mixdog 1.2.5 → 1.2.6

package/src/runtime/agent/orchestrator/providers/openai-compat-models.mjs

@@ -47,23 +47,68 @@ export function extractCompatReasoningEffort(model) {
   return null;
 }
 
+const ERROR_BODY_LIMIT = 4096;
+// An echoed key prefix this long (or the whole key, if shorter) is redacted.
+const ECHOED_KEY_PREFIX_MIN = 8;
+
+// Replaces the request key, and any run of its first ECHOED_KEY_PREFIX_MIN or
+// more characters ("Incorrect API key provided: xai-abcd****"), in `value`.
+function redactRequestKey(value, key) {
+  if (!key) return value;
+  const min = Math.min(ECHOED_KEY_PREFIX_MIN, key.length);
+  let out = '';
+  for (let i = 0; i < value.length; ) {
+    let n = 0;
+    while (n < key.length && value[i + n] === key[n]) n += 1;
+    if (n >= min) {
+      out += '[redacted]';
+      i += n;
+    } else {
+      out += value[i];
+      i += 1;
+    }
+  }
+  return out;
+}
+
+// A refused /models request keeps the provider's own reason (status plus the
+// body's code/type/message) so the UI can say why the list is empty. The
+// message stays `<name> models <status>`; the body rides on `providerError`,
+// with the request key (`apiKey`) redacted from it.
+async function compatModelsError(name, res, apiKey = '') {
+  const error = Object.assign(new Error(`${name} models ${res.status}`), { status: res.status });
+  try {
+    const body = JSON.parse((await res.text()).slice(0, ERROR_BODY_LIMIT));
+    const nested = body?.error && typeof body.error === 'object' ? body.error : null;
+    const text = (value) => (typeof value === 'string' && value ? redactRequestKey(value, apiKey) : undefined);
+    const providerError = {
+      message: text(body?.error) ?? text(nested?.message) ?? text(body?.message),
+      code: text(nested?.code) ?? text(body?.code),
+      type: text(nested?.type) ?? text(body?.type),
+    };
+    if (providerError.message || providerError.code || providerError.type) error.providerError = providerError;
+  } catch {
+    // A body that is not JSON adds no detail.
+  }
+  return error;
+}
+
 // `keyless` omits the Authorization header entirely (keyless endpoints);
 // `signal` aborts the request together with the list timeout.
 export async function fetchCompatModelItems(provider, { signal = null, keyless = false } = {}) {
   const name = provider.name;
   const timeout = createTimeoutSignal(signal, MODEL_LIST_TIMEOUT_MS, `${name} model list`);
   try {
+    const apiKey = keyless ? '' : resolveProviderApiKey(name, provider.config || provider);
     const res = await fetch(`${String(provider.baseURL || '').replace(/\/+$/, '')}/models`, {
       method: 'GET',
       headers: {
-        ...(keyless
-          ? {}
-          : { Authorization: `Bearer ${resolveProviderApiKey(name, provider.config || provider) || 'no-key'}` }),
+        ...(keyless ? {} : { Authorization: `Bearer ${apiKey || 'no-key'}` }),
         ...(provider.defaultHeaders || {}),
       },
       signal: timeout.signal,
     });
-    if (!res.ok) throw Object.assign(new Error(`${provider.name} models ${res.status}`), { status: res.status });
+    if (!res.ok) throw await compatModelsError(provider.name, res, apiKey);
     const data = await res.json();
     if (Array.isArray(data?.data)) return data.data;
     if (Array.isArray(data)) return data;

package/src/runtime/agent/orchestrator/providers/openai-compat-presets.mjs

@@ -9,13 +9,6 @@ export const OPENAI_COMPAT_PRESETS = {
     baseURL: 'https://api.x.ai/v1',
     defaultModel: 'grok-4.5',
   },
-  // OpenCode Go - low-cost coding-model subscription gateway.
-  'opencode-go': {
-    baseURL: 'https://opencode.ai/inference/go/v1',
-    defaultModel: 'glm-5.2',
-    // The gateway expects an application User-Agent (not the SDK default).
-    extraHeaders: { 'User-Agent': 'mixdog' },
-  },
   openrouter: {
     baseURL: 'https://openrouter.ai/api/v1',
     defaultModel: 'openrouter/auto',

package/src/runtime/agent/orchestrator/providers/openai-compat-responses-events.mjs

@@ -14,6 +14,7 @@ import { truncatedCompatStreamError, parseCompletedToolCallArgumentsJson } from
 import { incompleteReasonFromEvent, isMaxOutputIncompleteReason } from './lib/responses-terminal-fields.mjs';
 import { responsesUsage } from './openai-compat-response-normalization.mjs';
 import { normalizeGatewayErrorDetail } from './provider-error-kind.mjs';
+import { reportStreamItemStart, responsesItemStart } from './lib/send-callbacks.mjs';
 
 // An incomplete response was still billed: carry its reported usage on the
 // error so the provider-boundary accounting records it.
@@ -194,6 +195,7 @@ function onOutputItemAdded(event, state, ctx) {
     state.toolTracker?.mark(event.item);
     state.toolInFlight = true;
   }
+  reportStreamItemStart(ctx.onStreamItemStart, responsesItemStart(event.item));
   signal(ctx, state.toolInFlight ? 'tool' : 'semantic');
 }
 
@@ -249,7 +251,11 @@ function onRefusalDone(event, state, ctx) {
 
 function onOutputItemDone(event, state, ctx) {
   const item = event.item || {};
-  if (item.type === 'message') refusalsOf(state).absorbMessage(item);
+  if (item.type === 'message') {
+    refusalsOf(state).absorbMessage(item);
+    // A stream that names the phase only on the finished item.
+    reportStreamItemStart(ctx.onStreamItemStart, responsesItemStart(item));
+  }
   if (item.type === 'function_call') {
     const itemId = reconcileCompatFunctionCallItem(state, item, ctx.label, ctx.onToolCall);
     // Drop the resolved function item from pendingCalls before

package/src/runtime/agent/orchestrator/providers/openai-compat-responses.mjs

@@ -243,6 +243,7 @@ async function streamCompatResponses({ provider, params, label, signal, opts, he
             onStreamDelta: opts.onStreamDelta,
             onToolCall: opts.onToolCall,
             onTextDelta: opts.onTextDelta,
+            onStreamItemStart: opts.onStreamItemStart,
             parseResponsesToolCalls,
             responseOutputText,
             knownToolNames: knownToolNamesFromResponsesTools(params.tools),

package/src/runtime/agent/orchestrator/providers/openai-compat-stream.mjs

@@ -51,6 +51,7 @@ export async function consumeCompatResponsesStream(
     onStreamDelta,
     onToolCall,
     onTextDelta,
+    onStreamItemStart,
     parseResponsesToolCalls,
     responseOutputText,
     knownToolNames,
@@ -89,6 +90,7 @@ export async function consumeCompatResponsesStream(
     onStreamDelta: reportProgress,
     onToolCall,
     onTextDelta,
+    onStreamItemStart,
     relayLeakText,
   };
   const stampOutcome = createResponsesOutcomeStamper(state, leakedCalls);

package/src/runtime/agent/orchestrator/providers/openai-compat-xai-send.mjs

@@ -134,6 +134,7 @@ export async function sendXaiResponses(provider, messages, useModel, tools, opts
             onStreamDelta: opts.onStreamDelta,
             onToolCall: opts.onToolCall,
             onTextDelta: opts.onTextDelta,
+            onStreamItemStart: opts.onStreamItemStart,
             parseResponsesToolCalls,
             responseOutputText,
             knownToolNames: knownToolNamesFromResponsesTools(params.tools),

package/src/runtime/agent/orchestrator/providers/openai-http-sse-response-state/response-events.mjs

@@ -5,8 +5,9 @@
  */
 import { createOutputItemEvents } from './response-events/output-items.mjs';
 import { createTerminalFrameEvents } from './response-events/terminal-frames.mjs';
+import { reportStreamItemStart, responsesItemStart } from '../lib/send-callbacks.mjs';
 
-export function createResponseEvents({ state, items, text, outcome, meaningful, onServerEvent }) {
+export function createResponseEvents({ state, items, text, outcome, meaningful, onServerEvent, onStreamItemStart }) {
   const output = createOutputItemEvents({ state, items, meaningful });
   const terminal = createTerminalFrameEvents({ state, items, text, outcome, meaningful });
 
@@ -34,6 +35,7 @@ export function createResponseEvents({ state, items, text, outcome, meaningful,
         break;
       case 'response.output_item.added':
         output.onOutputItemAdded(event.item);
+        reportStreamItemStart(onStreamItemStart, responsesItemStart(event.item));
         break;
       case 'response.function_call_arguments.delta':
       case 'response.custom_tool_call_input.delta':
@@ -54,6 +56,8 @@ export function createResponseEvents({ state, items, text, outcome, meaningful,
         break;
       case 'response.output_item.done':
         output.onOutputItemDone(event.item || {});
+        // A stream that names the phase only on the finished message.
+        if (event.item?.type === 'message') reportStreamItemStart(onStreamItemStart, responsesItemStart(event.item));
         break;
       case 'response.completed':
         terminal.onCompleted(event);

package/src/runtime/agent/orchestrator/providers/openai-http-sse-response-state.mjs

@@ -25,13 +25,22 @@ import { createResponseEvents } from './openai-http-sse-response-state/response-
  * @param {(text: string) => void} [deps.onTextDelta]
  * @param {(kind: string) => void} deps.meaningful  semantic progress (re-arms the idle watchdog)
  * @param {() => void} deps.onServerEvent  first-event → semantic-idle handover
+ * @param {(detail: object) => void} [deps.onStreamItemStart]  a tool call or phased message started
  */
-export function createHttpSseResponseState({ body, onToolCall, onTextDelta, meaningful, onServerEvent, label }) {
+export function createHttpSseResponseState({
+  body,
+  onToolCall,
+  onTextDelta,
+  onStreamItemStart = null,
+  meaningful,
+  onServerEvent,
+  label,
+}) {
   const state = createResponseState(label);
   const outcome = createResponseOutcome({ state });
   const items = createResponseItems({ state, onToolCall });
   const text = createTextRelay({ state, body, onTextDelta, meaningful, emitToolCall: items.emitToolCall });
-  const events = createResponseEvents({ state, items, text, outcome, meaningful, onServerEvent });
+  const events = createResponseEvents({ state, items, text, outcome, meaningful, onServerEvent, onStreamItemStart });
 
   return {
     handleEvent: events.handleEvent,

package/src/runtime/agent/orchestrator/providers/openai-oauth-http-sse.mjs

@@ -195,6 +195,7 @@ export async function sendViaHttpSse({
     body,
     onToolCall,
     onTextDelta,
+    onStreamItemStart: typeof opts?.onStreamItemStart === 'function' ? opts.onStreamItemStart : null,
     meaningful,
     onServerEvent: watchdogs.noteServerEvent,
     label,

package/src/runtime/agent/orchestrator/providers/openai-oauth-login.mjs

@@ -11,7 +11,7 @@
 import { createServer } from 'node:http';
 import { randomBytes } from 'node:crypto';
 import { createOAuthPkce, parseOAuthCodeInput } from './lib/oauth-pkce.mjs';
-import { OAUTH_PAGE_CONTENT_TYPE, oauthSuccessHtml } from './lib/oauth-page.mjs';
+import { OAUTH_PAGE_CONTENT_TYPE, oauthErrorHtml, oauthSuccessHtml } from './lib/oauth-page.mjs';
 import { openLoginUrl } from './lib/open-login-url.mjs';
 
 const TOKEN_URL = 'https://auth.openai.com/oauth/token';
@@ -44,7 +44,8 @@ function _scrubOAuthLoginBody(text) {
 export function createOpenAIOAuthLogin(deps) {
   const { clientId, originator, extractAccountId, identityFromTokens, expiryFromAccessToken, saveTokens } = deps;
 
-  async function exchangeAuthorizationCode({ pkce, code }) {
+  async function exchangeAuthorizationCode({ pkce, code, signal = null }) {
+    signal?.throwIfAborted();
     const cleanCode = String(code || '').trim();
     if (!cleanCode) throw new Error('[openai-oauth] authorization code is required');
     const tokenRes = await fetch(TOKEN_URL, {
@@ -58,7 +59,9 @@ export function createOpenAIOAuthLogin(deps) {
         code_verifier: pkce.verifier,
       }),
       redirect: 'error',
-      signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
+      signal: signal
+        ? AbortSignal.any([signal, AbortSignal.timeout(TOKEN_TIMEOUT_MS)])
+        : AbortSignal.timeout(TOKEN_TIMEOUT_MS),
     });
     if (!tokenRes.ok) {
       const text = await tokenRes.text().catch(() => '');
@@ -78,6 +81,8 @@ export function createOpenAIOAuthLogin(deps) {
       account_id: extractAccountId(json.access_token),
       identity: identityFromTokens(json.id_token, json.access_token),
     };
+    // A cancelled login never stores the account it was exchanging.
+    signal?.throwIfAborted();
     saveTokens(tokens);
     return tokens;
   }
@@ -100,11 +105,30 @@ export function createOpenAIOAuthLogin(deps) {
     let server = null;
     let timeout = null;
     let finish = null;
+    let exchangePromise = null;
+    const controller = new AbortController();
+    // Browser and manual callbacks share one exchange: an authorization code is
+    // single-use, and a duplicate must not settle the login before the first.
+    const acceptCode = (code) => {
+      if (exchangePromise) return exchangePromise;
+      controller.signal.throwIfAborted();
+      // The browser deadline ends when a code arrives; the exchange has its own.
+      if (timeout) clearTimeout(timeout);
+      timeout = null;
+      exchangePromise = exchangeAuthorizationCode({ pkce, code, signal: controller.signal });
+      exchangePromise.then(
+        (tokens) => finish(tokens),
+        (err) => finish(null, err instanceof Error ? err : new Error(String(err)))
+      );
+      return exchangePromise;
+    };
     const waitForCallback = new Promise((resolve, reject) => {
       let settled = false;
       finish = (value, error = null) => {
         if (settled) return;
         settled = true;
+        // Work arriving after the login settled (or was cancelled) is rejected.
+        controller.abort();
         if (timeout) clearTimeout(timeout);
         try {
           server?.close();
@@ -122,19 +146,25 @@ export function createOpenAIOAuthLogin(deps) {
           return;
         }
         const code = u.searchParams.get('code');
-        if (!code || u.searchParams.get('state') !== state) {
-          res.writeHead(400);
-          res.end('Invalid');
-          finish(null);
+        const stateMatches = u.searchParams.get('state') === state;
+        if (!code || !stateMatches) {
+          res.writeHead(400, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE });
+          res.end(oauthErrorHtml('The sign-in callback was invalid or did not match this login.'));
+          // A request for another login is rejected alone; this login's
+          // legitimate callback may still arrive.
+          if (stateMatches && !exchangePromise) finish(null);
           return;
         }
-        res.writeHead(200, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE });
-        res.end(oauthSuccessHtml('OpenAI'));
         try {
-          const tokens = await exchangeAuthorizationCode({ pkce, code });
-          finish(tokens);
-        } catch (err) {
-          finish(null, err instanceof Error ? err : new Error(String(err)));
+          await acceptCode(code);
+          // The login settles (closing the server) before this response is
+          // written; do not leave a keep-alive connection bound to it.
+          res.writeHead(200, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE, Connection: 'close' });
+          res.end(oauthSuccessHtml('OpenAI'));
+        } catch {
+          // The shared exchange reports its error through waitForCallback.
+          res.writeHead(500, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE, Connection: 'close' });
+          res.end(oauthErrorHtml('OpenAI could not complete the token exchange.'));
         }
       });
       timeout = setTimeout(() => finish(null), LOGIN_TIMEOUT_MS);
@@ -161,9 +191,8 @@ export function createOpenAIOAuthLogin(deps) {
       completeCode: async (input) => {
         const parsed = parseOAuthCodeInput(input, { allowHashState: true });
         if (parsed.state && parsed.state !== state) throw new Error('[openai-oauth] OAuth state mismatch');
-        const tokens = await exchangeAuthorizationCode({ pkce, code: parsed.code });
-        finish?.(tokens);
-        return tokens;
+        if (!parsed.code) throw new Error('[openai-oauth] authorization code is required');
+        return await acceptCode(parsed.code);
       },
       cancel: () => {
         finish?.(null);

package/src/runtime/agent/orchestrator/providers/openai-oauth-ws.mjs

@@ -297,6 +297,7 @@ export async function sendViaWebSocket({
         onStreamDelta,
         onToolCall,
         onTextDelta,
+        onStreamItemStart: typeof sendOpts?.onStreamItemStart === 'function' ? sendOpts.onStreamItemStart : null,
         state: midState,
         logSuppressedReasoningDeltas,
         traceProvider,

package/src/runtime/agent/orchestrator/providers/openai-ws-connect.mjs

@@ -0,0 +1,196 @@
+/**
+ * openai-ws-connect.mjs — how a Responses WebSocket reaches the server.
+ *
+ * Every pool handshake is a brand-new TCP+TLS connection (the upgrade detaches
+ * it from any HTTP keep-alive pool), so a burst of agents starting together
+ * pays one DNS resolution and one full TLS handshake per socket. This module
+ * removes the repeated work and the long stall:
+ *
+ *   - lookup: one resolution per host, shared by concurrent handshakes and
+ *     reused for a short TTL (libuv's small thread pool otherwise queues one
+ *     getaddrinfo per socket behind unrelated file I/O);
+ *   - TLS resumption: the latest session ticket per host rides the next
+ *     connect, so later sockets skip the full key exchange;
+ *   - hedged open: an upgrade that has not opened within the hedge window
+ *     gets a parallel replacement attempt instead of waiting out the whole
+ *     acquire timeout. The first leg to open wins; the rest are cancelled.
+ *     Server decisions (any HTTP status on the upgrade, e.g. 429/401) end
+ *     the race at once so backoff stays driven by real server signals.
+ */
+import { lookup as dnsLookup } from 'node:dns';
+import net from 'node:net';
+import tls from 'node:tls';
+import { resolveTimeoutMs } from '../stall-policy.mjs';
+
+const DNS_TTL_MS = resolveTimeoutMs('MIXDOG_PROVIDER_WS_DNS_TTL_MS', 30_000, { minMs: 1_000, maxMs: 300_000 });
+// Observed production upgrades: p95 ≈ 0.55s, max ≈ 3.4s over 6k handshakes,
+// so a leg still unopened after 3s is almost certainly stuck.
+const WS_HEDGE_MS = resolveTimeoutMs('MIXDOG_PROVIDER_WS_HEDGE_MS', 3_000, { minMs: 500, maxMs: 60_000 });
+
+const _dnsCache = new Map();
+
+function _lookupKey(hostname, options) {
+  return `${hostname}\0${options?.family || 0}\0${options?.hints || 0}`;
+}
+
+function _answer(addresses, options, callback) {
+  if (options?.all) {
+    callback(null, addresses);
+    return;
+  }
+  const first = addresses[0];
+  callback(null, first.address, first.family);
+}
+
+/** dns.lookup-compatible resolver with in-flight coalescing and a short TTL. */
+export function cachedLookup(hostname, options, callback) {
+  const opts = typeof options === 'function' ? {} : typeof options === 'number' ? { family: options } : options || {};
+  const cb = typeof options === 'function' ? options : callback;
+  const key = _lookupKey(hostname, opts);
+  const cached = _dnsCache.get(key);
+  if (cached?.addresses && cached.expiresAt > Date.now()) {
+    _answer(cached.addresses, opts, cb);
+    return;
+  }
+  if (cached?.waiters) {
+    cached.waiters.push({ opts, cb });
+    return;
+  }
+  const record = { waiters: [{ opts, cb }] };
+  _dnsCache.set(key, record);
+  dnsLookup(hostname, { family: opts.family || 0, hints: opts.hints || 0, all: true }, (err, addresses) => {
+    const waiters = record.waiters;
+    if (err || !addresses?.length) {
+      if (_dnsCache.get(key) === record) _dnsCache.delete(key);
+      const failure = err || Object.assign(new Error(`lookup ${hostname} returned no address`), { code: 'ENOTFOUND' });
+      for (const waiter of waiters) waiter.cb(failure);
+      return;
+    }
+    _dnsCache.set(key, { addresses, expiresAt: Date.now() + DNS_TTL_MS });
+    for (const waiter of waiters) _answer(addresses, waiter.opts, waiter.cb);
+  });
+}
+
+const _tlsSessions = new Map();
+
+/**
+ * `ws` createConnection: the shared lookup for every socket, plus TLS
+ * resumption for secure ones. Mirrors ws's own servername defaulting.
+ */
+export function createWsConnection(options) {
+  if (options.protocol === 'ws:' || options.protocol === 'http:') {
+    return net.connect({ ...options, path: options.socketPath, lookup: cachedLookup });
+  }
+  const sessionKey = `${options.host}:${options.port}`;
+  const servername =
+    options.servername || options.servername === '' ? options.servername : net.isIP(options.host) ? '' : options.host;
+  const socket = tls.connect({
+    ...options,
+    path: undefined,
+    servername,
+    lookup: cachedLookup,
+    session: _tlsSessions.get(sessionKey),
+  });
+  socket.on('session', (session) => _tlsSessions.set(sessionKey, session));
+  return socket;
+}
+
+/** Test-only reset of the resolver and TLS session caches. */
+export function _clearConnectCachesForTest() {
+  _dnsCache.clear();
+  _tlsSessions.clear();
+}
+
+function _abortReason(signal, fallback) {
+  return signal?.reason instanceof Error ? signal.reason : new Error(fallback);
+}
+
+/**
+ * Race handshake legs until one opens. `openLeg({ externalSignal })` opens one
+ * socket and resolves `{ socket }`. A new leg starts every `hedgeMs` while
+ * none has opened and the acquire deadline leaves room; a leg's transport
+ * failure only ends the race when nothing else is still connecting.
+ */
+export function openHedged({ openLeg, externalSignal, hedgeMs = WS_HEDGE_MS, deadlineMs, deadlineError }) {
+  return new Promise((resolve, reject) => {
+    const startedAt = Date.now();
+    const legs = new Set();
+    let settled = false;
+    let hedgeTimer = null;
+    let deadlineTimer = null;
+    let lastError = null;
+
+    const cleanup = () => {
+      if (hedgeTimer) clearTimeout(hedgeTimer);
+      if (deadlineTimer) clearTimeout(deadlineTimer);
+      externalSignal?.removeEventListener?.('abort', onExternalAbort);
+    };
+    const cancelLegs = (reason) => {
+      for (const leg of legs) leg.abort(reason);
+      legs.clear();
+    };
+    const finish = (ok, value) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      (ok ? resolve : reject)(value);
+    };
+    const fail = (err) => {
+      cancelLegs(err);
+      finish(false, err);
+    };
+    function onExternalAbort() {
+      fail(_abortReason(externalSignal, 'OpenAI WS handshake aborted'));
+    }
+
+    const scheduleHedge = () => {
+      if (settled || !(hedgeMs > 0)) return;
+      if (Date.now() - startedAt + hedgeMs >= deadlineMs) return;
+      hedgeTimer = setTimeout(() => {
+        hedgeTimer = null;
+        startLeg();
+      }, hedgeMs);
+      hedgeTimer.unref?.();
+    };
+
+    function startLeg() {
+      if (settled) return;
+      const controller = new AbortController();
+      legs.add(controller);
+      Promise.resolve()
+        .then(() => openLeg({ externalSignal: controller.signal }))
+        .then(
+          (opened) => {
+            legs.delete(controller);
+            if (settled) {
+              try {
+                opened?.socket?.terminate?.();
+              } catch {}
+              return;
+            }
+            cancelLegs(new Error('OpenAI WS handshake superseded by a faster attempt'));
+            finish(true, opened);
+          },
+          (err) => {
+            legs.delete(controller);
+            if (settled || controller.signal.aborted) return;
+            lastError = err;
+            // An HTTP status is the server's decision for this request
+            // (rate limit, auth, upgrade refusal): surface it unchanged.
+            if (err?.httpStatus != null || legs.size === 0) fail(err);
+          }
+        );
+      if (hedgeTimer) clearTimeout(hedgeTimer);
+      scheduleHedge();
+    }
+
+    if (externalSignal?.aborted) {
+      onExternalAbort();
+      return;
+    }
+    externalSignal?.addEventListener?.('abort', onExternalAbort, { once: true });
+    deadlineTimer = setTimeout(() => fail(lastError?.httpStatus != null ? lastError : deadlineError()), deadlineMs);
+    deadlineTimer.unref?.();
+    startLeg();
+  });
+}

package/src/runtime/agent/orchestrator/providers/openai-ws-pool.mjs

@@ -9,6 +9,7 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { performance } from 'node:perf_hooks';
 import { attachHandshakeFailureHandlers, captureHandshakeUpgrade } from './openai-ws-handshake.mjs';
+import { createWsConnection, openHedged } from './openai-ws-connect.mjs';
 import { codexOriginator, codexUserAgent, codexVersionHeader } from './codex-client-meta.mjs';
 import {
   PROVIDER_WS_ACQUIRE_TIMEOUT_MS,
@@ -539,7 +540,26 @@ const WS_URL_BY_AUTH = { xai: XAI_WS_URL, 'openai-direct': OPENAI_WS_URL };
 /** The auth kind an error label names; anything but xAI/direct is the OAuth (Codex) path. */
 const _wsAuthKind = (auth) => (auth?.type === 'xai' || auth?.type === 'openai-direct' ? auth.type : 'openai-oauth');
 
-async function _openSocket({ auth, sessionToken, externalSignal, cacheKey, codexHeaders }) {
+function _acquireTimeoutError(auth) {
+  return Object.assign(
+    new Error(`${_wsErrLabel(_wsAuthKind(auth))} acquire timed out before open (${WS_ACQUIRE_TIMEOUT_MS}ms)`),
+    { code: 'EWSACQUIRETIMEOUT', acquireTimeoutMs: WS_ACQUIRE_TIMEOUT_MS }
+  );
+}
+
+// One acquire = a hedged race of handshake legs under the acquire deadline
+// (openai-ws-connect.mjs): a stuck upgrade is replaced after the hedge window
+// instead of costing the whole timeout plus a retry.
+function _openSocket(args) {
+  return openHedged({
+    openLeg: ({ externalSignal }) => _openSocketLeg({ ...args, externalSignal }),
+    externalSignal: args.externalSignal,
+    deadlineMs: WS_ACQUIRE_TIMEOUT_MS,
+    deadlineError: () => _acquireTimeoutError(args.auth),
+  });
+}
+
+async function _openSocketLeg({ auth, sessionToken, externalSignal, cacheKey, codexHeaders }) {
   // `ws` loads on the first socket, not at runtime boot via provider-admin.
   const { default: WebSocket } = await import('ws');
   const headers = _buildHandshakeHeaders({ auth, sessionToken, cacheKey, codexHeaders });
@@ -586,6 +606,7 @@ async function _openSocket({ auth, sessionToken, externalSignal, cacheKey, codex
       headers,
       handshakeTimeout: WS_HANDSHAKE_TIMEOUT_MS,
       maxPayload: WS_MAX_INCOMING_FRAME_BYTES,
+      createConnection: createWsConnection,
     });
     acquireTimer = setTimeout(() => {
       if (settled) return;
@@ -597,13 +618,7 @@ async function _openSocket({ auth, sessionToken, externalSignal, cacheKey, codex
       try {
         socket.terminate();
       } catch {}
-      settle(
-        false,
-        Object.assign(
-          new Error(`${_wsErrLabel(_wsAuthKind(auth))} acquire timed out before open (${WS_ACQUIRE_TIMEOUT_MS}ms)`),
-          { code: 'EWSACQUIRETIMEOUT', acquireTimeoutMs: WS_ACQUIRE_TIMEOUT_MS }
-        )
-      );
+      settle(false, _acquireTimeoutError(auth));
     }, WS_ACQUIRE_TIMEOUT_MS);
     try {
       acquireTimer.unref?.();
@@ -764,6 +779,52 @@ function _onEntryClosed(poolKey, entry) {
   if (!entry.ephemeral) _removeFromPool(poolKey, entry);
 }
 
+// Sessionless sends (no poolKey) carry no turn state or response chain of
+// their own, so their connections are shared: one idle bucket per
+// credential + cache key, no owner claim (concurrent sessionless callers
+// each take a different idle socket or open one), and a reused socket starts
+// with an empty chain so no request ever deltas against another caller's
+// response. Without this every sessionless send paid a fresh handshake and
+// closed the socket on release.
+const SHARED_POOL_PREFIX = '\0shared:';
+
+function _resetChain(entry) {
+  entry.lastResponseId = null;
+  entry.lastRequestSansInput = null;
+  entry.lastRequestInput = null;
+  entry.lastResponseItems = null;
+  entry.lastInputLen = 0;
+  entry.lastInputPrefixHash = null;
+  entry.turnState = null;
+  entry.turnStateScope = null;
+  entry.turnStateTurnId = null;
+}
+
+async function _acquireShared({ auth, cacheKey, codexHeaders, externalSignal, acqStart }) {
+  const compatibility = _poolCompatibility(auth, cacheKey);
+  const sharedKey = `${SHARED_POOL_PREFIX}${compatibility.authIdentity}:${compatibility.cacheKeyIdentity}`;
+  const arr = _wsPool.get(sharedKey) || [];
+  _pruneStaleEntries(sharedKey, arr, compatibility);
+  const idle = await _takeIdleEntry(sharedKey, arr, compatibility, acqStart);
+  if (idle) {
+    _resetChain(idle);
+    return { entry: idle, reused: true, ownerWaitMs: 0 };
+  }
+  const entry = await _openPoolEntry({
+    auth,
+    cacheKey,
+    codexHeaders,
+    externalSignal,
+    compatibility,
+    ephemeral: false,
+    acqStart,
+  });
+  entry.sharedPoolKey = sharedKey;
+  _getPoolArr(sharedKey).push(entry);
+  entry.socket.on('close', () => _onEntryClosed(sharedKey, entry));
+  return { entry, reused: false, ownerWaitMs: 0 };
+}
+
 export async function acquireWebSocket({ auth, poolKey, cacheKey, codexHeaders, forceFresh, externalSignal }) {
   const _acqStart = Date.now();
   _acquireTrace(
@@ -772,6 +833,9 @@ export async function acquireWebSocket({ auth, poolKey, cacheKey, codexHeaders,
   if (externalSignal?.aborted) {
     throw _acquireAbortError(externalSignal);
   }
+  if (!poolKey && !forceFresh) {
+    return _acquireShared({ auth, cacheKey, codexHeaders, externalSignal, acqStart: _acqStart });
+  }
   const ownerClaim = await _claimPoolOwner(poolKey, externalSignal);
   const acquired = (entry, reused) => {
     _bindPoolOwner(poolKey, ownerClaim, entry);
@@ -825,8 +889,9 @@ export async function acquireWebSocket({ auth, poolKey, cacheKey, codexHeaders,
   }
 }
 
-export function releaseWebSocket({ entry, poolKey, keep }) {
+export function releaseWebSocket({ entry, poolKey: callerPoolKey, keep }) {
   if (!entry) return;
+  const poolKey = callerPoolKey || entry.sharedPoolKey || null;
   entry.busy = false;
   if (!keep || !_isOpen(entry) || !poolKey || entry.ephemeral) {
     try {