neoagent 3.2.1-beta.1 → 3.2.1-beta.3

package/server/services/ai/providerRetry.js

@@ -1,5 +1,16 @@
 'use strict';
 
+const { createAbortError } = require('../../utils/abort');
+const {
+  RETRYABLE_HTTP_STATUS: RETRYABLE_STATUS,
+  RETRYABLE_NETWORK_CODES: RETRYABLE_CODES,
+  abortableDelay,
+  computeBackoffMs,
+  getErrorCode,
+  getHttpStatus,
+  retryAfterMilliseconds,
+} = require('../../utils/retry');
+
 // Centralized transient-error retry for AI provider calls.
 //
 // A transient blip (rate limit, provider overload, brief network failure) should
@@ -14,17 +25,6 @@ const DEFAULTS = {
   maxDelayMs: 8000,
 };
 
-// HTTP statuses worth retrying: request timeout, conflict, rate limit, and the
-// 5xx family including Anthropic's 529 "overloaded" and common CDN edge codes.
-const RETRYABLE_STATUS = new Set([408, 409, 425, 429, 500, 502, 503, 504, 520, 521, 522, 524, 529]);
-
-// Low-level socket / DNS errors surfaced by Node and undici.
-const RETRYABLE_CODES = new Set([
-  'ECONNRESET', 'ECONNREFUSED', 'ETIMEDOUT', 'EPIPE', 'EAI_AGAIN', 'ENOTFOUND',
-  'ENETUNREACH', 'EHOSTUNREACH', 'EAGAIN',
-  'UND_ERR_CONNECT_TIMEOUT', 'UND_ERR_SOCKET', 'UND_ERR_HEADERS_TIMEOUT',
-]);
-
 function readNumberEnv(name, fallback, { min = 0, max = Number.MAX_SAFE_INTEGER } = {}) {
   const raw = process.env[name];
   if (raw === undefined || raw === null || String(raw).trim() === '') return fallback;
@@ -47,25 +47,10 @@ function resolveConfig(overrides = {}) {
 // SDKs disagree on where they put the HTTP status: OpenAI/Anthropic expose
 // `.status`, raw http clients use `.statusCode`, and some nest it under
 // `.response.status`. Check all of them.
-function getStatus(err) {
-  if (!err || typeof err !== 'object') return null;
-  const candidates = [err.status, err.statusCode, err.response?.status, err.cause?.status];
-  for (const value of candidates) {
-    const num = Number(value);
-    if (Number.isFinite(num) && num >= 100 && num < 600) return num;
-  }
-  return null;
-}
-
-function getErrorCode(err) {
-  if (!err || typeof err !== 'object') return null;
-  return err.code || err.errno || err.cause?.code || null;
-}
-
 function isTransientError(err) {
   if (!err) return false;
 
-  const status = getStatus(err);
+  const status = getHttpStatus(err);
   if (status !== null) return RETRYABLE_STATUS.has(status);
 
   const code = getErrorCode(err);
@@ -84,39 +69,11 @@ function isTransientError(err) {
 // own backoff. Supports both delta-seconds and `retry-after-ms` style headers.
 function retryAfterMs(err) {
   if (!err || typeof err !== 'object') return null;
-  const headers = err.headers || err.response?.headers;
-  const read = (name) => {
-    if (!headers) return undefined;
-    if (typeof headers.get === 'function') return headers.get(name);
-    return headers[name] ?? headers[name.toLowerCase()];
-  };
-
-  const ms = read('retry-after-ms');
-  if (ms !== undefined && ms !== null && String(ms).trim() !== '') {
-    const parsed = Number(ms);
-    if (Number.isFinite(parsed) && parsed >= 0) return parsed;
-  }
-
-  const after = read('retry-after');
-  if (after !== undefined && after !== null && String(after).trim() !== '') {
-    const seconds = Number(after);
-    if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1000;
-    const date = Date.parse(String(after));
-    if (Number.isFinite(date)) return Math.max(0, date - Date.now());
-  }
-
-  return null;
-}
-
-// Exponential backoff with equal-jitter: half the window is fixed, half random,
-// which spreads retries out without ever collapsing the delay to zero.
-function computeBackoffMs(attempt, baseDelayMs, maxDelayMs) {
-  const exp = Math.min(maxDelayMs, baseDelayMs * 2 ** (attempt - 1));
-  return Math.round(exp / 2 + Math.random() * (exp / 2));
+  return retryAfterMilliseconds(err.headers || err.response?.headers);
 }
 
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+function abortError(signal) {
+  return createAbortError(signal, 'Provider retry aborted.');
 }
 
 /**
@@ -137,6 +94,7 @@ async function withProviderRetry(fn, options = {}) {
 
   let attempt = 0;
   while (true) {
+    if (options.signal?.aborted) throw abortError(options.signal);
     attempt += 1;
     try {
       return await fn(attempt);
@@ -153,7 +111,7 @@ async function withProviderRetry(fn, options = {}) {
           options.onRetry({ attempt, delayMs: waitMs, error: err });
         } catch { /* a misbehaving progress callback must not abort the retry */ }
       }
-      await delay(waitMs);
+      await abortableDelay(waitMs, options.signal);
     }
   }
 }

package/server/services/ai/provider_selector.js

@@ -0,0 +1,111 @@
+'use strict';
+
+const { getAiSettings } = require('./settings');
+const { createProviderInstance, getSupportedModels } = require('./models');
+const {
+  getRawModelId,
+  normalizeModelSelections,
+  resolveModelSelection,
+} = require('./model_identity');
+
+function buildSelection(model, userId, providerConfig) {
+  return {
+    provider: createProviderInstance(model.provider, userId, providerConfig),
+    model: getRawModelId(model),
+    modelSelectionId: model.id,
+    providerName: model.provider,
+  };
+}
+
+async function getProviderForUser(
+  userId,
+  _task = '',
+  isSubagent = false,
+  modelOverride = null,
+  providerConfig = {},
+) {
+  const agentId = providerConfig.agentId || null;
+  const aiSettings = getAiSettings(userId, agentId);
+  const models = await getSupportedModels(userId, agentId, {
+    signal: providerConfig.signal,
+  });
+  const selectableModels = models.filter((model) => model.available !== false);
+
+  if (modelOverride && typeof modelOverride === 'string') {
+    const requested = resolveModelSelection(selectableModels, modelOverride);
+    if (!requested) {
+      throw new Error(`Requested model '${modelOverride.trim()}' is not available.`);
+    }
+    return buildSelection(requested, userId, providerConfig);
+  }
+
+  const configuredEnabledIds = Array.isArray(aiSettings.enabled_models)
+    ? aiSettings.enabled_models.map((id) => String(id).trim()).filter(Boolean)
+    : [];
+  const enabledIds = normalizeModelSelections(selectableModels, configuredEnabledIds);
+  const availableModels = configuredEnabledIds.length > 0
+    ? selectableModels.filter((model) => enabledIds.includes(model.id))
+    : selectableModels;
+
+  if (availableModels.length === 0) {
+    const message = configuredEnabledIds.length > 0
+      ? 'None of the enabled AI models are currently available. Check model and provider settings.'
+      : 'No AI providers are currently available. Open Settings and configure at least one provider.';
+    throw new Error(message);
+  }
+
+  const fallbackModel = availableModels[0];
+  const userSelectedDefault = isSubagent
+    ? (aiSettings.default_subagent_model || 'auto')
+    : (aiSettings.default_chat_model || 'auto');
+  const smarterSelection = aiSettings.smarter_model_selector !== false
+    && aiSettings.smarter_model_selector !== 'false';
+
+  let selectedModel = fallbackModel;
+  if (userSelectedDefault !== 'auto') {
+    selectedModel = resolveModelSelection(availableModels, userSelectedDefault) || fallbackModel;
+  } else {
+    const selectionHint = providerConfig.selectionHint && typeof providerConfig.selectionHint === 'object'
+      ? providerConfig.selectionHint
+      : {};
+    const preferredPurpose = String(selectionHint.purpose || '').trim().toLowerCase();
+    const highAutonomy = selectionHint.autonomyLevel === 'high'
+      || selectionHint.complexity === 'complex';
+    const requiredConfidence = String(selectionHint.requiredConfidence || '').trim().toLowerCase();
+    const costMode = String(selectionHint.costMode || aiSettings.cost_mode || 'balanced_auto')
+      .trim()
+      .toLowerCase();
+    const requestedPurpose = ['planning', 'coding', 'general', 'fast'].includes(preferredPurpose)
+      ? preferredPurpose
+      : '';
+    const priceRank = { free: 0, cheap: 1, medium: 2, expensive: 3 };
+    const chooseForPurpose = (purpose) => {
+      const candidates = availableModels.filter((model) => model.purpose === purpose);
+      if (candidates.length === 0) return null;
+      if (['economy', 'cost_saver', 'lowest_cost'].includes(costMode)) {
+        return [...candidates].sort((left, right) => (
+          (priceRank[left.priceTier] ?? 99) - (priceRank[right.priceTier] ?? 99)
+        ))[0];
+      }
+      if (['quality', 'highest_quality'].includes(costMode) || requiredConfidence === 'high') {
+        return candidates.find((model) => model.priceTier !== 'free' && model.priceTier !== 'cheap')
+          || candidates[0];
+      }
+      return candidates[0];
+    };
+
+    if (smarterSelection && requestedPurpose) {
+      selectedModel = chooseForPurpose(requestedPurpose) || fallbackModel;
+    } else if (smarterSelection && highAutonomy) {
+      selectedModel = chooseForPurpose('planning') || chooseForPurpose('general') || fallbackModel;
+    } else if (isSubagent) {
+      selectedModel = chooseForPurpose('fast') || fallbackModel;
+    } else {
+      selectedModel = chooseForPurpose('general') || fallbackModel;
+    }
+  }
+
+  return buildSelection(selectedModel, userId, providerConfig);
+}
+
+module.exports = { getProviderForUser };

package/server/services/ai/providers/anthropic.js

@@ -31,8 +31,8 @@ class AnthropicProvider extends BaseProvider {
     });
   }
 
-  async listModels() {
-    const res = await this.client.models.list({ limit: 100 });
+  async listModels(signal = null) {
+    const res = await this.client.models.list({ limit: 100 }, { signal });
     return (res.data || []).map((m) => ({ id: m.id, name: m.display_name || m.id }));
   }
 

package/server/services/ai/providers/claudeCode.js

@@ -2,6 +2,8 @@ const os = require('os');
 const fs = require('fs');
 const path = require('path');
 const Anthropic = require('@anthropic-ai/sdk');
+const { ENV_FILE, upsertEnvValue } = require('../../../../runtime/paths');
+const { fetchResponseText } = require('../../network/http');
 const { AnthropicProvider } = require('./anthropic');
 
 const CLAUDE_CLI_CREDS_PATH = path.join(os.homedir(), '.claude', '.credentials.json');
@@ -12,6 +14,8 @@ const CLAUDE_CODE_SYSTEM_PROMPT = "You are Claude Code, Anthropic's official CLI
 const CLAUDE_CODE_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
 const CLAUDE_CODE_TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
 const CLAUDE_CODE_SCOPES = 'user:inference user:profile org:create_api_key user:sessions:claude_code user:mcp_servers';
+const OAUTH_REFRESH_TIMEOUT_MS = 30000;
+const OAUTH_MAX_RESPONSE_BYTES = 256 * 1024;
 
 function readTokenRecord(data) {
   const tokens = data?.claudeAiOauthTokens || data?.claudeAiOauth || {};
@@ -71,40 +75,17 @@ function normalizeExpiresAt(data) {
   return null;
 }
 
-function sanitizeEnvKey(key) {
-  return String(key).replace(/[\r\n]/g, '');
-}
-
-function sanitizeEnvValue(value) {
-  return String(value).replace(/[\r\n]/g, '');
-}
-
 function persistEnvValue(key, value) {
   if (!value) return;
   try {
-    const { ENV_FILE } = require('../../../../runtime/paths');
-    const safeKey = sanitizeEnvKey(key);
-    const safeValue = sanitizeEnvValue(value);
-    const raw = fs.existsSync(ENV_FILE) ? fs.readFileSync(ENV_FILE, 'utf8') : '';
-    const lines = raw ? raw.split('\n') : [];
-    let replaced = false;
-    for (let i = 0; i < lines.length; i++) {
-      if (lines[i].startsWith(`${safeKey}=`)) {
-        lines[i] = `${safeKey}=${safeValue}`;
-        replaced = true;
-        break;
-      }
-    }
-    if (!replaced) lines.push(`${safeKey}=${safeValue}`);
-    const output = lines.filter((_, idx, arr) => idx !== arr.length - 1 || arr[idx] !== '').join('\n') + '\n';
-    fs.mkdirSync(path.dirname(ENV_FILE), { recursive: true });
-    fs.writeFileSync(ENV_FILE, output, { mode: 0o600 });
+    upsertEnvValue(ENV_FILE, key, value);
   } catch { }
 }
 
-async function refreshClaudeCodeAccessToken(refreshToken, fetchImpl = fetch) {
+async function refreshClaudeCodeAccessToken(refreshToken, fetchImpl = fetch, signal = null) {
   if (!refreshToken) return null;
-  const response = await fetchImpl(CLAUDE_CODE_TOKEN_URL, {
+  const { response, text } = await fetchResponseText(CLAUDE_CODE_TOKEN_URL, {
+    fetchImpl,
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
@@ -116,9 +97,14 @@ async function refreshClaudeCodeAccessToken(refreshToken, fetchImpl = fetch) {
       refresh_token: refreshToken,
       client_id: CLAUDE_CODE_CLIENT_ID,
     }),
+    signal,
+    timeoutMs: OAUTH_REFRESH_TIMEOUT_MS,
+    maxResponseBytes: OAUTH_MAX_RESPONSE_BYTES,
+    serviceName: 'Claude Code OAuth refresh',
+    timeoutCode: 'PROVIDER_OAUTH_TIMEOUT',
+    tooLargeCode: 'PROVIDER_OAUTH_RESPONSE_TOO_LARGE',
   });
 
-  const text = await response.text();
   let data = {};
   try {
     data = text ? JSON.parse(text) : {};
@@ -127,7 +113,9 @@ async function refreshClaudeCodeAccessToken(refreshToken, fetchImpl = fetch) {
   }
 
   if (!response.ok) {
-    const detail = data?.error?.message || data?.error_description || data?.error || text || 'Unknown error';
+    const detail = String(
+      data?.error?.message || data?.error_description || data?.error || text || 'Unknown error',
+    ).slice(0, 2000);
     throw new Error(`Claude Code OAuth refresh failed: HTTP ${response.status} ${detail}`);
   }
   if (!data.access_token) {
@@ -209,8 +197,8 @@ class ClaudeCodeProvider extends AnthropicProvider {
     });
   }
 
-  async refreshClient() {
-    const refreshed = await refreshClaudeCodeAccessToken(this.refreshToken, this.fetchImpl);
+  async refreshClient(signal = null) {
+    const refreshed = await refreshClaudeCodeAccessToken(this.refreshToken, this.fetchImpl, signal);
     if (!refreshed?.access) return false;
     this.authToken = refreshed.access;
     this.refreshToken = refreshed.refresh || this.refreshToken;
@@ -244,7 +232,7 @@ class ClaudeCodeProvider extends AnthropicProvider {
       if ((!isAuthenticationError(err) && !isInferenceScopeError(err)) || !this.refreshToken) {
         throw formatClaudeCodeCredentialError(err);
       }
-      await this.refreshClient();
+      await this.refreshClient(options.signal);
       try {
         return await super.chat(messages, tools, options);
       } catch (retryErr) {
@@ -260,7 +248,7 @@ class ClaudeCodeProvider extends AnthropicProvider {
       if ((!isAuthenticationError(err) && !isInferenceScopeError(err)) || !this.refreshToken) {
         throw formatClaudeCodeCredentialError(err);
       }
-      await this.refreshClient();
+      await this.refreshClient(options.signal);
       try {
         yield* super.stream(messages, tools, options);
       } catch (retryErr) {

package/server/services/ai/providers/githubCopilot.js

@@ -1,4 +1,9 @@
 const { OpenAIProvider } = require('./openai');
+const {
+  fetchResponseText,
+  waitForAbortableResult,
+} = require('../../network/http');
+const { sanitizeProviderErrorDetail } = require('./provider_error');
 
 class GithubCopilotProvider extends OpenAIProvider {
   constructor(config = {}) {
@@ -26,35 +31,47 @@ class GithubCopilotProvider extends OpenAIProvider {
     this._refreshPromise = null;
   }
 
-  async _refreshCopilotToken() {
-    if (this._refreshPromise) return this._refreshPromise;
-
+  async _refreshCopilotToken(signal = null) {
     const now = Math.floor(Date.now() / 1000);
     // Refresh token if missing or expiring in less than 5 minutes
     if (this.copilotToken && this.tokenExpiresAt >= now + 300) {
       return;
     }
 
-    this._refreshPromise = (async () => {
-      try {
+    if (!this._refreshPromise) {
+      this._refreshPromise = (async () => {
         if (!this.githubToken) {
           throw new Error('GitHub Copilot access token is missing. Please run `neoagent login github-copilot`.');
         }
 
-        const res = await fetch('https://api.github.com/copilot_internal/v2/token', {
+        const { response, text } = await fetchResponseText(
+          'https://api.github.com/copilot_internal/v2/token',
+          {
           headers: {
             'Authorization': `token ${this.githubToken}`,
             'Accept': 'application/json',
             'User-Agent': 'NeoAgent/1.0.0'
-          }
-        });
-
-        if (!res.ok) {
-          const errorText = await res.text().catch(() => 'Unknown error');
-          throw new Error(`Failed to refresh GitHub Copilot token: HTTP ${res.status} - ${errorText}`);
+          },
+            maxResponseBytes: 1024 * 1024,
+            serviceName: 'GitHub Copilot token refresh',
+          },
+        );
+
+        if (!response.ok) {
+          const error = new Error(
+            `Failed to refresh GitHub Copilot token: HTTP ${response.status} - ${sanitizeProviderErrorDetail(text.slice(0, 500))}`,
+          );
+          error.status = response.status;
+          error.headers = response.headers;
+          throw error;
         }
 
-        const data = await res.json();
+        let data;
+        try {
+          data = JSON.parse(text || '{}');
+        } catch {
+          throw new Error('Invalid token response from GitHub Copilot.');
+        }
         if (!data || typeof data.token !== 'string' || !data.token) {
           throw new Error('Invalid token response from GitHub Copilot.');
         }
@@ -70,26 +87,30 @@ class GithubCopilotProvider extends OpenAIProvider {
 
         // Update the client's API key
         this.client.apiKey = this.copilotToken;
-      } finally {
+      })().finally(() => {
         this._refreshPromise = null;
-      }
-    })();
+      });
+    }
 
-    return this._refreshPromise;
+    return waitForAbortableResult(
+      this._refreshPromise,
+      signal,
+      'GitHub Copilot token refresh aborted.',
+    );
   }
 
   async chat(messages, tools = [], options = {}) {
-    await this._refreshCopilotToken();
+    await this._refreshCopilotToken(options.signal);
     return super.chat(messages, tools, options);
   }
 
   async *stream(messages, tools = [], options = {}) {
-    await this._refreshCopilotToken();
+    await this._refreshCopilotToken(options.signal);
     yield* super.stream(messages, tools, options);
   }
 
   async analyzeImage(options = {}) {
-    await this._refreshCopilotToken();
+    await this._refreshCopilotToken(options.signal);
     return super.analyzeImage(options);
   }
 }

package/server/services/ai/providers/google.js

@@ -1,5 +1,6 @@
 const { GoogleGenerativeAI } = require('@google/generative-ai');
 const { BaseProvider } = require('./base');
+const { fetchResponseText } = require('../../network/http');
 
 class GoogleProvider extends BaseProvider {
   constructor(config = {}) {
@@ -31,13 +32,30 @@ class GoogleProvider extends BaseProvider {
     this.genAI = new GoogleGenerativeAI(this.apiKey);
   }
 
-  async listModels() {
+  async listModels(signal = null) {
     const DROP = /tts|lyria|robotics|deep-research|antigravity|computer-use|-image(?!.*it)/i;
-    const res = await fetch(
-      `https://generativelanguage.googleapis.com/v1beta/models?key=${this.apiKey}&pageSize=200`
+    const { response, text } = await fetchResponseText(
+      'https://generativelanguage.googleapis.com/v1beta/models?pageSize=200',
+      {
+        headers: { 'x-goog-api-key': this.apiKey },
+        maxResponseBytes: 5 * 1024 * 1024,
+        serviceName: 'Google model catalog',
+        signal,
+      },
     );
-    if (!res.ok) throw new Error(`Google models API returned ${res.status}`);
-    const { models = [] } = await res.json();
+    if (!response.ok) {
+      const error = new Error(`Google models API returned ${response.status}`);
+      error.status = response.status;
+      error.headers = response.headers;
+      throw error;
+    }
+    let payload;
+    try {
+      payload = JSON.parse(text || '{}');
+    } catch {
+      throw new Error('Google models API returned invalid JSON.');
+    }
+    const { models = [] } = payload;
     return models
       .filter((m) => {
         const id = m.name.replace('models/', '');

package/server/services/ai/providers/grok.js

@@ -1,5 +1,6 @@
 const OpenAI = require('openai');
 const { OpenAICompatibleProvider } = require('./openaiCompatible');
+const { wrapProviderError } = require('./provider_error');
 
 class GrokProvider extends OpenAICompatibleProvider {
   constructor(config = {}) {
@@ -11,15 +12,15 @@ class GrokProvider extends OpenAICompatibleProvider {
     });
   }
 
-  async listModels() {
+  async listModels(signal = null) {
     try {
-      const res = await this.client.models.list();
+      const res = await this.client.models.list({ signal });
       const DROP = /imagine|diffus|embed|-tts/i;
       return res.data
         .filter((m) => !DROP.test(m.id))
         .map((m) => ({ id: m.id, name: m.id }));
     } catch (err) {
-      throw new Error(`Failed to list Grok models: ${err.message || String(err)}`);
+      throw wrapProviderError(err, 'Failed to list Grok models', { signal });
     }
   }
 

package/server/services/ai/providers/grokOauth.js

@@ -1,12 +1,14 @@
-const fs = require('fs');
-const path = require('path');
 const OpenAI = require('openai');
+const { ENV_FILE, upsertEnvValue } = require('../../../../runtime/paths');
+const { fetchResponseText } = require('../../network/http');
 const { GrokProvider } = require('./grok');
 
 const GROK_OAUTH_BASE_URL = 'https://api.x.ai/v1';
 const GROK_OAUTH_CLIENT_ID = 'b1a00492-073a-47ea-816f-4c329264a828';
 const GROK_OAUTH_TOKEN_URL = 'https://auth.x.ai/oauth2/token';
 const GROK_OAUTH_SCOPES = 'openid profile email offline_access grok-cli:access api:access';
+const OAUTH_REFRESH_TIMEOUT_MS = 30000;
+const OAUTH_MAX_RESPONSE_BYTES = 256 * 1024;
 
 function normalizeExpiresAt(data) {
   if (typeof data.expires_at === 'number' && Number.isFinite(data.expires_at)) {
@@ -21,29 +23,14 @@ function normalizeExpiresAt(data) {
 function persistEnvValue(key, value) {
   if (!value) return;
   try {
-    const { ENV_FILE } = require('../../../../runtime/paths');
-    const safeKey = String(key).replace(/[\r\n]/g, '');
-    const safeValue = String(value).replace(/[\r\n]/g, '');
-    const raw = fs.existsSync(ENV_FILE) ? fs.readFileSync(ENV_FILE, 'utf8') : '';
-    const lines = raw ? raw.split('\n') : [];
-    let replaced = false;
-    for (let i = 0; i < lines.length; i++) {
-      if (lines[i].startsWith(`${safeKey}=`)) {
-        lines[i] = `${safeKey}=${safeValue}`;
-        replaced = true;
-        break;
-      }
-    }
-    if (!replaced) lines.push(`${safeKey}=${safeValue}`);
-    const output = lines.filter((_, idx, arr) => idx !== arr.length - 1 || arr[idx] !== '').join('\n') + '\n';
-    fs.mkdirSync(path.dirname(ENV_FILE), { recursive: true });
-    fs.writeFileSync(ENV_FILE, output, { mode: 0o600 });
+    upsertEnvValue(ENV_FILE, key, value);
   } catch { }
 }
 
-async function refreshGrokOAuthAccessToken(refreshToken, fetchImpl = fetch) {
+async function refreshGrokOAuthAccessToken(refreshToken, fetchImpl = fetch, signal = null) {
   if (!refreshToken) return null;
-  const response = await fetchImpl(GROK_OAUTH_TOKEN_URL, {
+  const { response, text } = await fetchResponseText(GROK_OAUTH_TOKEN_URL, {
+    fetchImpl,
     method: 'POST',
     headers: {
       'Content-Type': 'application/x-www-form-urlencoded',
@@ -54,9 +41,14 @@ async function refreshGrokOAuthAccessToken(refreshToken, fetchImpl = fetch) {
       refresh_token: refreshToken,
       client_id: GROK_OAUTH_CLIENT_ID,
     }),
+    signal,
+    timeoutMs: OAUTH_REFRESH_TIMEOUT_MS,
+    maxResponseBytes: OAUTH_MAX_RESPONSE_BYTES,
+    serviceName: 'Grok OAuth refresh',
+    timeoutCode: 'PROVIDER_OAUTH_TIMEOUT',
+    tooLargeCode: 'PROVIDER_OAUTH_RESPONSE_TOO_LARGE',
   });
 
-  const text = await response.text();
   let data = {};
   try {
     data = text ? JSON.parse(text) : {};
@@ -68,7 +60,7 @@ async function refreshGrokOAuthAccessToken(refreshToken, fetchImpl = fetch) {
     if (data?.error === 'invalid_grant') {
       throw new Error('Grok OAuth refresh token is invalid or expired. Re-run `neoagent login grok-oauth` to re-authenticate.');
     }
-    const detail = data?.error_description || data?.error || text || 'Unknown error';
+    const detail = String(data?.error_description || data?.error || text || 'Unknown error').slice(0, 2000);
     throw new Error(`Grok OAuth refresh failed: HTTP ${response.status} ${detail}`);
   }
   if (!data.access_token) {
@@ -102,8 +94,8 @@ class GrokOAuthProvider extends GrokProvider {
     this.fetchImpl = config.fetch || fetch;
   }
 
-  async refreshClient() {
-    const refreshed = await refreshGrokOAuthAccessToken(this.refreshToken, this.fetchImpl);
+  async refreshClient(signal = null) {
+    const refreshed = await refreshGrokOAuthAccessToken(this.refreshToken, this.fetchImpl, signal);
     if (!refreshed?.access) return false;
     this.authToken = refreshed.access;
     this.refreshToken = refreshed.refresh || this.refreshToken;
@@ -122,7 +114,7 @@ class GrokOAuthProvider extends GrokProvider {
       return await super.chat(messages, tools, options);
     } catch (err) {
       if (err?.status !== 401 || !this.refreshToken) throw err;
-      await this.refreshClient();
+      await this.refreshClient(options.signal);
       return await super.chat(messages, tools, options);
     }
   }
@@ -132,7 +124,7 @@ class GrokOAuthProvider extends GrokProvider {
       yield* super.stream(messages, tools, options);
     } catch (err) {
       if (err?.status !== 401 || !this.refreshToken) throw err;
-      await this.refreshClient();
+      await this.refreshClient(options.signal);
       yield* super.stream(messages, tools, options);
     }
   }