mirror of
https://github.com/unslothai/unsloth.git
synced 2026-07-10 00:08:58 +00:00
f109e7f0e6
* Studio: parse Mistral [TOOL_CALLS] and rehearsal tool-call shapes
Extends the rescue parsers in core/tool_healing.py and
core/inference/tool_call_parser.py to recognise two extra serialisations
local models commonly emit when bypassing native function calling:
* [TOOL_CALLS]name{json_args} (Devstral-Small-2, Mistral-Small-3.x).
* name[ARGS]{json_args} (reasoning-model rehearsal).
Both extractors use a brace-balance scan that honours escapes and
quoted strings so nested JSON args stay intact.
Also pre-strips <think>...</think> and [THINK]...[/THINK] blocks before
matching so calls emitted after a reasoning preamble are recognised
regardless of position.
Streaming gates (TOOL_XML_SIGNALS, llama_cpp.py _TOOL_XML_SIGNALS) and
the SSE strip regex (routes/inference.py _TOOL_XML_RE) gain the new
sentinels so the parser is actually invoked and the raw markup never
leaks to the UI.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Strip unclosed think blocks and catch rehearsal [ARGS] mid-buffer
The pre-existing ``_THINK_TAG_RE`` only matched closed thinking
blocks (``<think>...</think>`` or ``[THINK]...[/THINK]``). During
streaming the model is still inside the open block when the parser
runs, so any tool-shaped markup the model is REHEARSING inside that
block survived the strip and could be executed as a real call.
Switch both copies of the regex (parser + healing) to accept the
trailing block being terminated by end-of-string in addition to
the explicit closer.
The ``_TOOL_XML_SIGNALS`` list on the llama_cpp streaming buffer
included ``[ARGS]`` to catch rehearsal syntax, but the gate used a
``startswith`` check against the buffer head -- rehearsal is shaped
``name[ARGS]{json}``, so the buffer never STARTS with ``[ARGS]``
and the signal had no effect. Add a substring fallback for the
bracket-style signals so the BUFFERING window can still divert the
stream into DRAINING when rehearsal markup arrives mid-buffer.
Adds three regression tests covering rehearsal inside unclosed
``<think>`` / ``[THINK]`` blocks (must yield no calls) and the
positive case after a closed think block (still parsed).
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Studio: harden bracket-tag tool-call parsing and streaming strip
Address review findings on the Mistral [TOOL_CALLS] / rehearsal [ARGS] paths:
- Accept hyphenated tool names in the bracket parsers and strip patterns.
_MISTRAL_BRACKET_RE and _REHEARSAL_RE used \w+, which dropped or truncated
MCP function names containing dashes (mcp__srv__list-issues). Use [\w-]+ to
match the XML and Gemma parsers.
- Strip a partial bracket marker streamed before its opening brace. The
trailing-unclosed patterns required the {, so a [TOOL_CALLS]web_search or
python[ARGS] split across deltas leaked the raw marker to the UI. Match the
bare marker to end-of-text, mirroring how the bare open tags are stripped.
Closed pairs are unchanged so in-progress markup stays buffered until parsed.
- Strip a truncated bracket tail in the route-level display regex. _TOOL_XML_RE
required a balanced JSON object; a tool call truncated by EOS now strips up
to \Z, like the orphan-opening XML shapes. Complete calls still strip only
their balanced JSON so following prose survives.
Add regression tests for hyphenated names, the streaming partial-marker strip,
and the unclosed-tail route strip.
* Studio: preserve XML parameter indentation in tool_healing
The chat template emits <parameter=k>\nVALUE\n</parameter>; the parameter-start
regex consumed the wrapping newline AND the value's first-line indentation via a
trailing \s*, then str.strip() removed the rest, corrupting code/diff arguments.
Narrow the trailing class to horizontal whitespace and trim exactly one wrapping
newline (_trim_param_value), preserving indentation. Matches SGLang's qwen3_coder
detector and the same fix on the multi-format parser. Add a regression test.
* Studio: tighten Mistral/rehearsal tool-call comments
Compress the comments in the Mistral [TOOL_CALLS] / rehearsal [ARGS] healing shim
and its callers to one or two lines, keeping the bracket-tag stripping rationale,
the thinking-block handling note, and the forge attribution intact.
Comment-only: no code or behavior change (verified with comment_tools.py check
--strip-docstrings; tests green).
* Studio: fix think-strip arg corruption and nested bracket-JSON strip
Review follow-up for the Mistral/rehearsal healing shim:
- The <think>/[THINK] strip ran unconditionally over the whole content before
parsing, so a real tool argument that legitimately contained a <think> /
[THINK] literal was silently corrupted. Don't delete the blocks: compute the
reasoning-block spans and skip any tool-call candidate that STARTS inside one,
across all parse paths (JSON, Gemma, XML, bracket, rehearsal). A rehearsed call
inside reasoning is still ignored; a real call after </think> still parses.
- The bracket-tag display strip used a fixed one-level-nesting regex, so a call
with two-level-nested JSON args either leaked raw markup or, in final mode, let
the catch-all eat the trailing prose. Add a balanced-brace
_strip_bracket_tag_calls pass (any nesting depth) used by strip_tool_call_markup
and the route display strip.
Add regressions: <think>/[THINK] literal inside a real argument, rehearsal-inside-
think with a real call after, and two-level-nested bracket/rehearsal strip keeping
trailing prose.
* Studio: correct think-block comments to match span-skip behavior
The think-strip fix replaced the unconditional think-block strip with a
span-skip (the block is kept and any tool-call candidate starting inside it is
ignored), but two comments still described the old strip-first behavior. Update
the _THINK_TAG_RE comment and the parse_tool_calls_from_text docstring.
* Studio: parse Mistral arrays and call-ids, unify bracket parse/strip, keep it linear
- Parse the canonical Mistral array form (TOOL_CALLS followed by a JSON list of
calls) and emit every call; parse the v11 shape that carries an opaque CALL_ID
token between the name and ARGS (the function name is the token after
TOOL_CALLS, never the call-id); and parse a Mistral call plus a rehearsal call
in one message (the second was dropped yet still stripped from display).
- One shared balanced forward scan (_iter_bracket_spans) backs both the parser
and the strip path, so they no longer diverge. It is linear: each regex is
re-searched only once its cached match falls behind the cursor, replacing the
per-match full-tail re-scan that was O(n^2) (O(n^3) over a stream). A length cap
before the scan is a backstop.
- strip_tool_call_markup preserves think/reasoning blocks verbatim (the parser
skips tool markup inside them), stripping only the visible text around them.
- _in_think uses bisect over the sorted think spans (was a linear scan per
candidate).
- GGUF streaming strip runs the balanced bracket pre-pass before the regex
patterns so nested-arg calls do not leak or eat trailing prose, and the
BUFFERING ARGS detector requires the rehearsal name-ARGS shape.
- Tests: canonical array, array string-args, array strip keeps prose, Mistral
plus rehearsal multi-call, v11 call-id name, think-rehearsal strip
preservation, and bracket-strip linearity.
* Studio: preserve reasoning blocks in the route and streaming strip paths too
Addresses Gemini/Codex review: making strip_tool_call_markup preserve think
blocks left the route display strip and the GGUF streaming strip inconsistent,
so a rehearsed call inside a reasoning block was still deleted from the visible
text on those paths.
- Extract the think-block segmentation into one shared helper (strip_outside_think)
and route all three strip paths through it: strip_tool_call_markup,
_strip_tool_xml_for_display, and the GGUF _strip_tool_markup_streaming closure.
- Add a route-strip regression test that a rehearsal inside a reasoning block is
preserved while a real call outside it is still stripped.
* Studio: fix bracket-tag strip/buffer review findings
Address the live code-review findings on the Mistral bracket-tag / rehearsal
tool-call rescue path:
- tool_healing: a literal think block inside a tool-call argument is no longer
treated as a reasoning block. strip_outside_think now excludes think spans
that sit inside a complete tool-call span, so the call is stripped whole
instead of the split hiding its open/close pair and leaking the raw call.
- tool_healing: the rehearsal trailing-strip pattern requires a following brace
or end-of-text, so prose that merely mentions name[ARGS] is not truncated as
a phantom call. The bracket strip patterns are aligned with the parser
regexes (whitespace, v11 [CALL_ID]/[ARGS] metadata, and the [CALL_ID]
lookbehind).
- routes: strip a truncated canonical Mistral array ([TOOL_CALLS] [{... with no
closing bracket) that the balanced scan cannot remove, align the display
regex with the parser regexes, and apply the same rehearsal-prose guard.
- safetensors loop: mirror the GGUF [ARGS] rehearsal-substring check during
BUFFERING so a rehearsal name does not stream before its [ARGS] arrives.
Adds regression tests for each; existing parser suite stays green.
* Studio: hold split rehearsal tool-name prefix in both streaming loops
A reasoning-model rehearsal call can stream the tool name and its [ARGS] arm in
separate chunks (web_search then [ARGS]{...}). The buffering detector only
recognised the rehearsal once [ARGS] was present, so the bare tool name was
emitted as visible content before the call drained and executed.
Add _is_rehearsal_prefix (mirrored in the safetensors loop and the GGUF loop):
when a no-signal buffer is a bare active-tool name -- or a partial prefix of
NAME[ARGS] -- hold it as a prefix instead of streaming it, so the next chunk's
[ARGS] flips it to a drain. A whitespace in the buffer means prose, not a split
call, so ordinary text still streams.
Adds regression tests for the split rehearsal in both loops and a guard that a
plain non-tool word still streams.
* Studio: route Anthropic tool-call cleanup through the protected display strip
The Anthropic stream, non-stream, and passthrough paths cleaned content with raw
_TOOL_XML_RE.sub instead of _strip_tool_xml_for_display, so a rehearsal call
inside <think> was deleted from the reasoning and a nested [TOOL_CALLS] call
dropped its trailing prose (the OpenAI-compatible paths already use the helper).
Route all four sites (prior-assistant cleanup, streaming content events,
non-stream aggregation, passthrough conversion) through the protected helper, and
add a source-level guard test so raw _TOOL_XML_RE.sub stays confined to the
helper itself.
* Studio: stop split rehearsal tool names leaking once streaming, uncapped, or unrestricted
The split-rehearsal guard (NAME in one chunk, [ARGS]{...} in the next) only held
the name in the initial BUFFERING state. Three gaps remained where the bare tool
name still streamed as visible content before the call drained:
- STREAMING: after prose had already streamed, both loops emitted a trailing
active-tool-name token (and the GGUF/safetensors [ARGS] boundary was not pulled
back over the name). Hold the trailing rehearsal token and release it on the
next chunk, with an end-of-stream flush so a plain answer that merely ends on a
tool-name word is never dropped.
- Buffer cap: a realistic MCP name longer than the 32-char _MAX_BUFFER_CHARS cap
defeated the BUFFERING hold. A rehearsal prefix is self-bounding (it stops
matching once it grows past NAME[ARGS]), so the generic cap no longer applies to
it.
- Unrestricted mode (tools=[]): with no declared tool list, any bare identifier
may be a NAME[ARGS] rehearsal, so the prefix check now recognises one instead of
leaking the name and mis-parsing the call.
Regression tests cover the streaming, long-name, and unrestricted cases plus the
plain-prose paths that must not be held or corrupted.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Studio tools: protect think blocks in safetensors streaming, hold split rehearsal on initial flush, advertise Mistral tools
Pass-3 review follow-ups on the Mistral [TOOL_CALLS] / rehearsal [ARGS] work:
- Safetensors streaming display strip now preserves think / [THINK] reasoning
verbatim (routes through strip_outside_think like the GGUF path). A call
rehearsed inside a reasoning block was stripped mid-stream and then restored by
the final strip, a non-monotonic shrink/grow that corrupted append-by-length
stream consumers and the visible reasoning.
- The first flush out of BUFFERING (safetensors and GGUF) now applies the same
trailing-name hold the STREAMING branch uses, so a split rehearsal (prose plus a
trailing active tool name in one chunk, [ARGS]{...} in the next) no longer leaks
the bare name before the call drains.
- Safetensors capability gate no longer suppresses tools for Mistral [TOOL_CALLS]
templates, which the shared bracket-tag parser now handles end to end. Llama
python_tag stays suppressed (still unparseable).
- Route display strip applies the open-ended / bare-marker tail arms only on the
segment after the last reasoning block (closed-only regex before it), matching
strip_tool_call_markup, so a bare foo[ARGS] before a reasoning block is preserved
while complete calls are still removed in every segment.
Adds regression tests for each and updates the now-stale Mistral capability test.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Fix tool-call think-marker and bracket-wrapper edge cases
Round-1 review follow-ups on the Mistral/rehearsal tool-call healing:
- tool_healing: a reasoning marker that opens INSIDE a tool call's
arguments is argument data, not a reasoning block. Add
_think_spans_outside_tool_markup (start-inside test) and use it in
both parse_tool_calls_from_text and strip_outside_think so a literal
marker in one call's args no longer hides a later call (parse) or
leaks the raw markup (strip) when the greedy match runs past the
call's closer.
- tool_healing: strip the orphan Mistral v11 [/TOOL_CALLS] closer left
behind after the balanced scan removes the call body. Add a route arm
for the same closer in _TOOL_XML_RE / _TOOL_XML_CLOSED_RE.
- safetensors + llama_cpp streaming strip: run the open-ended (EOS
anchored) tail patterns only on the last segment; segments before a
reasoning block use the closed-only patterns, matching the final
strip and the route strip. A bare foo[ARGS] before a reasoning block
is prose, not a truncated call.
- safetensors streaming detector: validate each [ARGS] hit before
draining. A bare foo[ARGS] in prose (no active tool name in front)
no longer drains the rest of the turn; a later real NAME[ARGS] call
is still found and the prose in between is preserved.
Regression tests added for each case across the parser, strip helpers,
and both streaming loops.
* Strip incomplete-XML tool markup with literal think tags; widen render-html detector
Round-2 review follow-ups.
- tool_healing: an UNCLOSED <tool_call> / <function= call that the parser still
executes via allow_incomplete leaked its markup when an argument contained a
literal think marker. _tool_call_markup_spans only covered closed calls, so the
literal was treated as a reasoning block to preserve. Extend it to the
open-ended XML tail forms (shared as _TOOL_OPEN_XML_TAIL_PATS) so a think marker
inside an unclosed call is argument data and the call's markup is stripped. A
complete call's opener stays bounded to its closed span, and a real reasoning
block with no tool call is still preserved.
- safetensors render-html provisional card: _detect_render_html_tool_start was
XML-only, so a Mistral [TOOL_CALLS]render_html or rehearsal render_html[ARGS]
call executed but skipped the early card. Detect the earliest tool-call marker
across every serialization the loop executes and fire when it is render_html.
Regression tests added for both.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Studio tools: gate [ARGS] on active tools and skip think-block render_html rehearsal
Round 3 review fixes for the Mistral / rehearsal tool-call parsing path. Both are
asymmetric-fix bugs where one code path applied a guard the analogous paths did not.
- [ARGS] active-tool gating: the streaming state already validates a rehearsal
NAME[ARGS] against the active tool list before draining, but the BUFFERING
detection and the end-of-stream safety-net checks (safetensors and GGUF) treated
any word[ARGS] substring as a tool boundary. An answer containing a literal
foo[ARGS]{...} in prose, where foo is not an enabled tool, was drained, parsed into
a disabled foo no-op, and forced an extra generation turn. Gate those checks on the
active tool name too (unrestricted mode still accepts any name), so inactive-name
prose is neither drained nor parsed. Adds a shared _has_genuine_tool_signal helper
(safetensors) and _gguf_rehearsal_signal_pos / _gguf_has_genuine_tool_signal (GGUF).
- render_html provisional card vs think blocks: the parser skips tool candidates that
start inside a <think>/[THINK] reasoning block, but the provisional render_html
detector scanned raw content. A render_html rehearsed inside <think> followed by a
real non-render_html call emitted a provisional render_html tool_start (reusing the
later call's id) that the loop never executed. Drop candidates that start inside a
think span and use the first marker of each shape outside the blocks. Also resolve
the [TOOL_CALLS] [{...}] array shape through the parser so a nested "name" argument
key no longer fires a false provisional card ahead of the real top-level tool name.
Adds regression tests for both loops: inactive-name foo[ARGS]{...} is not drained into
a disabled no-op or a retry turn, a think-block render_html rehearsal emits no
provisional card, and the array top-level name is read correctly.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Gate ambiguous bare-rehearsal parse and strip on the active tool list
A bare NAME[ARGS]{json} is a genuine rehearsal call only when NAME is an
active tool; otherwise it is prose. The earlier round gated only detection
(so an inactive foo[ARGS] no longer drained the buffer or forced a retry
turn), but the parse and strip stayed unrestricted, which produced two
regressions:
1. An inactive foo[ARGS]{...} placed immediately before a real
web_search[ARGS]{...} in the same content span made the real call fail
to execute (parse consumed the phantom foo call).
2. An inactive foo[ARGS]{...} in a prose answer had its markup stripped
from the visible text, corrupting the sentence to " is just syntax."
Thread enabled_tool_names through the shared parser/strip so parse and
strip apply the SAME active-tool gate as detection:
- core/tool_healing.py: _iter_bracket_spans skips an inactive rehearsal
span; parse_tool_calls_from_text, _strip_bracket_tag_calls,
_strip_markup_segment and strip_tool_call_markup accept and thread the
gate; apply_tool_strip_patterns keeps an inactive rehearsal match.
- core/inference/tool_call_parser.py: wrappers forward the gate.
- core/inference/safetensors_agentic.py and core/inference/llama_cpp.py:
compute the gate from the active tool list (None when unrestricted, to
keep the legacy strip-all behavior) and thread it into every parse and
streaming/final strip site.
- routes/inference.py: _strip_tool_xml_for_display accepts the gate and
keeps an inactive rehearsal via a capture group on its rehearsal arm, so
the display cleanup does not re-strip the already-correct loop output.
The [TOOL_CALLS] control-token arms still strip unconditionally. Wire
the current turn's active tool names into the GGUF and safetensors
content-display sites.
Tests: parse and strip gate coverage in test_tool_call_parser_strict.py,
test_tool_xml_strip.py and test_safetensors_tool_loop.py; end-to-end GGUF
coverage for the real-call-after-inactive-rehearsal case and a
strengthened assertion that the inactive rehearsal prose survives intact.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Studio: render the reasoning block for safetensors and MLX like GGUF
enable_thinking chat templates (Qwen3/Qwen3.5/GLM) prefill an unclosed <think>
into the generation prompt, so the model emits only the closing </think> then
the answer. The safetensors/MLX chat stream emitted that as plain content, so
the reasoning showed inline with no collapsible thinking block, while GGUF
(which surfaces reasoning via reasoning_content) rendered one. This brings
safetensors and MLX to parity.
- _ResponsesReasoningExtractor gains a reasoning_prefilled mode that starts
inside the reasoning block and splits on the first </think>; default False
keeps GGUF and every existing caller byte-identical. It suppresses a stray
re-emitted <think> and holds partial markers back across chunk boundaries.
- _sf_reasoning_prefill_mode gates the mode on reasoning being enabled for the
request, an enable_thinking or enable_thinking_effort style, and the template
actually using the standard <think>/</think> markers. Models with a bespoke
reasoning channel (e.g. gemma's <|think|>/<|channel>) are excluded so their
answer is never swallowed; gpt-oss (Harmony) and thinking-off requests are
excluded too.
- sf_tool_stream and stream_chunks (the latter also serves MLX) feed text
through the extractor, emitting reasoning_content then content deltas, with a
per-turn reset in the tool loop and a flush before each tool_start; only the
visible delta reaches the monitor reply. The two non-streaming drains split
reasoning_content the same way.
- Tests: extractor prefilled mode (streaming and edge cases), the gate matrix
including the gemma-style exclusion, and a route-replay of the tool-loop
reasoning stream.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* studio: skip tool calls rehearsed in prefilled reasoning
Reasoning models (Qwen3.5 enable_thinking) open <think> in the prompt, so the
generated text starts inside the thought and emits only a closing </think> with
no opener. _think_spans_outside_tool_markup only found spans with an explicit
opener, so a NAME[ARGS]{...} or [TOOL_CALLS] call rehearsed in that leading
thought was parsed and executed as a real call.
Add a leading think span (offset 0 through the first close marker) when the
content opens with a bare close, so the rehearsed call is skipped and the
reasoning is preserved by strip_outside_think. Guarded by the existing call-span
check: a literal </think> inside a real call's arguments does not trigger the
span, so a genuine leading call still fires. Tests for both cases.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* studio: do not start prefilled reasoning mode when reasoning_effort is none
enable_thinking_effort models (e.g. GLM-5.2) express thinking-off via
reasoning_effort="none" rather than enable_thinking=False, but
_sf_reasoning_prefill_mode only looked at enable_thinking, so such a request
started the extractor in prefilled mode. With thinking off the model never emits
</think>, so the whole answer was captured as reasoning_content and the visible
content/stream came back empty. Thread reasoning_effort through and return False
when it is "none". Tests for none vs a real effort level.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* studio: only treat a leading bare </think> as prefilled reasoning when a real call follows
The prefilled-reasoning virtual span fired on any unmatched leading close marker,
so a non-prefilled turn that emits a real call before a stray </think> (for
example "Now web_search[ARGS]{...}</think> answer") had the call swallowed by the
span and dropped. Require that a real tool call also appear after the close (the
actual turn that follows the thought) before adding the span, so a stray close in
a normal answer no longer suppresses a genuine leading call. The rehearse-then-
call case still skips the rehearsal. Test for the stray-close case.
* Studio: trim redundant comments (comment-only, AST-verified)
* studio: keep tool_healing importable on Python 3.9
_balanced_json_span was annotated -> int | None. With no
from __future__ import annotations, that PEP 604 union is evaluated at
import time, so on Python 3.9 (which the package still supports,
requires-python >=3.9, and where external inference servers import this
module standalone) the def raises TypeError and the whole module fails
to import before any parsing runs.
Add from __future__ import annotations so annotations stay lazy strings,
matching the prevailing convention across studio/backend. No behavior
change: the module has no runtime annotation introspection.
* Studio: gate the Anthropic tool-stream display strip on declared tools
The Anthropic streaming and non-streaming tool paths called
_strip_tool_xml_for_display without enabled_tool_names, so with the default
strip-all behavior a final answer that literally contains an inactive-name
NAME[ARGS]{json} (prose, not a call) lost those bytes in the delivered text.
The GGUF and safetensors paths already pass _display_tool_name_gate(tools);
these two sites were missed when that gate was threaded through.
Compute the gate from the declared tools and pass it at both sites (threading
openai_tools into _anthropic_tool_non_streaming and its caller), so an
inactive-name rehearsal survives while an active-name one is still stripped.
Add a regression test.
* Studio: hold a split unrestricted rehearsal prefix at the bracket
In unrestricted tool mode (tools=[]) the rehearsal-prefix regex required
[A after the bracket, so a chunk boundary landing right after NAME[ (e.g.
web_search[ then ARGS]{...}) failed the prefix check and streamed the
partial tool markup web_search[ to the client before the call drained.
Restricted mode already holds this via a startswith check. Make the bracket
and each ARGS letter individually optional so NAME[ is held too, matching
the documented intent. Add a regression test.
* Studio: gate rehearsal detection and history strip on the original tool set
Two display/loop gate fixes so a spent one-shot tool is handled consistently:
- Rehearsal DETECTION (safetensors and GGUF loops) now uses the ORIGINAL tool
list, matching the strip gate, instead of the post-removal active_tools. After a
one-shot tool (render_html) runs it is dropped from active_tools; a repeat
render_html[ARGS]{...} while another tool is still active was stripped from
display yet never detected, so it was not routed to the render_html_repeat no-op
and the turn ended as a blank continuation. Detection now fires for it.
- The GGUF assistant-history sanitiser forwards the enabled-tool-name gate (like
the live-response strip), so a prior turn documenting an inactive foo[ARGS]{...}
shape is preserved in the replayed prompt context instead of being deleted.
Add regression tests for both loops and the history strip.
* Studio: thread the tool-name gate through the remaining rehearsal/history sites
Follow-up to the rehearsal-detection and history-strip gate fixes, covering the
sibling sites that were missed:
- GGUF loop: the rehearsal-prefix and trailing-name hold checks now use the
original tool list (_detect_tools) like the detection path, so a spent one-shot's
split repeat (bare render_html then [ARGS]{...}) is held instead of flushed as
visible text.
- The safetensors and Anthropic assistant-history sanitisers and the Anthropic
non-streaming passthrough now forward the enabled-tool-name gate to
_strip_tool_xml_for_display, matching the GGUF history sanitiser and the live
strips, so a prior turn documenting an inactive foo[ARGS]{...} example is
preserved in the replayed prompt / final text instead of deleted.
Add regression tests.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Tile bracket-call spans per array item and include the v11 closer
Two with_spans fixes for the Mistral bracket parser, both hit through the
client-tool passthrough healers:
- A multi-call [TOOL_CALLS] array carried its whole markup span on the first
call and zero-width spans after, so a consumer that filters promotions by
the declared tool set either re-emitted the full raw array as text next to
the promoted call or silently dropped a filtered call's bytes. The region is
now tiled across the call-producing items (each call's span covers its own
JSON object plus the separator bytes before it; the last span runs to the
region end), so promoted markup strips exactly once and a skipped call's
bytes stay visible.
- The v11 wrapper closer [/TOOL_CALLS] sat outside the reported span and
leaked as stray text after promotion; the region now extends over an
immediately-following closer.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Address review: decouple healer signals from the loop signal set
The passthrough healer buffered on every TOOL_XML_SIGNALS entry, so the bare
[ARGS] rehearsal marker this branch adds for the loops (where it is gated on
active tool names) put legitimate prose like 'Use foo[ARGS] in templates'
into the holding state and stalled the stream until finalization. The healer
can never promote a bare rehearsal call, so it now buffers only on formats
its parser promotes: <tool_call>, <|tool_call>, <function=, [TOOL_CALLS].
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Condense comments in the Mistral tool-call rescue to contract essentials
* verify_import_hoist: exempt __future__ imports and same-diff relocations
Two false positives fired on this PR's refactor. A from __future__ import
is a compiler directive whose name never appears as a runtime load, so
HOISTED-IMPORT-UNUSED can never see it used, yet the file requires it for
PEP 604 annotations on Python 3.9. TARGET-CHANGED flagged the deliberate
move of the strip-pattern constants into core.inference.tool_call_parser
as a silent re-point even though the old module-level target was removed
and the new one added in the same diff. Both get narrow exemptions; a
re-point to a pre-existing target is still caught, and the self-test
negative controls all pass unchanged.
* Drain the whole Mistral [TOOL_CALLS] array in streaming passthrough healing
StreamToolCallHealer._drain promoted only the first parsed call per pass and
dropped the rest of the buffer past that one span. For a well-formed Mistral
parallel-tool-call array streamed through client-tool passthrough
([TOOL_CALLS][{...},{...}]), the per-item spans are contiguous, so after the
first call was promoted the residue began with ,{...}] (no leading signal) and
was flushed as raw text: every call after the first was lost.
_drain now walks the contiguous run of parsed calls (adjacent tiled spans =
one array), promoting each declared call and relaying undeclared ones as data,
and stops at the first gap (prose) or incomplete trailing block so separate
blocks still stream incrementally in document order. This mirrors the
non-streaming heal_openai_message / finalize promote-or-flush loop and the
server-side safetensors loop, which already handled multi-call arrays.
Added regression tests: 2-call array in one feed and char-by-char, an
undeclared middle call kept as text, and an array followed by trailing prose.
* Drain comma-less Mistral tool-call arrays and normalize null arguments
The array branch fed the whole body to a single json.loads, which rejects the
comma-less multi-call form the repo's own Mistral/Ollama templates render (the
range loop in ollama_template_mappers.py emits the objects with no separator) and
so dropped every call. Decode elements individually with the existing
comma-tolerant raw_decode helper, now _decode_array_items, which also returns the
objects, so all calls are recovered while the span tiling is unchanged.
Also normalize a non-object array argument such as arguments null to an empty
object, matching the wrapped tool_call path, instead of serializing None to the
string "null" that auto-heal would turn into a bogus query of "null".
* Gate safetensors reasoning prefill on the rendered generation prompt
reasoning_always_on fires on any paired <think></think> in the template,
including markup that only renders PAST assistant history (Kimi-K2-Thinking)
while the generation prompt opens no <think>. Starting the reasoning extractor
in prefilled mode there captured a normal answer entirely as reasoning_content
and returned blank visible content. Prefill only when rendering the generation
prompt actually leaves <think> open (DeepSeek-R1 / QwQ / Qwen3-Thinking);
history-only templates start the extractor in normal mode and parse the model's
own <think>...</think>. Adds a Kimi-shape regression test.
* Keep bare scalar Mistral array arguments raw instead of double-encoding
A scalar string argument in the canonical Mistral [TOOL_CALLS] array
(for example [TOOL_CALLS][{"name":"web_search","arguments":"weather"}])
was run through json.dumps, turning weather into the JSON string
"weather". The downstream argument healer then wrapped that quoted
form, so a single-string tool like web_search searched for the literal
"weather" with quotes. The <tool_call> path already keeps a scalar
argument raw; mirror it here so only a dict is serialized. Add a
regression test asserting both paths yield the same healed arguments.
* Tighten tool-call rescue and reasoning-prefill comments
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
---------
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
1821 lines
85 KiB
Python
1821 lines
85 KiB
Python
# SPDX-License-Identifier: AGPL-3.0-only
|
||
# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
|
||
|
||
"""Strict-mode (Auto-Heal disabled) tool-call parsing.
|
||
|
||
With ``allow_incomplete=False`` the parser must accept a well-formed
|
||
``<function=...>...</function>`` call even when the model appends prose
|
||
after the closing tag -- matching the JSON-style ``<tool_call>...`` path,
|
||
which already tolerates trailing text -- while still rejecting genuinely
|
||
truncated calls that never close.
|
||
"""
|
||
|
||
from __future__ import annotations
|
||
|
||
import json
|
||
import sys
|
||
from pathlib import Path
|
||
|
||
_BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
|
||
if _BACKEND_DIR not in sys.path:
|
||
sys.path.insert(0, _BACKEND_DIR)
|
||
|
||
from core.inference.tool_call_parser import parse_tool_calls_from_text
|
||
|
||
|
||
def _only(text: str) -> dict:
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = False)
|
||
assert len(calls) == 1, f"expected exactly one call, got {len(calls)}: {calls!r}"
|
||
fn = calls[0]["function"]
|
||
return {"name": fn["name"], "arguments": json.loads(fn["arguments"])}
|
||
|
||
|
||
class TestFunctionStyleTrailingText:
|
||
def test_closed_function_with_trailing_prose_is_accepted(self):
|
||
text = (
|
||
"<function=web_search><parameter=query>weather london</parameter></function>"
|
||
" Let me check that for you."
|
||
)
|
||
call = _only(text)
|
||
assert call == {"name": "web_search", "arguments": {"query": "weather london"}}
|
||
|
||
def test_closed_function_with_trailing_whitespace_is_accepted(self):
|
||
text = "<function=web_search><parameter=query>cats</parameter></function> \n\n"
|
||
call = _only(text)
|
||
assert call == {"name": "web_search", "arguments": {"query": "cats"}}
|
||
|
||
def test_closed_function_without_trailing_text_still_parses(self):
|
||
text = "<function=web_search><parameter=query>cats</parameter></function>"
|
||
call = _only(text)
|
||
assert call == {"name": "web_search", "arguments": {"query": "cats"}}
|
||
|
||
def test_multi_param_with_trailing_prose(self):
|
||
text = (
|
||
"<function=terminal><parameter=command>ls -la</parameter>"
|
||
"<parameter=workdir>home</parameter></function> running it now"
|
||
)
|
||
call = _only(text)
|
||
assert call == {
|
||
"name": "terminal",
|
||
"arguments": {"command": "ls -la", "workdir": "home"},
|
||
}
|
||
|
||
def test_code_value_containing_literal_close_tag_is_preserved(self):
|
||
# The real closing </function> is the last one; the literal inside
|
||
# the code argument must survive (rfind, not the first match).
|
||
text = (
|
||
"<function=python><parameter=code>"
|
||
'print("</function>")'
|
||
"</parameter></function> all done"
|
||
)
|
||
call = _only(text)
|
||
assert call == {"name": "python", "arguments": {"code": 'print("</function>")'}}
|
||
|
||
def test_closed_function_with_trailing_prose_heal_path(self):
|
||
# Regression: the heal path (allow_incomplete=True) must match the strict path --
|
||
# keep a clean argument and leave trailing prose outside the call span.
|
||
text = "<function=web_search><parameter=query>cats</parameter></function> trailing words"
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = True)
|
||
assert len(calls) == 1
|
||
fn = calls[0]["function"]
|
||
assert fn["name"] == "web_search"
|
||
assert json.loads(fn["arguments"]) == {"query": "cats"}
|
||
# The trailing prose sits outside the removed span, so it stays visible.
|
||
from core.tool_healing import (
|
||
parse_tool_calls_from_text as _parse_with_spans,
|
||
)
|
||
|
||
_calls, spans = _parse_with_spans(text, allow_incomplete = True, with_spans = True)
|
||
out = text
|
||
for s, e in sorted(spans, reverse = True):
|
||
out = out[:s] + out[e:]
|
||
assert out == " trailing words"
|
||
|
||
def test_incomplete_function_without_close_is_still_rejected(self):
|
||
text = "<function=web_search><parameter=query>weather london"
|
||
assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
|
||
|
||
def test_param_without_close_tag_is_rejected_in_strict_mode(self):
|
||
# Closing </function> present, but the single parameter never closes.
|
||
text = "<function=web_search><parameter=query>weather london</function>"
|
||
assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
|
||
|
||
def test_attribute_form_literal_close_tag_is_preserved(self):
|
||
# The attribute form <function name="..."> (MiniCPM-5 / MiniMax-M2) also ends at the
|
||
# LAST </function>, so a literal close tag inside a code argument survives.
|
||
text = (
|
||
'<function name="python"><param name="code">'
|
||
'print("</function>")'
|
||
"</param></function> all done"
|
||
)
|
||
call = _only(text)
|
||
assert call == {"name": "python", "arguments": {"code": 'print("</function>")'}}
|
||
|
||
def test_closed_zero_param_attribute_call_is_accepted_in_strict_mode(self):
|
||
# A closed call with no parameters is a valid zero-argument call; strict
|
||
# mode must not treat the empty parameter list as a truncated call.
|
||
assert _only('<function name="ping"></function>') == {"name": "ping", "arguments": {}}
|
||
# A no-arg call that never closes is still rejected as truncated.
|
||
assert parse_tool_calls_from_text('<function name="ping">', allow_incomplete = False) == []
|
||
|
||
|
||
class TestParityWithJsonStyle:
|
||
def test_json_tool_call_with_trailing_prose_is_accepted(self):
|
||
text = (
|
||
'<tool_call>{"name":"web_search","arguments":{"query":"weather london"}}</tool_call>'
|
||
" Let me check that for you."
|
||
)
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = False)
|
||
assert len(calls) == 1
|
||
assert calls[0]["function"]["name"] == "web_search"
|
||
|
||
def test_function_and_json_styles_agree_on_trailing_text(self):
|
||
q = "weather london"
|
||
func = parse_tool_calls_from_text(
|
||
f"<function=web_search><parameter=query>{q}</parameter></function> trailing",
|
||
allow_incomplete = False,
|
||
)
|
||
js = parse_tool_calls_from_text(
|
||
f'<tool_call>{{"name":"web_search","arguments":{{"query":"{q}"}}}}</tool_call> trailing',
|
||
allow_incomplete = False,
|
||
)
|
||
assert len(func) == len(js) == 1
|
||
assert json.loads(func[0]["function"]["arguments"]) == {"query": q}
|
||
assert json.loads(js[0]["function"]["arguments"]) == {"query": q}
|
||
|
||
|
||
class TestGemmaNativeStyle:
|
||
def test_closed_native_call_with_trailing_prose_is_accepted(self):
|
||
text = (
|
||
'<|tool_call>call:terminal{command:"ls -la",workdir:"."}<tool_call|>' " running it now"
|
||
)
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = False)
|
||
assert len(calls) == 1
|
||
assert calls[0]["function"]["name"] == "terminal"
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {
|
||
"command": "ls -la",
|
||
"workdir": ".",
|
||
}
|
||
|
||
def test_unclosed_native_call_requires_healing(self):
|
||
text = '<|tool_call>call:terminal{command:"ls"}'
|
||
assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = True)
|
||
assert len(calls) == 1
|
||
assert calls[0]["function"]["name"] == "terminal"
|
||
|
||
def test_hyphenated_native_argument_name_is_accepted(self):
|
||
text = '<|tool_call>call:mcp__srv__create-issue{issue-title:"Bug report"}<tool_call|>'
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = False)
|
||
assert len(calls) == 1
|
||
assert calls[0]["function"]["name"] == "mcp__srv__create-issue"
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {"issue-title": "Bug report"}
|
||
|
||
def test_native_template_quotes_preserve_windows_path(self):
|
||
text = r'<|tool_call>call:ls{path:<|"|>C:\Users\wasim\repo<|"|>}<tool_call|>'
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = False)
|
||
assert len(calls) == 1
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {"path": r"C:\Users\wasim\repo"}
|
||
|
||
def test_bare_unquoted_string_values_are_accepted(self):
|
||
# Gemma can emit enum/string args unquoted; bare JSON scalars stay typed.
|
||
text = (
|
||
"<|tool_call>call:get_weather{location:Tokyo,unit:celsius,days:3,live:true}<tool_call|>"
|
||
)
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = False)
|
||
assert len(calls) == 1
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {
|
||
"location": "Tokyo",
|
||
"unit": "celsius",
|
||
"days": 3,
|
||
"live": True,
|
||
}
|
||
|
||
|
||
class TestLlama3PythonTagStrict:
|
||
def test_closed_dot_call_is_accepted(self):
|
||
text = '<|python_tag|>get_weather.call(location="Tokyo")'
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = False)
|
||
assert len(calls) == 1
|
||
assert calls[0]["function"]["name"] == "get_weather"
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {"location": "Tokyo"}
|
||
|
||
def test_truncated_dot_call_is_rejected(self):
|
||
# No closing paren (depth > 0 at EOF): truncated, reject in strict mode.
|
||
text = '<|python_tag|>get_weather.call(location="Tokyo"'
|
||
assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
|
||
# Auto-Heal still recovers it.
|
||
assert len(parse_tool_calls_from_text(text, allow_incomplete = True)) == 1
|
||
|
||
|
||
class TestMistralArrayStrict:
|
||
def test_closed_array_is_accepted(self):
|
||
text = '[TOOL_CALLS] [{"name":"web_search","arguments":{"q":"x"}}]'
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = False)
|
||
assert len(calls) == 1
|
||
assert calls[0]["function"]["name"] == "web_search"
|
||
|
||
def test_unclosed_array_is_rejected(self):
|
||
# Missing the closing ]; strict mode must not heal it.
|
||
text = '[TOOL_CALLS] [{"name":"web_search","arguments":{"q":"x"}}'
|
||
assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
|
||
# Auto-Heal still recovers the object by hand.
|
||
assert len(parse_tool_calls_from_text(text, allow_incomplete = True)) == 1
|
||
|
||
|
||
class TestHealingPathUnaffected:
|
||
def test_auto_heal_still_repairs_unclosed_function(self):
|
||
text = "<function=web_search><parameter=query>cats"
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = True)
|
||
assert len(calls) == 1
|
||
assert calls[0]["function"]["name"] == "web_search"
|
||
|
||
def test_closed_function_call_keeps_trailing_prose_out_of_arguments(self):
|
||
# A call that DID close must parse identically to strict mode, leaving prose after
|
||
# </function> out of the last parameter and the removal span.
|
||
from core.tool_healing import parse_tool_calls_from_text as parse_with_spans
|
||
|
||
text = "<function=web_search><parameter=query>cats</parameter></function> trailing"
|
||
calls, spans = parse_with_spans(text, allow_incomplete = True, with_spans = True)
|
||
(call,) = calls
|
||
assert json.loads(call["function"]["arguments"]) == {"query": "cats"}
|
||
(span,) = spans
|
||
assert text[span[0] : span[1]] == (
|
||
"<function=web_search><parameter=query>cats</parameter></function>"
|
||
)
|
||
|
||
def test_wrapperless_fallback_calls_carry_spans(self):
|
||
# The wrapperless function-XML fallback must report spans too, so with_spans
|
||
# consumers strip exactly the promoted markup (through </function> when closed).
|
||
from core.tool_healing import parse_tool_calls_from_text as parse_with_spans
|
||
|
||
closed = "before <function=web_search><parameter=query>cats</parameter></function> after"
|
||
calls, spans = parse_with_spans(closed, allow_incomplete = True, with_spans = True)
|
||
(call,) = calls
|
||
assert json.loads(call["function"]["arguments"]) == {"query": "cats"}
|
||
(span,) = spans
|
||
assert closed[span[0] : span[1]] == (
|
||
"<function=web_search><parameter=query>cats</parameter></function>"
|
||
)
|
||
|
||
healed = "x <function=web_search><parameter=query>dogs"
|
||
calls, spans = parse_with_spans(healed, allow_incomplete = True, with_spans = True)
|
||
(call,) = calls
|
||
assert json.loads(call["function"]["arguments"]) == {"query": "dogs"}
|
||
(span,) = spans
|
||
assert healed[span[0] : span[1]] == "<function=web_search><parameter=query>dogs"
|
||
|
||
|
||
class TestEnabledToolNameGate:
|
||
"""``enabled_tool_names`` disambiguates the ambiguous bare-rehearsal
|
||
``NAME[ARGS]{json}`` form (#5704): NAME is a call only when it is an active tool,
|
||
otherwise it is prose. ``None`` (the default) keeps the legacy unrestricted parse
|
||
so existing callers are unaffected."""
|
||
|
||
def _names(self, calls):
|
||
return [c["function"]["name"] for c in calls]
|
||
|
||
def test_inactive_rehearsal_before_active_call_does_not_swallow_it(self):
|
||
# P1: an inactive ``foo[ARGS]{...}`` before a real call must not consume the real call.
|
||
text = 'foo[ARGS]{"a":1} web_search[ARGS]{"query":"cats"}'
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert self._names(calls) == ["web_search"]
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {"query": "cats"}
|
||
|
||
def test_inactive_rehearsal_alone_is_not_a_call(self):
|
||
text = 'foo[ARGS]{"a":1}'
|
||
assert parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"}) == []
|
||
|
||
def test_active_rehearsal_is_still_parsed(self):
|
||
text = 'web_search[ARGS]{"query":"cats"}'
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert self._names(calls) == ["web_search"]
|
||
|
||
def test_unrestricted_gate_none_preserves_legacy_behavior(self):
|
||
# Without a gate every ``NAME[ARGS]{...}`` is parsed, as before the gate landed.
|
||
text = 'foo[ARGS]{"a":1} web_search[ARGS]{"query":"cats"}'
|
||
assert self._names(parse_tool_calls_from_text(text)) == ["foo", "web_search"]
|
||
assert self._names(parse_tool_calls_from_text(text, enabled_tool_names = None)) == [
|
||
"foo",
|
||
"web_search",
|
||
]
|
||
|
||
|
||
class TestBracketCallSpans:
|
||
"""with_spans tiling for Mistral bracket calls: promoted markup strips
|
||
exactly once, filtered calls' bytes stay visible, closers strip too."""
|
||
|
||
def test_mixed_array_filtered_first_keeps_its_bytes_only(self):
|
||
from core.inference.passthrough_healing import heal_openai_message_events
|
||
|
||
tools = [{"type": "function", "function": {"name": "lookup", "parameters": {}}}]
|
||
content = (
|
||
'[TOOL_CALLS][{"name":"bad","arguments":{"x":1}},'
|
||
'{"name":"lookup","arguments":{"q":"cats"}}]'
|
||
)
|
||
events = heal_openai_message_events(
|
||
{"role": "assistant", "content": content}, {"lookup"}, tools
|
||
)
|
||
kinds = [k for k, _v in events]
|
||
assert kinds == ["text", "tool_call"]
|
||
text = events[0][1]
|
||
assert '"bad"' in text
|
||
# The promoted call's markup must not survive in the text event.
|
||
assert '"lookup"' not in text
|
||
|
||
def test_mixed_array_filtered_second_stays_visible(self):
|
||
from core.inference.passthrough_healing import heal_openai_message_events
|
||
|
||
tools = [{"type": "function", "function": {"name": "lookup", "parameters": {}}}]
|
||
content = (
|
||
'[TOOL_CALLS][{"name":"lookup","arguments":{"q":"cats"}},'
|
||
'{"name":"bad","arguments":{"x":1}}]'
|
||
)
|
||
events = heal_openai_message_events(
|
||
{"role": "assistant", "content": content}, {"lookup"}, tools
|
||
)
|
||
assert events[0][0] == "tool_call"
|
||
trailing = "".join(v for k, v in events if k == "text")
|
||
assert '"bad"' in trailing
|
||
|
||
def test_v11_closer_inside_span(self):
|
||
from core.tool_healing import parse_tool_calls_from_text as parse_with_spans
|
||
|
||
text = '[TOOL_CALLS]web_search[ARGS]{"query":"cats"}[/TOOL_CALLS] after'
|
||
calls, spans = parse_with_spans(text, allow_incomplete = True, with_spans = True)
|
||
(call,) = calls
|
||
assert call["function"]["name"] == "web_search"
|
||
(span,) = spans
|
||
assert text[span[0] : span[1]].endswith("[/TOOL_CALLS]")
|
||
assert text[span[1] :] == " after"
|
||
|
||
def test_fully_promoted_array_strips_whole_region(self):
|
||
from core.inference.passthrough_healing import heal_openai_message_events
|
||
|
||
tools = [{"type": "function", "function": {"name": "lookup", "parameters": {}}}]
|
||
content = (
|
||
'[TOOL_CALLS][{"name":"lookup","arguments":{"q":"a"}},'
|
||
'{"name":"lookup","arguments":{"q":"b"}}] after'
|
||
)
|
||
events = heal_openai_message_events(
|
||
{"role": "assistant", "content": content}, {"lookup"}, tools
|
||
)
|
||
assert [k for k, _v in events] == ["tool_call", "tool_call", "text"]
|
||
assert events[2][1] == " after"
|
||
|
||
|
||
class TestMistralArrayHealing:
|
||
"""Draining the whole [TOOL_CALLS] array for the shapes the repo's own
|
||
Mistral/Ollama templates emit."""
|
||
|
||
def test_comma_less_multi_call_array_parses_all_calls(self):
|
||
# ollama_template_mappers.py renders multi-call turns as [{...}{...}] with no
|
||
# comma separator; a single json.loads of the body rejects it and dropped every
|
||
# call. The element-by-element decode must recover all of them.
|
||
text = '[TOOL_CALLS] [{"name":"a","arguments":{"x":1}}{"name":"b","arguments":{"y":2}}]'
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["a", "b"]
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {"x": 1}
|
||
assert json.loads(calls[1]["function"]["arguments"]) == {"y": 2}
|
||
|
||
def test_comma_separated_and_single_arrays_still_parse(self):
|
||
both = parse_tool_calls_from_text(
|
||
'[TOOL_CALLS] [{"name":"a","arguments":{}},{"name":"b","arguments":{}}]'
|
||
)
|
||
assert [c["function"]["name"] for c in both] == ["a", "b"]
|
||
one = parse_tool_calls_from_text('[TOOL_CALLS] [{"name":"a","arguments":{}}]')
|
||
assert [c["function"]["name"] for c in one] == ["a"]
|
||
|
||
def test_mistral_array_null_arguments_normalized_to_empty_object(self):
|
||
# ``"arguments": null`` is a no-arg call; it must become {} (as the <tool_call>
|
||
# path does), not the string "null" that auto-heal turns into {"query":"null"}.
|
||
calls = parse_tool_calls_from_text('[TOOL_CALLS][{"name":"get_time","arguments":null}]')
|
||
assert calls[0]["function"]["arguments"] == "{}"
|
||
|
||
|
||
class TestGlmStrict:
|
||
def test_closed_glm_call_is_accepted(self):
|
||
text = (
|
||
"<tool_call>get_weather\n"
|
||
"<arg_key>city</arg_key>\n<arg_value>Paris</arg_value>\n"
|
||
"</tool_call>"
|
||
)
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = False)
|
||
assert len(calls) == 1
|
||
assert calls[0]["function"]["name"] == "get_weather"
|
||
|
||
def test_unclosed_glm_call_is_rejected(self):
|
||
# No </tool_call> close: truncated, reject with Auto-Heal off.
|
||
text = "<tool_call>get_weather\n<arg_key>city</arg_key>\n<arg_value>Paris</arg_value>"
|
||
assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
|
||
assert len(parse_tool_calls_from_text(text, allow_incomplete = True)) == 1
|
||
|
||
|
||
class TestKimiStrict:
|
||
_SB = "<|tool_calls_section_begin|>"
|
||
_KB = "<|tool_call_begin|>"
|
||
_AB = "<|tool_call_argument_begin|>"
|
||
_KE = "<|tool_call_end|>"
|
||
_SE = "<|tool_calls_section_end|>"
|
||
|
||
def test_full_kimi_call_is_accepted(self):
|
||
text = self._SB + self._KB + "functions.x:0" + self._AB + '{"a":1}' + self._KE + self._SE
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = False)
|
||
assert len(calls) == 1
|
||
assert calls[0]["function"]["name"] == "x"
|
||
|
||
def test_kimi_call_without_call_end_is_rejected(self):
|
||
# Section closed but the call lacks <|tool_call_end|>: reject in strict.
|
||
text = self._SB + self._KB + "functions.x:0" + self._AB + '{"a":1}' + self._SE
|
||
assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
|
||
assert len(parse_tool_calls_from_text(text, allow_incomplete = True)) == 1
|
||
|
||
def test_kimi_without_section_end_is_rejected(self):
|
||
# No <|tool_calls_section_end|>: truncated section, reject in strict.
|
||
text = self._SB + self._KB + "functions.x:0" + self._AB + '{"a":1}' + self._KE
|
||
assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
|
||
assert len(parse_tool_calls_from_text(text, allow_incomplete = True)) == 1
|
||
|
||
|
||
class TestParserLinearity:
|
||
"""Llama-3 ``.call`` kwargs and Mistral-array healing must stay linear (a regex-per-offset blew up on long truncated bodies)."""
|
||
|
||
def test_llama3_unterminated_call_arg_is_linear(self):
|
||
import time
|
||
|
||
text = '<|python_tag|>upload.call(data="' + "A" * 200_000 # no closing quote/paren
|
||
t0 = time.perf_counter()
|
||
parse_tool_calls_from_text(text, allow_incomplete = True)
|
||
assert time.perf_counter() - t0 < 2.0
|
||
|
||
def test_llama3_huge_wordrun_call_arg_is_linear(self):
|
||
import time
|
||
|
||
text = "<|python_tag|>upload.call(" + "a" * 200_000 # giant word run, no '='
|
||
t0 = time.perf_counter()
|
||
parse_tool_calls_from_text(text, allow_incomplete = True)
|
||
assert time.perf_counter() - t0 < 2.0
|
||
|
||
def test_mistral_unclosed_array_open_braces_is_linear(self):
|
||
import time
|
||
|
||
text = "[TOOL_CALLS] [" + "{" * 200_000 # unclosed array, all open braces
|
||
t0 = time.perf_counter()
|
||
parse_tool_calls_from_text(text, allow_incomplete = True)
|
||
assert time.perf_counter() - t0 < 2.0
|
||
|
||
def test_gemma_wrapperless_deep_nesting_is_linear(self):
|
||
# Wrapper-less Gemma ``call:f{a:{a:{...}}}`` deep nesting must parse in linear time (no quadratic re-scan).
|
||
import time
|
||
|
||
def nested(d):
|
||
return "call:f{a:" + "{a:" * d + "x:1" + "}" * d + "}"
|
||
|
||
def best_ms(depth):
|
||
text = nested(depth)
|
||
best = float("inf")
|
||
for _ in range(5):
|
||
t0 = time.perf_counter()
|
||
calls = parse_tool_calls_from_text(text)
|
||
best = min(best, time.perf_counter() - t0)
|
||
assert calls and json.loads(calls[0]["function"]["arguments"]), "nested args dropped"
|
||
return best
|
||
|
||
t200 = best_ms(200)
|
||
t400 = best_ms(400)
|
||
assert t400 < t200 * 3.0, (t200, t400)
|
||
|
||
def test_llama3_call_kwargs_still_parse(self):
|
||
text = '<|python_tag|>do.call(s="hi 😀", n=42, f=1.5, b=true, z=null)'
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = True)
|
||
assert len(calls) == 1
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {
|
||
"s": "hi 😀",
|
||
"n": 42,
|
||
"f": 1.5,
|
||
"b": True,
|
||
"z": None,
|
||
}
|
||
|
||
def test_llama3_call_scientific_notation_args_parse(self):
|
||
# Scientific notation must decode as float (the old regex truncated 1e-3 -> 1).
|
||
text = "<|python_tag|>calc.call(x=1e-3, y=-2E+4, z=0.5e2, n=42)"
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = True)
|
||
assert len(calls) == 1
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args == {"x": 1e-3, "y": -2e4, "z": 50.0, "n": 42}
|
||
assert isinstance(args["n"], int) and isinstance(args["x"], float)
|
||
|
||
def test_mistral_unclosed_array_recovers_top_level_objects(self):
|
||
text = (
|
||
'[TOOL_CALLS] [{"name":"a","arguments":{"k":1}},'
|
||
'{"name":"b","arguments":{"j":2}}' # missing closing ]
|
||
)
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = True)
|
||
assert [c["function"]["name"] for c in calls] == ["a", "b"]
|
||
|
||
|
||
class TestLlamaBuiltinChainAndNesting:
|
||
"""Llama-3 ``.call`` built-ins: ``; `` chaining and nested-tag isolation."""
|
||
|
||
def test_semicolon_chained_builtin_calls_all_parse(self):
|
||
# Only the first call is anchored to <|python_tag|>; the rest chain via ';'.
|
||
text = "<|python_tag|>alpha.call(x=1); beta.call(y=2); gamma.call(z=3)"
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = True)
|
||
assert [c["function"]["name"] for c in calls] == ["alpha", "beta", "gamma"]
|
||
assert json.loads(calls[1]["function"]["arguments"]) == {"y": 2}
|
||
|
||
def test_nested_python_tag_in_json_string_arg_is_not_a_call(self):
|
||
# A code arg literally containing a <|python_tag|>...call(...) string: the real call is the
|
||
# outer "python", not the nested "os" -- the scan stays anchored to the first tag.
|
||
text = (
|
||
'<|python_tag|>{"name":"python","parameters":'
|
||
'{"code":"<|python_tag|>os.call(\'rm -rf /\')"}}'
|
||
)
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = True)
|
||
assert len(calls) == 1
|
||
assert calls[0]["function"]["name"] == "python"
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args["code"] == "<|python_tag|>os.call('rm -rf /')"
|
||
|
||
def test_single_builtin_call_unchanged(self):
|
||
text = '<|python_tag|>web_search.call(query="cats")'
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = True)
|
||
assert len(calls) == 1
|
||
assert calls[0]["function"]["name"] == "web_search"
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {"query": "cats"}
|
||
|
||
|
||
def test_glm_open_does_not_parse_spaced_prose_as_tool_name():
|
||
# The GLM <tool_call>NAME opener must reject spaced literal prose (V10); only a
|
||
# valid [\w.\-]+ name (followed by newline/<arg_key>/</tool_call>) is a call.
|
||
assert parse_tool_calls_from_text("<tool_call>not a call</tool_call>") == []
|
||
ok = parse_tool_calls_from_text(
|
||
"<tool_call>get_weather\n<arg_key>city</arg_key>\n<arg_value>NYC</arg_value>\n</tool_call>"
|
||
)
|
||
assert [c["function"]["name"] for c in ok] == ["get_weather"]
|
||
|
||
|
||
def test_deepseek_r1_missing_call_terminator_rejected_in_strict_mode():
|
||
# R1 must reject a fenced call whose closing ``` + <｜tool▁call▁end｜> never
|
||
# arrived when Auto-Heal is off, matching V3/V3.1 strictness (V6).
|
||
text = (
|
||
"<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>function<｜tool▁sep｜>get_weather\n"
|
||
"```json\n"
|
||
'{"city":"NYC"}'
|
||
"<｜tool▁calls▁end｜>"
|
||
)
|
||
assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
|
||
assert len(parse_tool_calls_from_text(text, allow_incomplete = True)) == 1
|
||
|
||
|
||
def test_deepseek_r1_complete_call_accepted_in_strict_mode():
|
||
# A fully-terminated R1 call (close fence + per-call end) is still accepted.
|
||
text = (
|
||
"<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>function<｜tool▁sep｜>get_weather\n"
|
||
"```json\n"
|
||
'{"city":"NYC"}\n'
|
||
"```<｜tool▁call▁end｜><｜tool▁calls▁end｜>"
|
||
)
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = False)
|
||
assert len(calls) == 1 and calls[0]["function"]["name"] == "get_weather"
|
||
|
||
|
||
def test_strip_leading_bare_json_call_drops_complete_call():
|
||
from core.inference.tool_call_parser import strip_leading_bare_json_call
|
||
|
||
# A complete Llama-3.2 bare-JSON call is removed; trailing prose is kept.
|
||
assert strip_leading_bare_json_call('{"name":"web_search","parameters":{"query":"cats"}}') == ""
|
||
assert (
|
||
strip_leading_bare_json_call('{"name":"python","parameters":{"code":"x"}} done') == "done"
|
||
)
|
||
|
||
|
||
def test_strip_leading_bare_json_call_drops_truncated_call():
|
||
from core.inference.tool_call_parser import strip_leading_bare_json_call
|
||
|
||
# A truncated call (no closing brace) collapses to "" -- nothing recoverable.
|
||
assert (
|
||
strip_leading_bare_json_call('{"name":"web_search","parameters":{"query":"weather in S')
|
||
== ""
|
||
)
|
||
|
||
|
||
def test_strip_leading_bare_json_call_preserves_plain_json_and_prose():
|
||
from core.inference.tool_call_parser import strip_leading_bare_json_call
|
||
|
||
# No "name" key -> plain JSON answer, left untouched.
|
||
assert (
|
||
strip_leading_bare_json_call('{"result": 42, "ok": true}') == '{"result": 42, "ok": true}'
|
||
)
|
||
# Prose before the brace -> not a leading bare call, untouched.
|
||
assert strip_leading_bare_json_call('here is {"name":"x"}') == 'here is {"name":"x"}'
|
||
# Ordinary text untouched.
|
||
assert strip_leading_bare_json_call("just a sentence.") == "just a sentence."
|
||
|
||
|
||
def test_glm_literal_close_tag_in_string_arg_not_truncated():
|
||
import json
|
||
|
||
from core.inference.tool_call_parser import parse_tool_calls_from_text
|
||
|
||
# A GLM string argument may legitimately contain the literal close tag ``</tool_call>``.
|
||
text = (
|
||
"<tool_call>run_code\n"
|
||
"<arg_key>code</arg_key>\n"
|
||
'<arg_value>print("</tool_call>")</arg_value>\n'
|
||
"</tool_call>"
|
||
)
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = True)
|
||
assert len(calls) == 1
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args["code"] == 'print("</tool_call>")', args
|
||
|
||
|
||
def test_glm_truncated_block_rejected_in_strict_mode_but_healed_otherwise():
|
||
from core.inference.tool_call_parser import parse_tool_calls_from_text
|
||
|
||
# No </tool_call> close: strict mode (Auto-Heal off) rejects the truncated
|
||
# block; with Auto-Heal it keeps the partial call.
|
||
text = "<tool_call>get_weather\n<arg_key>city</arg_key>\n<arg_value>NYC"
|
||
assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
|
||
healed = parse_tool_calls_from_text(text, allow_incomplete = True)
|
||
assert len(healed) == 1 and healed[0]["function"]["name"] == "get_weather"
|
||
|
||
|
||
def test_truncated_wrapperless_gemma_call_is_stripped():
|
||
from core.inference.tool_call_parser import strip_tool_markup
|
||
|
||
# A wrapper-less Gemma ``call:NAME{...`` cut off mid-arguments (no closing
|
||
# brace) must not leak the raw call into the visible stream.
|
||
text = 'Sure!\ncall:web_search{"query": "weather in San Fr'
|
||
stripped = strip_tool_markup(text, final = True)
|
||
assert "call:web_search" not in stripped, repr(stripped)
|
||
assert stripped.strip() == "Sure!"
|
||
|
||
|
||
def test_complete_wrapperless_gemma_call_keeps_trailing_prose():
|
||
from core.inference.tool_call_parser import strip_tool_markup
|
||
|
||
# The truncation pattern must run AFTER the closed form, so a complete call
|
||
# followed by prose keeps the prose instead of eating to EOS.
|
||
text = 'call:web_search{"query": "cats"} Here you go.'
|
||
stripped = strip_tool_markup(text, final = True)
|
||
assert "call:web_search" not in stripped
|
||
assert stripped.strip() == "Here you go."
|
||
|
||
|
||
def test_bare_json_gated_on_enabled_tool_names():
|
||
from core.inference.tool_call_parser import parse_tool_calls_from_text
|
||
|
||
alice = '{"name":"Alice","parameters":{"age":30}}'
|
||
real = '{"name":"web_search","parameters":{"query":"cats"}}'
|
||
# With an enabled set, markerless JSON whose name is not a tool is NOT a call.
|
||
assert parse_tool_calls_from_text(alice, enabled_tool_names = {"web_search"}) == []
|
||
# A real call (enabled name) still parses.
|
||
got = parse_tool_calls_from_text(real, enabled_tool_names = {"web_search"})
|
||
assert [c["function"]["name"] for c in got] == ["web_search"]
|
||
# No enabled set (None) keeps the name-agnostic behaviour for direct callers.
|
||
assert [c["function"]["name"] for c in parse_tool_calls_from_text(alice)] == ["Alice"]
|
||
# Marker-based forms are NOT gated (an explicit signal is a real call attempt).
|
||
xml = '<tool_call>{"name":"Alice","arguments":{}}</tool_call>'
|
||
assert parse_tool_calls_from_text(xml, enabled_tool_names = {"web_search"})
|
||
|
||
|
||
def test_strip_leading_bare_json_call_gated_on_enabled_tool_names():
|
||
from core.inference.tool_call_parser import strip_leading_bare_json_call
|
||
|
||
alice = '{"name":"Alice","parameters":{"age":30}}'
|
||
# Not an enabled tool -> ordinary JSON answer, kept verbatim.
|
||
assert strip_leading_bare_json_call(alice, {"web_search"}) == alice
|
||
# Enabled tool -> a real call, stripped (trailing prose kept).
|
||
assert (
|
||
strip_leading_bare_json_call(
|
||
'{"name":"web_search","parameters":{"q":1}} hi', {"web_search"}
|
||
)
|
||
== "hi"
|
||
)
|
||
|
||
|
||
def test_function_xml_strip_keeps_literal_close_tag_in_param_value():
|
||
from core.inference.tool_call_parser import strip_tool_markup
|
||
|
||
# The strip uses the LAST </function> (like the parser) so a literal </function> in a value doesn't
|
||
# truncate it; separate calls still strip independently.
|
||
text = '<function=python><parameter=code>print("</function>")</parameter></function> done'
|
||
assert strip_tool_markup(text, final = True) == "done"
|
||
two = (
|
||
"a <function=f><parameter=x>1</parameter></function> mid "
|
||
"<function=g><parameter=y>2</parameter></function> end"
|
||
)
|
||
assert strip_tool_markup(two, final = True) == "a mid end"
|
||
|
||
|
||
def test_function_xml_strip_keeps_trailing_text_after_literal_open_tag():
|
||
from core.inference.tool_call_parser import parse_tool_calls_from_text, strip_tool_markup
|
||
|
||
# A literal ``<function=x>`` opener inside a parameter value is data, not a call: the scan-based
|
||
# strip keeps " done" (the old negative-lookahead regex ate the trailing prose).
|
||
text = '<function=python><parameter=code>print("<function=x>")</parameter></function> done'
|
||
assert parse_tool_calls_from_text(text)[0]["function"]["name"] == "python"
|
||
assert strip_tool_markup(text, final = True) == "done"
|
||
# Non-final (streaming) keeps an unclosed call buffered, does not eat prose early.
|
||
open_text = 'pre <function=python><parameter=code>print("<function=x>")'
|
||
assert strip_tool_markup(open_text, final = False) == open_text
|
||
|
||
|
||
def test_final_strip_removes_magistral_think_reasoning():
|
||
from core.inference.tool_call_parser import strip_tool_markup
|
||
|
||
# Magistral emits reasoning as ``[THINK]...[/THINK]`` (bracket form, not ``<think>``);
|
||
# at end-of-turn it must be dropped so it doesn't leak into display / history.
|
||
text = "[THINK]The user greeted me, I should say hi.[/THINK]Hello! How can I help?"
|
||
assert strip_tool_markup(text, final = True) == "Hello! How can I help?"
|
||
# A ``[TOOL_CALLS]`` living inside the reasoning goes with it.
|
||
with_call = '[THINK]Maybe I should search.[/THINK][TOOL_CALLS]search{"q":"x"}'
|
||
assert strip_tool_markup(with_call, final = True) == ""
|
||
|
||
|
||
def test_streaming_strip_keeps_magistral_think_buffered():
|
||
from core.inference.tool_call_parser import strip_tool_markup
|
||
|
||
# Mid-stream (final=False) the reasoning block is left intact; only the
|
||
# end-of-turn pass removes it.
|
||
text = "[THINK]still thinking"
|
||
assert strip_tool_markup(text, final = False) == text
|
||
|
||
|
||
def test_final_strip_leaves_non_magistral_bracket_text_untouched():
|
||
from core.inference.tool_call_parser import strip_tool_markup
|
||
|
||
# Only a LEADING ``[THINK]`` block is reasoning; unrelated bracketed prose stays.
|
||
text = "See [THINK about it] later"
|
||
assert strip_tool_markup(text, final = True) == "See [THINK about it] later"
|
||
|
||
|
||
def test_strip_leading_bare_json_call_ignores_nested_name():
|
||
from core.inference.tool_call_parser import strip_leading_bare_json_call
|
||
|
||
# A nested ``"name"`` must NOT gate the strip (only a TOP-LEVEL enabled name is a call); the
|
||
# ordinary JSON answer is kept verbatim, truncated or complete.
|
||
nested_trunc = '{"result":{"name":"web_search","age":'
|
||
nested_full = '{"result":{"name":"web_search","age":1}}'
|
||
assert strip_leading_bare_json_call(nested_trunc, {"web_search"}) == nested_trunc
|
||
assert strip_leading_bare_json_call(nested_full, {"web_search"}) == nested_full
|
||
# A real top-level call (even with a top-level array before the name) still strips.
|
||
assert (
|
||
strip_leading_bare_json_call(
|
||
'{"data":[1,2],"name":"web_search","parameters":{}}', {"web_search"}
|
||
)
|
||
== ""
|
||
)
|
||
|
||
|
||
def test_mistral_single_object_call_is_stripped_for_display():
|
||
from core.inference.tool_call_parser import (
|
||
_strip_mistral_closed_calls,
|
||
parse_tool_calls_from_text,
|
||
)
|
||
|
||
# The parser accepts the single-object [TOOL_CALLS]{...} shape, so the display
|
||
# strip must remove it too (asymmetry would leak the raw object).
|
||
text = '[TOOL_CALLS]{"name":"web_search","arguments":{"filters":{"date":"2024"}}} tail'
|
||
assert [c["function"]["name"] for c in parse_tool_calls_from_text(text)] == ["web_search"]
|
||
assert _strip_mistral_closed_calls(text) == " tail"
|
||
# A literal [TOOL_CALLS] in prose (no following object) is left untouched.
|
||
assert _strip_mistral_closed_calls("See the [TOOL_CALLS] docs") == "See the [TOOL_CALLS] docs"
|
||
|
||
|
||
def test_tool_call_parser_declares_future_annotations_for_py39_import():
|
||
# F1: the parser is imported standalone on python >=3.9, where its PEP 604 ``X | None``
|
||
# annotations need ``from __future__ import annotations``; guard that the import stays.
|
||
from pathlib import Path
|
||
src = (
|
||
Path(__file__).resolve().parent.parent / "core" / "inference" / "tool_call_parser.py"
|
||
).read_text()
|
||
assert "from __future__ import annotations" in src
|
||
|
||
|
||
def test_glm_strip_treats_literal_close_tag_in_arg_value_as_data():
|
||
# Core strip parity: a literal </tool_call> inside a GLM <arg_value> is argument data, so the whole call is stripped (no leaked tail).
|
||
from core.inference.tool_call_parser import strip_tool_markup
|
||
|
||
text = (
|
||
"<tool_call>web_search\n<arg_key>query</arg_key>\n"
|
||
"<arg_value>see </tool_call> tag</arg_value>\n</tool_call> tail"
|
||
)
|
||
assert strip_tool_markup(text, final = True) == "tail"
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {"query": "see </tool_call> tag"}
|
||
|
||
|
||
def test_bare_json_function_alias_parses_and_strips_symmetrically():
|
||
# The bare-JSON parser accepts the "function" alias for the call name;
|
||
# strip_leading_bare_json_call must recognise it too (parser/strip symmetry).
|
||
from core.inference.tool_call_parser import (
|
||
parse_tool_calls_from_text,
|
||
strip_leading_bare_json_call,
|
||
_top_level_bare_json_name,
|
||
)
|
||
|
||
enabled = {"web_search"}
|
||
text = '{"function":"web_search","parameters":{"query":"cats"}}'
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = enabled)
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
assert strip_leading_bare_json_call(text, enabled) == ""
|
||
|
||
# "name" still takes precedence when both are present; nested aliases are data.
|
||
assert _top_level_bare_json_name('{"function":"foo","name":"web_search"}') == "web_search"
|
||
assert _top_level_bare_json_name('{"function":"web_search"}') == "web_search"
|
||
assert _top_level_bare_json_name('{"result":{"function":"web_search"}}') is None
|
||
# A non-enabled function-alias object is ordinary content and is preserved.
|
||
assert (
|
||
strip_leading_bare_json_call('{"function":"not_a_tool","parameters":{}}', enabled)
|
||
== '{"function":"not_a_tool","parameters":{}}'
|
||
)
|
||
|
||
|
||
class TestMistralOuterOverXmlLiteral:
|
||
"""Quoted tool XML inside a [TOOL_CALLS] call's arguments is data; the outer call executes. Reverse order keeps the XML."""
|
||
|
||
def test_mistral_v11_arg_quoting_function_xml(self):
|
||
text = (
|
||
'[TOOL_CALLS]web_search[ARGS]{"query":"literal '
|
||
'<function=evil><parameter=x>1</parameter></function>"}'
|
||
)
|
||
for strict in (True, False):
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = not strict)
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
assert "<function=evil>" in json.loads(calls[0]["function"]["arguments"])["query"]
|
||
|
||
def test_mistral_array_arg_quoting_tool_call_json(self):
|
||
text = (
|
||
'[TOOL_CALLS][{"name":"web_search","arguments":{"query":'
|
||
'"see <tool_call>{\\"name\\":\\"evil\\"}</tool_call>"}}]'
|
||
)
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
def test_xml_outer_keeps_winning_over_mistral_literal(self):
|
||
text = (
|
||
'<tool_call>{"name":"web_search","arguments":'
|
||
'{"query":"docs say [TOOL_CALLS]evil[ARGS]{}"}}</tool_call>'
|
||
)
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
|
||
class TestHealerSignalAlignment:
|
||
"""The healer buffers only formats its shared parser can promote. Mistral's
|
||
``[TOOL_CALLS]`` is promotable (rescued), so it is a heal signal; the loop-only
|
||
text-call markers (Llama ``<|python_tag|>``, bare ``[ARGS]``) are not, so they
|
||
stream through instead of stalling as prose that never yields a call."""
|
||
|
||
def test_heal_signals_subset_of_promotable_formats(self):
|
||
from core.inference.passthrough_healing import _HEAL_SIGNALS
|
||
assert set(_HEAL_SIGNALS) == {"<tool_call>", "<|tool_call>", "<function=", "[TOOL_CALLS]"}
|
||
|
||
def test_stream_healer_does_not_hold_llama_python_tag_text(self):
|
||
from core.inference.passthrough_healing import StreamToolCallHealer
|
||
|
||
healer = StreamToolCallHealer(
|
||
{"web_search"},
|
||
[{"type": "function", "function": {"name": "web_search", "parameters": {}}}],
|
||
)
|
||
# Llama <|python_tag|> is not a healer-promotable format, so it streams through as text.
|
||
events = list(healer.feed('<|python_tag|>web_search.call(query="cats")'))
|
||
text_out = "".join(v for k, v in events if k == "text")
|
||
assert "<|python_tag|>" in text_out # streamed through, not buffered
|
||
assert not list(healer.finalize()) or all(k == "text" for k, _v in healer.finalize())
|
||
|
||
|
||
class TestGemmaWrapperlessLiteralMarkers:
|
||
"""Wrapper-less Gemma calls whose ARGUMENTS mention Gemma's own markup.
|
||
|
||
The tool_healing deferral must key on an actual wrapped opener
|
||
(``<|tool_call>call:...``), not the wrapper literal anywhere in content:
|
||
a query about the marker has nothing tool_healing can parse, and deferring
|
||
it loses the call entirely (not executed AND stripped from display)."""
|
||
|
||
def test_marker_literal_in_argument_still_parses(self):
|
||
text = 'call:web_search{query:"what does <|tool_call> mean"}'
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert len(calls) == 1
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args["query"] == "what does <|tool_call> mean"
|
||
|
||
def test_real_wrapped_call_still_deferred_to_tool_healing(self):
|
||
from core.inference.tool_call_parser import _parse_gemma_tool_calls
|
||
|
||
# An actual wrapped opener present: the Gemma fallback must keep
|
||
# deferring to the shared tool_healing parser that owns that form.
|
||
text = '<|tool_call>call:web_search{query:<|"|>cats<|"|>}<tool_call|>'
|
||
assert _parse_gemma_tool_calls(text, id_offset = 0) == []
|
||
|
||
def test_single_quoted_brace_does_not_truncate_code(self):
|
||
text = "call:python{code:print('}')}"
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"python"})
|
||
assert len(calls) == 1
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args["code"] == "print('}')"
|
||
|
||
def test_single_quoted_brace_strip_span_covers_whole_call(self):
|
||
from core.inference.tool_call_parser import strip_tool_markup
|
||
|
||
text = "call:python{code:print('}')} Done."
|
||
stripped = strip_tool_markup(text, final = True, enabled_tool_names = {"python"})
|
||
assert "call:python" not in stripped
|
||
assert "')}" not in stripped
|
||
assert stripped.strip() == "Done."
|
||
|
||
|
||
class TestGlmEmbeddedClosePair:
|
||
"""A GLM value whose string literal embeds the full close-tag pair
|
||
``</arg_value></tool_call>`` (code documenting the GLM format) must not be
|
||
truncated at the embedded pair: a structural close sits at balanced quote
|
||
state, an embedded one is inside an open string literal."""
|
||
|
||
def test_embedded_pair_inside_quoted_value_not_structural(self):
|
||
text = (
|
||
"<tool_call>python\n"
|
||
"<arg_key>code</arg_key>\n"
|
||
'<arg_value>print("</arg_value></tool_call>")\nx = 1</arg_value>\n'
|
||
"</tool_call>"
|
||
)
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = True)
|
||
assert len(calls) == 1
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args["code"] == 'print("</arg_value></tool_call>")\nx = 1'
|
||
|
||
def test_strip_covers_the_full_call(self):
|
||
from core.inference.tool_call_parser import strip_tool_markup
|
||
|
||
text = (
|
||
"<tool_call>python\n"
|
||
"<arg_key>code</arg_key>\n"
|
||
'<arg_value>print("</arg_value></tool_call>")\nx = 1</arg_value>\n'
|
||
"</tool_call> Done."
|
||
)
|
||
stripped = strip_tool_markup(text, final = True)
|
||
assert "arg_value" not in stripped
|
||
assert stripped.strip() == "Done."
|
||
|
||
def test_unbalanced_apostrophe_falls_back_to_first_candidate(self):
|
||
# Prose-like value with an apostrophe: no candidate reaches balanced
|
||
# quote state, so the first token-valid close wins (prior behavior).
|
||
text = (
|
||
"<tool_call>web_search\n"
|
||
"<arg_key>query</arg_key>\n"
|
||
"<arg_value>it's fine</arg_value>\n"
|
||
"</tool_call>"
|
||
)
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = True)
|
||
assert len(calls) == 1
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args["query"] == "it's fine"
|
||
|
||
|
||
class TestPythonTagLiteralInsideMistralArgs:
|
||
"""A python_tag LITERAL inside a leading Mistral call's arguments is data; the outer call executes."""
|
||
|
||
def test_mistral_arg_quoting_python_tag_call(self):
|
||
text = (
|
||
'[TOOL_CALLS] [{"name": "web_search", "arguments": '
|
||
'{"query": "what is <|python_tag|>evil.call(x=1)"}}]'
|
||
)
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args["query"] == "what is <|python_tag|>evil.call(x=1)"
|
||
|
||
|
||
class TestPythonTagOuterOverXmlLiteral:
|
||
"""A leading Llama-3 ``<|python_tag|>`` call owns the turn: tool XML/Mistral
|
||
markup quoted in a ``.call(...)`` string argument (or in trailing prose) is
|
||
data, so the outer call executes -- parity with the bare-JSON / Mistral /
|
||
attribute-form leading-ownership rules. XML before the tag keeps normal order."""
|
||
|
||
def test_call_arg_quoting_complete_function_xml(self):
|
||
# A closed <function=...> in a .call() code arg must not beat the leading python_tag call.
|
||
text = (
|
||
'<|python_tag|>python.call(code="<function=render_html>'
|
||
'<parameter=x>1</parameter></function>")'
|
||
)
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["python"]
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args["code"] == "<function=render_html><parameter=x>1</parameter></function>"
|
||
|
||
def test_call_arg_quoting_bare_function_tag_in_query(self):
|
||
# A query mentioning <function=...> must search, not execute a phantom tool.
|
||
text = '<|python_tag|>web_search.call(query="how do I use <function=foo> in llama")'
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args["query"] == "how do I use <function=foo> in llama"
|
||
|
||
def test_call_arg_quoting_tool_call_json(self):
|
||
text = (
|
||
"<|python_tag|>save_file.call(content="
|
||
'"<tool_call>{\\"name\\": \\"delete\\", \\"arguments\\": {}}</tool_call>")'
|
||
)
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["save_file"]
|
||
|
||
def test_json_form_code_arg_quoting_function_xml(self):
|
||
# JSON emission: a <function=...> in the code arg is data; the outer "python" call runs.
|
||
text = (
|
||
'<|python_tag|>{"name":"python","parameters":'
|
||
'{"code":"<function=terminal>ls</function>"}}'
|
||
)
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["python"]
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args["code"] == "<function=terminal>ls</function>"
|
||
|
||
def test_call_arg_quoting_mistral_trigger(self):
|
||
text = '<|python_tag|>web_search.call(query="see [TOOL_CALLS]evil[ARGS]{}")'
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
def test_leading_call_wins_over_trailing_xml(self):
|
||
# A leading python_tag call owns the turn even when a real XML literal follows.
|
||
text = (
|
||
'<|python_tag|>web_search.call(query="cats") '
|
||
"<function=evil><parameter=x>1</parameter></function>"
|
||
)
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
def test_xml_before_python_tag_keeps_xml_order(self):
|
||
# A foreign signal BEFORE the tag keeps normal document order (XML wins).
|
||
text = (
|
||
"<function=web_search><parameter=q>x</parameter></function> "
|
||
'<|python_tag|>python.call(code="y")'
|
||
)
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
|
||
class TestBareJsonOuterOverXmlLiteral:
|
||
"""Quoted tool XML inside a leading bare-JSON call is data; XML before the JSON keeps normal order."""
|
||
|
||
def test_bare_json_code_arg_quoting_function_xml(self):
|
||
text = (
|
||
'{"name": "python", "arguments": '
|
||
'{"code": "run() # <function=terminal>ls</function>"}}'
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"python"})
|
||
assert [c["function"]["name"] for c in calls] == ["python"]
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args["code"] == "run() # <function=terminal>ls</function>"
|
||
|
||
def test_bare_json_outer_unrestricted_mode(self):
|
||
text = '{"name": "python", "parameters": {"code": "<function=terminal>ls</function>"}}'
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["python"]
|
||
|
||
def test_xml_before_json_keeps_xml_order(self):
|
||
text = (
|
||
"<function=web_search><parameter=query>cats</parameter></function>"
|
||
' {"name": "python", "arguments": {"code": "x"}}'
|
||
)
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
|
||
class TestMagistralThinkRehearsal:
|
||
"""A call rehearsed inside [THINK]...[/THINK] is reasoning; the real call after wins, and parse agrees with strip."""
|
||
|
||
def test_function_xml_rehearsal_in_think_is_not_promoted(self):
|
||
text = (
|
||
'[THINK]I could emit <function=web_search>{"query":"x"}</function>'
|
||
' here[/THINK][TOOL_CALLS] [{"name":"terminal","arguments":{"cmd":"ls"}}]'
|
||
)
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["terminal"]
|
||
|
||
def test_hermes_rehearsal_in_think_is_not_promoted(self):
|
||
text = (
|
||
'[THINK]maybe <tool_call>{"name":"web_search","arguments":'
|
||
'{"query":"x"}}</tool_call>[/THINK]'
|
||
'[TOOL_CALLS] [{"name":"terminal","arguments":{"cmd":"ls"}}]'
|
||
)
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["terminal"]
|
||
|
||
def test_unclosed_think_parses_nothing(self):
|
||
text = '[THINK]let me try <function=web_search>{"query":"x"}</function>'
|
||
assert parse_tool_calls_from_text(text) == []
|
||
|
||
|
||
class TestGemmaUnquotedApostrophes:
|
||
"""Quotes open strings only at value-start context: an apostrophe inside
|
||
an unquoted wrapper-less value (contractions, possessives) is prose, and
|
||
treating it as an opener swallowed the closing brace and lost the call."""
|
||
|
||
def test_contraction_in_unquoted_query_parses(self):
|
||
text = "call:web_search{query:what's the weather}"
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert len(calls) == 1
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args["query"] == "what's the weather"
|
||
|
||
def test_contraction_does_not_swallow_next_key(self):
|
||
text = "call:web_search{query:what's up, n:3}"
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert len(calls) == 1
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args["query"] == "what's up"
|
||
assert args["n"] == 3
|
||
|
||
def test_contraction_strip_span_covers_whole_call(self):
|
||
from core.inference.tool_call_parser import strip_tool_markup
|
||
|
||
text = "call:web_search{query:what's the weather} Done."
|
||
stripped = strip_tool_markup(text, final = True, enabled_tool_names = {"web_search"})
|
||
assert "call:web_search" not in stripped
|
||
assert stripped.strip() == "Done."
|
||
|
||
def test_quoted_values_still_hide_delimiters(self):
|
||
text = 'call:web_search{query:"weather, location: Boston", n:2}'
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert len(calls) == 1
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args["query"] == "weather, location: Boston"
|
||
assert args["n"] == 2
|
||
|
||
|
||
class TestGlmKeyWithoutValue:
|
||
"""A GLM <arg_key> with no <arg_value> tag: strict mode rejects the call
|
||
(same contract as an unclosed value) instead of executing it with the
|
||
argument silently dropped; Auto-Heal keeps the lenient skip."""
|
||
|
||
def test_strict_rejects_key_without_value(self):
|
||
text = "<tool_call>web_search\n<arg_key>query</arg_key>\n</tool_call>"
|
||
assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
|
||
|
||
def test_heal_keeps_the_lenient_skip(self):
|
||
text = "<tool_call>web_search\n<arg_key>query</arg_key>\n</tool_call>"
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = True)
|
||
assert len(calls) == 1
|
||
assert calls[0]["function"]["name"] == "web_search"
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {}
|
||
|
||
|
||
class TestDisabledBareJsonLiteralNotPromoted:
|
||
"""A leading non-enabled-name object is content: nothing inside promotes, and a call after it still parses."""
|
||
|
||
def test_literal_inside_disabled_json_stays_data(self):
|
||
text = (
|
||
'{"name": "Alice", "note": "try <function=web_search>'
|
||
'<parameter=query>x</parameter></function>"}'
|
||
)
|
||
assert parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"}) == []
|
||
|
||
def test_python_tag_literal_inside_disabled_json_stays_data(self):
|
||
text = '{"name": "Alice", "note": "<|python_tag|>web_search.call(query=1)"}'
|
||
assert parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"}) == []
|
||
|
||
def test_real_call_after_disabled_json_still_parses(self):
|
||
text = (
|
||
'{"name": "Alice", "note": "<function=evil>x</function>"} '
|
||
'<tool_call>{"name": "web_search", "arguments": {"query": "cats"}}</tool_call>'
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
|
||
class TestDeepSeekMarkerInsideLeadingEnvelopes:
|
||
"""A DeepSeek/Kimi marker quoted inside a leading bare-JSON or Mistral
|
||
call's argument strings is data: the pre-pass must not promote the
|
||
embedded no-arg literal and drop the real outer call."""
|
||
|
||
def test_marker_inside_leading_json_call_stays_data(self):
|
||
text = (
|
||
'{"name": "web_search", "arguments": '
|
||
'{"query": "what is <｜tool▁calls▁begin｜>...{}..."}}'
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert "tool▁calls▁begin" in args["query"]
|
||
|
||
def test_marker_inside_leading_mistral_call_stays_data(self):
|
||
text = (
|
||
'[TOOL_CALLS] [{"name": "web_search", "arguments": '
|
||
'{"query": "docs on <｜tool▁calls▁begin｜> markers"}}]'
|
||
)
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
def test_standalone_deepseek_call_still_parses(self):
|
||
text = (
|
||
"<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>function<｜tool▁sep｜>web_search\n"
|
||
'```json\n{"query": "cats"}\n```<｜tool▁call▁end｜><｜tool▁calls▁end｜>'
|
||
)
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
|
||
class TestMistralLiteralInsideLeadingJson:
|
||
"""A [TOOL_CALLS] literal quoted inside a leading JSON object must not be promoted over it."""
|
||
|
||
def test_outer_json_call_wins_over_mistral_literal(self):
|
||
text = '{"name": "python", "arguments": {"code": "[TOOL_CALLS]web_search{}"}}'
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"python", "web_search"})
|
||
assert [c["function"]["name"] for c in calls] == ["python"]
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args["code"] == "[TOOL_CALLS]web_search{}"
|
||
|
||
def test_disabled_outer_json_keeps_mistral_literal_as_data(self):
|
||
text = '{"name": "Alice", "note": "[TOOL_CALLS]web_search{}"}'
|
||
assert parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"}) == []
|
||
|
||
|
||
class TestGemmaWrappedWhitespace:
|
||
"""Whitespace drift around ``call``/``:`` in wrapped Gemma calls must still parse (no fallback exists)."""
|
||
|
||
def test_space_after_call_colon_parses(self):
|
||
text = '<|tool_call>call: web_search{query:<|"|>cats<|"|>}<tool_call|>'
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {"query": "cats"}
|
||
|
||
def test_space_around_colon_parses(self):
|
||
text = '<|tool_call>call : web_search{query:<|"|>cats<|"|>}<tool_call|>'
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
def test_strict_mode_still_requires_the_closing_tag(self):
|
||
text = '<|tool_call>call: web_search{query:<|"|>cats<|"|>}'
|
||
assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
|
||
|
||
|
||
class TestDisabledJsonBeforeDeepSeekCall:
|
||
"""A disabled leading bare-JSON object whose strings mention a
|
||
DeepSeek/Kimi marker is dropped and the tail parsed, so a REAL
|
||
DeepSeek/Kimi call after the object still executes instead of the whole
|
||
message skipping the pre-pass."""
|
||
|
||
_DS = (
|
||
"<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>function<｜tool▁sep｜>web_search\n"
|
||
'```json\n{"query": "cats"}\n```<｜tool▁call▁end｜><｜tool▁calls▁end｜>'
|
||
)
|
||
|
||
def test_real_deepseek_call_after_disabled_json_parses(self):
|
||
text = '{"name": "Alice", "note": "<｜tool▁calls▁begin｜>"} ' + self._DS
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {"query": "cats"}
|
||
|
||
def test_disabled_json_with_marker_alone_stays_data(self):
|
||
text = '{"name": "Alice", "note": "<｜tool▁calls▁begin｜>"}'
|
||
assert parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"}) == []
|
||
|
||
|
||
class TestGemmaDottedArgumentKeys:
|
||
"""Dotted Gemma keys (namespaced schemas) must survive key-quoting or the call is lost."""
|
||
|
||
def test_dotted_key_parses(self):
|
||
text = '<|tool_call>call:web_search{user.name:<|"|>bob<|"|>, query:<|"|>x<|"|>}<tool_call|>'
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args == {"user.name": "bob", "query": "x"}
|
||
|
||
|
||
class TestLeadingWrapperlessGemmaOverEmbeddedMarkers:
|
||
"""A leading wrapper-less Gemma call to an enabled tool owns the turn: a
|
||
quoted foreign literal inside its argument (a query citing another tool
|
||
syntax) is data, and tool_healing must not promote it before the Gemma
|
||
fallback runs. Foreign markup leading keeps the normal order."""
|
||
|
||
def test_leading_gemma_wins_over_quoted_xml_literal(self):
|
||
text = (
|
||
'call:web_search{query:"explain <tool_call>'
|
||
'{"name":"evil","arguments":{}}</tool_call>"}'
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "evil"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
def test_xml_leading_keeps_normal_order(self):
|
||
text = (
|
||
'<tool_call>{"name":"web_search","arguments":'
|
||
'{"query":"call:evil{x:1} example"}}</tool_call>'
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "evil"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
|
||
class TestLeadingMistralCallOwnsTheTurn:
|
||
"""A leading Mistral call wins in document order over literal XML in trailing prose."""
|
||
|
||
def test_leading_mistral_wins_over_trailing_xml_literal(self):
|
||
text = (
|
||
'[TOOL_CALLS]web_search[ARGS]{"query":"cats"} '
|
||
"Note: <function=evil><parameter=x>1</parameter></function>"
|
||
)
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
def test_function_xml_leading_keeps_normal_order(self):
|
||
text = (
|
||
"<function=web_search><parameter=query>x</parameter></function> "
|
||
"[TOOL_CALLS]evil[ARGS]{}"
|
||
)
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
|
||
class TestGemmaDottedKeyAfterBareValue:
|
||
def test_dotted_key_after_bare_value_is_a_boundary(self):
|
||
text = "<|tool_call>call:web_search{query:foo,user.name:bob}<tool_call|>"
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args == {"query": "foo", "user.name": "bob"}
|
||
|
||
|
||
class TestJsonAnswersAreDataForMarkerlessScans:
|
||
"""A whole-content JSON value is a structured answer: a quoted example of
|
||
an enabled tool's syntax inside it must not execute the tool, and the
|
||
display strip must not mutilate the answer."""
|
||
|
||
def test_gemma_example_inside_json_answer_not_promoted(self):
|
||
text = '{"answer":"Gemma syntax is call:web_search{query:hi}"}'
|
||
assert parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"}) == []
|
||
|
||
def test_gemma_example_inside_json_answer_not_stripped(self):
|
||
from core.inference.tool_call_parser import strip_tool_markup
|
||
text = '{"answer":"Gemma syntax is call:web_search{query:hi}"}'
|
||
assert strip_tool_markup(text, final = True, enabled_tool_names = {"web_search"}) == text
|
||
|
||
def test_kimi_marker_inside_json_answer_not_promoted(self):
|
||
text = (
|
||
'{"answer":"<|tool_call_begin|>functions.web_search:0'
|
||
'<|tool_call_argument_begin|>{}<|tool_call_end|>"}'
|
||
)
|
||
assert parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"}) == []
|
||
|
||
|
||
class TestGemmaNestedQuotedLeaves:
|
||
def test_nested_object_and_array_values_are_unquoted(self):
|
||
text = 'call:f{loc:{city:"New York"},items:["a","b"],n:3}'
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"f"})
|
||
assert len(calls) == 1
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args == {"loc": {"city": "New York"}, "items": ["a", "b"], "n": 3}
|
||
|
||
|
||
class TestEarliestEnvelopeWinsAcrossDeepSeekKimi:
|
||
"""The DeepSeek/Kimi pre-pass dispatches by earliest envelope opener: a
|
||
leading real call wins over a trailing example of the sibling format in
|
||
either direction (document order, like the other leading guards)."""
|
||
|
||
_DS = (
|
||
"<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>function<｜tool▁sep｜>evil\n"
|
||
'```json\n{"x": 1}\n```<｜tool▁call▁end｜><｜tool▁calls▁end｜>'
|
||
)
|
||
_KIMI = (
|
||
"<|tool_calls_section_begin|><|tool_call_begin|>functions.web_search:0"
|
||
'<|tool_call_argument_begin|>{"query": "cats"}<|tool_call_end|>'
|
||
"<|tool_calls_section_end|>"
|
||
)
|
||
|
||
def test_leading_kimi_wins_over_trailing_deepseek_example(self):
|
||
text = self._KIMI + " For reference: " + self._DS
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
def test_leading_deepseek_wins_over_trailing_kimi_example(self):
|
||
text = self._DS + " Kimi format: " + self._KIMI
|
||
calls = parse_tool_calls_from_text(text)
|
||
assert [c["function"]["name"] for c in calls] == ["evil"]
|
||
|
||
|
||
class TestNamelessLeadingJsonAnswerIsData:
|
||
"""A nameless leading JSON answer is an envelope: quoted markup stays data, and a call after it parses."""
|
||
|
||
def test_xml_literal_inside_json_answer_stays_data(self):
|
||
text = '{"answer": "use <function=web_search><parameter=query>x</parameter></function>"}'
|
||
assert parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"}) == []
|
||
|
||
def test_real_call_after_json_answer_still_parses(self):
|
||
text = (
|
||
'{"answer": "docs"} <tool_call>{"name": "web_search", '
|
||
'"arguments": {"query": "cats"}}</tool_call>'
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
|
||
class TestClosedCallPrecedesMarkerPrePass:
|
||
"""A closed non-DeepSeek/Kimi call that precedes the first DS/Kimi marker
|
||
owns the turn: a trailing example (or an example quoted inside a wrapped
|
||
Gemma argument) must not be promoted by the pre-pass."""
|
||
|
||
_KIMI_EVIL = (
|
||
"<|tool_calls_section_begin|><|tool_call_begin|>functions.evil:0"
|
||
'<|tool_call_argument_begin|>{"x": 1}<|tool_call_end|>'
|
||
"<|tool_calls_section_end|>"
|
||
)
|
||
|
||
def test_kimi_example_inside_wrapped_gemma_arg_stays_data(self):
|
||
text = (
|
||
'<|tool_call>call:web_search{query:<|"|>explain '
|
||
+ self._KIMI_EVIL
|
||
+ '<|"|>}<tool_call|>'
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "evil"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
def test_leading_xml_call_wins_over_trailing_kimi_example(self):
|
||
text = (
|
||
'<tool_call>{"name":"web_search","arguments":{"query":"cats"}}</tool_call>'
|
||
" For reference: " + self._KIMI_EVIL
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "evil"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
def test_standalone_kimi_call_still_parses(self):
|
||
calls = parse_tool_calls_from_text(self._KIMI_EVIL)
|
||
assert [c["function"]["name"] for c in calls] == ["evil"]
|
||
|
||
|
||
class TestTruncatedWrapperlessGemmaStopsScan:
|
||
def test_call_quoted_inside_truncated_arg_not_promoted(self):
|
||
text = 'call:python{code:example("call:web_search{query:hi}") and then it cut'
|
||
assert parse_tool_calls_from_text(text, enabled_tool_names = {"python", "web_search"}) == []
|
||
|
||
|
||
class TestGemmaQuotedNestedDelimiters:
|
||
def test_comma_inside_quoted_nested_string_not_a_split(self):
|
||
text = 'call:f{loc:{city:"New, York"},n:1}'
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"f"})
|
||
assert len(calls) == 1
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args == {"loc": {"city": "New, York"}, "n": 1}
|
||
|
||
|
||
class TestGemmaStringMarkerLiteralInArgs:
|
||
def test_string_marker_literal_does_not_lose_the_call(self):
|
||
text = "call:web_search{query:'what does <|\"|> mean in Gemma'}"
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert len(calls) == 1
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args["query"] == 'what does <|"|> mean in Gemma'
|
||
|
||
|
||
class TestGemmaMidValueQuotedPhrase:
|
||
def test_quoted_phrase_mid_value_hides_delimiters(self):
|
||
text = 'call:web_search{query:find "weather, location: Boston", limit:3}'
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert len(calls) == 1
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args == {"query": 'find "weather, location: Boston"', "limit": 3}
|
||
|
||
def test_apostrophes_still_prose_mid_value(self):
|
||
text = "call:web_search{query:what's on at the museum, n:2}"
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args == {"query": "what's on at the museum", "n": 2}
|
||
|
||
|
||
class TestGlmStrictRefusesInQuoteFallback:
|
||
"""A truncated GLM value whose only close candidates sit inside a string
|
||
literal must reject in strict mode instead of executing truncated
|
||
arguments; Auto-Heal keeps the lenient partial value."""
|
||
|
||
_TRUNC = (
|
||
'<tool_call>python\n<arg_key>code</arg_key>\n<arg_value>print("</arg_value></tool_call>")'
|
||
)
|
||
|
||
def test_strict_rejects_truncated_in_string_close(self):
|
||
assert parse_tool_calls_from_text(self._TRUNC, allow_incomplete = False) == []
|
||
|
||
def test_heal_keeps_partial_value(self):
|
||
calls = parse_tool_calls_from_text(self._TRUNC, allow_incomplete = True)
|
||
assert len(calls) == 1 and calls[0]["function"]["name"] == "python"
|
||
|
||
|
||
class TestGemmaGuardCoversPreambles:
|
||
def test_preamble_then_gemma_call_quoting_xml_wins(self):
|
||
text = (
|
||
"Sure, searching now. call:web_search{query:"
|
||
'"explain <tool_call>{"name":"evil","arguments":{}}</tool_call>"}'
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "evil"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
|
||
class TestGlmStrictAcceptsApostrophes:
|
||
def test_apostrophe_value_parses_in_strict_mode(self):
|
||
text = (
|
||
"<tool_call>web_search\n<arg_key>query</arg_key>\n"
|
||
"<arg_value>what's the weather</arg_value>\n</tool_call>"
|
||
)
|
||
calls = parse_tool_calls_from_text(text, allow_incomplete = False)
|
||
assert len(calls) == 1
|
||
args = json.loads(calls[0]["function"]["arguments"])
|
||
assert args == {"query": "what's the weather"}
|
||
|
||
|
||
class TestDisabledGemmaCallLiteralsAreData:
|
||
def test_literal_inside_disabled_call_not_promoted(self):
|
||
text = 'call:foo{query:"<function=python><parameter=code>x</parameter></function>"}'
|
||
assert parse_tool_calls_from_text(text, enabled_tool_names = {"python", "web_search"}) == []
|
||
|
||
def test_real_call_after_disabled_example_still_parses(self):
|
||
text = (
|
||
'call:foo{query:"<function=python><parameter=code>x</parameter></function>"}'
|
||
" call:web_search{query:hi}"
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"python", "web_search"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
|
||
class TestLeadingJsonArrayAnswerIsData:
|
||
def test_kimi_marker_inside_json_array_answer_not_promoted(self):
|
||
text = (
|
||
'[{"answer": "<|tool_call_begin|>functions.web_search:0'
|
||
'<|tool_call_argument_begin|>{}<|tool_call_end|>"}]'
|
||
)
|
||
assert parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"}) == []
|
||
|
||
|
||
class TestLeadingBareJsonOwnsTurnOverTrailingXml:
|
||
"""Document order: a leading closed bare-JSON call owns the turn even when
|
||
tool XML appears AFTER it (inside-or-after, mirroring the Mistral rule)."""
|
||
|
||
def test_leading_call_wins_over_trailing_xml(self):
|
||
text = (
|
||
'{"name":"lookup","parameters":{"q":"first"}} Example: '
|
||
'<tool_call>{"name":"delete_all","arguments":{}}</tool_call>'
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"lookup", "delete_all"})
|
||
assert [c["function"]["name"] for c in calls] == ["lookup"], calls
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {"q": "first"}
|
||
|
||
def test_chained_leading_calls_win_over_trailing_xml(self):
|
||
text = (
|
||
'{"name":"lookup","parameters":{"q":"first"}};'
|
||
'{"name":"lookup","parameters":{"q":"second"}} '
|
||
'<tool_call>{"name":"delete_all","arguments":{}}</tool_call>'
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"lookup", "delete_all"})
|
||
assert [c["function"]["name"] for c in calls] == ["lookup", "lookup"], calls
|
||
|
||
def test_non_call_leading_object_defers_to_trailing_real_call(self):
|
||
# Nameless answers and disabled-name objects take the decline path:
|
||
# the object is dropped and the real trailing call still parses.
|
||
for lead in ('{"answer": 42}', '{"name":"draft","parameters":{}}'):
|
||
text = lead + ' <tool_call>{"name":"delete_all","arguments":{}}</tool_call>'
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"delete_all"})
|
||
assert [c["function"]["name"] for c in calls] == ["delete_all"], (lead, calls)
|
||
|
||
def test_leading_xml_call_still_wins_over_trailing_bare_json(self):
|
||
text = (
|
||
'<tool_call>{"name":"delete_all","arguments":{}}</tool_call> '
|
||
'Example: {"name":"lookup","parameters":{"q":"x"}}'
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"lookup", "delete_all"})
|
||
assert [c["function"]["name"] for c in calls] == ["delete_all"], calls
|
||
|
||
|
||
class TestProseCloseTagAfterClosedFunctionCall:
|
||
"""A literal </function> in prose after a closed call is data: the call
|
||
ends at its first close that is not parameter data, so arguments never
|
||
swallow the prose between the real close and the literal."""
|
||
|
||
def test_arguments_do_not_swallow_prose(self):
|
||
text = (
|
||
"<function=web_search><parameter=query>cats</parameter></function>"
|
||
" Done. The tag </function> closes a call."
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"], calls
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {"query": "cats"}
|
||
|
||
def test_literal_close_inside_open_parameter_stays_data(self):
|
||
text = '<function=python><parameter=code>print("</function>")</parameter></function>'
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"python"})
|
||
assert [c["function"]["name"] for c in calls] == ["python"], calls
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {"code": 'print("</function>")'}
|
||
|
||
def test_attribute_form_arguments_do_not_swallow_prose(self):
|
||
# The <function name="..."> attribute form shares the first-balanced-close
|
||
# rule: prose mentioning a literal close tag never folds into arguments.
|
||
text = (
|
||
'<function name="web_search"><parameter name="query">cats</parameter></function>'
|
||
" Done. The tag </function> closes a call."
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"], calls
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {"query": "cats"}
|
||
|
||
def test_attribute_form_literal_close_in_open_parameter_stays_data(self):
|
||
text = '<function name="python"><parameter name="code">print("</function>")</parameter></function>'
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"python"})
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {"code": 'print("</function>")'}
|
||
|
||
def test_attribute_form_two_calls_both_parse(self):
|
||
text = (
|
||
'<function name="web_search"><parameter name="query">cats</parameter></function>'
|
||
'<function name="python"><parameter name="code">x=1</parameter></function>'
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "python"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search", "python"], calls
|
||
|
||
|
||
class TestEnabledNameJsonAnswerIsContent:
|
||
"""A JSON answer whose top-level name matches an enabled tool but has no
|
||
call shape is content: the parser rejects it, so the strip and the drain
|
||
gate must keep it visible too."""
|
||
|
||
def test_answer_survives_strip(self):
|
||
from core.inference.tool_call_parser import strip_leading_bare_json_call
|
||
ans = '{"name":"web_search","result":"no call"}'
|
||
assert strip_leading_bare_json_call(ans, {"web_search"}) == ans
|
||
|
||
def test_answer_does_not_route_to_draining(self):
|
||
from core.inference.safetensors_agentic import _looks_like_enabled_bare_json
|
||
assert not _looks_like_enabled_bare_json(
|
||
'{"name":"web_search","result":"no call"}', {"web_search"}
|
||
)
|
||
|
||
def test_real_call_still_strips_and_drains(self):
|
||
from core.inference.safetensors_agentic import _looks_like_enabled_bare_json
|
||
from core.inference.tool_call_parser import strip_leading_bare_json_call
|
||
|
||
real = '{"name":"web_search","parameters":{"q":"x"}}'
|
||
assert strip_leading_bare_json_call(real, {"web_search"}) == ""
|
||
assert _looks_like_enabled_bare_json(real, {"web_search"})
|
||
|
||
def test_arguments_string_call_still_strips(self):
|
||
from core.inference.tool_call_parser import strip_leading_bare_json_call
|
||
call = '{"name":"web_search","arguments":"{\\"q\\":\\"x\\"}"} tail'
|
||
assert strip_leading_bare_json_call(call, {"web_search"}) == "tail"
|
||
|
||
|
||
class TestAttributeFormLeadingContainment:
|
||
"""A leading attribute-form call owns the turn: markup quoted inside its
|
||
parameter is data, not a call for the shared XML parser to promote."""
|
||
|
||
def test_quoted_tool_call_inside_param_stays_data(self):
|
||
from core.inference.tool_call_parser import parse_tool_calls_from_text
|
||
|
||
text = (
|
||
'<function name="web_search"><param name="query">find '
|
||
'<tool_call>{"name":"delete","arguments":{}}</tool_call></param></function>'
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "delete"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
assert "delete" in json.loads(calls[0]["function"]["arguments"])["query"]
|
||
|
||
def test_real_xml_call_before_attribute_form_keeps_order(self):
|
||
from core.inference.tool_call_parser import parse_tool_calls_from_text
|
||
|
||
text = (
|
||
'<tool_call>{"name":"delete","arguments":{}}</tool_call> Example: '
|
||
'<function name="web_search"><param name="q">x</param></function>'
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "delete"})
|
||
assert calls[0]["function"]["name"] == "delete"
|
||
|
||
|
||
class TestParameterKeepsMultipleLiteralCloses:
|
||
"""A parameter that provably closes with its own tag keeps every literal
|
||
function close inside it as data (regression: the first literal close was
|
||
treated as ending the parameter, truncating the value)."""
|
||
|
||
def test_two_literal_closes_in_one_parameter(self):
|
||
from core.inference.tool_call_parser import parse_tool_calls_from_text
|
||
|
||
text = (
|
||
'<function name="web_search"><param name="query">'
|
||
"a </function> b </function> c </param></function>"
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {
|
||
"query": "a </function> b </function> c"
|
||
}
|
||
|
||
def test_strip_removes_the_whole_call(self):
|
||
from core.inference.tool_call_parser import strip_tool_markup
|
||
text = (
|
||
'<function name="web_search"><param name="query">'
|
||
"a </function> b </function> c </param></function> after"
|
||
)
|
||
assert strip_tool_markup(text, final = True) == "after"
|
||
|
||
def test_unclosed_parameter_still_heals_at_function_close(self):
|
||
from core.inference.tool_call_parser import parse_tool_calls_from_text
|
||
calls = parse_tool_calls_from_text(
|
||
"<function=web_search><parameter=query>val</function>",
|
||
enabled_tool_names = {"web_search"},
|
||
)
|
||
assert json.loads(calls[0]["function"]["arguments"]) == {"query": "val"}
|
||
|
||
|
||
class TestMistralPreambleOwnership:
|
||
"""A visible preface before the first Mistral call must not hand the turn
|
||
to a later XML literal: the Mistral call is first in document order."""
|
||
|
||
def test_v11_named_form_after_preface(self):
|
||
from core.inference.tool_call_parser import parse_tool_calls_from_text
|
||
|
||
text = (
|
||
'pref [TOOL_CALLS]web_search[ARGS]{"query":"cats"} Note '
|
||
"<function=evil><parameter=x>1</parameter></function>"
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "evil"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
def test_array_form_after_preface(self):
|
||
from core.inference.tool_call_parser import parse_tool_calls_from_text
|
||
|
||
text = (
|
||
'pref [TOOL_CALLS][{"name":"web_search","arguments":{"query":"cats"}}] Note '
|
||
"<function=evil><parameter=x>1</parameter></function>"
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "evil"})
|
||
assert [c["function"]["name"] for c in calls] == ["web_search"]
|
||
|
||
def test_xml_call_before_trigger_keeps_order(self):
|
||
from core.inference.tool_call_parser import parse_tool_calls_from_text
|
||
|
||
text = (
|
||
"<function=evil><parameter=x>1</parameter></function> then "
|
||
'[TOOL_CALLS][{"name":"web_search","arguments":{}}]'
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "evil"})
|
||
assert calls[0]["function"]["name"] == "evil"
|
||
|
||
def test_prose_mention_without_call_shape_keeps_order(self):
|
||
from core.inference.tool_call_parser import parse_tool_calls_from_text
|
||
|
||
text = (
|
||
"See [TOOL_CALLS] docs for details. "
|
||
"<function=evil><parameter=x>1</parameter></function>"
|
||
)
|
||
calls = parse_tool_calls_from_text(text, enabled_tool_names = {"evil"})
|
||
assert [c["function"]["name"] for c in calls] == ["evil"]
|
||
|
||
|
||
class TestBareJsonStripRequiresTopLevelName:
|
||
"""The strip's shape gate requires the parser's TOP-LEVEL name in every
|
||
mode: a JSON answer with only a nested name is content, even name-agnostic."""
|
||
|
||
def test_nested_name_answer_survives_name_agnostic_strip(self):
|
||
from core.inference.tool_call_parser import strip_leading_bare_json_call
|
||
|
||
ans = '{"parameters":{},"result":{"name":"web_search"}}'
|
||
assert strip_leading_bare_json_call(ans) == ans
|
||
assert strip_leading_bare_json_call(ans, {"web_search"}) == ans
|
||
|
||
def test_real_call_still_strips_name_agnostic(self):
|
||
from core.inference.tool_call_parser import strip_leading_bare_json_call
|
||
assert strip_leading_bare_json_call('{"name":"web_search","parameters":{"q":"x"}}') == ""
|
||
|
||
|
||
class TestGemmaAwareClosedBlockPrePass:
|
||
"""The closed JSON/function strip pre-pass must not delete across a complete
|
||
Gemma span (a quoted <function=...> plus a later real </function>)."""
|
||
|
||
def test_literal_function_in_gemma_arg_with_later_real_call(self):
|
||
from core.tool_healing import strip_tool_call_markup
|
||
text = (
|
||
'before <|tool_call>call:python{code:<|"|>print("<function=x>")<|"|>}'
|
||
"<tool_call|> <function=terminal><parameter=cmd>ls</parameter>"
|
||
"</function> after"
|
||
)
|
||
assert strip_tool_call_markup(text, final = True) == "before after"
|
||
|
||
def test_literal_function_in_gemma_arg_with_prose_closer(self):
|
||
from core.tool_healing import strip_tool_call_markup
|
||
|
||
text = (
|
||
'before <|tool_call>call:python{code:<|"|>print("<function=x>")<|"|>}'
|
||
"<tool_call|> then use </function> to close. after"
|
||
)
|
||
out = strip_tool_call_markup(text, final = True)
|
||
assert out.startswith("before")
|
||
assert out.endswith("after")
|
||
assert "call:python" not in out
|
||
|
||
def test_gemma_opener_inside_json_arg_still_strips_block(self):
|
||
from core.tool_healing import strip_tool_call_markup
|
||
text = (
|
||
'<tool_call>{"name":"t","arguments":{"code":"<|tool_call>call:x{"}}</tool_call> after'
|
||
)
|
||
assert strip_tool_call_markup(text, final = True) == "after"
|
||
|
||
def test_gemma_opener_inside_function_param_still_strips_block(self):
|
||
from core.tool_healing import strip_tool_call_markup
|
||
text = (
|
||
'<function=python><parameter=code>x = "<|tool_call>call:t{"</parameter>'
|
||
"</function> after"
|
||
)
|
||
assert strip_tool_call_markup(text, final = True) == "after"
|