fix(core): safely recover malformed tool input

[kitlangton]

What

Recover safely when a model emits malformed JSON for a local tool call.

The malformed call is recorded as failed and executed: false, valid siblings settle normally, the originating Step remains truthfully failed, and V2 may issue one new logical repair Step from freshly projected history. Raw malformed input remains diagnostic-only; the model receives a protocol-valid {} call paired with a concise error asking it to retry with valid JSON.

Before / After

Before: Native protocol adapters failed the provider stream while finalizing malformed local arguments, which could discard valid parallel calls. The generic AI SDK adapter instead converted invalid JSON into a string input that could reach local tool dispatch. Neither path provided a safe, bounded semantic continuation.

After: Adapters emit a non-executable tool-input-error only for malformed local calls. Core durably closes that call, waits for valid siblings, records the failed Step and its snapshot metadata, then reloads history for at most one corrective model request. Interruptions, later provider failures, infrastructure failures, and malformed provider-executed calls remain terminal.

How

• packages/ai: ToolStream finalizes parallel calls independently and emits diagnostic tool-input-error events for malformed local input. OpenAI Responses and Bedrock preserve the correct tool-calls finish classification; malformed hosted Anthropic input still fails terminally.
• packages/core/src/aisdk.ts: the generic AI SDK route now uses the same typed JSON parser instead of treating malformed JSON as executable string input.
• packages/core/src/session/runner: the publisher records a failed, unexecuted tool with safe model feedback. The runner waits for siblings, preserves terminal error precedence, and permits one monotonic repair continuation.
• packages/schema and the message projector: failed Steps retain end snapshots and changed-file paths, so successful file-changing siblings remain revertible.
• Failed assistant history retains provider continuation metadata only for truthfully settled hosted siblings; partial or interrupted hosted state remains suppressed.

Scope

• Malformed provider-executed calls are not repaired; they remain terminal.
• Generic provider errors and interruptions do not trigger repair.
• The repair budget is process-local and fixed at one new logical Step.
• This is V2-only and does not modify packages/opencode.
• This is an alternative to fix(core): recover malformed tool input #37669. It intentionally does not expose raw malformed arguments to the model and does not allow four repair retries.

Testing

• cd packages/ai && bun run test: 343 passed, 29 skipped.
• cd packages/core && bun run test test/session-runner.test.ts test/session-runner-message.test.ts test/session-runner-tool-events.test.ts test/aisdk.test.ts: 167 passed.
• bun turbo typecheck --concurrency=3: 32 tasks passed across the 39-package scope.
• Targeted oxlint: 0 errors; existing warnings remain.
• git diff --check: passed.
• Full Core suite: 1,345 passed, 6 skipped. Three unrelated local-environment/timing failures remained: a webfetch timeout, an extra configured execute tool, and user-level cmux plugins appearing in an isolation assertion.

Flow

sequenceDiagram
  participant Provider
  participant Adapter
  participant Runner
  participant Tools
  participant Store
  participant Model

  Provider->>Adapter: malformed local arguments + valid siblings
  Adapter-->>Runner: tool-input-error (raw diagnostic only)
  Adapter-->>Runner: valid tool-call events
  Runner->>Tools: execute valid local siblings
  Tools-->>Runner: settle success or failure
  Runner->>Store: failed tool (executed=false)
  Runner->>Store: failed Step + snapshot/files
  Runner->>Model: new Step with {} call + safe error
  Note over Runner,Model: At most one repair continuation

Loading