mixdog 1.0.11 → 1.1.0

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-credentials.mjs

@@ -15,9 +15,18 @@ import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs
 import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
 import { claudeCliUserAgent, resolveCliVersion } from './anthropic-oauth-client-version.mjs';
-import { expiryFromAccessToken, oauthCredentialStatus, scrubOAuthSecrets } from './lib/oauth-token-utils.mjs';
+import {
+  accountIdentityFields,
+  expiryFromAccessToken,
+  isDefinitiveOAuthFailure,
+  normalizeAccountIdentity,
+  oauthCredentialStatus,
+  scrubOAuthSecrets,
+} from './lib/oauth-token-utils.mjs';
 import { createOAuthPkce, parseOAuthCodeInput } from './lib/oauth-pkce.mjs';
 
+const SIGN_IN_EXPIRED_PREFIX = 'Anthropic sign-in expired. Sign in again from Providers.';
+
 // SSRF guard for the OAuth token endpoint override. Env-supplied URLs must be
 // https with a valid http(s) URL shape; reject file:/data:/ftp:/etc. and any
 // http override so a hostile env cannot redirect refresh-token requests.
@@ -88,15 +97,26 @@ function _loadCredentialsFile(path) {
       mtimeMs: stat.mtimeMs,
       accessToken: oauth.accessToken,
       refreshToken: oauth.refreshToken || null,
+      reauthRequired: oauth.reauthRequired === true,
       expiresAt: _normalizeExpiresAt(oauth.expiresAt ?? oauth.expires_at) || expiryFromAccessToken(oauth.accessToken),
       scopes: Array.isArray(oauth.scopes) ? oauth.scopes : [],
       subscriptionType: oauth.subscriptionType || null,
+      identity: normalizeAccountIdentity(oauth.identity),
     };
   } catch {
     return null;
   }
 }
 
+// The token endpoint names the signed-in account next to the tokens.
+export function identityFromTokenResponse(json) {
+  return normalizeAccountIdentity({
+    id: json?.account?.uuid,
+    email: json?.account?.email_address,
+    organizationId: json?.organization?.uuid,
+  });
+}
+
 // Cross-process safe credential save. Lockfile (O_EXCL) prevents two Mixdog
 // refreshers from clobbering each other; atomic rename guarantees readers see
 // either the old or new file, never a half-written one. Used so refresh_token
@@ -174,7 +194,21 @@ export function describeAnthropicOAuthCredentials() {
         expiresAt,
       };
     }
-    return oauthCredentialStatus({ hasRefresh, expiresAt, detail, refreshSkewMs: TOKEN_REFRESH_SKEW_MS });
+    if (creds.reauthRequired) {
+      return {
+        authenticated: false,
+        usable: false,
+        refreshable: false,
+        reauthRequired: true,
+        status: 'Reauth Required',
+        detail,
+        expiresAt,
+      };
+    }
+    return {
+      ...oauthCredentialStatus({ hasRefresh, expiresAt, detail, refreshSkewMs: TOKEN_REFRESH_SKEW_MS }),
+      ...accountIdentityFields(creds.identity),
+    };
   } catch (err) {
     return {
       authenticated: false,
@@ -289,10 +323,14 @@ async function _refreshOAuthCredentialsUnlocked(creds) {
     }
     if (!res.ok) {
       const isInvalidGrant = text.includes('invalid_grant') || json?.error === 'invalid_grant';
-      throw Object.assign(
-        _tokenEndpointError('token refresh', res.status, text, [creds.refreshToken, creds.accessToken]),
-        { isInvalidGrant }
-      );
+      const failure = _tokenEndpointError('token refresh', res.status, text, [creds.refreshToken, creds.accessToken]);
+      if (isDefinitiveOAuthFailure(text, res.status)) {
+        throw Object.assign(new Error(`${SIGN_IN_EXPIRED_PREFIX} ${failure.message}`), {
+          isInvalidGrant: true,
+          reauthRequired: true,
+        });
+      }
+      throw Object.assign(failure, { isInvalidGrant });
     }
 
     const accessToken = json?.access_token || json?.accessToken;
@@ -305,6 +343,7 @@ async function _refreshOAuthCredentialsUnlocked(creds) {
       expiresAt,
       scopes: Array.isArray(json?.scope) ? json.scope : creds.scopes,
       subscriptionType: creds.subscriptionType,
+      identity: identityFromTokenResponse(json) || creds.identity || null,
     };
     // Persist rotated tokens back so any other Mixdog reader of the same
     // credentials file picks up the new refresh_token. Without this, a
@@ -320,6 +359,8 @@ async function _refreshOAuthCredentialsUnlocked(creds) {
             refreshToken: refreshed.refreshToken,
             expiresAt: refreshed.expiresAt,
             scopes: refreshed.scopes,
+            reauthRequired: undefined,
+            ...(refreshed.identity ? { identity: refreshed.identity } : {}),
           },
         }));
       } catch (err) {
@@ -364,7 +405,31 @@ export async function refreshOAuthCredentials(creds) {
       ) {
         return disk;
       }
-      return _refreshOAuthCredentialsUnlocked(disk || { ...creds, path: credentialPath });
+      const attempt = disk || { ...creds, path: credentialPath };
+      try {
+        return await _refreshOAuthCredentialsUnlocked(attempt);
+      } catch (err) {
+        if (err?.reauthRequired !== true) throw err;
+        const latest = _loadCredentialsFile(credentialPath);
+        if (latest?.refreshToken && latest.refreshToken !== attempt.refreshToken) {
+          if (!latest.expiresAt || latest.expiresAt > Date.now()) return latest;
+          return _refreshOAuthCredentialsUnlocked(latest);
+        }
+        try {
+          _updateCredentialsFile(credentialPath, (raw) => {
+            const oauth = raw?.claudeAiOauth;
+            if (!oauth || oauth.refreshToken !== attempt.refreshToken) return undefined;
+            // Non-destructive: tokens stay intact; a new sign-in or a
+            // successful refresh rewrites the entry without this marker.
+            return { ...raw, claudeAiOauth: { ...oauth, reauthRequired: true } };
+          });
+        } catch (saveErr) {
+          process.stderr.write(
+            `[anthropic-oauth] dead-account mark failed: ${_scrubTokens(saveErr?.message || String(saveErr)).slice(0, 200)}\n`
+          );
+        }
+        throw err;
+      }
     },
     {
       timeoutMs: 120_000,
@@ -536,6 +601,7 @@ async function exchangeAuthorizationCode({ pkce, code, state, redirectUri }) {
   }
   const expiresAt = expiresAtFromTokenResponse(json);
   const scopes = _oauthParseScopeField(json?.scope);
+  const identity = identityFromTokenResponse(json);
   const credPath = _oauthCredentialsWritePath();
   const raw = _updateCredentialsFile(credPath, (current) => {
     const base = current && typeof current === 'object' ? current : {};
@@ -548,7 +614,10 @@ async function exchangeAuthorizationCode({ pkce, code, state, redirectUri }) {
         refreshToken,
         expiresAt,
         scopes,
+        reauthRequired: undefined,
         subscriptionType: existingOauth.subscriptionType ?? null,
+        // A fresh sign-in replaces the account: never keep the previous identity.
+        identity: identity || undefined,
       },
     };
   });
@@ -559,10 +628,11 @@ async function exchangeAuthorizationCode({ pkce, code, state, redirectUri }) {
     expiresAt,
     scopes,
     subscriptionType: raw.claudeAiOauth.subscriptionType,
+    identity,
   };
 }
 
-export async function beginOAuthLogin({ openBrowserFn = null } = {}) {
+export async function beginOAuthLogin({ openBrowserFn = null, openBrowser = true } = {}) {
   const pkce = createOAuthPkce();
   const state = randomBytes(32).toString('base64url');
   const buildUrl = (redirectUri) => {
@@ -580,6 +650,7 @@ export async function beginOAuthLogin({ openBrowserFn = null } = {}) {
   const url = buildUrl(OAUTH_REDIRECT_URI);
   const manualUrl = buildUrl(OAUTH_MANUAL_REDIRECT_URI);
   const openLoginUrl = async (targetUrl, label = 'login') => {
+    if (!openBrowser) return;
     try {
       const openInBrowser = openBrowserFn || (await import('../../../shared/open-url.mjs')).openInBrowser;
       await openInBrowser(targetUrl.toString());

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -62,6 +62,8 @@ import {
 } from './lib/anthropic-request-utils.mjs';
 import {
   EFFORT_CONFIGURATION_BETA,
+  isEffortConfigurationRejection,
+  markEffortConfigurationUnsupported,
   projectEffortConfiguration,
   lowerAnthropicEffortHistory,
   markAnthropicEffortBody,
@@ -293,7 +295,9 @@ export class AnthropicOAuthProvider {
       this.credentials = loadCredentials();
     }
     if (!this.credentials) {
-      throw new Error('Anthropic OAuth credentials not found. Open /providers in mixdog to sign in.');
+      throw Object.assign(new Error('Anthropic OAuth credentials not found. Open /providers in mixdog to sign in.'), {
+        reauthRequired: true,
+      });
     }
 
     // Pick up Mixdog-updated tokens the moment the credentials file is
@@ -359,12 +363,20 @@ export class AnthropicOAuthProvider {
         return latest;
       }
 
-      if (!latest?.refreshToken) {
+      if (!latest?.refreshToken || latest.reauthRequired) {
         if (!force && latest?.accessToken && (!latest.expiresAt || latest.expiresAt > Date.now())) {
-          logQuiet('WARNING: token expiring but no refresh token; using current token until expiry');
+          logQuiet('WARNING: token expiring but no usable refresh token; using current token until expiry');
           return latest;
         }
-        throw new Error('Anthropic OAuth refresh token not available. Open /providers in mixdog to sign in again.');
+        if (latest?.reauthRequired) {
+          throw Object.assign(new Error('Anthropic sign-in expired. Sign in again from Providers.'), {
+            reauthRequired: true,
+          });
+        }
+        throw Object.assign(
+          new Error('Anthropic OAuth refresh token not available. Open /providers in mixdog to sign in again.'),
+          { reauthRequired: true }
+        );
       }
 
       try {
@@ -608,6 +620,19 @@ export class AnthropicOAuthProvider {
       throw anthropicQuotaError(response.status, response.headers, safeText);
     }
 
+    // A newer model that rejects the mid-conversation effort update: switch
+    // the updates off for it in this process and replay the turn once
+    // without them (the request keeps its turn effort).
+    if (isEffortConfigurationRejection(response.status, scrubbedText) && !opts._effortConfigurationRetry) {
+      markEffortConfigurationUnsupported('anthropic-oauth', useModel);
+      process.stderr.write(`[anthropic-oauth] ${useModel} rejected the mid-conversation effort update; retrying once without it\n`);
+      return this.send(messages, useModel, tools, {
+        ...opts,
+        effortConfigurationEnabled: false,
+        _effortConfigurationRetry: true,
+      });
+    }
+
     // Anthropic can gate a newly launched model on a newer Claude
     // Code client identity. Learn only the exact minimum-version
     // rejection, persist the raised floor, and replay this untouched

package/src/runtime/agent/orchestrator/providers/anthropic-sse-turn.mjs

@@ -71,6 +71,9 @@ export function createAnthropicSseTurn({
     ...events,
     // Stream ended: flush any held-back leaked-tool-call buffer.
     flushLeak: leak.flush,
+    // Usage the provider reported so far, in the success result's shape (a
+    // cancelled turn hands it to its send's accounting).
+    reportedUsage: () => ({ usage: turn.usage, model: turn.model || undefined }),
     ...outcome,
   };
 }

package/src/runtime/agent/orchestrator/providers/anthropic-sse.mjs

@@ -16,6 +16,7 @@ import { OAUTH_STREAM_LABELS } from './lib/anthropic-stream-labels.mjs';
 import { stampStreamOutcome, STREAM_TRANSPORTS, STREAM_OUTCOME_VERSION } from './lib/stream-outcome.mjs';
 import { createAnthropicSseTurn } from './anthropic-sse-turn.mjs';
 import { createAnthropicSseWatchdogs } from './anthropic-sse-watchdogs.mjs';
+import { noteAbandonedUsage } from '../../../shared/llm/usage-context.mjs';
 
 /** Bounded mid-stream SSE retries (transient stream loss); shared with anthropic.mjs.
  *  Sourced from the single shared retry-budget table (MIDSTREAM_RETRY_POLICY.sse). */
@@ -234,7 +235,15 @@ export async function parseSSEStream(
         chunk = await watchdogs.read();
       } catch (err) {
         const stopped = watchdogs.readFailure() ?? (signal?.aborted ? abortedError() : null);
-        if (stopped) throw stopped;
+        if (stopped) {
+          // The caller's cancellation reason may be shared: never stamp this
+          // request's usage on it; the usage reported so far goes to this send.
+          if (signal?.aborted && state?.sawMessageStart) {
+            const reported = turn.reportedUsage();
+            noteAbandonedUsage(reported.usage, reported.model);
+          }
+          throw stopped;
+        }
         // The connection dropped mid-body: carry what this turn completed so
         // the loop can continue from finished tool calls instead of failing.
         throw state?.sawMessageStart ? turn.attachTransportPartial(err) : err;

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -7,6 +7,7 @@ import { createAbortController } from '../../../shared/abort-controller.mjs';
 import { ANTHROPIC_MAX_MIDSTREAM_RETRIES, parseSSEStream } from './anthropic-sse.mjs';
 import { buildAnthropicBetaHeaders } from './anthropic-betas.mjs';
 import { buildAnthropicApiRequest } from './anthropic-api-request.mjs';
+import { isCustomProviderName } from './custom-reasoning.mjs';
 import { armFirstByteWatchdog, createAnthropicApiTransport } from './anthropic-api-transport.mjs';
 import { createAnthropicApiRecovery } from './anthropic-api-recovery.mjs';
 import { buildAnthropicTurnResult } from './anthropic-turn-result.mjs';
@@ -47,12 +48,18 @@ export class AnthropicProvider {
   // off the client defaults and add it only on turns that actually serialize
   // defer_loading tools.
   _createClient(apiKey) {
-    const betaHeaders = this.config.disableBetaHeaders ? null : buildAnthropicBetaHeaders();
+    // A custom gateway gets no first-party default betas and only its own
+    // credential: never the SDK's env/credential-file fallbacks, and none at
+    // all when keyless (config.keyless).
+    const custom = isCustomProviderName(this.name);
+    const keyless = custom && this.config.keyless === true;
+    const betaHeaders = this.config.disableBetaHeaders || custom ? null : buildAnthropicBetaHeaders();
     return new (loadAnthropic())({
-      apiKey,
+      ...(custom ? { apiKey: keyless ? '' : apiKey || '', authToken: null } : { apiKey }),
       ...(this.config.baseURL ? { baseURL: this.config.baseURL } : {}),
       defaultHeaders: {
         ...(betaHeaders ? { 'anthropic-beta': betaHeaders } : {}),
+        ...(keyless ? { 'x-api-key': null, authorization: null } : {}),
         ...(this.config.extraHeaders || {}),
       },
       maxRetries: 0,
@@ -114,6 +121,8 @@ export class AnthropicProvider {
       tools,
       opts,
       fastModeLatched: this.fastModeBetaHeaderLatched,
+      // Custom providers carry per-model reasoning settings on their own rows.
+      modelInfo: isCustomProviderName(this.name) ? this.getCachedModelInfo?.(useModel) || null : null,
     });
     this.fastModeBetaHeaderLatched = fastModeLatched;
 

package/src/runtime/agent/orchestrator/providers/antigravity-oauth-login.mjs

@@ -103,19 +103,20 @@ async function requestCodeAssist(action, body, context, timeoutMs = PROJECT_TIME
   return payload;
 }
 
-async function fetchAccountEmail(accessToken, { fetchFn = fetch, signal = null } = {}) {
+// The userinfo response carries the Google account's email and stable user id.
+async function fetchAccountInfo(accessToken, { fetchFn = fetch, signal = null } = {}) {
   try {
     const res = await fetchFn(USERINFO_URL, {
       headers: { Authorization: `Bearer ${accessToken}` },
       redirect: 'error',
       signal: withTimeoutSignal(signal, TOKEN_TIMEOUT_MS),
     });
-    if (!res.ok) return '';
+    if (!res.ok) return { email: '', userId: '' };
     const json = await res.json();
-    return String(json?.email || '');
+    return { email: String(json?.email || ''), userId: String(json?.id || json?.sub || '') };
   } catch {
     signal?.throwIfAborted();
-    return '';
+    return { email: '', userId: '' };
   }
 }
 
@@ -266,7 +267,7 @@ export async function exchangeAuthorizationCode({ code, verifier, fetchFn = fetc
   if (!json?.access_token || !json?.refresh_token) {
     throw new Error('[antigravity-oauth] token exchange response missing access_token or refresh_token');
   }
-  const email = await fetchAccountEmail(json.access_token, { fetchFn, signal });
+  const { email, userId } = await fetchAccountInfo(json.access_token, { fetchFn, signal });
   const projectId = await discoverProject(json.access_token, { fetchFn, onProgress, signal, email });
   const tokens = {
     access_token: json.access_token,
@@ -274,6 +275,7 @@ export async function exchangeAuthorizationCode({ code, verifier, fetchFn = fetc
     expires_at: typeof json.expires_in === 'number' ? Date.now() + json.expires_in * 1000 : 0,
     project_id: projectId,
     email,
+    user_id: userId,
   };
   signal?.throwIfAborted();
   saveTokens(tokens);
@@ -285,6 +287,7 @@ export async function beginOAuthLogin({
   onProgress = null,
   createServerFn = createServer,
   openBrowserFn = null,
+  openBrowser = true,
 } = {}) {
   const controller = new AbortController();
   const pkce = createOAuthPkce();
@@ -396,6 +399,7 @@ export async function beginOAuthLogin({
     server.listen(CALLBACK_PORT, CALLBACK_HOST, async () => {
       if (settled) return;
       process.stderr.write(`\n[antigravity-oauth] Open this URL to log in:\n${url.toString()}\n\n`);
+      if (!openBrowser) return;
       try {
         if (openBrowserFn) await openBrowserFn(url.toString());
         else {

package/src/runtime/agent/orchestrator/providers/antigravity-oauth-tokens.mjs

@@ -18,7 +18,11 @@ import { join, resolve } from 'node:path';
 import { getPluginData } from '../config.mjs';
 import { writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
 import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
-import { normalizeExpiresAtMs as _normalizeExpiresAt, scrubOAuthSecrets } from './lib/oauth-token-utils.mjs';
+import {
+  accountIdentityFields,
+  normalizeExpiresAtMs as _normalizeExpiresAt,
+  scrubOAuthSecrets,
+} from './lib/oauth-token-utils.mjs';
 import { ANTIGRAVITY_MODELS } from '../../../shared/llm/provider-model-identities.mjs';
 import { readLastKnownVersion, rememberLastKnownVersion } from './client-version-store.mjs';
 import { maxSemver } from './npm-cli-version.mjs';
@@ -199,6 +203,7 @@ export function loadTokens() {
       expires_at: _normalizeExpiresAt(raw.expires_at ?? raw.expiresAt),
       project_id: String(raw.project_id || raw.projectId || ''),
       email: String(raw.email || ''),
+      user_id: String(raw.user_id || raw.userId || ''),
       source: 'own',
       mtimeMs: mtimeMs(path),
     };
@@ -216,6 +221,7 @@ export function saveTokens(tokens) {
       expires_at: tokens.expires_at || 0,
       project_id: tokens.project_id || tokens.projectId || '',
       email: tokens.email || '',
+      user_id: tokens.user_id || tokens.userId || '',
     },
     { lock: true, fsyncDir: true, mode: 0o600, secret: true }
   );
@@ -263,6 +269,7 @@ export function describeAntigravityOAuthCredentials() {
       reauthRequired: !usable,
       status: usable ? 'Signed In' : 'Reauth Required',
       detail,
+      ...accountIdentityFields({ id: tokens.user_id, email: tokens.email }),
       email: tokens.email || '',
       projectId: tokens.project_id || '',
     };
@@ -332,6 +339,7 @@ export function refreshTokens({ fetchFn = fetch } = {}) {
       expires_at: typeof json.expires_in === 'number' ? Date.now() + json.expires_in * 1000 : 0,
       project_id: current.project_id,
       email: current.email,
+      user_id: current.user_id,
     };
     saveTokens(next);
     return next;

package/src/runtime/agent/orchestrator/providers/antigravity-oauth.mjs

@@ -12,6 +12,7 @@
  * Auth, endpoints, and headers live in antigravity-oauth-tokens.mjs.
  */
 import { mkdirSync, writeFileSync } from 'node:fs';
+import { noteErrorUsage } from './lib/note-error-usage.mjs';
 import { join } from 'node:path';
 import { buildAntigravityRequest, isAntigravityClaude as isClaudeModel } from './antigravity-request.mjs';
 import { createPassthroughSignal } from '../stall-policy.mjs';
@@ -167,6 +168,7 @@ export class AntigravityOAuthProvider {
         response = await requestOnce();
       } catch (err) {
         lastErr = err;
+        noteErrorUsage(err);
         const status = Number(err?.status || err?.httpStatus || 0);
         const emitted = err?.unsafeToRetry === true || err?.liveTextEmitted === true || err?.emittedToolCall === true;
         // A typed 401 says THIS access token is no longer accepted.

package/src/runtime/agent/orchestrator/providers/antigravity-response.mjs

@@ -10,6 +10,17 @@ import { traceAgentUsage } from '../agent-trace.mjs';
 import { createProviderReplay } from './lib/provider-replay.mjs';
 import { parseToolCalls, collectGeminiGroundingSources, parseGeminiTextPartMetadata } from './gemini-schema.mjs';
 
+// Pure usageMetadata normalization shared by the success path and a failed
+// stream's partialUsage.
+export function normalizeAntigravityUsage(um) {
+  const inputTokens = um.promptTokenCount || um.prompt_token_count || 0;
+  const cachedTokens = um.cachedContentTokenCount || um.cached_content_token_count || 0;
+  const outputTokens =
+    (um.candidatesTokenCount || um.candidates_token_count || 0) +
+    (um.thoughtsTokenCount || um.thoughts_token_count || 0);
+  return { inputTokens, outputTokens, cachedTokens, promptTokens: inputTokens, raw: um };
+}
+
 /**
  * @param {object} deps
  * @param {object} deps.response  final unwrapped Gemini-shaped payload
@@ -48,31 +59,11 @@ export function finalizeAntigravityTurn({ response, collector, useModel, opts, o
   const finishReason =
     collector.terminalFailure || candidate?.finishReason || (promptBlockReason ? `PROMPT_${promptBlockReason}` : null);
   const normalizedFinish = String(finishReason || '').replace(/^FINISH_REASON_/, '');
-  if (finishReason && normalizedFinish !== 'STOP') {
-    throw Object.assign(new Error(`Antigravity response incomplete: finishReason=${finishReason}`), {
-      name: 'ProviderIncompleteError',
-      code: 'PROVIDER_INCOMPLETE',
-      providerIncomplete: true,
-      finishReason,
-      partialContent: content,
-      partialToolCalls: toolCalls,
-      partialProviderReplay: providerReplay,
-      providerMetadata,
-      model: useModel,
-      rawUsage: response.usageMetadata || null,
-      ...(collector.emittedToolCount ? { emittedToolCall: true, unsafeToRetry: true } : {}),
-    });
-  }
-
   const um = response.usageMetadata || null;
   let usage;
   if (um) {
-    const inputTokens = um.promptTokenCount || um.prompt_token_count || 0;
-    const cachedTokens = um.cachedContentTokenCount || um.cached_content_token_count || 0;
-    const outputTokens =
-      (um.candidatesTokenCount || um.candidates_token_count || 0) +
-      (um.thoughtsTokenCount || um.thoughts_token_count || 0);
-    usage = { inputTokens, outputTokens, cachedTokens, promptTokens: inputTokens, raw: um };
+    usage = normalizeAntigravityUsage(um);
+    const { inputTokens, outputTokens, cachedTokens } = usage;
     traceAgentUsage({
       sessionId: opts.sessionId || opts.session?.id || null,
       iteration: Number.isFinite(Number(opts.iteration)) ? Number(opts.iteration) : null,
@@ -88,6 +79,23 @@ export function finalizeAntigravityTurn({ response, collector, useModel, opts, o
     });
   }
 
+  if (finishReason && normalizedFinish !== 'STOP') {
+    throw Object.assign(new Error(`Antigravity response incomplete: finishReason=${finishReason}`), {
+      name: 'ProviderIncompleteError',
+      code: 'PROVIDER_INCOMPLETE',
+      providerIncomplete: true,
+      finishReason,
+      partialContent: content,
+      partialToolCalls: toolCalls,
+      partialProviderReplay: providerReplay,
+      providerMetadata,
+      model: useModel,
+      rawUsage: response.usageMetadata || null,
+      ...(usage ? { partialUsage: usage, partialModel: useModel } : {}),
+      ...(collector.emittedToolCount ? { emittedToolCall: true, unsafeToRetry: true } : {}),
+    });
+  }
+
   return {
     content,
     model: useModel,

package/src/runtime/agent/orchestrator/providers/antigravity-stream.mjs

@@ -13,6 +13,7 @@
 import { createProviderReplay } from './lib/provider-replay.mjs';
 import { createGeminiTextLeakGuard, consumeGeminiRestStreamResponse } from './gemini-stream.mjs';
 import { parseToolCalls, emitGeminiToolCalls } from './gemini-schema.mjs';
+import { normalizeAntigravityUsage } from './antigravity-response.mjs';
 
 // A retired wire id answers with one plain-text notice and no finishReason.
 // That is a terminal answer about the model, not a truncated stream.
@@ -118,6 +119,7 @@ export function createAntigravityStreamCollector({ tools, useModel, onToolCall,
         onChunk,
         textLeakGuard,
         label: 'Antigravity streamGenerateContent',
+        failureUsage: { model: useModel, normalize: normalizeAntigravityUsage },
         // Cloud Code Assist nests the Gemini payload under
         // `response`; in-band error events stay top level.
         unwrapChunk: (chunk) => (chunk && typeof chunk === 'object' && chunk.response ? chunk.response : chunk),

package/src/runtime/agent/orchestrator/providers/auto-effort.mjs

@@ -25,18 +25,36 @@ export function autoEffortBase(chosen) {
 
 export const AUTO_EFFORT_MODES = Object.freeze(['off', 'observe', 'on']);
 
-// Below this top-class probability the judge is unsure and the default stays.
-export const AUTO_EFFORT_MIN_CONFIDENCE = 0.4;
-// xhigh costs far more than high, so "very hard" needs a firmer judge;
-// below this it is treated as "hard". 0.65 minimised the eval cost with a
-// false xhigh weighted three times a missed one.
-export const AUTO_EFFORT_VERY_HARD_CONFIDENCE = 0.65;
-
 // The judge rates four levels, each one ladder step from the base: easy -1
 // (low), normal 0 (medium), hard +1 (high), very hard +2 (xhigh).
 export const AUTO_EFFORT_LEVELS = Object.freeze(['easy', 'normal', 'hard', 'very hard']);
 const STEP_OF_LEVEL = [-1, 0, 1, 2];
 
+// The chosen level minimises the expected cost under the judge distribution.
+// A miss costs one per level, plus extra for an opposite call and for a
+// needless "very hard" (xhigh). Opposite calls are asymmetric: "easy" for a
+// hard turn degrades the answer, "hard" for an easy turn only costs tokens.
+// On the held-out test splits the heavier under-call cost cut hard-as-easy
+// calls by a third (20 -> 13 of 7,180) for -0.2 points of exact accuracy.
+export const AUTO_EFFORT_UNDER_OPPOSITE_COST = 3;
+export const AUTO_EFFORT_OVER_OPPOSITE_COST = 1;
+export const AUTO_EFFORT_FALSE_VERY_HARD_COST = 1;
+// Ties keep the default first, then the cheaper side.
+const TIE_ORDER = [1, 0, 2, 3];
+
+function expectedCost(values, level) {
+  let cost = 0;
+  values.forEach((p, actual) => {
+    cost +=
+      p *
+      (Math.abs(level - actual) +
+        (level === 0 && actual >= 2 ? AUTO_EFFORT_UNDER_OPPOSITE_COST : 0) +
+        (actual === 0 && level >= 2 ? AUTO_EFFORT_OVER_OPPOSITE_COST : 0) +
+        (level === 3 && actual < 3 ? AUTO_EFFORT_FALSE_VERY_HARD_COST : 0));
+  });
+  return cost;
+}
+
 export function normalizeAutoEffortMode(value) {
   const mode = String(value ?? '')
     .trim()
@@ -57,9 +75,9 @@ export function judgedStep(probs) {
   const values = Array.isArray(probs) && probs.length === AUTO_EFFORT_LEVELS.length ? probs.map(Number) : null;
   if (!values || values.some((value) => !Number.isFinite(value))) return { step: 0, level: null, confidence: 0 };
   const confidence = Math.max(...values);
-  if (confidence < AUTO_EFFORT_MIN_CONFIDENCE) return { step: 0, level: null, confidence };
-  let level = values.indexOf(confidence);
-  if (level === 3 && confidence < AUTO_EFFORT_VERY_HARD_CONFIDENCE) level = 2;
+  let level = TIE_ORDER[0];
+  for (const candidate of TIE_ORDER)
+    if (expectedCost(values, candidate) < expectedCost(values, level) - 1e-12) level = candidate;
   return { step: STEP_OF_LEVEL[level], level, confidence };
 }