mixdog 0.9.94 → 0.9.96

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -8,6 +8,7 @@ import { shutdownStdioChild, killStdioChildTreeFast } from './child-tree.mjs';
 import { readServicePort, markServiceUnreachable, isConnRefuseError } from '../../../shared/service-discovery.mjs';
 import { makeToolEnvelope, normalizeToolEnvelope } from '../session/tool-envelope.mjs';
 import { classifyResultKind } from '../session/result-classification.mjs';
+import { createKeyedSingleflight } from './reconnect-singleflight.mjs';
 // --- Types ---
 /** Known auto-detect targets: port file path relative to tmpdir.
  *  Note: `mixdog` used to self-loopback via active-instance.json's
@@ -19,10 +20,11 @@ const AUTO_DETECT_PORTS = {
     'mixdog-memory': { discovery: 'memory', dir: 'mixdog', file: 'active-instance.json', portField: 'memory_port', endpoint: '/mcp' },
 };
 const DEFAULT_MCP_CALL_TIMEOUT_MS = 120000;
-// Per-server STARTUP handshake budget (connect + listTools). Codex parity: 10s.
+// Per-server STARTUP handshake budget (connect + listTools): 10s.
 const DEFAULT_MCP_STARTUP_TIMEOUT_MS = 10000;
 // --- State ---
 const servers = new Map();
+const reconnects = createKeyedSingleflight();
 let mcpSdkPromise = null;
 // Memo for mcpToolHasField(name, field) — keyed by `${toolName}|${field}`.
 // The lookup (regex parse + servers Map get + tools.find + schema property
@@ -173,6 +175,26 @@ export function getMcpServerInstructionsMap() {
     }
     return out;
 }
+
+async function reconnectMcpServer(serverName, failedServer) {
+    return reconnects.run(serverName, async () => {
+        const current = servers.get(serverName);
+        // A peer already completed the replacement while this failed call was
+        // unwinding. Reuse it immediately instead of closing a fresh transport.
+        if (current && current !== failedServer) return current;
+        if (current) {
+            await _closeServer(current);
+            if (servers.get(serverName) === current) servers.delete(serverName);
+        }
+        await connectServer(serverName, failedServer.cfg);
+        const replacement = servers.get(serverName);
+        if (!replacement) {
+            throw new Error(`reconnect succeeded but server "${serverName}" entry is missing from registry`);
+        }
+        return replacement;
+    });
+}
+
 /**
  * Execute an MCP tool call.
  * Name format: `mcp__{serverName}__{toolName}`
@@ -195,21 +217,14 @@ export async function executeMcpTool(name, args) {
             mcpLog(`[mcp-client] Tool call timed out; skipping reconnect retry for "${serverName}/${toolName}".\n`);
             throw firstErr;
         }
-        mcpLog(`[mcp-client] Tool call failed, attempting reconnect...\n`);
-        await new Promise(r => setTimeout(r, 500));
-        try {
-            await _closeServer(server);
-        } catch { /* ignore close error */ }
+        mcpLog(`[mcp-client] Tool call failed, attempting shared reconnect...\n`);
+        let retryServer;
         try {
-            await connectServer(serverName, server.cfg);
+            retryServer = await reconnectMcpServer(serverName, server);
         } catch (reconnectErr) {
             const reconnectMsg = reconnectErr instanceof Error ? reconnectErr.message : String(reconnectErr);
             throw new Error(`Tool call failed: ${firstMsg}; reconnect also failed: ${reconnectMsg}`);
         }
-        const retryServer = servers.get(serverName);
-        if (!retryServer) {
-            throw new Error(`Tool call failed: ${firstMsg}; reconnect succeeded but server "${serverName}" entry is missing from registry`);
-        }
         try {
             result = await _callToolWithTimeout(retryServer, toolName, args);
         } catch (retryErr) {
@@ -264,8 +279,8 @@ function isMcpToolCallTimeoutError(err) {
 }
 
 // MCP per-server STARTUP timeout: bounds the connect + listTools handshake so a
-// slow or hung server can't stall boot or the first turn. Default 10s (codex
-// parity). Per-server override: startupTimeoutMs / startupTimeoutSec. Global
+// slow or hung server can't stall boot or the first turn. Default 10s.
+// Per-server override: startupTimeoutMs / startupTimeoutSec. Global
 // env: MIXDOG_MCP_STARTUP_TIMEOUT_MS. A value of 0/off/none/false disables it.
 export function resolveMcpStartupTimeoutMs(cfg = {}, env = process.env) {
     const rawMs = cfg?.startupTimeoutMs ?? cfg?.startup_timeout_ms;
@@ -632,7 +647,7 @@ async function connectServer(name, cfg, genAtStart = _connectAbortGeneration) {
             ...(t.annotations && typeof t.annotations === 'object' ? { annotations: t.annotations } : {}),
         }));
         const toolNames = tools.map(t => t.name);
-        servers.set(name, { name, client, transport, tools, cfg, instructions });
+        servers.set(name, { name, client, transport, tools, cfg, instructions, generation: genAtStart });
         _invalidateMcpToolFieldMemo();
         mcpLog(`[mcp] connected: ${tools.length} tools — ${toolNames.join(', ')}\n`);
     }

package/src/runtime/agent/orchestrator/mcp/reconnect-singleflight.mjs

@@ -0,0 +1,23 @@
+export function createKeyedSingleflight() {
+    const pending = new Map();
+    return {
+        run(key, task) {
+            const lane = String(key || '');
+            const existing = pending.get(lane);
+            if (existing) return existing;
+            let tracked;
+            const promise = Promise.resolve().then(task);
+            tracked = promise.finally(() => {
+                if (pending.get(lane) === tracked) pending.delete(lane);
+            });
+            pending.set(lane, tracked);
+            return tracked;
+        },
+        has(key) {
+            return pending.has(String(key || ''));
+        },
+        get size() {
+            return pending.size;
+        },
+    };
+}

package/src/runtime/agent/orchestrator/providers/admission-scheduler.mjs

@@ -1,10 +1,9 @@
 import { createHash } from 'node:crypto';
 import { AsyncLocalStorage } from 'node:async_hooks';
 
-// Unbounded by design: provider requests must never serialize behind a local
-// concurrency cap. Rate-limit cooldowns below (server-mandated retry-after)
-// remain the only thing that parks/rejects requests; with an infinite limit
-// the adaptive halving/recovery below is inert.
+// Normal provider traffic is not concurrency-gated. Independent sessions and
+// accounts start immediately; a finite limit exists only when an operator
+// explicitly configures one, or after that account reports a real 429.
 export const PROVIDER_ACCOUNT_CONCURRENCY = Infinity;
 export const PROVIDER_ACCOUNT_MAX_QUEUE = 1024;
 // A cooldown longer than this is a quota-window block (subscription limit),
@@ -13,6 +12,21 @@ export const PROVIDER_ACCOUNT_MAX_QUEUE = 1024;
 export const PROVIDER_COOLDOWN_FAIL_FAST_MS = 60_000;
 const MAX_TIMEOUT_MS = 2_147_483_647;
 const currentAdmission = new AsyncLocalStorage();
+const PRIORITY_RANK = Object.freeze({
+    'user-blocking': 0,
+    'user-visible': 1,
+    'best-effort': 2,
+});
+
+function normalizePriority(value) {
+    const key = String(value || 'user-visible').toLowerCase();
+    return Object.hasOwn(PRIORITY_RANK, key) ? key : 'user-visible';
+}
+
+export function currentProviderAdmissionOwner() {
+    const active = currentAdmission.getStore();
+    return active?.ownerKey ? String(active.ownerKey) : null;
+}
 
 function abortError(signal, fallback = 'provider request canceled') {
     return signal?.reason instanceof Error
@@ -110,10 +124,10 @@ export class ProviderAdmissionScheduler {
         setTimer = setTimeout,
         clearTimer = clearTimeout,
     } = {}) {
-        this.concurrency = Math.min(
-            PROVIDER_ACCOUNT_CONCURRENCY,
-            Math.max(1, Math.floor(Number(concurrency) || PROVIDER_ACCOUNT_CONCURRENCY)),
-        );
+        const parsedConcurrency = Math.floor(Number(concurrency));
+        this.concurrency = Number.isFinite(parsedConcurrency) && parsedConcurrency >= 1
+            ? parsedConcurrency
+            : Infinity;
         this.maxQueue = configuredQueueBound(maxQueue);
         this.now = now;
         this.setTimer = setTimer;
@@ -160,7 +174,9 @@ export class ProviderAdmissionScheduler {
             limit: this.concurrency,
             cooldownUntil: 0,
             recoverySuccesses: 0,
+            recoveryTarget: null,
             cooldownTimer: null,
+            fairCursor: null,
         };
         if (!lane.adaptive || until <= lane.cooldownUntil) return false;
         this.lanes.set(laneKey, lane);
@@ -175,8 +191,15 @@ export class ProviderAdmissionScheduler {
         return true;
     }
 
-    run(key, task, { signal = null, onCooldownWait = null } = {}) {
+    run(key, task, {
+        signal = null,
+        onCooldownWait = null,
+        ownerKey = null,
+        priority = 'user-visible',
+    } = {}) {
         const laneKey = String(key || 'provider:default');
+        const owner = String(ownerKey || 'anonymous').trim().slice(0, 240) || 'anonymous';
+        const taskPriority = normalizePriority(priority);
         // Provider-local recovery may recursively call this.send(). It already
         // owns a slot, so reacquiring the same lane could deadlock a full wave.
         const current = this.context.getStore();
@@ -193,7 +216,9 @@ export class ProviderAdmissionScheduler {
             limit: this.concurrency,
             cooldownUntil: 0,
             recoverySuccesses: 0,
+            recoveryTarget: null,
             cooldownTimer: null,
+            fairCursor: null,
         };
         this.lanes.set(laneKey, lane);
         // Long cooldown = quota window. Fail fast with a visible error; short
@@ -206,7 +231,17 @@ export class ProviderAdmissionScheduler {
             return Promise.reject(new ProviderAdmissionQueueOverflowError(laneKey, this.maxQueue));
         }
         return new Promise((resolve, reject) => {
-            const item = { task, signal, resolve, reject, canceled: false, onAbort: null };
+            const item = {
+                task,
+                signal,
+                resolve,
+                reject,
+                canceled: false,
+                onAbort: null,
+                ownerKey: owner,
+                priority: taskPriority,
+                queuedAt: this.now(),
+            };
             if (signal) {
                 item.onAbort = () => {
                     if (item.started || item.canceled) return;
@@ -236,6 +271,28 @@ export class ProviderAdmissionScheduler {
         });
     }
 
+    _nextQueueIndex(lane) {
+        if (!lane.queue.length) return -1;
+        const bestRank = Math.min(...lane.queue.map((item) =>
+            PRIORITY_RANK[normalizePriority(item.priority)]));
+        const eligible = lane.queue
+            .map((item, index) => ({ item, index }))
+            .filter(({ item }) => PRIORITY_RANK[normalizePriority(item.priority)] === bestRank);
+        const owners = [];
+        for (const { item } of eligible) {
+            const owner = item.ownerKey || 'anonymous';
+            if (!owners.includes(owner)) owners.push(owner);
+        }
+        let selected = owners[0] || 'anonymous';
+        if (owners.length > 1) {
+            const prior = owners.indexOf(lane.fairCursor);
+            selected = owners[(prior + 1 + owners.length) % owners.length];
+        }
+        lane.fairCursor = selected;
+        return eligible.find(({ item }) => (item.ownerKey || 'anonymous') === selected)?.index
+            ?? eligible[0].index;
+    }
+
     _drain(key, lane) {
         if (lane.adaptive && lane.cooldownUntil > this.now()) {
             if (lane.cooldownUntil - this.now() > PROVIDER_COOLDOWN_FAIL_FAST_MS) {
@@ -245,7 +302,9 @@ export class ProviderAdmissionScheduler {
             return;
         }
         while (lane.active < lane.limit && lane.queue.length) {
-            const item = lane.queue.shift();
+            const index = this._nextQueueIndex(lane);
+            if (index < 0) break;
+            const [item] = lane.queue.splice(index, 1);
             if (item.canceled) {
                 this._detach(item);
                 continue;
@@ -268,7 +327,14 @@ export class ProviderAdmissionScheduler {
                 item.signal.addEventListener('abort', running.parentAbort, { once: true });
             }
             this.running.add(running);
-            const admission = { scheduler: this, key, lane, rateLimited: false };
+            const admission = {
+                scheduler: this,
+                key,
+                lane,
+                ownerKey: item.ownerKey,
+                priority: item.priority,
+                rateLimited: false,
+            };
             this.context.run(admission, () => Promise.resolve().then(() => item.task(controller.signal)))
                 .then((value) => {
                     // A retry that eventually succeeds is not evidence that
@@ -292,6 +358,25 @@ export class ProviderAdmissionScheduler {
         if (this._canDeleteLane(lane)) this._deleteLane(key, lane);
     }
 
+    snapshot() {
+        const now = this.now();
+        return {
+            concurrency: Number.isFinite(this.concurrency) ? this.concurrency : null,
+            lanes: [...this.lanes.entries()].map(([key, lane]) => ({
+                key,
+                active: lane.active,
+                queued: lane.queue.length,
+                owners: new Set(lane.queue.map((item) => item.ownerKey || 'anonymous')).size,
+                limit: Number.isFinite(lane.limit) ? lane.limit : null,
+                cooldownMs: Math.max(0, lane.cooldownUntil - now),
+                oldestWaitMs: lane.queue.reduce(
+                    (oldest, item) => Math.max(oldest, Math.max(0, now - (item.queuedAt || now))),
+                    0,
+                ),
+            })),
+        };
+    }
+
     _recordFailure(key, lane, error) {
         if (!lane.adaptive) return false;
         const status = Number(error?.httpStatus || error?.status || error?.response?.status || 0);
@@ -300,7 +385,14 @@ export class ProviderAdmissionScheduler {
             if (this.reportedRateLimits.has(error)) return false;
             this.reportedRateLimits.add(error);
         }
-        lane.limit = Math.max(1, Math.floor(lane.limit / 2));
+        const observed = Number.isFinite(lane.limit)
+            ? lane.limit
+            : Math.max(1, lane.active);
+        lane.recoveryTarget = Math.max(
+            Number(lane.recoveryTarget) || 0,
+            observed,
+        );
+        lane.limit = Math.max(1, Math.floor(observed / 2));
         lane.recoverySuccesses = 0;
         const now = this.now();
         lane.cooldownUntil = Math.max(
@@ -348,6 +440,7 @@ export class ProviderAdmissionScheduler {
             lane.cooldownUntil = 0;
             lane.limit = this.concurrency;
             lane.recoverySuccesses = 0;
+            lane.recoveryTarget = null;
             if (lane.cooldownTimer) {
                 this.clearTimer(lane.cooldownTimer);
                 lane.cooldownTimer = null;
@@ -364,11 +457,15 @@ export class ProviderAdmissionScheduler {
     }
 
     _recordSuccess(lane) {
-        if (!lane.adaptive || lane.limit >= this.concurrency) return;
+        if (!lane.adaptive || !Number.isFinite(lane.limit)) return;
         lane.recoverySuccesses += 1;
         if (lane.recoverySuccesses >= lane.limit) {
             lane.limit += 1;
             lane.recoverySuccesses = 0;
+            if (lane.recoveryTarget && lane.limit >= lane.recoveryTarget) {
+                lane.limit = this.concurrency;
+                lane.recoveryTarget = null;
+            }
         }
     }
 
@@ -505,6 +602,8 @@ export function wrapProviderAdmission(provider, providerName, scheduler = provid
             });
         }, {
             signal,
+            ownerKey: opts.admissionOwner || opts.sessionId || null,
+            priority: opts.admissionPriority || 'user-visible',
             onCooldownWait: (waitMs) => {
                 // Display-only: the TUI/desktop 'reconnecting' stage already
                 // renders a custom verb, so no new stage vocabulary is needed.

package/src/runtime/agent/orchestrator/providers/anthropic-effort.mjs

@@ -17,6 +17,67 @@ function _sortEffortLevels(levels) {
     return [...levels].sort((a, b) => rank(a) - rank(b));
 }
 
+// Control flags that ride the capabilities.effort map alongside real levels
+// (`{supported:true, low:true, …}`). They are NOT selectable effort levels;
+// letting them through minted a bogus "supported" level that got persisted
+// into the on-disk catalog and offered in the UI.
+const CONTROL_EFFORT_KEYS = new Set(['supported', 'enabled', 'default']);
+
+// ── Catalog-first capability index ───────────────────────────────────────
+// The provider catalog already carries what each model advertises
+// (capabilities.effort → reasoningOptions:[{type:'effort',values:[…]}]), so it
+// — not a hardcoded regex ladder — is the source of truth for what we put on
+// the wire. anthropic-model-resolve feeds this whenever the in-memory catalog
+// moves. The regex ladder below stays as the fallback for ids the catalog does
+// not know (offline start, api-key provider, first run before /v1/models).
+const _catalogEffortLevels = new Map();
+
+function _catalogKeys(model) {
+    const id = normalizeModelId(model);
+    if (!id) return [];
+    // A dated id and its bare version alias describe the SAME model — index
+    // both so `claude-opus-5` and `claude-opus-5-20260101` resolve alike.
+    const undated = id.replace(/-\d{8}$/, '');
+    return undated !== id ? [id, undated] : [id];
+}
+
+/**
+ * Replace the catalog-derived capability index. Records without a
+ * `reasoningOptions` array are treated as UNKNOWN (skipped, so the regex
+ * fallback still applies) rather than as "no effort" — offline/static fallback
+ * lists carry no capability data and must not disable effort.
+ */
+export function setModelEffortCapabilities(models) {
+    _catalogEffortLevels.clear();
+    if (!Array.isArray(models)) return;
+    for (const model of models) {
+        if (!model?.id || !Array.isArray(model.reasoningOptions)) continue;
+        const option = model.reasoningOptions.find(
+            (entry) => String(entry?.type || '').trim().toLowerCase() === 'effort',
+        );
+        const levels = new Set(
+            (Array.isArray(option?.values) ? option.values : [])
+                .map((value) => String(value || '').trim().toLowerCase())
+                .filter((value) => value && !CONTROL_EFFORT_KEYS.has(value)),
+        );
+        for (const key of _catalogKeys(model.id)) {
+            const existing = _catalogEffortLevels.get(key);
+            // A bare alias shared by several records keeps the richer entry.
+            if (existing?.size && levels.size === 0) continue;
+            _catalogEffortLevels.set(key, levels);
+        }
+    }
+}
+
+/** Advertised levels for `model`, or null when the catalog has no record. */
+function _catalogLevels(model) {
+    for (const key of _catalogKeys(model)) {
+        const levels = _catalogEffortLevels.get(key);
+        if (levels) return levels;
+    }
+    return null;
+}
+
 export const EFFORT_BETA_HEADER = 'effort-2025-11-24';
 
 export const LEGACY_EFFORT_BUDGET = Object.freeze({
@@ -40,7 +101,10 @@ function parseClaudeVersion(model) {
     if (triple) {
         return { family: triple[1], major: Number(triple[2]), minor: Number(triple[3]) };
     }
-    const pair = m.match(/^claude-(sonnet|fable)-(\d+)(?:$|[-@])/);
+    // Bare version ids carry family + major only (claude-opus-5). opus/haiku
+    // were missing here, so `claude-opus-5` parsed to null and fell through
+    // every capability check as an unknown shape.
+    const pair = m.match(/^claude-(sonnet|fable|opus|haiku)-(\d+)(?:$|[-@])/);
     if (pair) {
         return { family: pair[1], major: Number(pair[2]), minor: null };
     }
@@ -64,6 +128,9 @@ function isLegacyAnthropicReasoningModel(model) {
     if (parsed.family === 'sonnet' || parsed.family === 'opus') {
         if (parsed.major < 4) return true;
         if (parsed.major === 4 && parsed.minor !== null && parsed.minor < 6) return true;
+        // Bare major, no minor (claude-opus-4 / claude-sonnet-4): adaptive
+        // effort only ships from 5 up, so 4.x aliases stay manual-thinking.
+        if (parsed.minor === null && parsed.major < 5) return true;
         return false;
     }
     return false;
@@ -72,13 +139,22 @@ function isLegacyAnthropicReasoningModel(model) {
 // @[MODEL LAUNCH]: extend allowlist when new Claude models ship with effort support.
 export function modelSupportsEffort(model) {
     if (isEnvTruthy(process.env.MIXDOG_ANTHROPIC_ALWAYS_ENABLE_EFFORT)) return true;
+    const advertised = _catalogLevels(model);
+    if (advertised) return advertised.size > 0;
+    return _regexSupportsEffort(model);
+}
+
+// Fallback ladder for ids the catalog does not carry. Also used by
+// effortValuesForModel, which BUILDS the catalog records and therefore must
+// never consult the index it feeds.
+function _regexSupportsEffort(model) {
     const m = normalizeModelId(model);
     if (!m.includes('claude')) return false;
     if (isLegacyAnthropicReasoningModel(model)) return false;
     if (m.includes('opus-4-6') || m.includes('sonnet-4-6')) return true;
     if (m.includes('sonnet-5') || m.includes('fable-5')) return true;
     if (/^claude-opus-4-(6|7|8)(?:$|[-@])/.test(m)) return true;
-    if (/^claude-opus-5-/.test(m)) return true;
+    if (/^claude-opus-5(?:$|[-@])/.test(m)) return true;
     // Fallthrough for not-yet-enumerated modern models: only grant effort when
     // parseClaudeVersion resolves a family with major>=4 (and not a manual-
     // thinking legacy already excluded above). A bare `startsWith('claude-')`
@@ -98,6 +174,12 @@ export function modelSupportsEffort(model) {
 // supported by: Fable 5, Mythos 5, Opus 4.8, Opus 4.7, Sonnet 5.
 // NOT Opus 4.6 / Sonnet 4.6 (those support max but not xhigh).
 export function modelSupportsXhighEffort(model) {
+    const advertised = _catalogLevels(model);
+    if (advertised) return advertised.has('xhigh');
+    return _regexSupportsXhighEffort(model);
+}
+
+function _regexSupportsXhighEffort(model) {
     const m = normalizeModelId(model);
     if (/^claude-opus-4-(7|8)(?:$|[-@])/.test(m)) return true;
     if (/^claude-opus-5(?:$|[-@])/.test(m)) return true;
@@ -111,7 +193,14 @@ export function modelSupportsXhighEffort(model) {
 // @[MODEL LAUNCH]: extend when new Opus models support max effort.
 // Max list = xhigh list PLUS Opus 4.6, Sonnet 4.6, Opus 4.5.
 export function modelSupportsMaxEffort(model) {
-    if (modelSupportsXhighEffort(model)) return true;
+    const advertised = _catalogLevels(model);
+    // xhigh support implies max support (kept from the ladder below).
+    if (advertised) return advertised.has('max') || advertised.has('xhigh');
+    return _regexSupportsMaxEffort(model);
+}
+
+function _regexSupportsMaxEffort(model) {
+    if (_regexSupportsXhighEffort(model)) return true;
     const m = normalizeModelId(model);
     if (/^claude-opus-4-(5|6)(?:$|[-@])/.test(m)) return true;
     if (/^claude-sonnet-4-6(?:$|[-@])/.test(m)) return true;
@@ -209,7 +298,7 @@ export function applyAnthropicEffortToBody(
         // Set unconditionally (independent of `normalized`) so effort-capable
         // turns always carry adaptive thinking + round-trip signatures.
         // MIXDOG_ANTHROPIC_THINKING_DISPLAY=omitted (operator/bench knob):
-        // CC-parity mode — no thinking blocks come back, so nothing is
+        // thinking blocks are omitted entirely, so nothing is
         // replayed into later requests (saves the 1h cache-write + re-read on
         // accumulated thinking) at the cost of losing visible reasoning and
         // cross-iteration thinking continuity. Default stays summarized.
@@ -254,7 +343,8 @@ export function effortValuesForModel(capabilities, modelId) {
     // advertises (xhigh, max, or anything future), no hardcoded allowlist.
     if (effort !== true && typeof effort === 'object') {
         const advertised = Object.keys(effort).filter(
-            (level) => effort[level] === true || effort[level]?.supported === true,
+            (level) => !CONTROL_EFFORT_KEYS.has(String(level).trim().toLowerCase())
+                && (effort[level] === true || effort[level]?.supported === true),
         );
         if (advertised.length) return _sortEffortLevels(advertised);
         // Object with no per-level flags: fall through to the boolean/supported
@@ -265,10 +355,10 @@ export function effortValuesForModel(capabilities, modelId) {
     // the model supports effort but doesn't enumerate levels, so derive the
     // set from the known level ladder, gated by the top-tier model check.
     let levels = [...EFFORT_LEVELS];
-    if (!modelSupportsMaxEffort(modelId)) {
+    if (!_regexSupportsMaxEffort(modelId)) {
         levels = levels.filter((level) => level !== 'max');
     }
-    if (!modelSupportsXhighEffort(modelId)) {
+    if (!_regexSupportsXhighEffort(modelId)) {
         levels = levels.filter((level) => level !== 'xhigh');
     }
     return levels;

package/src/runtime/agent/orchestrator/providers/anthropic-model-resolve.mjs

@@ -8,20 +8,22 @@
 import { enrichModels } from './model-catalog.mjs';
 import { sanitizeModelList } from './model-list-sanitize.mjs';
 import { makeModelCache } from './model-cache.mjs';
-import { effortValuesForModel } from './anthropic-effort.mjs';
+import { effortValuesForModel, setModelEffortCapabilities } from './anthropic-effort.mjs';
 
 // Disk-backed cache so repeated process starts (cron, tool calls) don't
 // hammer /v1/models. 24h TTL matches the upstream client cadence.
 const MODEL_CACHE_TTL_MS = 24 * 60 * 60_000;
 // Bump when the on-disk cache shape changes so stale-shape entries are
 // discarded instead of misread.
-const ANTHROPIC_MODEL_CACHE_SCHEMA_VERSION = 1;
+// v2: effort level lists no longer carry the `supported` control flag as a
+// selectable level, so v1 caches are discarded rather than replayed.
+const ANTHROPIC_MODEL_CACHE_SCHEMA_VERSION = 2;
 
 const _modelCache = makeModelCache({
     fileName: 'anthropic-oauth-models.json',
     ttlMs: MODEL_CACHE_TTL_MS,
     version: ANTHROPIC_MODEL_CACHE_SCHEMA_VERSION,
-    onSave: (m) => { _inMemoryCatalog = Array.isArray(m) ? m.slice() : null; },
+    onSave: (m) => { _setInMemoryCatalog(m); },
 });
 
 // Async wrappers so callers can keep awaiting; the shared cache CRUD is sync.
@@ -42,6 +44,9 @@ let _inMemoryCatalog = null;
 // listModels() warm path, so expose a setter instead of the raw binding.
 export function _setInMemoryCatalog(models) {
     _inMemoryCatalog = Array.isArray(models) ? models.slice() : null;
+    // The request builder resolves effort capability from the catalog, so the
+    // capability index moves with the mirror — one write, one source of truth.
+    setModelEffortCapabilities(_inMemoryCatalog || []);
 }
 
 export function _catalogHas(id) {
@@ -185,7 +190,9 @@ export function _catalogOutputTokens(model) {
     try {
         if (!Array.isArray(_inMemoryCatalog)) {
             const cached = _modelCache.loadSync();
-            if (Array.isArray(cached)) _inMemoryCatalog = cached.slice();
+            // Route the lazy warm through the setter: a direct assignment left
+            // the effort-capability index empty even though the mirror was warm.
+            if (Array.isArray(cached)) _setInMemoryCatalog(cached);
         }
         if (!Array.isArray(_inMemoryCatalog)) return null;
         const entry = _inMemoryCatalog.find(m => m?.id === model);

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -1094,7 +1094,7 @@ export class AnthropicOAuthProvider {
                     continue;
                 }
                 const classifier = _classifyMidstreamError(err, midState);
-                // CC-parity stall recovery (2026-08-03 v3 postmortem): a
+                // Stall recovery (2026-08-03 v3 postmortem): a
                 // stalled stream that exposed NOTHING (no text/thinking
                 // relayed, no tool emitted) is re-issued NON-STREAMING instead
                 // of retrying the same streaming shape. Effort-mode models can
@@ -1103,8 +1103,7 @@ export class AnthropicOAuthProvider {
                 // generation into the same timer (observed live: deterministic
                 // 4×~138s beheading, ~552s per turn), while the non-streaming
                 // transport simply waits for the full body (bounded by
-                // PROVIDER_NONSTREAM_TOTAL_TIMEOUT_MS). Claude Code does
-                // exactly this on its watchdog aborts. Replay is trivially
+                // PROVIDER_NONSTREAM_TOTAL_TIMEOUT_MS). Replay is trivially
                 // safe here — nothing was relayed or dispatched.
                 if (classifier === 'stream_stalled'
                     && _outcome?.replayUnsafe !== true

package/src/runtime/agent/orchestrator/providers/anthropic-sse.mjs

@@ -23,6 +23,7 @@ import {
     NATIVE_SERVER_TOOL_CALL_BLOCK_TYPES,
     NATIVE_SERVER_TOOL_RESULT_BLOCK_TYPES,
 } from './lib/anthropic-native-blocks.mjs';
+import { parseProviderJsonBatch } from './stream-json-pool.mjs';
 import { stampStreamOutcome, STREAM_TRANSPORTS, STREAM_OUTCOME_VERSION } from './lib/stream-outcome.mjs';
 
 /** Bounded mid-stream SSE retries (transient stream loss); shared with anthropic.mjs.
@@ -486,7 +487,10 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                 if (!data) continue;
 
                 try {
-                    const event = JSON.parse(data);
+                    // A completed reader.read() owns this frame even if abort
+                    // races immediately afterward; the next read observes the
+                    // cancellation after this frame is relayed.
+                    const [event] = await parseProviderJsonBatch([data]);
 
                     // SEMANTIC idle reset (Part A): reset the idle timer ONLY for
                     // real progress events, NOT for Anthropic keepalives. Anthropic

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -604,7 +604,7 @@ export class AnthropicProvider {
                         continue;
                     }
                     const classifier = _classifyMidstreamError(err, midState);
-                    // CC-parity stall recovery (ported from anthropic-oauth,
+                    // Stall recovery (shared with anthropic-oauth,
                     // 2026-08-03): a stalled stream that exposed NOTHING is
                     // re-issued non-streaming instead of retrying the same
                     // streaming shape into the same idle window. Replay is

package/src/runtime/agent/orchestrator/providers/codex-client-meta.mjs

@@ -2,13 +2,11 @@
  * codex-client-meta.mjs — codex client identity headers for the OpenAI OAuth
  * transports.
  *
- * codex-rs sends two client-identity headers on EVERY request including the
- * WS handshake:
+ * The reference client sends two client-identity headers on EVERY request,
+ * including the WS handshake:
  *  - `User-Agent: codex_cli_rs/<version> (<os> <ver>; <arch>) <terminal>`
- *    (login/src/auth/default_client.rs get_codex_user_agent + default_headers)
  *  - `version: <CARGO_PKG_VERSION>` via the built-in provider http_headers
- *    (model-provider-info/src/lib.rs:339-343), merged into the WS handshake by
- *    merge_request_headers (codex-api/src/endpoint/responses_websocket.rs).
+ *    merged into the WS handshake.
  * The backend uses these for client gating (model catalog visibility measured
  * 2026-07-03) and plausibly for x-codex-turn-state issuance / sticky
  * cache-node routing, so mixdog mirrors both.
@@ -17,7 +15,7 @@ import os from 'node:os';
 
 // Offline fallback only; live value refreshes from npm (24h TTL, in-process).
 // The backend gates model exposure AND per-request model access on the client
-// version (gpt-5.6-* require >= 0.144.0 per codex models-manager/models.json,
+// version (gpt-5.6-* require >= 0.144.0 per the published model catalog,
 // verified 2026-07-09), so keep this at the current release when bumping.
 const CODEX_CLIENT_VERSION_FLOOR = '0.144.1';
 const VERSION_TTL_MS = 24 * 60 * 60_000;