@moxxy/plugin-provider-anthropic 0.2.0 → 0.2.2

package/dist/validate.js

@@ -18,9 +18,31 @@ export async function validateKey(key, deps = {}) {
         return { ok: true };
     }
     catch (err) {
-        return { ok: false, message: err instanceof Error ? err.message : String(err) };
+        return { ok: false, message: friendlyValidationError(err, key) };
     }
 }
+/**
+ * Map a key-validation failure to a fixed friendly string by HTTP status, never
+ * echoing raw SDK error text (which can embed request/proxy URLs or header
+ * fragments) verbatim. The fallback is truncated and any occurrence of the key
+ * is scrubbed so a reflected error can't leak it into setup UIs / logs.
+ */
+function friendlyValidationError(err, key) {
+    const status = err?.status;
+    if (typeof status === 'number') {
+        if (status === 401)
+            return 'key was rejected';
+        if (status === 403)
+            return 'key lacks access';
+        if (status === 429)
+            return 'rate limited — try again shortly';
+        if (status >= 500)
+            return 'Anthropic returned a server error';
+    }
+    const raw = err instanceof Error ? err.message : String(err);
+    const scrubbed = key ? raw.split(key).join('[redacted]') : raw;
+    return scrubbed.length > 200 ? `${scrubbed.slice(0, 200)}…` : scrubbed;
+}
 function defaultMaker(apiKey) {
     return new Anthropic({ apiKey });
 }

package/dist/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,mBAAmB,CAAC;AAY1C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAwB,EAAE;IACvE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,2BAA2B;YAChD,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;SAC9C,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAClF,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,CAE9B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,mBAAmB,CAAC;AAY1C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAwB,EAAE;IACvE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,2BAA2B;YAChD,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;SAC9C,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,GAAY,EAAE,GAAW;IACxD,MAAM,MAAM,GAAI,GAA+C,EAAE,MAAM,CAAC;IACxE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,kBAAkB,CAAC;QAC9C,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,kBAAkB,CAAC;QAC9C,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,kCAAkC,CAAC;QAC9D,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,mCAAmC,CAAC;IAChE,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/D,OAAO,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;AACzE,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,CAE9B,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moxxy/plugin-provider-anthropic",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Anthropic (Claude) LLMProvider plugin for moxxy. Streams the Messages API with tool use + adaptive thinking; translates moxxy ProviderRequest/Event ↔ the Anthropic wire shape. Register it into an @moxxy/core Session to route turns to Claude models.",
   "keywords": [
     "moxxy",
@@ -45,17 +45,17 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.40.0",
-    "@moxxy/sdk": "0.15.0"
+    "@moxxy/sdk": "0.15.2"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",
     "typescript": "^5.7.3",
     "vitest": "^2.1.8",
     "zod": "^3.24.0",
-    "@moxxy/mode-default": "0.1.0",
+    "@moxxy/core": "0.5.2",
+    "@moxxy/mode-default": "0.1.2",
     "@moxxy/tsconfig": "0.0.0",
-    "@moxxy/vitest-preset": "0.0.0",
-    "@moxxy/core": "0.3.0"
+    "@moxxy/vitest-preset": "0.0.0"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",

package/src/hardening.test.ts

@@ -0,0 +1,376 @@
+import { describe, expect, it } from 'vitest';
+import type Anthropic from '@anthropic-ai/sdk';
+import type { ProviderEvent, ProviderRequest } from '@moxxy/sdk';
+import { AnthropicProvider } from './provider.js';
+
+/**
+ * Worst-case / failure-path coverage for the hardening fixes in provider.ts
+ * that landed without a dedicated regression test:
+ *
+ *  - SDK stream teardown on early exit (abort / consumer abandonment) — the
+ *    `finally` block must force-abort the SDK stream so a half-open HTTP
+ *    connection can't linger under Esc-spam.
+ *  - OAuth refresh concurrency coalescing — two concurrent near-expiry callers
+ *    must share a single in-flight refresh (one endpoint hit, one client swap).
+ *  - countTokens offline fallback — must NOT serialize megabytes of base64 into
+ *    one mega-string; a multi-MB media blob yields a bounded, blob-independent
+ *    estimate.
+ *  - Index-less degraded stream — a stale, already-finished blockIndexToId entry
+ *    must not misroute a new tool block's input deltas.
+ *  - message_delta usage merge — delta-reported input/cache numbers win when
+ *    present, message_start values survive when absent.
+ */
+
+async function drain(it: AsyncIterable<ProviderEvent>): Promise<ProviderEvent[]> {
+  const out: ProviderEvent[] = [];
+  for await (const e of it) out.push(e);
+  return out;
+}
+
+/**
+ * A fake SDK stream object that is BOTH async-iterable AND exposes the
+ * `abort()` / `controller.abort()` surface the provider's finally-block reaches
+ * for. The inner generator hangs on an open "HTTP body" promise after the first
+ * events; that promise REJECTS the moment `abort()`/`controller.abort()` fires
+ * (or the request `signal` aborts), faithfully mirroring how the real SDK
+ * unblocks a pending `.next()` on teardown — so the test can't hang.
+ */
+function abortableStream(signal?: AbortSignal): {
+  stream: AsyncIterable<unknown> & { abort: () => void; controller: { abort: () => void } };
+  aborts: { abort: number; controller: number };
+} {
+  const aborts = { abort: 0, controller: 0 };
+  let rejectBody: ((e: Error) => void) | undefined;
+  const tearDown = (): void => rejectBody?.(Object.assign(new Error('aborted'), { name: 'AbortError' }));
+  signal?.addEventListener('abort', tearDown);
+  const controller = {
+    abort: () => {
+      aborts.controller += 1;
+      tearDown();
+    },
+  };
+  async function* gen(): AsyncGenerator<unknown> {
+    // First events so the provider enters the loop and records output, then
+    // hang on an open body until torn down.
+    yield { type: 'message_start', message: { usage: { input_tokens: 1, output_tokens: 0 } } };
+    yield { type: 'content_block_delta', delta: { type: 'text_delta', text: 'partial' } };
+    await new Promise<void>((_res, rej) => {
+      rejectBody = rej;
+    });
+  }
+  const g = gen();
+  const stream = Object.assign(g, {
+    abort: () => {
+      aborts.abort += 1;
+      tearDown();
+    },
+    controller,
+  });
+  return { stream, aborts };
+}
+
+describe('AnthropicProvider stream teardown', () => {
+  it('force-aborts the SDK stream when the signal aborts mid-stream', async () => {
+    const controller = new AbortController();
+    const { stream, aborts } = abortableStream(controller.signal);
+    const client = {
+      messages: { stream: () => stream, countTokens: async () => ({ input_tokens: 0 }) },
+    };
+    const p = new AnthropicProvider({ client: client as never });
+
+    const out: ProviderEvent[] = [];
+    const it = p.stream({ model: 'm', messages: [], signal: controller.signal })[
+      Symbol.asyncIterator
+    ]();
+    // Pull until the first content event arrives, then abort. The fake's open
+    // body promise rejects on signal-abort (as the real SDK does), unblocking
+    // the provider's pending pull so its catch/finally run deterministically.
+    // stream() yields its own message_start first; streamOnce does NOT emit a
+    // second one — it processes the fake's message_start silently, then yields
+    // the text_delta. So: pull1 = message_start, pull2 = text_delta 'partial',
+    // pull3 = provider awaits the hung body.
+    out.push((await it.next()).value); // message_start (from stream())
+    out.push((await it.next()).value); // text_delta 'partial'
+    const nextP = it.next(); // provider now awaits the hung body
+    controller.abort(); // rejects the body -> provider catch sees signal.aborted
+    out.push((await nextP).value); // 'aborted' error event
+    await it.next(); // drive generator to done (runs finally -> teardown)
+
+    // The finally-block tore the SDK stream down.
+    expect(aborts.abort + aborts.controller).toBeGreaterThan(0);
+    const abortedErr = out.find((e) => e?.type === 'error');
+    expect(abortedErr).toMatchObject({ message: 'aborted', retryable: false });
+  });
+
+  it('force-aborts the SDK stream when the consumer abandons the generator between events', async () => {
+    // Here the body is NOT hung: events stream eagerly. The consumer pulls a few
+    // then `.return()`s before the stream completes. The for-await is suspended
+    // BETWEEN yields (not inside an un-abortable await), so .return() unwinds it
+    // and our finally runs the teardown (drained never became true).
+    const aborts = { abort: 0, controller: 0 };
+    async function* gen(): AsyncGenerator<unknown> {
+      yield { type: 'message_start', message: { usage: { input_tokens: 1, output_tokens: 0 } } };
+      yield { type: 'content_block_delta', delta: { type: 'text_delta', text: 'a' } };
+      yield { type: 'content_block_delta', delta: { type: 'text_delta', text: 'b' } };
+      yield { type: 'content_block_delta', delta: { type: 'text_delta', text: 'c' } };
+      yield { type: 'message_delta', delta: { stop_reason: 'end_turn' }, usage: { output_tokens: 1 } };
+      yield { type: 'message_stop' };
+    }
+    const stream = Object.assign(gen(), {
+      abort: () => {
+        aborts.abort += 1;
+      },
+      controller: {
+        abort: () => {
+          aborts.controller += 1;
+        },
+      },
+    });
+    const client = {
+      messages: { stream: () => stream, countTokens: async () => ({ input_tokens: 0 }) },
+    };
+    const p = new AnthropicProvider({ client: client as never });
+
+    const it = p.stream({ model: 'm', messages: [] })[Symbol.asyncIterator]();
+    await it.next(); // message_start (stream())
+    await it.next(); // message_start (streamOnce)
+    await it.next(); // text_delta 'a'
+    // Consumer walks away before the stream completes (drained stays false).
+    await it.return?.(undefined);
+
+    expect(aborts.abort + aborts.controller).toBeGreaterThan(0);
+  });
+
+  it('does NOT abort the SDK stream on a clean completion (no teardown on the happy path)', async () => {
+    const aborts = { abort: 0, controller: 0 };
+    async function* gen(): AsyncGenerator<unknown> {
+      yield { type: 'message_start', message: { usage: { input_tokens: 1, output_tokens: 0 } } };
+      yield { type: 'content_block_delta', delta: { type: 'text_delta', text: 'hi' } };
+      yield { type: 'message_delta', delta: { stop_reason: 'end_turn' }, usage: { output_tokens: 1 } };
+      yield { type: 'message_stop' };
+    }
+    const stream = Object.assign(gen(), {
+      abort: () => {
+        aborts.abort += 1;
+      },
+      controller: {
+        abort: () => {
+          aborts.controller += 1;
+        },
+      },
+    });
+    const client = {
+      messages: { stream: () => stream, countTokens: async () => ({ input_tokens: 0 }) },
+    };
+    const p = new AnthropicProvider({ client: client as never });
+    const out = await drain(p.stream({ model: 'm', messages: [] }));
+    expect(out.at(-1)).toMatchObject({ type: 'message_end', stopReason: 'end_turn' });
+    // Drained naturally — teardown must NOT fire (would abort an already-closed
+    // request and could cancel keep-alive reuse).
+    expect(aborts.abort + aborts.controller).toBe(0);
+  });
+});
+
+describe('AnthropicProvider OAuth refresh concurrency', () => {
+  it('coalesces concurrent near-expiry refreshes onto a single in-flight refresh', async () => {
+    let refreshCalls = 0;
+    let resolveRefresh: ((v: { token: string; expiresAt: number }) => void) | undefined;
+    const refreshGate = new Promise<{ token: string; expiresAt: number }>((res) => {
+      resolveRefresh = res;
+    });
+
+    const streamCalls = { n: 0 };
+    const fakeStream = (): AsyncIterable<unknown> =>
+      (async function* () {
+        streamCalls.n += 1;
+        yield { type: 'message_start', message: { usage: { input_tokens: 1, output_tokens: 0 } } };
+        yield { type: 'message_delta', delta: { stop_reason: 'end_turn' }, usage: { output_tokens: 1 } };
+        yield { type: 'message_stop' };
+      })();
+    const client = {
+      messages: { stream: fakeStream, countTokens: async () => ({ input_tokens: 0 }) },
+    } as unknown as Anthropic;
+
+    const p = new AnthropicProvider({
+      oauthToken: 'tok-old',
+      oauthExpiresAt: Date.now() + 5_000, // inside skew window -> both callers want a refresh
+      oauthRefresh: async () => {
+        refreshCalls += 1;
+        return refreshGate;
+      },
+      client,
+    });
+    // Pin the fake across the refresh-driven client rebuild.
+    const internals = p as unknown as {
+      client: Anthropic;
+      makeOauthClient: (t: string) => Anthropic;
+    };
+    internals.makeOauthClient = () => client;
+
+    const baseReq: ProviderRequest = { model: 'm', messages: [] };
+    // Kick off two streams concurrently; both observe the stale expiry and call
+    // ensureFreshOauth before the (gated) refresh resolves.
+    const p1 = drain(p.stream(baseReq));
+    const p2 = drain(p.stream(baseReq));
+    // Let both reach the awaited refresh, then release it.
+    await Promise.resolve();
+    await Promise.resolve();
+    resolveRefresh!({ token: 'tok-new', expiresAt: Date.now() + 3_600_000 });
+    const [o1, o2] = await Promise.all([p1, p2]);
+
+    // The refresh endpoint was hit exactly once despite two concurrent callers.
+    expect(refreshCalls).toBe(1);
+    expect((p as unknown as { oauthToken?: string }).oauthToken).toBe('tok-new');
+    expect(o1.some((e) => e.type === 'error')).toBe(false);
+    expect(o2.some((e) => e.type === 'error')).toBe(false);
+    expect(streamCalls.n).toBe(2); // both turns still went out
+  });
+});
+
+describe('AnthropicProvider countTokens offline fallback', () => {
+  it('does not stringify a multi-MB base64 image blob, yielding a bounded estimate', async () => {
+    // A 4 MB base64 image: if the fallback stringified the bytes, the estimate
+    // would be ~1,000,000 tokens. The fixed media allowance keeps it tiny.
+    const bigData = 'A'.repeat(4_000_000);
+    let serialized = '';
+    const client = {
+      messages: {
+        countTokens: async () => {
+          throw new Error('countTokens unreachable');
+        },
+        stream: () => (async function* () {})(),
+      },
+    };
+    // Spy on JSON.stringify to prove the blob is never serialized.
+    const origStringify = JSON.stringify;
+    const spy = (v: unknown, ...rest: unknown[]): string => {
+      const s = origStringify(v as never, ...(rest as []));
+      if (s.length > serialized.length) serialized = s;
+      return s;
+    };
+    JSON.stringify = spy as typeof JSON.stringify;
+    try {
+      const p = new AnthropicProvider({ client: client as never });
+      const n = await p.countTokens({
+        model: 'm',
+        messages: [
+          {
+            role: 'user',
+            content: [
+              { type: 'text', text: 'describe this' },
+              { type: 'image', mediaType: 'image/png', data: bigData },
+            ],
+          },
+        ],
+      });
+      // Bounded estimate, NOT proportional to the 4 MB blob.
+      expect(n).toBeLessThan(10_000);
+      expect(n).toBeGreaterThan(0);
+      // No stringify call ever materialized the base64 payload.
+      expect(serialized.length).toBeLessThan(bigData.length);
+    } finally {
+      JSON.stringify = origStringify;
+    }
+  });
+
+  it('falls back to a char-based estimate (not a crash) when the API count throws', async () => {
+    const client = {
+      messages: {
+        countTokens: async () => {
+          throw new Error('network down');
+        },
+        stream: () => (async function* () {})(),
+      },
+    };
+    const p = new AnthropicProvider({ client: client as never });
+    const n = await p.countTokens({
+      model: 'm',
+      messages: [{ role: 'user', content: [{ type: 'text', text: 'x'.repeat(400) }] }],
+    });
+    // ~400 chars / 4 ≈ 100 tokens (plus the empty tools array length).
+    expect(n).toBeGreaterThanOrEqual(100);
+    expect(n).toBeLessThan(150);
+  });
+});
+
+describe('AnthropicProvider message_delta usage merge', () => {
+  it('prefers delta-reported input/cache tokens over message_start values when present', async () => {
+    const client = {
+      messages: {
+        stream: () =>
+          (async function* () {
+            yield {
+              type: 'message_start',
+              message: {
+                usage: {
+                  input_tokens: 100,
+                  output_tokens: 0,
+                  cache_read_input_tokens: 10,
+                },
+              },
+            };
+            yield { type: 'content_block_delta', delta: { type: 'text_delta', text: 'hi' } };
+            // The delta CORRECTS input + cache numbers (some streaming modes do).
+            yield {
+              type: 'message_delta',
+              delta: { stop_reason: 'end_turn' },
+              usage: {
+                input_tokens: 120,
+                output_tokens: 5,
+                cache_read_input_tokens: 30,
+                cache_creation_input_tokens: 7,
+              },
+            };
+            yield { type: 'message_stop' };
+          })(),
+        countTokens: async () => ({ input_tokens: 0 }),
+      },
+    };
+    const p = new AnthropicProvider({ client: client as never });
+    const out = await drain(p.stream({ model: 'm', messages: [] }));
+    expect(out.at(-1)).toMatchObject({
+      type: 'message_end',
+      usage: {
+        inputTokens: 120,
+        outputTokens: 5,
+        cacheReadTokens: 30,
+        cacheCreationTokens: 7,
+      },
+    });
+  });
+});
+
+describe('AnthropicProvider degraded index-less stream', () => {
+  it('does not misroute a second tool block onto a stale finished entry when index is absent', async () => {
+    // No `index` on any event (older SDK / hand-rolled). Two strictly-serial
+    // tool blocks. The first finishes (its pendingToolUses entry is deleted on
+    // tool_use_end); the SECOND block's deltas must route to B, not the stale A
+    // entry left lingering in blockIndexToId.
+    const client = {
+      messages: {
+        stream: () =>
+          (async function* () {
+            yield { type: 'message_start', message: { usage: { input_tokens: 1, output_tokens: 0 } } };
+            yield { type: 'content_block_start', content_block: { type: 'tool_use', id: 'A', name: 'Read' } };
+            yield { type: 'content_block_delta', delta: { type: 'input_json_delta', partial_json: '{"a":1}' } };
+            yield { type: 'content_block_stop' };
+            yield { type: 'content_block_start', content_block: { type: 'tool_use', id: 'B', name: 'Glob' } };
+            yield { type: 'content_block_delta', delta: { type: 'input_json_delta', partial_json: '{"b":2}' } };
+            yield { type: 'content_block_stop' };
+            yield { type: 'message_delta', delta: { stop_reason: 'tool_use' }, usage: { output_tokens: 2 } };
+            yield { type: 'message_stop' };
+          })(),
+        countTokens: async () => ({ input_tokens: 0 }),
+      },
+    };
+    const p = new AnthropicProvider({ client: client as never });
+    const out = await drain(p.stream({ model: 'm', messages: [] }));
+    const ends = out.filter((e) => e.type === 'tool_use_end');
+    expect(ends).toHaveLength(2);
+    const endA = ends.find((e) => 'id' in e && (e as { id: string }).id === 'A');
+    const endB = ends.find((e) => 'id' in e && (e as { id: string }).id === 'B');
+    // Each tool received only its OWN input — no cross-routing onto a stale entry.
+    expect(endA).toMatchObject({ id: 'A', input: { a: 1 } });
+    expect(endB).toMatchObject({ id: 'B', input: { b: 2 } });
+  });
+});

package/src/oauth-refresh.test.ts

@@ -249,6 +249,60 @@ describe('AnthropicProvider OAuth token refresh', () => {
     const errors = out.filter((e): e is Extract<ProviderEvent, { type: 'error' }> => e.type === 'error');
     expect(errors).toHaveLength(1);
     expect(errors[0]!.message).toContain('proactive refresh failed');
+    // A failed proactive refresh emits NO message_start — the turn never opens,
+    // so consumers pairing message_start/message_end see nothing dangling.
+    expect(out.some((e) => e.type === 'message_start')).toBe(false);
+  });
+
+  it('does NOT refresh-and-replay a 401 surfaced AFTER content already streamed (no duplicate output)', async () => {
+    // First attempt streams a text delta, THEN throws a 401 mid-stream (token
+    // revoked during generation). Replaying would duplicate the text + emit a
+    // second message_end; the provider must instead surface the error once.
+    const fake = fakeClient((attempt) => {
+      if (attempt === 1) {
+        return [
+          { type: 'message_start', message: { usage: { input_tokens: 1, output_tokens: 0 } } },
+          { type: 'content_block_delta', delta: { type: 'text_delta', text: 'partial' } },
+          { __throw: unauthorizedError() } as unknown,
+        ];
+      }
+      return DONE_EVENTS;
+    });
+    // Make the fake throw when it reaches a `__throw` sentinel mid-iteration.
+    const msgs = fake.client.messages as unknown as { stream: () => AsyncIterable<unknown> };
+    const inner = msgs.stream.bind(msgs);
+    msgs.stream = () => {
+      const it = inner();
+      return (async function* () {
+        for await (const e of it) {
+          if (e && typeof e === 'object' && '__throw' in e) {
+            throw (e as { __throw: unknown }).__throw;
+          }
+          yield e;
+        }
+      })();
+    };
+
+    let refreshCalls = 0;
+    const p = new AnthropicProvider({
+      oauthToken: 'tok-old',
+      oauthExpiresAt: Date.now() + 3_600_000, // fresh -> the mid-stream 401 drives this path
+      oauthRefresh: async () => {
+        refreshCalls += 1;
+        return { token: 'tok-new' };
+      },
+      client: fake.client,
+    });
+    pinClient(p, fake.client);
+
+    const out = await drain(p.stream(baseReq));
+
+    // No replay: the 401 arrived after output, so we surface the error instead.
+    expect(refreshCalls).toBe(0);
+    // The partial text was streamed exactly once (not duplicated by a replay).
+    expect(out.filter((e) => e.type === 'text_delta')).toHaveLength(1);
+    expect(out.filter((e) => e.type === 'message_start')).toHaveLength(1);
+    expect(out.filter((e) => e.type === 'error')).toHaveLength(1);
   });
 
   it('countTokens proactively refreshes a near-expiry token before counting', async () => {

package/src/provider.test.ts

@@ -195,4 +195,50 @@ describe('AnthropicProvider.stream', () => {
     const p = new AnthropicProvider({ client: fake as never });
     expect(await p.countTokens({ model: 'm', messages: [] })).toBe(42);
   });
+
+  it('surfaces an error (not a junk tool input) when streamed tool JSON is malformed/truncated', async () => {
+    // A truncated input_json stream: the accumulated partial never closes.
+    const fake = fakeAnthropic([
+      { type: 'message_start', message: { usage: { input_tokens: 1, output_tokens: 0 } } },
+      { type: 'content_block_start', index: 0, content_block: { type: 'tool_use', id: 'c1', name: 'Read' } },
+      { type: 'content_block_delta', index: 0, delta: { type: 'input_json_delta', partial_json: '{"file_path":"a' } },
+      { type: 'content_block_stop', index: 0 },
+      { type: 'message_delta', delta: { stop_reason: 'tool_use' }, usage: { output_tokens: 2 } },
+      { type: 'message_stop' },
+    ]);
+    const p = new AnthropicProvider({ client: fake as never });
+    const events = [];
+    for await (const e of p.stream({ model: 'm', messages: [] })) events.push(e);
+    // The malformed call must NOT reach the loop as a valid tool_use_end with junk.
+    expect(events.some((e) => e.type === 'tool_use_end')).toBe(false);
+    const err = events.find((e) => e.type === 'error');
+    expect(err).toMatchObject({ retryable: false });
+    expect((err as { message: string }).message).toContain('c1');
+    // The turn is marked as an error rather than a clean tool-use completion.
+    expect(events.at(-1)).toMatchObject({ type: 'message_end', stopReason: 'error' });
+  });
+
+  it('clamps a caller maxTokens above the model output ceiling and defaults to it', async () => {
+    const calls: Array<{ max_tokens?: number }> = [];
+    const client = {
+      messages: {
+        stream: (args: { max_tokens?: number }) => {
+          calls.push(args);
+          return (async function* () {
+            yield { type: 'message_stop' };
+          })();
+        },
+        countTokens: async () => ({ input_tokens: 0 }),
+      },
+    };
+    const p = new AnthropicProvider({ client: client as never });
+    // haiku ceiling is 64_000 — an absurd request must be clamped, not forwarded.
+    for await (const _ of p.stream({ model: 'claude-haiku-4-5-20251001', maxTokens: 5_000_000, messages: [] })) {
+      void _;
+    }
+    expect(calls[0]!.max_tokens).toBe(64_000);
+    // No maxTokens → defaults to the descriptor ceiling.
+    for await (const _ of p.stream({ model: 'claude-haiku-4-5-20251001', messages: [] })) void _;
+    expect(calls[1]!.max_tokens).toBe(64_000);
+  });
 });