Address PR feedback + proactive cleanup pass

anticomputer · Copilot · anticomputer · commit 5e0a38cd827d · 2026-06-15T11:39:04.000-04:00
Three behavior fixes flagged by review or by re-reading the diff:

1. 4xx exception mapping (reviewer-flagged): previously only
   anthropic.BadRequestError (400) was mapped to BackendBadRequestError.
   Auth (401), permission (403), not-found (404), conflict (409),
   unprocessable (422) all fell through to BackendUnexpectedError and
   surfaced as 'Agent Exception' instead of a clean request error.
   Catch anthropic.APIStatusError and map any 4xx status to
   BackendBadRequestError; 5xx still falls through to
   BackendUnexpectedError (the request was well-formed).

2. Empty-token failure mode: build() now raises BackendBadRequestError
   with a clear message when no API token can be resolved, instead of
   either leaking RuntimeError from get_AI_token() or letting the
   Anthropic client be constructed with an empty 'Bearer ' header
   (which produces an opaque 401 mid-stream much later).

3. Stale module docstring in sdk/__init__.py: said 'Two backends are
   supported' and referenced the removed '[copilot]' optional-extra.
   Updated to reflect the current three-backend reality.

Test cleanup (reviewer-flagged):

- DRY'd 3x duplicate _FakeStreamCtx boilerplate in the prompt-caching
  tests into a single _make_fake_client() helper at the top of the
  file. The helper uses a proper empty async iterator class instead
  of the 'return; yield' empty-generator pattern the reviewer
  flagged as awkward.

Added regression coverage:

- test_build_raises_bad_request_when_no_token_available
- test_4xx_api_status_errors_map_to_bad_request (parameterized over
  400/401/403/404/409/422)
- test_5xx_api_status_errors_map_to_unexpected

281 -&gt; 289 passing; lint clean (hatch fmt --linter --check).

Co-authored-by: Copilot &lt;223556219+Copilot@users.noreply.github.com&gt;
diff --git a/src/seclab_taskflow_agent/sdk/__init__.py b/src/seclab_taskflow_agent/sdk/__init__.py
@@ -3,9 +3,9 @@
 
 """Backend factory for the agent runner.
 
-Two backends are supported: ``openai_agents`` (default) and
-``copilot_sdk`` (optional, requires ``pip install
-seclab-taskflow-agent[copilot]``).
+Three backends are supported: ``openai_agents`` (default), ``copilot_sdk``,
+and ``anthropic_sdk``.  All three are always available because per-task
+backend selection means any SDK may be needed at runtime.
 """
 
 from __future__ import annotations
@@ -70,8 +70,9 @@ def resolve_backend_name(
     ``SECLAB_TASKFLOW_BACKEND`` env var > ``openai_agents``.
 
     Backend selection is always deterministic — there is no auto-detection
-    based on endpoint URL.  Use ``backend: copilot_sdk`` in model config
-    or set ``SECLAB_TASKFLOW_BACKEND=copilot_sdk`` to opt in.
+    based on endpoint URL.  Use ``backend: copilot_sdk`` or ``backend:
+    anthropic_sdk`` in model config (or set
+    ``SECLAB_TASKFLOW_BACKEND=<name>``) to opt in.
 
     The *endpoint* parameter is accepted for forward compatibility but
     is not used for backend selection.
diff --git a/src/seclab_taskflow_agent/sdk/anthropic_sdk/backend.py b/src/seclab_taskflow_agent/sdk/anthropic_sdk/backend.py
@@ -104,10 +104,22 @@ async def build(
 
         from ...capi import get_AI_endpoint, get_AI_token, get_provider
 
-        # Resolve token: per-model env var override, then standard token chain
+        # Resolve token: per-model env var override, then standard token chain.
+        # Wrap RuntimeError from get_AI_token (env var not set) so the runner
+        # surfaces it as a request error rather than an internal exception.
         token = os.getenv(spec.token_env, "") if spec.token_env else ""
         if not token:
-            token = get_AI_token()
+            try:
+                token = get_AI_token()
+            except RuntimeError as exc:
+                raise BackendBadRequestError(
+                    f"anthropic_sdk: no API token available ({exc})"
+                ) from exc
+        if not token:
+            raise BackendBadRequestError(
+                "anthropic_sdk: no API token available "
+                "(checked spec.token_env then standard token chain)"
+            )
 
         endpoint = spec.endpoint or get_AI_endpoint()
         provider = get_provider(endpoint)
@@ -257,8 +269,16 @@ async def run_streamed(
                 raise BackendRateLimitError(str(exc)) from exc
             except anthropic.APITimeoutError as exc:
                 raise BackendTimeoutError(str(exc)) from exc
-            except anthropic.BadRequestError as exc:
-                raise BackendBadRequestError(str(exc)) from exc
+            except anthropic.APIStatusError as exc:
+                # Map all 4xx (auth, permission, not_found, conflict,
+                # unprocessable, bad_request) to BackendBadRequestError so
+                # the runner surfaces them as request errors rather than
+                # internal exceptions. 5xx and unclassified errors fall
+                # through to BackendUnexpectedError.
+                status = getattr(exc, "status_code", None)
+                if isinstance(status, int) and 400 <= status < 500:
+                    raise BackendBadRequestError(str(exc)) from exc
+                raise BackendUnexpectedError(str(exc)) from exc
             except anthropic.APIError as exc:
                 raise BackendUnexpectedError(str(exc)) from exc
 
diff --git a/tests/test_sdk_anthropic_adapter.py b/tests/test_sdk_anthropic_adapter.py
@@ -31,6 +31,48 @@ def _spec(**overrides) -> AgentSpec:
     return AgentSpec(**base)
 
 
+def _make_fake_client(captured: dict, *, stop_reason: str = "end_turn", content: list | None = None):
+    """Build a minimal fake Anthropic client that records messages.stream() kwargs.
+
+    The returned client exposes ``client.messages.stream(**kwargs)``; ``kwargs`` is
+    written into *captured* so tests can assert on what the backend would have sent
+    to the real SDK.  The stream yields nothing and ``get_final_message()`` returns
+    a stub with the requested ``stop_reason``/``content``.
+    """
+    final_content = content if content is not None else []
+
+    class _EmptyAsyncIter:
+        def __aiter__(self):
+            return self
+
+        async def __anext__(self):
+            raise StopAsyncIteration
+
+    class _FakeStreamCtx:
+        async def __aenter__(self):
+            return self
+
+        async def __aexit__(self, *exc):
+            return False
+
+        def __aiter__(self):
+            return _EmptyAsyncIter()
+
+        async def get_final_message(self):
+            return type("M", (), {"stop_reason": stop_reason, "content": final_content})()
+
+    class _FakeMessages:
+        def stream(self, **kwargs):
+            captured.update(kwargs)
+            return _FakeStreamCtx()
+
+    class _FakeClient:
+        def __init__(self):
+            self.messages = _FakeMessages()
+
+    return _FakeClient()
+
+
 # -- Backend registration --
 
 
@@ -241,30 +283,9 @@ def test_prompt_caching_enabled_by_default():
 
     from seclab_taskflow_agent.sdk.anthropic_sdk.backend import _AnthropicHandle
 
-    captured = {}
-
-    class _FakeStreamCtx:
-        async def __aenter__(self): return self
-        async def __aexit__(self, *exc): return False
-        def __aiter__(self):
-            async def _gen():
-                return
-                yield
-            return _gen()
-        async def get_final_message(self):
-            return type("M", (), {"stop_reason": "end_turn", "content": []})()
-
-    class _FakeMessages:
-        def stream(self, **kwargs):
-            captured.update(kwargs)
-            return _FakeStreamCtx()
-
-    class _FakeClient:
-        def __init__(self):
-            self.messages = _FakeMessages()
-
+    captured: dict = {}
     handle = _AnthropicHandle(
-        client=_FakeClient(),
+        client=_make_fake_client(captured),
         system_prompt="",
         model="claude-mythos-5",
         max_tokens=100,
@@ -291,30 +312,9 @@ def test_prompt_caching_explicit_opt_out():
 
     from seclab_taskflow_agent.sdk.anthropic_sdk.backend import _AnthropicHandle
 
-    captured = {}
-
-    class _FakeStreamCtx:
-        async def __aenter__(self): return self
-        async def __aexit__(self, *exc): return False
-        def __aiter__(self):
-            async def _gen():
-                return
-                yield
-            return _gen()
-        async def get_final_message(self):
-            return type("M", (), {"stop_reason": "end_turn", "content": []})()
-
-    class _FakeMessages:
-        def stream(self, **kwargs):
-            captured.update(kwargs)
-            return _FakeStreamCtx()
-
-    class _FakeClient:
-        def __init__(self):
-            self.messages = _FakeMessages()
-
+    captured: dict = {}
     handle = _AnthropicHandle(
-        client=_FakeClient(),
+        client=_make_fake_client(captured),
         system_prompt="",
         model="claude-mythos-5",
         max_tokens=100,
@@ -340,30 +340,9 @@ def test_prompt_caching_1h_ttl_passes_ttl_field():
 
     from seclab_taskflow_agent.sdk.anthropic_sdk.backend import _AnthropicHandle
 
-    captured = {}
-
-    class _FakeStreamCtx:
-        async def __aenter__(self): return self
-        async def __aexit__(self, *exc): return False
-        def __aiter__(self):
-            async def _gen():
-                return
-                yield
-            return _gen()
-        async def get_final_message(self):
-            return type("M", (), {"stop_reason": "end_turn", "content": []})()
-
-    class _FakeMessages:
-        def stream(self, **kwargs):
-            captured.update(kwargs)
-            return _FakeStreamCtx()
-
-    class _FakeClient:
-        def __init__(self):
-            self.messages = _FakeMessages()
-
+    captured: dict = {}
     handle = _AnthropicHandle(
-        client=_FakeClient(),
+        client=_make_fake_client(captured),
         system_prompt="",
         model="claude-mythos-5",
         max_tokens=100,
@@ -490,3 +469,138 @@ def copy(self):
     assert handle.tools == [], (
         f"blocked namespaced name should filter out the tool; got: {handle.tools}"
     )
+
+
+# -- token validation --
+
+
+def test_build_raises_bad_request_when_no_token_available(monkeypatch):
+    """build() must fail loudly when no API token can be resolved.
+
+    Otherwise the Anthropic client gets created with an empty 'Bearer '
+    header and the failure surfaces later as an opaque 401 mid-stream
+    instead of a clear BackendBadRequestError at build time.
+    """
+    import asyncio
+
+    # Clear every token-source env var the standard chain consults
+    for var in ("AI_API_TOKEN", "OPENAI_API_KEY", "AZURE_OPENAI_API_KEY",
+                "ANTHROPIC_API_KEY", "GITHUB_TOKEN", "GH_TOKEN"):
+        monkeypatch.delenv(var, raising=False)
+
+    spec = AgentSpec(
+        name="t",
+        instructions="",
+        model="claude-mythos-preview",
+        endpoint="https://api.githubcopilot.com",
+    )
+    backend = AnthropicSDKBackend()
+    with pytest.raises(BackendBadRequestError, match="no API token"):
+        asyncio.run(backend.build(spec))
+
+
+# -- exception mapping (4xx -> BackendBadRequestError) --
+
+
+@pytest.mark.parametrize("status_code", [400, 401, 403, 404, 409, 422])
+def test_4xx_api_status_errors_map_to_bad_request(monkeypatch, status_code):
+    """Any 4xx APIStatusError must surface as BackendBadRequestError so the
+    runner logs it as a request error rather than an internal exception.
+    Previously only BadRequestError (400) was mapped, leaving auth/permission/
+    not-found errors (401/403/404) to surface as BackendUnexpectedError."""
+    import asyncio
+    import anthropic
+    import httpx
+
+    from seclab_taskflow_agent.sdk.anthropic_sdk.backend import _AnthropicHandle
+
+    response = httpx.Response(
+        status_code=status_code,
+        request=httpx.Request("POST", "https://test.example/v1/messages"),
+    )
+
+    class _RaisingStreamCtx:
+        async def __aenter__(self):
+            raise anthropic.APIStatusError(
+                f"http {status_code}", response=response, body=None
+            )
+
+        async def __aexit__(self, *exc):
+            return False
+
+    class _FakeMessages:
+        def stream(self, **kwargs):  # noqa: ARG002
+            return _RaisingStreamCtx()
+
+    class _FakeClient:
+        def __init__(self):
+            self.messages = _FakeMessages()
+
+    handle = _AnthropicHandle(
+        client=_FakeClient(),
+        system_prompt="",
+        model="claude-mythos-5",
+        max_tokens=100,
+        tools=[],
+        mcp_server_map={},
+        model_settings={"prompt_caching": False},
+    )
+    backend = AnthropicSDKBackend()
+
+    async def _run():
+        async for _ in backend.run_streamed(handle, "hi", max_turns=1):
+            pass
+
+    with pytest.raises(BackendBadRequestError):
+        asyncio.run(_run())
+
+
+def test_5xx_api_status_errors_map_to_unexpected(monkeypatch):
+    """5xx APIStatusError must still surface as BackendUnexpectedError (not
+    BackendBadRequestError); the request itself was well-formed."""
+    import asyncio
+    import anthropic
+    import httpx
+
+    from seclab_taskflow_agent.sdk.anthropic_sdk.backend import _AnthropicHandle
+    from seclab_taskflow_agent.sdk.errors import BackendUnexpectedError
+
+    response = httpx.Response(
+        status_code=503,
+        request=httpx.Request("POST", "https://test.example/v1/messages"),
+    )
+
+    class _RaisingStreamCtx:
+        async def __aenter__(self):
+            raise anthropic.InternalServerError(
+                "service unavailable", response=response, body=None
+            )
+
+        async def __aexit__(self, *exc):
+            return False
+
+    class _FakeMessages:
+        def stream(self, **kwargs):  # noqa: ARG002
+            return _RaisingStreamCtx()
+
+    class _FakeClient:
+        def __init__(self):
+            self.messages = _FakeMessages()
+
+    handle = _AnthropicHandle(
+        client=_FakeClient(),
+        system_prompt="",
+        model="claude-mythos-5",
+        max_tokens=100,
+        tools=[],
+        mcp_server_map={},
+        model_settings={"prompt_caching": False},
+    )
+    backend = AnthropicSDKBackend()
+
+    async def _run():
+        async for _ in backend.run_streamed(handle, "hi", max_turns=1):
+            pass
+
+    with pytest.raises(BackendUnexpectedError):
+        asyncio.run(_run())
