@buoy-gg/agent-core 7.0.41 → 7.0.42

package/lib/commonjs/policy/redact.js

@@ -1,172 +1 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.isSelfTraffic = isSelfTraffic;
-exports.redact = redact;
-exports.registerSelfEndpoint = registerSelfEndpoint;
-exports.stripSelfTraffic = stripSelfTraffic;
-/**
- * Scrub tool results before they leave the device.
- *
- * Two separate reasons, and the second is the one people forget:
- *
- * 1. EGRESS. Tool results go to the customer's own model endpoint. That is
- *    their data boundary, not ours — but a response body carrying an
- *    `Authorization` header or a Buoy `licenseKey` is a credential, and
- *    credentials do not belong in a chat transcript that may be retained for
- *    30 days for abuse monitoring.
- * 2. SELF-INJECTION. Buoy's own network interceptor captures the agent's
- *    requests to the model endpoint. Without exclusion, the model reads back
- *    its own request headers — including whatever the host app's `headers()`
- *    returned — out of `network.getRequests`. That is a credential leak and a
- *    prompt-injection channel in one call.
- */
-
-/**
- * Key names that mean "credential", compared with separators stripped —
- * `X_API_KEY`, `x-api-key` and `xApiKey` are the same word. A list of hyphen
- * spellings let `EXPO_PUBLIC_X_API_KEY=…` through to the model whole on a real
- * app, alongside `EXPO_PUBLIC_BUOY_KEY`, which is the Pro licence that gates
- * this very tool. Both went out in plaintext while `…_PASSWORD` was caught.
- */
-const SECRET_KEYS = ["authorization", "cookie", "setcookie", "apikey", "proxyauthorization", "authtoken", "accesstoken", "refreshtoken", "idtoken", "sessiontoken", "bearertoken", "licensekey", "licencekey", "buoykey", "privatekey", "secret", "password", "passwd", "credential"];
-const REDACTED = "[redacted by Buoy]";
-
-/**
- * Credential SHAPES, for values whose key name gives nothing away — a JWT
- * stored under `session`, a Bearer header quoted inside a response body. The
- * key-name check alone let those through whole. Same shapes the broker wire
- * scrubber uses; duplicated here because agent-core cannot depend on ask-buoy.
- */
-const SECRET_VALUE_PATTERNS = [{
-  re: /\bBearer\s+[A-Za-z0-9._~+/-]{12,}=*/gi,
-  label: "[bearer token removed]"
-}, {
-  re: /\beyJ[A-Za-z0-9._-]{20,}/g,
-  label: "[jwt removed]"
-}, {
-  re: /\bsk-[A-Za-z0-9_-]{16,}/g,
-  label: "[api key removed]"
-}, {
-  re: /\bBUOY-[A-Z0-9-]{8,}/g,
-  label: "[license key removed]"
-},
-// Keygen-issued Buoy Pro keys: five hex sextets and a version suffix.
-{
-  re: /\b[A-F0-9]{6}(?:-[A-F0-9]{6}){4}-V\d\b/g,
-  label: "[license key removed]"
-}, {
-  // Key-name spellings inside free text: `X_API_KEY=…`, `apiKey: "…"`,
-  // `EXPO_PUBLIC_BUOY_KEY=…`. Word-prefixed forms (EXPO_PUBLIC_, REACT_APP_)
-  // are covered because the name only has to END in the credential word.
-  re: /("|')?[A-Za-z0-9_-]*(authorization|api[_-]?key|password|passwd|secret|access[_-]?token|refresh[_-]?token|auth[_-]?token|session[_-]?token|license[_-]?key|licence[_-]?key|buoy[_-]?key|private[_-]?key)\1?\s*[:=]\s*("|')?[^\s"',}]{6,}/gi,
-  label: "[credential removed]"
-}];
-function scrubString(s) {
-  let out = s;
-  for (const {
-    re,
-    label
-  } of SECRET_VALUE_PATTERNS) {
-    out = out.replace(re, label);
-  }
-  return out;
-}
-function isSecretKey(key) {
-  const k = key.toLowerCase().replace(/[-_.\s]/g, "");
-  return SECRET_KEYS.some(s => k.includes(s));
-}
-
-/**
- * Deep-redact by key name AND by value shape. Depth-limited because tool
- * results can be deeply nested state trees and a runaway walk on a megabyte
- * payload is a frame drop on the JS thread the app is also using.
- */
-function redact(value, depth = 0) {
-  if (typeof value === "string") return scrubString(value);
-  if (depth > 12 || value === null || typeof value !== "object") return value;
-  if (Array.isArray(value)) {
-    return value.map(v => redact(v, depth + 1));
-  }
-  const out = {};
-  for (const [key, v] of Object.entries(value)) {
-    out[key] = isSecretKey(key) ? REDACTED : redact(v, depth + 1);
-  }
-  return out;
-}
-
-/**
- * Hosts that must never appear in a tool result, because they are the agent's
- * own traffic. Registered by the runtime from the configured endpoint.
- */
-const selfHosts = new Set();
-
-/**
- * Where the network tool looks for hosts it must not touch.
- *
- * A GLOBAL, not an import, because the dependency cannot go either way:
- * `agent-core` ships with no dependencies at all, and `@buoy-gg/network` is
- * optional — most apps that install Ask Buoy do not have it, and the ones that
- * do may load it after. A well-known key is the only seam that works in both
- * directions without either package requiring the other.
- *
- * Registering a host here means the interceptor passes its requests straight
- * through: not captured, not overridable, and — the reason this exists — not
- * held open while the interceptor reads the body. See `networkListener.ts`.
- */
-const INTERNAL_HOSTS_KEY = "__BUOY_INTERNAL_HOSTS__";
-function registerSelfEndpoint(endpoint) {
-  try {
-    // No URL polyfill assumptions — a plain parse is enough for a host match.
-    const match = /^[a-z]+:\/\/([^/?#]+)/i.exec(endpoint);
-    if (!match?.[1]) return;
-    const host = match[1].toLowerCase();
-    selfHosts.add(host);
-    const g = globalThis;
-    const existing = g[INTERNAL_HOSTS_KEY];
-    const hosts = existing instanceof Set ? existing : new Set();
-    hosts.add(host);
-    g[INTERNAL_HOSTS_KEY] = hosts;
-  } catch {
-    /* an unparseable endpoint just means no exclusion */
-  }
-}
-function isSelfTraffic(url) {
-  if (typeof url !== "string") return false;
-  const lower = url.toLowerCase();
-  for (const host of selfHosts) {
-    if (lower.includes(host)) return true;
-  }
-  return false;
-}
-function hasSelfUrl(item) {
-  if (!item || typeof item !== "object") return false;
-  const rec = item;
-  return isSelfTraffic(rec.url ?? rec.uri ?? rec.href);
-}
-
-/**
- * Drop the agent's own requests out of a network-shaped result before the
- * model sees them.
- *
- * WALKS INTO OBJECTS, not just top-level arrays. A network reader returns
- * `{ totalCaptured, requests: [...] }`, not a bare array, and a version of
- * this that only handled the bare array quietly did nothing — the agent's own
- * POST to the model endpoint, headers and all, came straight back to it out
- * of the network read. Depth-limited for the same reason `redact` is: this
- * runs on the JS thread the app is drawing on.
- */
-function stripSelfTraffic(value, depth = 0) {
-  if (depth > 6 || value === null || typeof value !== "object") return value;
-  if (Array.isArray(value)) {
-    return value.filter(item => !hasSelfUrl(item)).map(item => stripSelfTraffic(item, depth + 1));
-  }
-  const out = {};
-  for (const [key, v] of Object.entries(value)) {
-    out[key] = stripSelfTraffic(v, depth + 1);
-  }
-  return out;
-}
-//# sourceMappingURL=redact.js.map
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.isSelfTraffic=isSelfTraffic;exports.redact=redact;exports.registerSelfEndpoint=registerSelfEndpoint;exports.stripSelfTraffic=stripSelfTraffic;const SECRET_KEYS=["authorization","cookie","setcookie","apikey","proxyauthorization","authtoken","accesstoken","refreshtoken","idtoken","sessiontoken","bearertoken","licensekey","licencekey","buoykey","privatekey","secret","password","passwd","credential"];const REDACTED="[redacted by Buoy]";const SECRET_VALUE_PATTERNS=[{re:/\bBearer\s+[A-Za-z0-9._~+/-]{12,}=*/gi,label:"[bearer token removed]"},{re:/\beyJ[A-Za-z0-9._-]{20,}/g,label:"[jwt removed]"},{re:/\bsk-[A-Za-z0-9_-]{16,}/g,label:"[api key removed]"},{re:/\bBUOY-[A-Z0-9-]{8,}/g,label:"[license key removed]"},{re:/\b[A-F0-9]{6}(?:-[A-F0-9]{6}){4}-V\d\b/g,label:"[license key removed]"},{re:/("|')?[A-Za-z0-9_-]*(authorization|api[_-]?key|password|passwd|secret|access[_-]?token|refresh[_-]?token|auth[_-]?token|session[_-]?token|license[_-]?key|licence[_-]?key|buoy[_-]?key|private[_-]?key)\1?\s*[:=]\s*("|')?[^\s"',}]{6,}/gi,label:"[credential removed]"}];function scrubString(e){let r=e;for(const{re:o,label:t}of SECRET_VALUE_PATTERNS){r=r.replace(o,t)}return r}function isSecretKey(e){const r=e.toLowerCase().replace(/[-_.\s]/g,"");return SECRET_KEYS.some(o=>r.includes(o))}function redact(e,r=0){if(typeof e==="string")return scrubString(e);if(r>12||e===null||typeof e!=="object")return e;if(Array.isArray(e)){return e.map(t=>redact(t,r+1))}const o={};for(const[t,s]of Object.entries(e)){o[t]=isSecretKey(t)?REDACTED:redact(s,r+1)}return o}const selfHosts=new Set;const INTERNAL_HOSTS_KEY="__BUOY_INTERNAL_HOSTS__";function registerSelfEndpoint(e){try{const r=/^[a-z]+:\/\/([^/?#]+)/i.exec(e);if(!r?.[1])return;const o=r[1].toLowerCase();selfHosts.add(o);const t=globalThis;const s=t[INTERNAL_HOSTS_KEY];const n=s instanceof Set?s:new Set;n.add(o);t[INTERNAL_HOSTS_KEY]=n}catch{}}function isSelfTraffic(e){if(typeof e!=="string")return false;const r=e.toLowerCase();for(const o of selfHosts){if(r.includes(o))return true}return false}function hasSelfUrl(e){if(!e||typeof e!=="object")return false;const r=e;return isSelfTraffic(r.url??r.uri??r.href)}function stripSelfTraffic(e,r=0){if(r>6||e===null||typeof e!=="object")return e;if(Array.isArray(e)){return e.filter(t=>!hasSelfUrl(t)).map(t=>stripSelfTraffic(t,r+1))}const o={};for(const[t,s]of Object.entries(e)){o[t]=stripSelfTraffic(s,r+1)}return o}

package/lib/commonjs/providers/anthropic.js

@@ -1,447 +1,5 @@
-"use strict";
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.createAnthropicProvider=createAnthropicProvider;var _sse=require("./sse");var _streamTimer=require("./streamTimer");var _transport=require("./transport");var _problem=require("./problem");const DEFAULT_VERSION="2023-06-01";function markLastBlock(a){const i=a[a.length-1];const s=i?.content[i.content.length-1];if(s){s.cache_control={type:"ephemeral"}}return a}function toWireMessages(a){const i=[];for(const s of a){if(s.role==="user"){i.push({role:"user",content:[{type:"text",text:s.text}]})}else if(s.role==="assistant"){const o=[];for(const r of s.thinking??[])o.push(r);if(s.text)o.push({type:"text",text:s.text});for(const r of s.toolCalls??[]){o.push({type:"tool_use",id:r.id,name:r.name,input:r.input})}if(o.length)i.push({role:"assistant",content:o})}else{i.push({role:"user",content:s.results.map(o=>({type:"tool_result",tool_use_id:o.toolCallId,content:o.content,...o.isError?{is_error:true}:{}}))})}}return i}function createAnthropicProvider(a){const i=(0,_transport.createTransport)(a);return{protocol:"anthropic",async*send(s){const o=(0,_streamTimer.createStreamTimer)(s.signal,a);const r={truncated:false};try{const l={"content-type":"application/json","anthropic-version":a.anthropicVersion??DEFAULT_VERSION,...await(a.headers?.()??{})};if(a.apiKey&&!l["x-api-key"]&&!l.Authorization){l["x-api-key"]=a.apiKey;l["anthropic-dangerous-direct-browser-access"]="true"}const p=await i.open({headers:l,signal:o.signal,body:JSON.stringify({model:s.model,max_tokens:s.maxTokens,stream:true,system:a.cache===false?s.systemVolatile?`${s.system}
 
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.createAnthropicProvider = createAnthropicProvider;
-var _sse = require("./sse");
-var _streamTimer = require("./streamTimer");
-var _transport = require("./transport");
-var _problem = require("./problem");
-/**
- * Anthropic Messages protocol.
- *
- * Four things here are not obvious and each one is a silent failure if missed:
- *
- * 1. `content_block_start` for a `tool_use` carries `"input": {}` — an EMPTY
- *    object, never the real arguments. The arguments only exist after
- *    concatenating every `input_json_delta.partial_json` and parsing at
- *    `content_block_stop`. Reading `.input` at start yields a tool call with no
- *    arguments and no error.
- * 2. There is NO `data: [DONE]` sentinel (removed in the 2023-06-01 version).
- *    The stream ends at `message_stop`.
- * 3. `error` events arrive MID-STREAM on an already-committed HTTP 200 —
- *    `overloaded_error` being the common one. A 200 is not success.
- * 4. Ordering is 400-level strict: `tool_result` blocks must come FIRST in the
- *    user content array with any text after, and that user message must
- *    immediately follow the assistant turn. "Here are the results:" placed
- *    before the blocks is an instant 400.
- * 5. Every current Claude model thinks by DEFAULT, and a `thinking` block must
- *    be replayed VERBATIM (signature and all) at the FRONT of the assistant
- *    turn it came from whenever that turn's tool results are sent back. An
- *    adapter that keeps only text and tool_use 400s on the second request of
- *    every tool-using turn — which is every turn Ask Buoy actually makes.
- */
+---
 
-const DEFAULT_VERSION = "2023-06-01";
-/**
- * Mark the last content block of the last message as a cache breakpoint.
- *
- * WHY THERE IS A SECOND BREAKPOINT AT ALL. The first one, at the end of
- * `system`, caches the tools and the system prompt — the big fixed prefix. It
- * does nothing for the messages, which were left uncached on the reasoning
- * that they grow every turn and so would pay the write multiplier for a prefix
- * never read back. That is true of a turn with ONE request. It is false of the
- * turns this tool actually makes: a turn runs 3 to 8 model requests, each
- * re-sending the whole conversation plus everything the previous steps read,
- * and steps 2..N are exactly a re-read of what step 1 already sent.
- *
- * So the breakpoint MOVES: each request marks its own last block, and the next
- * request hits it (Anthropic looks back ~20 blocks for a match). Step 1 writes
- * the messages at 1.25x, every later step reads them at 0.1x and writes only
- * its own delta.
- *
- * What it does NOT buy is cross-TURN caching, because the volatile "right now"
- * block sits at the end of `system` and changes every turn, invalidating
- * anything after it. Within a turn is where the multiplier lives, and that is
- * what this collects.
- */
-function markLastBlock(out) {
-  const lastMessage = out[out.length - 1];
-  const lastBlock = lastMessage?.content[lastMessage.content.length - 1];
-  if (lastBlock) {
-    lastBlock.cache_control = {
-      type: "ephemeral"
-    };
-  }
-  return out;
-}
-function toWireMessages(messages) {
-  const out = [];
-  for (const m of messages) {
-    if (m.role === "user") {
-      out.push({
-        role: "user",
-        content: [{
-          type: "text",
-          text: m.text
-        }]
-      });
-    } else if (m.role === "assistant") {
-      const content = [];
-      // Thinking FIRST — see note 5. Signatures are opaque; never edit them.
-      for (const t of m.thinking ?? []) content.push(t);
-      if (m.text) content.push({
-        type: "text",
-        text: m.text
-      });
-      for (const c of m.toolCalls ?? []) {
-        content.push({
-          type: "tool_use",
-          id: c.id,
-          name: c.name,
-          input: c.input
-        });
-      }
-      if (content.length) out.push({
-        role: "assistant",
-        content
-      });
-    } else {
-      // tool_result blocks FIRST — see note 4. No preamble text, ever.
-      out.push({
-        role: "user",
-        content: m.results.map(r => ({
-          type: "tool_result",
-          tool_use_id: r.toolCallId,
-          content: r.content,
-          ...(r.isError ? {
-            is_error: true
-          } : {})
-        }))
-      });
-    }
-  }
-  return out;
-}
-function createAnthropicProvider(config) {
-  // One per provider, so the `auto` transport decision is made once and not
-  // re-learned (and re-buffered) at the start of every turn.
-  const transport = (0, _transport.createTransport)(config);
-  return {
-    protocol: "anthropic",
-    async *send(req) {
-      const timer = (0, _streamTimer.createStreamTimer)(req.signal, config);
-      const status = {
-        truncated: false
-      };
-      try {
-        const headers = {
-          "content-type": "application/json",
-          "anthropic-version": config.anthropicVersion ?? DEFAULT_VERSION,
-          ...(await (config.headers?.() ?? {}))
-        };
-        // Dev-only direct mode. A distributed build uses `headers` against the
-        // org's own gateway and never carries a provider key at all.
-        if (config.apiKey && !headers["x-api-key"] && !headers.Authorization) {
-          headers["x-api-key"] = config.apiKey;
-          // Without this the POST comes back with no access-control-allow-origin
-          // and a browser/Electron renderer silently discards an otherwise fine
-          // response — a 200 in the network log and "Failed to fetch" in JS.
-          headers["anthropic-dangerous-direct-browser-access"] = "true";
-        }
-        const stream = await transport.open({
-          headers,
-          // The timer's signal, not the caller's: it aborts on the user's Stop
-          // AND on either clock running out. See providers/streamTimer.ts.
-          signal: timer.signal,
-          body: JSON.stringify({
-            model: req.model,
-            max_tokens: req.maxTokens,
-            stream: true,
-            // ONE cache breakpoint, at the end of `system`.
-            //
-            // Anthropic caches the prefix in a fixed order — tools, then system,
-            // then messages — up to and including the block carrying
-            // `cache_control`. So marking the end of the system prompt caches
-            // the tool definitions with it, which is the point: the tools are
-            // ~20k tokens and by far the larger half. A second breakpoint on the
-            // last tool would buy nothing and spend one of the four available.
-            //
-            // Messages stay uncached on purpose. They grow every turn, so they
-            // would invalidate on each request and pay the write multiplier for
-            // a prefix that is never read back.
-            //
-            // The volatile block (what is on screen right now) goes in a SECOND
-            // text block after the breakpoint. It changes every turn; inside the
-            // cached block it would invalidate the whole prefix each time.
-            system: config.cache === false ? req.systemVolatile ? `${req.system}\n\n---\n\n${req.systemVolatile}` : req.system : [{
-              type: "text",
-              text: req.system,
-              cache_control: {
-                type: "ephemeral"
-              }
-            }, ...(req.systemVolatile ? [{
-              type: "text",
-              text: req.systemVolatile
-            }] : [])],
-            tools: req.tools.map(t => ({
-              name: t.name,
-              description: t.description,
-              input_schema: t.inputSchema,
-              // Anthropic-only. Each example must validate against input_schema
-              // or the API 400s, so these are generated from the catalog rather
-              // than written by hand.
-              ...(t.inputExamples?.length ? {
-                input_examples: t.inputExamples
-              } : {})
-            })),
-            messages: config.cache === false ? toWireMessages(req.messages) : markLastBlock(toWireMessages(req.messages)),
-            ...config.requestOverrides
-          })
-        });
-
-        // Headers are in: the connect clock stops here and the idle one starts.
-        timer.connected();
-        if (stream.problem) {
-          yield {
-            type: "error",
-            message: stream.problem,
-            kind: "provider",
-            problem: stream.problemInfo
-          };
-          return;
-        }
-
-        // Partial tool_use args accumulate here, keyed by content-block index.
-        const pending = new Map();
-        // Partial thinking blocks, same keying. `thinking_delta` carries the
-        // text and `signature_delta` the signature, and the signature usually
-        // arrives in ONE delta right at the end — a reader that stops at
-        // thinking_delta replays an unsigned block, which the API rejects.
-        const thinking = new Map();
-        let stopReason;
-        let usage;
-        let model;
-        /** The protocol's end marker; ends the read. See `sawTerminal` below. */
-        let sawStop = false;
-        for await (const ev of stream.frames({
-          status,
-          onFrame: timer.activity,
-          signal: timer.signal
-        })) {
-          let payload;
-          try {
-            payload = JSON.parse(ev.data);
-          } catch {
-            continue;
-          }
-          const kind = payload.type ?? ev.event;
-          switch (kind) {
-            case "content_block_start":
-              {
-                const block = payload.content_block;
-                if (block?.type === "thinking") {
-                  thinking.set(payload.index, {
-                    thinking: block.thinking ?? "",
-                    signature: block.signature ?? ""
-                  });
-                } else if (block?.type === "redacted_thinking") {
-                  // No deltas for these — the whole (encrypted) payload is here.
-                  yield {
-                    type: "thinking",
-                    block: {
-                      type: "redacted_thinking",
-                      data: block.data
-                    }
-                  };
-                } else if (block?.type === "tool_use") {
-                  // NOT block.input — see note 1.
-                  pending.set(payload.index, {
-                    id: block.id,
-                    name: block.name,
-                    json: ""
-                  });
-                }
-                break;
-              }
-            case "content_block_delta":
-              {
-                const delta = payload.delta;
-                if (delta?.type === "text_delta") {
-                  yield {
-                    type: "text",
-                    delta: delta.text
-                  };
-                } else if (delta?.type === "input_json_delta") {
-                  const slot = pending.get(payload.index);
-                  if (slot) slot.json += delta.partial_json ?? "";
-                } else if (delta?.type === "thinking_delta") {
-                  const slot = thinking.get(payload.index);
-                  if (slot) slot.thinking += delta.thinking ?? "";
-                } else if (delta?.type === "signature_delta") {
-                  const slot = thinking.get(payload.index);
-                  if (slot) slot.signature += delta.signature ?? "";
-                }
-                break;
-              }
-            case "content_block_stop":
-              {
-                const thought = thinking.get(payload.index);
-                if (thought) {
-                  thinking.delete(payload.index);
-                  yield {
-                    type: "thinking",
-                    block: {
-                      type: "thinking",
-                      ...thought
-                    }
-                  };
-                }
-                const slot = pending.get(payload.index);
-                if (slot) {
-                  pending.delete(payload.index);
-                  let input = {};
-                  try {
-                    input = slot.json ? JSON.parse(slot.json) : {};
-                  } catch {
-                    yield {
-                      type: "error",
-                      kind: "provider",
-                      // Same evidence as the OpenAI path. The stop reason is not
-                      // known yet here — it rides on `message_delta`, which comes
-                      // after this block closes — so only the raw tail is carried.
-                      message: (0, _sse.unparseableMessage)(slot.name, slot.json)
-                    };
-                    break;
-                  }
-                  const call = {
-                    id: slot.id,
-                    name: slot.name,
-                    input
-                  };
-                  yield {
-                    type: "tool-call",
-                    call
-                  };
-                }
-                break;
-              }
-            case "message_start":
-              {
-                // The cache counters arrive HERE, not on message_delta — the
-                // prefix is accounted for before a single token is generated. A
-                // reader that only watches message_delta sees cacheRead 0 on
-                // every request and concludes caching is not working.
-                const m = payload.message;
-                // The served model id is named here and nowhere else — a gateway
-                // resolves an alias to a dated snapshot, and this is that id.
-                if (typeof m?.model === "string" && m.model) model = m.model;
-                const u = m?.usage;
-                if (u) {
-                  usage = {
-                    input: u.input_tokens ?? 0,
-                    output: u.output_tokens ?? 0,
-                    ...(u.cache_read_input_tokens !== undefined ? {
-                      cacheRead: u.cache_read_input_tokens
-                    } : {}),
-                    ...(u.cache_creation_input_tokens !== undefined ? {
-                      cacheWrite: u.cache_creation_input_tokens
-                    } : {})
-                  };
-                }
-                break;
-              }
-            case "message_delta":
-              {
-                const delta = payload.delta;
-                // `stop_reason` is the model's own statement that it finished,
-                // and counts as terminal on its own (see `sawTerminal`). It does
-                // NOT end the read: `message_stop` is one frame away and there is
-                // no reason to cancel a stream that is about to close itself.
-                if (delta?.stop_reason) stopReason = delta.stop_reason;
-                // Cumulative, not incremental — assign, never add. Output tokens
-                // are only final here, so keep whatever message_start reported
-                // about the cache rather than replacing the whole record.
-                const u = payload.usage;
-                if (u) {
-                  usage = {
-                    ...usage,
-                    input: u.input_tokens ?? usage?.input ?? 0,
-                    output: u.output_tokens ?? 0
-                  };
-                }
-                break;
-              }
-            case "error":
-              {
-                const err = payload.error;
-                const message = err?.message ?? "Provider error";
-                yield {
-                  type: "error",
-                  message,
-                  kind: "provider",
-                  // `overloaded_error` on a committed 200 is the common shape —
-                  // classified so the engine can retry it when nothing came first.
-                  problem: (0, _problem.classifyProblem)({
-                    type: typeof err?.type === "string" ? err.type : undefined,
-                    message
-                  })
-                };
-                return;
-              }
-            case "message_stop":
-              // The end. There is no [DONE] — see note 2.
-              sawStop = true;
-              break;
-            default:
-              break;
-          }
-          // `break` inside the switch leaves the switch, not the loop.
-          if (sawStop) break;
-        }
-
-        /**
-         * Did the provider actually say it was finished?
-         *
-         * `message_stop` is the protocol's end marker. `stop_reason` counts
-         * too: it is the model's own statement of why it stopped, which is the
-         * stronger claim — `message_stop` only says the SSE stream closed. A
-         * proxy that forwards the delta and drops the final frame has still
-         * delivered a whole answer, and refusing it would break working
-         * gateways for no safety gain. NEITHER arriving is the case that
-         * matters: bare EOF, which used to be read as success.
-         */
-        const sawTerminal = sawStop || stopReason !== undefined;
-        if (!sawTerminal) {
-          // Bare EOF. Whatever text arrived is real and the engine will show it,
-          // but the plan behind it is half-written: a connection cut after
-          // `{"key":"cart","value":[]}` leaves valid JSON that reads exactly like
-          // a finished thought. Nothing here is admitted for execution.
-          yield {
-            type: "error",
-            message: (0, _sse.truncatedMessage)(status.truncated),
-            kind: "truncated"
-          };
-          return;
-        }
-        yield {
-          type: "done",
-          outcome: stopReason === "max_tokens" ? "output-limited" : "completed",
-          stopReason,
-          usage,
-          model
-        };
-      } catch (err) {
-        // The user's Stop wins the label even if a clock fired in the same
-        // tick: they know why the turn ended, and "timed out" would be a lie.
-        if (req.signal?.aborted) throw err;
-        const message = timer.message();
-        if (message) {
-          yield {
-            type: "error",
-            message,
-            kind: "timeout"
-          };
-          return;
-        }
-        // A genuine transport failure — DNS, refused connection, TLS. It has
-        // always propagated to the failed-turn card, and still does.
-        throw err;
-      } finally {
-        timer.dispose();
-      }
-    }
-  };
-}
-//# sourceMappingURL=anthropic.js.map
+${s.systemVolatile}`:s.system:[{type:"text",text:s.system,cache_control:{type:"ephemeral"}},...s.systemVolatile?[{type:"text",text:s.systemVolatile}]:[]],tools:s.tools.map(c=>({name:c.name,description:c.description,input_schema:c.inputSchema,...c.inputExamples?.length?{input_examples:c.inputExamples}:{}})),messages:a.cache===false?toWireMessages(s.messages):markLastBlock(toWireMessages(s.messages)),...a.requestOverrides})});o.connected();if(p.problem){yield{type:"error",message:p.problem,kind:"provider",problem:p.problemInfo};return}const m=new Map;const d=new Map;let y;let u;let h;let _=false;for await(const c of p.frames({status:r,onFrame:o.activity,signal:o.signal})){let n;try{n=JSON.parse(c.data)}catch{continue}const f=n.type??c.event;switch(f){case"content_block_start":{const e=n.content_block;if(e?.type==="thinking"){d.set(n.index,{thinking:e.thinking??"",signature:e.signature??""})}else if(e?.type==="redacted_thinking"){yield{type:"thinking",block:{type:"redacted_thinking",data:e.data}}}else if(e?.type==="tool_use"){m.set(n.index,{id:e.id,name:e.name,json:""})}break}case"content_block_delta":{const e=n.delta;if(e?.type==="text_delta"){yield{type:"text",delta:e.text}}else if(e?.type==="input_json_delta"){const t=m.get(n.index);if(t)t.json+=e.partial_json??""}else if(e?.type==="thinking_delta"){const t=d.get(n.index);if(t)t.thinking+=e.thinking??""}else if(e?.type==="signature_delta"){const t=d.get(n.index);if(t)t.signature+=e.signature??""}break}case"content_block_stop":{const e=d.get(n.index);if(e){d.delete(n.index);yield{type:"thinking",block:{type:"thinking",...e}}}const t=m.get(n.index);if(t){m.delete(n.index);let g={};try{g=t.json?JSON.parse(t.json):{}}catch{yield{type:"error",kind:"provider",message:(0,_sse.unparseableMessage)(t.name,t.json)};break}const x={id:t.id,name:t.name,input:g};yield{type:"tool-call",call:x}}break}case"message_start":{const e=n.message;if(typeof e?.model==="string"&&e.model)h=e.model;const t=e?.usage;if(t){u={input:t.input_tokens??0,output:t.output_tokens??0,...t.cache_read_input_tokens!==void 0?{cacheRead:t.cache_read_input_tokens}:{},...t.cache_creation_input_tokens!==void 0?{cacheWrite:t.cache_creation_input_tokens}:{}}}break}case"message_delta":{const e=n.delta;if(e?.stop_reason)y=e.stop_reason;const t=n.usage;if(t){u={...u,input:t.input_tokens??u?.input??0,output:t.output_tokens??0}}break}case"error":{const e=n.error;const t=e?.message??"Provider error";yield{type:"error",message:t,kind:"provider",problem:(0,_problem.classifyProblem)({type:typeof e?.type==="string"?e.type:void 0,message:t})};return}case"message_stop":_=true;break;default:break}if(_)break}const k=_||y!==void 0;if(!k){yield{type:"error",message:(0,_sse.truncatedMessage)(r.truncated),kind:"truncated"};return}yield{type:"done",outcome:y==="max_tokens"?"output-limited":"completed",stopReason:y,usage:u,model:h}}catch(l){if(s.signal?.aborted)throw l;const p=o.message();if(p){yield{type:"error",message:p,kind:"timeout"};return}throw l}finally{o.dispose()}}}}