@vellumai/assistant 0.6.3 → 0.6.5

package/src/providers/anthropic/client.ts

@@ -1,9 +1,11 @@
 import Anthropic from "@anthropic-ai/sdk";
 
 import { SYSTEM_PROMPT_CACHE_BOUNDARY } from "../../prompts/system-prompt.js";
+import { isAbortReason } from "../../util/abort-reasons.js";
 import { ProviderError } from "../../util/errors.js";
 import { getLogger } from "../../util/logger.js";
 import { extractRetryAfterMs } from "../../util/retry.js";
+import { stripOrphanedSurrogatesDeep } from "../../util/unicode.js";
 import { createStreamTimeout } from "../stream-timeout.js";
 import type {
   ContentBlock,
@@ -13,12 +15,79 @@ import type {
   SendMessageOptions,
   ToolDefinition,
 } from "../types.js";
+import {
+  ContextOverflowError,
+  extractOverflowTokensFromMessage,
+} from "../types.js";
 
 const log = getLogger("anthropic-client");
 
 /** Validation-specific timeout (10s) so a stalled network doesn't block key submission. */
 const VALIDATION_TIMEOUT_MS = 10_000;
 
+/**
+ * Detect Anthropic's `prompt_too_long` context-overflow signal.
+ *
+ * Anthropic returns HTTP 400 with a body shaped as
+ *   `{ type: "error", error: { type: "invalid_request_error", message: "..." } }`
+ * where the inner `message` carries the "prompt is too long: N tokens > M
+ * maximum" text. The SDK stores the body at `APIError.error` and formats a
+ * top-level `message` by JSON-stringifying the body when no top-level
+ * `.message` key exists — so we probe both the nested body and the
+ * formatted string.
+ */
+export function detectAnthropicContextOverflow(
+  error: InstanceType<typeof Anthropic.APIError>,
+): { actualTokens?: number; maxTokens?: number } | null {
+  // 413 is theoretically adjacent but Anthropic does not emit it today.
+  if (error.status !== 400) return null;
+  const body = error.error as
+    | {
+        type?: string;
+        message?: string;
+        error?: { type?: string; message?: string };
+      }
+    | undefined;
+  const innerMessage =
+    (typeof body === "object" && body != null
+      ? (body.error?.message ?? body.message)
+      : undefined) ?? "";
+  const topLevelMessage = error.message ?? "";
+  const combined = `${innerMessage} ${topLevelMessage}`;
+  if (!/prompt.?is.?too.?long|prompt_too_long/i.test(combined)) return null;
+  // Prefer the clean inner message over the JSON-stringified top-level string.
+  return extractOverflowTokensFromMessage(innerMessage || topLevelMessage);
+}
+
+/** Rate-limit the orphaned-surrogate warning so a single bad stream can't flood logs. */
+const ORPHAN_WARNING_THROTTLE_MS = 60_000;
+let lastOrphanWarningMs = 0;
+
+function logOrphanedSurrogateWarning(
+  fixedStringCount: number,
+  messages: Anthropic.MessageParam[],
+): void {
+  const now = Date.now();
+  if (now - lastOrphanWarningMs < ORPHAN_WARNING_THROTTLE_MS) return;
+  lastOrphanWarningMs = now;
+  const blockTypes = new Set<string>();
+  for (const msg of messages) {
+    if (!Array.isArray(msg.content)) continue;
+    for (const block of msg.content) {
+      if (typeof block !== "object" || block == null) continue;
+      const type = (block as { type?: string }).type;
+      if (type) blockTypes.add(type);
+    }
+  }
+  log.warn(
+    {
+      fixedStringCount,
+      blockTypes: Array.from(blockTypes),
+    },
+    "stripped orphaned UTF-16 surrogates from outbound Anthropic request — upstream truncation is not surrogate-aware",
+  );
+}
+
 /**
  * Validate an Anthropic API key by making a lightweight GET /v1/models call.
  * Returns `{ valid: true }` on success or `{ valid: false, reason: string }` on failure.
@@ -101,6 +170,26 @@ export const PLACEHOLDER_EMPTY_TURN =
 export const PLACEHOLDER_BLOCKS_OMITTED =
   "\x00__PLACEHOLDER__[internal blocks omitted]";
 
+// Compared against the payload with any leading `\x00` stripped, so the check
+// matches both the prefixed sentinel we emit and any bare variant that lost
+// the null byte in transit (e.g. the model echoing the text back without
+// reproducing the control character).
+const PLACEHOLDER_SENTINEL_BARE: ReadonlySet<string> = new Set([
+  PLACEHOLDER_EMPTY_TURN.slice(1),
+  PLACEHOLDER_BLOCKS_OMITTED.slice(1),
+]);
+
+/**
+ * True when the text is one of the provider's internal alternation-preserving
+ * sentinels, with or without the null-byte prefix. These must never be
+ * persisted or rendered to users — they exist only in outbound Anthropic API
+ * request bodies.
+ */
+export function isPlaceholderSentinelText(text: string): boolean {
+  const normalized = text.startsWith("\x00") ? text.slice(1) : text;
+  return PLACEHOLDER_SENTINEL_BARE.has(normalized);
+}
+
 /**
  * Synthetic placeholder injected as user-message content when Anthropic API
  * alternation requires a user turn but no real user content exists. Uses the
@@ -361,7 +450,10 @@ function repairOrphanedServerToolUse(
         repairedContent.push({
           type: "web_search_tool_result",
           tool_use_id: block.id,
-          content: [],
+          content: {
+            type: "web_search_tool_result_error",
+            error_code: "unavailable",
+          },
         } as unknown as Anthropic.ContentBlockParam);
       }
     }
@@ -564,12 +656,36 @@ export class AnthropicProvider implements Provider {
       useNativeWebSearch?: boolean;
       streamTimeoutMs?: number;
       baseURL?: string;
+      /**
+       * Authenticate via `Authorization: Bearer <token>` instead of
+       * `x-api-key`. Required for proxies that front the Anthropic Messages
+       * API with their own Bearer scheme (e.g. OpenRouter). When set, the
+       * positional `apiKey` argument is ignored on the wire.
+       */
+      authToken?: string;
     } = {},
   ) {
-    this.client = new Anthropic({ apiKey, baseURL: options.baseURL });
+    this.streamTimeoutMs = options.streamTimeoutMs ?? 1_800_000;
+    // Pass the same deadline to the SDK so its per-request timeout can't
+    // fire before `createStreamTimeout` does. The SDK's default is 10 min,
+    // which truncates any request we intend to run longer than that. We add
+    // a 60s buffer so `createStreamTimeout` always wins — its abort reason
+    // produces a clearer error message than the SDK's generic timeout.
+    const sdkTimeoutMs = this.streamTimeoutMs + 60_000;
+    this.client = options.authToken
+      ? new Anthropic({
+          apiKey: null,
+          authToken: options.authToken,
+          baseURL: options.baseURL,
+          timeout: sdkTimeoutMs,
+        })
+      : new Anthropic({
+          apiKey,
+          baseURL: options.baseURL,
+          timeout: sdkTimeoutMs,
+        });
     this.model = model;
     this.useNativeWebSearch = options.useNativeWebSearch ?? false;
-    this.streamTimeoutMs = options.streamTimeoutMs ?? 1_800_000;
   }
 
   async sendMessage(
@@ -579,8 +695,16 @@ export class AnthropicProvider implements Provider {
     options?: SendMessageOptions,
   ): Promise<ProviderResponse> {
     const { config, onEvent, signal } = options ?? {};
-    const cacheTtl: "5m" | "1h" = ((config as Record<string, unknown> | undefined)?.cacheTtl as "5m" | "1h") ?? "1h";
+    const cacheTtl: "5m" | "1h" =
+      ((config as Record<string, unknown> | undefined)?.cacheTtl as
+        | "5m"
+        | "1h") ?? "1h";
     let sentMessages: Anthropic.MessageParam[] | undefined;
+    const startedAt = Date.now();
+    // Hoisted so the catch block can distinguish our inner stream timeout
+    // (30 min default) from an external transport abort (bun fetch deadline,
+    // edge LB, NAT idle) — only the latter should be retried.
+    let innerTimeoutSignal: AbortSignal | undefined;
     try {
       const formatted = messages
         .map((m) => {
@@ -670,10 +794,7 @@ export class AnthropicProvider implements Provider {
             )
               return false;
             const text = (c[0] as { text?: string }).text;
-            return (
-              text === PLACEHOLDER_EMPTY_TURN ||
-              text === PLACEHOLDER_BLOCKS_OMITTED
-            );
+            return typeof text === "string" && isPlaceholderSentinelText(text);
           };
           if (isPlaceholder(iContent)) {
             formatted.splice(i, 1);
@@ -689,25 +810,55 @@ export class AnthropicProvider implements Provider {
       // — the API accepts them. No provider-side stripping needed.
 
       sentMessages = ensureToolPairing(repairOrphanedServerToolUse(formatted));
-      const { effort, speed, output_config, cacheTtl: _cacheTtl, ...restConfig } = (config ??
-        {}) as Record<string, unknown> & {
-        effort?: Anthropic.OutputConfig["effort"];
+      const {
+        effort,
+        speed,
+        output_config,
+        cacheTtl: _cacheTtl,
+        max_tokens: callerMaxTokens,
+        ...restConfig
+      } = (config ?? {}) as Record<string, unknown> & {
+        // "xhigh" is an intermediate tier between "high" and "max" supported
+        // by newer Anthropic models (e.g. Opus 4.7). The SDK's OutputConfig
+        // type doesn't yet include it, so we widen to the internal effort
+        // union and cast when building mergedOutputConfig.
+        effort?: "low" | "medium" | "high" | "xhigh" | "max";
         speed?: "standard" | "fast";
         output_config?: Record<string, unknown>;
       };
-      // Haiku does not support the effort / output_config parameter.
+      // Haiku does not support the effort / output_config parameter,
+      // extended cache TTL betas, 1M context, or 64K output tokens.
       // Determine the effective model (per-call override or provider default)
-      // and strip effort when the model doesn't support it.
+      // and gate features accordingly.
       const effectiveModel =
         (restConfig as Record<string, unknown>).model?.toString() ?? this.model;
-      const supportsEffort = !effectiveModel.includes("haiku");
+      const isHaiku = effectiveModel.includes("haiku");
+      const supportsEffort = !isHaiku;
       const mergedOutputConfig = {
         ...(output_config ?? {}),
-        ...(effort && supportsEffort ? { effort } : {}),
+        ...(effort && supportsEffort
+          ? { effort: effort as Anthropic.OutputConfig["effort"] }
+          : {}),
       };
-      const params: Anthropic.MessageStreamParams = {
+      // Build cache_control objects: Haiku doesn't support the extended
+      // cache TTL beta, so omit the ttl field for Haiku models.
+      const cacheControl = isHaiku
+        ? { type: "ephemeral" as const }
+        : { type: "ephemeral" as const, ttl: cacheTtl };
+      const tailCacheControl = isHaiku
+        ? { type: "ephemeral" as const }
+        : { type: "ephemeral" as const, ttl: "5m" as const };
+
+      let params: Anthropic.MessageStreamParams = {
         model: this.model,
-        max_tokens: 64000,
+        max_tokens: isHaiku
+          ? Math.min(
+              typeof callerMaxTokens === "number" ? callerMaxTokens : 8192,
+              8192,
+            )
+          : typeof callerMaxTokens === "number"
+            ? callerMaxTokens
+            : 64000,
         messages: sentMessages,
         ...restConfig,
         ...(Object.keys(mergedOutputConfig).length > 0
@@ -733,12 +884,12 @@ export class AnthropicProvider implements Provider {
             {
               type: "text" as const,
               text: staticBlock,
-              cache_control: { type: "ephemeral" as const, ttl: cacheTtl },
+              cache_control: cacheControl,
             },
             {
               type: "text" as const,
               text: dynamicBlock,
-              cache_control: { type: "ephemeral" as const, ttl: cacheTtl },
+              cache_control: cacheControl,
             },
           ];
         } else {
@@ -746,7 +897,7 @@ export class AnthropicProvider implements Provider {
             {
               type: "text" as const,
               text: systemPrompt,
-              cache_control: { type: "ephemeral" as const, ttl: cacheTtl },
+              cache_control: cacheControl,
             },
           ];
         }
@@ -763,12 +914,7 @@ export class AnthropicProvider implements Provider {
             description: t.description,
             input_schema: t.input_schema as Anthropic.Tool["input_schema"],
             ...(i === otherTools.length - 1
-              ? {
-                  cache_control: {
-                    type: "ephemeral" as const,
-                    ttl: cacheTtl,
-                  },
-                }
+              ? { cache_control: cacheControl }
               : {}),
           }));
           const webSearchTool: Anthropic.WebSearchTool20250305 = {
@@ -782,14 +928,7 @@ export class AnthropicProvider implements Provider {
             name: t.name,
             description: t.description,
             input_schema: t.input_schema as Anthropic.Tool["input_schema"],
-            ...(i === tools.length - 1
-              ? {
-                  cache_control: {
-                    type: "ephemeral" as const,
-                    ttl: cacheTtl,
-                  },
-                }
-              : {}),
+            ...(i === tools.length - 1 ? { cache_control: cacheControl } : {}),
           }));
         }
       }
@@ -813,10 +952,8 @@ export class AnthropicProvider implements Provider {
         if (!hasText) continue;
         const lastBlock = msg.content[msg.content.length - 1];
         if (typeof lastBlock !== "string") {
-          (lastBlock as unknown as Record<string, unknown>).cache_control = {
-            type: "ephemeral",
-            ttl: cacheTtl,
-          };
+          (lastBlock as unknown as Record<string, unknown>).cache_control =
+            cacheControl;
         }
         turnStartIdx = i;
         break;
@@ -832,7 +969,10 @@ export class AnthropicProvider implements Provider {
       if (turnStartIdx >= 0 && turnStartIdx < sentMessages.length - 1) {
         const lastMsg = sentMessages[sentMessages.length - 1];
         if (Array.isArray(lastMsg.content) && lastMsg.content.length > 0) {
-          const NON_CACHEABLE_TYPES = new Set(["thinking", "redacted_thinking"]);
+          const NON_CACHEABLE_TYPES = new Set([
+            "thinking",
+            "redacted_thinking",
+          ]);
           let tailBlock: (typeof lastMsg.content)[number] | undefined;
           for (let j = lastMsg.content.length - 1; j >= 0; j--) {
             const block = lastMsg.content[j];
@@ -845,10 +985,8 @@ export class AnthropicProvider implements Provider {
             }
           }
           if (tailBlock && typeof tailBlock !== "string") {
-            (tailBlock as unknown as Record<string, unknown>).cache_control = {
-              type: "ephemeral",
-              ttl: "5m",
-            };
+            (tailBlock as unknown as Record<string, unknown>).cache_control =
+              tailCacheControl;
             tailBreakpointApplied = true;
           }
         }
@@ -872,11 +1010,22 @@ export class AnthropicProvider implements Provider {
         params.system.length === 2 &&
         hasToolCacheBreakpoint
       ) {
-        delete (params.system[0] as unknown as Record<string, unknown>).cache_control;
+        delete (params.system[0] as unknown as Record<string, unknown>)
+          .cache_control;
+      }
+
+      // Strip orphaned UTF-16 surrogates so the Anthropic JSON parser never
+      // sees invalid strings produced by upstream surrogate-splitting `.slice()` calls.
+      const sanitized = stripOrphanedSurrogatesDeep(params);
+      if (sanitized.changed) {
+        logOrphanedSurrogateWarning(sanitized.fixedStringCount, sentMessages);
+        params = sanitized.value;
+        sentMessages = params.messages;
       }
 
       const { signal: timeoutSignal, cleanup: cleanupTimeout } =
         createStreamTimeout(this.streamTimeoutMs, signal);
+      innerTimeoutSignal = timeoutSignal;
 
       /** Minimal stream interface shared by MessageStream and BetaMessageStream. */
       interface UnifiedStream {
@@ -890,15 +1039,15 @@ export class AnthropicProvider implements Provider {
         finalMessage(): Promise<Anthropic.Message>;
       }
 
-      // Fast mode: use the beta endpoint with speed: "fast" for Opus 4.6
+      // Fast mode: use the beta endpoint with speed: "fast" for Opus models (4.6, 4.7)
       const useFastMode = speed === "fast" && effectiveModel.includes("opus");
 
       // Collect required betas: extended cache TTL for 1h system prompt caching,
       // 1M context window, and fast-mode when applicable.
-      const betas: string[] = [
-        "extended-cache-ttl-2025-04-11",
-        "context-1m-2025-08-07",
-      ];
+      // Haiku doesn't support the extended cache TTL or 1M context betas.
+      const betas: string[] = isHaiku
+        ? []
+        : ["extended-cache-ttl-2025-04-11", "context-1m-2025-08-07"];
       if (useFastMode) {
         betas.push("fast-mode-2026-02-01");
       }
@@ -915,17 +1064,43 @@ export class AnthropicProvider implements Provider {
                 Anthropic.Beta.Messages.MessageCreateParamsStreaming,
               { signal: timeoutSignal },
             ) as unknown as UnifiedStream)
-          : (this.client.beta.messages.stream(
-              {
-                ...(params as Record<string, unknown>),
-                betas,
-              } as Anthropic.Beta.Messages.MessageCreateParamsNonStreaming &
-                Anthropic.Beta.Messages.MessageCreateParamsStreaming,
-              { signal: timeoutSignal },
-            ) as unknown as UnifiedStream);
+          : betas.length > 0
+            ? (this.client.beta.messages.stream(
+                {
+                  ...(params as Record<string, unknown>),
+                  betas,
+                } as Anthropic.Beta.Messages.MessageCreateParamsNonStreaming &
+                  Anthropic.Beta.Messages.MessageCreateParamsStreaming,
+                { signal: timeoutSignal },
+              ) as unknown as UnifiedStream)
+            : (this.client.messages.stream(params, {
+                signal: timeoutSignal,
+              }) as unknown as UnifiedStream);
+
+        // Buffer streaming text until it's clear the accumulated text isn't
+        // going to form a placeholder sentinel. Sentinels are injected into
+        // outbound requests for role alternation and are sometimes echoed by
+        // the model; holding back partial prefixes prevents them from
+        // flashing on the live UI before cleanAssistantContent strips them
+        // at persist time. Buffer is bounded by the longest sentinel (~45
+        // chars) and resets on every content_block_start.
+        const SENTINEL_TEXTS: readonly string[] = [
+          PLACEHOLDER_EMPTY_TURN,
+          PLACEHOLDER_EMPTY_TURN.slice(1),
+          PLACEHOLDER_BLOCKS_OMITTED,
+          PLACEHOLDER_BLOCKS_OMITTED.slice(1),
+        ];
+        const couldBeSentinelPrefix = (s: string): boolean =>
+          SENTINEL_TEXTS.some((sentinel) => sentinel.startsWith(s));
+        const isCompleteSentinel = (s: string): boolean =>
+          SENTINEL_TEXTS.includes(s);
+        let textBuffer = "";
 
         stream.on("text", (text) => {
-          onEvent?.({ type: "text_delta", text });
+          textBuffer += text;
+          if (couldBeSentinelPrefix(textBuffer)) return;
+          onEvent?.({ type: "text_delta", text: textBuffer });
+          textBuffer = "";
         });
 
         stream.on("thinking", (thinking) => {
@@ -940,6 +1115,13 @@ export class AnthropicProvider implements Provider {
         let pendingInputJsonFlush: ReturnType<typeof setTimeout> | undefined;
 
         stream.on("streamEvent", (event) => {
+          // Reset the text sentinel buffer at each content-block boundary.
+          // A new block starts fresh; at the end of a block, flush any
+          // buffered text that is NOT a complete sentinel, and drop it if
+          // it is one.
+          if (event.type === "content_block_start") {
+            textBuffer = "";
+          }
           if (
             event.type === "content_block_start" &&
             event.content_block.type === "tool_use"
@@ -982,7 +1164,9 @@ export class AnthropicProvider implements Provider {
               type: "server_tool_complete",
               toolUseId: block.tool_use_id,
               isError: !!isError,
-              ...(Array.isArray(block.content) ? { content: block.content } : {}),
+              ...(Array.isArray(block.content)
+                ? { content: block.content }
+                : {}),
             });
           }
           if (event.type === "content_block_stop") {
@@ -1001,6 +1185,11 @@ export class AnthropicProvider implements Provider {
             currentStreamingToolName = undefined;
             currentStreamingToolUseId = undefined;
             accumulatedInputJson = "";
+            // Flush residual text buffer unless it's exactly a sentinel.
+            if (textBuffer.length > 0 && !isCompleteSentinel(textBuffer)) {
+              onEvent?.({ type: "text_delta", text: textBuffer });
+            }
+            textBuffer = "";
           }
         });
 
@@ -1064,6 +1253,20 @@ export class AnthropicProvider implements Provider {
         rawResponse: response,
       };
     } catch (error) {
+      // Propagate a tagged AbortReason (set by the daemon at controller.abort())
+      // so wrapped errors can be classified as user cancellation downstream.
+      const callerAborted = signal?.aborted === true;
+      const abortReason =
+        callerAborted && isAbortReason(signal!.reason)
+          ? signal!.reason
+          : undefined;
+      const elapsedMs = Date.now() - startedAt;
+      // Inner-timeout means OUR 30-min stream deadline fired, not the caller
+      // and not an external transport cutoff. We rewrite the message so the
+      // retry layer can distinguish it from a transport abort (which should
+      // retry) — a timed-out stream would almost certainly time out again.
+      const innerTimeoutFired =
+        innerTimeoutSignal?.aborted === true && !callerAborted;
       if (error instanceof Anthropic.APIError) {
         // Log detailed message structure for tool_use/tool_result ordering errors
         if (
@@ -1079,20 +1282,82 @@ export class AnthropicProvider implements Provider {
             "Anthropic 400: tool_use/tool_result pairing error — dumping message structure",
           );
         }
-        log.error(
-          {
-            status: error.status,
-            message: error.message,
-            headers: Object.fromEntries(error.headers?.entries() ?? []),
-          },
-          `Anthropic API error (${error.status})`,
-        );
+        const isAbortMessage =
+          error.status === undefined &&
+          /request was aborted/i.test(error.message);
+        if (abortReason) {
+          log.info(
+            { abortReason, elapsedMs, message: error.message },
+            "Anthropic request aborted by daemon",
+          );
+        } else if (isAbortMessage) {
+          log.error(
+            {
+              elapsedMs,
+              cause: error.cause,
+              callerSignalAborted: callerAborted,
+              innerTimeoutFired,
+              message: error.message,
+            },
+            innerTimeoutFired
+              ? "Anthropic stream timed out (inner streamTimeoutMs fired)"
+              : "Anthropic stream aborted by transport — no daemon or inner-timeout abort; likely bun fetch deadline, edge LB, or network idle cutoff",
+          );
+        } else {
+          log.error(
+            {
+              status: error.status,
+              elapsedMs,
+              message: error.message,
+              headers: Object.fromEntries(error.headers?.entries() ?? []),
+            },
+            `Anthropic API error (${error.status})`,
+          );
+        }
+        const overflow = detectAnthropicContextOverflow(error);
+        if (overflow) {
+          throw new ContextOverflowError(
+            `Anthropic API error (${error.status}): ${error.message}`,
+            "anthropic",
+            {
+              actualTokens: overflow.actualTokens,
+              maxTokens: overflow.maxTokens,
+              statusCode: error.status,
+              cause: error,
+            },
+          );
+        }
         const retryAfterMs = extractRetryAfterMs(error.headers);
+        const errorOptions: {
+          retryAfterMs?: number;
+          abortReason?: unknown;
+          cause?: unknown;
+        } = {};
+        if (retryAfterMs !== undefined)
+          errorOptions.retryAfterMs = retryAfterMs;
+        if (abortReason) errorOptions.abortReason = abortReason;
+        // Only preserve the original error as `cause` for transport aborts
+        // without a daemon-tagged reason — it's the diagnostic signal the
+        // retry layer and log reader rely on. Don't leak it through the
+        // caller-aborted path, which already carries `abortReason`.
+        if (!abortReason && isAbortMessage) errorOptions.cause = error;
+        // Rewrite the message only for inner-timeout, so the retry layer
+        // won't retry a request that already hit its 30-min deadline.
+        const rewrittenMessage =
+          isAbortMessage && innerTimeoutFired
+            ? `Anthropic stream timed out after ${Math.round(elapsedMs / 1000)}s (inner streamTimeoutMs)`
+            : error.message;
+        // Only include the `(status)` parenthetical when the SDK surfaced a
+        // real HTTP status. Abort paths and mid-stream protocol errors have
+        // `error.status === undefined`, and string-interpolating that produces
+        // a confusing "Anthropic API error (undefined): …" message.
+        const statusPart =
+          error.status !== undefined ? ` (${error.status})` : "";
         throw new ProviderError(
-          `Anthropic API error (${error.status}): ${error.message}`,
+          `Anthropic API error${statusPart}: ${rewrittenMessage}`,
           "anthropic",
           error.status,
-          retryAfterMs !== undefined ? { retryAfterMs } : undefined,
+          Object.keys(errorOptions).length > 0 ? errorOptions : undefined,
         );
       }
       throw new ProviderError(
@@ -1101,7 +1366,7 @@ export class AnthropicProvider implements Provider {
         }`,
         "anthropic",
         undefined,
-        { cause: error },
+        abortReason ? { cause: error, abortReason } : { cause: error },
       );
     }
   }

package/src/providers/call-site-routing.ts

@@ -0,0 +1,71 @@
+/**
+ * Provider wrapper that routes each `sendMessage` call to a different
+ * underlying provider transport when the per-call `options.config.callSite`
+ * resolves to a provider name that differs from the default.
+ *
+ * Without this wrapper the conversation-level provider transport is fixed at
+ * construction time, so a per-call-site `llm.callSites.<id>.provider`
+ * override only affects the request *metadata* the downstream client sees —
+ * the actual HTTP transport still belongs to `llm.default.provider`. That
+ * means routing decisions like "send `memoryRetrieval` calls to OpenAI even
+ * though the main agent runs on Anthropic" silently fail.
+ *
+ * `CallSiteRoutingProvider` consults `resolveCallSiteConfig` per call. When
+ * the resolved provider name differs from the default's name and the
+ * registry can produce a Provider for it, the call is delegated to that
+ * provider; otherwise it falls back to the default. Other Provider interface
+ * surface area (`name`, `tokenEstimationProvider`) is delegated to the
+ * default so wrappers further out (e.g. `RateLimitProvider`) still see a
+ * stable identity.
+ */
+
+import { resolveCallSiteConfig } from "../config/llm-resolver.js";
+import { getConfig } from "../config/loader.js";
+import type {
+  Message,
+  Provider,
+  ProviderResponse,
+  SendMessageOptions,
+  ToolDefinition,
+} from "./types.js";
+
+export class CallSiteRoutingProvider implements Provider {
+  public readonly name: string;
+  public readonly tokenEstimationProvider?: string;
+
+  constructor(
+    private readonly defaultProvider: Provider,
+    private readonly getProviderByName: (name: string) => Provider | undefined,
+  ) {
+    this.name = defaultProvider.name;
+    this.tokenEstimationProvider = defaultProvider.tokenEstimationProvider;
+  }
+
+  async sendMessage(
+    messages: Message[],
+    tools?: ToolDefinition[],
+    systemPrompt?: string,
+    options?: SendMessageOptions,
+  ): Promise<ProviderResponse> {
+    const target = this.selectProvider(options);
+    return target.sendMessage(messages, tools, systemPrompt, options);
+  }
+
+  /**
+   * Pick the provider to route this call through. The default provider wins
+   * unless the per-call `callSite` resolves to a different provider name and
+   * the registry can produce a Provider for it.
+   */
+  private selectProvider(options?: SendMessageOptions): Provider {
+    const callSite = options?.config?.callSite;
+    if (!callSite) return this.defaultProvider;
+
+    const resolved = resolveCallSiteConfig(callSite, getConfig().llm);
+    if (resolved.provider === this.defaultProvider.name) {
+      return this.defaultProvider;
+    }
+
+    const alternative = this.getProviderByName(resolved.provider);
+    return alternative ?? this.defaultProvider;
+  }
+}