mixdog 1.4.0 → 1.4.2

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-credentials.mjs

@@ -22,7 +22,12 @@ import {
   expiryFromAccessToken,
   isDefinitiveOAuthFailure,
   normalizeAccountIdentity,
+  oauthBodySummary,
   oauthCredentialStatus,
+  oauthFailureReason,
+  oauthPublicError,
+  oauthRequestError,
+  oauthResponseJson,
   scrubOAuthSecrets,
 } from './lib/oauth-token-utils.mjs';
 import { createOAuthPkce, parseOAuthCodeInput } from './lib/oauth-pkce.mjs';
@@ -271,7 +276,7 @@ export function _scrubTokens(text, secretValues = []) {
 }
 
 function _tokenEndpointError(operation, status, text, secretValues = []) {
-  const safeDetail = _scrubTokens(text, secretValues).replace(/\s+/g, ' ').trim().slice(0, 500);
+  const safeDetail = oauthBodySummary(text, secretValues);
   const detail = safeDetail ? `: ${safeDetail}` : '';
   const compatibility =
     status === 403
@@ -282,7 +287,7 @@ function _tokenEndpointError(operation, status, text, secretValues = []) {
         ' update Mixdog or set MIXDOG_CLI_VERSION to the installed official Claude Code version;' +
         ' then retry sign-in via /providers without an intercepting network layer if applicable.'
       : '';
-  return new Error(`${operation} ${status}${detail}.${compatibility}`);
+  return oauthPublicError(new Error(`${operation} ${status}${detail}.${compatibility}`));
 }
 
 export function isAnthropicOAuthRefreshDisabled() {
@@ -578,21 +583,26 @@ async function exchangeAuthorizationCode({ pkce, code, state, redirectUri, signa
   const cleanCode = String(code || '').trim();
   if (!cleanCode) throw new Error('[anthropic-oauth] authorization code is required');
   const timeoutSignal = AbortSignal.timeout(OAUTH_TOKEN_TIMEOUT_MS);
-  const tokenRes = await fetch(TOKEN_URL, {
-    method: 'POST',
-    headers: tokenEndpointHeaders(),
-    body: JSON.stringify({
-      grant_type: 'authorization_code',
-      code: cleanCode,
-      redirect_uri: redirectUri,
-      client_id: CLAUDE_CODE_CLIENT_ID,
-      code_verifier: pkce.verifier,
-      state,
-    }),
-    redirect: 'error',
-    signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal,
-    dispatcher: getLlmDispatcher(),
-  });
+  let tokenRes;
+  try {
+    tokenRes = await fetch(TOKEN_URL, {
+      method: 'POST',
+      headers: tokenEndpointHeaders(),
+      body: JSON.stringify({
+        grant_type: 'authorization_code',
+        code: cleanCode,
+        redirect_uri: redirectUri,
+        client_id: CLAUDE_CODE_CLIENT_ID,
+        code_verifier: pkce.verifier,
+        state,
+      }),
+      redirect: 'error',
+      signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal,
+      dispatcher: getLlmDispatcher(),
+    });
+  } catch (err) {
+    throw oauthRequestError('[anthropic-oauth] token exchange', err);
+  }
   if (!tokenRes.ok) {
     const text = await tokenRes.text().catch(() => '');
     throw _tokenEndpointError('[anthropic-oauth] token exchange', tokenRes.status, text, [
@@ -601,7 +611,7 @@ async function exchangeAuthorizationCode({ pkce, code, state, redirectUri, signa
       state,
     ]);
   }
-  const json = await tokenRes.json();
+  const json = await oauthResponseJson(tokenRes, '[anthropic-oauth] token exchange');
   const accessToken = json?.access_token || json?.accessToken;
   const refreshToken = json?.refresh_token || json?.refreshToken;
   if (!accessToken || !refreshToken) {
@@ -727,10 +737,10 @@ export async function beginOAuthLogin({ openBrowserFn = null, openBrowser = true
         await acceptCode(code, OAUTH_REDIRECT_URI);
         res.writeHead(200, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE, Connection: 'close' });
         res.end(oauthSuccessHtml('Claude'));
-      } catch {
-        // The shared exchange reports its error through waitForCallback.
+      } catch (err) {
+        // The shared exchange also reports its error through waitForCallback.
         res.writeHead(500, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE, Connection: 'close' });
-        res.end(oauthErrorHtml('Claude could not complete the token exchange.'));
+        res.end(oauthErrorHtml(oauthFailureReason('Claude could not complete the token exchange.', err)));
       }
     });
     timeout = setTimeout(() => finish(null), OAUTH_LOGIN_TIMEOUT_MS);

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-request/initial-status.mjs

@@ -50,7 +50,9 @@ export function anthropicQuotaError(status, headers, bodyText = '') {
   const detail = bodyText ? `: ${String(bodyText).slice(0, 200)}` : '';
   const retry = retryAfter ? ` retryAfter=${retryAfter}` : '';
   const quota = hasQuotaHeaders(headers);
-  const err = new Error(`Anthropic OAuth API ${status} ${quota ? 'quota/rate limit' : 'request rejected'}${retry}${detail}`);
+  const err = new Error(
+    `Anthropic OAuth API ${status} ${quota ? 'quota/rate limit' : 'request rejected'}${retry}${detail}`
+  );
   err.name = quota ? 'ProviderQuotaError' : 'ProviderRequestRejectedError';
   err.headers = headers;
   err.response = { status, headers };

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -8,6 +8,7 @@
 import { traceAgentSse, traceAgentUsage } from '../agent-trace.mjs';
 import {
   anthropicPrefixFingerprint,
+  anthropicPrefixSessionId,
   latestAnthropicPrefix,
   recordAnthropicPrefix,
 } from './lib/anthropic-prefix-trace.mjs';
@@ -555,7 +556,7 @@ export class AnthropicOAuthProvider {
     const body = buildRequestBody(messages, useModel, tools, sendOpts);
     body.messages = await prepareAnthropicImages(body.messages, { signal: externalSignal });
     // Diagnostic: per-block prefix hashes of exactly what is sent.
-    recordAnthropicPrefix(opts.sessionId || null, anthropicPrefixFingerprint(body));
+    recordAnthropicPrefix(anthropicPrefixSessionId(opts), anthropicPrefixFingerprint(body));
     if (body.speed === 'fast') {
       this.fastModeBetaHeaderLatched = true;
     }
@@ -652,6 +653,7 @@ export class AnthropicOAuthProvider {
             iteration,
             useModel,
             requestKind: opts.requestKind || null,
+            prefixSessionId: anthropicPrefixSessionId(opts),
           });
           tagMidstreamRetries(result, attemptIndex);
           return result;
@@ -887,7 +889,16 @@ export class AnthropicOAuthProvider {
   }
 
   // Traces + catalog upkeep for a streamed turn, then the empty-stream guard.
-  _settleStreamedTurn({ result, midState, sseStartedAt, sessionId, iteration, useModel, requestKind }) {
+  _settleStreamedTurn({
+    result,
+    midState,
+    sseStartedAt,
+    sessionId,
+    iteration,
+    useModel,
+    requestKind,
+    prefixSessionId,
+  }) {
     const ttftMs = midState.ttftAt ? midState.ttftAt - sseStartedAt : null;
     const liveModel = result.model || useModel;
     traceAgentSse({
@@ -912,7 +923,7 @@ export class AnthropicOAuthProvider {
       rawUsage: result.usage?.raw || null,
       provider: 'anthropic-oauth',
       requestKind,
-      prefixBlocks: latestAnthropicPrefix(sessionId),
+      prefixBlocks: latestAnthropicPrefix(prefixSessionId),
     });
 
     // Phase I: if the live response surfaced a model id we don't know

package/src/runtime/agent/orchestrator/providers/anthropic-sse.mjs

@@ -161,6 +161,12 @@ function applyAnthropicSseEvent(framedEvent, { turn, watchdogs, state, progress,
         return false;
       case 'message_delta':
         return turn.onMessageDelta(event);
+      case 'ping':
+        // Anthropic bridges long generation gaps (adaptive thinking, a buffered
+        // tool input) with `ping` events. A distinct kind, not 'semantic': the
+        // agent watchdog decides how far a keepalive may extend liveness.
+        progress('keepalive');
+        return false;
       case 'message_stop':
         turn.onMessageStop();
         // Anthropic streams can keep emitting `:ping` keepalive frames after

package/src/runtime/agent/orchestrator/providers/anthropic-turn-result.mjs

@@ -11,7 +11,7 @@
  */
 import { traceAgentUsage } from '../agent-trace.mjs';
 import { reportedCostUsd } from './lib/usage-primitives.mjs';
-import { latestAnthropicPrefix } from './lib/anthropic-prefix-trace.mjs';
+import { anthropicPrefixSessionId, latestAnthropicPrefix } from './lib/anthropic-prefix-trace.mjs';
 
 /**
  * @param {object} parseResult  the assembled turn (streaming or normalized non-streaming)
@@ -48,7 +48,7 @@ export function buildAnthropicTurnResult(parseResult, { provider, useModel, opts
       // Anthropic usage is additive at this inner transport
       // boundary, even when OpenCode Go supplies the provider id.
       inputTokensInclusive: false,
-      prefixBlocks: latestAnthropicPrefix(opts.sessionId || opts.session?.id || null),
+      prefixBlocks: latestAnthropicPrefix(anthropicPrefixSessionId(opts)),
     });
   }
 

package/src/runtime/agent/orchestrator/providers/antigravity-oauth-login.mjs

@@ -266,7 +266,9 @@ export async function exchangeAuthorizationCode({ code, verifier, fetchFn = fetc
   });
   if (!res.ok) {
     const text = await res.text().catch(() => '');
-    throw new Error(`[antigravity-oauth] token exchange ${res.status}: ${_scrubTokens(text).slice(0, 300)}`);
+    // The authorization code is redacted by value: `code` alone is not a secret field.
+    const detail = _scrubTokens(text, [cleanCode, verifier]).slice(0, 300);
+    throw new Error(`[antigravity-oauth] token exchange ${res.status}: ${detail}`);
   }
   const json = await res.json();
   if (!json?.access_token || !json?.refresh_token) {

package/src/runtime/agent/orchestrator/providers/antigravity-oauth-tokens.mjs

@@ -231,8 +231,8 @@ export function saveTokens(tokens) {
   );
 }
 
-export function _scrubTokens(text) {
-  return scrubOAuthSecrets(text);
+export function _scrubTokens(text, secretValues = []) {
+  return scrubOAuthSecrets(text, secretValues);
 }
 
 export function hasAntigravityOAuthCredentials() {

package/src/runtime/agent/orchestrator/providers/codex-client-meta.mjs

@@ -20,7 +20,7 @@ import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
 // version (gpt-6.1-sol requires >= 0.159.0, measured 2026-10-09), so the
 // release workflow raises this to the published CLI version on every release
 // (scripts/sync-client-version-floors.mjs).
-export const CODEX_CLIENT_VERSION_FLOOR = '0.164.0';
+export const CODEX_CLIENT_VERSION_FLOOR = '0.165.0';
 export const CODEX_CLI_NPM_PACKAGE = '@openai/codex';
 const live = createNpmVersionSource(CODEX_CLI_NPM_PACKAGE, { persistKey: 'codex-cli' });
 

package/src/runtime/agent/orchestrator/providers/command-code-oauth-login.mjs

@@ -3,6 +3,7 @@
 // A pasted key or pasted callback JSON completes the same login by hand. The
 // first sign-in on a machine adopts an existing Command Code CLI login instead.
 import { createServer } from 'node:http';
+import { listenOn } from './lib/listen-on.mjs';
 import { randomBytes } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -95,16 +96,6 @@ function readLocalAuth(path) {
   }
 }
 
-function listenOn(server, port, host) {
-  return new Promise((resolve, reject) => {
-    server.once('error', reject);
-    server.listen(port, host, () => {
-      server.off('error', reject);
-      resolve();
-    });
-  });
-}
-
 function readBody(req) {
   return new Promise((resolve, reject) => {
     const chunks = [];

package/src/runtime/agent/orchestrator/providers/command-code-oauth.mjs

@@ -361,7 +361,7 @@ export class CommandCodeOAuthProvider {
     if (Array.isArray(body?.data)) list = body.data;
     else if (Array.isArray(body)) list = body;
     const items = list.filter((item) => modelWire(item));
-    publish(items.map(rosterRow));
+    await publish(items.map(rosterRow));
     if (this.tokens?.apiKey === apiKey) {
       // Rows accumulate for one key: a later roster that misses a model
       // leaves the endpoints it was last listed with.

package/src/runtime/agent/orchestrator/providers/cursor.mjs

@@ -677,6 +677,9 @@ class CursorProviderBase {
       return await consumeCompatChatCompletionStream(responseSseEvents(response, signal), {
         signal,
         label: this.name,
+        // The wrapper below always exists; the stream joins the session's
+        // logical request only when the caller reports progress into it.
+        sessionId: typeof sendOpts.onStreamDelta === 'function' ? sendOpts.sessionId : null,
         onStreamDelta: (delta) => {
           sendOpts.onStreamDelta?.(delta);
         },

package/src/runtime/agent/orchestrator/providers/custom-provider-config.mjs

@@ -12,13 +12,21 @@ export const CUSTOM_REASONING_LEVELS = CUSTOM_EFFORT_LEVELS;
 export const CUSTOM_REASONING_WIRE_FORMATS = Object.freeze(['standard', 'deepseek', 'together', 'vllm']);
 export const CUSTOM_PROVIDER_AUTH_MODES = Object.freeze(['key', 'none']);
 export const CUSTOM_MODEL_OVERRIDE_LIMIT = 500;
+export const CUSTOM_HEADER_LIMIT = 64;
 
 const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
 const MAX_MODEL_ID = 256;
 const MAX_NAME = 200;
 const MAX_WIRE_VALUE = 64;
+const MAX_HEADER_TEXT = 4096;
 // biome-ignore lint/suspicious/noControlCharactersInRegex: rejecting control characters is the point.
 const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+// RFC 9110 field-name token, and a field value of visible ASCII, space, tab and
+// obs-text (what a fetch Headers value can carry).
+const HEADER_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+const HEADER_VALUE = /^[\t\x20-\x7e\x80-\xff]*$/;
+// The API key field owns authentication; a header may not carry a credential.
+const AUTH_HEADERS = new Set(['authorization', 'x-api-key', 'api-key']);
 
 function fail(message) {
   throw new Error(`[custom-provider] ${message}`);
@@ -84,6 +92,7 @@ const V2_TOP_LEVEL_KEYS = new Set([
   'modelOverrides',
   'wires',
   'modelWires',
+  'headers',
   'id',
   'apiKey',
   'apiKeyEnv',
@@ -295,6 +304,34 @@ function normalizeModelWires(raw, protocol, wires) {
   return out;
 }
 
+// `headers`: extra HTTP headers sent with every request to the endpoint
+// (inference, model discovery, connection test). Names are case-insensitive
+// tokens; the credential headers belong to the API key field.
+function normalizeHeaders(raw) {
+  if (raw === undefined) return {};
+  if (!isPlainObject(raw)) fail('headers must be an object of header names to string values');
+  const names = Object.keys(raw);
+  if (names.length > CUSTOM_HEADER_LIMIT) fail(`at most ${CUSTOM_HEADER_LIMIT} headers are allowed`);
+  const seen = new Set();
+  const entries = [];
+  for (const name of names) {
+    if (name.length > MAX_HEADER_TEXT || !HEADER_NAME.test(name))
+      fail(`headers has an invalid header name: ${JSON.stringify(name.slice(0, 64))}`);
+    const lower = name.toLowerCase();
+    if (AUTH_HEADERS.has(lower)) fail(`headers must not set ${name}: authentication belongs to the API key field`);
+    if (seen.has(lower)) fail(`headers has duplicate header: ${name}`);
+    seen.add(lower);
+    if (typeof raw[name] !== 'string') fail(`headers.${name} must be a string`);
+    // Validate before trimming, and trim only HTTP whitespace (space, tab), so
+    // CR/LF is refused rather than stripped and other characters are kept.
+    if (!HEADER_VALUE.test(raw[name])) fail(`headers.${name} has an invalid value`);
+    const value = raw[name].replace(/^[ \t]+|[ \t]+$/g, '');
+    if (value.length > MAX_HEADER_TEXT) fail(`headers.${name} has an invalid value`);
+    entries.push([name, value]);
+  }
+  return Object.fromEntries(entries);
+}
+
 // Legacy (pre-v2) `models: [{ id, name?, contextWindow?, maxOutputTokens? }]`
 // become manual, visible overrides; their presence hides newly discovered ids.
 function migrateLegacy(input) {
@@ -336,6 +373,7 @@ export function normalizeCustomProviderConfig(input) {
       fail('modelOverrides and discovery require schemaVersion 2');
     if (input.wires !== undefined || input.modelWires !== undefined)
       fail('wires and modelWires require schemaVersion 2');
+    if (input.headers !== undefined) fail('headers require schemaVersion 2');
     source = migrateLegacy(input);
   } else if (Number.isInteger(version) && version > CUSTOM_PROVIDER_SCHEMA_VERSION)
     fail(`unsupported schemaVersion ${version}; update mixdog to use this provider`);
@@ -368,6 +406,7 @@ export function normalizeCustomProviderConfig(input) {
   const newModelsHidden = optionalBoolean(discovery.newModelsHidden, 'discovery.newModelsHidden') ?? false;
   const wires = normalizeWires(source.wires, protocol);
   const modelWires = normalizeModelWires(source.modelWires, protocol, wires);
+  const headers = normalizeHeaders(source.headers);
   return {
     type: 'custom',
     schemaVersion: CUSTOM_PROVIDER_SCHEMA_VERSION,
@@ -377,6 +416,7 @@ export function normalizeCustomProviderConfig(input) {
     enabled: source.enabled !== false,
     auth,
     ...(apiKeyEnv && auth === 'key' ? { apiKeyEnv } : {}),
+    ...(Object.keys(headers).length ? { headers } : {}),
     discovery: { newModelsHidden },
     modelOverrides: normalizeOverrides(source.modelOverrides, protocol, legacy),
     ...(wires ? { wires } : {}),

package/src/runtime/agent/orchestrator/providers/custom-provider-keys.mjs

@@ -0,0 +1,34 @@
+// The engine a custom provider sends with when one of its additional API keys
+// serves (account-pool.mjs `createCustomKeyPoolProvider`). Every key reaches
+// the same endpoint, so the engine is a view of the primary instance: the
+// catalog, discovered models, wire routes and settings stay the primary's,
+// and only the credential and the client built from it are the key's own.
+
+import { readCustomProviderKey } from '../../../shared/custom-provider-keys.mjs';
+
+function keyView(engine, providerId, keyId, key) {
+  const view = Object.create(engine);
+  const rekey = (value) => {
+    // The key is the only source: an environment variable names the primary key alone.
+    view.config = { ...engine.config, apiKey: value, apiKeyEnv: undefined };
+    view.apiKey = value;
+    view.client = view._createClient(value);
+  };
+  rekey(key);
+  // An auth retry re-reads this key, never the primary's keychain entry.
+  view.reloadApiKey = () => {
+    const fresh = readCustomProviderKey(providerId, keyId);
+    if (fresh) rekey(fresh);
+  };
+  return view;
+}
+
+/** `primary` sending with additional key `keyId` of custom provider `providerId`. */
+export function customKeyEngine(primary, providerId, keyId) {
+  const key = readCustomProviderKey(providerId, keyId);
+  if (!key) throw new Error(`An additional API key of ${providerId} is not readable; enter it again in its settings.`);
+  const engine = keyView(primary, providerId, keyId, key);
+  // A Messages-wire route sends through the bound Anthropic engine.
+  if (primary.messagesEngine) engine.messagesEngine = keyView(primary.messagesEngine, providerId, keyId, key);
+  return engine;
+}

package/src/runtime/agent/orchestrator/providers/custom-provider.mjs

@@ -120,6 +120,7 @@ async function discoverAnthropicModels(provider, signal, timeoutMs = DISCOVERY_T
     headers: {
       ...(provider._customKeyless ? {} : { 'x-api-key': provider._customKey() }),
       'anthropic-version': ANTHROPIC_VERSION,
+      ...(provider.config.extraHeaders || {}),
     },
   });
   if (!res.ok) throw Object.assign(new Error(`${provider.name} models ${res.status}`), { status: res.status });
@@ -153,6 +154,8 @@ export async function createCustomProvider(id, config) {
     apiKey: apiKey || undefined,
     ...(cfg.apiKeyEnv ? { apiKeyEnv: cfg.apiKeyEnv } : {}),
     ...(keyless ? { keyless: true } : {}),
+    // User-defined headers ride the engines' existing `extraHeaders` path.
+    ...(cfg.headers ? { extraHeaders: cfg.headers } : {}),
     ...(config.preconnect === false ? { preconnect: false } : {}),
   };
   let provider;

package/src/runtime/agent/orchestrator/providers/devin-auth.mjs

@@ -14,6 +14,10 @@ import {
   decodeJwtPayload,
   expiryFromAccessToken,
   normalizeAccountIdentity,
+  OAUTH_NETWORK_HINT,
+  oauthFailureReason,
+  oauthNetworkCause,
+  oauthPublicError,
 } from './lib/oauth-token-utils.mjs';
 
 const AUTHORIZE_URL = 'https://app.devin.ai/auth/cli/continue';
@@ -46,9 +50,11 @@ export const DEVIN_OAUTH_FAILURE_CODES = Object.freeze([
   'DEVIN_OAUTH_TOKEN_EXCHANGE_FAILED',
 ]);
 
+// Built from fixed text, statuses and error codes only, so a failure page may
+// show it; response bodies are never quoted (they may carry the login token).
 function loginFailure(code, text, props = {}) {
   const failureCode = `DEVIN_OAUTH_${code}`;
-  return Object.assign(new Error(`${failureCode}: ${text}`), { failureCode }, props);
+  return oauthPublicError(Object.assign(new Error(`${failureCode}: ${text}`), { failureCode }, props));
 }
 
 function credentialsPath() {
@@ -175,12 +181,13 @@ export async function exchangeDevinCode(code, verifier, { fetchFn = fetch, signa
     });
   } catch (error) {
     // A cancelled login keeps its own abort; any other failure to get an
-    // answer (network, timeout) is a coded exchange failure. The cause is not
-    // quoted: only its kind is.
+    // answer (network, timeout) is a coded exchange failure. Its message is
+    // not quoted: only its error code.
     if (signal?.aborted) throw error;
+    const cause = oauthNetworkCause(error) || 'network error';
     throw loginFailure(
       'TOKEN_EXCHANGE_FAILED',
-      error?.name === 'TimeoutError' ? 'Devin token exchange timed out' : 'Devin token exchange request failed'
+      `Devin token exchange request failed (${cause}). ${OAUTH_NETWORK_HINT}`
     );
   }
   // Response bodies may carry the login token itself, so none is ever quoted
@@ -341,9 +348,9 @@ async function startDevinOAuthLogin({ openBrowser = true, timeoutMs = LOGIN_TIME
     try {
       await acceptCode(code);
       reply(res, 200, oauthSuccessHtml('Devin'));
-    } catch {
-      // The shared exchange reports its error through waitForCallback.
-      reply(res, 500, oauthErrorHtml('Devin could not complete the token exchange.'));
+    } catch (error) {
+      // The shared exchange also reports its error through waitForCallback.
+      reply(res, 500, oauthErrorHtml(oauthFailureReason('Devin could not complete the token exchange.', error)));
     }
   };
 

package/src/runtime/agent/orchestrator/providers/devin-wire-transport.mjs

@@ -190,10 +190,11 @@ function connectError(
   const finalCode = tooLarge ? 'request_too_large' : mixdogCode;
   const head = `Devin ${operation} ${code || 'error'}${status ? ` (HTTP ${status})` : ''}`;
   const text = [head, detail].filter(Boolean).join(': ') + (detailsSummary ? ` [details: ${detailsSummary}]` : '');
+  // A reworded throttle reports its throttle status, not the carrier's.
+  const carrierStatus = reworded ? mappedStatus : status || mappedStatus;
   const error = new DevinWireError(text, {
     code: finalCode,
-    // A reworded throttle reports its throttle status, not the carrier's.
-    status: tooLarge ? 413 : (reworded ? mappedStatus : status || mappedStatus),
+    status: tooLarge ? 413 : carrierStatus,
     retryable: tooLarge ? false : retryable,
     connectCode: code,
     detail: [detail, detailsSummary].filter(Boolean).join(' '),

package/src/runtime/agent/orchestrator/providers/devin.mjs

@@ -405,6 +405,9 @@ export class DevinOAuthProvider {
         signal,
         label: this.name,
         providerName: this.name,
+        // The wrapper below always exists; the stream joins the session's
+        // logical request only when the caller reports progress into it.
+        sessionId: typeof sendOpts.onStreamDelta === 'function' ? sendOpts.sessionId : null,
         onStreamDelta: (delta) => {
           if (!streaming) {
             streaming = true;

package/src/runtime/agent/orchestrator/providers/gemini-response.mjs

@@ -115,7 +115,7 @@ export function geminiFailureUsage(opts, cachedContent, useModel) {
   };
 }
 
-export function resolveGeminiUsage(response, opts, cachedContent, useModel) {
+export function resolveGeminiUsage(response, opts, cachedContent, useModel, provider = 'gemini') {
   const um = response.usageMetadata || null;
   if (!um) return null;
   const iteration = Number.isFinite(Number(opts.iteration)) ? Number(opts.iteration) : null;
@@ -143,7 +143,7 @@ export function resolveGeminiUsage(response, opts, cachedContent, useModel) {
     model: useModel,
     modelDisplay: useModel,
     rawUsage: um,
-    provider: 'gemini',
+    provider,
   });
   return resolvedUsage;
 }

package/src/runtime/agent/orchestrator/providers/gemini-stream.mjs

@@ -589,6 +589,9 @@ export async function consumeGeminiRestStreamResponse(
     onChunk = null,
     failureUsage = null,
     firstByteTimeoutMs = GEMINI_FIRST_BYTE_TIMEOUT_MS,
+    // A first-byte window longer than the idle window must govern alone until
+    // the first payload, or the idle timer would cut the wait short.
+    idleAfterFirstChunk = false,
   }
 ) {
   const unwrap =
@@ -649,7 +652,7 @@ export async function consumeGeminiRestStreamResponse(
   }
 
   try {
-    watchdogs.resetIdle();
+    if (!idleAfterFirstChunk) watchdogs.resetIdle();
     while (true) {
       let chunk;
       try {