coderouter-cli 2.7.1__py3-none-any.whl → 2.7.3__py3-none-any.whl

coderouter/config/schemas.py

@@ -718,6 +718,57 @@ class FallbackChain(BaseModel):
         ),
     )
 
+    # --- ⑧ (empty-response): per-request empty-response fallback ------------
+    #
+    # Some local backends (observed: gemma4:26b on ``no_tool_temptation``
+    # prompts) return a 200 with a structurally-valid but *content-empty*
+    # Anthropic response — no tool_use and no non-whitespace text — for a
+    # fraction of requests. The drift guard's ``empty_response_rate`` is a
+    # windowed aggregate (default threshold 0.3, ``min_window_fill`` 6): it
+    # promotes/reloads a backend once the *rate* is bad, but cannot rescue a
+    # single blank turn in-flight. This knob adds a per-request in-flight
+    # fallback that re-dispatches the *same* request to the next provider in
+    # the chain the moment an empty response is detected.
+    #
+    # Design: "empty" is judged on *content*, not usage.output_tokens (which
+    # some backends report unreliably). A response is empty when its content
+    # list is empty, or every block is either a whitespace-only ``text`` block
+    # or a ``thinking`` block — i.e. nothing the client can act on. A single
+    # ``tool_use`` block or one non-whitespace ``text`` block makes it non-empty.
+    #
+    #   * ``off``      — no detection, no fallback, no log. Backward-compatible
+    #                    default (byte-for-byte identical to pre-⑧ behavior).
+    #   * ``warn``     — detect + emit an ``empty-response-detected`` log line
+    #                    only; the empty response is returned unchanged.
+    #   * ``fallback`` — on an empty response, log ``empty-response-detected``
+    #                    and continue to the next provider (the empty response
+    #                    is *not* recorded as an error). If every provider in
+    #                    the chain returns empty, the last empty response is
+    #                    returned as-is (a 200 blank is a legitimate answer)
+    #                    with ``chain_exhausted=True`` on the log line. On the
+    #                    streaming path, ``fallback`` buffers events until real
+    #                    content is observed, so an empty stream can be swapped
+    #                    to the next provider without the client seeing bytes.
+    #
+    # Default ``off`` preserves complete backward compatibility; the original
+    # request object is never mutated, so a later provider always receives the
+    # untouched request.
+    empty_response_action: Literal["off", "warn", "fallback"] = Field(
+        default="off",
+        description=(
+            "⑧ (empty-response): action when a provider returns a 200 with "
+            "empty content (no tool_use and no non-whitespace text; a "
+            "thinking-only response counts as empty). ``off`` (default) does "
+            "nothing. ``warn`` emits an ``empty-response-detected`` log only "
+            "and returns the empty response. ``fallback`` re-dispatches the "
+            "same request to the next provider (empty is not counted as an "
+            "error); if the whole chain returns empty, the last empty response "
+            "is returned unchanged. Streaming buffers events until real "
+            "content appears so empty streams can be swapped provider-side "
+            "without the client seeing any bytes."
+        ),
+    )
+
     # --- S2 (shim): tool_choice capability gate + emulation -----------------
     #
     # Anthropic clients (Claude Code, SDKs) can pin the model to a specific

coderouter/logging.py

@@ -1372,6 +1372,46 @@ def log_partial_stitch_surfaced(
     )
 
 
+# ---------------------------------------------------------------------------
+# ⑧ (empty-response): per-request empty-response fallback log shape
+#
+# Fired when a provider returns a 200 with content-empty output (no
+# tool_use and no non-whitespace text). The single event lane carries the
+# ``action`` (warn|fallback) that triggered it, whether the empty response
+# came from the streaming or non-streaming path, and ``chain_exhausted``
+# — True only when every provider in the chain returned empty and the last
+# empty response is being returned to the client as-is.
+# ---------------------------------------------------------------------------
+
+
+def log_empty_response_detected(
+    logger: logging.Logger,
+    provider: str,
+    *,
+    action: str,
+    stream: bool,
+    chain_exhausted: bool = False,
+) -> None:
+    """Emit an ``empty-response-detected`` warn line.
+
+    Fired when ``empty_response_action`` is ``warn`` or ``fallback`` and a
+    provider returns a structurally-valid but content-empty response. The
+    ``action`` field records which knob value produced the line; ``stream``
+    distinguishes the SSE path from the non-streaming path; ``chain_exhausted``
+    is True only when the whole chain returned empty and the last empty
+    response is being returned unchanged.
+    """
+    logger.warning(
+        "empty-response-detected",
+        extra={
+            "provider": provider,
+            "action": action,
+            "stream": stream,
+            "chain_exhausted": chain_exhausted,
+        },
+    )
+
+
 # ---------------------------------------------------------------------------
 # v2.0-I: Continuous probe log shapes
 #

coderouter/metrics/collector.py

@@ -52,6 +52,7 @@ Event inventory (dispatch table in :meth:`MetricsCollector._dispatch`)
     ``drift-promoted`` (v2.0-G)  → ``drift_promoted_total``
     ``drift-reload-attempted``   → ``drift_reload_total`` / success
     ``partial-stitch-surfaced``  → ``partial_stitch_surfaced_total`` (v2.0-H)
+    ``empty-response-detected``  → ``empty_responses_total`` + per-provider (⑧)
     ``probe-completed`` (v2.0-I) → ``probe_total`` / ``probe_success`` / ``probe_failure``
                                    + per-provider latency gauge
     ``probe-round-completed``    → ``probe_rounds_total`` (v2.0-I)
@@ -109,6 +110,7 @@ _KNOWN_EVENTS: Final[frozenset[str]] = frozenset(
         "drift-promoted",
         "drift-reload-attempted",
         "partial-stitch-surfaced",
+        "empty-response-detected",
         "probe-completed",
         "probe-round-completed",
         "probe-capabilities-drift",
@@ -272,6 +274,13 @@ class MetricsCollector(logging.Handler):
         # client instead of a generic error event.
         self._partial_stitch_surfaced_total: int = 0
 
+        # ⑧ (empty-response): count of per-request empty-response detections
+        # (both ``warn`` and ``fallback`` actions). Aggregate + per-provider
+        # so a dashboard can spot which backend blanks out. Counts every
+        # detection event, including the terminal chain-exhausted one.
+        self._empty_responses_total: int = 0
+        self._empty_responses_by_provider: Counter[str] = Counter()
+
         # v2.0-I: continuous probe counters. Per-provider probe attempts
         # and outcomes, plus a round counter for the dashboard's
         # "probes/min" panel.
@@ -329,6 +338,7 @@ class MetricsCollector(logging.Handler):
             "drift-promoted": self._on_drift_promoted,
             "drift-reload-attempted": self._on_drift_reload_attempted,
             "partial-stitch-surfaced": self._on_partial_stitch_surfaced,
+            "empty-response-detected": self._on_empty_response_detected,
             "probe-completed": self._on_probe_completed,
             "probe-round-completed": self._on_probe_round_completed,
             "probe-capabilities-drift": self._on_probe_capabilities_drift,
@@ -670,6 +680,17 @@ class MetricsCollector(logging.Handler):
         self._partial_stitch_surfaced_total += 1
         self._push_recent("partial-stitch-surfaced", extras, record)
 
+    def _on_empty_response_detected(
+        self, extras: dict[str, Any], record: logging.LogRecord
+    ) -> None:
+        # ⑧ (empty-response): a content-empty 200 was detected under a
+        # ``warn`` / ``fallback`` action.
+        self._empty_responses_total += 1
+        provider = _str(extras.get("provider"))
+        if provider:
+            self._empty_responses_by_provider[provider] += 1
+        self._push_recent("empty-response-detected", extras, record)
+
     def _on_probe_completed(
         self, extras: dict[str, Any], record: logging.LogRecord
     ) -> None:
@@ -888,6 +909,11 @@ class MetricsCollector(logging.Handler):
                     "drift_reload_success_total": self._drift_reload_success_total,
                     # v2.0-H (L6): partial stitch surfaced.
                     "partial_stitch_surfaced_total": self._partial_stitch_surfaced_total,
+                    # ⑧ (empty-response): per-request empty-response fallback.
+                    "empty_responses_total": self._empty_responses_total,
+                    "empty_responses_by_provider": dict(
+                        self._empty_responses_by_provider
+                    ),
                     # v2.0-I: continuous probe counters.
                     "probe_total": dict(self._probe_total),
                     "probe_success": dict(self._probe_success),
@@ -1042,6 +1068,9 @@ class MetricsCollector(logging.Handler):
             self._tokens_saved_by_mechanism.clear()
             # v2.0-H (L6)
             self._partial_stitch_surfaced_total = 0
+            # ⑧ (empty-response)
+            self._empty_responses_total = 0
+            self._empty_responses_by_provider.clear()
             # v2.0-I
             self._probe_total.clear()
             self._probe_success.clear()

coderouter/routing/fallback.py

@@ -76,6 +76,7 @@ from coderouter.logging import (
     log_chain_memory_pressure_blocked,
     log_chain_paid_gate_blocked,
     log_demote_unhealthy_provider,
+    log_empty_response_detected,
     log_memory_pressure_detected,
     log_skip_budget_exceeded,
     log_skip_memory_pressure,
@@ -973,6 +974,82 @@ def _warn_if_uniform_auth_failure(errors: list[AdapterError], *, profile: str) -
     )
 
 
+# ---------------------------------------------------------------------------
+# ⑧ (empty-response): content-based emptiness judgement + stream buffering
+# ---------------------------------------------------------------------------
+
+
+def _block_field(block: Any, key: str) -> Any:
+    """Read ``key`` from a content block whether it is a dict or a model.
+
+    Anthropic content blocks reach the engine as plain dicts (openai_compat
+    translation, most test fakes) or as pydantic-ish objects (native
+    passthrough). This mirrors the accessor pattern already used by the
+    drift fingerprint at the success-path tail.
+    """
+    if isinstance(block, dict):
+        return block.get(key)
+    return getattr(block, key, None)
+
+
+def _anthropic_response_is_empty(resp: AnthropicResponse) -> bool:
+    """Return True when ``resp`` carries no client-actionable content.
+
+    "Empty" is judged on content, never on ``usage.output_tokens`` (some
+    backends report that unreliably). A response is empty when:
+        - its ``content`` list is empty / falsy, or
+        - every block is either a whitespace-only ``text`` block or a
+          ``thinking`` block.
+
+    A single ``tool_use`` block, or one ``text`` block with any
+    non-whitespace character, makes the response non-empty. Unknown block
+    types are treated conservatively as *content* (non-empty) so a novel
+    actionable block is never silently swallowed.
+    """
+    content = getattr(resp, "content", None)
+    if not content:
+        return True
+    for block in content:
+        btype = _block_field(block, "type")
+        if btype == "text":
+            text = _block_field(block, "text") or ""
+            if text.strip():
+                return False
+            # whitespace-only text → keep scanning
+            continue
+        if btype == "thinking":
+            # thinking-only carries nothing the client can act on
+            continue
+        # tool_use or any other (unknown → conservatively non-empty) block
+        return False
+    return True
+
+
+def _stream_event_is_real_content(event: AnthropicStreamEvent) -> bool:
+    """Return True when ``event`` is the first byte of actionable content.
+
+    Real content is either a ``content_block_start`` opening a ``tool_use``
+    block, or a ``content_block_delta`` carrying a non-whitespace text
+    delta. ``message_start`` / ``ping`` / empty-text openers do not count —
+    they are the buffered preamble that an empty stream also emits.
+    """
+    data = getattr(event, "data", None) or {}
+    etype = data.get("type") if isinstance(data, dict) else None
+    if etype == "content_block_start":
+        block = data.get("content_block") or {}
+        return isinstance(block, dict) and block.get("type") == "tool_use"
+    if etype == "content_block_delta":
+        delta = data.get("delta") or {}
+        if isinstance(delta, dict):
+            # text_delta with non-whitespace text is real content;
+            # input_json_delta (tool args) is real content too.
+            if delta.get("type") == "text_delta":
+                return bool((delta.get("text") or "").strip())
+            if delta.get("type") == "input_json_delta":
+                return True
+    return False
+
+
 class FallbackEngine:
     """Sequential fallback router — the core of CodeRouter.
 
@@ -1717,6 +1794,20 @@ class FallbackEngine:
             getattr(profile, "cache_control_action", "off"),
         )
 
+    def _resolve_empty_response_action(self, profile_name: str | None) -> str:
+        """⑧ (empty-response): resolve ``empty_response_action`` for a profile.
+
+        Defaults to ``off`` so a missing / stub profile (e.g. a
+        ``__new__``-constructed test engine) yields the backward-compatible
+        no-op. Resolved once at the top of each Anthropic entry point.
+        """
+        chosen = profile_name or self.config.default_profile
+        try:
+            profile = self.config.profile_by_name(chosen)
+        except (KeyError, ValueError):
+            return "off"
+        return getattr(profile, "empty_response_action", "off")
+
     def _resolve_chain(self, profile_name: str | None) -> list[BaseAdapter]:
         """Return the list of adapters to try, in order, for this profile.
 
@@ -2431,6 +2522,11 @@ class FallbackEngine:
         tool_choice_action, cache_control_action = self._resolve_shim_actions(
             request.profile
         )
+        # ⑧ (empty-response): resolve the per-request empty-response action
+        # once. ``last_empty_resp`` holds the most recent content-empty 200
+        # under ``fallback`` so a fully-empty chain returns it verbatim.
+        empty_response_action = self._resolve_empty_response_action(request.profile)
+        last_empty_resp: AnthropicResponse | None = None
 
         for adapter, will_degrade in chain:
             is_native = isinstance(adapter, AnthropicAdapter)
@@ -2585,6 +2681,26 @@ class FallbackEngine:
                 stream=False,
                 response_fingerprint=_fp(_fp_text) if _fp_text else None,
             )
+            # ⑧ (empty-response): per-request empty-response handling. Runs
+            # after the drift observation above (which still gets the real
+            # output_tokens=0 signal for the windowed empty_response_rate)
+            # but before the cache-observed / observer fanout, so a
+            # ``fallback`` swap does not emit a "completed" line for a
+            # response the client never sees.
+            if empty_response_action != "off" and _anthropic_response_is_empty(resp):
+                if empty_response_action == "fallback":
+                    # Remember this empty response so a fully-empty chain can
+                    # return it verbatim, then try the next provider. Not
+                    # recorded in ``errors`` — a 200 blank is not a failure.
+                    last_empty_resp = resp
+                    log_empty_response_detected(
+                        logger, adapter.name, action="fallback", stream=False
+                    )
+                    continue
+                # ``warn``: log only; fall through and return the empty resp.
+                log_empty_response_detected(
+                    logger, adapter.name, action="warn", stream=False
+                )
             # v1.9-A: pair every successful Anthropic response with a
             # cache-observed log line. Native Anthropic / LM Studio
             # /v1/messages report cache_read_input_tokens /
@@ -2625,6 +2741,20 @@ class FallbackEngine:
             )
             return resp
 
+        # ⑧ (empty-response): the chain is exhausted. Under ``fallback``,
+        # if every provider that answered returned an empty 200, return the
+        # last empty response verbatim (a 200 blank is a legitimate answer)
+        # rather than raising — errors is empty in that case anyway.
+        if last_empty_resp is not None:
+            log_empty_response_detected(
+                logger,
+                last_empty_resp.coderouter_provider or "unknown",
+                action="fallback",
+                stream=False,
+                chain_exhausted=True,
+            )
+            return last_empty_resp
+
         profile = request.profile or self.config.default_profile
         _warn_if_uniform_auth_failure(errors, profile=profile)
         raise NoProvidersAvailableError(profile=profile, errors=errors)
@@ -2676,6 +2806,15 @@ class FallbackEngine:
         tool_choice_action, cache_control_action = self._resolve_shim_actions(
             request.profile
         )
+        # ⑧ (empty-response): resolve the per-request empty-response action.
+        # Only ``fallback`` changes the streaming path (it buffers events
+        # until real content appears); ``off`` / ``warn`` stream unchanged.
+        # ``last_empty_stream_buffer`` holds the buffered preamble of the
+        # most recent empty stream so a fully-empty chain can flush it and
+        # terminate normally rather than raising.
+        empty_response_action = self._resolve_empty_response_action(request.profile)
+        empty_fallback = empty_response_action == "fallback"
+        last_empty_stream_buffer: list[AnthropicStreamEvent] | None = None
 
         for adapter, will_degrade in chain:
             is_native = isinstance(adapter, AnthropicAdapter)
@@ -2828,15 +2967,59 @@ class FallbackEngine:
             self._observe_provider_success(
                 adapter.name, profile=request.profile
             )
-            acc.observe(first)
-            yield first
+            # ⑧ (empty-response): under ``fallback`` we withhold the opening
+            # events (message_start / empty content_block_start / ping) from
+            # the client until the *first real content* event is observed.
+            # Because no bytes have reached the client, an empty stream can
+            # still be swapped for the next provider. ``off`` / ``warn`` keep
+            # the legacy immediate-yield behavior (byte-for-byte unchanged).
+            #
+            # ``content_started`` flips True the moment real content is seen
+            # (or immediately, when the action is not ``fallback``); from
+            # then on events pass straight through and the mid-stream guard
+            # is live exactly as before.
+            content_started = not empty_fallback
+            buffer: list[AnthropicStreamEvent] = []
             # Mid-stream guard identical to stream() — any error after the
-            # first event is terminal.
+            # first *forwarded* event is terminal.
             try:
-                async for ev in event_iter:
+                # Seed the loop with the already-fetched ``first`` event,
+                # then drain the rest of the iterator.
+                pending = first
+                iterator = event_iter.__aiter__()
+                while True:
+                    ev = pending
                     acc.observe(ev)
-                    yield ev
+                    if content_started:
+                        yield ev
+                    else:
+                        buffer.append(ev)
+                        if _stream_event_is_real_content(ev):
+                            # Real content arrived — flush the withheld
+                            # preamble in order, then switch to passthrough.
+                            content_started = True
+                            for buffered_ev in buffer:
+                                yield buffered_ev
+                            buffer = []
+                    try:
+                        pending = await iterator.__anext__()
+                    except StopAsyncIteration:
+                        break
             except AdapterError as exc:
+                if not content_started:
+                    # Empty-stream failure before any real content under
+                    # ``fallback``: nothing reached the client, so treat it
+                    # like an empty response and try the next provider. Do
+                    # NOT raise MidStreamError (that would surface to the
+                    # client). Record the error-only observation for adaptive.
+                    self._adaptive.record_attempt(
+                        adapter.name, latency_ms=None, success=False
+                    )
+                    log_empty_response_detected(
+                        logger, adapter.name, action="fallback", stream=True
+                    )
+                    last_empty_stream_buffer = buffer
+                    continue
                 # M2: mid-stream failure — record an error-only
                 # observation (no latency; first-event success already
                 # recorded) so adaptive error rate reflects the breakage.
@@ -2868,6 +3051,17 @@ class FallbackEngine:
                 raise MidStreamError(
                     adapter.name, exc, partial_content=acc.partial_content
                 ) from exc
+            # ⑧ (empty-response): the stream ended cleanly but no real
+            # content was ever observed under ``fallback`` — the preamble is
+            # still buffered (never sent). Treat as an empty response: keep
+            # the buffer for a possible chain-exhausted flush and try the
+            # next provider.
+            if empty_fallback and not content_started:
+                log_empty_response_detected(
+                    logger, adapter.name, action="fallback", stream=True
+                )
+                last_empty_stream_buffer = buffer
+                continue
             # v2.0-G (L4): drift detection observation (stream success).
             # P1-4: compute response fingerprint for goal_progress_stall.
             _stream_fp_text = " ".join(
@@ -2923,6 +3117,23 @@ class FallbackEngine:
             )
             return
 
+        # ⑧ (empty-response): the chain is exhausted under ``fallback`` and
+        # every provider produced an empty stream. Flush the last buffered
+        # (empty) preamble so the client gets a well-formed, terminating SSE
+        # sequence (message_start … message_stop) instead of an error — a
+        # 200 blank is a legitimate answer. errors is empty in that case.
+        if last_empty_stream_buffer is not None:
+            log_empty_response_detected(
+                logger,
+                "unknown",
+                action="fallback",
+                stream=True,
+                chain_exhausted=True,
+            )
+            for buffered_ev in last_empty_stream_buffer:
+                yield buffered_ev
+            return
+
         profile = request.profile or self.config.default_profile
         _warn_if_uniform_auth_failure(errors, profile=profile)
         raise NoProvidersAvailableError(profile=profile, errors=errors)

coderouter/translation/tool_repair.py

@@ -27,6 +27,30 @@ Recognised shapes
     <echo message="probe"/>                        (attribute form)
     <tool>{"name": "echo", "arguments": {...}}</tool>   (wrapper form)
     <echo>{"message": "probe"}</echo>              (named-wrapper form)
+5. Nested-XML name-attribute forms (R4a), where the tool name lives in a
+   ``name`` attribute rather than the tag itself (L2 default-temp residual):
+    <tools><function name="echo" arguments='{...}'/></tools>   (container form)
+    <function name="echo" arguments='{...}'/>       (bare call-tag form)
+    <tool name="read_file" args='{...}'/>           (args alias)
+   The container/call tags are a fixed known set; the ``name`` attribute must
+   be allow-listed and the ``arguments``/``args`` value is delegated to R1.
+6. JSON envelope forms (R4b), where the model echoes a response wrapper:
+    {"tool_calls": [{"name": "echo", "arguments": {...}}, ...]}  (OpenAI list)
+    {"function_call": {"name": ..., "arguments": "<JSON string>"}}  (legacy)
+   The envelope is unwrapped and each inner object is run through the same
+   shape + allow-list validation; the legacy ``arguments`` string is
+   double-parsed. Works both fenced and bare.
+7. Call-syntax forms (R4c), the "name + parens + args" family, recognised
+   ONLY inside a fenced block or on its own standalone line (never inline in
+   prose):
+    print(default_api.echo(message="probe"))        (Gemma tool_code idiom)
+    echo(message="probe")                           (python kwargs)
+    echo(message: 'demo')                           (colon-separated kwargs)
+    write_note({"path": "a", "text": "b"})          (single JSON-object arg)
+   Guards: the function name must be allow-listed, the argument list must
+   parse completely (a broken inner JSON is left alone rather than executed
+   with corrupt args), and an explanatory example cue preceding the fence
+   suppresses extraction.
 
 Each candidate is accepted only if it parses to one of:
     {"name": <str>, "arguments": <dict | str>}          # direct shape
@@ -64,6 +88,7 @@ name that is not in the allow-list is still never repaired.
 
 from __future__ import annotations
 
+import contextlib
 import json
 import re
 import uuid
@@ -137,6 +162,71 @@ def _looks_like_tool_call(obj: Any, allowed: set[str] | None) -> tuple[str, Any]
     return name, args
 
 
+# R4b: JSON envelope keys whose value carries the actual tool call(s).
+#   {"tool_calls": [ {call}, {call}, ... ]}   -> a list of calls
+#   {"function_call": {call}}                 -> a single call
+# These are the OpenAI response-envelope shapes a model sometimes echoes back
+# into the text body verbatim. The envelope wrapper is unwrapped and each inner
+# object is validated by the same _looks_like_tool_call predicate.
+_ENVELOPE_LIST_KEY = "tool_calls"
+_ENVELOPE_SINGLE_KEY = "function_call"
+
+
+def _expand_tool_call_envelope(
+    obj: Any, allowed: set[str] | None
+) -> list[tuple[str, Any]] | None:
+    """Unwrap an R4b JSON envelope into a list of (name, arguments) tuples.
+
+    Recognises exactly two response-envelope wrappers:
+      - ``{"tool_calls": [ ... ]}``    (OpenAI tool_calls list)
+      - ``{"function_call": { ... }}`` (OpenAI legacy single call)
+
+    The dict must carry the envelope key and nothing else that would make it
+    ambiguous with a plain tool-call object (i.e. it must NOT itself already
+    look like a direct call). Every inner element must resolve to an
+    allow-listed call, otherwise the whole envelope is declined (all-or-nothing
+    keeps false positives at zero — a half-recognised wrapper is suspicious).
+
+    Returns the list of calls, or None if ``obj`` is not an envelope. An empty
+    envelope (no valid inner calls) also returns None.
+    """
+    if not isinstance(obj, dict):
+        return None
+    # If the object is itself a direct tool call, it is not an envelope; let the
+    # ordinary single-call path handle it (avoids double extraction).
+    if _looks_like_tool_call(obj, allowed) is not None:
+        return None
+
+    if _ENVELOPE_LIST_KEY in obj:
+        raw = obj[_ENVELOPE_LIST_KEY]
+        if not isinstance(raw, list) or not raw:
+            return None
+        calls: list[tuple[str, Any]] = []
+        for item in raw:
+            hit = _looks_like_tool_call(item, allowed)
+            if hit is None:
+                return None  # all-or-nothing
+            calls.append(hit)
+        return calls or None
+
+    if _ENVELOPE_SINGLE_KEY in obj:
+        inner = obj[_ENVELOPE_SINGLE_KEY]
+        hit = _looks_like_tool_call(inner, allowed)
+        if hit is None:
+            return None
+        name, args = hit
+        # Legacy shape carries arguments as a JSON *string*; double-parse it so
+        # the normaliser emits a proper arguments object where possible. If the
+        # inner string is not valid JSON, keep it verbatim (bug-for-bug parity
+        # with bare_json_04's string-arguments behaviour).
+        if isinstance(args, str):
+            with contextlib.suppress(ValueError):
+                args = _parse_json_object(args)
+        return [(name, args)]
+
+    return None
+
+
 def _normalise_to_openai_tool_call(name: str, arguments: Any) -> dict[str, Any]:
     """Build an OpenAI-shape tool_calls entry."""
     if isinstance(arguments, str):
@@ -373,12 +463,30 @@ def _extract_tool_call_fenced_blocks(
         body = match.group(2).strip()
         if lang in _CODE_FENCE_LANGS:
             return match.group(0)  # protected source-code fence
+        # R4c: call-syntax family (name(...)) inside a non-code fence. Only
+        # attempted when the body is a single call line and its name is
+        # allow-listed with fully-parseable arguments; an example cue on the
+        # line(s) preceding the fence suppresses it.
+        if not body.startswith("{") and allowed is not None:
+            if not _preceded_by_prose_cue_before_fence(text, match.start()):
+                call_hits = _extract_call_syntax_lines(body, allowed)
+                if call_hits:
+                    for name, args in call_hits:
+                        tool_calls.append(_normalise_to_openai_tool_call(name, args))
+                    return ""
+            return match.group(0)  # keep other non-JSON fenced blocks (code)
         if not body.startswith("{"):
             return match.group(0)  # keep non-JSON fenced blocks (e.g. code)
         try:
             obj = _parse_json_object(body)
         except ValueError:
             return match.group(0)  # keep unparseable fenced blocks
+        # R4b: response-envelope wrappers ({"tool_calls": [...]}, ...).
+        envelope = _expand_tool_call_envelope(obj, allowed)
+        if envelope is not None:
+            for name, args in envelope:
+                tool_calls.append(_normalise_to_openai_tool_call(name, args))
+            return ""
         hit = _looks_like_tool_call(obj, allowed)
         if hit is None:
             return match.group(0)  # keep non-tool-call JSON blocks
@@ -405,6 +513,17 @@ def _protected_code_spans(text: str) -> list[tuple[int, int]]:
     return spans
 
 
+def _all_fence_spans(text: str) -> list[tuple[int, int]]:
+    """Byte spans of *every* fenced block (any language tag or none).
+
+    Used by the standalone-line R4c scanner: a call line that survives inside a
+    fence was already offered to the fenced R4c path (and, if suppressed by an
+    example cue, must stay suppressed), so the standalone scanner must never
+    reach inside any fence.
+    """
+    return [(m.start(), m.end()) for m in _FENCED_RE.finditer(text)]
+
+
 def _in_spans(pos: int, spans: list[tuple[int, int]]) -> bool:
     return any(start <= pos < end for start, end in spans)
 
@@ -514,27 +633,389 @@ def _find_candidate_object_spans(text: str) -> list[tuple[int, int, str]]:
 # If one of these phrases appears immediately before a bare JSON object (within
 # a short window, on the same clause), the object is being *described* rather
 # than emitted as a call. Conservative: only suppresses, never forces a repair.
+#
+# The vocabulary is deliberately broad — documentation / example / "here is the
+# format" framings all mark the following block as *illustrative*. It stays
+# clear of tokens that appear in genuine descriptive prose which nonetheless
+# precedes a real call (e.g. "The `echo` function echoes back the provided
+# message." for python_call_04), so words like ``function`` / ``message`` are
+# NOT cues.
 _PROSE_CUE_RE = re.compile(
     r"(?:"
     r"for\s+example|for\s+instance|e\.?g\.?|such\s+as|"
     r"you\s+(?:would|could|can|might)\s+write|"
     r"you\s+would\s+(?:use|call)|"
-    r"(?:is|are)\s+documented(?:\s+as)?|documented\s+like|"
-    r"looks?\s+like\s+this|written\s+as|the\s+format\s+is|"
-    r"syntax\s+is|例えば|たとえば|のように書"
+    r"(?:is|are)\s+documented(?:\s+as)?|documented(?:\s+like)?|"
+    r"looks?\s+like|written\s+as|"
+    r"as\s+follows|"
+    r"(?:calling\s+)?convention|"
+    r"below\s+is|"
+    r"(?:this|the|that)\s+format|the\s+format\s+is|"
+    r"sample|payload|"
+    r"syntax|signature|"
+    r"look(?:s|ing)?\s+in|"
+    r"例えば|たとえば|のように書"
     r")"
-    r"[^\n{]{0,40}$",
+    r"[^\n{]{0,80}$",
     re.IGNORECASE,
 )
 
 
 def _preceded_by_prose_cue(text: str, start: int) -> bool:
-    """True if a documentation/example cue immediately precedes position ``start``."""
+    """True if a documentation/example cue precedes position ``start``.
+
+    Two windows are checked so a cue on the *previous* line still guards a call
+    that a model placed on its own line under an introductory sentence
+    (``"Here's a sample payload:\n{...}"`` — negative_19 / negative_22):
+
+      1. the current same-clause lead-in — the object's own line, explicitly
+         sliced from the last newline, which catches inline "..., e.g. {...}"
+         framings; and
+      2. the immediately preceding non-blank line, matched whole, which catches
+         "Here's how it looks in this format:" one line above the object.
+
+    Design note (colon-terminated lead-ins): a legitimate call announcement such
+    as ``"I'll call it now:"`` ends in a cue-adjacent colon and, when it carries
+    a cue word (e.g. "sample", "payload", "format"), is deliberately suppressed
+    together with the illustrative ones. Under the FP-0%-first principle this
+    trade-off is accepted on purpose: losing the occasional genuine "here it
+    comes" preamble is preferable to executing a described example as a real
+    call. (The bare cue guard here still keys off the *vocabulary*, so a
+    cue-free colon lead-in like "Here's the tool call:" stays repairable; the
+    unconditional colon rule lives only on the call-syntax fence path.)
+
+    Conservative: only ever suppresses, never forces a repair.
+    """
     prefix = text[:start]
-    # Look only within the current line/clause (last ~80 chars, no newline jump
-    # further than the immediate lead-in).
-    tail = prefix[-80:]
-    return bool(_PROSE_CUE_RE.search(tail))
+    # (1) same-clause lead-in. Slice the object's *own* line explicitly from the
+    #     last newline so the cue anchor is measured against the current line's
+    #     real end, not the whole-string end. Anchoring on ``prefix[-200:]``
+    #     alone breaks when the object sits at a line start (prefix ends "\n\n"):
+    #     the ``[^\n{]`` tail then collapses to zero width and the anchor can no
+    #     longer reach a cue that lives before the newline. Isolating the current
+    #     line keeps window (1) strictly same-line, leaving cross-line cues to
+    #     window (2).
+    nl = prefix.rfind("\n")
+    current_line = prefix[nl + 1 :] if nl != -1 else prefix
+    if _PROSE_CUE_RE.search(current_line[-200:]):
+        return True
+    # (2) the nearest non-blank line above the object.
+    lines = prefix.splitlines()
+    while lines and not lines[-1].strip():
+        lines.pop()
+    # Drop the current (partial) line the object sits on — but ONLY when it
+    # actually exists. When ``prefix`` ends in a newline the object is at a line
+    # start, so ``splitlines()`` already excludes any current-line residue and
+    # the last surviving entry *is* the lead-in line; popping it unconditionally
+    # would discard the cue line itself (negative_19 / negative_23 off-by-one).
+    if lines and not prefix.endswith("\n"):
+        lines.pop()
+    while lines and not lines[-1].strip():
+        lines.pop()
+    if lines:
+        lead = lines[-1].strip()
+        if _PROSE_CUE_RE.search(lead[-200:]):
+            return True
+    return False
+
+
+def _preceded_by_prose_cue_before_fence(text: str, fence_start: int) -> bool:
+    """True if the last non-blank line before a fence is an example cue.
+
+    The bare-JSON cue guard (:func:`_preceded_by_prose_cue`) only looks at the
+    immediate same-clause lead-in, which does not span the blank line(s) that
+    separate an introductory sentence from a following ```...``` fence. R4c
+    call-syntax fences are commonly introduced on a *separate* line
+    ("For example, you would write:\\n\\n```..."), so this looks back across
+    blank lines to the nearest non-empty line and applies the same cue regex.
+
+    This is the discriminator between negative_15 (example-cue + fenced call ->
+    suppress) and python_call_04 (descriptive prose + fenced call -> repair).
+    Conservative: only ever suppresses, never forces a repair.
+    """
+    prefix = text[:fence_start]
+    lines = prefix.splitlines()
+    # Drop the (possibly empty) trailing fragment and any blank separator lines
+    # so we land on the last line carrying actual prose.
+    while lines and not lines[-1].strip():
+        lines.pop()
+    if not lines:
+        return False
+    lead = lines[-1].strip()
+    # A lead-in line ending in a colon ("... as follows:", "... this format:",
+    # a long "For example, ...:") is an introduction to an illustrative block,
+    # so a call-syntax fence that follows it is being *shown*, not invoked. This
+    # is a general signal that does not depend on the cue vocabulary and so is
+    # robust to paraphrase and to arbitrarily long lead-in lines (negative_18 /
+    # 20 / 21). It is applied ONLY on this call-syntax fence path — bare JSON /
+    # JSON-envelope fences are introduced by legitimate colon lead-ins too
+    # ("Here's the tool call:", "First:") and must stay repairable.
+    if lead.endswith((":", "：")):  # noqa: RUF001 — full-width colon (U+FF1A) is intentional
+        return True
+    # Otherwise fall back to the cue vocabulary anywhere in the lead-in line.
+    return bool(_PROSE_CUE_RE.search(lead[-200:]))
+
+
+# ------------------------------------------------------------------
+# R4c: call-syntax family (name + parens + args)
+# ------------------------------------------------------------------
+
+# Head of a call line: an optional ``print(`` wrapper, an optional
+# ``default_api.`` prefix (Gemma tool_code idiom), then the tool name and its
+# opening paren. Anchored at the start of a (stripped) line so an inline
+# mid-prose call is never a candidate.
+_CALL_HEAD_RE = re.compile(
+    r"^(?P<print>print\s*\(\s*)?"
+    r"(?:default_api\s*\.\s*)?"
+    r"(?P<name>[A-Za-z_]\w*)\s*\("
+)
+
+# A single ``key = value`` / ``key : value`` kwargs pair.
+_CALL_KWARG_RE = re.compile(r"^(?P<key>[A-Za-z_]\w*)\s*(?:=|:)\s*(?P<val>.*)$", re.DOTALL)
+
+
+def _find_matching_paren(s: str, open_idx: str | int) -> int:
+    """Index of the ``)`` matching the ``(`` at ``open_idx``, or -1.
+
+    Balances parentheses while respecting single/double quoted strings (so a
+    paren inside a string literal does not close the call).
+    """
+    depth = 0
+    i = int(open_idx)
+    n = len(s)
+    quote: str | None = None
+    escape = False
+    while i < n:
+        c = s[i]
+        if escape:
+            escape = False
+        elif quote is not None:
+            if c == "\\":
+                escape = True
+            elif c == quote:
+                quote = None
+        else:
+            if c == '"' or c == "'":
+                quote = c
+            elif c == "(":
+                depth += 1
+            elif c == ")":
+                depth -= 1
+                if depth == 0:
+                    return i
+        i += 1
+    return -1
+
+
+def _split_top_level_commas(body: str) -> list[str] | None:
+    """Split ``body`` on top-level commas, respecting quotes and brackets.
+
+    Returns the list of segments, or None if the string/bracket nesting is
+    unbalanced (which means the arguments are corrupt and must not be repaired).
+    """
+    parts: list[str] = []
+    cur: list[str] = []
+    depth = 0
+    quote: str | None = None
+    escape = False
+    for c in body:
+        if escape:
+            cur.append(c)
+            escape = False
+            continue
+        if quote is not None:
+            cur.append(c)
+            if c == "\\":
+                escape = True
+            elif c == quote:
+                quote = None
+            continue
+        if c == '"' or c == "'":
+            quote = c
+            cur.append(c)
+            continue
+        if c in "([{":
+            depth += 1
+            cur.append(c)
+            continue
+        if c in ")]}":
+            depth -= 1
+            cur.append(c)
+            continue
+        if c == "," and depth == 0:
+            parts.append("".join(cur))
+            cur = []
+            continue
+        cur.append(c)
+    if quote is not None or depth != 0:
+        return None
+    tail = "".join(cur).strip()
+    if tail:
+        parts.append(tail)
+    return parts
+
+
+def _parse_call_value(raw: str) -> tuple[bool, Any]:
+    """Parse a single kwargs value. Returns (ok, value).
+
+    Tries strict JSON, then the lenient JSON pipe (which normalises single
+    quotes, unquoted words, etc.). ``ok`` is False when the value cannot be
+    parsed at all, so a corrupt argument fails the whole call (guard b).
+    """
+    v = raw.strip()
+    if not v:
+        return False, None
+    try:
+        return True, json.loads(v)
+    except json.JSONDecodeError:
+        pass
+    try:
+        return True, _lenient_json_loads(v)
+    except ValueError:
+        return False, None
+
+
+def _parse_call_args(body: str, name: str) -> tuple[str, Any] | None:
+    """Parse a call's argument list into (name, arguments) or None.
+
+    Handles all three R4c argument styles with a single splitter:
+      - ``key="value"`` / ``key=value`` (Python kwargs)
+      - ``key: 'value'``               (colon-separated, Ruby/Swift flavour)
+      - ``({...})`` a single JSON-object positional argument (JS flavour)
+
+    Every argument must parse completely; a broken inner value causes the whole
+    call to be declined (guard b — a form-only fix with corrupt args is more
+    harmful than no repair).
+    """
+    body = body.strip()
+    if not body:
+        # Zero-arg call: valid, empty arguments object.
+        return name, {}
+
+    # Single JSON-object positional argument: write_note({...}).
+    if body.startswith("{"):
+        try:
+            obj = _parse_json_object(body)
+        except ValueError:
+            return None
+        if not isinstance(obj, dict):
+            return None
+        return name, obj
+
+    segments = _split_top_level_commas(body)
+    if not segments:
+        return None
+    out: dict[str, Any] = {}
+    for seg in segments:
+        m = _CALL_KWARG_RE.match(seg.strip())
+        if not m:
+            return None  # positional args / unparseable -> decline
+        ok, val = _parse_call_value(m.group("val"))
+        if not ok:
+            return None
+        out[m.group("key")] = val
+    return name, out
+
+
+def _extract_one_call_line(line: str, allowed: set[str]) -> tuple[str, Any] | None:
+    """Extract a single call-syntax invocation from one standalone line.
+
+    The line must be *entirely* a call (optionally wrapped in ``print(...)``);
+    trailing garbage after the closing paren disqualifies it, so an inline
+    call embedded in a sentence is never matched. The name must be allow-listed
+    and the arguments must parse fully.
+    """
+    stripped = line.strip()
+    m = _CALL_HEAD_RE.match(stripped)
+    if not m:
+        return None
+    name = m.group("name")
+    if name not in allowed:
+        return None
+    open_idx = m.end() - 1
+    close_idx = _find_matching_paren(stripped, open_idx)
+    if close_idx < 0:
+        return None
+    inner = stripped[open_idx + 1 : close_idx]
+    rest = stripped[close_idx + 1 :].strip()
+    if m.group("print"):
+        # A print(...) wrapper must be closed by exactly one trailing ')'.
+        if not rest.startswith(")"):
+            return None
+        rest = rest[1:].strip()
+    if rest:
+        return None  # trailing garbage -> not a clean standalone call
+    return _parse_call_args(inner, name)
+
+
+def _extract_call_syntax_lines(
+    block: str, allowed: set[str]
+) -> list[tuple[str, Any]]:
+    """Extract call-syntax invocations from the non-blank lines of ``block``.
+
+    Used for fence interiors (one or more call lines). Every non-blank line
+    must resolve to an allow-listed call with fully-parseable arguments; if any
+    line fails, the whole block is declined (all-or-nothing keeps a mixed
+    code/call fence from being partially executed).
+    """
+    lines = [ln for ln in block.splitlines() if ln.strip()]
+    if not lines:
+        return []
+    hits: list[tuple[str, Any]] = []
+    for ln in lines:
+        hit = _extract_one_call_line(ln, allowed)
+        if hit is None:
+            return []
+        hits.append(hit)
+    return hits
+
+
+def _extract_r4c_standalone_lines(
+    text: str,
+    allowed: set[str],
+    protected: list[tuple[int, int]],
+) -> tuple[str, list[dict[str, Any]]]:
+    """Extract R4c call-syntax invocations that stand alone on their own line.
+
+    Complements the fenced R4c path: a call like ``write_note({...})`` may
+    appear bare (no fence) as the whole response or on its own line. Each
+    candidate line must be *entirely* a call (``_extract_one_call_line``
+    enforces the no-trailing-garbage rule), so an inline call embedded in a
+    sentence is never a candidate. Lines inside a protected code fence, or
+    introduced by an example cue, are skipped.
+
+    Returns (text_with_call_lines_removed, tool_calls).
+    """
+    if "(" not in text:
+        return text, []
+    tool_calls: list[dict[str, Any]] = []
+    out_lines: list[str] = []
+    pos = 0
+    changed = False
+    for line in text.splitlines(keepends=True):
+        line_start = pos
+        pos += len(line)
+        stripped = line.strip()
+        if not stripped:
+            out_lines.append(line)
+            continue
+        if _in_spans(line_start, protected):
+            out_lines.append(line)
+            continue
+        if _preceded_by_prose_cue(text, line_start):
+            out_lines.append(line)
+            continue
+        hit = _extract_one_call_line(stripped, allowed)
+        if hit is None:
+            out_lines.append(line)
+            continue
+        name, args = hit
+        tool_calls.append(_normalise_to_openai_tool_call(name, args))
+        changed = True
+        # Drop the call line entirely (keep a trailing newline structure sane).
+    if not changed:
+        return text, []
+    return "".join(out_lines), tool_calls
 
 
 # ------------------------------------------------------------------
@@ -606,6 +1087,121 @@ _XML_WRAPPER_RE = re.compile(
 )
 _XML_ATTR_RE = re.compile(r"([\w.:-]+)\s*=\s*\"([^\"]*)\"")
 
+# R4a: nested-XML name-attribute forms.
+# Known call/container tags whose ``name`` attribute (not the tag itself)
+# carries the tool name. Restricting to this fixed set — rather than treating
+# any tag with a ``name`` attribute as a call — keeps arbitrary markup (e.g.
+# <input name="q"/>) from being mistaken for a tool call.
+_R4A_CALL_TAGS = frozenset({"function", "tool", "function_call", "invoke", "tool_call"})
+# Container tags that merely wrap one or more call tags; scanned through, never
+# themselves a call.
+_R4A_CONTAINER_TAGS = frozenset({"tools", "tool_calls", "function_calls", "invoke"})
+# A self-closing call tag: <function name="..." arguments='...'/>. Attribute
+# values may be single- OR double-quoted; the ``arguments`` value is captured
+# raw and delegated to the JSON pipe (R1/R2). ``\1`` on the quote char keeps the
+# value greedy up to the matching closing quote.
+_R4A_ATTR_RE = re.compile(
+    r"""([\w.:-]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)')""",
+)
+_R4A_SELFCLOSE_RE = re.compile(
+    r"""<([A-Za-z_][\w.-]*)((?:\s+[\w.:-]+\s*=\s*(?:"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'))+)\s*/>""",
+)
+# R4a attribute keys that hold the tool name / the arguments payload.
+_R4A_NAME_ATTRS = ("name",)
+_R4A_ARG_ATTRS = ("arguments", "args", "parameters", "input")
+
+
+def _r4a_parse_attrs(attr_blob: str) -> dict[str, str]:
+    """Parse an XML attribute blob into {key: value}, unescaping quoted values.
+
+    A double-quoted value may carry backslash-escaped inner quotes
+    (``arguments="{\\"command\\": ...}"``); those are unescaped so the value is
+    valid JSON before it reaches the parse pipe. Single-quoted values are taken
+    verbatim (their inner double quotes are already literal JSON).
+    """
+    out: dict[str, str] = {}
+    for m in _R4A_ATTR_RE.finditer(attr_blob):
+        key = m.group(1)
+        if m.group(2) is not None:  # double-quoted
+            val = m.group(2).replace('\\"', '"').replace("\\\\", "\\")
+        else:  # single-quoted
+            val = m.group(3) or ""
+        out[key] = val
+    return out
+
+
+def _r4a_build_call(
+    attrs: dict[str, str], allowed: set[str]
+) -> tuple[str, Any] | None:
+    """Turn parsed R4a attributes into (name, arguments) if valid, else None."""
+    name = None
+    for k in _R4A_NAME_ATTRS:
+        if k in attrs:
+            name = attrs[k]
+            break
+    if not name or name not in allowed:
+        return None
+    args: Any = {}
+    for k in _R4A_ARG_ATTRS:
+        if k in attrs:
+            raw = attrs[k].strip()
+            if not raw:
+                args = {}
+                break
+            try:
+                args = _parse_json_object(raw)
+            except ValueError:
+                return None  # malformed arguments -> decline (safe side)
+            break
+    return name, args
+
+
+def _extract_r4a_nested_xml(
+    text: str,
+    allowed: set[str] | None,
+    guard: list[tuple[int, int]],
+) -> tuple[str, list[dict[str, Any]]]:
+    """Extract R4a nested-XML name-attribute tool calls.
+
+    Handles both the bare call tag (``<function name=.../>``) and the same tag
+    inside a container (``<tools>...</tools>``). Containers are transparent —
+    the scanner simply finds every allow-listed call tag, wherever it sits, and
+    removes it; a lone empty ``<tools></tools>`` shell left behind is trimmed by
+    residue cleanup. Reasoning-block / example-cue guards are honoured.
+
+    Returns (text_with_calls_removed, tool_calls).
+    """
+    if allowed is None or "<" not in text:
+        return text, []
+    tool_calls: list[dict[str, Any]] = []
+    removals: list[tuple[int, int]] = []
+    for m in _R4A_SELFCLOSE_RE.finditer(text):
+        tag = m.group(1).lower()
+        if tag not in _R4A_CALL_TAGS:
+            continue
+        if _in_spans(m.start(), guard) or _preceded_by_prose_cue(text, m.start()):
+            continue
+        attrs = _r4a_parse_attrs(m.group(2) or "")
+        hit = _r4a_build_call(attrs, allowed)
+        if hit is None:
+            continue
+        name, args = hit
+        tool_calls.append(_normalise_to_openai_tool_call(name, args))
+        removals.append((m.start(), m.end()))
+
+    if not removals:
+        return text, []
+    # Also sweep up now-empty container shells around removed calls.
+    cleaned = text
+    removals.sort()
+    for s, e in reversed(removals):
+        cleaned = cleaned[:s] + cleaned[e:]
+    for ctag in _R4A_CONTAINER_TAGS:
+        cleaned = re.sub(
+            rf"<{ctag}\s*>\s*</{ctag}\s*>", "", cleaned, flags=re.IGNORECASE
+        )
+    return cleaned, tool_calls
+
 
 def _known_non_tool_tag_ranges(text: str) -> list[tuple[int, int]]:
     """Ranges covered by <think>...</think> (and similar) reasoning blocks.
@@ -785,6 +1381,26 @@ def repair_tool_calls_in_text(
     cleaned, xml_tool_calls = _extract_xml_tool_calls(cleaned, allowed, protected)
     extracted.extend(xml_tool_calls)
 
+    # 2b. R4a: nested-XML name-attribute forms (<function name=.../> etc.).
+    #     Same guards as R3: protected code fences + reasoning blocks are
+    #     shielded, and an example cue immediately before a call tag suppresses
+    #     it.
+    protected = _protected_code_spans(cleaned)
+    r4a_guard = protected + _known_non_tool_tag_ranges(cleaned)
+    cleaned, r4a_tool_calls = _extract_r4a_nested_xml(cleaned, allowed, r4a_guard)
+    extracted.extend(r4a_tool_calls)
+
+    # 2c. R4c: standalone call-syntax lines outside any fence
+    #     (e.g. ``write_note({...})`` alone on a line). Fenced call-syntax was
+    #     already handled in step 1. Only whole-line calls with an allow-listed
+    #     name and fully-parseable arguments are taken; inline / mid-prose forms
+    #     are never candidates.
+    if allowed is not None:
+        cleaned, r4c_tool_calls = _extract_r4c_standalone_lines(
+            cleaned, allowed, _all_fence_spans(cleaned)
+        )
+        extracted.extend(r4c_tool_calls)
+
     # 3. Scan remaining text for bare JSON objects (strict then lenient).
     #    Skip anything inside a protected code fence or introduced by a prose
     #    example cue. Walk back-to-front so slicing removals don't shift the
@@ -803,6 +1419,14 @@ def repair_tool_calls_in_text(
             obj = json.loads(substr)
         except json.JSONDecodeError:
             continue
+        # R4b: response-envelope wrappers ({"tool_calls": [...]}, ...) expand to
+        # one or more inner calls before the direct-shape check.
+        envelope = _expand_tool_call_envelope(obj, allowed)
+        if envelope is not None:
+            for name, args in envelope:
+                repaired_from_bare.append(_normalise_to_openai_tool_call(name, args))
+            spans_to_remove.append((start, end))
+            continue
         hit = _looks_like_tool_call(obj, allowed)
         if hit is None:
             continue

{coderouter_cli-2.7.1.dist-info → coderouter_cli-2.7.3.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coderouter-cli
-Version: 2.7.1
+Version: 2.7.3
 Summary: Local-first, free-first, fallback-built-in LLM router. Claude Code / OpenAI compatible.
 Project-URL: Homepage, https://github.com/zephel01/CodeRouter
 Project-URL: Repository, https://github.com/zephel01/CodeRouter

{coderouter_cli-2.7.1.dist-info → coderouter_cli-2.7.3.dist-info}/RECORD

@@ -10,7 +10,7 @@ coderouter/errors.py,sha256=Xmq67lheyw8iv3Ox39jh2c4tvNI5RcUR4QkoxVDN6l4,1130
 coderouter/gguf_introspect.py,sha256=FZO14STLSp94Rfo5AInGwYUOpfjiXOW6CH5RiczTWDE,9514
 coderouter/hardware.py,sha256=gn3_9qbVcGRR81yKMn1lJE_8-YDRau0LxIH_M-f7pxE,8356
 coderouter/language_tax.py,sha256=LTbE3tIfoJuV2O3T0NixRKhzq_dEOTUuPEerJv2q9uk,9360
-coderouter/logging.py,sha256=ZHEgkWG1J7VkgL6pNzGJHRXRq_LB_Hcbl0VOG0phke8,54609
+coderouter/logging.py,sha256=91cveN8SCJEMNz9DGi6TrFSlc8cx0wdUkOdSLWLA-z8,56144
 coderouter/output_filters.py,sha256=0ry_rPiS_kC-FnHgaNVP6v7e6Al2djxzu9vBzZ8kEkE,25314
 coderouter/token_estimation.py,sha256=iz22vZEEW2P7uKLB2pYvPNpIbZGbgXRO5MtfkS_-9Sk,7531
 coderouter/token_estimation_accurate.py,sha256=GTfzrBVnvAGjeVzmzAeUdOYZvWZKLAxcxPpFiJGlzjk,4609
@@ -23,7 +23,7 @@ coderouter/config/__init__.py,sha256=FODEn74fN-qZnt4INPSHswqhOlEgpL6-_onxsitSx8g
 coderouter/config/capability_registry.py,sha256=RZgzHF54dXy0CCDocRCz2ee21qXGbbgTSKTkRI9iLL4,16936
 coderouter/config/env_file.py,sha256=CoMK27fuAXm-NtoLzXb8yN2E-wDFjHQuFwiIlmgTBQw,10356
 coderouter/config/loader.py,sha256=FUEe8m4Tnmj_aul0vSctD8vKvNW-oLRoMRbTpSKqSmc,4077
-coderouter/config/schemas.py,sha256=JmoUl5gCRucib940I3oFVMp8Om9Cz_C5iQAPeuJ32rc,74490
+coderouter/config/schemas.py,sha256=f46bpmSzZ_zJRhHbo9-inp-mAW86WZAg6hfSxgPaEcc,77741
 coderouter/data/__init__.py,sha256=uNyfD9jaCvTWsBAWtaw1Fr25OSxzv3psGMfBjT1z0Cc,328
 coderouter/data/model-capabilities.yaml,sha256=S9jt6SC6-3s2-icZ_n-a14iEMnc2yB1C2R6q-N_tZWQ,19309
 coderouter/guards/__init__.py,sha256=5qliYBqygvVPneej7nx0uSjxDKsz7t8VzvrDgVBJlvU,1170
@@ -45,7 +45,7 @@ coderouter/ingress/launcher_routes.py,sha256=1bU245mEauCMpEOsq0LY-8FKKQIJWJhDe3C
 coderouter/ingress/metrics_routes.py,sha256=M22dwOGn24P05Ge4W3c7d7mYytSGWjIR-pPSPOAiHJY,3965
 coderouter/ingress/openai_routes.py,sha256=Mjsk3jwot4qP9f5xshrmR1iuHMW-9sQdsfHMN_Sx5hc,9294
 coderouter/metrics/__init__.py,sha256=7Es351DPS7yLM0yVF_F0eesmiD83n7Zzhie44chht38,1465
-coderouter/metrics/collector.py,sha256=_Zp1wUOZhLA9afEdCwlxdV5QP4Z5sCjm1ya8jL0xkhI,59708
+coderouter/metrics/collector.py,sha256=wdGuX5yOBWEHCz1KVIfaUBZP5NXW3U34yyYlLGwgoCE,61212
 coderouter/metrics/prometheus.py,sha256=THYkvrcpQK3ZNW-BV0h3O-PoT2ppNZ0dapQuu1nyHwE,24410
 coderouter/plugins/__init__.py,sha256=76hMLe5dV_ilripHXzWn3HSYoIALjzlw4EJVyI-GyIM,1974
 coderouter/plugins/base.py,sha256=n9hsck2NCSqi6oeHIumKC5zhQ8JGwCXUz7J5AZQCQss,5772
@@ -56,7 +56,7 @@ coderouter/routing/adaptive.py,sha256=G2o377twGSjbUh65wiIFx6klnpFGjsD_nI3oDvcBwh
 coderouter/routing/auto_router.py,sha256=y4v0c8u5F9f98Vmhx1vRcKPiOgAvpzbFqr6TIh058h0,13341
 coderouter/routing/budget.py,sha256=PblmVKJGs_BwNa9uDHAA8hmZ4XIVKv38mHAeU0V3OMs,8451
 coderouter/routing/capability.py,sha256=rRQhzTgQYFTFDNYcSLKvq3xjdw6B1w7T-3jS7PTMI14,27864
-coderouter/routing/fallback.py,sha256=iuCCyIT0ARCI8r6iLQPaMYwt27WhwC1bPSiqE-OFCSM,129102
+coderouter/routing/fallback.py,sha256=vjnDv3z88v76ZnF2Sg1xYUOkKfe0jZm14OtoOrQA7Dc,139707
 coderouter/state/__init__.py,sha256=XoGcPmmBQSiZWML2S0juSveQ78xfhtdeCliNnVyzu7E,1088
 coderouter/state/audit_log.py,sha256=n7vuDsTfd5iuNUJhlRQPakJ2tMSsT9EfgPCzs1GEaac,10941
 coderouter/state/replay.py,sha256=Z_YHKroTKZdrL8qObFxcoLOAQWWXZvXFdLfxzvBhEJg,11230
@@ -66,9 +66,9 @@ coderouter/state/suggest_rules.py,sha256=FvdhEvao5NvdKp9zs8AkcoFKHY4yqqXY2HekvSj
 coderouter/translation/__init__.py,sha256=PYXN7XVEwpG1uC8RLy6fvnGbzEZhhrEuUapH8IYOtG8,1788
 coderouter/translation/anthropic.py,sha256=aZkcYH4x82b0x7efJgJb9RWn9Hbyc9pEOthXe4vjUdU,11113
 coderouter/translation/convert.py,sha256=VV4kpu4dvLmGBmJfQnCLY5ryy_AnQcV2NuwjqRtaR8Q,52633
-coderouter/translation/tool_repair.py,sha256=Ex9cPdRFuX7UeVKbMQRctum2CbCupXu8pnJEpIc6Ifc,31818
-coderouter_cli-2.7.1.dist-info/METADATA,sha256=YE2Jk09KYcC_8Zfk6ZnYhxVtMFL1xzRcy9TPMHkiwNo,14857
-coderouter_cli-2.7.1.dist-info/WHEEL,sha256=mffPy8wBnZQn2VnJUU5jE99KsxaSfiyMHV9Yt0aLVxs,87
-coderouter_cli-2.7.1.dist-info/entry_points.txt,sha256=-dnLfD1YZ2WjH2zSdNCvlO65wYltM9bsHt9Fhg3yGss,51
-coderouter_cli-2.7.1.dist-info/licenses/LICENSE,sha256=wkEzoR86jFw33jvfOHjULqmkGEfxTFMgMaJnpR8mPRw,1065
-coderouter_cli-2.7.1.dist-info/RECORD,,
+coderouter/translation/tool_repair.py,sha256=DGOKArM53yfVbIfiAveoul1vGq9NEKmjagf43Qh4IkM,57630
+coderouter_cli-2.7.3.dist-info/METADATA,sha256=EqYCtqhIooSQ806Ps89T9XIxVKRhWHiyyTyJsMpu_Lg,14857
+coderouter_cli-2.7.3.dist-info/WHEEL,sha256=mffPy8wBnZQn2VnJUU5jE99KsxaSfiyMHV9Yt0aLVxs,87
+coderouter_cli-2.7.3.dist-info/entry_points.txt,sha256=-dnLfD1YZ2WjH2zSdNCvlO65wYltM9bsHt9Fhg3yGss,51
+coderouter_cli-2.7.3.dist-info/licenses/LICENSE,sha256=wkEzoR86jFw33jvfOHjULqmkGEfxTFMgMaJnpR8mPRw,1065
+coderouter_cli-2.7.3.dist-info/RECORD,,