@miller-tech/uap 1.220.7 → 1.220.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.220.7",
+  "version": "1.220.9",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_conditional_destructive_verbs tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_schema_diff_inline tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_gate_failclosed_schema_diff tools.agents.tests.test_rtk_wrap tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_stuck_break_hard tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window tools.agents.tests.test_thinking_template_kwargs tools.agents.tests.test_cycle_break_wait_poll",
+    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_conditional_destructive_verbs tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_schema_diff_inline tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_repeat_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_gate_failclosed_schema_diff tools.agents.tests.test_rtk_wrap tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_stuck_break_hard tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window tools.agents.tests.test_thinking_template_kwargs tools.agents.tests.test_cycle_break_wait_poll",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",

package/src/policies/enforcers/rtk_wrap.py

@@ -60,6 +60,35 @@ MACHINE_FORMS = {
     "stash": ("list",),
 }
 
+# rtk's docker handlers only recognise the BARE subcommand. Any flag on
+# `docker ps` or `docker logs` makes rtk print "[rtk: parse failed, running
+# raw]" ahead of otherwise-correct raw output. The DATA is fine -- but that
+# line reads as a tool error, and a model that cannot act on it retries: it
+# drove a live ERROR-LOOP on 2026-08-25 ("same failure x3,
+# sig='[rtk: parse failed, running raw]'"). `rtk proxy` runs the same command
+# unfiltered with no such line, and is still counted in the savings ledger.
+#
+# Measured against rtk 0.27.0 on 2026-08-25 -- listed rather than guessed,
+# because every entry here is friction for a call that would have been fine:
+#   docker ps                        ok
+#   docker ps -a                     parse failed
+#   docker ps --filter name=uap      parse failed
+#   docker ps --format '{{.Names}}'  parse failed
+#   docker images                    ok
+#   docker logs --tail 1 <id>        parse failed
+#   docker inspect <id>              ok
+# So the trigger is the SUBCOMMAND plus any flag at all, not a specific flag.
+DOCKER_FLAG_INTOLERANT = ("ps", "logs")
+
+
+def docker_wants_proxy(tokens: list[str]) -> bool:
+    """Is this a docker call rtk will fail to parse (bare form only)?"""
+    args = [t for t in tokens if t.split("/")[-1] != "docker"]
+    sub_cmd = next((t for t in args if not t.startswith("-")), "")
+    if sub_cmd not in DOCKER_FLAG_INTOLERANT:
+        return False
+    return any(t.startswith("-") for t in args)
+
 
 def wants_machine_output(tokens: list[str]) -> bool:
     """Is this git invocation asking for output something will parse?"""
@@ -122,6 +151,16 @@ def main() -> None:
         # skipping every rtk-led statement is what let it through the gate.
         if bin_name == "rtk":
             rest = [t for t in tokens[1:] if not t.startswith("-")]
+            if rest[:1] == ["docker"] and docker_wants_proxy(tokens[1:]):
+                emit(
+                    False,
+                    "rtk-wrap: rtk only parses the bare form of this docker "
+                    "subcommand; with any flag it prefixes "
+                    "'[rtk: parse failed, running raw]' to the output, which "
+                    "reads as an error and has driven retry loops. Use: "
+                    "rtk proxy " + " ".join(tokens[1:]),
+                    bin="rtk",
+                )
             if rest[:1] == ["git"] and wants_machine_output(tokens[1:]):
                 emit(
                     False,
@@ -141,6 +180,8 @@ def main() -> None:
         if bin_name == "git" and wants_machine_output(tokens):
             # Still through rtk, so the call is still tracked -- just unfiltered.
             wrapper = "rtk proxy"
+        elif bin_name == "docker" and docker_wants_proxy(tokens):
+            wrapper = "rtk proxy"
         if bin_name in PMS:
             sub = ""
             for nxt in tokens[1:]:

package/tools/agents/scripts/anthropic_proxy.py

@@ -11005,6 +11005,85 @@ def _maybe_extract_text_tool_calls(
     return openai_resp
 
 
+# ---------------------------------------------------------------------------
+# Mid-stream degenerate-repetition guard
+# ---------------------------------------------------------------------------
+# `_detect_and_truncate_degenerate_repetition` (below) is the POST-HOC sibling
+# of this guard: it repairs a finished non-streaming response. It cannot help a
+# STREAMING client, and by the time it runs the GPU time is already spent.
+#
+# Measured 2026-08-25: a rail running --repeat-penalty 1.0 with DRY disabled
+# emitted ONE sentence 640 times (151,628 chars) until it hit the 32,768-token
+# n_predict cap -- ~11 minutes of GPU for a turn that ended reason="length",
+# after which opencode logged "exiting loop" and abandoned the session having
+# done nothing. 130 such generations were in one client's history, 2-5/day for
+# months. Sampler-level control (repeat-penalty >1, --dry-multiplier) is the
+# primary fix; this is the backstop for when it is misconfigured again.
+#
+# Cost is bounded by construction: the check runs at most once per
+# PROXY_REPEAT_GUARD_CHECK_EVERY characters and only ever inspects a
+# PROXY_REPEAT_GUARD_TAIL-sized tail, never the whole accumulated response.
+PROXY_REPEAT_GUARD = os.environ.get("PROXY_REPEAT_GUARD", "1") not in ("0", "false", "False")
+PROXY_REPEAT_GUARD_MIN_CHARS = int(os.environ.get("PROXY_REPEAT_GUARD_MIN_CHARS", "2000"))
+PROXY_REPEAT_GUARD_CHECK_EVERY = int(os.environ.get("PROXY_REPEAT_GUARD_CHECK_EVERY", "1000"))
+PROXY_REPEAT_GUARD_TAIL = int(os.environ.get("PROXY_REPEAT_GUARD_TAIL", "8000"))
+PROXY_REPEAT_GUARD_LINE_REPEATS = int(os.environ.get("PROXY_REPEAT_GUARD_LINE_REPEATS", "8"))
+PROXY_REPEAT_GUARD_BLOCK_REPEATS = int(os.environ.get("PROXY_REPEAT_GUARD_BLOCK_REPEATS", "4"))
+PROXY_REPEAT_GUARD_MIN_UNIT = int(os.environ.get("PROXY_REPEAT_GUARD_MIN_UNIT", "24"))
+PROXY_REPEAT_GUARD_MAX_PERIOD = int(os.environ.get("PROXY_REPEAT_GUARD_MAX_PERIOD", "600"))
+
+
+def _detect_degenerate_repeat(tail: str) -> str | None:
+    """Return the repeated unit if `tail` ENDS in a degenerate loop, else None.
+
+    Both detectors are anchored at the END of the text, so a legitimately
+    repetitive passage earlier in a response (a changelog, a table, a list of
+    similar imports) cannot trip them -- only output that is still repeating
+    at the moment of the check does.
+
+      * line mode  -- the same non-blank line N times in a row. This is the
+        shape real runaways take here: one sentence, "\\n\\n", forever.
+      * block mode -- the same character block N times in a row, for loops
+        that never emit a newline and so are invisible to line mode.
+
+    A unit must be at least MIN_UNIT characters AND contain an alphanumeric
+    character, so horizontal rules ("----"), fence markers, bracket runs and
+    indentation are never flagged. Callers pass a bounded tail; this function
+    does not trim, so its cost is the caller's choice.
+    """
+    if not tail:
+        return None
+
+    # --- line mode ---------------------------------------------------------
+    lines = [ln.strip() for ln in tail.splitlines()]
+    lines = [ln for ln in lines if ln]
+    if len(lines) >= PROXY_REPEAT_GUARD_LINE_REPEATS:
+        last = lines[-1]
+        if len(last) >= PROXY_REPEAT_GUARD_MIN_UNIT and any(c.isalnum() for c in last):
+            run = 1
+            for prev in reversed(lines[:-1]):
+                if prev != last:
+                    break
+                run += 1
+            if run >= PROXY_REPEAT_GUARD_LINE_REPEATS:
+                return last
+
+    # --- block mode --------------------------------------------------------
+    reps = PROXY_REPEAT_GUARD_BLOCK_REPEATS
+    if reps >= 2:
+        max_period = min(PROXY_REPEAT_GUARD_MAX_PERIOD, len(tail) // reps)
+        for period in range(PROXY_REPEAT_GUARD_MIN_UNIT, max_period + 1):
+            unit = tail[-period:]
+            if not any(c.isalnum() for c in unit):
+                continue
+            if all(
+                tail[-period * (k + 1) : -period * k] == unit
+                for k in range(1, reps)
+            ):
+                return unit
+    return None
+
+
 def _detect_and_truncate_degenerate_repetition(
     openai_resp: dict,
 ) -> tuple[dict, bool]:
@@ -11646,6 +11725,14 @@ async def stream_anthropic_response(
     text_chunks: list[str] = []  # accumulate text for logging
     reasoning_chunks: list[str] = []  # accumulate reasoning for fallback
 
+    # Mid-stream repetition guard state. `_rg_tail` is a bounded rolling window
+    # so the check never walks the whole accumulated response.
+    _rg_tail: deque[str] = deque()
+    _rg_tail_len = 0
+    _rg_total = 0
+    _rg_checked_at = 0
+    _rg_tripped = ""
+
     # Real token counts from upstream's final usage chunk (llama-server /
     # OpenAI emit it on the last data frame). The per-delta output_tokens
     # counter is a chunk count that misses tool-call deltas entirely; prefer
@@ -11685,6 +11772,33 @@ async def stream_anthropic_response(
                     f"data: {json.dumps({'type': 'content_block_delta', 'index': 0, 'delta': {'type': 'text_delta', 'text': delta['content']}})}\n\n"
                 )
 
+                # Degenerate-repetition guard: stop a runaway while it is still
+                # running instead of paying out the full n-predict budget. The
+                # deltas already forwarded stand; finish_reason below marks the
+                # text untrustworthy, matching the post-hoc detector's contract.
+                if PROXY_REPEAT_GUARD:
+                    _rg_tail.append(delta["content"])
+                    _rg_tail_len += len(delta["content"])
+                    _rg_total += len(delta["content"])
+                    while _rg_tail_len > PROXY_REPEAT_GUARD_TAIL and len(_rg_tail) > 1:
+                        _rg_tail_len -= len(_rg_tail.popleft())
+                    if (
+                        _rg_total >= PROXY_REPEAT_GUARD_MIN_CHARS
+                        and _rg_total - _rg_checked_at >= PROXY_REPEAT_GUARD_CHECK_EVERY
+                    ):
+                        _rg_checked_at = _rg_total
+                        _unit = _detect_degenerate_repeat("".join(_rg_tail))
+                        if _unit:
+                            _rg_tripped = _unit
+                            logger.warning(
+                                "REPEAT GUARD: aborting runaway generation after %d chars "
+                                "— unit of %d chars repeating: %.120r",
+                                _rg_total,
+                                len(_unit),
+                                _unit,
+                            )
+                            break
+
             # Handle tool_calls deltas
             if delta.get("tool_calls"):
                 for tc_delta in delta["tool_calls"]:
@@ -11769,6 +11883,13 @@ async def stream_anthropic_response(
         # connection un-closed → CLOSE-WAIT leak. Detaching guarantees it runs.
         _detach_aclose(openai_stream)
 
+    # A guard-aborted turn is NOT a complete answer. Report max_tokens so the
+    # client treats the text as truncated (and retries where it supports that)
+    # rather than accepting a wall of repeated text as the final response —
+    # the same contract `_detect_and_truncate_degenerate_repetition` uses.
+    if _rg_tripped:
+        finish_reason = "max_tokens"
+
     # Close any open tool call blocks (skip if XML recovery already emitted them)
     xml_recovered = tool_calls_by_index.pop("_xml_recovered", False)
     if tool_calls_by_index and not xml_recovered:

package/tools/agents/tests/test_repeat_guard.py

@@ -0,0 +1,216 @@
+#!/usr/bin/env python3
+"""Mid-stream degenerate-repetition guard.
+
+Regression cover for the 2026-08-25 runaway: a rail running
+--repeat-penalty 1.0 with DRY disabled emitted ONE sentence 640 times
+(151,628 chars) until it hit the 32,768-token n-predict cap, ~11 minutes of
+GPU for a turn that produced nothing. The post-hoc detector
+(_detect_and_truncate_degenerate_repetition) only repairs NON-streaming
+responses, so a streaming client like opencode was never protected.
+
+The false-positive tests are the load-bearing half: a guard that aborts real
+answers is worse than the runaway it prevents.
+"""
+
+import asyncio
+import importlib.util
+import json
+import unittest
+from pathlib import Path
+
+
+def _load_proxy_module():
+    proxy_path = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+    spec = importlib.util.spec_from_file_location("anthropic_proxy", proxy_path)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+proxy = _load_proxy_module()
+
+# The exact sentence captured from the live runaway.
+RUNAWAY_LINE = (
+    "The Docker build fails because the workspace root `Cargo.toml` doesn't "
+    "include the `pg-server` bin target. Let me check the workspace structure:"
+)
+
+
+class TestDetectDegenerateRepeat(unittest.TestCase):
+    def test_detects_the_captured_runaway_shape(self):
+        """One sentence + blank line, over and over — the real failure."""
+        tail = (RUNAWAY_LINE + "\n\n") * 20
+        self.assertEqual(proxy._detect_degenerate_repeat(tail), RUNAWAY_LINE)
+
+    def test_detects_loop_with_no_newlines(self):
+        """Block mode: a loop inside one long line is invisible to line mode."""
+        unit = "and then the value is recomputed again, "
+        tail = "prefix text. " + unit * 12
+        found = proxy._detect_degenerate_repeat(tail)
+        self.assertIsNotNone(found)
+        # Whatever period it locks onto must itself be the repeating unit.
+        self.assertTrue(unit.strip(", ") in found or found in unit * 2)
+
+    def test_ignores_repetition_that_has_stopped(self):
+        """Anchored at the END: a repetitive passage the model moved on from
+        is not a runaway, and aborting there would truncate a real answer."""
+        tail = (RUNAWAY_LINE + "\n\n") * 20 + (
+            "\n\nRight — the bin target is missing from the workspace members "
+            "list. Adding it to Cargo.toml now, then rebuilding to confirm the "
+            "image picks up the new binary.\n"
+        )
+        self.assertIsNone(proxy._detect_degenerate_repeat(tail))
+
+    def test_ignores_short_and_punctuation_only_runs(self):
+        """Rules, fences and bracket runs legitimately repeat in real output."""
+        for tail in (
+            "----\n" * 30,
+            "```\n" * 30,
+            "}\n" * 30,
+            "    \n" * 30,
+            ("ok\n") * 30,  # non-blank but under MIN_UNIT
+        ):
+            with self.subTest(tail=tail[:12]):
+                self.assertIsNone(proxy._detect_degenerate_repeat(tail))
+
+    def test_ignores_similar_but_distinct_lines(self):
+        """Generated code repeats structure, not whole identical lines."""
+        tail = "".join(
+            f'    assert_eq!(rows[{i}].get::<_, i64>("id"), {i} as i64);\n'
+            for i in range(30)
+        )
+        self.assertIsNone(proxy._detect_degenerate_repeat(tail))
+
+    def test_ignores_empty_input(self):
+        self.assertIsNone(proxy._detect_degenerate_repeat(""))
+
+
+class _FakeUpstreamStream:
+    """Minimal streamed httpx.Response: yields OpenAI SSE lines."""
+
+    def __init__(self, contents, finish_reason="stop"):
+        self._contents = list(contents)
+        self._finish_reason = finish_reason
+        self.closed = False
+        self.lines_served = 0
+
+    async def aiter_lines(self):
+        for chunk in self._contents:
+            self.lines_served += 1
+            payload = {"choices": [{"delta": {"content": chunk}, "index": 0}]}
+            yield "data: " + json.dumps(payload)
+        final = {"choices": [{"delta": {}, "finish_reason": self._finish_reason}]}
+        yield "data: " + json.dumps(final)
+        yield "data: [DONE]"
+
+    async def aclose(self):
+        self.closed = True
+
+
+def _drain(upstream):
+    monitor = proxy.SessionMonitor(context_window=131072)
+
+    async def run():
+        out = []
+        async for frame in proxy.stream_anthropic_response(
+            upstream, "test-model", monitor, {"messages": [], "tools": []}
+        ):
+            out.append(frame)
+        return out
+
+    return asyncio.run(run())
+
+
+def _text_deltas(frames):
+    texts = []
+    for frame in frames:
+        for line in frame.splitlines():
+            if not line.startswith("data: "):
+                continue
+            try:
+                obj = json.loads(line[6:])
+            except json.JSONDecodeError:
+                continue
+            if obj.get("type") == "content_block_delta":
+                delta = obj.get("delta", {})
+                if delta.get("type") == "text_delta":
+                    texts.append(delta["text"])
+    return texts
+
+
+def _stop_reason(frames):
+    for frame in frames:
+        for line in frame.splitlines():
+            if not line.startswith("data: "):
+                continue
+            try:
+                obj = json.loads(line[6:])
+            except json.JSONDecodeError:
+                continue
+            if obj.get("type") == "message_delta":
+                return (obj.get("delta") or {}).get("stop_reason")
+    return None
+
+
+class TestStreamRepeatGuard(unittest.TestCase):
+    def test_aborts_runaway_before_the_budget_is_spent(self):
+        """The whole point: stop generating, not just clean up afterwards."""
+        chunks = [RUNAWAY_LINE + "\n\n"] * 400
+        upstream = _FakeUpstreamStream(chunks)
+        frames = _drain(upstream)
+
+        served = upstream.lines_served
+        self.assertLess(
+            served, 100, f"guard did not abort early: {served}/400 chunks consumed"
+        )
+        self.assertEqual(
+            _stop_reason(frames),
+            "max_tokens",
+            "an aborted runaway must not be reported as a complete answer",
+        )
+
+    def test_normal_response_streams_through_untouched(self):
+        """No false abort, and every delta still reaches the client."""
+        chunks = [
+            "Checking the workspace layout.\n\n",
+            "The `pg-server` crate is present but not listed under "
+            "`[workspace] members`, so `cargo build --workspace` never "
+            "builds its binary.\n\n",
+            "Adding it to the members list and rebuilding.\n",
+        ]
+        upstream = _FakeUpstreamStream(chunks)
+        frames = _drain(upstream)
+
+        self.assertEqual(_text_deltas(frames), chunks)
+        self.assertEqual(_stop_reason(frames), "end_turn")
+
+    def test_long_legitimate_answer_is_not_aborted(self):
+        """Well past the guard's minimum length, with repeated structure."""
+        chunks = [
+            f"Step {i}: verify that migration {i:03d} applies cleanly and the "
+            f"resulting schema matches the fixture checked in at "
+            f"tests/fixtures/schema_{i:03d}.sql.\n\n"
+            for i in range(80)
+        ]
+        upstream = _FakeUpstreamStream(chunks)
+        frames = _drain(upstream)
+
+        self.assertEqual(len(_text_deltas(frames)), 80)
+        self.assertEqual(_stop_reason(frames), "end_turn")
+
+    def test_guard_can_be_disabled(self):
+        chunks = [RUNAWAY_LINE + "\n\n"] * 60
+        original = proxy.PROXY_REPEAT_GUARD
+        proxy.PROXY_REPEAT_GUARD = False
+        try:
+            upstream = _FakeUpstreamStream(chunks)
+            frames = _drain(upstream)
+            self.assertEqual(len(_text_deltas(frames)), 60)
+            self.assertEqual(_stop_reason(frames), "end_turn")
+        finally:
+            proxy.PROXY_REPEAT_GUARD = original
+
+
+if __name__ == "__main__":
+    unittest.main()