Multiple-choice ask_user silently renders as a free-text prompt when trailing tool-call parameters leak into the preceding string argument

Describe the bug

An ask_user call that supplies choices sometimes renders as a plain free-text prompt ("Type your answer…") instead of the usual clickable option buttons — and the options themselves show up as a literal JSON array printed at the end of the question text.

The cause is upstream of any UI: the assistant emits Anthropic-style <parameter name="…"> markup inside a string argument, and the argument parser recovers only the first parameter. Every trailing parameter is silently absorbed into that first parameter's string value. Unlike #3765 (where the whole <invoke> block leaks as text and the tool never runs), here the tool call does execute — just with silently truncated arguments, so nothing surfaces as an error.

Verbatim from the session transcript (tool.execution_start), reformatted only for line breaks:

{
  "toolName": "ask_user",
  "arguments": {
    "question": "…Tests 244 → 247 passing, typecheck clean. Commit it?</question>\n<parameter name=\"choices\">[\"Commit (Recommended)\", \"Edit message\", \"Skip repo\", \"Cancel\"]"
  }
}

arguments has exactly one key. choices never arrives, so the client correctly renders a free-text prompt — it has no options to draw.

It is not ask_user-specific. The same shape corrupts ordinary tools, where the damage is worse because the call runs with wrong arguments and nobody notices. A grep call that lost its -n:

{ "-B": "30\">\n<parameter name=\"-n\">true", "output_mode": "content", "pattern": "latched" }

Affected version

Engine 1.0.84-4 (running inside the GitHub Copilot desktop app). Standalone CLI on PATH is 1.0.81-12. Occurrences in my logs span 2026-08-18 → 2026-09-11, so this is not new to one release.

Steps to reproduce the behavior

Not deterministic on demand — it depends on model output. What reliably produces it:

1. Run a long session on claude-opus-5.
2. Have the agent call ask_user with a choices array and a long question (every affected call was 643–944 characters; nothing shorter ever broke).
3. Once one malformed call lands, every subsequent tool call of that kind in the session is malformed too — the model copies its own bad output from the transcript.
4. Run /compact. The bad exemplar leaves the context window and calls go back to normal.

Step 3–4 is the strongest signal and is fully reproducible from logs — see the investigation block.

Expected behavior

Either the model never emits parameter markup inside a string value, or — more robustly — the argument parser refuses to accept a partial parse. A string value containing </param> / <parameter name="…"> is unambiguously a serialization failure, and the trailing parameters are trivially recoverable from it. Today it silently succeeds with dropped arguments, which is the worst of the three options.

Additional context

Suggested labels (I can't set them): area:tools, type: Bug.

Related: #3765 — same root family (parameter markup leaking), different failure mode: there the call is never executed; here it executes with silently truncated arguments.

Environment

Engine version   1.0.84-4  (GitHub Copilot desktop app)
CLI on PATH      1.0.81-12
OS               Microsoft Windows NT 10.0.26200.0
CPU arch         AMD64
Shell            PowerShell 7
Surface          desktop app, project session
Model            claude-opus-5 (long-context tier)

Frequency

Measured, not estimated — scanned every tool.execution_start event in my local session store:

Tools affected: ask_user ×12, grep ×2, an ADO MCP tool ×2, a Bluebird MCP tool ×1, create ×1.

The global rate is low but misleading — it is heavily clustered. Within an affected session the rate is effectively 100% until a compaction clears it.

Extensions

Not tried with extensions disabled. Canvas extensions were loaded, but they cannot plausibly be involved: the corruption is present in the raw tool.execution_start event, before any client renders it.

Diagnostics available on request

• Redacted events.jsonl excerpts for both affected sessions
• The scan script used to produce the frequency table

calls  1–6    ok
               ← 5 compactions in 31 minutes (heavy context pressure)
calls  7–11   MALFORMED   (contiguous, ~26 h, no compaction in between)
               ← compaction
calls 12–30   ok          (19 consecutive clean calls)

首先跟踪生成原始 tool.execution_start 事件的参数解析器，并使用格式错误的 question 和 -B 示例作为复现输入。检查解码后的字符串值中的尾随参数标记是如何处理的。完成标准是：格式错误的部分解析不再在丢弃参数的情况下静默执行，并且解析器覆盖了报告中的这些形式。