Fail the turn instead of dispatching truncated tool calls

Author: TheGreatAxios

docs/VENDORING.md

@@ -25,7 +25,7 @@ points straight at `./src/*.ts` files rather than a `dist/` build.
 | Package                                            | Vendor path                           | License       | Synced from upstream commit                | Retrieved  | Local patches                                |
 | -------------------------------------------------- | ------------------------------------- | ------------- | ------------------------------------------ | ---------- | -------------------------------------------- |
 | `@intx/inference`                                  | `vendor/intx-inference/`              | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | Yes — see `vendor/intx-inference/PATCHES.md` |
-| `@intx/types`                                      | `vendor/intx-types/`                  | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim                              |
+| `@intx/types`                                      | `vendor/intx-types/`                  | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | Yes — see `vendor/intx-types/PATCHES.md`     |
 | `@intx/storage-isogit`                             | `vendor/intx-storage-isogit/`         | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim                              |
 | `@intx/agent`                                      | `vendor/intx-agent/`                  | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim                              |
 | `@intx/authz`                                      | `vendor/intx-authz/`                  | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim                              |
@@ -48,7 +48,7 @@ package; the date is the deadline even if it is not.
 | Vendor path                           | Upstream repo           | Upstream commit                            | Patched            | Why not the published package                                                                                                                                   | Owner   | Proposed kill date                                                                         |
 | ------------------------------------- | ----------------------- | ------------------------------------------ | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ------------------------------------------------------------------------------------------ |
 | `vendor/intx-inference/`              | `faremeter/interchange` | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | Yes — `PATCHES.md` | Local fixes not yet upstream                                                                                                                                    | runtime | 2027-03-07 or when patches land upstream and publish                                       |
-| `vendor/intx-types/`                  | `faremeter/interchange` | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | No                 | Cross-package coupling with `@intx/inference`                                                                                                                   | runtime | 2027-03-07 or when the coupled trio publishes past `0.3.0`                                 |
+| `vendor/intx-types/`                  | `faremeter/interchange` | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | Yes — `PATCHES.md` | Cross-package coupling with `@intx/inference`                                                                                                                   | runtime | 2027-03-07 or when the coupled trio publishes past `0.3.0`                                 |
 | `vendor/intx-storage-isogit/`         | `faremeter/interchange` | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | No                 | Cross-package coupling with `@intx/inference`                                                                                                                   | runtime | 2027-03-07 or when the coupled trio publishes past `0.3.0`                                 |
 | `vendor/intx-agent/`                  | `faremeter/interchange` | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | No                 | Vendored at Interchange head ahead of npm                                                                                                                       | runtime | 2027-03-07 or when `@intx/agent@>=0.4.0` publishes                                         |
 | `vendor/intx-authz/`                  | `faremeter/interchange` | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | No                 | Vendored at Interchange head ahead of npm                                                                                                                       | runtime | 2027-03-07 or when `@intx/authz@>=0.4.0` publishes                                         |
@@ -187,10 +187,11 @@ those packages now resolves to the single root instance. As of this sync,
 
 ## Patched vs. verbatim
 
-Of the eleven vendored paths, exactly one carries local patches:
-`@intx/inference` — every divergence is a real fix not yet upstream, listed
-one-per-patch in `vendor/intx-inference/PATCHES.md`. The other ten paths
-(nine whole packages plus the partial `vendor/intx-workflow-host/adapters/`
+Of the eleven vendored paths, exactly two carry local patches:
+`@intx/inference` and `@intx/types` — every divergence is a real fix not
+yet upstream, listed one-per-patch in `vendor/intx-inference/PATCHES.md`
+and `vendor/intx-types/PATCHES.md` respectively. The other nine paths
+(eight whole packages plus the partial `vendor/intx-workflow-host/adapters/`
 tree) are verbatim copies of upstream — no modifications. A diff against a
 pristine upstream checkout at the same commit and paths will show 100%
 upstream-authored lines.

src/plugins/path-escape-plugin.ts

@@ -28,14 +28,6 @@ export function pathEscapePlugin(
 ): ToolPlugin {
   return {
     middleware: (next) => async (call, signal) => {
-      if ("_raw" in call.arguments) {
-        return {
-          callId: call.id,
-          content:
-            "Tool call arguments were malformed JSON (likely truncated). Retry with a smaller payload.",
-          isError: true,
-        };
-      }
       let escaped: Record<string, unknown>;
       try {
         escaped = escapeArgs(

vendor/intx-inference/PATCHES.md

@@ -406,6 +406,37 @@ gap rather than carrying indefinitely.
 the cast can be deleted from the vendored file.
 **Re-carry:** clean three-way at `0205b07b`, zero conflicts. Low risk.
 
+## inference-ts-cl-7783-truncated-tool-call
+
+End-of-stream finalization in `harness.ts` (`finalizeStreamTurn`) never
+dispatches a tool call whose arguments do not parse as a normal call. The
+prior code fell back to a `{ _raw: <partial JSON> }` tool_call block, which
+the reactor dispatched — executing a tool with truncated arguments when the
+model was cut off by `max_tokens` (CL-7783: a truncated `Bash`
+`rm -rf /tm…` fragment reached the executor). Now: when `stopReason` is
+`max_tokens` and a tool call is still open, the turn fails retryably with a
+message naming the tool and the truncated prefix, telling the model to retry
+with a narrower scope; any other unparseable-args case fails retryably as
+invalid JSON. Two supporting changes: `providers/anthropic.ts` parses
+`stop_reason` out of `MessageDelta` (previously stripped by the schema) and
+surfaces it on `inference.usage`, and `vendor/intx-types`' `InferenceUsageEvent`
+gains the optional `stopReason` field both halves flow through. Guarded by the
+CL-7783 regression suite in `providers/anthropic.test.ts`, which drives the
+exact incident wire sequence and asserts no `tool_call` block reaches the
+reactor. The OpenAI-compatible adapter was audited for the same path: it has
+no adapter-local args fallback (the harness was the only dispatch site) but
+still drops `finish_reason` on both paths, so OpenAI streams get the generic
+invalid-JSON failure rather than the truncation-specific message.
+
+**Disposition:** Promotion candidate. Safety/correctness fix — prevents
+executing tools with truncated arguments after a `max_tokens` cutoff.
+**Removal path:** Upstream PR (a) surfacing `stop_reason`/`finish_reason` on
+usage events and (b) failing the turn instead of dispatching unparseable tool
+calls at end-of-stream finalization. **Re-carry:** localized to
+`finalizeStreamTurn`, the `MessageDelta` schema, and one optional event
+field; re-applies against upstream `harness.ts`/`anthropic.ts` unless the
+finalization path is reworked.
+
 ---
 
 ## Upstream promotion ledger
@@ -428,6 +459,7 @@ revisit point is the next vendored sync (see `docs/VENDORING.md`).
 | reactor-ts-after-checkpoint-director-only | Gate `afterCheckpoint` on `hasOverride` so auto-commits do not emit it | Alexander Guy <alexander.guy@pm.me> | This ledger (#reactor-ts-after-checkpoint-director-only) | Next vendored sync |
 | sse-ts-max-line-length | Cap the unterminated SSE line buffer (`MAX_LINE_LENGTH`, 16 MiB) | Alexander Guy <alexander.guy@pm.me> | This ledger (#sse-ts-max-line-length) | Next vendored sync |
 | state-ts-deep-freeze-turns-revision | Make `ReactorState.snapshot().turns` a lazy, revision-tracked getter | Alexander Guy <alexander.guy@pm.me> | This ledger (#state-ts-deep-freeze-turns-revision) | Next vendored sync |
+| inference-ts-cl-7783-truncated-tool-call | Surface `stop_reason`/`finish_reason` on usage events; fail the turn instead of dispatching unparseable tool calls at end-of-stream finalization | Alexander Guy <alexander.guy@pm.me> | This ledger (#inference-ts-cl-7783-truncated-tool-call) | Next vendored sync |
 | google-genai-files-ts-body-init-cast | Widen `BodyInit` to accept Node's `Uint8Array` typing so the cast can be removed | Alexander Guy <alexander.guy@pm.me> | This ledger (#google-genai-files-ts-body-init-cast) | Next vendored sync |
 
 Contact basis: identified from the read-only upstream clone

vendor/intx-inference/src/harness.ts

@@ -316,6 +316,8 @@ async function* runSingleAttempt(
   // capture). Appended to the finalized turn after indexed blocks.
   const unindexedSafetyRatings: SafetyRatingBlock[] = [];
   let usageSeen: TokenUsage | null = null;
+  // Locally patched — see vendor/intx-inference/PATCHES.md#inference-ts-cl-7783-truncated-tool-call
+  let stopReason: string | undefined;
 
   // Tool call state: keyed by callId (or index for OpenAI).
   type ToolCallState = {
@@ -1058,10 +1060,18 @@ async function* runSingleAttempt(
               // synthesizes its own descriptor cannot drift from the
               // call-start identity the rest of the harness commits to.
               usageSeen = mergeUsage(usageSeen, raw.data.usage);
+              // Locally patched — see vendor/intx-inference/PATCHES.md#inference-ts-cl-7783-truncated-tool-call
+              if (raw.data.stopReason !== undefined) {
+                stopReason = raw.data.stopReason;
+              }
               yield {
                 type: "inference.usage",
                 seq: nextSeq(),
-                data: { usage: usageSeen, source: lastCycleSource },
+                data: {
+                  usage: usageSeen,
+                  ...(stopReason === undefined ? {} : { stopReason }),
+                  source: lastCycleSource,
+                },
               };
               break;
             }
@@ -1110,18 +1120,68 @@ async function* runSingleAttempt(
     }
 
     // Finalize any open tool calls that never received an explicit end event.
-    const completedToolCalls: ContentBlock[] = [];
+    // Locally patched — see vendor/intx-inference/PATCHES.md#inference-ts-cl-7783-truncated-tool-call:
+    // validate every open call before emitting any of them, and never
+    // dispatch a call whose arguments are incomplete or unparseable. A turn
+    // cut at max_tokens with calls still open is unambiguous truncation;
+    // anything else unparseable is still not a normal call. Both fail the
+    // turn retryably so the model can re-issue it with room to finish.
+    const finalizedToolCalls: {
+      tc: ToolCallState;
+      parsedArgs: Record<string, unknown>;
+    }[] = [];
     for (const tc of openToolCalls.values()) {
-      let parsedArgs: Record<string, unknown>;
+      if (stopReason === "max_tokens") {
+        yield {
+          type: "inference.error",
+          seq: nextSeq(),
+          data: {
+            error: {
+              category: "retryable",
+              message:
+                `Tool call '${tc.name}' (${tc.callId}) was not executed: the provider ended the turn ` +
+                `at max_tokens while its arguments were still streaming (truncated input). ` +
+                `Retry the turn with a larger max_tokens budget or a smaller request so the full tool call fits.`,
+            },
+            partial: snapshotPartial(partial),
+          },
+        };
+        return;
+      }
+      let parsed: unknown;
       try {
         const raw = tc.argsBuffer.trim() === "" ? "{}" : tc.argsBuffer;
-        const parsed = JSON.parse(raw);
-        const validated = ParsedToolArgs(parsed);
-        parsedArgs = validated instanceof type.errors ? {} : validated;
+        parsed = JSON.parse(raw);
       } catch {
-        parsedArgs = { _raw: tc.argsBuffer };
+        const tail =
+          tc.argsBuffer.length > 200
+            ? `…${tc.argsBuffer.slice(-200)}`
+            : tc.argsBuffer;
+        yield {
+          type: "inference.error",
+          seq: nextSeq(),
+          data: {
+            error: {
+              category: "retryable",
+              message:
+                `Tool call '${tc.name}' (${tc.callId}) was not executed: its streamed arguments are not ` +
+                `valid JSON and cannot be dispatched as a normal call. Re-issue the turn; ` +
+                `partial argument text ends with: ${JSON.stringify(tail)}.`,
+            },
+            partial: snapshotPartial(partial),
+          },
+        };
+        return;
       }
+      const validated = ParsedToolArgs(parsed);
+      finalizedToolCalls.push({
+        tc,
+        parsedArgs: validated instanceof type.errors ? {} : validated,
+      });
+    }
 
+    const completedToolCalls: ContentBlock[] = [];
+    for (const { tc, parsedArgs } of finalizedToolCalls) {
       completedToolCalls.push({
         type: "tool_call",
         id: tc.callId,

vendor/intx-inference/src/providers/anthropic.test.ts

@@ -1260,3 +1260,120 @@ describe("createAnthropicAdapter — streaming vs non-streaming parity", () => {
     expect(jdone?.data.usage).toEqual(sdone?.data.usage);
   });
 });
+
+describe("CL-7783 truncated tool_use", () => {
+  // The exact incident wire sequence: a tool_use block opens, one partial
+  // input_json_delta arrives, then message_delta reports stop_reason
+  // max_tokens and the stream stops — no content_block_stop ever closes
+  // the tool block, so its arguments are unparseable by construction.
+  const TRUNCATED_STREAM = sse([
+    {
+      type: "content_block_start",
+      index: 0,
+      content_block: { type: "tool_use", id: "toolu_trunc", name: "Bash" },
+    },
+    {
+      type: "content_block_delta",
+      index: 0,
+      delta: {
+        type: "input_json_delta",
+        partial_json: '{"command":"rm -rf /tm',
+      },
+    },
+    {
+      type: "message_delta",
+      delta: { stop_reason: "max_tokens" },
+      usage: { output_tokens: 12 },
+    },
+    { type: "message_stop" },
+  ]);
+
+  function errorEvents(events: InferenceEvent[]) {
+    return events.filter(
+      (e): e is Extract<InferenceEvent, { type: "inference.error" }> =>
+        e.type === "inference.error",
+    );
+  }
+
+  function usageEvents(events: InferenceEvent[]) {
+    return events.filter(
+      (e): e is Extract<InferenceEvent, { type: "inference.usage" }> =>
+        e.type === "inference.usage",
+    );
+  }
+
+  test("message_delta stop_reason surfaces on the usage event", async () => {
+    const { events } = await driveTurn(TRUNCATED_STREAM, "text/event-stream");
+    const usage = usageEvents(events);
+    expect(usage.length).toBeGreaterThan(0);
+    expect(usage[usage.length - 1]?.data.stopReason).toBe("max_tokens");
+  });
+
+  test("truncated call fails the turn retryably; no tool_call is dispatched", async () => {
+    const { turn, events } = await driveTurn(
+      TRUNCATED_STREAM,
+      "text/event-stream",
+    );
+    expect(turn).toBeUndefined();
+    expect(events.some((e) => e.type === "inference.done")).toBe(false);
+    expect(
+      events.some((e) => e.type === "inference.tool_call.end"),
+    ).toBe(false);
+    const errors = errorEvents(events);
+    expect(errors).toHaveLength(1);
+    expect(errors[0]?.data.error.category).toBe("retryable");
+    expect(errors[0]?.data.error.message).toContain("max_tokens");
+    expect(errors[0]?.data.error.message).toContain("Bash");
+    expect(errors[0]?.data.error.message).toContain("not executed");
+  });
+
+  test("unparseable args with a non-truncation stop reason still never dispatch", async () => {
+    const body = sse([
+      {
+        type: "content_block_start",
+        index: 0,
+        content_block: { type: "tool_use", id: "toolu_bad", name: "Bash" },
+      },
+      {
+        type: "content_block_delta",
+        index: 0,
+        delta: {
+          type: "input_json_delta",
+          partial_json: '{"command":',
+        },
+      },
+      {
+        type: "message_delta",
+        delta: { stop_reason: "end_turn" },
+        usage: { output_tokens: 12 },
+      },
+      { type: "message_stop" },
+    ]);
+    const { turn, events } = await driveTurn(body, "text/event-stream");
+    expect(turn).toBeUndefined();
+    expect(events.some((e) => e.type === "inference.done")).toBe(false);
+    expect(
+      events.some((e) => e.type === "inference.tool_call.end"),
+    ).toBe(false);
+    const errors = errorEvents(events);
+    expect(errors).toHaveLength(1);
+    expect(errors[0]?.data.error.category).toBe("retryable");
+    expect(errors[0]?.data.error.message).toContain("not valid JSON");
+  });
+
+  test("non-streaming message surfaces top-level stop_reason on usage", async () => {
+    const body = JSON.stringify({
+      type: "message",
+      role: "assistant",
+      model: "claude-test",
+      content: [{ type: "text", text: "Done." }],
+      stop_reason: "end_turn",
+      usage: { input_tokens: 5, output_tokens: 3 },
+    });
+    const { events } = await driveTurn(body, "application/json");
+    expect(events.some((e) => e.type === "inference.error")).toBe(false);
+    const usage = usageEvents(events);
+    expect(usage).toHaveLength(1);
+    expect(usage[0]?.data.stopReason).toBe("end_turn");
+  });
+});

vendor/intx-inference/src/providers/anthropic.ts

@@ -554,6 +554,8 @@ const ContentBlockStop = type({
 
 const MessageDelta = type({
   type: "'message_delta'",
+  // Locally patched — see vendor/intx-inference/PATCHES.md#inference-ts-cl-7783-truncated-tool-call
+  "delta?": { "stop_reason?": "string" },
   "usage?": { "output_tokens?": "number" },
 });
 
@@ -816,11 +818,17 @@ function parseResponse(
         cacheWrite: 0,
         thinking: 0,
       };
+      // Locally patched — see vendor/intx-inference/PATCHES.md#inference-ts-cl-7783-truncated-tool-call
+      const stopReason = event.delta?.stop_reason;
       return [
         {
           type: "inference.usage",
           seq,
-          data: { usage: inferenceUsage, source },
+          data: {
+            usage: inferenceUsage,
+            ...(stopReason === undefined ? {} : { stopReason }),
+            source,
+          },
         },
       ];
     }
@@ -869,6 +877,8 @@ const NonStreamingUsage = type({
 const NonStreamingMessage = type({
   type: "'message'",
   content: "unknown[]",
+  // Locally patched — see vendor/intx-inference/PATCHES.md#inference-ts-cl-7783-truncated-tool-call
+  "stop_reason?": "string",
   usage: NonStreamingUsage,
 });
 
@@ -1064,7 +1074,13 @@ function parseJSONResponse(
   events.push({
     type: "inference.usage",
     seq,
-    data: { usage: toInferenceUsage(message.usage), source },
+    data: {
+      usage: toInferenceUsage(message.usage),
+      ...(message.stop_reason === undefined
+        ? {}
+        : { stopReason: message.stop_reason }),
+      source,
+    },
   });
 
   return events;