@miller-tech/uap 1.218.0 → 1.220.0

package/templates/hooks/escalation_tracker.py

@@ -0,0 +1,252 @@
+#!/usr/bin/env python3
+"""escalation-tracker: the evidence store behind the `escalate` delivery mode.
+
+Under `delivery.enforcement: escalate` (or `delivery.localMode: escalate`) a
+coding agent makes ordinary source edits DIRECTLY and `uap deliver` becomes an
+ESCALATION POINT instead of the path every edit is forced through. The gate
+(delivery_enforcement.py) decides *when* to escalate from the state kept here:
+
+  .uap/escalation-state.json
+    failures           consecutive verification failures since the last green
+    last_failure       {ts, source, detail}  — what failed, shown to the agent
+    last_green         ts of the last passing verification
+    edits_since_green  {relpath: n}  — per-file churn with no green in between
+    updated            ts of the last write
+
+Writers (all best-effort, never block):
+  escalation_tracker.py fail  --source verify|bash|stop --detail "<text>"
+  escalation_tracker.py pass  --source verify|bash|stop
+  escalation_tracker.py edit  --file <path>          (the gate records this itself)
+  escalation_tracker.py reset                        (after a deliver run lands)
+  escalation_tracker.py status [--json]
+  escalation_tracker.py classify-bash --command "<cmd>" --output "<text>"
+      -> prints pass|fail|none for a build/test command's output, and records it
+
+The project root is UAP_MAIN_ROOT (the checkout holding .uap/), else cwd.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import sys
+import time
+from pathlib import Path
+
+STATE_FILE = "escalation-state.json"
+DETAIL_MAX = 1200
+
+# A shell command that exercises the project's real gates. Only these commands'
+# outcomes count as verification evidence — `ls` failing is not a gate failure.
+_BUILD_TEST_RE = re.compile(
+    r"(?:^|[;&|]\s*)(?:"
+    r"cargo\s+(?:build|check|test|clippy)"
+    r"|npm\s+(?:run\s+)?(?:build|test|lint|typecheck|check)"
+    r"|(?:pnpm|yarn|bun)\s+(?:run\s+)?(?:build|test|lint|typecheck|check)"
+    r"|(?:npx\s+)?(?:tsc|vitest|jest|mocha|eslint)\b"
+    r"|(?:python3?\s+-m\s+)?pytest\b"
+    r"|go\s+(?:build|test|vet)"
+    r"|make(?:\s+(?:test|build|check|all))?\s*(?:$|[;&|])"
+    r"|mvn\s+(?:test|package|verify|compile)"
+    r"|gradle(?:w)?\s+(?:test|build|check)"
+    r"|dotnet\s+(?:build|test)"
+    r"|uap\s+verify\b"
+    r")",
+    re.IGNORECASE,
+)
+_FAIL_MARKERS = (
+    "error[e",                     # rustc
+    "could not compile",
+    "test result: failed",
+    "failed to compile",
+    "npm err!",
+    "error ts",                    # tsc: error TS2345
+    "assertionerror",
+    "traceback (most recent call last)",
+    "build failed",
+    "fatal error",
+    "compilation failed",
+    "panicked at",
+    "exit status 1",
+    "exit code 1",
+)
+_PASS_MARKERS = (
+    "test result: ok",
+    "finished `dev`", "finished `release`", "finished dev", "finished release",
+    "tests passed", "passed", "all tests passed",
+    "compiled successfully", "build succeeded", "build successful",
+    "0 errors", "no errors", "ok\n", " ok ",
+    "runtime gate: pass", "all gates pass", "verify: pass",
+)
+
+
+def root_dir() -> Path:
+    """The MAIN checkout's root — the same anchor the policy gate uses.
+
+    The gate resolves MAIN_ROOT by stripping `/.worktrees/NNN-slug` and points
+    the enforcer there, so evidence written from a session that runs INSIDE a
+    worktree must land in the same place or the trigger never fires."""
+    p = str(Path(os.environ.get("UAP_MAIN_ROOT") or ".").resolve())
+    if "/.worktrees/" in p:
+        p = p.split("/.worktrees/", 1)[0]
+    return Path(p)
+
+
+def state_path(root: Path | None = None) -> Path:
+    return (root or root_dir()) / ".uap" / STATE_FILE
+
+
+def load_state(root: Path | None = None) -> dict:
+    try:
+        data = json.loads(state_path(root).read_text(encoding="utf-8"))
+        if isinstance(data, dict):
+            data.setdefault("failures", 0)
+            data.setdefault("edits_since_green", {})
+            return data
+    except Exception:
+        pass
+    return {"failures": 0, "edits_since_green": {}, "last_failure": None,
+            "last_green": None, "updated": 0}
+
+
+def save_state(state: dict, root: Path | None = None) -> None:
+    p = state_path(root)
+    try:
+        p.parent.mkdir(parents=True, exist_ok=True)
+        state["updated"] = int(time.time())
+        tmp = p.with_suffix(".tmp")
+        tmp.write_text(json.dumps(state, indent=1), encoding="utf-8")
+        os.replace(tmp, p)
+    except Exception:
+        pass  # evidence is best-effort; never wedge the hook that records it
+
+
+def record_fail(source: str, detail: str, root: Path | None = None) -> dict:
+    st = load_state(root)
+    st["failures"] = int(st.get("failures") or 0) + 1
+    st["last_failure"] = {
+        "ts": int(time.time()),
+        "source": source or "unknown",
+        "detail": (detail or "")[-DETAIL_MAX:],
+    }
+    save_state(st, root)
+    return st
+
+
+def record_pass(source: str, root: Path | None = None) -> dict:
+    st = load_state(root)
+    st["failures"] = 0
+    st["edits_since_green"] = {}
+    st["last_green"] = {"ts": int(time.time()), "source": source or "unknown"}
+    st["last_failure"] = None
+    save_state(st, root)
+    return st
+
+
+def record_edit(rel: str, root: Path | None = None) -> dict:
+    st = load_state(root)
+    edits = st.get("edits_since_green") or {}
+    edits[rel] = int(edits.get(rel, 0)) + 1
+    st["edits_since_green"] = edits
+    save_state(st, root)
+    return st
+
+
+def reset(root: Path | None = None) -> dict:
+    st = {"failures": 0, "edits_since_green": {}, "last_failure": None,
+          "last_green": {"ts": int(time.time()), "source": "reset"}, "updated": 0}
+    save_state(st, root)
+    return st
+
+
+def is_gate_command(command: str) -> bool:
+    return bool(command) and bool(_BUILD_TEST_RE.search(command))
+
+
+def classify_output(command: str, output: str, exit_code: int | None = None) -> str:
+    """pass | fail | none for a shell command's outcome.
+
+    The exit code is authoritative when the harness supplies one. Without it
+    (opencode's after-hook exposes text only) fall back to markers, and to
+    `none` when the text says nothing either way — silence is not evidence.
+    """
+    if not is_gate_command(command):
+        return "none"
+    if exit_code is not None:
+        return "pass" if exit_code == 0 else "fail"
+    low = (output or "").lower()
+    if not low.strip():
+        return "none"
+    # A non-zero failure COUNT ("2 failed", "1 failures", "3 errors") or a
+    # specific failure marker. A bare "failed" substring is deliberately NOT a
+    # marker: `test_failed_login PASSED` and `--- PASS: TestFailedAuth` are green.
+    if any(m in low for m in _FAIL_MARKERS) or re.search(r"\b[1-9]\d* (?:failed|failures?|errors?)\b", low):
+        return "fail"
+    if any(m in low for m in _PASS_MARKERS) or re.search(r"(?m)^ok\b|--- pass:|\b\d+ passed\b", low):
+        return "pass"
+    return "none"
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(prog="escalation_tracker.py")
+    sub = ap.add_subparsers(dest="cmd", required=True)
+    f = sub.add_parser("fail"); f.add_argument("--source", default="verify"); f.add_argument("--detail", default="")
+    p = sub.add_parser("pass"); p.add_argument("--source", default="verify"); p.add_argument("--detail", default="")
+    e = sub.add_parser("edit"); e.add_argument("--file", required=True)
+    sub.add_parser("reset")
+    s = sub.add_parser("status"); s.add_argument("--json", action="store_true")
+    c = sub.add_parser("classify-bash")
+    c.add_argument("--command", required=True); c.add_argument("--output", default="")
+    c.add_argument("--exit-code", type=int, default=None); c.add_argument("--dry-run", action="store_true")
+    raw = list(sys.argv[1:] if argv is None else argv)
+    folded: list[str] = []
+    k = 0
+    while k < len(raw):
+        tok = raw[k]
+        if tok in ("--detail", "--output", "--command") and k + 1 < len(raw):
+            folded.append(f"{tok}={raw[k + 1]}")
+            k += 2
+            continue
+        folded.append(tok)
+        k += 1
+    a = ap.parse_args(folded)
+
+    if a.cmd == "fail":
+        detail = a.detail
+        if detail == "-":
+            detail = sys.stdin.read()
+        st = record_fail(a.source, detail)
+        print(f"escalation: {st['failures']} consecutive failure(s) recorded ({a.source})")
+    elif a.cmd == "pass":
+        record_pass(a.source)
+        print(f"escalation: green ({a.source}) — counters reset")
+    elif a.cmd == "edit":
+        record_edit(a.file)
+    elif a.cmd == "reset":
+        reset()
+        print("escalation: state reset")
+    elif a.cmd == "status":
+        st = load_state()
+        if a.json:
+            print(json.dumps(st))
+        else:
+            lf = st.get("last_failure") or {}
+            print(f"failures={st.get('failures', 0)} files_churning={len(st.get('edits_since_green') or {})}"
+                  + (f" last_failure=({lf.get('source')}) {str(lf.get('detail',''))[:120]!r}" if lf else ""))
+    elif a.cmd == "classify-bash":
+        output = a.output
+        if output == "-":
+            output = sys.stdin.read()
+        verdict = classify_output(a.command, output, a.exit_code)
+        if not a.dry_run:
+            if verdict == "fail":
+                record_fail("bash", f"$ {a.command[:200]}\n{output[-DETAIL_MAX:]}")
+            elif verdict == "pass":
+                record_pass("bash")
+        print(verdict)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/templates/hooks/stop.sh

@@ -221,6 +221,16 @@ if [ "$CODE_CHANGED" = "true" ] && [ "${UAP_VERIFY_ON_STOP:-1}" != "0" ] && comm
     fi
     VERIFY_OUT="$(cd "$PROJECT_DIR" && $TIMEOUT_WRAP uap verify --runtime-only $UV_AUTO $ACC_AUTO --dir "$PROJECT_DIR" 2>&1)"
     VERIFY_RC=$?
+    # Evidence for the `escalate` delivery mode: a red verify counts toward the
+    # "escalate to deliver" threshold, a green one clears it. Best-effort.
+    TRACKER="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/escalation_tracker.py"
+    if [ -f "$TRACKER" ]; then
+      if [ "$VERIFY_RC" = "1" ]; then
+        (cd "$PROJECT_DIR" && UAP_MAIN_ROOT="$PROJECT_DIR" python3 "$TRACKER" fail --source stop --detail "$(printf '%s' "$VERIFY_OUT" | tail -c 1200)" >/dev/null 2>&1) || true
+      elif [ "$VERIFY_RC" = "0" ]; then
+        (cd "$PROJECT_DIR" && UAP_MAIN_ROOT="$PROJECT_DIR" python3 "$TRACKER" pass --source stop >/dev/null 2>&1) || true
+      fi
+    fi
   fi
   set -e
   # RC 1 = a REAL gate failure (code is broken) → block. Everything else fails

package/templates/hooks/uap-policy-gate.sh

@@ -71,7 +71,7 @@ export UAP_WORKTREE_ROOT="$CHECKOUT_ROOT"
 #      in .bashrc) can NOT silently downgrade a project configured to `block`
 #      and let the agent bypass deliver. `delivery.localMode` is read the same
 #      authoritative way and selects how a local-model session resolves block
-#      (advisory|deliver|block — see delivery_enforcement.py).
+#      (advisory|deliver|block|escalate — see delivery_enforcement.py).
 #   2. ambient UAP_ENFORCE_DELIVERY (operator/CI per-run override) when the
 #      project declares nothing.
 #   3. default: block.
@@ -83,7 +83,7 @@ import json, sys
 try:
     d = (json.load(open(sys.argv[1])).get("delivery") or {})
     e = str(d.get("enforcement", "")).lower()
-    print("%s|%s" % (e if e in ("block", "advisory", "off") else "", str(d.get("localMode", "")).lower()))
+    print("%s|%s" % (e if e in ("block", "advisory", "off", "escalate") else "", str(d.get("localMode", "")).lower()))
 except Exception:
     print("|")
 ' "$MAIN_ROOT/.uap.json" 2>/dev/null || echo "|")"
@@ -168,7 +168,7 @@ if not hit and cmd:
             if hit:
                 break
 bypass = re.search(
-    r"UAP_DELIVER_BYPASS\s*=\s*[\x27\"]?1|UAP_ENFORCE_DELIVERY\s*=\s*[\x27\"]?(advisory|off|0|false|no)"
+    r"UAP_DELIVER_BYPASS\s*=\s*[\x27\"]?1|UAP_ENFORCE_DELIVERY\s*=\s*[\x27\"]?(advisory|off|escalate|0|false|no)"
     r"|UAP_SELF_PROTECT_OFF\s*=\s*[\x27\"]?1|UAP_NO_WORKTREE\s*=\s*[\x27\"]?1"
     r"|UAP_WORKDIR_SCOPE_OFF\s*=\s*[\x27\"]?1|UAP_USER_VALIDATION\s*=\s*[\x27\"]?0"
     r"|UAP_DELIVER_NO_LOCK\s*=\s*[\x27\"]?1|UAP_NO_REVIEW\s*=\s*[\x27\"]?1"
@@ -293,7 +293,7 @@ record_execution() {
   local esc_args esc_reason
   esc_args="$(printf '%s' "$ARGS" | sed "s/'/''/g")"
   esc_reason="$(printf '%s' "$reason" | sed "s/'/''/g" | cut -c1-500)"
-  sqlite3 "$DB" "INSERT INTO policy_executions
+  sqlite3 -cmd ".timeout 5000" "$DB" "INSERT INTO policy_executions
     (policyId, toolName, operation, args, result, allowed, reason, executedAt)
     VALUES ('$pid', '${TOOL//\'/\'\'}', '${TOOL//\'/\'\'}', '$esc_args',
             '{}', $allowed, '$esc_reason', strftime('%Y-%m-%dT%H:%M:%fZ','now'));
@@ -463,7 +463,7 @@ except: print("")' 2>/dev/null || echo "")"
 # first, and the agent saw the wrong routing message. Honor priority now so
 # the intended policy fires first. (Blocking short-circuits at exit 2, so the
 # highest-priority applicable block wins.) Name is the stable tiebreak.
-done < <(sqlite3 "$DB" "SELECT p.id, p.name, t.toolName FROM policies p JOIN executable_tools t ON t.policyId=p.id WHERE p.isActive=1 ORDER BY p.priority DESC, p.name ASC;")
+done < <(sqlite3 -cmd ".timeout 5000" "$DB" "SELECT p.id, p.name, t.toolName FROM policies p JOIN executable_tools t ON t.policyId=p.id WHERE p.isActive=1 ORDER BY p.priority DESC, p.name ASC;")
 
 # A sensitive op that no self-protect enforcer ever evaluated = the control
 # surface is unguarded (self-protect not registered/active). Fail closed.

package/tools/agents/scripts/anthropic_proxy.py

@@ -1945,6 +1945,96 @@ def _apply_profile_overrides(
     return updated, prompt_suffix, grammar_text
 
 
+# ── Upstream-safe tool names ────────────────────────────────────────────────
+# llama.cpp's grammar builder cannot parse a tool NAME containing '-' or '.'
+# under tool_choice=required: the request fails with HTTP 400 "Failed to
+# initialize samplers: failed to parse grammar" (measured 2026-08-21 against
+# the live server: `uap-router_deliver` -> 400, the same schema as
+# `uap_router_deliver` -> 200; `auto` passes either way because the lazy
+# grammar path never compiles the name). OpenCode prefixes every MCP tool
+# with "<server>_" and servers are named with hyphens, so the moment a rail
+# forces `required` with such a tool present, the turn dies and the client
+# session wedges (observed: RECON hard tier restored `uap-router_deliver`,
+# forced required, 400, stream error, 10h idle).
+#
+# Names are rewritten to [A-Za-z0-9_] on the way UP (tool definitions, the
+# assistant history's tool_calls, a function-pinned tool_choice) and restored
+# on the way DOWN, so the client never sees the sanitized form. The map is
+# module-level: sanitization is a pure function of the name, so one map serves
+# every session and every response path (stream, strict, non-stream).
+_UPSTREAM_TOOL_NAME_BAD_RE = re.compile(r"[^A-Za-z0-9_]")
+_UPSTREAM_TOOL_NAME_MAP: dict[str, str] = {}  # sanitized -> original
+
+
+def _sanitize_tool_name(name: str) -> str:
+    return _UPSTREAM_TOOL_NAME_BAD_RE.sub("_", name or "")
+
+
+def _sanitize_tool_names_for_upstream(openai_body: dict) -> int:
+    """Rewrite unsafe tool names in-place; returns how many were renamed.
+
+    Idempotent: already-safe names are untouched, so calling it on a retry is
+    harmless. A rename that would collide with another tool's (native or
+    sanitized) name gets a numeric suffix.
+    """
+    tools = openai_body.get("tools") or []
+    originals = {
+        ((t.get("function") or {}).get("name") or "")
+        for t in tools
+        if isinstance(t, dict) and isinstance(t.get("function"), dict)
+    }
+    renamed: dict[str, str] = {}  # original -> safe
+    taken: set[str] = set()
+    for t in tools:
+        fn = t.get("function") if isinstance(t, dict) else None
+        if not isinstance(fn, dict):
+            continue
+        name = fn.get("name") or ""
+        safe = _sanitize_tool_name(name)
+        if safe == name:
+            taken.add(name)
+            # A tool that NATIVELY owns this spelling must never be restored
+            # to some other client's hyphenated name left in the global map.
+            _UPSTREAM_TOOL_NAME_MAP.pop(name, None)
+            continue
+        base, i = safe, 2
+        while safe in taken or (safe in originals and safe != name):
+            safe = f"{base}_{i}"
+            i += 1
+        fn["name"] = safe
+        taken.add(safe)
+        renamed[name] = safe
+        _UPSTREAM_TOOL_NAME_MAP[safe] = name
+    if not renamed:
+        return 0
+    # The model must see ONE name per tool: history tool_calls that carry the
+    # original spelling are rewritten too, as is a function-pinned tool_choice.
+    for m in openai_body.get("messages") or []:
+        if not isinstance(m, dict):
+            continue
+        for tc in m.get("tool_calls") or []:
+            fn = tc.get("function") if isinstance(tc, dict) else None
+            if isinstance(fn, dict) and fn.get("name") in renamed:
+                fn["name"] = renamed[fn["name"]]
+    choice = openai_body.get("tool_choice")
+    if isinstance(choice, dict):
+        fn = choice.get("function")
+        if isinstance(fn, dict) and fn.get("name") in renamed:
+            fn["name"] = renamed[fn["name"]]
+    logger.info(
+        "TOOL NAMES: sanitized %d upstream-unsafe tool name(s) for llama.cpp grammar: %s",
+        len(renamed), ", ".join(f"{k}->{v}" for k, v in list(renamed.items())[:6]),
+    )
+    return len(renamed)
+
+
+def _restore_tool_name(name: str) -> str:
+    """The client-facing name for a tool the upstream called by sanitized name."""
+    if not name or not _UPSTREAM_TOOL_NAME_MAP:
+        return name
+    return _UPSTREAM_TOOL_NAME_MAP.get(name, name)
+
+
 def _is_grammar_tools_incompatibility(status_code: int, error_text: str) -> bool:
     if status_code != 400:
         return False
@@ -1963,9 +2053,15 @@ def _is_gemma4_peg_parse_failure(status_code: int, error_text: str) -> bool:
     tool_choice='auto' so the model can emit prose or a complete call
     without grammar enforcement triggering this failure mode.
     """
+    text = error_text or ""
+    # Same remedy for the other grammar-compile failure: HTTP 400 "Failed to
+    # initialize samplers: failed to parse grammar" (a tool schema/name the
+    # builder cannot express under `required`). Relaxing to `auto` lets the
+    # turn proceed on the lazy grammar path instead of killing the stream.
+    if status_code == 400 and "failed to parse grammar" in text.lower():
+        return True
     if status_code != 500:
         return False
-    text = error_text or ""
     return (
         "Failed to parse input at pos" in text
         or "<|tool_call>call:" in text
@@ -8844,6 +8940,12 @@ def _tool_schema_map_from_anthropic_body(anthropic_body: dict) -> dict[str, dict
         if isinstance(name, str) and name:
             schema = tool.get("input_schema")
             schema_map[name] = schema if isinstance(schema, dict) else {}
+            # The upstream calls tools by their SANITIZED name (see
+            # _sanitize_tool_names_for_upstream); a guardrail that only knew the
+            # client's spelling would reject every such call as "unknown tool".
+            safe = _sanitize_tool_name(name)
+            if safe != name and safe not in schema_map:
+                schema_map[safe] = schema_map[name]
     return schema_map
 
 
@@ -9317,6 +9419,9 @@ def _anthropic_tools_by_name(anthropic_body: dict) -> dict[str, dict]:
                 else {}
             )
         tool_map[name] = schema or {}
+        safe = _sanitize_tool_name(name)  # upstream spelling, see schema map above
+        if safe != name and safe not in tool_map:
+            tool_map[safe] = tool_map[name]
     return tool_map
 
 
@@ -11202,7 +11307,7 @@ def openai_to_anthropic_response(
             {
                 "type": "tool_use",
                 "id": tool_use_id,
-                "name": fn.get("name", ""),
+                "name": _restore_tool_name(fn.get("name", "")),
                 "input": args,
             }
         )
@@ -11561,7 +11666,7 @@ async def stream_anthropic_response(
                         initial_args = fn.get("arguments", "")
                         tool_calls_by_index[tc_idx] = {
                             "id": tc_id,
-                            "name": fn.get("name", ""),
+                            "name": _restore_tool_name(fn.get("name", "")),
                             "arguments": initial_args,
                             "block_index": tool_block_index,
                         }
@@ -11749,7 +11854,7 @@ async def stream_anthropic_response(
             for idx, xtc in enumerate(xml_extracted, start=1):
                 fn = xtc.get("function", {})
                 tc_id = xtc.get("id", f"toolu_{uuid.uuid4().hex[:12]}")
-                tc_name = fn.get("name", "")
+                tc_name = _restore_tool_name(fn.get("name", ""))
                 tc_args = fn.get("arguments", "{}")
                 tool_calls_by_index[idx] = {
                     "id": tc_id,
@@ -12380,6 +12485,9 @@ async def messages(request: Request):
             media_type="application/json",
         )
 
+    # Last step before the wire: names llama.cpp's grammar builder can parse.
+    _sanitize_tool_names_for_upstream(openai_body)
+
     use_guarded_non_stream = _should_use_guarded_non_stream(
         is_stream,
         body,