Bug: duplicate provider tool-call index silently merges two calls into one — the harness executes a different tool than the model called

[FermiHart]

Package: @deepseek-ai/dsh-llm-deepseek (src/translate.ts)
Severity: high · Confidence: high — mechanically proven against the real parser with synthetic provider bytes

Problem

Streaming tool-call deltas are keyed solely by the provider-sent index, with no duplicate detection, no id-change alarm, and no name-stability check:

let block = toolBlocks.get(call.index)
if (!block) { block = open('tool-call'); toolBlocks.set(call.index, block); ... }
if (call.id !== undefined) block.callId = call.id      // last-wins overwrite
if (call.function?.name !== undefined) block.name = call.function.name
block.text += fragment                                  // args concatenated blindly

Two logical calls sharing a wire index merge into ONE block: fragments concatenate, and the last fragment's id/name win. The other call vanishes entirely.

Proven outcome

Feeding two interleaved calls both at index: 0 — read_file({"path":"/etc/pa… then …sswd"}}) under name delete_file, id call_BBB — produces exactly one assembled call:

{"type":"tool-call","id":"call_BBB","name":"delete_file","arguments":"{\"path\":\"/etc/passwd\"}"}

Valid JSON pointing at /etc/passwd. The harness executes delete_file("/etc/passwd"); nothing the model called survives. Control cases (distinct indices, out-of-order arrival) assemble correctly, isolating the defect to index collision.

Trigger

Any buggy OpenAI-compatible gateway on the supported custom baseURL that reuses indices (a historically recurring bug class), or a hostile gateway. The harness is the confused deputy that turns a gateway bug into wrong-tool execution with attacker-shaped arguments.

Fix direction

At the JSON.parse boundary: reject or split on index reuse once a block has an id/name (id change ⇒ new logical call or hard error), require non-empty stable identity, and fail loud instead of concatenating.

[weijiafu14]

Confirmation from a second, independent harness: this defect is not specific to llm-deepseek — pi-ai's openai-completions accumulator drops the second call the same way.

We added your shape to our wire-conformance battery (fault injection into the unmodified pi-ai client/parser/accumulator): two complete tool calls arriving under the same index, each with its own non-empty id/name/arguments — only the first survives; the second vanishes silently with stopReason: "toolUse" and no diagnostic. Reproduced on 0.84.1 and latest 0.84.4 (case duplicateIndex: harness / 0.84.4 results).

Filed upstream with a proposed fix (a delta whose non-empty id differs from the block's should open a NEW block — id takes precedence over index for identity) citing this thread: earendil-works/pi#8861.

So both accumulators in the ecosystem currently lose data on index reuse, in the same direction — worth fixing with the same id-over-index rule on both sides, and your mechanical proof plus ours make a matched pair of regression fixtures.