Issue for this PR

Closes #24316

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Models served through vLLM/llama.cpp sometimes write their tool call as plain text instead of a structured call. I captured this live with Qwen3.6 27B: about 50K tokens into a session the model emitted <function_bash> instead of <function=bash>, the server-side parser couldn't match it, the whole call leaked into the message text, and the turn finished stop with zero tool calls. The session loop saw a "finished" turn and halted mid-task.

I first tested the tag-stripping approach from #27984, but it didn't hold up. It patches packages/llm, which the CLI doesn't import (OpenAI-compatible providers go through the AI SDK path), and stripping text can't un-halt the session anyway since there's still no tool call to execute.

This PR adds a small detector (tool-call-leak.ts) that recognizes a leaked tool-call block at the end of the assistant text (Qwen XML, drifted variants, hermes JSON). When the session loop is about to exit on such a turn, it instead injects a hidden corrective message and lets the model retry, capped at 2 attempts per user prompt. Past the cap it stops with a visible error instead of a silent halt. Nothing is ever parsed or executed from the leaked text; the retry goes through the normal tool-calling path, so permissions and tool resolution are untouched. This works because the leak is intermittent format drift: given a correction, the model re-issues the call properly on the next try.

How did you verify your code works?

• 21 unit tests for the detector and attempt counting; the captured real-world leak is one of the test cases
• bun test in packages/opencode: 3000 pass, 0 fail; bun run typecheck clean
• End-to-end against a scripted OpenAI-compatible mock server: leak -> hidden retry -> tool executes -> session completes; permanent leak -> stops after 2 attempts with a persisted error
• Smoke test against live vLLM + Qwen3.6 27B: healthy turns never trigger the detector

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR