mixdog 1.4.0 → 1.4.2

package/src/runtime/agent/orchestrator/mcp/oauth-login.mjs

@@ -1,10 +1,77 @@
 import { createServer } from 'node:http';
+import { listenOnFetchSafePort } from '../../../shared/fetch-safe-listen.mjs';
 import { randomBytes } from 'node:crypto';
 import { normalizeMcpTransportUrl } from './client-config.mjs';
 import { identityFromTokenResponse } from './oauth-account.mjs';
 import { answerOAuthCallback } from './oauth-callback.mjs';
 import { anySignal, loginFailed, reauthenticationRequired, scopeNotGranted } from './oauth-shared.mjs';
 
+// Fetch for the SDK: transport-URL normalized, no redirects, bounded by the
+// login `signal`. The token endpoint's answer is read for who the tokens
+// belong to (oauth-account.mjs): the SDK keeps only the token fields.
+function makeSafeFetch({ fetchImpl, flow, signal }) {
+  return async (input, init = {}) => {
+    const response = await fetchImpl(normalizeMcpTransportUrl(input), {
+      ...init,
+      redirect: 'error',
+      signal: anySignal(signal, init.signal),
+    });
+    if (response.ok && /(^|&)grant_type=/.test(String(init.body ?? ''))) {
+      flow.identity = identityFromTokenResponse(
+        await response
+          .clone()
+          .json()
+          .catch(() => null)
+      );
+    }
+    return response;
+  };
+}
+
+// The caller's progress hooks (mcp-oauth-login.mjs): the callback arrived,
+// then the tokens are stored.
+function reportProgress(browser, hook) {
+  try {
+    browser?.[hook]?.();
+  } catch {
+    /* progress reporting never fails the login */
+  }
+}
+
+// The callback promise of one login, and the browser page held open for the
+// loopback callback until the code exchange and scope check end: `settle()` is
+// success, `settle({ code })` a failure. Bounded by `signal`, like the
+// exchange itself. `setFlushing` receives each answered page's flush.
+function awaitCallback({ flow, signal, stopListening, setFlushing }) {
+  let abort;
+  let respond;
+  const settle = (failure) => {
+    const answer = respond;
+    respond = undefined;
+    if (!answer) return undefined;
+    const flushed = answer(failure);
+    setFlushing(flushed);
+    return flushed;
+  };
+  const callback = new Promise((resolve, reject) => {
+    const finish = (code, page) => {
+      if (page) respond = page;
+      return code ? resolve(code) : reject(loginFailed());
+    };
+    flow.finishCallback = finish;
+    // Timeout, cancel or abort: the held page gets the generic failure now
+    // (the exchange or a credential write may be stalled past the deadline),
+    // and the listener closes once it is flushed.
+    abort = () => {
+      finish();
+      settle({});
+      stopListening();
+    };
+    signal.addEventListener('abort', abort, { once: true });
+  });
+  return { callback, settle, abort };
+}
+
 /**
  * The browser login of one connection over its credential `cache` and login
  * `flow` state: the loopback callback listener and the SDK authorization
@@ -48,8 +115,10 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
     await new Promise((resolve, reject) => {
       flow.listener.once('error', reject);
       // Retain the registered redirect URI if this connection later needs
-      // refresh or reauthorization; never register a different callback.
-      flow.listener.listen(creds.redirectUrl ? Number(new URL(creds.redirectUrl).port) : 0, '127.0.0.1', resolve);
+      // refresh or reauthorization; never register a different callback. A new
+      // one is a port the browser can be redirected to.
+      if (creds.redirectUrl) flow.listener.listen(Number(new URL(creds.redirectUrl).port), '127.0.0.1', resolve);
+      else listenOnFetchSafePort(flow.listener, '127.0.0.1', resolve);
     });
     creds.redirectUrl = `http://127.0.0.1:${flow.listener.address().port}/oauth/callback`;
   }
@@ -62,61 +131,19 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
     // the token fields, so the token endpoint's answer is read here.
     flow.identity = undefined;
     flow.signal = signal;
-    const safeFetch = async (input, init = {}) => {
-      const response = await fetchImpl(normalizeMcpTransportUrl(input), {
-        ...init,
-        redirect: 'error',
-        signal: anySignal(signal, init.signal),
-      });
-      if (response.ok && /(^|&)grant_type=/.test(String(init.body ?? ''))) {
-        flow.identity = identityFromTokenResponse(
-          await response
-            .clone()
-            .json()
-            .catch(() => null)
-        );
-      }
-      return response;
-    };
-    // The caller's progress hooks (mcp-oauth-login.mjs): the callback arrived,
-    // then the tokens are stored.
-    const progress = (hook) => {
-      try {
-        browser?.[hook]?.();
-      } catch {
-        /* progress reporting never fails the login */
-      }
-    };
-    let abort;
-    // The browser page held open for the loopback callback until the code
-    // exchange and scope check end: `settle()` is success, `settle({ code })`
-    // a failure. Bounded by `signal`, like the exchange itself.
-    let respond;
-    const settle = (failure) => {
-      const answer = respond;
-      respond = undefined;
-      if (!answer) return undefined;
-      flushing = answer(failure);
-      return flushing;
-    };
-    const callback = new Promise((resolve, reject) => {
-      const finish = (code, page) => {
-        if (page) respond = page;
-        return code ? resolve(code) : reject(loginFailed());
-      };
-      flow.finishCallback = finish;
-      // Timeout, cancel or abort: the held page gets the generic failure now
-      // (the exchange or a credential write may be stalled past the deadline),
-      // and the listener closes once it is flushed.
-      abort = () => {
-        finish();
-        settle({});
-        stopListening();
-      };
-      signal.addEventListener('abort', abort, { once: true });
+    const safeFetch = makeSafeFetch({ fetchImpl, flow, signal });
+    const progress = (hook) => reportProgress(browser, hook);
+    const { callback, settle, abort } = awaitCallback({
+      flow,
+      signal,
+      stopListening,
+      setFlushing: (page) => {
+        flushing = page;
+      },
     });
     // A discovery/registration error can precede waiting for the callback.
     callback.catch(() => {});
+    let codeReceived = false;
     try {
       signal.throwIfAborted();
       const { auth } = await import('@modelcontextprotocol/sdk/client/auth.js');
@@ -138,6 +165,7 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
       });
       if (result === 'REDIRECT') {
         const code = await callback;
+        codeReceived = true;
         signal.throwIfAborted();
         progress('onCallback');
         const exchanged = await cache.withLock(async () => {
@@ -154,6 +182,12 @@ export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, op
       await settle();
     } catch (error) {
       await settle({ code: error?.code });
+      // An authorization server that no longer knows our client_id answers the
+      // browser with an HTTP error, never a redirect or a token-endpoint
+      // invalid_client, so the SDK cannot see it: register again next time.
+      if (interactive && flow.browserOpened && !codeReceived && !provider.preRegistered) {
+        await provider.invalidateCredentials('client').catch(() => {});
+      }
       // SDK errors may contain authorization server response bodies/secrets.
       if (error?.code === 'reauthenticationRequired' || !interactive) throw reauthenticationRequired();
       // Our own error names scopes only (no token data): the one to pass on.

package/src/runtime/agent/orchestrator/mcp/oauth.mjs

@@ -50,28 +50,33 @@ export function isMcpOAuthScopeNotGranted(error) {
   return false;
 }
 
-// One keychain entry per exact server URL. Windows stores each account as a
-// file name, so the account is a hash of the URL and nothing else.
-export function mcpOAuthAccount(url) {
-  return `mcp-oauth.${createHash('sha256').update(url).digest('hex')}`;
+// One keychain entry per credential key: the exact server URL, or a connector
+// account's own key (client-config.mjs resolveMcpOAuthCredentialKey). Windows
+// stores each account as a file name, so the account is a hash of the key and
+// nothing else.
+export function mcpOAuthAccount(key) {
+  return `mcp-oauth.${createHash('sha256').update(key).digest('hex')}`;
 }
 
-/** Whether OAuth tokens are stored for one server URL, read from the
- *  non-secret revision marker without touching the keychain. */
-export function hasStoredMcpOAuthTokens(url) {
+/** What one sign-in is stored under: `credentialKey`, else the normalized URL. */
+const credentialIdOf = (url, credentialKey) => credentialKey || normalizeMcpTransportUrl(url);
+
+/** Whether OAuth tokens are stored for one server URL (or `credentialKey`),
+ *  read from the non-secret revision marker without touching the keychain. */
+export function hasStoredMcpOAuthTokens(url, credentialKey) {
   try {
-    const marker = readFileSync(credentialFile(mcpOAuthAccount(normalizeMcpTransportUrl(url)), 'rev'), 'utf8');
+    const marker = readFileSync(credentialFile(mcpOAuthAccount(credentialIdOf(url, credentialKey)), 'rev'), 'utf8');
     return marker.endsWith(TOKENS_FLAG);
   } catch {
     return false;
   }
 }
 
-/** Who the stored sign-in of one MCP server URL belongs to, without a keychain
- *  read: `{ account, workspace, forcedChoice }` (empty strings when the server
- *  named nobody), or null when signed out. */
-export function storedMcpOAuthIdentity(url) {
-  return readIdentityFile(mcpOAuthAccount(normalizeMcpTransportUrl(url)));
+/** Who the stored sign-in of one MCP server URL (or `credentialKey`) belongs
+ *  to, without a keychain read: `{ account, workspace, forcedChoice }` (empty
+ *  strings when the server named nobody), or null when signed out. */
+export function storedMcpOAuthIdentity(url, credentialKey) {
+  return readIdentityFile(mcpOAuthAccount(credentialIdOf(url, credentialKey)));
 }
 
 // RFC 7009 revocation of the stored grant, only where the authorization server
@@ -114,9 +119,15 @@ async function revokeStoredGrant(saved, fetchImpl) {
  *  explicit reconnect to log in again. With `revoke`, the grant is first
  *  revoked at the authorization server where it documents a revocation
  *  endpoint. Resolves `{ revoked }`. */
-export async function clearMcpOAuth({ url, credentialStore = keychain, revoke = false, fetchImpl = fetch }) {
-  url = normalizeMcpTransportUrl(url);
-  const account = mcpOAuthAccount(url);
+export async function clearMcpOAuth({
+  url,
+  credentialKey,
+  credentialStore = keychain,
+  revoke = false,
+  fetchImpl = fetch,
+}) {
+  const id = credentialIdOf(url, credentialKey);
+  const account = mcpOAuthAccount(id);
   let revoked = false;
   await withCredentialLock(account, async () => {
     const saved = await readStoredCredentials(credentialStore, account);
@@ -125,7 +136,7 @@ export async function clearMcpOAuth({ url, credentialStore = keychain, revoke =
     if (saved != null) await credentialStore.deleteSecretAsync(account);
     await writeIdentityFile(account, null);
   });
-  scopes.get(credentialStore)?.get(url)?.oauth.clear();
+  scopes.get(credentialStore)?.get(id)?.oauth.clear();
   return { revoked };
 }
 
@@ -151,6 +162,7 @@ async function storeEntry(account, url, value, credentialStore) {
  */
 export function startMcpOAuthSwitch({
   url,
+  credentialKey,
   launch,
   serverName,
   credentialStore = keychain,
@@ -209,7 +221,7 @@ export function startMcpOAuthSwitch({
     timeoutMs,
   });
   const done = (async () => {
-    const saved = await readStoredCredentials(credentialStore, mcpOAuthAccount(url));
+    const saved = await readStoredCredentials(credentialStore, mcpOAuthAccount(credentialIdOf(url, credentialKey)));
     if (saved) {
       const value = JSON.parse(saved);
       if (value.url === url) {
@@ -244,9 +256,9 @@ export function startMcpOAuthSwitch({
 /** Store the sign-in a switch returned as the URL's sign-in; resolves a
  *  `rollback()` that restores the previous one (or none). Live connections
  *  adopt either through the revision marker on their next request. */
-export async function commitMcpOAuthSwitch({ url, signIn, credentialStore = keychain }) {
+export async function commitMcpOAuthSwitch({ url, credentialKey, signIn, credentialStore = keychain }) {
   url = normalizeMcpTransportUrl(url);
-  const account = mcpOAuthAccount(url);
+  const account = mcpOAuthAccount(credentialIdOf(url, credentialKey));
   let previous = null;
   await withCredentialLock(account, async () => {
     previous = await readStoredCredentials(credentialStore, account);
@@ -262,9 +274,11 @@ export async function commitMcpOAuthSwitch({ url, signIn, credentialStore = keyc
 }
 
 // The keychain is the only durable store. Exact URLs, including query strings,
-// partition clients and tokens even when servers share an authorization issuer.
+// partition clients and tokens even when servers share an authorization issuer;
+// a `credentialKey` (a connector account's own) partitions them at one URL.
 export function createMcpOAuth({
   url,
+  credentialKey,
   credentialStore = keychain,
   interactive = false,
   isTransportEndpoint = () => false,
@@ -272,15 +286,16 @@ export function createMcpOAuth({
   ...options
 }) {
   url = normalizeMcpTransportUrl(url);
+  const id = credentialIdOf(url, credentialKey);
   let entries = scopes.get(credentialStore);
   if (!entries) {
     entries = new Map();
     scopes.set(credentialStore, entries);
   }
-  let entry = entries.get(url);
+  let entry = entries.get(id);
   if (!entry) {
-    entry = { oauth: createSharedOAuth({ url, credentialStore, ...options }), users: 0 };
-    entries.set(url, entry);
+    entry = { oauth: createSharedOAuth({ url, account: mcpOAuthAccount(id), credentialStore, ...options }), users: 0 };
+    entries.set(id, entry);
   }
   entry.users++;
   const lifetime = new AbortController();
@@ -346,7 +361,7 @@ export function createMcpOAuth({
       lifetime.abort();
       if (--entry.users === 0) {
         entry.oauth.close();
-        entries.delete(url);
+        entries.delete(id);
       }
     },
   };
@@ -354,6 +369,7 @@ export function createMcpOAuth({
 
 function createSharedOAuth({
   url,
+  account,
   credentialStore,
   openBrowser = openInBrowser,
   fetchImpl = fetch,
@@ -361,7 +377,7 @@ function createSharedOAuth({
   oauthClient = null,
 }) {
   const lifetime = new AbortController();
-  const cache = createCredentialCache({ url, credentialStore, account: mcpOAuthAccount(url) });
+  const cache = createCredentialCache({ url, credentialStore, account });
   const { creds } = cache;
   const flow = {
     listener: undefined,

package/src/runtime/agent/orchestrator/providers/account-pool.mjs

@@ -13,6 +13,7 @@ import {
   providerAccountWithBlocks,
   providerAccountBlockedUntil,
   staleQuotaWindows,
+  isCustomKeyProvider,
 } from '../../../shared/provider-accounts.mjs';
 import { withProviderAccount, hasExplicitProviderAuthBinding } from '../../../shared/provider-auth-binding.mjs';
 import { isExplicitUserAbortError, markProviderRecoveryExhausted } from './retry-classifier.mjs';
@@ -161,8 +162,11 @@ function quotaExhausted(error, providerName, model, rows, options = {}) {
 // caller does not subscribe, and account-bound connection/delta state stays
 // apart without changing the visible Mixdog session, so no stale server state
 // crosses an account switch. `emitted()` reports whether output reached the
-// caller.
-function boundAccountSend(providerName, row, messages, options) {
+// caller. `servedBy` names the account a history message or provider state
+// came from; only that account's replay and state are passed on.
+const replayAccount = (entry) => entry?.providerReplay?.accountId ?? entry?.providerAccountId;
+
+function boundAccountSend(providerName, row, messages, options, servedBy = replayAccount) {
   let emitted = false;
   const opts = { ...options };
   for (const key of ['onStreamDelta', 'onTextDelta', 'onToolCall', 'onThinkingDelta']) {
@@ -178,9 +182,9 @@ function boundAccountSend(providerName, row, messages, options) {
     // The spend still belongs to the visible session (usage-accounting.mjs).
     opts.usageSessionId = options.usageSessionId || options.sessionId;
   }
-  opts.providerState = options.providerState?.providerAccountId === row.id ? options.providerState : undefined;
+  opts.providerState = servedBy(options.providerState) === row.id ? options.providerState : undefined;
   const history = messages.map((message) => {
-    if (message.providerReplay?.accountId === row.id) return message;
+    if (servedBy(message) === row.id) return message;
     const { providerReplay, reasoning, thinkingBlocks, ...plain } = message;
     return plain;
   });
@@ -204,7 +208,7 @@ async function commitFallbackAccount(providerName, pool, row, model, refusalScop
 // the binding survives a restart and eviction from this map, which only
 // spares the history walk. Bounded, oldest binding first out.
 const SESSION_ACCOUNT_LIMIT = 1000;
-const ROUTING_METADATA_KEY = 'accountRouting';
+export const ROUTING_METADATA_KEY = 'accountRouting';
 const sessionAccounts = new Map();
 
 // Forget every in-memory binding, as a restart does (tests).
@@ -244,6 +248,17 @@ function sessionAccountId(providerName, key, messages, options) {
   return null;
 }
 
+/** The account a send of `model` for `sessionId` would try first right now —
+ *  the session's binding and the choice poolSend makes for its first attempt
+ *  — or null when the provider has no roster account or none is eligible. */
+export function plannedAccountId(providerName, { sessionId = null, messages = [], providerState, model = '' } = {}) {
+  const pool = readProviderAccountPool(providerName);
+  if (!pool.accounts.length) return null;
+  const sessionKey = sessionId ? `${providerName}:${sessionId}` : null;
+  const boundId = sessionAccountId(providerName, sessionKey, messages, { providerState });
+  return chooseProviderAccount(pool, new Set(), Date.now(), model, { sessionAccountId: boundId })?.id || null;
+}
+
 // Stamp the serving account on the answer, independent of transport state,
 // with the account the session stays bound to (`bindingId`).
 function recordServingAccount(providerName, result, id, bindingId) {
@@ -509,7 +524,7 @@ function rotationReason(evidence, accountBlocked) {
 
 // The pool's send: walks the eligible accounts until one answers, blocking
 // the ones whose quota window is exhausted along the way.
-function poolSend(providerName, account) {
+function poolSend(providerName, account, servedBy) {
   return async function send(messages, model, tools, options = {}) {
     const request = { providerName, model, account, options };
     // This send's record of the roster: the accounts it tried, those it found
@@ -530,7 +545,8 @@ function poolSend(providerName, account) {
       options.signal?.throwIfAborted();
       const pool = readProviderAccountPool(providerName);
       if (!pool.accounts.length) {
-        throwIfPlanQuotaSpent(providerName, pool, model);
+        // A custom provider's key has no plan meter to consult.
+        if (!isCustomKeyProvider(providerName)) throwIfPlanQuotaSpent(providerName, pool, model);
         return account('default').send(messages, model, tools, options);
       }
       const policy = providerAccountPolicy(pool);
@@ -548,7 +564,7 @@ function poolSend(providerName, account) {
       }
       ledger.attempted.add(row.id);
       sends += 1;
-      const bound = boundAccountSend(providerName, row, messages, options);
+      const bound = boundAccountSend(providerName, row, messages, options, servedBy);
       try {
         const result = await account(row.id).send(bound.history, model, tools, bound.opts);
         quotaStrikes.delete(`${providerName}:${row.id}`);
@@ -649,3 +665,33 @@ export function createAccountPoolProvider(providerName, create) {
     }
   );
 }
+
+// Every key of a custom provider reaches one endpoint, so its answers carry
+// no key-bound server state but what an answer's routing names: history from
+// before the key pool (or from no pooled send) is the primary key's.
+function customKeyServedBy(providerName) {
+  return (entry) => {
+    const routing = entry?.providerMetadata?.[ROUTING_METADATA_KEY];
+    if (routing?.provider === providerName && routing.accountId) return routing.accountId;
+    return replayAccount(entry) || 'default';
+  };
+}
+
+/**
+ * A custom provider's API keys as one roster (provider-accounts.mjs
+ * `setCustomProviderKeyIds`): `primary` is the `default` account and answers
+ * everything but `send`; `keyEngine(id)` is the engine sending with
+ * additional key `id`. Without additional keys the roster is empty and every
+ * send is the primary's own, unchanged.
+ */
+export function createCustomKeyPoolProvider(providerName, primary, keyEngine) {
+  const engines = new Map([['default', primary]]);
+  const account = (id) => {
+    if (!engines.has(id)) engines.set(id, keyEngine(id));
+    return engines.get(id);
+  };
+  const send = poolSend(providerName, account, customKeyServedBy(providerName));
+  return new Proxy(primary, {
+    get: (target, key, receiver) => (key === 'send' ? send : Reflect.get(target, key, receiver)),
+  });
+}

package/src/runtime/agent/orchestrator/providers/anthropic-api-recovery.mjs

@@ -52,7 +52,7 @@ export function createAnthropicApiRecovery({
         : PROVIDER_NONSTREAM_TOTAL_TIMEOUT_MS;
     const lifetime = createTimeoutSignal(totalSignal, timeoutMs, `${label} Anthropic non-streaming fallback`);
     try {
-      const message = await transport.requestNonStreamingMessage(nonStreamingParams, lifetime.signal);
+      const message = await transport.requestNonStreamingMessage(nonStreamingParams, lifetime.signal, timeoutMs);
       return buildTurnResult(normalizeAnthropicNonStreamingResponse(message, useModel));
     } catch (error) {
       if (error instanceof AnthropicFallbackTriggeredError || totalSignal?.aborted) throw error;

package/src/runtime/agent/orchestrator/providers/anthropic-api-request.mjs

@@ -10,7 +10,11 @@
  * anthropic-turn-result.mjs); nothing here touches the socket.
  */
 import { prepareAnthropicImages } from './lib/anthropic-image-input.mjs';
-import { anthropicPrefixFingerprint, recordAnthropicPrefix } from './lib/anthropic-prefix-trace.mjs';
+import {
+  anthropicPrefixFingerprint,
+  anthropicPrefixSessionId,
+  recordAnthropicPrefix,
+} from './lib/anthropic-prefix-trace.mjs';
 import { buildAnthropicBetaHeaders, supportsAnthropicFastMode } from './anthropic-betas.mjs';
 import { applyAnthropicServerFallback } from './anthropic-server-fallback.mjs';
 import { fastModeAvailable } from './anthropic-fast-mode.mjs';
@@ -93,7 +97,7 @@ export async function buildAnthropicApiRequest({
   // Tools are resolved BEFORE the messages: the lowering needs the final
   // tool list to drop tool_reference blocks whose tool no longer ships
   // in this request (otherwise the API rejects the whole turn).
-  const requestTools = requestAnthropicTools(tools, chatMsgs, opts, name);
+  const requestTools = requestAnthropicTools(tools, chatMsgs, opts, name, config);
   // Message-tail cache budget (4-BP layout + ANTHROPIC_MSG_SLOTS) is
   // shared with anthropic-oauth — see resolveAnthropicMessageCacheSlots.
   const messageCacheSlots = resolveAnthropicMessageCacheSlots(systemBlocks, ttls, { tools: requestTools });
@@ -183,10 +187,9 @@ export async function buildAnthropicApiRequest({
   // (once) → mark → prepare image bytes → send.
   params.stream = true;
   // Diagnostic: per-block prefix hashes of exactly what is sent.
-  recordAnthropicPrefix(opts.sessionId || opts.session?.id || null, anthropicPrefixFingerprint(params));
+  recordAnthropicPrefix(anthropicPrefixSessionId(opts), anthropicPrefixFingerprint(params));
 
-  const requestHeaders = requestHeadersFor(params, {
-    config,
+  const betas = requestBetasFor(params, {
     opts,
     isCustom,
     fastLatched,
@@ -194,8 +197,10 @@ export async function buildAnthropicApiRequest({
     capabilityModel,
     effortProjection,
   });
+  const requestHeaders = requestHeadersFor(betas, { config, opts });
 
-  return { params, requestHeaders, knownToolNames, fastModeLatched: fastLatched };
+  // `betas`: the selected beta names, whether or not this route sends them as a header.
+  return { params, requestHeaders, betas, knownToolNames, fastModeLatched: fastLatched };
 }
 
 /** The turn's thinking/effort fields on `params` (in place): a custom
@@ -243,35 +248,36 @@ function resolveRequestToolChoice(params, opts, config) {
   else delete params.tool_choice;
 }
 
-/** The per-request headers of the final body `params`: the anthropic-beta
- *  set it needs, then the caller's `opts.requestHeaders`; null when none. */
-function requestHeadersFor(
-  params,
-  { config, opts, isCustom, fastLatched, hasDeferredTools, capabilityModel, effortProjection }
-) {
+/** The anthropic-beta names the final body `params` needs. A custom endpoint
+ *  gets no first-party base betas; only those its own request body needs
+ *  (row-driven effort, deferred tools). */
+function requestBetasFor(params, { opts, isCustom, fastLatched, hasDeferredTools, capabilityModel, effortProjection }) {
+  return [
+    buildAnthropicBetaHeaders({
+      ...(isCustom ? { base: '' } : {}),
+      fastMode: fastLatched,
+      toolSearch: hasDeferredTools,
+      // Custom: the beta follows the resolver's output, not the model id.
+      effort: isCustom ? Boolean(params.output_config?.effort) : shouldIncludeEffortBeta(capabilityModel, opts),
+      serverFallback: params.fallbacks === 'default',
+      thinkingDisplayUpdates: params.thinking?.display === 'updates',
+      turnScopedSystem: hasAnthropicTurnScopedMessages(params.messages),
+    }),
+    ...(effortProjection ? [EFFORT_CONFIGURATION_BETA] : []),
+  ]
+    .join(',')
+    .split(',')
+    .filter(Boolean);
+}
+
+/** The per-request headers: the anthropic-beta header of `betas`, then the
+ *  caller's `opts.requestHeaders`; null when none. */
+function requestHeadersFor(betas, { config, opts }) {
   // Per-call headers override the client defaultHeaders, so the
   // constructor-level disableBetaHeaders opt-out must be honoured here
   // too — otherwise opencode-go's anthropic-compatible routing
   // (disableBetaHeaders:true) would still send beta strings that a
   // third-party endpoint may reject.
-  // A custom endpoint gets no first-party base betas; only those its own
-  // request body needs (row-driven effort, deferred tools).
-  let betaHeaders = null;
-  if (!config?.disableBetaHeaders) {
-    const betas = [
-      buildAnthropicBetaHeaders({
-        ...(isCustom ? { base: '' } : {}),
-        fastMode: fastLatched,
-        toolSearch: hasDeferredTools,
-        // Custom: the beta follows the resolver's output, not the model id.
-        effort: isCustom ? Boolean(params.output_config?.effort) : shouldIncludeEffortBeta(capabilityModel, opts),
-        serverFallback: params.fallbacks === 'default',
-        thinkingDisplayUpdates: params.thinking?.display === 'updates',
-        turnScopedSystem: hasAnthropicTurnScopedMessages(params.messages),
-      }),
-      ...(effortProjection ? [EFFORT_CONFIGURATION_BETA] : []),
-    ].filter(Boolean);
-    if (betas.length) betaHeaders = { 'anthropic-beta': betas.join(',') };
-  }
+  const betaHeaders = !config?.disableBetaHeaders && betas.length ? { 'anthropic-beta': betas.join(',') } : null;
   return betaHeaders || opts.requestHeaders ? { ...(betaHeaders || {}), ...(opts.requestHeaders || {}) } : null;
 }

package/src/runtime/agent/orchestrator/providers/anthropic-api-transport.mjs

@@ -215,12 +215,18 @@ export function createAnthropicApiTransport({
     }
   };
 
-  const requestNonStreamingMessage = (nonStreamingParams, signal) =>
+  // `timeoutMs` is the replay's own lifetime, handed to the SDK as the request
+  // timeout: without an explicit one the SDK refuses any stream:false body
+  // whose max_tokens it estimates past 10 minutes before sending it.
+  const requestNonStreamingMessage = (nonStreamingParams, signal, timeoutMs) =>
     withRetry(
       withBodyRecovery(nonStreamingParams, async ({ signal: attemptSignal }) => {
         noteRequestServiceTier(nonStreamingParams.speed);
         try {
-          return await client.messages.create(nonStreamingParams, requestOptions(attemptSignal));
+          return await client.messages.create(nonStreamingParams, {
+            ...requestOptions(attemptSignal),
+            timeout: timeoutMs,
+          });
         } catch (err) {
           throw annotateHttpFailure(err);
         }

package/src/runtime/agent/orchestrator/providers/anthropic-max-tokens-recovery.mjs

@@ -22,11 +22,15 @@ export function parseMaxTokensContextOverflow(status, message) {
   const match = OVERFLOW_RE.exec(String(message || ''));
   if (!match) return null;
   const [inputTokens, maxTokens, contextLimit] = match.slice(1).map((value) => Number.parseInt(value, 10));
-  return [inputTokens, maxTokens, contextLimit].every(Number.isFinite) ? { inputTokens, maxTokens, contextLimit } : null;
+  return [inputTokens, maxTokens, contextLimit].every(Number.isFinite)
+    ? { inputTokens, maxTokens, contextLimit }
+    : null;
 }
 
 const thinkingBudget = (body) =>
-  body?.thinking?.type === 'enabled' && Number(body.thinking.budget_tokens) > 0 ? Number(body.thinking.budget_tokens) : 0;
+  body?.thinking?.type === 'enabled' && Number(body.thinking.budget_tokens) > 0
+    ? Number(body.thinking.budget_tokens)
+    : 0;
 
 /**
  * Shrink `body.max_tokens` to fit the reported context. Returns true when the

package/src/runtime/agent/orchestrator/providers/anthropic-messages.mjs

@@ -159,8 +159,8 @@ function deferredAnthropicTools(activeTools, messages, opts, provider = 'anthrop
   return sharedDeferredAnthropicTools(activeTools, messages, opts, provider);
 }
 // `provider`: the engine's name (a gateway Messages engine runs under its gateway's).
-export function requestAnthropicTools(tools, messages, opts, provider = 'anthropic') {
-  return sharedRequestAnthropicTools(tools, messages, opts, provider);
+export function requestAnthropicTools(tools, messages, opts, provider = 'anthropic', config = {}) {
+  return sharedRequestAnthropicTools(tools, messages, opts, provider, config);
 }
 // Test-only: expose the lowering so the steering-provenance test can assert
 // the API-key provider keeps steering-tagged user turns distinct (mirrors

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-client-version.mjs

@@ -10,7 +10,7 @@ import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
 // source release just to advance the user-agent version.
 // Claude Opus 5.5 requires 2.1.280 or newer. The release workflow raises this
 // to the published CLI version (scripts/sync-client-version-floors.mjs).
-export const DEFAULT_CLI_VERSION = '2.1.311';
+export const DEFAULT_CLI_VERSION = '2.1.312';
 export const CLAUDE_CLI_NPM_PACKAGE = '@anthropic-ai/claude-code';
 
 const CACHE_SCHEMA_VERSION = 1;