mixdog 1.3.4 → 1.4.0

package/src/runtime/agent/orchestrator/providers/provider-error-kind.mjs

@@ -5,6 +5,7 @@
 // to the older fields (httpStatus, responseFailed, providerError, SDK error
 // bodies, RPC status strings). Message text is consulted only for untyped
 // errors and only for unambiguous wordings.
+import { TIMEOUT_PHASE, isFirstByteTimeout } from '../../../shared/provider-timeout-phase.mjs';
 
 export const PROVIDER_ERROR_KINDS = Object.freeze([
   'overloaded',
@@ -391,6 +392,13 @@ const CODE_KINDS = new Map(
   }).flatMap(([kind, codes]) => codes.map((code) => [code, kind]))
 );
 const RESOURCE_EXHAUSTED = 'resource_exhausted';
+
+/** True when `code` is one of the provider error codes this module classifies
+ *  (rate/usage limits, quota, overload, server/transient, context length,
+ *  model not found, auth, policy, …): a known vocabulary word, never free text. */
+function isKnownProviderErrorCode(code) {
+  return typeof code === 'string' && (CODE_KINDS.has(code) || code === RESOURCE_EXHAUSTED);
+}
 // When several typed codes are present (an envelope type plus a specific
 // code), the most specific verdict wins.
 const KIND_RANK = [
@@ -435,7 +443,7 @@ const GATEWAY_ERROR_TYPE_CODES = Object.freeze({
 });
 
 /** The typed code a gateway `error_type` names, or null for an absent/unmapped one. */
-export function gatewayErrorTypeCode(errorType) {
+function gatewayErrorTypeCode(errorType) {
   const key = typeof errorType === 'string' ? errorType.trim().toLowerCase() : '';
   return key && Object.hasOwn(GATEWAY_ERROR_TYPE_CODES, key) ? GATEWAY_ERROR_TYPE_CODES[key] : null;
 }
@@ -718,6 +726,62 @@ export function providerErrorKind(err, options = {}) {
   return describe(kind, code || undefined);
 }
 
+// ── Retry reason, without server text ───────────────────────────────────────
+// A server error's free text can echo request content (prompt, tokens,
+// account ids), so neither the retry trace nor the reconnect status carries
+// it: only a fixed reason class derived from typed status/code, and a code
+// only when it is a known provider error code (an identifier-shaped value can
+// still be private, e.g. an account id in a `code` field).
+const SERVER_ERROR_CODES = new Set([
+  'server_error',
+  'api_error',
+  'internal',
+  'internal_error',
+  'unavailable',
+  'service_unavailable',
+]);
+// Responses failure codes the WS retry classifier acts on beyond the shared
+// provider vocabulary.
+const WS_RETRY_ERROR_CODES = new Set(['auth_context_expired', 'auth_expired']);
+
+/** The typed error code when it is a known provider error code; null otherwise. */
+export function safeRetryErrorCode(err) {
+  const code = providerErrorKind(err).code;
+  return isKnownProviderErrorCode(code) || WS_RETRY_ERROR_CODES.has(code) ? code : null;
+}
+
+const STALL_ERROR_NAMES = new Set(['StreamStalledError', 'StreamStalledAbortError']);
+
+/**
+ * One of rate_limited / overloaded / server_error / auth / first_response_timeout /
+ * stalled / other. The timeout classes read our own typed timeout stamps
+ * (name, code, timeoutPhase), never message text.
+ */
+export function retryReasonClass(err) {
+  const { kind, status } = providerErrorKind(err);
+  const code = safeRetryErrorCode(err);
+  if (kind === 'rate_limited' || kind === 'quota_exhausted' || status === 429) return 'rate_limited';
+  if (kind === 'overloaded' || status === 529) return 'overloaded';
+  if (kind === 'auth' || kind === 'permission' || status === 401 || status === 403) return 'auth';
+  // A token-refresh timeout is a sign-in problem, not a slow model.
+  if (err?.timeoutPhase === TIMEOUT_PHASE.AUTH) return 'auth';
+  if ((status >= 500 && status < 600) || (code && SERVER_ERROR_CODES.has(code))) return 'server_error';
+  if (err?.timeoutPhase === TIMEOUT_PHASE.IDLE || STALL_ERROR_NAMES.has(err?.name) || err?.code === 'ESTREAMSTALL') {
+    return 'stalled';
+  }
+  // `firstByteTimeout` is the stamp the Anthropic first-message and OpenAI
+  // WS/HTTP first-event watchdogs put on their errors.
+  if (
+    isFirstByteTimeout(err) ||
+    err?.firstByteTimeout === true ||
+    err?.name === 'ProviderTimeoutError' ||
+    err?.code === 'EPROVIDERTIMEOUT'
+  ) {
+    return 'first_response_timeout';
+  }
+  return 'other';
+}
+
 /** Kinds whose refusal no wait or replay can change: quota, plan and billing. */
 export const QUOTA_KINDS = new Set(['quota_exhausted', 'entitlement', 'billing']);
 /** Kinds that are deterministic refusals of this request (never replayed as-is). */

package/src/runtime/agent/orchestrator/providers/quota-reading.mjs

@@ -13,6 +13,8 @@ import {
 } from '../../../shared/provider-accounts.mjs';
 import { fetchOAuthUsageSnapshot } from './oauth-usage.mjs';
 import { getProvider } from './registry.mjs';
+import { modelProxyClientMode } from '../../../shared/model-proxy-mode.mjs';
+import { getModelProxyChannel } from './model-proxy-channel.mjs';
 
 const forcedReading = (routeInfo, providerObj) =>
   fetchOAuthUsageSnapshot(routeInfo, providerObj, () => {}, { force: true }).catch(() => null);
@@ -40,15 +42,15 @@ function readingServesModel(reading, model, useCredits) {
   return measured.length > 0 && measured.every((window) => window.usedPct < 100);
 }
 
-export async function providerQuotaUsable(providerName, model = '', { provider = getProvider(providerName) } = {}) {
+/** The model-independent, account-wide measurement: one forced usage reading
+ *  per roster account (or the single credential). Null for a provider that
+ *  reports no exhausted quota. */
+export async function measureProviderQuota(providerName, { provider } = {}) {
   // Only an account-pooled provider reports exhausted quota at all.
-  if (!ACCOUNT_PROVIDERS.includes(providerName)) return true;
+  if (!ACCOUNT_PROVIDERS.includes(providerName)) return null;
+  if (provider === undefined) provider = getProvider(providerName);
   const pool = readProviderAccountPool(providerName);
   const useCredits = pool.useCredits === true;
-  // Only this reading counts as evidence: an account whose forced reading
-  // failed or measured nothing for this model stays exhausted however its
-  // older record reads; the pool's own choice (selection, blocks) decides
-  // among the rest.
   if (pool.accounts.length > 0) {
     const readings = await Promise.all(
       pool.accounts.map((row) =>
@@ -58,13 +60,37 @@ export async function providerQuotaUsable(providerName, model = '', { provider =
         )
       )
     );
-    const unproven = new Set(
-      pool.accounts.filter((_, index) => !readingServesModel(readings[index], model, useCredits)).map((row) => row.id)
-    );
-    if (unproven.size === pool.accounts.length) return false;
-    return chooseProviderAccount(readProviderAccountPool(providerName), unproven, Date.now(), model) !== null;
+    return {
+      providerName,
+      useCredits,
+      accounts: pool.accounts.map((row, index) => ({ id: row.id, reading: readings[index] })),
+    };
   }
   // No roster: the single credential's fresh meter decides.
   const reading = await forcedReading({ provider: providerName, model: '' }, provider);
-  return readingServesModel(reading, model, useCredits);
+  return { providerName, useCredits, accounts: null, reading };
+}
+
+/** Whether `model` can be served per `measurement` (from measureProviderQuota).
+ *  Only the measurement counts as evidence: an account whose forced reading
+ *  failed or measured nothing for this model stays exhausted however its
+ *  older record reads; the pool's own choice (selection, blocks) decides
+ *  among the rest. */
+export function quotaMeasurementServesModel(measurement, model = '') {
+  if (!measurement) return true;
+  const { providerName, useCredits, accounts } = measurement;
+  if (!accounts) return readingServesModel(measurement.reading, model, useCredits);
+  const unproven = new Set(
+    accounts.filter((row) => !readingServesModel(row.reading, model, useCredits)).map((row) => row.id)
+  );
+  if (unproven.size === accounts.length) return false;
+  return chooseProviderAccount(readProviderAccountPool(providerName), unproven, Date.now(), model) !== null;
+}
+
+export async function providerQuotaUsable(providerName, model = '', { provider } = {}) {
+  // The PC owns the accounts in proxy mode; do not resolve a server provider.
+  if (modelProxyClientMode()) {
+    return (await getModelProxyChannel().request({ provider: providerName, method: 'quotaUsable', model })) === true;
+  }
+  return quotaMeasurementServesModel(await measureProviderQuota(providerName, { provider }), model);
 }

package/src/runtime/agent/orchestrator/providers/registry.mjs

@@ -1,5 +1,6 @@
 import { OPENAI_COMPAT_PRESETS } from './openai-compat-presets.mjs';
 import { oauthCredentialProbeState } from './oauth-credential-probes.mjs';
+import { providerAvailable } from './provider-availability.mjs';
 import { refreshCatalog as refreshMetadataCatalog } from './model-catalog.mjs';
 import { wrapProviderAdmission } from './admission-scheduler.mjs';
 import { createAccountPoolProvider } from './account-pool.mjs';
@@ -33,6 +34,7 @@ export const OAUTH_PROVIDER_NAMES = new Set([
   'command-code-oauth',
   'mimo-oauth',
   'cursor-oauth',
+  'devin-oauth',
   'antigravity-oauth',
   'opencode-go-oauth',
 ]);
@@ -68,6 +70,17 @@ let _initChain = Promise.resolve();
 let _inFlightPromise = null;
 let _inFlightSig = null;
 let _lastAppliedSig = null;
+// Settles when an initialization by the owning runtime first applies.
+let _markProvidersInitialized;
+const _providersInitialized = new Promise((resolve) => {
+  _markProvidersInitialized = resolve;
+});
+
+/** Read-only readiness: resolves once the owning runtime's provider
+ *  initialization has applied a config (never starts one). */
+export function providersInitialized() {
+  return _providersInitialized;
+}
 // Provider instances are process-global inside the daemon. Catalog
 // readers use this revision to share one raw model snapshot while still
 // rebuilding their cheap route/config projection after auth/config changes.
@@ -176,6 +189,7 @@ const PROVIDER_MODULES = {
   'command-code-oauth': ['./command-code-oauth.mjs', 'CommandCodeOAuthProvider'],
   'mimo-oauth': ['./mimo-oauth.mjs', 'MimoOAuthProvider'],
   'cursor-oauth': ['./cursor.mjs', 'CursorOAuthProvider'],
+  'devin-oauth': ['./devin.mjs', 'DevinOAuthProvider'],
   'antigravity-oauth': ['./antigravity-oauth.mjs', 'AntigravityOAuthProvider'],
   'cursor-api': ['./cursor.mjs', 'CursorApiProvider'],
   openai: ['./openai-ws.mjs', 'OpenAIDirectProvider'],
@@ -220,7 +234,14 @@ async function instantiateProvider(name, Ctor, cfg, proxyChannel = null) {
   return createAccountPoolProvider(name, () => wrapProviderAdmission(new Ctor(cfg), name));
 }
 
+let _initProvidersCalls = 0;
+/** Test seam: how many times initProviders was called in this process. */
+export function _initProvidersCallCountForTest() {
+  return _initProvidersCalls;
+}
+
 export async function initProviders(config, { signal = null } = {}) {
+  _initProvidersCalls += 1;
   throwIfAborted(signal);
   // Remote mode: provider availability and config are the PC's, never this
   // server's credential probes. No connected client fails here, clearly.
@@ -260,6 +281,7 @@ export async function initProviders(config, { signal = null } = {}) {
       if (_lastAppliedSig !== sig) _providerCatalogRevision += 1;
       _lastAppliedSig = sig;
       settle();
+      _markProvidersInitialized();
       return v;
     },
     (err) => {
@@ -290,6 +312,9 @@ async function _initProvidersUnsynchronized(config, signal = null, proxyChannel
   const enabledResults = await Promise.all(
     entries.map(async ([name, cfg]) => {
       if (!cfg.enabled) return null;
+      // A dev-gated provider whose Developer option is off is never admitted,
+      // even from a config that still says enabled:true.
+      if (!providerAvailable(name)) return null;
       // A retired provider's saved config is inert: its replacement is its own entry.
       if (Object.hasOwn(RETIRED_PROVIDER_ALIASES, name)) return null;
       // Idempotent reuse: an enabled provider whose config signature is
@@ -446,10 +471,20 @@ function _scheduleOAuthSelfHeal(name) {
 // by its replacement account. When that account is not connected the lookup
 // misses like any other unconnected provider.
 const RETIRED_PROVIDER_ALIASES = Object.freeze({ 'opencode-go': 'opencode-go-oauth' });
+
+/** The instance registered under `name` right now, or null — a read-only
+ *  lookup (no lazy registration, unlike getProvider). */
+export function registeredProvider(name) {
+  return providers.get(name) || null;
+}
+
 export function getProvider(requestedName) {
   const name = Object.hasOwn(RETIRED_PROVIDER_ALIASES, requestedName)
     ? RETIRED_PROVIDER_ALIASES[requestedName]
     : requestedName;
+  // Availability first: switching a dev-gated provider's option off takes
+  // effect on the next lookup, even for an already-initialized instance.
+  if (!providerAvailable(name)) return undefined;
   const cached = providers.get(name);
   if (cached) return cached;
   // OAuth lazy fallback. Covers the boot-time race where the credential probe
@@ -539,7 +574,12 @@ export function providerConsumesReadWindows(name) {
 export function getAllProviders() {
   // Defensive copy — callers must not mutate the live registry or retain
   // stale entries across re-init (initProviders rebuilds the map in place).
-  return new Map(providers);
+  return new Map(availableProviderEntries());
+}
+
+// Live instances minus dev-gated providers whose Developer option is off.
+function availableProviderEntries() {
+  return [...providers].filter(([name]) => providerAvailable(name));
 }
 
 export function disableProvider(name) {
@@ -629,7 +669,7 @@ export function refreshProviderCatalogsOnStartup() {
   if (_startupCatalogRefreshPromise) return _startupCatalogRefreshPromise;
   armNextCatalogRefresh();
   const pending = [];
-  for (const [name, provider] of providers) {
+  for (const [name, provider] of availableProviderEntries()) {
     const refreshFn = providerCatalogRefreshFn(provider);
     if (!refreshFn) continue;
     pending.push(boundedCatalogRefresh(name, provider, refreshFn, 'startup catalog refresh'));
@@ -669,7 +709,7 @@ export function refreshCatalogs(options = {}) {
     const msg = error instanceof Error ? error.message : String(error);
     process.stderr.write(`[model-catalog] metadata refresh failed: ${msg}\n`);
   });
-  for (const [name, provider] of providers) {
+  for (const [name, provider] of availableProviderEntries()) {
     const refreshFn = providerCatalogRefreshFn(provider);
     if (!refreshFn) continue;
     pending.push(metadataReady.then(() => boundedCatalogRefresh(name, provider, refreshFn, 'catalog refresh')));

package/src/runtime/agent/orchestrator/providers/retry-executor.mjs

@@ -4,7 +4,7 @@ import { PROVIDER_RETRY_JITTER_RATIO, createTimeoutSignal } from '../stall-polic
 import { readStreamOutcome } from './lib/stream-outcome.mjs';
 import { recycleLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
 import { noteErrorUsage } from './lib/note-error-usage.mjs';
-import { retryReasonText, retryStatusLine } from '../../../shared/err-text.mjs';
+import { retryStatusLine, retryTimeoutText } from '../../../shared/err-text.mjs';
 import {
   TERMINAL_EDGE_STATUSES,
   boundedCauseChain,
@@ -13,7 +13,14 @@ import {
   isToolInputCut,
   retryAfterMsFromError,
 } from './retry-classification.mjs';
-import { DETERMINISTIC_KINDS, QUOTA_KINDS, errorHeaderValue, providerErrorKind } from './provider-error-kind.mjs';
+import {
+  DETERMINISTIC_KINDS,
+  QUOTA_KINDS,
+  errorHeaderValue,
+  providerErrorKind,
+  retryReasonClass,
+  safeRetryErrorCode,
+} from './provider-error-kind.mjs';
 import { adviceGatedRetry } from './retry-midstream.mjs';
 import {
   ModelFallbackTriggeredError,
@@ -35,7 +42,9 @@ export function createStreamSafetyStamps() {
       try {
         e.liveTextEmitted = true;
         e.unsafeToRetry = true;
-      } catch {}
+      } catch {
+        // the error object may be frozen; the live-text stamp is advisory
+      }
     }
     return e;
   };
@@ -44,7 +53,9 @@ export function createStreamSafetyStamps() {
       try {
         e.emittedToolCall = true;
         e.unsafeToRetry = true;
-      } catch {}
+      } catch {
+        // the error object may be frozen; the tool-call stamp is advisory
+      }
     }
     return e;
   };
@@ -313,6 +324,19 @@ function retryWaitMs(
   return retryAfterJitterRatio > 0 ? jitterDelayMs(wait, retryAfterJitterRatio, 'positive') : wait;
 }
 
+/** Fixed status phrases for a caller-classified retry reason. */
+const RETRY_REASON_TEXT = Object.freeze({
+  rate_limited: 'Rate limited by the provider',
+  overloaded: 'Provider overloaded',
+  server_error: 'Provider server error',
+  auth: 'Provider rejected the sign-in',
+  other: 'Connection interrupted',
+});
+
+// Timeout classes read our own typed timeout stamps (retryTimeoutText), so
+// their phrases carry the wait window.
+const TIMEOUT_REASON_CLASSES = new Set(['first_response_timeout', 'stalled']);
+
 /**
  * Display-only 'reconnecting' stage for one retry wait, so it reads as a
  * reconnect instead of a silent spinner. `attempt` is the attempt about to run
@@ -321,20 +345,28 @@ function retryWaitMs(
  */
 export function emitProviderRetryStage(
   onStageChange,
-  { attempt, maxAttempts, lastErr, delayMs, classifier = null, extra = null }
+  { attempt, maxAttempts, lastErr, delayMs, classifier = null, extra = null, reasonClass = null, providerLabel = null }
 ) {
   if (typeof onStageChange !== 'function') return;
   try {
-    const reason = retryReasonText(lastErr);
+    // The reason is a fixed phrase for a class (the caller's, else derived from
+    // the error's typed status/code), never the error's own text; an
+    // unrecognized class reads as `other`.
+    const cls = reasonClass == null ? retryReasonClass(lastErr) : reasonClass;
+    const fixedClass = Object.hasOwn(RETRY_REASON_TEXT, cls) || TIMEOUT_REASON_CLASSES.has(cls) ? cls : 'other';
+    const reason = TIMEOUT_REASON_CLASSES.has(fixedClass)
+      ? retryTimeoutText(lastErr, fixedClass, providerLabel)
+      : RETRY_REASON_TEXT[fixedClass];
     const waitMs = Math.max(0, Number(delayMs) || 0);
     onStageChange('reconnecting', {
       ...extra,
+      reasonClass: fixedClass,
       attempt,
       max: maxAttempts,
       waitMs,
       retryAt: Date.now() + waitMs,
       reason,
-      classifier: classifier || lastErr?.retryClassifier || lastErr?.code || null,
+      classifier: classifier || lastErr?.retryClassifier || safeRetryErrorCode(lastErr),
       message: retryStatusLine({ reason, attempt, maxAttempts, delayMs: waitMs }),
     });
   } catch {

package/src/runtime/agent/orchestrator/providers/statusline-route-meta.mjs

@@ -34,6 +34,12 @@ export function recordGatewayUsageEvent(summary) {
   return requireRouteMeta().recordGatewayUsageEvent(summary);
 }
 
+/** Resolves once every recorded usage event has been written; nothing was
+ *  recorded while the module is not loaded. */
+export function settleGatewayUsageWrites() {
+  return routeMeta ? routeMeta.settleGatewayUsageWrites() : Promise.resolve();
+}
+
 export function summarizeGatewayUsage(routeInfo, providerOut, compact = null, durationMs = null) {
   return requireRouteMeta().summarizeGatewayUsage(routeInfo, providerOut, compact, durationMs);
 }