crewly 1.20.34 → 1.20.40

package/packages/crewly-agent/src/runtime/text-tool-calls.test.ts

@@ -0,0 +1,144 @@
+/**
+ * Tests for recovering tool calls a model wrote as text.
+ *
+ * The bug these lock down: deepseek-chat writes its call envelope into the
+ * text channel with its own separators (`<｜｜DSML｜｜ invoke name="Bash">`),
+ * so no tool ever ran and the user was shown the markup instead of an answer
+ * (2026-09-19). Matching is by shape — a new prefix must not defeat it.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { parseTextToolCalls, hasTextToolCalls, coerceArgs, resolveToolName, type SchemaLike } from './text-tool-calls.js';
+
+/** The exact bytes deepseek-chat emitted, taken from ~/.crewly/chat.db. */
+const DSML = [
+  'Let me check the repo.',
+  '<｜｜DSML｜｜ calls>',
+  '<｜｜DSML｜｜ invoke name="bash_exec">',
+  '<｜｜DSML｜｜ parameter name="command" string="true">git status --short</｜｜DSML｜｜ parameter>',
+  '<｜｜DSML｜｜ parameter name="timeout" string="true">5000</｜｜DSML｜｜ parameter>',
+  '</｜｜DSML｜｜ invoke>',
+  '</｜｜DSML｜｜ calls>',
+].join('\n');
+
+/** A minimal Zod-style schema. */
+function schema(check: (v: Record<string, unknown>) => boolean): SchemaLike {
+  return { safeParse: (v: unknown) => (check(v as Record<string, unknown>) ? { success: true, data: v } : { success: false, error: { message: 'bad args' } }) };
+}
+
+describe('parseTextToolCalls', () => {
+  it('recovers the deepseek envelope, prefix and all, and leaves the prose', () => {
+    const { calls, text } = parseTextToolCalls(DSML);
+    expect(calls).toEqual([
+      { toolName: 'bash_exec', args: { command: 'git status --short', timeout: '5000' } },
+    ]);
+    expect(text).toBe('Let me check the repo.');
+  });
+
+  it('recovers the plain Claude-style envelope too', () => {
+    const { calls } = parseTextToolCalls('<function_calls><invoke name="read_file"><parameter name="path">a.ts</parameter></invoke></function_calls>');
+    expect(calls).toEqual([{ toolName: 'read_file', args: { path: 'a.ts' } }]);
+  });
+
+  it('recovers every call in a batch, in order', () => {
+    const { calls } = parseTextToolCalls(
+      '<invoke name="a"><parameter name="x">1</parameter></invoke><invoke name="b"><parameter name="y">2</parameter></invoke>',
+    );
+    expect(calls.map((c) => c.toolName)).toEqual(['a', 'b']);
+    expect(calls[1].args).toEqual({ y: '2' });
+  });
+
+  it('keeps a multi-line value intact, including its own angle brackets', () => {
+    const { calls } = parseTextToolCalls(
+      '<invoke name="write_file"><parameter name="content">line 1\nif (a < b) { go(); }\nline 3</parameter></invoke>',
+    );
+    expect(calls[0].args.content).toBe('line 1\nif (a < b) { go(); }\nline 3');
+  });
+
+  it('salvages a call the model never closed', () => {
+    const { calls, text } = parseTextToolCalls('Working.\n<invoke name="bash_exec"><parameter name="command">npm test');
+    expect(calls).toEqual([{ toolName: 'bash_exec', args: { command: 'npm test' } }]);
+    expect(text).toBe('Working.');
+  });
+
+  it('leaves a fenced example alone — it is documentation, not a call', () => {
+    const raw = 'Here is the syntax:\n\n```\n<invoke name="bash_exec"><parameter name="command">ls</parameter></invoke>\n```';
+    const { calls, text } = parseTextToolCalls(raw);
+    expect(calls).toEqual([]);
+    expect(text).toBe(raw);
+  });
+
+  it('finds nothing in ordinary prose, and does not touch it', () => {
+    for (const prose of ['', 'The build recalls the cached layer.', 'Use <Parameter> in the docs? no.']) {
+      expect(parseTextToolCalls(prose).calls).toEqual([]);
+    }
+    expect(parseTextToolCalls('The build recalls the cached layer.').text).toBe('The build recalls the cached layer.');
+  });
+
+  it('ignores an invoke tag with no name rather than inventing one', () => {
+    expect(parseTextToolCalls('<invoke><parameter name="x">1</parameter></invoke>').calls).toEqual([]);
+  });
+});
+
+describe('hasTextToolCalls', () => {
+  it('is true for any prefix and false for prose', () => {
+    expect(hasTextToolCalls(DSML)).toBe(true);
+    expect(hasTextToolCalls('<invoke name="x">')).toBe(true);
+    expect(hasTextToolCalls('nothing to see')).toBe(false);
+  });
+});
+
+describe('coerceArgs', () => {
+  it('passes strings through when the schema accepts them', () => {
+    const out = coerceArgs({ command: '5' }, schema((v) => typeof v.command === 'string'));
+    expect(out).toEqual({ args: { command: '5' } });
+  });
+
+  it('parses JSON-looking values only when the schema refuses the strings', () => {
+    const out = coerceArgs({ timeout: '5000', on: 'true', tags: '["a"]' }, schema((v) => typeof v.timeout === 'number'));
+    expect(out.args).toEqual({ timeout: 5000, on: true, tags: ['a'] });
+    expect(out.error).toBeUndefined();
+  });
+
+  it('coerces with no schema to give the tool its best shot', () => {
+    expect(coerceArgs({ n: '3', s: 'hello' }).args).toEqual({ n: 3, s: 'hello' });
+  });
+
+  it('reports the schema complaint instead of calling a tool with bad arguments', () => {
+    const out = coerceArgs({ command: 'ls' }, schema((v) => typeof v.path === 'string'));
+    expect(out.error).toBe('bad args');
+  });
+
+  it('keeps a value that only looks like JSON', () => {
+    expect(coerceArgs({ command: '{ not json' }).args).toEqual({ command: '{ not json' });
+  });
+});
+
+describe('resolveToolName', () => {
+  const available = ['bash_exec', 'read_file', 'write_file', 'edit_file', 'glob', 'grep', 'delegate_task', 'git_status'];
+
+  it('takes an exact name unchanged', () => {
+    expect(resolveToolName('bash_exec', available)).toBe('bash_exec');
+  });
+
+  it('matches across casing and separators, so GitStatus finds git_status', () => {
+    for (const written of ['GitStatus', 'git-status', 'GIT_STATUS', 'gitStatus']) {
+      expect(resolveToolName(written, available)).toBe('git_status');
+    }
+  });
+
+  it("resolves the names another harness uses — the live failure was 'Bash'", () => {
+    expect(resolveToolName('Bash', available)).toBe('bash_exec');
+    expect(resolveToolName('Read', available)).toBe('read_file');
+    expect(resolveToolName('Write', available)).toBe('write_file');
+    expect(resolveToolName('Edit', available)).toBe('edit_file');
+    expect(resolveToolName('Task', available)).toBe('delegate_task');
+    expect(resolveToolName('Search', available)).toBe('grep');
+  });
+
+  it('does not invent a tool the run does not have', () => {
+    expect(resolveToolName('Bash', ['read_file'])).toBeUndefined();
+    expect(resolveToolName('deploy_to_prod', available)).toBeUndefined();
+    expect(resolveToolName('', available)).toBeUndefined();
+  });
+});

package/packages/crewly-agent/src/runtime/text-tool-calls.ts

@@ -0,0 +1,316 @@
+/**
+ * Recover tool calls a model wrote as text.
+ *
+ * A weak model sometimes *writes* its function-call envelope into the text
+ * channel instead of emitting a real tool call. The provider sees ordinary
+ * prose, the AI SDK sees no tool call, the step ends — so nothing runs, and
+ * the user is shown a wall of markup where an answer should be. deepseek-chat
+ * does this with its own separators:
+ *
+ *   `<｜｜DSML｜｜ invoke name="Bash">` … `<｜｜DSML｜｜ parameter name="command" …>`
+ *
+ * which is Claude's `invoke`/`parameter` grammar with `｜｜DSML｜｜ ` (U+FF5C
+ * pipes) where the namespace prefix goes. Nothing in Crewly teaches that
+ * format — the model emits it on its own (2026-09-19, #crewly-support).
+ *
+ * Stripping the markup hides the symptom and still loses the work. This
+ * module instead *parses* the envelope so the runtime can execute what the
+ * model meant to call and hand the results back, turning a dead turn into a
+ * working one. Matching is by **shape**, never by a list of known names: the
+ * prefix is whatever the model felt like emitting.
+ *
+ * @module runtime/text-tool-calls
+ */
+
+/** One tool call recovered from text. Values are raw, as written. */
+export interface TextToolCall {
+  /** Tool name from the `name="…"` attribute. */
+  toolName: string;
+  /** Parameter name → raw text value. */
+  args: Record<string, string>;
+}
+
+/** Result of {@link parseTextToolCalls}. */
+export interface ParsedTextToolCalls {
+  /** The calls found, in the order they were written. */
+  calls: TextToolCall[];
+  /** The same text with every envelope removed and whitespace tidied. */
+  text: string;
+}
+
+/** Anything with a Zod-style `safeParse` — kept duck-typed so this module stays dependency-free. */
+export interface SchemaLike {
+  safeParse(value: unknown): { success: boolean; data?: unknown; error?: { message?: string } };
+}
+
+/** Result of {@link coerceArgs}. */
+export interface CoercedArgs {
+  /** Arguments to pass to the tool. */
+  args: Record<string, unknown>;
+  /** Why the schema rejected them, when it did. */
+  error?: string;
+}
+
+/**
+ * A tag like `<invoke …>`, `</invoke>`, `<｜｜DSML｜｜ parameter …>` — any
+ * junk or namespace before the name, anything but `<`/`>` after it.
+ *
+ * @param name - Tag-name pattern
+ * @param closing - Match the closing form
+ * @returns The pattern source
+ */
+function tagSource(name: string, closing: boolean): string {
+  return `<${closing ? '\\s*/' : ''}[^<>]{0,40}?${name}\\b[^<>]*>`;
+}
+
+/** Wrapper the model puts around a batch of calls: `function_calls`, `tool_calls`, or a bare `calls`. */
+const WRAPPER_NAME = '(?:function_calls|tool_calls|(?<![A-Za-z_])calls)';
+
+const INVOKE_OPEN = new RegExp(tagSource('invoke', false), 'gi');
+const INVOKE_CLOSE = new RegExp(tagSource('invoke', true), 'i');
+const PARAM_OPEN = new RegExp(tagSource('parameter', false), 'gi');
+const PARAM_CLOSE = new RegExp(tagSource('parameter', true), 'i');
+
+/** `name="x"` / `name='x'` / `name=x` inside a tag. */
+const NAME_ATTR = /\bname\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'<>]+))/i;
+
+/** Well-formed `<x>…</x>` blocks, for removal. */
+const BLOCK_PATTERNS = [WRAPPER_NAME, 'invoke'].map(
+  (name) => new RegExp(`${tagSource(name, false)}[\\s\\S]*?${tagSource(name, true)}`, 'gi'),
+);
+
+/** An opening tag with no close — the output was cut off mid-call. */
+const UNCLOSED_PATTERN = new RegExp(`(?:${tagSource(WRAPPER_NAME, false)}|${tagSource('invoke', false)})[\\s\\S]*$`, 'i');
+
+/** Any leftover lone tag. */
+const LONE_TAG_PATTERN = new RegExp(
+  [WRAPPER_NAME, 'invoke', 'parameter'].map((name) => `${tagSource(name, false)}|${tagSource(name, true)}`).join('|'),
+  'gi',
+);
+
+/** A value that is plainly JSON rather than prose. */
+const JSONISH = /^(?:true|false|null|-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?|\{[\s\S]*\}|\[[\s\S]*\])$/;
+
+/**
+ * Read the `name="…"` attribute out of an opening tag.
+ *
+ * @param tag - The whole tag, angle brackets included
+ * @returns The name, or '' when the tag has none
+ */
+function nameOf(tag: string): string {
+  const m = NAME_ATTR.exec(tag);
+  return (m?.[1] ?? m?.[2] ?? m?.[3] ?? '').trim();
+}
+
+/**
+ * Split text into segments, marking the fenced ones.
+ *
+ * Markup inside a ``` fence is an example the agent meant to show — it is
+ * neither executed nor stripped.
+ *
+ * @param input - Raw text
+ * @returns Segments; odd indexes are fenced code
+ */
+function splitOnFences(input: string): string[] {
+  return input.split(/(```[\s\S]*?```)/g);
+}
+
+/**
+ * Parse the `parameter` blocks inside one `invoke` body.
+ *
+ * A block runs to its closing tag, or — when the model never wrote one — to
+ * the next parameter or the end of the body, so a truncated call still yields
+ * the arguments it managed to write.
+ *
+ * @param body - Text between the invoke tags
+ * @returns Parameter name → raw value
+ */
+function parseParams(body: string): Record<string, string> {
+  const args: Record<string, string> = {};
+  PARAM_OPEN.lastIndex = 0;
+  const opens: Array<{ name: string; from: number }> = [];
+  for (let m = PARAM_OPEN.exec(body); m; m = PARAM_OPEN.exec(body)) {
+    opens.push({ name: nameOf(m[0]), from: m.index + m[0].length });
+  }
+  opens.forEach((open, i) => {
+    const until = i + 1 < opens.length ? body.lastIndexOf('<', opens[i + 1].from) : body.length;
+    const slice = body.slice(open.from, Math.max(until, open.from));
+    const close = PARAM_CLOSE.exec(slice);
+    const value = close ? slice.slice(0, close.index) : slice;
+    if (open.name) args[open.name] = value.replace(/^\r?\n/, '').replace(/\s+$/, '');
+  });
+  return args;
+}
+
+/**
+ * Find every tool call written as text, and return the text without them.
+ *
+ * @param raw - The model's text output
+ * @returns The recovered calls and the cleaned text
+ *
+ * @example
+ * parseTextToolCalls('<invoke name="bash_exec"><parameter name="command">ls</parameter></invoke>')
+ * // → { calls: [{ toolName: 'bash_exec', args: { command: 'ls' } }], text: '' }
+ */
+export function parseTextToolCalls(raw: string): ParsedTextToolCalls {
+  const input = raw ?? '';
+  if (!input) return { calls: [], text: '' };
+
+  const calls: TextToolCall[] = [];
+  const cleaned = splitOnFences(input)
+    .map((segment, i) => {
+      if (i % 2 === 1) return segment; // fenced code — an example, not a call
+
+      INVOKE_OPEN.lastIndex = 0;
+      const opens: Array<{ name: string; from: number }> = [];
+      for (let m = INVOKE_OPEN.exec(segment); m; m = INVOKE_OPEN.exec(segment)) {
+        opens.push({ name: nameOf(m[0]), from: m.index + m[0].length });
+      }
+      opens.forEach((open, idx) => {
+        // An unclosed invoke runs to the next one, or to the end of the text.
+        const until = idx + 1 < opens.length ? segment.lastIndexOf('<', opens[idx + 1].from) : segment.length;
+        const slice = segment.slice(open.from, Math.max(until, open.from));
+        const close = INVOKE_CLOSE.exec(slice);
+        const body = close ? slice.slice(0, close.index) : slice;
+        if (open.name) calls.push({ toolName: open.name, args: parseParams(body) });
+      });
+
+      let out = segment;
+      for (const pattern of BLOCK_PATTERNS) out = out.replace(pattern, '');
+      out = out.replace(UNCLOSED_PATTERN, '');
+      return out.replace(LONE_TAG_PATTERN, '');
+    })
+    .join('');
+
+  const text = cleaned
+    .split('\n')
+    .map((line) => line.replace(/[ \t]+$/, ''))
+    .join('\n')
+    .replace(/\n{3,}/g, '\n\n')
+    .trim();
+
+  return { calls, text };
+}
+
+/**
+ * Whether text contains something that looks like a tool-call envelope.
+ *
+ * @param raw - Candidate text
+ * @returns True when an `invoke` or wrapper tag is present
+ */
+export function hasTextToolCalls(raw: string): boolean {
+  return new RegExp(`${tagSource(WRAPPER_NAME, false)}|${tagSource('invoke', false)}`, 'i').test(raw ?? '');
+}
+
+/**
+ * Names other harnesses use for tools Crewly spells differently.
+ *
+ * A model that has seen Claude Code reaches for `Bash` and `Read`; ours are
+ * `bash_exec` and `read_file`. Observed live on the first turn after the
+ * salvage shipped: deepseek-chat wrote `Bash` twice, was told the name did
+ * not exist, and only then used real names (2026-09-19). Resolving the alias
+ * turns that wasted round into a working one. This maps onto tools the agent
+ * already has — it never grants one it does not.
+ */
+const TOOL_ALIASES: Record<string, string> = {
+  bash: 'bash_exec',
+  shell: 'bash_exec',
+  runcommand: 'bash_exec',
+  terminal: 'bash_exec',
+  read: 'read_file',
+  view: 'read_file',
+  cat: 'read_file',
+  write: 'write_file',
+  create: 'write_file',
+  edit: 'edit_file',
+  strreplace: 'edit_file',
+  multiedit: 'edit_file',
+  str_replace_editor: 'edit_file',
+  search: 'grep',
+  ripgrep: 'grep',
+  findfiles: 'glob',
+  find: 'glob',
+  task: 'delegate_task',
+  agent: 'delegate_task',
+  delegate: 'delegate_task',
+  websearch: 'web_search',
+  memory: 'recall_memory',
+};
+
+/**
+ * Reduce a tool name to a comparable form: letters and digits, lower case.
+ *
+ * @param name - A tool name in any casing or separator style
+ * @returns The normalized form, so `GitStatus`, `git_status` and `git-status` all match
+ */
+function normalizeName(name: string): string {
+  return name.toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+
+/**
+ * Match a tool name the model wrote against the tools it actually has.
+ *
+ * Tried in order: the exact name, the same name in any casing or separator
+ * style, then a small table of names other harnesses use. Anything else is
+ * unresolved — the caller reports that back rather than guessing, since
+ * running the wrong tool is worse than saying the name was wrong.
+ *
+ * @param written - The name as the model wrote it
+ * @param available - The tool names in this run's registry
+ * @returns The registry name to call, or undefined when nothing matches
+ *
+ * @example
+ * resolveToolName('Bash', ['bash_exec', 'read_file'])  // → 'bash_exec'
+ */
+export function resolveToolName(written: string, available: string[]): string | undefined {
+  if (available.includes(written)) return written;
+
+  const target = normalizeName(written);
+  if (!target) return undefined;
+
+  const byShape = available.find((name) => normalizeName(name) === target);
+  if (byShape) return byShape;
+
+  const aliased = TOOL_ALIASES[target];
+  return aliased && available.includes(aliased) ? aliased : undefined;
+}
+
+/**
+ * Turn the raw string values of a recovered call into arguments the tool accepts.
+ *
+ * Everything written in text arrives as a string, but a schema may want a
+ * number, a boolean or an object. Strings are tried first, so a tool that
+ * genuinely wants the string `"42"` still gets it; only if the schema refuses
+ * are JSON-looking values parsed.
+ *
+ * @param raw - Parameter name → raw text value
+ * @param schema - The tool's input schema, when it has one
+ * @returns The arguments, and the schema's complaint if it still refuses them
+ *
+ * @example
+ * coerceArgs({ timeout: '5000' }, z.object({ timeout: z.number() }))
+ * // → { args: { timeout: 5000 } }
+ */
+export function coerceArgs(raw: Record<string, string>, schema?: SchemaLike): CoercedArgs {
+  const coerced: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(raw)) {
+    const trimmed = value.trim();
+    if (JSONISH.test(trimmed)) {
+      try {
+        coerced[key] = JSON.parse(trimmed);
+        continue;
+      } catch {
+        // Not valid JSON after all — keep the text.
+      }
+    }
+    coerced[key] = value;
+  }
+
+  if (!schema || typeof schema.safeParse !== 'function') return { args: coerced };
+  if (schema.safeParse(raw).success) return { args: raw };
+
+  const second = schema.safeParse(coerced);
+  if (second.success) return { args: coerced };
+
+  return { args: coerced, error: second.error?.message ?? 'arguments did not match the tool schema' };
+}

package/packages/crewly-agent/src/runtime/text-tool-salvage.test.ts

@@ -0,0 +1,190 @@
+/**
+ * Tests for the runtime half of text-emitted tool-call recovery: executing
+ * what the model wrote as prose and feeding the results back into the turn.
+ *
+ * The bug these lock down: deepseek-chat wrote `<｜｜DSML｜｜ invoke …>` into
+ * its reply, the SDK saw no tool call, and the step ended having done
+ * nothing — the agent said it would create a team and created nothing
+ * (2026-09-19).
+ */
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { AgentRunnerService } from './agent-runner.service.js';
+import { CREWLY_AGENT_DEFAULTS, type AgentRunResult, type CrewlyAgentConfig } from './types.js';
+
+const MAX_STEPS = 50;
+
+/** A run result with sensible defaults. */
+function runResult(over: Partial<AgentRunResult> = {}): AgentRunResult {
+  return { text: 'text', steps: 1, usage: { input: 10, output: 5 }, toolCalls: [], finishReason: 'stop', ...over };
+}
+
+/** The envelope deepseek-chat actually emits, around one call. */
+function dsml(tool: string, param: string, value: string): string {
+  return [
+    '<｜｜DSML｜｜ calls>',
+    `<｜｜DSML｜｜ invoke name="${tool}">`,
+    `<｜｜DSML｜｜ parameter name="${param}" string="true">${value}</｜｜DSML｜｜ parameter>`,
+    '</｜｜DSML｜｜ invoke>',
+    '</｜｜DSML｜｜ calls>',
+  ].join('\n');
+}
+
+describe('salvaging tool calls the model wrote as text', () => {
+  let runner: AgentRunnerService;
+  let attempts: AgentRunResult[];
+  let attemptSpy: ReturnType<typeof vi.fn>;
+  let bashExec: ReturnType<typeof vi.fn>;
+  let tools: Record<string, unknown>;
+
+  const config = {
+    sessionName: 'test-agent',
+    role: 'developer',
+    projectPath: '/tmp',
+    maxSteps: MAX_STEPS,
+    model: { provider: 'deepseek', modelId: 'deepseek-chat' },
+  } as unknown as CrewlyAgentConfig;
+
+  /** Drive the private loop with a scripted sequence of attempts. */
+  async function runLoop(): Promise<AgentRunResult> {
+    return await (runner as unknown as {
+      executeRunWithStreamText(tools: Record<string, unknown>, signal: AbortSignal): Promise<AgentRunResult>;
+    }).executeRunWithStreamText(tools, new AbortController().signal);
+  }
+
+  /** The messages the runner has accumulated for the turn. */
+  function messages(): Array<{ role: string; content: string }> {
+    return (runner as unknown as { state: { messages: Array<{ role: string; content: string }> } }).state.messages;
+  }
+
+  beforeEach(() => {
+    runner = new AgentRunnerService(config);
+    attempts = [];
+    attemptSpy = vi.fn(async () => {
+      const next = attempts.shift() ?? runResult();
+      // Mirror what a real attempt does: its text lands in the transcript.
+      if (next.text) messages().push({ role: 'assistant', content: next.text });
+      return next;
+    });
+    (runner as unknown as Record<string, unknown>).attemptWithErrorRetries = attemptSpy;
+    bashExec = vi.fn(async () => ({ success: true, stdout: 'M src/index.ts', exitCode: 0 }));
+    tools = { bash_exec: { description: 'run a command', inputSchema: undefined, execute: bashExec } };
+    vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+  });
+
+  it('executes the call, hides the markup, and lets the turn finish', async () => {
+    attempts = [
+      runResult({ text: `Checking the repo.\n${dsml('bash_exec', 'command', 'git status --short')}` }),
+      runResult({ text: 'One file is modified.' }),
+    ];
+    const out = await runLoop();
+
+    expect(bashExec).toHaveBeenCalledWith({ command: 'git status --short' });
+    expect(out.text).toBe('Checking the repo.\n\nOne file is modified.');
+    expect(out.text).not.toContain('DSML');
+    expect(out.incomplete).toBeUndefined();
+  });
+
+  it('records the salvaged call in the run ledger, so it is not invisible work', async () => {
+    attempts = [runResult({ text: dsml('bash_exec', 'command', 'ls') }), runResult({ text: 'done' })];
+    const out = await runLoop();
+    expect(out.toolCalls).toEqual([
+      { toolName: 'bash_exec', args: { command: 'ls' }, result: { success: true, stdout: 'M src/index.ts', exitCode: 0 } },
+    ]);
+  });
+
+  it('feeds the result back and tells the model to use real tool calls', async () => {
+    attempts = [runResult({ text: dsml('bash_exec', 'command', 'ls') }), runResult({ text: 'done' })];
+    await runLoop();
+    const fedBack = messages().filter((m) => m.role === 'user').pop();
+    expect(fedBack?.content).toContain('M src/index.ts');
+    expect(fedBack?.content).toMatch(/executes nothing/i);
+  });
+
+  it('rewrites the transcript so the markup is not modelled as the way to call a tool', async () => {
+    attempts = [runResult({ text: `Checking.\n${dsml('bash_exec', 'command', 'ls')}` }), runResult({ text: 'done' })];
+    await runLoop();
+    expect(messages().some((m) => m.content.includes('DSML'))).toBe(false);
+    expect(messages().some((m) => m.role === 'assistant' && m.content === 'Checking.')).toBe(true);
+  });
+
+  it("runs the tool under the name another harness uses — the live failure was 'Bash'", async () => {
+    attempts = [runResult({ text: dsml('Bash', 'command', 'ls') }), runResult({ text: 'ok' })];
+    await runLoop();
+    expect(bashExec).toHaveBeenCalledWith({ command: 'ls' });
+    const fedBack = messages().filter((m) => m.role === 'user').pop();
+    expect(fedBack?.content).toContain('bash_exec (you wrote "Bash")');
+  });
+
+  it('reports a name it cannot resolve instead of guessing at a tool', async () => {
+    attempts = [runResult({ text: dsml('deploy_to_prod', 'target', 'live') }), runResult({ text: 'ok' })];
+    await runLoop();
+    expect(bashExec).not.toHaveBeenCalled();
+    const fedBack = messages().filter((m) => m.role === 'user').pop();
+    expect(fedBack?.content).toMatch(/no tool with that name/i);
+    expect(fedBack?.content).toContain('bash_exec');
+  });
+
+  it('reports a schema complaint rather than calling the tool with bad arguments', async () => {
+    tools = {
+      bash_exec: {
+        execute: bashExec,
+        inputSchema: { safeParse: () => ({ success: false, error: { message: 'command is required' } }) },
+      },
+    };
+    attempts = [runResult({ text: dsml('bash_exec', 'cmd', 'ls') }), runResult({ text: 'ok' })];
+    await runLoop();
+    expect(bashExec).not.toHaveBeenCalled();
+    expect(messages().filter((m) => m.role === 'user').pop()?.content).toContain('command is required');
+  });
+
+  it('hands a thrown tool error back as a result instead of losing the turn', async () => {
+    bashExec.mockRejectedValueOnce(new Error('spawn ENOENT'));
+    attempts = [runResult({ text: dsml('bash_exec', 'command', 'nope') }), runResult({ text: 'ok' })];
+    const out = await runLoop();
+    expect(out.toolCalls[0].result).toEqual({ error: 'spawn ENOENT' });
+    expect(messages().filter((m) => m.role === 'user').pop()?.content).toContain('spawn ENOENT');
+  });
+
+  it('gives up after the salvage budget rather than looping on a model that will not learn', async () => {
+    attempts = Array.from({ length: 12 }, () => runResult({ text: dsml('bash_exec', 'command', 'ls') }));
+    await runLoop();
+    expect(bashExec).toHaveBeenCalledTimes(CREWLY_AGENT_DEFAULTS.MAX_TEXT_TOOL_SALVAGES);
+  });
+
+  it('caps how many calls one confused turn can fan out to', async () => {
+    const many = Array.from({ length: 9 }, (_, i) => `<invoke name="bash_exec"><parameter name="command">echo ${i}</parameter></invoke>`).join('\n');
+    attempts = [runResult({ text: many }), runResult({ text: 'ok' })];
+    await runLoop();
+    expect(bashExec).toHaveBeenCalledTimes(CREWLY_AGENT_DEFAULTS.MAX_SALVAGED_CALLS_PER_ROUND);
+    expect(messages().filter((m) => m.role === 'user').pop()?.content).toMatch(/4 further call\(s\) were not run/);
+  });
+
+  it('truncates a huge result so one salvaged command cannot blow the context', async () => {
+    bashExec.mockResolvedValueOnce('x'.repeat(CREWLY_AGENT_DEFAULTS.SALVAGED_RESULT_MAX_CHARS + 500));
+    attempts = [runResult({ text: dsml('bash_exec', 'command', 'cat big') }), runResult({ text: 'ok' })];
+    await runLoop();
+    const fedBack = messages().filter((m) => m.role === 'user').pop()?.content ?? '';
+    expect(fedBack).toMatch(/truncated, 500 more characters/);
+    expect(fedBack.length).toBeLessThan(CREWLY_AGENT_DEFAULTS.SALVAGED_RESULT_MAX_CHARS + 1500);
+  });
+
+  it('leaves a healthy turn completely alone', async () => {
+    attempts = [runResult({ text: 'All done, nothing to salvage.' })];
+    const out = await runLoop();
+    expect(attemptSpy).toHaveBeenCalledTimes(1);
+    expect(bashExec).not.toHaveBeenCalled();
+    expect(out.text).toBe('All done, nothing to salvage.');
+  });
+
+  it('still reports the turn incomplete when the retried attempt bails', async () => {
+    attempts = [
+      runResult({ text: dsml('bash_exec', 'command', 'ls') }),
+      runResult({ text: '', finishReason: 'other' }),
+      runResult({ text: '', finishReason: 'other' }),
+    ];
+    const out = await runLoop();
+    expect(bashExec).toHaveBeenCalledTimes(1);
+    expect(out.incomplete).toMatchObject({ reason: 'abnormal-finish' });
+  });
+});