mixdog 1.3.5 → 1.4.1

package/src/runtime/agent/orchestrator/providers/account-pool.mjs

@@ -1,5 +1,6 @@
 import {
   ACCOUNT_PROVIDERS,
+  MAX_ACCOUNTS,
   accountScopedSessionId,
   readProviderAccountPool,
   chooseProviderAccount,
@@ -243,6 +244,17 @@ function sessionAccountId(providerName, key, messages, options) {
   return null;
 }
 
+/** The account a send of `model` for `sessionId` would try first right now —
+ *  the session's binding and the choice poolSend makes for its first attempt
+ *  — or null when the provider has no roster account or none is eligible. */
+export function plannedAccountId(providerName, { sessionId = null, messages = [], providerState, model = '' } = {}) {
+  const pool = readProviderAccountPool(providerName);
+  if (!pool.accounts.length) return null;
+  const sessionKey = sessionId ? `${providerName}:${sessionId}` : null;
+  const boundId = sessionAccountId(providerName, sessionKey, messages, { providerState });
+  return chooseProviderAccount(pool, new Set(), Date.now(), model, { sessionAccountId: boundId })?.id || null;
+}
+
 // Stamp the serving account on the answer, independent of transport state,
 // with the account the session stays bound to (`bindingId`).
 function recordServingAccount(providerName, result, id, bindingId) {
@@ -358,110 +370,182 @@ async function accountQuotaExhausted(providerName, row, model, error, account) {
     evidence = providerAccountExhausted(providerAccountWithBlocks(entry), Date.now(), model, options);
     exhausted = exhausted || evidence || providerAccountExhausted(entry, Date.now(), model, options);
   }
-  return { exhausted, delay, evidence, ...(exhausted ? blockUntil(evidence, evidence ? 'quota' : 'unknown') : {}) };
+  const reason = evidence ? 'quota' : 'unknown';
+  return { exhausted, delay, evidence, ...(exhausted ? blockUntil(evidence, reason) : {}) };
+}
+
+// Record an exhausted verdict on the roster. An account-level block holds
+// every model, so it carries no model or limit scope.
+function blockRefusedAccount(providerName, accountId, model, error, verdict) {
+  const { evidence, until, source, reset, accountBlocked } = verdict;
+  return blockProviderAccount(providerName, accountId, until, accountBlocked ? '' : model, source, {
+    quota: evidence === true,
+    reset: reset === true,
+    limit: accountBlocked ? '' : quotaLimitOf(error),
+  });
+}
+
+/**
+ * A refusal `error` that account `accountId` gave outside the pool's send (a
+ * cache warm, which never rotates): judged and recorded on the roster exactly
+ * as the send would, with `instance` as that account's provider. Resolves
+ * whether the account was blocked.
+ */
+export async function recordAccountRefusal(providerName, accountId, model, error, instance) {
+  const row = readProviderAccountPool(providerName).accounts.find((entry) => entry.id === accountId);
+  if (!row) return false;
+  const verdict = await accountQuotaExhausted(providerName, row, model, error, () => instance);
+  if (!verdict.exhausted) return false;
+  await blockRefusedAccount(providerName, row.id, model, error, verdict);
+  return true;
+}
+
+// Whether every account in `ids` (default: the roster) is exhausted with quota
+// evidence: observed in this send (`evidenced`), or a full window.
+function rosterExhaustion(providerName, model, evidenced, ids) {
+  const pool = readProviderAccountPool(providerName);
+  // Manual policy: the eligible set is the selected account alone.
+  const scope = ids || (providerAccountPolicy(pool) === 'manual' ? [pool.selectedId] : null);
+  const rows = scope ? pool.accounts.filter((entry) => scope.includes(entry.id)) : pool.accounts;
+  const opts = { useCredits: pool.useCredits === true };
+  const now = Date.now();
+  const all =
+    rows.length > 0 &&
+    rows.every((entry) =>
+      providerAccountExhausted(
+        evidenced.has(entry.id) ? entry : providerAccountWithBlocks(entry, (block) => block.blockedQuota === true),
+        now,
+        model,
+        opts
+      )
+    );
+  return { rows, opts, now, all };
+}
+
+// Mark `error` only when every account in `ids` is exhausted with quota
+// evidence (`rosterExhaustion`). Without an error of its own, the send reports
+// quota exhaustion only on that evidence, and a rate-limit cooldown otherwise.
+function exhaustedSendError(providerName, model, evidenced, error, ids) {
+  const { rows, opts, now, all } = rosterExhaustion(providerName, model, evidenced, ids);
+  if (all) {
+    return quotaExhausted(error || accountsExhaustedError(opts.useCredits), providerName, model, rows, opts);
+  }
+  return error || accountsCoolingDownError(rows, now, model);
+}
+
+// The provider's bound on the time one send spends waiting for cooldowns.
+function cooldownWaitBoundMs(providerName, account, ids) {
+  const id = ids?.[0] || readProviderAccountPool(providerName).selectedId || 'default';
+  return finiteMs(cooldownPolicyOf(account(id))?.waitForCooldownMs, 0);
+}
+
+// A cooldown-only eligible set whose earliest cooldown ends inside the
+// remaining wait budget is waited out; otherwise the send fails as before.
+// `ledger` is the send's own record of the roster (see `poolSend`).
+async function waitOutCooldownOrThrow(request, ledger, error, ids) {
+  const { providerName, model, account, options } = request;
+  const { rows, now, all } = rosterExhaustion(providerName, model, ledger.evidenced, ids);
+  const bound = cooldownWaitBoundMs(providerName, account, ids);
+  // Persisting a short cooldown can outlast its deadline. Release only
+  // attempts cooled by this send, and only under an enabled wait policy.
+  const expired = bound > 0 && rows.some((row) => ledger.cooled.has(row.id) && !(coolingUntil(row, model) > now));
+  let wait = null;
+  if (!all) wait = expired ? 0 : earliestCooldownMs(rows, now, model);
+  if (wait == null || ledger.waitedMs + wait > bound) {
+    throw exhaustedSendError(providerName, model, ledger.evidenced, error, ids);
+  }
+  options.onStageChange?.('reconnecting', {
+    message: `Rate limited — every account is cooling down; retrying in ${Math.ceil(wait / 1000)}s`,
+    reason: 'rate_limited',
+    waitMs: wait,
+    retryAt: now + wait,
+  });
+  // A zero-duration sleep does not check cancellation, including on the
+  // final allowed send when no next loop iteration will check it either.
+  options.signal?.throwIfAborted();
+  await sleepWithAbort(wait, options.signal);
+  ledger.waitedMs += wait;
+  const lifted = Date.now();
+  for (const row of readProviderAccountPool(providerName).accounts) {
+    if (ledger.cooled.has(row.id) && !(coolingUntil(row, model) > lifted)) {
+      ledger.cooled.delete(row.id);
+      ledger.attempted.delete(row.id);
+    }
+  }
+}
+
+// No roster: with credit use off, a stored reading showing the plan's window
+// spent refuses before the implicit account sends.
+function throwIfPlanQuotaSpent(providerName, pool, model) {
+  if (pool.useCredits !== true) {
+    const stored = readCachedOAuthUsageSnapshot({ provider: providerName, model: '' });
+    // A snapshot cached before per-model gating is stale evidence.
+    if (stored?.quotaWindows?.length && !staleQuotaWindows(providerName, stored.quotaWindows)) {
+      const row = { usage: { windows: stored.quotaWindows, checkedAt: stored.cachedAt } };
+      if (providerAccountExhausted(row, Date.now(), model)) {
+        throw quotaExhausted(accountsExhaustedError(false), providerName, model, [row]);
+      }
+    }
+  }
+}
+
+// Headroom policy: a session's first pick, or its move off its account on a
+// limit, becomes the selection; continuing on its account does not, so
+// concurrent sessions never flip the selection back and forth. A move forced
+// by a model-scoped limit serves this request only (`scoped`). Stamps the
+// serving account on `result` and resolves whether the selection may commit.
+function bindServedAccount(providerName, result, rowId, model, binding) {
+  const { policy, boundId, sessionKey, switched, refusalScoped } = binding;
+  const leftBound = Boolean(boundId) && rowId !== boundId;
+  const scoped = switched
+    ? refusalScoped
+    : policy === 'headroom' && leftBound && accountExhaustedForModelOnly(providerName, boundId, model);
+  recordServingAccount(providerName, result, rowId, scoped && boundId ? boundId : rowId);
+  if (sessionKey && policy === 'headroom' && !scoped) rememberSessionAccount(sessionKey, rowId);
+  return { scoped, commit: policy !== 'headroom' || !boundId || leftBound };
+}
+
+// A failed attempt is never re-issued once output reached the caller or the
+// attempt was unsafe to retry (`unsafe`, judged by the caller and read only
+// when nothing was emitted).
+function attemptUnretryable(bound, error, unsafe) {
+  return Boolean(bound.emitted() || unsafe() || error.liveTextEmitted || error.emittedToolCall);
+}
+
+function rotationReason(evidence, accountBlocked) {
+  if (evidence) return 'Quota exhausted';
+  if (accountBlocked) return 'Account blocked';
+  return 'Rate limited (cooldown)';
 }
 
 // The pool's send: walks the eligible accounts until one answers, blocking
 // the ones whose quota window is exhausted along the way.
 function poolSend(providerName, account) {
   return async function send(messages, model, tools, options = {}) {
-    const attempted = new Set();
+    const request = { providerName, model, account, options };
+    // This send's record of the roster: the accounts it tried, those it found
+    // exhausted with quota evidence, those it blocked on a rate-limit
+    // cooldown, and the time it spent waiting for cooldowns.
+    const ledger = { attempted: new Set(), evidenced: new Set(), cooled: new Set(), waitedMs: 0 };
     let lastError;
     let probed = false;
-    const evidenced = new Set();
+    let sends = 0;
     const sessionKey = options.sessionId ? `${providerName}:${options.sessionId}` : null;
     const boundId = sessionAccountId(providerName, sessionKey, messages, options);
     // Whether this send already left an account, and whether the latest quota
     // refusal held only for this model's family.
     let switched = false;
     let refusalScoped = false;
-    // Mark `error` only when every account in `ids` (default: the roster) is
-    // exhausted with quota evidence: observed in this send, or a full window.
-    // Without an error of its own, the send reports quota exhaustion only on
-    // that evidence, and a rate-limit cooldown otherwise.
-    const exhaustion = (ids) => {
-      const pool = readProviderAccountPool(providerName);
-      // Manual policy: the eligible set is the selected account alone.
-      const scope = ids || (providerAccountPolicy(pool) === 'manual' ? [pool.selectedId] : null);
-      const rows = scope ? pool.accounts.filter((entry) => scope.includes(entry.id)) : pool.accounts;
-      const opts = { useCredits: pool.useCredits === true };
-      const now = Date.now();
-      const all =
-        rows.length > 0 &&
-        rows.every((entry) =>
-          providerAccountExhausted(
-            evidenced.has(entry.id) ? entry : providerAccountWithBlocks(entry, (block) => block.blockedQuota === true),
-            now,
-            model,
-            opts
-          )
-        );
-      return { rows, opts, now, all };
-    };
-    const markExhausted = (error, ids) => {
-      const { rows, opts, now, all } = exhaustion(ids);
-      if (all) {
-        return quotaExhausted(error || accountsExhaustedError(opts.useCredits), providerName, model, rows, opts);
-      }
-      return error || accountsCoolingDownError(rows, now, model);
-    };
-    // Accounts this send blocked on a rate-limit cooldown, the time it spent
-    // waiting for cooldowns, and the provider's wait bound.
-    const cooled = new Set();
-    let waitedMs = 0;
-    let sends = 0;
-    const waitBoundMs = (ids) => {
-      const id = ids?.[0] || readProviderAccountPool(providerName).selectedId || 'default';
-      return finiteMs(cooldownPolicyOf(account(id))?.waitForCooldownMs, 0);
-    };
-    // A cooldown-only eligible set whose earliest cooldown ends inside the
-    // remaining wait budget is waited out; otherwise the send fails as before.
-    const waitOrThrow = async (error, ids) => {
-      const { rows, now, all } = exhaustion(ids);
-      const bound = waitBoundMs(ids);
-      // Persisting a short cooldown can outlast its deadline. Release only
-      // attempts cooled by this send, and only under an enabled wait policy.
-      const expired = bound > 0 && rows.some((row) => cooled.has(row.id) && !(coolingUntil(row, model) > now));
-      let wait = null;
-      if (!all) wait = expired ? 0 : earliestCooldownMs(rows, now, model);
-      if (wait == null || waitedMs + wait > bound) throw markExhausted(error, ids);
-      options.onStageChange?.('reconnecting', {
-        message: `Rate limited — every account is cooling down; retrying in ${Math.ceil(wait / 1000)}s`,
-        reason: 'rate_limited',
-        waitMs: wait,
-        retryAt: now + wait,
-      });
-      // A zero-duration sleep does not check cancellation, including on the
-      // final allowed send when no next loop iteration will check it either.
-      options.signal?.throwIfAborted();
-      await sleepWithAbort(wait, options.signal);
-      waitedMs += wait;
-      const lifted = Date.now();
-      for (const row of readProviderAccountPool(providerName).accounts) {
-        if (cooled.has(row.id) && !(coolingUntil(row, model) > lifted)) {
-          cooled.delete(row.id);
-          attempted.delete(row.id);
-        }
-      }
-    };
-    while (attempted.size < 20 && sends < 20) {
+    // One try per connectable account at most (provider-accounts.mjs MAX_ACCOUNTS).
+    while (ledger.attempted.size < MAX_ACCOUNTS && sends < MAX_ACCOUNTS) {
       options.signal?.throwIfAborted();
       const pool = readProviderAccountPool(providerName);
       if (!pool.accounts.length) {
-        if (pool.useCredits !== true) {
-          const stored = readCachedOAuthUsageSnapshot({ provider: providerName, model: '' });
-          // A snapshot cached before per-model gating is stale evidence.
-          if (stored?.quotaWindows?.length && !staleQuotaWindows(providerName, stored.quotaWindows)) {
-            const row = { usage: { windows: stored.quotaWindows, checkedAt: stored.cachedAt } };
-            if (providerAccountExhausted(row, Date.now(), model)) {
-              throw quotaExhausted(accountsExhaustedError(false), providerName, model, [row]);
-            }
-          }
-        }
+        throwIfPlanQuotaSpent(providerName, pool, model);
         return account('default').send(messages, model, tools, options);
       }
       const policy = providerAccountPolicy(pool);
-      const row = chooseProviderAccount(pool, attempted, Date.now(), model, { sessionAccountId: boundId });
+      const row = chooseProviderAccount(pool, ledger.attempted, Date.now(), model, { sessionAccountId: boundId });
       if (!row) {
         // Once per send: a refusal built on a stale meter must not outlive the
         // meter. Re-measuring can only widen the roster, so it is tried before
@@ -470,26 +554,22 @@ function poolSend(providerName, account) {
           probed = true;
           if (await probeRefusedAccounts(providerName, pool, model, account)) continue;
         }
-        await waitOrThrow(lastError);
+        await waitOutCooldownOrThrow(request, ledger, lastError);
         continue;
       }
-      attempted.add(row.id);
+      ledger.attempted.add(row.id);
       sends += 1;
       const bound = boundAccountSend(providerName, row, messages, options);
       try {
         const result = await account(row.id).send(bound.history, model, tools, bound.opts);
         quotaStrikes.delete(`${providerName}:${row.id}`);
-        // Headroom policy: a session's first pick, or its move off its account
-        // on a limit, becomes the selection; continuing on its account does
-        // not, so concurrent sessions never flip the selection back and forth.
-        // A move forced by a model-scoped limit serves this request only.
-        const leftBound = Boolean(boundId) && row.id !== boundId;
-        const scoped = switched
-          ? refusalScoped
-          : policy === 'headroom' && leftBound && accountExhaustedForModelOnly(providerName, boundId, model);
-        recordServingAccount(providerName, result, row.id, scoped && boundId ? boundId : row.id);
-        if (sessionKey && policy === 'headroom' && !scoped) rememberSessionAccount(sessionKey, row.id);
-        const commit = policy !== 'headroom' || !boundId || leftBound;
+        const { scoped, commit } = bindServedAccount(providerName, result, row.id, model, {
+          policy,
+          boundId,
+          sessionKey,
+          switched,
+          refusalScoped,
+        });
         if (commit && (await commitFallbackAccount(providerName, pool, row, model, scoped, policy))) {
           // Publish only a committed selection, never a speculative retry or
           // one superseded by a manual switch. The existing progress channel
@@ -508,62 +588,41 @@ function poolSend(providerName, account) {
       } catch (error) {
         if (options.signal?.aborted) throw error;
         if (error?.reauthRequired === true) {
-          if (
-            policy === 'manual' ||
-            bound.emitted() ||
-            error.unsafeToRetry ||
-            error.liveTextEmitted ||
-            error.emittedToolCall
-          )
-            throw error;
+          if (policy === 'manual' || attemptUnretryable(bound, error, () => error.unsafeToRetry)) throw error;
           lastError = error;
           switched = true;
           refusalScoped = false;
           options.onStageChange?.('reconnecting', { message: 'Sign-in expired — switching to the next account' });
           continue;
         }
-        const { exhausted, evidence, until, source, reset, accountBlocked } = await accountQuotaExhausted(
-          providerName,
-          row,
-          model,
-          error,
-          account
-        );
+        const verdict = await accountQuotaExhausted(providerName, row, model, error, account);
+        const { exhausted, evidence, accountBlocked } = verdict;
         if (options.signal?.aborted || !exhausted) throw error;
-        if (evidence) evidenced.add(row.id);
-        else cooled.add(row.id);
-        // An account-level block holds every model, so it carries no model or
-        // limit scope.
-        await blockProviderAccount(providerName, row.id, until, accountBlocked ? '' : model, source, {
-          quota: evidence === true,
-          reset: reset === true,
-          limit: accountBlocked ? '' : quotaLimitOf(error),
-        });
+        if (evidence) ledger.evidenced.add(row.id);
+        else ledger.cooled.add(row.id);
+        await blockRefusedAccount(providerName, row.id, model, error, verdict);
         // An account block is unsafe to re-issue on THAT account only; with no
         // output emitted, the next account may serve the same request.
-        if (
-          bound.emitted() ||
-          (error.unsafeToRetry && accountBlocked !== true) ||
-          error.liveTextEmitted ||
-          error.emittedToolCall
-        )
-          throw error;
+        if (attemptUnretryable(bound, error, () => error.unsafeToRetry && accountBlocked !== true)) throw error;
         // Manual policy: the eligible set is the selected account alone.
         if (policy === 'manual') {
-          await waitOrThrow(error, [row.id]);
+          await waitOutCooldownOrThrow(request, ledger, error, [row.id]);
           lastError = error;
           continue;
         }
         lastError = error;
         switched = true;
         refusalScoped = accountExhaustedForModelOnly(providerName, row.id, model);
-        let reason = 'Rate limited (cooldown)';
-        if (evidence) reason = 'Quota exhausted';
-        else if (accountBlocked) reason = 'Account blocked';
+        const reason = rotationReason(evidence, accountBlocked);
         options.onStageChange?.('reconnecting', { message: `${reason} — switching to the next account` });
       }
     }
-    throw markExhausted(lastError || new Error('Provider account attempts exhausted.'));
+    throw exhaustedSendError(
+      providerName,
+      model,
+      ledger.evidenced,
+      lastError || new Error('Provider account attempts exhausted.')
+    );
   };
 }
 

package/src/runtime/agent/orchestrator/providers/admission-scheduler.mjs

@@ -264,7 +264,9 @@ export class ProviderAdmissionScheduler {
         running.parentAbort = () => {
           try {
             controller.abort(item.signal.reason);
-          } catch {}
+          } catch {
+            // the controller may already be aborted
+          }
         };
         item.signal.addEventListener('abort', running.parentAbort, { once: true });
       }
@@ -301,7 +303,9 @@ export class ProviderAdmissionScheduler {
           if (running.parentAbort && running.parentSignal) {
             try {
               running.parentSignal.removeEventListener('abort', running.parentAbort);
-            } catch {}
+            } catch {
+              // the abort listener may already be gone
+            }
           }
           this.running.delete(running);
           lane.active -= 1;
@@ -312,6 +316,32 @@ export class ProviderAdmissionScheduler {
     if (this._canDeleteLane(lane)) this._deleteLane(key, lane);
   }
 
+  /**
+   * Why a request that must not wait (a cache warm) cannot start on lane
+   * `key` now, or null: the lane's rate-limit cooldown, or a lane throttled
+   * after a 429 that would queue it.
+   */
+  immediateBlock(key) {
+    if (this.closedReason) return 'provider scheduler closed';
+    const lane = this.lanes.get(String(key || ''));
+    if (!lane) return null;
+    if (lane.adaptive && lane.cooldownUntil > this.now()) return 'rate-limit cooldown';
+    if (lane.queue.length > 0 || lane.active >= lane.limit) return 'account throttled';
+    return null;
+  }
+
+  /** Record a rate limit a request outside `run` (a cache warm) received on
+   *  lane `key`, into the same cooldown state (and broadcast) as a send's. */
+  recordRateLimit(key, error) {
+    const laneKey = String(key || '');
+    if (!laneKey || this.closedReason) return false;
+    const lane = this.lanes.get(laneKey) || createAdmissionLane(laneKey, this.concurrency);
+    this.lanes.set(laneKey, lane);
+    const recorded = this._recordFailure(laneKey, lane, error);
+    if (this._canDeleteLane(lane)) this._deleteLane(laneKey, lane);
+    return recorded;
+  }
+
   snapshot() {
     const now = this.now();
     return {
@@ -428,7 +458,9 @@ export class ProviderAdmissionScheduler {
     if (item.onAbort && item.signal) {
       try {
         item.signal.removeEventListener('abort', item.onAbort);
-      } catch {}
+      } catch {
+        // the abort listener may already be gone
+      }
       item.onAbort = null;
     }
   }
@@ -453,7 +485,9 @@ export class ProviderAdmissionScheduler {
     for (const running of this.running) {
       try {
         running.controller.abort(this.closedReason);
-      } catch {}
+      } catch {
+        // the controller may already be aborted
+      }
     }
   }
 }
@@ -476,7 +510,7 @@ function digest(value) {
     .digest('hex');
 }
 
-function providerAdmissionKey(providerName, provider) {
+export function providerAdmissionKey(providerName, provider) {
   const name = String(providerName || provider?.name || 'provider');
   const stableAnthropicOAuthPath =
     name.toLowerCase() === 'anthropic-oauth'
@@ -556,7 +590,9 @@ export function wrapProviderAdmission(provider, providerName, scheduler = provid
             // time. Provider-local retry remains the sole retry owner.
             try {
               opts.onStageChange?.('requesting');
-            } catch {}
+            } catch {
+              // the stage observer is advisory
+            }
             const admittedOpts = {
               ...opts,
               signal: admissionSignal,

package/src/runtime/agent/orchestrator/providers/anthropic-api-recovery.mjs

@@ -52,7 +52,7 @@ export function createAnthropicApiRecovery({
         : PROVIDER_NONSTREAM_TOTAL_TIMEOUT_MS;
     const lifetime = createTimeoutSignal(totalSignal, timeoutMs, `${label} Anthropic non-streaming fallback`);
     try {
-      const message = await transport.requestNonStreamingMessage(nonStreamingParams, lifetime.signal);
+      const message = await transport.requestNonStreamingMessage(nonStreamingParams, lifetime.signal, timeoutMs);
       return buildTurnResult(normalizeAnthropicNonStreamingResponse(message, useModel));
     } catch (error) {
       if (error instanceof AnthropicFallbackTriggeredError || totalSignal?.aborted) throw error;

package/src/runtime/agent/orchestrator/providers/anthropic-api-request.mjs

@@ -10,7 +10,11 @@
  * anthropic-turn-result.mjs); nothing here touches the socket.
  */
 import { prepareAnthropicImages } from './lib/anthropic-image-input.mjs';
-import { anthropicPrefixFingerprint, recordAnthropicPrefix } from './lib/anthropic-prefix-trace.mjs';
+import {
+  anthropicPrefixFingerprint,
+  anthropicPrefixSessionId,
+  recordAnthropicPrefix,
+} from './lib/anthropic-prefix-trace.mjs';
 import { buildAnthropicBetaHeaders, supportsAnthropicFastMode } from './anthropic-betas.mjs';
 import { applyAnthropicServerFallback } from './anthropic-server-fallback.mjs';
 import { fastModeAvailable } from './anthropic-fast-mode.mjs';
@@ -93,7 +97,7 @@ export async function buildAnthropicApiRequest({
   // Tools are resolved BEFORE the messages: the lowering needs the final
   // tool list to drop tool_reference blocks whose tool no longer ships
   // in this request (otherwise the API rejects the whole turn).
-  const requestTools = requestAnthropicTools(tools, chatMsgs, opts, name);
+  const requestTools = requestAnthropicTools(tools, chatMsgs, opts, name, config);
   // Message-tail cache budget (4-BP layout + ANTHROPIC_MSG_SLOTS) is
   // shared with anthropic-oauth — see resolveAnthropicMessageCacheSlots.
   const messageCacheSlots = resolveAnthropicMessageCacheSlots(systemBlocks, ttls, { tools: requestTools });
@@ -183,7 +187,7 @@ export async function buildAnthropicApiRequest({
   // (once) → mark → prepare image bytes → send.
   params.stream = true;
   // Diagnostic: per-block prefix hashes of exactly what is sent.
-  recordAnthropicPrefix(opts.sessionId || opts.session?.id || null, anthropicPrefixFingerprint(params));
+  recordAnthropicPrefix(anthropicPrefixSessionId(opts), anthropicPrefixFingerprint(params));
 
   const requestHeaders = requestHeadersFor(params, {
     config,

package/src/runtime/agent/orchestrator/providers/anthropic-api-transport.mjs

@@ -215,12 +215,18 @@ export function createAnthropicApiTransport({
     }
   };
 
-  const requestNonStreamingMessage = (nonStreamingParams, signal) =>
+  // `timeoutMs` is the replay's own lifetime, handed to the SDK as the request
+  // timeout: without an explicit one the SDK refuses any stream:false body
+  // whose max_tokens it estimates past 10 minutes before sending it.
+  const requestNonStreamingMessage = (nonStreamingParams, signal, timeoutMs) =>
     withRetry(
       withBodyRecovery(nonStreamingParams, async ({ signal: attemptSignal }) => {
         noteRequestServiceTier(nonStreamingParams.speed);
         try {
-          return await client.messages.create(nonStreamingParams, requestOptions(attemptSignal));
+          return await client.messages.create(nonStreamingParams, {
+            ...requestOptions(attemptSignal),
+            timeout: timeoutMs,
+          });
         } catch (err) {
           throw annotateHttpFailure(err);
         }