…, tool error sanitization

Three resilience features ported from Ironclaw:

1. Discard incomplete tool calls (ironclaw#1632)
   When finish_reason='length' and tool calls are present, they're likely
   incomplete. Discard them, inject a summarize notice. After 3 consecutive
   occurrences, temporarily disable tools.

2. Empty response recovery (ironclaw#1677 + #1720)
   When the LLM returns empty (no content, no tool calls):
   - If meaningful output exists earlier, treat as completion
   - Otherwise nudge once, then fail gracefully
   Max 2 consecutive empties before giving up.

3. Sanitize tool error results (ironclaw#1639)
   Strip XML boundary markers, CDATA sections, and code fences from error
   messages before sending to LLM. Cap at 2000 chars. Prevents
   injection attacks via crafted tool error messages.

18 new tests.

…-consecutive-role-violation

fix(compressor): summary role can violate consecutive-role constraint

…, tool error sanitization

Three resilience features ported from Ironclaw:

1. Discard incomplete tool calls (ironclaw#1632)
   When finish_reason='length' and tool calls are present, they're likely
   incomplete. Discard them, inject a summarize notice. After 3 consecutive
   occurrences, temporarily disable tools.

2. Empty response recovery (ironclaw#1677 + NousResearch#1720)
   When the LLM returns empty (no content, no tool calls):
   - If meaningful output exists earlier, treat as completion
   - Otherwise nudge once, then fail gracefully
   Max 2 consecutive empties before giving up.

3. Sanitize tool error results (ironclaw#1639)
   Strip XML boundary markers, CDATA sections, and code fences from error
   messages before sending to LLM. Cap at 2000 chars. Prevents
   injection attacks via crafted tool error messages.

18 new tests.

…-consecutive-role-violation

fix(compressor): summary role can violate consecutive-role constraint

…text (#26823)

Adds _sanitize_tool_error() in model_tools and routes both error paths
through it: registry.dispatch's try/except (the primary path for tool
exceptions) and handle_function_call's outer except (defense in depth).

Stripping targets structural framing tokens that the model itself can
react to even though json.dumps already handles wire-layer escaping:
XML role tags (tool_call, function_call, result, response, output,
input, system, assistant, user), CDATA sections, and markdown code
fences. Caps message body at 2000 chars and wraps with [TOOL_ERROR]
prefix.

Defense-in-depth: a tool exception carrying '<tool_call>...' won't
break message framing (json escapes it), but the model still reads
those tokens and they nudge it toward role-confusion framing.

Ported from ironclaw#1639 (one piece of #3838's three-feature scout).
The truncated-tool-call (#1632) and empty-response-recovery (#1677,
#1720) pieces are skipped because main now implements both far more
thoroughly (run_agent.py L8147/L12209/L13012 for truncation retry +
length rewrite; L4500/L15090+ for empty-response scaffolding stripper,
multi-stage nudge, fallback model activation).

…-consecutive-role-violation

fix(compressor): summary role can violate consecutive-role constraint

…text (NousResearch#26823)

Adds _sanitize_tool_error() in model_tools and routes both error paths
through it: registry.dispatch's try/except (the primary path for tool
exceptions) and handle_function_call's outer except (defense in depth).

Stripping targets structural framing tokens that the model itself can
react to even though json.dumps already handles wire-layer escaping:
XML role tags (tool_call, function_call, result, response, output,
input, system, assistant, user), CDATA sections, and markdown code
fences. Caps message body at 2000 chars and wraps with [TOOL_ERROR]
prefix.

Defense-in-depth: a tool exception carrying '<tool_call>...' won't
break message framing (json escapes it), but the model still reads
those tokens and they nudge it toward role-confusion framing.

Ported from ironclaw#1639 (one piece of NousResearch#3838's three-feature scout).
The truncated-tool-call (NousResearch#1632) and empty-response-recovery (NousResearch#1677,
NousResearch#1720) pieces are skipped because main now implements both far more
thoroughly (run_agent.py L8147/L12209/L13012 for truncation retry +
length rewrite; L4500/L15090+ for empty-response scaffolding stripper,
multi-stage nudge, fallback model activation).

…text (NousResearch#26823)

Adds _sanitize_tool_error() in model_tools and routes both error paths
through it: registry.dispatch's try/except (the primary path for tool
exceptions) and handle_function_call's outer except (defense in depth).

Stripping targets structural framing tokens that the model itself can
react to even though json.dumps already handles wire-layer escaping:
XML role tags (tool_call, function_call, result, response, output,
input, system, assistant, user), CDATA sections, and markdown code
fences. Caps message body at 2000 chars and wraps with [TOOL_ERROR]
prefix.

Defense-in-depth: a tool exception carrying '<tool_call>...' won't
break message framing (json escapes it), but the model still reads
those tokens and they nudge it toward role-confusion framing.

Ported from ironclaw#1639 (one piece of NousResearch#3838's three-feature scout).
The truncated-tool-call (NousResearch#1632) and empty-response-recovery (NousResearch#1677,
NousResearch#1720) pieces are skipped because main now implements both far more
thoroughly (run_agent.py L8147/L12209/L13012 for truncation retry +
length rewrite; L4500/L15090+ for empty-response scaffolding stripper,
multi-stage nudge, fallback model activation).

…text (NousResearch#26823)

Adds _sanitize_tool_error() in model_tools and routes both error paths
through it: registry.dispatch's try/except (the primary path for tool
exceptions) and handle_function_call's outer except (defense in depth).

Stripping targets structural framing tokens that the model itself can
react to even though json.dumps already handles wire-layer escaping:
XML role tags (tool_call, function_call, result, response, output,
input, system, assistant, user), CDATA sections, and markdown code
fences. Caps message body at 2000 chars and wraps with [TOOL_ERROR]
prefix.

Defense-in-depth: a tool exception carrying '<tool_call>...' won't
break message framing (json escapes it), but the model still reads
those tokens and they nudge it toward role-confusion framing.

Ported from ironclaw#1639 (one piece of NousResearch#3838's three-feature scout).
The truncated-tool-call (NousResearch#1632) and empty-response-recovery (NousResearch#1677,
NousResearch#1720) pieces are skipped because main now implements both far more
thoroughly (run_agent.py L8147/L12209/L13012 for truncation retry +
length rewrite; L4500/L15090+ for empty-response scaffolding stripper,
multi-stage nudge, fallback model activation).

(cherry picked from commit 627f8a5)

…, tool error sanitization

Three resilience features ported from Ironclaw:

1. Discard incomplete tool calls (ironclaw#1632)
   When finish_reason='length' and tool calls are present, they're likely
   incomplete. Discard them, inject a summarize notice. After 3 consecutive
   occurrences, temporarily disable tools.

2. Empty response recovery (ironclaw#1677 + NousResearch#1720)
   When the LLM returns empty (no content, no tool calls):
   - If meaningful output exists earlier, treat as completion
   - Otherwise nudge once, then fail gracefully
   Max 2 consecutive empties before giving up.

3. Sanitize tool error results (ironclaw#1639)
   Strip XML boundary markers, CDATA sections, and code fences from error
   messages before sending to LLM. Cap at 2000 chars. Prevents
   injection attacks via crafted tool error messages.

18 new tests.

…-consecutive-role-violation

fix(compressor): summary role can violate consecutive-role constraint

…text (NousResearch#26823)

Adds _sanitize_tool_error() in model_tools and routes both error paths
through it: registry.dispatch's try/except (the primary path for tool
exceptions) and handle_function_call's outer except (defense in depth).

Stripping targets structural framing tokens that the model itself can
react to even though json.dumps already handles wire-layer escaping:
XML role tags (tool_call, function_call, result, response, output,
input, system, assistant, user), CDATA sections, and markdown code
fences. Caps message body at 2000 chars and wraps with [TOOL_ERROR]
prefix.

Defense-in-depth: a tool exception carrying '<tool_call>...' won't
break message framing (json escapes it), but the model still reads
those tokens and they nudge it toward role-confusion framing.

Ported from ironclaw#1639 (one piece of NousResearch#3838's three-feature scout).
The truncated-tool-call (NousResearch#1632) and empty-response-recovery (NousResearch#1677,
NousResearch#1720) pieces are skipped because main now implements both far more
thoroughly (run_agent.py L8147/L12209/L13012 for truncation retry +
length rewrite; L4500/L15090+ for empty-response scaffolding stripper,
multi-stage nudge, fallback model activation).

…-consecutive-role-violation

fix(compressor): summary role can violate consecutive-role constraint