mixdog 1.3.5 → 1.4.1

package/src/runtime/agent/orchestrator/providers/antigravity-transport.mjs

@@ -132,103 +132,12 @@ export function createAntigravityRequest({
   firstByte = ANTIGRAVITY_UNCLASSED_FIRST_BYTE,
   afterToolResult = false,
 }) {
-  const log = (attempt, lastErr, delayMs) => {
-    // A first-byte timeout runs on its own, shorter retry budget.
-    const firstByteLimited = isFirstByteTimeout(lastErr) && firstByte.retries != null;
-    emitProviderRetryStage(opts.onStageChange, {
-      attempt: attempt + 1,
-      maxAttempts: firstByteLimited
-        ? Math.min(ANTIGRAVITY_RETRY.maxAttempts, firstByte.retries + 1)
-        : ANTIGRAVITY_RETRY.maxAttempts,
-      lastErr,
-      delayMs,
-    });
-    process.stderr.write(`[antigravity] retry ${attempt + 1} after ${lastErr?.message || 'transient error'}\n`);
-  };
-  // Stamps what the attempt tells the user: how many attempts ran and, for a
-  // first-byte timeout, how long the model was given in total. A timeout past
-  // the first-byte retry budget ends the ladder here. A caller's cancellation
-  // reason may be shared by other requests and is never stamped.
-  const noteFailure = (err, { attemptSignal, windowMs, send }) => {
-    if (!err || typeof err !== 'object' || attemptSignal?.aborted) return err;
-    send.attempts += 1;
-    err.attempts = send.attempts;
-    if (!isFirstByteTimeout(err)) return err;
-    send.firstByteTimeouts += 1;
-    send.firstByteWaitedMs += windowMs;
-    err.waitedMs = send.firstByteWaitedMs;
-    err.providerLabel = 'Antigravity';
-    if (firstByte.retries != null && send.firstByteTimeouts > firstByte.retries) {
-      markProviderRecoveryExhausted(err, { owner: 'antigravity-first-byte', attempts: send.attempts, terminal: true });
-    }
-    return err;
-  };
+  const log = (attempt, lastErr, delayMs) =>
+    logAntigravityRetry(opts.onStageChange, firstByte, attempt, lastErr, delayMs);
   const attemptOnce = (send) =>
     withRetry(
-      async ({ signal: attemptSignal }) => {
-        try {
-          opts.onStageChange?.('requesting');
-        } catch {
-          /* heartbeat */
-        }
-        const windowMs = firstByteWindowMs(firstByte, send.firstByteTimeouts);
-        try {
-          const firstByteTimer = createTimeoutSignal(attemptSignal, windowMs, 'Antigravity first byte');
-          let res;
-          try {
-            const response = fetchFn(`${endpoint}/v1internal:streamGenerateContent?alt=sse`, {
-              method: 'POST',
-              headers,
-              body,
-              signal: firstByteTimer.signal,
-              dispatcher: getLlmDispatcher(),
-            });
-            // The request is on the wire and its headers are pending: the
-            // gateway sends them only with the first chunk, so this wait is
-            // the model's queueing and thinking time.
-            try {
-              opts.onStageChange?.(MODEL_THINKING_STAGE);
-            } catch {
-              /* heartbeat */
-            }
-            res = await response;
-          } catch (err) {
-            // Fetch surfaces AbortError; rethrow the timer/parent
-            // reason so same-host retry sees EPROVIDERTIMEOUT and
-            // a caller cancel stays a cancel.
-            if (firstByteTimer.signal.aborted && firstByteTimer.signal.reason instanceof Error) {
-              const reason = firstByteTimer.signal.reason;
-              if (!attemptSignal?.aborted) reason.timeoutPhase = TIMEOUT_PHASE.HEADERS;
-              throw reason;
-            }
-            throw err;
-          } finally {
-            firstByteTimer.cleanup();
-          }
-          // Headers arrived: the connection is live even while the model
-          // has not produced its first chunk.
-          try {
-            opts.onStreamDelta?.('transport');
-          } catch {}
-          if (!res.ok) {
-            const text = await res.text().catch(() => '');
-            const failure = antigravityError(res, text, endpoint);
-            // Capacity is paced by the local schedule below; the generic loop
-            // would sleep whatever wait the server names.
-            if (isCapacityFailure(failure)) markProviderRecoveryExhausted(failure, { owner: 'antigravity-capacity' });
-            throw failure;
-          }
-          try {
-            opts.onStageChange?.('streaming');
-          } catch {
-            /* heartbeat */
-          }
-          collector.beginAttempt();
-          return await collector.consume(res, attemptSignal, { firstByteTimeoutMs: windowMs });
-        } catch (err) {
-          throw noteFailure(err, { attemptSignal, windowMs, send });
-        }
-      },
+      ({ signal: attemptSignal }) =>
+        streamAttempt({ fetchFn, endpoint, headers, body, opts, collector, firstByte, send, attemptSignal }),
       {
         ...ANTIGRAVITY_RETRY,
         finalOnExhaust: true,
@@ -261,16 +170,128 @@ export function createAntigravityRequest({
         streamAttempt += 1;
         await sleepWithAbort(reask.waitMs, signal, sleepFn, 'Antigravity retry wait aborted');
       } catch (err) {
-        const waitMs = antigravity429WaitMs(err, state);
-        if (waitMs == null) {
-          if (isCapacityFailure(err)) {
-            markProviderRecoveryExhausted(err, { owner: 'antigravity-capacity', attempts: tried });
-          }
-          throw err;
-        }
+        const waitMs = scheduledRetryWaitMs(err, state, tried);
         log(tried, err, waitMs);
         await sleepWithAbort(waitMs, signal, sleepFn, 'Antigravity retry wait aborted');
       }
     }
   };
 }
+
+// The retry status and log line of one scheduled retry. A first-byte timeout
+// runs on its own, shorter retry budget.
+function logAntigravityRetry(onStageChange, firstByte, attempt, lastErr, delayMs) {
+  const firstByteLimited = isFirstByteTimeout(lastErr) && firstByte.retries != null;
+  emitProviderRetryStage(onStageChange, {
+    attempt: attempt + 1,
+    maxAttempts: firstByteLimited
+      ? Math.min(ANTIGRAVITY_RETRY.maxAttempts, firstByte.retries + 1)
+      : ANTIGRAVITY_RETRY.maxAttempts,
+    lastErr,
+    delayMs,
+    providerLabel: 'Antigravity',
+  });
+  process.stderr.write(`[antigravity] retry ${attempt + 1} after ${lastErr?.message || 'transient error'}\n`);
+}
+
+// The local wait before re-sending a failed request (429 / capacity schedule);
+// a failure the schedule does not retry is rethrown, a capacity one marked
+// exhausted after `tried` sends.
+function scheduledRetryWaitMs(err, state, tried) {
+  const waitMs = antigravity429WaitMs(err, state);
+  if (waitMs == null) {
+    if (isCapacityFailure(err)) {
+      markProviderRecoveryExhausted(err, { owner: 'antigravity-capacity', attempts: tried });
+    }
+    throw err;
+  }
+  return waitMs;
+}
+
+// One POST under the first-byte window: headers pending is the model's
+// thinking time, a non-OK body becomes the typed error, and a live stream is
+// handed to the collector for this attempt.
+async function streamAttempt({ fetchFn, endpoint, headers, body, opts, collector, firstByte, send, attemptSignal }) {
+  try {
+    opts.onStageChange?.('requesting');
+  } catch {
+    /* heartbeat */
+  }
+  const windowMs = firstByteWindowMs(firstByte, send.firstByteTimeouts);
+  try {
+    const firstByteTimer = createTimeoutSignal(attemptSignal, windowMs, 'Antigravity first byte');
+    let res;
+    try {
+      const response = fetchFn(`${endpoint}/v1internal:streamGenerateContent?alt=sse`, {
+        method: 'POST',
+        headers,
+        body,
+        signal: firstByteTimer.signal,
+        dispatcher: getLlmDispatcher(),
+      });
+      // The request is on the wire and its headers are pending: the
+      // gateway sends them only with the first chunk, so this wait is
+      // the model's queueing and thinking time.
+      try {
+        opts.onStageChange?.(MODEL_THINKING_STAGE);
+      } catch {
+        /* heartbeat */
+      }
+      res = await response;
+    } catch (err) {
+      // Fetch surfaces AbortError; rethrow the timer/parent
+      // reason so same-host retry sees EPROVIDERTIMEOUT and
+      // a caller cancel stays a cancel.
+      if (firstByteTimer.signal.aborted && firstByteTimer.signal.reason instanceof Error) {
+        const reason = firstByteTimer.signal.reason;
+        if (!attemptSignal?.aborted) reason.timeoutPhase = TIMEOUT_PHASE.HEADERS;
+        throw reason;
+      }
+      throw err;
+    } finally {
+      firstByteTimer.cleanup();
+    }
+    // Headers arrived: the connection is live even while the model
+    // has not produced its first chunk.
+    try {
+      opts.onStreamDelta?.('transport');
+    } catch {
+      // the stream-delta observer is advisory
+    }
+    if (!res.ok) {
+      const text = await res.text().catch(() => '');
+      const failure = antigravityError(res, text, endpoint);
+      // Capacity is paced by the local schedule; the generic loop
+      // would sleep whatever wait the server names.
+      if (isCapacityFailure(failure)) markProviderRecoveryExhausted(failure, { owner: 'antigravity-capacity' });
+      throw failure;
+    }
+    try {
+      opts.onStageChange?.('streaming');
+    } catch {
+      /* heartbeat */
+    }
+    collector.beginAttempt();
+    return await collector.consume(res, attemptSignal, { firstByteTimeoutMs: windowMs });
+  } catch (err) {
+    throw noteAttemptFailure(err, { attemptSignal, windowMs, send, firstByte });
+  }
+}
+
+// Stamps what the attempt tells the user: how many attempts ran and, for a
+// first-byte timeout, how long the model was given in total. A timeout past
+// the first-byte retry budget ends the ladder here. A caller's cancellation
+// reason may be shared by other requests and is never stamped.
+function noteAttemptFailure(err, { attemptSignal, windowMs, send, firstByte }) {
+  if (!err || typeof err !== 'object' || attemptSignal?.aborted) return err;
+  send.attempts += 1;
+  err.attempts = send.attempts;
+  if (!isFirstByteTimeout(err)) return err;
+  send.firstByteTimeouts += 1;
+  send.firstByteWaitedMs += windowMs;
+  err.waitedMs = send.firstByteWaitedMs;
+  if (firstByte.retries != null && send.firstByteTimeouts > firstByte.retries) {
+    markProviderRecoveryExhausted(err, { owner: 'antigravity-first-byte', attempts: send.attempts, terminal: true });
+  }
+  return err;
+}

package/src/runtime/agent/orchestrator/providers/cache-warm-admission.mjs

@@ -0,0 +1,90 @@
+// cache-warm-admission.mjs — the account gate of a cache warm
+// (anthropic-cache-warm.mjs). A warm never waits, queues, rotates accounts or
+// retries: right before its POST it reads the state a normal send consults
+// for the account it goes to — the Developer option, the account's admission
+// lane (rate-limit cooldown, a lane throttled after a 429), the account
+// roster's blocks and quota windows, and the session's quota-resume pause —
+// and is skipped when any of them holds or when no fresh quota reading says
+// the account has room. A warm's own refusal is recorded like a send's: a 429
+// in the lane cooldown, and the roster's verdict through the account pool.
+import {
+  ACCOUNT_PROVIDERS,
+  providerAccountExhausted,
+  quotaReadingFresh,
+  readProviderAccountPool,
+  staleQuotaWindows,
+} from '../../../shared/provider-accounts.mjs';
+import { quotaResumeEntry } from '../../../shared/quota-resume-store.mjs';
+import { recordAccountRefusal } from './account-pool.mjs';
+import { providerAdmissionKey, providerAdmissionScheduler } from './admission-scheduler.mjs';
+import { readCachedOAuthUsageSnapshot } from './oauth-usage.mjs';
+import { providerAvailable } from './provider-availability.mjs';
+
+function readingBlock(providerName, windows, checkedAt, now, exhausted) {
+  if (!Array.isArray(windows) || !quotaReadingFresh(checkedAt, now)) return 'no fresh quota reading';
+  if (staleQuotaWindows(providerName, windows)) return 'no fresh quota reading';
+  return exhausted ? 'account blocked or quota exhausted' : null;
+}
+
+function rosterBlock(providerName, accountId, model, now) {
+  if (!ACCOUNT_PROVIDERS.includes(providerName)) return null;
+  const pool = readProviderAccountPool(providerName);
+  const useCredits = pool.useCredits === true;
+  if (!pool.accounts.length) {
+    if (useCredits) return null;
+    const stored = readCachedOAuthUsageSnapshot({ provider: providerName, model: '' });
+    const row = stored ? { usage: { windows: stored.quotaWindows, checkedAt: stored.cachedAt } } : null;
+    return readingBlock(
+      providerName,
+      stored?.quotaWindows,
+      stored?.cachedAt,
+      now,
+      row && providerAccountExhausted(row, now, model)
+    );
+  }
+  if (!accountId) return 'account holding the cache unknown';
+  const row = pool.accounts.find((entry) => entry.id === accountId);
+  if (!row) return 'account not connected';
+  const exhausted = providerAccountExhausted(row, now, model, { useCredits });
+  if (useCredits) return exhausted ? 'account blocked' : null;
+  return readingBlock(providerName, row.usage?.windows, row.usage?.checkedAt, now, exhausted);
+}
+
+/**
+ * Why a warm on `instance` (account `accountId` of `providerName`; no id for
+ * a provider without an account roster) may not be sent now, or null. The
+ * instance's admission lane — the one its ordinary sends are admitted on —
+ * cooling down or throttled blocks it. Never waits.
+ */
+export function cacheWarmAccountBlock(
+  providerName,
+  instance,
+  { accountId = '', model = '', sessionId = '', scheduler = providerAdmissionScheduler, now = Date.now() } = {}
+) {
+  if (!providerAvailable(providerName)) return 'provider disabled';
+  const lane = scheduler.immediateBlock(providerAdmissionKey(providerName, instance));
+  if (lane) return lane;
+  if (sessionId && quotaResumeEntry(sessionId)) return 'session paused until its quota resets';
+  return rosterBlock(providerName, accountId, model, now);
+}
+
+/** The error a skipped warm rejects with (nothing was sent or billed). */
+export function cacheWarmBlockedError(reason) {
+  return Object.assign(new Error(`cache warm skipped: ${reason}`), { code: 'ECACHEWARMBLOCKED', usage: null });
+}
+
+/** Feed a warm's refusal into the shared state a send's would reach (the
+ *  lane keeps 429s only; the roster judges every refusal as the pool's send
+ *  does). A warm the caller aborted is no refusal. */
+export async function recordCacheWarmRefusal(
+  providerName,
+  instance,
+  error,
+  { accountId = '', model = '', aborted = false, scheduler = providerAdmissionScheduler } = {}
+) {
+  if (aborted || error?.code === 'ECACHEWARMBLOCKED') return;
+  scheduler.recordRateLimit(providerAdmissionKey(providerName, instance), error);
+  if (accountId && ACCOUNT_PROVIDERS.includes(providerName)) {
+    await recordAccountRefusal(providerName, accountId, model, error, instance);
+  }
+}

package/src/runtime/agent/orchestrator/providers/command-code-oauth-login.mjs

@@ -3,6 +3,7 @@
 // A pasted key or pasted callback JSON completes the same login by hand. The
 // first sign-in on a machine adopts an existing Command Code CLI login instead.
 import { createServer } from 'node:http';
+import { listenOn } from './lib/listen-on.mjs';
 import { randomBytes } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -95,16 +96,6 @@ function readLocalAuth(path) {
   }
 }
 
-function listenOn(server, port, host) {
-  return new Promise((resolve, reject) => {
-    server.once('error', reject);
-    server.listen(port, host, () => {
-      server.off('error', reject);
-      resolve();
-    });
-  });
-}
-
 function readBody(req) {
   return new Promise((resolve, reject) => {
     const chunks = [];

package/src/runtime/agent/orchestrator/providers/cursor-wire-transport.mjs

@@ -5,6 +5,7 @@ import http2 from 'node:http2';
 import { MAX_CONNECT_FRAME_BYTES, createCursorByteQueue } from './cursor-wire-guards.mjs';
 import { cursorClientVersion, warmCursorClientVersion } from './cursor-client-version.mjs';
 import { retryAfterMsFromError } from './retry-classifier.mjs';
+import { providerTimeoutError } from '../stall-policy.mjs';
 
 export { warmCursorClientVersion };
 
@@ -153,7 +154,9 @@ export function openCursorStream({ accessToken, path = RUN_PATH, url = API_URL }
     if (closed || session.closed || session.destroyed) return;
     try {
       session.ping(() => {});
-    } catch {}
+    } catch {
+      // the session may have closed since the check above
+    }
   }, H2_PING_INTERVAL_MS);
   ping.unref?.();
 
@@ -175,20 +178,28 @@ export function openCursorStream({ accessToken, path = RUN_PATH, url = API_URL }
     closeError = error || (status >= 400 ? httpStatusError(status, responseHeaders) : null);
     try {
       request.close();
-    } catch {}
+    } catch {
+      // the request stream may already be closed
+    }
     try {
       session.close();
-    } catch {}
+    } catch {
+      // the session may already be closed
+    }
     closeHandler?.(closeError);
   };
   const close = (error = null) => {
     if (closed) return;
     try {
       request.close(http2.constants.NGHTTP2_CANCEL);
-    } catch {}
+    } catch {
+      // the request stream may already be closed
+    }
     try {
       session.destroy();
-    } catch {}
+    } catch {
+      // the session may already be destroyed
+    }
     finish(error);
   };
 
@@ -243,17 +254,21 @@ export async function callCursorUnary({ accessToken, path, body, url = API_URL,
     let status = 0;
     let responseHeaders = null;
     let settled = false;
-    const timeout = setTimeout(() => finish(new Error('Cursor request timed out')), timeoutMs);
+    const timeout = setTimeout(() => finish(providerTimeoutError('Cursor request', timeoutMs)), timeoutMs);
     const finish = (error = null) => {
       if (settled) return;
       settled = true;
       clearTimeout(timeout);
       try {
         request.close();
-      } catch {}
+      } catch {
+        // the request stream may already be closed
+      }
       try {
         session.close();
-      } catch {}
+      } catch {
+        // the session may already be closed
+      }
       if (error) reject(error);
       else if (status >= 400) reject(httpStatusError(status, responseHeaders));
       else resolve(Buffer.concat(chunks));
@@ -322,7 +337,8 @@ export function parseEndStream(bytes) {
     if (!payload?.error) return null;
     const connectCode = String(payload.error.code || 'error').toLowerCase();
     const detail = String(payload.error.message || 'request failed');
-    const tooLarge = connectCode === 'resource_exhausted' && !THROTTLE_CUE_RE.test(detail) && REQUEST_TOO_LARGE_RE.test(detail);
+    const tooLarge =
+      connectCode === 'resource_exhausted' && !THROTTLE_CUE_RE.test(detail) && REQUEST_TOO_LARGE_RE.test(detail);
     const retryAfter =
       payload.error.retryAfter ??
       payload.error.retry_after ??

package/src/runtime/agent/orchestrator/providers/cursor.mjs

@@ -132,7 +132,9 @@ async function* responseSseEvents(response, signal) {
     if (signal) {
       try {
         signal.removeEventListener('abort', onAbort);
-      } catch {}
+      } catch {
+        // the abort listener may already be gone
+      }
     }
     if (aborted) await reader.cancel().catch(() => {});
   }
@@ -480,16 +482,10 @@ function selectParameterizedCursorVariant(group, requested, sendOpts = {}) {
     availableVariants[0] ||
     null;
   const parameters = { ...(defaultVariant?.parameters || {}), ...aliasParameters };
+  const defaultContext = parameters.context;
   const routeParameters =
     sendOpts.modelParameters && typeof sendOpts.modelParameters === 'object' ? sendOpts.modelParameters : {};
-  // The window picked the mode above: a stored `context` no variant of that
-  // mode offers (a 256k left beside a raised 500K window) is a stale value and
-  // yields to the mode's own; one the mode offers stays the user's choice.
-  const staleContext =
-    Object.hasOwn(routeParameters, 'context') &&
-    !availableVariants.some((variant) => String(variant.parameters?.context ?? '') === String(routeParameters.context));
   for (const definition of group.definitions) {
-    if (staleContext && definition.id === 'context') continue;
     if (Object.hasOwn(routeParameters, definition.id)) {
       parameters[definition.id] = String(routeParameters[definition.id]);
     }
@@ -508,9 +504,18 @@ function selectParameterizedCursorVariant(group, requested, sendOpts = {}) {
   ) {
     parameters.fast = sendOpts.fast === true ? 'true' : 'false';
   }
-  const selected = availableVariants.find((variant) =>
-    Object.entries(parameters).every(([id, value]) => String(variant.parameters?.[id] ?? '') === String(value))
-  );
+  const matches = (variant) =>
+    Object.entries(parameters).every(([id, value]) => String(variant.parameters?.[id] ?? '') === String(value));
+  let selected = availableVariants.find(matches);
+  // Keep a supported explicit context. A persisted context can exist in this
+  // mode but conflict with its requested effort/fast/other options. In that
+  // case try only the mode's default context, preserving every other choice
+  // and still rejecting the request unless the full combination is offered.
+  if (!selected && Object.hasOwn(routeParameters, 'context')) {
+    if (defaultContext === undefined) delete parameters.context;
+    else parameters.context = defaultContext;
+    selected = availableVariants.find(matches);
+  }
   if (!selected && availableVariants.length) {
     throw new Error(`Cursor model ${group.id} does not offer the selected parameter combination`);
   }
@@ -649,7 +654,9 @@ class CursorProviderBase {
     let emittedToolCall = false;
     try {
       sendOpts.onStageChange?.('requesting');
-    } catch {}
+    } catch {
+      // the stage observer is advisory
+    }
     try {
       const response = await runtime.handleChatCompletion(body, accessToken, {
         onStageChange: sendOpts.onStageChange,
@@ -664,10 +671,15 @@ class CursorProviderBase {
       });
       try {
         sendOpts.onStageChange?.('streaming');
-      } catch {}
+      } catch {
+        // the stage observer is advisory
+      }
       return await consumeCompatChatCompletionStream(responseSseEvents(response, signal), {
         signal,
         label: this.name,
+        // The wrapper below always exists; the stream joins the session's
+        // logical request only when the caller reports progress into it.
+        sessionId: typeof sendOpts.onStreamDelta === 'function' ? sendOpts.sessionId : null,
         onStreamDelta: (delta) => {
           sendOpts.onStreamDelta?.(delta);
         },

package/src/runtime/agent/orchestrator/providers/devin-wire-transport.mjs

@@ -193,7 +193,7 @@ function connectError(
   const error = new DevinWireError(text, {
     code: finalCode,
     // A reworded throttle reports its throttle status, not the carrier's.
-    status: tooLarge ? 413 : (reworded ? mappedStatus : status || mappedStatus),
+    status: tooLarge ? 413 : reworded ? mappedStatus : status || mappedStatus,
     retryable: tooLarge ? false : retryable,
     connectCode: code,
     detail: [detail, detailsSummary].filter(Boolean).join(' '),

package/src/runtime/agent/orchestrator/providers/devin.mjs

@@ -405,6 +405,9 @@ export class DevinOAuthProvider {
         signal,
         label: this.name,
         providerName: this.name,
+        // The wrapper below always exists; the stream joins the session's
+        // logical request only when the caller reports progress into it.
+        sessionId: typeof sendOpts.onStreamDelta === 'function' ? sendOpts.sessionId : null,
         onStreamDelta: (delta) => {
           if (!streaming) {
             streaming = true;