Three layers of repair, shared by every agent loop: fix malformed tool calls when they are parsed, refine them before they run, and stop repeat failures with circuit breakers. Dangerous commands are blocked before they execute.
When speculative decoding (Lightning-MLX, MTP) drops tokens inside tool call JSON, the model emits malformed arguments. Layer 1 catches InvalidToolInputError and runs jsonrepair to fix truncated JSON. Unknown tool names (hallucinated by the model) are silently dropped instead of crashing the turn. All repairs logged to the debug console.
After JSON parses but before execution, per-tool refinement functions validate inputs. File paths checked for existence. Suspicious write targets (/etc, /usr, path traversal) blocked. URLs auto-prefixed with https://. Dangerous shell patterns (rm -rf /, sudo rm) intercepted and replaced with a safe echo.
Tracks tool call signatures (name + serialized args). When the same call fails 3 times identically, the circuit opens — further identical calls are blocked. Prevents infinite retry loops where the model repeats the same broken command. Successful calls reset the counter. Tripped tools are visible via the subagent registry API.
jsonrepair fixes truncated tool call arguments from speculative decoding
Hallucinated tool names silently dropped instead of crashing
File existence checks, traversal detection, suspicious target blocking
Dangerous shell patterns intercepted before execution
Auto https:// prefix, malformed URL correction
3× identical failure → hard stop, prevents infinite retry loops