@miller-tech/uap 1.179.5 → 1.179.7

package/docs/guides/PROXY.md

@@ -117,7 +117,23 @@ token is not echoed into the ride-along log. Binding beyond loopback
 `uap-anthropic-proxy.service`, reading its environment from
 `~/.config/uap/anthropic-proxy.env`; a plain spawned proxy seeds the same file
 for parity. The proxy also loads project-local `.uap/proxy.env` at startup
-(real environment always wins). PID reuse is defended with a `/proc/<pid>`
+(real environment always wins). That search walks up from the working
+directory and **stops at the repository root**, so a checkout nested inside an
+unrelated checkout no longer inherits the outer repo's `PROXY_AUTH_TOKEN`; a
+git *worktree* is the same repository, so its `.git` pointer is followed back
+to the main checkout rather than terminating the search. If nothing is found
+under the repo, `$XDG_CONFIG_HOME/uap/proxy.env` and `~/.uap/proxy.env` are
+tried, matching the client-side resolver. The proxy logs which file it loaded
+(or that it found none) plus its auth state at startup, so a discovery miss is
+visible rather than silently degrading to defaults.
+
+| Env (default) | Behavior |
+|---|---|
+| `UAP_PROXY_ENV_FILE` (unset) | Explicit path to a proxy.env, tried before the walk |
+| `UAP_PROXY_ENV_AUTOLOAD` (**on**) | Set to `0` to make *importing* the proxy module inert — it then mutates no process environment. Used by the Python test suite so tests assert shipped defaults rather than the developer's config. Does not affect a server run |
+| `PROXY_ALLOW_UNAUTHENTICATED_BIND` (**off**) | The proxy **refuses to start** on a non-loopback `PROXY_HOST` when `PROXY_AUTH_TOKEN` is empty, because the auth middleware treats an empty token as "no auth configured" and would leave every route open on the LAN. Set to `1` only if an open listener is genuinely intended |
+
+PID reuse is defended with a `/proc/<pid>`
 start-time token so `release` never kills an unrelated process that inherited an
 old pid. Everything hook-driven **fails open** — if the proxy won't start, the
 agent just runs without it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.179.5",
+  "version": "1.179.7",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project",
+    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_delivery_enforcement_worktree",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",

package/tools/agents/scripts/anthropic_proxy.py

@@ -109,21 +109,92 @@ from fastapi.responses import StreamingResponse
 import uvicorn
 
 
+# Path of the .uap/proxy.env actually loaded, or "" if none was found. Reported
+# at startup so a silent discovery miss is visible in the journal.
+_PROXY_ENV_FILE_LOADED = ""
+
+
+def _git_common_root(gitfile: Path) -> "Path | None":
+    """Resolve a worktree/submodule `.git` FILE to its main checkout root.
+
+    A worktree's .git is a file containing `gitdir: <main>/.git/worktrees/<n>`.
+    It names the SAME repository — same object store, same operator, same trust
+    domain — so config discovery must follow it home rather than treat the
+    worktree as a foreign tree. Returns None if the file isn't a gitdir pointer.
+    """
+    try:
+        text = gitfile.read_text(errors="ignore").strip()
+    except OSError:
+        return None
+    if not text.startswith("gitdir:"):
+        return None
+    target = Path(text.split(":", 1)[1].strip())
+    if not target.is_absolute():
+        target = (gitfile.parent / target)
+    try:
+        target = target.resolve()
+    except OSError:
+        return None
+    for parent in [target, *target.parents]:
+        if parent.name == ".git":
+            return parent.parent
+    return None
+
+
 def _load_proxy_env_file() -> None:
     """Load .uap/proxy.env (KEY=VALUE) written by `uap setup` into os.environ so
     recipe / escalation / delivery selections reach the proxy without the user
     hand-exporting env. Existing process env ALWAYS wins (setdefault). Walks up
-    from CWD to the filesystem root looking for a .uap/proxy.env; override the
-    path with UAP_PROXY_ENV_FILE. Runs before the import-time env reads below.
-    Fails open."""
+    from CWD looking for a .uap/proxy.env, stopping at the repository root;
+    override the path with UAP_PROXY_ENV_FILE. Runs before the import-time env
+    reads below. Fails open."""
     try:
         candidates = []
         explicit = os.environ.get("UAP_PROXY_ENV_FILE")
         if explicit:
             candidates.append(Path(explicit))
         d = Path.cwd()
+        try:
+            home = Path.home()
+        except Exception:
+            home = None
         for base in [d, *d.parents]:
             candidates.append(base / ".uap" / "proxy.env")
+            git = base / ".git"
+            # A real repository root: stop. The walk used to climb to the
+            # FILESYSTEM root, so a checkout nested under another repo silently
+            # loaded the outer repo's proxy.env — PROXY_AUTH_TOKEN included.
+            if git.is_dir():
+                break
+            # A worktree or submodule: its .git is a FILE naming the SAME
+            # repository. Same object store, same operator, same trust domain —
+            # so follow it to the main checkout instead of stopping. Stopping
+            # here would be worse than the leak: a worktree gets no .uap/ of its
+            # own, so the proxy would start with an EMPTY PROXY_AUTH_TOKEN, and
+            # the auth middleware treats empty as "no auth configured" rather
+            # than "misconfigured". Since PROXY_HOST=0.0.0.0 arrives from a
+            # different file that this walk never touched, that combination is
+            # an unauthenticated listener on the LAN.
+            if git.is_file():
+                main_root = _git_common_root(git)
+                if main_root is not None:
+                    candidates.append(main_root / ".uap" / "proxy.env")
+                break
+            # Never climb above the user's home. With no repository anywhere
+            # above cwd the walk would otherwise reach "/", where a
+            # world-writable /tmp/.uap/proxy.env would be loaded unconditionally.
+            if home is not None and base == home:
+                break
+        # Machine-wide fallbacks, mirroring the TypeScript reader in
+        # src/models/openai-compat-client.ts. Without these the two halves
+        # disagree about where the token lives: the client finds one and sends
+        # it while the server has none and skips the check.
+        xdg = os.environ.get("XDG_CONFIG_HOME")
+        if xdg:
+            candidates.append(Path(xdg) / "uap" / "proxy.env")
+        if home is not None:
+            candidates.append(home / ".config" / "uap" / "proxy.env")
+            candidates.append(home / ".uap" / "proxy.env")
         for path in candidates:
             try:
                 if not path.is_file():
@@ -139,12 +210,36 @@ def _load_proxy_env_file() -> None:
                 val = val.strip().strip('"').strip("'")
                 if key:
                     os.environ.setdefault(key, val)
+            global _PROXY_ENV_FILE_LOADED
+            _PROXY_ENV_FILE_LOADED = str(path)
             break  # first file found wins
     except Exception:
         pass
 
 
-_load_proxy_env_file()
+def _proxy_env_autoload_enabled() -> bool:
+    """Whether importing this module may mutate the process environment.
+
+    On by default: the module-level constants below read os.environ at import,
+    so a server run needs the file loaded first. But `import anthropic_proxy`
+    is not always a server run — the test suite imports it ~6 times, and each
+    import used to setdefault the whole of .uap/proxy.env into the real
+    os.environ. Every enforcer subprocess spawned afterwards inherited it, so
+    tests asserted the developer's proxy config instead of the shipped
+    defaults, and the outcome depended on module order. Set
+    UAP_PROXY_ENV_AUTOLOAD=0 to import the module inertly; callers that want
+    the file can still invoke _load_proxy_env_file() explicitly.
+    """
+    return os.environ.get("UAP_PROXY_ENV_AUTOLOAD", "1").strip().lower() not in {
+        "0",
+        "off",
+        "false",
+        "no",
+    }
+
+
+if _proxy_env_autoload_enabled():
+    _load_proxy_env_file()
 
 # ---------------------------------------------------------------------------
 # Configuration (all configurable via environment variables)
@@ -12588,7 +12683,58 @@ async def context_status(request: Request):
 # Entry Point
 # ===========================================================================
 
+_LOOPBACK_HOSTS = {"127.0.0.1", "::1", "localhost", ""}
+
+
+def _assert_bind_is_authenticated(host: str, token: str) -> None:
+    """Refuse to expose an unauthenticated proxy beyond loopback.
+
+    The auth middleware is a no-op when PROXY_AUTH_TOKEN is empty — it reads
+    "no auth configured", not "misconfigured". The token arrives from
+    .uap/proxy.env while PROXY_HOST commonly arrives from the systemd
+    EnvironmentFile, so any failure to locate the former leaves the latter
+    intact: bind-all survives, require-a-credential does not. That asymmetry
+    turns a silent config miss into an open LLM proxy on the LAN, fronting both
+    the local model and cloud passthrough on the operator's credentials.
+
+    Fail closed instead. Set PROXY_ALLOW_UNAUTHENTICATED_BIND=1 to override
+    when an open listener is genuinely intended.
+    """
+    if host in _LOOPBACK_HOSTS or token:
+        return
+    if os.environ.get("PROXY_ALLOW_UNAUTHENTICATED_BIND", "").strip().lower() in {
+        "1",
+        "on",
+        "true",
+        "yes",
+    }:
+        logger.warning(
+            "PROXY AUTH DISABLED on a non-loopback bind (%s) — allowed only "
+            "because PROXY_ALLOW_UNAUTHENTICATED_BIND is set.",
+            host,
+        )
+        return
+    raise SystemExit(
+        f"refusing to bind {host} with no PROXY_AUTH_TOKEN: every route would be "
+        f"unauthenticated. The token normally comes from .uap/proxy.env — if the "
+        f"proxy cannot find that file, config discovery is broken rather than the "
+        f"token being genuinely unset. Set PROXY_AUTH_TOKEN, bind 127.0.0.1, or "
+        f"set PROXY_ALLOW_UNAUTHENTICATED_BIND=1 if an open listener is intended."
+    )
+
+
 if __name__ == "__main__":
+    # Config discovery is silent by design (it fails open so a missing file can
+    # never stop the proxy). Say what it found, so a miss is visible in the
+    # journal instead of showing up later as unexplained default behaviour.
+    logger.info(
+        "proxy env: %s | auth=%s | bind=%s:%d",
+        f"loaded {_PROXY_ENV_FILE_LOADED}" if _PROXY_ENV_FILE_LOADED else "no proxy.env found",
+        "enabled" if PROXY_AUTH_TOKEN else "DISABLED",
+        PROXY_HOST,
+        PROXY_PORT,
+    )
+    _assert_bind_is_authenticated(PROXY_HOST, PROXY_AUTH_TOKEN)
     uvicorn.run(
         app,
         host=PROXY_HOST,

package/tools/agents/tests/__init__.py

@@ -0,0 +1,27 @@
+"""Test package init — keeps importing the proxy from mutating this process.
+
+`anthropic_proxy` loads `.uap/proxy.env` into the real `os.environ` at import.
+That is right for a server run and wrong for a test run: it makes tests assert
+the developer's proxy config instead of the shipped defaults, and it leaks
+UAP_DELIVER_* settings into every enforcer subprocess the suite spawns, so
+results depend on module import order.
+
+Setting the opt-out here rather than only in `conftest.py` covers every entry
+path, because all of them import this package first:
+
+  - `python -m unittest tools.agents.tests.test_x`   (what CI runs)
+  - `python -m unittest discover -s tools/agents/tests`
+  - `loadTestsFromNames(...)` in test_enforcer_suite_coverage
+  - pytest (which also reads conftest.py)
+
+`python3 tools/agents/tests/test_x.py` — running a file directly by path — is
+the one shape that does NOT import the package, which is why conftest.py and
+the `test:enforcers` script both still set it too.
+
+`setdefault`, so an explicit `UAP_PROXY_ENV_AUTOLOAD=1` in the environment
+still wins for anyone who deliberately wants the real file loaded.
+"""
+
+import os
+
+os.environ.setdefault("UAP_PROXY_ENV_AUTOLOAD", "0")

package/tools/agents/tests/conftest.py

@@ -0,0 +1,27 @@
+"""Keep importing the proxy from mutating the test process's environment.
+
+`anthropic_proxy` loads `.uap/proxy.env` into the real `os.environ` at import
+so a server run gets the operator's recipe/delivery/auth settings without
+hand-exported env. Under test that is a liability, and it produced two real
+failures:
+
+1. Tests that assert shipped defaults (timeouts, retry budgets) instead
+   asserted whatever the developer's `.uap/proxy.env` happened to contain —
+   green in CI, red locally, for no code reason.
+2. `UAP_DELIVER_LOCAL_MODE` from that file reached every enforcer subprocess
+   the suite spawns, so `test_delivery_enforcement_worktree` passed or failed
+   depending on whether a proxy-importing module had run before it.
+
+Setting the opt-out here covers every pytest run from one place instead of
+each module defending itself. `npm run test:enforcers` sets the same variable
+for the unittest path, which does not read conftest.py.
+
+This must run before any test module imports the proxy — conftest is imported
+at collection time, ahead of the test modules, which is exactly that point.
+Tests that specifically exercise the loader call `_load_proxy_env_file()`
+directly and are unaffected.
+"""
+
+import os
+
+os.environ.setdefault("UAP_PROXY_ENV_AUTOLOAD", "0")

package/tools/agents/tests/test_anthropic_proxy_streaming.py

@@ -3,6 +3,7 @@
 import asyncio
 import importlib.util
 import json
+import os
 import unittest
 import unittest.mock
 from pathlib import Path
@@ -91,36 +92,44 @@ class TestProxyConfigTuning(unittest.TestCase):
         finally:
             setattr(proxy, "PROXY_MAX_TOKENS_FLOOR", old_floor)
 
-    def test_build_request_bypasses_floor_for_tool_turns_when_thinking_disabled(self):
-        old_floor = getattr(proxy, "PROXY_MAX_TOKENS_FLOOR")
-        old_disable = getattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS")
-        try:
-            setattr(proxy, "PROXY_MAX_TOKENS_FLOOR", 4096)
-            setattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS", True)
-
-            body = {
-                "model": "test",
-                "max_tokens": 512,
-                "messages": [{"role": "user", "content": "run pwd"}],
-                "tools": [
+    def test_thinking_disabled_flag_no_longer_changes_the_tool_turn_budget(self):
+        # This test used to assert 512 while toggling
+        # PROXY_DISABLE_THINKING_ON_TOOL_TURNS. That gating was deliberately
+        # removed — it skipped the floor on every tool turn once thinking was
+        # off, which re-introduced truncated tool calls on long edits — and the
+        # flag now only feeds a log line. Asserting the post-removal number
+        # alone would just duplicate test_max_tokens_floor_bypassed_for_small_
+        # preflight, so pin the removal itself: the flag must not move the
+        # budget in either position. 512 lands on THINKING_MIN_FOR_TOOLS (2048)
+        # because Qwen emits <think> regardless of the flag, and on a tool turn
+        # those blocks alone eat ~400-1000 tokens, leaving nothing for the
+        # tool_call (observed live as ~5 required_tool_miss retries per turn).
+        def budget(disable_thinking):
+            with unittest.mock.patch.object(proxy, "PROXY_MAX_TOKENS_FLOOR", 4096), \
+                    unittest.mock.patch.object(
+                        proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS", disable_thinking):
+                return proxy.build_openai_request(
                     {
-                        "name": "Bash",
-                        "description": "run command",
-                        "input_schema": {"type": "object"},
-                    }
-                ],
-            }
+                        "model": "test",
+                        "max_tokens": 512,
+                        "messages": [{"role": "user", "content": "run pwd"}],
+                        "tools": [
+                            {
+                                "name": "Bash",
+                                "description": "run command",
+                                "input_schema": {"type": "object"},
+                            }
+                        ],
+                    },
+                    proxy.SessionMonitor(context_window=0),
+                ).get("max_tokens")
 
-            openai = proxy.build_openai_request(
-                body, proxy.SessionMonitor(context_window=0)
-            )
-            self.assertEqual(openai.get("max_tokens"), 512)
-        finally:
-            setattr(proxy, "PROXY_MAX_TOKENS_FLOOR", old_floor)
-            setattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS", old_disable)
+        self.assertEqual(budget(True), budget(False), "flag must no longer gate the floor")
+        self.assertEqual(budget(True), 2048)
 
-    def test_build_request_skips_floor_for_non_tool_turns(self):
-        """Non-tool requests should NOT have the max_tokens floor applied."""
+    def test_non_tool_turn_takes_thinking_floor_not_the_big_floor(self):
+        """Non-tool requests skip PROXY_MAX_TOKENS_FLOOR and land on
+        THINKING_MIN_NO_TOOLS instead — a different, larger mechanism."""
         old_floor = getattr(proxy, "PROXY_MAX_TOKENS_FLOOR")
         old_disable = getattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS")
         try:
@@ -133,11 +142,20 @@ class TestProxyConfigTuning(unittest.TestCase):
                 "messages": [{"role": "user", "content": "say ok"}],
             }
 
-            openai = proxy.build_openai_request(
-                body, proxy.SessionMonitor(context_window=0)
-            )
-            # Floor should NOT inflate max_tokens for non-tool requests
-            self.assertEqual(openai.get("max_tokens"), 512)
+            with unittest.mock.patch.dict(
+                os.environ, {"PROXY_THINKING_MIN_NO_TOOLS": "8192"}
+            ):
+                openai = proxy.build_openai_request(
+                    body, proxy.SessionMonitor(context_window=0)
+                )
+            # The big PROXY_MAX_TOKENS_FLOOR (4096) is still skipped for
+            # non-tool turns — that is what this test guards. What the request
+            # lands on instead is THINKING_MIN_NO_TOOLS: Qwen spends small
+            # no-tool budgets entirely inside <think>, the EMPTY-OUTPUT GUARD
+            # then promotes truncated reasoning as the body, and evaluator
+            # callers get an unparseable verdict. Distinct mechanism, distinct
+            # value — assert it explicitly rather than the raw 512.
+            self.assertEqual(openai.get("max_tokens"), 8192)
         finally:
             setattr(proxy, "PROXY_MAX_TOKENS_FLOOR", old_floor)
             setattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS", old_disable)
@@ -170,30 +188,56 @@ class TestProfileSelection(unittest.TestCase):
         )
         self.assertIn(suffix, openai_body["messages"][0]["content"])
 
+    @staticmethod
+    def _grammar_body():
+        return {
+            "model": "default",
+            "max_tokens": 128,
+            "messages": [{"role": "user", "content": "run pwd"}],
+            "tools": [
+                {
+                    "name": "Bash",
+                    "description": "run command",
+                    "input_schema": {"type": "object"},
+                }
+            ],
+        }
+
     def test_build_request_uses_profile_grammar_override(self):
-        old_flag = getattr(proxy, "PROXY_TOOL_CALL_GRAMMAR")
-        setattr(proxy, "PROXY_TOOL_CALL_GRAMMAR", True)
-        try:
-            body = {
-                "model": "default",
-                "max_tokens": 128,
-                "messages": [{"role": "user", "content": "run pwd"}],
-                "tools": [
-                    {
-                        "name": "Bash",
-                        "description": "run command",
-                        "input_schema": {"type": "object"},
-                    }
-                ],
-            }
+        # PROXY_TOOL_CALL_GRAMMAR_REQUIRED_ONLY defaults to True and gates the
+        # whole grammar path on tool_choice == "required". It postdates this
+        # test, which is why the override looked broken: _apply_tool_call_grammar
+        # returned before ever consulting it. Relax the gate so this test covers
+        # what its name says — the override winning over the default GBNF — and
+        # let the test below cover the gate itself.
+        with unittest.mock.patch.object(proxy, "PROXY_TOOL_CALL_GRAMMAR", True), \
+                unittest.mock.patch.object(
+                    proxy, "PROXY_TOOL_CALL_GRAMMAR_REQUIRED_ONLY", False):
             openai_body = proxy.build_openai_request(
-                body,
+                self._grammar_body(),
                 proxy.SessionMonitor(context_window=0),
                 profile_grammar="grammar-test",
             )
-            self.assertEqual(openai_body.get("grammar"), "grammar-test")
-        finally:
-            setattr(proxy, "PROXY_TOOL_CALL_GRAMMAR", old_flag)
+        self.assertEqual(openai_body.get("grammar"), "grammar-test")
+
+    def test_required_only_gate_is_what_decides_whether_grammar_attaches(self):
+        # The gate that broke the test above is real behaviour and was untested.
+        # Assert it on the DISCRIMINATING axis — tool_choice — rather than only
+        # the negative case: a bare assertIsNone would also pass if the grammar
+        # flag were off, if tools were stripped, or if the _apply_tool_call_grammar
+        # call site were deleted outright, so it would prove nothing.
+        def grammar_for(tool_choice):
+            body = {"tools": [{"type": "function"}], "tool_choice": tool_choice}
+            with unittest.mock.patch.object(proxy, "PROXY_TOOL_CALL_GRAMMAR", True), \
+                    unittest.mock.patch.object(
+                        proxy, "PROXY_TOOL_CALL_GRAMMAR_REQUIRED_ONLY", True):
+                proxy._apply_tool_call_grammar(
+                    body, tool_choice=tool_choice, grammar_override="grammar-test"
+                )
+            return body.get("grammar")
+
+        self.assertEqual(grammar_for("required"), "grammar-test")
+        self.assertIsNone(grammar_for("auto"))
 
     def test_prune_target_fraction_uses_config_or_default(self):
         old_target = getattr(proxy, "PROXY_CONTEXT_PRUNE_TARGET_FRACTION")
@@ -408,7 +452,18 @@ class TestStreamGuardedPathSelection(unittest.TestCase):
 
 
 class TestMalformedToolGuardrail(unittest.TestCase):
-    def test_detects_malformed_tool_payload(self):
+    def test_tolerates_orphan_parameter_closer_after_a_valid_answer(self):
+        # Reversed deliberately on 2026-05-12 (_strip_orphan_tool_xml): an orphan
+        # closer with no opener is no longer treated as a malformed tool call,
+        # because Qwen3.6 leaks bare </parameter> training residue after a valid
+        # answer when forced into tool_choice='required' with nothing to call, and
+        # rejecting those cost ~11 false rejections in 40 min on a related branch.
+        #
+        # Be honest about the trade-off this pins: THIS payload is the model
+        # regurgitating its own tool schema twice, which is a plausible genuine
+        # failure. It survives only because the separator is '= {' rather than
+        # '=\n{' — one whitespace character flips the verdict. We accept that
+        # false negative to kill a much larger false-positive class.
         openai_resp = {
             "choices": [
                 {
@@ -427,9 +482,43 @@ class TestMalformedToolGuardrail(unittest.TestCase):
             "tools": [{"name": "Read", "input_schema": {"type": "object"}}],
             "messages": [{"role": "user", "content": "fix this"}],
         }
-        self.assertTrue(proxy._is_malformed_tool_response(openai_resp, anthropic_body))
+        self.assertFalse(proxy._is_malformed_tool_response(openai_resp, anthropic_body))
 
-    def test_detects_closing_function_tag_payload(self):
+    def test_still_detects_a_payload_that_retains_its_opener(self):
+        # The other half of the contract the strip promises: tolerating orphan
+        # closers must not blind the guardrail to a genuine malformed attempt,
+        # which keeps its opener. Without this, the test above alone would be
+        # satisfied by deleting the detector outright.
+        anthropic_body = {
+            "tools": [{"name": "Read", "input_schema": {"type": "object"}}],
+            "messages": [{"role": "user", "content": "fix this"}],
+        }
+        for payload in (
+            # The load-bearing case: an orphan closer AND a real opener in the
+            # same text. Only this one proves the strip removes the residue
+            # without also swallowing the genuine attempt beside it — the other
+            # payloads return early before _strip_orphan_tool_xml ever runs.
+            '</function> then <function=Bash><parameter name="c">ls</parameter></function>',
+            '<parameter name="cmd">ls</parameter>',
+            '<tool_call>{"name":"Read"}',
+            '<function=Bash>{"cmd":"ls"}',
+        ):
+            with self.subTest(payload=payload):
+                openai_resp = {
+                    "choices": [
+                        {
+                            "finish_reason": "stop",
+                            "message": {"content": payload, "tool_calls": []},
+                        }
+                    ]
+                }
+                self.assertTrue(
+                    proxy._is_malformed_tool_response(openai_resp, anthropic_body)
+                )
+
+    def test_tolerates_orphan_function_closer_after_a_valid_answer(self):
+        # Same 2026-05-12 reversal as the </parameter> case above: a trailing
+        # </function> with no opener is training residue, not a tool call.
         openai_resp = {
             "choices": [
                 {
@@ -449,7 +538,7 @@ class TestMalformedToolGuardrail(unittest.TestCase):
             "tools": [{"name": "Bash", "input_schema": {"type": "object"}}],
             "messages": [{"role": "user", "content": "list root docs/json files"}],
         }
-        self.assertTrue(proxy._is_malformed_tool_response(openai_resp, anthropic_body))
+        self.assertFalse(proxy._is_malformed_tool_response(openai_resp, anthropic_body))
 
     def test_detects_think_tag_with_repeated_policy_phrase(self):
         openai_resp = {
@@ -1840,7 +1929,14 @@ class TestTurnCountFinalizeBreaker(unittest.TestCase):
                 self._body(45), proxy.SessionMonitor(context_window=262144)
             )
             self.assertFalse(out.get("tools"))  # tools stripped
-            self.assertIn("STOP now", out["messages"][-1]["content"])
+            # The breaker's wording moved from a hard "STOP now" to a periodic
+            # progress checkpoint that explicitly resumes next turn. Assert the
+            # contract that survives rewording rather than the prose: the turn
+            # count is cited, and the model is told not to emit a tool call —
+            # which is the half that must agree with the stripped toolset.
+            nudge = out["messages"][-1]["content"]
+            self.assertIn("45", nudge)
+            self.assertRegex(nudge, r"(?i)do NOT emit any tool call|no tools are available")
         finally:
             setattr(proxy, "PROXY_HARD_FINALIZE_TURNS", old)
 
@@ -3643,8 +3739,9 @@ class TestDegenerateRepetitionDetection(unittest.TestCase):
         self.assertFalse(truncated)
         self.assertEqual(result["choices"][0]["message"]["content"], text)
 
-    def test_max_tokens_floor_skipped_for_non_tool_requests(self):
-        """max_tokens floor should not inflate non-tool requests."""
+    def test_non_tool_request_lands_below_the_big_floor(self):
+        """The 16384 floor is skipped for non-tool turns; the much smaller
+        THINKING_MIN_NO_TOOLS applies instead."""
         old_floor = getattr(proxy, "PROXY_MAX_TOKENS_FLOOR")
         old_disable = getattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS")
         try:
@@ -3656,11 +3753,17 @@ class TestDegenerateRepetitionDetection(unittest.TestCase):
                 "max_tokens": 100,
                 "messages": [{"role": "user", "content": "generate a title"}],
             }
-            openai = proxy.build_openai_request(
-                body, proxy.SessionMonitor(context_window=0)
-            )
-            # No tools = no floor inflation
-            self.assertEqual(openai.get("max_tokens"), 100)
+            with unittest.mock.patch.dict(
+                os.environ, {"PROXY_THINKING_MIN_NO_TOOLS": "8192"}
+            ):
+                openai = proxy.build_openai_request(
+                    body, proxy.SessionMonitor(context_window=0)
+                )
+            # No tools = the 16384 floor is skipped. The result is the much
+            # smaller THINKING_MIN_NO_TOOLS, not the raw 100: a 100-token
+            # no-tool budget is consumed entirely by Qwen's mandatory <think>,
+            # leaving nothing for the answer. Still well under the floor.
+            self.assertEqual(openai.get("max_tokens"), 8192)
         finally:
             setattr(proxy, "PROXY_MAX_TOKENS_FLOOR", old_floor)
             setattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS", old_disable)
@@ -3826,8 +3929,10 @@ class EmptyOutputGuardTest(unittest.TestCase):
         self.assertFalse(any(b.get("type") == "text" for b in out["content"]))
 
 
-if __name__ == "__main__":
-    unittest.main()
+# NB: the `unittest.main()` entrypoint is at the END of this file. It used to
+# sit here, above ~2200 further lines of TestCase classes, so running the file
+# directly exited after this point and silently skipped roughly 40% of the
+# module — including TestSendStreamWithRetry — while still printing OK.
 
 
 class TestCompletionContractGuardrails(unittest.TestCase):

package/tools/agents/tests/test_delivery_enforcement_all_langs.py

@@ -45,7 +45,13 @@ NOT_GATED = ["package.json", "config.yaml", "data.xml", "README.md", "notes.txt"
 
 def run(path, content="x" * 2000):
     e = {**os.environ, "UAP_ENFORCE_DELIVERY": "block", "UAP_INFERENCE_ENDPOINT": "http://172.17.0.1:8080/v1"}
-    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE", "UAP_DELIVER_LOCAL_ADVISORY"):
+    # ANTHROPIC_BASE_URL / OPENAI_BASE_URL must be stripped too: the enforcer
+    # downgrades block -> advisory for a local-model session, so a developer
+    # with a loopback base URL exported (the normal shape of a local session)
+    # sees every block-expecting test here allow instead. CI has them unset, so
+    # this is green in CI and red on the developer's machine.
+    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE",
+              "UAP_DELIVER_LOCAL_ADVISORY", "ANTHROPIC_BASE_URL", "OPENAI_BASE_URL"):
         e.pop(k, None)
     p = subprocess.run(
         [sys.executable, str(ENF), "--operation", "Write", "--args", json.dumps({"file_path": path, "content": content})],

package/tools/agents/tests/test_delivery_enforcement_exemptions.py

@@ -21,7 +21,13 @@ ENF = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "
 
 def run(path):
     e = {**os.environ, "UAP_ENFORCE_DELIVERY": "block", "UAP_INFERENCE_ENDPOINT": "http://172.17.0.1:8080/v1"}
-    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE", "UAP_DELIVER_LOCAL_ADVISORY"):
+    # ANTHROPIC_BASE_URL / OPENAI_BASE_URL must be stripped too: the enforcer
+    # downgrades block -> advisory for a local-model session, so a developer
+    # with a loopback base URL exported (the normal shape of a local session)
+    # sees every block-expecting test here allow instead. CI has them unset, so
+    # this is green in CI and red on the developer's machine.
+    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE",
+              "UAP_DELIVER_LOCAL_ADVISORY", "ANTHROPIC_BASE_URL", "OPENAI_BASE_URL"):
         e.pop(k, None)
     p = subprocess.run(
         [sys.executable, str(ENF), "--operation", "Write",

package/tools/agents/tests/test_delivery_enforcement_filepath.py

@@ -9,7 +9,13 @@ ENF = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "
 
 def run(args, env=None):
     e = {**os.environ, "UAP_ENFORCE_DELIVERY": "block", "UAP_INFERENCE_ENDPOINT": "http://172.17.0.1:8080/v1"}
-    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE", "UAP_DELIVER_LOCAL_ADVISORY"):
+    # ANTHROPIC_BASE_URL / OPENAI_BASE_URL must be stripped too: the enforcer
+    # downgrades block -> advisory for a local-model session, so a developer
+    # with a loopback base URL exported (the normal shape of a local session)
+    # sees every block-expecting test here allow instead. CI has them unset, so
+    # this is green in CI and red on the developer's machine.
+    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE",
+              "UAP_DELIVER_LOCAL_ADVISORY", "ANTHROPIC_BASE_URL", "OPENAI_BASE_URL"):
         e.pop(k, None)
     if env:
         e.update(env)

package/tools/agents/tests/test_delivery_enforcement_web_and_bash.py

@@ -17,7 +17,13 @@ ENF = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "
 
 def run(op, args, env=None):
     e = {**os.environ, "UAP_ENFORCE_DELIVERY": "block", "UAP_INFERENCE_ENDPOINT": "http://172.17.0.1:8080/v1"}
-    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE", "UAP_DELIVER_LOCAL_ADVISORY"):
+    # ANTHROPIC_BASE_URL / OPENAI_BASE_URL must be stripped too: the enforcer
+    # downgrades block -> advisory for a local-model session, so a developer
+    # with a loopback base URL exported (the normal shape of a local session)
+    # sees every block-expecting test here allow instead. CI has them unset, so
+    # this is green in CI and red on the developer's machine.
+    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE",
+              "UAP_DELIVER_LOCAL_ADVISORY", "ANTHROPIC_BASE_URL", "OPENAI_BASE_URL"):
         e.pop(k, None)
     if env:
         e.update(env)

package/tools/agents/tests/test_delivery_enforcement_worktree.py

@@ -24,8 +24,17 @@ def run(path, root, env_extra=None):
     env = dict(os.environ)
     env["UAP_REPO_ROOT"] = str(root)
     env["UAP_ENFORCE_DELIVERY"] = "block"
-    env.pop("UAP_DELIVER_ACTIVE", None)
-    env.pop("UAP_DELIVER_BYPASS", None)
+    # Every ambient input that can turn "block" into "allow" must be cleared,
+    # or these tests assert the developer's shell rather than the enforcer.
+    # ANTHROPIC_BASE_URL is the subtle one: delivery_enforcement downgrades
+    # block -> advisory for a local-model session, so with a loopback base URL
+    # exported (the normal shape of a local session here) the three
+    # block-expecting tests below flip to allowed. CI has it unset, so this
+    # fails only for developers — presenting as "behaviour drifted".
+    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS",
+              "UAP_DELIVER_LOCAL_MODE", "UAP_DELIVER_LOCAL_ADVISORY",
+              "ANTHROPIC_BASE_URL", "OPENAI_BASE_URL"):
+        env.pop(k, None)
     if env_extra:
         env.update(env_extra)
     p = subprocess.run(
@@ -82,8 +91,12 @@ class TestDeliveryEnforcementWorktree(unittest.TestCase):
         )
 
 
-if __name__ == "__main__":
-    unittest.main()
+# NB: the `unittest.main()` entrypoint lives at the END of this file, not here.
+# It used to sit at this point, above the two classes below, so running the file
+# directly (`python3 tools/agents/tests/test_delivery_enforcement_worktree.py`)
+# ran 7 tests and printed OK while `python -m unittest` ran 14 — the 7 it
+# skipped being exactly LocalAdvisoryTest + LocalModeTest. Anyone verifying a
+# change to those got a false green.
 
 
 import os as _os, subprocess as _sp, sys as _sys, json as _json, tempfile as _tf
@@ -96,7 +109,21 @@ class LocalAdvisoryTest(unittest.TestCase):
             root = _Path(td); (root/".git").mkdir()
             f = root/"src"/"a.ts"; f.parent.mkdir(parents=True); f.write_text("x")
             e = dict(_os.environ); e["UAP_REPO_ROOT"]=str(root)
-            for k in ("ANTHROPIC_BASE_URL","UAP_DELIVER_LOCAL_ADVISORY","UAP_DELIVER_ACTIVE"): e.pop(k, None)
+            # This test asserts the DEFAULT for a local session, so every input
+            # that overrides that default has to be cleared:
+            #  - UAP_DELIVER_BYPASS: run() already strips it. An agent shell
+            #    commonly exports it, the enforcer then allows every write, and
+            #    the block-expecting tests fail rc 0 != 2 — which reads as
+            #    "behaviour drifted" rather than "your env leaked".
+            #  - UAP_DELIVER_LOCAL_MODE: LocalModeTest._run already strips it;
+            #    omitting it here was an inconsistency. Importing the proxy
+            #    module (any test that does _load_proxy_module()) runs
+            #    _load_proxy_env_file(), which loads .uap/proxy.env into the
+            #    real os.environ — and that file sets UAP_DELIVER_LOCAL_MODE.
+            #    So this test's result depended on whether a proxy-importing
+            #    module ran before it in the same process.
+            for k in ("ANTHROPIC_BASE_URL","UAP_DELIVER_LOCAL_ADVISORY","UAP_DELIVER_ACTIVE",
+                      "UAP_DELIVER_BYPASS","UAP_DELIVER_LOCAL_MODE"): e.pop(k, None)
             e.update(extra_env)
             p = _sp.run([_sys.executable, str(_ENF), "--operation","Write","--args",_json.dumps({"file_path":str(f)})], capture_output=True, text=True, env=e)
             return p.returncode, _json.loads(p.stdout) if p.stdout.strip() else {}
@@ -120,7 +147,8 @@ class LocalModeTest(unittest.TestCase):
             root = _Path(td); (root/".git").mkdir()
             f = root/"src"/"a.ts"; f.parent.mkdir(parents=True); f.write_text("x")
             e = dict(_os.environ); e["UAP_REPO_ROOT"]=str(root)
-            for k in ("ANTHROPIC_BASE_URL","UAP_DELIVER_LOCAL_ADVISORY","UAP_DELIVER_LOCAL_MODE","UAP_DELIVER_ACTIVE"): e.pop(k, None)
+            # See the note in LocalAdvisoryTest._run — same ambient-bypass leak.
+            for k in ("ANTHROPIC_BASE_URL","UAP_DELIVER_LOCAL_ADVISORY","UAP_DELIVER_LOCAL_MODE","UAP_DELIVER_ACTIVE","UAP_DELIVER_BYPASS"): e.pop(k, None)
             e.update(env)
             p = _sp.run([_sys.executable, str(_ENF), "--operation","Write","--args",_json.dumps({"file_path":str(f)})], capture_output=True, text=True, env=e)
             return p.returncode, _json.loads(p.stdout) if p.stdout.strip() else {}
@@ -141,3 +169,7 @@ class LocalModeTest(unittest.TestCase):
     def test_default_is_advisory(self):
         rc, out = self._run({"ANTHROPIC_BASE_URL":"http://127.0.0.1:4000"})
         self.assertEqual(rc, 0)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_enforcer_suite_coverage.py

@@ -28,8 +28,19 @@ TESTS = Path(__file__).resolve().parent
 # Verified failing for their own pre-existing reasons, not by omission. Each
 # entry is a debt with a stated cause — not a place to park a newly broken test.
 KNOWN_EXCLUDED = {
-    "test_anthropic_proxy_streaming": "behaviour drifted from the assertions",
-    "test_delivery_enforcement_worktree": "behaviour drifted from the assertions",
+    # test_anthropic_proxy_streaming and test_delivery_enforcement_worktree
+    # were both listed here as "behaviour drifted from the assertions" and are
+    # now listed in test:enforcers instead:
+    #   - proxy_streaming had 7 genuinely stale assertions (max_tokens floors
+    #     superseded by the thinking-floor, a grammar guard that postdated the
+    #     test, the turn-count breaker's rewording, and two malformed-payload
+    #     cases deliberately reversed by _strip_orphan_tool_xml). All rewritten
+    #     against current intent. This is the module that covers the streaming
+    #     503 retry, so it was the gap that let that bug ship.
+    #   - delivery_enforcement_worktree never drifted at all: two of its env
+    #     helpers failed to strip an ambient UAP_DELIVER_BYPASS, so the
+    #     enforcer allowed every write and four block-expecting tests read 0
+    #     instead of 2. It passes clean; the helpers are now hermetic.
     "test_uap_compliance": "needs a populated DB; environment-bound",
 }
 
@@ -87,5 +98,50 @@ class TestEveryListedModuleActuallyCollects(unittest.TestCase):
         assert ghosts == set(), f"test:enforcers names modules that do not exist: {sorted(ghosts)}"
 
 
+class TestTheGateCollectsWhatItClaims(unittest.TestCase):
+    """Every check above is structural — none pins how many tests actually run.
+
+    A listed module can define a TestCase and still contribute almost nothing.
+    Two real instances: a mid-file `unittest.main()` in
+    test_anthropic_proxy_streaming and test_delivery_enforcement_worktree cut
+    direct runs off partway through the file (273 -> 168 and 14 -> 7) while
+    still printing OK; and a mass deletion inside any listed module is invisible
+    to the listing checks. A floor on the collected count catches both.
+    """
+
+    # Deliberately below the current count so ordinary churn doesn't trip it.
+    # Raise it when the suite grows substantially; never lower it to make a
+    # failing gate pass — that is the deletion this test exists to catch.
+    MINIMUM_COLLECTED = 750
+
+    def test_listed_modules_collect_at_least_the_expected_test_count(self):
+        loader = unittest.TestLoader()
+        suite = loader.loadTestsFromNames(
+            [f"tools.agents.tests.{m}" for m in sorted(_listed_modules())]
+        )
+        # loadTestsFromNames turns an import failure into a _FailedTest that
+        # still counts, so surface those rather than let them pad the total.
+        broken = [
+            str(t) for t in _flatten(suite)
+            if type(t).__name__ == "_FailedTest"
+        ]
+        assert broken == [], f"listed modules that fail to even import: {broken}"
+
+        count = suite.countTestCases()
+        assert count >= self.MINIMUM_COLLECTED, (
+            f"the gate collects {count} tests, below the {self.MINIMUM_COLLECTED} floor. "
+            "Tests were deleted, a module stopped collecting, or an entrypoint "
+            "truncates the file. Investigate before adjusting this number."
+        )
+
+
+def _flatten(suite):
+    for item in suite:
+        if isinstance(item, unittest.TestSuite):
+            yield from _flatten(item)
+        else:
+            yield item
+
+
 if __name__ == "__main__":
     unittest.main()

package/tools/agents/tests/test_proxy_env_loader.py

@@ -3,6 +3,7 @@ import importlib.util
 import os
 import tempfile
 import unittest
+import unittest.mock
 from pathlib import Path
 
 
@@ -55,5 +56,144 @@ class ProxyEnvLoaderTest(unittest.TestCase):
         proxy._load_proxy_env_file()  # must not raise
 
 
+class ProxyEnvWalkStopsAtRepoRootTest(unittest.TestCase):
+    """The upward walk must stop at the repository, not the filesystem root.
+
+    It used to run to "/", so a checkout nested under an unrelated checkout
+    loaded the outer repo's proxy.env, PROXY_AUTH_TOKEN included. A WORKTREE is
+    not that case — its .git file names the same repository — so it must still
+    reach its own repo's config rather than start tokenless.
+    """
+
+    KEY = "UAP_WALK_PROBE_KEY"
+
+    def tearDown(self):
+        os.environ.pop(self.KEY, None)
+        os.environ.pop("UAP_PROXY_ENV_FILE", None)
+
+    def _tree(self, td):
+        # outer/ is the "parent checkout" and holds the env file; outer/inner/
+        # is the "worktree" — it has a .git FILE (as real worktrees do) and no
+        # .uap/ of its own.
+        outer = Path(td) / "outer"
+        (outer / ".uap").mkdir(parents=True)
+        (outer / ".git").mkdir()
+        (outer / ".uap" / "proxy.env").write_text(f"{self.KEY}=from_the_repo\n")
+        inner = outer / "inner"
+        inner.mkdir()
+        (inner / ".git").write_text("gitdir: ../.git/worktrees/inner\n")
+        return outer, inner
+
+    def _load_from(self, path):
+        # cwd is process-global; restore it even if the loader raises. Safe
+        # under unittest (serial) and pytest-xdist (separate processes); would
+        # not be under a thread-parallel runner, and nothing here runs threaded.
+        cwd = os.getcwd()
+        os.chdir(path)
+        try:
+            os.environ.pop(self.KEY, None)
+            proxy._load_proxy_env_file()
+        finally:
+            os.chdir(cwd)
+        return os.environ.get(self.KEY)
+
+    def test_a_worktree_still_reaches_its_own_repository_config(self):
+        # A worktree's .git is a FILE naming the same repository. Stopping there
+        # would leave the proxy with an empty PROXY_AUTH_TOKEN, and since the
+        # auth middleware treats empty as "no auth configured", a non-loopback
+        # bind would then be wide open. Same repo => follow the pointer home.
+        with tempfile.TemporaryDirectory() as td:
+            _outer, inner = self._tree(td)
+            self.assertEqual(self._load_from(inner), "from_the_repo")
+
+    def test_still_finds_the_env_file_at_the_repo_root_itself(self):
+        # The bound is inclusive — stopping AT the repo root must not stop
+        # BEFORE reading it, or the proxy loses its own config.
+        with tempfile.TemporaryDirectory() as td:
+            outer, _inner = self._tree(td)
+            self.assertEqual(self._load_from(outer), "from_the_repo")
+
+    def test_the_walk_actually_ascends(self):
+        # Both cases above sit ON a boundary directory, so an implementation
+        # that only ever looked at Path.cwd() would pass them. Start well below
+        # the root, in a dir with neither .git nor .uap.
+        with tempfile.TemporaryDirectory() as td:
+            outer, _inner = self._tree(td)
+            deep = outer / "a" / "b" / "c"
+            deep.mkdir(parents=True)
+            self.assertEqual(self._load_from(deep), "from_the_repo")
+
+    def test_does_not_climb_out_of_one_repository_into_another(self):
+        # The genuine cross-repo case the bound exists for: a checkout nested
+        # under an unrelated checkout must not inherit the outer repo's secret.
+        with tempfile.TemporaryDirectory() as td:
+            outer, _inner = self._tree(td)
+            nested = outer / "vendored"
+            (nested / ".git").mkdir(parents=True)  # a real repo root, not a worktree
+            self.assertIsNone(
+                self._load_from(nested),
+                "walk escaped a nested repository into the enclosing checkout",
+            )
+
+
+class ProxyBindAuthGuardTest(unittest.TestCase):
+    """A non-loopback bind with no token must fail closed.
+
+    PROXY_AUTH_TOKEN comes from .uap/proxy.env; PROXY_HOST commonly comes from
+    the systemd EnvironmentFile. So any failure to find the former leaves the
+    latter intact — bind-all survives, require-a-credential does not — and the
+    middleware reads an empty token as "no auth configured". Without this guard
+    a config-discovery bug silently produces an open LLM proxy on the LAN.
+    """
+
+    def test_loopback_without_a_token_is_allowed(self):
+        for host in ("127.0.0.1", "::1", "localhost"):
+            with self.subTest(host=host):
+                proxy._assert_bind_is_authenticated(host, "")  # must not raise
+
+    def test_any_bind_with_a_token_is_allowed(self):
+        proxy._assert_bind_is_authenticated("0.0.0.0", "a-real-token")
+
+    def test_non_loopback_without_a_token_refuses_to_start(self):
+        for host in ("0.0.0.0", "192.168.1.50", "::"):
+            with self.subTest(host=host):
+                with unittest.mock.patch.dict(os.environ, {}, clear=False):
+                    os.environ.pop("PROXY_ALLOW_UNAUTHENTICATED_BIND", None)
+                    with self.assertRaises(SystemExit) as ctx:
+                        proxy._assert_bind_is_authenticated(host, "")
+                    self.assertIn("unauthenticated", str(ctx.exception))
+
+    def test_explicit_override_permits_an_open_listener(self):
+        with unittest.mock.patch.dict(
+            os.environ, {"PROXY_ALLOW_UNAUTHENTICATED_BIND": "1"}
+        ):
+            proxy._assert_bind_is_authenticated("0.0.0.0", "")  # must not raise
+
+
+class ProxyEnvAutoloadOptOutTest(unittest.TestCase):
+    """Importing the module must be inert when the opt-out is set."""
+
+    def test_autoload_enabled_by_default(self):
+        with unittest.mock.patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("UAP_PROXY_ENV_AUTOLOAD", None)
+            self.assertTrue(proxy._proxy_env_autoload_enabled())
+
+    def test_opt_out_values_disable_autoload(self):
+        for val in ("0", "off", "false", "no", "OFF", " 0 "):
+            with self.subTest(val=val):
+                with unittest.mock.patch.dict(
+                    os.environ, {"UAP_PROXY_ENV_AUTOLOAD": val}
+                ):
+                    self.assertFalse(proxy._proxy_env_autoload_enabled())
+
+    def test_other_values_leave_autoload_on(self):
+        for val in ("1", "on", "true", "yes"):
+            with self.subTest(val=val):
+                with unittest.mock.patch.dict(
+                    os.environ, {"UAP_PROXY_ENV_AUTOLOAD": val}
+                ):
+                    self.assertTrue(proxy._proxy_env_autoload_enabled())
+
+
 if __name__ == "__main__":
     unittest.main()