diff --git a/scripts/stryker-diff.mjs b/scripts/stryker-diff.mjs
index 2d6adddfa2..2490312268 100644
--- a/scripts/stryker-diff.mjs
+++ b/scripts/stryker-diff.mjs
@@ -254,9 +254,19 @@ function git(repoRoot, args) {
 	return execFileSync("git", args, { cwd: repoRoot, encoding: "utf8", maxBuffer: 20 * 1024 * 1024 })
 }
 
+// GitHub checks out the synthetic pull request merge commit, but `pull_request.base.sha` is frozen at
+// event-creation time. When main advances afterwards, that stale base attributes unrelated upstream
+// lines to the pull request. The merge commit's first parent is the base actually merged into.
+export function resolvePullRequestBase(repoRoot, baseSha, headSha) {
+	const parents = git(repoRoot, ["rev-list", "--parents", "-n", "1", headSha]).trim().split(/\s+/).slice(1)
+	if (parents.length < 2) return baseSha
+	return parents[0]
+}
+
 export function selectFromGit(repoRoot, baseSha, headSha) {
 	validateSha(baseSha, "base SHA")
 	validateSha(headSha, "head SHA")
+	baseSha = resolvePullRequestBase(repoRoot, baseSha, headSha)
 	const mergeBase = git(repoRoot, ["merge-base", baseSha, headSha]).trim()
 	const nameStatus = git(repoRoot, ["diff", "--name-status", "-z", "--find-renames", `${mergeBase}...${headSha}`])
 	const entries = parseNameStatus(nameStatus)
diff --git a/scripts/stryker-diff.test.mjs b/scripts/stryker-diff.test.mjs
index 931840606f..25f49e794d 100644
--- a/scripts/stryker-diff.test.mjs
+++ b/scripts/stryker-diff.test.mjs
@@ -56,6 +56,86 @@ describe("mutation testing workflow", () => {
 	})
 })
 
+function createSyntheticPullRequestRepository() {
+	const repository = fs.mkdtempSync(path.join(os.tmpdir(), "stryker-diff-revision-"))
+	const run = (...args) => execFileSync("git", args, { cwd: repository, encoding: "utf8" }).trim()
+	const write = (filePath, contents) => {
+		fs.mkdirSync(path.join(repository, path.dirname(filePath)), { recursive: true })
+		fs.writeFileSync(path.join(repository, filePath), contents)
+	}
+
+	run("init", "--quiet", "--initial-branch", "main")
+	run("config", "user.email", "gate@example.com")
+	run("config", "user.name", "Gate")
+	run("config", "commit.gpgsign", "false")
+
+	write("packages/core/src/unrelated.ts", "export const unrelated = () => 1\n")
+	write("packages/core/src/feature.ts", "export const feature = () => 1\n")
+	run("add", ".")
+	run("commit", "--quiet", "-m", "initial")
+	const eventBaseSha = run("rev-parse", "HEAD")
+
+	run("checkout", "--quiet", "-b", "pull-request")
+	write("packages/core/src/feature.ts", "export const feature = () => 2\n")
+	run("add", ".")
+	run("commit", "--quiet", "-m", "pull request change")
+
+	// The upstream change lands after the pull_request event recorded its base SHA, which is what
+	// made the stale event base attribute unrelated main-only lines to the pull request.
+	run("checkout", "--quiet", "main")
+	write("packages/core/src/unrelated.ts", "export const unrelated = () => 99\n")
+	run("add", ".")
+	run("commit", "--quiet", "-m", "unrelated upstream change")
+	const upstreamSha = run("rev-parse", "HEAD")
+
+	run("merge", "--quiet", "--no-ff", "-m", "merge pull request", "pull-request")
+	const mergeSha = run("rev-parse", "HEAD")
+
+	return { repository, eventBaseSha, upstreamSha, mergeSha }
+}
+
+describe("pull request revision selection", () => {
+	it("excludes unrelated upstream files by diffing from the merge commit's first parent", () => {
+		const { repository, eventBaseSha, upstreamSha, mergeSha } = createSyntheticPullRequestRepository()
+
+		// A failed assertion must still remove the temporary repository, or a failing run leaks it.
+		try {
+			const manifest = selectFromGit(repository, eventBaseSha, mergeSha)
+			const changedPaths = manifest.packages.flatMap((entry) => entry.files.map((file) => file.path))
+
+			assert.deepEqual(changedPaths, ["packages/core/src/feature.ts"])
+			assert.equal(manifest.baseSha, upstreamSha)
+			assert.equal(manifest.mergeBase, upstreamSha)
+
+			// Selectors must stay aligned with the checked-out head content.
+			assert.equal(manifest.headSha, mergeSha)
+			assert.deepEqual(
+				manifest.packages.flatMap((entry) => entry.selectors),
+				["src/feature.ts:1-1"],
+			)
+		} finally {
+			fs.rmSync(repository, { recursive: true, force: true })
+		}
+	})
+
+	it("keeps the supplied base for non-merge heads such as manual runs", () => {
+		const { repository, eventBaseSha, upstreamSha } = createSyntheticPullRequestRepository()
+
+		try {
+			const manifest = selectFromGit(repository, eventBaseSha, upstreamSha)
+
+			assert.equal(manifest.baseSha, eventBaseSha)
+			assert.equal(manifest.mergeBase, eventBaseSha)
+			assert.deepEqual(
+				manifest.packages.flatMap((entry) => entry.files.map((file) => file.path)),
+				["packages/core/src/unrelated.ts"],
+			)
+		} finally {
+			fs.rmSync(repository, { recursive: true, force: true })
+		}
+	})
+})
+
 describe("parseNameStatus", () => {
 	it("parses added, modified, and renamed paths", () => {
 		assert.deepEqual(
@@ -249,7 +329,6 @@ describe("shouldUseVitestRelated", () => {
 	})
 })
 
-
 describe("related-test discovery", () => {
 	it("keeps Stryker's temp directory relative to each run root", () => {
 		assert.equal(resolveStrykerTempDir("/repo", "/repo"), ".stryker-tmp")
diff --git a/src/api/providers/__tests__/vscode-lm.spec.ts b/src/api/providers/__tests__/vscode-lm.spec.ts
index 423f119f14..0dc770a389 100644
--- a/src/api/providers/__tests__/vscode-lm.spec.ts
+++ b/src/api/providers/__tests__/vscode-lm.spec.ts
@@ -16,6 +16,14 @@ vi.mock("vscode", () => {
 		) {}
 	}
 
+	class MockLanguageModelToolResultPart {
+		type = "tool_result"
+		constructor(
+			public callId: string,
+			public content: unknown[],
+		) {}
+	}
+
 	return {
 		workspace: {
 			getConfiguration: vi.fn(() => ({
@@ -53,6 +61,7 @@ vi.mock("vscode", () => {
 		},
 		LanguageModelTextPart: MockLanguageModelTextPart,
 		LanguageModelToolCallPart: MockLanguageModelToolCallPart,
+		LanguageModelToolResultPart: MockLanguageModelToolResultPart,
 		lm: {
 			selectChatModels: vi.fn(),
 		},
@@ -60,12 +69,19 @@ vi.mock("vscode", () => {
 })
 
 import * as vscode from "vscode"
-import { VsCodeLmHandler } from "../vscode-lm"
+import {
+	VsCodeLmHandler,
+	extractLeakedToolCalls,
+	trailingPartialToolMarkerLength,
+	middleOutTruncate,
+	truncateToolResultsToFitWindow,
+} from "../vscode-lm"
 import type { ApiHandlerOptions } from "../../../shared/api"
 import type { Anthropic } from "@anthropic-ai/sdk"
 import { openAiModelInfoSaneDefaults, vscodeLlmDefaultModelId, vscodeLlmModels } from "@roo-code/types"
 
 import { clearAllMocks } from "../../../test-utils/reset"
+import { collectStream } from "../../../test-utils/stream"
 
 const mockLanguageModelChat = {
 	id: "test-model",
@@ -272,6 +288,407 @@ describe("VsCodeLmHandler", () => {
 			})
 		})
 
+		it("still trims oversized tool_results when the system prompt consumes most of the budget", async () => {
+			// A system prompt large enough to drive the raw budget negative; the clamp keeps trimming
+			// active for the case where the request is most oversized.
+			const systemPrompt = "S".repeat(handler.getCondenseContextWindow() * 3)
+			const messages: Anthropic.Messages.MessageParam[] = [
+				{
+					role: "user",
+					content: [{ type: "text", text: "hi" }],
+				},
+				{
+					role: "assistant",
+					content: [{ type: "tool_use", id: "t1", name: "some_tool", input: { a: 1 } }],
+				},
+				{
+					role: "user",
+					content: [{ type: "tool_result", tool_use_id: "t1", content: "X".repeat(50_000) }],
+				},
+			]
+
+			// No sendRequest response is queued: the request must be refused before it is sent, and a
+			// queued-but-unconsumed response would leak into later tests.
+			// The clamped floor cannot be met once the tool_result bottoms out at its minimum, so the
+			// request must be refused rather than sent over-window (which orphans the tool_result).
+			const stream = handler.createMessage(systemPrompt, messages, { taskId: "test-task" })
+			await expect(
+				(async () => {
+					for await (const _chunk of stream) {
+						// drain
+					}
+				})(),
+			).rejects.toThrow(/too large for this model's context window/)
+			expect(mockLanguageModelChat.sendRequest).not.toHaveBeenCalled()
+		})
+
+		it("refuses a request that exceeds a small positive raw budget below the trimming floor", async () => {
+			// The clamp to MIN_TOOL_RESULT_CHARS only keeps trimming productive; admission must still
+			// respect the raw budget, otherwise a conversation between the raw budget and the floor is
+			// sent over-window. Sized so the remaining content exceeds the raw budget but stays under
+			// the floor, and so no tool_result is large enough for trimming to shrink anything.
+			const targetRawBudgetChars = 1000
+			const systemPrompt = "S".repeat(
+				Math.floor(handler.getCondenseContextWindow() * 0.8 * 3) - targetRawBudgetChars,
+			)
+			const messages: Anthropic.Messages.MessageParam[] = [
+				{
+					role: "assistant",
+					content: [{ type: "tool_use", id: "t1", name: "some_tool", input: { a: 1 } }],
+				},
+				{
+					role: "user",
+					content: [{ type: "tool_result", tool_use_id: "t1", content: "X".repeat(1500) }],
+				},
+			]
+
+			// No sendRequest response is queued: refusal must happen before the request is sent.
+			const stream = handler.createMessage(systemPrompt, messages, { taskId: "test-task" })
+			await expect(
+				(async () => {
+					for await (const _chunk of stream) {
+						// drain
+					}
+				})(),
+			).rejects.toThrow(/too large for this model's context window/)
+			expect(mockLanguageModelChat.sendRequest).not.toHaveBeenCalled()
+		})
+
+		it("sends a request that fits within a small positive raw budget", async () => {
+			const targetRawBudgetChars = 1000
+			const systemPrompt = "S".repeat(
+				Math.floor(handler.getCondenseContextWindow() * 0.8 * 3) - targetRawBudgetChars,
+			)
+			const messages: Anthropic.Messages.MessageParam[] = [
+				{
+					role: "user",
+					content: [{ type: "text", text: "Y".repeat(500) }],
+				},
+			]
+
+			mockLanguageModelChat.sendRequest.mockResolvedValueOnce({
+				stream: (async function* () {
+					yield new vscode.LanguageModelTextPart("ok")
+					return
+				})(),
+				text: (async function* () {
+					yield "ok"
+					return
+				})(),
+			})
+
+			const stream = handler.createMessage(systemPrompt, messages, { taskId: "test-task" })
+			const chunks = await collectStream(stream)
+
+			expect(mockLanguageModelChat.sendRequest).toHaveBeenCalled()
+			expect(chunks).toContainEqual({ type: "text", text: "ok" })
+		})
+
+		it("sends the request when trimming brings the conversation back under budget", async () => {
+			const messages: Anthropic.Messages.MessageParam[] = [
+				{
+					role: "assistant",
+					content: [{ type: "tool_use", id: "t1", name: "some_tool", input: { a: 1 } }],
+				},
+				{
+					role: "user",
+					content: [{ type: "tool_result", tool_use_id: "t1", content: "X".repeat(500_000) }],
+				},
+			]
+
+			mockLanguageModelChat.sendRequest.mockResolvedValueOnce({
+				stream: (async function* () {
+					yield new vscode.LanguageModelTextPart("ok")
+					return
+				})(),
+				text: (async function* () {
+					yield "ok"
+					return
+				})(),
+			})
+
+			const stream = handler.createMessage("system", messages, { taskId: "test-task" })
+			for await (const _chunk of stream) {
+				// drain
+			}
+
+			const sent = JSON.stringify(mockLanguageModelChat.sendRequest.mock.calls[0][0])
+			expect(sent).toContain("characters truncated")
+			expect(sent).not.toContain("X".repeat(400_000))
+		})
+
+		describe("leaked tool-call recovery during streaming", () => {
+			const salvageTools = [
+				{
+					type: "function" as const,
+					function: {
+						name: "calculator",
+						description: "A simple calculator",
+						parameters: { type: "object", properties: { operation: { type: "string" } } },
+					},
+				},
+			]
+
+			const streamTextParts = (parts: string[]) => {
+				mockLanguageModelChat.sendRequest.mockResolvedValueOnce({
+					stream: (async function* () {
+						for (const part of parts) {
+							yield new vscode.LanguageModelTextPart(part)
+						}
+						return
+					})(),
+					text: (async function* () {
+						yield parts.join("")
+						return
+					})(),
+				})
+			}
+
+			const streamMixedParts = (parts: Array<string | { name: string; input: object }>) => {
+				mockLanguageModelChat.sendRequest.mockResolvedValueOnce({
+					stream: (async function* () {
+						for (const part of parts) {
+							yield typeof part === "string"
+								? new vscode.LanguageModelTextPart(part)
+								: new vscode.LanguageModelToolCallPart("native-1", part.name, part.input)
+						}
+						return
+					})(),
+					text: (async function* () {
+						yield ""
+						return
+					})(),
+				})
+			}
+
+			const drain = async () => {
+				const stream = handler.createMessage("system", [{ role: "user" as const, content: "hi" }], {
+					taskId: "test-task",
+					tools: salvageTools,
+				})
+				const chunks = []
+				for await (const chunk of stream) {
+					chunks.push(chunk)
+				}
+				return chunks
+			}
+
+			const collect = async (parts: string[]) => {
+				streamTextParts(parts)
+				return drain()
+			}
+
+			it("recovers a tool call the model streamed as raw invoke XML", async () => {
+				const chunks = await collect([
+					"Thinking. ",
+					'<function_calls><invoke name="calculator"><parameter name="operation">add</parameter></invoke></function_calls>',
+				])
+
+				expect(chunks.filter((chunk) => chunk.type === "text")).toEqual([{ type: "text", text: "Thinking. " }])
+				expect(chunks.filter((chunk) => chunk.type === "tool_call")).toEqual([
+					{
+						type: "tool_call",
+						id: expect.stringContaining("vscodelm-salvaged-"),
+						name: "calculator",
+						arguments: JSON.stringify({ operation: "add" }),
+					},
+				])
+			})
+
+			it("detects a marker split across stream chunks", async () => {
+				const chunks = await collect([
+					"abc <function_calls><inv",
+					'oke name="calculator"><parameter name="operation">sub</parameter></invoke></function_calls>',
+				])
+
+				expect(chunks.filter((chunk) => chunk.type === "text")).toEqual([{ type: "text", text: "abc " }])
+				expect(chunks.filter((chunk) => chunk.type === "tool_call")).toMatchObject([
+					{ name: "calculator", arguments: JSON.stringify({ operation: "sub" }) },
+				])
+			})
+
+			it("emits a carried tail as plain text when it never becomes a marker", async () => {
+				const chunks = await collect(["hello <par"])
+
+				expect(chunks.filter((chunk) => chunk.type === "text")).toEqual([
+					{ type: "text", text: "hello " },
+					{ type: "text", text: "<par" },
+				])
+				expect(chunks.some((chunk) => chunk.type === "tool_call")).toBe(false)
+			})
+
+			it("buffers across chunks that arrive after the marker", async () => {
+				const chunks = await collect([
+					'prose <function_calls><invoke name="calculator">',
+					'<parameter name="operation">',
+					"mul</parameter>",
+					"</invoke></function_calls>",
+				])
+
+				expect(chunks.filter((chunk) => chunk.type === "text")).toEqual([{ type: "text", text: "prose " }])
+				expect(chunks.filter((chunk) => chunk.type === "tool_call")).toMatchObject([
+					{ name: "calculator", arguments: JSON.stringify({ operation: "mul" }) },
+				])
+			})
+
+			it("recovers a null-only declared parameter as JSON null through createMessage", async () => {
+				mockLanguageModelChat.sendRequest.mockResolvedValueOnce({
+					stream: (async function* () {
+						yield new vscode.LanguageModelTextPart(
+							'<function_calls><invoke name="nuller"><parameter name="cursor">null</parameter></invoke></function_calls>',
+						)
+						return
+					})(),
+					text: (async function* () {
+						yield ""
+						return
+					})(),
+				})
+
+				const stream = handler.createMessage("system", [{ role: "user" as const, content: "hi" }], {
+					taskId: "test-task",
+					tools: [
+						{
+							type: "function" as const,
+							function: {
+								name: "nuller",
+								description: "",
+								parameters: { type: "object", properties: { cursor: { type: "null" } } },
+							},
+						},
+					],
+				})
+				const chunks = []
+				for await (const chunk of stream) {
+					chunks.push(chunk)
+				}
+
+				expect(chunks.filter((chunk) => chunk.type === "tool_call")).toMatchObject([
+					{ name: "nuller", arguments: JSON.stringify({ cursor: null }) },
+				])
+			})
+
+			it("keeps an invoke block for an unknown tool as literal text", async () => {
+				const block = '<invoke name="not_our_tool"><parameter name="a">1</parameter></invoke>'
+				const chunks = await collect([block])
+
+				expect(chunks.filter((chunk) => chunk.type === "text")).toEqual([{ type: "text", text: block }])
+				expect(chunks.some((chunk) => chunk.type === "tool_call")).toBe(false)
+			})
+
+			it("emits prose before the recovered tool call", async () => {
+				const chunks = await collect([
+					"Thinking. ",
+					'<function_calls><invoke name="calculator"><parameter name="operation">add</parameter></invoke></function_calls>',
+				])
+
+				expect(chunks.map((chunk) => chunk.type)).toEqual(["text", "tool_call", "usage"])
+			})
+
+			it("flushes buffered text before a native tool call so no text follows a tool_use", async () => {
+				streamMixedParts([
+					'partial <invoke name="calculator">',
+					{ name: "calculator", input: { operation: "div" } },
+				])
+				const chunks = await drain()
+
+				// The ordering comparison is only meaningful once both kinds of chunk exist: a
+				// silently broken flush emits no text at all, and -1 < firstToolCall would still hold.
+				expect(chunks.filter((chunk) => chunk.type === "text")).toEqual([
+					{ type: "text", text: "partial " },
+					{ type: "text", text: '<invoke name="calculator">' },
+				])
+				const types = chunks.map((chunk) => chunk.type)
+				const lastText = types.lastIndexOf("text")
+				const firstToolCall = types.indexOf("tool_call")
+				expect(lastText).toBeGreaterThanOrEqual(0)
+				expect(firstToolCall).toBeGreaterThanOrEqual(0)
+				expect(firstToolCall).toBeGreaterThan(lastText)
+			})
+
+			it("does not latch buffering on prose that merely mentions the tag", async () => {
+				const chunks = await collect(["never emit <invoke> markup as text. ", "Streaming continues."])
+
+				expect(chunks.filter((chunk) => chunk.type === "text")).toEqual([
+					{ type: "text", text: "never emit <invoke> markup as text. " },
+					{ type: "text", text: "Streaming continues." },
+				])
+				expect(chunks.some((chunk) => chunk.type === "tool_call")).toBe(false)
+			})
+
+			it("does not recover an invoke block quoted inside a fenced code block", async () => {
+				const block = '<invoke name="calculator"><parameter name="operation">add</parameter></invoke>'
+				const chunks = await collect(["Do NOT do this:\n```\n" + block + "\n```\n"])
+
+				expect(chunks.some((chunk) => chunk.type === "tool_call")).toBe(false)
+			})
+
+			it("flushes an over-long never-closing invoke as plain text before the stream ends", async () => {
+				// Defect 4: without a cap the buffer is only drained once the stream finishes, so the
+				// user sees nothing until then. Releasing it at the end looks identical in content —
+				// only the timing distinguishes the fix, so track how much of the source has been
+				// produced at the moment each text chunk reaches the consumer.
+				const filler = "x".repeat(5000)
+				const parts = ['<invoke name="calculator">', filler, filler, filler, filler]
+				let partsProduced = 0
+
+				mockLanguageModelChat.sendRequest.mockResolvedValueOnce({
+					stream: (async function* () {
+						for (const part of parts) {
+							partsProduced++
+							yield new vscode.LanguageModelTextPart(part)
+						}
+						return
+					})(),
+					text: (async function* () {
+						yield ""
+						return
+					})(),
+				})
+
+				const stream = handler.createMessage("system", [{ role: "user" as const, content: "hi" }], {
+					taskId: "test-task",
+					tools: salvageTools,
+				})
+
+				let sawTextBeforeStreamEnd = false
+				let streamedText = ""
+				for await (const chunk of stream) {
+					if (chunk.type === "text") {
+						streamedText += chunk.text
+						if (partsProduced < parts.length) {
+							sawTextBeforeStreamEnd = true
+						}
+					}
+				}
+
+				expect(sawTextBeforeStreamEnd).toBe(true)
+				expect(streamedText).toContain('<invoke name="calculator">')
+				expect(streamedText).toContain(filler)
+			})
+		})
+
+		describe("system prompt sanitization", () => {
+			it("sanitizes lone surrogates in the system prompt", async () => {
+				mockLanguageModelChat.sendRequest.mockResolvedValueOnce({
+					stream: (async function* () {
+						yield new vscode.LanguageModelTextPart("ok")
+						return
+					})(),
+					text: (async function* () {
+						yield "ok"
+						return
+					})(),
+				})
+				const stream = handler.createMessage("sys\uD800tem", [{ role: "user" as const, content: "hi" }])
+				for await (const _chunk of stream) {
+					// drain
+				}
+
+				expect(vscode.LanguageModelChatMessage.Assistant).toHaveBeenCalledWith("sys\uFFFDtem")
+			})
+		})
+
 		it("should handle native tool calls when tools are provided", async () => {
 			const systemPrompt = "You are a helpful assistant"
 			const messages: Anthropic.Messages.MessageParam[] = [
@@ -1077,3 +1494,667 @@ describe("VsCodeLmHandler", () => {
 		})
 	})
 })
+
+describe("leaked tool-call recovery", () => {
+	// Builders keep the XML fixtures readable and prevent this file's own markup from being
+	// mistaken for a real tool call.
+	const invoke = (name: string, body: string) => `<in${"voke"} name="${name}">${body}</in${"voke"}>`
+	const param = (name: string, value: string) => `<param${"eter"} name="${name}">${value}</param${"eter"}>`
+	const wrap = (body: string) => `<function${"_calls"}>${body}</function${"_calls"}>`
+
+	describe("extractLeakedToolCalls", () => {
+		it("recovers a known-tool block and strips it from the leftover text", () => {
+			const text = `Working on it.\n${wrap(invoke("update_todo_list", param("todos", "[x] one\n[ ] two")))}`
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toEqual([{ name: "update_todo_list", input: { todos: "[x] one\n[ ] two" } }])
+			expect(leftoverText).toBe("Working on it.\n")
+		})
+
+		it("recovers a wrapped leak preceded by a stray token", () => {
+			const text = `court\n${wrap(invoke("update_todo_list", param("todos", "[x] done")))}`
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toEqual([{ name: "update_todo_list", input: { todos: "[x] done" } }])
+			expect(leftoverText).toBe("court\n")
+		})
+
+		it("does not recover a bare invoke block with no function_calls wrapper", () => {
+			const text = `court\n${invoke("update_todo_list", param("todos", "[x] done"))}`
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("does not recover an invoke that follows an already-closed wrapper", () => {
+			const text = `${wrap("")}\n${invoke("update_todo_list", param("todos", "[x] done"))}`
+
+			const { calls } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+		})
+
+		it("recovers multiple params and strips function-call wrapper tags", () => {
+			const body = param("mode", "code") + param("message", "go")
+			const text = `<function_calls>${invoke("new_task", body)}</function_calls>`
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["new_task"]))
+
+			expect(calls).toEqual([{ name: "new_task", input: { mode: "code", message: "go" } }])
+			expect(leftoverText).toBe("")
+		})
+
+		it("passes through invoke blocks for tools that were not offered", () => {
+			const text = invoke("some_other_tool", param("x", "1"))
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toEqual([])
+			expect(leftoverText).toBe(text)
+		})
+
+		it("returns no calls for ordinary text", () => {
+			const { calls, leftoverText } = extractLeakedToolCalls("just a normal reply", new Set(["update_todo_list"]))
+
+			expect(calls).toEqual([])
+			expect(leftoverText).toBe("just a normal reply")
+		})
+	})
+
+	describe("trailingPartialToolMarkerLength", () => {
+		it("holds back a split marker prefix at the end of a chunk", () => {
+			expect(trailingPartialToolMarkerLength("some text <in")).toBe(3)
+		})
+
+		it("returns 0 for plain text and complete tags", () => {
+			expect(trailingPartialToolMarkerLength("hello world")).toBe(0)
+			expect(trailingPartialToolMarkerLength("a < b")).toBe(0)
+			expect(trailingPartialToolMarkerLength("text <function_calls>")).toBe(0)
+		})
+
+		it("holds back an invoke tag whose name attribute has not arrived", () => {
+			expect(trailingPartialToolMarkerLength("text <invoke ")).toBe(8)
+		})
+
+		it("does not hold back an over-long trailing fragment", () => {
+			expect(trailingPartialToolMarkerLength("<invoke " + "x".repeat(200))).toBe(0)
+		})
+
+		it("does not hold back an over-long generic tag fragment", () => {
+			expect(trailingPartialToolMarkerLength("text <" + "a".repeat(200))).toBe(0)
+		})
+	})
+
+	describe("quoted markup", () => {
+		it("does not recover an invoke block inside a fenced code block", () => {
+			const text = "```\n" + invoke("update_todo_list", param("todos", "[x] one")) + "\n```"
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("does not recover an invoke block inside an inline code span", () => {
+			const text = "avoid `" + invoke("update_todo_list", param("todos", "x")) + "`"
+
+			const { calls } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+		})
+
+		it("does not recover an invoke block quoted in unfenced, backtick-free prose", () => {
+			const text = "You must never emit " + invoke("update_todo_list", param("todos", "x")) + " directly."
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("does not recover a quoted invoke block that ends its line", () => {
+			// Defect 3: an empty rest-of-line previously made this look like a genuine leak.
+			const text = "You must never emit " + invoke("update_todo_list", param("todos", "x"))
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("does not recover an invoke block inside a tilde fence", () => {
+			const text = "~~~\n" + invoke("update_todo_list", param("todos", "[x] one")) + "\n~~~"
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("does not recover an invoke inside a four-backtick fence containing a three-backtick fence", () => {
+			// A narrower inner fence must not close the wider outer one, so the invoke stays quoted.
+			const text = "````\n```\n" + invoke("update_todo_list", param("todos", "[x] one")) + "\n```\n````"
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("does not recover an invoke inside a tilde fence containing a backtick fence line", () => {
+			const text = "~~~\n```\n" + invoke("update_todo_list", param("todos", "[x] one")) + "\n```\n~~~"
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("recovers an invoke block that follows a closed code fence", () => {
+			const text = "```\nexample output\n```\n" + wrap(invoke("update_todo_list", param("todos", "[x] one")))
+
+			const { calls } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toEqual([{ name: "update_todo_list", input: { todos: "[x] one" } }])
+		})
+
+		it("does not treat doubled angle brackets as trailing prose after stripping", () => {
+			// Defect 1: a single strip pass turns `<<x>>` into a tag-looking `<x>`, so the
+			// trailing-text check must strip repeatedly until stable.
+			const text = wrap(invoke("update_todo_list", param("todos", "x")) + "<<script>>")
+
+			const { calls } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toEqual([{ name: "update_todo_list", input: { todos: "x" } }])
+		})
+
+		it("keeps wrapper tags around a block that was not recovered", () => {
+			const text = `<function_calls>${invoke("some_other_tool", param("x", "1"))}</function_calls>`
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+	})
+
+	// The bare-invoke cases above short-circuit at the wrapper check, so they never exercise the
+	// quoting guards. These keep the wrapper open so each guard is actually reached.
+	describe("quoted markup inside an open function_calls wrapper", () => {
+		const tools = new Set(["update_todo_list"])
+		const quoted = (body: string) => `<function${"_calls"}>\n${body}`
+
+		it("suppresses an invoke inside a three-backtick fence", () => {
+			const block = invoke("update_todo_list", param("todos", "[x] one"))
+			const text = quoted("```\n" + block + "\n```")
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, tools)
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("suppresses an invoke inside a tilde fence", () => {
+			const block = invoke("update_todo_list", param("todos", "[x] one"))
+			const text = quoted("~~~\n" + block + "\n~~~")
+
+			const { calls } = extractLeakedToolCalls(text, tools)
+
+			expect(calls).toHaveLength(0)
+		})
+
+		it("suppresses an invoke inside a four-backtick fence containing a narrower fence", () => {
+			const block = invoke("update_todo_list", param("todos", "[x] one"))
+			const text = quoted("````\n```\n" + block + "\n```\n````")
+
+			const { calls } = extractLeakedToolCalls(text, tools)
+
+			expect(calls).toHaveLength(0)
+		})
+
+		it("recovers an invoke that follows a CLOSED fence, proving the fence guard reopens", () => {
+			const text = quoted("```\nexample\n```\n" + invoke("update_todo_list", param("todos", "[x] one")))
+
+			const { calls } = extractLeakedToolCalls(text, tools)
+
+			expect(calls).toEqual([{ name: "update_todo_list", input: { todos: "[x] one" } }])
+		})
+
+		it("suppresses an invoke inside an inline code span", () => {
+			const text = quoted("avoid `" + invoke("update_todo_list", param("todos", "x")) + "`")
+
+			const { calls } = extractLeakedToolCalls(text, tools)
+
+			expect(calls).toHaveLength(0)
+		})
+
+		it("suppresses an invoke introduced by a quoting cue that ends its line", () => {
+			const text = quoted("You must never emit " + invoke("update_todo_list", param("todos", "x")))
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, tools)
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("suppresses an invoke followed by narrative text on the same line", () => {
+			const text = quoted(invoke("update_todo_list", param("todos", "x")) + " is what you must not do.")
+
+			const { calls } = extractLeakedToolCalls(text, tools)
+
+			expect(calls).toHaveLength(0)
+		})
+	})
+
+	describe("schema-aware recovered parameters", () => {
+		const schemas = new Map<string, Record<string, unknown> | undefined>([
+			[
+				"update_todo_list",
+				{ type: "object", properties: { todos: { type: "array" }, note: { type: "string" } } },
+			],
+			[
+				"read_file",
+				{
+					type: "object",
+					properties: {
+						path: { type: "string" },
+						indentation: { type: "object" },
+						limit: { type: "integer" },
+						ratio: { type: "number" },
+						recursive: { type: "boolean" },
+						optional: { type: ["object", "null"] },
+						nullScalar: { type: "null" },
+						nullUnion: { type: ["null"] },
+					},
+				},
+			],
+		])
+
+		it("converts a declared array parameter into a real array", () => {
+			const text = wrap(invoke("update_todo_list", param("todos", '["a","b"]')))
+
+			const { calls } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toEqual([{ name: "update_todo_list", input: { todos: ["a", "b"] } }])
+		})
+
+		it("converts declared object, number, integer and boolean parameters", () => {
+			const body =
+				param("path", "src/app.ts") +
+				param("indentation", '{"anchor_line":42}') +
+				param("limit", "10") +
+				param("ratio", "1.5") +
+				param("recursive", "true")
+			const { calls } = extractLeakedToolCalls(wrap(invoke("read_file", body)), schemas)
+
+			expect(calls).toEqual([
+				{
+					name: "read_file",
+					input: {
+						path: "src/app.ts",
+						indentation: { anchor_line: 42 },
+						limit: 10,
+						ratio: 1.5,
+						recursive: true,
+					},
+				},
+			])
+		})
+
+		it("resolves a nullable union to its non-null type", () => {
+			const text = wrap(invoke("read_file", param("optional", '{"a":1}')))
+
+			const { calls } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toEqual([{ name: "read_file", input: { optional: { a: 1 } } }])
+		})
+
+		it("accepts an explicit null for a nullable union parameter", () => {
+			const text = wrap(invoke("read_file", param("optional", "null")))
+
+			const { calls } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toEqual([{ name: "read_file", input: { optional: null } }])
+			expect(Object.keys(calls[0].input)).toContain("optional")
+			expect(calls[0].input.optional).toBeNull()
+		})
+
+		it("fails closed when a non-nullable object parameter is null", () => {
+			const text = wrap(invoke("read_file", param("indentation", "null")))
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("accepts an explicit null for a scalar null-only parameter", () => {
+			const text = wrap(invoke("read_file", param("nullScalar", "null")))
+
+			const { calls } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toEqual([{ name: "read_file", input: { nullScalar: null } }])
+			expect(calls[0].input.nullScalar).toBeNull()
+		})
+
+		it("accepts an explicit null for a single-entry null union parameter", () => {
+			const text = wrap(invoke("read_file", param("nullUnion", "null")))
+
+			const { calls } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toEqual([{ name: "read_file", input: { nullUnion: null } }])
+			expect(calls[0].input.nullUnion).toBeNull()
+		})
+
+		it("fails closed when a scalar null-only parameter carries a non-null value", () => {
+			const text = wrap(invoke("read_file", param("nullScalar", '{"a":1}')))
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("fails closed when a single-entry null union parameter carries a non-null value", () => {
+			const text = wrap(invoke("read_file", param("nullUnion", "123")))
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("keeps a declared string parameter as the literal text null", () => {
+			const text = wrap(invoke("read_file", param("path", "null")))
+
+			const { calls } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toEqual([{ name: "read_file", input: { path: "null" } }])
+		})
+
+		it("keeps a declared string parameter literal even when it looks like JSON", () => {
+			const text = wrap(invoke("update_todo_list", param("note", "123")))
+
+			const { calls } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toEqual([{ name: "update_todo_list", input: { note: "123" } }])
+		})
+
+		it("keeps every parameter literal when no schemas are supplied", () => {
+			const text = wrap(invoke("update_todo_list", param("todos", '["a"]')))
+
+			const { calls } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toEqual([{ name: "update_todo_list", input: { todos: '["a"]' } }])
+		})
+
+		it("fails closed to unchanged text when a structured parameter is not valid JSON", () => {
+			const text = wrap(invoke("update_todo_list", param("todos", "[x] not json")))
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("fails closed when a parsed value has the wrong type for its schema", () => {
+			const text = wrap(invoke("update_todo_list", param("todos", '{"a":1}')))
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("still requires the function_calls wrapper for a schema-typed call", () => {
+			const text = invoke("update_todo_list", param("todos", '["a"]'))
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+	})
+})
+
+describe("context-window tool_result truncation", () => {
+	describe("middleOutTruncate", () => {
+		it("returns text unchanged when within the limit", () => {
+			expect(middleOutTruncate("hello world", 100)).toBe("hello world")
+		})
+
+		it("keeps the head and tail and inserts a truncation marker", () => {
+			const text = "A".repeat(500) + "B".repeat(500)
+			const result = middleOutTruncate(text, 200)
+
+			expect(result.length).toBeLessThanOrEqual(200)
+			expect(result).toContain("characters truncated to fit the model context window")
+			expect(result.startsWith("A")).toBe(true)
+			expect(result.endsWith("B")).toBe(true)
+		})
+
+		it("returns an empty string for a non-positive limit", () => {
+			expect(middleOutTruncate("anything", 0)).toBe("")
+		})
+
+		// A lone surrogate cannot be encoded as UTF-8 and 400s the whole request.
+		it("never splits a surrogate pair across the removed middle", () => {
+			const pair = "\u{1F600}" // one astral char = high + low surrogate
+			const text = pair.repeat(400)
+			const result = middleOutTruncate(text, 200)
+
+			expect(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/.test(result)).toBe(false)
+		})
+	})
+
+	describe("truncateToolResultsToFitWindow", () => {
+		const toolUseMessage = (id: string): Anthropic.Messages.MessageParam => ({
+			role: "assistant",
+			content: [
+				{ type: "text", text: "Calling a tool." },
+				{ type: "tool_use", id, name: "some_tool", input: { a: 1 } },
+			],
+		})
+
+		const toolResultMessage = (id: string, content: string): Anthropic.Messages.MessageParam => ({
+			role: "user",
+			content: [
+				{ type: "tool_result", tool_use_id: id, content },
+				{ type: "text", text: "<environment_details>env</environment_details>" },
+			],
+		})
+
+		const findBlock = (message: Anthropic.Messages.MessageParam, type: string) =>
+			(message.content as unknown as Array<{ type: string; [key: string]: unknown }>).find(
+				(block) => block.type === type,
+			)!
+
+		it("is a no-op when the conversation already fits the budget", () => {
+			const messages: Anthropic.Messages.MessageParam[] = [
+				toolUseMessage("t1"),
+				toolResultMessage("t1", "small result"),
+			]
+			const before = JSON.parse(JSON.stringify(messages))
+
+			truncateToolResultsToFitWindow(messages, 100_000)
+
+			expect(messages).toEqual(before)
+		})
+
+		it("returns messages untouched when the budget is not a usable number", () => {
+			const messages: Anthropic.Messages.MessageParam[] = [
+				toolUseMessage("t1"),
+				toolResultMessage("t1", "Y".repeat(50_000)),
+			]
+			const before = JSON.parse(JSON.stringify(messages))
+
+			expect(truncateToolResultsToFitWindow(messages, 0)).toBe(messages)
+			expect(truncateToolResultsToFitWindow(messages, Number.NaN)).toBe(messages)
+			expect(messages).toEqual(before)
+		})
+
+		it("truncates array-form tool_result content and preserves non-text parts", () => {
+			const messages: Anthropic.Messages.MessageParam[] = [
+				toolUseMessage("t1"),
+				{
+					role: "user",
+					content: [
+						{
+							type: "tool_result",
+							tool_use_id: "t1",
+							content: [
+								{ type: "text", text: "Z".repeat(50_000) },
+								{ type: "image", source: { type: "base64", media_type: "image/png", data: "abc" } },
+							],
+						},
+					],
+				} as unknown as Anthropic.Messages.MessageParam,
+			]
+
+			truncateToolResultsToFitWindow(messages, 10_000)
+
+			const toolResult = findBlock(messages[1], "tool_result")
+			const parts = toolResult.content as Array<{ type: string; text?: string }>
+			expect(parts[0].type).toBe("text")
+			expect(parts[0].text).toContain("characters truncated")
+			expect(parts.some((part) => part.type === "image")).toBe(true)
+		})
+
+		it("ignores string content and skips messages that cannot hold tool_result blocks", () => {
+			const messages: Anthropic.Messages.MessageParam[] = [
+				{ role: "user", content: "a plain string turn" },
+				toolUseMessage("t1"),
+				{
+					role: "user",
+					content: [
+						{ type: "tool_result", tool_use_id: "t1", content: "W".repeat(50_000) },
+						{ type: "image", source: { type: "base64", media_type: "image/png", data: "abc" } },
+					],
+				} as unknown as Anthropic.Messages.MessageParam,
+			]
+
+			truncateToolResultsToFitWindow(messages, 10_000)
+
+			expect(messages[0].content).toBe("a plain string turn")
+			expect(String(findBlock(messages[2], "tool_result").content)).toContain("characters truncated")
+		})
+
+		it("ignores a tool_result whose content is neither string nor array", () => {
+			const messages: Anthropic.Messages.MessageParam[] = [
+				toolUseMessage("t1"),
+				toolResultMessage("t1", "V".repeat(50_000)),
+				{
+					role: "user",
+					content: [{ type: "tool_result", tool_use_id: "t2", content: undefined }],
+				} as unknown as Anthropic.Messages.MessageParam,
+			]
+
+			truncateToolResultsToFitWindow(messages, 10_000)
+
+			expect(findBlock(messages[2], "tool_result").content).toBeUndefined()
+			expect(String(findBlock(messages[1], "tool_result").content)).toContain("characters truncated")
+		})
+
+		it("skips a tool_result already small enough to need no trimming", () => {
+			// Overage is tiny, so the largest block's target lands at its current length.
+			const messages: Anthropic.Messages.MessageParam[] = [
+				toolUseMessage("t1"),
+				toolResultMessage("t1", "U".repeat(3000)),
+				toolUseMessage("t2"),
+				toolResultMessage("t2", "T".repeat(2500)),
+			]
+
+			truncateToolResultsToFitWindow(messages, 5600)
+
+			const first = String(findBlock(messages[1], "tool_result").content)
+			const second = String(findBlock(messages[3], "tool_result").content)
+			expect(first.length + second.length).toBeLessThanOrEqual(5600)
+		})
+
+		it("leaves a tool_result at or below the minimum size alone", () => {
+			const shortResult = "S".repeat(1500)
+			const messages: Anthropic.Messages.MessageParam[] = [
+				toolUseMessage("t1"),
+				toolResultMessage("t1", shortResult),
+				toolUseMessage("t2"),
+				toolResultMessage("t2", shortResult),
+			]
+
+			truncateToolResultsToFitWindow(messages, 100)
+
+			expect(findBlock(messages[1], "tool_result").content).toBe(shortResult)
+			expect(findBlock(messages[3], "tool_result").content).toBe(shortResult)
+		})
+
+		it("shrinks an oversized tool_result so the conversation fits the budget", () => {
+			const messages: Anthropic.Messages.MessageParam[] = [
+				toolUseMessage("t1"),
+				toolResultMessage("t1", "X".repeat(50_000)),
+			]
+
+			truncateToolResultsToFitWindow(messages, 10_000)
+
+			const toolResult = findBlock(messages[1], "tool_result")
+			expect(toolResult.tool_use_id).toBe("t1") // pairing preserved
+			expect(String(toolResult.content).length).toBeLessThanOrEqual(10_000)
+			expect(String(toolResult.content)).toContain("characters truncated")
+		})
+
+		it("truncates the largest tool_result first and leaves small ones intact", () => {
+			const small = "small but real result"
+			const messages: Anthropic.Messages.MessageParam[] = [
+				toolUseMessage("t1"),
+				toolResultMessage("t1", "B".repeat(40_000)),
+				toolUseMessage("t2"),
+				toolResultMessage("t2", small),
+			]
+
+			truncateToolResultsToFitWindow(messages, 12_000)
+
+			expect(String(findBlock(messages[1], "tool_result").content)).toContain("characters truncated")
+			expect(findBlock(messages[3], "tool_result").content).toBe(small) // untouched
+		})
+
+		it("never truncates tool_use blocks, assistant text, or environment details", () => {
+			const messages: Anthropic.Messages.MessageParam[] = [
+				toolUseMessage("t1"),
+				toolResultMessage("t1", "X".repeat(50_000)),
+			]
+
+			truncateToolResultsToFitWindow(messages, 8_000)
+
+			expect(findBlock(messages[0], "text").text).toBe("Calling a tool.")
+			expect(findBlock(messages[0], "tool_use")).toMatchObject({ id: "t1", name: "some_tool" })
+			expect(findBlock(messages[1], "text").text).toBe("<environment_details>env</environment_details>")
+		})
+
+		it("handles array-form tool_result content and keeps it valid", () => {
+			const messages: Anthropic.Messages.MessageParam[] = [
+				toolUseMessage("t1"),
+				{
+					role: "user",
+					content: [
+						{
+							type: "tool_result",
+							tool_use_id: "t1",
+							content: [{ type: "text", text: "Y".repeat(40_000) }],
+						},
+					],
+				},
+			]
+
+			truncateToolResultsToFitWindow(messages, 8_000)
+
+			const toolResult = findBlock(messages[1], "tool_result")
+			expect(toolResult.tool_use_id).toBe("t1")
+			expect(Array.isArray(toolResult.content)).toBe(true)
+			const parts = toolResult.content as Array<{ type: string; text?: string }>
+			expect(parts[0].type).toBe("text")
+			expect(String(parts[0].text)).toContain("characters truncated")
+		})
+	})
+})
diff --git a/src/api/providers/vscode-lm.ts b/src/api/providers/vscode-lm.ts
index c657e6c0d6..52fb8f902e 100644
--- a/src/api/providers/vscode-lm.ts
+++ b/src/api/providers/vscode-lm.ts
@@ -8,8 +8,12 @@ import type { ApiHandlerOptions } from "../../shared/api"
 import { SELECTOR_SEPARATOR, stringifyVsCodeLmModelSelector } from "../../shared/vsCodeSelectorUtils"
 import { normalizeToolSchema } from "../../utils/json-schema"
 
-import { ApiStream } from "../transform/stream"
-import { convertToVsCodeLmMessages, extractTextCountFromMessage } from "../transform/vscode-lm-format"
+import { ApiStream, ApiStreamChunk } from "../transform/stream"
+import {
+	convertToVsCodeLmMessages,
+	extractTextCountFromMessage,
+	sanitizeSurrogates,
+} from "../transform/vscode-lm-format"
 
 import { BaseProvider } from "./base-provider"
 import type { SingleCompletionHandler, ApiHandlerCreateMessageMetadata, CompletePromptOptions } from "../index"
@@ -60,6 +64,529 @@ function convertToVsCodeLmTools(tools: OpenAI.Chat.ChatCompletionTool[]): vscode
  * }
  * ```
  */
+/**
+ * Recovery for leaked tool calls
+ * ------------------------------
+ * Some VS Code LM backends — notably GitHub Copilot serving Anthropic Claude models —
+ * intermittently stream a tool call as PLAIN TEXT using Anthropic's internal function-call
+ * XML instead of emitting a structured `LanguageModelToolCallPart`. When this happens the
+ * assistant turn contains no tool_use block, so Zoo reports "no tools used" and the task stalls
+ * in a retry loop. The helpers below detect the leaked markup mid-stream and replay it as a real
+ * tool call. Recovery is deliberately conservative: only `<invoke>` blocks whose name matches a
+ * tool we actually offered this turn are treated as calls; everything else is passed through
+ * unchanged as text.
+ *
+ * SCOPE: only the WRAPPED variant — an `<invoke>` inside an open `<function_calls>` wrapper — is
+ * recovered. A bare, unwrapped `<invoke>` is deliberately left as text: we have no observation of
+ * this backend emitting one, while quoted examples and prompt-injected file content routinely
+ * contain bare markup, so passing it through is the safer default rather than a security boundary.
+ * Widening to the bare case needs a reproduction first.
+ */
+// Latching on a bare `<invoke` would let any prose mentioning the tag stop real-time streaming for
+// the rest of the response, so the marker only counts once the `name="` attribute has arrived.
+const LEAKED_TOOL_CALL_START = /<(?:antml:)?(?:function_calls\s*>|invoke\s+name=")/i
+const LEAKED_INVOKE_BLOCK = /<(?:antml:)?invoke\s+name="([^"]+)"\s*>([\s\S]*?)<\/(?:antml:)?invoke\s*>/gi
+const LEAKED_INVOKE_PARAM = /<(?:antml:)?parameter\s+name="([^"]+)"\s*>([\s\S]*?)<\/(?:antml:)?parameter\s*>/gi
+
+/** Upper bound on an incomplete `<invoke ...` tail held back between chunks. */
+const MAX_PARTIAL_INVOKE_CARRY = 64
+
+/**
+ * Upper bound on buffered text held while waiting for a leaked `<invoke>` block to close. Markup
+ * that never closes would otherwise withhold the whole response from the user until the stream
+ * ended, so past this size the buffer is released as ordinary text.
+ */
+const MAX_SALVAGE_BUFFER_CHARS = 64 * MAX_PARTIAL_INVOKE_CARRY
+
+/**
+ * Same-line prose that introduces markup as an example rather than invoking it. This is a
+ * deliberately narrow lexical cue: a quoted invoke that ENDS its line is otherwise
+ * indistinguishable from a genuine leak, which is just as often preceded by prose.
+ */
+const QUOTING_CUE =
+	/\b(?:never|not|do not|don't|does not|doesn't|must not|mustn't|avoid|instead of|rather than|for example|e\.g\.|such as|like this|as follows)\b[^.!?\n]*$/i
+
+/**
+ * True when `before` ends inside an open Markdown code fence. Tracks the fence character and its
+ * width so tilde fences and fences of 4+ backticks (which may legally contain shorter fences) are
+ * recognized, rather than counting three-backtick runs for parity.
+ */
+function isInsideCodeFence(before: string): boolean {
+	let openFence: { marker: string; width: number } | null = null
+	for (const line of before.split("\n")) {
+		const fenceMatch = line.match(/^ {0,3}(`{3,}|~{3,})/)
+		if (!fenceMatch) {
+			continue
+		}
+		const marker = fenceMatch[1][0]
+		const width = fenceMatch[1].length
+		if (!openFence) {
+			openFence = { marker, width }
+		} else if (marker === openFence.marker && width >= openFence.width) {
+			openFence = null
+		}
+	}
+	return openFence !== null
+}
+
+/** True when `text` already contains a closed `<invoke>` block, so buffering is still productive. */
+function hasCompleteInvokeBlock(text: string): boolean {
+	LEAKED_INVOKE_BLOCK.lastIndex = 0
+	const found = LEAKED_INVOKE_BLOCK.test(text)
+	LEAKED_INVOKE_BLOCK.lastIndex = 0
+	return found
+}
+
+/**
+ * Strips well-formed tags repeatedly until the result stops changing. A single pass is unsafe:
+ * `<<invoke>>` reassembles into a live-looking tag after one replacement.
+ */
+function stripTagsCompletely(text: string): string {
+	let current = text
+	for (;;) {
+		const stripped = current.replace(/<[^<>]*>/g, "")
+		if (stripped === current) {
+			return stripped
+		}
+		current = stripped
+	}
+}
+
+/**
+ * Returns the length of a trailing fragment that might be the start of a leaked tool-call marker
+ * split across stream chunks. Such a tail is held back until more text arrives so the marker can
+ * be detected intact.
+ */
+export function trailingPartialToolMarkerLength(text: string): number {
+	const partialTag = text.match(/<(?:antml:)?[a-zA-Z_]*$/)
+	if (partialTag) {
+		return partialTag[0].length <= MAX_PARTIAL_INVOKE_CARRY ? partialTag[0].length : 0
+	}
+	// An `<invoke` whose `name="` attribute hasn't arrived yet: hold it back so the marker can
+	// latch on the next chunk, bounded so ordinary prose is never swallowed.
+	const partialInvoke = text.match(/<(?:antml:)?invoke\b[^<>]*$/i)
+	return partialInvoke && partialInvoke[0].length <= MAX_PARTIAL_INVOKE_CARRY ? partialInvoke[0].length : 0
+}
+
+/**
+ * True when an unclosed `<function_calls>` wrapper is open at the end of `before`.
+ *
+ * Every wrapped-leak sample we have came with this wrapper, and the quoted-in-prose cases were
+ * bare, making the wrapper the sharpest discriminator available. Requiring it keeps untrusted bare
+ * `<invoke>` markup — which a prompt-injected file or a quoted example can contain — from becoming
+ * a real call. It is a heuristic filter, not a security boundary.
+ */
+function isInsideFunctionCallsWrapper(before: string): boolean {
+	const lastOpen = before.search(/<(?:antml:)?function_calls\s*>(?![\s\S]*<(?:antml:)?function_calls\s*>)/i)
+	if (lastOpen === -1) {
+		return false
+	}
+	return !/<\/(?:antml:)?function_calls\s*>/i.test(before.slice(lastOpen))
+}
+
+/**
+ * True when the block spanning `[index, endIndex)` is being quoted — inside a fenced code block,
+ * inside an inline code span, or embedded mid-sentence in plain prose — rather than invoked.
+ */
+function isQuotedAsCode(text: string, index: number, endIndex: number): boolean {
+	const before = text.slice(0, index)
+	if (isInsideCodeFence(before)) {
+		return true
+	}
+	const lineStart = before.lastIndexOf("\n") + 1
+	const sameLineBefore = before.slice(lineStart)
+	if ((sameLineBefore.match(/`/g)?.length ?? 0) % 2 === 1) {
+		return true
+	}
+	// Narrative words after the block on the same line mean the markup is being talked about
+	// (e.g. "never emit <invoke ...> directly"), which must not be replayed as a live call.
+	const after = text.slice(endIndex)
+	const lineEnd = after.indexOf("\n")
+	const restOfLine = lineEnd === -1 ? after : after.slice(0, lineEnd)
+	if (stripTagsCompletely(restOfLine).trim().length > 0) {
+		return true
+	}
+	// A quoted invoke that ENDS its line leaves no trailing text to judge. Keying off the mere
+	// presence of leading prose was tried and regressed genuine recoveries, because a real leak is
+	// commonly preceded by narration too ("Working on it.\n"), so only an explicit quoting cue
+	// immediately before the markup suppresses it. Heuristic: prose that quotes markup without
+	// such a cue still reads as a live call.
+	return QUOTING_CUE.test(stripTagsCompletely(sameLineBefore))
+}
+
+/**
+ * JSON Schema (draft 2020-12 subset) for one tool's parameters, keyed by tool name. Supplied by
+ * `createMessage` from the very schemas offered to the model, so recovery converts a leaked
+ * parameter to the type the tool actually declares.
+ */
+export type LeakedToolSchemas = ReadonlyMap<string, Record<string, unknown> | undefined>
+
+/** Non-string JSON Schema types a leaked parameter may be converted into. */
+const STRUCTURED_PARAM_TYPES = new Set(["object", "array", "number", "integer", "boolean", "null"])
+
+/**
+ * Declared type of `paramName`, resolving a nullable `["T","null"]` union to `T` while reporting
+ * that null is permitted, so an explicit null is not mistaken for a wrong-typed value.
+ */
+function declaredParamType(
+	schema: Record<string, unknown> | undefined,
+	paramName: string,
+): { type: string | undefined; nullable: boolean } {
+	const properties = schema?.["properties"] as Record<string, unknown> | undefined
+	const property = properties?.[paramName] as Record<string, unknown> | undefined
+	const type = property?.["type"]
+	if (typeof type === "string") {
+		return { type, nullable: type === "null" }
+	}
+	if (Array.isArray(type)) {
+		const nullable = type.includes("null")
+		const nonNull = type.find((entry): entry is string => typeof entry === "string" && entry !== "null")
+		// A null-only union has no non-null member; keeping type undefined would fall back to the raw
+		// string "null", so declare the null type explicitly to force a JSON parse.
+		return { type: nonNull ?? (nullable ? "null" : undefined), nullable }
+	}
+	return { type: undefined, nullable: false }
+}
+
+/**
+ * Converts one leaked parameter's raw text to the type its schema declares.
+ *
+ * Leaked markup carries no types — every value arrives as text — so a tool declaring an object or
+ * array (`update_todo_list.todos`, `read_file.indentation`) would otherwise receive a flat string
+ * and fail downstream. Only declared non-string types are JSON-parsed; a declared (or unknown)
+ * string stays literal, because parsing every value would silently turn the text `"123"` or
+ * `"null"` into a number or null. A value that does not parse, or parses to the wrong type, is
+ * reported as a failure so the caller can pass the block through as text rather than dispatch a
+ * malformed call.
+ */
+function convertLeakedParamValue(
+	raw: string,
+	declared: { type: string | undefined; nullable: boolean },
+): { value: unknown } | undefined {
+	const declaredType = declared.type
+	if (declaredType === undefined || declaredType === "string") {
+		return { value: raw }
+	}
+	if (!STRUCTURED_PARAM_TYPES.has(declaredType)) {
+		return undefined
+	}
+
+	let parsed: unknown
+	try {
+		parsed = JSON.parse(raw)
+	} catch {
+		return undefined
+	}
+
+	// Must precede the type ladder, whose object branch rejects null outright.
+	if (parsed === null) {
+		return declared.nullable ? { value: null } : undefined
+	}
+
+	const matchesDeclaredType =
+		declaredType === "null"
+			? false
+			: declaredType === "object"
+				? typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)
+				: declaredType === "array"
+					? Array.isArray(parsed)
+					: declaredType === "boolean"
+						? typeof parsed === "boolean"
+						: declaredType === "integer"
+							? Number.isInteger(parsed)
+							: typeof parsed === "number" && Number.isFinite(parsed)
+
+	return matchesDeclaredType ? { value: parsed } : undefined
+}
+
+/**
+ * Parses the parameters of a leaked `<invoke>` body against the tool's schema. Returns `undefined`
+ * when any parameter cannot be converted, so the whole block is failed closed to unchanged text.
+ */
+function parseLeakedInvokeParams(
+	body: string,
+	schema: Record<string, unknown> | undefined,
+): Record<string, unknown> | undefined {
+	const input: Record<string, unknown> = {}
+	LEAKED_INVOKE_PARAM.lastIndex = 0
+	let match: RegExpExecArray | null
+	while ((match = LEAKED_INVOKE_PARAM.exec(body)) !== null) {
+		const name = match[1]
+		const converted = convertLeakedParamValue(match[2].trim(), declaredParamType(schema, name))
+		if (!converted) {
+			LEAKED_INVOKE_PARAM.lastIndex = 0
+			return undefined
+		}
+		input[name] = converted.value
+	}
+	return input
+}
+
+/**
+ * Extracts complete leaked `<invoke>` tool-call blocks from `text`. Only blocks whose name
+ * is present in `validTools` are returned as calls; all other text (including `<invoke>`
+ * blocks for unknown names) is returned as `leftoverText` so legitimate prose is preserved.
+ *
+ * `validTools` may be a bare name set (no schemas, so every parameter stays a literal string) or a
+ * map from tool name to its parameter schema, which enables typed conversion.
+ */
+export function extractLeakedToolCalls(
+	text: string,
+	validTools: ReadonlySet<string> | LeakedToolSchemas,
+	precedingText = "",
+): { calls: Array<{ name: string; input: Record<string, unknown> }>; leftoverText: string } {
+	const schemaFor = (name: string) =>
+		validTools instanceof Map ? (validTools.get(name) as Record<string, unknown> | undefined) : undefined
+	const calls: Array<{ name: string; input: Record<string, unknown> }> = []
+	// Text between recovered/passed-through blocks, kept as segments so the wrapper cleanup below
+	// only touches segments adjacent to a block that was actually recovered.
+	const segments: Array<{ text: string; nearRecovery: boolean }> = []
+	let pending = ""
+	let lastIndex = 0
+
+	LEAKED_INVOKE_BLOCK.lastIndex = 0
+	let match: RegExpExecArray | null
+	while ((match = LEAKED_INVOKE_BLOCK.exec(text)) !== null) {
+		pending += text.slice(lastIndex, match.index)
+		const name = match[1]
+		// Quote detection needs the text streamed before the buffer, since a fence may have opened there.
+		const recoverable =
+			validTools.has(name) &&
+			isInsideFunctionCallsWrapper(precedingText + text.slice(0, match.index)) &&
+			!isQuotedAsCode(
+				precedingText + text,
+				precedingText.length + match.index,
+				precedingText.length + match.index + match[0].length,
+			)
+		// Parsing may still fail closed when a parameter doesn't match its declared type.
+		const input = recoverable ? parseLeakedInvokeParams(match[2], schemaFor(name)) : undefined
+		if (input) {
+			calls.push({ name, input })
+			segments.push({ text: pending, nearRecovery: true })
+			pending = ""
+			// The segment that follows a recovery also holds that call's closing wrapper.
+			segments.push({ text: "", nearRecovery: true })
+		} else {
+			// Not one of our tools, quoted as code, or un-convertible — keep the block as literal text.
+			pending += match[0]
+		}
+		lastIndex = match.index + match[0].length
+	}
+	pending += text.slice(lastIndex)
+	const trailing =
+		segments.length > 0 && segments[segments.length - 1].nearRecovery && segments[segments.length - 1].text === ""
+	if (trailing) {
+		segments[segments.length - 1].text = pending
+	} else {
+		segments.push({ text: pending, nearRecovery: false })
+	}
+
+	// Remove the wrapper tags belonging to a recovered call (cosmetic; also avoids re-teaching the
+	// model this format when the turn is sent back as history). Wrappers around blocks that were
+	// NOT recovered are user-visible text and must survive verbatim.
+	const leftover = segments
+		.map((segment) =>
+			segment.nearRecovery ? segment.text.replace(/<\/?(?:antml:)?function_calls\s*>/gi, "") : segment.text,
+		)
+		.join("")
+
+	return { calls, leftoverText: leftover }
+}
+
+/**
+ * Context-window safety for Copilot's backend
+ * -------------------------------------------
+ * Copilot's backend enforces its own context window and, for third-party `sendRequest` callers,
+ * trims an over-window request in a way that is NOT tool-pair-aware: it can drop the assistant
+ * message holding a `tool_use` while keeping the matching `tool_result`, after which Anthropic
+ * rejects the request with "unexpected tool_use_id". To keep trimming on OUR side — where
+ * pairing is preserved — we shrink oversized `tool_result` payloads before sending. Only
+ * `tool_result` text is truncated (never `tool_use`, assistant text, summaries, or environment
+ * details), and only when the request would otherwise exceed the budget.
+ */
+
+/**
+ * Conservative characters-per-token ratio used to turn a token window into a character budget.
+ *
+ * `client.countTokens` is the model's real tokenizer, but it counts only a string: it cannot price
+ * the tool schemas, image placeholders, or per-message framing the backend adds, so it cannot give
+ * the true total for the request we are about to send. It is also an async, per-call RPC, and the
+ * budget is needed for every message on every turn. We therefore keep a character estimate here
+ * and stay deliberately conservative — 3 chars/token rather than the ~4 typical of English —
+ * because the token-dense JSON, logs, and code that dominate oversized tool results tokenize to
+ * fewer characters per token than prose. Under-counting biases toward trimming too early, which is
+ * recoverable; over-counting sends an over-window request, which is not.
+ */
+const VSCODE_LM_BUDGET_CHARS_PER_TOKEN = 3
+
+/**
+ * Fraction of the context window the *entire* input (system prompt + tool schemas + conversation)
+ * is allowed to occupy. The remaining headroom absorbs char/token estimation variance and any
+ * output/overhead the backend reserves.
+ */
+const VSCODE_LM_INPUT_BUDGET_FRACTION = 0.8
+
+/** A tool_result is never shrunk below this many characters, so a truncated result stays useful. */
+const MIN_TOOL_RESULT_CHARS = 2000
+
+/**
+ * Length charged for an image block. VS Code LM cannot carry image data, so
+ * `convertToVsCodeLmMessages` replaces each image with a sentence-long textual placeholder; this
+ * is that placeholder's approximate length.
+ */
+const IMAGE_PLACEHOLDER_CHARS = 64
+
+function readToolResultText(block: Anthropic.Messages.ContentBlockParam): string | undefined {
+	if (!block || (block as { type?: string }).type !== "tool_result") {
+		return undefined
+	}
+	const content = (block as Anthropic.Messages.ToolResultBlockParam).content
+	if (typeof content === "string") {
+		return content
+	}
+	if (Array.isArray(content)) {
+		return content
+			.filter((part): part is Anthropic.Messages.TextBlockParam => (part as { type?: string })?.type === "text")
+			.map((part) => part.text ?? "")
+			.join("")
+	}
+	return undefined
+}
+
+function writeToolResultText(block: Anthropic.Messages.ContentBlockParam, text: string): void {
+	const toolResult = block as Anthropic.Messages.ToolResultBlockParam
+	const content = toolResult.content
+	if (Array.isArray(content)) {
+		// Preserve any non-text parts (e.g. images) and collapse the text into one truncated part.
+		const nonText = content.filter((part) => (part as { type?: string })?.type !== "text")
+		toolResult.content = [{ type: "text", text }, ...nonText] as typeof content
+		return
+	}
+	toolResult.content = text
+}
+
+/**
+ * Middle-out truncate `text` to at most `maxChars`, keeping the head and tail and replacing the
+ * middle with a marker noting how many characters were removed. Head/tail are preserved because
+ * logs and file dumps carry the most signal at their start (structure) and end (recent output).
+ */
+export function middleOutTruncate(text: string, maxChars: number): string {
+	if (maxChars <= 0) {
+		return ""
+	}
+	if (text.length <= maxChars) {
+		return text
+	}
+
+	const buildMarker = (removed: number) =>
+		`\n\n[... ${removed.toLocaleString("en-US")} characters truncated to fit the model context window ...]\n\n`
+
+	// Reserve room for the marker, sized against the original length so the result never grows.
+	const reservedMarkerLength = buildMarker(text.length).length
+	const keep = Math.max(0, maxChars - reservedMarkerLength)
+	const headLength = Math.ceil(keep / 2)
+	const tailLength = keep - headLength
+	let head = text.slice(0, headLength)
+	// Don't end the head on a lone high surrogate — its low half is in the removed middle, and a lone
+	// surrogate cannot be encoded as UTF-8 (the backend 400s the whole request). Drop the split half.
+	if (head.length > 0 && (head.charCodeAt(head.length - 1) & 0xfc00) === 0xd800) {
+		head = head.slice(0, -1)
+	}
+	let tail = tailLength > 0 ? text.slice(text.length - tailLength) : ""
+	// Likewise, don't start the tail on a lone low surrogate (its high half is in the removed middle).
+	if (tail.length > 0 && (tail.charCodeAt(0) & 0xfc00) === 0xdc00) {
+		tail = tail.slice(1)
+	}
+	const removed = text.length - head.length - tail.length
+	return `${head}${buildMarker(removed)}${tail}`
+}
+
+/** Estimated character cost of a whole conversation, using the same accounting as truncation. */
+export function estimateMessagesChars(messages: Anthropic.Messages.MessageParam[]): number {
+	return messages.reduce((sum, message) => sum + estimateContentChars(message.content), 0)
+}
+
+function estimateContentChars(content: Anthropic.Messages.MessageParam["content"]): number {
+	if (typeof content === "string") {
+		return content.length
+	}
+	if (!Array.isArray(content)) {
+		return 0
+	}
+	let total = 0
+	for (const block of content) {
+		const type = (block as { type?: string })?.type
+		if (type === "text") {
+			total += (block as Anthropic.Messages.TextBlockParam).text?.length ?? 0
+		} else if (type === "tool_result") {
+			total += readToolResultText(block)?.length ?? 0
+		} else if (type === "tool_use") {
+			total += JSON.stringify((block as Anthropic.Messages.ToolUseBlockParam).input ?? {}).length
+		} else if (type === "image") {
+			// VS Code LM cannot send image data; convertToVsCodeLmMessages substitutes a textual
+			// placeholder, so charge that placeholder's real length rather than a token-sized guess.
+			total += IMAGE_PLACEHOLDER_CHARS
+		}
+	}
+	return total
+}
+
+/**
+ * Shrinks oversized `tool_result` payloads (largest first, middle-out) until the conversation fits
+ * `budgetChars`. Mutates the tool_result blocks of the supplied messages in place — callers pass a
+ * cloned array (see `createMessage`) so stored history is never mutated. A no-op when the
+ * conversation already fits.
+ */
+export function truncateToolResultsToFitWindow(
+	messages: Anthropic.Messages.MessageParam[],
+	budgetChars: number,
+): Anthropic.Messages.MessageParam[] {
+	if (!Number.isFinite(budgetChars) || budgetChars <= 0) {
+		return messages
+	}
+
+	let total = messages.reduce((sum, message) => sum + estimateContentChars(message.content), 0)
+	if (total <= budgetChars) {
+		return messages
+	}
+
+	// Collect every truncatable tool_result block, largest first.
+	const toolResultBlocks: Anthropic.Messages.ContentBlockParam[] = []
+	for (const message of messages) {
+		if (!Array.isArray(message.content)) {
+			continue
+		}
+		for (const block of message.content) {
+			if (readToolResultText(block) !== undefined) {
+				toolResultBlocks.push(block)
+			}
+		}
+	}
+	toolResultBlocks.sort((a, b) => (readToolResultText(b)?.length ?? 0) - (readToolResultText(a)?.length ?? 0))
+
+	for (const block of toolResultBlocks) {
+		if (total <= budgetChars) {
+			break
+		}
+		const text = readToolResultText(block)
+		if (text === undefined || text.length <= MIN_TOOL_RESULT_CHARS) {
+			continue
+		}
+
+		const overage = total - budgetChars
+		const target = Math.max(MIN_TOOL_RESULT_CHARS, text.length - overage)
+		if (target >= text.length) {
+			continue
+		}
+
+		const truncated = middleOutTruncate(text, target)
+		total -= text.length - truncated.length
+		writeToolResultText(block, truncated)
+	}
+
+	return messages
+}
+
 export class VsCodeLmHandler extends BaseProvider implements SingleCompletionHandler {
 	protected options: ApiHandlerOptions
 	private client: vscode.LanguageModelChat | null
@@ -383,9 +910,43 @@ export class VsCodeLmHandler extends BaseProvider implements SingleCompletionHan
 			content: this.cleanMessageContent(msg.content),
 		}))
 
+		// Keep context-window trimming on OUR side. Copilot's backend trims an over-window request
+		// without preserving tool_use/tool_result pairing, which orphans a tool_result and triggers a
+		// 400 ("unexpected tool_use_id"). See truncateToolResultsToFitWindow.
+		const contextWindowTokens = this.getCondenseContextWindow()
+		if (Number.isFinite(contextWindowTokens) && contextWindowTokens > 0) {
+			const toolSchemaChars = metadata?.tools ? JSON.stringify(metadata.tools).length : 0
+			const rawBudgetChars =
+				contextWindowTokens * VSCODE_LM_INPUT_BUDGET_FRACTION * VSCODE_LM_BUDGET_CHARS_PER_TOKEN -
+				systemPrompt.length -
+				toolSchemaChars
+			// A system prompt or tool schema large enough to consume the whole budget would leave a
+			// non-positive budget, which disables trimming exactly when the request is most oversized.
+			const messagesBudgetChars = Math.max(MIN_TOOL_RESULT_CHARS, rawBudgetChars)
+			truncateToolResultsToFitWindow(cleanedMessages, messagesBudgetChars)
+
+			// Shrinking tool_results cannot always reach the budget: each keeps MIN_TOOL_RESULT_CHARS,
+			// and the excess may be non-tool content (a huge paste, tool_use inputs, or the system
+			// prompt) that we must not touch. Dropping messages here would orphan a tool_result from
+			// its tool_use — the exact 400 this guard exists to prevent — so fail loudly instead of
+			// sending a request we already know is over the window.
+			// Admission is judged against the RAW budget, not the clamped one: the clamp exists only
+			// to keep trimming productive, so accepting up to it would send a request the window
+			// genuinely cannot hold whenever the raw budget falls below MIN_TOOL_RESULT_CHARS.
+			const remainingChars = estimateMessagesChars(cleanedMessages)
+			if (remainingChars > rawBudgetChars) {
+				throw new Error(
+					"Zoo Code <Language Model API>: The request is too large for this model's context window " +
+						`(estimated ${remainingChars.toLocaleString("en-US")} characters against a budget of ` +
+						`${Math.max(0, Math.floor(rawBudgetChars)).toLocaleString("en-US")}), and it cannot be reduced further without ` +
+						"breaking tool-call pairing. Condense the conversation or start a new task.",
+				)
+			}
+		}
+
 		// Convert Anthropic messages to VS Code LM messages
 		const vsCodeLmMessages: vscode.LanguageModelChatMessage[] = [
-			vscode.LanguageModelChatMessage.Assistant(systemPrompt),
+			vscode.LanguageModelChatMessage.Assistant(sanitizeSurrogates(systemPrompt)),
 			...convertToVsCodeLmMessages(cleanedMessages),
 		]
 
@@ -398,6 +959,67 @@ export class VsCodeLmHandler extends BaseProvider implements SingleCompletionHan
 		// Accumulate the text and count at the end of the stream to reduce token counting overhead.
 		let accumulatedText: string = ""
 
+		// Leaked tool-call recovery state (see `extractLeakedToolCalls`). Only enabled when we
+		// actually offered tools this turn, so it can never misfire on plain conversations.
+		// Carries each tool's parameter schema, so a recovered parameter is converted to the type
+		// the tool declares instead of always arriving as a string.
+		const providedToolSchemas: LeakedToolSchemas = new Map(
+			(metadata?.tools ?? [])
+				.filter((tool) => tool.type === "function")
+				.filter((tool) => tool.function.name.length > 0)
+				.map((tool) => [tool.function.name, tool.function.parameters as Record<string, unknown> | undefined]),
+		)
+		const salvageLeakedToolCalls = providedToolSchemas.size > 0
+		let salvageBuffering = false
+		let salvageBuffer = ""
+		let salvageCarry = ""
+		let salvageEmittedText = ""
+		let salvagedToolCallIndex = 0
+
+		// Drains the salvage state into ordered chunks: prose first, then any recovered calls. Must
+		// run before a native tool_call is yielded — text after a tool_use block is rejected by
+		// Anthropic once the turn is serialized back into history.
+		const flushSalvage = (): ApiStreamChunk[] => {
+			const flushed: ApiStreamChunk[] = []
+			if (!salvageLeakedToolCalls) {
+				return flushed
+			}
+
+			if (!salvageBuffering) {
+				if (salvageCarry) {
+					flushed.push({ type: "text", text: salvageCarry })
+					salvageCarry = ""
+				}
+				return flushed
+			}
+
+			const buffered = salvageBuffer
+			salvageBuffering = false
+			salvageBuffer = ""
+			if (!buffered) {
+				return flushed
+			}
+
+			const { calls, leftoverText } = extractLeakedToolCalls(buffered, providedToolSchemas, salvageEmittedText)
+			salvageEmittedText += buffered
+			if (leftoverText) {
+				flushed.push({ type: "text", text: leftoverText })
+			}
+			for (const call of calls) {
+				console.warn(
+					"Zoo Code <Language Model API>: Recovered a tool call the model emitted as text instead of a structured tool call:",
+					{ name: call.name, params: Object.keys(call.input) },
+				)
+				flushed.push({
+					type: "tool_call",
+					id: `vscodelm-salvaged-${Date.now()}-${salvagedToolCallIndex++}`,
+					name: call.name,
+					arguments: JSON.stringify(call.input),
+				})
+			}
+			return flushed
+		}
+
 		try {
 			// Create the response stream with required options
 			const requestOptions: vscode.LanguageModelChatRequestOptions = {
@@ -421,11 +1043,54 @@ export class VsCodeLmHandler extends BaseProvider implements SingleCompletionHan
 					}
 
 					accumulatedText += chunk.value
-					yield {
-						type: "text",
-						text: chunk.value,
+
+					// Fast path: when we didn't offer any tools there is nothing to salvage, so
+					// stream the text straight through exactly as before.
+					if (!salvageLeakedToolCalls) {
+						yield { type: "text", text: chunk.value }
+						continue
+					}
+
+					// Once we've seen the start of a leaked tool-call block, buffer the rest of the
+					// stream so the full markup can be parsed and replayed as a structured call.
+					if (salvageBuffering) {
+						salvageBuffer += chunk.value
+						// Markup that never closes must not withhold the response indefinitely; past the
+						// cap the buffer is released as plain text and buffering stops for the turn.
+						if (salvageBuffer.length > MAX_SALVAGE_BUFFER_CHARS && !hasCompleteInvokeBlock(salvageBuffer)) {
+							const overflowed = salvageBuffer
+							salvageBuffering = false
+							salvageBuffer = ""
+							salvageEmittedText += overflowed
+							yield { type: "text", text: overflowed }
+						}
+						continue
+					}
+
+					// Watch for the start of a leaked tool-call block, carrying a small tail across
+					// chunks so a marker split across chunk boundaries is still detected.
+					const combined = salvageCarry + chunk.value
+					const markerMatch = combined.match(LEAKED_TOOL_CALL_START)
+					if (markerMatch) {
+						const before = combined.slice(0, markerMatch.index)
+						if (before) {
+							salvageEmittedText += before
+							yield { type: "text", text: before }
+						}
+						salvageBuffering = true
+						salvageBuffer = combined.slice(markerMatch.index)
+						salvageCarry = ""
+					} else {
+						const carryLength = trailingPartialToolMarkerLength(combined)
+						const emit = carryLength > 0 ? combined.slice(0, combined.length - carryLength) : combined
+						salvageCarry = carryLength > 0 ? combined.slice(combined.length - carryLength) : ""
+						if (emit) {
+							salvageEmittedText += emit
+							yield { type: "text", text: emit }
+						}
 					}
 				} else if (chunk instanceof vscode.LanguageModelToolCallPart) {
+					yield* flushSalvage()
 					try {
 						// Validate tool call parameters
 						if (!chunk.name || typeof chunk.name !== "string") {
@@ -472,6 +1137,9 @@ export class VsCodeLmHandler extends BaseProvider implements SingleCompletionHan
 				}
 			}
 
+			// Flush any leaked tool-call recovery state accumulated during streaming.
+			yield* flushSalvage()
+
 			// Count tokens in the accumulated text after stream completion
 			const totalOutputTokens: number = await this.internalCountTokens(accumulatedText)
 
diff --git a/src/api/transform/__tests__/vscode-lm-format.spec.ts b/src/api/transform/__tests__/vscode-lm-format.spec.ts
index 3265f2745b..3299fedf4b 100644
--- a/src/api/transform/__tests__/vscode-lm-format.spec.ts
+++ b/src/api/transform/__tests__/vscode-lm-format.spec.ts
@@ -3,7 +3,12 @@
 import { Anthropic } from "@anthropic-ai/sdk"
 import * as vscode from "vscode"
 
-import { convertToVsCodeLmMessages, convertToAnthropicRole, extractTextCountFromMessage } from "../vscode-lm-format"
+import {
+	convertToVsCodeLmMessages,
+	convertToAnthropicRole,
+	extractTextCountFromMessage,
+	sanitizeSurrogates,
+} from "../vscode-lm-format"
 
 // Mock crypto using Vitest
 vitest.stubGlobal("crypto", {
@@ -325,6 +330,97 @@ describe("convertToVsCodeLmMessages", () => {
 	})
 })
 
+describe("sanitizeSurrogates", () => {
+	it("leaves plain ASCII unchanged", () => {
+		expect(sanitizeSurrogates("hello world")).toBe("hello world")
+	})
+
+	it("leaves valid surrogate pairs unchanged", () => {
+		// 😀 U+1F600 and 𐀀 U+10000 are astral-plane code points encoded as surrogate pairs.
+		expect(sanitizeSurrogates("a\uD83D\uDE00b\uD800\uDC00c")).toBe("a\uD83D\uDE00b\uD800\uDC00c")
+	})
+
+	it("replaces a lone high surrogate with U+FFFD", () => {
+		expect(sanitizeSurrogates("a\uD800b")).toBe("a\uFFFDb")
+	})
+
+	it("replaces a lone low surrogate with U+FFFD", () => {
+		expect(sanitizeSurrogates("a\uDC00b")).toBe("a\uFFFDb")
+	})
+
+	it("replaces a trailing lone high surrogate", () => {
+		expect(sanitizeSurrogates("abc\uD800")).toBe("abc\uFFFD")
+	})
+
+	it("replaces a reversed (low-then-high) pair as two lone surrogates", () => {
+		expect(sanitizeSurrogates("\uDC00\uD800")).toBe("\uFFFD\uFFFD")
+	})
+
+	it("returns empty input unchanged", () => {
+		expect(sanitizeSurrogates("")).toBe("")
+	})
+})
+
+describe("convertToVsCodeLmMessages surrogate sanitization", () => {
+	const lone = "bad\uD800end"
+	const sanitized = "bad\uFFFDend"
+
+	const textValues = (message: { content: unknown }) =>
+		(message.content as MockLanguageModelTextPart[]).map((part) => part.value)
+
+	it("sanitizes a simple string message", () => {
+		const result = convertToVsCodeLmMessages([{ role: "user", content: lone }])
+		expect(textValues(result[0])).toEqual([sanitized])
+	})
+
+	it("sanitizes string tool_result content", () => {
+		const result = convertToVsCodeLmMessages([
+			{ role: "user", content: [{ type: "tool_result", tool_use_id: "tool-1", content: lone }] },
+		])
+		const toolResult = result[0].content[0] as MockLanguageModelToolResultPart
+		expect(toolResult.content[0].value).toBe(sanitized)
+	})
+
+	it("sanitizes tool_result text blocks", () => {
+		const result = convertToVsCodeLmMessages([
+			{
+				role: "user",
+				content: [{ type: "tool_result", tool_use_id: "tool-1", content: [{ type: "text", text: lone }] }],
+			},
+		])
+		const toolResult = result[0].content[0] as MockLanguageModelToolResultPart
+		expect(toolResult.content[0].value).toBe(sanitized)
+	})
+
+	it("sanitizes user text blocks", () => {
+		const result = convertToVsCodeLmMessages([{ role: "user", content: [{ type: "text", text: lone }] }])
+		expect(textValues(result[0])).toContain(sanitized)
+	})
+
+	it("sanitizes strings nested in tool_use input", () => {
+		const result = convertToVsCodeLmMessages([
+			{
+				role: "assistant",
+				content: [
+					{
+						type: "tool_use",
+						id: "tool-1",
+						name: "read_file",
+						input: { path: lone, nested: { list: [lone] } },
+					},
+				],
+			},
+		])
+		const toolCall = result[0].content[0] as MockLanguageModelToolCallPart
+		expect(toolCall.input).toEqual({ path: sanitized, nested: { list: [sanitized] } })
+	})
+
+	it("sanitizes assistant text blocks", () => {
+		const result = convertToVsCodeLmMessages([{ role: "assistant", content: [{ type: "text", text: lone }] }])
+		expect(textValues(result[0])).toContain(sanitized)
+	})
+})
+
 describe("convertToAnthropicRole", () => {
 	it("should convert assistant role correctly", () => {
 		const result = convertToAnthropicRole(vscode.LanguageModelChatMessageRole.Assistant)
diff --git a/src/api/transform/vscode-lm-format.ts b/src/api/transform/vscode-lm-format.ts
index 7ac51e024f..e516aaa9ae 100644
--- a/src/api/transform/vscode-lm-format.ts
+++ b/src/api/transform/vscode-lm-format.ts
@@ -28,6 +28,46 @@ function asObjectSafe(value: unknown): object {
 	}
 }
 
+/**
+ * Replaces unpaired UTF-16 surrogate code units with the Unicode replacement character (U+FFFD).
+ *
+ * The VS Code LM backend forwards requests to model APIs that require valid UTF-8. A lone surrogate
+ * — e.g. left behind when some upstream step slices a string through an astral-plane character
+ * (emoji, CJK extension, etc.) — cannot be encoded as UTF-8, so the backend rejects the entire
+ * request with a 400 ("string contains an unpaired UTF-16 surrogate code point and cannot be
+ * encoded as valid UTF-8"). Valid surrogate pairs are matched by the lookahead/lookbehind and left
+ * untouched. The regex intentionally omits the `u` flag so it operates on UTF-16 code units.
+ */
+export function sanitizeSurrogates(text: string): string {
+	if (!text) {
+		return text
+	}
+	return text.replace(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g, "\uFFFD")
+}
+
+/**
+ * Applies {@link sanitizeSurrogates} to every string nested in a tool-call argument object. The
+ * backend rejects the whole request for a lone surrogate anywhere in the JSON payload, so a tool
+ * argument carrying a sliced astral character fails the request just as message text would.
+ */
+function sanitizeSurrogatesDeep(value: unknown): unknown {
+	if (typeof value === "string") {
+		return sanitizeSurrogates(value)
+	}
+	if (Array.isArray(value)) {
+		return value.map(sanitizeSurrogatesDeep)
+	}
+	if (value && typeof value === "object") {
+		return Object.fromEntries(
+			Object.entries(value as Record<string, unknown>).map(([key, nested]) => [
+				sanitizeSurrogates(key),
+				sanitizeSurrogatesDeep(nested),
+			]),
+		)
+	}
+	return value
+}
+
 export function convertToVsCodeLmMessages(
 	anthropicMessages: Anthropic.Messages.MessageParam[],
 ): vscode.LanguageModelChatMessage[] {
@@ -36,10 +76,11 @@ export function convertToVsCodeLmMessages(
 	for (const anthropicMessage of anthropicMessages) {
 		// Handle simple string messages
 		if (typeof anthropicMessage.content === "string") {
+			const safeContent = sanitizeSurrogates(anthropicMessage.content)
 			vsCodeLmMessages.push(
 				anthropicMessage.role === "assistant"
-					? vscode.LanguageModelChatMessage.Assistant(anthropicMessage.content)
-					: vscode.LanguageModelChatMessage.User(anthropicMessage.content),
+					? vscode.LanguageModelChatMessage.Assistant(safeContent)
+					: vscode.LanguageModelChatMessage.User(safeContent),
 			)
 			continue
 		}
@@ -69,7 +110,7 @@ export function convertToVsCodeLmMessages(
 						// Process tool result content into TextParts
 						const toolContentParts: vscode.LanguageModelTextPart[] =
 							typeof toolMessage.content === "string"
-								? [new vscode.LanguageModelTextPart(toolMessage.content)]
+								? [new vscode.LanguageModelTextPart(sanitizeSurrogates(toolMessage.content))]
 								: (toolMessage.content?.map((part) => {
 										if (part.type === "image") {
 											if (part.source.type === "base64") {
@@ -82,7 +123,7 @@ export function convertToVsCodeLmMessages(
 											)
 										}
 										if (part.type === "text") {
-											return new vscode.LanguageModelTextPart(part.text)
+											return new vscode.LanguageModelTextPart(sanitizeSurrogates(part.text))
 										}
 										return new vscode.LanguageModelTextPart("")
 									}) ?? [new vscode.LanguageModelTextPart("")])
@@ -102,7 +143,7 @@ export function convertToVsCodeLmMessages(
 								`[Image (${part.source.type}): not supported by VSCode LM API]`,
 							)
 						}
-						return new vscode.LanguageModelTextPart(part.text)
+						return new vscode.LanguageModelTextPart(sanitizeSurrogates(part.text))
 					}),
 				]
 
@@ -135,7 +176,7 @@ export function convertToVsCodeLmMessages(
 						if (part.type === "image") {
 							return new vscode.LanguageModelTextPart("[Image generation not supported by VSCode LM API]")
 						}
-						return new vscode.LanguageModelTextPart(part.text)
+						return new vscode.LanguageModelTextPart(sanitizeSurrogates(part.text))
 					}),
 
 					// Convert tool messages to ToolCallParts after text
@@ -144,7 +185,7 @@ export function convertToVsCodeLmMessages(
 							new vscode.LanguageModelToolCallPart(
 								toolMessage.id,
 								toolMessage.name,
-								asObjectSafe(toolMessage.input),
+								sanitizeSurrogatesDeep(asObjectSafe(toolMessage.input)) as object,
 							),
 					),
 				]