fix(tracing/anthropic): guard ContentBlockDelta / Stop indices from negatives

The upper-bound check on ContentBlockDelta/Stop was `idx < len(response.Content)`.
In Go, that condition is trivially satisfied by negative ints, so a malformed
or hostile upstream chunk with `Index: -1` slipped through and panicked on the
`response.Content[idx]` access below. The panic surfaces inside the tracing
pipeline (Anthropic messages recorder) and takes the request down when
OpenInference tracing is enabled.

Only ContentBlockStart had the non-negative guard. Extract the shared check
into `isValidContentBlockIndex(idx)` and apply it to every SSE index path
(Start / Delta / Stop). The upper bound (maxContentBlocks = 1000) is preserved
so a giant Index can't force a giant allocation either.

Regression test added: a chunk sequence with a valid Start followed by
ContentBlockDelta{Index:-5} and ContentBlockStop{Index:-1} now completes
without panic and produces the same content as if those events were absent.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: pokabookinflab

internal/tracing/openinference/anthropic/messages.go

@@ -233,6 +233,19 @@ func buildResponseAttributes(resp *anthropic.MessagesResponse, config *openinfer
 	return attrs
 }
 
+// maxContentBlocks caps how large a single Anthropic streaming message's content array can
+// grow inside the tracing span. Well-formed responses stay well below this; the cap exists so
+// a hostile / buggy upstream cannot force a giant allocation by sending an out-of-range index.
+const maxContentBlocks = 1000
+
+// isValidContentBlockIndex applies the same non-negative / bounded check to every SSE index
+// path (ContentBlockStart / ContentBlockDelta / ContentBlockStop). Negative indices used to
+// slip through the delta/stop branches — the length check alone (`idx < len`) is satisfied by
+// negative values in Go, which then panic on the slice index below.
+func isValidContentBlockIndex(idx int) bool {
+	return idx >= 0 && idx < maxContentBlocks
+}
+
 // convertSSEToResponse converts a complete SSE stream to a single JSON-encoded
 // openai.ChatCompletionResponse. This will not serialize zero values including
 // fields whose values are zero or empty, or nested objects where all fields
@@ -270,9 +283,7 @@ func convertSSEToResponse(chunks []*anthropic.MessagesStreamChunk) *anthropic.Me
 
 		case event.ContentBlockStart != nil:
 			idx := event.ContentBlockStart.Index
-			// Guard against negative or unreasonably large indices from a hostile upstream.
-			const maxContentBlocks = 1000
-			if idx < 0 || idx >= maxContentBlocks {
+			if !isValidContentBlockIndex(idx) {
 				continue
 			}
 			// Grow slice if needed.
@@ -285,28 +296,35 @@ func convertSSEToResponse(chunks []*anthropic.MessagesStreamChunk) *anthropic.Me
 
 		case event.ContentBlockDelta != nil:
 			idx := event.ContentBlockDelta.Index
-			if idx < len(response.Content) {
-				block := &response.Content[idx]
-				delta := event.ContentBlockDelta.Delta
+			// The upper-bound check (idx < len) already blocks out-of-range access, but a
+			// negative index from a hostile / malformed upstream would satisfy `idx < len`
+			// yet still panic on the slice index below. Reject negatives explicitly.
+			if !isValidContentBlockIndex(idx) || idx >= len(response.Content) {
+				continue
+			}
+			block := &response.Content[idx]
+			delta := event.ContentBlockDelta.Delta
 
-				if block.Text != nil && delta.Text != "" {
-					block.Text.Text += delta.Text
-				}
-				if block.Tool != nil && delta.PartialJSON != "" {
-					toolInputs[idx] += delta.PartialJSON
+			if block.Text != nil && delta.Text != "" {
+				block.Text.Text += delta.Text
+			}
+			if block.Tool != nil && delta.PartialJSON != "" {
+				toolInputs[idx] += delta.PartialJSON
+			}
+			if block.Thinking != nil {
+				if delta.Thinking != "" {
+					block.Thinking.Thinking += delta.Thinking
 				}
-				if block.Thinking != nil {
-					if delta.Thinking != "" {
-						block.Thinking.Thinking += delta.Thinking
-					}
-					if delta.Signature != "" {
-						block.Thinking.Signature = delta.Signature
-					}
+				if delta.Signature != "" {
+					block.Thinking.Signature = delta.Signature
 				}
 			}
 
 		case event.ContentBlockStop != nil:
 			idx := event.ContentBlockStop.Index
+			if !isValidContentBlockIndex(idx) {
+				continue
+			}
 			if jsonStr, ok := toolInputs[idx]; ok {
 				if idx < len(response.Content) && response.Content[idx].Tool != nil {
 					var input map[string]any

internal/tracing/openinference/anthropic/messages_test.go

@@ -238,6 +238,42 @@ func TestConvertSSEToResponse(t *testing.T) {
 				Content: []anthropic.MessagesContentBlock{},
 			},
 		},
+		{
+			// Regression: negative index used to slip through the delta / stop branches
+			// (idx < len(response.Content) is true for negatives in Go) and panic on the
+			// slice access. Now guarded by isValidContentBlockIndex.
+			name: "negative delta and stop indices after a valid start do not panic",
+			chunks: []*anthropic.MessagesStreamChunk{
+				{
+					MessageStart: &anthropic.MessagesStreamChunkMessageStart{
+						ID: "msg_neg2", Model: "claude-3", Role: "assistant",
+						Usage: &anthropic.Usage{InputTokens: 1},
+					},
+				},
+				{
+					ContentBlockStart: &anthropic.MessagesStreamChunkContentBlockStart{
+						Index:        0,
+						ContentBlock: anthropic.MessagesContentBlock{Text: &anthropic.TextBlock{Type: "text"}},
+					},
+				},
+				{
+					ContentBlockDelta: &anthropic.MessagesStreamChunkContentBlockDelta{
+						Index: -5,
+						Delta: anthropic.ContentBlockDelta{Type: "text_delta", Text: "malicious"},
+					},
+				},
+				{
+					ContentBlockStop: &anthropic.MessagesStreamChunkContentBlockStop{Index: -1},
+				},
+			},
+			want: &anthropic.MessagesResponse{
+				ID: "msg_neg2", Model: "claude-3", Role: "assistant",
+				Usage: &anthropic.Usage{InputTokens: 1},
+				Content: []anthropic.MessagesContentBlock{
+					{Text: &anthropic.TextBlock{Type: "text", Text: ""}},
+				},
+			},
+		},
 		{
 			name: "content block index at cap is ignored",
 			chunks: []*anthropic.MessagesStreamChunk{