mixdog 1.2.0 → 1.2.2

package/src/runtime/agent/orchestrator/providers/registry.mjs

@@ -7,6 +7,7 @@ import { isInclusiveProvider } from '../../../shared/llm/cost.mjs';
 import { noEnabledProvidersError } from './registry-errors.mjs';
 import { providerTakesNativePdf } from '../../../attachments/store.mjs';
 import { modelProxyClientMode } from '../../../shared/model-proxy-mode.mjs';
+import { getModelProxyChannel } from './model-proxy-channel.mjs';
 // OpenAI-compat provider names are self-declared by openai-compat-presets.mjs via
 // OPENAI_COMPAT_PRESETS. No parallel list maintained here.
 const providers = new Map();
@@ -28,6 +29,7 @@ const OAUTH_PROVIDER_NAMES = new Set([
   'openai-oauth',
   'grok-oauth',
   'muse-code-oauth',
+  'command-code-oauth',
   'mimo-oauth',
   'cursor-oauth',
   'antigravity-oauth',
@@ -96,6 +98,28 @@ function configSignature(cfg) {
   }
 }
 
+// Remote mode: a proxy provider sends through the channel it was built on. A
+// headless boundary installs a fresh channel per run (model-proxy-bridge.mjs)
+// and closes it afterwards, so the channel's identity is part of every reuse
+// signature — an identical PC config behind a new channel is a rebuild, never
+// a provider bound to a closed channel. Local mode: '' (signatures unchanged).
+const _proxyChannelIds = new WeakMap();
+let _proxyChannelSeq = 0;
+function proxyChannelTag(channel) {
+  if (!channel) return '';
+  let id = _proxyChannelIds.get(channel);
+  if (!id) {
+    _proxyChannelSeq += 1;
+    id = _proxyChannelSeq;
+    _proxyChannelIds.set(channel, id);
+  }
+  return `\u0000model-proxy-channel:${id}`;
+}
+function reuseSignature(cfg, proxyChannel) {
+  const sig = configSignature(cfg);
+  return sig === null ? null : sig + proxyChannelTag(proxyChannel);
+}
+
 function abortError(signal) {
   return signal?.reason instanceof Error
     ? signal.reason
@@ -147,6 +171,7 @@ const PROVIDER_MODULES = {
   'anthropic-oauth': ['./anthropic-oauth.mjs', 'AnthropicOAuthProvider'],
   'grok-oauth': ['./grok-oauth.mjs', 'GrokOAuthProvider'],
   'muse-code-oauth': ['./muse-code-oauth.mjs', 'MuseCodeOAuthProvider'],
+  'command-code-oauth': ['./command-code-oauth.mjs', 'CommandCodeOAuthProvider'],
   'mimo-oauth': ['./mimo-oauth.mjs', 'MimoOAuthProvider'],
   'cursor-oauth': ['./cursor.mjs', 'CursorOAuthProvider'],
   'antigravity-oauth': ['./antigravity-oauth.mjs', 'AntigravityOAuthProvider'],
@@ -176,12 +201,12 @@ async function loadProviderCtor(name, signal = null, cfg = null) {
   throw new Error(`unknown enabled provider: ${name}`);
 }
 
-async function instantiateProvider(name, Ctor, cfg) {
+async function instantiateProvider(name, Ctor, cfg, proxyChannel = null) {
   // Remote mode: the client PC executes the call with its own credentials.
   // Admission and usage accounting still wrap the daemon-side stand-in.
   if (modelProxyClientMode()) {
     const { createModelProxyProvider } = await import('./model-proxy-provider.mjs');
-    return wrapProviderAdmission(createModelProxyProvider(name, cfg), name);
+    return wrapProviderAdmission(createModelProxyProvider(name, cfg, proxyChannel ?? getModelProxyChannel()), name);
   }
   if (isCustomProviderConfig(name, cfg)) return wrapProviderAdmission(await Ctor(name, cfg), name);
   if (Object.hasOwn(OPENAI_COMPAT_PRESETS, name) && name !== 'opencode-go') {
@@ -194,11 +219,12 @@ export async function initProviders(config, { signal = null } = {}) {
   throwIfAborted(signal);
   // Remote mode: provider availability and config are the PC's, never this
   // server's credential probes. No connected client fails here, clearly.
-  if (modelProxyClientMode()) {
+  const proxyChannel = modelProxyClientMode() ? getModelProxyChannel() : null;
+  if (proxyChannel) {
     const { loadModelProxyProviderConfig } = await import('./model-proxy-provider.mjs');
-    config = await awaitWithAbort(loadModelProxyProviderConfig(), signal);
+    config = await awaitWithAbort(loadModelProxyProviderConfig({ channel: proxyChannel }), signal);
   }
-  const sig = configSignature(config);
+  const sig = reuseSignature(config, proxyChannel);
   // Coalesce: an identical config is already mid-init — attach to it.
   if (sig !== null && _inFlightPromise && _inFlightSig === sig) {
     return awaitWithAbort(_inFlightPromise, signal);
@@ -212,7 +238,7 @@ export async function initProviders(config, { signal = null } = {}) {
   // signatures can never run their clear()+rebuild concurrently, regardless
   // of caller-side gating (agent-tool gateOnPrior may release a queued init
   // before the prior one settled). Errors do not poison the chain.
-  const run = () => _initProvidersUnsynchronized(config, signal);
+  const run = () => _initProvidersUnsynchronized(config, signal, proxyChannel);
   const next = _initChain.then(run, run);
   _initChain = next.then(
     () => {},
@@ -241,7 +267,7 @@ export async function initProviders(config, { signal = null } = {}) {
   return awaitWithAbort(tracked, signal);
 }
 
-async function _initProvidersUnsynchronized(config, signal = null) {
+async function _initProvidersUnsynchronized(config, signal = null, proxyChannel = null) {
   throwIfAborted(signal);
   // Invariant: never wipe the live registry based on an empty / all-disabled
   // config. Without this guard, a stale `loadAgentConfig()` (e.g. mid-reload
@@ -262,7 +288,7 @@ async function _initProvidersUnsynchronized(config, signal = null) {
       // Idempotent reuse: an enabled provider whose config signature is
       // unchanged from the live registry is carried forward as-is. Only
       // added or changed providers are (re)constructed below.
-      const sig = configSignature(cfg);
+      const sig = reuseSignature(cfg, proxyChannel);
       if (sig !== null && providers.has(name) && signatures.get(name) === sig) {
         return { name, inst: providers.get(name), sig };
       }
@@ -270,7 +296,7 @@ async function _initProvidersUnsynchronized(config, signal = null) {
         // A proxied provider never loads the real adapter module.
         const Ctor = modelProxyClientMode() ? null : await loadProviderCtor(name, signal, cfg);
         throwIfAborted(signal);
-        const inst = await instantiateProvider(name, Ctor, cfg);
+        const inst = await instantiateProvider(name, Ctor, cfg, proxyChannel);
         return { name, inst, sig };
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);

package/src/runtime/agent/orchestrator/providers/retry-backoff.mjs

@@ -5,6 +5,7 @@ import {
   PROVIDER_RETRY_JITTER_RATIO,
   PROVIDER_RETRY_MAX_ATTEMPTS,
 } from '../stall-policy.mjs';
+import { providerErrorKind } from './provider-error-kind.mjs';
 
 /** Anthropic request budget: 10 retries (11 attempts).
  * CLAUDE_CODE_MAX_RETRIES is intentionally read per request for reload/tests.
@@ -32,17 +33,23 @@ export function anthropicRequestTimeoutMs() {
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 600_000;
 }
 
+// Consecutive overloads after which Anthropic switches to its fallback model
+// (passed to withRetry as `overloadFallbackAfter`).
 export const ANTHROPIC_MAX_CONSECUTIVE_529 = 3;
 
-export class AnthropicFallbackTriggeredError extends Error {
+/** Thrown by withRetry when `overloadFallbackAfter` consecutive overloads hand the send to `fallbackModel`. */
+export class ModelFallbackTriggeredError extends Error {
   constructor(originalModel, fallbackModel, cause) {
-    super(`Anthropic model fallback triggered: ${originalModel} -> ${fallbackModel}`, { cause });
-    this.name = 'AnthropicFallbackTriggeredError';
+    super(`Model fallback triggered: ${originalModel} -> ${fallbackModel}`, { cause });
+    this.name = 'ModelFallbackTriggeredError';
     this.originalModel = originalModel;
     this.fallbackModel = fallbackModel;
   }
 }
 
+// Existing provider imports keep working: the same class under its old name.
+export const AnthropicFallbackTriggeredError = ModelFallbackTriggeredError;
+
 // Default backoff schedule used by withRetry when caller does not override.
 // Mirrors anthropic-oauth's 5-attempt curve (immediate + 1s/2s/4s/8s) so the
 // total cap stays under 15s. Total upper bound = sum = 15s.
@@ -51,9 +58,36 @@ export const DEFAULT_MAX_ATTEMPTS = PROVIDER_RETRY_MAX_ATTEMPTS;
 
 const MIDSTREAM_BACKOFF_MS = [250, 1000, 2000, 4000];
 
-export function midstreamBackoffFor(retryNumber, schedule = MIDSTREAM_BACKOFF_MS) {
-  const raw = schedule[Math.min(Math.max(retryNumber, 1), schedule.length) - 1];
-  return jitterDelayMs(raw);
+const ADVICE_RETRYABLE_KINDS = new Set(['overloaded', 'rate_limited', 'transient']);
+
+/**
+ * The wait before a mid-stream re-issue: the server's advice (Retry-After /
+ * retryAfterMs) in full for a retryable kind — never capped below its value —
+ * else the caller's bounded backoff step. Advice never makes a terminal kind
+ * retryable; that is the classifier's verdict, not this wait's. The retry
+ * COUNT stays the caller's budget; the sleep stays the caller's abortable one.
+ */
+export function midstreamRetryDelayMs(err, backoffMs) {
+  const { kind, retryAfterMs } = providerErrorKind(err);
+  if (retryAfterMs != null && ADVICE_RETRYABLE_KINDS.has(kind)) return Math.max(0, retryAfterMs);
+  return Math.max(0, Number(backoffMs) || 0);
+}
+
+/** The mid-stream wait for `retryNumber`; pass the failure as `err` so server
+ *  advice on a retryable kind replaces the jittered step (midstreamRetryDelayMs). */
+// `schedule` / `jitterRatio` default to the shared values; a provider passes
+// its own (e.g. openai-retry-policy.mjs).
+export function midstreamBackoffFor(
+  retryNumber,
+  schedule = MIDSTREAM_BACKOFF_MS,
+  err = null,
+  jitterRatio,
+  jitterMode = 'symmetric'
+) {
+  const steps = schedule || MIDSTREAM_BACKOFF_MS;
+  const raw = steps[Math.min(Math.max(retryNumber, 1), steps.length) - 1];
+  const step = jitterDelayMs(raw, jitterRatio ?? PROVIDER_RETRY_JITTER_RATIO, jitterMode);
+  return err ? midstreamRetryDelayMs(err, step) : step;
 }
 
 export function jitterDelayMs(ms, ratio = PROVIDER_RETRY_JITTER_RATIO, mode = 'symmetric') {
@@ -62,7 +96,12 @@ export function jitterDelayMs(ms, ratio = PROVIDER_RETRY_JITTER_RATIO, mode = 's
   const r = Math.min(Math.max(Number(ratio) || 0, 0), 1);
   if (!r) return Math.round(base);
   const spread = base * r;
-  const offset = mode === 'positive' ? Math.random() * spread : (Math.random() * 2 - 1) * spread;
+  // 'positive': upward only; 'negative': downward only, base × (1 − r·rand);
+  // otherwise symmetric ±r.
+  let offset;
+  if (mode === 'positive') offset = Math.random() * spread;
+  else if (mode === 'negative') offset = -Math.random() * spread;
+  else offset = (Math.random() * 2 - 1) * spread;
   return Math.max(0, Math.round(base + offset));
 }