diff --git a/scripts/stryker-diff.mjs b/scripts/stryker-diff.mjs
index a69d272d75..c1d6b46f4f 100644
--- a/scripts/stryker-diff.mjs
+++ b/scripts/stryker-diff.mjs
@@ -259,9 +259,19 @@ function git(repoRoot, args) {
 	return execFileSync("git", args, { cwd: repoRoot, encoding: "utf8", maxBuffer: 20 * 1024 * 1024 })
 }
 
+// GitHub checks out the synthetic pull request merge commit, but `pull_request.base.sha` is frozen at
+// event-creation time. When main advances afterwards, that stale base attributes unrelated upstream
+// lines to the pull request. The merge commit's first parent is the base actually merged into.
+export function resolvePullRequestBase(repoRoot, baseSha, headSha) {
+	const parents = git(repoRoot, ["rev-list", "--parents", "-n", "1", headSha]).trim().split(/\s+/).slice(1)
+	if (parents.length < 2) return baseSha
+	return parents[0]
+}
+
 export function selectFromGit(repoRoot, baseSha, headSha) {
 	validateSha(baseSha, "base SHA")
 	validateSha(headSha, "head SHA")
+	baseSha = resolvePullRequestBase(repoRoot, baseSha, headSha)
 	const mergeBase = git(repoRoot, ["merge-base", baseSha, headSha]).trim()
 	const nameStatus = git(repoRoot, ["diff", "--name-status", "-z", "--find-renames", `${mergeBase}...${headSha}`])
 	const entries = parseNameStatus(nameStatus)
diff --git a/scripts/stryker-diff.test.mjs b/scripts/stryker-diff.test.mjs
index 535581ab17..389cb9b583 100644
--- a/scripts/stryker-diff.test.mjs
+++ b/scripts/stryker-diff.test.mjs
@@ -63,6 +63,86 @@ describe("mutation testing workflow", () => {
 	})
 })
 
+function createSyntheticPullRequestRepository() {
+	const repository = fs.mkdtempSync(path.join(os.tmpdir(), "stryker-diff-revision-"))
+	const run = (...args) => execFileSync("git", args, { cwd: repository, encoding: "utf8" }).trim()
+	const write = (filePath, contents) => {
+		fs.mkdirSync(path.join(repository, path.dirname(filePath)), { recursive: true })
+		fs.writeFileSync(path.join(repository, filePath), contents)
+	}
+
+	run("init", "--quiet", "--initial-branch", "main")
+	run("config", "user.email", "gate@example.com")
+	run("config", "user.name", "Gate")
+	run("config", "commit.gpgsign", "false")
+
+	write("packages/core/src/unrelated.ts", "export const unrelated = () => 1\n")
+	write("packages/core/src/feature.ts", "export const feature = () => 1\n")
+	run("add", ".")
+	run("commit", "--quiet", "-m", "initial")
+	const eventBaseSha = run("rev-parse", "HEAD")
+
+	run("checkout", "--quiet", "-b", "pull-request")
+	write("packages/core/src/feature.ts", "export const feature = () => 2\n")
+	run("add", ".")
+	run("commit", "--quiet", "-m", "pull request change")
+
+	// The upstream change lands after the pull_request event recorded its base SHA, which is what
+	// made the stale event base attribute unrelated main-only lines to the pull request.
+	run("checkout", "--quiet", "main")
+	write("packages/core/src/unrelated.ts", "export const unrelated = () => 99\n")
+	run("add", ".")
+	run("commit", "--quiet", "-m", "unrelated upstream change")
+	const upstreamSha = run("rev-parse", "HEAD")
+
+	run("merge", "--quiet", "--no-ff", "-m", "merge pull request", "pull-request")
+	const mergeSha = run("rev-parse", "HEAD")
+
+	return { repository, eventBaseSha, upstreamSha, mergeSha }
+}
+
+describe("pull request revision selection", () => {
+	it("excludes unrelated upstream files by diffing from the merge commit's first parent", () => {
+		const { repository, eventBaseSha, upstreamSha, mergeSha } = createSyntheticPullRequestRepository()
+
+		// A failed assertion must still remove the temporary repository, or a failing run leaks it.
+		try {
+			const manifest = selectFromGit(repository, eventBaseSha, mergeSha)
+			const changedPaths = manifest.packages.flatMap((entry) => entry.files.map((file) => file.path))
+
+			assert.deepEqual(changedPaths, ["packages/core/src/feature.ts"])
+			assert.equal(manifest.baseSha, upstreamSha)
+			assert.equal(manifest.mergeBase, upstreamSha)
+
+			// Selectors must stay aligned with the checked-out head content.
+			assert.equal(manifest.headSha, mergeSha)
+			assert.deepEqual(
+				manifest.packages.flatMap((entry) => entry.selectors),
+				["src/feature.ts:1-1"],
+			)
+		} finally {
+			fs.rmSync(repository, { recursive: true, force: true })
+		}
+	})
+
+	it("keeps the supplied base for non-merge heads such as manual runs", () => {
+		const { repository, eventBaseSha, upstreamSha } = createSyntheticPullRequestRepository()
+
+		try {
+			const manifest = selectFromGit(repository, eventBaseSha, upstreamSha)
+
+			assert.equal(manifest.baseSha, eventBaseSha)
+			assert.equal(manifest.mergeBase, eventBaseSha)
+			assert.deepEqual(
+				manifest.packages.flatMap((entry) => entry.files.map((file) => file.path)),
+				["packages/core/src/unrelated.ts"],
+			)
+		} finally {
+			fs.rmSync(repository, { recursive: true, force: true })
+		}
+	})
+})
+
 describe("parseNameStatus", () => {
 	it("parses added, modified, and renamed paths", () => {
 		assert.deepEqual(
diff --git a/src/api/providers/__tests__/vscode-lm.spec.ts b/src/api/providers/__tests__/vscode-lm.spec.ts
index 423f119f14..666c8e5ce4 100644
--- a/src/api/providers/__tests__/vscode-lm.spec.ts
+++ b/src/api/providers/__tests__/vscode-lm.spec.ts
@@ -16,6 +16,14 @@ vi.mock("vscode", () => {
 		) {}
 	}
 
+	class MockLanguageModelToolResultPart {
+		type = "tool_result"
+		constructor(
+			public callId: string,
+			public content: unknown[],
+		) {}
+	}
+
 	return {
 		workspace: {
 			getConfiguration: vi.fn(() => ({
@@ -53,6 +61,7 @@ vi.mock("vscode", () => {
 		},
 		LanguageModelTextPart: MockLanguageModelTextPart,
 		LanguageModelToolCallPart: MockLanguageModelToolCallPart,
+		LanguageModelToolResultPart: MockLanguageModelToolResultPart,
 		lm: {
 			selectChatModels: vi.fn(),
 		},
@@ -60,12 +69,16 @@ vi.mock("vscode", () => {
 })
 
 import * as vscode from "vscode"
-import { VsCodeLmHandler } from "../vscode-lm"
+import { VsCodeLmHandler, extractLeakedToolCalls, trailingPartialToolMarkerLength } from "../vscode-lm"
 import type { ApiHandlerOptions } from "../../../shared/api"
 import type { Anthropic } from "@anthropic-ai/sdk"
 import { openAiModelInfoSaneDefaults, vscodeLlmDefaultModelId, vscodeLlmModels } from "@roo-code/types"
 
+import { normalizeToolSchema } from "../../../utils/json-schema"
+import { getMcpServerTools } from "../../../core/prompts/tools/native-tools/mcp_server"
+import type { McpHub } from "../../../services/mcp/McpHub"
 import { clearAllMocks } from "../../../test-utils/reset"
+import { collectStream } from "../../../test-utils/stream"
 
 const mockLanguageModelChat = {
 	id: "test-model",
@@ -1077,3 +1090,807 @@ describe("VsCodeLmHandler", () => {
 		})
 	})
 })
+
+describe("leaked tool-call recovery", () => {
+	// Builders keep the XML fixtures readable and prevent this file's own markup from being
+	// mistaken for a real tool call.
+	const invoke = (name: string, body: string) => `<in${"voke"} name="${name}">${body}</in${"voke"}>`
+	const param = (name: string, value: string) => `<param${"eter"} name="${name}">${value}</param${"eter"}>`
+	const wrap = (body: string) => `<function${"_calls"}>${body}</function${"_calls"}>`
+
+	describe("extractLeakedToolCalls", () => {
+		it("recovers a known-tool block and strips it from the leftover text", () => {
+			const text = `Working on it.\n${wrap(invoke("update_todo_list", param("todos", "[x] one\n[ ] two")))}`
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toEqual([{ name: "update_todo_list", input: { todos: "[x] one\n[ ] two" } }])
+			expect(leftoverText).toBe("Working on it.\n")
+		})
+
+		it("recovers a wrapped leak preceded by a stray token", () => {
+			const text = `court\n${wrap(invoke("update_todo_list", param("todos", "[x] done")))}`
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toEqual([{ name: "update_todo_list", input: { todos: "[x] done" } }])
+			expect(leftoverText).toBe("court\n")
+		})
+
+		it("does not recover a bare invoke block with no function_calls wrapper", () => {
+			const text = `court\n${invoke("update_todo_list", param("todos", "[x] done"))}`
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("does not recover an invoke that follows an already-closed wrapper", () => {
+			const text = `${wrap("")}\n${invoke("update_todo_list", param("todos", "[x] done"))}`
+
+			const { calls } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+		})
+
+		it("recovers multiple params and strips function-call wrapper tags", () => {
+			const body = param("mode", "code") + param("message", "go")
+			const text = `<function_calls>${invoke("new_task", body)}</function_calls>`
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["new_task"]))
+
+			expect(calls).toEqual([{ name: "new_task", input: { mode: "code", message: "go" } }])
+			expect(leftoverText).toBe("")
+		})
+
+		it("passes through invoke blocks for tools that were not offered", () => {
+			const text = invoke("some_other_tool", param("x", "1"))
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toEqual([])
+			expect(leftoverText).toBe(text)
+		})
+
+		it("returns no calls for ordinary text", () => {
+			const { calls, leftoverText } = extractLeakedToolCalls("just a normal reply", new Set(["update_todo_list"]))
+
+			expect(calls).toEqual([])
+			expect(leftoverText).toBe("just a normal reply")
+		})
+	})
+
+	describe("trailingPartialToolMarkerLength", () => {
+		it("holds back a split marker prefix at the end of a chunk", () => {
+			expect(trailingPartialToolMarkerLength("some text <in")).toBe(3)
+		})
+
+		it("returns 0 for plain text and complete tags", () => {
+			expect(trailingPartialToolMarkerLength("hello world")).toBe(0)
+			expect(trailingPartialToolMarkerLength("a < b")).toBe(0)
+			expect(trailingPartialToolMarkerLength("text <function_calls>")).toBe(0)
+		})
+
+		it("holds back an invoke tag whose name attribute has not arrived", () => {
+			expect(trailingPartialToolMarkerLength("text <invoke ")).toBe(8)
+		})
+
+		it("does not hold back an over-long trailing fragment", () => {
+			expect(trailingPartialToolMarkerLength("<invoke " + "x".repeat(200))).toBe(0)
+		})
+
+		it("does not hold back an over-long generic tag fragment", () => {
+			expect(trailingPartialToolMarkerLength("text <" + "a".repeat(200))).toBe(0)
+		})
+	})
+
+	describe("quoted markup", () => {
+		it("does not recover an invoke block inside a fenced code block", () => {
+			const text = "```\n" + invoke("update_todo_list", param("todos", "[x] one")) + "\n```"
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("does not recover an invoke block inside an inline code span", () => {
+			const text = "avoid `" + invoke("update_todo_list", param("todos", "x")) + "`"
+
+			const { calls } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+		})
+
+		it("does not recover an invoke block quoted in unfenced, backtick-free prose", () => {
+			const text = "You must never emit " + invoke("update_todo_list", param("todos", "x")) + " directly."
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("does not recover a quoted invoke block that ends its line", () => {
+			// Defect 3: an empty rest-of-line previously made this look like a genuine leak.
+			const text = "You must never emit " + invoke("update_todo_list", param("todos", "x"))
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("does not recover an invoke block inside a tilde fence", () => {
+			const text = "~~~\n" + invoke("update_todo_list", param("todos", "[x] one")) + "\n~~~"
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("does not recover an invoke inside a four-backtick fence containing a three-backtick fence", () => {
+			// A narrower inner fence must not close the wider outer one, so the invoke stays quoted.
+			const text = "````\n```\n" + invoke("update_todo_list", param("todos", "[x] one")) + "\n```\n````"
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("does not recover an invoke inside a tilde fence containing a backtick fence line", () => {
+			const text = "~~~\n```\n" + invoke("update_todo_list", param("todos", "[x] one")) + "\n```\n~~~"
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("recovers an invoke block that follows a closed code fence", () => {
+			const text = "```\nexample output\n```\n" + wrap(invoke("update_todo_list", param("todos", "[x] one")))
+
+			const { calls } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toEqual([{ name: "update_todo_list", input: { todos: "[x] one" } }])
+		})
+
+		it("does not treat doubled angle brackets as trailing prose after stripping", () => {
+			// Defect 1: a single strip pass turns `<<x>>` into a tag-looking `<x>`, so the
+			// trailing-text check must strip repeatedly until stable.
+			const text = wrap(invoke("update_todo_list", param("todos", "x")) + "<<script>>")
+
+			const { calls } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toEqual([{ name: "update_todo_list", input: { todos: "x" } }])
+		})
+
+		it("keeps wrapper tags around a block that was not recovered", () => {
+			const text = `<function_calls>${invoke("some_other_tool", param("x", "1"))}</function_calls>`
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+	})
+
+	// The bare-invoke cases above short-circuit at the wrapper check, so they never exercise the
+	// quoting guards. These keep the wrapper open so each guard is actually reached.
+	describe("quoted markup inside an open function_calls wrapper", () => {
+		const tools = new Set(["update_todo_list"])
+		const quoted = (body: string) => `<function${"_calls"}>\n${body}`
+
+		it("suppresses an invoke inside a three-backtick fence", () => {
+			const block = invoke("update_todo_list", param("todos", "[x] one"))
+			const text = quoted("```\n" + block + "\n```")
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, tools)
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("suppresses an invoke inside a tilde fence", () => {
+			const block = invoke("update_todo_list", param("todos", "[x] one"))
+			const text = quoted("~~~\n" + block + "\n~~~")
+
+			const { calls } = extractLeakedToolCalls(text, tools)
+
+			expect(calls).toHaveLength(0)
+		})
+
+		it("suppresses an invoke inside a four-backtick fence containing a narrower fence", () => {
+			const block = invoke("update_todo_list", param("todos", "[x] one"))
+			const text = quoted("````\n```\n" + block + "\n```\n````")
+
+			const { calls } = extractLeakedToolCalls(text, tools)
+
+			expect(calls).toHaveLength(0)
+		})
+
+		it("recovers an invoke that follows a CLOSED fence, proving the fence guard reopens", () => {
+			const text = quoted("```\nexample\n```\n" + invoke("update_todo_list", param("todos", "[x] one")))
+
+			const { calls } = extractLeakedToolCalls(text, tools)
+
+			expect(calls).toEqual([{ name: "update_todo_list", input: { todos: "[x] one" } }])
+		})
+
+		it("suppresses an invoke inside an inline code span", () => {
+			const text = quoted("avoid `" + invoke("update_todo_list", param("todos", "x")) + "`")
+
+			const { calls } = extractLeakedToolCalls(text, tools)
+
+			expect(calls).toHaveLength(0)
+		})
+
+		it("suppresses an invoke introduced by a quoting cue that ends its line", () => {
+			const text = quoted("You must never emit " + invoke("update_todo_list", param("todos", "x")))
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, tools)
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("suppresses an invoke followed by narrative text on the same line", () => {
+			const text = quoted(invoke("update_todo_list", param("todos", "x")) + " is what you must not do.")
+
+			const { calls } = extractLeakedToolCalls(text, tools)
+
+			expect(calls).toHaveLength(0)
+		})
+	})
+
+	describe("schema-aware recovered parameters", () => {
+		const schemas = new Map<string, Record<string, unknown> | undefined>([
+			[
+				"update_todo_list",
+				{ type: "object", properties: { todos: { type: "array" }, note: { type: "string" } } },
+			],
+			[
+				"read_file",
+				{
+					type: "object",
+					properties: {
+						path: { type: "string" },
+						indentation: { type: "object" },
+						limit: { type: "integer" },
+						ratio: { type: "number" },
+						recursive: { type: "boolean" },
+						optional: { type: ["object", "null"] },
+						nullScalar: { type: "null" },
+						nullUnion: { type: ["null"] },
+					},
+				},
+			],
+		])
+
+		it("converts a declared array parameter into a real array", () => {
+			const text = wrap(invoke("update_todo_list", param("todos", '["a","b"]')))
+
+			const { calls } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toEqual([{ name: "update_todo_list", input: { todos: ["a", "b"] } }])
+		})
+
+		it("converts declared object, number, integer and boolean parameters", () => {
+			const body =
+				param("path", "src/app.ts") +
+				param("indentation", '{"anchor_line":42}') +
+				param("limit", "10") +
+				param("ratio", "1.5") +
+				param("recursive", "true")
+			const { calls } = extractLeakedToolCalls(wrap(invoke("read_file", body)), schemas)
+
+			expect(calls).toEqual([
+				{
+					name: "read_file",
+					input: {
+						path: "src/app.ts",
+						indentation: { anchor_line: 42 },
+						limit: 10,
+						ratio: 1.5,
+						recursive: true,
+					},
+				},
+			])
+		})
+
+		it("resolves a nullable union to its non-null type", () => {
+			const text = wrap(invoke("read_file", param("optional", '{"a":1}')))
+
+			const { calls } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toEqual([{ name: "read_file", input: { optional: { a: 1 } } }])
+		})
+
+		it("accepts an explicit null for a nullable union parameter", () => {
+			const text = wrap(invoke("read_file", param("optional", "null")))
+
+			const { calls } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toEqual([{ name: "read_file", input: { optional: null } }])
+			expect(Object.keys(calls[0].input)).toContain("optional")
+			expect(calls[0].input.optional).toBeNull()
+		})
+
+		it("fails closed when a non-nullable object parameter is null", () => {
+			const text = wrap(invoke("read_file", param("indentation", "null")))
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("accepts an explicit null for a scalar null-only parameter", () => {
+			const text = wrap(invoke("read_file", param("nullScalar", "null")))
+
+			const { calls } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toEqual([{ name: "read_file", input: { nullScalar: null } }])
+			expect(calls[0].input.nullScalar).toBeNull()
+		})
+
+		it("accepts an explicit null for a single-entry null union parameter", () => {
+			const text = wrap(invoke("read_file", param("nullUnion", "null")))
+
+			const { calls } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toEqual([{ name: "read_file", input: { nullUnion: null } }])
+			expect(calls[0].input.nullUnion).toBeNull()
+		})
+
+		it("fails closed when a scalar null-only parameter carries a non-null value", () => {
+			const text = wrap(invoke("read_file", param("nullScalar", '{"a":1}')))
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("fails closed when a single-entry null union parameter carries a non-null value", () => {
+			const text = wrap(invoke("read_file", param("nullUnion", "123")))
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("keeps a declared string parameter as the literal text null", () => {
+			const text = wrap(invoke("read_file", param("path", "null")))
+
+			const { calls } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toEqual([{ name: "read_file", input: { path: "null" } }])
+		})
+
+		it("keeps a declared string parameter literal even when it looks like JSON", () => {
+			const text = wrap(invoke("update_todo_list", param("note", "123")))
+
+			const { calls } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toEqual([{ name: "update_todo_list", input: { note: "123" } }])
+		})
+
+		it("keeps every parameter literal when no schemas are supplied", () => {
+			const text = wrap(invoke("update_todo_list", param("todos", '["a"]')))
+
+			const { calls } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toEqual([{ name: "update_todo_list", input: { todos: '["a"]' } }])
+		})
+
+		it("fails closed to unchanged text when a structured parameter is not valid JSON", () => {
+			const text = wrap(invoke("update_todo_list", param("todos", "[x] not json")))
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("fails closed when a parsed value has the wrong type for its schema", () => {
+			const text = wrap(invoke("update_todo_list", param("todos", '{"a":1}')))
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("still requires the function_calls wrapper for a schema-typed call", () => {
+			const text = invoke("update_todo_list", param("todos", '["a"]'))
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, schemas)
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+	})
+})
+
+// The MCP path normalizes dynamic server schemas before they reach the provider, so these fixtures
+// must come from the real normalizer rather than a hand-written guess at its output shape.
+describe("recovered parameters for normalized MCP schemas", () => {
+	const invoke = (name: string, body: string) => `<in${"voke"} name="${name}">${body}</in${"voke"}>`
+	const param = (name: string, value: string) => `<param${"eter"} name="${name}">${value}</param${"eter"}>`
+	const wrap = (body: string) => `<function${"_calls"}>${body}</function${"_calls"}>`
+
+	const normalized = normalizeToolSchema({
+		type: "object",
+		properties: {
+			tags: { type: ["array", "null"], items: { type: "string" } },
+			options: { type: ["object", "null"], properties: { deep: { type: "string" } } },
+			limit: { type: ["integer", "null"] },
+			note: { type: ["string", "null"] },
+		},
+		required: ["tags"],
+	}) as Record<string, unknown>
+
+	const schemas = new Map<string, Record<string, unknown> | undefined>([["mcp_server_search", normalized]])
+
+	const recover = (body: string) => extractLeakedToolCalls(wrap(invoke("mcp_server_search", body)), schemas).calls
+
+	it("emits typed alternatives rather than a plain type for nullable properties", () => {
+		const properties = normalized.properties as Record<string, Record<string, unknown>>
+		expect(properties.tags.type).toBeUndefined()
+		expect(properties.tags.anyOf).toEqual([{ type: "array", items: { type: "string" } }, { type: "null" }])
+	})
+
+	it("converts a nullable array parameter to a real array", () => {
+		expect(recover(param("tags", '["a","b"]'))).toEqual([
+			{ name: "mcp_server_search", input: { tags: ["a", "b"] } },
+		])
+	})
+
+	it("converts a nullable object parameter to a real object", () => {
+		expect(recover(param("options", '{"deep":"x"}'))).toEqual([
+			{ name: "mcp_server_search", input: { options: { deep: "x" } } },
+		])
+	})
+
+	it("converts a nullable integer parameter to a number", () => {
+		expect(recover(param("limit", "5"))).toEqual([{ name: "mcp_server_search", input: { limit: 5 } }])
+	})
+
+	it("accepts an explicit null for a nullable alternative", () => {
+		expect(recover(param("tags", "null"))).toEqual([{ name: "mcp_server_search", input: { tags: null } }])
+	})
+
+	it("keeps a nullable string alternative literal", () => {
+		expect(recover(param("note", "123"))).toEqual([{ name: "mcp_server_search", input: { note: "123" } }])
+	})
+
+	it("rejects a malformed value for a nullable array alternative", () => {
+		const text = wrap(invoke("mcp_server_search", param("tags", "[not json")))
+		const { calls, leftoverText } = extractLeakedToolCalls(text, schemas)
+
+		expect(calls).toHaveLength(0)
+		expect(leftoverText).toBe(text)
+	})
+
+	it("rejects a well-formed value of the wrong type for a nullable array alternative", () => {
+		expect(recover(param("tags", '{"a":1}'))).toHaveLength(0)
+	})
+
+	it("leaves a mixed non-null union unresolved so no alternative is guessed", () => {
+		const mixed = normalizeToolSchema({
+			type: "object",
+			properties: { value: { type: ["array", "number"] } },
+		}) as Record<string, unknown>
+		const mixedSchemas = new Map<string, Record<string, unknown> | undefined>([["mcp_server_search", mixed]])
+		const text = wrap(invoke("mcp_server_search", param("value", "[1]")))
+
+		expect(extractLeakedToolCalls(text, mixedSchemas).calls).toEqual([
+			{ name: "mcp_server_search", input: { value: "[1]" } },
+		])
+	})
+
+	it("routes a schema built by the MCP tool builder through the same conversion", () => {
+		const mcpHub = {
+			getServers: () => [
+				{
+					name: "server",
+					tools: [
+						{
+							name: "search",
+							inputSchema: {
+								type: "object",
+								properties: { tags: { type: ["array", "null"], items: { type: "string" } } },
+							},
+						},
+					],
+				},
+			],
+		} as unknown as McpHub
+
+		const [tool] = getMcpServerTools(mcpHub)
+		if (tool.type !== "function") {
+			throw new Error("expected a function tool")
+		}
+		const { name, parameters } = tool.function
+		const builderSchemas = new Map<string, Record<string, unknown> | undefined>([
+			[name, parameters as Record<string, unknown>],
+		])
+		const text = wrap(invoke(name, param("tags", '["a"]')))
+
+		expect(extractLeakedToolCalls(text, builderSchemas).calls).toEqual([{ name, input: { tags: ["a"] } }])
+	})
+})
+
+describe("leaked tool-call parser contracts", () => {
+	const invoke = (name: string, body: string) => `<in${"voke"} name="${name}">${body}</in${"voke"}>`
+	const param = (name: string, value: string) => `<param${"eter"} name="${name}">${value}</param${"eter"}>`
+	const wrap = (body: string) => `<function${"_calls"}>${body}</function${"_calls"}>`
+	// The fence in a quoting fixture must begin a line, so the wrapper opens on its own line.
+	const wrapLines = (body: string) => `<function${"_calls"}>\n${body}\n</function${"_calls"}>`
+
+	const tools = new Set(["update_todo_list"])
+	const callsOf = (text: string) => extractLeakedToolCalls(text, tools).calls
+	const todo = (value = "x") => invoke("update_todo_list", param("todos", value))
+
+	const schemaFor = (properties: Record<string, unknown>) =>
+		new Map<string, Record<string, unknown> | undefined>([["update_todo_list", { properties }]])
+	const convert = (properties: Record<string, unknown>, raw: string) =>
+		extractLeakedToolCalls(wrap(invoke("update_todo_list", param("value", raw))), schemaFor(properties)).calls
+
+	describe("wrapper discrimination", () => {
+		it("requires whitespace between invoke and its name attribute", () => {
+			const glued = `<function${"_calls"}><in${"voke"}name="update_todo_list"></in${"voke"}></function${"_calls"}>`
+
+			expect(callsOf(glued)).toHaveLength(0)
+		})
+
+		it("tolerates a newline between invoke and its name attribute", () => {
+			const spaced = wrap(`<in${"voke"}\n name="update_todo_list">${param("todos", "x")}</in${"voke"}>`)
+
+			expect(callsOf(spaced)).toHaveLength(1)
+		})
+
+		it("does not recover an unterminated name attribute", () => {
+			expect(callsOf(wrap(`<in${"voke"} name="update_todo_list>x</in${"voke"}>`))).toHaveLength(0)
+		})
+
+		it("does not recover an empty name attribute", () => {
+			expect(callsOf(wrap(invoke("", param("todos", "x"))))).toHaveLength(0)
+		})
+
+		it("recovers after an unrelated closed wrapper", () => {
+			expect(callsOf(`${wrap("")}\n${wrap(todo())}`)).toHaveLength(1)
+		})
+
+		it("arms on an opening wrapper tag carrying inner whitespace", () => {
+			expect(callsOf(`<function${"_calls"} >${todo()}`)).toHaveLength(1)
+		})
+
+		it("disarms on a closing wrapper tag carrying inner whitespace", () => {
+			expect(callsOf(`<function${"_calls"}></function${"_calls"} >${todo()}`)).toHaveLength(0)
+		})
+	})
+
+	describe("fence and quote discrimination", () => {
+		it("keeps a fence indented three spaces open", () => {
+			expect(callsOf(wrapLines("   ```\n" + todo()))).toHaveLength(0)
+		})
+
+		it("does not open a fence indented four spaces", () => {
+			expect(callsOf(wrapLines("    ```\n" + todo()))).toHaveLength(1)
+		})
+
+		it("requires a fence to begin its line", () => {
+			expect(callsOf(wrapLines("text ```\n" + todo()))).toHaveLength(1)
+		})
+
+		it("does not close a wide fence with a narrower one", () => {
+			expect(callsOf(wrapLines("````\n```\n" + todo() + "\n"))).toHaveLength(0)
+		})
+
+		it("closes a fence of equal width", () => {
+			expect(callsOf(wrapLines("```\ncode\n```\n" + todo()))).toHaveLength(1)
+		})
+
+		it("does not close a tilde fence with a backtick fence", () => {
+			expect(callsOf(wrapLines("~~~\n```\n" + todo() + "\n"))).toHaveLength(0)
+		})
+
+		it("suppresses on an odd backtick count earlier in the line", () => {
+			expect(callsOf(wrapLines("see `" + todo()))).toHaveLength(0)
+		})
+
+		it("does not suppress on an even backtick count", () => {
+			expect(callsOf(wrapLines("see `x` " + todo()))).toHaveLength(1)
+		})
+
+		it("does not suppress on trailing whitespace alone", () => {
+			expect(callsOf(wrapLines(todo() + "   "))).toHaveLength(1)
+		})
+
+		it("does not suppress on trailing residual tags alone", () => {
+			expect(callsOf(wrapLines(todo() + "<<>>"))).toHaveLength(1)
+		})
+
+		it("stops applying a quoting cue after sentence punctuation", () => {
+			expect(callsOf(wrapLines("Never do that. Now " + todo()))).toHaveLength(1)
+		})
+
+		it("does not suppress on ordinary narration", () => {
+			expect(callsOf(wrapLines("Working on it now " + todo()))).toHaveLength(1)
+		})
+	})
+
+	describe("schema-directed conversion boundaries", () => {
+		it("rejects a float for a declared integer", () => {
+			expect(convert({ value: { type: "integer" } }, "1.5")).toHaveLength(0)
+		})
+
+		it("rejects a non-finite number", () => {
+			expect(convert({ value: { type: "number" } }, "1e400")).toHaveLength(0)
+		})
+
+		it("rejects an array for a declared object", () => {
+			expect(convert({ value: { type: "object" } }, "[]")).toHaveLength(0)
+		})
+
+		it("leaves an ambiguous multi-type union literal", () => {
+			expect(convert({ value: { type: ["array", "object"] } }, '["a"]')[0].input).toEqual({ value: '["a"]' })
+		})
+
+		it("fails a block closed for an unsupported declared type", () => {
+			expect(convert({ value: { type: "date" } }, "x")).toHaveLength(0)
+		})
+
+		it("does not treat an inherited Object.prototype key as a supported type", () => {
+			expect(convert({ value: { type: "toString" } }, "x")).toHaveLength(0)
+		})
+
+		it("bails out on a null anyOf branch", () => {
+			expect(convert({ value: { anyOf: [null] } }, '["a"]')[0].input).toEqual({ value: '["a"]' })
+		})
+
+		it("trims a parameter value", () => {
+			expect(callsOf(wrap(invoke("update_todo_list", param("todos", "  spaced  "))))[0].input).toEqual({
+				todos: "spaced",
+			})
+		})
+
+		it("parses a whitespace-padded JSON array", () => {
+			expect(convert({ value: { type: "array" } }, '  ["a"]  ')[0].input).toEqual({ value: ["a"] })
+		})
+
+		it("rejects a number for a declared object", () => {
+			expect(convert({ value: { type: "object" } }, "5")).toHaveLength(0)
+		})
+
+		it("rejects a number for a declared boolean", () => {
+			expect(convert({ value: { type: "boolean" } }, "5")).toHaveLength(0)
+		})
+
+		it("fails a block closed when an unsupported declared type carries parseable JSON", () => {
+			expect(convert({ value: { type: "date" } }, "5")).toHaveLength(0)
+		})
+
+		it("ignores a non-string member of a declared type union", () => {
+			expect(convert({ value: { type: ["array", 5] } }, '["a"]')[0].input).toEqual({ value: ["a"] })
+		})
+	})
+
+	describe("carry boundaries", () => {
+		it("holds a generic fragment of exactly the carry bound", () => {
+			expect(trailingPartialToolMarkerLength("<" + "a".repeat(63))).toBe(64)
+		})
+
+		it("drops a generic fragment one character past the bound", () => {
+			expect(trailingPartialToolMarkerLength("<" + "a".repeat(64))).toBe(0)
+		})
+
+		it("holds an invoke tail of exactly the carry bound", () => {
+			expect(trailingPartialToolMarkerLength("<invoke " + "x".repeat(56))).toBe(64)
+		})
+
+		it("drops an invoke tail one character past the bound", () => {
+			expect(trailingPartialToolMarkerLength("<invoke " + "x".repeat(57))).toBe(0)
+		})
+	})
+
+	describe("preceding text and leftover segments", () => {
+		it("positions the quote window using preceding text", () => {
+			const { calls } = extractLeakedToolCalls(todo(), tools, `<function${"_calls"}>`)
+
+			expect(calls).toHaveLength(1)
+		})
+
+		it("suppresses on a fence opened in an earlier chunk", () => {
+			const { calls } = extractLeakedToolCalls(todo(), tools, `<function${"_calls"}>\n\`\`\`\n`)
+
+			expect(calls).toHaveLength(0)
+		})
+
+		it("keeps text that follows a recovered call", () => {
+			expect(extractLeakedToolCalls(`${wrap(todo())}\nAfterwards.`, tools).leftoverText).toBe("\nAfterwards.")
+		})
+
+		it("strips a closing wrapper tag carrying inner whitespace", () => {
+			const text = `<function${"_calls"}>${todo()}</function${"_calls"} >`
+
+			expect(extractLeakedToolCalls(text, tools).leftoverText).toBe("")
+		})
+
+		it("recovers two calls from one wrapper", () => {
+			const { calls } = extractLeakedToolCalls(wrap(`${todo("a")}\n${todo("b")}`), tools)
+
+			expect(calls.map((call) => call.input.todos)).toEqual(["a", "b"])
+		})
+
+		// Two recoveries put a non-last placeholder segment in the middle of the array, where both the
+		// placeholder seeding and the last-segment lookup can silently reorder or leak text.
+		it("keeps interleaved text in order across two recovered calls", () => {
+			const text = `${wrap(`${todo("a")}\nmid\n${todo("b")}`)}\ntail`
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, tools)
+
+			expect(calls.map((call) => call.input.todos)).toEqual(["a", "b"])
+			expect(leftoverText).toBe("\nmid\n\ntail")
+		})
+	})
+
+	// Tag shapes a real backend varies on: whitespace inside the tags, and the `antml:` prefix.
+	describe("tag whitespace tolerance", () => {
+		it("recovers an invoke whose opening tag has whitespace before the closing bracket", () => {
+			const spaced = `<in${"voke"} name="update_todo_list" >${param("todos", "x")}</in${"voke"}>`
+
+			expect(callsOf(wrap(spaced))[0].input).toEqual({ todos: "x" })
+		})
+
+		it("recovers an invoke whose closing tag has whitespace before the bracket", () => {
+			const spaced = `<in${"voke"} name="update_todo_list">${param("todos", "x")}</in${"voke"} >`
+
+			expect(callsOf(wrap(spaced))[0].input).toEqual({ todos: "x" })
+		})
+
+		it("keeps a parameter whose closing tag has whitespace before the bracket", () => {
+			const body = `<param${"eter"} name="todos">x</param${"eter"} >`
+			const text = wrap(`<in${"voke"} name="update_todo_list">${body}</in${"voke"}>`)
+
+			expect(callsOf(text)[0].input).toEqual({ todos: "x" })
+		})
+
+		it("reads a parameter name separated by more than one whitespace character", () => {
+			const body = `<param${"eter"}\t\tname="todos">x</param${"eter"}>`
+			const text = wrap(`<in${"voke"} name="update_todo_list">${body}</in${"voke"}>`)
+
+			expect(callsOf(text)[0].input).toEqual({ todos: "x" })
+		})
+
+		it("arms on a reopened wrapper whose tag carries inner whitespace", () => {
+			const text = `${wrap("")}\n<function${"_calls"} >\n${todo()}`
+
+			expect(callsOf(text)).toHaveLength(1)
+		})
+
+		it("treats a tilde run shorter than three characters as ordinary text, not a fence", () => {
+			expect(callsOf(`<function${"_calls"}>\n~\n${todo()}`)).toHaveLength(1)
+		})
+	})
+
+	describe("chunk-boundary positioning", () => {
+		it("does not hold back an invoke tag that already closed earlier in the chunk", () => {
+			expect(trailingPartialToolMarkerLength("mid <invoke tail> more")).toBe(0)
+		})
+
+		it("locates the quoting cue relative to the preceding chunk, not its mirror image", () => {
+			// The window offset is preceding.length + match.index; subtracting instead lands on an
+			// earlier, cue-free slice and wrongly recovers the quoted block.
+			const { calls } = extractLeakedToolCalls(`see \`${todo()}`, tools, `<function${"_calls"}>`)
+
+			expect(calls).toHaveLength(0)
+		})
+	})
+})
diff --git a/src/api/providers/vscode-lm.ts b/src/api/providers/vscode-lm.ts
index 62bcbf0c27..06d05260a3 100644
--- a/src/api/providers/vscode-lm.ts
+++ b/src/api/providers/vscode-lm.ts
@@ -14,7 +14,7 @@ import type { ApiHandlerOptions } from "../../shared/api"
 import { SELECTOR_SEPARATOR, stringifyVsCodeLmModelSelector } from "../../shared/vsCodeSelectorUtils"
 import { normalizeToolSchema } from "../../utils/json-schema"
 
-import { ApiStream } from "../transform/stream"
+import { ApiStream, ApiStreamChunk } from "../transform/stream"
 import { convertToVsCodeLmMessages, extractTextCountFromMessage } from "../transform/vscode-lm-format"
 
 import { BaseProvider } from "./base-provider"
@@ -66,6 +66,321 @@ function convertToVsCodeLmTools(tools: OpenAI.Chat.ChatCompletionTool[]): vscode
  * }
  * ```
  */
+/**
+ * Recovery for leaked tool calls
+ * ------------------------------
+ * Some VS Code LM backends — notably GitHub Copilot serving Anthropic Claude models —
+ * intermittently stream a tool call as PLAIN TEXT using Anthropic's internal function-call
+ * XML instead of emitting a structured `LanguageModelToolCallPart`. When this happens the
+ * assistant turn contains no tool_use block, so Zoo reports "no tools used" and the task stalls
+ * in a retry loop. The helpers below detect the leaked markup mid-stream and replay it as a real
+ * tool call. Recovery is deliberately conservative: only `<invoke>` blocks whose name matches a
+ * tool we actually offered this turn are treated as calls; everything else is passed through
+ * unchanged as text.
+ *
+ * SCOPE: only the WRAPPED variant — an `<invoke>` inside an open `<function_calls>` wrapper — is
+ * recovered. A bare, unwrapped `<invoke>` is deliberately left as text: we have no observation of
+ * this backend emitting one, while quoted examples and prompt-injected file content routinely
+ * contain bare markup, so passing it through is the safer default rather than a security boundary.
+ * Widening to the bare case needs a reproduction first.
+ */
+/** Upper bound on an incomplete `<invoke ...` tail held back between chunks. */
+const MAX_PARTIAL_INVOKE_CARRY = 64
+
+/**
+ * True when `before` ends inside an open Markdown code fence. Tracks the fence character and its
+ * width so tilde fences and fences of 4+ backticks (which may legally contain shorter fences) are
+ * recognized, rather than counting three-backtick runs for parity.
+ */
+function isInsideCodeFence(before: string): boolean {
+	let openFence: { marker: string; width: number } | null = null
+	for (const line of before.split("\n")) {
+		const fenceMatch = line.match(/^ {0,3}(`{3,}|~{3,})/)
+		if (!fenceMatch) {
+			continue
+		}
+		const marker = fenceMatch[1][0]
+		const width = fenceMatch[1].length
+		if (!openFence) {
+			openFence = { marker, width }
+		} else if (marker === openFence.marker && width >= openFence.width) {
+			openFence = null
+		}
+	}
+	return openFence !== null
+}
+
+/**
+ * Strips well-formed tags repeatedly until the result stops changing. A single pass is unsafe:
+ * `<<invoke>>` reassembles into a live-looking tag after one replacement.
+ */
+function stripTagsCompletely(text: string): string {
+	let current = text
+	for (;;) {
+		const stripped = current.replace(/<[^<>]*>/g, "")
+		if (stripped === current) {
+			return stripped
+		}
+		current = stripped
+	}
+}
+
+/**
+ * Returns the length of a trailing fragment that might be the start of a leaked tool-call marker
+ * split across stream chunks. Such a tail is held back until more text arrives so the marker can
+ * be detected intact.
+ */
+export function trailingPartialToolMarkerLength(text: string): number {
+	const partialTag = text.match(/<(?:antml:)?[a-zA-Z_]*$/)
+	if (partialTag) {
+		return partialTag[0].length <= MAX_PARTIAL_INVOKE_CARRY ? partialTag[0].length : 0
+	}
+	// An `<invoke` whose `name="` attribute hasn't arrived yet: hold it back so the marker can
+	// latch on the next chunk, bounded so ordinary prose is never swallowed.
+	const partialInvoke = text.match(/<(?:antml:)?invoke\b[^<>]*$/i)
+	return partialInvoke && partialInvoke[0].length <= MAX_PARTIAL_INVOKE_CARRY ? partialInvoke[0].length : 0
+}
+
+/**
+ * True when an unclosed `<function_calls>` wrapper is open at the end of `before`.
+ *
+ * Every wrapped-leak sample we have came with this wrapper, and the quoted-in-prose cases were
+ * bare, making the wrapper the sharpest discriminator available. Requiring it keeps untrusted bare
+ * `<invoke>` markup — which a prompt-injected file or a quoted example can contain — from becoming
+ * a real call. It is a heuristic filter, not a security boundary.
+ */
+function isInsideFunctionCallsWrapper(before: string): boolean {
+	const lastOpen = before.search(/<(?:antml:)?function_calls\s*>(?![\s\S]*<(?:antml:)?function_calls\s*>)/i)
+	if (lastOpen === -1) {
+		return false
+	}
+	return !/<\/(?:antml:)?function_calls\s*>/i.test(before.slice(lastOpen))
+}
+
+/**
+ * True when the block spanning `[index, endIndex)` is being quoted — inside a fenced code block,
+ * inside an inline code span, or embedded mid-sentence in plain prose — rather than invoked.
+ */
+function isQuotedAsCode(text: string, index: number, endIndex: number): boolean {
+	const before = text.slice(0, index)
+	if (isInsideCodeFence(before)) {
+		return true
+	}
+	const lineStart = before.lastIndexOf("\n") + 1
+	const sameLineBefore = before.slice(lineStart)
+	if ((sameLineBefore.match(/`/g)?.length ?? 0) % 2 === 1) {
+		return true
+	}
+	// Narrative words after the block on the same line mean the markup is being talked about
+	// (e.g. "never emit <invoke ...> directly"), which must not be replayed as a live call.
+	const after = text.slice(endIndex)
+	const lineEnd = after.indexOf("\n")
+	const restOfLine = lineEnd === -1 ? after : after.slice(0, lineEnd)
+	if (stripTagsCompletely(restOfLine).trim().length > 0) {
+		return true
+	}
+	// A quoted invoke that ENDS its line leaves no trailing text to judge, and a real leak is
+	// commonly narrated too — keying off leading prose alone regressed genuine recoveries, so only
+	// this narrow cue suppresses it.
+	const quotingCue =
+		/\b(?:never|not|do not|don't|does not|doesn't|must not|mustn't|avoid|instead of|rather than|for example|e\.g\.|such as|like this|as follows)\b[^.!?\n]*$/i
+	return quotingCue.test(stripTagsCompletely(sameLineBefore))
+}
+
+/**
+ * JSON Schema (draft 2020-12 subset) for one tool's parameters, keyed by tool name. Supplied by
+ * `createMessage` from the very schemas offered to the model, so recovery converts a leaked
+ * parameter to the type the tool actually declares.
+ */
+export type LeakedToolSchemas = ReadonlyMap<string, Record<string, unknown> | undefined>
+
+/**
+ * Non-string JSON Schema types a leaked parameter may be converted into, each paired with the
+ * check that a parsed value must satisfy. A null-only declaration is settled by its own branch in
+ * `convertLeakedParamValue` and so has no entry here.
+ */
+function structuredParamCheck(declaredType: string): ((parsed: unknown) => boolean) | undefined {
+	const checks: Record<string, (parsed: unknown) => boolean> = {
+		object: (parsed) => typeof parsed === "object" && !Array.isArray(parsed),
+		array: (parsed) => Array.isArray(parsed),
+		number: (parsed) => Number.isFinite(parsed),
+		integer: (parsed) => Number.isInteger(parsed),
+		boolean: (parsed) => typeof parsed === "boolean",
+	}
+	// Own-property only: a schema declaring `"toString"` would otherwise inherit a live function
+	// from Object.prototype and be treated as a supported type.
+	return Object.hasOwn(checks, declaredType) ? checks[declaredType] : undefined
+}
+
+/** A resolved declaration, or `undefined` when the schema does not pin down a single type. */
+type DeclaredType = { type: string; nullable: boolean }
+
+/** Resolves a `["T","null"]` type union to `T` while reporting that null is permitted. */
+function resolveTypeUnion(types: string[]): DeclaredType | undefined {
+	const nullable = types.includes("null")
+	const nonNullTypes = types.filter((entry) => entry !== "null")
+	// A null-only union has no non-null member; leaving the type unresolved would fall back to the
+	// raw string "null", so name the null type and let convertLeakedParamValue settle it.
+	if (nonNullTypes.length === 0) {
+		return nullable ? { type: "null", nullable } : undefined
+	}
+	// Two or more non-null members leave the intended type ambiguous; picking one would coerce the
+	// value to a type the tool may not accept, so the raw string is kept instead.
+	return nonNullTypes.length === 1 ? { type: nonNullTypes[0], nullable } : undefined
+}
+
+/**
+ * Declared type of `paramName`, resolving a nullable `["T","null"]` union to `T` while reporting
+ * that null is permitted, so an explicit null is not mistaken for a wrong-typed value.
+ *
+ * MCP schemas reach this provider already rewritten by `normalizeToolSchema`, which turns such a
+ * union into typed `anyOf` branches. Without reading that form a declared array or object would
+ * fall through to the raw string, and the tool would receive `'["a","b"]'` instead of a list.
+ */
+function declaredParamType(schema: Record<string, unknown> | undefined, paramName: string): DeclaredType | undefined {
+	const properties = schema?.["properties"] as Record<string, unknown> | undefined
+	const property = properties?.[paramName] as Record<string, unknown> | undefined
+	const type = property?.["type"]
+	if (typeof type === "string") {
+		// A bare declaration permits null only when the type IS "null", which convertLeakedParamValue
+		// settles on its own before reading this flag.
+		return { type, nullable: false }
+	}
+	if (Array.isArray(type)) {
+		return resolveTypeUnion(type.filter((entry): entry is string => typeof entry === "string"))
+	}
+	const alternatives = property?.["anyOf"]
+	if (Array.isArray(alternatives)) {
+		const branchTypes: string[] = []
+		for (const alternative of alternatives) {
+			const branchType = (alternative as Record<string, unknown> | null)?.["type"]
+			// Any branch that is not a simple named type (nested composition, $ref, enum-only) makes
+			// the union unsupported here; bail out rather than guess at a partial reading.
+			if (typeof branchType !== "string") {
+				return undefined
+			}
+			branchTypes.push(branchType)
+		}
+		return resolveTypeUnion(branchTypes)
+	}
+	return undefined
+}
+
+/**
+ * Converts one leaked parameter's raw text to the type its schema declares.
+ *
+ * Leaked markup carries no types — every value arrives as text — so a tool declaring an object or
+ * array (`update_todo_list.todos`, `read_file.indentation`) would otherwise receive a flat string
+ * and fail downstream. Only declared non-string types are JSON-parsed; a declared (or unknown)
+ * string stays literal, because parsing every value would silently turn the text `"123"` or
+ * `"null"` into a number or null. A value that does not parse, or parses to the wrong type, is
+ * reported as a failure so the caller can pass the block through as text rather than dispatch a
+ * malformed call.
+ */
+function convertLeakedParamValue(raw: string, declared: DeclaredType | undefined): { value: unknown } | undefined {
+	if (declared === undefined || declared.type === "string") {
+		return { value: raw }
+	}
+	// A null-only declaration admits the literal null and nothing else, so no parse is needed.
+	if (declared.type === "null") {
+		return raw === "null" ? { value: null } : undefined
+	}
+	const matchesDeclaredType = structuredParamCheck(declared.type)
+	if (!matchesDeclaredType) {
+		return undefined
+	}
+
+	let parsed: unknown
+	try {
+		parsed = JSON.parse(raw)
+	} catch {
+		return undefined
+	}
+
+	// Must precede the table, whose object check would otherwise accept a null.
+	if (parsed === null) {
+		return declared.nullable ? { value: null } : undefined
+	}
+
+	return matchesDeclaredType(parsed) ? { value: parsed } : undefined
+}
+
+/**
+ * Parses the parameters of a leaked `<invoke>` body against the tool's schema. Returns `undefined`
+ * when any parameter cannot be converted, so the whole block is failed closed to unchanged text.
+ */
+function parseLeakedInvokeParams(
+	body: string,
+	schema: Record<string, unknown> | undefined,
+): Record<string, unknown> | undefined {
+	const input: Record<string, unknown> = {}
+	const paramPattern = /<(?:antml:)?parameter\s+name="([^"]+)"\s*>([\s\S]*?)<\/(?:antml:)?parameter\s*>/gi
+	for (const match of body.matchAll(paramPattern)) {
+		const name = match[1]
+		const converted = convertLeakedParamValue(match[2].trim(), declaredParamType(schema, name))
+		if (!converted) {
+			return undefined
+		}
+		input[name] = converted.value
+	}
+	return input
+}
+
+/**
+ * Extracts complete leaked `<invoke>` tool-call blocks from `text`. Only blocks whose name
+ * is present in `validTools` are returned as calls; all other text (including `<invoke>`
+ * blocks for unknown names) is returned as `leftoverText` so legitimate prose is preserved.
+ *
+ * `validTools` may be a bare name set (no schemas, so every parameter stays a literal string) or a
+ * map from tool name to its parameter schema, which enables typed conversion.
+ */
+export function extractLeakedToolCalls(
+	text: string,
+	validTools: ReadonlySet<string> | LeakedToolSchemas,
+	precedingText = "",
+): { calls: Array<{ name: string; input: Record<string, unknown> }>; leftoverText: string } {
+	const schemaFor = (name: string) =>
+		validTools instanceof Map ? (validTools.get(name) as Record<string, unknown> | undefined) : undefined
+	const calls: Array<{ name: string; input: Record<string, unknown> }> = []
+	// Text outside recovered blocks, in stream order.
+	let leftover = ""
+	let lastIndex = 0
+
+	const blockPattern = /<(?:antml:)?invoke\s+name="([^"]+)"\s*>([\s\S]*?)<\/(?:antml:)?invoke\s*>/gi
+	for (const match of text.matchAll(blockPattern)) {
+		leftover += text.slice(lastIndex, match.index)
+		const name = match[1]
+		// Quote detection needs the text streamed before the buffer, since a fence may have opened there.
+		const recoverable =
+			validTools.has(name) &&
+			isInsideFunctionCallsWrapper(precedingText + text.slice(0, match.index)) &&
+			!isQuotedAsCode(
+				precedingText + text,
+				precedingText.length + match.index,
+				precedingText.length + match.index + match[0].length,
+			)
+		// Parsing may still fail closed when a parameter doesn't match its declared type.
+		const input = recoverable ? parseLeakedInvokeParams(match[2], schemaFor(name)) : undefined
+		if (input) {
+			calls.push({ name, input })
+		} else {
+			// Not one of our tools, quoted as code, or un-convertible — keep the block as literal text.
+			leftover += match[0]
+		}
+		lastIndex = match.index + match[0].length
+	}
+	leftover += text.slice(lastIndex)
+
+	// Once a call is recovered its `<function_calls>` wrapper is spent markup, so drop every wrapper
+	// tag (cosmetic; also avoids re-teaching the model this format when the turn replays as history).
+	// With nothing recovered the same tags are user-visible prose and must survive verbatim.
+	if (calls.length > 0) {
+		leftover = leftover.replace(/<\/?(?:antml:)?function_calls\s*>/gi, "")
+	}
+
+	return { calls, leftoverText: leftover }
+}
+
 export class VsCodeLmHandler extends BaseProvider implements SingleCompletionHandler {
 	protected options: ApiHandlerOptions
 	private client: vscode.LanguageModelChat | null