@miller-tech/uap 1.172.10 → 1.172.12

package/dist/delivery/orphan-guard.js

@@ -0,0 +1,122 @@
+/**
+ * Stop a detached deliver run once the session that ordered it is gone.
+ *
+ * `uap deliver` detaches on purpose (see deliver-detach.ts): a mission must
+ * outlive the agent's bash tool call, which is a short-lived, process-group-
+ * killed container. That is correct and this must not undo it.
+ *
+ * What it must not outlive is the SESSION. Observed live: an agent client
+ * exited, and two detached deliver runs kept driving the model for over an hour
+ * — holding both slots, generating tokens for a conversation nobody would ever
+ * read — while the operator reasonably reported "I have nothing running". Only
+ * killing them by pid stopped it.
+ *
+ * WHY NOT THE OBVIOUS CHECKS
+ *  - `ppid === 1`: wrong on any modern Linux desktop. Both orphans observed here
+ *    had ppid 11681 — the systemd --user manager, which registers as a child
+ *    subreaper, so orphans are re-parented to IT and never to init.
+ *  - "re-parented since start": fires immediately on every detached run, because
+ *    being re-parented is exactly what detaching does. It would kill the feature.
+ *
+ * So the guard watches a specific OWNER pid — the nearest ancestor that is an
+ * agent client — resolved once at detach time and inherited by the child.
+ */
+import { readFileSync } from 'node:fs';
+/** Env var carrying the resolved owner pid across the detach boundary. */
+export const OWNER_PID_ENV = 'UAP_DELIVER_OWNER_PID';
+/** Poll interval. Slow on purpose — a janitor, not a latency path. */
+const DEFAULT_INTERVAL_MS = 20_000;
+/**
+ * Process names that own a deliver run. A deliver started by one of these is
+ * work on behalf of a live session; when that session goes, so does the reason
+ * for the run. Anything else (a plain shell, CI, systemd) is deliberately NOT
+ * matched — the guard then stays off rather than guessing.
+ */
+const CLIENT_COMMS = ['opencode', 'claude', 'cursor', 'codex', 'windsurf'];
+/** `comm` and `ppid` for a pid, or null if it is gone / unreadable. */
+export function readProcInfo(pid, procRoot = '/proc') {
+    try {
+        // /proc/<pid>/stat: "pid (comm) state ppid ..." — comm can contain spaces and
+        // parens, so split on the LAST ')' rather than tokenising the whole line.
+        const stat = readFileSync(`${procRoot}/${pid}/stat`, 'utf8');
+        const close = stat.lastIndexOf(')');
+        const open = stat.indexOf('(');
+        if (open < 0 || close < 0 || close < open)
+            return null;
+        const comm = stat.slice(open + 1, close);
+        const rest = stat.slice(close + 2).trim().split(/\s+/);
+        const ppid = Number(rest[1]);
+        return Number.isFinite(ppid) ? { comm, ppid } : null;
+    }
+    catch {
+        return null; // gone or unreadable — treat as absent
+    }
+}
+/**
+ * Nearest ancestor that is an agent client, or undefined.
+ *
+ * Undefined is a first-class answer: a deliver run from a plain shell or from CI
+ * has no session to outlive, so it gets no guard at all.
+ */
+export function resolveOwnerPid(startPid = process.ppid, opts = {}) {
+    const procRoot = opts.procRoot ?? '/proc';
+    let pid = startPid;
+    for (let depth = 0; depth < (opts.maxDepth ?? 12); depth++) {
+        if (pid <= 1)
+            return undefined;
+        const info = readProcInfo(pid, procRoot);
+        if (!info)
+            return undefined;
+        const comm = info.comm.toLowerCase();
+        if (CLIENT_COMMS.some((c) => comm === c || comm.startsWith(c)))
+            return pid;
+        pid = info.ppid;
+    }
+    return undefined;
+}
+/** Is that pid still around? */
+export function pidAlive(pid) {
+    try {
+        process.kill(pid, 0); // signal 0: existence check, delivers nothing
+        return true;
+    }
+    catch (err) {
+        // EPERM means it exists but belongs to someone else — alive for our purpose.
+        return err?.code === 'EPERM';
+    }
+}
+/**
+ * Exit when the owning session exits. No-op when there is no owner, or when the
+ * operator opted out with UAP_ALLOW_ORPHAN=1 (a deliberately detached run — say,
+ * a long mission started over SSH).
+ *
+ * Returns a stop function. The timer is unref'd: a watchdog that by itself kept
+ * the process alive would be its own bug.
+ */
+export function guardAgainstOwnerExit(opts = {}) {
+    const optOut = (process.env.UAP_ALLOW_ORPHAN ?? '').toLowerCase();
+    if (['1', 'true', 'on', 'yes'].includes(optOut))
+        return () => { };
+    const ownerPid = Number(process.env[OWNER_PID_ENV]);
+    if (!Number.isFinite(ownerPid) || ownerPid <= 1)
+        return () => { };
+    const isAlive = opts.isAlive ?? pidAlive;
+    const timer = setInterval(() => {
+        if (isAlive(ownerPid))
+            return;
+        clearInterval(timer);
+        if (opts.onOwnerGone) {
+            opts.onOwnerGone(ownerPid);
+            return;
+        }
+        // Say why on the way out: a run that vanishes silently is the same
+        // debugging problem as one that never stops.
+        console.error(`\nuap: the session that started this run (pid ${ownerPid}) has exited — ` +
+            `stopping rather than holding a model slot for output nobody will read. ` +
+            `Set ${'UAP_ALLOW_ORPHAN'}=1 to keep detached runs alive.`);
+        process.exit(130); // 128 + SIGINT: ended by circumstance, not by failing
+    }, opts.intervalMs ?? DEFAULT_INTERVAL_MS);
+    timer.unref?.();
+    return () => clearInterval(timer);
+}
+//# sourceMappingURL=orphan-guard.js.map

package/dist/delivery/orphan-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orphan-guard.js","sourceRoot":"","sources":["../../src/delivery/orphan-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAErD,sEAAsE;AACtE,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,YAAY,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AAE3E,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,QAAQ,GAAG,OAAO;IAC1D,IAAI,CAAC;QACH,8EAA8E;QAC9E,0EAA0E;QAC1E,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,QAAQ,IAAI,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,IAAI;YAAE,OAAO,IAAI,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,uCAAuC;IACtD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,WAAmB,OAAO,CAAC,IAAI,EAC/B,OAAiD,EAAE;IAEnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC;IAC1C,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3D,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QAC3E,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,8CAA8C;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6EAA6E;QAC7E,OAAQ,GAA6B,EAAE,IAAI,KAAK,OAAO,CAAC;IAC1D,CAAC;AACH,CAAC;AAUD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA0B,EAAE;IAChE,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAEjE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAEjE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,IAAI,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO;QAC9B,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,mEAAmE;QACnE,6CAA6C;QAC7C,OAAO,CAAC,KAAK,CACX,iDAAiD,QAAQ,iBAAiB;YACxE,yEAAyE;YACzE,OAAO,kBAAkB,iCAAiC,CAC7D,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,sDAAsD;IAC3E,CAAC,EAAE,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC,CAAC;IAE3C,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.172.10",
+  "version": "1.172.12",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/tools/agents/scripts/anthropic_proxy.py

@@ -83,6 +83,7 @@ Dependencies
 
 import asyncio
 import contextvars
+from typing import Awaitable, Callable
 import copy
 import hashlib
 import json
@@ -2958,6 +2959,47 @@ _current_request_session: contextvars.ContextVar[str | None] = contextvars.Conte
     "uap_current_request_session", default=None
 )
 
+# Is the DOWNSTREAM client still there?
+#
+# Nothing used to ask. Once a turn was accepted, the guardrail loops kept
+# retrying and re-POSTing upstream on their own — so when the client died the
+# work carried on regardless. Observed live: two `uap deliver` runs were killed,
+# no socket remained on :4000, and the proxy still drove llama for minutes,
+# generating 32k tokens per orphaned turn that nobody would ever read. Only a
+# proxy restart stopped it.
+#
+# Same ContextVar trick as the session above: request-local without threading a
+# Request through every signature. Holds Starlette's `request.is_disconnected`.
+_current_client_gone: contextvars.ContextVar[
+    Callable[[], Awaitable[bool]] | None
+] = contextvars.ContextVar("uap_current_client_gone", default=None)
+
+
+class ClientGoneError(Exception):
+    """The downstream client disconnected; abandon the turn.
+
+    Raised instead of returning a value so the whole in-flight chain unwinds at
+    once — every guardrail loop, retry and recovery step above it stops without
+    each needing its own check. Caught at the handler boundary and answered with
+    a status nobody reads, since by definition there is no one left to read it.
+    """
+
+
+async def _client_gone() -> bool:
+    """True when the caller has hung up. Never raises, never blocks meaningfully.
+
+    A disconnect check that can itself fail or stall would be worse than no
+    check: it sits in front of every upstream call. Any error means "assume the
+    client is still there" — the pre-existing behaviour.
+    """
+    probe = _current_client_gone.get()
+    if probe is None:
+        return False
+    try:
+        return bool(await probe())
+    except Exception:  # noqa: BLE001
+        return False
+
 # Session admission state. _admitted_sessions maps session_id -> last-seen
 # monotonic ts; OrderedDict insertion order is the LRU (oldest = front).
 # Guarded by _admission_cond's lock (created lazily on the running event loop).
@@ -3289,6 +3331,12 @@ async def _post_with_retry(
     # don't evict each other's KV (sticky, released by idle-TTL). No-op when
     # PROXY_SESSION_ADMISSION is off. Runs BEFORE the per-request semaphore so a
     # queued new session waits without holding a concurrency slot.
+    # Every upstream call funnels through here, so one check covers all of them:
+    # the guardrail retry loop, the completion-contract retries, recovery passes.
+    # Placed BEFORE admission and the slot acquire so a dead client never takes a
+    # concurrency slot away from a live one, and never queues behind one either.
+    if await _client_gone():
+        raise ClientGoneError("client disconnected before upstream call")
     await _ensure_session_admitted(_current_request_session.get())
     acquired = await _acquire_upstream_slot()
     if not acquired:
@@ -3310,6 +3358,55 @@ async def _post_with_retry(
         _release_upstream_slot()
 
 
+# How often to re-check the caller while an upstream generation is in flight.
+PROXY_DISCONNECT_POLL_SECS = max(
+    0.5, float(os.environ.get("PROXY_DISCONNECT_POLL_SECS", "2"))
+)
+
+
+async def _post_watching_client(
+    client: httpx.AsyncClient, url: str, payload: dict, headers: dict
+) -> httpx.Response:
+    """POST upstream, cancelling it if the caller hangs up mid-generation.
+
+    Checking only BEFORE each upstream call stops the retry loops, but does
+    nothing for a generation already in flight: a single turn is one POST, so
+    there is no next call to block and the model runs to completion — up to
+    PROXY_TOOL_TURN_MAX_TOKENS (32k, ~13 minutes here) for a client that has
+    already gone. This closes that.
+
+    Cancelling the httpx task closes the upstream connection, and llama.cpp
+    releases the slot when its client disappears — verified directly against the
+    running server: slots went 2 -> 0 within 15s of closing the socket. So this
+    genuinely frees the GPU rather than merely letting the proxy stop waiting.
+
+    No probe (background task, tests) means no watching: plain await, unchanged.
+    """
+    probe = _current_client_gone.get()
+    if probe is None:
+        return await client.post(url, json=payload, headers=headers)
+
+    post_task = asyncio.ensure_future(client.post(url, json=payload, headers=headers))
+    try:
+        while True:
+            done, _pending = await asyncio.wait(
+                {post_task}, timeout=PROXY_DISCONNECT_POLL_SECS
+            )
+            if post_task in done:
+                return post_task.result()
+            if await _client_gone():
+                post_task.cancel()
+                try:
+                    await post_task
+                except (asyncio.CancelledError, Exception):  # noqa: BLE001
+                    pass  # cancellation is the point; the connection is closed
+                raise ClientGoneError("client disconnected mid-generation")
+    finally:
+        # Never leave the upstream call running after we stop waiting on it.
+        if not post_task.done():
+            post_task.cancel()
+
+
 async def _post_with_retry_inner(
     client: httpx.AsyncClient,
     url: str,
@@ -3321,7 +3418,7 @@ async def _post_with_retry_inner(
         try:
             _inflight_inc(client)
             try:
-                resp = await client.post(url, json=payload, headers=headers)
+                resp = await _post_watching_client(client, url, payload, headers)
             finally:
                 _inflight_dec(client)
             # Cycle 19 Option 1: if 503 "Loading model", wait for health then retry
@@ -3542,6 +3639,23 @@ app = FastAPI(
     lifespan=lifespan,
 )
 
+@app.exception_handler(ClientGoneError)
+async def _client_gone_handler(request: Request, exc: ClientGoneError):
+    """The caller hung up mid-turn: stop, and say so at INFO rather than ERROR.
+
+    499 is nginx's "client closed request" — chosen because no standard code
+    means this and the body goes nowhere anyway; what matters is that the log
+    line reads as an abandoned turn rather than a proxy fault, so this does not
+    masquerade as an incident when someone kills an agent run.
+    """
+    logger.info(
+        "CLIENT GONE: abandoned %s mid-turn (session=%s) — no further upstream calls",
+        request.url.path,
+        (_current_request_session.get() or "?")[:24],
+    )
+    return Response(status_code=499)
+
+
 @app.exception_handler(httpx.PoolTimeout)
 async def _pool_timeout_handler(request: Request, exc: httpx.PoolTimeout):
     """Saturated upstream pool: answer 529 overloaded (Anthropic semantics —
@@ -10791,6 +10905,10 @@ async def messages(request: Request):
     """
     global last_session_id
 
+    # Publish this request's disconnect probe for the whole call tree. Set before
+    # ANY upstream work so an already-dead client is caught on the first call.
+    _current_client_gone.set(request.is_disconnected)
+
     body = await request.json()
     is_stream = body.get("stream", False)
     model = body.get("model", "default")
@@ -11067,6 +11185,8 @@ async def messages(request: Request):
                     strict_body,
                     {"Content-Type": "application/json"},
                 )
+            except ClientGoneError:
+                raise  # control flow: never swallow into a broad handler
             except Exception as exc:
                 # Check if upstream is hung before returning error
                 await _check_slot_hang(LLAMA_CPP_BASE.replace("/v1", "/slots"))
@@ -11099,6 +11219,8 @@ async def messages(request: Request):
                             strict_body,
                             {"Content-Type": "application/json"},
                         )
+                    except ClientGoneError:
+                        raise  # control flow: never swallow into a broad handler
                     except Exception:
                         pass  # fall through to next handler
             if strict_resp.status_code != 200:
@@ -11116,6 +11238,8 @@ async def messages(request: Request):
                             strict_body,
                             {"Content-Type": "application/json"},
                         )
+                    except ClientGoneError:
+                        raise  # control flow: never swallow into a broad handler
                     except Exception as exc:
                         return Response(
                             content=json.dumps(
@@ -11242,6 +11366,8 @@ async def messages(request: Request):
                             openai_resp = retry_data
                         else:
                             logger.info("DEGENERATE RETRY: retry insufficient, using truncated original")
+                except ClientGoneError:
+                    raise  # control flow: never swallow into a broad handler
                 except Exception as exc:
                     logger.warning("DEGENERATE RETRY: failed: %s", exc)
             anthropic_resp = openai_to_anthropic_response(
@@ -11535,6 +11661,8 @@ async def messages(request: Request):
                 openai_body,
                 {"Content-Type": "application/json"},
             )
+        except ClientGoneError:
+            raise  # control flow: never swallow into a broad handler
         except Exception as exc:
             return Response(
                 content=json.dumps(
@@ -11565,6 +11693,8 @@ async def messages(request: Request):
                         openai_body,
                         {"Content-Type": "application/json"},
                     )
+                except ClientGoneError:
+                    raise  # control flow: never swallow into a broad handler
                 except Exception:
                     pass  # fall through
         if resp.status_code != 200:
@@ -11582,6 +11712,8 @@ async def messages(request: Request):
                         openai_body,
                         {"Content-Type": "application/json"},
                     )
+                except ClientGoneError:
+                    raise  # control flow: never swallow into a broad handler
                 except Exception as exc:
                     return Response(
                         content=json.dumps(
@@ -11699,6 +11831,8 @@ async def messages(request: Request):
                         openai_resp = retry_data
                     else:
                         logger.info("DEGENERATE RETRY (stream): no tool call, using truncated")
+            except ClientGoneError:
+                raise  # control flow: never swallow into a broad handler
             except Exception as exc:
                 logger.warning("DEGENERATE RETRY (stream): failed: %s", exc)
         anthropic_resp = openai_to_anthropic_response(

package/tools/agents/tests/test_client_disconnect.py

@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+"""The proxy must abandon a turn when the downstream client disconnects.
+
+Nothing used to ask whether the caller was still there. Once a turn was
+accepted, the guardrail loops kept retrying and re-POSTing upstream on their
+own — so when the client died the work carried on regardless. Observed live
+(2026-07-29): two `uap deliver` runs were killed, no socket remained on :4000,
+and the proxy still drove llama for minutes, generating ~32k tokens per
+orphaned turn that nobody would ever read. Only a proxy restart stopped it.
+"""
+
+import asyncio
+import importlib.util
+import unittest
+from pathlib import Path
+
+
+def _load_proxy():
+    p = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+    spec = importlib.util.spec_from_file_location("anthropic_proxy_disc", p)
+    assert spec is not None and spec.loader is not None
+    m = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(m)
+    return m
+
+
+proxy = _load_proxy()
+
+
+class ClientGoneProbeTest(unittest.TestCase):
+    def test_absent_probe_means_client_is_present(self):
+        """No probe set (background task, test harness) must not read as gone —
+        that would abandon perfectly live turns."""
+        proxy._current_client_gone.set(None)
+        self.assertFalse(asyncio.run(proxy._client_gone()))
+
+    def test_reports_disconnect(self):
+        async def gone() -> bool:
+            return True
+
+        proxy._current_client_gone.set(gone)
+        self.assertTrue(asyncio.run(proxy._client_gone()))
+
+    def test_reports_connected(self):
+        async def here() -> bool:
+            return False
+
+        proxy._current_client_gone.set(here)
+        self.assertFalse(asyncio.run(proxy._client_gone()))
+
+    def test_a_failing_probe_never_breaks_the_request(self):
+        """This check sits in front of every upstream call. A probe that can
+        raise would be worse than no probe, so failure means 'still there'."""
+        async def broken() -> bool:
+            raise RuntimeError("receive channel exploded")
+
+        proxy._current_client_gone.set(broken)
+        self.assertFalse(asyncio.run(proxy._client_gone()))
+
+
+class ClientGoneIsNotSwallowedTest(unittest.TestCase):
+    """The unwind only works if no broad handler eats it on the way out.
+
+    `messages()` has eight `except Exception` blocks. Any one of them catching
+    ClientGoneError would turn "client left" into a logged error and let the
+    turn continue — silently reinstating the bug while every other test passed.
+    """
+
+    def test_every_broad_except_in_messages_reraises_first(self):
+        src = (
+            Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+        ).read_text().split("\n")
+        start = next(i for i, l in enumerate(src) if l.startswith("async def messages(request: Request)"))
+        end = next(
+            (i for i in range(start + 1, len(src)) if src[i].startswith("async def ") or src[i].startswith("@app.")),
+            len(src),
+        )
+
+        unguarded = []
+        for i in range(start, end):
+            stripped = src[i].lstrip()
+            if not stripped.startswith("except Exception") and not stripped.startswith("except BaseException"):
+                continue
+            # The two lines above must be the ClientGoneError re-raise.
+            prev = [src[i - 2].strip(), src[i - 1].strip()] if i >= 2 else []
+            if prev[:1] != ["except ClientGoneError:"] or prev[1:] and not prev[1].startswith("raise"):
+                unguarded.append((i + 1, stripped[:60]))
+
+        self.assertEqual(unguarded, [], f"broad handlers that would swallow the disconnect: {unguarded}")
+
+    def test_client_gone_is_an_exception_so_fastapi_can_handle_it(self):
+        """Deliberately NOT a BaseException: Starlette's middleware only
+        dispatches Exception subclasses, so a BaseException would sail past the
+        registered handler and take down the worker instead of answering 499."""
+        self.assertTrue(issubclass(proxy.ClientGoneError, Exception))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_inflight_cancel.py

@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+"""Cancel the upstream generation when the caller hangs up mid-turn.
+
+Checking only BEFORE each upstream call (v1.172.11) stops the retry loops, but
+does nothing for a generation already in flight: a single turn is ONE post, so
+there is no next call to block and the model runs to completion — up to
+PROXY_TOOL_TURN_MAX_TOKENS (32k, ~13 minutes on this box) for a client that has
+already gone.
+
+That gap was caught by an end-to-end test, not by reasoning: the abandon simply
+never fired for a single long request. These tests pin the closing behaviour so
+it cannot silently regress to the pre-check-only version.
+
+Cancelling matters rather than merely returning: closing the upstream connection
+is what makes llama.cpp release the slot (verified against the running server —
+slots went 2 -> 0 within 15s of a raw socket close).
+"""
+
+import asyncio
+import importlib.util
+import unittest
+from pathlib import Path
+
+
+def _load_proxy():
+    p = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+    spec = importlib.util.spec_from_file_location("anthropic_proxy_inflight", p)
+    assert spec is not None and spec.loader is not None
+    m = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(m)
+    return m
+
+
+proxy = _load_proxy()
+
+
+class _Client:
+    """Stands in for httpx.AsyncClient.post.
+
+    `never` models the real failure: the model is generating, so the POST is
+    neither erroring nor returning — it is simply not done yet.
+    """
+
+    def __init__(self, mode: str):
+        self.mode = mode
+        self.cancelled = False
+
+    async def post(self, url, json=None, headers=None):  # noqa: A002
+        if self.mode == "fast":
+            return "RESPONSE"
+        try:
+            await asyncio.sleep(3600)
+        except asyncio.CancelledError:
+            self.cancelled = True
+            raise
+        return "RESPONSE"
+
+
+def _set_probe(gone: bool):
+    async def probe() -> bool:
+        return gone
+    proxy._current_client_gone.set(probe)
+
+
+class InflightCancelTest(unittest.TestCase):
+    def setUp(self):
+        proxy.PROXY_DISCONNECT_POLL_SECS = 0.05  # keep the tests quick
+
+    def test_cancels_the_upstream_call_when_the_caller_leaves(self):
+        client = _Client("never")
+        _set_probe(True)
+
+        async def run():
+            with self.assertRaises(proxy.ClientGoneError):
+                await proxy._post_watching_client(client, "u", {}, {})
+
+        asyncio.run(run())
+        # The cancellation is the whole point: it closes the connection, which is
+        # what frees the llama slot. Returning early without it would leave the
+        # model generating exactly as before.
+        self.assertTrue(client.cancelled, "upstream POST was not cancelled")
+
+    def test_leaves_a_live_turn_completely_alone(self):
+        client = _Client("fast")
+        _set_probe(False)
+        self.assertEqual(asyncio.run(proxy._post_watching_client(client, "u", {}, {})), "RESPONSE")
+        self.assertFalse(client.cancelled)
+
+    def test_no_probe_means_a_plain_await(self):
+        """Background tasks and tests have no request context. They must keep
+        working, unwatched, rather than acquiring surprise cancellation."""
+        client = _Client("fast")
+        proxy._current_client_gone.set(None)
+        self.assertEqual(asyncio.run(proxy._post_watching_client(client, "u", {}, {})), "RESPONSE")
+
+    def test_a_slow_but_live_turn_is_left_pending(self):
+        """The poll must not mistake 'slow' for 'gone' — long generations are
+        normal, and cancelling them would be a far worse bug than the one fixed.
+
+        Asserted by letting it poll many times and checking it is STILL running.
+        (Wrapping it in wait_for would prove nothing: a wait_for timeout is the
+        caller giving up, and the cleanup correctly cancels upstream then — which
+        is how the first version of this test fooled itself.)
+        """
+        client = _Client("never")
+        _set_probe(False)
+
+        async def run():
+            task = asyncio.ensure_future(proxy._post_watching_client(client, "u", {}, {}))
+            await asyncio.sleep(0.4)  # ~8 poll intervals
+            still_running = not task.done()
+            task.cancel()
+            try:
+                await task
+            except (asyncio.CancelledError, Exception):
+                pass
+            return still_running
+
+        self.assertTrue(asyncio.run(run()), "a live-but-slow turn was ended early")
+
+    def test_poll_interval_has_a_floor(self):
+        """A zero/negative interval would spin the event loop."""
+        self.assertGreaterEqual(proxy.PROXY_DISCONNECT_POLL_SECS, 0.0)
+        mod = _load_proxy()
+        self.assertGreaterEqual(mod.PROXY_DISCONNECT_POLL_SECS, 0.5)
+
+
+if __name__ == "__main__":
+    unittest.main()