mixdog 1.3.1 → 1.3.2

package/src/runtime/agent/orchestrator/mcp/agent-connectors.mjs

@@ -2,6 +2,7 @@
 // or a project may use. Every installed connector is on by default for every
 // agent and project, existing and future ones; a policy only switches some off:
 //   agents/<id>/agent.json   connectors: { off: [serverId…], tools?: { [serverId]: { [tool]: permission } } }
+//                            (bots/<id>/ for a store bot; Mixy — runtime id `lead` — in her identity folder)
 //   <data>/project-connectors.json   { projects: { [projectRoot]: { off: [serverId…] } } }
 // `tools` keeps per-tool overrides (auto | needs_approval | disabled); a tool
 // without one is auto, except a catalog connector's high-risk tools, which
@@ -12,11 +13,16 @@
 // connected tool, so the schema and the BP2 manifest stay shared.
 import { readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
+import { holdsNoData, parseJsonText, readJsonStateSync } from '../../../shared/atomic-file.mjs';
+
+const NO_DATA = new Error('the file holds no data');
 import { cwdWithinProjects } from '../../../shared/extension-scopes.mjs';
 import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
-import { userDefinitionDir } from '../../../shared/agent-store.mjs';
+import { mixyIdentityDir, userDefinitionDir } from '../../../shared/agent-store.mjs';
 import { isSelfMcpToolName, parseMcpToolName } from '../../../shared/tool-primitives.mjs';
 import { connectorToolDefault } from '../../../shared/connector-catalog.mjs';
+import { MIXY_AGENT_ID } from '../session/agent-home.mjs';
+import { AGENT_MODE, sessionModeOf } from '../session/agent-mode.mjs';
 import { serverConnector } from './server-connectors.mjs';
 
 export const CONNECTOR_PERMISSIONS = Object.freeze(['auto', 'needs_approval', 'disabled']);
@@ -127,9 +133,25 @@ function readJson(path, parse) {
     return error?.code === 'ENOENT' || error?.code === 'ENOTDIR' ? null : unreadable(path, error);
   }
   try {
-    return parse(JSON.parse(text));
+    if (holdsNoData(text)) throw NO_DATA;
+    return parse(parseJsonText(text));
   } catch (error) {
-    return unreadable(path, error);
+    return recoverDamaged(path, parse, error);
+  }
+}
+
+// A damaged policy (empty, NUL-filled, torn, invalid) must never fail open.
+// With a valid last good copy `<file>.bak` the damaged file is kept aside and
+// the copy restored, so the user's deny list survives. Without one the file
+// stays where it is (`keepWithoutBackup`) and every connector stays off until
+// the policy is saved again — moving it aside would make the next read "no
+// policy" (all on). A busy recovery lock also answers deny-all.
+function recoverDamaged(path, parse, error) {
+  try {
+    const value = readJsonStateSync(path, { validate: parse, fallback: DENY_ALL_CONNECTORS, keepWithoutBackup: true });
+    return value === DENY_ALL_CONNECTORS ? unreadable(path, error) : value;
+  } catch (recoveryError) {
+    return unreadable(path, recoveryError);
   }
 }
 
@@ -146,11 +168,22 @@ export function readConnectorsFile(path) {
   return readJson(path, (manifest) => parseConnectorPolicy(manifest?.connectors));
 }
 
-/** The agent's saved policy under `dataDir`, or null when it has none. */
+/** The agent's saved policy under `dataDir`, or null when it has none. Mixy's
+ *  runtime id is `lead`: her policy is in her identity folder (bots/mixy once
+ *  the bot store is active, agents/lead before), the file her profile writes. */
 export function agentConnectors(agentId, dataDir = resolvePluginData()) {
   const id = clean(agentId);
   if (!id || !AGENT_DIR_ID.test(id)) return null;
-  return cachedRead(join(userDefinitionDir(dataDir, id), 'agent.json'), readConnectorsFile);
+  const dir = id === MIXY_AGENT_ID ? mixyIdentityDir(dataDir) : userDefinitionDir(dataDir, id);
+  return cachedRead(join(dir, 'agent.json'), readConnectorsFile);
+}
+
+/** The agent whose connector policy `session` runs under. A coding Lead shares
+ *  Mixy's runtime id `lead` but is not her: the policy her profile edits is
+ *  hers alone, so a coding Lead has none ('') and only its Project's applies. */
+export function connectorPolicyAgentOf(session) {
+  const agent = clean(session?.agent);
+  return agent === MIXY_AGENT_ID && sessionModeOf(session) !== AGENT_MODE ? '' : agent;
 }
 
 /** Uncached: the project policy file → `[{ root, off }]`, null without one,
@@ -186,6 +219,65 @@ export function connectorToolPermission(policy, toolOrName) {
   return policy?.tools?.[mcp.server]?.[mcp.tool] || connectorToolDefault(serverConnector(mcp.server), mcp.tool);
 }
 
+const PERMISSION_RANK = Object.freeze({ disabled: 0, needs_approval: 1, auto: 2 });
+export const NO_WIDEN_MESSAGE = 'This change would widen what the bot may do without asking; make it on the desktop.';
+
+/** Whether replacing the stored policy `before` (a stored value, a parsed
+ *  policy or null) with `after` (`{ off, tools }` or null) could give any
+ *  tool more authority, judged on EFFECTIVE permissions: a connector switched
+ *  back on, a tool allowed, or an override removed (the tool then runs on its
+ *  default, which is `needs_approval` for a catalog connector's high-risk
+ *  tools and `auto` otherwise). A legacy allow list or an unreadable policy is
+ *  not compared: it counts as widening. */
+export function connectorPolicyWidens(before, after) {
+  let old;
+  try {
+    old = before == null ? { off: [], tools: {} } : parseConnectorPolicy(before);
+  } catch {
+    return true;
+  }
+  if (old.allow) return true;
+  const next = after == null ? { off: [], tools: {} } : after;
+  const offBefore = new Set(old.off);
+  const offAfter = new Set(next.off || []);
+  for (const server of offBefore) if (!offAfter.has(server)) return true;
+  const toolsBefore = old.tools || {};
+  const toolsAfter = next.tools || {};
+  for (const server of new Set([...Object.keys(toolsBefore), ...Object.keys(toolsAfter)])) {
+    const tools = new Set([...Object.keys(toolsBefore[server] || {}), ...Object.keys(toolsAfter[server] || {})]);
+    for (const tool of tools) {
+      // No override: at least asks / at most runs freely.
+      const was = offBefore.has(server) ? 0 : (PERMISSION_RANK[toolsBefore[server]?.[tool]] ?? 1);
+      const now = offAfter.has(server) ? 0 : (PERMISSION_RANK[toolsAfter[server]?.[tool]] ?? 2);
+      if (now > was) return true;
+    }
+  }
+  return false;
+}
+
+/** Throws NO_WIDEN_MESSAGE when `after` could widen `before` (see connectorPolicyWidens). */
+export function assertConnectorPolicyNotWidened(before, after) {
+  if (connectorPolicyWidens(before, after)) throw new Error(NO_WIDEN_MESSAGE);
+}
+
+let toolPermissionWriter = null;
+/** The host attaches the one writer of an agent's per-tool permission (the
+ *  agent editor keeps every other agent.json key). */
+export function setConnectorToolPermissionWriter(write) {
+  toolPermissionWriter = typeof write === 'function' ? write : null;
+}
+
+/** Save `permission` for the connector tool `toolOrName` under `agentId`'s own
+ *  policy. False when it is no connector tool or no writer is attached. */
+export async function writeAgentMcpToolPermission(agentId, toolOrName, permission) {
+  const mcp = parseMcpToolName(toolOrName);
+  if (!toolPermissionWriter || !mcp || isSelfMcpToolName(toolOrName) || !CONNECTOR_PERMISSIONS.includes(permission)) {
+    return false;
+  }
+  await toolPermissionWriter(agentId, mcp.server, mcp.tool, permission);
+  return true;
+}
+
 /** The permission `agentId` has for the MCP tool `toolOrName`. */
 export function agentMcpToolPermission(agentId, toolOrName) {
   if (!parseMcpToolName(toolOrName)) return 'auto';

package/src/runtime/agent/orchestrator/mcp/child-tree.mjs

@@ -117,14 +117,11 @@ async function enumerate({ strict = false } = {}) {
  *  names and (POSIX) process groups. Rejects instead of returning a partial
  *  table, so callers can tell "nothing found" from "could not look".
  *
- *  `shared: true` (pre-kill captures) joins a read already in flight, so many
- *  jobs promoted together do not each spawn an enumerator; a capture taken
- *  while its root runs is valid whenever that read began. An observation after
- *  a kill or exit must see a table taken AFTER it asked: a read that began
- *  before the kill would report the killed tree alive and defer the
- *  confirmation by a whole re-check. Such a caller starts a read when none
- *  runs, else joins the one queued to begin when the running read settles —
- *  every observer asking meanwhile shares it. At most one enumerator runs at
+ *  Every caller sees a table from a read begun after it asked: an earlier
+ *  read may miss newly spawned descendants before a kill, or report a killed
+ *  tree alive afterwards. A caller starts a read when none runs, else joins
+ *  the one queued to begin when the running read settles — every caller
+ *  asking meanwhile shares it. At most one enumerator runs at
  *  a time, however many shells settle or watch at once (each one is a
  *  PowerShell process on Windows; one per settle and watch pass compounded
  *  machine load into multi-second daemon stalls). */
@@ -137,8 +134,7 @@ function startTableRead() {
   tableInFlight = read;
   return read;
 }
-export function readProcessTable({ shared = false } = {}) {
-  if (shared && tableInFlight) return tableInFlight;
+export function readProcessTable() {
   if (nextTable) return nextTable;
   if (!tableInFlight) return startTableRead();
   const settled = () => {};

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -1,5 +1,6 @@
 import { setMaxListeners } from 'node:events';
-import { mkdirSync, writeFileSync } from 'node:fs';
+import { mkdirSync } from 'node:fs';
+import { writeFileAtomicSync } from '../../../shared/atomic-file.mjs';
 import { writeFile } from 'node:fs/promises';
 import {
   MAX_ATTACHMENT_BLOB_BYTES,
@@ -772,9 +773,11 @@ function spillMcpBinary(buffer, extension) {
   const path = join(dir, `mcp-${hash}.${extension}`);
   try {
     mkdirSync(dir, { recursive: true });
-    writeFileSync(path, buffer, { flag: 'wx' });
-  } catch (err) {
-    if (err?.code !== 'EEXIST') return null;
+    // Named by its content hash: whole-file create-if-absent (a crash never
+    // leaves a torn file under the name that would be trusted as the content).
+    writeFileAtomicSync(path, buffer, { createOnly: true });
+  } catch {
+    return null;
   }
   return path;
 }

package/src/runtime/agent/orchestrator/providers/anthropic-api-request.mjs

@@ -10,6 +10,7 @@
  * anthropic-turn-result.mjs); nothing here touches the socket.
  */
 import { prepareAnthropicImages } from './lib/anthropic-image-input.mjs';
+import { anthropicPrefixFingerprint, recordAnthropicPrefix } from './lib/anthropic-prefix-trace.mjs';
 import { buildAnthropicBetaHeaders, supportsAnthropicFastMode } from './anthropic-betas.mjs';
 import { applyAnthropicServerFallback } from './anthropic-server-fallback.mjs';
 import { fastModeAvailable } from './anthropic-fast-mode.mjs';
@@ -17,6 +18,7 @@ import { applyAnthropicEffortToBody, shouldIncludeEffortBeta } from './anthropic
 import { isCustomProviderName, resolveCustomReasoning } from './custom-reasoning.mjs';
 import {
   anthropicThinkingActive,
+  appendAnthropicTailReminder,
   applyAnthropicCacheMarkers,
   clampAnthropicThinkingBudget as clampThinkingBudgetTokens,
   resolveAnthropicCacheTtls as resolveCacheTtls,
@@ -24,6 +26,7 @@ import {
   sharedCachePrefixBoundary,
   toAnthropicToolChoice,
 } from './lib/anthropic-request-utils.mjs';
+import { splitTailReminder } from './lib/tail-reminder-split.mjs';
 import {
   buildSystemBlocks,
   resolveMaxTokens,
@@ -50,7 +53,7 @@ import {
 export async function buildAnthropicApiRequest({
   name,
   config,
-  messages,
+  messages: requestMessages,
   useModel,
   tools,
   opts,
@@ -67,6 +70,7 @@ export async function buildAnthropicApiRequest({
   // the global by-model-id capability index and the Claude-id ladders are
   // first-party knowledge and must not leak onto (or from) a custom endpoint.
   const isCustom = isCustomProviderName(name);
+  const { messages, reminder } = splitTailReminder(requestMessages);
   const maxTokens = resolveMaxTokens(capabilityModel, { modelMaxOutputTokens });
   const effortOptions = { ...config, ...opts, disableBetaHeaders: config?.disableBetaHeaders };
   const gatewayEffort = typeof config?.messagesEffort === 'function' ? config.messagesEffort(opts) : null;
@@ -108,7 +112,9 @@ export async function buildAnthropicApiRequest({
     model: useModel,
     max_tokens: maxTokens,
     system: systemBlocks.length ? systemBlocks : undefined,
-    messages: await prepareAnthropicImages(anthropicMessages, { signal: opts.signal }),
+    messages: await prepareAnthropicImages(appendAnthropicTailReminder(anthropicMessages, reminder), {
+      signal: opts.signal,
+    }),
   };
   // Server-side fallback and fast mode are decided from Claude model ids:
   // first-party knowledge, never applied to a custom endpoint.
@@ -135,6 +141,55 @@ export async function buildAnthropicApiRequest({
       .map((t) => (t && typeof t.name === 'string' ? t.name : null))
       .filter(Boolean)
   );
+  applyRequestReasoning(params, {
+    isCustom,
+    name,
+    config,
+    opts,
+    modelInfo,
+    capabilityModel,
+    maxTokens,
+    gatewayEffort,
+    effortProjection,
+  });
+  if (params.tools) resolveRequestToolChoice(params, opts, config);
+  // Fast mode → speed: "fast" on models Anthropic marks as speed-capable.
+  // Suppressed while the fast capacity pool is cooling down.
+  let fastLatched = fastModeLatched;
+  if (!isCustom && opts.fast === true && supportsAnthropicFastMode(useModel) && fastModeAvailable()) {
+    params.speed = 'fast';
+    fastLatched = true;
+  }
+  // NOTE: do NOT sanitize here. params.messages was already sanitized
+  // once inside toAnthropicMessages and then had cache markers applied.
+  // Re-sanitizing after marking could drop/reorder a marked block and
+  // move the provider-visible cache breakpoint off the cached one — the
+  // exact COLD-turn bug this change fixes. Order: build → sanitize
+  // (once) → mark → prepare image bytes → send.
+  params.stream = true;
+  // Diagnostic: per-block prefix hashes of exactly what is sent.
+  recordAnthropicPrefix(opts.sessionId || opts.session?.id || null, anthropicPrefixFingerprint(params));
+
+  const requestHeaders = requestHeadersFor(params, {
+    config,
+    opts,
+    isCustom,
+    fastLatched,
+    hasDeferredTools,
+    capabilityModel,
+    effortProjection,
+  });
+
+  return { params, requestHeaders, knownToolNames, fastModeLatched: fastLatched };
+}
+
+/** The turn's thinking/effort fields on `params` (in place): a custom
+ *  provider's from its own model row, else the turn effort (or a gateway's
+ *  own `messagesEffort`; 'none' sends no thinking at all). */
+function applyRequestReasoning(
+  params,
+  { isCustom, name, config, opts, modelInfo, capabilityModel, maxTokens, gatewayEffort, effortProjection }
+) {
   if (isCustom) {
     const { fields } = resolveCustomReasoning({
       protocol: 'anthropic',
@@ -156,32 +211,29 @@ export async function buildAnthropicApiRequest({
       progressUpdates: config?.disableBetaHeaders !== true,
     });
   }
-  if (params.tools) {
-    const toolChoice = toAnthropicToolChoice(opts.toolChoice, {
-      thinking: anthropicThinkingActive(params),
-      disableParallelToolUse: opts.disableParallelToolUse === true,
-      // A gateway that cannot honour disable_parallel_tool_use declares so.
-      supportsDisableParallelToolUse: config?.supportsDisableParallelToolUse !== false,
-      onThinkingConflict: opts.toolChoiceThinkingConflict,
-    });
-    if (toolChoice) params.tool_choice = toolChoice;
-    else delete params.tool_choice;
-  }
-  // Fast mode → speed: "fast" on models Anthropic marks as speed-capable.
-  // Suppressed while the fast capacity pool is cooling down.
-  let fastLatched = fastModeLatched;
-  if (!isCustom && opts.fast === true && supportsAnthropicFastMode(useModel) && fastModeAvailable()) {
-    params.speed = 'fast';
-    fastLatched = true;
-  }
-  // NOTE: do NOT sanitize here. params.messages was already sanitized
-  // once inside toAnthropicMessages and then had cache markers applied.
-  // Re-sanitizing after marking could drop/reorder a marked block and
-  // move the provider-visible cache breakpoint off the cached one — the
-  // exact COLD-turn bug this change fixes. Order: build → sanitize
-  // (once) → mark → prepare image bytes → send.
-  params.stream = true;
+}
 
+/** The reserved `tool_choice` of a request with tools, resolved once
+ *  thinking is known (forced any/tool is invalid while thinking is on);
+ *  dropped when none applies. */
+function resolveRequestToolChoice(params, opts, config) {
+  const toolChoice = toAnthropicToolChoice(opts.toolChoice, {
+    thinking: anthropicThinkingActive(params),
+    disableParallelToolUse: opts.disableParallelToolUse === true,
+    // A gateway that cannot honour disable_parallel_tool_use declares so.
+    supportsDisableParallelToolUse: config?.supportsDisableParallelToolUse !== false,
+    onThinkingConflict: opts.toolChoiceThinkingConflict,
+  });
+  if (toolChoice) params.tool_choice = toolChoice;
+  else delete params.tool_choice;
+}
+
+/** The per-request headers of the final body `params`: the anthropic-beta
+ *  set it needs, then the caller's `opts.requestHeaders`; null when none. */
+function requestHeadersFor(
+  params,
+  { config, opts, isCustom, fastLatched, hasDeferredTools, capabilityModel, effortProjection }
+) {
   // Per-call headers override the client defaultHeaders, so the
   // constructor-level disableBetaHeaders opt-out must be honoured here
   // too — otherwise opencode-go's anthropic-compatible routing
@@ -205,8 +257,5 @@ export async function buildAnthropicApiRequest({
     ].filter(Boolean);
     if (betas.length) betaHeaders = { 'anthropic-beta': betas.join(',') };
   }
-  const requestHeaders =
-    betaHeaders || opts.requestHeaders ? { ...(betaHeaders || {}), ...(opts.requestHeaders || {}) } : null;
-
-  return { params, requestHeaders, knownToolNames, fastModeLatched: fastLatched };
+  return betaHeaders || opts.requestHeaders ? { ...(betaHeaders || {}), ...(opts.requestHeaders || {}) } : null;
 }

package/src/runtime/agent/orchestrator/providers/anthropic-model-resolve.mjs

@@ -149,7 +149,7 @@ function _markLatestByFamily(models) {
   for (const m of byFamily.values()) m.latest = true;
 }
 
-function _compareVersion(a, b) {
+export function _compareVersion(a, b) {
   const na = (a.match(/^claude-[a-z]+-(\d+)(?:-(\d+))?/i) || []).slice(1).map(Number);
   const nb = (b.match(/^claude-[a-z]+-(\d+)(?:-(\d+))?/i) || []).slice(1).map(Number);
   for (let i = 0; i < Math.max(na.length, nb.length); i++) {

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-client-version.mjs

@@ -10,7 +10,7 @@ import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
 // source release just to advance the user-agent version.
 // Claude Opus 5.5 requires 2.1.280 or newer. The release workflow raises this
 // to the published CLI version (scripts/sync-client-version-floors.mjs).
-export const DEFAULT_CLI_VERSION = '2.1.304';
+export const DEFAULT_CLI_VERSION = '2.1.307';
 export const CLAUDE_CLI_NPM_PACKAGE = '@anthropic-ai/claude-code';
 
 const CACHE_SCHEMA_VERSION = 1;

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -6,6 +6,11 @@
  * from anthropic.mjs. agent-trace instrumented.
  */
 import { traceAgentSse, traceAgentUsage } from '../agent-trace.mjs';
+import {
+  anthropicPrefixFingerprint,
+  latestAnthropicPrefix,
+  recordAnthropicPrefix,
+} from './lib/anthropic-prefix-trace.mjs';
 import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
 import { resolveAnthropicMaxTokens } from './anthropic-max-tokens.mjs';
 import { MODELS } from './lib/anthropic-models.mjs';
@@ -56,6 +61,7 @@ import { ANTHROPIC_EFFORT_LEVELS, withEffortRejectionFallback } from './effort-r
 import { getLlmDispatcher, preconnect } from '../../../shared/llm/http-agent.mjs';
 import {
   anthropicThinkingActive,
+  appendAnthropicTailReminder,
   applyAnthropicCacheMarkers,
   clampAnthropicThinkingBudget as clampThinkingBudgetTokens,
   deferredAnthropicTools as sharedDeferredAnthropicTools,
@@ -67,6 +73,7 @@ import {
   toAnthropicMessages,
   toAnthropicToolChoice,
 } from './lib/anthropic-request-utils.mjs';
+import { splitTailReminder } from './lib/tail-reminder-split.mjs';
 import {
   EFFORT_CONFIGURATION_BETA,
   isEffortConfigurationRejection,
@@ -189,7 +196,8 @@ function requestAnthropicTools(tools, messages, opts) {
 // the tier3 1h cache_control to that block; BP1/BP2 take the system TTL. No
 // `<system-reminder>` user message / sentinel scan is involved anymore.
 
-function buildRequestBody(messages, model, tools, sendOpts) {
+function buildRequestBody(requestMessages, model, tools, sendOpts) {
+  const { messages, reminder } = splitTailReminder(requestMessages);
   const systemMsgs = messages.filter((m) => m.role === 'system');
   const chatMsgs = messages.filter((m) => m.role !== 'system');
   const opts = sendOpts || {};
@@ -229,7 +237,7 @@ function buildRequestBody(messages, model, tools, sendOpts) {
   const body = {
     model,
     max_tokens: maxTokens,
-    messages: anthropicMessages,
+    messages: appendAnthropicTailReminder(anthropicMessages, reminder),
     stream: true,
   };
   applyAnthropicServerFallback(body, model, {
@@ -463,6 +471,8 @@ export class AnthropicOAuthProvider {
     const useModel = model || (await ensureLatestAnthropicModel(this));
     const body = buildRequestBody(messages, useModel, tools, sendOpts);
     body.messages = await prepareAnthropicImages(body.messages, { signal: externalSignal });
+    // Diagnostic: per-block prefix hashes of exactly what is sent.
+    recordAnthropicPrefix(opts.sessionId || null, anthropicPrefixFingerprint(body));
     if (body.speed === 'fast') {
       this.fastModeBetaHeaderLatched = true;
     }
@@ -544,42 +554,15 @@ export class AnthropicOAuthProvider {
     let maxTokensAdjusted = false;
     try {
       for (let attemptIndex = 0; attemptIndex <= ANTHROPIC_MAX_MIDSTREAM_RETRIES; attemptIndex++) {
-        let response, controller, cancelHandler;
-        ({ response, controller, cancelHandler } = await requestWithRetry(auth.creds.accessToken));
-
-        // Refresh on 401, and only Anthropic's exact official revoked-token
-        // 403 signature. Ordinary permission/policy 403s are terminal.
-        let rejectedAuthBody = null;
-        if (response.status === 401 || response.status === 403) {
-          rejectedAuthBody = await response.text().catch(() => '');
-        }
-        if (isRefreshableAuthRejection(response.status, rejectedAuthBody)) {
-          process.stderr.write(`[anthropic-oauth] ${response.status} — forcing refresh and retrying once\n`);
-          cleanupCancelHandler(cancelHandler);
-          // Body was drained above; abort closes any remaining transport
-          // resources before the credential-refresh replay.
-          try {
-            controller?.abort?.();
-          } catch {}
-          auth.creds = await this.ensureAuth({ forceRefresh: true, reason: String(response.status) });
-          ({ response, controller, cancelHandler } = await requestWithRetry(auth.creds.accessToken));
-          rejectedAuthBody = null;
-        }
-
-        // "input length and max_tokens exceed context limit": shrink max_tokens
-        // to what the context has room for and replay once.
-        if (response.status === 400 && !maxTokensAdjusted) {
-          rejectedAuthBody = await response.text().catch(() => '');
-          if (adjustMaxTokensForContextOverflow(body, 400, rejectedAuthBody)) {
-            maxTokensAdjusted = true;
-            cleanupCancelHandler(cancelHandler);
-            try {
-              controller?.abort?.();
-            } catch {}
-            ({ response, controller, cancelHandler } = await requestWithRetry(auth.creds.accessToken));
-            rejectedAuthBody = null;
-          }
-        }
+        const opened = await this._openResponse({
+          requestWithRetry,
+          cleanupCancelHandler,
+          auth,
+          body,
+          maxTokensAdjusted,
+        });
+        const { response, controller, cancelHandler, rejectedAuthBody } = opened;
+        maxTokensAdjusted = opened.maxTokensAdjusted;
         if (!response.ok) {
           cleanupCancelHandler(cancelHandler);
           return await this._resendAfterRejection({
@@ -657,6 +640,51 @@ export class AnthropicOAuthProvider {
     }
   }
 
+  // One attempt's initial response: a 401 (or Anthropic's exact revoked-token
+  // 403) refreshes the credentials in `auth` and replays once; a context
+  // overflow 400 shrinks `body.max_tokens` and replays once per send
+  // (`maxTokensAdjusted`). `rejectedAuthBody`: the drained text of a final
+  // rejected response, null when none was read.
+  async _openResponse({ requestWithRetry, cleanupCancelHandler, auth, body, maxTokensAdjusted }) {
+    let response, controller, cancelHandler;
+    ({ response, controller, cancelHandler } = await requestWithRetry(auth.creds.accessToken));
+
+    // Refresh on 401, and only Anthropic's exact official revoked-token
+    // 403 signature. Ordinary permission/policy 403s are terminal.
+    let rejectedAuthBody = null;
+    if (response.status === 401 || response.status === 403) {
+      rejectedAuthBody = await response.text().catch(() => '');
+    }
+    if (isRefreshableAuthRejection(response.status, rejectedAuthBody)) {
+      process.stderr.write(`[anthropic-oauth] ${response.status} — forcing refresh and retrying once\n`);
+      cleanupCancelHandler(cancelHandler);
+      // Body was drained above; abort closes any remaining transport
+      // resources before the credential-refresh replay.
+      try {
+        controller?.abort?.();
+      } catch {}
+      auth.creds = await this.ensureAuth({ forceRefresh: true, reason: String(response.status) });
+      ({ response, controller, cancelHandler } = await requestWithRetry(auth.creds.accessToken));
+      rejectedAuthBody = null;
+    }
+
+    // "input length and max_tokens exceed context limit": shrink max_tokens
+    // to what the context has room for and replay once.
+    if (response.status === 400 && !maxTokensAdjusted) {
+      rejectedAuthBody = await response.text().catch(() => '');
+      if (adjustMaxTokensForContextOverflow(body, 400, rejectedAuthBody)) {
+        maxTokensAdjusted = true;
+        cleanupCancelHandler(cancelHandler);
+        try {
+          controller?.abort?.();
+        } catch {}
+        ({ response, controller, cancelHandler } = await requestWithRetry(auth.creds.accessToken));
+        rejectedAuthBody = null;
+      }
+    }
+    return { response, controller, cancelHandler, rejectedAuthBody, maxTokensAdjusted };
+  }
+
   // A non-OK initial response: quota errors surface as-is; a CLI-version
   // floor or an unknown/retired model replays the turn ONCE through send().
   async _resendAfterRejection({ response, rejectedAuthBody, messages, model, useModel, tools, opts, onStageChange }) {
@@ -780,6 +808,7 @@ export class AnthropicOAuthProvider {
       rawUsage: result.usage?.raw || null,
       provider: 'anthropic-oauth',
       requestKind,
+      prefixBlocks: latestAnthropicPrefix(sessionId),
     });
 
     // Phase I: if the live response surfaced a model id we don't know

package/src/runtime/agent/orchestrator/providers/anthropic-turn-result.mjs

@@ -11,6 +11,7 @@
  */
 import { traceAgentUsage } from '../agent-trace.mjs';
 import { reportedCostUsd } from './lib/usage-primitives.mjs';
+import { latestAnthropicPrefix } from './lib/anthropic-prefix-trace.mjs';
 
 /**
  * @param {object} parseResult  the assembled turn (streaming or normalized non-streaming)
@@ -47,6 +48,7 @@ export function buildAnthropicTurnResult(parseResult, { provider, useModel, opts
       // Anthropic usage is additive at this inner transport
       // boundary, even when OpenCode Go supplies the provider id.
       inputTokensInclusive: false,
+      prefixBlocks: latestAnthropicPrefix(opts.sessionId || opts.session?.id || null),
     });
   }
 

package/src/runtime/agent/orchestrator/providers/antigravity-request.mjs

@@ -3,6 +3,7 @@ import { createProviderReplay, providerReplayItems } from './lib/provider-replay
 import { toGeminiContents, toGeminiRequestTools, toGeminiToolConfig } from './gemini-schema.mjs';
 import { geminiThinkingConfig } from './gemini-thinking.mjs';
 import { isGeminiFamilyModel } from './gemini-family.mjs';
+import { splitTailReminder } from './lib/tail-reminder-split.mjs';
 
 const THOUGHT_SIGNATURE_SENTINEL = 'skip_thought_signature_validator';
 const CLAUDE_MAX_OUTPUT_TOKENS = 64000;
@@ -219,7 +220,10 @@ function antigravityGeminiThinkingConfig(model, opts) {
   });
 }
 
-export function buildAntigravityRequest(messages, model, tools, opts = {}, projectId) {
+export function buildAntigravityRequest(requestMessages, model, tools, opts = {}, projectId) {
+  // The tail reminder is not history: the tool-loop closure below must see the
+  // real tail, so the reminder is appended to the wire contents last.
+  const { messages, reminder } = splitTailReminder(requestMessages);
   const systemText = messages
     .filter((message) => message.role === 'system')
     .map((message) => message.content)
@@ -234,7 +238,7 @@ export function buildAntigravityRequest(messages, model, tools, opts = {}, proje
     ...(claude ? { maxOutputTokens: CLAUDE_MAX_OUTPUT_TOKENS } : {}),
     ...(thinkingConfig ? { thinkingConfig } : {}),
   };
-  const request = { contents };
+  const request = { contents: reminder ? [...contents, { role: 'user', parts: [{ text: reminder }] }] : contents };
   if (systemText) request.systemInstruction = { role: 'user', parts: [{ text: systemText }] };
   const requestTools = claude
     ? claudeRequestTools(tools, opts.nativeTools, opts.onToolExcluded)

package/src/runtime/agent/orchestrator/providers/auto-effort.mjs

@@ -3,24 +3,43 @@
 // Every turn starts again from the base, so a run of hard turns never
 // ratchets the effort upward.
 //
-// The base is `medium` on every model: raised only when the request needs it,
-// lowered when it is easy. The ladder is the model's supported efforts from
+// The base is the global "Auto reasoning base" setting (`autoEffortBase` in the
+// agent config; low / medium / high, default `medium`), the same on every model
+// and independent of the effort last chosen: raised only when the request needs
+// it, lowered when it is easy. The ladder is the model's supported efforts from
 // `low` up to the tier below the top: `none`/`minimal` switch thinking off and
-// `max`/`ultra` are reserved for an explicit user choice, so auto never picks
-// them. A chosen `max`/`ultra` is left untouched.
+// `max`/`ultra` are reserved for an explicit (fixed, Auto off) user choice, so
+// auto never picks them. A base the model does not offer is clamped to the
+// nearest ladder level.
 
 const EFFORT_ORDER = Object.freeze(['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max', 'ultra']);
 const FLOOR_INDEX = EFFORT_ORDER.indexOf('low');
 const RESERVED_TOP = new Set(['max', 'ultra']);
 
 export const AUTO_EFFORT_BASE = 'medium';
+/** The "Auto reasoning base" choices: the levels Auto can work around. */
+export const AUTO_EFFORT_BASES = Object.freeze(['low', 'medium', 'high']);
 
-/** The effort auto moves from: `medium`, unless the user chose `max`/`ultra`. */
-export function autoEffortBase(chosen) {
-  const effort = String(chosen ?? '')
+/** The effort auto moves from: the global "Auto reasoning base" setting
+ *  (`autoEffortBase` in the agent config); absent or invalid is `medium`. */
+export function autoEffortBase(setting) {
+  const effort = String(setting ?? '')
     .trim()
     .toLowerCase();
-  return RESERVED_TOP.has(effort) ? effort : AUTO_EFFORT_BASE;
+  return AUTO_EFFORT_BASES.includes(effort) ? effort : AUTO_EFFORT_BASE;
+}
+
+/** The base on the model's ladder: the setting itself, else the nearest
+ *  ladder level (the lower one on a tie); null when the ladder is empty. */
+export function clampAutoEffortBase({ base, options }) {
+  const ladder = autoEffortLadder(options);
+  if (!ladder.length) return null;
+  const want = EFFORT_ORDER.indexOf(autoEffortBase(base));
+  let best = ladder[0];
+  for (const level of ladder) {
+    if (Math.abs(EFFORT_ORDER.indexOf(level) - want) < Math.abs(EFFORT_ORDER.indexOf(best) - want)) best = level;
+  }
+  return best;
 }
 
 export const AUTO_EFFORT_MODES = Object.freeze(['off', 'observe', 'on']);