diff --git a/‎packages/cli/src/serve/hosted-workspace-tool-turn.test.ts‎
Lines changed: 4 additions & 0 deletions b/‎packages/cli/src/serve/hosted-workspace-tool-turn.test.ts‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎packages/cli/src/serve/hosted-workspace-tool-turn.ts‎
Lines changed: 6 additions & 1 deletion b/‎packages/cli/src/serve/hosted-workspace-tool-turn.ts‎
Lines changed: 6 additions & 1 deletion
diff --git a/‎packages/core/src/agents/runtime/agent-core.test.ts‎
Lines changed: 83 additions & 0 deletions b/‎packages/core/src/agents/runtime/agent-core.test.ts‎
Lines changed: 83 additions & 0 deletions
diff --git a/‎packages/core/src/agents/runtime/agent-core.ts‎
Lines changed: 7 additions & 0 deletions b/‎packages/core/src/agents/runtime/agent-core.ts‎
Lines changed: 7 additions & 0 deletions
diff --git a/‎packages/core/src/core/coreToolScheduler.test.ts‎
Lines changed: 172 additions & 0 deletions b/‎packages/core/src/core/coreToolScheduler.test.ts‎
Lines changed: 172 additions & 0 deletions
@@ -827,6 +827,10 @@ it('refuses unsupported profile calls before acquiring or reserving work', async
   for (const call of [
     { ...calls[0], name: 'run_shell_command' },
     { ...calls[0], wasOutputTruncated: true },
+    // Arguments that arrived unterminated are refused even when the output
+    // token limit was not what cut them: this profile writes to a remote
+    // Workspace with no undo backup (#12970).
+    { ...calls[0], hadIncompleteArguments: true },
   ]) {
     await expect(
       turn.execute([call], parts, 'model', new AbortController().signal),
 
@@ -716,7 +716,12 @@ export class HostedWorkspaceToolTurn {
         if (
           !declarations.some((tool) => tool.name === call.name) ||
           ids.has(call.callId) ||
-          call.wasOutputTruncated === true
+          // Refuse a call whose arguments arrived unterminated even when the
+          // output token limit was not what cut them: this profile commits to a
+          // remote Workspace with no undo backup, so a repaired partial
+          // `content` or half-streamed command line is unrecoverable.
+          call.wasOutputTruncated === true ||
+          call.hadIncompleteArguments === true
         )
           throw new Error('Hosted Workspace profile refused a tool call.');
         ids.add(call.callId);
 
@@ -82,6 +82,7 @@ import {
   type ToolCall,
   type WaitingToolCall,
 } from '../../core/coreToolScheduler.js';
+import { markToolCallArgumentsIncomplete } from '../../core/incomplete-tool-call-args.js';
 import { ToolConfirmationOutcome } from '../../tools/tools.js';
 import {
   AgentEventType,
@@ -1439,6 +1440,88 @@ describe('AgentCore approval response deduplication', () => {
   });
 });
 
+describe('AgentCore.processFunctionCalls incomplete-argument marker', () => {
+  it('forwards hadIncompleteArguments when the turn was not token-truncated', async () => {
+    const config = {
+      getToolRegistry: vi.fn().mockReturnValue({ getTool: vi.fn() }),
+      getDebugLogger: vi
+        .fn()
+        .mockReturnValue({ debug: vi.fn(), error: vi.fn() }),
+      getToolOutputBatchBudget: vi
+        .fn()
+        .mockReturnValue(Number.POSITIVE_INFINITY),
+      getToolResultBytesWritten: vi.fn().mockReturnValue(0),
+      getSessionId: vi.fn().mockReturnValue('incomplete-args-session'),
+    } as unknown as Config;
+    const core = new AgentCore(
+      'incomplete-args-agent',
+      config,
+      { systemPrompt: '' },
+      { model: 'test-model' },
+      { max_turns: 1 },
+    );
+
+    const functionCall = {
+      id: 'call-incomplete',
+      name: 'write_file',
+      args: { file_path: 'a.txt', content: 'half-written' },
+    };
+    markToolCallArgumentsIncomplete([{ functionCall }]);
+    // Negative control: an unmarked sibling must reach the scheduler WITHOUT
+    // hadIncompleteArguments, or over-application of the marker (which would
+    // reject every subagent Edit call) is undetectable.
+    const cleanFunctionCall = {
+      id: 'call-clean',
+      name: 'write_file',
+      args: { file_path: 'b.txt', content: 'complete' },
+    };
+
+    const scheduleSpy = vi
+      .spyOn(CoreToolScheduler.prototype, 'schedule')
+      .mockResolvedValue(undefined);
+    const abortController = new AbortController();
+
+    const processing = core.processFunctionCalls(
+      [functionCall, cleanFunctionCall],
+      abortController,
+      'prompt-incomplete',
+      1,
+      [{ name: 'write_file' } as FunctionDeclaration],
+      undefined,
+      // The subagent turn saw finishReason STOP (delayed usage disproved a
+      // token cut), so the marker is the only thing left that can arm the
+      // scheduler's data-loss guard here — a subagent has no approval prompt
+      // between the response and the write (#12970).
+      false,
+    );
+    try {
+      await vi.waitFor(() => expect(scheduleSpy).toHaveBeenCalledOnce());
+      const scheduledRequests = scheduleSpy.mock.calls[0]?.[0];
+      expect(scheduledRequests).toEqual([
+        expect.objectContaining({
+          callId: 'call-incomplete',
+          name: 'write_file',
+          wasOutputTruncated: false,
+          hadIncompleteArguments: true,
+        }),
+        expect.objectContaining({
+          callId: 'call-clean',
+          name: 'write_file',
+          wasOutputTruncated: false,
+        }),
+      ]);
+      expect(Array.isArray(scheduledRequests)).toBe(true);
+      expect((scheduledRequests as unknown[])[1]).not.toHaveProperty(
+        'hadIncompleteArguments',
+      );
+    } finally {
+      abortController.abort();
+      await processing;
+      scheduleSpy.mockRestore();
+    }
+  });
+});
+
 describe('AgentCore.prepareTools', () => {
   // Subagents that opt into the wildcard (`tools: ['*']`), or omit
   // toolConfig entirely, must inherit DEFERRED tools too. Otherwise a
 
@@ -86,6 +86,7 @@ import type {
   GenerateContentResponseUsageMetadata,
 } from '@google/genai';
 import { LlmChat } from '../../core/llm-chat.js';
+import { toolCallArgumentsWereIncomplete } from '../../core/incomplete-tool-call-args.js';
 import { assembleSystemPrompt } from '../../core/prompts.js';
 import {
   dedupeToolCallsById,
@@ -2418,6 +2419,12 @@ export class AgentCore {
         prompt_id: promptId,
         response_id: responseId,
         wasOutputTruncated,
+        // Mirror `turn.ts`: the data-loss guard keys on the fact that the
+        // arguments arrived unterminated, which is independent of whether the
+        // output token limit was what cut them (QwenLM/qwen-code#12970).
+        ...(toolCallArgumentsWereIncomplete(fc)
+          ? { hadIncompleteArguments: true }
+          : {}),
         ...((toolName === ToolNames.EXEC ||
           toolName === ToolNames.TOOL_SEARCH) &&
         this.runtimeContext.getToolMode?.() === ToolMode.CodeModeOnly
 
@@ -7181,6 +7181,10 @@ describe('CoreToolScheduler truncated output protection', () => {
     expect(errorMessage).toContain(
       'rejected to prevent writing truncated content',
     );
+    // The telemetry arm of the cause-versus-diagnosis distinction (#12970):
+    // a genuine max_tokens cut must keep reporting OUTPUT_TRUNCATED, never
+    // collapse into the malformed-generation INVALID_TOOL_PARAMS.
+    expect(call.response.errorType).toBe(ToolErrorType.OUTPUT_TRUNCATED);
     return errorMessage;
   }
 
@@ -7195,6 +7199,110 @@ describe('CoreToolScheduler truncated output protection', () => {
     );
   });
 
+  // The token-limit diagnosis being withdrawn must not withdraw the data-loss
+  // guard with it: incomplete arguments mean incomplete file content either
+  // way (QwenLM/qwen-code#12970).
+  it('rejects Kind.Edit calls whose arguments were incomplete without a max_tokens cut', async () => {
+    const declarativeTool = new TestApprovalTool({
+      getApprovalMode: () => ApprovalMode.AUTO_EDIT,
+    } as unknown as Config);
+    const { scheduler, onAllToolCallsComplete } =
+      createTruncationTestScheduler(declarativeTool);
+
+    await scheduler.schedule(
+      [
+        {
+          callId: '1',
+          name: TestApprovalTool.Name,
+          args: { id: 'test-malformed' },
+          isClientInitiated: false,
+          prompt_id: 'prompt-id-malformed',
+          hadIncompleteArguments: true,
+        },
+      ],
+      new AbortController().signal,
+    );
+
+    await vi.waitFor(() => {
+      expect(onAllToolCallsComplete).toHaveBeenCalled();
+    });
+
+    const completedCalls = onAllToolCallsComplete.mock
+      .calls[0][0] as ToolCall[];
+    expect(completedCalls).toHaveLength(1);
+    const completedCall = completedCalls[0];
+    expect(completedCall.status).toBe('error');
+
+    if (completedCall.status === 'error') {
+      const errorMessage = completedCall.response.error?.message ?? '';
+      // Still rejected, and for the real reason.
+      expect(errorMessage).toContain(
+        'rejected to prevent writing incomplete content',
+      );
+      expect(errorMessage).toContain('malformed generation');
+      expect(errorMessage).not.toContain('was truncated due to max_tokens');
+      expect(completedCall.response.errorType).toBe(
+        ToolErrorType.INVALID_TOOL_PARAMS,
+      );
+    }
+  });
+
+  // The non-Edit half of #12970 — and the wording the issue actually asks
+  // for: a non-Edit tool whose schema validation fails lands past the Edit
+  // guard, so its guidance must name malformed generation rather than a
+  // max_tokens cut the response's own usage disproved. The witness tool must
+  // not be Kind.Edit: Edit calls are rejected before validation and can never
+  // reach the paramGuidance branch.
+  it('attaches malformed-generation guidance to validation errors of incomplete non-Edit calls', async () => {
+    const readTool = new MockTool({
+      name: 'mockReadWithRequiredParam',
+      kind: Kind.Read,
+      params: {
+        type: 'object',
+        properties: { path: { type: 'string' } },
+        required: ['path'],
+      },
+    });
+    const { scheduler, onAllToolCallsComplete } =
+      createTruncationTestScheduler(readTool);
+
+    await scheduler.schedule(
+      [
+        {
+          callId: '1',
+          name: 'mockReadWithRequiredParam',
+          args: {},
+          isClientInitiated: false,
+          prompt_id: 'prompt-id-malformed-nonedit',
+          hadIncompleteArguments: true,
+        },
+      ],
+      new AbortController().signal,
+    );
+
+    await vi.waitFor(() => {
+      expect(onAllToolCallsComplete).toHaveBeenCalled();
+    });
+
+    const completedCalls = onAllToolCallsComplete.mock
+      .calls[0][0] as ToolCall[];
+    expect(completedCalls).toHaveLength(1);
+    const completedCall = completedCalls[0];
+    expect(completedCall.status).toBe('error');
+
+    if (completedCall.status === 'error') {
+      const errorMessage = completedCall.response.error?.message ?? '';
+      // Reached validation (not the pre-validation Edit rejection)...
+      expect(errorMessage).toContain("required property 'path'");
+      // ...and the attached guidance matches the actual cause.
+      expect(errorMessage).toContain('malformed generation');
+      expect(errorMessage).not.toContain('truncated due to max_tokens limit');
+      expect(completedCall.response.errorType).toBe(
+        ToolErrorType.INVALID_TOOL_PARAMS,
+      );
+    }
+  });
+
   it('should allow Kind.Edit tool calls when wasOutputTruncated is false', async () => {
     const completedCall = await completeTruncationCall(
       approvalTool(),
@@ -7261,6 +7369,70 @@ describe('CoreToolScheduler truncated output protection', () => {
     expect(messages[1]).not.toContain('RETRY LOOP DETECTED');
     expect(messages[2]).toContain('RETRY LOOP DETECTED');
   });
+
+  // The Edit guard rejects before buildInvocation, so schema validation never
+  // runs on these calls: at the retry-loop threshold the directive must match
+  // the actual cause (repeated incomplete writes), not the validation-failure
+  // wording that would send the model re-examining a schema it never violated.
+  it('should inject the incomplete-args retry loop directive after repeated incomplete write_file rejections', async () => {
+    const writeFileConfig = {
+      getProjectRoot: () => '/tmp',
+      getTargetDir: () => '/tmp',
+      getFileSystemService: () => ({
+        readTextFile: vi.fn(),
+        writeTextFile: vi.fn(),
+      }),
+      getDefaultFileEncoding: () => undefined,
+      setApprovalMode: vi.fn(),
+    } as unknown as Config;
+    const writeFileTool = new WriteFileTool(writeFileConfig);
+    const { scheduler, onAllToolCallsComplete } =
+      createTruncationTestScheduler(writeFileTool);
+
+    const messages: string[] = [];
+
+    for (let i = 1; i <= 3; i++) {
+      await scheduler.schedule(
+        [
+          {
+            callId: `incomplete-write-file-${i}`,
+            name: WriteFileTool.Name,
+            args: { file_path: '/tmp/test.txt', content: 'partial' },
+            isClientInitiated: false,
+            prompt_id: `prompt-id-write-file-incomplete-${i}`,
+            hadIncompleteArguments: true,
+          },
+        ],
+        new AbortController().signal,
+      );
+
+      await vi.waitFor(() => {
+        expect(onAllToolCallsComplete).toHaveBeenCalledTimes(i);
+      });
+
+      const completedCalls = onAllToolCallsComplete.mock.calls.at(-1)?.[0] as
+        | ToolCall[]
+        | undefined;
+      const completedCall = completedCalls?.[0];
+      expect(completedCall?.status).toBe('error');
+      if (completedCall?.status === 'error') {
+        messages.push(completedCall.response.error?.message ?? '');
+      }
+    }
+
+    expect(messages[0]).toContain(
+      'rejected to prevent writing incomplete content',
+    );
+    expect(messages[0]).not.toContain('RETRY LOOP DETECTED');
+    expect(messages[1]).not.toContain('RETRY LOOP DETECTED');
+    // At the threshold, the directive must be the incomplete-args one: the
+    // validation wording would misdiagnose the cause, and the truncation
+    // wording would re-introduce the max_tokens blame #12970 removed.
+    expect(messages[2]).toContain('RETRY LOOP DETECTED');
+    expect(messages[2]).toContain('same incomplete file write');
+    expect(messages[2]).not.toContain('failed validation');
+    expect(messages[2]).not.toContain('truncated');
+  });
 });
 
 describe('CoreToolScheduler Sequential Execution', () => {