@miller-tech/uap 1.148.2 → 1.148.4

package/src/policies/enforcers/expert_review_required.py

@@ -24,7 +24,9 @@ import sys
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).parent))
-from _common import emit, parse_cli, worktree_root, run  # noqa: E402
+from _common import (  # noqa: E402
+    emit, parse_cli, worktree_root, run, REVIEW_ARTIFACT_DIR, REVIEW_WAIVER_DIR,
+)
 
 # Ship verbs are anchored to their tool prefix so that the bare tokens "merge"
 # or "signoff" inside read-only commands (git diff --merge-base, rg merge,
@@ -81,12 +83,12 @@ def _is_low_risk(f: str) -> bool:
 def _active_waiver(root: Path) -> bool:
     """A committable, env-free bypass: an active waiver file. Works in harnesses
     that strip env vars (where UAP_NO_REVIEW=1 cannot be set)."""
-    wdir = root / "policies" / "waivers"
+    wdir = root / REVIEW_WAIVER_DIR
     if wdir.exists():
         for w in wdir.glob("*expert-review*.md"):
             if w.is_file():
                 return True
-    return (root / ".uap" / "reviews" / "WAIVER").exists()
+    return (root / REVIEW_ARTIFACT_DIR / "WAIVER").exists()
 
 
 def current_branch(root: Path) -> str | None:
@@ -129,6 +131,13 @@ def main() -> None:
         emit(True, "not a ship operation")
 
     cmd = args.get("command") or args.get("cmd") or ""
+    # The policy-gate hook runs in the harness env, not the inline command env,
+    # so `UAP_NO_REVIEW=1 git commit ...` never reaches os.environ above. Honor
+    # an inline assignment parsed from the command string too.
+    # Anchored to a LEADING env-assignment run so an incidental mention in a
+    # quoted arg / commit message does NOT silently skip review.
+    if re.search(r"^\s*(?:[A-Za-z_]\w*=\S*\s+)*UAP_NO_REVIEW=['\"]?1\b", cmd):
+        emit(True, "UAP_NO_REVIEW inline override set")
     if not any(p.search(cmd) for p in SHIP_PATTERNS):
         emit(True, "not a ship action")
 
@@ -159,7 +168,7 @@ def main() -> None:
             "— parallel expert review not required",
         )
 
-    review = root / ".uap" / "reviews" / f"{slug}.json"
+    review = root / REVIEW_ARTIFACT_DIR / f"{slug}.json"
     if not review.exists():
         emit(
             False,

package/templates/hooks/uap-policy-gate.sh

@@ -63,11 +63,37 @@ export UAP_REPO_ROOT="$MAIN_ROOT"
 # actual WORKING TREE, not the (possibly bare) MAIN_ROOT. Expose the current checkout
 # so _common.worktree_root() targets the worktree when an op runs from inside one.
 export UAP_WORKTREE_ROOT="$CHECKOUT_ROOT"
-# Delivery enforcement defaults to BLOCK for UAP-managed projects: substantive
-# source edits must route through `uap deliver` (verified completion against the
-# gates). The `:-` preserves any explicit operator/CI override (advisory|block).
-# Escape hatches still apply: UAP_DELIVER_ACTIVE=1 (inside deliver) / UAP_DELIVER_BYPASS=1.
-export UAP_ENFORCE_DELIVERY="${UAP_ENFORCE_DELIVERY:-block}"
+# Delivery enforcement posture. Precedence (highest first):
+#   1. .uap.json `delivery.enforcement` — the project's DECLARED posture is
+#      AUTHORITATIVE (deliberate, reproducible IaC), so a stale ambient
+#      UAP_ENFORCE_DELIVERY=advisory (leaked into a launching shell/session env,
+#      e.g. an opencode session started months ago when an env export was still
+#      in .bashrc) can NOT silently downgrade a project configured to `block`
+#      and let the agent bypass deliver. `delivery.localMode` is read the same
+#      authoritative way and selects how a local-model session resolves block
+#      (advisory|deliver|block — see delivery_enforcement.py).
+#   2. ambient UAP_ENFORCE_DELIVERY (operator/CI per-run override) when the
+#      project declares nothing.
+#   3. default: block.
+# Escape hatches always apply and are honored by the enforcer BEFORE mode:
+# UAP_DELIVER_ACTIVE=1 (inside a deliver run) / UAP_DELIVER_BYPASS=1 (sanctioned
+# manual edit) — so config-authoritative block never re-routes deliver's own edits.
+_DLV_CFG="$(python3 -c '
+import json, sys
+try:
+    d = (json.load(open(sys.argv[1])).get("delivery") or {})
+    e = str(d.get("enforcement", "")).lower()
+    print("%s|%s" % (e if e in ("block", "advisory", "off") else "", str(d.get("localMode", "")).lower()))
+except Exception:
+    print("|")
+' "$MAIN_ROOT/.uap.json" 2>/dev/null || echo "|")"
+_DLV_MODE="${_DLV_CFG%%|*}"; _DLV_LOCAL="${_DLV_CFG##*|}"
+if [[ -n "$_DLV_MODE" ]]; then
+  export UAP_ENFORCE_DELIVERY="$_DLV_MODE"          # config-authoritative: overrides stale ambient
+else
+  export UAP_ENFORCE_DELIVERY="${UAP_ENFORCE_DELIVERY:-block}"
+fi
+[[ -n "$_DLV_LOCAL" ]] && export UAP_DELIVER_LOCAL_MODE="$_DLV_LOCAL"
 cd "$MAIN_ROOT"
 
 TOOL="$(printf '%s' "$PAYLOAD" | python3 -c 'import json,sys; d=json.load(sys.stdin); print(d.get("tool_name") or d.get("tool") or "")' 2>/dev/null || true)"
@@ -103,6 +129,41 @@ print("1" if (hit or bypass) else "0")
 # Operator out-of-band override disables the fail-closed guard too.
 [[ "${UAP_SELF_PROTECT_OFF:-}" == "1" ]] && SEC_SENSITIVE=0
 
+# ── Edit fast-path (A) ───────────────────────────────────────────────────────
+# Test files and TRIVIAL edits (a one-liner, a constant, a typo) are the fast
+# feedback loop; routing each through the full worktree/task/deliver workflow
+# gates costs a ~10+ min deliver cycle on a slow local executor. Allow them
+# directly — BEFORE the workflow-gate loop — so iteration stays fast. This never
+# bypasses SAFETY: a sensitive control-surface path (SEC_SENSITIVE) is excluded,
+# and self/infra-protect gate bash, not these edits. UAP_DELIVER_FASTPATH=off
+# disables; UAP_DELIVER_TRIVIAL_EDIT_CHARS tunes the trivial threshold.
+if [[ "${UAP_DELIVER_FASTPATH:-on}" != "off" && "$SEC_SENSITIVE" != "1" ]]; then
+  case " Edit Write MultiEdit edit write multiedit " in
+    *" $TOOL "*)
+      if printf '%s' "$ARGS" | TRIVIAL="${UAP_DELIVER_TRIVIAL_EDIT_CHARS:-240}" python3 -c '
+import json, os, sys
+try: a = json.loads(sys.stdin.read() or "{}")
+except Exception: sys.exit(1)
+target = (a.get("file_path") or a.get("filePath") or a.get("path") or a.get("target") or a.get("filename") or a.get("file") or "").lower()
+base = target.rsplit("/", 1)[-1]; stem = base.rsplit(".", 1)[0]
+markers = (".test.", ".spec.", "_test.", "test_", "/test/", "/tests/", "/__tests__/", "/spec/", "/specs/")
+is_test = any(m in "/" + target for m in markers) or stem in ("test","tests","spec","specs","conftest") or stem.startswith("test") or stem.endswith("test") or stem.endswith("spec")
+def changed(a):
+    if isinstance(a.get("edits"), list):
+        return sum(len(str(e.get("old_string") or e.get("oldString") or "")) + len(str(e.get("new_string") or e.get("newString") or "")) for e in a["edits"] if isinstance(e, dict))
+    o=a.get("old_string") or a.get("oldString"); n=a.get("new_string") or a.get("newString")
+    return (len(str(o or ""))+len(str(n or ""))) if (o is not None or n is not None) else None
+c = changed(a)
+trivial = c is not None and c <= int(os.environ.get("TRIVIAL","240"))
+sys.exit(0 if (is_test or trivial) else 1)
+' 2>/dev/null; then
+        echo "[UAP policy gate] fast-path: test-file or trivial edit — allowed directly (route substantive source changes through deliver)." >&2
+        exit 0
+      fi
+      ;;
+  esac
+fi
+
 fail_closed() {
   echo "[UAP policy gate] FAIL-CLOSED: this operation touches the enforcement control surface but the self-protect enforcer could not run (${1:-machinery unavailable}). Blocked so a broken/absent gate can't become a bypass. (Operator override: UAP_SELF_PROTECT_OFF=1.)" >&2
   exit 2
@@ -182,7 +243,14 @@ except: print("")' 2>/dev/null || echo "")"
     echo "$msg" >&2
     exit 2
   fi
-done < <(sqlite3 "$DB" "SELECT p.id, p.name, t.toolName FROM policies p JOIN executable_tools t ON t.policyId=p.id WHERE p.isActive=1;")
+# ORDER BY priority DESC: the policies table has a `priority` column but the
+# gate previously ignored it, iterating in rowid order — so a high-priority
+# routing/safety policy (e.g. delivery-enforcement, infra-protect) could be
+# pre-empted by a lower-priority edit-gate that happened to be registered
+# first, and the agent saw the wrong routing message. Honor priority now so
+# the intended policy fires first. (Blocking short-circuits at exit 2, so the
+# highest-priority applicable block wins.) Name is the stable tiebreak.
+done < <(sqlite3 "$DB" "SELECT p.id, p.name, t.toolName FROM policies p JOIN executable_tools t ON t.policyId=p.id WHERE p.isActive=1 ORDER BY p.priority DESC, p.name ASC;")
 
 # A sensitive op that no self-protect enforcer ever evaluated = the control
 # surface is unguarded (self-protect not registered/active). Fail closed.

package/tools/agents/scripts/anthropic_proxy.py

@@ -274,6 +274,49 @@ _RATE_LIMITED_API_RE = re.compile(r"api\.github\.com", re.IGNORECASE)
 PROXY_STUCK_TEXT_THRESHOLD = int(os.environ.get("PROXY_STUCK_TEXT_THRESHOLD", "2"))
 PROXY_STUCK_API_THRESHOLD = int(os.environ.get("PROXY_STUCK_API_THRESHOLD", "3"))
 
+# ---------------------------------------------------------------------------
+# ERROR-LOOP guardrail: the model edits, runs a command, hits the SAME failure,
+# edits again (a DIFFERENT edit), runs, hits the same failure — for many turns.
+# The identical-tool-call loop/cycle detectors never trip because each edit
+# differs; the model looks productive while never addressing the real blocker
+# (observed live: a duplicate function declaration in test.js kept the test from
+# compiling, and the model chased an unrelated error in another file for 35 min).
+# Detect a repeated tool_RESULT error SIGNATURE (normalized: paths/line numbers/
+# digits/hex stripped so it's edit-invariant) and, past the threshold, inject a
+# nudge to STOP editing and re-read the failing file/output end-to-end.
+# PROXY_ERROR_LOOP=off to disable.
+PROXY_ERROR_LOOP = os.environ.get("PROXY_ERROR_LOOP", "on").lower() not in {
+    "0", "off", "false", "no",
+}
+PROXY_ERROR_LOOP_THRESHOLD = int(os.environ.get("PROXY_ERROR_LOOP_THRESHOLD", "3"))
+
+_ERROR_LINE_RE = re.compile(
+    r"^.*(?:Error|Exception|Traceback|FAILED|assert(?:ion)?|SyntaxError|"
+    r"TypeError|ReferenceError|not found|cannot find|undefined|panic|"
+    r"fatal|command not found|exit code [1-9]).*$",
+    re.IGNORECASE | re.MULTILINE,
+)
+
+
+def _error_signature(text: str) -> str:
+    """Edit-invariant signature of the first error line in a tool result.
+
+    Normalizes away paths, line:col numbers, hex, and bare digits so that the
+    SAME underlying failure produces the SAME signature across turns even as the
+    model edits different code around it. Returns "" when no error line is found
+    (a passing result resets the streak)."""
+    if not text:
+        return ""
+    m = _ERROR_LINE_RE.search(text)
+    if not m:
+        return ""
+    line = m.group(0)
+    line = re.sub(r"(/[^\s:]+)+", "<path>", line)          # unix paths
+    line = re.sub(r"\b[0-9a-fA-F]{6,}\b", "<hex>", line)    # hashes/addresses
+    line = re.sub(r"\d+", "#", line)                        # line numbers, counts
+    line = re.sub(r"\s+", " ", line).strip().lower()
+    return line[:200]
+
 # ---------------------------------------------------------------------------
 # DEFERRAL-BREAK guardrail (Fix A): a model can end a turn with plain prose that
 # DEFERS the work instead of doing it -- "I need more exploration cycles to
@@ -769,6 +812,19 @@ PROXY_MALFORMED_TOOL_RETRY_MAX_TOKENS = int(
 PROXY_MALFORMED_TOOL_RETRY_TEMPERATURE = float(
     os.environ.get("PROXY_MALFORMED_TOOL_RETRY_TEMPERATURE", "0")
 )
+# Empty-max_tokens recovery (Option 3): a reasoning model can consume the ENTIRE
+# output budget in reasoning_content and emit NO content/tool_calls
+# (finish_reason=length, empty message) — a thinking-runaway. The upstream
+# --reasoning-budget cap is the primary fix; this is the backstop: on detecting
+# such an empty truncation, retry ONCE with thinking disabled so the turn yields
+# a usable answer instead of an empty response the client blindly re-sends
+# (observed: 529 retry cascades). PROXY_EMPTY_MAXTOKENS_RECOVER=off to disable.
+PROXY_EMPTY_MAXTOKENS_RECOVER = os.environ.get(
+    "PROXY_EMPTY_MAXTOKENS_RECOVER", "on"
+).lower() not in {"0", "off", "false", "no"}
+PROXY_EMPTY_MAXTOKENS_RETRY_MAX_TOKENS = int(
+    os.environ.get("PROXY_EMPTY_MAXTOKENS_RETRY_MAX_TOKENS", "4096")
+)
 PROXY_TOOL_TURN_TEMPERATURE = float(
     os.environ.get("PROXY_TOOL_TURN_TEMPERATURE", "0.3")
 )
@@ -1358,6 +1414,10 @@ class SessionMonitor:
     catastrophic_ctx_streak: int = 0  # Fix F: consecutive turns raw ctx >= finalize ratio
     unexpected_end_turn_count: int = 0  # end_turn without tool_use in active loop
     self_stuck_streak: int = 0  # consecutive assistant texts self-reporting a loop
+    error_signature_streak: int = 0  # consecutive turns with the SAME tool_result error
+    last_error_signature: str = ""  # normalized signature of that recurring error
+    error_loop_fires: int = 0  # telemetry: error-loop nudges injected
+    empty_maxtokens_recoveries: int = 0  # telemetry: thinking-runaway recoveries
     rate_limited_api_streak: int = 0  # consecutive tool calls hitting a rate-limited API host
     stuck_break_fires: int = 0  # monotonic count of forced stuck-breaks
     deferral_streak: int = 0  # consecutive no-tool turns deferring the work (Fix A)
@@ -1599,6 +1659,24 @@ class SessionMonitor:
                     by_tool = self.tool_target_history.setdefault(name, {})
                     by_tool[target] = by_tool.get(target, 0) + 1
 
+    def note_tool_result_error(self, latest_result_text: str) -> None:
+        """Track a repeated tool_result error signature (ERROR-LOOP guardrail).
+
+        Same normalized error as last turn -> increment the streak; a new error
+        or a clean (error-free) result -> reset. Only a SUSTAINED same-failure
+        streak (despite the model's varied edits) trips the nudge."""
+        if not PROXY_ERROR_LOOP:
+            return
+        sig = _error_signature(latest_result_text or "")
+        if sig and sig == self.last_error_signature:
+            self.error_signature_streak += 1
+        elif sig:
+            self.error_signature_streak = 1
+            self.last_error_signature = sig
+        else:
+            self.error_signature_streak = 0
+            self.last_error_signature = ""
+
     def note_assistant_text(self, text: str) -> None:
         """Track the model self-reporting that it is stuck (STUCK-BREAK signal
         (a)). A matching turn increments the streak; a non-matching turn resets
@@ -4905,6 +4983,46 @@ def _maybe_inject_stuck_break(openai_body: dict, monitor: "SessionMonitor") -> N
     logger.warning("STUCK-BREAK: forced terminal turn (%s, fires=%d)", reason, monitor.stuck_break_fires)
 
 
+def _maybe_inject_error_loop_break(openai_body: dict, monitor: "SessionMonitor") -> None:
+    """Nudge the model out of a repeated-same-error loop (ERROR-LOOP guardrail).
+
+    When the SAME normalized tool_result error has recurred >= threshold times
+    despite the model's (varied) edits, its edits aren't addressing the real
+    blocker. Inject a directive to STOP editing and re-read the whole failing
+    file/output — the bug is likely somewhere it hasn't looked. Advisory: does
+    NOT release tool_choice (the model should keep acting, just diagnose first)."""
+    if not PROXY_ERROR_LOOP:
+        return
+    if monitor.error_signature_streak < PROXY_ERROR_LOOP_THRESHOLD:
+        return
+    monitor.error_loop_fires += 1
+    directive = (
+        "\n\nSTOP — the SAME failure has now recurred "
+        + str(monitor.error_signature_streak)
+        + " times in a row despite your edits: \""
+        + monitor.last_error_signature[:120]
+        + "\". Your edits are NOT addressing the real cause. Do NOT make another "
+        "edit yet. FIRST re-read the ENTIRE failing file (and the full error "
+        "output) top-to-bottom — the bug is very likely somewhere you have not "
+        "looked (a duplicate declaration, a wrong import, a different file). "
+        "Only after you can name the exact line causing THIS error, fix that."
+    )
+    msgs = openai_body.get("messages")
+    if not isinstance(msgs, list):
+        msgs = []
+    if msgs and msgs[0].get("role") == "system":
+        msgs[0]["content"] = (msgs[0].get("content") or "") + directive
+    else:
+        msgs.insert(0, {"role": "system", "content": directive.strip()})
+    openai_body["messages"] = msgs
+    logger.warning(
+        "ERROR-LOOP: same failure x%d — injected re-read nudge (sig=%r, fires=%d)",
+        monitor.error_signature_streak,
+        monitor.last_error_signature[:80],
+        monitor.error_loop_fires,
+    )
+
+
 def _maybe_inject_deferral_break(openai_body: dict, monitor: "SessionMonitor") -> None:
     """Convert a turn-ending deferral into forward motion (Fix A).
 
@@ -5897,6 +6015,9 @@ def build_openai_request(
 
     _maybe_inject_stuck_break(openai_body, monitor)
 
+    # ERROR-LOOP: same tool_result failure recurring despite varied edits.
+    _maybe_inject_error_loop_break(openai_body, monitor)
+
     # DEFERRAL-BREAK (Fix A): after stuck-break, drive a no-tool deferral turn
     # into a concrete action. Runs last so it can yield to stuck-break.
     _maybe_inject_deferral_break(openai_body, monitor)
@@ -6030,6 +6151,21 @@ def _record_last_assistant_tool_calls(
     with different arguments (e.g. read(file_a) vs read(file_b)) produces
     distinct fingerprints, preventing false cycle/stagnation detection."""
     messages = anthropic_body.get("messages", [])
+    # ERROR-LOOP tracking: feed the monitor the most recent tool_result text so a
+    # recurring same-failure signature can be detected across (varied) edits.
+    _latest_tr = ""
+    for _m in reversed(messages):
+        _c = _m.get("content")
+        if isinstance(_c, list):
+            _parts = [
+                _extract_text(b.get("content", ""))
+                for b in _c
+                if isinstance(b, dict) and b.get("type") == "tool_result"
+            ]
+            if _parts:
+                _latest_tr = "\n".join(p for p in _parts if p)
+                break
+    monitor.note_tool_result_error(_latest_tr)
     tool_fingerprints = []
     tool_targets: dict[str, str] = {}
     assistant_had_text = False  # Fix B: did the last assistant turn emit prose?
@@ -8159,6 +8295,71 @@ async def _apply_completion_contract_guardrail(
     return retried
 
 
+def _is_empty_maxtokens_response(openai_resp: dict) -> bool:
+    """A finish_reason=length turn that produced NO content and NO tool calls —
+    the thinking-runaway signature (all budget spent in reasoning_content)."""
+    choices = openai_resp.get("choices") or []
+    if not choices:
+        return False
+    choice = choices[0]
+    if (choice.get("finish_reason") or "").lower() != "length":
+        return False
+    msg = choice.get("message") or {}
+    if msg.get("tool_calls"):
+        return False
+    content = msg.get("content")
+    text = content if isinstance(content, str) else ""
+    return len(text.strip()) == 0
+
+
+async def _apply_empty_maxtokens_recovery(
+    client: httpx.AsyncClient,
+    openai_resp: dict,
+    openai_body: dict,
+    anthropic_body: dict,
+    monitor: SessionMonitor,
+    session_id: str,
+) -> dict:
+    """Option 3 backstop: recover an empty finish=length turn by retrying once
+    with thinking OFF, so a residual reasoning-runaway yields a usable answer
+    instead of an empty response the client blindly re-sends (529 cascade)."""
+    if not PROXY_EMPTY_MAXTOKENS_RECOVER:
+        return openai_resp
+    if not _is_empty_maxtokens_response(openai_resp):
+        return openai_resp
+    retry_body = dict(openai_body)
+    retry_body["enable_thinking"] = False
+    ctk = dict(retry_body.get("chat_template_kwargs") or {})
+    ctk["enable_thinking"] = False
+    retry_body["chat_template_kwargs"] = ctk
+    requested = int(openai_body.get("max_tokens") or PROXY_EMPTY_MAXTOKENS_RETRY_MAX_TOKENS)
+    retry_body["max_tokens"] = min(requested, PROXY_EMPTY_MAXTOKENS_RETRY_MAX_TOKENS)
+    logger.warning(
+        "EMPTY-MAX_TOKENS recovery: thinking-runaway (empty finish=length) for "
+        "session %s — retrying once with thinking OFF (max_tokens=%d)",
+        session_id, retry_body["max_tokens"],
+    )
+    try:
+        retry_resp = await client.post(
+            f"{LLAMA_CPP_BASE}/chat/completions",
+            json=retry_body,
+            headers={"Content-Type": "application/json"},
+        )
+        if retry_resp.status_code != 200:
+            return openai_resp
+        retried = retry_resp.json()
+        if not _is_empty_maxtokens_response(retried):
+            monitor.empty_maxtokens_recoveries += 1
+            logger.info(
+                "EMPTY-MAX_TOKENS recovery succeeded for session %s (recoveries=%d)",
+                session_id, monitor.empty_maxtokens_recoveries,
+            )
+            return retried
+    except Exception as exc:  # noqa: BLE001 — recovery is best-effort
+        logger.warning("EMPTY-MAX_TOKENS recovery errored for session %s: %s", session_id, exc)
+    return openai_resp
+
+
 def _sanitize_assistant_messages_for_retry(messages: list[dict]) -> list[dict]:
     """Strip malformed tool-like text from assistant messages to prevent copy-contamination.
 
@@ -10672,6 +10873,14 @@ async def messages(request: Request):
                 monitor,
                 session_id,
             )
+            openai_resp = await _apply_empty_maxtokens_recovery(
+                client,
+                openai_resp,
+                strict_body,
+                body,
+                monitor,
+                session_id,
+            )
 
             openai_resp, was_degenerate = _detect_and_truncate_degenerate_repetition(openai_resp)
             if was_degenerate:
@@ -11116,6 +11325,14 @@ async def messages(request: Request):
             monitor,
             session_id,
         )
+        openai_resp = await _apply_empty_maxtokens_recovery(
+            client,
+            openai_resp,
+            openai_body,
+            body,
+            monitor,
+            session_id,
+        )
 
         choice, _ = _extract_openai_choice(openai_resp)
         finish_reason = choice.get("finish_reason", "")

package/tools/agents/tests/test_empty_maxtokens_recovery.py

@@ -0,0 +1,94 @@
+#!/usr/bin/env python3
+"""Empty-max_tokens recovery: a thinking-runaway (finish=length, empty content,
+no tool calls) is retried once with thinking OFF so the turn yields an answer
+instead of an empty response the client blindly re-sends."""
+import asyncio
+import importlib.util
+import unittest
+from pathlib import Path
+
+
+def _load_proxy():
+    p = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+    spec = importlib.util.spec_from_file_location("anthropic_proxy", p)
+    m = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(m)
+    return m
+
+
+proxy = _load_proxy()
+
+
+def empty_length_resp():
+    return {"choices": [{"finish_reason": "length", "message": {"role": "assistant", "content": ""}}]}
+
+
+def good_resp(text="here is the answer"):
+    return {"choices": [{"finish_reason": "stop", "message": {"role": "assistant", "content": text}}]}
+
+
+class DetectTests(unittest.TestCase):
+    def test_detects_empty_length(self):
+        self.assertTrue(proxy._is_empty_maxtokens_response(empty_length_resp()))
+
+    def test_ignores_length_with_content(self):
+        self.assertFalse(proxy._is_empty_maxtokens_response(
+            {"choices": [{"finish_reason": "length", "message": {"content": "partial answer"}}]}))
+
+    def test_ignores_length_with_tool_calls(self):
+        self.assertFalse(proxy._is_empty_maxtokens_response(
+            {"choices": [{"finish_reason": "length", "message": {"content": "", "tool_calls": [{"id": "1"}]}}]}))
+
+    def test_ignores_normal_stop(self):
+        self.assertFalse(proxy._is_empty_maxtokens_response(good_resp()))
+
+
+class FakeResp:
+    def __init__(self, body):
+        self.status_code = 200
+        self._body = body
+    def json(self):
+        return self._body
+
+
+class FakeClient:
+    def __init__(self, body):
+        self._body = body
+        self.last_json = None
+    async def post(self, url, json=None, headers=None):  # noqa: A002
+        self.last_json = json
+        return FakeResp(self._body)
+
+
+class RecoveryTests(unittest.TestCase):
+    def setUp(self):
+        self.m = proxy.SessionMonitor()
+
+    def _run(self, resp, client_body, body_in=None):
+        client = FakeClient(client_body)
+        out = asyncio.run(proxy._apply_empty_maxtokens_recovery(
+            client, resp, body_in or {"max_tokens": 16384}, {}, self.m, "t"))
+        return out, client
+
+    def test_recovers_with_thinking_off(self):
+        out, client = self._run(empty_length_resp(), good_resp("recovered!"))
+        self.assertEqual(out["choices"][0]["message"]["content"], "recovered!")
+        # retry request had thinking disabled + a bounded max_tokens
+        self.assertIs(client.last_json["chat_template_kwargs"]["enable_thinking"], False)
+        self.assertIs(client.last_json["enable_thinking"], False)
+        self.assertLessEqual(client.last_json["max_tokens"], proxy.PROXY_EMPTY_MAXTOKENS_RETRY_MAX_TOKENS)
+        self.assertEqual(self.m.empty_maxtokens_recoveries, 1)
+
+    def test_no_retry_on_a_healthy_response(self):
+        out, client = self._run(good_resp("fine"), good_resp("should-not-be-used"))
+        self.assertEqual(out["choices"][0]["message"]["content"], "fine")
+        self.assertIsNone(client.last_json)  # never called upstream
+
+    def test_keeps_original_if_retry_also_empty(self):
+        out, _ = self._run(empty_length_resp(), empty_length_resp())
+        self.assertTrue(proxy._is_empty_maxtokens_response(out))  # unchanged
+        self.assertEqual(self.m.empty_maxtokens_recoveries, 0)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_error_loop_break.py

@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+"""ERROR-LOOP guardrail: detect a repeated tool_result error signature across
+varied edits and nudge the model to re-read the failing file.
+
+The identical-tool-call loop detectors miss this because each edit differs; this
+keys on the normalized ERROR, which is edit-invariant.
+"""
+import importlib.util
+import unittest
+from pathlib import Path
+
+
+def _load_proxy_module():
+    proxy_path = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+    spec = importlib.util.spec_from_file_location("anthropic_proxy", proxy_path)
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod
+
+
+proxy = _load_proxy_module()
+
+
+class ErrorSignatureTests(unittest.TestCase):
+    def test_same_error_different_paths_lines_shares_signature(self):
+        a = proxy._error_signature("SyntaxError: Identifier 'testPageLoads' has already been declared\n  at /home/x/test.js:75:1")
+        b = proxy._error_signature("SyntaxError: Identifier 'testPageLoads' has already been declared\n  at /other/path/test.js:128:9")
+        self.assertTrue(a)
+        self.assertEqual(a, b)  # edit-invariant
+
+    def test_distinct_errors_differ(self):
+        a = proxy._error_signature("TypeError: cannot read property 'x' of undefined")
+        b = proxy._error_signature("SyntaxError: unexpected token")
+        self.assertNotEqual(a, b)
+
+    def test_clean_output_has_no_signature(self):
+        self.assertEqual(proxy._error_signature("ok\nall 12 tests passed"), "")
+        self.assertEqual(proxy._error_signature(""), "")
+
+
+class MonitorStreakTests(unittest.TestCase):
+    def setUp(self):
+        self.m = proxy.SessionMonitor()
+
+    def test_streak_accumulates_on_repeat_and_resets_on_pass(self):
+        err = "TypeError: cannot find module 'foo'\n at a.js:1"
+        for _ in range(3):
+            self.m.note_tool_result_error(err)
+        self.assertGreaterEqual(self.m.error_signature_streak, 3)
+        # a passing result resets
+        self.m.note_tool_result_error("ok, 5 passed")
+        self.assertEqual(self.m.error_signature_streak, 0)
+
+    def test_new_error_resets_streak_to_one(self):
+        self.m.note_tool_result_error("Error: A\n at a:1")
+        self.m.note_tool_result_error("Error: A\n at a:2")
+        self.assertEqual(self.m.error_signature_streak, 2)
+        self.m.note_tool_result_error("Error: B different\n at b:1")
+        self.assertEqual(self.m.error_signature_streak, 1)
+
+
+class InjectionTests(unittest.TestCase):
+    def setUp(self):
+        self.m = proxy.SessionMonitor()
+
+    def test_nudge_injected_past_threshold(self):
+        for _ in range(proxy.PROXY_ERROR_LOOP_THRESHOLD):
+            self.m.note_tool_result_error("SyntaxError: already declared\n at x:1")
+        body = {"messages": [{"role": "user", "content": "go"}], "tool_choice": "required"}
+        proxy._maybe_inject_error_loop_break(body, self.m)
+        sysmsg = body["messages"][0]
+        self.assertEqual(sysmsg["role"], "system")
+        self.assertIn("SAME failure", sysmsg["content"])
+        self.assertIn("re-read", sysmsg["content"].lower())
+        # advisory: does NOT release tool_choice
+        self.assertEqual(body["tool_choice"], "required")
+        self.assertEqual(self.m.error_loop_fires, 1)
+
+    def test_no_nudge_below_threshold(self):
+        self.m.note_tool_result_error("Error: once\n at x:1")
+        body = {"messages": [{"role": "user", "content": "go"}]}
+        proxy._maybe_inject_error_loop_break(body, self.m)
+        self.assertEqual(len(body["messages"]), 1)  # unchanged
+        self.assertEqual(self.m.error_loop_fires, 0)
+
+
+if __name__ == "__main__":
+    unittest.main()