fix(stream-parser): Strip orphaned </tool_call> tags from streamed output

When Qwen on Albert/vLLM emits `<function=...>...</function></tool_call>`
without an opening `<tool_call>` wrapper, the parser closed on `</function>`
and emitted the trailing `</tool_call>` as visible text. Same leak when the
closing tag arrived in a later SSE chunk, or split as `</to` + `ol_call>`.

- Add `_ORPHANED_CLOSE_RE` to scrub stray `</tool_call>` and `</function>`
  from safe content before emission, in `_drain` and `flush`.
- Add `_CLOSE_PARTIAL_RE` so a trailing partial closing tag is held back
  until the rest arrives.
- After extracting a bare `<function>...</function>` block, consume any
  immediately-following `</tool_call>` silently.
- 5 new tests (`TestXmlToolCallStreamParserOrphanedClose`) covering same
  chunk, separate chunk, split-tag, flush leftover, and trailing text.

Author: obook

albert_code/core/llm/backend/generic.py

@@ -268,6 +268,17 @@ def parse_response(
 _FN_OPEN_PARTIAL_RE = re.compile(
     r"<(?:f(?:u(?:n(?:c(?:t(?:i(?:o(?:n(?:=\w*)?)?)?)?)?)?)?)?)?$"
 )
+# Orphaned closing tags left over after the parser grabs a bare
+# <function=...>...</function> block without its <tool_call> wrapper.
+_ORPHANED_CLOSE_RE = re.compile(r"\s*</(?:tool_call|function)>")
+# Trailing fragment that could be the start of a closing tag once more text
+# arrives.  Matches `</`, `</t`, ..., `</tool_call`, `</f`, ..., `</function`.
+_CLOSE_PARTIAL_RE = re.compile(
+    r"</"
+    r"(?:t(?:o(?:o(?:l(?:_(?:c(?:a(?:l(?:l)?)?)?)?)?)?)?)?|"
+    r"f(?:u(?:n(?:c(?:t(?:i(?:o(?:n)?)?)?)?)?)?)?)?"
+    r"$"
+)
 
 
 class XmlToolCallStreamParser:
@@ -308,8 +319,8 @@ def flush(self) -> tuple[str, list[ToolCall]]:
                 leftover, start_index=self._next_tool_index
             )
             self._next_tool_index += len(tool_calls)
-            return cleaned, tool_calls
-        return leftover, []
+            return _ORPHANED_CLOSE_RE.sub("", cleaned), tool_calls
+        return _ORPHANED_CLOSE_RE.sub("", leftover), []
 
     def _find_open(self) -> tuple[int, str]:
         """Earliest opening marker as (index, kind). Returns (-1, '') if none.
@@ -345,14 +356,20 @@ def _find_close(self, open_kind: str, after: int) -> tuple[int, int]:
             candidates.append((tc_close_idx, len(_TOOL_CALL_CLOSE)))
         return min(candidates) if candidates else (-1, 0)
 
-    def _trailing_partial_open_length(self) -> int:
-        """Length of the trailing fragment that could be the start of an opener."""
+    def _trailing_partial_tag_length(self) -> int:
+        """Length of the trailing fragment that could be the start of any tag."""
         tc_partial = _partial_tag_suffix_length(self._buffer, _TOOL_CALL_OPEN)
         fn_match = _FN_OPEN_PARTIAL_RE.search(self._buffer)
         fn_partial = (
             len(self._buffer) - fn_match.start() if fn_match and fn_match.group() else 0
         )
-        return max(tc_partial, fn_partial)
+        close_match = _CLOSE_PARTIAL_RE.search(self._buffer)
+        close_partial = (
+            len(self._buffer) - close_match.start()
+            if close_match and close_match.group()
+            else 0
+        )
+        return max(tc_partial, fn_partial, close_partial)
 
     def _drain(self) -> tuple[str, list[ToolCall]]:
         safe_parts: list[str] = []
@@ -361,7 +378,7 @@ def _drain(self) -> tuple[str, list[ToolCall]]:
             open_idx, open_kind = self._find_open()
 
             if open_idx < 0:
-                partial = self._trailing_partial_open_length()
+                partial = self._trailing_partial_tag_length()
                 if partial == 0:
                     safe_parts.append(self._buffer)
                     self._buffer = ""
@@ -386,9 +403,15 @@ def _drain(self) -> tuple[str, list[ToolCall]]:
             self._next_tool_index += len(parsed)
             new_calls.extend(parsed)
             self._buffer = self._buffer[end:]
+            # After extracting a bare <function>…</function>, an orphaned
+            # </tool_call> wrapper may remain; consume it silently.
+            stripped = self._buffer.lstrip()
+            if stripped.startswith(_TOOL_CALL_CLOSE):
+                self._buffer = stripped[len(_TOOL_CALL_CLOSE) :]
             continue
 
-        return "".join(safe_parts), new_calls
+        safe_text = _ORPHANED_CLOSE_RE.sub("", "".join(safe_parts))
+        return safe_text, new_calls
 
 
 def _partial_tag_suffix_length(text: str, tag: str) -> int:

tests/backend/test_xml_stream_parser.py

@@ -217,3 +217,71 @@ def test_partial_function_open_released_when_no_match(self) -> None:
         safe, calls = parser.feed("tioning")
         assert calls == []
         assert safe == "<functioning"
+
+
+class TestXmlToolCallStreamParserOrphanedClose:
+    """Coverage for orphaned closing tags that leak into visible output.
+
+    When the model emits <function=...>...</function></tool_call>, the parser
+    grabs the inner <function> block first.  The leftover </tool_call> must
+    be stripped rather than displayed to the user.
+    """
+
+    def test_orphaned_close_after_bare_function_same_chunk(self) -> None:
+        parser = _make_parser()
+        text = (
+            "<function=read_file>"
+            "<parameter=path>README.md</parameter>"
+            "</function>"
+            "\n</tool_call>"
+        )
+        safe, calls = parser.feed(text)
+        assert "</tool_call>" not in safe
+        assert safe.strip() == ""
+        assert len(calls) == 1
+        assert calls[0].function.name == "read_file"
+
+    def test_orphaned_close_arrives_in_separate_chunk(self) -> None:
+        parser = _make_parser()
+        s1, c1 = parser.feed(
+            "<function=read_file><parameter=path>README.md</parameter></function>"
+        )
+        s2, c2 = parser.feed("\n</tool_call>")
+        assert len(c1) == 1
+        assert "</tool_call>" not in s1
+        assert "</tool_call>" not in s2
+
+    def test_orphaned_close_split_across_chunks(self) -> None:
+        """</tool_call> arrives as </to then ol_call>."""
+        parser = _make_parser()
+        parser.feed(
+            "<function=read_file><parameter=path>README.md</parameter></function>"
+        )
+        s1, _ = parser.feed("</to")
+        s2, _ = parser.feed("ol_call>")
+        combined = s1 + s2
+        assert "</tool_call>" not in combined
+        assert combined.strip() == ""
+
+    def test_orphaned_close_in_flush(self) -> None:
+        parser = _make_parser()
+        parser.feed(
+            "<function=read_file><parameter=path>README.md</parameter></function>"
+        )
+        parser.feed("\n</tool_call>")
+        leftover_safe, leftover_calls = parser.flush()
+        assert "</tool_call>" not in leftover_safe
+
+    def test_text_after_orphaned_close_is_preserved(self) -> None:
+        parser = _make_parser()
+        text = (
+            "<function=read_file>"
+            "<parameter=path>README.md</parameter>"
+            "</function>"
+            "</tool_call>"
+            "Now I summarize."
+        )
+        safe, calls = parser.feed(text)
+        assert "Now I summarize." in safe
+        assert "</tool_call>" not in safe
+        assert len(calls) == 1