@miller-tech/uap 2.16.7 → 2.20.0

package/tools/agents/tests/test_ollama_compat.py

@@ -0,0 +1,320 @@
+#!/usr/bin/env python3
+"""Ollama-compatible surface (/api/*) on PROXY_OLLAMA_PORT.
+
+The surface is a pure translation layer over the same guarded pipeline the
+Anthropic and OpenAI inbounds use, so what needs pinning here is exactly the
+translation: Ollama request fields -> OpenAI request fields, and OpenAI
+response -> Ollama wire shapes (single JSON, and the two-line NDJSON stream
+a stream-mode client waits on). Conversion helpers are exercised in
+isolation per this suite's convention — the guarded core they call is the
+same messages() pipeline the rest of the suite already covers.
+
+The lifecycle machinery (companion listener) matters just as much: a second
+uvicorn server must not install its own signal handlers (SIGTERM would land
+on whichever registered last and leave the other port hanging on systemd
+stops), and the app's startup handlers must not run twice.
+"""
+
+import asyncio
+import importlib.util
+import json
+import socket
+import time
+import unittest
+from pathlib import Path
+
+
+def _load():
+    p = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+    spec = importlib.util.spec_from_file_location("anthropic_proxy", p)
+    m = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(m)
+    return m
+
+
+proxy = _load()
+
+
+class TestOllamaChatRequestConversion(unittest.TestCase):
+    def test_messages_options_tools_and_model_default(self):
+        body = {
+            "model": "qwen3.8-flash-next-iq3_xxs",
+            "messages": [
+                {"role": "system", "content": "be terse"},
+                {"role": "user", "content": "hi"},
+            ],
+            "stream": True,
+            "tools": [{"type": "function", "function": {"name": "f"}}],
+            "options": {
+                "temperature": 0.2,
+                "top_k": 40,
+                "num_predict": 512,
+                "num_ctx": 999999,  # must be dropped: rail owns context sizing
+                "min_p": 0.05,  # must be dropped: not forwarded by the 2nd hop
+                "stop": "END",
+            },
+        }
+        out = proxy.ollama_chat_to_openai_request(body)
+        self.assertEqual(
+            out["messages"],
+            [
+                {"role": "system", "content": "be terse"},
+                {"role": "user", "content": "hi"},
+            ],
+        )
+        self.assertEqual(out["model"], "qwen3.8-flash-next-iq3_xxs")
+        self.assertEqual(out["temperature"], 0.2)
+        self.assertEqual(out["top_k"], 40)
+        self.assertEqual(out["max_tokens"], 512)
+        self.assertEqual(out["stop"], ["END"])
+        # drops happen at the boundary, not silently mid-pipeline
+        for dropped in ("num_ctx", "min_p", "repeat_penalty", "seed"):
+            self.assertNotIn(dropped, json.dumps(out))
+        self.assertEqual(out["tool_choice"], "auto")
+        # buffered through the guardrails: always non-stream internally
+        self.assertFalse(out["stream"])
+
+    def test_content_parts_and_unknown_role(self):
+        body = {
+            "model": "m",
+            "messages": [
+                {"role": "supervisor", "content": [{"type": "text", "text": "part1"},
+                                                   {"type": "image", "text": "drop"}]},
+                {"role": "user", "content": [{"type": "text", "text": "part2"}]},
+            ],
+        }
+        out = proxy.ollama_chat_to_openai_request(body)
+        self.assertEqual(out["messages"][0], {"role": "user", "content": "part1"})
+        self.assertEqual(out["messages"][1], {"role": "user", "content": "part2"})
+
+    def test_assistant_tool_calls_replay_object_args_to_string(self):
+        body = {
+            "model": "m",
+            "messages": [
+                {"role": "assistant", "content": "",
+                 "tool_calls": [{"function": {"name": "bash",
+                                              "arguments": {"command": "ls"}}}]},
+                {"role": "tool", "content": "file_a\nfile_b"},
+                {"role": "user", "content": "thanks"},
+            ],
+        }
+        out = proxy.ollama_chat_to_openai_request(body)
+        entry = out["messages"][0]
+        self.assertEqual(entry["tool_calls"][0]["function"]["name"], "bash")
+        # OpenAI carries arguments as a JSON string
+        self.assertEqual(
+            json.loads(entry["tool_calls"][0]["function"]["arguments"]),
+            {"command": "ls"},
+        )
+        # Deterministic ids pair the replayed call with its tool result:
+        # Ollama associates by order, the Anthropic hop pairs by id.
+        call_id = entry["tool_calls"][0]["id"]
+        self.assertTrue(call_id)
+        self.assertEqual(out["messages"][1]["tool_call_id"], call_id)
+        self.assertEqual(out["messages"][2], {"role": "user", "content": "thanks"})
+
+    def test_format_field_is_accepted_and_dropped(self):
+        # response_format does not survive the second translation hop; the
+        # drop happens at the boundary instead of silently mid-pipeline.
+        out = proxy.ollama_chat_to_openai_request(
+            {"model": "m", "messages": [], "format": "json"}
+        )
+        self.assertNotIn("response_format", out)
+
+
+class TestOllamaGenerateRequestConversion(unittest.TestCase):
+    def test_system_then_prompt_order(self):
+        out = proxy.ollama_generate_to_openai_request(
+            {"model": "m", "prompt": "write", "system": "you are terse"}
+        )
+        self.assertEqual(
+            out["messages"],
+            [
+                {"role": "system", "content": "you are terse"},
+                {"role": "user", "content": "write"},
+            ],
+        )
+
+    def test_prompt_only_and_missing_prompt(self):
+        out = proxy.ollama_generate_to_openai_request({"model": "m"})
+        self.assertEqual(out["messages"], [{"role": "user", "content": ""}])
+
+
+class TestOllamaResponseConversion(unittest.TestCase):
+    OPENAI = {
+        "id": "x",
+        "model": "resolved-id",
+        "choices": [
+            {
+                "index": 0,
+                "message": {
+                    "role": "assistant",
+                    "content": "hello",
+                    "tool_calls": [
+                        {"function": {"name": "bash",
+                                      "arguments": "{\"command\": \"ls\"}"}}
+                    ],
+                },
+                "finish_reason": "tool_calls",
+            }
+        ],
+        "usage": {"prompt_tokens": 11, "completion_tokens": 7},
+    }
+
+    def test_chat_response_shape_and_tool_args_object(self):
+        resp = proxy.openai_to_ollama_chat_response(self.OPENAI, "asked-id", 123)
+        self.assertEqual(resp["model"], "asked-id")  # echo the REQUESTED id
+        self.assertTrue(resp["done"])
+        self.assertEqual(resp["done_reason"], "stop")  # only "length" is special
+        self.assertEqual(resp["message"]["content"], "hello")
+        self.assertEqual(
+            resp["message"]["tool_calls"][0]["function"]["arguments"],
+            {"command": "ls"},  # Ollama carries arguments as an object
+        )
+        self.assertEqual(resp["prompt_eval_count"], 11)
+        self.assertEqual(resp["eval_count"], 7)
+        self.assertEqual(resp["total_duration"], 123)
+
+    def test_chat_response_unparseable_args_stay_string(self):
+        openai = {
+            "choices": [{"message": {"role": "assistant", "content": "",
+                                     "tool_calls": [{"function": {
+                                         "name": "f", "arguments": "{oops"}}]},
+                          "finish_reason": "tool_calls"}],
+            "usage": {},
+        }
+        resp = proxy.openai_to_ollama_chat_response(openai, "m", 0)
+        self.assertEqual(resp["message"]["tool_calls"][0]["function"]["arguments"],
+                         "{oops")
+
+    def test_chat_response_length_done_reason(self):
+        openai = {
+            "choices": [{"message": {"role": "assistant", "content": "x"},
+                         "finish_reason": "length"}],
+            "usage": {},
+        }
+        resp = proxy.openai_to_ollama_chat_response(openai, "m", 0)
+        self.assertEqual(resp["done_reason"], "length")
+
+    def test_generate_response_and_tool_calls_as_text(self):
+        resp = proxy.openai_to_ollama_generate_response(self.OPENAI, "asked-id", 5)
+        self.assertTrue(resp["response"].startswith("hello"))
+        self.assertIn('"tool_calls"', resp["response"])  # not silently dropped
+        self.assertEqual(resp["eval_count"], 7)
+        self.assertTrue(resp["done"])
+
+    def test_ndjson_stream_two_lines_done_last(self):
+        resp = proxy.openai_to_ollama_chat_response(self.OPENAI, "m", 1)
+        out = asyncio.run(_collect(proxy._emit_ollama_ndjson(
+            resp, {"message": resp["message"]})))
+        lines = [json.loads(l) for l in out.splitlines()]
+        self.assertEqual(len(lines), 2)
+        self.assertFalse(lines[0]["done"])
+        self.assertEqual(lines[0]["message"]["content"], "hello")
+        self.assertTrue(lines[-1]["done"])
+        # final line carries the payload key EMPTY — concatenating content
+        # across lines must yield it exactly once
+        self.assertEqual(lines[-1]["message"], {"role": "assistant", "content": ""})
+        self.assertEqual(
+            lines[0]["message"]["content"] + lines[-1]["message"]["content"], "hello"
+        )
+        self.assertEqual(lines[-1]["eval_count"], 7)
+
+    def test_ndjson_stream_generate_empties_response_key(self):
+        resp = proxy.openai_to_ollama_generate_response(
+            {"choices": [{"message": {"role": "assistant", "content": "hi"},
+                          "finish_reason": "stop"}], "usage": {}}, "m", 1)
+        out = asyncio.run(_collect(proxy._emit_ollama_ndjson(
+            resp, {"response": resp["response"]})))
+        lines = [json.loads(l) for l in out.splitlines()]
+        self.assertEqual(lines[0]["response"], "hi")
+        self.assertEqual(lines[-1]["response"], "")
+        self.assertTrue(lines[-1]["done"])
+
+
+class TestOllamaModelCardHelpers(unittest.TestCase):
+    def test_quantization_and_family_from_model_id(self):
+        mid = "qwen3.8-flash-next-iq3_xxs"
+        self.assertEqual(proxy._ollama_quantization_level(mid), "IQ3_XXS")
+        self.assertEqual(proxy._ollama_family(mid), "qwen3")
+        self.assertEqual(proxy._ollama_family("llama3:8b"), "llama3")
+        self.assertEqual(proxy._ollama_quantization_level("plain"), "")
+
+    def test_digest_is_stable_and_prefixed_hex(self):
+        d1 = proxy._ollama_digest("m")
+        d2 = proxy._ollama_digest("m")
+        self.assertEqual(d1, d2)
+        self.assertTrue(d1.startswith("sha256:"))  # some clients parse on the colon
+        int(d1[7:], 16)  # hex
+        self.assertEqual(len(d1), 71)
+
+    def test_details_shape(self):
+        d = proxy._ollama_details("qwen3.8-flash-next-iq3_xxs")
+        self.assertEqual(d["format"], "gguf")
+        self.assertEqual(d["family"], d["families"][0])
+        self.assertEqual(d["quantization_level"], "IQ3_XXS")
+
+
+class TestOllamaModelMeta(unittest.IsolatedAsyncioTestCase):
+    async def test_meta_placeholders_when_no_upstream(self):
+        meta = await proxy._ollama_model_meta("some-model")
+        self.assertEqual(meta, {"modified_at": proxy._OLLAMA_START_ISO, "size": 0})
+
+    async def test_meta_served_from_cache(self):
+        # These are discovery endpoints (some unauthenticated) — the meta
+        # probe must not hit the upstream once per request.
+        proxy._OLLAMA_META_CACHE.clear()
+        proxy._OLLAMA_META_CACHE["m"] = (
+            time.monotonic(), {"modified_at": "FRESH", "size": 2}
+        )
+        try:
+            self.assertEqual(
+                await proxy._ollama_model_meta("m"), {"modified_at": "FRESH", "size": 2}
+            )
+        finally:
+            proxy._OLLAMA_META_CACHE.clear()
+
+
+class TestCompanionListenerLifecycle(unittest.TestCase):
+    def test_capture_signals_is_a_noop(self):
+        # A second uvicorn server installing signal handlers would hand
+        # SIGTERM to whichever registered last. The companion must not
+        # register any.
+        import signal
+
+        companion = proxy._CompanionListener.__new__(proxy._CompanionListener)
+        before = signal.getsignal(signal.SIGTERM)
+        with companion.capture_signals():
+            during = signal.getsignal(signal.SIGTERM)
+        after = signal.getsignal(signal.SIGTERM)
+        self.assertIs(before, during)
+        self.assertIs(before, after)
+
+    def test_port_bindable_detects_occupied_port(self):
+        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+            s.bind(("127.0.0.1", 0))
+            s.listen(1)
+            busy_port = s.getsockname()[1]
+            self.assertFalse(proxy._ollama_port_bindable("127.0.0.1", busy_port))
+        # same port free after close
+        self.assertTrue(proxy._ollama_port_bindable("127.0.0.1", busy_port))
+
+    def test_port_bindable_free_port(self):
+        self.assertTrue(proxy._ollama_port_bindable("127.0.0.1", 0))
+        # port 0: bind with port 0 means "pick one" — always bindable; the
+        # function is only called with real ports, but must not raise.
+
+    def test_ollama_port_env_default_and_disable(self):
+        # module-level default (11434) was set at import
+        self.assertEqual(proxy.PROXY_OLLAMA_PORT, 11434)
+
+
+async def _collect(agen):
+    parts = []
+    async for chunk in agen:
+        parts.append(chunk.decode() if isinstance(chunk, bytes) else chunk)
+    return "".join(parts)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_plane_admin_protect.py

@@ -0,0 +1,124 @@
+"""Tests for plane-admin-protect: credential-mutation guard on the Plane stack.
+
+Covers the three things that make this enforcer trustworthy:
+  - it catches the observed incident spelling (docker exec ... changepassword)
+    and the bash -c wrapper,
+  - it does NOT refuse commands that merely NAME a credential verb in prose
+    (commit message, memory store, heredoc body) — the false positives that
+    make an agent route around a gate,
+  - the owner waiver fails CLOSED (exit 2, allowed=false) on expired / missing
+    expiry / unreadable, rather than crashing (exit 1) or silently allowing.
+"""
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+from datetime import date, timedelta
+from pathlib import Path
+
+ENF = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "plane_admin_protect.py"
+
+MUTATION = "docker exec plane-app-api-1 python manage.py changepassword admin@pay2u.com.au"
+
+
+def run(root, command, op="Bash"):
+    e = dict(os.environ)
+    e["UAP_REPO_ROOT"] = str(root)
+    p = subprocess.run(
+        [sys.executable, str(ENF), "--operation", op,
+         "--args", json.dumps({"command": command})],
+        capture_output=True, text=True, env=e,
+    )
+    out = json.loads(p.stdout) if p.stdout.strip() else {}
+    return p.returncode, out
+
+
+def write_waiver(root, days):
+    w = root / "policies" / "waivers" / "plane-admin-reset"
+    w.parent.mkdir(parents=True, exist_ok=True)
+    w.write_text(f"owner approved reset\nexpires: {(date.today() + timedelta(days=days)).isoformat()}\n")
+    return w
+
+
+class PlaneAdminProtectTest(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.root = Path(self._tmp.name)
+        self.addCleanup(self._tmp.cleanup)
+
+    def test_non_shell_operation_allowed(self):
+        rc, out = run(self.root, MUTATION, op="Edit")
+        self.assertEqual(rc, 0)
+        self.assertTrue(out["allowed"])
+
+    def test_observed_incident_blocked(self):
+        rc, out = run(self.root, MUTATION)
+        self.assertEqual(rc, 2)
+        self.assertFalse(out["allowed"])
+        self.assertIn("changepassword", out["reason"])
+        self.assertEqual(out.get("route"), "owner-waiver")
+        self.assertIn("waiverHint", out)
+
+    def test_bash_c_wrapped_mutation_blocked(self):
+        rc, out = run(self.root, 'bash -c "docker exec plane-app-api-1 manage.py set_password admin"')
+        self.assertEqual(rc, 2)
+        self.assertFalse(out["allowed"])
+
+    def test_read_only_plane_command_allowed(self):
+        rc, out = run(self.root, "kubectl logs plane-app-worker")
+        self.assertEqual(rc, 0)
+        self.assertTrue(out["allowed"])
+
+    def test_prose_naming_verb_not_blocked(self):
+        rc, out = run(self.root, 'git commit -m "refused to passwd /opt/plane admin"')
+        self.assertEqual(rc, 0)
+        self.assertTrue(out["allowed"])
+        rc, out = run(self.root, 'uap memory store "never set_password on plane-db"')
+        self.assertEqual(rc, 0)
+        self.assertTrue(out["allowed"])
+
+    def test_heredoc_body_naming_verb_not_blocked(self):
+        cmd = "python3 - <<PY\n# would createsuperuser on plane-db\nprint(1)\nPY"
+        rc, out = run(self.root, cmd)
+        self.assertEqual(rc, 0)
+        self.assertTrue(out["allowed"])
+
+    def test_valid_waiver_allows(self):
+        write_waiver(self.root, 3)
+        rc, out = run(self.root, MUTATION)
+        self.assertEqual(rc, 0)
+        self.assertTrue(out["allowed"])
+        self.assertIn("waiver valid until", out["reason"])
+
+    def test_expired_waiver_fails_closed(self):
+        write_waiver(self.root, -3)
+        rc, out = run(self.root, MUTATION)
+        self.assertEqual(rc, 2)
+        self.assertFalse(out["allowed"])
+        self.assertIn("expired", out["reason"])
+
+    def test_waiver_missing_expiry_fails_closed(self):
+        w = self.root / "policies" / "waivers" / "plane-admin-reset"
+        w.parent.mkdir(parents=True, exist_ok=True)
+        w.write_text("owner approved reset\n")
+        rc, out = run(self.root, MUTATION)
+        self.assertEqual(rc, 2)
+        self.assertFalse(out["allowed"])
+        self.assertIn("expires", out["reason"])
+
+    def test_unreadable_waiver_fails_closed_not_crash(self):
+        w = write_waiver(self.root, 3)
+        w.chmod(0)
+        try:
+            rc, out = run(self.root, MUTATION)
+        finally:
+            w.chmod(0o644)
+        self.assertEqual(rc, 2)
+        self.assertFalse(out["allowed"])
+        self.assertIn("could not be read", out["reason"])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_stream_heartbeat.py

@@ -107,5 +107,82 @@ class TestStreamHeartbeat(unittest.TestCase):
         self.assertIn("kaboom", out)
 
 
+class TestGuardedWaitProgressLog(unittest.TestCase):
+    """Journal progress during the buffered wait (2026-10-04 incident).
+
+    A no-tool streaming turn served via the guarded path can buffer for
+    minutes (live: an 11,099-token client-compaction summary over 281 s) with
+    the journal silent from REQ to RESP — the proxy read as hung and the only
+    evidence was the RESP timestamp. `_heartbeat_then_buffered` now logs one
+    INFO line per PROXY_GUARDED_WAIT_LOG_SECS of waiting so a long buffered
+    generation is legible while it happens.
+    """
+
+    def setUp(self):
+        self._hb = proxy.PROXY_STREAM_HEARTBEAT_SECS
+        self._log_secs = proxy.PROXY_GUARDED_WAIT_LOG_SECS
+        proxy.PROXY_STREAM_HEARTBEAT_SECS = 0.05
+        proxy.PROXY_GUARDED_WAIT_LOG_SECS = 0.06
+
+    def tearDown(self):
+        proxy.PROXY_STREAM_HEARTBEAT_SECS = self._hb
+        proxy.PROXY_GUARDED_WAIT_LOG_SECS = self._log_secs
+
+    @staticmethod
+    def _response():
+        return {
+            "id": "msg_z",
+            "model": "m",
+            "content": [{"type": "text", "text": "done"}],
+            "stop_reason": "end_turn",
+            "usage": {"output_tokens": 1},
+        }
+
+    def test_slow_produce_logs_wait_progress(self):
+        async def produce():
+            await asyncio.sleep(0.2)  # > 2 log boundaries at 0.06s
+            return self._response()
+
+        with self.assertLogs("uap.anthropic_proxy", level="INFO") as cm:
+            out = "".join(asyncio.run(_collect(produce())))
+        self.assertIn("done", out)  # stream still completes normally
+        wait_logs = [l for l in cm.output if "GUARDED-BUFFER WAIT" in l]
+        self.assertGreaterEqual(len(wait_logs), 2)
+        self.assertIn("still generating after", wait_logs[0])
+        self.assertIn("test-model", wait_logs[0])
+
+    def test_progress_logs_once_per_boundary_not_per_heartbeat(self):
+        async def produce():
+            await asyncio.sleep(0.22)  # ~4 heartbeats, ~3 boundaries
+            return self._response()
+
+        with self.assertLogs("uap.anthropic_proxy", level="INFO") as cm:
+            asyncio.run(_collect(produce()))
+        wait_logs = [l for l in cm.output if "GUARDED-BUFFER WAIT" in l]
+        # 0.22s of waiting at 0.06s boundaries: 2-4 lines, one per boundary
+        # crossed — NOT one per 0.05s heartbeat.
+        self.assertGreaterEqual(len(wait_logs), 2)
+        self.assertLessEqual(len(wait_logs), 4)
+
+    def test_fast_produce_logs_no_wait_progress(self):
+        async def produce():
+            return self._response()
+
+        with self.assertNoLogs("uap.anthropic_proxy", level="INFO"):
+            out = "".join(asyncio.run(_collect(produce())))
+        self.assertIn("done", out)
+
+    def test_wait_progress_log_disabled(self):
+        proxy.PROXY_GUARDED_WAIT_LOG_SECS = 0.0
+
+        async def produce():
+            await asyncio.sleep(0.15)
+            return self._response()
+
+        with self.assertNoLogs("uap.anthropic_proxy", level="INFO"):
+            out = "".join(asyncio.run(_collect(produce())))
+        self.assertIn("done", out)
+
+
 if __name__ == "__main__":
     unittest.main()