mixdog 0.9.2 → 0.9.4

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -5,40 +5,58 @@
  * Raw HTTP + SSE streaming, reuses message/tool conversion patterns
  * from anthropic.mjs. agent-trace instrumented.
  */
-import { readFileSync, existsSync, statSync } from 'fs';
-import { join } from 'path';
-import { createServer } from 'http';
-import { randomBytes, createHash } from 'crypto';
+import { randomBytes } from 'crypto';
 import {
     traceAgentFetch,
     traceAgentSse,
     traceAgentUsage,
 } from '../agent-trace.mjs';
 import { createAbortController } from '../../../shared/abort-controller.mjs';
-import { writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
-import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
-import { enrichModels } from './model-catalog.mjs';
-import { makeModelCache } from './model-cache.mjs';
+import { resolveAnthropicMaxTokens } from './anthropic-max-tokens.mjs';
+import {
+    _loadModelCache,
+    _setInMemoryCatalog,
+    _catalogHas,
+    _displayModel,
+    _catalogOutputTokens,
+    normalizeAndSaveCatalog,
+    resolveLatestAnthropicModel,
+    resolveAnthropicModelAfter404,
+    ensureLatestAnthropicModel,
+} from './anthropic-model-resolve.mjs';
 import { sanitizeToolPairs, sanitizeAnthropicContentPairs } from '../session/context-utils.mjs';
+import {
+    TOKEN_REFRESH_SKEW_MS,
+    resolveCliVersion,
+    loadCredentials,
+    hasAnthropicOAuthCredentials,
+    describeAnthropicOAuthCredentials,
+    forgetAnthropicOAuthCredentials,
+    _scrubTokens,
+    _credentialsMaxMtime,
+    refreshOAuthCredentials,
+    beginOAuthLogin,
+    loginOAuth,
+} from './anthropic-oauth-credentials.mjs';
 import {
     PROVIDER_FIRST_BYTE_TIMEOUT_MS,
     PROVIDER_HTTP_RESPONSE_TIMEOUT_MS,
     PROVIDER_RETRY_BACKOFF_MS,
     PROVIDER_RETRY_MAX_ATTEMPTS,
-    PROVIDER_SSE_IDLE_WATCHDOG_ENABLED,
-    PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS,
-    streamStalledError,
     createPassthroughSignal,
 } from '../stall-policy.mjs';
 import {
     classifyError,
-    classifyMidstreamError,
     midstreamBackoffFor,
-    MIDSTREAM_RETRY_POLICY,
     retryAfterMsFromError,
-    sleepWithAbort,
     withRetry,
 } from './retry-classifier.mjs';
+import {
+    ANTHROPIC_MAX_MIDSTREAM_RETRIES,
+    parseSSEStream,
+    _classifyMidstreamError,
+    _midstreamSleepWithAbort,
+} from './anthropic-sse.mjs';
 import { buildAnthropicBetaHeaders, supportsAnthropicFastMode } from './anthropic-betas.mjs';
 import {
     applyAnthropicEffortToBody,
@@ -47,33 +65,11 @@ import {
 } from './anthropic-effort.mjs';
 import { getLlmDispatcher, preconnect } from '../../../shared/llm/http-agent.mjs';
 import { normalizeContentForAnthropic } from './media-normalization.mjs';
-import { makeInvalidToolArgsMarker } from './openai-compat-stream.mjs';
-import { scanLeakedToolCalls, createToolCallDedupe } from './anthropic-leaked-toolcall.mjs';
-
-// --- Model catalog cache helpers ---
-// Disk-backed cache so repeated process starts (cron, tool calls) don't
-// hammer /v1/models. 24h TTL matches the upstream client cadence.
-const MODEL_CACHE_TTL_MS = 24 * 60 * 60_000;
-// Bump when the on-disk cache shape changes so stale-shape entries are
-// discarded instead of misread (mirrors openai-oauth's schema-version gate).
-const ANTHROPIC_MODEL_CACHE_SCHEMA_VERSION = 1;
+
+// --- Model catalog cache helpers: extracted to anthropic-model-resolve.mjs ---
 // SSE progress emits (per-request "Response …" and "Done:" lines). Off by default.
 const SSE_VERBOSE = process.env.MIXDOG_SSE_VERBOSE === '1';
 
-/** Bounded mid-stream SSE retries (transient stream loss); shared with anthropic.mjs.
- *  Sourced from the single shared retry-budget table (MIDSTREAM_RETRY_POLICY.sse). */
-export const ANTHROPIC_MAX_MIDSTREAM_RETRIES = MIDSTREAM_RETRY_POLICY.sse.defaultRetries;
-
-// Policy passed to the shared classifyMidstreamError for the SSE path. The
-// top-of-function attempt-budget gate uses defaultRetries (3); perClassifierGate
-// is false so the classifier returns raw bucket strings (the loop owns the
-// MAX_MIDSTREAM_RETRIES bound), matching the former _classifyMidstreamError.
-const SSE_MIDSTREAM_POLICY = {
-    mode: 'sse',
-    defaultRetries: MIDSTREAM_RETRY_POLICY.sse.defaultRetries,
-    perClassifierGate: false,
-};
-
 function formatRetryAfter(ms) {
     if (ms == null) return '';
     const n = Number(ms);
@@ -102,26 +98,6 @@ function anthropicQuotaError(status, headers, bodyText = '') {
     return err;
 }
 
-const _modelCache = makeModelCache({
-    fileName: 'anthropic-oauth-models.json',
-    ttlMs: MODEL_CACHE_TTL_MS,
-    version: ANTHROPIC_MODEL_CACHE_SCHEMA_VERSION,
-    onSave: (m) => { _inMemoryCatalog = Array.isArray(m) ? m.slice() : null; },
-});
-
-// Async wrappers so callers can keep awaiting; the shared cache CRUD is sync.
-async function _loadModelCache() {
-    return _modelCache.loadSync();
-}
-
-async function _saveModelCache(models) {
-    _modelCache.save(models);
-}
-
-// In-memory mirror of the disk catalog — populated on first listModels() and
-// refreshed after every _saveModelCache. Used by _catalogHas and _displayModel
-// so hot paths don't hit disk on every response.
-let _inMemoryCatalog = null;
 let _modelRefreshInFlight = null;
 let _oauthRefreshInFlight = null;
 // No in-memory credential cache: the canonical credentials file is the
@@ -131,192 +107,14 @@ let _oauthRefreshInFlight = null;
 // disk on demand is cheap (one stat + one small JSON parse) and removes
 // the cache-vs-disk skew entirely.
 
-
-function _catalogHas(id) {
-    if (!id || !Array.isArray(_inMemoryCatalog)) return false;
-    return _inMemoryCatalog.some(m => m.id === id);
-}
-
-// Display-name normalization for trace / usage. Turns dated or version-alias
-// ids into the version alias form: claude-opus-4-7 → claude-opus-4.7,
-// claude-haiku-4-5-20251001 → claude-haiku-4.5. Falls back to the raw id.
-function _displayModel(id) {
-    if (!id || typeof id !== 'string') return id;
-    const m = id.match(/^claude-([a-z]+)-(\d+)(?:-(\d+))?(?:-\d{8})?$/i);
-    if (!m) return id;
-    return `claude-${m[1].toLowerCase()}-${m[2]}${m[3] ? `.${m[3]}` : ''}`;
-}
-
-function _capabilitySupported(capability) {
-    return capability === true || capability?.supported === true;
-}
-
-// Classify a model id into our common tier/family shape. Anthropic's catalog
-// mixes dated ids (claude-opus-4-5-20251101), versioned aliases
-// (claude-opus-4-6), and the raw family tokens resolved via env vars.
-function _normalizeAnthropicModel(raw) {
-    const id = raw?.id || raw?.name;
-    if (!id) return null;
-    const familyMatch = id.match(/^claude-([a-z]+)/i);
-    const family = familyMatch ? familyMatch[1].toLowerCase() : 'other';
-    // Dated: trailing -YYYYMMDD (8 digits).
-    const dated = /-\d{8}$/.test(id);
-    // Versioned alias: claude-<family>-<major>-<minor>[-...] with no dated suffix.
-    const versioned = !dated && /^claude-[a-z]+-\d+(?:-\d+)?$/i.test(id);
-    const tier = dated ? 'dated' : versioned ? 'version' : 'family';
-    const releaseDate = dated
-        ? id.match(/-(\d{4})(\d{2})(\d{2})$/)
-        : null;
-    const effortValues = effortValuesForModel(raw?.capabilities, id);
-    return {
-        id,
-        display: raw?.display_name || _prettyName(id, family),
-        family,
-        provider: 'anthropic-oauth',
-        contextWindow: raw?.context_window || raw?.max_context_window || raw?.max_input_tokens || _defaultContextForModel(id, family),
-        outputTokens: raw?.max_tokens || raw?.max_output_tokens || null,
-        tier,
-        latest: false, // assigned in a second pass once full list is known
-        releaseDate: releaseDate ? `${releaseDate[1]}-${releaseDate[2]}-${releaseDate[3]}` : null,
-        supportsReasoning: effortValues.length > 0 || _capabilitySupported(raw?.capabilities?.thinking),
-        reasoningOptions: effortValues.length ? [{ type: 'effort', values: effortValues }] : [],
-    };
-}
-
-function _prettyName(id, family) {
-    const v = id.match(/^claude-[a-z]+-(\d+)(?:-(\d+))?/i);
-    const base = family[0].toUpperCase() + family.slice(1);
-    return v ? `${base} ${v[1]}${v[2] ? `.${v[2]}` : ''}` : base;
-}
-
-function _defaultContextForModel(id, family) {
-    const text = String(id || '');
-    const version = text.match(/^claude-[a-z]+-(\d+)(?:-(\d+))?/i);
-    if (Number(version?.[1] || 0) >= 5) return 1000000;
-    if (/^claude-(opus|sonnet)-4-(6|7|8)(?:$|-)/i.test(text)) return 1000000;
-    if (family && family !== 'other') return 200000;
-    return 200000;
-}
-
-// Mark the highest-numbered version per family as `latest: true`. Uses a simple
-// lexicographic comparison on the numeric parts embedded in the id.
-function _markLatestByFamily(models) {
-    const byFamily = new Map();
-    for (const m of models) {
-        if (m.tier !== 'version') continue;
-        const cur = byFamily.get(m.family);
-        if (!cur || _compareVersion(m.id, cur.id) > 0) {
-            byFamily.set(m.family, m);
-        }
-    }
-    for (const m of byFamily.values()) m.latest = true;
-}
-
-function _compareVersion(a, b) {
-    const na = (a.match(/^claude-[a-z]+-(\d+)(?:-(\d+))?/i) || []).slice(1).map(Number);
-    const nb = (b.match(/^claude-[a-z]+-(\d+)(?:-(\d+))?/i) || []).slice(1).map(Number);
-    for (let i = 0; i < Math.max(na.length, nb.length); i++) {
-        if ((na[i] || 0) !== (nb[i] || 0)) return (na[i] || 0) - (nb[i] || 0);
-    }
-    return a.localeCompare(b);
-}
-
-// Newest HIGH-TIER chat model by version, read from the SYNC in-memory catalog
-// mirror. Symmetric with resolveLatestGrokModel / resolveLatestCodexModel.
-// Anthropic ships three families: opus / sonnet / haiku. "Latest" is the
-// highest version across opus + sonnet only — haiku is the cheap tier and is
-// never the flagship default. Returns null until listModels() populates the
-// mirror; callers must warm the catalog (ensureLatestAnthropicModel) when null.
-export function resolveLatestAnthropicModel() {
-    if (!Array.isArray(_inMemoryCatalog)) return null;
-    let best = null;
-    for (const m of _inMemoryCatalog) {
-        if (!m?.id || (m.family !== 'opus' && m.family !== 'sonnet')) continue;
-        if (!best || _compareVersion(m.id, best.id) > 0) best = m;
-    }
-    return best?.id || null;
-}
-
-function resolveAnthropicModelAfter404(requested) {
-    if (!Array.isArray(_inMemoryCatalog)) return null;
-    const wanted = String(requested || '');
-    const family = (wanted.match(/^claude-([a-z]+)/i) || [])[1]?.toLowerCase() || null;
-    let best = null;
-    for (const m of _inMemoryCatalog) {
-        if (!m?.id) continue;
-        if (family && m.family !== family) continue;
-        if (!family && m.family !== 'opus' && m.family !== 'sonnet') continue;
-        if (!best || _compareVersion(m.id, best.id) > 0) best = m;
-    }
-    if (best?.id && best.id !== wanted) return best.id;
-    if (family === 'opus') {
-        const flagship = resolveLatestAnthropicModel();
-        if (flagship && flagship !== wanted) return flagship;
-    }
-    return null;
-}
-
-export async function ensureLatestAnthropicModel(provider) {
-    let m = resolveLatestAnthropicModel();
-    if (m) return m;
-    await provider._refreshModelCache();
-    m = resolveLatestAnthropicModel();
-    if (m) return m;
-    throw new Error('[anthropic-oauth] model catalog unavailable after warmup — cannot resolve default model');
-}
-
 const API_URL = 'https://api.anthropic.com/v1/messages';
-// SSRF guard for the OAuth token endpoint override. Env-supplied URLs must be
-// https with a valid http(s) URL shape; reject file:/data:/ftp:/etc. and any
-// http override so a hostile env cannot redirect refresh-token requests.
-function assertSafeTokenURL(rawURL) {
-    let parsed;
-    try {
-        parsed = new URL(String(rawURL));
-    } catch {
-        throw new Error(`[anthropic-oauth] invalid ANTHROPIC_OAUTH_TOKEN_URL: ${rawURL}`);
-    }
-    if (parsed.protocol.toLowerCase() !== 'https:') {
-        throw new Error(`[anthropic-oauth] ANTHROPIC_OAUTH_TOKEN_URL must use https (got ${parsed.protocol})`);
-    }
-    return rawURL;
-}
-const TOKEN_URL = assertSafeTokenURL(process.env.ANTHROPIC_OAUTH_TOKEN_URL || 'https://platform.claude.com/v1/oauth/token');
 const ANTHROPIC_VERSION = '2023-06-01';
-const DEFAULT_CREDENTIALS_PATH = join(resolvePluginData(), 'anthropic-oauth-credentials.json');
-const CLAUDE_CODE_CLIENT_ID = process.env.ANTHROPIC_OAUTH_CLIENT_ID || '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
-const TOKEN_REFRESH_SKEW_MS = 5 * 60_000;
-const CLAUDE_AI_AUTHORIZE_URL = 'https://claude.com/cai/oauth/authorize';
-const ALL_OAUTH_SCOPES = [
-    'org:create_api_key',
-    'user:profile',
-    'user:inference',
-    'user:sessions:claude_code',
-    'user:mcp_servers',
-    'user:file_upload',
-];
-const OAUTH_LOGIN_SCOPE = ALL_OAUTH_SCOPES.join(' ');
-const OAUTH_CALLBACK_HOST = 'localhost';
-const OAUTH_CALLBACK_PORT = 54545;
-const OAUTH_CALLBACK_PATH = '/callback';
-const OAUTH_REDIRECT_URI = `http://${OAUTH_CALLBACK_HOST}:${OAUTH_CALLBACK_PORT}${OAUTH_CALLBACK_PATH}`;
-const OAUTH_MANUAL_REDIRECT_URI = process.env.ANTHROPIC_OAUTH_MANUAL_REDIRECT_URI || 'https://platform.claude.com/oauth/code/callback';
-const OAUTH_SUCCESS_REDIRECT_URL = process.env.ANTHROPIC_OAUTH_SUCCESS_REDIRECT_URL || 'https://platform.claude.com/oauth/code/success?app=claude-code';
-const OAUTH_LOGIN_TIMEOUT_MS = 5 * 60_000;
-const OAUTH_TOKEN_TIMEOUT_MS = 30_000;
-
-// Anthropic OAuth contract for first-party OAuth clients.
-// Opus/Sonnet requests are gated on a specific system-prompt prefix.
-// Mixdog keeps that upstream client contract for OAuth routing. Haiku is not
+
+// Anthropic OAuth contract for first-party OAuth clients: Opus/Sonnet
+// requests are gated on this exact system-prompt prefix. Haiku is not
 // gated and ignores this prefix.
 const CLAUDE_CODE_SYSTEM_PREFIX = "You are Claude Code, Anthropic's official CLI for Claude.";
-const OAUTH_BETA_HEADERS = 'oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27,extended-cache-ttl-2025-04-11,advanced-tool-use-2025-11-20';
-const DEFAULT_CLI_VERSION = '2.1.77';
-
-function resolveCliVersion() {
-    return process.env.MIXDOG_CLI_VERSION
-        || DEFAULT_CLI_VERSION;
-}
+const OAUTH_BETA_HEADERS = 'oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27,extended-cache-ttl-2025-04-11';
 
 function requiresSystemPrefix(model) {
     // High-tier Claude OAuth models require the first-party system prefix for
@@ -364,98 +162,36 @@ function buildSystemBlocks(systemMsgs, model, systemTtl, tier3Ttl) {
     // Apply per-tier cache_control. BP1/BP2 -> systemTtl, BP3 -> tier3Ttl. The
     // gating prefix block is never cached (Anthropic routes on its exact bytes).
     // tier3Ttl === null leaves the 3rd block uncached (e.g. maintenance roles).
+    // Anthropic caps cache_control breakpoints at 4 per request; defensively
+    // cap it here too so an unexpectedly large systemMsgs array can never
+    // mark more than 4 blocks (extras keep their text, just lose the
+    // cache_control breakpoint, not the block itself).
+    const MAX_SYSTEM_BREAKPOINTS = 4;
+    let bpCount = 0;
     for (const b of blocks) {
         const tier = b._tier;
         delete b._tier;
         if (b.text === CLAUDE_CODE_SYSTEM_PREFIX) continue;
         const ttl = tier === 'tier3' ? tier3Ttl : systemTtl;
-        if (ttl) b.cache_control = ttl;
-    }
-    return blocks;
-}
-
-// Per-model max_tokens when the model id is explicitly listed. New models
-// (e.g., Sonnet 4.7) won't match a specific entry and fall through to the
-// family-based heuristic below. Conservative defaults — model may support
-// more but we'd rather stay within safe bounds.
-const MAX_TOKENS = {
-    'claude-opus-4-8': 65536,
-    'claude-opus-4-7': 65536,
-    'claude-opus-4-6': 65536,
-    'claude-sonnet-4-6': 16384,
-    'claude-haiku-4-5-20251001': 8192,
-};
-
-// Sanity floor/ceiling for resolveMaxTokens. Catalog-reported outputTokens
-// (from the Anthropic API, cached to disk) can be trusted above these
-// hardcoded fallbacks, but we still clamp to a safety cap so a bad/huge
-// catalog value can't blow the thinking+output budget, and floor so a
-// missing/zero catalog value never degenerates to an unusable cap.
-const MAX_TOKENS_FLOOR = 8192;
-const DEFAULT_SAFETY_CAP = 65536;
-// Parse MIXDOG_ANTHROPIC_MAX_OUTPUT_TOKENS strictly: only a finite positive
-// number is a valid override. Invalid values ("0", negatives, garbage,
-// whitespace) are treated as unset — NOT as "use the default cap outright" —
-// so resolveMaxTokens still consults catalog/fallback for low-cap models.
-function _envMaxOutputOverride() {
-    const raw = process.env.MIXDOG_ANTHROPIC_MAX_OUTPUT_TOKENS;
-    if (raw == null || String(raw).trim() === '') return null;
-    const n = Number(raw);
-    if (!Number.isFinite(n) || n <= 0) return null;
-    return Math.floor(n);
-}
-
-// Catalog-reported outputTokens for a model id, read from the in-memory
-// catalog mirror (lazily populated from the disk cache if the mirror hasn't
-// been warmed yet by listModels()). Never throws — any failure just means
-// "no catalog data", and callers fall back to the static heuristics below.
-function _catalogOutputTokens(model) {
-    if (!model) return null;
-    try {
-        if (!Array.isArray(_inMemoryCatalog)) {
-            const cached = _modelCache.loadSync();
-            if (Array.isArray(cached)) _inMemoryCatalog = cached.slice();
+        if (ttl && bpCount < MAX_SYSTEM_BREAKPOINTS) {
+            b.cache_control = ttl;
+            bpCount++;
         }
-        if (!Array.isArray(_inMemoryCatalog)) return null;
-        const entry = _inMemoryCatalog.find(m => m?.id === model);
-        const out = Number(entry?.outputTokens);
-        return Number.isFinite(out) && out > 0 ? out : null;
-    } catch {
-        return null;
     }
+    return blocks;
 }
 
-function _fallbackMaxTokens(model) {
-    if (MAX_TOKENS[model]) return MAX_TOKENS[model];
-    const id = String(model || '').toLowerCase();
-    if (id.includes('opus')) return 65536;
-    if (id.includes('fable')) return 65536;
-    // Sonnet 5+ ships a much larger output budget than the legacy 4.x line
-    // (this is the claude-sonnet-5 fix: 16384 was starving visible output
-    // once extended thinking ate into the same hard cap). Keep sonnet-4-x
-    // conservative at 16384; only bump 5+.
-    const sonnetVersion = id.match(/^claude-sonnet-(\d+)/);
-    if (sonnetVersion) return Number(sonnetVersion[1]) >= 5 ? 65536 : 16384;
-    if (id.includes('sonnet')) return 16384;
-    if (id.includes('haiku')) return 8192;
-    return 8192;
-}
-
-// resolveMaxTokens: catalog-driven max_tokens for a model id.
+// resolveMaxTokens: catalog-driven max_tokens for a model id. Thin wrapper
+// around the shared anthropic-max-tokens helper (also used by the API-key
+// twin in anthropic.mjs) — this provider supplies its own in-memory-mirror-
+// first catalog lookup strategy (see anthropic-model-resolve.mjs).
 //   1. MIXDOG_ANTHROPIC_MAX_OUTPUT_TOKENS env override, if set, wins outright.
 //   2. Catalog outputTokens (trusted over hardcoded heuristics when present),
 //      clamped to [MAX_TOKENS_FLOOR, safetyCap].
 //   3. Static MAX_TOKENS table / family heuristic fallback when the catalog
 //      has no entry for this model, also clamped to the safety cap.
 function resolveMaxTokens(model) {
-    const envOverride = _envMaxOutputOverride();
-    if (envOverride != null) return envOverride;
-    const safetyCap = DEFAULT_SAFETY_CAP;
-    const catalogValue = _catalogOutputTokens(model);
-    if (catalogValue != null) {
-        return Math.max(MAX_TOKENS_FLOOR, Math.min(catalogValue, safetyCap));
-    }
-    return Math.min(_fallbackMaxTokens(model), safetyCap);
+    return resolveAnthropicMaxTokens(model, { catalogLookup: _catalogOutputTokens });
 }
 
 const MIN_THINKING_BUDGET = 1024;
@@ -475,250 +211,7 @@ function clampThinkingBudgetTokens(value, maxTokens) {
 const CACHE_TTL_STABLE = { type: 'ephemeral', ttl: '1h' };   // tools, system, tier3, messages
 const CACHE_TTL_VOLATILE = { type: 'ephemeral' };             // explicit 5m override
 
-// --- Credential helpers ---
-
-function _pushUnique(list, value) {
-    if (!value || typeof value !== 'string') return;
-    if (!list.includes(value)) list.push(value);
-}
-
-function credentialCandidates() {
-    const paths = [];
-    _pushUnique(paths, process.env.ANTHROPIC_OAUTH_CREDENTIALS_PATH);
-    _pushUnique(paths, DEFAULT_CREDENTIALS_PATH);
-    return paths;
-}
-
-// Fallback expiry from the access_token's JWT `exp` claim (epoch ms) when the
-// credentials file carries no explicit expiresAt — without it expiresAt stays 0,
-// which ensureAuth reads as "never expires", disabling proactive refresh. Claude
-// OAuth tokens are opaque so this returns 0 and the file's expiresAt governs; kept
-// for parity with the other OAuth providers. JWT `exp` is epoch SECONDS (RFC 7519).
-function _expiryFromAccessToken(token) {
-    try {
-        const parts = String(token || '').split('.');
-        if (parts.length !== 3) return 0;
-        const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString('utf-8'));
-        const exp = Number(payload?.exp);
-        return Number.isFinite(exp) && exp > 0 ? exp * 1000 : 0;
-    } catch { return 0; }
-}
-
-function _loadCredentialsFile(path) {
-    if (!existsSync(path)) return null;
-    try {
-        const stat = statSync(path);
-        const raw = JSON.parse(readFileSync(path, 'utf-8'));
-        const oauth = raw?.claudeAiOauth;
-        if (!oauth?.accessToken) return null;
-        return {
-            path,
-            mtimeMs: stat.mtimeMs,
-            accessToken: oauth.accessToken,
-            refreshToken: oauth.refreshToken || null,
-            expiresAt: _normalizeExpiresAt(oauth.expiresAt ?? oauth.expires_at) || _expiryFromAccessToken(oauth.accessToken),
-            scopes: Array.isArray(oauth.scopes) ? oauth.scopes : [],
-            subscriptionType: oauth.subscriptionType || null,
-        };
-    } catch {
-        return null;
-    }
-}
-
-// Cross-process safe credential save. Lockfile (O_EXCL) prevents two Mixdog
-// refreshers from clobbering each other; atomic rename guarantees readers see
-// either the old or new file, never a half-written one. Used so refresh_token
-// rotation propagates to other Mixdog readers of the same credentials file
-// instead of leaving them stuck on the previous refresh_token.
-function _saveCredentialsFile(path, raw) {
-    // Secret file, not parent-dir ACL mutation. `secret: true` clamps the file
-    // itself on Windows; it deliberately leaves the data dir inheritance alone.
-    writeJsonAtomicSync(path, raw, { lock: true, fsyncDir: true, mode: 0o600, secret: true });
-}
-
-// Cheap stat-only probe so ensureAuth can detect Mixdog-updated credentials
-// without paying a full JSON read every call.
-function _credentialsMaxMtime() {
-    let max = 0;
-    for (const p of credentialCandidates()) {
-        try {
-            const s = statSync(p);
-            if (s.mtimeMs > max) max = s.mtimeMs;
-        } catch { /* not present — skip */ }
-    }
-    return max;
-}
-
-function loadCredentials() {
-    const loaded = credentialCandidates()
-        .map(_loadCredentialsFile)
-        .filter(Boolean);
-    if (!loaded.length) return null;
-    loaded.sort((a, b) => (Number(b.expiresAt) || 0) - (Number(a.expiresAt) || 0));
-    return loaded[0];
-}
-
-// Public predicate used by config.buildDefaultConfig — provider is enabled
-// when on-disk credentials exist AND carry the inference scope. Single
-// truth: same loader the runtime uses, no parallel hard-coded path probe.
-export function hasAnthropicOAuthCredentials() {
-    const creds = loadCredentials();
-    if (!creds?.accessToken) return false;
-    return Array.isArray(creds.scopes) && creds.scopes.includes('user:inference');
-}
-
-export function describeAnthropicOAuthCredentials() {
-    try {
-        const creds = loadCredentials();
-        if (!creds?.accessToken) {
-            return { authenticated: false, status: 'Not Set', detail: 'Mixdog OAuth credentials' };
-        }
-        const hasInferenceScope = Array.isArray(creds.scopes) && creds.scopes.includes('user:inference');
-        const hasRefresh = Boolean(creds.refreshToken);
-        const expiresAt = _normalizeExpiresAt(creds.expiresAt);
-        const expiring = expiresAt > 0 && expiresAt < Date.now() + TOKEN_REFRESH_SKEW_MS;
-        const expired = expiresAt > 0 && expiresAt <= Date.now();
-        const detail = creds.path || DEFAULT_CREDENTIALS_PATH;
-        if (!hasInferenceScope) {
-            return { authenticated: false, status: 'Missing Scope', detail, expiresAt };
-        }
-        if (!hasRefresh) {
-            return {
-                authenticated: expiresAt === 0 || !expired,
-                status: expired ? 'Reauth Required' : 'Access Only',
-                detail: `${detail}; no refresh token`,
-                expiresAt,
-            };
-        }
-        if (expired) return { authenticated: true, status: 'Refresh Required', detail, expiresAt };
-        if (expiring) return { authenticated: true, status: 'Refresh Soon', detail, expiresAt };
-        return { authenticated: true, status: 'Valid', detail, expiresAt };
-    } catch (err) {
-        return { authenticated: false, status: 'Error', detail: String(err?.message || err).slice(0, 200) };
-    }
-}
-
-export function forgetAnthropicOAuthCredentials() {
-    let removed = false;
-    for (const path of credentialCandidates()) {
-        if (!existsSync(path)) continue;
-        try {
-            const raw = JSON.parse(readFileSync(path, 'utf-8'));
-            if (raw?.claudeAiOauth) {
-                delete raw.claudeAiOauth;
-                _saveCredentialsFile(path, raw);
-                removed = true;
-            }
-        } catch (err) {
-            throw new Error(`Anthropic OAuth reset failed for ${path}: ${err?.message || err}`);
-        }
-    }
-    return { removed };
-}
-
-function _normalizeExpiresAt(value) {
-    if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0) return 0;
-    return value < 1e12 ? value * 1000 : value;
-}
-
-function _scrubTokens(text) {
-    return String(text || '')
-        .replace(/Bearer [A-Za-z0-9._\-]+/g, 'Bearer [REDACTED]')
-        .replace(/sk-ant-[A-Za-z0-9._\-]+/g, '[REDACTED]')
-        .replace(/"access[Tt]oken"\s*:\s*"[^"]+"/g, '"accessToken":"[REDACTED]"')
-        .replace(/"refresh[Tt]oken"\s*:\s*"[^"]+"/g, '"refreshToken":"[REDACTED]"')
-        .replace(/"access_token"\s*:\s*"[^"]+"/g, '"access_token":"[REDACTED]"')
-        .replace(/"refresh_token"\s*:\s*"[^"]+"/g, '"refresh_token":"[REDACTED]"');
-}
-
-async function refreshOAuthCredentials(creds) {
-    if (!creds?.refreshToken) {
-        throw new Error('Anthropic OAuth refresh token not available. Open /providers in mixdog to sign in again.');
-    }
-
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 30_000);
-    try {
-        const res = await fetch(TOKEN_URL, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'anthropic-dangerous-direct-browser-access': 'true',
-                'user-agent': `claude-cli/${resolveCliVersion()} (external, sdk-cli)`,
-            },
-            body: JSON.stringify({
-                grant_type: 'refresh_token',
-                refresh_token: creds.refreshToken,
-                client_id: CLAUDE_CODE_CLIENT_ID,
-            }),
-            // Never follow a redirect on a secret-bearing request: a token
-            // endpoint that 307/308-redirects would replay the refresh_token to
-            // the redirect target. Fail loud instead.
-            redirect: 'error',
-            signal: controller.signal,
-            dispatcher: getLlmDispatcher(),
-        });
-
-        const text = await res.text();
-        let json = null;
-        try { json = text ? JSON.parse(text) : null; } catch { /* handled below */ }
-        if (!res.ok) {
-            const isInvalidGrant = text.includes('invalid_grant') || json?.error === 'invalid_grant';
-            throw Object.assign(new Error(`token refresh ${res.status}: ${_scrubTokens(text).slice(0, 200)}`), { isInvalidGrant });
-        }
-
-        const accessToken = json?.access_token || json?.accessToken;
-        if (!accessToken) throw new Error('token refresh returned no access token');
-        const expiresAt = _normalizeExpiresAt(json?.expires_at ?? json?.expiresAt)
-            || (typeof json?.expires_in === 'number' ? Date.now() + json.expires_in * 1000 : 0);
-        const refreshed = {
-            path: creds.path,
-            accessToken,
-            refreshToken: json?.refresh_token || json?.refreshToken || creds.refreshToken,
-            expiresAt,
-            scopes: Array.isArray(json?.scope) ? json.scope : creds.scopes,
-            subscriptionType: creds.subscriptionType,
-        };
-        // Persist rotated tokens back so any other Mixdog reader of the same
-        // credentials file picks up the new refresh_token. Without this, a
-        // later process can replay an old single-use refresh token and loop on
-        // invalid_grant.
-        if (creds.path && existsSync(creds.path)) {
-            try {
-                const raw = JSON.parse(readFileSync(creds.path, 'utf-8'));
-                raw.claudeAiOauth = {
-                    ...(raw.claudeAiOauth || {}),
-                    accessToken: refreshed.accessToken,
-                    refreshToken: refreshed.refreshToken,
-                    expiresAt: refreshed.expiresAt,
-                    scopes: refreshed.scopes,
-                };
-                _saveCredentialsFile(creds.path, raw);
-            } catch (err) {
-                process.stderr.write(`[anthropic-oauth] credential save failed: ${_scrubTokens(err?.message || String(err)).slice(0, 200)}\n`);
-                throw new Error(`[oauth] credentials save failed: ${err?.message ?? String(err)}`);
-            }
-        }
-        return refreshed;
-    } catch (err) {
-        if (err?.name === 'AbortError') {
-            throw new Error('Anthropic OAuth token refresh timed out after 30000ms');
-        }
-        throw err;
-    } finally {
-        clearTimeout(timeout);
-    }
-}
-
-// Exported so callers can detect re-auth-required scenarios and prompt the user.
-export class ReauthRequired extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'ReauthRequired';
-    }
-}
-
-// --- Message conversion (mirrors anthropic.mjs) ---
+// --- Message conversion ---
 
 function withCacheControl(block, ttl = CACHE_TTL_VOLATILE) {
     if (!block || typeof block !== 'object' || block.cache_control) return block;
@@ -965,575 +458,7 @@ function applyAnthropicCacheMarkers(sanitizedMessages, { messageTtl = CACHE_TTL_
     return sanitizedMessages;
 }
 
-// --- SSE parser ---
-
-function _captureMidstreamAbort(state, reason) {
-    if (!state) return;
-    const reasonName = reason?.name || '';
-    if (reasonName === 'AgentStallAbortError' || reasonName === 'StreamStalledAbortError') {
-        state.watchdogAbort = reasonName;
-    } else {
-        state.userAbort = true;
-    }
-}
-
-// Abort-aware mid-stream backoff sleep → shared sleepWithAbort
-// (retry-classifier.mjs). abortMessage preserves the prior fallback text.
-function _midstreamSleepWithAbort(ms, signal) {
-    return sleepWithAbort(ms, signal, undefined, 'Anthropic OAuth mid-stream retry backoff aborted');
-}
-
-function _statusForAnthropicSseError(type, message) {
-    const kind = String(type || '').toLowerCase();
-    const text = String(message || '').toLowerCase();
-    if (kind.includes('overload') || text.includes('overload')) return 503;
-    if (kind.includes('rate_limit') || text.includes('rate limit') || text.includes('quota')) return 429;
-    if (kind.includes('authentication') || text.includes('authentication') || text.includes('unauthorized')) return 401;
-    if (kind.includes('permission') || text.includes('forbidden')) return 403;
-    if (kind.includes('not_found') || text.includes('not found')) return 404;
-    if (kind.includes('invalid_request')) return 400;
-    return 0;
-}
-
-function _anthropicSseError(event) {
-    const payload = event?.error && typeof event.error === 'object' ? event.error : event;
-    const type = payload?.type || event?.type || 'error';
-    const message = payload?.message || 'Anthropic SSE error';
-    const err = new Error(`Anthropic OAuth SSE error ${type}: ${message}`);
-    err.name = 'AnthropicSseError';
-    err.code = 'EANTHROPIC_SSE_ERROR';
-    err.providerErrorType = type;
-    err.requestId = event?.request_id || event?.requestId || null;
-    const status = _statusForAnthropicSseError(type, message);
-    if (status) {
-        err.httpStatus = status;
-        err.status = status;
-    }
-    return err;
-}
-
-async function parseSSEStream(response, signal, abortStream, onStreamDelta, onToolCall, state, onTextDelta, knownToolNames) {
-    const reader = response.body.getReader();
-    const decoder = new TextDecoder();
-    // SEMANTIC idle window: reset only by real model events (message/content/
-    // tool deltas), NOT by raw keepalive bytes. A ping-only wedge therefore
-    // trips this within the window instead of hanging until the 30-min agent
-    // watchdog. See resetIdleTimer + the per-event reset in the loop below.
-    // state.semanticIdleTimeoutMs is a test/override seam (same shape as
-    // firstMessageTimeoutMs); production uses the shared env-backed default.
-    const SSE_IDLE_TIMEOUT_MS = Number.isFinite(Number(state?.semanticIdleTimeoutMs))
-        && Number(state.semanticIdleTimeoutMs) > 0
-        ? Number(state.semanticIdleTimeoutMs)
-        : PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS;
-    const SSE_FIRST_MESSAGE_TIMEOUT_MS = Number.isFinite(Number(state?.firstMessageTimeoutMs))
-        && Number(state.firstMessageTimeoutMs) > 0
-        ? Number(state.firstMessageTimeoutMs)
-        : PROVIDER_FIRST_BYTE_TIMEOUT_MS;
-    let content = '';
-    let hasThinkingContent = false;
-    const contentBlockTypes = new Set();
-    let model = '';
-    let toolCalls = [];
-    let usage = { inputTokens: 0, outputTokens: 0, cachedTokens: 0, cacheWriteTokens: 0, raw: null };
-    let stopReason = null;
-    let buffer = '';
-    let idleTimedOut = false;
-    let firstMessageTimedOut = false;
-    let idleTimer = null;
-    let firstMessageTimer = null;
-    let currentEvent = '';
-
-    const pendingToolInputs = new Map();
-
-    // Leaked tool-call guard. The model (esp. Opus via OAuth) occasionally
-    // emits a tool call as plain text tags inside `text_delta` instead of a
-    // native `tool_use` block. `leakBuffer` is a minimal rolling window that
-    // only holds back text when a partial sentinel prefix is present, so a
-    // tag split across chunk boundaries is still detected while ordinary text
-    // still streams promptly. The guard is additive: the native tool_use path
-    // (content_block_start/input_json_delta/content_block_stop) is untouched.
-    const _knownTools = knownToolNames instanceof Set
-        ? knownToolNames
-        : new Set(Array.isArray(knownToolNames) ? knownToolNames : []);
-    const _leakGuardEnabled = _knownTools.size > 0;
-    const _isKnownTool = (name) => _knownTools.has(name);
-    let leakBuffer = '';
-    // Running markdown fence/inline-code state threaded across text_delta
-    // chunks (Fix 1): a tool-call tag inside a ```code fence``` or inline span
-    // is a doc example, not a real call — the guard emits it as text.
-    let leakFenceState = undefined;
-    // Cross-path fingerprint dedupe (Fix 2): a synthesized text-leaked call and
-    // an identical native tool_use block must dispatch onToolCall exactly once.
-    const _toolDedupe = createToolCallDedupe();
-
-    // Synthesize + dispatch a recovered leaked call exactly like the native
-    // content_block_stop path (push into toolCalls, flag state, eager
-    // onToolCall). A generated id mirrors the `toolu_`-prefixed native shape.
-    const dispatchLeakedCall = (recovered) => {
-        let args = recovered?.arguments;
-        if (args === null || typeof args !== 'object' || Array.isArray(args)) args = {};
-        // Skip if an identical native (or prior synthetic) call already fired.
-        if (!_toolDedupe.shouldDispatch(recovered.name, args)) return;
-        const call = {
-            id: `toolu_leaked_${randomBytes(8).toString('hex')}`,
-            name: recovered.name,
-            arguments: args,
-        };
-        toolCalls.push(call);
-        if (state) state.emittedToolCall = true;
-        try { onToolCall?.(call); } catch {}
-        try { onStreamDelta?.(); } catch {}
-    };
-
-    // Feed accumulated text through the scanner. On `final` nothing is held
-    // back so legitimate text is never lost at stream end.
-    const pumpLeakBuffer = (final) => {
-        if (!_leakGuardEnabled) return;
-        if (!leakBuffer && !final) return;
-        const { emit, calls, rest, fenceState } = scanLeakedToolCalls(leakBuffer, { isKnownTool: _isKnownTool, final, fenceState: leakFenceState });
-        leakBuffer = rest;
-        leakFenceState = fenceState;
-        if (emit) {
-            content += emit;
-            if (onTextDelta) {
-                if (state) state.emittedText = true;
-                try { onTextDelta(emit); } catch {}
-            }
-        }
-        for (const c of calls) dispatchLeakedCall(c);
-    };
-
-    // Holds the in-flight reader.read() race rejector so the idle timer can
-    // force-unblock the loop even when reader.cancel() fails to settle the
-    // pending read (undici half-open socket). See resetIdleTimer below.
-    let idleReject = null;
-
-    const firstMessageTimeoutError = () => {
-        const err = new Error(`Anthropic OAuth SSE stream produced no message_start within ${SSE_FIRST_MESSAGE_TIMEOUT_MS}ms`);
-        err.code = 'EEMPTYSTREAM';
-        err.isEmptyStream = true;
-        err.firstByteTimeout = true;
-        return err;
-    };
-
-    const clearFirstMessageTimer = () => {
-        if (firstMessageTimer) {
-            clearTimeout(firstMessageTimer);
-            firstMessageTimer = null;
-        }
-    };
-
-    const armFirstMessageTimer = () => {
-        if (!(SSE_FIRST_MESSAGE_TIMEOUT_MS > 0)) return;
-        clearFirstMessageTimer();
-        firstMessageTimer = setTimeout(() => {
-            if (state?.sawMessageStart) return;
-            firstMessageTimedOut = true;
-            const err = firstMessageTimeoutError();
-            try { abortStream?.(err); } catch (abortErr) {
-                try { process.stderr.write(`[anthropic-oauth] sse first-message abortStream failed: ${abortErr?.message ?? String(abortErr)}\n`); } catch {}
-            }
-            try {
-                const _c = reader.cancel('SSE first message timeout');
-                if (_c && typeof _c.catch === 'function') _c.catch(() => {});
-            } catch (cancelErr) {
-                try { process.stderr.write(`[anthropic-oauth] sse first-message cancel failed: ${cancelErr?.message ?? String(cancelErr)}\n`); } catch {}
-            }
-            if (idleReject) {
-                const r = idleReject; idleReject = null; r(err);
-            }
-        }, SSE_FIRST_MESSAGE_TIMEOUT_MS);
-        try { firstMessageTimer.unref?.(); } catch {}
-    };
-
-    // Attach the partial stream state to a mid-stream stall error so the agent
-    // loop can decide SUCCESS vs FAILURE. The recurring "worker finished but
-    // owner never notified" case is a FINAL no-tool summary stream that wedges
-    // ping-only after the real work (tool calls) already completed in earlier
-    // iterations: there is streamed `content`, no pending tool_use, and no
-    // emitted tool call this iteration. The loop treats that as a successful
-    // partial-final (deliver the summary we have) instead of dropping it. A
-    // stall WITH a pending/emitted tool call stays a hard failure (a tool whose
-    // input never completed must never be reported as done).
-    const _attachStallPartial = (err) => {
-        try {
-            err.partialContent = content;
-            err.partialToolCalls = toolCalls.length ? toolCalls.slice() : undefined;
-            err.pendingToolUse = pendingToolInputs.size > 0;
-            err.partialModel = model || undefined;
-            err.partialUsage = usage;
-            err.partialStopReason = stopReason || undefined;
-            err.partialHasThinking = hasThinkingContent;
-        } catch { /* best-effort enrichment */ }
-        return err;
-    };
-
-    const resetIdleTimer = () => {
-        // OFF by default. When disabled the
-        // idle timer never arms, so the stream is never killed on inactivity;
-        // the agent stall watchdog (600s) remains the dead-stream backstop.
-        if (!PROVIDER_SSE_IDLE_WATCHDOG_ENABLED) return;
-        if (idleTimer) clearTimeout(idleTimer);
-        idleTimer = setTimeout(() => {
-            idleTimedOut = true;
-            try { abortStream?.(); } catch (err) {
-                try { process.stderr.write(`[anthropic-oauth] sse idle abortStream failed: ${err?.message ?? String(err)}\n`); } catch {}
-            }
-            try {
-                const _c = reader.cancel('SSE idle timeout');
-                if (_c && typeof _c.catch === 'function') _c.catch(() => {});
-            } catch (err) {
-                try { process.stderr.write(`[anthropic-oauth] sse idle cancel failed: ${err?.message ?? String(err)}\n`); } catch {}
-            }
-            // Force-reject the in-flight reader.read() race even when reader.cancel()
-            // fails to settle the pending read: without this the await below stays
-            // pending forever and the SSE idle timeout never unblocks the loop —
-            // the 391s-hang root cause.
-            if (idleReject) {
-                const e = _attachStallPartial(streamStalledError('Anthropic OAuth SSE', SSE_IDLE_TIMEOUT_MS, { emittedToolCall: !!state?.emittedToolCall }));
-                const r = idleReject; idleReject = null; r(e);
-            }
-        // Shared provider policy: short SEMANTIC-event inactivity catches the
-        // ping-only wedge where SSE starts, emits some deltas, then goes silent
-        // while `:ping` keepalives keep the transport socket warm.
-        }, SSE_IDLE_TIMEOUT_MS);
-        try { idleTimer.unref?.(); } catch {}
-    };
-
-    const onAbort = () => {
-        try {
-            const _c = reader.cancel('SSE aborted');
-            if (_c && typeof _c.catch === 'function') _c.catch(() => {});
-        } catch {}
-    };
-    if (signal) {
-        if (signal.aborted) {
-            _captureMidstreamAbort(state, signal.reason);
-            throw signal.reason instanceof Error
-                ? signal.reason
-                : new Error('Anthropic OAuth SSE stream aborted');
-        }
-        signal.addEventListener('abort', onAbort, { once: true });
-    }
-
-    try {
-        // Part A / reviewer fix: do NOT arm the SEMANTIC idle timer before the
-        // stream has produced its first event. A slow first response is governed
-        // by armFirstMessageTimer() (first-byte window) alone; arming the
-        // semantic idle here could let it win and mis-abort a legitimately slow
-        // first response as a stall. The semantic idle is first armed at
-        // `message_start` (see below), so it only ever guards MID-stream silence.
-        armFirstMessageTimer();
-        streamLoop: while (true) {
-            let chunk;
-            try {
-                // Race the read against the idle timer's rejector so a stuck
-                // reader.read() (cancel did not settle it) still unblocks here.
-                chunk = await new Promise((resolve, reject) => {
-                    idleReject = reject;
-                    reader.read().then(resolve, reject);
-                });
-            } catch (err) {
-                if (idleTimedOut) {
-                    throw _attachStallPartial(streamStalledError('Anthropic OAuth SSE', SSE_IDLE_TIMEOUT_MS, { emittedToolCall: !!state?.emittedToolCall }));
-                }
-                if (firstMessageTimedOut) {
-                    throw firstMessageTimeoutError();
-                }
-                if (signal?.aborted) {
-                    _captureMidstreamAbort(state, signal.reason);
-                    throw signal.reason instanceof Error
-                        ? signal.reason
-                        : new Error('Anthropic OAuth SSE stream aborted');
-                }
-                throw err;
-            }
-            const { done, value } = chunk;
-            if (done) break;
-
-            buffer += decoder.decode(value, { stream: true });
-            const lines = buffer.split('\n');
-            buffer = lines.pop() || '';
-
-            for (const line of lines) {
-                if (line.startsWith(':')) {
-                    // SSE comment frame (Anthropic `:ping` keepalive). Keep it
-                    // at transport level only: comments must not refresh the
-                    // agent's semantic progress timestamp, or a ping-only 200
-                    // can look alive forever without message_start/content.
-                    // Crucially it also does NOT reset the SEMANTIC idle timer
-                    // below — a ping-only wedge must trip the idle abort.
-                    continue;
-                }
-                // Blank lines are SSE record separators — emitted after EVERY
-                // frame, including `:ping` keepalives — so they are NOT semantic
-                // progress and must not reset the idle timer (else a ping frame's
-                // trailing blank would keep a wedge alive forever).
-                if (line === '') continue;
-                if (line.startsWith('event: ')) {
-                    currentEvent = line.slice(7).trim();
-                    continue;
-                }
-                if (!line.startsWith('data: ')) continue;
-                const data = line.slice(6).trim();
-                if (!data) continue;
-
-                try {
-                    const event = JSON.parse(data);
-
-                    // SEMANTIC idle reset (Part A): reset the idle timer ONLY for
-                    // real progress events, NOT for Anthropic keepalives. Anthropic
-                    // sends pings as a NAMED event (`event: ping` /
-                    // `data: {"type":"ping"}`), not just `:` comment frames, so a
-                    // named ping must be excluded here or a ping-only wedge keeps
-                    // the timer alive forever. Everything that is not a ping is a
-                    // genuine server event (message_start/content/tool/thinking
-                    // deltas, message_delta/stop, errors) and counts as progress.
-                    if (currentEvent !== 'ping' && event?.type !== 'ping') {
-                        resetIdleTimer();
-                    }
-
-                    if (currentEvent === 'error' || event?.type === 'error' || event?.error) {
-                        throw _anthropicSseError(event);
-                    }
-
-                    if (event.type === 'message_start' && event.message) {
-                        clearFirstMessageTimer();
-                        if (state) state.sawMessageStart = true;
-                        if (event.message.model) model = event.message.model;
-                        if (event.message.usage) {
-                            usage.inputTokens = event.message.usage.input_tokens || 0;
-                            usage.cachedTokens = event.message.usage.cache_read_input_tokens || 0;
-                            usage.cacheWriteTokens = event.message.usage.cache_creation_input_tokens || 0;
-                            usage.raw = { ...event.message.usage };
-                        }
-                    }
-
-                    if (event.type === 'content_block_start') {
-                        const block = event.content_block;
-                        if (block?.type === 'tool_use') {
-                            pendingToolInputs.set(event.index, {
-                                id: block.id || '',
-                                name: block.name || '',
-                                inputJson: '',
-                            });
-                        }
-                    }
-
-                    if (event.type === 'content_block_delta') {
-                        const delta = event.delta;
-                        if (delta?.type) contentBlockTypes.add(delta.type);
-                        // Time-to-first-token: stamp the first content delta
-                        // (text / thinking / tool input_json) exactly once so
-                        // the SSE trace can separate first-byte latency from
-                        // total stream/generation time. Without this stamp
-                        // ttftMs was always null and reported as 0ms.
-                        if (state && !state.ttftAt) state.ttftAt = Date.now();
-                        if (delta?.type === 'text_delta') {
-                            try { onStreamDelta?.(); } catch {}
-                            // Live text relay (gateway): forward the explicit
-                            // text chunk. thinking/signature/input_json deltas
-                            // intentionally stay off this path.
-                            // Invariant: once a non-empty chunk has been relayed
-                            // live it cannot be withdrawn, so flag the attempt so
-                            // the mid-stream retry loop treats any later failure
-                            // as final (a retry would concatenate attempts).
-                            if (_leakGuardEnabled) {
-                                // Route text through the leaked-tool-call guard.
-                                // It appends to `content`, forwards visible text
-                                // via onTextDelta, and synthesizes/dispatches any
-                                // recovered known-tool call — suppressing the
-                                // tags from the visible stream. A partial sentinel
-                                // is held in leakBuffer until the next chunk.
-                                leakBuffer += delta.text || '';
-                                pumpLeakBuffer(false);
-                            } else {
-                                content += delta.text || '';
-                                if (delta.text && onTextDelta) {
-                                    if (state) state.emittedText = true;
-                                    try { onTextDelta(delta.text); } catch {}
-                                }
-                            }
-                        }
-                        if (delta?.type === 'thinking_delta' || delta?.type === 'signature_delta') {
-                            // Extended-thinking block: provider reasoning without
-                            // user-visible text. Track presence so a final turn
-                            // that emitted ONLY thinking (no text_delta, no
-                            // tool_use) can be classified by the loop as
-                            // synthesis-stalled rather than silent empty.
-                            hasThinkingContent = true;
-                            try { onStreamDelta?.(); } catch {}
-                        }
-                        if (delta?.type === 'input_json_delta') {
-                            const pending = pendingToolInputs.get(event.index);
-                            if (pending) {
-                                pending.inputJson += delta.partial_json || '';
-                            }
-                            try { onStreamDelta?.(); } catch {}
-                        }
-                    }
-
-                    if (event.type === 'content_block_stop') {
-                        const pending = pendingToolInputs.get(event.index);
-                        if (pending) {
-                            // Bare JSON.parse threw straight up into the
-                            // surrounding broad catch, which swallowed the
-                            // whole tool_call — the loop never saw it and
-                            // the assistant turn ended with an unmatched
-                            // tool_use id. Wrap the parse so a malformed
-                            // input still produces a tool_call (with an
-                            // invalid-args marker and a logged error) instead
-                            // of a silent drop or accidental `{}` dispatch.
-                            let parsedArgs = {};
-                            if (pending.inputJson) {
-                                try { parsedArgs = JSON.parse(pending.inputJson); }
-                                catch (parseErr) {
-                                    process.stderr.write(`[anthropic-oauth] tool args JSON.parse failed (id=${pending.id}, name=${pending.name}): ${parseErr?.message || parseErr}\n`);
-                                    parsedArgs = makeInvalidToolArgsMarker(pending.inputJson, parseErr instanceof Error ? parseErr.message : String(parseErr));
-                                }
-                            }
-                            // Tool arguments must be a plain object. Anthropic's
-                            // tool_use input is always a JSON object, but a
-                            // malformed stream could parse to an array/string/
-                            // number — wrap those as {} to keep the contract
-                            // (invariant-based, no heuristic coercion).
-                            if (parsedArgs === null
-                                || typeof parsedArgs !== 'object'
-                                || Array.isArray(parsedArgs)) {
-                                process.stderr.write(`[anthropic-oauth] tool args not a plain object (id=${pending.id}, name=${pending.name}, type=${Array.isArray(parsedArgs) ? 'array' : typeof parsedArgs}); using {}\n`);
-                                parsedArgs = {};
-                            }
-                            const call = {
-                                id: pending.id,
-                                name: pending.name,
-                                arguments: parsedArgs,
-                            };
-                            pendingToolInputs.delete(event.index);
-                            // Eager dispatch: let the loop start this tool
-                            // before message_stop arrives. The loop keys
-                            // pending promises by call.id so order is safe.
-                            // Fix 2: skip the ENTIRE call (push + dispatch) when a
-                            // text-leaked synthetic of the same (name,args) already
-                            // fired — otherwise the duplicate stays in `toolCalls`
-                            // and the loop executes the side-effecting tool twice.
-                            // An invalid-args marker never fingerprint-collides with
-                            // a real recovered call, so malformed native calls still
-                            // dispatch (the marker path is unaffected).
-                            if (_toolDedupe.shouldDispatch(call.name, call.arguments)) {
-                                toolCalls.push(call);
-                                if (state) state.emittedToolCall = true;
-                                // Eager dispatch: let the loop start this tool
-                                // before message_stop arrives. The loop keys
-                                // pending promises by call.id so order is safe.
-                                try { onToolCall?.(call); } catch {}
-                            }
-                            try { onStreamDelta?.(); } catch {}
-                        }
-                    }
-
-                    if (event.type === 'message_delta') {
-                        if (event.delta?.stop_reason) {
-                            stopReason = event.delta.stop_reason;
-                        }
-                        if (event.usage) {
-                            usage.outputTokens = event.usage.output_tokens || 0;
-                            usage.raw = { ...(usage.raw || {}), ...event.usage };
-                        }
-                        if (stopReason === 'tool_use' && toolCalls.length > 0 && pendingToolInputs.size === 0) {
-                            if (state) state.sawCompleted = true;
-                            break streamLoop;
-                        }
-                    }
-                    if (event.type === 'message_stop') {
-                        if (state) state.sawCompleted = true;
-                        // Anthropic streams can keep emitting `:ping` keepalive
-                        // frames after `message_stop`; if we wait for EOF the
-                        // outer reader.read() loop hangs indefinitely. Break
-                        // out of streamLoop the moment the message ends.
-                        break streamLoop;
-                    }
-                    // Unified prompt volume — what the model actually ingested.
-                    // Anthropic splits input into three billable slots (uncached
-                    // input + cache_read + cache_create); keep them separate for
-                    // cost math but also expose the sum so cross-provider logs
-                    // have a consistent `promptTokens` meaning.
-                    usage.promptTokens = (usage.inputTokens || 0)
-                        + (usage.cachedTokens || 0)
-                        + (usage.cacheWriteTokens || 0);
-                } catch (err) {
-                    if (err?.code === 'EANTHROPIC_SSE_ERROR') throw err;
-                    /* skip malformed events */
-                }
-            }
-        }
-
-        // Stream ended: flush any held-back leaked-tool-call buffer. `final`
-        // holds nothing back, so a trailing partial sentinel that never
-        // resolved into a real call is surfaced as ordinary text — legitimate
-        // user-visible content is never lost on the failure path.
-        pumpLeakBuffer(true);
-
-        // Truncated-stream guard: if the reader loop exited (EOF or break)
-        // after message_start but without seeing message_stop / a tool_use
-        // stop_reason, the assistant turn was cut off mid-flight. Returning
-        // success here would silently surface partial content (or a partially
-        // streamed tool_use whose input_json never completed) as final.
-        // Throw a typed truncated-stream error so the loop can decide whether
-        // to retry, surface, or escalate instead of accepting the partial.
-        if (state?.sawMessageStart && !state?.sawCompleted) {
-            const pendingToolUse = pendingToolInputs.size > 0;
-            const err = Object.assign(
-                new Error(
-                    `Anthropic OAuth SSE stream truncated: message_start without message_stop`
-                    + (pendingToolUse ? ` (pending tool_use input)` : ''),
-                ),
-                {
-                    name: 'TruncatedStreamError',
-                    code: 'TRUNCATED_STREAM',
-                    truncatedStream: true,
-                    pendingToolUse,
-                    stopReason,
-                },
-            );
-            throw err;
-        }
-
-        return {
-            content,
-            model,
-            toolCalls: toolCalls.length ? toolCalls : undefined,
-            usage,
-            stopReason,
-            hasThinkingContent,
-            contentBlockTypes: Array.from(contentBlockTypes),
-        };
-    } finally {
-        if (idleTimer) clearTimeout(idleTimer);
-        clearFirstMessageTimer();
-        if (signal) signal.removeEventListener('abort', onAbort);
-        try { reader.releaseLock(); } catch (err) {
-            try { process.stderr.write(`[anthropic-oauth] reader releaseLock failed: ${err?.message ?? String(err)}\n`); } catch {}
-        }
-    }
-}
-
-/**
- * Classify an Anthropic SSE failure for single-shot mid-stream retry.
- *
- * Retry is allowed only after `message_start` and before `message_stop`,
- * and only when no tool call has already been surfaced to the loop.
- * That keeps recovery limited to transport/stream stalls without risking
- * duplicate eager tool execution.
- */
-// Thin wrapper: the SSE mid-stream decision tree now lives in the shared
-// classifyMidstreamError (retry-classifier.mjs, policy.mode='sse'). Kept as a
-// named export so internal call sites AND anthropic.mjs (which imports this
-// symbol) keep resolving it. Behavior is byte-identical — the shared function
-// is the relocated original, gated by SSE_MIDSTREAM_POLICY (defaultRetries=3,
-// perClassifierGate:false).
-export function _classifyMidstreamError(err, state) {
-    return classifyMidstreamError(err, state, SSE_MIDSTREAM_POLICY);
-}
+// --- SSE parser + midstream retry policy: extracted to anthropic-sse.mjs ---
 
 // --- Build request body ---
 
@@ -1562,12 +487,30 @@ function resolveCacheTtls(opts) {
     // free for sessions that don't carry one. Previously null here meant any
     // caller that skipped agent runtime resolve (CLI, raw agent spawn)
     // silently lost the tier3 cache layer even though it supported one.
-    return {
+    const resolved = {
         tools: pick('tools', null),
         system: pick('system', CACHE_TTL_STABLE),
         tier3: pick('tier3', CACHE_TTL_STABLE),
         messages: pick('messages', CACHE_TTL_STABLE),
     };
+    // A partial cacheStrategy override (e.g. {system:'5m'} while tier3/
+    // messages default to '1h') can put a longer TTL after a shorter one in
+    // request order, which Anthropic rejects: 1h breakpoints must all appear
+    // before any 5m breakpoint. Normalize left-to-right in wire order
+    // (system -> tier3 -> messages; tools is emitted before system and is
+    // excluded from the run) so a later layer is downgraded to the earliest
+    // shorter TTL seen so far — never re-promoted. Layers set to null ('none')
+    // emit no breakpoint at all, so they neither violate nor constrain
+    // ordering and are skipped.
+    const ttlRank = (ttl) => (ttl === CACHE_TTL_STABLE ? 2 : 1); // 1h=2, 5m=1
+    let minRank = Infinity;
+    for (const layer of ['system', 'tier3', 'messages']) {
+        if (!resolved[layer]) continue;
+        const rank = ttlRank(resolved[layer]);
+        if (rank > minRank) resolved[layer] = CACHE_TTL_VOLATILE;
+        else minRank = rank;
+    }
+    return resolved;
 }
 
 // BP3 (tier3) is injected by session/manager as its own `system` role block —
@@ -1790,6 +733,11 @@ export class AnthropicOAuthProvider {
         if (body.speed === 'fast') {
             this.fastModeBetaHeaderLatched = true;
         }
+        // advanced-tool-use-2025-11-20 beta is only needed when this request
+        // actually carries deferred (defer_loading) tools — gate the header on
+        // that instead of sending it unconditionally on every request.
+        const hasDeferredTools = Array.isArray(body.tools)
+            && body.tools.some((t) => t && t.defer_loading === true);
         // Known tool names for the leaked-tool-call guard in parseSSEStream:
         // recovered leaked calls are only synthesized when they name a tool
         // actually offered to this request (native + lowered). Derived from the
@@ -1866,7 +814,7 @@ export class AnthropicOAuthProvider {
                         'anthropic-beta': buildAnthropicBetaHeaders({
                             base: OAUTH_BETA_HEADERS,
                             fastMode: this.fastModeBetaHeaderLatched,
-                            toolSearch: true,
+                            toolSearch: hasDeferredTools,
                             effort: shouldIncludeEffortBeta(useModel, opts),
                         }),
                         'anthropic-dangerous-direct-browser-access': 'true',
@@ -2195,7 +1143,7 @@ export class AnthropicOAuthProvider {
         // works offline or when Anthropic's /v1/models is momentarily down.
         const cached = await _loadModelCache();
         if (cached) {
-            _inMemoryCatalog = cached.slice();
+            _setInMemoryCatalog(cached);
             return cached;
         }
         try {
@@ -2216,13 +1164,8 @@ export class AnthropicOAuthProvider {
             if (!res.ok) throw new Error(`list_models ${res.status}`);
             const data = await res.json();
             const items = Array.isArray(data?.data) ? data.data : [];
-            const normalized = items
-                .map(m => _normalizeAnthropicModel(m))
-                .filter(Boolean);
-            _markLatestByFamily(normalized);
-            // Enrich with LiteLLM catalog metadata (context, pricing, capabilities)
-            const enriched = await enrichModels(normalized);
-            await _saveModelCache(enriched);
+            // Normalize + mark-latest + LiteLLM-enrich + persist (shared helper).
+            const enriched = await normalizeAndSaveCatalog(items);
             return enriched;
         } catch (err) {
             if (!process.env.MIXDOG_QUIET_PROVIDER_LOG) process.stderr.write(`[anthropic-oauth] listModels fetch failed (${err.message})\n`);
@@ -2264,12 +1207,7 @@ export class AnthropicOAuthProvider {
                 if (!res.ok) throw new Error(`list_models ${res.status}`);
                 const data = await res.json();
                 const items = Array.isArray(data?.data) ? data.data : [];
-                const normalized = items
-                    .map(m => _normalizeAnthropicModel(m))
-                    .filter(Boolean);
-                _markLatestByFamily(normalized);
-                const enriched = await enrichModels(normalized);
-                await _saveModelCache(enriched);
+                const enriched = await normalizeAndSaveCatalog(items);
                 if (!process.env.MIXDOG_QUIET_PROVIDER_LOG) process.stderr.write(`[anthropic-oauth] catalog refreshed (${enriched.length} models)\n`);
                 return enriched;
             } catch (err) {
@@ -2287,204 +1225,20 @@ export class AnthropicOAuthProvider {
     }
 }
 
-// --- Login flow (PKCE loopback, export for setup UI / CLI) ---
-
-function _oauthGeneratePKCE() {
-    const verifier = randomBytes(32).toString('base64url');
-    const challenge = createHash('sha256').update(verifier).digest('base64url');
-    return { verifier, challenge };
-}
-
-function _oauthCredentialsWritePath() {
-    for (const p of credentialCandidates()) {
-        if (existsSync(p)) return p;
-    }
-    return DEFAULT_CREDENTIALS_PATH;
-}
-
-function _oauthParseScopeField(scope) {
-    if (Array.isArray(scope)) return scope;
-    return String(scope || '').split(' ').filter(Boolean);
-}
-
-function _parseOAuthCodeInput(input) {
-    const value = String(input || '').trim();
-    if (!value) return { code: '', state: '' };
-    try {
-        const url = new URL(value);
-        const code = url.searchParams.get('code') || '';
-        const state = url.searchParams.get('state') || '';
-        if (code || state) return { code, state, redirectUri: `${url.origin}${url.pathname}` };
-    } catch { /* not a URL */ }
-    if (value.includes('#')) {
-        const [code, state] = value.split('#', 2);
-        return { code: String(code || '').trim(), state: String(state || '').trim() };
-    }
-    if (value.includes('code=')) {
-        const params = new URLSearchParams(value.startsWith('?') ? value.slice(1) : value);
-        return { code: params.get('code') || '', state: params.get('state') || '' };
-    }
-    return { code: value, state: '' };
-}
-
-async function exchangeAuthorizationCode({ pkce, code, state, redirectUri }) {
-    const cleanCode = String(code || '').trim();
-    if (!cleanCode) throw new Error('[anthropic-oauth] authorization code is required');
-    const tokenRes = await fetch(TOKEN_URL, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            'anthropic-dangerous-direct-browser-access': 'true',
-            'user-agent': `claude-cli/${resolveCliVersion()} (external, sdk-cli)`,
-        },
-        body: JSON.stringify({
-            grant_type: 'authorization_code',
-            code: cleanCode,
-            redirect_uri: redirectUri,
-            client_id: CLAUDE_CODE_CLIENT_ID,
-            code_verifier: pkce.verifier,
-            state,
-        }),
-        redirect: 'error',
-        signal: AbortSignal.timeout(OAUTH_TOKEN_TIMEOUT_MS),
-        dispatcher: getLlmDispatcher(),
-    });
-    if (!tokenRes.ok) {
-        const text = await tokenRes.text().catch(() => '');
-        throw new Error(`[anthropic-oauth] token exchange ${tokenRes.status}: ${_scrubTokens(text).slice(0, 500)}`);
-    }
-    const json = await tokenRes.json();
-    const accessToken = json?.access_token || json?.accessToken;
-    const refreshToken = json?.refresh_token || json?.refreshToken;
-    if (!accessToken || !refreshToken) {
-        throw new Error('[anthropic-oauth] token exchange response missing access_token or refresh_token');
-    }
-    const expiresAt = _normalizeExpiresAt(json?.expires_at ?? json?.expiresAt)
-        || (typeof json?.expires_in === 'number' ? Date.now() + json.expires_in * 1000 : 0);
-    const scopes = _oauthParseScopeField(json?.scope);
-    const credPath = _oauthCredentialsWritePath();
-    let raw = {};
-    if (existsSync(credPath)) {
-        raw = JSON.parse(readFileSync(credPath, 'utf-8'));
-    }
-    const existingOauth = raw.claudeAiOauth || {};
-    raw.claudeAiOauth = {
-        ...existingOauth,
-        accessToken,
-        refreshToken,
-        expiresAt,
-        scopes,
-        subscriptionType: existingOauth.subscriptionType ?? null,
-    };
-    _saveCredentialsFile(credPath, raw);
-    return {
-        path: credPath,
-        accessToken,
-        refreshToken,
-        expiresAt,
-        scopes,
-        subscriptionType: raw.claudeAiOauth.subscriptionType,
-    };
-}
-
-export async function beginOAuthLogin() {
-    const pkce = _oauthGeneratePKCE();
-    const state = randomBytes(32).toString('base64url');
-    const buildUrl = (redirectUri) => {
-        const url = new URL(CLAUDE_AI_AUTHORIZE_URL);
-        url.searchParams.set('code', 'true');
-        url.searchParams.set('client_id', CLAUDE_CODE_CLIENT_ID);
-        url.searchParams.set('response_type', 'code');
-        url.searchParams.set('redirect_uri', redirectUri);
-        url.searchParams.set('scope', OAUTH_LOGIN_SCOPE);
-        url.searchParams.set('code_challenge', pkce.challenge);
-        url.searchParams.set('code_challenge_method', 'S256');
-        url.searchParams.set('state', state);
-        return url;
-    };
-    const url = buildUrl(OAUTH_REDIRECT_URI);
-    const manualUrl = buildUrl(OAUTH_MANUAL_REDIRECT_URI);
-
-    let server = null;
-    let timeout = null;
-    let finish = null;
-    const waitForCallback = new Promise((resolve, reject) => {
-        let settled = false;
-        finish = (value, error = null) => {
-            if (settled) return;
-            settled = true;
-            if (timeout) clearTimeout(timeout);
-            try { server?.close(); } catch { /* already closed */ }
-            if (error) reject(error);
-            else resolve(value);
-        };
-        server = createServer(async (req, res) => {
-            const u = new URL(req.url || '/', `http://${OAUTH_CALLBACK_HOST}:${OAUTH_CALLBACK_PORT}`);
-            if (u.pathname !== OAUTH_CALLBACK_PATH) {
-                res.writeHead(404);
-                res.end();
-                return;
-            }
-            const code = u.searchParams.get('code');
-            if (!code || u.searchParams.get('state') !== state) {
-                res.writeHead(400);
-                res.end('Invalid');
-                finish(null);
-                return;
-            }
-            try {
-                const tokens = await exchangeAuthorizationCode({ pkce, code, state, redirectUri: OAUTH_REDIRECT_URI });
-                res.writeHead(302, { Location: OAUTH_SUCCESS_REDIRECT_URL });
-                res.end();
-                finish(tokens);
-            } catch (err) {
-                const error = err instanceof Error ? err : new Error(String(err));
-                res.writeHead(500, { 'Content-Type': 'text/plain; charset=utf-8' });
-                res.end(`Claude login failed: ${error.message}`);
-                finish(null, error);
-            }
-        });
-        timeout = setTimeout(() => finish(null), OAUTH_LOGIN_TIMEOUT_MS);
-        server.listen(OAUTH_CALLBACK_PORT, OAUTH_CALLBACK_HOST, async () => {
-            process.stderr.write(`\n[anthropic-oauth] Open this URL to log in with Claude:\n${url.toString()}\n\nIf the localhost callback cannot complete, open this manual URL and paste the shown code#state:\n${manualUrl.toString()}\n\n`);
-            try {
-                const { openInBrowser } = await import('../../../shared/open-url.mjs');
-                openInBrowser(url.toString());
-            } catch (err) {
-                process.stderr.write(`[anthropic-oauth] browser open failed: ${String(err?.message || err).slice(0, 200)}\n`);
-            }
-        });
-        server.on('error', (err) => finish(null, new Error(`[anthropic-oauth] callback server failed on ${OAUTH_CALLBACK_HOST}:${OAUTH_CALLBACK_PORT}: ${err?.message || err}`)));
-    });
-
-    return {
-        provider: 'anthropic-oauth',
-        url: url.toString(),
-        manualUrl: manualUrl.toString(),
-        waitForCallback,
-        completeCode: async (input) => {
-            const parsed = _parseOAuthCodeInput(input);
-            if (parsed.state && parsed.state !== state) throw new Error('[anthropic-oauth] OAuth state mismatch');
-            const redirectUri = parsed.redirectUri || (parsed.state ? OAUTH_MANUAL_REDIRECT_URI : OAUTH_REDIRECT_URI);
-            const tokens = await exchangeAuthorizationCode({ pkce, code: parsed.code, state, redirectUri });
-            finish?.(tokens);
-            return tokens;
-        },
-        cancel: () => {
-            finish?.(null);
-        },
-    };
-}
-
-export async function loginOAuth() {
-    const login = await beginOAuthLogin();
-    return await login.waitForCallback;
-}
+// Re-exports so external callers of anthropic-oauth.mjs keep their existing
+// import path after the credential/login-flow extraction into
+// anthropic-oauth-credentials.mjs.
+export {
+    hasAnthropicOAuthCredentials,
+    describeAnthropicOAuthCredentials,
+    forgetAnthropicOAuthCredentials,
+    beginOAuthLogin,
+    loginOAuth,
+};
 
-// Additive exports for test harnesses.
-// Lets the SSE parser be exercised in isolation against a synthetic
-// ReadableStream without needing a live OAuth session.
-export { parseSSEStream };
+// Re-exports so anthropic.mjs and the test harnesses keep their existing
+// import path after the SSE-parser extraction into anthropic-sse.mjs.
+export { parseSSEStream, _classifyMidstreamError, ANTHROPIC_MAX_MIDSTREAM_RETRIES };
 
 // Test-only escape hatch for scripts/tool-smoke.mjs to verify the
 // catalog-driven max-tokens resolution without duplicating its logic.