@miller-tech/uap 1.220.4 → 1.220.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.220.4",
+  "version": "1.220.5",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_conditional_destructive_verbs tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_schema_diff_inline tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_gate_failclosed_schema_diff tools.agents.tests.test_rtk_wrap tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window tools.agents.tests.test_thinking_template_kwargs tools.agents.tests.test_cycle_break_wait_poll",
+    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_conditional_destructive_verbs tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_schema_diff_inline tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_gate_failclosed_schema_diff tools.agents.tests.test_rtk_wrap tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_stuck_break_hard tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window tools.agents.tests.test_thinking_template_kwargs tools.agents.tests.test_cycle_break_wait_poll",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",

package/tools/agents/scripts/anthropic_proxy.py

@@ -364,6 +364,12 @@ PROXY_CONTEXT_RELEASE_THRESHOLD = float(
 PROXY_STUCK_BREAK = os.environ.get("PROXY_STUCK_BREAK", "on").lower() not in {
     "0", "false", "off", "no",
 }
+# After this many STUCK-BREAK fires in a session the break becomes HARD: the
+# tools are removed from that turn so the only possible reply is prose, which
+# ends the client's agent loop. The advisory break alone (directive + released
+# tool_choice) is ignored by a weak local model: observed 2026-08-23, the same
+# bash call repeated 13+ turns with fires=33 and not one prose reply. 0 = never.
+PROXY_STUCK_BREAK_HARD_FIRES = int(os.environ.get("PROXY_STUCK_BREAK_HARD_FIRES", "3"))
 # Self-reported-stuck phrases (lowercased match). Deliberately narrow.
 _STUCK_PHRASE_RE = re.compile(
     r"stuck in a loop|been stuck|break out of (?:this|the) loop|going in circles|"
@@ -6408,6 +6414,31 @@ def _maybe_inject_stuck_break(openai_body: dict, monitor: "SessionMonitor") -> N
     else:
         msgs.insert(0, {"role": "system", "content": directive.strip()})
     openai_body["messages"] = msgs  # reattach in case messages was empty/absent
+    # HARD tier: the directive has been ignored PROXY_STUCK_BREAK_HARD_FIRES
+    # times -- stop offering the tool at all. With no tools the model can only
+    # answer in prose; the response-side XML resurrection is suppressed for
+    # this turn so a "<tool_call>" written into the text cannot re-arm the loop
+    # (same mechanism the finalize turn uses). Per-turn: the flag is cleared at
+    # the next request entry and the tools come back with the next user turn.
+    hard = PROXY_STUCK_BREAK_HARD_FIRES > 0 and monitor.stuck_break_fires >= PROXY_STUCK_BREAK_HARD_FIRES
+    if hard:
+        stripped = len(openai_body.get("tools") or [])
+        openai_body.pop("tools", None)
+        openai_body.pop("tool_choice", None)
+        openai_body.pop("grammar", None)
+        monitor.suppress_text_tool_extraction = True
+        if msgs and msgs[0].get("role") == "system":
+            msgs[0]["content"] = (msgs[0].get("content") or "") + (
+                "\n\nTools are NOT available this turn. Reply in plain text only: "
+                "what is done, what the repeated call returned, and the single next "
+                "step or blocking question."
+            )
+        logger.warning(
+            "STUCK-BREAK HARD: tools stripped for this turn (%s, fires=%d, stripped=%d) -- "
+            "the advisory break was ignored; forcing a prose exit",
+            reason, monitor.stuck_break_fires, stripped,
+        )
+        return
     logger.warning("STUCK-BREAK: forced terminal turn (%s, fires=%d)", reason, monitor.stuck_break_fires)
 
 

package/tools/agents/tests/test_stuck_break_hard.py

@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+"""STUCK-BREAK hard tier.
+
+The advisory STUCK-BREAK (directive + tool_choice released to 'auto') leaves
+every tool on the table, and a weak local model just issues the same call
+again: observed live 2026-08-23 16:46-17:45, the identical bash call 13+ turns
+in a row with fires=33 and never a prose reply. After
+PROXY_STUCK_BREAK_HARD_FIRES fires the break must be HARD -- tools removed for
+that turn, XML tool-call resurrection suppressed -- so the turn can only end in
+prose and the client's agent loop actually terminates.
+"""
+
+import importlib.util
+import unittest
+from pathlib import Path
+
+
+def _load_proxy_module():
+    proxy_path = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+    spec = importlib.util.spec_from_file_location("anthropic_proxy", proxy_path)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+proxy = _load_proxy_module()
+
+
+def _looping_monitor(fires_so_far: int):
+    mon = proxy.SessionMonitor()
+    mon.self_stuck_streak = proxy.PROXY_STUCK_TEXT_THRESHOLD + 1
+    mon.stuck_break_fires = fires_so_far
+    return mon
+
+
+def _body():
+    return {
+        "tool_choice": "required",
+        "tools": [{"type": "function", "function": {"name": "bash", "parameters": {}}}],
+        "messages": [{"role": "system", "content": "sys"}, {"role": "user", "content": "go"}],
+    }
+
+
+class TestStuckBreakHard(unittest.TestCase):
+    def test_below_hard_threshold_stays_advisory(self):
+        mon = _looping_monitor(fires_so_far=0)
+        body = _body()
+        proxy._maybe_inject_stuck_break(body, mon)
+        self.assertEqual(mon.stuck_break_fires, 1)
+        self.assertIn("tools", body, "advisory tier keeps the tools")
+        self.assertEqual(body["tool_choice"], "auto")
+        self.assertFalse(mon.suppress_text_tool_extraction)
+        self.assertIn("STOP", body["messages"][0]["content"])
+
+    def test_hard_threshold_strips_tools_and_suppresses_xml_resurrection(self):
+        mon = _looping_monitor(fires_so_far=proxy.PROXY_STUCK_BREAK_HARD_FIRES - 1)
+        body = _body()
+        proxy._maybe_inject_stuck_break(body, mon)
+        self.assertEqual(mon.stuck_break_fires, proxy.PROXY_STUCK_BREAK_HARD_FIRES)
+        self.assertNotIn("tools", body)
+        self.assertNotIn("tool_choice", body)
+        self.assertTrue(mon.suppress_text_tool_extraction)
+        self.assertIn("plain text", body["messages"][0]["content"])
+        self.assertIn("STOP", body["messages"][0]["content"])  # the advisory text still travels
+
+    def test_hard_tier_can_be_disabled(self):
+        saved = proxy.PROXY_STUCK_BREAK_HARD_FIRES
+        try:
+            proxy.PROXY_STUCK_BREAK_HARD_FIRES = 0
+            mon = _looping_monitor(fires_so_far=50)
+            body = _body()
+            proxy._maybe_inject_stuck_break(body, mon)
+            self.assertIn("tools", body)
+            self.assertFalse(mon.suppress_text_tool_extraction)
+        finally:
+            proxy.PROXY_STUCK_BREAK_HARD_FIRES = saved
+
+    def test_default_threshold_is_small(self):
+        # Three ignored breaks is already ~8 minutes of identical calls on the
+        # local executor; the default must not let a loop run for an hour.
+        self.assertGreater(proxy.PROXY_STUCK_BREAK_HARD_FIRES, 0)
+        self.assertLessEqual(proxy.PROXY_STUCK_BREAK_HARD_FIRES, 5)
+
+
+if __name__ == "__main__":
+    unittest.main()