mixdog 1.1.2 → 1.2.1

package/src/session-runtime/schedule-session-run.mjs

@@ -65,7 +65,7 @@ export async function runScheduleSession(schedule, { config = null, prompt: prom
   const result = await runAutomationTurns(
     session.id,
     () => askSession(session.id, content, null, null, cwd || undefined),
-    (completions) => askSession(session.id, completions, null, null, cwd || undefined)
+    (completions, askOpts) => askSession(session.id, completions, null, null, cwd || undefined, undefined, askOpts)
   );
   return { sessionId: session.id, result: String(result?.content || '') };
 }

package/src/session-runtime/services/agent-tool/helpers.mjs

@@ -12,6 +12,7 @@ import {
 import { PRESET_ALIASES } from './tool-def.mjs';
 import { positiveInt } from '../../../runtime/shared/numbers.mjs';
 import { clean } from '../../../runtime/shared/clean.mjs';
+import { normalizeContextTokens } from '../../../runtime/shared/llm/default-context-window.mjs';
 
 export { positiveInt };
 
@@ -220,10 +221,14 @@ export function normalizeAgentRoute(routeLike) {
     model,
     effort: clean(routeLike?.effort) || undefined,
     fast: routeLike?.fast === true,
+    ...(routeLike?.autoEffort === false ? { autoEffort: false } : {}),
     ...(routeLike?.modelParameters && typeof routeLike.modelParameters === 'object'
       ? { modelParameters: { ...routeLike.modelParameters } }
       : {}),
     ...(Number(routeLike?.contextPercent) > 0 ? { contextPercent: Number(routeLike.contextPercent) } : {}),
+    ...(normalizeContextTokens(routeLike?.contextTokens)
+      ? { contextTokens: normalizeContextTokens(routeLike.contextTokens) }
+      : {}),
   };
 }
 

package/src/session-runtime/services/agent-tool/job-views/agent-list.mjs

@@ -3,6 +3,7 @@
 // progress, filtered by default to workers that can still do work.
 import { ACTIVE_STAGES } from '../tool-def.mjs';
 import { isTerminalWorkerStatus } from '../worker-rows.mjs';
+import { sessionUsageTotals } from '../../../../runtime/shared/session-usage-totals.mjs';
 
 // Idle, closed, errored and reaped/unknown rows are history and stay reachable
 // through the task section (status/read keep their terminal result).
@@ -36,6 +37,7 @@ function agentRow({ tag, session, runtime, progress, now, indexRow = null }) {
     preset: session.presetName || null,
     effort: session.effort || null,
     fast: session.fast === true,
+    ...(session.autoEffort === false ? { autoEffort: false } : {}),
     // Additive: route model parameters (e.g. Daybreak Blue) when the route has any.
     ...(session.modelParameters && Object.keys(session.modelParameters).length
       ? { modelParameters: { ...session.modelParameters } }
@@ -51,6 +53,7 @@ function agentRow({ tag, session, runtime, progress, now, indexRow = null }) {
     clientHostPid: session.clientHostPid || null,
     lastStreamDeltaAt: runtime?.lastStreamDeltaAt ? new Date(runtime.lastStreamDeltaAt).toISOString() : null,
     staleSeconds: runtime?.lastStreamDeltaAt ? Math.floor((now - runtime.lastStreamDeltaAt) / 1000) : null,
+    ...sessionUsageTotals(session),
     windowTokens: Number(session.lastContextTokens ?? session.lastInputTokens) || 0,
     windowCap: Number(session.contextWindow) || null,
     permission: session.permission || null,

package/src/session-runtime/services/agent-tool/job-views/job-lookup.mjs

@@ -69,6 +69,7 @@ export function createJobLookup({ mgr, tags, refreshTagsFromSessions }) {
         model: session.model || null,
         effort: session.effort || null,
         fast: session.fast === true,
+        ...(session.autoEffort === false ? { autoEffort: false } : {}),
       },
     };
   }

package/src/session-runtime/services/agent-tool/job-views/spawn-meta.mjs

@@ -16,6 +16,7 @@ export function preparedSpawnMeta(prepared, extras = {}) {
     model: prepared.preset.model,
     effort: prepared.preset.effort || null,
     fast: prepared.preset.fast === true,
+    ...(prepared.preset.autoEffort === false ? { autoEffort: false } : {}),
   });
 }
 

package/src/session-runtime/services/agent-tool/lead-worker-index.mjs

@@ -72,6 +72,20 @@ export function createLeadWorkerIndex({ dataDir, cfgMod, workerRowFromSession })
     return true;
   }
 
+  /** A workspace transition moved the Lead: its existing row follows (status,
+   *  reap deadline and liveness stamps unchanged). No row: nothing to write. */
+  function updateLeadWorkerCwd(sessionId, cwd) {
+    const id = clean(sessionId);
+    const next = clean(cwd);
+    if (!id || !next) return false;
+    index.write((byKey) => {
+      const current = byKey.get(id);
+      if (!current || current.cwd === next) return;
+      byKey.set(id, { ...current, cwd: next });
+    });
+    return true;
+  }
+
   /** Graceful-exit settlement: every turn this process still claims goes idle
    *  before the runtime disappears. */
   function flushActiveLeadRows() {
@@ -147,6 +161,7 @@ export function createLeadWorkerIndex({ dataDir, cfgMod, workerRowFromSession })
     /** Resolves once every queued Lead index write is on disk. */
     flushLeadWorkerIndexWrites: index.flush,
     upsertLeadSession,
+    updateLeadWorkerCwd,
     removeLeadWorkerRow,
     flushActiveLeadRows,
     recoverStaleLeadRows,

package/src/session-runtime/services/agent-tool/send-flow.mjs

@@ -180,6 +180,7 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
         preset: session.presetName || null,
         effort: session.effort || null,
         fast: session.fast === true,
+        ...(session.autoEffort === false ? { autoEffort: false } : {}),
       },
       (job, ownerNotifyContext) => runSend(prepared, ownerNotifyContext, job),
       notifyContext

package/src/session-runtime/services/agent-tool/spawn-flow/spawn-plan.mjs

@@ -17,6 +17,7 @@ import { isAgentDisabled } from '../../../../runtime/shared/agent-route-config.m
 import { normalizeAgentPermission } from '../../../../runtime/shared/markdown-frontmatter.mjs';
 import { resolveAgentSpawnPreset } from '../spawn-preset.mjs';
 import { AGENT_OWNER } from '../../../../runtime/agent/orchestrator/agent-owner.mjs';
+import { workspaceCwdLock } from '../../../workspace/admission-gate.mjs';
 
 export function createSpawnPlanner({
   cfgMod,
@@ -52,8 +53,15 @@ export function createSpawnPlanner({
     if (resolveTag(tag, context, { scanSessions: wantsSessionScan(args) })) {
       throw new Error(`agent spawn: tag "${tag}" already exists`);
     }
-    const baseCwd = resolve(callerCwd || defaultCwd || process.cwd());
-    const workerCwd = clean(args.cwd) ? resolve(baseCwd, args.cwd) : baseCwd;
+    // Workers share their Lead's execution root. While the Lead runs in its
+    // worktree, that root is locked: neither args.cwd nor an inherited
+    // (pre-transition) cwd can send a worker elsewhere.
+    const lockedCwd = workspaceCwdLock([
+      context?.ownerSessionId,
+      context?.callerSessionId || context?.sessionId,
+    ]);
+    const baseCwd = resolve(lockedCwd || callerCwd || defaultCwd || process.cwd());
+    const workerCwd = !lockedCwd && clean(args.cwd) ? resolve(baseCwd, args.cwd) : baseCwd;
     const prompt = await resolvePrompt(args, workerCwd);
     if (prepState?.timedOut) {
       throw new Error('agent spawn prep timed out before session bind');

package/src/session-runtime/services/agent-tool/spawn-flow/spawn-prep.mjs

@@ -10,6 +10,7 @@ import { prepareAgentSession } from '../../../../runtime/agent/orchestrator/agen
 import { getProvider } from '../../../../runtime/agent/orchestrator/providers/registry.mjs';
 import { resolveRouteContextState } from '../../../route-state.mjs';
 import { createSpawnPlanner } from './spawn-plan.mjs';
+import { enterWorkerSpawn } from '../../../workspace/admission-gate.mjs';
 
 /** The route fields every worker-row and tag record carries. */
 export function presetDescriptor(agent, preset, presetName) {
@@ -20,6 +21,7 @@ export function presetDescriptor(agent, preset, presetName) {
     model: preset.model,
     effort: preset.effort || null,
     fast: preset.fast === true,
+    ...(preset.autoEffort === false ? { autoEffort: false } : {}),
   };
 }
 
@@ -84,9 +86,9 @@ export function createSpawnPreparer({
     // A sub-100 context share needs the window it selects; a percent alone
     // keeps the full served window.
     const sessionSpec = { ...spec };
-    if (plan.preset.contextPercent) {
-      const { contextPercent, selectedContextWindow } = resolveRouteContextState(plan.preset, null);
-      Object.assign(sessionSpec, { contextPercent, selectedContextWindow });
+    if (plan.preset.contextPercent || plan.preset.contextTokens) {
+      const { contextPercent, selectedContextWindow, contextTokens } = resolveRouteContextState(plan.preset, null);
+      Object.assign(sessionSpec, { contextPercent, selectedContextWindow }, contextTokens ? { contextTokens } : {});
     }
     if (sessionSurface?.canonical === true && typeof sessionSurface.createChild === 'function') {
       return sessionSurface.createChild({ spec: sessionSpec, prompt: plan.prompt, tag: plan.tag });
@@ -99,10 +101,20 @@ export function createSpawnPreparer({
   }
 
   async function prepareSpawnInProcess(args, callerCwd = null, context = {}, prepState = null) {
-    const plan = await resolveSpawnPlan(args, callerCwd, context, prepState);
-    const spec = spawnSessionSpec(plan, args, context);
-    const { session, effectiveCwd } = await createSpawnedSession(plan, spec, prepState);
-    bindSpawnedSession(session, plan);
+    // Shared admission with Lead workspace transitions: no spawn is prepared
+    // while the Lead's workspace changes, no transition starts mid-spawn.
+    const leaveSpawn = enterWorkerSpawn([context?.ownerSessionId, context?.callerSessionId || context?.sessionId]);
+    let plan;
+    let session;
+    let effectiveCwd;
+    try {
+      plan = await resolveSpawnPlan(args, callerCwd, context, prepState);
+      const spec = spawnSessionSpec(plan, args, context);
+      ({ session, effectiveCwd } = await createSpawnedSession(plan, spec, prepState));
+      bindSpawnedSession(session, plan);
+    } finally {
+      leaveSpawn();
+    }
     if (sessionSurface?.canonical !== true) {
       maybePrewarmSpawnTransport(plan, session);
     }

package/src/session-runtime/services/agent-tool/spawn-preset.mjs

@@ -20,6 +20,7 @@ export function resolveAgentSpawnPreset(config, args = {}) {
         model: clean(args.model),
         effort: clean(args.effort) || undefined,
         fast: args.fast === true,
+        ...(args.autoEffort === false ? { autoEffort: false } : {}),
         tools: 'full',
       },
     };
@@ -42,8 +43,10 @@ export function resolveAgentSpawnPreset(config, args = {}) {
         model: agentRoute.model,
         effort: agentRoute.effort,
         fast: agentRoute.fast === true,
+        ...(agentRoute.autoEffort === false ? { autoEffort: false } : {}),
         ...(agentRoute.modelParameters ? { modelParameters: agentRoute.modelParameters } : {}),
         ...(agentRoute.contextPercent ? { contextPercent: agentRoute.contextPercent } : {}),
+        ...(agentRoute.contextTokens ? { contextTokens: agentRoute.contextTokens } : {}),
         tools: 'full',
       },
     };

package/src/session-runtime/services/agent-tool/tag-registry.mjs

@@ -29,7 +29,7 @@ export function createTagRegistry({ dataDir, cfgMod, mgr }) {
     workerRowFromSession: index.workerRowFromSession,
   });
 
-  const { upsertLeadSession } = leadIndex;
+  const { upsertLeadSession, updateLeadWorkerCwd } = leadIndex;
 
   function dispose(options) {
     try {
@@ -103,6 +103,7 @@ export function createTagRegistry({ dataDir, cfgMod, mgr }) {
     upsertWorkerSession: index.upsertWorkerSession,
     upsertWorkerSessionDeferred,
     upsertLeadSession,
+    updateLeadWorkerCwd,
     removeWorkerRow,
     refreshTagsFromIndex,
     tags,

package/src/session-runtime/services/agent-tool/worker-index/row-shape.mjs

@@ -38,6 +38,7 @@ export function normalizeWorkerRows(value) {
       preset: clean(row.preset) || null,
       effort: clean(row.effort) || null,
       fast: typeof row.fast === 'boolean' ? row.fast : null,
+      ...(row.autoEffort === false ? { autoEffort: false } : {}),
       status: clean(row.status) || 'idle',
       stage: clean(row.stage) || clean(row.status) || 'idle',
       createdAt: clean(row.createdAt) || null,
@@ -87,6 +88,10 @@ export function workerRowFromSession(session, fallbackTag = '', extra = {}, getS
     preset: clean(extra.preset) || clean(session?.presetName) || null,
     effort: clean(extra.effort) || clean(session?.effort) || null,
     fast: fastFlag(extra.fast, session?.fast),
+    // Absent means Auto effort is on; an explicit boolean wins over the session's.
+    ...((typeof extra.autoEffort === 'boolean' ? extra.autoEffort : session?.autoEffort) === false
+      ? { autoEffort: false }
+      : {}),
     status,
     stage,
     createdAt: clean(session?.createdAt) || clean(extra.createdAt) || nowIso,

package/src/session-runtime/services/agent-tool/worker-rows.mjs

@@ -133,6 +133,7 @@ export function workerRowToSession(row = {}) {
     presetName: row.preset || null,
     effort: row.effort || null,
     fast: row.fast === true,
+    ...(row.autoEffort === false ? { autoEffort: false } : {}),
     status: row.status || 'idle',
     stage: row.stage || row.status || 'idle',
     createdAt: row.createdAt || null,

package/src/session-runtime/services/agent-tool.mjs

@@ -146,6 +146,7 @@ export function createStandaloneAgent({
     getStatus,
     recoverWorkers,
     upsertLeadSession: registry.upsertLeadSession,
+    updateLeadWorkerCwd: registry.updateLeadWorkerCwd,
     closeAll: closeFlow.closeAll,
     dispose: (options) => registry.dispose(options),
   };

package/src/session-runtime/services/channel-session-router.mjs

@@ -19,7 +19,10 @@ export function createChannelSessionRouter({ getSessionService, getSessionId, lo
       service.submitSession({
         sessionId,
         prompt: content,
-        options: { source: 'channel' },
+        // A channel notification (webhook event rules carry fenced external
+        // values) is queued as a task notification, never as typed input, so
+        // nothing inside it selects a skill.
+        options: { source: 'channel', mode: 'task-notification' },
       })
     ).catch((error) => {
       log(`channel session delivery failed session=${sessionId}: ${error?.message || error}`);

package/src/session-runtime/services/daemon-candidate.mjs

@@ -5,7 +5,8 @@
 // ready handoff so the daemon's code/signal is recorded against its pid, boot
 // time and ready state. Resolves once the candidate reported ready, exited,
 // failed to spawn, or the timeout elapsed; the caller then re-reads discovery
-// and attaches to whoever won.
+// and attaches to whoever won. The resolved `summary()` describes this boot as
+// observed when called, for a caller that has to give up.
 import { fork } from 'node:child_process';
 import { beginDaemonSpawnCapture } from './daemon-crash-capture.mjs';
 
@@ -34,7 +35,7 @@ export function forkDaemonCandidate({
       // Boot diagnostics written to fd 2 reach this log exactly once, even when
       // the candidate never reached ready.
       capture.mirror();
-      resolve();
+      resolve({ summary: capture.summary });
     };
     let child;
     try {

package/src/session-runtime/services/daemon-crash-capture/spawn-capture.mjs

@@ -20,6 +20,11 @@ const CAPTURE_ID_ATTEMPTS = 8;
 const MIRROR_MAX_BYTES = 16 * 1024;
 const MESSAGE_MAX_CHARS = 512;
 const HEAP_FLAG_RE = /^--max-(?:old-space|semi-space|heap)-size=/;
+// Bytes of fd 2 a failure summary scans (the newest ones when larger).
+const SUMMARY_SCAN_MAX_BYTES = 256 * 1024;
+// Node's uncaught-error report (`TypeError: …`, `Error [ERR_…]: …`), V8's
+// fatal abort and the daemon's own `fatal boot error` log line.
+const STDERR_ERROR_LINE_RE = /\b[A-Z][A-Za-z]*Error\b(?: \[[A-Z0-9_]+\])?:|^Error\b|FATAL ERROR|(?<!non-)\bfatal\b/;
 
 function stamp(ms) {
   const iso = new Date(ms).toISOString();
@@ -256,6 +261,8 @@ function noteSpawnError(capture, error) {
 // this stream, so nothing here extends its lifetime.
 function drainStderrPipe(capture, stream) {
   const onData = (chunk) => {
+    // No capture file to read back: keep the newest bytes for summary().
+    capture.pipeText = `${capture.pipeText}${chunk}`.slice(-SUMMARY_SCAN_MAX_BYTES);
     mirrorText(capture.log, chunk);
   };
   stream.on('data', onData);
@@ -272,6 +279,52 @@ function drainStderrPipe(capture, stream) {
   });
 }
 
+/** The candidate's fd 2 as text: the capture file (its newest bytes when
+ *  large) or, when fd 2 fell back to a pipe, what that pipe delivered. */
+function stderrText(capture) {
+  if (!capture.capturePath || capture.removed) return capture.pipeText;
+  try {
+    const handle = fs.openSync(capture.capturePath, 'r');
+    try {
+      const size = fs.fstatSync(handle).size;
+      const length = Math.min(size, SUMMARY_SCAN_MAX_BYTES);
+      const buffer = Buffer.allocUnsafe(length);
+      const bytesRead = fs.readSync(handle, buffer, 0, length, size - length);
+      return buffer.subarray(0, bytesRead).toString('utf8');
+    } finally {
+      fs.closeSync(handle);
+    }
+  } catch {
+    return capture.pipeText;
+  }
+}
+
+/** What a launcher that gave up on this boot needs to name its cause: the
+ *  lifecycle as far as observed, the first error line on fd 2 (else its last
+ *  line, where a stalled boot stopped) and where the full text is. */
+function summarize(capture) {
+  const { record } = capture;
+  const lines = stderrText(capture)
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean);
+  const errorLine = lines.find((line) => STDERR_ERROR_LINE_RE.test(line));
+  return {
+    pid: record.pid,
+    ready: record.ready,
+    spawnedAt: record.spawnedAt,
+    exitedAt: record.exitedAt,
+    exitCode: record.exitCode,
+    exitSignal: record.exitSignal,
+    exitReason: record.exitReason ?? null,
+    uptimeMs: record.uptimeMs,
+    error: record.error,
+    stderrErrorLine: errorLine ? boundedMessage(errorLine) : null,
+    stderrLastLine: lines.length > 0 ? boundedMessage(lines.at(-1)) : null,
+    stderrPath: capture.removed ? null : capture.capturePath,
+  };
+}
+
 /** Attach to the forked child: record its identity and keep a lifetime
  *  listener that survives the ready handoff, so a later exit is still
  *  correlated to this pid, boot time and ready state. */
@@ -347,6 +400,7 @@ export function beginDaemonSpawnCapture({
     readOffset: 0,
     removed: false,
     pipeDrained: null,
+    pipeText: '',
     stderrStdio: 'pipe',
   };
   openCapture(capture, { captureDir, prune, launcherPid, nonce });
@@ -377,5 +431,6 @@ export function beginDaemonSpawnCapture({
      *  recording anything — the child, if any, keeps its duplicate. */
     release: () => closeWriteFd(capture),
     snapshot: () => ({ ...capture.record }),
+    summary: () => summarize(capture),
   };
 }

package/src/session-runtime/services/hook-bus/command-handler.mjs

@@ -3,6 +3,7 @@ import { spawn, spawnSync } from 'node:child_process';
 import { MAX_BUFFER_BYTES } from './constants.mjs';
 import { handlerTimeoutS } from './handler-timeout.mjs';
 import { abortReason, throwIfAborted } from '../../../runtime/shared/abort-race.mjs';
+import { scrubRuntimeRootVars } from '../../../runtime/agent/orchestrator/tools/env-scrub.mjs';
 
 function resolvePlaceholders(str, projectDir, pluginData, pluginRoot = null) {
   if (typeof str !== 'string') return str;
@@ -88,8 +89,10 @@ function hookEnv(projectDir, pluginData, payload, pluginRoot = null) {
   const resolvedProject = projectDir || process.cwd();
   const resolvedPluginRoot = pluginRoot || resolvedProject;
   const resolvedPluginData = pluginData || resolvedProject;
+  // Hooks are user commands like model shells: the host's runtime root,
+  // identity and Electron node-mode must not reach them.
   const env = {
-    ...process.env,
+    ...scrubRuntimeRootVars({ ...process.env }),
     MIXDOG_PROJECT_DIR: resolvedProject,
     MIXDOG_PLUGIN_ROOT: resolvedPluginRoot,
     MIXDOG_PLUGIN_DATA: resolvedPluginData,

package/src/session-runtime/services/hook-bus/handlers.mjs

@@ -1,6 +1,7 @@
 import { readResponseBuffer } from '../../../runtime/shared/bounded-download.mjs';
 import { runAbortable, throwIfAborted } from '../../../runtime/shared/abort-race.mjs';
 import { assertPublicUrl, pinnedFetch } from '../../../runtime/web-search/lib/ssrf-guard.mjs';
+import { providerSafeMcpToolName } from '../../../runtime/agent/orchestrator/mcp/client-config.mjs';
 import { handlerTimeoutS } from './handler-timeout.mjs';
 export { handlerTimeoutS } from './handler-timeout.mjs';
 export { defaultShellKind, runCommandHandler } from './command-handler.mjs';
@@ -216,8 +217,9 @@ export async function runMcpToolHandler(handler, payload, eventName, mcpToolRunn
   throwIfAborted(signal);
   const timeoutMs = Math.round(handlerTimeoutS(handler, eventName) * 1000);
   let name = String(handler.tool || '').trim();
-  if (handler.server && !name.startsWith('mcp__')) {
-    name = `mcp__${String(handler.server).trim()}__${name}`;
+  if (handler.server && name && !name.startsWith('mcp__')) {
+    // The same provider-safe name the server's tool was registered under.
+    name = providerSafeMcpToolName(String(handler.server).trim(), name);
   }
   if (!name) {
     return {
@@ -241,7 +243,9 @@ export async function runMcpToolHandler(handler, payload, eventName, mcpToolRunn
         onTimeout: () => {
           try {
             controller.abort(new Error(`mcp_tool hook timed out: ${name}`));
-          } catch {}
+          } catch {
+            // Abort is best-effort; the timeout error below is what callers see.
+          }
           return new Error(`mcp_tool hook timed out: ${name}`);
         },
       }

package/src/session-runtime/services/provider-admin.mjs

@@ -54,6 +54,15 @@ import {
   beginOAuthLogin as beginMuseCodeOAuthLogin,
   loginOAuth as loginMuseCodeOAuth,
 } from '../../runtime/agent/orchestrator/providers/muse-code-oauth-login.mjs';
+import {
+  describeCommandCodeOAuthCredentials,
+  forgetCommandCodeOAuthCredentials,
+  hasCommandCodeOAuthCredentials,
+} from '../../runtime/agent/orchestrator/providers/command-code-oauth-tokens.mjs';
+import {
+  beginOAuthLogin as beginCommandCodeOAuthLogin,
+  loginOAuth as loginCommandCodeOAuth,
+} from '../../runtime/agent/orchestrator/providers/command-code-oauth-login.mjs';
 import {
   beginCursorOAuthLogin,
   describeCursorOAuthCredentials,
@@ -80,6 +89,7 @@ import {
   changeProviderAccounts,
   removeProviderAccount,
   clearProviderAccountQuotaState,
+  providerAccountLimit,
   ACCOUNT_PROVIDERS,
 } from '../../runtime/shared/provider-accounts.mjs';
 import { currentProviderAccountId, withProviderAccount } from '../../runtime/shared/provider-auth-binding.mjs';
@@ -154,6 +164,16 @@ const OAUTH_PROVIDERS = Object.freeze([
     begin: beginMuseCodeOAuthLogin,
     login: loginMuseCodeOAuth,
   }),
+  Object.freeze({
+    id: 'command-code-oauth',
+    name: 'Command Code',
+    desc: 'Sign in with your Command Code account',
+    has: hasCommandCodeOAuthCredentials,
+    describe: describeCommandCodeOAuthCredentials,
+    forget: forgetCommandCodeOAuthCredentials,
+    begin: beginCommandCodeOAuthLogin,
+    login: loginCommandCodeOAuth,
+  }),
   Object.freeze({
     id: 'mimo-oauth',
     name: 'MiMo',
@@ -421,6 +441,12 @@ function customProviderRow(id, entry, checkSecrets = true) {
   const keyless = (config?.auth ?? entry.auth) === 'none';
   const stored = checkSecrets ? hasStoredSecret(SECRET_ACCOUNTS.agentApiKey(id)) : false;
   const unstoredStatus = configuredEnabled ? 'No Key' : 'Off';
+  let status = stored ? 'Set' : unstoredStatus;
+  let detail = stored ? 'stored in keychain' : 'custom endpoint';
+  if (keyless) {
+    status = configuredEnabled ? 'Keyless' : 'Off';
+    detail = 'no API key required';
+  }
   const row = {
     id,
     name: entry.name,
@@ -431,12 +457,12 @@ function customProviderRow(id, entry, checkSecrets = true) {
     group: 'api',
     type: 'api-key',
     enabled: configuredEnabled,
-    authenticated: keyless ? true : checkSecrets ? stored : configuredEnabled,
+    authenticated: keyless || (checkSecrets ? stored : configuredEnabled),
     stored,
     env: false,
     envName: null,
-    status: keyless ? (configuredEnabled ? 'Keyless' : 'Off') : stored ? 'Set' : unstoredStatus,
-    detail: keyless ? 'no API key required' : stored ? 'stored in keychain' : 'custom endpoint',
+    status,
+    detail,
   };
   row.schemaVersion = config?.schemaVersion ?? entry.schemaVersion;
   row.auth = keyless ? 'none' : 'key';
@@ -584,7 +610,7 @@ export async function loginOAuthProvider(cfgMod, provider) {
     updateConfigProvider(cfgMod, id, { enabled: true });
     // Same reason as the interactive add-account flow: a fresh credential says
     // nothing about the quota the previous one exhausted.
-    if (ACCOUNT_PROVIDERS.includes(id)) clearProviderAccountQuotaState(id, currentProviderAccountId(id));
+    if (ACCOUNT_PROVIDERS.includes(id)) await clearProviderAccountQuotaState(id, currentProviderAccountId(id));
   }
   return { provider: id, type: 'oauth', authenticated: Boolean(auth.authenticated), status: auth.status || null };
 }
@@ -621,7 +647,7 @@ function rosterAccountForIdentity(id, oauth, newAccountId, auth) {
   return match?.id || null;
 }
 
-function settleOAuthLogin(
+async function settleOAuthLogin(
   { cfgMod, id, accountId: signedInId, addAccount, includeDefault, label, inAccount, oauth },
   result
 ) {
@@ -635,11 +661,11 @@ function settleOAuthLogin(
       renameSync(providerAccountPath(id, signedInId), providerAccountPath(id, existingId));
       accountId = existingId;
     }
-    registerProviderAccount(id, accountId, { includeDefault, label });
+    await registerProviderAccount(id, accountId, { includeDefault, label });
     // A re-connect can follow a re-created subscription under the same
     // account id: start it from no recorded quota rather than from the
     // exhausted window the previous credential earned.
-    clearProviderAccountQuotaState(id, accountId);
+    await clearProviderAccountQuotaState(id, accountId);
     updateConfigProvider(cfgMod, id, { enabled: true });
   }
   return {
@@ -688,12 +714,20 @@ export async function beginOAuthProviderLogin(cfgMod, provider, options = {}) {
   // The callback and a pasted code can both deliver the same sign-in; it must
   // settle once, because settling may move the credential to an existing id.
   let settled = null;
+  let settling = null;
   const finish = async (result) => {
     if (!result || cancelled) return null;
     if (settled) return settled;
-    const outcome = settleOAuthLogin(login, result);
-    if (outcome.authenticated) settled = outcome;
-    return outcome;
+    // Settling is async now: a second delivery arriving mid-write shares it.
+    if (settling) return settling;
+    settling = settleOAuthLogin(login, result);
+    try {
+      const outcome = await settling;
+      if (outcome.authenticated) settled = outcome;
+      return outcome;
+    } finally {
+      settling = null;
+    }
   };
   return {
     provider: id,
@@ -721,9 +755,11 @@ export function listProviderAccounts(provider) {
   if (!oauth) throw new TypeError('Unknown OAuth provider.');
   const pool = readProviderAccountPool(provider);
   const accounts = pool.accounts.length ? pool.accounts : defaultAccountRows(provider, oauth);
+  const now = Date.now();
   return {
     provider,
     auto: pool.auto !== false,
+    policy: pool.policy,
     useCredits: pool.useCredits === true,
     selectedId: pool.selectedId || accounts[0]?.id || null,
     accounts: accounts.map((row) => {
@@ -740,6 +776,9 @@ export function listProviderAccounts(provider) {
         reauthRequired: auth.reauthRequired === true,
         usage: row.usage || null,
         blockedUntil: row.blockedUntil || null,
+        // The limit holding the account now: account-wide, or only for one
+        // model family ("7D Fable") while other models still run.
+        limit: providerAccountLimit(row, now, { useCredits: pool.useCredits === true }),
         ...(identity ? { identity } : {}),
         ...(typeof auth.email === 'string' && auth.email.trim() ? { email: auth.email.trim() } : {}),
       };
@@ -753,17 +792,23 @@ function defaultAccountRows(provider, oauth) {
   return authenticated ? [{ id: 'default', label: 'Account 1' }] : [];
 }
 
-export function updateProviderAccounts(provider, change) {
+// Store the implicit signed-in `default` account in the roster, so a change or
+// a usage measurement has a row to land on. Returns the current roster view.
+export async function materializeProviderAccounts(provider) {
   const current = listProviderAccounts(provider);
-  if (!readProviderAccountPool(provider).accounts.length && current.accounts.length) {
-    registerProviderAccount(provider, 'default', { label: 'Account 1' });
-  }
-  changeProviderAccounts(provider, change);
+  if (readProviderAccountPool(provider).accounts.length || !current.accounts.length) return current;
+  await registerProviderAccount(provider, 'default', { label: 'Account 1' });
+  return listProviderAccounts(provider);
+}
+
+export async function updateProviderAccounts(provider, change) {
+  await materializeProviderAccounts(provider);
+  await changeProviderAccounts(provider, change);
   // Picking an account by hand is a decision to use it NOW, so the refusal
   // window and meter stored against it — both describing the state the user
   // just changed — are dropped here. Never in the pool's own fallback commit,
   // where clearing them would send the request back to a spent account.
-  if (change?.selectedId !== undefined) clearProviderAccountQuotaState(provider, change.selectedId);
+  if (change?.selectedId !== undefined) await clearProviderAccountQuotaState(provider, change.selectedId);
   return listProviderAccounts(provider);
 }
 
@@ -859,7 +904,8 @@ async function resolveCustomInput(cfgMod, rawInput, options) {
   const config = normalizeCustomProviderConfig(input, options);
   const typed = typeof input.apiKey === 'string' ? input.apiKey.trim() : '';
   const keyless = config.auth === 'none';
-  const apiKey = keyless ? '' : typed || (id ? getAgentApiKey(id) || '' : '');
+  let apiKey = '';
+  if (!keyless) apiKey = typed || (id ? getAgentApiKey(id) || '' : '');
   return { id, config, typed: keyless ? '' : typed, apiKey, keyless };
 }
 
@@ -1078,7 +1124,7 @@ export async function forgetProviderAuth(cfgModOrProvider, maybeProvider, reques
       throw new TypeError('Account is no longer connected.');
     }
     const result = withProviderAccount(id, accountId, () => oauth.forget());
-    const pool = removeProviderAccount(id, accountId);
+    const pool = await removeProviderAccount(id, accountId);
     if (cfgMod) updateConfigProvider(cfgMod, id, { enabled: pool.accounts.length > 0 });
     return { provider: id, type: 'oauth', forgotten: true, removed: Boolean(result?.removed) };
   }

package/src/session-runtime/services/usage-dashboard-model.mjs

@@ -236,6 +236,8 @@ function providerDescription(id, group) {
       return 'Grok Build subscription quota';
     case 'muse-code-oauth':
       return 'Muse Code subscription quota';
+    case 'command-code-oauth':
+      return 'Command Code subscription quota';
     case 'mimo-oauth':
       return 'MiMo Token Plan subscription quota';
     case 'antigravity-oauth':
@@ -343,6 +345,7 @@ const PROVIDER_RANKS = {
   'anthropic-oauth': 20,
   'grok-oauth': 30,
   'muse-code-oauth': 33,
+  'command-code-oauth': 33.5,
   'mimo-oauth': 34,
   'cursor-oauth': 35,
   'antigravity-oauth': 36,