feat(loop): Top5#4 工具循环增强（对齐 OpenClaw agent-loop）——重复检测/并行串行/钩子/errorKind/repair

- 重复调用安全网（critical-tool-loop）：指纹=name+canonical JSON(args)；批内重复第二次跳过回喂
  「duplicate call」；跨轮关键重复(同指纹重现)→首次 block+criticalSeen，再次连续重复→终止整轮
  StopReasonToolLoopTerminated（替代裸 8 轮针对同调用的硬截止）。
- 并行/串行混合：invokeParallel 默认并行，信号量(ToolParallelism 默认4)限并发，结果按调用索引
  写回按原序渲染；串行触发=Options.ToolExecution:sequential 或 SetToolExecutionMode(name,sequential)
  （对齐 OpenClaw「一个 sequential 标记→整组串行」）；goroutine 不泄漏、ctx 取消快速返回。
- 工具钩子：ToolLoopHooks(BatchAdmit/CallAdmit/AfterCall/AfterOutcome) 经 Options.Hooks 注入，
  均 nil-tolerant；供后续敏感操作代审复用（design/11）。terminate 用 every 语义。
- status 分类：ToolError.Kind() 区分 argument-validation(JSON-Schema 失败)/execution；
  失败消息渲染 {kind,message} 让模型区分重发参数 vs 执行失败。
- tool-call-repair：LenientJSONUnmarshal 修 fence 包裹/尾逗号畸形；agent.extractToolCalls 与
  loop.decodeToolCalls 走它；不可修复退化为文本不崩整轮。意图调用未区分回喂提示(后置)。
- tool_execution_update：流式路径 emitToolExecution 发 StreamKindToolExecution(start/end/end:error)。

go build/vet/test 全绿(46包)。TestRun_MaxRounds 改每轮不同参(原同 echo 被安全网拦，预期新行为)。
-race 受宿主 TSan VMA 限制无法运行(与代码无关)。

internal/runtime/tool/repair.go

@@ -0,0 +1,113 @@
+package tool
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"regexp"
+)
+
+// fencedJSONRe matches a code-fence wrapper some models emit around tool-call
+// JSON, e.g. ```json {...} ```. The captured group is the inner JSON.
+var fencedJSONRe = regexp.MustCompile("(?s)^[\\s`]*```(?:json)?[\\r\\n]*(.*?)[\\r\\n]*```\\s*$")
+
+// LenientJSONUnmarshal unmarshals raw into dest, applying a few tolerant repairs
+// for the malformed tool-call JSON models sometimes emit, before falling back to
+// strict encoding/json. Repairs are applied in order:
+//
+//  1. strip a wrapping ```json code fence (and stray backticks);
+//  2. trim surrounding whitespace;
+//  3. strip trailing commas before `}` and `]`;
+//  4. attempt the strict decode.
+//
+// The function reports the raw json.Unmarshal error (wrapped) when every repair
+// fails, so a caller can fall back to treating the payload as plain text without
+// crashing — the malformed call never aborts the round. Full repair (unquoted
+// keys, single-quoted strings, smart quotes) is deliberately left for a later
+// milestone; the load-bearing guarantee here is that a malformed envelope is
+// recoverable or degrades to text rather than throwing.
+func LenientJSONUnmarshal(raw []byte, dest any) error {
+	candidates := repairCandidates(raw)
+	var lastErr error
+	for _, c := range candidates {
+		if err := json.Unmarshal(c, dest); err == nil {
+			return nil
+		} else {
+			lastErr = err
+		}
+	}
+	return fmt.Errorf("tool: lenient json: %w", lastErr)
+}
+
+// repairCandidates returns the ordered list of byte slices to try, deduplicated:
+// the raw input, the fenced-stripped input, and trailing-comma-stripped variants.
+func repairCandidates(raw []byte) [][]byte {
+	out := [][]byte{nil}
+	seen := map[string]bool{}
+	push := func(b []byte) {
+		s := string(b)
+		if seen[s] {
+			return
+		}
+		seen[s] = true
+		out = append(out, b)
+	}
+
+	push(bytes.TrimSpace(raw))
+
+	clean := raw
+	if m := fencedJSONRe.FindSubmatch(raw); len(m) == 2 {
+		clean = bytes.TrimSpace(m[1])
+		push(clean)
+	}
+	clean = bytes.TrimSpace(clean)
+	push(bytes.TrimSpace(clean))
+	push(bytes.TrimSpace(stripTrailingCommas(clean)))
+	push(bytes.TrimSpace(stripTrailingCommas(bytes.TrimSpace(raw))))
+
+	return out
+}
+
+// stripTrailingCommas removes commas that sit immediately before a closing `}`
+// or `]` (ignoring whitespace), the most common single-token repair for truncated
+// model output such as `{"a":1,}`.
+func stripTrailingCommas(b []byte) []byte {
+	if !bytes.ContainsAny(b, "}]") {
+		return b
+	}
+	// Scan for a comma run whose next non-whitespace byte is a closing bracket; a
+	// copy is built so the original bytes are never mutated.
+	out := make([]byte, 0, len(b))
+	skipComma := false
+	for i := 0; i < len(b); i++ {
+		if b[i] == ',' {
+			// Peek ahead past whitespace for a closing bracket.
+			j := i + 1
+			for j < len(b) && isJSONSpace(b[j]) {
+				j++
+			}
+			if j < len(b) && (b[j] == '}' || b[j] == ']') {
+				skipComma = true
+			}
+		}
+		if skipComma && isJSONSpace(b[i]) {
+			continue
+		}
+		if skipComma && b[i] == ',' {
+			skipComma = false
+			continue
+		}
+		out = append(out, b[i])
+	}
+	return out
+}
+
+// isJSONSpace reports whether b is JSON insignificant whitespace.
+func isJSONSpace(b byte) bool {
+	switch b {
+	case ' ', '\t', '\r', '\n':
+		return true
+	default:
+		return false
+	}
+}

internal/runtime/tool/tool.go

@@ -25,6 +25,28 @@ import (
 // override and the Dispatcher was built without WithDefaultTimeout.
 const DefaultTimeout = 30 * time.Second
 
+// Execution modes a tool may declare to the loop. A tool that mutates shared
+// state (file writes, device control) should be marked sequential so the loop
+// does not run it concurrently with other calls.
+const (
+	// ExecutionModeParallel is the default: the loop may run such a tool
+	// concurrently with other calls in a batch.
+	ExecutionModeParallel = "parallel"
+	// ExecutionModeSequential forces the loop to run the whole batch serially so
+	// this tool is never invoked concurrently.
+	ExecutionModeSequential = "sequential"
+)
+
+// Error-kind labels distinguishing why a tool call failed, fed back to the model
+// as a structured {kind,message} so it can react differently to a bad argument
+// (re-issue a corrected call) versus an execution failure.
+const (
+	// KindArgumentValidation marks a JSON-Schema argument-validation failure.
+	KindArgumentValidation = "argument-validation"
+	// KindExecution marks a runtime execution failure (timeout, panic, tool error).
+	KindExecution = "execution"
+)
+
 // Sentinel errors returned by the Dispatcher. Use errors.Is to test for them;
 // they are wrapped with %w so the underlying cause stays available.
 var (
@@ -64,6 +86,17 @@ func (e *ToolError) Error() string {
 // Unwrap exposes the wrapped cause so errors.Is/errors.As traverse the chain.
 func (e *ToolError) Unwrap() error { return e.cause }
 
+// Kind classifies the failure as "argument-validation" (the caller-supplied
+// arguments failed the JSON Schema) or "execution" (anything after validation:
+// unknown tool, timeout, panic or an Execute error). The loop uses it to feed a
+// structured {kind,message} tool result back to the model.
+func (e *ToolError) Kind() string {
+	if e.cause != nil && errors.Is(e.cause, ErrInvalidArgs) {
+		return KindArgumentValidation
+	}
+	return KindExecution
+}
+
 // Option configures a Dispatcher at construction time.
 type Option func(*Dispatcher)
 
@@ -72,8 +105,9 @@ type Option func(*Dispatcher)
 type Dispatcher struct {
 	reg      *registry.Registry
 	dft      time.Duration
-	mu       sync.RWMutex // guards timeouts
+	mu       sync.RWMutex // guards timeouts and modes
 	timeouts map[string]time.Duration
+	modes    map[string]string // tool name -> ExecutionMode* (default parallel)
 }
 
 // New builds a Dispatcher backed by reg, applying opts in order. It returns an
@@ -87,6 +121,7 @@ func New(reg *registry.Registry, opts ...Option) (*Dispatcher, error) {
 		reg:      reg,
 		dft:      DefaultTimeout,
 		timeouts: make(map[string]time.Duration),
+		modes:    make(map[string]string),
 	}
 	for _, opt := range opts {
 		if opt != nil {
@@ -125,6 +160,33 @@ func (d *Dispatcher) SetToolTimeout(name string, timeout time.Duration) error {
 	return nil
 }
 
+// SetToolExecutionMode marks a tool as running "sequential" or "parallel" (the
+// default). A sequential tool is never invoked concurrently by the loop, so
+// shared-state tools (file writes, device control) can declare it. An empty mode
+// clears the override back to the default. Only ExecutionModeSequential is
+// treated as sequential.
+func (d *Dispatcher) SetToolExecutionMode(name, mode string) error {
+	if name == "" {
+		return fmt.Errorf("tool: set execution mode: %w", ErrUnknownTool)
+	}
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	if mode == "" || mode == ExecutionModeParallel {
+		delete(d.modes, name)
+		return nil
+	}
+	d.modes[name] = mode
+	return nil
+}
+
+// IsSequential reports whether the named tool has been declared sequential. An
+// unknown name or one never marked sequential reports false (the default).
+func (d *Dispatcher) IsSequential(name string) bool {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+	return d.modes[name] == ExecutionModeSequential
+}
+
 // Invoke executes the tool registered as name with the given args. It resolves
 // the tool from the registry, validates args against the tool's Parameters JSON
 // Schema, and runs Execute under the tool's deadline (per-tool override, else

internal/runtime/tool/tool_extra_test.go

@@ -0,0 +1,87 @@
+package tool
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+)
+
+func TestLenientJSONUnmarshal_TrailingComma(t *testing.T) {
+	t.Parallel()
+	var v map[string]any
+	if err := LenientJSONUnmarshal([]byte(`{"a":1,}`), &v); err != nil {
+		t.Fatalf("LenientJSONUnmarshal: %v", err)
+	}
+	if v["a"] != float64(1) {
+		t.Fatalf("a = %#v, want 1", v["a"])
+	}
+}
+
+func TestLenientJSONUnmarshal_Fenced(t *testing.T) {
+	t.Parallel()
+	raw := "```json\n{\"tool_calls\":[{\"name\":\"echo\",\"args\":{\"q\":\"hi\"}}]}\n```"
+	var v struct {
+		ToolCalls []map[string]any `json:"tool_calls"`
+	}
+	if err := LenientJSONUnmarshal([]byte(raw), &v); err != nil {
+		t.Fatalf("LenientJSONUnmarshal: %v", err)
+	}
+	if len(v.ToolCalls) != 1 {
+		t.Fatalf("tool_calls = %d, want 1", len(v.ToolCalls))
+	}
+}
+
+func TestLenientJSONUnmarshal_Unrecoverable(t *testing.T) {
+	t.Parallel()
+	// Malformed beyond repair must return an error, never panic or silently
+	// succeed.
+	var v map[string]any
+	if err := LenientJSONUnmarshal([]byte(`{"a":"unterminated`), &v); err == nil {
+		t.Fatal("expected error for unrecoverable JSON")
+	}
+}
+
+func TestSetToolExecutionMode_Sequential(t *testing.T) {
+	t.Parallel()
+	d, _ := newDispatcher(t)
+	if d.IsSequential("x") {
+		t.Fatal("x should default to parallel")
+	}
+	if err := d.SetToolExecutionMode("x", ExecutionModeSequential); err != nil {
+		t.Fatalf("SetToolExecutionMode: %v", err)
+	}
+	if !d.IsSequential("x") {
+		t.Fatal("x should be sequential after marking")
+	}
+	// Clearing back to parallel.
+	if err := d.SetToolExecutionMode("x", ExecutionModeParallel); err != nil {
+		t.Fatalf("SetToolExecutionMode(parallel): %v", err)
+	}
+	if d.IsSequential("x") {
+		t.Fatal("x should be parallel after clearing")
+	}
+}
+
+func TestSetToolExecutionMode_EmptyName(t *testing.T) {
+	t.Parallel()
+	d, _ := newDispatcher(t)
+	if err := d.SetToolExecutionMode("", ExecutionModeSequential); !errors.Is(err, ErrUnknownTool) {
+		t.Fatalf("SetToolExecutionMode(\"\") error = %v, want ErrUnknownTool", err)
+	}
+}
+
+func TestToolError_Kind(t *testing.T) {
+	t.Parallel()
+	val := &ToolError{Name: "x", Message: "bad args", cause: fmt.Errorf("validate: %w", ErrInvalidArgs)}
+	if val.Kind() != KindArgumentValidation {
+		t.Fatalf("validation Kind = %q, want %q", val.Kind(), KindArgumentValidation)
+	}
+	exec := &ToolError{Name: "x", Message: "boom", cause: errors.New("boom")}
+	if exec.Kind() != KindExecution {
+		t.Fatalf("execution Kind = %q, want %q", exec.Kind(), KindExecution)
+	}
+	none := &ToolError{Name: "x", Message: "m"}
+	if none.Kind() != KindExecution {
+		t.Fatalf("nil-cause Kind = %q, want %q", none.Kind(), KindExecution)
+	}
+}