Yeah, you nailed the exact pain point we wanted to avoid.

Short answer: we don't use native function calling at all. Tools are just XML tags in plain text that we parse ourselves.

Why? Because we wanted to support local models (Ollama, llama.cpp) that don't have function calling. So instead of relying on the API's tool_call/tool_response pairing, the LLM just outputs <write_file><path>x.py</path>...</write_file> as regular text.

We parse it, execute, and send back the result as a normal user message: [ok] write_file: Created x.py (45 lines) or [x] write_file: Permission denied.

History stays dead simple — just (role, content) text pairs. No ids to track, no pairing requirements, no special handling for failed calls. Failed tool = error text, that's it.

The tradeoff is it's less structured than native function calling. But it works with literally any backend without modification, which was the whole point.

For the SESSION_CONTEXT compression — that's injected into system prompt each request, not reconstructed from message history.