@animalabs/membrane 0.5.67 → 0.5.69

package/src/formatters/native.ts

@@ -29,6 +29,19 @@ import type {
   StreamEmission,
 } from './types.js';
 import { normalizeToolPairs, mergeConsecutiveRoles } from './normalize-tool-pairs.js';
+import { isAcceptedImageMediaType, strippedImagePlaceholder } from '../utils/image-media.js';
+
+/** Index of the last content block that can carry cache_control. Anthropic
+ *  rejects cache_control on thinking / redacted_thinking blocks, so a cache
+ *  breakpoint must attach to the last NON-thinking block. Returns -1 when the
+ *  message has only thinking blocks (the breakpoint is then skipped). */
+function lastCacheableBlockIndex(blocks: Array<Record<string, unknown>>): number {
+  for (let k = blocks.length - 1; k >= 0; k--) {
+    const t = blocks[k]?.type as string | undefined;
+    if (t !== 'thinking' && t !== 'redacted_thinking') return k;
+  }
+  return -1;
+}
 
 // ============================================================================
 // Configuration
@@ -243,8 +256,9 @@ export class NativeFormatter implements PrefillFormatter {
       if (hasCacheMarker && hasCacheMarker(message, i) && cacheControl && providerMessages.length > 0) {
         const prevMsg = providerMessages[providerMessages.length - 1]!;
         const prevContent = Array.isArray(prevMsg.content) ? prevMsg.content as Record<string, unknown>[] : [];
-        if (prevContent.length > 0) {
-          prevContent[prevContent.length - 1]!.cache_control = cacheControl;
+        const prevIdx = lastCacheableBlockIndex(prevContent);
+        if (prevIdx >= 0) {
+          prevContent[prevIdx]!.cache_control = cacheControl;
           markedBreakpoints++;
         }
       }
@@ -253,8 +267,11 @@ export class NativeFormatter implements PrefillFormatter {
 
       // cacheBreakpoint: cache up to and INCLUDING this message — tag last block
       if (message.cacheBreakpoint && cacheControl && content.length > 0) {
-        (content[content.length - 1] as Record<string, unknown>).cache_control = cacheControl;
-        markedBreakpoints++;
+        const bpIdx = lastCacheableBlockIndex(content as Record<string, unknown>[]);
+        if (bpIdx >= 0) {
+          (content[bpIdx] as Record<string, unknown>).cache_control = cacheControl;
+          markedBreakpoints++;
+        }
       }
     }
 
@@ -349,6 +366,25 @@ export class NativeFormatter implements PrefillFormatter {
   // PRIVATE HELPERS
   // ==========================================================================
 
+  /** Replace API-unacceptable image blocks nested in tool_result content with
+   *  text placeholders. Non-array content passes through untouched. */
+  private static sanitizeToolResultContent(content: unknown): unknown {
+    if (!Array.isArray(content)) return content;
+    return content.map((item) => {
+      if (
+        item &&
+        typeof item === 'object' &&
+        (item as { type?: string }).type === 'image'
+      ) {
+        const src = (item as { source?: { media_type?: string } }).source;
+        if (!isAcceptedImageMediaType(src?.media_type)) {
+          return strippedImagePlaceholder(src?.media_type);
+        }
+      }
+      return item;
+    });
+  }
+
   private convertContent(
     content: ContentBlock[],
     participant: string,
@@ -371,19 +407,39 @@ export class NativeFormatter implements PrefillFormatter {
         result.push(textBlock);
       } else if (block.type === 'image') {
         if (block.source.type === 'base64') {
-          const imageBlock: Record<string, unknown> = {
-            type: 'image',
+          if (!isAcceptedImageMediaType(block.source.mediaType)) {
+            // Unacceptable media type (e.g. image/svg): degrade to a text
+            // placeholder instead of poisoning the whole request.
+            result.push(strippedImagePlaceholder(block.source.mediaType));
+          } else {
+            const imageBlock: Record<string, unknown> = {
+              type: 'image',
+              source: {
+                type: 'base64',
+                media_type: block.source.mediaType,
+                data: block.source.data,
+              },
+            };
+            // Preserve sourceUrl for providers that use URL-as-text (Gemini 3.x)
+            if (block.sourceUrl) {
+              imageBlock.sourceUrl = block.sourceUrl;
+            }
+            result.push(imageBlock);
+          }
+        }
+      } else if (block.type === 'audio') {
+        // Pass audio through in the same shape as images — the provider
+        // adapters convert it (Gemini → inlineData, OpenRouter → input_audio).
+        // Whether a given model accepts audio is the provider/model's concern.
+        if (block.source.type === 'base64') {
+          result.push({
+            type: 'audio',
             source: {
               type: 'base64',
               media_type: block.source.mediaType,
               data: block.source.data,
             },
-          };
-          // Preserve sourceUrl for providers that use URL-as-text (Gemini 3.x)
-          if (block.sourceUrl) {
-            imageBlock.sourceUrl = block.sourceUrl;
-          }
-          result.push(imageBlock);
+          });
         }
       } else if (block.type === 'tool_use') {
         result.push({
@@ -396,7 +452,7 @@ export class NativeFormatter implements PrefillFormatter {
         result.push({
           type: 'tool_result',
           tool_use_id: block.toolUseId,
-          content: block.content,
+          content: NativeFormatter.sanitizeToolResultContent(block.content),
           is_error: block.isError,
         });
       } else if (block.type === 'thinking') {
@@ -414,7 +470,7 @@ export class NativeFormatter implements PrefillFormatter {
       } else if (block.type === 'redacted_thinking') {
         // Pass through verbatim (carries encrypted data field)
         result.push({ ...(block as unknown as Record<string, unknown>) });
-      } else if (block.type === 'document' || block.type === 'audio') {
+      } else if (block.type === 'document') {
         hasUnsupportedMedia = true;
       }
     }

package/src/membrane.ts

@@ -55,6 +55,11 @@ import { AnthropicXmlFormatter } from './formatters/anthropic-xml.js';
 import { normalizeToolPairs, mergeConsecutiveRoles } from './formatters/normalize-tool-pairs.js';
 import { YieldingStreamImpl } from './yielding-stream.js';
 import { calculateCost } from './utils/cost.js';
+import {
+  isAcceptedImageMediaType,
+  strippedImagePlaceholder,
+  shedImagesToFitByteBudget, assertWithinByteBudget,
+} from './utils/image-media.js';
 import { getDefaultPricing } from './registry/default-pricing.js';
 
 // ============================================================================
@@ -990,6 +995,14 @@ export class Membrane {
     const promptCaching = request.promptCaching ?? true;
     const cacheControl = promptCaching ? { type: 'ephemeral' as const, ...(request.cacheTtl ? { ttl: request.cacheTtl } : {}) } : undefined;
 
+    // Anthropic allows at most 4 cache_control breakpoints per request. The
+    // message breakpoints are the valuable ones (they cache the longest prefixes,
+    // and every one already includes tools+system at the front of the request).
+    // So tools/system get a breakpoint only as a FALLBACK — when no message
+    // breakpoint was marked — otherwise they're redundant and would push the
+    // total past 4, which the API hard-rejects (the agent goes unresponsive).
+    let messageBreakpoints = 0;
+
     for (const msg of messages) {
       const isAssistant = msg.participant === assistantName;
       const role = isAssistant ? 'assistant' : 'user';
@@ -1037,19 +1050,26 @@ export class Membrane {
           content.push({ ...(block as unknown as Record<string, unknown>) });
         } else if (block.type === 'image') {
           if (block.source.type === 'base64') {
-            const imageBlock: Record<string, unknown> = {
-              type: 'image',
-              source: {
-                type: 'base64',
-                media_type: block.source.mediaType,
-                data: block.source.data,
-              },
-            };
-            // Preserve sourceUrl for providers that use URL-as-text (Gemini 3.x)
-            if (block.sourceUrl) {
-              imageBlock.sourceUrl = block.sourceUrl;
+            if (!isAcceptedImageMediaType(block.source.mediaType)) {
+              // API-unacceptable media type (e.g. image/svg): degrade to a
+              // loud text placeholder instead of poisoning the whole request
+              // (one bad stored block otherwise 400s every compile forever).
+              content.push(strippedImagePlaceholder(block.source.mediaType));
+            } else {
+              const imageBlock: Record<string, unknown> = {
+                type: 'image',
+                source: {
+                  type: 'base64',
+                  media_type: block.source.mediaType,
+                  data: block.source.data,
+                },
+              };
+              // Preserve sourceUrl for providers that use URL-as-text (Gemini 3.x)
+              if (block.sourceUrl) {
+                imageBlock.sourceUrl = block.sourceUrl;
+              }
+              content.push(imageBlock);
             }
-            content.push(imageBlock);
           }
         }
       }
@@ -1057,6 +1077,7 @@ export class Membrane {
       // Apply cache_control to last block of messages with cacheBreakpoint
       if (msg.cacheBreakpoint && cacheControl && content.length > 0) {
         content[content.length - 1].cache_control = cacheControl;
+        messageBreakpoints++;
       }
 
       providerMessages.push({ role, content });
@@ -1093,18 +1114,21 @@ export class Membrane {
         description: tool.description,
         input_schema: tool.inputSchema,
       };
-      // Cache the tool list — mark the last tool with cache_control
-      if (cacheControl && request.tools && idx === request.tools.length - 1) {
+      // Cache the tool list (last tool) only as a fallback — a marked message
+      // breakpoint already caches the tools as part of its prefix.
+      if (cacheControl && messageBreakpoints === 0 && request.tools && idx === request.tools.length - 1) {
         t.cache_control = cacheControl;
       }
       return t;
     });
 
-    // Wrap system prompt with cache_control if prompt caching is enabled
+    // Wrap system prompt with cache_control only as a fallback (no message
+    // breakpoint marked); otherwise a message breakpoint already caches
+    // tools+system as part of its prefix.
     let system: unknown = request.system;
-    if (cacheControl && typeof system === 'string' && system.length > 0) {
+    if (cacheControl && messageBreakpoints === 0 && typeof system === 'string' && system.length > 0) {
       system = [{ type: 'text', text: system, cache_control: cacheControl }];
-    } else if (cacheControl && Array.isArray(system) && system.length > 0) {
+    } else if (cacheControl && messageBreakpoints === 0 && Array.isArray(system) && system.length > 0) {
       const blocks = system as Record<string, unknown>[];
       system = blocks.map((block, idx) =>
         idx === blocks.length - 1 ? { ...block, cache_control: cacheControl } : block
@@ -1120,6 +1144,14 @@ export class Membrane {
     // Anthropic requires temperature=1 when extended thinking is enabled
     const temperature = alwaysOnThinking ? undefined : (thinking ? 1 : request.config.temperature);
 
+    // Byte-wall policy point (see transformRequest): loud failure unless the
+    // caller explicitly owns image loss.
+    if (request.shedOversizeImages) {
+      shedImagesToFitByteBudget(mergedMessages, undefined, 'buildNativeToolRequest');
+    } else {
+      assertWithinByteBudget(mergedMessages, undefined, 'buildNativeToolRequest');
+    }
+
     return {
       model: request.config.model,
       maxTokens: request.config.maxTokens,
@@ -1357,6 +1389,17 @@ export class Membrane {
       prefillUserMessage: request.prefillUserMessage,
     });
 
+    // Byte-wall policy point (2026-07-12): transformRequest serves BOTH
+    // complete() and the streaming path through EVERY adapter. Oversize
+    // requests FAIL LOUDLY here, before the API round-trip, unless the
+    // caller explicitly owns image loss via `shedOversizeImages` (and the
+    // shed itself reports at error grade). No silent transport mutation.
+    if (request.shedOversizeImages) {
+      shedImagesToFitByteBudget(buildResult.messages, undefined, 'transformRequest');
+    } else {
+      assertWithinByteBudget(buildResult.messages, undefined, 'transformRequest');
+    }
+
     const providerRequest = {
       ...this.getBaseProviderParams(request.config),
       messages: buildResult.messages,

package/src/providers/anthropic-tool-schema.ts

@@ -0,0 +1,194 @@
+/**
+ * Anthropic tool-schema normalization
+ *
+ * MCP permits a tool's input JSON Schema to have a root-level `oneOf` /
+ * `anyOf` / `allOf` (a union of alternative argument shapes). The Anthropic
+ * API does not: `input_schema` must be a single object-type schema, and a
+ * root-level combinator is rejected with 400
+ * ("input_schema does not support oneOf, allOf, or anyOf at the top level").
+ * One such tool 400s the entire inference — same philosophy as
+ * `normalize-tool-pairs`: repair at the wire boundary instead of letting a
+ * producer-side quirk kill the turn.
+ *
+ * `flattenRootSchemaUnion` rewrites the common case — every union variant is
+ * itself an object schema — into a single object schema:
+ *
+ *   - `properties` is the merge of all variants' properties (first wins on
+ *     key collision).
+ *   - `required`: for `allOf` (intersective — every variant applies) the
+ *     union of the variants' required lists; for `oneOf`/`anyOf`
+ *     (alternatives) only keys required by *every* variant stay required.
+ *   - A short note enumerating the alternative argument groups is appended
+ *     to the description so the model still sees the union intent.
+ *   - Variant-level `additionalProperties: false` is dropped: the merged
+ *     object is a permissive superset of the alternatives, and `false`
+ *     could reject payloads valid under one of the original variants.
+ *
+ * If any variant is not object-shaped (e.g. a root `oneOf` of a string and
+ * an object), the union cannot be merged into properties; we fall back to a
+ * permissive object schema carrying the serialized union in the description.
+ * Degenerate, but it does not 400 — the tool stays callable and the model
+ * sees the accepted shapes.
+ *
+ * Nested combinators (inside `properties`, array `items`, etc.) are legal
+ * for Anthropic and are left untouched; only the root is rewritten.
+ */
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function isMergeableObjectVariant(variant: Record<string, unknown>): boolean {
+  return (
+    variant.type === 'object' ||
+    (variant.type === undefined && isPlainObject(variant.properties))
+  );
+}
+
+function stringRequired(value: unknown): string[] {
+  return Array.isArray(value)
+    ? value.filter((entry): entry is string => typeof entry === 'string')
+    : [];
+}
+
+const ROOT_UNION_KEYS = ['oneOf', 'anyOf', 'allOf'] as const;
+
+/** Max length of the description we synthesize on the fallback path. */
+const MAX_FALLBACK_DESCRIPTION = 4000;
+
+/**
+ * Rewrite a root-level `oneOf`/`anyOf`/`allOf` in a tool input schema into a
+ * single Anthropic-acceptable object schema. Returns the input unchanged
+ * (same reference) when there is nothing to repair, so callers can cheaply
+ * detect whether a rewrite happened.
+ */
+export function flattenRootSchemaUnion(schema: unknown): unknown {
+  if (!isPlainObject(schema)) return schema;
+
+  // A root may carry more than one combinator at once (e.g. `{ oneOf, anyOf }`).
+  // These are sibling keywords: a valid instance must satisfy every one of
+  // them (an implicit `allOf` across the combinators). Process *all* present
+  // keys — handling only the first would strip the others' variants (the
+  // destructuring below removes all three keys), silently losing their
+  // properties and required lists.
+  const presentKeys = ROOT_UNION_KEYS.filter(
+    (key) => Array.isArray(schema[key]) && (schema[key] as unknown[]).length > 0,
+  );
+  if (presentKeys.length === 0) return schema;
+
+  const combinators = presentKeys.map((key) => {
+    const raw = schema[key] as unknown[];
+    return { key, raw, variants: raw.filter(isPlainObject) };
+  });
+  const rawVariantsAll: unknown[] = combinators.flatMap(({ raw }) => raw);
+
+  // Keep every root key except the combinators themselves.
+  const { oneOf: _oneOf, anyOf: _anyOf, allOf: _allOf, ...rest } = schema;
+
+  const allMergeable = combinators.every(
+    ({ raw, variants }) =>
+      variants.length === raw.length && variants.every(isMergeableObjectVariant),
+  );
+
+  if (allMergeable) {
+    // Common case: every variant of every present combinator is an object
+    // schema — merge them all.
+    const properties: Record<string, unknown> = isPlainObject(rest.properties)
+      ? { ...rest.properties }
+      : {};
+    for (const { variants } of combinators) {
+      for (const variant of variants) {
+        if (isPlainObject(variant.properties)) {
+          for (const [key, propSchema] of Object.entries(variant.properties)) {
+            if (!(key in properties)) properties[key] = propSchema;
+          }
+        }
+      }
+    }
+
+    // Per-combinator required semantics: `allOf` unions its variants' required
+    // lists (every variant applies); `oneOf`/`anyOf` keep only keys required by
+    // every variant (alternatives). Across combinators they all apply at once,
+    // so the effective required set is the union of the per-combinator results.
+    const mergedRequired = combinators.flatMap(({ key, variants }) => {
+      const variantRequired = variants.map((variant) => stringRequired(variant.required));
+      return key === 'allOf'
+        ? [...new Set(variantRequired.flat())]
+        : variantRequired.reduce(
+            (acc, req) => acc.filter((k) => req.includes(k)),
+            variantRequired[0] ?? [],
+          );
+    });
+    const required = [
+      ...new Set([...stringRequired(rest.required), ...mergedRequired]),
+    ].filter((key) => key in properties);
+
+    const {
+      properties: _properties,
+      required: _required,
+      additionalProperties: _additionalProperties,
+      ...restSansObjectKeys
+    } = rest;
+
+    const result: Record<string, unknown> = {
+      ...restSansObjectKeys,
+      type: 'object',
+      properties,
+    };
+    if (required.length > 0) result.required = required;
+
+    // For alternatives, preserve the union intent in prose so the model
+    // still knows the arguments come in groups (one line per combinator).
+    const noteParts = combinators
+      .filter(({ key, variants }) => key !== 'allOf' && variants.length > 1)
+      .map(({ variants }) => {
+        const groups = variants
+          .map((variant) => {
+            const req = stringRequired(variant.required);
+            return req.length > 0 ? `(${req.join(', ')})` : '(no required fields)';
+          })
+          .join(' | ');
+        return `Provide one of the following argument groups: ${groups}.`;
+      });
+    if (noteParts.length > 0) {
+      const note = noteParts.join('\n');
+      result.description =
+        typeof result.description === 'string' && result.description.length > 0
+          ? `${result.description}\n${note}`
+          : note;
+    }
+
+    return result;
+  }
+
+  // Fallback: at least one variant (across the present combinators) is not an
+  // object schema (or not a schema at all). Emit a permissive object schema and
+  // carry the union(s) into the description so the intent survives.
+  const label = presentKeys.join('/');
+  let note: string;
+  try {
+    note = `Accepts one of the following input shapes (flattened from a root-level ${label}): ${JSON.stringify(rawVariantsAll)}`;
+  } catch {
+    note = `Accepts one of ${rawVariantsAll.length} alternative input shapes (root-level ${label} flattened).`;
+  }
+  const baseDescription =
+    typeof rest.description === 'string' && rest.description.length > 0
+      ? `${rest.description}\n${note}`
+      : note;
+
+  // Spread `rest` (already sans the combinator keys) so sibling definitions —
+  // `$defs`/`definitions` — survive. Without this, a variant serialized into
+  // the description as `{"$ref":"#/definitions/A"}` would point at a definition
+  // that no longer exists anywhere in the tool. The mergeable path preserves
+  // `restSansObjectKeys` for the same reason; the fallback extends the courtesy.
+  return {
+    ...rest,
+    type: 'object',
+    properties: isPlainObject(rest.properties) ? rest.properties : {},
+    additionalProperties: true,
+    description:
+      baseDescription.length > MAX_FALLBACK_DESCRIPTION
+        ? baseDescription.slice(0, MAX_FALLBACK_DESCRIPTION)
+        : baseDescription,
+  };
+}

package/src/providers/anthropic.ts

@@ -3,6 +3,7 @@
  */
 
 import Anthropic, { type ClientOptions } from '@anthropic-ai/sdk';
+import { assertWithinByteBudget, shedImagesToFitByteBudget } from '../utils/image-media.js';
 import type {
   ProviderAdapter,
   ProviderRequest,
@@ -20,6 +21,52 @@ import {
   serverError,
   abortError,
 } from '../types/index.js';
+import { flattenRootSchemaUnion } from './anthropic-tool-schema.js';
+
+// ============================================================================
+// Model capability gates
+// ============================================================================
+
+/**
+ * Models that reject the sampling parameters (`temperature`, `top_p`,
+ * `top_k`) with a 400 invalid_request_error — which Membrane classifies as
+ * non-retryable, so a single stray `temperature` kills the whole turn.
+ * Mirrors the `noTemperatureSupport` gate in the OpenAI provider.
+ *
+ * This is the always-on-thinking / reasoning-forward tier, which removes the
+ * sampling parameters from the API surface entirely (Sonnet 5 rejects only
+ * non-default values). Everything else — Haiku 4.5, Sonnet 4.6, Opus 4.6 and
+ * older — ACCEPTS `temperature`, so it must NOT be listed here.
+ *
+ *   - Opus 4.7 / Opus 4.8 / Sonnet 5 / Fable 5 / Mythos 5 / Mythos preview:
+ *     documented 400 on any sampling parameter.
+ *
+ * NB: claude-haiku-4-5 was previously listed here on the strength of a single
+ * "observed 400 in production when temperature is sent" anecdote. Haiku 4.5
+ * documentably supports `temperature`; the production 400 was almost certainly
+ * the `extra`-params bypass fixed in this same PR (a sampling param smuggled
+ * through `extra` and re-inserted after the gate — 400s on any model), not a
+ * capability of Haiku. Listing it silently discarded a valid parameter on the
+ * most common cheap model, so it has been removed.
+ *
+ * Prefix-matched, so dated snapshots (e.g. claude-opus-4-8-20251001) are
+ * covered. Keep this list updated as models launch.
+ */
+const NO_TEMPERATURE_MODELS = [
+  'claude-opus-4-7',
+  'claude-opus-4-8',
+  'claude-sonnet-5',
+  'claude-fable-5',
+  'claude-mythos-5',
+  'claude-mythos-preview',
+];
+
+/**
+ * Check if a model doesn't support custom sampling parameters
+ */
+function noTemperatureSupport(model: string): boolean {
+  return NO_TEMPERATURE_MODELS.some(prefix => model.startsWith(prefix));
+}
 
 // ============================================================================
 // Adapter Configuration
@@ -326,6 +373,13 @@ export class AnthropicAdapter implements ProviderAdapter {
       };
     });
 
+    // Byte-wall INVARIANT at the last exit before the SDK (2026-07-12): the
+    // policy decision (shed with explicit opt-in, or fail loudly) happens
+    // upstream at the request-build sites. Reaching this point oversize means
+    // a compile path bypassed the policy — throw with the breakdown rather
+    // than silently mutate or eat a 413 round-trip.
+    assertWithinByteBudget(sanitizedMessages, undefined, 'anthropic-provider');
+
     const params: Anthropic.MessageCreateParams = {
       model: request.model,
       max_tokens: request.maxTokens || this.defaultMaxTokens,
@@ -342,17 +396,42 @@ export class AnthropicAdapter implements ProviderAdapter {
       }
     }
     
-    if (request.temperature !== undefined) {
+    // Sampling-parameter gates:
+    //   - Some models reject temperature/top_p/top_k outright with a 400
+    //     (see NO_TEMPERATURE_MODELS) — strip rather than let the whole
+    //     inference die on a non-retryable invalid_request_error.
+    //   - Extended thinking rejects custom temperature/top_k on every model
+    //     (only the defaults are accepted while thinking is on) — strip those
+    //     too when a thinking config is present and not disabled.
+    const stripSampling = noTemperatureSupport(request.model);
+    // Thinking can arrive top-level OR smuggled through `extra` — the same
+    // `Object.assign(params, rest)` below installs `extra.thinking` into the
+    // request AFTER this gate ran. Resolve from both sources so an enabled
+    // thinking config strips sampling params no matter where it came from;
+    // otherwise `extra: { thinking, temperature }` reproduces the exact 400
+    // this gate exists to prevent (same bug class as the extra-sampling bypass,
+    // one field over).
+    const extraThinking = (request.extra as { thinking?: { type?: string } } | undefined)?.thinking;
+    const thinkingConfig = request.thinking ?? extraThinking;
+    const thinkingOn = thinkingConfig !== undefined && thinkingConfig.type !== 'disabled';
+
+    if (request.temperature !== undefined && !stripSampling && !thinkingOn) {
       params.temperature = request.temperature;
     }
 
     // Anthropic API rejects requests with both temperature and top_p set.
     // When both are provided, prefer temperature (more commonly tuned) and drop top_p.
-    if (request.topP !== undefined && request.temperature === undefined) {
+    // With thinking on, top_p is only accepted in [0.95, 1] — strip values below.
+    if (
+      request.topP !== undefined &&
+      params.temperature === undefined &&
+      !stripSampling &&
+      (!thinkingOn || request.topP >= 0.95)
+    ) {
       params.top_p = request.topP;
     }
 
-    if (request.topK !== undefined) {
+    if (request.topK !== undefined && !stripSampling && !thinkingOn) {
       params.top_k = request.topK;
     }
 
@@ -361,17 +440,43 @@ export class AnthropicAdapter implements ProviderAdapter {
     }
     
     if (request.tools && request.tools.length > 0) {
-      params.tools = request.tools as Anthropic.Tool[];
+      // MCP allows a root-level oneOf/anyOf/allOf in a tool's input schema,
+      // but the Anthropic API rejects it ("input_schema does not support
+      // oneOf, allOf, or anyOf at the top level") — one bad tool 400s the
+      // entire inference. Flatten such roots into a single object schema
+      // before shipping (see anthropic-tool-schema.ts).
+      params.tools = (request.tools as Anthropic.Tool[]).map(tool => {
+        const inputSchema = (tool as { input_schema?: unknown }).input_schema;
+        const flattened = flattenRootSchemaUnion(inputSchema);
+        return flattened === inputSchema
+          ? tool
+          : ({ ...tool, input_schema: flattened } as Anthropic.Tool);
+      });
     }
 
     // Handle extended thinking
-    if ((request as any).thinking) {
-      (params as any).thinking = (request as any).thinking;
+    if (request.thinking) {
+      (params as any).thinking = request.thinking;
     }
 
     // Apply extra params, excluding internal membrane fields
     if (request.extra) {
       const { normalizedMessages, prompt, ...rest } = request.extra as Record<string, unknown>;
+      // Sampling params passed through `extra` must obey the same gates as the
+      // top-level ones. Otherwise a caller passing e.g. `extra: { temperature }`
+      // for a reject-list model (or under extended thinking) would re-insert the
+      // stripped value here — via Object.assign, after the gate above — and
+      // reproduce the exact non-retryable 400 this stripping is meant to prevent.
+      if (stripSampling || thinkingOn) {
+        delete rest.temperature;
+        delete rest.top_k;
+        // top_p is accepted in [0.95, 1] while thinking is on, but never when
+        // the model rejects sampling params outright.
+        const extraTopP = rest.top_p;
+        if (stripSampling || typeof extraTopP !== 'number' || extraTopP < 0.95) {
+          delete rest.top_p;
+        }
+      }
       Object.assign(params, rest);
     }
 

package/src/providers/gemini.ts

@@ -428,6 +428,20 @@ export class GeminiAdapter implements ProviderAdapter {
                 },
               });
             }
+          } else if (block.type === 'audio') {
+            // Audio input → Gemini inlineData (same mechanism as images). This is
+            // pure plumbing: whether a given model accepts/understands audio is the
+            // model's concern (the caller decides what to send). Common MIME types:
+            // audio/mp3, audio/wav, audio/ogg, audio/flac.
+            const source = block.source;
+            if (source?.type === 'base64' && source.data) {
+              parts.push({
+                inlineData: {
+                  mimeType: source.mediaType ?? source.media_type ?? 'audio/mpeg',
+                  data: source.data,
+                },
+              });
+            }
           } else if (block.type === 'tool_use') {
             parts.push({
               functionCall: {

package/src/providers/index.ts

@@ -9,6 +9,8 @@ export {
   type AnthropicAdapterConfig,
 } from './anthropic.js';
 
+export { flattenRootSchemaUnion } from './anthropic-tool-schema.js';
+
 export {
   OpenRouterAdapter,
   toOpenRouterMessages,