@miller-tech/uap 1.210.4 → 1.210.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.210.4",
+  "version": "1.210.5",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window",
+    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window tools.agents.tests.test_thinking_template_kwargs",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",

package/tools/agents/scripts/anthropic_proxy.py

@@ -1453,12 +1453,48 @@ def _apply_json_response_grammar(openai_body: dict, anthropic_body: dict) -> Non
     if openai_body.get("tools") or openai_body.get("grammar"):
         return
     openai_body["grammar"] = JSON_RESPONSE_GBNF
-    openai_body["enable_thinking"] = False
-    ctk = openai_body.setdefault("chat_template_kwargs", {})
-    ctk["enable_thinking"] = False
+    _set_thinking(openai_body, False)
     logger.info("JSON-RESPONSE grammar applied (evaluator verdict turn)")
 
 
+def _set_thinking(body: dict, enabled: bool) -> None:
+    """Turn upstream reasoning on/off, in BOTH places llama.cpp reads.
+
+    The top-level `enable_thinking` field alone does NOTHING on a `--jinja`
+    server: the Qwen chat template reads `chat_template_kwargs`, and this one is
+    launched with `--chat-template-kwargs {"enable_thinking": true}`, so an
+    unqualified top-level flag is silently overridden by the template default.
+
+    Measured on the live server, identical tool-call prompt:
+        top-level only                     -> 703 chars of reasoning, 196 tokens
+        chat_template_kwargs               ->   0 chars,                27 tokens
+    and on a planning-flavoured prompt with max_tokens=700, reasoning consumed
+    the ENTIRE budget and no tool call was emitted at all.
+
+    The OPERATOR switches — PROXY_DISABLE_THINKING_ALWAYS and
+    PROXY_DISABLE_THINKING_ON_TOOL_TURNS, plus the tool-turn breakers — set only
+    the top-level field, so they were no-ops against a jinja server: they
+    existed, logged themselves as active, and changed nothing. The paths that
+    already set both (the JSON-verdict grammar, the empty-max_tokens retry, and
+    the prefill/continuation turn) worked, which is why evaluator turns were
+    unaffected and this went unnoticed elsewhere.
+
+    Use this for a switch that expresses INTENT ("this turn must not reason").
+    The Anthropic protocol-default translation deliberately does NOT use it —
+    see the comment there; making a default authoritative would change serving
+    policy for every client rather than fix a broken control.
+    """
+    body["enable_thinking"] = enabled
+    # REPLACE the nested dict rather than mutate it: callers build retry bodies
+    # with `dict(openai_body)`, a SHALLOW copy that still shares this dict, so
+    # mutating in place would silently disable thinking on the original request
+    # too. Copying keeps any other template kwargs the server was launched with.
+    existing = body.get("chat_template_kwargs")
+    ctk = dict(existing) if isinstance(existing, dict) else {}
+    ctk["enable_thinking"] = enabled
+    body["chat_template_kwargs"] = ctk
+
+
 def _apply_thinking_grammar(request_body: dict) -> None:
     """Apply the structured-thinking GBNF grammar to non-tool turns.
 
@@ -1547,6 +1583,13 @@ def _apply_profile_overrides(
     if "stop_sequences" in profile:
         updated["stop_sequences"] = profile["stop_sequences"]
     if "enable_thinking" in profile:
+        # Left as a plain assignment: `updated` is the ANTHROPIC-shaped body,
+        # and build_openai_request constructs the upstream body from a fresh
+        # literal that never reads this key — so this has never reached the
+        # wire, and writing a llama.cpp template kwarg into an Anthropic body
+        # would only add a field that passthrough requests must not carry.
+        # Wiring profiles to thinking is a separate change from making the
+        # operator switches work.
         updated["enable_thinking"] = profile["enable_thinking"]
 
     tool_call_batching = profile.get("tool_call_batching") or {}
@@ -6453,14 +6496,26 @@ def build_openai_request(
     # consume the client's max_tokens budget on internal reasoning, leaving
     # nothing for the visible answer.
     anthropic_thinking = anthropic_body.get("thinking")
+    # PROTOCOL DEFAULT — deliberately top-level only, NOT via _set_thinking.
+    #
+    # Anthropic's default is "thinking off unless asked", so this branch sets
+    # off for almost every request. Against a jinja server the top-level field
+    # is inert, which is why the upstream has been reasoning by default all
+    # along. Routing this through _set_thinking would make it authoritative and
+    # silently flip EVERY client that never asked for thinking — Claude Code,
+    # opencode, benchmarks, all OpenAI-compat traffic — from the server's
+    # configured default to off. That is a serving-policy change, not a bug fix.
+    #
+    # The same reasoning applies to the "enabled" case in reverse: making it
+    # authoritative would let a client turn reasoning ON against a server
+    # deliberately launched with it off. The measured bug was one-directional
+    # (an operator's OFF switch didn't stick); the fix stays one-directional.
+    # Operators who want thinking off across the board have an explicit switch
+    # below (PROXY_DISABLE_THINKING_ALWAYS), and it now works.
     if isinstance(anthropic_thinking, dict):
         ttype = (anthropic_thinking.get("type") or "").lower()
-        if ttype == "enabled":
-            openai_body["enable_thinking"] = True
-        else:
-            openai_body["enable_thinking"] = False
+        openai_body["enable_thinking"] = ttype == "enabled"
     else:
-        # Match Anthropic default: thinking off unless explicitly requested.
         openai_body["enable_thinking"] = False
 
     # Global thinking-off (G): apply to every request, not just tool turns.
@@ -6468,7 +6523,7 @@ def build_openai_request(
     # Per-path tool-turn handling below (DISABLE_THINKING_ON_TOOL_TURNS) is
     # additive — ALWAYS supersedes when set.
     if PROXY_DISABLE_THINKING_ALWAYS:
-        openai_body["enable_thinking"] = False
+        _set_thinking(openai_body, False)
 
     # Inject agentic protocol instructions only for tool-enabled turns.
     # Use minimal supplement for qwen models to reduce prompt leak surface.
@@ -6788,7 +6843,7 @@ def build_openai_request(
                 monitor.catastrophic_ctx_streak,
             )
             if PROXY_DISABLE_THINKING_ON_TOOL_TURNS:
-                openai_body["enable_thinking"] = False
+                _set_thinking(openai_body, False)
             if PROXY_DISABLE_SPEC_ON_TOOL_TURNS:
                 openai_body["speculative.n_max"] = 0
             return openai_body
@@ -6813,7 +6868,7 @@ def build_openai_request(
             )
             # Skip all further tool_choice logic — no tools this turn
             if PROXY_DISABLE_THINKING_ON_TOOL_TURNS:
-                openai_body["enable_thinking"] = False
+                _set_thinking(openai_body, False)
             if PROXY_DISABLE_SPEC_ON_TOOL_TURNS:
                 openai_body["speculative.n_max"] = 0
             return openai_body
@@ -6863,7 +6918,7 @@ def build_openai_request(
                     PROXY_HARD_FINALIZE_TURNS,
                 )
                 if PROXY_DISABLE_THINKING_ON_TOOL_TURNS:
-                    openai_body["enable_thinking"] = False
+                    _set_thinking(openai_body, False)
                 if PROXY_DISABLE_SPEC_ON_TOOL_TURNS:
                     openai_body["speculative.n_max"] = 0
                 return openai_body
@@ -7046,7 +7101,7 @@ def build_openai_request(
 
 
         if PROXY_DISABLE_THINKING_ALWAYS or PROXY_DISABLE_THINKING_ON_TOOL_TURNS:
-            openai_body["enable_thinking"] = False
+            _set_thinking(openai_body, False)
             logger.info(
                 "Thinking disabled (always=%s tool_turns=%s)",
                 PROXY_DISABLE_THINKING_ALWAYS,
@@ -9408,10 +9463,7 @@ async def _apply_empty_maxtokens_recovery(
     if not _is_empty_maxtokens_response(openai_resp):
         return openai_resp
     retry_body = dict(openai_body)
-    retry_body["enable_thinking"] = False
-    ctk = dict(retry_body.get("chat_template_kwargs") or {})
-    ctk["enable_thinking"] = False
-    retry_body["chat_template_kwargs"] = ctk
+    _set_thinking(retry_body, False)
     requested = int(openai_body.get("max_tokens") or PROXY_EMPTY_MAXTOKENS_RETRY_MAX_TOKENS)
     retry_body["max_tokens"] = min(requested, PROXY_EMPTY_MAXTOKENS_RETRY_MAX_TOKENS)
     logger.warning(
@@ -9577,7 +9629,7 @@ def _build_malformed_retry_body(
             )
 
     if PROXY_DISABLE_THINKING_ON_TOOL_TURNS:
-        retry_body["enable_thinking"] = False
+        _set_thinking(retry_body, False)
 
     # Option 3: Proactively strip grammar from retry when tools are present and
     # grammar+tools is known to be incompatible. Prevents the 400 error

package/tools/agents/tests/test_anthropic_proxy_streaming.py

@@ -2043,6 +2043,17 @@ class TestToolTurnControls(unittest.TestCase):
             )
             self.assertIn("enable_thinking", openai)
             self.assertFalse(openai["enable_thinking"])
+            # THE assertion whose absence let the switch be a no-op for months:
+            # a `--jinja` server reads chat_template_kwargs and ignores the
+            # top-level field entirely, so asserting only the line above passes
+            # while the upstream keeps reasoning. Measured on the live server:
+            # top-level only -> 703 chars of reasoning; this key -> 0.
+            self.assertIs(
+                openai.get("chat_template_kwargs", {}).get("enable_thinking"),
+                False,
+                "tool-turn thinking switch must reach chat_template_kwargs, "
+                "or a --jinja upstream ignores it",
+            )
         finally:
             setattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS", old_disable)
 

package/tools/agents/tests/test_thinking_template_kwargs.py

@@ -0,0 +1,155 @@
+"""Turning reasoning off must reach the place llama.cpp actually reads it.
+
+Measured on the live server (Qwen3.6-35B-A3B, launched `--jinja
+--chat-template-kwargs {"enable_thinking": true}`), identical tool-call prompt:
+
+    top-level "enable_thinking": false   -> 703 chars of reasoning, 196 tokens
+    chat_template_kwargs.enable_thinking ->   0 chars,                27 tokens
+
+and on a planning-flavoured prompt with max_tokens=700, reasoning consumed the
+ENTIRE budget and NO tool call was emitted — the "stuck planning" symptom.
+
+Every thinking switch in the proxy set only the top-level field, so
+PROXY_DISABLE_THINKING_ALWAYS, PROXY_DISABLE_THINKING_ON_TOOL_TURNS and the
+Anthropic `thinking: {type: disabled}` parameter were all no-ops against a jinja
+server: the controls existed, logged themselves as active, and changed nothing.
+"""
+import importlib.util
+import os
+import unittest
+from pathlib import Path
+
+proxy_path = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+
+
+_PRIOR_AUTOLOAD = os.environ.get("UAP_PROXY_ENV_AUTOLOAD")
+
+
+def tearDownModule():
+    # Restore rather than leak into any test sharing this process.
+    if _PRIOR_AUTOLOAD is None:
+        os.environ.pop("UAP_PROXY_ENV_AUTOLOAD", None)
+    else:
+        os.environ["UAP_PROXY_ENV_AUTOLOAD"] = _PRIOR_AUTOLOAD
+
+
+def load_proxy(**env):
+    # Explicit, so a project .uap/proxy.env cannot leak in when this module is
+    # run directly rather than through the npm script.
+    os.environ["UAP_PROXY_ENV_AUTOLOAD"] = "0"
+    for k in ("PROXY_DISABLE_THINKING_ALWAYS", "PROXY_DISABLE_THINKING_ON_TOOL_TURNS"):
+        os.environ.pop(k, None)
+    os.environ.update({k: v for k, v in env.items()})
+    spec = importlib.util.spec_from_file_location("anthropic_proxy_thinking", proxy_path)
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod
+
+
+class SetThinkingTest(unittest.TestCase):
+    def tearDown(self):
+        for k in ("PROXY_DISABLE_THINKING_ALWAYS", "PROXY_DISABLE_THINKING_ON_TOOL_TURNS"):
+            os.environ.pop(k, None)
+
+    def test_disabling_reaches_chat_template_kwargs(self):
+        # THE BUG: the top-level field alone is overridden by the server's
+        # --chat-template-kwargs default, so reasoning kept flowing.
+        ap = load_proxy()
+        body = {}
+        ap._set_thinking(body, False)
+        self.assertIs(body["chat_template_kwargs"]["enable_thinking"], False)
+
+    def test_top_level_is_still_set_for_servers_that_read_it(self):
+        # Belt and braces: non-jinja / older builds read the top-level field.
+        ap = load_proxy()
+        body = {}
+        ap._set_thinking(body, False)
+        self.assertIs(body["enable_thinking"], False)
+
+    def test_enabling_reaches_both_places_too(self):
+        ap = load_proxy()
+        body = {}
+        ap._set_thinking(body, True)
+        self.assertIs(body["enable_thinking"], True)
+        self.assertIs(body["chat_template_kwargs"]["enable_thinking"], True)
+
+    def test_existing_chat_template_kwargs_are_preserved(self):
+        # The server is launched with other template kwargs; clobbering the dict
+        # would drop them.
+        ap = load_proxy()
+        body = {"chat_template_kwargs": {"preserve_thinking": False, "custom": 1}}
+        ap._set_thinking(body, False)
+        self.assertEqual(body["chat_template_kwargs"]["custom"], 1)
+        self.assertIs(body["chat_template_kwargs"]["preserve_thinking"], False)
+        self.assertIs(body["chat_template_kwargs"]["enable_thinking"], False)
+
+    def test_a_non_dict_kwargs_value_does_not_raise(self):
+        # Defensive: a malformed client body must not 500 the turn.
+        ap = load_proxy()
+        body = {"chat_template_kwargs": "nonsense"}
+        ap._set_thinking(body, False)
+        self.assertIs(body["enable_thinking"], False)
+
+    def test_a_shallow_retry_copy_does_not_disable_thinking_on_the_original(self):
+        # The helper's whole rationale: retry bodies are built as
+        # `dict(openai_body)`, which SHARES this nested dict. Mutating it in
+        # place would disable thinking on the in-flight request too.
+        ap = load_proxy()
+        original = {"chat_template_kwargs": {"enable_thinking": True}}
+        retry = dict(original)
+        ap._set_thinking(retry, False)
+        self.assertIs(original["chat_template_kwargs"]["enable_thinking"], True)
+        self.assertIs(retry["chat_template_kwargs"]["enable_thinking"], False)
+
+
+class SwitchesReachTheTemplateTest(unittest.TestCase):
+    """The switches, exercised through the real request builder."""
+
+    def tearDown(self):
+        for k in ("PROXY_DISABLE_THINKING_ALWAYS", "PROXY_DISABLE_THINKING_ON_TOOL_TURNS"):
+            os.environ.pop(k, None)
+
+    @staticmethod
+    def _build(ap, tools=False):
+        body = {"model": "test", "messages": [{"role": "user", "content": "hi"}]}
+        if tools:
+            body["tools"] = [
+                {"name": "Read", "description": "Read file", "input_schema": {"type": "object"}}
+            ]
+        return ap.build_openai_request(body, ap.SessionMonitor(context_window=262144))
+
+    def test_always_switch_reaches_chat_template_kwargs(self):
+        ap = load_proxy(PROXY_DISABLE_THINKING_ALWAYS="on")
+        built = self._build(ap)
+        self.assertIs(built["chat_template_kwargs"]["enable_thinking"], False)
+
+    def test_protocol_default_does_NOT_force_the_template(self):
+        # Deliberate: Anthropic defaults thinking off, and making that
+        # authoritative would flip every client that never asked for it from
+        # the server's configured default to off. A serving-policy change is
+        # not a bug fix; operators have an explicit switch for that.
+        ap = load_proxy()
+        built = self._build(ap)
+        self.assertIs(built["enable_thinking"], False)
+        self.assertNotIn(
+            "enable_thinking",
+            built.get("chat_template_kwargs", {}),
+            "the protocol default must not override the server's configured default",
+        )
+
+    def test_a_client_cannot_turn_thinking_ON_against_the_server_default(self):
+        # The measured bug was one-directional (an OFF switch that didn't
+        # stick); the fix stays one-directional.
+        ap = load_proxy()
+        body = {
+            "model": "test",
+            "messages": [{"role": "user", "content": "hi"}],
+            "thinking": {"type": "enabled"},
+        }
+        built = ap.build_openai_request(body, ap.SessionMonitor(context_window=262144))
+        self.assertIs(built["enable_thinking"], True)
+        self.assertNotIn("enable_thinking", built.get("chat_template_kwargs", {}))
+
+
+if __name__ == "__main__":
+    unittest.main()