Tool-call invocation markup leaks into visible output as literal text in long sessions (regression ~2026-06-18)

Summary

In long / large sessions, the assistant's internal tool-call markup is emitted into the visible chat as literal text instead of being parsed as an actual tool call. The malformed call then errors at the tail, and — critically — the tool sometimes partially executes, leaving operations half-applied.

Concretely, the chat shows raw text such as:

court
<invoke name="Bash">
<parameter name="command">... curl ... </parameter>
<parameter name="description">...</parameter>
</invoke>

i.e. the <invoke …> / <parameter …> wrapper (and a leading token that renders as court) leaks as plain text. The run is marked "executed" but the trailing portion of the command breaks with a syntax error.

Environment

• Claude Code desktop app (macOS, Darwin 25.5.0)
• Model: Opus 4.8 (high reasoning effort; "fast mode" enabled)
• First observed right after an app update around 2026-06-18. This did not occur before that update.

Reproduction conditions

• Long, multi-hundred-turn sessions (here: PdM / personal-assistant style sessions running for days). Does not reproduce in short/fresh sessions.
• Triggered while building complex multi-line Bash tool calls (shell quoting, piped curl, inline python3 -c).
• Once it occurs in a session, retrying in the same session reproduces it — the failure persists for the remainder of that session.

Impact

• Corrupts in-progress automated workflows (interrupted a scheduled routine mid-run).
• The partial execution is the worst part: some side effects apply and some don't, so the resulting state is ambiguous and the user must manually inspect and repair it.
• Forces the user to abandon the session and redo work in a fresh one.

Hypothesis (unverified)

Tool-call / special-token formatting reliability appears to degrade as context length grows, and the strong correlation with the recent update suggests a possible regression in the latest release. Filing so it can be investigated.

Notes

No personal data, secrets, or screenshots are included here. Happy to provide additional detail (timestamps, redacted transcript excerpts) through a private channel if useful.