@miller-tech/uap 1.220.10 → 1.220.12

package/config/llama-profiles/gemma4-26b-a4b-mtp.env

@@ -41,6 +41,15 @@
 # =====================================================================
 LLAMA_BIN=/home/cogtek/llama.cpp/.worktrees/latest-master/build/bin/llama-server
 LLAMA_MODEL=/home/cogtek/Downloads/gemma-4-26B-A4B-it-UD-IQ4_XS.gguf
+# Model id advertised to API clients (llama-server --alias). Set it EXPLICITLY
+# here: the script's fallback derives a name from the GGUF filename, which is a
+# name rather than a path but is not the name client configs are written
+# against ("Qwen3.8-27B-UD-IQ4_XS" vs "Qwen3.8-27B"), so the proxy would still
+# rewrite the model on every request.
+# ORDER IS NOT PRESERVED: llama.cpp stores aliases in a std::set and reports
+# *begin() as the model id, so the ASCII-FIRST entry becomes the primary id.
+# Keep the id clients actually use sorting first if you add more.
+LLAMA_ALIAS=Gemma4-26B-A4B
 LLAMA_DRAFT_MODEL=/home/cogtek/Downloads/mtp-gemma-4-26B-A4B-it-Q8_0.gguf
 
 # Vision projector MUST be pinned. The launch script's auto-discovery falls

package/config/llama-profiles/qwen36-35b-a3b.env

@@ -23,6 +23,15 @@
 # =====================================================================
 LLAMA_BIN=/home/cogtek/llama.cpp/.worktrees/latest-master/build/bin/llama-server
 LLAMA_MODEL=/home/cogtek/Downloads/Qwen3.6-35B-A3B-UD-IQ4_XS.gguf
+# Model id advertised to API clients (llama-server --alias). Set it EXPLICITLY
+# here: the script's fallback derives a name from the GGUF filename, which is a
+# name rather than a path but is not the name client configs are written
+# against ("Qwen3.8-27B-UD-IQ4_XS" vs "Qwen3.8-27B"), so the proxy would still
+# rewrite the model on every request.
+# ORDER IS NOT PRESERVED: llama.cpp stores aliases in a std::set and reports
+# *begin() as the model id, so the ASCII-FIRST entry becomes the primary id.
+# Keep the id clients actually use sorting first if you add more.
+LLAMA_ALIAS=Qwen3.6-35B-A3B
 LLAMA_MMPROJ=/home/cogtek/Downloads/mmproj-F16.gguf
 
 LLAMA_HOST=0.0.0.0

package/config/llama-profiles/qwen38-27b-dflash2.env

@@ -68,6 +68,15 @@
 # =====================================================================
 LLAMA_BIN=/home/cogtek/llama.cpp/.worktrees/dflash2-trial/build-cuda/bin/llama-server
 LLAMA_MODEL=/home/cogtek/Downloads/Qwen3.8-27B-UD-IQ4_XS.gguf
+# Model id advertised to API clients (llama-server --alias). Set it EXPLICITLY
+# here: the script's fallback derives a name from the GGUF filename, which is a
+# name rather than a path but is not the name client configs are written
+# against ("Qwen3.8-27B-UD-IQ4_XS" vs "Qwen3.8-27B"), so the proxy would still
+# rewrite the model on every request.
+# ORDER IS NOT PRESERVED: llama.cpp stores aliases in a std::set and reports
+# *begin() as the model id, so the ASCII-FIRST entry becomes the primary id.
+# Keep the id clients actually use sorting first if you add more.
+LLAMA_ALIAS=Qwen3.8-27B
 # CONFIRMED INCOMPATIBLE 2026-08-20: mmproj-BF16.gguf crashed the server on
 # load -- "mismatch between text model (n_embd = 5120) and mmproj
 # (n_embd = 2048)". It was built for a different, smaller model's vision

package/config/llama-profiles/qwen38-27b-mtp.env

@@ -36,6 +36,15 @@
 # =====================================================================
 LLAMA_BIN=/home/cogtek/llama.cpp/.worktrees/dflash-mtp-upgrade/build-cuda/bin/llama-server
 LLAMA_MODEL=/home/cogtek/Downloads/Qwen3.8-27B-UD-IQ4_XS.gguf
+# Model id advertised to API clients (llama-server --alias). Set it EXPLICITLY
+# here: the script's fallback derives a name from the GGUF filename, which is a
+# name rather than a path but is not the name client configs are written
+# against ("Qwen3.8-27B-UD-IQ4_XS" vs "Qwen3.8-27B"), so the proxy would still
+# rewrite the model on every request.
+# ORDER IS NOT PRESERVED: llama.cpp stores aliases in a std::set and reports
+# *begin() as the model id, so the ASCII-FIRST entry becomes the primary id.
+# Keep the id clients actually use sorting first if you add more.
+LLAMA_ALIAS=Qwen3.8-27B
 # CONFIRMED INCOMPATIBLE 2026-08-20: mmproj-BF16.gguf crashed the server on
 # load -- "mismatch between text model (n_embd = 5120) and mmproj
 # (n_embd = 2048)". It was built for a different, smaller model's vision

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.220.10",
+  "version": "1.220.12",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_conditional_destructive_verbs tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_schema_diff_inline tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_repeat_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_gate_failclosed_schema_diff tools.agents.tests.test_rtk_wrap tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_stuck_break_hard tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window tools.agents.tests.test_thinking_template_kwargs tools.agents.tests.test_cycle_break_wait_poll",
+    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_conditional_destructive_verbs tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_schema_diff_inline tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_repeat_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_gate_failclosed_schema_diff tools.agents.tests.test_rtk_wrap tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_stuck_break_hard tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window tools.agents.tests.test_thinking_template_kwargs tools.agents.tests.test_cycle_break_wait_poll tools.agents.tests.test_upstream_model_aliases",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",

package/tools/agents/scripts/anthropic_proxy.py

@@ -1342,7 +1342,20 @@ async def _upstream_model_ids_cached() -> list[str] | None:
         if r.status_code != 200:
             return None
         data = (r.json() or {}).get("data") or []
-        ids = [str(m["id"]) for m in data if isinstance(m, dict) and m.get("id")]
+        # Aliases count as served ids. llama-server reports ONE primary `id`
+        # (the ASCII-first entry of a std::set) plus an `aliases` array, so a
+        # config naming any other registered alias looked unserved and got
+        # rewritten on every request -- which is most of what --alias was added
+        # to stop. Reading only `id` made the flag half-useless.
+        ids: list[str] = []
+        for m in data:
+            if not isinstance(m, dict):
+                continue
+            if m.get("id"):
+                ids.append(str(m["id"]))
+            for alias in m.get("aliases") or []:
+                if alias and str(alias) not in ids:
+                    ids.append(str(alias))
         if ids:
             _upstream_model_ids = ids
         return ids or None
@@ -4983,6 +4996,33 @@ def _has_tool_definitions(anthropic_body: dict) -> bool:
     return isinstance(tools, list) and len(tools) > 0
 
 
+def _should_buffer_turn(
+    is_stream: bool,
+    body: dict,
+    openai_body: dict,
+    monitor: "SessionMonitor",
+) -> bool:
+    """Whether this turn must be collected in full before anything is sent.
+
+    Wraps _should_use_guarded_non_stream with one extra reason: a turn whose
+    tools were deliberately stripped.
+
+    That turn CANNOT be streamed. The stripping is what makes it terminal, and
+    the sanitiser that scrubs tool-call markup out of the reply only runs on the
+    buffered path -- a streamed turn is already on the wire before anything can
+    inspect it. Worse, the hard tier pops `tool_choice`, which is precisely the
+    key _should_use_guarded_non_stream requires, so stripping the tools was
+    itself enough to route the turn AWAY from the guarded path. Measured
+    2026-08-25: a hard-tier streaming turn delivered the raw markup verbatim to
+    opencode, which rendered it and ended the session -- the incident this rail
+    exists to end. Buffering costs nothing here: the turn is terminal by
+    construction, so there is no long generation for the client to watch.
+    """
+    if monitor.suppress_text_tool_extraction:
+        return True
+    return _should_use_guarded_non_stream(is_stream, body, openai_body)
+
+
 def _should_use_guarded_non_stream(
     is_stream: bool,
     anthropic_body: dict,
@@ -8723,6 +8763,84 @@ def _strip_residual_tool_call_xml(text: str) -> str:
     return cleaned
 
 
+# The prose a suppressed turn falls back to when stripping the markup leaves
+# nothing. An EMPTY assistant message is no better for the client than the raw
+# XML was: opencode ends the turn either way and the operator sees a blank
+# reply, so the breaker must say what it did.
+STUCK_BREAK_PROSE_FALLBACK = (
+    "I repeated the same tool call without making progress, so tools were "
+    "withheld for this turn. I have not run anything further. Tell me which "
+    "different approach to take, or confirm the next step."
+)
+
+
+# Hermes blocks, for DELETION rather than parsing.
+#
+# Deliberately not _HERMES_FUNCTION_RE. That one ends with `(?:</function>|\Z)`
+# so it can salvage a premature-EOS tool call, which is right when parsing and
+# destructive when deleting: a reply that merely MENTIONS a tag loses everything
+# after it. Measured — "The proxy scans for <function=bash> and then deletes
+# everything after it. THIS SHOULD SURVIVE." collapsed to "The proxy scans for".
+# That is not hypothetical here: the hard-tier directive asks the model to say
+# "what the repeated call returned", i.e. it invites naming the call.
+#
+# So a block only counts as markup when it is closed, or when it contains a
+# parameter tag — both of which a prose mention will not have. The name class is
+# also wider than the parser's (`[^>\s]+`): the parser can afford to ignore a
+# dotted or hyphenated name it cannot map to a tool, but leaving that block in
+# the text is the leak.
+_SANITIZE_HERMES_BLOCK_RE = re.compile(
+    r"<function=[^>\s]+>"
+    # Either a properly closed block -- whose body may not contain another
+    # opener, or one malformed block swallows the prose up to the NEXT block's
+    # closing tag (measured: "IMPORTANT PROSE" between two blocks vanished) --
+    r"(?:(?:(?!<function=).)*?</function>"
+    # ...or an unclosed one that at least carries a parameter tag, which is what
+    # separates a real premature-EOS emission from a prose mention.
+    r"|(?:(?!<function=).)*?<parameter=(?:(?!<function=).)*?(?:</function>|\Z))",
+    re.DOTALL,
+)
+# Gemma's DSL, with the premature-EOS arm the parsing regex lacks.
+_SANITIZE_GEMMA_DSL_RE = re.compile(
+    r"<\|tool_call>.*?(?:<tool_call\|>|\Z)",
+    re.DOTALL,
+)
+# Whatever the block patterns left behind: closing tags with no opener, and a
+# LONE opener. The lone opener is stripped as a tag rather than as a block on
+# purpose -- it is inert to every client, and the text around it is far more
+# likely to be the model explaining which call it kept repeating (which the
+# hard-tier directive asks for) than a real emission.
+_SANITIZE_ORPHAN_TAG_RE = re.compile(
+    r"</?parameter(?:=[^>\s]+)?>|</?function(?:=[^>\s]+)?>|</?tool_call>|<tool_call\|>",
+)
+
+
+def _strip_all_tool_call_markup(text: str) -> str:
+    """Remove the tool-call markup forms a model emits INSTEAD of calling a tool.
+
+    `_strip_residual_tool_call_xml` only understands the ``<tool_call>``
+    envelope. A model that emits a BARE Hermes ``<function=…>`` block (no
+    envelope) or Gemma's DSL walks straight through it, which is how raw markup
+    reached a client on a turn whose whole purpose was to end in prose. Applied
+    on the suppressed path only — the normal path promotes this markup to real
+    tool calls instead of deleting it.
+
+    Fenced ```json`` calls are deliberately NOT stripped: the normal path
+    schema-matches them, but here they are indistinguishable from a model
+    legitimately quoting JSON, and destroying real output is the worse error.
+    """
+    cleaned = _strip_residual_tool_call_xml(text)
+    if "<function=" in cleaned:
+        cleaned = _SANITIZE_HERMES_BLOCK_RE.sub("", cleaned)
+    if "<|tool_call>" in cleaned:
+        cleaned = _SANITIZE_GEMMA_DSL_RE.sub("", cleaned)
+    # Orphans left by a block whose closing tag never arrived, or by the
+    # envelope strip above.
+    cleaned = _SANITIZE_ORPHAN_TAG_RE.sub("", cleaned)
+    cleaned = re.sub(r"\n{3,}", "\n\n", cleaned).strip()
+    return cleaned
+
+
 # Pattern: runaway closing braces like }}}}}
 _GARBLED_RUNAWAY_BRACES_RE = re.compile(r"\}{4,}")
 # Pattern: repetitive digit sequences like 000000 or 398859738398859738
@@ -10952,6 +11070,69 @@ def _maybe_apply_session_contamination_breaker(
 # ===========================================================================
 
 
+# Anything carrying one of these is worth running the stripper over. Kept wider
+# than the shapes the PARSER understands: an orphan closing tag or a lone
+# parameter tag is still markup on the client's screen, and gating the stripper
+# on the parser's markers let those through untouched.
+_SUPPRESSED_MARKUP_MARKERS = (
+    "<tool_call>",
+    "</tool_call>",
+    "<tool_call|>",
+    "<function=",
+    "</function>",
+    "<parameter=",
+    "</parameter>",
+    "<|tool_call>",
+)
+
+
+def _sanitize_suppressed_tool_markup(openai_resp: dict) -> dict:
+    """Scrub tool-call markup from a turn whose tools were deliberately stripped.
+
+    Mutates *openai_resp* in place and returns it. A no-op unless a message
+    is text-only and actually carries markup, so an ordinary prose reply on a
+    suppressed turn passes through byte-for-byte.
+    """
+    for choice in openai_resp.get("choices") or []:
+        if not isinstance(choice, dict):
+            continue
+        message = choice.get("message")
+        # A malformed upstream payload must not turn a degraded turn into a 500.
+        if not isinstance(message, dict) or message.get("tool_calls"):
+            continue
+        # The reasoning sidecar is scrubbed too: when `content` is empty the
+        # EMPTY-OUTPUT GUARD promotes reasoning into the VISIBLE text, so
+        # leaving it alone just relocates the leak.
+        for field in ("content", "reasoning_content", "reasoning"):
+            text = message.get(field)
+            if not isinstance(text, str) or not text:
+                continue
+            if not any(marker in text for marker in _SUPPRESSED_MARKUP_MARKERS):
+                continue
+            cleaned = _strip_all_tool_call_markup(text)
+            if field == "content":
+                # Emptiness is judged on what SURVIVES thinking extraction. A
+                # reply of "<think></think>" is truthy but renders blank, and
+                # blank is the outcome the fallback exists to prevent.
+                _, visible = _extract_thinking_block(cleaned)
+                if not visible.strip():
+                    cleaned = (
+                        f"{cleaned}\n\n{STUCK_BREAK_PROSE_FALLBACK}"
+                        if cleaned.strip()
+                        else STUCK_BREAK_PROSE_FALLBACK
+                    )
+            message[field] = cleaned
+            logger.warning(
+                "SUPPRESSED TOOL MARKUP: scrubbed tool-call markup from %s on a "
+                "tools-stripped turn (%d chars in, %d out) -- the turn now ends "
+                "in prose as intended",
+                field,
+                len(text),
+                len(cleaned),
+            )
+    return openai_resp
+
+
 def _maybe_extract_text_tool_calls(
     openai_resp: dict,
     anthropic_tools: list[dict] | None = None,
@@ -10970,8 +11151,15 @@ def _maybe_extract_text_tool_calls(
     # A hard finalize breaker stripped tools this turn to force a terminal
     # text-only end_turn; do not resurrect prose tool-calls (that would defeat
     # the breaker and continue the loop). Carried per-turn on the SessionMonitor.
+    #
+    # Not resurrecting is only half the job. Returning the response untouched
+    # ships the raw markup to the client as the assistant's visible text --
+    # measured live 2026-08-25 on opencode session ses_fc7a27ea…, which rendered
+    # a <tool_call><function=bash>… block as the reply, logged "exiting loop",
+    # and left the operator retyping "go" into the same loop. A turn forced to
+    # end in prose must actually END IN PROSE.
     if suppress:
-        return openai_resp
+        return _sanitize_suppressed_tool_markup(openai_resp)
     choice = (openai_resp.get("choices") or [{}])[0]
     message = choice.get("message", {})
 
@@ -12640,11 +12828,7 @@ async def messages(request: Request):
     # Last step before the wire: names llama.cpp's grammar builder can parse.
     _sanitize_tool_names_for_upstream(openai_body)
 
-    use_guarded_non_stream = _should_use_guarded_non_stream(
-        is_stream,
-        body,
-        openai_body,
-    )
+    use_guarded_non_stream = _should_buffer_turn(is_stream, body, openai_body, monitor)
     if use_guarded_non_stream:
         async def _produce_guarded():
             strict_body = dict(openai_body)

package/tools/agents/tests/test_finalize_suppression.py

@@ -99,14 +99,24 @@ class TestFinalizeSuppressionExtractor(unittest.TestCase):
         self.assertEqual(msg["tool_calls"][0]["function"]["name"], "Bash")
         self.assertEqual(resp["choices"][0]["finish_reason"], "tool_calls")
 
-    def test_suppressed_leaves_prose_as_text(self):
-        """suppress=True: prose stays text -> the client sees a clean end_turn
-        with no action, so the agentic loop terminates."""
+    def test_suppressed_ends_the_turn_in_clean_prose(self):
+        """suppress=True: the client sees a clean end_turn with no action, so
+        the agentic loop terminates.
+
+        This used to assert the markup was still IN the text. That was an
+        incidental detail of the first implementation, not the contract this
+        docstring describes -- and it froze a real defect in place: the raw
+        block was shipped to the client as the assistant's visible reply.
+        Measured live 2026-08-25 (opencode ses_fc7a27ea...), which rendered the
+        markup, logged "exiting loop", and left the operator retyping "go".
+        The contract is: no resurrected call, finish_reason stop, and NO markup.
+        """
         resp = _prose_tool_resp()
         proxy._maybe_extract_text_tool_calls(resp, suppress=True)
         msg = resp["choices"][0]["message"]
         self.assertFalse(msg.get("tool_calls"), "must NOT resurrect tool call on finalize")
-        self.assertIn("<function=Bash>", msg["content"])
+        self.assertNotIn(chr(60) + "function=", msg["content"])
+        self.assertTrue(msg["content"].strip(), "an empty reply is no better than markup")
         self.assertEqual(resp["choices"][0]["finish_reason"], "stop")
 
     def test_conversion_respects_suppression(self):

package/tools/agents/tests/test_stuck_break_hard.py

@@ -26,6 +26,10 @@ def _load_proxy_module():
 
 proxy = _load_proxy_module()
 
+# Angle brackets built at runtime; see _markup below for why.
+LT = chr(60)
+GT = chr(62)
+
 
 def _looping_monitor(fires_so_far: int):
     mon = proxy.SessionMonitor()
@@ -83,5 +87,329 @@ class TestStuckBreakHard(unittest.TestCase):
         self.assertLessEqual(proxy.PROXY_STUCK_BREAK_HARD_FIRES, 5)
 
 
+class TestSuppressedTurnEndsInProse(unittest.TestCase):
+    """The response half of the hard break.
+
+    Suppressing XML resurrection stops the loop re-arming, but on its own it
+    ships the raw markup to the client as the assistant's visible text.
+    Measured live 2026-08-25 (opencode ses_fc7a27ea...): the client rendered a
+    <tool_call> block as the reply, logged "exiting loop", and the operator
+    retyped "go" straight back into the same loop. A turn forced to end in
+    prose must actually end in prose.
+    """
+
+    @staticmethod
+    def _markup(envelope=True, closed=True, lead=""):
+        # Built from chr() so the literal tags never appear in this file --
+        # the repo's bash-safety enforcer refuses commands carrying standalone
+        # tool-call tag lines, which makes a literal fixture unrunnable.
+        def tag(name):
+            return LT + name + GT
+        parts = [tag("function=bash"), tag("parameter=command"), "grep -rn X ."]
+        if closed:
+            parts += [tag("/parameter"), tag("/function")]
+        if envelope:
+            parts = [tag("tool_call")] + parts + [tag("/tool_call")]
+        return (lead + "\n" + "\n".join(parts)) if lead else "\n".join(parts)
+
+    @staticmethod
+    def _resp(text):
+        return {
+            "choices": [
+                {"finish_reason": "stop", "message": {"role": "assistant", "content": text}}
+            ]
+        }
+
+    def test_enveloped_markup_never_reaches_the_client(self):
+        out = proxy._maybe_extract_text_tool_calls(
+            self._resp(self._markup()), suppress=True
+        )
+        content = out["choices"][0]["message"]["content"]
+        self.assertNotIn(LT + "tool_call" + GT, content)
+        self.assertNotIn(LT + "function=", content)
+        self.assertIsNone(out["choices"][0]["message"].get("tool_calls"))
+
+    def test_bare_hermes_block_is_stripped_too(self):
+        # _strip_residual_tool_call_xml only knows the envelope; a bare
+        # function block walked straight through it.
+        out = proxy._maybe_extract_text_tool_calls(
+            self._resp(self._markup(envelope=False)), suppress=True
+        )
+        self.assertNotIn(LT + "function=", out["choices"][0]["message"]["content"])
+
+    def test_unclosed_block_is_stripped_too(self):
+        out = proxy._maybe_extract_text_tool_calls(
+            self._resp(self._markup(envelope=False, closed=False)), suppress=True
+        )
+        content = out["choices"][0]["message"]["content"]
+        self.assertNotIn(LT + "function=", content)
+        self.assertNotIn(LT + "parameter=", content)
+
+    def test_markup_only_reply_gets_fallback_prose(self):
+        # An empty assistant message is no better than XML: the client ends the
+        # turn either way and the operator sees a blank reply.
+        out = proxy._maybe_extract_text_tool_calls(
+            self._resp(self._markup()), suppress=True
+        )
+        self.assertEqual(
+            out["choices"][0]["message"]["content"], proxy.STUCK_BREAK_PROSE_FALLBACK
+        )
+
+    def test_the_model_own_prose_is_kept_when_it_wrote_any(self):
+        out = proxy._maybe_extract_text_tool_calls(
+            self._resp(self._markup(lead="I will check the DB.")), suppress=True
+        )
+        self.assertEqual(out["choices"][0]["message"]["content"], "I will check the DB.")
+
+    def test_plain_prose_passes_through_untouched(self):
+        # Whitespace and blank lines included: the sanitiser collapses those, so
+        # a fixture without them is a fixed point and would pass even if the
+        # early exit were deleted.
+        text = "\n  The cleanup at line 725 takes\n\n\n  the lock in the wrong order.  \n"
+        out = proxy._maybe_extract_text_tool_calls(self._resp(text), suppress=True)
+        self.assertEqual(out["choices"][0]["message"]["content"], text)
+
+    def test_suppression_still_refuses_to_resurrect_the_call(self):
+        # The original guarantee must survive the sanitiser.
+        out = proxy._maybe_extract_text_tool_calls(
+            self._resp(self._markup()), suppress=True
+        )
+        self.assertIsNone(out["choices"][0]["message"].get("tool_calls"))
+        self.assertEqual(out["choices"][0]["finish_reason"], "stop")
+
+    def test_unsuppressed_turns_still_promote_the_call(self):
+        # The sanitiser must not leak onto the normal path, where recovering a
+        # prose tool call is the whole point.
+        out = proxy._maybe_extract_text_tool_calls(
+            self._resp(self._markup()), suppress=False
+        )
+        calls = out["choices"][0]["message"].get("tool_calls") or []
+        self.assertEqual([c["function"]["name"] for c in calls], ["bash"])
+        self.assertEqual(out["choices"][0]["finish_reason"], "tool_calls")
+
+    def test_end_to_end_the_anthropic_response_is_a_prose_end_turn(self):
+        # BARE hermes, not the enveloped form: the pre-existing
+        # _strip_residual_tool_call_xml already deleted a whole <tool_call>
+        # envelope downstream, so the enveloped fixture passed on the OLD code
+        # too -- with an EMPTY text block, the very outcome this rail rejects.
+        resp = self._resp(self._markup(envelope=False))
+        proxy._maybe_extract_text_tool_calls(resp, suppress=True)
+        out = proxy.openai_to_anthropic_response(
+            resp, "qwen", suppress_text_tool_extraction=True
+        )
+        self.assertEqual(out["stop_reason"], "end_turn")
+        blocks = out.get("content") or []
+        self.assertTrue(blocks, "a suppressed turn must still carry a text block")
+        self.assertTrue(all(b.get("type") == "text" for b in blocks))
+        joined = "".join(b.get("text") or "" for b in blocks)
+        # An empty reply is as useless to the client as the markup was.
+        self.assertTrue(joined.strip(), "the turn must end in ACTUAL prose")
+        self.assertNotIn(LT + "function=", joined)
+        self.assertNotIn(LT + "tool_call" + GT, joined)
+
+
 if __name__ == "__main__":
     unittest.main()
+
+class TestSuppressedMarkupLeakClasses(unittest.TestCase):
+    """Every markup shape that reached a client, and every prose shape that must not be eaten.
+
+    The sanitiser deletes text, so its failure modes run both ways: markup left
+    behind is the original bug, and prose destroyed is a new one. Both are
+    pinned here.
+    """
+
+    @staticmethod
+    def _clean(text):
+        return proxy._strip_all_tool_call_markup(text)
+
+    @staticmethod
+    def _tag(name):
+        return LT + name + GT
+
+    def _block(self, name="bash", closed=True, param=True):
+        parts = [self._tag(f"function={name}")]
+        if param:
+            parts += [self._tag("parameter=command"), "grep X ."]
+            if closed:
+                parts.append(self._tag("/parameter"))
+        else:
+            parts.append("body")
+        if closed:
+            parts.append(self._tag("/function"))
+        return "".join(parts)
+
+    # --- markup that must go ---
+
+    def test_strips_a_dotted_or_hyphenated_tool_name(self):
+        # The PARSER's name class is [A-Za-z_][A-Za-z0-9_]*, so it ignored these
+        # -- and the old stripper reused it, leaving a half-eaten block behind.
+        for name in ("web.search", "read-file", "2fa_check"):
+            with self.subTest(name=name):
+                self.assertEqual(self._clean(self._block(name)), "")
+
+    def test_strips_an_unclosed_block_that_carries_a_parameter(self):
+        self.assertEqual(self._clean(self._block(closed=False)), "")
+
+    def test_strips_an_orphan_closing_tag(self):
+        self.assertEqual(self._clean("All done." + self._tag("/function")), "All done.")
+        self.assertEqual(self._clean("Done." + self._tag("/tool_call")), "Done.")
+        self.assertEqual(self._clean("Done." + self._tag("/parameter")), "Done.")
+
+    def test_strips_an_unclosed_gemma_dsl_call(self):
+        # The Gemma parsing regex has no premature-EOS arm, so a truncated call
+        # passed through whole.
+        dsl = LT + "|tool_call" + GT + "call: bash {c:1}"
+        self.assertEqual(self._clean("Done.\n" + dsl), "Done.")
+
+    # --- prose that must survive ---
+
+    def test_prose_that_merely_mentions_a_tag_keeps_its_sentence(self):
+        # The hard-tier directive asks the model what the repeated call
+        # returned, i.e. it invites naming the call. A \Z-anchored delete turned
+        # that into "The proxy scans for".
+        text = (
+            "The proxy scans for "
+            + self._tag("function=bash")
+            + " and then deletes the rest. THIS SHOULD SURVIVE."
+        )
+        out = self._clean(text)
+        self.assertIn("THIS SHOULD SURVIVE.", out)
+        self.assertIn("The proxy scans for", out)
+
+    def test_prose_between_two_blocks_survives(self):
+        text = (
+            "Alpha.\n"
+            + self._block("b")
+            + "\nBETWEEN-PROSE\n"
+            + self._block("d")
+            + "\nOmega."
+        )
+        out = self._clean(text)
+        self.assertIn("BETWEEN-PROSE", out)
+        self.assertIn("Alpha.", out)
+        self.assertIn("Omega.", out)
+
+    def test_a_malformed_block_does_not_swallow_the_next_blocks_prose(self):
+        # One unclosed opener used to match through the NEXT block's </function>.
+        text = (
+            "Alpha.\n"
+            + self._tag("function=bash")
+            + "X\nIMPORTANT PROSE\n"
+            + self._block("read")
+            + "\nOmega."
+        )
+        out = self._clean(text)
+        self.assertIn("IMPORTANT PROSE", out)
+        self.assertNotIn(LT + "function=", out)
+
+    def test_a_fenced_json_call_is_deliberately_left_alone(self):
+        # The normal path schema-matches these; here they are indistinguishable
+        # from a model quoting JSON, and destroying real output is worse.
+        text = 'I will run it.\n\n```json\n{"name": "bash"}\n```'
+        self.assertEqual(self._clean(text), text)
+
+
+class TestSuppressedSanitiserReach(unittest.TestCase):
+    """Fields and shapes the sanitiser has to reach, beyond choices[0].content."""
+
+    @staticmethod
+    def _markup():
+        return (
+            LT + "function=bash" + GT + LT + "parameter=command" + GT
+            + "grep X ." + LT + "/parameter" + GT + LT + "/function" + GT
+        )
+
+    def test_scrubs_the_reasoning_sidecar_too(self):
+        # With content empty, the EMPTY-OUTPUT GUARD promotes reasoning into the
+        # VISIBLE text -- leaving it alone just relocates the leak.
+        resp = {"choices": [{"message": {"role": "assistant", "content": "", "reasoning_content": self._markup()}}]}
+        proxy._maybe_extract_text_tool_calls(resp, suppress=True)
+        self.assertNotIn(LT + "function=", resp["choices"][0]["message"]["reasoning_content"])
+
+    def test_a_think_wrapped_call_still_yields_visible_prose(self):
+        # "<think></think>" is truthy but renders blank. Emptiness has to be
+        # judged on what survives thinking extraction.
+        text = LT + "think" + GT + LT + "/think" + GT + self._markup()
+        resp = {"choices": [{"message": {"role": "assistant", "content": text}}]}
+        proxy._maybe_extract_text_tool_calls(resp, suppress=True)
+        _, visible = proxy._extract_thinking_block(resp["choices"][0]["message"]["content"])
+        self.assertTrue(visible.strip(), "a think-only reply renders blank to the client")
+
+    def test_scrubs_every_choice_not_just_the_first(self):
+        resp = {"choices": [
+            {"message": {"role": "assistant", "content": "fine"}},
+            {"message": {"role": "assistant", "content": self._markup()}},
+        ]}
+        proxy._maybe_extract_text_tool_calls(resp, suppress=True)
+        self.assertNotIn(LT + "function=", resp["choices"][1]["message"]["content"])
+
+    def test_leaves_a_message_that_has_real_tool_calls_alone(self):
+        # Rewriting the text beside a live tool call would attach an apology to
+        # a turn that is actually doing work.
+        mk = self._markup()
+        resp = {"choices": [{"message": {"role": "assistant", "content": mk, "tool_calls": [{"id": "x"}]}}]}
+        proxy._maybe_extract_text_tool_calls(resp, suppress=True)
+        self.assertEqual(resp["choices"][0]["message"]["content"], mk)
+
+    def test_survives_a_malformed_upstream_payload(self):
+        # A degraded turn must not become a 500.
+        for bad in ({"choices": [{"message": None}]}, {"choices": ["oops"]}, {"choices": []}, {}):
+            with self.subTest(bad=bad):
+                proxy._maybe_extract_text_tool_calls(dict(bad), suppress=True)
+
+
+class TestSuppressedTurnIsBuffered(unittest.TestCase):
+    """A tools-stripped turn must not be streamed.
+
+    The sanitiser only runs on the buffered path -- a streamed turn is already
+    on the wire before anything can inspect it. And the hard tier pops
+    `tool_choice`, which is precisely the key _should_use_guarded_non_stream
+    requires, so stripping the tools ALSO routed the turn away from the guarded
+    path. That is why the request handler ORs the monitor flag in.
+    """
+
+    @staticmethod
+    def _hard_tier_body():
+        # What _maybe_inject_stuck_break leaves behind at the hard tier: no
+        # tools, no tool_choice, no grammar.
+        return {"messages": [{"role": "user", "content": "go"}]}
+
+    @staticmethod
+    def _monitor(suppress):
+        mon = proxy.SessionMonitor()
+        mon.suppress_text_tool_extraction = suppress
+        return mon
+
+    def test_a_suppressed_turn_is_always_buffered(self):
+        # Regardless of stream flag, body shape, or any ambient proxy config:
+        # the sanitiser only runs on the buffered path.
+        for is_stream in (True, False):
+            with self.subTest(is_stream=is_stream):
+                self.assertTrue(
+                    proxy._should_buffer_turn(
+                        is_stream,
+                        {"stream": is_stream},
+                        self._hard_tier_body(),
+                        self._monitor(True),
+                    )
+                )
+
+    def test_an_ordinary_turn_defers_to_the_existing_check(self):
+        # The new reason must ADD to the old rule, never replace it.
+        body = self._hard_tier_body()
+        mon = self._monitor(False)
+        self.assertEqual(
+            proxy._should_buffer_turn(True, {"stream": True}, body, mon),
+            proxy._should_use_guarded_non_stream(True, {"stream": True}, body),
+        )
+
+    def test_suppression_overrides_a_declining_guarded_check(self):
+        # Pin the actual defect: with the flag off this exact turn is NOT
+        # buffered by the old rule alone, and with it on it is.
+        body = {"stream": True}
+        openai_body = self._hard_tier_body()
+        if proxy._should_use_guarded_non_stream(True, body, openai_body):
+            self.skipTest("ambient proxy config already forces buffering here")
+        self.assertFalse(proxy._should_buffer_turn(True, body, openai_body, self._monitor(False)))
+        self.assertTrue(proxy._should_buffer_turn(True, body, openai_body, self._monitor(True)))

package/tools/agents/tests/test_upstream_model_aliases.py

@@ -0,0 +1,116 @@
+#!/usr/bin/env python3
+"""An advertised alias is a servable model id.
+
+llama-server registers aliases in a std::set and reports ONE primary `id` --
+`*begin()`, i.e. the ASCII-first entry -- alongside an `aliases` array carrying
+all of them. The proxy read only `id`, so every client configured with any other
+registered alias looked unservable and had its model rewritten on EVERY request
+(MODEL REWRITE, 6 in a 3h window on 2026-08-25).
+
+That made --alias half-useless for the thing it was added to fix: naming legacy
+ids alongside a new one so an older client config keeps resolving untouched.
+"""
+
+import asyncio
+import importlib.util
+import unittest
+from pathlib import Path
+
+
+def _load_proxy_module():
+    proxy_path = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+    spec = importlib.util.spec_from_file_location("anthropic_proxy", proxy_path)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+proxy = _load_proxy_module()
+
+
+class _FakeResponse:
+    def __init__(self, payload, status_code=200):
+        self._payload = payload
+        self.status_code = status_code
+        self.text = str(payload)
+
+    def json(self):
+        return self._payload
+
+
+class _FakeClient:
+    """Stands in for the httpx client; records nothing, just answers /models."""
+
+    def __init__(self, payload, status_code=200):
+        self._response = _FakeResponse(payload, status_code)
+
+    async def get(self, _url, timeout=None):  # noqa: ARG002 - signature parity
+        return self._response
+
+
+class UpstreamModelAliasTests(unittest.TestCase):
+    def setUp(self):
+        # The result is cached in a module global for the process lifetime.
+        self._saved_client = proxy.http_client
+        proxy._upstream_model_ids = None
+
+    def tearDown(self):
+        proxy.http_client = self._saved_client
+        proxy._upstream_model_ids = None
+
+    def _ids(self, payload, status_code=200):
+        proxy.http_client = _FakeClient(payload, status_code)
+        return asyncio.run(proxy._upstream_model_ids_cached())
+
+    def test_aliases_are_reported_as_served_ids(self):
+        ids = self._ids(
+            {
+                "data": [
+                    {
+                        "id": "Qwen3.8-27B",
+                        "aliases": ["Qwen3.8-27B", "qwen36-35b-a3b-iq4xs", "qwen35-a3b-iq4xs"],
+                    }
+                ]
+            }
+        )
+        # The legacy ids are exactly the ones that were being rewritten.
+        self.assertIn("qwen36-35b-a3b-iq4xs", ids)
+        self.assertIn("qwen35-a3b-iq4xs", ids)
+        self.assertIn("Qwen3.8-27B", ids)
+
+    def test_the_primary_id_stays_first(self):
+        # Callers pick ids[0] as the rewrite target, so the primary must lead
+        # even though it also appears in the aliases array.
+        ids = self._ids({"data": [{"id": "Primary", "aliases": ["Primary", "Alt"]}]})
+        self.assertEqual(ids[0], "Primary")
+
+    def test_the_primary_id_is_not_duplicated_by_its_own_alias_entry(self):
+        # llama-server lists the primary inside `aliases` too.
+        ids = self._ids({"data": [{"id": "Same", "aliases": ["Same"]}]})
+        self.assertEqual(ids, ["Same"])
+
+    def test_a_payload_with_no_aliases_key_still_works(self):
+        # Older llama-server builds, and any other OpenAI-compatible upstream.
+        ids = self._ids({"data": [{"id": "OnlyId"}]})
+        self.assertEqual(ids, ["OnlyId"])
+
+    def test_junk_entries_are_skipped_rather_than_raising(self):
+        # Discovery must never take the proxy down.
+        ids = self._ids(
+            {
+                "data": [
+                    "not-a-dict",
+                    {"no_id": True},
+                    {"id": "Good", "aliases": [None, "", "AlsoGood"]},
+                ]
+            }
+        )
+        self.assertEqual(ids, ["Good", "AlsoGood"])
+
+    def test_a_non_200_yields_no_ids(self):
+        self.assertIsNone(self._ids({"data": [{"id": "x"}]}, status_code=503))
+
+
+if __name__ == "__main__":
+    unittest.main()