Three places translated a provider error code into a ProviderErrorKind:
error_from_status_code for HTTP error bodies, and a private table in each
of the openai_responses and anthropic_messages stream decoders. The tables
disagreed, so the same failure classified differently depending on which
path saw it.
Most visibly, OpenAI returns HTTP 429 with error.type "insufficient_quota"
when an account is out of credit. The streaming decoder mapped that to
QuotaExceeded, but the non-streaming path fell through to the plain
429 => RateLimit arm, so a spent quota was retried with backoff and never
triggered failover.
Move the code table into error.rs as kind_from_error_code, returning None
when the code says nothing so each caller keeps its own default. All three
call sites now share it.
In error_from_status_code, unambiguous statuses (401, 403, 404, 408, 413,
5xx) still win outright. A 429 defers to the code only when it reports a
spent quota. Ambiguous statuses (400, 422, ...) prefer the structured code
over the existing message-substring guessing, which now runs only when
there is no code.
Two classifications improve as a side effect of merging the tables:
not_found_error now maps to NotFound rather than Server for openai, and
request_too_large maps to ContextLength rather than InvalidRequest.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Follow-up review of the repair-error work. Behavior is the same or better;
the machinery is smaller.
Fixes a false "unchanged from your previous repair" nudge. same_problem_as
fell through to `_ => true`, so any two non-Required issues at the same
instance path, schema path and keyword compared equal. A model that removed
one unexpected property and added another was told it had changed nothing.
SchemaValidationIssue already derives PartialEq, so the 17-line comparison
is now `previous.contains(issue)`.
Drops the hand-written Type and Enum rendering. jsonschema already renders
both, and its messages name the offending value, which the hand-written
ones did not. Also switches masked() back to to_string(): masking replaced
the bad value with a placeholder, working against the goal of an actionable
message, and buys no privacy since the full response is already in the
prompt.
Resolves the schema fragment when the issue is captured rather than
threading Option<&OutputSchemaKind> through rendering. That reverts the
command.rs change and drops the test-only messages() shim. The fragment is
now attached only to Other, where it adds information; for required, type,
enum and additionalProperties it just repeated the prose.
Also: caps the model-controlled unexpected-property list so a wide object
cannot turn the repair prompt into megabytes; drops evaluation_path, which
was dead except under $ref, where it printed a pointer that does not
resolve; drops the keyword field, already named by the schema path; and
records the previous error only after the agent session accepted the
repair, since failover rebuilds the session from the original prompt.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The parallel stage summary rendered a Duration tile directly below
StageMetaBar, which already shows the same stage's duration with a live
ticking clock and a started-at tooltip. The two disagreed while running:
the meta bar counted up, the tile showed the static word "running". The
cancelled-stage bug lived only in the duplicate.
Drop the tile. The meta bar owns duration for every stage renderer, and
it was already correct for cancelled, pending and skipped stages. That
removes the three-way duration branch, the "--" sentinel decode, and the
ACTIVE_STAGE_STATES and formatDurationMs imports.
With the tile gone, ParallelOverview.durationMs is dead, as were
successCount, failureCount and isComplete — the renderer counts the
branch rows it draws. ParallelOverview reduces to branch identity.
For run event write failures, log the first at error with run_id and
event name, the rest at debug, and summarize new losses at flush. A
broken sink fails for every event, so a bare error would emit one
"investigate me" line per event for the life of the run.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
- Return String from the sanitize helpers instead of Cow: every call
site feeds the result into json!, which allocates anyway, so the
borrowed fast path only cost extra branches and Cow-variant tests.
- Route all toolUse/toolResult construction through private
tool_use_block/tool_result_block constructors that own the sanitize
calls, so the toolUse/toolResult pairing invariant is enforced by
construction rather than by call-site discipline.
- Drop a test assertion the type system already guarantees (encoding
takes &Request, so it cannot mutate the input) and assert wiring
tests against the sanitize helpers instead of re-pinning the exact
replacement literals in a second file.
No wire-format changes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The steering dock on run pages now starts collapsed, staying out of
the way until the operator opens it. A run that is interrupted and
waiting for steering still forces the dock open.
While collapsed, the whole dock header is a click target that expands
it. Clicks on buttons in the bar (Interrupt, the chevron) keep their
own behavior, and the chevron remains the keyboard/assistive-tech
toggle. The interview dock shares the shell, so it gets the same
click-to-open behavior.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A fork carries a checkpoint from its source run, but its first
run.created event contains only a sandbox plan. Resume previously tried
to reconnect that planned sandbox and failed because no instance
exists. Now a fork resume with a Planned sandbox record builds a fresh
sandbox instead; later fork resumes still reconnect the ready instance,
and a same-run resume with an uninitialized sandbox still fails the
precondition check.
Also consolidates the test module's three near-identical InitOptions
literals into a shared test_init_options helper.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
