mixdog 1.4.0 → 1.4.1

package/src/defaults/skills/browser-use/SKILL.md

@@ -8,6 +8,8 @@ dependencies:
   tools:
     - type: tool
       value: browser
+    - type: tool
+      value: handoff_user
 ---
 
 # Browser Use
@@ -170,7 +172,7 @@ not as two blocks joined.
     a submitted form's result.
   - **Handoff** — the user must act on the page: payment, approval, or an
     unfinished workflow they continue. A sign-in, CAPTCHA or 2FA step you
-    wait on is an `ask_user` takeover instead (User step mid-flow).
+    wait on is a `handoff_user` takeover instead (User step mid-flow).
 - `open` replies with exactly one placement: "Shown in the browser panel",
   "Not on screen yet" (this conversation or its panel is not visible; the
   page appears when the user opens it), or an error. Tell the user that and
@@ -200,12 +202,12 @@ not as two blocks joined.
   pages.
 - **User step mid-flow** — a CAPTCHA or human check, 2FA, or identity check is
   a handoff, not completion (an e-mail check of a flow you started is not one:
-  E-mail verification). With `ask_user`, call it with `handoff: { kind:
+  E-mail verification). With `handoff_user`, call it with `handoff: { kind:
   'takeover', surface: 'browser', tab, instructions, need }`: it shows the
   takeover card, notifies the user, opens that page beside the chat, and
   returns when they press Done; continue from a fresh observation. Never ask
   for the step in plain chat or tell the user to open the panel. Without
-  `ask_user` (an agent), retain the page with `open`, report the required
+  `handoff_user` (an agent), retain the page with `open`, report the required
   user action, and stop.
 - Preserve pre-existing user tabs, unfinished forms, and pages needed for
   recovery. If ownership or disposability is unclear, preserve the page;
@@ -383,7 +385,7 @@ in the page instead of retrying the same `navigate`.
   `MIXDOG_BROWSER_CONFIRM_ACTIONS` and
   `MIXDOG_BROWSER_DENY_ACTIONS` optionally name comma-separated public actions
   (or `*`) the desktop app confirms once or refuses; denial takes precedence.
-- For a password or token, focus the field and call `ask_user` with
+- For a password or token, focus the field and call `handoff_user` with
   `handoff: { kind: 'secret', surface: 'browser' }`; for sign-in, CAPTCHA or
   2FA use `kind: 'takeover'` with instructions. Never ask for secrets or
   these steps in plain chat.

package/src/defaults/skills/computer-use/SKILL.md

@@ -8,6 +8,8 @@ dependencies:
   tools:
     - type: tool
       value: computer
+    - type: tool
+      value: handoff_user
 ---
 
 # Computer Use
@@ -241,9 +243,9 @@ your results and that browser's pixels are withheld until this turn ends
 (`ax` reads still work), but a page that redisplays it can expose it, and other
 programs of the same Windows user are outside this protection. A username is
 an identifier and is not hidden. Continue with keys (`act` key Enter). On a
-refusal, hand the secret to the user (`ask_user` kind `secret`,
+refusal, hand the secret to the user (`handoff_user` kind `secret`,
 surface `computer`); one-time codes, passkeys, security keys and app approvals
-are the user's step (`ask_user` kind `takeover`). Never type a password or
+are the user's step (`handoff_user` kind `takeover`). Never type a password or
 code with `type`/`set_value`, even one shown on screen.
 
 **Keyboard-driven navigation** — `act` with `key` steps such as `ctrl+s`

package/src/lib/rules-builder.cjs

@@ -126,7 +126,10 @@ function buildProfilePreferencesContent(dataDir) {
   return lines.length ? `# Profile Preferences\n\n${lines.join('\n')}` : '';
 }
 
-function buildLanguageSection(dataDir) {
+// `sharedFormatActive`: the prompt carries the shared Output Format partial,
+// which already keeps literals verbatim (common.md), so the language block
+// need not repeat it.
+function buildLanguageSection(dataDir, sharedFormatActive = false) {
   const profile = normalizeProfileConfig(readAgentConfig(dataDir).profile);
   const language = profileLanguagePrompt(profile.language);
   if (!language?.prompt) return '';
@@ -139,7 +142,7 @@ function buildLanguageSection(dataDir) {
   // mistranslate, so the two clauses would be dead text.
   if (language.prompt !== 'English') {
     lines.push(
-      `- Preserve identifiers, paths, commands, API names, and exact errors. Keep technical terms in their established form, usually the original English (blocker, cache, commit); add a short plain explanation only when the reader may not know it. Never invent a literal translation.`
+      `- ${sharedFormatActive ? '' : 'Preserve identifiers, paths, commands, API names, and exact errors. '}Keep technical terms in their established form, usually the original English (blocker, cache, commit); add a short plain explanation only when the reader may not know it. Never invent a literal translation.`
     );
   }
   return `# Language\n\n${lines.join('\n')}`;
@@ -153,7 +156,9 @@ function stripFrontmatter(markdown) {
 
 // Tool dependency is declared as metadata, not matched against prose. A
 // `<!-- tools: a, b -->` marker binds the block that follows it: the block
-// survives while any listed tool is permitted by the allow/deny policy.
+// survives while any listed tool is permitted by the allow/deny policy. The
+// pseudo-entry `lead` is not a tool: it is permitted for every non-agent
+// session (whatever its tool profile) and never for an agent-owned one.
 // Unspecified allowlists are unrestricted. Markers never reach the model.
 const TOOL_MARKER_RE = /^[ \t]*<!--[ \t]*tools:[ \t]*([^>]*?)[ \t]*-->[ \t]*$/;
 
@@ -188,9 +193,10 @@ function omitKeySet(omitTools) {
 }
 
 /** Drop routing clauses for tools that are not on the session surface. */
-function omitToolRoutes(text, omitTools = [], allowTools = null) {
+function omitToolRoutes(text, omitTools = [], allowTools = null, ownerIsAgent = false) {
   const deny = omitKeySet(omitTools);
   const allow = Array.isArray(allowTools) ? omitKeySet(allowTools) : null;
+  const permitted = (name) => (name === 'lead' ? !ownerIsAgent : !deny.has(name) && (!allow || allow.has(name)));
   const lines = String(text || '').split(/\r?\n/);
   const kept = [];
   let index = 0;
@@ -204,7 +210,7 @@ function omitToolRoutes(text, omitTools = [], allowTools = null) {
     index += 1;
     if (index >= lines.length) break;
     const end = markedBlockEnd(lines, index);
-    if (!tools.length || tools.some((name) => !deny.has(name) && (!allow || allow.has(name)))) {
+    if (!tools.length || tools.some(permitted)) {
       kept.push(...lines.slice(index, end));
     }
     index = end;
@@ -252,22 +258,29 @@ function readSharedFormatPartial({ PLUGIN_ROOT, DATA_DIR }) {
   );
 }
 
-function loadOutputStyle({ PLUGIN_ROOT, DATA_DIR }) {
+function resolveOutputStyle({ PLUGIN_ROOT, DATA_DIR }) {
   // Root `outputStyle` is the only configured location; the retired
   // `agent.outputStyle` key is dropped by config canonicalization.
   const configured = String(readUnifiedConfig(DATA_DIR).outputStyle || '').trim() || DEFAULT_OUTPUT_STYLE_ID;
   const styles = listOutputStyleEntries({ PLUGIN_ROOT, DATA_DIR });
   const style = matchOutputStyle(configured, styles) || matchOutputStyle(DEFAULT_OUTPUT_STYLE_ID, styles) || styles[0];
-  if (!style) return '';
+  if (!style) return null;
   const selected = stripFrontmatter(style.raw);
-  if (!selected) return '';
+  if (!selected) return null;
   const common = style.keepSharedFormat ? readSharedFormatPartial({ PLUGIN_ROOT, DATA_DIR }) : '';
+  return { style, selected, common };
+}
+
+function loadOutputStyle(paths) {
+  const resolved = resolveOutputStyle(paths);
+  if (!resolved) return '';
+  const { style, selected, common } = resolved;
   return [`# Output Style: ${style.label}`, OUTPUT_STYLE_ANCHOR, common, selected].filter(Boolean).join('\n\n');
 }
 
-function buildSharedToolContent({ PLUGIN_ROOT, omitTools = [], allowTools = null } = {}) {
+function buildSharedToolContent({ PLUGIN_ROOT, omitTools = [], allowTools = null, ownerIsAgent = false } = {}) {
   const SHARED_DIR = path.join(PLUGIN_ROOT, 'rules', 'shared');
-  return omitToolRoutes(readMarkdownDirectory(SHARED_DIR), omitTools, allowTools);
+  return omitToolRoutes(readMarkdownDirectory(SHARED_DIR), omitTools, allowTools, ownerIsAgent);
 }
 
 // Route policy: `rules/routes/*.md` files bound to a provider and/or model
@@ -444,8 +457,12 @@ function buildLeadMetaContent({ PLUGIN_ROOT, DATA_DIR, includeOutputStyle = true
  * preamble and progress lines follow the most recent instruction, so nothing
  * English (session/shell/git lines included) may trail it.
  */
-function buildLeadLanguageContent({ DATA_DIR }) {
-  return buildLanguageSection(DATA_DIR);
+function buildLeadLanguageContent({ PLUGIN_ROOT, DATA_DIR, includeOutputStyle = true }) {
+  const resolved = includeOutputStyle ? resolveOutputStyle({ PLUGIN_ROOT, DATA_DIR }) : null;
+  // Only the shipped partial is known to keep literals verbatim; a user
+  // override of common.md may not, so it keeps the language guard.
+  const shipped = stripFrontmatter(readOptional(path.join(PLUGIN_ROOT, 'output-styles', 'common.md')));
+  return buildLanguageSection(DATA_DIR, Boolean(shipped) && resolved?.common === shipped);
 }
 
 /** The configured response language as {id, name} (name = the language block's); null when none. */

package/src/output-styles/common.md

@@ -13,8 +13,8 @@ partial: true
 - Distinguish facts, inference, and uncertainty; keep exact literals and
   material risks. Caveats only when they change the reader's next step.
 - Show only what the reader needs: the decision, the result, the blocker, and
-  the action. No tangents, raw dumps, or process narration. Explicit depth
-  requests win; depth applies to substantive answers, not the one-line
+  the action. No tangents, raw dumps, or process narration. Depth
+  applies to substantive answers, not the one-line
   pre-tool briefing.
 - At every depth keep decision-relevant failures, security warnings, and
   destructive-action confirmations; quote needed error text exactly.

package/src/output-styles/simple.md

@@ -7,7 +7,7 @@ aliases: default, concise, handoff
 
 ## Depth
 
-- Give a self-contained summary: the answer first, then the core causal
+- Give a self-contained summary: the core causal
   sequence, the strongest evidence, and the direct consequence or next step.
 - Omit secondary evidence, implementation detail, and extended examples
   unless requested.

package/src/rules/agent/AGENT.md

@@ -15,7 +15,8 @@
 - Reporting: send one final message, then stop; never ask whether to
   continue. Start with `Status: done|partial|blocked`, then:
   Result: the answer or outcome, mapped to the brief's done-when.
-  Evidence: path+symbol and checks run (failures: decisive error only).
-  Open: risks, gaps, or the blocker. Omit empty fields; no logs, narration,
-  or restated brief. Role contracts only add fields.
-  Lead owns the independent review.
+  Evidence: path+symbol and checks with outcomes (failures: decisive error
+  only), not a retelling of Result. Open: risks, gaps, or the blocker.
+  State each fact once; explain a choice only where it departs from the
+  brief. Omit empty fields; no logs, narration, nested headings or restated
+  brief. Role contracts only add fields. Lead owns the independent review.

package/src/rules/lead/LEAD.md

@@ -19,11 +19,16 @@
 - Be a grounded, candid, and attentive collaborator: natural and respectful,
   without flattery, forced humor, mimicry, or stereotyping.
 <!-- tools: agent -->
-- Briefing an agent: one self-contained English brief with goal and why,
-  owned paths, non-goals and done-when; a running agent gets only changes.
-  Outcomes only: no tools, steps or mid-flight checks; evidence by path.
-  Decide first; send scope changes as one replacement brief; invent no
-  restrictions or copies.
+- Briefing an agent: one self-contained English brief with the goal and the
+  context it needs, owned paths, non-goals, constraints the agent does not
+  already receive, and done-when; a running agent gets only changes.
+  Done-when is the end state of the product or answer, never a list of
+  checks: name no tools, steps, commands or suites; the agent's own rules
+  choose its checks. A Reviewer gets the diff scope, the acceptance criteria
+  and the author's Evidence verbatim, not the whole report, so passed checks
+  are not rerun; a re-review carries only the fixes. Reference evidence by
+  path instead of retelling it. Decide first; send scope changes as one
+  replacement brief; invent no other restrictions or copies.
 <!-- tools: agent -->
 - Reports arrive as `<task-notification>`: never wait, poll or guess them;
   do independent work and end the turn. On an agent report, each feature

package/src/rules/shared/10-tool-workflow.md

@@ -8,7 +8,9 @@
   has its evidence; never widen past what was asked, and never ask
   permission for work the request already covers.
 - When blocked, first look for a workaround you can carry out yourself with
-  the available tools; ask the user only when none exists.
+  the available tools.
+<!-- tools: lead -->
+  Ask the user only when none exists.
 - Do not add work whose need depends on a pending result. Reuse content
   already delivered; changed sources and omitted ranges are new evidence.
   Trust documented guarantees; no availability checks or defensive branches —

package/src/rules/shared/45-destructive.md

@@ -7,8 +7,6 @@
   files you did not create: it may hold other agents' or the user's
   uncommitted work. Use a copy or managed snapshot for before/after
   comparisons.
-- Worktrees live only in the app-managed store; never create one through
-  shell or in a temp folder.
 <!-- tools: git -->
 - Separate-branch work goes into a managed worktree through `git`.
 - Back up only when changes risk irreversible loss, not for routine code edits;

package/src/rules/shared/50-execution.md

@@ -4,4 +4,6 @@
   data transformation, generated output, unsupported-format decoding. An open
   shell is never a routing reason.
 - Structured service operations go through the service's MCP tool or CLI.
+- Open no window, dialog or elevation prompt unless showing or operating
+  that UI is the task.
 

package/src/rules/shared/70-delivery.md

@@ -1,8 +1,9 @@
 # Delivery
 
 - Unless the user explicitly requests them, do not author separate record-keeping
-  artifacts (reports, progress logs, notes, or checklists). Report progress and
-  results in the conversation instead.
+  artifacts (reports, progress logs, notes, or checklists).
+<!-- tools: lead -->
+  Report progress and results in the conversation instead.
 - Reference files and folders in inline code by a Project-root-relative or
   absolute path, optionally `:line[:column]` (`deliverables/report.docx`,
   `src/app.ts:42`); files outside the Project always by absolute path; never a
@@ -11,14 +12,11 @@
   and give their path; never open them in the system browser or paste their
   source unless the user asks.
 <!-- tools: visualize -->
-- Open each finished artifact beside the chat with `visualize open` when available.
-  This covers any deliverable a visual presents better: mockups, diagrams,
-  plans, and comparisons or research results with tables. Present these as
-  a visualize page and keep the chat to a short summary.
+- Show every finished visual artifact with `visualize open`, loading its schema
+  first if deferred: images, video, HTML, documents, decks, mockups, diagrams,
+  plans; comparisons or research tables go in a visualize page. Keep the chat
+  to a short summary.
 
 <!-- tools: git -->
 - A commit request includes selecting and staging its changes; a stage-only
   request stops before commit. Do not stage changes without either request.
-<!-- tools: git -->
-- Stage selected diff changes with `git` using `action:"stage"`. Keep this
-  internal step within the requested commit workflow, not a separate approval.

package/src/runtime/agent/orchestrator/agent-runtime/agent-progress-watchdog.mjs

@@ -243,11 +243,13 @@ export function resolveAgentWatchdogPolicy(agent, overrides = {}) {
     // Role budget, floored so the provider recovery window always wins.
     idleStaleMs = Math.max(abort * 1000, PROVIDER_RECOVERY_FLOOR_MS);
   } else {
-    // Part B: the primary mid-stream stall catch is now the provider-level
-    // SEMANTIC idle abort (~120s, ping-immune). This public-agent idle is a
-    // BACKSTOP only, so it must not exceed the stall abort (600s default) —
-    // the old 30-min value meant a ping-only wedge that slipped past the
-    // provider layer would still hang the owner for half an hour. Cap it at
+    // Part B: the provider-level idle abort is the first mid-stream catch, but
+    // it is transport-based for Anthropic (pings reset it; other providers
+    // judge semantic idle). This public-agent idle is a BACKSTOP only, so it
+    // must not exceed the stall abort (600s default) — the old 30-min value
+    // meant a ping-only wedge that slipped past the provider layer would still
+    // hang the owner for half an hour. Anthropic pings extend it only up to
+    // KEEPALIVE_MAX_IDLE_MULTIPLIER times (evaluateAgentWatchdogAbort). Cap it at
     // the stall abort while keeping 30 min as an absolute ceiling. Long tool
     // calls refresh progress through the activity heartbeat, so they never
     // trip this backstop.
@@ -270,6 +272,23 @@ export function resolveAgentWatchdogPolicy(agent, overrides = {}) {
   };
 }
 
+// How far keepalives may extend liveness past the last real progress, as a
+// multiple of the idle budget. Anthropic pings across legitimate generation
+// gaps (adaptive thinking, a buffered tool input), but a wedged stream that
+// pings forever must still die.
+export const KEEPALIVE_MAX_IDLE_MULTIPLIER = 3;
+
+// A keepalive newer than the last real progress holds the idle abort while it
+// is itself fresh and the silence is within the cap. The runtime records one
+// only after the request's first semantic event, so a ping before it never
+// reaches here (the first-output window owns that phase).
+function keepaliveHoldsIdle(snapshot, last, now, idleStaleMs) {
+  const keepaliveAt = snapshot.lastKeepaliveAt || 0;
+  return (
+    keepaliveAt > last && now - keepaliveAt <= idleStaleMs && now - last <= idleStaleMs * KEEPALIVE_MAX_IDLE_MULTIPLIER
+  );
+}
+
 export function evaluateAgentWatchdogAbort(snapshot, now, policy) {
   if (!snapshot || !policy) return null;
   // A turn blocked on the user's tool approval (its own, or a sub-agent's that
@@ -285,7 +304,10 @@ export function evaluateAgentWatchdogAbort(snapshot, now, policy) {
   const firstSemanticMs = policy.firstSemanticMs ?? policy.firstVisibleCeilingMs ?? 0;
   // Independent fixed deadlines from request start. Transport can satisfy
   // only the transport deadline; it never switches, extends, or resets the
-  // semantic-response deadline.
+  // semantic-response deadline. Both are judged per logical model request
+  // (runtime-liveness): the request that carries tool results gets the same
+  // first-output allowance as the turn's first request, while a retry of a
+  // request keeps that request's clock and marks.
   if (snapshot.waitingForTransport && firstTransportMs > 0 && startedAt && now - startedAt > firstTransportMs) {
     return new AgentStallAbortError(`agent first transport stale (${firstTransportMs}ms)`);
   }
@@ -298,6 +320,7 @@ export function evaluateAgentWatchdogAbort(snapshot, now, policy) {
 
   const last = snapshot.lastProgressAt || snapshot.firstActivityAt;
   if (policy.idleStaleMs > 0 && last && now - last > policy.idleStaleMs) {
+    if (keepaliveHoldsIdle(snapshot, last, now, policy.idleStaleMs)) return null;
     return new AgentStallAbortError(`agent task stale (${policy.idleStaleMs}ms without stream/tool progress)`);
   }
 

package/src/runtime/agent/orchestrator/cache-break-trace.mjs

@@ -53,6 +53,7 @@ export function buildCacheBreakPayload(record = {}) {
     input_prefix_mismatch_actual_hash: cleanHash(record.inputPrefixMismatchActualHash),
     changed_blocks: cleanText(record.changedBlocks),
     system_markers_changed: typeof record.markersChanged === 'boolean' ? record.markersChanged : null,
+    lost_message_breakpoints: cleanText(record.lostMessageBreakpoints),
   };
   return Object.fromEntries(Object.entries(payload).filter(([, value]) => value !== null));
 }
@@ -81,6 +82,7 @@ function formatCacheBreakLine(record = {}) {
     ['noGuardBaseline', payload.missing_prefix_guard_baseline],
     ['changedBlocks', payload.changed_blocks],
     ['systemMarkersChanged', payload.system_markers_changed],
+    ['lostMessageBreakpoints', payload.lost_message_breakpoints],
   ].filter(([, value]) => value !== null && value !== undefined);
   return `[cache-break] ${fields.map(([key, value]) => (typeof value === 'string' ? `${key}=${JSON.stringify(value)}` : `${key}=${value}`)).join(' ')}`;
 }

package/src/runtime/agent/orchestrator/context/deferred-tools.mjs

@@ -100,7 +100,7 @@ export function buildDeferredToolManifest(entries) {
   list.sort((a, b) => a.name.localeCompare(b.name));
   return [
     '<available-deferred-tools>',
-    'Deferred tool names and selection triggers; schemas load on demand.',
+    'Deferred tools; load_tool loads their schemas.',
     ...list.map((entry) => (entry.description ? `- ${entry.name}: ${entry.description}` : `- ${entry.name}`)),
     '</available-deferred-tools>',
   ].join('\n');

package/src/runtime/agent/orchestrator/context/skill-catalog.mjs

@@ -669,7 +669,9 @@ export function buildSkillManifest(skills, { limit = 80, charBudget = SKILL_MANI
   for (const skill of visible) skill.trigger = compactPromptManifestText(skill.trigger, triggerCap);
   const lines = [
     '# available-skills',
-    'Selection triggers and linked tools for Skill({"name":"<skill-name>"}). mcp:<server> denotes that server’s tools.',
+    visible.some((skill) => skill.linkedTools.some((tool) => tool.startsWith('mcp:')))
+      ? 'Selection triggers and linked tools. mcp:<server> denotes that server’s tools.'
+      : 'Selection triggers and linked tools.',
     '<available_skills>',
     ...visible.map(
       (skill) => (skill.trigger ? `- ${skill.name}: ${skill.trigger}` : `- ${skill.name}`) + toolSuffix(skill)

package/src/runtime/agent/orchestrator/mcp/oauth-login.mjs

@@ -1,4 +1,5 @@
 import { createServer } from 'node:http';
+import { listenOnFetchSafePort } from '../../../shared/fetch-safe-listen.mjs';
 import { randomBytes } from 'node:crypto';
 import { normalizeMcpTransportUrl } from './client-config.mjs';
 import { identityFromTokenResponse } from './oauth-account.mjs';
@@ -48,8 +49,10 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
     await new Promise((resolve, reject) => {
       flow.listener.once('error', reject);
       // Retain the registered redirect URI if this connection later needs
-      // refresh or reauthorization; never register a different callback.
-      flow.listener.listen(creds.redirectUrl ? Number(new URL(creds.redirectUrl).port) : 0, '127.0.0.1', resolve);
+      // refresh or reauthorization; never register a different callback. A new
+      // one is a port the browser can be redirected to.
+      if (creds.redirectUrl) flow.listener.listen(Number(new URL(creds.redirectUrl).port), '127.0.0.1', resolve);
+      else listenOnFetchSafePort(flow.listener, '127.0.0.1', resolve);
     });
     creds.redirectUrl = `http://127.0.0.1:${flow.listener.address().port}/oauth/callback`;
   }

package/src/runtime/agent/orchestrator/providers/account-pool.mjs

@@ -244,6 +244,17 @@ function sessionAccountId(providerName, key, messages, options) {
   return null;
 }
 
+/** The account a send of `model` for `sessionId` would try first right now —
+ *  the session's binding and the choice poolSend makes for its first attempt
+ *  — or null when the provider has no roster account or none is eligible. */
+export function plannedAccountId(providerName, { sessionId = null, messages = [], providerState, model = '' } = {}) {
+  const pool = readProviderAccountPool(providerName);
+  if (!pool.accounts.length) return null;
+  const sessionKey = sessionId ? `${providerName}:${sessionId}` : null;
+  const boundId = sessionAccountId(providerName, sessionKey, messages, { providerState });
+  return chooseProviderAccount(pool, new Set(), Date.now(), model, { sessionAccountId: boundId })?.id || null;
+}
+
 // Stamp the serving account on the answer, independent of transport state,
 // with the account the session stays bound to (`bindingId`).
 function recordServingAccount(providerName, result, id, bindingId) {

package/src/runtime/agent/orchestrator/providers/anthropic-api-recovery.mjs

@@ -52,7 +52,7 @@ export function createAnthropicApiRecovery({
         : PROVIDER_NONSTREAM_TOTAL_TIMEOUT_MS;
     const lifetime = createTimeoutSignal(totalSignal, timeoutMs, `${label} Anthropic non-streaming fallback`);
     try {
-      const message = await transport.requestNonStreamingMessage(nonStreamingParams, lifetime.signal);
+      const message = await transport.requestNonStreamingMessage(nonStreamingParams, lifetime.signal, timeoutMs);
       return buildTurnResult(normalizeAnthropicNonStreamingResponse(message, useModel));
     } catch (error) {
       if (error instanceof AnthropicFallbackTriggeredError || totalSignal?.aborted) throw error;

package/src/runtime/agent/orchestrator/providers/anthropic-api-request.mjs

@@ -10,7 +10,11 @@
  * anthropic-turn-result.mjs); nothing here touches the socket.
  */
 import { prepareAnthropicImages } from './lib/anthropic-image-input.mjs';
-import { anthropicPrefixFingerprint, recordAnthropicPrefix } from './lib/anthropic-prefix-trace.mjs';
+import {
+  anthropicPrefixFingerprint,
+  anthropicPrefixSessionId,
+  recordAnthropicPrefix,
+} from './lib/anthropic-prefix-trace.mjs';
 import { buildAnthropicBetaHeaders, supportsAnthropicFastMode } from './anthropic-betas.mjs';
 import { applyAnthropicServerFallback } from './anthropic-server-fallback.mjs';
 import { fastModeAvailable } from './anthropic-fast-mode.mjs';
@@ -93,7 +97,7 @@ export async function buildAnthropicApiRequest({
   // Tools are resolved BEFORE the messages: the lowering needs the final
   // tool list to drop tool_reference blocks whose tool no longer ships
   // in this request (otherwise the API rejects the whole turn).
-  const requestTools = requestAnthropicTools(tools, chatMsgs, opts, name);
+  const requestTools = requestAnthropicTools(tools, chatMsgs, opts, name, config);
   // Message-tail cache budget (4-BP layout + ANTHROPIC_MSG_SLOTS) is
   // shared with anthropic-oauth — see resolveAnthropicMessageCacheSlots.
   const messageCacheSlots = resolveAnthropicMessageCacheSlots(systemBlocks, ttls, { tools: requestTools });
@@ -183,7 +187,7 @@ export async function buildAnthropicApiRequest({
   // (once) → mark → prepare image bytes → send.
   params.stream = true;
   // Diagnostic: per-block prefix hashes of exactly what is sent.
-  recordAnthropicPrefix(opts.sessionId || opts.session?.id || null, anthropicPrefixFingerprint(params));
+  recordAnthropicPrefix(anthropicPrefixSessionId(opts), anthropicPrefixFingerprint(params));
 
   const requestHeaders = requestHeadersFor(params, {
     config,

package/src/runtime/agent/orchestrator/providers/anthropic-api-transport.mjs

@@ -215,12 +215,18 @@ export function createAnthropicApiTransport({
     }
   };
 
-  const requestNonStreamingMessage = (nonStreamingParams, signal) =>
+  // `timeoutMs` is the replay's own lifetime, handed to the SDK as the request
+  // timeout: without an explicit one the SDK refuses any stream:false body
+  // whose max_tokens it estimates past 10 minutes before sending it.
+  const requestNonStreamingMessage = (nonStreamingParams, signal, timeoutMs) =>
     withRetry(
       withBodyRecovery(nonStreamingParams, async ({ signal: attemptSignal }) => {
         noteRequestServiceTier(nonStreamingParams.speed);
         try {
-          return await client.messages.create(nonStreamingParams, requestOptions(attemptSignal));
+          return await client.messages.create(nonStreamingParams, {
+            ...requestOptions(attemptSignal),
+            timeout: timeoutMs,
+          });
         } catch (err) {
           throw annotateHttpFailure(err);
         }

package/src/runtime/agent/orchestrator/providers/anthropic-max-tokens-recovery.mjs

@@ -22,11 +22,15 @@ export function parseMaxTokensContextOverflow(status, message) {
   const match = OVERFLOW_RE.exec(String(message || ''));
   if (!match) return null;
   const [inputTokens, maxTokens, contextLimit] = match.slice(1).map((value) => Number.parseInt(value, 10));
-  return [inputTokens, maxTokens, contextLimit].every(Number.isFinite) ? { inputTokens, maxTokens, contextLimit } : null;
+  return [inputTokens, maxTokens, contextLimit].every(Number.isFinite)
+    ? { inputTokens, maxTokens, contextLimit }
+    : null;
 }
 
 const thinkingBudget = (body) =>
-  body?.thinking?.type === 'enabled' && Number(body.thinking.budget_tokens) > 0 ? Number(body.thinking.budget_tokens) : 0;
+  body?.thinking?.type === 'enabled' && Number(body.thinking.budget_tokens) > 0
+    ? Number(body.thinking.budget_tokens)
+    : 0;
 
 /**
  * Shrink `body.max_tokens` to fit the reported context. Returns true when the

package/src/runtime/agent/orchestrator/providers/anthropic-messages.mjs

@@ -159,8 +159,8 @@ function deferredAnthropicTools(activeTools, messages, opts, provider = 'anthrop
   return sharedDeferredAnthropicTools(activeTools, messages, opts, provider);
 }
 // `provider`: the engine's name (a gateway Messages engine runs under its gateway's).
-export function requestAnthropicTools(tools, messages, opts, provider = 'anthropic') {
-  return sharedRequestAnthropicTools(tools, messages, opts, provider);
+export function requestAnthropicTools(tools, messages, opts, provider = 'anthropic', config = {}) {
+  return sharedRequestAnthropicTools(tools, messages, opts, provider, config);
 }
 // Test-only: expose the lowering so the steering-provenance test can assert
 // the API-key provider keeps steering-tagged user turns distinct (mirrors

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-request/initial-status.mjs

@@ -50,7 +50,9 @@ export function anthropicQuotaError(status, headers, bodyText = '') {
   const detail = bodyText ? `: ${String(bodyText).slice(0, 200)}` : '';
   const retry = retryAfter ? ` retryAfter=${retryAfter}` : '';
   const quota = hasQuotaHeaders(headers);
-  const err = new Error(`Anthropic OAuth API ${status} ${quota ? 'quota/rate limit' : 'request rejected'}${retry}${detail}`);
+  const err = new Error(
+    `Anthropic OAuth API ${status} ${quota ? 'quota/rate limit' : 'request rejected'}${retry}${detail}`
+  );
   err.name = quota ? 'ProviderQuotaError' : 'ProviderRequestRejectedError';
   err.headers = headers;
   err.response = { status, headers };

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -8,6 +8,7 @@
 import { traceAgentSse, traceAgentUsage } from '../agent-trace.mjs';
 import {
   anthropicPrefixFingerprint,
+  anthropicPrefixSessionId,
   latestAnthropicPrefix,
   recordAnthropicPrefix,
 } from './lib/anthropic-prefix-trace.mjs';
@@ -555,7 +556,7 @@ export class AnthropicOAuthProvider {
     const body = buildRequestBody(messages, useModel, tools, sendOpts);
     body.messages = await prepareAnthropicImages(body.messages, { signal: externalSignal });
     // Diagnostic: per-block prefix hashes of exactly what is sent.
-    recordAnthropicPrefix(opts.sessionId || null, anthropicPrefixFingerprint(body));
+    recordAnthropicPrefix(anthropicPrefixSessionId(opts), anthropicPrefixFingerprint(body));
     if (body.speed === 'fast') {
       this.fastModeBetaHeaderLatched = true;
     }
@@ -652,6 +653,7 @@ export class AnthropicOAuthProvider {
             iteration,
             useModel,
             requestKind: opts.requestKind || null,
+            prefixSessionId: anthropicPrefixSessionId(opts),
           });
           tagMidstreamRetries(result, attemptIndex);
           return result;
@@ -887,7 +889,16 @@ export class AnthropicOAuthProvider {
   }
 
   // Traces + catalog upkeep for a streamed turn, then the empty-stream guard.
-  _settleStreamedTurn({ result, midState, sseStartedAt, sessionId, iteration, useModel, requestKind }) {
+  _settleStreamedTurn({
+    result,
+    midState,
+    sseStartedAt,
+    sessionId,
+    iteration,
+    useModel,
+    requestKind,
+    prefixSessionId,
+  }) {
     const ttftMs = midState.ttftAt ? midState.ttftAt - sseStartedAt : null;
     const liveModel = result.model || useModel;
     traceAgentSse({
@@ -912,7 +923,7 @@ export class AnthropicOAuthProvider {
       rawUsage: result.usage?.raw || null,
       provider: 'anthropic-oauth',
       requestKind,
-      prefixBlocks: latestAnthropicPrefix(sessionId),
+      prefixBlocks: latestAnthropicPrefix(prefixSessionId),
     });
 
     // Phase I: if the live response surfaced a model id we don't know

package/src/runtime/agent/orchestrator/providers/anthropic-sse.mjs

@@ -161,6 +161,12 @@ function applyAnthropicSseEvent(framedEvent, { turn, watchdogs, state, progress,
         return false;
       case 'message_delta':
         return turn.onMessageDelta(event);
+      case 'ping':
+        // Anthropic bridges long generation gaps (adaptive thinking, a buffered
+        // tool input) with `ping` events. A distinct kind, not 'semantic': the
+        // agent watchdog decides how far a keepalive may extend liveness.
+        progress('keepalive');
+        return false;
       case 'message_stop':
         turn.onMessageStop();
         // Anthropic streams can keep emitting `:ping` keepalive frames after

package/src/runtime/agent/orchestrator/providers/anthropic-turn-result.mjs

@@ -11,7 +11,7 @@
  */
 import { traceAgentUsage } from '../agent-trace.mjs';
 import { reportedCostUsd } from './lib/usage-primitives.mjs';
-import { latestAnthropicPrefix } from './lib/anthropic-prefix-trace.mjs';
+import { anthropicPrefixSessionId, latestAnthropicPrefix } from './lib/anthropic-prefix-trace.mjs';
 
 /**
  * @param {object} parseResult  the assembled turn (streaming or normalized non-streaming)
@@ -48,7 +48,7 @@ export function buildAnthropicTurnResult(parseResult, { provider, useModel, opts
       // Anthropic usage is additive at this inner transport
       // boundary, even when OpenCode Go supplies the provider id.
       inputTokensInclusive: false,
-      prefixBlocks: latestAnthropicPrefix(opts.sessionId || opts.session?.id || null),
+      prefixBlocks: latestAnthropicPrefix(anthropicPrefixSessionId(opts)),
     });
   }