The 1200-char cap silently disabled the tool-call leak retry: a leaked
shell call with a heredoc body is routinely longer than that (missed live
at 1604 chars), and the rejection path logged nothing so the miss was
invisible. Detection is structural already - the tags must anchor the
message, finish is "stop" and no tool parts are present - so length is not
evidence of legitimacy. The cap is now opt-in via OPENCODE_FIXES_LEAK_MAX_LEN
(0 = unlimited, the default).
Also replace the blanket includes("```") veto with stripping fenced blocks:
a legal "the format looks like this" example loses its tags and stays a
clean answer, while a real leak whose command body contains fences is still
detected.
Self-tests: regression fixture for the long heredoc leak, fenced-suffix
example, fence-inside-command leak and inline-code suffix; the cap case is
only registered when a cap is configured.
andrey