[ItszFinn]

Problem

The web model occasionally degenerates and emits DSML tool-call markers with a stray character between the fullwidth bars, e.g. <｜触｜DSML｜｜ calls>, or floods bare </｜｜DSML｜｜> closers. These corrupted variants don't match the structured DSML regexes (which expect a clean ｜｜DSML), so they leak straight into the reply text. Seen live via a chat client (a wall of </｜｜DSML｜｜> and <｜触｜DSML｜｜ calls> in the assistant message).

The existing FIX 1–5 handling covers clean decorated/spaced/bare DSML, but not a marker with an unexpected character wedged between the bars.

Fix

A catch-all _FULLWIDTH_PIPE_TAG_RE = re.compile(r"<[^<>]*｜[^<>]*>") that strips any <...> token containing a fullwidth pipe U+FF5C — which never appears in legitimate prose. It runs only in the prose/leftover paths (_strip_stray_markers, _strip_wrapper_tags), i.e. after tool extraction, so real tool calls are unaffected.

• ASCII | is deliberately NOT matched (markdown tables, shell pipes, code stay intact).
• The streaming holdback in StreamToolParser.feed also keeps an unclosed < tail that already contains a U+FF5C, so a corrupted marker split across SSE chunks isn't emitted as prose before the catch-all can strip it.

Tests

Added to tests/test_dsml_leaks.py: corrupted marker in prose, in a single stream chunk, split across 3-char chunks, and an assertion that ASCII | survives. All pass against the patched code.

Update: tool-call arguments too

The corrupted markers also leak inside tool-call argument values — e.g. a path parsed as shell/core/Theme.qml</｜｜DSML｜｜ >, which makes the tool call fail (file not found). Added _clean_tool_arg, applied in normalize_tool_call (all tool calls route through it), so every string argument gets the same fullwidth-pipe catch-all (recurses into dicts/lists; only strings containing U+FF5C are touched; ASCII | preserved). Covered by two more tests.

Update 2: never emit a bare command as message text

Separately, the model sometimes emitted a raw shell command / script as its normal message content (shown to the user, never executed) instead of a tool call — e.g. a bare cd … && python3 - <<'EOF' … EOF. The DSML format block alone did not rule this out, so TOOL_USE_INSTRUCTIONS now carries an explicit directive: to run a shell command, Python or any code the model MUST use a tool call and must never write a command/script/code block as message text. Prompt-level, so it also helps the streaming path.

---

🤖 Generated with Claude Code

[AmanCode22]

@ItszFinn kindly run ruff check also always with pytest as it's failing in your pr .

[AmanCode22]

Merging #91 instead