The markerless tool-call parsers promoted a bare call:NAME{...} and
NAME[ARGS]{json} found anywhere in assistant text into a real tool call,
gated only by whether NAME was an enabled tool. When the model quotes
attacker-controlled content (web, RAG, pasted text) shaped like one of
those, the safetensors, MLX and GGUF loops would execute it via
execute_tool, so prose could be turned into host code execution through
the python and terminal tools.
Real Gemma and Mistral calls carry an unambiguous wrapper
(<|tool_call>...<tool_call|>, [TOOL_CALLS]), but generation streams with
skip_special_tokens=True, which strips that wrapper before the parser
sees it and forces the bare-text fallback that cannot tell a real call
from a quote.
Never promote or strip a markerless execution-class call. Add a shared
EXECUTION_CLASS_TOOL_NAMES = {python, terminal} and a _markerless_promotable
helper in tool_healing, and route every markerless parse and strip path
through it: the bare Gemma call, the bare rehearsal name[ARGS]{...}, the
bare Llama-3.2 {"name":...} JSON, and the two leading-dispatch guards.
Trusted wrapped and structured forms (<|tool_call>, [TOOL_CALLS],
<function=>, and GGUF structured tool_calls) still promote python and
terminal normally, and benign bare tools are unchanged.
Existing tests that used python/terminal as placeholder names to exercise
parser mechanics are re-pointed to benign tools; add
test_markerless_exec_tool_guard.py plus loop-level cases proving a bare
execution call in prose never reaches execute_tool while the wrapped
forms still execute.
f2f0dc5e54