@miller-tech/uap 1.186.2 → 1.186.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.186.2",
+  "version": "1.186.3",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window",
+    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",
@@ -31,7 +31,7 @@
     "install:web": "bash scripts/setup/install-web.sh",
     "install:desktop": "bash scripts/setup/install-desktop.sh",
     "install:cloakbrowser": "tsx scripts/setup/install-cloakbrowser.ts",
-    "postinstall": "echo '\n✨ Run: npx @miller-tech/uap init --interactive'",
+    "postinstall": "echo '\n\u2728 Run: npx @miller-tech/uap init --interactive'",
     "version:patch": "bash scripts/version-bump.sh patch",
     "version:minor": "bash scripts/version-bump.sh minor",
     "version:major": "bash scripts/version-bump.sh major",

package/tools/agents/scripts/anthropic_proxy.py

@@ -374,6 +374,30 @@ _RATE_LIMITED_API_RE = re.compile(r"api\.github\.com", re.IGNORECASE)
 PROXY_STUCK_TEXT_THRESHOLD = int(os.environ.get("PROXY_STUCK_TEXT_THRESHOLD", "2"))
 PROXY_STUCK_API_THRESHOLD = int(os.environ.get("PROXY_STUCK_API_THRESHOLD", "3"))
 
+# REPEAT-CALL guardrail: the same tool call, with the same arguments, over and
+# over -- while SUCCEEDING every time.
+#
+# Observed live (opencode + qwen3.6, 2026-08-07): `git diff --stat` re-issued 44
+# times in one run, ~2.5s apart, until the operator interrupted. On screen it
+# reads as the final message repeating forever.
+#
+# Every existing guard missed it, and each for a defensible reason:
+#   STUCK-BREAK  needs self-reported "stuck" phrasing or an api.github.com arg.
+#   ERROR-LOOP   needs a repeated tool-RESULT error signature; this call works.
+#   LOOP BREAKER detects the identical fingerprint, but is ANDed with
+#                no_progress_streak -- and a command that returns output every
+#                time never accumulates one, so the condition never holds.
+#
+# The blind spot is therefore a repeatedly-SUCCESSFUL identical call: the other
+# guards all key off failure or self-awareness, and this loop has neither. A
+# read-only command issued four times with identical arguments is not a
+# strategy, so this fires on the fingerprint alone, independent of outcome.
+# PROXY_REPEAT_CALL_THRESHOLD=0 disables.
+PROXY_REPEAT_CALL_THRESHOLD = int(os.environ.get("PROXY_REPEAT_CALL_THRESHOLD", "4"))
+# Marker so the injected directive can address a SUCCEEDING loop correctly
+# rather than telling the model to stop retrying "a failing action".
+_REPEAT_CALL_REASON = "identical tool call"
+
 # ---------------------------------------------------------------------------
 # ERROR-LOOP guardrail: the model edits, runs a command, hits the SAME failure,
 # edits again (a DIFFERENT edit), runs, hits the same failure — for many turns.
@@ -1993,6 +2017,14 @@ class SessionMonitor:
             return True, f"self-reported stuck x{self.self_stuck_streak}"
         if self.rate_limited_api_streak >= PROXY_STUCK_API_THRESHOLD:
             return True, f"rate-limited-API retries x{self.rate_limited_api_streak}"
+        # Repeated identical call, judged on the fingerprint ALONE. Deliberately
+        # not ANDed with no_progress_streak the way the LOOP BREAKER is: a call
+        # that succeeds every time never builds a no-progress streak, which is
+        # exactly how a 44-turn `git diff --stat` loop ran unchallenged.
+        if PROXY_REPEAT_CALL_THRESHOLD > 0:
+            looping, count = self.detect_tool_loop(window=PROXY_REPEAT_CALL_THRESHOLD)
+            if looping and count >= PROXY_REPEAT_CALL_THRESHOLD:
+                return True, f"{_REPEAT_CALL_REASON} x{count}"
         return False, ""
 
     def note_deferral_signal(self, text: str, had_tool_call: bool) -> None:
@@ -5677,6 +5709,51 @@ def _strip_sandbox_unreachable_tools(body: dict) -> int:
     return removed
 
 
+def _seed_tool_history_from_request(monitor: "SessionMonitor", messages: list) -> None:
+    """Rebuild the tool-call streak from the CONVERSATION, not from server state.
+
+    Every streak guard here counted appends to a per-session SessionMonitor. That
+    monitor is keyed `fp:<hash of the first user message>` whenever the client
+    sends no session header — and opencode sends none. So anything that shifts
+    that text (compaction, a re-summarised opening turn) silently starts a FRESH
+    monitor with empty history, and every streak restarts at zero. A proxy
+    restart mid-session does the same.
+
+    The client re-sends the whole conversation each turn, so the streak is
+    already in the request. Deriving it from there makes the guards independent
+    of monitor identity and of proxy uptime.
+
+    Only ever EXTENDS: if the monitor already knows at least as much as the
+    request implies, it is left alone, so this cannot double-count the normal
+    path that appends one fingerprint per request.
+    """
+    if not isinstance(messages, list):
+        return
+    rebuilt: list[str] = []
+    for msg in messages:
+        if not isinstance(msg, dict) or msg.get("role") != "assistant":
+            continue
+        content = msg.get("content")
+        if not isinstance(content, list):
+            continue
+        fps = [
+            _tool_call_fingerprint(b)
+            for b in content
+            if isinstance(b, dict) and b.get("type") == "tool_use"
+        ]
+        if fps:
+            rebuilt.append("|".join(sorted(fps)))
+    # Drop the LAST turn: the incremental path immediately appends that one, and
+    # seeding it here too would count the current turn twice — inflating every
+    # streak by one and firing the guards a turn early. Caught by two existing
+    # streaming tests, which replay one body three times and reached the
+    # threshold sooner than they should have.
+    rebuilt = rebuilt[:-1]
+    if len(rebuilt) > len(monitor.tool_call_history):
+        # Keep the same bound the incremental path uses.
+        monitor.tool_call_history = rebuilt[-30:]
+
+
 def _maybe_inject_stuck_break(openai_body: dict, monitor: "SessionMonitor") -> None:
     """Force a terminal turn when the model is looping self-awarely or hammering
     a rate-limited API. Unlike the cycle-breaker (which narrows tools), this
@@ -5697,15 +5774,29 @@ def _maybe_inject_stuck_break(openai_body: dict, monitor: "SessionMonitor") -> N
         if monitor.sandboxed
         else "use the browser tool or `git clone` (git protocol)"
     )
-    directive = (
-        "\n\nSTOP — you are repeating a failing action (" + reason + "). Do NOT "
-        "retry the same tool or fetch again. If a resource is unreachable (e.g. a "
-        "rate-limited GitHub REST API), switch channel: " + channel_hint + ", NOT "
-        "api.github.com. If it is still "
-        "unavailable, proceed WITHOUT it using what you already have, or ask the "
-        "operator the single blocking question in one sentence. Take a DIFFERENT "
-        "action now."
-    )
+    if reason.startswith(_REPEAT_CALL_REASON):
+        # The call SUCCEEDS every time, so "stop retrying a failing action" and
+        # the switch-channel advice would both be nonsense here. Name the real
+        # problem: the answer is already in hand and re-asking cannot change it.
+        directive = (
+            "\n\nSTOP — you have issued the same tool call with the same "
+            "arguments " + reason.rsplit("x", 1)[-1] + " times in a row. It "
+            "SUCCEEDED each time and the result will not change by asking again. "
+            "You already have that output. Do NOT repeat it. Either take the "
+            "NEXT concrete action using what it told you, or — if you genuinely "
+            "cannot proceed — state the single blocking question in one sentence "
+            "and stop. Answer in plain text now if the work is done."
+        )
+    else:
+        directive = (
+            "\n\nSTOP — you are repeating a failing action (" + reason + "). Do NOT "
+            "retry the same tool or fetch again. If a resource is unreachable (e.g. a "
+            "rate-limited GitHub REST API), switch channel: " + channel_hint + ", NOT "
+            "api.github.com. If it is still "
+            "unavailable, proceed WITHOUT it using what you already have, or ask the "
+            "operator the single blocking question in one sentence. Take a DIFFERENT "
+            "action now."
+        )
     msgs = openai_body.get("messages")
     if not isinstance(msgs, list):
         msgs = []
@@ -7095,6 +7186,7 @@ def _record_last_assistant_tool_calls(
                     _latest_err = any(_flags)
                 break
     monitor.note_tool_result_error(_latest_tr, _latest_err)
+    _seed_tool_history_from_request(monitor, messages)
     tool_fingerprints = []
     tool_targets: dict[str, str] = {}
     assistant_had_text = False  # Fix B: did the last assistant turn emit prose?

package/tools/agents/tests/test_repeat_call_guard.py

@@ -0,0 +1,228 @@
+#!/usr/bin/env python3
+"""A tool call that keeps SUCCEEDING can loop forever, and every guard missed it.
+
+Observed live (opencode + qwen3.6, 2026-08-07): `git diff --stat` re-issued 44
+times in one run, ~2.5s apart, until the operator interrupted. On screen it
+reads as the final message repeating without end.
+
+Each existing guard declined it for a defensible reason:
+
+  STUCK-BREAK   wants self-reported "stuck" phrasing, or an `api.github.com`
+                argument. The model said nothing and this is a git command.
+  ERROR-LOOP    wants a repeated tool-RESULT error signature. This call works.
+  LOOP BREAKER  does detect the identical fingerprint, but ANDs it with
+                `no_progress_streak` — and a command that returns output every
+                time never accumulates one, so the condition never held.
+
+The blind spot is a repeatedly-SUCCESSFUL identical call: the other guards all
+key off failure or self-awareness, and this loop has neither. So this guard
+fires on the fingerprint alone, at 4, independent of outcome.
+"""
+
+import importlib.util
+import os
+import sys
+import unittest
+from pathlib import Path
+
+PROXY = Path(__file__).resolve().parents[3] / "tools" / "agents" / "scripts" / "anthropic_proxy.py"
+
+
+def load_proxy(env: dict | None = None):
+    """Import the proxy module with a chosen env (thresholds are read at import)."""
+    saved = dict(os.environ)
+    os.environ.update(env or {})
+    try:
+        spec = importlib.util.spec_from_file_location(f"proxy_{len(sys.modules)}", PROXY)
+        mod = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(mod)
+        return mod
+    finally:
+        os.environ.clear()
+        os.environ.update(saved)
+
+
+class TestRepeatCallGuard(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.proxy = load_proxy()
+
+    def monitor(self):
+        return self.proxy.SessionMonitor(context_window=100000)
+
+    def record(self, mon, fingerprint, times):
+        for _ in range(times):
+            mon.record_tool_calls(tool_names=["Bash"], fingerprint=fingerprint)
+
+    def test_the_observed_loop_is_caught(self):
+        # The real thing: same tool, same args, succeeding every time.
+        mon = self.monitor()
+        self.record(mon, "Bash|git diff --stat", 4)
+        should, reason = mon.should_force_stuck_break()
+        self.assertTrue(should, "4 identical successful calls must break the loop")
+        self.assertIn("identical tool call", reason)
+
+    def test_three_identical_calls_are_left_alone(self):
+        # Repetition is not automatically a loop — a couple of retries is normal.
+        mon = self.monitor()
+        self.record(mon, "Bash|git diff --stat", 3)
+        should, _ = mon.should_force_stuck_break()
+        self.assertFalse(should)
+
+    def test_no_progress_streak_is_NOT_required(self):
+        # The precise reason the existing LOOP BREAKER never fired: a succeeding
+        # command leaves no_progress_streak at 0 forever.
+        mon = self.monitor()
+        self.record(mon, "Bash|git diff --stat", 6)
+        self.assertEqual(mon.no_progress_streak, 0)
+        should, _ = mon.should_force_stuck_break()
+        self.assertTrue(should)
+
+    def test_varied_calls_do_not_trip_it(self):
+        # Ordinary agentic work: different tools, different arguments.
+        mon = self.monitor()
+        for fp in ("Bash|ls", "Read|a.ts", "Bash|npm test", "Edit|a.ts", "Bash|git status"):
+            mon.record_tool_calls(tool_names=["Bash"], fingerprint=fp)
+        should, _ = mon.should_force_stuck_break()
+        self.assertFalse(should)
+
+    def test_a_broken_streak_resets_it(self):
+        # Three repeats, something else, three repeats — not a loop.
+        mon = self.monitor()
+        self.record(mon, "Bash|git diff --stat", 3)
+        mon.record_tool_calls(tool_names=["Read"], fingerprint="Read|src/index.ts")
+        self.record(mon, "Bash|git diff --stat", 3)
+        should, _ = mon.should_force_stuck_break()
+        self.assertFalse(should)
+
+    def test_the_guard_can_be_disabled(self):
+        proxy = load_proxy({"PROXY_REPEAT_CALL_THRESHOLD": "0"})
+        mon = proxy.SessionMonitor(context_window=100000)
+        for _ in range(12):
+            mon.record_tool_calls(tool_names=["Bash"], fingerprint="Bash|git diff --stat")
+        should, _ = mon.should_force_stuck_break()
+        self.assertFalse(should, "PROXY_REPEAT_CALL_THRESHOLD=0 must disable it")
+
+    def test_existing_stuck_signals_still_work(self):
+        # The new branch must not shadow the two guards that were already there.
+        mon = self.monitor()
+        for _ in range(self.proxy.PROXY_STUCK_TEXT_THRESHOLD):
+            mon.note_assistant_text("I've been stuck in a loop, let me break out")
+        should, reason = mon.should_force_stuck_break()
+        self.assertTrue(should)
+        self.assertIn("self-reported", reason)
+
+
+class TestDirectiveMatchesTheFailure(unittest.TestCase):
+    """A succeeding loop must not be told to stop retrying 'a failing action'."""
+
+    @classmethod
+    def setUpClass(cls):
+        cls.proxy = load_proxy()
+
+    def inject(self, mon):
+        body = {"messages": [{"role": "system", "content": "base"}], "tool_choice": "required"}
+        self.proxy._maybe_inject_stuck_break(body, mon)
+        return body
+
+    def test_repeat_loop_gets_the_right_words(self):
+        mon = self.proxy.SessionMonitor(context_window=100000)
+        for _ in range(4):
+            mon.record_tool_calls(tool_names=["Bash"], fingerprint="Bash|git diff --stat")
+        text = self.inject(mon)["messages"][0]["content"]
+        self.assertIn("SUCCEEDED each time", text)
+        self.assertIn("will not change", text)
+        # Wrong-diagnosis wording from the other branch must not appear.
+        self.assertNotIn("failing action", text)
+        self.assertNotIn("api.github.com", text)
+
+    def test_tool_choice_is_released_so_a_text_turn_is_possible(self):
+        # Without this the model is still coerced into calling a tool, which is
+        # the loop it is being asked to leave.
+        mon = self.proxy.SessionMonitor(context_window=100000)
+        for _ in range(4):
+            mon.record_tool_calls(tool_names=["Bash"], fingerprint="Bash|git diff --stat")
+        self.assertEqual(self.inject(mon)["tool_choice"], "auto")
+
+    def test_failing_loop_keeps_its_original_directive(self):
+        mon = self.proxy.SessionMonitor(context_window=100000)
+        for _ in range(self.proxy.PROXY_STUCK_API_THRESHOLD):
+            mon.note_tool_arg_hosts(["https://api.github.com/repos/x/y"])
+        text = self.inject(mon)["messages"][0]["content"]
+        self.assertIn("failing action", text)
+
+
+if __name__ == "__main__":
+    unittest.main()
+
+
+class TestStreakSurvivesAFreshMonitor(unittest.TestCase):
+    """The guards counted server-side state that silently resets.
+
+    The monitor is keyed `fp:<hash of the first user message>` when the client
+    sends no session header — and opencode sends none. Compaction, a re-summarised
+    opening turn, or a proxy restart therefore starts a FRESH monitor with empty
+    history, and every streak restarts at zero no matter how long the real loop is.
+
+    The conversation is re-sent whole each turn, so the streak is derivable from
+    the request. These tests pin that.
+    """
+
+    @classmethod
+    def setUpClass(cls):
+        cls.proxy = load_proxy()
+
+    @staticmethod
+    def convo(n, cmd="git diff --stat"):
+        """A conversation containing `n` identical assistant tool calls."""
+        msgs = [{"role": "user", "content": "check the diff"}]
+        for i in range(n):
+            msgs.append({"role": "assistant", "content": [
+                {"type": "tool_use", "id": f"t{i}", "name": "Bash", "input": {"command": cmd}}]})
+            msgs.append({"role": "user", "content": [
+                {"type": "tool_result", "tool_use_id": f"t{i}", "content": "1 file changed"}]})
+        return msgs
+
+    def test_a_fresh_monitor_still_sees_the_loop(self):
+        # THE RESIDUAL: brand-new monitor, 44-turn loop already in the transcript.
+        mon = self.proxy.SessionMonitor(context_window=100000)
+        self.assertEqual(mon.tool_call_history, [])
+        self.proxy._seed_tool_history_from_request(mon, self.convo(44))
+        should, reason = mon.should_force_stuck_break()
+        self.assertTrue(should, "a reset monitor must not erase a live loop")
+        self.assertIn("identical tool call", reason)
+
+    def test_it_only_extends_never_double_counts(self):
+        # The incremental path appends one fingerprint per request; seeding must
+        # not stack on top of that and inflate the streak.
+        mon = self.proxy.SessionMonitor(context_window=100000)
+        for _ in range(6):
+            mon.record_tool_calls(tool_names=["Bash"], fingerprint="Bash|x")
+        before = list(mon.tool_call_history)
+        self.proxy._seed_tool_history_from_request(mon, self.convo(2))
+        self.assertEqual(mon.tool_call_history, before)
+
+    def test_varied_history_is_reconstructed_without_tripping(self):
+        mon = self.proxy.SessionMonitor(context_window=100000)
+        msgs = [{"role": "user", "content": "go"}]
+        for i, cmd in enumerate(["ls", "npm test", "git status", "npm run build", "ls -la"]):
+            msgs.append({"role": "assistant", "content": [
+                {"type": "tool_use", "id": f"t{i}", "name": "Bash", "input": {"command": cmd}}]})
+        self.proxy._seed_tool_history_from_request(mon, msgs)
+        # 5 assistant turns, 4 seeded: the last is deliberately left for the
+        # incremental path to append, so the current turn is not counted twice.
+        self.assertEqual(len(mon.tool_call_history), 4)
+        should, _ = mon.should_force_stuck_break()
+        self.assertFalse(should)
+
+    def test_it_is_bounded(self):
+        mon = self.proxy.SessionMonitor(context_window=100000)
+        self.proxy._seed_tool_history_from_request(mon, self.convo(200))
+        self.assertLessEqual(len(mon.tool_call_history), 30)
+
+    def test_malformed_input_is_survivable(self):
+        mon = self.proxy.SessionMonitor(context_window=100000)
+        for bad in (None, "not-a-list", [], [None, 3, {"role": "assistant"}],
+                    [{"role": "assistant", "content": "plain text"}]):
+            self.proxy._seed_tool_history_from_request(mon, bad)
+        self.assertEqual(mon.tool_call_history, [])