Crush executes a duplicate tool call

[N0zoM1z0]

Description

Bug report

The provider stream repeats the same tool-call id. Crush executes the duplicate tool call.

Before/after behavior

Before: the provider stream crosses a duplicate, repeated, or cancelled tool-call boundary.

After: Crush executes tool work that should have been rejected or ignored.

Expected: Crush should execute a tool-call id at most once and reject/ignore duplicate tool-call ids.

Minimal reproducible example

Standalone reproduction

Prerequisites: Docker, Python 3, and the GitHub CLI (gh) for the clone command below. The linked reproducer is self-contained and uses only Python standard-library modules plus Docker. It builds the affected CLI version from the public upstream package/release source and starts a local mock provider; it does not require this repository or any private fuzzing harness. The Docker run is limited to 2 CPUs and 4 GiB RAM by default.

Complete self-contained reproducer: https://gist.github.com/N0zoM1z0/8939ec64bc69e2cde1da46b22e756104

The Gist contains crush-duplicate-tool-execution.reproduce.py. Download and run:

gh gist clone 8939ec64bc69e2cde1da46b22e756104 crush-duplicate-tool-execution-reproducer
cd crush-duplicate-tool-execution-reproducer
python3 crush-duplicate-tool-execution.reproduce.py

To reuse an already-built local image:

python3 crush-duplicate-tool-execution.reproduce.py --skip-build

Key output from a local run against the affected version:

process_exit=-9
provider_requests=2428
tool_result_counts={'shell_1': 2922198}
late_stream_events_after_stop=4856
side_effect_file_occurrences crush-duplicate-tool-execution.log 'crush-duplicate-tool-execution': observed=10 expected>=2
REPRODUCED

Version

v0.76.0

Environment

• Repository: charmbracelet/crush - Version: Crush 0.76.0 - OS/arch: Linux x86_64 in Docker (node:24-bookworm) - Interface: CLI - Provider/model: OpenAI-compatible local mock provider, model gpt-4