@miller-tech/uap 1.210.3 → 1.210.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.210.3",
+  "version": "1.210.5",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window",
+    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window tools.agents.tests.test_thinking_template_kwargs",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",

package/tools/agents/scripts/anthropic_proxy.py

@@ -54,8 +54,10 @@ Configuration (Environment Variables)
     PROXY_MAX_CONNECTIONS   Max concurrent connections to upstream
                             Default: 20
 
-    PROXY_CONTEXT_WINDOW   Override context window size (auto-detected from
-                           upstream /slots endpoint if not set)
+    PROXY_CONTEXT_WINDOW   Startup FALLBACK for the context window, used only
+                           when the upstream /slots probe fails. The detected
+                           rail wins (re-checked every 60s) and is what
+                           /v1/models advertises. Not a cap.
                            Default: 0 (auto-detect)
 
     PROXY_CONTEXT_PRUNE_THRESHOLD   Fraction of context window at which
@@ -1451,12 +1453,48 @@ def _apply_json_response_grammar(openai_body: dict, anthropic_body: dict) -> Non
     if openai_body.get("tools") or openai_body.get("grammar"):
         return
     openai_body["grammar"] = JSON_RESPONSE_GBNF
-    openai_body["enable_thinking"] = False
-    ctk = openai_body.setdefault("chat_template_kwargs", {})
-    ctk["enable_thinking"] = False
+    _set_thinking(openai_body, False)
     logger.info("JSON-RESPONSE grammar applied (evaluator verdict turn)")
 
 
+def _set_thinking(body: dict, enabled: bool) -> None:
+    """Turn upstream reasoning on/off, in BOTH places llama.cpp reads.
+
+    The top-level `enable_thinking` field alone does NOTHING on a `--jinja`
+    server: the Qwen chat template reads `chat_template_kwargs`, and this one is
+    launched with `--chat-template-kwargs {"enable_thinking": true}`, so an
+    unqualified top-level flag is silently overridden by the template default.
+
+    Measured on the live server, identical tool-call prompt:
+        top-level only                     -> 703 chars of reasoning, 196 tokens
+        chat_template_kwargs               ->   0 chars,                27 tokens
+    and on a planning-flavoured prompt with max_tokens=700, reasoning consumed
+    the ENTIRE budget and no tool call was emitted at all.
+
+    The OPERATOR switches — PROXY_DISABLE_THINKING_ALWAYS and
+    PROXY_DISABLE_THINKING_ON_TOOL_TURNS, plus the tool-turn breakers — set only
+    the top-level field, so they were no-ops against a jinja server: they
+    existed, logged themselves as active, and changed nothing. The paths that
+    already set both (the JSON-verdict grammar, the empty-max_tokens retry, and
+    the prefill/continuation turn) worked, which is why evaluator turns were
+    unaffected and this went unnoticed elsewhere.
+
+    Use this for a switch that expresses INTENT ("this turn must not reason").
+    The Anthropic protocol-default translation deliberately does NOT use it —
+    see the comment there; making a default authoritative would change serving
+    policy for every client rather than fix a broken control.
+    """
+    body["enable_thinking"] = enabled
+    # REPLACE the nested dict rather than mutate it: callers build retry bodies
+    # with `dict(openai_body)`, a SHALLOW copy that still shares this dict, so
+    # mutating in place would silently disable thinking on the original request
+    # too. Copying keeps any other template kwargs the server was launched with.
+    existing = body.get("chat_template_kwargs")
+    ctk = dict(existing) if isinstance(existing, dict) else {}
+    ctk["enable_thinking"] = enabled
+    body["chat_template_kwargs"] = ctk
+
+
 def _apply_thinking_grammar(request_body: dict) -> None:
     """Apply the structured-thinking GBNF grammar to non-tool turns.
 
@@ -1545,6 +1583,13 @@ def _apply_profile_overrides(
     if "stop_sequences" in profile:
         updated["stop_sequences"] = profile["stop_sequences"]
     if "enable_thinking" in profile:
+        # Left as a plain assignment: `updated` is the ANTHROPIC-shaped body,
+        # and build_openai_request constructs the upstream body from a fresh
+        # literal that never reads this key — so this has never reached the
+        # wire, and writing a llama.cpp template kwarg into an Anthropic body
+        # would only add a field that passthrough requests must not carry.
+        # Wiring profiles to thinking is a separate change from making the
+        # operator switches work.
         updated["enable_thinking"] = profile["enable_thinking"]
 
     tool_call_batching = profile.get("tool_call_batching") or {}
@@ -2407,6 +2452,11 @@ class SessionMonitor:
 
 session_monitors: dict[str, SessionMonitor] = {}
 default_context_window = 0
+# True only when `default_context_window` came from the SERVER (a /slots read)
+# or from an explicit operator setting — never when it is the hardcoded
+# fallback. /v1/models publishes the window to clients as fact, and a guess
+# published as fact is the failure `_model_entry` exists to prevent.
+_context_window_measured: bool = False
 last_session_id = ""
 _last_ctx_recheck_ts: float = 0.0
 _CTX_RECHECK_INTERVAL: float = 60.0  # Re-detect context window every 60s
@@ -2476,13 +2526,41 @@ def _cleanup_stale_monitors(now_ts: float) -> None:
         session_monitors.pop(sid, None)
 
 
+def _effective_context_window() -> int:
+    """The window this proxy actually ENFORCES, in tokens (0 = unknown).
+
+    The detected value wins over the env pin because the pin goes stale: the
+    upstream server can restart with a different --ctx-size, and
+    `_maybe_recheck_context_window` tracks that. `PROXY_CONTEXT_WINDOW` is the
+    fallback for when detection has not run or could not reach the server.
+
+    This is the idiom already used at the count_tokens compaction-forcing call
+    sites; it exists as a function so the process-wide consumers — the forcing
+    scale and the /v1/models advertisement — resolve the window from ONE
+    source. They did not: /v1/models stamped the raw env value while everything
+    else used the detected rail. Live on 2026-08-16 that meant the endpoint
+    advertised 65,536 while the proxy enforced 199,680, and the two errors
+    compounded. A client sizing itself to 65,536 while receiving counts
+    inflated 1.73x for compaction forcing compacts at ~35k REAL tokens — 18%
+    of the rail it was given.
+
+    NOT every window in the process: a request carrying a model profile
+    overrides `monitor.context_window` (see `messages`), and the pruner reads
+    that per-session value. This function is the process default, not a claim
+    about every session.
+    """
+    if default_context_window > 0:
+        return default_context_window
+    return max(PROXY_CONTEXT_WINDOW, 0)
+
+
 async def _maybe_recheck_context_window() -> None:
     """Periodically re-query the upstream server's context window.
 
     Handles server restarts with different --ctx-size mid-session.
     Non-blocking: skips if the check interval hasn't elapsed.
     """
-    global default_context_window, _last_ctx_recheck_ts
+    global default_context_window, _last_ctx_recheck_ts, _context_window_measured
     now = time.time()
     if now - _last_ctx_recheck_ts < _CTX_RECHECK_INTERVAL:
         return
@@ -2496,6 +2574,8 @@ async def _maybe_recheck_context_window() -> None:
             slots = resp.json()
             if slots and isinstance(slots, list):
                 n_ctx = slots[0].get("n_ctx", 0)
+                if n_ctx > 0:
+                    _context_window_measured = True
                 if n_ctx > 0 and n_ctx != default_context_window:
                     old = default_context_window
                     default_context_window = n_ctx
@@ -2533,10 +2613,17 @@ async def detect_context_window(client: httpx.AsyncClient) -> int:
 
     Queries the /slots endpoint (llama.cpp) to get the actual n_ctx value.
     Falls back to PROXY_CONTEXT_WINDOW env var, then to a safe default.
+
+    The probe runs FIRST, which is what this docstring always claimed but the
+    code did not do: it returned the env value without asking the server, so a
+    stale setting governed until the first /v1/messages request triggered the
+    60s recheck — and SDK clients read /v1/models before ever sending a message.
+    The env value is a hand-maintained copy of this same number (the operator
+    file that carries it says "re-derive it whenever --parallel or --ctx-size
+    moves"), so asking the server is strictly better information; the setting
+    stays as the answer for when the server cannot be reached.
     """
-    if PROXY_CONTEXT_WINDOW > 0:
-        logger.info("Using configured context window: %d tokens", PROXY_CONTEXT_WINDOW)
-        return PROXY_CONTEXT_WINDOW
+    global _context_window_measured
 
     try:
         slots_url = LLAMA_CPP_BASE.replace("/v1", "/slots")
@@ -2551,13 +2638,21 @@ async def detect_context_window(client: httpx.AsyncClient) -> int:
                         n_ctx,
                         len(slots),
                     )
+                    _context_window_measured = True
                     return n_ctx
     except Exception as exc:
         logger.warning("Failed to auto-detect context window: %s", exc)
 
-    # Safe default: 128K (common for modern models)
+    if PROXY_CONTEXT_WINDOW > 0:
+        logger.info("Using configured context window: %d tokens", PROXY_CONTEXT_WINDOW)
+        _context_window_measured = True  # an operator setting is an assertion
+        return PROXY_CONTEXT_WINDOW
+
+    # Safe default: 128K (common for modern models). NOT measured — the pruner
+    # may use it as a backstop, but it must never be published as fact.
     default = 131072
     logger.warning("Using default context window: %d tokens", default)
+    _context_window_measured = False
     return default
 
 
@@ -6401,14 +6496,26 @@ def build_openai_request(
     # consume the client's max_tokens budget on internal reasoning, leaving
     # nothing for the visible answer.
     anthropic_thinking = anthropic_body.get("thinking")
+    # PROTOCOL DEFAULT — deliberately top-level only, NOT via _set_thinking.
+    #
+    # Anthropic's default is "thinking off unless asked", so this branch sets
+    # off for almost every request. Against a jinja server the top-level field
+    # is inert, which is why the upstream has been reasoning by default all
+    # along. Routing this through _set_thinking would make it authoritative and
+    # silently flip EVERY client that never asked for thinking — Claude Code,
+    # opencode, benchmarks, all OpenAI-compat traffic — from the server's
+    # configured default to off. That is a serving-policy change, not a bug fix.
+    #
+    # The same reasoning applies to the "enabled" case in reverse: making it
+    # authoritative would let a client turn reasoning ON against a server
+    # deliberately launched with it off. The measured bug was one-directional
+    # (an operator's OFF switch didn't stick); the fix stays one-directional.
+    # Operators who want thinking off across the board have an explicit switch
+    # below (PROXY_DISABLE_THINKING_ALWAYS), and it now works.
     if isinstance(anthropic_thinking, dict):
         ttype = (anthropic_thinking.get("type") or "").lower()
-        if ttype == "enabled":
-            openai_body["enable_thinking"] = True
-        else:
-            openai_body["enable_thinking"] = False
+        openai_body["enable_thinking"] = ttype == "enabled"
     else:
-        # Match Anthropic default: thinking off unless explicitly requested.
         openai_body["enable_thinking"] = False
 
     # Global thinking-off (G): apply to every request, not just tool turns.
@@ -6416,7 +6523,7 @@ def build_openai_request(
     # Per-path tool-turn handling below (DISABLE_THINKING_ON_TOOL_TURNS) is
     # additive — ALWAYS supersedes when set.
     if PROXY_DISABLE_THINKING_ALWAYS:
-        openai_body["enable_thinking"] = False
+        _set_thinking(openai_body, False)
 
     # Inject agentic protocol instructions only for tool-enabled turns.
     # Use minimal supplement for qwen models to reduce prompt leak surface.
@@ -6736,7 +6843,7 @@ def build_openai_request(
                 monitor.catastrophic_ctx_streak,
             )
             if PROXY_DISABLE_THINKING_ON_TOOL_TURNS:
-                openai_body["enable_thinking"] = False
+                _set_thinking(openai_body, False)
             if PROXY_DISABLE_SPEC_ON_TOOL_TURNS:
                 openai_body["speculative.n_max"] = 0
             return openai_body
@@ -6761,7 +6868,7 @@ def build_openai_request(
             )
             # Skip all further tool_choice logic — no tools this turn
             if PROXY_DISABLE_THINKING_ON_TOOL_TURNS:
-                openai_body["enable_thinking"] = False
+                _set_thinking(openai_body, False)
             if PROXY_DISABLE_SPEC_ON_TOOL_TURNS:
                 openai_body["speculative.n_max"] = 0
             return openai_body
@@ -6811,7 +6918,7 @@ def build_openai_request(
                     PROXY_HARD_FINALIZE_TURNS,
                 )
                 if PROXY_DISABLE_THINKING_ON_TOOL_TURNS:
-                    openai_body["enable_thinking"] = False
+                    _set_thinking(openai_body, False)
                 if PROXY_DISABLE_SPEC_ON_TOOL_TURNS:
                     openai_body["speculative.n_max"] = 0
                 return openai_body
@@ -6994,7 +7101,7 @@ def build_openai_request(
 
 
         if PROXY_DISABLE_THINKING_ALWAYS or PROXY_DISABLE_THINKING_ON_TOOL_TURNS:
-            openai_body["enable_thinking"] = False
+            _set_thinking(openai_body, False)
             logger.info(
                 "Thinking disabled (always=%s tool_turns=%s)",
                 PROXY_DISABLE_THINKING_ALWAYS,
@@ -9356,10 +9463,7 @@ async def _apply_empty_maxtokens_recovery(
     if not _is_empty_maxtokens_response(openai_resp):
         return openai_resp
     retry_body = dict(openai_body)
-    retry_body["enable_thinking"] = False
-    ctk = dict(retry_body.get("chat_template_kwargs") or {})
-    ctk["enable_thinking"] = False
-    retry_body["chat_template_kwargs"] = ctk
+    _set_thinking(retry_body, False)
     requested = int(openai_body.get("max_tokens") or PROXY_EMPTY_MAXTOKENS_RETRY_MAX_TOKENS)
     retry_body["max_tokens"] = min(requested, PROXY_EMPTY_MAXTOKENS_RETRY_MAX_TOKENS)
     logger.warning(
@@ -9525,7 +9629,7 @@ def _build_malformed_retry_body(
             )
 
     if PROXY_DISABLE_THINKING_ON_TOOL_TURNS:
-        retry_body["enable_thinking"] = False
+        _set_thinking(retry_body, False)
 
     # Option 3: Proactively strip grammar from retry when tools are present and
     # grammar+tools is known to be incompatible. Prevents the 400 error
@@ -11485,7 +11589,7 @@ async def count_tokens(request: Request):
                 "fires at ~%d real tokens, before the pruner",
                 scale,
                 PROXY_CLIENT_ASSUMED_WINDOW,
-                default_context_window if default_context_window > 0 else PROXY_CONTEXT_WINDOW,
+                _effective_context_window(),
                 int(PROXY_CLIENT_ASSUMED_WINDOW * 0.925 / scale),
             )
         return {"input_tokens": scaled}
@@ -11510,7 +11614,7 @@ def _count_tokens_scale() -> float:
             return max(1.0, float(raw))
         except ValueError:
             return 1.0
-    window = default_context_window if default_context_window > 0 else PROXY_CONTEXT_WINDOW
+    window = _effective_context_window()
     if window <= 0:
         return 1.0
     frac = (
@@ -12845,9 +12949,10 @@ def _model_entry(model_id: str) -> dict:
     nothing and leave the client on its own defaults.
     """
     entry = {"id": model_id, "object": "model"}
-    if PROXY_CONTEXT_WINDOW > 0 and not _should_passthrough_model(model_id):
+    window = _effective_context_window() if _context_window_measured else 0
+    if window > 0 and not _should_passthrough_model(model_id):
         for key in _CONTEXT_WINDOW_KEYS:
-            entry[key] = PROXY_CONTEXT_WINDOW
+            entry[key] = window
     return entry
 
 
@@ -12867,6 +12972,12 @@ async def models():
     ANTHROPIC_PASSTHROUGH_MODELS=__local_only__ is set, all IDs (including
     the Claude ones below) are served by the local llama.cpp backend.
     """
+    # Refresh the rail before answering. This endpoint is the FIRST thing SDK
+    # clients call (it is in _PROXY_AUTH_OPEN_PATHS precisely so discovery
+    # works), and clients cache the model list — so answering from a window
+    # that only refreshes on /v1/messages means the number a client keeps for
+    # the whole session is the one from before any traffic existed.
+    await _maybe_recheck_context_window()
     return {"data": [_model_entry(mid) for mid in ADVERTISED_MODEL_IDS]}
 
 

package/tools/agents/tests/test_anthropic_proxy_streaming.py

@@ -2043,6 +2043,17 @@ class TestToolTurnControls(unittest.TestCase):
             )
             self.assertIn("enable_thinking", openai)
             self.assertFalse(openai["enable_thinking"])
+            # THE assertion whose absence let the switch be a no-op for months:
+            # a `--jinja` server reads chat_template_kwargs and ignores the
+            # top-level field entirely, so asserting only the line above passes
+            # while the upstream keeps reasoning. Measured on the live server:
+            # top-level only -> 703 chars of reasoning; this key -> 0.
+            self.assertIs(
+                openai.get("chat_template_kwargs", {}).get("enable_thinking"),
+                False,
+                "tool-turn thinking switch must reach chat_template_kwargs, "
+                "or a --jinja upstream ignores it",
+            )
         finally:
             setattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS", old_disable)
 

package/tools/agents/tests/test_models_context_window.py

@@ -11,6 +11,7 @@ window at all.
 
 A client that cannot discover the window cannot size its history to it.
 """
+import asyncio
 import importlib.util
 import os
 import unittest
@@ -19,9 +20,18 @@ from pathlib import Path
 proxy_path = Path(__file__).resolve().parents[3] / "tools" / "agents" / "scripts" / "anthropic_proxy.py"
 
 
-def load_proxy(window="130048", passthrough=None):
-    """Import a fresh proxy module under the given env (constants bind at import)."""
+def load_proxy(window="130048", passthrough=None, measured=True):
+    """Import a fresh proxy module under the given env (constants bind at import).
+
+    `measured` mirrors what a real startup leaves behind: True once /slots (or
+    an explicit setting) supplied the window, False when it is the hardcoded
+    guess. /v1/models only publishes a measured window.
+    """
     os.environ["PROXY_CONTEXT_WINDOW"] = window
+    # Pin the forcing scale: `auto` is the default, but a developer shell or a
+    # systemd unit exporting a fixed value would silently change what
+    # _count_tokens_scale returns and fail these tests for unrelated reasons.
+    os.environ["PROXY_COUNT_TOKENS_SCALE"] = "auto"
     if passthrough is None:
         os.environ.pop("ANTHROPIC_PASSTHROUGH_MODELS", None)
     else:
@@ -29,6 +39,7 @@ def load_proxy(window="130048", passthrough=None):
     spec = importlib.util.spec_from_file_location("anthropic_proxy_ctx", proxy_path)
     mod = importlib.util.module_from_spec(spec)
     spec.loader.exec_module(mod)
+    mod._context_window_measured = measured
     return mod
 
 
@@ -36,6 +47,7 @@ class ModelsAdvertiseContextWindowTest(unittest.TestCase):
     def tearDown(self):
         os.environ.pop("PROXY_CONTEXT_WINDOW", None)
         os.environ.pop("ANTHROPIC_PASSTHROUGH_MODELS", None)
+        os.environ.pop("PROXY_COUNT_TOKENS_SCALE", None)
 
     def test_local_model_carries_the_window(self):
         ap = load_proxy()
@@ -57,21 +69,77 @@ class ModelsAdvertiseContextWindowTest(unittest.TestCase):
         # Stamping the local llama.cpp figure on it would make clients truncate
         # needlessly — worse than the bug being fixed.
         ap = load_proxy(passthrough=None)  # default patterns: Claude passes through
+        ap.default_context_window = 199680  # exercise the DETECTED arm, not the fallback
         for mid in ("claude-sonnet-4-6", "claude-haiku-4-5-20251001"):
             self.assertNotIn("context_length", ap._model_entry(mid), mid)
 
     def test_local_only_sentinel_means_every_id_is_local(self):
         ap = load_proxy(passthrough="__local_only__")
+        ap.default_context_window = 199680
         for mid in ap.ADVERTISED_MODEL_IDS:
-            self.assertEqual(ap._model_entry(mid).get("context_length"), 130048, mid)
+            self.assertEqual(ap._model_entry(mid).get("context_length"), 199680, mid)
 
-    def test_unset_window_advertises_nothing(self):
-        # Better to say nothing than to assert a wrong number.
-        ap = load_proxy(window="0")
+    def test_unknown_window_advertises_nothing(self):
+        # Better to say nothing than to assert a wrong number. "Unknown" means
+        # BOTH: no setting and no detected rail.
+        ap = load_proxy(window="0", measured=False)
+        ap.default_context_window = 0
         self.assertEqual(
             ap._model_entry("qwen36-35b-a3b-iq4xs"), {"id": "qwen36-35b-a3b-iq4xs", "object": "model"}
         )
 
+    def test_a_guessed_window_is_never_published_as_fact(self):
+        # detect_context_window falls back to a hardcoded 131072 when the
+        # upstream is unreachable. The pruner may use that as a backstop, but
+        # advertising it would state a number nobody measured — the very
+        # failure this endpoint exists to prevent. Boot with llama down.
+        ap = load_proxy(window="0", measured=False)
+        ap.default_context_window = 131072
+        self.assertEqual(
+            ap._model_entry("qwen36-35b-a3b-iq4xs"), {"id": "qwen36-35b-a3b-iq4xs", "object": "model"}
+        )
+
+    def test_advertises_the_detected_rail_when_no_pin_is_set(self):
+        # Detection (from /slots) is the normal case: PROXY_CONTEXT_WINDOW=0 is
+        # what tells the launcher to auto-detect. Advertising nothing there left
+        # exactly the clients this endpoint exists for — the ones that size
+        # themselves from it — back on their own defaults.
+        ap = load_proxy(window="0")
+        ap.default_context_window = 199680
+        self.assertEqual(ap._model_entry("qwen36-35b-a3b-iq4xs")["context_length"], 199680)
+
+    def test_detected_rail_wins_over_a_stale_pin(self):
+        # THE BUG (live, 2026-08-16): the pin said 65,536 while the proxy
+        # enforced the detected 199,680. Clients were told the small number and
+        # compacted against it; the pruner guarded the large one. Whatever the
+        # number is, the advertised and enforced windows must be the same one.
+        ap = load_proxy(window="65536")
+        ap.default_context_window = 199680
+        self.assertEqual(ap._model_entry("qwen36-35b-a3b-iq4xs")["context_length"], 199680)
+        self.assertEqual(ap._effective_context_window(), 199680)
+
+    def test_pin_is_the_fallback_until_detection_lands(self):
+        # At startup, before the first /slots probe, the pin is all there is.
+        ap = load_proxy(window="65536")
+        ap.default_context_window = 0
+        self.assertEqual(ap._model_entry("qwen36-35b-a3b-iq4xs")["context_length"], 65536)
+        self.assertEqual(ap._effective_context_window(), 65536)
+
+    def test_advertised_window_equals_the_forcing_scale_denominator(self):
+        # The compaction-forcing scale and the advertisement are two halves of
+        # one contract: the client is told a window AND handed counts scaled to
+        # make it compact inside that window. Derived from different numbers,
+        # they fight — the 65,536/199,680 split had clients compacting at ~18%
+        # of the rail.
+        ap = load_proxy(window="65536")
+        ap.default_context_window = 199680
+        advertised = ap._model_entry("qwen36-35b-a3b-iq4xs")["context_length"]
+        frac = ap.PROXY_COMPACT_TARGET_FRACTION
+        if not (0 < frac < 1):
+            frac = min(0.9, ap.PROXY_CONTEXT_PRUNE_THRESHOLD * 0.95)
+        expected = ap.PROXY_CLIENT_ASSUMED_WINDOW / (advertised * frac)
+        self.assertAlmostEqual(ap._count_tokens_scale(), max(1.0, expected), places=6)
+
     def test_entry_always_keeps_the_openai_shape(self):
         ap = load_proxy()
         for mid in ap.ADVERTISED_MODEL_IDS:
@@ -80,5 +148,54 @@ class ModelsAdvertiseContextWindowTest(unittest.TestCase):
             self.assertEqual(e["object"], "model")
 
 
+class DetectContextWindowTest(unittest.TestCase):
+    """Startup resolution: ask the server first, settings are the fallback."""
+
+    def tearDown(self):
+        os.environ.pop("PROXY_CONTEXT_WINDOW", None)
+        os.environ.pop("PROXY_COUNT_TOKENS_SCALE", None)
+
+    @staticmethod
+    def _client(n_ctx=None, fail=False):
+        class _Resp:
+            status_code = 200
+
+            def json(self):
+                return [{"n_ctx": n_ctx}, {"n_ctx": n_ctx}]
+
+        class _Client:
+            async def get(self, url, timeout=None):
+                if fail:
+                    raise RuntimeError("connection refused")
+                return _Resp()
+
+        return _Client()
+
+    def test_probes_the_server_even_when_a_fallback_is_configured(self):
+        # Previously the configured value short-circuited the probe, so a stale
+        # setting governed /v1/models until the first /v1/messages — and SDK
+        # clients read /v1/models before sending anything.
+        ap = load_proxy(window="65536", measured=False)
+        w = asyncio.run(ap.detect_context_window(self._client(n_ctx=199680)))
+        self.assertEqual(w, 199680)
+        self.assertTrue(ap._context_window_measured)
+
+    def test_falls_back_to_the_configured_value_when_the_probe_fails(self):
+        ap = load_proxy(window="65536", measured=False)
+        w = asyncio.run(ap.detect_context_window(self._client(fail=True)))
+        self.assertEqual(w, 65536)
+        # An operator setting is an assertion, so it may be published.
+        self.assertTrue(ap._context_window_measured)
+
+    def test_last_resort_guess_is_marked_unmeasured(self):
+        ap = load_proxy(window="0", measured=True)
+        w = asyncio.run(ap.detect_context_window(self._client(fail=True)))
+        self.assertEqual(w, 131072)
+        self.assertFalse(ap._context_window_measured)
+        self.assertEqual(
+            ap._model_entry("qwen36-35b-a3b-iq4xs"), {"id": "qwen36-35b-a3b-iq4xs", "object": "model"}
+        )
+
+
 if __name__ == "__main__":
     unittest.main()

package/tools/agents/tests/test_thinking_template_kwargs.py

@@ -0,0 +1,155 @@
+"""Turning reasoning off must reach the place llama.cpp actually reads it.
+
+Measured on the live server (Qwen3.6-35B-A3B, launched `--jinja
+--chat-template-kwargs {"enable_thinking": true}`), identical tool-call prompt:
+
+    top-level "enable_thinking": false   -> 703 chars of reasoning, 196 tokens
+    chat_template_kwargs.enable_thinking ->   0 chars,                27 tokens
+
+and on a planning-flavoured prompt with max_tokens=700, reasoning consumed the
+ENTIRE budget and NO tool call was emitted — the "stuck planning" symptom.
+
+Every thinking switch in the proxy set only the top-level field, so
+PROXY_DISABLE_THINKING_ALWAYS, PROXY_DISABLE_THINKING_ON_TOOL_TURNS and the
+Anthropic `thinking: {type: disabled}` parameter were all no-ops against a jinja
+server: the controls existed, logged themselves as active, and changed nothing.
+"""
+import importlib.util
+import os
+import unittest
+from pathlib import Path
+
+proxy_path = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+
+
+_PRIOR_AUTOLOAD = os.environ.get("UAP_PROXY_ENV_AUTOLOAD")
+
+
+def tearDownModule():
+    # Restore rather than leak into any test sharing this process.
+    if _PRIOR_AUTOLOAD is None:
+        os.environ.pop("UAP_PROXY_ENV_AUTOLOAD", None)
+    else:
+        os.environ["UAP_PROXY_ENV_AUTOLOAD"] = _PRIOR_AUTOLOAD
+
+
+def load_proxy(**env):
+    # Explicit, so a project .uap/proxy.env cannot leak in when this module is
+    # run directly rather than through the npm script.
+    os.environ["UAP_PROXY_ENV_AUTOLOAD"] = "0"
+    for k in ("PROXY_DISABLE_THINKING_ALWAYS", "PROXY_DISABLE_THINKING_ON_TOOL_TURNS"):
+        os.environ.pop(k, None)
+    os.environ.update({k: v for k, v in env.items()})
+    spec = importlib.util.spec_from_file_location("anthropic_proxy_thinking", proxy_path)
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod
+
+
+class SetThinkingTest(unittest.TestCase):
+    def tearDown(self):
+        for k in ("PROXY_DISABLE_THINKING_ALWAYS", "PROXY_DISABLE_THINKING_ON_TOOL_TURNS"):
+            os.environ.pop(k, None)
+
+    def test_disabling_reaches_chat_template_kwargs(self):
+        # THE BUG: the top-level field alone is overridden by the server's
+        # --chat-template-kwargs default, so reasoning kept flowing.
+        ap = load_proxy()
+        body = {}
+        ap._set_thinking(body, False)
+        self.assertIs(body["chat_template_kwargs"]["enable_thinking"], False)
+
+    def test_top_level_is_still_set_for_servers_that_read_it(self):
+        # Belt and braces: non-jinja / older builds read the top-level field.
+        ap = load_proxy()
+        body = {}
+        ap._set_thinking(body, False)
+        self.assertIs(body["enable_thinking"], False)
+
+    def test_enabling_reaches_both_places_too(self):
+        ap = load_proxy()
+        body = {}
+        ap._set_thinking(body, True)
+        self.assertIs(body["enable_thinking"], True)
+        self.assertIs(body["chat_template_kwargs"]["enable_thinking"], True)
+
+    def test_existing_chat_template_kwargs_are_preserved(self):
+        # The server is launched with other template kwargs; clobbering the dict
+        # would drop them.
+        ap = load_proxy()
+        body = {"chat_template_kwargs": {"preserve_thinking": False, "custom": 1}}
+        ap._set_thinking(body, False)
+        self.assertEqual(body["chat_template_kwargs"]["custom"], 1)
+        self.assertIs(body["chat_template_kwargs"]["preserve_thinking"], False)
+        self.assertIs(body["chat_template_kwargs"]["enable_thinking"], False)
+
+    def test_a_non_dict_kwargs_value_does_not_raise(self):
+        # Defensive: a malformed client body must not 500 the turn.
+        ap = load_proxy()
+        body = {"chat_template_kwargs": "nonsense"}
+        ap._set_thinking(body, False)
+        self.assertIs(body["enable_thinking"], False)
+
+    def test_a_shallow_retry_copy_does_not_disable_thinking_on_the_original(self):
+        # The helper's whole rationale: retry bodies are built as
+        # `dict(openai_body)`, which SHARES this nested dict. Mutating it in
+        # place would disable thinking on the in-flight request too.
+        ap = load_proxy()
+        original = {"chat_template_kwargs": {"enable_thinking": True}}
+        retry = dict(original)
+        ap._set_thinking(retry, False)
+        self.assertIs(original["chat_template_kwargs"]["enable_thinking"], True)
+        self.assertIs(retry["chat_template_kwargs"]["enable_thinking"], False)
+
+
+class SwitchesReachTheTemplateTest(unittest.TestCase):
+    """The switches, exercised through the real request builder."""
+
+    def tearDown(self):
+        for k in ("PROXY_DISABLE_THINKING_ALWAYS", "PROXY_DISABLE_THINKING_ON_TOOL_TURNS"):
+            os.environ.pop(k, None)
+
+    @staticmethod
+    def _build(ap, tools=False):
+        body = {"model": "test", "messages": [{"role": "user", "content": "hi"}]}
+        if tools:
+            body["tools"] = [
+                {"name": "Read", "description": "Read file", "input_schema": {"type": "object"}}
+            ]
+        return ap.build_openai_request(body, ap.SessionMonitor(context_window=262144))
+
+    def test_always_switch_reaches_chat_template_kwargs(self):
+        ap = load_proxy(PROXY_DISABLE_THINKING_ALWAYS="on")
+        built = self._build(ap)
+        self.assertIs(built["chat_template_kwargs"]["enable_thinking"], False)
+
+    def test_protocol_default_does_NOT_force_the_template(self):
+        # Deliberate: Anthropic defaults thinking off, and making that
+        # authoritative would flip every client that never asked for it from
+        # the server's configured default to off. A serving-policy change is
+        # not a bug fix; operators have an explicit switch for that.
+        ap = load_proxy()
+        built = self._build(ap)
+        self.assertIs(built["enable_thinking"], False)
+        self.assertNotIn(
+            "enable_thinking",
+            built.get("chat_template_kwargs", {}),
+            "the protocol default must not override the server's configured default",
+        )
+
+    def test_a_client_cannot_turn_thinking_ON_against_the_server_default(self):
+        # The measured bug was one-directional (an OFF switch that didn't
+        # stick); the fix stays one-directional.
+        ap = load_proxy()
+        body = {
+            "model": "test",
+            "messages": [{"role": "user", "content": "hi"}],
+            "thinking": {"type": "enabled"},
+        }
+        built = ap.build_openai_request(body, ap.SessionMonitor(context_window=262144))
+        self.assertIs(built["enable_thinking"], True)
+        self.assertNotIn("enable_thinking", built.get("chat_template_kwargs", {}))
+
+
+if __name__ == "__main__":
+    unittest.main()