mixdog 1.4.0 → 1.4.2

package/src/runtime/agent/orchestrator/providers/grok-oauth-login.mjs

@@ -1,11 +1,18 @@
 // Grok OAuth browser login + PKCE exchange against xAI's shared OAuth client
-// (the consent screen renders it as "Grok Build").
+// (the consent screen renders it as "Grok Build"). A machine with no browser
+// (`openBrowser: false`) signs in by RFC 8628 device code instead.
 import { createServer } from 'node:http';
 import { randomBytes } from 'node:crypto';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
 import { createOAuthPkce, parseOAuthCodeInput } from './lib/oauth-pkce.mjs';
 import { OAUTH_PAGE_CONTENT_TYPE, oauthErrorHtml, oauthSuccessHtml } from './lib/oauth-page.mjs';
-import { emailFromJwts } from './lib/oauth-token-utils.mjs';
+import {
+  emailFromJwts,
+  oauthFailureReason,
+  oauthHttpError,
+  oauthRequestError,
+  oauthResponseJson,
+} from './lib/oauth-token-utils.mjs';
 import {
   CLIENT_ID,
   SCOPE,
@@ -22,47 +29,30 @@ import {
   _scrubTokens,
 } from './grok-oauth-tokens.mjs';
 
+// The device flow is xAI's own headless path (`grok login --device-auth`): the
+// user opens the URL on any device and confirms the code while this host polls,
+// so no loopback listener, port forward or pasted redirect is involved.
+const DEVICE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
+// The path the issuer's discovery document advertises as its
+// device_authorization_endpoint; the token endpoint is the discovered one.
+const DEVICE_CODE_PATH = '/oauth2/device/code';
+const DEFAULT_DEVICE_INTERVAL_S = 5;
+const SLOW_DOWN_STEP_S = 5;
+// The Grok CLI keeps polling for at least ten minutes whatever expires_in says.
+const MIN_DEVICE_EXPIRY_S = 600;
+const SAFE_USER_CODE = /^[A-Za-z0-9-]+$/;
+
 export function generatePKCE() {
   return createOAuthPkce();
 }
 
-export async function exchangeAuthorizationCode({ discovery, pkce, code, signal = null }) {
-  signal?.throwIfAborted();
-  const cleanCode = String(code || '').trim();
-  if (!cleanCode) throw new Error('[grok-oauth] authorization code is required');
-  const tokenRes = await fetch(discovery.token_endpoint, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-    body: new URLSearchParams({
-      grant_type: 'authorization_code',
-      client_id: CLIENT_ID,
-      code: cleanCode,
-      code_verifier: pkce.verifier,
-      redirect_uri: REDIRECT_URI,
-      // xAI re-validates the PKCE challenge at token exchange
-      // (not just the verifier), so echo it back. Omitting
-      // these makes the exchange fail. Matches the Grok CLI.
-      code_challenge: pkce.challenge,
-      code_challenge_method: 'S256',
-    }),
-    // Secret-bearing (authorization code + verifier): refuse
-    // redirects so they can't be replayed to an untrusted host.
-    redirect: 'error',
-    signal: signal
-      ? AbortSignal.any([signal, AbortSignal.timeout(TOKEN_TIMEOUT_MS)])
-      : AbortSignal.timeout(TOKEN_TIMEOUT_MS),
-    dispatcher: getLlmDispatcher(),
-  });
-  if (!tokenRes.ok) {
-    const text = await tokenRes.text().catch(() => '');
-    throw new Error(`[grok-oauth] token exchange ${tokenRes.status}: ${_scrubTokens(text).slice(0, 500)}`);
-  }
-  const json = await tokenRes.json();
+// The tokens a successful grant (authorization code or device code) yields.
+function tokensFromGrant(json, discovery) {
   if (!json.access_token || !json.refresh_token) {
     throw new Error('[grok-oauth] token exchange response missing access_token or refresh_token');
   }
   const identity = _identityFromAccessToken(json.access_token);
-  const tokens = {
+  return {
     access_token: json.access_token,
     refresh_token: json.refresh_token,
     expires_at:
@@ -75,14 +65,229 @@ export async function exchangeAuthorizationCode({ discovery, pkce, code, signal
       ? { email: emailFromJwts(json.id_token, json.access_token) }
       : {}),
   };
+}
+
+export async function exchangeAuthorizationCode({ discovery, pkce, code, signal = null }) {
+  signal?.throwIfAborted();
+  const cleanCode = String(code || '').trim();
+  if (!cleanCode) throw new Error('[grok-oauth] authorization code is required');
+  let tokenRes;
+  try {
+    tokenRes = await fetch(discovery.token_endpoint, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({
+        grant_type: 'authorization_code',
+        client_id: CLIENT_ID,
+        code: cleanCode,
+        code_verifier: pkce.verifier,
+        redirect_uri: REDIRECT_URI,
+        // xAI re-validates the PKCE challenge at token exchange
+        // (not just the verifier), so echo it back. Omitting
+        // these makes the exchange fail. Matches the Grok CLI.
+        code_challenge: pkce.challenge,
+        code_challenge_method: 'S256',
+      }),
+      // Secret-bearing (authorization code + verifier): refuse
+      // redirects so they can't be replayed to an untrusted host.
+      redirect: 'error',
+      signal: signal
+        ? AbortSignal.any([signal, AbortSignal.timeout(TOKEN_TIMEOUT_MS)])
+        : AbortSignal.timeout(TOKEN_TIMEOUT_MS),
+      dispatcher: getLlmDispatcher(),
+    });
+  } catch (err) {
+    throw oauthRequestError('[grok-oauth] token exchange', err);
+  }
+  if (!tokenRes.ok) {
+    const text = await tokenRes.text().catch(() => '');
+    throw oauthHttpError('[grok-oauth] token exchange', tokenRes.status, text, [
+      cleanCode,
+      pkce.verifier,
+      pkce.challenge,
+    ]);
+  }
+  const tokens = tokensFromGrant(await oauthResponseJson(tokenRes, '[grok-oauth] token exchange'), discovery);
   // A cancelled login never stores the account it was exchanging.
   signal?.throwIfAborted();
   saveTokens(tokens);
   return tokens;
 }
 
-export async function beginOAuthLogin({ openBrowser = true } = {}) {
+// Not sleepWithAbort: grok-oauth-isolated.test.mjs loads this file in a VM
+// sandbox that admits no dependency beyond its reviewed list.
+const defaultSleep = (ms, signal) =>
+  new Promise((resolve, reject) => {
+    if (signal.aborted) return reject(signal.reason);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signal.reason);
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener('abort', onAbort);
+      resolve();
+    }, ms);
+    signal.addEventListener('abort', onAbort, { once: true });
+  });
+
+const hasAsciiControl = (text) => [...text].some((char) => char.charCodeAt(0) < 0x20 || char.charCodeAt(0) === 0x7f);
+
+// The Grok CLI's verification-URI rules (validate_verification_uri): a string
+// without ASCII control characters (they could reach the terminal) that parses
+// as a URL and is https, or http only for localhost / 127.0.0.1.
+function verificationUri(value, field) {
+  if (typeof value !== 'string') throw new Error(`[grok-oauth] device authorization ${field} must be a string`);
+  if (hasAsciiControl(value) || !URL.canParse(value)) {
+    throw new Error('[grok-oauth] device authorization returned an invalid verification URI');
+  }
+  const { protocol, hostname } = new URL(value);
+  const loopback = protocol === 'http:' && (hostname === 'localhost' || hostname === '127.0.0.1');
+  if (protocol !== 'https:' && !loopback) {
+    throw new Error('[grok-oauth] device authorization returned an unsupported verification URI scheme');
+  }
+  return value;
+}
+
+// The vendor reads these as typed integers: a string or a fraction is a
+// malformed response.
+function integerField(value, field) {
+  if (!Number.isInteger(value)) {
+    throw new Error(`[grok-oauth] device authorization ${field} must be an integer`);
+  }
+  return value;
+}
+
+const requestSignal = (signal) => AbortSignal.any([signal, AbortSignal.timeout(TOKEN_TIMEOUT_MS)]);
+
+function postDeviceForm(url, params, signal) {
+  return fetch(url, {
+    method: 'POST',
+    headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams(params),
+    // The device code is secret-bearing: refuse redirects.
+    redirect: 'error',
+    signal: requestSignal(signal),
+    dispatcher: getLlmDispatcher(),
+  });
+}
+
+// null when the issuer has no device flow (404), as the Grok CLI reads it:
+// the caller then falls back to the loopback login.
+async function requestDeviceCode(discovery, signal) {
+  const res = await postDeviceForm(
+    new URL(DEVICE_CODE_PATH, discovery.token_endpoint).href,
+    { client_id: CLIENT_ID, scope: SCOPE },
+    signal
+  );
+  if (res.status === 404) return null;
+  if (!res.ok) {
+    const text = await res.text().catch(() => '');
+    throw new Error(`[grok-oauth] device authorization ${res.status}: ${_scrubTokens(text).slice(0, 300)}`);
+  }
+  const json = await res.json().catch(() => null);
+  const deviceCode = typeof json?.device_code === 'string' ? json.device_code : '';
+  const userCode = typeof json?.user_code === 'string' ? json.user_code : '';
+  if (!deviceCode || !SAFE_USER_CODE.test(userCode)) {
+    throw new Error('[grok-oauth] device authorization response is missing or has invalid required fields');
+  }
+  // Both addresses are checked on their own: an invalid one fails the login
+  // rather than yielding to the other. The complete one (code pre-filled) wins.
+  const plainUrl = verificationUri(json.verification_uri, 'verification_uri');
+  const completeUrl = json.verification_uri_complete ?? null;
+  const verificationUrl = completeUrl === null ? plainUrl : verificationUri(completeUrl, 'verification_uri_complete');
+  const interval = json.interval ?? null;
+  return {
+    deviceCode,
+    userCode,
+    verificationUrl,
+    // 5 s only when the interval is omitted; zero or a negative value clamps to one second.
+    intervalS: Math.max(interval === null ? DEFAULT_DEVICE_INTERVAL_S : integerField(interval, 'interval'), 1),
+    expiresInS: Math.max(integerField(json.expires_in, 'expires_in'), MIN_DEVICE_EXPIRY_S),
+  };
+}
+
+const deviceExpired = () => new Error('[grok-oauth] device code expired — start the login again');
+
+/** Poll until approval, denial or expiry; resolves the token response of the grant. */
+async function pollDeviceGrant(device, discovery, { signal, sleep, now }) {
+  const deadline = now() + device.expiresInS * 1000;
+  let intervalMs = device.intervalS * 1000;
+  for (;;) {
+    // A poll straight after the code was issued only answers authorization_pending.
+    await sleep(intervalMs, signal);
+    if (now() > deadline) throw deviceExpired();
+    let res;
+    let text;
+    try {
+      res = await postDeviceForm(
+        discovery.token_endpoint,
+        { grant_type: DEVICE_GRANT_TYPE, device_code: device.deviceCode, client_id: CLIENT_ID },
+        signal
+      );
+      text = await res.text();
+    } catch (err) {
+      // As in the Grok CLI, a transport failure ends the login at once.
+      throw new Error(`[grok-oauth] device token request failed: ${_scrubTokens(String(err?.message || err))}`);
+    }
+    let json = null;
+    try {
+      json = text ? JSON.parse(text) : null;
+    } catch {
+      /* a non-JSON body is reported below */
+    }
+    if (res.ok && json?.access_token) return json;
+    const error = typeof json?.error === 'string' ? json.error : '';
+    // Only these two answers keep the poll going; anything else ends the login.
+    if (error === 'slow_down') {
+      intervalMs += SLOW_DOWN_STEP_S * 1000;
+    } else if (error === 'access_denied') {
+      throw new Error('[grok-oauth] sign-in was denied');
+    } else if (error === 'expired_token') {
+      throw deviceExpired();
+    } else if (error !== 'authorization_pending') {
+      throw new Error(`[grok-oauth] device token ${res.status}: ${error || _scrubTokens(text).slice(0, 300)}`);
+    }
+  }
+}
+
+async function beginDeviceLogin(discovery, { sleep, now }) {
+  const controller = new AbortController();
+  const device = await requestDeviceCode(discovery, controller.signal);
+  if (!device) return null;
+  process.stderr.write(
+    `\n[grok-oauth] Enter code: ${device.userCode}\n[grok-oauth] Open: ${device.verificationUrl}\n\n`
+  );
+  const waitForCallback = pollDeviceGrant(device, discovery, { signal: controller.signal, sleep, now })
+    .then((json) => {
+      const tokens = tokensFromGrant(json, discovery);
+      // A cancelled login never stores the account it was granted.
+      controller.signal.throwIfAborted();
+      saveTokens(tokens);
+      return tokens;
+    })
+    .catch((error) => {
+      // Cancelling settles quietly, as it does for the loopback login.
+      if (controller.signal.aborted) return null;
+      throw error;
+    });
+  // A caller may only ever cancel; a later failure must not be unhandled.
+  waitForCallback.catch(() => {});
+  return {
+    provider: 'grok-oauth',
+    url: device.verificationUrl,
+    manualUrl: null,
+    userCode: device.userCode,
+    waitForCallback,
+    cancel: () => controller.abort(new Error('Grok login cancelled')),
+  };
+}
+
+export async function beginOAuthLogin({ openBrowser = true, sleep = defaultSleep, now = Date.now } = {}) {
   const discovery = await fetchDiscovery();
+  if (!openBrowser) {
+    const device = await beginDeviceLogin(discovery, { sleep, now });
+    if (device) return device;
+  }
   const pkce = generatePKCE();
   const state = randomBytes(16).toString('hex');
   const nonce = randomBytes(16).toString('hex');
@@ -148,14 +353,16 @@ export async function beginOAuthLogin({ openBrowser = true } = {}) {
         res.end(oauthErrorHtml('The sign-in callback was invalid or did not match this login.'));
         return;
       }
+      // The login settles (closing its server) before this answer is sent, so
+      // the connection must not stay open to the closed login's handler.
       try {
         await acceptCode(code);
-        res.writeHead(200, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE });
+        res.writeHead(200, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE, Connection: 'close' });
         res.end(oauthSuccessHtml('Grok'));
-      } catch {
-        // The shared exchange reports its error through waitForCallback.
-        res.writeHead(500, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE });
-        res.end(oauthErrorHtml('Grok could not complete the token exchange.'));
+      } catch (err) {
+        // The shared exchange also reports its error through waitForCallback.
+        res.writeHead(500, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE, Connection: 'close' });
+        res.end(oauthErrorHtml(oauthFailureReason('Grok could not complete the token exchange.', err)));
       }
     });
     timeout = setTimeout(() => finish(null), LOGIN_TIMEOUT_MS);

package/src/runtime/agent/orchestrator/providers/lib/anthropic-prefix-trace.mjs

@@ -1,9 +1,13 @@
 // Diagnostic per-block prefix fingerprint of an Anthropic request: the tools,
-// each system block (BP1/BP2/BP3/env, the routing prefix included) and the
-// cache_control marker positions, as short hashes only — never any text, so
-// it is safe in shipped builds. The last two requests per session are kept in
-// memory so a usage-detected cache miss (session/loop/send-phase.mjs) can say
-// which block or marker moved.
+// each system block (BP1/BP2/BP3/env, the routing prefix included), the
+// thinking parameters (they key the message cache), the cache_control marker
+// positions and, at each marked message, a chained hash of the messages up to
+// it — as short hashes only, never any text, so it is safe in shipped builds.
+// The last two requests per session are kept in memory so a usage-detected
+// cache miss (session/loop/send-phase.mjs) can say which block, marker or
+// message breakpoint moved. The latest one also rides on the session record
+// (persistableAnthropicPrefix / seedAnthropicPrefix), so the first request
+// after a restart is compared with the last one before it.
 import { createHash } from 'node:crypto';
 
 const HASH_CHARS = 12;
@@ -22,9 +26,26 @@ const withoutMarker = (block) => {
   return rest;
 };
 
+// A message as the cache reads it: markers stripped, a string content as the
+// one text block a marker would turn it into.
+const messageWithoutMarkers = (message) => {
+  const content =
+    typeof message?.content === 'string' ? [{ type: 'text', text: message.content }] : message?.content || [];
+  return { ...message, content: Array.isArray(content) ? content.map(withoutMarker) : content };
+};
+
 const markerTtl = (marker) => (marker?.ttl ? String(marker.ttl) : '5m');
 
-/** `{ tools, system: [hash…], markers: ['s1:1h', 'm12:5m', …] }` of a request body. */
+/** The session id a request's prefix is recorded under: the visible Mixdog
+ *  session, not the account-scoped id an account roster sends under. */
+export function anthropicPrefixSessionId(opts) {
+  return opts?.usageSessionId || opts?.sessionId || opts?.session?.id || null;
+}
+
+/** `{ tools, system: [hash…], params, markers: ['s1:1h', 'm12:5m', …],
+ *  messageMarks: [{ i, h }] }` of a request body; the full message hash chain
+ *  rides along non-enumerable (memory only) for the next request's
+ *  comparison. */
 export function anthropicPrefixFingerprint(body) {
   const system = Array.isArray(body?.system) ? body.system : [];
   const messages = Array.isArray(body?.messages) ? body.messages : [];
@@ -32,12 +53,47 @@ export function anthropicPrefixFingerprint(body) {
   system.forEach((block, index) => {
     if (block?.cache_control) markers.push(`s${index}:${markerTtl(block.cache_control)}`);
   });
+  const params = hash({ thinking: body?.thinking ?? null, output_config: body?.output_config ?? null });
+  const chain = [];
+  const messageMarks = [];
+  let link = params;
   messages.forEach((message, index) => {
+    link = hash([link, messageWithoutMarkers(message)]);
+    chain.push(link);
     const content = Array.isArray(message?.content) ? message.content : [];
     const marked = content.find((block) => block?.cache_control);
-    if (marked) markers.push(`m${index}:${markerTtl(marked.cache_control)}`);
+    if (marked) {
+      markers.push(`m${index}:${markerTtl(marked.cache_control)}`);
+      messageMarks.push({ i: index, h: link });
+    }
   });
-  return { tools: hash(body?.tools || []), system: system.map((block) => hash(withoutMarker(block))), markers };
+  const fingerprint = {
+    tools: hash(body?.tools || []),
+    system: system.map((block) => hash(withoutMarker(block))),
+    params,
+    markers,
+    messageMarks,
+  };
+  Object.defineProperty(fingerprint, 'chain', { value: chain, enumerable: false });
+  return fingerprint;
+}
+
+/** `fingerprint` as the session record keeps it (hashes only, no chain). */
+export function persistableAnthropicPrefix(fingerprint) {
+  if (!fingerprint) return null;
+  const { tools, system, params, markers, messageMarks } = fingerprint;
+  return { tools, system, params, markers, messageMarks };
+}
+
+/** A restarted process has no previous request for the session: take the
+ *  one its record kept (persistableAnthropicPrefix) as the latest, so the
+ *  next request is compared with it. A no-op once the session has one. */
+export function seedAnthropicPrefix(sessionId, fingerprint) {
+  if (!sessionId || !fingerprint || typeof fingerprint !== 'object') return;
+  const key = String(sessionId);
+  if (bySession.has(key)) return;
+  bySession.set(key, { previous: null, current: persistableAnthropicPrefix(fingerprint) });
+  if (bySession.size > MAX_SESSIONS) bySession.delete(bySession.keys().next().value);
 }
 
 /** Keep `fingerprint` as the session's latest request (the one before it stays as previous). */
@@ -55,8 +111,11 @@ export function latestAnthropicPrefix(sessionId) {
   return bySession.get(String(sessionId || ''))?.current || null;
 }
 
-/** `{ changedBlocks: 'tools,s3' | 'none', markersChanged }` between the session's
- *  last two requests, or null before it has two. */
+/** `{ changedBlocks: 'tools,s3,params' | 'none', markersChanged,
+ *  lostMessageBreakpoints? }` between the session's last two requests, or
+ *  null before it has two. `lostMessageBreakpoints` ('m12,m40' | 'none')
+ *  names the previous request's message breakpoints whose prefix the latest
+ *  request does not repeat (absent when either side predates the chain). */
 export function anthropicPrefixChanges(sessionId) {
   const entry = bySession.get(String(sessionId || ''));
   if (!entry?.previous) return null;
@@ -67,10 +126,16 @@ export function anthropicPrefixChanges(sessionId) {
   for (let index = 0; index < blocks; index += 1) {
     if (previous.system[index] !== current.system[index]) changed.push(`s${index}`);
   }
+  if (previous.params && current.params && previous.params !== current.params) changed.push('params');
   // Message markers move every turn; only the system markers are a layout change.
   const systemMarkers = (print) => print.markers.filter((marker) => marker.startsWith('s')).join(',');
-  return {
+  const changes = {
     changedBlocks: changed.length ? changed.join(',') : 'none',
     markersChanged: systemMarkers(previous) !== systemMarkers(current),
   };
+  if (Array.isArray(previous.messageMarks) && Array.isArray(current.chain)) {
+    const lost = previous.messageMarks.filter(({ i, h }) => current.chain[i] !== h).map(({ i }) => `m${i}`);
+    changes.lostMessageBreakpoints = lost.length ? lost.join(',') : 'none';
+  }
+  return changes;
 }

package/src/runtime/agent/orchestrator/providers/lib/anthropic-request-utils.mjs

@@ -108,11 +108,16 @@ export function appendAnthropicTailReminder(anthropicMessages, reminder) {
 // 5.5, Sonnet 5.5) and with explicit lists naming Sonnet 5 or Opus 4.8, and
 // fallback runs only on a safety-classifier refusal.
 export function anthropicTurnScopedReminders(provider, model, config = {}) {
+  return anthropicFirstPartyRoute(provider, config) && supportsAnthropicTurnScopedSystemMessages(model);
+}
+
+// The first-party Messages routes: native provider, beta headers allowed, no
+// gateway base URL. Request features a proxy answers with a 400 are gated here.
+export function anthropicFirstPartyRoute(provider, config = {}) {
   return (
     ANTHROPIC_NATIVE_PROVIDERS.has(provider) &&
     config?.disableBetaHeaders !== true &&
-    (!config?.baseURL || /^https:\/\/api\.anthropic\.com(?:\/|$)/.test(config.baseURL)) &&
-    supportsAnthropicTurnScopedSystemMessages(model)
+    (!config?.baseURL || /^https:\/\/api\.anthropic\.com(?:\/|$)/.test(config.baseURL))
   );
 }
 
@@ -333,6 +338,9 @@ export function toAnthropicMessages(transcript, availableTools, provider = '') {
   const ownProvider = String(provider || '').toLowerCase();
   const availableNames = anthropicToolNameSet(availableTools);
   const result = [];
+  // Tool-result user messages a provider request ended with (see the
+  // `sentRequestTail` meta finalizeInterruptedTurn stamps).
+  const sent = new WeakSet();
   for (let idx = 0; idx < messages.length; idx++) {
     const m = messages[idx];
     if (m.role === 'system') continue;
@@ -407,6 +415,17 @@ export function toAnthropicMessages(transcript, availableTools, provider = '') {
       } else {
         result.push({ role: 'user', content: [block, ...hoisted] });
       }
+      if (m.meta?.sentRequestTail === true) sent.add(result[result.length - 1]);
+      continue;
+    }
+    // Text after a tool_result message a provider request already carried
+    // (an interrupted request's tail: the restart or cancel marker, the next
+    // prompt and anything riding with it) goes in as sibling blocks of that
+    // user message. Folding it into the tool_result would rewrite a block the
+    // provider cached, so the whole message prefix would be written again.
+    const tail = result[result.length - 1];
+    if (m.role === 'user' && m.meta?.source !== 'steering' && sent.has(tail)) {
+      tail.content.push(...siblingBlocks(normalizeContentForAnthropic(m.content)));
       continue;
     }
     // First-party client parity: fold a user text turn that directly follows a
@@ -424,6 +443,8 @@ export function toAnthropicMessages(transcript, availableTools, provider = '') {
       !isSteering &&
       foldUserTextIntoToolResultTail(result, normalizeContentForAnthropic(m.content))
     ) {
+      // A reminder folded before the request was sent ends that request.
+      if (m.meta?.sentRequestTail === true) sent.add(tail);
       continue;
     }
     // An assistant turn with no text and no blocks (a refused or empty final
@@ -436,6 +457,15 @@ export function toAnthropicMessages(transcript, availableTools, provider = '') {
   return sanitizeAnthropicContentPairs(result);
 }
 
+// A user message's content as blocks of the message it joins; blank text is
+// dropped (a blank text block is a hard 400).
+function siblingBlocks(content) {
+  let blocks = [];
+  if (typeof content === 'string') blocks = [{ type: 'text', text: content }];
+  else if (Array.isArray(content)) blocks = content;
+  return blocks.filter((block) => !(block?.type === 'text' && isBlankText(block.text)));
+}
+
 function isBlankText(content) {
   return content == null || (typeof content === 'string' && !content.trim());
 }
@@ -619,7 +649,10 @@ export function anthropicToolExclusion(tool, logTag = 'anthropic') {
 
 // A Messages endpoint rejects the whole request for one invalid input_schema,
 // so a tool broken even after lowering is reported and left out.
-function toAnthropicTools(tools, logTag, onToolExcluded) {
+// `eager`: fine-grained tool streaming — the API streams each tool parameter as
+// it is generated instead of buffering it until complete, so a large tool input
+// does not leave the stream silent. First-party routes only.
+function toAnthropicTools(tools, logTag, onToolExcluded, eager = false) {
   const out = [];
   tools.forEach((tool, index) => {
     const result = anthropicInputSchema(tool, logTag);
@@ -629,6 +662,7 @@ function toAnthropicTools(tools, logTag, onToolExcluded) {
     }
     const entry = { name: tool.name, description: tool.description, input_schema: result.schema };
     if (tool.deferLoading === true || tool.defer_loading === true) entry.defer_loading = true;
+    if (eager) entry.eager_input_streaming = true;
     out.push(entry);
   });
   return out;
@@ -727,20 +761,25 @@ export function deferredAnthropicTools(activeTools, messages, opts, provider) {
     .map((tool) => ({ ...tool, deferLoading: true }));
 }
 
-export function requestAnthropicTools(tools, messages, opts, provider) {
+// `config`: the provider config (baseURL, disableBetaHeaders) deciding the route.
+export function requestAnthropicTools(tools, messages, opts, provider, config = {}) {
   const activeTools = Array.isArray(tools) ? tools : [];
+  const eager = anthropicFirstPartyRoute(provider, config);
   if (opts?.providerToolSnapshotAuthoritative === true) {
     const nativePrefixCount = providerNativeToolPrefixCount(activeTools, opts.providerNativeToolPrefixCount);
     return [
       ...activeTools.slice(0, nativePrefixCount),
-      ...toAnthropicTools(activeTools.slice(nativePrefixCount), provider, opts.onToolExcluded),
+      ...toAnthropicTools(activeTools.slice(nativePrefixCount), provider, opts.onToolExcluded, eager),
     ];
   }
   const deferredTools = deferredAnthropicTools(activeTools, messages, opts, provider);
   const nativeTools = Array.isArray(opts?.nativeTools)
     ? opts.nativeTools.filter((tool) => tool && typeof tool === 'object')
     : [];
-  return [...nativeTools, ...toAnthropicTools([...activeTools, ...deferredTools], provider, opts?.onToolExcluded)];
+  return [
+    ...nativeTools,
+    ...toAnthropicTools([...activeTools, ...deferredTools], provider, opts?.onToolExcluded, eager),
+  ];
 }
 
 // Applies cache_control markers to the FINAL, already-sanitized Anthropic

package/src/runtime/agent/orchestrator/providers/lib/first-output-window.mjs

@@ -0,0 +1,58 @@
+// The first-output window one provider stream runs under. A logical model
+// request owns ONE window (stall-policy.mjs PROVIDER_FIRST_OUTPUT_TIMEOUT_MS)
+// from its start, whatever attempts serve it: a provider retry, a loop replay
+// or a route fallback opens a new stream for the same request and inherits
+// its absolute deadline and whether it already produced output (a stream for
+// a request that had output runs under the semantic idle from its opening).
+// Only a new logical request (runtime-liveness) starts a new window.
+//
+// A stream joins the session's request only when it reports its progress
+// into it (the loop's onStreamDelta). Forks of the request — a /btw side
+// question, a cache warm, a compaction summary — carry the session id without
+// that callback and keep a window of their own.
+//
+// The window is shared by all four transports: the timer-driven ones (WS,
+// HTTP/SSE) use arm/noteOutput/clear, the iterator-driven compat streams use
+// idleWatch.
+import { getLogicalModelRequest } from '../../session/manager/runtime-liveness.mjs';
+
+/**
+ * @param {object} input
+ * @param {string|null} [input.sessionId]
+ * @param {Function} [input.onStreamDelta]  the stream's progress callback
+ * @param {number} input.timeoutMs  the window length
+ */
+export function streamFirstOutputWindow({ sessionId, onStreamDelta, timeoutMs }) {
+  const request = typeof onStreamDelta === 'function' ? getLogicalModelRequest(sessionId) : null;
+  const deadlineAt = (request?.startedAt || Date.now()) + timeoutMs;
+  let timer = null;
+  const clear = () => {
+    clearTimeout(timer);
+    timer = null;
+  };
+  const window = {
+    timeoutMs,
+    /** Whether the request (or, after noteOutput, this stream) has produced semantic output. */
+    outputSeen: request?.outputSeen === true,
+    /** Calls `onExpire` at the request's deadline. */
+    arm(onExpire) {
+      clear();
+      timer = setTimeout(onExpire, Math.max(0, deadlineAt - Date.now()));
+      timer.unref?.();
+    },
+    clear,
+    /** The stream's semantic output: ends the window. */
+    noteOutput() {
+      window.outputSeen = true;
+      clear();
+    },
+    /** The `nextAsyncWithWatchdog` idle bounds: the semantic idle once output
+     *  started (`semanticDeadlineAt` set), the window before. */
+    idleWatch(semanticDeadlineAt, idleMs) {
+      return semanticDeadlineAt > 0
+        ? { idleMs, idleDeadlineAt: semanticDeadlineAt }
+        : { idleMs: timeoutMs, idleDeadlineAt: deadlineAt };
+    },
+  };
+  return window;
+}

package/src/runtime/agent/orchestrator/providers/lib/listen-on.mjs

@@ -0,0 +1,14 @@
+import { listenOnFetchSafePort } from '../../../../shared/fetch-safe-listen.mjs';
+
+// Port 0 takes an OS-assigned port the browser can be redirected to.
+export function listenOn(server, port, host) {
+  return new Promise((resolve, reject) => {
+    server.once('error', reject);
+    const listening = () => {
+      server.off('error', reject);
+      resolve();
+    };
+    if (port === 0) listenOnFetchSafePort(server, host, listening);
+    else server.listen(port, host, listening);
+  });
+}