@miller-tech/uap 1.148.10 → 1.148.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.148.10",
+  "version": "1.148.12",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/src/policies/enforcers/delivery_enforcement.py

@@ -89,10 +89,26 @@ BROWSER_BINS = (
 # source straight into it (observed: 24 source files written to
 # .worktrees/001-space-shooter/ with no deliver run). Gating it behind the active
 # flag closes that hole.
+# What stays exempt, and WHY — each is a deliberate carve-out, not an oversight:
+#   * agent/enforcement infrastructure (.claude/ .cursor/ .opencode/ .codex/
+#     .forge/ .omp/ .uap/ .policy-tools/): the hooks, plugins and enforcers that
+#     RUN the gate. Routing them through deliver is a bootstrap deadlock — an
+#     agent repairing a broken hook would need that hook to work. These are
+#     guarded by enforcement-self-protect (which blocks WEAKENING them) instead.
+#   * src/policies/, policies/: the policy definitions themselves — same
+#     self-reference; likewise guarded by self-protect rather than by routing.
+#   * test/, tests/: the deliberate fast feedback loop (deliver still verifies
+#     them via the gate ladder). _is_test_file() covers test files living outside
+#     these dirs.
+#
+# REMOVED 2026-07-13: "scripts/" and "docs/". Shell/Python/etc. under scripts/
+# EXECUTES — it is code, so it must route through deliver and be tested like any
+# other source. Exempting it left an entire language (shell) silently ungated:
+# a model could put its whole implementation in scripts/ and never be validated.
 EXEMPT_PREFIXES = (
     ".claude/", ".cursor/", ".opencode/", ".codex/", ".forge/", ".omp/",
     ".uap/", ".policy-tools/",
-    "src/policies/", "scripts/", "docs/", "policies/", "test/", "tests/",
+    "src/policies/", "policies/", "test/", "tests/",
 )
 
 # Test files are protected by deliver itself; never gate them here. Covers the

package/templates/hooks/deliver_autoroute.py

@@ -47,21 +47,36 @@ def decide(out: dict, tool: str, args: dict, autoroute_on: bool, seen_files: set
     m = re.fullmatch(r'uap deliver "(.+)"', hint.strip())
     if m:
         hint = m.group(1)
-    file_path = args.get("file_path") or args.get("path") or args.get("target") or ""
+    # Accept the file-path key under ANY agent spelling. The enforcer was fixed
+    # for this long ago; autoroute was not — so for opencode (which sends
+    # `filePath`) file_path was always "", `spawn` was always False, and autoroute
+    # was INERT: the gate blocked the edit, logged the intent, told the model to
+    # call deliver… and deliver never ran. Observed live: 3 routed intents, 0
+    # deliver runs, 0 files changed — work blocked but never delivered.
+    file_path = (
+        args.get("file_path") or args.get("filePath") or args.get("path")
+        or args.get("target") or args.get("filename") or args.get("file") or ""
+    )
 
     if route != "deliver":
         return {"message": reason, "route": route, "spawn": False,
-                "file_path": file_path, "hint": hint, "intent": None}
+                "file_path": file_path, "hint": hint, "dedup_key": "", "intent": None}
 
     intent = {"ts": int(time.time()), "tool": tool, "file_path": file_path, "hint": hint}
-    spawn = bool(autoroute_on and hint and file_path and file_path not in seen_files)
+    # Dedup on the file when we have one, else on the hint itself. Requiring a
+    # file_path made an entire class unspawnable: a BASH-routed source-write
+    # (`cat > app.js <<EOF`) carries a `command`, not a path — so those intents
+    # were blocked and then silently dropped. The hint is what deliver actually
+    # runs, so it is the correct spawn key.
+    dedup_key = file_path or hint
+    spawn = bool(autoroute_on and hint and dedup_key and dedup_key not in seen_files)
     message = reason
     if spawn:
         message = reason + " [auto-routed to `uap deliver` — running in the background]"
-    elif autoroute_on and file_path in seen_files:
-        message = reason + " [already auto-routed to `uap deliver` for this file — see .uap/autoroute.log / pending-deliver.jsonl]"
+    elif autoroute_on and dedup_key and dedup_key in seen_files:
+        message = reason + " [already auto-routed to `uap deliver` for this change — see .uap/autoroute.log / pending-deliver.jsonl]"
     return {"message": message, "route": route, "spawn": spawn,
-            "file_path": file_path, "hint": hint, "intent": intent}
+            "file_path": file_path, "hint": hint, "dedup_key": dedup_key, "intent": intent}
 
 
 def _seen_path(root: Path) -> Path:
@@ -160,8 +175,12 @@ def main() -> None:
 
     if d["spawn"]:
         try:
+            # Dedup on the SAME key `decide` gated on (file when present, else the
+            # hint) — writing file_path here would record "" for a bash-routed
+            # intent and never dedup it.
+            key = d.get("dedup_key") or d["file_path"] or d["hint"]
             with _seen_path(root).open("a") as f:
-                f.write(d["file_path"].replace("\n", " ").replace("\r", " ") + "\n")
+                f.write(key.replace("\n", " ").replace("\r", " ") + "\n")
         except Exception:
             pass
         _spawn_deliver(root, d["hint"])

package/tools/agents/tests/test_deliver_autoroute.py

@@ -69,5 +69,53 @@ class LoggingTest(unittest.TestCase):
             self.assertEqual(rec["file_path"], "/repo/src/foo.ts")
 
 
+class AgentKeySpellingTest(unittest.TestCase):
+    """autoroute must accept EVERY agent's file-path key.
+
+    The enforcer was fixed for this long ago; autoroute was not — so for opencode
+    (which sends `filePath`) file_path was always "", `spawn` was always False, and
+    autoroute was INERT: the gate blocked the edit, logged the intent, told the
+    model to call deliver… and deliver never ran. Observed live: 3 routed intents,
+    0 deliver runs, 0 files changed — work blocked but never delivered. The old
+    tests only ever passed snake_case, which is why this went unnoticed.
+    """
+
+    def test_opencode_filePath_spawns(self):
+        d = mod.decide(BLOCK_OUT, "Write", {"filePath": "/repo/src/foo.ts"}, True, set())
+        self.assertTrue(d["spawn"])
+        self.assertEqual(d["dedup_key"], "/repo/src/foo.ts")
+
+    def test_claude_file_path_still_spawns(self):
+        d = mod.decide(BLOCK_OUT, "Write", {"file_path": "/repo/src/foo.ts"}, True, set())
+        self.assertTrue(d["spawn"])
+
+    def test_other_spellings(self):
+        for key in ("path", "target", "filename", "file"):
+            d = mod.decide(BLOCK_OUT, "Write", {key: "/repo/src/foo.ts"}, True, set())
+            self.assertTrue(d["spawn"], key)
+
+
+class BashRoutedIntentTest(unittest.TestCase):
+    """A BASH-routed source-write carries a `command`, not a path — requiring
+    file_path made that whole class unspawnable (blocked, then silently dropped).
+    The hint is what deliver actually runs, so it is the correct spawn key."""
+
+    def test_bash_intent_spawns_on_hint_alone(self):
+        d = mod.decide(BLOCK_OUT, "Bash", {"command": "cat > src/app.js <<EOF"}, True, set())
+        self.assertTrue(d["spawn"])
+        self.assertEqual(d["file_path"], "")           # genuinely has no path
+        self.assertEqual(d["dedup_key"], d["hint"])    # …so it dedups on the hint
+
+    def test_bash_intent_dedupes_on_hint(self):
+        d1 = mod.decide(BLOCK_OUT, "Bash", {"command": "cat > a.js <<EOF"}, True, set())
+        d2 = mod.decide(BLOCK_OUT, "Bash", {"command": "cat > a.js <<EOF"}, True, {d1["dedup_key"]})
+        self.assertTrue(d1["spawn"])
+        self.assertFalse(d2["spawn"])  # no double-spawn for the same change
+
+    def test_still_never_spawns_without_a_hint(self):
+        d = mod.decide({"reason": "x", "route": "deliver"}, "Bash", {"command": "cat > a.js"}, True, set())
+        self.assertFalse(d["spawn"])
+
+
 if __name__ == "__main__":
     unittest.main()

package/tools/agents/tests/test_delivery_enforcement_exemptions.py

@@ -0,0 +1,66 @@
+#!/usr/bin/env python3
+"""EXEMPT_PREFIXES must exempt ONLY what is genuinely un-routable.
+
+`scripts/` and `docs/` used to be exempt — but shell/Python under scripts/ EXECUTES.
+It is code, so it must route through deliver and be tested like any other source.
+Exempting it left an entire language silently ungated: a model could put its whole
+implementation in scripts/ and never be validated.
+
+What remains exempt is deliberate:
+  * agent/enforcement infra (.uap/ .opencode/ .claude/ .policy-tools/ …) — the
+    hooks that RUN the gate; routing them is a bootstrap deadlock. Guarded by
+    enforcement-self-protect instead.
+  * src/policies/, policies/ — the policy definitions themselves (same self-reference).
+  * test/, tests/ — the deliberate fast feedback loop.
+"""
+import json, os, subprocess, sys, unittest
+from pathlib import Path
+
+ENF = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "delivery_enforcement.py"
+
+
+def run(path):
+    e = {**os.environ, "UAP_ENFORCE_DELIVERY": "block", "UAP_INFERENCE_ENDPOINT": "http://172.17.0.1:8080/v1"}
+    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE", "UAP_DELIVER_LOCAL_ADVISORY"):
+        e.pop(k, None)
+    p = subprocess.run(
+        [sys.executable, str(ENF), "--operation", "Write",
+         "--args", json.dumps({"file_path": path, "content": "x" * 2000})],
+        capture_output=True, text=True, env=e, cwd=str(ENF.parents[3]),
+    )
+    return p.returncode, p.stdout
+
+
+class TightenedExemptionsTest(unittest.TestCase):
+    def test_scripts_and_docs_are_now_GATED(self):
+        # These execute — they are code and must route through deliver.
+        for path in ("scripts/deploy.sh", "scripts/build.py", "scripts/tool.ts", "docs/example.py"):
+            code, out = run(path)
+            self.assertEqual(code, 2, f"{path} must be GATED (it is code) — got {out}")
+            self.assertIn("route", out, path)
+
+    def test_agent_enforcement_infra_stays_exempt(self):
+        # Routing the hooks that RUN the gate is a bootstrap deadlock; these are
+        # guarded by enforcement-self-protect, not by delivery routing.
+        for path in (".uap/hook.py", ".opencode/plugin.ts", ".claude/hooks/x.sh", ".policy-tools/e.py"):
+            code, out = run(path)
+            self.assertEqual(code, 0, f"{path} must stay exempt — got {out}")
+
+    def test_policy_definitions_stay_exempt(self):
+        for path in ("src/policies/enforcers/x.py", "policies/custom.py"):
+            code, out = run(path)
+            self.assertEqual(code, 0, f"{path} must stay exempt — got {out}")
+
+    def test_test_dirs_stay_exempt(self):
+        # Deliberate fast feedback loop; deliver still verifies them via the ladder.
+        for path in ("test/helper.ts", "tests/fixtures/data.py"):
+            code, out = run(path)
+            self.assertEqual(code, 0, f"{path} must stay exempt — got {out}")
+
+    def test_ordinary_source_still_gated(self):
+        code, out = run("src/app.ts")
+        self.assertEqual(code, 2, out)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_delivery_enforcement_worktree.py

@@ -66,8 +66,15 @@ class TestDeliveryEnforcementWorktree(unittest.TestCase):
         self.assertFalse(run("src/game.js", self.root))
 
     def test_other_exemptions_intact(self):
+        # Agent/enforcement infra stays exempt (routing the hooks that RUN the
+        # gate is a bootstrap deadlock).
         self.assertTrue(run(".uap/state.js", self.root))
-        self.assertTrue(run("scripts/build.js", self.root))
+        self.assertTrue(run("test/helper.js", self.root))
+
+    def test_scripts_no_longer_exempt(self):
+        # TIGHTENED: scripts/ executes — it is code, so it must route through
+        # deliver and be tested like any other source.
+        self.assertFalse(run("scripts/build.js", self.root))
 
     def test_bypass_override_still_works(self):
         self.assertTrue(