChars,
+                    reason: 'anthropic-streaming-fallback',
+                }) === true;
+            } catch {}
+            if (!resetAccepted) {
+                try { streamingError.liveTextEmitted = true; streamingError.unsafeToRetry = true; } catch {}
+                throw streamingError;
+            }
+            return issueNonStreamingFallback(streamController, streamingError);
+        };
+
         try {
             for (let attemptIndex = 0; attemptIndex <= MAX_MIDSTREAM_RETRIES; attemptIndex++) {
                 const streamController = createAbortController();
@@ -597,6 +604,20 @@ export class AnthropicProvider {
                         continue;
                     }
                     const classifier = _classifyMidstreamError(err, midState);
+                    // CC-parity stall recovery (ported from anthropic-oauth,
+                    // 2026-08-03): a stalled stream that exposed NOTHING is
+                    // re-issued non-streaming instead of retrying the same
+                    // streaming shape into the same idle window. Replay is
+                    // trivially safe — nothing was relayed or dispatched.
+                    if (classifier === 'stream_stalled'
+                        && _outcome?.replayUnsafe !== true
+                        && !midState.emittedText
+                        && !midState.emittedToolCall
+                        && !midState.partialToolCall
+                        && !midState.emittedThinking) {
+                        try { process.stderr.write(`[${this.name}] stream stalled with no exposure — retrying non-streaming\n`); } catch {}
+                        return await issueNonStreamingFallback(streamController, err);
+                    }
                     if (classifier === 'stream_stalled' && !stallRetryBudget.allowStallRetry()) {
                         try {
                             process.stderr.write(

package/src/runtime/agent/orchestrator/providers/lib/anthropic-request-utils.mjs

@@ -268,10 +268,27 @@ export function applyAnthropicCacheMarkers(sanitizedMessages, {
         const tailIdx = sanitizedMessages.length - 1;
         return hasUserText(sanitizedMessages[tailIdx]) ? tailIdx : -1;
     };
+    // True-tip anchor: when the request ends with a PERSISTED user text turn
+    // (the current prompt — it re-appears verbatim in every later request's
+    // prefix), mark it first. Without this, mid-session turn-first requests
+    // (multi-turn only; single-turn sessions are already covered by
+    // firstRequestUserPromptIdx) leave the fresh prompt unmarked: its tokens
+    // bill once at $5/M uncached, then again as a cache write when a later
+    // anchor advances past them — cost bounded by the prompt's size, so it
+    // matters for large pasted prompts. (2026-08-03 A/B note: session totals'
+    // totalUncachedInputTokens = input + cacheWrite by design, see
+    // uncachedInputTokensForProvider; billing-uncached input measured via
+    // usage.json was already ~0 on single-turn bench tasks before and after
+    // this change.) Synthetic system-reminder tails are excluded by
+    // hasUserText, so per-call volatile content still never keys the cache.
+    const currentTailUserIdx = () => {
+        const tailIdx = sanitizedMessages.length - 1;
+        return hasUserText(sanitizedMessages[tailIdx]) ? tailIdx : -1;
+    };
     if (messageTtl !== null) {
         const slots = Math.max(0, Math.min(4, Number(messageSlots) || 0));
         const marked = new Set();
-        const candidates = [latestToolResultTailIdx(), previousUserTextAnchorIdx(), firstRequestUserPromptIdx()];
+        const candidates = [currentTailUserIdx(), latestToolResultTailIdx(), previousUserTextAnchorIdx(), firstRequestUserPromptIdx()];
         for (const idx of candidates) {
             if (slots <= 0) break;
             if (idx < 0 || marked.has(idx)) continue;

package/src/runtime/agent/orchestrator/providers/oauth-usage.mjs

@@ -18,6 +18,10 @@ const FETCH_TIMEOUT_MS = 4500;
 const WARN_TTL_MS = 5 * 60_000;
 const CODEX_RESET_CREDITS_URL = 'https://chatgpt.com/backend-api/wham/rate-limit-reset-credits';
 const CODEX_RESET_CONSUME_URL = `${CODEX_RESET_CREDITS_URL}/consume`;
+// Redeeming a reset credit is an explicit user action, not a poll: it gets the
+// generous budget the orca client uses (REDEEM_BACKEND_TIMEOUT_MS) so a slow
+// backend cannot abort a request the server is already applying.
+const CODEX_REDEEM_TIMEOUT_MS = 30_000;
 
 const memoryCache = new Map();
 const inflight = new Map();
@@ -99,6 +103,38 @@ try {
   // Embedded runtimes may not expose process lifecycle hooks.
 }
 
+/** Drops every cached usage snapshot of one provider (memory, queued disk
+ *  writes and the persisted routes). A mutation that changes quota state
+ *  server-side — redeeming a Codex reset credit — must not keep serving the
+ *  pre-mutation meters from a 60s/10min cache. */
+export function invalidateOAuthUsageSnapshots(provider) {
+  const providerOnly = String(provider || '').toLowerCase();
+  if (!providerOnly) return;
+  const routePrefix = `${providerOnly}\u0001`;
+  const owned = (key) => key === providerOnly || String(key).startsWith(routePrefix);
+  for (const key of [...memoryCache.keys()]) {
+    if (owned(key)) memoryCache.delete(key);
+  }
+  for (const key of [...pendingDiskSnapshots.keys()]) {
+    if (owned(key)) pendingDiskSnapshots.delete(key);
+  }
+  try {
+    updateJsonAtomicSync(cachePath(), (curRaw) => {
+      const cur = curRaw && typeof curRaw === 'object' ? curRaw : {};
+      const routes = cur.routes && typeof cur.routes === 'object' ? cur.routes : {};
+      return {
+        version: 1,
+        updatedAt: Date.now(),
+        routes: Object.fromEntries(
+          Object.entries(routes).filter(([key]) => !owned(key)),
+        ),
+      };
+    }, { compact: true, fsync: false, fsyncDir: false });
+  } catch {
+    // Usage display must never break the reset path.
+  }
+}
+
 function isContentfulSnapshot(snapshot) {
   return !!snapshot
     && typeof snapshot === 'object'
@@ -253,11 +289,15 @@ function normalizeOpenAICodexResetCredits(data, accountId = '') {
     .filter((value) => Number.isFinite(value) && value > 0);
   const nextExpiresAt = resetAtMs(data.next_expires_at ?? data.nextExpiresAt)
     || (expiryCandidates.length ? Math.min(...expiryCandidates) : null);
+  // Identity of the OFFER, not of one payload shape: the detail endpoint and
+  // the counts embedded in /wham/usage describe the same credits with
+  // different fields, so hashing the raw rows made the same offer produce two
+  // revisions — and the desktop scopes its durable idempotency key by
+  // revision. Count + soonest expiry is what a user is offered.
   const offerRevision = `v1:${createHash('sha256').update(JSON.stringify({
     accountId,
     availableCount,
     nextExpiresAt,
-    credits,
   })).digest('hex')}`;
   return {
     availableCount,
@@ -290,6 +330,32 @@ function codexResetOutcome(code) {
   throw new Error(`Unknown Codex reset outcome: ${cleanString(code) || 'missing'}`);
 }
 
+async function postOpenAICodexResetConsume(auth, idempotencyKey) {
+  return await fetch(CODEX_RESET_CONSUME_URL, {
+    ...fetchOptions({
+      ...codexHeaders(auth),
+      'Content-Type': 'application/json',
+    }, CODEX_REDEEM_TIMEOUT_MS),
+    method: 'POST',
+    body: JSON.stringify({ redeem_request_id: idempotencyKey }),
+  });
+}
+
+async function redeemOpenAICodexResetCredit(auth, idempotencyKey) {
+  // A transport failure (abort, dropped socket) leaves the outcome unknown
+  // while the credit may already be spent. redeem_request_id makes the request
+  // idempotent, so ONE replay turns that unknown into the server's real answer
+  // instead of reporting "could not be confirmed" over a consumed credit.
+  let response;
+  try {
+    response = await postOpenAICodexResetConsume(auth, idempotencyKey);
+  } catch {
+    response = await postOpenAICodexResetConsume(auth, idempotencyKey);
+  }
+  if (!response.ok) throw new Error(`Codex reset failed: HTTP ${response.status}`);
+  return codexResetOutcome((await response.json())?.code);
+}
+
 export async function consumeOpenAICodexResetCredit(providerObj, options = {}) {
   const expectedOfferRevision = cleanString(options?.expectedOfferRevision);
   const idempotencyKey = cleanString(options?.idempotencyKey);
@@ -301,20 +367,14 @@ export async function consumeOpenAICodexResetCredit(providerObj, options = {}) {
   }
   const auth = await resolveOpenAICodexAuth(providerObj);
   if (!auth) throw new Error('Codex is not signed in');
-  const current = await fetchOpenAICodexResetCreditsWithAuth(auth);
-  if (!current || current.availableCount < 1 || current.offerRevision !== expectedOfferRevision) {
-    return { status: 'offerChanged', resetCredits: current };
-  }
-  const response = await fetch(CODEX_RESET_CONSUME_URL, {
-    ...fetchOptions({
-      ...codexHeaders(auth),
-      'Content-Type': 'application/json',
-    }, 15_000),
-    method: 'POST',
-    body: JSON.stringify({ redeem_request_id: idempotencyKey }),
-  });
-  if (!response.ok) throw new Error(`Codex reset failed: HTTP ${response.status}`);
-  const outcome = codexResetOutcome((await response.json())?.code);
+  // The SERVER decides the outcome (orca parity): redeem_request_id makes the
+  // call idempotent and `already_redeemed`/`no_credit` are real answers. The
+  // old client-side offer gate ran before every attempt, so retrying an
+  // unconfirmed redeem — whose credit was already spent, hence a changed
+  // revision — could only ever report "offer changed" and never the truth.
+  const outcome = await redeemOpenAICodexResetCredit(auth, idempotencyKey);
+  // Quota meters just changed server-side; cached snapshots are now wrong.
+  invalidateOAuthUsageSnapshots('openai-oauth');
   const resetCredits = await fetchOpenAICodexResetCreditsWithAuth(auth).catch(() => null);
   return { outcome, resetCredits };
 }