fix(text): strip antml:namespaced tool call XML from visible content

maweibin · claude · vincentkoc · commit b2787a1c7a7a · 2026-06-30T10:24:28.000-07:00
When a proxied Anthropic-Messages endpoint degrades a native tool_use block into plain text, the assistant emits antml:namespaced XML tags (<antml:invoke>, <antml:parameter>). These were not recognized by the visible-text sanitizer, leaking tool-call XML into user-visible replies. Added antml: (and mm:) namespace handling to: - TOOL_CALL_QUICK_RE regex for fast pre-check - TOOL_CALL_TAG_NAMES set for tag name recognition - Tag name scanner to accept ':' in tag names - TOOL_CALL_XML_PAYLOAD_START_RE for XML payload detection - shouldDetectXmlPayload to include antml:invoke tags Fixes #97750. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
diff --git a/src/shared/text/assistant-visible-text.test.ts b/src/shared/text/assistant-visible-text.test.ts
@@ -763,6 +763,23 @@ describe("stripToolCallXmlTags", () => {
       "Checking.  Done.",
     );
   });
+
+  it("strips antml:invoke/parameter tool call XML from visible content", () => {
+    const input =
+      'before <antml:invoke name="exec"><antml:parameter name="command">ls</antml:parameter></antml:invoke> after';
+    expect(stripToolCallXmlTags(input)).toBe("before  after");
+  });
+
+  it("strips antml:invoke with function_call payload", () => {
+    const input =
+      'prefix <antml:invoke name="exec"><function_call>test</function_call></antml:invoke> suffix';
+    expect(stripToolCallXmlTags(input)).toBe("prefix  suffix");
+  });
+
+  it("does not strip non-namespaced invoke tags (unrelated XML)", () => {
+    const input = 'keep <invoke name="something">content</invoke> keep';
+    expect(stripToolCallXmlTags(input)).toBe(input);
+  });
 });
 
 describe("stripMinimaxToolCallXml", () => {
diff --git a/src/shared/text/assistant-visible-text.ts b/src/shared/text/assistant-visible-text.ts
@@ -30,7 +30,7 @@ const INTERNAL_CHANNEL_TRACE_LINE_RE =
  * closing tag, or to end-of-string if the stream was truncated mid-tag.
  */
 const TOOL_CALL_QUICK_RE =
-  /<\s*\/?\s*(?:tool_call|tool_result|function_calls?|function_response|function|tool_calls)\b/i;
+  /<\s*\/?\s*(?:antml:)?(?:tool_call|tool_result|function_calls?|function_response|function|tool_calls|invoke|parameter)\b/i;
 const TOOL_CALL_TAG_NAMES = new Set([
   "tool_call",
   "tool_result",
@@ -39,11 +39,13 @@ const TOOL_CALL_TAG_NAMES = new Set([
   "function_response",
   "function",
   "tool_calls",
+  "antml:invoke",
+  "antml:parameter",
 ]);
 const TOOL_CALL_JSON_PAYLOAD_START_RE =
   /^(?:\s+[A-Za-z_:][-A-Za-z0-9_:.]*\s*=\s*(?:"[^"]*"|'[^']*'|[^\s"'=<>`]+))*\s*(?:\r?\n\s*)?[[{]/;
 const TOOL_CALL_XML_PAYLOAD_START_RE =
-  /^\s*(?:\r?\n\s*)?<(?:function_call|tool_call|function|invoke|parameters?|arguments?)\b/i;
+  /^\s*(?:\r?\n\s*)?<(?:antml:)?(?:function_call|tool_call|function|invoke|parameters?|arguments?)\b/i;
 const NESTED_JSON_TOOL_CALL_PAYLOAD_START_RE = /^\s*(?:\r?\n\s*)?<(?:function_call|tool_call)\b/i;
 
 type ToolCallPayloadKind = "json" | "xml" | null;
@@ -296,7 +298,7 @@ function parseToolCallTagAt(text: string, start: number): ParsedToolCallTag | nu
   }
 
   const nameStart = cursor;
-  while (cursor < text.length && /[A-Za-z_]/.test(text[cursor])) {
+  while (cursor < text.length && /[A-Za-z_:]/.test(text[cursor])) {
     cursor += 1;
   }
 
@@ -404,6 +406,7 @@ export function stripToolCallXmlTags(
       const shouldDetectXmlPayload =
         tag.tagName === "tool_call" ||
         tag.tagName === "function" ||
+        tag.tagName === "antml:invoke" ||
         ((options.stripFunctionCallsXmlPayloads === true ||
           shouldStripPluralWrapperBeforeResponse) &&
           isPluralToolCallWrapper);
