@cjhyy/code-shell-core 0.5.0-rc.1 → 0.5.0-rc.2

package/dist/llm/client-base.d.ts

@@ -1,17 +1,17 @@
 /**
  * Abstract base class for all LLM provider clients.
  */
-import type { LLMConfig, LLMResponse, TokenUsage } from "../types.js";
+import type { ClientDefaults, LLMConfig, LLMResponse, TokenUsage } from "../types.js";
 import type { CreateMessageOptions, LLMUsageTracker } from "./types.js";
 export declare abstract class LLMClientBase {
     protected readonly config: LLMConfig;
     readonly provider: string;
     readonly model: string;
+    readonly maxTokens: number | undefined;
     readonly temperature: number;
-    readonly maxTokens: number;
     readonly timeout: number;
     readonly retryMaxAttempts: number;
-    readonly enableStreaming: boolean;
+    readonly imageDetail?: ClientDefaults["imageDetail"];
     /**
      * Process-wide hook fired on every LLM response. The CLI installs this in
      * main.ts to feed the cost tracker; lives on the base class so every code
@@ -20,10 +20,47 @@ export declare abstract class LLMClientBase {
      */
     static onUsage?: (model: string, usage: TokenUsage) => void;
     protected usage: LLMUsageTracker;
-    constructor(config: LLMConfig);
+    /**
+     * `config` carries model identity (provider/model/apiKey/baseUrl/maxTokens/
+     * thinking/providerKind). `defaults` carries cross-model runtime knobs
+     * (temperature/timeout/retryMaxAttempts/imageDetail) — those are owned by
+     * the Engine and stay stable across hot model switches.
+     */
+    constructor(config: LLMConfig, defaults?: ClientDefaults);
     protected abstract initClient(): void;
     abstract createMessage(options: CreateMessageOptions): Promise<LLMResponse>;
     protected recordUsage(usage: TokenUsage, options?: CreateMessageOptions): void;
     getUsage(): LLMUsageTracker;
     protected withRetry<T>(fn: () => Promise<T>, maxAttempts?: number): Promise<T>;
 }
+/**
+ * Detect HTTP 4xx errors from provider SDKs so withRetry can bail
+ * without burning backoff time. OpenAI/Anthropic SDKs attach a numeric
+ * `status` to their error objects; we treat 400-499 as non-retryable
+ * (429 is handled separately above as a rate-limit).
+ *
+ * The provider clients also wrap SDK errors into `new LLMError(msg,
+ * provider, { status })`, where the status lands in
+ * `FrameworkError.details.status` rather than a top-level `.status`.
+ * We read both so a wrapped 400/401/404 isn't retried 3× (~9 s wasted)
+ * before finally surfacing.
+ *
+ * Network errors and 5xx fall through and remain retryable.
+ *
+ * Exported for unit testing.
+ */
+export declare function isClientError(err: unknown): boolean;
+/**
+ * Detect a user/run cancellation. The OpenAI and Anthropic SDKs throw
+ * `APIUserAbortError` when a request's AbortSignal fires mid-flight; the
+ * providers rethrow it unchanged (see handleApiError). It carries no HTTP
+ * `status`, so `isClientError` can't recognise it — without an explicit
+ * check it falls through to `withRetry`'s generic branch and gets retried.
+ *
+ * We match by error name rather than `instanceof` to avoid importing the
+ * provider SDKs into the base class: `APIUserAbortError` from the SDKs, and
+ * the WHATWG `AbortError` from `fetch`/AbortController, both surface here.
+ *
+ * Exported for unit testing.
+ */
+export declare function isAbortError(err: unknown): boolean;

package/dist/llm/client-base.js

@@ -7,11 +7,11 @@ export class LLMClientBase {
     config;
     provider;
     model;
-    temperature;
     maxTokens;
+    temperature;
     timeout;
     retryMaxAttempts;
-    enableStreaming;
+    imageDetail;
     /**
      * Process-wide hook fired on every LLM response. The CLI installs this in
      * main.ts to feed the cost tracker; lives on the base class so every code
@@ -26,15 +26,26 @@ export class LLMClientBase {
         totalTokens: 0,
         requestCount: 0,
     };
-    constructor(config) {
+    /**
+     * `config` carries model identity (provider/model/apiKey/baseUrl/maxTokens/
+     * thinking/providerKind). `defaults` carries cross-model runtime knobs
+     * (temperature/timeout/retryMaxAttempts/imageDetail) — those are owned by
+     * the Engine and stay stable across hot model switches.
+     */
+    constructor(config, defaults) {
         this.config = config;
         this.provider = config.provider;
         this.model = config.model;
-        this.temperature = config.temperature ?? 0.3;
-        this.maxTokens = config.maxTokens ?? 8192;
-        this.timeout = config.timeout ?? 120_000;
-        this.retryMaxAttempts = config.retryMaxAttempts ?? 3;
-        this.enableStreaming = config.enableStreaming ?? true;
+        // No `?? 8192` fallback: when the model's output ceiling is unknown we keep
+        // `undefined` so each provider decides (OpenAI omits the field and lets the
+        // endpoint use its own max; Anthropic, where max_tokens is required, supplies
+        // a conservative default at request time). Forcing 8192 here truncated long
+        // outputs — a streamed tool-arg JSON cut off mid-token → "Missing file_path".
+        this.maxTokens = config.maxTokens;
+        this.temperature = defaults?.temperature ?? 0.3;
+        this.timeout = defaults?.timeout ?? 120_000;
+        this.retryMaxAttempts = defaults?.retryMaxAttempts ?? 3;
+        this.imageDetail = defaults?.imageDetail;
         this.initClient();
     }
     recordUsage(usage, options) {
@@ -61,6 +72,20 @@ export class LLMClientBase {
                 lastError = err;
                 if (err instanceof ContextLimitError)
                     throw err;
+                // User pressed ESC / Stop, or the run's AbortSignal fired. The SDK
+                // throws APIUserAbortError (no HTTP status, so isClientError below
+                // can't catch it). Retrying re-issues the same aborted request 3×
+                // with growing backoff — ~40 s of dead time ending in llm.exhausted,
+                // for work the user explicitly cancelled. Surface immediately.
+                if (isAbortError(err)) {
+                    logger.warn("llm.abort_no_retry", {
+                        cat: "llm",
+                        provider: this.provider,
+                        model: this.model,
+                        error: err.message,
+                    });
+                    throw err;
+                }
                 if (err instanceof LLMRateLimitError) {
                     const waitMs = (err.retryAfter ?? attempt * 2) * 1000;
                     logger.warn("llm.retry", {
@@ -119,19 +144,48 @@ export class LLMClientBase {
 }
 /**
  * Detect HTTP 4xx errors from provider SDKs so withRetry can bail
- * without burning backoff time. OpenAI/Anthropic SDKs both attach a
- * numeric `status` to their error objects; we treat 400-499 as
- * non-retryable (429 is handled separately above as a rate-limit).
+ * without burning backoff time. OpenAI/Anthropic SDKs attach a numeric
+ * `status` to their error objects; we treat 400-499 as non-retryable
+ * (429 is handled separately above as a rate-limit).
+ *
+ * The provider clients also wrap SDK errors into `new LLMError(msg,
+ * provider, { status })`, where the status lands in
+ * `FrameworkError.details.status` rather than a top-level `.status`.
+ * We read both so a wrapped 400/401/404 isn't retried 3× (~9 s wasted)
+ * before finally surfacing.
  *
  * Network errors and 5xx fall through and remain retryable.
+ *
+ * Exported for unit testing.
  */
-function isClientError(err) {
+export function isClientError(err) {
     if (typeof err !== "object" || err === null)
         return false;
-    const status = err.status;
+    const top = err.status;
+    const buried = err.details?.status;
+    const status = typeof top === "number" ? top : typeof buried === "number" ? buried : undefined;
     if (typeof status !== "number")
         return false;
     if (status === 429)
         return false;
     return status >= 400 && status < 500;
 }
+/**
+ * Detect a user/run cancellation. The OpenAI and Anthropic SDKs throw
+ * `APIUserAbortError` when a request's AbortSignal fires mid-flight; the
+ * providers rethrow it unchanged (see handleApiError). It carries no HTTP
+ * `status`, so `isClientError` can't recognise it — without an explicit
+ * check it falls through to `withRetry`'s generic branch and gets retried.
+ *
+ * We match by error name rather than `instanceof` to avoid importing the
+ * provider SDKs into the base class: `APIUserAbortError` from the SDKs, and
+ * the WHATWG `AbortError` from `fetch`/AbortController, both surface here.
+ *
+ * Exported for unit testing.
+ */
+export function isAbortError(err) {
+    if (typeof err !== "object" || err === null)
+        return false;
+    const name = err.name;
+    return name === "APIUserAbortError" || name === "AbortError";
+}

package/dist/llm/client-factory.d.ts

@@ -1,10 +1,10 @@
 /**
  * LLM provider factory with registry pattern.
  */
-import type { LLMConfig } from "../types.js";
+import type { ClientDefaults, LLMConfig } from "../types.js";
 import type { LLMClientBase } from "./client-base.js";
-type ProviderConstructor = new (config: LLMConfig) => LLMClientBase;
+type ProviderConstructor = new (config: LLMConfig, defaults?: ClientDefaults) => LLMClientBase;
 declare const PROVIDER_REGISTRY: Map<string, ProviderConstructor>;
 export declare function registerProvider(name: string, cls: ProviderConstructor): void;
-export declare function createLLMClient(config: LLMConfig): Promise<LLMClientBase>;
+export declare function createLLMClient(config: LLMConfig, defaults?: ClientDefaults): Promise<LLMClientBase>;
 export { PROVIDER_REGISTRY };

package/dist/llm/client-factory.js

@@ -6,7 +6,7 @@ const PROVIDER_REGISTRY = new Map();
 export function registerProvider(name, cls) {
     PROVIDER_REGISTRY.set(name, cls);
 }
-export async function createLLMClient(config) {
+export async function createLLMClient(config, defaults) {
     let Cls = PROVIDER_REGISTRY.get(config.provider);
     if (!Cls) {
         // Auto-register built-in providers on first use
@@ -24,6 +24,6 @@ export async function createLLMClient(config) {
     if (!Cls) {
         throw new LLMError(`Unknown LLM provider: ${config.provider}. Available: ${[...PROVIDER_REGISTRY.keys()].join(", ")}`);
     }
-    return new Cls(config);
+    return new Cls(config, defaults);
 }
 export { PROVIDER_REGISTRY };

package/dist/llm/model-pool.d.ts

@@ -30,12 +30,11 @@ export interface ModelEntry {
      *  come from the catalog unless the entry overrides them. */
     providerKey?: string;
     /**
-     * Per-model thinking override. Wins over the provider-level setting
-     * (ProviderCatalog entry's `thinking`). Useful when models in the same
-     * provider need different defaults — e.g. DeepSeek V4 Pro off but
-     * V4 Flash on.
+     * Per-model reasoning override. Wins over the provider-level setting
+     * (ProviderCatalog entry's `reasoning`). Useful when models in the same
+     * provider need different defaults — e.g. one model off but another on.
      */
-    thinking?: "enabled" | "disabled";
+    reasoning?: import("./reasoning-setting.js").ReasoningSetting;
 }
 export declare class ModelPool {
     private models;
@@ -83,13 +82,18 @@ export declare class ModelPool {
     /** Check if a key exists. */
     has(key: string): boolean;
     /**
-     * Build an LLMConfig for a given model entry, merging with a base config
-     * (inherits apiKey, baseUrl, etc. from the base if not set on the entry).
+     * Build an LLMConfig (pure model identity) for the given entry. Cross-model
+     * runtime knobs (temperature/timeout/retryMaxAttempts/imageDetail) are NOT
+     * part of LLMConfig — they live on the Engine as ClientDefaults and are
+     * threaded into the LLMClient independently. That separation lets hot-
+     * switching the model replace this object wholesale without touching the
+     * user's runtime preferences (and without leaking the old model's settings
+     * onto a model that doesn't share them — e.g. 384k-output deepseek bleeding
+     * into 128k-cap gpt-5.5).
      */
-    toLLMConfig(entry: ModelEntry, base?: Partial<LLMConfig>): LLMConfig;
+    toLLMConfig(entry: ModelEntry): LLMConfig;
     /**
-     * Build an LLMConfig for the active model (or a specific key),
-     * merging with a base config.
+     * Build an LLMConfig for the active model (or a specific key).
      */
-    resolveLLMConfig(key?: string, base?: Partial<LLMConfig>): LLMConfig | undefined;
+    resolveLLMConfig(key?: string): LLMConfig | undefined;
 }

package/dist/llm/model-pool.js

@@ -193,10 +193,16 @@ export class ModelPool {
         return this.models.has(key);
     }
     /**
-     * Build an LLMConfig for a given model entry, merging with a base config
-     * (inherits apiKey, baseUrl, etc. from the base if not set on the entry).
+     * Build an LLMConfig (pure model identity) for the given entry. Cross-model
+     * runtime knobs (temperature/timeout/retryMaxAttempts/imageDetail) are NOT
+     * part of LLMConfig — they live on the Engine as ClientDefaults and are
+     * threaded into the LLMClient independently. That separation lets hot-
+     * switching the model replace this object wholesale without touching the
+     * user's runtime preferences (and without leaking the old model's settings
+     * onto a model that doesn't share them — e.g. 384k-output deepseek bleeding
+     * into 128k-cap gpt-5.5).
      */
-    toLLMConfig(entry, base) {
+    toLLMConfig(entry) {
         const fromCat = entry.providerKey && this.providerCatalog
             ? this.providerCatalog.get(entry.providerKey)
             : undefined;
@@ -215,32 +221,29 @@ export class ModelPool {
                 kindToClientProvider(fromCat?.kind) ||
                 "openai",
             model: entry.model,
-            apiKey: entry.apiKey ?? fromCat?.apiKey ?? base?.apiKey,
-            baseUrl: entry.baseUrl ?? fromCat?.baseUrl ?? base?.baseUrl,
-            temperature: base?.temperature ?? 0.3,
-            maxTokens: entry.maxOutputTokens ?? base?.maxTokens ?? 8192,
-            enableStreaming: base?.enableStreaming ?? true,
-            // thinking precedence: model entry > provider catalog > base.
-            // Model-level wins so users can hold one default for "deepseek"
-            // and still override a single model (e.g. v4-pro off).
-            ...(entry.thinking || fromCat?.thinking || base?.thinking
-                ? { thinking: entry.thinking ?? fromCat?.thinking ?? base?.thinking }
+            apiKey: entry.apiKey ?? fromCat?.apiKey,
+            baseUrl: entry.baseUrl ?? fromCat?.baseUrl,
+            // No invented default: undefined lets each client apply its own fallback
+            // (OpenAI omits the token field entirely; Anthropic uses its own constant)
+            // instead of fabricating 8192, which silently truncates long outputs and
+            // masks the real per-model cap.
+            maxTokens: entry.maxOutputTokens,
+            // reasoning: entry overrides catalog. No base fallback — see class doc.
+            ...(entry.reasoning ?? fromCat?.reasoning
+                ? { reasoning: entry.reasoning ?? fromCat?.reasoning }
                 : {}),
             // Carry the catalog kind through so the capability layer can pick
-            // per-(kind, model) request-shape rules. Defaults below cover the
-            // unusual case where an entry has a provider but no providerKey
-            // (legacy / arena-injected models).
+            // per-(kind, model) request-shape rules.
             ...(fromCat?.kind ? { providerKind: fromCat.kind } : {}),
         };
     }
     /**
-     * Build an LLMConfig for the active model (or a specific key),
-     * merging with a base config.
+     * Build an LLMConfig for the active model (or a specific key).
      */
-    resolveLLMConfig(key, base) {
+    resolveLLMConfig(key) {
         const entry = this.get(key);
         if (!entry)
             return undefined;
-        return this.toLLMConfig(entry, base);
+        return this.toLLMConfig(entry);
     }
 }

package/dist/llm/provider-catalog.d.ts

@@ -13,8 +13,8 @@ export interface ProviderConfig {
     apiKey?: string;
     protocol?: "openai-compat" | "anthropic-style";
     modelsPath?: string;
-    /** Default DeepSeek V4 thinking-mode for this provider. See LLMConfig. */
-    thinking?: "enabled" | "disabled";
+    /** Default reasoning/thinking setting for this provider. See LLMConfig. */
+    reasoning?: import("./reasoning-setting.js").ReasoningSetting;
 }
 export declare class ProviderCatalog {
     private byKey;

package/dist/llm/providers/anthropic.d.ts

@@ -1,14 +1,44 @@
 /**
  * Anthropic Claude provider using @anthropic-ai/sdk.
  */
-import type { LLMConfig, LLMResponse } from "../../types.js";
+import type { ClientDefaults, LLMConfig, LLMResponse } from "../../types.js";
 import type { CreateMessageOptions } from "../types.js";
 import { LLMClientBase } from "../client-base.js";
 export declare class AnthropicClient extends LLMClientBase {
     private _client;
-    constructor(config: LLMConfig);
+    constructor(config: LLMConfig, defaults?: ClientDefaults);
     protected initClient(): void;
     private get client();
+    /**
+     * Resolve the capability descriptor for the current model. `providerKind`
+     * defaults to "anthropic" (this client only serves the Anthropic API).
+     * Memoized — the model doesn't change mid-client.
+     */
+    private _capability;
+    private get capability();
+    /**
+     * Translate the resolved ReasoningSetting into Anthropic's `thinking` field,
+     * honoring the model's reasoning shape (rules.ts):
+     *
+     *  - `anthropic-budget` (Claude 4.0–4.5): supports explicit
+     *    `thinking:{type:"enabled", budget_tokens≥minBudgetTokens}`.
+     *      · mode "budget" → use budgetTokens (clamped up to minBudgetTokens)
+     *      · mode "on"     → default budget (clamped up to minBudgetTokens)
+     *      · mode "effort" → this family is budget-typed, not effort-typed, so
+     *                        treat any effort selection as "on" with the default.
+     *      · mode "off" / unset → return undefined (omit the field).
+     *  - `anthropic-adaptive` (Claude 4.6+): thinking is automatic and NOT
+     *    controllable; sending `type:"enabled"` 400s. Always omit → undefined.
+     *  - anything else (Claude 3.x catch-all → kind "none"): omit → undefined.
+     *
+     * `maxTokens` is the request's max_tokens. Anthropic requires
+     * max_tokens > budget_tokens when thinking is enabled, so we cap the budget
+     * just below it (leaving headroom for the visible answer). The minBudgetTokens
+     * floor still wins — if even the floor doesn't fit under max_tokens the model
+     * itself rejects it, which surfaces as a clear API error rather than us
+     * silently sending a degenerate budget.
+     */
+    private buildThinking;
     createMessage(options: CreateMessageOptions): Promise<LLMResponse>;
     private nonStreamMessage;
     private streamMessage;

package/dist/llm/providers/anthropic.js

@@ -6,10 +6,24 @@ import { LLMClientBase } from "../client-base.js";
 import { ContextLimitError, LLMError, LLMRateLimitError } from "../../exceptions.js";
 import { logger } from "../../logging/logger.js";
 import { countTokens } from "../token-counter.js";
+import { capabilitiesFor } from "../capabilities/index.js";
+import { stripVisionFromHistory } from "../strip-vision.js";
+/**
+ * Anthropic's `max_tokens` is required, so unlike OpenAI we can't omit it when
+ * the model's ceiling is unknown. Use a conservative floor in that rare case
+ * (every catalog Anthropic model resolves a real value via resolveMaxOutput, so
+ * this only fires for an unconfigured/unknown model).
+ */
+const ANTHROPIC_FALLBACK_MAX_TOKENS = 4096;
+/**
+ * Default thinking budget when a budget-capable model wants "thinking on" but
+ * no explicit token budget was given. Clamped up to the model's minimum.
+ */
+const ANTHROPIC_DEFAULT_THINKING_BUDGET = 4096;
 export class AnthropicClient extends LLMClientBase {
     _client = null;
-    constructor(config) {
-        super(config);
+    constructor(config, defaults) {
+        super(config, defaults);
     }
     initClient() {
         // Lazy init
@@ -24,6 +38,68 @@ export class AnthropicClient extends LLMClientBase {
         }
         return this._client;
     }
+    /**
+     * Resolve the capability descriptor for the current model. `providerKind`
+     * defaults to "anthropic" (this client only serves the Anthropic API).
+     * Memoized — the model doesn't change mid-client.
+     */
+    _capability = null;
+    get capability() {
+        if (!this._capability) {
+            const kind = (this.config.providerKind ?? "anthropic");
+            this._capability = capabilitiesFor(kind, this.model);
+        }
+        return this._capability;
+    }
+    /**
+     * Translate the resolved ReasoningSetting into Anthropic's `thinking` field,
+     * honoring the model's reasoning shape (rules.ts):
+     *
+     *  - `anthropic-budget` (Claude 4.0–4.5): supports explicit
+     *    `thinking:{type:"enabled", budget_tokens≥minBudgetTokens}`.
+     *      · mode "budget" → use budgetTokens (clamped up to minBudgetTokens)
+     *      · mode "on"     → default budget (clamped up to minBudgetTokens)
+     *      · mode "effort" → this family is budget-typed, not effort-typed, so
+     *                        treat any effort selection as "on" with the default.
+     *      · mode "off" / unset → return undefined (omit the field).
+     *  - `anthropic-adaptive` (Claude 4.6+): thinking is automatic and NOT
+     *    controllable; sending `type:"enabled"` 400s. Always omit → undefined.
+     *  - anything else (Claude 3.x catch-all → kind "none"): omit → undefined.
+     *
+     * `maxTokens` is the request's max_tokens. Anthropic requires
+     * max_tokens > budget_tokens when thinking is enabled, so we cap the budget
+     * just below it (leaving headroom for the visible answer). The minBudgetTokens
+     * floor still wins — if even the floor doesn't fit under max_tokens the model
+     * itself rejects it, which surfaces as a clear API error rather than us
+     * silently sending a degenerate budget.
+     */
+    buildThinking(reasoning, maxTokens) {
+        const cap = this.capability;
+        if (cap.reasoning.kind !== "anthropic-budget") {
+            // anthropic-adaptive and none: never send a thinking field.
+            return undefined;
+        }
+        if (!reasoning || reasoning.mode === "off") {
+            return undefined;
+        }
+        const min = cap.reasoning.minBudgetTokens;
+        // Anthropic constraint: max_tokens must STRICTLY exceed budget_tokens, and
+        // budget_tokens must be ≥ the model's minimum. If max_tokens can't fit a
+        // min-sized thinking block plus at least `min` tokens of answer, there is
+        // no valid budget — omit thinking entirely rather than emit budget_tokens
+        // ≥ max_tokens (which the API rejects with a 400). This is reachable for
+        // small-maxTokens auxiliary calls (judge/planner) on budget models.
+        const ceiling = maxTokens - min;
+        if (ceiling < min) {
+            return undefined;
+        }
+        let budget = reasoning.mode === "budget"
+            ? reasoning.budgetTokens
+            : ANTHROPIC_DEFAULT_THINKING_BUDGET; // "on" or "effort" → default budget
+        // Clamp into [min, ceiling] — both bounds are now guaranteed ≥ min.
+        budget = Math.min(Math.max(budget, min), ceiling);
+        return { type: "enabled", budget_tokens: budget };
+    }
     async createMessage(options) {
         return this.withRetry(async () => {
             const messages = this.buildMessages(options.messages);
@@ -61,9 +137,14 @@ export class AnthropicClient extends LLMClientBase {
     }
     async nonStreamMessage(options, messages, tools) {
         try {
+            // Per-call reasoning wins; otherwise fall back to the provider/model
+            // default (settings → LLMConfig.reasoning). Mirrors openai.ts.
+            const reasoning = options.reasoning ?? this.config.reasoning;
+            const maxTokens = options.maxTokens ?? this.maxTokens ?? ANTHROPIC_FALLBACK_MAX_TOKENS;
+            const thinking = this.buildThinking(reasoning, maxTokens);
             const response = await this.client.messages.create({
                 model: this.model,
-                max_tokens: options.maxTokens ?? this.maxTokens,
+                max_tokens: maxTokens,
                 system: [
                     {
                         type: "text",
@@ -73,6 +154,7 @@ export class AnthropicClient extends LLMClientBase {
                 ],
                 messages,
                 ...(tools?.length ? { tools } : {}),
+                ...(thinking ? { thinking } : {}),
                 ...(options.temperature !== undefined
                     ? { temperature: options.temperature }
                     : { temperature: this.temperature }),
@@ -94,9 +176,12 @@ export class AnthropicClient extends LLMClientBase {
     }
     async streamMessage(options, messages, tools) {
         try {
+            const reasoning = options.reasoning ?? this.config.reasoning;
+            const maxTokens = options.maxTokens ?? this.maxTokens ?? ANTHROPIC_FALLBACK_MAX_TOKENS;
+            const thinking = this.buildThinking(reasoning, maxTokens);
             const stream = this.client.messages.stream({
                 model: this.model,
-                max_tokens: options.maxTokens ?? this.maxTokens,
+                max_tokens: maxTokens,
                 system: [
                     {
                         type: "text",
@@ -106,6 +191,7 @@ export class AnthropicClient extends LLMClientBase {
                 ],
                 messages,
                 ...(tools?.length ? { tools } : {}),
+                ...(thinking ? { thinking } : {}),
                 ...(options.temperature !== undefined
                     ? { temperature: options.temperature }
                     : { temperature: this.temperature }),
@@ -114,6 +200,25 @@ export class AnthropicClient extends LLMClientBase {
             let currentToolName = "";
             let currentToolId = "";
             let currentToolInput = "";
+            // Abort-guarded emit: once the turn is cancelled, stop forwarding chunks
+            // to the UI. The SDK's event emitter can keep firing buffered text/
+            // contentBlock/inputJson events after abort() until its HTTP stream tears
+            // down; without this guard those leak to the UI after the user hit Stop
+            // ("content comes back after interrupt"). We also eagerly abort the SDK
+            // stream below so teardown starts immediately rather than waiting on the
+            // passed-in request signal alone.
+            const emit = (chunk) => {
+                if (options.signal?.aborted)
+                    return;
+                options.onChunk?.(chunk);
+            };
+            if (options.signal) {
+                const sig = options.signal;
+                if (sig.aborted)
+                    stream.abort();
+                else
+                    sig.addEventListener("abort", () => stream.abort(), { once: true });
+            }
             // Time-to-first-byte: log exactly once per stream so streaming-latency
             // questions ("model felt slow tonight") get a clean number per request.
             const streamStartedAt = Date.now();
@@ -129,14 +234,14 @@ export class AnthropicClient extends LLMClientBase {
                     });
                 }
                 currentText += text;
-                options.onChunk?.({ type: "text", text, tokens: countTokens(text) });
+                emit({ type: "text", text, tokens: countTokens(text) });
             });
             stream.on("contentBlock", (block) => {
                 if (block.type === "tool_use") {
                     currentToolName = block.name;
                     currentToolId = block.id;
                     currentToolInput = "";
-                    options.onChunk?.({
+                    emit({
                         type: "tool_use_start",
                         toolCall: { id: block.id, toolName: block.name, args: {} },
                     });
@@ -145,7 +250,7 @@ export class AnthropicClient extends LLMClientBase {
             stream.on("inputJson", (_delta, snapshot) => {
                 currentToolInput = JSON.stringify(snapshot);
                 if (currentToolId) {
-                    options.onChunk?.({
+                    emit({
                         type: "tool_use_delta",
                         toolCall: {
                             id: currentToolId,
@@ -195,6 +300,7 @@ export class AnthropicClient extends LLMClientBase {
         };
     }
     buildMessages(messages) {
+        messages = stripVisionFromHistory(messages, this.capability.supportsVision);
         const result = [];
         for (const msg of messages) {
             if (msg.role === "system")
@@ -218,10 +324,37 @@ export class AnthropicClient extends LLMClientBase {
                         });
                     }
                     else if (block.type === "tool_result" && block.tool_use_id) {
+                        let content;
+                        if (typeof block.content === "string") {
+                            content = block.content;
+                        }
+                        else if (Array.isArray(block.content)) {
+                            const parts = [];
+                            for (const part of block.content) {
+                                if (part.type === "text" && part.text) {
+                                    parts.push({ type: "text", text: part.text });
+                                }
+                                else if (part.type === "image" && part.source) {
+                                    parts.push({
+                                        type: "image",
+                                        source: {
+                                            type: "base64",
+                                            media_type: part.source.media_type,
+                                            data: part.source.data,
+                                        },
+                                    });
+                                }
+                            }
+                            content = parts;
+                        }
+                        else {
+                            content = "";
+                        }
                         blocks.push({
                             type: "tool_result",
                             tool_use_id: block.tool_use_id,
-                            content: typeof block.content === "string" ? block.content : "",
+                            content,
+                            ...(block.is_error ? { is_error: true } : {}),
                         });
                     }
                     else if (block.type === "image" && block.source) {
@@ -250,6 +383,12 @@ export class AnthropicClient extends LLMClientBase {
         }));
     }
     handleApiError(err) {
+        // ESC / Stop path — see openai.ts handleApiError for the same logic.
+        // Rethrow the SDK's abort error unchanged so server.ts recognises
+        // cancellation; don't repackage it as a generic "Anthropic API error".
+        if (err instanceof Anthropic.APIUserAbortError) {
+            throw err;
+        }
         if (err instanceof Anthropic.APIError) {
             if (err.status === 429) {
                 throw new LLMRateLimitError("anthropic");