From 196e3c46f6f65edefa8565b4baf611640e115a75 Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Sun, 10 May 2026 09:27:30 +0700
Subject: [PATCH] feat(toolcall): harden confusable candidate spans

---
 docs/prompt-compatibility.md                  |    4 +-
 docs/toolcall-semantics.md                    |    4 +
 .../openai/leaked_output_sanitize_test.go     |    8 +
 .../openai/shared/leaked_output_sanitize.go   |    9 +-
 internal/js/chat-stream/sse_parse_impl.js     |   10 +-
 .../js/helpers/stream-tool-sieve/parse.js     |   43 +-
 .../stream-tool-sieve/parse_payload.js        | 1153 ++++++++++++++---
 .../js/helpers/stream-tool-sieve/sieve-xml.js |   34 +
 .../js/helpers/stream-tool-sieve/sieve.js     |    4 +
 internal/toolcall/toolcalls_candidates.go     |  689 +++++++++-
 internal/toolcall/toolcalls_dsml.go           |   89 +-
 internal/toolcall/toolcalls_markup.go         |   40 +-
 internal/toolcall/toolcalls_parse.go          |   35 +-
 internal/toolcall/toolcalls_parse_markup.go   |   45 +-
 internal/toolcall/toolcalls_scan.go           |   44 +-
 internal/toolcall/toolcalls_test.go           |  105 ++
 internal/toolstream/tool_sieve_xml.go         |   18 +-
 internal/toolstream/tool_sieve_xml_test.go    |  163 +++
 tests/node/chat-stream.test.js                |   10 +
 tests/node/stream-tool-sieve.test.js          |  113 ++
 20 files changed, 2257 insertions(+), 363 deletions(-)

diff --git a/docs/prompt-compatibility.md b/docs/prompt-compatibility.md
index fb03021..6fcc1ab 100644
--- a/docs/prompt-compatibility.md
+++ b/docs/prompt-compatibility.md
@@ -168,7 +168,7 @@ OpenAI Chat / Responses 在标准化后、current input file 之前，会默认
 4. 把这整段内容并入 system prompt。
 
 工具调用正例现在优先示范全角分隔符 DSML 风格：`<｜DSML｜tool_calls>` → `<｜DSML｜invoke name="...">` → `<｜DSML｜parameter name="...">`。
-兼容层仍接受旧式纯 `<tool_calls>` wrapper，并会容错若干 DSML 标签变体，包括短横线形式 `<dsml-tool-calls>` / `<dsml-invoke>` / `<dsml-parameter>`、下划线形式 `<dsml_tool_calls>` / `<dsml_invoke>` / `<dsml_parameter>`，以及其他前缀分隔形态如 `<vendor|tool_calls>` / `<vendor_tool_calls>` / `<vendor - tool_calls>`；标签壳扫描还会把全角 ASCII 漂移归一化，例如 `<ｄＳＭＬ｜tool_calls>` 与全角 `＞` 结束符，也会容错 CJK 尖括号、全角感叹号或顿号分隔符、弯引号属性值、PascalCase 本地名和属性尾部分隔符漂移，例如 `<DSM｜parameter name="command"｜>...〈/DSM｜parameter〉`、`<！DSML！invoke name=“Bash”>`、`<、DSML、tool_calls>`、`<DSmartToolCalls>`、`<DSMLtool_calls※>`。更一般地，Go / Node tag 扫描以固定本地标签名 `tool_calls` / `invoke` / `parameter` 为准，标签名前或标签名后的非结构性协议分隔符都会在解析入口剥离，例如 `<DSML␂tool_calls>`、`<proto💥tool_calls>` 这类控制符或非 ASCII 分隔符漂移也会归一化回现有 XML 标签后继续走同一套 parser；结构性字符如 `<` / `>` / `/` / `=` / 引号、空白和 ASCII 字母数字不会被当作这类分隔符。CDATA 开头也使用同一类扫描式容错，`<![CDATA[` / `<！[CDATA[` / `<、[CDATA[` 都会作为参数原文容器处理。但提示词会优先要求模型输出官方 DSML 标签，并强调不能只输出 closing wrapper 而漏掉 opening tag。需要注意：这是“兼容 DSML 外壳，内部仍以 XML 解析语义为准”，不是原生 DSML 全链路实现。解析器会先截获非代码块中的疑似工具 wrapper，完整解析失败或工具语义无效时再按普通文本放行。
+兼容层仍接受旧式纯 `<tool_calls>` wrapper，并会容错若干 DSML 标签变体，包括短横线形式 `<dsml-tool-calls>` / `<dsml-invoke>` / `<dsml-parameter>`、下划线形式 `<dsml_tool_calls>` / `<dsml_invoke>` / `<dsml_parameter>`，以及其他前缀分隔形态如 `<vendor|tool_calls>` / `<vendor_tool_calls>` / `<vendor - tool_calls>`；标签壳扫描还会把全角 ASCII 漂移归一化，例如 `<ｄＳＭＬ｜tool_calls>` 与全角 `＞` 结束符，也会容错 CJK 尖括号、全角感叹号或顿号分隔符、弯引号属性值、PascalCase 本地名和属性尾部分隔符漂移，例如 `<DSM｜parameter name="command"｜>...〈/DSM｜parameter〉`、`<！DSML！invoke name=“Bash”>`、`<、DSML、tool_calls>`、`<DSmartToolCalls>`、`<DSMLtool_calls※>`。更一般地，Go / Node tag 扫描以固定本地标签名 `tool_calls` / `invoke` / `parameter` 为准，标签名前或标签名后的非结构性协议分隔符都会在解析入口剥离，例如 `<DSML␂tool_calls>`、`<proto💥tool_calls>` 这类控制符或非 ASCII 分隔符漂移也会归一化回现有 XML 标签后继续走同一套 parser；结构性字符如 `<` / `>` / `/` / `=` / 引号、空白和 ASCII 字母数字不会被当作这类分隔符。进入现有 DSML rewrite / XML parse 之前，Go / Node 还会先对“已经识别成工具标签壳的 candidate span”做一次窄 canonicalization：只折叠 wrapper / `invoke` / `parameter` / `name` / `CDATA` / `DSML` 及其壳层分隔符里的 confusable 字符，清理零宽 / BOM / 控制类干扰，并把引号、空白、dash / underscore 变体等统一回可解析的工具语法。这个阶段不会广义改写普通正文、参数内容、CDATA 里的示例文本或其他非工具 XML。CDATA 开头也使用同一类扫描式容错，`<![CDATA[` / `<！[CDATA[` / `<、[CDATA[` 都会作为参数原文容器处理。但提示词会优先要求模型输出官方 DSML 标签，并强调不能只输出 closing wrapper 而漏掉 opening tag。需要注意：这是“兼容 DSML 外壳，内部仍以 XML 解析语义为准”，不是原生 DSML 全链路实现。解析器会先截获非代码块中的疑似工具 wrapper，完整解析失败或工具语义无效时再按普通文本放行。
 数组参数使用 `<item>...</item>` 子节点表示；当某个参数体只包含 item 子节点时，Go / Node 解析器会把它还原成数组，避免 `questions` / `options` 这类 schema 中要求 array 的参数被误解析成 `{ "item": ... }` 对象。除此之外，解析器还会回收一些更松散的列表写法，例如 JSON array 字面量或逗号分隔的 JSON 项序列，只要它们足够明确；但 `<item>` 仍然是首选形态。若模型把完整结构化 XML fragment 误包进 CDATA，兼容层会在保护 `content` / `command` 等原文字段的前提下，尝试把非原文字段中的 CDATA XML fragment 还原成 object / array。不过，如果 CDATA 只是单个平面的 XML/HTML 标签，例如 `<b>urgent</b>` 这种行内标记，兼容层会保留原始字符串，不会强行升成 object / array；只有明显表示结构的 CDATA 片段，例如多兄弟节点、嵌套子节点或 `item` 列表，才会触发结构化恢复。对 `command` / `content` 等长文本参数，CDATA 内部的 Markdown fenced DSML / XML 示例会作为原文保护；示例里的 `]]></parameter>` 或 `</tool_calls>` 不会截断外层工具调用，解析器会继续等待围栏外真正的参数 / wrapper 结束标签。
 Go 侧读取 DeepSeek SSE 时不再依赖 `bufio.Scanner` 的固定 2MiB 单行上限；当写文件类工具把很长的 `content` 放在单个 `data:` 行里返回时，非流式收集、流式解析和 auto-continue 透传都会保留完整行，再进入同一套工具解析与序列化流程。
 在 assistant 最终回包阶段，如果某个 tool 参数在声明 schema 中明确是 `string`，兼容层会在把解析后的 `tool_calls` / `function_call` 重新序列化成 OpenAI / Responses / Claude 可见参数前，递归把该路径上的 number / bool / object / array 统一转成字符串；其中 object / array 会压成紧凑 JSON 字符串。这个保护只对 schema 明确声明为 string 的路径生效，不会改写本来就是 `number` / `boolean` / `object` / `array` 的参数。这样可以兼容 DeepSeek 输出了结构化片段、但上游客户端工具 schema 又严格要求字符串参数的场景（例如 `content`、`prompt`、`path`、`taskId` 等）。
@@ -225,7 +225,7 @@ assistant 历史 `tool_calls` 不会保留成 OpenAI 原生 JSON，而会转成
 如果客户端历史里没有结构化 `tool_calls` 字段、却把一个可独立解析的 assistant 工具块放进了普通 `content`，兼容层会在写入后续 prompt 前先按工具调用解析它，再重渲染为规范 DSML 历史外壳。这样可以避免一次 malformed 工具块未被结构化保存后，作为普通 assistant 文本回灌，继续污染后续模型的 few-shot 工具格式。
 
 解析层同时兼容旧式纯 XML 形态：`<tool_calls>` / `<invoke>` / `<parameter>`。两者都会先归一到现有 XML 解析语义；其他旧格式都会作为普通文本保留，不会作为可执行调用语法。
-例外是 parser 会对一个非常窄的模型失误做修复：如果 assistant 输出了 `<invoke ...>` ... `</tool_calls>`（或 DSML 对应标签），但漏掉最前面的 opening wrapper，解析阶段会补回 wrapper 后再尝试识别。
+例外是 parser 会对一个非常窄的模型失误做修复：如果 assistant 输出了 `<invoke ...>` ... `</tool_calls>`（或 DSML 对应标签），但漏掉最前面的 opening wrapper，解析阶段会在 wrapper-confidence 足够高时补回 wrapper 后再尝试识别。这里的 wrapper-confidence 指 scanner 已经识别出白名单工具壳结构，剩余失败只像壳层结构漂移，而不是语义上接近但不在白名单内的 near-miss 标签名。修复成功时，wrapper 后面的 suffix prose 会继续保留在可见文本里；修复失败时，该块仍按普通文本处理。
 
 这件事很重要，因为它决定了：
 
diff --git a/docs/toolcall-semantics.md b/docs/toolcall-semantics.md
index 4deb80d..598eb47 100644
--- a/docs/toolcall-semantics.md
+++ b/docs/toolcall-semantics.md
@@ -39,8 +39,11 @@
 兼容修复：
 
 - 如果模型漏掉 opening wrapper，但后面仍输出了一个或多个 invoke 并以 closing wrapper 收尾，Go 解析链路会在解析前补回缺失的 opening wrapper。
+- 在进入现有 DSML rewrite / XML parse 之前，Go / Node 都会先做一次非常窄的 candidate-span canonicalization：只处理已经被 scanner 识别为工具标签壳的 wrapper / `invoke` / `parameter` / `name` / `CDATA` / `DSML` 及其结构分隔符；这里会移除零宽 / BOM / 控制类干扰字符，并把 `<`、`>`、`/`、`|`、`=`、引号、Unicode 空白、常见 dash / underscore 变体这类工具语法外壳符号折回 ASCII 语义。
 - Go / Node 解析层不再枚举每一种 DSML typo。它以固定本地标签名 `tool_calls` / `invoke` / `parameter` 为准，把标签名前的任意协议前缀壳视为可容忍噪声，并继续兼容管道符 `|` / `｜`、全角感叹号 `！`、顿号 `、`、空白、重复 leading `<`、可视控制符 `␂`、原始 STX `\x02`、非 ASCII 分隔符、CJK 尖括号 `〈` / `〉`、弯引号属性值、PascalCase 本地名等漂移。例如 `<DSML|tool_calls>`、`<<|DSML|tool_calls>`、`<|DSML tool_calls>`、`<DSMLtool_calls>`、`<DSmartToolCalls>`、`<<DSML|DSML|tool_calls>`、`<DSML␂tool_calls>`、`<proto💥tool_calls>`、`<DSM｜tool_calls>...〈/DSM｜tool_calls〉`、`<！DSML！tool_calls>...<！/DSML！tool_calls>`、`<、DSML、tool_calls>...<、/DSML、tool_calls>` 都会归一化；相似但非固定标签名（如 `tool_calls_extra` / `ToolCallsExtra`）仍按普通文本处理。
+- 这个 candidate-span canonicalization 不会对普通 prose、参数正文、CDATA 内容或嵌套的非工具 XML 做广义 Unicode 归一化。也就是说，参数里的示例 `<invοke>`、普通聊天文本里的 confusable 单词、或其他非工具壳 XML 片段都保持原样；只有真正落在工具标签壳上的 whitelist 关键字和结构符号会被折叠。
 - 如果模型在固定工具标签名后多输出一个非结构性分隔符，例如 `<|DSML|tool_calls|` / `<|DSML|invoke|` / `<|DSML|parameter|` / `<DSMLtool_calls※>`，或在带属性标签的结束符前多输出一个尾部分隔符（如 `<DSM｜parameter name="command"｜>`），兼容层会把这个尾部分隔符当作异常标签终止符并补齐或归一化；如果后面已经有 `>` / `〉`，也会消费这个多余分隔符后再归一化。结构性字符如 `<` / `>` / `/` / `=` / 引号、空白和 ASCII 字母数字不会被当作这类分隔符。
+- “缺失 opening wrapper”的修复只会在 wrapper-confidence 足够高时触发：scanner 必须已经识别出白名单工具壳结构（wrapper / invoke / parameter / `name=` 等），且剩余失败看起来只是壳层结构问题。相似但不在白名单内的 near-miss 标签名，或缺少足够 wrapper 证据的 malformed 片段，仍会按普通文本透传。
 - 这是一个针对常见模型失误的窄修复，不改变推荐输出格式；prompt 仍要求模型直接输出完整 DSML 外壳。
 - 裸 `<invoke ...>` / `<parameter ...>` 不会被当成“已支持的工具语法”；只有 `tool_calls` wrapper 或可修复的缺失 opening wrapper 才会进入工具调用路径。
 
@@ -58,6 +61,7 @@
 - 如果流里直接从 invoke 开始，但后面补上了 closing wrapper，Go 流式筛分也会按缺失 opening wrapper 的修复路径尝试恢复
 - 已识别成功的工具调用不会再次回流到普通文本
 - 不符合新格式的块不会执行，并继续按原样文本透传
+- 如果一个 confusable / 漂移过的工具壳在 candidate-span canonicalization + repair 后仍能形成有效工具调用，wrapper 后面的 suffix prose 会继续按普通文本输出；如果 canonicalization 后仍不满足 wrapper-confidence 或 XML 语义，整块就作为普通文本释放，不会半吞半漏。
 - fenced code block（反引号 `` ``` `` 和波浪线 `~~~`）中的 XML 示例始终按普通文本处理
 - 支持嵌套围栏（如 4 反引号嵌套 3 反引号）和 CDATA 内围栏保护
 - 对 `command` / `content` 等长文本参数，CDATA 内部如果包含 Markdown fenced DSML / XML 示例，即使示例里出现 `]]></parameter>` / `</tool_calls>` 这类看起来像外层结束标签的片段，也会继续按参数原文保留，直到真正位于围栏外的外层结束标签
diff --git a/internal/httpapi/openai/leaked_output_sanitize_test.go b/internal/httpapi/openai/leaked_output_sanitize_test.go
index acaf720..3b2884b 100644
--- a/internal/httpapi/openai/leaked_output_sanitize_test.go
+++ b/internal/httpapi/openai/leaked_output_sanitize_test.go
@@ -34,6 +34,14 @@ func TestSanitizeLeakedOutputRemovesThinkAndBosMarkers(t *testing.T) {
 	}
 }
 
+func TestSanitizeLeakedOutputRemovesThoughtMarkers(t *testing.T) {
+	raw := "A<｜▁of▁thought｜>B<| of_thought |>C<| begin_of_thought |>D<| end_of_thought |>E"
+	got := sanitizeLeakedOutput(raw)
+	if got != "ABCDE" {
+		t.Fatalf("unexpected sanitize result for leaked thought markers: %q", got)
+	}
+}
+
 func TestSanitizeLeakedOutputRemovesDanglingThinkBlock(t *testing.T) {
 	raw := "Answer prefix<think>internal reasoning that never closes"
 	got := sanitizeLeakedOutput(raw)
diff --git a/internal/httpapi/openai/shared/leaked_output_sanitize.go b/internal/httpapi/openai/shared/leaked_output_sanitize.go
index 5e54637..b45a3ac 100644
--- a/internal/httpapi/openai/shared/leaked_output_sanitize.go
+++ b/internal/httpapi/openai/shared/leaked_output_sanitize.go
@@ -18,10 +18,16 @@ var leakedThinkTagPattern = regexp.MustCompile(`(?is)</?\s*think\s*>`)
 //   - U+2581 variant:   <｜begin▁of▁sentence｜>
 var leakedBOSMarkerPattern = regexp.MustCompile(`(?i)<[｜\|]\s*begin[_▁]of[_▁]sentence\s*[｜\|]>`)
 
+// leakedThoughtMarkerPattern matches leaked thought control markers in both
+// explicit and compact forms:
+//   - ASCII underscore: <| of_thought |>, <| begin_of_thought |>
+//   - U+2581 variant:   <｜▁of▁thought｜>, <｜begin▁of▁thought｜>
+var leakedThoughtMarkerPattern = regexp.MustCompile(`(?i)<[｜\|]\s*(?:begin[_▁])?[_▁]*of[_▁]thought\s*[｜\|]>`)
+
 // leakedMetaMarkerPattern matches the remaining DeepSeek special tokens in BOTH forms:
 //   - ASCII underscore: <｜end_of_sentence｜>, <｜end_of_toolresults｜>, <｜end_of_instructions｜>
 //   - U+2581 variant:   <｜end▁of▁sentence｜>, <｜end▁of▁toolresults｜>, <｜end▁of▁instructions｜>
-var leakedMetaMarkerPattern = regexp.MustCompile(`(?i)<[｜\|]\s*(?:assistant|tool|end[_▁]of[_▁]sentence|end[_▁]of[_▁]thinking|end[_▁]of[_▁]toolresults|end[_▁]of[_▁]instructions)\s*[｜\|]>`)
+var leakedMetaMarkerPattern = regexp.MustCompile(`(?i)<[｜\|]\s*(?:assistant|tool|end[_▁]of[_▁]sentence|end[_▁]of[_▁]thinking|end[_▁]of[_▁]thought|end[_▁]of[_▁]toolresults|end[_▁]of[_▁]instructions)\s*[｜\|]>`)
 
 // leakedAgentXMLBlockPatterns catch agent-style XML blocks that leak through
 // when the sieve fails to capture them. These are applied only to complete
@@ -48,6 +54,7 @@ func sanitizeLeakedOutput(text string) string {
 	out = stripDanglingThinkSuffix(out)
 	out = leakedThinkTagPattern.ReplaceAllString(out, "")
 	out = leakedBOSMarkerPattern.ReplaceAllString(out, "")
+	out = leakedThoughtMarkerPattern.ReplaceAllString(out, "")
 	out = leakedMetaMarkerPattern.ReplaceAllString(out, "")
 	out = stripLeakedToolCallWrapperBlocks(out)
 	out = sanitizeLeakedAgentXMLBlocks(out)
diff --git a/internal/js/chat-stream/sse_parse_impl.js b/internal/js/chat-stream/sse_parse_impl.js
index 6f5922e..4d9a121 100644
--- a/internal/js/chat-stream/sse_parse_impl.js
+++ b/internal/js/chat-stream/sse_parse_impl.js
@@ -7,6 +7,10 @@ const {
   SKIP_EXACT_PATHS,
 } = require('../shared/deepseek-constants');
 
+const LEAKED_BOS_MARKER_PATTERN = /<[｜|]\s*begin[_▁]of[_▁]sentence\s*[｜|]>/gi;
+const LEAKED_THOUGHT_MARKER_PATTERN = /<[｜|]\s*(?:begin[_▁])?[_▁]*of[_▁]thought\s*[｜|]>/gi;
+const LEAKED_META_MARKER_PATTERN = /<[｜|]\s*(?:assistant|tool|end[_▁]of[_▁]sentence|end[_▁]of[_▁]thinking|end[_▁]of[_▁]thought|end[_▁]of[_▁]toolresults|end[_▁]of[_▁]instructions)\s*[｜|]>/gi;
+
 
 
 function stripThinkTags(text) {
@@ -621,7 +625,11 @@ function stripReferenceMarkersText(text) {
   if (!text) {
     return text;
   }
-  return text.replace(/\[(?:citation|reference):\s*\d+\]/gi, '');
+  return text
+    .replace(/\[(?:citation|reference):\s*\d+\]/gi, '')
+    .replace(LEAKED_BOS_MARKER_PATTERN, '')
+    .replace(LEAKED_THOUGHT_MARKER_PATTERN, '')
+    .replace(LEAKED_META_MARKER_PATTERN, '');
 }
 
 function asString(v) {
diff --git a/internal/js/helpers/stream-tool-sieve/parse.js b/internal/js/helpers/stream-tool-sieve/parse.js
index f2ba3dc..7a70769 100644
--- a/internal/js/helpers/stream-tool-sieve/parse.js
+++ b/internal/js/helpers/stream-tool-sieve/parse.js
@@ -7,6 +7,9 @@ const {
   parseMarkupToolCalls,
   stripFencedCodeBlocks,
   containsToolCallWrapperSyntaxOutsideIgnored,
+  normalizeDSMLToolCallMarkup,
+  hasRepairableXMLToolCallsWrapper,
+  indexToolCDATAOpen,
   sanitizeLooseCDATA,
 } = require('./parse_payload');
 
@@ -37,19 +40,23 @@ function parseToolCalls(text, toolNames) {
 
 function parseToolCallsDetailed(text, toolNames) {
   const result = emptyParseResult();
-  const normalized = toStringSafe(text);
-  if (!normalized) {
+  const raw = toStringSafe(text);
+  if (!raw) {
     return result;
   }
-  result.sawToolCallSyntax = looksLikeToolCallSyntax(normalized);
-  if (shouldSkipToolCallParsingForCodeFenceExample(normalized)) {
+  if (shouldSkipToolCallParsingForCodeFenceExample(raw)) {
     return result;
   }
+  const normalized = normalizeDSMLToolCallMarkup(stripFencedCodeBlocks(raw).trim());
+  if (!normalized.ok || !normalized.text) {
+    return result;
+  }
+  result.sawToolCallSyntax = looksLikeToolCallSyntax(normalized.text) || hasRepairableXMLToolCallsWrapper(normalized.text);
   // XML markup parsing only.
-  let parsed = parseMarkupToolCalls(normalized);
-  if (parsed.length === 0 && normalized.toLowerCase().includes('<![cdata[')) {
-    const recovered = sanitizeLooseCDATA(normalized);
-    if (recovered !== normalized) {
+  let parsed = parseMarkupToolCalls(normalized.text);
+  if (parsed.length === 0 && indexToolCDATAOpen(normalized.text, 0) >= 0) {
+    const recovered = sanitizeLooseCDATA(normalized.text);
+    if (recovered !== normalized.text) {
       parsed = parseMarkupToolCalls(recovered);
     }
   }
@@ -70,19 +77,23 @@ function parseStandaloneToolCalls(text, toolNames) {
 
 function parseStandaloneToolCallsDetailed(text, toolNames) {
   const result = emptyParseResult();
-  const trimmed = toStringSafe(text);
-  if (!trimmed) {
+  const raw = toStringSafe(text);
+  if (!raw) {
     return result;
   }
-  result.sawToolCallSyntax = looksLikeToolCallSyntax(trimmed);
-  if (shouldSkipToolCallParsingForCodeFenceExample(trimmed)) {
+  if (shouldSkipToolCallParsingForCodeFenceExample(raw)) {
     return result;
   }
+  const normalized = normalizeDSMLToolCallMarkup(stripFencedCodeBlocks(raw).trim());
+  if (!normalized.ok || !normalized.text) {
+    return result;
+  }
+  result.sawToolCallSyntax = looksLikeToolCallSyntax(normalized.text) || hasRepairableXMLToolCallsWrapper(normalized.text);
   // XML markup parsing only.
-  let parsed = parseMarkupToolCalls(trimmed);
-  if (parsed.length === 0 && trimmed.toLowerCase().includes('<![cdata[')) {
-    const recovered = sanitizeLooseCDATA(trimmed);
-    if (recovered !== trimmed) {
+  let parsed = parseMarkupToolCalls(normalized.text);
+  if (parsed.length === 0 && indexToolCDATAOpen(normalized.text, 0) >= 0) {
+    const recovered = sanitizeLooseCDATA(normalized.text);
+    if (recovered !== normalized.text) {
       parsed = parseMarkupToolCalls(recovered);
     }
   }
diff --git a/internal/js/helpers/stream-tool-sieve/parse_payload.js b/internal/js/helpers/stream-tool-sieve/parse_payload.js
index a24bd62..37c4df6 100644
--- a/internal/js/helpers/stream-tool-sieve/parse_payload.js
+++ b/internal/js/helpers/stream-tool-sieve/parse_payload.js
@@ -2,6 +2,8 @@
 
 const CDATA_PATTERN = /^(?:<|〈)(?:!|！)\[CDATA\[([\s\S]*?)]](?:>|＞|〉)$/i;
 const XML_ATTR_PATTERN = /\b([a-z0-9_:-]+)\s*=\s*("([^"]*)"|'([^']*)')/gi;
+const XML_TOOL_CALLS_CLOSE_PATTERN = /[<＜][\/／]tool_calls\s*[>＞]/gi;
+const XML_INVOKE_START_PATTERN = /[<＜]invoke\b[^>＞]*\bname\s*[=＝]\s*(?:"([^"]*)"|'([^']*)'|“([^”]*)”|‘([^’]*)’|＂([^＂]*)＂|＇([^＇]*)＇)/i;
 const TOOL_MARKUP_NAMES = [
   { raw: 'tool_calls', canonical: 'tool_calls' },
   { raw: 'tool-calls', canonical: 'tool_calls', dsmlOnly: true },
@@ -88,8 +90,7 @@ function isFenceCloseLine(trimmed, fenceChar, fenceLen) {
 }
 
 function cdataStartsBeforeFence(line) {
-  const cdataOpen = findNextCDATAOpen(line, 0);
-  const cdataIdx = cdataOpen.ok ? cdataOpen.start : -1;
+  const cdataIdx = indexToolCDATAOpen(line, 0);
   if (cdataIdx < 0) return false;
   const fenceIdx = Math.min(
     line.indexOf('```') >= 0 ? line.indexOf('```') : Infinity,
@@ -99,21 +100,28 @@ function cdataStartsBeforeFence(line) {
 }
 
 function updateCDATAStateLine(inCDATA, line) {
-  const lower = line.toLowerCase();
   let pos = 0;
   let state = inCDATA;
-  while (pos < lower.length) {
+  while (pos < line.length) {
     if (state) {
-      const cdataEnd = findCDATAEnd(lower, pos);
-      const end = cdataEnd.index;
+      let end = -1;
+      let closeLen = 0;
+      for (let i = pos; i < line.length; i += 1) {
+        const foundLen = toolCDATACloseLenAt(line, i);
+        if (foundLen > 0) {
+          end = i;
+          closeLen = foundLen;
+          break;
+        }
+      }
       if (end < 0) return true;
-      pos = end + cdataEnd.len;
+      pos = end + closeLen;
       state = false;
       continue;
     }
-    const start = findNextCDATAOpen(line, pos);
-    if (!start.ok) return false;
-    pos = start.bodyStart;
+    const start = indexToolCDATAOpen(line, pos);
+    if (start < 0) return false;
+    pos = start + toolCDATAOpenLenAt(line, start);
     state = true;
   }
   return state;
@@ -124,12 +132,20 @@ function parseMarkupToolCalls(text) {
   if (!normalized.ok) {
     return [];
   }
-  const raw = normalized.text.trim();
+  let raw = normalized.text.trim();
   if (!raw) {
     return [];
   }
+  let wrappers = findXmlElementBlocks(raw, 'tool_calls');
+  if (wrappers.length === 0 && hasRepairableXMLToolCallsWrapper(raw)) {
+    const repaired = repairMissingXMLToolCallsOpeningWrapper(raw);
+    if (repaired !== raw) {
+      raw = repaired;
+      wrappers = findXmlElementBlocks(raw, 'tool_calls');
+    }
+  }
   const out = [];
-  for (const wrapper of findXmlElementBlocks(raw, 'tool_calls')) {
+  for (const wrapper of wrappers) {
     const body = toStringSafe(wrapper.body);
     for (const block of findXmlElementBlocks(body, 'invoke')) {
       const parsed = parseMarkupSingleToolCall(block);
@@ -146,12 +162,13 @@ function normalizeDSMLToolCallMarkup(text) {
   if (!raw) {
     return { text: '', ok: true };
   }
-  const styles = containsToolMarkupSyntaxOutsideIgnored(raw);
-  if (!styles.dsml) {
-    return { text: raw, ok: true };
+  const canonicalized = canonicalizeToolCallCandidateSpans(raw);
+  const styles = containsToolMarkupSyntaxOutsideIgnored(canonicalized);
+  if (!styles.dsml && !styles.canonical) {
+    return { text: canonicalized, ok: true };
   }
   return {
-    text: replaceDSMLToolMarkupOutsideIgnored(raw),
+    text: replaceDSMLToolMarkupOutsideIgnored(canonicalized),
     ok: true,
   };
 }
@@ -170,9 +187,8 @@ function containsToolCallWrapperSyntaxOutsideIgnored(text) {
   if (!raw) {
     return styles;
   }
-  const lower = raw.toLowerCase();
   for (let i = 0; i < raw.length;) {
-    const skipped = skipXmlIgnoredSection(lower, i);
+    const skipped = skipXmlIgnoredSection(raw, i);
     if (skipped.blocked) {
       return styles;
     }
@@ -208,7 +224,7 @@ function containsToolMarkupSyntaxOutsideIgnored(text) {
     return styles;
   }
   for (let i = 0; i < raw.length;) {
-    const skipped = skipXmlIgnoredSection(raw.toLowerCase(), i);
+    const skipped = skipXmlIgnoredSection(raw, i);
     if (skipped.blocked) {
       return styles;
     }
@@ -239,10 +255,9 @@ function replaceDSMLToolMarkupOutsideIgnored(text) {
   if (!raw) {
     return '';
   }
-  const lower = raw.toLowerCase();
   let out = '';
   for (let i = 0; i < raw.length;) {
-    const skipped = skipXmlIgnoredSection(lower, i);
+    const skipped = skipXmlIgnoredSection(raw, i);
     if (skipped.blocked) {
       out += raw.slice(i);
       break;
@@ -254,15 +269,7 @@ function replaceDSMLToolMarkupOutsideIgnored(text) {
     }
     const tag = scanToolMarkupTagAt(raw, i);
     if (tag) {
-      if (tag.dsmlLike) {
-        const tail = normalizeToolMarkupTagTailForXML(raw.slice(tag.nameEnd, tag.end + 1));
-        out += `<${tag.closing ? '/' : ''}${tag.name}${tail}`;
-        if (!tail.endsWith('>')) {
-          out += '>';
-        }
-      } else {
-        out += raw.slice(tag.start, tag.end + 1);
-      }
+      out += `<${tag.closing ? '/' : ''}${tag.name}${raw.slice(tag.nameEnd, tag.end)}>`;
       i = tag.end + 1;
       continue;
     }
@@ -345,7 +352,7 @@ function findXmlStartTagOutsideCDATA(text, tag, from) {
   const lower = text.toLowerCase();
   const target = `<${tag}`;
   for (let i = Math.max(0, from || 0); i < text.length;) {
-    const skipped = skipXmlIgnoredSection(lower, i);
+    const skipped = skipXmlIgnoredSection(text, i);
     if (skipped.blocked) {
       return null;
     }
@@ -375,7 +382,7 @@ function findMatchingXmlEndTagOutsideCDATA(text, tag, from) {
   const closeTarget = `</${tag}`;
   let depth = 1;
   for (let i = Math.max(0, from || 0); i < text.length;) {
-    const skipped = skipXmlIgnoredSection(lower, i);
+    const skipped = skipXmlIgnoredSection(text, i);
     if (skipped.blocked) {
       return null;
     }
@@ -411,18 +418,18 @@ function findMatchingXmlEndTagOutsideCDATA(text, tag, from) {
   return null;
 }
 
-function skipXmlIgnoredSection(lower, i) {
-  const cdataOpen = matchCDATAOpenAt(lower, i);
-  if (cdataOpen.ok) {
-    const cdataEnd = findCDATAEnd(lower, cdataOpen.bodyStart);
-    const end = cdataEnd.index;
+function skipXmlIgnoredSection(text, i) {
+  const raw = toStringSafe(text);
+  const openLen = toolCDATAOpenLenAt(raw, i);
+  if (openLen > 0) {
+    const end = findToolCDATAEnd(raw, i + openLen);
     if (end < 0) {
       return { advanced: false, blocked: true, next: i };
     }
-    return { advanced: true, blocked: false, next: end + cdataEnd.len };
+    return { advanced: true, blocked: false, next: end + toolCDATACloseLenAt(raw, end) };
   }
-  if (lower.startsWith('<!--', i)) {
-    const end = lower.indexOf('-->', i + '<!--'.length);
+  if (raw.startsWith('<!--', i)) {
+    const end = raw.indexOf('-->', i + '<!--'.length);
     if (end < 0) {
       return { advanced: false, blocked: true, next: i };
     }
@@ -433,35 +440,17 @@ function skipXmlIgnoredSection(lower, i) {
 
 function findNextCDATAOpen(text, from) {
   const raw = toStringSafe(text);
-  for (let i = Math.max(0, from || 0); i < raw.length; i += 1) {
-    if (normalizeFullwidthASCIIChar(raw[i]) !== '<') {
-      continue;
-    }
-    const open = matchCDATAOpenAt(raw, i);
-    if (open.ok) {
-      return { ok: true, start: i, bodyStart: open.bodyStart };
-    }
+  const start = indexToolCDATAOpen(raw, from || 0);
+  if (start < 0) {
+    return { ok: false, start: -1, bodyStart: -1 };
   }
-  return { ok: false, start: -1, bodyStart: -1 };
+  return { ok: true, start, bodyStart: start + toolCDATAOpenLenAt(raw, start) };
 }
 
 function matchCDATAOpenAt(text, start) {
   const raw = toStringSafe(text);
-  if (start < 0 || start >= raw.length || normalizeFullwidthASCIIChar(raw[start]) !== '<') {
-    return { ok: false, bodyStart: start };
-  }
-  let i = start + 1;
-  for (let skipped = 0; skipped <= 4 && i < raw.length; skipped += 1) {
-    const matched = matchNormalizedASCII(raw, i, '[cdata[');
-    if (matched.ok) {
-      return { ok: true, bodyStart: i + matched.len };
-    }
-    if (!isCDATAOpenSeparator(raw[i])) {
-      break;
-    }
-    i += 1;
-  }
-  return { ok: false, bodyStart: start };
+  const openLen = toolCDATAOpenLenAt(raw, start);
+  return openLen > 0 ? { ok: true, bodyStart: start + openLen } : { ok: false, bodyStart: start };
 }
 
 function isCDATAOpenSeparator(ch) {
@@ -469,39 +458,30 @@ function isCDATAOpenSeparator(ch) {
 }
 
 function findCDATAEnd(text, from) {
-  const ascii = text.indexOf(']]>', from);
-  const fullwidth = text.indexOf(']]＞', from);
-  const cjk = text.indexOf(']]〉', from);
-  if (ascii < 0 && fullwidth < 0 && cjk < 0) {
-    return { index: -1, len: 0 };
-  }
-  let best = { index: -1, len: 0 };
-  for (const candidate of [
-    { index: ascii, len: ']]>'.length },
-    { index: fullwidth, len: ']]＞'.length },
-    { index: cjk, len: ']]〉'.length },
-  ]) {
-    if (candidate.index >= 0 && (best.index < 0 || candidate.index < best.index)) {
-      best = candidate;
-    }
-  }
-  return best;
+  const raw = toStringSafe(text);
+  const index = findToolCDATAEnd(raw, from);
+  return { index, len: index >= 0 ? toolCDATACloseLenAt(raw, index) : 0 };
 }
 
 function scanToolMarkupTagAt(text, start) {
   const raw = toStringSafe(text);
-  if (!raw || start < 0 || start >= raw.length || normalizeFullwidthASCIIChar(raw[start]) !== '<') {
+  const startDelimLen = xmlTagStartDelimiterLenAt(raw, start);
+  if (!raw || start < 0 || start >= raw.length || !startDelimLen) {
     return null;
   }
   const lower = raw.toLowerCase();
-  let i = start + 1;
-  while (i < raw.length && normalizeFullwidthASCIIChar(raw[i]) === '<') {
-    i += 1;
-  }
-  let closing = raw[i] === '/';
-  if (closing) {
-    i += 1;
+  let i = start + startDelimLen;
+  while (i < raw.length) {
+    i = skipToolMarkupIgnorables(raw, i);
+    const delimLen = xmlTagStartDelimiterLenAt(raw, i);
+    if (!delimLen) {
+      break;
+    }
+    i += delimLen;
   }
+  const slash = consumeToolMarkupClosingSlash(raw, i);
+  let closing = slash.closing;
+  i = slash.next;
   const prefix = consumeToolMarkupNamePrefix(raw, lower, i);
   const prefixStart = i;
   i = prefix.next;
@@ -522,8 +502,12 @@ function scanToolMarkupTagAt(text, start) {
   }
   const originalNameEnd = i + len;
   let nameEnd = originalNameEnd;
-  while (nameEnd < raw.length && isToolMarkupSeparator(raw[nameEnd])) {
-    nameEnd += 1;
+  while (true) {
+    const nextPipe = consumeToolMarkupSeparator(raw, nameEnd);
+    if (!nextPipe.ok) {
+      break;
+    }
+    nameEnd = nextPipe.next;
   }
   const hasTrailingSeparator = nameEnd > originalNameEnd;
   if (!hasXmlTagBoundary(raw, nameEnd)) {
@@ -552,7 +536,7 @@ function scanToolMarkupTagAt(text, start) {
     nameEnd,
     name,
     closing,
-    selfClosing: raw.slice(start, end + 1).trim().endsWith('/>'),
+    selfClosing: isSelfClosingXmlTag(raw.slice(start, end)),
     dsmlLike,
     canonical: !dsmlLike,
   };
@@ -560,9 +544,8 @@ function scanToolMarkupTagAt(text, start) {
 
 function findToolMarkupTagOutsideIgnored(text, from) {
   const raw = toStringSafe(text);
-  const lower = raw.toLowerCase();
   for (let i = Math.max(0, from || 0); i < raw.length;) {
-    const skipped = skipXmlIgnoredSection(lower, i);
+    const skipped = skipXmlIgnoredSection(raw, i);
     if (skipped.blocked) {
       return null;
     }
@@ -609,13 +592,13 @@ function findMatchingToolMarkupClose(text, openTag) {
 
 function findPartialToolMarkupStart(text) {
   const raw = toStringSafe(text);
-  const lastLT = raw.lastIndexOf('<');
+  const lastLT = lastIndexOfToolMarkupStartDelimiter(raw);
   if (lastLT < 0) {
     return -1;
   }
   const start = includeDuplicateLeadingLessThan(raw, lastLT);
   const tail = raw.slice(start);
-  if (tail.includes('>') || tail.includes('＞')) {
+  if (containsXmlTagTerminator(tail)) {
     return -1;
   }
   return isPartialToolMarkupTagPrefix(tail) ? start : -1;
@@ -623,13 +606,20 @@ function findPartialToolMarkupStart(text) {
 
 function includeDuplicateLeadingLessThan(text, idx) {
   let out = idx;
-  while (out > 0 && text[out - 1] === '<') {
+  while (out > 0 && isXmlTagStartDelimiter(text[out - 1])) {
     out -= 1;
   }
   return out;
 }
 
+function isXmlTagStartDelimiter(ch) {
+  return ['<', '＜', '﹤', '〈'].includes(ch);
+}
+
 function isToolMarkupSeparator(ch) {
+  if (isToolMarkupWhitespaceLike(ch)) {
+    return false;
+  }
   const normalized = normalizeFullwidthASCIIChar(ch || '');
   if (!normalized || ['<', '>', '/', '=', '"', "'", '['].includes(normalized)) {
     return false;
@@ -640,21 +630,26 @@ function isToolMarkupSeparator(ch) {
   return !/^[A-Za-z0-9]$/.test(normalized);
 }
 
+function isToolMarkupWhitespaceLike(ch) {
+  return !!ch && (/\s/u.test(ch) || ch === '▁');
+}
+
 function isPartialToolMarkupTagPrefix(text) {
   const raw = toStringSafe(text);
-  if (!raw || raw[0] !== '<' || raw.includes('>')) {
+  if (!raw || !isXmlTagStartDelimiter(raw[0]) || containsXmlTagTerminator(raw)) {
     return false;
   }
   const lower = raw.toLowerCase();
   let i = 1;
-  while (i < raw.length && raw[i] === '<') {
+  while (i < raw.length && isXmlTagStartDelimiter(raw[i])) {
     i += 1;
   }
   if (i >= raw.length) {
     return true;
   }
-  if (raw[i] === '/') {
-    i += 1;
+  const slash = consumeToolMarkupClosingSlash(raw, i);
+  if (slash.closing) {
+    i = slash.next;
   }
   while (i <= raw.length) {
     if (i === raw.length) {
@@ -663,7 +658,7 @@ function isPartialToolMarkupTagPrefix(text) {
     if (hasToolMarkupNamePrefix(raw, i)) {
       return true;
     }
-    if (normalizedASCIITailAt(raw, i).startsWith('dsml') || 'dsml'.startsWith(normalizedASCIITailAt(raw, i))) {
+    if (hasDSMLNamePrefixOrPartial(raw, i)) {
       return true;
     }
     if (hasPartialToolMarkupNameAfterArbitraryPrefix(raw, i)) {
@@ -697,10 +692,14 @@ function matchToolMarkupNameAfterArbitraryPrefix(raw, start) {
       return { ok: false };
     }
     for (const name of TOOL_MARKUP_NAMES) {
-      const matched = matchNormalizedASCII(raw, idx, name.raw);
-      if (!matched.ok) continue;
-      if (!toolMarkupPrefixAllowsLocalNameAt(raw, start, idx)) continue;
-      return { ok: true, name: name.canonical, start: idx, len: matched.len };
+      const matched = consumeToolKeyword(raw, idx, name.raw);
+      if (!matched.ok) {
+        continue;
+      }
+      if (!toolMarkupPrefixAllowsLocalNameAt(raw, start, idx)) {
+        continue;
+      }
+      return { ok: true, name: name.canonical, start: idx, len: matched.next - idx };
     }
     idx += 1;
   }
@@ -725,7 +724,7 @@ function hasPartialToolMarkupNameAfterArbitraryPrefix(raw, start) {
 
 function hasDSMLNamePrefixOrPartial(raw, start) {
   const tail = normalizedASCIITailAt(raw, start);
-  return tail.startsWith('dsml') || 'dsml'.startsWith(tail);
+  return tail.startsWith('dsml') || 'dsml'.startsWith(tail) || hasConfusablePartialKeywordPrefix(raw, start, 'dsml');
 }
 
 function toolMarkupPrefixAllowsLocalName(prefix) {
@@ -735,7 +734,7 @@ function toolMarkupPrefixAllowsLocalName(prefix) {
   if (normalizedASCIITailAt(prefix, 0).includes('dsml')) {
     return true;
   }
-  if (/[="'"]/.test(prefix)) {
+  if (/[="']/u.test(prefix)) {
     return false;
   }
   const previous = normalizeFullwidthASCIIChar(prefix[prefix.length - 1] || '');
@@ -750,7 +749,7 @@ function toolMarkupPrefixAllowsLocalNameAt(raw, start, localStart) {
   if (toolMarkupPrefixAllowsLocalName(prefix)) {
     return true;
   }
-  if (/[="'"]/.test(prefix)) {
+  if (/[="']/u.test(prefix)) {
     return false;
   }
   const previous = normalizeFullwidthASCIIChar(prefix[prefix.length - 1] || '');
@@ -772,18 +771,24 @@ function isToolMarkupTagTerminator(raw, idx) {
 }
 
 function consumeToolMarkupNamePrefixOnce(raw, lower, idx) {
-  if (idx < raw.length && isToolMarkupSeparator(raw[idx])) {
-    return { next: idx + 1, ok: true };
+  idx = skipToolMarkupIgnorables(raw, idx);
+  const sep = consumeToolMarkupSeparator(raw, idx);
+  if (sep.ok) {
+    return sep;
   }
-  if (idx < raw.length && [' ', '\t', '\r', '\n'].includes(raw[idx])) {
-    return { next: idx + 1, ok: true };
+  const spacingLen = toolMarkupWhitespaceLikeLenAt(raw, idx);
+  if (spacingLen > 0) {
+    return { next: idx + spacingLen, ok: true };
   }
-  const dsml = matchNormalizedASCII(raw, idx, 'dsml');
+  const dsml = consumeToolKeyword(raw, idx, 'dsml');
   if (dsml.ok) {
-    let next = idx + dsml.len;
-    const sep = normalizeFullwidthASCIIChar(raw[next] || '');
-    if (next < raw.length && (sep === '-' || sep === '_')) {
-      next += 1;
+    let next = dsml.next;
+    const dashLen = toolMarkupDashLenAt(raw, next);
+    const underscoreLen = toolMarkupUnderscoreLenAt(raw, next);
+    if (dashLen) {
+      next += dashLen;
+    } else if (underscoreLen) {
+      next += underscoreLen;
     }
     return { next, ok: true };
   }
@@ -794,7 +799,7 @@ function consumeToolMarkupNamePrefixOnce(raw, lower, idx) {
   return { next: idx, ok: false };
 }
 
-function consumeArbitraryToolMarkupNamePrefix(raw, lower, idx) {
+function consumeArbitraryToolMarkupNamePrefix(raw, _lower, idx) {
   const first = consumeToolMarkupPrefixSegment(raw, idx);
   if (!first.ok) {
     return { next: idx, ok: false };
@@ -802,27 +807,45 @@ function consumeArbitraryToolMarkupNamePrefix(raw, lower, idx) {
   let j = first.next;
   while (j < raw.length) {
     const segment = consumeToolMarkupPrefixSegment(raw, j);
-    if (!segment.ok) break;
+    if (!segment.ok) {
+      break;
+    }
     j = segment.next;
   }
   let k = j;
-  while (k < raw.length && [' ', '\t', '\r', '\n'].includes(raw[k])) {
-    k += 1;
+  while (true) {
+    const spacingLen = toolMarkupWhitespaceLikeLenAt(raw, k);
+    if (!spacingLen) {
+      break;
+    }
+    k += spacingLen;
   }
   let next = k;
   let ok = false;
-  if (next < raw.length && isToolMarkupSeparator(raw[next])) {
-    next += 1;
-    ok = true;
-  } else if (next < raw.length && ['_', '-'].includes(normalizeFullwidthASCIIChar(raw[next]))) {
-    next += 1;
+  const sep = consumeToolMarkupSeparator(raw, next);
+  if (sep.ok) {
+    next = sep.next;
     ok = true;
+  } else {
+    const dashLen = toolMarkupDashLenAt(raw, next);
+    const underscoreLen = toolMarkupUnderscoreLenAt(raw, next);
+    if (dashLen) {
+      next += dashLen;
+      ok = true;
+    } else if (underscoreLen) {
+      next += underscoreLen;
+      ok = true;
+    }
   }
   if (!ok) {
     return { next: idx, ok: false };
   }
-  while (next < raw.length && [' ', '\t', '\r', '\n'].includes(raw[next])) {
-    next += 1;
+  while (true) {
+    const spacingLen = toolMarkupWhitespaceLikeLenAt(raw, next);
+    if (!spacingLen) {
+      break;
+    }
+    next += spacingLen;
   }
   if (!hasToolMarkupNamePrefix(raw, next)) {
     return { next: idx, ok: false };
@@ -834,68 +857,669 @@ function consumeToolMarkupPrefixSegment(raw, idx) {
   if (idx < 0 || idx >= raw.length) {
     return { next: idx, ok: false };
   }
-  const ch = normalizeFullwidthASCIIChar(raw[idx]);
-  if (/^[A-Za-z0-9]$/.test(ch)) {
+  const normalized = normalizeFullwidthASCIIChar(raw[idx]);
+  if (/^[A-Za-z0-9]$/.test(normalized)) {
     return { next: idx + 1, ok: true };
   }
   return { next: idx, ok: false };
 }
 
 function hasToolMarkupNamePrefix(raw, start) {
-  const tail = normalizedASCIITailAt(raw, start);
   for (const name of TOOL_MARKUP_NAMES) {
-    if (tail.startsWith(name.raw) || name.raw.startsWith(tail)) {
+    if (consumeToolKeyword(raw, start, name.raw).ok) {
+      return true;
+    }
+    if (hasConfusablePartialKeywordPrefix(raw, start, name.raw)) {
       return true;
     }
   }
   return false;
 }
 
+function hasConfusablePartialKeywordPrefix(raw, start, keyword) {
+  if (start < 0 || start >= raw.length) {
+    return false;
+  }
+  let idx = start;
+  let matched = 0;
+  while (matched < keyword.length && idx < raw.length) {
+    idx = skipToolMarkupIgnorables(raw, idx);
+    if (idx >= raw.length) {
+      break;
+    }
+    const expected = keyword[matched];
+    if (expected === '_') {
+      const underscoreLen = toolMarkupUnderscoreLenAt(raw, idx);
+      if (!underscoreLen) {
+        return false;
+      }
+      idx += underscoreLen;
+      matched += 1;
+      continue;
+    }
+    if (expected === '-') {
+      const dashLen = toolMarkupDashLenAt(raw, idx);
+      if (!dashLen) {
+        return false;
+      }
+      idx += dashLen;
+      matched += 1;
+      continue;
+    }
+    const cp = raw.codePointAt(idx);
+    const ch = String.fromCodePoint(cp);
+    const folded = foldToolKeywordRune(ch);
+    if (!folded || folded !== expected.toLowerCase()) {
+      return false;
+    }
+    idx += ch.length;
+    matched += 1;
+  }
+  return matched > 0 && matched < keyword.length && idx === raw.length;
+}
+
 function matchToolMarkupName(raw, start, dsmlLike) {
   for (const name of TOOL_MARKUP_NAMES) {
     if (name.dsmlOnly && !dsmlLike) {
       continue;
     }
-    const matched = matchNormalizedASCII(raw, start, name.raw);
+    const matched = consumeToolKeyword(raw, start, name.raw);
     if (matched.ok) {
-      return { name: name.canonical, len: matched.len };
+      return { name: name.canonical, len: matched.next - start };
     }
   }
   return { name: '', len: 0 };
 }
 
-function findXmlTagEnd(text, from) {
-  let quote = '';
-  for (let i = Math.max(0, from || 0); i < text.length; i += 1) {
-    const ch = text[i];
-    const normalized = normalizeFullwidthASCIIChar(ch);
-    if (quote) {
-      if (normalized === quote) {
-        quote = '';
+function consumeToolMarkupSeparator(raw, idx) {
+  idx = skipToolMarkupIgnorables(raw, idx);
+  if (idx >= raw.length) {
+    return { next: idx, ok: false };
+  }
+  const cp = raw.codePointAt(idx);
+  const ch = String.fromCodePoint(cp);
+  if (!isToolMarkupSeparator(ch)) {
+    return { next: idx, ok: false };
+  }
+  return { next: idx + ch.length, ok: true };
+}
+
+function hasToolMarkupBoundary(text, idx) {
+  idx = skipToolMarkupIgnorables(text, idx);
+  if (idx >= text.length) {
+    return true;
+  }
+  if (toolMarkupWhitespaceLikeLenAt(text, idx) > 0) {
+    return true;
+  }
+  if (consumeToolMarkupClosingSlash(text, idx).closing) {
+    return true;
+  }
+  return xmlTagEndDelimiterLenAt(text, idx) > 0;
+}
+
+function consumeToolMarkupLessThan(raw, idx) {
+  idx = skipToolMarkupIgnorables(raw, idx);
+  if (idx < 0 || idx >= raw.length) {
+    return { next: idx, ok: false };
+  }
+  const delimLen = xmlTagStartDelimiterLenAt(raw, idx);
+  if (!delimLen) {
+    return { next: idx, ok: false };
+  }
+  return { next: idx + delimLen, ok: true };
+}
+
+function canonicalizeToolCallCandidateSpans(text) {
+  const raw = toStringSafe(text);
+  if (!raw) {
+    return '';
+  }
+  let out = '';
+  for (let i = 0; i < raw.length;) {
+    const skipped = skipXmlIgnoredSection(raw, i);
+    if (skipped.blocked) {
+      out += raw.slice(i);
+      break;
+    }
+    if (skipped.advanced) {
+      out += raw.slice(i, skipped.next);
+      i = skipped.next;
+      continue;
+    }
+    const tag = scanToolMarkupTagAt(raw, i);
+    if (!tag) {
+      out += raw[i];
+      i += 1;
+      continue;
+    }
+    out += canonicalizeRecognizedToolMarkupTag(raw.slice(tag.start, tag.end + 1), tag);
+    i = tag.end + 1;
+  }
+  return out;
+}
+
+function canonicalizeRecognizedToolMarkupTag(rawTag, tag) {
+  const raw = toStringSafe(rawTag);
+  if (!raw || !tag) {
+    return raw;
+  }
+  let idx = 0;
+  const startLen = xmlTagStartDelimiterLenAt(raw, idx);
+  if (startLen > 0) {
+    idx += startLen;
+  }
+  while (idx < raw.length) {
+    idx = skipToolMarkupIgnorables(raw, idx);
+    const delimLen = xmlTagStartDelimiterLenAt(raw, idx);
+    if (!delimLen) {
+      break;
+    }
+    idx += delimLen;
+  }
+  idx = skipToolMarkupIgnorables(raw, idx);
+  if (tag.closing) {
+    const slash = consumeToolMarkupClosingSlash(raw, idx);
+    if (slash.closing) {
+      idx = slash.next;
+    }
+  }
+  const prefix = consumeToolMarkupNamePrefix(raw, raw.toLowerCase(), idx);
+  idx = prefix.next;
+  const nameMatch = consumeToolKeyword(raw, idx, rawNameForTag(tag));
+  const afterName = nameMatch.ok ? nameMatch.next : idx;
+  const attrs = parseCanonicalToolMarkupAttrs(raw, afterName);
+
+  let out = '<';
+  if (tag.closing) {
+    out += '/';
+  }
+  if (tag.dsmlLike) {
+    out += '|DSML|';
+  }
+  out += tag.name;
+  for (const attr of attrs) {
+    if (!attr || !attr.key) {
+      continue;
+    }
+    out += ` ${attr.key}="${quoteCanonicalXMLAttrValue(attr.value)}"`;
+  }
+  if (tag.selfClosing) {
+    out += '/';
+  }
+  out += '>';
+  return out;
+}
+
+function parseCanonicalToolMarkupAttrs(rawTag, startIdx) {
+  const raw = toStringSafe(rawTag);
+  let idx = Math.max(0, startIdx || 0);
+  const out = [];
+  while (idx < raw.length) {
+    idx = skipToolMarkupIgnorables(raw, idx);
+    if (idx >= raw.length) {
+      break;
+    }
+    const spacingLen = toolMarkupWhitespaceLikeLenAt(raw, idx);
+    if (spacingLen > 0) {
+      idx += spacingLen;
+      continue;
+    }
+    if (xmlTagEndDelimiterLenAt(raw, idx) > 0) {
+      break;
+    }
+    if (consumeToolMarkupPipe(raw, idx).ok) {
+      idx = consumeToolMarkupPipe(raw, idx).next;
+      continue;
+    }
+    if (consumeToolMarkupClosingSlash(raw, idx).closing) {
+      idx = consumeToolMarkupClosingSlash(raw, idx).next;
+      continue;
+    }
+
+    const keyStart = idx;
+    while (idx < raw.length) {
+      idx = skipToolMarkupIgnorables(raw, idx);
+      if (idx >= raw.length) {
+        break;
+      }
+      if (toolMarkupWhitespaceLikeLenAt(raw, idx) > 0) {
+        break;
+      }
+      if (toolMarkupEqualsLenAt(raw, idx) > 0 || xmlTagEndDelimiterLenAt(raw, idx) > 0) {
+        break;
+      }
+      if (consumeToolMarkupPipe(raw, idx).ok || consumeToolMarkupClosingSlash(raw, idx).closing) {
+        break;
+      }
+      const cp = raw.codePointAt(idx);
+      idx += cp > 0xFFFF ? 2 : 1;
+    }
+    const key = normalizeCanonicalToolAttrKey(raw.slice(keyStart, idx));
+
+    idx = skipToolMarkupIgnorables(raw, idx);
+    while (idx < raw.length) {
+      const wsLen = toolMarkupWhitespaceLikeLenAt(raw, idx);
+      if (!wsLen) {
+        break;
+      }
+      idx += wsLen;
+      idx = skipToolMarkupIgnorables(raw, idx);
+    }
+    const equalsLen = toolMarkupEqualsLenAt(raw, idx);
+    if (!equalsLen) {
+      continue;
+    }
+    idx += equalsLen;
+    idx = skipToolMarkupIgnorables(raw, idx);
+    while (idx < raw.length) {
+      const wsLen = toolMarkupWhitespaceLikeLenAt(raw, idx);
+      if (!wsLen) {
+        break;
+      }
+      idx += wsLen;
+      idx = skipToolMarkupIgnorables(raw, idx);
+    }
+    if (!key) {
+      if (idx < raw.length) {
+        const cp = raw.codePointAt(idx);
+        idx += cp > 0xFFFF ? 2 : 1;
       }
       continue;
     }
-    if (normalized === '"' || normalized === "'") {
-      quote = normalized;
+
+    let value = '';
+    const quote = xmlQuotePairAt(raw, idx);
+    if (quote.len) {
+      const valueStart = idx + quote.len;
+      idx = valueStart;
+      while (idx < raw.length) {
+        const closeLen = xmlQuoteCloseDelimiterLenAt(raw, idx, quote.close);
+        if (closeLen) {
+          value = raw.slice(valueStart, idx);
+          idx += closeLen;
+          break;
+        }
+        const cp = raw.codePointAt(idx);
+        idx += cp > 0xFFFF ? 2 : 1;
+      }
+    } else {
+      const valueStart = idx;
+      while (idx < raw.length) {
+        if (toolMarkupWhitespaceLikeLenAt(raw, idx) > 0 || xmlTagEndDelimiterLenAt(raw, idx) > 0 || toolMarkupEqualsLenAt(raw, idx) > 0) {
+          break;
+        }
+        if (consumeToolMarkupPipe(raw, idx).ok || consumeToolMarkupClosingSlash(raw, idx).closing) {
+          break;
+        }
+        const cp = raw.codePointAt(idx);
+        idx += cp > 0xFFFF ? 2 : 1;
+      }
+      value = raw.slice(valueStart, idx);
+    }
+    out.push({ key, value });
+  }
+  return out;
+}
+
+function normalizeCanonicalToolAttrKey(rawKey) {
+  const trimmed = toStringSafe(removeToolMarkupIgnorables(rawKey)).trim();
+  if (!trimmed) {
+    return '';
+  }
+  const matched = consumeToolKeyword(trimmed, 0, 'name');
+  return matched.ok && skipToolMarkupIgnorables(trimmed, matched.next) === trimmed.length ? 'name' : '';
+}
+
+function quoteCanonicalXMLAttrValue(rawValue) {
+  return toStringSafe(rawValue).replace(/"/g, '&quot;');
+}
+
+function removeToolMarkupIgnorables(rawValue) {
+  const raw = toStringSafe(rawValue);
+  let out = '';
+  for (let i = 0; i < raw.length;) {
+    const ignorableLen = toolMarkupIgnorableLenAt(raw, i);
+    if (ignorableLen) {
+      i += ignorableLen;
       continue;
     }
-    if (normalized === '>') {
-      return i;
+    const cp = raw.codePointAt(i);
+    const ch = String.fromCodePoint(cp);
+    out += ch;
+    i += ch.length;
+  }
+  return out;
+}
+
+function skipToolMarkupIgnorables(text, idx) {
+  const raw = toStringSafe(text);
+  let pos = Math.max(0, idx || 0);
+  while (pos < raw.length) {
+    const next = toolMarkupIgnorableLenAt(raw, pos);
+    if (!next) {
+      break;
     }
+    pos += next;
+  }
+  return pos;
+}
+
+function toolMarkupIgnorableLenAt(text, idx) {
+  const raw = toStringSafe(text);
+  if (idx < 0 || idx >= raw.length) {
+    return 0;
+  }
+  const cp = raw.codePointAt(idx);
+  if (cp === undefined) {
+    return 0;
+  }
+  const ch = String.fromCodePoint(cp);
+  const isFormat = /[\u00AD\u200B-\u200F\u202A-\u202E\u2060-\u206F\uFE00-\uFE0F\uFEFF]/u.test(ch);
+  const isControl = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/u.test(ch);
+  return isFormat || isControl ? ch.length : 0;
+}
+
+function toolMarkupEqualsLenAt(text, idx) {
+  const raw = toStringSafe(text);
+  const pos = skipToolMarkupIgnorables(raw, idx);
+  for (const variant of ['=', '＝', '﹦', '꞊']) {
+    if (raw.startsWith(variant, pos)) {
+      return (pos + variant.length) - idx;
+    }
+  }
+  return 0;
+}
+
+function toolMarkupDashLenAt(text, idx) {
+  const raw = toStringSafe(text);
+  const pos = skipToolMarkupIgnorables(raw, idx);
+  for (const variant of ['-', '‐', '‑', '‒', '–', '—', '―', '−', '﹣', '－']) {
+    if (raw.startsWith(variant, pos)) {
+      return (pos + variant.length) - idx;
+    }
+  }
+  return 0;
+}
+
+function toolMarkupUnderscoreLenAt(text, idx) {
+  const raw = toStringSafe(text);
+  const pos = skipToolMarkupIgnorables(raw, idx);
+  for (const variant of ['_', '＿', '﹍', '﹎', '﹏']) {
+    if (raw.startsWith(variant, pos)) {
+      return (pos + variant.length) - idx;
+    }
+  }
+  return 0;
+}
+
+function consumeToolKeyword(text, idx, keyword) {
+  const raw = toStringSafe(text);
+  let next = idx;
+  for (const ch of keyword.toLowerCase()) {
+    next = skipToolMarkupIgnorables(raw, next);
+    if (next >= raw.length) {
+      return { next: idx, ok: false };
+    }
+    if (ch === '_') {
+      const len = toolMarkupUnderscoreLenAt(raw, next);
+      if (!len) {
+        return { next: idx, ok: false };
+      }
+      next += len;
+      continue;
+    }
+    if (ch === '-') {
+      const len = toolMarkupDashLenAt(raw, next);
+      if (!len) {
+        return { next: idx, ok: false };
+      }
+      next += len;
+      continue;
+    }
+    const cp = raw.codePointAt(next);
+    const folded = foldToolKeywordRune(String.fromCodePoint(cp));
+    if (!folded || folded !== ch) {
+      return { next: idx, ok: false };
+    }
+    next += cp > 0xFFFF ? 2 : 1;
+  }
+  return { next, ok: true };
+}
+
+function foldToolKeywordRune(ch) {
+  if (!ch) {
+    return '';
+  }
+  const cp = ch.codePointAt(0);
+  if (cp >= 0xFF21 && cp <= 0xFF3A) {
+    return String.fromCharCode(cp - 0xFEE0).toLowerCase();
+  }
+  if (cp >= 0xFF41 && cp <= 0xFF5A) {
+    return String.fromCharCode(cp - 0xFEE0);
+  }
+  const lower = ch.toLowerCase();
+  if ('acdeiklmnoprstv'.includes(lower)) {
+    return lower;
+  }
+  const mapped = {
+    'а': 'a',
+    'α': 'a',
+    'с': 'c',
+    'ϲ': 'c',
+    'ԁ': 'd',
+    'ⅾ': 'd',
+    'е': 'e',
+    'ε': 'e',
+    'і': 'i',
+    'ι': 'i',
+    'ı': 'i',
+    'к': 'k',
+    'κ': 'k',
+    'ⅼ': 'l',
+    'м': 'm',
+    'μ': 'm',
+    'ո': 'n',
+    'о': 'o',
+    'ο': 'o',
+    'р': 'p',
+    'ρ': 'p',
+    'ѕ': 's',
+    'т': 't',
+    'τ': 't',
+    'ν': 'v',
+    'ѵ': 'v',
+    'ⅴ': 'v',
+  };
+  return mapped[lower] || '';
+}
+
+function toolMarkupWhitespaceLikeLenAt(text, idx) {
+  const raw = toStringSafe(text);
+  const pos = skipToolMarkupIgnorables(raw, idx);
+  if (pos < 0 || pos >= raw.length) {
+    return 0;
+  }
+  if ([' ', '\t', '\n', '\r'].includes(raw[pos])) {
+    return (pos + 1) - idx;
+  }
+  if (raw.startsWith('▁', pos)) {
+    return (pos + '▁'.length) - idx;
+  }
+  const cp = raw.codePointAt(pos);
+  const ch = String.fromCodePoint(cp);
+  return /\s/u.test(ch) ? (pos + ch.length) - idx : 0;
+}
+
+function consumeToolMarkupPipe(raw, idx) {
+  const pos = skipToolMarkupIgnorables(raw, idx);
+  if (pos >= raw.length) {
+    return { next: idx, ok: false };
+  }
+  for (const variant of ['|', '｜', '│', '∣', '❘', 'ǀ', '￨']) {
+    if (raw.startsWith(variant, pos)) {
+      return { next: pos + variant.length, ok: true };
+    }
+  }
+  return { next: idx, ok: false };
+}
+
+function consumeToolMarkupClosingSlash(raw, idx) {
+  const pos = skipToolMarkupIgnorables(raw, idx);
+  if (pos >= raw.length) {
+    return { next: idx, closing: false };
+  }
+  for (const variant of ['/', '／', '∕', '⁄', '⧸']) {
+    if (raw.startsWith(variant, pos)) {
+      return { next: pos + variant.length, closing: true };
+    }
+  }
+  return { next: idx, closing: false };
+}
+
+function xmlTagStartDelimiterLenAt(text, idx) {
+  const raw = toStringSafe(text);
+  const pos = skipToolMarkupIgnorables(raw, idx);
+  if (pos < 0 || pos >= raw.length) {
+    return 0;
+  }
+  for (const variant of ['<', '＜', '﹤', '〈']) {
+    if (raw.startsWith(variant, pos)) {
+      return (pos + variant.length) - idx;
+    }
+  }
+  return 0;
+}
+
+function xmlTagEndDelimiterLenAt(text, idx) {
+  const raw = toStringSafe(text);
+  const pos = skipToolMarkupIgnorables(raw, idx);
+  if (pos < 0 || pos >= raw.length) {
+    return 0;
+  }
+  for (const variant of ['>', '＞', '﹥', '〉']) {
+    if (raw.startsWith(variant, pos)) {
+      return (pos + variant.length) - idx;
+    }
+  }
+  return 0;
+}
+
+function xmlTagEndDelimiterLenEndingAt(text, end) {
+  const raw = toStringSafe(text);
+  if (end < 0 || end >= raw.length) {
+    return 0;
+  }
+  for (const variant of ['>', '＞', '﹥', '〉']) {
+    if (end + 1 >= variant.length && raw.slice(end + 1 - variant.length, end + 1) === variant) {
+      return variant.length;
+    }
+  }
+  return 0;
+}
+
+function xmlQuotePairAt(text, idx) {
+  const raw = toStringSafe(text);
+  const pos = skipToolMarkupIgnorables(raw, idx);
+  if (pos < 0 || pos >= raw.length) {
+    return { close: '', len: 0 };
+  }
+  if (raw[pos] === '"') {
+    return { close: '"', len: (pos + 1) - idx };
+  }
+  if (raw[pos] === "'") {
+    return { close: "'", len: (pos + 1) - idx };
+  }
+  if (raw.startsWith('“', pos)) {
+    return { close: '”', len: (pos + '“'.length) - idx };
+  }
+  if (raw.startsWith('‘', pos)) {
+    return { close: '’', len: (pos + '‘'.length) - idx };
+  }
+  if (raw.startsWith('＂', pos)) {
+    return { close: '＂', len: (pos + '＂'.length) - idx };
+  }
+  if (raw.startsWith('＇', pos)) {
+    return { close: '＇', len: (pos + '＇'.length) - idx };
+  }
+  if (raw.startsWith('„', pos)) {
+    return { close: '”', len: (pos + '„'.length) - idx };
+  }
+  if (raw.startsWith('‟', pos)) {
+    return { close: '”', len: (pos + '‟'.length) - idx };
+  }
+  return { close: '', len: 0 };
+}
+
+function xmlQuoteCloseDelimiterLenAt(text, idx, close) {
+  const raw = toStringSafe(text);
+  if (!close) {
+    return 0;
+  }
+  return raw.startsWith(close, idx) ? close.length : 0;
+}
+
+function lastIndexOfToolMarkupStartDelimiter(raw) {
+  const text = toStringSafe(raw);
+  let best = -1;
+  for (const variant of ['<', '＜', '﹤', '〈']) {
+    const idx = text.lastIndexOf(variant);
+    if (idx > best) {
+      best = idx;
+    }
+  }
+  return best;
+}
+
+function containsXmlTagTerminator(raw) {
+  const text = toStringSafe(raw);
+  return text.includes('>') || text.includes('＞') || text.includes('﹥') || text.includes('〉');
+}
+
+function findXmlTagEnd(text, from) {
+  const raw = toStringSafe(text);
+  let quote = '';
+  for (let i = Math.max(0, from || 0); i < raw.length;) {
+    if (quote) {
+      const closeLen = xmlQuoteCloseDelimiterLenAt(raw, i, quote);
+      if (closeLen) {
+        quote = '';
+        i += closeLen;
+        continue;
+      }
+      const cp = raw.codePointAt(i);
+      i += cp > 0xFFFF ? 2 : 1;
+      continue;
+    }
+    const nextQuote = xmlQuotePairAt(raw, i);
+    if (nextQuote.len) {
+      quote = nextQuote.close;
+      i += nextQuote.len;
+      continue;
+    }
+    const endLen = xmlTagEndDelimiterLenAt(raw, i);
+    if (endLen > 0) {
+      return i + endLen - 1;
+    }
+    const cp = raw.codePointAt(i);
+    i += cp > 0xFFFF ? 2 : 1;
   }
   return -1;
 }
 
 function hasXmlTagBoundary(text, idx) {
-  if (idx >= text.length) {
+  const pos = skipToolMarkupIgnorables(text, idx);
+  if (pos >= text.length) {
     return true;
   }
-  return [' ', '\t', '\n', '\r', '>', '/'].includes(text[idx])
-    || normalizeFullwidthASCIIChar(text[idx]) === '>';
+  return toolMarkupWhitespaceLikeLenAt(text, pos) > 0
+    || consumeToolMarkupClosingSlash(text, pos).closing
+    || xmlTagEndDelimiterLenAt(text, pos) > 0;
 }
 
 function isSelfClosingXmlTag(startTag) {
-  return toStringSafe(startTag).trim().endsWith('/');
+  const trimmed = toStringSafe(startTag).trim();
+  return trimmed.endsWith('/') || trimmed.endsWith('／');
 }
 
 function normalizeFullwidthASCIIChar(ch) {
@@ -1070,7 +1694,7 @@ function findGenericXmlElementBlocks(text) {
 function findGenericXmlStartTagOutsideCDATA(text, from) {
   const lower = text.toLowerCase();
   for (let i = Math.max(0, from || 0); i < text.length;) {
-    const skipped = skipXmlIgnoredSection(lower, i);
+    const skipped = skipXmlIgnoredSection(text, i);
     if (skipped.blocked) {
       return null;
     }
@@ -1120,7 +1744,7 @@ function findMatchingGenericXmlEndTagOutsideCDATA(text, name, from) {
   const closeTarget = `</${needle}`;
   let depth = 1;
   for (let i = Math.max(0, from || 0); i < text.length;) {
-    const skipped = skipXmlIgnoredSection(lower, i);
+    const skipped = skipXmlIgnoredSection(text, i);
     if (skipped.blocked) {
       return null;
     }
@@ -1320,28 +1944,33 @@ function unescapeHtml(safe) {
 
 function extractStandaloneCDATA(inner) {
   const s = toStringSafe(inner).trim();
-  const open = matchCDATAOpenAt(s, 0);
-  if (open.ok) {
-    const close = findStandaloneCDATAEnd(s, open.bodyStart);
-    if (close.index < 0) {
-      return { ok: true, value: s.slice(open.bodyStart) };
-    }
-    return { ok: true, value: s.slice(open.bodyStart, close.index) };
+  const openLen = toolCDATAOpenLenAt(s, 0);
+  if (!openLen) {
+    return { ok: false, value: '' };
   }
-  return { ok: false, value: '' };
+  const closeStart = findTrailingToolCDATACloseStart(s);
+  if (closeStart >= openLen) {
+    return { ok: true, value: s.slice(openLen, closeStart) };
+  }
+  const end = findToolCDATAEnd(s, openLen);
+  if (end >= 0) {
+    return { ok: true, value: s.slice(openLen, end) };
+  }
+  return { ok: true, value: s.slice(openLen) };
 }
 
 function findStandaloneCDATAEnd(text, from) {
   const raw = toStringSafe(text);
   let best = { index: -1, len: 0 };
   for (let searchFrom = Math.max(0, from || 0); searchFrom < raw.length;) {
-    const close = findCDATAEnd(raw, searchFrom);
-    if (close.index < 0) {
+    const index = findToolCDATAEnd(raw, searchFrom);
+    if (index < 0) {
       break;
     }
-    const closeEnd = close.index + close.len;
+    const len = toolCDATACloseLenAt(raw, index);
+    const closeEnd = index + len;
     if (!raw.slice(closeEnd).trim()) {
-      best = close;
+      best = { index, len };
     }
     searchFrom = closeEnd;
   }
@@ -1588,26 +2217,23 @@ function sanitizeLooseCDATA(text) {
   if (!raw) {
     return '';
   }
-  const lower = raw.toLowerCase();
-  const openMarker = '<![cdata[';
-  const closeMarker = ']]>';
 
   let out = '';
   let pos = 0;
   let changed = false;
   while (pos < raw.length) {
-    const startRel = lower.indexOf(openMarker, pos);
-    if (startRel < 0) {
+    const start = indexToolCDATAOpen(raw, pos);
+    if (start < 0) {
       out += raw.slice(pos);
       break;
     }
-    const start = startRel;
-    const contentStart = start + openMarker.length;
+    const openLen = toolCDATAOpenLenAt(raw, start);
+    const contentStart = start + openLen;
     out += raw.slice(pos, start);
 
-    const endRel = lower.indexOf(closeMarker, contentStart);
+    const endRel = findToolCDATAEnd(raw, contentStart);
     if (endRel >= 0) {
-      const end = endRel + closeMarker.length;
+      const end = endRel + toolCDATACloseLenAt(raw, endRel);
       out += raw.slice(start, end);
       pos = end;
       continue;
@@ -1621,6 +2247,181 @@ function sanitizeLooseCDATA(text) {
   return changed ? out : raw;
 }
 
+function hasRepairableXMLToolCallsWrapper(text) {
+  const raw = toStringSafe(text).trim();
+  if (!raw || raw.toLowerCase().includes('<tool_calls')) {
+    return false;
+  }
+  const closeMatches = [...raw.matchAll(XML_TOOL_CALLS_CLOSE_PATTERN)];
+  if (closeMatches.length === 0) {
+    return false;
+  }
+  const invoke = raw.match(XML_INVOKE_START_PATTERN);
+  if (!invoke || invoke.index === undefined) {
+    return false;
+  }
+  const close = closeMatches[closeMatches.length - 1];
+  return invoke.index < close.index;
+}
+
+function repairMissingXMLToolCallsOpeningWrapper(text) {
+  const raw = toStringSafe(text);
+  if (!hasRepairableXMLToolCallsWrapper(raw)) {
+    return raw;
+  }
+  const closeMatches = [...raw.matchAll(XML_TOOL_CALLS_CLOSE_PATTERN)];
+  const invoke = raw.match(XML_INVOKE_START_PATTERN);
+  const close = closeMatches[closeMatches.length - 1];
+  return `${raw.slice(0, invoke.index)}<tool_calls>${raw.slice(invoke.index, close.index)}</tool_calls>${raw.slice(close.index + close[0].length)}`;
+}
+
+function rawNameForTag(tag) {
+  for (const candidate of TOOL_MARKUP_NAMES) {
+    if (candidate.canonical === tag.name) {
+      return candidate.raw;
+    }
+  }
+  return tag.name || '';
+}
+
+function toolCDATAOpenLenAt(text, idx) {
+  const raw = toStringSafe(text);
+  const start = skipToolMarkupIgnorables(raw, idx);
+  const ltLen = xmlTagStartDelimiterLenAt(raw, start);
+  if (!ltLen) {
+    return 0;
+  }
+  let pos = start + ltLen;
+  for (let skipped = 0; skipped <= 4 && pos < raw.length; skipped += 1) {
+    pos = skipToolMarkupIgnorables(raw, pos);
+    if (raw[pos] === '[') {
+      pos += 1;
+      const keyword = consumeToolKeyword(raw, pos, 'cdata');
+      if (!keyword.ok) {
+        return 0;
+      }
+      pos = skipToolMarkupIgnorables(raw, keyword.next);
+      if (raw[pos] !== '[') {
+        return 0;
+      }
+      pos += 1;
+      return pos - idx;
+    }
+    const cp = raw.codePointAt(pos);
+    if (cp === undefined) {
+      return 0;
+    }
+    const ch = String.fromCodePoint(cp);
+    if (!isToolMarkupSeparator(ch)) {
+      return 0;
+    }
+    pos += ch.length;
+  }
+  return 0;
+}
+
+function toolCDATACloseLenAt(text, idx) {
+  const raw = toStringSafe(text);
+  const start = skipToolMarkupIgnorables(raw, idx);
+  if (raw[start] !== ']') {
+    return 0;
+  }
+  let pos = start + 1;
+  pos = skipToolMarkupIgnorables(raw, pos);
+  if (raw[pos] !== ']') {
+    return 0;
+  }
+  pos += 1;
+  const gtLen = xmlTagEndDelimiterLenAt(raw, pos);
+  return gtLen ? (pos + gtLen) - idx : 0;
+}
+
+function findToolCDATAEnd(text, from) {
+  const raw = toStringSafe(text);
+  if (from < 0 || from >= raw.length) {
+    return -1;
+  }
+  let firstNonFenceEnd = -1;
+  for (let i = from; i < raw.length; i += 1) {
+    const closeLen = toolCDATACloseLenAt(raw, i);
+    if (!closeLen) {
+      continue;
+    }
+    const end = i;
+    if (cdataOffsetIsInsideMarkdownFence(raw.slice(from, end))) {
+      continue;
+    }
+    if (cdataEndLooksStructural(raw, end + closeLen)) {
+      return end;
+    }
+    if (firstNonFenceEnd < 0) {
+      firstNonFenceEnd = end;
+    }
+    i = end + closeLen - 1;
+  }
+  return firstNonFenceEnd;
+}
+
+function indexToolCDATAOpen(text, from = 0) {
+  const raw = toStringSafe(text);
+  for (let i = Math.max(0, from || 0); i < raw.length; i += 1) {
+    if (toolCDATAOpenLenAt(raw, i)) {
+      return i;
+    }
+  }
+  return -1;
+}
+
+function findTrailingToolCDATACloseStart(text) {
+  const raw = toStringSafe(text);
+  for (let i = raw.length - 1; i >= 0; i -= 1) {
+    const closeLen = toolCDATACloseLenAt(raw, i);
+    if (closeLen && i + closeLen === raw.length) {
+      return i;
+    }
+  }
+  return -1;
+}
+
+function cdataOffsetIsInsideMarkdownFence(fragment) {
+  const lines = toStringSafe(fragment).split('\n');
+  let inFence = false;
+  let fenceChar = '';
+  let fenceLen = 0;
+  for (const line of lines) {
+    const trimmed = line.replace(/^[ \t]+/, '');
+    if (!inFence) {
+      const fence = parseFenceOpenLine(trimmed);
+      if (fence) {
+        inFence = true;
+        fenceChar = fence.ch;
+        fenceLen = fence.count;
+      }
+      continue;
+    }
+    if (isFenceCloseLine(trimmed, fenceChar, fenceLen)) {
+      inFence = false;
+      fenceChar = '';
+      fenceLen = 0;
+    }
+  }
+  return inFence;
+}
+
+function cdataEndLooksStructural(text, after) {
+  const raw = toStringSafe(text);
+  let pos = after;
+  while (pos < raw.length) {
+    const ch = raw[pos];
+    if ([' ', '\t', '\r', '\n'].includes(ch)) {
+      pos += 1;
+      continue;
+    }
+    return raw.startsWith('</', pos) || raw.startsWith('<／', pos) || raw.startsWith('＜/', pos) || raw.startsWith('＜／', pos);
+  }
+  return true;
+}
+
 function parseTagAttributes(raw) {
   const source = toStringSafe(raw);
   const out = {};
@@ -1632,7 +2433,7 @@ function parseTagAttributes(raw) {
     if (!key) {
       continue;
     }
-    out[key] = match[3] || match[4] || '';
+    out[key] = match.slice(3).find((value) => value !== undefined && value !== '') || '';
   }
   return out;
 }
@@ -1697,8 +2498,10 @@ module.exports = {
   normalizeDSMLToolCallMarkup,
   containsToolMarkupSyntaxOutsideIgnored,
   containsToolCallWrapperSyntaxOutsideIgnored,
+  hasRepairableXMLToolCallsWrapper,
   findToolMarkupTagOutsideIgnored,
   findMatchingToolMarkupClose,
   findPartialToolMarkupStart,
+  indexToolCDATAOpen,
   sanitizeLooseCDATA,
 };
diff --git a/internal/js/helpers/stream-tool-sieve/sieve-xml.js b/internal/js/helpers/stream-tool-sieve/sieve-xml.js
index 1503c3e..6e2b1ed 100644
--- a/internal/js/helpers/stream-tool-sieve/sieve-xml.js
+++ b/internal/js/helpers/stream-tool-sieve/sieve-xml.js
@@ -114,6 +114,39 @@ function hasOpenXMLToolTag(captured) {
   return false;
 }
 
+function shouldKeepBareInvokeCapture(captured) {
+  const invokeTag = findFirstToolTag(captured, 0, 'invoke', false);
+  if (!invokeTag) {
+    return false;
+  }
+  const wrapperOpen = findFirstToolTag(captured, 0, 'tool_calls', false);
+  if (wrapperOpen && wrapperOpen.start <= invokeTag.start) {
+    return false;
+  }
+  const closeTag = findFirstToolTag(captured, invokeTag.start + 1, 'tool_calls', true);
+  if (closeTag && closeTag.start > invokeTag.start) {
+    return true;
+  }
+  const startEnd = invokeTag.end;
+  if (startEnd < 0) {
+    return true;
+  }
+  const body = captured.slice(startEnd + 1);
+  const trimmedBody = body.replace(/^[ \t\r\n]+/, '');
+  if (!trimmedBody) {
+    return true;
+  }
+  const invokeCloseTag = findFirstToolTag(captured, startEnd + 1, 'invoke', true);
+  if (invokeCloseTag) {
+    return captured.slice(invokeCloseTag.end + 1).trim() === '';
+  }
+  const paramTag = findFirstToolTag(body, 0, 'parameter', false);
+  if (paramTag && body.slice(0, paramTag.start).trim() === '') {
+    return true;
+  }
+  return trimmedBody.startsWith('{') || trimmedBody.startsWith('[');
+}
+
 function findFirstToolTag(text, from, name, closing) {
   for (let pos = Math.max(0, from || 0); pos < text.length;) {
     const tag = findToolMarkupTagOutsideIgnored(text, pos);
@@ -131,5 +164,6 @@ function findFirstToolTag(text, from, name, closing) {
 module.exports = {
   consumeXMLToolCapture,
   hasOpenXMLToolTag,
+  shouldKeepBareInvokeCapture,
   findPartialXMLToolTagStart: findPartialToolMarkupStart,
 };
diff --git a/internal/js/helpers/stream-tool-sieve/sieve.js b/internal/js/helpers/stream-tool-sieve/sieve.js
index a90a662..0e2d0aa 100644
--- a/internal/js/helpers/stream-tool-sieve/sieve.js
+++ b/internal/js/helpers/stream-tool-sieve/sieve.js
@@ -12,6 +12,7 @@ const {
 const {
   consumeXMLToolCapture: consumeXMLToolCaptureImpl,
   hasOpenXMLToolTag,
+  shouldKeepBareInvokeCapture,
   findPartialXMLToolTagStart,
 } = require('./sieve-xml');
 function processToolSieveChunk(state, chunk, toolNames) {
@@ -203,6 +204,9 @@ function consumeToolCapture(state, toolNames) {
   if (hasOpenXMLToolTag(captured)) {
     return { ready: false, prefix: '', calls: [], suffix: '' };
   }
+  if (shouldKeepBareInvokeCapture(captured)) {
+    return { ready: false, prefix: '', calls: [], suffix: '' };
+  }
 
   // No XML tool tags detected — release captured content as text.
   return {
diff --git a/internal/toolcall/toolcalls_candidates.go b/internal/toolcall/toolcalls_candidates.go
index 6fb5a8c..3d5cf76 100644
--- a/internal/toolcall/toolcalls_candidates.go
+++ b/internal/toolcall/toolcalls_candidates.go
@@ -1,4 +1,689 @@
 package toolcall
 
-// toolcalls_candidates.go is reserved for tool-call candidate helper logic.
-// It exists to satisfy the refactor line gate target list.
+import (
+	"strings"
+	"unicode"
+	"unicode/utf8"
+)
+
+type canonicalToolMarkupAttr struct {
+	Key   string
+	Value string
+}
+
+func canonicalizeToolCallCandidateSpans(text string) string {
+	if text == "" {
+		return ""
+	}
+	var b strings.Builder
+	b.Grow(len(text))
+	for i := 0; i < len(text); {
+		next, advanced, blocked := skipXMLIgnoredSection(text, i)
+		if blocked {
+			b.WriteString(text[i:])
+			break
+		}
+		if advanced {
+			b.WriteString(text[i:next])
+			i = next
+			continue
+		}
+		tag, ok := scanToolMarkupTagAt(text, i)
+		if !ok {
+			b.WriteByte(text[i])
+			i++
+			continue
+		}
+		b.WriteString(canonicalizeRecognizedToolMarkupTag(text[tag.Start:tag.End+1], tag))
+		i = tag.End + 1
+	}
+	return b.String()
+}
+
+func canonicalizeRecognizedToolMarkupTag(raw string, tag ToolMarkupTag) string {
+	if raw == "" {
+		return raw
+	}
+	idx := 0
+	if delimLen := xmlTagStartDelimiterLenAt(raw, idx); delimLen > 0 {
+		idx += delimLen
+	}
+	for {
+		idx = skipToolMarkupIgnorables(raw, idx)
+		if delimLen := xmlTagStartDelimiterLenAt(raw, idx); delimLen > 0 {
+			idx += delimLen
+			continue
+		}
+		break
+	}
+	idx = skipToolMarkupIgnorables(raw, idx)
+	if tag.Closing {
+		if next, ok := consumeToolMarkupClosingSlash(raw, idx); ok {
+			idx = next
+		}
+	}
+	idx, _ = consumeToolMarkupNamePrefix(raw, idx)
+	afterName, ok := consumeToolKeyword(raw, idx, rawNameForTag(tag))
+	if !ok {
+		afterName = idx
+	}
+
+	attrs := parseCanonicalToolMarkupAttrs(raw, afterName)
+
+	var b strings.Builder
+	b.Grow(len(raw) + 8)
+	b.WriteByte('<')
+	if tag.Closing {
+		b.WriteByte('/')
+	}
+	if tag.DSMLLike {
+		b.WriteString("|DSML|")
+	}
+	b.WriteString(tag.Name)
+	for _, attr := range attrs {
+		if attr.Key == "" {
+			continue
+		}
+		b.WriteByte(' ')
+		b.WriteString(attr.Key)
+		b.WriteString(`="`)
+		b.WriteString(quoteCanonicalXMLAttrValue(attr.Value))
+		b.WriteByte('"')
+	}
+	if tag.SelfClosing {
+		b.WriteByte('/')
+	}
+	b.WriteByte('>')
+	return b.String()
+}
+
+func rawNameForTag(tag ToolMarkupTag) string {
+	for _, name := range toolMarkupNames {
+		if name.canonical == tag.Name {
+			return name.raw
+		}
+	}
+	return tag.Name
+}
+
+func parseCanonicalToolMarkupAttrs(raw string, idx int) []canonicalToolMarkupAttr {
+	if raw == "" || idx >= len(raw) {
+		return nil
+	}
+	var out []canonicalToolMarkupAttr
+	for idx < len(raw) {
+		idx = skipToolMarkupIgnorables(raw, idx)
+		if idx >= len(raw) {
+			break
+		}
+		if spacingLen := toolMarkupWhitespaceLikeLenAt(raw, idx); spacingLen > 0 {
+			idx += spacingLen
+			continue
+		}
+		if xmlTagEndDelimiterLenAt(raw, idx) > 0 {
+			break
+		}
+		if next, ok := consumeToolMarkupPipe(raw, idx); ok {
+			idx = next
+			continue
+		}
+		if next, ok := consumeToolMarkupClosingSlash(raw, idx); ok {
+			idx = next
+			continue
+		}
+
+		keyStart := idx
+		for idx < len(raw) {
+			idx = skipToolMarkupIgnorables(raw, idx)
+			if idx >= len(raw) {
+				break
+			}
+			if spacingLen := toolMarkupWhitespaceLikeLenAt(raw, idx); spacingLen > 0 {
+				break
+			}
+			if toolMarkupEqualsLenAt(raw, idx) > 0 || xmlTagEndDelimiterLenAt(raw, idx) > 0 {
+				break
+			}
+			if _, ok := consumeToolMarkupPipe(raw, idx); ok {
+				break
+			}
+			if _, ok := consumeToolMarkupClosingSlash(raw, idx); ok {
+				break
+			}
+			_, size := utf8.DecodeRuneInString(raw[idx:])
+			if size <= 0 {
+				idx++
+			} else {
+				idx += size
+			}
+		}
+		keyEnd := idx
+		key := normalizeCanonicalToolAttrKey(raw[keyStart:keyEnd])
+		idx = skipToolMarkupIgnorables(raw, idx)
+		for {
+			spacingLen := toolMarkupWhitespaceLikeLenAt(raw, idx)
+			if spacingLen == 0 {
+				break
+			}
+			idx += spacingLen
+			idx = skipToolMarkupIgnorables(raw, idx)
+		}
+		if eqLen := toolMarkupEqualsLenAt(raw, idx); eqLen > 0 {
+			idx += eqLen
+		} else {
+			continue
+		}
+		idx = skipToolMarkupIgnorables(raw, idx)
+		for {
+			spacingLen := toolMarkupWhitespaceLikeLenAt(raw, idx)
+			if spacingLen == 0 {
+				break
+			}
+			idx += spacingLen
+			idx = skipToolMarkupIgnorables(raw, idx)
+		}
+		if key == "" {
+			_, size := utf8.DecodeRuneInString(raw[idx:])
+			if size <= 0 {
+				idx++
+			} else {
+				idx += size
+			}
+			continue
+		}
+
+		value := ""
+		if quote, quoteLen := xmlQuotePairAt(raw, idx); quoteLen > 0 {
+			valueStart := idx + quoteLen
+			idx = valueStart
+			for idx < len(raw) {
+				if closeLen := xmlQuoteCloseDelimiterLenAt(raw, idx, quote); closeLen > 0 {
+					value = raw[valueStart:idx]
+					idx += closeLen
+					break
+				}
+				_, size := utf8.DecodeRuneInString(raw[idx:])
+				if size <= 0 {
+					idx++
+				} else {
+					idx += size
+				}
+			}
+		} else {
+			valueStart := idx
+			for idx < len(raw) {
+				if spacingLen := toolMarkupWhitespaceLikeLenAt(raw, idx); spacingLen > 0 {
+					break
+				}
+				if xmlTagEndDelimiterLenAt(raw, idx) > 0 || toolMarkupEqualsLenAt(raw, idx) > 0 {
+					break
+				}
+				if _, ok := consumeToolMarkupPipe(raw, idx); ok {
+					break
+				}
+				if _, ok := consumeToolMarkupClosingSlash(raw, idx); ok {
+					break
+				}
+				_, size := utf8.DecodeRuneInString(raw[idx:])
+				if size <= 0 {
+					idx++
+				} else {
+					idx += size
+				}
+			}
+			value = raw[valueStart:idx]
+		}
+
+		out = append(out, canonicalToolMarkupAttr{
+			Key:   key,
+			Value: value,
+		})
+	}
+	return out
+}
+
+func normalizeCanonicalToolAttrKey(raw string) string {
+	trimmed := strings.TrimSpace(removeToolMarkupIgnorables(raw))
+	if trimmed == "" {
+		return ""
+	}
+	if next, ok := consumeToolKeyword(trimmed, 0, "name"); ok {
+		if skipToolMarkupIgnorables(trimmed, next) == len(trimmed) {
+			return "name"
+		}
+	}
+	return ""
+}
+
+func quoteCanonicalXMLAttrValue(raw string) string {
+	if raw == "" {
+		return ""
+	}
+	return strings.ReplaceAll(raw, `"`, "&quot;")
+}
+
+func removeToolMarkupIgnorables(raw string) string {
+	if raw == "" {
+		return ""
+	}
+	var b strings.Builder
+	b.Grow(len(raw))
+	for i := 0; i < len(raw); {
+		if ignorableLen := toolMarkupIgnorableLenAt(raw, i); ignorableLen > 0 {
+			i += ignorableLen
+			continue
+		}
+		r, size := utf8.DecodeRuneInString(raw[i:])
+		if size <= 0 {
+			b.WriteByte(raw[i])
+			i++
+			continue
+		}
+		b.WriteRune(r)
+		i += size
+	}
+	return b.String()
+}
+
+func skipToolMarkupIgnorables(text string, idx int) int {
+	for idx < len(text) {
+		if ignorableLen := toolMarkupIgnorableLenAt(text, idx); ignorableLen > 0 {
+			idx += ignorableLen
+			continue
+		}
+		break
+	}
+	return idx
+}
+
+func toolMarkupIgnorableLenAt(text string, idx int) int {
+	if idx < 0 || idx >= len(text) {
+		return 0
+	}
+	r, size := utf8.DecodeRuneInString(text[idx:])
+	if size <= 0 {
+		return 0
+	}
+	if unicode.Is(unicode.Cf, r) {
+		return size
+	}
+	if unicode.IsControl(r) && !unicode.IsSpace(r) {
+		return size
+	}
+	return 0
+}
+
+func toolMarkupEqualsLenAt(text string, idx int) int {
+	idx = skipToolMarkupIgnorables(text, idx)
+	if idx < 0 || idx >= len(text) {
+		return 0
+	}
+	switch {
+	case text[idx] == '=':
+		return 1
+	case strings.HasPrefix(text[idx:], "＝"):
+		return len("＝")
+	case strings.HasPrefix(text[idx:], "﹦"):
+		return len("﹦")
+	case strings.HasPrefix(text[idx:], "꞊"):
+		return len("꞊")
+	default:
+		return 0
+	}
+}
+
+func toolMarkupDashLenAt(text string, idx int) int {
+	idx = skipToolMarkupIgnorables(text, idx)
+	if idx < 0 || idx >= len(text) {
+		return 0
+	}
+	switch {
+	case text[idx] == '-':
+		return 1
+	case strings.HasPrefix(text[idx:], "‐"):
+		return len("‐")
+	case strings.HasPrefix(text[idx:], "‑"):
+		return len("‑")
+	case strings.HasPrefix(text[idx:], "‒"):
+		return len("‒")
+	case strings.HasPrefix(text[idx:], "–"):
+		return len("–")
+	case strings.HasPrefix(text[idx:], "—"):
+		return len("—")
+	case strings.HasPrefix(text[idx:], "―"):
+		return len("―")
+	case strings.HasPrefix(text[idx:], "−"):
+		return len("−")
+	case strings.HasPrefix(text[idx:], "﹣"):
+		return len("﹣")
+	case strings.HasPrefix(text[idx:], "－"):
+		return len("－")
+	default:
+		return 0
+	}
+}
+
+func toolMarkupUnderscoreLenAt(text string, idx int) int {
+	idx = skipToolMarkupIgnorables(text, idx)
+	if idx < 0 || idx >= len(text) {
+		return 0
+	}
+	switch {
+	case text[idx] == '_':
+		return 1
+	case strings.HasPrefix(text[idx:], "＿"):
+		return len("＿")
+	case strings.HasPrefix(text[idx:], "﹍"):
+		return len("﹍")
+	case strings.HasPrefix(text[idx:], "﹎"):
+		return len("﹎")
+	case strings.HasPrefix(text[idx:], "﹏"):
+		return len("﹏")
+	default:
+		return 0
+	}
+}
+
+func consumeToolKeyword(text string, idx int, keyword string) (int, bool) {
+	next := idx
+	for i := 0; i < len(keyword); i++ {
+		next = skipToolMarkupIgnorables(text, next)
+		if next >= len(text) {
+			return idx, false
+		}
+		target := asciiLower(keyword[i])
+		switch target {
+		case '_':
+			if underscoreLen := toolMarkupUnderscoreLenAt(text, next); underscoreLen > 0 {
+				next += underscoreLen
+				continue
+			}
+			return idx, false
+		case '-':
+			if dashLen := toolMarkupDashLenAt(text, next); dashLen > 0 {
+				next += dashLen
+				continue
+			}
+			return idx, false
+		default:
+			r, size := utf8.DecodeRuneInString(text[next:])
+			if size <= 0 {
+				return idx, false
+			}
+			folded, ok := foldToolKeywordRune(r)
+			if !ok || folded != target {
+				return idx, false
+			}
+			next += size
+		}
+	}
+	return next, true
+}
+
+func foldToolKeywordRune(r rune) (byte, bool) {
+	if r >= 'Ａ' && r <= 'Ｚ' {
+		r = r - 'Ａ' + 'A'
+	}
+	if r >= 'ａ' && r <= 'ｚ' {
+		r = r - 'ａ' + 'a'
+	}
+	r = unicode.ToLower(r)
+	switch r {
+	case 'a', 'c', 'd', 'e', 'i', 'k', 'l', 'm', 'n', 'o', 'p', 'r', 's', 't', 'v':
+		return byte(r), true
+	case 'а', 'Α', 'α':
+		return 'a', true
+	case 'с', 'С', 'ϲ', 'Ϲ':
+		return 'c', true
+	case 'ԁ', 'ⅾ':
+		return 'd', true
+	case 'е', 'Е', 'Ε', 'ε':
+		return 'e', true
+	case 'і', 'І', 'Ι', 'ι', 'ı':
+		return 'i', true
+	case 'к', 'К', 'Κ', 'κ':
+		return 'k', true
+	case 'ⅼ':
+		return 'l', true
+	case 'м', 'М', 'Μ', 'μ':
+		return 'm', true
+	case 'ո':
+		return 'n', true
+	case 'о', 'О', 'Ο', 'ο':
+		return 'o', true
+	case 'р', 'Р', 'Ρ', 'ρ':
+		return 'p', true
+	case 'ѕ', 'Ѕ':
+		return 's', true
+	case 'т', 'Т', 'Τ', 'τ':
+		return 't', true
+	case 'ν', 'Ν', 'ѵ', 'ⅴ':
+		return 'v', true
+	default:
+		return 0, false
+	}
+}
+
+func toolMarkupWhitespaceLikeLenAt(text string, idx int) int {
+	idx = skipToolMarkupIgnorables(text, idx)
+	if idx < 0 || idx >= len(text) {
+		return 0
+	}
+	switch text[idx] {
+	case ' ', '\t', '\n', '\r':
+		return 1
+	}
+	if strings.HasPrefix(text[idx:], "▁") {
+		return len("▁")
+	}
+	r, size := utf8.DecodeRuneInString(text[idx:])
+	if size > 0 && unicode.IsSpace(r) {
+		return size
+	}
+	return 0
+}
+
+func consumeToolMarkupPipe(text string, idx int) (int, bool) {
+	idx = skipToolMarkupIgnorables(text, idx)
+	if idx >= len(text) {
+		return idx, false
+	}
+	switch {
+	case text[idx] == '|':
+		return idx + 1, true
+	case strings.HasPrefix(text[idx:], "｜"):
+		return idx + len("｜"), true
+	case strings.HasPrefix(text[idx:], "│"):
+		return idx + len("│"), true
+	case strings.HasPrefix(text[idx:], "∣"):
+		return idx + len("∣"), true
+	case strings.HasPrefix(text[idx:], "❘"):
+		return idx + len("❘"), true
+	case strings.HasPrefix(text[idx:], "ǀ"):
+		return idx + len("ǀ"), true
+	case strings.HasPrefix(text[idx:], "￨"):
+		return idx + len("￨"), true
+	default:
+		return idx, false
+	}
+}
+
+func consumeToolMarkupClosingSlash(text string, idx int) (int, bool) {
+	idx = skipToolMarkupIgnorables(text, idx)
+	if idx >= len(text) {
+		return idx, false
+	}
+	switch {
+	case text[idx] == '/':
+		return idx + 1, true
+	case strings.HasPrefix(text[idx:], "／"):
+		return idx + len("／"), true
+	case strings.HasPrefix(text[idx:], "∕"):
+		return idx + len("∕"), true
+	case strings.HasPrefix(text[idx:], "⁄"):
+		return idx + len("⁄"), true
+	case strings.HasPrefix(text[idx:], "⧸"):
+		return idx + len("⧸"), true
+	default:
+		return idx, false
+	}
+}
+
+func xmlTagStartDelimiterLenAt(text string, idx int) int {
+	idx = skipToolMarkupIgnorables(text, idx)
+	if idx < 0 || idx >= len(text) {
+		return 0
+	}
+	switch {
+	case text[idx] == '<':
+		return 1
+	case strings.HasPrefix(text[idx:], "＜"):
+		return len("＜")
+	case strings.HasPrefix(text[idx:], "﹤"):
+		return len("﹤")
+	case strings.HasPrefix(text[idx:], "〈"):
+		return len("〈")
+	default:
+		return 0
+	}
+}
+
+func xmlTagEndDelimiterLenAt(text string, idx int) int {
+	idx = skipToolMarkupIgnorables(text, idx)
+	if idx < 0 || idx >= len(text) {
+		return 0
+	}
+	switch {
+	case text[idx] == '>':
+		return 1
+	case strings.HasPrefix(text[idx:], "＞"):
+		return len("＞")
+	case strings.HasPrefix(text[idx:], "﹥"):
+		return len("﹥")
+	case strings.HasPrefix(text[idx:], "〉"):
+		return len("〉")
+	default:
+		return 0
+	}
+}
+
+func xmlTagEndDelimiterLenEndingAt(text string, end int) int {
+	if end < 0 || end >= len(text) {
+		return 0
+	}
+	if text[end] == '>' {
+		return 1
+	}
+	if end+1 >= len("＞") && text[end+1-len("＞"):end+1] == "＞" {
+		return len("＞")
+	}
+	return 0
+}
+
+func xmlQuotePairAt(text string, idx int) (string, int) {
+	idx = skipToolMarkupIgnorables(text, idx)
+	if idx < 0 || idx >= len(text) {
+		return "", 0
+	}
+	switch {
+	case text[idx] == '"':
+		return `"`, 1
+	case text[idx] == '\'':
+		return `'`, 1
+	case strings.HasPrefix(text[idx:], "“"):
+		return "”", len("“")
+	case strings.HasPrefix(text[idx:], "‘"):
+		return "’", len("‘")
+	case strings.HasPrefix(text[idx:], "＂"):
+		return "＂", len("＂")
+	case strings.HasPrefix(text[idx:], "＇"):
+		return "＇", len("＇")
+	case strings.HasPrefix(text[idx:], "„"):
+		return "”", len("„")
+	case strings.HasPrefix(text[idx:], "‟"):
+		return "”", len("‟")
+	default:
+		return "", 0
+	}
+}
+
+func xmlQuoteCloseDelimiterLenAt(text string, idx int, quote string) int {
+	if quote == "" || idx < 0 || idx >= len(text) {
+		return 0
+	}
+	if strings.HasPrefix(text[idx:], quote) {
+		return len(quote)
+	}
+	return 0
+}
+
+func hasRepairableXMLToolCallsWrapper(text string) bool {
+	if strings.TrimSpace(text) == "" {
+		return false
+	}
+	if strings.Contains(strings.ToLower(text), "<tool_calls") {
+		return false
+	}
+	closeMatches := xmlToolCallsClosePattern.FindAllStringIndex(text, -1)
+	if len(closeMatches) == 0 {
+		return false
+	}
+	invokeLoc := xmlInvokeStartPattern.FindStringIndex(text)
+	if invokeLoc == nil {
+		return false
+	}
+	closeLoc := closeMatches[len(closeMatches)-1]
+	return invokeLoc[0] < closeLoc[0]
+}
+
+func toolCDATAOpenLenAt(text string, idx int) int {
+	start := skipToolMarkupIgnorables(text, idx)
+	ltLen := xmlTagStartDelimiterLenAt(text, start)
+	if ltLen == 0 {
+		return 0
+	}
+	pos := start + ltLen
+	for skipped := 0; skipped <= 4 && pos < len(text); skipped++ {
+		pos = skipToolMarkupIgnorables(text, pos)
+		if pos >= len(text) {
+			return 0
+		}
+		if text[pos] == '[' {
+			pos++
+			next, ok := consumeToolKeyword(text, pos, "cdata")
+			if !ok {
+				return 0
+			}
+			pos = skipToolMarkupIgnorables(text, next)
+			if pos >= len(text) || text[pos] != '[' {
+				return 0
+			}
+			pos++
+			return pos - idx
+		}
+		r, size := utf8.DecodeRuneInString(text[pos:])
+		if size <= 0 || !isToolMarkupSeparator(r) {
+			return 0
+		}
+		pos += size
+	}
+	return 0
+}
+
+func indexToolCDATAOpen(text string, start int) int {
+	for i := maxInt(start, 0); i < len(text); i++ {
+		if toolCDATAOpenLenAt(text, i) > 0 {
+			return i
+		}
+	}
+	return -1
+}
+
+func findTrailingToolCDATACloseStart(text string) int {
+	for i := len(text) - 1; i >= 0; i-- {
+		if closeLen := toolCDATACloseLenAt(text, i); closeLen > 0 && i+closeLen == len(text) {
+			return i
+		}
+	}
+	return -1
+}
diff --git a/internal/toolcall/toolcalls_dsml.go b/internal/toolcall/toolcalls_dsml.go
index a5d9c4a..6cd595a 100644
--- a/internal/toolcall/toolcalls_dsml.go
+++ b/internal/toolcall/toolcalls_dsml.go
@@ -2,18 +2,18 @@ package toolcall
 
 import (
 	"strings"
-	"unicode/utf8"
 )
 
 func normalizeDSMLToolCallMarkup(text string) (string, bool) {
 	if text == "" {
 		return "", true
 	}
-	hasAliasLikeMarkup, _ := ContainsToolMarkupSyntaxOutsideIgnored(text)
-	if !hasAliasLikeMarkup {
-		return text, true
+	canonicalized := canonicalizeToolCallCandidateSpans(text)
+	hasDSMLLikeMarkup, hasCanonicalMarkup := ContainsToolMarkupSyntaxOutsideIgnored(canonicalized)
+	if !hasDSMLLikeMarkup && !hasCanonicalMarkup {
+		return canonicalized, true
 	}
-	return rewriteDSMLToolMarkupOutsideIgnored(text), true
+	return rewriteDSMLToolMarkupOutsideIgnored(canonicalized), true
 }
 
 func rewriteDSMLToolMarkupOutsideIgnored(text string) string {
@@ -39,76 +39,19 @@ func rewriteDSMLToolMarkupOutsideIgnored(text string) string {
 			i++
 			continue
 		}
-		if tag.DSMLLike {
-			b.WriteByte('<')
-			if tag.Closing {
-				b.WriteByte('/')
-			}
-			b.WriteString(tag.Name)
-			tail := normalizeToolMarkupTagTailForXML(text[tag.NameEnd : tag.End+1])
-			b.WriteString(tail)
-			if !strings.HasSuffix(tail, ">") {
-				b.WriteByte('>')
-			}
-			i = tag.End + 1
-			continue
+		b.WriteByte('<')
+		if tag.Closing {
+			b.WriteByte('/')
+		}
+		b.WriteString(tag.Name)
+		if delimLen := xmlTagEndDelimiterLenEndingAt(text, tag.End); delimLen > 0 {
+			b.WriteString(text[tag.NameEnd : tag.End+1-delimLen])
+			b.WriteByte('>')
+		} else {
+			b.WriteString(text[tag.NameEnd : tag.End+1])
+			b.WriteByte('>')
 		}
-		b.WriteString(text[tag.Start : tag.End+1])
 		i = tag.End + 1
 	}
 	return b.String()
 }
-
-func normalizeToolMarkupTagTailForXML(tail string) string {
-	if tail == "" {
-		return ""
-	}
-	var b strings.Builder
-	b.Grow(len(tail))
-	quote := rune(0)
-	for i := 0; i < len(tail); {
-		r, size := utf8.DecodeRuneInString(tail[i:])
-		if r == utf8.RuneError && size == 1 {
-			b.WriteByte(tail[i])
-			i++
-			continue
-		}
-		ch := normalizeFullwidthASCII(r)
-		if quote != 0 {
-			b.WriteRune(ch)
-			if ch == quote {
-				quote = 0
-			}
-			i += size
-			continue
-		}
-		switch ch {
-		case '"', '\'':
-			quote = ch
-			b.WriteRune(ch)
-		case '|', '!':
-			j := i + size
-			for j < len(tail) {
-				next, nextSize := utf8.DecodeRuneInString(tail[j:])
-				if nextSize <= 0 {
-					break
-				}
-				if next == ' ' || next == '\t' || next == '\r' || next == '\n' {
-					j += nextSize
-					continue
-				}
-				break
-			}
-			next, _ := normalizedASCIIAt(tail, j)
-			if next != '>' {
-				b.WriteRune(ch)
-			}
-		case '>', '/', '=':
-			b.WriteRune(ch)
-		default:
-			b.WriteString(tail[i : i+size])
-		}
-		i += size
-	}
-	return b.String()
-}
diff --git a/internal/toolcall/toolcalls_markup.go b/internal/toolcall/toolcalls_markup.go
index 08cf07e..fc45731 100644
--- a/internal/toolcall/toolcalls_markup.go
+++ b/internal/toolcall/toolcalls_markup.go
@@ -105,32 +105,18 @@ func extractRawTagValue(inner string) string {
 
 func extractStandaloneCDATA(inner string) (string, bool) {
 	trimmed := strings.TrimSpace(inner)
-	if bodyStart, ok := matchToolCDATAOpenAt(trimmed, 0); ok {
-		end := findStandaloneCDATAEnd(trimmed, bodyStart)
-		if end < 0 {
-			return trimmed[bodyStart:], true
+	if openLen := toolCDATAOpenLenAt(trimmed, 0); openLen > 0 {
+		if closeStart := findTrailingToolCDATACloseStart(trimmed); closeStart >= openLen {
+			return trimmed[openLen:closeStart], true
 		}
-		return trimmed[bodyStart:end], true
+		if end := findToolCDATAEnd(trimmed, openLen); end >= 0 {
+			return trimmed[openLen:end], true
+		}
+		return trimmed[openLen:], true
 	}
 	return "", false
 }
 
-func findStandaloneCDATAEnd(text string, from int) int {
-	end := -1
-	for searchFrom := from; searchFrom < len(text); {
-		next := indexToolCDATAClose(text, searchFrom)
-		if next < 0 {
-			break
-		}
-		closeEnd := next + toolCDATACloseLenAt(text, next)
-		if strings.TrimSpace(text[closeEnd:]) == "" {
-			end = next
-		}
-		searchFrom = closeEnd
-	}
-	return end
-}
-
 func parseJSONLiteralValue(raw string) (any, bool) {
 	trimmed := strings.TrimSpace(raw)
 	if trimmed == "" {
@@ -159,24 +145,22 @@ func SanitizeLooseCDATA(text string) string {
 		return ""
 	}
 
-	const openMarker = "<![cdata["
-	const closeMarker = "]]>"
-
 	var b strings.Builder
 	b.Grow(len(text))
 	changed := false
 	pos := 0
 	for pos < len(text) {
-		start := indexASCIIFold(text, pos, openMarker)
+		start := indexToolCDATAOpen(text, pos)
 		if start < 0 {
 			b.WriteString(text[pos:])
 			break
 		}
-		contentStart := start + len(openMarker)
+		openLen := toolCDATAOpenLenAt(text, start)
+		contentStart := start + openLen
 		b.WriteString(text[pos:start])
 
-		if endRel := indexASCIIFold(text, contentStart, closeMarker); endRel >= 0 {
-			end := endRel + len(closeMarker)
+		if endRel := findToolCDATAEnd(text, contentStart); endRel >= 0 {
+			end := endRel + toolCDATACloseLenAt(text, endRel)
 			b.WriteString(text[start:end])
 			pos = end
 			continue
diff --git a/internal/toolcall/toolcalls_parse.go b/internal/toolcall/toolcalls_parse.go
index 3880da9..4e4f704 100644
--- a/internal/toolcall/toolcalls_parse.go
+++ b/internal/toolcall/toolcalls_parse.go
@@ -53,7 +53,6 @@ func parseToolCallsDetailedXMLOnly(text string) ToolCallParseResult {
 	if trimmed == "" {
 		return result
 	}
-	result.SawToolCallSyntax = looksLikeToolCallSyntax(trimmed)
 	trimmed = stripFencedCodeBlocks(trimmed)
 	trimmed = strings.TrimSpace(trimmed)
 	if trimmed == "" {
@@ -64,8 +63,9 @@ func parseToolCallsDetailedXMLOnly(text string) ToolCallParseResult {
 	if !ok {
 		return result
 	}
+	result.SawToolCallSyntax = looksLikeToolCallSyntax(normalized) || hasRepairableXMLToolCallsWrapper(normalized)
 	parsed := parseXMLToolCalls(normalized)
-	if len(parsed) == 0 && strings.Contains(strings.ToLower(normalized), "<![cdata[") {
+	if len(parsed) == 0 && indexToolCDATAOpen(normalized, 0) >= 0 {
 		recovered := SanitizeLooseCDATA(normalized)
 		if recovered != normalized {
 			parsed = parseXMLToolCalls(recovered)
@@ -154,7 +154,7 @@ func stripFencedCodeBlocks(text string) string {
 }
 
 func cdataStartsBeforeFence(line string) bool {
-	cdataIdx := strings.Index(strings.ToLower(line), "<![cdata[")
+	cdataIdx := indexToolCDATAOpen(line, 0)
 	if cdataIdx < 0 {
 		return false
 	}
@@ -183,11 +183,14 @@ func updateCDATAStateForStrip(inCDATA bool, cdataFenceMarker, line string) (bool
 	fenceMarker := cdataFenceMarker
 	lineForFence := line
 	if !state {
-		start := indexASCIIFold(line, pos, "<![cdata[")
+		start := indexToolCDATAOpen(line, pos)
 		if start < 0 {
 			return false, ""
 		}
-		pos = start + len("<![cdata[")
+		pos = start + toolCDATAOpenLenAt(line, start)
+		if pos > len(line) {
+			pos = len(line)
+		}
 		state = true
 		lineForFence = line[pos:]
 	}
@@ -205,22 +208,36 @@ func updateCDATAStateForStrip(inCDATA bool, cdataFenceMarker, line string) (bool
 	}
 
 	for pos < len(line) {
-		endPos := indexASCIIFold(line, pos, "]]>")
+		endPos := -1
+		closeLen := 0
+		for search := pos; search < len(line); search++ {
+			if foundLen := toolCDATACloseLenAt(line, search); foundLen > 0 {
+				endPos = search
+				closeLen = foundLen
+				break
+			}
+		}
 		if endPos < 0 {
 			return true, fenceMarker
 		}
-		pos = endPos + len("]]>")
+		pos = endPos + closeLen
+		if pos > len(line) {
+			pos = len(line)
+		}
 		if fenceMarker != "" {
 			continue
 		}
 		if cdataEndLooksStructural(line, pos) || strings.TrimSpace(line[pos:]) == "" {
 			state = false
 			for pos < len(line) {
-				start := indexASCIIFold(line, pos, "<![cdata[")
+				start := indexToolCDATAOpen(line, pos)
 				if start < 0 {
 					return false, ""
 				}
-				pos = start + len("<![cdata[")
+				pos = start + toolCDATAOpenLenAt(line, start)
+				if pos > len(line) {
+					pos = len(line)
+				}
 				state = true
 				trimmedTail := strings.TrimLeft(line[pos:], " \t")
 				if marker, ok := parseFenceOpen(trimmedTail); ok {
diff --git a/internal/toolcall/toolcalls_parse_markup.go b/internal/toolcall/toolcalls_parse_markup.go
index 4660c50..0d222bd 100644
--- a/internal/toolcall/toolcalls_parse_markup.go
+++ b/internal/toolcall/toolcalls_parse_markup.go
@@ -229,27 +229,13 @@ func skipXMLIgnoredSection(text string, i int) (next int, advanced bool, blocked
 }
 
 func matchToolCDATAOpenAt(text string, start int) (int, bool) {
-	i, ok := consumeToolMarkupLessThan(text, start)
-	if !ok {
-		return start, false
-	}
-	for skipped := 0; skipped <= 4 && i < len(text); skipped++ {
-		if cdataLen, ok := matchASCIIPrefixFoldAt(text, i, "[cdata["); ok {
-			return i + cdataLen, true
-		}
-		r, size := utf8.DecodeRuneInString(text[i:])
-		if size <= 0 || !isToolCDATAOpenSeparator(r) {
-			break
-		}
-		i += size
+	openLen := toolCDATAOpenLenAt(text, start)
+	if openLen > 0 {
+		return start + openLen, true
 	}
 	return start, false
 }
 
-func isToolCDATAOpenSeparator(r rune) bool {
-	return isToolMarkupSeparator(r)
-}
-
 func hasASCIIPrefixFoldAt(text string, start int, prefix string) bool {
 	_, ok := matchASCIIPrefixFoldAt(text, start, prefix)
 	return ok
@@ -280,23 +266,6 @@ func asciiLower(b byte) byte {
 	return b
 }
 
-// indexASCIIFold returns the absolute byte position in s where substr (ASCII-only) is
-// found case-insensitively, scanning forward from start. Returns -1 if not found.
-// Unlike strings.Index on a lowercased copy, this does not allocate or risk byte-length
-// mismatch when non-ASCII runes change width under case folding.
-func indexASCIIFold(s string, start int, substr string) int {
-	if start < 0 || len(s)-start < len(substr) {
-		return -1
-	}
-	end := len(s) - len(substr) + 1
-	for i := start; i < end; i++ {
-		if hasASCIIPrefixFoldAt(s, i, substr) {
-			return i
-		}
-	}
-	return -1
-}
-
 func findToolCDATAEnd(text string, from int) int {
 	if from < 0 || from >= len(text) {
 		return -1
@@ -342,13 +311,19 @@ func indexToolCDATAClose(text string, from int) int {
 }
 
 func toolCDATACloseLenAt(text string, idx int) int {
+	if idx < 0 || idx >= len(text) {
+		return 0
+	}
 	if strings.HasPrefix(text[idx:], "]]〉") {
 		return len("]]〉")
 	}
 	if strings.HasPrefix(text[idx:], "]]＞") {
 		return len("]]＞")
 	}
-	return len("]]>")
+	if strings.HasPrefix(text[idx:], "]]>") {
+		return len("]]>")
+	}
+	return 0
 }
 
 func cdataEndLooksStructural(text string, after int) bool {
diff --git a/internal/toolcall/toolcalls_scan.go b/internal/toolcall/toolcalls_scan.go
index 39727d1..f14ca15 100644
--- a/internal/toolcall/toolcalls_scan.go
+++ b/internal/toolcall/toolcalls_scan.go
@@ -2,6 +2,7 @@ package toolcall
 
 import (
 	"strings"
+	"unicode"
 	"unicode/utf8"
 )
 
@@ -148,9 +149,9 @@ func scanToolMarkupTagAt(text string, start int) (ToolMarkupTag, bool) {
 		i = next
 	}
 	closing := false
-	if i < len(text) && text[i] == '/' {
+	if next, ok := consumeToolMarkupClosingSlash(text, i); ok {
 		closing = true
-		i++
+		i = next
 	}
 	prefixStart := i
 	i, dsmlLike := consumeToolMarkupNamePrefix(text, i)
@@ -252,17 +253,18 @@ func consumeToolMarkupNamePrefix(text string, idx int) (int, bool) {
 }
 
 func consumeToolMarkupNamePrefixOnce(text string, idx int) (int, bool) {
+	idx = skipToolMarkupIgnorables(text, idx)
 	if next, ok := consumeToolMarkupSeparator(text, idx); ok {
 		return next, true
 	}
-	if idx < len(text) && (text[idx] == ' ' || text[idx] == '\t' || text[idx] == '\r' || text[idx] == '\n') {
-		return idx + 1, true
+	if spacingLen := toolMarkupWhitespaceLikeLenAt(text, idx); spacingLen > 0 {
+		return idx + spacingLen, true
 	}
-	if hasASCIIPrefixFoldAt(text, idx, "dsml") {
-		dsmlLen, _ := matchASCIIPrefixFoldAt(text, idx, "dsml")
-		next := idx + dsmlLen
-		if sep, size := normalizedASCIIAt(text, next); sep == '-' || sep == '_' {
-			next += size
+	if next, ok := consumeToolKeyword(text, idx, "dsml"); ok {
+		if dashLen := toolMarkupDashLenAt(text, next); dashLen > 0 {
+			next += dashLen
+		} else if underscoreLen := toolMarkupUnderscoreLenAt(text, next); underscoreLen > 0 {
+			next += underscoreLen
 		}
 		return next, true
 	}
@@ -353,8 +355,8 @@ func matchToolMarkupName(text string, start int, dsmlLike bool) (string, int) {
 		if name.dsmlOnly && !dsmlLike {
 			continue
 		}
-		if nameLen, ok := matchASCIIPrefixFoldAt(text, start, name.raw); ok {
-			return name.canonical, nameLen
+		if next, ok := consumeToolKeyword(text, start, name.raw); ok {
+			return name.canonical, next - start
 		}
 	}
 	return "", 0
@@ -366,14 +368,14 @@ func matchToolMarkupNameAfterArbitraryPrefix(text string, start int) (string, in
 			return "", 0, 0, false
 		}
 		for _, name := range toolMarkupNames {
-			nameLen, ok := matchASCIIPrefixFoldAt(text, idx, name.raw)
+			next, ok := consumeToolKeyword(text, idx, name.raw)
 			if !ok {
 				continue
 			}
 			if !toolMarkupPrefixAllowsLocalNameAt(text, start, idx) {
 				continue
 			}
-			return name.canonical, idx, nameLen, true
+			return name.canonical, idx, next - idx, true
 		}
 		_, size := utf8.DecodeRuneInString(text[idx:])
 		if size <= 0 {
@@ -477,6 +479,7 @@ func isToolMarkupTagTerminator(text string, idx int) bool {
 }
 
 func consumeToolMarkupSeparator(text string, idx int) (int, bool) {
+	idx = skipToolMarkupIgnorables(text, idx)
 	if idx >= len(text) {
 		return idx, false
 	}
@@ -495,6 +498,9 @@ func isToolMarkupSeparator(r rune) bool {
 	if ch == ' ' || ch == '\t' || ch == '\n' || ch == '\r' {
 		return false
 	}
+	if r == '▁' || unicode.IsSpace(r) {
+		return false
+	}
 	if (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9') {
 		return false
 	}
@@ -502,6 +508,7 @@ func isToolMarkupSeparator(r rune) bool {
 }
 
 func consumeToolMarkupLessThan(text string, idx int) (int, bool) {
+	idx = skipToolMarkupIgnorables(text, idx)
 	ch, size := normalizedASCIIAt(text, idx)
 	if size <= 0 || ch != '<' {
 		return idx, false
@@ -510,16 +517,17 @@ func consumeToolMarkupLessThan(text string, idx int) (int, bool) {
 }
 
 func hasToolMarkupBoundary(text string, idx int) bool {
+	idx = skipToolMarkupIgnorables(text, idx)
 	if idx >= len(text) {
 		return true
 	}
-	switch text[idx] {
-	case ' ', '\t', '\n', '\r', '>', '/':
+	if toolMarkupWhitespaceLikeLenAt(text, idx) > 0 {
 		return true
-	default:
-		r, _ := utf8.DecodeRuneInString(text[idx:])
-		return normalizeFullwidthASCII(r) == '>'
 	}
+	if _, ok := consumeToolMarkupClosingSlash(text, idx); ok {
+		return true
+	}
+	return xmlTagEndDelimiterLenAt(text, idx) > 0
 }
 
 func normalizedASCIIAt(text string, idx int) (byte, int) {
diff --git a/internal/toolcall/toolcalls_test.go b/internal/toolcall/toolcalls_test.go
index f706f9c..eb62ce5 100644
--- a/internal/toolcall/toolcalls_test.go
+++ b/internal/toolcall/toolcalls_test.go
@@ -1201,3 +1201,108 @@ func TestFindMatchingToolMarkupCloseBoundaryConditions(t *testing.T) {
 		})
 	}
 }
+
+func TestParseToolCallsSupportsDSMLShellWithFullwidthClosingSlash(t *testing.T) {
+	text := `<｜DSML｜tool_calls><｜DSML｜invoke name="execute_code"><｜DSML｜parameter name="code"><![CDATA[print("hi")]]></｜DSML｜parameter></｜DSML｜invoke><／DSML｜tool_calls>`
+	calls := ParseToolCalls(text, []string{"execute_code"})
+	if len(calls) != 1 {
+		t.Fatalf("expected 1 DSML call with fullwidth closing slash, got %#v", calls)
+	}
+	if calls[0].Name != "execute_code" || calls[0].Input["code"] != `print("hi")` {
+		t.Fatalf("unexpected fullwidth-closing-slash DSML parse result: %#v", calls[0])
+	}
+}
+
+func TestParseToolCallsSupportsDSMLShellWithSentencePieceSeparatorAndFullwidthGT(t *testing.T) {
+	text := `<｜DSML▁tool_calls｜><｜DSML▁invoke▁name="execute_code"><｜DSML▁parameter▁name="code"><![CDATA[print("hi")]]></｜DSML▁parameter></｜DSML▁invoke></｜DSML▁tool_calls＞`
+	calls := ParseToolCalls(text, []string{"execute_code"})
+	if len(calls) != 1 {
+		t.Fatalf("expected 1 DSML call with sentencepiece separator and fullwidth terminator, got %#v", calls)
+	}
+	if calls[0].Name != "execute_code" || calls[0].Input["code"] != `print("hi")` {
+		t.Fatalf("unexpected sentencepiece/fullwidth-terminator DSML parse result: %#v", calls[0])
+	}
+}
+
+func TestParseToolCallsSupportsDSMLShellWithFullwidthLTUnicodeSpaceAndFullwidthAttributes(t *testing.T) {
+	text := `＜｜DSML　tool_calls＞＜｜DSML　invoke　name＝“execute_code”＞＜｜DSML　parameter　name＝“code”＞<![CDATA[print("hi")]]>＜／DSML｜parameter＞＜／DSML｜invoke＞＜／DSML｜tool_calls＞`
+	calls := ParseToolCalls(text, []string{"execute_code"})
+	if len(calls) != 1 {
+		t.Fatalf("expected 1 DSML call with fullwidth opening delimiter and Unicode attribute confusables, got %#v", calls)
+	}
+	if calls[0].Name != "execute_code" || calls[0].Input["code"] != `print("hi")` {
+		t.Fatalf("unexpected fullwidth-opening/Unicode-attr DSML parse result: %#v", calls[0])
+	}
+}
+
+func TestParseToolCallsCanonicalizesConfusableCandidateShellOnly(t *testing.T) {
+	text := "<|\u200b\uff24\u0405\u039cL|to\u03bfl\uff3fcalls>" +
+		"<|\ufeffDSML|inv\u03bfk\u0435 n\u0430me\uff1d\u201cexecute_code\u201d>" +
+		"<|\u200bDSML|par\u0430meter n\u0430me\uff1d\u201ccode\u201d><![\ufeff\u0421D\u0410T\u0410[print(\"hi\")]]>" +
+		"</|\u200bDSML|par\u0430meter></|\u200bDSML|inv\u03bfk\u0435></|\u200b\uff24\u0405\u039cL|to\u03bfl\uff3fcalls>"
+	calls := ParseToolCalls(text, []string{"execute_code"})
+	if len(calls) != 1 {
+		t.Fatalf("expected one confusable-shell call, got %#v", calls)
+	}
+	if calls[0].Name != "execute_code" || calls[0].Input["code"] != `print("hi")` {
+		t.Fatalf("unexpected confusable-shell parse result: %#v", calls[0])
+	}
+}
+
+func TestParseToolCallsKeepsConfusableMarkupInsideCDATAAsText(t *testing.T) {
+	value := "<inv\u03bfke>literal</inv\u03bfke>"
+	text := "<tool_calls><invoke name=\"Write\"><parameter name=\"description\"><![\u200b\u0421D\u0410T\u0410[" + value + "]]></parameter></invoke></tool_calls>"
+	calls := ParseToolCalls(text, []string{"Write"})
+	if len(calls) != 1 {
+		t.Fatalf("expected one Write call, got %#v", calls)
+	}
+	if got, _ := calls[0].Input["description"].(string); got != value {
+		t.Fatalf("expected confusable markup example inside CDATA to stay raw, got %q", got)
+	}
+}
+
+func TestParseToolCallsRepairsMissingOpeningWrapperWithConfusableShell(t *testing.T) {
+	text := "Before tool call\n" +
+		"<inv\u03bfk\u0435 n\u0430me=\"read_file\"><par\u0430meter n\u0430me=\"path\"><![\u200b\u0421D\u0410T\u0410[README.md]]></par\u0430meter></inv\u03bfk\u0435>\n" +
+		"</to\u03bfl_calls>\n" +
+		"after"
+	res := ParseToolCallsDetailed(text, []string{"read_file"})
+	if len(res.Calls) != 1 {
+		t.Fatalf("expected repaired confusable wrapper to parse one call, got %#v", res)
+	}
+	if got, _ := res.Calls[0].Input["path"].(string); got != "README.md" {
+		t.Fatalf("expected repaired confusable wrapper to preserve args, got %#v", res.Calls[0].Input)
+	}
+	if !res.SawToolCallSyntax {
+		t.Fatalf("expected repaired confusable wrapper to mark tool syntax seen, got %#v", res)
+	}
+}
+
+func TestParseToolCallsDoesNotAcceptConfusableNearMissTagName(t *testing.T) {
+	text := "<tool_calls><inv\u03bfker name=\"execute_code\"><parameter name=\"code\">pwd</parameter></inv\u03bfker></tool_calls>"
+	calls := ParseToolCalls(text, []string{"execute_code"})
+	if len(calls) != 0 {
+		t.Fatalf("expected confusable near-miss tag name to remain non-executable, got %#v", calls)
+	}
+}
+
+func TestFindMatchingToolMarkupCloseBoundaryConditionsSupportsConfusableDelimiters(t *testing.T) {
+	tests := []struct {
+		name   string
+		text   string
+		open   ToolMarkupTag
+		wantOk bool
+	}{
+		{"valid_fullwidth_closing_slash", "<tool_calls><／tool_calls>", ToolMarkupTag{Name: "tool_calls", End: 11}, true},
+		{"valid_fullwidth_opening_delimiter", "＜tool_calls＞＜／tool_calls＞", ToolMarkupTag{Name: "tool_calls", End: len("＜tool_calls＞") - 1}, true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, ok := FindMatchingToolMarkupClose(tt.text, tt.open)
+			if ok != tt.wantOk {
+				t.Errorf("FindMatchingToolMarkupClose(%q, %+v) ok = %v, want %v", tt.text, tt.open, ok, tt.wantOk)
+			}
+		})
+	}
+}
diff --git a/internal/toolstream/tool_sieve_xml.go b/internal/toolstream/tool_sieve_xml.go
index 11294bb..ccb09a6 100644
--- a/internal/toolstream/tool_sieve_xml.go
+++ b/internal/toolstream/tool_sieve_xml.go
@@ -141,6 +141,9 @@ func shouldKeepBareInvokeCapture(captured string) bool {
 	if invokeCloseTag, ok := findFirstToolMarkupTagByNameFrom(captured, startEnd+1, "invoke", true); ok {
 		return strings.TrimSpace(captured[invokeCloseTag.End+1:]) == ""
 	}
+	if paramTag, ok := findFirstToolMarkupTagByName(body, 0, "parameter"); ok && strings.TrimSpace(body[:paramTag.Start]) == "" {
+		return true
+	}
 
 	trimmedLower := strings.ToLower(trimmedBody)
 	return strings.HasPrefix(trimmedLower, "<parameter") ||
@@ -149,14 +152,14 @@ func shouldKeepBareInvokeCapture(captured string) bool {
 }
 
 func findPartialXMLToolTagStart(s string) int {
-	lastLT := strings.LastIndex(s, "<")
+	lastLT := lastToolMarkupStartDelimiterIndex(s)
 	if lastLT < 0 {
 		return -1
 	}
 	start := includeDuplicateLeadingLessThan(s, lastLT)
 	tail := s[start:]
-	// If there's a '>' in the tail, the tag is closed — not partial.
-	if strings.Contains(tail, ">") {
+	// If there's a tag terminator in the tail, the tag is closed — not partial.
+	if strings.Contains(tail, ">") || strings.Contains(tail, "＞") {
 		return -1
 	}
 	if toolcall.IsPartialToolMarkupTagPrefix(tail) {
@@ -164,3 +167,12 @@ func findPartialXMLToolTagStart(s string) int {
 	}
 	return -1
 }
+
+func lastToolMarkupStartDelimiterIndex(s string) int {
+	asciiIdx := strings.LastIndex(s, "<")
+	fullwidthIdx := strings.LastIndex(s, "＜")
+	if asciiIdx > fullwidthIdx {
+		return asciiIdx
+	}
+	return fullwidthIdx
+}
diff --git a/internal/toolstream/tool_sieve_xml_test.go b/internal/toolstream/tool_sieve_xml_test.go
index 780dc1b..2701b2f 100644
--- a/internal/toolstream/tool_sieve_xml_test.go
+++ b/internal/toolstream/tool_sieve_xml_test.go
@@ -1335,3 +1335,166 @@ func TestProcessToolSieveIdeographicCommaDSMLDriftDoesNotLeak(t *testing.T) {
 		t.Fatalf("unexpected ideographic-comma DSML drift call: %#v", calls[0])
 	}
 }
+
+func TestProcessToolSieveParsesFullwidthClosingSlashAndKeepsSuffixText(t *testing.T) {
+	var state State
+	chunk := `<｜DSML｜tool_calls><｜DSML｜invoke name="execute_code"><｜DSML｜parameter name="code"><![CDATA[print("hi")]]></｜DSML｜parameter></｜DSML｜invoke><／DSML｜tool_calls> sao cụm này lại đc trả là 1 message`
+	events := ProcessChunk(&state, chunk, []string{"execute_code"})
+	events = append(events, Flush(&state, []string{"execute_code"})...)
+
+	var textContent strings.Builder
+	toolCalls := 0
+	var parsed Event
+	for _, evt := range events {
+		textContent.WriteString(evt.Content)
+		if len(evt.ToolCalls) > 0 {
+			parsed = evt
+		}
+		toolCalls += len(evt.ToolCalls)
+	}
+	if toolCalls != 1 {
+		t.Fatalf("expected exactly one parsed tool call from fullwidth closing slash block, got %d events=%#v", toolCalls, events)
+	}
+	if parsed.ToolCalls[0].Name != "execute_code" || parsed.ToolCalls[0].Input["code"] != `print("hi")` {
+		t.Fatalf("unexpected parsed call from fullwidth closing slash block: %#v", parsed.ToolCalls[0])
+	}
+	if got := textContent.String(); got != " sao cụm này lại đc trả là 1 message" {
+		t.Fatalf("expected suffix text to be preserved, got %q", got)
+	}
+}
+
+func TestProcessToolSieveParsesSentencePieceSeparatorAndFullwidthTerminator(t *testing.T) {
+	var state State
+	chunk := `<｜DSML▁tool_calls｜><｜DSML▁invoke▁name="execute_code"><｜DSML▁parameter▁name="code"><![CDATA[print("hi")]]></｜DSML▁parameter></｜DSML▁invoke></｜DSML▁tool_calls＞ suffix`
+	events := ProcessChunk(&state, chunk, []string{"execute_code"})
+	events = append(events, Flush(&state, []string{"execute_code"})...)
+
+	var textContent strings.Builder
+	toolCalls := 0
+	var parsed Event
+	for _, evt := range events {
+		textContent.WriteString(evt.Content)
+		if len(evt.ToolCalls) > 0 {
+			parsed = evt
+		}
+		toolCalls += len(evt.ToolCalls)
+	}
+	if toolCalls != 1 {
+		t.Fatalf("expected exactly one parsed tool call from sentencepiece/fullwidth-terminator block, got %d events=%#v", toolCalls, events)
+	}
+	if parsed.ToolCalls[0].Name != "execute_code" || parsed.ToolCalls[0].Input["code"] != `print("hi")` {
+		t.Fatalf("unexpected parsed call from sentencepiece/fullwidth-terminator block: %#v", parsed.ToolCalls[0])
+	}
+	if got := textContent.String(); got != " suffix" {
+		t.Fatalf("expected suffix text to be preserved, got %q", got)
+	}
+}
+
+func TestProcessToolSieveParsesFullwidthOpeningDelimiterAndUnicodeAttributes(t *testing.T) {
+	var state State
+	chunk := `＜｜DSML　tool_calls＞＜｜DSML　invoke　name＝“execute_code”＞＜｜DSML　parameter　name＝“code”＞<![CDATA[print("hi")]]>＜／DSML｜parameter＞＜／DSML｜invoke＞＜／DSML｜tool_calls＞ suffix`
+	events := ProcessChunk(&state, chunk, []string{"execute_code"})
+	events = append(events, Flush(&state, []string{"execute_code"})...)
+
+	var textContent strings.Builder
+	toolCalls := 0
+	var parsed Event
+	for _, evt := range events {
+		textContent.WriteString(evt.Content)
+		if len(evt.ToolCalls) > 0 {
+			parsed = evt
+		}
+		toolCalls += len(evt.ToolCalls)
+	}
+	if toolCalls != 1 {
+		t.Fatalf("expected exactly one parsed tool call from fullwidth-opening/Unicode-attr block, got %d events=%#v", toolCalls, events)
+	}
+	if parsed.ToolCalls[0].Name != "execute_code" || parsed.ToolCalls[0].Input["code"] != `print("hi")` {
+		t.Fatalf("unexpected parsed call from fullwidth-opening/Unicode-attr block: %#v", parsed.ToolCalls[0])
+	}
+	if got := textContent.String(); got != " suffix" {
+		t.Fatalf("expected suffix text to be preserved, got %q", got)
+	}
+}
+
+func TestProcessToolSieveParsesConfusableCandidateShellAndKeepsSuffixText(t *testing.T) {
+	var state State
+	chunk := "<|\u200b\uff24\u0405\u039cL|to\u03bfl\uff3fcalls><|\ufeffDSML|inv\u03bfk\u0435 n\u0430me\uff1d\u201cexecute_code\u201d><|\u200bDSML|par\u0430meter n\u0430me\uff1d\u201ccode\u201d><![\ufeff\u0421D\u0410T\u0410[print(\"hi\")]]></|\u200bDSML|par\u0430meter></|\u200bDSML|inv\u03bfk\u0435></|\u200b\uff24\u0405\u039cL|to\u03bfl\uff3fcalls> suffix"
+	events := ProcessChunk(&state, chunk, []string{"execute_code"})
+	events = append(events, Flush(&state, []string{"execute_code"})...)
+
+	var textContent strings.Builder
+	toolCalls := 0
+	var parsed Event
+	for _, evt := range events {
+		textContent.WriteString(evt.Content)
+		if len(evt.ToolCalls) > 0 {
+			parsed = evt
+		}
+		toolCalls += len(evt.ToolCalls)
+	}
+	if toolCalls != 1 {
+		t.Fatalf("expected exactly one parsed tool call from confusable-shell block, got %d events=%#v", toolCalls, events)
+	}
+	if parsed.ToolCalls[0].Name != "execute_code" || parsed.ToolCalls[0].Input["code"] != `print("hi")` {
+		t.Fatalf("unexpected parsed call from confusable-shell block: %#v", parsed.ToolCalls[0])
+	}
+	if got := textContent.String(); got != " suffix" {
+		t.Fatalf("expected suffix text to be preserved, got %q", got)
+	}
+}
+
+func TestProcessToolSieveRepairsConfusableMissingWrapperAndKeepsSuffixText(t *testing.T) {
+	var state State
+	chunks := []string{
+		"<inv\u03bfk\u0435 n\u0430me=\"read_file\">\n",
+		"  <par\u0430meter n\u0430me=\"path\"><![\u200b\u0421D\u0410T\u0410[README.md]]></par\u0430meter>\n",
+		"</inv\u03bfk\u0435>\n",
+		"</to\u03bfl_calls> trailing prose",
+	}
+	var events []Event
+	for _, c := range chunks {
+		events = append(events, ProcessChunk(&state, c, []string{"read_file"})...)
+	}
+	events = append(events, Flush(&state, []string{"read_file"})...)
+
+	var textContent strings.Builder
+	toolCalls := 0
+	var parsed Event
+	for _, evt := range events {
+		textContent.WriteString(evt.Content)
+		if len(evt.ToolCalls) > 0 {
+			parsed = evt
+		}
+		toolCalls += len(evt.ToolCalls)
+	}
+	if toolCalls != 1 {
+		t.Fatalf("expected repaired confusable missing-wrapper stream to emit one tool call, got %d events=%#v", toolCalls, events)
+	}
+	if parsed.ToolCalls[0].Name != "read_file" || parsed.ToolCalls[0].Input["path"] != "README.md" {
+		t.Fatalf("unexpected parsed call from repaired confusable missing-wrapper block: %#v", parsed.ToolCalls[0])
+	}
+	if got := textContent.String(); got != " trailing prose" {
+		t.Fatalf("expected suffix prose to be preserved, got %q", got)
+	}
+}
+
+func TestProcessToolSieveKeepsConfusableNearMissWrapperAsText(t *testing.T) {
+	var state State
+	chunk := "<to\u03bfl_callz><inv\u03bfke name=\"read_file\"><parameter name=\"path\">README.md</parameter></inv\u03bfke></to\u03bfl_callz>"
+	events := ProcessChunk(&state, chunk, []string{"read_file"})
+	events = append(events, Flush(&state, []string{"read_file"})...)
+
+	var textContent strings.Builder
+	toolCalls := 0
+	for _, evt := range events {
+		textContent.WriteString(evt.Content)
+		toolCalls += len(evt.ToolCalls)
+	}
+	if toolCalls != 0 {
+		t.Fatalf("expected confusable near-miss wrapper to remain text, got %d events=%#v", toolCalls, events)
+	}
+	if got := textContent.String(); got != chunk {
+		t.Fatalf("expected confusable near-miss wrapper to pass through unchanged, got %q", got)
+	}
+}
diff --git a/tests/node/chat-stream.test.js b/tests/node/chat-stream.test.js
index 1146113..6cf3e0d 100644
--- a/tests/node/chat-stream.test.js
+++ b/tests/node/chat-stream.test.js
@@ -643,6 +643,16 @@ test('parseChunkForContent strips citation and reference markers from fragment c
   assert.deepEqual(parsed.parts, [{ text: '广州天气   多云', type: 'text' }]);
 });
 
+test('parseChunkForContent strips leaked thought control markers from content', () => {
+  const chunk = {
+    p: 'response/content',
+    v: '<｜▁of▁thought｜>A<| of_thought |>B<| end_of_thought |>C',
+  };
+  const parsed = parseChunkForContent(chunk, false, 'text');
+  assert.equal(parsed.finished, false);
+  assert.deepEqual(parsed.parts, [{ text: 'ABC', type: 'text' }]);
+});
+
 test('parseChunkForContent detects content_filter status and ignores upstream output tokens', () => {
   const chunk = {
     p: 'response',
diff --git a/tests/node/stream-tool-sieve.test.js b/tests/node/stream-tool-sieve.test.js
index 1de053d..c78fb51 100644
--- a/tests/node/stream-tool-sieve.test.js
+++ b/tests/node/stream-tool-sieve.test.js
@@ -57,6 +57,38 @@ test('parseToolCalls parses DSML shell as XML-compatible tool call', () => {
   assert.deepEqual(calls[0].input, { path: 'README.MD' });
 });
 
+test('parseToolCalls tolerates fullwidth closing slash in DSML wrapper', () => {
+  const payload = '<｜DSML｜tool_calls><｜DSML｜invoke name="execute_code"><｜DSML｜parameter name="code"><![CDATA[print("hi")]]></｜DSML｜parameter></｜DSML｜invoke><／DSML｜tool_calls>';
+  const calls = parseToolCalls(payload, ['execute_code']);
+  assert.equal(calls.length, 1);
+  assert.equal(calls[0].name, 'execute_code');
+  assert.deepEqual(calls[0].input, { code: 'print("hi")' });
+});
+
+test('parseToolCalls tolerates sentencepiece separator and fullwidth terminator', () => {
+  const payload = '<｜DSML▁tool_calls｜><｜DSML▁invoke▁name="execute_code"><｜DSML▁parameter▁name="code"><![CDATA[print("hi")]]></｜DSML▁parameter></｜DSML▁invoke></｜DSML▁tool_calls＞';
+  const calls = parseToolCalls(payload, ['execute_code']);
+  assert.equal(calls.length, 1);
+  assert.equal(calls[0].name, 'execute_code');
+  assert.deepEqual(calls[0].input, { code: 'print("hi")' });
+});
+
+test('parseToolCalls tolerates fullwidth opening delimiter and Unicode attribute confusables', () => {
+  const payload = '＜｜DSML　tool_calls＞＜｜DSML　invoke　name＝“execute_code”＞＜｜DSML　parameter　name＝“code”＞<![CDATA[print("hi")]]>＜／DSML｜parameter＞＜／DSML｜invoke＞＜／DSML｜tool_calls＞';
+  const calls = parseToolCalls(payload, ['execute_code']);
+  assert.equal(calls.length, 1);
+  assert.equal(calls[0].name, 'execute_code');
+  assert.deepEqual(calls[0].input, { code: 'print("hi")' });
+});
+
+test('parseToolCalls canonicalizes confusable candidate shell only', () => {
+  const payload = '<|\u200b\uff24\u0405\u039cL|to\u03bfl\uff3fcalls><|\ufeffDSML|inv\u03bfk\u0435 n\u0430me\uff1d\u201cexecute_code\u201d><|\u200bDSML|par\u0430meter n\u0430me\uff1d\u201ccode\u201d><![\ufeff\u0421D\u0410T\u0410[print("hi")]]></|\u200bDSML|par\u0430meter></|\u200bDSML|inv\u03bfk\u0435></|\u200b\uff24\u0405\u039cL|to\u03bfl\uff3fcalls>';
+  const calls = parseToolCalls(payload, ['execute_code']);
+  assert.equal(calls.length, 1);
+  assert.equal(calls[0].name, 'execute_code');
+  assert.deepEqual(calls[0].input, { code: 'print("hi")' });
+});
+
 test('parseToolCalls parses hyphenated DSML shell with here-doc CDATA', () => {
   const payload = `<dsml-tool-calls>
 <dsml-invoke name="Bash">
@@ -344,6 +376,12 @@ test('parseToolCalls ignores collapsed DSML lookalike tag names', () => {
   assert.equal(calls.length, 0);
 });
 
+test('parseToolCalls rejects confusable near-miss tag names', () => {
+  const payload = '<tool_calls><inv\u03bfker name="execute_code"><parameter name="code">pwd</parameter></inv\u03bfker></tool_calls>';
+  const calls = parseToolCalls(payload, ['execute_code']);
+  assert.equal(calls.length, 0);
+});
+
 test('parseToolCalls keeps canonical XML examples inside DSML CDATA', () => {
   const content = '<tool_calls><invoke name="demo"><parameter name="value">x</parameter></invoke></tool_calls>';
   const payload = `<|DSML|tool_calls><|DSML|invoke name="write_file"><|DSML|parameter name="path">notes.md</|DSML|parameter><|DSML|parameter name="content"><![CDATA[${content}]]></|DSML|parameter></|DSML|invoke></|DSML|tool_calls>`;
@@ -360,6 +398,14 @@ test('parseToolCalls preserves simple inline markup inside CDATA as text', () =>
   assert.equal(calls[0].input.description, '<b>urgent</b>');
 });
 
+test('parseToolCalls keeps confusable markup examples inside CDATA as text', () => {
+  const value = '<inv\u03bfke>literal</inv\u03bfke>';
+  const payload = `<tool_calls><invoke name="Write"><parameter name="description"><![\u200b\u0421D\u0410T\u0410[${value}]]></parameter></invoke></tool_calls>`;
+  const calls = parseToolCalls(payload, ['Write']);
+  assert.equal(calls.length, 1);
+  assert.equal(calls[0].input.description, value);
+});
+
 test('parseToolCalls recovers when CDATA never closes inside a valid wrapper', () => {
   const payload = '<tool_calls><invoke name="Write"><parameter name="content"><![CDATA[hello world</parameter></invoke></tool_calls>';
   const calls = parseToolCalls(payload, ['Write']);
@@ -556,6 +602,65 @@ test('sieve emits tool_calls for DSML space-separator typo', () => {
   assert.equal(text.includes('<|DSML invoke'), false);
 });
 
+test('sieve emits tool_calls for fullwidth closing slash and preserves suffix text', () => {
+  const input = '<｜DSML｜tool_calls><｜DSML｜invoke name="execute_code"><｜DSML｜parameter name="code"><![CDATA[print("hi")]]></｜DSML｜parameter></｜DSML｜invoke><／DSML｜tool_calls> sao cụm này lại đc trả là 1 message';
+  const events = runSieve([input], ['execute_code']);
+  const text = collectText(events);
+  const finalCalls = events.filter((evt) => evt.type === 'tool_calls').flatMap((evt) => evt.calls || []);
+  assert.equal(finalCalls.length, 1);
+  assert.equal(finalCalls[0].name, 'execute_code');
+  assert.deepEqual(finalCalls[0].input, { code: 'print("hi")' });
+  assert.equal(text, ' sao cụm này lại đc trả là 1 message');
+});
+
+test('sieve emits tool_calls for sentencepiece separator and fullwidth terminator', () => {
+  const input = '<｜DSML▁tool_calls｜><｜DSML▁invoke▁name="execute_code"><｜DSML▁parameter▁name="code"><![CDATA[print("hi")]]></｜DSML▁parameter></｜DSML▁invoke></｜DSML▁tool_calls＞ suffix';
+  const events = runSieve([input], ['execute_code']);
+  const text = collectText(events);
+  const finalCalls = events.filter((evt) => evt.type === 'tool_calls').flatMap((evt) => evt.calls || []);
+  assert.equal(finalCalls.length, 1);
+  assert.equal(finalCalls[0].name, 'execute_code');
+  assert.deepEqual(finalCalls[0].input, { code: 'print("hi")' });
+  assert.equal(text, ' suffix');
+});
+
+test('sieve emits tool_calls for fullwidth opening delimiter and Unicode attribute confusables', () => {
+  const input = '＜｜DSML　tool_calls＞＜｜DSML　invoke　name＝“execute_code”＞＜｜DSML　parameter　name＝“code”＞<![CDATA[print("hi")]]>＜／DSML｜parameter＞＜／DSML｜invoke＞＜／DSML｜tool_calls＞ suffix';
+  const events = runSieve([input], ['execute_code']);
+  const text = collectText(events);
+  const finalCalls = events.filter((evt) => evt.type === 'tool_calls').flatMap((evt) => evt.calls || []);
+  assert.equal(finalCalls.length, 1);
+  assert.equal(finalCalls[0].name, 'execute_code');
+  assert.deepEqual(finalCalls[0].input, { code: 'print("hi")' });
+  assert.equal(text, ' suffix');
+});
+
+test('sieve emits tool_calls for confusable candidate shell and preserves suffix text', () => {
+  const input = '<|\u200b\uff24\u0405\u039cL|to\u03bfl\uff3fcalls><|\ufeffDSML|inv\u03bfk\u0435 n\u0430me\uff1d\u201cexecute_code\u201d><|\u200bDSML|par\u0430meter n\u0430me\uff1d\u201ccode\u201d><![\ufeff\u0421D\u0410T\u0410[print("hi")]]></|\u200bDSML|par\u0430meter></|\u200bDSML|inv\u03bfk\u0435></|\u200b\uff24\u0405\u039cL|to\u03bfl\uff3fcalls> suffix';
+  const events = runSieve([input], ['execute_code']);
+  const text = collectText(events);
+  const finalCalls = events.filter((evt) => evt.type === 'tool_calls').flatMap((evt) => evt.calls || []);
+  assert.equal(finalCalls.length, 1);
+  assert.equal(finalCalls[0].name, 'execute_code');
+  assert.deepEqual(finalCalls[0].input, { code: 'print("hi")' });
+  assert.equal(text, ' suffix');
+});
+
+test('sieve repairs confusable missing opening wrapper and preserves suffix text', () => {
+  const events = runSieve([
+    '<inv\u03bfk\u0435 n\u0430me="read_file">\n',
+    '  <par\u0430meter n\u0430me="path"><![\u200b\u0421D\u0410T\u0410[README.md]]></par\u0430meter>\n',
+    '</inv\u03bfk\u0435>\n',
+    '</to\u03bfl_calls> trailing prose',
+  ], ['read_file']);
+  const text = collectText(events);
+  const finalCalls = events.filter((evt) => evt.type === 'tool_calls').flatMap((evt) => evt.calls || []);
+  assert.equal(finalCalls.length, 1);
+  assert.equal(finalCalls[0].name, 'read_file');
+  assert.deepEqual(finalCalls[0].input, { path: 'README.md' });
+  assert.equal(text, ' trailing prose');
+});
+
 test('sieve emits tool_calls for DSML trailing pipe tag terminator', () => {
   const events = runSieve([
     '<|DSML|tool_calls| \n',
@@ -742,6 +847,14 @@ test('sieve keeps collapsed DSML lookalike tag names as text', () => {
   assert.equal(collectText(events), input);
 });
 
+test('sieve keeps confusable near-miss wrappers as text', () => {
+  const input = '<to\u03bfl_callz><inv\u03bfke name="read_file"><parameter name="path">README.md</parameter></inv\u03bfke></to\u03bfl_callz>';
+  const events = runSieve([input], ['read_file']);
+  const finalCalls = events.filter((evt) => evt.type === 'tool_calls').flatMap((evt) => evt.calls || []);
+  assert.equal(finalCalls.length, 0);
+  assert.equal(collectText(events), input);
+});
+
 test('sieve preserves review body with alias mentions before real DSML tool calls', () => {
   const events = runSieve([
     "Done reviewing the diff. Here's my analysis before we commit:\n\n",