@nexrall/code-core 1.4.25 → 1.4.27

package/dist/api/client.js

@@ -801,417 +801,445 @@ async function streamChat(messages, options, onEvent) {
         const haveCompleteMessage = () => completedMessage !== null;
         // Partial input accumulator keyed by tool_use id
         const partialInputs = {};
-        await new Promise((resolve, reject) => {
-            // Feed chunks from the response body into the SSE parser.
-            // Declared here so the heartbeat watchdog closure can reference it.
-            const stream = response.body;
-            // ── Heartbeat watchdog ────────────────────────────────────────────────────
-            // The backend sends ": ping" comments every 10 s. If we receive no data at
-            // all for 90 s the connection has silently dropped (proxy timeout, network
-            // blip). Reject so the caller sees an actionable error instead of hanging.
-            //
-            // Sizing: this must tolerate a burst of consecutive LOST pings, not just one.
-            // The old pairing (20 s ping / 45 s timeout) survived exactly two misses —
-            // routinely exceeded on flaky Wi-Fi, tethered 4G, or the seconds right after a
-            // laptop wakes, so a perfectly healthy connection got torn down and the turn
-            // restarted for nothing. At 10 s / 90 s we ride out eight consecutive misses
-            // while still detecting a truly dead socket faster in absolute terms than the
-            // proxy's own idle timeout.
-            const HEARTBEAT_TIMEOUT_MS = 90000;
-            // Progress watchdog. The backend's ": ping" keepalive (every 10 s) resets lastDataAt,
-            // so the heartbeat above only catches a fully dead connection — NOT an upstream model
-            // stall, where Anthropic stops emitting tokens but the backend keeps pinging. That case
-            // would otherwise hang on "Thinking…" forever. lastProgressAt is bumped ONLY on real
-            // model events (see parser below), never on pings, so a genuine stall trips this and
-            // surfaces a retryable error.
-            // Two-phase stall limits:
-            //   • BEFORE the first model event, the upstream is doing prompt processing (time-to-
-            //     first-token). On big contexts (1M window, cold prompt cache, large tool schemas)
-            //     that phase emits NOTHING until message_start and can legitimately exceed 150 s.
-            //     Killing it there was the "timeout 150s → retry instantly works" bug: the first
-            //     attempt warmed the prompt cache, so the retry's TTFT was short. Allow 300 s.
-            //   • AFTER the first model event, tokens are flowing; a 150 s silent gap mid-stream
-            //     is a genuine stall.
-            // Overridable so tests can reach the stall path in seconds instead of minutes.
-            // That path is where the subtlest bug in this file lives: `lastProgressAt` stops
-            // advancing at `message_complete` while heartbeat pings keep `lastDataAt` fresh, so
-            // this watchdog — and only this one — can fire on a turn that already succeeded.
-            const FIRST_EVENT_TIMEOUT_MS = Number(process.env.NEXRALL_FIRST_EVENT_TIMEOUT_MS) || 300000;
-            const PROGRESS_TIMEOUT_MS = Number(process.env.NEXRALL_PROGRESS_TIMEOUT_MS) || 150000;
-            let sawModelEvent = false;
-            let lastDataAt = Date.now();
-            let lastProgressAt = Date.now();
-            const heartbeatWatchdog = setInterval(() => {
-                const now = Date.now();
-                // The turn already succeeded and we're only waiting on the trailing `done`.
-                // Finish with what we have rather than discarding a complete message and
-                // re-running the model.
+        // ─── Watchdog ownership ────────────────────────────────────────────────────
+        //
+        // Hoisted OUT of the promise executor so a single `finally` can guarantee the
+        // interval dies with the attempt. It used to be declared inside, and was cleared
+        // in nine separate branches — but not in the two `resolve()` paths inside the
+        // parser (the `[DONE]` sentinel and the `done` event), which are the NORMAL way a
+        // healthy turn ends. Those relied on `stream.on('end')` firing afterwards to do
+        // the cleanup; when a proxy or keep-alive holds the socket open, `end` never comes,
+        // so a 5-second interval outlived the turn. On a long run that is both a leak
+        // (one surviving timer per iteration, hundreds of iterations) and a correctness
+        // bug: the orphaned watchdog can still call stream.destroy() and reject() on an
+        // already-settled promise, i.e. tear down the NEXT thing using that socket.
+        //
+        // Nine clear sites are now belt-and-braces rather than load-bearing: clearInterval
+        // is idempotent, so leaving them costs nothing and each still stops the watchdog at
+        // the earliest possible moment.
+        let heartbeatWatchdog;
+        // NOTE: the promise body below is deliberately NOT re-indented for this `try`.
+        // Wrapping it cost one line; re-indenting ~400 lines would bury that one-line fix
+        // in a whitespace diff nobody can review.
+        try {
+            await new Promise((resolve, reject) => {
+                // Feed chunks from the response body into the SSE parser.
+                // Declared here so the heartbeat watchdog closure can reference it.
+                const stream = response.body;
+                // ── Heartbeat watchdog ────────────────────────────────────────────────────
+                // The backend sends ": ping" comments every 10 s. If we receive no data at
+                // all for 90 s the connection has silently dropped (proxy timeout, network
+                // blip). Reject so the caller sees an actionable error instead of hanging.
                 //
-                // The silence condition is essential, not decorative: the backend AWAITS its
-                // billing write before emitting `balance_status` and `done`, so the gap after
-                // `message_complete` is normal, expected, and can run for seconds on a slow DB.
-                // Firing on the next tick regardless would tear down a perfectly healthy socket
-                // and swallow the low-balance nudge — trading the bug this guard was written to
-                // fix for a different one. Wait out the full heartbeat timeout first; only then
-                // is the trailing frame genuinely never coming.
-                if (haveCompleteMessage() && now - lastDataAt > HEARTBEAT_TIMEOUT_MS) {
-                    clearInterval(heartbeatWatchdog);
-                    stream.destroy?.();
-                    resolve();
-                    return;
-                }
-                if (now - lastDataAt > HEARTBEAT_TIMEOUT_MS) {
-                    clearInterval(heartbeatWatchdog);
-                    stream.destroy?.();
-                    // Same rule as the stall watchdog below: if nothing has been shown to the
-                    // caller yet, a fresh attempt can't duplicate output, so retry transparently
-                    // instead of surfacing a hard error. This is also the common path when the
-                    // machine just woke from sleep — JS timers freeze during sleep, so on wake
-                    // `now - lastDataAt` immediately reads as a large gap even though nothing is
-                    // actually wrong with the connection; without this it used to hard-fail
-                    // instead of silently reconnecting.
-                    const recoverable = !emittedToCaller || !!allowRestartAfterRender;
-                    const secs = Math.round(HEARTBEAT_TIMEOUT_MS / 1000);
-                    reject(tagTransient(new Error(recoverable
-                        ? `Connection lost — no data received for ${secs} s. Reconnecting…`
-                        : `Connection lost — no data received for ${secs} s. Retry your message.`)));
-                    return;
-                }
-                const stallLimitMs = sawModelEvent ? PROGRESS_TIMEOUT_MS : FIRST_EVENT_TIMEOUT_MS;
-                if (now - lastProgressAt > stallLimitMs) {
-                    clearInterval(heartbeatWatchdog);
-                    stream.destroy?.();
-                    // Same rule as the heartbeat branch above, and MORE easily reached here: this
-                    // watchdog reads `lastProgressAt`, which only real model events bump. Once
-                    // `message_complete` lands, nothing bumps it again — so while the backend awaits
-                    // its billing write, the heartbeat's `: ping` keeps `lastDataAt` fresh (both
-                    // branches above correctly stay silent) but THIS clock runs out and reports a
-                    // "stall" on a turn that already succeeded. Restarting there would discard a
-                    // correct answer and re-bill the model call, repeatedly. The turn is complete;
-                    // finish with it.
-                    if (haveCompleteMessage()) {
+                // Sizing: this must tolerate a burst of consecutive LOST pings, not just one.
+                // The old pairing (20 s ping / 45 s timeout) survived exactly two misses —
+                // routinely exceeded on flaky Wi-Fi, tethered 4G, or the seconds right after a
+                // laptop wakes, so a perfectly healthy connection got torn down and the turn
+                // restarted for nothing. At 10 s / 90 s we ride out eight consecutive misses
+                // while still detecting a truly dead socket faster in absolute terms than the
+                // proxy's own idle timeout.
+                const HEARTBEAT_TIMEOUT_MS = 90000;
+                // Progress watchdog. The backend's ": ping" keepalive (every 10 s) resets lastDataAt,
+                // so the heartbeat above only catches a fully dead connection — NOT an upstream model
+                // stall, where Anthropic stops emitting tokens but the backend keeps pinging. That case
+                // would otherwise hang on "Thinking…" forever. lastProgressAt is bumped ONLY on real
+                // model events (see parser below), never on pings, so a genuine stall trips this and
+                // surfaces a retryable error.
+                // Two-phase stall limits:
+                //   • BEFORE the first model event, the upstream is doing prompt processing (time-to-
+                //     first-token). On big contexts (1M window, cold prompt cache, large tool schemas)
+                //     that phase emits NOTHING until message_start and can legitimately exceed 150 s.
+                //     Killing it there was the "timeout 150s → retry instantly works" bug: the first
+                //     attempt warmed the prompt cache, so the retry's TTFT was short. Allow 300 s.
+                //   • AFTER the first model event, tokens are flowing; a 150 s silent gap mid-stream
+                //     is a genuine stall.
+                // Overridable so tests can reach the stall path in seconds instead of minutes.
+                // That path is where the subtlest bug in this file lives: `lastProgressAt` stops
+                // advancing at `message_complete` while heartbeat pings keep `lastDataAt` fresh, so
+                // this watchdog — and only this one — can fire on a turn that already succeeded.
+                const FIRST_EVENT_TIMEOUT_MS = Number(process.env.NEXRALL_FIRST_EVENT_TIMEOUT_MS) || 300000;
+                const PROGRESS_TIMEOUT_MS = Number(process.env.NEXRALL_PROGRESS_TIMEOUT_MS) || 150000;
+                let sawModelEvent = false;
+                let lastDataAt = Date.now();
+                let lastProgressAt = Date.now();
+                heartbeatWatchdog = setInterval(() => {
+                    const now = Date.now();
+                    // The turn already succeeded and we're only waiting on the trailing `done`.
+                    // Finish with what we have rather than discarding a complete message and
+                    // re-running the model.
+                    //
+                    // The silence condition is essential, not decorative: the backend AWAITS its
+                    // billing write before emitting `balance_status` and `done`, so the gap after
+                    // `message_complete` is normal, expected, and can run for seconds on a slow DB.
+                    // Firing on the next tick regardless would tear down a perfectly healthy socket
+                    // and swallow the low-balance nudge — trading the bug this guard was written to
+                    // fix for a different one. Wait out the full heartbeat timeout first; only then
+                    // is the trailing frame genuinely never coming.
+                    if (haveCompleteMessage() && now - lastDataAt > HEARTBEAT_TIMEOUT_MS) {
+                        clearInterval(heartbeatWatchdog);
+                        stream.destroy?.();
                         resolve();
                         return;
                     }
-                    // If nothing has been shown to the caller yet, a fresh attempt can't duplicate
-                    // output — tag it retryable so the outer loop transparently retries the turn
-                    // instead of killing it. Once output has been emitted, a retry would duplicate
-                    // rendered text/tool calls, so surface the stall as a terminal error.
-                    reject(tagTransient(new Error(sawModelEvent
-                        ? `The model stopped responding mid-stream (no output for ${Math.round(stallLimitMs / 1000)} s).`
-                        : `The model did not start responding within ${Math.round(stallLimitMs / 1000)} s (large context can take a while to process).`)));
-                    return;
-                }
-            }, 5000);
-            const parser = (0, eventsource_parser_1.createParser)((event) => {
-                lastDataAt = Date.now(); // any SSE data (including ": ping" comments) resets the watchdog
-                // Skip reconnect-interval events
-                if (event.type !== 'event') {
-                    return;
-                }
-                {
-                    // Track the server-assigned frame id. This is the resume cursor: on a drop we
-                    // hand it back via Last-Event-ID and receive exactly the frames we missed,
-                    // instead of re-running the whole turn. Only present on resumable turns.
-                    const frameId = event.id;
-                    if (frameId) {
-                        const n = Number(frameId);
-                        if (Number.isFinite(n) && n > lastEventId)
-                            lastEventId = n;
-                    }
-                    const raw = event.data;
-                    if (!raw || raw === '[DONE]') {
-                        resolve();
+                    if (now - lastDataAt > HEARTBEAT_TIMEOUT_MS) {
+                        clearInterval(heartbeatWatchdog);
+                        stream.destroy?.();
+                        // Same rule as the stall watchdog below: if nothing has been shown to the
+                        // caller yet, a fresh attempt can't duplicate output, so retry transparently
+                        // instead of surfacing a hard error. This is also the common path when the
+                        // machine just woke from sleep — JS timers freeze during sleep, so on wake
+                        // `now - lastDataAt` immediately reads as a large gap even though nothing is
+                        // actually wrong with the connection; without this it used to hard-fail
+                        // instead of silently reconnecting.
+                        const recoverable = !emittedToCaller || !!allowRestartAfterRender;
+                        const secs = Math.round(HEARTBEAT_TIMEOUT_MS / 1000);
+                        reject(tagTransient(new Error(recoverable
+                            ? `Connection lost — no data received for ${secs} s. Reconnecting…`
+                            : `Connection lost — no data received for ${secs} s. Retry your message.`)));
                         return;
                     }
-                    let parsed;
-                    try {
-                        parsed = JSON.parse(raw);
-                    }
-                    catch {
-                        return; // Skip malformed lines
+                    const stallLimitMs = sawModelEvent ? PROGRESS_TIMEOUT_MS : FIRST_EVENT_TIMEOUT_MS;
+                    if (now - lastProgressAt > stallLimitMs) {
+                        clearInterval(heartbeatWatchdog);
+                        stream.destroy?.();
+                        // Same rule as the heartbeat branch above, and MORE easily reached here: this
+                        // watchdog reads `lastProgressAt`, which only real model events bump. Once
+                        // `message_complete` lands, nothing bumps it again — so while the backend awaits
+                        // its billing write, the heartbeat's `: ping` keeps `lastDataAt` fresh (both
+                        // branches above correctly stay silent) but THIS clock runs out and reports a
+                        // "stall" on a turn that already succeeded. Restarting there would discard a
+                        // correct answer and re-bill the model call, repeatedly. The turn is complete;
+                        // finish with it.
+                        if (haveCompleteMessage()) {
+                            resolve();
+                            return;
+                        }
+                        // If nothing has been shown to the caller yet, a fresh attempt can't duplicate
+                        // output — tag it retryable so the outer loop transparently retries the turn
+                        // instead of killing it. Once output has been emitted, a retry would duplicate
+                        // rendered text/tool calls, so surface the stall as a terminal error.
+                        reject(tagTransient(new Error(sawModelEvent
+                            ? `The model stopped responding mid-stream (no output for ${Math.round(stallLimitMs / 1000)} s).`
+                            : `The model did not start responding within ${Math.round(stallLimitMs / 1000)} s (large context can take a while to process).`)));
+                        return;
                     }
-                    if (typeof parsed !== 'object' || parsed === null || !('type' in parsed)) {
+                }, 5000);
+                const parser = (0, eventsource_parser_1.createParser)((event) => {
+                    lastDataAt = Date.now(); // any SSE data (including ": ping" comments) resets the watchdog
+                    // Skip reconnect-interval events
+                    if (event.type !== 'event') {
                         return;
                     }
-                    const evt = parsed;
-                    // Reaching here means a well-formed model event was parsed (": ping" keepalive
-                    // comments never produce a ParsedEvent with data) — count it as real progress.
-                    lastProgressAt = Date.now();
-                    sawModelEvent = true;
-                    // Real data is flowing again — clear any "reconnecting…" indicator the caller
-                    // may be showing from an earlier retry on THIS same attempt.
-                    clearRetryIfNeeded();
-                    switch (evt.type) {
-                        case 'text': {
-                            const text = typeof evt.text === 'string' ? evt.text : '';
-                            textParts.push(text);
-                            emittedToCaller = true;
-                            emittedChars += text.length;
-                            emittedAnythingAcrossAttempts = true;
-                            emittedCharsAcrossAttempts += text.length;
-                            onEvent({ type: 'text', text });
-                            break;
+                    {
+                        // Track the server-assigned frame id. This is the resume cursor: on a drop we
+                        // hand it back via Last-Event-ID and receive exactly the frames we missed,
+                        // instead of re-running the whole turn. Only present on resumable turns.
+                        const frameId = event.id;
+                        if (frameId) {
+                            const n = Number(frameId);
+                            if (Number.isFinite(n) && n > lastEventId)
+                                lastEventId = n;
                         }
-                        case 'tool_use': {
-                            const block = {
-                                type: 'tool_use',
-                                id: typeof evt.id === 'string' ? evt.id : '',
-                                name: typeof evt.name === 'string' ? evt.name : '',
-                                input: evt.input ?? {},
-                            };
-                            // Handle streaming input deltas
-                            if (typeof evt.input_json_delta === 'string') {
-                                partialInputs[block.id] = (partialInputs[block.id] ?? '') + evt.input_json_delta;
-                                try {
-                                    block.input = JSON.parse(partialInputs[block.id]);
-                                }
-                                catch {
-                                    // Input not fully streamed yet
-                                    return;
-                                }
-                            }
-                            toolUseBlocks.push(block);
-                            // Deliberately does NOT bump `emittedChars`: a streamed tool_use is a
-                            // preview that no consumer renders. The agent loop's `tool_use` case is a
-                            // no-op and the UI's tool row is only drawn later, from `options.onToolUse`
-                            // during execution — which happens after streamChat() returns and so never
-                            // runs on a failed attempt. `emittedToCaller` is still set, conservatively,
-                            // so a restart continues to require an explicit rollback handler.
-                            emittedToCaller = true;
-                            emittedAnythingAcrossAttempts = true;
-                            onEvent({ type: 'tool_use', id: block.id, name: block.name, input: block.input });
-                            break;
+                        const raw = event.data;
+                        if (!raw || raw === '[DONE]') {
+                            resolve();
+                            return;
                         }
-                        case 'message_complete': {
-                            // Anthropic's stop_reason (and the full raw content array) travel inside
-                            // the nested `message` object the backend forwards verbatim (routes/code.js's
-                            // `sendEvent(res, {type:'message_complete', message})` — `message` is the raw
-                            // Anthropic SDK message with thinking already stripped, which always has
-                            // stop_reason). 'max_tokens' means the model's output was cut off mid-
-                            // generation — if the last content block is a tool_use, its `input` may be a
-                            // truncated JSON object that still happened to parse (e.g. a multi_edit whose
-                            // `edits` array lost its last, still-in-progress element, or came out empty/
-                            // missing entirely) without any error at all. The agent loop uses this to
-                            // refuse executing that block blindly instead of silently applying a partial edit.
-                            const nestedMessage = evt.message;
-                            const stopReason = typeof nestedMessage?.stop_reason === 'string' ? nestedMessage.stop_reason : null;
-                            // Build the complete assistant message from accumulated parts (the common
-                            // path: text + tool_use, in the client's own order).
-                            const contentBlocks = [];
-                            const fullText = textParts.join('');
-                            if (fullText) {
-                                contentBlocks.push({ type: 'text', text: fullText });
-                            }
-                            contentBlocks.push(...toolUseBlocks);
-                            // TOOL-SEARCH / SERVER-SIDE-BLOCK PRESERVATION.
-                            // The rebuild above keeps ONLY text + tool_use. That is lossy for any turn
-                            // that also contains server-side blocks — `server_tool_use`,
-                            // `tool_search_tool_result` (and its nested `tool_reference`s), or a
-                            // `web_search_tool_result`. Those blocks MUST round-trip back to the API
-                            // verbatim on the next request or (a) the API rejects the follow-up (it
-                            // expects the paired server_tool_use/result to be present) and (b) for tool
-                            // search specifically, the discovered (deferred) tools are FORGOTTEN, forcing
-                            // Claude to re-search every turn — the exact opposite of the token saving.
-                            //
-                            // Preserve server-side blocks (tool_search_tool_result / server_tool_use /
-                            // web_search_tool_result) verbatim when present; otherwise keep the rebuilt
-                            // array. See chooseFinalContent for the full rationale. Zero regression for
-                            // an ordinary text/tool_use turn.
-                            const rawContent = Array.isArray(nestedMessage?.content)
-                                ? nestedMessage.content
-                                : null;
-                            const finalContent = chooseFinalContent(contentBlocks, rawContent);
-                            completedMessage = {
-                                role: 'assistant',
-                                content: finalContent,
-                                stopReason,
-                            };
-                            onEvent({ type: 'message_complete', message: completedMessage });
-                            break;
+                        let parsed;
+                        try {
+                            parsed = JSON.parse(raw);
                         }
-                        case 'usage': {
-                            if (typeof evt.input_tokens === 'number' && typeof evt.output_tokens === 'number') {
-                                onEvent({
-                                    type: 'usage',
-                                    // Forwarded, not dropped: the backend tags the usage of an attempt it
-                                    // billed but never completed (its stream `abort` path). Without this
-                                    // the flag dies here and every consumer that sums usage silently folds
-                                    // a discarded attempt's tokens into the successful turn's total.
-                                    ...(evt.partial === true ? { partial: true } : {}),
-                                    // `replayed` means these tokens are being reported a SECOND time: the
-                                    // turn completed and was billed on an earlier attempt whose `done` never
-                                    // reached us, and the backend served this one from its idempotency cache
-                                    // instead of re-running the model. Nothing new was charged, so a cost
-                                    // display must not add them again.
-                                    ...(evt.replayed === true ? { replayed: true } : {}),
-                                    usage: {
-                                        input_tokens: evt.input_tokens,
-                                        output_tokens: evt.output_tokens,
-                                        cache_creation_input_tokens: typeof evt.cache_creation_input_tokens === 'number' ? evt.cache_creation_input_tokens : undefined,
-                                        cache_read_input_tokens: typeof evt.cache_read_input_tokens === 'number' ? evt.cache_read_input_tokens : undefined,
-                                    },
-                                });
-                            }
-                            break;
+                        catch {
+                            return; // Skip malformed lines
                         }
-                        case 'context_warning': {
-                            // Server-side context-budget housekeeping (routes/code.js /
-                            // contextWindow.js): it already safely trimmed/compacted the
-                            // history before sending, at a turn boundary that never breaks
-                            // a tool_use/tool_result pair. Purely informational — the
-                            // server has already handled it, so there is nothing actionable
-                            // for the user here. Deliberately NOT surfaced to the UI
-                            // (used to be forwarded as an `error` event, which made a
-                            // routine, already-handled trim look like a failure).
-                            break;
+                        if (typeof parsed !== 'object' || parsed === null || !('type' in parsed)) {
+                            return;
                         }
-                        case 'thinking': {
-                            const text = typeof evt.text === 'string' ? evt.text : '';
-                            if (text) {
+                        const evt = parsed;
+                        // Reaching here means a well-formed model event was parsed (": ping" keepalive
+                        // comments never produce a ParsedEvent with data) — count it as real progress.
+                        lastProgressAt = Date.now();
+                        sawModelEvent = true;
+                        // Real data is flowing again — clear any "reconnecting…" indicator the caller
+                        // may be showing from an earlier retry on THIS same attempt.
+                        clearRetryIfNeeded();
+                        switch (evt.type) {
+                            case 'text': {
+                                const text = typeof evt.text === 'string' ? evt.text : '';
+                                textParts.push(text);
                                 emittedToCaller = true;
                                 emittedChars += text.length;
                                 emittedAnythingAcrossAttempts = true;
                                 emittedCharsAcrossAttempts += text.length;
-                                onEvent({ type: 'thinking', text });
+                                onEvent({ type: 'text', text });
+                                break;
                             }
-                            break;
-                        }
-                        case 'thinking_progress': {
-                            // Without this case the live token counter never updated and long thinking
-                            // phases (e.g. after reading a large file) looked frozen on "Thinking…".
-                            const tokens = typeof evt.tokens === 'number' ? evt.tokens : 0;
-                            onEvent({ type: 'thinking_progress', tokens });
-                            break;
-                        }
-                        case 'thinking_delta': {
-                            // Live thinking text streamed token-by-token so a long thinking phase shows
-                            // content as it forms, not a single block dumped at message completion.
-                            const text = typeof evt.text === 'string' ? evt.text : '';
-                            if (text) {
+                            case 'tool_use': {
+                                const block = {
+                                    type: 'tool_use',
+                                    id: typeof evt.id === 'string' ? evt.id : '',
+                                    name: typeof evt.name === 'string' ? evt.name : '',
+                                    input: evt.input ?? {},
+                                };
+                                // Handle streaming input deltas
+                                if (typeof evt.input_json_delta === 'string') {
+                                    partialInputs[block.id] = (partialInputs[block.id] ?? '') + evt.input_json_delta;
+                                    try {
+                                        block.input = JSON.parse(partialInputs[block.id]);
+                                    }
+                                    catch {
+                                        // Input not fully streamed yet
+                                        return;
+                                    }
+                                }
+                                toolUseBlocks.push(block);
+                                // Deliberately does NOT bump `emittedChars`: a streamed tool_use is a
+                                // preview that no consumer renders. The agent loop's `tool_use` case is a
+                                // no-op and the UI's tool row is only drawn later, from `options.onToolUse`
+                                // during execution — which happens after streamChat() returns and so never
+                                // runs on a failed attempt. `emittedToCaller` is still set, conservatively,
+                                // so a restart continues to require an explicit rollback handler.
                                 emittedToCaller = true;
-                                emittedChars += text.length;
                                 emittedAnythingAcrossAttempts = true;
-                                emittedCharsAcrossAttempts += text.length;
-                                onEvent({ type: 'thinking_delta', text });
+                                onEvent({ type: 'tool_use', id: block.id, name: block.name, input: block.input });
+                                break;
                             }
-                            break;
-                        }
-                        case 'resumable': {
-                            // The backend numbers this turn's frames and buffers them, so a dropped
-                            // connection can reattach mid-response rather than re-running the turn.
-                            // Purely a capability announcement — nothing to show the user.
-                            serverResumable = true;
-                            break;
-                        }
-                        case 'balance_status': {
-                            const balance = typeof evt.balance === 'number' ? evt.balance : 0;
-                            const zero = !!evt.zero;
-                            onEvent({ type: 'balance_status', balance, zero });
-                            break;
-                        }
-                        case 'done': {
-                            onEvent({ type: 'done' });
-                            resolve();
-                            break;
-                        }
-                        case 'error': {
-                            const message = typeof evt.message === 'string' ? evt.message :
-                                typeof evt.error === 'string' ? evt.error : 'Unknown SSE error';
-                            // The GET /chat/resume tail loop sends this when the turn's Redis frame
-                            // buffer developed a gap (trimmed window, a swallowed flush error, or the
-                            // owning pod died) or the turn is simply gone — see routes/code.js. Unlike
-                            // `isRetryableStreamMsg` below, this is NOT a fuzzy text match: the backend
-                            // sets the flag explicitly, so it can never silently stop matching if either
-                            // side rewrites the English message. There is no cursor left to resume
-                            // from — a plain "retryable" resume-with-Last-Event-ID would just 410 again
-                            // — so this always needs a fresh turnId, which the outer loop mints via
-                            // `forceRestart`.
-                            const notResumable = evt.notResumable === true;
-                            // Transient upstream failure before any output → let the outer loop retry it
-                            // transparently instead of killing the turn (this is the "Overloaded" case).
-                            // But never retry once the turn's message has already been delivered in
-                            // full: a late error frame (e.g. the backend's billing write failing after
-                            // `message_complete`) must not discard a correct answer and re-bill the
-                            // model call. Surface it as a notice and finish with what we have.
-                            if (haveCompleteMessage()) {
-                                clearInterval(heartbeatWatchdog);
-                                onEvent({ type: 'error', message });
-                                resolve();
+                            case 'message_complete': {
+                                // Anthropic's stop_reason (and the full raw content array) travel inside
+                                // the nested `message` object the backend forwards verbatim (routes/code.js's
+                                // `sendEvent(res, {type:'message_complete', message})` — `message` is the raw
+                                // Anthropic SDK message with thinking already stripped, which always has
+                                // stop_reason). 'max_tokens' means the model's output was cut off mid-
+                                // generation — if the last content block is a tool_use, its `input` may be a
+                                // truncated JSON object that still happened to parse (e.g. a multi_edit whose
+                                // `edits` array lost its last, still-in-progress element, or came out empty/
+                                // missing entirely) without any error at all. The agent loop uses this to
+                                // refuse executing that block blindly instead of silently applying a partial edit.
+                                const nestedMessage = evt.message;
+                                const stopReason = typeof nestedMessage?.stop_reason === 'string' ? nestedMessage.stop_reason : null;
+                                // Build the complete assistant message from accumulated parts (the common
+                                // path: text + tool_use, in the client's own order).
+                                const contentBlocks = [];
+                                const fullText = textParts.join('');
+                                if (fullText) {
+                                    contentBlocks.push({ type: 'text', text: fullText });
+                                }
+                                contentBlocks.push(...toolUseBlocks);
+                                // TOOL-SEARCH / SERVER-SIDE-BLOCK PRESERVATION.
+                                // The rebuild above keeps ONLY text + tool_use. That is lossy for any turn
+                                // that also contains server-side blocks — `server_tool_use`,
+                                // `tool_search_tool_result` (and its nested `tool_reference`s), or a
+                                // `web_search_tool_result`. Those blocks MUST round-trip back to the API
+                                // verbatim on the next request or (a) the API rejects the follow-up (it
+                                // expects the paired server_tool_use/result to be present) and (b) for tool
+                                // search specifically, the discovered (deferred) tools are FORGOTTEN, forcing
+                                // Claude to re-search every turn — the exact opposite of the token saving.
+                                //
+                                // Preserve server-side blocks (tool_search_tool_result / server_tool_use /
+                                // web_search_tool_result) verbatim when present; otherwise keep the rebuilt
+                                // array. See chooseFinalContent for the full rationale. Zero regression for
+                                // an ordinary text/tool_use turn.
+                                const rawContent = Array.isArray(nestedMessage?.content)
+                                    ? nestedMessage.content
+                                    : null;
+                                const finalContent = chooseFinalContent(contentBlocks, rawContent);
+                                completedMessage = {
+                                    role: 'assistant',
+                                    content: finalContent,
+                                    stopReason,
+                                };
+                                onEvent({ type: 'message_complete', message: completedMessage });
+                                break;
+                            }
+                            case 'usage': {
+                                if (typeof evt.input_tokens === 'number' && typeof evt.output_tokens === 'number') {
+                                    onEvent({
+                                        type: 'usage',
+                                        // Forwarded, not dropped: the backend tags the usage of an attempt it
+                                        // billed but never completed (its stream `abort` path). Without this
+                                        // the flag dies here and every consumer that sums usage silently folds
+                                        // a discarded attempt's tokens into the successful turn's total.
+                                        ...(evt.partial === true ? { partial: true } : {}),
+                                        // `replayed` means these tokens are being reported a SECOND time: the
+                                        // turn completed and was billed on an earlier attempt whose `done` never
+                                        // reached us, and the backend served this one from its idempotency cache
+                                        // instead of re-running the model. Nothing new was charged, so a cost
+                                        // display must not add them again.
+                                        ...(evt.replayed === true ? { replayed: true } : {}),
+                                        usage: {
+                                            input_tokens: evt.input_tokens,
+                                            output_tokens: evt.output_tokens,
+                                            cache_creation_input_tokens: typeof evt.cache_creation_input_tokens === 'number' ? evt.cache_creation_input_tokens : undefined,
+                                            cache_read_input_tokens: typeof evt.cache_read_input_tokens === 'number' ? evt.cache_read_input_tokens : undefined,
+                                        },
+                                    });
+                                }
+                                break;
+                            }
+                            case 'context_warning': {
+                                // Server-side context-budget housekeeping (routes/code.js /
+                                // contextWindow.js): it already safely trimmed/compacted the
+                                // history before sending, at a turn boundary that never breaks
+                                // a tool_use/tool_result pair. Purely informational — the
+                                // server has already handled it, so there is nothing actionable
+                                // for the user here. Deliberately NOT surfaced to the UI
+                                // (used to be forwarded as an `error` event, which made a
+                                // routine, already-handled trim look like a failure).
+                                break;
+                            }
+                            case 'thinking': {
+                                const text = typeof evt.text === 'string' ? evt.text : '';
+                                if (text) {
+                                    emittedToCaller = true;
+                                    emittedChars += text.length;
+                                    emittedAnythingAcrossAttempts = true;
+                                    emittedCharsAcrossAttempts += text.length;
+                                    onEvent({ type: 'thinking', text });
+                                }
+                                break;
+                            }
+                            case 'thinking_progress': {
+                                // Without this case the live token counter never updated and long thinking
+                                // phases (e.g. after reading a large file) looked frozen on "Thinking…".
+                                const tokens = typeof evt.tokens === 'number' ? evt.tokens : 0;
+                                onEvent({ type: 'thinking_progress', tokens });
+                                break;
                             }
-                            else if (notResumable && (!emittedToCaller || allowRestartAfterRender)) {
-                                clearInterval(heartbeatWatchdog);
-                                stream.destroy?.();
-                                reject(Object.assign(tagTransient(new Error(message)), { forceRestart: true }));
+                            case 'thinking_delta': {
+                                // Live thinking text streamed token-by-token so a long thinking phase shows
+                                // content as it forms, not a single block dumped at message completion.
+                                const text = typeof evt.text === 'string' ? evt.text : '';
+                                if (text) {
+                                    emittedToCaller = true;
+                                    emittedChars += text.length;
+                                    emittedAnythingAcrossAttempts = true;
+                                    emittedCharsAcrossAttempts += text.length;
+                                    onEvent({ type: 'thinking_delta', text });
+                                }
+                                break;
                             }
-                            else if (isRetryableStreamMsg(message) && (!emittedToCaller || allowRestartAfterRender)) {
-                                clearInterval(heartbeatWatchdog);
-                                stream.destroy?.();
-                                reject(tagTransient(new Error(message)));
+                            case 'resumable': {
+                                // The backend numbers this turn's frames and buffers them, so a dropped
+                                // connection can reattach mid-response rather than re-running the turn.
+                                // Purely a capability announcement — nothing to show the user.
+                                serverResumable = true;
+                                break;
                             }
-                            else {
-                                // Terminal error. The three branches above each stop the watchdog
-                                // and tear the socket down; this one used to do neither, so a
-                                // fatal SSE error left a 5-second interval running and the
-                                // response body open for the lifetime of the process. The
-                                // rejection settles the promise either way, which is exactly why
-                                // the leak was invisible — nothing downstream ever noticed, it
-                                // just accumulated one timer per failed turn across a long session.
-                                clearInterval(heartbeatWatchdog);
-                                stream.destroy?.();
-                                onEvent({ type: 'error', message });
-                                reject(new Error(message));
+                            case 'balance_status': {
+                                const balance = typeof evt.balance === 'number' ? evt.balance : 0;
+                                const zero = !!evt.zero;
+                                onEvent({ type: 'balance_status', balance, zero });
+                                break;
+                            }
+                            case 'done': {
+                                onEvent({ type: 'done' });
+                                resolve();
+                                break;
+                            }
+                            case 'error': {
+                                const message = typeof evt.message === 'string' ? evt.message :
+                                    typeof evt.error === 'string' ? evt.error : 'Unknown SSE error';
+                                // The GET /chat/resume tail loop sends this when the turn's Redis frame
+                                // buffer developed a gap (trimmed window, a swallowed flush error, or the
+                                // owning pod died) or the turn is simply gone — see routes/code.js. Unlike
+                                // `isRetryableStreamMsg` below, this is NOT a fuzzy text match: the backend
+                                // sets the flag explicitly, so it can never silently stop matching if either
+                                // side rewrites the English message. There is no cursor left to resume
+                                // from — a plain "retryable" resume-with-Last-Event-ID would just 410 again
+                                // — so this always needs a fresh turnId, which the outer loop mints via
+                                // `forceRestart`.
+                                const notResumable = evt.notResumable === true;
+                                // Transient upstream failure before any output → let the outer loop retry it
+                                // transparently instead of killing the turn (this is the "Overloaded" case).
+                                // But never retry once the turn's message has already been delivered in
+                                // full: a late error frame (e.g. the backend's billing write failing after
+                                // `message_complete`) must not discard a correct answer and re-bill the
+                                // model call. Surface it as a notice and finish with what we have.
+                                if (haveCompleteMessage()) {
+                                    clearInterval(heartbeatWatchdog);
+                                    onEvent({ type: 'error', message });
+                                    resolve();
+                                }
+                                else if (notResumable && (!emittedToCaller || allowRestartAfterRender)) {
+                                    clearInterval(heartbeatWatchdog);
+                                    stream.destroy?.();
+                                    reject(Object.assign(tagTransient(new Error(message)), { forceRestart: true }));
+                                }
+                                else if (isRetryableStreamMsg(message) && (!emittedToCaller || allowRestartAfterRender)) {
+                                    clearInterval(heartbeatWatchdog);
+                                    stream.destroy?.();
+                                    reject(tagTransient(new Error(message)));
+                                }
+                                else {
+                                    // Terminal error. The three branches above each stop the watchdog
+                                    // and tear the socket down; this one used to do neither, so a
+                                    // fatal SSE error left a 5-second interval running and the
+                                    // response body open for the lifetime of the process. The
+                                    // rejection settles the promise either way, which is exactly why
+                                    // the leak was invisible — nothing downstream ever noticed, it
+                                    // just accumulated one timer per failed turn across a long session.
+                                    clearInterval(heartbeatWatchdog);
+                                    stream.destroy?.();
+                                    onEvent({ type: 'error', message });
+                                    reject(new Error(message));
+                                }
+                                break;
                             }
-                            break;
                         }
                     }
-                }
-            });
-            stream.on('data', (chunk) => {
-                lastDataAt = Date.now();
-                if (abortSignal?.aborted) {
-                    stream.destroy?.();
-                    return;
-                }
-                parser.feed(chunk.toString('utf-8'));
-            });
-            stream.on('end', () => {
-                clearInterval(heartbeatWatchdog);
-                // A clean 'end' with ZERO model events means the connection was dropped before
-                // the backend produced anything (deploy restart, proxy reset). Without this,
-                // the fallback below returns an EMPTY assistant message and the agent loop
-                // treats it as a silent no-op — the turn just vanishes. Nothing was emitted,
-                // so a retry cannot duplicate output → tag retryable.
-                if (!sawModelEvent && !completedMessage) {
-                    reject(Object.assign(new Error('Connection closed before the model responded. Retrying…'), { retryable: true }));
-                    return;
-                }
-                resolve();
-            });
-            // Treat stream destruction from abort as a clean exit, not an error
-            stream.on('error', (err) => {
-                clearInterval(heartbeatWatchdog);
-                if (abortSignal?.aborted || controller.signal.aborted) {
-                    resolve();
-                    return;
-                }
-                // Socket died AFTER the turn was fully delivered — the only thing still
-                // outstanding was the trailing `done`. Treat as success: rejecting here would
-                // throw away a complete answer and (with restart enabled) re-run and re-bill
-                // the entire turn. This is the widest such window in practice, because the
-                // backend does a DB write between `message_complete` and `done`.
-                if (haveCompleteMessage()) {
+                });
+                stream.on('data', (chunk) => {
+                    lastDataAt = Date.now();
+                    if (abortSignal?.aborted) {
+                        stream.destroy?.();
+                        return;
+                    }
+                    parser.feed(chunk.toString('utf-8'));
+                });
+                stream.on('end', () => {
+                    clearInterval(heartbeatWatchdog);
+                    // A clean 'end' with ZERO model events means the connection was dropped before
+                    // the backend produced anything (deploy restart, proxy reset). Without this,
+                    // the fallback below returns an EMPTY assistant message and the agent loop
+                    // treats it as a silent no-op — the turn just vanishes. Nothing was emitted,
+                    // so a retry cannot duplicate output → tag retryable.
+                    if (!sawModelEvent && !completedMessage) {
+                        reject(Object.assign(new Error('Connection closed before the model responded. Retrying…'), { retryable: true }));
+                        return;
+                    }
                     resolve();
-                    return;
-                }
-                // Transport-level failures ("Premature close" / ECONNRESET / socket hang up)
-                // happen whenever the backend restarts mid-deploy or a proxy drops the socket.
-                // They are exactly as transient as an overloaded_error — if nothing has been
-                // emitted to the caller yet, retry the attempt transparently instead of
-                // surfacing "Stream failed: Premature close" and killing the whole turn.
-                reject(tagTransient(err));
+                });
+                // Treat stream destruction from abort as a clean exit, not an error
+                stream.on('error', (err) => {
+                    clearInterval(heartbeatWatchdog);
+                    if (abortSignal?.aborted || controller.signal.aborted) {
+                        resolve();
+                        return;
+                    }
+                    // Socket died AFTER the turn was fully delivered — the only thing still
+                    // outstanding was the trailing `done`. Treat as success: rejecting here would
+                    // throw away a complete answer and (with restart enabled) re-run and re-bill
+                    // the entire turn. This is the widest such window in practice, because the
+                    // backend does a DB write between `message_complete` and `done`.
+                    if (haveCompleteMessage()) {
+                        resolve();
+                        return;
+                    }
+                    // Transport-level failures ("Premature close" / ECONNRESET / socket hang up)
+                    // happen whenever the backend restarts mid-deploy or a proxy drops the socket.
+                    // They are exactly as transient as an overloaded_error — if nothing has been
+                    // emitted to the caller yet, retry the attempt transparently instead of
+                    // surfacing "Stream failed: Premature close" and killing the whole turn.
+                    reject(tagTransient(err));
+                });
             });
-        });
+        }
+        finally {
+            // The one guaranteed cleanup: covers the two parser `resolve()` paths that
+            // clear nothing, plus any future exit path added without remembering to.
+            if (heartbeatWatchdog !== undefined)
+                clearInterval(heartbeatWatchdog);
+        }
         if (completedMessage) {
             return completedMessage;
         }