@miller-tech/uap 1.179.5 → 1.179.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.179.5",
+  "version": "1.179.6",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project",
+    "test:enforcers": "python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_delivery_enforcement_worktree",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",

package/tools/agents/tests/test_anthropic_proxy_streaming.py

@@ -3,6 +3,7 @@
 import asyncio
 import importlib.util
 import json
+import os
 import unittest
 import unittest.mock
 from pathlib import Path
@@ -91,36 +92,44 @@ class TestProxyConfigTuning(unittest.TestCase):
         finally:
             setattr(proxy, "PROXY_MAX_TOKENS_FLOOR", old_floor)
 
-    def test_build_request_bypasses_floor_for_tool_turns_when_thinking_disabled(self):
-        old_floor = getattr(proxy, "PROXY_MAX_TOKENS_FLOOR")
-        old_disable = getattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS")
-        try:
-            setattr(proxy, "PROXY_MAX_TOKENS_FLOOR", 4096)
-            setattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS", True)
-
-            body = {
-                "model": "test",
-                "max_tokens": 512,
-                "messages": [{"role": "user", "content": "run pwd"}],
-                "tools": [
+    def test_thinking_disabled_flag_no_longer_changes_the_tool_turn_budget(self):
+        # This test used to assert 512 while toggling
+        # PROXY_DISABLE_THINKING_ON_TOOL_TURNS. That gating was deliberately
+        # removed — it skipped the floor on every tool turn once thinking was
+        # off, which re-introduced truncated tool calls on long edits — and the
+        # flag now only feeds a log line. Asserting the post-removal number
+        # alone would just duplicate test_max_tokens_floor_bypassed_for_small_
+        # preflight, so pin the removal itself: the flag must not move the
+        # budget in either position. 512 lands on THINKING_MIN_FOR_TOOLS (2048)
+        # because Qwen emits <think> regardless of the flag, and on a tool turn
+        # those blocks alone eat ~400-1000 tokens, leaving nothing for the
+        # tool_call (observed live as ~5 required_tool_miss retries per turn).
+        def budget(disable_thinking):
+            with unittest.mock.patch.object(proxy, "PROXY_MAX_TOKENS_FLOOR", 4096), \
+                    unittest.mock.patch.object(
+                        proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS", disable_thinking):
+                return proxy.build_openai_request(
                     {
-                        "name": "Bash",
-                        "description": "run command",
-                        "input_schema": {"type": "object"},
-                    }
-                ],
-            }
+                        "model": "test",
+                        "max_tokens": 512,
+                        "messages": [{"role": "user", "content": "run pwd"}],
+                        "tools": [
+                            {
+                                "name": "Bash",
+                                "description": "run command",
+                                "input_schema": {"type": "object"},
+                            }
+                        ],
+                    },
+                    proxy.SessionMonitor(context_window=0),
+                ).get("max_tokens")
 
-            openai = proxy.build_openai_request(
-                body, proxy.SessionMonitor(context_window=0)
-            )
-            self.assertEqual(openai.get("max_tokens"), 512)
-        finally:
-            setattr(proxy, "PROXY_MAX_TOKENS_FLOOR", old_floor)
-            setattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS", old_disable)
+        self.assertEqual(budget(True), budget(False), "flag must no longer gate the floor")
+        self.assertEqual(budget(True), 2048)
 
-    def test_build_request_skips_floor_for_non_tool_turns(self):
-        """Non-tool requests should NOT have the max_tokens floor applied."""
+    def test_non_tool_turn_takes_thinking_floor_not_the_big_floor(self):
+        """Non-tool requests skip PROXY_MAX_TOKENS_FLOOR and land on
+        THINKING_MIN_NO_TOOLS instead — a different, larger mechanism."""
         old_floor = getattr(proxy, "PROXY_MAX_TOKENS_FLOOR")
         old_disable = getattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS")
         try:
@@ -133,11 +142,20 @@ class TestProxyConfigTuning(unittest.TestCase):
                 "messages": [{"role": "user", "content": "say ok"}],
             }
 
-            openai = proxy.build_openai_request(
-                body, proxy.SessionMonitor(context_window=0)
-            )
-            # Floor should NOT inflate max_tokens for non-tool requests
-            self.assertEqual(openai.get("max_tokens"), 512)
+            with unittest.mock.patch.dict(
+                os.environ, {"PROXY_THINKING_MIN_NO_TOOLS": "8192"}
+            ):
+                openai = proxy.build_openai_request(
+                    body, proxy.SessionMonitor(context_window=0)
+                )
+            # The big PROXY_MAX_TOKENS_FLOOR (4096) is still skipped for
+            # non-tool turns — that is what this test guards. What the request
+            # lands on instead is THINKING_MIN_NO_TOOLS: Qwen spends small
+            # no-tool budgets entirely inside <think>, the EMPTY-OUTPUT GUARD
+            # then promotes truncated reasoning as the body, and evaluator
+            # callers get an unparseable verdict. Distinct mechanism, distinct
+            # value — assert it explicitly rather than the raw 512.
+            self.assertEqual(openai.get("max_tokens"), 8192)
         finally:
             setattr(proxy, "PROXY_MAX_TOKENS_FLOOR", old_floor)
             setattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS", old_disable)
@@ -170,30 +188,56 @@ class TestProfileSelection(unittest.TestCase):
         )
         self.assertIn(suffix, openai_body["messages"][0]["content"])
 
+    @staticmethod
+    def _grammar_body():
+        return {
+            "model": "default",
+            "max_tokens": 128,
+            "messages": [{"role": "user", "content": "run pwd"}],
+            "tools": [
+                {
+                    "name": "Bash",
+                    "description": "run command",
+                    "input_schema": {"type": "object"},
+                }
+            ],
+        }
+
     def test_build_request_uses_profile_grammar_override(self):
-        old_flag = getattr(proxy, "PROXY_TOOL_CALL_GRAMMAR")
-        setattr(proxy, "PROXY_TOOL_CALL_GRAMMAR", True)
-        try:
-            body = {
-                "model": "default",
-                "max_tokens": 128,
-                "messages": [{"role": "user", "content": "run pwd"}],
-                "tools": [
-                    {
-                        "name": "Bash",
-                        "description": "run command",
-                        "input_schema": {"type": "object"},
-                    }
-                ],
-            }
+        # PROXY_TOOL_CALL_GRAMMAR_REQUIRED_ONLY defaults to True and gates the
+        # whole grammar path on tool_choice == "required". It postdates this
+        # test, which is why the override looked broken: _apply_tool_call_grammar
+        # returned before ever consulting it. Relax the gate so this test covers
+        # what its name says — the override winning over the default GBNF — and
+        # let the test below cover the gate itself.
+        with unittest.mock.patch.object(proxy, "PROXY_TOOL_CALL_GRAMMAR", True), \
+                unittest.mock.patch.object(
+                    proxy, "PROXY_TOOL_CALL_GRAMMAR_REQUIRED_ONLY", False):
             openai_body = proxy.build_openai_request(
-                body,
+                self._grammar_body(),
                 proxy.SessionMonitor(context_window=0),
                 profile_grammar="grammar-test",
             )
-            self.assertEqual(openai_body.get("grammar"), "grammar-test")
-        finally:
-            setattr(proxy, "PROXY_TOOL_CALL_GRAMMAR", old_flag)
+        self.assertEqual(openai_body.get("grammar"), "grammar-test")
+
+    def test_required_only_gate_is_what_decides_whether_grammar_attaches(self):
+        # The gate that broke the test above is real behaviour and was untested.
+        # Assert it on the DISCRIMINATING axis — tool_choice — rather than only
+        # the negative case: a bare assertIsNone would also pass if the grammar
+        # flag were off, if tools were stripped, or if the _apply_tool_call_grammar
+        # call site were deleted outright, so it would prove nothing.
+        def grammar_for(tool_choice):
+            body = {"tools": [{"type": "function"}], "tool_choice": tool_choice}
+            with unittest.mock.patch.object(proxy, "PROXY_TOOL_CALL_GRAMMAR", True), \
+                    unittest.mock.patch.object(
+                        proxy, "PROXY_TOOL_CALL_GRAMMAR_REQUIRED_ONLY", True):
+                proxy._apply_tool_call_grammar(
+                    body, tool_choice=tool_choice, grammar_override="grammar-test"
+                )
+            return body.get("grammar")
+
+        self.assertEqual(grammar_for("required"), "grammar-test")
+        self.assertIsNone(grammar_for("auto"))
 
     def test_prune_target_fraction_uses_config_or_default(self):
         old_target = getattr(proxy, "PROXY_CONTEXT_PRUNE_TARGET_FRACTION")
@@ -408,7 +452,18 @@ class TestStreamGuardedPathSelection(unittest.TestCase):
 
 
 class TestMalformedToolGuardrail(unittest.TestCase):
-    def test_detects_malformed_tool_payload(self):
+    def test_tolerates_orphan_parameter_closer_after_a_valid_answer(self):
+        # Reversed deliberately on 2026-05-12 (_strip_orphan_tool_xml): an orphan
+        # closer with no opener is no longer treated as a malformed tool call,
+        # because Qwen3.6 leaks bare </parameter> training residue after a valid
+        # answer when forced into tool_choice='required' with nothing to call, and
+        # rejecting those cost ~11 false rejections in 40 min on a related branch.
+        #
+        # Be honest about the trade-off this pins: THIS payload is the model
+        # regurgitating its own tool schema twice, which is a plausible genuine
+        # failure. It survives only because the separator is '= {' rather than
+        # '=\n{' — one whitespace character flips the verdict. We accept that
+        # false negative to kill a much larger false-positive class.
         openai_resp = {
             "choices": [
                 {
@@ -427,9 +482,43 @@ class TestMalformedToolGuardrail(unittest.TestCase):
             "tools": [{"name": "Read", "input_schema": {"type": "object"}}],
             "messages": [{"role": "user", "content": "fix this"}],
         }
-        self.assertTrue(proxy._is_malformed_tool_response(openai_resp, anthropic_body))
+        self.assertFalse(proxy._is_malformed_tool_response(openai_resp, anthropic_body))
 
-    def test_detects_closing_function_tag_payload(self):
+    def test_still_detects_a_payload_that_retains_its_opener(self):
+        # The other half of the contract the strip promises: tolerating orphan
+        # closers must not blind the guardrail to a genuine malformed attempt,
+        # which keeps its opener. Without this, the test above alone would be
+        # satisfied by deleting the detector outright.
+        anthropic_body = {
+            "tools": [{"name": "Read", "input_schema": {"type": "object"}}],
+            "messages": [{"role": "user", "content": "fix this"}],
+        }
+        for payload in (
+            # The load-bearing case: an orphan closer AND a real opener in the
+            # same text. Only this one proves the strip removes the residue
+            # without also swallowing the genuine attempt beside it — the other
+            # payloads return early before _strip_orphan_tool_xml ever runs.
+            '</function> then <function=Bash><parameter name="c">ls</parameter></function>',
+            '<parameter name="cmd">ls</parameter>',
+            '<tool_call>{"name":"Read"}',
+            '<function=Bash>{"cmd":"ls"}',
+        ):
+            with self.subTest(payload=payload):
+                openai_resp = {
+                    "choices": [
+                        {
+                            "finish_reason": "stop",
+                            "message": {"content": payload, "tool_calls": []},
+                        }
+                    ]
+                }
+                self.assertTrue(
+                    proxy._is_malformed_tool_response(openai_resp, anthropic_body)
+                )
+
+    def test_tolerates_orphan_function_closer_after_a_valid_answer(self):
+        # Same 2026-05-12 reversal as the </parameter> case above: a trailing
+        # </function> with no opener is training residue, not a tool call.
         openai_resp = {
             "choices": [
                 {
@@ -449,7 +538,7 @@ class TestMalformedToolGuardrail(unittest.TestCase):
             "tools": [{"name": "Bash", "input_schema": {"type": "object"}}],
             "messages": [{"role": "user", "content": "list root docs/json files"}],
         }
-        self.assertTrue(proxy._is_malformed_tool_response(openai_resp, anthropic_body))
+        self.assertFalse(proxy._is_malformed_tool_response(openai_resp, anthropic_body))
 
     def test_detects_think_tag_with_repeated_policy_phrase(self):
         openai_resp = {
@@ -1840,7 +1929,14 @@ class TestTurnCountFinalizeBreaker(unittest.TestCase):
                 self._body(45), proxy.SessionMonitor(context_window=262144)
             )
             self.assertFalse(out.get("tools"))  # tools stripped
-            self.assertIn("STOP now", out["messages"][-1]["content"])
+            # The breaker's wording moved from a hard "STOP now" to a periodic
+            # progress checkpoint that explicitly resumes next turn. Assert the
+            # contract that survives rewording rather than the prose: the turn
+            # count is cited, and the model is told not to emit a tool call —
+            # which is the half that must agree with the stripped toolset.
+            nudge = out["messages"][-1]["content"]
+            self.assertIn("45", nudge)
+            self.assertRegex(nudge, r"(?i)do NOT emit any tool call|no tools are available")
         finally:
             setattr(proxy, "PROXY_HARD_FINALIZE_TURNS", old)
 
@@ -3643,8 +3739,9 @@ class TestDegenerateRepetitionDetection(unittest.TestCase):
         self.assertFalse(truncated)
         self.assertEqual(result["choices"][0]["message"]["content"], text)
 
-    def test_max_tokens_floor_skipped_for_non_tool_requests(self):
-        """max_tokens floor should not inflate non-tool requests."""
+    def test_non_tool_request_lands_below_the_big_floor(self):
+        """The 16384 floor is skipped for non-tool turns; the much smaller
+        THINKING_MIN_NO_TOOLS applies instead."""
         old_floor = getattr(proxy, "PROXY_MAX_TOKENS_FLOOR")
         old_disable = getattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS")
         try:
@@ -3656,11 +3753,17 @@ class TestDegenerateRepetitionDetection(unittest.TestCase):
                 "max_tokens": 100,
                 "messages": [{"role": "user", "content": "generate a title"}],
             }
-            openai = proxy.build_openai_request(
-                body, proxy.SessionMonitor(context_window=0)
-            )
-            # No tools = no floor inflation
-            self.assertEqual(openai.get("max_tokens"), 100)
+            with unittest.mock.patch.dict(
+                os.environ, {"PROXY_THINKING_MIN_NO_TOOLS": "8192"}
+            ):
+                openai = proxy.build_openai_request(
+                    body, proxy.SessionMonitor(context_window=0)
+                )
+            # No tools = the 16384 floor is skipped. The result is the much
+            # smaller THINKING_MIN_NO_TOOLS, not the raw 100: a 100-token
+            # no-tool budget is consumed entirely by Qwen's mandatory <think>,
+            # leaving nothing for the answer. Still well under the floor.
+            self.assertEqual(openai.get("max_tokens"), 8192)
         finally:
             setattr(proxy, "PROXY_MAX_TOKENS_FLOOR", old_floor)
             setattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS", old_disable)
@@ -3826,8 +3929,10 @@ class EmptyOutputGuardTest(unittest.TestCase):
         self.assertFalse(any(b.get("type") == "text" for b in out["content"]))
 
 
-if __name__ == "__main__":
-    unittest.main()
+# NB: the `unittest.main()` entrypoint is at the END of this file. It used to
+# sit here, above ~2200 further lines of TestCase classes, so running the file
+# directly exited after this point and silently skipped roughly 40% of the
+# module — including TestSendStreamWithRetry — while still printing OK.
 
 
 class TestCompletionContractGuardrails(unittest.TestCase):

package/tools/agents/tests/test_delivery_enforcement_all_langs.py

@@ -45,7 +45,13 @@ NOT_GATED = ["package.json", "config.yaml", "data.xml", "README.md", "notes.txt"
 
 def run(path, content="x" * 2000):
     e = {**os.environ, "UAP_ENFORCE_DELIVERY": "block", "UAP_INFERENCE_ENDPOINT": "http://172.17.0.1:8080/v1"}
-    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE", "UAP_DELIVER_LOCAL_ADVISORY"):
+    # ANTHROPIC_BASE_URL / OPENAI_BASE_URL must be stripped too: the enforcer
+    # downgrades block -> advisory for a local-model session, so a developer
+    # with a loopback base URL exported (the normal shape of a local session)
+    # sees every block-expecting test here allow instead. CI has them unset, so
+    # this is green in CI and red on the developer's machine.
+    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE",
+              "UAP_DELIVER_LOCAL_ADVISORY", "ANTHROPIC_BASE_URL", "OPENAI_BASE_URL"):
         e.pop(k, None)
     p = subprocess.run(
         [sys.executable, str(ENF), "--operation", "Write", "--args", json.dumps({"file_path": path, "content": content})],

package/tools/agents/tests/test_delivery_enforcement_exemptions.py

@@ -21,7 +21,13 @@ ENF = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "
 
 def run(path):
     e = {**os.environ, "UAP_ENFORCE_DELIVERY": "block", "UAP_INFERENCE_ENDPOINT": "http://172.17.0.1:8080/v1"}
-    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE", "UAP_DELIVER_LOCAL_ADVISORY"):
+    # ANTHROPIC_BASE_URL / OPENAI_BASE_URL must be stripped too: the enforcer
+    # downgrades block -> advisory for a local-model session, so a developer
+    # with a loopback base URL exported (the normal shape of a local session)
+    # sees every block-expecting test here allow instead. CI has them unset, so
+    # this is green in CI and red on the developer's machine.
+    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE",
+              "UAP_DELIVER_LOCAL_ADVISORY", "ANTHROPIC_BASE_URL", "OPENAI_BASE_URL"):
         e.pop(k, None)
     p = subprocess.run(
         [sys.executable, str(ENF), "--operation", "Write",

package/tools/agents/tests/test_delivery_enforcement_filepath.py

@@ -9,7 +9,13 @@ ENF = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "
 
 def run(args, env=None):
     e = {**os.environ, "UAP_ENFORCE_DELIVERY": "block", "UAP_INFERENCE_ENDPOINT": "http://172.17.0.1:8080/v1"}
-    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE", "UAP_DELIVER_LOCAL_ADVISORY"):
+    # ANTHROPIC_BASE_URL / OPENAI_BASE_URL must be stripped too: the enforcer
+    # downgrades block -> advisory for a local-model session, so a developer
+    # with a loopback base URL exported (the normal shape of a local session)
+    # sees every block-expecting test here allow instead. CI has them unset, so
+    # this is green in CI and red on the developer's machine.
+    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE",
+              "UAP_DELIVER_LOCAL_ADVISORY", "ANTHROPIC_BASE_URL", "OPENAI_BASE_URL"):
         e.pop(k, None)
     if env:
         e.update(env)

package/tools/agents/tests/test_delivery_enforcement_web_and_bash.py

@@ -17,7 +17,13 @@ ENF = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "
 
 def run(op, args, env=None):
     e = {**os.environ, "UAP_ENFORCE_DELIVERY": "block", "UAP_INFERENCE_ENDPOINT": "http://172.17.0.1:8080/v1"}
-    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE", "UAP_DELIVER_LOCAL_ADVISORY"):
+    # ANTHROPIC_BASE_URL / OPENAI_BASE_URL must be stripped too: the enforcer
+    # downgrades block -> advisory for a local-model session, so a developer
+    # with a loopback base URL exported (the normal shape of a local session)
+    # sees every block-expecting test here allow instead. CI has them unset, so
+    # this is green in CI and red on the developer's machine.
+    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE",
+              "UAP_DELIVER_LOCAL_ADVISORY", "ANTHROPIC_BASE_URL", "OPENAI_BASE_URL"):
         e.pop(k, None)
     if env:
         e.update(env)

package/tools/agents/tests/test_delivery_enforcement_worktree.py

@@ -24,8 +24,17 @@ def run(path, root, env_extra=None):
     env = dict(os.environ)
     env["UAP_REPO_ROOT"] = str(root)
     env["UAP_ENFORCE_DELIVERY"] = "block"
-    env.pop("UAP_DELIVER_ACTIVE", None)
-    env.pop("UAP_DELIVER_BYPASS", None)
+    # Every ambient input that can turn "block" into "allow" must be cleared,
+    # or these tests assert the developer's shell rather than the enforcer.
+    # ANTHROPIC_BASE_URL is the subtle one: delivery_enforcement downgrades
+    # block -> advisory for a local-model session, so with a loopback base URL
+    # exported (the normal shape of a local session here) the three
+    # block-expecting tests below flip to allowed. CI has it unset, so this
+    # fails only for developers — presenting as "behaviour drifted".
+    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS",
+              "UAP_DELIVER_LOCAL_MODE", "UAP_DELIVER_LOCAL_ADVISORY",
+              "ANTHROPIC_BASE_URL", "OPENAI_BASE_URL"):
+        env.pop(k, None)
     if env_extra:
         env.update(env_extra)
     p = subprocess.run(
@@ -82,8 +91,12 @@ class TestDeliveryEnforcementWorktree(unittest.TestCase):
         )
 
 
-if __name__ == "__main__":
-    unittest.main()
+# NB: the `unittest.main()` entrypoint lives at the END of this file, not here.
+# It used to sit at this point, above the two classes below, so running the file
+# directly (`python3 tools/agents/tests/test_delivery_enforcement_worktree.py`)
+# ran 7 tests and printed OK while `python -m unittest` ran 14 — the 7 it
+# skipped being exactly LocalAdvisoryTest + LocalModeTest. Anyone verifying a
+# change to those got a false green.
 
 
 import os as _os, subprocess as _sp, sys as _sys, json as _json, tempfile as _tf
@@ -96,7 +109,21 @@ class LocalAdvisoryTest(unittest.TestCase):
             root = _Path(td); (root/".git").mkdir()
             f = root/"src"/"a.ts"; f.parent.mkdir(parents=True); f.write_text("x")
             e = dict(_os.environ); e["UAP_REPO_ROOT"]=str(root)
-            for k in ("ANTHROPIC_BASE_URL","UAP_DELIVER_LOCAL_ADVISORY","UAP_DELIVER_ACTIVE"): e.pop(k, None)
+            # This test asserts the DEFAULT for a local session, so every input
+            # that overrides that default has to be cleared:
+            #  - UAP_DELIVER_BYPASS: run() already strips it. An agent shell
+            #    commonly exports it, the enforcer then allows every write, and
+            #    the block-expecting tests fail rc 0 != 2 — which reads as
+            #    "behaviour drifted" rather than "your env leaked".
+            #  - UAP_DELIVER_LOCAL_MODE: LocalModeTest._run already strips it;
+            #    omitting it here was an inconsistency. Importing the proxy
+            #    module (any test that does _load_proxy_module()) runs
+            #    _load_proxy_env_file(), which loads .uap/proxy.env into the
+            #    real os.environ — and that file sets UAP_DELIVER_LOCAL_MODE.
+            #    So this test's result depended on whether a proxy-importing
+            #    module ran before it in the same process.
+            for k in ("ANTHROPIC_BASE_URL","UAP_DELIVER_LOCAL_ADVISORY","UAP_DELIVER_ACTIVE",
+                      "UAP_DELIVER_BYPASS","UAP_DELIVER_LOCAL_MODE"): e.pop(k, None)
             e.update(extra_env)
             p = _sp.run([_sys.executable, str(_ENF), "--operation","Write","--args",_json.dumps({"file_path":str(f)})], capture_output=True, text=True, env=e)
             return p.returncode, _json.loads(p.stdout) if p.stdout.strip() else {}
@@ -120,7 +147,8 @@ class LocalModeTest(unittest.TestCase):
             root = _Path(td); (root/".git").mkdir()
             f = root/"src"/"a.ts"; f.parent.mkdir(parents=True); f.write_text("x")
             e = dict(_os.environ); e["UAP_REPO_ROOT"]=str(root)
-            for k in ("ANTHROPIC_BASE_URL","UAP_DELIVER_LOCAL_ADVISORY","UAP_DELIVER_LOCAL_MODE","UAP_DELIVER_ACTIVE"): e.pop(k, None)
+            # See the note in LocalAdvisoryTest._run — same ambient-bypass leak.
+            for k in ("ANTHROPIC_BASE_URL","UAP_DELIVER_LOCAL_ADVISORY","UAP_DELIVER_LOCAL_MODE","UAP_DELIVER_ACTIVE","UAP_DELIVER_BYPASS"): e.pop(k, None)
             e.update(env)
             p = _sp.run([_sys.executable, str(_ENF), "--operation","Write","--args",_json.dumps({"file_path":str(f)})], capture_output=True, text=True, env=e)
             return p.returncode, _json.loads(p.stdout) if p.stdout.strip() else {}
@@ -141,3 +169,7 @@ class LocalModeTest(unittest.TestCase):
     def test_default_is_advisory(self):
         rc, out = self._run({"ANTHROPIC_BASE_URL":"http://127.0.0.1:4000"})
         self.assertEqual(rc, 0)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_enforcer_suite_coverage.py

@@ -28,8 +28,19 @@ TESTS = Path(__file__).resolve().parent
 # Verified failing for their own pre-existing reasons, not by omission. Each
 # entry is a debt with a stated cause — not a place to park a newly broken test.
 KNOWN_EXCLUDED = {
-    "test_anthropic_proxy_streaming": "behaviour drifted from the assertions",
-    "test_delivery_enforcement_worktree": "behaviour drifted from the assertions",
+    # test_anthropic_proxy_streaming and test_delivery_enforcement_worktree
+    # were both listed here as "behaviour drifted from the assertions" and are
+    # now listed in test:enforcers instead:
+    #   - proxy_streaming had 7 genuinely stale assertions (max_tokens floors
+    #     superseded by the thinking-floor, a grammar guard that postdated the
+    #     test, the turn-count breaker's rewording, and two malformed-payload
+    #     cases deliberately reversed by _strip_orphan_tool_xml). All rewritten
+    #     against current intent. This is the module that covers the streaming
+    #     503 retry, so it was the gap that let that bug ship.
+    #   - delivery_enforcement_worktree never drifted at all: two of its env
+    #     helpers failed to strip an ambient UAP_DELIVER_BYPASS, so the
+    #     enforcer allowed every write and four block-expecting tests read 0
+    #     instead of 2. It passes clean; the helpers are now hermetic.
     "test_uap_compliance": "needs a populated DB; environment-bound",
 }
 
@@ -87,5 +98,50 @@ class TestEveryListedModuleActuallyCollects(unittest.TestCase):
         assert ghosts == set(), f"test:enforcers names modules that do not exist: {sorted(ghosts)}"
 
 
+class TestTheGateCollectsWhatItClaims(unittest.TestCase):
+    """Every check above is structural — none pins how many tests actually run.
+
+    A listed module can define a TestCase and still contribute almost nothing.
+    Two real instances: a mid-file `unittest.main()` in
+    test_anthropic_proxy_streaming and test_delivery_enforcement_worktree cut
+    direct runs off partway through the file (273 -> 168 and 14 -> 7) while
+    still printing OK; and a mass deletion inside any listed module is invisible
+    to the listing checks. A floor on the collected count catches both.
+    """
+
+    # Deliberately below the current count so ordinary churn doesn't trip it.
+    # Raise it when the suite grows substantially; never lower it to make a
+    # failing gate pass — that is the deletion this test exists to catch.
+    MINIMUM_COLLECTED = 750
+
+    def test_listed_modules_collect_at_least_the_expected_test_count(self):
+        loader = unittest.TestLoader()
+        suite = loader.loadTestsFromNames(
+            [f"tools.agents.tests.{m}" for m in sorted(_listed_modules())]
+        )
+        # loadTestsFromNames turns an import failure into a _FailedTest that
+        # still counts, so surface those rather than let them pad the total.
+        broken = [
+            str(t) for t in _flatten(suite)
+            if type(t).__name__ == "_FailedTest"
+        ]
+        assert broken == [], f"listed modules that fail to even import: {broken}"
+
+        count = suite.countTestCases()
+        assert count >= self.MINIMUM_COLLECTED, (
+            f"the gate collects {count} tests, below the {self.MINIMUM_COLLECTED} floor. "
+            "Tests were deleted, a module stopped collecting, or an entrypoint "
+            "truncates the file. Investigate before adjusting this number."
+        )
+
+
+def _flatten(suite):
+    for item in suite:
+        if isinstance(item, unittest.TestSuite):
+            yield from _flatten(item)
+        else:
+            yield item
+
+
 if __name__ == "__main__":
     unittest.main()