QVAC-19908 chore: release sdk + bare-sdk 0.13.4

Fix-only patch release: recover malformed Qwen hybrid tool-call frames (#2677).
Bumps @qvac/sdk and @qvac/bare-sdk to 0.13.4 and adds the 0.13.4 changelog.

(cherry picked from commit 92da258)

Author: simon-iribarren

packages/bare-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qvac/bare-sdk",
-  "version": "0.13.3",
+  "version": "0.13.4",
   "license": "Apache-2.0",
   "description": "Bare-targeted slim assembly of the QVAC SDK. Consumers install only the addon packages they need and register plugins explicitly. No addon dependencies pulled in by default.",
   "repository": {

packages/sdk/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [0.13.4]
+
+📦 **NPM:** https://www.npmjs.com/package/@qvac/sdk/v/0.13.4
+
+A patch release that hardens tool-call parsing for Qwen models used in agentic
+workflows.
+
+## Bug Fixes
+
+### Recover malformed Qwen tool-call frames
+
+Qwen3.5/3.6 can intermittently emit a malformed tool-call frame that fuses its
+XML and JSON tool templates, embedding the `function=<name>` token as a bare
+string key inside an otherwise JSON object. Previously the parser rejected that
+frame as invalid JSON, so no structured tool call was produced and callers saw
+the raw markup as assistant text. The parser now recognizes and repairs this
+specific shape, so the tool call is recovered and dispatched correctly.
+
 ## [0.13.3]
 
 📦 **NPM:** https://www.npmjs.com/package/@qvac/sdk/v/0.13.3
@@ -58,15 +76,15 @@ per-platform prebuilds at install time. Both packages remain available in
 
 The bundled `@qvac/rag` dependency is updated to `^0.6.4`.
 
-## [0.13.1]
-
-📦 **NPM:** https://www.npmjs.com/package/@qvac/sdk/v/0.13.1
-
-Dependency-maintenance patch. `@qvac/sdk` and `@qvac/bare-sdk` adopt `bare-fetch` 3.x and `@qvac/decoder-audio` 0.4.x, and move dev-only `bare-subprocess` to 6.x. This removes the deprecated `@qvac/response` and its exact `bare-events 2.4.2` pin from the dependency tree.
+## [0.13.1] (LLM)
 
-## Maintenance
+Dependency-maintenance patch. No public API changes.
 
-Bump `bare-fetch` to `^3.0.1` (public fetch API unchanged) and dev `bare-subprocess` to `^6.1.0`. Bump `@qvac/decoder-audio` to `^0.4.0` (drops deprecated `@qvac/response`); `decoder-audio@0.4.0` returns its `QvacResponse` synchronously, so `server/utils/audio/decoder.ts` no longer `await`s `decoder.run()`. `@qvac/sdk`/`@qvac/bare-sdk` bumped in lockstep.
+- `bare-fetch` → `^3.0.1` (transitive-only major; fetch API unchanged; only 3.0.1 header validation, all SDK headers are RFC-valid).
+- dev `bare-subprocess` → `^6.1.0` (not shipped to consumers).
+- `@qvac/decoder-audio` → `^0.4.0`: removes the deprecated `@qvac/response` package (folded into `@qvac/infer-base`) from the dependency tree, eliminating its exact `bare-events 2.4.2` pin. `decoder-audio@0.4.0`'s `run()` returns `QvacResponse` synchronously; `server/utils/audio/decoder.ts` updated to not `await` it.
+- `@qvac/sdk` + `@qvac/bare-sdk` bumped in lockstep.
+- Validated by a clean install: no `@qvac/response`, no `bare-events@2.4.2`, no `bare-fetch@2.x`, no `decoder-audio@0.3.x` resolve in the tree.
 
 ## [0.13.0]
 

packages/sdk/changelog/0.13.4/CHANGELOG.md

@@ -0,0 +1,8 @@
+# Changelog v0.13.4
+
+Release Date: 2026-06-18
+
+## 🐞 Fixes
+
+- Recover Qwen hybrid tool-call frames. (see PR [#2677](https://github.com/tetherto/qvac/pull/2677))
+

packages/sdk/changelog/0.13.4/CHANGELOG_LLM.md

@@ -0,0 +1,17 @@
+# QVAC SDK v0.13.4 Release Notes
+
+📦 **NPM:** https://www.npmjs.com/package/@qvac/sdk/v/0.13.4
+
+A patch release that hardens tool-call parsing for Qwen models used in agentic
+workflows.
+
+## Bug Fixes
+
+### Recover malformed Qwen tool-call frames
+
+Qwen3.5/3.6 can intermittently emit a malformed tool-call frame that fuses its
+XML and JSON tool templates, embedding the `function=<name>` token as a bare
+string key inside an otherwise JSON object. Previously the parser rejected that
+frame as invalid JSON, so no structured tool call was produced and callers saw
+the raw markup as assistant text. The parser now recognizes and repairs this
+specific shape, so the tool call is recovered and dispatched correctly.

packages/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qvac/sdk",
-  "version": "0.13.3",
+  "version": "0.13.4",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",