@miller-tech/uap 1.60.0 → 1.61.0

package/tools/agents/scripts/toolcall_path_normalizer.py

@@ -0,0 +1,140 @@
+"""Self-Harness middleware (proxy side) — conversation-aware tool-call path normalizer.
+
+The mechanical fix for the `toolcall.path.garbled` failure: a small quant
+fat-fingers the file path in Write/Edit/Read tool calls (case, dropped/altered
+extension, stray subdirectory, trailing whitespace), so the edit lands nowhere.
+No prompt/param Mod fixes it. A Claude Code PreToolUse hook can't either — it does
+NOT honor `updatedInput` (verified empirically 2026-06-23). The proxy, however,
+sees the whole conversation: the model almost always Reads the file with the
+CORRECT path before mangling it in a later Edit. So we snap a garbled tool-call
+path to the nearest path the model already used correctly earlier in the
+conversation — filesystem-free, and the proxy is in the request path.
+
+Pure functions; gated by PROXY_TOOLCALL_PATH_NORMALIZE in the proxy. Mirrors the
+TS reference at src/self-harness/middleware/path-normalizer.ts.
+See docs/design/SELF_HARNESS.md §4 (P2).
+"""
+
+import re
+
+_PATH_ARG_KEYS = ("file_path", "path", "filePath", "notebook_path")
+
+
+def _squash(s: str) -> str:
+    return re.sub(r"[^a-z0-9]", "", s.lower())
+
+
+def _basename(p: str) -> str:
+    parts = [x for x in p.split("/") if x]
+    return parts[-1] if parts else p
+
+
+def _edit_distance(a: str, b: str) -> int:
+    m, n = len(a), len(b)
+    if m == 0:
+        return n
+    if n == 0:
+        return m
+    prev = list(range(n + 1))
+    for i in range(1, m + 1):
+        cur = [i] + [0] * n
+        for j in range(1, n + 1):
+            cost = 0 if a[i - 1] == b[j - 1] else 1
+            cur[j] = min(prev[j] + 1, cur[j - 1] + 1, prev[j - 1] + cost)
+        prev = cur
+    return prev[n]
+
+
+def normalize_tool_path(proposed: str, known_paths, max_edit_distance=None):
+    """Snap `proposed` to the nearest path in `known_paths` (paths the model used
+    correctly earlier). Returns (path, changed, reason). Never invents a target:
+    an unmatched path (a legitimate new file) is returned unchanged.
+    """
+    known = list(dict.fromkeys(known_paths))  # de-dupe, preserve order
+    if not proposed or not known:
+        return proposed, False, None
+
+    trimmed = proposed.strip()
+    if trimmed in known:
+        if trimmed != proposed:
+            return trimmed, True, "trimmed surrounding whitespace"
+        return proposed, False, None
+
+    base = _basename(trimmed)
+
+    def snap(target, reason):
+        return (target, True, reason) if target != proposed else (proposed, False, None)
+
+    def unique(cands):
+        return cands[0] if len(cands) == 1 else None
+
+    # 1) exact basename (stray dirs)
+    hit = unique([k for k in known if _basename(k) == base])
+    if hit:
+        return snap(hit, "stray path components removed")
+    # 2) case-insensitive basename
+    hit = unique([k for k in known if _basename(k).lower() == base.lower()])
+    if hit:
+        return snap(hit, "case-normalized to the real filename")
+    # 3) punctuation/extension-squashed basename
+    sb = _squash(base)
+    hit = unique([k for k in known if _squash(_basename(k)) == sb])
+    if hit:
+        return snap(hit, "extension/punctuation-normalized to the real filename")
+    # 4) edit-distance fallback (only when clearly closest)
+    max_d = max_edit_distance if max_edit_distance is not None else max(2, len(base) // 3)
+    ranked = sorted(
+        ((k, _edit_distance(base.lower(), _basename(k).lower())) for k in known),
+        key=lambda kv: kv[1],
+    )
+    if ranked and ranked[0][1] <= max_d and (len(ranked) < 2 or ranked[1][1] > ranked[0][1]):
+        return snap(ranked[0][0], f"nearest filename by edit distance ({ranked[0][1]})")
+
+    return proposed, False, None
+
+
+def extract_known_paths(anthropic_messages) -> list:
+    """Collect file paths the model has already used in the conversation — from
+    prior tool_use arguments (file_path/path) and from tool_result text that
+    echoes a path. These are the 'real' paths to snap garbled ones toward.
+    """
+    known: list[str] = []
+
+    def add(p):
+        if isinstance(p, str) and p.strip() and p.strip() not in known:
+            known.append(p.strip())
+
+    for msg in anthropic_messages or []:
+        content = msg.get("content")
+        if not isinstance(content, list):
+            continue
+        for block in content:
+            if not isinstance(block, dict):
+                continue
+            if block.get("type") == "tool_use":
+                inp = block.get("input") or {}
+                for key in _PATH_ARG_KEYS:
+                    add(inp.get(key))
+    return known
+
+
+def normalize_tool_uses(tool_uses, known_paths):
+    """Normalize path args of a list of Anthropic tool_use blocks in place.
+    Returns the list of corrections [(tool_use_id, key, from, to, reason)].
+    """
+    corrections = []
+    for tu in tool_uses:
+        if not isinstance(tu, dict) or tu.get("type") != "tool_use":
+            continue
+        inp = tu.get("input")
+        if not isinstance(inp, dict):
+            continue
+        for key in _PATH_ARG_KEYS:
+            v = inp.get(key)
+            if not isinstance(v, str):
+                continue
+            new_v, changed, reason = normalize_tool_path(v, known_paths)
+            if changed:
+                inp[key] = new_v
+                corrections.append((tu.get("id", ""), key, v, new_v, reason))
+    return corrections

package/tools/agents/tests/test_anthropic_proxy_streaming.py

@@ -1809,6 +1809,64 @@ class TestMalformedToolGuardrail(unittest.TestCase):
         self.assertEqual(len(fake_client.requests), 1)
 
 
+class TestTurnCountFinalizeBreaker(unittest.TestCase):
+    """The mode-B runaway backstop: after PROXY_HARD_FINALIZE_TURNS assistant
+    tool turns, the proxy strips tools so the only possible output is a terminal
+    text summary (end_turn). Inert below the ceiling."""
+
+    @staticmethod
+    def _body(n_tool_turns):
+        msgs = [{"role": "user", "content": "do the task"}]
+        for i in range(n_tool_turns):
+            msgs.append({
+                "role": "assistant",
+                "content": [{"type": "tool_use", "id": f"t{i}", "name": "Bash",
+                             "input": {"command": "ls"}}],
+            })
+            msgs.append({
+                "role": "user",
+                "content": [{"type": "tool_result", "tool_use_id": f"t{i}", "content": "ok"}],
+            })
+        return {
+            "model": "x", "messages": msgs,
+            "tools": [{"name": "Bash", "input_schema": {"type": "object"}}],
+        }
+
+    def test_strips_tools_above_ceiling(self):
+        old = getattr(proxy, "PROXY_HARD_FINALIZE_TURNS")
+        try:
+            setattr(proxy, "PROXY_HARD_FINALIZE_TURNS", 40)
+            out = proxy.build_openai_request(
+                self._body(45), proxy.SessionMonitor(context_window=262144)
+            )
+            self.assertFalse(out.get("tools"))  # tools stripped
+            self.assertIn("STOP now", out["messages"][-1]["content"])
+        finally:
+            setattr(proxy, "PROXY_HARD_FINALIZE_TURNS", old)
+
+    def test_inert_below_ceiling(self):
+        old = getattr(proxy, "PROXY_HARD_FINALIZE_TURNS")
+        try:
+            setattr(proxy, "PROXY_HARD_FINALIZE_TURNS", 40)
+            out = proxy.build_openai_request(
+                self._body(5), proxy.SessionMonitor(context_window=262144)
+            )
+            self.assertTrue(out.get("tools"))  # tools retained
+        finally:
+            setattr(proxy, "PROXY_HARD_FINALIZE_TURNS", old)
+
+    def test_disabled_when_zero(self):
+        old = getattr(proxy, "PROXY_HARD_FINALIZE_TURNS")
+        try:
+            setattr(proxy, "PROXY_HARD_FINALIZE_TURNS", 0)
+            out = proxy.build_openai_request(
+                self._body(60), proxy.SessionMonitor(context_window=262144)
+            )
+            self.assertTrue(out.get("tools"))  # disabled → never strips
+        finally:
+            setattr(proxy, "PROXY_HARD_FINALIZE_TURNS", old)
+
+
 class TestToolTurnControls(unittest.TestCase):
     def test_tool_narrowing_reduces_tool_count(self):
         old_narrow = getattr(proxy, "PROXY_TOOL_NARROWING")
@@ -1853,9 +1911,17 @@ class TestToolTurnControls(unittest.TestCase):
             openai = proxy.build_openai_request(
                 body, proxy.SessionMonitor(context_window=262144)
             )
-            self.assertEqual(len(openai.get("tools", [])), 2)
             names = [t.get("function", {}).get("name") for t in openai.get("tools", [])]
-            self.assertIn("RunTests", names)
+            # Narrowing must still REDUCE the toolset by dropping irrelevant tools
+            # (Deploy), while keeping the query-relevant tool (RunTests) AND core
+            # action tools (Read/Edit) — a coding agent that loses Edit cannot
+            # "fix the failing test". Core-tool protection makes `keep` a soft
+            # floor, so the exact count is keep + any core tools not already in
+            # the top-scored set; assert the invariant, not a brittle fixed count.
+            self.assertLess(len(names), 4)            # reduced from 4
+            self.assertIn("RunTests", names)          # query-relevant kept
+            self.assertIn("Edit", names)              # core action tool kept
+            self.assertNotIn("Deploy", names)         # irrelevant dropped
         finally:
             setattr(proxy, "PROXY_TOOL_NARROWING", old_narrow)
             setattr(proxy, "PROXY_TOOL_NARROWING_KEEP", old_keep)
@@ -5480,6 +5546,31 @@ class TestReconConvergence(unittest.TestCase):
         proxy._maybe_inject_recon_convergence(body, m)
         self.assertEqual(len(body["messages"]), 1)
 
+    def test_escalate_is_one_shot_not_a_permanent_poison(self):
+        """POISON FIX: the escalate tier strips tools to force a terminal
+        summary, but it must reset the no-write streak so it does NOT re-fire
+        every subsequent request. Without the reset, recon_hard_fires is
+        monotonic (escalate stays true) and stripped tools mean the model can
+        never write (streak never falls), so EVERY request gets tools stripped
+        forever — poisoning the session (and any colliding-fingerprint session)
+        until a proxy restart."""
+        proxy.PROXY_RECON_CONVERGENCE_THRESHOLD = 40
+        m = proxy.SessionMonitor(context_window=131072)
+        tools = [self._tool("Write"), self._tool("Read")]
+        # drive into escalate: streak huge, hard-tier already fired to the cap
+        m.consecutive_no_write_turns = 200
+        m.recon_hard_fires = proxy.PROXY_RECON_SESSION_HARD_CAP
+        b1 = {"messages": [{"role": "user", "content": "go"}],
+              "tools": list(tools), "tool_choice": "required"}
+        proxy._maybe_inject_recon_convergence(b1, m, tools)
+        self.assertNotIn("tools", b1)                    # escalate stripped tools
+        self.assertEqual(m.consecutive_no_write_turns, 0)  # streak reset (the fix)
+        # next request: streak is now below threshold → MUST NOT strip again
+        b2 = {"messages": [{"role": "user", "content": "go"}],
+              "tools": list(tools), "tool_choice": "required"}
+        proxy._maybe_inject_recon_convergence(b2, m, tools)
+        self.assertTrue(b2.get("tools"))                 # tools restored, not poisoned
+
     @staticmethod
     def _tool(name: str) -> dict:
         return {"type": "function", "function": {"name": name, "description": f"{name} tool"}}