fix: only reinterpret an error as a budget rejection when it says so

Review of the first commit found the retry could fire on errors that have
nothing to do with the budget, which would replace a readable provider error
with a truncated response: exactly the symptom this PR exists to remove.

- Drop the generic "lower than N" pattern. For the Bedrock message it was dead
  code, since "model limit of N" matches first with the same number. Left live,
  it would read a number out of any message shaped like "must be lower than 2".
- Skip errors whose status is not 400 or 422, so auth and rate-limit failures
  are never reinterpreted.
- Require the parsed ceiling to be at least 1024. Below that a diagram cannot
  come out whole, so retrying would hide the error behind broken XML.
- Validate MAX_OUTPUT_TOKENS from env the same way as the header, so a stray
  "-1" falls back instead of reaching the provider.

Adds tests for the retry wrapper itself, which had none: it retries once with
the named ceiling, leaves a 401 alone, does not retry when the ceiling is not
smaller, propagates a second rejection, and preserves the other call options.

Re-verified against the live APIs: bedrock nova-lite still logs "64000 rejected,
retrying with 10000" and completes its tool call, and deepseek-v4-flash still
finishes normally at 64000.

lib/output-token-limit.ts

@@ -16,6 +16,19 @@ export const DEFAULT_MAX_OUTPUT_TOKENS = 64000
 /** Ceiling for the user-supplied override, to catch typos like an extra zero. */
 export const MAX_OUTPUT_TOKENS_LIMIT = 200000
 
+/**
+ * Below this a diagram cannot come out whole, so a retry would just produce
+ * truncated XML instead of the provider's error. Better to surface the error.
+ */
+const MIN_USABLE_OUTPUT_TOKENS = 1024
+
+/** Status codes that can carry a complaint about the requested budget. */
+const BUDGET_REJECTION_STATUSES = new Set([400, 422])
+
+function usableLimit(value: number): number | null {
+    return value >= MIN_USABLE_OUTPUT_TOKENS ? value : null
+}
+
 /**
  * A budget this large exceeds what some models accept. Providers reject it with a
  * 400 that names the real limit, so we parse the number out and retry once
@@ -28,9 +41,26 @@ export const MAX_OUTPUT_TOKENS_LIMIT = 200000
  *   Note this one is an input+output ceiling, so the input has to be subtracted.
  * - Anthropic: "max_tokens: 200000 > 64000, which is the maximum allowed..."
  * - OpenAI: "This model supports at most 16384 completion tokens"
+ *
+ * Every pattern names tokens explicitly. A generic one (an earlier draft matched
+ * "lower than N") would reinterpret unrelated failures, and retrying on a bogus
+ * number turns a readable error into an empty diagram.
  */
 export function parseOutputTokenLimit(error: unknown): number | null {
-    const err = error as { message?: unknown; responseBody?: unknown }
+    const err = error as {
+        message?: unknown
+        responseBody?: unknown
+        statusCode?: unknown
+    }
+
+    // An auth or rate-limit failure is not about the budget, so leave it alone.
+    if (
+        typeof err?.statusCode === "number" &&
+        !BUDGET_REJECTION_STATUSES.has(err.statusCode)
+    ) {
+        return null
+    }
+
     const text = [
         typeof err?.message === "string" ? err.message : "",
         typeof err?.responseBody === "string" ? err.responseBody : "",
@@ -43,18 +73,17 @@ export function parseOutputTokenLimit(error: unknown): number | null {
     const context = text.match(/maximum context length is (\d+)/i)
     if (context) {
         const input = text.match(/(\d+) of text input/i)
-        const budget =
-            Number(context[1]) - (input ? Number(input[1]) : 0) - 1024
-        return budget > 0 ? budget : null
+        return usableLimit(
+            Number(context[1]) - (input ? Number(input[1]) : 0) - 1024,
+        )
     }
 
     const output =
         text.match(/model limit of (\d+)/i) ||
         text.match(/> (\d+), which is the maximum/i) ||
-        text.match(/at most (\d+) completion tokens/i) ||
-        text.match(/lower than (\d+)/i)
+        text.match(/at most (\d+) completion tokens/i)
 
-    return output ? Number(output[1]) : null
+    return output ? usableLimit(Number(output[1])) : null
 }
 
 /**
@@ -92,19 +121,25 @@ export function withOutputTokenLimitFallback(
     })
 }
 
+function validBudget(value: string | null | undefined): number | null {
+    const parsed = Number(value)
+    return Number.isInteger(parsed) &&
+        parsed > 0 &&
+        parsed <= MAX_OUTPUT_TOKENS_LIMIT
+        ? parsed
+        : null
+}
+
 /**
  * Resolve the output budget: user setting (sent as a header so it works in the
- * desktop app too), then server env, then the default.
+ * desktop app too), then server env, then the default. Both sources go through
+ * the same validation, so a typo in either falls back instead of reaching the
+ * provider.
  */
 export function resolveMaxOutputTokens(headerValue: string | null): number {
-    const fromHeader = Number(headerValue)
-    if (
-        Number.isInteger(fromHeader) &&
-        fromHeader > 0 &&
-        fromHeader <= MAX_OUTPUT_TOKENS_LIMIT
-    ) {
-        return fromHeader
-    }
-
-    return Number(process.env.MAX_OUTPUT_TOKENS) || DEFAULT_MAX_OUTPUT_TOKENS
+    return (
+        validBudget(headerValue) ??
+        validBudget(process.env.MAX_OUTPUT_TOKENS) ??
+        DEFAULT_MAX_OUTPUT_TOKENS
+    )
 }