@@ -494,15 +494,55 @@ describe("VsCodeLmHandler", () => {
 
 			it("does not recover an invoke block quoted inside a fenced code block", async () => {
 				const block = '<invoke name="calculator"><parameter name="operation">add</parameter></invoke>'
-				const chunks = await collect(["Do NOT do this:\n```\n" + block + "\n```\n"])
+				// Open the wrapper outside the fence so only the quoting guard prevents recovery.
+				const chunks = await collect(["<function_calls>\n```\n" + block + "\n```\n</function_calls>"])
 
 				expect(chunks.some((chunk) => chunk.type === "tool_call")).toBe(false)
 			})
 
+			it.each([
+				{ name: "write_to_file", parameter: "content" },
+				{ name: "update_todo_list", parameter: "todos" },
+			])(
+				"recovers a large $name call split across chunks without leaking markup",
+				async ({ name, parameter }) => {
+					const payload = "x".repeat(5000)
+					streamTextParts([
+						`<function_calls><invoke name="${name}"><parameter name="${parameter}">`,
+						payload,
+						"</parameter></invoke></function_calls>",
+					])
+					const chunks = []
+					for await (const chunk of handler.createMessage("system", [{ role: "user", content: "hi" }], {
+						taskId: "test-task",
+						tools: [
+							{
+								type: "function",
+								function: {
+									name,
+									parameters: { type: "object", properties: { [parameter]: { type: "string" } } },
+								},
+							},
+						],
+					})) {
+						chunks.push(chunk)
+					}
+
+					expect(chunks.filter((chunk) => chunk.type !== "usage")).toEqual([
+						{
+							type: "tool_call",
+							id: expect.stringContaining("vscodelm-salvaged-"),
+							name,
+							arguments: JSON.stringify({ [parameter]: payload }),
+						},
+					])
+				},
+			)
+
 			it("flushes an over-long never-closing invoke as plain text before the stream ends", async () => {
 				// End-of-stream flushing produces identical text, so track production timing to
 				// prove the buffer releases text before the stream ends.
-				const filler = "x".repeat(5000)
+				const filler = "x".repeat(256 * 1024)
 				const parts = ['<invoke name="calculator">', filler, filler, filler, filler]
 				let partsProduced = 0
 
 
@@ -104,12 +104,9 @@ const LEAKED_INVOKE_BLOCK = /<(?:antml:)?invoke\s+name="([^"]+)"\s*>([\s\S]*?)<\
 /** Upper bound on an incomplete `<invoke ...` tail held back between chunks. */
 const MAX_PARTIAL_INVOKE_CARRY = 64
 
-/**
- * Upper bound on buffered text held while waiting for a leaked `<invoke>` block to close. Markup
- * that never closes would otherwise withhold the whole response from the user until the stream
- * ended, so past this size the buffer is released as ordinary text.
- */
-const MAX_SALVAGE_BUFFER_CHARS = 64 * MAX_PARTIAL_INVOKE_CARRY
+// Allow substantial file contents and todo lists (256 Ki characters including markup), while
+// bounding how much never-closing markup can withhold from the user.
+const MAX_SALVAGE_BUFFER_CHARS = 256 * 1024
 
 /** True when `text` already contains a closed `<invoke>` block, so buffering is still productive. */
 function hasCompleteInvokeBlock(text: string): boolean {
@@ -1216,8 +1213,7 @@ export class VsCodeLmHandler extends BaseProvider implements SingleCompletionHan
 					// stream so the full markup can be parsed and replayed as a structured call.
 					if (salvageBuffering) {
 						salvageBuffer += chunk.value
-						// Markup that never closes must not withhold the response indefinitely; past the
-						// cap the buffer is released as plain text and buffering stops for the turn.
+						// Release never-closing markup past the cap; a later fresh marker can re-arm recovery.
 						if (salvageBuffer.length > MAX_SALVAGE_BUFFER_CHARS && !hasCompleteInvokeBlock(salvageBuffer)) {
 							const overflowed = salvageBuffer
 							salvageBuffering = false