@miller-tech/uap 1.184.4 → 1.184.6

package/src/policies/enforcers/codebase_read_before_plan.py

@@ -8,7 +8,7 @@ import time
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).parent))
-from _common import arg_str, emit, parse_cli, repo_root  # noqa: E402
+from _common import arg_str, emit, parse_cli, repo_root, recent_evidence  # noqa: E402
 
 PLAN_OPS = {"ExitPlanMode", "Plan", "TodoWrite"}
 PLAN_WORD_RE = re.compile(r"(?<![-\w/])(plan the|design the|architect the|propose a plan|spec the)", re.I)
@@ -66,9 +66,16 @@ def main() -> None:
     if op not in PLAN_OPS and not PLAN_WORD_RE.search(blob):
         emit(True, "not a plan op")
 
+    # Prefer the protected evidence log; fall back to the legacy read_log while
+    # installs catch up. The legacy file is shell-writable, so it is accepted
+    # but no longer the only source.
+    trusted = recent_evidence("reads", RECENT_SEC, repo_root())
+    if trusted:
+        emit(True, f"{trusted} recent codebase reads on record (evidence)")
+
     reads = recent_reads()
     if reads:
-        emit(True, f"{len(reads)} recent codebase reads on record")
+        emit(True, f"{len(reads)} recent codebase reads on record (legacy log)")
 
     if not writer_installed():
         emit(True, "read-log writer hook not installed — gate advisory (run `uap hooks install`)")

package/src/policies/enforcers/enforcement_self_protect.py

@@ -112,6 +112,12 @@ PROTECTED_TARGETS = (
     "src/policies",
     "policies/",
     ".uap/interaction",
+    # Gate evidence. The rest of .uap/ stays permissive on purpose (the tooling
+    # writes runtime state there constantly), but these records are what the
+    # plan-time gates accept as proof a required action happened. Leaving them
+    # shell-writable meant a single append could satisfy a gate — which is
+    # exactly how one was satisfied during development.
+    ".uap/evidence",
     ".uap.json",
     "anthropic-proxy.env",
 )

package/src/policies/enforcers/expert_review_required.py

@@ -43,7 +43,24 @@ SHIP_PATTERNS = (
 # Additional, command-position detection: `git -C <path> push` is a real ship
 # action that the patterns above never matched (they require git and the
 # subcommand to be adjacent). Unioned with them, so it only ever ADDS coverage.
-GIT_SHIP_SUBCOMMANDS = frozenset({"commit", "push", "merge"})
+# Porcelain verbs, plus the plumbing that does the same job under another
+# name. `git send-pack` IS a push (push is a wrapper around it) and
+# `commit-tree` + `update-ref` is a commit; neither says "push" or "commit".
+GIT_SHIP_SUBCOMMANDS = frozenset({
+    "commit", "push", "merge",
+    "send-pack", "commit-tree", "update-ref", "fast-import",
+})
+
+# `gh api` reaches the same endpoints without ever saying "pr merge":
+#   gh api -X PUT repos/o/r/pulls/1/merge
+#   gh api graphql -f query=mutation{mergePullRequest(...)}
+GH_API_SHIP_RE = re.compile(
+    r"pulls/[^/\s]+/merge"
+    r"|/merges\b"
+    r"|mergePullRequest"
+    r"|createPullRequest",
+    re.I,
+)
 GIT_VALUE_OPTIONS = frozenset({"-C", "-c", "--git-dir", "--work-tree", "--namespace"})
 WRAPPER_VERBS = frozenset({
     "rtk", "env", "nohup", "sudo", "time", "command", "timeout", "stdbuf",
@@ -100,7 +117,28 @@ def _mask_prose(text: str) -> str:
     return text if quote is not None else "".join(out)
 
 
-def _ships_at_command_position(text: str) -> bool:
+def _git_ship_aliases(root: Path) -> frozenset[str]:
+    """Alias names that expand to a ship subcommand.
+
+    `git p` is a push when the user's gitconfig says so, and a scanner that
+    only knows the porcelain verbs never sees it. git itself is the authority,
+    so ask it. Empty on any failure — this only ever ADDS coverage.
+    """
+    rc, out, _ = run(["git", "config", "--get-regexp", r"^alias" + chr(92) + "."], cwd=root)
+    if rc != 0 or not out.strip():
+        return frozenset()
+
+    found = set()
+    for line in out.splitlines():
+        name, _, expansion = line.partition(" ")
+        alias = name.split(".", 1)[1] if "." in name else ""
+        first = expansion.strip().lstrip("!").split()
+        if alias and first and first[0].lower() in GIT_SHIP_SUBCOMMANDS:
+            found.add(alias.lower())
+    return frozenset(found)
+
+
+def _ships_at_command_position(text: str, root: Path | None = None) -> bool:
     """True when a segment's VERB is git with a ship subcommand.
 
     Only used to add `git -C <path> push`; the patterns carry the rest.
@@ -118,8 +156,12 @@ def _ships_at_command_position(text: str) -> bool:
         rest, i = tokens[1:], 0
         while i < len(rest) and rest[i].startswith("-"):
             i += 2 if rest[i] in GIT_VALUE_OPTIONS else 1
-        if i < len(rest) and rest[i].lower() in GIT_SHIP_SUBCOMMANDS:
-            return True
+        if i < len(rest):
+            sub = rest[i].lower()
+            if sub in GIT_SHIP_SUBCOMMANDS:
+                return True
+            if root is not None and sub in _git_ship_aliases(root):
+                return True
     return False
 
 
@@ -146,7 +188,7 @@ def _only_inert_verbs(text: str) -> bool:
     return saw
 
 
-def is_ship_action(command: str) -> bool:
+def is_ship_action(command: str, root: Path | None = None) -> bool:
     """True when the command line PERFORMS a ship action.
 
     The patterns used to run against the raw string, so any text that merely
@@ -165,7 +207,14 @@ def is_ship_action(command: str) -> bool:
     scan = _mask_prose(text) if _only_inert_verbs(text) else text
     if any(p.search(scan) for p in SHIP_PATTERNS):
         return True
-    return _ships_at_command_position(text)
+
+    # `gh api` hitting a merge/create endpoint is a ship action however it is
+    # spelled. Checked on the same `scan` text, so quoted prose describing an
+    # endpoint is still prose.
+    if "gh" in scan and GH_API_SHIP_RE.search(scan):
+        return True
+
+    return _ships_at_command_position(text, root)
 
 # A ship action that NAMES a pull request. The review that matters is the one
 # for that PR's head branch, which is usually not the branch the shell is on.
@@ -351,7 +400,7 @@ def main() -> None:
     # enforcement-self-protect also lists this flag among the bypasses the agent
     # may not set, so an inline attempt is refused with an explicit message
     # instead of appearing to work.
-    if not is_ship_action(cmd):
+    if not is_ship_action(cmd, worktree_root()):
         emit(True, "not a ship action")
 
     # Resolve against the WORKING TREE the operation runs in (the worktree when a

package/src/policies/enforcers/memory_before_plan.py

@@ -8,7 +8,7 @@ import time
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).parent))
-from _common import arg_str, emit, parse_cli, repo_root, worktree_root  # noqa: E402
+from _common import arg_str, emit, parse_cli, repo_root, worktree_root, recent_evidence  # noqa: E402
 
 PLAN_OPS = {"ExitPlanMode", "Plan", "TodoWrite", "plan", "design"}
 # Only match standalone words, not compounds like 'validate-plan-on-change'
@@ -66,9 +66,14 @@ def main() -> None:
     if op not in PLAN_OPS and not PLAN_WORD_RE.search(blob):
         emit(True, "not a plan operation")
 
+    # Protected evidence first; the DB row is still accepted, but it is an
+    # ordinary row in a database the agent writes to constantly.
+    if recent_evidence("memory-queries", RECENT_SEC, repo_root()):
+        emit(True, "recent uap memory query on record (evidence)")
+
     for db in candidate_dbs():
         if recent_memory_query(db):
-            emit(True, "recent uap memory query on record")
+            emit(True, "recent uap memory query on record (db row)")
 
     emit(
         False,

package/src/policies/enforcers/workdir_scope.py

@@ -19,6 +19,25 @@ Allowed targets:
     UAP_WORKDIR_ALLOW.
 
 Escape hatch: UAP_WORKDIR_SCOPE_OFF=1 allows everything (operator override).
+
+SCOPE — read this before trusting it as a boundary.
+
+The Write/Edit path IS a boundary: it receives a concrete file path and
+checks it, with no parsing involved.
+
+The Bash path is DEFENCE IN DEPTH, not a boundary. It pattern-matches shell
+text rather than parsing shell, and three separate review rounds each found
+another construct the patterns missed: an escaped quote desyncing the mask,
+command substitution executing inside double quotes, a tilde- or
+variable-prefixed redirect target, a line continuation splitting a verb from
+its destination, a process substitution hiding its destination in parens.
+Each was fixed; the pattern is that there is always another one, because a
+regex over command text cannot know what a shell will do with it.
+
+So it raises the cost of an accidental escape and catches the naive forms —
+which is what was actually observed in the wild. It does not stop a
+determined one. The real containment is the tool-level path check above,
+plus the fact that the agent cannot edit this file (enforcement-self-protect).
 """
 from __future__ import annotations
 

package/templates/hooks/post-tool-use-read.sh

@@ -52,6 +52,16 @@ REL="${REL//$'\r'/ }"
 printf -v NOW '%(%s)T' -1   # bash builtin; no `date` fork
 printf '%s\t%s\n' "$NOW" "$REL" >> "$LOG" 2>/dev/null || exit 0
 
+# Same record, in the protected evidence directory. This is the copy the gate
+# trusts: self-protect refuses agent writes to .uap/evidence/, while the log
+# above sits in the permissive part of .uap/ where a shell append is allowed.
+# Written here because a hook is not an agent tool call, so it is not gated.
+EVIDENCE_DIR="${STATE_DIR}/evidence"
+if [ -d "$EVIDENCE_DIR" ] || mkdir -p "$EVIDENCE_DIR" 2>/dev/null; then
+  EVIDENCE="${EVIDENCE_DIR}/reads.log"
+  [ -L "$EVIDENCE" ] || printf '%s\t%s\n' "$NOW" "$REL" >> "$EVIDENCE" 2>/dev/null || true
+fi
+
 # Bound the file. The enforcer only ever looks at a 30-minute window, so old
 # lines are dead weight. Sampled rather than checked every call: reading the log
 # on every Read to decide whether to trim costs more than the occasional

package/tools/agents/tests/test_expert_review_pr_scope.py

@@ -378,6 +378,34 @@ class TestShipDetectionIsCommandPosition(unittest.TestCase):
         self.assert_not_ship("printf " + SQ + "run gh pr merge later" + SQ)
         self.assert_not_ship("cat docs/merge-strategy.md")
 
+    # --- verbs that ship without saying "push" or "merge" ---
+    #
+    # Catalogued as gaps that pattern-matching could not reach. Three of the
+    # four turned out to be reachable; the fourth (a variable holding the
+    # binary name, `G=git; $G push`) is not, because knowing what $G contains
+    # means running the shell — it is documented rather than half-solved.
+
+    def test_plumbing_push_is_a_ship_action(self):
+        # `git push` is a wrapper around send-pack. Same effect, different verb.
+        self.assert_ship("git send-pack origin HEAD:refs/heads/main")
+
+    def test_plumbing_commit_is_a_ship_action(self):
+        self.assert_ship("git commit-tree abc123 -m msg")
+
+    def test_gh_api_rest_merge_is_a_ship_action(self):
+        # Merges the PR without the string "pr merge" appearing anywhere.
+        self.assert_ship("gh api -X PUT repos/owner/repo/pulls/1/merge")
+
+    def test_gh_api_graphql_merge_is_a_ship_action(self):
+        self.assert_ship(
+            "gh api graphql -f query=" + SQ + "mutation{mergePullRequest(input:{})}" + SQ
+        )
+
+    def test_prose_naming_a_merge_endpoint_is_still_prose(self):
+        # The endpoint patterns must not resurrect the false positives #649
+        # removed: naming an endpoint is not calling it.
+        self.assert_not_ship("echo " + SQ + "see repos/owner/repo/pulls/1/merge" + SQ)
+
     def test_read_only_git_is_not_a_ship_action(self):
         self.assert_not_ship("git diff --merge-base main")
         self.assert_not_ship("git status --short")

package/tools/agents/tests/test_gate_evidence.py

@@ -0,0 +1,141 @@
+#!/usr/bin/env python3
+"""Gate evidence must not be writable by the agent.
+
+Both plan-time gates accept "a record exists" as proof a required action
+happened. Those records used to sit where an agent could write them: a shell
+append to .uap/read_log.state was allowed (self-protect keeps its Bash scan
+deliberately permissive inside .uap/, which is mostly runtime state), and the
+memory_query record was an ordinary row in a database the agent writes to
+constantly. During development a gate was in fact satisfied by exactly such an
+append.
+
+Evidence now lives in .uap/evidence/, listed in self-protect's
+PROTECTED_TARGETS. Written only by the PostToolUse hook and the CLI — neither
+is an agent tool call, so neither is intercepted.
+
+This is not cryptographic and does not claim to be: forging evidence now costs
+the same as defeating self-protect for any other purpose, rather than one echo.
+"""
+
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+from pathlib import Path
+
+ENFORCERS = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers"
+SELF_PROTECT = ENFORCERS / "enforcement_self_protect.py"
+READ_GATE = ENFORCERS / "codebase_read_before_plan.py"
+MEM_GATE = ENFORCERS / "memory_before_plan.py"
+GT = chr(62)
+
+
+def run_enforcer(enforcer, op, args, root):
+    env = dict(os.environ)
+    env["UAP_REPO_ROOT"] = str(root)
+    env["UAP_WORKTREE_ROOT"] = str(root)
+    env["PYTHONPATH"] = str(ENFORCERS)
+    env.pop("UAP_SELF_PROTECT_OFF", None)
+    p = subprocess.run(
+        [sys.executable, str(enforcer), "--operation", op, "--args", json.dumps(args)],
+        capture_output=True, text=True, env=env, cwd=str(root),
+    )
+    try:
+        return json.loads(p.stdout)
+    except json.JSONDecodeError:
+        return {"allowed": True, "reason": f"<unparseable {p.stdout!r} {p.stderr!r}>"}
+
+
+class TestEvidenceIsNotAgentWritable(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.root = Path(self._tmp.name)
+        (self.root / ".uap" / "evidence").mkdir(parents=True)
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def _bash_blocked(self, cmd, label):
+        out = run_enforcer(SELF_PROTECT, "Bash", {"command": cmd}, self.root)
+        self.assertFalse(out.get("allowed"), f"{label}: {cmd!r} should be refused")
+
+    def test_shell_append_to_evidence_is_refused(self):
+        # The exact forgery that worked before.
+        self._bash_blocked("echo hi " + GT * 2 + " .uap/evidence/reads.log", "append")
+        self._bash_blocked(
+            "echo hi " + GT * 2 + " .uap/evidence/memory-queries.log", "append")
+
+    def test_other_writes_into_evidence_are_refused(self):
+        self._bash_blocked("echo hi | tee .uap/evidence/reads.log", "tee")
+        self._bash_blocked("cp /etc/hostname .uap/evidence/reads.log", "cp")
+        self._bash_blocked("rm -f .uap/evidence/reads.log", "rm")
+
+    def test_write_tool_into_evidence_is_refused(self):
+        out = run_enforcer(
+            SELF_PROTECT, "Write",
+            {"file_path": str(self.root / ".uap/evidence/reads.log")}, self.root)
+        self.assertFalse(out.get("allowed"), "Write into evidence should be refused")
+
+    def test_ordinary_uap_runtime_writes_still_work(self):
+        # The rest of .uap/ is runtime state the tooling writes constantly.
+        # Over-blocking it would break the project's own plumbing — the reason
+        # that scan was narrow to begin with.
+        for cmd in ["echo 0 " + GT + " .uap/verify-cadence",
+                    "echo x " + GT * 2 + " .uap/pending-deliver.jsonl"]:
+            out = run_enforcer(SELF_PROTECT, "Bash", {"command": cmd}, self.root)
+            self.assertTrue(out.get("allowed"), f"{cmd!r} must stay allowed")
+
+
+class TestGatesReadProtectedEvidence(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.root = Path(self._tmp.name)
+        (self.root / ".uap" / "evidence").mkdir(parents=True)
+        # Writer hook present, so the read gate enforces instead of degrading
+        # to advisory.
+        hooks = self.root / ".claude" / "hooks"
+        hooks.mkdir(parents=True)
+        (hooks / "post-tool-use-read.sh").write_text("#!/bin/sh\n")
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def _evidence(self, kind, age=0, detail="src/x.ts"):
+        path = self.root / ".uap" / "evidence" / f"{kind}.log"
+        with path.open("a") as f:
+            f.write(f"{int(time.time()) - age}\t{detail}\n")
+
+    def test_read_gate_accepts_fresh_evidence_and_blocks_without(self):
+        out = run_enforcer(READ_GATE, "ExitPlanMode", {}, self.root)
+        self.assertFalse(out.get("allowed"), "no evidence -> blocked")
+
+        self._evidence("reads")
+        out = run_enforcer(READ_GATE, "ExitPlanMode", {}, self.root)
+        self.assertTrue(out.get("allowed"), out.get("reason"))
+        self.assertIn("evidence", out.get("reason", ""))
+
+    def test_read_gate_still_blocks_on_stale_evidence(self):
+        self._evidence("reads", age=4000)      # past the 30-minute window
+        out = run_enforcer(READ_GATE, "ExitPlanMode", {}, self.root)
+        self.assertFalse(out.get("allowed"), "stale evidence must not satisfy the gate")
+
+    def test_memory_gate_accepts_fresh_evidence_and_blocks_without(self):
+        out = run_enforcer(MEM_GATE, "ExitPlanMode", {}, self.root)
+        self.assertFalse(out.get("allowed"), "no evidence -> blocked")
+
+        self._evidence("memory-queries", detail="a topic")
+        out = run_enforcer(MEM_GATE, "ExitPlanMode", {}, self.root)
+        self.assertTrue(out.get("allowed"), out.get("reason"))
+        self.assertIn("evidence", out.get("reason", ""))
+
+    def test_memory_gate_still_blocks_on_stale_evidence(self):
+        self._evidence("memory-queries", age=1000, detail="old")   # past 300s
+        out = run_enforcer(MEM_GATE, "ExitPlanMode", {}, self.root)
+        self.assertFalse(out.get("allowed"), "stale evidence must not satisfy the gate")
+
+
+if __name__ == "__main__":
+    unittest.main()