server : fix tool calls being dropped from trailing assistant message

[kyo-zzz]

Fixes #27588

Overview

The bug

--prefill-assistant + trailing assistant(tool_calls) = silent context corruption. Request switches to continuation mode, add_generation_prompt forced off, prompt tail rebuilt without the tool calls. Model continues from an assistant turn where those calls don't exist. Agent clients replaying such histories get hosed.

Why

Three spots:

1. tools/server/server-common.cpp — heuristic triggers on any trailing assistant msg
2. common/chat.cpp — final msg popped from render list
3. common/chat-auto-parser-generator.cpp — continuation suffix skips tool_calls entirely

Fix

• Auto-continuation now skips trailing assistant msgs that have tool calls → they render normally, add_generation_prompt is honored
• Explicit continue_final_message throws instead of silently corrupting (consistent with the existing conflict error)

Tested

Regression tests in tests/test-chat.cpp (Qwen3): normal render keeps get_weather, explicit continuation is rejected, server parse path keeps both the tool call and gen prompt.

Additional information

Thanks to @PieBru for providing a GPU-free reproduction of the /apply-template issue in #27588. This PR follows the "reject loudly" option discussed there.

Built and tested locally on Windows 11 with MSVC 2022 (static build).

Requirements

• I have read and agree with the contributing guidelines
• AI usage disclosure: YES — I used AI to assist with root-cause analysis, code changes, and test development. I reviewed every line, built and ran the tests locally, and take full responsibility for the change.

[ggml-gh-bot]

Hi @kyo-zzz, thanks for your contribution!

Per our contribution guidelines, the automated PR checker found the following issue(s) that need your attention:

• AI-generated content: While code is allowed to be generated by AI, please write the PR description and commit messages on your own without the help of AI.

---

Please note that maintainers reserve the right to make final decisions on PRs. If you believe there is a mistake, please comment below.

[zhong285]

I independently reproduced this issue on an older affected llama.cpp build, but had not posted the results here previously. I have now also verified the current PR head (aeba8f159d185afd1ce5384c4c161842ccb3eb89) against the same agent-style history boundary.

Environment

Affected build:

• b1-a94d563ed

PR-head build:

• b339-aeba8f1
• source: aeba8f159d185afd1ce5384c4c161842ccb3eb89

Common runtime profile:

• Qwen3.6-35B-A3B Q4_K_M
• Vulkan
• n-gpu-layers=999
• threads=4
• default assistant prefill enabled
• reasoning disabled
• GGML_NATIVE=OFF

The replay fixture used a real assistant(tool_calls) object originally produced by the model.

Results

1. Trailing assistant(tool_calls)

Affected build:

• /apply-template returned HTTP 200
• the trailing tool call disappeared from the rendered prompt
• no error was reported

PR head:

• the same history returned HTTP 400
• structured error:

Cannot continue an assistant message that contains tool calls.

Result: the previously observed silent context corruption is replaced by an explicit fail-closed rejection.

2. Completed synchronous tool round

For:

assistant(tool_calls) -> tool(result)

the PR head returned HTTP 200 and preserved the function call, argument, tool result, ordering, and next assistant generation prompt.

Result: no regression observed for the completed synchronous tool round.

3. Explicit continuation

Using the same trailing assistant(tool_calls) history with:

• continue_final_message=true
• add_generation_prompt=false

the PR head returned HTTP 400 with the same structured rejection.

Result: explicit continuation also fails closed.

Before / after

Case	Affected build	PR head
trailing assistant(tool_calls)	HTTP 200 + silent loss	HTTP 400 fail-closed
completed assistant(tool_calls) -> tool(result)	preserved	preserved
explicit continuation	not separately qualified	HTTP 400 fail-closed

For this tested Qwen3.6/Vulkan environment, the current PR head removes the silent tool-call history corruption at the affected boundary while preserving the completed synchronous tool round.

This is a focused independent verification of this specific runtime/history boundary, not a claim of universal coverage across models or backends.