mixdog 1.2.1 → 1.2.2

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -1,6 +1,11 @@
 import { reloadProviderApiKey, resolveProviderApiKey } from '../../../shared/provider-api-key.mjs';
 import { sanitizeToolPairs } from '../session/context-utils.mjs';
 import { AnthropicFallbackTriggeredError } from './retry-classifier.mjs';
+import {
+  announceAnthropicModelFallback,
+  createAnthropicOverloadTracker,
+  isTerminalOverloadModel,
+} from './anthropic-overload-fallback.mjs';
 import { readStreamOutcome } from './lib/stream-outcome.mjs';
 import { createPassthroughSignal } from '../stall-policy.mjs';
 import { createAbortController } from '../../../shared/abort-controller.mjs';
@@ -166,6 +171,13 @@ export class AnthropicProvider {
       } catch {}
     };
 
+    // Request-loop 529s and SSE overload events share one counter; at the
+    // limit the configured fallback model takes over the whole send.
+    const overload = createAnthropicOverloadTracker({
+      model: useModel,
+      fallbackModel: opts._fallbackTriggered ? undefined : opts.fallbackModel,
+      terminalAtLimit: !isCustomProviderName(this.name) && isTerminalOverloadModel(useModel),
+    });
     // The SDK calls and their initial-response retry policy
     // (anthropic-api-transport.mjs).
     const transport = createAnthropicApiTransport({
@@ -176,6 +188,7 @@ export class AnthropicProvider {
       params,
       requestHeaders,
       totalSignal,
+      overload,
     });
     // Usage accounting + caller-visible projection, shared by the streaming
     // success path and the non-streaming fallback (anthropic-turn-result.mjs).
@@ -213,8 +226,10 @@ export class AnthropicProvider {
       recovery,
       onStageChange,
       retry529: opts.retry529 !== false,
+      overload,
     });
 
+    let streamingFallbackTried = false;
     try {
       for (let attemptIndex = 0; attemptIndex <= ANTHROPIC_MAX_MIDSTREAM_RETRIES; attemptIndex++) {
         const streamController = createAbortController();
@@ -274,13 +289,13 @@ export class AnthropicProvider {
 
           return buildTurnResult(parseResult);
         } catch (err) {
-          if (err instanceof AnthropicFallbackTriggeredError) {
-            process.stderr.write(`[${this.name}] ${err.message}\n`);
-            return this._doSend(messages, err.fallbackModel, tools, {
-              ...opts,
-              fallbackModel: undefined,
-              _fallbackTriggered: true,
-            });
+          // The fallback trigger is handled around the whole send below.
+          if (err instanceof AnthropicFallbackTriggeredError) throw err;
+          // Gateways that 404 the streaming endpoint but serve non-streaming:
+          // one non-streaming replay (nothing was streamed yet).
+          if (err?.initialResponseError === true && Number(err.status) === 404 && !streamingFallbackTried) {
+            streamingFallbackTried = true;
+            return await recovery.issueNonStreamingFallback(streamController, err);
           }
           // Ordered recovery ladder: canonical outcome stamp, acknowledged
           // non-streaming replay for exposed output, bounded streaming
@@ -300,6 +315,18 @@ export class AnthropicProvider {
         }
       }
       throw midstream.exhaustedError();
+    } catch (err) {
+      // The fallback trigger can surface from the request loop, a mid-stream
+      // overload, or the non-streaming recovery: handle it around the whole
+      // operation, not just the first request.
+      if (!(err instanceof AnthropicFallbackTriggeredError)) throw err;
+      process.stderr.write(`[${this.name}] ${err.message}\n`);
+      announceAnthropicModelFallback(onStageChange, useModel, err.fallbackModel);
+      return await this._doSend(messages, err.fallbackModel, tools, {
+        ...opts,
+        fallbackModel: undefined,
+        _fallbackTriggered: true,
+      });
     } finally {
       totalTimeout.cleanup();
     }

package/src/runtime/agent/orchestrator/providers/antigravity-oauth-catalog.mjs

@@ -11,6 +11,9 @@
  * comes from `retrieveUserQuotaSummary`, not the per-model catalog counters.
  */
 import { makeModelCache } from './model-cache.mjs';
+import { isGeminiFamilyModel } from './gemini-family.mjs';
+import { isAntigravityClaude } from './antigravity-request.mjs';
+import { getModelMetadataSync } from '../../../shared/llm/model-catalog.mjs';
 import {
   ANTIGRAVITY_MODELS,
   PROJECT_ENDPOINT,
@@ -27,8 +30,9 @@ const TIER_EFFORTS = { 'extra low': 'minimal', minimal: 'minimal', low: 'low', m
 const EFFORT_ORDER = ['minimal', 'low', 'medium', 'high'];
 // IDE-internal completion/chat models are listed without a display name.
 const INTERNAL_ID = /^(?:chat|tab)_/;
-// Bare Gemini 3 ids take the ordinary thinkingLevel field instead of a tier id.
-const BARE_GEMINI3_LEVELS = Object.freeze(['low', 'medium', 'high']);
+// The thinkingLevel values the gateway accepts on a single wire id; `minimal`
+// is an error there, so it is never offered even when a catalog lists it.
+const GATEWAY_THINKING_LEVELS = Object.freeze(['low', 'medium', 'high']);
 
 let _mirror = null;
 export const antigravityModelCache = makeModelCache({
@@ -116,6 +120,23 @@ function chatEntries(rawModels) {
   return out;
 }
 
+// A Gemini wire id without tier siblings takes the ordinary thinkingLevel field.
+// The ladder comes from the catalogs' row for the same Gemini id (models.dev /
+// LiteLLM) narrows what the gateway accepts; when no catalog declares a ladder
+// the gateway-accepted levels are offered and the server judges the value.
+// Only a model the gateway does not flag as thinking-capable has no levels.
+function bareThinkingLevels(wire, supportsReasoning) {
+  if (!supportsReasoning) return [];
+  // Claude behind the gateway takes the same thinkingLevel enum; no catalog
+  // describes these wire ids, so the gateway-accepted levels are offered.
+  if (isAntigravityClaude(wire)) return [...GATEWAY_THINKING_LEVELS];
+  if (!isGeminiFamilyModel(wire)) return [];
+  const effort = getModelMetadataSync(wire, 'gemini')?.reasoningOptions?.find((option) => option?.type === 'effort');
+  if (!Array.isArray(effort?.values) || !effort.values.length) return [...GATEWAY_THINKING_LEVELS];
+  const declared = new Set(effort.values.map((value) => String(value).toLowerCase()));
+  return GATEWAY_THINKING_LEVELS.filter((level) => declared.has(level));
+}
+
 /** Collapse the gateway's per-tier wire ids into picker records. */
 export function normalizeAntigravityCatalog(rawModels) {
   const families = new Map();
@@ -142,13 +163,13 @@ export function normalizeAntigravityCatalog(rawModels) {
       ? Object.fromEntries(efforts.map((effort) => [effort, pickWire(family.wires.get(effort), family.base)]))
       : pickWire(family.wires.get(efforts[0] ?? ''), family.base);
     const id = tiered ? key : wire;
-    const bareGemini3 = !tiered && /^gemini-3(?:\.\d+)?-(?:flash|pro)$/.test(wire);
     const display =
       tiered || !efforts.length ? family.base : `${family.base} (${efforts[0][0].toUpperCase()}${efforts[0].slice(1)})`;
     const kind = familyKind(family.base);
-    let reasoningLevels = [];
-    if (tiered) reasoningLevels = efforts;
-    else if (bareGemini3) reasoningLevels = [...BARE_GEMINI3_LEVELS];
+    // A lone labelled tier already names its effort in the wire id.
+    let reasoningLevels = efforts;
+    if (!efforts.length) reasoningLevels = bareThinkingLevels(wire, family.supportsReasoning);
+    else if (!tiered) reasoningLevels = [];
     models.push({
       id,
       name: display,
@@ -174,9 +195,9 @@ function antigravityCatalogModels() {
 
 /**
  * Turn a picker model + effort into the wire id the gateway accepts. Tiered
- * families consume the effort (the id encodes it); a bare Gemini 3 id keeps it
- * for thinkingLevel; every other record drops it because the model has no
- * effort surface. Unknown ids pass through unchanged.
+ * families consume the effort (the id encodes it); a bare id whose record
+ * lists levels keeps it for thinkingLevel; every other record drops it
+ * because the gateway does not flag the model as thinking-capable. Unknown ids pass through unchanged.
  */
 export function resolveAntigravityWireModel(model, effort, models = antigravityCatalogModels()) {
   const id = String(model || '');

package/src/runtime/agent/orchestrator/providers/antigravity-oauth.mjs

@@ -20,6 +20,7 @@ import { preconnect } from '../../../shared/llm/http-agent.mjs';
 import { createAntigravityStreamCollector } from './antigravity-stream.mjs';
 import { createAntigravityRequest } from './antigravity-transport.mjs';
 import { finalizeAntigravityTurn } from './antigravity-response.mjs';
+import { ANTIGRAVITY_ACCOUNT_COOLDOWN_POLICY } from './antigravity-retry-policy.mjs';
 import {
   CONTENT_ENDPOINT,
   ANTIGRAVITY_MODELS,
@@ -69,6 +70,11 @@ export class AntigravityOAuthProvider {
   // usageMetadata.promptTokenCount is the total, cached tokens included.
   static inputExcludesCache = false;
   name = 'antigravity-oauth';
+  // Roster cooldowns the shared account pool applies when the server names no delay.
+  accountCooldownPolicy = ANTIGRAVITY_ACCOUNT_COOLDOWN_POLICY;
+  // The capacity / quick-retry ladder is the whole recovery: a spent ladder
+  // surfaces instead of parking on loop recovery cycles.
+  retryPolicy = Object.freeze({ recoveryCycles: false });
 
   constructor(config = {}) {
     this.config = config || {};
@@ -162,6 +168,7 @@ export class AntigravityOAuthProvider {
       opts,
       signal: passthrough.signal,
       collector,
+      sleepFn: this.config.sleepFn,
     });
     try {
       try {

package/src/runtime/agent/orchestrator/providers/antigravity-request.mjs

@@ -2,10 +2,15 @@ import { randomUUID, createHash } from 'node:crypto';
 import { createProviderReplay, providerReplayItems } from './lib/provider-replay.mjs';
 import { toGeminiContents, toGeminiRequestTools, toGeminiToolConfig } from './gemini-schema.mjs';
 import { geminiThinkingConfig } from './gemini-thinking.mjs';
+import { isGeminiFamilyModel } from './gemini-family.mjs';
 
 const THOUGHT_SIGNATURE_SENTINEL = 'skip_thought_signature_validator';
 const CLAUDE_MAX_OUTPUT_TOKENS = 64000;
 
+// Claude models behind the gateway speak a different thinking/replay dialect
+// (token budgets, anthropic-beta header, their own signatures). The roster
+// carries no protocol marker, and a wrong guess is rejected upstream, so the
+// vendor prefix of the wire id decides.
 export function isAntigravityClaude(model) {
   return /^claude-/i.test(String(model || ''));
 }
@@ -59,33 +64,44 @@ function sessionId(contents) {
   return `-${digest.readBigUInt64BE(0) % 9223372036854775807n}`;
 }
 
+// The gateway validates Claude's level against Google's ThinkingLevel enum,
+// whose highest value is `high`; anything it does not name is left out.
+const CLAUDE_GATEWAY_LEVELS = new Set(['low', 'medium', 'high']);
+function claudeGatewayLevel(value) {
+  const level = String(value ?? '').toLowerCase();
+  if (level === 'xhigh' || level === 'max' || level === 'ultra') return 'high';
+  return CLAUDE_GATEWAY_LEVELS.has(level) ? level : null;
+}
+
+// An explicit token budget is sent as-is; otherwise the chosen effort rides
+// on thinkingLevel with the wire id unchanged.
 function claudeThinkingConfig(opts) {
   const budget = opts.thinkingBudget ?? opts.thinkingBudgetTokens;
-  if (opts.thinkingLevel != null || (budget == null && opts.effort != null)) {
-    throw new TypeError(
-      'Antigravity Claude uses thinkingBudget; effort levels cannot be converted to a token budget automatically.'
-    );
-  }
   const thinkingConfig = { includeThoughts: true };
-  if (budget != null) {
-    const value = Number(budget);
-    if (!Number.isInteger(value) || value < 1024 || value >= CLAUDE_MAX_OUTPUT_TOKENS) {
-      throw new TypeError('Antigravity Claude thinkingBudget must be an integer from 1024 to 63999.');
-    }
-    thinkingConfig.thinkingBudget = value;
+  if (budget == null) {
+    const level = claudeGatewayLevel(opts.thinkingLevel ?? opts.effort);
+    if (level) thinkingConfig.thinkingLevel = level;
+    return thinkingConfig;
+  }
+  const value = Number(budget);
+  if (!Number.isInteger(value) || value < 1024 || value >= CLAUDE_MAX_OUTPUT_TOKENS) {
+    throw new TypeError('Antigravity Claude thinkingBudget must be an integer from 1024 to 63999.');
   }
+  thinkingConfig.thinkingBudget = value;
   return thinkingConfig;
 }
 
 // Tiered wire ids (gemini-3.8-flash-high) already encode the thinking
 // level; the provider resolves them from the catalog and clears the
 // effort, so only bare ids reach this field.
-// Thought summaries on by default for every Gemini family, matching the
+// Thought summaries on by default for every Gemini-family model, matching the
 // API-key provider. The gateway also serves GPT-OSS, which rejects the
-// thinking fields outright, so the flag stays Gemini-only.
+// thinking fields outright and which the roster's thinking flag does not
+// separate from Gemini, so the flag stays Gemini-only.
 function antigravityGeminiThinkingConfig(model, opts) {
   return geminiThinkingConfig(model, opts, {
-    includeThoughts: /^gemini-/i.test(model) ? true : undefined,
+    provider: 'antigravity-oauth',
+    includeThoughts: isGeminiFamilyModel(model) ? true : undefined,
   });
 }
 

package/src/runtime/agent/orchestrator/providers/antigravity-response.mjs

@@ -9,6 +9,7 @@
 import { traceAgentUsage } from '../agent-trace.mjs';
 import { createProviderReplay } from './lib/provider-replay.mjs';
 import { parseToolCalls, collectGeminiGroundingSources, parseGeminiTextPartMetadata } from './gemini-schema.mjs';
+import { geminiPolicyFinishCode } from './gemini-error-contract.mjs';
 
 // Pure usageMetadata normalization shared by the success path and a failed
 // stream's partialUsage.
@@ -82,7 +83,7 @@ export function finalizeAntigravityTurn({ response, collector, useModel, opts, o
   if (finishReason && normalizedFinish !== 'STOP') {
     throw Object.assign(new Error(`Antigravity response incomplete: finishReason=${finishReason}`), {
       name: 'ProviderIncompleteError',
-      code: 'PROVIDER_INCOMPLETE',
+      code: geminiPolicyFinishCode(finishReason) || 'PROVIDER_INCOMPLETE',
       providerIncomplete: true,
       finishReason,
       partialContent: content,

package/src/runtime/agent/orchestrator/providers/antigravity-retry-policy.mjs

@@ -0,0 +1,93 @@
+/**
+ * antigravity-retry-policy.mjs — Antigravity retry constants and the verdict
+ * for a 429:
+ *
+ *   capacity (429/503/529, MODEL_CAPACITY_EXHAUSTED, "server busy"): retried on
+ *     the SAME account and host with 1s → 2s → 4s (8s cap) ±10% jitter, three
+ *     retries, whatever wait the server names, then the failure surfaces.
+ *   Endpoint: the reference falls back to its next endpoint after a failure;
+ *     generation here deliberately stays on the single daily host and never
+ *     walks an endpoint list (a spent ladder surfaces to the account layer).
+ *   RPM / unknown 429: ONE quick retry after 1s (or the server's advice, up to
+ *     60s), then the failure surfaces so the account layer can lock and
+ *     rotate; advice beyond 60s surfaces at once.
+ *   QUOTA_EXHAUSTED (and any day/plan window): never retried here.
+ *
+ * Replay stays gated by the stream-outcome contract: an attempt that exposed
+ * text or dispatched a tool is never re-issued.
+ */
+import { readStreamOutcome } from './lib/stream-outcome.mjs';
+import { DETERMINISTIC_KINDS, providerErrorKind } from './provider-error-kind.mjs';
+
+export const ANTIGRAVITY_CAPACITY_RETRIES = 3;
+export const ANTIGRAVITY_CAPACITY_BASE_MS = 1000;
+export const ANTIGRAVITY_CAPACITY_MAX_MS = 8000;
+export const ANTIGRAVITY_CAPACITY_JITTER_RATIO = 0.1;
+export const ANTIGRAVITY_QUICK_RETRY_MS = 1000;
+export const ANTIGRAVITY_QUICK_RETRY_MAX_ADVICE_MS = 60_000;
+
+// withRetry options for everything that is not a 429: transient transport and
+// 5xx failures use the capacity schedule (the reference has no other same-host
+// retry; the leading duplicate is the sleep-before-attempt index).
+export const ANTIGRAVITY_RETRY = Object.freeze({
+  maxAttempts: ANTIGRAVITY_CAPACITY_RETRIES + 1,
+  backoffMs: Object.freeze([1000, 1000, 2000, 4000]),
+  retryJitterRatio: ANTIGRAVITY_CAPACITY_JITTER_RATIO,
+  // 429s are handled by antigravity429WaitMs, not the generic loop.
+  retry429: false,
+});
+
+/** Capacity wait for retry number `retryIndex` (0-based): 1s, 2s, 4s, 8s cap, ±10%. */
+export function antigravityCapacityDelayMs(retryIndex) {
+  const base = Math.min(ANTIGRAVITY_CAPACITY_BASE_MS * 2 ** retryIndex, ANTIGRAVITY_CAPACITY_MAX_MS);
+  return Math.round(base * (1 - ANTIGRAVITY_CAPACITY_JITTER_RATIO + Math.random() * 2 * ANTIGRAVITY_CAPACITY_JITTER_RATIO));
+}
+
+export function isAntigravityCapacityError(err) {
+  return err?.code === 'model_capacity_exhausted' || providerErrorKind(err).kind === 'overloaded';
+}
+
+/**
+ * Wait before re-issuing a 429, or null when it must surface. `state` is the
+ * send's `{ capacityRetries, quickRetried }` record.
+ */
+export function antigravity429WaitMs(err, state) {
+  const status = Number(err?.status || err?.httpStatus || 0);
+  const capacity = isAntigravityCapacityError(err);
+  if (status !== 429 && !(capacity && (status === 503 || status === 529))) return null;
+  if (readStreamOutcome(err).replaySafe !== true) return null;
+  const { kind, retryAfterMs } = providerErrorKind(err);
+  if (DETERMINISTIC_KINDS.has(kind) || err.code === 'quota_exhausted' || err.quotaScope === 'day' || err.quotaScope === 'plan') {
+    return null;
+  }
+  // Capacity follows the local schedule whatever wait the server names.
+  if (capacity) {
+    if (state.capacityRetries >= ANTIGRAVITY_CAPACITY_RETRIES) return null;
+    return antigravityCapacityDelayMs(state.capacityRetries++);
+  }
+  // An RPM hit gets one quick retry; advice up to a minute is honored in
+  // full, a longer wait surfaces so the account pool can rotate.
+  if (state.quickRetried || retryAfterMs > ANTIGRAVITY_QUICK_RETRY_MAX_ADVICE_MS) return null;
+  state.quickRetried = true;
+  return retryAfterMs ?? ANTIGRAVITY_QUICK_RETRY_MS;
+}
+
+// Account-pool roster cooldowns, read
+// generically by the shared pool from the provider's `accountCooldownPolicy`
+// when the server named no delay: a plain rate limit rotates the account for
+// 30s; a spent quota escalates 60s → 5m → 30m → 2h per consecutive refusal of
+// that account (a served answer resets it); anything else 60s; never under 2s.
+// Capacity and server errors never block an account in the shared pool.
+export const ANTIGRAVITY_ACCOUNT_COOLDOWN_POLICY = Object.freeze({
+  floorMs: 2_000,
+  rateLimitedMs: 30_000,
+  quotaStepsMs: Object.freeze([60_000, 5 * 60_000, 30 * 60_000, 2 * 60 * 60_000]),
+  unknownMs: 60_000,
+  rotateOnRateLimit: true,
+  // A roster that is only cooling down waits up to five minutes for its
+  // earliest cooldown instead of failing the send.
+  waitForCooldownMs: 300_000,
+  // An account that needs verification cools for ten minutes while the
+  // roster serves from the next account.
+  blockedMs: 600_000,
+});

package/src/runtime/agent/orchestrator/providers/antigravity-transport.mjs

@@ -6,13 +6,45 @@
  * account-verification URL Google hides in the error details), and the
  * per-attempt hand-off of the live stream to the turn collector.
  */
-import { emitProviderRetryStage, withRetry } from './retry-classifier.mjs';
+import { emitProviderRetryStage, markProviderRecoveryExhausted, sleepWithAbort, withRetry } from './retry-classifier.mjs';
+import {
+  ANTIGRAVITY_RETRY,
+  antigravity429WaitMs,
+  isAntigravityCapacityError,
+} from './antigravity-retry-policy.mjs';
 import { createTimeoutSignal } from '../stall-policy.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
 import { GEMINI_FIRST_BYTE_TIMEOUT_MS } from './gemini-stream.mjs';
 import { _scrubTokens } from './antigravity-oauth-tokens.mjs';
+import { applyGeminiErrorContract } from './gemini-error-contract.mjs';
+import { DETERMINISTIC_KINDS, providerErrorKind } from './provider-error-kind.mjs';
 
-function antigravityError(res, text, endpoint) {
+// Rate-limit reason: 503/529 are capacity by status; a
+// typed ErrorInfo reason decides next; wording is the last resort for a 429.
+const CAPACITY_MESSAGE_RE = /capacity|overloaded|resource exhausted|server (?:is )?(?:currently )?busy/i;
+const RATE_LIMIT_MESSAGE_RE = /per minute|rate limit|too many requests/i;
+const TYPED_REASONS = new Set(['quota_exhausted', 'rate_limit_exceeded', 'model_capacity_exhausted']);
+
+function applyAntigravityRateLimitReason(err, status, message) {
+  if (status === 503 || status === 529) {
+    // A typed refusal of this request (bad argument, policy, auth, quota) is
+    // not an overload whatever the status says.
+    if (DETERMINISTIC_KINDS.has(providerErrorKind(err).kind)) return;
+    err.code = 'model_capacity_exhausted';
+    return;
+  }
+  if (status !== 429 || TYPED_REASONS.has(err.code)) return;
+  if (CAPACITY_MESSAGE_RE.test(message)) err.code = 'model_capacity_exhausted';
+  else if (RATE_LIMIT_MESSAGE_RE.test(message)) err.code = 'rate_limit_exceeded';
+}
+
+const CAPACITY_STATUSES = new Set([429, 503, 529]);
+
+function isCapacityFailure(err) {
+  return CAPACITY_STATUSES.has(Number(err?.status)) && isAntigravityCapacityError(err);
+}
+
+export function antigravityError(res, text, endpoint) {
   let payload = null;
   try {
     payload = text ? JSON.parse(text) : null;
@@ -30,7 +62,11 @@ function antigravityError(res, text, endpoint) {
     err.error = detail;
     err.data = payload;
     if (detail.status) err.geminiStatus = detail.status;
+    const details = detail.details ?? detail.errorDetails;
+    applyGeminiErrorContract(err, { details, googleStatus: detail.status, message });
   }
+  // Capacity is overload of the shared model pool, not this account's quota.
+  applyAntigravityRateLimitReason(err, res.status, message);
   // Account verification is terminal and actionable: surface the URL Google
   // returns instead of a raw API body the user cannot act on.
   // Google puts the link in the error details, not the message text.
@@ -47,6 +83,9 @@ function antigravityError(res, text, endpoint) {
     err.message = `Antigravity requires account verification${validationUrl ? `: open ${validationUrl} , complete the check, then retry` : ''}`;
     err.validationUrl = validationUrl || undefined;
     err.unsafeToRetry = true;
+    // This account needs verification; another account may still serve.
+    err.code ||= 'validation_required';
+    err.accountBlocked = true;
   }
   return err;
 }
@@ -62,8 +101,17 @@ function antigravityError(res, text, endpoint) {
  * @param {{ beginAttempt: Function, consume: Function }} deps.collector
  * @returns {() => Promise<object>} one retried request that resolves the final payload
  */
-export function createAntigravityRequest({ fetchFn, endpoint, headers, body, opts, signal, collector }) {
-  return () =>
+export function createAntigravityRequest({ fetchFn, endpoint, headers, body, opts, signal, collector, sleepFn }) {
+  const log = (attempt, lastErr, delayMs) => {
+    emitProviderRetryStage(opts.onStageChange, {
+      attempt: attempt + 1,
+      maxAttempts: ANTIGRAVITY_RETRY.maxAttempts,
+      lastErr,
+      delayMs,
+    });
+    process.stderr.write(`[antigravity] retry ${attempt + 1} after ${lastErr?.message || 'transient error'}\n`);
+  };
+  const attemptOnce = () =>
     withRetry(
       async ({ signal: attemptSignal }) => {
         try {
@@ -94,17 +142,42 @@ export function createAntigravityRequest({ fetchFn, endpoint, headers, body, opt
         }
         if (!res.ok) {
           const text = await res.text().catch(() => '');
-          throw antigravityError(res, text, endpoint);
+          const failure = antigravityError(res, text, endpoint);
+          // Capacity is paced by the local schedule below; the generic loop
+          // would sleep whatever wait the server names.
+          if (isCapacityFailure(failure)) markProviderRecoveryExhausted(failure, { owner: 'antigravity-capacity' });
+          throw failure;
         }
         collector.beginAttempt();
         return collector.consume(res, attemptSignal);
       },
       {
+        ...ANTIGRAVITY_RETRY,
+        finalOnExhaust: true,
         signal,
-        onRetry: ({ attempt, maxAttempts, lastErr: retryErr, delayMs }) => {
-          emitProviderRetryStage(opts.onStageChange, { attempt: attempt + 1, maxAttempts, lastErr: retryErr, delayMs });
-          process.stderr.write(`[antigravity] retry ${attempt + 1} after ${retryErr?.message || 'transient error'}\n`);
-        },
+        sleepFn,
+        onRetry: ({ attempt, lastErr: retryErr, delayMs }) => log(attempt, retryErr, delayMs),
       }
     );
+  // A 429 comes back from withRetry untouched (retry429:false) and is paced by
+  // the retry schedule: capacity backs off on this host, an RPM hit
+  // gets one quick retry, a spent quota surfaces.
+  return async () => {
+    const state = { capacityRetries: 0, quickRetried: false };
+    for (let tried = 1; ; tried++) {
+      try {
+        return await attemptOnce();
+      } catch (err) {
+        const waitMs = antigravity429WaitMs(err, state);
+        if (waitMs == null) {
+          if (isCapacityFailure(err)) {
+            markProviderRecoveryExhausted(err, { owner: 'antigravity-capacity', attempts: tried });
+          }
+          throw err;
+        }
+        log(tried, err, waitMs);
+        await sleepWithAbort(waitMs, signal, sleepFn, 'Antigravity retry wait aborted');
+      }
+    }
+  };
 }

package/src/runtime/agent/orchestrator/providers/command-code-oauth.mjs

@@ -11,6 +11,7 @@
 import { noteErrorUsage } from './lib/note-error-usage.mjs';
 import { fileMtimeMs, normalizeExpiresAtMs, scrubOAuthSecrets } from './lib/oauth-token-utils.mjs';
 import { OpenAICompatProvider, preloadOpenAICompatRuntime } from './openai-compat.mjs';
+import { COMPAT_RETRY_POLICY } from './openai-compat-retry-profile.mjs';
 import { listCompatModels } from './openai-compat-models.mjs';
 import { AnthropicProvider } from './anthropic.mjs';
 import { toInclusiveOpenCodeGoUsage as toInclusiveUsage } from './opencode-go.mjs';
@@ -242,6 +243,8 @@ export class CommandCodeOAuthProvider {
   // OpenAI-compatible usage: prompt_tokens includes cached. See registry.mjs.
   static inputExcludesCache = false;
   name = PROVIDER_ID;
+  // The retry profile's limits are final: no loop-level recovery cycles on top.
+  retryPolicy = COMPAT_RETRY_POLICY;
   config;
   tokens = null;
   _inner = null;

package/src/runtime/agent/orchestrator/providers/cursor-auth.mjs

@@ -8,6 +8,7 @@ import { modelProxyClientMode } from '../../../shared/model-proxy-mode.mjs';
 import { openInBrowser } from '../../../shared/open-url.mjs';
 import { createOAuthPkce } from './lib/oauth-pkce.mjs';
 import { accountIdentityFields, normalizeAccountIdentity } from './lib/oauth-token-utils.mjs';
+import { retryAfterMsFromError } from './retry-classifier.mjs';
 
 const LOGIN_URL = 'https://cursor.com/loginDeepControl';
 const POLL_URL = 'https://api2.cursor.sh/auth/poll';
@@ -17,6 +18,23 @@ const REFRESH_SKEW_MS = 5 * 60_000;
 // abort signal, which must never govern work every other waiter depends on.
 const REFRESH_TIMEOUT_MS = 30_000;
 const refreshesInFlight = new Map();
+export const REAUTH_GUIDANCE = 'Open /providers in Mixdog to sign in again.';
+// The refresh credential itself was rejected.
+const PERMANENT_REFRESH_STATUS = new Set([400, 401, 403]);
+const EXCHANGE_STATUS_CODE = Object.freeze({
+  400: 'invalid_argument',
+  401: 'unauthenticated',
+  403: 'permission_denied',
+  429: 'resource_exhausted',
+  500: 'internal',
+  502: 'unavailable',
+  503: 'unavailable',
+  504: 'deadline_exceeded',
+});
+
+function reauthError(message) {
+  return Object.assign(new Error(message), { reauthRequired: true });
+}
 
 // Wait on the shared refresh while still honouring THIS caller's abort signal.
 // Aborting only ends this caller's wait; the exchange keeps running for the
@@ -197,8 +215,25 @@ export async function exchangeCursorToken(token, { fetchFn = fetch, signal } = {
   });
   if (!response.ok) {
     const detail = await response.text().catch(() => '');
-    const error = new Error(`Cursor token exchange failed (${response.status})${detail ? `: ${detail}` : ''}`);
+    // Only a credential verdict is permanent; throttles, 5xx and network
+    // failures leave the refresh token valid and stay retryable upstream.
+    const reauthRequired = PERMANENT_REFRESH_STATUS.has(response.status);
+    const error = new Error(
+      `Cursor token exchange failed (${response.status})${detail ? `: ${detail}` : ''}${
+        reauthRequired ? `. ${REAUTH_GUIDANCE}` : ''
+      }`
+    );
     error.status = response.status;
+    error.httpStatus = response.status;
+    const code = EXCHANGE_STATUS_CODE[response.status];
+    if (code) error.code = code;
+    const headers = Object.fromEntries(response.headers?.entries?.() ?? []);
+    if (Object.keys(headers).length) {
+      error.headers = headers;
+      const retryAfterMs = retryAfterMsFromError(error);
+      if (Number.isFinite(retryAfterMs)) error.retryAfterMs = retryAfterMs;
+    }
+    if (reauthRequired) error.reauthRequired = true;
     throw error;
   }
   const data = await response.json();
@@ -277,9 +312,7 @@ export async function resolveCursorOAuthAccessToken({ forceRefresh = false, fetc
   if (!forceRefresh && !expiring) return tokens.access_token;
   if (!tokens.refresh_token) {
     if (!tokens.expires_at || tokens.expires_at > Date.now()) return tokens.access_token;
-    throw new Error(
-      'Cursor access token expired and has no refresh token. Open /providers in Mixdog to sign in again.'
-    );
+    throw reauthError(`Cursor access token expired and has no refresh token. ${REAUTH_GUIDANCE}`);
   }
   const refreshPath = credentialsPath();
   let refreshInFlight = refreshesInFlight.get(refreshPath);
@@ -296,7 +329,7 @@ export async function resolveCursorOAuthAccessToken({ forceRefresh = false, fetc
           return latest;
         }
         if (!latest.refresh_token) {
-          throw new Error('Cursor OAuth refresh token is unavailable. Open /providers in Mixdog to sign in again.');
+          throw reauthError(`Cursor OAuth refresh token is unavailable. ${REAUTH_GUIDANCE}`);
         }
         // Deliberately NOT the caller's signal: this exchange is shared by
         // every concurrent waiter, so letting the first caller's abort

package/src/runtime/agent/orchestrator/providers/cursor-client-version.mjs

@@ -4,7 +4,7 @@ import { createRemoteVersionSource } from './npm-cli-version.mjs';
 // documented version endpoint; the official installer script embeds the
 // current build (…/lab/<build>/…), parsed best-effort. Any format change or
 // failure falls back to the floor.
-export const CURSOR_CLIENT_VERSION_FLOOR = 'cli-2026.10.12-d47ca18';
+export const CURSOR_CLIENT_VERSION_FLOOR = 'cli-2026.10.14-0f9edde';
 const BUILD_PATTERN = /downloads\.cursor\.com\/lab\/(\d{4}\.\d{2}\.\d{2}-[0-9a-f]{6,40})\//;
 export const CURSOR_INSTALL_URL = 'https://cursor.com/install';