@miller-tech/uap 2.16.4 → 2.16.7

package/README.md

@@ -9,7 +9,7 @@
 [![Tests](https://img.shields.io/badge/tests-450%2B_suites-brightgreen)](#testing)
 [![License](https://img.shields.io/badge/license-MIT-black)](LICENSE)
 
-`v2.11.0` · 367 TypeScript modules across 26 subsystems · 459 vitest suites (+ a ~1,200-test Python enforcer/proxy suite) · 9 agent harnesses
+`v2.16.6` · 367 TypeScript modules across 26 subsystems · 459 vitest suites (+ a ~1,200-test Python enforcer/proxy suite) · 9 agent harnesses
 
 [Quickstart](#quickstart) · [Why UAP?](#why-uap) · [The delivery pipeline](docs/guides/DELIVERY_PIPELINE.md) · [`uap deliver`](#the-deliver-harness) · [Docs](docs/INDEX.md)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "2.16.4",
+  "version": "2.16.7",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/tools/agents/scripts/anthropic_proxy.py

@@ -2494,6 +2494,15 @@ class SessionMonitor:
     # back into a structured tool_use, which would continue the very loop the
     # breaker is ending. Reset to False at the start of every request.
     suppress_text_tool_extraction: bool = False
+    # Bounded snippet of the most recent tool_result text seen in the request.
+    # Feeds the STUCK-BREAK repeat-call directive so the model is SHOWN the
+    # unchanged output instead of only being told it "already has" it — live
+    # 2026-09-29, a model re-ran `uap memory query "plane workspace slug pay2u"`
+    # 7 times ignoring the directive, because a "No results" output is not an
+    # answer a weak model recognises as final; it believes the missing value
+    # must exist and keeps re-asking. Quoting the output makes the futility
+    # concrete. Refreshed on every request from the conversation.
+    last_tool_result_snippet: str = ""
     # Tool-turn count at which the TURN-COUNT FINALIZE BREAKER last fired. The
     # count is derived from the (only-growing) conversation, so without this the
     # breaker would re-fire on EVERY turn once the ceiling is first crossed —
@@ -7265,15 +7274,27 @@ def _maybe_inject_stuck_break(openai_body: dict, monitor: "SessionMonitor") -> N
     if reason.startswith(_REPEAT_CALL_REASON):
         # The call SUCCEEDS every time, so "stop retrying a failing action" and
         # the switch-channel advice would both be nonsense here. Name the real
-        # problem: the answer is already in hand and re-asking cannot change it.
+        # problem: the answer is already in hand and re-asking cannot change
+        # it. QUOTE the actual output — live 2026-09-29, "You already have that
+        # output" was ignored 7 times on a `uap memory query` returning "No
+        # results": the model does not recognise an empty result as an answer,
+        # so the directive must show it that the output IS the output.
+        snippet = (monitor.last_tool_result_snippet or "").strip()
+        quoted = (
+            f' It returns EXACTLY this every time: "{snippet[:300]}"' if snippet else ""
+        )
         directive = (
             "\n\nSTOP — you have issued the same tool call with the same "
             "arguments " + reason.rsplit("x", 1)[-1] + " times in a row. It "
             "SUCCEEDED each time and the result will not change by asking again. "
-            "You already have that output. Do NOT repeat it. Either take the "
-            "NEXT concrete action using what it told you, or — if you genuinely "
-            "cannot proceed — state the single blocking question in one sentence "
-            "and stop. Answer in plain text now if the work is done."
+            "You already have that output." + quoted + " Do NOT repeat it — "
+            "re-asking cannot produce new information, and an empty or "
+            "'no results' output IS this source's final answer. Either take the "
+            "NEXT concrete action using what it told you (proceeding WITHOUT "
+            "the missing information and stating your assumption if necessary), "
+            "or — if you genuinely cannot proceed — state the single blocking "
+            "question in one sentence and stop. Answer in plain text now if "
+            "the work is done."
         )
     else:
         directive = (
@@ -9093,6 +9114,9 @@ def _record_last_assistant_tool_calls(
                     _latest_err = any(_flags)
                 break
     monitor.note_tool_result_error(_latest_tr, _latest_err)
+    # Bounded raw snippet of the same result, for the STUCK-BREAK repeat-call
+    # directive (see SessionMonitor.last_tool_result_snippet).
+    monitor.last_tool_result_snippet = (_latest_tr or "")[:400]
     _seed_tool_history_from_request(monitor, messages)
     tool_fingerprints = []
     tool_targets: dict[str, str] = {}
@@ -11783,6 +11807,19 @@ async def _apply_unexpected_end_turn_guardrail(
         logger.info("GUARDRAIL: skipped unexpected_end_turn retry on finalize turn")
         return openai_resp
 
+    # A tools-stripped breaker turn (STUCK-BREAK HARD / finalize-adjacent) ends
+    # in prose BY DESIGN -- observed live 2026-09-29 08:43:40, the model finally
+    # produced the prose exit and this guardrail treated it as an anomaly and
+    # retried with tool_choice=required, re-coercing the very loop the breaker
+    # exists to end (and burning a full prefill to do it).
+    if monitor.suppress_text_tool_extraction:
+        logger.info(
+            "GUARDRAIL: skipped unexpected_end_turn retry on a tools-stripped "
+            "breaker turn -- the prose exit is the intended outcome, not an "
+            "anomaly to re-coerce"
+        )
+        return openai_resp
+
     if not _is_unexpected_end_turn(openai_resp, anthropic_body):
         return openai_resp
 
@@ -11877,6 +11914,15 @@ async def _apply_malformed_tool_guardrail(
             logger.info("GUARDRAIL: finalize turn clean, no tool call XML detected")
         return openai_resp
 
+    # A tools-stripped breaker turn drops whatever the backend resurrects at
+    # conversion time; repairing the resurrected call's arguments first would
+    # burn a retry prefill perfecting a call that is about to be discarded.
+    if monitor.suppress_text_tool_extraction:
+        logger.info(
+            "GUARDRAIL: skipped malformed-tool retry on a tools-stripped breaker turn"
+        )
+        return openai_resp
+
     working_resp = openai_resp
     repair_count = 0
     if PROXY_TOOL_ARGS_PREFLIGHT and _openai_has_tool_calls(openai_resp):
@@ -12922,6 +12968,41 @@ def openai_to_anthropic_response(
     message = choice.get("message", {})
     finish = choice.get("finish_reason", "stop")
 
+    # Structured resurrection on a tools-stripped turn. The text-markup
+    # suppression above only scrubs tool calls written into the TEXT body --
+    # but the BACKEND can still parse the model's repeated <tool_call> into a
+    # STRUCTURED tool_calls field even with an empty tools list (observed live
+    # 2026-09-29 08:38, tabbyAPI: finish=tool_calls, text_len=0, the identical
+    # ssh call re-served 30+ times at ~9 req/min; the client re-executed it
+    # each pass and the loop never ended). On a suppressed turn there are, by
+    # construction, no tools, so ANY structured call is resurrection: drop it,
+    # force the finish back to prose, and let the fallback below carry the
+    # reply when the model wrote nothing else.
+    if suppress_text_tool_extraction and message.get("tool_calls"):
+        dropped = message.pop("tool_calls") or []
+        if finish in ("tool_calls", "function_call"):
+            choice["finish_reason"] = "stop"
+            finish = "stop"
+        _suppressed_content = message.get("content")
+        if _suppressed_content is None or (
+            isinstance(_suppressed_content, str) and not _suppressed_content.strip()
+        ):
+            message["content"] = STUCK_BREAK_PROSE_FALLBACK
+        logger.warning(
+            "STUCK-BREAK HARD: suppressed STRUCTURED tool_calls from the backend on "
+            "a tools-stripped turn (%d call(s), e.g. %s) -- the turn now ends in "
+            "prose as intended",
+            len(dropped),
+            next(
+                (
+                    (c.get("function") or {}).get("name", "?")
+                    for c in dropped
+                    if isinstance(c, dict)
+                ),
+                "?",
+            ),
+        )
+
     content = []
     # Surface Qwen's <think>...</think> output as Anthropic-style thinking
     # blocks (Anthropic extended-thinking API shape:

package/tools/agents/tests/test_anthropic_proxy_streaming.py

@@ -1737,6 +1737,114 @@ class TestMalformedToolGuardrail(unittest.TestCase):
         self.assertEqual(malformed, openai_resp)
         self.assertEqual(len(fake_client.requests), 0)
 
+    def test_guardrails_skip_tools_stripped_breaker_turn(self):
+        # A STUCK-BREAK HARD turn ending in prose is the INTENDED exit, not an
+        # anomaly. Live 2026-09-29 08:43:40 (ses_f18850847): the model finally
+        # produced the prose exit and the unexpected_end_turn guardrail retried
+        # it with tool_choice=required, re-coercing the very loop the breaker
+        # exists to end. Both guardrails must yield on a suppressed turn.
+        monitor = proxy.SessionMonitor(context_window=262144)
+        monitor.suppress_text_tool_extraction = True
+        monitor.tool_turn_phase = "act"
+
+        # Prose end_turn + an active tool loop: exactly the shape the
+        # unexpected_end_turn guardrail would otherwise retry.
+        openai_resp = {
+            "choices": [
+                {
+                    "finish_reason": "stop",
+                    "message": {
+                        "content": "The query keeps failing; I need operator input.",
+                        "tool_calls": [],
+                    },
+                }
+            ]
+        }
+        # A garbled structured call: exactly the shape the malformed-tool
+        # guardrail would otherwise spend a retry prefill repairing -- on a
+        # turn where conversion drops the call anyway.
+        garbled_resp = {
+            "choices": [
+                {
+                    "finish_reason": "tool_calls",
+                    "message": {
+                        "content": "",
+                        "tool_calls": [
+                            {
+                                "id": "call_1",
+                                "type": "function",
+                                "function": {
+                                    "name": "Bash",
+                                    "arguments": '{"command": "ssh root@db psq',
+                                },
+                            }
+                        ],
+                    },
+                }
+            ]
+        }
+        openai_body = {
+            "model": "test",
+            "tool_choice": "auto",
+            "messages": [{"role": "user", "content": "continue"}],
+        }
+        anthropic_body = {
+            "tools": [{"name": "Bash", "input_schema": {"type": "object"}}],
+            "messages": [
+                {"role": "user", "content": "start"},
+                {
+                    "role": "assistant",
+                    "content": [
+                        {
+                            "type": "tool_use",
+                            "id": "toolu_1",
+                            "name": "Bash",
+                            "input": {"command": "pwd"},
+                        }
+                    ],
+                },
+                {
+                    "role": "user",
+                    "content": [
+                        {
+                            "type": "tool_result",
+                            "tool_use_id": "toolu_1",
+                            "content": "ok",
+                        }
+                    ],
+                },
+            ],
+        }
+        fake_client = _FakeClient([_FakeResponse({"choices": []})])
+        unexpected = asyncio.run(
+            proxy._apply_unexpected_end_turn_guardrail(
+                fake_client,
+                openai_resp,
+                openai_body,
+                anthropic_body,
+                monitor,
+                "session-stuck-break",
+            )
+        )
+        malformed = asyncio.run(
+            proxy._apply_malformed_tool_guardrail(
+                fake_client,
+                garbled_resp,
+                openai_body,
+                anthropic_body,
+                monitor,
+                "session-stuck-break",
+            )
+        )
+        self.assertEqual(unexpected, openai_resp)
+        self.assertEqual(malformed, garbled_resp)
+        self.assertEqual(
+            malformed["choices"][0]["message"]["tool_calls"][0]["function"]["arguments"],
+            '{"command": "ssh root@db psq',
+            "a suppressed turn must not repair a call it is about to drop",
+        )
+        self.assertEqual(len(fake_client.requests), 0)
+
     def test_unexpected_end_turn_guardrail_retries_review_auto_turn_in_active_loop(self):
         monitor = proxy.SessionMonitor(context_window=262144)
         monitor.tool_turn_phase = "review"

package/tools/agents/tests/test_repeat_call_guard.py

@@ -226,3 +226,67 @@ class TestStreakSurvivesAFreshMonitor(unittest.TestCase):
                     [{"role": "assistant", "content": "plain text"}]):
             self.proxy._seed_tool_history_from_request(mon, bad)
         self.assertEqual(mon.tool_call_history, [])
+
+
+class TestDirectiveQuotesTheActualOutput(unittest.TestCase):
+    """Live 2026-09-29 (ses_f158cb463, qwen3.8): the advisory directive told the
+    model 'you already have that output' on a `uap memory query` returning "No
+    results" — and it was ignored 7 times, because a weak model does not
+    recognise an EMPTY result as an answer; it believes the missing value must
+    exist and keeps re-asking. The directive must SHOW the model the output it
+    keeps receiving, and say plainly that 'no results' IS the source's answer.
+    """
+
+    @classmethod
+    def setUpClass(cls):
+        cls.proxy = load_proxy()
+
+    NO_RESULTS = "No results in short-term memory\n\nNo results in long-term memory"
+
+    @staticmethod
+    def looping_monitor(proxy, snippet):
+        mon = proxy.SessionMonitor(context_window=100000)
+        for _ in range(4):
+            mon.record_tool_calls(tool_names=["Bash"], fingerprint="Bash|uap memory query x")
+        mon.last_tool_result_snippet = snippet
+        return mon
+
+    def inject(self, mon):
+        body = {"messages": [{"role": "system", "content": "base"}], "tool_choice": "required"}
+        self.proxy._maybe_inject_stuck_break(body, mon)
+        return body["messages"][0]["content"]
+
+    def test_the_directive_quotes_the_repeated_calls_actual_output(self):
+        text = self.inject(self.looping_monitor(self.proxy, self.NO_RESULTS))
+        self.assertIn("No results in short-term memory", text)
+        self.assertIn("returns EXACTLY this every time", text)
+        # The trap named in words, not just implied by the quote.
+        self.assertIn("'no results' output IS this source's final answer", text)
+
+    def test_a_long_result_is_bounded_in_the_directive(self):
+        text = self.inject(self.looping_monitor(self.proxy, "x" * 5000))
+        self.assertLess(len(text), 2000, "a huge tool result must not bloat the directive")
+
+    def test_a_missing_snippet_keeps_the_directive_valid(self):
+        # No tool_result seen (e.g. the repeat was in the request seeds only):
+        # the directive must still fire, unquoted, and not crash.
+        text = self.inject(self.looping_monitor(self.proxy, ""))
+        self.assertIn("SUCCEEDED each time", text)
+        self.assertIn("will not change", text)
+        self.assertNotIn("returns EXACTLY this", text)
+
+    def test_the_snippet_is_captured_from_the_latest_tool_result_of_the_request(self):
+        # The capture path: the most recent tool_result text in the
+        # conversation becomes the monitor snippet, so the NEXT turn's
+        # directive quotes what the repeated call actually returned.
+        mon = self.proxy.SessionMonitor(context_window=100000)
+        msgs = [{"role": "user", "content": "find the slug"}]
+        for i in range(2):
+            msgs.append({"role": "assistant", "content": [
+                {"type": "tool_use", "id": f"t{i}", "name": "Bash",
+                 "input": {"command": "uap memory query x"}}]})
+            msgs.append({"role": "user", "content": [
+                {"type": "tool_result", "tool_use_id": f"t{i}",
+                 "content": self.NO_RESULTS}]})
+        self.proxy._record_last_assistant_tool_calls({"messages": msgs}, mon)
+        self.assertIn("No results in short-term memory", mon.last_tool_result_snippet)

package/tools/agents/tests/test_stuck_break_hard.py

@@ -413,3 +413,80 @@ class TestSuppressedTurnIsBuffered(unittest.TestCase):
             self.skipTest("ambient proxy config already forces buffering here")
         self.assertFalse(proxy._should_buffer_turn(True, body, openai_body, self._monitor(False)))
         self.assertTrue(proxy._should_buffer_turn(True, body, openai_body, self._monitor(True)))
+
+
+class TestSuppressedStructuredToolCalls(unittest.TestCase):
+    """The STRUCTURED half of the hard break (live incident 2026-09-29 08:38).
+
+    The text-markup suppression scrubs tool calls written into the text body,
+    but the BACKEND can still parse the model's repeated markup into a
+    STRUCTURED tool_calls field on a tools-stripped turn -- observed on tabbyAPI
+    as finish=tool_calls with an EMPTY text body, re-served 30+ times at ~9
+    req/min. The conversion promoted each one straight back to tool_use, the
+    client re-executed the identical ssh call, and the loop ran for hours. On a
+    suppressed turn there are by construction no tools, so ANY structured call
+    is resurrection and must be dropped.
+    """
+
+    @staticmethod
+    def _resp(text="", finish="tool_calls"):
+        return {
+            "choices": [
+                {
+                    "finish_reason": finish,
+                    "message": {
+                        "role": "assistant",
+                        "content": text,
+                        "tool_calls": [
+                            {
+                                "id": "call_1",
+                                "type": "function",
+                                "function": {
+                                    "name": "bash",
+                                    "arguments": '{"command": "ssh root@db psql"}',
+                                },
+                            }
+                        ],
+                    },
+                }
+            ],
+            "usage": {"prompt_tokens": 100, "completion_tokens": 0},
+        }
+
+    @staticmethod
+    def _text(out):
+        return "".join(b.get("text") or "" for b in out.get("content") or [])
+
+    def test_resurrected_call_is_dropped_and_turn_is_a_prose_end_turn(self):
+        out = proxy.openai_to_anthropic_response(
+            self._resp(), "qwen", suppress_text_tool_extraction=True
+        )
+        self.assertEqual(out["stop_reason"], "end_turn")
+        types = [b.get("type") for b in out["content"]]
+        self.assertNotIn("tool_use", types, "a suppressed turn must not carry tool_use")
+
+    def test_empty_body_gets_fallback_prose_not_a_blank_reply(self):
+        # The live incident shape: text_len=0, everything in tool_calls.
+        out = proxy.openai_to_anthropic_response(
+            self._resp(text=""), "qwen", suppress_text_tool_extraction=True
+        )
+        joined = self._text(out)
+        self.assertIn("repeated the same tool call", joined)
+        self.assertNotIn("ssh root@db psql", joined, "dropped args must not leak")
+
+    def test_model_prose_is_kept_when_the_resurrected_call_is_dropped(self):
+        out = proxy.openai_to_anthropic_response(
+            self._resp(text="The query keeps failing; I need operator input."),
+            "qwen",
+            suppress_text_tool_extraction=True,
+        )
+        self.assertIn("The query keeps failing", self._text(out))
+
+    def test_normal_turns_still_promote_structured_calls(self):
+        # The suppression must not leak onto the normal path, where serving a
+        # structured call is the whole point of the conversion.
+        out = proxy.openai_to_anthropic_response(
+            self._resp(), "qwen", suppress_text_tool_extraction=False
+        )
+        self.assertEqual(out["stop_reason"], "tool_use")
+        self.assertTrue(any(b.get("type") == "tool_use" for b in out["content"]))