@miller-tech/uap 1.175.4 → 1.175.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.175.4",
+  "version": "1.175.5",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/src/policies/enforcers/enforcement_self_protect.py

@@ -60,6 +60,19 @@ BYPASS_PATTERNS = (
     # review. Refuse it here so the attempt is visible rather than silent.
     re.compile(r"UAP_NO_REVIEW\s*=\s*['\"]?1", re.I),
     re.compile(r"UAP_USER_VALIDATION\s*=\s*['\"]?0", re.I),
+    # Single-flight is a DATA-SAFETY control, not a policy preference: deliver
+    # runs each candidate in a git worktree, and two runs against one repo are
+    # not safe together. Disabling it cost real work — observed live
+    # (octopus_invaders_v3, 2026-07-31): the agent ran
+    # `UAP_DELIVER_NO_LOCK=1 uap deliver ...`, two runs overlapped for seven
+    # minutes, and the untracked space-shooter/ tree they were both building
+    # disappeared. It had never been committed, so nothing could recover it.
+    #
+    # The env var stays a real operator hatch; only the INLINE form is refused,
+    # because a switch the constrained party writes into its own command line is
+    # not an override — it is an off switch, the same reasoning as every entry
+    # above it.
+    re.compile(r"UAP_DELIVER_NO_LOCK\s*=\s*['\"]?1", re.I),
 )
 # Destructive ops against the enforcer/policy surface.
 #

package/tools/agents/tests/test_enforcement_self_protect.py

@@ -49,6 +49,29 @@ class SelfProtectTest(unittest.TestCase):
         rc, out = run("Bash", {"command": "UAP_ENFORCE_DELIVERY=advisory uap deliver x"})
         self.assertEqual(rc, 2)
 
+    def test_blocks_inline_single_flight_bypass(self):
+        """Single-flight is a DATA-SAFETY control, not a preference.
+
+        deliver runs each candidate in a git worktree, and two runs against one
+        repo are not safe together. Observed live (octopus_invaders_v3,
+        2026-07-31): the agent ran `UAP_DELIVER_NO_LOCK=1 uap deliver ...`, two
+        runs overlapped for seven minutes, and the untracked tree they were both
+        building disappeared. It had never been committed, so nothing could
+        recover it.
+        """
+        rc, out = run("Bash", {"command": "UAP_DELIVER_NO_LOCK=1 uap deliver -- build it"})
+        self.assertEqual(rc, 2)
+
+    def test_blocks_exported_single_flight_bypass(self):
+        rc, out = run("Bash", {"command": "export UAP_DELIVER_NO_LOCK=1 && uap deliver -- x"})
+        self.assertEqual(rc, 2)
+
+    def test_allows_merely_mentioning_the_override(self):
+        # The env var remains a real OPERATOR hatch; only the agent writing it
+        # into its own command line is refused. Talking about it is not doing it.
+        rc, out = run("Bash", {"command": "echo 'UAP_DELIVER_NO_LOCK is an operator override'"})
+        self.assertEqual(rc, 0)
+
     def test_blocks_bash_rm_enforcer(self):
         rc, out = run("Bash", {"command": "rm -f .policy-tools/abc_delivery_enforcement.py"})
         self.assertEqual(rc, 2)