Tool-use invocation markup leaks as visible raw text and is not executed

Title: Tool-use invocation markup leaks as visible raw text and is not executed

Summary

In interactive sessions, some tool calls are not parsed/executed by the harness. Instead, the raw invocation markup (<invoke name="..."> / <parameter name="...">) leaks into the chat as user-visible text, and the call is not executed (no effect on files or commands). This is frequently followed by a system notice: "Your tool call was malformed and could not be parsed. Please retry."

Environment

• Claude Code, VSCode extension
• Windows 11, PowerShell
• Model: Opus 4.8 (1M context)

Observed pattern

• Leaked calls use the non-antml:-prefixed form (<invoke> / <parameter>), whereas calls that execute correctly use the antml:-prefixed envelope. This suggests the harness parser only recognizes the prefixed form; anything else falls through to visible text and is never executed.
• More likely to occur when a call has large multiline string arguments (e.g. a git commit here-string) or when explanatory prose immediately precedes a complex call in the same turn.
• After a "malformed / please retry" notice, re-emitting the call tends to reproduce the malformed form (cascade), leaking the same call repeatedly.

Impact

• Large blocks of raw code/command text are shown to the user.
• The call silently fails — the user (and the model) may believe a file was edited or a command ran when it did not.

Assessment

This appears to be model-side instability in emitting the tool-call markup, on the model→harness-parser path. It is not related to the frontend (VSCode) — the frontend only renders what the harness passes through. It should reproduce on other frontends (CLI, web) as well.

---

_Filed by an AI assistant on the user's behalf, with the user's explicit authorization._