mixdog 1.2.5 → 1.3.0

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-credentials.mjs

@@ -25,6 +25,7 @@ import {
   scrubOAuthSecrets,
 } from './lib/oauth-token-utils.mjs';
 import { createOAuthPkce, parseOAuthCodeInput } from './lib/oauth-pkce.mjs';
+import { OAUTH_PAGE_CONTENT_TYPE, oauthErrorHtml, oauthSuccessHtml } from './lib/oauth-page.mjs';
 
 const SIGN_IN_EXPIRED_PREFIX = 'Anthropic sign-in expired. Sign in again from Providers.';
 
@@ -66,8 +67,6 @@ const OAUTH_CALLBACK_PATH = '/callback';
 const OAUTH_REDIRECT_URI = `http://${OAUTH_CALLBACK_HOST}:${OAUTH_CALLBACK_PORT}${OAUTH_CALLBACK_PATH}`;
 const OAUTH_MANUAL_REDIRECT_URI =
   process.env.ANTHROPIC_OAUTH_MANUAL_REDIRECT_URI || 'https://platform.claude.com/oauth/code/callback';
-const OAUTH_SUCCESS_REDIRECT_URL =
-  process.env.ANTHROPIC_OAUTH_SUCCESS_REDIRECT_URL || 'https://platform.claude.com/oauth/code/success?app=claude-code';
 const OAUTH_LOGIN_TIMEOUT_MS = 5 * 60_000;
 const OAUTH_TOKEN_TIMEOUT_MS = 30_000;
 
@@ -110,7 +109,7 @@ function _loadCredentialsFile(path) {
 }
 
 // The token endpoint names the signed-in account next to the tokens.
-export function identityFromTokenResponse(json) {
+function identityFromTokenResponse(json) {
   return normalizeAccountIdentity({
     id: json?.account?.uuid,
     email: json?.account?.email_address,
@@ -210,6 +209,7 @@ export function describeAnthropicOAuthCredentials() {
     return {
       ...oauthCredentialStatus({ hasRefresh, expiresAt, detail, refreshSkewMs: TOKEN_REFRESH_SKEW_MS }),
       ...accountIdentityFields(creds.identity),
+      plan: creds.subscriptionType || null,
     };
   } catch (err) {
     return {
@@ -570,9 +570,11 @@ function _parseOAuthCodeInput(input) {
   return parseOAuthCodeInput(input, { allowHashState: true });
 }
 
-async function exchangeAuthorizationCode({ pkce, code, state, redirectUri }) {
+async function exchangeAuthorizationCode({ pkce, code, state, redirectUri, signal = null }) {
+  signal?.throwIfAborted();
   const cleanCode = String(code || '').trim();
   if (!cleanCode) throw new Error('[anthropic-oauth] authorization code is required');
+  const timeoutSignal = AbortSignal.timeout(OAUTH_TOKEN_TIMEOUT_MS);
   const tokenRes = await fetch(TOKEN_URL, {
     method: 'POST',
     headers: tokenEndpointHeaders(),
@@ -585,7 +587,7 @@ async function exchangeAuthorizationCode({ pkce, code, state, redirectUri }) {
       state,
     }),
     redirect: 'error',
-    signal: AbortSignal.timeout(OAUTH_TOKEN_TIMEOUT_MS),
+    signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal,
     dispatcher: getLlmDispatcher(),
   });
   if (!tokenRes.ok) {
@@ -605,6 +607,8 @@ async function exchangeAuthorizationCode({ pkce, code, state, redirectUri }) {
   const expiresAt = expiresAtFromTokenResponse(json);
   const scopes = _oauthParseScopeField(json?.scope);
   const identity = identityFromTokenResponse(json);
+  // A cancelled login never stores the account it was exchanging.
+  signal?.throwIfAborted();
   const credPath = _oauthCredentialsWritePath();
   const raw = _updateCredentialsFile(credPath, (current) => {
     const base = current && typeof current === 'object' ? current : {};
@@ -664,14 +668,33 @@ export async function beginOAuthLogin({ openBrowserFn = null, openBrowser = true
     }
   };
 
+  const controller = new AbortController();
   let server = null;
   let timeout = null;
   let finish = null;
+  let exchangePromise = null;
+  // Browser and manual callbacks share one exchange: an authorization code is
+  // spent once, and a duplicate joins the first instead of failing the login.
+  const acceptCode = (code, redirectUri) => {
+    if (exchangePromise) return exchangePromise;
+    controller.signal.throwIfAborted();
+    // The browser deadline ends when a code arrives; the exchange has its own.
+    if (timeout) clearTimeout(timeout);
+    timeout = null;
+    exchangePromise = exchangeAuthorizationCode({ pkce, code, state, redirectUri, signal: controller.signal });
+    exchangePromise.then(
+      (tokens) => finish(tokens),
+      (error) => finish(null, error instanceof Error ? error : new Error(String(error)))
+    );
+    return exchangePromise;
+  };
   const waitForCallback = new Promise((resolve, reject) => {
     let settled = false;
     finish = (value, error = null) => {
       if (settled) return;
       settled = true;
+      // Work arriving after the login settled (or was cancelled) is rejected.
+      controller.abort();
       if (timeout) clearTimeout(timeout);
       try {
         server?.close();
@@ -691,20 +714,20 @@ export async function beginOAuthLogin({ openBrowserFn = null, openBrowser = true
       const code = u.searchParams.get('code');
       if (!code || u.searchParams.get('state') !== state) {
         // Reject this request only; the valid callback may still arrive.
-        res.writeHead(400);
-        res.end('Invalid');
+        res.writeHead(400, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE });
+        res.end(oauthErrorHtml('The sign-in callback was invalid or did not match this login.'));
         return;
       }
+      // The login settles (and its server closes) before this answer is sent,
+      // so the connection must not stay open to the closed login's handler.
       try {
-        const tokens = await exchangeAuthorizationCode({ pkce, code, state, redirectUri: OAUTH_REDIRECT_URI });
-        res.writeHead(302, { Location: OAUTH_SUCCESS_REDIRECT_URL });
-        res.end();
-        finish(tokens);
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err));
-        res.writeHead(500, { 'Content-Type': 'text/plain; charset=utf-8' });
-        res.end(`Claude login failed: ${error.message}`);
-        finish(null, error);
+        await acceptCode(code, OAUTH_REDIRECT_URI);
+        res.writeHead(200, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE, Connection: 'close' });
+        res.end(oauthSuccessHtml('Claude'));
+      } catch {
+        // The shared exchange reports its error through waitForCallback.
+        res.writeHead(500, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE, Connection: 'close' });
+        res.end(oauthErrorHtml('Claude could not complete the token exchange.'));
       }
     });
     timeout = setTimeout(() => finish(null), OAUTH_LOGIN_TIMEOUT_MS);
@@ -730,10 +753,9 @@ export async function beginOAuthLogin({ openBrowserFn = null, openBrowser = true
     completeCode: async (input) => {
       const parsed = _parseOAuthCodeInput(input);
       if (parsed.state && parsed.state !== state) throw new Error('[anthropic-oauth] OAuth state mismatch');
+      if (!String(parsed.code || '').trim()) throw new Error('[anthropic-oauth] authorization code is required');
       const redirectUri = parsed.redirectUri || (parsed.state ? OAUTH_MANUAL_REDIRECT_URI : OAUTH_REDIRECT_URI);
-      const tokens = await exchangeAuthorizationCode({ pkce, code: parsed.code, state, redirectUri });
-      finish?.(tokens);
-      return tokens;
+      return await acceptCode(parsed.code, redirectUri);
     },
     cancel: () => {
       finish?.(null);

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -448,7 +448,8 @@ export class AnthropicOAuthProvider {
     // a hard 400. Pairing here closes the gap regardless of caller.
     messages = sanitizeToolPairs(messages);
     const opts = sendOpts || {};
-    const { onStageChange, onStreamDelta, onToolCall, onTextDelta, onTextReset } = streamCallbacks(opts);
+    const { onStageChange, onStreamDelta, onToolCall, onTextDelta, onTextReset, onStreamItemStart } =
+      streamCallbacks(opts);
     const externalSignal = opts.signal || null;
     // Test seam: lets the retry harness drive stream outcomes without a
     // live OAuth session.
@@ -610,7 +611,7 @@ export class AnthropicOAuthProvider {
             midState,
             onTextDelta,
             knownToolNames,
-            { relayProgressUpdates: body.thinking?.display === 'updates' }
+            { relayProgressUpdates: body.thinking?.display === 'updates', onStreamItemStart }
           );
           try {
             controller?.abort?.('Anthropic SSE complete');

package/src/runtime/agent/orchestrator/providers/anthropic-sse-turn/turn-events/content-block-start.mjs

@@ -8,6 +8,7 @@ import {
   NATIVE_SERVER_TOOL_RESULT_BLOCK_TYPES,
 } from '../../lib/anthropic-native-blocks.mjs';
 import { parseAnthropicFallbackBlock } from '../../anthropic-server-fallback.mjs';
+import { reportStreamItemStart } from '../../lib/send-callbacks.mjs';
 
 // Detach the provider payload from the parser's event object without altering
 // any field (opaque server-tool result payloads must round-trip byte-exact).
@@ -19,7 +20,7 @@ function cloneNativeBlock(block) {
   }
 }
 
-export function createContentBlockStart({ turn, blocks, state, progress, seedText }) {
+export function createContentBlockStart({ turn, blocks, state, progress, seedText, onStreamItemStart }) {
   const seedThinkingBlock = (index, block) => {
     if (block.type === 'redacted_thinking') {
       // Opaque redacted payload: real reasoning content, exposed as a block.
@@ -59,6 +60,8 @@ export function createContentBlockStart({ turn, blocks, state, progress, seedTex
         name: block.name || '',
         inputJson: '',
       });
+      // The call opened; its input still streams before onToolCall.
+      reportStreamItemStart(onStreamItemStart, { kind: 'tool' });
     }
     if (block?.type === 'text') {
       // Seed the ordered text slot. An empty block still needs its slot (it

package/src/runtime/agent/orchestrator/providers/anthropic-sse-turn/turn-events.mjs

@@ -19,6 +19,7 @@ export function createTurnEvents({
   onToolCall,
   relayProgressUpdates,
   labels,
+  onStreamItemStart,
 }) {
   const { onMessageStart, onMessageDelta, onMessageStop } = createMessageEvents({ turn, blocks, state });
   const onContentBlockDelta = createContentBlockDelta({
@@ -38,6 +39,7 @@ export function createTurnEvents({
       state,
       progress,
       seedText: onContentBlockDelta.seedText,
+      onStreamItemStart,
     }),
     onContentBlockDelta,
     onContentBlockStop: createContentBlockStop({ turn, blocks, state, leak, progress, onToolCall, labels }),

package/src/runtime/agent/orchestrator/providers/anthropic-sse-turn.mjs

@@ -24,6 +24,7 @@ import { OAUTH_STREAM_LABELS } from './lib/anthropic-stream-labels.mjs';
  * @param {Iterable<string>} [deps.knownToolNames]
  * @param {boolean} [deps.relayProgressUpdates]  request used thinking.display "updates"
  * @param {{ display: string, tag: string }} [deps.labels]  provider name for errors and stderr lines
+ * @param {(detail: object) => void} [deps.onStreamItemStart]  a client tool_use block opened
  */
 export function createAnthropicSseTurn({
   state,
@@ -33,6 +34,7 @@ export function createAnthropicSseTurn({
   knownToolNames,
   relayProgressUpdates = false,
   labels = OAUTH_STREAM_LABELS,
+  onStreamItemStart = null,
 }) {
   const progress = (kind) => {
     try {
@@ -64,6 +66,7 @@ export function createAnthropicSseTurn({
     onToolCall,
     relayProgressUpdates,
     labels,
+    onStreamItemStart,
   });
   const outcome = createTurnOutcome({ turn, blocks, state, labels });
 

package/src/runtime/agent/orchestrator/providers/anthropic-sse.mjs

@@ -186,7 +186,7 @@ export async function parseSSEStream(
   state,
   onTextDelta,
   knownToolNames,
-  { relayProgressUpdates = false, labels = OAUTH_STREAM_LABELS } = {}
+  { relayProgressUpdates = false, labels = OAUTH_STREAM_LABELS, onStreamItemStart = null } = {}
 ) {
   // Anthropic/Claude parity: every received SSE byte proves transport
   // activity, including comment and named ping keepalives. Content kinds
@@ -208,6 +208,7 @@ export async function parseSSEStream(
     knownToolNames,
     relayProgressUpdates,
     labels,
+    onStreamItemStart,
   });
   const watchdogs = createAnthropicSseWatchdogs({
     state,

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -162,7 +162,8 @@ export class AnthropicProvider {
     });
     this.fastModeBetaHeaderLatched = fastModeLatched;
 
-    const { onStageChange, onStreamDelta, onToolCall, onTextDelta, onTextReset } = streamCallbacks(opts);
+    const { onStageChange, onStreamDelta, onToolCall, onTextDelta, onTextReset, onStreamItemStart } =
+      streamCallbacks(opts);
 
     // No absolute wall-clock cap on streaming generation: a stream still
     // emitting SSE deltas must not be killed by a fixed total-lifetime timer.
@@ -288,6 +289,7 @@ export class AnthropicProvider {
             {
               relayProgressUpdates: params.thinking?.display === 'updates',
               labels: { display: 'Anthropic', tag: this.name },
+              onStreamItemStart,
             }
           );
           try {

package/src/runtime/agent/orchestrator/providers/antigravity-oauth-login.mjs

@@ -36,8 +36,7 @@ import {
 
 const ONBOARD_INTERVAL_MS = 1_000;
 const CALLBACK_FAILURE_HTML = oauthErrorHtml(
-  'Antigravity sign-in was not completed.',
-  'Return to Mixdog for the error details and any account verification link.'
+  'Antigravity sign-in was not completed. Return to Mixdog for the error details and any account verification link.'
 );
 
 function extractProjectId(payload) {
@@ -219,7 +218,12 @@ async function provisionProject(context, tierId) {
 }
 
 /** Resolve account eligibility and return the project from a fresh status load. */
-export async function discoverProject(
+export async function discoverProject(accessToken, options = {}) {
+  return (await discoverAccount(accessToken, options)).projectId;
+}
+
+/** Project plus the account's tier id (paid tier first), from the same status load. */
+export async function discoverAccount(
   accessToken,
   { fetchFn = fetch, onProgress = null, signal = null, email = '' } = {}
 ) {
@@ -236,7 +240,8 @@ export async function discoverProject(
   const refreshed = await loadProjectState(context);
   const projectId = extractProjectId(refreshed);
   if (!projectId) throw new Error('[antigravity-oauth] loadCodeAssist did not return a cloudaicompanionProject');
-  return projectId;
+  const tierId = refreshed.paidTier?.id || refreshed.currentTier?.id;
+  return { projectId, tierId: typeof tierId === 'string' ? tierId : '' };
 }
 
 export async function exchangeAuthorizationCode({ code, verifier, fetchFn = fetch, onProgress = null, signal = null }) {
@@ -268,12 +273,13 @@ export async function exchangeAuthorizationCode({ code, verifier, fetchFn = fetc
     throw new Error('[antigravity-oauth] token exchange response missing access_token or refresh_token');
   }
   const { email, userId } = await fetchAccountInfo(json.access_token, { fetchFn, signal });
-  const projectId = await discoverProject(json.access_token, { fetchFn, onProgress, signal, email });
+  const { projectId, tierId } = await discoverAccount(json.access_token, { fetchFn, onProgress, signal, email });
   const tokens = {
     access_token: json.access_token,
     refresh_token: json.refresh_token,
     expires_at: typeof json.expires_in === 'number' ? Date.now() + json.expires_in * 1000 : 0,
     project_id: projectId,
+    tier_id: tierId,
     email,
     user_id: userId,
   };

package/src/runtime/agent/orchestrator/providers/antigravity-oauth-tokens.mjs

@@ -204,6 +204,7 @@ export function loadTokens() {
       refresh_token: String(raw.refresh_token),
       expires_at: _normalizeExpiresAt(raw.expires_at ?? raw.expiresAt),
       project_id: String(raw.project_id || raw.projectId || ''),
+      tier_id: String(raw.tier_id || ''),
       email: String(raw.email || ''),
       user_id: String(raw.user_id || raw.userId || ''),
       source: 'own',
@@ -222,6 +223,7 @@ export function saveTokens(tokens) {
       refresh_token: tokens.refresh_token,
       expires_at: tokens.expires_at || 0,
       project_id: tokens.project_id || tokens.projectId || '',
+      tier_id: tokens.tier_id || '',
       email: tokens.email || '',
       user_id: tokens.user_id || tokens.userId || '',
     },
@@ -274,6 +276,7 @@ export function describeAntigravityOAuthCredentials() {
       ...accountIdentityFields({ id: tokens.user_id, email: tokens.email }),
       email: tokens.email || '',
       projectId: tokens.project_id || '',
+      plan: tokens.tier_id || null,
     };
   } catch {
     return credentialsNotSet();
@@ -340,6 +343,7 @@ export function refreshTokens({ fetchFn = fetch } = {}) {
       refresh_token: json.refresh_token || current.refresh_token,
       expires_at: typeof json.expires_in === 'number' ? Date.now() + json.expires_in * 1000 : 0,
       project_id: current.project_id,
+      tier_id: current.tier_id,
       email: current.email,
       user_id: current.user_id,
     };

package/src/runtime/agent/orchestrator/providers/catalog-deadline.mjs

@@ -0,0 +1,163 @@
+// Bounded, single-flight, cancellable provider catalog work, shared by the
+// registry's catalog refreshes and the session runtime's shared catalog.
+//
+// - Deadline: a caller waits at most `timeoutMs` and then gets an ETIMEDOUT
+//   error entry instead of the provider's answer, so one hung provider cannot
+//   hold a catalog read or a startup/forced refresh.
+// - Cancellation: on that deadline the operation's AbortSignal fires; a
+//   provider whose listModels honors `{ signal }` stops its work there.
+// - Single flight: per provider at most one operation is pending in this
+//   process. A caller that finds one of its own kind joins it (with its own
+//   deadline); one that finds the other kind (a refresh vs a model list)
+//   waits for it inside its deadline before starting its own. An operation
+//   leaves the table only when the underlying work settles, not when a
+//   caller gives up, so repeated timed-out reads never pile up work; once an
+//   operation overran one deadline, later callers fail fast on it instead of
+//   each waiting out another deadline, until it settles.
+// - Generations: one auth/account generation spans refreshes and lists alike
+//   (bumpProviderCatalogGeneration). Work of the other kind pending from an
+//   older generation, or from an older provider instance, never blocks or
+//   fails a caller of the newer one: that caller starts afresh. Same-kind
+//   work is never joined across generations, instances or a caller-supplied
+//   `epoch` (the catalog revision a list belongs to) either, unless it
+//   stalled (below).
+// - Stalled work: an operation that overran its deadline (its signal fired)
+//   and still has not settled ignores cancellation. Until it settles, that
+//   provider name is not asked again for the same kind, not by a newer
+//   generation, epoch or provider instance: callers get an ETIMEDOUT entry
+//   marked `stalled` at once. Otherwise every account change, catalog
+//   revision or registry rebuild would leave one more never-ending call
+//   behind in the provider. Superseded calls can only overlap inside one
+//   deadline window, before any of them stalls.
+import { clearProviderCatalogFailures, recordProviderCatalogOutcome } from './catalog-failures.mjs';
+
+export const PROVIDER_CATALOG_TIMEOUT_MS = 4_000;
+
+/** name -> the latest op started for that provider (either kind). */
+const pendingOps = new Map();
+/** `${kind}\0${name}` -> Set of the unsettled ops of that kind, of any
+ *  generation, epoch or provider instance; emptied sets are removed. */
+const runningOps = new Map();
+/** `${kind}\0${name}` -> sequence number of the latest op started of that kind. */
+const latestOpSeq = new Map();
+let opSeq = 0;
+let generation = 0;
+
+const runKey = (name, kind) => `${kind}\0${name}`;
+
+/** Opens a new auth/account generation for every provider's catalog work. */
+export function bumpProviderCatalogGeneration() {
+  generation += 1;
+  // Failures of the previous account say nothing about the new one.
+  clearProviderCatalogFailures();
+}
+
+/** Provider names with catalog work still pending (diagnostics and tests). */
+export function pendingProviderCatalogOps() {
+  return [...pendingOps.keys()];
+}
+
+/** `{ name, kind }` of every operation that ignored its deadline's abort and
+ *  is still unsettled (diagnostics and tests). */
+export function stalledProviderCatalogOps() {
+  return [...runningOps.values()]
+    .flatMap((ops) => [...ops])
+    .filter((op) => op.timedOut)
+    .map(({ name, kind }) => ({ name, kind }));
+}
+
+const isStalled = (name, kind) => [...(runningOps.get(runKey(name, kind)) || [])].some((op) => op.timedOut);
+
+function startOp(name, provider, kind, run, epoch, opGeneration) {
+  const controller = new AbortController();
+  const settled = Promise.resolve()
+    .then(() => run(controller.signal))
+    .then(
+      (value) => ({ value }),
+      (error) => ({ error })
+    );
+  const seq = ++opSeq;
+  const op = { name, provider, kind, epoch, generation: opGeneration, seq, controller, settled, done: false };
+  const key = runKey(name, kind);
+  latestOpSeq.set(key, seq);
+  const running = runningOps.get(key) || new Set();
+  running.add(op);
+  runningOps.set(key, running);
+  pendingOps.set(name, op);
+  void settled.then(() => {
+    op.done = true;
+    if (pendingOps.get(name) === op) pendingOps.delete(name);
+    running.delete(op);
+    if (running.size === 0 && runningOps.get(key) === running) runningOps.delete(key);
+  });
+  return op;
+}
+
+function timeoutError(message) {
+  const error = new Error(message);
+  error.code = 'ETIMEDOUT';
+  return error;
+}
+
+/** Resolves `{ value }`, `{ error }`, or `{ error, timedOut: true }`; never rejects.
+ *  The outcome is also kept as the provider's latest catalog failure (or
+ *  recovery) for views that explain an empty list (catalog-failures.mjs),
+ *  but only while it is current: a caller of a superseded generation, or one
+ *  answered by an op that a newer op of its kind replaced, publishes nothing. */
+export async function boundedProviderCatalogOp(op) {
+  const callerGeneration = generation;
+  const answered = { op: null };
+  const outcome = await runBoundedOp(op, callerGeneration, answered);
+  const currentOp = !answered.op || latestOpSeq.get(runKey(op.name, op.kind)) === answered.op.seq;
+  if (callerGeneration === generation && currentOp) recordProviderCatalogOutcome(op.name, outcome.error);
+  return outcome;
+}
+
+async function runBoundedOp(
+  { name, provider, kind, run, timeoutMs = PROVIDER_CATALOG_TIMEOUT_MS, epoch = 0 },
+  callerGeneration,
+  answered
+) {
+  let timer = null;
+  let watched = null;
+  const deadline = new Promise((resolve) => {
+    timer = setTimeout(() => {
+      const error = timeoutError(`provider "${name}" catalog ${kind} did not finish within ${timeoutMs}ms`);
+      if (watched) {
+        // Stalled until it settles: an op that honors the abort settles (and
+        // leaves the table) a few microtasks later, one that ignores it stays.
+        watched.timedOut = true;
+        watched.controller.abort(error);
+      }
+      resolve({ error, timedOut: true });
+    }, timeoutMs);
+  });
+  try {
+    for (;;) {
+      let op = pendingOps.get(name);
+      const superseded =
+        !op || op.provider !== provider || op.generation < callerGeneration || (op.kind === kind && op.epoch !== epoch);
+      if (superseded) {
+        if (isStalled(name, kind)) {
+          const error = timeoutError(`provider "${name}" catalog ${kind} ignored its deadline and is still pending`);
+          return { error, timedOut: true, stalled: true };
+        }
+        op = startOp(name, provider, kind, run, epoch, callerGeneration);
+      } else if (op.timedOut) {
+        // Already overran a deadline and still not settled: fail fast instead
+        // of making every later caller wait out another deadline for it.
+        const error = timeoutError(`provider "${name}" catalog ${op.kind} is still pending after its deadline`);
+        return { error, timedOut: true };
+      }
+      watched = op;
+      if (op.kind === kind) {
+        answered.op = op;
+        return await Promise.race([op.settled, deadline]);
+      }
+      const outcome = await Promise.race([op.settled.then(() => null), deadline]);
+      if (outcome) return outcome;
+    }
+  } finally {
+    clearTimeout(timer);
+  }
+}

package/src/runtime/agent/orchestrator/providers/catalog-failures.mjs

@@ -0,0 +1,34 @@
+// The latest catalog failure of each provider, kept so a view that lists a
+// provider's models can say WHY the list is empty (expired key, spent credits,
+// timeout) instead of showing a silent 0/0. Cleared by the provider's next
+// answer and by an account change.
+import { safeErrorDetails } from '../../../shared/error-presentation.mjs';
+import { providerErrorKind } from './provider-error-kind.mjs';
+
+const MESSAGE_LIMIT = 300;
+const failures = new Map();
+
+/** Records a provider's catalog failure (`error`) or its recovery (no error). */
+export function recordProviderCatalogOutcome(name, error) {
+  if (!error) {
+    failures.delete(name);
+    return;
+  }
+  const reason = typeof error.providerError?.message === 'string' ? error.providerError.message : '';
+  const text = safeErrorDetails(reason ? `${error.message}: ${reason}` : error.message);
+  failures.set(name, {
+    // Plain text, never a JSON envelope: describeError reads the kind below.
+    message: text.replace(/\s+/g, ' ').slice(0, MESSAGE_LIMIT),
+    errorKind: providerErrorKind(error),
+    at: Date.now(),
+  });
+}
+
+/** `{ message, errorKind, at }` of the provider's latest failure, or null. */
+export function providerCatalogFailure(name) {
+  return failures.get(name) ?? null;
+}
+
+export function clearProviderCatalogFailures() {
+  failures.clear();
+}

package/src/runtime/agent/orchestrator/providers/cursor-client-version.mjs

@@ -4,7 +4,7 @@ import { createRemoteVersionSource } from './npm-cli-version.mjs';
 // documented version endpoint; the official installer script embeds the
 // current build (…/lab/<build>/…), parsed best-effort. Any format change or
 // failure falls back to the floor.
-export const CURSOR_CLIENT_VERSION_FLOOR = 'cli-2026.10.16-e3cb207';
+export const CURSOR_CLIENT_VERSION_FLOOR = 'cli-2026.10.19-6bbf2c4';
 const BUILD_PATTERN = /downloads\.cursor\.com\/lab\/(\d{4}\.\d{2}\.\d{2}-[0-9a-f]{6,40})\//;
 export const CURSOR_INSTALL_URL = 'https://cursor.com/install';
 

package/src/runtime/agent/orchestrator/providers/grok-oauth-login.mjs

@@ -4,7 +4,7 @@ import { createServer } from 'node:http';
 import { randomBytes } from 'node:crypto';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
 import { createOAuthPkce, parseOAuthCodeInput } from './lib/oauth-pkce.mjs';
-import { OAUTH_PAGE_CONTENT_TYPE, oauthSuccessHtml } from './lib/oauth-page.mjs';
+import { OAUTH_PAGE_CONTENT_TYPE, oauthErrorHtml, oauthSuccessHtml } from './lib/oauth-page.mjs';
 import { emailFromJwts } from './lib/oauth-token-utils.mjs';
 import {
   CLIENT_ID,
@@ -26,7 +26,8 @@ export function generatePKCE() {
   return createOAuthPkce();
 }
 
-export async function exchangeAuthorizationCode({ discovery, pkce, code }) {
+export async function exchangeAuthorizationCode({ discovery, pkce, code, signal = null }) {
+  signal?.throwIfAborted();
   const cleanCode = String(code || '').trim();
   if (!cleanCode) throw new Error('[grok-oauth] authorization code is required');
   const tokenRes = await fetch(discovery.token_endpoint, {
@@ -47,7 +48,9 @@ export async function exchangeAuthorizationCode({ discovery, pkce, code }) {
     // Secret-bearing (authorization code + verifier): refuse
     // redirects so they can't be replayed to an untrusted host.
     redirect: 'error',
-    signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
+    signal: signal
+      ? AbortSignal.any([signal, AbortSignal.timeout(TOKEN_TIMEOUT_MS)])
+      : AbortSignal.timeout(TOKEN_TIMEOUT_MS),
     dispatcher: getLlmDispatcher(),
   });
   if (!tokenRes.ok) {
@@ -72,6 +75,8 @@ export async function exchangeAuthorizationCode({ discovery, pkce, code }) {
       ? { email: emailFromJwts(json.id_token, json.access_token) }
       : {}),
   };
+  // A cancelled login never stores the account it was exchanging.
+  signal?.throwIfAborted();
   saveTokens(tokens);
   return tokens;
 }
@@ -96,11 +101,30 @@ export async function beginOAuthLogin({ openBrowser = true } = {}) {
   let server = null;
   let timeout = null;
   let finish = null;
+  let exchangePromise = null;
+  const controller = new AbortController();
+  // Browser and manual callbacks share one exchange: an authorization code is
+  // single-use, and a duplicate must not settle the login before the first.
+  const acceptCode = (code) => {
+    if (exchangePromise) return exchangePromise;
+    controller.signal.throwIfAborted();
+    // The browser deadline ends when a code arrives; the exchange has its own.
+    if (timeout) clearTimeout(timeout);
+    timeout = null;
+    exchangePromise = exchangeAuthorizationCode({ discovery, pkce, code, signal: controller.signal });
+    exchangePromise.then(
+      (tokens) => finish(tokens),
+      (err) => finish(null, err instanceof Error ? err : new Error(String(err)))
+    );
+    return exchangePromise;
+  };
   const waitForCallback = new Promise((resolve, reject) => {
     let settled = false;
     finish = (value, error = null) => {
       if (settled) return;
       settled = true;
+      // Work arriving after the login settled (or was cancelled) is rejected.
+      controller.abort();
       if (timeout) clearTimeout(timeout);
       try {
         server?.close();
@@ -120,17 +144,18 @@ export async function beginOAuthLogin({ openBrowser = true } = {}) {
       const code = u.searchParams.get('code');
       if (!code || u.searchParams.get('state') !== state) {
         // Reject this request only; the valid callback may still arrive.
-        res.writeHead(400);
-        res.end('Invalid');
+        res.writeHead(400, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE });
+        res.end(oauthErrorHtml('The sign-in callback was invalid or did not match this login.'));
         return;
       }
-      res.writeHead(200, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE });
-      res.end(oauthSuccessHtml('Grok'));
       try {
-        const tokens = await exchangeAuthorizationCode({ discovery, pkce, code });
-        finish(tokens);
-      } catch (err) {
-        finish(null, err instanceof Error ? err : new Error(String(err)));
+        await acceptCode(code);
+        res.writeHead(200, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE });
+        res.end(oauthSuccessHtml('Grok'));
+      } catch {
+        // The shared exchange reports its error through waitForCallback.
+        res.writeHead(500, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE });
+        res.end(oauthErrorHtml('Grok could not complete the token exchange.'));
       }
     });
     timeout = setTimeout(() => finish(null), LOGIN_TIMEOUT_MS);
@@ -161,9 +186,8 @@ export async function beginOAuthLogin({ openBrowser = true } = {}) {
     completeCode: async (input) => {
       const parsed = parseOAuthCodeInput(input, { allowHashState: true });
       if (parsed.state && parsed.state !== state) throw new Error('[grok-oauth] OAuth state mismatch');
-      const tokens = await exchangeAuthorizationCode({ discovery, pkce, code: parsed.code });
-      finish?.(tokens);
-      return tokens;
+      if (!parsed.code) throw new Error('[grok-oauth] authorization code is required');
+      return await acceptCode(parsed.code);
     },
     cancel: () => {
       finish?.(null);