mixdog 1.2.1 → 1.2.3

package/src/runtime/agent/orchestrator/providers/antigravity-stream.mjs

@@ -1,18 +1,15 @@
 /**
  * antigravity-stream.mjs — what one Antigravity SSE turn accumulates while it
  * streams: the live text mirror a retirement notice is recognised from, the
- * ordered parts of every chunk, the native tool calls parsed per chunk with
- * their id dedup, the leak guard that recovers calls the model wrote as text,
- * the first terminal finishReason, and the exposure marks a failed stream must
- * carry (emittedToolCall / unsafeToRetry / partial calls + partial replay).
+ * leak guard that recovers calls the model wrote as text (held back, like the
+ * native calls, until the turn finishes cleanly), and the first terminal
+ * finishReason. Nothing is dispatched while streaming.
  *
  * The transport (antigravity-transport.mjs) owns the socket and the retry
  * policy; the projection (antigravity-response.mjs) reads this record after
  * the turn settles.
  */
-import { createProviderReplay } from './lib/provider-replay.mjs';
 import { createGeminiTextLeakGuard, consumeGeminiRestStreamResponse } from './gemini-stream.mjs';
-import { parseToolCalls, emitGeminiToolCalls } from './gemini-schema.mjs';
 import { normalizeAntigravityUsage } from './antigravity-response.mjs';
 
 // A retired wire id answers with one plain-text notice and no finishReason.
@@ -46,10 +43,6 @@ export function createAntigravityStreamCollector({ tools, useModel, onToolCall,
   // Streamed text is kept so a retirement notice can be told apart from
   // a truncated stream when the gateway omits the finishReason.
   let streamedText = '';
-  let streamedParts = [];
-  let streamedNativeToolCalls = [];
-  const seenNativeToolIds = new Set();
-  const emittedToolIds = new Set();
 
   const relayText = onTextDelta
     ? (text) => {
@@ -57,15 +50,9 @@ export function createAntigravityStreamCollector({ tools, useModel, onToolCall,
         onTextDelta(text);
       }
     : null;
-  const dispatchToolCall = onToolCall
-    ? (call) => {
-        // A failure already observed in this chunk must win over both
-        // native calls and calls recovered from its text.
-        if (terminalFailure || emittedToolIds.has(call.id)) return;
-        emittedToolIds.add(call.id);
-        onToolCall(call);
-      }
-    : null;
+  // Tool calls (native and text-recovered) are never dispatched while the
+  // stream runs: the turn's terminal verdict decides, and
+  // finalizeAntigravityTurn releases them only after a clean finish.
   const onChunk = (chunk) => {
     const candidate = chunk?.candidates?.[0];
     const finishReason =
@@ -74,37 +61,20 @@ export function createAntigravityStreamCollector({ tools, useModel, onToolCall,
     if (finishReason && String(finishReason).replace(/^FINISH_REASON_/, '') !== 'STOP') {
       terminalFailure ||= finishReason;
     }
-    if (!onToolCall) return;
-    const parts = candidate?.content?.parts ?? [];
-    streamedParts.push(...parts);
-    if (terminalFailure || !parts.some((part) => part?.functionCall)) return;
-    // Parse against the turn's parts so anonymous call IDs keep the
-    // same ordinal as final parsing, even across separate SSE chunks.
-    const fresh = (parseToolCalls(streamedParts) || []).filter((call) => {
-      if (seenNativeToolIds.has(call.id)) return false;
-      seenNativeToolIds.add(call.id);
-      return true;
-    });
-    const calls = textLeakGuard?.enabled ? textLeakGuard.filterNativeToolCalls(fresh) : fresh;
-    if (calls?.length) streamedNativeToolCalls.push(...calls);
-    emitGeminiToolCalls(calls, dispatchToolCall);
   };
 
   // Each attempt starts from an empty record: a replayed request must not
-  // inherit the dead attempt's text, parts or dispatched-call ids.
+  // inherit the dead attempt's text or failure.
   const beginAttempt = () => {
     textLeakGuard = createGeminiTextLeakGuard({
       knownToolNames: tools?.map((t) => t.name).filter(Boolean) ?? [],
       onTextDelta: relayText,
-      onToolCall: dispatchToolCall,
+      onToolCall,
       onStreamDelta,
+      deferToolCalls: true,
     });
     streamedText = '';
     terminalFailure = null;
-    streamedParts = [];
-    streamedNativeToolCalls = [];
-    seenNativeToolIds.clear();
-    emittedToolIds.clear();
   };
   const releaseGuard = () => {
     textLeakGuard = null;
@@ -125,22 +95,7 @@ export function createAntigravityStreamCollector({ tools, useModel, onToolCall,
         unwrapChunk: (chunk) => (chunk && typeof chunk === 'object' && chunk.response ? chunk.response : chunk),
       });
     } catch (streamErr) {
-      const error = retiredModelError(streamErr, streamedText, useModel) || streamErr;
-      // Native calls now run before EOF. Preserve
-      // their history and prohibit resampling after
-      // a tool callback.
-      if (emittedToolIds.size) {
-        error.emittedToolCall = true;
-        error.unsafeToRetry = true;
-        const leaked = textLeakGuard.getLeakedToolCalls();
-        error.partialToolCalls = [...streamedNativeToolCalls, ...leaked];
-        const replay = createProviderReplay('antigravity', leaked.length ? [] : streamedParts);
-        if (replay) {
-          replay.requestContext = { model: useModel };
-          error.partialProviderReplay = replay;
-        }
-      }
-      throw error;
+      throw retiredModelError(streamErr, streamedText, useModel) || streamErr;
     }
   };
 
@@ -155,11 +110,5 @@ export function createAntigravityStreamCollector({ tools, useModel, onToolCall,
     get terminalFailure() {
       return terminalFailure;
     },
-    get streamedNativeToolCalls() {
-      return streamedNativeToolCalls;
-    },
-    get emittedToolCount() {
-      return emittedToolIds.size;
-    },
   };
 }

package/src/runtime/agent/orchestrator/providers/antigravity-transport.mjs

@@ -6,13 +6,45 @@
  * account-verification URL Google hides in the error details), and the
  * per-attempt hand-off of the live stream to the turn collector.
  */
-import { emitProviderRetryStage, withRetry } from './retry-classifier.mjs';
+import { emitProviderRetryStage, markProviderRecoveryExhausted, sleepWithAbort, withRetry } from './retry-classifier.mjs';
+import {
+  ANTIGRAVITY_RETRY,
+  antigravity429WaitMs,
+  isAntigravityCapacityError,
+} from './antigravity-retry-policy.mjs';
 import { createTimeoutSignal } from '../stall-policy.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
 import { GEMINI_FIRST_BYTE_TIMEOUT_MS } from './gemini-stream.mjs';
 import { _scrubTokens } from './antigravity-oauth-tokens.mjs';
+import { applyGeminiErrorContract } from './gemini-error-contract.mjs';
+import { DETERMINISTIC_KINDS, providerErrorKind } from './provider-error-kind.mjs';
 
-function antigravityError(res, text, endpoint) {
+// Rate-limit reason: 503/529 are capacity by status; a
+// typed ErrorInfo reason decides next; wording is the last resort for a 429.
+const CAPACITY_MESSAGE_RE = /capacity|overloaded|resource exhausted|server (?:is )?(?:currently )?busy/i;
+const RATE_LIMIT_MESSAGE_RE = /per minute|rate limit|too many requests/i;
+const TYPED_REASONS = new Set(['quota_exhausted', 'rate_limit_exceeded', 'model_capacity_exhausted']);
+
+function applyAntigravityRateLimitReason(err, status, message) {
+  if (status === 503 || status === 529) {
+    // A typed refusal of this request (bad argument, policy, auth, quota) is
+    // not an overload whatever the status says.
+    if (DETERMINISTIC_KINDS.has(providerErrorKind(err).kind)) return;
+    err.code = 'model_capacity_exhausted';
+    return;
+  }
+  if (status !== 429 || TYPED_REASONS.has(err.code)) return;
+  if (CAPACITY_MESSAGE_RE.test(message)) err.code = 'model_capacity_exhausted';
+  else if (RATE_LIMIT_MESSAGE_RE.test(message)) err.code = 'rate_limit_exceeded';
+}
+
+const CAPACITY_STATUSES = new Set([429, 503, 529]);
+
+function isCapacityFailure(err) {
+  return CAPACITY_STATUSES.has(Number(err?.status)) && isAntigravityCapacityError(err);
+}
+
+export function antigravityError(res, text, endpoint) {
   let payload = null;
   try {
     payload = text ? JSON.parse(text) : null;
@@ -30,23 +62,36 @@ function antigravityError(res, text, endpoint) {
     err.error = detail;
     err.data = payload;
     if (detail.status) err.geminiStatus = detail.status;
+    const details = detail.details ?? detail.errorDetails;
+    applyGeminiErrorContract(err, { details, googleStatus: detail.status, message });
   }
+  // Capacity is overload of the shared model pool, not this account's quota.
+  applyAntigravityRateLimitReason(err, res.status, message);
   // Account verification is terminal and actionable: surface the URL Google
   // returns instead of a raw API body the user cannot act on.
   // Google puts the link in the error details, not the message text.
-  const validationDetail = Array.isArray(detail?.details)
-    ? detail.details.find(
-        (entry) => entry?.reason === 'VALIDATION_REQUIRED' && typeof entry.metadata?.validation_url === 'string'
-      )
-    : null;
+  // Order: google.rpc.Help.links, metadata.validation_url, metadata.validation_link.
+  const detailEntries = Array.isArray(detail?.details) ? detail.details : [];
+  const helpUrl = detailEntries
+    .flatMap((entry) => (Array.isArray(entry?.links) ? entry.links : []))
+    .map((link) => link?.url)
+    .find((url) => typeof url === 'string' && url.length > 0);
+  const metadataUrl = (key) =>
+    detailEntries.find((entry) => entry?.reason === 'VALIDATION_REQUIRED' && typeof entry.metadata?.[key] === 'string' && entry.metadata[key])
+      ?.metadata[key];
   const validationUrl =
-    validationDetail?.metadata.validation_url ||
+    helpUrl ||
+    metadataUrl('validation_url') ||
+    metadataUrl('validation_link') ||
     /https:\/\/\S*(?:accounts|console)\.google\.com\/\S+/.exec(message || '')?.[0] ||
     '';
   if (res.status === 403 && /VALIDATION_REQUIRED/i.test(text || '')) {
     err.message = `Antigravity requires account verification${validationUrl ? `: open ${validationUrl} , complete the check, then retry` : ''}`;
     err.validationUrl = validationUrl || undefined;
     err.unsafeToRetry = true;
+    // This account needs verification; another account may still serve.
+    err.code ||= 'validation_required';
+    err.accountBlocked = true;
   }
   return err;
 }
@@ -62,8 +107,17 @@ function antigravityError(res, text, endpoint) {
  * @param {{ beginAttempt: Function, consume: Function }} deps.collector
  * @returns {() => Promise<object>} one retried request that resolves the final payload
  */
-export function createAntigravityRequest({ fetchFn, endpoint, headers, body, opts, signal, collector }) {
-  return () =>
+export function createAntigravityRequest({ fetchFn, endpoint, headers, body, opts, signal, collector, sleepFn }) {
+  const log = (attempt, lastErr, delayMs) => {
+    emitProviderRetryStage(opts.onStageChange, {
+      attempt: attempt + 1,
+      maxAttempts: ANTIGRAVITY_RETRY.maxAttempts,
+      lastErr,
+      delayMs,
+    });
+    process.stderr.write(`[antigravity] retry ${attempt + 1} after ${lastErr?.message || 'transient error'}\n`);
+  };
+  const attemptOnce = () =>
     withRetry(
       async ({ signal: attemptSignal }) => {
         try {
@@ -94,17 +148,42 @@ export function createAntigravityRequest({ fetchFn, endpoint, headers, body, opt
         }
         if (!res.ok) {
           const text = await res.text().catch(() => '');
-          throw antigravityError(res, text, endpoint);
+          const failure = antigravityError(res, text, endpoint);
+          // Capacity is paced by the local schedule below; the generic loop
+          // would sleep whatever wait the server names.
+          if (isCapacityFailure(failure)) markProviderRecoveryExhausted(failure, { owner: 'antigravity-capacity' });
+          throw failure;
         }
         collector.beginAttempt();
         return collector.consume(res, attemptSignal);
       },
       {
+        ...ANTIGRAVITY_RETRY,
+        finalOnExhaust: true,
         signal,
-        onRetry: ({ attempt, maxAttempts, lastErr: retryErr, delayMs }) => {
-          emitProviderRetryStage(opts.onStageChange, { attempt: attempt + 1, maxAttempts, lastErr: retryErr, delayMs });
-          process.stderr.write(`[antigravity] retry ${attempt + 1} after ${retryErr?.message || 'transient error'}\n`);
-        },
+        sleepFn,
+        onRetry: ({ attempt, lastErr: retryErr, delayMs }) => log(attempt, retryErr, delayMs),
       }
     );
+  // A 429 comes back from withRetry untouched (retry429:false) and is paced by
+  // the retry schedule: capacity backs off on this host, an RPM hit
+  // gets one quick retry, a spent quota surfaces.
+  return async () => {
+    const state = { capacityRetries: 0, quickRetried: false };
+    for (let tried = 1; ; tried++) {
+      try {
+        return await attemptOnce();
+      } catch (err) {
+        const waitMs = antigravity429WaitMs(err, state);
+        if (waitMs == null) {
+          if (isCapacityFailure(err)) {
+            markProviderRecoveryExhausted(err, { owner: 'antigravity-capacity', attempts: tried });
+          }
+          throw err;
+        }
+        log(tried, err, waitMs);
+        await sleepWithAbort(waitMs, signal, sleepFn, 'Antigravity retry wait aborted');
+      }
+    }
+  };
 }

package/src/runtime/agent/orchestrator/providers/codex-client-meta.mjs

@@ -20,7 +20,7 @@ import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
 // version (gpt-6.1-sol requires >= 0.159.0, measured 2026-10-09), so the
 // release workflow raises this to the published CLI version on every release
 // (scripts/sync-client-version-floors.mjs).
-export const CODEX_CLIENT_VERSION_FLOOR = '0.162.1';
+export const CODEX_CLIENT_VERSION_FLOOR = '0.163.0';
 export const CODEX_CLI_NPM_PACKAGE = '@openai/codex';
 const live = createNpmVersionSource(CODEX_CLI_NPM_PACKAGE, { persistKey: 'codex-cli' });
 

package/src/runtime/agent/orchestrator/providers/command-code-oauth.mjs

@@ -2,22 +2,25 @@
  * Command Code provider (commandcode.ai Provider API).
  *
  * Credentials are a Studio-issued API key (command-code-oauth-tokens.mjs).
- * Each model is served on the endpoint its /models row declares: Chat
- * Completions through the OpenAI-compatible engine, Messages-only models
- * (Claude) through the Anthropic engine. Both clients are pinned to the
- * Command Code API host. The key never expires and has no refresh grant: a
- * 401 means the user must sign in again.
+ * Each model is served on a wire its /models row declares (wire-route.mjs
+ * picks among them): Chat Completions and Responses through the
+ * OpenAI-compatible engine, Messages through the Anthropic engine. Both
+ * clients are pinned to the Command Code API host. The key never expires and
+ * has no refresh grant: a 401 means the user must sign in again.
  */
 import { noteErrorUsage } from './lib/note-error-usage.mjs';
 import { fileMtimeMs, normalizeExpiresAtMs, scrubOAuthSecrets } from './lib/oauth-token-utils.mjs';
+import { originBoundFetch } from './lib/origin-bound-fetch.mjs';
+import { withInclusiveUsage } from './lib/inclusive-usage.mjs';
 import { OpenAICompatProvider, preloadOpenAICompatRuntime } from './openai-compat.mjs';
+import { COMPAT_RETRY_POLICY } from './openai-compat-retry-profile.mjs';
 import { listCompatModels } from './openai-compat-models.mjs';
 import { AnthropicProvider } from './anthropic.mjs';
-import { toInclusiveOpenCodeGoUsage as toInclusiveUsage } from './opencode-go.mjs';
 import { sanitizeToolPairs } from '../session/context-utils.mjs';
 import { preparePdfTextForProvider } from './media-normalization.mjs';
-import { currentUsageContext } from '../../../shared/llm/usage-context.mjs';
 import { makeModelCache } from './model-cache.mjs';
+import { resolveWireRoute, sendOnRoute } from './wire-route.mjs';
+import { gatewayMessagesOpts } from './wire-gateway.mjs';
 import {
   API_ORIGIN,
   CREDITS_URL,
@@ -37,8 +40,11 @@ export {
 export { beginOAuthLogin, loginOAuth } from './command-code-oauth-login.mjs';
 
 export const DEFAULT_MODEL = 'deepseek/deepseek-v4-flash';
-const CHAT_ENDPOINT = '/chat/completions';
-const MESSAGES_ENDPOINT = '/messages';
+const ENDPOINT_WIRES = Object.freeze({
+  '/chat/completions': 'chat',
+  '/messages': 'messages',
+  '/responses': 'responses',
+});
 // The Anthropic SDK appends /v1/messages itself.
 const MESSAGES_BASE_URL = `${API_ORIGIN}/provider`;
 const FIVE_HOURS_MS = 5 * 60 * 60 * 1000;
@@ -55,35 +61,42 @@ const commandCodeModelCache = makeModelCache({
 });
 
 /**
- * The wire a /models row is served on: 'chat' when it declares Chat
- * Completions or declares no endpoints at all, 'messages' when it declares
- * only Messages, null when it declares neither.
+ * The wires a /models row declares (`supported_endpoints`), or null when it
+ * declares none — such a row is served on Chat Completions by convention.
+ */
+export function modelEndpoints(item) {
+  const declared = item?.supported_endpoints;
+  if (!Array.isArray(declared)) return null;
+  const wires = [];
+  for (const endpoint of declared) {
+    const path = String(endpoint).replace(/^\/?(?:provider\/)?(?:v1\/)?/, '/');
+    const wire = Object.hasOwn(ENDPOINT_WIRES, path) ? ENDPOINT_WIRES[path] : null;
+    if (wire && !wires.includes(wire)) wires.push(wire);
+  }
+  return wires;
+}
+
+// The route for a model with these declared endpoints (null: undeclared, Chat).
+// `undefined`: nothing describes the model, so no wire is ruled out.
+function commandCodeRoute(model, endpoints, ctx = {}) {
+  return resolveWireRoute(PROVIDER_ID, model, { ...ctx, endpoints: endpoints === undefined ? null : (endpoints ?? ['chat']) });
+}
+
+/**
+ * The wire a /models row is served on (wire-route.mjs over its declared
+ * endpoints): Responses for GPT / Muse / Grok when advertised, otherwise Chat
+ * when declared or undeclared, Messages when it is the only one, Responses
+ * for a Responses-only row; null when it declares none of them.
  */
 export function modelWire(item) {
   if (typeof item?.id !== 'string' || !item.id) return null;
-  const endpoints = item.supported_endpoints;
-  if (!Array.isArray(endpoints)) return 'chat';
-  const declared = endpoints.map((endpoint) => String(endpoint).replace(/^\/?(?:provider\/)?(?:v1\/)?/, '/'));
-  if (declared.includes(CHAT_ENDPOINT)) return 'chat';
-  if (declared.includes(MESSAGES_ENDPOINT)) return 'messages';
-  return null;
+  return commandCodeRoute(item.id, modelEndpoints(item))?.wire || null;
 }
 
-// Every request either engine makes goes through this fetch: anything outside
-// the Command Code API origin is refused before the key leaves the process,
-// and redirects are never followed (any 3xx is an error).
+// Every request either engine makes goes through this fetch: only the Command
+// Code API origin, never a redirect.
 function apiOnlyFetch(fetchImpl) {
-  return async (input, init) => {
-    const url = new URL(String(input?.url ?? input));
-    if (url.origin !== API_ORIGIN) {
-      throw new Error(`[command-code-oauth] refusing to send the API key to ${url.host}`);
-    }
-    const res = await (fetchImpl || globalThis.fetch)(input, { ...init, redirect: 'manual' });
-    if (res.status >= 300 && res.status < 400) {
-      throw new Error(`[command-code-oauth] refusing to follow a redirect from ${url.host}`);
-    }
-    return res;
-  };
+  return originBoundFetch(API_ORIGIN, fetchImpl, PROVIDER_ID);
 }
 
 // Anthropic engine bound to this credential: only the Command Code key is
@@ -97,15 +110,11 @@ class CommandCodeMessagesEngine extends AnthropicProvider {
     client.fetch = apiOnlyFetch(this.config.fetchImpl);
     return client;
   }
-}
-
-const normalizeUsageError = (err) => {
-  if (err && typeof err === 'object') {
-    if (err.usage) err.usage = toInclusiveUsage(err.usage);
-    if (err.partialUsage) err.partialUsage = toInclusiveUsage(err.partialUsage);
+  // The roster's output ceiling reaches the shared request builder.
+  _sendOnce(messages, model, tools, opts) {
+    return super._sendOnce(messages, model, tools, gatewayMessagesOpts(this.config, model, messages, opts));
   }
-  return err;
-};
+}
 
 function rosterRow(item) {
   const contextWindow = Number(item.context_window ?? item.max_context_window ?? item.context_length ?? 0);
@@ -117,6 +126,11 @@ function rosterRow(item) {
     ...(name ? { name: name.trim() } : {}),
     ...(contextWindow > 0 ? { contextWindow } : {}),
     ...(outputTokens > 0 ? { outputTokens } : {}),
+    // The full declared endpoint set: the cached route metadata a later
+    // send falls back on when the live roster cannot be read.
+    ...(Array.isArray(item.supported_endpoints)
+      ? { supportedEndpoints: item.supported_endpoints.map((endpoint) => String(endpoint)) }
+      : {}),
   };
 }
 
@@ -146,11 +160,16 @@ function scrubErrorSecrets(err, apiKey) {
 }
 
 // Redact where the transport first surfaces errors (request open and stream
-// iteration), so the shared retry reporter never logs the key.
+// iteration) on the Chat and Responses endpoints, so the shared retry
+// reporter never logs the key.
 function redactClientErrors(client, apiKey) {
-  const completions = client?.chat?.completions;
-  if (!completions || !apiKey || completions.create?.commandCodeRedacting === apiKey) return;
-  const create = completions.create.bind(completions);
+  redactCreateErrors(client?.chat?.completions, apiKey);
+  redactCreateErrors(client?.responses, apiKey);
+}
+
+function redactCreateErrors(endpoint, apiKey) {
+  if (!endpoint || !apiKey || endpoint.create?.commandCodeRedacting === apiKey) return;
+  const create = endpoint.create.bind(endpoint);
   const wrapped = async (...args) => {
     try {
       const stream = await create(...args);
@@ -176,7 +195,7 @@ function redactClientErrors(client, apiKey) {
     }
   };
   wrapped.commandCodeRedacting = apiKey;
-  completions.create = wrapped;
+  endpoint.create = wrapped;
 }
 
 // Same for the Anthropic client's streaming request (read through
@@ -242,6 +261,8 @@ export class CommandCodeOAuthProvider {
   // OpenAI-compatible usage: prompt_tokens includes cached. See registry.mjs.
   static inputExcludesCache = false;
   name = PROVIDER_ID;
+  // The retry profile's limits are final: no loop-level recovery cycles on top.
+  retryPolicy = COMPAT_RETRY_POLICY;
   config;
   tokens = null;
   _inner = null;
@@ -250,8 +271,9 @@ export class CommandCodeOAuthProvider {
   _defaultModelKey = null;
   _messages = null;
   _messagesKey = null;
-  // Model id → wire ('chat' | 'messages') from the roster fetched with `_wiresKey`.
-  _wires = new Map();
+  // Model id → declared endpoint wires (null: undeclared) from the roster
+  // fetched with `_wiresKey`.
+  _endpoints = new Map();
   _wiresKey = null;
 
   constructor(config) {
@@ -312,6 +334,8 @@ export class CommandCodeOAuthProvider {
       apiKey,
       baseURL: MESSAGES_BASE_URL,
       disableBetaHeaders: true,
+      modelMaxOutputTokens: (model) =>
+        commandCodeModelCache.loadSync({ allowStale: true })?.find((row) => row?.id === model)?.outputTokens,
       // x-api-key from the SDK plus the bearer form of the same key.
       extraHeaders: { Authorization: `Bearer ${apiKey}` },
     });
@@ -321,8 +345,9 @@ export class CommandCodeOAuthProvider {
     return engine;
   }
 
-  // Servable rows from /models; only the latest fetch with the still-active
-  // key publishes the roster and the per-model wire map.
+  // Servable rows from /models (any declared Chat, Messages or Responses
+  // endpoint, or none declared); only the latest fetch with the still-active
+  // key publishes the roster and the per-model endpoint map.
   async _fetchRoster(apiKey, signal = null) {
     const publish = commandCodeModelCache.beginSave(() => loadTokens()?.apiKey === apiKey);
     const body = await requestCommandCodeJson(`${PROVIDER_BASE_URL}/models`, apiKey, {
@@ -335,16 +360,30 @@ export class CommandCodeOAuthProvider {
     const items = list.filter((item) => modelWire(item));
     publish(items.map(rosterRow));
     if (this.tokens?.apiKey === apiKey) {
-      this._wires = new Map(items.map((item) => [item.id, modelWire(item)]));
+      // Rows accumulate for one key: a later roster that misses a model
+      // leaves the endpoints it was last listed with.
+      const known = this._wiresKey === apiKey ? this._endpoints : new Map();
+      for (const item of items) known.set(item.id, modelEndpoints(item));
+      this._endpoints = known;
       this._wiresKey = apiKey;
     }
     return items;
   }
 
-  // The wire for a model, from this credential's roster (fetched once when
-  // missing). A model the roster does not know, or a roster that cannot be
-  // read right now, stays on Chat Completions; a rejected key is surfaced.
-  async _wireFor(inner, model) {
+  // A model's declared endpoints: what this credential's rosters listed,
+  // then the persisted roster (a roster miss or a roster that cannot be read
+  // right now must not move a known Messages-only model to Chat). null is a
+  // row declaring none (Chat); undefined is a model nothing describes.
+  _endpointsFor(apiKey, model) {
+    if (this._wiresKey === apiKey && this._endpoints.has(model)) return this._endpoints.get(model);
+    const cached = commandCodeModelCache.loadSync({ allowStale: true })?.find((row) => row?.id === model);
+    return cached ? modelEndpoints({ supported_endpoints: cached.supportedEndpoints }) : undefined;
+  }
+
+  // This credential's route for a model (the roster is fetched once when
+  // missing; a roster that cannot be read falls back on the persisted rows);
+  // a rejected key is surfaced.
+  async _routeFor(inner, model, ctx = {}) {
     if (this._wiresKey !== inner.apiKey) {
       try {
         await listCompatModels(inner, { throwOnError: true });
@@ -352,7 +391,16 @@ export class CommandCodeOAuthProvider {
         if (isUnauthorized(err)) throw err;
       }
     }
-    return (this._wiresKey === inner.apiKey && this._wires.get(model)) || 'chat';
+    const endpoints = this._endpointsFor(inner.apiKey, model);
+    return commandCodeRoute(model, endpoints, {
+      ...ctx,
+      override: this.config?.modelWires?.[model] ?? null,
+      known: endpoints !== undefined,
+    });
+  }
+
+  resolveWireRoute(model, ctx = {}) {
+    return this._routeFor(this._ensureInner(), model, ctx);
   }
 
   // A rejected key needs a fresh sign-in; the gateway's own detail stays attached.
@@ -379,17 +427,21 @@ export class CommandCodeOAuthProvider {
       throw this._shapeError(err, this.tokens?.apiKey);
     }
     const apiKey = this._innerKey;
-    // The model's declared endpoint picks the wire; a caller cannot move a
-    // model to Responses.
-    const { compatWireApi: _wire, responsesTransport: _transport, ...opts } = sendOpts || {};
+    // The model's route (the session's pinned one, else its declared
+    // endpoints) picks the wire; a caller's compat wire flag cannot move it.
+    const { compatWireApi: _wire, responsesTransport: _transport, ...callerOpts } = sendOpts || {};
     try {
       const useModel = model || (await this._pickDefaultModel(inner));
-      if ((await this._wireFor(inner, useModel)) === 'messages') {
-        return await this._sendMessages(apiKey, messages, useModel, tools, opts);
-      }
-      // _doSend directly: the compat wrapper's 401 handler reloads a static
-      // config key, which does not apply to this credential.
-      return await inner._doSend(messages, useModel, tools, opts);
+      // One clear "unsupported" refusal moves the send to the next wire once.
+      return await sendOnRoute(this, useModel, tools, callerOpts, messages, (wire, history, opts) => {
+        if (wire === 'messages') return this._sendMessages(apiKey, history, useModel, tools, opts);
+        // _doSend directly: the compat wrapper's 401 handler reloads a static
+        // config key, which does not apply to this credential.
+        if (wire === 'responses') {
+          return inner._doSend(history, useModel, tools, { ...opts, compatWireApi: 'responses' });
+        }
+        return inner._doSend(history, useModel, tools, opts);
+      });
     } catch (err) {
       throw this._shapeError(err, apiKey);
     }
@@ -402,14 +454,7 @@ export class CommandCodeOAuthProvider {
   async _sendMessages(apiKey, messages, model, tools, opts) {
     const engine = this._ensureMessages(apiKey);
     const prepared = await preparePdfTextForProvider(sanitizeToolPairs(messages), engine);
-    const identity = currentUsageContext();
-    if (identity) identity.normalizeAbandonedUsage = toInclusiveUsage;
-    try {
-      const result = await engine._doSend(prepared, model, tools, opts);
-      return result?.usage ? { ...result, usage: toInclusiveUsage(result.usage) } : result;
-    } catch (err) {
-      throw normalizeUsageError(err);
-    }
+    return withInclusiveUsage(() => engine._doSend(prepared, model, tools, opts));
   }
 
   async listModels() {