mixdog 1.0.12 → 1.1.0

package/src/defaults/skills/setup/references/surfaces.md

@@ -36,8 +36,11 @@ An attached Desktop or TUI may navigate and return `opened:true`.
 - Settings → General: profile, Web Search exposure, display language, theme,
   side panels, and notifications.
 - Settings → Context: auto-compact and auto-clear.
-- Settings → Output style: output style selection.
-- Settings → Providers: API-key, OAuth, local providers, and usage sign-in.
+- Settings → Output style: output style selection, plus the desktop-only
+  "Expand tool activity" choice (collapsed / commands and edits / everything),
+  saved per device; Ctrl+O toggles everything open for the current window.
+- Settings → Providers: API-key, OAuth, custom provider registration, local
+  providers, and usage sign-in.
 - Extensions → Plugin → Git & GitHub: Git/GitHub CLI installation and connection.
 - Settings → Connection: web-app pairing and linked devices.
 - Settings → System: update, keep-awake, run in background after the window
@@ -53,11 +56,12 @@ the user to Desktop.
 
 ## Desktop-backed settings
 
-Setup can read and change Desktop appearance, keep-awake, run in background,
-usage pin, activity rail pins, Computer observe-only, Browser/Computer/voice installation and
-toggles, Projects, and linked-device revocation through the attached
-Desktop. A receipt identifies `scope:desktop-host`; appearance is not applied
-to the paired browser. No Desktop claimant means no confirmed change.
+Setup can read and change Desktop appearance (including markdown default
+view, link previews, and tool activity expansion), keep-awake, run in
+background, turn-completion notifications, notification volume (Windows),
+usage pin, activity rail pins, Computer observe-only, Browser/Computer
+installation and toggles, Projects, and linked-device revocation through the
+attached Desktop. A receipt identifies `scope:desktop-host`.
 
 Computer observe-only and background Memory cycles (`set_recap_enabled`)
 have no settings control in either app; setup is their only supported route. Usage pin is the pin toggle on the activity rail usage card.
@@ -74,12 +78,10 @@ The setup tool does not mutate:
 - web-app pairing credentials and OS permission dialogs;
 - TUI-local theme palettes (use `/theme`; Desktop themes are separate).
 
-Use `open` where a target exists, then let the user act. Never simulate a
-missing or denied operation by editing storage or switching surfaces.
+Use `open` where a target exists, then let the user act.
 
 ## TUI notes
 
 The TUI settings hub exposes system shell in addition to common settings.
 Desktop-host actions need the Desktop app; opening the TUI is not a substitute.
-Use the schema and `status capabilities` as the supported API boundary.
 

package/src/lib/rules-builder.cjs

@@ -366,7 +366,7 @@ function buildLeadRoleContent({ PLUGIN_ROOT, includeLeadBrief = true }) {
   const RULES_DIR = path.join(PLUGIN_ROOT, 'rules');
   const lead = readOptional(path.join(RULES_DIR, 'lead', 'LEAD.md'));
   if (!lead) return '';
-  // Delegation-free workflows (Solo, headless) never expose the `agent` tool,
+  // Delegation-free sessions (headless, no delegatable agents) never expose the `agent` tool,
   // so Lead guidance marked `<!-- tools: agent -->` (briefing, completion
   // notifications) is dropped there and kept verbatim for delegating workflows.
   return omitToolRoutes(lead, includeLeadBrief ? [] : ['agent']);

package/src/runtime/agent/orchestrator/agent-runtime/cache-strategy.mjs

@@ -30,7 +30,9 @@
  * Non-breakpoint providers:
  *   - OpenAI (public): prompt_cache_key plus model-specific retention when
  *     response storage is enabled (30m cache options or 24h retention).
- *   - OpenAI OAuth: prompt_cache_key only (server in-memory 5-10min)
+ *   - OpenAI OAuth: prompt_cache_key only; the Codex backend keeps the
+ *     prompt cache at least 30 minutes on GPT-5.6+ models, refreshed on use
+ *     (the openai-oauth auto-clear window matches it)
  *   - Gemini: provider-managed explicit cachedContents with 5m default TTL, plus
  *     implicit caching as a fallback when the prefix is below cache minimums.
  *   - xAI: conversation routing for chat; Responses omits prompt_cache_key

package/src/runtime/agent/orchestrator/agent-runtime/session-builder.mjs

@@ -76,6 +76,8 @@ export function prepareAgentSession({
   schemaAllowedTools,
   sessionId,
   mcpScopeId,
+  contextPercent,
+  selectedContextWindow,
 }) {
   const effectivePermission = resolveAgentSessionPermission(agent, permission);
   // Pass cwd through verbatim — null is the fixed agent sentinel meaning
@@ -112,6 +114,8 @@ export function prepareAgentSession({
     compaction: compaction || undefined,
     mcpScopeId: mcpScopeId || null,
   };
+  if (contextPercent) sessionOpts.contextPercent = contextPercent;
+  if (selectedContextWindow) sessionOpts.selectedContextWindow = selectedContextWindow;
   if (agentTag) sessionOpts.agentTag = agentTag;
   if (effectivePermission) sessionOpts.permission = effectivePermission;
   if (permissionMode) sessionOpts.permissionMode = permissionMode;

package/src/runtime/agent/orchestrator/config-presets.d.mts

@@ -0,0 +1 @@
+export function withDefaultPresets(stored: unknown): unknown[];

package/src/runtime/agent/orchestrator/config-presets.mjs

@@ -1,4 +1,6 @@
 // Preset normalization and identity are independent of config storage.
+import { isDeepStrictEqual } from 'node:util';
+
 const ANTHROPIC_FAMILY_MODEL = Object.freeze({
   opus: 'claude-opus-4-8',
   sonnet: 'claude-sonnet-4-6',
@@ -64,6 +66,48 @@ export const DEFAULT_PRESETS = Object.freeze([
   }),
 ]);
 
+const DEFAULT_PRESET_BY_ID = new Map(DEFAULT_PRESETS.map((preset) => [preset.id, preset]));
+
+/** Effective presets: the stored entries in their stored order, then the
+ *  shipped presets missing from storage in shipped order. */
+export function withDefaultPresets(stored) {
+  const list = Array.isArray(stored) ? stored : [];
+  const present = new Set(list.map(presetKey));
+  return [...list, ...DEFAULT_PRESETS.filter((preset) => !present.has(preset.id)).map((preset) => ({ ...preset }))];
+}
+
+/** Stored form of `presets`: only entries that differ from the shipped default of the same id. */
+export function presetsDelta(presets) {
+  return (Array.isArray(presets) ? presets : []).filter((preset) => {
+    const shipped = DEFAULT_PRESET_BY_ID.get(presetKey(preset));
+    return !shipped || !isDeepStrictEqual(normalizePreset(preset), { ...shipped });
+  });
+}
+
+/** Stored form of `maintenance`: only slots that differ from the shipped route. */
+export function maintenanceDelta(maintenance) {
+  const source = maintenance && typeof maintenance === 'object' ? maintenance : {};
+  return Object.fromEntries(
+    Object.entries(source).filter(([slot, route]) => !isDeepStrictEqual(route, DEFAULT_MAINTENANCE[slot]))
+  );
+}
+
+/** Drop shipped presets and maintenance routes that equal their default; loadConfig restores them. */
+export function stripStoredRouteDefaults(agent) {
+  const next = { ...agent };
+  if (Object.hasOwn(next, 'presets')) {
+    const presets = presetsDelta(next.presets);
+    if (presets.length) next.presets = presets;
+    else delete next.presets;
+  }
+  if (Object.hasOwn(next, 'maintenance')) {
+    const maintenance = maintenanceDelta(next.maintenance);
+    if (Object.keys(maintenance).length) next.maintenance = maintenance;
+    else delete next.maintenance;
+  }
+  return next;
+}
+
 const AGENT_PROVIDER_ALIASES = Object.freeze({
   'openai-api': 'openai',
   'gemini-api': 'gemini',

package/src/runtime/agent/orchestrator/config-providers-merge.mjs

@@ -50,9 +50,17 @@ export function mergeStoredProviders({ raw, defaults, includeSecrets }) {
     }
   }
   // Custom providers: the keychain account is the generated custom-<uuid> id.
+  // A keyless (auth 'none') custom provider never carries a key, not even a
+  // hand-edited plaintext one.
+  for (const [name, val] of Object.entries(mergedProviders)) {
+    if (val?.type === 'custom' && val.auth === 'none' && Object.hasOwn(val, 'apiKey')) {
+      const { apiKey: _dropped, ...rest } = val;
+      mergedProviders[name] = rest;
+    }
+  }
   if (includeSecrets) {
     for (const [name, val] of Object.entries(mergedProviders)) {
-      if (val?.type !== 'custom' || !name.startsWith('custom-')) continue;
+      if (val?.type !== 'custom' || !name.startsWith('custom-') || val.auth === 'none') continue;
       const kc = getAgentApiKey(name);
       if (kc) mergedProviders[name] = { ...val, apiKey: kc, enabled: raw.providers?.[name]?.enabled !== false };
     }

package/src/runtime/agent/orchestrator/config.mjs

@@ -4,9 +4,29 @@ import { mergeStoredProviders } from './config-providers-merge.mjs';
 import { normalizeExtensionScopes } from '../../shared/extension-scopes.mjs';
 import { applyConfigPatch, diffConfig } from '../../shared/config-patch.mjs';
 import { normalizeWorkflowSelection } from '../../shared/orchestration.mjs';
-import { DEFAULT_DISABLED_AGENT_IDS, canonicalizeAgentRouteStorage } from '../../shared/agent-route-config.mjs';
+import {
+  DEFAULT_DISABLED_AGENT_ROSTER,
+  canonicalizeAgentRouteStorage,
+  disabledAgentDelta,
+  disabledAgentIds,
+  effectiveDisabledAgents,
+  withEffectiveDisabledAgents,
+  withStoredDisabledAgents,
+} from '../../shared/agent-route-config.mjs';
+import {
+  DEFAULTS_VERSION,
+  ensureDefaultsSeparated,
+  storedDefaultsVersion,
+  stripAgentSectionDefaults,
+} from '../../shared/defaults-separation.mjs';
 import profileConfig from '../../shared/profile-config.cjs';
-import { DEFAULT_MAINTENANCE, DEFAULT_PRESETS, normalizePreset } from './config-presets.mjs';
+import {
+  DEFAULT_MAINTENANCE,
+  DEFAULT_PRESETS,
+  normalizePreset,
+  stripStoredRouteDefaults,
+  withDefaultPresets,
+} from './config-presets.mjs';
 import {
   agentConfigStorageNeedsMigration,
   canonicalizeAgentStorage,
@@ -100,11 +120,10 @@ export function buildDefaultConfig(options = {}) {
   providers['mixdog-local'] = { enabled: false };
   return {
     providers,
-    // The Maintainer also starts off: background upkeep spends model calls, so
-    // it runs only once the user turns it on and picks its model.
-    disabledAgents: [...DEFAULT_DISABLED_AGENT_IDS, 'maintainer'],
+    // Effective roster; the file stores only the user's delta against it.
+    disabledAgents: [...DEFAULT_DISABLED_AGENT_ROSTER],
     workflow: { active: 'default' },
-    orchestrationMode: 'none',
+    orchestrationMode: 'balanced',
   };
 }
 
@@ -170,9 +189,17 @@ function normalizeRecapConfig(rawRecap) {
 
 export function loadConfig(options = {}) {
   const includeSecrets = options.secrets !== false;
+  try {
+    ensureDefaultsSeparated({ stripRouteDefaults: separateStoredAgent });
+  } catch (err) {
+    process.stderr.write(`[config] defaults separation failed: ${err?.message}\n`);
+  }
   const sectionRaw = readSection('agent');
   if (hasKeys(sectionRaw)) {
     try {
+      // A file that could not be separated still holds the legacy form:
+      // before version 1 `disabledAgents` is the full list, not a delta.
+      const legacyDisabledAgents = storedDefaultsVersion() < 1;
       let raw = sectionRaw;
       const storageNeedsMigration = agentConfigStorageNeedsMigration(raw);
       raw = canonicalizeAgentStorage(raw);
@@ -206,7 +233,7 @@ export function loadConfig(options = {}) {
       const loaded = canonicalizeAgentRouteStorage({
         providers: mergedProviders,
         mcpServers,
-        presets: normalizedPresets,
+        presets: withDefaultPresets(normalizedPresets),
         default: raw.default || null,
         maintenance: { ...DEFAULT_MAINTENANCE, ...normalizedMaint },
         workflowRoutes,
@@ -214,9 +241,10 @@ export function loadConfig(options = {}) {
         modelSettings,
         onboarding: raw.onboarding && typeof raw.onboarding === 'object' ? raw.onboarding : {},
         agents: raw.agents && typeof raw.agents === 'object' ? raw.agents : {},
-        // Explicit "off" roster. canonicalizeAgentRouteStorage normalizes
-        // and drops it when empty, so an all-enabled config stays clean.
-        disabledAgents: Array.isArray(raw.disabledAgents) ? raw.disabledAgents : [],
+        // Effective "off" roster = code defaults + the stored user delta.
+        // canonicalizeAgentRouteStorage drops it when empty.
+        disabledAgents: legacyDisabledAgents ? disabledAgentIds(raw) : effectiveDisabledAgents(raw),
+        ...(raw.memoryTools && typeof raw.memoryTools === 'object' ? { memoryTools: { ...raw.memoryTools } } : {}),
         ...normalizeWorkflowSelection(raw),
         profile: normalizeProfileConfig(raw.profile),
         skills: normalizeSkillsConfig(raw.skills),
@@ -241,7 +269,7 @@ export function loadConfig(options = {}) {
           // Retired cross-section fields are no longer migrated by
           // the shared config layer. Normalize only the locked
           // current section; stale reads must not undo deletions.
-          persistAgentConfig(canonicalizeAgentStorage);
+          persistAgentConfig((current) => storedAgentForm(canonicalizeAgentStorage(current)));
         } catch (err) {
           process.stderr.write(`[config] persist canonical agent config failed: ${err?.message}\n`);
         }
@@ -263,7 +291,7 @@ export function loadConfig(options = {}) {
     onboarding: {},
     agents: {},
     workflow: { active: 'default' },
-    orchestrationMode: 'none',
+    orchestrationMode: 'balanced',
     profile: normalizeProfileConfig(null),
     skills: normalizeSkillsConfig(null),
     extensionScopes: normalizeExtensionScopes(null),
@@ -383,28 +411,81 @@ function buildAgentSaveBuilder(config) {
     // Developer options (developer-options.mjs); an empty set stays absent.
     if (Object.keys(developer).length) next.developer = developer;
     else if (Object.hasOwn(config, 'developer')) delete next.developer;
-    if (canonicalRoutes.disabledAgents) {
-      next.disabledAgents = canonicalRoutes.disabledAgents;
-    } else {
-      delete next.disabledAgents;
-    }
+    // Only the user's delta against the default roster is stored.
+    delete next.disabledAgents;
+    delete next.enabledAgents;
+    // An unseparated file keeps the legacy full list until the pass succeeds.
+    if (storedDefaultsVersion() < 1) {
+      if (canonicalRoutes.disabledAgents?.length) next.disabledAgents = canonicalRoutes.disabledAgents;
+    } else Object.assign(next, disabledAgentDelta(canonicalRoutes.disabledAgents));
+    if (config.memoryTools && typeof config.memoryTools === 'object') next.memoryTools = { ...config.memoryTools };
+    else delete next.memoryTools;
     delete next.workflowRoutes;
-    return removeRetiredAgentFields(next);
+    // Defaults live in code: values equal to the current default are not stored.
+    return storedAgentForm(removeRetiredAgentFields(next));
   };
 }
+
+/** A numeric `default` is a preset index; store the preset id it points at (index into the effective list). */
+function resolveNumericDefault(agent) {
+  const value = agent?.default;
+  // The loader reads a falsy default (including 0) as "none".
+  if (!value || !(typeof value === 'number' || /^\d+$/.test(String(value)))) return agent;
+  const stored = (Array.isArray(agent.presets) ? agent.presets : [])
+    .map((preset) => normalizePreset(preset))
+    .filter(Boolean)
+    .filter((preset) => preset.id !== 'workflow-search');
+  const { presets } = canonicalizeAgentRouteStorage({ presets: withDefaultPresets(stored) });
+  const preset = presets[Number(value)];
+  return preset ? { ...agent, default: preset.id } : agent;
+}
+
+/** The agent section as stored: defaults dropped. Route defaults go only once the file is separated. */
+function storedAgentForm(agent) {
+  const stripped = stripAgentSectionDefaults(resolveNumericDefault(agent));
+  return storedDefaultsVersion() >= DEFAULTS_VERSION ? stripStoredRouteDefaults(stripped) : stripped;
+}
+
+/** Separation pass: normalize the compared sections first, then drop every default. */
+function separateStoredAgent(agent) {
+  const full = canonicalizeAgentStorage(agent);
+  const next = { ...agent };
+  for (const key of ['autoClear', 'compaction', 'modules']) {
+    if (!Object.hasOwn(agent, key)) continue;
+    if (full[key] === undefined) delete next[key];
+    else next[key] = full[key];
+  }
+  return stripStoredRouteDefaults(stripAgentSectionDefaults(resolveNumericDefault(next)));
+}
+
+/** Patch the stored section; unseparated data keeps its form, a numeric default becomes an id first. */
+function applyStoredPatch(current, changes) {
+  const base = resolveNumericDefault(current);
+  if (storedDefaultsVersion() >= 1) return applyConfigPatch(base, changes);
+  const delta = withStoredDisabledAgents({ ...base, disabledAgents: disabledAgentIds(base) });
+  return withEffectiveDisabledAgents(applyConfigPatch(delta, changes));
+}
 // Diff the persisted schema, not runtime defaults, aliases, or secret overlays.
+// Patches always speak the delta domain; an unseparated file's full list is
+// converted here and back in applyStoredPatch.
+function patchForm(agent) {
+  if (storedDefaultsVersion() >= 1) return agent;
+  const { disabledAgents, ...rest } = agent;
+  return { ...rest, ...disabledAgentDelta(disabledAgents || []) };
+}
+
 export function createConfigPatch(before, after) {
-  return diffConfig(buildAgentSaveBuilder(before)({}), buildAgentSaveBuilder(after)({}));
+  return diffConfig(patchForm(buildAgentSaveBuilder(before)({})), patchForm(buildAgentSaveBuilder(after)({})));
 }
 
 export function saveConfigPatch(changes) {
   if (!changes.length) return;
-  persistAgentConfig((current) => applyConfigPatch(current, changes));
+  persistAgentConfig((current) => applyStoredPatch(current, changes));
 }
 
 export async function saveConfigPatchAsync(changes) {
   if (!changes.length) return;
-  await persistAgentConfigAsync((current) => applyConfigPatch(current, changes));
+  await persistAgentConfigAsync((current) => applyStoredPatch(current, changes));
 }
 
 // Whole-section replacement is reserved for explicit full saves. Read/edit/save

package/src/runtime/agent/orchestrator/providers/account-pool.mjs

@@ -6,10 +6,11 @@ import {
   changeProviderAccounts,
   blockProviderAccount,
   providerAccountExhausted,
+  providerAccountsResetAt,
 } from '../../../shared/provider-accounts.mjs';
 import { withProviderAccount, hasExplicitProviderAuthBinding } from '../../../shared/provider-auth-binding.mjs';
 import { retryAfterMsFromError, isExplicitUserAbortError, typedErrorCode } from './retry-classifier.mjs';
-import { fetchOAuthUsageSnapshot } from './oauth-usage.mjs';
+import { fetchOAuthUsageSnapshot, readCachedOAuthUsageSnapshot } from './oauth-usage.mjs';
 
 // Only an explicit quota refusal advances the roster; a generic 429, auth
 // refusal, policy denial or transport failure retains its existing recovery.
@@ -49,7 +50,7 @@ export function resetAccountProbePacing() {
 async function probeRefusedAccounts(providerName, pool, model, account) {
   const now = Date.now();
   const due = pool.accounts
-    .filter((row) => providerAccountExhausted(row, now, model))
+    .filter((row) => providerAccountExhausted(row, now, model, { useCredits: pool.useCredits === true }))
     .filter((row) => now - (lastProbeAt.get(`${providerName}:${row.id}`) || 0) >= PROBE_INTERVAL_MS)
     .sort((a, b) => (a.usage?.checkedAt || 0) - (b.usage?.checkedAt || 0));
   if (!due.length) return false;
@@ -64,12 +65,29 @@ async function probeRefusedAccounts(providerName, pool, model, account) {
   return true;
 }
 
-function accountsExhaustedError() {
-  const error = new Error('All connected accounts have exhausted their quota. Check account usage and reset times.');
+function accountsExhaustedError(useCredits) {
+  const error = new Error(
+    useCredits
+      ? 'All connected accounts have exhausted their quota. Check account usage and reset times.'
+      : 'The plan limit is reached and credit use is off. Turn on credit use or wait for the limit to reset.'
+  );
   error.code = 'provider_accounts_exhausted';
   return error;
 }
 
+// Structured proof that the send ended because no account can serve `model`
+// (not merely because a generic 429 or a stopped loop surfaced an error).
+function quotaExhausted(error, providerName, model, rows, options = {}) {
+  if (error && typeof error === 'object') {
+    error.quotaExhausted = {
+      provider: providerName,
+      model: String(model || ''),
+      resetAt: providerAccountsResetAt(rows, Date.now(), model, options),
+    };
+  }
+  return error;
+}
+
 // The send bound to one account: output callbacks are observed even when the
 // caller does not subscribe, and account-bound connection/delta state stays
 // apart without changing the visible Mixdog session, so no stale server state
@@ -114,18 +132,22 @@ function commitFallbackAccount(providerName, pool, row) {
 async function accountQuotaExhausted(providerName, row, model, error, account) {
   const status = Number(error?.status || error?.httpStatus || error?.response?.status || 0);
   const delay = retryAfterMsFromError(error);
-  let exhausted = isAccountQuotaError(error) || (status === 429 && delay > QUOTA_WINDOW_RETRY_AFTER_MS);
-  if (!exhausted && status === 429) {
+  const typed = isAccountQuotaError(error);
+  let exhausted = typed || (status === 429 && delay > QUOTA_WINDOW_RETRY_AFTER_MS);
+  // Proof of a spent quota: a typed quota refusal or an exhausted usage window
+  // (a long Retry-After alone only rotates the roster, it proves nothing).
+  let evidence = typed;
+  if (!typed && status === 429) {
     await fetchOAuthUsageSnapshot({ provider: providerName, accountId: row.id }, account(row.id), () => {}, {
       force: true,
     });
-    exhausted = providerAccountExhausted(
-      readProviderAccountPool(providerName).accounts.find((entry) => entry.id === row.id),
-      Date.now(),
-      model
-    );
+    const pool = readProviderAccountPool(providerName);
+    const entry = pool.accounts.find((item) => item.id === row.id);
+    const options = { useCredits: pool.useCredits === true };
+    evidence = providerAccountExhausted({ ...entry, blockedUntil: 0 }, Date.now(), model, options);
+    exhausted = exhausted || evidence || providerAccountExhausted(entry, Date.now(), model, options);
   }
-  return { exhausted, delay };
+  return { exhausted, delay, evidence };
 }
 
 // The pool's send: walks the eligible accounts until one answers, blocking
@@ -135,10 +157,43 @@ function poolSend(providerName, account) {
     const attempted = new Set();
     let lastError;
     let probed = false;
+    const evidenced = new Set();
+    // Mark `error` only when every account in `ids` (default: the roster) is
+    // exhausted with quota evidence: observed in this send, or a full window.
+    const markExhausted = (error, ids) => {
+      const pool = readProviderAccountPool(providerName);
+      // Auto switching off: the eligible set is the selected account alone.
+      const scope = ids || (pool.auto === false ? [pool.selectedId] : null);
+      const rows = scope ? pool.accounts.filter((entry) => scope.includes(entry.id)) : pool.accounts;
+      const opts = { useCredits: pool.useCredits === true };
+      const now = Date.now();
+      const all =
+        rows.length > 0 &&
+        rows.every((entry) =>
+          providerAccountExhausted(
+            evidenced.has(entry.id) || entry.blockedQuota === true ? entry : { ...entry, blockedUntil: 0 },
+            now,
+            model,
+            opts
+          )
+        );
+      return all ? quotaExhausted(error, providerName, model, rows, opts) : error;
+    };
     while (attempted.size < 20) {
       options.signal?.throwIfAborted();
       const pool = readProviderAccountPool(providerName);
-      if (!pool.accounts.length) return account('default').send(messages, model, tools, options);
+      if (!pool.accounts.length) {
+        if (pool.useCredits !== true) {
+          const stored = readCachedOAuthUsageSnapshot({ provider: providerName, model: '' });
+          if (stored?.quotaWindows?.length) {
+            const row = { usage: { windows: stored.quotaWindows, checkedAt: stored.cachedAt } };
+            if (providerAccountExhausted(row, Date.now(), model)) {
+              throw quotaExhausted(accountsExhaustedError(false), providerName, model, [row]);
+            }
+          }
+        }
+        return account('default').send(messages, model, tools, options);
+      }
       const row = chooseProviderAccount(pool, attempted, Date.now(), model);
       if (!row) {
         // Once per send: a refusal built on a stale meter must not outlive the
@@ -148,8 +203,7 @@ function poolSend(providerName, account) {
           probed = true;
           if (await probeRefusedAccounts(providerName, pool, model, account)) continue;
         }
-        if (lastError) throw lastError;
-        throw accountsExhaustedError();
+        throw markExhausted(lastError || accountsExhaustedError(pool.useCredits === true));
       }
       attempted.add(row.id);
       const bound = boundAccountSend(providerName, row, messages, options);
@@ -187,28 +241,25 @@ function poolSend(providerName, account) {
           options.onStageChange?.('reconnecting', { message: 'Sign-in expired — switching to the next account' });
           continue;
         }
-        const { exhausted, delay } = await accountQuotaExhausted(providerName, row, model, error, account);
+        const { exhausted, delay, evidence } = await accountQuotaExhausted(providerName, row, model, error, account);
         if (options.signal?.aborted || !exhausted) throw error;
+        if (evidence) evidenced.add(row.id);
         blockProviderAccount(
           providerName,
           row.id,
           Date.now() + (delay > 0 ? delay : 5 * 60_000),
           model,
-          delay > 0 ? 'retry-after' : 'inferred'
+          delay > 0 ? 'retry-after' : 'inferred',
+          { quota: evidence === true }
         );
-        if (
-          pool.auto === false ||
-          bound.emitted() ||
-          error.unsafeToRetry ||
-          error.liveTextEmitted ||
-          error.emittedToolCall
-        )
-          throw error;
+        if (bound.emitted() || error.unsafeToRetry || error.liveTextEmitted || error.emittedToolCall) throw error;
+        // Auto switching off: the eligible set is the selected account alone.
+        if (pool.auto === false) throw markExhausted(error, [row.id]);
         lastError = error;
         options.onStageChange?.('reconnecting', { message: 'Quota exhausted — switching to the next account' });
       }
     }
-    throw lastError || new Error('Provider account attempts exhausted.');
+    throw markExhausted(lastError || new Error('Provider account attempts exhausted.'));
   };
 }
 

package/src/runtime/agent/orchestrator/providers/anthropic-api-request.mjs

@@ -14,6 +14,7 @@ import { buildAnthropicBetaHeaders, supportsAnthropicFastMode } from './anthropi
 import { applyAnthropicServerFallback } from './anthropic-server-fallback.mjs';
 import { fastModeAvailable } from './anthropic-fast-mode.mjs';
 import { applyAnthropicEffortToBody, shouldIncludeEffortBeta } from './anthropic-effort.mjs';
+import { isCustomProviderName, resolveCustomReasoning } from './custom-reasoning.mjs';
 import {
   applyAnthropicCacheMarkers,
   clampAnthropicThinkingBudget as clampThinkingBudgetTokens,
@@ -44,7 +45,20 @@ import {
  * @param {boolean} deps.fastModeLatched  the provider's sticky fast-mode beta latch
  * @returns {Promise<{ params: object, requestHeaders: object|null, knownToolNames: Set<string>, fastModeLatched: boolean }>}
  */
-export async function buildAnthropicApiRequest({ name, config, messages, useModel, tools, opts, fastModeLatched }) {
+export async function buildAnthropicApiRequest({
+  name,
+  config,
+  messages,
+  useModel,
+  tools,
+  opts,
+  fastModeLatched,
+  modelInfo = null,
+}) {
+  // A user-defined provider's reasoning comes from its own model row only:
+  // the global by-model-id capability index and the Claude-id ladders are
+  // first-party knowledge and must not leak onto (or from) a custom endpoint.
+  const isCustom = isCustomProviderName(name);
   const maxTokens = resolveMaxTokens(useModel);
   const effortProjection = projectEffortConfiguration(messages, name, useModel, {
     ...config,
@@ -81,8 +95,10 @@ export async function buildAnthropicApiRequest({ name, config, messages, useMode
     system: systemBlocks.length ? systemBlocks : undefined,
     messages: await prepareAnthropicImages(anthropicMessages, { signal: opts.signal }),
   };
+  // Server-side fallback and fast mode are decided from Claude model ids:
+  // first-party knowledge, never applied to a custom endpoint.
   applyAnthropicServerFallback(params, useModel, {
-    enabled: config?.disableBetaHeaders !== true && opts.serverFallback !== false,
+    enabled: !isCustom && config?.disableBetaHeaders !== true && opts.serverFallback !== false,
   });
   if (requestTools.length) {
     // No cache_control on tools — the system BP covers tools via
@@ -105,18 +121,28 @@ export async function buildAnthropicApiRequest({ name, config, messages, useMode
       .map((t) => (t && typeof t.name === 'string' ? t.name : null))
       .filter(Boolean)
   );
-  applyAnthropicEffortToBody(params, {
-    model: useModel,
-    opts: effortProjection ? { ...opts, effort: effortProjection.initialEffort } : opts,
-    maxTokens,
-    clampThinkingBudgetTokens,
-    logTag: name,
-    progressUpdates: config?.disableBetaHeaders !== true,
-  });
+  if (isCustom) {
+    const { fields } = resolveCustomReasoning({
+      protocol: 'anthropic',
+      model: modelInfo,
+      effort: opts.effort ?? config?.reasoningEffort,
+    });
+    if (fields.thinking) params.thinking = fields.thinking;
+    if (fields.output_config) params.output_config = { ...(params.output_config || {}), ...fields.output_config };
+  } else {
+    applyAnthropicEffortToBody(params, {
+      model: useModel,
+      opts: effortProjection ? { ...opts, effort: effortProjection.initialEffort } : opts,
+      maxTokens,
+      clampThinkingBudgetTokens,
+      logTag: name,
+      progressUpdates: config?.disableBetaHeaders !== true,
+    });
+  }
   // Fast mode → speed: "fast" on models Anthropic marks as speed-capable.
   // Suppressed while the fast capacity pool is cooling down.
   let fastLatched = fastModeLatched;
-  if (opts.fast === true && supportsAnthropicFastMode(useModel) && fastModeAvailable()) {
+  if (!isCustom && opts.fast === true && supportsAnthropicFastMode(useModel) && fastModeAvailable()) {
     params.speed = 'fast';
     fastLatched = true;
   }
@@ -133,19 +159,23 @@ export async function buildAnthropicApiRequest({ name, config, messages, useMode
   // too — otherwise opencode-go's anthropic-compatible routing
   // (disableBetaHeaders:true) would still send beta strings that a
   // third-party endpoint may reject.
+  // A custom endpoint gets no first-party base betas; only those its own
+  // request body needs (row-driven effort, deferred tools).
   let betaHeaders = null;
   if (!config?.disableBetaHeaders) {
     const betas = [
       buildAnthropicBetaHeaders({
+        ...(isCustom ? { base: '' } : {}),
         fastMode: fastLatched,
         toolSearch: hasDeferredTools,
-        effort: shouldIncludeEffortBeta(useModel, opts),
+        // Custom: the beta follows the resolver's output, not the model id.
+        effort: isCustom ? Boolean(params.output_config?.effort) : shouldIncludeEffortBeta(useModel, opts),
         serverFallback: params.fallbacks === 'default',
         thinkingDisplayUpdates: params.thinking?.display === 'updates',
       }),
       ...(effortProjection ? [EFFORT_CONFIGURATION_BETA] : []),
-    ];
-    betaHeaders = { 'anthropic-beta': betas.join(',') };
+    ].filter(Boolean);
+    if (betas.length) betaHeaders = { 'anthropic-beta': betas.join(',') };
   }
   const requestHeaders =
     betaHeaders || opts.requestHeaders ? { ...(betaHeaders || {}), ...(opts.requestHeaders || {}) } : null;