@@ -8,17 +8,17 @@ description: How to empirically probe the VS Code Language Model API (`vscode.lm
 ## When to Use This Skill
 
 - A claim is being made about what a Copilot-backed model _actually_ emits over `vscode.lm` (tool-call parts vs. text), and it needs evidence rather than inference.
-- Changing [`extractLeakedToolCalls()`](src/api/providers/vscode-lm.ts) or its guards, and you need a false-positive corpus.
+- Changing [`extractLeakedToolCalls()`](../../../src/api/providers/vscode-lm.ts) or its guards, and you need a false-positive corpus.
 - Any question that can only be answered by real `model.sendRequest()` traffic — the mocked unit tests cannot answer it.
 
 ## When NOT to Use This Skill
 
-- Ordinary provider work covered by [`src/api/providers/__tests__/vscode-lm.spec.ts`](src/api/providers/__tests__/vscode-lm.spec.ts). Live probing is slow and burns Copilot quota.
+- Ordinary provider work covered by [`src/api/providers/__tests__/vscode-lm.spec.ts`](../../../src/api/providers/__tests__/vscode-lm.spec.ts). Live probing is slow and burns Copilot quota.
 - Anything about non-`vscode-lm` providers. Anthropic-API behavior does not transfer.
 
 ## Running the Probe
 
-Scripts live in [`scripts/`](.roo/skills/probe-vscode-lm-api/scripts/) next to this file.
+Scripts live in [`scripts/`](scripts/) next to this file.
 
 1. Copy `scripts/package.json` and `scripts/extension.js` into a scratch directory, e.g. `<repo>\.tmp\lmprobe\`. No build, no `npm install` — it is plain CommonJS against the `vscode` module.
 2. Adjust `OUT_DIR` at the top of `extension.js` to the transcript output directory.
@@ -65,7 +65,7 @@ Never `npx vitest` — it resolves a wrong hoisted 3.2.4 instead of the pinned 4
 
 ## Measured Findings
 
-Sample: 210 live requests, 7 Copilot Claude models x 6 scenarios x 5 repeats, 0 errors. Raw evidence in [`transcripts/`](.roo/skills/probe-vscode-lm-api/transcripts/).
+Sample: 210 live requests, 7 Copilot Claude models x 6 scenarios x 5 repeats, 0 errors. Raw evidence in [`transcripts/`](transcripts/).
 
 | Scenario | Setup                                     | Runs | `<invoke` in text |
 | -------- | ----------------------------------------- | ---- | ----------------- |
@@ -90,7 +90,7 @@ Observations:
 
 ## Reproducing the False-Positive Replay
 
-`scripts/probe-false-positives.spec.ts` replays [`extractLeakedToolCalls()`](src/api/providers/vscode-lm.ts) over a transcript directory and writes a `RECOVERED`/`passthrough` report. Drop it into `src/api/providers/__tests__/`, point `TRANSCRIPTS` at the transcript directory, then:
+[`scripts/probe-false-positives.spec.ts`](scripts/probe-false-positives.spec.ts) replays [`extractLeakedToolCalls()`](../../../src/api/providers/vscode-lm.ts) over a transcript directory and writes a `RECOVERED`/`passthrough` report. Drop it into `src/api/providers/__tests__/`, point `TRANSCRIPTS` at the transcript directory, then:
 
 ```
 pnpm --dir src exec vitest run api/providers/__tests__/probe-false-positives.spec.ts
 
@@ -51,8 +51,8 @@ async function runOnce(model, scenario) {
 	if (scenario.tools) {
 		options.tools = [READ_TOOL]
 	}
+	const source = new vscode.CancellationTokenSource()
 	try {
-		const source = new vscode.CancellationTokenSource()
 		const response = await model.sendRequest(messages, options, source.token)
 		for await (const chunk of response.stream) {
 			const typeName = chunk && chunk.constructor ? chunk.constructor.name : typeof chunk
@@ -69,6 +69,8 @@ async function runOnce(model, scenario) {
 		}
 	} catch (error) {
 		record.error = { name: error && error.name, message: error && error.message, stack: error && error.stack }
+	} finally {
+		source.dispose()
 	}
 
 	const text = record.concatenatedText
 
@@ -1331,6 +1331,10 @@ describe("leaked tool-call recovery", () => {
 		it("does not hold back an over-long trailing fragment", () => {
 			expect(trailingPartialToolMarkerLength("<invoke " + "x".repeat(200))).toBe(0)
 		})
+
+		it("does not hold back an over-long generic tag fragment", () => {
+			expect(trailingPartialToolMarkerLength("text <" + "a".repeat(200))).toBe(0)
+		})
 	})
 
 	describe("quoted markup", () => {
@@ -1350,6 +1354,24 @@ describe("leaked tool-call recovery", () => {
 
 			expect(calls).toHaveLength(0)
 		})
+
+		it("does not recover an invoke block quoted in unfenced, backtick-free prose", () => {
+			const text = "You must never emit " + invoke("update_todo_list", param("todos", "x")) + " directly."
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
+
+		it("keeps wrapper tags around a block that was not recovered", () => {
+			const text = `<function_calls>${invoke("some_other_tool", param("x", "1"))}</function_calls>`
+
+			const { calls, leftoverText } = extractLeakedToolCalls(text, new Set(["update_todo_list"]))
+
+			expect(calls).toHaveLength(0)
+			expect(leftoverText).toBe(text)
+		})
 	})
 })
 
 
@@ -93,7 +93,7 @@ const MAX_PARTIAL_INVOKE_CARRY = 64
 export function trailingPartialToolMarkerLength(text: string): number {
 	const partialTag = text.match(/<(?:antml:)?[a-zA-Z_]*$/)
 	if (partialTag) {
-		return partialTag[0].length
+		return partialTag[0].length <= MAX_PARTIAL_INVOKE_CARRY ? partialTag[0].length : 0
 	}
 	// An `<invoke` whose `name="` attribute hasn't arrived yet: hold it back so the marker can
 	// latch on the next chunk, bounded so ordinary prose is never swallowed.
@@ -102,17 +102,25 @@ export function trailingPartialToolMarkerLength(text: string): number {
 }
 
 /**
- * True when `index` falls inside a fenced code block or an inline code span, where `<invoke>`
- * markup is being quoted (e.g. a file excerpt or a "do NOT emit this" example) rather than
- * actually invoked.
+ * True when the block spanning `[index, endIndex)` is being quoted — inside a fenced code block,
+ * inside an inline code span, or embedded mid-sentence in plain prose — rather than invoked.
  */
-function isQuotedAsCode(text: string, index: number): boolean {
+function isQuotedAsCode(text: string, index: number, endIndex: number): boolean {
 	const before = text.slice(0, index)
 	if ((before.match(/```/g)?.length ?? 0) % 2 === 1) {
 		return true
 	}
 	const lineStart = before.lastIndexOf("\n") + 1
-	return (before.slice(lineStart).match(/`/g)?.length ?? 0) % 2 === 1
+	if ((before.slice(lineStart).match(/`/g)?.length ?? 0) % 2 === 1) {
+		return true
+	}
+	// A genuine leak ends the turn's line — nothing follows it but the optional closing wrapper.
+	// Narrative words after the block on the same line mean the markup is being talked about
+	// (e.g. "never emit <invoke ...> directly"), which must not be replayed as a live call.
+	const after = text.slice(endIndex)
+	const lineEnd = after.indexOf("\n")
+	const restOfLine = lineEnd === -1 ? after : after.slice(0, lineEnd)
+	return restOfLine.replace(/<[^<>]*>/g, "").trim().length > 0
 }
 
 function parseLeakedInvokeParams(body: string): Record<string, string> {
@@ -136,28 +144,54 @@ export function extractLeakedToolCalls(
 	precedingText = "",
 ): { calls: Array<{ name: string; input: Record<string, string> }>; leftoverText: string } {
 	const calls: Array<{ name: string; input: Record<string, string> }> = []
-	let leftover = ""
+	// Text between recovered/passed-through blocks, kept as segments so the wrapper cleanup below
+	// only touches segments adjacent to a block that was actually recovered.
+	const segments: Array<{ text: string; nearRecovery: boolean }> = []
+	let pending = ""
 	let lastIndex = 0
 
 	LEAKED_INVOKE_BLOCK.lastIndex = 0
 	let match: RegExpExecArray | null
 	while ((match = LEAKED_INVOKE_BLOCK.exec(text)) !== null) {
-		leftover += text.slice(lastIndex, match.index)
+		pending += text.slice(lastIndex, match.index)
 		const name = match[1]
 		// Quote detection needs the text streamed before the buffer, since a fence may have opened there.
-		if (validToolNames.has(name) && !isQuotedAsCode(precedingText + text, precedingText.length + match.index)) {
+		if (
+			validToolNames.has(name) &&
+			!isQuotedAsCode(
+				precedingText + text,
+				precedingText.length + match.index,
+				precedingText.length + match.index + match[0].length,
+			)
+		) {
 			calls.push({ name, input: parseLeakedInvokeParams(match[2]) })
+			segments.push({ text: pending, nearRecovery: true })
+			pending = ""
+			// The segment that follows a recovery also holds that call's closing wrapper.
+			segments.push({ text: "", nearRecovery: true })
 		} else {
 			// Not one of our tools, or quoted as code — keep the block as literal text.
-			leftover += match[0]
+			pending += match[0]
 		}
 		lastIndex = match.index + match[0].length
 	}
-	leftover += text.slice(lastIndex)
+	pending += text.slice(lastIndex)
+	const trailing =
+		segments.length > 0 && segments[segments.length - 1].nearRecovery && segments[segments.length - 1].text === ""
+	if (trailing) {
+		segments[segments.length - 1].text = pending
+	} else {
+		segments.push({ text: pending, nearRecovery: false })
+	}
 
-	// Remove bare function-call wrapper tags left behind (cosmetic; also avoids re-teaching
-	// the model this format when the turn is later sent back as history).
-	leftover = leftover.replace(/<\/?(?:antml:)?function_calls\s*>/gi, "")
+	// Remove the wrapper tags belonging to a recovered call (cosmetic; also avoids re-teaching the
+	// model this format when the turn is sent back as history). Wrappers around blocks that were
+	// NOT recovered are user-visible text and must survive verbatim.
+	const leftover = segments
+		.map((segment) =>
+			segment.nearRecovery ? segment.text.replace(/<\/?(?:antml:)?function_calls\s*>/gi, "") : segment.text,
+		)
+		.join("")
 
 	return { calls, leftoverText: leftover }
 }
Original file line number	Diff line number	Diff line change
`@@ -51,8 +51,8 @@ async function runOnce(model, scenario) {`
`51`	`51`	`if (scenario.tools) {`
`52`	`52`	`options.tools = [READ_TOOL]`
`53`	`53`	`}`
	`54`	`+ const source = new vscode.CancellationTokenSource()`
`54`	`55`	`try {`
`55`		`- const source = new vscode.CancellationTokenSource()`
`56`	`56`	`const response = await model.sendRequest(messages, options, source.token)`
`57`	`57`	`for await (const chunk of response.stream) {`
`58`	`58`	`const typeName = chunk && chunk.constructor ? chunk.constructor.name : typeof chunk`
`@@ -69,6 +69,8 @@ async function runOnce(model, scenario) {`
`69`	`69`	`}`
`70`	`70`	`} catch (error) {`
`71`	`71`	`record.error = { name: error && error.name, message: error && error.message, stack: error && error.stack }`
	`72`	`+ } finally {`
	`73`	`+ source.dispose()`
`72`	`74`	`}`
`73`	`75`
`74`	`76`	`const text = record.concatenatedText`