@miller-tech/uap 1.186.2 → 1.187.3

package/dist/models/long-fetch.js

@@ -18,6 +18,16 @@
  */
 import { Agent } from 'undici';
 const globalFetch = (url, init) => globalThis.fetch(url, init);
+/**
+ * Marks a failure as "the model endpoint is not reachable".
+ *
+ * A greppable prefix rather than an Error subclass because it has to survive
+ * being stringified into an executor error string and read back by the
+ * convergence loop, which never sees the original Error object. Lives here, in
+ * the transport module, so both the executor that raises it and the loop that
+ * consumes it can import it without a cycle.
+ */
+export const ENDPOINT_UNREACHABLE = 'ENDPOINT_UNREACHABLE';
 const DEFAULT_MODEL_HTTP_TIMEOUT_MS = 30 * 60 * 1000;
 const CONNECT_TIMEOUT_MS = 30_000;
 const DEFAULT_RETRIES = 2;
@@ -51,6 +61,43 @@ const TRANSIENT_CODES = new Set([
     'UND_ERR_CONNECT_TIMEOUT',
     'UND_ERR_SOCKET',
 ]);
+/**
+ * Codes that mean the connection could never be ESTABLISHED — nothing is
+ * listening, or the name does not resolve.
+ *
+ * Deliberately a strict subset of TRANSIENT_CODES, and deliberately NOT reused
+ * from it. The transient set answers "is a retry safe?", which is a different
+ * question from "is the endpoint dead?", and most of it means *reachable but
+ * flaky or slow*: ECONNRESET/EPIPE/UND_ERR_SOCKET are a dropped connection
+ * under load, and UND_ERR_*_TIMEOUT is a model still thinking past the
+ * 30-minute ceiling. Treating those as "unreachable" would kill a long,
+ * healthy run and tell the operator to go restart a proxy that is fine.
+ */
+const UNREACHABLE_CODES = new Set([
+    'ECONNREFUSED',
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'UND_ERR_CONNECT_TIMEOUT',
+]);
+/**
+ * True only when the endpoint could not be reached at all.
+ *
+ * Note the asymmetry with `isTransientNetworkError`: a bare
+ * `TypeError: fetch failed` with no cause code is NOT enough here. It is
+ * retryable (safe), but it does not say the listener is gone, and this
+ * predicate gates an abort.
+ */
+export function isEndpointUnreachable(err) {
+    if (!(err instanceof Error))
+        return false;
+    if (err.name === 'AbortError')
+        return false;
+    const cause = err.cause;
+    if (cause?.code && UNREACHABLE_CODES.has(cause.code))
+        return true;
+    const direct = err.code;
+    return Boolean(direct && UNREACHABLE_CODES.has(direct));
+}
 /** True for network-level failures worth retrying (never HTTP responses). */
 export function isTransientNetworkError(err) {
     if (!(err instanceof Error))

package/dist/models/long-fetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"long-fetch.js","sourceRoot":"","sources":["../../src/models/long-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAS/B,MAAM,WAAW,GAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAE,UAAU,CAAC,KAA8B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAEpG,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACrD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,MAAM,UAAU,kBAAkB;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC;AACzE,CAAC;AAED,IAAI,MAAM,GAAiB,IAAI,CAAC;AAChC,IAAI,aAAa,GAAG,CAAC,CAAC;AAEtB,SAAS,UAAU;IACjB,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,GAAG,IAAI,KAAK,CAAC;YACjB,cAAc,EAAE,OAAO;YACvB,WAAW,EAAE,OAAO;YACpB,cAAc,EAAE,kBAAkB;SACnC,CAAC,CAAC;QACH,aAAa,GAAG,OAAO,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,YAAY;IACZ,cAAc;IACd,OAAO;IACP,WAAW;IACX,WAAW;IACX,yBAAyB;IACzB,sBAAsB;IACtB,yBAAyB;IACzB,gBAAgB;CACjB,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,oEAAoE;IACpE,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAI,GAA6C,CAAC,KAAK,CAAC;IACnE,IAAI,KAAK,EAAE,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,MAAM,GAAI,GAAiC,CAAC,IAAI,CAAC;IACvD,IAAI,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,gEAAgE;IAChE,OAAO,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AAC1E,CAAC;AAaD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAiB,EACjB,IAAiB,EACjB,UAA6B,EAAE;IAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,WAAW,CAAC;IAE9C,IAAI,OAAgB,CAAC;IACrB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,GAAG,CAAC;YACd,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,OAAO;gBAAE,MAAM,GAAG,CAAC;YACpE,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;YACpC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC,CAAC,sCAAsC;AACvD,CAAC"}
+{"version":3,"file":"long-fetch.js","sourceRoot":"","sources":["../../src/models/long-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAS/B,MAAM,WAAW,GAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAE,UAAU,CAAC,KAA8B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAEpG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACrD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,MAAM,UAAU,kBAAkB;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC;AACzE,CAAC;AAED,IAAI,MAAM,GAAiB,IAAI,CAAC;AAChC,IAAI,aAAa,GAAG,CAAC,CAAC;AAEtB,SAAS,UAAU;IACjB,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,GAAG,IAAI,KAAK,CAAC;YACjB,cAAc,EAAE,OAAO;YACvB,WAAW,EAAE,OAAO;YACpB,cAAc,EAAE,kBAAkB;SACnC,CAAC,CAAC;QACH,aAAa,GAAG,OAAO,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,YAAY;IACZ,cAAc;IACd,OAAO;IACP,WAAW;IACX,WAAW;IACX,yBAAyB;IACzB,sBAAsB;IACtB,yBAAyB;IACzB,gBAAgB;CACjB,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,cAAc;IACd,WAAW;IACX,WAAW;IACX,yBAAyB;CAC1B,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAI,GAA6C,CAAC,KAAK,CAAC;IACnE,IAAI,KAAK,EAAE,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,MAAM,GAAI,GAAiC,CAAC,IAAI,CAAC;IACvD,OAAO,OAAO,CAAC,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,oEAAoE;IACpE,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAI,GAA6C,CAAC,KAAK,CAAC;IACnE,IAAI,KAAK,EAAE,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,MAAM,GAAI,GAAiC,CAAC,IAAI,CAAC;IACvD,IAAI,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,gEAAgE;IAChE,OAAO,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AAC1E,CAAC;AAaD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAiB,EACjB,IAAiB,EACjB,UAA6B,EAAE;IAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,WAAW,CAAC;IAE9C,IAAI,OAAgB,CAAC;IACrB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,GAAG,CAAC;YACd,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,OAAO;gBAAE,MAAM,GAAG,CAAC;YACpE,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;YACpC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC,CAAC,sCAAsC;AACvD,CAAC"}

package/dist/telemetry/tool-failure.d.ts

@@ -21,6 +21,15 @@
 export type ToolOutcomeClass = 
 /** Call succeeded with no caveat. */
 'ok'
+/**
+ * The call was accepted but changed NOTHING — a write or edit whose result
+ * already matched the file. Neither a success nor a failure: the tool did
+ * exactly what it was told, and the turn made no progress. It gets its own
+ * class because folding it into `ok` is what the no-op guards exist to stop —
+ * the corpus would report edit tooling as healthy precisely while a run is
+ * spinning on repeated no-op edits.
+ */
+ | 'no-op'
 /** Succeeded, but only via the whitespace-tolerant edit rung (anchor drift). */
  | 'ok-tolerant'
 /** `old_string` matched nothing. The dominant edit-tool failure. */

package/dist/telemetry/tool-failure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-failure.d.ts","sourceRoot":"","sources":["../../src/telemetry/tool-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;GAGG;AACH,MAAM,MAAM,gBAAgB;AAC1B,qCAAqC;AACnC,IAAI;AACN,gFAAgF;GAC9E,aAAa;AACf,oEAAoE;GAClE,WAAW;AACb,sEAAsE;GACpE,gBAAgB;AAClB,oDAAoD;GAClD,eAAe;AACjB,sCAAsC;GACpC,gBAAgB;AAClB,qCAAqC;GACnC,aAAa;AACf,wEAAwE;GACtE,gBAAgB;AAClB,uEAAuE;GACrE,cAAc;AAChB,4CAA4C;GAC1C,iBAAiB;AACnB,gDAAgD;GAC9C,gBAAgB;AAClB,qCAAqC;GACnC,SAAS;AACX,kDAAkD;GAChD,cAAc;AAChB,iFAAiF;GAC/E,SAAS;AACX,uEAAuE;GACrE,iBAAiB;AACnB,gDAAgD;GAC9C,aAAa,CAAC;AAElB,kFAAkF;AAClF,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;AAoB1F,wBAAgB,cAAc,CAAC,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAE3D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAiDjF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAc/D"}
+{"version":3,"file":"tool-failure.d.ts","sourceRoot":"","sources":["../../src/telemetry/tool-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;GAGG;AACH,MAAM,MAAM,gBAAgB;AAC1B,qCAAqC;AACnC,IAAI;AACN;;;;;;;GAOG;GACD,OAAO;AACT,gFAAgF;GAC9E,aAAa;AACf,oEAAoE;GAClE,WAAW;AACb,sEAAsE;GACpE,gBAAgB;AAClB,oDAAoD;GAClD,eAAe;AACjB,sCAAsC;GACpC,gBAAgB;AAClB,qCAAqC;GACnC,aAAa;AACf,wEAAwE;GACtE,gBAAgB;AAClB,uEAAuE;GACrE,cAAc;AAChB,4CAA4C;GAC1C,iBAAiB;AACnB,gDAAgD;GAC9C,gBAAgB;AAClB,qCAAqC;GACnC,SAAS;AACX,kDAAkD;GAChD,cAAc;AAChB,iFAAiF;GAC/E,SAAS;AACX,uEAAuE;GACrE,iBAAiB;AACnB,gDAAgD;GAC9C,aAAa,CAAC;AAElB,kFAAkF;AAClF,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;AAoB1F,wBAAgB,cAAc,CAAC,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAE3D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAoDjF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAc/D"}

package/dist/telemetry/tool-failure.js

@@ -66,6 +66,10 @@ export function classifyToolResult(tool, result) {
         return lower.startsWith('error:') ? 'other-error' : 'ok';
     }
     if (!lower.startsWith('error:')) {
+        // Checked BEFORE the tolerant note: a no-op reached through the tolerant
+        // rung still changed nothing, and "no progress" is the more important fact.
+        if (lower.startsWith('no-op:'))
+            return 'no-op';
         // Success paths. The tolerant-match note is a success WITH a signal: the
         // model's anchors are drifting, which predicts future misses.
         if (lower.includes('did not match byte-for-byte'))

package/dist/telemetry/tool-failure.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-failure.js","sourceRoot":"","sources":["../../src/telemetry/tool-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA2CH,gEAAgE;AAChE,MAAM,eAAe,GAAkC,IAAI,GAAG,CAAmB;IAC/E,SAAS;IACT,iBAAiB;IACjB,WAAW;IACX,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,cAAc;IACd,iBAAiB;IACjB,gBAAgB;IAChB,SAAS;IACT,cAAc;IACd,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAAC,CAAmB;IAChD,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,MAAc;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAEjC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,cAAc,CAAC;IAE1D,2EAA2E;IAC3E,2EAA2E;IAC3E,+EAA+E;IAC/E,oEAAoE;IACpE,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,UAAU,CAAC,sBAAsB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,SAAS,CAAC;QAChG,yEAAyE;QACzE,8CAA8C;QAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,iBAAiB,CAAC;QACxF,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,SAAS,CAAC;QAClD,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC3D,OAAO,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,yEAAyE;QACzE,8DAA8D;QAC9D,IAAI,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC;YAAE,OAAO,aAAa,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mEAAmE;IACnE,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACnF,IAAI,KAAK,CAAC,QAAQ,CAAC,mCAAmC,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAEjF,IAAI,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAAE,OAAO,WAAW,CAAC;IAC/D,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAClG,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,eAAe,CAAC;IACvF,IAAI,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAAE,OAAO,aAAa,CAAC;IACjE,IACE,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAChC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjC,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACpC,KAAK,CAAC,QAAQ,CAAC,yCAAyC,CAAC,EACzD,CAAC;QACD,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,cAAc,CAAC;IAChF,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAC1D,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/E,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAC7F,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW,CAAC;QACjB,KAAK,YAAY,CAAC;QAClB,KAAK,YAAY,CAAC;QAClB,KAAK,WAAW,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,WAAW,CAAC;QACrB;YACE,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1D,CAAC;AACH,CAAC"}
+{"version":3,"file":"tool-failure.js","sourceRoot":"","sources":["../../src/telemetry/tool-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAoDH,gEAAgE;AAChE,MAAM,eAAe,GAAkC,IAAI,GAAG,CAAmB;IAC/E,SAAS;IACT,iBAAiB;IACjB,WAAW;IACX,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,cAAc;IACd,iBAAiB;IACjB,gBAAgB;IAChB,SAAS;IACT,cAAc;IACd,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAAC,CAAmB;IAChD,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,MAAc;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAEjC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,cAAc,CAAC;IAE1D,2EAA2E;IAC3E,2EAA2E;IAC3E,+EAA+E;IAC/E,oEAAoE;IACpE,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,UAAU,CAAC,sBAAsB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,SAAS,CAAC;QAChG,yEAAyE;QACzE,8CAA8C;QAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,iBAAiB,CAAC;QACxF,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,SAAS,CAAC;QAClD,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC3D,OAAO,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,yEAAyE;QACzE,4EAA4E;QAC5E,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,OAAO,CAAC;QAC/C,yEAAyE;QACzE,8DAA8D;QAC9D,IAAI,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC;YAAE,OAAO,aAAa,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mEAAmE;IACnE,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACnF,IAAI,KAAK,CAAC,QAAQ,CAAC,mCAAmC,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAEjF,IAAI,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAAE,OAAO,WAAW,CAAC;IAC/D,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAClG,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,eAAe,CAAC;IACvF,IAAI,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAAE,OAAO,aAAa,CAAC;IACjE,IACE,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAChC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjC,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACpC,KAAK,CAAC,QAAQ,CAAC,yCAAyC,CAAC,EACzD,CAAC;QACD,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,cAAc,CAAC;IAChF,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAC1D,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/E,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAC7F,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW,CAAC;QACjB,KAAK,YAAY,CAAC;QAClB,KAAK,YAAY,CAAC;QAClB,KAAK,WAAW,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,WAAW,CAAC;QACrB;YACE,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1D,CAAC;AACH,CAAC"}

package/docs/reference/CLI.md

@@ -398,8 +398,12 @@ uap deliver --await-run --await-timeout 45 # one poll, then report and return
 
 Exit codes for `--await-run` are distinct because three of the four outcomes are
 not failures: **0** delivered · **1** the mission ended badly · **3** nothing was
-running (go ahead and launch) · **4** still running — the wait gave up, the
-mission did not.
+running *on this root* · **4** still running — the wait gave up, the mission did
+not.
+
+A **3** normally means "safe to launch". The exception is a launch that was just
+refused because an *overlapping* root holds the run: follow that root instead —
+this one has nothing in flight and will keep answering 3.
 
 A `4` carries a `progress` object so consecutive polls can be compared. Always
 present: `heartbeatAgeSec`, `wedgeAfterSec`, `health`. Present only when the run
@@ -417,6 +421,13 @@ asserted:
 - `"wedged"` — silent past `UAP_DELIVER_WEDGE_TIMEOUT` (default 1800s, shared
   with the autoroute hook) and may be stuck.
 
+Single-flight is a property of the **subtree**, not of the lock path. A run also
+exits early when an older live run holds an *overlapping* (nested or identical)
+project root: `repo` and `repo/src/ext` edit the same files even though their
+`.uap/deliver.lock` paths differ. The refusal names the holder's root — follow
+*that* root, because following your own reports nothing in flight. Live runs
+register in `~/.uap/active-runs` (redirect with `UAP_ACTIVE_RUNS_DIR`).
+
 A wedged **lock** holder is reclaimed by the next launch. A resumed run holds no
 lock, so relaunching there does not reclaim it — it starts a second mission on
 the same tree; keep following instead. Never kill a deliver run by hand: that

package/docs/reference/CONFIGURATION.md

@@ -81,6 +81,8 @@ Top level: `version`, `project`, `memory`, `worktree`, `costOptimization`,
 | `UAP_DELIVER_AUTO` | `0` disables auto-deliver | enabled |
 | `UAP_DELIVER_UNTIL_DELIVERED` | `0` disables loop-until-delivered | enabled |
 | `UAP_DELIVER_SANDBOX` | Deliver sandbox root path | — |
+| `UAP_ACTIVE_RUNS_DIR` | Registry of live deliver runs, used for cross-root (nested-project) single-flight | `~/.uap/active-runs` |
+| `UAP_DELIVER_NO_LOCK` | `1` disables the per-project lock **and** the overlapping-root check; the run also becomes invisible to other runs' checks | enabled |
 | `UAP_HALO_TRACE` | `1` enables HALO tracing | off |
 | `UAP_HALO_TRACE_PATH` | HALO trace output file | `.uap/halo/traces.jsonl` |
 | `UAP_HALO_PROJECT_ID` | HALO project id | `uap` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.186.2",
+  "version": "1.187.3",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window",
+    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",

package/src/policies/enforcers/enforcement_infra_protect.py

@@ -246,6 +246,18 @@ def _laundered_infra_kill(cmd: str) -> bool:
 # exists to prevent. delivery_enforcement._deliver_lock_holder() has taken the
 # same precaution since the PID-reuse incident; this must not diverge from it.
 _PID_TOKEN_RE = re.compile(r"(?<![\w.])(-?\d{1,10})(?![\w.-])")
+# The label both deliver paths agree on, so the caller has one thing to compare.
+DELIVER_LABEL = "the deliver run in progress"
+
+# A deliver PROCESS, by argv. Deliberately separate from _STACK_ARGV_RE: a
+# deliver run is protected for a different reason than llama-server, and gets a
+# different remedy, so the two must not be told apart by string-matching the
+# combined pattern's output.
+_DELIVER_ARGV_RE = re.compile(
+    r"(\buap\s+deliver\b|(?:cli\.js|uap)\s+(?:\S+\s+)*deliver\b)",
+    re.IGNORECASE,
+)
+
 _STACK_ARGV_RE = re.compile(
     r"(llama-server|anthropic_proxy|nomic-embed"
     r"|\buap\s+deliver\b|(?:cli\.js|uap)\s+(?:\S+\s+)*deliver\b)",
@@ -276,7 +288,7 @@ def _lock_holder_pids() -> dict[str, str]:
             continue
         m = re.match(r"\s*(\d+)", text)
         if m:
-            holders[str(int(m.group(1)))] = "the deliver run in progress"
+            holders[str(int(m.group(1)))] = DELIVER_LABEL
     return holders
 
 
@@ -293,14 +305,61 @@ def _identify_pid(pid: str, holders: dict[str, str]) -> str | None:
         return None  # dead: a stale lock protects nothing
     m = _STACK_ARGV_RE.search(argv)
     if pid in holders:
-        # Confirm identity too — a recycled PID must not inherit the claim.
-        return holders[pid] if m else None
-    return m.group(1).lower() if m else None
+        # Confirm identity too — a recycled PID must not inherit the claim. The
+        # claim is "this is the deliver run", so confirm it with the DELIVER
+        # pattern: checking the combined stack pattern let a stale lock whose
+        # PID had been recycled by llama-server inherit the deliver label, and
+        # with it a remedy that does not apply to the stack.
+        if _DELIVER_ARGV_RE.search(argv):
+            return holders[pid]
+        return m.group(1).lower() if m else None
+    if not m:
+        return None
+    # Canonicalise a deliver match to the SAME label the lock-holder path uses.
+    # Without this the caller fell through to the inference-stack message, which
+    # told the operator that killing their own mission "ends your own session"
+    # and pointed at llama-server / the proxy — none of which is true. The
+    # lock-holder path only fires when the lock is under THIS repo, so any
+    # deliver launched against another project (the usual case) got the wrong
+    # message and the wrong remedy.
+    if _DELIVER_ARGV_RE.search(argv):
+        return DELIVER_LABEL
+    return m.group(1).lower()
+
+
+_PROBE_RE = re.compile(r"\bkill\b\s+(?:-0\b|-s\s+0\b|-s\s+SIGNULL\b)", re.IGNORECASE)
+
+
+def _only_liveness_probes(text: str) -> bool:
+    """True when EVERY kill in `text` is `kill -0` / `kill -s 0` — a probe.
+
+    Signal 0 performs error checking only: it tests whether the PID exists and
+    is signalable, and delivers nothing. Refusing it protects nothing and denies
+    the cheapest way to ask "is that run still alive?".
+
+    Scoped per STATEMENT, and deliberately so. Testing the whole command instead
+    let one probe anywhere switch rule 9 off for every PID in the text, so
+    `kill -0 $P && kill -9 $P` — the canonical "kill it if it is alive" idiom,
+    and the `if kill -0 …; then kill -9 …; fi` form — reached the stack. Rule 9
+    is the ONLY guard on a bare-PID kill (rules 1-8 all need pkill/killall, a
+    service name, a -f pattern or a lookup verb), so a whole-text exemption
+    turned this module's one un-spell-around-able rule into a text rule whose
+    password was two characters. Measured before the fix: all four laundering
+    spellings were allowed.
+    """
+    kills = [
+        seg for seg in _STATEMENT_SPLIT_RE.split(text) if _KILL_VERB_RE.search(seg)
+    ]
+    if not kills:
+        return False
+    return all(_PROBE_RE.search(seg) for seg in kills)
 
 
 def _protected_pid_hit(text: str) -> tuple[str, str] | None:
     if not (_KILL_VERB_RE.search(text) and _PID_TOKEN_RE.search(text)):
         return None
+    if _only_liveness_probes(text):
+        return None
     holders = _lock_holder_pids()
     seen: set[str] = set()
     for m in _PID_TOKEN_RE.finditer(text):
@@ -325,6 +384,10 @@ DELIVER_PID_REASON = (
     "call the deliver tool with follow:true, which answers within about a "
     "minute; a 'STILL RUNNING' answer is normal and means keep polling, not "
     "fail. From a shell, `uap deliver --await-run` blocks until the run ends. "
+    "If it genuinely must stop, do NOT kill it: request the COOPERATIVE stop "
+    "(the dashboard's Cancel, or `touch <projectRoot>/.uap/deliver-runs/<runId>/STOP`) — "
+    "the loop observes it at the next turn boundary and exits with its work "
+    "checkpointed and the lock released, which a signal does not. "
     "Operator override: set UAP_INFRA_PROTECT_OFF=1 in the launch environment "
     "(not inline on the command)."
 )
@@ -438,7 +501,7 @@ def main() -> None:
         hit = _protected_pid_hit(text)
         if hit:
             pid, what = hit
-            if what == "the deliver run in progress":
+            if what == DELIVER_LABEL:
                 emit(False, DELIVER_PID_REASON.format(pid=pid) + label)
             emit(False, STACK_PID_REASON.format(what=what, pid=pid) + label)
     emit(True, "no infra-destructive pattern")

package/src/policies/enforcers/enforcement_self_protect.py

@@ -75,7 +75,27 @@ BYPASS_PATTERNS = (
     # not an override — it is an off switch, the same reasoning as every entry
     # above it.
     re.compile(r"UAP_DELIVER_NO_LOCK\s*=\s*['\"]?1", re.I),
+    # The gateless-root refusal exists BECAUSE an agent-driven launch does not
+    # honour a warning: the warning shipped, fired, named the right root, and
+    # the run went ahead at the gateless root anyway, then spent 34 minutes
+    # taking a crate from 1 failing test to 3 while reporting "100% of gates".
+    # A hatch the constrained party can write into its own command line is not
+    # an override, it is an off switch — same reasoning as every entry above.
+    # The CLI-flag spelling is just as self-grantable, but it is matched
+    # separately below: a bare flag NAME appears in ordinary prose (docs,
+    # commit messages, `grep`), so scanning the raw command for it refused
+    # honest work. It runs against `scannable_command`, which blanks quoted
+    # blobs, instead.
+    re.compile(r"UAP_ALLOW_GATELESS_ROOT\s*=\s*['\"]?1", re.I),
 )
+
+# The gateless-root override in its CLI-flag spelling. Anchored on both sides
+# so a longer option that merely starts the same way does not collide, and
+# case-sensitive because commander does not accept an upper-case spelling.
+GATELESS_FLAG_RE = re.compile(r"(?:^|\s)--allow-gateless-root(?:[=\s]|$)")
+# Only a deliver invocation can be bypassed by the flag. `\b` keeps this off
+# `src/delivery/`, which merely starts with the same letters.
+DELIVER_INVOCATION_RE = re.compile(r"\bdeliver\b")
 # Destructive ops against the enforcer/policy surface.
 #
 # HONEST SCOPE: this is a NUDGE, not a boundary. An agent that can write a file
@@ -419,6 +439,22 @@ def main() -> None:
 
     if op in {"Bash", "bash"}:
         cmd = args.get("command") or ""
+        # The flag form is checked against the SCANNABLE command, not the raw
+        # one: `scannable_command` blanks multi-word quoted blobs, so a commit
+        # message or a `uap memory store "..."` that merely NAMES the switch is
+        # not refused, while text handed to a shell is left intact and still
+        # caught. It must ALSO look like a deliver invocation — the flag does
+        # nothing anywhere else, so refusing `rg -- <flag> src/` bought no
+        # security and blocked someone auditing the switch.
+        _scannable = scannable_command(cmd)
+        if GATELESS_FLAG_RE.search(_scannable) and DELIVER_INVOCATION_RE.search(_scannable):
+            emit(
+                False,
+                "BLOCKED: setting a delivery-enforcement bypass/advisory flag is "
+                "not allowed for the agent. Route your change through the "
+                "`deliver` tool instead of disabling the gate. "
+                "(Operator-only override: UAP_SELF_PROTECT_OFF=1.)",
+            )
         for pat in BYPASS_PATTERNS:
             if pat.search(cmd):
                 emit(

package/templates/hooks/pre-tool-use-bash.sh

@@ -122,8 +122,16 @@ if echo "$CMD" | grep -qE '\bgit\s+reset\s+--hard\b|\bgit\s+clean\s+-[a-z]*f'; t
 fi
 
 # ─── Manual Version Edit Protection ─────────────────────────────
-# Block direct edits to package.json version field via sed/awk
-if echo "$CMD" | grep -qE "(sed|awk).*package\.json.*(version|\"version\")|((sed|awk).*version.*package\.json)|(jq.*\.version.*package\.json)"; then
+# Block direct edits to package.json version field via sed/awk/jq.
+#
+# Scoped to a single shell STATEMENT. Matching across the whole command line
+# meant any sed/awk anywhere plus `package.json` and `version` anywhere later
+# tripped it, so reading the version alongside unrelated text munging was
+# refused:  `curl ... | sed 's/^/x/'; node -p "require('./package.json').version"`
+# That is a READ. Splitting on ; && || | and newline keeps every real edit
+# (each has sed/awk/jq and package.json inside one statement) and drops the
+# cross-statement coincidence. Verified against both corpora before and after.
+if printf '%s' "$CMD" | tr ';|&\n' '\n\n\n\n' | grep -qE "(sed|awk).*package\.json.*(version|\"version\")|((sed|awk).*version.*package\.json)|(jq.*\.version.*package\.json)"; then
   echo "BLOCKED [semver-versioning]: Manual package.json version edits are prohibited. Use: npm run version:patch, version:minor, or version:major. See policies/semver-versioning.md" >&2
   exit 2
 fi

package/templates/hooks/uap-policy-gate.sh

@@ -169,7 +169,10 @@ if not hit and cmd:
                 break
 bypass = re.search(
     r"UAP_DELIVER_BYPASS\s*=\s*[\x27\"]?1|UAP_ENFORCE_DELIVERY\s*=\s*[\x27\"]?(advisory|off|0|false|no)"
-    r"|UAP_SELF_PROTECT_OFF\s*=\s*[\x27\"]?1|UAP_NO_WORKTREE\s*=\s*[\x27\"]?1|UAP_WORKDIR_SCOPE_OFF\s*=\s*[\x27\"]?1|UAP_USER_VALIDATION\s*=\s*[\x27\"]?0",
+    r"|UAP_SELF_PROTECT_OFF\s*=\s*[\x27\"]?1|UAP_NO_WORKTREE\s*=\s*[\x27\"]?1"
+    r"|UAP_WORKDIR_SCOPE_OFF\s*=\s*[\x27\"]?1|UAP_USER_VALIDATION\s*=\s*[\x27\"]?0"
+    r"|UAP_DELIVER_NO_LOCK\s*=\s*[\x27\"]?1|UAP_NO_REVIEW\s*=\s*[\x27\"]?1"
+    r"|UAP_INFRA_PROTECT_OFF\s*=\s*[\x27\"]?1|UAP_ALLOW_GATELESS_ROOT\s*=\s*[\x27\"]?1",
     cmd, re.I)
 print("1" if (hit or bypass) else "0")
 ' 2>/dev/null || echo 1)"

package/tools/agents/scripts/anthropic_proxy.py

@@ -374,6 +374,30 @@ _RATE_LIMITED_API_RE = re.compile(r"api\.github\.com", re.IGNORECASE)
 PROXY_STUCK_TEXT_THRESHOLD = int(os.environ.get("PROXY_STUCK_TEXT_THRESHOLD", "2"))
 PROXY_STUCK_API_THRESHOLD = int(os.environ.get("PROXY_STUCK_API_THRESHOLD", "3"))
 
+# REPEAT-CALL guardrail: the same tool call, with the same arguments, over and
+# over -- while SUCCEEDING every time.
+#
+# Observed live (opencode + qwen3.6, 2026-08-07): `git diff --stat` re-issued 44
+# times in one run, ~2.5s apart, until the operator interrupted. On screen it
+# reads as the final message repeating forever.
+#
+# Every existing guard missed it, and each for a defensible reason:
+#   STUCK-BREAK  needs self-reported "stuck" phrasing or an api.github.com arg.
+#   ERROR-LOOP   needs a repeated tool-RESULT error signature; this call works.
+#   LOOP BREAKER detects the identical fingerprint, but is ANDed with
+#                no_progress_streak -- and a command that returns output every
+#                time never accumulates one, so the condition never holds.
+#
+# The blind spot is therefore a repeatedly-SUCCESSFUL identical call: the other
+# guards all key off failure or self-awareness, and this loop has neither. A
+# read-only command issued four times with identical arguments is not a
+# strategy, so this fires on the fingerprint alone, independent of outcome.
+# PROXY_REPEAT_CALL_THRESHOLD=0 disables.
+PROXY_REPEAT_CALL_THRESHOLD = int(os.environ.get("PROXY_REPEAT_CALL_THRESHOLD", "4"))
+# Marker so the injected directive can address a SUCCEEDING loop correctly
+# rather than telling the model to stop retrying "a failing action".
+_REPEAT_CALL_REASON = "identical tool call"
+
 # ---------------------------------------------------------------------------
 # ERROR-LOOP guardrail: the model edits, runs a command, hits the SAME failure,
 # edits again (a DIFFERENT edit), runs, hits the same failure — for many turns.
@@ -1993,6 +2017,14 @@ class SessionMonitor:
             return True, f"self-reported stuck x{self.self_stuck_streak}"
         if self.rate_limited_api_streak >= PROXY_STUCK_API_THRESHOLD:
             return True, f"rate-limited-API retries x{self.rate_limited_api_streak}"
+        # Repeated identical call, judged on the fingerprint ALONE. Deliberately
+        # not ANDed with no_progress_streak the way the LOOP BREAKER is: a call
+        # that succeeds every time never builds a no-progress streak, which is
+        # exactly how a 44-turn `git diff --stat` loop ran unchallenged.
+        if PROXY_REPEAT_CALL_THRESHOLD > 0:
+            looping, count = self.detect_tool_loop(window=PROXY_REPEAT_CALL_THRESHOLD)
+            if looping and count >= PROXY_REPEAT_CALL_THRESHOLD:
+                return True, f"{_REPEAT_CALL_REASON} x{count}"
         return False, ""
 
     def note_deferral_signal(self, text: str, had_tool_call: bool) -> None:
@@ -5677,6 +5709,51 @@ def _strip_sandbox_unreachable_tools(body: dict) -> int:
     return removed
 
 
+def _seed_tool_history_from_request(monitor: "SessionMonitor", messages: list) -> None:
+    """Rebuild the tool-call streak from the CONVERSATION, not from server state.
+
+    Every streak guard here counted appends to a per-session SessionMonitor. That
+    monitor is keyed `fp:<hash of the first user message>` whenever the client
+    sends no session header — and opencode sends none. So anything that shifts
+    that text (compaction, a re-summarised opening turn) silently starts a FRESH
+    monitor with empty history, and every streak restarts at zero. A proxy
+    restart mid-session does the same.
+
+    The client re-sends the whole conversation each turn, so the streak is
+    already in the request. Deriving it from there makes the guards independent
+    of monitor identity and of proxy uptime.
+
+    Only ever EXTENDS: if the monitor already knows at least as much as the
+    request implies, it is left alone, so this cannot double-count the normal
+    path that appends one fingerprint per request.
+    """
+    if not isinstance(messages, list):
+        return
+    rebuilt: list[str] = []
+    for msg in messages:
+        if not isinstance(msg, dict) or msg.get("role") != "assistant":
+            continue
+        content = msg.get("content")
+        if not isinstance(content, list):
+            continue
+        fps = [
+            _tool_call_fingerprint(b)
+            for b in content
+            if isinstance(b, dict) and b.get("type") == "tool_use"
+        ]
+        if fps:
+            rebuilt.append("|".join(sorted(fps)))
+    # Drop the LAST turn: the incremental path immediately appends that one, and
+    # seeding it here too would count the current turn twice — inflating every
+    # streak by one and firing the guards a turn early. Caught by two existing
+    # streaming tests, which replay one body three times and reached the
+    # threshold sooner than they should have.
+    rebuilt = rebuilt[:-1]
+    if len(rebuilt) > len(monitor.tool_call_history):
+        # Keep the same bound the incremental path uses.
+        monitor.tool_call_history = rebuilt[-30:]
+
+
 def _maybe_inject_stuck_break(openai_body: dict, monitor: "SessionMonitor") -> None:
     """Force a terminal turn when the model is looping self-awarely or hammering
     a rate-limited API. Unlike the cycle-breaker (which narrows tools), this
@@ -5697,15 +5774,29 @@ def _maybe_inject_stuck_break(openai_body: dict, monitor: "SessionMonitor") -> N
         if monitor.sandboxed
         else "use the browser tool or `git clone` (git protocol)"
     )
-    directive = (
-        "\n\nSTOP — you are repeating a failing action (" + reason + "). Do NOT "
-        "retry the same tool or fetch again. If a resource is unreachable (e.g. a "
-        "rate-limited GitHub REST API), switch channel: " + channel_hint + ", NOT "
-        "api.github.com. If it is still "
-        "unavailable, proceed WITHOUT it using what you already have, or ask the "
-        "operator the single blocking question in one sentence. Take a DIFFERENT "
-        "action now."
-    )
+    if reason.startswith(_REPEAT_CALL_REASON):
+        # The call SUCCEEDS every time, so "stop retrying a failing action" and
+        # the switch-channel advice would both be nonsense here. Name the real
+        # problem: the answer is already in hand and re-asking cannot change it.
+        directive = (
+            "\n\nSTOP — you have issued the same tool call with the same "
+            "arguments " + reason.rsplit("x", 1)[-1] + " times in a row. It "
+            "SUCCEEDED each time and the result will not change by asking again. "
+            "You already have that output. Do NOT repeat it. Either take the "
+            "NEXT concrete action using what it told you, or — if you genuinely "
+            "cannot proceed — state the single blocking question in one sentence "
+            "and stop. Answer in plain text now if the work is done."
+        )
+    else:
+        directive = (
+            "\n\nSTOP — you are repeating a failing action (" + reason + "). Do NOT "
+            "retry the same tool or fetch again. If a resource is unreachable (e.g. a "
+            "rate-limited GitHub REST API), switch channel: " + channel_hint + ", NOT "
+            "api.github.com. If it is still "
+            "unavailable, proceed WITHOUT it using what you already have, or ask the "
+            "operator the single blocking question in one sentence. Take a DIFFERENT "
+            "action now."
+        )
     msgs = openai_body.get("messages")
     if not isinstance(msgs, list):
         msgs = []
@@ -7095,6 +7186,7 @@ def _record_last_assistant_tool_calls(
                     _latest_err = any(_flags)
                 break
     monitor.note_tool_result_error(_latest_tr, _latest_err)
+    _seed_tool_history_from_request(monitor, messages)
     tool_fingerprints = []
     tool_targets: dict[str, str] = {}
     assistant_had_text = False  # Fix B: did the last assistant turn emit prose?