@miller-tech/uap 1.175.6 → 1.175.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.175.6",
+  "version": "1.175.10",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break",
+    "test:enforcers": "python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",

package/tools/agents/scripts/anthropic_proxy.py

@@ -325,22 +325,74 @@ _HARNESS_CORRECTIVE_RE = re.compile(
 )
 
 
+# A tool result that declares its own SUCCESS is not a failure, whatever words
+# appear in its prose.
+#
+# _ERROR_LINE_RE matches on tokens ("failed", "error", "not found"), so it reads
+# a NEGATED failure as a failure. Observed live (2026-07-31): the deliver
+# follow-mode poll returns
+#
+#   {"ok":true,...,"note":"The deliver run (pid 774213) is STILL RUNNING after
+#    45s. It has not failed -- this wait gave up, the mission did not. ..."}
+#
+# and "failed", inside the sentence saying it had NOT failed, produced an error
+# signature. Three identical healthy polls then tripped the ERROR-LOOP guard,
+# which told the model to re-read its failing output. The model concluded the
+# tool was stuck for 10+ minutes, abandoned follow mode, hand-rolled
+# `sleep 60 && ls` polling, and finally collided with "a deliver run is already
+# in progress" -- a mission that was healthy the whole time.
+#
+# The sentence was written to REASSURE the model it had not failed. Reading the
+# structured verdict instead of the prose is what makes that safe to say.
+_SUCCESS_ENVELOPE_RE = re.compile(r'"ok"\s*:\s*true', re.IGNORECASE)
+_ERROR_FIELD_RE = re.compile(r'"error"\s*:\s*(?!null|""|\s*[,}])', re.IGNORECASE)
+
+# "it has not failed", "did not fail", "no errors" -- a denial of failure, in
+# plain prose that carries no ok:true envelope to consult.
+_NEGATED_FAILURE_RE = re.compile(
+    r"\b(?:has\s+not|have\s+not|had\s+not|did\s+not|does\s+not|is\s+not|was\s+not|"
+    r"were\s+not|not|no|never|without)\s+"
+    r"(?:\w+\s+){0,2}?(?:fail(?:ed|ure|s)?|error(?:ed|s)?|crash(?:ed|es)?)\b",
+    re.IGNORECASE,
+)
+
+
+def _is_successful_result(text: str) -> bool:
+    """True when the payload structurally declares success.
+
+    Only an `"ok": true` envelope with no populated `"error"` field counts. A
+    bare `"ok": true` alongside a real error field is treated as a failure,
+    because a partial success that still reports an error is one the model needs
+    to see."""
+    if not _SUCCESS_ENVELOPE_RE.search(text):
+        return False
+    return not _ERROR_FIELD_RE.search(text)
+
+
 def _error_signature(text: str) -> str:
     """Edit-invariant signature of the first error line in a tool result.
 
     Normalizes away paths, line:col numbers, hex, and bare digits so that the
     SAME underlying failure produces the SAME signature across turns even as the
     model edits different code around it. Returns "" when no error line is found
-    (a passing result resets the streak), and "" for the harness's own
-    correctives -- see _HARNESS_CORRECTIVE_RE."""
+    (a passing result resets the streak), "" for the harness's own correctives
+    (_HARNESS_CORRECTIVE_RE), and "" for results that declare success
+    (_is_successful_result) or explicitly deny failure (_NEGATED_FAILURE_RE)."""
     if not text:
         return ""
+    # Checked against the WHOLE payload, before line matching: the ok:true lives
+    # at the head of the envelope while the failure-shaped token can be anywhere
+    # in a long note.
+    if _is_successful_result(text):
+        return ""
     m = _ERROR_LINE_RE.search(text)
     if not m:
         return ""
     line = m.group(0)
     if _HARNESS_CORRECTIVE_RE.search(line):
         return ""
+    if _NEGATED_FAILURE_RE.search(line):
+        return ""
     line = re.sub(r"(/[^\s:]+)+", "<path>", line)          # unix paths
     line = re.sub(r"\b[0-9a-fA-F]{6,}\b", "<hex>", line)    # hashes/addresses
     line = re.sub(r"\d+", "#", line)                        # line numbers, counts

package/tools/agents/tests/test_enforcer_escape_hatches.py

@@ -14,16 +14,30 @@ override read from os.environ is set by whoever launched the session.
 self-protect additionally refuses inline attempts at either flag, so trying reads
 as an explicit refusal rather than appearing to work.
 
-NOTE ON THE HARNESS: every case runs with cwd inside a real git repo. Outside
-one, expert-review fail-opens on an unresolvable branch and EVERY result reads
-"allowed" — the first version of this verification was run from a temp dir and
-reported the self-grant case as passing when it was not.
+NOTE ON THE HARNESS: every case runs with cwd inside a real git repo, ON A
+BRANCH, with no review artifact. All three conditions are load-bearing, and each
+one silently inverts a result when it is missing:
+
+  - outside a git repo, or on a DETACHED head, expert-review cannot resolve a
+    branch and fail-opens, so every result reads "allowed". The first version of
+    this verification ran from a temp dir and reported the self-grant case as
+    passing when it was not. The second ran with cwd=REPO, which is detached in
+    CI (checkout of a merge ref) — green locally, red in CI, for the same reason.
+  - inside THIS repo on a feature branch, a review artifact usually exists, and
+    expert-review then allows the ship on its own merits. The test would pass or
+    fail depending on whether the working session happened to record one.
+
+So the fixture is a throwaway repo built here, not the checkout the suite runs
+in. A test of a security control must not depend on the mood of its surroundings.
 """
 
+import atexit
 import json
 import os
+import shutil
 import subprocess
 import sys
+import tempfile
 import unittest
 from pathlib import Path
 
@@ -39,6 +53,28 @@ SHIP = "git " + "commit -m x"
 RESTART = "systemctl --user " + "rest" + "art " + "uap-" + "llama-server.service"
 
 
+def _make_fixture_repo() -> Path:
+    """A throwaway git repo on a branch, with no review artifact.
+
+    Deterministic in every environment: local checkout, CI's detached merge ref,
+    or a bare container. See the module docstring for what each missing
+    condition would silently do to the results."""
+    proj = Path(tempfile.mkdtemp(prefix="uap-hatch-"))
+    atexit.register(shutil.rmtree, proj, True)
+    run = lambda *a: subprocess.run(a, cwd=proj, check=True, capture_output=True)  # noqa: E731
+    run("git", "init", "-q", "-b", "feature/escape-hatch-fixture")
+    (proj / "f.txt").write_text("x\n")
+    run("git", "add", "-A")
+    # --no-verify: the repo's own hooks are not under test here, and a hook that
+    # blocks would leave the fixture without the commit the enforcers look for.
+    run("git", "-c", "user.email=t@t", "-c", "user.name=t",
+        "commit", "-qm", "init", "--no-verify")
+    return proj
+
+
+PROJECT = _make_fixture_repo()
+
+
 def verdict(enforcer: str, cmd: str, env: dict | None = None):
     e = dict(os.environ)
     for k in ("UAP_NO_REVIEW", "UAP_INFRA_PROTECT_OFF", "UAP_SELF_PROTECT_OFF"):
@@ -47,7 +83,7 @@ def verdict(enforcer: str, cmd: str, env: dict | None = None):
     p = subprocess.run(
         [sys.executable, str(ENFORCERS / enforcer),
          "--operation", "Bash", "--args", json.dumps({"command": cmd})],
-        capture_output=True, text=True, cwd=str(REPO), env=e,
+        capture_output=True, text=True, cwd=str(PROJECT), env=e,
     )
     try:
         return json.loads(p.stdout or "{}").get("allowed")
@@ -55,6 +91,32 @@ def verdict(enforcer: str, cmd: str, env: dict | None = None):
         return f"ERR {(p.stderr or '')[:80]}"
 
 
+class FixtureIsSoundTest(unittest.TestCase):
+    """If the fixture degrades, every hatch test below passes vacuously.
+
+    expert-review fail-opens when it cannot resolve a branch, so a broken
+    fixture turns "the self-grant was refused" into "everything is allowed" —
+    a suite that reports the security control working while it is bypassed.
+    That is precisely how this file was green locally and red in CI."""
+
+    def test_the_fixture_is_a_git_repo_on_a_named_branch(self):
+        got = subprocess.run(["git", "symbolic-ref", "--short", "HEAD"],
+                             cwd=str(PROJECT), capture_output=True, text=True)
+        assert got.returncode == 0, f"fixture has no branch (detached?): {got.stderr.strip()}"
+        assert got.stdout.strip() == "feature/escape-hatch-fixture", got.stdout
+
+    def test_the_fixture_has_no_review_artifact(self):
+        # With one present, expert-review allows the ship on its own merits and
+        # the refusal tests below stop testing anything.
+        assert not (PROJECT / ".uap" / "reviews").exists()
+
+    def test_expert_review_actually_engages_in_the_fixture(self):
+        # The positive control: a plain ship must be REFUSED here. If this ever
+        # reads True, the enforcer is fail-opening and every assertion that
+        # something was "refused" is meaningless.
+        assert verdict("expert_review_required.py", SHIP) is False
+
+
 class InfraProtectHatchTest(unittest.TestCase):
     E = "enforcement_infra_protect.py"
 

package/tools/agents/tests/test_enforcer_suite_coverage.py

@@ -0,0 +1,91 @@
+"""The Python test gate must actually run the tests it claims to.
+
+`npm run test:enforcers` is an EXPLICIT module list handed to
+`python -m unittest`, not discovery. Two silent failure modes follow, and both
+had occurred by 2026-07-31:
+
+1. A module exists but is not listed. 37 of 51 were unlisted; 34 of those passed
+   perfectly well. The guardrail suites — error-loop, deferral-break,
+   stuck-break, session-admission, cycle-break — had no CI coverage at all,
+   which is how the same guards kept regressing on green PRs.
+
+2. A module is listed but contains no unittest.TestCase subclasses.
+   `python -m unittest` collects nothing from a plain pytest-style class,
+   reports "Ran 0 tests / NO TESTS RAN", and exits 0. The suite looks covered
+   and asserts nothing.
+
+Both are invisible in a green build, which is exactly why they need a test.
+"""
+
+import json
+import re
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[3]
+TESTS = Path(__file__).resolve().parent
+
+# Verified failing for their own pre-existing reasons, not by omission. Each
+# entry is a debt with a stated cause — not a place to park a newly broken test.
+KNOWN_EXCLUDED = {
+    "test_anthropic_proxy_streaming": "behaviour drifted from the assertions",
+    "test_delivery_enforcement_worktree": "behaviour drifted from the assertions",
+    "test_uap_compliance": "needs a populated DB; environment-bound",
+}
+
+
+def _listed_modules() -> set:
+    script = json.loads((ROOT / "package.json").read_text())["scripts"]["test:enforcers"]
+    return set(re.findall(r"tools\.agents\.tests\.(\w+)\b", script))
+
+
+def _modules_on_disk() -> set:
+    return {p.stem for p in TESTS.glob("test_*.py")}
+
+
+class TestEveryModuleIsListed(unittest.TestCase):
+    def test_no_test_module_is_silently_unlisted(self):
+        missing = _modules_on_disk() - _listed_modules() - set(KNOWN_EXCLUDED)
+        assert missing == set(), (
+            f"these test modules exist but CI never runs them: {sorted(missing)}. "
+            "Add them to the test:enforcers script, or record them in "
+            "KNOWN_EXCLUDED with the reason they cannot run."
+        )
+
+    def test_the_exclusion_list_does_not_name_files_that_are_gone(self):
+        # A stale exclusion silently re-opens the hole it was documenting.
+        stale = set(KNOWN_EXCLUDED) - _modules_on_disk()
+        assert stale == set(), f"KNOWN_EXCLUDED names modules that no longer exist: {sorted(stale)}"
+
+    def test_an_excluded_module_is_not_also_listed(self):
+        both = set(KNOWN_EXCLUDED) & _listed_modules()
+        assert both == set(), f"listed AND marked excluded — one of the two is wrong: {sorted(both)}"
+
+
+class TestEveryListedModuleActuallyCollects(unittest.TestCase):
+    def test_listed_modules_define_unittest_testcases(self):
+        # The "Ran 0 tests" trap: a listed module made of plain classes
+        # contributes nothing and still exits 0.
+        empty = []
+        for name in sorted(_listed_modules()):
+            path = TESTS / f"{name}.py"
+            if not path.exists():
+                continue  # covered by the stale-name test below
+            src = path.read_text()
+            has_case = re.search(r"class\s+\w+\s*\(\s*[\w.]*TestCase\s*\)", src)
+            # A module may instead expose bare `def test_*` at module level,
+            # which unittest also does not collect — so that is not a rescue.
+            if not has_case:
+                empty.append(name)
+        assert empty == [], (
+            f"listed in test:enforcers but define no unittest.TestCase, so they run "
+            f"zero tests and pass: {empty}"
+        )
+
+    def test_every_listed_module_exists(self):
+        ghosts = {n for n in _listed_modules() if not (TESTS / f"{n}.py").exists()}
+        assert ghosts == set(), f"test:enforcers names modules that do not exist: {sorted(ghosts)}"
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_error_loop_ignores_correctives.py

@@ -18,32 +18,47 @@ making progress.
 The distinction the fix encodes: a CORRECTIVE is the harness talking to the model
 about its behaviour; an ERROR is a tool reporting that something did not work.
 Only the latter belongs in the streak.
+
+The same guard fired again on 2026-07-31, on the opposite side: deliver's
+follow-mode poll returns `{"ok":true, ... "It has not failed — this wait gave up,
+the mission did not."}`, and the word "failed", inside the sentence saying it had
+NOT failed, produced an error signature. See TestSuccessfulResultsAreNotFailures.
+
+NOTE ON THE TEST RUNNER: these classes MUST subclass unittest.TestCase. CI runs
+`npm run test:enforcers`, which is `python3 -m unittest <explicit module list>`,
+and unittest collects nothing from a plain pytest-style class — this file
+reported "Ran 0 tests / NO TESTS RAN" while appearing to be covered. Adding a
+class here without TestCase, or adding a module without listing it in
+test:enforcers, produces a test that never runs.
 """
 
 import re
+import unittest
 from pathlib import Path
 
 PROXY = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
 
 
 def _load_signature():
-    """Extract _error_signature and its patterns without importing the server."""
+    """Extract _error_signature and its patterns without importing the server.
+
+    Takes ONE contiguous slice, from the first pattern through the end of
+    _error_signature, rather than cherry-picking names. The previous version
+    exec'd a hardcoded list of regexes, so adding a helper to the proxy left the
+    test raising NameError against its own source -- the loader had to be edited
+    in lockstep with any new dependency."""
     src = PROXY.read_text()
     ns = {"re": re}
-    for name in ("_ERROR_LINE_RE", "_HARNESS_CORRECTIVE_RE"):
-        start = src.index(f"{name} = re.compile(")
-        end = src.index(")\n", src.index("re.", start + 20)) + 1
-        exec(src[start:end], ns)  # noqa: S102 - reading our own source, not input
-    start = src.index("def _error_signature")
-    end = src.index("\n# ---", start)
-    exec(src[start:end], ns)  # noqa: S102
+    start = src.index("_ERROR_LINE_RE = re.compile(")
+    end = src.index("\n# ---", src.index("def _error_signature"))
+    exec(src[start:end], ns)  # noqa: S102 - reading our own source, not input
     return ns["_error_signature"]
 
 
 _error_signature = _load_signature()
 
 
-class TestHarnessCorrectivesAreNotFailures:
+class TestHarnessCorrectivesAreNotFailures(unittest.TestCase):
     def test_write_nudge_does_not_enter_the_failure_streak(self):
         # The exact line from the incident.
         assert _error_signature("[agent r6 error] write-nudge injected after 5 read-only rounds") == ""
@@ -64,7 +79,7 @@ class TestHarnessCorrectivesAreNotFailures:
         assert {_error_signature(line) for _ in range(6)} == {""}
 
 
-class TestRealFailuresStillTracked:
+class TestRealFailuresStillTracked(unittest.TestCase):
     def test_tool_errors_still_produce_a_signature(self):
         for line in (
             "ERROR: TypeError: x is not a function at /a/b.js:12",
@@ -90,3 +105,62 @@ class TestRealFailuresStillTracked:
         # become a way to hide real errors behind a nudge.
         text = "ERROR: ReferenceError: foo is not defined\n[agent r6 error] write-nudge injected"
         assert _error_signature(text) != ""
+
+
+# The follow-mode incident, 2026-07-31.
+FOLLOW_POLL = (
+    '{"ok":true,"dryRun":false,"exitCode":0,"note":"The deliver run (pid 774213) is '
+    "STILL RUNNING after 45s. It has not failed — this wait gave up, the mission did "
+    "not. This is the NORMAL answer for a mission that takes longer than one poll, and "
+    "the run is healthy. Call deliver again with follow:true to keep waiting. Do NOT "
+    'kill the deliver process."}'
+)
+
+
+class TestSuccessfulResultsAreNotFailures(unittest.TestCase):
+    def test_the_healthy_follow_poll_produces_no_signature(self):
+        # Reproduces the incident exactly: "failed", inside the sentence saying
+        # it had NOT failed, made a healthy poll look like a failure.
+        assert _error_signature(FOLLOW_POLL) == ""
+
+    def test_three_identical_healthy_polls_cannot_arm_the_guard(self):
+        # Three was the threshold. This is the whole bug: waiting patiently, as
+        # instructed, was what tripped the loop guard.
+        assert {_error_signature(FOLLOW_POLL) for _ in range(3)} == {""}
+
+    def test_ok_true_beats_failure_words_anywhere_in_the_note(self):
+        assert _error_signature('{"ok":true,"note":"0 tests failed, no errors"}') == ""
+
+    def test_a_populated_error_field_still_counts_despite_ok_true(self):
+        # A partial success that still reports an error is one the model needs
+        # to see; ok:true must not become a way to launder real failures.
+        text = '{"ok":true,"error":"ENOENT: cannot find module foo"}'
+        assert _error_signature(text) != ""
+
+    def test_an_empty_error_field_does_not_count(self):
+        assert _error_signature('{"ok":true,"error":null,"note":"nothing failed"}') == ""
+        assert _error_signature('{"ok":true,"error":"","note":"nothing failed"}') == ""
+
+    def test_ok_false_is_still_a_failure(self):
+        text = '{"ok":false,"error":"a deliver run is already in progress"}'
+        assert _error_signature(text) != ""
+
+
+class TestDeniedFailuresInPlainProse(unittest.TestCase):
+    def test_a_denial_of_failure_is_not_a_failure(self):
+        # No ok:true envelope to consult — the prose itself has to be read.
+        for line in (
+            "The build has not failed; it is still compiling.",
+            "The run did not fail — it is waiting on the model.",
+            "Completed with no errors.",
+            "Finished without errors.",
+        ):
+            assert _error_signature(line) == "", line
+
+    def test_a_plain_assertion_of_failure_still_counts(self):
+        for line in (
+            "The build failed.",
+            "ERROR: the run failed after 3 retries",
+            "2 tests failed",
+        ):
+            assert _error_signature(line) != "", line