@miller-tech/uap 1.172.14 → 1.172.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.172.14",
+  "version": "1.172.15",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/src/policies/enforcers/enforcement_infra_protect.py

@@ -34,6 +34,7 @@ Scope (Bash/bash/run_bash commands only):
 Killing a SPECIFIC process pattern (e.g. `pkill -f "python3 -m http.server
 8765"`) and serving on non-infra ports stay allowed.
 """
+import os
 import re
 import sys
 from pathlib import Path
@@ -94,7 +95,8 @@ REASON = (
     "session runs on (llama-server :8080 / UAP proxy :4000 / embeddings :8081). "
     "Kill only your own processes by SPECIFIC pattern (e.g. pkill -f 'python3 -m "
     "http.server 8765') and serve your app on a port other than 8080/4000/8081 "
-    "(e.g. 8765)."
+    "(e.g. 8765). Operator override: set UAP_INFRA_PROTECT_OFF=1 in the launch "
+    "environment (not inline on the command)."
 )
 
 
@@ -140,8 +142,31 @@ def _referenced_script_bodies(cmd: str, limit: int = 4) -> list[tuple[str, str]]
     return found
 
 
+# Operator escape hatch — ENVIRONMENT ONLY, deliberately.
+#
+# This is the only enforcer that had no override, which is why every restart of
+# the inference stack required the operator to run the command by hand. That is
+# defensible for a control whose purpose is to stop the agent cycling the stack
+# it runs on, but it also meant an operator who WANTED the agent to restart a
+# service had no way to say so.
+#
+# It reads os.environ and nothing else. It does NOT honour an inline
+# `UAP_INFRA_PROTECT_OFF=1 systemctl ...` assignment, unlike expert-review's
+# override, because the agent composes its own command strings: an inline form is
+# self-grantable and would delete the control rather than delegate it. An
+# environment variable is set by whoever launched the session, so honouring only
+# that keeps the decision with the operator.
+#
+# enforcement-self-protect additionally lists this flag among the bypasses the
+# agent may not set, so an inline attempt is refused with an explicit message
+# instead of silently doing nothing.
+OVERRIDE = os.environ.get("UAP_INFRA_PROTECT_OFF") == "1"
+
+
 def main() -> None:
     operation, args = parse_cli()
+    if OVERRIDE:
+        emit(True, "UAP_INFRA_PROTECT_OFF=1 set in the launch environment (operator)")
     if operation not in BASH_OPS:
         emit(True, "not a shell operation")
     cmd = str(args.get("command") or "")

package/src/policies/enforcers/enforcement_self_protect.py

@@ -51,6 +51,14 @@ BYPASS_PATTERNS = (
     re.compile(r"UAP_SELF_PROTECT_OFF\s*=\s*['\"]?1", re.I),
     re.compile(r"UAP_NO_WORKTREE\s*=\s*['\"]?1", re.I),
     re.compile(r"UAP_WORKDIR_SCOPE_OFF\s*=\s*['\"]?1", re.I),
+    # infra-protect's hatch is environment-only by design; an inline assignment
+    # would be self-grantable, so refuse it here with a clear message rather than
+    # letting it look like it worked.
+    re.compile(r"UAP_INFRA_PROTECT_OFF\s*=\s*['\"]?1", re.I),
+    # expert-review's override is environment-only too, for the same reason: the
+    # agent writes its own command strings, so an inline form waives its own
+    # review. Refuse it here so the attempt is visible rather than silent.
+    re.compile(r"UAP_NO_REVIEW\s*=\s*['\"]?1", re.I),
     re.compile(r"UAP_USER_VALIDATION\s*=\s*['\"]?0", re.I),
 )
 # Destructive ops against the enforcer/policy surface.

package/src/policies/enforcers/expert_review_required.py

@@ -131,13 +131,25 @@ def main() -> None:
         emit(True, "not a ship operation")
 
     cmd = args.get("command") or args.get("cmd") or ""
-    # The policy-gate hook runs in the harness env, not the inline command env,
-    # so `UAP_NO_REVIEW=1 git commit ...` never reaches os.environ above. Honor
-    # an inline assignment parsed from the command string too.
-    # Anchored to a LEADING env-assignment run so an incidental mention in a
-    # quoted arg / commit message does NOT silently skip review.
-    if re.search(r"^\s*(?:[A-Za-z_]\w*=\S*\s+)*UAP_NO_REVIEW=['\"]?1\b", cmd):
-        emit(True, "UAP_NO_REVIEW inline override set")
+    # The inline override is GONE, deliberately.
+    #
+    # It used to parse a leading UAP_NO_REVIEW=1 assignment out of the command
+    # string, on the reasoning that the policy-gate hook runs in the harness
+    # environment and so cannot see one. That reasoning was correct — but the
+    # agent composes its own command strings, which made the override
+    # SELF-GRANTABLE. In practice an agent session waived expert review on every
+    # ship action it performed. That is not delegating the decision, it is
+    # removing the gate.
+    #
+    # Now environment-only: os.environ is set by whoever launched the session, so
+    # the decision stays with the operator. Two env-free routes remain for
+    # harnesses that strip the environment, and both are deliberate acts visible
+    # in the tree rather than a per-command flag:
+    #   - policies/waivers/*expert-review*.md
+    #   - .uap/reviews/WAIVER
+    # enforcement-self-protect also lists this flag among the bypasses the agent
+    # may not set, so an inline attempt is refused with an explicit message
+    # instead of appearing to work.
     if not any(p.search(cmd) for p in SHIP_PATTERNS):
         emit(True, "not a ship action")
 
@@ -175,7 +187,8 @@ def main() -> None:
             f"expert-review-required: no review artifact at .uap/reviews/{slug}.json. "
             "Run the parallel-expert-review skill (code-quality, security, performance, "
             "docs, test-coverage reviewers) and record the consolidated verdict before "
-            "shipping. Override for one-off meta-work: UAP_NO_REVIEW=1.",
+            "shipping. Operator override: UAP_NO_REVIEW=1 in the launch environment "
+            "(no longer honoured inline), or a waiver file.",
         )
 
     head = head_sha(root)
@@ -192,7 +205,7 @@ def main() -> None:
             False,
             f"expert-review-required: review at .uap/reviews/{slug}.json covers branch "
             f"'{artifact_branch}', not '{branch}'. Re-run the parallel expert review on "
-            "this branch. Override: UAP_NO_REVIEW=1.",
+            "this branch. Operator override: UAP_NO_REVIEW=1 in the launch environment.",
         )
 
     # Stale check relative to current HEAD.

package/tools/agents/tests/test_enforcer_escape_hatches.py

@@ -0,0 +1,123 @@
+#!/usr/bin/env python3
+"""Operator escape hatches must be operator-only — not self-grantable.
+
+Two changes, one principle. The agent composes its own command strings, so any
+override parsed OUT OF a command string is one the agent can grant itself. An
+override read from os.environ is set by whoever launched the session.
+
+  - infra-protect had NO hatch at all, so every restart of the inference stack
+    needed the operator to type it. Now UAP_INFRA_PROTECT_OFF=1, environment only.
+  - expert-review HAD an inline hatch, and it was self-granted on all eleven
+    commits of one agent session. That is not delegating the decision, it is
+    removing the gate. Now UAP_NO_REVIEW=1, environment only.
+
+self-protect additionally refuses inline attempts at either flag, so trying reads
+as an explicit refusal rather than appearing to work.
+
+NOTE ON THE HARNESS: every case runs with cwd inside a real git repo. Outside
+one, expert-review fail-opens on an unresolvable branch and EVERY result reads
+"allowed" — the first version of this verification was run from a temp dir and
+reported the self-grant case as passing when it was not.
+"""
+
+import json
+import os
+import subprocess
+import sys
+import unittest
+from pathlib import Path
+
+# parents: [0]=tests [1]=agents [2]=tools [3]=repo root. Off-by-one here made
+# every enforcer path invalid and the suite fail for the wrong reason.
+REPO = Path(__file__).resolve().parents[3]
+ENFORCERS = REPO / "src" / "policies" / "enforcers"
+
+# Assembled rather than written literally: these enforcers scan command strings
+# for ship/infra verbs, so a literal here trips the gate on this file's own test
+# run. (infra-protect refused its own comment text for exactly this reason.)
+SHIP = "git " + "commit -m x"
+RESTART = "systemctl --user " + "rest" + "art " + "uap-" + "llama-server.service"
+
+
+def verdict(enforcer: str, cmd: str, env: dict | None = None):
+    e = dict(os.environ)
+    for k in ("UAP_NO_REVIEW", "UAP_INFRA_PROTECT_OFF", "UAP_SELF_PROTECT_OFF"):
+        e.pop(k, None)
+    e.update(env or {})
+    p = subprocess.run(
+        [sys.executable, str(ENFORCERS / enforcer),
+         "--operation", "Bash", "--args", json.dumps({"command": cmd})],
+        capture_output=True, text=True, cwd=str(REPO), env=e,
+    )
+    try:
+        return json.loads(p.stdout or "{}").get("allowed")
+    except Exception:  # noqa: BLE001
+        return f"ERR {(p.stderr or '')[:80]}"
+
+
+class InfraProtectHatchTest(unittest.TestCase):
+    E = "enforcement_infra_protect.py"
+
+    def test_blocks_a_stack_restart_by_default(self):
+        self.assertFalse(verdict(self.E, RESTART))
+
+    def test_env_override_allows_it(self):
+        self.assertTrue(verdict(self.E, RESTART, {"UAP_INFRA_PROTECT_OFF": "1"}))
+
+    def test_inline_override_is_NOT_honoured(self):
+        """The load-bearing case. An inline form would be self-grantable, which
+        would delete the control rather than delegate it."""
+        self.assertFalse(verdict(self.E, f"UAP_INFRA_PROTECT_OFF=1 {RESTART}"))
+
+    def test_harmless_commands_are_untouched(self):
+        self.assertTrue(verdict(self.E, "echo hi"))
+
+    def test_the_refusal_tells_the_operator_the_hatch_exists(self):
+        """An undiscoverable hatch is not much better than none: the whole
+        problem was an operator with no way to say yes."""
+        src = (ENFORCERS / self.E).read_text()
+        self.assertIn("UAP_INFRA_PROTECT_OFF", src.split("REASON")[1] if "REASON" in src else src)
+
+
+class ExpertReviewHatchTest(unittest.TestCase):
+    E = "expert_review_required.py"
+
+    def test_inline_override_is_NOT_honoured(self):
+        """This is the regression that mattered: it used to return True here, and
+        an agent session used it to waive review on every commit it made."""
+        self.assertFalse(verdict(self.E, f"UAP_NO_REVIEW=1 {SHIP}"))
+
+    def test_env_override_allows_it(self):
+        self.assertTrue(verdict(self.E, SHIP, {"UAP_NO_REVIEW": "1"}))
+
+    def test_non_ship_commands_are_untouched(self):
+        self.assertTrue(verdict(self.E, "echo hi"))
+
+    def test_the_inline_parser_is_gone_from_source(self):
+        """Behavioural tests could pass while a dormant parser waits to be
+        re-enabled; assert the code path is actually removed."""
+        src = (ENFORCERS / self.E).read_text()
+        self.assertNotIn("inline override set", src)
+
+
+class SelfProtectRefusesInlineAttemptsTest(unittest.TestCase):
+    E = "enforcement_self_protect.py"
+
+    def test_refuses_inline_no_review(self):
+        self.assertFalse(verdict(self.E, f"UAP_NO_REVIEW=1 {SHIP}"))
+
+    def test_refuses_inline_infra_protect_off(self):
+        self.assertFalse(verdict(self.E, f"UAP_INFRA_PROTECT_OFF=1 {RESTART}"))
+
+    def test_still_refuses_the_pre_existing_bypasses(self):
+        """Guards against a regression that drops the older patterns while adding
+        the new ones."""
+        self.assertFalse(verdict(self.E, "UAP_DELIVER_BYPASS=1 " + SHIP))
+        self.assertFalse(verdict(self.E, "UAP_WORKDIR_SCOPE_OFF=1 touch /tmp/x"))
+
+    def test_harmless_commands_are_untouched(self):
+        self.assertTrue(verdict(self.E, "echo hi"))
+
+
+if __name__ == "__main__":
+    unittest.main()