@miller-tech/uap 1.61.1 → 1.61.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.61.1",
+  "version": "1.61.2",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/tools/agents/scripts/anthropic_proxy.py

@@ -945,6 +945,13 @@ class SessionMonitor:
     tool_cycle_counts: dict = field(default_factory=dict)  # {tool_name: cycle_count} across resets
     last_response_garbled: bool = False  # previous turn had garbled/malformed output
     finalize_turn_active: bool = False
+    # Set True for the single turn on which a hard finalize breaker (TURN-COUNT
+    # or CONTAMINATION LOOP) strips tools to force a terminal text-only end_turn.
+    # Suppresses response-side prose->tool_call resurrection so a contaminated
+    # model emitting `<function=...>`/`<tool_call>` prose does not get it promoted
+    # back into a structured tool_use, which would continue the very loop the
+    # breaker is ending. Reset to False at the start of every request.
+    suppress_text_tool_extraction: bool = False
     finalize_continuation_count: int = 0
     finalize_hard_stop_count: int = 0  # monotonic, not reset by fresh user text
     finalize_synthetic_tool_id: str = ""
@@ -4052,6 +4059,10 @@ def build_openai_request(
                 })
                 openai_body["messages"] = msgs
                 monitor.reset_tool_turn_state(reason="turn_count_finalize_breaker")
+                # Tools were stripped to force a terminal text summary; do not let
+                # the response-side extractor resurrect prose tool-calls (which
+                # would defeat the breaker and continue the loop).
+                monitor.suppress_text_tool_extraction = True
                 logger.warning(
                     "TURN-COUNT FINALIZE BREAKER: %d agent tool turns >= ceiling %d "
                     "-- stripped tools to force terminal summary (end_turn).",
@@ -7084,6 +7095,11 @@ def _maybe_apply_session_contamination_breaker(
                 "Summarize what you have accomplished and what remains to be done."
             ),
         })
+        # Suppress prose->tool_call resurrection on this turn: the model is
+        # contaminated and will emit `<function=...>`/`<tool_call>` prose even
+        # with tools removed; promoting it back to a structured tool_use would
+        # continue the exact loop this finalize is meant to break.
+        monitor.suppress_text_tool_extraction = True
         return updated
 
     messages = anthropic_body.get("messages", [])
@@ -7210,7 +7226,9 @@ def _maybe_apply_session_contamination_breaker(
 
 
 def _maybe_extract_text_tool_calls(
-    openai_resp: dict, anthropic_tools: list[dict] | None = None
+    openai_resp: dict,
+    anthropic_tools: list[dict] | None = None,
+    suppress: bool = False,
 ) -> dict:
     """Mutate *openai_resp* in-place: if the message has no structured
     ``tool_calls`` but contains tool-call markup in text, extract them
@@ -7222,6 +7240,11 @@ def _maybe_extract_text_tool_calls(
     blocks pass through as text.
 
     Returns the (possibly-mutated) response for chaining."""
+    # A hard finalize breaker stripped tools this turn to force a terminal
+    # text-only end_turn; do not resurrect prose tool-calls (that would defeat
+    # the breaker and continue the loop). Carried per-turn on the SessionMonitor.
+    if suppress:
+        return openai_resp
     choice = (openai_resp.get("choices") or [{}])[0]
     message = choice.get("message", {})
 
@@ -7427,7 +7450,10 @@ def _extract_thinking_block(text: str) -> tuple[str | None, str]:
 
 
 def openai_to_anthropic_response(
-    openai_resp: dict, model: str, expose_thinking: bool = True
+    openai_resp: dict,
+    model: str,
+    expose_thinking: bool = True,
+    suppress_text_tool_extraction: bool = False,
 ) -> dict:
     """Convert an OpenAI Chat Completions response to Anthropic Messages format.
 
@@ -7441,7 +7467,7 @@ def openai_to_anthropic_response(
     they're surfaced as Anthropic blocks or silently consumed.
     """
     # First: try to recover tool calls trapped in text XML tags
-    _maybe_extract_text_tool_calls(openai_resp)
+    _maybe_extract_text_tool_calls(openai_resp, suppress=suppress_text_tool_extraction)
     # Second: strip garbled/degenerate tool call arguments
     _sanitize_garbled_tool_calls(openai_resp)
 
@@ -7837,7 +7863,11 @@ async def stream_anthropic_response(
     # -------------------------------------------------------------------
     # Post-stream: recover <tool_call> XML from accumulated text
     # -------------------------------------------------------------------
-    if not tool_calls_by_index and "<tool_call>" in accumulated_text:
+    if (
+        not tool_calls_by_index
+        and "<tool_call>" in accumulated_text
+        and not monitor.suppress_text_tool_extraction
+    ):
         xml_extracted, remaining_text = _extract_tool_calls_from_text(accumulated_text)
         if xml_extracted:
             # We already streamed the text as-is.  We cannot un-stream it,
@@ -8045,6 +8075,10 @@ async def messages(request: Request):
         return await _passthrough_anthropic_request(request, body, is_stream)
     session_id = resolve_session_id(request, body)
     monitor = get_session_monitor(session_id)
+    # Per-turn flag: only the turn whose breaker strips tools suppresses the
+    # response-side prose->tool_call resurrection. Clear it at request entry so a
+    # prior finalize turn never bleeds into the next turn's normal extraction.
+    monitor.suppress_text_tool_extraction = False
     last_session_id = session_id
     # Make the session id visible to _ensure_slot_for_session inside
     # _post_with_retry. The /v1/chat/completions handler also reaches this
@@ -8358,7 +8392,11 @@ async def messages(request: Request):
 
         openai_resp = strict_resp.json()
         # Recover tool calls from <tool_call> XML before guardrails run
-        _maybe_extract_text_tool_calls(openai_resp, anthropic_tools=body.get("tools"))
+        _maybe_extract_text_tool_calls(
+            openai_resp,
+            anthropic_tools=body.get("tools"),
+            suppress=monitor.suppress_text_tool_extraction,
+        )
         openai_resp = await _apply_unexpected_end_turn_guardrail(
             client,
             openai_resp,
@@ -8417,6 +8455,7 @@ async def messages(request: Request):
             openai_resp, model,
             expose_thinking=isinstance(body.get("thinking"), dict)
                 and (body["thinking"].get("type") or "").lower() == "enabled",
+            suppress_text_tool_extraction=monitor.suppress_text_tool_extraction,
         )
         _maybe_normalize_toolcall_paths(anthropic_resp, body)
         # FINALIZE CONTINUATION: inject synthetic tool_use to keep client loop alive
@@ -8758,7 +8797,11 @@ async def messages(request: Request):
 
         openai_resp = resp.json()
         # Recover tool calls from <tool_call> XML before guardrails run
-        _maybe_extract_text_tool_calls(openai_resp, anthropic_tools=body.get("tools"))
+        _maybe_extract_text_tool_calls(
+            openai_resp,
+            anthropic_tools=body.get("tools"),
+            suppress=monitor.suppress_text_tool_extraction,
+        )
         openai_resp = await _apply_unexpected_end_turn_guardrail(
             client,
             openai_resp,
@@ -8831,6 +8874,7 @@ async def messages(request: Request):
             openai_resp, model,
             expose_thinking=isinstance(body.get("thinking"), dict)
                 and (body["thinking"].get("type") or "").lower() == "enabled",
+            suppress_text_tool_extraction=monitor.suppress_text_tool_extraction,
         )
         _maybe_normalize_toolcall_paths(anthropic_resp, body)
         # FINALIZE CONTINUATION: inject synthetic tool_use (non-guarded stream path)

package/tools/agents/tests/test_finalize_suppression.py

@@ -0,0 +1,178 @@
+#!/usr/bin/env python3
+"""Tests for the gated finalize-suppression fix.
+
+When a hard finalize breaker (TURN-COUNT FINALIZE BREAKER or SESSION
+CONTAMINATION LOOP) deliberately strips tools to force a terminal text-only
+``end_turn``, the response-side prose->tool_call resurrection must be suppressed.
+Otherwise a contaminated model that emits ``<function=...>`` / ``<tool_call>``
+prose has it promoted back into a structured ``tool_use``, the client executes
+it, and the very loop the breaker meant to end continues.
+
+The suppression is carried per-turn on the SessionMonitor
+(``suppress_text_tool_extraction``): the breakers set it True; the extractor and
+the post-stream recovery honor it; the request handler clears it at the start of
+every turn so a finalize turn never bleeds into the next turn's normal flow.
+"""
+
+import asyncio
+import importlib.util
+import json
+import unittest
+from pathlib import Path
+
+
+def _load_proxy_module():
+    proxy_path = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+    spec = importlib.util.spec_from_file_location("anthropic_proxy", proxy_path)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+proxy = _load_proxy_module()
+
+
+def _prose_tool_resp():
+    """OpenAI response: message has NO structured tool_calls but DOES contain a
+    Hermes ``<function=...>`` prose tool call (the contamination output)."""
+    return {
+        "choices": [
+            {
+                "message": {
+                    "role": "assistant",
+                    "content": "<function=Bash>\n<parameter=command>ls</parameter>\n</function>",
+                },
+                "finish_reason": "stop",
+            }
+        ]
+    }
+
+
+class _FakeOpenAIStream:
+    """Minimal stand-in for an httpx streaming response: yields the queued
+    ``data: {...}`` SSE lines that stream_anthropic_response consumes."""
+
+    def __init__(self, lines):
+        self._lines = list(lines)
+
+    async def aiter_lines(self):
+        for line in self._lines:
+            yield line
+
+    async def aclose(self):
+        pass
+
+
+def _tool_call_text_stream():
+    """An upstream stream whose text delta embeds a ``<tool_call>`` payload and
+    that carries NO structured tool_calls — the prose the post-stream recovery
+    would otherwise resurrect."""
+    text_delta = {
+        "choices": [
+            {
+                "delta": {
+                    "content": '<tool_call>{"name":"Bash","arguments":{"command":"ls"}}</tool_call>'
+                },
+                "finish_reason": None,
+            }
+        ]
+    }
+    final = {"choices": [{"delta": {}, "finish_reason": "stop"}]}
+    return _FakeOpenAIStream(
+        [f"data: {json.dumps(text_delta)}", f"data: {json.dumps(final)}", "data: [DONE]"]
+    )
+
+
+async def _drain(agen):
+    return [chunk async for chunk in agen]
+
+
+class TestFinalizeSuppressionExtractor(unittest.TestCase):
+    def test_baseline_promotes_prose_tool_call(self):
+        """suppress=False: the load-bearing parser still resurrects the prose
+        tool call (guards against the fix over-suppressing normal turns)."""
+        resp = _prose_tool_resp()
+        proxy._maybe_extract_text_tool_calls(resp)
+        msg = resp["choices"][0]["message"]
+        self.assertTrue(msg.get("tool_calls"), "expected prose call to be promoted")
+        self.assertEqual(msg["tool_calls"][0]["function"]["name"], "Bash")
+        self.assertEqual(resp["choices"][0]["finish_reason"], "tool_calls")
+
+    def test_suppressed_leaves_prose_as_text(self):
+        """suppress=True: prose stays text -> the client sees a clean end_turn
+        with no action, so the agentic loop terminates."""
+        resp = _prose_tool_resp()
+        proxy._maybe_extract_text_tool_calls(resp, suppress=True)
+        msg = resp["choices"][0]["message"]
+        self.assertFalse(msg.get("tool_calls"), "must NOT resurrect tool call on finalize")
+        self.assertIn("<function=Bash>", msg["content"])
+        self.assertEqual(resp["choices"][0]["finish_reason"], "stop")
+
+    def test_conversion_respects_suppression(self):
+        """openai_to_anthropic_response forwards suppression to its internal
+        extraction call (the 7444 site that lacks a monitor argument)."""
+        anthro = proxy.openai_to_anthropic_response(
+            _prose_tool_resp(), "m", suppress_text_tool_extraction=True
+        )
+        self.assertFalse(
+            any(b.get("type") == "tool_use" for b in anthro.get("content", [])),
+            "conversion must not resurrect a tool_use when suppressed",
+        )
+
+
+class TestStreamingRecoverySuppression(unittest.TestCase):
+    def _run(self, suppress):
+        monitor = proxy.SessionMonitor(context_window=100000)
+        monitor.suppress_text_tool_extraction = suppress
+        agen = proxy.stream_anthropic_response(_tool_call_text_stream(), "test-model", monitor, {})
+        return "".join(asyncio.run(_drain(agen)))
+
+    def test_baseline_streaming_recovers_tool_use(self):
+        self.assertIn(
+            '"type": "tool_use"', self._run(False),
+            "post-stream recovery should fire when not suppressed",
+        )
+
+    def test_suppressed_streaming_does_not_recover_tool_use(self):
+        self.assertNotIn(
+            '"type": "tool_use"', self._run(True),
+            "must NOT recover tool_use on finalize",
+        )
+
+
+class TestContaminationBreakerSetsSuppression(unittest.TestCase):
+    def _monitor(self):
+        return proxy.SessionMonitor(context_window=100000)
+
+    def test_forcing_finalize_sets_suppression_and_strips_tools(self):
+        """The terminal forcing-finalize branch (resets >= max) strips tools AND
+        sets the per-turn suppression flag on the monitor."""
+        m = self._monitor()
+        m.malformed_tool_streak = proxy.PROXY_SESSION_CONTAMINATION_THRESHOLD
+        m.contamination_resets = 3  # >= max (3) -> forcing-finalize branch
+        body = {
+            "messages": [{"role": "user", "content": "go"}],
+            "tools": [{"name": "Bash"}],
+            "tool_choice": "auto",
+        }
+        out = proxy._maybe_apply_session_contamination_breaker(body, m, "sess-finalize")
+        self.assertNotIn("tools", out)
+        self.assertNotIn("tool_choice", out)
+        self.assertTrue(m.suppress_text_tool_extraction, "forcing-finalize must set suppression")
+
+    def test_standard_reset_does_not_suppress(self):
+        """A normal (non-terminal) contamination reset keeps tools and must NOT
+        suppress extraction — the model should still be able to recover."""
+        m = self._monitor()
+        m.malformed_tool_streak = proxy.PROXY_SESSION_CONTAMINATION_THRESHOLD
+        m.contamination_resets = 0  # below max -> standard reset path
+        msgs = [{"role": "user", "content": "go"}]
+        msgs += [{"role": "assistant", "content": f"turn {i}"} for i in range(12)]
+        body = {"messages": msgs, "tools": [{"name": "Bash"}]}
+        proxy._maybe_apply_session_contamination_breaker(body, m, "sess-standard")
+        self.assertFalse(m.suppress_text_tool_extraction, "standard reset must NOT suppress")
+
+
+if __name__ == "__main__":
+    unittest.main()