@miller-tech/uap 1.210.4 → 1.210.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.210.4",
+  "version": "1.210.6",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window",
+    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window tools.agents.tests.test_thinking_template_kwargs tools.agents.tests.test_cycle_break_wait_poll",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",

package/tools/agents/scripts/anthropic_proxy.py

@@ -396,6 +396,14 @@ PROXY_STUCK_API_THRESHOLD = int(os.environ.get("PROXY_STUCK_API_THRESHOLD", "3")
 # strategy, so this fires on the fingerprint alone, independent of outcome.
 # PROXY_REPEAT_CALL_THRESHOLD=0 disables.
 PROXY_REPEAT_CALL_THRESHOLD = int(os.environ.get("PROXY_REPEAT_CALL_THRESHOLD", "4"))
+# How many CONSECUTIVE wait/poll turns stay exempt from the loop guards before
+# the guards resume. The exemption is call-side and outcome-blind — a poll of a
+# healthy run and a poll of a wedged one are byte-identical from here — so
+# without a cap a dead job polled forever would be bounded only by the client's
+# own timeout. At the 45s follow interval this is ~30 minutes of waiting before
+# the proxy insists on a checkpoint, comfortably longer than a normal build turn
+# and far shorter than a stuck mission. 0 disables the cap.
+PROXY_WAIT_POLL_MAX_STREAK = int(os.environ.get("PROXY_WAIT_POLL_MAX_STREAK", "40"))
 # Marker so the injected directive can address a SUCCEEDING loop correctly
 # rather than telling the model to stop retrying "a failing action".
 _REPEAT_CALL_REASON = "identical tool call"
@@ -729,6 +737,18 @@ _READ_ONLY_TOOL_CLASS = frozenset({
 # open-ended set of tools (Bash, WebFetch, Agent, ...) that cannot be
 # enumerated, but "the agent produced a write" is a small, stable signal.
 # Names are matched case-insensitively (callers lower() before lookup).
+# Every wire name `deliver` arrives under. Tool names reach this proxy verbatim
+# from the client, prefixed with the MCP server's CONFIG KEY — and this repo
+# ships two: `.mcp.json`/`opencode.json` register it as `uap-router`, while
+# `uap setup` (setup-mcp-router.ts, for Claude/Factory/VSCode/Cursor) registers
+# it as `router`. Enumerating only one of them silently exempts half the fleet,
+# which is why this is ONE constant rather than three hand-maintained lists.
+_DELIVER_TOOL_NAMES = frozenset({
+    "deliver",
+    "uap-router_deliver", "uap-router__deliver", "mcp__uap-router__deliver",
+    "router_deliver", "mcp__router__deliver",
+})
+
 _WRITE_TOOL_CLASS = frozenset({
     "write", "edit", "multiedit", "notebookedit",
     "str_replace", "str_replace_editor", "str_replace_based_edit_tool",
@@ -746,7 +766,13 @@ _WRITE_TOOL_CLASS = frozenset({
     # and (b) the recon-convergence restore loop re-injects `deliver` when
     # narrowing dropped it, so a gated "route through deliver" directive is
     # actually satisfiable.
-    "deliver",
+    #
+    # The PREFIXED forms matter as much as the bare one: the wire name is
+    # `uap-router_deliver`, so with only "deliver" here the no-write streak kept
+    # climbing through a healthy delivery and recon-convergence escalated
+    # mid-wait — stripping reads and demanding "write your deliverable now"
+    # while the deliverable was being written by the run it was waiting on.
+    *_DELIVER_TOOL_NAMES,
 })
 
 # Open-ended exploration tools the agent uses to make a DIFFERENT move once a
@@ -763,6 +789,60 @@ _EXPLORATION_ESCAPE_TOOLS = frozenset({
     "agent", "task", "dispatch_agent",
 })
 
+# NEVER strip these either, for the same reason and a sharper one: they BLOCK on
+# a long-running job and return "still running" when their wait budget expires,
+# so the correct agent behaviour is to call them again. That is a WAIT, not a
+# spin — but it is indistinguishable from one by fingerprint, since every poll
+# carries identical arguments.
+#
+# Observed live 2026-08-17: an agent following a healthy `deliver` run (heartbeat
+# 8s old, checkpoint advancing) polled it as designed. The cycle-breaker read the
+# repeats as a loop, excluded the deliver tool, and the agent — now unable to
+# observe the work it was waiting on — fell through to Bash and cycled on THAT
+# instead. Median turn spacing collapsed from the 45s poll interval to 5s. The
+# loop the breaker "found" was the one it created.
+#
+# Stripping the tool cannot help here: unlike a cycling Bash, there is no
+# different argument to vary toward. The job is simply not finished yet.
+_WAIT_POLL_TOOLS = frozenset(
+    n.strip().lower()
+    for n in os.environ.get(
+        "PROXY_WAIT_POLL_TOOLS",
+        ",".join(sorted(_DELIVER_TOOL_NAMES | {"await_run", "wait"})),
+    ).split(",")
+    if n.strip()
+)
+
+
+def _fingerprint_tool_names(fingerprint: str) -> set:
+    """Tool names inside a tool-call fingerprint.
+
+    Fingerprints are "name" or "name:arghash", joined by "|" for a multi-call
+    turn — the same shape the cycle path already unpacks when it builds
+    cycling_tool_names.
+    """
+    names = set()
+    for part in (fingerprint or "").split("|"):
+        part = part.strip()
+        if part:
+            names.add(part.split(":")[0].lower())
+    return names
+
+
+def _spinning_cycling_names(cycling_tool_names) -> list:
+    """The cycling names that are genuinely spinning — wait/poll tools removed."""
+    return [n for n in (cycling_tool_names or []) if str(n).lower() not in _WAIT_POLL_TOOLS]
+
+
+def _is_wait_poll_only(names) -> bool:
+    """True when EVERY name given is a wait/poll tool (and there is at least one).
+
+    Deliberately all-not-any: a turn that calls `deliver` alongside a genuinely
+    spinning tool is still a spin, and must stay breakable.
+    """
+    lowered = {str(n).lower() for n in names if str(n).strip()}
+    return bool(lowered) and lowered <= _WAIT_POLL_TOOLS
+
 
 def _narrow_tools_for_cycle_break(tools, cycling_tool_names, session_banned_tools):
     """Drop cycling + session-banned tools from the toolset, expanding to the
@@ -788,8 +868,10 @@ def _narrow_tools_for_cycle_break(tools, cycling_tool_names, session_banned_tool
         cycling_exclude |= read_only_lower
     # Never let the cycling path narrow away the exploration escape hatch — that
     # is exactly the filesystem-exploration capability the cycle-break is trying
-    # to redirect the agent toward.
+    # to redirect the agent toward. Wait/poll tools are spared for the stronger
+    # reason that their repeats are not a loop at all (see _WAIT_POLL_TOOLS).
     cycling_exclude -= _EXPLORATION_ESCAPE_TOOLS
+    cycling_exclude -= _WAIT_POLL_TOOLS
     exclude_set = cycling_exclude | banned_lower
 
     def _name(t):
@@ -824,6 +906,11 @@ def _should_auto_ban(name, cycle_count, ban_at):
     """
     if name.lower() in _EXPLORATION_ESCAPE_TOOLS:
         return False
+    # A wait/poll tool accrues cycle counts fastest of all — every poll of a
+    # long job looks identical — so without this it is the FIRST tool banned,
+    # permanently, for doing exactly what it is for.
+    if name.lower() in _WAIT_POLL_TOOLS:
+        return False
     return cycle_count >= ban_at
 
 PROXY_GUARDRAIL_RETRY = os.environ.get("PROXY_GUARDRAIL_RETRY", "on").lower() not in {
@@ -1453,12 +1540,48 @@ def _apply_json_response_grammar(openai_body: dict, anthropic_body: dict) -> Non
     if openai_body.get("tools") or openai_body.get("grammar"):
         return
     openai_body["grammar"] = JSON_RESPONSE_GBNF
-    openai_body["enable_thinking"] = False
-    ctk = openai_body.setdefault("chat_template_kwargs", {})
-    ctk["enable_thinking"] = False
+    _set_thinking(openai_body, False)
     logger.info("JSON-RESPONSE grammar applied (evaluator verdict turn)")
 
 
+def _set_thinking(body: dict, enabled: bool) -> None:
+    """Turn upstream reasoning on/off, in BOTH places llama.cpp reads.
+
+    The top-level `enable_thinking` field alone does NOTHING on a `--jinja`
+    server: the Qwen chat template reads `chat_template_kwargs`, and this one is
+    launched with `--chat-template-kwargs {"enable_thinking": true}`, so an
+    unqualified top-level flag is silently overridden by the template default.
+
+    Measured on the live server, identical tool-call prompt:
+        top-level only                     -> 703 chars of reasoning, 196 tokens
+        chat_template_kwargs               ->   0 chars,                27 tokens
+    and on a planning-flavoured prompt with max_tokens=700, reasoning consumed
+    the ENTIRE budget and no tool call was emitted at all.
+
+    The OPERATOR switches — PROXY_DISABLE_THINKING_ALWAYS and
+    PROXY_DISABLE_THINKING_ON_TOOL_TURNS, plus the tool-turn breakers — set only
+    the top-level field, so they were no-ops against a jinja server: they
+    existed, logged themselves as active, and changed nothing. The paths that
+    already set both (the JSON-verdict grammar, the empty-max_tokens retry, and
+    the prefill/continuation turn) worked, which is why evaluator turns were
+    unaffected and this went unnoticed elsewhere.
+
+    Use this for a switch that expresses INTENT ("this turn must not reason").
+    The Anthropic protocol-default translation deliberately does NOT use it —
+    see the comment there; making a default authoritative would change serving
+    policy for every client rather than fix a broken control.
+    """
+    body["enable_thinking"] = enabled
+    # REPLACE the nested dict rather than mutate it: callers build retry bodies
+    # with `dict(openai_body)`, a SHALLOW copy that still shares this dict, so
+    # mutating in place would silently disable thinking on the original request
+    # too. Copying keeps any other template kwargs the server was launched with.
+    existing = body.get("chat_template_kwargs")
+    ctk = dict(existing) if isinstance(existing, dict) else {}
+    ctk["enable_thinking"] = enabled
+    body["chat_template_kwargs"] = ctk
+
+
 def _apply_thinking_grammar(request_body: dict) -> None:
     """Apply the structured-thinking GBNF grammar to non-tool turns.
 
@@ -1547,6 +1670,13 @@ def _apply_profile_overrides(
     if "stop_sequences" in profile:
         updated["stop_sequences"] = profile["stop_sequences"]
     if "enable_thinking" in profile:
+        # Left as a plain assignment: `updated` is the ANTHROPIC-shaped body,
+        # and build_openai_request constructs the upstream body from a fresh
+        # literal that never reads this key — so this has never reached the
+        # wire, and writing a llama.cpp template kwarg into an Anthropic body
+        # would only add a field that passthrough requests must not carry.
+        # Wiring profiles to thinking is a separate change from making the
+        # operator switches work.
         updated["enable_thinking"] = profile["enable_thinking"]
 
     tool_call_batching = profile.get("tool_call_batching") or {}
@@ -1741,6 +1871,9 @@ class SessionMonitor:
     tool_state_forced_budget_remaining: int = 0
     tool_state_auto_budget_remaining: int = 0
     tool_state_stagnation_streak: int = 0
+    # Consecutive turns whose tool calls were ALL wait/poll tools. Bounds the
+    # loop-guard exemption so a wedged job cannot be polled forever.
+    wait_poll_streak: int = 0
     tool_state_transitions: int = 0
     tool_state_review_cycles: int = 0
     tool_state_unproductive_exhaustion_streak: int = 0
@@ -1931,6 +2064,12 @@ class SessionMonitor:
             and self.coordination_repeat_streak >= PROXY_COORDINATION_EARLY_BAN
         ):
             for n in coord_names:
+                # This path adds to session_banned_tools directly, bypassing
+                # _should_auto_ban — and an explicit ban IS honoured even for
+                # exempt tools, so a wait/poll tool reaching here would be
+                # stripped for the rest of the session.
+                if n.lower() in _WAIT_POLL_TOOLS:
+                    continue
                 if n not in self.session_banned_tools:
                     self.session_banned_tools.add(n)
                     logger.warning(
@@ -2011,6 +2150,20 @@ class SessionMonitor:
         else:
             self.rate_limited_api_streak = 0
 
+    def wait_poll_exempt(self) -> bool:
+        """True when this turn is a bounded wait on a long-running job.
+
+        Bounded: `wait_poll_streak` is capped by PROXY_WAIT_POLL_MAX_STREAK, so
+        a wedged job — indistinguishable from a healthy one at the call site —
+        eventually falls back under the normal guards.
+        """
+        last_fp = self.tool_call_history[-1] if self.tool_call_history else ""
+        if not _is_wait_poll_only(_fingerprint_tool_names(last_fp)):
+            return False
+        if PROXY_WAIT_POLL_MAX_STREAK <= 0:
+            return True
+        return self.wait_poll_streak <= PROXY_WAIT_POLL_MAX_STREAK
+
     def should_force_stuck_break(self) -> tuple[bool, str]:
         """True + reason when a terminal break should be forced this turn."""
         if not PROXY_STUCK_BREAK:
@@ -2026,7 +2179,16 @@ class SessionMonitor:
         if PROXY_REPEAT_CALL_THRESHOLD > 0:
             looping, count = self.detect_tool_loop(window=PROXY_REPEAT_CALL_THRESHOLD)
             if looping and count >= PROXY_REPEAT_CALL_THRESHOLD:
-                return True, f"{_REPEAT_CALL_REASON} x{count}"
+                # ...unless the repeated call is a WAIT. This branch is
+                # outcome-blind by design (see above), which is right for a
+                # `git diff --stat` loop and wrong for a tool that blocks on a
+                # long job and returns "still running": every poll is identical
+                # by construction, so this fires ~4 polls in — earlier than the
+                # cycle path — and tells the agent "you already have that
+                # output, do NOT repeat it" while the job is still running.
+                # The wait is bounded by the job, not by the agent.
+                if not self.wait_poll_exempt():
+                    return True, f"{_REPEAT_CALL_REASON} x{count}"
         return False, ""
 
     def note_deferral_signal(self, text: str, had_tool_call: bool) -> None:
@@ -5371,6 +5533,26 @@ def _update_tool_state_stagnation(
     repeated = latest_tool_fingerprint == monitor.last_tool_fingerprint
     recently_seen = latest_tool_fingerprint in monitor.tool_call_history[-4:-1]
 
+    # THE choke point for the wait/poll exemption. This signal is keyed on
+    # repeats alone — `repeated` above is a fingerprint comparison — and a poll
+    # of a long job repeats by construction, while its "still running" reply is
+    # a tool_result, so the only reset guard never fires either. Left unchecked
+    # the streak climbs one per poll straight through a healthy wait and the
+    # state machine enters review, accrues review cycles, and force-finalizes
+    # with "wrap up ... what is blocking further progress" — mid-build.
+    #
+    # Exempting HERE rather than at each consumer covers the stagnation
+    # finalize, the review-cycle limit and the phase flip in one place.
+    if _is_wait_poll_only(_fingerprint_tool_names(latest_tool_fingerprint)):
+        monitor.wait_poll_streak += 1
+        if PROXY_WAIT_POLL_MAX_STREAK <= 0 or monitor.wait_poll_streak <= PROXY_WAIT_POLL_MAX_STREAK:
+            monitor.last_tool_fingerprint = latest_tool_fingerprint
+            return
+        # Past the cap the guards resume: a wedged job looks exactly like a
+        # healthy one from here, so the exemption must not be unbounded.
+    else:
+        monitor.wait_poll_streak = 0
+
     if repeated or recently_seen:
         monitor.tool_state_stagnation_streak += 1
     else:
@@ -5533,6 +5715,24 @@ def _resolve_state_machine_tool_choice(
         # kept as a strong signal (read target repeated 3+ times). Low-repeat
         # cycles detected by detect_tool_cycle get filtered here.
         cycle_trip = cycle_looping and cycle_repeat >= PROXY_CYCLE_TRIGGER_REPEAT
+        # A cycle made up ENTIRELY of wait/poll calls is a wait, not a spin.
+        # Letting it trip still costs the session even with the tool exempted
+        # from narrowing: entering review increments tool_state_review_cycles,
+        # and at PROXY_TOOL_STATE_REVIEW_CYCLE_LIMIT the machine forces a
+        # finalize turn telling the agent to "wrap up" — mid-wait.
+        #
+        # Judged over the SAME window the detector used: a shorter slice lets an
+        # A/B oscillation between a wait tool and a real one be suppressed
+        # whenever the last turns happen to be waits. And only `cycle_trip` is
+        # cleared, never `cycle_looping` — that flag also carries the
+        # duplicate-read-target signal, which is not fingerprint-derived, and
+        # clearing it flips a downstream branch into counting the turn as
+        # unproductive (arming a different finalize).
+        _cycle_window = max(2, PROXY_TOOL_STATE_CYCLE_WINDOW)
+        if cycle_trip and _is_wait_poll_only(
+            _fingerprint_tool_names("|".join(monitor.tool_call_history[-_cycle_window:]))
+        ):
+            cycle_trip = False
         if cycle_trip or stagnating:
             reason = "cycle_detected" if cycle_looping else "stagnation"
             monitor.set_tool_turn_phase("review", reason=reason)
@@ -5592,7 +5792,15 @@ def _resolve_state_machine_tool_choice(
 
         if monitor.tool_state_forced_budget_remaining <= 0:
             monitor.set_tool_turn_phase("review", reason="forced_budget_exhausted")
-            if cycle_looping or stagnating:
+            if monitor.wait_poll_exempt():
+                # A bounded wait is neither a cycle nor an unproductive burn:
+                # both arms below lead to a forced finalize (review-cycle limit
+                # at 3, unproductive-exhaustion at 2), and reaching either
+                # mid-wait tells the agent to wrap up a job that is still
+                # running. Bounded by PROXY_WAIT_POLL_MAX_STREAK, so a wedged
+                # run falls back into normal accounting.
+                monitor.tool_state_unproductive_exhaustion_streak = 0
+            elif cycle_looping or stagnating:
                 monitor.tool_state_review_cycles += 1
                 monitor.tool_state_unproductive_exhaustion_streak = 0
             else:
@@ -6453,14 +6661,26 @@ def build_openai_request(
     # consume the client's max_tokens budget on internal reasoning, leaving
     # nothing for the visible answer.
     anthropic_thinking = anthropic_body.get("thinking")
+    # PROTOCOL DEFAULT — deliberately top-level only, NOT via _set_thinking.
+    #
+    # Anthropic's default is "thinking off unless asked", so this branch sets
+    # off for almost every request. Against a jinja server the top-level field
+    # is inert, which is why the upstream has been reasoning by default all
+    # along. Routing this through _set_thinking would make it authoritative and
+    # silently flip EVERY client that never asked for thinking — Claude Code,
+    # opencode, benchmarks, all OpenAI-compat traffic — from the server's
+    # configured default to off. That is a serving-policy change, not a bug fix.
+    #
+    # The same reasoning applies to the "enabled" case in reverse: making it
+    # authoritative would let a client turn reasoning ON against a server
+    # deliberately launched with it off. The measured bug was one-directional
+    # (an operator's OFF switch didn't stick); the fix stays one-directional.
+    # Operators who want thinking off across the board have an explicit switch
+    # below (PROXY_DISABLE_THINKING_ALWAYS), and it now works.
     if isinstance(anthropic_thinking, dict):
         ttype = (anthropic_thinking.get("type") or "").lower()
-        if ttype == "enabled":
-            openai_body["enable_thinking"] = True
-        else:
-            openai_body["enable_thinking"] = False
+        openai_body["enable_thinking"] = ttype == "enabled"
     else:
-        # Match Anthropic default: thinking off unless explicitly requested.
         openai_body["enable_thinking"] = False
 
     # Global thinking-off (G): apply to every request, not just tool turns.
@@ -6468,7 +6688,7 @@ def build_openai_request(
     # Per-path tool-turn handling below (DISABLE_THINKING_ON_TOOL_TURNS) is
     # additive — ALWAYS supersedes when set.
     if PROXY_DISABLE_THINKING_ALWAYS:
-        openai_body["enable_thinking"] = False
+        _set_thinking(openai_body, False)
 
     # Inject agentic protocol instructions only for tool-enabled turns.
     # Use minimal supplement for qwen models to reduce prompt leak surface.
@@ -6788,7 +7008,7 @@ def build_openai_request(
                 monitor.catastrophic_ctx_streak,
             )
             if PROXY_DISABLE_THINKING_ON_TOOL_TURNS:
-                openai_body["enable_thinking"] = False
+                _set_thinking(openai_body, False)
             if PROXY_DISABLE_SPEC_ON_TOOL_TURNS:
                 openai_body["speculative.n_max"] = 0
             return openai_body
@@ -6813,7 +7033,7 @@ def build_openai_request(
             )
             # Skip all further tool_choice logic — no tools this turn
             if PROXY_DISABLE_THINKING_ON_TOOL_TURNS:
-                openai_body["enable_thinking"] = False
+                _set_thinking(openai_body, False)
             if PROXY_DISABLE_SPEC_ON_TOOL_TURNS:
                 openai_body["speculative.n_max"] = 0
             return openai_body
@@ -6863,7 +7083,7 @@ def build_openai_request(
                     PROXY_HARD_FINALIZE_TURNS,
                 )
                 if PROXY_DISABLE_THINKING_ON_TOOL_TURNS:
-                    openai_body["enable_thinking"] = False
+                    _set_thinking(openai_body, False)
                 if PROXY_DISABLE_SPEC_ON_TOOL_TURNS:
                     openai_body["speculative.n_max"] = 0
                 return openai_body
@@ -6931,9 +7151,16 @@ def build_openai_request(
             if (
                 monitor.tool_turn_phase == "review"
                 and state_reason in {"cycle_detected", "stagnation"}
-                and monitor.cycling_tool_names
+                # A hint naming ONLY wait/poll tools would read "stop calling
+                # deliver, produce your final answer now" while the job it is
+                # waiting on is still running — an instruction to abandon the
+                # wait and claim a result the agent does not have yet. Hint on
+                # the genuinely-spinning tools, or say nothing.
+                and _spinning_cycling_names(monitor.cycling_tool_names)
             ):
-                cycling_names = ", ".join(monitor.cycling_tool_names)
+                cycling_names = ", ".join(
+                    _spinning_cycling_names(monitor.cycling_tool_names)
+                )
                 cycles = monitor.tool_state_review_cycles
                 if cycles <= 1:
                     cycle_hint = (
@@ -6975,8 +7202,12 @@ def build_openai_request(
                 )
                 if narrowed:
                     openai_body["tools"] = narrowed
-                    # Only log on first activation or phase transitions to reduce noise
-                    if state_reason in {"cycle_detected", "stagnation"}:
+                    # Only log on first activation or phase transitions to reduce noise.
+                    # `len(narrowed) < original_count` keeps an exempt-only cycle
+                    # from logging "narrowed tools from 5 to 5", which reads as a
+                    # cycle-break having happened when nothing was excluded —
+                    # exactly the line that would mislead triage of this incident.
+                    if state_reason in {"cycle_detected", "stagnation"} and len(narrowed) < original_count:
                         logger.warning(
                             "CYCLE BREAK: narrowed tools from %d to %d (excluded %s, read_only_class=%s)",
                             original_count,
@@ -7046,7 +7277,7 @@ def build_openai_request(
 
 
         if PROXY_DISABLE_THINKING_ALWAYS or PROXY_DISABLE_THINKING_ON_TOOL_TURNS:
-            openai_body["enable_thinking"] = False
+            _set_thinking(openai_body, False)
             logger.info(
                 "Thinking disabled (always=%s tool_turns=%s)",
                 PROXY_DISABLE_THINKING_ALWAYS,
@@ -9408,10 +9639,7 @@ async def _apply_empty_maxtokens_recovery(
     if not _is_empty_maxtokens_response(openai_resp):
         return openai_resp
     retry_body = dict(openai_body)
-    retry_body["enable_thinking"] = False
-    ctk = dict(retry_body.get("chat_template_kwargs") or {})
-    ctk["enable_thinking"] = False
-    retry_body["chat_template_kwargs"] = ctk
+    _set_thinking(retry_body, False)
     requested = int(openai_body.get("max_tokens") or PROXY_EMPTY_MAXTOKENS_RETRY_MAX_TOKENS)
     retry_body["max_tokens"] = min(requested, PROXY_EMPTY_MAXTOKENS_RETRY_MAX_TOKENS)
     logger.warning(
@@ -9577,7 +9805,7 @@ def _build_malformed_retry_body(
             )
 
     if PROXY_DISABLE_THINKING_ON_TOOL_TURNS:
-        retry_body["enable_thinking"] = False
+        _set_thinking(retry_body, False)
 
     # Option 3: Proactively strip grammar from retry when tools are present and
     # grammar+tools is known to be incompatible. Prevents the 400 error

package/tools/agents/tests/test_anthropic_proxy_streaming.py

@@ -2043,6 +2043,17 @@ class TestToolTurnControls(unittest.TestCase):
             )
             self.assertIn("enable_thinking", openai)
             self.assertFalse(openai["enable_thinking"])
+            # THE assertion whose absence let the switch be a no-op for months:
+            # a `--jinja` server reads chat_template_kwargs and ignores the
+            # top-level field entirely, so asserting only the line above passes
+            # while the upstream keeps reasoning. Measured on the live server:
+            # top-level only -> 703 chars of reasoning; this key -> 0.
+            self.assertIs(
+                openai.get("chat_template_kwargs", {}).get("enable_thinking"),
+                False,
+                "tool-turn thinking switch must reach chat_template_kwargs, "
+                "or a --jinja upstream ignores it",
+            )
         finally:
             setattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS", old_disable)
 

package/tools/agents/tests/test_cycle_break_wait_poll.py

@@ -0,0 +1,293 @@
+"""A tool that BLOCKS on a long job must not be loop-broken for repeating.
+
+Incident (2026-08-17): an agent was following a healthy `deliver` run — heartbeat
+8s old, run checkpoint advancing, genuinely compiling a Rust crate. `deliver` in
+follow mode blocks up to its wait budget and returns "still running", so the
+correct behaviour is to call it again; every poll therefore carries identical
+arguments and an identical fingerprint.
+
+Three separate guards read those repeats as a spin:
+
+  1. should_force_stuck_break  — fires FIRST, at 4 identical calls, judged on
+     the fingerprint alone, and injects "STOP ... do NOT repeat it".
+  2. the cycle path            — enters review, increments review cycles, and
+     at the review-cycle limit forces a "wrap up" finalize turn.
+  3. cycle-break narrowing     — excluded the deliver tool outright, after which
+     the agent could no longer observe the work it was waiting on and fell
+     through to Bash, cycling on THAT instead. Median turn spacing collapsed
+     from the 45s poll interval to 5s.
+
+Unlike a cycling Bash ("vary the command"), there is no different argument to
+vary toward: the job is simply not finished yet. The wait is bounded by the job.
+"""
+import importlib.util
+import os
+import unittest
+from pathlib import Path
+
+proxy_path = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+
+
+def load_proxy(wait_tools=None):
+    # Explicit, so a project .uap/proxy.env cannot inject PROXY_WAIT_POLL_TOOLS
+    # and silently invalidate the default-list assertions when this module is
+    # run directly rather than through the npm script.
+    os.environ["UAP_PROXY_ENV_AUTOLOAD"] = "0"
+    if wait_tools is None:
+        os.environ.pop("PROXY_WAIT_POLL_TOOLS", None)
+    else:
+        os.environ["PROXY_WAIT_POLL_TOOLS"] = wait_tools
+    spec = importlib.util.spec_from_file_location("anthropic_proxy_waitpoll", proxy_path)
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod
+
+
+def tool(name):
+    return {"type": "function", "function": {"name": name, "parameters": {}}}
+
+
+# The toolset from the live incident, trimmed to the relevant members.
+TOOLS = [tool(n) for n in ("uap-router_deliver", "bash", "read", "edit", "glob")]
+
+
+_PRIOR_AUTOLOAD = os.environ.get("UAP_PROXY_ENV_AUTOLOAD")
+
+
+def tearDownModule():
+    # Restore rather than leak into any module loaded later in this process —
+    # cross-test env leakage from files like this one has caused
+    # order-dependent failures before.
+    if _PRIOR_AUTOLOAD is None:
+        os.environ.pop("UAP_PROXY_ENV_AUTOLOAD", None)
+    else:
+        os.environ["UAP_PROXY_ENV_AUTOLOAD"] = _PRIOR_AUTOLOAD
+
+
+class _Base(unittest.TestCase):
+    def tearDown(self):
+        os.environ.pop("PROXY_WAIT_POLL_TOOLS", None)
+
+    @staticmethod
+    def _names(tools):
+        return [t["function"]["name"] for t in tools]
+
+
+class WaitPollNotNarrowedTest(_Base):
+    def test_the_polled_tool_survives_the_cycle_break(self):
+        ap = load_proxy()
+        narrowed, _ = ap._narrow_tools_for_cycle_break(TOOLS, ["uap-router_deliver"], [])
+        self.assertIn("uap-router_deliver", self._names(narrowed))
+
+    def test_a_genuinely_spinning_tool_is_still_narrowed(self):
+        ap = load_proxy()
+        narrowed, _ = ap._narrow_tools_for_cycle_break(TOOLS, ["edit"], [])
+        self.assertNotIn("edit", self._names(narrowed))
+
+    def test_matching_is_exact_not_substring(self):
+        # A tool whose name merely CONTAINS an exempt name must still be
+        # narrowed — otherwise the exemption silently widens to anything
+        # someone names "deliver_report".
+        ap = load_proxy()
+        tools = [tool("deliver_report"), tool("bash"), tool("edit")]
+        narrowed, _ = ap._narrow_tools_for_cycle_break(tools, ["deliver_report"], [])
+        self.assertNotIn("deliver_report", self._names(narrowed))
+
+    def test_the_polled_tool_is_never_auto_banned(self):
+        ap = load_proxy()
+        self.assertFalse(ap._should_auto_ban("uap-router_deliver", cycle_count=99, ban_at=3))
+        self.assertTrue(ap._should_auto_ban("edit", cycle_count=99, ban_at=3))
+
+    def test_an_explicit_session_ban_is_still_honoured(self):
+        ap = load_proxy()
+        narrowed, _ = ap._narrow_tools_for_cycle_break(TOOLS, [], ["uap-router_deliver"])
+        self.assertNotIn("uap-router_deliver", self._names(narrowed))
+
+    def test_the_set_is_configurable(self):
+        ap = load_proxy(wait_tools="my_wait_tool")
+        self.assertIn("my_wait_tool", ap._WAIT_POLL_TOOLS)
+        narrowed, _ = ap._narrow_tools_for_cycle_break(
+            [tool("my_wait_tool"), tool("edit")], ["my_wait_tool"], []
+        )
+        self.assertIn("my_wait_tool", self._names(narrowed))
+
+    def test_matching_is_case_insensitive(self):
+        ap = load_proxy()
+        narrowed, _ = ap._narrow_tools_for_cycle_break(
+            [tool("UAP-Router_Deliver"), tool("edit")], ["UAP-Router_Deliver"], []
+        )
+        self.assertIn("UAP-Router_Deliver", self._names(narrowed))
+
+    def test_exploration_hatch_still_exempt(self):
+        ap = load_proxy()
+        narrowed, _ = ap._narrow_tools_for_cycle_break(TOOLS, ["bash"], [])
+        self.assertIn("bash", self._names(narrowed))
+
+
+class DeliverWireNamesTest(_Base):
+    def test_both_mcp_config_keys_are_covered(self):
+        # Names arrive prefixed with the MCP server's CONFIG KEY, and this repo
+        # ships two: `uap-router` (.mcp.json / opencode.json) and `router`
+        # (setup-mcp-router.ts, used by `uap setup`). Covering one exempts only
+        # half the fleet.
+        ap = load_proxy()
+        for name in ("uap-router_deliver", "mcp__uap-router__deliver",
+                     "router_deliver", "mcp__router__deliver", "deliver"):
+            self.assertIn(name, ap._WAIT_POLL_TOOLS, name)
+
+    def test_deliver_counts_as_a_write_under_every_wire_name(self):
+        # _WRITE_TOOL_CLASS with only the bare name let the no-write streak
+        # climb through a healthy delivery, escalating recon-convergence
+        # mid-wait ("write your deliverable now") while the deliverable was
+        # being written by the run being waited on.
+        ap = load_proxy()
+        for name in ap._DELIVER_TOOL_NAMES:
+            self.assertIn(name, ap._WRITE_TOOL_CLASS, name)
+
+    def test_wait_poll_and_write_classes_deliberately_overlap(self):
+        # Other tool classes in this module are pairwise disjoint; this pair is
+        # not, and the intent is pinned here rather than left implicit.
+        ap = load_proxy()
+        self.assertTrue(ap._WAIT_POLL_TOOLS & ap._WRITE_TOOL_CLASS)
+
+
+class StuckBreakTest(_Base):
+    """The guard that fires FIRST — 4 identical calls, outcome-blind."""
+
+    @staticmethod
+    def _monitor(ap, history):
+        m = ap.SessionMonitor(context_window=131072)
+        m.tool_call_history = list(history)
+        return m
+
+    def test_a_healthy_poll_does_not_force_a_stuck_break(self):
+        ap = load_proxy()
+        m = self._monitor(ap, ["uap-router_deliver:abc"] * 8)
+        forced, reason = m.should_force_stuck_break()
+        self.assertFalse(forced, reason)
+
+    def test_a_genuinely_repeated_call_still_forces_a_break(self):
+        # The 44-turn `git diff --stat` loop this guard exists for.
+        ap = load_proxy()
+        m = self._monitor(ap, ["bash:diffstat"] * 8)
+        forced, _ = m.should_force_stuck_break()
+        self.assertTrue(forced)
+
+    def test_a_wait_mixed_with_a_spin_still_breaks(self):
+        # all-not-any: a turn calling deliver alongside a spinning tool is
+        # still a spin and must stay breakable.
+        ap = load_proxy()
+        m = self._monitor(ap, ["uap-router_deliver:abc|bash:x"] * 8)
+        forced, _ = m.should_force_stuck_break()
+        self.assertTrue(forced)
+
+
+class StateMachineEndToEndTest(_Base):
+    """Drive real polls through the state machine — the test that catches the
+    guard the helper-level tests miss.
+
+    The first cut of this fix exempted narrowing, the stuck-break and the cycle
+    trip, and STILL force-finalized a healthy wait: the stagnation signal is
+    keyed on repeats (`latest_fingerprint == last_fingerprint`) and its only
+    reset needs a turn WITHOUT a tool_result, which a poll always has. It
+    climbed one per poll, entered review at 9, and hit the review-cycle limit at
+    16 with "wrap up ... what is blocking further progress" — mid-build.
+    """
+
+    FP = "uap-router_deliver:abc"
+
+    @staticmethod
+    def _poll(ap, monitor, fingerprint, msgs):
+        """One agent turn: record the call, then run the state machine.
+
+        `msgs` GROWS across turns. A constant-length message list reads as a
+        compaction boundary ("message count collapsed"), which resets all
+        anti-spin state every turn and would make this harness silently prove
+        nothing.
+        """
+        monitor.record_tool_calls(["deliver"], fingerprint=fingerprint)
+        ap._update_tool_state_stagnation(
+            monitor, latest_tool_fingerprint=fingerprint, last_user_has_tool_result=True
+        )
+        msgs.append({"role": "assistant", "content": "calling"})
+        msgs.append({"role": "user", "content": "STILL RUNNING"})
+        body = {"messages": list(msgs), "tools": [tool("uap-router_deliver")]}
+        # A poll always carries the previous poll's "still running" tool_result,
+        # which is precisely why the stagnation reset never fires for it.
+        return ap._resolve_state_machine_tool_choice(
+            body, monitor, has_tool_results=True, last_user_has_tool_result=True
+        )
+
+    def test_a_healthy_wait_is_never_force_finalized(self):
+        ap = load_proxy()
+        m = ap.SessionMonitor(context_window=131072)
+        msgs = [{"role": "user", "content": "start"}]
+        for i in range(30):
+            self._poll(ap, m, self.FP, msgs)
+            self.assertNotEqual(
+                m.tool_turn_phase, "finalize",
+                f"forced a finalize on poll {i + 1} of a healthy wait",
+            )
+        self.assertEqual(m.tool_state_stagnation_streak, 0)
+        self.assertEqual(m.tool_state_review_cycles, 0)
+
+    def test_a_wedged_job_is_still_bounded(self):
+        # The exemption is call-side and outcome-blind, so it MUST be capped:
+        # a dead run polled forever would otherwise be bounded only by the
+        # client's own timeout.
+        ap = load_proxy()
+        ap.PROXY_WAIT_POLL_MAX_STREAK = 5
+        m = ap.SessionMonitor(context_window=131072)
+        msgs = [{"role": "user", "content": "start"}]
+        for _ in range(40):
+            self._poll(ap, m, self.FP, msgs)
+        self.assertGreater(
+            m.tool_state_stagnation_streak, 0,
+            "past the cap the normal guards must resume",
+        )
+
+    def test_a_real_spin_still_stagnates(self):
+        ap = load_proxy()
+        m = ap.SessionMonitor(context_window=131072)
+        msgs = [{"role": "user", "content": "start"}]
+        for _ in range(10):
+            self._poll(ap, m, "bash:samecmd", msgs)
+        self.assertGreater(m.tool_state_stagnation_streak, 0)
+
+    def test_the_streak_resets_when_the_agent_does_something_else(self):
+        ap = load_proxy()
+        m = ap.SessionMonitor(context_window=131072)
+        msgs = [{"role": "user", "content": "start"}]
+        for _ in range(5):
+            self._poll(ap, m, self.FP, msgs)
+        self.assertEqual(m.wait_poll_streak, 5)
+        self._poll(ap, m, "edit:file", msgs)
+        self.assertEqual(m.wait_poll_streak, 0)
+
+
+class HelperTest(_Base):
+    def test_fingerprint_names_are_unpacked(self):
+        ap = load_proxy()
+        self.assertEqual(
+            ap._fingerprint_tool_names("uap-router_deliver:abc123|bash:def"),
+            {"uap-router_deliver", "bash"},
+        )
+
+    def test_is_wait_poll_only_requires_all(self):
+        ap = load_proxy()
+        self.assertTrue(ap._is_wait_poll_only({"uap-router_deliver"}))
+        self.assertFalse(ap._is_wait_poll_only({"uap-router_deliver", "bash"}))
+        self.assertFalse(ap._is_wait_poll_only(set()))
+
+    def test_hint_names_drop_wait_tools_but_keep_spinners(self):
+        # The load-bearing mixed case: the hint must still fire, naming only
+        # the tool that is actually spinning.
+        ap = load_proxy()
+        self.assertEqual(
+            ap._spinning_cycling_names(["uap-router_deliver", "read"]), ["read"]
+        )
+        self.assertEqual(ap._spinning_cycling_names(["uap-router_deliver"]), [])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_thinking_template_kwargs.py

@@ -0,0 +1,155 @@
+"""Turning reasoning off must reach the place llama.cpp actually reads it.
+
+Measured on the live server (Qwen3.6-35B-A3B, launched `--jinja
+--chat-template-kwargs {"enable_thinking": true}`), identical tool-call prompt:
+
+    top-level "enable_thinking": false   -> 703 chars of reasoning, 196 tokens
+    chat_template_kwargs.enable_thinking ->   0 chars,                27 tokens
+
+and on a planning-flavoured prompt with max_tokens=700, reasoning consumed the
+ENTIRE budget and NO tool call was emitted — the "stuck planning" symptom.
+
+Every thinking switch in the proxy set only the top-level field, so
+PROXY_DISABLE_THINKING_ALWAYS, PROXY_DISABLE_THINKING_ON_TOOL_TURNS and the
+Anthropic `thinking: {type: disabled}` parameter were all no-ops against a jinja
+server: the controls existed, logged themselves as active, and changed nothing.
+"""
+import importlib.util
+import os
+import unittest
+from pathlib import Path
+
+proxy_path = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+
+
+_PRIOR_AUTOLOAD = os.environ.get("UAP_PROXY_ENV_AUTOLOAD")
+
+
+def tearDownModule():
+    # Restore rather than leak into any test sharing this process.
+    if _PRIOR_AUTOLOAD is None:
+        os.environ.pop("UAP_PROXY_ENV_AUTOLOAD", None)
+    else:
+        os.environ["UAP_PROXY_ENV_AUTOLOAD"] = _PRIOR_AUTOLOAD
+
+
+def load_proxy(**env):
+    # Explicit, so a project .uap/proxy.env cannot leak in when this module is
+    # run directly rather than through the npm script.
+    os.environ["UAP_PROXY_ENV_AUTOLOAD"] = "0"
+    for k in ("PROXY_DISABLE_THINKING_ALWAYS", "PROXY_DISABLE_THINKING_ON_TOOL_TURNS"):
+        os.environ.pop(k, None)
+    os.environ.update({k: v for k, v in env.items()})
+    spec = importlib.util.spec_from_file_location("anthropic_proxy_thinking", proxy_path)
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod
+
+
+class SetThinkingTest(unittest.TestCase):
+    def tearDown(self):
+        for k in ("PROXY_DISABLE_THINKING_ALWAYS", "PROXY_DISABLE_THINKING_ON_TOOL_TURNS"):
+            os.environ.pop(k, None)
+
+    def test_disabling_reaches_chat_template_kwargs(self):
+        # THE BUG: the top-level field alone is overridden by the server's
+        # --chat-template-kwargs default, so reasoning kept flowing.
+        ap = load_proxy()
+        body = {}
+        ap._set_thinking(body, False)
+        self.assertIs(body["chat_template_kwargs"]["enable_thinking"], False)
+
+    def test_top_level_is_still_set_for_servers_that_read_it(self):
+        # Belt and braces: non-jinja / older builds read the top-level field.
+        ap = load_proxy()
+        body = {}
+        ap._set_thinking(body, False)
+        self.assertIs(body["enable_thinking"], False)
+
+    def test_enabling_reaches_both_places_too(self):
+        ap = load_proxy()
+        body = {}
+        ap._set_thinking(body, True)
+        self.assertIs(body["enable_thinking"], True)
+        self.assertIs(body["chat_template_kwargs"]["enable_thinking"], True)
+
+    def test_existing_chat_template_kwargs_are_preserved(self):
+        # The server is launched with other template kwargs; clobbering the dict
+        # would drop them.
+        ap = load_proxy()
+        body = {"chat_template_kwargs": {"preserve_thinking": False, "custom": 1}}
+        ap._set_thinking(body, False)
+        self.assertEqual(body["chat_template_kwargs"]["custom"], 1)
+        self.assertIs(body["chat_template_kwargs"]["preserve_thinking"], False)
+        self.assertIs(body["chat_template_kwargs"]["enable_thinking"], False)
+
+    def test_a_non_dict_kwargs_value_does_not_raise(self):
+        # Defensive: a malformed client body must not 500 the turn.
+        ap = load_proxy()
+        body = {"chat_template_kwargs": "nonsense"}
+        ap._set_thinking(body, False)
+        self.assertIs(body["enable_thinking"], False)
+
+    def test_a_shallow_retry_copy_does_not_disable_thinking_on_the_original(self):
+        # The helper's whole rationale: retry bodies are built as
+        # `dict(openai_body)`, which SHARES this nested dict. Mutating it in
+        # place would disable thinking on the in-flight request too.
+        ap = load_proxy()
+        original = {"chat_template_kwargs": {"enable_thinking": True}}
+        retry = dict(original)
+        ap._set_thinking(retry, False)
+        self.assertIs(original["chat_template_kwargs"]["enable_thinking"], True)
+        self.assertIs(retry["chat_template_kwargs"]["enable_thinking"], False)
+
+
+class SwitchesReachTheTemplateTest(unittest.TestCase):
+    """The switches, exercised through the real request builder."""
+
+    def tearDown(self):
+        for k in ("PROXY_DISABLE_THINKING_ALWAYS", "PROXY_DISABLE_THINKING_ON_TOOL_TURNS"):
+            os.environ.pop(k, None)
+
+    @staticmethod
+    def _build(ap, tools=False):
+        body = {"model": "test", "messages": [{"role": "user", "content": "hi"}]}
+        if tools:
+            body["tools"] = [
+                {"name": "Read", "description": "Read file", "input_schema": {"type": "object"}}
+            ]
+        return ap.build_openai_request(body, ap.SessionMonitor(context_window=262144))
+
+    def test_always_switch_reaches_chat_template_kwargs(self):
+        ap = load_proxy(PROXY_DISABLE_THINKING_ALWAYS="on")
+        built = self._build(ap)
+        self.assertIs(built["chat_template_kwargs"]["enable_thinking"], False)
+
+    def test_protocol_default_does_NOT_force_the_template(self):
+        # Deliberate: Anthropic defaults thinking off, and making that
+        # authoritative would flip every client that never asked for it from
+        # the server's configured default to off. A serving-policy change is
+        # not a bug fix; operators have an explicit switch for that.
+        ap = load_proxy()
+        built = self._build(ap)
+        self.assertIs(built["enable_thinking"], False)
+        self.assertNotIn(
+            "enable_thinking",
+            built.get("chat_template_kwargs", {}),
+            "the protocol default must not override the server's configured default",
+        )
+
+    def test_a_client_cannot_turn_thinking_ON_against_the_server_default(self):
+        # The measured bug was one-directional (an OFF switch that didn't
+        # stick); the fix stays one-directional.
+        ap = load_proxy()
+        body = {
+            "model": "test",
+            "messages": [{"role": "user", "content": "hi"}],
+            "thinking": {"type": "enabled"},
+        }
+        built = ap.build_openai_request(body, ap.SessionMonitor(context_window=262144))
+        self.assertIs(built["enable_thinking"], True)
+        self.assertNotIn("enable_thinking", built.get("chat_template_kwargs", {}))
+
+
+if __name__ == "__main__":
+    unittest.main()