fix(ui): strip malformed tool-call markup fragments from chat display

- fix(TextToolCallParser): add stripMalformedToolCallMarkup() — strips
  structural tag tokens (tool_call, function_call, function=NAME,
  </function>, parameter=NAME, =</parameter>, </parameter>) even when
  they don't assemble into valid executable tool calls. Prevents raw
  broken XML from leaking into the chat UI.
- fix(textToolCallRecovery): applyTextualToolCallRecovery now calls
  stripMalformedToolCallMarkup when parseTextToolCalls returns
  recovered:false (malformed fragments with no valid tools). The
  cleaned text replaces the original in text blocks, so users only
  see prose — never raw markup.
- test: add 16 regression tests covering the exact field-report
  fragment, unclosed/orphaned tags, stray =</parameter>, pure markup
  fragments, multiple fragments, and false-positive guards (prose
  with technical words, angle brackets in code, HTML-like tags).

Root cause: the recovery parser only strips markup when it can extract
a valid tool call. Garbled fragments (no function name, stray closers,
truncated tags) correctly fail recovery but were left in the displayed
text because no stripping path existed for unparseable markup.

Tests: 207/207 pass across all affected suites.

Co-authored-by: Kilo <kilo@kilocode.com>

Author: CodeKing

src/core/assistant-message/TextToolCallParser.ts

@@ -697,6 +697,69 @@ export function textEndsWithIncompleteMarkup(text: string): boolean {
 	return PARTIAL_TAG_TAIL_RE.test(text) || PARTIAL_FENCE_TAIL_RE.test(text)
 }
 
+/**
+ * Strip malformed/unparseable tool-call structural fragments from text.
+ *
+ * The recovery parser (parseTextToolCalls) only strips markup when it can
+ * successfully extract a valid tool call. But models sometimes emit garbled
+ * fragments — missing function names, stray `=</parameter>`, truncated tags —
+ * that don't assemble into anything executable. The user must never see raw
+ * broken XML, even when there's nothing valid to recover.
+ *
+ * This function strips tag-shaped tokens that are clearly tool-call structural
+ * fragments (not ordinary prose) while preserving any surrounding text. It is
+ * conservative: only strips text that looks like actual XML tags, never plain
+ * English words like "parameter" or "function".
+ *
+ * Returns the cleaned text (may be empty if the entire input was markup).
+ */
+export function stripMalformedToolCallMarkup(text: string): string {
+	if (!text) {
+		return text
+	}
+
+	let cleaned = text
+
+	// Strip complete <tool_call>…</tool_call> blocks (even if inner is garbled)
+	// — these are unambiguous tool-call containers.
+	cleaned = cleaned.replace(/<\s*tool_call\b[^>]*>[\s\S]*?<\s*\/\s*tool_call\s*>/gi, "")
+
+	// Strip complete <function_call>…</function_call> blocks.
+	cleaned = cleaned.replace(/<\s*function_call\b[^>]*>[\s\S]*?<\s*\/\s*function_call\s*>/gi, "")
+
+	// Strip complete <function=NAME>…</function> blocks (has a valid name).
+	cleaned = cleaned.replace(/<\s*function\s*=\s*[a-zA-Z0-9_.:-]+\s*>[\s\S]*?<\s*\/\s*function\s*>/gi, "")
+
+	// Strip complete <function|tool|invoke name="NAME">…</function|tool|invoke> blocks.
+	cleaned = cleaned.replace(
+		/<\s*(?:function|tool|invoke)\b[^>]*\bname\s*=\s*["'][^"']+["'][^>]*>[\s\S]*?<\s*\/\s*(?:function|tool|invoke)\s*>/gi,
+		"",
+	)
+
+	// Strip stray/unclosed structural tag fragments that are clearly tool-call
+	// markup, not prose. These are the exact tokens from the field report:
+	//   <tool_call>          (unclosed)
+	//   </tool_call>         (orphaned closer)
+	//   <function=NAME>      (unclosed)
+	//   </function>          (orphaned closer)
+	//   <parameter=NAME>     (unclosed parameter)
+	//   <parameter name="N"> (unclosed parameter)
+	//   =</parameter>        (stray closer with stray equals)
+	//   </parameter>         (orphaned parameter closer)
+	// These are specific enough (angle brackets + structural names) that they
+	// virtually never appear in ordinary prose — plain English words like
+	// "function" or "parameter" without angle brackets are never matched.
+	cleaned = cleaned.replace(
+		/<\s*\/?\s*tool_call\b[^>]*>|<\s*\/?\s*function_call\b[^>]*>|<\s*\/?\s*function\s*=\s*[a-zA-Z0-9_.:-]*\s*>|<\s*\/\s*function\s*>|<\s*\/?\s*(?:function|tool|invoke)\b[^>]*\bname\s*=\s*["'][^"']*["'][^>]*>|<\s*\/?\s*parameter\s*(?:=\s*[a-zA-Z0-9_.:-]*\s*|\bname\s*=\s*["'][^"']*["']\s*)>|=\s*<\s*\/\s*parameter\s*>|<\s*\/\s*parameter\s*>/gi,
+		"",
+	)
+
+	// Collapse any double blank lines left behind by the strip.
+	cleaned = cleaned.replace(/\n{3,}/g, "\n\n").trim()
+
+	return cleaned
+}
+
 /** Test helper — reset synthetic id sequence. */
 export function resetTextToolCallSeqForTests(): void {
 	textToolCallSeq = 0

src/core/assistant-message/__tests__/mimo-scenarios.spec.ts

@@ -12,7 +12,7 @@
  * nativeArgs — both are asserted here.
  */
 import { NativeToolCallParser } from "../NativeToolCallParser"
-import { looksLikeTextToolCall } from "../TextToolCallParser"
+import { looksLikeTextToolCall, stripMalformedToolCallMarkup } from "../TextToolCallParser"
 import {
 	applyTextualToolCallRecovery,
 	hasExecutableNativeToolUse,
@@ -265,4 +265,163 @@ describe("MiMo field-failure scenarios (regression)", () => {
 			expect(tool.nativeArgs.doc).toBe("design")
 		})
 	})
+
+	describe("Scenario (d): malformed/garbled markup fragments — must never leak to UI", () => {
+		/**
+		 * Field report: model emitted a garbled fragment with no valid function
+		 * opener, just stray tokens like `=</parameter>` + `</function></tool_call>`.
+		 * The recovery parser correctly can't extract a valid tool call, but the
+		 * raw broken XML was displayed to the user. The fix: strip structural
+		 * tag-shaped tokens even when recovery fails, so the user only sees
+		 * clean prose.
+		 */
+
+		it("exact field-report fragment: prose + stray =</parameter> + </function></tool_call>", () => {
+			const fragment =
+				"All 8 passed. Let me verify the remaining tools and clean up:<tool_call>\n=</parameter>\n</function>\n</tool_call>"
+			const stripped = stripMalformedToolCallMarkup(fragment)
+			expect(stripped).toBe("All 8 passed. Let me verify the remaining tools and clean up:")
+			expect(stripped).not.toContain("<tool_call>")
+			expect(stripped).not.toContain("</parameter>")
+			expect(stripped).not.toContain("</function>")
+			expect(stripped).not.toContain("</tool_call>")
+		})
+
+		it("applyTextualToolCallRecovery strips malformed fragment when recovery fails", () => {
+			const fragment =
+				"All 8 passed. Let me verify the remaining tools and clean up:<tool_call>\n=</parameter>\n</function>\n</tool_call>"
+
+			const recovered = applyTextualToolCallRecovery({
+				assistantMessage: fragment,
+				assistantMessageContent: [{ type: "text", content: fragment, partial: true }] as any[],
+				currentStreamingContentIndex: 0,
+			})
+
+			// Recovery fails (no valid tools) but markup is stripped
+			expect(recovered.recoveredCount).toBe(0)
+			expect(recovered.applied).toBe(true) // applied=true because message changed
+			expect(recovered.assistantMessage).toBe("All 8 passed. Let me verify the remaining tools and clean up:")
+			expect(recovered.assistantMessage).not.toContain("<tool_call>")
+			expect(recovered.assistantMessage).not.toContain("</parameter>")
+		})
+
+		it("unclosed <tool_call> at end of text", () => {
+			const fragment = "Done. Now let me run the tests.<tool_call>"
+			const stripped = stripMalformedToolCallMarkup(fragment)
+			expect(stripped).toBe("Done. Now let me run the tests.")
+		})
+
+		it("orphaned </tool_call> closer", () => {
+			const fragment = "Finished processing.</tool_call>"
+			const stripped = stripMalformedToolCallMarkup(fragment)
+			expect(stripped).toBe("Finished processing.")
+		})
+
+		it("unclosed <function=write_spec> opener", () => {
+			const fragment = "Let me write the spec.<function=write_spec>"
+			const stripped = stripMalformedToolCallMarkup(fragment)
+			expect(stripped).toBe("Let me write the spec.")
+		})
+
+		it("orphaned </function> closer", () => {
+			const fragment = "All done here.</function>"
+			const stripped = stripMalformedToolCallMarkup(fragment)
+			expect(stripped).toBe("All done here.")
+		})
+
+		it("unclosed <parameter=doc> opener", () => {
+			const fragment = "Setting the doc parameter.<parameter=doc>"
+			const stripped = stripMalformedToolCallMarkup(fragment)
+			expect(stripped).toBe("Setting the doc parameter.")
+		})
+
+		it("stray =</parameter> closer", () => {
+			const fragment = "Value set.=</parameter>"
+			const stripped = stripMalformedToolCallMarkup(fragment)
+			expect(stripped).toBe("Value set.")
+		})
+
+		it("orphaned </parameter> closer", () => {
+			const fragment = "Done with params.</parameter>"
+			const stripped = stripMalformedToolCallMarkup(fragment)
+			expect(stripped).toBe("Done with params.")
+		})
+
+		it("pure markup fragment (no prose) → empty string", () => {
+			const fragment = "<tool_call>\n=</parameter>\n</function>\n</tool_call>"
+			const stripped = stripMalformedToolCallMarkup(fragment)
+			expect(stripped).toBe("")
+		})
+
+		it("multiple malformed fragments in one text", () => {
+			const fragment =
+				"First step done.<tool_call>\n=</parameter>\n</function>\n</tool_call>\nSecond step complete.</tool_call>"
+			const stripped = stripMalformedToolCallMarkup(fragment)
+			expect(stripped).toContain("First step done.")
+			expect(stripped).toContain("Second step complete.")
+			expect(stripped).not.toContain("<tool_call>")
+			expect(stripped).not.toContain("</tool_call>")
+			expect(stripped).not.toContain("</function>")
+			expect(stripped).not.toContain("</parameter>")
+		})
+
+		it("normal prose with technical words is NEVER falsely stripped", () => {
+			const prose =
+				"The function parameter is set to null. Please call the tool_call function with the correct parameter."
+			const stripped = stripMalformedToolCallMarkup(prose)
+			expect(stripped).toBe(prose)
+		})
+
+		it("prose with angle brackets in code is preserved", () => {
+			const prose = "Use `if (a < b && c > d)` for the comparison."
+			const stripped = stripMalformedToolCallMarkup(prose)
+			expect(stripped).toBe(prose)
+		})
+
+		it("prose with HTML-like tags that are NOT tool-call structural is preserved", () => {
+			const prose = 'Use the <div> element with class="container" for layout.'
+			const stripped = stripMalformedToolCallMarkup(prose)
+			expect(stripped).toBe(prose)
+		})
+
+		it("well-formed tool call is NOT stripped (recovery handles it, not this path)", () => {
+			const wellFormed =
+				"Let me read the spec.\n<tool_call>\n<function=read_spec>\n<parameter=doc>design</parameter>\n</function>\n</tool_call>"
+			// stripMalformedToolCallMarkup strips it (it's structural markup), but
+			// the recovery path should handle it first. This test just documents
+			// that the strip function is structural, not semantic.
+			const stripped = stripMalformedToolCallMarkup(wellFormed)
+			expect(stripped).toBe("Let me read the spec.")
+		})
+
+		it("applyTextualToolCallRecovery with well-formed tool call still recovers (not just strips)", () => {
+			const wellFormed =
+				"Let me read the spec.\n<tool_call>\n<function=read_spec>\n<parameter=doc>design</parameter>\n</function>\n</tool_call>"
+
+			const recovered = applyTextualToolCallRecovery({
+				assistantMessage: wellFormed,
+				assistantMessageContent: [{ type: "text", content: wellFormed, partial: true }] as any[],
+				currentStreamingContentIndex: 0,
+			})
+
+			// Recovery succeeds — tool is extracted AND markup is stripped
+			expect(recovered.recoveredCount).toBe(1)
+			expect(recovered.applied).toBe(true)
+			expect(recovered.assistantMessage).toBe("Let me read the spec.")
+			const toolBlocks = recovered.assistantMessageContent.filter((b) => b.type === "tool_use")
+			expect(toolBlocks).toHaveLength(1)
+			expect((toolBlocks[0] as any).name).toBe("read_spec")
+		})
+
+		it("empty input returns empty", () => {
+			expect(stripMalformedToolCallMarkup("")).toBe("")
+			expect(stripMalformedToolCallMarkup("   ")).toBe("")
+		})
+
+		it("text with only whitespace between fragments collapses correctly", () => {
+			const fragment = "Start.<tool_call>\n\n\n</tool_call>\n\nEnd."
+			const stripped = stripMalformedToolCallMarkup(fragment)
+			expect(stripped).toBe("Start.\n\nEnd.")
+		})
+	})
 })

src/core/assistant-message/textToolCallRecovery.ts

@@ -1,5 +1,5 @@
 import type { ToolUse, McpToolUse, TextContent } from "../../shared/tools"
-import { looksLikeTextToolCall, parseTextToolCalls } from "./TextToolCallParser"
+import { looksLikeTextToolCall, parseTextToolCalls, stripMalformedToolCallMarkup } from "./TextToolCallParser"
 
 /**
  * Content blocks that participate in textual tool-call recovery.
@@ -83,11 +83,31 @@ export function applyTextualToolCallRecovery(state: TextualToolCallRecoveryState
 
 	const recovered = parseTextToolCalls(assistantMessage)
 	if (!recovered.recovered || recovered.toolUses.length === 0) {
+		// Malformed/garbled tool-call fragments: nothing valid to execute, but
+		// the user must never see raw broken XML. Strip structural tag-shaped
+		// tokens (conservative — never touches plain English prose).
+		const strippedMessage = stripMalformedToolCallMarkup(assistantMessage)
+		const messageChanged = strippedMessage !== assistantMessage
+		if (messageChanged) {
+			// Update text blocks with the stripped version
+			for (const block of assistantMessageContent) {
+				if (block.type === "text") {
+					block.content = strippedMessage
+					block.partial = false
+				}
+			}
+			// Drop empty text blocks after stripping
+			if (!strippedMessage.trim()) {
+				assistantMessageContent = assistantMessageContent.filter(
+					(block) => block.type !== "text" || (block.content && block.content.trim()),
+				)
+			}
+		}
 		return {
-			assistantMessage,
+			assistantMessage: strippedMessage,
 			assistantMessageContent,
 			currentStreamingContentIndex,
-			applied: false,
+			applied: messageChanged,
 			recoveredCount: 0,
 		}
 	}