From 04d27da70d09d9967a8be93e58c4d3a0615432e4 Mon Sep 17 00:00:00 2001 From: Matt Rubens Date: Wed, 3 Dec 2025 01:06:58 -0500 Subject: [PATCH] Safer tool call json parsing --- src/core/assistant-message/NativeToolCallParser.ts | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/core/assistant-message/NativeToolCallParser.ts b/src/core/assistant-message/NativeToolCallParser.ts index ac95597779..8cb6736ab7 100644 --- a/src/core/assistant-message/NativeToolCallParser.ts +++ b/src/core/assistant-message/NativeToolCallParser.ts @@ -559,8 +559,9 @@ export class NativeToolCallParser { } try { - // Parse the arguments JSON string - const args = JSON.parse(toolCall.arguments) + // Parse the arguments JSON string using partial-json to handle malformed JSON + // (e.g., unescaped tab characters that strict JSON.parse would reject) + const args = parseJSON(toolCall.arguments) // Build legacy params object for backward compatibility with XML protocol and UI. // Native execution path uses nativeArgs instead, which has proper typing. @@ -805,8 +806,9 @@ export class NativeToolCallParser { */ public static parseDynamicMcpTool(toolCall: { id: string; name: string; arguments: string }): McpToolUse | null { try { - // Parse the arguments - these are the actual tool arguments passed directly - const args = JSON.parse(toolCall.arguments || "{}") + // Parse the arguments using partial-json to handle malformed JSON + // (e.g., unescaped tab characters that strict JSON.parse would reject) + const args = parseJSON(toolCall.arguments || "{}") // Extract server_name and tool_name from the tool name itself // Format: mcp_serverName_toolName