stack 4/5: keep an explicit thinking disable through translation (#545)

[lidge-jun]

Stack

4/4 — Claude Desktop classifier thinking round-trip

Base: codex/carry-contributor-bugfixes (#953)

Summary

Claude Desktop 3P Auto Mode sends thinking: {type: "disabled"} with max_tokens: 64 and a </block> stop sequence. The instruction was dropped in translation, so the model thought anyway and spent the 64-token budget before it could close the tag — and Claude Code retried, up to five times per tool approval. The reporter measured 1,084 truncated requests against 143 that completed.

• src/claude/inbound.ts — an explicit disable is preserved as the parser's "none" sentinel instead of becoming undefined
• src/adapters/anthropic.ts — emit thinking: {type: "disabled"} for models that both default to thinking-on and accept the explicit disable

The standing hypothesis was impossible

The recorded analysis on #545 said the prepended OAuth identity block consumed the classifier's 64 output tokens. It cannot: the identity goes into the system prompt, and max_tokens caps output. Different budgets. This repository had already reached that conclusion once — devlog/_fin/260728_bug_bundle_resolution/030_claude_system_dedup.md abandoned an identity-dedup patch for exactly this reason — and I re-derived the rejected theory before testing it.

The real chain is a round-trip fidelity loss:

1. src/claude/inbound.ts:494 treated disabled as nothing to translate, leaving reasoning undefined
2. that is indistinguishable from a request that never mentioned thinking, and tests/claude-inbound.test.ts pinned both to undefined
3. the adapter emits thinking only for a real non-none effort, so the field was omitted outbound
4. for Sonnet 5, an omitted thinking field means adaptive thinking is ON, and thinking tokens count against max_tokens

The client asked for no thinking and got thinking. That also explains the shape of the reporter's data: the 143 requests that completed are the ones where thinking happened to stay short.

The gate is deliberately narrow

usesAdaptiveThinking() looks like the right predicate and is not — it answers which wire shape a family accepts, not whether omission means thinking-on. The sets differ both ways: Fable always thinks and rejects an explicit disable, while Opus 4.7/4.8 use the adaptive wire but leave thinking off when omitted. Reusing it would have required breaking a passing test (tests/anthropic-reasoning.test.ts asserts claude-fable-5 + "none" sends no thinking config) in order to ship a production 400.

So supportsExplicitThinkingDisable() is seeded with sonnet: [5,0] only. Widen it per family with vendor evidence.

What the audit caught

Three rounds, two FAIL. Both findings were reproduced at runtime before fixing.

Round 1 — anthropic/claude-sonnet-5 silently missed the gate. A modelMap entry can point at a routed destination that routing decodes back into a slash-carrying native id, and the predicate anchored on ^claude-.

Round 2 — my own round-1 fix was worse than the bug. Normalizing with lastIndexOf("/") repaired the prefix case and broke the suffix case (claude-sonnet-5/variant), and because the adaptive-wire predicate shares that parse, such a model would have been sent obsolete manual thinking.enabled and 400d. A silent truncation traded for a hard failure.

Both now match the segment that actually begins with claude-, at either boundary, with all shapes pinned in the matrices — including a new adaptive-shape test covering the 400 path.

Cross-provider note

A modelMap that routes such a request to Cursor now selects the model's lowest tier rather than its top one. Cursor has no off switch for a reasoning model, so the lowest tier is the closest honest reading of "do not think" — the previous behavior sent these to the maximum tier, the opposite of the caller's instruction. Pinned in tests/cursor-effort-suffix.test.ts so it is deliberate rather than emergent.

Verification

• bun x tsc --noEmit — exit 0
• bun run test — 7711 pass, 8 skip, 0 fail, 507 files
• bun run privacy:scan — passed
• red-green, both halves independently: ablating the inbound preservation fails 3 tests; ablating the adapter emission fails 2 different ones

Two honest limits

The tests prove the wire shape, not that the retries stop. Confirming that needs a live Claude Desktop 3P + Anthropic OAuth session showing the classifier terminating on </block> instead of max_tokens. I have asked the reporter rather than claiming the symptom fixed.

This changes request construction on an Anthropic OAuth execution path, so MAINTAINERS.md requires explicit human security review — no credential handling is touched, but the boundary is. Please do not merge on CI alone.

Refs #545

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• ^dev$
• ^preview$

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 42ae96dc-8028-4c2b-903a-24526f46b945

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[lidge-jun]

Stack navigation

1. stack 1/5: triage the open issue surface and lock the bug plan #951 — triage the open issue surface and lock the bug plan (base dev)
2. stack 2/5: price long-context requests at the published long rate (#908) #952 — long-context pricing tiers, Cost estimates ignore published long-context pricing tiers (OpenAI >272k, xAI >=200k) #908 (base stack 1/5: triage the open issue surface and lock the bug plan #951)
3. stack 3/5: carry six contributor bug fixes with authorship intact #953 — carry six contributor bug fixes (base stack 2/5: price long-context requests at the published long rate (#908) #952)
4. stack 4/5: keep an explicit thinking disable through translation (#545) #954 — Claude Desktop classifier thinking round-trip, Claude Desktop 3P Auto Mode classifier retries after 64-token Anthropic OAuth outputs #545 (base stack 3/5: carry six contributor bug fixes with authorship intact #953)

Review and merge bottom-up. Each PR targets the preceding stack branch, so its Files changed view contains only that layer.

The layers touch disjoint files — devlog/, src/usage/, the carried contributors' paths, and src/claude/ + src/adapters/anthropic.ts — so any layer can be retargeted to dev and taken independently without a rebase conflict.

#954 needs human security review per MAINTAINERS.md: it changes request construction on an Anthropic OAuth execution path. It is last in the stack so the first three can land without waiting on that.

Carried in #953, with authorship preserved: #939, #942, #943, #944, #945, #948.

[lidge-jun]

Stack navigation

1. stack 1/5: triage the open issue surface and lock the bug plan #951 — triage the open issue surface and lock the bug plan (base dev)
2. stack 2/5: price long-context requests at the published long rate (#908) #952 — long-context pricing tiers, Cost estimates ignore published long-context pricing tiers (OpenAI >272k, xAI >=200k) #908 (base stack 1/5: triage the open issue surface and lock the bug plan #951)
3. stack 3/5: carry six contributor bug fixes with authorship intact #953 — carry six contributor bug fixes (base stack 2/5: price long-context requests at the published long rate (#908) #952)
4. stack 4/5: keep an explicit thinking disable through translation (#545) #954 — Claude Desktop classifier thinking round-trip, Claude Desktop 3P Auto Mode classifier retries after 64-token Anthropic OAuth outputs #545 (base stack 3/5: carry six contributor bug fixes with authorship intact #953)
5. stack 5/5: probe reset-derived cooldowns without waiting to be selected (#915) #955 — cooldown early-recovery probe, [Bug]: Reset-derived cooldowns can miss early recovery while another pool account remains eligible #915 (base stack 4/5: keep an explicit thinking disable through translation (#545) #954)

Review and merge bottom-up. Each PR targets the preceding stack branch, so its Files changed view contains only that layer.

The layers touch disjoint files — devlog/, src/usage/, the carried contributors' paths, src/claude/ + src/adapters/anthropic.ts, and src/codex/ — so any layer can be retargeted to dev and taken independently without a rebase conflict.

#954 needs human security review per MAINTAINERS.md: it changes request construction on an Anthropic OAuth execution path. #955 sits above it in the chain but is independent of it in code, so if that review blocks, #955 can be retargeted to #953 without conflict.

Carried in #953, with authorship preserved: #939, #942, #943, #944, #945, #948.