mixdog 1.3.0 → 1.3.2

package/src/runtime/agent/orchestrator/providers/anthropic-api-request.mjs

@@ -10,6 +10,7 @@
  * anthropic-turn-result.mjs); nothing here touches the socket.
  */
 import { prepareAnthropicImages } from './lib/anthropic-image-input.mjs';
+import { anthropicPrefixFingerprint, recordAnthropicPrefix } from './lib/anthropic-prefix-trace.mjs';
 import { buildAnthropicBetaHeaders, supportsAnthropicFastMode } from './anthropic-betas.mjs';
 import { applyAnthropicServerFallback } from './anthropic-server-fallback.mjs';
 import { fastModeAvailable } from './anthropic-fast-mode.mjs';
@@ -17,6 +18,7 @@ import { applyAnthropicEffortToBody, shouldIncludeEffortBeta } from './anthropic
 import { isCustomProviderName, resolveCustomReasoning } from './custom-reasoning.mjs';
 import {
   anthropicThinkingActive,
+  appendAnthropicTailReminder,
   applyAnthropicCacheMarkers,
   clampAnthropicThinkingBudget as clampThinkingBudgetTokens,
   resolveAnthropicCacheTtls as resolveCacheTtls,
@@ -24,6 +26,7 @@ import {
   sharedCachePrefixBoundary,
   toAnthropicToolChoice,
 } from './lib/anthropic-request-utils.mjs';
+import { splitTailReminder } from './lib/tail-reminder-split.mjs';
 import {
   buildSystemBlocks,
   resolveMaxTokens,
@@ -50,7 +53,7 @@ import {
 export async function buildAnthropicApiRequest({
   name,
   config,
-  messages,
+  messages: requestMessages,
   useModel,
   tools,
   opts,
@@ -67,6 +70,7 @@ export async function buildAnthropicApiRequest({
   // the global by-model-id capability index and the Claude-id ladders are
   // first-party knowledge and must not leak onto (or from) a custom endpoint.
   const isCustom = isCustomProviderName(name);
+  const { messages, reminder } = splitTailReminder(requestMessages);
   const maxTokens = resolveMaxTokens(capabilityModel, { modelMaxOutputTokens });
   const effortOptions = { ...config, ...opts, disableBetaHeaders: config?.disableBetaHeaders };
   const gatewayEffort = typeof config?.messagesEffort === 'function' ? config.messagesEffort(opts) : null;
@@ -108,7 +112,9 @@ export async function buildAnthropicApiRequest({
     model: useModel,
     max_tokens: maxTokens,
     system: systemBlocks.length ? systemBlocks : undefined,
-    messages: await prepareAnthropicImages(anthropicMessages, { signal: opts.signal }),
+    messages: await prepareAnthropicImages(appendAnthropicTailReminder(anthropicMessages, reminder), {
+      signal: opts.signal,
+    }),
   };
   // Server-side fallback and fast mode are decided from Claude model ids:
   // first-party knowledge, never applied to a custom endpoint.
@@ -135,6 +141,55 @@ export async function buildAnthropicApiRequest({
       .map((t) => (t && typeof t.name === 'string' ? t.name : null))
       .filter(Boolean)
   );
+  applyRequestReasoning(params, {
+    isCustom,
+    name,
+    config,
+    opts,
+    modelInfo,
+    capabilityModel,
+    maxTokens,
+    gatewayEffort,
+    effortProjection,
+  });
+  if (params.tools) resolveRequestToolChoice(params, opts, config);
+  // Fast mode → speed: "fast" on models Anthropic marks as speed-capable.
+  // Suppressed while the fast capacity pool is cooling down.
+  let fastLatched = fastModeLatched;
+  if (!isCustom && opts.fast === true && supportsAnthropicFastMode(useModel) && fastModeAvailable()) {
+    params.speed = 'fast';
+    fastLatched = true;
+  }
+  // NOTE: do NOT sanitize here. params.messages was already sanitized
+  // once inside toAnthropicMessages and then had cache markers applied.
+  // Re-sanitizing after marking could drop/reorder a marked block and
+  // move the provider-visible cache breakpoint off the cached one — the
+  // exact COLD-turn bug this change fixes. Order: build → sanitize
+  // (once) → mark → prepare image bytes → send.
+  params.stream = true;
+  // Diagnostic: per-block prefix hashes of exactly what is sent.
+  recordAnthropicPrefix(opts.sessionId || opts.session?.id || null, anthropicPrefixFingerprint(params));
+
+  const requestHeaders = requestHeadersFor(params, {
+    config,
+    opts,
+    isCustom,
+    fastLatched,
+    hasDeferredTools,
+    capabilityModel,
+    effortProjection,
+  });
+
+  return { params, requestHeaders, knownToolNames, fastModeLatched: fastLatched };
+}
+
+/** The turn's thinking/effort fields on `params` (in place): a custom
+ *  provider's from its own model row, else the turn effort (or a gateway's
+ *  own `messagesEffort`; 'none' sends no thinking at all). */
+function applyRequestReasoning(
+  params,
+  { isCustom, name, config, opts, modelInfo, capabilityModel, maxTokens, gatewayEffort, effortProjection }
+) {
   if (isCustom) {
     const { fields } = resolveCustomReasoning({
       protocol: 'anthropic',
@@ -156,32 +211,29 @@ export async function buildAnthropicApiRequest({
       progressUpdates: config?.disableBetaHeaders !== true,
     });
   }
-  if (params.tools) {
-    const toolChoice = toAnthropicToolChoice(opts.toolChoice, {
-      thinking: anthropicThinkingActive(params),
-      disableParallelToolUse: opts.disableParallelToolUse === true,
-      // A gateway that cannot honour disable_parallel_tool_use declares so.
-      supportsDisableParallelToolUse: config?.supportsDisableParallelToolUse !== false,
-      onThinkingConflict: opts.toolChoiceThinkingConflict,
-    });
-    if (toolChoice) params.tool_choice = toolChoice;
-    else delete params.tool_choice;
-  }
-  // Fast mode → speed: "fast" on models Anthropic marks as speed-capable.
-  // Suppressed while the fast capacity pool is cooling down.
-  let fastLatched = fastModeLatched;
-  if (!isCustom && opts.fast === true && supportsAnthropicFastMode(useModel) && fastModeAvailable()) {
-    params.speed = 'fast';
-    fastLatched = true;
-  }
-  // NOTE: do NOT sanitize here. params.messages was already sanitized
-  // once inside toAnthropicMessages and then had cache markers applied.
-  // Re-sanitizing after marking could drop/reorder a marked block and
-  // move the provider-visible cache breakpoint off the cached one — the
-  // exact COLD-turn bug this change fixes. Order: build → sanitize
-  // (once) → mark → prepare image bytes → send.
-  params.stream = true;
+}
 
+/** The reserved `tool_choice` of a request with tools, resolved once
+ *  thinking is known (forced any/tool is invalid while thinking is on);
+ *  dropped when none applies. */
+function resolveRequestToolChoice(params, opts, config) {
+  const toolChoice = toAnthropicToolChoice(opts.toolChoice, {
+    thinking: anthropicThinkingActive(params),
+    disableParallelToolUse: opts.disableParallelToolUse === true,
+    // A gateway that cannot honour disable_parallel_tool_use declares so.
+    supportsDisableParallelToolUse: config?.supportsDisableParallelToolUse !== false,
+    onThinkingConflict: opts.toolChoiceThinkingConflict,
+  });
+  if (toolChoice) params.tool_choice = toolChoice;
+  else delete params.tool_choice;
+}
+
+/** The per-request headers of the final body `params`: the anthropic-beta
+ *  set it needs, then the caller's `opts.requestHeaders`; null when none. */
+function requestHeadersFor(
+  params,
+  { config, opts, isCustom, fastLatched, hasDeferredTools, capabilityModel, effortProjection }
+) {
   // Per-call headers override the client defaultHeaders, so the
   // constructor-level disableBetaHeaders opt-out must be honoured here
   // too — otherwise opencode-go's anthropic-compatible routing
@@ -205,8 +257,5 @@ export async function buildAnthropicApiRequest({
     ].filter(Boolean);
     if (betas.length) betaHeaders = { 'anthropic-beta': betas.join(',') };
   }
-  const requestHeaders =
-    betaHeaders || opts.requestHeaders ? { ...(betaHeaders || {}), ...(opts.requestHeaders || {}) } : null;
-
-  return { params, requestHeaders, knownToolNames, fastModeLatched: fastLatched };
+  return betaHeaders || opts.requestHeaders ? { ...(betaHeaders || {}), ...(opts.requestHeaders || {}) } : null;
 }

package/src/runtime/agent/orchestrator/providers/anthropic-model-resolve.mjs

@@ -149,7 +149,7 @@ function _markLatestByFamily(models) {
   for (const m of byFamily.values()) m.latest = true;
 }
 
-function _compareVersion(a, b) {
+export function _compareVersion(a, b) {
   const na = (a.match(/^claude-[a-z]+-(\d+)(?:-(\d+))?/i) || []).slice(1).map(Number);
   const nb = (b.match(/^claude-[a-z]+-(\d+)(?:-(\d+))?/i) || []).slice(1).map(Number);
   for (let i = 0; i < Math.max(na.length, nb.length); i++) {

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-client-version.mjs

@@ -10,7 +10,7 @@ import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
 // source release just to advance the user-agent version.
 // Claude Opus 5.5 requires 2.1.280 or newer. The release workflow raises this
 // to the published CLI version (scripts/sync-client-version-floors.mjs).
-export const DEFAULT_CLI_VERSION = '2.1.304';
+export const DEFAULT_CLI_VERSION = '2.1.307';
 export const CLAUDE_CLI_NPM_PACKAGE = '@anthropic-ai/claude-code';
 
 const CACHE_SCHEMA_VERSION = 1;

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -6,6 +6,11 @@
  * from anthropic.mjs. agent-trace instrumented.
  */
 import { traceAgentSse, traceAgentUsage } from '../agent-trace.mjs';
+import {
+  anthropicPrefixFingerprint,
+  latestAnthropicPrefix,
+  recordAnthropicPrefix,
+} from './lib/anthropic-prefix-trace.mjs';
 import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
 import { resolveAnthropicMaxTokens } from './anthropic-max-tokens.mjs';
 import { MODELS } from './lib/anthropic-models.mjs';
@@ -56,6 +61,7 @@ import { ANTHROPIC_EFFORT_LEVELS, withEffortRejectionFallback } from './effort-r
 import { getLlmDispatcher, preconnect } from '../../../shared/llm/http-agent.mjs';
 import {
   anthropicThinkingActive,
+  appendAnthropicTailReminder,
   applyAnthropicCacheMarkers,
   clampAnthropicThinkingBudget as clampThinkingBudgetTokens,
   deferredAnthropicTools as sharedDeferredAnthropicTools,
@@ -67,6 +73,7 @@ import {
   toAnthropicMessages,
   toAnthropicToolChoice,
 } from './lib/anthropic-request-utils.mjs';
+import { splitTailReminder } from './lib/tail-reminder-split.mjs';
 import {
   EFFORT_CONFIGURATION_BETA,
   isEffortConfigurationRejection,
@@ -189,7 +196,8 @@ function requestAnthropicTools(tools, messages, opts) {
 // the tier3 1h cache_control to that block; BP1/BP2 take the system TTL. No
 // `<system-reminder>` user message / sentinel scan is involved anymore.
 
-function buildRequestBody(messages, model, tools, sendOpts) {
+function buildRequestBody(requestMessages, model, tools, sendOpts) {
+  const { messages, reminder } = splitTailReminder(requestMessages);
   const systemMsgs = messages.filter((m) => m.role === 'system');
   const chatMsgs = messages.filter((m) => m.role !== 'system');
   const opts = sendOpts || {};
@@ -229,7 +237,7 @@ function buildRequestBody(messages, model, tools, sendOpts) {
   const body = {
     model,
     max_tokens: maxTokens,
-    messages: anthropicMessages,
+    messages: appendAnthropicTailReminder(anthropicMessages, reminder),
     stream: true,
   };
   applyAnthropicServerFallback(body, model, {
@@ -463,6 +471,8 @@ export class AnthropicOAuthProvider {
     const useModel = model || (await ensureLatestAnthropicModel(this));
     const body = buildRequestBody(messages, useModel, tools, sendOpts);
     body.messages = await prepareAnthropicImages(body.messages, { signal: externalSignal });
+    // Diagnostic: per-block prefix hashes of exactly what is sent.
+    recordAnthropicPrefix(opts.sessionId || null, anthropicPrefixFingerprint(body));
     if (body.speed === 'fast') {
       this.fastModeBetaHeaderLatched = true;
     }
@@ -544,42 +554,15 @@ export class AnthropicOAuthProvider {
     let maxTokensAdjusted = false;
     try {
       for (let attemptIndex = 0; attemptIndex <= ANTHROPIC_MAX_MIDSTREAM_RETRIES; attemptIndex++) {
-        let response, controller, cancelHandler;
-        ({ response, controller, cancelHandler } = await requestWithRetry(auth.creds.accessToken));
-
-        // Refresh on 401, and only Anthropic's exact official revoked-token
-        // 403 signature. Ordinary permission/policy 403s are terminal.
-        let rejectedAuthBody = null;
-        if (response.status === 401 || response.status === 403) {
-          rejectedAuthBody = await response.text().catch(() => '');
-        }
-        if (isRefreshableAuthRejection(response.status, rejectedAuthBody)) {
-          process.stderr.write(`[anthropic-oauth] ${response.status} — forcing refresh and retrying once\n`);
-          cleanupCancelHandler(cancelHandler);
-          // Body was drained above; abort closes any remaining transport
-          // resources before the credential-refresh replay.
-          try {
-            controller?.abort?.();
-          } catch {}
-          auth.creds = await this.ensureAuth({ forceRefresh: true, reason: String(response.status) });
-          ({ response, controller, cancelHandler } = await requestWithRetry(auth.creds.accessToken));
-          rejectedAuthBody = null;
-        }
-
-        // "input length and max_tokens exceed context limit": shrink max_tokens
-        // to what the context has room for and replay once.
-        if (response.status === 400 && !maxTokensAdjusted) {
-          rejectedAuthBody = await response.text().catch(() => '');
-          if (adjustMaxTokensForContextOverflow(body, 400, rejectedAuthBody)) {
-            maxTokensAdjusted = true;
-            cleanupCancelHandler(cancelHandler);
-            try {
-              controller?.abort?.();
-            } catch {}
-            ({ response, controller, cancelHandler } = await requestWithRetry(auth.creds.accessToken));
-            rejectedAuthBody = null;
-          }
-        }
+        const opened = await this._openResponse({
+          requestWithRetry,
+          cleanupCancelHandler,
+          auth,
+          body,
+          maxTokensAdjusted,
+        });
+        const { response, controller, cancelHandler, rejectedAuthBody } = opened;
+        maxTokensAdjusted = opened.maxTokensAdjusted;
         if (!response.ok) {
           cleanupCancelHandler(cancelHandler);
           return await this._resendAfterRejection({
@@ -657,6 +640,51 @@ export class AnthropicOAuthProvider {
     }
   }
 
+  // One attempt's initial response: a 401 (or Anthropic's exact revoked-token
+  // 403) refreshes the credentials in `auth` and replays once; a context
+  // overflow 400 shrinks `body.max_tokens` and replays once per send
+  // (`maxTokensAdjusted`). `rejectedAuthBody`: the drained text of a final
+  // rejected response, null when none was read.
+  async _openResponse({ requestWithRetry, cleanupCancelHandler, auth, body, maxTokensAdjusted }) {
+    let response, controller, cancelHandler;
+    ({ response, controller, cancelHandler } = await requestWithRetry(auth.creds.accessToken));
+
+    // Refresh on 401, and only Anthropic's exact official revoked-token
+    // 403 signature. Ordinary permission/policy 403s are terminal.
+    let rejectedAuthBody = null;
+    if (response.status === 401 || response.status === 403) {
+      rejectedAuthBody = await response.text().catch(() => '');
+    }
+    if (isRefreshableAuthRejection(response.status, rejectedAuthBody)) {
+      process.stderr.write(`[anthropic-oauth] ${response.status} — forcing refresh and retrying once\n`);
+      cleanupCancelHandler(cancelHandler);
+      // Body was drained above; abort closes any remaining transport
+      // resources before the credential-refresh replay.
+      try {
+        controller?.abort?.();
+      } catch {}
+      auth.creds = await this.ensureAuth({ forceRefresh: true, reason: String(response.status) });
+      ({ response, controller, cancelHandler } = await requestWithRetry(auth.creds.accessToken));
+      rejectedAuthBody = null;
+    }
+
+    // "input length and max_tokens exceed context limit": shrink max_tokens
+    // to what the context has room for and replay once.
+    if (response.status === 400 && !maxTokensAdjusted) {
+      rejectedAuthBody = await response.text().catch(() => '');
+      if (adjustMaxTokensForContextOverflow(body, 400, rejectedAuthBody)) {
+        maxTokensAdjusted = true;
+        cleanupCancelHandler(cancelHandler);
+        try {
+          controller?.abort?.();
+        } catch {}
+        ({ response, controller, cancelHandler } = await requestWithRetry(auth.creds.accessToken));
+        rejectedAuthBody = null;
+      }
+    }
+    return { response, controller, cancelHandler, rejectedAuthBody, maxTokensAdjusted };
+  }
+
   // A non-OK initial response: quota errors surface as-is; a CLI-version
   // floor or an unknown/retired model replays the turn ONCE through send().
   async _resendAfterRejection({ response, rejectedAuthBody, messages, model, useModel, tools, opts, onStageChange }) {
@@ -780,6 +808,7 @@ export class AnthropicOAuthProvider {
       rawUsage: result.usage?.raw || null,
       provider: 'anthropic-oauth',
       requestKind,
+      prefixBlocks: latestAnthropicPrefix(sessionId),
     });
 
     // Phase I: if the live response surfaced a model id we don't know

package/src/runtime/agent/orchestrator/providers/anthropic-turn-result.mjs

@@ -11,6 +11,7 @@
  */
 import { traceAgentUsage } from '../agent-trace.mjs';
 import { reportedCostUsd } from './lib/usage-primitives.mjs';
+import { latestAnthropicPrefix } from './lib/anthropic-prefix-trace.mjs';
 
 /**
  * @param {object} parseResult  the assembled turn (streaming or normalized non-streaming)
@@ -47,6 +48,7 @@ export function buildAnthropicTurnResult(parseResult, { provider, useModel, opts
       // Anthropic usage is additive at this inner transport
       // boundary, even when OpenCode Go supplies the provider id.
       inputTokensInclusive: false,
+      prefixBlocks: latestAnthropicPrefix(opts.sessionId || opts.session?.id || null),
     });
   }
 

package/src/runtime/agent/orchestrator/providers/antigravity-oauth-catalog.mjs

@@ -187,9 +187,14 @@ export function normalizeAntigravityCatalog(rawModels) {
   return models.sort((a, b) => a.display.localeCompare(b.display));
 }
 
-/** Catalog to resolve wire ids against: in-memory mirror, disk cache, then the curated fallback. */
+/**
+ * Catalog to resolve wire ids against: in-memory mirror, disk cache, then the
+ * curated fallback. Sends never refresh the catalog, so the account's last live
+ * list is used even past its TTL: it names the wire ids this account was
+ * offered, which the curated list can only approximate.
+ */
 function antigravityCatalogModels() {
-  if (!_mirror) _mirror = antigravityModelCache.loadSync();
+  if (!_mirror) _mirror = antigravityModelCache.loadSync({ allowStale: true });
   return _mirror || ANTIGRAVITY_MODELS;
 }
 

package/src/runtime/agent/orchestrator/providers/antigravity-request.mjs

@@ -3,6 +3,7 @@ import { createProviderReplay, providerReplayItems } from './lib/provider-replay
 import { toGeminiContents, toGeminiRequestTools, toGeminiToolConfig } from './gemini-schema.mjs';
 import { geminiThinkingConfig } from './gemini-thinking.mjs';
 import { isGeminiFamilyModel } from './gemini-family.mjs';
+import { splitTailReminder } from './lib/tail-reminder-split.mjs';
 
 const THOUGHT_SIGNATURE_SENTINEL = 'skip_thought_signature_validator';
 const CLAUDE_MAX_OUTPUT_TOKENS = 64000;
@@ -219,7 +220,10 @@ function antigravityGeminiThinkingConfig(model, opts) {
   });
 }
 
-export function buildAntigravityRequest(messages, model, tools, opts = {}, projectId) {
+export function buildAntigravityRequest(requestMessages, model, tools, opts = {}, projectId) {
+  // The tail reminder is not history: the tool-loop closure below must see the
+  // real tail, so the reminder is appended to the wire contents last.
+  const { messages, reminder } = splitTailReminder(requestMessages);
   const systemText = messages
     .filter((message) => message.role === 'system')
     .map((message) => message.content)
@@ -234,7 +238,7 @@ export function buildAntigravityRequest(messages, model, tools, opts = {}, proje
     ...(claude ? { maxOutputTokens: CLAUDE_MAX_OUTPUT_TOKENS } : {}),
     ...(thinkingConfig ? { thinkingConfig } : {}),
   };
-  const request = { contents };
+  const request = { contents: reminder ? [...contents, { role: 'user', parts: [{ text: reminder }] }] : contents };
   if (systemText) request.systemInstruction = { role: 'user', parts: [{ text: systemText }] };
   const requestTools = claude
     ? claudeRequestTools(tools, opts.nativeTools, opts.onToolExcluded)

package/src/runtime/agent/orchestrator/providers/auto-effort.mjs

@@ -3,24 +3,43 @@
 // Every turn starts again from the base, so a run of hard turns never
 // ratchets the effort upward.
 //
-// The base is `medium` on every model: raised only when the request needs it,
-// lowered when it is easy. The ladder is the model's supported efforts from
+// The base is the global "Auto reasoning base" setting (`autoEffortBase` in the
+// agent config; low / medium / high, default `medium`), the same on every model
+// and independent of the effort last chosen: raised only when the request needs
+// it, lowered when it is easy. The ladder is the model's supported efforts from
 // `low` up to the tier below the top: `none`/`minimal` switch thinking off and
-// `max`/`ultra` are reserved for an explicit user choice, so auto never picks
-// them. A chosen `max`/`ultra` is left untouched.
+// `max`/`ultra` are reserved for an explicit (fixed, Auto off) user choice, so
+// auto never picks them. A base the model does not offer is clamped to the
+// nearest ladder level.
 
 const EFFORT_ORDER = Object.freeze(['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max', 'ultra']);
 const FLOOR_INDEX = EFFORT_ORDER.indexOf('low');
 const RESERVED_TOP = new Set(['max', 'ultra']);
 
 export const AUTO_EFFORT_BASE = 'medium';
+/** The "Auto reasoning base" choices: the levels Auto can work around. */
+export const AUTO_EFFORT_BASES = Object.freeze(['low', 'medium', 'high']);
 
-/** The effort auto moves from: `medium`, unless the user chose `max`/`ultra`. */
-export function autoEffortBase(chosen) {
-  const effort = String(chosen ?? '')
+/** The effort auto moves from: the global "Auto reasoning base" setting
+ *  (`autoEffortBase` in the agent config); absent or invalid is `medium`. */
+export function autoEffortBase(setting) {
+  const effort = String(setting ?? '')
     .trim()
     .toLowerCase();
-  return RESERVED_TOP.has(effort) ? effort : AUTO_EFFORT_BASE;
+  return AUTO_EFFORT_BASES.includes(effort) ? effort : AUTO_EFFORT_BASE;
+}
+
+/** The base on the model's ladder: the setting itself, else the nearest
+ *  ladder level (the lower one on a tie); null when the ladder is empty. */
+export function clampAutoEffortBase({ base, options }) {
+  const ladder = autoEffortLadder(options);
+  if (!ladder.length) return null;
+  const want = EFFORT_ORDER.indexOf(autoEffortBase(base));
+  let best = ladder[0];
+  for (const level of ladder) {
+    if (Math.abs(EFFORT_ORDER.indexOf(level) - want) < Math.abs(EFFORT_ORDER.indexOf(best) - want)) best = level;
+  }
+  return best;
 }
 
 export const AUTO_EFFORT_MODES = Object.freeze(['off', 'observe', 'on']);
@@ -31,14 +50,14 @@ export const AUTO_EFFORT_LEVELS = Object.freeze(['easy', 'normal', 'hard', 'very
 const STEP_OF_LEVEL = [-1, 0, 1, 2];
 
 // The chosen level minimises the expected cost under the judge distribution.
-// A miss costs one per level, plus extra for an opposite call and for a
-// needless "very hard" (xhigh). Opposite calls are asymmetric: "easy" for a
-// hard turn degrades the answer, "hard" for an easy turn only costs tokens.
-// On the held-out test splits the heavier under-call cost cut hard-as-easy
-// calls by a third (20 -> 13 of 7,180) for -0.2 points of exact accuracy.
+// A miss costs one per level, plus extra for an opposite call. Opposite calls
+// are asymmetric: "easy" for a hard turn degrades the answer, "hard" for an
+// easy turn only costs tokens. On the held-out test splits the heavier
+// under-call cost cut hard-as-easy calls by a third (20 -> 13 of 7,180) for
+// -0.2 points of exact accuracy. "Very hard" carries no extra cost: an extra
+// penalty there let judge v7 pick xhigh on only 17% of very hard turns.
 export const AUTO_EFFORT_UNDER_OPPOSITE_COST = 3;
 export const AUTO_EFFORT_OVER_OPPOSITE_COST = 1;
-export const AUTO_EFFORT_FALSE_VERY_HARD_COST = 1;
 // Ties keep the default first, then the cheaper side.
 const TIE_ORDER = [1, 0, 2, 3];
 
@@ -49,8 +68,7 @@ function expectedCost(values, level) {
       p *
       (Math.abs(level - actual) +
         (level === 0 && actual >= 2 ? AUTO_EFFORT_UNDER_OPPOSITE_COST : 0) +
-        (actual === 0 && level >= 2 ? AUTO_EFFORT_OVER_OPPOSITE_COST : 0) +
-        (level === 3 && actual < 3 ? AUTO_EFFORT_FALSE_VERY_HARD_COST : 0));
+        (actual === 0 && level >= 2 ? AUTO_EFFORT_OVER_OPPOSITE_COST : 0));
   });
   return cost;
 }

package/src/runtime/agent/orchestrator/providers/cursor-wire.mjs

@@ -40,8 +40,10 @@ import {
   textContent,
 } from './cursor-wire-request.mjs';
 import { handleExecMessage, heartbeatFrame, sendToolResult } from './cursor-wire-exec.mjs';
+import { releaseCursorNativeCall } from './cursor-native-context.mjs';
 import { completionChunk, createStreamSink } from './cursor-wire-stream-sink.mjs';
 import { createBridgeController } from './cursor-wire-stream-bridge.mjs';
+import { markProviderRecoveryExhausted } from './retry-classifier.mjs';
 import { TRANSPORT_SCOPE_DISPOSED } from './transport-scope.mjs';
 
 export { clearModelCache, getCursorModels, getCursorUsage } from './cursor-wire-models.mjs';
@@ -70,16 +72,22 @@ function storeActiveRun(key, active) {
   activeRuns.set(key, active);
 }
 
-// Tear down one stored run: drop it from the registry, stop its 5s heartbeat
-// interval, and close the Cursor bridge it was holding open.
-function closeActiveRun(key, active, error) {
-  if (!forgetActiveRun(key, active)) return false;
+function disposeActiveRun(active, error) {
   clearInterval(active.heartbeat);
+  for (const pending of active.pending) releaseCursorNativeCall(pending);
+  active.pending = [];
   try {
     active.bridge.close(error);
   } catch {
     /* already closing */
   }
+}
+
+// Tear down one stored run: drop it from the registry, stop its 5s heartbeat
+// interval, and close the Cursor bridge it was holding open.
+function closeActiveRun(key, active, error) {
+  if (!forgetActiveRun(key, active)) return false;
+  disposeActiveRun(active, error);
   return true;
 }
 
@@ -458,6 +466,25 @@ function resumeRun(active, toolResults, userText, model, key) {
     }
     sendToolResult(active.bridge, pending, payload, result.isError !== true);
   }
+  // Every pending call was already handed to the executor. Re-emitting the
+  // same batch without accepting a result makes the transcript rename its
+  // ids, breaks native authorization, and can loop without another model call.
+  // Partial progress is valid; an unchanged pending batch is a terminal
+  // handoff failure, not a transport retry or an invitation to execute again.
+  if (remaining.length > 0 && remaining.length === active.pending.length) {
+    const error = markProviderRecoveryExhausted(
+      cursorError(
+        `Cursor tool-result handoff made no progress: ${remaining.length} pending call(s) received no matching result. Stopped to avoid repeating tool execution.`,
+        { status: 400, code: 'tool_result_no_progress' }
+      ),
+      { owner: 'cursor-wire', terminal: true }
+    );
+    // handleChatCompletion already detached this run; direct partial-batch
+    // resumes may still own its registry entry and expiry timer.
+    forgetActiveRun(key, active);
+    disposeActiveRun(active, error);
+    throw error;
+  }
   active.pending = remaining;
   active.pendingUserText = userTextDelivered ? '' : pendingUserText;
   if (remaining.length > 0) {

package/src/runtime/agent/orchestrator/providers/cursor.mjs

@@ -35,7 +35,10 @@ async function loadCursorRuntime() {
 function toCursorMessages(messages, providerName, { nativePdf } = {}) {
   const output = [];
   for (const message of messages || []) {
-    const converted = toOpenAIMessages([message], providerName, { nativePdf });
+    // This is a local envelope over Cursor's execution protocol, not an
+    // OpenAI request. Its pending executions and native capabilities require
+    // the exact original id, including ids longer than OpenAI's 40-char cap.
+    const converted = toOpenAIMessages([message], providerName, { nativePdf, preserveToolCallIds: true });
     if (message?.role !== 'tool') {
       output.push(...converted);
       continue;

package/src/runtime/agent/orchestrator/providers/custom-provider.mjs

@@ -40,6 +40,7 @@ function sanitizeDiscoveryError(error, apiKey) {
   if (apiKey) message = message.split(apiKey).join('[redacted]');
   const out = new Error(message);
   if (Number.isInteger(error?.status)) out.status = error.status;
+  if (error?.code === 'EPROVIDERTIMEOUT' || error?.name === 'TimeoutError') out.code = 'EPROVIDERTIMEOUT';
   return out;
 }
 
@@ -82,11 +83,13 @@ function withCustomModels(Base, discover) {
       const first = rows.find((row) => !row.hidden);
       if (first) this.defaultModel = first.id;
     }
-    async listModels({ signal = null, throwOnError = false } = {}) {
+    // `timeoutMs` lets an interactive caller wait longer than the default
+    // catalog timeout (slow gateways); the runtime refresh keeps the default.
+    async listModels({ signal = null, throwOnError = false, timeoutMs } = {}) {
       let failure = null;
       try {
         this._assertCustomKey();
-        this._customDiscovered = await discover(this, signal);
+        this._customDiscovered = await discover(this, signal, timeoutMs);
         this.customDiscoveryError = null;
       } catch (error) {
         if (signal?.aborted) throw error;
@@ -109,8 +112,8 @@ function withCustomModels(Base, discover) {
   };
 }
 
-async function discoverAnthropicModels(provider, signal) {
-  const timeout = AbortSignal.timeout(DISCOVERY_TIMEOUT_MS);
+async function discoverAnthropicModels(provider, signal, timeoutMs = DISCOVERY_TIMEOUT_MS) {
+  const timeout = AbortSignal.timeout(timeoutMs);
   const res = await fetch(`${provider.config.baseURL}/v1/models`, {
     method: 'GET',
     signal: signal ? AbortSignal.any([signal, timeout]) : timeout,
@@ -182,8 +185,8 @@ export async function createCustomProvider(id, config) {
     }
     class CompatBase extends OpenAICompatProvider {
       messagesEngine = messagesEngine;
-      _fetchModelItems({ signal = null } = {}) {
-        return fetchCompatModelItems(this, { signal, keyless: this._customKeyless });
+      _fetchModelItems({ signal = null, timeoutMs } = {}) {
+        return fetchCompatModelItems(this, { signal, timeoutMs, keyless: this._customKeyless });
       }
       resolveWireRoute(model, ctx = {}) {
         return resolveWireRoute(this.name, model, { ...ctx, override: cfg.modelWires?.[model] ?? null });
@@ -203,8 +206,8 @@ export async function createCustomProvider(id, config) {
         });
       }
     }
-    const Custom = withCustomModels(CompatBase, (self, signal) =>
-      listCompatModels(self, { throwOnError: true, signal })
+    const Custom = withCustomModels(CompatBase, (self, signal, timeoutMs) =>
+      listCompatModels(self, { throwOnError: true, signal, timeoutMs })
     );
     provider = new Custom(providerId, engine);
   }