fix(providers): Anthropic reload and parallel results, local probe retry

[adriannoes]

Summary

Consolidates three cursor high-severity provider fixes as operator-authored commits:

• fix(providers): apply live config reload to Anthropic (supersedes fix(providers): apply live config reload to Anthropic #106) — a SIGHUP config reload now reaches the Anthropic provider instead of only the agent core.
• fix(providers): send parallel Anthropic tool results in one user message (supersedes fix(providers): send parallel Anthropic tool results in one user message #107) — parallel tool results are now grouped into a single user turn as the Anthropic API expects, instead of parallel tool_result blocks on the assistant turn.
• fix(providers): retry the local probe after a startup miss (supersedes fix(providers): retry the local probe after a startup miss #110) — a local model (llama-server) started at boot no longer gets permanently marked unavailable when the first probe fires before the server is listening.

Testing

• make test_reload — passed
• make test_anthropic — passed
• make test_local_provider — passed
• CI=true make test — passed
• make static — passed

Supersedes #106, #107 and #110. #118 (model-id gateway mapping) also touches src/providers/anthropic.c/provider.h; it will be rebased on top of this PR as a follow-up.

[cursor]

Summary

Three small, independent provider fixes that supersede #106, #107, #110: Anthropic now follows live config reload (try_config_reload -> provider_anthropic_set_live_config, same guard as OpenAI), parallel tool results are folded into one user message, and the local provider re-probes on chat after a startup miss. The Anthropic message builder is also split into short, checkable helpers. I read the diff and surrounding code; I could not build or run the tests here (no libcurl headers in this image), so test status is from reading only.

Must Fix

None.

Should Fix

• src/providers/local.c:188-195: the re-probe runs on every chat while s_local_unavailable is set, synchronously, and agent_run holds agent_lock at that point. A down server costs up to two curl probes per turn (/v1/models, then /health; LOCAL_PROBE_CONNECT_SEC 2s, LOCAL_PROBE_TIMEOUT_SEC 3s each). When local is the last backend in the chain and everything before it failed, that is up to a few seconds of added latency per message, plus a blocked gateway/channel for the duration. Consider a minimum interval between retries (for example one probe per 10-30s, using a static time_t like the router's g_recovery_last_wall). Test code can reset it in local_provider_test_reset.
• CHANGELOG.md (Unreleased, Fixed): no entries for the three fixes. Other consolidation PRs in this tree add them.
• docs/LOCAL_INFERENCE.md:21: still says that if the server is unreachable at startup the provider marks itself unavailable. Add that the next request probes again.
• tests/test_local_provider.c:82: local_provider_test_set_skip_probe(1) makes local_probe_endpoint return 1 unconditionally, so the test proves the flag clears, but not that local_chat actually calls provider_local_endpoint_reachable against the configured endpoint. Fine as a first cut; a loopback listener (or a probe hook) would cover the real path. The unchanged test_init_unreachable_... does cover the still-down case.
• tests/test_anthropic.c:238: the grouping test only covers two results at the end of the list. Add: a single tool result (no regression of the old path), results followed by a plain user message (the loop must stop at the first message without tool_use_id), and two assistant/tool rounds in a row (no merging across the assistant message). Those are the boundary conditions of append_tool_result_message.

Nice to Have

• src/providers/anthropic.c:333: if tc->arguments is non-empty but not valid JSON, cJSON_Parse returns NULL and the tool_use block is sent without input, which the API rejects with a 400 that will repeat every turn for that session. Now that this is its own function it is cheap to fall back to {} (or fail closed). Pre-existing behavior, moved as-is.
• src/providers/anthropic.c:481: anthropic_live_config_for_test is compiled into production and declared unconditionally in provider.h, unlike the other _for_test hooks. I see why (test_reload links the non-test anthropic.o), but a short comment in provider.h saying so would stop someone from "fixing" it with an #ifdef.
• tests/test_reload.c:260: the new test is moved to the front of main with no comment, and it does not cover the no-key case (provider_anthropic_set_live_config must stay a no-op when init failed). One assertion would lock the s_anth_api_key guard.
• The cJSON_AddItemToObject(msg, "role", cJSON_CreateString(...)) calls in append_assistant_tool_content and append_anthropic_messages still ignore allocation failure (missing role would produce an invalid request). Same pattern as before; append_one_tool_result already uses cJSON_AddStringToObject with checks, so the rest could follow.

Positive Highlights

• The tool-result fix is correct against the Messages API: all tool_result blocks for one assistant turn go into a single user message, and the old per-result messages (a 400 for parallel tool calls) are gone. Ownership on error paths is clean: msg is attached to msg_arr before the loop, so a mid-loop failure does not leak.
• Splitting the 50-line inline loop in build_and_send into append_one_tool_result, append_tool_result_message, append_assistant_tool_content, and append_anthropic_messages makes the code reviewable, and the anthropic_messages_json_for_test hook lets the test assert on JSON structure instead of strstr. Failure on OOM now returns an error instead of silently dropping a block.
• The comment in local_chat explains why router recovery cannot clear the flag (it only probes backends before the active index, and local is last in the default chain). I checked provider_router_periodic_recovery_tick, and that reasoning holds.

  

_{Sent by Cursor Automation: Code review}

[cursor]

This probe is synchronous and repeats on every chat while the server is down (models probe, then health probe, up to ~2s connect / 3s total each). It runs under agent_lock. Please add a minimum retry interval so a dead llama-server does not add seconds to every turn.

[cursor]

The loop stops at the first following message without tool_use_id, which is right. Add a test for results followed by a plain user message and for a single result, so this boundary is locked.

[adriannoes]

Review triage — every item mapped:

Must Fix — none raised.

Should Fix

• src/providers/local.c:188-195 re-probe runs on every chat while unavailable — Fixed in ccbfa38 (fix(providers): throttle the local re-probe while unavailable). While s_local_unavailable is set, chat re-probes at most once per LOCAL_REPROBE_MIN_SEC (15 s), tracked by a static time_t in the router's g_recovery_last_wall style; local_provider_test_reset() clears it. TDD: a second chat inside the window does not probe; after the hook resets the throttle it probes again.
• CHANGELOG.md Unreleased/Fixed entries missing — Fixed in fa52090 (docs(providers): document local re-probe throttle and consolidated fixes). Bullets added for the three consolidated fixes.
• docs/LOCAL_INFERENCE.md:21 still ends the story at "marks itself unavailable" — Fixed in fa52090. Now states the provider re-probes on the next request, at most once every 15 seconds.
• tests/test_local_provider.c:82 loopback listener / probe hook proving local_chat probes the configured endpoint — Not changed: test-infrastructure addition; accepted as a first cut. The skip_probe flag covers the flag-clear path and the unchanged test_init_unreachable_* covers the still-down path. Follow-up.
• tests/test_anthropic.c:238 grouping boundary cases — Fixed in 77d2bfc (test(anthropic): cover tool-result grouping boundaries). Single tool result still yields one user message; results followed by a plain user message stop grouping at the first message without tool_use_id; two consecutive assistant/tool rounds keep their result messages separate.

Nice to Have — none changed

• src/providers/anthropic.c {} fallback when tool arguments are non-empty but invalid JSON — Not changed: pre-existing behavior moved as-is in this PR; incremental hardening beyond this PR's smallest patch. Follow-up.
• One-line comment in provider.h explaining why anthropic_live_config_for_test ships unconditioned — Not changed: comment-only hardening outside the smallest patch. Follow-up.
• No-key assertion in test_reload (live config must stay a no-op when init failed) — Not changed: incremental test hardening outside this PR's scope. Follow-up.
• cJSON_AddItemToObject(..., "role", ...) allocation-failure checks in the message builders — Not changed: same pre-existing pattern; append_one_tool_result already checks its adds. Follow-up.