neoagent 3.2.1-beta.1 → 3.2.1-beta.11

package/server/services/ai/providers/claudeCode.js

@@ -2,6 +2,8 @@ const os = require('os');
 const fs = require('fs');
 const path = require('path');
 const Anthropic = require('@anthropic-ai/sdk');
+const { ENV_FILE, upsertEnvValue } = require('../../../../runtime/paths');
+const { fetchResponseText } = require('../../network/http');
 const { AnthropicProvider } = require('./anthropic');
 
 const CLAUDE_CLI_CREDS_PATH = path.join(os.homedir(), '.claude', '.credentials.json');
@@ -12,6 +14,8 @@ const CLAUDE_CODE_SYSTEM_PROMPT = "You are Claude Code, Anthropic's official CLI
 const CLAUDE_CODE_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
 const CLAUDE_CODE_TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
 const CLAUDE_CODE_SCOPES = 'user:inference user:profile org:create_api_key user:sessions:claude_code user:mcp_servers';
+const OAUTH_REFRESH_TIMEOUT_MS = 30000;
+const OAUTH_MAX_RESPONSE_BYTES = 256 * 1024;
 
 function readTokenRecord(data) {
   const tokens = data?.claudeAiOauthTokens || data?.claudeAiOauth || {};
@@ -71,40 +75,17 @@ function normalizeExpiresAt(data) {
   return null;
 }
 
-function sanitizeEnvKey(key) {
-  return String(key).replace(/[\r\n]/g, '');
-}
-
-function sanitizeEnvValue(value) {
-  return String(value).replace(/[\r\n]/g, '');
-}
-
 function persistEnvValue(key, value) {
   if (!value) return;
   try {
-    const { ENV_FILE } = require('../../../../runtime/paths');
-    const safeKey = sanitizeEnvKey(key);
-    const safeValue = sanitizeEnvValue(value);
-    const raw = fs.existsSync(ENV_FILE) ? fs.readFileSync(ENV_FILE, 'utf8') : '';
-    const lines = raw ? raw.split('\n') : [];
-    let replaced = false;
-    for (let i = 0; i < lines.length; i++) {
-      if (lines[i].startsWith(`${safeKey}=`)) {
-        lines[i] = `${safeKey}=${safeValue}`;
-        replaced = true;
-        break;
-      }
-    }
-    if (!replaced) lines.push(`${safeKey}=${safeValue}`);
-    const output = lines.filter((_, idx, arr) => idx !== arr.length - 1 || arr[idx] !== '').join('\n') + '\n';
-    fs.mkdirSync(path.dirname(ENV_FILE), { recursive: true });
-    fs.writeFileSync(ENV_FILE, output, { mode: 0o600 });
+    upsertEnvValue(ENV_FILE, key, value);
   } catch { }
 }
 
-async function refreshClaudeCodeAccessToken(refreshToken, fetchImpl = fetch) {
+async function refreshClaudeCodeAccessToken(refreshToken, fetchImpl = fetch, signal = null) {
   if (!refreshToken) return null;
-  const response = await fetchImpl(CLAUDE_CODE_TOKEN_URL, {
+  const { response, text } = await fetchResponseText(CLAUDE_CODE_TOKEN_URL, {
+    fetchImpl,
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
@@ -116,9 +97,14 @@ async function refreshClaudeCodeAccessToken(refreshToken, fetchImpl = fetch) {
       refresh_token: refreshToken,
       client_id: CLAUDE_CODE_CLIENT_ID,
     }),
+    signal,
+    timeoutMs: OAUTH_REFRESH_TIMEOUT_MS,
+    maxResponseBytes: OAUTH_MAX_RESPONSE_BYTES,
+    serviceName: 'Claude Code OAuth refresh',
+    timeoutCode: 'PROVIDER_OAUTH_TIMEOUT',
+    tooLargeCode: 'PROVIDER_OAUTH_RESPONSE_TOO_LARGE',
   });
 
-  const text = await response.text();
   let data = {};
   try {
     data = text ? JSON.parse(text) : {};
@@ -127,7 +113,9 @@ async function refreshClaudeCodeAccessToken(refreshToken, fetchImpl = fetch) {
   }
 
   if (!response.ok) {
-    const detail = data?.error?.message || data?.error_description || data?.error || text || 'Unknown error';
+    const detail = String(
+      data?.error?.message || data?.error_description || data?.error || text || 'Unknown error',
+    ).slice(0, 2000);
     throw new Error(`Claude Code OAuth refresh failed: HTTP ${response.status} ${detail}`);
   }
   if (!data.access_token) {
@@ -209,8 +197,8 @@ class ClaudeCodeProvider extends AnthropicProvider {
     });
   }
 
-  async refreshClient() {
-    const refreshed = await refreshClaudeCodeAccessToken(this.refreshToken, this.fetchImpl);
+  async refreshClient(signal = null) {
+    const refreshed = await refreshClaudeCodeAccessToken(this.refreshToken, this.fetchImpl, signal);
     if (!refreshed?.access) return false;
     this.authToken = refreshed.access;
     this.refreshToken = refreshed.refresh || this.refreshToken;
@@ -244,7 +232,7 @@ class ClaudeCodeProvider extends AnthropicProvider {
       if ((!isAuthenticationError(err) && !isInferenceScopeError(err)) || !this.refreshToken) {
         throw formatClaudeCodeCredentialError(err);
       }
-      await this.refreshClient();
+      await this.refreshClient(options.signal);
       try {
         return await super.chat(messages, tools, options);
       } catch (retryErr) {
@@ -260,7 +248,7 @@ class ClaudeCodeProvider extends AnthropicProvider {
       if ((!isAuthenticationError(err) && !isInferenceScopeError(err)) || !this.refreshToken) {
         throw formatClaudeCodeCredentialError(err);
       }
-      await this.refreshClient();
+      await this.refreshClient(options.signal);
       try {
         yield* super.stream(messages, tools, options);
       } catch (retryErr) {

package/server/services/ai/providers/githubCopilot.js

@@ -1,4 +1,9 @@
 const { OpenAIProvider } = require('./openai');
+const {
+  fetchResponseText,
+  waitForAbortableResult,
+} = require('../../network/http');
+const { sanitizeProviderErrorDetail } = require('./provider_error');
 
 class GithubCopilotProvider extends OpenAIProvider {
   constructor(config = {}) {
@@ -26,35 +31,47 @@ class GithubCopilotProvider extends OpenAIProvider {
     this._refreshPromise = null;
   }
 
-  async _refreshCopilotToken() {
-    if (this._refreshPromise) return this._refreshPromise;
-
+  async _refreshCopilotToken(signal = null) {
     const now = Math.floor(Date.now() / 1000);
     // Refresh token if missing or expiring in less than 5 minutes
     if (this.copilotToken && this.tokenExpiresAt >= now + 300) {
       return;
     }
 
-    this._refreshPromise = (async () => {
-      try {
+    if (!this._refreshPromise) {
+      this._refreshPromise = (async () => {
         if (!this.githubToken) {
           throw new Error('GitHub Copilot access token is missing. Please run `neoagent login github-copilot`.');
         }
 
-        const res = await fetch('https://api.github.com/copilot_internal/v2/token', {
+        const { response, text } = await fetchResponseText(
+          'https://api.github.com/copilot_internal/v2/token',
+          {
           headers: {
             'Authorization': `token ${this.githubToken}`,
             'Accept': 'application/json',
             'User-Agent': 'NeoAgent/1.0.0'
-          }
-        });
-
-        if (!res.ok) {
-          const errorText = await res.text().catch(() => 'Unknown error');
-          throw new Error(`Failed to refresh GitHub Copilot token: HTTP ${res.status} - ${errorText}`);
+          },
+            maxResponseBytes: 1024 * 1024,
+            serviceName: 'GitHub Copilot token refresh',
+          },
+        );
+
+        if (!response.ok) {
+          const error = new Error(
+            `Failed to refresh GitHub Copilot token: HTTP ${response.status} - ${sanitizeProviderErrorDetail(text.slice(0, 500))}`,
+          );
+          error.status = response.status;
+          error.headers = response.headers;
+          throw error;
         }
 
-        const data = await res.json();
+        let data;
+        try {
+          data = JSON.parse(text || '{}');
+        } catch {
+          throw new Error('Invalid token response from GitHub Copilot.');
+        }
         if (!data || typeof data.token !== 'string' || !data.token) {
           throw new Error('Invalid token response from GitHub Copilot.');
         }
@@ -70,26 +87,30 @@ class GithubCopilotProvider extends OpenAIProvider {
 
         // Update the client's API key
         this.client.apiKey = this.copilotToken;
-      } finally {
+      })().finally(() => {
         this._refreshPromise = null;
-      }
-    })();
+      });
+    }
 
-    return this._refreshPromise;
+    return waitForAbortableResult(
+      this._refreshPromise,
+      signal,
+      'GitHub Copilot token refresh aborted.',
+    );
   }
 
   async chat(messages, tools = [], options = {}) {
-    await this._refreshCopilotToken();
+    await this._refreshCopilotToken(options.signal);
     return super.chat(messages, tools, options);
   }
 
   async *stream(messages, tools = [], options = {}) {
-    await this._refreshCopilotToken();
+    await this._refreshCopilotToken(options.signal);
     yield* super.stream(messages, tools, options);
   }
 
   async analyzeImage(options = {}) {
-    await this._refreshCopilotToken();
+    await this._refreshCopilotToken(options.signal);
     return super.analyzeImage(options);
   }
 }

package/server/services/ai/providers/google.js

@@ -1,5 +1,62 @@
-const { GoogleGenerativeAI } = require('@google/generative-ai');
+'use strict';
+
+const { GoogleGenAI } = require('@google/genai');
 const { BaseProvider } = require('./base');
+const { fetchResponseText } = require('../../network/http');
+
+function parseToolArguments(value) {
+  try {
+    const parsed = JSON.parse(value || '{}');
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+      ? parsed
+      : {};
+  } catch {
+    return {};
+  }
+}
+
+function normalizeUsage(usage) {
+  if (!usage) return null;
+  return {
+    inputTokens: usage.promptTokenCount || 0,
+    outputTokens: usage.candidatesTokenCount || 0,
+    reasoningTokens: usage.thoughtsTokenCount || 0,
+    cachedReadTokens: usage.cachedContentTokenCount || 0,
+    cacheWriteTokens: 0,
+    promptTokens: usage.promptTokenCount || 0,
+    completionTokens: usage.candidatesTokenCount || 0,
+    totalTokens: usage.totalTokenCount || 0
+  };
+}
+
+function collectResponseParts(response, toolCalls, seenToolCalls = null) {
+  let content = '';
+  for (const candidate of response?.candidates || []) {
+    for (const part of candidate.content?.parts || []) {
+      if (part.text && part.thought !== true) content += part.text;
+      if (!part.functionCall?.name) continue;
+
+      const args = part.functionCall.args || {};
+      const providerCallId = String(part.functionCall.id || '').trim();
+      const signature = providerCallId
+        || `${part.functionCall.name}:${JSON.stringify(args)}`;
+      if (seenToolCalls?.has(signature)) continue;
+      seenToolCalls?.add(signature);
+
+      toolCalls.push({
+        id: providerCallId
+          || `call_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+        type: 'function',
+        function: {
+          name: part.functionCall.name,
+          arguments: JSON.stringify(args),
+          thought_signature: part.thoughtSignature
+        }
+      });
+    }
+  }
+  return content;
+}
 
 class GoogleProvider extends BaseProvider {
   constructor(config = {}) {
@@ -28,16 +85,33 @@ class GoogleProvider extends BaseProvider {
       'gemini-1.5-flash': 1048576,
     };
     this.apiKey = config.apiKey || process.env.GOOGLE_AI_KEY;
-    this.genAI = new GoogleGenerativeAI(this.apiKey);
+    this.genAI = new GoogleGenAI({ apiKey: this.apiKey });
   }
 
-  async listModels() {
+  async listModels(signal = null) {
     const DROP = /tts|lyria|robotics|deep-research|antigravity|computer-use|-image(?!.*it)/i;
-    const res = await fetch(
-      `https://generativelanguage.googleapis.com/v1beta/models?key=${this.apiKey}&pageSize=200`
+    const { response, text } = await fetchResponseText(
+      'https://generativelanguage.googleapis.com/v1beta/models?pageSize=200',
+      {
+        headers: { 'x-goog-api-key': this.apiKey },
+        maxResponseBytes: 5 * 1024 * 1024,
+        serviceName: 'Google model catalog',
+        signal,
+      },
     );
-    if (!res.ok) throw new Error(`Google models API returned ${res.status}`);
-    const { models = [] } = await res.json();
+    if (!response.ok) {
+      const error = new Error(`Google models API returned ${response.status}`);
+      error.status = response.status;
+      error.headers = response.headers;
+      throw error;
+    }
+    let payload;
+    try {
+      payload = JSON.parse(text || '{}');
+    } catch {
+      throw new Error('Google models API returned invalid JSON.');
+    }
+    const { models = [] } = payload;
     return models
       .filter((m) => {
         const id = m.name.replace('models/', '');
@@ -60,11 +134,23 @@ class GoogleProvider extends BaseProvider {
       functionDeclarations: tools.map(tool => ({
         name: tool.name,
         description: tool.description,
-        parameters: tool.parameters || { type: 'object', properties: {} }
+        parametersJsonSchema: tool.parameters || { type: 'object', properties: {} }
       }))
     }];
   }
 
+  buildGenerateConfig(systemInstruction, tools, options) {
+    const config = {};
+    if (systemInstruction) config.systemInstruction = systemInstruction;
+    if (tools.length > 0) config.tools = this.formatTools(tools);
+    if (options.signal) config.abortSignal = options.signal;
+    const maxOutputTokens = Number(options.maxTokens);
+    if (Number.isFinite(maxOutputTokens) && maxOutputTokens > 0) {
+      config.maxOutputTokens = Math.floor(maxOutputTokens);
+    }
+    return config;
+  }
+
   convertMessages(messages) {
     let systemInstruction = '';
     const history = [];
@@ -75,14 +161,16 @@ class GoogleProvider extends BaseProvider {
         continue;
       }
       if (msg.role === 'tool') {
+        const functionResponse = {
+          name: msg.name || 'tool',
+          response: { result: msg.content }
+        };
+        if (msg.tool_call_id) functionResponse.id = msg.tool_call_id;
         history.push({
-          role: 'function',
-          parts: [{
-            functionResponse: {
-              name: msg.name || 'tool',
-              response: { result: msg.content }
-            }
-          }]
+          // The current Gemini API represents tool results as functionResponse
+          // parts on a user turn.
+          role: 'user',
+          parts: [{ functionResponse }]
         });
         continue;
       }
@@ -93,9 +181,10 @@ class GoogleProvider extends BaseProvider {
           const functionCallPart = {
             functionCall: {
               name: tc.function.name,
-              args: JSON.parse(tc.function.arguments || '{}')
+              args: parseToolArguments(tc.function.arguments)
             }
           };
+          if (tc.id) functionCallPart.functionCall.id = tc.id;
           if (tc.function.thought_signature) {
             functionCallPart.thoughtSignature = tc.function.thought_signature;
           }
@@ -129,6 +218,18 @@ class GoogleProvider extends BaseProvider {
       normalizedHistory.push({ role: currentRole, parts: currentParts });
     }
 
+    // Structured helpers can consist entirely of system instructions. Gemini
+    // still requires a user turn to trigger generation.
+    if (
+      normalizedHistory.length === 0
+      || normalizedHistory[normalizedHistory.length - 1].role === 'model'
+    ) {
+      normalizedHistory.push({
+        role: 'user',
+        parts: [{ text: 'Provide the requested response using the system instructions.' }]
+      });
+    }
+
     if (normalizedHistory.length > 0 && normalizedHistory[0].role !== 'user') {
       normalizedHistory.unshift({
         role: 'user',
@@ -142,53 +243,18 @@ class GoogleProvider extends BaseProvider {
   async chat(messages, tools = [], options = {}) {
     const model = options.model || this.config.model || this.getDefaultModel();
     const { systemInstruction, history } = this.convertMessages(messages);
-
-    const genModel = this.genAI.getGenerativeModel({
+    const response = await this.genAI.models.generateContent({
       model,
-      systemInstruction: systemInstruction || undefined,
-      tools: tools.length > 0 ? this.formatTools(tools) : undefined
+      contents: history,
+      config: this.buildGenerateConfig(systemInstruction, tools, options)
     });
-
-    const lastMessage = history.pop();
-    const chat = genModel.startChat({ history });
-    const result = await chat.sendMessage(lastMessage.parts, { signal: options.signal });
-    const response = result.response;
-
-    let content = '';
     const toolCalls = [];
-
-    for (const candidate of response.candidates || []) {
-      for (const part of candidate.content?.parts || []) {
-        if (part.text) content += part.text;
-        if (part.functionCall) {
-          toolCalls.push({
-            id: `call_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
-            type: 'function',
-            function: {
-              name: part.functionCall.name,
-              arguments: JSON.stringify(part.functionCall.args || {}),
-              thought_signature: part.thoughtSignature
-            }
-          });
-        }
-      }
-    }
-
-    const usage = response.usageMetadata;
+    const content = collectResponseParts(response, toolCalls);
     return {
       content,
       toolCalls,
       finishReason: toolCalls.length > 0 ? 'tool_calls' : 'stop',
-      usage: usage ? {
-        inputTokens: usage.promptTokenCount || 0,
-        outputTokens: usage.candidatesTokenCount || 0,
-        reasoningTokens: usage.thoughtsTokenCount || 0,
-        cachedReadTokens: usage.cachedContentTokenCount || 0,
-        cacheWriteTokens: 0,
-        promptTokens: usage.promptTokenCount || 0,
-        completionTokens: usage.candidatesTokenCount || 0,
-        totalTokens: usage.totalTokenCount || 0
-      } : null,
+      usage: normalizeUsage(response.usageMetadata),
       model
     };
   }
@@ -196,60 +262,32 @@ class GoogleProvider extends BaseProvider {
   async *stream(messages, tools = [], options = {}) {
     const model = options.model || this.config.model || this.getDefaultModel();
     const { systemInstruction, history } = this.convertMessages(messages);
-
-    const genModel = this.genAI.getGenerativeModel({
+    const responseStream = await this.genAI.models.generateContentStream({
       model,
-      systemInstruction: systemInstruction || undefined,
-      tools: tools.length > 0 ? this.formatTools(tools) : undefined
+      contents: history,
+      config: this.buildGenerateConfig(systemInstruction, tools, options)
     });
-
-    const lastMessage = history.pop();
-    const chat = genModel.startChat({ history });
-    const result = await chat.sendMessageStream(lastMessage.parts, { signal: options.signal });
-
     let content = '';
     const toolCalls = [];
+    const seenToolCalls = new Set();
+    let usage = null;
 
-    for await (const chunk of result.stream) {
-      for (const candidate of chunk.candidates || []) {
-        for (const part of candidate.content?.parts || []) {
-          if (part.text) {
-            content += part.text;
-            yield { type: 'content', content: part.text };
-          }
-          if (part.functionCall) {
-            toolCalls.push({
-              id: `call_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
-              type: 'function',
-              function: {
-                name: part.functionCall.name,
-                arguments: JSON.stringify(part.functionCall.args || {}),
-                thought_signature: part.thoughtSignature
-              }
-            });
-          }
-        }
+    for await (const chunk of responseStream) {
+      const chunkContent = collectResponseParts(chunk, toolCalls, seenToolCalls);
+      if (chunkContent) {
+        content += chunkContent;
+        yield { type: 'content', content: chunkContent };
       }
+      if (chunk.usageMetadata) usage = chunk.usageMetadata;
     }
 
-    const finalResponse = await result.response;
-    const usage = finalResponse.usageMetadata;
-
     yield {
       type: 'done',
       content,
       toolCalls,
       finishReason: toolCalls.length > 0 ? 'tool_calls' : 'stop',
-      usage: usage ? {
-        inputTokens: usage.promptTokenCount || 0,
-        outputTokens: usage.candidatesTokenCount || 0,
-        reasoningTokens: usage.thoughtsTokenCount || 0,
-        cachedReadTokens: usage.cachedContentTokenCount || 0,
-        cacheWriteTokens: 0,
-        promptTokens: usage.promptTokenCount || 0,
-        completionTokens: usage.candidatesTokenCount || 0,
-        totalTokens: usage.totalTokenCount || 0
-      } : null
+      usage: normalizeUsage(usage),
+      model
     };
   }
 }

package/server/services/ai/providers/grok.js

@@ -1,5 +1,6 @@
 const OpenAI = require('openai');
 const { OpenAICompatibleProvider } = require('./openaiCompatible');
+const { wrapProviderError } = require('./provider_error');
 
 class GrokProvider extends OpenAICompatibleProvider {
   constructor(config = {}) {
@@ -11,15 +12,15 @@ class GrokProvider extends OpenAICompatibleProvider {
     });
   }
 
-  async listModels() {
+  async listModels(signal = null) {
     try {
-      const res = await this.client.models.list();
+      const res = await this.client.models.list({ signal });
       const DROP = /imagine|diffus|embed|-tts/i;
       return res.data
         .filter((m) => !DROP.test(m.id))
         .map((m) => ({ id: m.id, name: m.id }));
     } catch (err) {
-      throw new Error(`Failed to list Grok models: ${err.message || String(err)}`);
+      throw wrapProviderError(err, 'Failed to list Grok models', { signal });
     }
   }
 

package/server/services/ai/providers/grokOauth.js

@@ -1,12 +1,14 @@
-const fs = require('fs');
-const path = require('path');
 const OpenAI = require('openai');
+const { ENV_FILE, upsertEnvValue } = require('../../../../runtime/paths');
+const { fetchResponseText } = require('../../network/http');
 const { GrokProvider } = require('./grok');
 
 const GROK_OAUTH_BASE_URL = 'https://api.x.ai/v1';
 const GROK_OAUTH_CLIENT_ID = 'b1a00492-073a-47ea-816f-4c329264a828';
 const GROK_OAUTH_TOKEN_URL = 'https://auth.x.ai/oauth2/token';
 const GROK_OAUTH_SCOPES = 'openid profile email offline_access grok-cli:access api:access';
+const OAUTH_REFRESH_TIMEOUT_MS = 30000;
+const OAUTH_MAX_RESPONSE_BYTES = 256 * 1024;
 
 function normalizeExpiresAt(data) {
   if (typeof data.expires_at === 'number' && Number.isFinite(data.expires_at)) {
@@ -21,29 +23,14 @@ function normalizeExpiresAt(data) {
 function persistEnvValue(key, value) {
   if (!value) return;
   try {
-    const { ENV_FILE } = require('../../../../runtime/paths');
-    const safeKey = String(key).replace(/[\r\n]/g, '');
-    const safeValue = String(value).replace(/[\r\n]/g, '');
-    const raw = fs.existsSync(ENV_FILE) ? fs.readFileSync(ENV_FILE, 'utf8') : '';
-    const lines = raw ? raw.split('\n') : [];
-    let replaced = false;
-    for (let i = 0; i < lines.length; i++) {
-      if (lines[i].startsWith(`${safeKey}=`)) {
-        lines[i] = `${safeKey}=${safeValue}`;
-        replaced = true;
-        break;
-      }
-    }
-    if (!replaced) lines.push(`${safeKey}=${safeValue}`);
-    const output = lines.filter((_, idx, arr) => idx !== arr.length - 1 || arr[idx] !== '').join('\n') + '\n';
-    fs.mkdirSync(path.dirname(ENV_FILE), { recursive: true });
-    fs.writeFileSync(ENV_FILE, output, { mode: 0o600 });
+    upsertEnvValue(ENV_FILE, key, value);
   } catch { }
 }
 
-async function refreshGrokOAuthAccessToken(refreshToken, fetchImpl = fetch) {
+async function refreshGrokOAuthAccessToken(refreshToken, fetchImpl = fetch, signal = null) {
   if (!refreshToken) return null;
-  const response = await fetchImpl(GROK_OAUTH_TOKEN_URL, {
+  const { response, text } = await fetchResponseText(GROK_OAUTH_TOKEN_URL, {
+    fetchImpl,
     method: 'POST',
     headers: {
       'Content-Type': 'application/x-www-form-urlencoded',
@@ -54,9 +41,14 @@ async function refreshGrokOAuthAccessToken(refreshToken, fetchImpl = fetch) {
       refresh_token: refreshToken,
       client_id: GROK_OAUTH_CLIENT_ID,
     }),
+    signal,
+    timeoutMs: OAUTH_REFRESH_TIMEOUT_MS,
+    maxResponseBytes: OAUTH_MAX_RESPONSE_BYTES,
+    serviceName: 'Grok OAuth refresh',
+    timeoutCode: 'PROVIDER_OAUTH_TIMEOUT',
+    tooLargeCode: 'PROVIDER_OAUTH_RESPONSE_TOO_LARGE',
   });
 
-  const text = await response.text();
   let data = {};
   try {
     data = text ? JSON.parse(text) : {};
@@ -68,7 +60,7 @@ async function refreshGrokOAuthAccessToken(refreshToken, fetchImpl = fetch) {
     if (data?.error === 'invalid_grant') {
       throw new Error('Grok OAuth refresh token is invalid or expired. Re-run `neoagent login grok-oauth` to re-authenticate.');
     }
-    const detail = data?.error_description || data?.error || text || 'Unknown error';
+    const detail = String(data?.error_description || data?.error || text || 'Unknown error').slice(0, 2000);
     throw new Error(`Grok OAuth refresh failed: HTTP ${response.status} ${detail}`);
   }
   if (!data.access_token) {
@@ -102,8 +94,8 @@ class GrokOAuthProvider extends GrokProvider {
     this.fetchImpl = config.fetch || fetch;
   }
 
-  async refreshClient() {
-    const refreshed = await refreshGrokOAuthAccessToken(this.refreshToken, this.fetchImpl);
+  async refreshClient(signal = null) {
+    const refreshed = await refreshGrokOAuthAccessToken(this.refreshToken, this.fetchImpl, signal);
     if (!refreshed?.access) return false;
     this.authToken = refreshed.access;
     this.refreshToken = refreshed.refresh || this.refreshToken;
@@ -122,7 +114,7 @@ class GrokOAuthProvider extends GrokProvider {
       return await super.chat(messages, tools, options);
     } catch (err) {
       if (err?.status !== 401 || !this.refreshToken) throw err;
-      await this.refreshClient();
+      await this.refreshClient(options.signal);
       return await super.chat(messages, tools, options);
     }
   }
@@ -132,7 +124,7 @@ class GrokOAuthProvider extends GrokProvider {
       yield* super.stream(messages, tools, options);
     } catch (err) {
       if (err?.status !== 401 || !this.refreshToken) throw err;
-      await this.refreshClient();
+      await this.refreshClient(options.signal);
       yield* super.stream(messages, tools, options);
     }
   }