mixdog 0.9.87 → 0.9.89

package/src/runtime/agent/orchestrator/providers/anthropic-sse.mjs

@@ -15,9 +15,15 @@ import {
     classifyMidstreamError,
     MIDSTREAM_RETRY_POLICY,
     sleepWithAbort,
+    typedStatusFrom,
 } from './retry-classifier.mjs';
 import { makeInvalidToolArgsMarker } from './openai-compat-stream.mjs';
 import { scanLeakedToolCalls, createToolCallDedupe } from './anthropic-leaked-toolcall.mjs';
+import {
+    NATIVE_SERVER_TOOL_CALL_BLOCK_TYPES,
+    NATIVE_SERVER_TOOL_RESULT_BLOCK_TYPES,
+} from './lib/anthropic-native-blocks.mjs';
+import { stampStreamOutcome, STREAM_TRANSPORTS, STREAM_OUTCOME_VERSION } from './lib/stream-outcome.mjs';
 
 /** Bounded mid-stream SSE retries (transient stream loss); shared with anthropic.mjs.
  *  Sourced from the single shared retry-budget table (MIDSTREAM_RETRY_POLICY.sse). */
@@ -51,15 +57,32 @@ export function _midstreamSleepWithAbort(ms, signal, sleepFn) {
     return sleepWithAbort(ms, signal, sleepFn, 'Anthropic OAuth mid-stream retry backoff aborted');
 }
 
-function _statusForAnthropicSseError(type, message) {
-    const kind = String(type || '').toLowerCase();
-    const text = String(message || '').toLowerCase();
-    if (kind.includes('overload') || text.includes('overload')) return 503;
-    if (kind.includes('rate_limit') || text.includes('rate limit') || text.includes('quota')) return 429;
-    if (kind.includes('authentication') || text.includes('authentication') || text.includes('unauthorized')) return 401;
-    if (kind.includes('permission') || text.includes('forbidden')) return 403;
-    if (kind.includes('not_found') || text.includes('not found')) return 404;
-    if (kind.includes('invalid_request')) return 400;
+// Anthropic's documented error-event `type` enumeration → HTTP equivalent.
+// This is STRUCTURED evidence (an explicit wire field with a closed value set),
+// never a message-text guess: an event whose only hint is prose keeps no status
+// at all, so the retry/auth layers see it as unknown and terminate the turn.
+const ANTHROPIC_SSE_ERROR_TYPE_STATUS = new Map([
+    ['invalid_request_error', 400],
+    ['authentication_error', 401],
+    ['permission_error', 403],
+    ['not_found_error', 404],
+    ['request_too_large', 413],
+    ['rate_limit_error', 429],
+    ['api_error', 500],
+    ['overloaded_error', 503],
+]);
+
+function _statusForAnthropicSseError(event, payload) {
+    // 1) A real numeric status carried by the event/error payload.
+    const numeric = typedStatusFrom(payload, event);
+    if (numeric) return numeric;
+    // 2) The explicit structured error type/code (exact enumeration match).
+    for (const field of [payload?.type, payload?.code, event?.error?.type, event?.error?.code]) {
+        const key = typeof field === 'string' ? field.trim().toLowerCase() : '';
+        if (key && ANTHROPIC_SSE_ERROR_TYPE_STATUS.has(key)) {
+            return ANTHROPIC_SSE_ERROR_TYPE_STATUS.get(key);
+        }
+    }
     return 0;
 }
 
@@ -72,7 +95,7 @@ function _anthropicSseError(event) {
     err.code = 'EANTHROPIC_SSE_ERROR';
     err.providerErrorType = type;
     err.requestId = event?.request_id || event?.requestId || null;
-    const status = _statusForAnthropicSseError(type, message);
+    const status = _statusForAnthropicSseError(event, payload);
     if (status) {
         err.httpStatus = status;
         err.status = status;
@@ -80,6 +103,21 @@ function _anthropicSseError(event) {
     return err;
 }
 
+// Anthropic NATIVE (server-side) tool blocks. Anthropic runs these itself and
+// returns both the CALL block (`server_tool_use`, streamed `input`) and its
+// RESULT block (`web_search_tool_result`, …, delivered whole). They are never
+// dispatched to the agent loop, so they only survive a continuation turn if
+// they are captured here and replayed verbatim in original block order. The
+// type sets are shared with the non-streaming normalizer so both transports
+// classify identically (see lib/anthropic-native-blocks.mjs).
+
+// Detach the provider payload from the parser's event object without altering
+// any field (opaque server-tool result payloads must round-trip byte-exact).
+function cloneNativeBlock(block) {
+    try { return structuredClone(block); }
+    catch { return { ...block }; }
+}
+
 export async function parseSSEStream(response, signal, abortStream, onStreamDelta, onToolCall, state, onTextDelta, knownToolNames) {
     // onStreamDelta is a semantic-progress callback. HTTP headers and raw SSE
     // bytes prove transport health but must not refresh semantic watchdogs.
@@ -107,6 +145,58 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
     // it can be round-tripped verbatim on tool-continuation turns (required
     // back on tool_use turns; empty thinking + signature is valid).
     const thinkingBlocks = new Map();
+    // Ordered NATIVE (server-side) tool blocks, keyed by content_block index.
+    // Anthropic executes these itself — they are never dispatched to the agent
+    // loop as client tool calls — but they are part of the assistant turn and
+    // MUST be replayed verbatim, in original block order, on a continuation
+    // turn (pause_turn): a `web_search_tool_result` is only valid immediately
+    // after the `server_tool_use` block that produced it.
+    const nativeServerToolBlocks = new Map();
+    // Streamed `input` JSON for native server-tool CALL blocks (same
+    // input_json_delta transport as client tool_use, separate index space).
+    const pendingNativeToolInputs = new Map();
+    // In-flight tool INPUT state: a client `tool_use` (pendingToolInputs) or an
+    // Anthropic-native `server_tool_use` (pendingNativeToolInputs) whose
+    // streamed input_json has not reached content_block_stop. While either is
+    // non-empty the assistant turn cannot be terminal: the arguments are
+    // incomplete, so the call was never pushed and never dispatched.
+    const _toolInputInFlight = () => pendingToolInputs.size > 0 || pendingNativeToolInputs.size > 0;
+    // Set when a terminal frame (message_stop) arrived while input was still in
+    // flight — used only to word the truncated-stream failure precisely.
+    let sawTerminalFrameWithPendingInput = false;
+    // Ordered assistant content builders. Shared by the SUCCESS return and the
+    // truncation failure so a cut-off turn preserves exactly the same completed
+    // native/client blocks (verbatim, in original content_block order) that a
+    // successful turn would have replayed.
+    const _orderedThinkingBlocks = () => (thinkingBlocks.size
+        ? [...thinkingBlocks.entries()].sort((a, b) => a[0] - b[0]).map(([, b]) => b)
+        : undefined);
+    // A native CALL block is seeded at content_block_start and only gains its
+    // parsed `input` at content_block_stop, so a block whose input JSON is
+    // still streaming is INCOMPLETE and must never enter the replay list: it
+    // would be replayed with empty/partial arguments. Completed blocks only.
+    const _completedNativeBlocks = () => [...nativeServerToolBlocks.entries()]
+        .filter(([index]) => !pendingNativeToolInputs.has(index));
+    const _orderedAssistantBlocks = () => {
+        const nativeBlocks = _completedNativeBlocks();
+        if (!nativeBlocks.length) return undefined;
+        return [
+            ...[...thinkingBlocks.entries()],
+            ...[...textBlocks.entries()]
+                .filter(([, text]) => typeof text === 'string' && text.length > 0)
+                .map(([index, text]) => [index, { type: 'text', text }]),
+            ...nativeBlocks,
+            ...[...clientToolUseBlocks.entries()],
+        ]
+            .sort((a, b) => a[0] - b[0])
+            .map(([, block]) => block);
+    };
+    // Per-index raw text, kept only so the ordered native-block replay list
+    // below can interleave text exactly where the provider emitted it.
+    const textBlocks = new Map();
+    // Client tool_use blocks that were actually dispatched, kept for the same
+    // ordered replay list (deduped/skipped calls are intentionally absent).
+    const clientToolUseBlocks = new Map();
     let model = '';
     let toolCalls = [];
     let usage = { inputTokens: 0, outputTokens: 0, cachedTokens: 0, cacheWriteTokens: 0, raw: null };
@@ -240,12 +330,48 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
         try {
             err.partialContent = content;
             err.partialToolCalls = toolCalls.length ? toolCalls.slice() : undefined;
-            err.pendingToolUse = pendingToolInputs.size > 0;
+            // `_toolInputInFlight()` is the single authority for "arguments
+            // never finished streaming": a client tool_use OR an Anthropic
+            // NATIVE server_tool_use whose input JSON is still open. A mixed
+            // turn (dispatched client call, then an incomplete server_tool_use)
+            // must stay a continuation failure — promoting it would report a
+            // native call that never ran as part of a finished turn.
+            err.pendingToolUse = _toolInputInFlight();
             err.partialModel = model || undefined;
             err.partialUsage = usage;
             err.partialStopReason = stopReason || undefined;
             err.partialHasThinking = hasThinkingContent;
+            // A stalled continuation must carry the SAME ordered block state a
+            // successful turn returns: Anthropic requires the verbatim thinking
+            // blocks (signatures intact) back before tool_use on the next turn,
+            // and a native server_tool_use call is only valid immediately
+            // followed by its result block. Without these the recovered
+            // tool-call turn replays with the native/thinking state dropped.
+            err.partialThinkingBlocks = _orderedThinkingBlocks();
+            err.partialAssistantBlocks = _orderedAssistantBlocks();
         } catch { /* best-effort enrichment */ }
+        // Canonical stream-outcome contract. Anthropic historically attached
+        // ONLY the partial-state fields above, so retry/fallback/persistence
+        // consumers had to guess; the record makes terminal-vs-continuation,
+        // observed text/reasoning and tool exposure explicit and fail-closed.
+        try {
+            stampStreamOutcome(err, {
+                transport: STREAM_TRANSPORTS.SSE,
+                provider: 'anthropic',
+                terminalObserved: state?.sawCompleted === true,
+                continuation: state?.sawCompleted !== true,
+                textEmitted: state?.emittedText === true,
+                textObservedChars: content.length,
+                // Buffered/empty thinking blocks are not exposure; only
+                // relayed reasoning text is.
+                reasoningEmitted: state?.emittedThinking === true,
+                toolCallsStarted: state?.partialToolCall === true,
+                toolCallsComplete: toolCalls.length,
+                toolCallsDispatched: state?.emittedToolCall === true ? Math.max(1, toolCalls.length) : 0,
+                pendingToolInput: _toolInputInFlight(),
+                stallObserved: true,
+            });
+        } catch { /* stamping is best-effort */ }
         return err;
     };
 
@@ -407,9 +533,31 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                                 inputJson: '',
                             });
                         }
+                        if (block?.type === 'text') {
+                            // Seed the ordered text slot (a text block may open
+                            // with a non-empty `text` before any delta).
+                            textBlocks.set(
+                                event.index,
+                                (textBlocks.get(event.index) || '') + (typeof block.text === 'string' ? block.text : ''),
+                            );
+                        }
+                        if (NATIVE_SERVER_TOOL_CALL_BLOCK_TYPES.has(block?.type)) {
+                            // Verbatim seed; `input` is completed from the
+                            // streamed input_json_delta at content_block_stop.
+                            nativeServerToolBlocks.set(event.index, cloneNativeBlock(block));
+                            pendingNativeToolInputs.set(event.index, '');
+                            try { onStreamDelta?.('tool'); } catch {}
+                        } else if (NATIVE_SERVER_TOOL_RESULT_BLOCK_TYPES.has(block?.type)) {
+                            // Server-tool RESULT blocks arrive whole (no deltas);
+                            // keep the payload byte-for-byte for replay.
+                            nativeServerToolBlocks.set(event.index, cloneNativeBlock(block));
+                            try { onStreamDelta?.('tool'); } catch {}
+                        }
                         if (block?.type === 'thinking' || block?.type === 'redacted_thinking') {
-                            if (state) state.emittedThinking = true;
                             if (block.type === 'redacted_thinking') {
+                                // Opaque redacted payload: real reasoning
+                                // content, exposed as a block.
+                                if (state) state.emittedThinking = true;
                                 // Redacted blocks round-trip EXACTLY as
                                 // {type:'redacted_thinking',data} — no thinking/
                                 // signature fields (the API rejects the extras).
@@ -442,6 +590,10 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                         // ttftMs was always null and reported as 0ms.
                         if (state && !state.ttftAt) state.ttftAt = Date.now();
                         if (delta?.type === 'text_delta') {
+                            // Ordered verbatim text for native-block replay —
+                            // independent of the leak-guard's visible-stream
+                            // bookkeeping below (which may hold text back).
+                            textBlocks.set(event.index, (textBlocks.get(event.index) || '') + (delta.text || ''));
                             // Live text relay (gateway): forward the explicit
                             // text chunk. thinking/signature/input_json deltas
                             // intentionally stay off this path.
@@ -473,7 +625,14 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                             }
                         }
                         if (delta?.type === 'thinking_delta' || delta?.type === 'signature_delta') {
-                            if (state) state.emittedThinking = true;
+                            // Only actual reasoning TEXT counts as exposed
+                            // reasoning. An empty thinking block (a
+                            // signature-only delta from a display-omitted
+                            // model) shows the user nothing, so it must not
+                            // deny a replay.
+                            if (state && delta.type === 'thinking_delta' && delta.thinking) {
+                                state.emittedThinking = true;
+                            }
                             // Extended-thinking block: provider reasoning without
                             // user-visible text. Track presence so a final turn
                             // that emitted ONLY thinking (no text_delta, no
@@ -501,6 +660,13 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                             }
                         }
                         if (delta?.type === 'input_json_delta') {
+                            if (pendingNativeToolInputs.has(event.index)) {
+                                pendingNativeToolInputs.set(
+                                    event.index,
+                                    pendingNativeToolInputs.get(event.index) + (delta.partial_json || ''),
+                                );
+                                try { onStreamDelta?.('tool'); } catch {}
+                            }
                             if (state) state.partialToolCall = true;
                             const pending = pendingToolInputs.get(event.index);
                             if (pending) {
@@ -511,6 +677,25 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                     }
 
                     if (event.type === 'content_block_stop') {
+                        if (pendingNativeToolInputs.has(event.index)) {
+                            const rawInput = pendingNativeToolInputs.get(event.index);
+                            pendingNativeToolInputs.delete(event.index);
+                            const nativeBlock = nativeServerToolBlocks.get(event.index);
+                            if (nativeBlock) {
+                                let input = nativeBlock.input && typeof nativeBlock.input === 'object'
+                                    ? nativeBlock.input
+                                    : {};
+                                if (rawInput) {
+                                    try { input = JSON.parse(rawInput); }
+                                    catch (parseErr) {
+                                        process.stderr.write(`[anthropic-oauth] native server-tool input JSON.parse failed (type=${nativeBlock.type}, id=${nativeBlock.id || ''}): ${parseErr?.message || parseErr}\n`);
+                                        input = {};
+                                    }
+                                }
+                                if (input === null || typeof input !== 'object' || Array.isArray(input)) input = {};
+                                nativeBlock.input = input;
+                            }
+                        }
                         const pending = pendingToolInputs.get(event.index);
                         if (pending) {
                             // Bare JSON.parse threw straight up into the
@@ -558,6 +743,15 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                             // dispatch (the marker path is unaffected).
                             if (_toolDedupe.shouldDispatch(call.name, call.arguments)) {
                                 toolCalls.push(call);
+                                // Ordered replay copy of the dispatched call —
+                                // skipped/deduped calls stay out so a replayed
+                                // turn never carries an orphan tool_use.
+                                clientToolUseBlocks.set(event.index, {
+                                    type: 'tool_use',
+                                    id: call.id,
+                                    name: call.name,
+                                    input: call.arguments,
+                                });
                                 if (state) state.emittedToolCall = true;
                                 // Eager dispatch: let the loop start this tool
                                 // before message_stop arrives. The loop keys
@@ -588,13 +782,43 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                             usage.outputTokens = event.usage.output_tokens || 0;
                             usage.raw = { ...(usage.raw || {}), ...event.usage };
                         }
-                        if (stopReason === 'tool_use' && toolCalls.length > 0 && pendingToolInputs.size === 0) {
+                        // A terminal stop_reason while ANY tool input is still
+                        // streaming ends the turn truncated, immediately: the
+                        // model declared it stopped sampling, so the pending
+                        // tool arguments can never complete. Do not wait for
+                        // message_stop/EOF (which may never arrive, or would
+                        // arrive as ping-only wedge) — enter the canonical
+                        // truncation failure now, with zero dispatch for the
+                        // incomplete call.
+                        if (event.delta?.stop_reason && _toolInputInFlight()) {
+                            sawTerminalFrameWithPendingInput = true;
+                            break streamLoop;
+                        }
+                        // Early terminal on a tool_use stop_reason is only valid
+                        // when NO tool input is still streaming — client
+                        // (pendingToolInputs) or Anthropic-native server tool
+                        // (pendingNativeToolInputs). An in-flight input means the
+                        // arguments never completed, so the turn is truncated,
+                        // not finished (the guard after the loop owns it).
+                        if (stopReason === 'tool_use' && toolCalls.length > 0 && !_toolInputInFlight()) {
                             if (state) state.sawCompleted = true;
                             break streamLoop;
                         }
                     }
                     if (event.type === 'message_stop') {
-                        if (state) state.sawCompleted = true;
+                        // A terminal frame does NOT finish a turn whose tool
+                        // input is still incomplete. `message_stop` while a
+                        // tool_use/server_tool_use input_json is mid-flight means
+                        // the model's arguments were cut off: nothing was
+                        // dispatched for that call and no partial success may be
+                        // promoted. Leave sawCompleted false and fall through to
+                        // the truncated-stream guard below, which throws the
+                        // canonical TruncatedStreamError (pendingToolUse:true).
+                        if (_toolInputInFlight()) {
+                            sawTerminalFrameWithPendingInput = true;
+                        } else if (state) {
+                            state.sawCompleted = true;
+                        }
                         // Anthropic streams can keep emitting `:ping` keepalive
                         // frames after `message_stop`; if we wait for EOF the
                         // outer reader.read() loop hangs indefinitely. Break
@@ -630,10 +854,12 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
         // Throw a typed truncated-stream error so the loop can decide whether
         // to retry, surface, or escalate instead of accepting the partial.
         if (state?.sawMessageStart && !state?.sawCompleted) {
-            const pendingToolUse = pendingToolInputs.size > 0;
+            const pendingToolUse = _toolInputInFlight();
             const err = Object.assign(
                 new Error(
-                    `Anthropic OAuth SSE stream truncated: message_start without message_stop`
+                    (sawTerminalFrameWithPendingInput
+                        ? `Anthropic OAuth SSE stream truncated: terminal frame with incomplete tool input`
+                        : `Anthropic OAuth SSE stream truncated: message_start without message_stop`)
                     + (pendingToolUse ? ` (pending tool_use input)` : ''),
                 ),
                 {
@@ -644,6 +870,43 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                     stopReason,
                 },
             );
+            // Completed client tool calls / native server-tool blocks captured
+            // before the cut-off ride on the error so the interrupted-turn
+            // persistence path keeps them; the INCOMPLETE call is absent (it was
+            // never pushed and never dispatched). `partialAssistantBlocks` is
+            // the SAME ordered native/client block list the success path
+            // returns as `assistantBlocks` — a native server_tool_use call and
+            // its result block are only valid in original order, so truncation
+            // must not drop the completed ones.
+            try {
+                err.partialContent = content;
+                err.partialToolCalls = toolCalls.length ? toolCalls.slice() : undefined;
+                err.partialModel = model || undefined;
+                err.partialUsage = usage;
+                err.partialHasThinking = hasThinkingContent;
+                err.partialThinkingBlocks = _orderedThinkingBlocks();
+                err.partialAssistantBlocks = _orderedAssistantBlocks();
+                err.partialStopReason = stopReason || undefined;
+            } catch { /* best-effort enrichment */ }
+            // Truncation is a continuation, never a terminal turn. A pending
+            // tool_use input alone stays replay-safe (nothing was dispatched);
+            // exposed text/reasoning or a complete tool call is not.
+            try {
+                stampStreamOutcome(err, {
+                    transport: STREAM_TRANSPORTS.SSE,
+                    provider: 'anthropic',
+                    terminalObserved: false,
+                    continuation: true,
+                    truncatedStream: true,
+                    textEmitted: state?.emittedText === true,
+                    textObservedChars: content.length,
+                    reasoningEmitted: state?.emittedThinking === true,
+                    toolCallsStarted: state?.partialToolCall === true && toolCalls.length > 0,
+                    toolCallsComplete: toolCalls.length,
+                    toolCallsDispatched: state?.emittedToolCall === true ? Math.max(1, toolCalls.length) : 0,
+                    pendingToolInput: pendingToolUse,
+                });
+            } catch { /* stamping is best-effort */ }
             throw err;
         }
 
@@ -660,11 +923,14 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
             // signature) for round-tripping on tool-continuation turns. Emitted
             // in content_block index order. Empty thinking + signature is a
             // valid block (display-omitted models) and is kept intact.
-            thinkingBlocks: thinkingBlocks.size
-                ? [...thinkingBlocks.entries()]
-                    .sort((a, b) => a[0] - b[0])
-                    .map(([, b]) => b)
-                : undefined,
+            thinkingBlocks: _orderedThinkingBlocks(),
+            // Complete ordered assistant content, emitted ONLY when the turn
+            // used Anthropic native server tools. Those blocks cannot be
+            // reconstructed from content/toolCalls/thinkingBlocks, so the loop
+            // replays this list verbatim (see toAnthropicMessages'
+            // assistantBlocks branch). Absent for every ordinary turn, which
+            // keeps the existing text/thinking/tool_use lowering untouched.
+            assistantBlocks: _orderedAssistantBlocks(),
         };
     } finally {
         if (idleTimer) clearTimeout(idleTimer);
@@ -697,3 +963,36 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
 export function _classifyMidstreamError(err, state) {
     return classifyMidstreamError(err, state, SSE_MIDSTREAM_POLICY);
 }
+
+/**
+ * Wrapper-level canonical stamp for the Anthropic providers (API key + OAuth).
+ *
+ * The PARSER is the authority on what the stream produced: it knows the
+ * difference between "a tool_use block started" (coarse
+ * `midState.partialToolCall`, set on the first input_json_delta) and "a tool
+ * input never completed and was never dispatched" (`pendingToolInput`, which
+ * stays replay-safe). Merging the coarse mid-state flag over a stamped parser
+ * verdict would downgrade an idempotent truncation into a non-replayable one.
+ *
+ * So: when the error already carries an authoritative parser record, only
+ * genuinely NEW exposure evidence observed by the wrapper is merged (relayed
+ * text, exposed thinking, dispatched tool call). Otherwise (transport/SDK
+ * errors that never reached the parser) the full mid-state is stamped.
+ */
+export function stampAnthropicStreamOutcome(err, midState, { provider = 'anthropic' } = {}) {
+    const hasParserVerdict = err?.streamOutcome?.version === STREAM_OUTCOME_VERSION;
+    if (hasParserVerdict) {
+        return stampStreamOutcome(err, {
+            transport: STREAM_TRANSPORTS.SSE,
+            provider,
+            textEmitted: midState?.emittedText === true,
+            reasoningEmitted: midState?.emittedThinking === true,
+            toolCallsDispatched: midState?.emittedToolCall === true ? 1 : 0,
+        });
+    }
+    return stampStreamOutcome(err, midState || {}, {
+        transport: STREAM_TRANSPORTS.SSE,
+        provider,
+        continuation: midState?.sawCompleted !== true,
+    });
+}

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -13,6 +13,7 @@ import {
     withRetry,
     retryAfterMsFromError,
 } from './retry-classifier.mjs';
+import { readStreamOutcome } from './lib/stream-outcome.mjs';
 import { traceAgentUsage } from '../agent-trace.mjs';
 import {
     PROVIDER_FIRST_BYTE_TIMEOUT_MS,
@@ -24,6 +25,7 @@ import {
     ANTHROPIC_MAX_MIDSTREAM_RETRIES,
     parseSSEStream,
     _classifyMidstreamError,
+    stampAnthropicStreamOutcome,
 } from './anthropic-sse.mjs';
 import { buildAnthropicBetaHeaders, supportsAnthropicFastMode } from './anthropic-betas.mjs';
 import {
@@ -108,15 +110,11 @@ export class AnthropicProvider {
             return await this._doSend(messages, model, tools, sendOpts);
         } catch (err) {
             const status = Number(err?.status || err?.httpStatus || err?.response?.status || 0);
-            const outputWasExposed = err?.liveTextEmitted === true
-                || err?.emittedText === true
-                || err?.emittedToolCall === true
-                || err?.toolCallEmitted === true
-                || err?.partialToolCall === true
-                || err?.emittedThinking === true
-                || err?.unsafeToRetry === true;
-            if (status === 401
-                && !outputWasExposed) {
+            // Auth recovery re-issues the whole turn, so it is a REPLAY: a
+            // typed 401 is re-sent once after reloading the key, unless the
+            // failure already exposed output or dispatched a tool call.
+            const replayPermitted = readStreamOutcome(err).replaySafe === true;
+            if (status === 401 && replayPermitted) {
                 process.stderr.write(`[provider] Auth error, re-reading provider authentication...\n`);
                 this.reloadApiKey();
                 return await this._doSend(messages, model, tools, sendOpts);
@@ -297,6 +295,16 @@ export class AnthropicProvider {
                 thinkingBlocks: Array.isArray(parseResult.thinkingBlocks) && parseResult.thinkingBlocks.length
                     ? parseResult.thinkingBlocks
                     : undefined,
+                // Ordered NATIVE server-tool blocks (server_tool_use +
+                // *_tool_result) exist ONLY in this verbatim list — they are
+                // never dispatched as client tool calls and cannot be rebuilt
+                // from content/toolCalls/thinkingBlocks. Dropping them here
+                // broke `pause_turn` continuations on the API-key path (the
+                // OAuth provider returns the parse result as-is). Absent for
+                // ordinary turns, so nothing else changes.
+                assistantBlocks: Array.isArray(parseResult.assistantBlocks) && parseResult.assistantBlocks.length
+                    ? parseResult.assistantBlocks
+                    : undefined,
                 usage: {
                     inputTokens: input,
                     outputTokens: output,
@@ -511,6 +519,14 @@ export class AnthropicProvider {
                             _fallbackTriggered: true,
                         });
                     }
+                    // Canonical stream-outcome contract (same record as the
+                    // OAuth SSE / WS / HTTP-SSE transports). The parser verdict
+                    // wins over coarse midState flags; new wrapper-observed
+                    // exposure is still merged. Aliases preserved.
+                    let _outcome = null;
+                    try {
+                        _outcome = stampAnthropicStreamOutcome(err, midState, { provider: 'anthropic' });
+                    } catch { /* stamping is best-effort */ }
                     // Acknowledged reset semantics let the owner tombstone this
                     // attempt before the full request is restarted non-streaming.
                     // Without that acknowledgement, recoverNonStreaming stamps
@@ -518,13 +534,14 @@ export class AnthropicProvider {
                     if (midState.emittedText) {
                         return await recoverNonStreaming(midState, err, streamController);
                     }
-                    if (midState.emittedToolCall || midState.partialToolCall || midState.emittedThinking) {
-                        try {
-                            err.emittedToolCall = !!midState.emittedToolCall;
-                            err.partialToolCall = !!midState.partialToolCall;
-                            err.emittedThinking = !!midState.emittedThinking;
-                            err.unsafeToRetry = true;
-                        } catch {}
+                    // Real exposure (dispatched tool, exposed thinking, or a
+                    // parser-recorded started/complete call) is a replay
+                    // boundary. The canonical merge above already recorded it
+                    // AND wrote the compatibility aliases; writing coarse
+                    // midState flags here would DOWNGRADE the parser's
+                    // authoritative verdict that an incomplete, never
+                    // dispatched tool input is still replay-safe.
+                    if (_outcome?.replayUnsafe === true) {
                         try { streamController.abort?.(err); } catch {}
                         throw err;
                     }
@@ -546,9 +563,7 @@ export class AnthropicProvider {
                     }
                     if (classifyError(err) === 'transient'
                         && !midState.sawMessageStart
-                        && !midState.emittedToolCall
-                        && !midState.partialToolCall
-                        && !midState.emittedThinking
+                        && _outcome?.replayUnsafe !== true
                         && attemptIndex < MAX_MIDSTREAM_RETRIES) {
                         firstAttemptError = err;
                         firstAttemptClassifier = err?.providerErrorType || 'sse_transient';
@@ -563,9 +578,7 @@ export class AnthropicProvider {
                     }
                     if ((err?.truncatedStream === true || err?.code === 'TRUNCATED_STREAM')
                         && classifyError(err) === 'transient'
-                        && !midState.emittedToolCall
-                        && !midState.partialToolCall
-                        && !midState.emittedThinking
+                        && _outcome?.replayUnsafe !== true
                         && attemptIndex < MAX_MIDSTREAM_RETRIES) {
                         firstAttemptError = err;
                         firstAttemptClassifier = 'truncated_stream';