@miller-tech/uap 1.127.0 → 1.128.0

package/templates/hooks/uap-policy-gate.sh

@@ -42,18 +42,73 @@ ARGS="$(printf '%s' "$PAYLOAD" | python3 -c 'import json,sys; d=json.load(sys.st
 
 [[ -z "$TOOL" ]] && exit 0
 
+# FAIL-CLOSED for the enforcement control surface. The gate is fail-SOFT by
+# design (a broken/absent enforcer must not wedge ALL work) — but that same
+# fail-open makes anything that BREAKS the enforcer a silent bypass of the
+# self-protect control. So: if THIS operation touches the enforcement surface
+# (policy DB/enforcers, .uap.json, proxy env, hook scripts) or sets a
+# bypass/relax flag, the gate fails CLOSED (exit 2) whenever the self-protect
+# enforcer cannot actually run and make the call. Normal ops keep failing open.
+SEC_SENSITIVE="$(printf '%s' "$ARGS" | TOOL="$TOOL" python3 -c '
+import json, os, re, sys
+try: a = json.loads(sys.stdin.read() or "{}")
+except Exception: a = {}
+markers = ("/.policy-tools/", "/src/policies/", "/policies/", "/.uap.json",
+           ".uap.json", "/.uap/", "anthropic-proxy.env", "uap-policy-gate.sh",
+           "uap-reactor-prompt.sh", "pre-tool-use")
+target = a.get("file_path") or a.get("path") or a.get("target") or ""
+cmd = a.get("command") or ""
+low = ("/" + str(target)).lower()
+hit = any(m in low for m in markers)
+bypass = re.search(
+    r"UAP_DELIVER_BYPASS\s*=\s*[\x27\"]?1|UAP_ENFORCE_DELIVERY\s*=\s*[\x27\"]?(advisory|off|0|false|no)"
+    r"|UAP_SELF_PROTECT_OFF\s*=\s*[\x27\"]?1|UAP_NO_WORKTREE\s*=\s*[\x27\"]?1|UAP_WORKDIR_SCOPE_OFF\s*=\s*[\x27\"]?1",
+    cmd, re.I)
+print("1" if (hit or bypass) else "0")
+' 2>/dev/null || echo 1)"
+
+# Operator out-of-band override disables the fail-closed guard too.
+[[ "${UAP_SELF_PROTECT_OFF:-}" == "1" ]] && SEC_SENSITIVE=0
+
+fail_closed() {
+  echo "[UAP policy gate] FAIL-CLOSED: this operation touches the enforcement control surface but the self-protect enforcer could not run (${1:-machinery unavailable}). Blocked so a broken/absent gate can't become a bypass. (Operator override: UAP_SELF_PROTECT_OFF=1.)" >&2
+  exit 2
+}
+
 DB="$MAIN_ROOT/agents/data/memory/policies.db"
-[[ ! -f "$DB" ]] && exit 0
+if [[ ! -f "$DB" ]]; then
+  [[ "$SEC_SENSITIVE" == "1" ]] && fail_closed "policies.db not found"
+  exit 0
+fi
+if ! command -v sqlite3 >/dev/null 2>&1; then
+  [[ "$SEC_SENSITIVE" == "1" ]] && fail_closed "sqlite3 not on PATH"
+  exit 0
+fi
+
+# Did the self-protect enforcer actually run and make a decision this call?
+sec_enforcer_ran=0
 
 # Iterate active policies with attached executable tools
 while IFS='|' read -r pid pname tool; do
   [[ -z "$pid" ]] && continue
   enforcer="$MAIN_ROOT/.policy-tools/${pid}_${tool}.py"
-  [[ ! -f "$enforcer" ]] && continue
+  if [[ ! -f "$enforcer" ]]; then
+    # A missing self-protect enforcer on a sensitive op = fail closed.
+    [[ "$SEC_SENSITIVE" == "1" && "$tool" == "enforcement_self_protect" ]] && fail_closed "enforcer file missing"
+    continue
+  fi
   out="$(python3 "$enforcer" --operation "$TOOL" --args "$ARGS" 2>/dev/null || true)"
   allowed="$(printf '%s' "$out" | python3 -c 'import json,sys;
 try: d=json.loads(sys.stdin.read()); print("1" if d.get("allowed",True) else "0")
-except: print("1")' 2>/dev/null || echo 1)"
+except: print("2")' 2>/dev/null || echo 2)"
+  # allowed=2 => enforcer errored / emitted unparseable output. For a sensitive
+  # op via the self-protect enforcer, that error must NOT default to allow.
+  if [[ "$tool" == "enforcement_self_protect" ]]; then
+    [[ "$SEC_SENSITIVE" == "1" && "$allowed" == "2" ]] && fail_closed "enforcer errored"
+    sec_enforcer_ran=1
+  fi
+  # For all other enforcers, an error still fails open (unchanged behavior).
+  [[ "$allowed" == "2" ]] && allowed=1
   if [[ "$allowed" == "0" ]]; then
     # R1: consume the enforcer's route:deliver signal (log intent, opt-in
     # background auto-route to `uap deliver`). Falls back to the plain reason if
@@ -73,4 +128,8 @@ except: print("")' 2>/dev/null || echo "")"
   fi
 done < <(sqlite3 "$DB" "SELECT p.id, p.name, t.toolName FROM policies p JOIN executable_tools t ON t.policyId=p.id WHERE p.isActive=1;")
 
+# A sensitive op that no self-protect enforcer ever evaluated = the control
+# surface is unguarded (self-protect not registered/active). Fail closed.
+[[ "$SEC_SENSITIVE" == "1" && "$sec_enforcer_ran" == "0" ]] && fail_closed "self-protect not registered/active"
+
 exit 0

package/tools/agents/scripts/anthropic_proxy.py

@@ -155,7 +155,16 @@ ANTHROPIC_API_BASE = os.environ.get(
 ANTHROPIC_API_KEY = os.environ.get("ANTHROPIC_API_KEY", "")
 ANTHROPIC_PASSTHROUGH_MODELS = os.environ.get("ANTHROPIC_PASSTHROUGH_MODELS", "")
 PROXY_PORT = int(os.environ.get("PROXY_PORT", "4000"))
-PROXY_HOST = os.environ.get("PROXY_HOST", "0.0.0.0")
+# Bind loopback by DEFAULT (security audit: an unauthenticated 0.0.0.0 listener
+# let any LAN host drive the local model and reach cloud passthrough). To run
+# the proxy as a shared LAN service, set PROXY_HOST=0.0.0.0 AND set
+# PROXY_AUTH_TOKEN so the exposure is credential-gated.
+PROXY_HOST = os.environ.get("PROXY_HOST", "127.0.0.1")
+# Optional shared secret. When set, every request to a model route must present
+# it as `Authorization: Bearer <token>` or `X-Uap-Proxy-Token: <token>`. Unset
+# (default) = no check, which is safe only because the default bind is loopback.
+# The health probe stays open so liveness checks don't need the secret.
+PROXY_AUTH_TOKEN = os.environ.get("PROXY_AUTH_TOKEN", "").strip()
 PROXY_LOG_LEVEL = os.environ.get("PROXY_LOG_LEVEL", "INFO").upper()
 PROXY_READ_TIMEOUT = float(os.environ.get("PROXY_READ_TIMEOUT", "180"))
 PROXY_GENERATION_TIMEOUT = float(os.environ.get("PROXY_GENERATION_TIMEOUT", "300"))
@@ -3051,6 +3060,46 @@ app = FastAPI(
     lifespan=lifespan,
 )
 
+
+# Open paths that never require the shared secret (liveness / discovery), so a
+# LAN health check or an SDK model-list probe works without the token.
+_PROXY_AUTH_OPEN_PATHS = frozenset({"/health", "/", "/v1/models"})
+
+
+@app.middleware("http")
+async def _shared_secret_auth(request: Request, call_next):
+    """Gate every request behind PROXY_AUTH_TOKEN when it is set.
+
+    No-op when the token is unset (the default; safe only because the default
+    bind is loopback). When set — the intended posture for a shared LAN service
+    (PROXY_HOST=0.0.0.0) — a request must present the token as
+    `Authorization: Bearer <token>` or `X-Uap-Proxy-Token: <token>`; otherwise
+    401. Uses a constant-time compare to avoid a timing oracle.
+    """
+    if PROXY_AUTH_TOKEN and request.url.path not in _PROXY_AUTH_OPEN_PATHS and request.method != "OPTIONS":
+        provided = request.headers.get("x-uap-proxy-token", "")
+        if not provided:
+            auth = request.headers.get("authorization", "")
+            if auth.lower().startswith("bearer "):
+                provided = auth[7:].strip()
+        import hmac as _hmac
+
+        if not (provided and _hmac.compare_digest(provided, PROXY_AUTH_TOKEN)):
+            return Response(
+                content=json.dumps(
+                    {
+                        "type": "error",
+                        "error": {
+                            "type": "authentication_error",
+                            "message": "missing or invalid proxy token (set X-Uap-Proxy-Token or Authorization: Bearer)",
+                        },
+                    }
+                ),
+                status_code=401,
+                media_type="application/json",
+            )
+    return await call_next(request)
+
 # NOTE: Concurrency control is enforced by _acquire_upstream_slot() inside
 # _post_with_retry (the single point where we hit llama.cpp). An earlier
 # implementation also added an HTTP middleware that acquired the same