mixdog 1.4.1 → 1.4.2

package/src/runtime/agent/orchestrator/mcp/oauth-login.mjs

@@ -6,6 +6,72 @@ import { identityFromTokenResponse } from './oauth-account.mjs';
 import { answerOAuthCallback } from './oauth-callback.mjs';
 import { anySignal, loginFailed, reauthenticationRequired, scopeNotGranted } from './oauth-shared.mjs';
 
+// Fetch for the SDK: transport-URL normalized, no redirects, bounded by the
+// login `signal`. The token endpoint's answer is read for who the tokens
+// belong to (oauth-account.mjs): the SDK keeps only the token fields.
+function makeSafeFetch({ fetchImpl, flow, signal }) {
+  return async (input, init = {}) => {
+    const response = await fetchImpl(normalizeMcpTransportUrl(input), {
+      ...init,
+      redirect: 'error',
+      signal: anySignal(signal, init.signal),
+    });
+    if (response.ok && /(^|&)grant_type=/.test(String(init.body ?? ''))) {
+      flow.identity = identityFromTokenResponse(
+        await response
+          .clone()
+          .json()
+          .catch(() => null)
+      );
+    }
+    return response;
+  };
+}
+
+// The caller's progress hooks (mcp-oauth-login.mjs): the callback arrived,
+// then the tokens are stored.
+function reportProgress(browser, hook) {
+  try {
+    browser?.[hook]?.();
+  } catch {
+    /* progress reporting never fails the login */
+  }
+}
+
+// The callback promise of one login, and the browser page held open for the
+// loopback callback until the code exchange and scope check end: `settle()` is
+// success, `settle({ code })` a failure. Bounded by `signal`, like the
+// exchange itself. `setFlushing` receives each answered page's flush.
+function awaitCallback({ flow, signal, stopListening, setFlushing }) {
+  let abort;
+  let respond;
+  const settle = (failure) => {
+    const answer = respond;
+    respond = undefined;
+    if (!answer) return undefined;
+    const flushed = answer(failure);
+    setFlushing(flushed);
+    return flushed;
+  };
+  const callback = new Promise((resolve, reject) => {
+    const finish = (code, page) => {
+      if (page) respond = page;
+      return code ? resolve(code) : reject(loginFailed());
+    };
+    flow.finishCallback = finish;
+    // Timeout, cancel or abort: the held page gets the generic failure now
+    // (the exchange or a credential write may be stalled past the deadline),
+    // and the listener closes once it is flushed.
+    abort = () => {
+      finish();
+      settle({});
+      stopListening();
+    };
+    signal.addEventListener('abort', abort, { once: true });
+  });
+  return { callback, settle, abort };
+}
+
 /**
  * The browser login of one connection over its credential `cache` and login
  * `flow` state: the loopback callback listener and the SDK authorization
@@ -65,61 +131,19 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
     // the token fields, so the token endpoint's answer is read here.
     flow.identity = undefined;
     flow.signal = signal;
-    const safeFetch = async (input, init = {}) => {
-      const response = await fetchImpl(normalizeMcpTransportUrl(input), {
-        ...init,
-        redirect: 'error',
-        signal: anySignal(signal, init.signal),
-      });
-      if (response.ok && /(^|&)grant_type=/.test(String(init.body ?? ''))) {
-        flow.identity = identityFromTokenResponse(
-          await response
-            .clone()
-            .json()
-            .catch(() => null)
-        );
-      }
-      return response;
-    };
-    // The caller's progress hooks (mcp-oauth-login.mjs): the callback arrived,
-    // then the tokens are stored.
-    const progress = (hook) => {
-      try {
-        browser?.[hook]?.();
-      } catch {
-        /* progress reporting never fails the login */
-      }
-    };
-    let abort;
-    // The browser page held open for the loopback callback until the code
-    // exchange and scope check end: `settle()` is success, `settle({ code })`
-    // a failure. Bounded by `signal`, like the exchange itself.
-    let respond;
-    const settle = (failure) => {
-      const answer = respond;
-      respond = undefined;
-      if (!answer) return undefined;
-      flushing = answer(failure);
-      return flushing;
-    };
-    const callback = new Promise((resolve, reject) => {
-      const finish = (code, page) => {
-        if (page) respond = page;
-        return code ? resolve(code) : reject(loginFailed());
-      };
-      flow.finishCallback = finish;
-      // Timeout, cancel or abort: the held page gets the generic failure now
-      // (the exchange or a credential write may be stalled past the deadline),
-      // and the listener closes once it is flushed.
-      abort = () => {
-        finish();
-        settle({});
-        stopListening();
-      };
-      signal.addEventListener('abort', abort, { once: true });
+    const safeFetch = makeSafeFetch({ fetchImpl, flow, signal });
+    const progress = (hook) => reportProgress(browser, hook);
+    const { callback, settle, abort } = awaitCallback({
+      flow,
+      signal,
+      stopListening,
+      setFlushing: (page) => {
+        flushing = page;
+      },
     });
     // A discovery/registration error can precede waiting for the callback.
     callback.catch(() => {});
+    let codeReceived = false;
     try {
       signal.throwIfAborted();
       const { auth } = await import('@modelcontextprotocol/sdk/client/auth.js');
@@ -141,6 +165,7 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
       });
       if (result === 'REDIRECT') {
         const code = await callback;
+        codeReceived = true;
         signal.throwIfAborted();
         progress('onCallback');
         const exchanged = await cache.withLock(async () => {
@@ -157,6 +182,12 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
       await settle();
     } catch (error) {
       await settle({ code: error?.code });
+      // An authorization server that no longer knows our client_id answers the
+      // browser with an HTTP error, never a redirect or a token-endpoint
+      // invalid_client, so the SDK cannot see it: register again next time.
+      if (interactive && flow.browserOpened && !codeReceived && !provider.preRegistered) {
+        await provider.invalidateCredentials('client').catch(() => {});
+      }
       // SDK errors may contain authorization server response bodies/secrets.
       if (error?.code === 'reauthenticationRequired' || !interactive) throw reauthenticationRequired();
       // Our own error names scopes only (no token data): the one to pass on.

package/src/runtime/agent/orchestrator/mcp/oauth.mjs

@@ -50,28 +50,33 @@ export function isMcpOAuthScopeNotGranted(error) {
   return false;
 }
 
-// One keychain entry per exact server URL. Windows stores each account as a
-// file name, so the account is a hash of the URL and nothing else.
-export function mcpOAuthAccount(url) {
-  return `mcp-oauth.${createHash('sha256').update(url).digest('hex')}`;
+// One keychain entry per credential key: the exact server URL, or a connector
+// account's own key (client-config.mjs resolveMcpOAuthCredentialKey). Windows
+// stores each account as a file name, so the account is a hash of the key and
+// nothing else.
+export function mcpOAuthAccount(key) {
+  return `mcp-oauth.${createHash('sha256').update(key).digest('hex')}`;
 }
 
-/** Whether OAuth tokens are stored for one server URL, read from the
- *  non-secret revision marker without touching the keychain. */
-export function hasStoredMcpOAuthTokens(url) {
+/** What one sign-in is stored under: `credentialKey`, else the normalized URL. */
+const credentialIdOf = (url, credentialKey) => credentialKey || normalizeMcpTransportUrl(url);
+
+/** Whether OAuth tokens are stored for one server URL (or `credentialKey`),
+ *  read from the non-secret revision marker without touching the keychain. */
+export function hasStoredMcpOAuthTokens(url, credentialKey) {
   try {
-    const marker = readFileSync(credentialFile(mcpOAuthAccount(normalizeMcpTransportUrl(url)), 'rev'), 'utf8');
+    const marker = readFileSync(credentialFile(mcpOAuthAccount(credentialIdOf(url, credentialKey)), 'rev'), 'utf8');
     return marker.endsWith(TOKENS_FLAG);
   } catch {
     return false;
   }
 }
 
-/** Who the stored sign-in of one MCP server URL belongs to, without a keychain
- *  read: `{ account, workspace, forcedChoice }` (empty strings when the server
- *  named nobody), or null when signed out. */
-export function storedMcpOAuthIdentity(url) {
-  return readIdentityFile(mcpOAuthAccount(normalizeMcpTransportUrl(url)));
+/** Who the stored sign-in of one MCP server URL (or `credentialKey`) belongs
+ *  to, without a keychain read: `{ account, workspace, forcedChoice }` (empty
+ *  strings when the server named nobody), or null when signed out. */
+export function storedMcpOAuthIdentity(url, credentialKey) {
+  return readIdentityFile(mcpOAuthAccount(credentialIdOf(url, credentialKey)));
 }
 
 // RFC 7009 revocation of the stored grant, only where the authorization server
@@ -114,9 +119,15 @@ async function revokeStoredGrant(saved, fetchImpl) {
  *  explicit reconnect to log in again. With `revoke`, the grant is first
  *  revoked at the authorization server where it documents a revocation
  *  endpoint. Resolves `{ revoked }`. */
-export async function clearMcpOAuth({ url, credentialStore = keychain, revoke = false, fetchImpl = fetch }) {
-  url = normalizeMcpTransportUrl(url);
-  const account = mcpOAuthAccount(url);
+export async function clearMcpOAuth({
+  url,
+  credentialKey,
+  credentialStore = keychain,
+  revoke = false,
+  fetchImpl = fetch,
+}) {
+  const id = credentialIdOf(url, credentialKey);
+  const account = mcpOAuthAccount(id);
   let revoked = false;
   await withCredentialLock(account, async () => {
     const saved = await readStoredCredentials(credentialStore, account);
@@ -125,7 +136,7 @@ export async function clearMcpOAuth({ url, credentialStore = keychain, revoke =
     if (saved != null) await credentialStore.deleteSecretAsync(account);
     await writeIdentityFile(account, null);
   });
-  scopes.get(credentialStore)?.get(url)?.oauth.clear();
+  scopes.get(credentialStore)?.get(id)?.oauth.clear();
   return { revoked };
 }
 
@@ -151,6 +162,7 @@ async function storeEntry(account, url, value, credentialStore) {
  */
 export function startMcpOAuthSwitch({
   url,
+  credentialKey,
   launch,
   serverName,
   credentialStore = keychain,
@@ -209,7 +221,7 @@ export function startMcpOAuthSwitch({
     timeoutMs,
   });
   const done = (async () => {
-    const saved = await readStoredCredentials(credentialStore, mcpOAuthAccount(url));
+    const saved = await readStoredCredentials(credentialStore, mcpOAuthAccount(credentialIdOf(url, credentialKey)));
     if (saved) {
       const value = JSON.parse(saved);
       if (value.url === url) {
@@ -244,9 +256,9 @@ export function startMcpOAuthSwitch({
 /** Store the sign-in a switch returned as the URL's sign-in; resolves a
  *  `rollback()` that restores the previous one (or none). Live connections
  *  adopt either through the revision marker on their next request. */
-export async function commitMcpOAuthSwitch({ url, signIn, credentialStore = keychain }) {
+export async function commitMcpOAuthSwitch({ url, credentialKey, signIn, credentialStore = keychain }) {
   url = normalizeMcpTransportUrl(url);
-  const account = mcpOAuthAccount(url);
+  const account = mcpOAuthAccount(credentialIdOf(url, credentialKey));
   let previous = null;
   await withCredentialLock(account, async () => {
     previous = await readStoredCredentials(credentialStore, account);
@@ -262,9 +274,11 @@ export async function commitMcpOAuthSwitch({ url, signIn, credentialStore = keyc
 }
 
 // The keychain is the only durable store. Exact URLs, including query strings,
-// partition clients and tokens even when servers share an authorization issuer.
+// partition clients and tokens even when servers share an authorization issuer;
+// a `credentialKey` (a connector account's own) partitions them at one URL.
 export function createMcpOAuth({
   url,
+  credentialKey,
   credentialStore = keychain,
   interactive = false,
   isTransportEndpoint = () => false,
@@ -272,15 +286,16 @@ export function createMcpOAuth({
   ...options
 }) {
   url = normalizeMcpTransportUrl(url);
+  const id = credentialIdOf(url, credentialKey);
   let entries = scopes.get(credentialStore);
   if (!entries) {
     entries = new Map();
     scopes.set(credentialStore, entries);
   }
-  let entry = entries.get(url);
+  let entry = entries.get(id);
   if (!entry) {
-    entry = { oauth: createSharedOAuth({ url, credentialStore, ...options }), users: 0 };
-    entries.set(url, entry);
+    entry = { oauth: createSharedOAuth({ url, account: mcpOAuthAccount(id), credentialStore, ...options }), users: 0 };
+    entries.set(id, entry);
   }
   entry.users++;
   const lifetime = new AbortController();
@@ -346,7 +361,7 @@ export function createMcpOAuth({
       lifetime.abort();
       if (--entry.users === 0) {
         entry.oauth.close();
-        entries.delete(url);
+        entries.delete(id);
       }
     },
   };
@@ -354,6 +369,7 @@ export function createMcpOAuth({
 
 function createSharedOAuth({
   url,
+  account,
   credentialStore,
   openBrowser = openInBrowser,
   fetchImpl = fetch,
@@ -361,7 +377,7 @@ function createSharedOAuth({
   oauthClient = null,
 }) {
   const lifetime = new AbortController();
-  const cache = createCredentialCache({ url, credentialStore, account: mcpOAuthAccount(url) });
+  const cache = createCredentialCache({ url, credentialStore, account });
   const { creds } = cache;
   const flow = {
     listener: undefined,

package/src/runtime/agent/orchestrator/providers/account-pool.mjs

@@ -13,6 +13,7 @@ import {
   providerAccountWithBlocks,
   providerAccountBlockedUntil,
   staleQuotaWindows,
+  isCustomKeyProvider,
 } from '../../../shared/provider-accounts.mjs';
 import { withProviderAccount, hasExplicitProviderAuthBinding } from '../../../shared/provider-auth-binding.mjs';
 import { isExplicitUserAbortError, markProviderRecoveryExhausted } from './retry-classifier.mjs';
@@ -161,8 +162,11 @@ function quotaExhausted(error, providerName, model, rows, options = {}) {
 // caller does not subscribe, and account-bound connection/delta state stays
 // apart without changing the visible Mixdog session, so no stale server state
 // crosses an account switch. `emitted()` reports whether output reached the
-// caller.
-function boundAccountSend(providerName, row, messages, options) {
+// caller. `servedBy` names the account a history message or provider state
+// came from; only that account's replay and state are passed on.
+const replayAccount = (entry) => entry?.providerReplay?.accountId ?? entry?.providerAccountId;
+
+function boundAccountSend(providerName, row, messages, options, servedBy = replayAccount) {
   let emitted = false;
   const opts = { ...options };
   for (const key of ['onStreamDelta', 'onTextDelta', 'onToolCall', 'onThinkingDelta']) {
@@ -178,9 +182,9 @@ function boundAccountSend(providerName, row, messages, options) {
     // The spend still belongs to the visible session (usage-accounting.mjs).
     opts.usageSessionId = options.usageSessionId || options.sessionId;
   }
-  opts.providerState = options.providerState?.providerAccountId === row.id ? options.providerState : undefined;
+  opts.providerState = servedBy(options.providerState) === row.id ? options.providerState : undefined;
   const history = messages.map((message) => {
-    if (message.providerReplay?.accountId === row.id) return message;
+    if (servedBy(message) === row.id) return message;
     const { providerReplay, reasoning, thinkingBlocks, ...plain } = message;
     return plain;
   });
@@ -204,7 +208,7 @@ async function commitFallbackAccount(providerName, pool, row, model, refusalScop
 // the binding survives a restart and eviction from this map, which only
 // spares the history walk. Bounded, oldest binding first out.
 const SESSION_ACCOUNT_LIMIT = 1000;
-const ROUTING_METADATA_KEY = 'accountRouting';
+export const ROUTING_METADATA_KEY = 'accountRouting';
 const sessionAccounts = new Map();
 
 // Forget every in-memory binding, as a restart does (tests).
@@ -520,7 +524,7 @@ function rotationReason(evidence, accountBlocked) {
 
 // The pool's send: walks the eligible accounts until one answers, blocking
 // the ones whose quota window is exhausted along the way.
-function poolSend(providerName, account) {
+function poolSend(providerName, account, servedBy) {
   return async function send(messages, model, tools, options = {}) {
     const request = { providerName, model, account, options };
     // This send's record of the roster: the accounts it tried, those it found
@@ -541,7 +545,8 @@ function poolSend(providerName, account) {
       options.signal?.throwIfAborted();
       const pool = readProviderAccountPool(providerName);
       if (!pool.accounts.length) {
-        throwIfPlanQuotaSpent(providerName, pool, model);
+        // A custom provider's key has no plan meter to consult.
+        if (!isCustomKeyProvider(providerName)) throwIfPlanQuotaSpent(providerName, pool, model);
         return account('default').send(messages, model, tools, options);
       }
       const policy = providerAccountPolicy(pool);
@@ -559,7 +564,7 @@ function poolSend(providerName, account) {
       }
       ledger.attempted.add(row.id);
       sends += 1;
-      const bound = boundAccountSend(providerName, row, messages, options);
+      const bound = boundAccountSend(providerName, row, messages, options, servedBy);
       try {
         const result = await account(row.id).send(bound.history, model, tools, bound.opts);
         quotaStrikes.delete(`${providerName}:${row.id}`);
@@ -660,3 +665,33 @@ export function createAccountPoolProvider(providerName, create) {
     }
   );
 }
+
+// Every key of a custom provider reaches one endpoint, so its answers carry
+// no key-bound server state but what an answer's routing names: history from
+// before the key pool (or from no pooled send) is the primary key's.
+function customKeyServedBy(providerName) {
+  return (entry) => {
+    const routing = entry?.providerMetadata?.[ROUTING_METADATA_KEY];
+    if (routing?.provider === providerName && routing.accountId) return routing.accountId;
+    return replayAccount(entry) || 'default';
+  };
+}
+
+/**
+ * A custom provider's API keys as one roster (provider-accounts.mjs
+ * `setCustomProviderKeyIds`): `primary` is the `default` account and answers
+ * everything but `send`; `keyEngine(id)` is the engine sending with
+ * additional key `id`. Without additional keys the roster is empty and every
+ * send is the primary's own, unchanged.
+ */
+export function createCustomKeyPoolProvider(providerName, primary, keyEngine) {
+  const engines = new Map([['default', primary]]);
+  const account = (id) => {
+    if (!engines.has(id)) engines.set(id, keyEngine(id));
+    return engines.get(id);
+  };
+  const send = poolSend(providerName, account, customKeyServedBy(providerName));
+  return new Proxy(primary, {
+    get: (target, key, receiver) => (key === 'send' ? send : Reflect.get(target, key, receiver)),
+  });
+}

package/src/runtime/agent/orchestrator/providers/anthropic-api-request.mjs

@@ -189,8 +189,7 @@ export async function buildAnthropicApiRequest({
   // Diagnostic: per-block prefix hashes of exactly what is sent.
   recordAnthropicPrefix(anthropicPrefixSessionId(opts), anthropicPrefixFingerprint(params));
 
-  const requestHeaders = requestHeadersFor(params, {
-    config,
+  const betas = requestBetasFor(params, {
     opts,
     isCustom,
     fastLatched,
@@ -198,8 +197,10 @@ export async function buildAnthropicApiRequest({
     capabilityModel,
     effortProjection,
   });
+  const requestHeaders = requestHeadersFor(betas, { config, opts });
 
-  return { params, requestHeaders, knownToolNames, fastModeLatched: fastLatched };
+  // `betas`: the selected beta names, whether or not this route sends them as a header.
+  return { params, requestHeaders, betas, knownToolNames, fastModeLatched: fastLatched };
 }
 
 /** The turn's thinking/effort fields on `params` (in place): a custom
@@ -247,35 +248,36 @@ function resolveRequestToolChoice(params, opts, config) {
   else delete params.tool_choice;
 }
 
-/** The per-request headers of the final body `params`: the anthropic-beta
- *  set it needs, then the caller's `opts.requestHeaders`; null when none. */
-function requestHeadersFor(
-  params,
-  { config, opts, isCustom, fastLatched, hasDeferredTools, capabilityModel, effortProjection }
-) {
+/** The anthropic-beta names the final body `params` needs. A custom endpoint
+ *  gets no first-party base betas; only those its own request body needs
+ *  (row-driven effort, deferred tools). */
+function requestBetasFor(params, { opts, isCustom, fastLatched, hasDeferredTools, capabilityModel, effortProjection }) {
+  return [
+    buildAnthropicBetaHeaders({
+      ...(isCustom ? { base: '' } : {}),
+      fastMode: fastLatched,
+      toolSearch: hasDeferredTools,
+      // Custom: the beta follows the resolver's output, not the model id.
+      effort: isCustom ? Boolean(params.output_config?.effort) : shouldIncludeEffortBeta(capabilityModel, opts),
+      serverFallback: params.fallbacks === 'default',
+      thinkingDisplayUpdates: params.thinking?.display === 'updates',
+      turnScopedSystem: hasAnthropicTurnScopedMessages(params.messages),
+    }),
+    ...(effortProjection ? [EFFORT_CONFIGURATION_BETA] : []),
+  ]
+    .join(',')
+    .split(',')
+    .filter(Boolean);
+}
+
+/** The per-request headers: the anthropic-beta header of `betas`, then the
+ *  caller's `opts.requestHeaders`; null when none. */
+function requestHeadersFor(betas, { config, opts }) {
   // Per-call headers override the client defaultHeaders, so the
   // constructor-level disableBetaHeaders opt-out must be honoured here
   // too — otherwise opencode-go's anthropic-compatible routing
   // (disableBetaHeaders:true) would still send beta strings that a
   // third-party endpoint may reject.
-  // A custom endpoint gets no first-party base betas; only those its own
-  // request body needs (row-driven effort, deferred tools).
-  let betaHeaders = null;
-  if (!config?.disableBetaHeaders) {
-    const betas = [
-      buildAnthropicBetaHeaders({
-        ...(isCustom ? { base: '' } : {}),
-        fastMode: fastLatched,
-        toolSearch: hasDeferredTools,
-        // Custom: the beta follows the resolver's output, not the model id.
-        effort: isCustom ? Boolean(params.output_config?.effort) : shouldIncludeEffortBeta(capabilityModel, opts),
-        serverFallback: params.fallbacks === 'default',
-        thinkingDisplayUpdates: params.thinking?.display === 'updates',
-        turnScopedSystem: hasAnthropicTurnScopedMessages(params.messages),
-      }),
-      ...(effortProjection ? [EFFORT_CONFIGURATION_BETA] : []),
-    ].filter(Boolean);
-    if (betas.length) betaHeaders = { 'anthropic-beta': betas.join(',') };
-  }
+  const betaHeaders = !config?.disableBetaHeaders && betas.length ? { 'anthropic-beta': betas.join(',') } : null;
   return betaHeaders || opts.requestHeaders ? { ...(betaHeaders || {}), ...(opts.requestHeaders || {}) } : null;
 }

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-client-version.mjs

@@ -10,7 +10,7 @@ import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
 // source release just to advance the user-agent version.
 // Claude Opus 5.5 requires 2.1.280 or newer. The release workflow raises this
 // to the published CLI version (scripts/sync-client-version-floors.mjs).
-export const DEFAULT_CLI_VERSION = '2.1.311';
+export const DEFAULT_CLI_VERSION = '2.1.312';
 export const CLAUDE_CLI_NPM_PACKAGE = '@anthropic-ai/claude-code';
 
 const CACHE_SCHEMA_VERSION = 1;

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-credentials.mjs

@@ -22,7 +22,12 @@ import {
   expiryFromAccessToken,
   isDefinitiveOAuthFailure,
   normalizeAccountIdentity,
+  oauthBodySummary,
   oauthCredentialStatus,
+  oauthFailureReason,
+  oauthPublicError,
+  oauthRequestError,
+  oauthResponseJson,
   scrubOAuthSecrets,
 } from './lib/oauth-token-utils.mjs';
 import { createOAuthPkce, parseOAuthCodeInput } from './lib/oauth-pkce.mjs';
@@ -271,7 +276,7 @@ export function _scrubTokens(text, secretValues = []) {
 }
 
 function _tokenEndpointError(operation, status, text, secretValues = []) {
-  const safeDetail = _scrubTokens(text, secretValues).replace(/\s+/g, ' ').trim().slice(0, 500);
+  const safeDetail = oauthBodySummary(text, secretValues);
   const detail = safeDetail ? `: ${safeDetail}` : '';
   const compatibility =
     status === 403
@@ -282,7 +287,7 @@ function _tokenEndpointError(operation, status, text, secretValues = []) {
         ' update Mixdog or set MIXDOG_CLI_VERSION to the installed official Claude Code version;' +
         ' then retry sign-in via /providers without an intercepting network layer if applicable.'
       : '';
-  return new Error(`${operation} ${status}${detail}.${compatibility}`);
+  return oauthPublicError(new Error(`${operation} ${status}${detail}.${compatibility}`));
 }
 
 export function isAnthropicOAuthRefreshDisabled() {
@@ -578,21 +583,26 @@ async function exchangeAuthorizationCode({ pkce, code, state, redirectUri, signa
   const cleanCode = String(code || '').trim();
   if (!cleanCode) throw new Error('[anthropic-oauth] authorization code is required');
   const timeoutSignal = AbortSignal.timeout(OAUTH_TOKEN_TIMEOUT_MS);
-  const tokenRes = await fetch(TOKEN_URL, {
-    method: 'POST',
-    headers: tokenEndpointHeaders(),
-    body: JSON.stringify({
-      grant_type: 'authorization_code',
-      code: cleanCode,
-      redirect_uri: redirectUri,
-      client_id: CLAUDE_CODE_CLIENT_ID,
-      code_verifier: pkce.verifier,
-      state,
-    }),
-    redirect: 'error',
-    signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal,
-    dispatcher: getLlmDispatcher(),
-  });
+  let tokenRes;
+  try {
+    tokenRes = await fetch(TOKEN_URL, {
+      method: 'POST',
+      headers: tokenEndpointHeaders(),
+      body: JSON.stringify({
+        grant_type: 'authorization_code',
+        code: cleanCode,
+        redirect_uri: redirectUri,
+        client_id: CLAUDE_CODE_CLIENT_ID,
+        code_verifier: pkce.verifier,
+        state,
+      }),
+      redirect: 'error',
+      signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal,
+      dispatcher: getLlmDispatcher(),
+    });
+  } catch (err) {
+    throw oauthRequestError('[anthropic-oauth] token exchange', err);
+  }
   if (!tokenRes.ok) {
     const text = await tokenRes.text().catch(() => '');
     throw _tokenEndpointError('[anthropic-oauth] token exchange', tokenRes.status, text, [
@@ -601,7 +611,7 @@ async function exchangeAuthorizationCode({ pkce, code, state, redirectUri, signa
       state,
     ]);
   }
-  const json = await tokenRes.json();
+  const json = await oauthResponseJson(tokenRes, '[anthropic-oauth] token exchange');
   const accessToken = json?.access_token || json?.accessToken;
   const refreshToken = json?.refresh_token || json?.refreshToken;
   if (!accessToken || !refreshToken) {
@@ -727,10 +737,10 @@ export async function beginOAuthLogin({ openBrowserFn = null, openBrowser = true
         await acceptCode(code, OAUTH_REDIRECT_URI);
         res.writeHead(200, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE, Connection: 'close' });
         res.end(oauthSuccessHtml('Claude'));
-      } catch {
-        // The shared exchange reports its error through waitForCallback.
+      } catch (err) {
+        // The shared exchange also reports its error through waitForCallback.
         res.writeHead(500, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE, Connection: 'close' });
-        res.end(oauthErrorHtml('Claude could not complete the token exchange.'));
+        res.end(oauthErrorHtml(oauthFailureReason('Claude could not complete the token exchange.', err)));
       }
     });
     timeout = setTimeout(() => finish(null), OAUTH_LOGIN_TIMEOUT_MS);

package/src/runtime/agent/orchestrator/providers/antigravity-oauth-login.mjs

@@ -266,7 +266,9 @@ export async function exchangeAuthorizationCode({ code, verifier, fetchFn = fetc
   });
   if (!res.ok) {
     const text = await res.text().catch(() => '');
-    throw new Error(`[antigravity-oauth] token exchange ${res.status}: ${_scrubTokens(text).slice(0, 300)}`);
+    // The authorization code is redacted by value: `code` alone is not a secret field.
+    const detail = _scrubTokens(text, [cleanCode, verifier]).slice(0, 300);
+    throw new Error(`[antigravity-oauth] token exchange ${res.status}: ${detail}`);
   }
   const json = await res.json();
   if (!json?.access_token || !json?.refresh_token) {

package/src/runtime/agent/orchestrator/providers/antigravity-oauth-tokens.mjs

@@ -231,8 +231,8 @@ export function saveTokens(tokens) {
   );
 }
 
-export function _scrubTokens(text) {
-  return scrubOAuthSecrets(text);
+export function _scrubTokens(text, secretValues = []) {
+  return scrubOAuthSecrets(text, secretValues);
 }
 
 export function hasAntigravityOAuthCredentials() {

package/src/runtime/agent/orchestrator/providers/codex-client-meta.mjs

@@ -20,7 +20,7 @@ import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
 // version (gpt-6.1-sol requires >= 0.159.0, measured 2026-10-09), so the
 // release workflow raises this to the published CLI version on every release
 // (scripts/sync-client-version-floors.mjs).
-export const CODEX_CLIENT_VERSION_FLOOR = '0.164.0';
+export const CODEX_CLIENT_VERSION_FLOOR = '0.165.0';
 export const CODEX_CLI_NPM_PACKAGE = '@openai/codex';
 const live = createNpmVersionSource(CODEX_CLI_NPM_PACKAGE, { persistKey: 'codex-cli' });
 

package/src/runtime/agent/orchestrator/providers/command-code-oauth.mjs

@@ -361,7 +361,7 @@ export class CommandCodeOAuthProvider {
     if (Array.isArray(body?.data)) list = body.data;
     else if (Array.isArray(body)) list = body;
     const items = list.filter((item) => modelWire(item));
-    publish(items.map(rosterRow));
+    await publish(items.map(rosterRow));
     if (this.tokens?.apiKey === apiKey) {
       // Rows accumulate for one key: a later roster that misses a model
       // leaves the endpoints it was last listed with.