Multiple-choice ask_user silently renders as a free-text prompt when trailing tool-call parameters leak into the preceding string argument

首先追蹤產生原始 tool.execution_start 事件的參數解析器，並使用格式錯誤的 question 與 -B 範例作為重現輸入。檢查解碼後的字串值中的尾隨參數標記是如何處理的。完成標準是：格式錯誤的部分解析不再在捨棄參數的情況下靜默執行，且解析器涵蓋了回報的這些形式。

Describe the bug

An ask_user call that supplies choices sometimes renders as a plain free-text prompt ("Type your answer…") instead of the usual clickable option buttons — and the options themselves show up as a literal JSON array printed at the end of the question text.

The cause is upstream of any UI: the assistant emits Anthropic-style <parameter name="…"> markup inside a string argument, and the argument parser recovers only the first parameter. Every trailing parameter is silently absorbed into that first parameter's string value. Unlike #3765 (where the whole <invoke> block leaks as text and the tool never runs), here the tool call does execute — just with silently truncated arguments, so nothing surfaces as an error.

Verbatim from the session transcript (tool.execution_start), reformatted only for line breaks:

{
  "toolName": "ask_user",
  "arguments": {
    "question": "…Tests 244 → 247 passing, typecheck clean. Commit it?</question>\n<parameter name=\"choices\">[\"Commit (Recommended)\", \"Edit message\", \"Skip repo\", \"Cancel\"]"
  }
}

arguments has exactly one key. choices never arrives, so the client correctly renders a free-text prompt — it has no options to draw.

It is not ask_user-specific. The same shape corrupts ordinary tools, where the damage is worse because the call runs with wrong arguments and nobody notices. A grep call that lost its -n:

{ "-B": "30\">\n<parameter name=\"-n\">true", "output_mode": "content", "pattern": "latched" }

Affected version

Engine 1.0.84-4 (running inside the GitHub Copilot desktop app). Standalone CLI on PATH is 1.0.81-12. Occurrences in my logs span 2026-08-18 → 2026-09-11, so this is not new to one release.

Steps to reproduce the behavior

Not deterministic on demand — it depends on model output. What reliably produces it:

1. Run a long session on claude-opus-5.
2. Have the agent call ask_user with a choices array and a long question (every affected call was 643–944 characters; nothing shorter ever broke).
3. Once one malformed call lands, every subsequent tool call of that kind in the session is malformed too — the model copies its own bad output from the transcript.
4. Run /compact. The bad exemplar leaves the context window and calls go back to normal.

Step 3–4 is the strongest signal and is fully reproducible from logs — see the investigation block.

Expected behavior

Either the model never emits parameter markup inside a string value, or — more robustly — the argument parser refuses to accept a partial parse. A string value containing </param> / <parameter name="…"> is unambiguously a serialization failure, and the trailing parameters are trivially recoverable from it. Today it silently succeeds with dropped arguments, which is the worst of the three options.

Additional context

Suggested labels (I can't set them): area:tools, type: Bug.

Related: #3765 — same root family (parameter markup leaking), different failure mode: there the call is never executed; here it executes with silently truncated arguments.

Environment

Engine version   1.0.84-4  (GitHub Copilot desktop app)
CLI on PATH      1.0.81-12
OS               Microsoft Windows NT 10.0.26200.0
CPU arch         AMD64
Shell            PowerShell 7
Surface          desktop app, project session
Model            claude-opus-5 (long-context tier)

Frequency

Measured, not estimated — scanned every tool.execution_start event in my local session store:

Tools affected: ask_user ×12, grep ×2, an ADO MCP tool ×2, a Bluebird MCP tool ×1, create ×1.

The global rate is low but misleading — it is heavily clustered. Within an affected session the rate is effectively 100% until a compaction clears it.

Extensions

Not tried with extensions disabled. Canvas extensions were loaded, but they cannot plausibly be involved: the corruption is present in the raw tool.execution_start event, before any client renders it.

Diagnostics available on request

• Redacted events.jsonl excerpts for both affected sessions
• The scan script used to produce the frequency table

calls  1–6    ok
               ← 5 compactions in 31 minutes (heavy context pressure)
calls  7–11   MALFORMED   (contiguous, ~26 h, no compaction in between)
               ← compaction
calls 12–30   ok          (19 consecutive clean calls)