fix(tools): make native /v1/messages tool calling work by moving off Qwen's intercepted <tool_call> delimiter

[maxff77]

Problem

Native /v1/messages tool calling on qwen3.x-max-thinking was effectively broken: a Claude Code session against this gateway would die with 上游返回了残缺、非法或不存在的工具调用, and the model would narrate "tool infrastructure failure" instead of calling. Root cause (measured, not guessed): Qwen's serving platform runs its own server-side agent loop. When the model emits the native <tool_call> tag, the platform intercepts it, looks the name up in ITS registry (which has none of the client's tools), and injects Tool <name> does not exists back into the model's generation context. Verified: a session death correlated second-by-second with 5 role:function interceptions named Bash/Read; auto_search:false does not disable the interceptor.

Fix

Take the platform interceptor out of the loop by moving the tool-call wire format off Qwen's native delimiter:

• Canonical wire format is now [TOOL CALL] / [END TOOL CALL], defined once in agent-turn.js so the system prompt, folded history and every retry hint teach the same shape. The platform no longer consumes the marker as a call, so no does not exists injection.
• The legacy <tool_call> angle form stays recognized on read (RL-habit emissions) but is never taught or written.
• Trigger-gated payload recovery (from the earlier work on this branch): the delimiter is a length-bounded trigger; the call is recovered from the JSON payload in a 128-char window behind it, with the tool name taken only from the payload's name key and the trigger required to be the first non-whitespace content — this narrows the injection surface a free-text scan would open.
• Result bodies neutralise both marker forms (case-insensitive) so untrusted tool output cannot fire the trigger.
• Defect A: Qwen's own role:function registry deltas are dropped from the client stream and logged, instead of being delivered as the assistant's answer.

The tool-prompt module is shared with /v1/chat/completions, so the change applies to both surfaces; the OpenAI path was re-verified after the swap.

Verification

• Unit suite 160/160 (node --test tests/*.test.js); key guards mutation-checked (trigger regex, neutraliser case-flag, canonical constant, markdown-link suppression, bare/decorated bracket closers).
• Live on a staging container built from this branch:
  • /v1/messages tool calling: 18/18 single + multi-turn probes, 0 does not exists in output, 0 unrecovered markers.
  • /v1/chat/completions (OpenAI format): 6/6 single, 5/6 multi requiring a fresh 2nd tool call (the one miss is the model answering early, not a format break).

Notes

• Three adversarial review passes ran against the diff; one live bug (a /g vs /gi case mismatch in the result-body neutraliser that let an uppercase <TOOL_CALL> execute) was caught and fixed here, plus coverage and false-positive gaps. Residuals with no corpus evidence (fused [TOOLCALL], full-width bracket closers, [Tool calls] heading edge case) are deliberately left unhandled.
• The 128-char window and recovery-% tolerances were measured on the angle-tag corpus and are inherited (documented in-code) — unvalidated for the bracket form, which the model is instructed to write cleanly.

[maxff77]

Pushed 13 more commits hardening the tool-call protocol end to end, all verified live against Claude Code sessions:

Interception recovery (270d6a6, 3d6c4df): when the Qwen platform eats a native <tool_call> emission server-side (injecting "Tool X does not exists" into the model's context), the gateway now detects the dropped role:function deltas and retries once with a hint to re-emit in the bracket format — instead of delivering a dead narration turn. Covers both Anthropic loops and the OpenAI agent runtime, with a shared one-shot cap.

Opener-less salvage (d201273, 6d3fdab): models under long tool-heavy sessions sometimes emit the payload WITHOUT the opening marker (bare {"name":…,"arguments":…} + [END TOOL CALL], observed live) — previously leaking verbatim as visible text. The parser now recognizes that shape as a synthetic opener and converts it into the intended tool call, behind six fail-closed gates (answer-start position, both keys, balanced JSON, declared tool name, mandatory adjacent closer, outside code fences). Untrusted tool-result content cannot arm it (closer markers are already disarmed at fold time — now pinned by a regression test). Everything the gates reject stays prose and falls back to the retry path.

CI + ESLint (c82b637…bb910d6): GitHub Actions gate (tests + lint on every push/PR) and an ESLint 10 flat config, correctness-only rules, zero-behavior-change cleanup.

Suite: 228 tests green, lint clean. The salvage went through an adversarial review cycle (13 findings patched, each pinned by a mutation-verified test).

[maxff77]

Pushed 2 more commits (48fa51b, 7066233) — a third live failure class, found and fixed:

Think-phase tool-call leak. In long agent sessions the model sometimes emits its entire bracket tool call inside the think phase. The Anthropic loops streamed think content verbatim (no parsing at all), so the call reached the client as a thinking block, never executed, and the model then narrated success — a hallucinated tool run. The OpenAI loop already defended this surface; the Anthropic stream + non-stream loops now match it:

• Per-attempt think text is parsed at attempt end with the shared parser. A standalone pure call (nothing else in the think text, zero parse errors, name in the declared tool set) is promoted to a real tool_use — same guards as the OpenAI loop, plus two stricter conjuncts (fail-closed on an empty tool whitelist; zero answer-side tool errors), plus terminal-finish discipline (never promote from content_filter/refusal/length turns).
• Anything else that parsed as a call or produced parse errors becomes a one-shot thought_tool_call retry (shared protocol-recovery budget with the existing intercepted/malformed_protocol reasons) with a canonical hint telling the model its call sat in unreachable reasoning.
• Non-stream responses strip the leaked protocol from the delivered thinking block on promotion.

Control-char JSON repair. Second verified failure class: payloads with raw newlines/tabs inside JSON string literals (Bad control character in string literal) died as invalid_json. buildToolCallPayload now runs a strict-parse-first repair (escape raw C0 inside string literals only) — valid JSON is untouched by construction, and unrepairable payloads keep the original strict-parse error.

Observability. Five logger.warning?.() calls were silent no-ops (the logger only exposes warn) — converted; the previously-silent give-up breaks (attempt exhaustion, tool_error after visible prose) now log; JSON.parse messages are sanitized before logging (V8 embeds payload fragments in e.message).

Hardened by a 4-layer adversarial review: 13 findings patched in 7066233, 12 of them pinned by mutation tests (guard deletion / priority swap / cap removal each verified red before restore). Suite: 272 tests green.

[maxff77]

salvage-3 — prose-adjacent tool-call leak recovery (5 commits, 7066233..6c27347)

A fourth leak class: the model emits its tool call as [TOOL_CALL]Bash{command:find …", "…"}} — the name sits outside the JSON and an unquoted key/value breaks quote parity, so extractBalancedObject never closes → truncated_tool_call, the raw span reaches the client, the call never runs. Hit 3× in 9 minutes on a live tool-heavy session.

Three fail-closed layers (each behind a triple gate: non-empty allowlist + strict JSON.parse + input_schema key/required validation):

1. Deterministic quote repair (repairLooseToolPayload) — quotes bare keys, opens bare string values reusing the next existing " as closer (never guesses where a value ends), backslashes/C0 chars JSON-escaped so bytes round-trip; tool name recovered from the bracket-trigger tail. Valid JSON is a fixed point.
2. Text-suppressed retry (loop B) — a tool_error after prose consumes the existing single compensation slot with a retry that forwards only tool_use blocks; its text/thinking never reach the wire.
3. Residue-free delivery — both parse paths record condemned spans in one ledger; delivery strips exactly those (positional, fence-immune), never a second search. Emptiness for the 502 decision is judged on stripped text (a residue-only turn 502s invalid_tool_call_error, never an empty content array); orphan bracket closers join the ledger so a lone [END TOOL CALL] is stripped/502'd, while prose + a stray closer delivers the prose.

The security boundary this cycle fixed: salvage now honors the parser's emittedProse position gate exactly like a canonical call — a malformed span after visible prose is suppressed, not executed. Earlier it inverted the anti-injection doctrine (malformed was more executable than well-formed). The real incident span is first-content, so recovery is unaffected.

Process: 2 adversarial review loops (3 independent reviewers), ~23 findings triaged, every behavioral fix mutation-pinned. 325/325 tests (51 salvage). Deployed to the staging container and validated live: both loops return tool_use (non-stream stop_reason: tool_use; stream emits thinking → tool_use → stop_reason: tool_use). Loop A / chat.js untouched (they pass no schemas → salvage fail-closed off).