[BUG] Side chat on a third-party model gateway: an undeclared tool call leaks as raw DSML text and can hang the panel

Environment

• Claude Desktop 1.52386.6.0 (Windows 11, build 26200), Code tab, local session
• Model backend: third-party gateway via developer mode / 3P (model name claude-sonnet-5 mapped to a specific third-party backend, Anthropic-compatible endpoint)
• Bundled CLI engine 2.1.270

What happens

Opening the side chat (Ctrl+;) on a Code session and asking something that invites "checking" (e.g. "check the log", "what's the progress") can produce a reply in which the tool call is emitted as raw markup text instead of a structured tool call:

<||DSML|| calls>
<||DSML|| invoke name="Bash">
<||DSML|| parameter name="command" ...>ls -la ...; cat ...

Nothing executes, the markup is rendered verbatim in the panel, and the turn effectively stalls. It is intermittent — fails more often than it succeeds.

Diagnosis (from the app bundle + controlled requests)

• In this version the side chat's allowed tools are a read-only trio: Read, Grep, Glob — no Bash (the system-prompt append explicitly says "You CANNOT … run commands").
• Every leaked call observed was an attempt at an undeclared tool (Bash) that the model imitates from the session history (the history is full of shell usage).
• With this backend family, when the model goes for an undeclared tool, the call collapses into DSML text markup — a widely reported failure mode for it (e.g. vllm-project/vllm#51914: "intermittently emits malformed DSML tool-call start wrapper") — and the client has no fallback parser, so it renders raw text and the turn stalls.
• Controls: declared-tool calls work fine on the same gateway (3/3 clean, both OpenAI- and Anthropic-format probes). Clean short-context requests never leak; this only reproduces under real side-chat conditions (long shell-flavored history, inherited max effort, preset prompt).

Relation to existing reports

#91975 and #92651 describe the same visible symptom ("side chat hangs / stops responding after the first reply", "intermittent, fails more often than it succeeds") without identifying this layer. This report adds the root cause: undeclared-tool attempt → DSML text leak → no execution → stalled panel. Likely the same underlying issue; worth cross-linking.

Suggested hardening (client side)

1. Tolerate/sanitize DSML-family markup when it arrives as text from third-party backends; and/or
2. Detect attempts at tools that were not offered and return a corrective note to the model instead of stalling the turn.

Repro

1. Claude Desktop (Code tab), third-party gateway (Anthropic-compatible endpoint serving the same backend model).
2. In a session whose recent history includes shell commands, open the side chat and ask something like "check the log / what's the progress".
3. Observe the raw <||DSML|| …> text and the stalled turn. — Instructing the side chat to "just answer, don't run anything" produces a clean reply, confirming the leak is tied to off-protocol tool attempts.

🤖 Drafted and filed by Claude (Claude Code) at the user's request.