mixdog 1.3.4 → 1.4.0

package/src/runtime/agent/orchestrator/providers/media-normalization.mjs

@@ -274,7 +274,7 @@ function* walkContentParts(content) {
  * beforehand by preparePdfTextForProvider, so one reaching here is a bug.
  * Null when the part is not a file at all.
  */
-export function textFormOfFilePart(part) {
+function textFormOfFilePart(part) {
   if (part?.type !== 'file' && part?.type !== 'document') return null;
   try {
     const file = fileInfo(part);
@@ -840,6 +840,56 @@ function partCarriesLiveMedia(part) {
   return Array.isArray(part.content) && contentCarriesLiveMedia(part.content);
 }
 
+/** An image part in any spelling the providers use: inline, URL, file id or
+ *  URI, Gemini inline data. */
+function isImagePart(part) {
+  return Boolean(
+    part.type === 'image' ||
+      part.type === 'image_url' ||
+      part.type === 'input_image' ||
+      imageUrlFromPart(part) ||
+      imageFileIdFromPart(part) ||
+      imageFileUriFromPart(part) ||
+      geminiInlineInfo(part)
+  );
+}
+
+function mapPartText(part, mapText) {
+  if (typeof part === 'string') return mapText(part);
+  if (!part || typeof part !== 'object') return part;
+  // Media and attachment references are encodings, never text.
+  if (isAttachmentReference(part) || isImagePart(part) || fileInfo(part)) return part;
+  for (const key of ['text', 'content']) {
+    if (typeof part[key] === 'string') {
+      const next = mapText(part[key]);
+      return next === part[key] ? part : { ...part, [key]: next };
+    }
+  }
+  if (Array.isArray(part.content)) {
+    const nextContent = mapContentText(part.content, mapText);
+    if (nextContent !== part.content) return { ...part, content: nextContent };
+  }
+  return part;
+}
+
+/** `content` with `mapText` applied to its text and nothing else: a string,
+ *  the text a text part or a part's string content carries (textFromPart),
+ *  and nested part content; media parts and attachment references stay as
+ *  they are. The same value when nothing changed. */
+export function mapContentText(content, mapText) {
+  if (typeof content === 'string') return mapText(content);
+  const parts = contentParts(content);
+  if (!parts) return content;
+  let changed = false;
+  const out = parts.map((part) => {
+    const next = mapPartText(part, mapText);
+    if (next !== part) changed = true;
+    return next;
+  });
+  if (!changed) return content;
+  return Array.isArray(content) ? out : { ...content, content: out };
+}
+
 function sanitizePartForStoredHistory(part) {
   if (typeof part === 'string') return part;
   if (!part || typeof part !== 'object') return part;
@@ -849,15 +899,7 @@ function sanitizePartForStoredHistory(part) {
   // reloading the session keeps the provider prompt cache intact.
   const storedImage = part.type === 'image' ? storedImagePart(part) : null;
   if (storedImage) return storedImage;
-  if (
-    part.type === 'image' ||
-    part.type === 'image_url' ||
-    part.type === 'input_image' ||
-    imageUrlFromPart(part) ||
-    imageFileIdFromPart(part) ||
-    imageFileUriFromPart(part) ||
-    geminiInlineInfo(part)
-  ) {
+  if (isImagePart(part)) {
     return { type: 'text', text: storedHistoryImagePlaceholder(part) };
   }
   const file = fileInfo(part);

package/src/runtime/agent/orchestrator/providers/model-proxy-channel.d.mts

@@ -5,7 +5,14 @@ export const MODEL_PROXY_OPERATIONS: Readonly<{
   resolve: 'modelProxyResolve';
   heartbeat: 'modelProxyHeartbeat';
 }>;
-export type ModelProxyMethod = 'send' | 'listModels' | 'refreshModels' | 'isAvailable' | 'resolveWireRoute' | 'providerConfig';
+export type ModelProxyMethod =
+  | 'send'
+  | 'listModels'
+  | 'refreshModels'
+  | 'isAvailable'
+  | 'quotaUsable'
+  | 'resolveWireRoute'
+  | 'providerConfig';
 export const MODEL_PROXY_METHODS: ReadonlyArray<ModelProxyMethod>;
 export const MODEL_PROXY_HEARTBEAT_MS: number;
 export const MODEL_PROXY_LEASE_MS: number;

package/src/runtime/agent/orchestrator/providers/model-proxy-channel.mjs

@@ -34,6 +34,7 @@ export const MODEL_PROXY_METHODS = Object.freeze([
   'listModels',
   'refreshModels',
   'isAvailable',
+  'quotaUsable',
   'resolveWireRoute',
   'providerConfig',
 ]);

package/src/runtime/agent/orchestrator/providers/npm-cli-version.mjs

@@ -8,6 +8,7 @@
 // so a new process (or an offline one) starts from the newest version this
 // machine has seen rather than from a floor that only moves with a release.
 
+import { runAbortable } from '../../../shared/abort-race.mjs';
 import { readLastKnownVersion, rememberLastKnownVersion } from './client-version-store.mjs';
 
 const SEMVER = /^\d+\.\d+\.\d+$/;
@@ -41,11 +42,18 @@ export async function parseNpmLatest(res) {
   return SEMVER.test(v) ? v : null;
 }
 
-/** One GET of `url` parsed to a version; null when offline, slow, or unrecognised. */
+/** One GET of `url` parsed to a version; null when offline, slow, or unrecognised.
+ *  The deadline settles the lookup itself instead of relying on the request
+ *  and its body read to honour the abort: a send awaits this lookup, and its
+ *  timer is unref'd, so once the abort tears the socket down nothing else is
+ *  left to wake a read that missed it. */
 export async function fetchRemoteVersion(url, parse, timeoutMs = TIMEOUT_MS) {
+  const signal = AbortSignal.timeout(timeoutMs);
   try {
-    const res = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
-    return res.ok ? (await parse(res)) || null : null;
+    return await runAbortable(signal, async () => {
+      const res = await fetch(url, { signal });
+      return res.ok ? (await parse(res)) || null : null;
+    });
   } catch {
     return null;
   }

package/src/runtime/agent/orchestrator/providers/oauth-credential-probes.mjs

@@ -4,6 +4,8 @@ import { join } from 'node:path';
 import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
 import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
 import { cursorTokenExpiry } from './cursor-auth.mjs';
+import { describeDevinOAuthCredentials } from './devin-auth.mjs';
+import { isSignedInTokenDocument } from './lib/oauth-token-utils.mjs';
 import { isValidMuseCredentialDocument } from './muse-code-oauth-tokens.mjs';
 import { isValidOpenCodeGoCredentialDocument } from './opencode-go-oauth-tokens.mjs';
 import { developerOptionEnabled, developerOptionForProvider } from '../../../shared/developer-options.mjs';
@@ -151,7 +153,7 @@ function openAIOAuthState() {
       join(resolvePluginData(), 'openai-oauth.json'),
   ];
   return memoProbe('openai-oauth', paths, () =>
-    resolveProbeState(paths, (docs) => docs.some((raw) => !!(raw?.access_token && raw?.refresh_token)))
+    resolveProbeState(paths, (docs) => docs.some((raw) => isSignedInTokenDocument(raw)))
   );
 }
 
@@ -273,6 +275,21 @@ function cursorOAuthState() {
   );
 }
 
+// Account-scoped like the token store: the selected account's file wins. Expiry
+// comes from describeDevinOAuthCredentials (no refresh is attempted here); an
+// expired access token still counts when a refresh token can renew it.
+function devinOAuthState() {
+  const paths = [
+    boundProviderAuthPath('devin-oauth') ||
+      process.env.DEVIN_OAUTH_CREDENTIALS_PATH ||
+      join(resolvePluginData(), 'devin-oauth.json'),
+  ];
+  return memoProbe('devin-oauth', paths, () => {
+    const info = describeDevinOAuthCredentials();
+    return info?.authenticated && (info.usable || info.refreshable) ? 'present' : 'absent';
+  });
+}
+
 const OAUTH_PROBE_STATES = new Map([
   ['anthropic-oauth', anthropicOAuthState],
   ['openai-oauth', openAIOAuthState],
@@ -281,6 +298,7 @@ const OAUTH_PROBE_STATES = new Map([
   ['command-code-oauth', commandCodeOAuthState],
   ['mimo-oauth', mimoOAuthState],
   ['cursor-oauth', cursorOAuthState],
+  ['devin-oauth', devinOAuthState],
   ['antigravity-oauth', antigravityOAuthState],
   ['opencode-go-oauth', openCodeGoOAuthState],
 ]);

package/src/runtime/agent/orchestrator/providers/oauth-usage.mjs

@@ -609,14 +609,47 @@ function balanceFromAnthropicSpend(spend) {
   return null;
 }
 
+// The server's limit id, in the one spelling headers and the usage payload share.
+const codexLimitId = (value) => (cleanString(value) || '').toLowerCase().replace(/-/g, '_');
+
+// Model-specific limits beside the plan's own: one per server limit id
+// (`metered_feature`), whose `limit_name` names the model it meters. Each
+// window gates that model alone.
+function codexAdditionalLimits(list) {
+  return (Array.isArray(list) ? list : []).flatMap((entry) => {
+    const limit = codexLimitId(entry?.metered_feature || entry?.limit_name);
+    if (!limit) return [];
+    const name = cleanString(entry.limit_name) || limit;
+    const rate = entry.rate_limit && typeof entry.rate_limit === 'object' ? entry.rate_limit : {};
+    const windows = [
+      windowFromPercent('5H', rate.primary_window || rate.primary, 'openai-codex-oauth'),
+      windowFromPercent('7D', rate.secondary_window || rate.secondary, 'openai-codex-oauth'),
+    ]
+      .filter(Boolean)
+      .map((window) => ({ ...window, label: `${window.label} ${name}`, limit, models: [name.toLowerCase()] }));
+    // A limit without a usable window meters nothing we can read: its model
+    // stays under the plan's windows.
+    return windows.length ? [{ model: name.toLowerCase(), windows }] : [];
+  });
+}
+
 export function normalizeOpenAIWhamUsage(data) {
   const rate = data?.rate_limit && typeof data.rate_limit === 'object' ? data.rate_limit : null;
   if (!rate) return null;
+  const additional = codexAdditionalLimits(data.additional_rate_limits);
+  // The plan's windows gate every model that no model-specific limit meters.
+  const plan = {
+    limit: 'codex',
+    ...(additional.length ? { except: additional.map((entry) => entry.model) } : {}),
+  };
   const windows = [
     windowFromPercent('5H', rate.primary_window || rate.primary, 'openai-codex-oauth'),
     windowFromPercent('7D', rate.secondary_window || rate.secondary, 'openai-codex-oauth'),
-  ].filter(Boolean);
+  ]
+    .filter(Boolean)
+    .map((window) => ({ ...window, ...plan }));
   if (!windows.length) return null;
+  windows.push(...additional.flatMap((entry) => entry.windows));
   return {
     provider: 'openai-oauth',
     source: 'openai-codex-wham',
@@ -687,12 +720,14 @@ function anthropicLimitWindows(limits, source) {
     .filter(Boolean);
 }
 
-// The extra-usage (pay-as-you-go) window when it is enabled, else null.
+// The extra-usage (pay-as-you-go) window when it is enabled, else null. It is
+// shown, never a limit: paid overage spent to its cap leaves the plan's own
+// windows serving, so it gates no model (`models: []`).
 function anthropicExtraUsageWindow(extraUsage) {
   if (extraUsage?.is_enabled !== true) return null;
   const limitUsd = num(extraUsage.monthly_limit, 0) / 100;
   const usedUsd = num(extraUsage.used_credits, 0) / 100;
-  return windowFromPercent(
+  const window = windowFromPercent(
     'EXTRA',
     {
       utilization: extraUsage.utilization,
@@ -702,6 +737,7 @@ function anthropicExtraUsageWindow(extraUsage) {
     },
     'anthropic-oauth-extra'
   );
+  return window ? { ...window, models: [] } : null;
 }
 
 export function normalizeAnthropicUsage(data, source = 'anthropic-oauth') {

package/src/runtime/agent/orchestrator/providers/openai-compat-chat-stream/stream-state.mjs

@@ -23,6 +23,8 @@ export function createCompatStreamState({
   onToolCall,
   onTextDelta,
   onStreamItemStart,
+  // false: text stays text; only native tool_calls deltas become calls.
+  leakedToolCallRecovery = true,
 }) {
   const toolDedupe = createToolCallDedupe();
   return {
@@ -49,7 +51,7 @@ export function createCompatStreamState({
     rawUsage: null,
     toolAcc: createToolCallAccumulator(),
     streamEmitState: { emittedToolCallKeys: new Set(), emittedToolCall: false, _toolDedupe: toolDedupe },
-    leakGuard: createLeakGuard({ knownToolNames, harmony: true }),
+    leakGuard: createLeakGuard({ knownToolNames: leakedToolCallRecovery ? knownToolNames : [], harmony: true }),
     leakedCalls: [],
     pendingLeakedCalls: [],
   };

package/src/runtime/agent/orchestrator/providers/openai-compat-chat-stream.mjs

@@ -44,6 +44,7 @@ export async function consumeCompatChatCompletionStream(
     knownToolNames,
     semanticIdleTimeoutMs,
     firstByteTimeoutMs,
+    leakedToolCallRecovery = true,
   } = {}
 ) {
   const idleOverrideEnabled = Number.isFinite(Number(semanticIdleTimeoutMs)) && Number(semanticIdleTimeoutMs) > 0;
@@ -57,6 +58,7 @@ export async function consumeCompatChatCompletionStream(
     onToolCall,
     onTextDelta,
     onStreamItemStart,
+    leakedToolCallRecovery,
   });
   reportTransport(state);
   const iterator = stream[Symbol.asyncIterator]();

package/src/runtime/agent/orchestrator/providers/openai-error-contract.mjs

@@ -7,6 +7,7 @@
  *   headers              response headers (HTTP, WS handshake, nested error.headers)
  *   retryAfterMs         server advice, uncapped (Retry-After / Retry-After-Ms)
  *   resetAt              epoch ms from quota reset fields (resets_at, resets_in_seconds)
+ *   quotaLimit           limit id from x-codex-active-limit, `-` normalized to `_`
  *
  * Pure: no I/O. Message text is never parsed for status or code.
  */
@@ -18,7 +19,7 @@ const isObject = (value) => value !== null && typeof value === 'object' && !Arra
  * Parse an HTTP error body ONCE into its contract fields. `message` is the
  * body's own message (untruncated); callers truncate for diagnostics.
  */
-export function parseErrorBody(text) {
+function parseErrorBody(text) {
   let json = null;
   try {
     json = JSON.parse(String(text || ''));
@@ -206,6 +207,10 @@ export function applyErrorContract(err, { status, headers, code, error, event }
     const wireHeaders =
       headers ?? error?.headers ?? event?.error?.headers ?? event?.response?.error?.headers ?? event?.headers;
     if (wireHeaders && typeof wireHeaders === 'object') err.headers = wireHeaders;
+    // The limit a refusal hit, by the server's limit id (`codex` is the plan's
+    // own; others are model-specific), so the account pool blocks only it.
+    const activeLimit = headerValue(err.headers, 'x-codex-active-limit').toLowerCase().replace(/-/g, '_');
+    if (activeLimit) err.quotaLimit = activeLimit;
     const rawCode = code ?? error?.code ?? error?.type ?? null;
     if (typeof rawCode === 'string' && rawCode.trim()) err.code = rawCode.trim().toLowerCase();
     const resetAt = resetAtFrom(error, event?.error, event?.response?.error, event);

package/src/runtime/agent/orchestrator/providers/openai-oauth-tokens.mjs

@@ -18,12 +18,15 @@ import { getPluginData } from '../config.mjs';
 import { writeJsonAtomicSync, withFileLock } from '../../../shared/atomic-file.mjs';
 import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
+import { TIMEOUT_PHASE } from '../../../shared/provider-timeout-phase.mjs';
 import { modelProxyClientMode, serverModelCredentialsDisabledError } from '../../../shared/model-proxy-mode.mjs';
 import {
   accountIdentityFields,
   decodeJwtPayload,
   expiryFromAccessToken,
+  isSignedInTokenDocument,
   normalizeAccountIdentity,
+  normalizeExpiresAtMs,
   oauthCredentialStatus,
 } from './lib/oauth-token-utils.mjs';
 import { createOpenAIOAuthLogin } from './openai-oauth-login.mjs';
@@ -60,11 +63,8 @@ function getRefreshLockPath() {
   return `${getOwnTokenPath()}.refresh.lock`;
 }
 
-function _normalizeExpiresAt(value) {
-  const n = Number(value || 0);
-  if (!Number.isFinite(n) || n <= 0) return 0;
-  return n < 1e12 ? n * 1000 : n;
-}
+// One normalizer for the store and the sign-in predicate (isSignedInTokenDocument).
+const _normalizeExpiresAt = normalizeExpiresAtMs;
 
 export function extractAccountId(token) {
   return decodeJwtPayload(token)?.['https://api.openai.com/auth']?.chatgpt_account_id;
@@ -117,7 +117,7 @@ export function loadTokens() {
   try {
     const stat = statSync(ownPath);
     const own = JSON.parse(readFileSync(ownPath, 'utf-8'));
-    if (own.access_token && own.refresh_token) {
+    if (isSignedInTokenDocument(own)) {
       const identity = identityFromTokens(own.id_token, own.access_token);
       return {
         ...own,
@@ -144,8 +144,7 @@ export function saveTokens(tokens) {
 // same loader the runtime uses (loadTokens), no parallel hard-coded path probe.
 export function hasOpenAIOAuthCredentials() {
   try {
-    const tokens = loadTokens();
-    return !!(tokens?.access_token && tokens?.refresh_token);
+    return !!loadTokens()?.access_token;
   } catch {
     return false;
   }
@@ -256,7 +255,9 @@ async function exchangeRefreshToken(refreshToken, previousIdentity = null) {
     return tokens;
   } catch (err) {
     if (err?.name === 'AbortError')
-      throw new Error(`OpenAI OAuth token refresh timed out after ${TOKEN_REFRESH_TIMEOUT_MS}ms`);
+      throw Object.assign(new Error(`OpenAI OAuth token refresh timed out after ${TOKEN_REFRESH_TIMEOUT_MS}ms`), {
+        timeoutPhase: TIMEOUT_PHASE.AUTH,
+      });
     throw err;
   } finally {
     clearTimeout(timeout);

package/src/runtime/agent/orchestrator/providers/openai-ws-send/send-context.mjs

@@ -7,13 +7,17 @@ import { createStreamSafetyStamps, resolveStallRetryBudget } from '../retry-clas
 import { _codexWsCompatibilityHeaders } from '../openai-codex-metadata.mjs';
 import { createWsSendAttempts } from '../openai-ws-send-attempts.mjs';
 import { createWsSendSpan } from '../openai-ws-send-span.mjs';
+import { emitProviderRetryStage } from '../retry-executor.mjs';
+import { retryReasonClass } from '../provider-error-kind.mjs';
 
 /** Stage callbacks are observers; a throwing one never fails the send. */
 export function notifyStage(onStageChange, stage, detail) {
   try {
     if (detail === undefined) onStageChange?.(stage);
     else onStageChange?.(stage, detail);
-  } catch {}
+  } catch {
+    // the stage observer is advisory
+  }
 }
 
 export function createWsSendContext(opts) {
@@ -81,10 +85,24 @@ export function createWsSendContext(opts) {
   // Single caller-visible recovery path for both handshake/acquire retries
   // and retryable stream failures. The session/TUI stage bridge renders this
   // as non-terminal reconnect progress; transport code must not also print it
-  // to stderr.
-  const emitReconnectProgress = ({ attempt, max, classifier }) => {
+  // to stderr. A retry that knows its failure carries the reason and the wait
+  // (retryAt), so a long server-advised wait counts down with its cause
+  // instead of sitting silently at "n/max".
+  const emitReconnectProgress = ({ attempt, max, classifier, error = null, waitMs = 0 }) => {
     const retryAttempt = Number(attempt) || 1;
     const retryMax = Number(max) || 1;
+    if (error) {
+      // The reason shown is the fixed class, never the server's own text.
+      emitProviderRetryStage(onStageChange, {
+        attempt: retryAttempt,
+        maxAttempts: retryMax,
+        lastErr: error,
+        delayMs: waitMs,
+        classifier,
+        reasonClass: retryReasonClass(error),
+      });
+      return;
+    }
     notifyStage(onStageChange, 'reconnecting', {
       attempt: retryAttempt,
       max: retryMax,
@@ -105,6 +123,7 @@ export function createWsSendContext(opts) {
     retry429,
     stallRetryBudget,
     trace: { poolKey, traceProvider, useModel },
+    traceFn: _agentTraceFn,
     auth,
     body,
   });

package/src/runtime/agent/orchestrator/providers/openai-ws-send-attempts/attempt-context.mjs

@@ -3,7 +3,34 @@
  * WS send, plus the surface/backoff primitives both failure resolvers use.
  */
 import { performance } from 'node:perf_hooks';
+import { appendAgentTrace } from '../../agent-trace.mjs';
 import { _sleepWithAbort, MIDSTREAM_WS_TRANSIENT_RETRY_LIMIT, midstreamBackoffFor, tag } from './policy.mjs';
+import { retryReasonClass, safeRetryErrorCode } from '../provider-error-kind.mjs';
+
+/** One row per WS retry: the server's typed verdict (status, close code, an
+ *  identifier-shaped code, the reason class) and the wait it bought, so a
+ *  long advised wait is diagnosable after the fact. Never the server's free
+ *  text: it can echo request content. Diagnostics only; never throws. */
+function traceRetry(traceFn, trace, err, { attempt, max, classifier, waitMs }) {
+  try {
+    const payload = {
+      provider: trace?.traceProvider || null,
+      model: trace?.useModel || null,
+      transport: 'websocket',
+      attempt,
+      max,
+      classifier: classifier || null,
+      reason: retryReasonClass(err),
+      wait_ms: Math.round(Number(waitMs) || 0),
+      http_status: Number(err?.httpStatus || err?.status || 0) || null,
+      code: safeRetryErrorCode(err),
+      ws_close_code: Number(err?.wsCloseCode || 0) || null,
+    };
+    traceFn({ sessionId: trace?.poolKey || null, kind: 'ws_retry', ...payload, payload });
+  } catch {
+    // the retry trace sink is advisory
+  }
+}
 
 export function createAttemptContext(deps) {
   const { sendSpan, externalSignal, sleepFn, safetyStamps } = deps;
@@ -31,10 +58,13 @@ export function createAttemptContext(deps) {
   };
   // Server advice (Retry-After, or a typed rate limit's "try again in")
   // replaces the local curve, like the reference client's retry deadline.
-  const backoff = async (retryNumber, err = null) => {
+  // Resolved before the retry is announced so the reconnect stage can name
+  // the wait it is about to sit through.
+  const retryWaitMs = (retryNumber, err = null) => midstreamBackoffFor(retryNumber, err);
+  const backoff = async (waitMs) => {
     const sleepStart = performance.now();
     try {
-      await _sleepWithAbort(midstreamBackoffFor(retryNumber, err), externalSignal, sleepFn);
+      await _sleepWithAbort(waitMs, externalSignal, sleepFn);
     } catch (sleepErr) {
       sendSpan.retryBackoffMs += performance.now() - sleepStart;
       sendSpan.emit('error');
@@ -53,14 +83,21 @@ export function createAttemptContext(deps) {
     }
     return first;
   };
-  /** Stash the error a retry is about to leave behind and announce the retry. */
-  const scheduleRetry = (err, { attemptIndex, classifier, retryLimit, remember }) => {
+  /** Stash the error a retry is about to leave behind and announce the retry
+   *  with its cause and the wait before the next attempt. */
+  const scheduleRetry = (err, { attemptIndex, classifier, retryLimit, remember, waitMs = 0 }) => {
     if (remember) {
       state.firstAttemptError = err;
       state.firstAttemptClassifier = classifier;
     }
     tag(err, { midstreamClassifier: classifier });
-    deps.emitReconnectProgress({ attempt: attemptIndex + 1, max: retryLimit, classifier });
+    deps.emitReconnectProgress({ attempt: attemptIndex + 1, max: retryLimit, classifier, error: err, waitMs });
+    traceRetry(deps.traceFn || appendAgentTrace, deps.trace, err, {
+      attempt: attemptIndex + 1,
+      max: retryLimit,
+      classifier,
+      waitMs,
+    });
   };
 
   return {
@@ -69,6 +106,7 @@ export function createAttemptContext(deps) {
     maxMidstreamRetries: MIDSTREAM_WS_TRANSIENT_RETRY_LIMIT,
     stampAll,
     surface,
+    retryWaitMs,
     backoff,
     surfaceFirstAttempt,
     scheduleRetry,

package/src/runtime/agent/orchestrator/providers/openai-ws-send-attempts/handshake-failure.mjs

@@ -81,13 +81,15 @@ export async function resolveHandshakeFailure(
   const retryable =
     classifier && status !== 401 && status !== 426 && err?.unsafeToRetry !== true && !externalSignal?.aborted;
   if (retryable && attemptIndex < ctx.maxMidstreamRetries) {
+    const waitMs = ctx.retryWaitMs(attemptIndex + 1, err);
     ctx.scheduleRetry(err, {
       attemptIndex,
       classifier,
       retryLimit: ctx.maxMidstreamRetries,
       remember: !state.firstAttemptError,
+      waitMs,
     });
-    await ctx.backoff(attemptIndex + 1, err);
+    await ctx.backoff(waitMs);
     return true;
   }
   // A later auth/upgrade decision must win over an earlier transient

package/src/runtime/agent/orchestrator/providers/openai-ws-send-attempts/stream-failure.mjs

@@ -77,7 +77,9 @@ export async function resolveStreamFailure(ctx, err, { attemptIndex, entry, midS
       process.stderr.write(
         `[openai-oauth] stall retry budget exhausted (${STREAM_STALL_RETRY_BUDGET_MS}ms since first stall) — surfacing provider-terminal failure\n`
       );
-    } catch {}
+    } catch {
+      // diagnostic write only; the provider-terminal failure is thrown next
+    }
     throw ctx.surface(markProviderRecoveryExhausted(err, { owner: 'openai-oauth-ws-stall-budget' }));
   }
   const retryLimit = classifier ? midstreamRetryLimit(classifier) : 0;
@@ -89,8 +91,9 @@ export async function resolveStreamFailure(ctx, err, { attemptIndex, entry, midS
       state.carryForwardCache = null;
       tag(entry, { lastResponseId: null });
     }
-    ctx.scheduleRetry(err, { attemptIndex, classifier, retryLimit, remember: true });
-    await ctx.backoff(attemptIndex + 1, err);
+    const waitMs = ctx.retryWaitMs(attemptIndex + 1, err);
+    ctx.scheduleRetry(err, { attemptIndex, classifier, retryLimit, remember: true, waitMs });
+    await ctx.backoff(waitMs);
     return true;
   }
   // Not retryable, OR we've already exhausted the retry budget. Do not

package/src/runtime/agent/orchestrator/providers/opencode-go-gemini.mjs

@@ -144,6 +144,7 @@ export class OpenCodeGoGeminiEngine extends GeminiProvider {
           );
         },
         afterToolResult: geminiEndsWithFunctionResponse(contents),
+        failureUsage: geminiFailureUsage(opts, null, useModel),
         run: async ({ signal: attemptSignal, connected }) => {
           try {
             opts.onStageChange?.('requesting');

package/src/runtime/agent/orchestrator/providers/provider-availability.mjs

@@ -0,0 +1,19 @@
+import { modelProxyClientMode } from '../../../shared/model-proxy-mode.mjs';
+import { isOAuthProviderAvailable } from './oauth-credential-probes.mjs';
+
+/**
+ * Whether the named provider may be looked up or sent through right now. Remote
+ * client mode serves the PC's providers, whose availability the PC already
+ * decided; only a locally run provider answers to the local Developer option.
+ */
+export function providerAvailable(name) {
+  return modelProxyClientMode() || isOAuthProviderAvailable(name);
+}
+
+/** The error a send raises when its provider was switched off after lookup. */
+export function providerUnavailableError(name) {
+  return Object.assign(
+    new Error(`Provider "${name}" is disabled: its Developer option was switched off before the request was sent.`),
+    { code: 'EPROVIDERUNAVAILABLE', provider: name }
+  );
+}