@miller-tech/uap 1.172.11 → 1.172.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.172.11",
+  "version": "1.172.13",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/tools/agents/scripts/anthropic_proxy.py

@@ -2766,7 +2766,7 @@ def _detach_aclose(closeable) -> None:
 
 def _build_http_client() -> httpx.AsyncClient:
     """Upstream client factory — used at startup AND by pool self-healing."""
-    c = httpx.AsyncClient(
+    c = DisconnectAwareClient(
         timeout=httpx.Timeout(
             connect=10.0,  # 10s to establish connection
             read=PROXY_READ_TIMEOUT,  # configurable (default 10 min)
@@ -3358,6 +3358,58 @@ async def _post_with_retry(
         _release_upstream_slot()
 
 
+# How often to re-check the caller while an upstream generation is in flight.
+PROXY_DISCONNECT_POLL_SECS = max(
+    0.5, float(os.environ.get("PROXY_DISCONNECT_POLL_SECS", "2"))
+)
+
+
+class DisconnectAwareClient(httpx.AsyncClient):
+    """An httpx client that abandons a call when the caller hangs up.
+
+    THE CHOKE POINT. The previous attempt guarded ONE call site and claimed to
+    cover them all; there are fourteen, and the guardrail loops that caused the
+    incident call the model directly rather than through _post_with_retry. So
+    the check belongs where it cannot be missed: every high-level httpx method —
+    post(), stream(), request() — funnels through send(), so overriding send()
+    covers all of them, including any added later.
+
+    Cancelling matters rather than merely returning: closing the connection is
+    what makes llama.cpp release the slot (verified against the running server —
+    slots went 2 -> 0 within 15s of a raw socket close). Returning early without
+    cancelling would leave the model generating exactly as before.
+
+    No probe (background task, health check, tests) means a plain send,
+    unwatched. Streaming sends are covered for their header phase; a body being
+    written to a vanished client fails on write anyway.
+    """
+
+    async def send(self, request, **kwargs):  # type: ignore[override]
+        probe = _current_client_gone.get()
+        if probe is None:
+            return await super().send(request, **kwargs)
+
+        task = asyncio.ensure_future(super().send(request, **kwargs))
+        try:
+            while True:
+                done, _pending = await asyncio.wait(
+                    {task}, timeout=PROXY_DISCONNECT_POLL_SECS
+                )
+                if task in done:
+                    return task.result()
+                if await _client_gone():
+                    task.cancel()
+                    try:
+                        await task
+                    except (asyncio.CancelledError, Exception):  # noqa: BLE001
+                        pass  # cancellation is the point; the connection is closed
+                    raise ClientGoneError("client disconnected mid-generation")
+        finally:
+            # Never leave an upstream call running once we stop waiting on it.
+            if not task.done():
+                task.cancel()
+
+
 async def _post_with_retry_inner(
     client: httpx.AsyncClient,
     url: str,
@@ -3446,7 +3498,7 @@ async def _check_slot_hang(slot_url: str) -> bool:
     if PROXY_SLOT_HANG_TIMEOUT <= 0:
         return False
     try:
-        async with httpx.AsyncClient() as check_client:
+        async with DisconnectAwareClient() as check_client:
             resp = await check_client.get(slot_url, timeout=5.0)
             if resp.status_code != 200:
                 return False

package/tools/agents/tests/test_upstream_chokepoint.py

@@ -0,0 +1,178 @@
+#!/usr/bin/env python3
+"""Every upstream call must pass the disconnect check — structurally, not by claim.
+
+This test exists because of a specific mistake. Two releases (v1.172.11,
+v1.172.12) guarded ONE call site while the commit message asserted that "every
+upstream call funnels through _post_with_retry, so one check covers them all".
+There are fourteen upstream call sites, and the guardrail loops that caused the
+incident — malformed-tool retry, completion-contract, empty-max-tokens recovery,
+unexpected-end-turn, recipe — call the model DIRECTLY. Both releases were
+therefore near-no-ops for the workload they were written for, and every unit
+test still passed.
+
+The fix was to move the check somewhere it cannot be missed: httpx routes every
+high-level method (post, stream, request) through send(), so DisconnectAwareClient
+overrides send() and the coverage becomes a property of the client rather than a
+property of remembering.
+
+These tests pin that property. A future call site added anywhere in the proxy is
+covered automatically; a future *client* constructed bare would not be, and that
+is exactly what the enumeration below fails on.
+"""
+
+import ast
+import asyncio
+import importlib.util
+import re
+import unittest
+from pathlib import Path
+
+PROXY_PATH = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+
+
+def _load_proxy():
+    spec = importlib.util.spec_from_file_location("anthropic_proxy_choke", PROXY_PATH)
+    assert spec is not None and spec.loader is not None
+    m = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(m)
+    return m
+
+
+proxy = _load_proxy()
+SRC = PROXY_PATH.read_text()
+
+
+class ChokePointEnumerationTest(unittest.TestCase):
+    def test_no_bare_httpx_client_is_ever_constructed(self):
+        """The invariant. A bare httpx.AsyncClient bypasses the override, so its
+        calls silently go unwatched — which is precisely how the first two
+        attempts failed, one call site at a time."""
+        bare = [
+            (i + 1, l.strip())
+            for i, l in enumerate(SRC.split("\n"))
+            if re.search(r"httpx\.AsyncClient\s*\(", l) and "class " not in l
+        ]
+        self.assertEqual(
+            bare, [], f"these construct an unwatched client: {bare}"
+        )
+
+    def test_the_client_actually_subclasses_httpx(self):
+        """Guards the reverse mistake: a wrapper that no longer IS an httpx
+        client would break every caller rather than fail this suite loudly."""
+        import httpx
+
+        self.assertTrue(issubclass(proxy.DisconnectAwareClient, httpx.AsyncClient))
+
+    def test_send_is_overridden_on_the_client_itself(self):
+        """send() is the funnel. If a refactor moves the logic off send() onto,
+        say, post(), then stream() and request() silently lose their guard."""
+        self.assertIn("send", vars(proxy.DisconnectAwareClient))
+
+    def test_every_upstream_call_site_is_reachable_through_send(self):
+        """Inventory, so the count cannot quietly drift.
+
+        Any client.post / client.stream / client.send in the proxy is covered by
+        the override — that is the point of a choke point. This asserts the call
+        sites still exist in numbers consistent with the audit (they were the
+        thing miscounted), and that none of them re-implements its own transport.
+        """
+        calls = re.findall(r"client\.(post|send|stream)\s*\(", SRC)
+        self.assertGreaterEqual(
+            len(calls), 10, "upstream call sites vanished — was transport re-implemented?"
+        )
+        # No call site may build its own client inline and slip the override.
+        self.assertNotRegex(SRC, r"await\s+httpx\.AsyncClient\s*\(")
+
+
+class ChokePointBehaviourTest(unittest.TestCase):
+    """The override must do the job, not merely exist."""
+
+    class _Req:
+        pass
+
+    def setUp(self):
+        proxy.PROXY_DISCONNECT_POLL_SECS = 0.05
+
+    def _client_with_send(self, behaviour):
+        """A DisconnectAwareClient whose SUPERCLASS send is stubbed, so the
+        override under test runs for real."""
+        import httpx
+
+        state = {"cancelled": False}
+
+        async def fake_send(self, request, **kwargs):
+            if behaviour == "fast":
+                return "RESPONSE"
+            try:
+                await asyncio.sleep(3600)
+            except asyncio.CancelledError:
+                state["cancelled"] = True
+                raise
+
+        original = httpx.AsyncClient.send
+        httpx.AsyncClient.send = fake_send  # type: ignore[assignment]
+        client = proxy.DisconnectAwareClient()
+        return client, state, (lambda: setattr(httpx.AsyncClient, "send", original))
+
+    def _set_probe(self, gone: bool):
+        async def probe() -> bool:
+            return gone
+        proxy._current_client_gone.set(probe)
+
+    def test_cancels_upstream_when_the_caller_leaves(self):
+        client, state, restore = self._client_with_send("never")
+        try:
+            self._set_probe(True)
+
+            async def run():
+                with self.assertRaises(proxy.ClientGoneError):
+                    await client.send(self._Req())
+
+            asyncio.run(run())
+            self.assertTrue(state["cancelled"], "upstream call was not cancelled")
+        finally:
+            restore()
+
+    def test_leaves_a_live_call_alone(self):
+        client, state, restore = self._client_with_send("fast")
+        try:
+            self._set_probe(False)
+            self.assertEqual(asyncio.run(client.send(self._Req())), "RESPONSE")
+            self.assertFalse(state["cancelled"])
+        finally:
+            restore()
+
+    def test_no_probe_means_unwatched(self):
+        """Health checks and background tasks have no request context and must
+        keep working rather than acquiring surprise cancellation."""
+        client, state, restore = self._client_with_send("fast")
+        try:
+            proxy._current_client_gone.set(None)
+            self.assertEqual(asyncio.run(client.send(self._Req())), "RESPONSE")
+        finally:
+            restore()
+
+    def test_a_slow_but_live_call_is_left_pending(self):
+        """Mistaking 'slow' for 'gone' would be worse than the bug being fixed."""
+        client, state, restore = self._client_with_send("never")
+        try:
+            self._set_probe(False)
+
+            async def run():
+                task = asyncio.ensure_future(client.send(self._Req()))
+                await asyncio.sleep(0.4)  # ~8 poll intervals
+                still = not task.done()
+                task.cancel()
+                try:
+                    await task
+                except (asyncio.CancelledError, Exception):
+                    pass
+                return still
+
+            self.assertTrue(asyncio.run(run()), "a live-but-slow call was ended early")
+        finally:
+            restore()
+
+
+if __name__ == "__main__":
+    unittest.main()