@miller-tech/uap 1.148.8 → 1.148.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.148.8",
+  "version": "1.148.9",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/src/policies/enforcers/delivery_enforcement.py

@@ -22,6 +22,7 @@ files (deliver protects those itself), and tooling dot-dirs.
 """
 from __future__ import annotations
 import os
+import re
 import sys
 from pathlib import Path
 
@@ -35,6 +36,25 @@ SOURCE_EXTS = (
     ".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs",
     ".py", ".go", ".rs", ".java", ".rb", ".php", ".cs", ".swift", ".kt",
     ".c", ".cc", ".cpp", ".h", ".hpp",
+    # WEB deliverables are source too. Omitting these let an ENTIRE class of
+    # deliverable (single-file web apps, static sites, templates) escape the gate:
+    # a 34KB single-file HTML app returned "not source code" -> allowed -> zero
+    # routing, zero deliver, zero validation (observed live). The completion gate's
+    # own code-change detector already counts html/css/vue/svelte as code, so the
+    # two halves of the system disagreed about what "source" means until now.
+    ".html", ".htm", ".css", ".scss", ".sass", ".less",
+    ".vue", ".svelte", ".astro",
+)
+
+# GUI-browser launchers. A model with no validation tooling in reach tries to
+# "check its work" by opening a browser (observed: 11 xdg-open/firefox/chromium
+# attempts in 40 min, spawning windows on the operator's desktop) — which proves
+# nothing and burns turns. Redirect it to `uap verify`, which renders headlessly
+# and runs the real visual + behavioral gates.
+BROWSER_BINS = (
+    "xdg-open", "firefox", "chromium", "chromium-browser", "google-chrome",
+    "google-chrome-stable", "chrome", "sensible-browser", "x-www-browser",
+    "microsoft-edge", "open",
 )
 
 # NOTE: `.worktrees/` is deliberately NOT exempt here. A real `uap deliver` run
@@ -148,8 +168,79 @@ def _local_mode() -> str:
     return "advisory" if adv not in {"0", "off", "false", "no", ""} else "block"
 
 
+BASH_OPS = {"Bash", "bash", "run_bash", "shell"}
+
+# A bash command that WRITES a source file: `> f.ts`, `>> f.ts`, `tee f.ts`,
+# `sed -i ... f.ts`. Without this, Edit/Write gating is trivially bypassable —
+# `cat > app.js <<EOF` writes source with no deliver run and no validation.
+_EXT_ALT = "|".join(e.lstrip(".") for e in SOURCE_EXTS)
+_BASH_WRITE_RE = re.compile(
+    r"(?:>>?\s*|tee\s+(?:-a\s+)?|sed\s+-i[^\s]*\s+(?:[^|;&]*\s)?)"
+    r"['\"]?([^\s'\"|;&>]+\.(?:" + _EXT_ALT + r"))\b",
+    re.IGNORECASE,
+)
+# A browser LAUNCH (not a lookup: `which firefox` / `command -v chrome` are fine).
+_BROWSER_RE = re.compile(
+    r"(?:^|[;&|]|\&\&|\|\|)\s*(?:nohup\s+)?(" + "|".join(BROWSER_BINS) + r")\b",
+    re.IGNORECASE,
+)
+_LOOKUP_RE = re.compile(r"^\s*(?:which|command\s+-v|type|whereis)\b", re.IGNORECASE)
+
+
+def _handle_bash(args: dict) -> None:
+    """Gate bash so it can't bypass delivery enforcement (source writes) and so a
+    model stops trying to 'verify' by opening a GUI browser."""
+    cmd = str(args.get("command") or args.get("cmd") or args.get("script") or "")
+    if not cmd.strip():
+        emit(True, "bash: empty command")
+        return
+
+    # Browser launch → redirect to the real (headless) validation path. Always
+    # blocked: opening a window proves nothing and cannot gate a DONE claim.
+    if not _LOOKUP_RE.match(cmd) and _BROWSER_RE.search(cmd):
+        emit(
+            False,
+            "BLOCKED: do not open a GUI browser to check your work — it proves nothing "
+            "and cannot validate anything. Run `uap verify` instead: it renders the page "
+            "headlessly and runs the REAL visual + behavioral gates (screenshots land in "
+            ".uap/visual). Use that to see whether the UI actually works.",
+        )
+        return
+
+    # Source write via shell → same rules as an Edit/Write: route through deliver.
+    if os.environ.get("UAP_DELIVER_ACTIVE") == "1":
+        emit(True, "bash: inside a deliver-driven run")
+        return
+    if os.environ.get("UAP_DELIVER_BYPASS") == "1":
+        emit(True, "bash: UAP_DELIVER_BYPASS override set")
+        return
+    m = _BASH_WRITE_RE.search(cmd)
+    if m:
+        target = m.group(1)
+        mode = os.environ.get("UAP_ENFORCE_DELIVERY", "block").lower()
+        if mode == "block" and _is_local_model_session() and _local_mode() == "advisory":
+            mode = "advisory"
+        msg = (
+            f"BLOCKED: do not write source via the shell ('{target}'). Writing files with "
+            "a redirect/heredoc/sed/tee bypasses the delivery gate. To create or change "
+            "code, call the `deliver` tool (or run: uap deliver \"<one-line description>\"). "
+            "Do NOT retry this command."
+        )
+        if mode == "block":
+            emit(False, msg, route="deliver", deliverHint=f"implement the intended change to {target}")
+            return
+        print(f"[delivery-enforcement advisory] {msg}", file=sys.stderr)
+        emit(True, "bash advisory: source-write nudge logged")
+        return
+
+    emit(True, "bash: no source write or browser launch")
+
+
 def main() -> None:
     op, args = parse_cli()
+    if op in BASH_OPS:
+        _handle_bash(args)
+        return
     if op not in EDIT_OPS:
         emit(True, "not a file-edit operation")
         return

package/tools/agents/tests/test_delivery_enforcement_web_and_bash.py

@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+"""delivery-enforcement must gate WEB source (.html/.css/...) and BASH.
+
+Two live escapes this closes:
+ 1. `.html` was not in SOURCE_EXTS, so a single-file web app — the actual
+    deliverable — returned "not source code" and was allowed: zero routing, zero
+    deliver, zero validation (observed: a 34KB rubiks-cube.html built ungated).
+ 2. Bash was ungated entirely, so `cat > app.js <<EOF` bypassed the whole gate;
+    and a model with no validation tooling in reach kept launching a GUI browser
+    (xdg-open/firefox) to "check its work", which proves nothing.
+"""
+import json, os, subprocess, sys, unittest
+from pathlib import Path
+
+ENF = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "delivery_enforcement.py"
+
+
+def run(op, args, env=None):
+    e = {**os.environ, "UAP_ENFORCE_DELIVERY": "block", "UAP_INFERENCE_ENDPOINT": "http://172.17.0.1:8080/v1"}
+    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE", "UAP_DELIVER_LOCAL_ADVISORY"):
+        e.pop(k, None)
+    if env:
+        e.update(env)
+    p = subprocess.run([sys.executable, str(ENF), "--operation", op, "--args", json.dumps(args)],
+                       capture_output=True, text=True, env=e, cwd=str(ENF.parents[3]))
+    return p.returncode, p.stdout + p.stderr
+
+
+class WebSourceTest(unittest.TestCase):
+    def test_html_is_source_and_routes(self):
+        code, out = run("Write", {"file_path": "app.html", "content": "<html>" + "x" * 2000})
+        self.assertEqual(code, 2, out)          # blocked
+        self.assertIn("route", out)             # → deliver
+
+    def test_css_is_source(self):
+        code, _ = run("Write", {"file_path": "src/app.css", "content": "a{}" * 500})
+        self.assertEqual(code, 2)
+
+    def test_vue_svelte_are_source(self):
+        for f in ("src/App.vue", "src/App.svelte"):
+            code, _ = run("Write", {"file_path": f, "content": "x" * 1000})
+            self.assertEqual(code, 2, f)
+
+    def test_non_source_still_allowed(self):
+        code, out = run("Write", {"file_path": "notes.md", "content": "hello"})
+        self.assertEqual(code, 0, out)
+
+
+class BashGateTest(unittest.TestCase):
+    def test_gui_browser_launch_is_blocked_and_redirected_to_verify(self):
+        code, out = run("Bash", {"command": "xdg-open /tmp/app.html"})
+        self.assertEqual(code, 2, out)
+        self.assertIn("uap verify", out)  # redirected to the real validation path
+
+    def test_firefox_launch_blocked(self):
+        code, _ = run("Bash", {"command": "nohup firefox /tmp/a.html &"})
+        self.assertEqual(code, 2)
+
+    def test_browser_LOOKUP_is_not_blocked(self):
+        # `which firefox` is a capability probe, not a launch — must not false-block.
+        code, _ = run("Bash", {"command": "which firefox chromium 2>/dev/null"})
+        self.assertEqual(code, 0)
+
+    def test_bash_source_write_routes_to_deliver(self):
+        code, out = run("Bash", {"command": "cat > src/app.js <<EOF\nconsole.log(1)\nEOF"})
+        self.assertEqual(code, 2, out)
+        self.assertIn("route", out)
+
+    def test_sed_inplace_on_source_blocked(self):
+        code, _ = run("Bash", {"command": "sed -i s/a/b/ src/main.ts"})
+        self.assertEqual(code, 2)
+
+    def test_benign_bash_allowed(self):
+        code, out = run("Bash", {"command": "ls -la && npm test"})
+        self.assertEqual(code, 0, out)
+
+    def test_deliver_active_bypasses_bash_gate(self):
+        code, _ = run("Bash", {"command": "cat > src/app.js <<EOF\nx\nEOF"},
+                      env={"UAP_DELIVER_ACTIVE": "1"})
+        self.assertEqual(code, 0)  # deliver's own shell writes must pass
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_delivery_enforcement_worktree.py

@@ -58,7 +58,9 @@ class TestDeliveryEnforcementWorktree(unittest.TestCase):
         )
 
     def test_worktree_nonsource_still_allowed(self):
-        self.assertTrue(run(".worktrees/001-x/css/styles.css", self.root))
+        # NOTE: .css is now SOURCE (web deliverables are gated) — use a genuinely
+        # non-source file to keep this test's intent (non-source is not routed).
+        self.assertTrue(run(".worktrees/001-x/docs/NOTES.md", self.root))
 
     def test_direct_source_still_blocked(self):
         self.assertFalse(run("src/game.js", self.root))