From 10dab4f2c7b8f674aeff2b678d6aadc39b400dd1 Mon Sep 17 00:00:00 2001 From: Dale Babiy <42547246+minupla@users.noreply.github.com> Date: Thu, 19 Feb 2026 22:23:00 -0500 Subject: [PATCH] fix(anthropic): preserve pi-ai default betas when injecting anthropic-beta header (openclaw#19789) thanks @minupla Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: minupla <42547246+minupla@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com> --- CHANGELOG.md | 1 + ...pi-embedded-runner-extraparams.e2e.test.ts | 58 ++++++++++++++++++- src/agents/pi-embedded-runner/extra-params.ts | 36 +++++++++++- 3 files changed, 89 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 38a740461..ecee33b83 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,6 +20,7 @@ Docs: https://docs.openclaw.ai - Gateway/Pairing: tolerate legacy paired devices missing `roles`/`scopes` metadata in websocket upgrade checks and backfill metadata on reconnect. (#21447, fixes #21236) Thanks @joshavant. - Docker: pin base images to SHA256 digests in Docker builds to prevent mutable tag drift. (#7734) Thanks @coygeek. - Provider/HTTP: treat HTTP 503 as failover-eligible for LLM provider errors. (#21086) Thanks @Protocol-zero-0. +- Anthropic/Agents: preserve required pi-ai default OAuth beta headers when `context1m` injects `anthropic-beta`, preventing 401 auth failures for `sk-ant-oat-*` tokens. (#19789, fixes #19769) Thanks @minupla. - Slack: pass `recipient_team_id` / `recipient_user_id` through Slack native streaming calls so `chat.startStream`/`appendStream`/`stopStream` work reliably across DMs and Slack Connect setups, and disable block streaming when native streaming is active. (#20988) Thanks @Dithilli. Earlier recipient-ID groundwork was contributed in #20377 by @AsserAl1012. - CLI/Config: add canonical `--strict-json` parsing for `config set` and keep `--json` as a legacy alias to reduce help/behavior drift. (#21332) thanks @adhitShet. - CLI: keep `openclaw -v` as a root-only version alias so subcommand `-v, --verbose` flags (for example ACP/hooks/skills) are no longer intercepted globally. (#21303) thanks @adhitShet. diff --git a/src/agents/pi-embedded-runner-extraparams.e2e.test.ts b/src/agents/pi-embedded-runner-extraparams.e2e.test.ts index 28ef1f0ea..966b00fca 100644 --- a/src/agents/pi-embedded-runner-extraparams.e2e.test.ts +++ b/src/agents/pi-embedded-runner-extraparams.e2e.test.ts @@ -144,15 +144,65 @@ describe("applyExtraParamsToAgent", () => { } as Model<"anthropic-messages">; const context: Context = { messages: [] }; - void agent.streamFn?.(model, context, { headers: { "X-Custom": "1" } }); + // Simulate pi-agent-core passing apiKey in options (API key, not OAuth token) + void agent.streamFn?.(model, context, { + apiKey: "sk-ant-api03-test", + headers: { "X-Custom": "1" }, + }); expect(calls).toHaveLength(1); expect(calls[0]?.headers).toEqual({ "X-Custom": "1", - "anthropic-beta": "context-1m-2025-08-07", + // Includes pi-ai default betas (preserved to avoid overwrite) + context1m + "anthropic-beta": + "fine-grained-tool-streaming-2025-05-14,interleaved-thinking-2025-05-14,context-1m-2025-08-07", }); }); + it("preserves oauth-2025-04-20 beta when context1m is enabled with an OAuth token", () => { + const calls: Array = []; + const baseStreamFn: StreamFn = (_model, _context, options) => { + calls.push(options); + return {} as ReturnType; + }; + const agent = { streamFn: baseStreamFn }; + const cfg = { + agents: { + defaults: { + models: { + "anthropic/claude-sonnet-4-6": { + params: { + context1m: true, + }, + }, + }, + }, + }, + }; + + applyExtraParamsToAgent(agent, cfg, "anthropic", "claude-sonnet-4-6"); + + const model = { + api: "anthropic-messages", + provider: "anthropic", + id: "claude-sonnet-4-6", + } as Model<"anthropic-messages">; + const context: Context = { messages: [] }; + + // Simulate pi-agent-core passing an OAuth token (sk-ant-oat-*) as apiKey + void agent.streamFn?.(model, context, { + apiKey: "sk-ant-oat01-test-oauth-token", + headers: { "X-Custom": "1" }, + }); + + expect(calls).toHaveLength(1); + const betaHeader = calls[0]?.headers?.["anthropic-beta"] as string; + // Must include the OAuth-required betas so they aren't stripped by pi-ai's mergeHeaders + expect(betaHeader).toContain("oauth-2025-04-20"); + expect(betaHeader).toContain("claude-code-20250219"); + expect(betaHeader).toContain("context-1m-2025-08-07"); + }); + it("merges existing anthropic-beta headers with configured betas", () => { const { calls, agent } = createOptionsCaptureAgent(); const cfg = buildAnthropicModelConfig("anthropic/claude-sonnet-4-5", { @@ -170,12 +220,14 @@ describe("applyExtraParamsToAgent", () => { const context: Context = { messages: [] }; void agent.streamFn?.(model, context, { + apiKey: "sk-ant-api03-test", headers: { "anthropic-beta": "prompt-caching-2024-07-31" }, }); expect(calls).toHaveLength(1); expect(calls[0]?.headers).toEqual({ - "anthropic-beta": "prompt-caching-2024-07-31,files-api-2025-04-14,context-1m-2025-08-07", + "anthropic-beta": + "prompt-caching-2024-07-31,fine-grained-tool-streaming-2025-05-14,interleaved-thinking-2025-05-14,files-api-2025-04-14,context-1m-2025-08-07", }); }); diff --git a/src/agents/pi-embedded-runner/extra-params.ts b/src/agents/pi-embedded-runner/extra-params.ts index 35bd575cb..553dccd57 100644 --- a/src/agents/pi-embedded-runner/extra-params.ts +++ b/src/agents/pi-embedded-runner/extra-params.ts @@ -222,16 +222,46 @@ function mergeAnthropicBetaHeader( return merged; } +// Betas that pi-ai's createClient injects for standard Anthropic API key calls. +// Must be included when injecting anthropic-beta via options.headers, because +// pi-ai's mergeHeaders uses Object.assign (last-wins), which would otherwise +// overwrite the hardcoded defaultHeaders["anthropic-beta"]. +const PI_AI_DEFAULT_ANTHROPIC_BETAS = [ + "fine-grained-tool-streaming-2025-05-14", + "interleaved-thinking-2025-05-14", +] as const; + +// Additional betas pi-ai injects when the API key is an OAuth token (sk-ant-oat-*). +// These are required for Anthropic to accept OAuth Bearer auth. Losing oauth-2025-04-20 +// causes a 401 "OAuth authentication is currently not supported". +const PI_AI_OAUTH_ANTHROPIC_BETAS = [ + "claude-code-20250219", + "oauth-2025-04-20", + ...PI_AI_DEFAULT_ANTHROPIC_BETAS, +] as const; + +function isAnthropicOAuthApiKey(apiKey: unknown): boolean { + return typeof apiKey === "string" && apiKey.includes("sk-ant-oat"); +} + function createAnthropicBetaHeadersWrapper( baseStreamFn: StreamFn | undefined, betas: string[], ): StreamFn { const underlying = baseStreamFn ?? streamSimple; - return (model, context, options) => - underlying(model, context, { + return (model, context, options) => { + // Preserve the betas pi-ai's createClient would inject for the given token type. + // Without this, our options.headers["anthropic-beta"] overwrites the pi-ai + // defaultHeaders via Object.assign, stripping critical betas like oauth-2025-04-20. + const piAiBetas = isAnthropicOAuthApiKey(options?.apiKey) + ? (PI_AI_OAUTH_ANTHROPIC_BETAS as readonly string[]) + : (PI_AI_DEFAULT_ANTHROPIC_BETAS as readonly string[]); + const allBetas = [...new Set([...piAiBetas, ...betas])]; + return underlying(model, context, { ...options, - headers: mergeAnthropicBetaHeader(options?.headers, betas), + headers: mergeAnthropicBetaHeader(options?.headers, allBetas), }); + }; } /**