mixdog 0.9.1 → 0.9.3

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -19,13 +19,16 @@ import { writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
 import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
 import { enrichModels } from './model-catalog.mjs';
 import { makeModelCache } from './model-cache.mjs';
+import { resolveAnthropicMaxTokens } from './anthropic-max-tokens.mjs';
 import { sanitizeToolPairs, sanitizeAnthropicContentPairs } from '../session/context-utils.mjs';
 import {
+    PROVIDER_FIRST_BYTE_TIMEOUT_MS,
     PROVIDER_HTTP_RESPONSE_TIMEOUT_MS,
     PROVIDER_RETRY_BACKOFF_MS,
     PROVIDER_RETRY_MAX_ATTEMPTS,
-    PROVIDER_SSE_IDLE_TIMEOUT_MS,
     PROVIDER_SSE_IDLE_WATCHDOG_ENABLED,
+    PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS,
+    streamStalledError,
     createPassthroughSignal,
 } from '../stall-policy.mjs';
 import {
@@ -38,14 +41,23 @@ import {
     withRetry,
 } from './retry-classifier.mjs';
 import { buildAnthropicBetaHeaders, supportsAnthropicFastMode } from './anthropic-betas.mjs';
+import {
+    applyAnthropicEffortToBody,
+    effortValuesForModel,
+    shouldIncludeEffortBeta,
+} from './anthropic-effort.mjs';
 import { getLlmDispatcher, preconnect } from '../../../shared/llm/http-agent.mjs';
 import { normalizeContentForAnthropic } from './media-normalization.mjs';
 import { makeInvalidToolArgsMarker } from './openai-compat-stream.mjs';
+import { scanLeakedToolCalls, createToolCallDedupe } from './anthropic-leaked-toolcall.mjs';
 
 // --- Model catalog cache helpers ---
 // Disk-backed cache so repeated process starts (cron, tool calls) don't
 // hammer /v1/models. 24h TTL matches the upstream client cadence.
 const MODEL_CACHE_TTL_MS = 24 * 60 * 60_000;
+// Bump when the on-disk cache shape changes so stale-shape entries are
+// discarded instead of misread.
+const ANTHROPIC_MODEL_CACHE_SCHEMA_VERSION = 1;
 // SSE progress emits (per-request "Response …" and "Done:" lines). Off by default.
 const SSE_VERBOSE = process.env.MIXDOG_SSE_VERBOSE === '1';
 
@@ -64,6 +76,7 @@ const SSE_MIDSTREAM_POLICY = {
 };
 
 function formatRetryAfter(ms) {
+    if (ms == null) return '';
     const n = Number(ms);
     if (!Number.isFinite(n) || n < 0) return '';
     if (n >= 60_000 && n % 60_000 === 0) return `${Math.round(n / 60_000)}m`;
@@ -93,6 +106,7 @@ function anthropicQuotaError(status, headers, bodyText = '') {
 const _modelCache = makeModelCache({
     fileName: 'anthropic-oauth-models.json',
     ttlMs: MODEL_CACHE_TTL_MS,
+    version: ANTHROPIC_MODEL_CACHE_SCHEMA_VERSION,
     onSave: (m) => { _inMemoryCatalog = Array.isArray(m) ? m.slice() : null; },
 });
 
@@ -134,6 +148,10 @@ function _displayModel(id) {
     return `claude-${m[1].toLowerCase()}-${m[2]}${m[3] ? `.${m[3]}` : ''}`;
 }
 
+function _capabilitySupported(capability) {
+    return capability === true || capability?.supported === true;
+}
+
 // Classify a model id into our common tier/family shape. Anthropic's catalog
 // mixes dated ids (claude-opus-4-5-20251101), versioned aliases
 // (claude-opus-4-6), and the raw family tokens resolved via env vars.
@@ -150,15 +168,19 @@ function _normalizeAnthropicModel(raw) {
     const releaseDate = dated
         ? id.match(/-(\d{4})(\d{2})(\d{2})$/)
         : null;
+    const effortValues = effortValuesForModel(raw?.capabilities, id);
     return {
         id,
         display: raw?.display_name || _prettyName(id, family),
         family,
         provider: 'anthropic-oauth',
-        contextWindow: raw?.context_window || raw?.max_context_window || _defaultContextForModel(id, family),
+        contextWindow: raw?.context_window || raw?.max_context_window || raw?.max_input_tokens || _defaultContextForModel(id, family),
+        outputTokens: raw?.max_tokens || raw?.max_output_tokens || null,
         tier,
         latest: false, // assigned in a second pass once full list is known
         releaseDate: releaseDate ? `${releaseDate[1]}-${releaseDate[2]}-${releaseDate[3]}` : null,
+        supportsReasoning: effortValues.length > 0 || _capabilitySupported(raw?.capabilities?.thinking),
+        reasoningOptions: effortValues.length ? [{ type: 'effort', values: effortValues }] : [],
     };
 }
 
@@ -201,8 +223,7 @@ function _compareVersion(a, b) {
 }
 
 // Newest HIGH-TIER chat model by version, read from the SYNC in-memory catalog
-// mirror. Symmetric with resolveLatestGrokModel / resolveLatestCodexModel.
-// Anthropic ships three families: opus / sonnet / haiku. "Latest" is the
+// mirror. Anthropic ships three families: opus / sonnet / haiku. "Latest" is the
 // highest version across opus + sonnet only — haiku is the cheap tier and is
 // never the flagship default. Returns null until listModels() populates the
 // mirror; callers must warm the catalog (ensureLatestAnthropicModel) when null.
@@ -284,12 +305,11 @@ const OAUTH_SUCCESS_REDIRECT_URL = process.env.ANTHROPIC_OAUTH_SUCCESS_REDIRECT_
 const OAUTH_LOGIN_TIMEOUT_MS = 5 * 60_000;
 const OAUTH_TOKEN_TIMEOUT_MS = 30_000;
 
-// Anthropic OAuth contract for first-party OAuth clients.
-// Opus/Sonnet requests are gated on a specific system-prompt prefix.
-// Mixdog keeps that upstream client contract for OAuth routing. Haiku is not
+// Anthropic OAuth contract for first-party OAuth clients: Opus/Sonnet
+// requests are gated on this exact system-prompt prefix. Haiku is not
 // gated and ignores this prefix.
 const CLAUDE_CODE_SYSTEM_PREFIX = "You are Claude Code, Anthropic's official CLI for Claude.";
-const OAUTH_BETA_HEADERS = 'oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27,extended-cache-ttl-2025-04-11,advanced-tool-use-2025-11-20';
+const OAUTH_BETA_HEADERS = 'oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27,extended-cache-ttl-2025-04-11';
 const DEFAULT_CLI_VERSION = '2.1.77';
 
 function resolveCliVersion() {
@@ -298,9 +318,11 @@ function resolveCliVersion() {
 }
 
 function requiresSystemPrefix(model) {
-    // Opus / Sonnet require the OAuth system prefix when authenticated
-    // via OAuth. Haiku does not.
-    return /^claude-(opus|sonnet)/i.test(String(model || ''));
+    // High-tier Claude OAuth models require the first-party system prefix for
+    // OAuth pool routing. Haiku does not; keep every other Claude family (Opus,
+    // Sonnet, Fable, and future non-Haiku families) on the prefixed path.
+    const id = String(model || '').toLowerCase();
+    return /^claude-/.test(id) && !/^claude-haiku(?:-|$)/.test(id);
 }
 
 // OAuth rate-limit pool routing is gated by the server inspecting the first
@@ -351,35 +373,39 @@ function buildSystemBlocks(systemMsgs, model, systemTtl, tier3Ttl) {
     return blocks;
 }
 
-// Per-model max_tokens when the model id is explicitly listed. New models
-// (e.g., Sonnet 4.7) won't match a specific entry and fall through to the
-// family-based heuristic below. Conservative defaults — model may support
-// more but we'd rather stay within safe bounds.
-const MAX_TOKENS = {
-    'claude-opus-4-8': 65536,
-    'claude-opus-4-7': 65536,
-    'claude-opus-4-6': 65536,
-    'claude-sonnet-4-6': 16384,
-    'claude-haiku-4-5-20251001': 8192,
-};
+// Catalog-reported outputTokens for a model id, read from the in-memory
+// catalog mirror (lazily populated from the disk cache if the mirror hasn't
+// been warmed yet by listModels()). Never throws — any failure just means
+// "no catalog data", and callers fall back to the static heuristics below.
+function _catalogOutputTokens(model) {
+    if (!model) return null;
+    try {
+        if (!Array.isArray(_inMemoryCatalog)) {
+            const cached = _modelCache.loadSync();
+            if (Array.isArray(cached)) _inMemoryCatalog = cached.slice();
+        }
+        if (!Array.isArray(_inMemoryCatalog)) return null;
+        const entry = _inMemoryCatalog.find(m => m?.id === model);
+        const out = Number(entry?.outputTokens);
+        return Number.isFinite(out) && out > 0 ? out : null;
+    } catch {
+        return null;
+    }
+}
 
+// resolveMaxTokens: catalog-driven max_tokens for a model id. Thin wrapper
+// around the shared anthropic-max-tokens helper (also used by the API-key
+// twin in anthropic.mjs) — this provider supplies its own in-memory-mirror-
+// first catalog lookup strategy.
+//   1. MIXDOG_ANTHROPIC_MAX_OUTPUT_TOKENS env override, if set, wins outright.
+//   2. Catalog outputTokens (trusted over hardcoded heuristics when present),
+//      clamped to [MAX_TOKENS_FLOOR, safetyCap].
+//   3. Static MAX_TOKENS table / family heuristic fallback when the catalog
+//      has no entry for this model, also clamped to the safety cap.
 function resolveMaxTokens(model) {
-    if (MAX_TOKENS[model]) return MAX_TOKENS[model];
-    const id = String(model || '').toLowerCase();
-    if (id.includes('opus')) return 65536;
-    if (id.includes('sonnet')) return 16384;
-    if (id.includes('haiku')) return 8192;
-    return 8192;
+    return resolveAnthropicMaxTokens(model, { catalogLookup: _catalogOutputTokens });
 }
 
-const EFFORT_BUDGET = {
-    low: 1024,
-    medium: 4096,
-    high: 16384,
-    xhigh: 32768,
-    max: 32768,
-};
-
 const MIN_THINKING_BUDGET = 1024;
 const THINKING_OUTPUT_RESERVE = 1024;
 
@@ -392,10 +418,6 @@ function clampThinkingBudgetTokens(value, maxTokens) {
     return Math.max(MIN_THINKING_BUDGET, Math.min(desired, ceiling));
 }
 
-// Tracks which unknown effort labels we've already logged so a repeated
-// session-level misconfig doesn't flood stderr with the same warning.
-const _LOGGED_UNKNOWN_EFFORT = new Set();
-
 // Layered cache TTLs — stable layers get 1h, volatile layers get 5m.
 // Anthropic requires 1h entries to appear before 5m entries in the request.
 const CACHE_TTL_STABLE = { type: 'ephemeral', ttl: '1h' };   // tools, system, tier3, messages
@@ -418,8 +440,8 @@ function credentialCandidates() {
 // Fallback expiry from the access_token's JWT `exp` claim (epoch ms) when the
 // credentials file carries no explicit expiresAt — without it expiresAt stays 0,
 // which ensureAuth reads as "never expires", disabling proactive refresh. Claude
-// OAuth tokens are opaque so this returns 0 and the file's expiresAt governs; kept
-// for parity with the other OAuth providers. JWT `exp` is epoch SECONDS (RFC 7519).
+// OAuth tokens are opaque so this returns 0 and the file's expiresAt governs.
+// JWT `exp` is epoch SECONDS (RFC 7519).
 function _expiryFromAccessToken(token) {
     try {
         const parts = String(token || '').split('.');
@@ -644,7 +666,7 @@ export class ReauthRequired extends Error {
     }
 }
 
-// --- Message conversion (mirrors anthropic.mjs) ---
+// --- Message conversion ---
 
 function withCacheControl(block, ttl = CACHE_TTL_VOLATILE) {
     if (!block || typeof block !== 'object' || block.cache_control) return block;
@@ -938,10 +960,23 @@ function _anthropicSseError(event) {
     return err;
 }
 
-async function parseSSEStream(response, signal, abortStream, onStreamDelta, onToolCall, state, onTextDelta) {
+async function parseSSEStream(response, signal, abortStream, onStreamDelta, onToolCall, state, onTextDelta, knownToolNames) {
     const reader = response.body.getReader();
     const decoder = new TextDecoder();
-    const SSE_IDLE_TIMEOUT_MS = PROVIDER_SSE_IDLE_TIMEOUT_MS;
+    // SEMANTIC idle window: reset only by real model events (message/content/
+    // tool deltas), NOT by raw keepalive bytes. A ping-only wedge therefore
+    // trips this within the window instead of hanging until the 30-min agent
+    // watchdog. See resetIdleTimer + the per-event reset in the loop below.
+    // state.semanticIdleTimeoutMs is a test/override seam (same shape as
+    // firstMessageTimeoutMs); production uses the shared env-backed default.
+    const SSE_IDLE_TIMEOUT_MS = Number.isFinite(Number(state?.semanticIdleTimeoutMs))
+        && Number(state.semanticIdleTimeoutMs) > 0
+        ? Number(state.semanticIdleTimeoutMs)
+        : PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS;
+    const SSE_FIRST_MESSAGE_TIMEOUT_MS = Number.isFinite(Number(state?.firstMessageTimeoutMs))
+        && Number(state.firstMessageTimeoutMs) > 0
+        ? Number(state.firstMessageTimeoutMs)
+        : PROVIDER_FIRST_BYTE_TIMEOUT_MS;
     let content = '';
     let hasThinkingContent = false;
     const contentBlockTypes = new Set();
@@ -951,16 +986,137 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
     let stopReason = null;
     let buffer = '';
     let idleTimedOut = false;
+    let firstMessageTimedOut = false;
     let idleTimer = null;
+    let firstMessageTimer = null;
     let currentEvent = '';
 
     const pendingToolInputs = new Map();
 
+    // Leaked tool-call guard. The model (esp. Opus via OAuth) occasionally
+    // emits a tool call as plain text tags inside `text_delta` instead of a
+    // native `tool_use` block. `leakBuffer` is a minimal rolling window that
+    // only holds back text when a partial sentinel prefix is present, so a
+    // tag split across chunk boundaries is still detected while ordinary text
+    // still streams promptly. The guard is additive: the native tool_use path
+    // (content_block_start/input_json_delta/content_block_stop) is untouched.
+    const _knownTools = knownToolNames instanceof Set
+        ? knownToolNames
+        : new Set(Array.isArray(knownToolNames) ? knownToolNames : []);
+    const _leakGuardEnabled = _knownTools.size > 0;
+    const _isKnownTool = (name) => _knownTools.has(name);
+    let leakBuffer = '';
+    // Running markdown fence/inline-code state threaded across text_delta
+    // chunks (Fix 1): a tool-call tag inside a ```code fence``` or inline span
+    // is a doc example, not a real call — the guard emits it as text.
+    let leakFenceState = undefined;
+    // Cross-path fingerprint dedupe (Fix 2): a synthesized text-leaked call and
+    // an identical native tool_use block must dispatch onToolCall exactly once.
+    const _toolDedupe = createToolCallDedupe();
+
+    // Synthesize + dispatch a recovered leaked call exactly like the native
+    // content_block_stop path (push into toolCalls, flag state, eager
+    // onToolCall). A generated id uses the same `toolu_`-prefixed shape as
+    // Anthropic's native tool-call ids.
+    const dispatchLeakedCall = (recovered) => {
+        let args = recovered?.arguments;
+        if (args === null || typeof args !== 'object' || Array.isArray(args)) args = {};
+        // Skip if an identical native (or prior synthetic) call already fired.
+        if (!_toolDedupe.shouldDispatch(recovered.name, args)) return;
+        const call = {
+            id: `toolu_leaked_${randomBytes(8).toString('hex')}`,
+            name: recovered.name,
+            arguments: args,
+        };
+        toolCalls.push(call);
+        if (state) state.emittedToolCall = true;
+        try { onToolCall?.(call); } catch {}
+        try { onStreamDelta?.(); } catch {}
+    };
+
+    // Feed accumulated text through the scanner. On `final` nothing is held
+    // back so legitimate text is never lost at stream end.
+    const pumpLeakBuffer = (final) => {
+        if (!_leakGuardEnabled) return;
+        if (!leakBuffer && !final) return;
+        const { emit, calls, rest, fenceState } = scanLeakedToolCalls(leakBuffer, { isKnownTool: _isKnownTool, final, fenceState: leakFenceState });
+        leakBuffer = rest;
+        leakFenceState = fenceState;
+        if (emit) {
+            content += emit;
+            if (onTextDelta) {
+                if (state) state.emittedText = true;
+                try { onTextDelta(emit); } catch {}
+            }
+        }
+        for (const c of calls) dispatchLeakedCall(c);
+    };
+
     // Holds the in-flight reader.read() race rejector so the idle timer can
     // force-unblock the loop even when reader.cancel() fails to settle the
     // pending read (undici half-open socket). See resetIdleTimer below.
     let idleReject = null;
 
+    const firstMessageTimeoutError = () => {
+        const err = new Error(`Anthropic OAuth SSE stream produced no message_start within ${SSE_FIRST_MESSAGE_TIMEOUT_MS}ms`);
+        err.code = 'EEMPTYSTREAM';
+        err.isEmptyStream = true;
+        err.firstByteTimeout = true;
+        return err;
+    };
+
+    const clearFirstMessageTimer = () => {
+        if (firstMessageTimer) {
+            clearTimeout(firstMessageTimer);
+            firstMessageTimer = null;
+        }
+    };
+
+    const armFirstMessageTimer = () => {
+        if (!(SSE_FIRST_MESSAGE_TIMEOUT_MS > 0)) return;
+        clearFirstMessageTimer();
+        firstMessageTimer = setTimeout(() => {
+            if (state?.sawMessageStart) return;
+            firstMessageTimedOut = true;
+            const err = firstMessageTimeoutError();
+            try { abortStream?.(err); } catch (abortErr) {
+                try { process.stderr.write(`[anthropic-oauth] sse first-message abortStream failed: ${abortErr?.message ?? String(abortErr)}\n`); } catch {}
+            }
+            try {
+                const _c = reader.cancel('SSE first message timeout');
+                if (_c && typeof _c.catch === 'function') _c.catch(() => {});
+            } catch (cancelErr) {
+                try { process.stderr.write(`[anthropic-oauth] sse first-message cancel failed: ${cancelErr?.message ?? String(cancelErr)}\n`); } catch {}
+            }
+            if (idleReject) {
+                const r = idleReject; idleReject = null; r(err);
+            }
+        }, SSE_FIRST_MESSAGE_TIMEOUT_MS);
+        try { firstMessageTimer.unref?.(); } catch {}
+    };
+
+    // Attach the partial stream state to a mid-stream stall error so the agent
+    // loop can decide SUCCESS vs FAILURE. The recurring "worker finished but
+    // owner never notified" case is a FINAL no-tool summary stream that wedges
+    // ping-only after the real work (tool calls) already completed in earlier
+    // iterations: there is streamed `content`, no pending tool_use, and no
+    // emitted tool call this iteration. The loop treats that as a successful
+    // partial-final (deliver the summary we have) instead of dropping it. A
+    // stall WITH a pending/emitted tool call stays a hard failure (a tool whose
+    // input never completed must never be reported as done).
+    const _attachStallPartial = (err) => {
+        try {
+            err.partialContent = content;
+            err.partialToolCalls = toolCalls.length ? toolCalls.slice() : undefined;
+            err.pendingToolUse = pendingToolInputs.size > 0;
+            err.partialModel = model || undefined;
+            err.partialUsage = usage;
+            err.partialStopReason = stopReason || undefined;
+            err.partialHasThinking = hasThinkingContent;
+        } catch { /* best-effort enrichment */ }
+        return err;
+    };
+
     const resetIdleTimer = () => {
         // OFF by default. When disabled the
         // idle timer never arms, so the stream is never killed on inactivity;
@@ -983,13 +1139,14 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
             // pending forever and the SSE idle timeout never unblocks the loop —
             // the 391s-hang root cause.
             if (idleReject) {
-                const e = new Error(`Anthropic OAuth SSE stream timed out after ${SSE_IDLE_TIMEOUT_MS}ms of inactivity`);
-                e.code = 'ETIMEDOUT';
+                const e = _attachStallPartial(streamStalledError('Anthropic OAuth SSE', SSE_IDLE_TIMEOUT_MS, { emittedToolCall: !!state?.emittedToolCall }));
                 const r = idleReject; idleReject = null; r(e);
             }
-        // Shared provider policy: short inter-chunk inactivity catches the
-        // sess_9cfd11-class stuck pattern where SSE starts but then goes silent.
+        // Shared provider policy: short SEMANTIC-event inactivity catches the
+        // ping-only wedge where SSE starts, emits some deltas, then goes silent
+        // while `:ping` keepalives keep the transport socket warm.
         }, SSE_IDLE_TIMEOUT_MS);
+        try { idleTimer.unref?.(); } catch {}
     };
 
     const onAbort = () => {
@@ -1009,7 +1166,13 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
     }
 
     try {
-        resetIdleTimer();
+        // Part A / reviewer fix: do NOT arm the SEMANTIC idle timer before the
+        // stream has produced its first event. A slow first response is governed
+        // by armFirstMessageTimer() (first-byte window) alone; arming the
+        // semantic idle here could let it win and mis-abort a legitimately slow
+        // first response as a stall. The semantic idle is first armed at
+        // `message_start` (see below), so it only ever guards MID-stream silence.
+        armFirstMessageTimer();
         streamLoop: while (true) {
             let chunk;
             try {
@@ -1021,9 +1184,10 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
                 });
             } catch (err) {
                 if (idleTimedOut) {
-                    const idleErr = new Error(`Anthropic OAuth SSE stream timed out after ${SSE_IDLE_TIMEOUT_MS}ms of inactivity`);
-                    idleErr.code = 'ETIMEDOUT';
-                    throw idleErr;
+                    throw _attachStallPartial(streamStalledError('Anthropic OAuth SSE', SSE_IDLE_TIMEOUT_MS, { emittedToolCall: !!state?.emittedToolCall }));
+                }
+                if (firstMessageTimedOut) {
+                    throw firstMessageTimeoutError();
                 }
                 if (signal?.aborted) {
                     _captureMidstreamAbort(state, signal.reason);
@@ -1036,21 +1200,25 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
             const { done, value } = chunk;
             if (done) break;
 
-            resetIdleTimer();
             buffer += decoder.decode(value, { stream: true });
             const lines = buffer.split('\n');
             buffer = lines.pop() || '';
 
             for (const line of lines) {
                 if (line.startsWith(':')) {
-                    // SSE comment frame (Anthropic `:ping` keepalive). The HTML Standard SSE
-                    // spec says comments are silently ignored, but we surface them here so
-                    // the agent stall watchdog sees the stream is still alive during Opus
-                    // extended-thinking pauses. No content is emitted — this only refreshes
-                    // the runtime's lastStreamDeltaAt timestamp.
-                    try { onStreamDelta?.(); } catch {}
+                    // SSE comment frame (Anthropic `:ping` keepalive). Keep it
+                    // at transport level only: comments must not refresh the
+                    // agent's semantic progress timestamp, or a ping-only 200
+                    // can look alive forever without message_start/content.
+                    // Crucially it also does NOT reset the SEMANTIC idle timer
+                    // below — a ping-only wedge must trip the idle abort.
                     continue;
                 }
+                // Blank lines are SSE record separators — emitted after EVERY
+                // frame, including `:ping` keepalives — so they are NOT semantic
+                // progress and must not reset the idle timer (else a ping frame's
+                // trailing blank would keep a wedge alive forever).
+                if (line === '') continue;
                 if (line.startsWith('event: ')) {
                     currentEvent = line.slice(7).trim();
                     continue;
@@ -1062,11 +1230,24 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
                 try {
                     const event = JSON.parse(data);
 
+                    // SEMANTIC idle reset (Part A): reset the idle timer ONLY for
+                    // real progress events, NOT for Anthropic keepalives. Anthropic
+                    // sends pings as a NAMED event (`event: ping` /
+                    // `data: {"type":"ping"}`), not just `:` comment frames, so a
+                    // named ping must be excluded here or a ping-only wedge keeps
+                    // the timer alive forever. Everything that is not a ping is a
+                    // genuine server event (message_start/content/tool/thinking
+                    // deltas, message_delta/stop, errors) and counts as progress.
+                    if (currentEvent !== 'ping' && event?.type !== 'ping') {
+                        resetIdleTimer();
+                    }
+
                     if (currentEvent === 'error' || event?.type === 'error' || event?.error) {
                         throw _anthropicSseError(event);
                     }
 
                     if (event.type === 'message_start' && event.message) {
+                        clearFirstMessageTimer();
                         if (state) state.sawMessageStart = true;
                         if (event.message.model) model = event.message.model;
                         if (event.message.usage) {
@@ -1091,8 +1272,13 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
                     if (event.type === 'content_block_delta') {
                         const delta = event.delta;
                         if (delta?.type) contentBlockTypes.add(delta.type);
+                        // Time-to-first-token: stamp the first content delta
+                        // (text / thinking / tool input_json) exactly once so
+                        // the SSE trace can separate first-byte latency from
+                        // total stream/generation time. Without this stamp
+                        // ttftMs was always null and reported as 0ms.
+                        if (state && !state.ttftAt) state.ttftAt = Date.now();
                         if (delta?.type === 'text_delta') {
-                            content += delta.text || '';
                             try { onStreamDelta?.(); } catch {}
                             // Live text relay (gateway): forward the explicit
                             // text chunk. thinking/signature/input_json deltas
@@ -1101,9 +1287,21 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
                             // live it cannot be withdrawn, so flag the attempt so
                             // the mid-stream retry loop treats any later failure
                             // as final (a retry would concatenate attempts).
-                            if (delta.text && onTextDelta) {
-                                if (state) state.emittedText = true;
-                                try { onTextDelta(delta.text); } catch {}
+                            if (_leakGuardEnabled) {
+                                // Route text through the leaked-tool-call guard.
+                                // It appends to `content`, forwards visible text
+                                // via onTextDelta, and synthesizes/dispatches any
+                                // recovered known-tool call — suppressing the
+                                // tags from the visible stream. A partial sentinel
+                                // is held in leakBuffer until the next chunk.
+                                leakBuffer += delta.text || '';
+                                pumpLeakBuffer(false);
+                            } else {
+                                content += delta.text || '';
+                                if (delta.text && onTextDelta) {
+                                    if (state) state.emittedText = true;
+                                    try { onTextDelta(delta.text); } catch {}
+                                }
                             }
                         }
                         if (delta?.type === 'thinking_delta' || delta?.type === 'signature_delta') {
@@ -1159,13 +1357,25 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
                                 name: pending.name,
                                 arguments: parsedArgs,
                             };
-                            toolCalls.push(call);
                             pendingToolInputs.delete(event.index);
-                            if (state) state.emittedToolCall = true;
                             // Eager dispatch: let the loop start this tool
                             // before message_stop arrives. The loop keys
                             // pending promises by call.id so order is safe.
-                            try { onToolCall?.(call); } catch {}
+                            // Fix 2: skip the ENTIRE call (push + dispatch) when a
+                            // text-leaked synthetic of the same (name,args) already
+                            // fired — otherwise the duplicate stays in `toolCalls`
+                            // and the loop executes the side-effecting tool twice.
+                            // An invalid-args marker never fingerprint-collides with
+                            // a real recovered call, so malformed native calls still
+                            // dispatch (the marker path is unaffected).
+                            if (_toolDedupe.shouldDispatch(call.name, call.arguments)) {
+                                toolCalls.push(call);
+                                if (state) state.emittedToolCall = true;
+                                // Eager dispatch: let the loop start this tool
+                                // before message_stop arrives. The loop keys
+                                // pending promises by call.id so order is safe.
+                                try { onToolCall?.(call); } catch {}
+                            }
                             try { onStreamDelta?.(); } catch {}
                         }
                     }
@@ -1206,6 +1416,12 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
             }
         }
 
+        // Stream ended: flush any held-back leaked-tool-call buffer. `final`
+        // holds nothing back, so a trailing partial sentinel that never
+        // resolved into a real call is surfaced as ordinary text — legitimate
+        // user-visible content is never lost on the failure path.
+        pumpLeakBuffer(true);
+
         // Truncated-stream guard: if the reader loop exited (EOF or break)
         // after message_start but without seeing message_stop / a tool_use
         // stop_reason, the assistant turn was cut off mid-flight. Returning
@@ -1242,6 +1458,7 @@ async function parseSSEStream(response, signal, abortStream, onStreamDelta, onTo
         };
     } finally {
         if (idleTimer) clearTimeout(idleTimer);
+        clearFirstMessageTimer();
         if (signal) signal.removeEventListener('abort', onAbort);
         try { reader.releaseLock(); } catch (err) {
             try { process.stderr.write(`[anthropic-oauth] reader releaseLock failed: ${err?.message ?? String(err)}\n`); } catch {}
@@ -1365,21 +1582,13 @@ function buildRequestBody(messages, model, tools, sendOpts) {
         body.tools = [...nativeTools, ...toAnthropicTools([...(tools || []), ...deferredTools])];
     }
 
-    const thinkingBudgetTokens = Number(opts.thinkingBudgetTokens);
-    if (Number.isFinite(thinkingBudgetTokens) && thinkingBudgetTokens > 0) {
-        const budgetTokens = clampThinkingBudgetTokens(thinkingBudgetTokens, maxTokens);
-        if (budgetTokens) body.thinking = { type: 'enabled', budget_tokens: budgetTokens };
-    } else if (opts.effort) {
-        if (EFFORT_BUDGET[opts.effort]) {
-            const budgetTokens = clampThinkingBudgetTokens(EFFORT_BUDGET[opts.effort], maxTokens);
-            if (budgetTokens) body.thinking = { type: 'enabled', budget_tokens: budgetTokens };
-        } else if (!_LOGGED_UNKNOWN_EFFORT.has(opts.effort)) {
-            _LOGGED_UNKNOWN_EFFORT.add(opts.effort);
-            try {
-                process.stderr.write(`[anthropic-oauth] unknown effort=${opts.effort} ignored (known: ${Object.keys(EFFORT_BUDGET).join(',')})\n`);
-            } catch {}
-        }
-    }
+    applyAnthropicEffortToBody(body, {
+        model,
+        opts,
+        maxTokens,
+        clampThinkingBudgetTokens,
+        logTag: 'anthropic-oauth',
+    });
 
     if (opts.fast === true && supportsAnthropicFastMode(model)) {
         body.speed = 'fast';
@@ -1530,6 +1739,20 @@ export class AnthropicOAuthProvider {
         if (body.speed === 'fast') {
             this.fastModeBetaHeaderLatched = true;
         }
+        // advanced-tool-use-2025-11-20 beta is only needed when this request
+        // actually carries deferred (defer_loading) tools — gate the header on
+        // that instead of sending it unconditionally on every request.
+        const hasDeferredTools = Array.isArray(body.tools)
+            && body.tools.some((t) => t && t.defer_loading === true);
+        // Known tool names for the leaked-tool-call guard in parseSSEStream:
+        // recovered leaked calls are only synthesized when they name a tool
+        // actually offered to this request (native + lowered). Derived from the
+        // final request body so it matches exactly what the model was given.
+        const knownToolNames = new Set(
+            (Array.isArray(body.tools) ? body.tools : [])
+                .map((t) => (t && typeof t.name === 'string' ? t.name : null))
+                .filter(Boolean),
+        );
         const sessionId = opts.sessionId || null;
         const iteration = Number.isFinite(Number(opts.iteration)) ? Number(opts.iteration) : null;
         // Option A: no absolute wall-clock cap on streaming generation. A stream
@@ -1597,7 +1820,8 @@ export class AnthropicOAuthProvider {
                         'anthropic-beta': buildAnthropicBetaHeaders({
                             base: OAUTH_BETA_HEADERS,
                             fastMode: this.fastModeBetaHeaderLatched,
-                            toolSearch: true,
+                            toolSearch: hasDeferredTools,
+                            effort: shouldIncludeEffortBeta(useModel, opts),
                         }),
                         'anthropic-dangerous-direct-browser-access': 'true',
                         'user-agent': `claude-cli/${resolveCliVersion()} (external, sdk-cli)`,
@@ -1758,11 +1982,12 @@ export class AnthropicOAuthProvider {
                 const result = await parseSSEFn(
                     response,
                     controller.signal,
-                    () => controller.abort(),
+                    (reason) => controller.abort(reason),
                     onStreamDelta,
                     onToolCall,
                     midState,
                     onTextDelta,
+                    knownToolNames,
                 );
 
                 const ttftMs = midState.ttftAt ? midState.ttftAt - sseStartedAt : null;
@@ -2214,3 +2439,7 @@ export async function loginOAuth() {
 // Lets the SSE parser be exercised in isolation against a synthetic
 // ReadableStream without needing a live OAuth session.
 export { parseSSEStream };
+
+// Test-only escape hatch for scripts/tool-smoke.mjs to verify the
+// catalog-driven max-tokens resolution without duplicating its logic.
+export const _test = { resolveMaxTokens };