@providerkit/core 0.22.0 → 0.23.0

package/src/providers/anthropic.ts

@@ -1,8 +1,9 @@
 // Anthropic-shape adapter — SSE from POST /v1/messages.
+import { repairHistory } from "../context.ts";
 import { fileRefused, ProviderError, streamCut, streamError } from "../errors.ts";
 import { schemaPrompt, toAnthropicToolSchema } from "../schema.ts";
-import { parseToolArgs } from "../tool-args.ts";
-import { streamSse, apiUrl } from "../transport.ts";
+import { parseToolArgs, settleToolCalls, type ToolCallIdentity } from "../tool-args.ts";
+import { streamSse, apiUrl, parseFrame } from "../transport.ts";
 import { attributionHeaders } from "../attribution.ts";
 import { withConfiguredFallbacks, type ProviderFallbackConfig } from "../fallback.ts";
 import type {
@@ -191,19 +192,32 @@ function continuesToolLoop(messages: readonly ChatMessage[]): boolean {
   return false;
 }
 
-function mapStopReason(reason: string | undefined): FinishReason | undefined {
+/**
+ * A stated stop, or a throw for one this adapter does not know. An unknown
+ * reason used to end the stream as a clean success with no finish at all.
+ * Nothing says the answer ended on purpose, so it is `overload`: theirs, and
+ * worth a retry (cc-proxy answers it the same way). `pause_turn` lands there
+ * too: it is a server-tool turn waiting to be sent back, which this adapter
+ * never asks for, and a half answer is not a finished one.
+ */
+function mapStopReason(provider: string, reason: string): FinishReason {
   switch (reason) {
     case "end_turn":
     case "stop_sequence":
       return "stop";
     case "tool_use":
       return "tool_calls";
+    // `model_context_window_exceeded`: the context window filled before the
+    // answer did. Cut short, and a retry fills it the same way.
     case "max_tokens":
+    case "model_context_window_exceeded":
       return "length";
     case "refusal":
       return "content_filter";
     default:
-      return undefined;
+      throw new ProviderError(provider, "overload", `${provider} stopped the turn on "${reason}"`, {
+        code: reason,
+      });
   }
 }
 
@@ -270,6 +284,34 @@ function jsonBlock(json: JsonOutput): unknown {
   return { type: "text", text: schemaPrompt(json.schema) };
 }
 
+/**
+ * Tool ids as this wire accepts them: `[A-Za-z0-9_-]` only. Kimi's
+ * `functions.search:0` is a 400 here, and an opencode-go rotation hands a
+ * history from chat completions to Messages mid-conversation, so a Kimi id
+ * does arrive. Each other character becomes `_`, and a result follows its call
+ * because both go through the same map.
+ *
+ * Collision-safe in one forward pass: an id whose cleaned form is already
+ * taken gets `_2`, `_3`…, judged only against ids seen before it, so an earlier
+ * id never changes because of a later one and the prompt cache keeps its
+ * prefix. A history whose ids are already clean comes out byte for byte.
+ */
+function anthropicIds(): (id: string) => string {
+  const sent = new Map<string, string>();
+  const taken = new Set<string>();
+  return (id) => {
+    let wire = sent.get(id);
+    if (wire === undefined) {
+      const clean = id.replace(/[^A-Za-z0-9_-]/g, "_");
+      wire = clean;
+      for (let k = 2; taken.has(wire); k++) wire = `${clean}_${k}`;
+      sent.set(id, wire);
+      taken.add(wire);
+    }
+    return wire;
+  };
+}
+
 export function toAnthropicMessages(
   messages: readonly ChatMessage[],
   provider = "anthropic",
@@ -277,6 +319,7 @@ export function toAnthropicMessages(
   system?: unknown[];
   messages: unknown[];
 } {
+  const wireId = anthropicIds();
   const system = messages
     .filter((m) => m.role === "system")
     .map((m) => m.content)
@@ -299,7 +342,7 @@ export function toAnthropicMessages(
       pushBlocks("user", [
         {
           type: "tool_result",
-          tool_use_id: message.toolCallId,
+          tool_use_id: wireId(message.toolCallId),
           content: [
             { type: "text", text: message.content },
             ...(message.images ?? []).map((image) => ({
@@ -319,7 +362,7 @@ export function toAnthropicMessages(
     for (const call of message.toolCalls ?? []) {
       blocks.push({
         type: "tool_use",
-        id: call.id,
+        id: wireId(call.id),
         name: call.name,
         input: parseToolArgs(call.arguments),
       });
@@ -373,7 +416,10 @@ export function createAnthropicProvider(config: AnthropicConfig): Provider {
       const model = opts.model ?? config.model;
       const maxTokens = opts.maxTokens ?? config.maxTokens ?? DEFAULT_MAX_TOKENS;
       const effort = opts.effort ?? config.effort;
-      const { system, messages: body } = toAnthropicMessages(messages, id);
+      // Repaired first: a result with no call, a call with no result, or an id
+      // used twice is a 400 that loses the turn. See repairHistory.
+      const sent = repairHistory(messages).messages;
+      const { system, messages: body } = toAnthropicMessages(sent, id);
 
       // Anthropic's own `service_tier` means auto or standard_only, not this.
       if (opts.serviceTier) {
@@ -438,7 +484,7 @@ export function createAnthropicProvider(config: AnthropicConfig): Provider {
       // ponytail: every loop step after the first goes unthought on these
       // models. The upgrade is replaying the signed thinking blocks.
       const unthought =
-        !claude && model.startsWith("claude-") && (forcesTool || continuesToolLoop(messages));
+        !claude && model.startsWith("claude-") && (forcesTool || continuesToolLoop(sent));
       if (claude) {
         // An effort the caller never set sends nothing: the model keeps its own
         // default, which on most of these is thinking ON.
@@ -476,12 +522,12 @@ export function createAnthropicProvider(config: AnthropicConfig): Provider {
       let cachedInputTokens = 0;
       let cacheWriteTokens = 0;
       let outputTokens = 0;
-      let toolCall: { index: number; id: string; name: string } | null = null;
+      let toolCall: ToolCallIdentity | null = null;
+      let sawToolCall = false;
       let blockIndex = -1;
       // What proves the turn ended rather than the socket: a stated stop
       // reason, or `message_stop`. See the check after the loop.
       let stopped = false;
-      let closed = false;
       const usageChunk = (): ProviderChunk => ({
         type: "usage",
         usage: {
@@ -510,13 +556,12 @@ export function createAnthropicProvider(config: AnthropicConfig): Provider {
         ...(opts.signal ? { signal: opts.signal } : {}),
         ...(config.fetchImpl ? { fetchImpl: config.fetchImpl } : {}),
         ...(opts.onActivity ? { onActivity: opts.onActivity } : {}),
+        ...(opts.onRateLimit ? { onRateLimit: opts.onRateLimit } : {}),
+        // The stop reason rides in `message_delta` with the final usage, so a
+        // read that dies after it loses nothing but `message_stop`.
+        finished: () => stopped,
       })) {
-        let event: AnthropicEvent;
-        try {
-          event = JSON.parse(data) as AnthropicEvent;
-        } catch {
-          continue; // a keep-alive or a frame we do not model
-        }
+        const event = parseFrame<AnthropicEvent>(data, id);
 
         switch (event.type) {
           // A failure the backend reports after its headers went out. Classified
@@ -542,6 +587,10 @@ export function createAnthropicProvider(config: AnthropicConfig): Provider {
                 id: event.content_block.id ?? "",
                 name: event.content_block.name ?? "",
               };
+              // Checked here, because this block is the only place this shape
+              // states a call's id and name.
+              settleToolCalls(id, [toolCall]);
+              sawToolCall = true;
               yield {
                 type: "delta",
                 toolCalls: [{ index: toolCall.index, id: toolCall.id, name: toolCall.name }],
@@ -577,21 +626,31 @@ export function createAnthropicProvider(config: AnthropicConfig): Provider {
             cachedInputTokens = event.usage?.cache_read_input_tokens ?? cachedInputTokens;
             cacheWriteTokens = event.usage?.cache_creation_input_tokens ?? cacheWriteTokens;
             outputTokens = event.usage?.output_tokens ?? outputTokens;
-            if (event.delta?.stop_reason) stopped = true;
-            const finishReason = mapStopReason(event.delta?.stop_reason);
-            if (finishReason) yield { type: "finish", finishReason };
+            if (event.delta?.stop_reason) {
+              const stated = mapStopReason(id, event.delta.stop_reason);
+              stopped = true;
+              // Anthropic-compatible gateways can end a tool turn on
+              // `end_turn`, and a caller reading that as done never runs the
+              // tool. Only `stop` is promoted: a length cut may be what broke
+              // the call.
+              const finishReason = stated === "stop" && sawToolCall ? "tool_calls" : stated;
+              yield { type: "finish", finishReason };
+            }
             break;
           }
 
+          // The turn's last event, so the reader stops here. Some gateways
+          // append a `[DONE]` or other bytes after it, and a read that died on
+          // those failed an answer that was already whole (Kimi, GLM and
+          // OpenCode Go, measured by cc-proxy).
           case "message_stop":
-            closed = true;
             yield usageChunk();
-            break;
+            return;
         }
       }
-      if (closed) return;
-      // A gateway that states its stop reason and then skips `message_stop`
-      // still finished the turn — and still billed it.
+      // A gateway that states its stop reason and then skips `message_stop`, or
+      // whose socket dies after the reason, still finished the turn, and still
+      // billed it.
       if (stopped) {
         yield usageChunk();
         return;

package/src/providers/gemini.ts

@@ -5,9 +5,10 @@
 // its own chain of thought on the next turn. Written straight against the REST
 // wire rather than @google/genai, because this package ships zero dependencies
 // and the SDK is a Node-shaped one.
-import { ProviderError, streamCut, streamError } from "../errors.ts";
+import { repairHistory } from "../context.ts";
+import { ProviderError, streamCut, streamError, type ErrorKind } from "../errors.ts";
 import { schemaPrompt, toGeminiToolSchema } from "../schema.ts";
-import { parseToolArgs } from "../tool-args.ts";
+import { parseToolArgs, settleToolCalls } from "../tool-args.ts";
 import { streamSse, apiUrl } from "../transport.ts";
 import { withConfiguredFallbacks, type ProviderFallbackConfig } from "../fallback.ts";
 import type {
@@ -133,6 +134,12 @@ function toResponseObject(content: string): Record<string, unknown> {
  * and carry tool calls as `functionCall` parts with the thought signature
  * beside them; tool results are role `user` with a `functionResponse` part
  * naming the FUNCTION, since Gemini pairs a result to its call by name.
+ *
+ * A run of results is ONE user turn: Gemini answers a model turn's parallel
+ * calls with every response together, and spread over several turns it 400s
+ * that the response count does not match the call count. The responses go
+ * first, in call order, and the run's images follow them all, the way the
+ * OpenAI dialect places them.
  */
 export function toGeminiContents(messages: readonly ChatMessage[]): {
   system?: string;
@@ -140,8 +147,11 @@ export function toGeminiContents(messages: readonly ChatMessage[]): {
 } {
   let system = "";
   const contents: GeminiContent[] = [];
+  // The open run of tool results: its parts, and how many lead with a response.
+  let results: { parts: unknown[]; responses: number } | undefined;
 
   for (const message of messages) {
+    if (message.role === "user" || message.role === "assistant") results = undefined;
     switch (message.role) {
       case "system":
         system = system ? `${system}\n\n${message.content}` : message.content;
@@ -181,23 +191,24 @@ export function toGeminiContents(messages: readonly ChatMessage[]): {
         break;
       }
 
-      case "tool":
-        contents.push({
-          role: "user",
-          parts: [
-            {
-              functionResponse: {
-                id: message.toolCallId,
-                name: message.name,
-                response: toResponseObject(message.content),
-              },
-            },
-            ...(message.images ?? []).map((image) => ({
-              inlineData: { mimeType: image.mimeType, data: image.data },
-            })),
-          ],
+      case "tool": {
+        if (!results) {
+          results = { parts: [], responses: 0 };
+          contents.push({ role: "user", parts: results.parts });
+        }
+        results.parts.splice(results.responses, 0, {
+          functionResponse: {
+            id: message.toolCallId,
+            name: message.name,
+            response: toResponseObject(message.content),
+          },
         });
+        results.responses += 1;
+        for (const image of message.images ?? []) {
+          results.parts.push({ inlineData: { mimeType: image.mimeType, data: image.data } });
+        }
         break;
+      }
     }
   }
 
@@ -216,15 +227,66 @@ function toToolConfig(choice: ToolChoice | undefined): unknown {
   return { functionCallingConfig: { mode: "ANY", allowedFunctionNames: [choice.name] } };
 }
 
-function mapFinishReason(reason: string): FinishReason {
+/**
+ * Every finish reason Gemini documents (the generate-content reference, read
+ * 2026-10-19), decided one by one. Anything this switch did not name used to
+ * read as `stop`, so a call the model botched (`MALFORMED_FUNCTION_CALL`) or a
+ * turn that ended for no stated reason (`OTHER`) came back as a finished, empty
+ * answer. After a tool result, `requireContent` takes an empty `stop` as the
+ * model choosing to say nothing, so nothing retried it.
+ */
+function mapFinishReason(provider: string, reason: string): FinishReason {
+  const fail = (kind: ErrorKind, why: string): never => {
+    throw new ProviderError(provider, kind, `${provider} ended the turn on ${reason}: ${why}`, {
+      code: reason,
+    });
+  };
   switch (reason) {
+    case "STOP":
+      return "stop";
+    // The output cap. CONTINUATION is the same cap with a token to carry on,
+    // which this adapter never sends back.
     case "MAX_TOKENS":
+    case "CONTINUATION":
       return "length";
+    // A filter on what was said or drawn. The text so far stands and the
+    // finish says why it ended, as `content_filter` does on every wire. A
+    // retry would mostly meet the same filter.
     case "SAFETY":
     case "PROHIBITED_CONTENT":
+    case "BLOCKLIST":
+    case "SPII":
+    case "RECITATION":
+    case "LANGUAGE":
+    case "ESCALATION":
+    case "IMAGE_SAFETY":
+    case "IMAGE_PROHIBITED_CONTENT":
+    case "IMAGE_RECITATION":
       return "content_filter";
+    // The request lost a thought signature, and the same request loses it
+    // again. A bug in what was sent, so nothing retries it.
+    case "MISSING_THOUGHT_SIGNATURE":
+      return fail("invalid", "the request is missing a thought signature");
+    // The account was limited for a policy violation. Benched like a refused
+    // key, so a key pool moves to another project.
+    case "PUP_LIMITED_DISABLED":
+      return fail("auth", "the account is limited or disabled");
+    // The model broke its own turn: a call it could not form, one with no tool
+    // offered, too many in a row, a malformed reply, an image it never made.
+    // The same request usually works on the next try.
+    case "MALFORMED_FUNCTION_CALL":
+    case "UNEXPECTED_TOOL_CALL":
+    case "TOO_MANY_TOOL_CALLS":
+    case "MALFORMED_RESPONSE":
+    case "NO_IMAGE":
+      return fail("overload", "the model broke its own turn");
+    // These say nothing about why, and a reason added after this list says
+    // nothing we can read. Neither proves the answer is whole.
+    case "OTHER":
+    case "IMAGE_OTHER":
+    case "FINISH_REASON_UNSPECIFIED":
     default:
-      return "stop";
+      return fail("overload", "it gave no reason that shows the answer is complete");
   }
 }
 
@@ -277,7 +339,9 @@ export function createGeminiProvider(config: GeminiConfig): Provider {
     ): AsyncIterable<ProviderChunk> {
       const effort = opts.effort ?? config.effort;
       const maxTokens = opts.maxTokens ?? config.maxTokens;
-      const { system, contents } = toGeminiContents(messages);
+      // Repaired first: a result with no call, or a call with no result, is a
+      // 400 that loses the turn. See repairHistory.
+      const { system, contents } = toGeminiContents(repairHistory(messages).messages);
 
       // A model id copied out of Gemini's docs is often already `models/…`, and
       // the doubled segment 404s as "model not found" — a confusing way to
@@ -385,6 +449,11 @@ export function createGeminiProvider(config: GeminiConfig): Provider {
         ...(opts.signal ? { signal: opts.signal } : {}),
         ...(config.fetchImpl ? { fetchImpl: config.fetchImpl } : {}),
         ...(opts.onActivity ? { onActivity: opts.onActivity } : {}),
+        ...(opts.onRateLimit ? { onRateLimit: opts.onRateLimit } : {}),
+        // This wire has no terminal event to stop at, so the finish reason is
+        // the end: a read that dies after it can cost a late usage record, never
+        // the answer.
+        finished: () => finished,
       })) {
         let chunk: GeminiResponse;
         try {
@@ -442,12 +511,14 @@ export function createGeminiProvider(config: GeminiConfig): Provider {
           const call = part.functionCall;
           if (!call) continue;
           const index = callIndex++;
+          const identity = { index, id: call.id ?? "", name: call.name ?? "" };
+          // The part is the whole call, so it is settled here: one with no
+          // name can't run, and one with no id gets one the way the other
+          // three wires mint it. Gemini omits the id on a single-call turn, and
+          // the seam's consumers pair a result back to its call by id.
+          settleToolCalls(id, [identity]);
           toolCalls.push({
-            index,
-            // Gemini omits the id on a single-call turn, and the seam's
-            // consumers pair a result back to its call by id.
-            id: call.id ?? `call_${index}`,
-            ...(call.name ? { name: call.name } : {}),
+            ...identity,
             // Whole and already assembled — unlike the OpenAI shape, Gemini
             // never fragments an argument object across chunks.
             arguments: JSON.stringify(call.args ?? {}),
@@ -463,13 +534,16 @@ export function createGeminiProvider(config: GeminiConfig): Provider {
         }
 
         if (candidate.finishReason) {
+          // Mapped first: a reason that throws must not be dressed as tool_calls.
+          const finishReason = mapFinishReason(id, candidate.finishReason);
           finished = true;
           yield {
             type: "finish",
-            // A turn that called tools finishes as tool_calls whatever the
-            // candidate says — Gemini routinely reports STOP there, and a
+            // Gemini routinely reports STOP on a turn that called tools, and a
             // caller reading that as "done" drops the tool round entirely.
-            finishReason: sawFunctionCalls ? "tool_calls" : mapFinishReason(candidate.finishReason),
+            // Only STOP is promoted, as on the other three wires: a length cut
+            // or a filter may be what broke the call (invariant 10).
+            finishReason: sawFunctionCalls && finishReason === "stop" ? "tool_calls" : finishReason,
           };
         }
       }

package/src/providers/openai.ts

@@ -3,8 +3,10 @@
 // This is the dialect most gateways speak, so one adapter serves OpenAI,
 // OpenRouter, DeepSeek, GLM, Kimi, Groq, Together, vLLM, Ollama and LM Studio.
 // Their divergences are small and named where they appear.
+import { repairHistory } from "../context.ts";
 import { fileRefused, ProviderError, streamCut, streamError } from "../errors.ts";
-import { streamSse, apiUrl } from "../transport.ts";
+import { streamSse, apiUrl, parseFrame } from "../transport.ts";
+import { settleToolCalls, type ToolCallIdentity } from "../tool-args.ts";
 import { attributionHeaders } from "../attribution.ts";
 import type {
   ChatMessage,
@@ -328,19 +330,43 @@ function dialectFor(id: string): EffortDialect {
   return "openai";
 }
 
-function mapFinishReason(reason: string | null | undefined): FinishReason | undefined {
+/**
+ * A stated finish, or a throw for one this dialect does not document. An
+ * unknown reason used to end the stream as a clean success with no finish at
+ * all, so DeepSeek's `insufficient_system_resource`, Z.ai's `network_error` and
+ * OpenRouter's `error` each read as a finished answer. Nothing says the answer
+ * ended on purpose, so it is `overload`: theirs, and worth a retry (cc-proxy
+ * answers it the same way).
+ */
+function mapFinishReason(provider: string, reason: string): FinishReason {
   switch (reason) {
+    // A natural end under another name, from servers on this wire: Together's
+    // `eos`, Hugging Face TGI's `eos_token` and `stop_sequence`. Thrown as
+    // unknown, each would fail an answer that was already whole.
     case "stop":
+    case "eos":
+    case "eos_token":
+    case "stop_sequence":
       return "stop";
+    // Z.ai's `model_context_window_exceeded` and Mistral's `model_length`: the
+    // context window filled before the answer did. Cut short, and a retry fills
+    // it the same way.
     case "length":
+    case "model_context_window_exceeded":
+    case "model_length":
       return "length";
     case "tool_calls":
     case "function_call":
       return "tool_calls";
+    // `sensitive` is Z.ai's name for its safety stop. A retry meets the same
+    // filter.
     case "content_filter":
+    case "sensitive":
       return "content_filter";
     default:
-      return undefined;
+      throw new ProviderError(provider, "overload", `${provider} ended the turn on "${reason}"`, {
+        code: reason,
+      });
   }
 }
 
@@ -519,7 +545,9 @@ export function createOpenAIProvider(config: OpenAIConfig): Provider {
       const effort = opts.effort ?? config.effort;
       const model = opts.model ?? config.model;
 
-      const body = toOpenAIMessages(messages, id);
+      // Repaired first: a result with no call, or a call with no result, is a
+      // 400 that loses the turn. See repairHistory.
+      const body = toOpenAIMessages(repairHistory(messages).messages, id);
       const request: Record<string, unknown> = {
         model,
         messages: body,
@@ -624,6 +652,9 @@ export function createOpenAIProvider(config: OpenAIConfig): Provider {
         : "/v1/chat/completions";
 
       let ended = false;
+      // Each call as its deltas named it, by index. The finish checks them
+      // before it goes out, and they are what says the turn called a tool.
+      const calls = new Map<number, ToolCallIdentity>();
       for await (const data of streamSse({
         url: apiUrl(baseUrl, config.path ?? defaultPath),
         headers: {
@@ -642,16 +673,16 @@ export function createOpenAIProvider(config: OpenAIConfig): Provider {
         ...(opts.signal ? { signal: opts.signal } : {}),
         ...(config.fetchImpl ? { fetchImpl: config.fetchImpl } : {}),
         ...(opts.onActivity ? { onActivity: opts.onActivity } : {}),
+        ...(opts.onRateLimit ? { onRateLimit: opts.onRateLimit } : {}),
         onDone: () => {
           ended = true;
         },
+        // Usage comes AFTER the finish on this shape, so the reader keeps going
+        // to `[DONE]` (invariant 5). But a read that dies in between costs only
+        // the usage frame: the answer is whole once its finish is stated.
+        finished: () => ended,
       })) {
-        let chunk: OpenAIChunk;
-        try {
-          chunk = JSON.parse(data) as OpenAIChunk;
-        } catch {
-          continue;
-        }
+        const chunk = parseFrame<OpenAIChunk>(data, id);
 
         // A failure the backend reports after its headers went out. The
         // gateways speaking this dialect — OpenRouter above all — report a
@@ -723,18 +754,35 @@ export function createOpenAIProvider(config: OpenAIConfig): Provider {
                 ? { arguments: call.function.arguments }
                 : {}),
             }));
+            for (const call of out.toolCalls) {
+              const seen = calls.get(call.index) ?? { index: call.index, id: "", name: "" };
+              if (call.id) seen.id = call.id;
+              if (call.name) seen.name = call.name;
+              calls.set(call.index, seen);
+            }
             has = true;
           }
           if (has) yield out;
         }
 
-        if (choice.finish_reason) ended = true;
-        const finishReason = mapFinishReason(choice.finish_reason);
-        if (finishReason) yield { type: "finish", finishReason };
+        if (choice.finish_reason) {
+          const stated = mapFinishReason(id, choice.finish_reason);
+          const minted = settleToolCalls(id, calls.values());
+          if (minted.length > 0) yield { type: "delta", toolCalls: minted };
+          ended = true;
+          // Several gateways end a turn that called a tool on `stop`, and a
+          // caller reading that as done never runs the tool. Only `stop` is
+          // promoted: a length cut or a filter may be what broke the call.
+          const finishReason = stated === "stop" && calls.size > 0 ? "tool_calls" : stated;
+          yield { type: "finish", finishReason };
+        }
       }
       // Either proof will do: some gateways send `[DONE]` with no finish, and
       // some a finish with no `[DONE]`. Neither means the socket closed early.
       if (!ended) throw streamCut(id);
+      // A `[DONE]` with no finish stated still owes its calls the same check.
+      const minted = settleToolCalls(id, calls.values());
+      if (minted.length > 0) yield { type: "delta", toolCalls: minted };
     },
   };