dsh-tool-call-guard

Some models occasionally emit a tool call whose arguments string is not valid JSON, most often an unescaped inner quote. During streaming, a lenient server lets the malformed call through, persists it in the append-only session log, and the turn appears successful. On the next history-replay request, however, a strict server (vLLM and peers) validates the arguments, rejects the entire request, and every subsequent turn in that session returns 400 until the log is surgically repaired by hand.

dsh-tool-call-guard sits on the harness llm/stream waterfall. For every assistant tool-call block whose arguments fail JSON.parse, it does two things: it re-expresses the call as an honest plain-text record (wire-only, never rewriting the durable log) so the model sees exactly what it emitted and can re-issue a corrected call, and it converts the matching tool result into a plain user message to keep the conversation protocol-balanced. No dangling tool_calls, no orphan role:tool reply, each of which is itself a 400 on strict servers. Clean history incurs zero overhead: one JSON.parse per tool-call block and the messages array passes through with object identity.

It is aimed at anyone running multi-turn agent sessions on dsh with an OpenAI-compatible backend (vLLM, etc.) where a single bad generation would otherwise poison the entire conversation. Install, restart, and the guard is active with no configuration required. If the guard itself encounters an error it fails open, passing the original request through untouched, so no new failure mode is introduced.