@operatingtag/dsh-unclesam 1.3.3 → 1.3.5

package/CHANGELOG.md

@@ -8,6 +8,64 @@ fixes the patch.
 
 ---
 
+## 1.3.5
+
+**A live web turn came apart into a loop, and the audit it prompted fixed three things.**
+
+Asked to glob a workspace it had misread, the web model invented a tool format
+(`<tool name="glob" string="true">{…}</tool>`), the parser did not accept it, nothing told the model so, and
+it repeated the block until the transcript was full of copies.
+
+- **The invented shape is now accepted.** `parseToolCall` recognises `<tool name="…">…</tool>` and
+  `<tool_call>…</tool_call>`, and `stripToolCall` removes them, so a model that drifts to tags still gets a
+  running call instead of a dead one.
+- **A reply that loops is stopped, not displayed.** `looksDegenerate` fires on three `<tool` openings or
+  four identical substantial lines, and the turn ends with a plain `web_loop` error naming what happened.
+  Nothing was wrong with the page; the model was stuck, and the person no longer has to watch it write one
+  line for minutes.
+- **Two audit findings, reproduced against the running code:**
+  - `findCallForm` treated an EMPTY tool list as "accept anything", so ordinary prose like `log(2)` and
+    `figure(2)` was silently deleted from every non-tool turn. The empty list now means "nothing is a call".
+  - A malformed call before a valid one (`read(bad) and pwsh({…})`) returned nothing, hiding the valid call
+    and leaking its text into the transcript. A bad candidate now skips to the next instead of aborting.
+
+`dev/test-call-form.mjs` gained the loop, tag, empty-list and malformed-candidate cases; the suite is 15
+suites, all green.
+
+---
+
+## 1.3.4
+
+**A tool call is now written `name({...})` instead of a JSON envelope, so the answer can stream.**
+
+MEASURED: a reply that is nothing but `{"tool":…}` cannot be shown while it is written — `streamSafeCut`
+returns 0 for the whole generation — so the harness sits empty for the entire turn and looks stuck. And a
+brace is the commonest punctuation in technical prose, so `{` is a poor delimiter: it both blocks streaming
+and invites false positives.
+
+`replace_note({"text":"…"})` needs no instruction, because it is the shape models already produce, and it is
+unambiguous once anchored on a tool name the model was actually offered. Prose streams until a known name
+opens a parenthesis, instead of stopping at the first brace anywhere.
+
+- **`parseToolCall` walks characters, not a regex**, so an argument may contain a parenthesis, a brace, an
+  escaped quote or a newline. `read()` parses as empty arguments; `see figure(2)` does not parse at all,
+  because `figure` was never offered.
+- **The JSON envelope is still accepted**, fenced or bare, as a fallback — a model may emit it unprompted
+  and refusing it would throw away a working call.
+- **`stripToolCall` removes whichever shape was used**, so neither reaches the transcript.
+- **`streamSafeCut` holds from a known name plus `(`, or from a trailing fragment of a known name of three
+  characters or more.** The first version held any fragment, so a sentence ending in `r` stalled one
+  character back — `r` prefixes `read`. Found by a test, fixed before shipping.
+- **`dev/test-call-form.mjs`** pins ten shapes that are calls, five that are not, and the stripping and
+  streaming behaviour. Two of its own assertions were written from guesswork and failed; they now measure.
+- **`dev/test-web-tool-write.mjs` asserts the shape**, not just the outcome: the raw reply is captured through
+  `UNCLE_SAM_RAW_REPLY` and must start with `name(`. Measured live: the page replied
+  `replace_note({"text":"…"})` and the file changed, **4,062 ms**.
+
+The raw capture is off unless that variable names a file, so nothing is written during ordinary use.
+
+---
+
 ## 1.3.3
 
 **The tool names were not enough: a call with the wrong argument name cannot be executed.**

package/README.ar.md

@@ -250,7 +250,7 @@ Copyright (c) 2026 Darren T. Weldon، منشور تحت اسم Operating Tag.
 Uncle Sam إضافة مستقلة. غير مرتبطة بـ DeepSeek، ولا تحظى بتأييدهم أو دعمهم.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 المؤلف     Operating Tag
 الترخيص    CC BY-NC-ND 4.0 — مجاني للاستخدام، لا للتغيير أو المشاركة أو البيع
 ```

package/README.az.md

@@ -256,7 +256,7 @@ soruşun — aydın cavab və aydın qiymət alacaqsınız.
 Uncle Sam müstəqil plagindir. DeepSeek ilə bağlı deyil, onlar tərəfindən təsdiqlənməyib və dəstəklənmir.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Müəllif    Operating Tag
 Lisenziya  CC BY-NC-ND 4.0 — istifadə üçün pulsuz, dəyişdirmək, paylaşmaq və ya satmaq üçün deyil
 ```

package/README.bg.md

@@ -259,7 +259,7 @@ Copyright (c) 2026 Darren T. Weldon, публикувано под името Op
 Uncle Sam е независима приставка. Не е свързана с DeepSeek, не е одобрена или поддържана от тях.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Автор     Operating Tag
 Лиценз    CC BY-NC-ND 4.0 — свободно за използване, не за промяна, споделяне или продажба
 ```

package/README.bn.md

@@ -254,7 +254,7 @@ Copyright (c) 2026 Darren T. Weldon, Operating Tag নামে প্রকা
 Uncle Sam একটি স্বাধীন প্লাগইন। DeepSeek-এর সঙ্গে যুক্ত নয়, তাদের অনুমোদন বা সমর্থন নেই।
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 লেখক      Operating Tag
 লাইসেন্স   CC BY-NC-ND 4.0 — ব্যবহারে বিনামূল্যে, পরিবর্তন, শেয়ার বা বিক্রিতে নয়
 ```

package/README.cs.md

@@ -256,7 +256,7 @@ Závazný je soubor [LICENSE](LICENSE) a začíná stejným shrnutím v jednoduc
 Uncle Sam je nezávislý plugin. Není spojený s DeepSeek, není jimi schválený ani podporovaný.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Autor     Operating Tag
 Licence   CC BY-NC-ND 4.0 — zdarma k použití, ne ke změně, sdílení nebo prodeji
 ```

package/README.da.md

@@ -257,7 +257,7 @@ Filen [LICENSE](LICENSE) er den gældende, og den begynder med samme resumé på
 Uncle Sam er et uafhængigt plugin. Ikke knyttet til DeepSeek, ikke godkendt eller støttet af dem.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Forfatter   Operating Tag
 Licens      CC BY-NC-ND 4.0 — frit at bruge, ikke at ændre, dele eller sælge
 ```

package/README.de.md

@@ -270,7 +270,7 @@ Englisch.
 Uncle Sam ist ein unabhängiges Plugin. Nicht mit DeepSeek verbunden, von ihnen weder unterstützt noch gefördert.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Autor     Operating Tag
 Lizenz    CC BY-NC-ND 4.0 — frei zur Nutzung, nicht zum Ändern, Weitergabe oder Verkauf
 ```

package/README.el.md

@@ -266,7 +266,7 @@ Copyright (c) 2026 Darren T. Weldon, δημοσιευμένο με το όνομ
 Το Uncle Sam είναι ανεξάρτητο πρόσθετο. Δεν συνδέεται με τη DeepSeek, δεν εγκρίνεται ούτε υποστηρίζεται από αυτούς.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Δημιουργός   Operating Tag
 Άδεια        CC BY-NC-ND 4.0 — ελεύθερο για χρήση, όχι για αλλαγή, κοινή χρήση ή πώληση
 ```

package/README.es.md

@@ -264,7 +264,7 @@ El archivo [LICENSE](LICENSE) es el que rige, y abre con el mismo resumen en ing
 Uncle Sam es un plugin independiente. No está afiliado, respaldado ni soportado por DeepSeek.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Autor    Operating Tag
 Licencia CC BY-NC-ND 4.0 — gratis para usar, no para cambiar, compartir o vender
 ```

package/README.fa.md

@@ -256,7 +256,7 @@ Copyright (c) 2026 Darren T. Weldon، منتشرشده با نام Operating Tag
 Uncle Sam یک افزونه مستقل است. وابسته به DeepSeek نیست، تأیید یا پشتیبانی نمی‌شود.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 نویسنده   Operating Tag
 پروانه     CC BY-NC-ND 4.0 — آزاد برای استفاده، نه برای تغییر، اشتراک یا فروش
 ```

package/README.fi.md

@@ -258,7 +258,7 @@ Tiedosto [LICENSE](LICENSE) on ratkaiseva, ja se alkaa samalla yhteenvedolla yks
 Uncle Sam on itsenäinen lisäosa. Ei sidoksissa DeepSeekiin, ei heidän hyväksymänsä tai tukemansa.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Tekijä     Operating Tag
 Lisenssi   CC BY-NC-ND 4.0 — vapaa käytettäväksi, ei muutettavaksi, jaettavaksi tai myytäväksi
 ```

package/README.fr.md

@@ -268,7 +268,7 @@ Le fichier [LICENSE](LICENSE) fait foi, et il s'ouvre sur le même résumé en a
 Uncle Sam est un plugin indépendant. Non affilié à DeepSeek, ni approuvé ni soutenu par eux.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Auteur     Operating Tag
 Licence    CC BY-NC-ND 4.0 — gratuit à l'usage, pas au changement, au partage ou à la vente
 ```

package/README.he.md

@@ -248,7 +248,7 @@ Copyright (c) 2026 Darren T. Weldon, פורסם תחת השם Operating Tag.
 Uncle Sam הוא תוסף עצמאי. לא קשור ל‑DeepSeek, לא מאושר ולא נתמך על ידם.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 יוצר     Operating Tag
 רישיון   CC BY-NC-ND 4.0 — חופשי לשימוש, לא לשינוי, שיתוף או מכירה
 ```

package/README.hi.md

@@ -259,7 +259,7 @@ Copyright (c) 2026 Darren T. Weldon, Operating Tag नाम से प्रक
 Uncle Sam एक स्वतंत्र प्लगइन है। DeepSeek से जुड़ा नहीं, उनका समर्थन या अनुमोदन नहीं।
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 लेखक     Operating Tag
 लाइसेंस  CC BY-NC-ND 4.0 — इस्तेमाल मुफ़्त, बदलना, बाँटना या बेचना नहीं
 ```

package/README.hr.md

@@ -256,7 +256,7 @@ Datoteka [LICENSE](LICENSE) je obvezujuća i počinje istim sažetkom na jednost
 Uncle Sam je neovisni dodatak. Nije povezan s DeepSeekom, nije odobren ni podržan od njih.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Autor      Operating Tag
 Licencija  CC BY-NC-ND 4.0 — besplatno za korištenje, ne za izmjenu, dijeljenje ili prodaju
 ```

package/README.hu.md

@@ -260,7 +260,7 @@ A [LICENSE](LICENSE) fájl a mérvadó, és ugyanazzal az egyszerű angol össze
 Az Uncle Sam független bővítmény. Nem kapcsolódik a DeepSeekhez, ő nem hagyja jóvá és nem támogatja.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Szerző    Operating Tag
 Licenc    CC BY-NC-ND 4.0 — szabadon használható, nem módosítható, osztható meg vagy adható el
 ```

package/README.id.md

@@ -260,7 +260,7 @@ Berkas [LICENSE](LICENSE) yang mengikat, dan ia dibuka dengan ringkasan yang sam
 Uncle Sam adalah plugin independen. Tidak berafiliasi dengan DeepSeek, tidak didukung maupun disponsori oleh mereka.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Penulis   Operating Tag
 Lisensi   CC BY-NC-ND 4.0 — bebas dipakai, tidak untuk diubah, dibagikan, atau dijual
 ```

package/README.it.md

@@ -264,7 +264,7 @@ Il file [LICENSE](LICENSE) è quello che fa fede, e si apre con lo stesso riassu
 Uncle Sam è un plugin indipendente. Non affiliato a DeepSeek, né approvato né supportato da loro.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Autore    Operating Tag
 Licenza   CC BY-NC-ND 4.0 — libero da usare, non da modificare, condividere o vendere
 ```

package/README.ja.md

@@ -259,7 +259,7 @@ Copyright (c) 2026 Darren T. Weldon、Operating Tag 名義で公開。
 Uncle Sam は独立したプラグインです。DeepSeek とは関係がなく、承認も支援も受けていません。
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 作者      Operating Tag
 ライセンス  CC BY-NC-ND 4.0 — 使用は自由、変更・共有・販売は不可
 ```

package/README.ka.md

@@ -257,7 +257,7 @@ Copyright (c) 2026 Darren T. Weldon, გამოქვეყნებული
 Uncle Sam დამოუკიდებელი დანამატია. არ არის დაკავშირებული DeepSeek-თან, მათ მიერ არ არის დამტკიცებული ან მხარდაჭერილი.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 ავტორი     Operating Tag
 ლიცენზია   CC BY-NC-ND 4.0 — თავისუფალი გამოსაყენებლად, არა შესაცვლელად, გასაზიარებლად ან გასაყიდად
 ```

package/README.kk.md

@@ -258,7 +258,7 @@ Operating Tag-тан сұраңыз — нақты жауап және нақт
 Uncle Sam — тәуелсіз плагин. DeepSeek-пен байланысты емес, олар мақұлдамаған немесе қолдамаған.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Авторы     Operating Tag
 Лицензия   CC BY-NC-ND 4.0 — пайдалануға тегін, өзгертуге, бөлісуге немесе сатуға емес
 ```

package/README.km.md

@@ -253,7 +253,7 @@ Tag — អ្នកនឹងទទួលបានចម្លើយច្បា
 Uncle Sam គឺជាកម្មវិធីបន្ថែមឯករាជ្យ។ មិនពាក់ព័ន្ធនឹង DeepSeek មិនត្រូវបានអនុម័ត ឬគាំទ្រដោយពួកគេ។
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 អ្នកនិពន្ធ  Operating Tag
 អាជ្ញាបណ្ណ  CC BY-NC-ND 4.0 — ប្រើឥតគិតថ្លៃ មិនមែនសម្រាប់កែប្រែ ចែករំលែក ឬលក់
 ```

package/README.ko.md

@@ -254,7 +254,7 @@ Copyright (c) 2026 Darren T. Weldon, Operating Tag 이름으로 공개.
 Uncle Sam은 독립적인 플러그인입니다. DeepSeek과 무관하며, 그들의 보증이나 지원을 받지 않습니다.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 저자      Operating Tag
 라이선스   CC BY-NC-ND 4.0 — 사용은 자유, 변경·공유·판매는 불가
 ```

package/README.lt.md

@@ -257,7 +257,7 @@ Failas [LICENSE](LICENSE) yra privalomas, ir jis prasideda ta pačia santrauka p
 Uncle Sam yra nepriklausomas papildinys. Nesusijęs su DeepSeek, jų nepatvirtintas ir neremiamas.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Autorius    Operating Tag
 Licencija   CC BY-NC-ND 4.0 — nemokama naudoti, ne keisti, bendrinti ar parduoti
 ```

package/README.md

@@ -257,7 +257,7 @@ The [LICENSE](LICENSE) file governs, and it opens with the same summary in plain
 Uncle Sam is an independent plugin. Not affiliated with, endorsed by, or supported by DeepSeek.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Author   Operating Tag
 Licence  CC BY-NC-ND 4.0 — free to use, not to change, share or sell
 ```

package/README.mr.md

@@ -254,7 +254,7 @@ Copyright (c) 2026 Darren T. Weldon, Operating Tag नावाने प्र
 Uncle Sam एक स्वतंत्र प्लगइन आहे. DeepSeek शी संबंधित नाही, त्यांची मान्यता किंवा समर्थन नाही.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 लेखक      Operating Tag
 परवाना     CC BY-NC-ND 4.0 — वापरण्यास मोफत, बदलण्यास, सामायिक करण्यास किंवा विकण्यास नाही
 ```

package/README.ms.md

@@ -261,7 +261,7 @@ mudah.
 Uncle Sam ialah pemalam bebas. Tidak berkaitan dengan DeepSeek, tidak disokong atau ditaja oleh mereka.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Penulis    Operating Tag
 Lesen      CC BY-NC-ND 4.0 — bebas digunakan, bukan untuk diubah, dikongsi atau dijual
 ```

package/README.my.md

@@ -262,7 +262,7 @@ Copyright (c) 2026 Darren T. Weldon, Operating Tag အမည်ဖြင့်
 Uncle Sam သည် သီးခြားလွတ်လပ်သော plugin ဖြစ်သည်။ DeepSeek နှင့် မသက်ဆိုင်ပါ၊ ၎င်းတို့က အတည်မပြု၊ မပံ့ပိုးပါ။
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 စာရေးသူ    Operating Tag
 လိုင်စင်     CC BY-NC-ND 4.0 — အသုံးပြုရန် အခမဲ့၊ ပြောင်းလဲရန်၊ မျှဝေရန် သို့မဟုတ် ရောင်းရန် မဟုတ်
 ```

package/README.ne.md

@@ -254,7 +254,7 @@ Copyright (c) 2026 Darren T. Weldon, Operating Tag नाममा प्रक
 Uncle Sam स्वतन्त्र प्लगइन हो। DeepSeek सँग सम्बन्धित छैन, उनीहरूको स्वीकृति वा समर्थन छैन।
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 लेखक     Operating Tag
 इजाजतपत्र CC BY-NC-ND 4.0 — प्रयोग गर्न निःशुल्क, परिवर्तन, बाँड्न वा बेच्न होइन
 ```

package/README.nl.md

@@ -262,7 +262,7 @@ Het bestand [LICENSE](LICENSE) is bindend, en het begint met dezelfde samenvatti
 Uncle Sam is een onafhankelijke plugin. Niet verbonden met DeepSeek, door hen niet goedgekeurd of ondersteund.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Auteur    Operating Tag
 Licentie  CC BY-NC-ND 4.0 — vrij om te gebruiken, niet om te wijzigen, delen of verkopen
 ```

package/README.no.md

@@ -257,7 +257,7 @@ Filen [LICENSE](LICENSE) er den gjeldende, og den begynner med det samme sammend
 Uncle Sam er en uavhengig utvidelse. Ikke knyttet til DeepSeek, ikke godkjent eller støttet av dem.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Forfatter   Operating Tag
 Lisens      CC BY-NC-ND 4.0 — fritt å bruke, ikke å endre, dele eller selge
 ```

package/README.pl.md

@@ -262,7 +262,7 @@ Wiążący jest plik [LICENSE](LICENSE), a otwiera się tym samym podsumowaniem
 Uncle Sam to niezależna wtyczka. Niepowiązana z DeepSeek, nie firmowana ani nie wspierana przez nich.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Autor      Operating Tag
 Licencja   CC BY-NC-ND 4.0 — wolno używać, nie wolno zmieniać, udostępniać ani sprzedawać
 ```

package/README.pt.md

@@ -261,7 +261,7 @@ O arquivo [LICENSE](LICENSE) é o que vale, e ele abre com o mesmo resumo em ing
 O Uncle Sam é um plugin independente. Não afiliado ao DeepSeek, nem endossado nem apoiado por ele.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Autor     Operating Tag
 Licença   CC BY-NC-ND 4.0 — livre para usar, não para alterar, compartilhar ou vender
 ```

package/README.ro.md

@@ -258,7 +258,7 @@ Fișierul [LICENSE](LICENSE) este cel care guvernează și începe cu același r
 Uncle Sam este un plugin independent. Neafiliat cu DeepSeek, neaprobat și nesprijinit de ei.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Autor     Operating Tag
 Licență   CC BY-NC-ND 4.0 — liber de folosit, nu de modificat, partajat sau vândut
 ```

package/README.ru.md

@@ -265,7 +265,7 @@ International. Copyright (c) 2026 Darren T. Weldon, опубликовано п
 Uncle Sam — независимый плагин. Не связан с DeepSeek, не одобрен и не поддерживается им.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Автор      Operating Tag
 Лицензия   CC BY-NC-ND 4.0 — бесплатно для использования, не для изменения, передачи или продажи
 ```

package/README.si.md

@@ -255,7 +255,7 @@ Copyright (c) 2026 Darren T. Weldon, Operating Tag නාමයෙන් ප්
 Uncle Sam ස්වාධීන ප්ලගීනයකි. DeepSeek සමඟ සම්බන්ධ නැත, ඔවුන් අනුමත හෝ අනුග්‍රහය නොදක්වයි.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 කතෘ      Operating Tag
 බලපත්‍රය   CC BY-NC-ND 4.0 — භාවිතයට නොමිලේ, වෙනස් කිරීමට, බෙදා ගැනීමට හෝ විකිණීමට නොවේ
 ```

package/README.sk.md

@@ -257,7 +257,7 @@ Záväzný je súbor [LICENSE](LICENSE) a začína rovnakým zhrnutím v jednodu
 Uncle Sam je nezávislý doplnok. Nie je spojený s DeepSeek, nie je nimi schválený ani podporovaný.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Autor     Operating Tag
 Licencia  CC BY-NC-ND 4.0 — zadarmo na používanie, nie na zmenu, zdieľanie alebo predaj
 ```

package/README.sl.md

@@ -258,7 +258,7 @@ Zavezujoča je datoteka [LICENSE](LICENSE) in se začne z istim povzetkom v prep
 Uncle Sam je neodvisen vtičnik. Ni povezan z DeepSeek, ni odobren ali podprt z njihove strani.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Avtor      Operating Tag
 Licenca    CC BY-NC-ND 4.0 — brezplačno za uporabo, ne za spreminjanje, deljenje ali prodajo
 ```

package/README.sr.md

@@ -258,7 +258,7 @@ Copyright (c) 2026 Darren T. Weldon, објављено под именом Oper
 Uncle Sam је независни додатак. Није повезан са DeepSeek, није одобрен ни подржан од њих.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Аутор      Operating Tag
 Лиценца    CC BY-NC-ND 4.0 — бесплатно за употребу, не за измену, дељење или продају
 ```

package/README.sv.md

@@ -259,7 +259,7 @@ Filen [LICENSE](LICENSE) är den som gäller, och den börjar med samma sammanfa
 Uncle Sam är ett fristående insticksprogram. Inte knutet till DeepSeek, inte godkänt eller stött av dem.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Författare   Operating Tag
 Licens       CC BY-NC-ND 4.0 — fritt att använda, inte att ändra, dela eller sälja
 ```

package/README.sw.md

@@ -259,7 +259,7 @@ Faili [LICENSE](LICENSE) ndiyo inayotumika, na inaanza na muhtasari huo huo kwa
 Uncle Sam ni programu-jalizi huru. Haijahusishwa na DeepSeek, haijaidhinishwa wala kuungwa mkono nao.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Mwandishi  Operating Tag
 Leseni     CC BY-NC-ND 4.0 — huru kutumika, si kubadilisha, kushiriki au kuuza
 ```

package/README.ta.md

@@ -262,7 +262,7 @@ Tag ஐக் கேளுங்கள் — தெளிவான பதில
 Uncle Sam ஒரு சுயாதீனச் செருகல். DeepSeek உடன் தொடர்பில்லை, அவர்களின் ஒப்புதல் அல்லது ஆதரவு இல்லை.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 ஆசிரியர்   Operating Tag
 உரிமம்     CC BY-NC-ND 4.0 — பயன்படுத்த இலவசம், மாற்ற, பகிர அல்லது விற்க அல்ல
 ```

package/README.te.md

@@ -256,7 +256,7 @@ Tag ను అడగండి — స్పష్టమైన సమాధాన
 Uncle Sam స్వతంత్ర ప్లగిన్. DeepSeek తో సంబంధం లేదు, వారి ఆమోదం లేదా మద్దతు లేదు.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 రచయిత     Operating Tag
 లైసెన్స్   CC BY-NC-ND 4.0 — వాడటానికి ఉచితం, మార్చడానికి, పంచుకోవడానికి లేదా అమ్మడానికి కాదు
 ```

package/README.th.md

@@ -252,7 +252,7 @@ Operating Tag แล้วคุณจะได้คำตอบที่ชั
 Uncle Sam เป็นปลั๊กอินอิสระ ไม่เกี่ยวข้องกับ DeepSeek ไม่ได้รับการรับรองหรือสนับสนุนจากพวกเขา
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 ผู้เขียน   Operating Tag
 สัญญาอนุญาต CC BY-NC-ND 4.0 — ใช้ฟรี ไม่ใช่เพื่อดัดแปลง แบ่งปัน หรือขาย
 ```

package/README.tl.md

@@ -265,7 +265,7 @@ Ang file na [LICENSE](LICENSE) ang namamahala, at nagsisimula ito sa parehong bu
 Ang Uncle Sam ay isang malayang plugin. Hindi kaanib sa DeepSeek, hindi inendorso o sinusuportahan nila.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 May-akda    Operating Tag
 Lisensya    CC BY-NC-ND 4.0 — libre gamitin, hindi para baguhin, ibahagi o ibenta
 ```

package/README.tr.md

@@ -261,7 +261,7 @@ Uncle Sam bağımsız bir eklentidir. DeepSeek ile bağlantılı değildir, onla
 desteklenmemiştir.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Yazar    Operating Tag
 Lisans   CC BY-NC-ND 4.0 — kullanması serbest, değiştirmesi, paylaşması veya satması değil
 ```

package/README.uk.md

@@ -261,7 +261,7 @@ International. Copyright (c) 2026 Darren T. Weldon, опубліковано п
 Uncle Sam — незалежний плагін. Не пов'язаний із DeepSeek, не схвалений і не підтриманий ними.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Автор      Operating Tag
 Ліцензія   CC BY-NC-ND 4.0 — вільно використовувати, не змінювати, передавати чи продавати
 ```

package/README.ur.md

@@ -257,7 +257,7 @@ Copyright (c) 2026 Darren T. Weldon، Operating Tag نام سے شائع شدہ
 Uncle Sam ایک خودمختار پلگ ان ہے۔ DeepSeek سے وابستہ نہیں، ان کی توثیق یا معاونت حاصل نہیں۔
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 مصنف      Operating Tag
 لائسنس     CC BY-NC-ND 4.0 — استعمال کے لیے مفت، تبدیلی، اشتراک یا فروخت کے لیے نہیں
 ```

package/README.uz.md

@@ -258,7 +258,7 @@ Tag dan so'rang — aniq javob va aniq narx olasiz.
 Uncle Sam — mustaqil plagin. DeepSeek bilan bog'liq emas, ular tomonidan ma'qullanmagan yoki qo'llab-quvvatlanmagan.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Muallif    Operating Tag
 Litsenziya CC BY-NC-ND 4.0 — foydalanish uchun bepul, o'zgartirish, ulashish yoki sotish uchun emas
 ```

package/README.vi.md

@@ -259,7 +259,7 @@ Tệp [LICENSE](LICENSE) là văn bản có hiệu lực, và nó mở đầu b
 Uncle Sam là một plugin độc lập. Không liên kết với DeepSeek, không được họ chứng thực hay hỗ trợ.
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 Tác giả   Operating Tag
 Giấy phép CC BY-NC-ND 4.0 — miễn phí để dùng, không được sửa, chia sẻ hay bán
 ```

package/README.zh.md

@@ -244,7 +244,7 @@ Copyright (c) 2026 Darren T. Weldon，以 Operating Tag 名义发布。
 Uncle Sam 是一个独立插件。与 DeepSeek 无关联，未获其背书，也未获其支持。
 
 ```
-@operatingtag/dsh-unclesam   v1.3.3
+@operatingtag/dsh-unclesam   v1.3.5
 作者      Operating Tag
 许可      CC BY-NC-ND 4.0 —— 可免费使用，不可修改、共享或出售
 ```

package/index.js

@@ -27,8 +27,8 @@
  *     prose instead of a call, and the harness sees no tool use that turn.
  */
 
-import { ChatSession, WebChatError } from './lib/engine.mjs';
-import { buildPrompt, messageText, parseToolCall, stripToolCall, streamSafeCut } from './lib/prompt.mjs';
+import { writeFileSync } from 'node:fs';
+import { ChatSession, WebChatError } from './lib/engine.mjs';import { buildPrompt, looksDegenerate, messageText, parseToolCall, stripToolCall, streamSafeCut } from './lib/prompt.mjs';
 import { SavingsMeter, estimateTokens as estimateTokensForSavings } from './lib/savings.mjs';
 import { Locales } from './lib/i18n.mjs';
 import { Prefs, prefsPath, profileDir } from './lib/prefs.mjs';
@@ -457,6 +457,16 @@ export function apply(ctx, config = {}) {
       }
 
       const wantTools = Array.isArray(options.tools) && options.tools.length > 0;
+      /*
+       * The names this turn offered, exactly as the page was told them.
+       *
+       * `name({...})` is only a call when `name` is one of these - that is what makes the form unambiguous.
+       * Without the list, prose like `see figure(2)` would look like a call.
+       */
+      const toolNames = wantTools ? options.tools.map((t) => t?.name).filter(Boolean) : [];
+
+      /** Set when the reply collapsed into repetition; the turn then ends with an error, not garbage. */
+      let stoppedAsLoop = false;
       const switches = switchesFor(model, settings);
       // A search answer is delivered as two blocks: what was searched and where it looked, then the
       // answer. That means the text cannot stream while search is on - the sources are only readable
@@ -556,11 +566,44 @@ export function apply(ctx, config = {}) {
           if (chunk.done) {
             assembled = chunk.text;
             if (chunk.sources) sources = chunk.sources;
+            /*
+             * Optional raw capture, for tests that need to see the reply AS THE PAGE WROTE IT.
+             *
+             * A recovered call proves the parser worked, not which shape the model chose - and the shape is
+             * the thing being changed when the call format changes. Writing the raw reply to a path the test
+             * names turns "the call parsed" into "the model emitted this, character for character".
+             *
+             * Off unless UNCLE_SAM_RAW_REPLY names a file, so nothing is written during ordinary use.
+             */
+            if (process.env.UNCLE_SAM_RAW_REPLY) {
+              try {
+                writeFileSync(process.env.UNCLE_SAM_RAW_REPLY, chunk.text ?? '', 'utf8');
+              } catch {
+                /* a diagnostic must never break the turn */
+              }
+            }
             continue;
           }
           if (!chunk.text) continue;
           assembled += chunk.text;
 
+          /*
+           * Stop a reply that has come apart into a loop.
+           *
+           * MEASURED, live: a web turn emitted the same malformed `<tool …>` block hundreds of times and the
+           * adapter streamed every copy, so the person watched a page write one line for minutes and
+           * reasonably concluded the plugin was broken. Nothing was wrong with the page — the model had
+           * invented a call format, the call never ran, and nothing told it so.
+           *
+           * The loop is now cut at the source: the turn ends with a plain error that says what happened,
+           * instead of displaying the wreckage. Only checked when the new text could contribute, so ordinary
+           * turns pay nothing for it.
+           */
+          if (/<tool/i.test(chunk.text) && looksDegenerate(assembled)) {
+            stoppedAsLoop = true;
+            break;
+          }
+
           if (wantSearch) {
             // held for ordering; nothing is emitted until the sources are known
             continue;
@@ -573,7 +616,7 @@ export function apply(ctx, config = {}) {
            * grow into {"tool":...}. Ordinary prose passes straight through, braces included, so the stream
            * stays live; it simply stops one brace early when a call might be starting.
            */
-          const safe = streamSafeCut(assembled);
+          const safe = streamSafeCut(assembled, toolNames);
           if (safe > shown) {
             const out = assembled.slice(shown, safe);
             shown = safe;
@@ -589,6 +632,29 @@ export function apply(ctx, config = {}) {
 
         // Search answers are emitted as two visible blocks so the transcript shows BOTH what was asked
         // of the web and what came back, before the answer that used it.
+        /*
+         * A reply that collapsed into repetition ends here, with an error that says so.
+         *
+         * The alternative - what used to happen - is that the loop is streamed to the transcript in full,
+         * which reads as the plugin having broken when in fact the model is stuck. Naming it is the whole
+         * point: the person can see that the page looped, not that their harness failed.
+         */
+        if (stoppedAsLoop) {
+          yield {
+            type: 'finish',
+            reason: {
+              kind: 'error',
+              failure: new WebChatError(
+                'The web reply collapsed into repetition - the same block written over and over - so the ' +
+                  'turn was stopped. Nothing was lost: send the message again, or switch to an API model ' +
+                  'for this one.',
+                'web_loop',
+              ),
+            },
+          };
+          return;
+        }
+
         if (wantSearch) {
           /*
            * The query is the person's newest message - and ONLY the person's.
@@ -634,7 +700,7 @@ export function apply(ctx, config = {}) {
           yield { type: 'text-delta', index: 0, text: summaryWithLabel };
           yield { type: 'block-end', index: 0, block: { type: 'text', text: summaryWithLabel } };
 
-          const answerText = stripToolCall(assembled);
+          const answerText = stripToolCall(assembled, toolNames);
           yield { type: 'block-start', index: 1, blockType: 'text' };
           if (answerText) yield { type: 'text-delta', index: 1, text: answerText };
           yield { type: 'block-end', index: 1, block: { type: 'text', text: answerText } };
@@ -645,7 +711,7 @@ export function apply(ctx, config = {}) {
            * block is emitted after the answer, exactly as the plain path does.
            */
           if (wantTools) {
-            const call = parseToolCall(assembled);
+            const call = parseToolCall(assembled, toolNames);
             if (call) {
               const callId = `webcall_${Date.now().toString(36)}`;
               yield { type: 'block-start', index: 2, blockType: 'tool-call' };
@@ -689,7 +755,7 @@ export function apply(ctx, config = {}) {
         }
 
         if (wantTools) {
-          const call = parseToolCall(assembled);
+          const call = parseToolCall(assembled, toolNames);
           if (call) {
             // A tool call was made. Any prose the model wrapped around it belongs in the text block;
             // the JSON itself must not reach the transcript.
@@ -732,7 +798,7 @@ export function apply(ctx, config = {}) {
               emitted += WEB_LABEL;
               yield { type: 'text-delta', index: 0, text: WEB_LABEL };
             }
-            const tail = stripToolCall(assembled.slice(shown));
+            const tail = stripToolCall(assembled.slice(shown), toolNames);
             if (tail) {
               emitted += tail;
               yield { type: 'text-delta', index: 0, text: tail };
@@ -774,7 +840,7 @@ export function apply(ctx, config = {}) {
          * scanner stopped one brace short of any. Scrubbing the tail and appending it keeps the committed
          * block equal to the deltas that were yielded, which the harness checks.
          */
-        const held = stripToolCall(assembled.slice(shown));
+        const held = stripToolCall(assembled.slice(shown), toolNames);
         if (held) {
           if (!emitted) {
             emitted += WEB_LABEL;

package/lib/prompt.mjs

@@ -161,7 +161,7 @@ export function toolPreamble(tools) {
    * emulation exists to work around.
    */
   const HEAD = 'Tools: ';
-  const TAIL = ' · to call one reply only with {"tool":"name","arguments":{}}';
+  const TAIL = ' · to call one reply only with name({"arg":"value"})';
 
   /**
    * Room for the list.
@@ -393,10 +393,214 @@ function finish(text, expectsToolCall, continuing) {
  * that merely CONTAINS the word tool but no valid object is treated as prose, because treating it as a
  * malformed call would throw away a perfectly good answer.
  */
-export function parseToolCall(reply) {
+/**
+ * Detect a reply that has come apart into repetition.
+ *
+ * MEASURED, live: asked to glob a workspace it had misread, the web model emitted the same malformed block
+ * — `<tool name="glob" string="true">{…}</tool>` — over and over, filling the transcript with hundreds of
+ * copies. The adapter streamed every one of them, because nothing was looking for that shape of failure.
+ *
+ * A format mismatch is recoverable: the call does not run and the model is told. A LOOP is not, because the
+ * person sits watching a page write the same line for minutes and concludes the plugin is broken.
+ *
+ * WHAT COUNTS AS DEGENERATE
+ *     Four identical substantial lines, or three `<tool` openings. Both are far beyond anything a real answer
+ *     does; an answer that repeats a sentence twice is fine and stays fine.
+ */
+export function looksDegenerate(reply) {
+  const s = String(reply ?? '');
+
+  /*
+   * Tag stacking first, and without a length floor.
+   *
+   * The floor exists so a short answer cannot be judged on a handful of lines. It must not gate this check:
+   * three `<tool` openings is three calls attempted in one reply, which is wrong however short the text is.
+   * Measured: the first version returned false for a three-tag reply because it was under 200 characters -
+   * the guard missed exactly the shape it was written for.
+   */
+  const tags = s.match(/<tool\b/gi);
+  if (tags && tags.length >= 3) return true;
+
+  /*
+   * No length floor on the line check either.
+   *
+   * It was there to stop a short answer being judged on a few lines, and it was wrong twice: a five-line
+   * loop sat under the floor and went undetected, which is precisely the case the guard exists for. Four
+   * identical lines of twenty characters or more is already far outside ordinary prose on its own.
+   */
+  const lines = s.split('\n').map((l) => l.trim()).filter((l) => l.length >= 20);
+  const counts = new Map();
+  for (const line of lines) counts.set(line, (counts.get(line) || 0) + 1);
+  for (const n of counts.values()) if (n >= 4) return true;
+
+  return false;
+}
+
+/**
+ * Find `name({...})` in a reply, where `name` is one of the tools that was offered.
+ *
+ * WHY THIS FORM IS PREFERRED OVER JSON
+ *     MEASURED: a reply that is nothing but `{"tool":…}` cannot be shown while it is written, so the harness
+ *     sits empty for the whole generation and looks stuck. And a brace is the commonest punctuation in
+ *     technical prose, so `{` is a poor delimiter - it both blocks streaming and invites false positives.
+ *
+ *     `read({"path":"x"})` needs no instruction, because it is the shape models already produce, and it is
+ *     unambiguous once it is anchored on a tool name the model was actually given. `read(` when `read` is in
+ *     the offered list is a far stronger signal than `{`.
+ *
+ * WHAT IT DOES NOT DO
+ *     It does not JSON.parse inside strings or respect nesting by regex - it walks the characters, because an
+ *     argument may contain a parenthesis or a brace inside a string and a regex would stop there.
+ */
+function findCallForm(text, names) {
+  /*
+   * `hasList` distinguishes "no list supplied" from "an empty list supplied", and that distinction is the
+   * whole of two bugs.
+   *
+   * An EMPTY list means "no tools are offered", so nothing can be a call - and a word followed by parentheses
+   * in ordinary prose, like `log(2)` or `figure(2)`, must be left alone. The old code collapsed both cases
+   * into `null` ("accept anything"), so a turn with no tools deleted such prose from the answer.
+   */
+  const hasList = Array.isArray(names);
+
+  for (let i = 0; i < text.length; i += 1) {
+    if (!/[A-Za-z_]/.test(text[i])) continue;
+
+    // Read the identifier at this position.
+    let j = i;
+    let word = '';
+    while (j < text.length && /[A-Za-z0-9_.-]/.test(text[j])) {
+      word += text[j];
+      j += 1;
+    }
+    if (!word) continue;
+    if (hasList && !names.includes(word)) {
+      i = j - 1;
+      continue;
+    }
+
+    // Optional whitespace, then a parenthesis.
+    let k = j;
+    while (k < text.length && (text[k] === ' ' || text[k] === '\t' || text[k] === '\n')) k += 1;
+    if (text[k] !== '(') {
+      i = j - 1;
+      continue;
+    }
+
+    // Walk to the matching parenthesis, respecting strings and escapes.
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    let end = -1;
+    for (let p = k; p < text.length; p += 1) {
+      const ch = text[p];
+      if (inString) {
+        if (escaped) escaped = false;
+        else if (ch === '\\') escaped = true;
+        else if (ch === '"') inString = false;
+        continue;
+      }
+      if (ch === '"') inString = true;
+      else if (ch === '(') depth += 1;
+      else if (ch === ')') {
+        depth -= 1;
+        if (depth === 0) {
+          end = p;
+          break;
+        }
+      }
+    }
+    if (end === -1) return null; // still being written - no complete call yet
+
+    const inside = text.slice(k + 1, end).trim();
+    let args = {};
+    if (inside) {
+      try {
+        args = JSON.parse(inside);
+      } catch {
+        /*
+         * Skip this candidate and keep scanning, instead of aborting.
+         *
+         * MEASURED: `read(bad) and pwsh({"command":"dir"})` returned nothing, because the first malformed
+         * candidate returned null for the whole reply and the valid `pwsh(...)` behind it was never reached.
+         * A bad call earlier in a reply must not hide a good one later. Resume just past this closing paren.
+         */
+        i = end;
+        continue;
+      }
+    }
+
+    return {
+      name: word,
+      arguments: JSON.stringify(args),
+      start: i,
+      end: end + 1,
+    };
+  }
+
+  return null;
+}
+
+/**
+ * Recover a tool call from a plain-text reply, if the model made one.
+ *
+ * TWO SHAPES, IN ORDER
+ *     1  `name({...})`  — preferred: no instruction needed, and it streams
+ *     2  `{"tool":"name","arguments":{…}}` — kept because models emit it unprompted, and because a fallback
+ *        costs nothing when the primary misses
+ *
+ * Fenced blocks are searched last-first because a model that explains itself tends to put the final answer at
+ * the end. A reply that merely CONTAINS the word tool but no valid object is treated as prose, because
+ * treating it as a malformed call would throw away a perfectly good answer.
+ */
+export function parseToolCall(reply, names) {
   const text = String(reply ?? '').trim();
   if (!text) return null;
 
+  // Shape 1: name({...}).
+  const direct = findCallForm(text, names);
+  if (direct) return { name: direct.name, arguments: direct.arguments };
+
+  /*
+   * Shape 2: the tags a model reaches for when it invents its own protocol.
+   *
+   * MEASURED, live: asked to run a glob, the web model answered
+   * `<tool name="glob" string="true">{"pattern":"…"}</tool>` — a shape nothing here had ever taught it, and
+   * one the parser did not accept. The call never ran, nothing said so, and the model repeated the block
+   * until the turn was full of copies. Accepting the shape ends the loop at its cause instead of only
+   * masking the symptom.
+   */
+  const xmlTag = /<tool\s+name\s*=\s*"([^"]+)"[^>]*>([\s\S]*?)<\/tool>/i.exec(text);
+  if (xmlTag) {
+    const name = xmlTag[1].trim();
+    if (!names?.length || names.includes(name)) {
+      let args = {};
+      const body = xmlTag[2].trim();
+      if (body) {
+        try {
+          args = JSON.parse(body);
+        } catch {
+          args = {};
+        }
+      }
+      return { name, arguments: JSON.stringify(args) };
+    }
+  }
+
+  const xmlBlock = /<tool_call>\s*([\s\S]*?)\s*<\/tool_call>/i.exec(text);
+  if (xmlBlock) {
+    try {
+      const parsed = JSON.parse(xmlBlock[1]);
+      const name = parsed?.name ?? parsed?.tool;
+      if (typeof name === 'string' && name && (!names?.length || names.includes(name))) {
+        const raw = parsed.arguments ?? {};
+        return { name, arguments: typeof raw === 'string' ? raw : JSON.stringify(raw) };
+      }
+    } catch {
+      /* fall through to the JSON scan below */
+    }
+  }
+
   const candidates = [];
   // fenced blocks first
   const fence = /```(?:json)?\s*([\s\S]*?)```/gi;
@@ -464,9 +668,74 @@ export function parseToolCall(reply) {
  *     It does not decide whether a call exists - `parseToolCall` does that at the end. It only answers
  *     "how far can I safely show right now", which is the question a live stream needs.
  */
-export function streamSafeCut(text) {
+export function streamSafeCut(text, names) {
   const s = String(text ?? '');
 
+  /**
+   * Hold from a known tool name that has opened, or is about to open, a parenthesis.
+   *
+   * This is the call-syntax half of the same question. `read(` is a call; `read` alone might be the first
+   * letters of `readable`, so it is not held - but a trailing fragment that could still become a known name
+   * (`repl` at the very end of the text) IS held, because the next characters may complete it.
+   */
+  const wanted = Array.isArray(names) && names.length ? names : null;
+  if (wanted) {
+    for (let i = 0; i < s.length; i += 1) {
+      if (!/[A-Za-z_]/.test(s[i])) continue;
+      let j = i;
+      let word = '';
+      while (j < s.length && /[A-Za-z0-9_.-]/.test(s[j])) {
+        word += s[j];
+        j += 1;
+      }
+      if (wanted.includes(word)) {
+        let k = j;
+        while (k < s.length && /\s/.test(s[k])) k += 1;
+        // A complete `name (` is a call being written; nothing after it may stream.
+        if (k >= s.length || s[k] === '(') return i;
+      }
+      i = j - 1;
+    }
+
+    /**
+     * A name that is still arriving.
+     *
+     * The reply may end mid-identifier — `… now call replace_not` — and one more character would make it a
+     * call. Holding the fragment costs a few visible characters and stops a call's opening words from
+     * appearing in the transcript before the call does.
+     *
+     * THREE CHARACTERS MINIMUM, measured. The first version held any trailing fragment that prefixed a known
+     * name, so an ordinary sentence ending in `r` stalled one character back - `r` prefixes `read` and
+     * `replace_note`. On screen that is a reply that appears to stop mid-word and then finishes a keystroke
+     * later. A three-letter fragment is worth holding; one letter is not.
+     */
+    const tailStart = Math.max(0, s.length - 40);
+    for (let i = tailStart; i < s.length; i += 1) {
+      const fragment = s.slice(i);
+      if (fragment.length < 3) break;
+      if (!/^[A-Za-z_][A-Za-z0-9_.-]*$/.test(fragment)) continue;
+      if (wanted.some((n) => n.startsWith(fragment))) return i;
+    }
+  }
+
+  /**
+   * Hold at a tag that may be turning into `<tool …>` or `<tool_call>`.
+   *
+   * The same reasoning as the name fragment: a reply that is writing one of these must not show its opening
+   * characters first, or the transcript gains a partial tag that no parser will ever match.
+   */
+  for (let i = s.indexOf('<'); i !== -1; i = s.indexOf('<', i + 1)) {
+    const frag = s.slice(i + 1);
+    if (frag.length === 0) return i;
+    const letters = /^[A-Za-z_]*/.exec(frag)[0];
+    if (letters.length < frag.length) {
+      // The tag name is complete; only an exact match to one we hold is interesting.
+      if (letters === 'tool' || letters === 'tool_call') return i;
+      continue;
+    }
+    if ('tool'.startsWith(letters) || 'tool_call'.startsWith(letters)) return i;
+  }
+
   /**
    * Could the brace at `i` still turn out to be the start of a tool object?
    *
@@ -497,9 +766,25 @@ export function streamSafeCut(text) {
   return s.length;
 }
 
-export function stripToolCall(reply) {
+export function stripToolCall(reply, names) {
   let text = String(reply ?? '');
 
+  /**
+   * Shape 1: `name({...})`, wherever it appears, prose either side.
+   *
+   * Removed by the same character walk that found it, so a call whose arguments contain a parenthesis or a
+   * brace inside a string is removed whole rather than up to the first `)`.
+   */
+  for (let guard = 0; guard < 20; guard += 1) {
+    const found = findCallForm(text, names);
+    if (!found) break;
+    text = text.slice(0, found.start) + ' ' + text.slice(found.end);
+  }
+
+  // The tagged shapes, before anything else, so their inner JSON is never treated as prose.
+  text = text.replace(/<tool\s+name\s*=\s*"[^"]+"[^>]*>[\s\S]*?<\/tool>/gi, ' ');
+  text = text.replace(/<tool_call>[\s\S]*?<\/tool_call>/gi, ' ');
+
   // Fenced calls first: the fence marks the whole block, so no brace counting is needed.
   text = text.replace(/```(?:json)?\s*\{\s*"tool"[\s\S]*?\}\s*```/gi, '');
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@operatingtag/dsh-unclesam",
-  "version": "1.3.3",
+  "version": "1.3.5",
   "private": false,
   "type": "module",
   "description": "Uncle Sam — answers through chat.deepseek.com in a real browser tab instead of the metered API. Switch between the API and the web account from the composer; web replies are signed so you always know which route answered.",