[Security] Keep copied tool closers inside Qwen parameter values

[jperezdealgaba]

Summary

Qwen-family XML tool parsers treat a </parameter> that appears inside a parameter value as the end of that value. When the copied text continues with another tool-call block, and the model then emits its own closing tags, the parser returns that block as a second tool call. The fix detects the extra closer (more closing tags than opening tags) and keeps the copied text in the first parameter. Later calls are held until the generation finishes, then dropped when the output is unbalanced. Balanced parallel calls are unchanged.

Changes

• vllm/parser/qwen3.py: when closers outnumber openers, rebuild one call whose first parameter runs through the final closer. Streaming holds calls after the first until finish_streaming.
• tests/parser/engine/test_qwen3.py: copied closers stay inside the parameter for the parser and the serving adapter, streaming does not emit the copied call, and balanced parallel calls still both return.
• tests/parser/engine/test_seed_oss.py: same copied-closer case with seed wrapper tokens.

Codepath coverage

• Chat completions non-streaming goes through Qwen3ParserToolAdapter.extract_tool_calls (qwen3_coder, qwen3_xml, and mimo all use that adapter). Covered.
• Chat completions streaming goes through extract_tool_calls_streaming and finish_streaming, which serving calls when the stream finishes. Covered.
• Responses uses the same tool parser. Covered.
• seed_oss subclasses Qwen3Parser and uses its own wrapper tokens. Covered.
• Nemotron V3 subclasses the same parser; existing nemotron parser tests still pass.

Duplicate-work check

No open or merged diff stops an extra closer inside a parameter value from becoming another call.

• [Bugfix][Tool Calling] Validate Qwen3 tool names in Parser Engine #50986 only drops tool names that are not in the request. A copied call whose name is declared still goes through.
• fix(parser): keep fenced code examples out of qwen3 tool calls #57553 ignores tool-call XML inside markdown fences in content. Parameter values are unchanged.
• [Bugfix][Parser] Preserve literal Qwen tool markers and following answers #56661 keeps a bare tool marker in prose from swallowing the rest of the answer. A complete call after a parameter closer is still a call.
• [Bugfix] Qwen3 parser: a malformed <parameter> element no longer leaks into streamed arguments #55497 stops a malformed parameter tag from leaking into streamed JSON.
• [Bugfix][Frontend] Keep the trailing parameter when qwen3 closes the function without it #57707 keeps a trailing parameter when </function> arrives without </parameter>.

Tests

• test_copied_closer_stays_inside_the_parameter
• test_serving_adapter_keeps_copied_closer_in_the_parameter
• test_streaming_does_not_emit_the_copied_call
• test_balanced_parallel_calls_still_both_return
• test_streaming_balanced_parallel_calls_flush_at_finish
• test_copied_closer_stays_inside_the_parameter (seed_oss)

.venv/bin/python -m pytest tests/parser/engine/test_qwen3.py tests/parser/engine/test_seed_oss.py tests/parser/engine/test_nemotron_v3.py tests/parser/engine/test_qwen3_reasoning.py -q -p no:randomly
# 153 passed
.venv/bin/pre-commit run ruff-check --files vllm/parser/qwen3.py tests/parser/engine/test_qwen3.py tests/parser/engine/test_seed_oss.py
.venv/bin/pre-commit run ruff-format --files vllm/parser/qwen3.py tests/parser/engine/test_qwen3.py tests/parser/engine/test_seed_oss.py
# both passed

AI assistance

This PR was developed with AI assistance.

Made with Cursor

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[mergify]

This pull request has merge conflicts that must be resolved before it can be
merged. Please rebase the PR, @jperezdealgaba.

https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork