mixdog 0.9.93 → 0.9.95

package/src/runtime/agent/orchestrator/agent-trace-format.mjs

@@ -1,6 +1,6 @@
 import { createHash } from 'crypto';
 import { countJsonNextCalls } from './tools/next-call-utils.mjs';
-import { splitGrepLinePrefix } from './tools/builtin/grep-formatting.mjs';
+import { parseGrepContextHeader, splitGrepLinePrefix } from './tools/builtin/grep-formatting.mjs';
 import {
     appendAgentTrace,
     normalizeSessionId,
@@ -236,7 +236,27 @@ export function parseGrepCoverage(resultText, toolName, toolArgs, resultKind) {
     const out = [];
     const seen = new Set();
     let sectionPath = null;
+    let rawSourceLinesRemaining = 0;
+    const addLine = (path, lineNo) => {
+        if (!path || !Number.isInteger(lineNo) || lineNo < 1 || out.length >= GREP_COVERAGE_MAX) return;
+        const key = `${path}\0${lineNo}`;
+        if (seen.has(key)) return;
+        seen.add(key);
+        out.push({ path: String(path).replace(/\\/g, '/'), line: lineNo });
+    };
     for (const line of String(resultText ?? '').split(/\r?\n/)) {
+        if (rawSourceLinesRemaining > 0) {
+            rawSourceLinesRemaining--;
+            continue;
+        }
+        const header = parseGrepContextHeader(line);
+        if (header) {
+            for (let lineNo = header.startLine; lineNo <= header.endLine && out.length < GREP_COVERAGE_MAX; lineNo++) {
+                addLine(header.path, lineNo);
+            }
+            rawSourceLinesRemaining = header.sourceLineCount;
+            continue;
+        }
         const section = line.match(/^# grep (.+)$/);
         if (section) {
             if (!section[1].startsWith('pattern:')) sectionPath = section[1];
@@ -252,17 +272,13 @@ export function parseGrepCoverage(resultText, toolName, toolArgs, resultKind) {
         const path = split?.path || (omitted ? toolArgs.path : null) || (sectionOmitted ? sectionPath : null);
         const lineNo = split?.lineNo || (omitted ? Number(omitted[1]) : null)
             || (sectionOmitted ? Number(sectionOmitted[1]) : null);
-        if (!path || !Number.isInteger(lineNo) || lineNo < 1) continue;
-        const key = `${path}\0${lineNo}`;
-        if (seen.has(key)) continue;
-        seen.add(key);
-        out.push({ path: String(path).replace(/\\/g, '/'), line: lineNo });
+        addLine(path, lineNo);
         if (out.length >= GREP_COVERAGE_MAX) break;
     }
     return out.length ? out : null;
 }
 
-// Codex-style patch failures all arrive as "apply_patch … failed" prose, but
+// Patch failures all arrive as "apply_patch … failed" prose, but
 // a malformed envelope, a rejected hunk, a preflight veto and a size/lock
 // guard need different operator responses. Returning null means "nothing
 // patch-specific here" and lets the generic rules (path/enoent, schema/args,

package/src/runtime/agent/orchestrator/agent-trace-io.mjs

@@ -368,6 +368,10 @@ function _resolveToolFailurePath() {
     if (process.env.MIXDOG_TOOL_FAILURE_LOG_DISABLE === '1') return null;
     if (_toolFailurePath) return _toolFailurePath;
     const explicit = process.env.MIXDOG_TOOL_FAILURE_LOG_PATH;
+    // The repo's own `node --test` suites drive intentional tool failures
+    // (patch ordering, arg guards, ...). Without an explicit path those rows
+    // land in the user's real failure log and read as production incidents.
+    if (!explicit && process.env.NODE_TEST_CONTEXT) return null;
     // Ship-mode default: skip diagnostic tool-failure log file IO unless
     // dev/debug, MIXDOG_DIAGNOSTICS, or an explicit path opts back in.
     if (!explicit && !isDiagnosticIOEnabled()) return null;

package/src/runtime/agent/orchestrator/agent-trace.mjs

@@ -158,6 +158,34 @@ function traceAgentSse({ sessionId, sseParseMs, ttftMs, provider, model, transpo
     });
 }
 
+// Per-turn preflight timing (submit → provider request). The runtime also
+// emits this as a `mixdog:turn-timing` process event for the daemon log, but
+// that sink is process-local and invisible to trace tooling — the row below is
+// what session-bench reads, so TTFT stage regressions stay measurable offline.
+function traceTurnTiming({
+    sessionId, status, requestId, ttftMs, endToEndTtftMs,
+    queueMs, routeMs, preflightMs, mcpMs, providerMs,
+}) {
+    const ms = (value) => (Number.isFinite(Number(value)) ? Math.round(Number(value)) : null);
+    const payload = {
+        status: status || 'unknown',
+        request_id: requestId || null,
+        ttft_ms: ms(ttftMs),
+        end_to_end_ttft_ms: ms(endToEndTtftMs),
+        queue_ms: ms(queueMs),
+        route_ms: ms(routeMs),
+        preflight_ms: ms(preflightMs),
+        mcp_ms: ms(mcpMs),
+        provider_ms: ms(providerMs),
+    };
+    appendAgentTrace({
+        sessionId,
+        kind: 'turn_timing',
+        ...payload,
+        payload,
+    });
+}
+
 function extractThinkingTokens(rawUsage) {
     if (!rawUsage || typeof rawUsage !== 'object') return null;
     const direct = Number(rawUsage.thinking_tokens ?? rawUsage.thinkingTokens);
@@ -294,6 +322,7 @@ export {
     traceAgentToolFailure,
     traceAgentCompact,
     traceAgentUsage,
+    traceTurnTiming,
     resolveTraceUsageInput,
     grokCacheChainTraceFields,
     traceAgentCompress,

package/src/runtime/agent/orchestrator/context/collect.mjs

@@ -374,6 +374,11 @@ function sanitizeMcpInstructionText(text, max = MCP_INSTRUCTION_MAX_CHARS) {
 /**
  * Per-server MCP initialize instructions for deferred-pool tools only.
  * Empty when no instructions or no matching deferred MCP tools → omit block.
+ * Emits ONLY the server heading + instruction body: the per-server tool names
+ * are deliberately NOT repeated here — every pool tool is already listed once
+ * (with its description) in <available-deferred-tools>, and re-listing ~30
+ * names per server doubled the MCP share of the BP1 prefix (2026-08-05 audit).
+ * Server membership stays evident from the mcp__<server>__ name prefix.
  */
 function buildMcpInstructionsManifest(mcpServerInstructions, poolNames) {
     const map = mcpServerInstructions && typeof mcpServerInstructions === 'object'
@@ -400,8 +405,7 @@ function buildMcpInstructionsManifest(mcpServerInstructions, poolNames) {
     for (const server of servers) {
         const safeServer = sanitizeMcpManifestServerName(server);
         const body = sanitizeMcpInstructionText(map[server]);
-        const tools = [...toolsByServer.get(server)].sort((a, b) => a.localeCompare(b));
-        lines.push(`## ${safeServer}`, body, ...tools.map((tool) => `- ${tool}`));
+        lines.push(`## ${safeServer}`, body);
     }
     lines.push('</mcp-instructions>');
     return lines.join('\n');

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -19,7 +19,7 @@ const AUTO_DETECT_PORTS = {
     'mixdog-memory': { discovery: 'memory', dir: 'mixdog', file: 'active-instance.json', portField: 'memory_port', endpoint: '/mcp' },
 };
 const DEFAULT_MCP_CALL_TIMEOUT_MS = 120000;
-// Per-server STARTUP handshake budget (connect + listTools). Codex parity: 10s.
+// Per-server STARTUP handshake budget (connect + listTools): 10s.
 const DEFAULT_MCP_STARTUP_TIMEOUT_MS = 10000;
 // --- State ---
 const servers = new Map();
@@ -264,8 +264,8 @@ function isMcpToolCallTimeoutError(err) {
 }
 
 // MCP per-server STARTUP timeout: bounds the connect + listTools handshake so a
-// slow or hung server can't stall boot or the first turn. Default 10s (codex
-// parity). Per-server override: startupTimeoutMs / startupTimeoutSec. Global
+// slow or hung server can't stall boot or the first turn. Default 10s.
+// Per-server override: startupTimeoutMs / startupTimeoutSec. Global
 // env: MIXDOG_MCP_STARTUP_TIMEOUT_MS. A value of 0/off/none/false disables it.
 export function resolveMcpStartupTimeoutMs(cfg = {}, env = process.env) {
     const rawMs = cfg?.startupTimeoutMs ?? cfg?.startup_timeout_ms;

package/src/runtime/agent/orchestrator/providers/anthropic-effort.mjs

@@ -17,6 +17,67 @@ function _sortEffortLevels(levels) {
     return [...levels].sort((a, b) => rank(a) - rank(b));
 }
 
+// Control flags that ride the capabilities.effort map alongside real levels
+// (`{supported:true, low:true, …}`). They are NOT selectable effort levels;
+// letting them through minted a bogus "supported" level that got persisted
+// into the on-disk catalog and offered in the UI.
+const CONTROL_EFFORT_KEYS = new Set(['supported', 'enabled', 'default']);
+
+// ── Catalog-first capability index ───────────────────────────────────────
+// The provider catalog already carries what each model advertises
+// (capabilities.effort → reasoningOptions:[{type:'effort',values:[…]}]), so it
+// — not a hardcoded regex ladder — is the source of truth for what we put on
+// the wire. anthropic-model-resolve feeds this whenever the in-memory catalog
+// moves. The regex ladder below stays as the fallback for ids the catalog does
+// not know (offline start, api-key provider, first run before /v1/models).
+const _catalogEffortLevels = new Map();
+
+function _catalogKeys(model) {
+    const id = normalizeModelId(model);
+    if (!id) return [];
+    // A dated id and its bare version alias describe the SAME model — index
+    // both so `claude-opus-5` and `claude-opus-5-20260101` resolve alike.
+    const undated = id.replace(/-\d{8}$/, '');
+    return undated !== id ? [id, undated] : [id];
+}
+
+/**
+ * Replace the catalog-derived capability index. Records without a
+ * `reasoningOptions` array are treated as UNKNOWN (skipped, so the regex
+ * fallback still applies) rather than as "no effort" — offline/static fallback
+ * lists carry no capability data and must not disable effort.
+ */
+export function setModelEffortCapabilities(models) {
+    _catalogEffortLevels.clear();
+    if (!Array.isArray(models)) return;
+    for (const model of models) {
+        if (!model?.id || !Array.isArray(model.reasoningOptions)) continue;
+        const option = model.reasoningOptions.find(
+            (entry) => String(entry?.type || '').trim().toLowerCase() === 'effort',
+        );
+        const levels = new Set(
+            (Array.isArray(option?.values) ? option.values : [])
+                .map((value) => String(value || '').trim().toLowerCase())
+                .filter((value) => value && !CONTROL_EFFORT_KEYS.has(value)),
+        );
+        for (const key of _catalogKeys(model.id)) {
+            const existing = _catalogEffortLevels.get(key);
+            // A bare alias shared by several records keeps the richer entry.
+            if (existing?.size && levels.size === 0) continue;
+            _catalogEffortLevels.set(key, levels);
+        }
+    }
+}
+
+/** Advertised levels for `model`, or null when the catalog has no record. */
+function _catalogLevels(model) {
+    for (const key of _catalogKeys(model)) {
+        const levels = _catalogEffortLevels.get(key);
+        if (levels) return levels;
+    }
+    return null;
+}
+
 export const EFFORT_BETA_HEADER = 'effort-2025-11-24';
 
 export const LEGACY_EFFORT_BUDGET = Object.freeze({
@@ -40,7 +101,10 @@ function parseClaudeVersion(model) {
     if (triple) {
         return { family: triple[1], major: Number(triple[2]), minor: Number(triple[3]) };
     }
-    const pair = m.match(/^claude-(sonnet|fable)-(\d+)(?:$|[-@])/);
+    // Bare version ids carry family + major only (claude-opus-5). opus/haiku
+    // were missing here, so `claude-opus-5` parsed to null and fell through
+    // every capability check as an unknown shape.
+    const pair = m.match(/^claude-(sonnet|fable|opus|haiku)-(\d+)(?:$|[-@])/);
     if (pair) {
         return { family: pair[1], major: Number(pair[2]), minor: null };
     }
@@ -64,6 +128,9 @@ function isLegacyAnthropicReasoningModel(model) {
     if (parsed.family === 'sonnet' || parsed.family === 'opus') {
         if (parsed.major < 4) return true;
         if (parsed.major === 4 && parsed.minor !== null && parsed.minor < 6) return true;
+        // Bare major, no minor (claude-opus-4 / claude-sonnet-4): adaptive
+        // effort only ships from 5 up, so 4.x aliases stay manual-thinking.
+        if (parsed.minor === null && parsed.major < 5) return true;
         return false;
     }
     return false;
@@ -72,13 +139,22 @@ function isLegacyAnthropicReasoningModel(model) {
 // @[MODEL LAUNCH]: extend allowlist when new Claude models ship with effort support.
 export function modelSupportsEffort(model) {
     if (isEnvTruthy(process.env.MIXDOG_ANTHROPIC_ALWAYS_ENABLE_EFFORT)) return true;
+    const advertised = _catalogLevels(model);
+    if (advertised) return advertised.size > 0;
+    return _regexSupportsEffort(model);
+}
+
+// Fallback ladder for ids the catalog does not carry. Also used by
+// effortValuesForModel, which BUILDS the catalog records and therefore must
+// never consult the index it feeds.
+function _regexSupportsEffort(model) {
     const m = normalizeModelId(model);
     if (!m.includes('claude')) return false;
     if (isLegacyAnthropicReasoningModel(model)) return false;
     if (m.includes('opus-4-6') || m.includes('sonnet-4-6')) return true;
     if (m.includes('sonnet-5') || m.includes('fable-5')) return true;
     if (/^claude-opus-4-(6|7|8)(?:$|[-@])/.test(m)) return true;
-    if (/^claude-opus-5-/.test(m)) return true;
+    if (/^claude-opus-5(?:$|[-@])/.test(m)) return true;
     // Fallthrough for not-yet-enumerated modern models: only grant effort when
     // parseClaudeVersion resolves a family with major>=4 (and not a manual-
     // thinking legacy already excluded above). A bare `startsWith('claude-')`
@@ -98,6 +174,12 @@ export function modelSupportsEffort(model) {
 // supported by: Fable 5, Mythos 5, Opus 4.8, Opus 4.7, Sonnet 5.
 // NOT Opus 4.6 / Sonnet 4.6 (those support max but not xhigh).
 export function modelSupportsXhighEffort(model) {
+    const advertised = _catalogLevels(model);
+    if (advertised) return advertised.has('xhigh');
+    return _regexSupportsXhighEffort(model);
+}
+
+function _regexSupportsXhighEffort(model) {
     const m = normalizeModelId(model);
     if (/^claude-opus-4-(7|8)(?:$|[-@])/.test(m)) return true;
     if (/^claude-opus-5(?:$|[-@])/.test(m)) return true;
@@ -111,7 +193,14 @@ export function modelSupportsXhighEffort(model) {
 // @[MODEL LAUNCH]: extend when new Opus models support max effort.
 // Max list = xhigh list PLUS Opus 4.6, Sonnet 4.6, Opus 4.5.
 export function modelSupportsMaxEffort(model) {
-    if (modelSupportsXhighEffort(model)) return true;
+    const advertised = _catalogLevels(model);
+    // xhigh support implies max support (kept from the ladder below).
+    if (advertised) return advertised.has('max') || advertised.has('xhigh');
+    return _regexSupportsMaxEffort(model);
+}
+
+function _regexSupportsMaxEffort(model) {
+    if (_regexSupportsXhighEffort(model)) return true;
     const m = normalizeModelId(model);
     if (/^claude-opus-4-(5|6)(?:$|[-@])/.test(m)) return true;
     if (/^claude-sonnet-4-6(?:$|[-@])/.test(m)) return true;
@@ -209,7 +298,7 @@ export function applyAnthropicEffortToBody(
         // Set unconditionally (independent of `normalized`) so effort-capable
         // turns always carry adaptive thinking + round-trip signatures.
         // MIXDOG_ANTHROPIC_THINKING_DISPLAY=omitted (operator/bench knob):
-        // CC-parity mode — no thinking blocks come back, so nothing is
+        // thinking blocks are omitted entirely, so nothing is
         // replayed into later requests (saves the 1h cache-write + re-read on
         // accumulated thinking) at the cost of losing visible reasoning and
         // cross-iteration thinking continuity. Default stays summarized.
@@ -254,7 +343,8 @@ export function effortValuesForModel(capabilities, modelId) {
     // advertises (xhigh, max, or anything future), no hardcoded allowlist.
     if (effort !== true && typeof effort === 'object') {
         const advertised = Object.keys(effort).filter(
-            (level) => effort[level] === true || effort[level]?.supported === true,
+            (level) => !CONTROL_EFFORT_KEYS.has(String(level).trim().toLowerCase())
+                && (effort[level] === true || effort[level]?.supported === true),
         );
         if (advertised.length) return _sortEffortLevels(advertised);
         // Object with no per-level flags: fall through to the boolean/supported
@@ -265,10 +355,10 @@ export function effortValuesForModel(capabilities, modelId) {
     // the model supports effort but doesn't enumerate levels, so derive the
     // set from the known level ladder, gated by the top-tier model check.
     let levels = [...EFFORT_LEVELS];
-    if (!modelSupportsMaxEffort(modelId)) {
+    if (!_regexSupportsMaxEffort(modelId)) {
         levels = levels.filter((level) => level !== 'max');
     }
-    if (!modelSupportsXhighEffort(modelId)) {
+    if (!_regexSupportsXhighEffort(modelId)) {
         levels = levels.filter((level) => level !== 'xhigh');
     }
     return levels;

package/src/runtime/agent/orchestrator/providers/anthropic-model-resolve.mjs

@@ -8,20 +8,22 @@
 import { enrichModels } from './model-catalog.mjs';
 import { sanitizeModelList } from './model-list-sanitize.mjs';
 import { makeModelCache } from './model-cache.mjs';
-import { effortValuesForModel } from './anthropic-effort.mjs';
+import { effortValuesForModel, setModelEffortCapabilities } from './anthropic-effort.mjs';
 
 // Disk-backed cache so repeated process starts (cron, tool calls) don't
 // hammer /v1/models. 24h TTL matches the upstream client cadence.
 const MODEL_CACHE_TTL_MS = 24 * 60 * 60_000;
 // Bump when the on-disk cache shape changes so stale-shape entries are
 // discarded instead of misread.
-const ANTHROPIC_MODEL_CACHE_SCHEMA_VERSION = 1;
+// v2: effort level lists no longer carry the `supported` control flag as a
+// selectable level, so v1 caches are discarded rather than replayed.
+const ANTHROPIC_MODEL_CACHE_SCHEMA_VERSION = 2;
 
 const _modelCache = makeModelCache({
     fileName: 'anthropic-oauth-models.json',
     ttlMs: MODEL_CACHE_TTL_MS,
     version: ANTHROPIC_MODEL_CACHE_SCHEMA_VERSION,
-    onSave: (m) => { _inMemoryCatalog = Array.isArray(m) ? m.slice() : null; },
+    onSave: (m) => { _setInMemoryCatalog(m); },
 });
 
 // Async wrappers so callers can keep awaiting; the shared cache CRUD is sync.
@@ -42,6 +44,9 @@ let _inMemoryCatalog = null;
 // listModels() warm path, so expose a setter instead of the raw binding.
 export function _setInMemoryCatalog(models) {
     _inMemoryCatalog = Array.isArray(models) ? models.slice() : null;
+    // The request builder resolves effort capability from the catalog, so the
+    // capability index moves with the mirror — one write, one source of truth.
+    setModelEffortCapabilities(_inMemoryCatalog || []);
 }
 
 export function _catalogHas(id) {
@@ -185,7 +190,9 @@ export function _catalogOutputTokens(model) {
     try {
         if (!Array.isArray(_inMemoryCatalog)) {
             const cached = _modelCache.loadSync();
-            if (Array.isArray(cached)) _inMemoryCatalog = cached.slice();
+            // Route the lazy warm through the setter: a direct assignment left
+            // the effort-capability index empty even though the mirror was warm.
+            if (Array.isArray(cached)) _setInMemoryCatalog(cached);
         }
         if (!Array.isArray(_inMemoryCatalog)) return null;
         const entry = _inMemoryCatalog.find(m => m?.id === model);

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -1094,7 +1094,7 @@ export class AnthropicOAuthProvider {
                     continue;
                 }
                 const classifier = _classifyMidstreamError(err, midState);
-                // CC-parity stall recovery (2026-08-03 v3 postmortem): a
+                // Stall recovery (2026-08-03 v3 postmortem): a
                 // stalled stream that exposed NOTHING (no text/thinking
                 // relayed, no tool emitted) is re-issued NON-STREAMING instead
                 // of retrying the same streaming shape. Effort-mode models can
@@ -1103,8 +1103,7 @@ export class AnthropicOAuthProvider {
                 // generation into the same timer (observed live: deterministic
                 // 4×~138s beheading, ~552s per turn), while the non-streaming
                 // transport simply waits for the full body (bounded by
-                // PROVIDER_NONSTREAM_TOTAL_TIMEOUT_MS). Claude Code does
-                // exactly this on its watchdog aborts. Replay is trivially
+                // PROVIDER_NONSTREAM_TOTAL_TIMEOUT_MS). Replay is trivially
                 // safe here — nothing was relayed or dispatched.
                 if (classifier === 'stream_stalled'
                     && _outcome?.replayUnsafe !== true

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -604,7 +604,7 @@ export class AnthropicProvider {
                         continue;
                     }
                     const classifier = _classifyMidstreamError(err, midState);
-                    // CC-parity stall recovery (ported from anthropic-oauth,
+                    // Stall recovery (shared with anthropic-oauth,
                     // 2026-08-03): a stalled stream that exposed NOTHING is
                     // re-issued non-streaming instead of retrying the same
                     // streaming shape into the same idle window. Replay is

package/src/runtime/agent/orchestrator/providers/codex-client-meta.mjs

@@ -2,13 +2,11 @@
  * codex-client-meta.mjs — codex client identity headers for the OpenAI OAuth
  * transports.
  *
- * codex-rs sends two client-identity headers on EVERY request including the
- * WS handshake:
+ * The reference client sends two client-identity headers on EVERY request,
+ * including the WS handshake:
  *  - `User-Agent: codex_cli_rs/<version> (<os> <ver>; <arch>) <terminal>`
- *    (login/src/auth/default_client.rs get_codex_user_agent + default_headers)
  *  - `version: <CARGO_PKG_VERSION>` via the built-in provider http_headers
- *    (model-provider-info/src/lib.rs:339-343), merged into the WS handshake by
- *    merge_request_headers (codex-api/src/endpoint/responses_websocket.rs).
+ *    merged into the WS handshake.
  * The backend uses these for client gating (model catalog visibility measured
  * 2026-07-03) and plausibly for x-codex-turn-state issuance / sticky
  * cache-node routing, so mixdog mirrors both.
@@ -17,7 +15,7 @@ import os from 'node:os';
 
 // Offline fallback only; live value refreshes from npm (24h TTL, in-process).
 // The backend gates model exposure AND per-request model access on the client
-// version (gpt-5.6-* require >= 0.144.0 per codex models-manager/models.json,
+// version (gpt-5.6-* require >= 0.144.0 per the published model catalog,
 // verified 2026-07-09), so keep this at the current release when bumping.
 const CODEX_CLIENT_VERSION_FLOOR = '0.144.1';
 const VERSION_TTL_MS = 24 * 60 * 60_000;

package/src/runtime/agent/orchestrator/providers/lib/stream-outcome.mjs

@@ -50,7 +50,7 @@
  *                        || toolCallsComplete > 0 || toolCallsDispatched > 0
  *   sideEffectDispatched = toolCallsDispatched > 0
  *   replayUnsafe       = the ONE architecture-specific deny MixDog adds on top
- *                        of the Codex retry rules, because it streams UI text
+ *                        of the standard retry rules, because it streams UI text
  *                        and dispatches tools eagerly:
  *                        visibleOutput || sideEffectDispatched
  *                        || dispatchAmbiguous || unsafe marker

package/src/runtime/agent/orchestrator/providers/oauth-usage.mjs

@@ -18,6 +18,10 @@ const FETCH_TIMEOUT_MS = 4500;
 const WARN_TTL_MS = 5 * 60_000;
 const CODEX_RESET_CREDITS_URL = 'https://chatgpt.com/backend-api/wham/rate-limit-reset-credits';
 const CODEX_RESET_CONSUME_URL = `${CODEX_RESET_CREDITS_URL}/consume`;
+// Redeeming a reset credit is an explicit user action, not a poll: it gets the
+// generous budget the orca client uses (REDEEM_BACKEND_TIMEOUT_MS) so a slow
+// backend cannot abort a request the server is already applying.
+const CODEX_REDEEM_TIMEOUT_MS = 30_000;
 
 const memoryCache = new Map();
 const inflight = new Map();
@@ -99,6 +103,38 @@ try {
   // Embedded runtimes may not expose process lifecycle hooks.
 }
 
+/** Drops every cached usage snapshot of one provider (memory, queued disk
+ *  writes and the persisted routes). A mutation that changes quota state
+ *  server-side — redeeming a Codex reset credit — must not keep serving the
+ *  pre-mutation meters from a 60s/10min cache. */
+export function invalidateOAuthUsageSnapshots(provider) {
+  const providerOnly = String(provider || '').toLowerCase();
+  if (!providerOnly) return;
+  const routePrefix = `${providerOnly}\u0001`;
+  const owned = (key) => key === providerOnly || String(key).startsWith(routePrefix);
+  for (const key of [...memoryCache.keys()]) {
+    if (owned(key)) memoryCache.delete(key);
+  }
+  for (const key of [...pendingDiskSnapshots.keys()]) {
+    if (owned(key)) pendingDiskSnapshots.delete(key);
+  }
+  try {
+    updateJsonAtomicSync(cachePath(), (curRaw) => {
+      const cur = curRaw && typeof curRaw === 'object' ? curRaw : {};
+      const routes = cur.routes && typeof cur.routes === 'object' ? cur.routes : {};
+      return {
+        version: 1,
+        updatedAt: Date.now(),
+        routes: Object.fromEntries(
+          Object.entries(routes).filter(([key]) => !owned(key)),
+        ),
+      };
+    }, { compact: true, fsync: false, fsyncDir: false });
+  } catch {
+    // Usage display must never break the reset path.
+  }
+}
+
 function isContentfulSnapshot(snapshot) {
   return !!snapshot
     && typeof snapshot === 'object'
@@ -253,11 +289,15 @@ function normalizeOpenAICodexResetCredits(data, accountId = '') {
     .filter((value) => Number.isFinite(value) && value > 0);
   const nextExpiresAt = resetAtMs(data.next_expires_at ?? data.nextExpiresAt)
     || (expiryCandidates.length ? Math.min(...expiryCandidates) : null);
+  // Identity of the OFFER, not of one payload shape: the detail endpoint and
+  // the counts embedded in /wham/usage describe the same credits with
+  // different fields, so hashing the raw rows made the same offer produce two
+  // revisions — and the desktop scopes its durable idempotency key by
+  // revision. Count + soonest expiry is what a user is offered.
   const offerRevision = `v1:${createHash('sha256').update(JSON.stringify({
     accountId,
     availableCount,
     nextExpiresAt,
-    credits,
   })).digest('hex')}`;
   return {
     availableCount,
@@ -290,6 +330,32 @@ function codexResetOutcome(code) {
   throw new Error(`Unknown Codex reset outcome: ${cleanString(code) || 'missing'}`);
 }
 
+async function postOpenAICodexResetConsume(auth, idempotencyKey) {
+  return await fetch(CODEX_RESET_CONSUME_URL, {
+    ...fetchOptions({
+      ...codexHeaders(auth),
+      'Content-Type': 'application/json',
+    }, CODEX_REDEEM_TIMEOUT_MS),
+    method: 'POST',
+    body: JSON.stringify({ redeem_request_id: idempotencyKey }),
+  });
+}
+
+async function redeemOpenAICodexResetCredit(auth, idempotencyKey) {
+  // A transport failure (abort, dropped socket) leaves the outcome unknown
+  // while the credit may already be spent. redeem_request_id makes the request
+  // idempotent, so ONE replay turns that unknown into the server's real answer
+  // instead of reporting "could not be confirmed" over a consumed credit.
+  let response;
+  try {
+    response = await postOpenAICodexResetConsume(auth, idempotencyKey);
+  } catch {
+    response = await postOpenAICodexResetConsume(auth, idempotencyKey);
+  }
+  if (!response.ok) throw new Error(`Codex reset failed: HTTP ${response.status}`);
+  return codexResetOutcome((await response.json())?.code);
+}
+
 export async function consumeOpenAICodexResetCredit(providerObj, options = {}) {
   const expectedOfferRevision = cleanString(options?.expectedOfferRevision);
   const idempotencyKey = cleanString(options?.idempotencyKey);
@@ -301,20 +367,14 @@ export async function consumeOpenAICodexResetCredit(providerObj, options = {}) {
   }
   const auth = await resolveOpenAICodexAuth(providerObj);
   if (!auth) throw new Error('Codex is not signed in');
-  const current = await fetchOpenAICodexResetCreditsWithAuth(auth);
-  if (!current || current.availableCount < 1 || current.offerRevision !== expectedOfferRevision) {
-    return { status: 'offerChanged', resetCredits: current };
-  }
-  const response = await fetch(CODEX_RESET_CONSUME_URL, {
-    ...fetchOptions({
-      ...codexHeaders(auth),
-      'Content-Type': 'application/json',
-    }, 15_000),
-    method: 'POST',
-    body: JSON.stringify({ redeem_request_id: idempotencyKey }),
-  });
-  if (!response.ok) throw new Error(`Codex reset failed: HTTP ${response.status}`);
-  const outcome = codexResetOutcome((await response.json())?.code);
+  // The SERVER decides the outcome (orca parity): redeem_request_id makes the
+  // call idempotent and `already_redeemed`/`no_credit` are real answers. The
+  // old client-side offer gate ran before every attempt, so retrying an
+  // unconfirmed redeem — whose credit was already spent, hence a changed
+  // revision — could only ever report "offer changed" and never the truth.
+  const outcome = await redeemOpenAICodexResetCredit(auth, idempotencyKey);
+  // Quota meters just changed server-side; cached snapshots are now wrong.
+  invalidateOAuthUsageSnapshots('openai-oauth');
   const resetCredits = await fetchOpenAICodexResetCreditsWithAuth(auth).catch(() => null);
   return { outcome, resetCredits };
 }

package/src/runtime/agent/orchestrator/providers/openai-codex-metadata.mjs

@@ -35,8 +35,8 @@ function _codexInstallationId(sendOpts) {
         || `mixdog-${_hashText(`${process.env.USERPROFILE || process.env.HOME || ''}:${process.cwd()}`, 32)}`;
 }
 
-// The identity block codex rebuilds per request (responses_metadata.rs
-// client_metadata()): never cached on the pooled socket, or a later turn would
+// The identity block is rebuilt per request: never cached on the pooled
+// socket, or a later turn would
 // replay the first turn's identity.
 function _codexMetadataBase(entry, { poolKey, cacheKey, sendOpts, handshake = false } = {}) {
     const sessionId = _cleanMetaString(sendOpts?.codexSessionId || sendOpts?.session?.codexSessionId || poolKey || cacheKey)
@@ -49,8 +49,8 @@ function _codexMetadataBase(entry, { poolKey, cacheKey, sendOpts, handshake = fa
         : _sessionStartedAtUnixMs(sessionId);
     const requestKind = _codexRequestKind(sendOpts, sessionId);
     const wireParity = process.env.MIXDOG_OAI_CODEX_WIRE_PARITY === '1';
-    // codex opens the WS with a prewarm (empty turn_id) BEFORE the real turn
-    // (client.rs). Under wire parity the handshake IS that prewarm, so its
+    // The reference client opens the WS with a prewarm (empty turn_id) BEFORE
+    // the real turn. Under wire parity the handshake IS that prewarm, so its
     // turn_id empties and its request_kind becomes 'prewarm' instead of
     // presenting the handshake as a live turn. Parity off is unchanged.
     const isPrewarm = requestKind === 'prewarm' || handshake === true;
@@ -66,7 +66,7 @@ function _codexMetadataBase(entry, { poolKey, cacheKey, sendOpts, handshake = fa
         turn_id: turnId,
         window_id: windowId,
         request_kind: effectiveRequestKind,
-        // Richer codex turn-metadata (responses_metadata.rs:264-280). A/B
+        // Richer turn-metadata. A/B
         // 2026-07-04 showed no effect, so it stays behind a knob for future
         // probes; wire parity implies it.
         ...((process.env.MIXDOG_OAI_TURN_METADATA_RICH === '1' || wireParity) ? {
@@ -98,8 +98,8 @@ export function _metadataTrace(metadata) {
     };
 }
 
-// Handshake projection of the same identity. codex attaches these on every
-// request (client.rs:582-584, responses_metadata.rs:227-252); A/B 2026-07-04
+// Handshake projection of the same identity. These ride on every
+// request; A/B 2026-07-04
 // showed the turn-metadata blob alone lifts prefix-cache hits, so it is ON by
 // default. MIXDOG_OAI_TURN_METADATA overrides:
 //   unset|1|turn-metadata : window-id + turn-metadata + installation-id
@@ -141,7 +141,7 @@ export function _withCodexWsClientMetadata(frame, entry, enabled, context = {})
         'x-codex-ws-stream-request-start-ms': String(Date.now()),
     };
     if (entry && typeof entry === 'object') {
-        // codex scopes x-codex-turn-state to ONE turn (client.rs:263-279) while
+        // x-codex-turn-state is scoped to ONE turn while
         // pooled sockets span turns: attribute a captured token to the FIRST
         // turn that observes it, then drop it once turn_id moves on. An empty
         // turn_id (parity prewarm) is a valid owner, so the check is against