@miller-tech/uap 1.172.0 → 1.172.6

package/tools/agents/scripts/anthropic_proxy.py

@@ -1468,6 +1468,7 @@ class SessionMonitor:
     doubling_break_fires: int = 0  # monotonic count of injected pivot directives
     last_doubling_obs: str = ""  # msg-count:fingerprint key of the last counted observation
     mandate_deliver_fires: int = 0  # monotonic count of forced deliver-routings (mandate)
+    mandate_deliver_active: bool = False  # THIS turn is pinned to deliver (beats recon convergence)
     tool_starvation_streak: int = 0  # Consecutive forced turns with no tool_calls produced
     last_request_msg_count: int = 0  # Message count of the previous request (compaction-boundary detection)
     malformed_tool_streak: int = 0  # consecutive malformed pseudo tool payloads
@@ -5251,6 +5252,13 @@ def _maybe_inject_deferral_break(openai_body: dict, monitor: "SessionMonitor") -
 PROXY_MANDATE_DELIVER = os.environ.get("PROXY_MANDATE_DELIVER", "on").lower() not in {
     "0", "off", "false", "no",
 }
+# Precedence: when the mandate pins a turn to deliver, recon convergence must not
+# undo it. Both guards run on the same turn and both rewrite tools/tool_choice, so
+# without this the later one (recon) silently wins. Off => the old ordering, where
+# recon can release the pin mid-mandate.
+PROXY_MANDATE_BEATS_RECON = os.environ.get(
+    "PROXY_MANDATE_BEATS_RECON", "on"
+).lower() not in {"0", "off", "false", "no"}
 # Enforcer-block-SPECIFIC phrases only (src/policies/enforcers/delivery_enforcement.py).
 # Deliberately NOT matching the reactor's STANDING "route through deliver" guidance
 # (which is injected every turn) -- only the actual block event must trigger.
@@ -5318,11 +5326,65 @@ def _assistant_already_called_deliver(messages, deliver_name: str) -> bool:
     return False
 
 
+def _pin_tool_choice_to(openai_body: dict, tool_name: str) -> bool:
+    """Constrain this turn to calling exactly `tool_name`. Returns True if pinned.
+
+    The obvious encoding -- OpenAI's `{"type": "function", "function": {"name":
+    ...}}` -- does NOT work against llama.cpp. Its server reads the field as a
+    STRING (`json_value(body, "tool_choice", std::string("auto"))`) and accepts
+    only auto | none | required via common_chat_tool_choice_parse_oaicompat().
+    Handed an object it logs
+
+        Wrong type supplied for parameter 'tool_choice'. Expected 'string',
+        using default value
+
+    and falls back to "auto" -- so every "pin" silently became "the model may do
+    whatever it likes". That is how a blocked source edit could be answered with
+    "I will proceed by manually creating the files": the mandate was never a
+    constraint, only the directive text asking nicely.
+
+    Express the same intent in the vocabulary llama.cpp actually has: demand SOME
+    tool call, and narrow the advertised tools to just this one, so the only call
+    that satisfies the demand is the intended one. "required" is equally valid
+    OpenAI, so this stays correct against a non-llama.cpp upstream.
+
+    Narrowing is skipped if the tool is not present in `tools` -- sending
+    "required" with the tool absent would force a call the model cannot make.
+    """
+    tools = openai_body.get("tools")
+    if not isinstance(tools, list):
+        return False
+    wanted = str(tool_name).lower()
+    pinned = [
+        t for t in tools
+        if isinstance(t, dict)
+        and str((t.get("function") or {}).get("name") or "").lower() == wanted
+    ]
+    if not pinned:
+        return False
+    openai_body["tools"] = pinned
+    openai_body["tool_choice"] = "required"
+    return True
+
+
 def _maybe_inject_mandate_deliver(openai_body: dict, monitor: "SessionMonitor") -> None:
     """MANDATORY deliver-routing: when a direct source edit was just blocked by
     delivery-enforcement, force the next turn to call the `deliver` tool for ANY
     model. Pins tool_choice to the deliver tool + injects a terse directive.
     Runs before the softer guards so the pin stands. PROXY_MANDATE_DELIVER=off."""
+    # Decide the per-turn flag HERE, unconditionally, before any early return.
+    #
+    # It previously lived beside finalize_turn_active in build_openai_request --
+    # which sits inside `if has_tools:`, while this function and
+    # _maybe_inject_recon_convergence are both called unconditionally. On a
+    # TOOL-LESS turn the reset was therefore skipped, this function returned
+    # early (no deliver tool to find), and recon read a stale True from an
+    # earlier turn and suppressed itself. Owning the flag here makes it
+    # impossible to leave stale: the one function that can set it True is the
+    # same one that always clears it first, on every turn, whatever the caller
+    # does. The clear precedes the PROXY_MANDATE_DELIVER check deliberately, so
+    # disabling the mandate can never strand a True either.
+    monitor.mandate_deliver_active = False
     if not PROXY_MANDATE_DELIVER:
         return
     deliver_name = _deliver_tool_name(openai_body.get("tools"))
@@ -5333,7 +5395,13 @@ def _maybe_inject_mandate_deliver(openai_body: dict, monitor: "SessionMonitor")
         return
     if _assistant_already_called_deliver(messages, deliver_name):
         return  # deliver is already in flight -- don't loop on it
-    openai_body["tool_choice"] = {"type": "function", "function": {"name": deliver_name}}
+    if not _pin_tool_choice_to(openai_body, deliver_name):
+        # Could not actually constrain the turn (deliver absent from `tools`).
+        # Don't claim a mandate that isn't real: recording one here would
+        # suppress recon convergence while leaving the model free to hand-edit,
+        # which is strictly worse than letting recon do its job.
+        return
+    monitor.mandate_deliver_active = True
     monitor.mandate_deliver_fires += 1
     directive = (
         "\n\nMANDATORY: your direct source edit was BLOCKED by delivery-enforcement. "
@@ -5419,6 +5487,31 @@ def _maybe_inject_recon_convergence(
     """
     if PROXY_RECON_CONVERGENCE_THRESHOLD <= 0:
         return
+    # PRECEDENCE: the deliver mandate outranks recon convergence.
+    #
+    # Both run on the same turn (mandate first), and both rewrite tools/
+    # tool_choice, so the later one wins by default -- which made the mandate's
+    # own "runs before the softer guards so the pin stands" untrue. Until
+    # v1.172.2 that was invisible: the pin was encoded in a form llama.cpp
+    # ignored, so it had nothing to override.
+    #
+    # The mandate is the more specific and more recent signal: a source edit was
+    # just BLOCKED and the only correct next action is a deliver call. Recon
+    # exists to break a read-forever deadlock -- which cannot occur while the
+    # mandate holds, because the pin leaves exactly one advertised tool under
+    # tool_choice="required", so the model is constrained to call deliver rather
+    # than read again. Letting recon win instead released that constraint and
+    # handed back the freedom to keep hand-editing.
+    #
+    # Escape hatch if this ever wedges: PROXY_MANDATE_BEATS_RECON=off.
+    if PROXY_MANDATE_BEATS_RECON and getattr(monitor, "mandate_deliver_active", False):
+        logger.info(
+            "RECON CONVERGENCE: suppressed -- deliver mandate owns this turn "
+            "(no_write_streak=%d, mandate_fires=%d).",
+            monitor.consecutive_no_write_turns,
+            monitor.mandate_deliver_fires,
+        )
+        return
     streak = monitor.consecutive_no_write_turns
     if streak < PROXY_RECON_CONVERGENCE_THRESHOLD:
         return

package/tools/agents/tests/test_mandate_beats_recon.py

@@ -0,0 +1,188 @@
+#!/usr/bin/env python3
+"""Precedence: the deliver mandate outranks recon convergence.
+
+Both guards run on the same turn (mandate first) and both rewrite
+tools/tool_choice, so without an explicit rule the later one -- recon -- wins
+and silently releases the pin. That made the mandate's own docstring claim
+("runs before the softer guards so the pin stands") untrue.
+
+The regression is only observable now: until v1.172.2 the pin was encoded in a
+form llama.cpp ignored, so recon had nothing to override.
+"""
+
+import importlib.util
+import os
+import unittest
+from pathlib import Path
+
+
+def _load_proxy(env: dict | None = None):
+    """Import the proxy with `env` applied, then restore the environment.
+
+    Module-level constants (PROXY_*) are read at import, so a knob can only be
+    exercised by re-importing under a different environment.
+    """
+    saved = {k: os.environ.get(k) for k in (env or {})}
+    try:
+        for k, v in (env or {}).items():
+            os.environ[k] = v
+        p = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+        spec = importlib.util.spec_from_file_location("anthropic_proxy_mbr", p)
+        assert spec is not None and spec.loader is not None
+        m = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(m)
+        return m
+    finally:
+        for k, v in saved.items():
+            if v is None:
+                os.environ.pop(k, None)
+            else:
+                os.environ[k] = v
+
+
+proxy = _load_proxy()
+
+DELIVER_TOOL = {"type": "function", "function": {"name": "deliver", "parameters": {}}}
+READ_TOOL = {"type": "function", "function": {"name": "read", "parameters": {}}}
+GREP_TOOL = {"type": "function", "function": {"name": "grep", "parameters": {}}}
+BLOCK_MSG = (
+    "BLOCKED: do not edit 'src/foo.ts' directly. To create or change code, call "
+    "the `deliver` tool (or run: uap deliver \"...\"). Do NOT retry this edit."
+)
+
+
+def _blocked_body(tools):
+    return {
+        "tools": list(tools),
+        "messages": [
+            {"role": "assistant", "content": "editing",
+             "tool_calls": [{"function": {"name": "edit"}}]},
+            {"role": "tool", "content": BLOCK_MSG},
+        ],
+        "tool_choice": "auto",
+    }
+
+
+def _deep_recon(monitor, mod):
+    """Put the monitor well past the hard recon tier, so recon would definitely
+    fire and rewrite the request if it were allowed to run."""
+    monitor.consecutive_no_write_turns = int(
+        mod.PROXY_RECON_CONVERGENCE_THRESHOLD * mod.PROXY_RECON_HARD_MULTIPLIER
+    ) + 10
+
+
+class MandateBeatsReconTest(unittest.TestCase):
+    def test_recon_cannot_release_a_pinned_turn(self):
+        mon = proxy.SessionMonitor()
+        mon.mandate_deliver_active = False
+        body = _blocked_body([READ_TOOL, GREP_TOOL, DELIVER_TOOL])
+
+        proxy._maybe_inject_mandate_deliver(body, mon)
+        self.assertTrue(mon.mandate_deliver_active)
+        self.assertEqual(body["tool_choice"], "required")
+        self.assertEqual([t["function"]["name"] for t in body["tools"]], ["deliver"])
+
+        _deep_recon(mon, proxy)
+        proxy._maybe_inject_recon_convergence(body, mon, [READ_TOOL, GREP_TOOL, DELIVER_TOOL])
+
+        # The pin must survive: still required, still exactly one tool.
+        self.assertEqual(body["tool_choice"], "required")
+        self.assertEqual([t["function"]["name"] for t in body["tools"]], ["deliver"])
+
+    def test_recon_still_runs_when_no_mandate_is_active(self):
+        """The suppression must be scoped to mandated turns -- recon is the
+        read-forever deadlock breaker and must keep working otherwise."""
+        mon = proxy.SessionMonitor()
+        mon.mandate_deliver_active = False
+        body = {"tools": [READ_TOOL, GREP_TOOL], "messages": [{"role": "user", "content": "explore"}]}
+        _deep_recon(mon, proxy)
+
+        before = mon.recon_hard_fires
+        proxy._maybe_inject_recon_convergence(body, mon, [READ_TOOL, GREP_TOOL])
+        self.assertGreater(mon.recon_hard_fires, before)
+
+    def test_flag_is_cleared_on_a_TOOL_LESS_turn(self):
+        """Regression: the reset used to live beside finalize_turn_active in
+        build_openai_request, which sits inside `if has_tools:` -- while both
+        _maybe_inject_mandate_deliver and _maybe_inject_recon_convergence are
+        called unconditionally. A tool-less turn therefore skipped the reset,
+        the mandate returned early (no deliver tool to find), and recon read a
+        stale True from an earlier turn and suppressed itself.
+
+        The mandate now owns the flag and clears it on every turn, so this
+        sequence -- mandate turn, then a turn with no tools at all -- must leave
+        it False.
+        """
+        mon = proxy.SessionMonitor()
+        proxy._maybe_inject_mandate_deliver(_blocked_body([DELIVER_TOOL]), mon)
+        self.assertTrue(mon.mandate_deliver_active)
+
+        proxy._maybe_inject_mandate_deliver({"messages": [{"role": "user", "content": "hi"}]}, mon)
+        self.assertFalse(mon.mandate_deliver_active)
+
+    def test_flag_is_cleared_even_when_the_mandate_is_disabled(self):
+        """The clear precedes the PROXY_MANDATE_DELIVER check, so turning the
+        mandate off cannot strand a True set while it was on."""
+        mod = _load_proxy({"PROXY_MANDATE_DELIVER": "off"})
+        self.assertFalse(mod.PROXY_MANDATE_DELIVER)
+        mon = mod.SessionMonitor()
+        mon.mandate_deliver_active = True  # as if set on a previous turn
+        mod._maybe_inject_mandate_deliver(_blocked_body([DELIVER_TOOL]), mon)
+        self.assertFalse(mon.mandate_deliver_active)
+
+    def test_flag_is_per_turn_not_sticky(self):
+        """A stale True would suppress recon forever after one mandate. The
+        request builder clears it each turn; assert the field is not latched by
+        the mandate itself."""
+        mon = proxy.SessionMonitor()
+        self.assertFalse(mon.mandate_deliver_active)
+        body = _blocked_body([DELIVER_TOOL])
+        proxy._maybe_inject_mandate_deliver(body, mon)
+        self.assertTrue(mon.mandate_deliver_active)
+
+        # Simulate the next turn's reset, then a turn with no block present.
+        mon.mandate_deliver_active = False
+        clean = {"tools": [DELIVER_TOOL], "messages": [{"role": "user", "content": "hello"}]}
+        proxy._maybe_inject_mandate_deliver(clean, mon)
+        self.assertFalse(mon.mandate_deliver_active)
+
+    def test_no_mandate_claimed_when_pin_is_impossible(self):
+        """If deliver is absent the pin cannot be applied. Recording a mandate
+        anyway would suppress recon while leaving the model free to hand-edit --
+        strictly worse than letting recon run."""
+        mon = proxy.SessionMonitor()
+        body = _blocked_body([READ_TOOL])
+        proxy._maybe_inject_mandate_deliver(body, mon)
+        self.assertFalse(mon.mandate_deliver_active)
+        self.assertEqual(mon.mandate_deliver_fires, 0)
+
+    def test_precedence_off_reproduces_the_bug_it_fixes(self):
+        """PROXY_MANDATE_BEATS_RECON=off restores the old ordering -- and pins
+        down exactly what that ordering costs.
+
+        This is the load-bearing assertion of the whole change: with the
+        precedence disabled, recon's hard tier sets tool_choice back to "auto",
+        releasing a mandate raised because a source edit had just been BLOCKED.
+        The model is then free to do what it was blocked for. If this test ever
+        stops reproducing that release, the precedence guard has become dead
+        code and the suppression above is no longer protecting anything.
+        """
+        mod = _load_proxy({"PROXY_MANDATE_BEATS_RECON": "off"})
+        self.assertFalse(mod.PROXY_MANDATE_BEATS_RECON)
+
+        mon = mod.SessionMonitor()
+        body = _blocked_body([READ_TOOL, GREP_TOOL, DELIVER_TOOL])
+        mod._maybe_inject_mandate_deliver(body, mon)
+        self.assertTrue(mon.mandate_deliver_active)
+        self.assertEqual(body["tool_choice"], "required")
+
+        _deep_recon(mon, mod)
+        before = mon.recon_hard_fires
+        mod._maybe_inject_recon_convergence(body, mon, [READ_TOOL, GREP_TOOL, DELIVER_TOOL])
+
+        self.assertGreater(mon.recon_hard_fires, before)  # recon ran
+        self.assertEqual(body["tool_choice"], "auto")     # ...and released the pin
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_mandate_deliver.py

@@ -46,7 +46,11 @@ class MandateDeliverTest(unittest.TestCase):
             {"role": "tool", "content": BLOCK_MSG},
         ], tools=[DELIVER_TOOL])
         proxy._maybe_inject_mandate_deliver(b, self.mon)
-        self.assertEqual(b["tool_choice"], {"type": "function", "function": {"name": "deliver"}})
+        # "required" + a one-tool list, NOT the OpenAI object form: llama.cpp
+        # parses tool_choice as a string and silently falls back to "auto" when
+        # handed an object, which un-pinned every mandate.
+        self.assertEqual(b["tool_choice"], "required")
+        self.assertEqual([t["function"]["name"] for t in b["tools"]], ["deliver"])
         self.assertEqual(self.mon.mandate_deliver_fires, 1)
         self.assertTrue(any("MANDATORY" in (m.get("content") or "") for m in b["messages"]))
 
@@ -79,7 +83,36 @@ class MandateDeliverTest(unittest.TestCase):
         mcp_deliver = {"type": "function", "function": {"name": "mcp__uap-router__deliver", "parameters": {}}}
         b = _body([{"role": "tool", "content": BLOCK_MSG}], tools=[mcp_deliver])
         proxy._maybe_inject_mandate_deliver(b, self.mon)
-        self.assertEqual(b["tool_choice"], {"type": "function", "function": {"name": "mcp__uap-router__deliver"}})
+        self.assertEqual(b["tool_choice"], "required")
+        self.assertEqual(
+            [t["function"]["name"] for t in b["tools"]], ["mcp__uap-router__deliver"]
+        )
+
+    def test_pin_narrows_tools_to_the_single_mandated_tool(self):
+        """The pin must REMOVE the other tools. 'required' only means "some
+        tool", so leaving `read` advertised would let the model satisfy the
+        mandate by reading a file instead of delivering."""
+        b = _body([{"role": "tool", "content": BLOCK_MSG}], tools=[READ_TOOL, DELIVER_TOOL])
+        proxy._maybe_inject_mandate_deliver(b, self.mon)
+        self.assertEqual(b["tool_choice"], "required")
+        self.assertEqual([t["function"]["name"] for t in b["tools"]], ["deliver"])
+
+    def test_tool_choice_is_never_an_object(self):
+        """Regression guard for the llama.cpp string-only parser. An object here
+        is not a hard error upstream -- it degrades to "auto" with only a log
+        line -- so nothing downstream would have caught the regression."""
+        b = _body([{"role": "tool", "content": BLOCK_MSG}], tools=[DELIVER_TOOL])
+        proxy._maybe_inject_mandate_deliver(b, self.mon)
+        self.assertIsInstance(b["tool_choice"], str)
+        self.assertIn(b["tool_choice"], {"auto", "none", "required"})
+
+    def test_pin_is_a_noop_when_the_named_tool_is_absent(self):
+        """Forcing "required" while the mandated tool is missing would demand a
+        call the model cannot make. _pin_tool_choice_to must decline instead."""
+        b = _body([{"role": "user", "content": "hi"}], tools=[READ_TOOL], tool_choice="auto")
+        self.assertFalse(proxy._pin_tool_choice_to(b, "deliver"))
+        self.assertEqual(b["tool_choice"], "auto")
+        self.assertEqual([t["function"]["name"] for t in b["tools"]], ["read"])
 
     def test_disabled_by_env(self):
         old = os.environ.get("PROXY_MANDATE_DELIVER")