@oh-my-pi/pi-ai 18.10.1 → 18.10.3

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [18.10.3] - 2026-10-12
+
+### Breaking Changes
+
+- `isOfficialCodexApiUrl` moved from `@oh-my-pi/pi-ai` to `@oh-my-pi/pi-catalog/wire/codex`, next to `CODEX_BASE_URL`, so the catalog's compat resolver classifies Codex endpoints with the same check ([#15434](https://github.com/can1357/oh-my-pi/pull/15434) by [@will-bogusz](https://github.com/will-bogusz))
+
+### Added
+
+- Added `withoutUnverifiedThinking` utility to filter reasoning capability from models when no effort is requested
+- Added `reachesOfficialEndpoint(model)`: whether a request to the model reaches the official endpoint its compat was built for, following `ANTHROPIC_BASE_URL` and Foundry's `FOUNDRY_BASE_URL` reroutes of first-party Anthropic models ([#15434](https://github.com/can1357/oh-my-pi/pull/15434) by [@will-bogusz](https://github.com/will-bogusz))
+- Added `AssistantMessage.elidedOutputTokens`, the visible output tokens a history rewrite (shake) has removed from the turn, which `usage.output` still counts ([#15446](https://github.com/can1357/oh-my-pi/pull/15446) by [@will-bogusz](https://github.com/will-bogusz))
+- Exported `shouldDropTruncatedThinkingOnlyAssistant` from `providers/transform-messages`, `isColdReplayableResponsesTurn` from `providers/openai-shared` and the new `openAIResponsesReplaysNativeHistory` from `providers/openai-responses`, so local token estimates can follow which turns replay drops and whether a session replays native history ([#15447](https://github.com/can1357/oh-my-pi/pull/15447) by [@will-bogusz](https://github.com/will-bogusz))
+
+### Fixed
+
+- Fixed Claude on Google Antigravity failing every turn with "image exceeds 5 MB maximum" once a large image entered the conversation; images are now downscaled to the host's limits before sending, as on the Anthropic API ([#15444](https://github.com/can1357/oh-my-pi/pull/15444) by [@will-bogusz](https://github.com/will-bogusz))
+
+## [18.10.2] - 2026-10-12
+
+### Added
+
+- Added support for `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS` on the `anthropic` provider: when set, requests omit pre-release fields (`context_management`, beta tool fields such as `strict` and `defer_loading`, task budgets, structured-output format, `thinking.block_binding`, and Anthropic server compaction) along with their beta headers, so `ANTHROPIC_BASE_URL` gateways that reject them keep working ([#15458](https://github.com/can1357/oh-my-pi/pull/15458) by [@H4vC](https://github.com/H4vC))
+
 ## [18.9.2] - 2026-10-11
 
 ### Breaking Changes

package/THIRD-PARTY-NOTICES.txt

@@ -79,9 +79,9 @@ uutils coreutils (https://github.com/uutils/coreutils), MIT
 --------------------------------------------------------------------------------
 Covers: base32, base64, basename, cat, cksum (shared checksum machinery),
 b2sum, md5sum, sha1sum, sha224sum, sha256sum, sha384sum, sha512sum, comm, cp,
-cut, date, dirname, head, hostname, ln, ls, mkdir, mktemp, mv, nproc, paste,
-printenv, readlink, realpath, rm, seq, sort, stat, tac, tail, tee, touch, tr,
-truncate, uname, uniq, wc, whoami, yes.
+cut, date, dirname, head, hostname, ln, ls, mkdir, mktemp, mv, nl, nproc,
+paste, printenv, readlink, realpath, rm, seq, sort, stat, tac, tail, tee,
+touch, tr, truncate, uname, uniq, wc, whoami, yes.
 
   Copyright (c) uutils developers
 

package/dist/types/providers/anthropic-images.d.ts

@@ -0,0 +1,7 @@
+import type { Context, Model } from "../types.js";
+/**
+ * Clamp every image a Claude reader would receive to the host's contract.
+ * Limits the model's policy leaves unset fall back to the canonical Anthropic
+ * API. Returns `context` itself when nothing needed resizing.
+ */
+export declare function prepareAnthropicImageContext(context: Context, model: Model<"anthropic-messages"> | Model<"google-gemini-cli">): Promise<Context>;

package/dist/types/providers/anthropic-state.d.ts

@@ -7,6 +7,13 @@ export declare const ANTHROPIC_OPAQUE_CLIENT_ANCHOR_KEY = "anthropic-opaque-clie
 export declare function normalizeAnthropicBaseUrl(baseUrl?: string): string | undefined;
 /** Resolve the endpoint for a first-party Anthropic model without loading its provider implementation. */
 export declare function resolveDirectAnthropicBaseUrl(model: Model<Api>): string;
+/**
+ * Whether a request to `model` reaches the official endpoint its compat was built for. `compat.officialEndpoint`
+ * classifies the configured `baseUrl`, but a first-party Anthropic model is rerouted at request time by
+ * `ANTHROPIC_BASE_URL` or Foundry's `FOUNDRY_BASE_URL` without rebuilding compat. Gates official-only host
+ * limits such as the catalog's inline image byte and image count budgets.
+ */
+export declare function reachesOfficialEndpoint(model: Model<Api>): boolean;
 /** Build the endpoint-and-model-scoped Anthropic session-state key. */
 export declare function anthropicProviderSessionStateKey(baseUrl: string, modelId: string): string;
 /** Re-arm fast mode across materialized Anthropic session-state entries. */

package/dist/types/providers/openai-responses.d.ts

@@ -114,6 +114,15 @@ interface OpenAIResponsesChainState {
     /** Set once chaining is judged unsupported for this session (circuit breaker). */
     disabled: boolean;
 }
+/**
+ * Whether the next request for `model` replays native Responses history items
+ * (encrypted reasoning, item ids), as {@link buildParams} decides it. A session
+ * is cold, rebuilding turns from message content, from the first request on a
+ * connection-bound host (`compat.connectionBoundNativeHistory`, GitHub Copilot)
+ * and after `close()` on any host, until a response succeeds. Without session
+ * state every request replays.
+ */
+export declare function openAIResponsesReplaysNativeHistory(model: Pick<Model, "api" | "provider" | "compat"> | null | undefined, providerSessionState: Map<string, ProviderSessionState> | undefined): boolean;
 /**
  * Set the process-wide storage default per provider id, used when a request
  * leaves `storeResponses` unset. Hosts call this from their settings so every

package/dist/types/providers/openai-shared.d.ts

@@ -525,6 +525,20 @@ export interface BuildResponsesInputOptions<TApi extends Api> {
  * Callers gate on {@link isHarmonyDialectModel}. Items are copied, not mutated.
  */
 export declare function escapeReplayedControlTokens(items: ResponseInput): ResponseInput;
+/**
+ * Whether a same-provider assistant turn may replay its native items while the
+ * provider session is still cold (#489). A cold session rebuilds turns from
+ * message content because some backends bind native items to one connection
+ * (GitHub Copilot: `401 input item does not belong to this connection`, #488).
+ * Binding needs server-issued state that survives replay sanitization: an
+ * `encrypted_content` blob or an item id. A turn with neither, whose every
+ * reasoning item carries plaintext `reasoning_text`, has nothing to bind and is
+ * exactly what the server receives once the session warms; rebuilding it would
+ * drop that reasoning and change the prompt prefix the server cached.
+ * Summary-only reasoning keeps the rebuild: it is no evidence of a server that
+ * returns plaintext reasoning.
+ */
+export declare function isColdReplayableResponsesTurn(items: ResponseInput): boolean;
 export declare function buildResponsesInput<TApi extends Api>(options: BuildResponsesInputOptions<TApi>): ResponseInput;
 /**
  * Non-empty `reasoning_text` shipped for a synthesized reasoning item when no

package/dist/types/providers/transform-messages.d.ts

@@ -31,6 +31,11 @@ export declare function appendDuplicateSuffix(originalId: string, suffix: string
  * name slot carries invocation text).
  */
 export declare function isMalformedToolCallName(name: unknown): boolean;
+/**
+ * Whether {@link transformMessages} drops `msg` from every replay: a turn cut
+ * off by `length` / `error` / `aborted` that carries no text and no tool call.
+ */
+export declare function shouldDropTruncatedThinkingOnlyAssistant(msg: AssistantMessage): boolean;
 /**
  * Normalize tool call ID for cross-provider compatibility.
  * OpenAI Responses API generates IDs that are 450+ chars with special characters like `|`.

package/dist/types/stream.d.ts

@@ -5,8 +5,6 @@ import type { GoogleGeminiCliOptions } from "./providers/google-gemini-cli.js";
 import type { GoogleVertexOptions } from "./providers/google-vertex.js";
 import type { Api, AssistantMessage, Context, Model, OptionsForApi, SimpleStreamOptions, ToolChoice } from "./types.js";
 import { AssistantMessageEventStream } from "./utils/event-stream.js";
-/** Strict official-Codex endpoint check; exact origin or a path boundary after {@link CODEX_BASE_URL}. */
-export declare function isOfficialCodexApiUrl(baseUrl: string | undefined): boolean;
 export declare function configureProviderMaxInFlightRequests(limits: Record<string, number> | undefined): void;
 export declare const __providerInFlightForTesting: {
     setRoot(root: string | undefined): void;

package/dist/types/types.d.ts

@@ -1031,6 +1031,12 @@ export interface AssistantMessage {
      */
     serviceTier?: ServiceTier;
     usage: Usage;
+    /**
+     * Visible output tokens a history rewrite (shake) has since removed from
+     * `content`. `usage.output` still counts them, so a replay estimate subtracts
+     * them to keep the turn's reasoning without recharging the removed text.
+     */
+    elidedOutputTokens?: number;
     stopReason: StopReason;
     stopDetails?: StopDetails | null;
     errorMessage?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.10.1",
+	"version": "18.10.3",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -155,11 +155,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.10.1",
-		"@oh-my-pi/pi-catalog": "18.10.1",
-		"@oh-my-pi/pi-natives": "18.10.1",
-		"@oh-my-pi/pi-utils": "18.10.1",
-		"@oh-my-pi/pi-wire": "18.10.1"
+		"@oh-my-pi/omptype": "18.10.3",
+		"@oh-my-pi/pi-catalog": "18.10.3",
+		"@oh-my-pi/pi-natives": "18.10.3",
+		"@oh-my-pi/pi-utils": "18.10.3",
+		"@oh-my-pi/pi-wire": "18.10.3"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/providers/anthropic-images.ts

@@ -0,0 +1,263 @@
+/**
+ * Claude's image contract, enforced before a request leaves the client. Every
+ * wire that delivers images to a Claude reader shares it: `anthropic-messages`
+ * always, and Google's Cloud Code Assist wire when resolved policy declares
+ * the host's limits (`max-image-dimension` / `max-image-payload-bytes`).
+ */
+import { logger } from "@oh-my-pi/pi-utils";
+import type { Context, ImageContent, Message, Model, TextContent } from "../types";
+
+const ANTHROPIC_MANY_IMAGE_THRESHOLD = 20;
+const ANTHROPIC_MANY_IMAGE_MAX_DIMENSION = 2000;
+/**
+ * Image contract of the canonical Anthropic Messages API, used when resolved
+ * model policy names no other: 8000px per side ("At least one of the image
+ * dimensions exceed max allowed size: 8000 pixels") and a 10 MB base64
+ * payload per block ("image exceeds 10 MB maximum: 14012300 bytes >
+ * 10485760 bytes"), measured on the encoded string rather than the decoded
+ * bytes. Either rejection poisons every retry and model fallback because the
+ * block stays in context, so both are clamped before the request goes out.
+ * A host with a different image contract sets `max-image-dimension` /
+ * `max-image-payload-bytes` in the KDL compatibility rules.
+ */
+const ANTHROPIC_MAX_IMAGE_DIMENSION = 8000;
+const ANTHROPIC_MAX_IMAGE_PAYLOAD_BYTES = 10 * 1024 * 1024;
+/** Headroom for the surrounding JSON and any provider-side accounting. */
+const ANTHROPIC_IMAGE_PAYLOAD_HEADROOM = 0.9;
+/** Re-encode passes allowed to bring one image under the byte budget. */
+const ANTHROPIC_IMAGE_RESIZE_ATTEMPTS = 4;
+
+/**
+ * Image bounds for one request. `maxDimension` and `payloadBudget` come from
+ * resolved model policy (`max-image-dimension`, `max-image-payload-bytes`) so
+ * a deployment whose image contract differs from the canonical API can
+ * override them, and the many-image path tightens `maxDimension` further
+ * because many images share one request budget.
+ */
+interface AnthropicImageCaps {
+	maxDimension: number;
+	payloadBudget: number;
+}
+
+function countAnthropicImageBlocks(messages: Message[]): number {
+	let count = 0;
+	for (const message of messages) {
+		if (message.role !== "user" && message.role !== "developer" && message.role !== "toolResult") continue;
+		if (!Array.isArray(message.content)) continue;
+		for (const block of message.content) {
+			if (block.type === "image") count++;
+		}
+	}
+	return count;
+}
+
+/**
+ * Ceiling on encoder output pixels in flight. One 8000x8000 RGBA surface is
+ * roughly 256 MiB, so admitting four of them would spike the CLI by a
+ * gigabyte; at the full-resolution cap this yields a single pipeline, while
+ * the many-image cap encodes at most 2000px and keeps the four-way fan-out.
+ */
+const ANTHROPIC_IMAGE_RESIZE_PIXEL_BUDGET = 16_000_000;
+const ANTHROPIC_IMAGE_RESIZE_MAX_CONCURRENCY = 4;
+
+function anthropicImageResizeConcurrency(maxDimension: number): number {
+	const perPipeline = maxDimension * maxDimension;
+	if (perPipeline <= 0) return ANTHROPIC_IMAGE_RESIZE_MAX_CONCURRENCY;
+	return Math.max(
+		1,
+		Math.min(ANTHROPIC_IMAGE_RESIZE_MAX_CONCURRENCY, Math.floor(ANTHROPIC_IMAGE_RESIZE_PIXEL_BUDGET / perPipeline)),
+	);
+}
+
+/**
+ * Memoized resize results keyed on ImageContent identity, per cap pair.
+ * Callers keep message objects stable across turns, so without this every
+ * request (and every in-provider retry of a fresh turn) re-decodes and
+ * re-encodes the same oversized screenshots. A cached value identical to the
+ * key means "already within bounds / unresizable — skip the decode". The caps
+ * depend on image count and on resolved policy, so each pair keeps its own
+ * cache: a value cached at 8000px is not reusable at 2000px.
+ */
+const anthropicImageResizeCaches = new Map<string, WeakMap<ImageContent, ImageContent>>();
+
+function anthropicImageResizeCache(caps: AnthropicImageCaps): WeakMap<ImageContent, ImageContent> {
+	const key = `${caps.maxDimension}:${caps.payloadBudget}`;
+	const existing = anthropicImageResizeCaches.get(key);
+	if (existing) return existing;
+	const created = new WeakMap<ImageContent, ImageContent>();
+	anthropicImageResizeCaches.set(key, created);
+	return created;
+}
+
+type ResizeLimiter = <R>(fn: () => Promise<R>) => Promise<R>;
+
+/**
+ * Bounded-concurrency gate for image decode/encode work. The many-image path
+ * fans out over every block of every message; unbounded, 100+ oversized images
+ * would decode concurrently and spike memory by gigabytes. Slots are handed
+ * off directly to the next waiter on release.
+ */
+function createResizeLimiter(limit: number): ResizeLimiter {
+	let active = 0;
+	const queue: (() => void)[] = [];
+	return async fn => {
+		if (active >= limit) {
+			const { promise, resolve } = Promise.withResolvers<void>();
+			queue.push(resolve);
+			await promise;
+		} else {
+			active++;
+		}
+		try {
+			return await fn();
+		} finally {
+			const next = queue.shift();
+			if (next) next();
+			else active--;
+		}
+	};
+}
+
+async function resizeAnthropicImageBlock(block: ImageContent, caps: AnthropicImageCaps): Promise<ImageContent> {
+	const { maxDimension, payloadBudget } = caps;
+	try {
+		const inputBuffer = Buffer.from(block.data, "base64");
+		const { width, height } = await new Bun.Image(inputBuffer).metadata();
+		if (!width || !height) return block;
+		const overDimension = width > maxDimension || height > maxDimension;
+		const overBudget = block.data.length > payloadBudget;
+		if (!overDimension && !overBudget) return block;
+
+		// Fitting the pixel cap does not imply fitting the byte cap: a dense
+		// screenshot re-encodes large even at the cap. Shrink by the overshoot in
+		// area terms until the payload fits or the passes run out.
+		let scale = Math.min(1, maxDimension / width, maxDimension / height);
+		let best: { buffer: Uint8Array; mimeType: string } | undefined;
+		for (let attempt = 0; attempt < ANTHROPIC_IMAGE_RESIZE_ATTEMPTS; attempt++) {
+			const targetWidth = Math.max(1, Math.min(maxDimension, Math.round(width * scale)));
+			const targetHeight = Math.max(1, Math.min(maxDimension, Math.round(height * scale)));
+			// One encoder at a time: a full-resolution surface is hundreds of
+			// megabytes, so the two candidates never coexist.
+			const png = await new Bun.Image(inputBuffer).resize(targetWidth, targetHeight).png().bytes();
+			const jpeg = await new Bun.Image(inputBuffer).resize(targetWidth, targetHeight).jpeg({ quality: 85 }).bytes();
+			best =
+				png.length <= jpeg.length
+					? { buffer: png, mimeType: "image/png" }
+					: { buffer: jpeg, mimeType: "image/jpeg" };
+
+			// Base64 expands three bytes into four characters; the encoded length
+			// is what Anthropic measures, so derive it without encoding.
+			const encoded = Math.ceil(best.buffer.length / 3) * 4;
+			if (encoded <= payloadBudget) break;
+			if (targetWidth === 1 && targetHeight === 1) break;
+			scale *= Math.max(0.25, Math.sqrt(payloadBudget / encoded) * 0.9);
+		}
+		if (!best) return block;
+
+		const data = Buffer.from(best.buffer).toString("base64");
+		// An image inside the pixel cap is only worth replacing if it shrank.
+		if (!overDimension && data.length >= block.data.length) return block;
+		// The rebuilt block carries no `url` or `providerFile`: those reference
+		// the original bytes, and Anthropic validates a referenced image after
+		// fetching it, so keeping either would resend the oversized copy.
+		return {
+			type: "image",
+			data,
+			mimeType: best.mimeType,
+		};
+	} catch (error) {
+		logger.warn("anthropic: failed to resize oversized image", {
+			mimeType: block.mimeType,
+			error: error instanceof Error ? error.message : String(error),
+		});
+		return block;
+	}
+}
+
+async function resizeAnthropicImageContent(
+	content: (TextContent | ImageContent)[],
+	state: { resized: number },
+	limit: ResizeLimiter,
+	caps: AnthropicImageCaps,
+): Promise<(TextContent | ImageContent)[]> {
+	let changed = false;
+	const cache = anthropicImageResizeCache(caps);
+	const next = await Promise.all(
+		content.map(async block => {
+			if (block.type !== "image") return block;
+			let resized = cache.get(block);
+			if (resized === undefined) {
+				resized = await limit(() => resizeAnthropicImageBlock(block, caps));
+				cache.set(block, resized);
+			}
+			if (resized !== block) {
+				changed = true;
+				state.resized++;
+			}
+			return resized;
+		}),
+	);
+	return changed ? next : content;
+}
+
+async function resizeAnthropicImageMessage(
+	message: Message,
+	state: { resized: number },
+	limit: ResizeLimiter,
+	caps: AnthropicImageCaps,
+): Promise<Message> {
+	if (message.role === "user" || message.role === "developer") {
+		if (!Array.isArray(message.content)) return message;
+		const content = await resizeAnthropicImageContent(message.content, state, limit, caps);
+		return content === message.content ? message : { ...message, content };
+	}
+	if (message.role === "toolResult") {
+		const content = await resizeAnthropicImageContent(message.content, state, limit, caps);
+		return content === message.content ? message : { ...message, content };
+	}
+	return message;
+}
+
+/**
+ * Clamp every image a Claude reader would receive to the host's contract.
+ * Limits the model's policy leaves unset fall back to the canonical Anthropic
+ * API. Returns `context` itself when nothing needed resizing.
+ */
+export async function prepareAnthropicImageContext(
+	context: Context,
+	model: Model<"anthropic-messages"> | Model<"google-gemini-cli">,
+): Promise<Context> {
+	if (!model.input.includes("image")) return context;
+	const imageCount = countAnthropicImageBlocks(context.messages);
+	if (imageCount === 0) return context;
+	// Many images share one request size budget, so they get the tighter cap.
+	// A smaller set only has to clear the host's per-image limit.
+	const hostMaxDimension = model.compat.maxImageDimension ?? ANTHROPIC_MAX_IMAGE_DIMENSION;
+	const maxDimension =
+		imageCount > ANTHROPIC_MANY_IMAGE_THRESHOLD
+			? Math.min(ANTHROPIC_MANY_IMAGE_MAX_DIMENSION, hostMaxDimension)
+			: hostMaxDimension;
+	const maxPayloadBytes = model.compat.maxImagePayloadBytes ?? ANTHROPIC_MAX_IMAGE_PAYLOAD_BYTES;
+	const caps: AnthropicImageCaps = {
+		maxDimension,
+		payloadBudget: Math.floor(maxPayloadBytes * ANTHROPIC_IMAGE_PAYLOAD_HEADROOM),
+	};
+
+	let changed = false;
+	const state = { resized: 0 };
+	const limit = createResizeLimiter(anthropicImageResizeConcurrency(maxDimension));
+	const messages = await Promise.all(
+		context.messages.map(async message => {
+			const next = await resizeAnthropicImageMessage(message, state, limit, caps);
+			if (next !== message) changed = true;
+			return next;
+		}),
+	);
+	if (!changed) return context;
+	logger.debug("anthropic: resized oversized images", {
+		imageCount,
+		resized: state.resized,
+		maxDimension,
+	});
+	return { ...context, messages };
+}

package/src/providers/anthropic-state.ts

@@ -27,6 +27,19 @@ export function resolveDirectAnthropicBaseUrl(model: Model<Api>): string {
 	return normalizeAnthropicBaseUrl($env.ANTHROPIC_BASE_URL) ?? configured ?? "https://api.anthropic.com";
 }
 
+/**
+ * Whether a request to `model` reaches the official endpoint its compat was built for. `compat.officialEndpoint`
+ * classifies the configured `baseUrl`, but a first-party Anthropic model is rerouted at request time by
+ * `ANTHROPIC_BASE_URL` or Foundry's `FOUNDRY_BASE_URL` without rebuilding compat. Gates official-only host
+ * limits such as the catalog's inline image byte and image count budgets.
+ */
+export function reachesOfficialEndpoint(model: Model<Api>): boolean {
+	const compat = model.compat;
+	if (!compat || !("officialEndpoint" in compat) || !compat.officialEndpoint) return false;
+	if (model.provider !== "anthropic" || model.api !== "anthropic-messages") return true;
+	return isOfficialAnthropicApiUrl(resolveDirectAnthropicBaseUrl(model));
+}
+
 /** Build the endpoint-and-model-scoped Anthropic session-state key. */
 export function anthropicProviderSessionStateKey(baseUrl: string, modelId: string): string {
 	return `${ANTHROPIC_PROVIDER_SESSION_STATE_KEY}:${baseUrl}\u0000${modelId}`;

package/src/providers/anthropic.ts

@@ -9,6 +9,7 @@ import { isAnthropicOAuthToken } from "@oh-my-pi/pi-catalog/utils";
 import { parseGitHubCopilotApiKey } from "@oh-my-pi/pi-catalog/wire/github-copilot";
 import {
 	$env,
+	$flag,
 	isEnoent,
 	logger,
 	parseJsonWithRepair,
@@ -116,10 +117,12 @@ import {
 	type MessageCreateParams,
 	type MessageCreateParamsStreaming,
 	type MessageParam,
+	type OutputConfig,
 	parseAnthropicInputTransformations,
 	type RawMessageStreamEvent,
 	THINKING_BINDING_CONTROLS_BETA,
 	type TextBlockParam,
+	type ThinkingConfigParam,
 } from "./anthropic-wire";
 import {
 	claudeCodeSdkVersion,
@@ -138,6 +141,7 @@ import {
 	resolveGitHubCopilotBaseUrl,
 	wrapFetchForCopilotFallback,
 } from "./github-copilot-headers";
+import { prepareAnthropicImageContext } from "./anthropic-images";
 import { servedModelFromAnthropicSignature } from "./anthropic-signature";
 import { getOpenAIPromptCacheKey } from "./openai-shared";
 import { applyInferenceHeaders } from "./inference-headers";
@@ -273,24 +277,41 @@ const promptCacheBetas: Record<string, true> = {
 };
 
 /**
- * Remove the prompt-cache betas from every `anthropic-beta` entry in a header
+ * Betas withheld under the kill switch: they gate the pre-release body fields
+ * it removes (Claude Code's gateway contract: context management, beta tool
+ * fields, structured-output format, task budgets, tool search), plus the
+ * thinking-binding and compaction controls omp also withholds.
+ */
+const killSwitchBetas: Record<string, true> = {
+	[THINKING_BINDING_CONTROLS_BETA]: true,
+	[contextManagementBeta]: true,
+	[COMPACTION_BETA]: true,
+	[LEGACY_COMPACTION_BETA]: true,
+	[structuredOutputsBeta]: true,
+	[taskBudgetBeta]: true,
+	[midConversationToolChangesBeta]: true,
+};
+
+/**
+ * Remove the `dropped` betas from every `anthropic-beta` entry in a header
  * record. Header names are case-insensitive and the value is a comma-separated
  * list, so each matching key keeps its own casing and its remaining tokens;
  * an entry left with no token is deleted rather than sent empty. The input is
- * returned untouched when it advertises no cache beta.
+ * returned untouched when it advertises none of them.
  *
  * `model.headers` and `options.headers` are caller-controlled channels that
  * reach the wire through `buildAnthropicHeaders` (as `modelHeaders`, which an
  * override-enabled endpoint lets replace our own beta header outright), the
  * GitHub Copilot default headers, and the per-request beta override built for
- * injected clients — each of which must go through here once breakpoints drop.
+ * injected clients — each of which must go through here once breakpoints drop
+ * or the experimental-beta kill switch is on.
  */
-function stripPromptCacheBetas(headers: Record<string, string>): Record<string, string> {
+function stripHeaderBetas(headers: Record<string, string>, dropped: Record<string, true>): Record<string, string> {
 	let stripped: Record<string, string> | undefined;
 	for (const key in headers) {
 		if (key.toLowerCase() !== "anthropic-beta") continue;
 		const betas = normalizeExtraBetas(headers[key]);
-		const kept = betas.filter(beta => promptCacheBetas[beta] !== true);
+		const kept = betas.filter(beta => dropped[beta] !== true);
 		if (kept.length === betas.length) continue;
 		stripped ??= { ...headers };
 		if (kept.length === 0) {
@@ -952,253 +973,6 @@ function decodeAnthropicToolName(name: string, isOAuthToken: boolean, escapeBuil
 	return name;
 }
 
-const ANTHROPIC_MANY_IMAGE_THRESHOLD = 20;
-const ANTHROPIC_MANY_IMAGE_MAX_DIMENSION = 2000;
-/**
- * Image contract of the canonical Anthropic Messages API, used when resolved
- * model policy names no other: 8000px per side ("At least one of the image
- * dimensions exceed max allowed size: 8000 pixels") and a 10 MB base64
- * payload per block ("image exceeds 10 MB maximum: 14012300 bytes >
- * 10485760 bytes"), measured on the encoded string rather than the decoded
- * bytes. Either rejection poisons every retry and model fallback because the
- * block stays in context, so both are clamped before the request goes out.
- * A host with a different image contract sets `max-image-dimension` /
- * `max-image-payload-bytes` in the KDL compatibility rules.
- */
-const ANTHROPIC_MAX_IMAGE_DIMENSION = 8000;
-const ANTHROPIC_MAX_IMAGE_PAYLOAD_BYTES = 10 * 1024 * 1024;
-/** Headroom for the surrounding JSON and any provider-side accounting. */
-const ANTHROPIC_IMAGE_PAYLOAD_HEADROOM = 0.9;
-/** Re-encode passes allowed to bring one image under the byte budget. */
-const ANTHROPIC_IMAGE_RESIZE_ATTEMPTS = 4;
-
-/**
- * Image bounds for one request. `maxDimension` and `payloadBudget` come from
- * resolved model policy (`max-image-dimension`, `max-image-payload-bytes`) so
- * a deployment whose image contract differs from the canonical API can
- * override them, and the many-image path tightens `maxDimension` further
- * because many images share one request budget.
- */
-interface AnthropicImageCaps {
-	maxDimension: number;
-	payloadBudget: number;
-}
-
-function countAnthropicImageBlocks(messages: Message[]): number {
-	let count = 0;
-	for (const message of messages) {
-		if (message.role !== "user" && message.role !== "developer" && message.role !== "toolResult") continue;
-		if (!Array.isArray(message.content)) continue;
-		for (const block of message.content) {
-			if (block.type === "image") count++;
-		}
-	}
-	return count;
-}
-
-/**
- * Ceiling on encoder output pixels in flight. One 8000x8000 RGBA surface is
- * roughly 256 MiB, so admitting four of them would spike the CLI by a
- * gigabyte; at the full-resolution cap this yields a single pipeline, while
- * the many-image cap encodes at most 2000px and keeps the four-way fan-out.
- */
-const ANTHROPIC_IMAGE_RESIZE_PIXEL_BUDGET = 16_000_000;
-const ANTHROPIC_IMAGE_RESIZE_MAX_CONCURRENCY = 4;
-
-function anthropicImageResizeConcurrency(maxDimension: number): number {
-	const perPipeline = maxDimension * maxDimension;
-	if (perPipeline <= 0) return ANTHROPIC_IMAGE_RESIZE_MAX_CONCURRENCY;
-	return Math.max(
-		1,
-		Math.min(ANTHROPIC_IMAGE_RESIZE_MAX_CONCURRENCY, Math.floor(ANTHROPIC_IMAGE_RESIZE_PIXEL_BUDGET / perPipeline)),
-	);
-}
-
-/**
- * Memoized resize results keyed on ImageContent identity, per cap pair.
- * Callers keep message objects stable across turns, so without this every
- * request (and every in-provider retry of a fresh turn) re-decodes and
- * re-encodes the same oversized screenshots. A cached value identical to the
- * key means "already within bounds / unresizable — skip the decode". The caps
- * depend on image count and on resolved policy, so each pair keeps its own
- * cache: a value cached at 8000px is not reusable at 2000px.
- */
-const anthropicImageResizeCaches = new Map<string, WeakMap<ImageContent, ImageContent>>();
-
-function anthropicImageResizeCache(caps: AnthropicImageCaps): WeakMap<ImageContent, ImageContent> {
-	const key = `${caps.maxDimension}:${caps.payloadBudget}`;
-	const existing = anthropicImageResizeCaches.get(key);
-	if (existing) return existing;
-	const created = new WeakMap<ImageContent, ImageContent>();
-	anthropicImageResizeCaches.set(key, created);
-	return created;
-}
-
-type ResizeLimiter = <R>(fn: () => Promise<R>) => Promise<R>;
-
-/**
- * Bounded-concurrency gate for image decode/encode work. The many-image path
- * fans out over every block of every message; unbounded, 100+ oversized images
- * would decode concurrently and spike memory by gigabytes. Slots are handed
- * off directly to the next waiter on release.
- */
-function createResizeLimiter(limit: number): ResizeLimiter {
-	let active = 0;
-	const queue: (() => void)[] = [];
-	return async fn => {
-		if (active >= limit) {
-			const { promise, resolve } = Promise.withResolvers<void>();
-			queue.push(resolve);
-			await promise;
-		} else {
-			active++;
-		}
-		try {
-			return await fn();
-		} finally {
-			const next = queue.shift();
-			if (next) next();
-			else active--;
-		}
-	};
-}
-
-async function resizeAnthropicImageBlock(block: ImageContent, caps: AnthropicImageCaps): Promise<ImageContent> {
-	const { maxDimension, payloadBudget } = caps;
-	try {
-		const inputBuffer = Buffer.from(block.data, "base64");
-		const { width, height } = await new Bun.Image(inputBuffer).metadata();
-		if (!width || !height) return block;
-		const overDimension = width > maxDimension || height > maxDimension;
-		const overBudget = block.data.length > payloadBudget;
-		if (!overDimension && !overBudget) return block;
-
-		// Fitting the pixel cap does not imply fitting the byte cap: a dense
-		// screenshot re-encodes large even at the cap. Shrink by the overshoot in
-		// area terms until the payload fits or the passes run out.
-		let scale = Math.min(1, maxDimension / width, maxDimension / height);
-		let best: { buffer: Uint8Array; mimeType: string } | undefined;
-		for (let attempt = 0; attempt < ANTHROPIC_IMAGE_RESIZE_ATTEMPTS; attempt++) {
-			const targetWidth = Math.max(1, Math.min(maxDimension, Math.round(width * scale)));
-			const targetHeight = Math.max(1, Math.min(maxDimension, Math.round(height * scale)));
-			// One encoder at a time: a full-resolution surface is hundreds of
-			// megabytes, so the two candidates never coexist.
-			const png = await new Bun.Image(inputBuffer).resize(targetWidth, targetHeight).png().bytes();
-			const jpeg = await new Bun.Image(inputBuffer).resize(targetWidth, targetHeight).jpeg({ quality: 85 }).bytes();
-			best =
-				png.length <= jpeg.length
-					? { buffer: png, mimeType: "image/png" }
-					: { buffer: jpeg, mimeType: "image/jpeg" };
-
-			// Base64 expands three bytes into four characters; the encoded length
-			// is what Anthropic measures, so derive it without encoding.
-			const encoded = Math.ceil(best.buffer.length / 3) * 4;
-			if (encoded <= payloadBudget) break;
-			if (targetWidth === 1 && targetHeight === 1) break;
-			scale *= Math.max(0.25, Math.sqrt(payloadBudget / encoded) * 0.9);
-		}
-		if (!best) return block;
-
-		const data = Buffer.from(best.buffer).toString("base64");
-		// An image inside the pixel cap is only worth replacing if it shrank.
-		if (!overDimension && data.length >= block.data.length) return block;
-		// The rebuilt block carries no `url` or `providerFile`: those reference
-		// the original bytes, and Anthropic validates a referenced image after
-		// fetching it, so keeping either would resend the oversized copy.
-		return {
-			type: "image",
-			data,
-			mimeType: best.mimeType,
-		};
-	} catch (error) {
-		logger.warn("anthropic: failed to resize oversized image", {
-			mimeType: block.mimeType,
-			error: error instanceof Error ? error.message : String(error),
-		});
-		return block;
-	}
-}
-
-async function resizeAnthropicImageContent(
-	content: (TextContent | ImageContent)[],
-	state: { resized: number },
-	limit: ResizeLimiter,
-	caps: AnthropicImageCaps,
-): Promise<(TextContent | ImageContent)[]> {
-	let changed = false;
-	const cache = anthropicImageResizeCache(caps);
-	const next = await Promise.all(
-		content.map(async block => {
-			if (block.type !== "image") return block;
-			let resized = cache.get(block);
-			if (resized === undefined) {
-				resized = await limit(() => resizeAnthropicImageBlock(block, caps));
-				cache.set(block, resized);
-			}
-			if (resized !== block) {
-				changed = true;
-				state.resized++;
-			}
-			return resized;
-		}),
-	);
-	return changed ? next : content;
-}
-
-async function resizeAnthropicImageMessage(
-	message: Message,
-	state: { resized: number },
-	limit: ResizeLimiter,
-	caps: AnthropicImageCaps,
-): Promise<Message> {
-	if (message.role === "user" || message.role === "developer") {
-		if (!Array.isArray(message.content)) return message;
-		const content = await resizeAnthropicImageContent(message.content, state, limit, caps);
-		return content === message.content ? message : { ...message, content };
-	}
-	if (message.role === "toolResult") {
-		const content = await resizeAnthropicImageContent(message.content, state, limit, caps);
-		return content === message.content ? message : { ...message, content };
-	}
-	return message;
-}
-
-async function prepareAnthropicImageContext(context: Context, model: Model<"anthropic-messages">): Promise<Context> {
-	if (!model.input.includes("image")) return context;
-	const imageCount = countAnthropicImageBlocks(context.messages);
-	if (imageCount === 0) return context;
-	// Many images share one request size budget, so they get the tighter cap.
-	// A smaller set only has to clear the host's per-image limit.
-	const hostMaxDimension = model.compat.maxImageDimension ?? ANTHROPIC_MAX_IMAGE_DIMENSION;
-	const maxDimension =
-		imageCount > ANTHROPIC_MANY_IMAGE_THRESHOLD
-			? Math.min(ANTHROPIC_MANY_IMAGE_MAX_DIMENSION, hostMaxDimension)
-			: hostMaxDimension;
-	const maxPayloadBytes = model.compat.maxImagePayloadBytes ?? ANTHROPIC_MAX_IMAGE_PAYLOAD_BYTES;
-	const caps: AnthropicImageCaps = {
-		maxDimension,
-		payloadBudget: Math.floor(maxPayloadBytes * ANTHROPIC_IMAGE_PAYLOAD_HEADROOM),
-	};
-
-	let changed = false;
-	const state = { resized: 0 };
-	const limit = createResizeLimiter(anthropicImageResizeConcurrency(maxDimension));
-	const messages = await Promise.all(
-		context.messages.map(async message => {
-			const next = await resizeAnthropicImageMessage(message, state, limit, caps);
-			if (next !== message) changed = true;
-			return next;
-		}),
-	);
-	if (!changed) return context;
-	logger.debug("anthropic: resized oversized images", {
-		imageCount,
-		resized: state.resized,
-		maxDimension,
-	});
-	return { ...context, messages };
-}
-
 type AnthropicImageSource =
 	| { type: "base64"; media_type: AnthropicImageMediaType; data: string }
 	| { type: "url"; url: string }
@@ -2406,6 +2180,9 @@ const streamAnthropicOnce = (
 			};
 			let dropAllThinking = droppedAllThinkingForSignature;
 			let prefixBindingRetryAttempted = false;
+			// Claude Code's `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS`; the wrapper
+			// already turned the gated compat off, this covers caller/frozen inputs.
+			const killSwitchActive = experimentalBetasDisabled(model);
 			// A live fallback-credit redemption replays its frozen body.
 			const frozenRedemption =
 				options?.fallbackCreditRedemption &&
@@ -2413,6 +2190,24 @@ const streamAnthropicOnce = (
 				options.fallbackCreditRedemption.params
 					? options.fallbackCreditRedemption
 					: undefined;
+			// A body frozen before the kill switch was set still carries the fields
+			// it withholds; the credit token is bound to that body, so forfeit it
+			// and build a fresh request. Server tools that already ran would re-run
+			// and re-bill on a tokenless retry, so surface that case instead.
+			const frozenBody = frozenRedemption?.params as MessageCreateParamsStreaming | undefined;
+			// The redemption drops `fallbacks` before sending, so they cannot force a forfeit.
+			const forfeitFrozenForKillSwitch =
+				killSwitchActive &&
+				frozenBody !== undefined &&
+				carriesKillSwitchField({ ...frozenBody, fallbacks: undefined });
+			if (
+				forfeitFrozenForKillSwitch &&
+				frozenRedemption?.refusedContent?.some(block => block.type === "anthropicServerTool")
+			) {
+				throw new AIError.ConfigurationError(
+					"CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS was set after a refused turn that ran server tools; its fallback credit cannot be redeemed without the experimental fields the switch withholds.",
+				);
+			}
 			// Collected at most once, on first params build; a frozen redemption
 			// body never builds params.
 			let controlRecords: AnthropicControlRecord[] | undefined;
@@ -2431,12 +2226,16 @@ const streamAnthropicOnce = (
 			// `anthropic-beta` value, so once breakpoints are dropped an unstripped
 			// base would re-attach the very cache beta the replay abandoned. Both
 			// prompt-cache betas govern `ttl`/`scope`, so the options rung has to
-			// strip them too. Read through a closure because both flags flip
-			// mid-turn.
-			const callerBetaBaseHeaders = (): Record<string, string> =>
-				dropCacheControl || dropCacheControlOptions
-					? stripPromptCacheBetas(mergedCallerHeaders)
-					: mergedCallerHeaders;
+			// strip them too. The kill switch's betas never ride, whatever the
+			// caller's header says. Read through a closure because both cache
+			// flags flip mid-turn.
+			const callerBetaBaseHeaders = (): Record<string, string> => {
+				const headers =
+					dropCacheControl || dropCacheControlOptions
+						? stripHeaderBetas(mergedCallerHeaders, promptCacheBetas)
+						: mergedCallerHeaders;
+				return killSwitchActive ? stripHeaderBetas(headers, killSwitchBetas) : headers;
+			};
 			// Keep fallback payloads aligned with the top-level Vertex effort gate:
 			// no nested effort field means the fallback scan cannot re-add its beta.
 			let fallbacks = options?.fallbacks;
@@ -2565,7 +2364,9 @@ const streamAnthropicOnce = (
 				if (!isOAuth && isOfficialAnthropicApiUrl(baseUrl) && !extraBetas.includes(fallbackCreditBeta)) {
 					extraBetas.push(fallbackCreditBeta);
 				}
-				if (options?.fallbackCreditRedemption) {
+				// A forfeited frozen body is rebuilt fresh, so it keeps the betas
+				// computed above instead of the saved list describing the old body.
+				if (options?.fallbackCreditRedemption && !forfeitFrozenForKillSwitch) {
 					const frozenBetas = (options.fallbackCreditRedemption.betas ?? []).filter(
 						b => !b.startsWith("server-side-fallback-"),
 					);
@@ -2598,6 +2399,8 @@ const streamAnthropicOnce = (
 						}
 					}
 				}
+				// Caller betas and a frozen redemption's beta list bypass compat.
+				if (killSwitchActive) extraBetas = extraBetas.filter(beta => killSwitchBetas[beta] !== true);
 
 				clientArgs = {
 					model,
@@ -2659,6 +2462,8 @@ const streamAnthropicOnce = (
 				if (replacementPayload !== undefined) {
 					nextParams = replacementPayload as typeof nextParams;
 				}
+				// After `onPayload`, so a hook cannot restore a field the switch withholds.
+				if (killSwitchActive) withholdKillSwitchFields(nextParams);
 				if (nextParams.compaction) stripCompactionIncompatibleParams(nextParams);
 				// After `onPayload`, so a hook cannot restore a field Bedrock rejects.
 				if (model.compat.bedrockMessagesApi) fitBedrockAnthropicPayload(nextParams);
@@ -2696,7 +2501,7 @@ const streamAnthropicOnce = (
 			let params: MessageCreateParamsStreaming;
 			// Recheck expiry here: preparation (image resizing) is async, and an
 			// expired token must fall back to a fresh request as before.
-			if (frozenRedemption && Date.now() <= frozenRedemption.expiresAt) {
+			if (frozenRedemption && !forfeitFrozenForKillSwitch && Date.now() <= frozenRedemption.expiresAt) {
 				const redemption = frozenRedemption;
 				usingFallbackCredit = true;
 				const frozenParams = structuredClone(redemption.params as MessageCreateParamsStreaming);
@@ -2925,7 +2730,12 @@ const streamAnthropicOnce = (
 					const rawBetas = options.fallbackCreditRedemption.betaHeader
 						.split(",")
 						.map(b => b.trim())
-						.filter(b => b && !b.startsWith("server-side-fallback-"));
+						.filter(
+							b =>
+								b &&
+								!b.startsWith("server-side-fallback-") &&
+								(!killSwitchActive || killSwitchBetas[b] !== true),
+						);
 					if (!rawBetas.includes(fallbackCreditBeta) && !rawBetas.includes("fallback-credit-2026-06-01")) {
 						rawBetas.push(fallbackCreditBeta);
 					}
@@ -4003,10 +3813,97 @@ const streamAnthropicOnce = (
  * loop. The inner attempt owns Anthropic provider-failure retries.
  */
 export const streamAnthropic: StreamFunction<"anthropic-messages"> = (model, context, options) =>
-	withReplaySafeStreamRetry(model, context, options, streamAnthropicOnce, {
+	withReplaySafeStreamRetry(withoutDisabledExperimentalBetas(model), context, options, streamAnthropicOnce, {
 		retryEmptyCompletion: true,
 	});
 
+/** Whether Claude Code's `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS` applies to this model's provider. */
+function experimentalBetasDisabled(model: Model<"anthropic-messages">): boolean {
+	return model.compat.honorsClaudeCodeBetaKillSwitch === true && $flag("CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS");
+}
+
+/**
+ * Whether a request body carries a field the kill switch withholds. A frozen
+ * fallback-credit body that does cannot be redeemed under the switch. Defined
+ * as "the sanitizer would change it" so detection and stripping cannot drift.
+ */
+function carriesKillSwitchField(params: MessageCreateParamsStreaming): boolean {
+	const sanitized = structuredClone(params);
+	withholdKillSwitchFields(sanitized);
+	return !Bun.deepEquals(sanitized, params);
+}
+
+/**
+ * Remove every field the kill switch withholds from a final request body, for
+ * payloads an `onPayload` hook replaced after compat already shaped them, and
+ * for the switch's fields compat has no axis for (task budgets). Compaction
+ * blocks keep their readable summary as text, the same form an endpoint
+ * without compaction support receives.
+ */
+function withholdKillSwitchFields(params: MessageCreateParamsStreaming): void {
+	withholdKillSwitchControls(params);
+	delete params.context_management;
+	delete params.compaction;
+	// Server-side fallback entries carry their own per-attempt controls.
+	for (const entry of params.fallbacks ?? []) withholdKillSwitchControls(entry);
+	for (const tool of params.tools ?? []) {
+		if ("strict" in tool) delete tool.strict;
+		if ("defer_loading" in tool) delete tool.defer_loading;
+		if ("eager_input_streaming" in tool) delete tool.eager_input_streaming;
+	}
+	for (const message of params.messages) {
+		// Per-message `output_config` (mid-conversation effort) may carry the same controls.
+		if ("output_config" in message && message.output_config) withholdKillSwitchControls(message);
+		if (!Array.isArray(message.content)) continue;
+		for (let i = 0; i < message.content.length; i++) {
+			const block = message.content[i];
+			if (block.type === "compaction") message.content[i] = { type: "text", text: block.content };
+		}
+	}
+	if (params.anthropic_beta) {
+		params.anthropic_beta = params.anthropic_beta.filter(beta => killSwitchBetas[beta] !== true);
+	}
+}
+
+/** Withhold the kill switch's thinking/output controls on a body, fallback entry, or message. */
+function withholdKillSwitchControls(holder: { thinking?: ThinkingConfigParam; output_config?: OutputConfig }): void {
+	if (holder.thinking && "block_binding" in holder.thinking) delete holder.thinking.block_binding;
+	if (!holder.output_config) return;
+	delete holder.output_config.task_budget;
+	delete holder.output_config.format;
+	if (Object.keys(holder.output_config).length === 0) delete holder.output_config;
+}
+
+/**
+ * Honor Claude Code's `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS` kill switch on
+ * providers whose compat opts in (`honors-claude-code-beta-kill-switch`).
+ * Gateways behind `ANTHROPIC_BASE_URL` often reject pre-release body fields,
+ * so the switch withholds what Claude Code's gateway contract lists — context
+ * management, beta tool fields (`strict`, `defer_loading`,
+ * `eager_input_streaming`), tool search (mid-conversation tool changes),
+ * structured-output format, task budgets — plus `thinking.block_binding` and
+ * server compaction (whose legacy replay needs a `context_management` edit),
+ * together with their betas. Effort, adaptive thinking, interleaved thinking
+ * and extended context stay, as in Claude Code. Applied through compat so every
+ * request builder and retry rung sees one decision; {@link withholdKillSwitchFields}
+ * and {@link killSwitchBetas} cover the rest where bodies and betas are finalized.
+ */
+function withoutDisabledExperimentalBetas(model: Model<"anthropic-messages">): Model<"anthropic-messages"> {
+	if (!experimentalBetasDisabled(model)) return model;
+	return {
+		...model,
+		compat: {
+			...model.compat,
+			supportsContextManagement: false,
+			supportsThinkingBindingControls: false,
+			supportsServerCompaction: false,
+			disableStrictTools: true,
+			supportsEagerToolInputStreaming: false,
+			supportsMidConversationToolChanges: false,
+		},
+	};
+}
+
 export type AnthropicSystemBlock = {
 	type: "text";
 	text: string;
@@ -4163,7 +4060,9 @@ export function buildAnthropicClientOptions(args: AnthropicClientOptionsArgs): A
 		// Unlike the generic builder below, this branch has no enforced-key
 		// filter: a caller-supplied `anthropic-beta` lands in the default
 		// headers verbatim, cache betas included.
-		const defaultHeaders = dropPromptCacheBetas ? stripPromptCacheBetas(mergedCopilotHeaders) : mergedCopilotHeaders;
+		const defaultHeaders = dropPromptCacheBetas
+			? stripHeaderBetas(mergedCopilotHeaders, promptCacheBetas)
+			: mergedCopilotHeaders;
 		applyInferenceHeaders(defaultHeaders, {
 			provider: model.provider,
 			protocol: "anthropic",
@@ -4208,9 +4107,13 @@ export function buildAnthropicClientOptions(args: AnthropicClientOptionsArgs): A
 	// value outright — but `allowAnthropicHeaderOverrides` lets it replace our
 	// built beta header wholesale, which would put a cache beta back on a
 	// breakpoint-free request.
-	const requestModelHeaders = dropPromptCacheBetas
-		? stripPromptCacheBetas(mergedRequestHeaders)
+	// The kill switch's betas are stripped on the same channel.
+	const cacheStrippedHeaders = dropPromptCacheBetas
+		? stripHeaderBetas(mergedRequestHeaders, promptCacheBetas)
 		: mergedRequestHeaders;
+	const requestModelHeaders = experimentalBetasDisabled(model)
+		? stripHeaderBetas(cacheStrippedHeaders, killSwitchBetas)
+		: cacheStrippedHeaders;
 	const defaultHeaders = buildAnthropicHeaders({
 		apiKey,
 		baseUrl,

package/src/providers/google-gemini-cli.ts

@@ -36,6 +36,7 @@ import { armPreResponseTimeout, getStreamFirstEventTimeoutMs, iterateWithIdleTim
 // the stream provider trusts the access token threaded through `options.apiKey`.
 import { normalizeSchemaForCCA } from "../utils/schema";
 import { StreamMarkupHealing, type StreamMarkupHealingEvent } from "../utils/stream-markup-healing";
+import { prepareAnthropicImageContext } from "./anthropic-images";
 import forcedToolDirective from "./google-antigravity-forced-tool.md" with { type: "text" };
 import type { Content, FunctionCallingConfigMode, ThinkingConfig } from "./google-shared";
 import {
@@ -573,7 +574,16 @@ export const streamGoogleGeminiCli: StreamFunction<"google-gemini-cli"> = (
 				endpoints = baseUrl ? [baseUrl] : [DEFAULT_ENDPOINT];
 			}
 
-			let requestBody = buildRequest(model, context, projectId, options, isAntigravity);
+			// A host that declares an image contract (Claude behind Antigravity)
+			// rejects oversized images, and a rejected image stays in context, so
+			// clamp before building; readers without one take images as sent. The
+			// cost is one pass over the context, as on `anthropic-messages`: images
+			// already within bounds hit the per-image cache and are not decoded.
+			const requestContext =
+				model.compat.maxImageDimension !== undefined || model.compat.maxImagePayloadBytes !== undefined
+					? await prepareAnthropicImageContext(context, model)
+					: context;
+			let requestBody = buildRequest(model, requestContext, projectId, options, isAntigravity);
 			const replacementPayload = await options?.onPayload?.(requestBody, model);
 			if (replacementPayload !== undefined) {
 				requestBody = replacementPayload as typeof requestBody;

package/src/providers/openai-codex-responses.ts

@@ -7,6 +7,7 @@ import {
 	CODEX_CLIENT_VERSION,
 	codexRoutingHint,
 	getCodexAccountId,
+	isOfficialCodexApiUrl,
 	OPENAI_HEADER_VALUES,
 	OPENAI_HEADERS,
 } from "@oh-my-pi/pi-catalog/wire/codex";
@@ -25,7 +26,6 @@ import {
 import * as AIError from "../error";
 import { parseToolCallArguments, replayableToolCallArguments } from "../utils/tool-call-arguments";
 import { getEnvApiKey } from "../env-api-key";
-import { isOfficialCodexApiUrl } from "../stream";
 import type {
 	Api,
 	AssistantMessage,

package/src/providers/openai-responses.ts

@@ -496,6 +496,27 @@ function getOpenAIResponsesProviderSessionState(
 	return created;
 }
 
+/**
+ * Whether the next request for `model` replays native Responses history items
+ * (encrypted reasoning, item ids), as {@link buildParams} decides it. A session
+ * is cold, rebuilding turns from message content, from the first request on a
+ * connection-bound host (`compat.connectionBoundNativeHistory`, GitHub Copilot)
+ * and after `close()` on any host, until a response succeeds. Without session
+ * state every request replays.
+ */
+export function openAIResponsesReplaysNativeHistory(
+	model: Pick<Model, "api" | "provider" | "compat"> | null | undefined,
+	providerSessionState: Map<string, ProviderSessionState> | undefined,
+): boolean {
+	if (model?.api !== "openai-responses" || !providerSessionState) return true;
+	const state = providerSessionState.get(`${OPENAI_RESPONSES_PROVIDER_SESSION_STATE_PREFIX}${model.provider}`) as
+		| OpenAIResponsesProviderSessionState
+		| undefined;
+	if (state) return state.nativeHistoryReplayWarmed;
+	const compat = model.compat;
+	return !(compat && "connectionBoundNativeHistory" in compat && compat.connectionBoundNativeHistory);
+}
+
 /** Host per-provider storage defaults; see {@link configureProviderStoreResponses}. */
 let configuredProviderStoreResponses: Readonly<Record<string, boolean>> = {};
 

package/src/providers/openai-shared.ts

@@ -2064,7 +2064,7 @@ export function escapeReplayedControlTokens(items: ResponseInput): ResponseInput
  * Summary-only reasoning keeps the rebuild: it is no evidence of a server that
  * returns plaintext reasoning.
  */
-function isColdReplayableResponsesTurn(items: ResponseInput): boolean {
+export function isColdReplayableResponsesTurn(items: ResponseInput): boolean {
 	let hasReasoning = false;
 	for (const item of items) {
 		if ("id" in item && typeof item.id === "string") return false;

package/src/providers/transform-messages.ts

@@ -443,7 +443,11 @@ function sanitizeMalformedToolCalls(messages: Message[]): Message[] {
 	return result;
 }
 
-function shouldDropTruncatedThinkingOnlyAssistant(msg: AssistantMessage): boolean {
+/**
+ * Whether {@link transformMessages} drops `msg` from every replay: a turn cut
+ * off by `length` / `error` / `aborted` that carries no text and no tool call.
+ */
+export function shouldDropTruncatedThinkingOnlyAssistant(msg: AssistantMessage): boolean {
 	const isTruncatedStop = msg.stopReason === "length" || msg.stopReason === "error" || msg.stopReason === "aborted";
 	return isTruncatedStop && !msg.content.some(block => block.type === "toolCall" || block.type === "text");
 }

package/src/stream.ts

@@ -12,8 +12,9 @@ import {
 	mapEffortToGoogleThinkingLevel,
 	requireSupportedEffort,
 	resolveWireModelId,
+	withoutUnverifiedThinking,
 } from "@oh-my-pi/pi-catalog/model-thinking";
-import { CODEX_BASE_URL } from "@oh-my-pi/pi-catalog/wire/codex";
+import { isOfficialCodexApiUrl } from "@oh-my-pi/pi-catalog/wire/codex";
 import { $env, getProviderInFlightRoot, isEnoent, logger, untilAborted } from "@oh-my-pi/pi-utils";
 import { getCustomApi } from "./api-registry";
 import { createAuthRetryKeyState, isApiKeyResolver, resolvedApiKeyBearer, resolveNextAuthRetryKey } from "./auth-retry";
@@ -132,23 +133,6 @@ function isOfficialOpenAIApiUrl(baseUrl: string | undefined): boolean {
 	}
 }
 
-const OFFICIAL_CODEX_URL = new URL(CODEX_BASE_URL);
-
-/** Strict official-Codex endpoint check; exact origin or a path boundary after {@link CODEX_BASE_URL}. */
-export function isOfficialCodexApiUrl(baseUrl: string | undefined): boolean {
-	if (!baseUrl) return true;
-	try {
-		const candidate = new URL(baseUrl);
-		const candidatePath = candidate.pathname.replace(/\/+$/, "");
-		return (
-			candidate.origin === OFFICIAL_CODEX_URL.origin &&
-			(candidatePath === OFFICIAL_CODEX_URL.pathname || candidatePath.startsWith(`${OFFICIAL_CODEX_URL.pathname}/`))
-		);
-	} catch {
-		return false;
-	}
-}
-
 /**
  * Apply live leaked-thinking healing unless {@link model} is an official
  * first-party endpoint ({@link isLeakedThinkingHealExempt}), which emits
@@ -1237,6 +1221,11 @@ export function streamSimple<TApi extends Api>(
 	options?: SimpleStreamOptions,
 ): AssistantMessageEventStream {
 	const sessionOptions = withInferenceSessionId(options);
+	// Unverified thinking is opt-in: without a requested effort the request is
+	// byte-identical to a non-reasoning model's.
+	const effortRequested =
+		sessionOptions.reasoning !== undefined && !sessionOptions.disableReasoning && !sessionOptions.forceReasoningOff;
+	if (!effortRequested) model = withoutUnverifiedThinking(model);
 	if (!model.requiresGlyphTokenization) {
 		return streamSimpleRequest(model, context, sessionOptions);
 	}

package/src/types.ts

@@ -1287,6 +1287,12 @@ export interface AssistantMessage {
 	 */
 	serviceTier?: ServiceTier;
 	usage: Usage;
+	/**
+	 * Visible output tokens a history rewrite (shake) has since removed from
+	 * `content`. `usage.output` still counts them, so a replay estimate subtracts
+	 * them to keep the turn's reasoning without recharging the removed text.
+	 */
+	elidedOutputTokens?: number;
 	stopReason: StopReason;
 	stopDetails?: StopDetails | null;
 	errorMessage?: string;