fix(tool-search): use the API's native search tool name and inject only on Anthropic hosts - #1332

What

Two defects in the Anthropic native tool-search adapter (builtin/tool-search/native-search.ts) that together break every anthropic-messages request once the extension catalog contains an inactive tool:

1. Wrong tool name. The adapter appended { type: "tool_search_tool_bm25_20251119", name: "tool_search" }. The Messages API only accepts name: "tool_search_tool_bm25" for that type and rejects the whole request:

   400 tools.39.tool_search_tool_bm25_20251119.name: Input should be 'tool_search_tool_bm25'
   

2. Injected on every anthropic-messages endpoint. The gate was api === "anthropic-messages", so third-party hosts that speak the Anthropic wire format (Kimi Code api.kimi.com/coding, OpenRouter, proxies) also received the server-side tool and answered with an opaque 400 {"error":{"type":"invalid_request_error","message":"Invalid request Error"}}.

Why it surfaced now

The adapter has been in since #811, but enabled() only fires when the catalog has an inactive extension tool. #1314 (eval-only routing for bash/workflow/monitor as the default) makes that true for every session, so 2026.9.3-3 turned native injection on for everyone and both defects hit at once. The 400 fallback (noteResponseStatus) only kicks in after the first failed turn of each session and, on third-party hosts, hid the real cause behind a generic error.

Changes

• ANTHROPIC_TOOL_SEARCH_NAME → "tool_search_tool_bm25".
• AnthropicNativeToolSearchAdapter.applyBeforeRequest(model, payload) now takes the request model (event.model ?? ctx.model) and skips injection unless isFirstPartyAnthropicEndpoint(model.baseUrl) — hostname anthropic.com or a subdomain. A missing baseUrl keeps the previous behaviour, so existing callers/tests are unaffected. addAnthropicNativeToolSearch itself is unchanged (still the pure api + payload transform).
• Test validator mock (native-search-mocks.ts) now enforces the tool name the way the API does, so the old name fails the existing HARD-RULES tests instead of passing silently.
• New cases in test/tool-search/native-anthropic.test.ts: exact tool name, pre-fix name is a 400 in the validator, host classification, and that an anthropic-messages model on a third-party host gets the untouched payload while a later 400 from that host is not attributed to native search.
• tool-search/changes.md entry.

No CHANGELOG.md edit (maintainer-owned).

Verification

• npx vitest --run test/tool-search test/mcp/tool-search-promotion.test.ts test/mcp/native-anthropic.test.ts — green.
• npm run check — green.
• Live reproduction on omo-ai 5.0.0-0.beta.38/39 (senpi 2026.9.3-3), session log excerpts with the two error shapes above against anthropic/claude-fable-5, anthropic/claude-opus-5, and kimi-coding/k3. Applying the same two changes to the installed dist/ restored both providers; the Kimi model keeps working through the local tool_search tool.

Notes for reviewers

• A corporate proxy in front of api.anthropic.com on a non-anthropic.com hostname loses native tool search with this change and falls back to local tool_search (no request failure). If that should be opt-in-able, a compat flag on the model config would be the natural follow-up; I kept this PR to the minimal fix.

Summary by cubic

Fixes the Anthropic native tool-search adapter so requests no longer fail with 400 errors. The injected tool now uses the API-required name tool_search_tool_bm25, and injection only runs on first-party anthropic.com hosts; third-party hosts now fall back to the local tool_search tool.

Bug Fixes

• Renames the native search tool to tool_search_tool_bm25; the API rejects any other name with a 400.
• Skips injection for anthropic-messages models on third-party hosts like Kimi Code and OpenRouter, which don't implement native tool search.
• Models without a baseUrl keep the previous behavior so existing callers and tests are unaffected.
• The test validator now enforces the tool name like the API does, with new tests covering the name, host gating, and third-party 400 attribution.

^{Written for commit 475598d. Summary will update on new commits.}