mixdog 1.2.5 → 1.3.0

package/src/runtime/agent/orchestrator/providers/openai-oauth-login.mjs

@@ -11,7 +11,7 @@
 import { createServer } from 'node:http';
 import { randomBytes } from 'node:crypto';
 import { createOAuthPkce, parseOAuthCodeInput } from './lib/oauth-pkce.mjs';
-import { OAUTH_PAGE_CONTENT_TYPE, oauthSuccessHtml } from './lib/oauth-page.mjs';
+import { OAUTH_PAGE_CONTENT_TYPE, oauthErrorHtml, oauthSuccessHtml } from './lib/oauth-page.mjs';
 import { openLoginUrl } from './lib/open-login-url.mjs';
 
 const TOKEN_URL = 'https://auth.openai.com/oauth/token';
@@ -44,7 +44,8 @@ function _scrubOAuthLoginBody(text) {
 export function createOpenAIOAuthLogin(deps) {
   const { clientId, originator, extractAccountId, identityFromTokens, expiryFromAccessToken, saveTokens } = deps;
 
-  async function exchangeAuthorizationCode({ pkce, code }) {
+  async function exchangeAuthorizationCode({ pkce, code, signal = null }) {
+    signal?.throwIfAborted();
     const cleanCode = String(code || '').trim();
     if (!cleanCode) throw new Error('[openai-oauth] authorization code is required');
     const tokenRes = await fetch(TOKEN_URL, {
@@ -58,7 +59,9 @@ export function createOpenAIOAuthLogin(deps) {
         code_verifier: pkce.verifier,
       }),
       redirect: 'error',
-      signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
+      signal: signal
+        ? AbortSignal.any([signal, AbortSignal.timeout(TOKEN_TIMEOUT_MS)])
+        : AbortSignal.timeout(TOKEN_TIMEOUT_MS),
     });
     if (!tokenRes.ok) {
       const text = await tokenRes.text().catch(() => '');
@@ -78,6 +81,8 @@ export function createOpenAIOAuthLogin(deps) {
       account_id: extractAccountId(json.access_token),
       identity: identityFromTokens(json.id_token, json.access_token),
     };
+    // A cancelled login never stores the account it was exchanging.
+    signal?.throwIfAborted();
     saveTokens(tokens);
     return tokens;
   }
@@ -100,11 +105,30 @@ export function createOpenAIOAuthLogin(deps) {
     let server = null;
     let timeout = null;
     let finish = null;
+    let exchangePromise = null;
+    const controller = new AbortController();
+    // Browser and manual callbacks share one exchange: an authorization code is
+    // single-use, and a duplicate must not settle the login before the first.
+    const acceptCode = (code) => {
+      if (exchangePromise) return exchangePromise;
+      controller.signal.throwIfAborted();
+      // The browser deadline ends when a code arrives; the exchange has its own.
+      if (timeout) clearTimeout(timeout);
+      timeout = null;
+      exchangePromise = exchangeAuthorizationCode({ pkce, code, signal: controller.signal });
+      exchangePromise.then(
+        (tokens) => finish(tokens),
+        (err) => finish(null, err instanceof Error ? err : new Error(String(err)))
+      );
+      return exchangePromise;
+    };
     const waitForCallback = new Promise((resolve, reject) => {
       let settled = false;
       finish = (value, error = null) => {
         if (settled) return;
         settled = true;
+        // Work arriving after the login settled (or was cancelled) is rejected.
+        controller.abort();
         if (timeout) clearTimeout(timeout);
         try {
           server?.close();
@@ -122,19 +146,25 @@ export function createOpenAIOAuthLogin(deps) {
           return;
         }
         const code = u.searchParams.get('code');
-        if (!code || u.searchParams.get('state') !== state) {
-          res.writeHead(400);
-          res.end('Invalid');
-          finish(null);
+        const stateMatches = u.searchParams.get('state') === state;
+        if (!code || !stateMatches) {
+          res.writeHead(400, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE });
+          res.end(oauthErrorHtml('The sign-in callback was invalid or did not match this login.'));
+          // A request for another login is rejected alone; this login's
+          // legitimate callback may still arrive.
+          if (stateMatches && !exchangePromise) finish(null);
           return;
         }
-        res.writeHead(200, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE });
-        res.end(oauthSuccessHtml('OpenAI'));
         try {
-          const tokens = await exchangeAuthorizationCode({ pkce, code });
-          finish(tokens);
-        } catch (err) {
-          finish(null, err instanceof Error ? err : new Error(String(err)));
+          await acceptCode(code);
+          // The login settles (closing the server) before this response is
+          // written; do not leave a keep-alive connection bound to it.
+          res.writeHead(200, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE, Connection: 'close' });
+          res.end(oauthSuccessHtml('OpenAI'));
+        } catch {
+          // The shared exchange reports its error through waitForCallback.
+          res.writeHead(500, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE, Connection: 'close' });
+          res.end(oauthErrorHtml('OpenAI could not complete the token exchange.'));
         }
       });
       timeout = setTimeout(() => finish(null), LOGIN_TIMEOUT_MS);
@@ -161,9 +191,8 @@ export function createOpenAIOAuthLogin(deps) {
       completeCode: async (input) => {
         const parsed = parseOAuthCodeInput(input, { allowHashState: true });
         if (parsed.state && parsed.state !== state) throw new Error('[openai-oauth] OAuth state mismatch');
-        const tokens = await exchangeAuthorizationCode({ pkce, code: parsed.code });
-        finish?.(tokens);
-        return tokens;
+        if (!parsed.code) throw new Error('[openai-oauth] authorization code is required');
+        return await acceptCode(parsed.code);
       },
       cancel: () => {
         finish?.(null);

package/src/runtime/agent/orchestrator/providers/openai-oauth-tokens.mjs

@@ -92,6 +92,15 @@ export function identityFromTokens(...tokens) {
   return normalizeAccountIdentity({ id: [sub, accountId].filter(Boolean).join(':'), email });
 }
 
+/** ChatGPT plan (e.g. plus, pro) from the first token carrying the claim, else null. */
+export function planFromTokens(...tokens) {
+  for (const token of tokens) {
+    const plan = decodeJwtPayload(token)?.['https://api.openai.com/auth']?.chatgpt_plan_type;
+    if (typeof plan === 'string' && plan) return plan;
+  }
+  return null;
+}
+
 /** mtime of the token file, 0 when it is missing or unreadable. */
 export function tokensFileMtimeMs() {
   try {
@@ -165,6 +174,7 @@ export function describeOpenAIOAuthCredentials() {
       ...oauthCredentialStatus({ hasRefresh, expiresAt, detail: source, refreshSkewMs: TOKEN_REFRESH_SKEW_MS }),
       ...accountIdentityFields(tokens.identity),
       ...(accountId ? { accountId } : {}),
+      plan: planFromTokens(tokens.id_token, tokens.access_token),
     };
   } catch (err) {
     return {

package/src/runtime/agent/orchestrator/providers/openai-oauth-ws.mjs

@@ -297,6 +297,7 @@ export async function sendViaWebSocket({
         onStreamDelta,
         onToolCall,
         onTextDelta,
+        onStreamItemStart: typeof sendOpts?.onStreamItemStart === 'function' ? sendOpts.onStreamItemStart : null,
         state: midState,
         logSuppressedReasoningDeltas,
         traceProvider,

package/src/runtime/agent/orchestrator/providers/openai-ws-connect.mjs

@@ -0,0 +1,196 @@
+/**
+ * openai-ws-connect.mjs — how a Responses WebSocket reaches the server.
+ *
+ * Every pool handshake is a brand-new TCP+TLS connection (the upgrade detaches
+ * it from any HTTP keep-alive pool), so a burst of agents starting together
+ * pays one DNS resolution and one full TLS handshake per socket. This module
+ * removes the repeated work and the long stall:
+ *
+ *   - lookup: one resolution per host, shared by concurrent handshakes and
+ *     reused for a short TTL (libuv's small thread pool otherwise queues one
+ *     getaddrinfo per socket behind unrelated file I/O);
+ *   - TLS resumption: the latest session ticket per host rides the next
+ *     connect, so later sockets skip the full key exchange;
+ *   - hedged open: an upgrade that has not opened within the hedge window
+ *     gets a parallel replacement attempt instead of waiting out the whole
+ *     acquire timeout. The first leg to open wins; the rest are cancelled.
+ *     Server decisions (any HTTP status on the upgrade, e.g. 429/401) end
+ *     the race at once so backoff stays driven by real server signals.
+ */
+import { lookup as dnsLookup } from 'node:dns';
+import net from 'node:net';
+import tls from 'node:tls';
+import { resolveTimeoutMs } from '../stall-policy.mjs';
+
+const DNS_TTL_MS = resolveTimeoutMs('MIXDOG_PROVIDER_WS_DNS_TTL_MS', 30_000, { minMs: 1_000, maxMs: 300_000 });
+// Observed production upgrades: p95 ≈ 0.55s, max ≈ 3.4s over 6k handshakes,
+// so a leg still unopened after 3s is almost certainly stuck.
+const WS_HEDGE_MS = resolveTimeoutMs('MIXDOG_PROVIDER_WS_HEDGE_MS', 3_000, { minMs: 500, maxMs: 60_000 });
+
+const _dnsCache = new Map();
+
+function _lookupKey(hostname, options) {
+  return `${hostname}\0${options?.family || 0}\0${options?.hints || 0}`;
+}
+
+function _answer(addresses, options, callback) {
+  if (options?.all) {
+    callback(null, addresses);
+    return;
+  }
+  const first = addresses[0];
+  callback(null, first.address, first.family);
+}
+
+/** dns.lookup-compatible resolver with in-flight coalescing and a short TTL. */
+export function cachedLookup(hostname, options, callback) {
+  const opts = typeof options === 'function' ? {} : typeof options === 'number' ? { family: options } : options || {};
+  const cb = typeof options === 'function' ? options : callback;
+  const key = _lookupKey(hostname, opts);
+  const cached = _dnsCache.get(key);
+  if (cached?.addresses && cached.expiresAt > Date.now()) {
+    _answer(cached.addresses, opts, cb);
+    return;
+  }
+  if (cached?.waiters) {
+    cached.waiters.push({ opts, cb });
+    return;
+  }
+  const record = { waiters: [{ opts, cb }] };
+  _dnsCache.set(key, record);
+  dnsLookup(hostname, { family: opts.family || 0, hints: opts.hints || 0, all: true }, (err, addresses) => {
+    const waiters = record.waiters;
+    if (err || !addresses?.length) {
+      if (_dnsCache.get(key) === record) _dnsCache.delete(key);
+      const failure = err || Object.assign(new Error(`lookup ${hostname} returned no address`), { code: 'ENOTFOUND' });
+      for (const waiter of waiters) waiter.cb(failure);
+      return;
+    }
+    _dnsCache.set(key, { addresses, expiresAt: Date.now() + DNS_TTL_MS });
+    for (const waiter of waiters) _answer(addresses, waiter.opts, waiter.cb);
+  });
+}
+
+const _tlsSessions = new Map();
+
+/**
+ * `ws` createConnection: the shared lookup for every socket, plus TLS
+ * resumption for secure ones. Mirrors ws's own servername defaulting.
+ */
+export function createWsConnection(options) {
+  if (options.protocol === 'ws:' || options.protocol === 'http:') {
+    return net.connect({ ...options, path: options.socketPath, lookup: cachedLookup });
+  }
+  const sessionKey = `${options.host}:${options.port}`;
+  const servername =
+    options.servername || options.servername === '' ? options.servername : net.isIP(options.host) ? '' : options.host;
+  const socket = tls.connect({
+    ...options,
+    path: undefined,
+    servername,
+    lookup: cachedLookup,
+    session: _tlsSessions.get(sessionKey),
+  });
+  socket.on('session', (session) => _tlsSessions.set(sessionKey, session));
+  return socket;
+}
+
+/** Test-only reset of the resolver and TLS session caches. */
+export function _clearConnectCachesForTest() {
+  _dnsCache.clear();
+  _tlsSessions.clear();
+}
+
+function _abortReason(signal, fallback) {
+  return signal?.reason instanceof Error ? signal.reason : new Error(fallback);
+}
+
+/**
+ * Race handshake legs until one opens. `openLeg({ externalSignal })` opens one
+ * socket and resolves `{ socket }`. A new leg starts every `hedgeMs` while
+ * none has opened and the acquire deadline leaves room; a leg's transport
+ * failure only ends the race when nothing else is still connecting.
+ */
+export function openHedged({ openLeg, externalSignal, hedgeMs = WS_HEDGE_MS, deadlineMs, deadlineError }) {
+  return new Promise((resolve, reject) => {
+    const startedAt = Date.now();
+    const legs = new Set();
+    let settled = false;
+    let hedgeTimer = null;
+    let deadlineTimer = null;
+    let lastError = null;
+
+    const cleanup = () => {
+      if (hedgeTimer) clearTimeout(hedgeTimer);
+      if (deadlineTimer) clearTimeout(deadlineTimer);
+      externalSignal?.removeEventListener?.('abort', onExternalAbort);
+    };
+    const cancelLegs = (reason) => {
+      for (const leg of legs) leg.abort(reason);
+      legs.clear();
+    };
+    const finish = (ok, value) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      (ok ? resolve : reject)(value);
+    };
+    const fail = (err) => {
+      cancelLegs(err);
+      finish(false, err);
+    };
+    function onExternalAbort() {
+      fail(_abortReason(externalSignal, 'OpenAI WS handshake aborted'));
+    }
+
+    const scheduleHedge = () => {
+      if (settled || !(hedgeMs > 0)) return;
+      if (Date.now() - startedAt + hedgeMs >= deadlineMs) return;
+      hedgeTimer = setTimeout(() => {
+        hedgeTimer = null;
+        startLeg();
+      }, hedgeMs);
+      hedgeTimer.unref?.();
+    };
+
+    function startLeg() {
+      if (settled) return;
+      const controller = new AbortController();
+      legs.add(controller);
+      Promise.resolve()
+        .then(() => openLeg({ externalSignal: controller.signal }))
+        .then(
+          (opened) => {
+            legs.delete(controller);
+            if (settled) {
+              try {
+                opened?.socket?.terminate?.();
+              } catch {}
+              return;
+            }
+            cancelLegs(new Error('OpenAI WS handshake superseded by a faster attempt'));
+            finish(true, opened);
+          },
+          (err) => {
+            legs.delete(controller);
+            if (settled || controller.signal.aborted) return;
+            lastError = err;
+            // An HTTP status is the server's decision for this request
+            // (rate limit, auth, upgrade refusal): surface it unchanged.
+            if (err?.httpStatus != null || legs.size === 0) fail(err);
+          }
+        );
+      if (hedgeTimer) clearTimeout(hedgeTimer);
+      scheduleHedge();
+    }
+
+    if (externalSignal?.aborted) {
+      onExternalAbort();
+      return;
+    }
+    externalSignal?.addEventListener?.('abort', onExternalAbort, { once: true });
+    deadlineTimer = setTimeout(() => fail(lastError?.httpStatus != null ? lastError : deadlineError()), deadlineMs);
+    deadlineTimer.unref?.();
+    startLeg();
+  });
+}

package/src/runtime/agent/orchestrator/providers/openai-ws-pool.mjs

@@ -9,6 +9,7 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { performance } from 'node:perf_hooks';
 import { attachHandshakeFailureHandlers, captureHandshakeUpgrade } from './openai-ws-handshake.mjs';
+import { createWsConnection, openHedged } from './openai-ws-connect.mjs';
 import { codexOriginator, codexUserAgent, codexVersionHeader } from './codex-client-meta.mjs';
 import {
   PROVIDER_WS_ACQUIRE_TIMEOUT_MS,
@@ -539,7 +540,26 @@ const WS_URL_BY_AUTH = { xai: XAI_WS_URL, 'openai-direct': OPENAI_WS_URL };
 /** The auth kind an error label names; anything but xAI/direct is the OAuth (Codex) path. */
 const _wsAuthKind = (auth) => (auth?.type === 'xai' || auth?.type === 'openai-direct' ? auth.type : 'openai-oauth');
 
-async function _openSocket({ auth, sessionToken, externalSignal, cacheKey, codexHeaders }) {
+function _acquireTimeoutError(auth) {
+  return Object.assign(
+    new Error(`${_wsErrLabel(_wsAuthKind(auth))} acquire timed out before open (${WS_ACQUIRE_TIMEOUT_MS}ms)`),
+    { code: 'EWSACQUIRETIMEOUT', acquireTimeoutMs: WS_ACQUIRE_TIMEOUT_MS }
+  );
+}
+
+// One acquire = a hedged race of handshake legs under the acquire deadline
+// (openai-ws-connect.mjs): a stuck upgrade is replaced after the hedge window
+// instead of costing the whole timeout plus a retry.
+function _openSocket(args) {
+  return openHedged({
+    openLeg: ({ externalSignal }) => _openSocketLeg({ ...args, externalSignal }),
+    externalSignal: args.externalSignal,
+    deadlineMs: WS_ACQUIRE_TIMEOUT_MS,
+    deadlineError: () => _acquireTimeoutError(args.auth),
+  });
+}
+
+async function _openSocketLeg({ auth, sessionToken, externalSignal, cacheKey, codexHeaders }) {
   // `ws` loads on the first socket, not at runtime boot via provider-admin.
   const { default: WebSocket } = await import('ws');
   const headers = _buildHandshakeHeaders({ auth, sessionToken, cacheKey, codexHeaders });
@@ -586,6 +606,7 @@ async function _openSocket({ auth, sessionToken, externalSignal, cacheKey, codex
       headers,
       handshakeTimeout: WS_HANDSHAKE_TIMEOUT_MS,
       maxPayload: WS_MAX_INCOMING_FRAME_BYTES,
+      createConnection: createWsConnection,
     });
     acquireTimer = setTimeout(() => {
       if (settled) return;
@@ -597,13 +618,7 @@ async function _openSocket({ auth, sessionToken, externalSignal, cacheKey, codex
       try {
         socket.terminate();
       } catch {}
-      settle(
-        false,
-        Object.assign(
-          new Error(`${_wsErrLabel(_wsAuthKind(auth))} acquire timed out before open (${WS_ACQUIRE_TIMEOUT_MS}ms)`),
-          { code: 'EWSACQUIRETIMEOUT', acquireTimeoutMs: WS_ACQUIRE_TIMEOUT_MS }
-        )
-      );
+      settle(false, _acquireTimeoutError(auth));
     }, WS_ACQUIRE_TIMEOUT_MS);
     try {
       acquireTimer.unref?.();
@@ -764,6 +779,52 @@ function _onEntryClosed(poolKey, entry) {
   if (!entry.ephemeral) _removeFromPool(poolKey, entry);
 }
 
+// Sessionless sends (no poolKey) carry no turn state or response chain of
+// their own, so their connections are shared: one idle bucket per
+// credential + cache key, no owner claim (concurrent sessionless callers
+// each take a different idle socket or open one), and a reused socket starts
+// with an empty chain so no request ever deltas against another caller's
+// response. Without this every sessionless send paid a fresh handshake and
+// closed the socket on release.
+const SHARED_POOL_PREFIX = '\0shared:';
+
+function _resetChain(entry) {
+  entry.lastResponseId = null;
+  entry.lastRequestSansInput = null;
+  entry.lastRequestInput = null;
+  entry.lastResponseItems = null;
+  entry.lastInputLen = 0;
+  entry.lastInputPrefixHash = null;
+  entry.turnState = null;
+  entry.turnStateScope = null;
+  entry.turnStateTurnId = null;
+}
+
+async function _acquireShared({ auth, cacheKey, codexHeaders, externalSignal, acqStart }) {
+  const compatibility = _poolCompatibility(auth, cacheKey);
+  const sharedKey = `${SHARED_POOL_PREFIX}${compatibility.authIdentity}:${compatibility.cacheKeyIdentity}`;
+  const arr = _wsPool.get(sharedKey) || [];
+  _pruneStaleEntries(sharedKey, arr, compatibility);
+  const idle = await _takeIdleEntry(sharedKey, arr, compatibility, acqStart);
+  if (idle) {
+    _resetChain(idle);
+    return { entry: idle, reused: true, ownerWaitMs: 0 };
+  }
+  const entry = await _openPoolEntry({
+    auth,
+    cacheKey,
+    codexHeaders,
+    externalSignal,
+    compatibility,
+    ephemeral: false,
+    acqStart,
+  });
+  entry.sharedPoolKey = sharedKey;
+  _getPoolArr(sharedKey).push(entry);
+  entry.socket.on('close', () => _onEntryClosed(sharedKey, entry));
+  return { entry, reused: false, ownerWaitMs: 0 };
+}
+
 export async function acquireWebSocket({ auth, poolKey, cacheKey, codexHeaders, forceFresh, externalSignal }) {
   const _acqStart = Date.now();
   _acquireTrace(
@@ -772,6 +833,9 @@ export async function acquireWebSocket({ auth, poolKey, cacheKey, codexHeaders,
   if (externalSignal?.aborted) {
     throw _acquireAbortError(externalSignal);
   }
+  if (!poolKey && !forceFresh) {
+    return _acquireShared({ auth, cacheKey, codexHeaders, externalSignal, acqStart: _acqStart });
+  }
   const ownerClaim = await _claimPoolOwner(poolKey, externalSignal);
   const acquired = (entry, reused) => {
     _bindPoolOwner(poolKey, ownerClaim, entry);
@@ -825,8 +889,9 @@ export async function acquireWebSocket({ auth, poolKey, cacheKey, codexHeaders,
   }
 }
 
-export function releaseWebSocket({ entry, poolKey, keep }) {
+export function releaseWebSocket({ entry, poolKey: callerPoolKey, keep }) {
   if (!entry) return;
+  const poolKey = callerPoolKey || entry.sharedPoolKey || null;
   entry.busy = false;
   if (!keep || !_isOpen(entry) || !poolKey || entry.ephemeral) {
     try {

package/src/runtime/agent/orchestrator/providers/openai-ws-stream/event-switch.mjs

@@ -1,9 +1,19 @@
 import { performance } from 'node:perf_hooks';
+import { reportStreamItemStart, responsesItemStart } from '../lib/send-callbacks.mjs';
 
 // The per-event fold: text/reasoning/tool deltas and item lifecycle feed the
 // response state, the text relay and the semantic watchdog; terminal frames
 // route to the terminal-frame handlers.
-export function createWsEventSwitch({ response, textRelay, watchdogs, midState, progress, terminal, streamingStart }) {
+export function createWsEventSwitch({
+  response,
+  textRelay,
+  watchdogs,
+  midState,
+  progress,
+  terminal,
+  streamingStart,
+  onStreamItemStart = null,
+}) {
   let firstDeltaEmitted = false;
 
   function onResponseCreated(event) {
@@ -73,6 +83,7 @@ export function createWsEventSwitch({ response, textRelay, watchdogs, midState,
         break;
       case 'response.output_item.added':
         response.noteItemAdded(event.item);
+        reportStreamItemStart(onStreamItemStart, responsesItemStart(event.item));
         // Item lifecycle is genuine progress: reset the semantic-idle timer so
         // long server-side tool latency after item-added (before any arg
         // delta) is not mistaken for a silent stall.
@@ -102,6 +113,8 @@ export function createWsEventSwitch({ response, textRelay, watchdogs, midState,
         break;
       case 'response.output_item.done': {
         const kind = response.completeOutputItem(event.item);
+        // A stream that names the phase only on the finished message.
+        if (event.item?.type === 'message') reportStreamItemStart(onStreamItemStart, responsesItemStart(event.item));
         // Item-done is genuine lifecycle progress — reset semantic idle so
         // latency before the next item/args does not stall.
         watchdogs.resetSemantic();

package/src/runtime/agent/orchestrator/providers/openai-ws-stream.mjs

@@ -96,6 +96,7 @@ export async function _streamResponse({
   onStreamDelta,
   onToolCall,
   onTextDelta,
+  onStreamItemStart = null,
   state,
   logSuppressedReasoningDeltas = true,
   traceProvider = 'openai-oauth',
@@ -236,6 +237,7 @@ export async function _streamResponse({
       progress,
       terminal,
       streamingStart,
+      onStreamItemStart,
     });
     handlers = createSocketHandlers({
       socket,