mixdog 1.2.5 → 1.3.0

package/src/runtime/agent/orchestrator/mcp/oauth-credentials.mjs

@@ -1,8 +1,10 @@
 import { randomBytes } from 'node:crypto';
-import { readFile } from 'node:fs/promises';
+import { readFileSync } from 'node:fs';
+import { readFile, rm } from 'node:fs/promises';
 import { join } from 'node:path';
 import { withFileLock, writeFileAtomicAsync } from '../../../shared/atomic-file.mjs';
 import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
+import { canForceAccountChoice } from './oauth-account.mjs';
 import { reauthenticationRequired } from './oauth-shared.mjs';
 
 // Same lease as the provider OAuth refresh (openai-oauth-tokens.mjs): a
@@ -35,6 +37,31 @@ function readRevisionMarker(account) {
   return readFile(credentialFile(account, 'rev'), 'utf8').catch(() => null);
 }
 
+// Who the stored sign-in belongs to, beside the entry (never a credential), so
+// the status lists it without decrypting the keychain:
+// `{ account, workspace, forcedChoice }`; absent when unknown or signed out.
+export function writeIdentityFile(account, creds) {
+  const file = credentialFile(account, 'who');
+  if (!creds?.tokens) return rm(file, { force: true });
+  const identity = creds.identity || {};
+  return writeFileAtomicAsync(
+    file,
+    JSON.stringify({
+      account: identity.account || '',
+      workspace: identity.workspace || '',
+      forcedChoice: canForceAccountChoice(creds.discovery?.authorizationServerMetadata?.authorization_endpoint),
+    })
+  );
+}
+export function readIdentityFile(account) {
+  try {
+    const value = JSON.parse(readFileSync(credentialFile(account, 'who'), 'utf8'));
+    return value && typeof value === 'object' ? value : null;
+  } catch {
+    return null;
+  }
+}
+
 // The stored value as another process may have just written it, not this
 // process's cached copy.
 export function readStoredCredentials(credentialStore, account) {
@@ -57,6 +84,7 @@ export function createCredentialCache({ url, credentialStore, account }) {
     clientInformation: undefined,
     redirectUrl: undefined,
     discovery: undefined,
+    identity: undefined,
     observed: undefined,
     loaded: undefined,
   };
@@ -74,10 +102,25 @@ export function createCredentialCache({ url, credentialStore, account }) {
       clientInformation: creds.clientInformation,
       redirectUrl: creds.redirectUrl,
       discovery: creds.discovery,
+      identity: creds.identity,
     } = value);
     creds.observed = revisionOf(saved);
     hold();
   };
+  // Whether the stored entry is still the one this process last read or wrote:
+  // its revision marker says so without a keychain read (on Windows each read
+  // is a DPAPI PowerShell round trip of ~250 ms). Every writer changes the
+  // marker under the credential lock before the entry, so under that lock an
+  // unchanged marker is an unchanged entry.
+  const unchanged = async (expected = creds.observed) =>
+    expected !== undefined &&
+    expected === creds.observed &&
+    (await readRevisionMarker(account)) === markerOf(expected, Boolean(creds.tokens));
+  // The stored entry as of now, adopted (skipped when unchanged).
+  async function adoptStored() {
+    if (await unchanged()) return;
+    adopt(await readStoredCredentials(credentialStore, account));
+  }
   // A failed read (locked keychain) is retried by the next request.
   const ready = () =>
     (creds.loaded ??= credentialStore
@@ -93,25 +136,31 @@ export function createCredentialCache({ url, credentialStore, account }) {
   // the newer entry, or its deletion by a log-out, and changes nothing.
   function update(change, { expected = creds.observed, remove = false } = {}) {
     return withCredentialLock(account, async () => {
-      const saved = await readStoredCredentials(credentialStore, account);
-      if (revisionOf(saved) !== expected) {
-        adopt(saved);
-        return false;
+      let exists = creds.observed !== null;
+      if (!(await unchanged(expected))) {
+        const saved = await readStoredCredentials(credentialStore, account);
+        if (revisionOf(saved) !== expected) {
+          adopt(saved);
+          return false;
+        }
+        exists = Boolean(saved);
       }
       change();
       hold();
       if (remove) {
         await writeRevisionMarker(account, null);
-        if (saved) await credentialStore.deleteSecretAsync(account);
+        if (exists) await credentialStore.deleteSecretAsync(account);
+        await writeIdentityFile(account, null);
         creds.observed = null;
       } else {
         const revision = randomBytes(16).toString('hex');
         await writeRevisionMarker(account, revision, Boolean(creds.tokens));
-        const { tokens, clientInformation, redirectUrl, discovery } = creds;
+        const { tokens, clientInformation, redirectUrl, discovery, identity } = creds;
         await credentialStore.setSecretAsync(
           account,
-          JSON.stringify({ url, revision, tokens, clientInformation, redirectUrl, discovery })
+          JSON.stringify({ url, revision, tokens, clientInformation, redirectUrl, discovery, identity })
         );
+        await writeIdentityFile(account, creds);
         creds.observed = revision;
       }
       return true;
@@ -133,7 +182,7 @@ export function createCredentialCache({ url, credentialStore, account }) {
   }
   // Forget the in-memory credentials; the next request re-reads the keychain.
   function clear() {
-    creds.tokens = creds.clientInformation = creds.redirectUrl = creds.discovery = undefined;
+    creds.tokens = creds.clientInformation = creds.redirectUrl = creds.discovery = creds.identity = undefined;
     creds.loaded = creds.observed = undefined;
   }
   return {
@@ -141,6 +190,7 @@ export function createCredentialCache({ url, credentialStore, account }) {
     held,
     ready,
     adopt,
+    adoptStored,
     update,
     observeStoredRevision,
     clear,

package/src/runtime/agent/orchestrator/mcp/oauth-login.mjs

@@ -1,6 +1,7 @@
 import { createServer } from 'node:http';
 import { randomBytes } from 'node:crypto';
 import { normalizeMcpTransportUrl } from './client-config.mjs';
+import { identityFromTokenResponse } from './oauth-account.mjs';
 import { answerOAuthCallback } from './oauth-callback.mjs';
 import { anySignal, loginFailed, reauthenticationRequired } from './oauth-shared.mjs';
 
@@ -49,12 +50,34 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
     flow.browserOpened = false;
     flow.launchBrowser = browser || openBrowser;
     const signal = AbortSignal.any([lifetimeSignal, requestSignal, AbortSignal.timeout(timeoutMs)]);
-    const safeFetch = (input, init = {}) =>
-      fetchImpl(normalizeMcpTransportUrl(input), {
+    // Who this login's tokens belong to (oauth-account.mjs): the SDK keeps only
+    // the token fields, so the token endpoint's answer is read here.
+    flow.identity = undefined;
+    const safeFetch = async (input, init = {}) => {
+      const response = await fetchImpl(normalizeMcpTransportUrl(input), {
         ...init,
         redirect: 'error',
         signal: anySignal(signal, init.signal),
       });
+      if (response.ok && /(^|&)grant_type=/.test(String(init.body ?? ''))) {
+        flow.identity = identityFromTokenResponse(
+          await response
+            .clone()
+            .json()
+            .catch(() => null)
+        );
+      }
+      return response;
+    };
+    // The caller's progress hooks (mcp-oauth-login.mjs): the callback arrived,
+    // then the tokens are stored.
+    const progress = (hook) => {
+      try {
+        browser?.[hook]?.();
+      } catch {
+        /* progress reporting never fails the login */
+      }
+    };
     let abort;
     const callback = new Promise((resolve, reject) => {
       const finish = (code) => (code ? resolve(code) : reject(loginFailed()));
@@ -72,9 +95,10 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
       // refreshed (and rotated) the tokens this request was rejected with:
       // decide on the stored credentials, under the cross-process lock.
       const result = await cache.withLock(async () => {
-        cache.adopt(await cache.readStored());
+        await cache.adoptStored();
         if (creds.tokens && creds.tokens.access_token !== attemptedToken?.access_token) return 'AUTHORIZED';
-        if (!interactive && (!creds.tokens?.refresh_token || !creds.clientInformation || !creds.redirectUrl)) {
+        const registered = provider.preRegistered || creds.clientInformation;
+        if (!interactive && (!creds.tokens?.refresh_token || !registered || !creds.redirectUrl)) {
           throw reauthenticationRequired();
         }
         flow.state = randomBytes(32).toString('base64url');
@@ -85,16 +109,17 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
       if (result === 'REDIRECT') {
         const code = await callback;
         signal.throwIfAborted();
+        progress('onCallback');
         const exchanged = await cache.withLock(async () => {
           // The entry this login registered in is gone only after a log-out
           // since it began, which wins: never recreate it.
-          const saved = await cache.readStored();
-          if (!saved) throw loginFailed();
-          cache.adopt(saved);
+          await cache.adoptStored();
+          if (creds.observed === null) throw loginFailed();
           return auth(provider, { ...options, authorizationCode: code });
         });
         if (exchanged !== 'AUTHORIZED') throw loginFailed();
       }
+      progress('onAuthorized');
       signal.throwIfAborted();
     } catch (error) {
       // SDK errors may contain authorization server response bodies/secrets.

package/src/runtime/agent/orchestrator/mcp/oauth-provider.mjs

@@ -1,18 +1,33 @@
 import { normalizeMcpTransportUrl } from './client-config.mjs';
+import { withAccountParams } from './oauth-account.mjs';
 import { loginFailed, reauthenticationRequired } from './oauth-shared.mjs';
 
 /**
  * The SDK's OAuth client provider over one connection's credential `cache`
  * and login `flow` state.
  */
-export function createOAuthProvider({ cache, flow, lifetimeSignal }) {
+export function createOAuthProvider({ cache, flow, lifetimeSignal, client = null, credentialStore = null }) {
   const { creds, ready, update } = cache;
   // The SDK saves only inside a login, which holds the lock and has just
   // adopted the stored entry.
   const save = async (change) => {
     if (!(await update(change))) throw loginFailed();
   };
+  // A pre-registered client (oauth-client.mjs) is the static client
+  // information: nothing is registered, and its secret (the user's lives in
+  // the keychain) goes with the token requests.
+  const staticClient = async () => {
+    const secret = client.secretAccount
+      ? await credentialStore?.getSecretAsync(client.secretAccount)
+      : client.clientSecret;
+    return { client_id: client.clientId, ...(secret ? { client_secret: secret } : {}) };
+  };
   return {
+    /** A pre-registered client: a refresh needs no stored registration. */
+    preRegistered: Boolean(client),
+    // A pre-registered client's provider issues tokens for its own APIs
+    // (Google): no RFC 8707 resource indicator is sent.
+    ...(client ? { validateResourceURL: async () => undefined } : {}),
     get redirectUrl() {
       return creds.redirectUrl;
     },
@@ -23,11 +38,13 @@ export function createOAuthProvider({ cache, flow, lifetimeSignal }) {
         grant_types: ['authorization_code', 'refresh_token'],
         response_types: ['code'],
         token_endpoint_auth_method: 'none',
+        ...(client?.scopes ? { scope: client.scopes.join(' ') } : {}),
       };
     },
     state: () => flow.state,
     clientInformation: async () => {
       await ready();
+      if (client) return staticClient();
       // A connect that cannot open a sign-in never registers a client (the
       // SDK registers one after dropping a rejected registration): the next
       // explicit sign-in registers it.
@@ -46,6 +63,11 @@ export function createOAuthProvider({ cache, flow, lifetimeSignal }) {
       lifetimeSignal.throwIfAborted();
       await save(() => {
         creds.tokens = value;
+        // A browser sign-in may be another account: its identity replaces the
+        // stored one (null when the server named nobody). A refresh keeps it
+        // unless the response names the account again.
+        if (flow.browserOpened) creds.identity = flow.identity ?? null;
+        else if (flow.identity) creds.identity = flow.identity;
       });
     },
     saveCodeVerifier: (value) => {
@@ -56,10 +78,11 @@ export function createOAuthProvider({ cache, flow, lifetimeSignal }) {
       return flow.verifier;
     },
     discoveryState: () => creds.discovery,
-    saveDiscoveryState: (value) =>
-      save(() => {
-        creds.discovery = value;
-      }),
+    // Kept in memory and stored with the login's next write (the client
+    // registration or the tokens), sparing a keychain write of its own.
+    saveDiscoveryState: (value) => {
+      creds.discovery = value;
+    },
     // The SDK invalidates 'all' when the token endpoint rejects the client
     // (invalid_client / unauthorized_client) and 'tokens' when it rejects the
     // grant (invalid_grant). The registration goes in both cases: an
@@ -88,8 +111,24 @@ export function createOAuthProvider({ cache, flow, lifetimeSignal }) {
         !flow.verifier
       )
         throw loginFailed();
+      // A pre-registered client is stored with this login's redirect, as a
+      // registration would be: the exchange and later refreshes (and the
+      // revocation on 연결 해제) read them from the entry.
+      if (client) {
+        const issuedTo = await staticClient();
+        await save(() => {
+          creds.clientInformation = issuedTo;
+        });
+      }
       flow.browserOpened = true;
-      await flow.launchBrowser(target.href);
+      // A pre-registered client asks for its own scopes (the server's list
+      // may name far more) plus its provider's parameters (Google's
+      // access_type=offline, without which no refresh token is issued).
+      if (client?.scopes) target.searchParams.set('scope', client.scopes.join(' '));
+      for (const [key, value] of Object.entries(client?.authParams || {})) target.searchParams.set(key, value);
+      // The explicit sign-in's account mode (mcp-oauth-login.mjs) decides the
+      // provider's documented account-choice parameter, if any.
+      await flow.launchBrowser(withAccountParams(target.href, flow.launchBrowser.accountMode || 'connect').href);
     },
   };
 }

package/src/runtime/agent/orchestrator/mcp/oauth.mjs

@@ -1,4 +1,4 @@
-import { createHash } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import keychain from '../../../../lib/keychain-cjs.cjs';
 import { openInBrowser } from '../../../shared/open-url.mjs';
@@ -12,8 +12,10 @@ import {
   TOKENS_FLAG,
   createCredentialCache,
   credentialFile,
+  readIdentityFile,
   readStoredCredentials,
   withCredentialLock,
+  writeIdentityFile,
   writeRevisionMarker,
 } from './oauth-credentials.mjs';
 import { createLoginFlow } from './oauth-login.mjs';
@@ -55,18 +57,198 @@ export function hasStoredMcpOAuthTokens(url) {
   }
 }
 
+/** Who the stored sign-in of one MCP server URL belongs to, without a keychain
+ *  read: `{ account, workspace, forcedChoice }` (empty strings when the server
+ *  named nobody), or null when signed out. */
+export function storedMcpOAuthIdentity(url) {
+  return readIdentityFile(mcpOAuthAccount(normalizeMcpTransportUrl(url)));
+}
+
+// RFC 7009 revocation of the stored grant, only where the authorization server
+// advertises its revocation endpoint (RFC 8414 metadata): it revokes the token
+// this client was issued, nothing workspace-wide. True when the server
+// confirmed it.
+async function revokeStoredGrant(saved, fetchImpl) {
+  let value;
+  try {
+    value = JSON.parse(saved);
+  } catch {
+    return false;
+  }
+  const endpoint = value?.discovery?.authorizationServerMetadata?.revocation_endpoint;
+  const token = value?.tokens?.refresh_token || value?.tokens?.access_token;
+  const clientId = value?.clientInformation?.client_id;
+  if (typeof endpoint !== 'string' || !/^https:\/\//.test(endpoint) || !token || !clientId) return false;
+  const body = new URLSearchParams({
+    token,
+    token_type_hint: value.tokens.refresh_token ? 'refresh_token' : 'access_token',
+    client_id: clientId,
+  });
+  if (value.clientInformation.client_secret) body.set('client_secret', value.clientInformation.client_secret);
+  try {
+    const response = await fetchImpl(endpoint, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body,
+      redirect: 'error',
+      signal: AbortSignal.timeout(5_000),
+    });
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+
 /** Log out of one MCP server URL: delete its stored tokens and client
  *  registration and drop them from live connections, which then need an
- *  explicit reconnect to log in again. */
-export async function clearMcpOAuth({ url, credentialStore = keychain }) {
+ *  explicit reconnect to log in again. With `revoke`, the grant is first
+ *  revoked at the authorization server where it documents a revocation
+ *  endpoint. Resolves `{ revoked }`. */
+export async function clearMcpOAuth({ url, credentialStore = keychain, revoke = false, fetchImpl = fetch }) {
   url = normalizeMcpTransportUrl(url);
   const account = mcpOAuthAccount(url);
+  let revoked = false;
   await withCredentialLock(account, async () => {
+    const saved = await readStoredCredentials(credentialStore, account);
+    if (revoke && saved != null) revoked = await revokeStoredGrant(saved, fetchImpl);
     await writeRevisionMarker(account, null);
-    if ((await readStoredCredentials(credentialStore, account)) != null)
-      await credentialStore.deleteSecretAsync(account);
+    if (saved != null) await credentialStore.deleteSecretAsync(account);
+    await writeIdentityFile(account, null);
   });
   scopes.get(credentialStore)?.get(url)?.oauth.clear();
+  return { revoked };
+}
+
+async function storeEntry(account, url, value, credentialStore) {
+  const revision = randomBytes(16).toString('hex');
+  const { tokens, clientInformation, redirectUrl, discovery, identity } = value;
+  await writeRevisionMarker(account, revision, Boolean(tokens));
+  await credentialStore.setSecretAsync(
+    account,
+    JSON.stringify({ url, revision, tokens, clientInformation, redirectUrl, discovery, identity })
+  );
+  await writeIdentityFile(account, value);
+}
+
+/**
+ * 계정 바꾸기 for one MCP server URL, transactionally: a browser sign-in with
+ * the provider's documented account choice that runs beside the stored
+ * sign-in, reusing its client registration and discovery but never its tokens,
+ * and stores nothing. `done` resolves the new sign-in (`{ tokens, identity, … }`)
+ * or rejects (cancel, denial, timeout), leaving the stored sign-in and every
+ * live connection as they were. `answer(pasted)` completes it with a pasted
+ * redirect URL (remote sign-in); `cancel()` aborts it.
+ */
+export function startMcpOAuthSwitch({
+  url,
+  launch,
+  serverName,
+  credentialStore = keychain,
+  fetchImpl = fetch,
+  timeoutMs = MCP_OAUTH_TIMEOUT_MS,
+  oauthClient = null,
+}) {
+  url = normalizeMcpTransportUrl(url);
+  const lifetime = new AbortController();
+  const creds = {
+    tokens: undefined,
+    clientInformation: undefined,
+    redirectUrl: undefined,
+    discovery: undefined,
+    identity: undefined,
+    // Never null: the in-memory entry always exists.
+    observed: 'switch',
+  };
+  // An in-memory entry: a registration made during the switch stays here
+  // until the commit stores it with the tokens.
+  const cache = {
+    creds,
+    held: new Set(),
+    ready: async () => {},
+    adoptStored: async () => {},
+    update: async (change) => {
+      change();
+      return true;
+    },
+    withLock: (fn) => fn(),
+  };
+  const flow = {
+    listener: undefined,
+    state: undefined,
+    verifier: undefined,
+    allowBrowser: false,
+    browserOpened: false,
+    launchBrowser: launch,
+    finishCallback: undefined,
+  };
+  const provider = createOAuthProvider({
+    cache,
+    flow,
+    lifetimeSignal: lifetime.signal,
+    client: oauthClient,
+    credentialStore,
+  });
+  const loginFlow = createLoginFlow({
+    url,
+    cache,
+    flow,
+    provider,
+    lifetimeSignal: lifetime.signal,
+    openBrowser: launch,
+    fetchImpl,
+    timeoutMs,
+  });
+  const done = (async () => {
+    const saved = await readStoredCredentials(credentialStore, mcpOAuthAccount(url));
+    if (saved) {
+      const value = JSON.parse(saved);
+      if (value.url === url) {
+        creds.clientInformation = value.clientInformation;
+        creds.redirectUrl = value.redirectUrl;
+        creds.discovery = value.discovery;
+      }
+    }
+    await loginFlow.login({}, lifetime.signal, true, launch, undefined, serverName);
+    const { tokens, clientInformation, redirectUrl, discovery, identity } = creds;
+    if (!tokens) throw new Error('MCP OAuth login failed, cancelled, or timed out');
+    return { tokens, clientInformation, redirectUrl, discovery, identity: identity ?? null };
+  })();
+  return {
+    done,
+    answer(pasted) {
+      if (!flow.finishCallback || !flow.browserOpened || !flow.state || !creds.redirectUrl) {
+        throw new Error(MCP_OAUTH_CALLBACK_NOT_PENDING);
+      }
+      const { code } = parsePastedMcpOAuthCallback(pasted, { redirectUrl: creds.redirectUrl, state: flow.state });
+      loginFlow.stopListening();
+      loginFlow.answerCallback(code);
+    },
+    cancel() {
+      lifetime.abort();
+      flow.finishCallback?.();
+      loginFlow.closeListener();
+    },
+  };
+}
+
+/** Store the sign-in a switch returned as the URL's sign-in; resolves a
+ *  `rollback()` that restores the previous one (or none). Live connections
+ *  adopt either through the revision marker on their next request. */
+export async function commitMcpOAuthSwitch({ url, signIn, credentialStore = keychain }) {
+  url = normalizeMcpTransportUrl(url);
+  const account = mcpOAuthAccount(url);
+  let previous = null;
+  await withCredentialLock(account, async () => {
+    previous = await readStoredCredentials(credentialStore, account);
+    await storeEntry(account, url, signIn, credentialStore);
+  });
+  return () =>
+    withCredentialLock(account, async () => {
+      if (previous) return storeEntry(account, url, JSON.parse(previous), credentialStore);
+      await writeRevisionMarker(account, null);
+      await credentialStore.deleteSecretAsync(account);
+      await writeIdentityFile(account, null);
+    });
 }
 
 // The keychain is the only durable store. Exact URLs, including query strings,
@@ -166,6 +348,7 @@ function createSharedOAuth({
   openBrowser = openInBrowser,
   fetchImpl = fetch,
   timeoutMs = MCP_OAUTH_TIMEOUT_MS,
+  oauthClient = null,
 }) {
   const lifetime = new AbortController();
   const cache = createCredentialCache({ url, credentialStore, account: mcpOAuthAccount(url) });
@@ -179,7 +362,13 @@ function createSharedOAuth({
     launchBrowser: openBrowser,
     finishCallback: undefined,
   };
-  const provider = createOAuthProvider({ cache, flow, lifetimeSignal: lifetime.signal });
+  const provider = createOAuthProvider({
+    cache,
+    flow,
+    lifetimeSignal: lifetime.signal,
+    client: oauthClient,
+    credentialStore,
+  });
   const { login, stopListening, closeListener, answerCallback } = createLoginFlow({
     url,
     cache,

package/src/runtime/agent/orchestrator/mcp/server-connectors.mjs

@@ -0,0 +1,17 @@
+// Which catalog connector each connected MCP server is (connector-catalog.mjs
+// connectorOfServer), recorded by the client as servers connect, so a tool
+// name alone (`mcp__<server>__<tool>`) finds its catalog defaults at dispatch.
+import { connectorOfServer } from '../../../shared/connector-catalog.mjs';
+
+const byServer = new Map();
+
+export function rememberServerConnector(name, cfg) {
+  const id = connectorOfServer(cfg);
+  if (id) byServer.set(String(name), id);
+  else byServer.delete(String(name));
+}
+
+/** The catalog id of connected server `name`, or ''. */
+export function serverConnector(name) {
+  return byServer.get(String(name)) || '';
+}

package/src/runtime/agent/orchestrator/providers/account-pool.mjs

@@ -378,14 +378,21 @@ function poolSend(providerName, account) {
     // remaining wait budget is waited out; otherwise the send fails as before.
     const waitOrThrow = async (error, ids) => {
       const { rows, now, all } = exhaustion(ids);
-      const wait = all ? null : earliestCooldownMs(rows, now);
-      if (wait == null || waitedMs + wait > waitBoundMs(ids)) throw markExhausted(error, ids);
+      const bound = waitBoundMs(ids);
+      // Persisting a short cooldown can outlast its deadline. Release only
+      // attempts cooled by this send, and only under an enabled wait policy.
+      const expired = bound > 0 && rows.some((row) => cooled.has(row.id) && !(Number(row.blockedUntil) > now));
+      const wait = all ? null : expired ? 0 : earliestCooldownMs(rows, now);
+      if (wait == null || waitedMs + wait > bound) throw markExhausted(error, ids);
       options.onStageChange?.('reconnecting', {
         message: `Rate limited — every account is cooling down; retrying in ${Math.ceil(wait / 1000)}s`,
         reason: 'rate_limited',
         waitMs: wait,
         retryAt: now + wait,
       });
+      // A zero-duration sleep does not check cancellation, including on the
+      // final allowed send when no next loop iteration will check it either.
+      options.signal?.throwIfAborted();
       await sleepWithAbort(wait, options.signal);
       waitedMs += wait;
       const lifted = Date.now();

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-client-version.mjs

@@ -10,7 +10,7 @@ import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
 // source release just to advance the user-agent version.
 // Claude Opus 5.5 requires 2.1.280 or newer. The release workflow raises this
 // to the published CLI version (scripts/sync-client-version-floors.mjs).
-export const DEFAULT_CLI_VERSION = '2.1.302';
+export const DEFAULT_CLI_VERSION = '2.1.304';
 export const CLAUDE_CLI_NPM_PACKAGE = '@anthropic-ai/claude-code';
 
 const CACHE_SCHEMA_VERSION = 1;