mixdog 1.4.1 → 1.4.3

package/src/runtime/agent/orchestrator/mcp/oauth-provider.mjs

@@ -145,6 +145,20 @@ export function createOAuthProvider({ cache, flow, lifetimeSignal, client = null
       // access_type=offline, without which no refresh token is issued).
       if (client?.scopes) target.searchParams.set('scope', client.scopes.join(' '));
       for (const [key, value] of Object.entries(client?.authParams || {})) target.searchParams.set(key, value);
+      // A dynamically registered client asks for offline access when the
+      // authorization server lists it (MCP SEP-2207): the SDK sends only the
+      // resource's scopes (Vercel's `openid`), and without `offline_access`
+      // such a server issues no refresh token, so the sign-in ends within the
+      // hour. `prompt=consent` is what the SDK adds beside that scope. An
+      // empty scope stays empty: the server's default scopes would be lost.
+      if (!client) {
+        const scope = target.searchParams.get('scope');
+        const offered = creds.discovery?.authorizationServerMetadata?.scopes_supported;
+        if (scope && offered?.includes('offline_access') && !scope.split(' ').includes('offline_access')) {
+          target.searchParams.set('scope', `${scope} offline_access`);
+          target.searchParams.append('prompt', 'consent');
+        }
+      }
       // The explicit sign-in's account mode (mcp-oauth-login.mjs) decides the
       // provider's documented account-choice parameter, if any.
       await flow.launchBrowser(withAccountParams(target.href, flow.launchBrowser.accountMode || 'connect').href);

package/src/runtime/agent/orchestrator/mcp/oauth.mjs

@@ -1,6 +1,6 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { readFileSync } from 'node:fs';
-import keychain from '../../../../lib/keychain-cjs.cjs';
+import { keychainSecretStore as keychain } from '../../../shared/config.mjs';
 import { openInBrowser } from '../../../shared/open-url.mjs';
 import { normalizeMcpTransportUrl } from './client-config.mjs';
 import {
@@ -50,28 +50,33 @@ export function isMcpOAuthScopeNotGranted(error) {
   return false;
 }
 
-// One keychain entry per exact server URL. Windows stores each account as a
-// file name, so the account is a hash of the URL and nothing else.
-export function mcpOAuthAccount(url) {
-  return `mcp-oauth.${createHash('sha256').update(url).digest('hex')}`;
+// One keychain entry per credential key: the exact server URL, or a connector
+// account's own key (client-config.mjs resolveMcpOAuthCredentialKey). Windows
+// stores each account as a file name, so the account is a hash of the key and
+// nothing else.
+export function mcpOAuthAccount(key) {
+  return `mcp-oauth.${createHash('sha256').update(key).digest('hex')}`;
 }
 
-/** Whether OAuth tokens are stored for one server URL, read from the
- *  non-secret revision marker without touching the keychain. */
-export function hasStoredMcpOAuthTokens(url) {
+/** What one sign-in is stored under: `credentialKey`, else the normalized URL. */
+const credentialIdOf = (url, credentialKey) => credentialKey || normalizeMcpTransportUrl(url);
+
+/** Whether OAuth tokens are stored for one server URL (or `credentialKey`),
+ *  read from the non-secret revision marker without touching the keychain. */
+export function hasStoredMcpOAuthTokens(url, credentialKey) {
   try {
-    const marker = readFileSync(credentialFile(mcpOAuthAccount(normalizeMcpTransportUrl(url)), 'rev'), 'utf8');
+    const marker = readFileSync(credentialFile(mcpOAuthAccount(credentialIdOf(url, credentialKey)), 'rev'), 'utf8');
     return marker.endsWith(TOKENS_FLAG);
   } catch {
     return false;
   }
 }
 
-/** Who the stored sign-in of one MCP server URL belongs to, without a keychain
- *  read: `{ account, workspace, forcedChoice }` (empty strings when the server
- *  named nobody), or null when signed out. */
-export function storedMcpOAuthIdentity(url) {
-  return readIdentityFile(mcpOAuthAccount(normalizeMcpTransportUrl(url)));
+/** Who the stored sign-in of one MCP server URL (or `credentialKey`) belongs
+ *  to, without a keychain read: `{ account, workspace, forcedChoice }` (empty
+ *  strings when the server named nobody), or null when signed out. */
+export function storedMcpOAuthIdentity(url, credentialKey) {
+  return readIdentityFile(mcpOAuthAccount(credentialIdOf(url, credentialKey)));
 }
 
 // RFC 7009 revocation of the stored grant, only where the authorization server
@@ -114,9 +119,15 @@ async function revokeStoredGrant(saved, fetchImpl) {
  *  explicit reconnect to log in again. With `revoke`, the grant is first
  *  revoked at the authorization server where it documents a revocation
  *  endpoint. Resolves `{ revoked }`. */
-export async function clearMcpOAuth({ url, credentialStore = keychain, revoke = false, fetchImpl = fetch }) {
-  url = normalizeMcpTransportUrl(url);
-  const account = mcpOAuthAccount(url);
+export async function clearMcpOAuth({
+  url,
+  credentialKey,
+  credentialStore = keychain,
+  revoke = false,
+  fetchImpl = fetch,
+}) {
+  const id = credentialIdOf(url, credentialKey);
+  const account = mcpOAuthAccount(id);
   let revoked = false;
   await withCredentialLock(account, async () => {
     const saved = await readStoredCredentials(credentialStore, account);
@@ -125,7 +136,7 @@ export async function clearMcpOAuth({ url, credentialStore = keychain, revoke =
     if (saved != null) await credentialStore.deleteSecretAsync(account);
     await writeIdentityFile(account, null);
   });
-  scopes.get(credentialStore)?.get(url)?.oauth.clear();
+  scopes.get(credentialStore)?.get(id)?.oauth.clear();
   return { revoked };
 }
 
@@ -151,6 +162,7 @@ async function storeEntry(account, url, value, credentialStore) {
  */
 export function startMcpOAuthSwitch({
   url,
+  credentialKey,
   launch,
   serverName,
   credentialStore = keychain,
@@ -209,7 +221,7 @@ export function startMcpOAuthSwitch({
     timeoutMs,
   });
   const done = (async () => {
-    const saved = await readStoredCredentials(credentialStore, mcpOAuthAccount(url));
+    const saved = await readStoredCredentials(credentialStore, mcpOAuthAccount(credentialIdOf(url, credentialKey)));
     if (saved) {
       const value = JSON.parse(saved);
       if (value.url === url) {
@@ -244,9 +256,9 @@ export function startMcpOAuthSwitch({
 /** Store the sign-in a switch returned as the URL's sign-in; resolves a
  *  `rollback()` that restores the previous one (or none). Live connections
  *  adopt either through the revision marker on their next request. */
-export async function commitMcpOAuthSwitch({ url, signIn, credentialStore = keychain }) {
+export async function commitMcpOAuthSwitch({ url, credentialKey, signIn, credentialStore = keychain }) {
   url = normalizeMcpTransportUrl(url);
-  const account = mcpOAuthAccount(url);
+  const account = mcpOAuthAccount(credentialIdOf(url, credentialKey));
   let previous = null;
   await withCredentialLock(account, async () => {
     previous = await readStoredCredentials(credentialStore, account);
@@ -262,9 +274,11 @@ export async function commitMcpOAuthSwitch({ url, signIn, credentialStore = keyc
 }
 
 // The keychain is the only durable store. Exact URLs, including query strings,
-// partition clients and tokens even when servers share an authorization issuer.
+// partition clients and tokens even when servers share an authorization issuer;
+// a `credentialKey` (a connector account's own) partitions them at one URL.
 export function createMcpOAuth({
   url,
+  credentialKey,
   credentialStore = keychain,
   interactive = false,
   isTransportEndpoint = () => false,
@@ -272,15 +286,16 @@ export function createMcpOAuth({
   ...options
 }) {
   url = normalizeMcpTransportUrl(url);
+  const id = credentialIdOf(url, credentialKey);
   let entries = scopes.get(credentialStore);
   if (!entries) {
     entries = new Map();
     scopes.set(credentialStore, entries);
   }
-  let entry = entries.get(url);
+  let entry = entries.get(id);
   if (!entry) {
-    entry = { oauth: createSharedOAuth({ url, credentialStore, ...options }), users: 0 };
-    entries.set(url, entry);
+    entry = { oauth: createSharedOAuth({ url, account: mcpOAuthAccount(id), credentialStore, ...options }), users: 0 };
+    entries.set(id, entry);
   }
   entry.users++;
   const lifetime = new AbortController();
@@ -346,7 +361,7 @@ export function createMcpOAuth({
       lifetime.abort();
       if (--entry.users === 0) {
         entry.oauth.close();
-        entries.delete(url);
+        entries.delete(id);
       }
     },
   };
@@ -354,6 +369,7 @@ export function createMcpOAuth({
 
 function createSharedOAuth({
   url,
+  account,
   credentialStore,
   openBrowser = openInBrowser,
   fetchImpl = fetch,
@@ -361,7 +377,7 @@ function createSharedOAuth({
   oauthClient = null,
 }) {
   const lifetime = new AbortController();
-  const cache = createCredentialCache({ url, credentialStore, account: mcpOAuthAccount(url) });
+  const cache = createCredentialCache({ url, credentialStore, account });
   const { creds } = cache;
   const flow = {
     listener: undefined,

package/src/runtime/agent/orchestrator/providers/account-pool.mjs

@@ -13,6 +13,7 @@ import {
   providerAccountWithBlocks,
   providerAccountBlockedUntil,
   staleQuotaWindows,
+  isCustomKeyProvider,
 } from '../../../shared/provider-accounts.mjs';
 import { withProviderAccount, hasExplicitProviderAuthBinding } from '../../../shared/provider-auth-binding.mjs';
 import { isExplicitUserAbortError, markProviderRecoveryExhausted } from './retry-classifier.mjs';
@@ -161,8 +162,11 @@ function quotaExhausted(error, providerName, model, rows, options = {}) {
 // caller does not subscribe, and account-bound connection/delta state stays
 // apart without changing the visible Mixdog session, so no stale server state
 // crosses an account switch. `emitted()` reports whether output reached the
-// caller.
-function boundAccountSend(providerName, row, messages, options) {
+// caller. `servedBy` names the account a history message or provider state
+// came from; only that account's replay and state are passed on.
+const replayAccount = (entry) => entry?.providerReplay?.accountId ?? entry?.providerAccountId;
+
+function boundAccountSend(providerName, row, messages, options, servedBy = replayAccount) {
   let emitted = false;
   const opts = { ...options };
   for (const key of ['onStreamDelta', 'onTextDelta', 'onToolCall', 'onThinkingDelta']) {
@@ -178,9 +182,9 @@ function boundAccountSend(providerName, row, messages, options) {
     // The spend still belongs to the visible session (usage-accounting.mjs).
     opts.usageSessionId = options.usageSessionId || options.sessionId;
   }
-  opts.providerState = options.providerState?.providerAccountId === row.id ? options.providerState : undefined;
+  opts.providerState = servedBy(options.providerState) === row.id ? options.providerState : undefined;
   const history = messages.map((message) => {
-    if (message.providerReplay?.accountId === row.id) return message;
+    if (servedBy(message) === row.id) return message;
     const { providerReplay, reasoning, thinkingBlocks, ...plain } = message;
     return plain;
   });
@@ -204,7 +208,7 @@ async function commitFallbackAccount(providerName, pool, row, model, refusalScop
 // the binding survives a restart and eviction from this map, which only
 // spares the history walk. Bounded, oldest binding first out.
 const SESSION_ACCOUNT_LIMIT = 1000;
-const ROUTING_METADATA_KEY = 'accountRouting';
+export const ROUTING_METADATA_KEY = 'accountRouting';
 const sessionAccounts = new Map();
 
 // Forget every in-memory binding, as a restart does (tests).
@@ -520,7 +524,7 @@ function rotationReason(evidence, accountBlocked) {
 
 // The pool's send: walks the eligible accounts until one answers, blocking
 // the ones whose quota window is exhausted along the way.
-function poolSend(providerName, account) {
+function poolSend(providerName, account, servedBy) {
   return async function send(messages, model, tools, options = {}) {
     const request = { providerName, model, account, options };
     // This send's record of the roster: the accounts it tried, those it found
@@ -541,7 +545,8 @@ function poolSend(providerName, account) {
       options.signal?.throwIfAborted();
       const pool = readProviderAccountPool(providerName);
       if (!pool.accounts.length) {
-        throwIfPlanQuotaSpent(providerName, pool, model);
+        // A custom provider's key has no plan meter to consult.
+        if (!isCustomKeyProvider(providerName)) throwIfPlanQuotaSpent(providerName, pool, model);
         return account('default').send(messages, model, tools, options);
       }
       const policy = providerAccountPolicy(pool);
@@ -559,7 +564,7 @@ function poolSend(providerName, account) {
       }
       ledger.attempted.add(row.id);
       sends += 1;
-      const bound = boundAccountSend(providerName, row, messages, options);
+      const bound = boundAccountSend(providerName, row, messages, options, servedBy);
       try {
         const result = await account(row.id).send(bound.history, model, tools, bound.opts);
         quotaStrikes.delete(`${providerName}:${row.id}`);
@@ -660,3 +665,33 @@ export function createAccountPoolProvider(providerName, create) {
     }
   );
 }
+
+// Every key of a custom provider reaches one endpoint, so its answers carry
+// no key-bound server state but what an answer's routing names: history from
+// before the key pool (or from no pooled send) is the primary key's.
+function customKeyServedBy(providerName) {
+  return (entry) => {
+    const routing = entry?.providerMetadata?.[ROUTING_METADATA_KEY];
+    if (routing?.provider === providerName && routing.accountId) return routing.accountId;
+    return replayAccount(entry) || 'default';
+  };
+}
+
+/**
+ * A custom provider's API keys as one roster (provider-accounts.mjs
+ * `setCustomProviderKeyIds`): `primary` is the `default` account and answers
+ * everything but `send`; `keyEngine(id)` is the engine sending with
+ * additional key `id`. Without additional keys the roster is empty and every
+ * send is the primary's own, unchanged.
+ */
+export function createCustomKeyPoolProvider(providerName, primary, keyEngine) {
+  const engines = new Map([['default', primary]]);
+  const account = (id) => {
+    if (!engines.has(id)) engines.set(id, keyEngine(id));
+    return engines.get(id);
+  };
+  const send = poolSend(providerName, account, customKeyServedBy(providerName));
+  return new Proxy(primary, {
+    get: (target, key, receiver) => (key === 'send' ? send : Reflect.get(target, key, receiver)),
+  });
+}

package/src/runtime/agent/orchestrator/providers/anthropic-api-request.mjs

@@ -189,8 +189,7 @@ export async function buildAnthropicApiRequest({
   // Diagnostic: per-block prefix hashes of exactly what is sent.
   recordAnthropicPrefix(anthropicPrefixSessionId(opts), anthropicPrefixFingerprint(params));
 
-  const requestHeaders = requestHeadersFor(params, {
-    config,
+  const betas = requestBetasFor(params, {
     opts,
     isCustom,
     fastLatched,
@@ -198,8 +197,10 @@ export async function buildAnthropicApiRequest({
     capabilityModel,
     effortProjection,
   });
+  const requestHeaders = requestHeadersFor(betas, { config, opts });
 
-  return { params, requestHeaders, knownToolNames, fastModeLatched: fastLatched };
+  // `betas`: the selected beta names, whether or not this route sends them as a header.
+  return { params, requestHeaders, betas, knownToolNames, fastModeLatched: fastLatched };
 }
 
 /** The turn's thinking/effort fields on `params` (in place): a custom
@@ -247,35 +248,36 @@ function resolveRequestToolChoice(params, opts, config) {
   else delete params.tool_choice;
 }
 
-/** The per-request headers of the final body `params`: the anthropic-beta
- *  set it needs, then the caller's `opts.requestHeaders`; null when none. */
-function requestHeadersFor(
-  params,
-  { config, opts, isCustom, fastLatched, hasDeferredTools, capabilityModel, effortProjection }
-) {
+/** The anthropic-beta names the final body `params` needs. A custom endpoint
+ *  gets no first-party base betas; only those its own request body needs
+ *  (row-driven effort, deferred tools). */
+function requestBetasFor(params, { opts, isCustom, fastLatched, hasDeferredTools, capabilityModel, effortProjection }) {
+  return [
+    buildAnthropicBetaHeaders({
+      ...(isCustom ? { base: '' } : {}),
+      fastMode: fastLatched,
+      toolSearch: hasDeferredTools,
+      // Custom: the beta follows the resolver's output, not the model id.
+      effort: isCustom ? Boolean(params.output_config?.effort) : shouldIncludeEffortBeta(capabilityModel, opts),
+      serverFallback: params.fallbacks === 'default',
+      thinkingDisplayUpdates: params.thinking?.display === 'updates',
+      turnScopedSystem: hasAnthropicTurnScopedMessages(params.messages),
+    }),
+    ...(effortProjection ? [EFFORT_CONFIGURATION_BETA] : []),
+  ]
+    .join(',')
+    .split(',')
+    .filter(Boolean);
+}
+
+/** The per-request headers: the anthropic-beta header of `betas`, then the
+ *  caller's `opts.requestHeaders`; null when none. */
+function requestHeadersFor(betas, { config, opts }) {
   // Per-call headers override the client defaultHeaders, so the
   // constructor-level disableBetaHeaders opt-out must be honoured here
   // too — otherwise opencode-go's anthropic-compatible routing
   // (disableBetaHeaders:true) would still send beta strings that a
   // third-party endpoint may reject.
-  // A custom endpoint gets no first-party base betas; only those its own
-  // request body needs (row-driven effort, deferred tools).
-  let betaHeaders = null;
-  if (!config?.disableBetaHeaders) {
-    const betas = [
-      buildAnthropicBetaHeaders({
-        ...(isCustom ? { base: '' } : {}),
-        fastMode: fastLatched,
-        toolSearch: hasDeferredTools,
-        // Custom: the beta follows the resolver's output, not the model id.
-        effort: isCustom ? Boolean(params.output_config?.effort) : shouldIncludeEffortBeta(capabilityModel, opts),
-        serverFallback: params.fallbacks === 'default',
-        thinkingDisplayUpdates: params.thinking?.display === 'updates',
-        turnScopedSystem: hasAnthropicTurnScopedMessages(params.messages),
-      }),
-      ...(effortProjection ? [EFFORT_CONFIGURATION_BETA] : []),
-    ].filter(Boolean);
-    if (betas.length) betaHeaders = { 'anthropic-beta': betas.join(',') };
-  }
+  const betaHeaders = !config?.disableBetaHeaders && betas.length ? { 'anthropic-beta': betas.join(',') } : null;
   return betaHeaders || opts.requestHeaders ? { ...(betaHeaders || {}), ...(opts.requestHeaders || {}) } : null;
 }

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-client-version.mjs

@@ -10,7 +10,7 @@ import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
 // source release just to advance the user-agent version.
 // Claude Opus 5.5 requires 2.1.280 or newer. The release workflow raises this
 // to the published CLI version (scripts/sync-client-version-floors.mjs).
-export const DEFAULT_CLI_VERSION = '2.1.311';
+export const DEFAULT_CLI_VERSION = '2.1.316';
 export const CLAUDE_CLI_NPM_PACKAGE = '@anthropic-ai/claude-code';
 
 const CACHE_SCHEMA_VERSION = 1;

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-credentials.mjs

@@ -22,7 +22,12 @@ import {
   expiryFromAccessToken,
   isDefinitiveOAuthFailure,
   normalizeAccountIdentity,
+  oauthBodySummary,
   oauthCredentialStatus,
+  oauthFailureReason,
+  oauthPublicError,
+  oauthRequestError,
+  oauthResponseJson,
   scrubOAuthSecrets,
 } from './lib/oauth-token-utils.mjs';
 import { createOAuthPkce, parseOAuthCodeInput } from './lib/oauth-pkce.mjs';
@@ -271,7 +276,7 @@ export function _scrubTokens(text, secretValues = []) {
 }
 
 function _tokenEndpointError(operation, status, text, secretValues = []) {
-  const safeDetail = _scrubTokens(text, secretValues).replace(/\s+/g, ' ').trim().slice(0, 500);
+  const safeDetail = oauthBodySummary(text, secretValues);
   const detail = safeDetail ? `: ${safeDetail}` : '';
   const compatibility =
     status === 403
@@ -282,7 +287,7 @@ function _tokenEndpointError(operation, status, text, secretValues = []) {
         ' update Mixdog or set MIXDOG_CLI_VERSION to the installed official Claude Code version;' +
         ' then retry sign-in via /providers without an intercepting network layer if applicable.'
       : '';
-  return new Error(`${operation} ${status}${detail}.${compatibility}`);
+  return oauthPublicError(new Error(`${operation} ${status}${detail}.${compatibility}`));
 }
 
 export function isAnthropicOAuthRefreshDisabled() {
@@ -578,21 +583,26 @@ async function exchangeAuthorizationCode({ pkce, code, state, redirectUri, signa
   const cleanCode = String(code || '').trim();
   if (!cleanCode) throw new Error('[anthropic-oauth] authorization code is required');
   const timeoutSignal = AbortSignal.timeout(OAUTH_TOKEN_TIMEOUT_MS);
-  const tokenRes = await fetch(TOKEN_URL, {
-    method: 'POST',
-    headers: tokenEndpointHeaders(),
-    body: JSON.stringify({
-      grant_type: 'authorization_code',
-      code: cleanCode,
-      redirect_uri: redirectUri,
-      client_id: CLAUDE_CODE_CLIENT_ID,
-      code_verifier: pkce.verifier,
-      state,
-    }),
-    redirect: 'error',
-    signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal,
-    dispatcher: getLlmDispatcher(),
-  });
+  let tokenRes;
+  try {
+    tokenRes = await fetch(TOKEN_URL, {
+      method: 'POST',
+      headers: tokenEndpointHeaders(),
+      body: JSON.stringify({
+        grant_type: 'authorization_code',
+        code: cleanCode,
+        redirect_uri: redirectUri,
+        client_id: CLAUDE_CODE_CLIENT_ID,
+        code_verifier: pkce.verifier,
+        state,
+      }),
+      redirect: 'error',
+      signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal,
+      dispatcher: getLlmDispatcher(),
+    });
+  } catch (err) {
+    throw oauthRequestError('[anthropic-oauth] token exchange', err);
+  }
   if (!tokenRes.ok) {
     const text = await tokenRes.text().catch(() => '');
     throw _tokenEndpointError('[anthropic-oauth] token exchange', tokenRes.status, text, [
@@ -601,7 +611,7 @@ async function exchangeAuthorizationCode({ pkce, code, state, redirectUri, signa
       state,
     ]);
   }
-  const json = await tokenRes.json();
+  const json = await oauthResponseJson(tokenRes, '[anthropic-oauth] token exchange');
   const accessToken = json?.access_token || json?.accessToken;
   const refreshToken = json?.refresh_token || json?.refreshToken;
   if (!accessToken || !refreshToken) {
@@ -727,10 +737,10 @@ export async function beginOAuthLogin({ openBrowserFn = null, openBrowser = true
         await acceptCode(code, OAUTH_REDIRECT_URI);
         res.writeHead(200, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE, Connection: 'close' });
         res.end(oauthSuccessHtml('Claude'));
-      } catch {
-        // The shared exchange reports its error through waitForCallback.
+      } catch (err) {
+        // The shared exchange also reports its error through waitForCallback.
         res.writeHead(500, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE, Connection: 'close' });
-        res.end(oauthErrorHtml('Claude could not complete the token exchange.'));
+        res.end(oauthErrorHtml(oauthFailureReason('Claude could not complete the token exchange.', err)));
       }
     });
     timeout = setTimeout(() => finish(null), OAUTH_LOGIN_TIMEOUT_MS);

package/src/runtime/agent/orchestrator/providers/anthropic-sse-turn/turn-events/content-block-stop.mjs

@@ -7,9 +7,9 @@
 import { makeInvalidToolArgsMarker } from '../../lib/openai-tool-args.mjs';
 import { OAUTH_STREAM_LABELS } from '../../lib/anthropic-stream-labels.mjs';
 
-// Bare JSON.parse used to throw straight up into the surrounding broad catch,
-// which swallowed the whole tool_call — the loop never saw it and the
-// assistant turn ended with an unmatched tool_use id. A malformed input still
+// A bare JSON.parse would throw into the surrounding broad catch, which
+// swallows the whole tool_call — the loop never sees it and the assistant
+// turn ends with an unmatched tool_use id. A malformed input still
 // produces a tool_call (with an invalid-args marker and a logged error)
 // instead of a silent drop or accidental `{}` dispatch. Tool arguments must
 // be a plain object: Anthropic's tool_use input is always a JSON object, but

package/src/runtime/agent/orchestrator/providers/antigravity-oauth-login.mjs

@@ -266,7 +266,9 @@ export async function exchangeAuthorizationCode({ code, verifier, fetchFn = fetc
   });
   if (!res.ok) {
     const text = await res.text().catch(() => '');
-    throw new Error(`[antigravity-oauth] token exchange ${res.status}: ${_scrubTokens(text).slice(0, 300)}`);
+    // The authorization code is redacted by value: `code` alone is not a secret field.
+    const detail = _scrubTokens(text, [cleanCode, verifier]).slice(0, 300);
+    throw new Error(`[antigravity-oauth] token exchange ${res.status}: ${detail}`);
   }
   const json = await res.json();
   if (!json?.access_token || !json?.refresh_token) {

package/src/runtime/agent/orchestrator/providers/antigravity-oauth-tokens.mjs

@@ -231,8 +231,8 @@ export function saveTokens(tokens) {
   );
 }
 
-export function _scrubTokens(text) {
-  return scrubOAuthSecrets(text);
+export function _scrubTokens(text, secretValues = []) {
+  return scrubOAuthSecrets(text, secretValues);
 }
 
 export function hasAntigravityOAuthCredentials() {

package/src/runtime/agent/orchestrator/providers/codex-client-meta.mjs

@@ -20,7 +20,7 @@ import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
 // version (gpt-6.1-sol requires >= 0.159.0, measured 2026-10-09), so the
 // release workflow raises this to the published CLI version on every release
 // (scripts/sync-client-version-floors.mjs).
-export const CODEX_CLIENT_VERSION_FLOOR = '0.164.0';
+export const CODEX_CLIENT_VERSION_FLOOR = '0.166.0';
 export const CODEX_CLI_NPM_PACKAGE = '@openai/codex';
 const live = createNpmVersionSource(CODEX_CLI_NPM_PACKAGE, { persistKey: 'codex-cli' });
 

package/src/runtime/agent/orchestrator/providers/command-code-oauth.mjs

@@ -361,7 +361,7 @@ export class CommandCodeOAuthProvider {
     if (Array.isArray(body?.data)) list = body.data;
     else if (Array.isArray(body)) list = body;
     const items = list.filter((item) => modelWire(item));
-    publish(items.map(rosterRow));
+    await publish(items.map(rosterRow));
     if (this.tokens?.apiKey === apiKey) {
       // Rows accumulate for one key: a later roster that misses a model
       // leaves the endpoints it was last listed with.

package/src/runtime/agent/orchestrator/providers/custom-provider-config.mjs

@@ -12,13 +12,21 @@ export const CUSTOM_REASONING_LEVELS = CUSTOM_EFFORT_LEVELS;
 export const CUSTOM_REASONING_WIRE_FORMATS = Object.freeze(['standard', 'deepseek', 'together', 'vllm']);
 export const CUSTOM_PROVIDER_AUTH_MODES = Object.freeze(['key', 'none']);
 export const CUSTOM_MODEL_OVERRIDE_LIMIT = 500;
+export const CUSTOM_HEADER_LIMIT = 64;
 
 const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
 const MAX_MODEL_ID = 256;
 const MAX_NAME = 200;
 const MAX_WIRE_VALUE = 64;
+const MAX_HEADER_TEXT = 4096;
 // biome-ignore lint/suspicious/noControlCharactersInRegex: rejecting control characters is the point.
 const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+// RFC 9110 field-name token, and a field value of visible ASCII, space, tab and
+// obs-text (what a fetch Headers value can carry).
+const HEADER_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+const HEADER_VALUE = /^[\t\x20-\x7e\x80-\xff]*$/;
+// The API key field owns authentication; a header may not carry a credential.
+const AUTH_HEADERS = new Set(['authorization', 'x-api-key', 'api-key']);
 
 function fail(message) {
   throw new Error(`[custom-provider] ${message}`);
@@ -84,6 +92,7 @@ const V2_TOP_LEVEL_KEYS = new Set([
   'modelOverrides',
   'wires',
   'modelWires',
+  'headers',
   'id',
   'apiKey',
   'apiKeyEnv',
@@ -295,6 +304,34 @@ function normalizeModelWires(raw, protocol, wires) {
   return out;
 }
 
+// `headers`: extra HTTP headers sent with every request to the endpoint
+// (inference, model discovery, connection test). Names are case-insensitive
+// tokens; the credential headers belong to the API key field.
+function normalizeHeaders(raw) {
+  if (raw === undefined) return {};
+  if (!isPlainObject(raw)) fail('headers must be an object of header names to string values');
+  const names = Object.keys(raw);
+  if (names.length > CUSTOM_HEADER_LIMIT) fail(`at most ${CUSTOM_HEADER_LIMIT} headers are allowed`);
+  const seen = new Set();
+  const entries = [];
+  for (const name of names) {
+    if (name.length > MAX_HEADER_TEXT || !HEADER_NAME.test(name))
+      fail(`headers has an invalid header name: ${JSON.stringify(name.slice(0, 64))}`);
+    const lower = name.toLowerCase();
+    if (AUTH_HEADERS.has(lower)) fail(`headers must not set ${name}: authentication belongs to the API key field`);
+    if (seen.has(lower)) fail(`headers has duplicate header: ${name}`);
+    seen.add(lower);
+    if (typeof raw[name] !== 'string') fail(`headers.${name} must be a string`);
+    // Validate before trimming, and trim only HTTP whitespace (space, tab), so
+    // CR/LF is refused rather than stripped and other characters are kept.
+    if (!HEADER_VALUE.test(raw[name])) fail(`headers.${name} has an invalid value`);
+    const value = raw[name].replace(/^[ \t]+|[ \t]+$/g, '');
+    if (value.length > MAX_HEADER_TEXT) fail(`headers.${name} has an invalid value`);
+    entries.push([name, value]);
+  }
+  return Object.fromEntries(entries);
+}
+
 // Legacy (pre-v2) `models: [{ id, name?, contextWindow?, maxOutputTokens? }]`
 // become manual, visible overrides; their presence hides newly discovered ids.
 function migrateLegacy(input) {
@@ -336,6 +373,7 @@ export function normalizeCustomProviderConfig(input) {
       fail('modelOverrides and discovery require schemaVersion 2');
     if (input.wires !== undefined || input.modelWires !== undefined)
       fail('wires and modelWires require schemaVersion 2');
+    if (input.headers !== undefined) fail('headers require schemaVersion 2');
     source = migrateLegacy(input);
   } else if (Number.isInteger(version) && version > CUSTOM_PROVIDER_SCHEMA_VERSION)
     fail(`unsupported schemaVersion ${version}; update mixdog to use this provider`);
@@ -368,6 +406,7 @@ export function normalizeCustomProviderConfig(input) {
   const newModelsHidden = optionalBoolean(discovery.newModelsHidden, 'discovery.newModelsHidden') ?? false;
   const wires = normalizeWires(source.wires, protocol);
   const modelWires = normalizeModelWires(source.modelWires, protocol, wires);
+  const headers = normalizeHeaders(source.headers);
   return {
     type: 'custom',
     schemaVersion: CUSTOM_PROVIDER_SCHEMA_VERSION,
@@ -377,6 +416,7 @@ export function normalizeCustomProviderConfig(input) {
     enabled: source.enabled !== false,
     auth,
     ...(apiKeyEnv && auth === 'key' ? { apiKeyEnv } : {}),
+    ...(Object.keys(headers).length ? { headers } : {}),
     discovery: { newModelsHidden },
     modelOverrides: normalizeOverrides(source.modelOverrides, protocol, legacy),
     ...(wires ? { wires } : {}),