[BUG] Tool call markup leaks into visible output instead of being executed

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Raw tool-call markup sometimes appears as visible text in the conversation output instead of being executed as an actual tool call. When this happens, tags like <invoke name="Read"> and <parameter> are displayed verbatim, and the intended tool is never executed.

After the leak, the response ends without the tool being executed. Re-prompting on the next turn recovers normal tool-call behavior.

Approximate frequency: occurred 5+ times across ~10 sessions.

What Should Happen?

Tool calls should be parsed by the harness and executed, not displayed as raw text in the conversation output.

Error Messages/Logs

No error messages are shown. The raw markup simply appears as text:

Let me read the service-lookback skill file.

<invoke name="Read">
<parameter name="file_path">C:\Users\<user>\...\project\.claude\skills\service-lookback\SKILL.md</parameter>
</invoke>

The file path in the leaked markup is also malformed (missing a backslash), suggesting the model generated text resembling a tool call rather than issuing a real one.

Steps to Reproduce

1. Open a project with many markdown files in VS Code with the Claude Code extension
2. Start a conversation that involves reading and analyzing multiple files sequentially
3. Continue the conversation for an extended period (approximately 20+ turns with 10+ tool calls)
4. At some point, raw markup appears in the output instead of a tool being executed

No minimal reproduction available — the issue appears intermittently in long sessions. It has not been observed in short sessions with few tool calls.

Claude Model

Not sure / Multiple models

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.191

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

Observed patterns (not confirmed root causes):

• Long conversation context (many files read, extended back-and-forth)
• Sequences where the model narrates its next action ("I'll read this file") immediately before attempting a tool call
• More frequent with Opus 4.8 than 4.6, but reproducible on both

Workaround: re-prompting on the same turn recovers normal behavior. Using /compact may reduce the frequency, but this has not been rigorously tested.