fix: bring Claude Code tool-call flow back to Anthropic-equivalent behaviour

[aict666]

Summary

Three independent regressions were stacking on top of each other and collectively prevented Opus-class clients (Claude Code v2.1.x in particular) from completing tool-emulated turns through the proxy. Bundled into one PR because they all surface as the same user-visible symptom ("Opus refuses to call tools / wastes 3 turns on broken paths") and the regression tests for each one only make sense in the presence of the others.

Reproducer: send 检查一下，所有分支里。有没有按照 压缩包的方案 处理过一版 from Claude Code v2.1.114 (Opus 4.7) routed through the proxy. Before this patch Opus replies with The user's message appears to contain a pasted system prompt for a different agent (Claude Code) along with what looks like a stray tool error result. After this patch Opus calls pwd then git branch -a directly.

1. Tool preamble was shaped like a Claude Code system prompt

buildToolPreamble emitted ~1600 chars of ### ToolName / parameters schema: / \``json {…}```blocks prepended to the user turn. That is the exact signature of Claude Code's own system prompt, so when the same shape appeared in a **user** slot Opus 4.7 reliably flagged it as"a pasted Claude Code system prompt in the user turn"and refused to emit any<tool_call>` blocks.

Fix: rewrite the user-message fallback to a single ~330-char line — protocol description plus tool name list, no schemas. Full schemas still go through the authoritative proto-level tool_calling_section override (buildToolPreambleForProto, unchanged). #22 NO_TOOL-mode models that ignore SectionOverride still see the tool names and the emission protocol, so the fallback continues to do its job.

New regression asserts the preamble:

• has no ^### headers, no parameters schema:, no fenced ```json blocks
• stays under 512 chars even with many tools
• still names every tool and still describes the <tool_call> protocol

2. Redaction marker kept getting reused by the model as a real path

Every prose-shaped REDACTED_PATH marker we have ever shipped has regressed:

Marker	Failure mode
./tail	LLM Reads ./src/main.py → ENOENT → loop
[internal]	LLM runs ls [internal] → ENOENT → loop
<redacted-path>	LLM passes to Read/Bash → ENOENT (Linux) / Errno 22 (Windows) → loop
(internal path redacted)	zsh parses cd (…) as glob-qualifier syntax → cryptic unknown file attribute: i → Opus gets confused, stops calling tools
redacted internal path	Opus echoes verbatim into bash: cd redacted internal path && git… → cd: too many arguments → wastes 2-3 turns before finally calling pwd

Common cause: any marker that contains ASCII word characters reads as a plausible path or identifier to the model, and the model puts it back into the next tool_call.

Fix: switch REDACTED_PATH to a single Unicode ellipsis (U+2026, …).

• Zero ASCII word chars
• No shell metacharacter
• Three UTF-8 bytes
• Universally read by humans and LLMs as "content omitted"
• Essentially no training data of cd … or Read("…") as a real operation, so the reuse-as-path loop never starts
• If the model still echoes it into shell, the failure mode is a single clean ENOENT instead of a cryptic glob-qualifier error

The new marker-shape regression suite makes future regressions impossible by asserting:

1. No shell metacharacters in ()[]{}<>|&;$`\"'\\*?
2. No / and no \\
3. Zero ASCII word characters [A-Za-z0-9_] — closes the door on every prose-shaped marker we have already regressed through.

3. neutralizeCascadeIdentity missed common Cascade-isms

Existing patterns covered I am Cascade / I'm Cascade / developed by Codeium but missed other common third-person leaks the upstream planner produces. Added:

• Cascade is an? (?:AI )?(?:coding )?assistant
• (?:As|Acting as) Cascade
• (?:Codeium|Windsurf)('s)? Cascade
• built by (?:Codeium|Windsurf)
• (?:the )?Cascade('s)? workspace → the workspace
  (the leading article is consumed by the same regex so we never produce the the the workspace double-article artefact)

Exported neutralizeCascadeIdentity from chat.js (matches the existing shouldUseCascadeReuse export pattern) and added 7 unit tests covering first-person, third-person, provider attribution, workspace narration, the dictionary-word negative case (a cascade of rocks), unknown-provider passthrough, and falsy inputs.

Tests

npm test — 80/80 pass (72 existing + 7 identity + 1 marker-shape).

Risk

Low. All three changes are purely cosmetic on the wire — the protocol contract, parser, streaming pipeline, tool-result round-trip, and proto-level injection are untouched. Behaviour change is strictly less aggressive: the preamble is gentler, the marker is shorter, the identity rewrites are more thorough. No new dependencies, no API changes.