Drop truncated tool_use blocks before they corrupt the next request and add unit tests for the small helpers introduced in the audit work

Author: alexylon

src/api/model_info.rs

@@ -325,6 +325,26 @@ pub fn effort_support_error(model: &str, effort: ReasoningEffort) -> Option<Stri
 mod tests {
     use super::*;
 
+    #[test]
+    fn provider_routes_gpt_and_claude_correctly() {
+        assert_eq!(provider_for("gpt-5.5"), Provider::OpenAI);
+        assert_eq!(provider_for("gpt-5.4-codex"), Provider::OpenAI);
+        assert_eq!(provider_for("GPT-5.5"), Provider::OpenAI);
+        assert_eq!(provider_for("claude-opus-4-7"), Provider::Anthropic);
+        assert_eq!(
+            provider_for("claude-sonnet-4-6-20260301"),
+            Provider::Anthropic
+        );
+        assert_eq!(provider_for("o1-mini"), Provider::OpenAI);
+        assert_eq!(provider_for("unknown-model"), Provider::Anthropic);
+    }
+
+    #[test]
+    fn provider_label_is_human_readable() {
+        assert_eq!(Provider::OpenAI.label(), "OpenAI");
+        assert_eq!(Provider::Anthropic.label(), "Anthropic");
+    }
+
     #[test]
     fn opus_4_7_has_1m_context_and_server_compaction() {
         let info = lookup("claude-opus-4-7");

src/clipboard.rs

@@ -95,3 +95,39 @@ pub fn get_clipboard_image() -> Option<PastedImage> {
         base64_data,
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn marker_for_first_index_returns_circled_one() {
+        assert_eq!(marker_for_index(0), Some('\u{2460}'));
+    }
+
+    #[test]
+    fn marker_for_last_supported_index_returns_circled_twenty() {
+        assert_eq!(
+            marker_for_index(MAX_PASTED_IMAGES_PER_MESSAGE - 1),
+            Some('\u{2473}')
+        );
+    }
+
+    #[test]
+    fn marker_past_supported_range_returns_none() {
+        assert_eq!(marker_for_index(MAX_PASTED_IMAGES_PER_MESSAGE), None);
+        assert_eq!(marker_for_index(100), None);
+    }
+
+    #[test]
+    fn strip_paste_markers_round_trips_indices_and_text() {
+        let input = format!(
+            "look at {} and {}",
+            marker_for_index(0).unwrap(),
+            marker_for_index(2).unwrap()
+        );
+        let (text, indices) = strip_paste_markers(&input);
+        assert_eq!(text, "look at  and");
+        assert_eq!(indices, vec![0, 2]);
+    }
+}

src/repl/response_handler.rs

@@ -145,10 +145,24 @@ impl ResponseHandler {
             }
 
             if !content_blocks.is_empty() {
-                let message_blocks: Vec<crate::api::MessageContentBlock> = content_blocks
+                let mut message_blocks: Vec<crate::api::MessageContentBlock> = content_blocks
                     .iter()
                     .map(crate::api::MessageContentBlock::from_content_block_for_api)
                     .collect();
+                if truncated_by_max_tokens {
+                    // Drop tool-use blocks from a truncated response.
+                    // Their arguments may be half-formed JSON, and storing
+                    // a `tool_use` without the matching `tool_result`
+                    // leaves the next request in a shape the provider
+                    // will reject.
+                    message_blocks.retain(|block| {
+                        !matches!(
+                            block,
+                            crate::api::MessageContentBlock::ToolUse { .. }
+                                | crate::api::MessageContentBlock::ServerToolUse { .. }
+                        )
+                    });
+                }
                 if !message_blocks.is_empty() {
                     self.conversation.add_assistant_with_blocks(message_blocks);
                 }
@@ -160,9 +174,6 @@ impl ResponseHandler {
                     "Consider using --max-tokens with a higher value (current: {})",
                     self.max_tokens
                 );
-                // Skip tool execution: a truncated tool_use carries
-                // half-formed JSON arguments, so running it would
-                // either parse-fail or fire on partial input.
                 return Ok(());
             }
 

src/session/history/manager.rs

@@ -131,8 +131,8 @@ impl HistoryManager {
 
     /// Reject session ids that could escape the sessions directory
     /// when interpolated into a path. The generator only produces
-    /// `session_<timestamp>` strings, so anything containing a path
-    /// separator or `..` came from an external caller (e.g.
+    /// `session_<timestamp>_<random>` strings, so anything containing a
+    /// path separator or `..` came from an external caller (e.g.
     /// `--resume <id>`) and must not be trusted.
     fn validate_session_id(session_id: &str) -> Result<()> {
         if session_id.is_empty()

src/tools/mod.rs

@@ -43,3 +43,26 @@ pub fn read_file_body(output: &str) -> &str {
         .map(|(_, body)| body)
         .unwrap_or(output)
 }
+
+#[cfg(test)]
+mod public_helpers_tests {
+    use super::*;
+
+    #[test]
+    fn format_and_recover_round_trip() {
+        let payload = format_read_file_output("src/main.rs", "fn main() {}\n");
+        assert!(payload.starts_with(READ_FILE_HEADER));
+        assert_eq!(read_file_body(&payload), "fn main() {}\n");
+    }
+
+    #[test]
+    fn read_file_body_falls_back_when_separator_missing() {
+        assert_eq!(read_file_body("no separator here"), "no separator here");
+    }
+
+    #[test]
+    fn read_file_body_handles_empty_body() {
+        let payload = format_read_file_output("empty.txt", "");
+        assert_eq!(read_file_body(&payload), "");
+    }
+}