@miller-tech/uap 1.218.0 → 1.219.0

package/templates/hooks/uap-policy-gate.sh

@@ -71,7 +71,7 @@ export UAP_WORKTREE_ROOT="$CHECKOUT_ROOT"
 #      in .bashrc) can NOT silently downgrade a project configured to `block`
 #      and let the agent bypass deliver. `delivery.localMode` is read the same
 #      authoritative way and selects how a local-model session resolves block
-#      (advisory|deliver|block — see delivery_enforcement.py).
+#      (advisory|deliver|block|escalate — see delivery_enforcement.py).
 #   2. ambient UAP_ENFORCE_DELIVERY (operator/CI per-run override) when the
 #      project declares nothing.
 #   3. default: block.
@@ -83,7 +83,7 @@ import json, sys
 try:
     d = (json.load(open(sys.argv[1])).get("delivery") or {})
     e = str(d.get("enforcement", "")).lower()
-    print("%s|%s" % (e if e in ("block", "advisory", "off") else "", str(d.get("localMode", "")).lower()))
+    print("%s|%s" % (e if e in ("block", "advisory", "off", "escalate") else "", str(d.get("localMode", "")).lower()))
 except Exception:
     print("|")
 ' "$MAIN_ROOT/.uap.json" 2>/dev/null || echo "|")"
@@ -168,7 +168,7 @@ if not hit and cmd:
             if hit:
                 break
 bypass = re.search(
-    r"UAP_DELIVER_BYPASS\s*=\s*[\x27\"]?1|UAP_ENFORCE_DELIVERY\s*=\s*[\x27\"]?(advisory|off|0|false|no)"
+    r"UAP_DELIVER_BYPASS\s*=\s*[\x27\"]?1|UAP_ENFORCE_DELIVERY\s*=\s*[\x27\"]?(advisory|off|escalate|0|false|no)"
     r"|UAP_SELF_PROTECT_OFF\s*=\s*[\x27\"]?1|UAP_NO_WORKTREE\s*=\s*[\x27\"]?1"
     r"|UAP_WORKDIR_SCOPE_OFF\s*=\s*[\x27\"]?1|UAP_USER_VALIDATION\s*=\s*[\x27\"]?0"
     r"|UAP_DELIVER_NO_LOCK\s*=\s*[\x27\"]?1|UAP_NO_REVIEW\s*=\s*[\x27\"]?1"
@@ -293,7 +293,7 @@ record_execution() {
   local esc_args esc_reason
   esc_args="$(printf '%s' "$ARGS" | sed "s/'/''/g")"
   esc_reason="$(printf '%s' "$reason" | sed "s/'/''/g" | cut -c1-500)"
-  sqlite3 "$DB" "INSERT INTO policy_executions
+  sqlite3 -cmd ".timeout 5000" "$DB" "INSERT INTO policy_executions
     (policyId, toolName, operation, args, result, allowed, reason, executedAt)
     VALUES ('$pid', '${TOOL//\'/\'\'}', '${TOOL//\'/\'\'}', '$esc_args',
             '{}', $allowed, '$esc_reason', strftime('%Y-%m-%dT%H:%M:%fZ','now'));
@@ -463,7 +463,7 @@ except: print("")' 2>/dev/null || echo "")"
 # first, and the agent saw the wrong routing message. Honor priority now so
 # the intended policy fires first. (Blocking short-circuits at exit 2, so the
 # highest-priority applicable block wins.) Name is the stable tiebreak.
-done < <(sqlite3 "$DB" "SELECT p.id, p.name, t.toolName FROM policies p JOIN executable_tools t ON t.policyId=p.id WHERE p.isActive=1 ORDER BY p.priority DESC, p.name ASC;")
+done < <(sqlite3 -cmd ".timeout 5000" "$DB" "SELECT p.id, p.name, t.toolName FROM policies p JOIN executable_tools t ON t.policyId=p.id WHERE p.isActive=1 ORDER BY p.priority DESC, p.name ASC;")
 
 # A sensitive op that no self-protect enforcer ever evaluated = the control
 # surface is unguarded (self-protect not registered/active). Fail closed.

package/tools/agents/scripts/anthropic_proxy.py

@@ -1945,6 +1945,96 @@ def _apply_profile_overrides(
     return updated, prompt_suffix, grammar_text
 
 
+# ── Upstream-safe tool names ────────────────────────────────────────────────
+# llama.cpp's grammar builder cannot parse a tool NAME containing '-' or '.'
+# under tool_choice=required: the request fails with HTTP 400 "Failed to
+# initialize samplers: failed to parse grammar" (measured 2026-08-21 against
+# the live server: `uap-router_deliver` -> 400, the same schema as
+# `uap_router_deliver` -> 200; `auto` passes either way because the lazy
+# grammar path never compiles the name). OpenCode prefixes every MCP tool
+# with "<server>_" and servers are named with hyphens, so the moment a rail
+# forces `required` with such a tool present, the turn dies and the client
+# session wedges (observed: RECON hard tier restored `uap-router_deliver`,
+# forced required, 400, stream error, 10h idle).
+#
+# Names are rewritten to [A-Za-z0-9_] on the way UP (tool definitions, the
+# assistant history's tool_calls, a function-pinned tool_choice) and restored
+# on the way DOWN, so the client never sees the sanitized form. The map is
+# module-level: sanitization is a pure function of the name, so one map serves
+# every session and every response path (stream, strict, non-stream).
+_UPSTREAM_TOOL_NAME_BAD_RE = re.compile(r"[^A-Za-z0-9_]")
+_UPSTREAM_TOOL_NAME_MAP: dict[str, str] = {}  # sanitized -> original
+
+
+def _sanitize_tool_name(name: str) -> str:
+    return _UPSTREAM_TOOL_NAME_BAD_RE.sub("_", name or "")
+
+
+def _sanitize_tool_names_for_upstream(openai_body: dict) -> int:
+    """Rewrite unsafe tool names in-place; returns how many were renamed.
+
+    Idempotent: already-safe names are untouched, so calling it on a retry is
+    harmless. A rename that would collide with another tool's (native or
+    sanitized) name gets a numeric suffix.
+    """
+    tools = openai_body.get("tools") or []
+    originals = {
+        ((t.get("function") or {}).get("name") or "")
+        for t in tools
+        if isinstance(t, dict) and isinstance(t.get("function"), dict)
+    }
+    renamed: dict[str, str] = {}  # original -> safe
+    taken: set[str] = set()
+    for t in tools:
+        fn = t.get("function") if isinstance(t, dict) else None
+        if not isinstance(fn, dict):
+            continue
+        name = fn.get("name") or ""
+        safe = _sanitize_tool_name(name)
+        if safe == name:
+            taken.add(name)
+            # A tool that NATIVELY owns this spelling must never be restored
+            # to some other client's hyphenated name left in the global map.
+            _UPSTREAM_TOOL_NAME_MAP.pop(name, None)
+            continue
+        base, i = safe, 2
+        while safe in taken or (safe in originals and safe != name):
+            safe = f"{base}_{i}"
+            i += 1
+        fn["name"] = safe
+        taken.add(safe)
+        renamed[name] = safe
+        _UPSTREAM_TOOL_NAME_MAP[safe] = name
+    if not renamed:
+        return 0
+    # The model must see ONE name per tool: history tool_calls that carry the
+    # original spelling are rewritten too, as is a function-pinned tool_choice.
+    for m in openai_body.get("messages") or []:
+        if not isinstance(m, dict):
+            continue
+        for tc in m.get("tool_calls") or []:
+            fn = tc.get("function") if isinstance(tc, dict) else None
+            if isinstance(fn, dict) and fn.get("name") in renamed:
+                fn["name"] = renamed[fn["name"]]
+    choice = openai_body.get("tool_choice")
+    if isinstance(choice, dict):
+        fn = choice.get("function")
+        if isinstance(fn, dict) and fn.get("name") in renamed:
+            fn["name"] = renamed[fn["name"]]
+    logger.info(
+        "TOOL NAMES: sanitized %d upstream-unsafe tool name(s) for llama.cpp grammar: %s",
+        len(renamed), ", ".join(f"{k}->{v}" for k, v in list(renamed.items())[:6]),
+    )
+    return len(renamed)
+
+
+def _restore_tool_name(name: str) -> str:
+    """The client-facing name for a tool the upstream called by sanitized name."""
+    if not name or not _UPSTREAM_TOOL_NAME_MAP:
+        return name
+    return _UPSTREAM_TOOL_NAME_MAP.get(name, name)
+
+
 def _is_grammar_tools_incompatibility(status_code: int, error_text: str) -> bool:
     if status_code != 400:
         return False
@@ -1963,9 +2053,15 @@ def _is_gemma4_peg_parse_failure(status_code: int, error_text: str) -> bool:
     tool_choice='auto' so the model can emit prose or a complete call
     without grammar enforcement triggering this failure mode.
     """
+    text = error_text or ""
+    # Same remedy for the other grammar-compile failure: HTTP 400 "Failed to
+    # initialize samplers: failed to parse grammar" (a tool schema/name the
+    # builder cannot express under `required`). Relaxing to `auto` lets the
+    # turn proceed on the lazy grammar path instead of killing the stream.
+    if status_code == 400 and "failed to parse grammar" in text.lower():
+        return True
     if status_code != 500:
         return False
-    text = error_text or ""
     return (
         "Failed to parse input at pos" in text
         or "<|tool_call>call:" in text
@@ -8844,6 +8940,12 @@ def _tool_schema_map_from_anthropic_body(anthropic_body: dict) -> dict[str, dict
         if isinstance(name, str) and name:
             schema = tool.get("input_schema")
             schema_map[name] = schema if isinstance(schema, dict) else {}
+            # The upstream calls tools by their SANITIZED name (see
+            # _sanitize_tool_names_for_upstream); a guardrail that only knew the
+            # client's spelling would reject every such call as "unknown tool".
+            safe = _sanitize_tool_name(name)
+            if safe != name and safe not in schema_map:
+                schema_map[safe] = schema_map[name]
     return schema_map
 
 
@@ -9317,6 +9419,9 @@ def _anthropic_tools_by_name(anthropic_body: dict) -> dict[str, dict]:
                 else {}
             )
         tool_map[name] = schema or {}
+        safe = _sanitize_tool_name(name)  # upstream spelling, see schema map above
+        if safe != name and safe not in tool_map:
+            tool_map[safe] = tool_map[name]
     return tool_map
 
 
@@ -11202,7 +11307,7 @@ def openai_to_anthropic_response(
             {
                 "type": "tool_use",
                 "id": tool_use_id,
-                "name": fn.get("name", ""),
+                "name": _restore_tool_name(fn.get("name", "")),
                 "input": args,
             }
         )
@@ -11561,7 +11666,7 @@ async def stream_anthropic_response(
                         initial_args = fn.get("arguments", "")
                         tool_calls_by_index[tc_idx] = {
                             "id": tc_id,
-                            "name": fn.get("name", ""),
+                            "name": _restore_tool_name(fn.get("name", "")),
                             "arguments": initial_args,
                             "block_index": tool_block_index,
                         }
@@ -11749,7 +11854,7 @@ async def stream_anthropic_response(
             for idx, xtc in enumerate(xml_extracted, start=1):
                 fn = xtc.get("function", {})
                 tc_id = xtc.get("id", f"toolu_{uuid.uuid4().hex[:12]}")
-                tc_name = fn.get("name", "")
+                tc_name = _restore_tool_name(fn.get("name", ""))
                 tc_args = fn.get("arguments", "{}")
                 tool_calls_by_index[idx] = {
                     "id": tc_id,
@@ -12380,6 +12485,9 @@ async def messages(request: Request):
             media_type="application/json",
         )
 
+    # Last step before the wire: names llama.cpp's grammar builder can parse.
+    _sanitize_tool_names_for_upstream(openai_body)
+
     use_guarded_non_stream = _should_use_guarded_non_stream(
         is_stream,
         body,