@miller-tech/uap 1.220.10 → 1.220.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.220.10",
+  "version": "1.220.11",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/tools/agents/scripts/anthropic_proxy.py

@@ -4983,6 +4983,33 @@ def _has_tool_definitions(anthropic_body: dict) -> bool:
     return isinstance(tools, list) and len(tools) > 0
 
 
+def _should_buffer_turn(
+    is_stream: bool,
+    body: dict,
+    openai_body: dict,
+    monitor: "SessionMonitor",
+) -> bool:
+    """Whether this turn must be collected in full before anything is sent.
+
+    Wraps _should_use_guarded_non_stream with one extra reason: a turn whose
+    tools were deliberately stripped.
+
+    That turn CANNOT be streamed. The stripping is what makes it terminal, and
+    the sanitiser that scrubs tool-call markup out of the reply only runs on the
+    buffered path -- a streamed turn is already on the wire before anything can
+    inspect it. Worse, the hard tier pops `tool_choice`, which is precisely the
+    key _should_use_guarded_non_stream requires, so stripping the tools was
+    itself enough to route the turn AWAY from the guarded path. Measured
+    2026-08-25: a hard-tier streaming turn delivered the raw markup verbatim to
+    opencode, which rendered it and ended the session -- the incident this rail
+    exists to end. Buffering costs nothing here: the turn is terminal by
+    construction, so there is no long generation for the client to watch.
+    """
+    if monitor.suppress_text_tool_extraction:
+        return True
+    return _should_use_guarded_non_stream(is_stream, body, openai_body)
+
+
 def _should_use_guarded_non_stream(
     is_stream: bool,
     anthropic_body: dict,
@@ -8723,6 +8750,84 @@ def _strip_residual_tool_call_xml(text: str) -> str:
     return cleaned
 
 
+# The prose a suppressed turn falls back to when stripping the markup leaves
+# nothing. An EMPTY assistant message is no better for the client than the raw
+# XML was: opencode ends the turn either way and the operator sees a blank
+# reply, so the breaker must say what it did.
+STUCK_BREAK_PROSE_FALLBACK = (
+    "I repeated the same tool call without making progress, so tools were "
+    "withheld for this turn. I have not run anything further. Tell me which "
+    "different approach to take, or confirm the next step."
+)
+
+
+# Hermes blocks, for DELETION rather than parsing.
+#
+# Deliberately not _HERMES_FUNCTION_RE. That one ends with `(?:</function>|\Z)`
+# so it can salvage a premature-EOS tool call, which is right when parsing and
+# destructive when deleting: a reply that merely MENTIONS a tag loses everything
+# after it. Measured — "The proxy scans for <function=bash> and then deletes
+# everything after it. THIS SHOULD SURVIVE." collapsed to "The proxy scans for".
+# That is not hypothetical here: the hard-tier directive asks the model to say
+# "what the repeated call returned", i.e. it invites naming the call.
+#
+# So a block only counts as markup when it is closed, or when it contains a
+# parameter tag — both of which a prose mention will not have. The name class is
+# also wider than the parser's (`[^>\s]+`): the parser can afford to ignore a
+# dotted or hyphenated name it cannot map to a tool, but leaving that block in
+# the text is the leak.
+_SANITIZE_HERMES_BLOCK_RE = re.compile(
+    r"<function=[^>\s]+>"
+    # Either a properly closed block -- whose body may not contain another
+    # opener, or one malformed block swallows the prose up to the NEXT block's
+    # closing tag (measured: "IMPORTANT PROSE" between two blocks vanished) --
+    r"(?:(?:(?!<function=).)*?</function>"
+    # ...or an unclosed one that at least carries a parameter tag, which is what
+    # separates a real premature-EOS emission from a prose mention.
+    r"|(?:(?!<function=).)*?<parameter=(?:(?!<function=).)*?(?:</function>|\Z))",
+    re.DOTALL,
+)
+# Gemma's DSL, with the premature-EOS arm the parsing regex lacks.
+_SANITIZE_GEMMA_DSL_RE = re.compile(
+    r"<\|tool_call>.*?(?:<tool_call\|>|\Z)",
+    re.DOTALL,
+)
+# Whatever the block patterns left behind: closing tags with no opener, and a
+# LONE opener. The lone opener is stripped as a tag rather than as a block on
+# purpose -- it is inert to every client, and the text around it is far more
+# likely to be the model explaining which call it kept repeating (which the
+# hard-tier directive asks for) than a real emission.
+_SANITIZE_ORPHAN_TAG_RE = re.compile(
+    r"</?parameter(?:=[^>\s]+)?>|</?function(?:=[^>\s]+)?>|</?tool_call>|<tool_call\|>",
+)
+
+
+def _strip_all_tool_call_markup(text: str) -> str:
+    """Remove the tool-call markup forms a model emits INSTEAD of calling a tool.
+
+    `_strip_residual_tool_call_xml` only understands the ``<tool_call>``
+    envelope. A model that emits a BARE Hermes ``<function=…>`` block (no
+    envelope) or Gemma's DSL walks straight through it, which is how raw markup
+    reached a client on a turn whose whole purpose was to end in prose. Applied
+    on the suppressed path only — the normal path promotes this markup to real
+    tool calls instead of deleting it.
+
+    Fenced ```json`` calls are deliberately NOT stripped: the normal path
+    schema-matches them, but here they are indistinguishable from a model
+    legitimately quoting JSON, and destroying real output is the worse error.
+    """
+    cleaned = _strip_residual_tool_call_xml(text)
+    if "<function=" in cleaned:
+        cleaned = _SANITIZE_HERMES_BLOCK_RE.sub("", cleaned)
+    if "<|tool_call>" in cleaned:
+        cleaned = _SANITIZE_GEMMA_DSL_RE.sub("", cleaned)
+    # Orphans left by a block whose closing tag never arrived, or by the
+    # envelope strip above.
+    cleaned = _SANITIZE_ORPHAN_TAG_RE.sub("", cleaned)
+    cleaned = re.sub(r"\n{3,}", "\n\n", cleaned).strip()
+    return cleaned
+
+
 # Pattern: runaway closing braces like }}}}}
 _GARBLED_RUNAWAY_BRACES_RE = re.compile(r"\}{4,}")
 # Pattern: repetitive digit sequences like 000000 or 398859738398859738
@@ -10952,6 +11057,69 @@ def _maybe_apply_session_contamination_breaker(
 # ===========================================================================
 
 
+# Anything carrying one of these is worth running the stripper over. Kept wider
+# than the shapes the PARSER understands: an orphan closing tag or a lone
+# parameter tag is still markup on the client's screen, and gating the stripper
+# on the parser's markers let those through untouched.
+_SUPPRESSED_MARKUP_MARKERS = (
+    "<tool_call>",
+    "</tool_call>",
+    "<tool_call|>",
+    "<function=",
+    "</function>",
+    "<parameter=",
+    "</parameter>",
+    "<|tool_call>",
+)
+
+
+def _sanitize_suppressed_tool_markup(openai_resp: dict) -> dict:
+    """Scrub tool-call markup from a turn whose tools were deliberately stripped.
+
+    Mutates *openai_resp* in place and returns it. A no-op unless a message
+    is text-only and actually carries markup, so an ordinary prose reply on a
+    suppressed turn passes through byte-for-byte.
+    """
+    for choice in openai_resp.get("choices") or []:
+        if not isinstance(choice, dict):
+            continue
+        message = choice.get("message")
+        # A malformed upstream payload must not turn a degraded turn into a 500.
+        if not isinstance(message, dict) or message.get("tool_calls"):
+            continue
+        # The reasoning sidecar is scrubbed too: when `content` is empty the
+        # EMPTY-OUTPUT GUARD promotes reasoning into the VISIBLE text, so
+        # leaving it alone just relocates the leak.
+        for field in ("content", "reasoning_content", "reasoning"):
+            text = message.get(field)
+            if not isinstance(text, str) or not text:
+                continue
+            if not any(marker in text for marker in _SUPPRESSED_MARKUP_MARKERS):
+                continue
+            cleaned = _strip_all_tool_call_markup(text)
+            if field == "content":
+                # Emptiness is judged on what SURVIVES thinking extraction. A
+                # reply of "<think></think>" is truthy but renders blank, and
+                # blank is the outcome the fallback exists to prevent.
+                _, visible = _extract_thinking_block(cleaned)
+                if not visible.strip():
+                    cleaned = (
+                        f"{cleaned}\n\n{STUCK_BREAK_PROSE_FALLBACK}"
+                        if cleaned.strip()
+                        else STUCK_BREAK_PROSE_FALLBACK
+                    )
+            message[field] = cleaned
+            logger.warning(
+                "SUPPRESSED TOOL MARKUP: scrubbed tool-call markup from %s on a "
+                "tools-stripped turn (%d chars in, %d out) -- the turn now ends "
+                "in prose as intended",
+                field,
+                len(text),
+                len(cleaned),
+            )
+    return openai_resp
+
+
 def _maybe_extract_text_tool_calls(
     openai_resp: dict,
     anthropic_tools: list[dict] | None = None,
@@ -10970,8 +11138,15 @@ def _maybe_extract_text_tool_calls(
     # A hard finalize breaker stripped tools this turn to force a terminal
     # text-only end_turn; do not resurrect prose tool-calls (that would defeat
     # the breaker and continue the loop). Carried per-turn on the SessionMonitor.
+    #
+    # Not resurrecting is only half the job. Returning the response untouched
+    # ships the raw markup to the client as the assistant's visible text --
+    # measured live 2026-08-25 on opencode session ses_fc7a27ea…, which rendered
+    # a <tool_call><function=bash>… block as the reply, logged "exiting loop",
+    # and left the operator retyping "go" into the same loop. A turn forced to
+    # end in prose must actually END IN PROSE.
     if suppress:
-        return openai_resp
+        return _sanitize_suppressed_tool_markup(openai_resp)
     choice = (openai_resp.get("choices") or [{}])[0]
     message = choice.get("message", {})
 
@@ -12640,11 +12815,7 @@ async def messages(request: Request):
     # Last step before the wire: names llama.cpp's grammar builder can parse.
     _sanitize_tool_names_for_upstream(openai_body)
 
-    use_guarded_non_stream = _should_use_guarded_non_stream(
-        is_stream,
-        body,
-        openai_body,
-    )
+    use_guarded_non_stream = _should_buffer_turn(is_stream, body, openai_body, monitor)
     if use_guarded_non_stream:
         async def _produce_guarded():
             strict_body = dict(openai_body)

package/tools/agents/tests/test_finalize_suppression.py

@@ -99,14 +99,24 @@ class TestFinalizeSuppressionExtractor(unittest.TestCase):
         self.assertEqual(msg["tool_calls"][0]["function"]["name"], "Bash")
         self.assertEqual(resp["choices"][0]["finish_reason"], "tool_calls")
 
-    def test_suppressed_leaves_prose_as_text(self):
-        """suppress=True: prose stays text -> the client sees a clean end_turn
-        with no action, so the agentic loop terminates."""
+    def test_suppressed_ends_the_turn_in_clean_prose(self):
+        """suppress=True: the client sees a clean end_turn with no action, so
+        the agentic loop terminates.
+
+        This used to assert the markup was still IN the text. That was an
+        incidental detail of the first implementation, not the contract this
+        docstring describes -- and it froze a real defect in place: the raw
+        block was shipped to the client as the assistant's visible reply.
+        Measured live 2026-08-25 (opencode ses_fc7a27ea...), which rendered the
+        markup, logged "exiting loop", and left the operator retyping "go".
+        The contract is: no resurrected call, finish_reason stop, and NO markup.
+        """
         resp = _prose_tool_resp()
         proxy._maybe_extract_text_tool_calls(resp, suppress=True)
         msg = resp["choices"][0]["message"]
         self.assertFalse(msg.get("tool_calls"), "must NOT resurrect tool call on finalize")
-        self.assertIn("<function=Bash>", msg["content"])
+        self.assertNotIn(chr(60) + "function=", msg["content"])
+        self.assertTrue(msg["content"].strip(), "an empty reply is no better than markup")
         self.assertEqual(resp["choices"][0]["finish_reason"], "stop")
 
     def test_conversion_respects_suppression(self):

package/tools/agents/tests/test_stuck_break_hard.py

@@ -26,6 +26,10 @@ def _load_proxy_module():
 
 proxy = _load_proxy_module()
 
+# Angle brackets built at runtime; see _markup below for why.
+LT = chr(60)
+GT = chr(62)
+
 
 def _looping_monitor(fires_so_far: int):
     mon = proxy.SessionMonitor()
@@ -83,5 +87,329 @@ class TestStuckBreakHard(unittest.TestCase):
         self.assertLessEqual(proxy.PROXY_STUCK_BREAK_HARD_FIRES, 5)
 
 
+class TestSuppressedTurnEndsInProse(unittest.TestCase):
+    """The response half of the hard break.
+
+    Suppressing XML resurrection stops the loop re-arming, but on its own it
+    ships the raw markup to the client as the assistant's visible text.
+    Measured live 2026-08-25 (opencode ses_fc7a27ea...): the client rendered a
+    <tool_call> block as the reply, logged "exiting loop", and the operator
+    retyped "go" straight back into the same loop. A turn forced to end in
+    prose must actually end in prose.
+    """
+
+    @staticmethod
+    def _markup(envelope=True, closed=True, lead=""):
+        # Built from chr() so the literal tags never appear in this file --
+        # the repo's bash-safety enforcer refuses commands carrying standalone
+        # tool-call tag lines, which makes a literal fixture unrunnable.
+        def tag(name):
+            return LT + name + GT
+        parts = [tag("function=bash"), tag("parameter=command"), "grep -rn X ."]
+        if closed:
+            parts += [tag("/parameter"), tag("/function")]
+        if envelope:
+            parts = [tag("tool_call")] + parts + [tag("/tool_call")]
+        return (lead + "\n" + "\n".join(parts)) if lead else "\n".join(parts)
+
+    @staticmethod
+    def _resp(text):
+        return {
+            "choices": [
+                {"finish_reason": "stop", "message": {"role": "assistant", "content": text}}
+            ]
+        }
+
+    def test_enveloped_markup_never_reaches_the_client(self):
+        out = proxy._maybe_extract_text_tool_calls(
+            self._resp(self._markup()), suppress=True
+        )
+        content = out["choices"][0]["message"]["content"]
+        self.assertNotIn(LT + "tool_call" + GT, content)
+        self.assertNotIn(LT + "function=", content)
+        self.assertIsNone(out["choices"][0]["message"].get("tool_calls"))
+
+    def test_bare_hermes_block_is_stripped_too(self):
+        # _strip_residual_tool_call_xml only knows the envelope; a bare
+        # function block walked straight through it.
+        out = proxy._maybe_extract_text_tool_calls(
+            self._resp(self._markup(envelope=False)), suppress=True
+        )
+        self.assertNotIn(LT + "function=", out["choices"][0]["message"]["content"])
+
+    def test_unclosed_block_is_stripped_too(self):
+        out = proxy._maybe_extract_text_tool_calls(
+            self._resp(self._markup(envelope=False, closed=False)), suppress=True
+        )
+        content = out["choices"][0]["message"]["content"]
+        self.assertNotIn(LT + "function=", content)
+        self.assertNotIn(LT + "parameter=", content)
+
+    def test_markup_only_reply_gets_fallback_prose(self):
+        # An empty assistant message is no better than XML: the client ends the
+        # turn either way and the operator sees a blank reply.
+        out = proxy._maybe_extract_text_tool_calls(
+            self._resp(self._markup()), suppress=True
+        )
+        self.assertEqual(
+            out["choices"][0]["message"]["content"], proxy.STUCK_BREAK_PROSE_FALLBACK
+        )
+
+    def test_the_model_own_prose_is_kept_when_it_wrote_any(self):
+        out = proxy._maybe_extract_text_tool_calls(
+            self._resp(self._markup(lead="I will check the DB.")), suppress=True
+        )
+        self.assertEqual(out["choices"][0]["message"]["content"], "I will check the DB.")
+
+    def test_plain_prose_passes_through_untouched(self):
+        # Whitespace and blank lines included: the sanitiser collapses those, so
+        # a fixture without them is a fixed point and would pass even if the
+        # early exit were deleted.
+        text = "\n  The cleanup at line 725 takes\n\n\n  the lock in the wrong order.  \n"
+        out = proxy._maybe_extract_text_tool_calls(self._resp(text), suppress=True)
+        self.assertEqual(out["choices"][0]["message"]["content"], text)
+
+    def test_suppression_still_refuses_to_resurrect_the_call(self):
+        # The original guarantee must survive the sanitiser.
+        out = proxy._maybe_extract_text_tool_calls(
+            self._resp(self._markup()), suppress=True
+        )
+        self.assertIsNone(out["choices"][0]["message"].get("tool_calls"))
+        self.assertEqual(out["choices"][0]["finish_reason"], "stop")
+
+    def test_unsuppressed_turns_still_promote_the_call(self):
+        # The sanitiser must not leak onto the normal path, where recovering a
+        # prose tool call is the whole point.
+        out = proxy._maybe_extract_text_tool_calls(
+            self._resp(self._markup()), suppress=False
+        )
+        calls = out["choices"][0]["message"].get("tool_calls") or []
+        self.assertEqual([c["function"]["name"] for c in calls], ["bash"])
+        self.assertEqual(out["choices"][0]["finish_reason"], "tool_calls")
+
+    def test_end_to_end_the_anthropic_response_is_a_prose_end_turn(self):
+        # BARE hermes, not the enveloped form: the pre-existing
+        # _strip_residual_tool_call_xml already deleted a whole <tool_call>
+        # envelope downstream, so the enveloped fixture passed on the OLD code
+        # too -- with an EMPTY text block, the very outcome this rail rejects.
+        resp = self._resp(self._markup(envelope=False))
+        proxy._maybe_extract_text_tool_calls(resp, suppress=True)
+        out = proxy.openai_to_anthropic_response(
+            resp, "qwen", suppress_text_tool_extraction=True
+        )
+        self.assertEqual(out["stop_reason"], "end_turn")
+        blocks = out.get("content") or []
+        self.assertTrue(blocks, "a suppressed turn must still carry a text block")
+        self.assertTrue(all(b.get("type") == "text" for b in blocks))
+        joined = "".join(b.get("text") or "" for b in blocks)
+        # An empty reply is as useless to the client as the markup was.
+        self.assertTrue(joined.strip(), "the turn must end in ACTUAL prose")
+        self.assertNotIn(LT + "function=", joined)
+        self.assertNotIn(LT + "tool_call" + GT, joined)
+
+
 if __name__ == "__main__":
     unittest.main()
+
+class TestSuppressedMarkupLeakClasses(unittest.TestCase):
+    """Every markup shape that reached a client, and every prose shape that must not be eaten.
+
+    The sanitiser deletes text, so its failure modes run both ways: markup left
+    behind is the original bug, and prose destroyed is a new one. Both are
+    pinned here.
+    """
+
+    @staticmethod
+    def _clean(text):
+        return proxy._strip_all_tool_call_markup(text)
+
+    @staticmethod
+    def _tag(name):
+        return LT + name + GT
+
+    def _block(self, name="bash", closed=True, param=True):
+        parts = [self._tag(f"function={name}")]
+        if param:
+            parts += [self._tag("parameter=command"), "grep X ."]
+            if closed:
+                parts.append(self._tag("/parameter"))
+        else:
+            parts.append("body")
+        if closed:
+            parts.append(self._tag("/function"))
+        return "".join(parts)
+
+    # --- markup that must go ---
+
+    def test_strips_a_dotted_or_hyphenated_tool_name(self):
+        # The PARSER's name class is [A-Za-z_][A-Za-z0-9_]*, so it ignored these
+        # -- and the old stripper reused it, leaving a half-eaten block behind.
+        for name in ("web.search", "read-file", "2fa_check"):
+            with self.subTest(name=name):
+                self.assertEqual(self._clean(self._block(name)), "")
+
+    def test_strips_an_unclosed_block_that_carries_a_parameter(self):
+        self.assertEqual(self._clean(self._block(closed=False)), "")
+
+    def test_strips_an_orphan_closing_tag(self):
+        self.assertEqual(self._clean("All done." + self._tag("/function")), "All done.")
+        self.assertEqual(self._clean("Done." + self._tag("/tool_call")), "Done.")
+        self.assertEqual(self._clean("Done." + self._tag("/parameter")), "Done.")
+
+    def test_strips_an_unclosed_gemma_dsl_call(self):
+        # The Gemma parsing regex has no premature-EOS arm, so a truncated call
+        # passed through whole.
+        dsl = LT + "|tool_call" + GT + "call: bash {c:1}"
+        self.assertEqual(self._clean("Done.\n" + dsl), "Done.")
+
+    # --- prose that must survive ---
+
+    def test_prose_that_merely_mentions_a_tag_keeps_its_sentence(self):
+        # The hard-tier directive asks the model what the repeated call
+        # returned, i.e. it invites naming the call. A \Z-anchored delete turned
+        # that into "The proxy scans for".
+        text = (
+            "The proxy scans for "
+            + self._tag("function=bash")
+            + " and then deletes the rest. THIS SHOULD SURVIVE."
+        )
+        out = self._clean(text)
+        self.assertIn("THIS SHOULD SURVIVE.", out)
+        self.assertIn("The proxy scans for", out)
+
+    def test_prose_between_two_blocks_survives(self):
+        text = (
+            "Alpha.\n"
+            + self._block("b")
+            + "\nBETWEEN-PROSE\n"
+            + self._block("d")
+            + "\nOmega."
+        )
+        out = self._clean(text)
+        self.assertIn("BETWEEN-PROSE", out)
+        self.assertIn("Alpha.", out)
+        self.assertIn("Omega.", out)
+
+    def test_a_malformed_block_does_not_swallow_the_next_blocks_prose(self):
+        # One unclosed opener used to match through the NEXT block's </function>.
+        text = (
+            "Alpha.\n"
+            + self._tag("function=bash")
+            + "X\nIMPORTANT PROSE\n"
+            + self._block("read")
+            + "\nOmega."
+        )
+        out = self._clean(text)
+        self.assertIn("IMPORTANT PROSE", out)
+        self.assertNotIn(LT + "function=", out)
+
+    def test_a_fenced_json_call_is_deliberately_left_alone(self):
+        # The normal path schema-matches these; here they are indistinguishable
+        # from a model quoting JSON, and destroying real output is worse.
+        text = 'I will run it.\n\n```json\n{"name": "bash"}\n```'
+        self.assertEqual(self._clean(text), text)
+
+
+class TestSuppressedSanitiserReach(unittest.TestCase):
+    """Fields and shapes the sanitiser has to reach, beyond choices[0].content."""
+
+    @staticmethod
+    def _markup():
+        return (
+            LT + "function=bash" + GT + LT + "parameter=command" + GT
+            + "grep X ." + LT + "/parameter" + GT + LT + "/function" + GT
+        )
+
+    def test_scrubs_the_reasoning_sidecar_too(self):
+        # With content empty, the EMPTY-OUTPUT GUARD promotes reasoning into the
+        # VISIBLE text -- leaving it alone just relocates the leak.
+        resp = {"choices": [{"message": {"role": "assistant", "content": "", "reasoning_content": self._markup()}}]}
+        proxy._maybe_extract_text_tool_calls(resp, suppress=True)
+        self.assertNotIn(LT + "function=", resp["choices"][0]["message"]["reasoning_content"])
+
+    def test_a_think_wrapped_call_still_yields_visible_prose(self):
+        # "<think></think>" is truthy but renders blank. Emptiness has to be
+        # judged on what survives thinking extraction.
+        text = LT + "think" + GT + LT + "/think" + GT + self._markup()
+        resp = {"choices": [{"message": {"role": "assistant", "content": text}}]}
+        proxy._maybe_extract_text_tool_calls(resp, suppress=True)
+        _, visible = proxy._extract_thinking_block(resp["choices"][0]["message"]["content"])
+        self.assertTrue(visible.strip(), "a think-only reply renders blank to the client")
+
+    def test_scrubs_every_choice_not_just_the_first(self):
+        resp = {"choices": [
+            {"message": {"role": "assistant", "content": "fine"}},
+            {"message": {"role": "assistant", "content": self._markup()}},
+        ]}
+        proxy._maybe_extract_text_tool_calls(resp, suppress=True)
+        self.assertNotIn(LT + "function=", resp["choices"][1]["message"]["content"])
+
+    def test_leaves_a_message_that_has_real_tool_calls_alone(self):
+        # Rewriting the text beside a live tool call would attach an apology to
+        # a turn that is actually doing work.
+        mk = self._markup()
+        resp = {"choices": [{"message": {"role": "assistant", "content": mk, "tool_calls": [{"id": "x"}]}}]}
+        proxy._maybe_extract_text_tool_calls(resp, suppress=True)
+        self.assertEqual(resp["choices"][0]["message"]["content"], mk)
+
+    def test_survives_a_malformed_upstream_payload(self):
+        # A degraded turn must not become a 500.
+        for bad in ({"choices": [{"message": None}]}, {"choices": ["oops"]}, {"choices": []}, {}):
+            with self.subTest(bad=bad):
+                proxy._maybe_extract_text_tool_calls(dict(bad), suppress=True)
+
+
+class TestSuppressedTurnIsBuffered(unittest.TestCase):
+    """A tools-stripped turn must not be streamed.
+
+    The sanitiser only runs on the buffered path -- a streamed turn is already
+    on the wire before anything can inspect it. And the hard tier pops
+    `tool_choice`, which is precisely the key _should_use_guarded_non_stream
+    requires, so stripping the tools ALSO routed the turn away from the guarded
+    path. That is why the request handler ORs the monitor flag in.
+    """
+
+    @staticmethod
+    def _hard_tier_body():
+        # What _maybe_inject_stuck_break leaves behind at the hard tier: no
+        # tools, no tool_choice, no grammar.
+        return {"messages": [{"role": "user", "content": "go"}]}
+
+    @staticmethod
+    def _monitor(suppress):
+        mon = proxy.SessionMonitor()
+        mon.suppress_text_tool_extraction = suppress
+        return mon
+
+    def test_a_suppressed_turn_is_always_buffered(self):
+        # Regardless of stream flag, body shape, or any ambient proxy config:
+        # the sanitiser only runs on the buffered path.
+        for is_stream in (True, False):
+            with self.subTest(is_stream=is_stream):
+                self.assertTrue(
+                    proxy._should_buffer_turn(
+                        is_stream,
+                        {"stream": is_stream},
+                        self._hard_tier_body(),
+                        self._monitor(True),
+                    )
+                )
+
+    def test_an_ordinary_turn_defers_to_the_existing_check(self):
+        # The new reason must ADD to the old rule, never replace it.
+        body = self._hard_tier_body()
+        mon = self._monitor(False)
+        self.assertEqual(
+            proxy._should_buffer_turn(True, {"stream": True}, body, mon),
+            proxy._should_use_guarded_non_stream(True, {"stream": True}, body),
+        )
+
+    def test_suppression_overrides_a_declining_guarded_check(self):
+        # Pin the actual defect: with the flag off this exact turn is NOT
+        # buffered by the old rule alone, and with it on it is.
+        body = {"stream": True}
+        openai_body = self._hard_tier_body()
+        if proxy._should_use_guarded_non_stream(True, body, openai_body):
+            self.skipTest("ambient proxy config already forces buffering here")
+        self.assertFalse(proxy._should_buffer_turn(True, body, openai_body, self._monitor(False)))
+        self.assertTrue(proxy._should_buffer_turn(True, body, openai_body, self._monitor(True)))