@gajae-code/ai 0.12.0 → 0.12.1

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 ## [Unreleased]
 
+## [0.12.1] - 2026-07-29
+
+### Fixed
+
+- Lazy-stream first-event timeouts now abort with `FirstEventTimeoutError` so `transportFailure.providerCode` is `stream_first_event_timeout` on the outer watchdog path shared by all bundled providers via `createLazyStream`. Idle stalls remain bare `Error`s (distinct class intentionally) (#3496).
+
+- Provider streams now surface first-event watchdog expiry as a typed timeout so callers can apply bounded retry policy without parsing error prose.
+- Codex websocket first-event timeouts now discard the timed-out connection before the outer retry/fallback layer handles the typed failure, preventing late frames from the abandoned request from being consumed by the replayed turn.
+- Codex named-tool requests now recognize provider `Tool choice '<name>' not found in 'tools' parameter` errors as runtime capability failures and retry once without forcing the choice.
+- The Kimi OAuth host (`KIMI_CODE_OAUTH_HOST` / `KIMI_OAUTH_HOST`) is now resolved from trusted environment sources only. That host receives the device-authorization request, the authorization-code exchange, and the refresh call that carries the existing refresh token, so reading it through the merged view that includes the caller's `cwd/.env` let a repository redirect the login flow and collect the user's Kimi credentials. Resolution now uses the non-project resolver; shell and user-level configuration is unchanged.
+- The documented `GJC_NO_STRICT` environment variable now takes effect. `adaptSchemaForStrict` read only the legacy `PI_NO_STRICT`, so an operator hitting a provider that rejects strict function schemas set the documented name and strict mode stayed on. Both names are honoured, canonical name first, and `GJC_NO_STRICT` is now listed in the environment-variable reference rather than only in the schema-normalisation note.
+- The documented `GJC_AUTH_NO_BORROW` environment variable now takes effect. Only the legacy `PI_AUTH_NO_BORROW` was read, so an operator who followed the documentation to disable macOS native-app token borrowing still had a JWT read out of the Perplexity desktop application during login. Both names are now honoured, and the contract stays presence-based as documented so that setting it to `0` cannot silently re-enable borrowing.
+- The Azure client's `AZURE_OPENAI_API_KEY` fallback is now resolved from trusted environment sources only. It read the merged view that includes the caller's `cwd/.env`, so a repository could supply the credential the client authenticates with; provider credential resolution is documented as excluding the project `.env`, and this fallback now matches. An explicit caller-supplied key still takes precedence, and shell / user-level configuration is unchanged.
+- Anthropic and Ollama tool calls cut off by an output-token limit are now marked incomplete before dispatch, so repaired partial JSON is rejected instead of executing with truncated arguments.
+- The Anthropic "thinking blocks in the latest assistant message cannot be modified" 400 now escalates its one-shot replay repair. The error names the latest assistant message but its cited `messages.N.content.M` path can point at an earlier replayed turn, so the latest-only repair was rejected identically and killed the turn; recovery now retries once more with thinking dropped from every replayed assistant message.
+- Anthropic adaptive-thinking `display` support is now decided by the canonical model-version parser instead of a provider-local `claude-opus-(\d+)-(\d+)` regex. The regex only matched two-component ids, so a single-component alias such as `claude-opus-5` was classified as pre-4.7 while its dated snapshot `claude-opus-5-20260101` was not: the alias sent `thinking: { type: "adaptive" }` without `display: "summarized"`, additionally requested the `interleaved-thinking-2025-05-14` beta, and had its returned thinking blocks recorded as raw rather than summarized. Both Anthropic and Bedrock providers now share `supportsAnthropicAdaptiveThinkingDisplay`, so alias and dated ids of the same model send an identical request shape.
+- Anthropic requests that force a tool choice no longer replay signed thinking blocks. Forcing `tool_choice` strips `thinking` from the request (the API rejects the combination), but the converted history still carried native `thinking`/`redacted_thinking` blocks from thinking-enabled turns, so eager tool-forcing turns (e.g. the todo bootstrap) sent a request whose history contradicted its own thinking setting and drew a 400. The replay now degrades in the same rebuild; the forced request trades its prompt-cache prefix for a shape the API accepts.
+
 ## [0.12.0] - 2026-07-28
 
 ### Added
@@ -26,6 +44,8 @@
 - The OpenAI and Azure endpoint decisions are now resolved from trusted environment sources only: `OPENAI_BASE_URL` (streaming responses, completions, and the model manager), `AZURE_OPENAI_BASE_URL`, and `AZURE_OPENAI_RESOURCE_NAME` (the alternate constructor for the same Azure host). `Bun.env` is `process.env` and the env module merges the caller's `cwd/.env` into it, so a repository could previously plant a `.env` that redirected authenticated requests; the two provider paths already reached for `$inheritedEnv` but re-admitted the project `.env` through a fallback. Resolution now goes through the non-project resolver (launching shell plus GJC/user-owned `.env` files); shell and user-level configuration is unchanged.
 - Google credential material is now resolved from trusted environment sources only: the `GOOGLE_APPLICATION_CREDENTIALS` service-account / authorized-user file path used by the ADC loader, and `GOOGLE_CLOUD_API_KEY` used as the Vertex API key. Both were read through the merged view that includes the caller's `cwd/.env`, so a repository could ship a key file and point the agent at it, making it authenticate to Google as an identity the repository chose. `stream.ts` already resolved the same ADC variable through the non-project resolver; the two now agree. An explicit caller-supplied API key still takes precedence.
 - The Grok usage token fallback (`GROK_CLI_OAUTH_TOKEN`) is now resolved from trusted environment sources only. It authenticates the billing/usage call, and reading it through the merged view that includes the caller's `cwd/.env` let a repository decide which account that call ran against. Stored credentials keep precedence, and shell / user-level configuration is unchanged.
+- The Vertex AI location (`GOOGLE_CLOUD_LOCATION`) can no longer redirect authenticated requests off Google. It is interpolated into the request host (`${location}-aiplatform.googleapis.com`), so a value containing `/` terminated the authority component and sent the Google access token to an arbitrary origin — and it was read through the merged view that includes the caller's `cwd/.env`. It now resolves from trusted sources only and must be a region label; `GOOGLE_CLOUD_PROJECT` / `GCLOUD_PROJECT` moved to the same trusted resolver.
+- HTTP 400 request dumps are now bounded. Every 400 wrote a file containing the full sanitized request body and nothing ever removed one, so the directory grew without limit — a developer machine reached 27,249 files totalling 7.0 GB, which was 96% of everything under `~/.gjc`. The newest 50 are retained, matching the bounded retention the rotating application log already uses, and pruning stays best-effort so diagnostics never turn a request failure into a second failure.
 - Anthropic `ping` keepalives no longer reset stream progress, so responses that stop producing content now reach the idle timeout instead of hanging indefinitely.
 - The Anthropic endpoint decision is now resolved from trusted environment sources only: `ANTHROPIC_BASE_URL`, `FOUNDRY_BASE_URL`, `ZCODE_PLAN_ANTHROPIC_BASE_URL`, and the `CLAUDE_CODE_USE_FOUNDRY` mode switch. `Bun.env` is `process.env` and the env module merges the caller's `cwd/.env` into it, so a repository could previously plant a `.env` that redirected authenticated Anthropic requests — the resolved base URL becomes `${baseUrl}/v1/messages` while the headers carry the API key or OAuth token. Resolution now goes through the non-project resolver (launching shell plus GJC/user-owned `.env` files); shell and user-level configuration is unchanged.
 - The documented `GJC_OPENAI_STREAM_IDLE_TIMEOUT_MS` environment variable now takes effect: the stream-watchdog idle-timeout helpers resolve it GJC-first before the legacy `PI_OPENAI_STREAM_IDLE_TIMEOUT_MS` / `PI_STREAM_IDLE_TIMEOUT_MS` aliases (previously only the `PI_`-prefixed names were read, so setting the documented GJC name was a silent no-op).

package/dist/types/model-thinking.d.ts

@@ -72,3 +72,18 @@ export declare function mapEffortToAnthropicAdaptiveEffort<TApi extends Api>(mod
  * - Thinking content is omitted by default (needs display: "summarized")
  */
 export declare function hasOpus47ApiRestrictions(modelId: string): boolean;
+/**
+ * Adaptive thinking `display` is supported starting with Anthropic Opus 4.7.
+ * Older adaptive-thinking models (Opus 4.6, Sonnet 4.6+) reject the field.
+ * Fable (5+) postdates Opus 4.7, accepts `display`, and defaults it to
+ * "omitted" — thinking tokens are billed but no content streams back — so it
+ * must opt in like Opus 4.7+ (issue #2791).
+ *
+ * Shares `hasOpus47ApiRestrictions` version parsing on purpose: the two
+ * predicates describe the same API generation, and a private `claude-opus-(\d+)-(\d+)`
+ * regex silently disagreed with it for single-component aliases (`claude-opus-5`
+ * matched nothing while `claude-opus-5-20260101` matched), so the same model sent
+ * a different thinking shape and beta set depending on which id string was used.
+ * Bedrock region/inference-profile prefixes are handled by the canonical parser.
+ */
+export declare function supportsAnthropicAdaptiveThinkingDisplay(modelId: string): boolean;

package/dist/types/providers/azure-openai-responses.d.ts

@@ -18,3 +18,5 @@ export declare function resolveAzureConfigForTest(model: Model<"azure-openai-res
     baseUrl: string;
     apiVersion: string;
 };
+/** Test seam: the client API key as resolved from a caller value plus trusted env. */
+export declare function resolveAzureClientApiKeyForTest(apiKey: string): string | undefined;

package/dist/types/providers/google-vertex.d.ts

@@ -7,3 +7,5 @@ export interface GoogleVertexOptions extends GoogleSharedStreamOptions {
 export declare const streamGoogleVertex: StreamFunction<"google-vertex">;
 /** Test seam: the Vertex API key as resolved from options plus trusted env. */
 export declare function resolveVertexApiKeyForTest(options?: GoogleVertexOptions): string | undefined;
+/** Test seam: the Vertex location as resolved from options plus trusted env. */
+export declare function resolveVertexLocationForTest(options?: GoogleVertexOptions): string;

package/dist/types/utils/fallback-transport.d.ts

@@ -3,6 +3,8 @@ export interface FallbackTrigger {
     class: FallbackTriggerClass;
     retryAfterMs?: number;
 }
+/** Stable code for streams that time out before producing semantic progress. */
+export declare const STREAM_FIRST_EVENT_TIMEOUT_PROVIDER_CODE = "stream_first_event_timeout";
 export type TransportHeaders = Headers | Record<string, string | undefined>;
 /**
  * Structured facts from an upstream HTTP or transport failure. Retry decisions

package/dist/types/utils/http-inspector.d.ts

@@ -17,6 +17,16 @@ export type CapturedHttpErrorResponse = {
 export declare function isModelUnavailableError(message: string, error: unknown): boolean;
 /** Actionable guidance for selecting an available model/provider. */
 export declare function formatModelUnavailableGuidance(dump: RawHttpRequestDump | undefined): string;
+/** Directory holding the retained HTTP 400 dumps. */
+export declare function httpRequestDumpDir(): string;
+/**
+ * Drop the oldest dumps beyond the cap. Best-effort: diagnostics must never turn
+ * a request failure into a second failure, so every step swallows its error.
+ *
+ * File names are `${Date.now()}-${hash}.json`, so a lexical sort is chronological
+ * for the millisecond timestamps this writer produces.
+ */
+export declare function pruneHttpRequestDumps(dir?: string): Promise<number>;
 export declare function appendRawHttpRequestDumpFor400(message: string, error: unknown, dump: RawHttpRequestDump | undefined): Promise<string>;
 /**
  * Name the failed connection when the request never produced an HTTP status.

package/dist/types/utils/idle-iterator.d.ts

@@ -30,6 +30,10 @@ export declare function getOpenAIStreamIdleTimeoutMs(): number | undefined;
  */
 export declare function getStreamFirstEventTimeoutMs(idleTimeoutMs?: number, fallbackMs?: number): number | undefined;
 export type Watchdog = NodeJS.Timeout | undefined;
+export declare class FirstEventTimeoutError extends Error {
+    readonly providerCode = "stream_first_event_timeout";
+    constructor(message: string);
+}
 /**
  * Starts a watchdog that aborts a request if no first stream event arrives in time.
  * Call `markFirstEventReceived()` as soon as the first event is observed.

package/dist/types/utils/oauth/kimi.d.ts

@@ -2,6 +2,8 @@
  * Kimi Code OAuth flow (device authorization grant)
  */
 import type { OAuthController, OAuthCredentials } from "./types";
+/** Test seam: the OAuth host as resolved from trusted env. */
+export declare function resolveKimiOAuthHostForTest(): string;
 export declare let getKimiCommonHeaders: () => Readonly<{
     "User-Agent": `KimiCLI/${string}`;
     "X-Msh-Platform": "kimi_cli";

package/dist/types/utils/oauth/perplexity.d.ts

@@ -1,9 +1,4 @@
 import type { OAuthController, OAuthCredentials } from "./types";
-/**
- * Login to Perplexity.
- *
- * Tries auto-extraction from the desktop app, then runs HTTP email OTP login.
- *
- * No browser/manual token paste fallback is used.
- */
+/** Test seam: the resolved native-app borrowing opt-out. */
+export declare function authBorrowDisabledForTest(): boolean;
 export declare function loginPerplexity(ctrl: OAuthController): Promise<OAuthCredentials>;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.12.0",
+	"version": "0.12.1",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -40,7 +40,7 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/utils": "0.12.0",
+		"@gajae-code/utils": "0.12.1",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/model-thinking.ts

@@ -350,6 +350,25 @@ export function hasOpus47ApiRestrictions(modelId: string): boolean {
 	return semverGte(parsed.version, "4.7") && parsed.kind === "opus";
 }
 
+/**
+ * Adaptive thinking `display` is supported starting with Anthropic Opus 4.7.
+ * Older adaptive-thinking models (Opus 4.6, Sonnet 4.6+) reject the field.
+ * Fable (5+) postdates Opus 4.7, accepts `display`, and defaults it to
+ * "omitted" — thinking tokens are billed but no content streams back — so it
+ * must opt in like Opus 4.7+ (issue #2791).
+ *
+ * Shares `hasOpus47ApiRestrictions` version parsing on purpose: the two
+ * predicates describe the same API generation, and a private `claude-opus-(\d+)-(\d+)`
+ * regex silently disagreed with it for single-component aliases (`claude-opus-5`
+ * matched nothing while `claude-opus-5-20260101` matched), so the same model sent
+ * a different thinking shape and beta set depending on which id string was used.
+ * Bedrock region/inference-profile prefixes are handled by the canonical parser.
+ */
+export function supportsAnthropicAdaptiveThinkingDisplay(modelId: string): boolean {
+	if (/claude-fable-\d/.test(modelId)) return true;
+	return hasOpus47ApiRestrictions(modelId);
+}
+
 function anthropicModelHasRealXHighEffort<TApi extends Api>(model: ApiModel<TApi>): boolean {
 	if (model.api !== "anthropic-messages") return false;
 	const parsedModel = parseKnownModel(model.id);

package/src/providers/amazon-bedrock.ts

@@ -9,7 +9,11 @@
 
 import { $credentialEnv, $env, $flag, extractHttpStatusFromError, fetchWithRetry } from "@gajae-code/utils";
 import type { Effort } from "../model-thinking";
-import { mapEffortToAnthropicAdaptiveEffort, requireSupportedEffort } from "../model-thinking";
+import {
+	mapEffortToAnthropicAdaptiveEffort,
+	requireSupportedEffort,
+	supportsAnthropicAdaptiveThinkingDisplay as supportsAdaptiveThinkingDisplay,
+} from "../model-thinking";
 import { calculateCost } from "../models";
 import type {
 	Api,
@@ -907,25 +911,6 @@ function buildAdditionalModelRequestFields(
 	return result;
 }
 
-/**
- * Adaptive thinking `display` is supported starting with Anthropic model Opus 4.7.
- * Older adaptive-thinking models (Opus 4.6, Sonnet 4.6+) reject the field.
- * Fable (5+) postdates Opus 4.7, accepts `display`, and defaults it to
- * "omitted" — thinking tokens are billed but no content streams back — so it
- * must opt in like Opus 4.7+ (issue #2791).
- * Bedrock model ids are prefixed with region/inference-profile slugs (e.g.
- * `eu.anthropic.Anthropic model-opus-4-7-...`); the regex matches the `Anthropic model-opus-X-Y`
- * fragment regardless of prefix.
- */
-function supportsAdaptiveThinkingDisplay(modelId: string): boolean {
-	if (/claude-fable-\d/.test(modelId)) return true;
-	const match = /claude-opus-(\d+)-(\d+)/.exec(modelId);
-	if (!match) return false;
-	const major = Number(match[1]);
-	const minor = Number(match[2]);
-	return major > 4 || (major === 4 && minor >= 7);
-}
-
 /**
  * Bedrock's wire format expects the image as `{ source: { bytes: <base64-string> }, format }`.
  * The caller already passes base64-encoded data, so no decode/re-encode round-trip is needed.

package/src/providers/anthropic.ts

@@ -20,7 +20,11 @@ import {
 	logger,
 	readSseEvents,
 } from "@gajae-code/utils";
-import { hasOpus47ApiRestrictions, mapEffortToAnthropicAdaptiveEffort } from "../model-thinking";
+import {
+	hasOpus47ApiRestrictions,
+	mapEffortToAnthropicAdaptiveEffort,
+	supportsAnthropicAdaptiveThinkingDisplay as supportsAdaptiveThinkingDisplay,
+} from "../model-thinking";
 import { calculateCost } from "../models";
 import { isUsageLimitError } from "../rate-limit-utils";
 import { getEnvApiKey, OUTPUT_FALLBACK_BUFFER } from "../stream";
@@ -62,12 +66,13 @@ import { transportFailureFacts } from "../utils/fallback-transport";
 import { isFoundryEnabled } from "../utils/foundry";
 import { finalizeErrorMessage, type RawHttpRequestDump, rewriteCopilotError } from "../utils/http-inspector";
 import {
+	FirstEventTimeoutError,
 	getProviderFirstEventTimeoutFallbackMs,
 	getStreamFirstEventTimeoutMs,
 	getStreamIdleTimeoutMs,
 	iterateWithIdleTimeout,
 } from "../utils/idle-iterator";
-import { parseJsonWithRepair, parseStreamingJson } from "../utils/json-parse";
+import { isCompleteJson, parseJsonWithRepair, parseStreamingJson } from "../utils/json-parse";
 import { parseGitHubCopilotApiKey } from "../utils/oauth/github-copilot";
 import { notifyProviderResponse } from "../utils/provider-response";
 import { isCopilotTransientModelError } from "../utils/retry";
@@ -309,22 +314,6 @@ type AnthropicSamplingParams = MessageCreateParamsStreaming & {
 const ANTHROPIC_STOP_SEQUENCES_MAX = 4;
 let warnedStopSequencesTrim = false;
 
-/**
- * Adaptive thinking `display` is supported starting with Anthropic model Opus 4.7.
- * Older adaptive-thinking models (Opus 4.6, Sonnet 4.6+) reject the field.
- * Fable (5+) postdates Opus 4.7, accepts `display`, and defaults it to
- * "omitted" — thinking tokens are billed but no content streams back — so it
- * must opt in like Opus 4.7+ (issue #2791).
- */
-function supportsAdaptiveThinkingDisplay(modelId: string): boolean {
-	if (/claude-fable-\d/.test(modelId)) return true;
-	const match = /claude-opus-(\d+)-(\d+)/.exec(modelId);
-	if (!match) return false;
-	const major = Number(match[1]);
-	const minor = Number(match[2]);
-	return major > 4 || (major === 4 && minor >= 7);
-}
-
 const ANTHROPIC_PROVIDER_SESSION_STATE_KEY = "anthropic-messages";
 
 type AnthropicProviderSessionState = ProviderSessionState & {
@@ -1422,6 +1411,8 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 			) & { index: number };
 			const blocks = output.content as Block[];
 			const blocksByAnthropicIndex = new Map<number, Block>();
+			const truncatedToolCalls = new Set<ToolCall>();
+			let sawTerminalStopReason = false;
 			// Derive from the ACTUAL request shape, not the option default: the request
 			// only sends `display: "summarized"` on specific paths (adaptive display is
 			// omitted for models where supportsAdaptiveThinkingDisplay is false). Defaulting
@@ -1439,8 +1430,14 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 				// finalize the orphaned block so no internal stream fields leak into output.
 				const orphaned = blocksByAnthropicIndex.get(anthropicIndex);
 				if (orphaned) {
-					if (orphaned.type === "toolCall" && orphaned.partialJson.trim()) {
-						orphaned.arguments = parseStreamingJson(orphaned.partialJson);
+					if (orphaned.type === "toolCall") {
+						if (!isCompleteJson(orphaned.partialJson)) {
+							orphaned.incompleteArguments = true;
+							truncatedToolCalls.add(orphaned);
+						}
+						if (orphaned.partialJson.trim()) {
+							orphaned.arguments = parseStreamingJson(orphaned.partialJson);
+						}
 					}
 					delete (orphaned as { index?: number }).index;
 					delete (orphaned as { partialJson?: string }).partialJson;
@@ -1457,6 +1454,8 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 				output.usage = createEmptyUsage(copilotDynamicHeaders?.premiumRequests);
 				output.stopReason = "stop";
 				firstTokenTime = undefined;
+				truncatedToolCalls.clear();
+				sawTerminalStopReason = false;
 			};
 			const idleTimeoutMs = options?.streamIdleTimeoutMs ?? getStreamIdleTimeoutMs();
 			const firstEventFallbackMs = getProviderFirstEventTimeoutFallbackMs(model.provider);
@@ -1467,12 +1466,13 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 			// Provider-level transport/rate-limit failures: only before any streamed content starts.
 			// Malformed envelopes/JSON: only before replay-unsafe text/tool events are visible on this stream.
 			let providerRetryAttempt = 0;
-			let thinkingRepairAttempted = false;
 			while (true) {
 				// Retries reset output.content; drop stale block correlations from the aborted attempt.
 				blocksByAnthropicIndex.clear();
+				truncatedToolCalls.clear();
+				sawTerminalStopReason = false;
 				activeAbortTracker = createAbortSourceTracker(options?.signal);
-				const firstEventTimeoutAbortError = new Error(
+				const firstEventTimeoutAbortError = new FirstEventTimeoutError(
 					"Anthropic stream timed out while waiting for the first event",
 				);
 				const idleTimeoutAbortError = new Error("Anthropic stream stalled while waiting for the next event");
@@ -1495,6 +1495,7 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 					let sawEvent = false;
 					let sawMessageStart = false;
 					let sawTerminalEnvelope = false;
+					let sawMessageStop = false;
 					const isProgressEvent = createAnthropicStreamProgressPredicate();
 
 					for await (const event of iterateWithIdleTimeout(anthropicStream, {
@@ -1508,9 +1509,13 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 						isProgressItem: isProgressEvent,
 					})) {
 						sawEvent = true;
+						if (sawMessageStop) {
+							throw createAnthropicStreamEnvelopeError("received event after message_stop");
+						}
 						if (sawProviderSafetyStop) {
 							if (event.type === "message_stop") {
 								sawTerminalEnvelope = true;
+								sawMessageStop = true;
 							}
 							continue;
 						}
@@ -1698,6 +1703,7 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 										partial: output,
 									});
 								} else if (block.type === "toolCall") {
+									if (!isCompleteJson(block.partialJson)) truncatedToolCalls.add(block);
 									if (block.partialJson.trim()) {
 										block.arguments = parseStreamingJson(block.partialJson);
 									}
@@ -1718,6 +1724,7 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 							if (rawStopReason) {
 								output.stopReason = isProviderSafetyStop ? "error" : mapStopReason(rawStopReason);
 								sawTerminalEnvelope = true;
+								sawTerminalStopReason = true;
 							}
 							if (isProviderSafetyStop) {
 								sawProviderSafetyStop = true;
@@ -1759,6 +1766,7 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 							calculateCost(model, output.usage);
 						} else if (event.type === "message_stop") {
 							sawTerminalEnvelope = true;
+							sawMessageStop = true;
 						}
 					}
 
@@ -1781,8 +1789,9 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 					}
 					break;
 				} catch (streamError) {
-					const streamFailure = activeAbortTracker.getLocalAbortReason() ?? streamError;
-					if (sawProviderSafetyStop) {
+					const localAbortReason = activeAbortTracker.getLocalAbortReason();
+					const streamFailure = localAbortReason ?? streamError;
+					if (localAbortReason || sawProviderSafetyStop) {
 						throw streamFailure;
 					}
 					if (
@@ -1834,21 +1843,22 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 					const thinkingSignatureInvalid = isAnthropicThinkingSignatureInvalidError(streamFailure);
 					if (
 						!options?.fallbackManaged &&
-						!thinkingRepairAttempted &&
+						!repairAllAssistantThinking &&
 						firstTokenTime === undefined &&
 						(thinkingSignatureInvalid || isAnthropicThinkingBlockMutationError(streamFailure))
 					) {
+						// The mutation 400 blames the "latest assistant message", but its cited
+						// `messages.N.content.M` path can point at an EARLIER replayed turn, so the
+						// latest-only repair gets rejected identically. Escalate to the full-history
+						// repair instead of burning the single retry on one scope.
+						const escalateToAll: boolean = thinkingSignatureInvalid || repairLatestAssistantThinking;
 						logger.debug("anthropic: repairing assistant thinking replay after provider rejection", {
 							model: model.id,
-							scope: thinkingSignatureInvalid ? "all" : "latest",
+							scope: escalateToAll ? "all" : "latest",
 							error: streamFailure instanceof Error ? streamFailure.message : String(streamFailure),
 						});
-						thinkingRepairAttempted = true;
-						if (thinkingSignatureInvalid) {
-							repairAllAssistantThinking = true;
-						} else {
-							repairLatestAssistantThinking = true;
-						}
+						repairLatestAssistantThinking = !escalateToAll;
+						repairAllAssistantThinking = escalateToAll;
 						params = await prepareParams();
 						providerRetryAttempt = 0;
 						resetOutputForRetry();
@@ -1897,6 +1907,24 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 				}
 			}
 
+			for (const block of blocksByAnthropicIndex.values()) {
+				delete (block as { index?: number }).index;
+				if (block.type === "toolCall") {
+					truncatedToolCalls.add(block);
+					if (block.partialJson.trim()) {
+						block.arguments = parseStreamingJson(block.partialJson);
+					}
+					delete (block as { partialJson?: string }).partialJson;
+				}
+			}
+			blocksByAnthropicIndex.clear();
+			if (output.stopReason === "length" || !sawTerminalStopReason) {
+				for (const block of output.content) {
+					if (block.type === "toolCall" && truncatedToolCalls.has(block)) {
+						block.incompleteArguments = true;
+					}
+				}
+			}
 			output.duration = Date.now() - startTime;
 			if (firstTokenTime) output.ttft = firstTokenTime - startTime;
 			if (dropFastMode && resolveServiceTier(options?.serviceTier, model.provider) === "priority") {
@@ -1909,13 +1937,12 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 				delete (block as { index?: number }).index;
 				delete (block as { partialJson?: string }).partialJson;
 			}
-			const firstEventTimeoutError = activeAbortTracker.getLocalAbortReason();
+			const localAbortReason = activeAbortTracker.getLocalAbortReason();
 			output.stopReason = activeAbortTracker.wasCallerAbort() ? "aborted" : "error";
-			output.errorStatus = extractHttpStatusFromError(error);
-			output.transportFailure = transportFailureFacts(error);
+			output.errorStatus = extractHttpStatusFromError(localAbortReason ?? error);
+			output.transportFailure = transportFailureFacts(localAbortReason ?? error);
 			if (output.errorKind !== "provider_safety_stop" || !output.errorMessage) {
-				output.errorMessage =
-					firstEventTimeoutError?.message ?? (await finalizeErrorMessage(error, rawRequestDump));
+				output.errorMessage = localAbortReason?.message ?? (await finalizeErrorMessage(error, rawRequestDump));
 			}
 			output.errorMessage = rewriteCopilotError(output.errorMessage, error, model.provider);
 			output.duration = Date.now() - startTime;
@@ -2100,13 +2127,26 @@ function createClient(
 	return { client, isOAuthToken: oauthToken };
 }
 
-function disableThinkingIfToolChoiceForced(params: MessageCreateParamsStreaming): void {
+/**
+ * Anthropic rejects extended thinking combined with a forced tool choice, so such a
+ * request drops `thinking`/`output_config`. Reports whether the forced-choice branch
+ * applied so the caller can keep the replayed history consistent with it.
+ */
+function disableThinkingIfToolChoiceForced(params: MessageCreateParamsStreaming): boolean {
 	const toolChoice = params.tool_choice;
-	if (!toolChoice) return;
-	if (toolChoice.type === "any" || toolChoice.type === "tool") {
-		delete params.thinking;
-		delete params.output_config;
-	}
+	if (!toolChoice) return false;
+	if (toolChoice.type !== "any" && toolChoice.type !== "tool") return false;
+	delete params.thinking;
+	delete params.output_config;
+	return true;
+}
+
+function hasNativeThinkingBlocks(messages: MessageParam[]): boolean {
+	return messages.some(
+		message =>
+			Array.isArray(message.content) &&
+			message.content.some(block => block.type === "thinking" || block.type === "redacted_thinking"),
+	);
 }
 
 function mapAnthropicToolChoice(
@@ -2430,6 +2470,18 @@ function buildParams(
 		}
 	}
 
+	// A forced tool choice strips `thinking` from the request. Signed thinking blocks
+	// replayed from history belong to a thinking-enabled request, and Anthropic rejects
+	// that pair with `thinking`/`redacted_thinking` blocks "cannot be modified", so the
+	// replay has to degrade in the same rebuild. Runs before the billing/system payload
+	// snapshot so the attribution hash covers the messages actually sent.
+	if (disableThinkingIfToolChoiceForced(params) && hasNativeThinkingBlocks(params.messages)) {
+		params.messages = convertAnthropicMessages(context.messages, model, isOAuthToken, {
+			...thinkingRepair,
+			repairAllAssistantThinking: true,
+		});
+	}
+
 	const shouldInjectClaudeCodeInstruction = isOAuthToken && !model.id.startsWith("claude-3-5-haiku");
 	const billingSystemPrompts = normalizeSystemPrompts(context.systemPrompt);
 	const billingPayload = shouldInjectClaudeCodeInstruction
@@ -2445,7 +2497,6 @@ function buildParams(
 	if (systemBlocks) {
 		params.system = systemBlocks;
 	}
-	disableThinkingIfToolChoiceForced(params);
 	ensureMaxTokensForThinking(params, model);
 	applyPromptCaching(params as AnthropicCacheParams, cacheMode, cacheControl);
 	enforceCacheControlLimit(params, 4);

package/src/providers/azure-openai-responses.ts

@@ -22,7 +22,6 @@ import { AssistantMessageEventStream } from "../utils/event-stream";
 import { transportFailureFacts } from "../utils/fallback-transport";
 import { finalizeErrorMessage, type RawHttpRequestDump } from "../utils/http-inspector";
 import {
-	createWatchdog,
 	getOpenAIStreamIdleTimeoutMs,
 	getStreamFirstEventTimeoutMs,
 	iterateWithIdleTimeout,
@@ -118,7 +117,6 @@ export const streamAzureOpenAIResponses: StreamFunction<"azure-openai-responses"
 		);
 		let rawRequestDump: RawHttpRequestDump | undefined;
 		const abortTracker = createAbortSourceTracker(options?.signal);
-		const firstEventTimeoutAbortError = new Error(AZURE_OPENAI_RESPONSES_FIRST_EVENT_TIMEOUT_MESSAGE);
 		const { requestAbortController, requestSignal } = abortTracker;
 
 		try {
@@ -127,7 +125,7 @@ export const streamAzureOpenAIResponses: StreamFunction<"azure-openai-responses"
 			const client = createClient(model, apiKey, options);
 			const { baseUrl } = resolveAzureConfig(model, options);
 			const params = buildParams(model, context, options, deploymentName, baseUrl);
-			const idleTimeoutMs = getOpenAIStreamIdleTimeoutMs();
+			const idleTimeoutMs = options?.streamIdleTimeoutMs ?? getOpenAIStreamIdleTimeoutMs();
 			options?.onPayload?.(params);
 			rawRequestDump = {
 				provider: model.provider,
@@ -164,18 +162,17 @@ export const streamAzureOpenAIResponses: StreamFunction<"azure-openai-responses"
 				rawRequestDump = { ...rawRequestDump, body: params };
 				openaiStream = await client.responses.create(params, { signal: requestSignal });
 			}
-			const firstEventWatchdog = createWatchdog(
-				options?.streamFirstEventTimeoutMs ?? getStreamFirstEventTimeoutMs(idleTimeoutMs),
-				() => abortTracker.abortLocally(firstEventTimeoutAbortError),
-			);
+			const firstEventTimeoutMs = options?.streamFirstEventTimeoutMs ?? getStreamFirstEventTimeoutMs(idleTimeoutMs);
 			stream.push({ type: "start", partial: output });
 
 			await processResponsesStream(
 				iterateWithIdleTimeout(openaiStream, {
-					watchdog: firstEventWatchdog,
+					firstItemTimeoutMs: firstEventTimeoutMs,
+					firstItemErrorMessage: AZURE_OPENAI_RESPONSES_FIRST_EVENT_TIMEOUT_MESSAGE,
 					idleTimeoutMs,
 					errorMessage: "Azure OpenAI responses stream stalled while waiting for the next event",
 					onIdle: () => requestAbortController.abort(),
+					onFirstItemTimeout: () => requestAbortController.abort(),
 				}),
 				output,
 				stream,
@@ -272,16 +269,31 @@ export function resolveAzureConfigForTest(
 	return resolveAzureConfig(model, options);
 }
 
+/**
+ * Azure API key for the client, from trusted environment sources only.
+ *
+ * `$env` merges the caller's `cwd/.env`, so reading the key there would let
+ * repository content supply the credential this client authenticates with.
+ * Provider credentials are resolved from the launching shell plus GJC/user-owned
+ * `.env` files, never the project `.env` — this fallback now matches that rule.
+ */
+function resolveAzureClientApiKey(apiKey: string): string | undefined {
+	if (apiKey) return apiKey;
+	return $credentialEnv("AZURE_OPENAI_API_KEY");
+}
+
+/** Test seam: the client API key as resolved from a caller value plus trusted env. */
+export function resolveAzureClientApiKeyForTest(apiKey: string): string | undefined {
+	return resolveAzureClientApiKey(apiKey);
+}
 function createClient(model: Model<"azure-openai-responses">, apiKey: string, options?: AzureOpenAIResponsesOptions) {
-	if (!apiKey) {
-		const envKey = $env.AZURE_OPENAI_API_KEY;
-		if (!envKey) {
-			throw new Error(
-				"Azure OpenAI API key is required. Set AZURE_OPENAI_API_KEY environment variable or pass it as an argument.",
-			);
-		}
-		apiKey = envKey;
+	const resolvedApiKey = resolveAzureClientApiKey(apiKey);
+	if (!resolvedApiKey) {
+		throw new Error(
+			"Azure OpenAI API key is required. Set AZURE_OPENAI_API_KEY environment variable or pass it as an argument.",
+		);
 	}
+	apiKey = resolvedApiKey;
 
 	const headers = { ...(model.headers ?? {}) };