@miller-tech/uap 2.16.6 → 2.19.5

package/tools/agents/tests/test_anthropic_proxy_streaming.py

@@ -3540,6 +3540,177 @@ class TestToolStarvationBreaker(unittest.TestCase):
         result = proxy.build_openai_request(body, monitor)
         self.assertIn("tools", result)
 
+    def _make_body_with_fresh_user_text(self):
+        """A COMPLETED turn followed by a new user prompt: the last
+        assistant message is the previous turn's text summary (the honest
+        end-of-work case the 2026-10-04 false fires were made of), and the
+        latest user message is fresh text with n_msgs > 1."""
+        return {
+            "model": "qwen3.5",
+            "messages": [
+                {"role": "user", "content": "first task"},
+                {"role": "assistant", "content": [{"type": "text", "text": "## Summary of progress"}]},
+                {"role": "user", "content": "second task"},
+            ],
+            "tools": [{"name": "Bash", "input_schema": {"type": "object", "properties": {"command": {"type": "string"}}}}],
+        }
+
+    def test_fresh_user_text_resets_the_forcing_loop_counter(self):
+        """The 2026-10-04 live bug: a turn that ended with a legitimate text
+        summary under a forced act-phase left consecutive_forced_count at the
+        threshold, so the FIRST request of the NEXT user turn hit the
+        starvation breaker (count >= threshold AND last-assistant-text-only,
+        i.e. the PREVIOUS turn's summary) and had its tools stripped — firing
+        roughly once per user turn for hours. The forcing loop is per-TURN
+        state; a fresh user text must reset it."""
+        monitor = proxy.SessionMonitor()
+        monitor.consecutive_forced_count = proxy.PROXY_TOOL_STARVATION_THRESHOLD
+        body = self._make_body_with_fresh_user_text()
+        result = proxy.build_openai_request(body, monitor)
+        self.assertIn("tools", result)
+        self.assertEqual(monitor.tool_starvation_streak, 0)
+        # The stale threshold count was reset (the breaker never fired), and
+        # the NEW turn's own act-phase forcing started counting from 1 within
+        # this same request build — 1, not threshold+1, proves the reset.
+        self.assertLessEqual(monitor.consecutive_forced_count, 1)
+
+    def test_fresh_user_text_keeps_output_quality_streaks_sticky(self):
+        """Only the loop-progress counters reset on fresh user text. A new
+        user message is not evidence about the model's tool-call FORMATTING,
+        so the malformed/invalid/required-miss streaks stay sticky — a user
+        typing "go on" must not clear a model's record of emitting broken
+        tool calls."""
+        monitor = proxy.SessionMonitor()
+        monitor.consecutive_forced_count = proxy.PROXY_TOOL_STARVATION_THRESHOLD
+        monitor.malformed_tool_streak = 3
+        monitor.invalid_tool_call_streak = 2
+        monitor.required_tool_miss_streak = 4
+        body = self._make_body_with_fresh_user_text()
+        proxy.build_openai_request(body, monitor)
+        self.assertEqual(monitor.malformed_tool_streak, 3)
+        self.assertEqual(monitor.invalid_tool_call_streak, 2)
+        self.assertEqual(monitor.required_tool_miss_streak, 4)
+
+    def test_no_tool_results_conversation_resets_the_forcing_loop_counter(self):
+        """The second reset path of the 2026-10-04 fix: a conversation with
+        no tool results anywhere cannot be in a forcing loop, so the loop
+        counter must not carry in even when there is NO fresh user text to
+        trigger the fresh_user_text branch (here: the last user message is
+        empty, e.g. a pure non-text block). Before the fix the stale count
+        from the previous turn stripped tools on this request too."""
+        monitor = proxy.SessionMonitor()
+        monitor.consecutive_forced_count = proxy.PROXY_TOOL_STARVATION_THRESHOLD
+        body = self._make_body_with_tools()
+        # Overwrite the tail: no tool_result blocks anywhere (that is the
+        # fixture's default) and an EMPTY last user message, so neither
+        # fresh_user_text nor active_loop can fire.
+        body["messages"] = [
+            {"role": "user", "content": "first task"},
+            {"role": "assistant", "content": [{"type": "text", "text": "## Summary of progress"}]},
+            {"role": "user", "content": ""},
+        ]
+        result = proxy.build_openai_request(body, monitor)
+        self.assertIn("tools", result)
+        self.assertEqual(monitor.tool_starvation_streak, 0)
+        # Reset proven the same way as the fresh_user_text test: the stale
+        # threshold count is gone, and the at-most-1 remainder is this new
+        # request's own act-phase forcing counted within the same build —
+        # not the previous turn's streak surviving (that would be >= 5).
+        self.assertLessEqual(monitor.consecutive_forced_count, 1)
+
+    def test_fresh_user_text_keeps_an_active_dampener_cooldown(self):
+        """2026-10-04 follow-up classification: forced_auto_cooldown_turns
+        is deliberately STICKY across fresh user text. The dampener is a
+        remedy for a tool-output QUALITY collapse, and quality is
+        cross-turn evidence -- "keep going" is a mid-episode ack that must
+        not cut the recovery window short, and the dampener cannot re-arm
+        after a reset (activation needs consecutive_forced_count >=
+        min_forced). The cooldown clears only at a brand-new conversation
+        or the contamination hard reset."""
+        monitor = proxy.SessionMonitor()
+        monitor.forced_auto_cooldown_turns = 2
+        body = self._make_body_with_fresh_user_text()
+        proxy.build_openai_request(body, monitor)
+        # One auto turn may be consumed by the release path; what must NOT
+        # happen is the cooldown being zeroed by the fresh_user_text reset.
+        self.assertEqual(monitor.forced_auto_cooldown_turns, 1)
+
+    def test_fresh_user_text_resets_the_recon_exploration_streak(self):
+        """2026-10-04 follow-up: the recon exploration streak is PER-TASK
+        state. The previous task's read-forever streak is not evidence
+        about the NEW deliverable, and a stale streak fired the recon
+        convergence directive on the new task's first request. Genuine
+        recon loops stay within a turn (their resends carry tool_results
+        and never hit the fresh_user_text branch), so they keep counting."""
+        monitor = proxy.SessionMonitor()
+        monitor.consecutive_no_write_turns = max(1, proxy.PROXY_RECON_CONVERGENCE_THRESHOLD)
+        body = self._make_body_with_fresh_user_text()
+        proxy.build_openai_request(body, monitor)
+        self.assertEqual(monitor.consecutive_no_write_turns, 0)
+
+    def test_fresh_user_text_keeps_the_deferral_streak_sticky(self):
+        """The deliberate exception (see SessionMonitor.reset_forcing_loop's
+        docstring): the capitulation loop the deferral break exists for
+        SPANS user acks — model asks for more cycles, user says yes, model
+        asks again. A per-turn reset would make that breaker unreachable in
+        exactly its true-positive case, so the deferral streak carries."""
+        monitor = proxy.SessionMonitor()
+        monitor.deferral_streak = 2
+        body = self._make_body_with_fresh_user_text()
+        proxy.build_openai_request(body, monitor)
+        self.assertEqual(monitor.deferral_streak, 2)
+
+    def test_reset_forcing_loop_membership_is_exact(self):
+        """Pins the family membership at its policy point: the two per-turn
+        members reset, and everything with a different lifecycle (quality
+        streaks, dampener cooldown, deferral streak, session telemetry,
+        and the per-TASK recon streak — which is reset inline at the four
+        boundary sites, ack-gated, never here) is untouched by this method.
+        A future symmetry-cleanup that widens this method must update this
+        test and the docstring together."""
+        monitor = proxy.SessionMonitor()
+        monitor.consecutive_forced_count = 5
+        monitor.no_progress_streak = 3
+        monitor.forced_auto_cooldown_turns = 2
+        monitor.consecutive_no_write_turns = 7
+        monitor.malformed_tool_streak = 1
+        monitor.invalid_tool_call_streak = 1
+        monitor.required_tool_miss_streak = 1
+        monitor.deferral_streak = 4
+        monitor.tool_starvation_streak = 2
+        monitor.reset_forcing_loop()
+        self.assertEqual(monitor.consecutive_forced_count, 0)
+        self.assertEqual(monitor.no_progress_streak, 0)
+        self.assertEqual(monitor.forced_auto_cooldown_turns, 2)
+        self.assertEqual(monitor.consecutive_no_write_turns, 7)
+        self.assertEqual(monitor.malformed_tool_streak, 1)
+        self.assertEqual(monitor.invalid_tool_call_streak, 1)
+        self.assertEqual(monitor.required_tool_miss_streak, 1)
+        self.assertEqual(monitor.deferral_streak, 4)
+        self.assertEqual(monitor.tool_starvation_streak, 2)
+
+    def test_mid_task_ack_does_not_clear_the_recon_exploration_streak(self):
+        """The ack gate on the per-TASK recon reset (security review,
+        2026-10-04): "ok" is an ack continuing the SAME task, not new work
+        — without the gate, a model could end each threshold-1 turn
+        soliciting an ack and keep the convergence directive unreachable
+        forever. The existing _is_no_task_user_text classifier decides."""
+        monitor = proxy.SessionMonitor()
+        monitor.consecutive_no_write_turns = max(1, proxy.PROXY_RECON_CONVERGENCE_THRESHOLD)
+        body = self._make_body_with_fresh_user_text()
+        body["messages"][-1] = {"role": "user", "content": "ok"}
+        proxy.build_openai_request(body, monitor)
+        # The streak survived the ack (it did not reset to 0) AND kept
+        # counting — the previous assistant prose turn is itself a
+        # no-write turn (Fix B), so the count grows within this build.
+        # Either fact alone would pass; together they pin that the ack gate
+        # kept the counter live for the SAME task.
+        self.assertGreaterEqual(
+            monitor.consecutive_no_write_turns,
+            max(1, proxy.PROXY_RECON_CONVERGENCE_THRESHOLD),
+        )
+        self.assertNotEqual(monitor.consecutive_no_write_turns, 0)
+
 
 class TestPruningImprovements(unittest.TestCase):
     """Tests for pruning death spiral fixes."""

package/tools/agents/tests/test_gate_failclosed_plane_admin.py

@@ -0,0 +1,248 @@
+"""The plane-admin guard's failure must not read as consent.
+
+uap-policy-gate.sh is fail-SOFT by design: a broken or absent enforcer must not
+wedge every tool call in the session. That same fail-open makes "break the
+enforcer" a silent bypass of the control that enforcer implements -- the loop
+iterating active policies maps a missing enforcer file, and an enforcer that
+errors or emits unparseable output, to ALLOW for everything except the names
+must_fail_closed() says otherwise about.
+
+plane_admin_protect guards the plane-admin control surface: policy registration,
+the plane-admin rows the gate itself reads out of agents/data/memory/policies.db,
+and the .policy-tools/ enforcer copies the gate executes. That surface is mutable
+almost exclusively through the shell (`uap policy install/verify`, `sqlite3
+agents/data/memory/policies.db ...`, `rm -rf .policy-tools/...`), so a missing or
+errored plane-admin enforcer ON A SHELL CALL is a live bypass of the admin
+controls. It therefore arms the fail-closed net -- but only for shell-execution
+tools (SHELL_OP), for the same reason COMMIT_OP scopes schema_diff_gate to
+commit/push: arming it on every Edit would turn one broken enforcer into a
+blanket block on all work in the session.
+
+These tests assert the shipped copies of the hook carry that case, and EXECUTE
+the extracted shell logic rather than grep for it -- a comment merely mentioning
+plane_admin_protect must not satisfy them.
+"""
+
+from __future__ import annotations
+
+import subprocess
+import unittest
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parents[3]
+HOOK_NAME = "uap-policy-gate.sh"
+PRIMARY_HOOK = REPO / ".claude" / "hooks" / HOOK_NAME
+TEMPLATE_HOOK = REPO / "templates" / "hooks" / HOOK_NAME
+POLICY_NAME = "plane_admin_protect"
+
+SHELL_TOOLS = (
+    "Bash", "bash", "run_bash", "BashTool", "Shell", "shell", "Terminal",
+    "terminal", "execute_command", "run_command", "exec", "local_shell", "command",
+)
+NON_SHELL_TOOLS = ("Edit", "Write", "MultiEdit", "Read", "Task", "Grep")
+
+
+def hook_copies() -> list[Path]:
+    """Every copy of the hook this repo SHIPS (git-tracked files only).
+
+    Matched on the path RELATIVE to REPO, and limited to tracked files: `uap
+    hooks install` output (.uap/omp/, .codex/hooks/, .cursor/hooks/, ...) is
+    gitignored, so sweeping it fails on files no PR can commit -- and matching
+    the ABSOLUTE path excluded the whole tree whenever REPO was itself a
+    worktree, making the sweep pass by iterating nothing.
+    """
+    tracked = subprocess.run(
+        ["git", "ls-files", "--full-name", "*" + HOOK_NAME],
+        cwd=REPO, capture_output=True, text=True,
+    ).stdout.split()
+    return sorted(REPO / t for t in tracked if (REPO / t).is_file())
+
+
+def _extract(gate: str, start: str, end: str) -> str:
+    """Pull a verbatim region out of the hook so the test runs the real code."""
+    i = gate.index(start)
+    return gate[i:gate.index(end, i) + len(end)]
+
+
+def must_fail_closed_fn(gate: str) -> str:
+    return _extract(gate, "must_fail_closed() {", "\n}\n")
+
+
+def shell_op_block(gate: str) -> str:
+    """The hook's own tool-name -> SHELL_OP decision, verbatim."""
+    return _extract(gate, "SHELL_OP=0\n", "esac\n")
+
+
+def run_bash(script: str) -> subprocess.CompletedProcess:
+    return subprocess.run(["bash", "-c", script], capture_output=True,
+                          text=True, timeout=30)
+
+
+class GateCarriesThePlaneAdminCase(unittest.TestCase):
+    """The selector must name the enforcer, not just the two it already knew."""
+
+    def test_the_sweep_actually_finds_the_copies(self):
+        """An assertion about a collection is worthless without this one.
+
+        hook_copies() once returned [] inside a worktree and both drift sweeps
+        went green while checking nothing.
+        """
+        found = hook_copies()
+        self.assertGreaterEqual(
+            len(found), 2,
+            f"expected several hook copies under {REPO}, found {[str(p) for p in found]}",
+        )
+        self.assertIn(PRIMARY_HOOK, found)
+        self.assertIn(TEMPLATE_HOOK, found)
+
+    def test_every_shipped_copy_arms_plane_admin_protect(self):
+        for copy in hook_copies():
+            with self.subTest(copy=str(copy.relative_to(REPO))):
+                fn = must_fail_closed_fn(copy.read_text())
+                self.assertIn(
+                    POLICY_NAME, fn,
+                    f"{copy.relative_to(REPO)}: must_fail_closed() has no "
+                    f"{POLICY_NAME} case, so a broken plane-admin enforcer fails open",
+                )
+
+    def test_the_template_copy_is_not_the_stale_one(self):
+        """`uap worktree create` seeds new worktrees from templates/hooks/.
+
+        A fix applied only to .claude/hooks/ is silently reverted the next time
+        anyone starts a branch -- a documented failure mode in this repo.
+        """
+        self.assertTrue(TEMPLATE_HOOK.is_file(), "templates/hooks copy is missing")
+        self.assertIn(POLICY_NAME, must_fail_closed_fn(TEMPLATE_HOOK.read_text()))
+
+    def test_the_selector_body_agrees_across_copies(self):
+        primary = must_fail_closed_fn(PRIMARY_HOOK.read_text())
+        for copy in hook_copies():
+            with self.subTest(copy=str(copy.relative_to(REPO))):
+                self.assertEqual(
+                    must_fail_closed_fn(copy.read_text()), primary,
+                    f"{copy.relative_to(REPO)}: must_fail_closed() has drifted "
+                    "from .claude/hooks/",
+                )
+
+    def test_every_copy_still_parses(self):
+        for copy in hook_copies():
+            with self.subTest(copy=str(copy.relative_to(REPO))):
+                p = subprocess.run(["bash", "-n", str(copy)],
+                                   capture_output=True, text=True, timeout=30)
+                self.assertEqual(p.returncode, 0, p.stderr[:300])
+
+    def test_the_refusal_names_the_right_enforcer(self):
+        """A refusal that names the wrong guard is how a loop survives it.
+
+        Routing this through the generic self-protect wording told the operator
+        the self-protect enforcer had failed and pointed at a hatch that does
+        not re-arm this case.
+        """
+        fn = _extract(PRIMARY_HOOK.read_text(), "fail_closed() {", "\n}\n")
+        script = (
+            "set -euo pipefail\n"
+            'record_execution() { echo "RECORDED allowed=$1 policy=$2"; }\n'
+            + fn
+            + f'\nfail_closed "enforcer errored" "{POLICY_NAME}" || true\n'
+        )
+        p = run_bash(script)
+        self.assertIn("FAIL-CLOSED", p.stderr)
+        self.assertIn(POLICY_NAME, p.stderr)
+        self.assertIn("RECORDED allowed=0", p.stdout, "the block must leave a compliance row")
+        self.assertIn(f"policy={POLICY_NAME}", p.stdout, "the row must name the enforcer")
+
+
+class PlaneAdminArmsOnlyForShellExecution(unittest.TestCase):
+    """The scoping IS the design: shell tools only, and the hatch clears it."""
+
+    def verdict(self, policy: str, shell_op: str, sec: str = "0", commit: str = "0") -> bool:
+        script = (
+            "set -euo pipefail\n"
+            f'SEC_SENSITIVE="{sec}"\nCOMMIT_OP="{commit}"\nSHELL_OP="{shell_op}"\n'
+            + must_fail_closed_fn(PRIMARY_HOOK.read_text())
+            + f'\nif must_fail_closed "{policy}"; then echo CLOSED; else echo open; fi\n'
+        )
+        p = run_bash(script)
+        self.assertEqual(p.returncode, 0, f"set -e tripped the helper: {p.stderr[:200]}")
+        return p.stdout.strip() == "CLOSED"
+
+    def test_it_fails_closed_on_a_shell_call(self):
+        self.assertTrue(self.verdict(POLICY_NAME, "1"))
+
+    def test_it_fails_open_on_everything_else(self):
+        self.assertFalse(self.verdict(POLICY_NAME, "0"))
+
+    def test_the_hooks_own_tool_test_classifies_shell_tools(self):
+        gate = PRIMARY_HOOK.read_text()
+        for tool in SHELL_TOOLS:
+            with self.subTest(tool=tool):
+                script = ("set -euo pipefail\n" + f'TOOL="{tool}"\n' + shell_op_block(gate)
+                          + '\nif [[ "$SHELL_OP" == "1" ]]; then echo shell; else echo not-shell; fi\n')
+                p = run_bash(script)
+                self.assertEqual(p.returncode, 0, p.stderr[:200])
+                self.assertEqual(p.stdout.strip(), "shell",
+                                 f"{tool} must arm the plane-admin fail-closed net")
+
+    def test_the_hooks_own_tool_test_leaves_edit_and_write_open(self):
+        """Otherwise one broken enforcer blocks every edit in the session."""
+        gate = PRIMARY_HOOK.read_text()
+        for tool in NON_SHELL_TOOLS:
+            with self.subTest(tool=tool):
+                script = ("set -euo pipefail\n" + f'TOOL="{tool}"\n' + shell_op_block(gate)
+                          + '\nif [[ "$SHELL_OP" == "1" ]]; then echo shell; else echo not-shell; fi\n')
+                p = run_bash(script)
+                self.assertEqual(p.returncode, 0, p.stderr[:200])
+                self.assertEqual(p.stdout.strip(), "not-shell",
+                                 f"{tool} must NOT arm the plane-admin fail-closed net")
+
+    def test_the_operator_hatch_clears_this_arm_too(self):
+        """UAP_SELF_PROTECT_OFF is documented as clearing the whole net.
+
+        Leaving SHELL_OP armed made the override named in the refusal a no-op
+        for exactly the case that prints it.
+        """
+        gate = PRIMARY_HOOK.read_text()
+        script = (
+            "set -euo pipefail\n"
+            'TOOL="Bash"\nSHELL_OP=1\n'
+            + shell_op_block(gate)
+            + '\nexport UAP_SELF_PROTECT_OFF=1\n'
+            + '[[ "${UAP_SELF_PROTECT_OFF:-}" == "1" ]] && SHELL_OP=0\n'
+            + must_fail_closed_fn(gate)
+            + f'\nif must_fail_closed "{POLICY_NAME}"; then echo CLOSED; else echo open; fi\n'
+        )
+        p = run_bash(script)
+        self.assertEqual(p.returncode, 0, p.stderr[:300])
+        self.assertEqual(p.stdout.strip(), "open")
+
+    def test_the_other_two_arms_are_unchanged(self):
+        """Adding this case must not have repurposed the existing selectors."""
+        self.assertTrue(self.verdict("enforcement_self_protect", "0", sec="1"))
+        self.assertFalse(self.verdict("enforcement_self_protect", "1", sec="0"))
+        self.assertTrue(self.verdict("schema_diff_gate", "0", commit="1"))
+        self.assertFalse(self.verdict("schema_diff_gate", "1", commit="0"))
+
+    def test_an_unrelated_enforcer_still_fails_open(self):
+        """Widening this to every enforcer would be a session-wide deadlock."""
+        self.assertFalse(self.verdict("worktree_required", "1", sec="1", commit="1"))
+        self.assertFalse(self.verdict("delivery_enforcement", "1", sec="1", commit="1"))
+
+
+class MissingEnforcerFileIsCaught(unittest.TestCase):
+    """The call sites, not just the selector: a deleted enforcer must block."""
+
+    def test_the_loop_asks_the_selector_before_continuing(self):
+        gate = PRIMARY_HOOK.read_text()
+        i = gate.index("enforcer file missing")
+        self.assertIn("must_fail_closed", gate[max(0, i - 400):i],
+                      "a missing enforcer file must consult the selector, not just skip")
+
+    def test_an_errored_enforcer_is_caught(self):
+        gate = PRIMARY_HOOK.read_text()
+        i = gate.index('fail_closed "enforcer errored"')
+        self.assertIn("must_fail_closed", gate[max(0, i - 400):i],
+                      "allowed=2 (errored/unparseable) must consult the selector")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_plane_admin_protect.py

@@ -0,0 +1,124 @@
+"""Tests for plane-admin-protect: credential-mutation guard on the Plane stack.
+
+Covers the three things that make this enforcer trustworthy:
+  - it catches the observed incident spelling (docker exec ... changepassword)
+    and the bash -c wrapper,
+  - it does NOT refuse commands that merely NAME a credential verb in prose
+    (commit message, memory store, heredoc body) — the false positives that
+    make an agent route around a gate,
+  - the owner waiver fails CLOSED (exit 2, allowed=false) on expired / missing
+    expiry / unreadable, rather than crashing (exit 1) or silently allowing.
+"""
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+from datetime import date, timedelta
+from pathlib import Path
+
+ENF = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "plane_admin_protect.py"
+
+MUTATION = "docker exec plane-app-api-1 python manage.py changepassword admin@pay2u.com.au"
+
+
+def run(root, command, op="Bash"):
+    e = dict(os.environ)
+    e["UAP_REPO_ROOT"] = str(root)
+    p = subprocess.run(
+        [sys.executable, str(ENF), "--operation", op,
+         "--args", json.dumps({"command": command})],
+        capture_output=True, text=True, env=e,
+    )
+    out = json.loads(p.stdout) if p.stdout.strip() else {}
+    return p.returncode, out
+
+
+def write_waiver(root, days):
+    w = root / "policies" / "waivers" / "plane-admin-reset"
+    w.parent.mkdir(parents=True, exist_ok=True)
+    w.write_text(f"owner approved reset\nexpires: {(date.today() + timedelta(days=days)).isoformat()}\n")
+    return w
+
+
+class PlaneAdminProtectTest(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.root = Path(self._tmp.name)
+        self.addCleanup(self._tmp.cleanup)
+
+    def test_non_shell_operation_allowed(self):
+        rc, out = run(self.root, MUTATION, op="Edit")
+        self.assertEqual(rc, 0)
+        self.assertTrue(out["allowed"])
+
+    def test_observed_incident_blocked(self):
+        rc, out = run(self.root, MUTATION)
+        self.assertEqual(rc, 2)
+        self.assertFalse(out["allowed"])
+        self.assertIn("changepassword", out["reason"])
+        self.assertEqual(out.get("route"), "owner-waiver")
+        self.assertIn("waiverHint", out)
+
+    def test_bash_c_wrapped_mutation_blocked(self):
+        rc, out = run(self.root, 'bash -c "docker exec plane-app-api-1 manage.py set_password admin"')
+        self.assertEqual(rc, 2)
+        self.assertFalse(out["allowed"])
+
+    def test_read_only_plane_command_allowed(self):
+        rc, out = run(self.root, "kubectl logs plane-app-worker")
+        self.assertEqual(rc, 0)
+        self.assertTrue(out["allowed"])
+
+    def test_prose_naming_verb_not_blocked(self):
+        rc, out = run(self.root, 'git commit -m "refused to passwd /opt/plane admin"')
+        self.assertEqual(rc, 0)
+        self.assertTrue(out["allowed"])
+        rc, out = run(self.root, 'uap memory store "never set_password on plane-db"')
+        self.assertEqual(rc, 0)
+        self.assertTrue(out["allowed"])
+
+    def test_heredoc_body_naming_verb_not_blocked(self):
+        cmd = "python3 - <<PY\n# would createsuperuser on plane-db\nprint(1)\nPY"
+        rc, out = run(self.root, cmd)
+        self.assertEqual(rc, 0)
+        self.assertTrue(out["allowed"])
+
+    def test_valid_waiver_allows(self):
+        write_waiver(self.root, 3)
+        rc, out = run(self.root, MUTATION)
+        self.assertEqual(rc, 0)
+        self.assertTrue(out["allowed"])
+        self.assertIn("waiver valid until", out["reason"])
+
+    def test_expired_waiver_fails_closed(self):
+        write_waiver(self.root, -3)
+        rc, out = run(self.root, MUTATION)
+        self.assertEqual(rc, 2)
+        self.assertFalse(out["allowed"])
+        self.assertIn("expired", out["reason"])
+
+    def test_waiver_missing_expiry_fails_closed(self):
+        w = self.root / "policies" / "waivers" / "plane-admin-reset"
+        w.parent.mkdir(parents=True, exist_ok=True)
+        w.write_text("owner approved reset\n")
+        rc, out = run(self.root, MUTATION)
+        self.assertEqual(rc, 2)
+        self.assertFalse(out["allowed"])
+        self.assertIn("expires", out["reason"])
+
+    def test_unreadable_waiver_fails_closed_not_crash(self):
+        w = write_waiver(self.root, 3)
+        w.chmod(0)
+        try:
+            rc, out = run(self.root, MUTATION)
+        finally:
+            w.chmod(0o644)
+        self.assertEqual(rc, 2)
+        self.assertFalse(out["allowed"])
+        self.assertIn("could not be read", out["reason"])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_repeat_call_guard.py

@@ -226,3 +226,67 @@ class TestStreakSurvivesAFreshMonitor(unittest.TestCase):
                     [{"role": "assistant", "content": "plain text"}]):
             self.proxy._seed_tool_history_from_request(mon, bad)
         self.assertEqual(mon.tool_call_history, [])
+
+
+class TestDirectiveQuotesTheActualOutput(unittest.TestCase):
+    """Live 2026-09-29 (ses_f158cb463, qwen3.8): the advisory directive told the
+    model 'you already have that output' on a `uap memory query` returning "No
+    results" — and it was ignored 7 times, because a weak model does not
+    recognise an EMPTY result as an answer; it believes the missing value must
+    exist and keeps re-asking. The directive must SHOW the model the output it
+    keeps receiving, and say plainly that 'no results' IS the source's answer.
+    """
+
+    @classmethod
+    def setUpClass(cls):
+        cls.proxy = load_proxy()
+
+    NO_RESULTS = "No results in short-term memory\n\nNo results in long-term memory"
+
+    @staticmethod
+    def looping_monitor(proxy, snippet):
+        mon = proxy.SessionMonitor(context_window=100000)
+        for _ in range(4):
+            mon.record_tool_calls(tool_names=["Bash"], fingerprint="Bash|uap memory query x")
+        mon.last_tool_result_snippet = snippet
+        return mon
+
+    def inject(self, mon):
+        body = {"messages": [{"role": "system", "content": "base"}], "tool_choice": "required"}
+        self.proxy._maybe_inject_stuck_break(body, mon)
+        return body["messages"][0]["content"]
+
+    def test_the_directive_quotes_the_repeated_calls_actual_output(self):
+        text = self.inject(self.looping_monitor(self.proxy, self.NO_RESULTS))
+        self.assertIn("No results in short-term memory", text)
+        self.assertIn("returns EXACTLY this every time", text)
+        # The trap named in words, not just implied by the quote.
+        self.assertIn("'no results' output IS this source's final answer", text)
+
+    def test_a_long_result_is_bounded_in_the_directive(self):
+        text = self.inject(self.looping_monitor(self.proxy, "x" * 5000))
+        self.assertLess(len(text), 2000, "a huge tool result must not bloat the directive")
+
+    def test_a_missing_snippet_keeps_the_directive_valid(self):
+        # No tool_result seen (e.g. the repeat was in the request seeds only):
+        # the directive must still fire, unquoted, and not crash.
+        text = self.inject(self.looping_monitor(self.proxy, ""))
+        self.assertIn("SUCCEEDED each time", text)
+        self.assertIn("will not change", text)
+        self.assertNotIn("returns EXACTLY this", text)
+
+    def test_the_snippet_is_captured_from_the_latest_tool_result_of_the_request(self):
+        # The capture path: the most recent tool_result text in the
+        # conversation becomes the monitor snippet, so the NEXT turn's
+        # directive quotes what the repeated call actually returned.
+        mon = self.proxy.SessionMonitor(context_window=100000)
+        msgs = [{"role": "user", "content": "find the slug"}]
+        for i in range(2):
+            msgs.append({"role": "assistant", "content": [
+                {"type": "tool_use", "id": f"t{i}", "name": "Bash",
+                 "input": {"command": "uap memory query x"}}]})
+            msgs.append({"role": "user", "content": [
+                {"type": "tool_result", "tool_use_id": f"t{i}",
+                 "content": self.NO_RESULTS}]})
+        self.proxy._record_last_assistant_tool_calls({"messages": msgs}, mon)
+        self.assertIn("No results in short-term memory", mon.last_tool_result_snippet)