fix: recover leaked Claude XML tool calls

[code-yeongyu]

Summary

• recover supported bare and exact antml: Claude XML invokes from streamed assistant text
• eagerly emit native tool-call events while preserving native/provider content order, metadata, signatures, usage, IDs, cancellation, and transport semantics
• fail closed for incomplete, invalid, overflowed, aborted, malformed-order, or late-ID-collision calls
• expose tri-state recoverTextToolCalls model configuration and wire both ModelRuntime streaming entry points
• persist recovered calls as native history and replay native Anthropic/OpenAI request structures
• add isolated real-CLI mock-loop modes for complete and truncated leaks on both supported APIs

Scope

• no packages/agent/src/agent-loop.ts changes
• no generated model catalog changes
• no provider implementation/factory changes
• protected provider-composer streamWith() body is byte-identical to main
• historical messages are never scanned or rewritten

Verification

• AI recovery target: 66 filtered tests passed
• Anthropic XML regression: 99 tests passed
• legacy wrapper regression: 12 tests passed
• coding-agent recovery target: 21 filtered tests passed
• final coding-agent serial suite: 467 files / 4,015 tests passed
• non-mutating static gates, browser/web/Neo checks, and AI/agent/coding-agent builds passed
• strict scope auditor: 91 allowlisted feature files, 18 canonical triplets, 21 recorded commits, 38 SHA receipts, clean status

Real CLI QA

All scenarios use localhost fake model servers and isolated sandboxes:

• Anthropic complete leak: PASS, Bash executed exactly once
• OpenAI complete leak: PASS, Bash executed exactly once
• Anthropic truncated leak: PASS, zero execution and re-issue guidance
• OpenAI truncated leak: PASS, zero execution and re-issue guidance
• mock-loop self-test: 38/38 PASS
• real auth SHA-256 unchanged before/after

Evidence is retained locally under local-ignore/qa-evidence/20260720-claude-xml-final-*.

Independent review

• code quality: APPROVE
• security: APPROVE
• hands-on QA: APPROVE
• scope fidelity: APPROVE
• final plan compliance: APPROVE

---

Summary by cubic

Recover leaked Claude XML tool calls from streamed assistant text and emit them as native tool-call events without rewriting history. Wired into ModelRuntime behind a recoverTextToolCalls flag with strict ordering, metadata preservation, and fail-closed safety.

• New Features

  • Recover bare and antml: <invoke> calls from assistant text; eager streaming; excludes code, redacted thinking, and native blocks.
  • Preserve native/provider order, IDs, signatures, usage, and diagnostics; reject malformed native event order and late ID collisions.
  • Handle complete, incomplete, and aborted calls; bounded parsing with code masking; replay recovered calls as native history for Anthropic/OpenAI.
  • Add recoverTextToolCalls (tri-state) on models; default on for Claude IDs and off when a native tool-call format exists; available in models.json and provider extensions.
  • Integrate with both ModelRuntime streaming entry points; add side-effect-free API registry and lazy stream cancellation; add mock-loop CLI modes for complete/truncated leaks on anthropic-messages and openai-completions.

• Bug Fixes

  • Stabilized recovery diagnostics tests by making assertion ordering deterministic.

^{Written for commit 1ead3bb. Summary will update on new commits.}