mixdog 1.1.2 → 1.2.1

package/src/runtime/agent/orchestrator/providers/model-proxy-provider.mjs

@@ -0,0 +1,251 @@
+// Daemon-side stand-in for a provider in remote mode (MIXDOG_MODEL_PROXY=client).
+// It holds no credentials and opens no model connection: every call is handed
+// to the desktop client through the model proxy channel and executed by the
+// PC's own provider of the same name. The registry still wraps it with
+// admission scheduling and usage accounting, which then see the PC's result.
+import {
+  getModelProxyChannel,
+  ModelProxyUnavailableError,
+  splitModelProxySendOptions,
+  stripModelProxySecrets,
+} from './model-proxy-channel.mjs';
+import {
+  isFinalizedProviderRequestTools,
+  providerNativeToolPrefixCount,
+} from '../runtime-core/provider-request-tools.mjs';
+import {
+  attachmentTextForPart,
+  isAttachmentReference,
+  isPermanentAttachmentError,
+  readAttachmentBuffer,
+} from '../../../attachments/store.mjs';
+import { MAX_ATTACHMENT_BLOB_BYTES } from '../../../attachments/limits.mjs';
+
+/** Stored-attachment bytes one proxied call may carry inline: the store's own
+ *  single-blob ceiling. Newer messages are inlined first; a reference past the
+ *  budget stays a reference, which the PC lowers to its "unavailable" text. */
+export const MODEL_PROXY_INLINE_MAX_BYTES = MAX_ATTACHMENT_BLOB_BYTES;
+
+// A stored reference names a blob in THIS daemon's attachment store, which the
+// PC running the call cannot read. Each one travels as the inline part it was
+// stored from (image/file → base64 `data`, text → its text), so the PC lowers
+// exactly what a local daemon would.
+function inlineReference(part, budget) {
+  let buffer;
+  try {
+    buffer = readAttachmentBuffer(part);
+  } catch (error) {
+    if (isPermanentAttachmentError(error)) return part;
+    throw error;
+  }
+  if (buffer.length > budget.remaining) return part;
+  budget.remaining -= buffer.length;
+  const { attachmentRef: _ref, sizeBytes: _size, ...rest } = part;
+  if (part.type === 'text') {
+    const { textKind: _kind, filename: _name, mimeType: _mime, ...textRest } = rest;
+    return { ...textRest, type: 'text', text: attachmentTextForPart(part) };
+  }
+  return { ...rest, data: buffer.toString('base64') };
+}
+
+function inlinePart(part, budget) {
+  if (!part || typeof part !== 'object' || Array.isArray(part)) return part;
+  if (isAttachmentReference(part)) return inlineReference(part, budget);
+  if (Array.isArray(part.content)) {
+    const content = inlineParts(part.content, budget);
+    return content === part.content ? part : { ...part, content };
+  }
+  return part;
+}
+
+/** Newest last in a content list, so it is walked backwards for the budget. */
+function inlineParts(parts, budget) {
+  let out = null;
+  for (let index = parts.length - 1; index >= 0; index -= 1) {
+    const next = inlinePart(parts[index], budget);
+    if (next === parts[index]) continue;
+    out ??= [...parts];
+    out[index] = next;
+  }
+  return out ?? parts;
+}
+
+/** `messages` with every stored attachment reference replaced by its bytes. */
+export function inlineModelProxyAttachments(messages, { maxBytes = MODEL_PROXY_INLINE_MAX_BYTES } = {}) {
+  if (!Array.isArray(messages)) return messages;
+  const budget = { remaining: maxBytes };
+  let out = null;
+  for (let index = messages.length - 1; index >= 0; index -= 1) {
+    const message = messages[index];
+    if (!message || typeof message !== 'object' || message.content == null || typeof message.content === 'string') {
+      continue;
+    }
+    const content = Array.isArray(message.content)
+      ? inlineParts(message.content, budget)
+      : inlinePart(message.content, budget);
+    if (content === message.content) continue;
+    out ??= [...messages];
+    out[index] = { ...message, content };
+  }
+  return out ?? messages;
+}
+
+export class ModelProxyProvider {
+  #channel;
+  #modelInfo = new Map();
+
+  constructor(name, config = {}, channel = getModelProxyChannel()) {
+    this.name = name;
+    this.config = config || {};
+    this.#channel = channel;
+    // Adapter traits are reported by the PC's real instance.
+    if (typeof this.config.modelProxy?.nativePdf === 'boolean') this.nativePdf = this.config.modelProxy.nativePdf;
+  }
+
+  #call(method, fields = {}, options = {}) {
+    return this.#channel.request({ provider: this.name, method, ...fields }, options);
+  }
+
+  async send(messages, model, tools, sendOpts) {
+    const { options, callbacks } = splitModelProxySendOptions(sendOpts);
+    const finalized = isFinalizedProviderRequestTools(tools);
+    return this.#call(
+      'send',
+      {
+        model: model ?? null,
+        messages: inlineModelProxyAttachments(messages),
+        tools: Array.isArray(tools) ? tools : null,
+        toolsFinalized: finalized,
+        nativePrefixCount: finalized ? providerNativeToolPrefixCount(tools) : 0,
+        options,
+      },
+      { signal: sendOpts?.signal || null, callbacks }
+    );
+  }
+
+  #adoptCatalog(catalog) {
+    const models = Array.isArray(catalog?.models) ? catalog.models : [];
+    const info = catalog?.modelInfo && typeof catalog.modelInfo === 'object' ? catalog.modelInfo : {};
+    this.#modelInfo = new Map(Object.entries(info));
+    return models;
+  }
+
+  async listModels() {
+    return this.#adoptCatalog(await this.#call('listModels'));
+  }
+
+  async _refreshModelCache() {
+    return this.#adoptCatalog(await this.#call('refreshModels'));
+  }
+
+  async isAvailable() {
+    return (await this.#call('isAvailable')) === true;
+  }
+
+  getCachedModelInfo(model) {
+    return this.#modelInfo.get(String(model ?? '')) ?? null;
+  }
+}
+
+/** A proxy instance whose class carries the PC adapter's usage convention. */
+export function createModelProxyProvider(name, config = {}, channel = getModelProxyChannel()) {
+  const inputExcludesCache = config?.modelProxy?.inputExcludesCache;
+  if (typeof inputExcludesCache !== 'boolean') return new ModelProxyProvider(name, config, channel);
+  class BoundModelProxyProvider extends ModelProxyProvider {
+    static inputExcludesCache = inputExcludesCache;
+  }
+  return new BoundModelProxyProvider(name, config, channel);
+}
+
+// The PC's provider set (availability + non-secret config) changes only on a
+// PC-side sign-in or settings edit; a short cache keeps registry re-inits from
+// paying a client round trip each. The cache belongs to one client generation:
+// a reconnect (possibly from another PC) always asks again.
+const PROVIDER_CONFIG_TTL_MS = 15_000;
+/** How long a registry init waits for a client to connect and for its PC to
+ *  answer with a loaded provider registry. */
+export const MODEL_PROXY_CONFIG_WAIT_MS = 15_000;
+const CONFIG_RETRY_FIRST_MS = 250;
+const CONFIG_RETRY_MAX_MS = 2_000;
+let _providerConfigCache = null;
+let _providerConfigInFlight = null;
+
+/** A reply the registry may act on: the PC says its registry is loaded, or it
+ *  already names an enabled provider (a client that predates `ready`). An
+ *  empty or unready answer is never read as "everything disabled". */
+function providerConfigReady(reply, providers) {
+  // A loaded PC registry is authoritative, even when it has nothing enabled.
+  if (reply?.ready === true) return true;
+  if (reply?.ready === false) return false;
+  return Object.keys(providers).some((name) => providers[name]?.enabled === true);
+}
+
+const pause = (ms) =>
+  new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms);
+    timer.unref?.();
+  });
+
+export function loadModelProxyProviderConfig({
+  channel = getModelProxyChannel(),
+  now = Date.now,
+  waitMs = MODEL_PROXY_CONFIG_WAIT_MS,
+} = {}) {
+  const generation = channel.generation;
+  const cached = _providerConfigCache;
+  if (
+    cached &&
+    cached.channel === channel &&
+    cached.generation === generation &&
+    now() - cached.at < PROVIDER_CONFIG_TTL_MS
+  ) {
+    return Promise.resolve(cached.value);
+  }
+  const inFlight = _providerConfigInFlight;
+  if (inFlight && inFlight.channel === channel && inFlight.generation === generation) return inFlight.promise;
+  const promise = (async () => {
+    const deadline = Date.now() + waitMs;
+    let delay = CONFIG_RETRY_FIRST_MS;
+    let lastError = null;
+    for (;;) {
+      if (!channel.connected) {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0 || !(await channel.whenConnected(remaining))) {
+          throw lastError ?? new ModelProxyUnavailableError('no desktop client is connected to run model calls');
+        }
+      }
+      try {
+        const reply = await channel.request({ provider: '', method: 'providerConfig' });
+        const raw = reply?.providers && typeof reply.providers === 'object' ? reply.providers : {};
+        // Defense in depth: the PC already strips secrets before sending.
+        const value = stripModelProxySecrets(raw);
+        if (providerConfigReady(reply, value)) {
+          if (channel.generation === generation) {
+            _providerConfigCache = { at: now(), value, channel, generation };
+          }
+          return value;
+        }
+        lastError = new ModelProxyUnavailableError('the desktop client has not loaded its model providers yet');
+      } catch (error) {
+        // Only "no client / no answer yet" is worth waiting out.
+        if (error?.code !== 'MODEL_PROXY_UNAVAILABLE') throw error;
+        lastError = error;
+      }
+      if (Date.now() + delay > deadline) throw lastError;
+      await pause(delay);
+      delay = Math.min(delay * 2, CONFIG_RETRY_MAX_MS);
+    }
+  })();
+  const entry = { channel, generation, promise };
+  _providerConfigInFlight = entry;
+  const clear = () => {
+    if (_providerConfigInFlight === entry) _providerConfigInFlight = null;
+  };
+  promise.then(clear, clear);
+  return promise;
+}
+
+export function _resetModelProxyProviderConfigForTest() {
+  _providerConfigCache = null;
+  _providerConfigInFlight = null;
+}

package/src/runtime/agent/orchestrator/providers/muse-code-oauth-tokens.mjs

@@ -10,6 +10,7 @@ import { writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
 import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
 import { accountIdentityFields, scrubOAuthSecrets } from './lib/oauth-token-utils.mjs';
+import { modelProxyClientMode } from '../../../shared/model-proxy-mode.mjs';
 
 export const CLIENT_ID = '1031625952748946';
 export const DEVICE_AUTH_URL = 'https://auth.meta.com/oidc/device/authorization/';
@@ -44,6 +45,7 @@ const nonEmptyString = (value) => typeof value === 'string' && value.trim() !==
 export const isValidMuseCredentialDocument = (doc) => nonEmptyString(doc?.accessToken) && nonEmptyString(doc?.apiKey);
 
 export function loadTokens() {
+  if (modelProxyClientMode()) return null;
   const path = getOwnTokenPath();
   if (!existsSync(path)) return null;
   try {

package/src/runtime/agent/orchestrator/providers/muse-code-oauth.mjs

@@ -10,6 +10,15 @@ import { createHash } from 'node:crypto';
 import { noteErrorUsage } from './lib/note-error-usage.mjs';
 import { fileMtimeMs } from './lib/oauth-token-utils.mjs';
 import { OpenAICompatProvider, preloadOpenAICompatRuntime } from './openai-compat.mjs';
+import { getModelMetadataSync } from './model-catalog.mjs';
+import { makeModelCache } from './model-cache.mjs';
+import { PRICING_RATE_KEYS } from '../../../shared/llm/model-pricing-rates.mjs';
+import {
+  MUSE_DEFAULT_EFFORT_LEVELS as FIVE_LEVELS,
+  MUSE_SEED_IDS as SEED_MODELS,
+  MUSE_SPARK_MAX_OUTPUT as SPARK_MAX_OUTPUT,
+  museSeedRow,
+} from '../../../shared/llm/provider-seed-rosters.mjs';
 import {
   API_VERSION,
   MODEL_API_BASE_URL,
@@ -27,108 +36,63 @@ export {
 export { beginOAuthLogin, loginOAuth } from './muse-code-oauth-login.mjs';
 
 export const DEFAULT_MODEL = 'muse-spark-1.3';
-const FIVE_LEVELS = Object.freeze(['minimal', 'low', 'medium', 'high', 'xhigh']);
-const SIX_LEVELS = Object.freeze([...FIVE_LEVELS, 'max']);
 const effortOptions = (levels) => [{ type: 'effort', values: [...levels] }];
 // Image and voice generation ids are served by the same catalog but are not chat models.
 const NON_CHAT_MODEL_RE = /^muse-(image|voice)-/i;
-const SPARK_CONTEXT = 1_048_576;
-const SPARK_MAX_OUTPUT = 131_072;
-const STANDARD_COST = { inputCostPerM: 1.25, outputCostPerM: 4.25, cacheReadCostPerM: 0.15, cacheWriteCostPerM: 0 };
-const CONTRIBUTOR_COST = { inputCostPerM: 0.1, outputCostPerM: 0.2, cacheReadCostPerM: 0.002, cacheWriteCostPerM: 0 };
-
-// Seeded roster: the discovery endpoint lists bare ids, so limits, pricing and
-// the effort ladder come from here. Only the 1.3 revisions accept `max`.
-const SEEDS = Object.freeze({
-  'muse-spark-1.1': { name: 'Muse Spark 1.1', levels: FIVE_LEVELS, cost: STANDARD_COST },
-  'muse-spark-1.2': { name: 'Muse Spark 1.2', levels: FIVE_LEVELS, cost: STANDARD_COST },
-  'muse-spark-1.2-contributor': { name: 'Muse Spark 1.2 (C)', levels: FIVE_LEVELS, cost: CONTRIBUTOR_COST },
-  'muse-spark-1.3': { name: 'Muse Spark 1.3', levels: SIX_LEVELS, cost: STANDARD_COST },
-  'muse-spark-1.3-contributor': { name: 'Muse Spark 1.3 (C)', levels: SIX_LEVELS, cost: CONTRIBUTOR_COST },
-});
-const SEED_MODELS = Object.freeze(Object.keys(SEEDS));
-
-function seedRow(id) {
-  const seed = SEEDS[id];
-  return {
-    id,
-    name: seed.name,
-    provider: 'muse-code-oauth',
-    family: 'muse-spark',
-    contextWindow: SPARK_CONTEXT,
-    outputTokens: SPARK_MAX_OUTPUT,
-    supportsReasoning: true,
-    supportsVision: true,
-    supportsFunctionCalling: true,
-    reasoningLevels: [...seed.levels],
-    reasoningOptions: effortOptions(seed.levels),
-    ...seed.cost,
-  };
-}
-
-// Revisioned Spark ids the seed does not list inherit the newest seeded
-// revision of their tier (limits, vision, pricing) but take the five-level
-// ladder: only reviewed seeds advertise `max`.
-const SPARK_ID_RE = /^muse-spark-(\d+)\.(\d+)(?:\.(\d+))?(-contributor)?$/i;
 
-function revisionOf(id) {
-  const m = SPARK_ID_RE.exec(id);
-  return m ? [Number(m[1]), Number(m[2]), Number(m[3] || 0)] : null;
-}
+// The discovered roster (fields /models returned, never seed values) is
+// persisted so the shared sync lookup sees what listModels found.
+const museModelCache = makeModelCache({
+  fileName: 'muse-code-oauth-models.json',
+  ttlMs: 24 * 60 * 60 * 1000,
+  version: 1,
+});
 
-function compareRevision(a, b) {
-  for (let i = 0; i < 3; i += 1) if (a[i] !== b[i]) return a[i] - b[i];
-  return 0;
+// Row fields the shared metadata lookup resolves: live roster, models.dev
+// `meta`, verified corrections, then the offline seed (provider-seed-rosters).
+const LOOKUP_FIELDS = Object.freeze([
+  'contextWindow',
+  'outputTokens',
+  ...PRICING_RATE_KEYS,
+  'supportsReasoning',
+  'supportsVision',
+  'supportsFunctionCalling',
+  'reasoningOptions',
+]);
+
+// Labels compare without the trailing "(C)" tier marker, case or punctuation.
+const nameKey = (name) =>
+  String(name || '')
+    .replace(/\s*\(c\)\s*$/i, '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '');
+
+// A discovered or catalog label naming the seeded model keeps the seed's "(C)" marker.
+function tierName(candidate, seedName) {
+  if (!candidate) return '';
+  return seedName && nameKey(candidate) === nameKey(seedName) ? seedName : candidate;
 }
 
-function lineageRow(id) {
-  if (SEEDS[id]) return null;
-  const match = SPARK_ID_RE.exec(id);
-  if (!match) return null;
-  const contributor = Boolean(match[4]);
-  let template = null;
-  let templateRevision = null;
-  for (const seedId of SEED_MODELS) {
-    if (SPARK_ID_RE.exec(seedId)[4] ? !contributor : contributor) continue;
-    const candidate = revisionOf(seedId);
-    if (!templateRevision || compareRevision(candidate, templateRevision) > 0) {
-      template = seedId;
-      templateRevision = candidate;
-    }
+// Discovered fields win, then the shared lookup (fetched catalogs before
+// seeds). Rows that report no effort ladder gain the default five levels
+// unless a source declares the model non-reasoning.
+function museRow(id, discovered = null) {
+  const meta = getModelMetadataSync(id, 'muse-code-oauth');
+  if (!meta && !discovered) return null;
+  const row = { id, provider: 'muse-code-oauth', family: 'muse-spark' };
+  for (const key of LOOKUP_FIELDS) {
+    const value = meta?.[key];
+    if (value != null && !(Array.isArray(value) && !value.length)) row[key] = value;
   }
-  if (!template) return null;
-  const revision =
-    match[3] && Number(match[3]) !== 0 ? `${match[1]}.${match[2]}.${match[3]}` : `${match[1]}.${match[2]}`;
-  return {
-    ...seedRow(template),
-    id,
-    name: `Muse Spark ${revision}${contributor ? ' (C)' : ''}`,
-    reasoningLevels: [...FIVE_LEVELS],
-    reasoningOptions: effortOptions(FIVE_LEVELS),
-  };
-}
-
-// Seeds win for the ids they cover; lineage rows yield to discovered metadata.
-// A name supplied by discovery is always kept. Other discovered rows keep
-// their own metadata and only gain the default effort ladder when they report none.
-function museRow(id, discovered) {
+  Object.assign(row, discovered || {});
   const discoveredName =
     typeof discovered?.name === 'string' && discovered.name && discovered.name !== id ? discovered.name : '';
-  if (SEEDS[id]) return { ...(discovered || {}), ...seedRow(id), ...(discoveredName ? { name: discoveredName } : {}) };
-  const lineage = lineageRow(id);
-  const row = {
-    id,
-    name: id,
-    provider: 'muse-code-oauth',
-    family: 'muse-spark',
-    ...(lineage || {}),
-    ...(discovered || {}),
-  };
-  if (discoveredName) row.name = discoveredName;
-  else if (lineage) row.name = lineage.name;
-  if (!row.reasoningOptions?.length) {
-    row.reasoningOptions = effortOptions(FIVE_LEVELS);
-    row.reasoningLevels = [...FIVE_LEVELS];
+  row.name = tierName(discoveredName || meta?.displayName, museSeedRow(id)?.name) || id;
+  // A model declared non-reasoning gets no default ladder.
+  if (!row.reasoningOptions?.length)
+    row.reasoningOptions = row.supportsReasoning === false ? [] : effortOptions(FIVE_LEVELS);
+  if (!row.reasoningLevels?.length) {
+    row.reasoningLevels = [...(row.reasoningOptions.find((o) => o?.type === 'effort')?.values || [])];
   }
   return row;
 }
@@ -414,12 +378,9 @@ export class MuseCodeOAuthProvider {
     });
     this._innerKey = apiKey;
     // The Responses builder reads limits and the effort ladder from the inner
-    // provider's cached model row; seeds fill in what discovery omits.
+    // provider's cached model row; the shared lookup fills what discovery omits.
     const innerRow = this._inner.getCachedModelInfo.bind(this._inner);
-    this._inner.getCachedModelInfo = (model) => {
-      const discovered = innerRow(model);
-      return discovered || SEEDS[model] || lineageRow(model) ? museRow(model, discovered) : null;
-    };
+    this._inner.getCachedModelInfo = (model) => museRow(model, innerRow(model));
     return this._inner;
   }
 
@@ -452,6 +413,8 @@ export class MuseCodeOAuthProvider {
   async listModels() {
     const { apiKey } = await this.ensureAuth();
     const inner = this._ensureInner(apiKey);
+    // Only the latest request, fetched with the still-active key, publishes.
+    const publish = museModelCache.beginSave(() => loadTokens()?.apiKey === apiKey);
     let items;
     try {
       items = await inner._fetchModelItems();
@@ -460,25 +423,29 @@ export class MuseCodeOAuthProvider {
       return SEED_MODELS.map((id) => museRow(id));
     }
     // A successful roster is authoritative, even when it holds no chat models.
-    const rows = (Array.isArray(items) ? items : [])
+    const discovered = (Array.isArray(items) ? items : [])
       .filter((m) => typeof m?.id === 'string' && m.id && !NON_CHAT_MODEL_RE.test(m.id))
       .map((m) => {
         const contextWindow = Number(m.context_window ?? m.max_context_window ?? m.context_length ?? 0);
         const outputTokens = Number(m.max_output_tokens ?? m.output_tokens ?? 0);
         const name = [m.name, m.display_name].find((v) => typeof v === 'string' && v.trim());
-        return museRow(m.id, {
+        return {
+          id: m.id,
+          provider: 'muse-code-oauth',
           ...(name ? { name: name.trim() } : {}),
           ...(contextWindow > 0 ? { contextWindow } : {}),
           ...(outputTokens > 0 ? { outputTokens } : {}),
           ...(typeof m.created === 'number' ? { created: m.created } : {}),
-        });
+        };
       });
-    inner._enrichedModels = rows;
+    const rows = discovered.map((row) => museRow(row.id, row));
+    // A superseded or other-credential response never replaces the live roster either.
+    if (publish(discovered)) inner._enrichedModels = rows;
     return rows;
   }
 
   getCachedModelInfo(model) {
-    return this._inner?.getCachedModelInfo?.(model) || (SEEDS[model] || lineageRow(model) ? museRow(model) : null);
+    return this._inner?.getCachedModelInfo?.(model) || museRow(model);
   }
 
   /** Subscription window/weekly usage, read from the key endpoint without onboarding. */

package/src/runtime/agent/orchestrator/providers/oauth-credential-probes.mjs

@@ -6,6 +6,7 @@ import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs
 import { cursorTokenExpiry } from './cursor-auth.mjs';
 import { isValidMuseCredentialDocument } from './muse-code-oauth-tokens.mjs';
 import { developerOptionEnabled, developerOptionForProvider } from '../../../shared/developer-options.mjs';
+import { modelProxyClientMode } from '../../../shared/model-proxy-mode.mjs';
 
 const ANTHROPIC_DEFAULT_CREDENTIALS_PATH = join(resolvePluginData(), 'anthropic-oauth-credentials.json');
 
@@ -100,6 +101,8 @@ function credentialPathsSignature(paths, extra = '') {
 }
 
 function memoProbe(key, paths, compute, extraSignature = '') {
+  // Remote mode: no credential file on this server is ever read.
+  if (modelProxyClientMode()) return 'absent';
   const signature = credentialPathsSignature(paths, extraSignature);
   const hit = _probeCache.get(key);
   const now = Date.now();
@@ -178,6 +181,17 @@ function mimoOAuthState() {
   );
 }
 
+function commandCodeOAuthState() {
+  const paths = [
+    boundProviderAuthPath('command-code-oauth') ||
+      process.env.COMMAND_CODE_OAUTH_CREDENTIALS_PATH ||
+      join(resolvePluginData(), 'command-code-oauth.json'),
+  ];
+  return memoProbe('command-code-oauth', paths, () =>
+    resolveProbeState(paths, (docs) => docs.some((own) => typeof own?.apiKey === 'string' && !!own.apiKey.trim()))
+  );
+}
+
 function museCodeOAuthState() {
   const paths = [
     boundProviderAuthPath('muse-code-oauth') ||
@@ -252,6 +266,7 @@ const OAUTH_PROBE_STATES = new Map([
   ['openai-oauth', openAIOAuthState],
   ['grok-oauth', grokOAuthState],
   ['muse-code-oauth', museCodeOAuthState],
+  ['command-code-oauth', commandCodeOAuthState],
   ['mimo-oauth', mimoOAuthState],
   ['cursor-oauth', cursorOAuthState],
   ['antigravity-oauth', antigravityOAuthState],

package/src/runtime/agent/orchestrator/providers/oauth-usage.mjs

@@ -868,7 +868,8 @@ async function measureUsage(provider, providerObj, routeInfo) {
     (provider === 'cursor-oauth' ||
       provider === 'cursor-api' ||
       provider === 'antigravity-oauth' ||
-      provider === 'muse-code-oauth') &&
+      provider === 'muse-code-oauth' ||
+      provider === 'command-code-oauth') &&
     typeof providerObj?.getUsageSnapshot === 'function'
   ) {
     return await providerObj.getUsageSnapshot();
@@ -893,12 +894,12 @@ async function measureUsageWithAuthRetry(provider, providerObj, routeInfo) {
 // refresh cannot vouch for the reading it last produced: keeping a 100% meter
 // earned by a dead token would hold the account out of the roster until its
 // reset time, so the recorded quota goes with the credential.
-function usageAfterFailure(err, provider, accountId, log) {
+async function usageAfterFailure(err, provider, accountId, log) {
   const snapshot = provider === 'anthropic-oauth' && accountId === 'default' ? latestClaudeStatuslineUsage() : null;
   if (snapshot) return snapshot;
   if (isUsageAuthRejection(err) && ACCOUNT_PROVIDERS.includes(provider)) {
     try {
-      clearProviderAccountQuotaState(provider, accountId);
+      await clearProviderAccountQuotaState(provider, accountId);
     } catch (error) {
       log(`Account usage could not be cleared: ${error.message}`);
     }
@@ -952,7 +953,7 @@ export async function fetchOAuthUsageSnapshot(routeInfo, providerObj, log = () =
     try {
       snapshot = await measureUsageWithAuthRetry(provider, providerObj, routeInfo);
     } catch (err) {
-      snapshot = usageAfterFailure(err, provider, accountId, log);
+      snapshot = await usageAfterFailure(err, provider, accountId, log);
     }
     if (!isContentfulSnapshot(snapshot)) {
       cacheNegative(key, 'empty');
@@ -961,7 +962,7 @@ export async function fetchOAuthUsageSnapshot(routeInfo, providerObj, log = () =
     }
     if (ACCOUNT_PROVIDERS.includes(provider)) {
       try {
-        recordProviderAccountUsage(provider, accountId, snapshot);
+        await recordProviderAccountUsage(provider, accountId, snapshot);
       } catch (error) {
         log(`Account usage could not be saved: ${error.message}`);
       }

package/src/runtime/agent/orchestrator/providers/openai-compat-chat-send.mjs

@@ -38,7 +38,7 @@ export async function sendCompatChat(provider, messages, useModel, tools, opts)
   // global catalog must not shape a user-defined endpoint's request.
   let modelInfo = null;
   if (isCustom) modelInfo = provider.getCachedModelInfo(useModel) || null;
-  else if (provider.name === 'opencode-go')
+  else if (provider.name === 'opencode-go' || provider.name === 'command-code-oauth')
     modelInfo = provider.getCachedModelInfo(useModel) || getModelMetadataSync(useModel, provider.name);
   else if (profile?.resolveModelInfo) modelInfo = profile.resolveModelInfo(provider, useModel) || null;
   // Resolved before lowering: replay eligibility depends on the snapped level

package/src/runtime/agent/orchestrator/providers/openai-compat-models.mjs

@@ -1,3 +1,4 @@
+import { resolveProviderApiKey } from '../../../shared/provider-api-key.mjs';
 import { enrichModels } from './model-catalog.mjs';
 import { sanitizeModelList } from './model-list-sanitize.mjs';
 import { PROVIDER_GENERATE_TOTAL_TIMEOUT_MS, createTimeoutSignal, resolveTimeoutMs } from '../stall-policy.mjs';
@@ -10,12 +11,15 @@ const MODEL_LIST_TIMEOUT_MS = resolveTimeoutMs('MIXDOG_COMPAT_MODEL_LIST_TIMEOUT
 // `keyless` omits the Authorization header entirely (keyless endpoints);
 // `signal` aborts the request together with the list timeout.
 export async function fetchCompatModelItems(provider, { signal = null, keyless = false } = {}) {
-  const timeout = createTimeoutSignal(signal, MODEL_LIST_TIMEOUT_MS, `${provider.name} model list`);
+  const name = provider.name;
+  const timeout = createTimeoutSignal(signal, MODEL_LIST_TIMEOUT_MS, `${name} model list`);
   try {
     const res = await fetch(`${String(provider.baseURL || '').replace(/\/+$/, '')}/models`, {
       method: 'GET',
       headers: {
-        ...(keyless ? {} : { Authorization: `Bearer ${provider.apiKey || 'no-key'}` }),
+        ...(keyless
+          ? {}
+          : { Authorization: `Bearer ${resolveProviderApiKey(name, provider.config || provider) || 'no-key'}` }),
         ...(provider.defaultHeaders || {}),
       },
       signal: timeout.signal,

package/src/runtime/agent/orchestrator/providers/openai-compat-options.mjs

@@ -74,6 +74,17 @@ export function applyCompatProviderChatOptions(params, providerName, opts = {},
     }
     return params;
   }
+  if (providerName === 'command-code-oauth') {
+    // The API's field is undocumented; mirror the common `reasoning_effort`
+    // (levels the catalog row declares, else low/medium/high).
+    const rawEffort = opts.effort ?? config?.reasoningEffort;
+    const declared = modelInfo?.reasoningOptions?.some((option) => option?.type === 'effort');
+    const effort = declared
+      ? normalizeOpencodeGoReasoningEffort(rawEffort, modelInfo)
+      : normalizeReasoningEffort(rawEffort, ['low', 'medium', 'high']);
+    if (effort) params.reasoning_effort = effort;
+    return params;
+  }
   if (providerName === 'opencode-go') {
     const reasoningEffort = normalizeOpencodeGoReasoningEffort(opts.effort ?? config?.reasoningEffort, modelInfo);
     // OpenCode Go's OpenAI-compatible contract exposes reasoning_effort,

package/src/runtime/agent/orchestrator/providers/openai-compat-xai-send.mjs

@@ -1,3 +1,4 @@
+import { resolveProviderApiKey } from '../../../shared/provider-api-key.mjs';
 import { markProviderRecoveryExhausted, withRetry } from './retry-classifier.mjs';
 import { consumeCompatResponsesStream } from './openai-compat-stream.mjs';
 import { PROVIDER_FIRST_BYTE_TIMEOUT_MS, createPassthroughSignal } from '../stall-policy.mjs';
@@ -158,7 +159,7 @@ export async function sendXaiResponsesWebSocket(provider, messages, useModel, to
     const reason = signal.reason;
     throw reason instanceof Error ? reason : new Error('xAI Responses WebSocket request aborted by session close');
   }
-  const apiKey = provider.config?.apiKey || process.env.XAI_API_KEY;
+  const apiKey = resolveProviderApiKey('xai', provider.config);
   if (!apiKey) throw new Error('xAI API key not configured');
   messages = await preparePdfTextForProvider(messages, provider);
   const chatMessagesForTrace = toOpenAIMessages(messages, provider.name, { nativePdf: provider.nativePdf });