fix(agent): recover tool_call arguments that arrived wrapped

[Drexuxux]

What

_repair_tool_call_arguments is a repair ladder for the malformed argument JSON local models emit — its docstring names truncated JSON, trailing commas and Python None, and it falls back to "{}" only when nothing parses, "better than crashing the session."

Two shapes were reaching that fallback while carrying a complete, valid payload:

in='```json\n{"path": "a.txt"}\n```'      out='{}'
in='{"path": "a.txt"} trailing text'      out='{}'

Both are ordinary model behaviour — a fenced object, or an object followed by an explanatory sentence — and both hold exactly the arguments the model chose. Discarding them runs the tool with no arguments at all, so the call fails on a missing required parameter (write_file with no path, terminal with no command) and the turn is spent on a confusing error instead of the requested action. The log line even says Unrepairable tool_call arguments … replaced with empty object for a payload that parses fine once unwrapped.

Found by fuzzing the function: 14 well-formed and 13 malformed argument strings, checking that the result parses and that a well-formed payload survives unchanged. These two were the only recoverable inputs being thrown away.

The fix

One pass added before the existing character-surgery repairs: strip a surrounding markdown fence, then take the leading JSON value with json.JSONDecoder().raw_decode(), which covers the trailing-prose case in the same step. The recovery is logged like every other repair in this function, including how many surrounding characters were dropped.

Ordering keeps the change inert for everything that already worked:

• well-formed input never reaches it — pass 0 (json.loads(..., strict=False)) returns first
• input that genuinely does not parse falls through to the existing repairs and, failing those, still ends at "{}"

Verified on the same fuzz corpus: the two wrapped cases now return {"path":"a.txt"}, every other input's output is byte-identical to before, and 0/14 well-formed payloads are damaged.

Tests

Added TestWrappedArgumentRecovery to tests/run_agent/test_repair_tool_call_arguments.py:

• a ```json fenced object is recovered with both keys intact
• a bare ``` fence with no language tag is recovered
• prose after a complete object is dropped, the object is kept
• surrounding whitespace only is handled
• a well-formed payload with a Windows path, a newline and an emoji round-trips semantically unchanged
• input that still does not parse continues to yield {}

Results:

28 passed

That is this file plus test_streaming_tool_call_repair.py, test_repair_tool_call_name.py and tests/agent/test_canon_args_memo_parity.py, with no pre-existing failures.

Without the source change, on the same files:

3 failed, 25 passed
E   AssertionError: assert {} == {'content': 'hi', 'path': 'a.txt'}
E   AssertionError: assert {} == {'path': 'a.txt'}

25 + 3 = 28, so the delta is exactly the new tests flipping green. tests/run_agent/test_dict_tool_call_args.py, test_dropped_tool_call_recovery.py and test_message_sequence_repair.py also pass (19) unchanged, and scripts/check-windows-footguns.py is clean on both files.

[teknium1]

Thanks for the work here — reviewed against current origin/main.

The premise is technically true (both shapes currently fall through the repair ladder to {}), but this lands squarely in our standing policy: we do not repair malformed model outputs. The two shapes recovered here — markdown-fenced JSON and JSON followed by prose — are the model writing chat formatting into the arguments field, not a documented provider wire-format quirk at an adapter boundary. Fixing that belongs at the model/prompting layer, not in the argument parser.

There are also concrete defects that would need addressing even if we wanted this: raw_decode has no dict guard (input like null and then… would yield a non-object arguments payload), and the silent prefix-take on concatenated objects conflicts with the territory of #63015/#38042.

Closing per policy — appreciate the thorough investigation regardless.