mixdog 1.4.0 → 1.4.2

package/src/runtime/agent/orchestrator/providers/lib/oauth-page.mjs

@@ -40,7 +40,6 @@ const COPY = {
     failureTitle: '로그인 실패',
     failureBody: 'Mixdog로 돌아가 다시 시도해 주세요.',
     reason: '사유',
-    close: '닫기',
   },
   en: {
     successTitle: 'Sign-in complete',
@@ -48,7 +47,6 @@ const COPY = {
     failureTitle: 'Sign-in failed',
     failureBody: 'Return to Mixdog and try again.',
     reason: 'Reason',
-    close: 'Close',
   },
 };
 
@@ -69,7 +67,6 @@ function renderPage({ kind, providerName, reason, lang }) {
   const reasonBlock = reason
     ? `<div class="reason"><span>${langs.map((code) => COPY[code].reason).join(' / ')}</span>${escapeHtml(reason)}</div>`
     : '';
-  const close = langs.map((code) => COPY[code].close).join(' · ');
   const documentTitle = escapeHtml(
     `${langs.map((code) => COPY[code][kind === 'success' ? 'successTitle' : 'failureTitle']).join(' / ')} · Mixdog`
   );
@@ -130,20 +127,6 @@ function renderPage({ kind, providerName, reason, lang }) {
       word-break: break-word;
     }
     .reason span { display: block; margin-bottom: 4px; color: var(--muted); font-family: inherit; font-size: 12px; }
-    button {
-      margin-top: 24px;
-      min-width: 120px;
-      height: 40px;
-      padding: 0 20px;
-      border: 1px solid var(--line);
-      border-radius: 10px;
-      background: transparent;
-      color: var(--fg);
-      font: inherit;
-      font-size: 14px;
-      cursor: pointer;
-    }
-    button:hover { border-color: var(--muted); }
   </style>
 </head>
 <body>
@@ -151,7 +134,6 @@ function renderPage({ kind, providerName, reason, lang }) {
     <div class="logo">${LOGO_SVG}</div>
     ${blocks}
     ${reasonBlock}
-    <button type="button" onclick="window.close()">${escapeHtml(close)}</button>
   </main>
 </body>
 </html>`;

package/src/runtime/agent/orchestrator/providers/lib/oauth-token-utils.mjs

@@ -140,14 +140,28 @@ export function isDefinitiveOAuthFailure(text, status = 0) {
   return s === 401;
 }
 
-export function scrubOAuthSecrets(text, secretValues = []) {
-  let scrubbed = String(text || '')
+// Fields whose string values are secrets, snake_case or camelCase. `code` is
+// not one: it is also every API's error/status code. The authorization code
+// is redacted by value — exchange paths pass it in `secretValues`.
+const SECRET_FIELD =
+  '(?:access_?token|refresh_?token|id_?token|client_?secret|code_?verifier|code_?challenge|device_?code|api_?key|token|key|secret|password|assertion)';
+const SECRET_KEY_RE = new RegExp(`^${SECRET_FIELD}$`, 'i');
+// Fallback for text that is not JSON. `"field": value` — a string (possibly
+// cut off) or a bare non-numeric value in malformed JSON.
+const JSON_SECRET_RE = new RegExp(
+  `"(${SECRET_FIELD})"\\s*:\\s*(?:"(?:[^"\\\\]|\\\\.)*"?|(?!-?\\d|true\\b|false\\b|null\\b)[^,}\\]\\s]+)`,
+  'gi'
+);
+// Form-encoded or query `field=value`.
+const FORM_SECRET_RE = new RegExp(`(^|[^A-Za-z0-9_])(${SECRET_FIELD})=[^&\\s"']*`, 'gi');
+const JWT_RE = /\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}(?:\.[A-Za-z0-9_-]*)?/g;
+
+// Bearer/JWT/Anthropic tokens and the given secret values, anywhere in `text`.
+function scrubTokenText(text, secretValues) {
+  let scrubbed = text
     .replace(/Bearer [A-Za-z0-9._-]+/gi, 'Bearer [REDACTED]')
     .replace(/sk-ant-[A-Za-z0-9._-]+/g, '[REDACTED]')
-    .replace(
-      /"(accessToken|refreshToken|access_token|refresh_token|code|key)"\s*:\s*"[^"]+"/g,
-      (_match, key) => `"${key}":"[REDACTED]"`
-    );
+    .replace(JWT_RE, '[REDACTED]');
   for (const secret of secretValues) {
     if (typeof secret === 'string' && secret) {
       scrubbed = scrubbed.split(secret).join('[REDACTED]');
@@ -155,3 +169,121 @@ export function scrubOAuthSecrets(text, secretValues = []) {
   }
   return scrubbed;
 }
+
+// A JSON object or array is redacted on its parsed form, so escaped key names
+// (`client\u005fsecret`) cannot slip past a pattern. Numbers keep their exact
+// source text; an untouched body is returned as it came. Null when `text` is
+// not a JSON object or array.
+function scrubJsonSecrets(text, secretValues) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text, (_key, value, context) =>
+      typeof value === 'number' ? JSON.rawJSON(context.source) : value
+    );
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== 'object' || JSON.isRawJSON(parsed)) return null;
+  let changed = false;
+  // Each decoded string (keys too) gets the full redaction: it may hold
+  // form-encoded fields, a query string or JSON of its own.
+  const scrubString = (value) => {
+    const scrubbed = scrubOAuthSecrets(value, secretValues);
+    if (scrubbed !== value) changed = true;
+    return scrubbed;
+  };
+  const walk = (value) => {
+    if (typeof value === 'string') return scrubString(value);
+    if (!value || typeof value !== 'object' || JSON.isRawJSON(value)) return value;
+    if (Array.isArray(value)) return value.map(walk);
+    return Object.fromEntries(
+      Object.entries(value).map(([key, inner]) => {
+        if (SECRET_KEY_RE.test(key) && typeof inner === 'string') {
+          changed = true;
+          return [key, '[REDACTED]'];
+        }
+        return [scrubString(key), walk(inner)];
+      })
+    );
+  };
+  const scrubbed = walk(parsed);
+  return changed ? JSON.stringify(scrubbed) : text;
+}
+
+/** Redact OAuth secrets from a body or message: secret fields (decoded JSON
+ *  keys, or JSON-like and form-encoded text), bearer/JWT/Anthropic tokens,
+ *  and the given values. Numeric and status codes are kept. */
+export function scrubOAuthSecrets(text, secretValues = []) {
+  const raw = String(text || '');
+  const json = scrubJsonSecrets(raw, secretValues);
+  if (json !== null) return json;
+  return scrubTokenText(
+    raw
+      .replace(JSON_SECRET_RE, (_match, key) => `"${key}":"[REDACTED]"`)
+      .replace(FORM_SECRET_RE, (_match, lead, key) => `${lead}${key}=[REDACTED]`),
+    secretValues
+  );
+}
+
+// --- Token-exchange failures a sign-in page may show ---
+
+export const OAUTH_NETWORK_HINT = 'Check your proxy/VPN: Mixdog uses the system proxy, or HTTPS_PROXY.';
+const NETWORK_CODE = /^(?:E[A-Z0-9]+|UND_ERR_[A-Z0-9_]+|ERR_[A-Z0-9_]+)$/;
+
+/**
+ * The transport cause of a fetch that got no answer: its error code
+ * (ECONNRESET, UND_ERR_CONNECT_TIMEOUT, ENOTFOUND…) or "timed out". Only codes,
+ * never messages, which may quote anything. Null for a cancel or a non-network
+ * error.
+ */
+export function oauthNetworkCause(error) {
+  if (!error || typeof error !== 'object' || error.name === 'AbortError') return null;
+  if (error.name === 'TimeoutError') return 'timed out';
+  for (let e = error, depth = 0; e && typeof e === 'object' && depth < 5; e = e.cause, depth += 1) {
+    if (typeof e.code === 'string' && NETWORK_CODE.test(e.code)) return e.code;
+  }
+  return error.name === 'TypeError' ? 'network error' : null;
+}
+
+// Errors whose message was built only from codes, statuses and redacted
+// bodies: the only ones a failure page quotes.
+const publicErrors = new WeakSet();
+
+/** Mark `error` as safe to show on the sign-in failure page. */
+export function oauthPublicError(error) {
+  publicErrors.add(error);
+  return error;
+}
+
+/** A fetch failure as `<operation> request failed (<cause>). <hint>`; other errors unchanged. */
+export function oauthRequestError(operation, error) {
+  const cause = oauthNetworkCause(error);
+  return cause ? oauthPublicError(new Error(`${operation} request failed (${cause}). ${OAUTH_NETWORK_HINT}`)) : error;
+}
+
+/** A token endpoint's body for an error message: secrets redacted, whitespace folded, shortened. */
+export function oauthBodySummary(text, secretValues = []) {
+  return scrubOAuthSecrets(text, secretValues).replace(/\s+/g, ' ').trim().slice(0, 500);
+}
+
+/** A token endpoint's HTTP failure as `<operation> <status>: <redacted body>`. */
+export function oauthHttpError(operation, status, text, secretValues = []) {
+  const summary = oauthBodySummary(text, secretValues);
+  return oauthPublicError(new Error(`${operation} ${status}${summary ? `: ${summary}` : ''}`));
+}
+
+/** The token response's JSON. A body that does not parse is named by its
+ *  status only: the parser's message quotes the body, tokens included. */
+export async function oauthResponseJson(response, operation) {
+  try {
+    return await response.json();
+  } catch (error) {
+    if (error?.name !== 'SyntaxError') throw oauthRequestError(operation, error);
+    throw oauthPublicError(new Error(`${operation} returned a malformed response (HTTP ${response.status})`));
+  }
+}
+
+/** The failure page reason: the summary, plus the error's message only when it is page-safe. */
+export function oauthFailureReason(summary, error) {
+  return error && publicErrors.has(error) ? `${summary}\n${error.message}` : summary;
+}

package/src/runtime/agent/orchestrator/providers/mimo-oauth-login.mjs

@@ -2,6 +2,7 @@
 // X25519 public key we send in the authorize URL; the reply (loopback redirect
 // or a pasted code) carries `u` = ephemeralPub(32) | nonce(12) | ciphertext | tag(16).
 import { createServer } from 'node:http';
+import { listenOn } from './lib/listen-on.mjs';
 import { lookup } from 'node:dns/promises';
 import { createDecipheriv, createHash, createPublicKey, diffieHellman, generateKeyPairSync } from 'node:crypto';
 import { openLoginUrl } from './lib/open-login-url.mjs';
@@ -112,16 +113,6 @@ async function loopbackAddresses() {
   return ['127.0.0.1'];
 }
 
-function listenOn(server, port, host) {
-  return new Promise((resolve, reject) => {
-    server.once('error', reject);
-    server.listen(port, host, () => {
-      server.off('error', reject);
-      resolve();
-    });
-  });
-}
-
 export async function beginOAuthLogin({
   openBrowser = true,
   timeoutMs = LOGIN_TIMEOUT_MS,

package/src/runtime/agent/orchestrator/providers/mimo-oauth.mjs

@@ -195,7 +195,7 @@ export class MimoOAuthProvider {
     // publishes nothing. `_listRows` revalidates `seq` and the key before
     // touching shared state, since enrichment runs after this returns.
     let published = true;
-    if (items.length) published = publish(items.map(rosterRow));
+    if (items.length) published = await publish(items.map(rosterRow));
     else items = seedModelItems();
     return { items, published, seq, apiKey };
   }

package/src/runtime/agent/orchestrator/providers/model-cache.mjs

@@ -1,7 +1,31 @@
 import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { getPluginData } from '../config.mjs';
-import { updateJsonAtomicSync, writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
+import { updateJsonAtomic, writeJsonAtomicAsync } from '../../../shared/atomic-file.mjs';
+
+// Disk writes never block the event loop: they run on the async atomic-file
+// primitives, one at a time per cache file, in the order they were requested
+// (a later write is never overtaken by an earlier one finishing late). Every
+// instance of one file shares these module-level tables, since several
+// instances and several providers can address the same path.
+const writeTails = new Map(); // path → tail of that file's write chain
+// path → JSON text of the newest save() whose write has not finished. Sync
+// readers see it, so a save is visible at once although its disk write is not.
+const unsettledSaves = new Map();
+
+function enqueueWrite(p, task) {
+  const run = (writeTails.get(p) ?? Promise.resolve()).then(task);
+  writeTails.set(p, run);
+  run.then(() => {
+    if (writeTails.get(p) === run) writeTails.delete(p);
+  });
+  return run;
+}
+
+/** Resolves once every cache write requested so far has settled (shutdown, tests). */
+export async function flushModelCacheWrites() {
+  while (writeTails.size) await Promise.all([...writeTails.values()]);
+}
 
 // Shared model-catalog disk-cache CRUD, parameterized over the small bits each
 // provider varies: cache file name, TTL, an optional schema-version gate, and an
@@ -15,9 +39,10 @@ export function makeModelCache({ fileName, ttlMs, version = null, onSave = null
   // allowStale skips the TTL only; the schema-version gate still applies.
   function loadEntrySync({ allowStale = false } = {}) {
     const p = path();
-    if (!existsSync(p)) return null;
+    const unsettled = unsettledSaves.get(p);
+    if (unsettled === undefined && !existsSync(p)) return null;
     try {
-      const raw = JSON.parse(readFileSync(p, 'utf-8'));
+      const raw = JSON.parse(unsettled ?? readFileSync(p, 'utf-8'));
       if (version != null && raw?.version !== version) return null;
       if (!raw?.fetchedAt || !Array.isArray(raw.models)) return null;
       if (!allowStale && Date.now() - raw.fetchedAt > ttlMs) return null;
@@ -31,56 +56,98 @@ export function makeModelCache({ fileName, ttlMs, version = null, onSave = null
     return loadEntrySync(options)?.models ?? null;
   }
 
+  // The in-memory state (sync readers, onSave mirror) updates at once; the
+  // returned promise settles, never rejecting, when the disk write has.
   function save(models, extra = {}) {
+    const p = path();
+    // The value as of this call: later mutation of `models` must not change
+    // what lands on disk (the old synchronous write captured it the same way).
+    let text;
+    let record;
+    try {
+      text = JSON.stringify({
+        ...extra,
+        ...(version != null ? { version } : {}),
+        fetchedAt: Date.now(),
+        models,
+      });
+      record = JSON.parse(text);
+      unsettledSaves.set(p, text);
+    } catch {
+      return Promise.resolve();
+    }
     try {
-      writeJsonAtomicSync(
-        path(),
-        {
-          ...extra,
-          ...(version != null ? { version } : {}),
-          fetchedAt: Date.now(),
-          models,
-        },
-        { lock: true, fsyncDir: true }
-      );
       if (onSave) onSave(models);
     } catch {
       /* best-effort */
     }
+    return enqueueWrite(p, async () => {
+      try {
+        await writeJsonAtomicAsync(p, record, { lock: true, fsyncDir: true });
+      } catch {
+        /* best-effort */
+      } finally {
+        if (unsettledSaves.get(p) === text) unsettledSaves.delete(p);
+      }
+    });
   }
 
   // A discovery request claims a generation when it starts. Its roster is
   // written only if no newer request started meanwhile — in this process
   // (generation) or another one (`requestedAt` checked under the file lock) —
   // and `isCurrent()` (the credential it was fetched with is still active) holds.
+  // The returned publish() resolves, never rejecting, to whether the roster was
+  // written; the cross-process check runs under the file lock, so the answer
+  // is only known once the queued write has run.
   let generation = 0;
   function beginSave(isCurrent) {
     const claimed = ++generation;
     const requestedAt = Date.now();
+    const stillWanted = () => claimed === generation && isCurrent();
     return (models, extra = {}) => {
-      if (claimed !== generation || !isCurrent()) return false;
-      let written = false;
+      if (!stillWanted()) return Promise.resolve(false);
+      const p = path();
+      // The roster as of this call, not as mutated while the write waits.
+      let snapshot;
       try {
-        updateJsonAtomicSync(
-          path(),
-          (cur) => {
-            if (Number(cur?.requestedAt) > requestedAt) return undefined;
-            written = true;
-            return {
-              ...extra,
-              ...(version != null ? { version } : {}),
-              fetchedAt: Date.now(),
-              requestedAt,
-              models,
-            };
-          },
-          { fsyncDir: true }
-        );
+        snapshot = JSON.parse(JSON.stringify({ extra, models }));
       } catch {
-        /* best-effort */
+        return Promise.resolve(false);
       }
-      if (written && onSave) onSave(models);
-      return written;
+      return enqueueWrite(p, async () => {
+        // A newer request may have started while this write waited its turn.
+        if (!stillWanted()) return false;
+        let written = false;
+        try {
+          await updateJsonAtomic(
+            p,
+            (cur) => {
+              if (Number(cur?.requestedAt) > requestedAt) return undefined;
+              // The lock wait is asynchronous: a newer request or a credential
+              // change may have landed since the checks above. Re-decide now,
+              // right before accepting the data.
+              if (!stillWanted()) return undefined;
+              written = true;
+              return {
+                ...snapshot.extra,
+                ...(version != null ? { version } : {}),
+                fetchedAt: Date.now(),
+                requestedAt,
+                models: snapshot.models,
+              };
+            },
+            { fsyncDir: true }
+          );
+        } catch {
+          /* best-effort */
+        }
+        try {
+          if (written && onSave) onSave(models);
+        } catch {
+          /* best-effort */
+        }
+        return written;
+      });
     };
   }
 

package/src/runtime/agent/orchestrator/providers/muse-code-oauth.mjs

@@ -435,7 +435,7 @@ export class MuseCodeOAuthProvider {
       });
     const rows = discovered.map((row) => museRow(row.id, row));
     // A superseded or other-credential response never replaces the live roster either.
-    if (publish(discovered)) inner._enrichedModels = rows;
+    if (await publish(discovered)) inner._enrichedModels = rows;
     return rows;
   }
 

package/src/runtime/agent/orchestrator/providers/oauth-secret-fields.fixtures.mjs

@@ -0,0 +1,45 @@
+// The authorization code a test login sends: redacted by value, since `code`
+// alone is also an error/status field.
+export const AUTH_CODE = 'SECRET-CODE';
+
+// Every secret field a token endpoint might echo, each with a distinct value
+// that a test can search for in pages, errors and logs.
+export const SECRET_FIELDS = {
+  access_token: 'SECRET-ACCESS',
+  refresh_token: 'SECRET-REFRESH',
+  id_token: 'SECRET-ID',
+  client_secret: 'SECRET-CLIENT',
+  code: AUTH_CODE,
+  code_verifier: 'SECRET-VERIFIER',
+  code_challenge: 'SECRET-CHALLENGE',
+  device_code: 'SECRET-DEVICE',
+  accessToken: 'SECRET-CAMEL-ACCESS',
+  refreshToken: 'SECRET-CAMEL-REFRESH',
+  idToken: 'SECRET-CAMEL-ID',
+  clientSecret: 'SECRET-CAMEL-CLIENT',
+  token: 'SECRET-TOKEN',
+};
+
+export const SECRET_RE = /SECRET-/;
+
+/** Valid JSON whose secret keys are written with escapes, nested in objects and arrays. */
+export const ESCAPED_SECRET_BODY = String.raw`{"error":{"code":400,"details":[{"client\u005fsecret":"SECRET-ESC-CLIENT","Refresh\u005FToken":"SECRET-ESC-REFRESH"},["x",{"\u0069d_token":"SECRET-ESC-ID"}]],"meta":{"api\u005Fkey":"SECRET-ESC-KEY","acc\u0065ss\u005ftoken":"SECRET-ESC-ACCESS"}}}`;
+
+/** Valid JSON whose secrets sit inside string values: form-encoded, a query string, nested JSON. */
+export const STRING_SECRET_BODY = JSON.stringify({
+  error: 'invalid_request',
+  detail: 'access_token=SECRET-FORM-ACCESS&client_secret=SECRET-FORM-CLIENT',
+  error_uri: 'https://auth.example/cb?client_secret=SECRET-QUERY-CLIENT&state=ok',
+  nested: JSON.stringify({ refresh_token: 'SECRET-NESTED', inner: String.raw`{"client\u005fsecret":"SECRET-DEEP"}` }),
+});
+
+/** Token-endpoint failure bodies carrying every secret field (JSON, escaped JSON, strings, form-encoded). */
+export const SECRET_BODIES = [
+  JSON.stringify({ error: 'invalid_grant', ...SECRET_FIELDS }),
+  ESCAPED_SECRET_BODY,
+  STRING_SECRET_BODY,
+  new URLSearchParams({ error: 'invalid_grant', ...SECRET_FIELDS }).toString(),
+];
+
+/** A 200 body that is not JSON but carries tokens (the parser would quote it). */
+export const MALFORMED_TOKEN_BODY = '{"access_token":"SECRET-ACCESS","refresh_token":"SECRET-REFRESH" oops';

package/src/runtime/agent/orchestrator/providers/openai-compat-chat-send.mjs

@@ -184,6 +184,7 @@ export async function sendCompatChat(provider, messages, useModel, tools, opts)
                 signal: attemptSignal,
                 label: provider.name,
                 providerName: provider.name,
+                sessionId: opts.sessionId,
                 onStreamDelta: opts.onStreamDelta,
                 onToolCall: opts.onToolCall,
                 onTextDelta: opts.onTextDelta,

package/src/runtime/agent/orchestrator/providers/openai-compat-chat-stream/chunk-events.mjs

@@ -5,7 +5,14 @@
  */
 import { mergeToolCallDelta } from './tool-call-acc.mjs';
 import { reportStreamItemStart } from '../lib/send-callbacks.mjs';
-import { appendText, drainLeakedCalls, relayText, reportProgress, reportTransport } from './stream-state.mjs';
+import {
+  appendText,
+  drainLeakedCalls,
+  relayText,
+  reportLifecycle,
+  reportProgress,
+  reportTransport,
+} from './stream-state.mjs';
 import { chatContentParts } from '../openai-compat-reasoning-field.mjs';
 
 function appendReasoning(state, text, source) {
@@ -50,7 +57,7 @@ export function applyCompatChunk(state, chunk) {
   const choice = chunk?.choices?.[0];
   const delta = choice?.delta;
   if (typeof delta?.role === 'string' && delta.role) {
-    reportProgress(state, 'semantic');
+    reportLifecycle(state, 'semantic');
   }
   const contentParts = chatContentParts(delta?.content);
   if (contentParts) applyContentParts(state, contentParts);

package/src/runtime/agent/orchestrator/providers/openai-compat-chat-stream/stream-state.mjs

@@ -70,6 +70,13 @@ export function reportProgress(state, kind) {
   } catch {}
 }
 
+/** Chunk metadata without output (a role-only delta): progress once the
+ *  model has produced output; before that it neither ends the first-output
+ *  phase nor starts the semantic idle (the chunk already reported transport). */
+export function reportLifecycle(state, kind) {
+  if (state.semanticIdleDeadlineAt > 0) reportProgress(state, kind);
+}
+
 /** Text the model exposed: accumulate, refresh the idle deadline, relay live. */
 export function appendText(state, text) {
   state.content += text;

package/src/runtime/agent/orchestrator/providers/openai-compat-chat-stream.mjs

@@ -10,6 +10,7 @@ import {
   PROVIDER_SSE_IDLE_WATCHDOG_ENABLED,
   PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS,
   createTimeoutSignal,
+  providerFirstOutputTimeoutMs,
 } from '../stall-policy.mjs';
 import { TIMEOUT_PHASE } from '../../../shared/provider-timeout-phase.mjs';
 import {
@@ -28,6 +29,7 @@ import {
   toolWorkStarted,
 } from './openai-compat-chat-stream/stream-state.mjs';
 import { applyCompatChunk } from './openai-compat-chat-stream/chunk-events.mjs';
+import { streamFirstOutputWindow } from './lib/first-output-window.mjs';
 import { incompleteStreamError, settleCompatStream } from './openai-compat-chat-stream/stream-result.mjs';
 
 export async function consumeCompatChatCompletionStream(
@@ -45,11 +47,20 @@ export async function consumeCompatChatCompletionStream(
     semanticIdleTimeoutMs,
     firstByteTimeoutMs,
     leakedToolCallRecovery = true,
+    sessionId = null,
   } = {}
 ) {
   const idleOverrideEnabled = Number.isFinite(Number(semanticIdleTimeoutMs)) && Number(semanticIdleTimeoutMs) > 0;
   const idleEnabled = idleOverrideEnabled || PROVIDER_SSE_IDLE_WATCHDOG_ENABLED;
   const idleMs = idleOverrideEnabled ? Number(semanticIdleTimeoutMs) : PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS;
+  // Until the first semantic output the logical request's first-output window
+  // bounds the stream; a request that already had output runs under the
+  // semantic idle from the stream's opening.
+  const firstOutput = streamFirstOutputWindow({
+    sessionId,
+    onStreamDelta,
+    timeoutMs: providerFirstOutputTimeoutMs(idleMs),
+  });
   const state = createCompatStreamState({
     providerName,
     knownToolNames,
@@ -60,6 +71,7 @@ export async function consumeCompatChatCompletionStream(
     onStreamItemStart,
     leakedToolCallRecovery,
   });
+  if (firstOutput.outputSeen) state.semanticIdleDeadlineAt = Date.now() + idleMs;
   reportTransport(state);
   const iterator = stream[Symbol.asyncIterator]();
   let iteratorDone = false;
@@ -72,9 +84,8 @@ export async function consumeCompatChatCompletionStream(
     while (true) {
       const { value: chunk, done } = await nextAsyncWithWatchdog(iterator, {
         signal: state.sawFirstEvent ? signal : firstByteTimeout.signal,
-        idleMs,
-        idleDeadlineAt: state.semanticIdleDeadlineAt,
-        idleEnabled: state.sawFirstEvent && idleEnabled && state.semanticIdleDeadlineAt > 0,
+        ...firstOutput.idleWatch(state.semanticIdleDeadlineAt, idleMs),
+        idleEnabled: state.sawFirstEvent && idleEnabled,
         idleLabel: `${label} SSE idle`,
         streamLabel: label,
         emittedToolCall: () => toolWorkStarted(state),

package/src/runtime/agent/orchestrator/providers/openai-compat-responses-events.mjs

@@ -147,7 +147,8 @@ function settleMaxOutputIncomplete(event, state, ctx, reason) {
 function onCreated(event, state, ctx) {
   if (event.response?.model) state.model = event.response.model;
   if (event.response?.id) state.responseId = event.response.id;
-  signal(ctx, 'semantic');
+  // Metadata, not output: progress only once the stream has seen output.
+  ctx.onLifecycle?.('semantic');
 }
 
 function onOutputTextDelta(event, state, ctx) {
@@ -196,7 +197,8 @@ function onOutputItemAdded(event, state, ctx) {
     state.toolInFlight = true;
   }
   reportStreamItemStart(ctx.onStreamItemStart, responsesItemStart(event.item));
-  signal(ctx, state.toolInFlight ? 'tool' : 'semantic');
+  if (state.toolInFlight) signal(ctx, 'tool');
+  else ctx.onLifecycle?.('semantic');
 }
 
 // A tool call's args (or custom-tool input) are streaming — mark tool work

package/src/runtime/agent/orchestrator/providers/openai-compat-responses.mjs

@@ -241,6 +241,7 @@ async function streamCompatResponses({ provider, params, label, signal, opts, he
           return await consumeCompatResponsesStream(stream, {
             signal: attemptSignal,
             label,
+            sessionId: opts.sessionId,
             onStreamDelta: opts.onStreamDelta,
             onToolCall: opts.onToolCall,
             onTextDelta: opts.onTextDelta,

package/src/runtime/agent/orchestrator/providers/openai-compat-stream-common.mjs

@@ -168,9 +168,11 @@ export async function nextAsyncWithWatchdog(
       }
       // The SDK JSON-decodes each frame inside next(): a SyntaxError here is a
       // malformed wire frame, typed at this boundary and nowhere else.
-      iterator.next().then(resolve, (error) =>
-        reject(error instanceof SyntaxError ? malformedCompatStreamError(streamLabel || idleLabel, error) : error)
-      );
+      iterator
+        .next()
+        .then(resolve, (error) =>
+          reject(error instanceof SyntaxError ? malformedCompatStreamError(streamLabel || idleLabel, error) : error)
+        );
     });
   } catch (err) {
     if (idleTimedOut)