mixdog 1.2.5 → 1.2.6

package/src/runtime/agent/orchestrator/providers/catalog-deadline.mjs

@@ -0,0 +1,163 @@
+// Bounded, single-flight, cancellable provider catalog work, shared by the
+// registry's catalog refreshes and the session runtime's shared catalog.
+//
+// - Deadline: a caller waits at most `timeoutMs` and then gets an ETIMEDOUT
+//   error entry instead of the provider's answer, so one hung provider cannot
+//   hold a catalog read or a startup/forced refresh.
+// - Cancellation: on that deadline the operation's AbortSignal fires; a
+//   provider whose listModels honors `{ signal }` stops its work there.
+// - Single flight: per provider at most one operation is pending in this
+//   process. A caller that finds one of its own kind joins it (with its own
+//   deadline); one that finds the other kind (a refresh vs a model list)
+//   waits for it inside its deadline before starting its own. An operation
+//   leaves the table only when the underlying work settles, not when a
+//   caller gives up, so repeated timed-out reads never pile up work; once an
+//   operation overran one deadline, later callers fail fast on it instead of
+//   each waiting out another deadline, until it settles.
+// - Generations: one auth/account generation spans refreshes and lists alike
+//   (bumpProviderCatalogGeneration). Work of the other kind pending from an
+//   older generation, or from an older provider instance, never blocks or
+//   fails a caller of the newer one: that caller starts afresh. Same-kind
+//   work is never joined across generations, instances or a caller-supplied
+//   `epoch` (the catalog revision a list belongs to) either, unless it
+//   stalled (below).
+// - Stalled work: an operation that overran its deadline (its signal fired)
+//   and still has not settled ignores cancellation. Until it settles, that
+//   provider name is not asked again for the same kind, not by a newer
+//   generation, epoch or provider instance: callers get an ETIMEDOUT entry
+//   marked `stalled` at once. Otherwise every account change, catalog
+//   revision or registry rebuild would leave one more never-ending call
+//   behind in the provider. Superseded calls can only overlap inside one
+//   deadline window, before any of them stalls.
+import { clearProviderCatalogFailures, recordProviderCatalogOutcome } from './catalog-failures.mjs';
+
+export const PROVIDER_CATALOG_TIMEOUT_MS = 4_000;
+
+/** name -> the latest op started for that provider (either kind). */
+const pendingOps = new Map();
+/** `${kind}\0${name}` -> Set of the unsettled ops of that kind, of any
+ *  generation, epoch or provider instance; emptied sets are removed. */
+const runningOps = new Map();
+/** `${kind}\0${name}` -> sequence number of the latest op started of that kind. */
+const latestOpSeq = new Map();
+let opSeq = 0;
+let generation = 0;
+
+const runKey = (name, kind) => `${kind}\0${name}`;
+
+/** Opens a new auth/account generation for every provider's catalog work. */
+export function bumpProviderCatalogGeneration() {
+  generation += 1;
+  // Failures of the previous account say nothing about the new one.
+  clearProviderCatalogFailures();
+}
+
+/** Provider names with catalog work still pending (diagnostics and tests). */
+export function pendingProviderCatalogOps() {
+  return [...pendingOps.keys()];
+}
+
+/** `{ name, kind }` of every operation that ignored its deadline's abort and
+ *  is still unsettled (diagnostics and tests). */
+export function stalledProviderCatalogOps() {
+  return [...runningOps.values()]
+    .flatMap((ops) => [...ops])
+    .filter((op) => op.timedOut)
+    .map(({ name, kind }) => ({ name, kind }));
+}
+
+const isStalled = (name, kind) => [...(runningOps.get(runKey(name, kind)) || [])].some((op) => op.timedOut);
+
+function startOp(name, provider, kind, run, epoch, opGeneration) {
+  const controller = new AbortController();
+  const settled = Promise.resolve()
+    .then(() => run(controller.signal))
+    .then(
+      (value) => ({ value }),
+      (error) => ({ error })
+    );
+  const seq = ++opSeq;
+  const op = { name, provider, kind, epoch, generation: opGeneration, seq, controller, settled, done: false };
+  const key = runKey(name, kind);
+  latestOpSeq.set(key, seq);
+  const running = runningOps.get(key) || new Set();
+  running.add(op);
+  runningOps.set(key, running);
+  pendingOps.set(name, op);
+  void settled.then(() => {
+    op.done = true;
+    if (pendingOps.get(name) === op) pendingOps.delete(name);
+    running.delete(op);
+    if (running.size === 0 && runningOps.get(key) === running) runningOps.delete(key);
+  });
+  return op;
+}
+
+function timeoutError(message) {
+  const error = new Error(message);
+  error.code = 'ETIMEDOUT';
+  return error;
+}
+
+/** Resolves `{ value }`, `{ error }`, or `{ error, timedOut: true }`; never rejects.
+ *  The outcome is also kept as the provider's latest catalog failure (or
+ *  recovery) for views that explain an empty list (catalog-failures.mjs),
+ *  but only while it is current: a caller of a superseded generation, or one
+ *  answered by an op that a newer op of its kind replaced, publishes nothing. */
+export async function boundedProviderCatalogOp(op) {
+  const callerGeneration = generation;
+  const answered = { op: null };
+  const outcome = await runBoundedOp(op, callerGeneration, answered);
+  const currentOp = !answered.op || latestOpSeq.get(runKey(op.name, op.kind)) === answered.op.seq;
+  if (callerGeneration === generation && currentOp) recordProviderCatalogOutcome(op.name, outcome.error);
+  return outcome;
+}
+
+async function runBoundedOp(
+  { name, provider, kind, run, timeoutMs = PROVIDER_CATALOG_TIMEOUT_MS, epoch = 0 },
+  callerGeneration,
+  answered
+) {
+  let timer = null;
+  let watched = null;
+  const deadline = new Promise((resolve) => {
+    timer = setTimeout(() => {
+      const error = timeoutError(`provider "${name}" catalog ${kind} did not finish within ${timeoutMs}ms`);
+      if (watched) {
+        // Stalled until it settles: an op that honors the abort settles (and
+        // leaves the table) a few microtasks later, one that ignores it stays.
+        watched.timedOut = true;
+        watched.controller.abort(error);
+      }
+      resolve({ error, timedOut: true });
+    }, timeoutMs);
+  });
+  try {
+    for (;;) {
+      let op = pendingOps.get(name);
+      const superseded =
+        !op || op.provider !== provider || op.generation < callerGeneration || (op.kind === kind && op.epoch !== epoch);
+      if (superseded) {
+        if (isStalled(name, kind)) {
+          const error = timeoutError(`provider "${name}" catalog ${kind} ignored its deadline and is still pending`);
+          return { error, timedOut: true, stalled: true };
+        }
+        op = startOp(name, provider, kind, run, epoch, callerGeneration);
+      } else if (op.timedOut) {
+        // Already overran a deadline and still not settled: fail fast instead
+        // of making every later caller wait out another deadline for it.
+        const error = timeoutError(`provider "${name}" catalog ${op.kind} is still pending after its deadline`);
+        return { error, timedOut: true };
+      }
+      watched = op;
+      if (op.kind === kind) {
+        answered.op = op;
+        return await Promise.race([op.settled, deadline]);
+      }
+      const outcome = await Promise.race([op.settled.then(() => null), deadline]);
+      if (outcome) return outcome;
+    }
+  } finally {
+    clearTimeout(timer);
+  }
+}

package/src/runtime/agent/orchestrator/providers/catalog-failures.mjs

@@ -0,0 +1,34 @@
+// The latest catalog failure of each provider, kept so a view that lists a
+// provider's models can say WHY the list is empty (expired key, spent credits,
+// timeout) instead of showing a silent 0/0. Cleared by the provider's next
+// answer and by an account change.
+import { safeErrorDetails } from '../../../shared/error-presentation.mjs';
+import { providerErrorKind } from './provider-error-kind.mjs';
+
+const MESSAGE_LIMIT = 300;
+const failures = new Map();
+
+/** Records a provider's catalog failure (`error`) or its recovery (no error). */
+export function recordProviderCatalogOutcome(name, error) {
+  if (!error) {
+    failures.delete(name);
+    return;
+  }
+  const reason = typeof error.providerError?.message === 'string' ? error.providerError.message : '';
+  const text = safeErrorDetails(reason ? `${error.message}: ${reason}` : error.message);
+  failures.set(name, {
+    // Plain text, never a JSON envelope: describeError reads the kind below.
+    message: text.replace(/\s+/g, ' ').slice(0, MESSAGE_LIMIT),
+    errorKind: providerErrorKind(error),
+    at: Date.now(),
+  });
+}
+
+/** `{ message, errorKind, at }` of the provider's latest failure, or null. */
+export function providerCatalogFailure(name) {
+  return failures.get(name) ?? null;
+}
+
+export function clearProviderCatalogFailures() {
+  failures.clear();
+}

package/src/runtime/agent/orchestrator/providers/grok-oauth-login.mjs

@@ -4,7 +4,7 @@ import { createServer } from 'node:http';
 import { randomBytes } from 'node:crypto';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
 import { createOAuthPkce, parseOAuthCodeInput } from './lib/oauth-pkce.mjs';
-import { OAUTH_PAGE_CONTENT_TYPE, oauthSuccessHtml } from './lib/oauth-page.mjs';
+import { OAUTH_PAGE_CONTENT_TYPE, oauthErrorHtml, oauthSuccessHtml } from './lib/oauth-page.mjs';
 import { emailFromJwts } from './lib/oauth-token-utils.mjs';
 import {
   CLIENT_ID,
@@ -26,7 +26,8 @@ export function generatePKCE() {
   return createOAuthPkce();
 }
 
-export async function exchangeAuthorizationCode({ discovery, pkce, code }) {
+export async function exchangeAuthorizationCode({ discovery, pkce, code, signal = null }) {
+  signal?.throwIfAborted();
   const cleanCode = String(code || '').trim();
   if (!cleanCode) throw new Error('[grok-oauth] authorization code is required');
   const tokenRes = await fetch(discovery.token_endpoint, {
@@ -47,7 +48,9 @@ export async function exchangeAuthorizationCode({ discovery, pkce, code }) {
     // Secret-bearing (authorization code + verifier): refuse
     // redirects so they can't be replayed to an untrusted host.
     redirect: 'error',
-    signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
+    signal: signal
+      ? AbortSignal.any([signal, AbortSignal.timeout(TOKEN_TIMEOUT_MS)])
+      : AbortSignal.timeout(TOKEN_TIMEOUT_MS),
     dispatcher: getLlmDispatcher(),
   });
   if (!tokenRes.ok) {
@@ -72,6 +75,8 @@ export async function exchangeAuthorizationCode({ discovery, pkce, code }) {
       ? { email: emailFromJwts(json.id_token, json.access_token) }
       : {}),
   };
+  // A cancelled login never stores the account it was exchanging.
+  signal?.throwIfAborted();
   saveTokens(tokens);
   return tokens;
 }
@@ -96,11 +101,30 @@ export async function beginOAuthLogin({ openBrowser = true } = {}) {
   let server = null;
   let timeout = null;
   let finish = null;
+  let exchangePromise = null;
+  const controller = new AbortController();
+  // Browser and manual callbacks share one exchange: an authorization code is
+  // single-use, and a duplicate must not settle the login before the first.
+  const acceptCode = (code) => {
+    if (exchangePromise) return exchangePromise;
+    controller.signal.throwIfAborted();
+    // The browser deadline ends when a code arrives; the exchange has its own.
+    if (timeout) clearTimeout(timeout);
+    timeout = null;
+    exchangePromise = exchangeAuthorizationCode({ discovery, pkce, code, signal: controller.signal });
+    exchangePromise.then(
+      (tokens) => finish(tokens),
+      (err) => finish(null, err instanceof Error ? err : new Error(String(err)))
+    );
+    return exchangePromise;
+  };
   const waitForCallback = new Promise((resolve, reject) => {
     let settled = false;
     finish = (value, error = null) => {
       if (settled) return;
       settled = true;
+      // Work arriving after the login settled (or was cancelled) is rejected.
+      controller.abort();
       if (timeout) clearTimeout(timeout);
       try {
         server?.close();
@@ -120,17 +144,18 @@ export async function beginOAuthLogin({ openBrowser = true } = {}) {
       const code = u.searchParams.get('code');
       if (!code || u.searchParams.get('state') !== state) {
         // Reject this request only; the valid callback may still arrive.
-        res.writeHead(400);
-        res.end('Invalid');
+        res.writeHead(400, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE });
+        res.end(oauthErrorHtml('The sign-in callback was invalid or did not match this login.'));
         return;
       }
-      res.writeHead(200, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE });
-      res.end(oauthSuccessHtml('Grok'));
       try {
-        const tokens = await exchangeAuthorizationCode({ discovery, pkce, code });
-        finish(tokens);
-      } catch (err) {
-        finish(null, err instanceof Error ? err : new Error(String(err)));
+        await acceptCode(code);
+        res.writeHead(200, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE });
+        res.end(oauthSuccessHtml('Grok'));
+      } catch {
+        // The shared exchange reports its error through waitForCallback.
+        res.writeHead(500, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE });
+        res.end(oauthErrorHtml('Grok could not complete the token exchange.'));
       }
     });
     timeout = setTimeout(() => finish(null), LOGIN_TIMEOUT_MS);
@@ -161,9 +186,8 @@ export async function beginOAuthLogin({ openBrowser = true } = {}) {
     completeCode: async (input) => {
       const parsed = parseOAuthCodeInput(input, { allowHashState: true });
       if (parsed.state && parsed.state !== state) throw new Error('[grok-oauth] OAuth state mismatch');
-      const tokens = await exchangeAuthorizationCode({ discovery, pkce, code: parsed.code });
-      finish?.(tokens);
-      return tokens;
+      if (!parsed.code) throw new Error('[grok-oauth] authorization code is required');
+      return await acceptCode(parsed.code);
     },
     cancel: () => {
       finish?.(null);

package/src/runtime/agent/orchestrator/providers/lib/oauth-page.mjs

@@ -31,17 +31,61 @@ function escapeHtml(value) {
     .replaceAll("'", ''');
 }
 
-function renderPage({ heading, message, details }) {
-  const title = escapeHtml(heading);
+// The callback servers do not know the app language, so the default is
+// bilingual (Korean first). A known language picks one copy.
+const COPY = {
+  ko: {
+    successTitle: '로그인 완료',
+    successBody: (name) => `${name} 로그인이 완료되었습니다. 이 탭을 닫고 Mixdog로 돌아가 주세요.`,
+    failureTitle: '로그인 실패',
+    failureBody: 'Mixdog로 돌아가 다시 시도해 주세요.',
+    reason: '사유',
+    close: '닫기',
+  },
+  en: {
+    successTitle: 'Sign-in complete',
+    successBody: (name) => `You are signed in to ${name}. You can close this tab and return to Mixdog.`,
+    failureTitle: 'Sign-in failed',
+    failureBody: 'Return to Mixdog and try again.',
+    reason: 'Reason',
+    close: 'Close',
+  },
+};
+
+function renderPage({ kind, providerName, reason, lang }) {
+  const langs = lang === 'ko' || lang === 'en' ? [lang] : ['ko', 'en'];
+  const blocks = langs
+    .map((code, index) => {
+      const copy = COPY[code];
+      const title = kind === 'success' ? copy.successTitle : copy.failureTitle;
+      const body = kind === 'success' ? copy.successBody(providerName) : copy.failureBody;
+      const tag = index === 0 ? 'h1' : 'h2';
+      return `<section lang="${code}" class="${index === 0 ? 'primary' : 'secondary'}">
+      <${tag}>${escapeHtml(title)}</${tag}>
+      <p>${escapeHtml(body)}</p>
+    </section>`;
+    })
+    .join('\n    ');
+  const reasonBlock = reason
+    ? `<div class="reason"><span>${langs.map((code) => COPY[code].reason).join(' / ')}</span>${escapeHtml(reason)}</div>`
+    : '';
+  const close = langs.map((code) => COPY[code].close).join(' · ');
+  const documentTitle = escapeHtml(
+    `${langs.map((code) => COPY[code][kind === 'success' ? 'successTitle' : 'failureTitle']).join(' / ')} · Mixdog`
+  );
   return `<!doctype html>
-<html lang="en">
+<html lang="${langs[0]}">
 <head>
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>${title} · Mixdog</title>
+  <meta name="color-scheme" content="dark light" />
+  <title>${documentTitle}</title>
   <style>
+    :root { --bg: #f6f7f9; --fg: #0f172a; --muted: #475569; --card: #ffffff; --line: #d9dee6; --ok: #15803d; --bad: #b91c1c; --link: #1d4ed8; }
+    @media (prefers-color-scheme: dark) {
+      :root { --bg: #07080b; --fg: #f8fafc; --muted: #94a3b8; --card: #0f1116; --line: #232733; --ok: #4ade80; --bad: #f87171; --link: #93c5fd; }
+    }
     * { box-sizing: border-box; }
-    html { color-scheme: dark; }
     body {
       margin: 0;
       min-height: 100vh;
@@ -49,32 +93,65 @@ function renderPage({ heading, message, details }) {
       align-items: center;
       justify-content: center;
       padding: 24px;
-      background: #07080b;
-      color: #f8fafc;
-      font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif;
+      background: var(--bg);
+      color: var(--fg);
+      font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", "Malgun Gothic", "Apple SD Gothic Neo", "Noto Sans KR", Roboto, Arial, sans-serif;
       text-align: center;
     }
-    main { width: 100%; max-width: 560px; display: flex; flex-direction: column; align-items: center; }
-    .logo { width: 72px; height: 72px; margin-bottom: 24px; }
+    main {
+      width: 100%;
+      max-width: 520px;
+      padding: 40px 32px 32px;
+      background: var(--card);
+      border: 1px solid var(--line);
+      border-radius: 16px;
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+    }
+    .logo { width: 72px; height: 72px; margin-bottom: 20px; }
     .logo svg { width: 100%; height: 100%; display: block; }
-    h1 { margin: 0 0 10px; font-size: 28px; line-height: 1.15; font-weight: 650; }
-    p { margin: 0; line-height: 1.7; color: #94a3b8; font-size: 15px; }
-    .details {
-      margin-top: 16px;
-      font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", monospace;
+    h1, h2 { margin: 0 0 6px; line-height: 1.2; font-weight: 650; }
+    h1 { font-size: 28px; color: ${kind === 'success' ? 'var(--ok)' : 'var(--bad)'}; }
+    h2 { font-size: 16px; color: var(--muted); font-weight: 600; }
+    p { margin: 0; line-height: 1.7; color: var(--muted); font-size: 15px; }
+    section.secondary { margin-top: 18px; }
+    .reason {
+      margin-top: 20px;
+      width: 100%;
+      padding: 12px 14px;
+      border: 1px solid var(--line);
+      border-radius: 10px;
+      text-align: left;
+      font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
       font-size: 13px;
-      color: #94a3b8;
+      color: var(--fg);
       white-space: pre-wrap;
       word-break: break-word;
     }
+    .reason span { display: block; margin-bottom: 4px; color: var(--muted); font-family: inherit; font-size: 12px; }
+    button {
+      margin-top: 24px;
+      min-width: 120px;
+      height: 40px;
+      padding: 0 20px;
+      border: 1px solid var(--line);
+      border-radius: 10px;
+      background: transparent;
+      color: var(--fg);
+      font: inherit;
+      font-size: 14px;
+      cursor: pointer;
+    }
+    button:hover { border-color: var(--muted); }
   </style>
 </head>
 <body>
   <main>
     <div class="logo">${LOGO_SVG}</div>
-    <h1>${title}</h1>
-    <p>${escapeHtml(message)}</p>
-    ${details ? `<div class="details">${escapeHtml(details)}</div>` : ''}
+    ${blocks}
+    ${reasonBlock}
+    <button type="button" onclick="window.close()">${escapeHtml(close)}</button>
   </main>
 </body>
 </html>`;
@@ -82,13 +159,10 @@ function renderPage({ heading, message, details }) {
 
 export const OAUTH_PAGE_CONTENT_TYPE = 'text/html; charset=utf-8';
 
-export function oauthSuccessHtml(providerName) {
-  return renderPage({
-    heading: 'Authentication successful',
-    message: `Signed in to ${providerName}. You can close this tab and return to Mixdog.`,
-  });
+export function oauthSuccessHtml(providerName, { lang } = {}) {
+  return renderPage({ kind: 'success', providerName, lang });
 }
 
-export function oauthErrorHtml(message, details) {
-  return renderPage({ heading: 'Authentication failed', message, details });
+export function oauthErrorHtml(reason, { lang } = {}) {
+  return renderPage({ kind: 'failure', reason, lang });
 }

package/src/runtime/agent/orchestrator/providers/lib/send-callbacks.mjs

@@ -8,5 +8,29 @@ export function streamCallbacks(opts) {
     onToolCall: functionOrNull(opts.onToolCall),
     onTextDelta: functionOrNull(opts.onTextDelta),
     onTextReset: functionOrNull(opts.onTextReset),
+    onStreamItemStart: functionOrNull(opts.onStreamItemStart),
   };
 }
+
+/** Tell the caller a provider output item started streaming: `{ kind: 'tool' }`
+ *  for a client tool call whose arguments are still on the way, `{ kind:
+ *  'text', phase }` for an assistant message that names its phase
+ *  (`commentary` / `final_answer`). A listener failure never reaches the
+ *  stream. */
+export function reportStreamItemStart(onStreamItemStart, detail) {
+  if (typeof onStreamItemStart !== 'function' || !detail) return;
+  try {
+    onStreamItemStart(detail);
+  } catch {}
+}
+
+const ASSISTANT_PHASES = new Set(['commentary', 'final_answer']);
+
+/** What a Responses output item tells `reportStreamItemStart`: a client tool
+ *  call, an assistant message carrying its phase, or nothing (null). */
+export function responsesItemStart(item) {
+  const type = item?.type;
+  if (type === 'function_call' || type === 'custom_tool_call' || type === 'tool_search_call') return { kind: 'tool' };
+  if (type === 'message' && ASSISTANT_PHASES.has(item.phase)) return { kind: 'text', phase: item.phase };
+  return null;
+}

package/src/runtime/agent/orchestrator/providers/oauth-credential-probes.mjs

@@ -5,6 +5,7 @@ import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
 import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
 import { cursorTokenExpiry } from './cursor-auth.mjs';
 import { isValidMuseCredentialDocument } from './muse-code-oauth-tokens.mjs';
+import { isValidOpenCodeGoCredentialDocument } from './opencode-go-oauth-tokens.mjs';
 import { developerOptionEnabled, developerOptionForProvider } from '../../../shared/developer-options.mjs';
 import { modelProxyClientMode } from '../../../shared/model-proxy-mode.mjs';
 
@@ -198,6 +199,17 @@ function museCodeOAuthState() {
   );
 }
 
+function openCodeGoOAuthState() {
+  const paths = [
+    boundProviderAuthPath('opencode-go-oauth') ||
+      process.env.OPENCODE_GO_OAUTH_CREDENTIALS_PATH ||
+      join(resolvePluginData(), 'opencode-go-oauth.json'),
+  ];
+  return memoProbe('opencode-go-oauth', paths, () =>
+    resolveProbeState(paths, (docs) => docs.some(isValidOpenCodeGoCredentialDocument))
+  );
+}
+
 // Antigravity needs a resolved Cloud project alongside the tokens: without it
 // every request 400s, so a half-finished login must not enable the provider.
 function antigravityOAuthState() {
@@ -270,6 +282,7 @@ const OAUTH_PROBE_STATES = new Map([
   ['mimo-oauth', mimoOAuthState],
   ['cursor-oauth', cursorOAuthState],
   ['antigravity-oauth', antigravityOAuthState],
+  ['opencode-go-oauth', openCodeGoOAuthState],
 ]);
 
 // Dev-only OAuth providers (Antigravity, Cursor). Each is hidden and treated as

package/src/runtime/agent/orchestrator/providers/oauth-usage.mjs

@@ -869,7 +869,8 @@ async function measureUsage(provider, providerObj, routeInfo) {
       provider === 'cursor-api' ||
       provider === 'antigravity-oauth' ||
       provider === 'muse-code-oauth' ||
-      provider === 'command-code-oauth') &&
+      provider === 'command-code-oauth' ||
+      provider === 'opencode-go-oauth') &&
     typeof providerObj?.getUsageSnapshot === 'function'
   ) {
     return await providerObj.getUsageSnapshot();

package/src/runtime/agent/orchestrator/providers/openai-compat-chat-send.mjs

@@ -187,6 +187,7 @@ export async function sendCompatChat(provider, messages, useModel, tools, opts)
                 onStreamDelta: opts.onStreamDelta,
                 onToolCall: opts.onToolCall,
                 onTextDelta: opts.onTextDelta,
+                onStreamItemStart: opts.onStreamItemStart,
                 parseToolCalls,
                 // Known tool names for the leaked-tool-call guard:
                 // recovered leaked calls only synthesize when they name

package/src/runtime/agent/orchestrator/providers/openai-compat-chat-stream/chunk-events.mjs

@@ -4,6 +4,7 @@
  * reasoning aliases, tool_calls deltas, finish reason and usage.
  */
 import { mergeToolCallDelta } from './tool-call-acc.mjs';
+import { reportStreamItemStart } from '../lib/send-callbacks.mjs';
 import { appendText, drainLeakedCalls, relayText, reportProgress, reportTransport } from './stream-state.mjs';
 import { chatContentParts } from '../openai-compat-reasoning-field.mjs';
 
@@ -58,7 +59,10 @@ export function applyCompatChunk(state, chunk) {
   if (Array.isArray(delta?.tool_calls) && delta.tool_calls.length) {
     reportProgress(state, 'tool');
   }
+  const toolsBefore = state.toolAcc.byKey.size;
   mergeToolCallDelta(state.toolAcc, delta?.tool_calls);
+  // A tool call's first delta: its arguments are still streaming.
+  if (state.toolAcc.byKey.size > toolsBefore) reportStreamItemStart(state.onStreamItemStart, { kind: 'tool' });
   if (choice?.finish_reason) {
     state.stopReason = choice.finish_reason;
     drainLeakedCalls(state);

package/src/runtime/agent/orchestrator/providers/openai-compat-chat-stream/stream-state.mjs

@@ -22,6 +22,7 @@ export function createCompatStreamState({
   onStreamDelta,
   onToolCall,
   onTextDelta,
+  onStreamItemStart,
 }) {
   const toolDedupe = createToolCallDedupe();
   return {
@@ -30,6 +31,7 @@ export function createCompatStreamState({
     onStreamDelta,
     onToolCall,
     onTextDelta,
+    onStreamItemStart,
     semanticIdleDeadlineAt: 0,
     sawFirstEvent: false,
     content: '',
@@ -86,7 +88,7 @@ export function isIncompleteFinishReason(finishReason) {
 
 /** Whether `finish_reason` confirms a normal end of the turn: present, not an
  *  incomplete outcome and not a gateway-reported failure (network_error/error). */
-export function isNormalFinishReason(finishReason) {
+function isNormalFinishReason(finishReason) {
   return (
     Boolean(finishReason) && !isIncompleteFinishReason(finishReason) && !failingFinishReasonError(finishReason, '')
   );

package/src/runtime/agent/orchestrator/providers/openai-compat-chat-stream.mjs

@@ -39,6 +39,7 @@ export async function consumeCompatChatCompletionStream(
     onStreamDelta,
     onToolCall,
     onTextDelta,
+    onStreamItemStart,
     parseToolCalls,
     knownToolNames,
     semanticIdleTimeoutMs,
@@ -55,6 +56,7 @@ export async function consumeCompatChatCompletionStream(
     onStreamDelta,
     onToolCall,
     onTextDelta,
+    onStreamItemStart,
   });
   reportTransport(state);
   const iterator = stream[Symbol.asyncIterator]();