mixdog 1.2.2 → 1.2.4

package/src/runtime/agent/orchestrator/providers/antigravity-transport.mjs

@@ -6,15 +6,22 @@
  * account-verification URL Google hides in the error details), and the
  * per-attempt hand-off of the live stream to the turn collector.
  */
-import { emitProviderRetryStage, markProviderRecoveryExhausted, sleepWithAbort, withRetry } from './retry-classifier.mjs';
+import {
+  emitProviderRetryStage,
+  markProviderRecoveryExhausted,
+  sleepWithAbort,
+  withRetry,
+} from './retry-classifier.mjs';
 import {
   ANTIGRAVITY_RETRY,
+  ANTIGRAVITY_UNCLASSED_FIRST_BYTE,
   antigravity429WaitMs,
   isAntigravityCapacityError,
 } from './antigravity-retry-policy.mjs';
-import { createTimeoutSignal } from '../stall-policy.mjs';
+import { createTimeoutSignal, firstByteWindowMs } from '../stall-policy.mjs';
+import { MODEL_THINKING_STAGE } from '../../../shared/quiet-progress.mjs';
+import { TIMEOUT_PHASE, isFirstByteTimeout } from '../../../shared/provider-timeout-phase.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
-import { GEMINI_FIRST_BYTE_TIMEOUT_MS } from './gemini-stream.mjs';
 import { _scrubTokens } from './antigravity-oauth-tokens.mjs';
 import { applyGeminiErrorContract } from './gemini-error-contract.mjs';
 import { DETERMINISTIC_KINDS, providerErrorKind } from './provider-error-kind.mjs';
@@ -70,13 +77,21 @@ export function antigravityError(res, text, endpoint) {
   // Account verification is terminal and actionable: surface the URL Google
   // returns instead of a raw API body the user cannot act on.
   // Google puts the link in the error details, not the message text.
-  const validationDetail = Array.isArray(detail?.details)
-    ? detail.details.find(
-        (entry) => entry?.reason === 'VALIDATION_REQUIRED' && typeof entry.metadata?.validation_url === 'string'
-      )
-    : null;
+  // Order: google.rpc.Help.links, metadata.validation_url, metadata.validation_link.
+  const detailEntries = Array.isArray(detail?.details) ? detail.details : [];
+  const helpUrl = detailEntries
+    .flatMap((entry) => (Array.isArray(entry?.links) ? entry.links : []))
+    .map((link) => link?.url)
+    .find((url) => typeof url === 'string' && url.length > 0);
+  const metadataUrl = (key) =>
+    detailEntries.find(
+      (entry) =>
+        entry?.reason === 'VALIDATION_REQUIRED' && typeof entry.metadata?.[key] === 'string' && entry.metadata[key]
+    )?.metadata[key];
   const validationUrl =
-    validationDetail?.metadata.validation_url ||
+    helpUrl ||
+    metadataUrl('validation_url') ||
+    metadataUrl('validation_link') ||
     /https:\/\/\S*(?:accounts|console)\.google\.com\/\S+/.exec(message || '')?.[0] ||
     '';
   if (res.status === 403 && /VALIDATION_REQUIRED/i.test(text || '')) {
@@ -99,19 +114,53 @@ export function antigravityError(res, text, endpoint) {
  * @param {object} deps.opts  send options (stage heartbeat)
  * @param {AbortSignal|null} deps.signal  retry-loop signal (session pass-through)
  * @param {{ beginAttempt: Function, consume: Function }} deps.collector
+ * @param {{ timeoutMs: number, maxMs: number, retries: number|null }} [deps.firstByte]
+ *   first-byte window per attempt (antigravityFirstBytePolicy)
  * @returns {() => Promise<object>} one retried request that resolves the final payload
  */
-export function createAntigravityRequest({ fetchFn, endpoint, headers, body, opts, signal, collector, sleepFn }) {
+export function createAntigravityRequest({
+  fetchFn,
+  endpoint,
+  headers,
+  body,
+  opts,
+  signal,
+  collector,
+  sleepFn,
+  firstByte = ANTIGRAVITY_UNCLASSED_FIRST_BYTE,
+}) {
   const log = (attempt, lastErr, delayMs) => {
+    // A first-byte timeout runs on its own, shorter retry budget.
+    const firstByteLimited = isFirstByteTimeout(lastErr) && firstByte.retries != null;
     emitProviderRetryStage(opts.onStageChange, {
       attempt: attempt + 1,
-      maxAttempts: ANTIGRAVITY_RETRY.maxAttempts,
+      maxAttempts: firstByteLimited
+        ? Math.min(ANTIGRAVITY_RETRY.maxAttempts, firstByte.retries + 1)
+        : ANTIGRAVITY_RETRY.maxAttempts,
       lastErr,
       delayMs,
     });
     process.stderr.write(`[antigravity] retry ${attempt + 1} after ${lastErr?.message || 'transient error'}\n`);
   };
-  const attemptOnce = () =>
+  // Stamps what the attempt tells the user: how many attempts ran and, for a
+  // first-byte timeout, how long the model was given in total. A timeout past
+  // the first-byte retry budget ends the ladder here. A caller's cancellation
+  // reason may be shared by other requests and is never stamped.
+  const noteFailure = (err, { attemptSignal, windowMs, send }) => {
+    if (!err || typeof err !== 'object' || attemptSignal?.aborted) return err;
+    send.attempts += 1;
+    err.attempts = send.attempts;
+    if (!isFirstByteTimeout(err)) return err;
+    send.firstByteTimeouts += 1;
+    send.firstByteWaitedMs += windowMs;
+    err.waitedMs = send.firstByteWaitedMs;
+    err.providerLabel = 'Antigravity';
+    if (firstByte.retries != null && send.firstByteTimeouts > firstByte.retries) {
+      markProviderRecoveryExhausted(err, { owner: 'antigravity-first-byte', attempts: send.attempts, terminal: true });
+    }
+    return err;
+  };
+  const attemptOnce = (send) =>
     withRetry(
       async ({ signal: attemptSignal }) => {
         try {
@@ -119,37 +168,63 @@ export function createAntigravityRequest({ fetchFn, endpoint, headers, body, opt
         } catch {
           /* heartbeat */
         }
-        const firstByte = createTimeoutSignal(attemptSignal, GEMINI_FIRST_BYTE_TIMEOUT_MS, 'Antigravity first byte');
-        let res;
+        const windowMs = firstByteWindowMs(firstByte, send.firstByteTimeouts);
         try {
-          res = await fetchFn(`${endpoint}/v1internal:streamGenerateContent?alt=sse`, {
-            method: 'POST',
-            headers,
-            body,
-            signal: firstByte.signal,
-            dispatcher: getLlmDispatcher(),
-          });
-        } catch (err) {
-          // Fetch surfaces AbortError; rethrow the timer/parent
-          // reason so same-host retry sees EPROVIDERTIMEOUT and
-          // a caller cancel stays a cancel.
-          if (firstByte.signal.aborted && firstByte.signal.reason instanceof Error) {
-            throw firstByte.signal.reason;
+          const firstByteTimer = createTimeoutSignal(attemptSignal, windowMs, 'Antigravity first byte');
+          let res;
+          try {
+            const response = fetchFn(`${endpoint}/v1internal:streamGenerateContent?alt=sse`, {
+              method: 'POST',
+              headers,
+              body,
+              signal: firstByteTimer.signal,
+              dispatcher: getLlmDispatcher(),
+            });
+            // The request is on the wire and its headers are pending: the
+            // gateway sends them only with the first chunk, so this wait is
+            // the model's queueing and thinking time.
+            try {
+              opts.onStageChange?.(MODEL_THINKING_STAGE);
+            } catch {
+              /* heartbeat */
+            }
+            res = await response;
+          } catch (err) {
+            // Fetch surfaces AbortError; rethrow the timer/parent
+            // reason so same-host retry sees EPROVIDERTIMEOUT and
+            // a caller cancel stays a cancel.
+            if (firstByteTimer.signal.aborted && firstByteTimer.signal.reason instanceof Error) {
+              const reason = firstByteTimer.signal.reason;
+              if (!attemptSignal?.aborted) reason.timeoutPhase = TIMEOUT_PHASE.HEADERS;
+              throw reason;
+            }
+            throw err;
+          } finally {
+            firstByteTimer.cleanup();
           }
-          throw err;
-        } finally {
-          firstByte.cleanup();
-        }
-        if (!res.ok) {
-          const text = await res.text().catch(() => '');
-          const failure = antigravityError(res, text, endpoint);
-          // Capacity is paced by the local schedule below; the generic loop
-          // would sleep whatever wait the server names.
-          if (isCapacityFailure(failure)) markProviderRecoveryExhausted(failure, { owner: 'antigravity-capacity' });
-          throw failure;
+          // Headers arrived: the connection is live even while the model
+          // has not produced its first chunk.
+          try {
+            opts.onStreamDelta?.('transport');
+          } catch {}
+          if (!res.ok) {
+            const text = await res.text().catch(() => '');
+            const failure = antigravityError(res, text, endpoint);
+            // Capacity is paced by the local schedule below; the generic loop
+            // would sleep whatever wait the server names.
+            if (isCapacityFailure(failure)) markProviderRecoveryExhausted(failure, { owner: 'antigravity-capacity' });
+            throw failure;
+          }
+          try {
+            opts.onStageChange?.('streaming');
+          } catch {
+            /* heartbeat */
+          }
+          collector.beginAttempt();
+          return await collector.consume(res, attemptSignal, { firstByteTimeoutMs: windowMs });
+        } catch (err) {
+          throw noteFailure(err, { attemptSignal, windowMs, send });
         }
-        collector.beginAttempt();
-        return collector.consume(res, attemptSignal);
       },
       {
         ...ANTIGRAVITY_RETRY,
@@ -164,9 +239,10 @@ export function createAntigravityRequest({ fetchFn, endpoint, headers, body, opt
   // gets one quick retry, a spent quota surfaces.
   return async () => {
     const state = { capacityRetries: 0, quickRetried: false };
+    const send = { attempts: 0, firstByteTimeouts: 0, firstByteWaitedMs: 0 };
     for (let tried = 1; ; tried++) {
       try {
-        return await attemptOnce();
+        return await attemptOnce(send);
       } catch (err) {
         const waitMs = antigravity429WaitMs(err, state);
         if (waitMs == null) {

package/src/runtime/agent/orchestrator/providers/codex-client-meta.mjs

@@ -20,7 +20,7 @@ import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
 // version (gpt-6.1-sol requires >= 0.159.0, measured 2026-10-09), so the
 // release workflow raises this to the published CLI version on every release
 // (scripts/sync-client-version-floors.mjs).
-export const CODEX_CLIENT_VERSION_FLOOR = '0.162.1';
+export const CODEX_CLIENT_VERSION_FLOOR = '0.163.0';
 export const CODEX_CLI_NPM_PACKAGE = '@openai/codex';
 const live = createNpmVersionSource(CODEX_CLI_NPM_PACKAGE, { persistKey: 'codex-cli' });
 

package/src/runtime/agent/orchestrator/providers/command-code-oauth.mjs

@@ -2,23 +2,25 @@
  * Command Code provider (commandcode.ai Provider API).
  *
  * Credentials are a Studio-issued API key (command-code-oauth-tokens.mjs).
- * Each model is served on the endpoint its /models row declares: Chat
- * Completions through the OpenAI-compatible engine, Messages-only models
- * (Claude) through the Anthropic engine. Both clients are pinned to the
- * Command Code API host. The key never expires and has no refresh grant: a
- * 401 means the user must sign in again.
+ * Each model is served on a wire its /models row declares (wire-route.mjs
+ * picks among them): Chat Completions and Responses through the
+ * OpenAI-compatible engine, Messages through the Anthropic engine. Both
+ * clients are pinned to the Command Code API host. The key never expires and
+ * has no refresh grant: a 401 means the user must sign in again.
  */
 import { noteErrorUsage } from './lib/note-error-usage.mjs';
 import { fileMtimeMs, normalizeExpiresAtMs, scrubOAuthSecrets } from './lib/oauth-token-utils.mjs';
+import { originBoundFetch } from './lib/origin-bound-fetch.mjs';
+import { withInclusiveUsage } from './lib/inclusive-usage.mjs';
 import { OpenAICompatProvider, preloadOpenAICompatRuntime } from './openai-compat.mjs';
 import { COMPAT_RETRY_POLICY } from './openai-compat-retry-profile.mjs';
 import { listCompatModels } from './openai-compat-models.mjs';
 import { AnthropicProvider } from './anthropic.mjs';
-import { toInclusiveOpenCodeGoUsage as toInclusiveUsage } from './opencode-go.mjs';
 import { sanitizeToolPairs } from '../session/context-utils.mjs';
 import { preparePdfTextForProvider } from './media-normalization.mjs';
-import { currentUsageContext } from '../../../shared/llm/usage-context.mjs';
 import { makeModelCache } from './model-cache.mjs';
+import { resolveWireRoute, sendOnRoute } from './wire-route.mjs';
+import { gatewayMessagesOpts } from './wire-gateway.mjs';
 import {
   API_ORIGIN,
   CREDITS_URL,
@@ -38,8 +40,11 @@ export {
 export { beginOAuthLogin, loginOAuth } from './command-code-oauth-login.mjs';
 
 export const DEFAULT_MODEL = 'deepseek/deepseek-v4-flash';
-const CHAT_ENDPOINT = '/chat/completions';
-const MESSAGES_ENDPOINT = '/messages';
+const ENDPOINT_WIRES = Object.freeze({
+  '/chat/completions': 'chat',
+  '/messages': 'messages',
+  '/responses': 'responses',
+});
 // The Anthropic SDK appends /v1/messages itself.
 const MESSAGES_BASE_URL = `${API_ORIGIN}/provider`;
 const FIVE_HOURS_MS = 5 * 60 * 60 * 1000;
@@ -56,35 +61,45 @@ const commandCodeModelCache = makeModelCache({
 });
 
 /**
- * The wire a /models row is served on: 'chat' when it declares Chat
- * Completions or declares no endpoints at all, 'messages' when it declares
- * only Messages, null when it declares neither.
+ * The wires a /models row declares (`supported_endpoints`), or null when it
+ * declares none — such a row is served on Chat Completions by convention.
+ */
+export function modelEndpoints(item) {
+  const declared = item?.supported_endpoints;
+  if (!Array.isArray(declared)) return null;
+  const wires = [];
+  for (const endpoint of declared) {
+    const path = String(endpoint).replace(/^\/?(?:provider\/)?(?:v1\/)?/, '/');
+    const wire = Object.hasOwn(ENDPOINT_WIRES, path) ? ENDPOINT_WIRES[path] : null;
+    if (wire && !wires.includes(wire)) wires.push(wire);
+  }
+  return wires;
+}
+
+// The route for a model with these declared endpoints (null: undeclared, Chat).
+// `undefined`: nothing describes the model, so no wire is ruled out.
+function commandCodeRoute(model, endpoints, ctx = {}) {
+  return resolveWireRoute(PROVIDER_ID, model, {
+    ...ctx,
+    endpoints: endpoints === undefined ? null : (endpoints ?? ['chat']),
+  });
+}
+
+/**
+ * The wire a /models row is served on (wire-route.mjs over its declared
+ * endpoints): Responses for GPT / Muse / Grok when advertised, otherwise Chat
+ * when declared or undeclared, Messages when it is the only one, Responses
+ * for a Responses-only row; null when it declares none of them.
  */
 export function modelWire(item) {
   if (typeof item?.id !== 'string' || !item.id) return null;
-  const endpoints = item.supported_endpoints;
-  if (!Array.isArray(endpoints)) return 'chat';
-  const declared = endpoints.map((endpoint) => String(endpoint).replace(/^\/?(?:provider\/)?(?:v1\/)?/, '/'));
-  if (declared.includes(CHAT_ENDPOINT)) return 'chat';
-  if (declared.includes(MESSAGES_ENDPOINT)) return 'messages';
-  return null;
+  return commandCodeRoute(item.id, modelEndpoints(item))?.wire || null;
 }
 
-// Every request either engine makes goes through this fetch: anything outside
-// the Command Code API origin is refused before the key leaves the process,
-// and redirects are never followed (any 3xx is an error).
+// Every request either engine makes goes through this fetch: only the Command
+// Code API origin, never a redirect.
 function apiOnlyFetch(fetchImpl) {
-  return async (input, init) => {
-    const url = new URL(String(input?.url ?? input));
-    if (url.origin !== API_ORIGIN) {
-      throw new Error(`[command-code-oauth] refusing to send the API key to ${url.host}`);
-    }
-    const res = await (fetchImpl || globalThis.fetch)(input, { ...init, redirect: 'manual' });
-    if (res.status >= 300 && res.status < 400) {
-      throw new Error(`[command-code-oauth] refusing to follow a redirect from ${url.host}`);
-    }
-    return res;
-  };
+  return originBoundFetch(API_ORIGIN, fetchImpl, PROVIDER_ID);
 }
 
 // Anthropic engine bound to this credential: only the Command Code key is
@@ -98,15 +113,11 @@ class CommandCodeMessagesEngine extends AnthropicProvider {
     client.fetch = apiOnlyFetch(this.config.fetchImpl);
     return client;
   }
-}
-
-const normalizeUsageError = (err) => {
-  if (err && typeof err === 'object') {
-    if (err.usage) err.usage = toInclusiveUsage(err.usage);
-    if (err.partialUsage) err.partialUsage = toInclusiveUsage(err.partialUsage);
+  // The roster's output ceiling reaches the shared request builder.
+  _sendOnce(messages, model, tools, opts) {
+    return super._sendOnce(messages, model, tools, gatewayMessagesOpts(this.config, model, messages, opts));
   }
-  return err;
-};
+}
 
 function rosterRow(item) {
   const contextWindow = Number(item.context_window ?? item.max_context_window ?? item.context_length ?? 0);
@@ -118,6 +129,11 @@ function rosterRow(item) {
     ...(name ? { name: name.trim() } : {}),
     ...(contextWindow > 0 ? { contextWindow } : {}),
     ...(outputTokens > 0 ? { outputTokens } : {}),
+    // The full declared endpoint set: the cached route metadata a later
+    // send falls back on when the live roster cannot be read.
+    ...(Array.isArray(item.supported_endpoints)
+      ? { supportedEndpoints: item.supported_endpoints.map((endpoint) => String(endpoint)) }
+      : {}),
   };
 }
 
@@ -147,11 +163,16 @@ function scrubErrorSecrets(err, apiKey) {
 }
 
 // Redact where the transport first surfaces errors (request open and stream
-// iteration), so the shared retry reporter never logs the key.
+// iteration) on the Chat and Responses endpoints, so the shared retry
+// reporter never logs the key.
 function redactClientErrors(client, apiKey) {
-  const completions = client?.chat?.completions;
-  if (!completions || !apiKey || completions.create?.commandCodeRedacting === apiKey) return;
-  const create = completions.create.bind(completions);
+  redactCreateErrors(client?.chat?.completions, apiKey);
+  redactCreateErrors(client?.responses, apiKey);
+}
+
+function redactCreateErrors(endpoint, apiKey) {
+  if (!endpoint || !apiKey || endpoint.create?.commandCodeRedacting === apiKey) return;
+  const create = endpoint.create.bind(endpoint);
   const wrapped = async (...args) => {
     try {
       const stream = await create(...args);
@@ -177,7 +198,7 @@ function redactClientErrors(client, apiKey) {
     }
   };
   wrapped.commandCodeRedacting = apiKey;
-  completions.create = wrapped;
+  endpoint.create = wrapped;
 }
 
 // Same for the Anthropic client's streaming request (read through
@@ -253,8 +274,9 @@ export class CommandCodeOAuthProvider {
   _defaultModelKey = null;
   _messages = null;
   _messagesKey = null;
-  // Model id → wire ('chat' | 'messages') from the roster fetched with `_wiresKey`.
-  _wires = new Map();
+  // Model id → declared endpoint wires (null: undeclared) from the roster
+  // fetched with `_wiresKey`.
+  _endpoints = new Map();
   _wiresKey = null;
 
   constructor(config) {
@@ -315,6 +337,8 @@ export class CommandCodeOAuthProvider {
       apiKey,
       baseURL: MESSAGES_BASE_URL,
       disableBetaHeaders: true,
+      modelMaxOutputTokens: (model) =>
+        commandCodeModelCache.loadSync({ allowStale: true })?.find((row) => row?.id === model)?.outputTokens,
       // x-api-key from the SDK plus the bearer form of the same key.
       extraHeaders: { Authorization: `Bearer ${apiKey}` },
     });
@@ -324,8 +348,9 @@ export class CommandCodeOAuthProvider {
     return engine;
   }
 
-  // Servable rows from /models; only the latest fetch with the still-active
-  // key publishes the roster and the per-model wire map.
+  // Servable rows from /models (any declared Chat, Messages or Responses
+  // endpoint, or none declared); only the latest fetch with the still-active
+  // key publishes the roster and the per-model endpoint map.
   async _fetchRoster(apiKey, signal = null) {
     const publish = commandCodeModelCache.beginSave(() => loadTokens()?.apiKey === apiKey);
     const body = await requestCommandCodeJson(`${PROVIDER_BASE_URL}/models`, apiKey, {
@@ -338,16 +363,30 @@ export class CommandCodeOAuthProvider {
     const items = list.filter((item) => modelWire(item));
     publish(items.map(rosterRow));
     if (this.tokens?.apiKey === apiKey) {
-      this._wires = new Map(items.map((item) => [item.id, modelWire(item)]));
+      // Rows accumulate for one key: a later roster that misses a model
+      // leaves the endpoints it was last listed with.
+      const known = this._wiresKey === apiKey ? this._endpoints : new Map();
+      for (const item of items) known.set(item.id, modelEndpoints(item));
+      this._endpoints = known;
       this._wiresKey = apiKey;
     }
     return items;
   }
 
-  // The wire for a model, from this credential's roster (fetched once when
-  // missing). A model the roster does not know, or a roster that cannot be
-  // read right now, stays on Chat Completions; a rejected key is surfaced.
-  async _wireFor(inner, model) {
+  // A model's declared endpoints: what this credential's rosters listed,
+  // then the persisted roster (a roster miss or a roster that cannot be read
+  // right now must not move a known Messages-only model to Chat). null is a
+  // row declaring none (Chat); undefined is a model nothing describes.
+  _endpointsFor(apiKey, model) {
+    if (this._wiresKey === apiKey && this._endpoints.has(model)) return this._endpoints.get(model);
+    const cached = commandCodeModelCache.loadSync({ allowStale: true })?.find((row) => row?.id === model);
+    return cached ? modelEndpoints({ supported_endpoints: cached.supportedEndpoints }) : undefined;
+  }
+
+  // This credential's route for a model (the roster is fetched once when
+  // missing; a roster that cannot be read falls back on the persisted rows);
+  // a rejected key is surfaced.
+  async _routeFor(inner, model, ctx = {}) {
     if (this._wiresKey !== inner.apiKey) {
       try {
         await listCompatModels(inner, { throwOnError: true });
@@ -355,7 +394,16 @@ export class CommandCodeOAuthProvider {
         if (isUnauthorized(err)) throw err;
       }
     }
-    return (this._wiresKey === inner.apiKey && this._wires.get(model)) || 'chat';
+    const endpoints = this._endpointsFor(inner.apiKey, model);
+    return commandCodeRoute(model, endpoints, {
+      ...ctx,
+      override: this.config?.modelWires?.[model] ?? null,
+      known: endpoints !== undefined,
+    });
+  }
+
+  resolveWireRoute(model, ctx = {}) {
+    return this._routeFor(this._ensureInner(), model, ctx);
   }
 
   // A rejected key needs a fresh sign-in; the gateway's own detail stays attached.
@@ -382,17 +430,21 @@ export class CommandCodeOAuthProvider {
       throw this._shapeError(err, this.tokens?.apiKey);
     }
     const apiKey = this._innerKey;
-    // The model's declared endpoint picks the wire; a caller cannot move a
-    // model to Responses.
-    const { compatWireApi: _wire, responsesTransport: _transport, ...opts } = sendOpts || {};
+    // The model's route (the session's pinned one, else its declared
+    // endpoints) picks the wire; a caller's compat wire flag cannot move it.
+    const { compatWireApi: _wire, responsesTransport: _transport, ...callerOpts } = sendOpts || {};
     try {
       const useModel = model || (await this._pickDefaultModel(inner));
-      if ((await this._wireFor(inner, useModel)) === 'messages') {
-        return await this._sendMessages(apiKey, messages, useModel, tools, opts);
-      }
-      // _doSend directly: the compat wrapper's 401 handler reloads a static
-      // config key, which does not apply to this credential.
-      return await inner._doSend(messages, useModel, tools, opts);
+      // One clear "unsupported" refusal moves the send to the next wire once.
+      return await sendOnRoute(this, useModel, tools, callerOpts, messages, (wire, history, opts) => {
+        if (wire === 'messages') return this._sendMessages(apiKey, history, useModel, tools, opts);
+        // _doSend directly: the compat wrapper's 401 handler reloads a static
+        // config key, which does not apply to this credential.
+        if (wire === 'responses') {
+          return inner._doSend(history, useModel, tools, { ...opts, compatWireApi: 'responses' });
+        }
+        return inner._doSend(history, useModel, tools, opts);
+      });
     } catch (err) {
       throw this._shapeError(err, apiKey);
     }
@@ -405,14 +457,7 @@ export class CommandCodeOAuthProvider {
   async _sendMessages(apiKey, messages, model, tools, opts) {
     const engine = this._ensureMessages(apiKey);
     const prepared = await preparePdfTextForProvider(sanitizeToolPairs(messages), engine);
-    const identity = currentUsageContext();
-    if (identity) identity.normalizeAbandonedUsage = toInclusiveUsage;
-    try {
-      const result = await engine._doSend(prepared, model, tools, opts);
-      return result?.usage ? { ...result, usage: toInclusiveUsage(result.usage) } : result;
-    } catch (err) {
-      throw normalizeUsageError(err);
-    }
+    return withInclusiveUsage(() => engine._doSend(prepared, model, tools, opts));
   }
 
   async listModels() {

package/src/runtime/agent/orchestrator/providers/compat-request-policy.mjs

@@ -1,5 +1,6 @@
 // Shared request controls for Chat Completions and Responses gateways.
 import { emitProviderRetryStage, retryDelayLabel } from './retry-classifier.mjs';
+import { isTogetherBaseURL } from './openai-compat-reasoning-field.mjs';
 
 // withRetry onRetry for the compat stream sends: one stderr line plus a
 // display-only 'reconnecting' stage for the UI.
@@ -13,8 +14,83 @@ export function compatStreamRetryReporter(label, opts) {
   };
 }
 
-export function applyCompatToolChoice(body, opts = {}) {
-  if (body.tools?.length && opts.toolChoice === 'none') body.tool_choice = 'none';
+// Providers whose docs accept `required` / named tool_choice, and the subset
+// that also documents `parallel_tool_calls`. DeepSeek documents no
+// parallel_tool_calls, and rejects forced choices in thinking mode.
+const FORCED_CHOICE_PROVIDERS = new Set([
+  'xai',
+  'deepseek',
+  'openrouter',
+  'mistral',
+  'groq',
+  'fireworks',
+  'together',
+  'command-code-oauth',
+]);
+const PARALLEL_CALLS_PROVIDERS = new Set([
+  'xai',
+  'openrouter',
+  'mistral',
+  'groq',
+  'fireworks',
+  'together',
+  'command-code-oauth',
+]);
+
+function hostMatches(baseURL, domain) {
+  try {
+    const host = new URL(String(baseURL || '')).hostname.toLowerCase();
+    return host === domain || host.endsWith(`.${domain}`);
+  } catch {
+    return false;
+  }
+}
+
+function compatToolFamily(provider, baseURL) {
+  if (FORCED_CHOICE_PROVIDERS.has(provider)) return provider;
+  if (isTogetherBaseURL(baseURL)) return 'together';
+  if (hostMatches(baseURL, 'fireworks.ai')) return 'fireworks';
+  if (hostMatches(baseURL, 'mistral.ai')) return 'mistral';
+  if (hostMatches(baseURL, 'groq.com')) return 'groq';
+  return null;
+}
+
+function forcedToolChoice(choice, wire) {
+  if (choice === 'required') return 'required';
+  if (!choice || typeof choice !== 'object') return null;
+  const name = choice.function?.name || choice.name;
+  if (typeof name !== 'string' || !name) return null;
+  return wire === 'responses' ? { type: 'function', name } : { type: 'function', function: { name } };
+}
+
+/**
+ * Tool-choice controls. `none` is universal. With `ctx` ({ provider, baseURL,
+ * wire: 'chat'|'responses', thinking: 'enabled'|'disabled'|null }) the
+ * documented providers also get explicit `required` / named tool_choice and an
+ * explicit boolean `opts.parallelToolCalls`; without it only `none` applies.
+ * DeepSeek rejects forced choices while thinking is explicitly enabled and
+ * keeps omitting them when thinking is left to the server default.
+ */
+export function applyCompatToolChoice(body, opts = {}, ctx = null) {
+  if (!(body.tools?.length > 0)) return body;
+  if (opts.toolChoice === 'none') body.tool_choice = 'none';
+  const family = ctx?.provider ? compatToolFamily(ctx.provider, ctx.baseURL) : null;
+  if (!family) return body;
+  const forced = forcedToolChoice(opts.toolChoice, ctx.wire);
+  if (forced) {
+    if (family === 'deepseek' && ctx.thinking === 'enabled') {
+      throw Object.assign(
+        new Error(
+          '[deepseek] tool_choice "required" or a named tool is not supported in thinking mode; disable thinking (effort none) to force a tool call'
+        ),
+        { code: 'unsupported_tool_choice' }
+      );
+    }
+    if (family !== 'deepseek' || ctx.thinking === 'disabled') body.tool_choice = forced;
+  }
+  if (typeof opts.parallelToolCalls === 'boolean' && PARALLEL_CALLS_PROVIDERS.has(family)) {
+    body.parallel_tool_calls = opts.parallelToolCalls;
+  }
   return body;
 }