@miller-tech/uap 1.163.13 → 1.165.0

package/src/policies/enforcers/iac_plan_destruction_check.py

@@ -50,6 +50,28 @@ def branch_touches_iac() -> bool:
     return rc == 0 and "infra/terraform/" in out
 
 
+def repo_selector(cmd: str) -> list[str]:
+    """The `--repo` args to reuse when looking up the PR, mirroring whatever
+    repo the merge command itself targets.
+
+    `gh pr merge <N> --repo owner/name` merges in THAT repo, but a bare
+    `gh pr view <N>` resolves against the local checkout. Without mirroring the
+    selector, a cross-repo merge looks the number up in the wrong repo; that
+    miss then falls back to branch_touches_iac(), which scans a local tree with
+    nothing to do with the PR — so an unrelated untracked infra/terraform tf
+    file in the current checkout blocks a merge that touches no infrastructure
+    at all. Observed blocking every cross-repo merge from pay2u.
+    """
+    m = re.search(r"(?:--repo|-R)[=\s]+([\w.-]+/[\w.-]+)", cmd)
+    if m:
+        return ["--repo", m.group(1)]
+    # A `gh api` merge call carries owner/name in its path instead of a flag.
+    m = re.search(r"repos/([\w.-]+/[\w.-]+)/pulls/\d+/merge", cmd)
+    if m:
+        return ["--repo", m.group(1)]
+    return []
+
+
 def merge_touches_iac(cmd: str) -> bool:
     """Decide whether a `gh pr merge`/`gh api .../merge` command touches IaC by
     inspecting the FILES OF THE PR BEING MERGED — not the local working tree.
@@ -61,13 +83,16 @@ def merge_touches_iac(cmd: str) -> bool:
     own file list instead, and only fall back to the local check when no PR
     number can be parsed or the lookup fails.
     """
-    m = re.search(r"gh\s+pr\s+merge\s+(\d+)", cmd) or re.search(r"/pulls/(\d+)/merge", cmd)
+    m = re.search(r"gh\s+pr\s+merge\s+(\d+)", cmd, re.I) or re.search(
+        r"/pulls/(\d+)/merge", cmd
+    )
     if not m:
         # e.g. `gh pr merge` on the current branch with no number — use local diff.
         return branch_touches_iac()
     pr = m.group(1)
     rc, out, _ = run(
-        ["gh", "pr", "view", pr, "--json", "files", "-q", ".files[].path"], timeout=20
+        ["gh", "pr", "view", pr, *repo_selector(cmd), "--json", "files", "-q", ".files[].path"],
+        timeout=20,
     )
     if rc != 0:
         # Lookup failed (offline / auth) — fail safe by keeping the gate on.
@@ -91,7 +116,10 @@ def main() -> None:
     op, args = parse_cli()
     if op not in ("Bash", "bash"):
         emit(True, "not a bash op")
-    cmd = (args.get("command") or "").lower()
+    raw_cmd = args.get("command") or ""
+    # Markers are matched case-insensitively, but repo_selector() needs the
+    # original case of an owner/name argument — so keep both forms.
+    cmd = raw_cmd.lower()
 
     is_tf_apply = any(m in cmd for m in APPLY_MARKERS)
     is_wf_apply = any(m in cmd for m in WORKFLOW_APPLY) and "iac-terraform" in cmd and "apply" in cmd
@@ -104,7 +132,7 @@ def main() -> None:
     # Merges/pushes only gated when IaC is actually touched. For `gh pr merge`
     # inspect the PR's own files; for local pushes use the working-tree diff.
     if (is_merge or is_push_main) and not (is_tf_apply or is_wf_apply):
-        touches = merge_touches_iac(cmd) if is_merge else branch_touches_iac()
+        touches = merge_touches_iac(raw_cmd) if is_merge else branch_touches_iac()
         if not touches:
             emit(True, "merge/push does not touch infra/terraform")
 

package/templates/hooks/session-end.sh

@@ -58,4 +58,13 @@ if [ -d "$BACKUP_DIR" ]; then
   find "$BACKUP_DIR" -maxdepth 1 -mindepth 1 -type d -mtime +7 -exec rm -rf {} \; 2>/dev/null || true
 fi
 
+# Session-scoped proxy + dashboard release: stop them ONLY if THIS session
+# started them and no other client remains (adopted/externally-managed services
+# are never killed; other active clients keep them alive). Fail-open; never
+# blocks exit.
+if command -v uap >/dev/null 2>&1; then
+  _uap_pc="${CLAUDE_SESSION_ID:-${FACTORY_SESSION_ID:-${CURSOR_SESSION_ID:-${UAP_SESSION_ID:-ppid-$PPID}}}}"
+  ( cd "$PROJECT_DIR" 2>/dev/null && timeout 20 uap proxy release --if-enabled --quiet --client "$_uap_pc" --client-pid "$PPID" ) >/dev/null 2>&1 || true
+fi
+
 exit 0

package/templates/hooks/session-start.sh

@@ -250,6 +250,16 @@ if command -v uap >/dev/null 2>&1; then
   fi
 fi
 
+# Session-scoped proxy autostart (opt-in via .uap.json proxy.autostart). Starts
+# the proxy if none is running, or ADOPTS an already-running one, and brings the
+# operational dashboard up with it (http://localhost:3847 — opt out with
+# `uap proxy dashboard off`). Reference-counted: released only when the last
+# client leaves. Fail-open, never blocks.
+if command -v uap >/dev/null 2>&1; then
+  _uap_pc="${CLAUDE_SESSION_ID:-${FACTORY_SESSION_ID:-${CURSOR_SESSION_ID:-${UAP_SESSION_ID:-ppid-$PPID}}}}"
+  ( cd "$PROJECT_DIR" 2>/dev/null && timeout 30 uap proxy ensure --if-enabled --quiet --client "$_uap_pc" --client-pid "$PPID" ) >/dev/null 2>&1 || true
+fi
+
 if [ -n "$output" ]; then
   echo "$output"
 fi