mixdog 1.2.1 → 1.2.3

package/src/runtime/agent/orchestrator/providers/anthropic-api-transport.mjs

@@ -14,13 +14,16 @@ import {
   ANTHROPIC_RETRY_JITTER_RATIO,
   anthropicMaxAttempts,
   anthropicRequestTimeoutMs,
+  AnthropicFallbackTriggeredError,
   emitProviderRetryStage,
   withRetry,
-  retryAfterMsFromError,
   retryDelayLabel,
 } from './retry-classifier.mjs';
+import { ANTHROPIC_MAX_CONSECUTIVE_529 } from './retry-backoff.mjs';
 import { PROVIDER_FIRST_BYTE_TIMEOUT_MS, createTimeoutSignal } from '../stall-policy.mjs';
-import { noteFastModeCapacityError } from './anthropic-fast-mode.mjs';
+import { fastModeDowngraded, noteFastModeCapacityError } from './anthropic-fast-mode.mjs';
+import { adjustMaxTokensForContextOverflow } from './anthropic-max-tokens-recovery.mjs';
+import { applyAnthropicErrorContract, retryAfterMsFromHeaders } from './anthropic-error-contract.mjs';
 import { noteRequestServiceTier } from '../../../shared/llm/usage-context.mjs';
 import { notifyCurrentAnthropicRateLimit } from './admission-scheduler.mjs';
 
@@ -78,12 +81,61 @@ export function armFirstByteWatchdog(streamController, midState) {
  * @param {object} deps.params  the streaming request body (mutated on fast-pool de-latch)
  * @param {object|null} deps.requestHeaders  per-call beta/extra headers
  * @param {AbortSignal|null} deps.totalSignal  session-lifetime pass-through
+ * @param {{ state: { consecutive529Errors: number } }|null} [deps.overload]  the send's shared overload counter
  */
-export function createAnthropicApiTransport({ client, label, opts, useModel, params, requestHeaders, totalSignal }) {
+export function createAnthropicApiTransport({
+  client,
+  label,
+  opts,
+  useModel,
+  params,
+  requestHeaders,
+  totalSignal,
+  overload = null,
+}) {
   const requestOptions = (attemptSignal) => ({
     signal: attemptSignal,
     ...(requestHeaders ? { headers: requestHeaders } : {}),
   });
+  // The SDK throws a non-2xx before `.asResponse()` resolves, so an HTTP
+  // failure arrives as an APIError rather than a Response. Stamp the
+  // provider-boundary error contract on it (status, lowercased error type as
+  // `code`, preserved headers, uncapped retryAfterMs / resetAt).
+  const annotateHttpFailure = (err) => {
+    if (err && typeof err === 'object' && Number(err.status || err.httpStatus || 0) > 0) {
+      applyAnthropicErrorContract(err, { status: err.status || err.httpStatus, headers: err.headers });
+    }
+    return err;
+  };
+  // A fast-pool refusal (or a "Fast mode is not enabled" 400) says nothing
+  // about standard-speed capacity: drop `speed` and let the caller replay at
+  // once instead of waiting out a window that only the fast pool owns.
+  const dropFastSpeedAfter = (body, err) => {
+    if (body.speed !== 'fast') return false;
+    if (!fastModeDowngraded(noteFastModeCapacityError(err, { fast: true }))) return false;
+    delete body.speed;
+    return true;
+  };
+  // In-attempt body repairs, each replayed once: drop speed after a fast-pool
+  // refusal, and shrink max_tokens after the "input length and max_tokens
+  // exceed context limit" 400.
+  const withBodyRecovery = (body, attempt) => async (ctx) => {
+    let speedDropped = false;
+    let tokensAdjusted = false;
+    for (;;) {
+      try {
+        return await attempt(ctx);
+      } catch (err) {
+        if (!speedDropped && dropFastSpeedAfter(body, err)) {
+          speedDropped = true;
+        } else if (!tokensAdjusted && adjustMaxTokensForContextOverflow(body, err?.status, err?.message)) {
+          tokensAdjusted = true;
+        } else {
+          throw err;
+        }
+      }
+    }
+  };
   // Initial-response retry policy shared by the streaming request and the
   // non-streaming fallback.
   const retryPolicy = (signal, perAttemptLabel, recoveryOwner) => ({
@@ -95,23 +147,27 @@ export function createAnthropicApiTransport({ client, label, opts, useModel, par
     perAttemptTimeoutMs: anthropicRequestTimeoutMs(),
     perAttemptLabel,
     provider: 'anthropic',
+    // This transport honors the positive x-should-retry override.
+    honorShouldRetryTrue: true,
     recoveryOwner,
     retry529: opts.retry529,
     model: useModel,
     fallbackModel: opts._fallbackTriggered ? undefined : opts.fallbackModel,
+    // One overload counter for the send: SSE overloads count toward the same
+    // limit as request-loop 529s.
+    overloadState: overload?.state,
+    overloadFallbackAfter: ANTHROPIC_MAX_CONSECUTIVE_529,
+    stopAfterRepeated529: overload?.stopAfterRepeated529 === true,
   });
 
-  const requestStreamingResponse = () =>
-    withRetry(
-      async ({ signal: attemptSignal }) => {
-        noteRequestServiceTier(params.speed);
+  const requestStreamingResponse = async () => {
+    const attempt = async ({ signal: attemptSignal }) => {
+      noteRequestServiceTier(params.speed);
+      try {
         const res = await client.messages.create(params, requestOptions(attemptSignal)).asResponse();
         if (!res.ok) {
           const text = await res.text().catch(() => '');
           const err = new Error(`Anthropic API ${res.status}: ${text.slice(0, 200)}`);
-          err.status = res.status;
-          err.httpStatus = res.status;
-          err.initialResponseError = true;
           // Carry response headers so withRetry can honor a
           // short Retry-After and upstream can read quota hints.
           err.headers = res.headers;
@@ -120,48 +176,55 @@ export function createAnthropicApiTransport({ client, label, opts, useModel, par
           // output/tool exposure, so the request-local
           // withRetry loop may retry it with jitter.
           if (res.status === 429) {
-            const retryAfterMs = retryAfterMsFromError({
-              headers: res.headers,
-              response: { headers: res.headers },
-            });
             err.name = 'ProviderQuotaError';
-            err.code = 'PROVIDER_QUOTA';
-            err.retryAfterMs = retryAfterMs;
+            err.retryAfterMs = retryAfterMsFromHeaders(res.headers);
             err.providerQuota = true;
             err.quotaExceeded = true;
           }
-          throw err;
+          throw applyAnthropicErrorContract(err, { status: res.status, headers: res.headers, bodyText: text });
         }
         if (!res.body) {
           throw new Error('Anthropic streaming response has no body');
         }
         return res;
-      },
-      {
+      } catch (err) {
+        throw annotateHttpFailure(err);
+      }
+    };
+    try {
+      return await withRetry(withBodyRecovery(params, attempt), {
         ...retryPolicy(totalSignal, `${label} Anthropic streaming response`, `${label}-initial-response`),
-        onRetry: ({ attempt, maxAttempts, lastErr, delayMs, delayReason }) => {
-          emitProviderRetryStage(opts.onStageChange, { attempt: attempt + 1, maxAttempts, lastErr, delayMs });
-          // Long/unknown fast-pool window: replay at
-          // standard speed rather than waiting it out.
-          if (params?.speed === 'fast' && noteFastModeCapacityError(lastErr, { fast: true }) !== 'retry-fast') {
-            delete params.speed;
-          }
+        onRetry: ({ attempt: retryNo, maxAttempts, lastErr, delayMs, delayReason }) => {
+          emitProviderRetryStage(opts.onStageChange, { attempt: retryNo + 1, maxAttempts, lastErr, delayMs });
           const status = Number(lastErr?.httpStatus || lastErr?.status || lastErr?.response?.status || 0);
           if (status === 429) notifyCurrentAnthropicRateLimit(lastErr);
           const delayLabel = retryDelayLabel(delayMs, delayReason);
           process.stderr.write(
-            `[${label}] retry attempt ${attempt + 1} after ${lastErr?.message || lastErr?.code || 'transient error'}${delayLabel}\n`
+            `[${label}] retry attempt ${retryNo + 1} after ${lastErr?.message || lastErr?.code || 'transient error'}${delayLabel}\n`
           );
         },
+      });
+    } catch (err) {
+      // Whatever escapes withRetry failed before any stream existed and has
+      // already spent the request-level budget: mark it so mid-stream
+      // recovery never grants it a second, SSE-sized retry budget.
+      if (err && typeof err === 'object' && !(err instanceof AnthropicFallbackTriggeredError)) {
+        err.initialResponseError = true;
       }
-    );
+      throw err;
+    }
+  };
 
   const requestNonStreamingMessage = (nonStreamingParams, signal) =>
     withRetry(
-      async ({ signal: attemptSignal }) => {
+      withBodyRecovery(nonStreamingParams, async ({ signal: attemptSignal }) => {
         noteRequestServiceTier(nonStreamingParams.speed);
-        return client.messages.create(nonStreamingParams, requestOptions(attemptSignal));
-      },
+        try {
+          return await client.messages.create(nonStreamingParams, requestOptions(attemptSignal));
+        } catch (err) {
+          throw annotateHttpFailure(err);
+        }
+      }),
       {
         ...retryPolicy(signal, `${label} Anthropic non-streaming fallback`, `${label}-nonstreaming-request`),
         onRetry: ({ attempt, maxAttempts, lastErr, delayMs }) =>

package/src/runtime/agent/orchestrator/providers/anthropic-error-contract.mjs

@@ -0,0 +1,98 @@
+/**
+ * anthropic-error-contract.mjs — the fields every error thrown at an Anthropic
+ * provider boundary carries, so the shared core never has to re-derive them
+ * from message text:
+ *
+ *   status / httpStatus  the HTTP status
+ *   code                 the lowercased Anthropic error type (`rate_limit_error`,
+ *                        `overloaded_error`, ...); a 413 is always
+ *                        `request_too_large` (a byte/media size refusal), which
+ *                        stays distinct from a 400 `invalid_request_error`
+ *                        "prompt is too long" (a token-count refusal)
+ *   headers              the response headers, preserved as received
+ *   retryAfterMs         the server's Retry-After / retry-after-ms window, uncapped
+ *   resetAt              epoch ms of anthropic-ratelimit-unified-reset, uncapped
+ */
+import { headerValue, retryAfterMsFromError } from './retry-classification.mjs';
+
+const RESET_HEADER = 'anthropic-ratelimit-unified-reset';
+const REQUEST_TOO_LARGE = 'request_too_large';
+
+// Anthropic's documented error-type enumeration by status, used only when the
+// body names no type of its own.
+const STATUS_ERROR_TYPE = new Map([
+  [400, 'invalid_request_error'],
+  [401, 'authentication_error'],
+  [403, 'permission_error'],
+  [404, 'not_found_error'],
+  [409, 'conflict_error'],
+  [413, REQUEST_TOO_LARGE],
+  [429, 'rate_limit_error'],
+  [500, 'api_error'],
+  [504, 'timeout_error'],
+  [529, 'overloaded_error'],
+]);
+
+const BODY_TYPE_RE = /"error"\s*:\s*\{\s*"type"\s*:\s*"([A-Za-z_]+)"/;
+
+function present(value) {
+  return value != null && value !== '';
+}
+
+function lowered(value) {
+  return typeof value === 'string' && value.trim() && value.trim() !== 'error' ? value.trim().toLowerCase() : '';
+}
+
+/** The lowercased error type named by an Anthropic error body (JSON text or parsed object). */
+export function anthropicErrorTypeFromBody(body) {
+  if (body && typeof body === 'object') return lowered((body.error && body.error.type) || body.type);
+  const match = BODY_TYPE_RE.exec(String(body || ''));
+  return match ? lowered(match[1]) : '';
+}
+
+/** Retry-After / retry-after-ms in ms, uncapped; null when the server sent neither. */
+export function retryAfterMsFromHeaders(headers) {
+  if (!present(headerValue(headers, 'retry-after-ms')) && !present(headerValue(headers, 'retry-after'))) return null;
+  return retryAfterMsFromError({ headers });
+}
+
+/** Epoch ms of the unified rate-limit reset header, uncapped; null when absent or past. */
+export function resetAtFromHeaders(headers) {
+  const raw = headerValue(headers, RESET_HEADER);
+  if (!present(raw)) return null;
+  const seconds = Number(raw);
+  return Number.isFinite(seconds) && seconds > 0 ? Math.ceil(seconds * 1000) : null;
+}
+
+/**
+ * Stamp the contract onto `err`. Existing `headers` and a finite
+ * `retryAfterMs` are preserved. `type` is the wire error type when the caller
+ * already parsed one; otherwise it is read from `bodyText` (or err.error, the
+ * SDK's parsed body, or err.message) and finally from the status.
+ */
+export function applyAnthropicErrorContract(err, { status, headers, type = '', bodyText = '' } = {}) {
+  if (!err || typeof err !== 'object') return err;
+  const httpStatus = Number(status || err.httpStatus || err.status || 0) || 0;
+  if (httpStatus) {
+    err.status = httpStatus;
+    err.httpStatus = httpStatus;
+    const wireType =
+      lowered(type) ||
+      anthropicErrorTypeFromBody(bodyText) ||
+      anthropicErrorTypeFromBody(err.error) ||
+      anthropicErrorTypeFromBody(err.message) ||
+      STATUS_ERROR_TYPE.get(httpStatus) ||
+      '';
+    const code = httpStatus === 413 ? REQUEST_TOO_LARGE : wireType;
+    if (code) err.code = code;
+  }
+  if (!err.headers && headers) err.headers = headers;
+  const effectiveHeaders = err.headers || headers || null;
+  if (!(err.retryAfterMs != null && Number.isFinite(Number(err.retryAfterMs)))) {
+    const retryAfterMs = retryAfterMsFromHeaders(effectiveHeaders);
+    if (retryAfterMs != null) err.retryAfterMs = retryAfterMs;
+  }
+  const resetAt = resetAtFromHeaders(effectiveHeaders);
+  if (resetAt != null) err.resetAt = resetAt;
+  return err;
+}

package/src/runtime/agent/orchestrator/providers/anthropic-fast-mode.mjs

@@ -6,7 +6,7 @@
 // cache, because the retry after the wait carries a different speed anyway.
 // The reference client's rule: a SHORT server window is worth waiting for at
 // fast speed (the cache prefix survives), anything longer drops to standard
-// speed for a cooldown. An explicit "overage billing unavailable" header is
+// speed for a cooldown (reference thresholds: <20s keeps fast; otherwise\n// max(Retry-After ?? 30min, 10min)). An explicit "overage billing unavailable" header is
 // terminal for the process — no cooldown can make paid overage appear.
 //
 // State is process-wide because the capacity pool is per-account, not per
@@ -14,23 +14,28 @@
 // sessions hammering it.
 
 import { headerValue } from './retry-classification.mjs';
+import { retryAfterMsFromHeaders } from './anthropic-error-contract.mjs';
 
 // Server-declared reason header for a fast-mode rejection caused by missing
 // overage billing (matches the reference client's header name).
 const OVERAGE_DISABLED_HEADER = 'anthropic-ratelimit-unified-overage-disabled-reason';
-// Body-only form of the same rejection ("Usage credits are required for fast
-// mode."), sent as a 429 rate_limit_error without the header above.
-const CREDITS_REQUIRED_PATTERN = /usage credits are required for fast mode/i;
-const CREDITS_REQUIRED_REASON = 'usage_credits_required';
+// Reasons that mean the wallet is empty / capped for now rather than that
+// overage can never exist: the request drops to standard speed, but fast mode
+// is not switched off (the reference client keeps its setting for these).
+const TRANSIENT_OVERAGE_REASONS = new Set(['org_level_disabled_until', 'out_of_credits']);
+// A 400 from an account/endpoint that cannot serve fast mode at all. The same
+// request succeeds at standard speed, and no cooldown makes it succeed fast.
+const NOT_ENABLED_PATTERN = /fast mode is not enabled/i;
+const NOT_ENABLED_REASON = 'fast_mode_not_enabled';
 
 // A Retry-After under this bound is short enough that waiting keeps fast mode
 // (and its cache prefix) worthwhile.
-const SHORT_RETRY_THRESHOLD_MS = 10_000;
+const SHORT_RETRY_THRESHOLD_MS = 20_000;
 // Cooldown floor: without it a 1s window would flip fast mode on and off every
 // turn, which costs more in cache misses than the downgrade saves.
-const MIN_COOLDOWN_MS = 60_000;
+const MIN_COOLDOWN_MS = 600_000;
 // Applied when the server gives no window at all.
-const DEFAULT_COOLDOWN_MS = 300_000;
+const DEFAULT_COOLDOWN_MS = 1_800_000;
 
 let _cooldownUntilMs = 0;
 let _disabledReason = null;
@@ -62,23 +67,23 @@ export function fastModeDisabledReason() {
 export function noteFastModeCapacityError(err, { fast = false, now = Date.now() } = {}) {
   if (!fast) return 'ignored';
   const status = Number(err?.httpStatus || err?.status || err?.response?.status || 0);
+  if (status === 400 && NOT_ENABLED_PATTERN.test(String(err?.message || ''))) {
+    _disabledReason = NOT_ENABLED_REASON;
+    return 'disabled';
+  }
   if (status !== 429 && status !== 529) return 'ignored';
 
   const headers = err?.headers || err?.response?.headers || err?.data?.responseHeaders || null;
   const overageReason = headerValue(headers, OVERAGE_DISABLED_HEADER);
-  if (overageReason != null && String(overageReason) !== '') {
-    _disabledReason = String(overageReason);
-    return 'disabled';
-  }
-  // Same terminal condition reported only in the error body: the account has
-  // no usage credits for fast mode, so no cooldown can make it succeed.
-  if (CREDITS_REQUIRED_PATTERN.test(String(err?.message || ''))) {
-    _disabledReason = CREDITS_REQUIRED_REASON;
+  // The header's presence (even empty) is the signal, as in the reference client.
+  if (overageReason != null) {
+    if (TRANSIENT_OVERAGE_REASONS.has(String(overageReason))) return 'downgrade';
+    _disabledReason = String(overageReason) || 'overage_unavailable';
     return 'disabled';
   }
 
-  const retryAfterMs = Number(err?.retryAfterMs);
-  const hasWindow = Number.isFinite(retryAfterMs) && retryAfterMs >= 0;
+  const retryAfterMs = serverWindowMs(err);
+  const hasWindow = retryAfterMs != null;
   if (hasWindow && retryAfterMs < SHORT_RETRY_THRESHOLD_MS) return 'retry-fast';
 
   const cooldownMs = Math.max(hasWindow ? retryAfterMs : DEFAULT_COOLDOWN_MS, MIN_COOLDOWN_MS);
@@ -86,6 +91,22 @@ export function noteFastModeCapacityError(err, { fast = false, now = Date.now()
   return 'downgrade';
 }
 
+/** True when the decision means the caller must drop `speed` before replaying. */
+export function fastModeDowngraded(decision) {
+  return decision === 'downgrade' || decision === 'disabled';
+}
+
+// The server's Retry-After window: an explicit err.retryAfterMs, else the
+// Retry-After headers. The unified-reset header is deliberately not a window
+// here (the reference client reads Retry-After only). null when none.
+function serverWindowMs(err) {
+  const explicit = err?.retryAfterMs;
+  if (explicit != null && explicit !== '' && Number.isFinite(Number(explicit)) && Number(explicit) >= 0) {
+    return Number(explicit);
+  }
+  return retryAfterMsFromHeaders(err?.headers || err?.response?.headers || err?.data?.responseHeaders || null);
+}
+
 /** Manual re-enable (user action) and test seam. */
 export function clearFastModeCooldown() {
   _cooldownUntilMs = 0;

package/src/runtime/agent/orchestrator/providers/anthropic-max-tokens-recovery.mjs

@@ -0,0 +1,55 @@
+/**
+ * anthropic-max-tokens-recovery.mjs — the two max_tokens adjustments the
+ * reference client makes (withRetry.ts / claude.ts):
+ *
+ *  - a 400 "input length and `max_tokens` exceed context limit: A + B > C" is
+ *    answered by shrinking max_tokens to what the context still has room for
+ *    (1000-token safety buffer, 3000-token floor, thinking budget + 1 minimum)
+ *    and replaying; with less than the floor available the error surfaces.
+ *  - the non-streaming replay caps max_tokens at 64000 (the API's long-request
+ *    boundary) and keeps thinking.budget_tokens below it.
+ */
+
+export const FLOOR_OUTPUT_TOKENS = 3000;
+export const CONTEXT_SAFETY_BUFFER_TOKENS = 1000;
+export const MAX_NON_STREAMING_TOKENS = 64_000;
+
+const OVERFLOW_RE = /input length and `max_tokens` exceed context limit: (\d+) \+ (\d+) > (\d+)/;
+
+/** `{ inputTokens, maxTokens, contextLimit }` for the exact 400, else null. */
+export function parseMaxTokensContextOverflow(status, message) {
+  if (Number(status) !== 400) return null;
+  const match = OVERFLOW_RE.exec(String(message || ''));
+  if (!match) return null;
+  const [inputTokens, maxTokens, contextLimit] = match.slice(1).map((value) => Number.parseInt(value, 10));
+  return [inputTokens, maxTokens, contextLimit].every(Number.isFinite) ? { inputTokens, maxTokens, contextLimit } : null;
+}
+
+const thinkingBudget = (body) =>
+  body?.thinking?.type === 'enabled' && Number(body.thinking.budget_tokens) > 0 ? Number(body.thinking.budget_tokens) : 0;
+
+/**
+ * Shrink `body.max_tokens` to fit the reported context. Returns true when the
+ * body was adjusted and is worth replaying.
+ */
+export function adjustMaxTokensForContextOverflow(body, status, message) {
+  const overflow = parseMaxTokensContextOverflow(status, message);
+  if (!overflow || !body) return false;
+  const available = Math.max(0, overflow.contextLimit - overflow.inputTokens - CONTEXT_SAFETY_BUFFER_TOKENS);
+  if (available < FLOOR_OUTPUT_TOKENS) return false;
+  body.max_tokens = Math.max(FLOOR_OUTPUT_TOKENS, available, thinkingBudget(body) + 1);
+  return true;
+}
+
+/** Cap a non-streaming body in place (max_tokens and the thinking budget). */
+export function capForNonStreaming(body) {
+  if (!body || !(Number(body.max_tokens) > MAX_NON_STREAMING_TOKENS)) return body;
+  body.max_tokens = MAX_NON_STREAMING_TOKENS;
+  if (thinkingBudget(body)) {
+    body.thinking = {
+      ...body.thinking,
+      budget_tokens: Math.min(body.thinking.budget_tokens, MAX_NON_STREAMING_TOKENS - 1),
+    };
+  }
+  return body;
+}

package/src/runtime/agent/orchestrator/providers/anthropic-max-tokens.mjs

@@ -4,29 +4,21 @@
 //
 // Resolution order:
 //   1. MIXDOG_ANTHROPIC_MAX_OUTPUT_TOKENS env override, if set to a positive
-//      int, wins outright (returned as the safety cap itself).
+//      int, wins, capped by the known model maximum when there is one.
 //   2. Catalog outputTokens for the model id (trusted over hardcoded
 //      heuristics when present — the API reports real per-model limits),
-//      clamped to [MAX_TOKENS_FLOOR, safetyCap].
-//   3. Static per-model table / family heuristic fallback when the catalog
-//      has no entry for this model, also capped at the safety cap.
+//      clamped to safetyCap (never raised: a declared limit is a ceiling).
+//   3. The shared model catalog's outputTokens for the model (cached roster /
+//      LiteLLM / models.dev), same clamp.
+//   4. The pre-catalog family limits for a model no catalog describes, else
+//      the floor.
+
+import { getModelMetadataSync } from './model-catalog.mjs';
 
 const MAX_TOKENS_FLOOR = 8192;
 const DEFAULT_SAFETY_CAP = 65536;
 const ENV_VAR = 'MIXDOG_ANTHROPIC_MAX_OUTPUT_TOKENS';
 
-// Per-model max_tokens when the model id is explicitly listed. New models
-// (e.g., Sonnet 4.7) won't match a specific entry and fall through to the
-// family-based heuristic below. Conservative defaults — model may support
-// more but we'd rather stay within safe bounds.
-const MAX_TOKENS = {
-  'claude-opus-4-8': 65536,
-  'claude-opus-4-7': 65536,
-  'claude-opus-4-6': 65536,
-  'claude-sonnet-4-6': 16384,
-  'claude-haiku-4-5-20251001': 8192,
-};
-
 // Strict-positive env override parsing. Invalid values ("0", negatives,
 // garbage, whitespace) are treated as UNSET — not as "use the default cap
 // outright" — so catalog/fallback still decide for low-cap models. Raw env
@@ -39,11 +31,18 @@ function envAnthropicMaxOutputOverride() {
   return Math.floor(n);
 }
 
-// Static per-model table + family heuristic, used when the catalog has no
-// entry for this model id. Sonnet 5+ ships a much larger output budget than
-// the legacy 4.x line (this is the claude-sonnet-5 fix: 16384 was starving
-// visible output once extended thinking ate into the same hard cap). Keep
-// sonnet-4-x conservative at 16384; only bump 5+.
+// Last resort when no catalog describes the model: the limits known before
+// the catalogs existed. Sonnet 5+ ships a much larger output budget than the
+// legacy 4.x line (16384 starved visible output once extended thinking ate
+// into the same hard cap). Unknown families stay at the floor.
+const MAX_TOKENS = {
+  'claude-opus-4-8': 65536,
+  'claude-opus-4-7': 65536,
+  'claude-opus-4-6': 65536,
+  'claude-sonnet-4-6': 16384,
+  'claude-haiku-4-5-20251001': 8192,
+};
+
 function fallbackAnthropicMaxTokens(model) {
   if (MAX_TOKENS[model]) return MAX_TOKENS[model];
   const id = String(model || '').toLowerCase();
@@ -52,27 +51,39 @@ function fallbackAnthropicMaxTokens(model) {
   const sonnetVersion = id.match(/^claude-sonnet-(\d+)/);
   if (sonnetVersion) return Number(sonnetVersion[1]) >= 5 ? 65536 : 16384;
   if (id.includes('sonnet')) return 16384;
-  if (id.includes('haiku')) return 8192;
-  return 8192;
+  return MAX_TOKENS_FLOOR;
+}
+
+function sharedCatalogOutputTokens(model) {
+  const declared = Number(getModelMetadataSync(String(model || ''), 'anthropic')?.outputTokens);
+  return Number.isFinite(declared) && declared > 0 ? declared : null;
 }
 
 // catalogLookup(model) -> number|null. Providers supply their own strategy
 // for sourcing the catalog array (in-memory mirror + disk fallback for OAuth,
 // plain disk read for the API-key twin — see anthropic.mjs).
-export function resolveAnthropicMaxTokens(model, { catalogLookup } = {}) {
-  const envOverride = envAnthropicMaxOutputOverride();
-  if (envOverride != null) return envOverride;
-  const safetyCap = DEFAULT_SAFETY_CAP;
-  let catalogValue = null;
-  if (typeof catalogLookup === 'function') {
-    try {
-      catalogValue = catalogLookup(model);
-    } catch {
-      catalogValue = null;
+//
+// `modelMaxOutputTokens` (number|null): a gateway-supplied model limit. When
+// positive it takes precedence over every catalog lookup. A declared model
+// maximum is a ceiling: it is never raised to the floor, and the env override
+// is capped by it.
+export function resolveAnthropicMaxTokens(model, { catalogLookup, modelMaxOutputTokens = null } = {}) {
+  const isLimit = (value) => Number.isFinite(value) && value > 0;
+  let declared = Number(modelMaxOutputTokens);
+  if (!isLimit(declared)) {
+    declared = null;
+    if (typeof catalogLookup === 'function') {
+      try {
+        declared = catalogLookup(model);
+      } catch {
+        declared = null;
+      }
     }
+    if (!isLimit(declared)) declared = sharedCatalogOutputTokens(model);
   }
-  if (Number.isFinite(catalogValue) && catalogValue > 0) {
-    return Math.max(MAX_TOKENS_FLOOR, Math.min(catalogValue, safetyCap));
-  }
-  return Math.min(fallbackAnthropicMaxTokens(model), safetyCap);
+  declared = isLimit(declared) ? Math.floor(declared) : null;
+  const envOverride = envAnthropicMaxOutputOverride();
+  if (envOverride != null) return declared == null ? envOverride : Math.min(envOverride, declared);
+  if (declared != null) return Math.min(declared, DEFAULT_SAFETY_CAP);
+  return Math.min(fallbackAnthropicMaxTokens(model), DEFAULT_SAFETY_CAP);
 }

package/src/runtime/agent/orchestrator/providers/anthropic-messages.mjs

@@ -1,6 +1,6 @@
 // Anthropic model catalog + message conversion helpers.
 import { createRequire } from 'node:module';
-import { effortValuesForModel } from './anthropic-effort.mjs';
+import { effortValuesForModel, thinkingTypesFromCapabilities } from './anthropic-effort.mjs';
 import { makeModelCache } from './model-cache.mjs';
 import { resolveAnthropicMaxTokens } from './anthropic-max-tokens.mjs';
 import {
@@ -73,6 +73,7 @@ export function _normalizeAnthropicModel(raw, provider = 'anthropic') {
   const dated = /-\d{8}$/.test(String(id));
   const versioned = !dated && /^claude-[a-z]+-\d+(?:-\d+)?$/i.test(String(id));
   const effortValues = effortValuesForModel(raw?.capabilities, id);
+  const thinkingTypes = thinkingTypesFromCapabilities(raw?.capabilities);
   return {
     id,
     display: raw?.display_name || raw?.displayName || raw?.display || _prettyName(id, family),
@@ -90,6 +91,7 @@ export function _normalizeAnthropicModel(raw, provider = 'anthropic') {
     latest: false,
     supportsReasoning: effortValues.length > 0 || _capabilitySupported(raw?.capabilities?.thinking),
     reasoningOptions: effortValues.length ? [{ type: 'effort', values: effortValues }] : [],
+    ...(thinkingTypes ? { thinkingTypes } : {}),
   };
 }
 // The API-key provider has no catalog cache of its own — it reads the same
@@ -129,8 +131,8 @@ function _catalogOutputTokensFromSharedCache(model) {
   }
 }
 
-export function resolveMaxTokens(model) {
-  return resolveAnthropicMaxTokens(model, { catalogLookup: _catalogOutputTokensFromSharedCache });
+export function resolveMaxTokens(model, { modelMaxOutputTokens = null } = {}) {
+  return resolveAnthropicMaxTokens(model, { catalogLookup: _catalogOutputTokensFromSharedCache, modelMaxOutputTokens });
 }
 
 // Test-only escape hatch for the provider contract scripts
@@ -142,11 +144,12 @@ export const _test = {
   sanitizeInputSchema: (schema, toolName) => sanitizeAnthropicInputSchema(schema, toolName, 'anthropic'),
 };
 
-function deferredAnthropicTools(activeTools, messages, opts) {
-  return sharedDeferredAnthropicTools(activeTools, messages, opts, 'anthropic');
+function deferredAnthropicTools(activeTools, messages, opts, provider = 'anthropic') {
+  return sharedDeferredAnthropicTools(activeTools, messages, opts, provider);
 }
-export function requestAnthropicTools(tools, messages, opts) {
-  return sharedRequestAnthropicTools(tools, messages, opts, 'anthropic');
+// `provider`: the engine's name (a gateway Messages engine runs under its gateway's).
+export function requestAnthropicTools(tools, messages, opts, provider = 'anthropic') {
+  return sharedRequestAnthropicTools(tools, messages, opts, provider);
 }
 // Test-only: expose the lowering so the steering-provenance test can assert
 // the API-key provider keeps steering-tagged user turns distinct (mirrors