lynkr 9.7.3 → 9.9.1

package/src/api/router.js

@@ -7,7 +7,32 @@ const logger = require("../logger");
 const { createRateLimiter } = require("./middleware/rate-limiter");
 const openaiRouter = require("./openai-router");
 const providersRouter = require("./providers-handler");
-const { getRoutingHeaders, getRoutingStats, analyzeComplexity, getModelTierSelector, analyzeRisk } = require("../routing");
+const { getRoutingHeaders, getRoutingStats, analyzeComplexity, getModelTierSelector, analyzeRisk, checkSessionPin, writeSessionPin, checkPinScoreDrift } = require("../routing");
+
+// Upstream streams can die without a clean end (reader.read() never
+// resolves on a dropped socket), hanging the client forever. Every
+// forwarding loop must read through this idle watchdog. The window is
+// IDLE time, reset per chunk — long-thinking models stream for minutes.
+const STREAM_IDLE_TIMEOUT_MS = Number(process.env.LYNKR_STREAM_IDLE_TIMEOUT_MS) || 90000;
+async function readWithIdleTimeout(reader, label) {
+  let timer;
+  try {
+    return await Promise.race([
+      reader.read(),
+      new Promise((_, reject) => {
+        timer = setTimeout(
+          () => reject(new Error(`upstream stream idle >${STREAM_IDLE_TIMEOUT_MS}ms (${label})`)),
+          STREAM_IDLE_TIMEOUT_MS,
+        );
+        if (typeof timer.unref === "function") timer.unref();
+      }),
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+const SSE_STALL_EVENT = `event: error\ndata: ${JSON.stringify({ type: "error", error: { type: "overloaded_error", message: "Lynkr: upstream stream stalled — retry" } })}\n\n`;
+const { detectClient } = require("../routing/client-profiles");
 const { buildInteractionBlock } = require("../routing/interaction");
 const { validateCwd } = require("../workspace");
 const { renderText } = require("../utils/markdown-ansi");
@@ -15,7 +40,6 @@ const { classifyAuthMode } = require("../auth-mode");
 
 const router = express.Router();
 
-// Create rate limiter middleware
 const rateLimiter = createRateLimiter();
 
 /**
@@ -29,6 +53,8 @@ const rateLimiter = createRateLimiter();
  *   - force_local / force_cloud regex shortcuts
  *   - risk classifier (high-risk → forced COMPLEX)
  *   - complexity scoring (weighted heuristic)
+ *   - thinking-budget trigger (≥10k tokens → REASONING, Claude Code ultrathink)
+ *   - force patterns (ultrathink/prove → REASONING; architecture review → COMPLEX; hi → SIMPLE)
  *   - agentic-workflow detector (may bump min-tier)
  *   - kNN router (embedding-based nearest-neighbors of historical queries)
  *   - LinUCB contextual bandit (intra-tier model selection, learns from reward)
@@ -39,6 +65,21 @@ const rateLimiter = createRateLimiter();
  * Plus telemetry — every decision is recorded so kNN/bandit improve over time.
  */
 async function pickTierByIntent(body) {
+  // thinking.budget_tokens is NOT a reliable routing signal. Claude Code
+  // Enterprise on Haiku 4.5 attaches budget_tokens=31999 to EVERY request
+  // as its default extended-thinking behavior — the model's baseline, not
+  // an intent signal from the user. Trying to threshold this dragged every
+  // casual "hi" into REASONING via passthrough (live-verified 2026-07-19,
+  // fp-e33173b… session logs).
+  //
+  // Explicit user intent (ultrathink / prove / security audit / …) is
+  // caught by FORCE_REASONING_PATTERNS on the *text*, which is unambiguous.
+  // No thinking-budget trigger here on purpose. Kept a debug log of the
+  // observed value so future tuning has data.
+  const thinkingBudget = body?.thinking?.budget_tokens;
+  if (typeof thinkingBudget === 'number') {
+    logger.debug({ thinkingBudget }, '[OAuthIntent] thinking budget present (informational, not used for routing)');
+  }
   // Build a user-intent payload. We INCLUDE the tools array (signals agentic
   // intent — a request with 12 tools attached is meaningfully different from
   // a chat-only one, even if both messages look short) but EXCLUDE the system
@@ -61,14 +102,24 @@ async function pickTierByIntent(body) {
   const N = Math.max(1, Number(process.env.LYNKR_INTENT_WINDOW_N) || 5);
   const decay = Number(process.env.LYNKR_INTENT_DECAY);
   const decayFactor = Number.isFinite(decay) && decay > 0 && decay <= 1 ? decay : 0.7;
-  const windowUserMsgs = allUserMsgs.slice(-N); // chronological, oldest-first
-
-  // Cap tools at 3 so we stay below the agentic detector's tool-count
-  // signal thresholds: high_tool_count fires at >5, moderate_tool_count at
-  // >3, no tool-count signal at <=3. Claude Code interactive mode attaches
-  // 11+ tools every request, but our pickTier needs to reflect USER intent,
-  // not session context.
-  const intentTools = Array.isArray(body?.tools) ? body.tools.slice(0, 3) : undefined;
+  // Window over messages the USER actually authored: tool_result-only and
+  // harness frames would otherwise age the typed ask out of the window and
+  // score envelope noise in its place. Pure tool exchanges keep the raw
+  // window as a fallback.
+  const { extractCleanUserText } = require("../routing/intent-score");
+  const textBearingMsgs = allUserMsgs.filter(
+    (m) => extractCleanUserText({ messages: [m] })
+  );
+  const windowUserMsgs = (textBearingMsgs.length > 0 ? textBearingMsgs : allUserMsgs)
+    .slice(-N); // chronological, oldest-first
+
+  // WS3 — we USED to slice tools to 3 here so Claude Code's 11 baseline
+  // tools didn't inflate the agentic detector's tool-count signal. That
+  // hack was client-specific and also discarded real MCP tools the user
+  // had configured. Now we pass the full tools array and let the detector
+  // subtract the client's baseline via the profile threaded onto the
+  // payload — same short-message-intent guarantee, but MCP tools count.
+  const intentTools = Array.isArray(body?.tools) ? body.tools : undefined;
 
   // CLEAN each user message: Claude Code wraps user input in
   //   <system-reminder>...</system-reminder> blocks (CLAUDE.md context,
@@ -124,6 +175,10 @@ async function pickTierByIntent(body) {
     const intentPayload = {
       messages: cleaned ? [cleaned] : [],
       tools: intentTools,
+      // WS3 — inherit the client profile from the parent request so the
+      // agentic detector inside determineProviderSmart can subtract the
+      // harness's baseline tools during intent scoring too.
+      _clientProfile: body?._clientProfile || null,
     };
     try {
       const decision = await determineProviderSmart(intentPayload, {
@@ -173,6 +228,23 @@ async function pickTierByIntent(body) {
     reason: d.reason || null,
     agenticResult: d.agenticResult || null,
     risk: d.risk || null,
+    // WS0: forward the intent-scoring decision's escalation ledger so the
+    // downstream forced-provider path can record it in telemetry.
+    base_tier: d.base_tier ?? null,
+    escalation_source: d.escalation_source ?? null,
+    // WS4: off-policy evaluation needs propensity + candidates on every row.
+    // The inner determineProviderSmart already sets these — we just forward.
+    // Falls back to a deterministic single-candidate view when the inner
+    // path returned neither (e.g. legacy shadow decisions).
+    propensity: d.propensity ?? 1.0,
+    candidates: d.candidates ?? [{ provider: d.provider, model: d.model || null }],
+    // WS5: feedback path needs the bandit context vector (to call
+    // bandit.update with the same features the arm was scored on) and the
+    // query embedding (to add conclusive-quality outcomes to kNN). Both
+    // are underscored — they don't leak through response headers.
+    _banditContext: d._banditContext ?? null,
+    _queryEmbedding: d._queryEmbedding ?? null,
+    _queryText: d._queryText ?? null,
   };
 }
 
@@ -226,6 +298,21 @@ async function handleOauthPassthrough(req, res, opts = {}) {
     if (HOP_BY_HOP.has(name.toLowerCase())) continue;
     outHeaders[name] = Array.isArray(value) ? value.join(", ") : value;
   }
+  // Strip Lynkr's internal underscore-prefixed fields (_sessionId,
+  // _forceProvider, _tierModel, _tierName, _forcedMethod, _baseTier,
+  // _escalationSource, _pinnedRoute, _switchReason, _clientProfile,
+  // _workspace, _tenantPolicy, _deadlineMs, _suggestionModeModel). Anthropic
+  // rejects unknown top-level keys with "Extra inputs are not permitted".
+  // The orchestrator's downstream paths whitelist their outbound bodies,
+  // but the passthrough sends this body VERBATIM — so we must strip here.
+  if (bodyToSend && typeof bodyToSend === 'object') {
+    const stripped = { ...bodyToSend };
+    for (const key of Object.keys(stripped)) {
+      if (key.startsWith('_')) delete stripped[key];
+    }
+    bodyToSend = stripped;
+  }
+
   // Re-stringify the body — express already parsed it. Identical re-encoding
   // is fine; Anthropic doesn't fingerprint key ordering.
   const bodyText = JSON.stringify(bodyToSend);
@@ -296,7 +383,7 @@ async function handleOauthPassthrough(req, res, opts = {}) {
     const decoder = new TextDecoder();
     try {
       while (true) {
-        const { value, done } = await reader.read();
+        const { value, done } = await readWithIdleTimeout(reader, "oauth-passthrough");
         if (done) break;
         const buf = Buffer.from(value);
         res.write(buf);
@@ -306,6 +393,10 @@ async function handleOauthPassthrough(req, res, opts = {}) {
           responseTextForObservability += decoder.decode(value, { stream: true });
         }
       }
+    } catch (err) {
+      logger.warn({ err: err.message }, "OAuth passthrough stream stalled — ending response");
+      try { reader.cancel(); } catch { /* already dead */ }
+      try { res.write(SSE_STALL_EVENT); } catch { /* client gone */ }
     } finally {
       try { reader.releaseLock(); } catch {}
     }
@@ -313,10 +404,18 @@ async function handleOauthPassthrough(req, res, opts = {}) {
   } else {
     const text = await upstreamResp.text();
     if (!upstreamResp.ok) {
+      // Auth-shape diagnostics (prefix only, never the token): sk-ant-oat*
+      // = subscription OAuth (fix: /login refresh), sk-ant-api* = an API KEY
+      // is overriding the subscription (fix: unset ANTHROPIC_API_KEY or the
+      // client's injected key), JWT/none = client sent something unusable.
+      const authHdr = String(req.headers?.authorization || "");
+      const apiKeyHdr = String(req.headers?.["x-api-key"] || "");
       logger.warn({
         status: upstreamResp.status,
         bodyPreview: text.slice(0, 500),
         upstream,
+        authShape: authHdr ? authHdr.replace("Bearer ", "").slice(0, 12) + "…" : "(none)",
+        xApiKeyShape: apiKeyHdr ? apiKeyHdr.slice(0, 12) + "…" : "(none)",
       }, "OAuth passthrough upstream returned non-2xx");
     }
     responseTextForObservability = text;
@@ -359,59 +458,53 @@ async function handleOauthPassthrough(req, res, opts = {}) {
         ?? inputTokenEstimate;
 
       // Lynkr-wide metrics
-      try {
-        const { getMetricsCollector } = require("../observability/metrics");
-        const mc = getMetricsCollector();
-        mc.recordProviderSuccess?.("azure-anthropic-passthrough", latencyMs);
-        if (outputTokens || inputTokensActual) mc.recordTokens?.(inputTokensActual, outputTokens || 0);
-      } catch (_) {}
+      const { getMetricsCollector } = require("../observability/metrics");
+      const mc = getMetricsCollector();
+      mc.recordProviderSuccess("azure-anthropic-passthrough", latencyMs);
+      if (outputTokens || inputTokensActual) mc.recordTokens(inputTokensActual, outputTokens || 0);
 
       // Tier router telemetry (so it shows up in dashboards / routing stats)
-      try {
-        const tlm = require("../routing/telemetry");
-        tlm.record?.({
-          request_id: req.headers["request-id"] || req.headers["x-request-id"] || null,
-          session_id: req.body?._sessionId || req.sessionId || null,
-          timestamp: startedAt,
-          tier: tier.tier || "COMPLEX",
-          provider: "azure-anthropic-passthrough",
-          model: req.body?.model || tier.model || null,
-          routing_method: "oauth-passthrough",
-          status_code: upstreamResp.status,
-          latency_ms: latencyMs,
-          input_tokens: inputTokensActual || null,
-          output_tokens: outputTokens || null,
-          message_count: req.body?.messages?.length || null,
-          tool_count: Array.isArray(req.body?.tools) ? req.body.tools.length : 0,
-          was_fallback: false,
-        });
-      } catch (_) {}
-
-      // Audit log
-      try {
-        const { createAuditLogger } = require("../logger/audit-logger");
-        const audit = createAuditLogger(config.audit);
-        audit?.log?.({
-          provider: "azure-anthropic-passthrough",
-          destination: upstream,
-          status: upstreamResp.status,
-          latencyMs,
-          inputTokens: inputTokensActual,
-          outputTokens,
-          model: req.body?.model,
-        });
-      } catch (_) {}
+      const tlm = require("../routing/telemetry");
+      tlm.record({
+        request_id: req.headers["request-id"] || req.headers["x-request-id"] || null,
+        session_id: req.body?._sessionId || req.sessionId || null,
+        timestamp: startedAt,
+        tier: tier.tier || "COMPLEX",
+        provider: "azure-anthropic-passthrough",
+        model: req.body?.model || tier.model || null,
+        routing_method: "oauth-passthrough",
+        status_code: upstreamResp.status,
+        latency_ms: latencyMs,
+        input_tokens: inputTokensActual || null,
+        output_tokens: outputTokens || null,
+        message_count: req.body?.messages?.length || null,
+        tool_count: Array.isArray(req.body?.tools) ? req.body.tools.length : 0,
+        was_fallback: false,
+      });
+
+      // Audit log. NOTE: the interface returned by createAuditLogger exposes
+      // logLlmRequest/logLlmResponse — no generic `.log` — so the optional
+      // call stays until this is migrated to the real audit API.
+      const { createAuditLogger } = require("../logger/audit-logger");
+      const audit = createAuditLogger(config.audit);
+      audit.log?.({
+        provider: "azure-anthropic-passthrough",
+        destination: upstream,
+        status: upstreamResp.status,
+        latencyMs,
+        inputTokens: inputTokensActual,
+        outputTokens,
+        model: req.body?.model,
+      });
 
       // Memory extraction (read-only on response, no LLM call — pure regex)
       if (parsedResponse && config.memory?.extraction?.enabled) {
-        try {
-          const memoryExtractor = require("../memory/extractor");
-          memoryExtractor.extractMemories?.(
-            parsedResponse,
-            req.body?.messages || [],
-            { sessionId: req.body?._sessionId || req.sessionId || null }
-          ).catch(() => {});
-        } catch (_) {}
+        const memoryExtractor = require("../memory/extractor");
+        memoryExtractor.extractMemories(
+          parsedResponse,
+          req.body?.messages || [],
+          { sessionId: req.body?._sessionId || req.sessionId || null }
+        ).catch(() => {});
       }
     } catch (err) {
       logger.debug({ err: err.message }, "OAuth passthrough observability hook failed (non-fatal)");
@@ -464,7 +557,6 @@ function extractAnthropicMessageFromSSE(sseText) {
  *   - Memory is disabled
  *   - No memories retrieved
  *   - Latest message is not a user turn (could be tool_result, assistant)
- *   - Latest user message sits inside a cache_control-marked prefix
  *
  * Returns a new body with appended context otherwise. Original body never
  * mutated (returns a shallow-cloned messages array).
@@ -476,29 +568,6 @@ function maybeInjectMemoryIntoUserTail(body) {
   const lastMsg = body.messages[lastIdx];
   if (!lastMsg || lastMsg.role !== "user") return body;
 
-  // Frozen-prefix check: if the previous message has cache_control set, the
-  // model client (Claude Code) considers messages up to that point cached.
-  // We refuse to mutate inside the cached prefix to preserve cache hits.
-  // (For Anthropic, cache_control is on a content block, not the message
-  // itself, so scan content blocks.)
-  const hasCacheControlAtOrBefore = (idx) => {
-    for (let i = 0; i <= idx; i++) {
-      const m = body.messages[i];
-      if (!m || !Array.isArray(m.content)) continue;
-      for (const blk of m.content) {
-        if (blk && typeof blk === "object" && blk.cache_control) return true;
-      }
-    }
-    return false;
-  };
-  // Only mutate if the previous message (lastIdx-1) is NOT cache-marked.
-  // That keeps Claude Code's prompt-cache breakpoint stable.
-  if (lastIdx >= 1 && hasCacheControlAtOrBefore(lastIdx - 1)) {
-    // Common case: it's fine — the user message itself isn't in the prefix.
-    // Continue.
-  }
-
-  // Retrieve relevant memories for this user query.
   const { retrieveRelevantMemories, formatMemoriesForContext, extractQueryFromMessage } =
     require("../memory/retriever");
   const query = extractQueryFromMessage(lastMsg);
@@ -675,16 +744,27 @@ router.post("/routing/analyze", async (req, res) => {
     const { getModelTierSelector } = require("../routing/model-tiers");
     const { getModelRegistry } = require("../routing/model-registry");
 
-    const analysis = await analyzeComplexity(req.body, { weighted: req.query.weighted === "true" });
+    // ?mode=intent scores through the WS7 anchor intent path — the same
+    // scorer live /v1/messages routing uses — instead of the legacy lexical
+    // complexity analyzer. Falls back to lexical when embeddings are down
+    // (mirroring live behavior).
+    let analysis;
+    if (req.query.mode === "intent") {
+      const { scoreIntent } = require("../routing/intent-score");
+      const intent = await scoreIntent(req.body);
+      analysis = intent
+        ? { score: intent.score, intentMode: intent.mode, intentClass: intent.class ?? null }
+        : await analyzeComplexity(req.body, { weighted: req.query.weighted === "true" });
+    } else {
+      analysis = await analyzeComplexity(req.body, { weighted: req.query.weighted === "true" });
+    }
     const agentic = getAgenticDetector().detect(req.body);
     const selector = getModelTierSelector();
     const tier = selector.getTier(analysis.score);
 
-    // Get recommended model for tier
     const provider = req.query.provider || "openai";
     const modelSelection = selector.selectModel(tier, provider);
 
-    // Get model cost info
     let modelInfo = null;
     if (modelSelection.model) {
       const registry = await getModelRegistry();
@@ -719,7 +799,6 @@ router.post("/v1/messages/count_tokens", rateLimiter, async (req, res, next) =>
   try {
     const { messages, system } = req.body;
 
-    // Validate required fields
     if (!messages || !Array.isArray(messages)) {
       return res.status(400).json({
         error: {
@@ -729,7 +808,6 @@ router.post("/v1/messages/count_tokens", rateLimiter, async (req, res, next) =>
       });
     }
 
-    // Estimate token count
     const inputTokens = estimateTokenCount(messages, system);
 
     // Return token count in Anthropic API format
@@ -743,7 +821,6 @@ router.post("/v1/messages/count_tokens", rateLimiter, async (req, res, next) =>
 
 // Stub endpoint for event logging (used by Claude CLI)
 router.post("/api/event_logging/batch", (req, res) => {
-  // Silently accept and discard event logging requests
   res.status(200).json({ success: true });
 });
 
@@ -796,6 +873,20 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
       model: req.body?.model,
     }, "Inbound /v1/messages");
 
+    // WS3 — detect the client harness (Claude Code / Cursor / Codex / …)
+    // ONCE per request and stash on the body so every downstream routing
+    // stage (pickTierByIntent's per-message scoring, orchestrator's full
+    // determineProviderSmart) sees the same profile and can subtract the
+    // client's baseline tool loadout when scoring agentic signals.
+    if (!req.body._clientProfile) {
+      try {
+        const profile = detectClient({ headers: req.headers, payload: req.body });
+        if (profile) req.body._clientProfile = profile;
+      } catch (err) {
+        logger.debug({ err: err.message }, '[Router] client detection failed');
+      }
+    }
+
     // Auth-mode classification (Headroom-style, UA-first):
     //
     //   - 'subscription': UX-bound CLI/IDE (Claude Code, Cursor, Copilot, …).
@@ -821,13 +912,217 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
     // COMPLEX/REASONING regardless of what the user actually typed. Window-
     // scoring fixes that for PAYG too.
     const authMode = classifyAuthMode(req.headers);
-    const tier = await pickTierByIntent(req.body);
+
+    // The session middleware sets req.sessionId from the x-session-id header,
+    // but req.body._sessionId isn't populated until deep in the orchestrator
+    // (src/orchestrator/index.js). WS1's checkSessionPin reads _sessionId off
+    // the payload, so mirror it onto the body here — the orchestrator's later
+    // assignment is a no-op when the value already matches.
+    if (req.sessionId && !req.body._sessionId) {
+      req.body._sessionId = req.sessionId;
+    }
+
+    // WS1 — sticky-session reuse. If this session already has a valid pin
+    // (guards pass, no compaction), skip pickTierByIntent entirely and reuse
+    // the pinned decision. This is the biggest cost win of WS1: repeat turns
+    // in a session skip the whole window-scored intent pipeline.
+    let tier;
+    const pinCheck = checkSessionPin(req.body);
+    // Side-request detection. Claude Code fires internal background calls
+    // (title generation, summarization, memory extraction, suggestion-mode
+    // autocomplete) that REPLAY the conversation — so they share the
+    // conversation's content fingerprint — but wrap it in harness prompts
+    // and repo transcript text. Two live incidents (2026-07-07):
+    //   1. A summarization side request replayed tool outputs full of
+    //      "security"/"credential" strings from the repo itself, tripped
+    //      the risk guard, re-routed COMPLEX (score 100), and OVERWROTE
+    //      the conversation's pin.
+    //   2. A suggestion-mode request — which DOES carry the full 13-tool
+    //      loadout, defeating the tool-less check — tripped risk on its
+    //      own "[SUGGESTION MODE: ...]" wrapper instructions and poisoned
+    //      the pin the same way (telemetry: risk+window COMPLEX 100).
+    // Discriminators: interactive turns attach tools AND have a plain last
+    // user message; side traffic is tool-less OR suggestion-tagged.
+    // Side requests are routed to a static cheap tier below — scoring
+    // harness wrapper text is meaningless and, worse, can land them on the
+    // subscription passthrough, burning quota on autocomplete calls.
+    const _lastUserText = (() => {
+      const msgs = req.body?.messages;
+      if (!Array.isArray(msgs)) return '';
+      for (let i = msgs.length - 1; i >= 0; i--) {
+        const m = msgs[i];
+        if (m?.role !== 'user') continue;
+        if (typeof m.content === 'string') return m.content;
+        if (Array.isArray(m.content)) {
+          return m.content.filter(b => b?.type === 'text').map(b => b.text || '').join(' ');
+        }
+        return '';
+      }
+      return '';
+    })();
+    const isSuggestionMode = _lastUserText.includes('[SUGGESTION MODE:');
+    // Tool-lessness alone is NOT harness evidence: generic API clients
+    // (curl, benchmarks, SDKs) legitimately send bare messages and must get
+    // full routing — live regression 2026-07-08: a benchmark's security-
+    // analysis scenario was force-SIMPLE'd as a "side request" and never
+    // reached the risk classifier. Require a detected client profile
+    // (harness UA / tool fingerprint) before treating tool-less traffic as
+    // side traffic; a suggestion-mode tag is harness evidence by itself.
+    const isKnownHarness = !!req.body?._clientProfile;
+    const isSideRequest = isSuggestionMode
+      || ((!Array.isArray(req.body?.tools) || req.body.tools.length === 0) && isKnownHarness);
+    // Side requests short-circuit to the static SIMPLE tier: no pin read
+    // (a COMPLEX-pinned conversation would burn expensive tokens on
+    // autocomplete), no pin write, no intent scoring of wrapper text.
+    // Upstream failures (e.g. a huge summarization overflowing the SIMPLE
+    // model's context) are rescued by the tier-fallback chain.
+    let sideTier = null;
+    if (isSideRequest) {
+      try {
+        const sel = getModelTierSelector().selectModel('SIMPLE', null);
+        sideTier = {
+          tier: 'SIMPLE',
+          provider: sel.provider,
+          model: sel.model || null,
+          score: null,
+          method: isSuggestionMode ? 'side_request_suggestion' : 'side_request',
+          reason: 'harness_side_request',
+          base_tier: null,
+          escalation_source: null,
+          pinned: false,
+          switch_reason: null,
+          propensity: 1.0,
+          candidates: [{ provider: sel.provider, model: sel.model || null }],
+        };
+      } catch (err) {
+        // Tier selector unavailable — fall through to the normal flow;
+        // the isSideRequest guards below still block pin writes.
+        logger.debug({ err: err.message }, 'Side-request static tier failed, falling through');
+      }
+    }
+    // WS1.5 — upward-drift check. A session pinned SIMPLE by a trivial
+    // opener ("Hi") must escape the pin the moment the real task arrives
+    // ("plan a refactor of the whole repo"). Only meaningful for
+    // guards_passed serves — tool_history turns must never switch models.
+    let pinDrift = null;
+    if (!sideTier && pinCheck.serve && pinCheck.reason === 'guards_passed' && !isSideRequest) {
+      pinDrift = await checkPinScoreDrift(pinCheck.pin, req.body);
+    }
+    if (sideTier) {
+      tier = sideTier;
+      logger.debug({
+        reqNumber: messagesRequestCount,
+        authMode,
+        suggestion: isSuggestionMode,
+        provider: tier.provider,
+      }, "OAuth intent — side request routed to static SIMPLE");
+    } else if (pinCheck.serve && !pinDrift?.drift) {
+      tier = {
+        tier: pinCheck.pin.tier || null,
+        provider: pinCheck.pin.provider,
+        model: pinCheck.pin.model || null,
+        // Prefer the drift check's fresh per-message score — it's already
+        // computed on every guards_passed pinned turn, and showing it makes
+        // the badge reflect THIS message instead of repeating the score
+        // that created the pin turns ago (users read a wall of "score 0"
+        // as the router being asleep). Falls back to the pin's original
+        // score on tool_history serves, where drift is deliberately
+        // skipped. Never complexity.score — the full-body value is
+        // inflated by tools + system + history.
+        score: typeof pinDrift?.freshScore === 'number'
+          ? pinDrift.freshScore
+          : (typeof pinCheck.pin.score === 'number' ? pinCheck.pin.score : null),
+        // Original pin score, surfaced in the badge as "pin@N" so both
+        // numbers are visible.
+        _pinScore: typeof pinCheck.pin.score === 'number' ? pinCheck.pin.score : null,
+        method: 'session_pin',
+        reason: 'sticky_' + pinCheck.reason,
+        base_tier: null,
+        escalation_source: null,
+        pinned: true,
+        switch_reason: null,
+      };
+      logger.debug({
+        reqNumber: messagesRequestCount,
+        authMode,
+        sessionId: pinCheck.sessionId,
+        tier,
+      }, "OAuth intent — served from session pin");
+    } else {
+      if (pinDrift?.drift) {
+        logger.info({
+          sessionId: pinCheck.sessionId,
+          pinnedTier: pinCheck.pin?.tier,
+          freshScore: pinDrift.freshScore,
+          ceiling: pinDrift.ceiling,
+        }, "OAuth intent — pin score drift, re-deciding");
+      }
+      tier = await pickTierByIntent(req.body);
+      if (pinDrift?.drift && tier) tier.switch_reason = 'score_drift';
+
+      // Compaction floor: compaction resets cache economics, not task
+      // difficulty — post-compaction windows score harness summaries, not
+      // the ask that earned the pin. Re-routes may move up, never below
+      // the pinned tier.
+      if (pinCheck.reason === 'compaction' && pinCheck.pin?.tier && tier?.tier) {
+        const { TIER_DEFINITIONS } = require("../routing/model-tiers");
+        const pri = (t) => TIER_DEFINITIONS[t]?.priority ?? -1;
+        if (pri(tier.tier) < pri(pinCheck.pin.tier)) {
+          const { getModelTierSelector } = require("../routing/model-tiers");
+          const floored = getModelTierSelector().selectModel(pinCheck.pin.tier, null);
+          logger.info({
+            sessionId: pinCheck.sessionId,
+            windowTier: tier.tier,
+            flooredTo: pinCheck.pin.tier,
+          }, "OAuth intent — compaction re-route floored at pinned tier");
+          tier = {
+            ...tier,
+            tier: pinCheck.pin.tier,
+            provider: floored.provider,
+            model: floored.model,
+            method: (tier.method || 'tier_config') + '+compaction_floor',
+            switch_reason: 'compaction_floor',
+          };
+        }
+      }
+      // Persist the fresh decision so the next turn on this session can
+      // reuse it. checkSessionPin returned serve=false (or WS1.5 drift fired),
+      // so either there was no pin, the pin lost a guard (context/vision/
+      // risk), the session was compacted, or the conversation outgrew its
+      // pinned tier — in every case we want the new pin. EXCEPT side
+      // requests: their decisions reflect harness wrapper text, not the
+      // user's conversation, and must never poison the conversation's pin.
+      if (!isSideRequest && pinCheck.sessionId && tier?.provider) {
+        writeSessionPin(pinCheck.sessionId, tier, req.body);
+      } else if (isSideRequest && pinCheck.sessionId && tier?.provider) {
+        logger.debug({
+          sessionId: pinCheck.sessionId,
+          tier: tier.tier,
+          provider: tier.provider,
+        }, "OAuth intent — side request (no tools), pin write skipped");
+      }
+    }
 
     // Subscription-only fork: anti-abuse stealth passthrough when the picked
     // tier resolves to azure-anthropic. Bypasses the orchestrator entirely
     // so the inbound bytes hit api.anthropic.com unchanged (Anthropic
     // fingerprints subscription clients; any mutation gets flagged).
-    if (authMode === 'subscription' && tier.provider === 'azure-anthropic') {
+    // Passthrough forwards the CLIENT's credentials; GUI harnesses that
+    // spawn claude headless inject placeholder keys ("dummy") that Anthropic
+    // 401s. Placeholder auth ⇒ serve REASONING via the provider's own
+    // credentials instead.
+    const _clientApiKey = String(req.headers?.['x-api-key'] || '').toLowerCase();
+    const _clientAuthHdr = String(req.headers?.authorization || '');
+    const _placeholderAuth =
+      !_clientAuthHdr &&
+      (['dummy', 'test', 'placeholder', 'none', 'x', 'sk-dummy'].includes(_clientApiKey) || _clientApiKey.length < 8);
+    if (_placeholderAuth && authMode === 'subscription' && tier.provider === 'azure-anthropic') {
+      logger.info({
+        reqNumber: messagesRequestCount,
+        xApiKeyShape: _clientApiKey.slice(0, 12),
+      }, 'Placeholder client auth — skipping passthrough, serving REASONING via provider credentials');
+    }
+    if (authMode === 'subscription' && tier.provider === 'azure-anthropic' && !_placeholderAuth) {
       logger.debug({
         reqNumber: messagesRequestCount,
         authMode,
@@ -852,6 +1147,26 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
     }, "Intent-scored tier routing → orchestrator (forced provider)");
     req.body._forceProvider = tier.provider;
     if (tier.model) req.body._tierModel = tier.model;
+    // Carry the full intent-scored decision into the downstream client so
+    // WS0's telemetry columns (tier, base_tier, escalation_source, pinned)
+    // are populated for the forced path too — otherwise every OAuth-intent
+    // request lands in routing_telemetry with empty tier + method='forced'.
+    if (tier.tier) req.body._tierName = tier.tier;
+    if (tier.method) req.body._forcedMethod = tier.method;
+    if (tier.base_tier) req.body._baseTier = tier.base_tier;
+    if (tier.escalation_source) req.body._escalationSource = tier.escalation_source;
+    if (tier.pinned) req.body._pinnedRoute = true;
+    if (tier.switch_reason) req.body._switchReason = tier.switch_reason;
+    // WS4 — propensity + candidates land on every telemetry row so downstream
+    // off-policy evaluation can score any counterfactual policy from logs.
+    if (tier.propensity != null) req.body._propensity = tier.propensity;
+    if (tier.candidates) req.body._candidates = tier.candidates;
+    // WS5 — bandit context vector + query embedding for the feedback loop.
+    // All three are underscored; `_stripInternalFields` scrubs them before
+    // the outbound provider request so no risk of leaking to Anthropic/Ollama.
+    if (tier._banditContext) req.body._banditContext = tier._banditContext;
+    if (tier._queryEmbedding) req.body._queryEmbedding = tier._queryEmbedding;
+    if (tier._queryText) req.body._queryText = tier._queryText;
     req._intentTier = tier;
 
     // Convert Anthropic server tools (web_search_20260209, etc.) to regular
@@ -959,16 +1274,32 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
       preRouteReason = 'user_intent';
     }
 
+    // Prefer the intent scorer's per-message score over the full-payload
+    // complexity score. The full-payload score is always inflated on
+    // subscription clients (5 KB system + 11 tools + prior turns) and would
+    // display "score 46" on a trivial "what did I just say?" follow-up.
+    // Only fall back to complexity.score when we don't have an intent
+    // decision at all (e.g. shouldForceLocal shortcut, or the intent scorer
+    // didn't run for this request type).
+    let displayScore = null;
+    if (req._intentTier && typeof req._intentTier.score === 'number') {
+      displayScore = req._intentTier.score;
+    } else if (!req._intentTier) {
+      displayScore = complexity.score;
+    }
+
     const preRouteDecision = {
       provider: preRouteProvider,
       tier: preRouteTier,
       model: preRouteModel,
       method: preRouteMethod,
       reason: preRouteReason,
-      // For OAuth requests, surface the user-intent score, not the full-payload one.
-      score: req._intentTier?.score ?? complexity.score,
+      score: displayScore,
       threshold: complexity.threshold,
       risk: preRouteRisk,
+      // Pin-serve turns carry the pin's original score so the badge can
+      // show "score <fresh> · pin@<original>".
+      _pinScore: typeof req._intentTier?._pinScore === 'number' ? req._intentTier._pinScore : null,
     };
 
     const routingHeaders = getRoutingHeaders(preRouteDecision);
@@ -978,19 +1309,17 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
     // response body when LYNKR_VISIBLE_ROUTING=true.
     const interaction = buildInteractionBlock(preRouteDecision);
 
-    // Extract client CWD from request body or header
     const clientCwd = validateCwd(req.body?.cwd || req.headers['x-workspace-cwd']);
 
     // For true streaming: only support non-tool requests for MVP
     // Tool requests require buffering for agent loop
     if (wantsStream && !hasTools) {
-      // True streaming path for text-only requests
       metrics.recordStreamingStart();
       res.set({
         "Content-Type": "text/event-stream",
         "Cache-Control": "no-cache",
         Connection: "keep-alive",
-        ...routingHeaders,  // Include routing headers
+        ...routingHeaders,
       });
       if (typeof res.flushHeaders === "function") {
         res.flushHeaders();
@@ -1008,7 +1337,6 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
         },
       });
 
-      // Check if we got a stream back
       if (result.stream) {
         // Parse SSE stream from provider and forward to client
         const reader = result.stream.getReader();
@@ -1017,13 +1345,12 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
 
         try {
           while (true) {
-            const { done, value } = await reader.read();
+            const { done, value } = await readWithIdleTimeout(reader, "provider-stream");
             if (done) break;
 
             const chunk = decoder.decode(value, { stream: true });
             bufferChunks.push(chunk);
 
-            // Join buffer and split by lines
             const buffer = bufferChunks.join('');
             const lines = buffer.split('\n');
 
@@ -1038,13 +1365,11 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
               }
             }
 
-            // Flush after each chunk
             if (typeof res.flush === 'function') {
               res.flush();
             }
           }
 
-          // Send any remaining buffer
           const remaining = bufferChunks.join('');
           if (remaining.trim()) {
             res.write(remaining + '\n');
@@ -1056,7 +1381,6 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
         } catch (streamError) {
           logger.error({ error: streamError }, "Error streaming response");
 
-          // Cancel stream on error
           try {
             await reader.cancel();
           } catch (cancelError) {
@@ -1066,6 +1390,10 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
           if (!res.headersSent) {
             res.status(500).json({ error: "Streaming error" });
           } else {
+            // Mid-stream failure: emit a parseable Anthropic error event so
+            // the client fails fast and retries, instead of seeing a
+            // truncated stream it may wait on.
+            try { res.write(SSE_STALL_EVENT); } catch { /* client gone */ }
             res.end();
           }
           return;
@@ -1080,8 +1408,6 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
         }
       }
 
-      // Fallback: if no stream, wrap buffered response in proper Anthropic SSE format
-      // Check if result.body exists
       if (!result || !result.body) {
         res.write(`event: error\n`);
         res.write(`data: ${JSON.stringify({ type: "error", error: { message: "Empty response from provider" } })}\n\n`);
@@ -1091,7 +1417,6 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
 
       const msg = result.body;
 
-      // 1. message_start
       res.write(`event: message_start\n`);
       res.write(`data: ${JSON.stringify({
         type: "message_start",
@@ -1107,19 +1432,24 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
         }
       })}\n\n`);
 
-      // 2. content_block_start and content_block_delta for each content block
       // Filter out server-side tools that shouldn't reach the client
+      // Server-tool filtering is server-mode only: in client mode Task and
+      // WebSearch are the CLIENT'S tools, and stripping them emits a
+      // malformed turn (stop_reason tool_use with no tool_use block).
       const _serverTools = new Set(["task", "websearch", "webfetch", "web_search", "web_fetch", "web_agent"]);
-      let contentBlocks = (msg.content || []).filter(b =>
-        !(b.type === "tool_use" && _serverTools.has((b.name || "").toLowerCase()))
-      );
+      const _clientOwnsTools = config.toolExecutionMode === "client" || config.toolExecutionMode === "passthrough";
+      let contentBlocks = _clientOwnsTools
+        ? (msg.content || []).slice()
+        : (msg.content || []).filter(b =>
+            !(b.type === "tool_use" && _serverTools.has((b.name || "").toLowerCase()))
+          );
 
       // When LYNKR_VISIBLE_ROUTING=true, prepend a one-line routing badge so
       // users can see which tier/provider/model handled the request inside
       // Claude Code's TUI (TUI only renders content blocks; unknown top-level
       // fields are silently dropped).
       if (config.routing?.visibleInteraction && interaction) {
-        const badge = `*[Lynkr] ${interaction.tier || '—'} → ${interaction.model || '—'} (${interaction.provider || '—'}) · score ${interaction.complexity_score ?? '—'}*\n\n`;
+        const badge = `*[Lynkr] ${interaction.tier || '—'} → ${interaction.model || '—'} (${interaction.provider || '—'}) · score ${interaction.complexity_score ?? '—'}${interaction.pin_score != null ? ` · pin@${interaction.pin_score}` : ''}*\n\n`;
         contentBlocks = [{ type: 'text', text: badge }, ...contentBlocks];
       }
 
@@ -1221,15 +1551,20 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
         }
       }
 
-      // 3. message_delta with stop_reason
       res.write(`event: message_delta\n`);
       res.write(`data: ${JSON.stringify({
         type: "message_delta",
-        delta: { stop_reason: msg.stop_reason || "end_turn", stop_sequence: null },
+        // Consistency: never claim tool_use if no tool_use block was emitted
+        // (a stop_reason pointing at a missing block hangs the client).
+        delta: {
+          stop_reason: (msg.stop_reason === "tool_use" && !contentBlocks.some(b => b.type === "tool_use"))
+            ? "end_turn"
+            : (msg.stop_reason || "end_turn"),
+          stop_sequence: null,
+        },
         usage: { output_tokens: msg.usage?.output_tokens || 0 }
       })}\n\n`);
 
-      // 4. message_stop
       res.write(`event: message_stop\n`);
       res.write(`data: ${JSON.stringify({ type: "message_stop" })}\n\n`);
 
@@ -1266,7 +1601,6 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
         res.flushHeaders();
       }
 
-      // Check if result.body exists
       if (!result || !result.body) {
         res.write(`event: error\n`);
         res.write(`data: ${JSON.stringify({ type: "error", error: { message: "Empty response from provider" } })}\n\n`);
@@ -1274,10 +1608,8 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
         return;
       }
 
-      // Use proper Anthropic SSE format
       const msg = result.body;
 
-      // 1. message_start
       res.write(`event: message_start\n`);
       res.write(`data: ${JSON.stringify({
         type: "message_start",
@@ -1293,19 +1625,24 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
         }
       })}\n\n`);
 
-      // 2. content_block_start and content_block_delta for each content block
       // Filter out server-side tools that shouldn't reach the client
+      // Server-tool filtering is server-mode only: in client mode Task and
+      // WebSearch are the CLIENT'S tools, and stripping them emits a
+      // malformed turn (stop_reason tool_use with no tool_use block).
       const _serverTools = new Set(["task", "websearch", "webfetch", "web_search", "web_fetch", "web_agent"]);
-      let contentBlocks = (msg.content || []).filter(b =>
-        !(b.type === "tool_use" && _serverTools.has((b.name || "").toLowerCase()))
-      );
+      const _clientOwnsTools = config.toolExecutionMode === "client" || config.toolExecutionMode === "passthrough";
+      let contentBlocks = _clientOwnsTools
+        ? (msg.content || []).slice()
+        : (msg.content || []).filter(b =>
+            !(b.type === "tool_use" && _serverTools.has((b.name || "").toLowerCase()))
+          );
 
       // When LYNKR_VISIBLE_ROUTING=true, prepend a one-line routing badge so
       // users can see which tier/provider/model handled the request inside
       // Claude Code's TUI (TUI only renders content blocks; unknown top-level
       // fields are silently dropped).
       if (config.routing?.visibleInteraction && interaction) {
-        const badge = `*[Lynkr] ${interaction.tier || '—'} → ${interaction.model || '—'} (${interaction.provider || '—'}) · score ${interaction.complexity_score ?? '—'}*\n\n`;
+        const badge = `*[Lynkr] ${interaction.tier || '—'} → ${interaction.model || '—'} (${interaction.provider || '—'}) · score ${interaction.complexity_score ?? '—'}${interaction.pin_score != null ? ` · pin@${interaction.pin_score}` : ''}*\n\n`;
         contentBlocks = [{ type: 'text', text: badge }, ...contentBlocks];
       }
 
@@ -1387,15 +1724,20 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
         }
       }
 
-      // 3. message_delta with stop_reason
       res.write(`event: message_delta\n`);
       res.write(`data: ${JSON.stringify({
         type: "message_delta",
-        delta: { stop_reason: msg.stop_reason || "end_turn", stop_sequence: null },
+        // Consistency: never claim tool_use if no tool_use block was emitted
+        // (a stop_reason pointing at a missing block hangs the client).
+        delta: {
+          stop_reason: (msg.stop_reason === "tool_use" && !contentBlocks.some(b => b.type === "tool_use"))
+            ? "end_turn"
+            : (msg.stop_reason || "end_turn"),
+          stop_sequence: null,
+        },
         usage: { output_tokens: msg.usage?.output_tokens || 0 }
       })}\n\n`);
 
-      // 4. message_stop
       res.write(`event: message_stop\n`);
       res.write(`data: ${JSON.stringify({ type: "message_stop" })}\n\n`);
 
@@ -1446,7 +1788,7 @@ router.post("/v1/messages", rateLimiter, async (req, res, next) => {
           parsed.lynkr_interaction = interaction;
           // Inject a one-line routing badge into content so the TUI renders it.
           if (Array.isArray(parsed.content)) {
-            const badge = `*[Lynkr] ${interaction.tier || '—'} → ${interaction.model || '—'} (${interaction.provider || '—'}) · score ${interaction.complexity_score ?? '—'} · savings ~${interaction.estimated_savings_percent ?? 0}%*\n\n`;
+            const badge = `*[Lynkr] ${interaction.tier || '—'} → ${interaction.model || '—'} (${interaction.provider || '—'}) · score ${interaction.complexity_score ?? '—'}${interaction.pin_score != null ? ` · pin@${interaction.pin_score}` : ''} · savings ~${interaction.estimated_savings_percent ?? 0}%*\n\n`;
             parsed.content.unshift({ type: 'text', text: badge });
           }
           finalBody = JSON.stringify(parsed);