mixdog 1.2.0 → 1.2.2

package/src/runtime/agent/orchestrator/providers/anthropic-error-contract.mjs

@@ -0,0 +1,96 @@
+/**
+ * anthropic-error-contract.mjs — the fields every error thrown at an Anthropic
+ * provider boundary carries, so the shared core never has to re-derive them
+ * from message text:
+ *
+ *   status / httpStatus  the HTTP status
+ *   code                 the lowercased Anthropic error type (`rate_limit_error`,
+ *                        `overloaded_error`, ...); a 413 is always
+ *                        `request_too_large` (a byte/media size refusal), which
+ *                        stays distinct from a 400 `invalid_request_error`
+ *                        "prompt is too long" (a token-count refusal)
+ *   headers              the response headers, preserved as received
+ *   retryAfterMs         the server's Retry-After / retry-after-ms window, uncapped
+ *   resetAt              epoch ms of anthropic-ratelimit-unified-reset, uncapped
+ */
+import { headerValue, retryAfterMsFromError } from './retry-classification.mjs';
+
+const RESET_HEADER = 'anthropic-ratelimit-unified-reset';
+const REQUEST_TOO_LARGE = 'request_too_large';
+
+// Anthropic's documented error-type enumeration by status, used only when the
+// body names no type of its own.
+const STATUS_ERROR_TYPE = new Map([
+  [400, 'invalid_request_error'],
+  [401, 'authentication_error'],
+  [403, 'permission_error'],
+  [404, 'not_found_error'],
+  [413, REQUEST_TOO_LARGE],
+  [429, 'rate_limit_error'],
+  [500, 'api_error'],
+  [529, 'overloaded_error'],
+]);
+
+const BODY_TYPE_RE = /"error"\s*:\s*\{\s*"type"\s*:\s*"([A-Za-z_]+)"/;
+
+function present(value) {
+  return value != null && value !== '';
+}
+
+function lowered(value) {
+  return typeof value === 'string' && value.trim() && value.trim() !== 'error' ? value.trim().toLowerCase() : '';
+}
+
+/** The lowercased error type named by an Anthropic error body (JSON text or parsed object). */
+export function anthropicErrorTypeFromBody(body) {
+  if (body && typeof body === 'object') return lowered((body.error && body.error.type) || body.type);
+  const match = BODY_TYPE_RE.exec(String(body || ''));
+  return match ? lowered(match[1]) : '';
+}
+
+/** Retry-After / retry-after-ms in ms, uncapped; null when the server sent neither. */
+export function retryAfterMsFromHeaders(headers) {
+  if (!present(headerValue(headers, 'retry-after-ms')) && !present(headerValue(headers, 'retry-after'))) return null;
+  return retryAfterMsFromError({ headers });
+}
+
+/** Epoch ms of the unified rate-limit reset header, uncapped; null when absent or past. */
+export function resetAtFromHeaders(headers) {
+  const raw = headerValue(headers, RESET_HEADER);
+  if (!present(raw)) return null;
+  const seconds = Number(raw);
+  return Number.isFinite(seconds) && seconds > 0 ? Math.ceil(seconds * 1000) : null;
+}
+
+/**
+ * Stamp the contract onto `err`. Existing `headers` and a finite
+ * `retryAfterMs` are preserved. `type` is the wire error type when the caller
+ * already parsed one; otherwise it is read from `bodyText` (or err.error, the
+ * SDK's parsed body, or err.message) and finally from the status.
+ */
+export function applyAnthropicErrorContract(err, { status, headers, type = '', bodyText = '' } = {}) {
+  if (!err || typeof err !== 'object') return err;
+  const httpStatus = Number(status || err.httpStatus || err.status || 0) || 0;
+  if (httpStatus) {
+    err.status = httpStatus;
+    err.httpStatus = httpStatus;
+    const wireType =
+      lowered(type) ||
+      anthropicErrorTypeFromBody(bodyText) ||
+      anthropicErrorTypeFromBody(err.error) ||
+      anthropicErrorTypeFromBody(err.message) ||
+      STATUS_ERROR_TYPE.get(httpStatus) ||
+      '';
+    const code = httpStatus === 413 ? REQUEST_TOO_LARGE : wireType;
+    if (code) err.code = code;
+  }
+  if (!err.headers && headers) err.headers = headers;
+  const effectiveHeaders = err.headers || headers || null;
+  if (!(err.retryAfterMs != null && Number.isFinite(Number(err.retryAfterMs)))) {
+    const retryAfterMs = retryAfterMsFromHeaders(effectiveHeaders);
+    if (retryAfterMs != null) err.retryAfterMs = retryAfterMs;
+  }
+  const resetAt = resetAtFromHeaders(effectiveHeaders);
+  if (resetAt != null) err.resetAt = resetAt;
+  return err;
+}

package/src/runtime/agent/orchestrator/providers/anthropic-fast-mode.mjs

@@ -6,7 +6,7 @@
 // cache, because the retry after the wait carries a different speed anyway.
 // The reference client's rule: a SHORT server window is worth waiting for at
 // fast speed (the cache prefix survives), anything longer drops to standard
-// speed for a cooldown. An explicit "overage billing unavailable" header is
+// speed for a cooldown (reference thresholds: <20s keeps fast; otherwise\n// max(Retry-After ?? 30min, 10min)). An explicit "overage billing unavailable" header is
 // terminal for the process — no cooldown can make paid overage appear.
 //
 // State is process-wide because the capacity pool is per-account, not per
@@ -14,23 +14,28 @@
 // sessions hammering it.
 
 import { headerValue } from './retry-classification.mjs';
+import { retryAfterMsFromHeaders } from './anthropic-error-contract.mjs';
 
 // Server-declared reason header for a fast-mode rejection caused by missing
 // overage billing (matches the reference client's header name).
 const OVERAGE_DISABLED_HEADER = 'anthropic-ratelimit-unified-overage-disabled-reason';
-// Body-only form of the same rejection ("Usage credits are required for fast
-// mode."), sent as a 429 rate_limit_error without the header above.
-const CREDITS_REQUIRED_PATTERN = /usage credits are required for fast mode/i;
-const CREDITS_REQUIRED_REASON = 'usage_credits_required';
+// Reasons that mean the wallet is empty / capped for now rather than that
+// overage can never exist: the request drops to standard speed, but fast mode
+// is not switched off (the reference client keeps its setting for these).
+const TRANSIENT_OVERAGE_REASONS = new Set(['org_level_disabled_until', 'out_of_credits']);
+// A 400 from an account/endpoint that cannot serve fast mode at all. The same
+// request succeeds at standard speed, and no cooldown makes it succeed fast.
+const NOT_ENABLED_PATTERN = /fast mode is not enabled/i;
+const NOT_ENABLED_REASON = 'fast_mode_not_enabled';
 
 // A Retry-After under this bound is short enough that waiting keeps fast mode
 // (and its cache prefix) worthwhile.
-const SHORT_RETRY_THRESHOLD_MS = 10_000;
+const SHORT_RETRY_THRESHOLD_MS = 20_000;
 // Cooldown floor: without it a 1s window would flip fast mode on and off every
 // turn, which costs more in cache misses than the downgrade saves.
-const MIN_COOLDOWN_MS = 60_000;
+const MIN_COOLDOWN_MS = 600_000;
 // Applied when the server gives no window at all.
-const DEFAULT_COOLDOWN_MS = 300_000;
+const DEFAULT_COOLDOWN_MS = 1_800_000;
 
 let _cooldownUntilMs = 0;
 let _disabledReason = null;
@@ -62,23 +67,23 @@ export function fastModeDisabledReason() {
 export function noteFastModeCapacityError(err, { fast = false, now = Date.now() } = {}) {
   if (!fast) return 'ignored';
   const status = Number(err?.httpStatus || err?.status || err?.response?.status || 0);
+  if (status === 400 && NOT_ENABLED_PATTERN.test(String(err?.message || ''))) {
+    _disabledReason = NOT_ENABLED_REASON;
+    return 'disabled';
+  }
   if (status !== 429 && status !== 529) return 'ignored';
 
   const headers = err?.headers || err?.response?.headers || err?.data?.responseHeaders || null;
   const overageReason = headerValue(headers, OVERAGE_DISABLED_HEADER);
-  if (overageReason != null && String(overageReason) !== '') {
-    _disabledReason = String(overageReason);
-    return 'disabled';
-  }
-  // Same terminal condition reported only in the error body: the account has
-  // no usage credits for fast mode, so no cooldown can make it succeed.
-  if (CREDITS_REQUIRED_PATTERN.test(String(err?.message || ''))) {
-    _disabledReason = CREDITS_REQUIRED_REASON;
+  // The header's presence (even empty) is the signal, as in the reference client.
+  if (overageReason != null) {
+    if (TRANSIENT_OVERAGE_REASONS.has(String(overageReason))) return 'downgrade';
+    _disabledReason = String(overageReason) || 'overage_unavailable';
     return 'disabled';
   }
 
-  const retryAfterMs = Number(err?.retryAfterMs);
-  const hasWindow = Number.isFinite(retryAfterMs) && retryAfterMs >= 0;
+  const retryAfterMs = serverWindowMs(err);
+  const hasWindow = retryAfterMs != null;
   if (hasWindow && retryAfterMs < SHORT_RETRY_THRESHOLD_MS) return 'retry-fast';
 
   const cooldownMs = Math.max(hasWindow ? retryAfterMs : DEFAULT_COOLDOWN_MS, MIN_COOLDOWN_MS);
@@ -86,6 +91,22 @@ export function noteFastModeCapacityError(err, { fast = false, now = Date.now()
   return 'downgrade';
 }
 
+/** True when the decision means the caller must drop `speed` before replaying. */
+export function fastModeDowngraded(decision) {
+  return decision === 'downgrade' || decision === 'disabled';
+}
+
+// The server's Retry-After window: an explicit err.retryAfterMs, else the
+// Retry-After headers. The unified-reset header is deliberately not a window
+// here (the reference client reads Retry-After only). null when none.
+function serverWindowMs(err) {
+  const explicit = err?.retryAfterMs;
+  if (explicit != null && explicit !== '' && Number.isFinite(Number(explicit)) && Number(explicit) >= 0) {
+    return Number(explicit);
+  }
+  return retryAfterMsFromHeaders(err?.headers || err?.response?.headers || err?.data?.responseHeaders || null);
+}
+
 /** Manual re-enable (user action) and test seam. */
 export function clearFastModeCooldown() {
   _cooldownUntilMs = 0;

package/src/runtime/agent/orchestrator/providers/anthropic-max-tokens-recovery.mjs

@@ -0,0 +1,55 @@
+/**
+ * anthropic-max-tokens-recovery.mjs — the two max_tokens adjustments the
+ * reference client makes (withRetry.ts / claude.ts):
+ *
+ *  - a 400 "input length and `max_tokens` exceed context limit: A + B > C" is
+ *    answered by shrinking max_tokens to what the context still has room for
+ *    (1000-token safety buffer, 3000-token floor, thinking budget + 1 minimum)
+ *    and replaying; with less than the floor available the error surfaces.
+ *  - the non-streaming replay caps max_tokens at 64000 (the API's long-request
+ *    boundary) and keeps thinking.budget_tokens below it.
+ */
+
+export const FLOOR_OUTPUT_TOKENS = 3000;
+export const CONTEXT_SAFETY_BUFFER_TOKENS = 1000;
+export const MAX_NON_STREAMING_TOKENS = 64_000;
+
+const OVERFLOW_RE = /input length and `max_tokens` exceed context limit: (\d+) \+ (\d+) > (\d+)/;
+
+/** `{ inputTokens, maxTokens, contextLimit }` for the exact 400, else null. */
+export function parseMaxTokensContextOverflow(status, message) {
+  if (Number(status) !== 400) return null;
+  const match = OVERFLOW_RE.exec(String(message || ''));
+  if (!match) return null;
+  const [inputTokens, maxTokens, contextLimit] = match.slice(1).map((value) => Number.parseInt(value, 10));
+  return [inputTokens, maxTokens, contextLimit].every(Number.isFinite) ? { inputTokens, maxTokens, contextLimit } : null;
+}
+
+const thinkingBudget = (body) =>
+  body?.thinking?.type === 'enabled' && Number(body.thinking.budget_tokens) > 0 ? Number(body.thinking.budget_tokens) : 0;
+
+/**
+ * Shrink `body.max_tokens` to fit the reported context. Returns true when the
+ * body was adjusted and is worth replaying.
+ */
+export function adjustMaxTokensForContextOverflow(body, status, message) {
+  const overflow = parseMaxTokensContextOverflow(status, message);
+  if (!overflow || !body) return false;
+  const available = Math.max(0, overflow.contextLimit - overflow.inputTokens - CONTEXT_SAFETY_BUFFER_TOKENS);
+  if (available < FLOOR_OUTPUT_TOKENS) return false;
+  body.max_tokens = Math.max(FLOOR_OUTPUT_TOKENS, available, thinkingBudget(body) + 1);
+  return true;
+}
+
+/** Cap a non-streaming body in place (max_tokens and the thinking budget). */
+export function capForNonStreaming(body) {
+  if (!body || !(Number(body.max_tokens) > MAX_NON_STREAMING_TOKENS)) return body;
+  body.max_tokens = MAX_NON_STREAMING_TOKENS;
+  if (thinkingBudget(body)) {
+    body.thinking = {
+      ...body.thinking,
+      budget_tokens: Math.min(body.thinking.budget_tokens, MAX_NON_STREAMING_TOKENS - 1),
+    };
+  }
+  return body;
+}

package/src/runtime/agent/orchestrator/providers/anthropic-max-tokens.mjs

@@ -8,25 +8,17 @@
 //   2. Catalog outputTokens for the model id (trusted over hardcoded
 //      heuristics when present — the API reports real per-model limits),
 //      clamped to [MAX_TOKENS_FLOOR, safetyCap].
-//   3. Static per-model table / family heuristic fallback when the catalog
-//      has no entry for this model, also capped at the safety cap.
+//   3. The shared model catalog's outputTokens for the model (cached roster /
+//      LiteLLM / models.dev), same clamp.
+//   4. The pre-catalog family limits for a model no catalog describes, else
+//      the floor.
+
+import { getModelMetadataSync } from './model-catalog.mjs';
 
 const MAX_TOKENS_FLOOR = 8192;
 const DEFAULT_SAFETY_CAP = 65536;
 const ENV_VAR = 'MIXDOG_ANTHROPIC_MAX_OUTPUT_TOKENS';
 
-// Per-model max_tokens when the model id is explicitly listed. New models
-// (e.g., Sonnet 4.7) won't match a specific entry and fall through to the
-// family-based heuristic below. Conservative defaults — model may support
-// more but we'd rather stay within safe bounds.
-const MAX_TOKENS = {
-  'claude-opus-4-8': 65536,
-  'claude-opus-4-7': 65536,
-  'claude-opus-4-6': 65536,
-  'claude-sonnet-4-6': 16384,
-  'claude-haiku-4-5-20251001': 8192,
-};
-
 // Strict-positive env override parsing. Invalid values ("0", negatives,
 // garbage, whitespace) are treated as UNSET — not as "use the default cap
 // outright" — so catalog/fallback still decide for low-cap models. Raw env
@@ -39,11 +31,18 @@ function envAnthropicMaxOutputOverride() {
   return Math.floor(n);
 }
 
-// Static per-model table + family heuristic, used when the catalog has no
-// entry for this model id. Sonnet 5+ ships a much larger output budget than
-// the legacy 4.x line (this is the claude-sonnet-5 fix: 16384 was starving
-// visible output once extended thinking ate into the same hard cap). Keep
-// sonnet-4-x conservative at 16384; only bump 5+.
+// Last resort when no catalog describes the model: the limits known before
+// the catalogs existed. Sonnet 5+ ships a much larger output budget than the
+// legacy 4.x line (16384 starved visible output once extended thinking ate
+// into the same hard cap). Unknown families stay at the floor.
+const MAX_TOKENS = {
+  'claude-opus-4-8': 65536,
+  'claude-opus-4-7': 65536,
+  'claude-opus-4-6': 65536,
+  'claude-sonnet-4-6': 16384,
+  'claude-haiku-4-5-20251001': 8192,
+};
+
 function fallbackAnthropicMaxTokens(model) {
   if (MAX_TOKENS[model]) return MAX_TOKENS[model];
   const id = String(model || '').toLowerCase();
@@ -52,8 +51,12 @@ function fallbackAnthropicMaxTokens(model) {
   const sonnetVersion = id.match(/^claude-sonnet-(\d+)/);
   if (sonnetVersion) return Number(sonnetVersion[1]) >= 5 ? 65536 : 16384;
   if (id.includes('sonnet')) return 16384;
-  if (id.includes('haiku')) return 8192;
-  return 8192;
+  return MAX_TOKENS_FLOOR;
+}
+
+function sharedCatalogOutputTokens(model) {
+  const declared = Number(getModelMetadataSync(String(model || ''), 'anthropic')?.outputTokens);
+  return Number.isFinite(declared) && declared > 0 ? declared : null;
 }
 
 // catalogLookup(model) -> number|null. Providers supply their own strategy
@@ -71,6 +74,7 @@ export function resolveAnthropicMaxTokens(model, { catalogLookup } = {}) {
       catalogValue = null;
     }
   }
+  if (!(Number.isFinite(catalogValue) && catalogValue > 0)) catalogValue = sharedCatalogOutputTokens(model);
   if (Number.isFinite(catalogValue) && catalogValue > 0) {
     return Math.max(MAX_TOKENS_FLOOR, Math.min(catalogValue, safetyCap));
   }

package/src/runtime/agent/orchestrator/providers/anthropic-messages.mjs

@@ -1,6 +1,6 @@
 // Anthropic model catalog + message conversion helpers.
 import { createRequire } from 'node:module';
-import { effortValuesForModel } from './anthropic-effort.mjs';
+import { effortValuesForModel, thinkingTypesFromCapabilities } from './anthropic-effort.mjs';
 import { makeModelCache } from './model-cache.mjs';
 import { resolveAnthropicMaxTokens } from './anthropic-max-tokens.mjs';
 import {
@@ -73,6 +73,7 @@ export function _normalizeAnthropicModel(raw, provider = 'anthropic') {
   const dated = /-\d{8}$/.test(String(id));
   const versioned = !dated && /^claude-[a-z]+-\d+(?:-\d+)?$/i.test(String(id));
   const effortValues = effortValuesForModel(raw?.capabilities, id);
+  const thinkingTypes = thinkingTypesFromCapabilities(raw?.capabilities);
   return {
     id,
     display: raw?.display_name || raw?.displayName || raw?.display || _prettyName(id, family),
@@ -90,6 +91,7 @@ export function _normalizeAnthropicModel(raw, provider = 'anthropic') {
     latest: false,
     supportsReasoning: effortValues.length > 0 || _capabilitySupported(raw?.capabilities?.thinking),
     reasoningOptions: effortValues.length ? [{ type: 'effort', values: effortValues }] : [],
+    ...(thinkingTypes ? { thinkingTypes } : {}),
   };
 }
 // The API-key provider has no catalog cache of its own — it reads the same

package/src/runtime/agent/orchestrator/providers/anthropic-midstream-recovery.mjs

@@ -24,6 +24,8 @@ import {
 } from './retry-classifier.mjs';
 import { _classifyMidstreamError, _midstreamSleepWithAbort, stampAnthropicStreamOutcome } from './anthropic-sse.mjs';
 import { notifyCurrentAnthropicRateLimit } from './admission-scheduler.mjs';
+import { applyAnthropicErrorContract } from './anthropic-error-contract.mjs';
+import { isAnthropicOverloadError } from './anthropic-overload-fallback.mjs';
 import { noteAbandonedUsage } from '../../../shared/llm/usage-context.mjs';
 
 export function createAnthropicMidState(attemptIndex) {
@@ -88,6 +90,8 @@ export function assertAnthropicStreamNotEmpty(midState, result, label) {
  * @param {{ recoverNonStreaming: Function, issueNonStreamingFallback: Function, requireTransportRecoveryBudget: Function }} deps.recovery
  * @param {Function|null} [deps.onStageChange]  receives the display-only 'reconnecting' stage per retry
  * @param {boolean} [deps.retry529]  false for a background call: an overload mid-stream is not retried
+ * @param {ReturnType<typeof import('./anthropic-overload-fallback.mjs').createAnthropicOverloadTracker>|null} [deps.overload]
+ *   the send's shared overload counter (SSE overloads feed it)
  */
 export function createAnthropicMidstreamRecovery({
   label,
@@ -101,6 +105,7 @@ export function createAnthropicMidstreamRecovery({
   recovery,
   onStageChange = null,
   retry529 = true,
+  overload = null,
 }) {
   const log = (line) => {
     try {
@@ -128,7 +133,7 @@ export function createAnthropicMidstreamRecovery({
     firstAttemptClassifier = classifier;
     abortStream(controller, err);
     log(message);
-    const waitMs = delayMs ?? midstreamBackoffFor(attemptIndex + 1);
+    const waitMs = delayMs ?? midstreamBackoffFor(attemptIndex + 1, undefined, err);
     emitProviderRetryStage(onStageChange, {
       attempt: attemptIndex + 1,
       maxAttempts: maxRetries,
@@ -192,6 +197,16 @@ export function createAnthropicMidstreamRecovery({
       abortStream(controller, err);
       throw err;
     }
+    // An SSE overload counts toward the same limit as a request-loop 529; at
+    // the limit the configured fallback model takes over (the provider's
+    // send loop catches the trigger around this whole recovery).
+    if (overload && isAnthropicOverloadError(err)) {
+      const trigger = overload.noteStreamOverload(err);
+      if (trigger) {
+        abortStream(controller, err);
+        throw trigger;
+      }
+    }
     const canRetry = attemptIndex < maxRetries;
     const attemptLabel = `${attemptIndex + 1}/${maxRetries}`;
     // Empty/dropped stream (no message_start): safe to retry once —
@@ -270,10 +285,9 @@ export function createAnthropicMidstreamRecovery({
       const status = Number(err?.httpStatus || err?.status || 0);
       let retryDelayMs = null;
       if (status === 429) {
-        if (!err.headers && response?.headers) err.headers = response.headers;
         if (!err.response && response) err.response = { status, headers: response.headers };
+        applyAnthropicErrorContract(err, { status, headers: response?.headers });
         retryDelayMs = retryAfterMsFromError(err);
-        if (retryDelayMs != null) err.retryAfterMs = retryDelayMs;
         notifyCurrentAnthropicRateLimit(err);
       }
       try {
@@ -283,7 +297,7 @@ export function createAnthropicMidstreamRecovery({
         log(`abort on stream error failed: ${abortErr?.message ?? String(abortErr)}`);
       }
       log(`mid-stream recovered: retry ${attemptLabel} (cause: ${classifier})`);
-      const waitMs = retryDelayMs ?? midstreamBackoffFor(attemptIndex + 1);
+      const waitMs = retryDelayMs ?? midstreamBackoffFor(attemptIndex + 1, undefined, err);
       emitProviderRetryStage(onStageChange, {
         attempt: attemptIndex + 1,
         maxAttempts: maxRetries,

package/src/runtime/agent/orchestrator/providers/anthropic-model-resolve.mjs

@@ -8,7 +8,12 @@
 import { enrichModels } from './model-catalog.mjs';
 import { sanitizeModelList } from './model-list-sanitize.mjs';
 import { makeModelCache } from './model-cache.mjs';
-import { effortValuesForModel, setModelEffortCapabilities } from './anthropic-effort.mjs';
+import {
+  effortValuesForModel,
+  setModelEffortCapabilities,
+  thinkingTypesFromCapabilities,
+} from './anthropic-effort.mjs';
+import { getModelMetadataSync } from './model-catalog.mjs';
 
 // Disk-backed cache so repeated process starts (cron, tool calls) don't
 // hammer /v1/models. 24h TTL matches the upstream client cadence.
@@ -85,6 +90,7 @@ export function _normalizeAnthropicModel(raw) {
   const tier = modelTier(dated, versioned);
   const releaseDate = dated ? id.match(/-(\d{4})(\d{2})(\d{2})$/) : null;
   const effortValues = effortValuesForModel(raw?.capabilities, id);
+  const thinkingTypes = thinkingTypesFromCapabilities(raw?.capabilities);
   return {
     id,
     display: raw?.display_name || _prettyName(id, family),
@@ -98,6 +104,7 @@ export function _normalizeAnthropicModel(raw) {
     releaseDate: releaseDate ? `${releaseDate[1]}-${releaseDate[2]}-${releaseDate[3]}` : null,
     supportsReasoning: effortValues.length > 0 || _capabilitySupported(raw?.capabilities?.thinking),
     reasoningOptions: effortValues.length ? [{ type: 'effort', values: effortValues }] : [],
+    ...(thinkingTypes ? { thinkingTypes } : {}),
   };
 }
 
@@ -115,7 +122,12 @@ export function _prettyName(id, family) {
   return `${base} ${v[1]}${minor}`;
 }
 
+// Context window for a roster row that reports none: the shared model catalog
+// (cached roster / LiteLLM / models.dev) first, else the pre-catalog family
+// windows.
 export function _defaultContextForModel(id) {
+  const declared = Number(getModelMetadataSync(id, 'anthropic')?.contextWindow);
+  if (Number.isFinite(declared) && declared > 0) return declared;
   const text = String(id || '');
   const version = text.match(/^claude-[a-z]+-(\d+)(?:-(\d+))?/i);
   if (Number(version?.[1] || 0) >= 5) return 1000000;

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-client-version.mjs

@@ -10,7 +10,7 @@ import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
 // source release just to advance the user-agent version.
 // Claude Opus 5.5 requires 2.1.280 or newer. The release workflow raises this
 // to the published CLI version (scripts/sync-client-version-floors.mjs).
-export const DEFAULT_CLI_VERSION = '2.1.296';
+export const DEFAULT_CLI_VERSION = '2.1.300';
 export const CLAUDE_CLI_NPM_PACKAGE = '@anthropic-ai/claude-code';
 
 const CACHE_SCHEMA_VERSION = 1;

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-midstream.mjs

@@ -21,8 +21,16 @@ export function createMidState(attemptIndex) {
  * @param {ReturnType<import('./anthropic-oauth-recovery.mjs').createAnthropicOAuthRecovery>} deps.recovery
  * @param {Function|null} [deps.onStageChange]
  * @param {boolean} [deps.retry529]
+ * @param {object|null} [deps.overload]  the send's shared overload counter
  */
-export function createMidstreamRecovery({ maxRetries, totalSignal, recovery, onStageChange = null, retry529 = true }) {
+export function createMidstreamRecovery({
+  maxRetries,
+  totalSignal,
+  recovery,
+  onStageChange = null,
+  retry529 = true,
+  overload = null,
+}) {
   return createAnthropicMidstreamRecovery({
     label: 'anthropic-oauth',
     outcomeProvider: 'anthropic-oauth',
@@ -33,5 +41,6 @@ export function createMidstreamRecovery({ maxRetries, totalSignal, recovery, onS
     recovery,
     onStageChange,
     retry529,
+    overload,
   });
 }

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-recovery.mjs

@@ -8,7 +8,10 @@ import { PROVIDER_NONSTREAM_TOTAL_TIMEOUT_MS, createTimeoutSignal } from '../sta
 import { AnthropicFallbackTriggeredError, markProviderRecoveryExhausted } from './retry-classifier.mjs';
 import { cloneAnthropicEffortBody } from './effort-configuration.mjs';
 import { normalizeAnthropicNonStreamingResponse } from './lib/anthropic-request-utils.mjs';
+import { capForNonStreaming } from './anthropic-max-tokens-recovery.mjs';
 import { createAnthropicRecoveryGuards } from './anthropic-recovery-guards.mjs';
+import { applyAnthropicErrorContract } from './anthropic-error-contract.mjs';
+import { isRefreshableAuthRejection } from './anthropic-oauth-request/initial-status.mjs';
 
 /**
  * @param {object} deps
@@ -70,7 +73,7 @@ export function createAnthropicOAuthRecovery({
     const requestFallback = async (accessToken) => {
       const result = await requestWithRetry(
         accessToken,
-        cloneAnthropicEffortBody(body, { stream: false }),
+        capForNonStreaming(cloneAnthropicEffortBody(body, { stream: false })),
         lifetime.signal
       );
       fallback = result;
@@ -89,19 +92,30 @@ export function createAnthropicOAuthRecovery({
     };
     try {
       fallback = await requestFallback(auth.creds.accessToken);
-      if (fallback.response.status === 401) {
-        releaseFallback('Anthropic OAuth non-streaming fallback refreshing auth');
-        auth.creds = await provider.ensureAuth({ forceRefresh: true, reason: '401' });
-        fallback = await requestFallback(auth.creds.accessToken);
+      // Same refresh rule as the streaming request: every 401 and only the
+      // exact revoked-token 403 are refreshed and replayed once; an ordinary
+      // 403 stays terminal. A rejected body is drained once and reused below.
+      let rejectedBody = null;
+      if (fallback.response.status === 401 || fallback.response.status === 403) {
+        rejectedBody = await fallback.response.text().catch(() => '');
+        if (isRefreshableAuthRejection(fallback.response.status, rejectedBody)) {
+          const rejectedStatus = fallback.response.status;
+          releaseFallback('Anthropic OAuth non-streaming fallback refreshing auth');
+          auth.creds = await provider.ensureAuth({ forceRefresh: true, reason: String(rejectedStatus) });
+          fallback = await requestFallback(auth.creds.accessToken);
+          rejectedBody = null;
+        }
       }
       if (!fallback.response.ok) {
-        const text = await fallback.response.text().catch(() => '');
+        const text = rejectedBody ?? (await fallback.response.text().catch(() => ''));
         const fallbackError = new Error(
           `Anthropic OAuth API ${fallback.response.status}: ${provider.scrubTokens(text).slice(0, 200)}`
         );
-        fallbackError.status = fallback.response.status;
-        fallbackError.httpStatus = fallback.response.status;
-        throw fallbackError;
+        throw applyAnthropicErrorContract(fallbackError, {
+          status: fallback.response.status,
+          headers: fallback.response.headers,
+          bodyText: provider.scrubTokens(text),
+        });
       }
       const message = await fallback.response.json();
       return normalizeAnthropicNonStreamingResponse(message, useModel);