Sanitize server_tool_use IDs for Anthropic-bound requests

[andreasfoo]

Problem

User report:

API Error: 400 ... messages.1.content.2.server_tool_use.id:
String should match pattern '^srvtoolu_[a-zA-Z0-9_]+$'

api.anthropic.com strictly validates the id of server_tool_use content blocks against ^srvtoolu_[a-zA-Z0-9_]+$. As a multi-provider gateway, tingly-box replays conversation history that may contain server_tool_use blocks (typically WebSearch) whose IDs were minted by a different upstream — e.g. OpenAI-style call_... IDs from a converted response, or a third-party Anthropic-compatible endpoint using its own ID format. When a later request in that conversation routes to real Anthropic, the history is forwarded verbatim and the entire request is rejected with a 400.

The codebase previously had no sanitization for server_tool_use IDs at all (no srvtoolu reference anywhere).

Fix

New op internal/protocol/ops/request_anthropic_server_tool_use.go:

• SanitizeAnthropicV1ServerToolUseIDs / SanitizeAnthropicBetaServerToolUseIDs rewrite non-conforming server_tool_use IDs in the replayed message history:
  • Invalid characters are replaced with _; a srvtoolu_ prefix is added when needed (an already-prefixed ID with bad chars is not double-prefixed).
  • The rewrite is deterministic: the original ID is preserved inside the new one so the model can still correlate the block across turns, and the same old ID always maps to the same new ID.
  • Empty IDs get a per-request counter (srvtoolu_missing_N) so they stay distinct.
• Every result block referencing a rewritten ID via tool_use_id (web_search_tool_result, web_fetch_tool_result, plain tool_result, etc. — via the SDK's GetToolUseID() accessor) is remapped so the use/result pairing stays intact.
• Valid IDs and regular tool_use blocks are left untouched.

Wired into VendorTransform (internal/protocol/transform/vendor.go) for both the v1 and beta paths, only when the target provider URL is api.anthropic.com / claude.ai — consistent with the existing per-vendor dispatch. Requests to other providers are unaffected.

Tests

internal/protocol/ops/request_anthropic_server_tool_use_test.go:

• Realistic JSON-unmarshalled beta request: invalid ID rewritten, web_search_tool_result remapped, serialized output no longer contains the old ID
• Valid srvtoolu_... IDs kept as-is
• Empty IDs get distinct replacement IDs
• srvtoolu_-prefixed ID with invalid chars is sanitized without double prefix
• Mixed valid/invalid IDs in one request: only invalid ones (and their results) touched
• Plain tool_result referencing a rewritten ID is remapped
• Regular tool_use blocks with call_... IDs untouched
• Same old ID maps to the same new ID; nil request is a no-op

internal/protocol/transform/vendor_test.go:

• Vendor dispatch: sanitizer runs for api.anthropic.com targets, no-op for non-Anthropic targets (api.deepseek.com)

All internal/protocol/ops and internal/protocol/transform tests pass.

Note

Beta mcp_tool_use blocks have an analogous prefix constraint (mcptoolu_) with the same cross-provider risk; kept out of scope here since the report only covers server_tool_use, but the same pattern extends directly.

🤖 Generated with Claude Code