fix(agent): preserve interleaved thinking order on Anthropic replay by AlexanderBFoley · Pull Request #36071 · NousResearch/hermes-agent

AlexanderBFoley · 2026-05-31T20:39:37Z

What & why

Extended/interleaved thinking turns on Claude 4.x (the interleaved-thinking beta) return assistant content as an ordered sequence of thinking/tool_use blocks, e.g. [thinking, tool_use, thinking, tool_use, ...].

AnthropicTransport.normalize_response() split these into flat text / reasoning_details / tool_calls collections, discarding the relative order, and _convert_assistant_message() rebuilt the turn as [all-thinking] + text + [all-tool_use]. Reordering the signed thinking blocks makes Anthropic reject the next request with a non-retryable:

HTTP 400 — thinking or redacted_thinking blocks in the latest assistant message cannot be modified. These blocks must remain as they were in the original response.

Result: on direct Anthropic (e.g. claude-opus-4-x), every multi-tool turn with thinking enabled hard-crashes the agent on the continuation call.

The existing thinking-signature recovery in error_classifier only matched messages containing both "signature" and "thinking", so this 400 (which says "cannot be modified" / "must remain as they were") fell through to a non-retryable abort — the strip-and-retry recovery never fired.

Changes

transports/anthropic.py — capture the full ordered block list (anthropic_ordered_content) when the turn carries signed thinking blocks; also capture redacted_thinking (previously dropped). Unsigned Kimi/DeepSeek /anthropic turns are intentionally excluded (no signature/data), so their reasoning_content round-trip is unaffected.
transports/types.py — anthropic_ordered_content accessor on NormalizedResponse.
chat_completion_helpers.py — persist the ordered list on the stored assistant message (plain JSON; survives session persistence).
anthropic_adapter.py — _convert_assistant_message replays the ordered blocks verbatim (interleave order + signatures preserved). Tool inputs are re-sourced from the already-redacted tool_calls, so the read_file returns line-numbered content that pollutes files when written back via write_file #19798 credential redaction is preserved.
error_classifier.py — broaden the thinking-recovery pattern to also catch "cannot be modified" / "must remain as they were".

The whole path is gated on the presence of signed thinking blocks → no behavior change for non-thinking turns or unsigned (Kimi/DeepSeek) providers.

How to test

python -m pytest -o "addopts=" tests/agent/test_interleaved_thinking_replay.py

New test covers: ordered capture, verbatim replay (order + signatures + tool-id match), both classifier message variants, and the unsigned-skip case.

Regression — all pass (681+ tests):
tests/agent/test_anthropic_adapter.py, test_error_classifier.py, test_deepseek_anthropic_thinking.py, test_kimi_coding_anthropic_thinking.py, tests/agent/transports/. scripts/check-windows-footguns.py clean on the diff.

Verified end-to-end: a live multi-tool Opus run that reproducibly crashed with the 400 now completes through multiple tool rounds.

Platforms tested

Windows 11 (Python 3.11, project venv)

Extended/interleaved thinking turns (Claude 4.x with the interleaved-thinking beta) return assistant content as an ordered sequence of thinking/tool_use blocks, e.g. [thinking, tool_use, thinking, tool_use, ...]. normalize_response() split this into flat text/reasoning_details/tool_calls bags, discarding the interleave order, and _convert_assistant_message() rebuilt the turn as [all-thinking] + text + [all-tool_use]. Reordering the signed thinking blocks makes Anthropic reject the next request with a non-retryable HTTP 400: "thinking blocks in the latest assistant message cannot be modified. These blocks must remain as they were in the original response." Every multi-tool turn with thinking enabled crashed the agent. Fixes: - transports/anthropic.py: capture the full ordered block list (anthropic_ordered_content) when the turn carries SIGNED thinking blocks; also capture redacted_thinking (previously dropped). Kimi/ DeepSeek unsigned-thinking turns are untouched (no signature/data), so their reasoning_content round-trip is unaffected. - transports/types.py: expose the anthropic_ordered_content accessor. - chat_completion_helpers.py: persist the ordered list on the stored assistant message (plain JSON, survives session persistence). - anthropic_adapter.py: _convert_assistant_message replays the ordered blocks verbatim, preserving interleave order and signatures; tool inputs are re-sourced from the already-redacted tool_calls so the credential redaction (NousResearch#19798) is preserved. - error_classifier.py: the existing thinking-block recovery only matched "signature"+"thinking"; broaden it to also catch "cannot be modified" / "must remain as they were" so the strip-and-retry recovery fires instead of a hard non-retryable abort. Adds tests/agent/test_interleaved_thinking_replay.py (ordered capture, verbatim replay, classifier variants, and the unsigned-skip case). Existing agent/transport/classifier suites pass; verified end-to-end with a live multi-tool Opus run that previously crashed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Fixes a regression where interleaved-thinking + tool_use turns from Anthropic were reordered on replay, triggering HTTP 400 "thinking blocks ... cannot be modified", and the error classifier failed to recognize that 400 message so the recovery path never ran.

Changes:

Capture the original ordered Anthropic content-block list in AnthropicTransport.normalize_response (only when signed/redacted thinking is present), persist it through NormalizedResponse and build_assistant_message, and replay it verbatim in _convert_assistant_message.
Broaden the error_classifier 400 pattern to also match "cannot be modified" / "must remain as they were" so the strip-and-retry recovery fires.
Add regression tests covering ordered-replay, classifier patterns, and signed/unsigned capture gating.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
agent/transports/anthropic.py	Build and store `anthropic_ordered_content` when signed thinking blocks are present; also captures `redacted_thinking`.
agent/transports/types.py	Expose `anthropic_ordered_content` accessor on `NormalizedResponse`.
agent/chat_completion_helpers.py	Propagate ordered block list into the persisted assistant message dict.
agent/anthropic_adapter.py	Fast-path replay of ordered blocks (with redacted tool args) preserving interleave.
agent/error_classifier.py	Broaden 400 thinking-block pattern to cover "cannot be modified" / "must remain".
tests/agent/test_interleaved_thinking_replay.py	New regression tests for ordering, classifier patterns, and capture gating.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+        for tc in m.get("tool_calls", []) or []:
+            if not isinstance(tc, dict):
+                continue
+            fn = tc.get("function", {}) or {}
+            raw_args = fn.get("arguments", "{}")
+            try:
+                parsed_args = json.loads(raw_args) if isinstance(raw_args, str) else raw_args
+            except (json.JSONDecodeError, ValueError):
+                parsed_args = {}
+            redacted_by_id[_sanitize_tool_id(tc.get("id", ""))] = parsed_args


+                ordered_blocks.append({
+                    "type": "tool_use",
+                    "id": block.id,
+                    "name": name,
+                    "input": _to_plain_data(block.input),
+                })


+    _system, result = convert_messages_to_anthropic(
+        messages, base_url=None, model="claude-opus-4-8"
+    )


alt-glitch · 2026-05-31T20:58:22Z

Competing fix for #35975 alongside PR #35586 (same preserve-verbatim-order approach) and PR #35976 (alternative demote-to-text approach). Also extends error_classifier to catch the "cannot be modified" 400 variant.

…ay 400 recovery Two additive hardening changes on the interleaved-thinking replay path introduced by this PR's anthropic_content_blocks channel. Both are scoped to that channel's blast radius; neither changes correct behavior. 1. Replay-time tool-input re-sourcing (credential safety). The ordered-block channel captures each tool_use `input` from the RAW API response in normalize_response, which is NOT credential-redacted. The parallel tool_calls[].function.arguments IS redacted at storage time (build_assistant_message, NousResearch#19798). The verbatim-replay fast path in _convert_assistant_message replayed the raw block input, so a secret a model inlined into a tool call (e.g. an Authorization header value passed inside a terminal command) would ride back onto the wire even though it is redacted everywhere else in history. Re-source tool_use input from the redacted tool_calls map by sanitized id; interleave order (the reason this channel exists) is unaffected. Adapted from NousResearch#36071, which re-sources tool inputs the same way on its replay path. 2. Broaden the thinking-replay 400 classifier (defense-in-depth). error_classifier only matched "signature" + "thinking", so the frozen-block variant — "thinking ... blocks in the latest assistant message cannot be modified. These blocks must remain as they were in the original response." — carried no "signature" token and fell through to a non-retryable abort. The anthropic_content_blocks channel prevents the reorder that triggers this 400 at the source, but if any future mutator reintroduces it, the turn now self-heals via the existing strip-reasoning-and-retry recovery instead of crash-looping. A negative case ensures an unrelated "cannot be modified" 400 (no "thinking") is not swept in. Mirrors the classifier broadening in NousResearch#36087 and NousResearch#36071. Tests - tests/agent/test_anthropic_thinking_block_order.py: a replay test asserting an inlined secret is redacted on the wire while interleave order is preserved. - tests/agent/test_error_classifier.py: three cases — frozen-block 400 native and via OpenRouter route to thinking_signature/retryable; an unrelated "cannot be modified" 400 does not. Both grafts verified RED (tests fail with the change reverted) then GREEN. Full adapter, transport, classifier and output-field-leak suites pass. Co-authored-by: AlexanderBFoley <92330381+AlexanderBFoley@users.noreply.github.com>

Spaceman-Spiffy · 2026-06-01T01:47:44Z

Hi @AlexanderBFoley — noting some overlap for context and to credit your work. #35586 takes the same root-cause approach as this PR: capture the turn's blocks in original order at the transport and replay them verbatim, so interleaved signed thinking/tool_use isn't reordered into the 400.

The main difference is persistence. #35586 stores the ordered list in a dedicated anthropic_content_blocks column in state.db (schema + append_message + get_messages_as_conversation + the run_agent flush), so it survives a process restart / session resume. This PR's anthropic_ordered_content rides on the in-memory message — as far as I can tell it isn't given a column or an append_message kwarg, so on the reload path (get_messages_as_conversation) the key would be dropped. I checked this with a small round-trip test against SessionDB; happy to share it, in case I've misread the persistence path.

One detail from this PR is now folded into #35586 with credit: re-sourcing tool_use input from the redacted tool_calls map rather than the raw captured block, which avoids replaying an un-redacted secret a model inlined into a tool call (tool_calls[].arguments is redacted at storage via #19798, the raw block isn't). You're added as Co-authored-by on that commit. The classifier broadening is carried as a backstop as well.

Sharing for the record — the two look complementary.

…ay 400 recovery Two additive hardening changes on the interleaved-thinking replay path introduced by this PR's anthropic_content_blocks channel. Both are scoped to that channel's blast radius; neither changes correct behavior. 1. Replay-time tool-input re-sourcing (credential safety). The ordered-block channel captures each tool_use `input` from the RAW API response in normalize_response, which is NOT credential-redacted. The parallel tool_calls[].function.arguments IS redacted at storage time (build_assistant_message, #19798). The verbatim-replay fast path in _convert_assistant_message replayed the raw block input, so a secret a model inlined into a tool call (e.g. an Authorization header value passed inside a terminal command) would ride back onto the wire even though it is redacted everywhere else in history. Re-source tool_use input from the redacted tool_calls map by sanitized id; interleave order (the reason this channel exists) is unaffected. Adapted from #36071, which re-sources tool inputs the same way on its replay path. 2. Broaden the thinking-replay 400 classifier (defense-in-depth). error_classifier only matched "signature" + "thinking", so the frozen-block variant — "thinking ... blocks in the latest assistant message cannot be modified. These blocks must remain as they were in the original response." — carried no "signature" token and fell through to a non-retryable abort. The anthropic_content_blocks channel prevents the reorder that triggers this 400 at the source, but if any future mutator reintroduces it, the turn now self-heals via the existing strip-reasoning-and-retry recovery instead of crash-looping. A negative case ensures an unrelated "cannot be modified" 400 (no "thinking") is not swept in. Mirrors the classifier broadening in #36087 and #36071. Tests - tests/agent/test_anthropic_thinking_block_order.py: a replay test asserting an inlined secret is redacted on the wire while interleave order is preserved. - tests/agent/test_error_classifier.py: three cases — frozen-block 400 native and via OpenRouter route to thinking_signature/retryable; an unrelated "cannot be modified" 400 does not. Both grafts verified RED (tests fail with the change reverted) then GREEN. Full adapter, transport, classifier and output-field-leak suites pass. Co-authored-by: AlexanderBFoley <92330381+AlexanderBFoley@users.noreply.github.com>

…ay 400 recovery Two additive hardening changes on the interleaved-thinking replay path introduced by this PR's anthropic_content_blocks channel. Both are scoped to that channel's blast radius; neither changes correct behavior. 1. Replay-time tool-input re-sourcing (credential safety). The ordered-block channel captures each tool_use `input` from the RAW API response in normalize_response, which is NOT credential-redacted. The parallel tool_calls[].function.arguments IS redacted at storage time (build_assistant_message, NousResearch#19798). The verbatim-replay fast path in _convert_assistant_message replayed the raw block input, so a secret a model inlined into a tool call (e.g. an Authorization header value passed inside a terminal command) would ride back onto the wire even though it is redacted everywhere else in history. Re-source tool_use input from the redacted tool_calls map by sanitized id; interleave order (the reason this channel exists) is unaffected. Adapted from NousResearch#36071, which re-sources tool inputs the same way on its replay path. 2. Broaden the thinking-replay 400 classifier (defense-in-depth). error_classifier only matched "signature" + "thinking", so the frozen-block variant — "thinking ... blocks in the latest assistant message cannot be modified. These blocks must remain as they were in the original response." — carried no "signature" token and fell through to a non-retryable abort. The anthropic_content_blocks channel prevents the reorder that triggers this 400 at the source, but if any future mutator reintroduces it, the turn now self-heals via the existing strip-reasoning-and-retry recovery instead of crash-looping. A negative case ensures an unrelated "cannot be modified" 400 (no "thinking") is not swept in. Mirrors the classifier broadening in NousResearch#36087 and NousResearch#36071. Tests - tests/agent/test_anthropic_thinking_block_order.py: a replay test asserting an inlined secret is redacted on the wire while interleave order is preserved. - tests/agent/test_error_classifier.py: three cases — frozen-block 400 native and via OpenRouter route to thinking_signature/retryable; an unrelated "cannot be modified" 400 does not. Both grafts verified RED (tests fail with the change reverted) then GREEN. Full adapter, transport, classifier and output-field-leak suites pass. Co-authored-by: AlexanderBFoley <92330381+AlexanderBFoley@users.noreply.github.com>

teknium1 · 2026-06-18T12:42:13Z

Closing as landed-in-spirit. The interleaved-thinking 400 crash-loop (#35975) is fixed on main by the order-preserving channel your PR pioneered: agent/transports/anthropic.py captures the verbatim block sequence into anthropic_content_blocks when a turn interleaves signed thinking with tool_use, chat_completion_helpers.py persists it through the store round-trip, and anthropic_adapter.py replays it in original order so signatures stay aligned. The adapter's replay path explicitly credits your approach ("Adapted from #36071 (replay-time tool-input re-sourcing)").

Your direction is the one we shipped — thank you. Closing this branch since the equivalent change is already on main.

…ay 400 recovery Two additive hardening changes on the interleaved-thinking replay path introduced by this PR's anthropic_content_blocks channel. Both are scoped to that channel's blast radius; neither changes correct behavior. 1. Replay-time tool-input re-sourcing (credential safety). The ordered-block channel captures each tool_use `input` from the RAW API response in normalize_response, which is NOT credential-redacted. The parallel tool_calls[].function.arguments IS redacted at storage time (build_assistant_message, NousResearch#19798). The verbatim-replay fast path in _convert_assistant_message replayed the raw block input, so a secret a model inlined into a tool call (e.g. an Authorization header value passed inside a terminal command) would ride back onto the wire even though it is redacted everywhere else in history. Re-source tool_use input from the redacted tool_calls map by sanitized id; interleave order (the reason this channel exists) is unaffected. Adapted from NousResearch#36071, which re-sources tool inputs the same way on its replay path. 2. Broaden the thinking-replay 400 classifier (defense-in-depth). error_classifier only matched "signature" + "thinking", so the frozen-block variant — "thinking ... blocks in the latest assistant message cannot be modified. These blocks must remain as they were in the original response." — carried no "signature" token and fell through to a non-retryable abort. The anthropic_content_blocks channel prevents the reorder that triggers this 400 at the source, but if any future mutator reintroduces it, the turn now self-heals via the existing strip-reasoning-and-retry recovery instead of crash-looping. A negative case ensures an unrelated "cannot be modified" 400 (no "thinking") is not swept in. Mirrors the classifier broadening in NousResearch#36087 and NousResearch#36071. Tests - tests/agent/test_anthropic_thinking_block_order.py: a replay test asserting an inlined secret is redacted on the wire while interleave order is preserved. - tests/agent/test_error_classifier.py: three cases — frozen-block 400 native and via OpenRouter route to thinking_signature/retryable; an unrelated "cannot be modified" 400 does not. Both grafts verified RED (tests fail with the change reverted) then GREEN. Full adapter, transport, classifier and output-field-leak suites pass. Co-authored-by: AlexanderBFoley <92330381+AlexanderBFoley@users.noreply.github.com>

Copilot AI review requested due to automatic review settings May 31, 2026 20:39

Copilot AI reviewed May 31, 2026

View reviewed changes

alt-glitch added type/bug Something isn't working P1 High — major feature broken, no workaround comp/agent Core agent runtime: loop, agent_init, prompt builder, context-compression, responses endpoint provider/anthropic Anthropic native Messages API labels May 31, 2026

ianculling mentioned this pull request May 31, 2026

fix(agent): route 'thinking blocks cannot be modified' 400 to recovery #36087

Closed

9 tasks

fesalfayed mentioned this pull request Jun 1, 2026

[Bug]: Bedrock Converse drops reasoning signatures + reads wrong schema key → interleaved thinking lost / signature-replay 400 (Bedrock analog of #35975) #36260

Open

teknium1 closed this Jun 18, 2026

This was referenced Jul 18, 2026

test(agent): regression coverage for plain-turn Anthropic thinking replay #66939

Closed

fix(anthropic): preserve signed thinking blocks on Kimi For Coding replay #66948

Closed

Navigation Menu

Uh oh!

fix(agent): preserve interleaved thinking order on Anthropic replay - #36071

fix(agent): preserve interleaved thinking order on Anthropic replay#36071
AlexanderBFoley wants to merge 1 commit into
NousResearch:mainfrom
AlexanderBFoley:fix/anthropic-interleaved-thinking-replay

AlexanderBFoley commented May 31, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

alt-glitch commented May 31, 2026

Uh oh!

Spaceman-Spiffy commented Jun 1, 2026 •

edited

Loading

Uh oh!

teknium1 commented Jun 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

AlexanderBFoley commented May 31, 2026

What & why

Changes

How to test

Platforms tested

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

alt-glitch commented May 31, 2026

Uh oh!

Spaceman-Spiffy commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

teknium1 commented Jun 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Spaceman-Spiffy commented Jun 1, 2026 •

edited

Loading