fix(code): stream tool-call args in linear time

[Mason Daugherty (mdrxy)]

Large streamed tool calls no longer repeatedly copy their full argument payload while rendering.

ToolCallBuffer scanned the whole accumulated prefix on every chunk to decide whether the payload was complete, so a long argument value cost O(n^2) over its stream. It now tracks JSON lexical state per fragment — first and last non-whitespace character, container depth and its running maximum, string and escape state, over-closing — and defers the join and the json.loads until that state says the value is structurally complete. The parsed result is memoized, and invalidated as soon as another fragment arrives.

Each fragment is scanned once, so the container and string-scalar paths are linear over a stream. A bare non-string scalar (a number or literal) has no closing token to wait for and still re-joins per chunk; tool arguments are never that shape.

Measured cost of ingest + parse_args per fragment:

fragments	container	bare scalar
2000	0.68 ms	5.98 ms
4000	1.36 ms	19.22 ms
8000	2.58 ms	68.34 ms

Latch lifetime

parse_args short-circuits on warned, since every condition that sets it is permanent: depth exceeded (the running maximum never falls), over-closed (a closer at depth 0 cannot be undone), or balanced-but-unparseable (the top-level value has already closed, so any suffix is trailing junk). That makes the latch gate data rather than only logging, so _reset_args_fragment_state clears it with the rest of the per-payload state. Otherwise a malformed payload strands the next one in the same buffer:

ingest '{bad json}'   -> None          warned=True
ingest {'whole': 1}   -> {'whole': 1}  (whole-value chunk resets fragment state)
ingest '{"good": 1}'  -> None          <- valid payload, tool.use dropped

Warning text

The over-closed path skips the balance check, so a payload can be reported unparseable while it ends mid-string. The old wording described that as complete:

before: Tool-call args look complete but failed to parse: '{"a":1}} {"b":"x\n}'
after:  Tool-call args are unparseable and cannot be completed: '{"a":1}} {"b":"x\n}'

%r keeps control characters in model output escaped, and the preview is capped by INVALID_ARGS_PREVIEW_LIMIT.

Behavior

Verified unchanged against the previous implementation by differential fuzzing over randomized payloads and fragmentations, comparing the full per-fragment return sequence and the warning counts. Deliberate trade-offs are preserved and now documented at the lines that implement them: a bracketed value with trailing junk is treated as still-streaming, and a bare scalar that is complete but malformed is not warned about, being indistinguishable from a still-streaming fragment.

Coverage was added for the state that crosses fragment boundaries, which the previous single-pass helpers did not have: the escape flag straddling a boundary, the parse memo invalidating, the open-string term in the completeness gate, the depth guard at its boundary (nesting that json.loads would accept, so only the guard can produce the skip), incremental over-closing, the preview cap, and the latch reset.