@miller-tech/uap 1.210.1 → 1.210.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.210.1",
+  "version": "1.210.3",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -119,6 +119,8 @@
     "src/policies/schemas/policies",
     "src/policies/enforcers",
     "tools/agents",
+    "scripts/lib",
+    "scripts/run-anthropic-proxy-continuity.sh",
     "scripts/setup",
     "scripts/version-bump.sh",
     "scripts/validate-build.sh",

package/scripts/lib/llama-upstream.sh

@@ -0,0 +1,226 @@
+#!/usr/bin/env bash
+# Resolve the live llama.cpp upstream for the Anthropic proxy.
+#
+# WHY: the upstream is not always a fixed port. Unsloth Studio restarts its
+# bundled llama-server on a NEW random port every launch (observed :50047 ->
+# :34407 -> :59879), while LLAMA_CPP_BASE is pinned in the proxy env file. The
+# moment Studio restarts, every local request fails with
+#   "Upstream connect failed after 3 attempts: ConnectError"  -> HTTP 529
+# and stays broken until someone hand-edits the env file. That env file is also
+# self-protect'd, so the agent cannot repair it — the stack sits dead.
+#
+# TRUST MODEL. A discovered endpoint receives every prompt and its replies drive
+# tool execution, so discovery is deliberately narrow:
+#   - The pin wins whenever it answers. A deliberate operator pin (remote host,
+#     second server) is never silently overridden by a local process.
+#   - Only loopback and wildcard binds are accepted. A llama-server bound to a
+#     specific non-loopback address is REJECTED rather than assumed to also be
+#     on 127.0.0.1 — that address may belong to a different user's socket.
+#   - A candidate must prove it is a chat-capable llama-server (/props shape +
+#     completion capability), not merely something returning 200. That rejects
+#     a decoy and, just as importantly, the embedding llama-server that also
+#     runs on this host.
+# Residual risk, accepted: a process running as THIS user can still name itself
+# llama-server and pass the shape checks. Such a process can already read the
+# source tree and the agent's files.
+#
+# Sourced by scripts/run-anthropic-proxy-continuity.sh. Also runnable directly:
+#   scripts/lib/llama-upstream.sh resolve http://127.0.0.1:8080/v1
+#
+# `curl` and `ss` are invoked by bare name (never absolute) so tests can stub
+# them on PATH and exercise the real code path. The TS counterpart is
+# src/utils/llama-discovery.ts — the two MUST agree; test/llama-upstream-parity
+# asserts it.
+
+# Strip the trailing /v1 (and any trailing slash) off an OpenAI-compatible base.
+llama_upstream_root() {
+    local base="${1:-}"
+    base="${base%/}"
+    base="${base%/v1}"
+    printf '%s' "$base"
+}
+
+# 0 if the base answers llama-server's /health with 200. Liveness only.
+# `--` terminates curl's options: a base beginning with `-` would otherwise be
+# read as a flag (e.g. -K reads an attacker-named config file).
+llama_upstream_alive() {
+    local base="${1:-}"
+    [ -n "$base" ] || return 1
+    local code
+    code="$(curl -s -o /dev/null -w '%{http_code}' --max-time "${UAP_LLAMA_PROBE_TIMEOUT:-2}" \
+        -- "$(llama_upstream_root "$base")/health" 2>/dev/null || true)"
+    [ "$code" = "200" ]
+}
+
+# 0 if the base looks like a chat-capable llama.cpp server. Applied to
+# DISCOVERED candidates only — an operator pin is taken at its word.
+llama_upstream_is_chat_server() {
+    local base="${1:-}" root props models
+    root="$(llama_upstream_root "$base")"
+
+    # /props carries llama-server's generation settings. A bare HTTP server, an
+    # error page, or a still-loading server does not.
+    props="$(curl -s --max-time "${UAP_LLAMA_PROBE_TIMEOUT:-2}" -- "${root}/props" 2>/dev/null || true)"
+    case "$props" in
+        *'"default_generation_settings"'*) ;;
+        *) return 1 ;;
+    esac
+
+    # Reject an embedding-only server (this host runs one). When the build does
+    # not report capabilities at all, accept — older llama.cpp omits the field.
+    models="$(curl -s --max-time "${UAP_LLAMA_PROBE_TIMEOUT:-2}" -- "${root}/v1/models" 2>/dev/null || true)"
+    case "$models" in
+        *'"capabilities"'*)
+            case "$models" in
+                *'"completion"'*) ;;
+                *) return 1 ;;
+            esac
+            ;;
+    esac
+    return 0
+}
+
+# Print the host:port of every locally listening llama-server, one per line,
+# already normalised to a loopback authority. Non-loopback binds are dropped.
+#
+# `ss -ltnp` attributes a process only to sockets the caller owns, which is the
+# case here (the server runs as the same user). Column 4 is Local Address:Port;
+# the port is the segment after the LAST colon so IPv6 forms survive.
+llama_upstream_candidate_authorities() {
+    ss -ltnp 2>/dev/null \
+        | grep -i 'users:(("llama-server"' \
+        | awk '{
+            n = split($4, a, ":");
+            port = a[n];
+            if (port !~ /^[0-9]+$/ || port+0 <= 0 || port+0 >= 65536) next;
+            addr = substr($4, 1, length($4) - length(port) - 1);
+            # Wildcard binds cover loopback, so 127.0.0.1 reaches the same
+            # socket. A specific non-loopback address does NOT imply loopback.
+            # Emit "port <tab> family-rank <tab> authority" so ordering is
+            # numeric by port and deterministic (IPv4 wins a tie) — matching
+            # src/utils/llama-discovery.ts exactly. Sorting the authority
+            # strings instead would order 10001 before 8080 and mangle [::1].
+            if (addr == "0.0.0.0" || addr == "*" || addr == "127.0.0.1") print port "\t0\t127.0.0.1:" port;
+            else if (addr == "[::]" || addr == "[::1]") print port "\t1\t[::1]:" port;
+        }' \
+        | sort -n -k1,1 -k2,2 \
+        | awk '!seen[$1]++ { print $3 }'
+}
+
+# Resolve the base to use. Echoes the preferred base untouched when it is
+# healthy, or when nothing better can be proven — never worse than the pin.
+llama_upstream_resolve() {
+    local preferred="${1:-}"
+
+    if llama_upstream_alive "$preferred"; then
+        printf '%s' "$preferred"
+        return 0
+    fi
+
+    if [ "${UAP_LLAMA_UPSTREAM_AUTODISCOVER:-on}" != "on" ]; then
+        printf '%s' "$preferred"
+        return 0
+    fi
+
+    local authority candidate
+    for authority in $(llama_upstream_candidate_authorities); do
+        candidate="http://${authority}/v1"
+        [ "$candidate" = "$preferred" ] && continue
+        if llama_upstream_alive "$candidate" && llama_upstream_is_chat_server "$candidate"; then
+            printf '%s' "$candidate"
+            return 0
+        fi
+    done
+
+    printf '%s' "$preferred"
+}
+
+# Port of a base URL ("http://192.168.1.165:8080/v1" -> "8080"). Empty when the
+# base carries no explicit port.
+llama_upstream_port() {
+    local authority="${1:-}"
+    authority="${authority#*://}"
+    authority="${authority%%/*}"
+    case "$authority" in
+        \[*\]:*) printf '%s' "${authority##*]:}" ;;   # [::1]:8080
+        \[*\]) : ;;                                   # [::1], no port
+        *:*) printf '%s' "${authority##*:}" ;;
+    esac
+}
+
+# Field 22 of /proc/<pid>/stat is the process start time. PID + starttime is an
+# identity; PID alone is not, and this repo has already been bitten by PID reuse
+# (see the deliver lock). Empty when the pid is gone.
+llama_upstream_pid_token() {
+    local pid="${1:-}"
+    [ -n "$pid" ] || return 0
+    awk '{ print $22 }' "/proc/${pid}/stat" 2>/dev/null || true
+}
+
+# Background guard: startup resolution alone still strands a LONG-LIVED proxy,
+# because llama can move ports hours after the proxy came up. Watch the upstream
+# and, once it is dead AND a DIFFERENT live server exists, stop the proxy so its
+# supervisor restarts it through resolve.
+#
+# ONLY safe under a supervisor — the caller gates on that. Two consecutive
+# failures are required before acting: a llama restart briefly shows no listener
+# at all, and reacting to that gap would bounce the proxy for nothing. Never
+# acts on a dead upstream alone, only on a proven live alternative, so an
+# intentionally stopped server does not cause a restart loop.
+llama_upstream_watch() {
+    local base="${1:-}" target_pid="${2:-}"
+    local interval="${UAP_LLAMA_UPSTREAM_WATCH_SECS:-20}"
+    local misses=0 found token now_token
+
+    case "$target_pid" in
+        ''|*[!0-9]*) return 0 ;;   # never signal a non-PID (kill -TERM -1 sprays)
+    esac
+    # A non-numeric interval makes `sleep` fail, which would end the loop and
+    # silently disable the guard. Fall back rather than vanish.
+    case "$interval" in
+        ''|*[!0-9.]*) interval=20 ;;
+    esac
+    token="$(llama_upstream_pid_token "$target_pid")"
+
+    while sleep "$interval"; do
+        now_token="$(llama_upstream_pid_token "$target_pid")"
+        # Gone, or the PID was recycled into someone else's process.
+        [ -n "$now_token" ] || return 0
+        [ "$now_token" = "$token" ] || return 0
+
+        if llama_upstream_alive "$base"; then
+            misses=0
+            continue
+        fi
+
+        misses=$((misses + 1))
+        [ "$misses" -ge 2 ] || continue
+
+        found="$(llama_upstream_resolve "$base")"
+        # "Moved" means a DIFFERENT PORT, not a different URL string. The
+        # documented pin is a LAN or localhost form (http://192.168.1.165:8080/v1,
+        # http://localhost:8080/v1) while a discovered candidate is always
+        # 127.0.0.1 — so comparing URLs calls the SAME server "moved" and bounces
+        # a healthy proxy every time the pin's address blips. A port change is
+        # the actual failure mode this watches for.
+        if [ -n "$found" ] && [ "$(llama_upstream_port "$found")" != "$(llama_upstream_port "$base")" ]; then
+            # Re-verify identity: resolve() above can take seconds.
+            now_token="$(llama_upstream_pid_token "$target_pid")"
+            [ "$now_token" = "$token" ] || return 0
+            echo "[proxy-upstream] upstream moved ${base} -> ${found}; restarting proxy to re-resolve" >&2
+            kill -TERM "$target_pid" 2>/dev/null || true
+            return 0
+        fi
+        misses=1
+    done
+}
+
+# Direct invocation: `llama-upstream.sh resolve <base>` / `alive <base>`.
+if [ "${BASH_SOURCE[0]}" = "${0}" ]; then
+    case "${1:-}" in
+        resolve) llama_upstream_resolve "${2:-}"; echo ;;
+        alive) llama_upstream_alive "${2:-}" ;;
+        authorities) llama_upstream_candidate_authorities ;;
+        *) echo "usage: ${0##*/} {resolve|alive|authorities} [base]" >&2; exit 2 ;;
+    esac
+fi

package/scripts/run-anthropic-proxy-continuity.sh

@@ -0,0 +1,136 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+# Fail-safe passthrough default: when ANTHROPIC_PASSTHROUGH_MODELS is unset OR
+# EMPTY, default it to __local_only__ (no api.anthropic.com forwarding) rather
+# than the code's empty=forward-cloud default. Set here in the ExecStart script
+# so it wins over systemd's EnvironmentFile (which overrides Environment=, so a
+# systemd Environment= pin cannot hold) and over the env file drifting back to
+# empty via `uap model routing use`/setup. An operator who genuinely wants cloud
+# passthrough sets an explicit non-empty value (a comma list of claude- ids),
+# which is preserved. This is the durable enforcement of the local-only policy.
+export ANTHROPIC_PASSTHROUGH_MODELS="${ANTHROPIC_PASSTHROUGH_MODELS:-__local_only__}"
+
+export PROXY_PORT="${PROXY_PORT:-4000}"
+export LLAMA_CPP_BASE="${LLAMA_CPP_BASE:-http://127.0.0.1:8080/v1}"
+export PROXY_LOG_LEVEL="${PROXY_LOG_LEVEL:-INFO}"
+
+# ---------------------------------------------------------------------------
+# Upstream resolution. LLAMA_CPP_BASE above is a PIN, and a pin goes stale:
+# Unsloth Studio restarts its bundled llama-server on a new random port each
+# launch (:50047 -> :34407 -> :59879 observed), after which every local request
+# 529s until the env file is hand-edited — and that file is self-protect'd, so
+# the agent cannot repair it. Resolve against reality instead: the pin is kept
+# whenever it answers /health, and only a proven-dead pin falls through to
+# discovering the live llama-server. Set UAP_LLAMA_UPSTREAM_AUTODISCOVER=off to
+# pin hard. Must run BEFORE the context-window probe below, which reads
+# LLAMA_CPP_BASE.
+# ---------------------------------------------------------------------------
+# Sourced defensively. Under `set -e` an unreadable lib would abort the script
+# BEFORE exec, and the unit's Restart=always/RestartSec=3 would then respawn it
+# every three seconds with no proxy at all — strictly worse than the stale pin
+# this resolves. scripts/lib is not in package.json `files`, so an installed
+# deployment can legitimately lack it. Degrade to the pin instead.
+_upstream_lib="${ROOT_DIR}/scripts/lib/llama-upstream.sh"
+if [ -r "$_upstream_lib" ]; then
+    # shellcheck source=lib/llama-upstream.sh
+    . "$_upstream_lib"
+else
+    echo "[proxy-startup] WARNING: ${_upstream_lib} missing; using pinned upstream without discovery" >&2
+    llama_upstream_resolve() { printf '%s' "${1:-}"; }
+    llama_upstream_root() { local b="${1:-}"; b="${b%/}"; printf '%s' "${b%/v1}"; }
+fi
+_resolved_base="$(llama_upstream_resolve "$LLAMA_CPP_BASE")"
+# An empty result would export LLAMA_CPP_BASE="" and degrade every upstream URL
+# to a bare "/chat/completions"; keep the pin instead.
+[ -n "$_resolved_base" ] || _resolved_base="$LLAMA_CPP_BASE"
+if [ "$_resolved_base" != "$LLAMA_CPP_BASE" ]; then
+    echo "[proxy-startup] pinned upstream ${LLAMA_CPP_BASE} is unreachable; using discovered ${_resolved_base}"
+    export LLAMA_CPP_BASE="$_resolved_base"
+else
+    echo "[proxy-startup] upstream: ${LLAMA_CPP_BASE}"
+fi
+
+export PROXY_LOOP_BREAKER="${PROXY_LOOP_BREAKER:-on}"
+export PROXY_LOOP_WINDOW="${PROXY_LOOP_WINDOW:-6}"
+export PROXY_LOOP_REPEAT_THRESHOLD="${PROXY_LOOP_REPEAT_THRESHOLD:-8}"
+export PROXY_FORCED_THRESHOLD="${PROXY_FORCED_THRESHOLD:-15}"
+export PROXY_NO_PROGRESS_THRESHOLD="${PROXY_NO_PROGRESS_THRESHOLD:-4}"
+export PROXY_CONTEXT_RELEASE_THRESHOLD="${PROXY_CONTEXT_RELEASE_THRESHOLD:-0.90}"
+export PROXY_GUARDRAIL_RETRY="${PROXY_GUARDRAIL_RETRY:-on}"
+export PROXY_SESSION_TTL_SECS="${PROXY_SESSION_TTL_SECS:-7200}"
+
+# Cross-session slot save/restore (UAP PR #179). Default ON: with
+# llama-server on --parallel 1 (a single slot), N agentic sessions
+# multiplexing the slot each evict the prior session's KV cache, forcing
+# 60-96s full prompt reprocesses (~17% of requests). The proxy saves the
+# outgoing session's slot state and restores the incoming session's on a
+# switch. PROXY_SLOT_SAVE_DIR must match llama-server's --slot-save-path
+# (run-llama-server-continuity.sh LLAMA_SLOT_SAVE_PATH). Set
+# PROXY_SLOT_SAVE_RESTORE=off to disable.
+export PROXY_SLOT_SAVE_RESTORE="${PROXY_SLOT_SAVE_RESTORE:-on}"
+export PROXY_SLOT_SAVE_DIR="${PROXY_SLOT_SAVE_DIR:-${HOME}/.cache/uap/llama-slots}"
+export PROXY_SLOT_CACHE_MAX_FILES="${PROXY_SLOT_CACHE_MAX_FILES:-12}"
+
+export PROXY_TOOL_CALL_GRAMMAR="${PROXY_TOOL_CALL_GRAMMAR:-on}"
+export PROXY_TOOL_CALL_GRAMMAR_REQUIRED_ONLY="${PROXY_TOOL_CALL_GRAMMAR_REQUIRED_ONLY:-on}"
+export PROXY_TOOL_CALL_GRAMMAR_PATH="${PROXY_TOOL_CALL_GRAMMAR_PATH:-${ROOT_DIR}/tools/agents/config/tool-call.gbnf}"
+
+# Structured thinking grammar (opt-in). When on, non-tool reasoning turns
+# are constrained to emit a compact <think> Q/M/K/R/V header before output.
+export PROXY_THINKING_GRAMMAR="${PROXY_THINKING_GRAMMAR:-off}"
+export PROXY_THINKING_GRAMMAR_PATH="${PROXY_THINKING_GRAMMAR_PATH:-${ROOT_DIR}/tools/agents/config/thinking.gbnf}"
+
+# ---------------------------------------------------------------------------
+# Auto-detect context window from upstream llama-server /slots endpoint.
+# Waits up to 60s for the server to be ready. Falls back to env var or 131072.
+# This ensures the proxy always matches the server's actual per-slot context,
+# even after server restarts with different --ctx-size / --parallel settings.
+# ---------------------------------------------------------------------------
+if [ "${PROXY_CONTEXT_WINDOW:-0}" = "0" ]; then
+    # Was an inline ${LLAMA_CPP_BASE/\/v1/} substitution, which strips the FIRST
+    # "/v1" anywhere in the string; llama_upstream_root strips only a trailing
+    # one. Same job, one rule.
+    SLOTS_URL="$(llama_upstream_root "$LLAMA_CPP_BASE")/slots"
+    echo "[proxy-startup] Detecting context window from ${SLOTS_URL}..."
+    for i in $(seq 1 30); do
+        CTX=$(curl -sf --max-time 2 -- "$SLOTS_URL" 2>/dev/null \
+            | python3 -c "import sys,json; print(json.load(sys.stdin)[0]['n_ctx'])" 2>/dev/null)
+        if [ -n "$CTX" ] && [ "$CTX" -gt 0 ]; then
+            export PROXY_CONTEXT_WINDOW="$CTX"
+            echo "[proxy-startup] Auto-detected context window: ${CTX} tokens"
+            break
+        fi
+        sleep 2
+    done
+    if [ "${PROXY_CONTEXT_WINDOW:-0}" = "0" ]; then
+        export PROXY_CONTEXT_WINDOW=131072
+        echo "[proxy-startup] WARNING: Could not detect context, using default: 131072"
+    fi
+fi
+
+cd "$ROOT_DIR"
+
+# Startup resolution alone still strands a LONG-LIVED proxy: llama can move
+# ports hours after the proxy came up. Watch it in the background and stop the
+# proxy once the upstream has demonstrably moved, so the supervisor restarts it
+# through resolution above. $$ is the proxy's PID after the exec below, and the
+# watcher dies with it via the unit's control group.
+#
+# SUPERVISED ONLY. src/cli/proxy.ts also launches this script as a detached,
+# unsupervised `spawn(...)` when the systemd unit is not installed (fresh
+# installs, UAP_PROXY_NO_SYSTEMD=1, containers, bench hosts). There, stopping
+# the proxy is not a restart — it is the end of the proxy, which is strictly
+# worse than pointing at a dead upstream, and on a bench host it would score as
+# model failure rather than infrastructure failure. systemd sets INVOCATION_ID,
+# so use it as the supervisor probe. UAP_LLAMA_UPSTREAM_WATCH=on forces the
+# watcher on (for another supervisor), =off disables it everywhere.
+_watch="${UAP_LLAMA_UPSTREAM_WATCH:-auto}"
+if command -v llama_upstream_watch >/dev/null 2>&1 &&
+   { [ "$_watch" = "on" ] || { [ "$_watch" = "auto" ] && [ -n "${INVOCATION_ID:-}" ]; }; }; then
+    llama_upstream_watch "$LLAMA_CPP_BASE" "$$" &
+fi
+
+exec python3 tools/agents/scripts/anthropic_proxy.py

package/tools/agents/tests/test_confidence_escalation.py

@@ -9,11 +9,17 @@ mod_path = Path(__file__).resolve().parents[3] / "tools" / "agents" / "scripts"
 spec = importlib.util.spec_from_file_location("confidence_escalation", mod_path)
 ce = importlib.util.module_from_spec(spec)
 sys.modules["confidence_escalation"] = ce
-import tempfile, os as _os2
-_os2.environ["UAP_RECIPE_SIGNAL_DIR"] = tempfile.mkdtemp(prefix="uap-sig-")
+import atexit, shutil, tempfile, os as _os2
+_sig_dir = tempfile.mkdtemp(prefix="uap-sig-")
+_os2.environ["UAP_RECIPE_SIGNAL_DIR"] = _sig_dir
 # Isolate the (now auto-on) real-time adaptation dir to an empty temp so no test
 # accidentally reads a stray ~/.cache adaptation signal from the dev machine.
-_os2.environ["UAP_ADAPTATION_SIGNAL_DIR"] = tempfile.mkdtemp(prefix="uap-adapt-empty-")
+_adapt_dir = tempfile.mkdtemp(prefix="uap-adapt-empty-")
+_os2.environ["UAP_ADAPTATION_SIGNAL_DIR"] = _adapt_dir
+# These leaked one dir per suite run into RAM-backed /tmp (26k accumulated by
+# 2026-08-16 — the enforcer suite runs on every commit). Clean up on exit.
+atexit.register(shutil.rmtree, _sig_dir, True)
+atexit.register(shutil.rmtree, _adapt_dir, True)
 spec.loader.exec_module(ce)