@gajae-code/ai 0.13.3 → 0.14.0

package/src/providers/anthropic.ts

@@ -104,7 +104,7 @@ import {
 	hasCopilotVisionInput,
 	resolveGitHubCopilotBaseUrl,
 } from "./github-copilot-headers";
-import { transformMessages } from "./transform-messages";
+import { hasAdjacentPrivateThinkingBlocks, transformMessages } from "./transform-messages";
 import { NON_VISION_IMAGE_PLACEHOLDER } from "./vision-guard";
 
 export type AnthropicHeaderOptions = {
@@ -341,7 +341,18 @@ type AnthropicThinkingReplayRepairScope = "none" | "latest" | "all";
  * the session rather than a single stream, and only a completed stream re-arms
  * it — an unacceptable shape never completes, so it can never buy more repairs.
  */
-const ANTHROPIC_MAX_THINKING_REPAIRS = 2;
+const ANTHROPIC_MAX_THINKING_REPAIRS = 1;
+
+type AnthropicPayloadFingerprint = {
+	sha256: string;
+	bytes: number;
+};
+
+type AnthropicThinkingRepairCandidate = {
+	scope: Exclude<AnthropicThinkingReplayRepairScope, "none">;
+	params: MessageCreateParamsStreaming;
+	fingerprint: AnthropicPayloadFingerprint;
+};
 
 type AnthropicProviderSessionState = ProviderSessionState & {
 	strictToolsDisabled: boolean;
@@ -349,6 +360,25 @@ type AnthropicProviderSessionState = ProviderSessionState & {
 	generatedCacheBudget: GeneratedCacheBudget;
 	thinkingReplayRepairScope: AnthropicThinkingReplayRepairScope;
 	thinkingReplayRepairAttempts: number;
+	thinkingReplayRejectedPayload?: AnthropicPayloadFingerprint;
+	/**
+	 * Managed-mode escalation for the CPA alias-restore failure (issue #4338):
+	 * corrective steering recorded against one exact turn, applied by the next
+	 * managed attempt that rebuilds the same turn and released on success.
+	 */
+	cpaToolAliasSteering?: AnthropicCpaToolAliasSteering;
+};
+
+type AnthropicCpaToolAliasSteering = {
+	/** Corrective steering text appended to the next build of the same turn. */
+	message: string;
+	/**
+	 * Fingerprint of the last user message when the failure was recorded. The
+	 * steering only applies to a rebuild of the same logical turn; a later turn
+	 * with a different prompt expires it instead of replaying a stale
+	 * correction.
+	 */
+	turnFingerprint: string;
 };
 
 function createAnthropicProviderSessionState(): AnthropicProviderSessionState {
@@ -364,6 +394,8 @@ function createAnthropicProviderSessionState(): AnthropicProviderSessionState {
 			state.generatedCacheBudget = 2;
 			state.thinkingReplayRepairScope = "none";
 			state.thinkingReplayRepairAttempts = 0;
+			state.thinkingReplayRejectedPayload = undefined;
+			state.cpaToolAliasSteering = undefined;
 		},
 	};
 	return state;
@@ -492,6 +524,74 @@ export function isAnthropicMaskedProxyRejection(error: unknown): boolean {
 	return /"type"\s*:\s*"api_error"/.test(message) && /an error occurred while processing/i.test(message);
 }
 
+function fingerprintAnthropicPayload(params: MessageCreateParamsStreaming): AnthropicPayloadFingerprint {
+	const body = JSON.stringify({ ...params, stream: true });
+	return {
+		sha256: nodeCrypto.createHash("sha256").update(body).digest("hex"),
+		bytes: Buffer.byteLength(body),
+	};
+}
+
+function anthropicPayloadChanged(left: AnthropicPayloadFingerprint, right: AnthropicPayloadFingerprint): boolean {
+	return left.bytes !== right.bytes || left.sha256 !== right.sha256;
+}
+
+function extractAnthropicCitedContentPath(error: unknown): { messageIndex: number; contentIndex: number } | undefined {
+	const message = error instanceof Error ? error.message : String(error);
+	const match = /messages\.(\d+)\.content\.(\d+)/i.exec(message);
+	if (!match) return undefined;
+	return { messageIndex: Number(match[1]), contentIndex: Number(match[2]) };
+}
+
+function countNativeThinkingBlocks(content: unknown): number {
+	if (!Array.isArray(content)) return 0;
+	return content.filter(block => {
+		if (!isRecord(block)) return false;
+		return block.type === "thinking" || block.type === "redacted_thinking";
+	}).length;
+}
+
+function describeAnthropicOutgoingPath(error: unknown, params: MessageCreateParamsStreaming): string {
+	const cited = extractAnthropicCitedContentPath(error);
+	const messages = params.messages;
+	let latestAssistantIndex = -1;
+	for (let index = messages.length - 1; index >= 0; index--) {
+		if (messages[index]?.role === "assistant") {
+			latestAssistantIndex = index;
+			break;
+		}
+	}
+	const latest = latestAssistantIndex >= 0 ? messages[latestAssistantIndex] : undefined;
+	const latestThinking = countNativeThinkingBlocks(latest?.content);
+	const latestDescription =
+		latest === undefined
+			? "GJC's outgoing request has no assistant message"
+			: `GJC's latest outgoing assistant message is messages[${latestAssistantIndex}] with ${latestThinking} native thinking block(s)`;
+	if (!cited) return `${latestDescription}; the rejection did not contain a messages.N.content.M path`;
+	const outgoing = messages[cited.messageIndex];
+	if (!outgoing) {
+		return `Anthropic cited messages.${cited.messageIndex}.content.${cited.contentIndex}, but GJC's outgoing request has only ${messages.length} messages; ${latestDescription}`;
+	}
+	const contentBlocks = Array.isArray(outgoing.content) ? outgoing.content.length : 1;
+	return `Anthropic cited messages.${cited.messageIndex}.content.${cited.contentIndex}, but GJC's outgoing messages[${cited.messageIndex}] has role=${outgoing.role} and ${contentBlocks} content block(s); ${latestDescription}`;
+}
+
+function createAnthropicThinkingRepairNoopError(
+	error: unknown,
+	params: MessageCreateParamsStreaming,
+	fingerprint: AnthropicPayloadFingerprint,
+	capturedDiagnostic?: string,
+): Error {
+	const diagnostic = describeAnthropicOutgoingPath(error, params);
+	const terminal = new Error(
+		`Anthropic thinking-replay repair was not sent because both latest-assistant and all-assistant transforms produced the same ${fingerprint.bytes}-byte payload (sha256=${fingerprint.sha256}). ${diagnostic}. GJC did not resend the rejected body and did not change thinking mode.${capturedDiagnostic ? `\n${capturedDiagnostic}` : ""}`,
+	);
+	const status = extractHttpStatusFromError(error);
+	if (status !== undefined) (terminal as Error & { status?: number }).status = status;
+	(terminal as Error & { anthropicHttp400AlreadyCaptured?: boolean }).anthropicHttp400AlreadyCaptured = true;
+	return terminal;
+}
+
 /**
  * Anthropic rejects a request carrying more than four `cache_control`
  * breakpoints. An Anthropic-compatible gateway may attach its own block-level
@@ -514,6 +614,132 @@ export function isAnthropicCacheBreakpointOverflowError(error: unknown): boolean
 	return /maximum of \d+ blocks/i.test(message) || /at most \d+ blocks/i.test(message);
 }
 
+export type AnthropicContextManagementInjectionDiagnostic = {
+	strategy: string;
+	message: string;
+	captureNote: string;
+};
+
+const CLEAR_THINKING_STRATEGY_PATTERN = /\b(clear_thinking_[a-z0-9_-]{1,64})\b/i;
+
+function formatAnthropicDiagnosticBaseUrl(requestUrl: unknown): string {
+	if (typeof requestUrl !== "string") return "the configured Anthropic base URL";
+	try {
+		const url = new URL(requestUrl);
+		const basePath = url.pathname.replace(/\/v1\/messages\/?$/, "");
+		return `${url.origin}${basePath}`;
+	} catch {
+		return "the configured Anthropic base URL";
+	}
+}
+
+/**
+ * Diagnose a context-management strategy named by an Anthropic 400 but absent
+ * from the body GJC sent. This mismatch is evidence of intermediary mutation,
+ * not permission to silently enable thinking or retry the request.
+ */
+export function diagnoseAnthropicContextManagementInjection(
+	error: unknown,
+	dump: RawHttpRequestDump | undefined,
+): AnthropicContextManagementInjectionDiagnostic | undefined {
+	if (extractHttpStatusFromError(error) !== 400) return undefined;
+	if (dump?.api !== "anthropic-messages" || !isRecord(dump.body)) return undefined;
+	if (isAnthropicApiBaseUrl(dump.url)) return undefined;
+	if (Object.hasOwn(dump.body, "thinking") || Object.hasOwn(dump.body, "context_management")) return undefined;
+
+	const errorMessage = error instanceof Error ? error.message : String(error);
+	if (!/invalid_request_error/i.test(errorMessage)) return undefined;
+	const strategy = CLEAR_THINKING_STRATEGY_PATTERN.exec(errorMessage)?.[1];
+	if (!strategy) return undefined;
+	if (!/\bstrategy\b/i.test(errorMessage) || !/\bthinking\b/i.test(errorMessage)) return undefined;
+
+	const baseUrl = formatAnthropicDiagnosticBaseUrl(dump.url);
+	return {
+		strategy,
+		message: [
+			`GJC did not send \`thinking\` or \`context_management\`, but the Anthropic 400 names the \`${strategy}\` context-management strategy.`,
+			`An intermediary at ${baseUrl} likely injected that strategy into the outgoing request.`,
+			"Enable thinking explicitly for this model, or fix/replace the intermediary so it does not add clear-thinking edits to requests without thinking. GJC did not auto-enable thinking or retry because that would change request cost and semantics.",
+		].join("\n"),
+		captureNote: `The HTTP 400 references context-management strategy ${strategy}, but this captured outgoing body contains neither thinking nor context_management; an intermediary may have added it after GJC sent the request.`,
+	};
+}
+
+async function finalizeAnthropicErrorMessage(error: unknown, dump: RawHttpRequestDump | undefined): Promise<string> {
+	if (
+		error instanceof Error &&
+		(error as Error & { anthropicHttp400AlreadyCaptured?: boolean }).anthropicHttp400AlreadyCaptured
+	) {
+		return error.message;
+	}
+	const diagnostic = diagnoseAnthropicContextManagementInjection(error, dump);
+	if (diagnostic && dump) {
+		dump.diagnostics = {
+			...(dump.diagnostics ?? {}),
+			anthropicContextManagement: {
+				strategy: diagnostic.strategy,
+				note: diagnostic.captureNote,
+			},
+		};
+	}
+	const message = await finalizeErrorMessage(error, dump);
+	return diagnostic ? `${message}\n\n${diagnostic.message}` : message;
+}
+
+/**
+ * CPA's Claude-OAuth layer cloaks downstream tool names into
+ * `mcp__<server>__<token>_<base>` aliases upstream. When the model emits a
+ * tool call whose alias embeds a token that appears nowhere in the request,
+ * CPA cannot restore the name and kills the whole stream with an HTTP 500 SSE
+ * `error` event instead of forwarding the call (issue #4338). The signature is
+ * precise and machine-parseable: it quotes the rejected alias and the failure
+ * mode verbatim. Native Anthropic never emits this phrasing, so the text itself
+ * is the route gate.
+ */
+const CPA_TOOL_ALIAS_RESTORE_PATTERN =
+	/cannot restore Claude OAuth MCP tool alias \\?"([^"\\\\]+)\\?": no unique request-local match/i;
+
+/**
+ * Aliases observed as `mcp__<server>__<token>_<base>` with a 12-character
+ * lowercase-alphanumeric token segment (`find` = `yw7zaf6emg3l` in both
+ * captured traces). Tolerate 8-16 chars so extraction survives token-length
+ * drift while staying out of the base name; a base that itself contains
+ * underscores (`todo_write`) is preserved by the trailing `.+`.
+ */
+const CPA_TOOL_ALIAS_BASE_PATTERN = /^mcp__[^_]+__[a-z0-9]{8,16}_(.+)$/;
+
+export interface CpaToolAliasRestoreFailure {
+	/** The rejected tool-call name exactly as CPA quoted it. */
+	alias: string;
+	/**
+	 * Base tool name parsed out of the alias (`mcp__<server>__<token>_<base>`
+	 * → `<base>`), when the alias shape is well-formed. `undefined` for a
+	 * malformed alias — callers must then fall back to direct discovery and
+	 * never invent a name.
+	 */
+	baseName?: string;
+}
+
+/**
+ * Classifies the CPA alias-restore signature and extracts the rejected alias
+ * plus its base tool name. Claims only statusless in-stream SSE error events
+ * and HTTP 5xx failures: a non-5xx status carrying this text is not the
+ * observed CPA delivery shape and is left to the other classifiers.
+ */
+export function parseCpaToolAliasRestoreFailure(error: unknown): CpaToolAliasRestoreFailure | undefined {
+	const status = extractHttpStatusFromError(error);
+	if (status !== undefined && status < 500) return undefined;
+	const message = error instanceof Error ? error.message : String(error);
+	const match = CPA_TOOL_ALIAS_RESTORE_PATTERN.exec(message);
+	if (!match) return undefined;
+	const alias = match[1]!;
+	return { alias, baseName: CPA_TOOL_ALIAS_BASE_PATTERN.exec(alias)?.[1] };
+}
+
+export function isCpaToolAliasRestoreFailure(error: unknown): boolean {
+	return parseCpaToolAliasRestoreFailure(error) !== undefined;
+}
+
 function hasStrictAnthropicTools(params: MessageCreateParamsStreaming): boolean {
 	const tools = params.tools as Array<{ strict?: unknown }> | undefined;
 	return tools?.some(tool => tool.strict === true) ?? false;
@@ -1255,6 +1481,131 @@ function getAnthropicCompat(
 
 const PROVIDER_MAX_RETRIES = 3;
 const PROVIDER_BASE_DELAY_MS = 2000;
+const ANTHROPIC_CUSTOM_ENDPOINT_FIRST_EVENT_GRACE_MS = 120_000;
+const ANTHROPIC_LARGE_REQUEST_BYTES = 1_000_000;
+const ANTHROPIC_LARGE_FIRST_EVENT_TIMEOUT_MAX_ATTEMPTS = 1;
+const ANTHROPIC_SMALL_FIRST_EVENT_TIMEOUT_MAX_ATTEMPTS = 2;
+
+function classifyAnthropicEndpoint(baseUrl: string): "canonical" | "custom" {
+	try {
+		const url = new URL(baseUrl);
+		return url.protocol.toLowerCase() === "https:" &&
+			url.hostname.toLowerCase() === "api.anthropic.com" &&
+			(url.port === "" || url.port === "443") &&
+			url.username === "" &&
+			url.password === "" &&
+			url.search === "" &&
+			url.hash === "" &&
+			(url.pathname === "" || url.pathname === "/")
+			? "canonical"
+			: "custom";
+	} catch {
+		return "custom";
+	}
+}
+
+function resolveAnthropicFirstEventWatchdogMs(
+	firstEventTimeoutMs: number | undefined,
+	endpointClass: "canonical" | "custom",
+	requestBytes: number,
+): number | undefined {
+	if (
+		firstEventTimeoutMs === undefined ||
+		firstEventTimeoutMs <= 0 ||
+		endpointClass === "canonical" ||
+		requestBytes < ANTHROPIC_LARGE_REQUEST_BYTES
+	) {
+		return firstEventTimeoutMs;
+	}
+	return firstEventTimeoutMs + ANTHROPIC_CUSTOM_ENDPOINT_FIRST_EVENT_GRACE_MS;
+}
+
+function resolveAnthropicFirstEventTimeoutMaxAttempts(requestBytes: number): number {
+	return requestBytes >= ANTHROPIC_LARGE_REQUEST_BYTES
+		? ANTHROPIC_LARGE_FIRST_EVENT_TIMEOUT_MAX_ATTEMPTS
+		: ANTHROPIC_SMALL_FIRST_EVENT_TIMEOUT_MAX_ATTEMPTS;
+}
+
+function normalizeStreamFailure(error: unknown): unknown {
+	if (error instanceof Error) return error;
+	if (error !== null && typeof error === "object") {
+		// Structured rejections (e.g. `{ status, error, headers }` from an SDK or
+		// injected client) carry transport metadata downstream classification
+		// reads; wrap them in a mutable Error but copy every enumerable own
+		// property so status/provider-code/header extraction still works.
+		let message: string;
+		try {
+			message = JSON.stringify(error) || String(error);
+		} catch {
+			message = String(error);
+		}
+		const wrapper = new Error(message);
+		Object.assign(wrapper, error as object);
+		return wrapper;
+	}
+	// Primitive rejections (string/number/boolean/null/undefined): wrap with the
+	// same string form downstream matchers already use (String(error)).
+	return new Error(String(error));
+}
+
+function attachAnthropicGraceFailureFacts(
+	error: unknown,
+	args: {
+		elapsedMs: number;
+		requestBytes: number;
+		firstEventTimeoutMs: number | undefined;
+		endpointClass: "canonical" | "custom";
+		awaitingFirstEvent: boolean;
+	},
+): void {
+	if (
+		!(error instanceof Error) ||
+		!args.awaitingFirstEvent ||
+		args.firstEventTimeoutMs === undefined ||
+		args.firstEventTimeoutMs <= 0 ||
+		args.elapsedMs < args.firstEventTimeoutMs ||
+		args.endpointClass !== "custom" ||
+		args.requestBytes < ANTHROPIC_LARGE_REQUEST_BYTES
+	) {
+		return;
+	}
+	Object.assign(error, {
+		requestBytes: args.requestBytes,
+		firstEventElapsedMs: args.elapsedMs,
+		firstEventTimeoutMs: args.firstEventTimeoutMs,
+		endpointClass: args.endpointClass,
+		retryMaxAttempts: ANTHROPIC_LARGE_FIRST_EVENT_TIMEOUT_MAX_ATTEMPTS,
+	});
+}
+
+function createAnthropicFirstEventTimeoutError(args: {
+	elapsedMs: number;
+	requestBytes: number;
+	firstEventTimeoutMs: number | undefined;
+	endpointClass: "canonical" | "custom";
+	/** Uploads this provider invocation already consumed before the timeout. */
+	providerAttemptsConsumed?: number;
+}): FirstEventTimeoutError {
+	const totalCeiling = resolveAnthropicFirstEventTimeoutMaxAttempts(args.requestBytes);
+	// The session counts a whole provider invocation as one attempt, so the
+	// ceiling handed up must bound TOTAL uploads across the invocation: subtract
+	// the provider replays already spent inside this invocation. A small request
+	// whose first upload 529'd and whose replay then timed out has already
+	// consumed two uploads; reporting the full two-attempt ceiling would let the
+	// session upload a third time.
+	const retryMaxAttempts = Math.max(1, totalCeiling - (args.providerAttemptsConsumed ?? 0));
+	const timeoutLabel = args.firstEventTimeoutMs === undefined ? "disabled" : `${args.firstEventTimeoutMs}ms`;
+	return new FirstEventTimeoutError(
+		`Anthropic stream timed out while waiting for the first event (elapsed=${args.elapsedMs}ms request_bytes=${args.requestBytes} endpoint=${args.endpointClass} configured_timeout=${timeoutLabel}; override with PI_STREAM_FIRST_EVENT_TIMEOUT_MS)`,
+		{
+			requestBytes: args.requestBytes,
+			firstEventElapsedMs: args.elapsedMs,
+			firstEventTimeoutMs: args.firstEventTimeoutMs,
+			endpointClass: args.endpointClass,
+			retryMaxAttempts,
+		},
+	);
+}
 
 /**
  * Check if an error from the Anthropic SDK is a rate-limit/transient error that
@@ -1403,6 +1754,93 @@ export function applyAnthropicUsageExtras(usage: Usage, source: AnthropicUsageLi
 	}
 }
 
+/**
+ * Unique request-local tool whose wire name equals the parsed base, if any.
+ * Only an exact, singular match is trusted; zero or multiple matches yield
+ * `undefined` so the repair never guesses among ambiguous aliases.
+ */
+function resolveCpaCallableToolName(
+	params: MessageCreateParamsStreaming,
+	failure: CpaToolAliasRestoreFailure,
+): string | undefined {
+	if (failure.baseName === undefined) return undefined;
+	const tools = params.tools as Array<{ name?: string }> | undefined;
+	if (!tools) return undefined;
+	let match: string | undefined;
+	for (const tool of tools) {
+		if (tool.name !== failure.baseName) continue;
+		if (match !== undefined) return undefined;
+		match = tool.name;
+	}
+	return match;
+}
+
+/**
+ * Corrective steering for the one retry after a CPA alias-restore failure. A
+ * provable unique callable name is stated deterministically; otherwise the
+ * model is directed at tool discovery instead of being handed an invented
+ * name, mirroring the agent loop's "not found → discover and activate"
+ * guidance. The rejected alias is echoed verbatim so the model knows which
+ * call was wrong; nothing else from the request is quoted.
+ */
+function buildCpaToolAliasSteering(failure: CpaToolAliasRestoreFailure, callableToolName?: string): string {
+	const rejected = `Your previous tool call "${failure.alias}" was rejected by the Claude OAuth proxy: the tool name is not callable in this request.`;
+	if (callableToolName !== undefined) {
+		return `${rejected} The callable tool is "${callableToolName}". Call it by exactly that name; do not construct or reconstruct prefixed or aliased tool names.`;
+	}
+	return `${rejected} If you need this capability, call \`search_tool_bm25\` to discover and activate the matching tool, then retry.`;
+}
+
+/**
+ * Actionable terminal error for a CPA alias-restore failure that survived the
+ * single corrective attempt. Deliberately statusless: no HTTP status, no
+ * transport facts, and no recognizable status phrase, so neither the provider
+ * generic 5xx retry nor the managed fallback controller re-sends the unchanged
+ * request. Only the rejected alias and the deterministic callable name (when
+ * provable) are quoted — never the request body or headers.
+ */
+function createCpaToolAliasTerminalError(failure: CpaToolAliasRestoreFailure, callableToolName?: string): Error {
+	const base = `Claude OAuth proxy rejected tool call "${failure.alias}": the proxy cannot restore the Claude OAuth MCP tool alias (no unique request-local match), and the corrective retry was rejected again.`;
+	const guidance =
+		callableToolName !== undefined
+			? ` The callable tool name is "${callableToolName}"; call it by exactly that name.`
+			: ` No unique callable tool name could be determined; discover the correct tool name before retrying.`;
+	return new Error(`${base}${guidance} The turn was not re-sent.`);
+}
+
+/**
+ * Stable identity for the logical turn currently being prompted: the
+ * serialized content of the last user message. Fallback rebuilds of the same
+ * turn keep the same fingerprint; the next user prompt changes it.
+ */
+function cpaTurnFingerprint(messages: Message[]): string {
+	for (let index = messages.length - 1; index >= 0; index--) {
+		const message = messages[index];
+		if (message.role !== "user") continue;
+		const content = message.content;
+		const serialized = typeof content === "string" ? content : JSON.stringify(content);
+		return `${serialized.length}:${serialized}`;
+	}
+	return "";
+}
+
+/**
+ * Append corrective steering as a trailing user turn, preserving role
+ * alternation by merging into the last user message when it is already a user
+ * turn.
+ */
+function appendCpaSteeringToMessages(params: MessageCreateParamsStreaming, text: string): void {
+	const messages = params.messages as MessageParam[];
+	const last = messages[messages.length - 1];
+	if (last && last.role === "user") {
+		last.content = Array.isArray(last.content)
+			? [...last.content, { type: "text", text }]
+			: `${last.content}\n\n${text}`;
+	} else {
+		messages.push({ role: "user", content: text });
+	}
+}
+
 export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 	model: Model<"anthropic-messages">,
 	context: Context,
@@ -1482,6 +1920,9 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 			let strictFallbackErrorMessage: string | undefined;
 			let dropFastMode = providerSessionState?.fastModeDisabled ?? false;
 			let droppedForcedToolChoice = false;
+			// Exactly one corrective retry per request for the CPA alias-restore
+			// signature (issue #4338); recurrence terminalizes instead of resending.
+			let cpaAliasRepairApplied = false;
 			let thinkingReplayRepairScope: AnthropicThinkingReplayRepairScope =
 				providerSessionState?.thinkingReplayRepairScope ?? "none";
 			let thinkingReplayRepairAttempts = providerSessionState?.thinkingReplayRepairAttempts ?? 0;
@@ -1522,18 +1963,50 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 				if (replacementPayload !== undefined) {
 					nextParams = replacementPayload as typeof nextParams;
 				}
+				// Managed-mode CPA steering (issue #4338): a previous managed attempt of
+				// this exact turn recorded a corrective tool-name message. Apply it only
+				// while the turn is unchanged; a different user prompt expires it so a
+				// stale correction never leaks into a later turn.
+				const cpaSteering = providerSessionState?.cpaToolAliasSteering;
+				if (cpaSteering) {
+					if (cpaSteering.turnFingerprint === cpaTurnFingerprint(context.messages)) {
+						appendCpaSteeringToMessages(nextParams, cpaSteering.message);
+					} else {
+						providerSessionState.cpaToolAliasSteering = undefined;
+					}
+				}
 				validateCacheControls(nextParams as AnthropicCacheParams);
+				return nextParams;
+			};
+			let params = await prepareParams();
+			const setRawRequestDump = (body: MessageCreateParamsStreaming): void => {
 				rawRequestDump = {
 					provider: model.provider,
 					api: output.api,
 					model: model.id,
 					method: "POST",
 					url: `${baseUrl}/v1/messages`,
-					body: nextParams,
+					body,
 				};
-				return nextParams;
 			};
-			let params = await prepareParams();
+			setRawRequestDump(params);
+			const inheritedRejectedPayload = providerSessionState?.thinkingReplayRejectedPayload;
+			if (
+				inheritedRejectedPayload &&
+				thinkingReplayRepairScope !== "none" &&
+				!anthropicPayloadChanged(inheritedRejectedPayload, fingerprintAnthropicPayload(params))
+			) {
+				throw createAnthropicThinkingRepairNoopError(
+					new Error(
+						"invalid_request_error: persisted Anthropic thinking repair did not change the outgoing payload",
+					),
+					params,
+					inheritedRejectedPayload,
+				);
+			}
+			if (providerSessionState?.thinkingReplayRejectedPayload) {
+				providerSessionState.thinkingReplayRejectedPayload = undefined;
+			}
 
 			type Block = (
 				| ThinkingContent
@@ -1565,10 +2038,14 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 					if (orphaned.type === "toolCall") {
 						if (!isCompleteJson(orphaned.partialJson)) {
 							orphaned.incompleteArguments = true;
+							orphaned.incompleteArgumentsReason = "truncated";
 							truncatedToolCalls.add(orphaned);
 						}
 						if (orphaned.partialJson.trim()) {
 							orphaned.arguments = parseStreamingJson(orphaned.partialJson);
+							if (findUnnecessaryUnicodeEscape(orphaned.partialJson)) {
+								orphaned.escapedNonAsciiArguments = true;
+							}
 						}
 					}
 					delete (orphaned as { index?: number }).index;
@@ -1595,25 +2072,49 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 			const firstEventFallbackMs = getProviderFirstEventTimeoutFallbackMs(model.provider);
 			const firstEventTimeoutMs =
 				options?.streamFirstEventTimeoutMs ?? getStreamFirstEventTimeoutMs(idleTimeoutMs, firstEventFallbackMs);
+			const endpointClass = classifyAnthropicEndpoint(options?.client?.baseURL ?? baseUrl);
 			stream.push({ type: "start", partial: output });
 			// Retry loop for transient errors from the stream.
 			// Provider-level transport/rate-limit failures: only before any streamed content starts.
 			// Malformed envelopes/JSON: only before replay-unsafe text/tool events are visible on this stream.
 			let providerRetryAttempt = 0;
+			// Total uploads this invocation has spent, including corrective-policy
+			// replays (strict-tool/forced-tool/fast-mode/thinking/CPA) that reset
+			// providerRetryAttempt before `continue`. The timeout ceiling must bound
+			// TOTAL uploads, so it reads this counter, not the resettable one.
+			let providerUploadCount = 0;
 			while (true) {
+				let firstEventWaitStartedAt: number | undefined;
+				const requestBytes = fingerprintAnthropicPayload(params).bytes;
+				const firstEventWatchdogMs = resolveAnthropicFirstEventWatchdogMs(
+					firstEventTimeoutMs,
+					endpointClass,
+					requestBytes,
+				);
+				const requestUploadCeilingBound =
+					endpointClass === "custom" &&
+					requestBytes >= ANTHROPIC_LARGE_REQUEST_BYTES &&
+					firstEventTimeoutMs !== undefined &&
+					firstEventTimeoutMs > 0;
 				// Retries reset output.content; drop stale block correlations from the aborted attempt.
 				blocksByAnthropicIndex.clear();
 				truncatedToolCalls.clear();
 				sawTerminalStopReason = false;
 				activeAbortTracker = createAbortSourceTracker(options?.signal);
-				const firstEventTimeoutAbortError = new FirstEventTimeoutError(
-					"Anthropic stream timed out while waiting for the first event",
-				);
+				let firstEventTimeoutAbortError: FirstEventTimeoutError | undefined;
 				const idleTimeoutAbortError = new Error("Anthropic stream stalled while waiting for the next event");
 				const { requestSignal } = activeAbortTracker;
-				const anthropicRequest = client.messages.create({ ...params, stream: true }, { signal: requestSignal });
+				setRawRequestDump(params);
+				const anthropicRequest = client.messages.create(
+					{ ...params, stream: true },
+					{
+						signal: requestSignal,
+						...(requestUploadCeilingBound ? { maxRetries: 0 } : {}),
+					},
+				);
 				let streamedReplayUnsafeContent = false;
 				let sawProviderSafetyStop = false;
+				let sawFirstSemanticEvent = false;
 
 				try {
 					const {
@@ -1626,6 +2127,7 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 						options?.client ? event => options?.onSseEvent?.(event, model, options?.attemptScope) : undefined,
 					);
 					await notifyProviderResponse(options, response, model, requestId);
+					firstEventWaitStartedAt = Date.now();
 					let sawEvent = false;
 					let sawMessageStart = false;
 					let sawTerminalEnvelope = false;
@@ -1634,13 +2136,27 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 
 					for await (const event of iterateWithIdleTimeout(anthropicStream, {
 						idleTimeoutMs,
-						firstItemTimeoutMs: firstEventTimeoutMs,
+						firstItemTimeoutMs: firstEventWatchdogMs,
 						errorMessage: idleTimeoutAbortError.message,
-						firstItemErrorMessage: firstEventTimeoutAbortError.message,
+						firstItemErrorMessage: "Anthropic stream timed out while waiting for the first event",
 						onIdle: () => activeAbortTracker.abortLocally(idleTimeoutAbortError),
-						onFirstItemTimeout: () => activeAbortTracker.abortLocally(firstEventTimeoutAbortError),
+						onFirstItemTimeout: () => {
+							firstEventTimeoutAbortError = createAnthropicFirstEventTimeoutError({
+								elapsedMs: Date.now() - (firstEventWaitStartedAt ?? Date.now()),
+								requestBytes,
+								firstEventTimeoutMs,
+								endpointClass,
+								providerAttemptsConsumed: providerUploadCount,
+							});
+							activeAbortTracker.abortLocally(firstEventTimeoutAbortError);
+						},
 						abortSignal: options?.signal,
-						isProgressItem: isProgressEvent,
+						isProgressItem: event => {
+							if (!isRecord(event) || (!sawMessageStart && event.type !== "message_start")) return false;
+							const progress = isProgressEvent(event);
+							if (progress) sawFirstSemanticEvent = true;
+							return progress;
+						},
 					})) {
 						sawEvent = true;
 						if (sawMessageStop) {
@@ -1840,9 +2356,9 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 									if (!isCompleteJson(block.partialJson)) truncatedToolCalls.add(block);
 									if (block.partialJson.trim()) {
 										block.arguments = parseStreamingJson(block.partialJson);
-										// Raw-wire check: after decode the escape is invisible.
-										if (findUnnecessaryUnicodeEscape(block.partialJson))
+										if (findUnnecessaryUnicodeEscape(block.partialJson)) {
 											block.escapedNonAsciiArguments = true;
+										}
 									}
 									delete (block as { partialJson?: string }).partialJson;
 									stream.push({
@@ -1944,13 +2460,52 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 						providerSessionState.thinkingReplayRepairScope = "none";
 						providerSessionState.thinkingReplayRepairAttempts = 0;
 					}
+					// Release a recorded CPA steering once any stream completes: a
+					// successful stream consumed it, and a failed one ends the turn (a
+					// later turn's different user prompt would expire it anyway).
+					if (providerSessionState?.cpaToolAliasSteering) {
+						providerSessionState.cpaToolAliasSteering = undefined;
+					}
 					break;
 				} catch (streamError) {
 					const localAbortReason = activeAbortTracker.getLocalAbortReason();
-					const streamFailure = localAbortReason ?? streamError;
+					// Normalize unknown rejections (a primitive string from an injected
+					// custom client is a supported surface) to a mutable Error. Boxed
+					// primitives silently discard every fact stamped below, which let
+					// a ceiling-bound upload slip past the one-attempt ceiling and
+					// string-matched corrective branches re-upload the body.
+					const streamFailure = localAbortReason ?? normalizeStreamFailure(streamError);
+					attachAnthropicGraceFailureFacts(streamFailure, {
+						elapsedMs: Date.now() - (firstEventWaitStartedAt ?? Date.now()),
+						requestBytes,
+						firstEventTimeoutMs,
+						endpointClass,
+						awaitingFirstEvent: !sawFirstSemanticEvent,
+					});
+					// A ceiling-bound upload failed before stream iteration began (for
+					// example an immediate 529 from withResponse()): the grace clock
+					// never started, so the facts above cannot apply, but the one-attempt
+					// upload ceiling must still bound the outer provider retry loop.
+					// Otherwise the multi-megabyte body is re-uploaded up to the default
+					// streamMaxRetries budget despite the ceiling. Once iteration has
+					// begun, only the grace-clock path above decides.
+					if (requestUploadCeilingBound && firstEventWaitStartedAt === undefined) {
+						Object.assign(streamFailure as Error, {
+							requestBytes,
+							endpointClass,
+							retryMaxAttempts: ANTHROPIC_LARGE_FIRST_EVENT_TIMEOUT_MAX_ATTEMPTS,
+						});
+					}
+					const firstEventRetryMaxAttempts =
+						typeof (streamFailure as { retryMaxAttempts?: unknown }).retryMaxAttempts === "number"
+							? (streamFailure as { retryMaxAttempts: number }).retryMaxAttempts
+							: undefined;
 					if (localAbortReason || sawProviderSafetyStop) {
 						throw streamFailure;
 					}
+					if (firstEventRetryMaxAttempts !== undefined && providerRetryAttempt + 1 >= firstEventRetryMaxAttempts) {
+						throw streamFailure;
+					}
 					if (
 						!options?.fallbackManaged &&
 						!disableStrictTools &&
@@ -1965,6 +2520,7 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 						disableStrictTools = true;
 						params = await prepareParams();
 						providerRetryAttempt = 0;
+						providerUploadCount++;
 						resetOutputForRetry();
 						continue;
 					}
@@ -1994,6 +2550,7 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 						droppedForcedToolChoice = true;
 						params = await prepareParams();
 						providerRetryAttempt = 0;
+						providerUploadCount++;
 						resetOutputForRetry();
 						continue;
 					}
@@ -2002,7 +2559,7 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 					const maskedProxyRejection = isAnthropicMaskedProxyRejection(streamFailure);
 					if (
 						!options?.fallbackManaged &&
-						thinkingReplayRepairScope !== "all" &&
+						thinkingReplayRepairScope === "none" &&
 						thinkingReplayRepairAttempts < ANTHROPIC_MAX_THINKING_REPAIRS &&
 						firstTokenTime === undefined &&
 						(thinkingSignatureInvalid ||
@@ -2012,15 +2569,47 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 							// flight there is nothing to repair and the error must surface.
 							(maskedProxyRejection && hasNativeThinkingBlocks(params.messages)))
 					) {
-						// "cannot be modified" means the cited blocks must be replayed byte for
-						// byte, so editing that turn again can never converge — the only recovery
-						// is to stop replaying native thinking at all. The invalid-signature 400
-						// cites blocks anywhere in history and needs the same full-history scope.
-						// Only the unclassifiable masked rejection is worth probing latest-first.
-						const nextScope: AnthropicThinkingReplayRepairScope =
-							thinkingSignatureInvalid || thinkingBlocksImmutable || thinkingReplayRepairScope === "latest"
-								? "all"
-								: "latest";
+						const rejectedFingerprint = fingerprintAnthropicPayload(params);
+						const scopes: Array<Exclude<AnthropicThinkingReplayRepairScope, "none">> = thinkingSignatureInvalid
+							? ["all"]
+							: ["latest", "all"];
+						let candidate: AnthropicThinkingRepairCandidate | undefined;
+						const transforms: Record<string, unknown> = {};
+						for (const scope of scopes) {
+							thinkingReplayRepairScope = scope;
+							const candidateParams = await prepareParams();
+							const fingerprint = fingerprintAnthropicPayload(candidateParams);
+							const changed = anthropicPayloadChanged(rejectedFingerprint, fingerprint);
+							transforms[scope] = { changed, sha256: fingerprint.sha256, bytes: fingerprint.bytes };
+							if (changed) {
+								candidate = { scope, params: candidateParams, fingerprint };
+								break;
+							}
+						}
+						if (rawRequestDump) {
+							rawRequestDump.diagnostics = {
+								...(rawRequestDump.diagnostics ?? {}),
+								anthropicThinkingRepair: {
+									rejected: rejectedFingerprint,
+									disposition: candidate ? `send-${candidate.scope}` : "no-op-terminal",
+									transforms,
+									outgoingMismatch: describeAnthropicOutgoingPath(streamFailure, params),
+								},
+							};
+						}
+						const captured = await finalizeAnthropicErrorMessage(streamFailure, rawRequestDump);
+						logger.warn("anthropic: thinking replay rejected; evaluated bounded repair", {
+							model: model.id,
+							disposition: candidate ? `send-${candidate.scope}` : "no-op-terminal",
+							rejectedSha256: rejectedFingerprint.sha256,
+							rejectedBytes: rejectedFingerprint.bytes,
+							diagnostic: captured,
+						});
+						if (!candidate) {
+							thinkingReplayRepairScope = "none";
+							throw createAnthropicThinkingRepairNoopError(streamFailure, params, rejectedFingerprint, captured);
+						}
+						const nextScope = candidate.scope;
 						thinkingReplayRepairAttempts++;
 						logger.debug("anthropic: repairing assistant thinking replay after provider rejection", {
 							model: model.id,
@@ -2038,13 +2627,73 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 								providerSessionState.thinkingReplayRepairScope = nextScope;
 							}
 						}
-						params = await prepareParams();
+						params = candidate.params;
+						// The corrective replay uploads the repaired body: count it so the
+						// first-event timeout ceiling bounds TOTAL uploads (issue #4464).
+						providerUploadCount++;
 						// The provider retry budget is deliberately NOT reset here: a repair that
 						// keeps being rejected must run out instead of renewing the budget it is
 						// supposed to consume (issue #4011).
 						resetOutputForRetry();
 						continue;
 					}
+					// Managed attempts never take the repair branch above: the fallback
+					// controller owns retries, so the provider must not retry inside the
+					// attempt it was handed. That left the repair unreachable for the
+					// coding agent, which prompts exclusively through managed attempts —
+					// every turn rebuilt the same replay from the same history, drew the
+					// same deterministic 400, and the session never converged (issue
+					// #4262: one rejected 1.3 MB request every 12s, indefinitely).
+					// Recording the escalation costs no round trip and keeps the retry
+					// boundary intact: the next managed attempt builds a repaired replay.
+					// The masked `api_error` stays out — it names no cause and may be a
+					// transient blip, so only a rejection that provably indicts the
+					// replayed thinking blocks may cost the session its native replay.
+					if (
+						options?.fallbackManaged &&
+						providerSessionState &&
+						providerSessionState.thinkingReplayRepairScope !== "all" &&
+						firstTokenTime === undefined &&
+						(thinkingSignatureInvalid || thinkingBlocksImmutable) &&
+						hasNativeThinkingBlocks(params.messages)
+					) {
+						const rejectedFingerprint = fingerprintAnthropicPayload(params);
+						thinkingReplayRepairScope = "all";
+						const candidateParams = await prepareParams();
+						const candidateFingerprint = fingerprintAnthropicPayload(candidateParams);
+						const changed = anthropicPayloadChanged(rejectedFingerprint, candidateFingerprint);
+						if (rawRequestDump) {
+							rawRequestDump.diagnostics = {
+								...(rawRequestDump.diagnostics ?? {}),
+								anthropicThinkingRepair: {
+									rejected: rejectedFingerprint,
+									disposition: changed ? "record-all-for-managed-retry" : "no-op-terminal",
+									transforms: {
+										all: { changed, sha256: candidateFingerprint.sha256, bytes: candidateFingerprint.bytes },
+									},
+									outgoingMismatch: describeAnthropicOutgoingPath(streamFailure, params),
+								},
+							};
+						}
+						const captured = await finalizeAnthropicErrorMessage(streamFailure, rawRequestDump);
+						logger.warn("anthropic: managed thinking replay rejected; evaluated repair", {
+							model: model.id,
+							disposition: changed ? "record-all-for-managed-retry" : "no-op-terminal",
+							rejectedSha256: rejectedFingerprint.sha256,
+							rejectedBytes: rejectedFingerprint.bytes,
+							diagnostic: captured,
+						});
+						if (!changed) {
+							thinkingReplayRepairScope = "none";
+							throw createAnthropicThinkingRepairNoopError(streamFailure, params, rejectedFingerprint, captured);
+						}
+						logger.debug("anthropic: recording thinking replay repair for the next managed attempt", {
+							model: model.id,
+							error: streamFailure instanceof Error ? streamFailure.message : String(streamFailure),
+						});
+						providerSessionState.thinkingReplayRepairScope = "all";
+						providerSessionState.thinkingReplayRejectedPayload = rejectedFingerprint;
+					}
 					if (
 						!options?.fallbackManaged &&
 						!dropFastMode &&
@@ -2062,6 +2711,7 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 						dropFastMode = true;
 						params = await prepareParams();
 						providerRetryAttempt = 0;
+						providerUploadCount++;
 						resetOutputForRetry();
 						continue;
 					}
@@ -2090,9 +2740,82 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 						generatedCacheBudget = nextBudget;
 						params = await prepareParams();
 						providerRetryAttempt = 0;
+						providerUploadCount++;
 						resetOutputForRetry();
 						continue;
 					}
+					// CPA (Claude-OAuth proxy) alias-restore failure (issue #4338): the
+					// proxy 500s the whole stream because the model emitted a cloaked
+					// `mcp__<server>__<token>_<base>` tool name whose random token segment
+					// matches nothing in the request. The generic 5xx retry below would
+					// blindly re-send the unchanged request and re-sample the same drift;
+					// instead, correct the request exactly once and terminalize on
+					// recurrence. The narrow CPA phrase is the route gate, so native
+					// Anthropic and non-CPA proxies are untouched.
+					const cpaAliasFailure = parseCpaToolAliasRestoreFailure(streamFailure);
+					if (cpaAliasFailure && firstTokenTime === undefined) {
+						if (options?.fallbackManaged) {
+							// The managed fallback controller owns retries: never retry
+							// inside the attempt it handed us. Record the corrective
+							// steering against this exact turn and surface the raw error;
+							// the controller's next attempt rebuilds the request with the
+							// steering. Without shared session state there is nowhere to
+							// record, so fall through to the controller unchanged.
+							if (!providerSessionState) throw streamFailure;
+							const turnFingerprint = cpaTurnFingerprint(context.messages);
+							if (providerSessionState.cpaToolAliasSteering?.turnFingerprint === turnFingerprint) {
+								// The steering was already applied to this attempt and the proxy
+								// rejected again: the single corrective attempt is spent. Surface
+								// an actionable terminal error instead of another unchanged
+								// resend.
+								throw createCpaToolAliasTerminalError(
+									cpaAliasFailure,
+									resolveCpaCallableToolName(params, cpaAliasFailure),
+								);
+							}
+							providerSessionState.cpaToolAliasSteering = {
+								message: buildCpaToolAliasSteering(
+									cpaAliasFailure,
+									resolveCpaCallableToolName(params, cpaAliasFailure),
+								),
+								turnFingerprint,
+							};
+							logger.debug("anthropic: recording CPA tool alias steering for the next managed attempt", {
+								model: model.id,
+								alias: cpaAliasFailure.alias,
+								baseName: cpaAliasFailure.baseName,
+								error: streamFailure instanceof Error ? streamFailure.message : String(streamFailure),
+							});
+							throw streamFailure;
+						}
+						if (!cpaAliasRepairApplied) {
+							cpaAliasRepairApplied = true;
+							logger.debug("anthropic: repairing CPA tool alias restore failure with corrective steering", {
+								model: model.id,
+								alias: cpaAliasFailure.alias,
+								baseName: cpaAliasFailure.baseName,
+								error: streamFailure instanceof Error ? streamFailure.message : String(streamFailure),
+							});
+							appendCpaSteeringToMessages(
+								params,
+								buildCpaToolAliasSteering(cpaAliasFailure, resolveCpaCallableToolName(params, cpaAliasFailure)),
+							);
+							// Exactly one corrective attempt per request: the provider retry
+							// budget is deliberately NOT reset, so a persistent failure runs
+							// out instead of renewing the budget it is supposed to consume
+							// (issue #4011), and the recurrence branch below terminalizes
+							// before the generic 5xx retry can re-send the unchanged request.
+							// This corrective replay uploads the steered body: count it so the
+							// first-event timeout ceiling bounds TOTAL uploads (issue #4464).
+							providerUploadCount++;
+							resetOutputForRetry();
+							continue;
+						}
+						throw createCpaToolAliasTerminalError(
+							cpaAliasFailure,
+							resolveCpaCallableToolName(params, cpaAliasFailure),
+						);
+					}
 					const isTransientEnvelopeFailure =
 						isTransientStreamParseError(streamFailure) || isTransientStreamEnvelopeError(streamFailure);
 					const canRetryTransientEnvelopeFailure = isTransientEnvelopeFailure && !streamedReplayUnsafeContent;
@@ -2100,12 +2823,15 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 						firstTokenTime === undefined && isProviderRetryableError(streamFailure, model.provider);
 					if (
 						activeAbortTracker.wasCallerAbort() ||
+						(firstEventRetryMaxAttempts !== undefined &&
+							providerRetryAttempt + 1 >= firstEventRetryMaxAttempts) ||
 						providerRetryAttempt >= resolveRetryBudget(options?.streamMaxRetries, PROVIDER_MAX_RETRIES) ||
 						(!canRetryTransientEnvelopeFailure && !canRetryProviderFailure)
 					) {
 						throw streamFailure;
 					}
 					providerRetryAttempt++;
+					providerUploadCount++;
 					const delayMs = PROVIDER_BASE_DELAY_MS * 2 ** (providerRetryAttempt - 1);
 					if (options?.providerRetryWait) {
 						await options.providerRetryWait(delayMs, options.signal);
@@ -2122,7 +2848,9 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 					truncatedToolCalls.add(block);
 					if (block.partialJson.trim()) {
 						block.arguments = parseStreamingJson(block.partialJson);
-						if (findUnnecessaryUnicodeEscape(block.partialJson)) block.escapedNonAsciiArguments = true;
+						if (findUnnecessaryUnicodeEscape(block.partialJson)) {
+							block.escapedNonAsciiArguments = true;
+						}
 					}
 					delete (block as { partialJson?: string }).partialJson;
 				}
@@ -2132,6 +2860,7 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 				for (const block of output.content) {
 					if (block.type === "toolCall" && truncatedToolCalls.has(block)) {
 						block.incompleteArguments = true;
+						block.incompleteArgumentsReason = "truncated";
 					}
 				}
 			}
@@ -2140,6 +2869,23 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 			if (dropFastMode && resolveServiceTier(options?.serviceTier, model.provider) === "priority") {
 				output.disabledFeatures = [...(output.disabledFeatures ?? []), "priority"];
 			}
+			// Defense-in-depth (#4443): when the provider stream assembles an
+			// assistant message whose content carries directly adjacent private
+			// blocks, emit a bounded diagnostic naming only the envelope shape —
+			// block count and adjacent-pair presence — never raw thinking text,
+			// signatures, or redacted payloads. The send-boundary collapse
+			// remains the wire source of truth; this is a read-only observation.
+			// Scoped to this stream invocation: each completed turn with the
+			// defect is a distinct upstream producer worth surfacing, so the
+			// diagnostic is not latched across invocations.
+			if (hasAdjacentPrivateThinkingBlocks(output.content)) {
+				logger.warn("anthropic: stream assembled assistant content with adjacent thinking blocks", {
+					model: model.id,
+					provider: model.provider,
+					contentBlockCount: output.content.length,
+					hasAdjacentPrivateBlocks: true,
+				});
+			}
 			stream.push({ type: "done", reason: output.stopReason, message: output });
 			stream.end();
 		} catch (error) {
@@ -2152,7 +2898,8 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 			output.errorStatus = extractHttpStatusFromError(localAbortReason ?? error);
 			output.transportFailure = transportFailureFacts(localAbortReason ?? error);
 			if (output.errorKind !== "provider_safety_stop" || !output.errorMessage) {
-				output.errorMessage = localAbortReason?.message ?? (await finalizeErrorMessage(error, rawRequestDump));
+				output.errorMessage =
+					localAbortReason?.message ?? (await finalizeAnthropicErrorMessage(error, rawRequestDump));
 			}
 			output.errorMessage = rewriteCopilotError(output.errorMessage, error, model.provider);
 			output.duration = Date.now() - startTime;
@@ -2872,6 +3619,49 @@ function buildToolResultBlock(model: Model<"anthropic-messages">, msg: ToolResul
 	return block;
 }
 
+/**
+ * Anthropic rejects a replayed assistant message containing adjacent
+ * `thinking`/`redacted_thinking` blocks — even when each block individually
+ * carries a valid signature — with a 400 citing the second block: "cannot be
+ * modified. These blocks must remain as in the original response." (issue #4416)
+ *
+ * The adjacency can originate from the provider stream (two `content_block_start`
+ * events for `thinking` in one message with no intervening `tool_use`), from a
+ * history mutation that removed a separating `tool_use`, or from an earlier
+ * conversion phase in `convertAnthropicMessages` that skipped an empty `text`
+ * block sitting between two thinking blocks. Because that last path exists, the
+ * invariant cannot be enforced in the shared `transformMessages` phase — it must
+ * run on the final wire output.
+ *
+ * This collapses each run of adjacent `thinking`/`redacted_thinking` blocks down
+ * to the first block, preserving its bytes, signature, and type verbatim (never
+ * concatenating, editing, synthesizing, or choosing the last). Blocks separated
+ * by any non-thinking block (`text`, `tool_use`, …) are legitimate
+ * interleaved-thinking shape and pass through unchanged. `thinking` and
+ * `redacted_thinking` are treated as one adjacency class per the API contract.
+ *
+ * The pass is O(n) per message and idempotent: an already-collapsed array is a
+ * no-op, so re-runs through `convertAnthropicMessages` (e.g. forced-tool-choice
+ * or unreplayable-thinking rebuilds) are safe.
+ */
+function collapseAdjacentThinkingBlocks(messages: MessageParam[]): void {
+	for (const message of messages) {
+		if (message.role !== "assistant" || !Array.isArray(message.content)) continue;
+		const content = message.content;
+		let write = 0;
+		let inThinkingRun = false;
+		for (let read = 0; read < content.length; read++) {
+			const block = content[read];
+			if (block === undefined) continue;
+			const isThinkingBlock = block.type === "thinking" || block.type === "redacted_thinking";
+			if (isThinkingBlock && inThinkingRun) continue; // only the first block of a run survives
+			inThinkingRun = isThinkingBlock;
+			content[write++] = block;
+		}
+		if (write < content.length) content.length = write;
+	}
+}
+
 export function convertAnthropicMessages(
 	messages: Message[],
 	model: Model<"anthropic-messages">,
@@ -3009,6 +3799,11 @@ export function convertAnthropicMessages(
 		}
 	}
 
+	// Final send-time invariant (issue #4416): collapse any run of adjacent
+	// `thinking`/`redacted_thinking` blocks within one assistant message down to
+	// the first block. This runs on the wire output because earlier phases here
+	// (e.g. skipping empty text blocks) can themselves create the adjacency.
+	collapseAdjacentThinkingBlocks(params);
 	if (params.length > 0 && params[params.length - 1]?.role === "assistant") {
 		params.push({ role: "user", content: "Continue." });
 	}