@miller-tech/uap 2.16.4 → 2.16.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "2.16.4",
+  "version": "2.16.6",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/tools/agents/scripts/anthropic_proxy.py

@@ -11783,6 +11783,19 @@ async def _apply_unexpected_end_turn_guardrail(
         logger.info("GUARDRAIL: skipped unexpected_end_turn retry on finalize turn")
         return openai_resp
 
+    # A tools-stripped breaker turn (STUCK-BREAK HARD / finalize-adjacent) ends
+    # in prose BY DESIGN -- observed live 2026-09-29 08:43:40, the model finally
+    # produced the prose exit and this guardrail treated it as an anomaly and
+    # retried with tool_choice=required, re-coercing the very loop the breaker
+    # exists to end (and burning a full prefill to do it).
+    if monitor.suppress_text_tool_extraction:
+        logger.info(
+            "GUARDRAIL: skipped unexpected_end_turn retry on a tools-stripped "
+            "breaker turn -- the prose exit is the intended outcome, not an "
+            "anomaly to re-coerce"
+        )
+        return openai_resp
+
     if not _is_unexpected_end_turn(openai_resp, anthropic_body):
         return openai_resp
 
@@ -11877,6 +11890,15 @@ async def _apply_malformed_tool_guardrail(
             logger.info("GUARDRAIL: finalize turn clean, no tool call XML detected")
         return openai_resp
 
+    # A tools-stripped breaker turn drops whatever the backend resurrects at
+    # conversion time; repairing the resurrected call's arguments first would
+    # burn a retry prefill perfecting a call that is about to be discarded.
+    if monitor.suppress_text_tool_extraction:
+        logger.info(
+            "GUARDRAIL: skipped malformed-tool retry on a tools-stripped breaker turn"
+        )
+        return openai_resp
+
     working_resp = openai_resp
     repair_count = 0
     if PROXY_TOOL_ARGS_PREFLIGHT and _openai_has_tool_calls(openai_resp):
@@ -12922,6 +12944,41 @@ def openai_to_anthropic_response(
     message = choice.get("message", {})
     finish = choice.get("finish_reason", "stop")
 
+    # Structured resurrection on a tools-stripped turn. The text-markup
+    # suppression above only scrubs tool calls written into the TEXT body --
+    # but the BACKEND can still parse the model's repeated <tool_call> into a
+    # STRUCTURED tool_calls field even with an empty tools list (observed live
+    # 2026-09-29 08:38, tabbyAPI: finish=tool_calls, text_len=0, the identical
+    # ssh call re-served 30+ times at ~9 req/min; the client re-executed it
+    # each pass and the loop never ended). On a suppressed turn there are, by
+    # construction, no tools, so ANY structured call is resurrection: drop it,
+    # force the finish back to prose, and let the fallback below carry the
+    # reply when the model wrote nothing else.
+    if suppress_text_tool_extraction and message.get("tool_calls"):
+        dropped = message.pop("tool_calls") or []
+        if finish in ("tool_calls", "function_call"):
+            choice["finish_reason"] = "stop"
+            finish = "stop"
+        _suppressed_content = message.get("content")
+        if _suppressed_content is None or (
+            isinstance(_suppressed_content, str) and not _suppressed_content.strip()
+        ):
+            message["content"] = STUCK_BREAK_PROSE_FALLBACK
+        logger.warning(
+            "STUCK-BREAK HARD: suppressed STRUCTURED tool_calls from the backend on "
+            "a tools-stripped turn (%d call(s), e.g. %s) -- the turn now ends in "
+            "prose as intended",
+            len(dropped),
+            next(
+                (
+                    (c.get("function") or {}).get("name", "?")
+                    for c in dropped
+                    if isinstance(c, dict)
+                ),
+                "?",
+            ),
+        )
+
     content = []
     # Surface Qwen's <think>...</think> output as Anthropic-style thinking
     # blocks (Anthropic extended-thinking API shape:

package/tools/agents/tests/test_anthropic_proxy_streaming.py

@@ -1737,6 +1737,114 @@ class TestMalformedToolGuardrail(unittest.TestCase):
         self.assertEqual(malformed, openai_resp)
         self.assertEqual(len(fake_client.requests), 0)
 
+    def test_guardrails_skip_tools_stripped_breaker_turn(self):
+        # A STUCK-BREAK HARD turn ending in prose is the INTENDED exit, not an
+        # anomaly. Live 2026-09-29 08:43:40 (ses_f18850847): the model finally
+        # produced the prose exit and the unexpected_end_turn guardrail retried
+        # it with tool_choice=required, re-coercing the very loop the breaker
+        # exists to end. Both guardrails must yield on a suppressed turn.
+        monitor = proxy.SessionMonitor(context_window=262144)
+        monitor.suppress_text_tool_extraction = True
+        monitor.tool_turn_phase = "act"
+
+        # Prose end_turn + an active tool loop: exactly the shape the
+        # unexpected_end_turn guardrail would otherwise retry.
+        openai_resp = {
+            "choices": [
+                {
+                    "finish_reason": "stop",
+                    "message": {
+                        "content": "The query keeps failing; I need operator input.",
+                        "tool_calls": [],
+                    },
+                }
+            ]
+        }
+        # A garbled structured call: exactly the shape the malformed-tool
+        # guardrail would otherwise spend a retry prefill repairing -- on a
+        # turn where conversion drops the call anyway.
+        garbled_resp = {
+            "choices": [
+                {
+                    "finish_reason": "tool_calls",
+                    "message": {
+                        "content": "",
+                        "tool_calls": [
+                            {
+                                "id": "call_1",
+                                "type": "function",
+                                "function": {
+                                    "name": "Bash",
+                                    "arguments": '{"command": "ssh root@db psq',
+                                },
+                            }
+                        ],
+                    },
+                }
+            ]
+        }
+        openai_body = {
+            "model": "test",
+            "tool_choice": "auto",
+            "messages": [{"role": "user", "content": "continue"}],
+        }
+        anthropic_body = {
+            "tools": [{"name": "Bash", "input_schema": {"type": "object"}}],
+            "messages": [
+                {"role": "user", "content": "start"},
+                {
+                    "role": "assistant",
+                    "content": [
+                        {
+                            "type": "tool_use",
+                            "id": "toolu_1",
+                            "name": "Bash",
+                            "input": {"command": "pwd"},
+                        }
+                    ],
+                },
+                {
+                    "role": "user",
+                    "content": [
+                        {
+                            "type": "tool_result",
+                            "tool_use_id": "toolu_1",
+                            "content": "ok",
+                        }
+                    ],
+                },
+            ],
+        }
+        fake_client = _FakeClient([_FakeResponse({"choices": []})])
+        unexpected = asyncio.run(
+            proxy._apply_unexpected_end_turn_guardrail(
+                fake_client,
+                openai_resp,
+                openai_body,
+                anthropic_body,
+                monitor,
+                "session-stuck-break",
+            )
+        )
+        malformed = asyncio.run(
+            proxy._apply_malformed_tool_guardrail(
+                fake_client,
+                garbled_resp,
+                openai_body,
+                anthropic_body,
+                monitor,
+                "session-stuck-break",
+            )
+        )
+        self.assertEqual(unexpected, openai_resp)
+        self.assertEqual(malformed, garbled_resp)
+        self.assertEqual(
+            malformed["choices"][0]["message"]["tool_calls"][0]["function"]["arguments"],
+            '{"command": "ssh root@db psq',
+            "a suppressed turn must not repair a call it is about to drop",
+        )
+        self.assertEqual(len(fake_client.requests), 0)
+
     def test_unexpected_end_turn_guardrail_retries_review_auto_turn_in_active_loop(self):
         monitor = proxy.SessionMonitor(context_window=262144)
         monitor.tool_turn_phase = "review"

package/tools/agents/tests/test_stuck_break_hard.py

@@ -413,3 +413,80 @@ class TestSuppressedTurnIsBuffered(unittest.TestCase):
             self.skipTest("ambient proxy config already forces buffering here")
         self.assertFalse(proxy._should_buffer_turn(True, body, openai_body, self._monitor(False)))
         self.assertTrue(proxy._should_buffer_turn(True, body, openai_body, self._monitor(True)))
+
+
+class TestSuppressedStructuredToolCalls(unittest.TestCase):
+    """The STRUCTURED half of the hard break (live incident 2026-09-29 08:38).
+
+    The text-markup suppression scrubs tool calls written into the text body,
+    but the BACKEND can still parse the model's repeated markup into a
+    STRUCTURED tool_calls field on a tools-stripped turn -- observed on tabbyAPI
+    as finish=tool_calls with an EMPTY text body, re-served 30+ times at ~9
+    req/min. The conversion promoted each one straight back to tool_use, the
+    client re-executed the identical ssh call, and the loop ran for hours. On a
+    suppressed turn there are by construction no tools, so ANY structured call
+    is resurrection and must be dropped.
+    """
+
+    @staticmethod
+    def _resp(text="", finish="tool_calls"):
+        return {
+            "choices": [
+                {
+                    "finish_reason": finish,
+                    "message": {
+                        "role": "assistant",
+                        "content": text,
+                        "tool_calls": [
+                            {
+                                "id": "call_1",
+                                "type": "function",
+                                "function": {
+                                    "name": "bash",
+                                    "arguments": '{"command": "ssh root@db psql"}',
+                                },
+                            }
+                        ],
+                    },
+                }
+            ],
+            "usage": {"prompt_tokens": 100, "completion_tokens": 0},
+        }
+
+    @staticmethod
+    def _text(out):
+        return "".join(b.get("text") or "" for b in out.get("content") or [])
+
+    def test_resurrected_call_is_dropped_and_turn_is_a_prose_end_turn(self):
+        out = proxy.openai_to_anthropic_response(
+            self._resp(), "qwen", suppress_text_tool_extraction=True
+        )
+        self.assertEqual(out["stop_reason"], "end_turn")
+        types = [b.get("type") for b in out["content"]]
+        self.assertNotIn("tool_use", types, "a suppressed turn must not carry tool_use")
+
+    def test_empty_body_gets_fallback_prose_not_a_blank_reply(self):
+        # The live incident shape: text_len=0, everything in tool_calls.
+        out = proxy.openai_to_anthropic_response(
+            self._resp(text=""), "qwen", suppress_text_tool_extraction=True
+        )
+        joined = self._text(out)
+        self.assertIn("repeated the same tool call", joined)
+        self.assertNotIn("ssh root@db psql", joined, "dropped args must not leak")
+
+    def test_model_prose_is_kept_when_the_resurrected_call_is_dropped(self):
+        out = proxy.openai_to_anthropic_response(
+            self._resp(text="The query keeps failing; I need operator input."),
+            "qwen",
+            suppress_text_tool_extraction=True,
+        )
+        self.assertIn("The query keeps failing", self._text(out))
+
+    def test_normal_turns_still_promote_structured_calls(self):
+        # The suppression must not leak onto the normal path, where serving a
+        # structured call is the whole point of the conversion.
+        out = proxy.openai_to_anthropic_response(
+            self._resp(), "qwen", suppress_text_tool_extraction=False
+        )
+        self.assertEqual(out["stop_reason"], "tool_use")
+        self.assertTrue(any(b.get("type") == "tool_use" for b in out["content"]))