@iislee/opencodex 2.11.0 → 2.35.0

package/src/adapters/anthropic.ts

@@ -1,4 +1,5 @@
 import type { IncomingMeta, ProviderAdapter } from "./base";
+import { createToolCallIdAllocator, type ToolCallIdAllocator } from "./tool-call-id";
 import { debugDroppedFrame } from "../lib/debug";
 import type {
   AdapterEvent,
@@ -13,16 +14,20 @@ import type {
   OcxToolResultMessage,
   OcxUsage,
 } from "../types";
-import { isAllowedToolChoice, namespacedToolName, resolveToolChoiceWireName, toolAllowedByChoice } from "../types";
+import { isAllowedToolChoice, namespacedToolName, resolveToolChoiceWireName, toolChoiceToolPredicate } from "../types";
 import { ANTHROPIC_OAUTH_BETA, CLAUDE_CODE_SYSTEM_INSTRUCTION, applyClaudeToolPrefix, stripClaudeToolPrefix } from "../oauth/anthropic";
 import { parseDataUrl } from "./image";
 import { enforceAnthropicImageLimits } from "./anthropic-image-guard";
 import { normalizeAnthropicImages } from "./anthropic-image-normalize";
-import { neutralizeIdentity } from "./identity";
+import { normalizeAnthropicOutputSchema } from "./anthropic-output-schema";
+import { stripResponsesOnlyEncryptedMarker } from "./responses-tool-schema";
+import { identifyRoutedModel } from "./identity";
+import { redactSecretString } from "../lib/redact";
 import { CLAUDE_CODE_HEADERS, claudeCodeSessionId } from "./client-fingerprint";
 import { buildNonOpenAIToolCatalogNudgeForTools } from "./tool-catalog-nudge";
 import { decodeServerSentEvents } from "../lib/sse-decoder";
 import { isTranslatorBudgetExceededError, retainTranslatedEventBatch, type TranslatorBudget } from "../lib/translator-budget";
+import { isReasoningEffortOmitted, modelRecordValue } from "../reasoning-effort";
 
 /** Map a user content part to an Anthropic content block (text or image source). */
 function toAnthropicContentPart(p: OcxContentPart): unknown {
@@ -32,6 +37,7 @@ function toAnthropicContentPart(p: OcxContentPart): unknown {
       ? { type: "image", source: { type: "base64", media_type: data.mediaType, data: data.base64 } }
       : { type: "image", source: { type: "url", url: p.imageUrl } };
   }
+  if (p.type === "video") return { type: "text", text: "[video]" };
   return { type: "text", text: p.text };
 }
 
@@ -243,6 +249,76 @@ function isLikelyRealAnthropicThinkingSignature(signature: string | undefined):
   return /^[A-Za-z0-9+/_=-]+$/.test(signature);
 }
 
+/**
+ * Bridge error fidelity (web-search/images loops): extract a display-safe summary from an
+ * Anthropic JSON error envelope so `Provider error <status>` carries the upstream reason.
+ * JSON-only extraction — HTML/non-JSON bodies yield "" so raw markup is never echoed.
+ */
+export function formatAnthropicErrorBody(status: number, _headers: Headers, payloadText: string): string {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(payloadText);
+  } catch {
+    return "";
+  }
+  const detail = extractAnthropicErrorDetail(parsed);
+  if (!detail) return "";
+  return redactSecretString(detail).slice(0, 400);
+}
+
+function isAnthropicRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function anthropicStructuralValueType(value: unknown): string {
+  if (value === null) return "null";
+  return Array.isArray(value) ? "array" : typeof value;
+}
+
+interface InvalidAnthropicShapeDiagnostic {
+  reason: "content_not_array" | "content_block_not_object";
+  blockIndex?: number;
+  valueType: string;
+}
+
+/**
+ * Structured refusal for a malformed buffered response body, shaped like the google adapter's
+ * `invalidGoogleShapeEvent` so an operator reading a log can tell which rung failed: the content
+ * container, or one block inside an otherwise well-formed container.
+ */
+function invalidAnthropicShapeEvent(
+  diagnostic: InvalidAnthropicShapeDiagnostic,
+): Extract<AdapterEvent, { type: "error" }> {
+  const at = diagnostic.blockIndex !== undefined ? `; blockIndex=${diagnostic.blockIndex}` : "";
+  const subject = diagnostic.reason === "content_not_array" ? "content" : "content block";
+  return {
+    type: "error",
+    message: `anthropic response contained invalid ${subject} (${diagnostic.reason}${at}; valueType=${diagnostic.valueType})`,
+    status: 502,
+    errorType: "upstream_error",
+  };
+}
+
+function extractAnthropicErrorDetail(parsed: unknown): string | undefined {
+  if (typeof parsed === "string") return parsed.trim() || undefined;
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return undefined;
+  const obj = parsed as Record<string, unknown>;
+  // Anthropic envelope: { type: "error", error: { type, message } }; tolerate a bare
+  // { error: { message } } and a string error field.
+  const err = obj.error;
+  if (typeof err === "string" && err.trim()) return err.trim();
+  if (err !== null && typeof err === "object" && !Array.isArray(err)) {
+    const e = err as Record<string, unknown>;
+    const msg = e.message;
+    if (typeof msg !== "string" || !msg.trim()) return undefined;
+    const type = e.type;
+    return typeof type === "string" && type.trim()
+      ? `${type.trim()}: ${msg.trim()}`
+      : msg.trim();
+  }
+  return undefined;
+}
+
 function usesNativeAnthropicEndpoint(provider: OcxProviderConfig): boolean {
   try {
     return new URL(provider.baseUrl).hostname === "api.anthropic.com";
@@ -277,7 +353,69 @@ function usableToolUseId(id: unknown): string {
   return typeof id === "string" && id.trim() ? id : synthesizeToolUseId();
 }
 
-function toolUseArguments(input: unknown): string {
+/**
+ * Bound repair for a malformed tool-arguments string under the compatibility profile (#658):
+ * a gateway such as AgentRouter can concatenate JSON objects (`{}{"value":42}`). Find the
+ * last parseable JSON object by scanning suffixes from each object-open brace and prefixes
+ * ending at each object-close brace. Both scans walk backwards from the end trying at most
+ * `maxCandidates` positions, so no offset index is ever materialized: a brace-dense hostile
+ * input costs at most 2 × maxCandidates bounded JSON.parse attempts and no extra storage.
+ * Inputs above MAX_REPAIRABLE_TOOL_ARGUMENT_BYTES are not repaired at all.
+ */
+const MAX_REPAIRABLE_TOOL_ARGUMENT_BYTES = 1024 * 1024;
+
+/**
+ * Whether `input` encodes to more than `max` UTF-8 bytes, with an early exit so the check
+ * itself never allocates a copy of a hostile string. `string.length` counts UTF-16 code
+ * units, which undercounts astral text by 2x against a byte budget.
+ */
+function utf8BytesExceed(input: string, max: number): boolean {
+  let bytes = 0;
+  for (let i = 0; i < input.length; i++) {
+    const code = input.charCodeAt(i);
+    if (code < 0x80) bytes += 1;
+    else if (code < 0x800) bytes += 2;
+    else if (code >= 0xd800 && code <= 0xdbff && i + 1 < input.length
+      && input.charCodeAt(i + 1) >= 0xdc00 && input.charCodeAt(i + 1) <= 0xdfff) {
+      // A complete surrogate pair is one 4-byte scalar. Anything else — a high surrogate
+      // followed by another high surrogate or a non-surrogate — encodes as two separate
+      // U+FFFD replacements, so the next unit must NOT be skipped.
+      bytes += 4;
+      i++;
+    } else bytes += 3; // lone surrogates encode as U+FFFD (3 bytes)
+    if (bytes > max) return true;
+  }
+  return false;
+}
+
+function lastValidJsonObject(input: string, maxCandidates: number): string | undefined {
+  const tryParseObject = (candidate: string): string | undefined => {
+    try {
+      const parsed = JSON.parse(candidate) as unknown;
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return candidate;
+    } catch { /* keep scanning */ }
+    return undefined;
+  };
+  let scanFrom = input.length - 1;
+  for (let tried = 0; tried < maxCandidates && scanFrom >= 0; tried++) {
+    const open = input.lastIndexOf("{", scanFrom);
+    if (open === -1) break;
+    const repaired = tryParseObject(input.slice(open));
+    if (repaired !== undefined) return repaired;
+    scanFrom = open - 1;
+  }
+  scanFrom = input.length - 1;
+  for (let tried = 0; tried < maxCandidates && scanFrom >= 0; tried++) {
+    const close = input.lastIndexOf("}", scanFrom);
+    if (close === -1) break;
+    const repaired = tryParseObject(input.slice(0, close + 1));
+    if (repaired !== undefined) return repaired;
+    scanFrom = close - 1;
+  }
+  return undefined;
+}
+
+function toolUseArguments(input: unknown, lenient = false): string {
   if (typeof input === "string") {
     const trimmed = input.trim();
     if (!trimmed) return "{}";
@@ -285,6 +423,10 @@ function toolUseArguments(input: unknown): string {
       JSON.parse(trimmed);
       return trimmed;
     } catch {
+      if (lenient && !utf8BytesExceed(trimmed, MAX_REPAIRABLE_TOOL_ARGUMENT_BYTES)) {
+        const repaired = lastValidJsonObject(trimmed, 32);
+        if (repaired !== undefined) return repaired;
+      }
       // A tool call's arguments must be a JSON object. Re-encoding an unparseable string as a
       // JSON *string* is the double-encoding #765 reports: the caller then receives
       // `"get weather"` where an object was required and the tool call is unusable either way.
@@ -342,16 +484,68 @@ const ADAPTIVE_THINKING_FAMILY_MINIMUMS: Record<string, readonly [major: number,
   fable: [0, 0],
 };
 
-function usesAdaptiveThinking(modelId: string): boolean {
-  // Minor is 1-2 digits with a non-digit lookahead so date-pinned ids ("claude-opus-4-20250514")
-  // parse as minor 0 instead of minor 20250514; suffixed ids ("claude-opus-4-8[1m]") still match.
-  const match = /^claude-([a-z]+)-(\d+)(?:-(\d{1,2}))?(?!\d)/.exec(modelId);
-  if (!match) return false;
-  const minimum = ADAPTIVE_THINKING_FAMILY_MINIMUMS[match[1]];
+/**
+ * Family/version parse for a Claude model id, tolerant of a routing prefix.
+ *
+ * `parsed.modelId` is not always bare, and the slash can fall on either side.
+ * A `modelMap` entry may point at a routed destination such as
+ * `anthropic/claude-sonnet-5` (prefix), while a custom provider may expose a
+ * native id such as `claude-sonnet-5/variant` (suffix); both survive routing's
+ * known-id decoding. So this matches the segment that actually begins with
+ * `claude-` rather than assuming it is the first or the last one. A capability
+ * predicate that quietly returns false is worse than one that throws — the
+ * request just goes out wrong.
+ *
+ * Minor is 1-2 digits with a non-digit lookahead so date-pinned ids
+ * ("claude-opus-4-20250514") parse as minor 0 instead of minor 20250514;
+ * suffixed ids ("claude-opus-4-8[1m]") still match.
+ */
+function claudeFamilyVersion(modelId: string): { family: string; major: number; minor: number } | undefined {
+  // Find the segment that actually starts with `claude-`, rather than assuming it is either
+  // the first (breaks `anthropic/claude-sonnet-5`) or the last (breaks `claude-sonnet-5/variant`,
+  // where the slash carries a vendor suffix rather than a routing prefix).
+  const match = /(?:^|\/)claude-([a-z]+)-(\d+)(?:[.-](\d{1,2}))?(?!\d)/i.exec(modelId);
+  if (!match) return undefined;
+  return {
+    family: match[1]!.toLowerCase(),
+    major: Number(match[2]),
+    minor: match[3] === undefined ? 0 : Number(match[3]),
+  };
+}
+
+function meetsFamilyMinimum(
+  modelId: string,
+  minimums: Record<string, readonly [major: number, minor: number]>,
+): boolean {
+  const parsed = claudeFamilyVersion(modelId);
+  if (!parsed) return false;
+  const minimum = minimums[parsed.family];
   if (!minimum) return false;
-  const major = Number(match[2]);
-  const minor = match[3] === undefined ? 0 : Number(match[3]);
-  return major > minimum[0] || (major === minimum[0] && minor >= minimum[1]);
+  return parsed.major > minimum[0] || (parsed.major === minimum[0] && parsed.minor >= minimum[1]);
+}
+
+function usesAdaptiveThinking(modelId: string): boolean {
+  return meetsFamilyMinimum(modelId, ADAPTIVE_THINKING_FAMILY_MINIMUMS);
+}
+
+/**
+ * Claude families that (a) think by DEFAULT when the request omits `thinking`,
+ * and (b) accept an explicit `thinking: {type: "disabled"}` to turn it off.
+ *
+ * Deliberately NOT `usesAdaptiveThinking()`, which answers a different question
+ * (which wire shape a family accepts). The two sets differ in both directions:
+ * Fable always thinks and REJECTS an explicit disable, while Opus 4.7/4.8 use
+ * the adaptive wire but leave thinking off when the field is omitted, so they
+ * need no disable at all. Seeded with the family where the defect reproduces
+ * (#545); widen only with vendor evidence, since a wrong entry here turns a
+ * silent truncation into a 400.
+ */
+const EXPLICIT_THINKING_DISABLE_FAMILY_MINIMUMS: Record<string, readonly [major: number, minor: number]> = {
+  sonnet: [5, 0],
+};
+
+function supportsExplicitThinkingDisable(modelId: string): boolean {
+  return meetsFamilyMinimum(modelId, EXPLICIT_THINKING_DISABLE_FAMILY_MINIMUMS);
 }
 
 /** `output_config.effort` accepts low|medium|high|xhigh|max — "minimal" is rejected with a 400. */
@@ -359,6 +553,18 @@ function adaptiveEffort(effort: string): string {
   return effort === "minimal" ? "low" : effort;
 }
 
+function defaultReasoningEffort(provider: OcxProviderConfig, modelId: string): string | undefined {
+  const value = modelRecordValue(provider.modelDefaultReasoningEfforts, modelId);
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  // `__omit__` means "send no reasoning field", not "an effort literally named
+  // __omit__". Without this the sentinel reached the wire as
+  // `output_config.effort: "__omit__"` on adaptive models, and enabled budget
+  // thinking on the rest — the opposite of what it asks for (#2432).
+  if (!trimmed || isReasoningEffortOmitted(trimmed)) return undefined;
+  return trimmed;
+}
+
 function usageFromAnthropic(usage: Record<string, number> | undefined): OcxUsage | undefined {
   if (!usage) return undefined;
   const hasCache = usage.cache_read_input_tokens !== undefined || usage.cache_creation_input_tokens !== undefined;
@@ -401,7 +607,7 @@ function buildToolNameTransforms(provider: OcxProviderConfig): { toWire: (name:
   return { toWire: (name) => name, fromWire: (name) => name };
 }
 
-function toAnthropicToolResult(msg: OcxToolResultMessage): Record<string, unknown> {
+function toAnthropicToolResult(msg: OcxToolResultMessage, wireCallId: string): Record<string, unknown> {
   // Anthropic tool_result accepts a string OR content blocks — render images natively
   // (e.g. Codex view_image output) instead of dropping them.
   let content: string | unknown[];
@@ -416,12 +622,17 @@ function toAnthropicToolResult(msg: OcxToolResultMessage): Record<string, unknow
   }
   return {
     type: "tool_result",
-    tool_use_id: msg.toolCallId,
+    tool_use_id: wireCallId,
     content,
     ...(msg.isError ? { is_error: true } : {}),
   };
 }
 
+function unrepresentableToolCallText(tc: OcxToolCall, wireName: string): string {
+  const args = typeof tc.arguments === "string" ? tc.arguments : JSON.stringify(tc.arguments);
+  return `[tool_use without a usable id: ${wireName}]\n${args}`;
+}
+
 function orphanToolResultText(msg: OcxToolResultMessage): string {
   const label = msg.toolName ? `${msg.toolName} (${msg.toolCallId})` : msg.toolCallId;
   const content = typeof msg.content === "string"
@@ -430,10 +641,80 @@ function orphanToolResultText(msg: OcxToolResultMessage): string {
   return `[tool_result without adjacent tool_use: ${label}]\n${content}`;
 }
 
+/**
+ * AgentRouter answers 400 `content-blocked` when the first user message is not in English
+ * (#2074), while the same request in English returns 200. The gateway is inspecting the opening
+ * user content, so an Anthropic `system` string cannot reach it — the framing has to sit in the
+ * first user turn.
+ */
+const AGENTROUTER_LANGUAGE_PREAMBLE =
+  "[Instruction: Process the user request below and respond in the appropriate language.]";
+
+/**
+ * Exact host match, not a substring.
+ *
+ * A `hostname.includes("agentrouter")` test also matches `notagentrouter.example` and
+ * `agentrouter.org.attacker.example`, which would let an unrelated destination silently
+ * receive an injected instruction block. A prompt mutation keyed on a provider's identity
+ * must be keyed on that identity exactly.
+ */
+function isAgentRouterEndpoint(baseUrl: string): boolean {
+  try {
+    const { hostname } = new URL(baseUrl);
+    return hostname === "agentrouter.org" || hostname.endsWith(".agentrouter.org");
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Prepend the framing as its OWN text block instead of splicing it into the user's string.
+ *
+ * The distinction matters: rewriting `content` to `${marker}\n\n${original}` edits what the
+ * user wrote, and every downstream consumer — logs, retries, an upstream that echoes the turn —
+ * then sees a sentence the user never typed as if they had. A separate leading block carries the
+ * same signal to the filter while the original text survives byte-for-byte.
+ *
+ * Only the first user turn is framed, because only the first is what the gateway rejects.
+ */
+function applyAgentRouterLanguageFraming(messages: unknown[]): void {
+  const firstUser = messages.find(
+    (m): m is { role: string; content: unknown } =>
+      typeof m === "object" && m !== null && (m as { role?: unknown }).role === "user",
+  );
+  if (!firstUser) return;
+  const preamble = { type: "text", text: AGENTROUTER_LANGUAGE_PREAMBLE };
+  if (typeof firstUser.content === "string") {
+    firstUser.content = firstUser.content === ""
+      ? [preamble]
+      : [preamble, { type: "text", text: firstUser.content }];
+    return;
+  }
+  if (!Array.isArray(firstUser.content)) return;
+  // Idempotence is keyed on the LEADING block being exactly the marker. A substring test would
+  // let a user who quotes the marker later in their own prompt suppress the framing entirely.
+  const [head] = firstUser.content as { type?: unknown; text?: unknown }[];
+  if (head?.type === "text" && head.text === AGENTROUTER_LANGUAGE_PREAMBLE) return;
+  (firstUser.content as unknown[]).unshift(preamble);
+}
+
 function messagesToAnthropicFormat(
   parsed: OcxParsedRequest,
   toolNames: { toWire: (name: string) => string },
 ): { system: string | undefined; messages: unknown[] } {
+  // One allocator for the whole request: a tool_result must resolve to the SAME wire id its
+  // call got, and two distinct raw ids must never collapse into one. Conforming ids are claimed
+  // first so a rewritten id can never squat on an id another call legitimately owns.
+  const callIds = createToolCallIdAllocator();
+  for (const message of parsed.context.messages) {
+    if (message.role === "assistant") {
+      for (const part of (message as OcxAssistantMessage).content) {
+        if (part.type === "toolCall") callIds.reserve((part as OcxToolCall).id);
+      }
+    } else if (message.role === "toolResult") {
+      callIds.reserve((message as OcxToolResultMessage).toolCallId);
+    }
+  }
   const toolCatalogNudge = buildNonOpenAIToolCatalogNudgeForTools(
     parsed.context.tools,
     parsed.options.toolChoice,
@@ -441,7 +722,7 @@ function messagesToAnthropicFormat(
   );
   const systemParts = [...(parsed.context.systemPrompt ?? []), ...(toolCatalogNudge ? [toolCatalogNudge] : [])];
   const system = systemParts.length
-    ? neutralizeIdentity(systemParts.join("\n\n")) || undefined
+    ? identifyRoutedModel(systemParts.join("\n\n"), parsed.modelId) || undefined
     : undefined;
   const messages: unknown[] = [];
 
@@ -485,8 +766,17 @@ function messagesToAnthropicFormat(
           } else if (part.type === "toolCall") {
             const tc = part as OcxToolCall;
             const flatName = namespacedToolName(tc.namespace, tc.name);
-            toolUseIds.push(tc.id);
-            toolUses.push({ type: "tool_use", id: tc.id, name: toolNames.toWire(flatName), input: tc.arguments });
+            // Normalized here, and identically for the matching tool_result above, so a history
+            // replayed from another provider path keeps its call/result pairing (#1767).
+            // No raw fallback: restoring an empty/unusable id puts a value on the wire Anthropic
+            // rejects. An unrepresentable call becomes text instead, and its result follows it there.
+            const wireCallId = callIds.allocate(tc.id);
+            if (wireCallId === undefined) {
+              preface.push({ type: "text", text: unrepresentableToolCallText(tc, toolNames.toWire(flatName)) });
+              continue;
+            }
+            toolUseIds.push(wireCallId);
+            toolUses.push({ type: "tool_use", id: wireCallId, name: toolNames.toWire(flatName), input: tc.arguments });
           }
         }
         // Anthropic treats text/thinking after tool_use as ending the tool turn, which makes
@@ -502,9 +792,13 @@ function messagesToAnthropicFormat(
           let j = i + 1;
           while (j < parsed.context.messages.length && parsed.context.messages[j].role === "toolResult") {
             const tr = parsed.context.messages[j] as OcxToolResultMessage;
-            if (requiredIds.has(tr.toolCallId) && !seen.has(tr.toolCallId)) {
-              resultBlocks.push(toAnthropicToolResult(tr));
-              seen.add(tr.toolCallId);
+            // Match on the WIRE id. requiredIds holds normalized ids, so comparing the raw result id
+            // made every rewritten pair lose its result to orphan text and gain a synthetic
+            // missing-result block. lookup() never mints an id: a result with no call stays orphan.
+            const wireResultId = callIds.lookup(tr.toolCallId);
+            if (wireResultId !== undefined && requiredIds.has(wireResultId) && !seen.has(wireResultId)) {
+              resultBlocks.push(toAnthropicToolResult(tr, wireResultId));
+              seen.add(wireResultId);
             } else {
               orphanBlocks.push({ type: "text", text: orphanToolResultText(tr) });
             }
@@ -549,11 +843,8 @@ function messagesToAnthropicFormat(
 
 function toolsToAnthropicFormat(parsed: OcxParsedRequest, toolNames: { toWire: (name: string) => string }): unknown[] | undefined {
   if (!parsed.context.tools || parsed.context.tools.length === 0) return undefined;
-  const allowed = isAllowedToolChoice(parsed.options.toolChoice)
-    ? new Set(parsed.options.toolChoice.allowedTools)
-    : undefined;
-  const tools = allowed
-    ? parsed.context.tools.filter(t => toolAllowedByChoice(t, allowed))
+  const tools = isAllowedToolChoice(parsed.options.toolChoice)
+    ? parsed.context.tools.filter(toolChoiceToolPredicate(parsed.options.toolChoice, parsed.context.tools))
     : parsed.context.tools;
   if (tools.length === 0) return undefined;
   const converted = tools.map(t => ({
@@ -564,35 +855,8 @@ function toolsToAnthropicFormat(parsed: OcxParsedRequest, toolNames: { toWire: (
   return converted;
 }
 
-// Codex multi-agent v2 stamps a Responses-only `encrypted: true` marker on
-// collaboration tool schemas (openai/codex 5f4d06ef; issue #85). It is an
-// annotation for the ChatGPT backend only. Anthropic input_schema is strict
-// JSON Schema; strip the marker defensively everywhere it can appear as a
-// schema keyword, while preserving properties literally named "encrypted".
-const ENCRYPTED_MARKER_NAME_BAG_KEYS = new Set(["properties", "patternProperties", "$defs", "definitions"]);
-const ENCRYPTED_MARKER_LITERAL_VALUE_KEYS = new Set(["const", "default", "enum", "examples"]);
-
-function stripEncryptedMarker(node: unknown, inNameBag = false): unknown {
-  if (Array.isArray(node)) return node.map(item => stripEncryptedMarker(item));
-  if (!node || typeof node !== "object") return node;
-
-  const out: Record<string, unknown> = {};
-
-  for (const [key, value] of Object.entries(node as Record<string, unknown>)) {
-    if (inNameBag) {
-      out[key] = stripEncryptedMarker(value);
-    } else if (key !== "encrypted") {
-      out[key] = ENCRYPTED_MARKER_LITERAL_VALUE_KEYS.has(key)
-        ? value
-        : stripEncryptedMarker(value, ENCRYPTED_MARKER_NAME_BAG_KEYS.has(key));
-    }
-  }
-
-  return out;
-}
-
 function normalizeAnthropicInputSchema(schema: unknown): Record<string, unknown> {
-  const stripped = stripEncryptedMarker(schema);
+  const stripped = stripResponsesOnlyEncryptedMarker(schema);
   const obj = stripped && typeof stripped === "object" && !Array.isArray(stripped)
     ? stripped as Record<string, unknown>
     : {};
@@ -659,6 +923,8 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
   return {
     name: "anthropic",
 
+    formatErrorBody: formatAnthropicErrorBody,
+
     async buildRequest(parsed: OcxParsedRequest, incoming?: IncomingMeta) {
       if (typeof provider.apiKey !== "string" || provider.apiKey.trim() === "") {
         if (isOAuth) {
@@ -668,6 +934,8 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
       }
 
       const { system, messages } = messagesToAnthropicFormat(parsed, toolNames);
+      // Before image normalization, so the framing block is present for every downstream pass.
+      if (isAgentRouterEndpoint(provider.baseUrl)) applyAgentRouterLanguageFraming(messages);
       // Primary image layer: resize/re-encode to fit Anthropic limits without dropping
       // (anthropic-image-normalize.ts); the guard below remains the deterministic backstop.
       // imageTierBias > 0 = upstream-413 tightened retry (030): start every image one tier lower.
@@ -700,16 +968,25 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
       // `reasoning` is a Codex effort string; "none" is the disable sentinel (see parser.ts
       // REASONING_EFFORTS). A bare truthy check would treat "none" as truthy and wrongly enable
       // extended thinking (and strip temperature/top_p), so gate on a real, non-disable effort.
-      if (typeof parsed.options.reasoning === "string" && parsed.options.reasoning !== "none") {
+      //
+      // "none" is not the same as absent. Omitting `thinking` lets a default-on model think
+      // anyway, and thinking shares the caller's `max_tokens` — which truncates a small-budget
+      // request before it can emit its stop sequence (#545). Say "disabled" out loud where the
+      // model both defaults to thinking and accepts being told not to.
+      const effectiveReasoning = parsed.options.reasoning ?? defaultReasoningEffort(provider, parsed.modelId);
+      if (effectiveReasoning === "none" && supportsExplicitThinkingDisable(parsed.modelId)) {
+        body.thinking = { type: "disabled" };
+      } else if (typeof effectiveReasoning === "string" && effectiveReasoning !== "none") {
         if (usesAdaptiveThinking(parsed.modelId)) {
           // Adaptive-thinking models replace the token budget with an effort knob and reject
           // `thinking.type: "enabled"` outright. `max_tokens` still caps thinking plus visible
           // output, so high effort needs the same total-token headroom as budget thinking or a
           // default 8192-token request can spend everything on thought and return empty text.
           body.thinking = { type: "adaptive" };
-          body.output_config = { effort: adaptiveEffort(parsed.options.reasoning) };
+          const effort = adaptiveEffort(effectiveReasoning);
+          body.output_config = { effort };
           const explicitMaxOut = parsed.options.maxOutputTokens;
-          const wantBudget = reasoningBudget(parsed.options.reasoning);
+          const wantBudget = reasoningBudget(effort);
           const floor = wantBudget + OUTPUT_HEADROOM;
           // Preserve explicit caller limits as-is; for omitted limits use the adaptive ceiling
           // so effort=max (budget=32k) still leaves OUTPUT_HEADROOM tokens for visible output.
@@ -722,7 +999,7 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
           // 400s ("max_tokens must be greater than thinking.budget_tokens"). Size them so max_tokens
           // always exceeds the budget within a model-safe ceiling, reserving room for visible output.
           const maxOut = parsed.options.maxOutputTokens ?? DEFAULT_MAX_TOKENS;
-          const wantBudget = reasoningBudget(parsed.options.reasoning);
+          const wantBudget = reasoningBudget(effectiveReasoning);
           const maxTokens = Math.min(REASONING_MAX_TOKENS_CEILING, Math.max(maxOut, wantBudget + OUTPUT_HEADROOM));
           const budget = Math.max(MIN_THINKING_BUDGET, Math.min(wantBudget, maxTokens - OUTPUT_FLOOR));
           body.max_tokens = maxTokens;
@@ -733,6 +1010,20 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
         delete body.top_p;
       }
 
+      const textFormat = parsed.options.textFormat;
+      if (textFormat?.type === "json_schema" && textFormat.schema) {
+        const outputConfig = body.output_config;
+        body.output_config = {
+          ...(outputConfig && typeof outputConfig === "object" && !Array.isArray(outputConfig)
+            ? outputConfig
+            : {}),
+          format: {
+            type: "json_schema",
+            schema: normalizeAnthropicOutputSchema(textFormat.schema),
+          },
+        };
+      }
+
       if (parsed.options.toolChoice && (tools || parsed.options.toolChoice === "none")) {
         const tc = parsed.options.toolChoice;
         if (tc === "auto") body.tool_choice = { type: "auto" };
@@ -798,10 +1089,23 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
       let pendingUsage: Record<string, number> | undefined;
       let pendingStopReason: string | undefined;
       let emittedDone = false;
+      let sawVisibleText = false;
 
       const emitDone = function* (): Generator<AdapterEvent> {
         if (emittedDone) return;
         emittedDone = true;
+        // An `error` stop reason is a failed generation, not a stop. Forwarding it as `done`
+        // lets the turn report success and install replacement history on a compaction turn.
+        if (pendingStopReason === "error") {
+          yield {
+            type: "error",
+            message: "upstream ended the turn with stop_reason \"error\"",
+            status: 502,
+            errorType: "upstream_error",
+            usage: usageFromAnthropic(pendingUsage),
+          };
+          return;
+        }
         yield {
           type: "done",
           usage: usageFromAnthropic(pendingUsage),
@@ -818,13 +1122,21 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
         const payload = record.data.trim();
         if (!payload) continue;
 
-        let data: Record<string, unknown>;
+        let parsed: unknown;
         try {
-          data = JSON.parse(payload) as Record<string, unknown>;
+          parsed = JSON.parse(payload);
         } catch {
           debugDroppedFrame("anthropic", payload);
           continue;
         }
+        // `JSON.parse("null")` returns null instead of throwing, so the catch above cannot cover
+        // it and the `data.type` read below crashed the stream. Drop a non-record frame the same
+        // way an unparseable one is dropped, so the message_stop check still governs the outcome.
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+          debugDroppedFrame("anthropic", payload);
+          continue;
+        }
+        const data = parsed as Record<string, unknown>;
 
         switch (record.event || data.type) {
               case "message_start": {
@@ -853,6 +1165,10 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
                 const delta = data.delta as Record<string, unknown> | undefined;
                 if (!delta) break;
                 if (delta.type === "text_delta" && typeof delta.text === "string") {
+                  // Only non-empty text proves the upstream produced usable output; an empty
+                  // delta followed by EOF must stay a truncation error even on the tolerant
+                  // profile, or a cut-off turn would surface as a successful empty answer.
+                  if (delta.text.length > 0) sawVisibleText = true;
                   yield { type: "text_delta", text: delta.text };
                 } else if (delta.type === "thinking_delta" && typeof delta.thinking === "string") {
                   yield { type: "thinking_delta", thinking: delta.thinking };
@@ -934,12 +1250,31 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
           code: "translation_buffer_limit",
           message: "upstream translation buffer exceeded the safe limit",
         };
+        // The budget error IS the terminal event for this stream. Falling through to the
+        // EOF handling below could append tool_call_end/done after it, violating the
+        // one-terminal-event contract for consumers that keep draining the generator.
+        return;
       } finally {
         if (currentToolCallId) budget.closeCall(currentToolCallId);
       }
       if (!emittedDone) {
         // Fail closed on transport EOF. Compatible providers may omit message_stop after message_delta.stop_reason.
         if (pendingStopReason !== undefined) {
+          // Same rule as emitDone: an `error` stop reason is a failed generation, not a stop.
+          // This branch bypasses emitDone entirely (it exists for providers that close after
+          // message_delta without message_stop), so the check has to be repeated here or the
+          // EOF route silently reports success.
+          if (pendingStopReason === "error") {
+            emittedDone = true;
+            yield {
+              type: "error",
+              message: "upstream ended the turn with stop_reason \"error\"",
+              status: 502,
+              errorType: "upstream_error",
+              usage: usageFromAnthropic(pendingUsage),
+            };
+            return;
+          }
           const stopReason = pendingStopReason === "max_tokens"
             ? "max_tokens"
             : pendingStopReason === "refusal" || pendingStopReason === "content_filter"
@@ -951,6 +1286,26 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
             usage: usageFromAnthropic(pendingUsage),
             ...(stopReason ? { stopReason } : {}),
           };
+        } else if (provider.anthropicEofTolerance === true) {
+          // AgentRouter-style compatibility profile (#658): the upstream can close the stream
+          // after valid content without terminal frames. Complete only when visible text was
+          // received or an open tool call has complete JSON-object arguments; everything else
+          // (incomplete tool JSON, no usable content, transport failure) stays a truncation
+          // error, matching the strict default.
+          if (currentToolCallId) {
+            if (streamedToolArgumentsParse(currentToolCallJson)) {
+              budget.closeCall(currentToolCallId);
+              currentToolCallId = "";
+              yield { type: "tool_call_end" };
+              yield* emitDone();
+            } else {
+              yield { type: "error", message: "upstream stream ended before message_stop — possible truncation" };
+            }
+          } else if (sawVisibleText) {
+            yield* emitDone();
+          } else {
+            yield { type: "error", message: "upstream stream ended before message_stop — possible truncation" };
+          }
         } else {
           yield { type: "error", message: "upstream stream ended before message_stop — possible truncation" };
         }
@@ -958,12 +1313,55 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
     },
 
     async parseResponse(response: Response, budget: TranslatorBudget): Promise<AdapterEvent[]> {
-      const json = await response.json() as Record<string, unknown>;
+      const parsed: unknown = await response.json();
+      // `response.json()` resolves a body of `null` to `null` without throwing, so the cast below
+      // used to reach `json.content` on it — the #1219 defect at the buffered body root. The
+      // streaming parser has skipped a non-record frame since #1240, but a buffered body has no
+      // next frame to recover into, so this fails closed instead.
+      if (!isAnthropicRecord(parsed)) {
+        return [{
+          type: "error",
+          message: `anthropic response was not a JSON object (${anthropicStructuralValueType(parsed)})`,
+          status: 502,
+          errorType: "upstream_error",
+        }];
+      }
+      const json = parsed;
       const responseBytes = new TextEncoder().encode(JSON.stringify(json)).byteLength;
       budget.chargeRetained(responseBytes, { kind: "retained_collectors" });
       try {
       const events: AdapterEvent[] = [];
-      const content = json.content as { type: string; text?: string; id?: string; name?: string; input?: unknown; thinking?: string; reasoning?: string; signature?: string; data?: string }[] | undefined;
+      // Same retain-then-return tail every other terminal branch in this function uses; naming it
+      // keeps the two shape guards below from drifting out of step with the accounting.
+      const finishWithEvents = (batch: AdapterEvent[]): AdapterEvent[] => {
+        retainTranslatedEventBatch(batch, budget);
+        return batch;
+      };
+      const rawContent: unknown = json.content;
+      // `content` is claimed model output inside a well-formed response, so it is governed by the
+      // #1332 nested-shape rule (fail closed) rather than #1240's root-frame padding rule (skip).
+      // Absence stays legal in both encodings. A present non-array was silently accepted and is
+      // the dangerous case: a string is iterable, so `for (const block of "text")` walked it one
+      // CHARACTER at a time, read `undefined` from every `block.type`, and completed the turn as a
+      // successful empty response — the #2231 failure mode on a different adapter.
+      if (rawContent !== undefined && rawContent !== null && !Array.isArray(rawContent)) {
+        return finishWithEvents([invalidAnthropicShapeEvent({
+          reason: "content_not_array",
+          valueType: anthropicStructuralValueType(rawContent),
+        })]);
+      }
+      if (Array.isArray(rawContent)) {
+        for (let blockIndex = 0; blockIndex < rawContent.length; blockIndex++) {
+          if (!isAnthropicRecord(rawContent[blockIndex])) {
+            return finishWithEvents([invalidAnthropicShapeEvent({
+              reason: "content_block_not_object",
+              blockIndex,
+              valueType: anthropicStructuralValueType(rawContent[blockIndex]),
+            })]);
+          }
+        }
+      }
+      const content = rawContent as { type: string; text?: string; id?: string; name?: string; input?: unknown; thinking?: string; reasoning?: string; signature?: string; data?: string }[] | undefined;
       if (content) {
         for (const block of content) {
           if (block.type === "text" && block.text) {
@@ -980,13 +1378,28 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
           } else if (block.type === "tool_use") {
             const id = usableToolUseId(block.id);
             events.push({ type: "tool_call_start", id, name: toolNames.fromWire(block.name ?? "") });
-            events.push({ type: "tool_call_delta", arguments: toolUseArguments(block.input) });
+            events.push({ type: "tool_call_delta", arguments: toolUseArguments(block.input, provider.anthropicEofTolerance === true) });
             events.push({ type: "tool_call_end" });
           }
         }
       }
       const usage = json.usage as Record<string, number> | undefined;
       const stopReason = typeof json.stop_reason === "string" ? json.stop_reason : undefined;
+      // An Anthropic-compatible upstream can forward an `error` stop reason verbatim. As a
+      // `done` it reads as a clean completion, so the turn reports success and — on a compaction
+      // turn — installs its partial summary as replacement history (#422). Usage is preserved:
+      // a failed turn still consumed tokens.
+      if (stopReason === "error") {
+        events.push({
+          type: "error",
+          message: "upstream ended the turn with stop_reason \"error\"",
+          status: 502,
+          errorType: "upstream_error",
+          usage: usageFromAnthropic(usage),
+        });
+        retainTranslatedEventBatch(events, budget);
+        return events;
+      }
       events.push({
         type: "done",
         usage: usageFromAnthropic(usage),