mixdog 0.9.1 → 0.9.2

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -21,11 +21,13 @@ import { enrichModels } from './model-catalog.mjs';
 import { makeModelCache } from './model-cache.mjs';
 import { sanitizeToolPairs, sanitizeAnthropicContentPairs } from '../session/context-utils.mjs';
 import {
+    PROVIDER_FIRST_BYTE_TIMEOUT_MS,
     PROVIDER_HTTP_RESPONSE_TIMEOUT_MS,
     PROVIDER_RETRY_BACKOFF_MS,
     PROVIDER_RETRY_MAX_ATTEMPTS,
-    PROVIDER_SSE_IDLE_TIMEOUT_MS,
     PROVIDER_SSE_IDLE_WATCHDOG_ENABLED,
+    PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS,
+    streamStalledError,
     createPassthroughSignal,
 } from '../stall-policy.mjs';
 import {
@@ -38,14 +40,23 @@ import {
     withRetry,
 } from './retry-classifier.mjs';
 import { buildAnthropicBetaHeaders, supportsAnthropicFastMode } from './anthropic-betas.mjs';
+import {
+    applyAnthropicEffortToBody,
+    effortValuesForModel,
+    shouldIncludeEffortBeta,
+} from './anthropic-effort.mjs';
 import { getLlmDispatcher, preconnect } from '../../../shared/llm/http-agent.mjs';
 import { normalizeContentForAnthropic } from './media-normalization.mjs';
 import { makeInvalidToolArgsMarker } from './openai-compat-stream.mjs';
+import { scanLeakedToolCalls, createToolCallDedupe } from './anthropic-leaked-toolcall.mjs';
 
 // --- Model catalog cache helpers ---
 // Disk-backed cache so repeated process starts (cron, tool calls) don't
 // hammer /v1/models. 24h TTL matches the upstream client cadence.
 const MODEL_CACHE_TTL_MS = 24 * 60 * 60_000;
+// Bump when the on-disk cache shape changes so stale-shape entries are
+// discarded instead of misread (mirrors openai-oauth's schema-version gate).
+const ANTHROPIC_MODEL_CACHE_SCHEMA_VERSION = 1;
 // SSE progress emits (per-request "Response …" and "Done:" lines). Off by default.
 const SSE_VERBOSE = process.env.MIXDOG_SSE_VERBOSE === '1';
 
@@ -64,6 +75,7 @@ const SSE_MIDSTREAM_POLICY = {
 };
 
 function formatRetryAfter(ms) {
+    if (ms == null) return '';
     const n = Number(ms);
     if (!Number.isFinite(n) || n < 0) return '';
     if (n >= 60_000 && n % 60_000 === 0) return `${Math.round(n / 60_000)}m`;
@@ -93,6 +105,7 @@ function anthropicQuotaError(status, headers, bodyText = '') {
 const _modelCache = makeModelCache({
     fileName: 'anthropic-oauth-models.json',
     ttlMs: MODEL_CACHE_TTL_MS,
+    version: ANTHROPIC_MODEL_CACHE_SCHEMA_VERSION,
     onSave: (m) => { _inMemoryCatalog = Array.isArray(m) ? m.slice() : null; },
 });
 
@@ -134,6 +147,10 @@ function _displayModel(id) {
     return `claude-${m[1].toLowerCase()}-${m[2]}${m[3] ? `.${m[3]}` : ''}`;
 }
 
+function _capabilitySupported(capability) {
+    return capability === true || capability?.supported === true;
+}
+
 // Classify a model id into our common tier/family shape. Anthropic's catalog
 // mixes dated ids (claude-opus-4-5-20251101), versioned aliases
 // (claude-opus-4-6), and the raw family tokens resolved via env vars.
@@ -150,15 +167,19 @@ function _normalizeAnthropicModel(raw) {
     const releaseDate = dated
         ? id.match(/-(\d{4})(\d{2})(\d{2})$/)
         : null;
+    const effortValues = effortValuesForModel(raw?.capabilities, id);
     return {
         id,
         display: raw?.display_name || _prettyName(id, family),
         family,
         provider: 'anthropic-oauth',
-        contextWindow: raw?.context_window || raw?.max_context_window || _defaultContextForModel(id, family),
+        contextWindow: raw?.context_window || raw?.max_context_window || raw?.max_input_tokens || _defaultContextForModel(id, family),
+        outputTokens: raw?.max_tokens || raw?.max_output_tokens || null,
         tier,
         latest: false, // assigned in a second pass once full list is known
         releaseDate: releaseDate ? `${releaseDate[1]}-${releaseDate[2]}-${releaseDate[3]}` : null,
+        supportsReasoning: effortValues.length > 0 || _capabilitySupported(raw?.capabilities?.thinking),
+        reasoningOptions: effortValues.length ? [{ type: 'effort', values: effortValues }] : [],
     };
 }
 
@@ -298,9 +319,11 @@ function resolveCliVersion() {
 }
 
 function requiresSystemPrefix(model) {
-    // Opus / Sonnet require the OAuth system prefix when authenticated
-    // via OAuth. Haiku does not.
-    return /^claude-(opus|sonnet)/i.test(String(model || ''));
+    // High-tier Claude OAuth models require the first-party system prefix for
+    // OAuth pool routing. Haiku does not; keep every other Claude family (Opus,
+    // Sonnet, Fable, and future non-Haiku families) on the prefixed path.
+    const id = String(model || '').toLowerCase();
+    return /^claude-/.test(id) && !/^claude-haiku(?:-|$)/.test(id);
 }
 
 // OAuth rate-limit pool routing is gated by the server inspecting the first
@@ -363,22 +386,77 @@ const MAX_TOKENS = {
     'claude-haiku-4-5-20251001': 8192,
 };
 
-function resolveMaxTokens(model) {
+// Sanity floor/ceiling for resolveMaxTokens. Catalog-reported outputTokens
+// (from the Anthropic API, cached to disk) can be trusted above these
+// hardcoded fallbacks, but we still clamp to a safety cap so a bad/huge
+// catalog value can't blow the thinking+output budget, and floor so a
+// missing/zero catalog value never degenerates to an unusable cap.
+const MAX_TOKENS_FLOOR = 8192;
+const DEFAULT_SAFETY_CAP = 65536;
+// Parse MIXDOG_ANTHROPIC_MAX_OUTPUT_TOKENS strictly: only a finite positive
+// number is a valid override. Invalid values ("0", negatives, garbage,
+// whitespace) are treated as unset — NOT as "use the default cap outright" —
+// so resolveMaxTokens still consults catalog/fallback for low-cap models.
+function _envMaxOutputOverride() {
+    const raw = process.env.MIXDOG_ANTHROPIC_MAX_OUTPUT_TOKENS;
+    if (raw == null || String(raw).trim() === '') return null;
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n <= 0) return null;
+    return Math.floor(n);
+}
+
+// Catalog-reported outputTokens for a model id, read from the in-memory
+// catalog mirror (lazily populated from the disk cache if the mirror hasn't
+// been warmed yet by listModels()). Never throws — any failure just means
+// "no catalog data", and callers fall back to the static heuristics below.
+function _catalogOutputTokens(model) {
+    if (!model) return null;
+    try {
+        if (!Array.isArray(_inMemoryCatalog)) {
+            const cached = _modelCache.loadSync();
+            if (Array.isArray(cached)) _inMemoryCatalog = cached.slice();
+        }
+        if (!Array.isArray(_inMemoryCatalog)) return null;
+        const entry = _inMemoryCatalog.find(m => m?.id === model);
+        const out = Number(entry?.outputTokens);
+        return Number.isFinite(out) && out > 0 ? out : null;
+    } catch {
+        return null;
+    }
+}
+
+function _fallbackMaxTokens(model) {
     if (MAX_TOKENS[model]) return MAX_TOKENS[model];
     const id = String(model || '').toLowerCase();
     if (id.includes('opus')) return 65536;
+    if (id.includes('fable')) return 65536;
+    // Sonnet 5+ ships a much larger output budget than the legacy 4.x line
+    // (this is the claude-sonnet-5 fix: 16384 was starving visible output
+    // once extended thinking ate into the same hard cap). Keep sonnet-4-x
+    // conservative at 16384; only bump 5+.
+    const sonnetVersion = id.match(/^claude-sonnet-(\d+)/);
+    if (sonnetVersion) return Number(sonnetVersion[1]) >= 5 ? 65536 : 16384;
     if (id.includes('sonnet')) return 16384;
     if (id.includes('haiku')) return 8192;
     return 8192;
 }
 
-const EFFORT_BUDGET = {
-    low: 1024,
-    medium: 4096,
-    high: 16384,
-    xhigh: 32768,
-    max: 32768,
-};
+// resolveMaxTokens: catalog-driven max_tokens for a model id.
+//   1. MIXDOG_ANTHROPIC_MAX_OUTPUT_TOKENS env override, if set, wins outright.
+//   2. Catalog outputTokens (trusted over hardcoded heuristics when present),
+//      clamped to [MAX_TOKENS_FLOOR, safetyCap].
+//   3. Static MAX_TOKENS table / family heuristic fallback when the catalog
+//      has no entry for this model, also clamped to the safety cap.
+function resolveMaxTokens(model) {
+    const envOverride = _envMaxOutputOverride();
+    if (envOverride != null) return envOverride;
+    const safetyCap = DEFAULT_SAFETY_CAP;
+    const catalogValue = _catalogOutputTokens(model);
+    if (catalogValue != null) {
+        return Math.max(MAX_TOKENS_FLOOR, Math.min(catalogValue, safetyCap));
+    }
+    return Math.min(_fallbackMaxTokens(model), safetyCap);
+}
 
 const MIN_THINKING_BUDGET = 1024;
 const THINKING_OUTPUT_RESERVE = 1024;
@@ -392,10 +470,6 @@ function clampThinkingBudgetTokens(value, maxTokens) {
     return Math.max(MIN_THINKING_BUDGET, Math.min(desired, ceiling));
 }
 
-// Tracks which unknown effort labels we've already logged so a repeated
-// session-level misconfig doesn't flood stderr with the same warning.
-const _LOGGED_UNKNOWN_EFFORT = new Set();
-
 // Layered cache TTLs — stable layers get 1h, volatile layers get 5m.
 // Anthropic requires 1h entries to appear before 5m entries in the request.
 const CACHE_TTL_STABLE = { type: 'ephemeral', ttl: '1h' };   // tools, system, tier3, messages
@@ -938,10 +1012,23 @@ function _anthropicSseError(event) {
     return err;
 }
 
-async function parseSSEStream(response, signal, abortStream, onStreamDelta, onToolCall, state, onTextDelta) {
+async function parseSSEStream(response, signal, abortStream, onStreamDelta, onToolCall, state, onTextDelta, knownToolNames) {
     const reader = response.body.getReader();
     const decoder = new TextDecoder();
-    const SSE_IDLE_TIMEOUT_MS = PROVIDER_SSE_IDLE_TIMEOUT_MS;
+    // SEMANTIC idle window: reset only by real model events (message/content/
+    // tool deltas), NOT by raw keepalive bytes. A ping-only wedge therefore
+    // trips this within the window instead of hanging until the 30-min agent
+    // watchdog. See resetIdleTimer + the per-event reset in the loop below.
+    // state.semanticIdleTimeoutMs is a test/override seam (same shape as
+    // firstMessageTimeoutMs); production uses the shared env-backed default.
+    const SSE_IDLE_TIMEOUT_MS = Number.isFinite(Number(state?.semanticIdleTimeoutMs))
+        && Number(state.semanticIdleTimeoutMs) > 0
+        ? Number(state.semanticIdleTimeoutMs)
+        : PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS;
+    const SSE_FIRST_MESSAGE_TIMEOUT_MS = Number.isFinite(Number(state?.firstMessageTimeoutMs))
+        && Number(state.firstMessageTimeoutMs) > 0
+        ? Number(state.firstMessageTimeoutMs)
+        : PROVIDER_FIRST_BYTE_TIMEOUT_MS;
     let content = '';
     let hasThinkingContent = false;
     const contentBlockTypes = new Set();
@@ -951,16 +1038,136 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
     let stopReason = null;
     let buffer = '';
     let idleTimedOut = false;
+    let firstMessageTimedOut = false;
     let idleTimer = null;
+    let firstMessageTimer = null;
     let currentEvent = '';
 
     const pendingToolInputs = new Map();
 
+    // Leaked tool-call guard. The model (esp. Opus via OAuth) occasionally
+    // emits a tool call as plain text tags inside `text_delta` instead of a
+    // native `tool_use` block. `leakBuffer` is a minimal rolling window that
+    // only holds back text when a partial sentinel prefix is present, so a
+    // tag split across chunk boundaries is still detected while ordinary text
+    // still streams promptly. The guard is additive: the native tool_use path
+    // (content_block_start/input_json_delta/content_block_stop) is untouched.
+    const _knownTools = knownToolNames instanceof Set
+        ? knownToolNames
+        : new Set(Array.isArray(knownToolNames) ? knownToolNames : []);
+    const _leakGuardEnabled = _knownTools.size > 0;
+    const _isKnownTool = (name) => _knownTools.has(name);
+    let leakBuffer = '';
+    // Running markdown fence/inline-code state threaded across text_delta
+    // chunks (Fix 1): a tool-call tag inside a ```code fence``` or inline span
+    // is a doc example, not a real call — the guard emits it as text.
+    let leakFenceState = undefined;
+    // Cross-path fingerprint dedupe (Fix 2): a synthesized text-leaked call and
+    // an identical native tool_use block must dispatch onToolCall exactly once.
+    const _toolDedupe = createToolCallDedupe();
+
+    // Synthesize + dispatch a recovered leaked call exactly like the native
+    // content_block_stop path (push into toolCalls, flag state, eager
+    // onToolCall). A generated id mirrors the `toolu_`-prefixed native shape.
+    const dispatchLeakedCall = (recovered) => {
+        let args = recovered?.arguments;
+        if (args === null || typeof args !== 'object' || Array.isArray(args)) args = {};
+        // Skip if an identical native (or prior synthetic) call already fired.
+        if (!_toolDedupe.shouldDispatch(recovered.name, args)) return;
+        const call = {
+            id: `toolu_leaked_${randomBytes(8).toString('hex')}`,
+            name: recovered.name,
+            arguments: args,
+        };
+        toolCalls.push(call);
+        if (state) state.emittedToolCall = true;
+        try { onToolCall?.(call); } catch {}
+        try { onStreamDelta?.(); } catch {}
+    };
+
+    // Feed accumulated text through the scanner. On `final` nothing is held
+    // back so legitimate text is never lost at stream end.
+    const pumpLeakBuffer = (final) => {
+        if (!_leakGuardEnabled) return;
+        if (!leakBuffer && !final) return;
+        const { emit, calls, rest, fenceState } = scanLeakedToolCalls(leakBuffer, { isKnownTool: _isKnownTool, final, fenceState: leakFenceState });
+        leakBuffer = rest;
+        leakFenceState = fenceState;
+        if (emit) {
+            content += emit;
+            if (onTextDelta) {
+                if (state) state.emittedText = true;
+                try { onTextDelta(emit); } catch {}
+            }
+        }
+        for (const c of calls) dispatchLeakedCall(c);
+    };
+
     // Holds the in-flight reader.read() race rejector so the idle timer can
     // force-unblock the loop even when reader.cancel() fails to settle the
     // pending read (undici half-open socket). See resetIdleTimer below.
     let idleReject = null;
 
+    const firstMessageTimeoutError = () => {
+        const err = new Error(`Anthropic OAuth SSE stream produced no message_start within ${SSE_FIRST_MESSAGE_TIMEOUT_MS}ms`);
+        err.code = 'EEMPTYSTREAM';
+        err.isEmptyStream = true;
+        err.firstByteTimeout = true;
+        return err;
+    };
+
+    const clearFirstMessageTimer = () => {
+        if (firstMessageTimer) {
+            clearTimeout(firstMessageTimer);
+            firstMessageTimer = null;
+        }
+    };
+
+    const armFirstMessageTimer = () => {
+        if (!(SSE_FIRST_MESSAGE_TIMEOUT_MS > 0)) return;
+        clearFirstMessageTimer();
+        firstMessageTimer = setTimeout(() => {
+            if (state?.sawMessageStart) return;
+            firstMessageTimedOut = true;
+            const err = firstMessageTimeoutError();
+            try { abortStream?.(err); } catch (abortErr) {
+                try { process.stderr.write(`[anthropic-oauth] sse first-message abortStream failed: ${abortErr?.message ?? String(abortErr)}\n`); } catch {}
+            }
+            try {
+                const _c = reader.cancel('SSE first message timeout');
+                if (_c && typeof _c.catch === 'function') _c.catch(() => {});
+            } catch (cancelErr) {
+                try { process.stderr.write(`[anthropic-oauth] sse first-message cancel failed: ${cancelErr?.message ?? String(cancelErr)}\n`); } catch {}
+            }
+            if (idleReject) {
+                const r = idleReject; idleReject = null; r(err);
+            }
+        }, SSE_FIRST_MESSAGE_TIMEOUT_MS);
+        try { firstMessageTimer.unref?.(); } catch {}
+    };
+
+    // Attach the partial stream state to a mid-stream stall error so the agent
+    // loop can decide SUCCESS vs FAILURE. The recurring "worker finished but
+    // owner never notified" case is a FINAL no-tool summary stream that wedges
+    // ping-only after the real work (tool calls) already completed in earlier
+    // iterations: there is streamed `content`, no pending tool_use, and no
+    // emitted tool call this iteration. The loop treats that as a successful
+    // partial-final (deliver the summary we have) instead of dropping it. A
+    // stall WITH a pending/emitted tool call stays a hard failure (a tool whose
+    // input never completed must never be reported as done).
+    const _attachStallPartial = (err) => {
+        try {
+            err.partialContent = content;
+            err.partialToolCalls = toolCalls.length ? toolCalls.slice() : undefined;
+            err.pendingToolUse = pendingToolInputs.size > 0;
+            err.partialModel = model || undefined;
+            err.partialUsage = usage;
+            err.partialStopReason = stopReason || undefined;
+            err.partialHasThinking = hasThinkingContent;
+        } catch { /* best-effort enrichment */ }
+        return err;
+    };
+
     const resetIdleTimer = () => {
         // OFF by default. When disabled the
         // idle timer never arms, so the stream is never killed on inactivity;
@@ -983,13 +1190,14 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
             // pending forever and the SSE idle timeout never unblocks the loop —
             // the 391s-hang root cause.
             if (idleReject) {
-                const e = new Error(`Anthropic OAuth SSE stream timed out after ${SSE_IDLE_TIMEOUT_MS}ms of inactivity`);
-                e.code = 'ETIMEDOUT';
+                const e = _attachStallPartial(streamStalledError('Anthropic OAuth SSE', SSE_IDLE_TIMEOUT_MS, { emittedToolCall: !!state?.emittedToolCall }));
                 const r = idleReject; idleReject = null; r(e);
             }
-        // Shared provider policy: short inter-chunk inactivity catches the
-        // sess_9cfd11-class stuck pattern where SSE starts but then goes silent.
+        // Shared provider policy: short SEMANTIC-event inactivity catches the
+        // ping-only wedge where SSE starts, emits some deltas, then goes silent
+        // while `:ping` keepalives keep the transport socket warm.
         }, SSE_IDLE_TIMEOUT_MS);
+        try { idleTimer.unref?.(); } catch {}
     };
 
     const onAbort = () => {
@@ -1009,7 +1217,13 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
     }
 
     try {
-        resetIdleTimer();
+        // Part A / reviewer fix: do NOT arm the SEMANTIC idle timer before the
+        // stream has produced its first event. A slow first response is governed
+        // by armFirstMessageTimer() (first-byte window) alone; arming the
+        // semantic idle here could let it win and mis-abort a legitimately slow
+        // first response as a stall. The semantic idle is first armed at
+        // `message_start` (see below), so it only ever guards MID-stream silence.
+        armFirstMessageTimer();
         streamLoop: while (true) {
             let chunk;
             try {
@@ -1021,9 +1235,10 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
                 });
             } catch (err) {
                 if (idleTimedOut) {
-                    const idleErr = new Error(`Anthropic OAuth SSE stream timed out after ${SSE_IDLE_TIMEOUT_MS}ms of inactivity`);
-                    idleErr.code = 'ETIMEDOUT';
-                    throw idleErr;
+                    throw _attachStallPartial(streamStalledError('Anthropic OAuth SSE', SSE_IDLE_TIMEOUT_MS, { emittedToolCall: !!state?.emittedToolCall }));
+                }
+                if (firstMessageTimedOut) {
+                    throw firstMessageTimeoutError();
                 }
                 if (signal?.aborted) {
                     _captureMidstreamAbort(state, signal.reason);
@@ -1036,21 +1251,25 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
             const { done, value } = chunk;
             if (done) break;
 
-            resetIdleTimer();
             buffer += decoder.decode(value, { stream: true });
             const lines = buffer.split('\n');
             buffer = lines.pop() || '';
 
             for (const line of lines) {
                 if (line.startsWith(':')) {
-                    // SSE comment frame (Anthropic `:ping` keepalive). The HTML Standard SSE
-                    // spec says comments are silently ignored, but we surface them here so
-                    // the agent stall watchdog sees the stream is still alive during Opus
-                    // extended-thinking pauses. No content is emitted — this only refreshes
-                    // the runtime's lastStreamDeltaAt timestamp.
-                    try { onStreamDelta?.(); } catch {}
+                    // SSE comment frame (Anthropic `:ping` keepalive). Keep it
+                    // at transport level only: comments must not refresh the
+                    // agent's semantic progress timestamp, or a ping-only 200
+                    // can look alive forever without message_start/content.
+                    // Crucially it also does NOT reset the SEMANTIC idle timer
+                    // below — a ping-only wedge must trip the idle abort.
                     continue;
                 }
+                // Blank lines are SSE record separators — emitted after EVERY
+                // frame, including `:ping` keepalives — so they are NOT semantic
+                // progress and must not reset the idle timer (else a ping frame's
+                // trailing blank would keep a wedge alive forever).
+                if (line === '') continue;
                 if (line.startsWith('event: ')) {
                     currentEvent = line.slice(7).trim();
                     continue;
@@ -1062,11 +1281,24 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
                 try {
                     const event = JSON.parse(data);
 
+                    // SEMANTIC idle reset (Part A): reset the idle timer ONLY for
+                    // real progress events, NOT for Anthropic keepalives. Anthropic
+                    // sends pings as a NAMED event (`event: ping` /
+                    // `data: {"type":"ping"}`), not just `:` comment frames, so a
+                    // named ping must be excluded here or a ping-only wedge keeps
+                    // the timer alive forever. Everything that is not a ping is a
+                    // genuine server event (message_start/content/tool/thinking
+                    // deltas, message_delta/stop, errors) and counts as progress.
+                    if (currentEvent !== 'ping' && event?.type !== 'ping') {
+                        resetIdleTimer();
+                    }
+
                     if (currentEvent === 'error' || event?.type === 'error' || event?.error) {
                         throw _anthropicSseError(event);
                     }
 
                     if (event.type === 'message_start' && event.message) {
+                        clearFirstMessageTimer();
                         if (state) state.sawMessageStart = true;
                         if (event.message.model) model = event.message.model;
                         if (event.message.usage) {
@@ -1091,8 +1323,13 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
                     if (event.type === 'content_block_delta') {
                         const delta = event.delta;
                         if (delta?.type) contentBlockTypes.add(delta.type);
+                        // Time-to-first-token: stamp the first content delta
+                        // (text / thinking / tool input_json) exactly once so
+                        // the SSE trace can separate first-byte latency from
+                        // total stream/generation time. Without this stamp
+                        // ttftMs was always null and reported as 0ms.
+                        if (state && !state.ttftAt) state.ttftAt = Date.now();
                         if (delta?.type === 'text_delta') {
-                            content += delta.text || '';
                             try { onStreamDelta?.(); } catch {}
                             // Live text relay (gateway): forward the explicit
                             // text chunk. thinking/signature/input_json deltas
@@ -1101,9 +1338,21 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
                             // live it cannot be withdrawn, so flag the attempt so
                             // the mid-stream retry loop treats any later failure
                             // as final (a retry would concatenate attempts).
-                            if (delta.text && onTextDelta) {
-                                if (state) state.emittedText = true;
-                                try { onTextDelta(delta.text); } catch {}
+                            if (_leakGuardEnabled) {
+                                // Route text through the leaked-tool-call guard.
+                                // It appends to `content`, forwards visible text
+                                // via onTextDelta, and synthesizes/dispatches any
+                                // recovered known-tool call — suppressing the
+                                // tags from the visible stream. A partial sentinel
+                                // is held in leakBuffer until the next chunk.
+                                leakBuffer += delta.text || '';
+                                pumpLeakBuffer(false);
+                            } else {
+                                content += delta.text || '';
+                                if (delta.text && onTextDelta) {
+                                    if (state) state.emittedText = true;
+                                    try { onTextDelta(delta.text); } catch {}
+                                }
                             }
                         }
                         if (delta?.type === 'thinking_delta' || delta?.type === 'signature_delta') {
@@ -1159,13 +1408,25 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
                                 name: pending.name,
                                 arguments: parsedArgs,
                             };
-                            toolCalls.push(call);
                             pendingToolInputs.delete(event.index);
-                            if (state) state.emittedToolCall = true;
                             // Eager dispatch: let the loop start this tool
                             // before message_stop arrives. The loop keys
                             // pending promises by call.id so order is safe.
-                            try { onToolCall?.(call); } catch {}
+                            // Fix 2: skip the ENTIRE call (push + dispatch) when a
+                            // text-leaked synthetic of the same (name,args) already
+                            // fired — otherwise the duplicate stays in `toolCalls`
+                            // and the loop executes the side-effecting tool twice.
+                            // An invalid-args marker never fingerprint-collides with
+                            // a real recovered call, so malformed native calls still
+                            // dispatch (the marker path is unaffected).
+                            if (_toolDedupe.shouldDispatch(call.name, call.arguments)) {
+                                toolCalls.push(call);
+                                if (state) state.emittedToolCall = true;
+                                // Eager dispatch: let the loop start this tool
+                                // before message_stop arrives. The loop keys
+                                // pending promises by call.id so order is safe.
+                                try { onToolCall?.(call); } catch {}
+                            }
                             try { onStreamDelta?.(); } catch {}
                         }
                     }
@@ -1206,6 +1467,12 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
             }
         }
 
+        // Stream ended: flush any held-back leaked-tool-call buffer. `final`
+        // holds nothing back, so a trailing partial sentinel that never
+        // resolved into a real call is surfaced as ordinary text — legitimate
+        // user-visible content is never lost on the failure path.
+        pumpLeakBuffer(true);
+
         // Truncated-stream guard: if the reader loop exited (EOF or break)
         // after message_start but without seeing message_stop / a tool_use
         // stop_reason, the assistant turn was cut off mid-flight. Returning
@@ -1242,6 +1509,7 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
         };
     } finally {
         if (idleTimer) clearTimeout(idleTimer);
+        clearFirstMessageTimer();
         if (signal) signal.removeEventListener('abort', onAbort);
         try { reader.releaseLock(); } catch (err) {
             try { process.stderr.write(`[anthropic-oauth] reader releaseLock failed: ${err?.message ?? String(err)}\n`); } catch {}
@@ -1365,21 +1633,13 @@ function buildRequestBody(messages, model, tools, sendOpts) {
         body.tools = [...nativeTools, ...toAnthropicTools([...(tools || []), ...deferredTools])];
     }
 
-    const thinkingBudgetTokens = Number(opts.thinkingBudgetTokens);
-    if (Number.isFinite(thinkingBudgetTokens) && thinkingBudgetTokens > 0) {
-        const budgetTokens = clampThinkingBudgetTokens(thinkingBudgetTokens, maxTokens);
-        if (budgetTokens) body.thinking = { type: 'enabled', budget_tokens: budgetTokens };
-    } else if (opts.effort) {
-        if (EFFORT_BUDGET[opts.effort]) {
-            const budgetTokens = clampThinkingBudgetTokens(EFFORT_BUDGET[opts.effort], maxTokens);
-            if (budgetTokens) body.thinking = { type: 'enabled', budget_tokens: budgetTokens };
-        } else if (!_LOGGED_UNKNOWN_EFFORT.has(opts.effort)) {
-            _LOGGED_UNKNOWN_EFFORT.add(opts.effort);
-            try {
-                process.stderr.write(`[anthropic-oauth] unknown effort=${opts.effort} ignored (known: ${Object.keys(EFFORT_BUDGET).join(',')})\n`);
-            } catch {}
-        }
-    }
+    applyAnthropicEffortToBody(body, {
+        model,
+        opts,
+        maxTokens,
+        clampThinkingBudgetTokens,
+        logTag: 'anthropic-oauth',
+    });
 
     if (opts.fast === true && supportsAnthropicFastMode(model)) {
         body.speed = 'fast';
@@ -1530,6 +1790,15 @@ export class AnthropicOAuthProvider {
         if (body.speed === 'fast') {
             this.fastModeBetaHeaderLatched = true;
         }
+        // Known tool names for the leaked-tool-call guard in parseSSEStream:
+        // recovered leaked calls are only synthesized when they name a tool
+        // actually offered to this request (native + lowered). Derived from the
+        // final request body so it matches exactly what the model was given.
+        const knownToolNames = new Set(
+            (Array.isArray(body.tools) ? body.tools : [])
+                .map((t) => (t && typeof t.name === 'string' ? t.name : null))
+                .filter(Boolean),
+        );
         const sessionId = opts.sessionId || null;
         const iteration = Number.isFinite(Number(opts.iteration)) ? Number(opts.iteration) : null;
         // Option A: no absolute wall-clock cap on streaming generation. A stream
@@ -1598,6 +1867,7 @@ export class AnthropicOAuthProvider {
                             base: OAUTH_BETA_HEADERS,
                             fastMode: this.fastModeBetaHeaderLatched,
                             toolSearch: true,
+                            effort: shouldIncludeEffortBeta(useModel, opts),
                         }),
                         'anthropic-dangerous-direct-browser-access': 'true',
                         'user-agent': `claude-cli/${resolveCliVersion()} (external, sdk-cli)`,
@@ -1758,11 +2028,12 @@ export class AnthropicOAuthProvider {
                 const result = await parseSSEFn(
                     response,
                     controller.signal,
-                    () => controller.abort(),
+                    (reason) => controller.abort(reason),
                     onStreamDelta,
                     onToolCall,
                     midState,
                     onTextDelta,
+                    knownToolNames,
                 );
 
                 const ttftMs = midState.ttftAt ? midState.ttftAt - sseStartedAt : null;
@@ -2214,3 +2485,7 @@ export async function loginOAuth() {
 // Lets the SSE parser be exercised in isolation against a synthetic
 // ReadableStream without needing a live OAuth session.
 export { parseSSEStream };
+
+// Test-only escape hatch for scripts/tool-smoke.mjs to verify the
+// catalog-driven max-tokens resolution without duplicating its logic.
+export const _test = { resolveMaxTokens };