@miller-tech/uap 1.163.4 → 1.163.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.163.4",
+  "version": "1.163.5",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/src/policies/enforcers/delivery_enforcement.py

@@ -225,12 +225,77 @@ _BASH_WRITE_RE = re.compile(
 # or relative path reaches it too. Anchoring on "name right after the separator"
 # let `nohup /home/u/.cloakbrowser/chromium-146/chrome file:///x.html &` walk
 # straight through the gate — the invocation the model actually reaches for.
+#
+# The trailing lookahead requires the bin to be a real COMMAND: followed by
+# whitespace-then-an-argument (a URL/file/flag), or a terminator (`firefox &`),
+# or end of input. Without it, `open` — a browser bin on macOS — also matched
+# Python's `open()` BUILTIN: `json.load(open('f'))` read as "subshell-paren +
+# open browser" and hard-blocked read-only diagnostics. A launch always has a
+# space before its argument; `open(` is a function call, so it no longer matches.
+# `\n` is a command separator too: without it `^` only anchored at offset 0, so a
+# launch on the SECOND-or-later line of a multi-line command was invisible —
+# `cd app\npython3 -m http.server &\nfirefox http://localhost:8080` walked
+# through. Agents emit multi-line bash constantly, so this was a live bypass.
+# `(?:\w+=[^\s]*\s+)*` skips leading env assignments: the path group rejects `=`
+# and `:`, so `DISPLAY=:0 firefox /tmp/a.html` — the canonical incantation for
+# putting a window on the operator's desktop, i.e. exactly what this gate exists
+# to stop — was also walking through.
 _BROWSER_RE = re.compile(
-    r"(?:^|[;&|(]|\|\||&&|\bnohup\b|\bsetsid\b|\bexec\b|\bxargs\b|\benv\b|\bnice\b|\btimeout\b|`|\$\()"
-    r"\s*(?:[\w./~+-]*/)?(" + "|".join(BROWSER_BINS) + r")\b",
+    r"(?:^|[;&|(\n]|\|\||&&|\bnohup\b|\bsetsid\b|\bexec\b|\bxargs\b|\benv\b|\bnice\b|\btimeout\b|`|\$\()"
+    r"\s*(?:\w+=[^\s]*\s+)*(?:[\w./~+-]*/)?(" + "|".join(BROWSER_BINS) + r")(?=\s+[^\s(]|\s*[;&|]|\s*$)",
     re.IGNORECASE,
 )
-_LOOKUP_RE = re.compile(r"^\s*(?:which|command\s+-v|type|whereis)\b", re.IGNORECASE)
+# A lookup is only exempt when the command is EXCLUSIVELY a lookup. Matching on
+# PREFIX alone disabled the whole browser scan for the natural probe-then-launch
+# sequence `which firefox && firefox /tmp/a.html` — the most likely real bypass
+# in this file, and one an agent reaches for without trying to evade anything.
+_LOOKUP_RE = re.compile(r"^\s*(?:which|command\s+-v|type|whereis)\b[^;&|\n]*$", re.IGNORECASE)
+
+# Quoted spans and heredoc bodies — blanked before the browser scan so a browser
+# NAME that is really a grep PATTERN, an interpreter payload
+# (`python -c "...open(...)"`), echoed text, or a heredoc body is not misread as
+# a LAUNCH. This was the other half of the false-positive class: a diagnostic
+# like `grep -n "GUI browser\|open.*browser" f.py` matched `|open` as "pipe into
+# the open browser". Only the shell SURFACE can express a launch.
+# The leading `\\.` alternative CONSUMES a backslash-escaped character before it
+# can open a span. A naive `'[^']*'` pairs the two ESCAPED apostrophes in
+# `echo it\'s done ; firefox a.html ; echo that\'s all`, blanking straight across
+# the launch and hiding it — reachable by accident, not just by an evader. The
+# escape token is returned unchanged by the substitution (only real quoted spans
+# are blanked); ordering matters, so keep `\\.` first.
+_QUOTE_SPAN_RE = re.compile(r"\\.|'(?:\\.|[^'])*'|\"(?:\\.|[^\"])*\"", re.DOTALL)
+_HEREDOC_RE = re.compile(r"<<-?\s*(['\"]?)([A-Za-z_]\w*)\1.*?^[ \t]*\2[ \t]*$", re.DOTALL | re.MULTILINE)
+# Above this size, skip surface-stripping and scan raw: `_HEREDOC_RE`'s lazy
+# `.*?` under DOTALL is O(n) per `<<TAG` with no terminator, so a pathological
+# ~100KB command could stall the hook. Scanning raw fails toward BLOCKING.
+_SURFACE_MAX = 65536
+
+
+def _shell_surface(cmd: str) -> str:
+    """`cmd` with quoted spans and heredoc bodies replaced by spaces, so the
+    browser matcher sees only real shell command words.
+
+    Length-preserving ON PURPOSE (blanks, never deletes): `firefox "$URL"` must
+    still read as a launch, and it only does because the blanked argument leaves
+    whitespace for the trailing lookahead. Returning "" here would silently stop
+    blocking every quoted-argument launch — there are tests pinning this.
+
+    KNOWN GAP (pre-existing, not introduced here): a launch inside a quoted
+    interpreter payload — `bash -c "firefox url"`, `sh -c 'xdg-open x'` — is not
+    detected. The OLD matcher missed these too (the `"` before the bin was never
+    a separator), so this is not a regression; closing it needs a separate
+    interpreter-aware pass that does not re-fire on `python -c "...open('f')"`."""
+    if len(cmd) > _SURFACE_MAX or ("'" not in cmd and '"' not in cmd and "<<" not in cmd):
+        return cmd
+    def blank(m: "re.Match[str]") -> str:
+        return " " * (m.end() - m.start())
+
+    def blank_spans(m: "re.Match[str]") -> str:
+        # Escape tokens (`\'`) pass through untouched — blanking them is
+        # unnecessary and they must not be treated as quote spans.
+        return m.group(0) if m.group(0).startswith("\\") else blank(m)
+
+    return _QUOTE_SPAN_RE.sub(blank_spans, _HEREDOC_RE.sub(blank, cmd))
 
 
 def _handle_bash(args: dict) -> None:
@@ -243,7 +308,7 @@ def _handle_bash(args: dict) -> None:
 
     # Browser launch → redirect to the real (headless) validation path. Always
     # blocked: opening a window proves nothing and cannot gate a DONE claim.
-    if not _LOOKUP_RE.match(cmd) and _BROWSER_RE.search(cmd):
+    if not _LOOKUP_RE.match(cmd) and _BROWSER_RE.search(_shell_surface(cmd)):
         emit(
             False,
             "BLOCKED: do not open a GUI browser to check your work — it proves nothing "

package/tools/agents/tests/test_delivery_enforcement_web_and_bash.py

@@ -82,6 +82,83 @@ class BashGateTest(unittest.TestCase):
         code, _ = run("Bash", {"command": "which firefox chromium 2>/dev/null"})
         self.assertEqual(code, 0)
 
+    def test_browser_name_inside_code_and_quotes_is_not_blocked(self):
+        # The matcher must read the SHELL SURFACE only — a browser-bin NAME that
+        # appears inside a quoted grep pattern, an interpreter payload, an echoed
+        # string, or a heredoc body is NOT a launch. These are the real
+        # false-positives that repeatedly blocked read-only diagnostics:
+        #   - Python's open() builtin: `(open` read as "subshell + open browser".
+        #   - a grep pattern containing `\|open`: read as "pipe + open browser".
+        for cmd in (
+            # Python open() builtin in a -c payload (the .uap/ ledger reads).
+            "python3 -c \"import json; d=json.load(open('.uap/completion-ledger.json'))\"",
+            # Python open() for writing, inside a heredoc body.
+            "python3 - \"$HEAD\" <<'PY'\nopen('.uap/reviews/x.json', 'w').write(s)\nPY",
+            # A grep pattern that literally contains browser-bin words.
+            "grep -n \"GUI browser\\|open.*browser\\|BROWSER\" src/x.py",
+            # Echoed text mentioning a browser is not a launch.
+            "echo 'open the browser to check the page'",
+            # `open` as a grep pattern arg (not a command at a shell position).
+            "cat notes.txt | grep open",
+        ):
+            code, out = run("Bash", {"command": cmd})
+            self.assertEqual(code, 0, f"{cmd!r} must NOT be blocked — got {out}")
+
+    def test_quoted_argument_launch_still_blocked(self):
+        # The surface-stripper blanks quoted spans LENGTH-PRESERVINGLY; these
+        # only stay blocked because the blanked argument leaves whitespace for
+        # the trailing lookahead. If blank() ever returns "" instead of spaces,
+        # every quoted-argument launch silently stops being blocked — pin it.
+        for cmd in ("firefox '/tmp/a.html'", 'xdg-open "$F"', 'chromium "/tmp/a b.html"'):
+            code, out = run("Bash", {"command": cmd})
+            self.assertEqual(code, 2, f"{cmd!r} must be BLOCKED — got {out}")
+
+    def test_lookahead_branches_and_alternation_order(self):
+        # `chromium` precedes `chromium-browser` in BROWSER_BINS, so the engine
+        # must backtrack through the lookahead to reach the longer name.
+        # Also covers the bare-bin (`\s*$`) and terminator (`\s*[;&|]`) branches.
+        for cmd in ("chromium-browser /tmp/a.html", "google-chrome-stable /tmp/a.html",
+                    "firefox", "chromium &"):
+            code, out = run("Bash", {"command": cmd})
+            self.assertEqual(code, 2, f"{cmd!r} must be BLOCKED — got {out}")
+
+    def test_probe_then_launch_is_blocked(self):
+        # A prefix `which` used to disable the ENTIRE browser scan, so the
+        # natural probe-then-launch sequence walked straight through.
+        for cmd in ("which firefox && firefox /tmp/a.html",
+                    "which xdg-open >/dev/null && xdg-open /tmp/app.html"):
+            code, out = run("Bash", {"command": cmd})
+            self.assertEqual(code, 2, f"{cmd!r} must be BLOCKED — got {out}")
+        # A pure lookup is still exempt.
+        code, out = run("Bash", {"command": "which firefox chromium 2>/dev/null"})
+        self.assertEqual(code, 0, out)
+
+    def test_launch_on_a_later_line_is_blocked(self):
+        # `^` only anchored at offset 0, so a launch on line 2+ of a multi-line
+        # command was invisible — and agents emit multi-line bash constantly.
+        cmd = "cd /tmp/app\npython3 -m http.server 8080 &\nfirefox http://localhost:8080"
+        code, out = run("Bash", {"command": cmd})
+        self.assertEqual(code, 2, f"multi-line launch must be BLOCKED — got {out}")
+
+    def test_leading_env_assignment_launch_is_blocked(self):
+        # `DISPLAY=:0 firefox ...` is the canonical way to put a window on the
+        # operator's desktop — precisely what this gate exists to prevent.
+        for cmd in ("DISPLAY=:0 firefox /tmp/a.html", "FOO=bar BAZ=1 chromium /tmp/a.html"):
+            code, out = run("Bash", {"command": cmd})
+            self.assertEqual(code, 2, f"{cmd!r} must be BLOCKED — got {out}")
+
+    def test_escaped_quotes_do_not_hide_a_launch(self):
+        # Escaped apostrophes must not pair ACROSS a launch and blank it away.
+        cmd = "echo it\\'s done ; firefox /tmp/a.html ; echo that\\'s all"
+        code, out = run("Bash", {"command": cmd})
+        self.assertEqual(code, 2, f"escaped-quote span must not hide the launch — got {out}")
+
+    def test_open_function_call_is_not_a_browser_launch(self):
+        # `open(` is a function call (Python/JS), never a browser launch; a real
+        # `open <url>` launch has a space + argument, not a paren.
+        code, out = run("Bash", {"command": "node -e \"const f = open('a.txt'); void f;\""})
+        self.assertEqual(code, 0, out)
+
     def test_bash_source_write_routes_to_deliver(self):
         code, out = run("Bash", {"command": "cat > src/app.js <<EOF\nconsole.log(1)\nEOF"})
         self.assertEqual(code, 2, out)