BlockAssembler fuses parallel tool calls when provider reuses stream index

[jdgg777]

Reporting a bug here per the README pointer to Discussions (issues are disabled on this repo).

Summary

Providers behind OpenAI-compatible proxies may emit multiple logical tool
calls under the same tool_calls[].index, distinguishing calls only by
id. BlockAssembler.push() accumulates tool-call-deltas strictly by
index and concatenates their argument fragments, producing a single block
whose arguments are concatenated JSON objects:

{"file_path":"/docs/a.md"}{"file_path":"/docs/b.md"}

The agent loop's parseArguments() preserves this as a raw string, schema
validation rejects it, and the turn burns a round-trip on an error result.
Separately, the web api-proxy's viewFor calls JSON.parse(raw) un-guarded
and logs one error per event ("presenter failed for tool/call, falling back
to generic"), including on every history page render of affected sessions.

A related but unfixable-client-side sibling: some proxies send
finish_reason: "stop" on max-token-truncated streams, bypassing the
assembler's documented max-tokens tool-call drop; truncated arguments then
dispatch and fail validation.

Status: still present in the latest published release. Verified
2026-08-24 by downloading the @deepseek-ai/dsh-llm@0.0.1-rc.1 tarball from
the npm registry: the vulnerable this.ensure(chunk.index, "tool-call")
accumulation is present and no id-based split exists. Upgrading
@deepseek-ai/dsh (latest dist-tag 0.1.1-rc.2) does not resolve this.

Reproduction

Feed the assembler two same-index deltas with different ids:

const a = new BlockAssembler();
a.push({ type: "block-start", index: 1, blockType: "tool-call" });
a.push({ type: "tool-call-delta", index: 1, id: "fc_A", name: "read", argumentsDelta: '{"file_path":"x"}' });
a.push({ type: "tool-call-delta", index: 1, id: "fc_B", name: "read", argumentsDelta: '{"file_path":"y"}' });
a.blocks(); // → 1 block, arguments = '{"file_path":"x"}{"file_path":"y"}'

Observed in production session logs (DeepSeek-hosted proxy models); full
trace available on request.

Suggested fix

In BlockAssembler.push(), case "tool-call-delta": when the existing
partial at chunk.index is an open tool-call whose recorded toolCallId
differs from chunk.id (both defined, non-empty), re-key onto a fresh index
(max(order)+1) before accumulating. Open blocks assemble from accumulated
deltas, so both calls complete correctly in stream order.

Defensive companion for the presentation path (viewFor): attempt strict
parse; on failure, extract the first balanced JSON object and parse that;
if still unsalvageable, return no view (generic card) without logging per
event.

Both changes verified against captured production streams; happy to share
the regression suite (8 cases incl. id-less continuation deltas, which must
NOT split).

Environment

• Repo: https://github.com/deepseek-ai/deepseek-harness (file under
  https://github.com/deepseek-ai/deepseek-harness/issues)
• @deepseek-ai/dsh@0.1.0-rc.8, Linux, node v24; vulnerable code confirmed
  identical in @deepseek-ai/dsh-llm@0.0.1-rc.1 (latest)
• Models routed through OpenAI-compatible proxy endpoints (stealth tiers);
  native DeepSeek official endpoints were not observed fusing.

[argszero]

Verified against rc.2 (HEAD b150a55) — your reproduction is line-exact, and this is a genuinely new mechanism for the tool-identity family (it is not covered by the null/empty-id blueprint in #4365/#4370 — more below). Two additions from the source, one of which sharpens your fix.

1. The fusion is worse than argument concatenation: id is last-writer-wins

BlockAssembler.push case 'tool-call-delta' (packages/llm/llm/src/assembler.ts:68-75):

const partial = this.ensure(chunk.index, 'tool-call')   // :69 keyed by index only
if (partial.block) return
partial.toolCallId = chunk.id                            // :71 OVERWRITES, not guards
if (chunk.name) partial.toolCallName = chunk.name
partial.toolCallArguments += chunk.argumentsDelta        // :73 concatenates

So the fused block carries the last delta's id (fc_B) with both calls' argument fragments. The error result the model sees is doubly wrong: fc_B's args are the concatenation, and fc_A's contribution is unreachable under any id. Your re-key-on-id-change fix is therefore correct on both axes — it preserves per-call ids and per-call args.

2. It's a sibling mechanism, not another instance of the null/"" family

The identity-loss family (#4365/#4370 and the 4-layer blueprint: translate truthy guards, assembler.ts:70 id guard, assemble() backfill, closeBlock source-side fallback) is about null/empty overwrites. This is different: two valid, distinct ids sharing one index — the assembler's index-keyed accumulation (ensure(index, ...) at :51/:63/:69/:77) assumes index == call identity, which holds for the OpenAI contract but breaks under proxies that distinguish calls only by id. The family blueprint does not close this; your re-key is the missing layer. The partial.toolCallId = chunk.id overwrite at :71 is also why the family's L2 guard (a truthy check) would not have caught it — the id is present on every delta, just different.

3. viewFor is guarded — the real cost is per-event console spam, not delivery

The presentation path (packages/host/apiproxy/src/api-proxy.ts:696-719) wraps JSON.parse(raw) in try/catch and soft-falls correctly — the author's "un-guarded" is slightly overstated; the failure you saw is the console.error at :718 firing once per event per render of affected history pages. Since legacy sessions are already poisoned, a viewFor-side salvage (your "first balanced JSON object" idea) is a reasonable read-path defense, but the durable fix is the assembler re-key so no new poisoned events are written.

4. The finish_reason sibling deserves its own line

Your "some proxies send finish_reason: 'stop' on max-token-truncated streams" point verified: assembled() drops tool-calls only when finish.kind === 'max-tokens' (assembler.ts:136-138). The drop is keyed on a provider-attested signal with no content validation — a "stop"-lying proxy lets truncated arguments dispatch and fail validation. A provider-independent guard would validate at the assembler output: before dispatch, each tool-call's arguments must parse as JSON; unparseable (or truncated) ones drop alongside the max-tokens path. That closes the masking regardless of what finish_reason claims — same shape as the "provider-attested signal trusted blindly" pattern in the sticky turn-end family (#3685/#4048).

5. Regression acceptance

Your 8-case suite is the right shape; the discriminating rows are: same-index different valid ids → split (your fix), same-index id-less continuation delta → must NOT split (the family's delta-continuation contract), and same-index same id → no split (normal multi-fragment call). Worth adding: a block-end-terminated first call followed by a same-index delta for a second id — the re-key must not resurrect a closed index (:64/:70/:80 ignore stragglers on closed partials).

Good find — this is a real gap between the wire contract and the proxy reality.