@oh-my-pi/pi-ai 16.4.4 → 16.4.6

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## [Unreleased]
 
+## [16.4.6] - 2026-07-12
+
+### Added
+
+- Added asynchronous `invalidateUsageCache` method to clear cached usage reports
+- Added support for cross-service usage cache invalidation between AuthStorage and AuthBroker
+
+### Fixed
+
+- Fixed OAuth credential resolution returning "No API key found" when every plan-eligible OpenAI Codex account was rate-limit blocked and the only unblocked account failed the model's plan gate: resolution now runs a last-resort ladder that first yields a plan-fitting account regardless of usage blocks (so callers get real usage-limit retry semantics), then tries every account with the plan filter dropped before reporting no credential
+
+## [16.4.5] - 2026-07-11
+
+### Fixed
+
+- Fixed an issue in GLM tool calling where missing or malformed argument closers (such as `<arg_value>` mistyped as `</arg_key>`) caused subsequent arguments to be swallowed or merged into a single field, affecting both in-band and native tool calling.
+
 ## [16.4.3] - 2026-07-11
 
 ### Fixed

package/dist/types/auth-broker/client.d.ts

@@ -1,5 +1,5 @@
 import type { AuthCredential } from "../auth-storage.js";
-import type { CredentialBlockRequest, CredentialBlockResponse, CredentialBlocksDeleteResponse, CredentialDisableResponse, CredentialRefreshResponse, CredentialUploadResponse, HealthzResponse, SnapshotResponse, SnapshotStreamEvent, UsageResponse } from "./types.js";
+import type { CredentialBlockRequest, CredentialBlockResponse, CredentialBlocksDeleteResponse, CredentialDisableResponse, CredentialRefreshResponse, CredentialUploadResponse, HealthzResponse, SnapshotResponse, SnapshotStreamEvent, UsageResponse, UsageStaleResponse } from "./types.js";
 export interface AuthBrokerClientOptions {
     /** Base URL (e.g. `https://broker.tailnet:8765`). Trailing slashes are trimmed. */
     url: string;
@@ -60,6 +60,7 @@ export declare class AuthBrokerClient {
         signal?: AbortSignal;
     }): AsyncGenerator<SnapshotStreamEvent>;
     fetchUsage(signal?: AbortSignal): Promise<UsageResponse>;
+    notifyUsageStale(signal?: AbortSignal): Promise<UsageStaleResponse>;
     refreshCredential(id: number, signal?: AbortSignal): Promise<CredentialRefreshResponse>;
     disableCredential(id: number, cause: string, signal?: AbortSignal): Promise<CredentialDisableResponse>;
     uploadCredential(provider: string, credential: AuthCredential, signal?: AbortSignal): Promise<CredentialUploadResponse>;

package/dist/types/auth-broker/remote-store.d.ts

@@ -80,6 +80,7 @@ export declare class RemoteAuthCredentialStore implements AuthCredentialStore {
     getCache(key: string): string | null;
     setCache(key: string, value: string, expiresAtSec: number): void;
     cleanExpiredCache(): void;
+    invalidateUsageCache(signal?: AbortSignal): Promise<void>;
     /**
      * Store-level hook consumed by `AuthStorage` — routes refresh through the
      * broker so the actual refresh token never leaves the broker host. Returns

package/dist/types/auth-broker/types.d.ts

@@ -56,6 +56,10 @@ export interface CredentialBlockResponse {
 export interface CredentialBlocksDeleteResponse {
     ok: boolean;
 }
+/** POST /v1/usage/stale response body. */
+export interface UsageStaleResponse {
+    ok: boolean;
+}
 /**
  * POST /v1/credential request body. The OAuth `refresh` must be the *real*
  * refresh token (not the sentinel) — the broker is the canonical writer.

package/dist/types/auth-broker/wire-schemas.d.ts

@@ -425,6 +425,9 @@ export declare const credentialBlockResponseSchema: import("arktype/internal/var
 export declare const credentialBlocksDeleteResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
     ok: boolean;
 }, {}>;
+export declare const usageStaleResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    ok: boolean;
+}, {}>;
 export declare const credentialUploadRequestSchema: import("arktype/internal/variants/object.ts").ObjectType<{
     provider: string;
     credential: {

package/dist/types/auth-storage.d.ts

@@ -233,6 +233,8 @@ export interface CredentialRefreshLeaseFence {
 }
 export interface AuthCredentialStore {
     close(): void;
+    /** Optional hook to notify the underlying store that usage report cache is stale. */
+    invalidateUsageCache?(signal?: AbortSignal): Promise<void>;
     listAuthCredentials(provider?: string): StoredAuthCredential[];
     updateAuthCredential(id: number, credential: AuthCredential): void;
     deleteAuthCredential(id: number, disabledCause: string): void;
@@ -930,6 +932,13 @@ export declare class AuthStorage {
         baseUrlResolver?: (provider: string) => string | undefined;
         signal?: AbortSignal;
     }): Promise<ResetCreditRedeemOutcome>;
+    /**
+     * Force-invalidate cached usage reports so the next fetch retrieves fresh
+     * values from upstream providers. If `provider` is specified, only that
+     * provider's credentials are invalidated; otherwise, all credentials in the
+     * store are invalidated.
+     */
+    invalidateUsageCache(provider?: string, signal?: AbortSignal): Promise<void>;
     invalidateCredentialMatching(provider: string, apiKey: string, options?: InvalidateCredentialMatchingOptions): Promise<boolean>;
     invalidateCredentialMatching(provider: string, apiKey: string, signal?: AbortSignal): Promise<boolean>;
     /**

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "16.4.4",
+	"version": "16.4.6",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,9 +38,9 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.0",
-		"@oh-my-pi/pi-catalog": "16.4.4",
-		"@oh-my-pi/pi-utils": "16.4.4",
-		"@oh-my-pi/pi-wire": "16.4.4",
+		"@oh-my-pi/pi-catalog": "16.4.6",
+		"@oh-my-pi/pi-utils": "16.4.6",
+		"@oh-my-pi/pi-wire": "16.4.6",
 		"arktype": "2.2.2",
 		"zod": "^4"
 	},

package/src/auth-broker/client.ts

@@ -21,6 +21,7 @@ import type {
 	SnapshotResponse,
 	SnapshotStreamEvent,
 	UsageResponse,
+	UsageStaleResponse,
 } from "./types";
 import {
 	credentialBlockResponseSchema,
@@ -32,6 +33,7 @@ import {
 	snapshotResponseSchema,
 	snapshotStreamEventSchema,
 	usageResponseSchema,
+	usageStaleResponseSchema,
 } from "./wire-schemas";
 
 export interface AuthBrokerClientOptions {
@@ -242,6 +244,13 @@ export class AuthBrokerClient {
 		return this.#request<UsageResponse>("GET", "/v1/usage", { schema: usageResponseSchema, signal });
 	}
 
+	notifyUsageStale(signal?: AbortSignal): Promise<UsageStaleResponse> {
+		return this.#request<UsageStaleResponse>("POST", "/v1/usage/stale", {
+			schema: usageStaleResponseSchema,
+			signal,
+		});
+	}
+
 	async refreshCredential(id: number, signal?: AbortSignal): Promise<CredentialRefreshResponse> {
 		return this.#request<CredentialRefreshResponse>("POST", `/v1/credential/${id}/refresh`, {
 			schema: credentialRefreshResponseSchema,

package/src/auth-broker/remote-store.ts

@@ -794,6 +794,13 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		}
 	}
 
+	async invalidateUsageCache(signal?: AbortSignal): Promise<void> {
+		this.#invalidateUsageCache();
+		await this.#client.notifyUsageStale(signal).catch(err => {
+			logger.warn("auth-broker notification of stale usage failed", { error: String(err) });
+		});
+	}
+
 	#invalidateUsageCache(): void {
 		this.#usageCache = undefined;
 		this.#usageInflight = undefined;

package/src/auth-broker/server.ts

@@ -608,6 +608,17 @@ export function startAuthBroker(opts: AuthBrokerServerOptions): AuthBrokerServer
 						return json(502, { error: message });
 					}
 				}
+				if (req.method === "POST" && pathname === "/v1/usage/stale") {
+					try {
+						opts.storage.invalidateUsageCache?.();
+						logger.info("auth-broker usage cache invalidated", { peer });
+						return json(200, { ok: true });
+					} catch (error) {
+						const message = error instanceof Error ? error.message : String(error);
+						logger.warn("auth-broker usage cache invalidation failed", { peer, error: message });
+						return json(500, { error: message });
+					}
+				}
 				const refreshMatch = req.method === "POST" ? pathname.match(REFRESH_ROUTE) : null;
 				if (refreshMatch) {
 					const id = Number.parseInt(refreshMatch[1], 10);

package/src/auth-broker/types.ts

@@ -75,6 +75,11 @@ export interface CredentialBlocksDeleteResponse {
 	ok: boolean;
 }
 
+/** POST /v1/usage/stale response body. */
+export interface UsageStaleResponse {
+	ok: boolean;
+}
+
 /**
  * POST /v1/credential request body. The OAuth `refresh` must be the *real*
  * refresh token (not the sentinel) — the broker is the canonical writer.

package/src/auth-broker/wire-schemas.ts

@@ -258,6 +258,11 @@ export const credentialBlocksDeleteResponseSchema = type({
 	ok: "boolean",
 });
 
+export const usageStaleResponseSchema = type({
+	"+": "reject",
+	ok: "boolean",
+});
+
 // ─── Upload ────────────────────────────────────────────────────────────────
 
 export const credentialUploadRequestSchema = type({

package/src/auth-storage.ts

@@ -315,6 +315,8 @@ export interface CredentialRefreshLeaseFence {
 
 export interface AuthCredentialStore {
 	close(): void;
+	/** Optional hook to notify the underlying store that usage report cache is stale. */
+	invalidateUsageCache?(signal?: AbortSignal): Promise<void>;
 	listAuthCredentials(provider?: string): StoredAuthCredential[];
 	updateAuthCredential(id: number, credential: AuthCredential): void;
 	deleteAuthCredential(id: number, disabledCause: string): void;
@@ -3739,8 +3741,17 @@ export class AuthStorage {
 
 	/**
 	 * Resolves an OAuth credential, trying credentials in priority order.
-	 * Skips blocked credentials and checks usage limits for providers with usage data.
-	 * Falls back to earliest-unblocking credential if all are blocked.
+	 *
+	 * Resolution ladder — a request in hand always beats "no API key":
+	 * 1. strict: unblocked credentials only, usage limits respected, plan
+	 *    filter enforced (when any account is confirmed eligible);
+	 * 2. plan-fitting last resort: same plan filter, but blocked/exhausted
+	 *    accounts are allowed (blocked candidates rank earliest-unblocking
+	 *    first) so the caller gets real usage-limit semantics from the wire
+	 *    instead of a missing key;
+	 * 3. unfiltered last resort: the plan filter matched nothing usable —
+	 *    skip it and try every account once; the server is the final arbiter
+	 *    of model access.
 	 *
 	 * Returns both the API key bytes for outbound requests AND the refreshed
 	 * {@link OAuthCredential} so callers needing identity metadata (account id,
@@ -3890,42 +3901,34 @@ export class AuthStorage {
 			hasPlanRequirement &&
 			candidates.some(candidate => getOpenAICodexPlanEligibility(candidate.usage, planRequirement) === true);
 
-		const fallback = candidates[0];
+		const passes: Array<{ allowBlocked: boolean; enforcePlanRequirement: boolean }> = [
+			{ allowBlocked: false, enforcePlanRequirement },
+			{ allowBlocked: true, enforcePlanRequirement },
+		];
+		if (enforcePlanRequirement) passes.push({ allowBlocked: true, enforcePlanRequirement: false });
 
-		for (const candidate of candidates) {
-			const resolved = await this.#tryOAuthCredential(
-				provider,
-				candidate.selection,
-				providerKey,
-				sessionId,
-				options,
-				{
-					checkUsage,
-					allowBlocked: false,
-					prefetchedUsage: candidate.usage,
-					usagePrechecked: candidate.usageChecked,
-					planRequirement,
-					enforcePlanRequirement,
-					strategy,
-					rankingContext,
-					blockScope,
-				},
-			);
-			if (resolved) return resolved;
-		}
-
-		if (fallback && this.#isCredentialBlocked(provider, providerKey, fallback.selection.index, blockScope)) {
-			return this.#tryOAuthCredential(provider, fallback.selection, providerKey, sessionId, options, {
-				checkUsage,
-				allowBlocked: true,
-				prefetchedUsage: fallback.usage,
-				usagePrechecked: fallback.usageChecked,
-				planRequirement,
-				enforcePlanRequirement,
-				strategy,
-				rankingContext,
-				blockScope,
-			});
+		for (const pass of passes) {
+			for (const candidate of candidates) {
+				const resolved = await this.#tryOAuthCredential(
+					provider,
+					candidate.selection,
+					providerKey,
+					sessionId,
+					options,
+					{
+						checkUsage,
+						allowBlocked: pass.allowBlocked,
+						prefetchedUsage: candidate.usage,
+						usagePrechecked: candidate.usageChecked,
+						planRequirement,
+						enforcePlanRequirement: pass.enforcePlanRequirement,
+						strategy,
+						rankingContext,
+						blockScope,
+					},
+				);
+				if (resolved) return resolved;
+			}
 		}
 
 		return undefined;
@@ -4666,6 +4669,11 @@ export class AuthStorage {
 		});
 		if (result.ok) {
 			this.#invalidateUsageReportCache(provider, baseUrl);
+			if (this.#store.invalidateUsageCache) {
+				await this.#store.invalidateUsageCache(options.signal).catch(err => {
+					logger.debug("Failed to notify store of stale usage", { err });
+				});
+			}
 			// The window this credential was blocked on (by markUsageLimitReached)
 			// is now reset, so lift its temporary block — otherwise selection
 			// keeps skipping/under-ranking the freshly-reset account.
@@ -4691,6 +4699,40 @@ export class AuthStorage {
 		}
 	}
 
+	/**
+	 * Force-invalidate cached usage reports so the next fetch retrieves fresh
+	 * values from upstream providers. If `provider` is specified, only that
+	 * provider's credentials are invalidated; otherwise, all credentials in the
+	 * store are invalidated.
+	 */
+	async invalidateUsageCache(provider?: string, signal?: AbortSignal): Promise<void> {
+		if (provider) {
+			this.#invalidateUsageReportCache(provider);
+		} else {
+			this.#usageCacheEpoch += 1;
+			const expired = Date.now() - 1;
+			try {
+				const credentials = this.#store.listAuthCredentials();
+				for (const entry of credentials) {
+					if (entry.credential.type !== "oauth") continue;
+					const cacheKey = this.#buildUsageReportCacheKey(
+						this.#buildUsageRequestForOauth(entry.provider, entry.credential),
+					);
+					const existing = this.#usageCache.getStale<UsageReport | null>(cacheKey);
+					this.#usageCache.set(cacheKey, { value: existing?.value ?? null, expiresAt: expired });
+				}
+			} catch (err) {
+				logger.debug("Failed to list auth credentials for complete usage cache invalidation", { err });
+			}
+		}
+
+		if (this.#store.invalidateUsageCache) {
+			await this.#store.invalidateUsageCache(signal).catch(err => {
+				logger.debug("Failed to notify store of stale usage", { err });
+			});
+		}
+	}
+
 	#invalidateUsageReportCacheForProviderKey(providerKey: string): void {
 		const oauthSuffix = ":oauth";
 		if (!providerKey.endsWith(oauthSuffix)) return;

package/src/dialect/glm.ts

@@ -272,8 +272,19 @@ export class GLMInbandScanner implements InbandScanner {
 
 	#consumeValue(final: boolean, events: InbandScanEvent[]): boolean {
 		const close = this.#buffer.indexOf(ARG_VALUE_CLOSE);
+		const heal = scanValueHeal(this.#buffer, close === -1 ? this.#buffer.length : close);
+		if (heal.kind === "heal") {
+			this.#streamValue(this.#buffer.slice(0, heal.valueEnd), events);
+			if (heal.trimValue && this.#call) this.#call.valueRaw = this.#call.valueRaw.trimEnd();
+			this.#appendCallRaw(this.#buffer.slice(heal.valueEnd, heal.resumeAt));
+			this.#buffer = this.#buffer.slice(heal.resumeAt);
+			this.#endValue();
+			this.#state = "body";
+			return true;
+		}
 		if (close === -1) {
-			const hold = final ? 0 : partialSuffixOverlap(this.#buffer, ARG_VALUE_CLOSE);
+			const healHold = heal.kind === "partial" ? this.#buffer.length - heal.start : 0;
+			const hold = final ? 0 : Math.max(partialSuffixOverlap(this.#buffer, ARG_VALUE_CLOSE), healHold);
 			const emit = this.#buffer.slice(0, this.#buffer.length - hold);
 			this.#streamValue(emit, events);
 			this.#buffer = this.#buffer.slice(this.#buffer.length - hold);
@@ -389,6 +400,118 @@ function minFound(...values: readonly number[]): number {
 	return best;
 }
 
+/** Max whitespace tolerated between heal-signature tags before giving up. */
+const HEAL_WS_MAX = 32;
+/** Max key length considered plausible for an inlined `<arg_key>…</arg_key>` pair. */
+const HEAL_KEY_MAX = 128;
+
+/**
+ * Result of scanning a streaming `<arg_value>` body for a forgotten or
+ * mistyped `</arg_value>` closer.
+ *
+ * - `heal`: a repair signature starts inside the value; the value ends at
+ *   `valueEnd` and parsing resumes at `resumeAt` in "body" state.
+ *   `trimValue` marks boundaries inferred from separator formatting, whose
+ *   trailing whitespace belongs to the syntax, not the value.
+ * - `partial`: a signature may be forming at `start` but the buffer ends
+ *   before it can be confirmed; the caller must hold `start..` back from
+ *   streaming.
+ */
+type ValueHealScan =
+	| { kind: "none" }
+	| { kind: "partial"; start: number }
+	| { kind: "heal"; valueEnd: number; resumeAt: number; trimValue: boolean };
+
+type HealFollow = { kind: "match"; resumeAt: number } | { kind: "partial" } | { kind: "none" };
+
+type TagPrefixMatch = "match" | "partial" | "none";
+
+/**
+ * Finds the earliest heal signature starting before `limit` (the legit
+ * `</arg_value>` close, or end of buffer when absent). Two signatures repair
+ * a value whose closer the model botched:
+ *
+ * - Wrong closer: `</arg_key>` followed by `<arg_key>`, `</tool_call>`, or
+ *   `</arg_value>` — the model closed the value with the wrong tag.
+ * - Missing closer: a complete `<arg_key>…</arg_key>` + `<arg_value>`
+ *   sequence — the model started the next pair without closing the value.
+ *
+ * Without repair, either mistake swallows every following pair into the
+ * current value until the next `</arg_value>` anywhere in the stream.
+ */
+function scanValueHeal(text: string, limit: number): ValueHealScan {
+	for (let at = text.indexOf("<"); at !== -1 && at < limit; at = text.indexOf("<", at + 1)) {
+		const scan = matchHealSignature(text, at);
+		if (scan.kind !== "none") return scan;
+	}
+	return { kind: "none" };
+}
+
+function matchHealSignature(text: string, start: number): ValueHealScan {
+	const wrongCloser = matchTagPrefix(text, start, ARG_KEY_CLOSE);
+	if (wrongCloser === "partial") return { kind: "partial", start };
+	if (wrongCloser === "match") {
+		const follow = matchHealFollow(text, start + ARG_KEY_CLOSE.length);
+		if (follow.kind === "partial") return { kind: "partial", start };
+		if (follow.kind === "match")
+			return { kind: "heal", valueEnd: start, resumeAt: follow.resumeAt, trimValue: false };
+		return { kind: "none" };
+	}
+
+	const nextKey = matchTagPrefix(text, start, ARG_KEY_OPEN);
+	if (nextKey === "partial") return { kind: "partial", start };
+	if (nextKey === "none") return { kind: "none" };
+	let at = start + ARG_KEY_OPEN.length;
+	const keyEnd = Math.min(text.length, at + HEAL_KEY_MAX);
+	while (at < keyEnd && text[at] !== "<" && text[at] !== "\n") at++;
+	if (at === text.length) return { kind: "partial", start };
+	if (text[at] !== "<") return { kind: "none" };
+	const keyClose = matchTagPrefix(text, at, ARG_KEY_CLOSE);
+	if (keyClose === "partial") return { kind: "partial", start };
+	if (keyClose === "none") return { kind: "none" };
+	at = skipHealWhitespace(text, at + ARG_KEY_CLOSE.length);
+	if (at === -1) return { kind: "none" };
+	if (at === text.length) return { kind: "partial", start };
+	const value = matchTagPrefix(text, at, ARG_VALUE_OPEN);
+	if (value === "partial") return { kind: "partial", start };
+	if (value === "none") return { kind: "none" };
+	return { kind: "heal", valueEnd: start, resumeAt: start, trimValue: true };
+}
+
+/** Matches the tag expected after a wrong `</arg_key>` closer. */
+function matchHealFollow(text: string, from: number): HealFollow {
+	const at = skipHealWhitespace(text, from);
+	if (at === -1) return { kind: "none" };
+	if (at === text.length) return { kind: "partial" };
+	for (const tag of [ARG_KEY_OPEN, TOOL_CLOSE]) {
+		const match = matchTagPrefix(text, at, tag);
+		if (match === "match") return { kind: "match", resumeAt: at };
+		if (match === "partial") return { kind: "partial" };
+	}
+	const close = matchTagPrefix(text, at, ARG_VALUE_CLOSE);
+	if (close === "match") return { kind: "match", resumeAt: at + ARG_VALUE_CLOSE.length };
+	if (close === "partial") return { kind: "partial" };
+	return { kind: "none" };
+}
+
+/** Skips whitespace from `from`; -1 when the run exceeds {@link HEAL_WS_MAX}. */
+function skipHealWhitespace(text: string, from: number): number {
+	let at = from;
+	while (at < text.length && " \n\t\r".includes(text[at]!)) {
+		at++;
+		if (at - from > HEAL_WS_MAX) return -1;
+	}
+	return at;
+}
+
+function matchTagPrefix(text: string, at: number, tag: string): TagPrefixMatch {
+	const available = Math.min(text.length - at, tag.length);
+	for (let k = 0; k < available; k++) {
+		if (text.charCodeAt(at + k) !== tag.charCodeAt(k)) return "none";
+	}
+	return available === tag.length ? "match" : "partial";
+}
+
 function renderToolCall(call: ToolCall, options: DialectRenderOptions = {}): string {
 	return glmInvocation(call, buildArgShapes(options.tools).get(call.name));
 }

package/src/utils/validation.ts

@@ -1659,6 +1659,161 @@ function validateContext(ctx: ValidationContext, value: unknown): ContextValidat
 	};
 }
 
+// In-band `arg_key`/`arg_value` tool-call syntax that leaks into native
+// tool-call arguments when a provider parses the model's owned format
+// server-side and the model botches an `</arg_value>` closer.
+const SPILL_KEY_OPEN = "<arg_key>";
+const SPILL_KEY_CLOSE = "</arg_key>";
+const SPILL_VALUE_OPEN = "<arg_value>";
+const SPILL_VALUE_CLOSE = "</arg_value>";
+const SPILL_TOOL_CLOSE = "</tool_call>";
+/** Plausible spilled argument names; anything else is ordinary content. */
+const SPILL_KEY_PATTERN = /^[\w.$-]{1,128}$/;
+
+interface SpillSplit {
+	head: string;
+	pairs: [string, string][];
+}
+
+function skipSpillWhitespace(text: string, from: number): number {
+	let at = from;
+	while (at < text.length && " \n\t\r".includes(text[at]!)) at++;
+	return at;
+}
+
+/** Whether a well-formed `<arg_key>NAME</arg_key>…<arg_value>` pair starts at `at`. */
+function isSpillPairStart(text: string, at: number): boolean {
+	if (!text.startsWith(SPILL_KEY_OPEN, at)) return false;
+	const keyStart = at + SPILL_KEY_OPEN.length;
+	const keyEnd = text.indexOf(SPILL_KEY_CLOSE, keyStart);
+	if (keyEnd === -1 || !SPILL_KEY_PATTERN.test(text.slice(keyStart, keyEnd))) return false;
+	const valueAt = skipSpillWhitespace(text, keyEnd + SPILL_KEY_CLOSE.length);
+	return text.startsWith(SPILL_VALUE_OPEN, valueAt);
+}
+
+/**
+ * Finds where a spilled `<arg_value>` body ends: the legit closer, a
+ * mistyped `</arg_key>` closer (validated by its follow-up), the start of the
+ * next pair when the closer is missing entirely, or end of input (the
+ * provider's parser consumed the terminating closer).
+ */
+function findSpillValueEnd(text: string, from: number): { end: number; next: number } {
+	const close = text.indexOf(SPILL_VALUE_CLOSE, from);
+	let wrong = text.indexOf(SPILL_KEY_CLOSE, from);
+	let open = text.indexOf(SPILL_KEY_OPEN, from);
+	while (true) {
+		const candidates = [close, wrong, open].filter(index => index !== -1);
+		if (candidates.length === 0) return { end: text.length, next: text.length };
+		const at = Math.min(...candidates);
+		if (at === close) return { end: at, next: at + SPILL_VALUE_CLOSE.length };
+		if (at === wrong) {
+			const follow = skipSpillWhitespace(text, at + SPILL_KEY_CLOSE.length);
+			if (
+				follow >= text.length ||
+				text.startsWith(SPILL_KEY_OPEN, follow) ||
+				text.startsWith(SPILL_TOOL_CLOSE, follow)
+			) {
+				return { end: at, next: at + SPILL_KEY_CLOSE.length };
+			}
+			wrong = text.indexOf(SPILL_KEY_CLOSE, at + 1);
+			continue;
+		}
+		if (isSpillPairStart(text, at)) {
+			let end = at;
+			while (end > from && " \n\t\r".includes(text[end - 1]!)) end--;
+			return { end, next: at };
+		}
+		open = text.indexOf(SPILL_KEY_OPEN, at + 1);
+	}
+}
+
+/**
+ * Strictly parses a spill tail as `<arg_key>…</arg_key><arg_value>…` pairs,
+ * tolerating a trailing `</tool_call>`. Returns null on any shape that is not
+ * pure pair syntax — the caller then treats the text as ordinary content.
+ */
+function parseSpilledPairs(text: string): [string, string][] | null {
+	const pairs: [string, string][] = [];
+	let at = skipSpillWhitespace(text, 0);
+	while (at < text.length) {
+		if (text.startsWith(SPILL_TOOL_CLOSE, at)) {
+			at = skipSpillWhitespace(text, at + SPILL_TOOL_CLOSE.length);
+			return at >= text.length ? pairs : null;
+		}
+		if (!text.startsWith(SPILL_KEY_OPEN, at)) return null;
+		const keyStart = at + SPILL_KEY_OPEN.length;
+		const keyEnd = text.indexOf(SPILL_KEY_CLOSE, keyStart);
+		if (keyEnd === -1) return null;
+		const key = text.slice(keyStart, keyEnd);
+		if (!SPILL_KEY_PATTERN.test(key)) return null;
+		at = skipSpillWhitespace(text, keyEnd + SPILL_KEY_CLOSE.length);
+		if (!text.startsWith(SPILL_VALUE_OPEN, at)) return null;
+		at += SPILL_VALUE_OPEN.length;
+		const { end, next } = findSpillValueEnd(text, at);
+		pairs.push([key, text.slice(at, end)]);
+		at = skipSpillWhitespace(text, next);
+	}
+	return pairs;
+}
+
+/**
+ * Splits a contaminated string value at the earliest spill boundary: a
+ * mistyped `</arg_key>` closer or an inlined next pair. Returns null when no
+ * boundary yields a cleanly parseable tail.
+ */
+function splitSpilledValue(text: string): SpillSplit | null {
+	let wrong = text.indexOf(SPILL_KEY_CLOSE);
+	let open = text.indexOf(SPILL_KEY_OPEN);
+	while (wrong !== -1 || open !== -1) {
+		if (wrong !== -1 && (open === -1 || wrong < open)) {
+			const pairs = parseSpilledPairs(text.slice(wrong + SPILL_KEY_CLOSE.length));
+			if (pairs) return { head: text.slice(0, wrong), pairs };
+			wrong = text.indexOf(SPILL_KEY_CLOSE, wrong + 1);
+			continue;
+		}
+		if (isSpillPairStart(text, open)) {
+			const pairs = parseSpilledPairs(text.slice(open));
+			if (pairs && pairs.length > 0) return { head: text.slice(0, open).trimEnd(), pairs };
+		}
+		open = text.indexOf(SPILL_KEY_OPEN, open + 1);
+	}
+	return null;
+}
+
+/**
+ * Repairs native tool-call arguments contaminated by in-band
+ * `<arg_key>`/`<arg_value>` syntax. Some providers parse owned tool-call
+ * formats server-side; when the model mistypes or omits an `</arg_value>`
+ * closer, every following pair is swallowed into one string argument, e.g.
+ * `op: "done</arg_key>\n<arg_key>task</arg_key>\n<arg_value>…"`. Truncates
+ * each contaminated top-level string at its spill boundary and restores the
+ * swallowed pairs as sibling arguments (never overwriting existing keys).
+ *
+ * Only invoked after validation and every coercion pass fail, so valid calls
+ * whose string content legitimately contains tag-like text are never touched.
+ */
+function healInbandArgSpill(value: unknown): { value: unknown; changed: boolean } {
+	if (!isPlainRecord(value)) return { value, changed: false };
+	let changed = false;
+	const out: Record<string, unknown> = { ...value };
+	const recovered: [string, string][] = [];
+	for (const key in value) {
+		const entry = value[key];
+		if (typeof entry !== "string") continue;
+		if (!entry.includes(SPILL_KEY_OPEN) && !entry.includes(SPILL_KEY_CLOSE)) continue;
+		const split = splitSpilledValue(entry);
+		if (!split) continue;
+		out[key] = split.head;
+		recovered.push(...split.pairs);
+		changed = true;
+	}
+	if (!changed) return { value, changed: false };
+	for (const [key, entry] of recovered) {
+		if (!(key in out)) out[key] = entry;
+	}
+	return { value: out, changed: true };
+}
+
 const MAX_COERCION_PASSES = 5;
 
 /**
@@ -1786,7 +1941,67 @@ export function validateToolArguments(tool: Tool, toolCall: ToolCall): ToolCall[
 	let result = validateContext(ctx, normalizedArgs);
 	if (result.success) return result.value as ToolCall["arguments"];
 
+	const coercionOutcome = runCoercionPasses(ctx, normalizedArgs, result);
+	normalizedArgs = coercionOutcome.args;
+	changed ||= coercionOutcome.changed;
+	result = coercionOutcome.result;
+	if (result.success) return result.value as ToolCall["arguments"];
+
+	// Last resort: some providers parse in-band tool-call syntax server-side,
+	// and a mistyped/missing `</arg_value>` closer inlines the remaining pairs
+	// into one string argument. Gated on validation failure so valid calls
+	// with tag-like string content are never rewritten.
+	const spillHeal = healInbandArgSpill(normalizedArgs);
+	if (spillHeal.changed) {
+		normalizedArgs = spillHeal.value;
+		changed = true;
+		result = validateContext(ctx, normalizedArgs);
+		if (!result.success) {
+			const healedOutcome = runCoercionPasses(ctx, normalizedArgs, result);
+			normalizedArgs = healedOutcome.args;
+			result = healedOutcome.result;
+		}
+		if (result.success) return result.value as ToolCall["arguments"];
+	}
+
+	// Format validation errors nicely. The header phrase is asserted by
+	// existing tests; the detailed body is informational.
+	const errors = result.messages.join("\n") || "Unknown validation error";
+
+	// Truncate long per-field strings: the full payload (potentially hundreds
+	// of KB for write/edit-class calls) would otherwise round-trip back to the
+	// model inside the tool error.
+	const receivedArgs = changed
+		? {
+				original: truncateArgsForError(originalArgs),
+				normalized: truncateArgsForError(normalizedArgs),
+			}
+		: truncateArgsForError(originalArgs);
+
+	const errorMessage = `Validation failed for tool "${
+		toolCall.name
+	}":\n${errors}\n\nReceived arguments:\n${JSON.stringify(receivedArgs, null, 2)}`;
+
+	throw new AIError.ValidationError(errorMessage);
+}
+
+/**
+ * Runs up to {@link MAX_COERCION_PASSES} issue-driven coercion rounds,
+ * re-applying the schema normalizations after each round because a coercion
+ * may unwrap JSON-string containers and expose fields the pre-validation
+ * passes could not reach.
+ */
+function runCoercionPasses(
+	ctx: ValidationContext,
+	args: unknown,
+	initial: ContextValidationResult,
+): { args: unknown; result: ContextValidationResult; changed: boolean } {
+	const { json } = ctx;
+	let normalizedArgs = args;
+	let result = initial;
+	let changed = false;
 	for (let pass = 0; pass < MAX_COERCION_PASSES; pass += 1) {
+		if (result.success) break;
 		const coercion = coerceArgsFromIssues(normalizedArgs, result.flatIssues);
 		if (!coercion.changed) break;
 
@@ -1840,26 +2055,6 @@ export function validateToolArguments(tool: Tool, toolCall: ToolCall): ToolCall[
 		}
 
 		result = validateContext(ctx, normalizedArgs);
-		if (result.success) return result.value as ToolCall["arguments"];
 	}
-
-	// Format validation errors nicely. The header phrase is asserted by
-	// existing tests; the detailed body is informational.
-	const errors = result.messages.join("\n") || "Unknown validation error";
-
-	// Truncate long per-field strings: the full payload (potentially hundreds
-	// of KB for write/edit-class calls) would otherwise round-trip back to the
-	// model inside the tool error.
-	const receivedArgs = changed
-		? {
-				original: truncateArgsForError(originalArgs),
-				normalized: truncateArgsForError(normalizedArgs),
-			}
-		: truncateArgsForError(originalArgs);
-
-	const errorMessage = `Validation failed for tool "${
-		toolCall.name
-	}":\n${errors}\n\nReceived arguments:\n${JSON.stringify(receivedArgs, null, 2)}`;
-
-	throw new AIError.ValidationError(errorMessage);
+	return { args: normalizedArgs, result, changed };
 }