@miller-tech/uap 1.179.6 → 1.179.7

package/docs/guides/PROXY.md

@@ -117,7 +117,23 @@ token is not echoed into the ride-along log. Binding beyond loopback
 `uap-anthropic-proxy.service`, reading its environment from
 `~/.config/uap/anthropic-proxy.env`; a plain spawned proxy seeds the same file
 for parity. The proxy also loads project-local `.uap/proxy.env` at startup
-(real environment always wins). PID reuse is defended with a `/proc/<pid>`
+(real environment always wins). That search walks up from the working
+directory and **stops at the repository root**, so a checkout nested inside an
+unrelated checkout no longer inherits the outer repo's `PROXY_AUTH_TOKEN`; a
+git *worktree* is the same repository, so its `.git` pointer is followed back
+to the main checkout rather than terminating the search. If nothing is found
+under the repo, `$XDG_CONFIG_HOME/uap/proxy.env` and `~/.uap/proxy.env` are
+tried, matching the client-side resolver. The proxy logs which file it loaded
+(or that it found none) plus its auth state at startup, so a discovery miss is
+visible rather than silently degrading to defaults.
+
+| Env (default) | Behavior |
+|---|---|
+| `UAP_PROXY_ENV_FILE` (unset) | Explicit path to a proxy.env, tried before the walk |
+| `UAP_PROXY_ENV_AUTOLOAD` (**on**) | Set to `0` to make *importing* the proxy module inert — it then mutates no process environment. Used by the Python test suite so tests assert shipped defaults rather than the developer's config. Does not affect a server run |
+| `PROXY_ALLOW_UNAUTHENTICATED_BIND` (**off**) | The proxy **refuses to start** on a non-loopback `PROXY_HOST` when `PROXY_AUTH_TOKEN` is empty, because the auth middleware treats an empty token as "no auth configured" and would leave every route open on the LAN. Set to `1` only if an open listener is genuinely intended |
+
+PID reuse is defended with a `/proc/<pid>`
 start-time token so `release` never kills an unrelated process that inherited an
 old pid. Everything hook-driven **fails open** — if the proxy won't start, the
 agent just runs without it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.179.6",
+  "version": "1.179.7",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_delivery_enforcement_worktree",
+    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_delivery_enforcement_worktree",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",

package/tools/agents/scripts/anthropic_proxy.py

@@ -109,21 +109,92 @@ from fastapi.responses import StreamingResponse
 import uvicorn
 
 
+# Path of the .uap/proxy.env actually loaded, or "" if none was found. Reported
+# at startup so a silent discovery miss is visible in the journal.
+_PROXY_ENV_FILE_LOADED = ""
+
+
+def _git_common_root(gitfile: Path) -> "Path | None":
+    """Resolve a worktree/submodule `.git` FILE to its main checkout root.
+
+    A worktree's .git is a file containing `gitdir: <main>/.git/worktrees/<n>`.
+    It names the SAME repository — same object store, same operator, same trust
+    domain — so config discovery must follow it home rather than treat the
+    worktree as a foreign tree. Returns None if the file isn't a gitdir pointer.
+    """
+    try:
+        text = gitfile.read_text(errors="ignore").strip()
+    except OSError:
+        return None
+    if not text.startswith("gitdir:"):
+        return None
+    target = Path(text.split(":", 1)[1].strip())
+    if not target.is_absolute():
+        target = (gitfile.parent / target)
+    try:
+        target = target.resolve()
+    except OSError:
+        return None
+    for parent in [target, *target.parents]:
+        if parent.name == ".git":
+            return parent.parent
+    return None
+
+
 def _load_proxy_env_file() -> None:
     """Load .uap/proxy.env (KEY=VALUE) written by `uap setup` into os.environ so
     recipe / escalation / delivery selections reach the proxy without the user
     hand-exporting env. Existing process env ALWAYS wins (setdefault). Walks up
-    from CWD to the filesystem root looking for a .uap/proxy.env; override the
-    path with UAP_PROXY_ENV_FILE. Runs before the import-time env reads below.
-    Fails open."""
+    from CWD looking for a .uap/proxy.env, stopping at the repository root;
+    override the path with UAP_PROXY_ENV_FILE. Runs before the import-time env
+    reads below. Fails open."""
     try:
         candidates = []
         explicit = os.environ.get("UAP_PROXY_ENV_FILE")
         if explicit:
             candidates.append(Path(explicit))
         d = Path.cwd()
+        try:
+            home = Path.home()
+        except Exception:
+            home = None
         for base in [d, *d.parents]:
             candidates.append(base / ".uap" / "proxy.env")
+            git = base / ".git"
+            # A real repository root: stop. The walk used to climb to the
+            # FILESYSTEM root, so a checkout nested under another repo silently
+            # loaded the outer repo's proxy.env — PROXY_AUTH_TOKEN included.
+            if git.is_dir():
+                break
+            # A worktree or submodule: its .git is a FILE naming the SAME
+            # repository. Same object store, same operator, same trust domain —
+            # so follow it to the main checkout instead of stopping. Stopping
+            # here would be worse than the leak: a worktree gets no .uap/ of its
+            # own, so the proxy would start with an EMPTY PROXY_AUTH_TOKEN, and
+            # the auth middleware treats empty as "no auth configured" rather
+            # than "misconfigured". Since PROXY_HOST=0.0.0.0 arrives from a
+            # different file that this walk never touched, that combination is
+            # an unauthenticated listener on the LAN.
+            if git.is_file():
+                main_root = _git_common_root(git)
+                if main_root is not None:
+                    candidates.append(main_root / ".uap" / "proxy.env")
+                break
+            # Never climb above the user's home. With no repository anywhere
+            # above cwd the walk would otherwise reach "/", where a
+            # world-writable /tmp/.uap/proxy.env would be loaded unconditionally.
+            if home is not None and base == home:
+                break
+        # Machine-wide fallbacks, mirroring the TypeScript reader in
+        # src/models/openai-compat-client.ts. Without these the two halves
+        # disagree about where the token lives: the client finds one and sends
+        # it while the server has none and skips the check.
+        xdg = os.environ.get("XDG_CONFIG_HOME")
+        if xdg:
+            candidates.append(Path(xdg) / "uap" / "proxy.env")
+        if home is not None:
+            candidates.append(home / ".config" / "uap" / "proxy.env")
+            candidates.append(home / ".uap" / "proxy.env")
         for path in candidates:
             try:
                 if not path.is_file():
@@ -139,12 +210,36 @@ def _load_proxy_env_file() -> None:
                 val = val.strip().strip('"').strip("'")
                 if key:
                     os.environ.setdefault(key, val)
+            global _PROXY_ENV_FILE_LOADED
+            _PROXY_ENV_FILE_LOADED = str(path)
             break  # first file found wins
     except Exception:
         pass
 
 
-_load_proxy_env_file()
+def _proxy_env_autoload_enabled() -> bool:
+    """Whether importing this module may mutate the process environment.
+
+    On by default: the module-level constants below read os.environ at import,
+    so a server run needs the file loaded first. But `import anthropic_proxy`
+    is not always a server run — the test suite imports it ~6 times, and each
+    import used to setdefault the whole of .uap/proxy.env into the real
+    os.environ. Every enforcer subprocess spawned afterwards inherited it, so
+    tests asserted the developer's proxy config instead of the shipped
+    defaults, and the outcome depended on module order. Set
+    UAP_PROXY_ENV_AUTOLOAD=0 to import the module inertly; callers that want
+    the file can still invoke _load_proxy_env_file() explicitly.
+    """
+    return os.environ.get("UAP_PROXY_ENV_AUTOLOAD", "1").strip().lower() not in {
+        "0",
+        "off",
+        "false",
+        "no",
+    }
+
+
+if _proxy_env_autoload_enabled():
+    _load_proxy_env_file()
 
 # ---------------------------------------------------------------------------
 # Configuration (all configurable via environment variables)
@@ -12588,7 +12683,58 @@ async def context_status(request: Request):
 # Entry Point
 # ===========================================================================
 
+_LOOPBACK_HOSTS = {"127.0.0.1", "::1", "localhost", ""}
+
+
+def _assert_bind_is_authenticated(host: str, token: str) -> None:
+    """Refuse to expose an unauthenticated proxy beyond loopback.
+
+    The auth middleware is a no-op when PROXY_AUTH_TOKEN is empty — it reads
+    "no auth configured", not "misconfigured". The token arrives from
+    .uap/proxy.env while PROXY_HOST commonly arrives from the systemd
+    EnvironmentFile, so any failure to locate the former leaves the latter
+    intact: bind-all survives, require-a-credential does not. That asymmetry
+    turns a silent config miss into an open LLM proxy on the LAN, fronting both
+    the local model and cloud passthrough on the operator's credentials.
+
+    Fail closed instead. Set PROXY_ALLOW_UNAUTHENTICATED_BIND=1 to override
+    when an open listener is genuinely intended.
+    """
+    if host in _LOOPBACK_HOSTS or token:
+        return
+    if os.environ.get("PROXY_ALLOW_UNAUTHENTICATED_BIND", "").strip().lower() in {
+        "1",
+        "on",
+        "true",
+        "yes",
+    }:
+        logger.warning(
+            "PROXY AUTH DISABLED on a non-loopback bind (%s) — allowed only "
+            "because PROXY_ALLOW_UNAUTHENTICATED_BIND is set.",
+            host,
+        )
+        return
+    raise SystemExit(
+        f"refusing to bind {host} with no PROXY_AUTH_TOKEN: every route would be "
+        f"unauthenticated. The token normally comes from .uap/proxy.env — if the "
+        f"proxy cannot find that file, config discovery is broken rather than the "
+        f"token being genuinely unset. Set PROXY_AUTH_TOKEN, bind 127.0.0.1, or "
+        f"set PROXY_ALLOW_UNAUTHENTICATED_BIND=1 if an open listener is intended."
+    )
+
+
 if __name__ == "__main__":
+    # Config discovery is silent by design (it fails open so a missing file can
+    # never stop the proxy). Say what it found, so a miss is visible in the
+    # journal instead of showing up later as unexplained default behaviour.
+    logger.info(
+        "proxy env: %s | auth=%s | bind=%s:%d",
+        f"loaded {_PROXY_ENV_FILE_LOADED}" if _PROXY_ENV_FILE_LOADED else "no proxy.env found",
+        "enabled" if PROXY_AUTH_TOKEN else "DISABLED",
+        PROXY_HOST,
+        PROXY_PORT,
+    )
+    _assert_bind_is_authenticated(PROXY_HOST, PROXY_AUTH_TOKEN)
     uvicorn.run(
         app,
         host=PROXY_HOST,

package/tools/agents/tests/__init__.py

@@ -0,0 +1,27 @@
+"""Test package init — keeps importing the proxy from mutating this process.
+
+`anthropic_proxy` loads `.uap/proxy.env` into the real `os.environ` at import.
+That is right for a server run and wrong for a test run: it makes tests assert
+the developer's proxy config instead of the shipped defaults, and it leaks
+UAP_DELIVER_* settings into every enforcer subprocess the suite spawns, so
+results depend on module import order.
+
+Setting the opt-out here rather than only in `conftest.py` covers every entry
+path, because all of them import this package first:
+
+  - `python -m unittest tools.agents.tests.test_x`   (what CI runs)
+  - `python -m unittest discover -s tools/agents/tests`
+  - `loadTestsFromNames(...)` in test_enforcer_suite_coverage
+  - pytest (which also reads conftest.py)
+
+`python3 tools/agents/tests/test_x.py` — running a file directly by path — is
+the one shape that does NOT import the package, which is why conftest.py and
+the `test:enforcers` script both still set it too.
+
+`setdefault`, so an explicit `UAP_PROXY_ENV_AUTOLOAD=1` in the environment
+still wins for anyone who deliberately wants the real file loaded.
+"""
+
+import os
+
+os.environ.setdefault("UAP_PROXY_ENV_AUTOLOAD", "0")

package/tools/agents/tests/conftest.py

@@ -0,0 +1,27 @@
+"""Keep importing the proxy from mutating the test process's environment.
+
+`anthropic_proxy` loads `.uap/proxy.env` into the real `os.environ` at import
+so a server run gets the operator's recipe/delivery/auth settings without
+hand-exported env. Under test that is a liability, and it produced two real
+failures:
+
+1. Tests that assert shipped defaults (timeouts, retry budgets) instead
+   asserted whatever the developer's `.uap/proxy.env` happened to contain —
+   green in CI, red locally, for no code reason.
+2. `UAP_DELIVER_LOCAL_MODE` from that file reached every enforcer subprocess
+   the suite spawns, so `test_delivery_enforcement_worktree` passed or failed
+   depending on whether a proxy-importing module had run before it.
+
+Setting the opt-out here covers every pytest run from one place instead of
+each module defending itself. `npm run test:enforcers` sets the same variable
+for the unittest path, which does not read conftest.py.
+
+This must run before any test module imports the proxy — conftest is imported
+at collection time, ahead of the test modules, which is exactly that point.
+Tests that specifically exercise the loader call `_load_proxy_env_file()`
+directly and are unaffected.
+"""
+
+import os
+
+os.environ.setdefault("UAP_PROXY_ENV_AUTOLOAD", "0")

package/tools/agents/tests/test_proxy_env_loader.py

@@ -3,6 +3,7 @@ import importlib.util
 import os
 import tempfile
 import unittest
+import unittest.mock
 from pathlib import Path
 
 
@@ -55,5 +56,144 @@ class ProxyEnvLoaderTest(unittest.TestCase):
         proxy._load_proxy_env_file()  # must not raise
 
 
+class ProxyEnvWalkStopsAtRepoRootTest(unittest.TestCase):
+    """The upward walk must stop at the repository, not the filesystem root.
+
+    It used to run to "/", so a checkout nested under an unrelated checkout
+    loaded the outer repo's proxy.env, PROXY_AUTH_TOKEN included. A WORKTREE is
+    not that case — its .git file names the same repository — so it must still
+    reach its own repo's config rather than start tokenless.
+    """
+
+    KEY = "UAP_WALK_PROBE_KEY"
+
+    def tearDown(self):
+        os.environ.pop(self.KEY, None)
+        os.environ.pop("UAP_PROXY_ENV_FILE", None)
+
+    def _tree(self, td):
+        # outer/ is the "parent checkout" and holds the env file; outer/inner/
+        # is the "worktree" — it has a .git FILE (as real worktrees do) and no
+        # .uap/ of its own.
+        outer = Path(td) / "outer"
+        (outer / ".uap").mkdir(parents=True)
+        (outer / ".git").mkdir()
+        (outer / ".uap" / "proxy.env").write_text(f"{self.KEY}=from_the_repo\n")
+        inner = outer / "inner"
+        inner.mkdir()
+        (inner / ".git").write_text("gitdir: ../.git/worktrees/inner\n")
+        return outer, inner
+
+    def _load_from(self, path):
+        # cwd is process-global; restore it even if the loader raises. Safe
+        # under unittest (serial) and pytest-xdist (separate processes); would
+        # not be under a thread-parallel runner, and nothing here runs threaded.
+        cwd = os.getcwd()
+        os.chdir(path)
+        try:
+            os.environ.pop(self.KEY, None)
+            proxy._load_proxy_env_file()
+        finally:
+            os.chdir(cwd)
+        return os.environ.get(self.KEY)
+
+    def test_a_worktree_still_reaches_its_own_repository_config(self):
+        # A worktree's .git is a FILE naming the same repository. Stopping there
+        # would leave the proxy with an empty PROXY_AUTH_TOKEN, and since the
+        # auth middleware treats empty as "no auth configured", a non-loopback
+        # bind would then be wide open. Same repo => follow the pointer home.
+        with tempfile.TemporaryDirectory() as td:
+            _outer, inner = self._tree(td)
+            self.assertEqual(self._load_from(inner), "from_the_repo")
+
+    def test_still_finds_the_env_file_at_the_repo_root_itself(self):
+        # The bound is inclusive — stopping AT the repo root must not stop
+        # BEFORE reading it, or the proxy loses its own config.
+        with tempfile.TemporaryDirectory() as td:
+            outer, _inner = self._tree(td)
+            self.assertEqual(self._load_from(outer), "from_the_repo")
+
+    def test_the_walk_actually_ascends(self):
+        # Both cases above sit ON a boundary directory, so an implementation
+        # that only ever looked at Path.cwd() would pass them. Start well below
+        # the root, in a dir with neither .git nor .uap.
+        with tempfile.TemporaryDirectory() as td:
+            outer, _inner = self._tree(td)
+            deep = outer / "a" / "b" / "c"
+            deep.mkdir(parents=True)
+            self.assertEqual(self._load_from(deep), "from_the_repo")
+
+    def test_does_not_climb_out_of_one_repository_into_another(self):
+        # The genuine cross-repo case the bound exists for: a checkout nested
+        # under an unrelated checkout must not inherit the outer repo's secret.
+        with tempfile.TemporaryDirectory() as td:
+            outer, _inner = self._tree(td)
+            nested = outer / "vendored"
+            (nested / ".git").mkdir(parents=True)  # a real repo root, not a worktree
+            self.assertIsNone(
+                self._load_from(nested),
+                "walk escaped a nested repository into the enclosing checkout",
+            )
+
+
+class ProxyBindAuthGuardTest(unittest.TestCase):
+    """A non-loopback bind with no token must fail closed.
+
+    PROXY_AUTH_TOKEN comes from .uap/proxy.env; PROXY_HOST commonly comes from
+    the systemd EnvironmentFile. So any failure to find the former leaves the
+    latter intact — bind-all survives, require-a-credential does not — and the
+    middleware reads an empty token as "no auth configured". Without this guard
+    a config-discovery bug silently produces an open LLM proxy on the LAN.
+    """
+
+    def test_loopback_without_a_token_is_allowed(self):
+        for host in ("127.0.0.1", "::1", "localhost"):
+            with self.subTest(host=host):
+                proxy._assert_bind_is_authenticated(host, "")  # must not raise
+
+    def test_any_bind_with_a_token_is_allowed(self):
+        proxy._assert_bind_is_authenticated("0.0.0.0", "a-real-token")
+
+    def test_non_loopback_without_a_token_refuses_to_start(self):
+        for host in ("0.0.0.0", "192.168.1.50", "::"):
+            with self.subTest(host=host):
+                with unittest.mock.patch.dict(os.environ, {}, clear=False):
+                    os.environ.pop("PROXY_ALLOW_UNAUTHENTICATED_BIND", None)
+                    with self.assertRaises(SystemExit) as ctx:
+                        proxy._assert_bind_is_authenticated(host, "")
+                    self.assertIn("unauthenticated", str(ctx.exception))
+
+    def test_explicit_override_permits_an_open_listener(self):
+        with unittest.mock.patch.dict(
+            os.environ, {"PROXY_ALLOW_UNAUTHENTICATED_BIND": "1"}
+        ):
+            proxy._assert_bind_is_authenticated("0.0.0.0", "")  # must not raise
+
+
+class ProxyEnvAutoloadOptOutTest(unittest.TestCase):
+    """Importing the module must be inert when the opt-out is set."""
+
+    def test_autoload_enabled_by_default(self):
+        with unittest.mock.patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("UAP_PROXY_ENV_AUTOLOAD", None)
+            self.assertTrue(proxy._proxy_env_autoload_enabled())
+
+    def test_opt_out_values_disable_autoload(self):
+        for val in ("0", "off", "false", "no", "OFF", " 0 "):
+            with self.subTest(val=val):
+                with unittest.mock.patch.dict(
+                    os.environ, {"UAP_PROXY_ENV_AUTOLOAD": val}
+                ):
+                    self.assertFalse(proxy._proxy_env_autoload_enabled())
+
+    def test_other_values_leave_autoload_on(self):
+        for val in ("1", "on", "true", "yes"):
+            with self.subTest(val=val):
+                with unittest.mock.patch.dict(
+                    os.environ, {"UAP_PROXY_ENV_AUTOLOAD": val}
+                ):
+                    self.assertTrue(proxy._proxy_env_autoload_enabled())
+
+
 if __name__ == "__main__":
     unittest.main()