@miller-tech/uap 1.185.0 → 1.186.0

package/src/policies/enforcers/enforcement_self_protect.py

@@ -26,6 +26,7 @@ from pathlib import Path
 sys.path.insert(0, str(Path(__file__).parent))
 from _common import (  # noqa: E402
     emit, parse_cli, repo_root, REVIEW_ARTIFACT_DIR, REVIEW_WAIVER_DIR,
+    hands_text_to_shell,
 )
 
 EDIT_OPS = {"Edit", "Write", "MultiEdit", "edit", "write", "multiedit"}
@@ -128,56 +129,180 @@ _QUOTES = str.maketrans("", "", "\"'")
 
 
 def _mentions_protected(text: str) -> bool:
-    """True when the text names a protected path and no exempt sub-path."""
-    low = text.translate(_QUOTES).lower()
-    # Normalise ./ and leading slashes so `./.uap`, `/.uap` and `.uap` agree.
-    low = low.replace("./", "/")
-    if any(ex in low for ex in PROTECTED_EXEMPT):
-        return False
-    # The .uap DIRECTORY ITSELF: `rm -rf .uap` / `find .uap -delete` destroy the
-    # manifest along with everything else, while `echo 0 > .uap/verify-cadence`
-    # names a deeper path and is ordinary tooling. So the bare directory is
-    # protected; a specific file under it is not (unless listed below).
-    for m in re.finditer(re.escape(".uap"), low):
-        if low[m.end():m.end() + 1] in ("", " ", '"', "'", "*"):
-            return True
-    for target in PROTECTED_TARGETS:
-        t = target.lower()
-        # Word-ish boundary so `.uap` matches `.uap`, `.uap/x` and `.uap.bak`
-        # but not an unrelated longer name like `.uapkeep`.
-        for m in re.finditer(re.escape(t), low):
-            tail = low[m.end():m.end() + 1]
-            if tail in ("", "/", ".", " ", '"', "'", "*"):
+    """True when any UNIT of `text` names a protected path.
+
+    Judged unit by unit, not over the whole blob. The exemption used to be
+    evaluated across the entire text, so one `policies/waivers` anywhere made
+    everything else invisible — appending a single innocuous line to a deletion
+    list defeated the check completely (found by the review, reproduced).
+    """
+    for unit in text.translate(_QUOTES).lower().replace("./", "/").split():
+        if any(ex in unit for ex in PROTECTED_EXEMPT):
+            continue
+        # The .uap DIRECTORY ITSELF: `rm -rf .uap` destroys the manifest, while
+        # `echo 0 > .uap/verify-cadence` names a deeper path and is ordinary
+        # tooling. Bare directory protected; a file under it is not.
+        for m in re.finditer(re.escape(".uap"), unit):
+            if unit[m.end():m.end() + 1] in ("", " ", '"', "'", "*"):
                 return True
+        for target in PROTECTED_TARGETS:
+            t = target.lower()
+            for m in re.finditer(re.escape(t), unit):
+                if unit[m.end():m.end() + 1] in ("", "/", ".", " ", '"', "'", "*"):
+                    return True
     return False
 
 
-def _bash_destructive(command: str) -> bool:
-    """Destructive op against a protected path, judged per command segment."""
+# An argument list is a list of paths; it is never a megabyte. The old 1 MiB cap
+# also SKIPPED anything larger, so padding a list file past the cap was a
+# one-line bypass. Read a bounded prefix instead of skipping.
+_MAX_SRC_BYTES = 1 << 16
+_MAX_SOURCES = 32
+# Commands whose arguments are literal paths we can read now.
+_FILE_READERS = ("cat", "head", "tail", "sort", "uniq", "cut", "tr", "nl", "rev")
+_LITERAL_EMITTERS = ("echo", "printf")
+# Wrappers that hand their remaining words back to a shell as a command.
+_WRAPPERS = ("eval", "env", "exec", "source", ".")
+_SHELL_C = re.compile(
+    r"(?:^|[\s;|&(])(?:ba|z|k|da|a)?sh\s+(?:-\w+\s+)*-\w*c\s+(['\"])(.*?)\1", re.S)
+_REDIRECT = re.compile(r">>?")
+_SUBST_FILE = re.compile(r"\$\(\s*(?:cat\s+)?<?\s*([^\s)]+)[^)]*\)|`\s*cat\s+([^`]+)`")
+_ARGFILE = re.compile(r"--arg-file=([^\s;|&]+)|(?:^|\s)-a\s+([^\s;|&]+)")
+_STDIN_REDIR = re.compile(r"<\s*([^\s;|&<>]+)")
+
+
+def _read_source(tok: str) -> str:
+    """A bounded prefix of `tok` if it is a readable regular file, else ""."""
+    tok = (tok or "").strip("\"'`$()").rstrip(";|&")
+    if not tok or tok.startswith("-"):
+        return ""
+    try:
+        p = Path(tok)
+        if not p.is_file():          # excludes FIFOs and devices: no blocking read
+            return ""
+        with p.open(errors="replace") as fh:
+            return fh.read(_MAX_SRC_BYTES)
+    except (OSError, ValueError):
+        return ""
+
+
+def _resolved_arguments(command: str) -> list[str]:
+    """Text that will actually REACH a command as arguments.
+
+    Only sources knowable right now: a `< file` redirect, xargs --arg-file/-a,
+    $(cat f)/`cat f`, and an upstream pipe stage that is a literal emitter
+    (echo/printf) or a file reader (cat/head/tail/...).
+
+    Deliberately NOT resolved: `grep … | xargs sed`. grep's output is unknown
+    here, and inferring it from the pattern text is exactly what made ordinary
+    refactors unrunnable. Unknowable means allow — the same call made for a path
+    held in a shell variable.
+    """
+    out: list[str] = []
+
+    def add(text: str) -> None:
+        if text and len(out) < _MAX_SOURCES:
+            out.append(text)
+
+    for m in _STDIN_REDIR.finditer(command):
+        add(_read_source(m.group(1)))
+    for m in _ARGFILE.finditer(command):
+        add(_read_source(m.group(1) or m.group(2)))
+    for m in _SUBST_FILE.finditer(command):
+        add(_read_source(m.group(1) or m.group(2)))
+
+    stages = [s.strip() for s in command.split("|") if s.strip()]
+    for stage in stages[:-1]:                       # producers only
+        toks = [t for t in stage.split() if not _ENV_ASSIGN.match(t)]
+        if not toks:
+            continue
+        verb = toks[0].rsplit("/", 1)[-1].lower()
+        if verb in _LITERAL_EMITTERS:
+            add(" ".join(toks[1:]))
+        elif verb in _FILE_READERS:
+            for t in toks[1:]:
+                if not t.startswith("-"):
+                    add(_read_source(t))
+    return out
+
+
+def _inner_commands(command: str) -> list[str]:
+    """Command strings this command hands back to a shell to execute."""
+    out = [m.group(2) for m in _SHELL_C.finditer(command or "")]
+    for segment in _SEGMENT_SPLIT.split(command or ""):
+        toks = [t for t in segment.split() if not _ENV_ASSIGN.match(t)]
+        if toks and toks[0].rsplit("/", 1)[-1].lower() in _WRAPPERS:
+            rest = " ".join(toks[1:]).strip().strip("\"'")
+            if rest:
+                out.append(rest)
+    return out
+
+
+def _destructive_intent(command: str) -> bool:
+    """A destructive verb or a redirect appears somewhere in `command`."""
+    toks = {t.rsplit("/", 1)[-1].lower().strip("\"'") for t in command.split()}
+    return bool(toks & set(DESTRUCTIVE_VERBS)) or bool(_REDIRECT.search(command))
+
+
+def _direct_destructive(command: str) -> bool:
+    """Destructive op naming a protected path, judged per command segment."""
+    cd_into_protected = False
     for segment in _SEGMENT_SPLIT.split(command or ""):
         seg = segment.strip()
         if not seg:
             continue
         # A redirect writes just as destructively as `rm`; the target may be
         # quoted, ./-prefixed, or fd-numbered (`1> .uap/x`).
-        for m in re.finditer(r">>?", seg):
+        for m in _REDIRECT.finditer(seg):
             if _mentions_protected(seg[m.end():]):
                 return True
         tokens = [t for t in seg.split() if not _ENV_ASSIGN.match(t)]
         if not tokens:
             continue
         verb = tokens[0].rsplit("/", 1)[-1].lower()
+        # `cd .policy-tools && rm -f _common.py` put the protected path in one
+        # segment and the verb in another, so neither segment looked dangerous.
+        if verb == "cd":
+            cd_into_protected = _mentions_protected(" ".join(tokens[1:]))
+            continue
         if verb == "git" and len(tokens) > 1:
             verb = f"git {tokens[1].lower()}"
             if verb not in ("git clean", "git checkout"):
                 continue
         elif verb not in DESTRUCTIVE_VERBS:
             continue
-        if _mentions_protected(" ".join(tokens[1:])):
+        if cd_into_protected or _mentions_protected(" ".join(tokens[1:])):
             return True
     return False
 
 
+def _bash_destructive(command: str, _depth: int = 0) -> bool:
+    """Destructive op against the protected surface, however the target arrives.
+
+    Three ways a target reaches a verb, all of them observed:
+      1. on the command line              -> _direct_destructive
+      2. through a shell wrapper          -> _inner_commands (bash -c, eval, env)
+      3. as resolved arguments            -> _resolved_arguments (xargs, $(cat))
+
+    HONEST LIMIT: shell state this process cannot see still wins. `P=.policy-
+    tools; rm $P/x` expands inside the shell, and no scan of command TEXT can
+    resolve a VALUE. Refusing every destructive command containing a variable
+    would block ordinary work for no real gain, so the residual is accepted and
+    covered by the gate's fail-closed and the _common.py self-heal.
+    """
+    if not command:
+        return False
+    if _direct_destructive(command):
+        return True
+    if _depth < 2:                       # bounded: `bash -c "bash -c ..."`
+        for inner in _inner_commands(command):
+            if _bash_destructive(inner, _depth + 1):
+                return True
+    if (hands_text_to_shell(command) or "$(" in command or "`" in command) \
+            and _destructive_intent(command):
+        return any(_mentions_protected(src) for src in _resolved_arguments(command))
+    return False
+
 OVERRIDE = os.environ.get("UAP_SELF_PROTECT_OFF") == "1"
 
 

package/templates/hooks/uap-policy-gate.sh

@@ -117,8 +117,56 @@ markers = ("/.policy-tools/", "/src/policies/", "/policies/", "/.uap.json",
            "uap-reactor-prompt.sh", "pre-tool-use")
 target = a.get("file_path") or a.get("path") or a.get("target") or ""
 cmd = a.get("command") or ""
+# Scan the COMMAND as well as file_path. Only file_path was checked, so for
+# every Bash call SEC_SENSITIVE was 0 unless the command set a bypass var --
+# leaving the fail-closed branch below blind to the entire shell surface. A
+# shell deletion under .policy-tools/ then fell through to fail-OPEN the moment
+# the enforcer could not run. Observed live: deleting .policy-tools/_common.py
+# broke every enforcer at import, and the next `>> .uap/evidence/...` was
+# allowed. Widening this only ever TIGHTENS: SEC_SENSITIVE gates the fail-
+# closed path and the fastpath skip, never an allow.
+#
+# Each token gets a leading "/" for the same reason the target does: the markers
+# are slash-anchored ("/.policy-tools/"), so a bare relative path in a command
+# ("rm .policy-tools/x") would not match without it. Concatenating the raw
+# command silently missed exactly the deletions this fix is about -- caught by
+# measuring old-vs-new, not by reading the diff.
 low = ("/" + str(target)).lower()
 hit = any(m in low for m in markers)
+# The command side needs its own pass. Markers are slash-terminated
+# ("/.policy-tools/"), so a plain substring test missed the DIRECTORY forms --
+# `rm -rf .policy-tools` scored 0, i.e. the single most destructive command
+# against the surface did not arm the fail-closed net. Quoted paths missed too.
+# Match on a path-segment boundary instead, per token, quotes stripped.
+if not hit and cmd:
+    words = str(cmd).lower().replace("./", "/").split()
+    lead = ""
+    for w in words:
+        if "=" in w and not w.startswith("/"):
+            continue
+        lead = w.rsplit("/", 1)[-1]
+        break
+    # A read-only command cannot weaken anything, and arming fail-closed for it
+    # turns `cat .uap.json` into a hard block on any checkout where self-protect
+    # is not attached -- a state this repo has actually been in.
+    readonly = ("cat", "ls", "grep", "rg", "head", "tail", "wc", "jq", "less",
+                "stat", "file", "which", "wc")
+    if lead not in readonly:
+        for w in words:
+            u = "/" + w.strip("\"" + chr(39) + "").lstrip("/")
+            for mk in markers:
+                base = mk.rstrip("/")
+                start = u.find(base)
+                while start != -1:
+                    tail = u[start + len(base):start + len(base) + 1]
+                    if tail in ("", "/", ".", "*"):
+                        hit = True
+                        break
+                    start = u.find(base, start + 1)
+                if hit:
+                    break
+            if hit:
+                break
 bypass = re.search(
     r"UAP_DELIVER_BYPASS\s*=\s*[\x27\"]?1|UAP_ENFORCE_DELIVERY\s*=\s*[\x27\"]?(advisory|off|0|false|no)"
     r"|UAP_SELF_PROTECT_OFF\s*=\s*[\x27\"]?1|UAP_NO_WORKTREE\s*=\s*[\x27\"]?1|UAP_WORKDIR_SCOPE_OFF\s*=\s*[\x27\"]?1|UAP_USER_VALIDATION\s*=\s*[\x27\"]?0",
@@ -225,6 +273,57 @@ record_execution() {
       AND (SELECT COUNT(*) FROM policy_executions) > 2000;" 2>/dev/null || true
 }
 
+# INTEGRITY: the gate runs COPIES in .policy-tools/. Verify them against the
+# manifest written at materialization and restore anything changed or missing,
+# BEFORE any enforcer runs. This is the durable control: a text scan over shell
+# commands cannot stop `python3 -c` from rewriting an enforcer (that is allowed
+# by design), but it does not need to if the surface repairs itself on the next
+# call. Covers the two observed failures — a stale copy leaving a merged fix
+# inert, and deleting _common.py to kill all 29 enforcers at import.
+#
+# Cost is one hash pass over ~30 small files. `sha256sum` on Linux, `shasum` on
+# macOS; with neither, verification is skipped rather than blocking work.
+_PT="$MAIN_ROOT/.policy-tools"
+if [[ -f "$_PT/.integrity.sha256" ]]; then
+  _SUM=""
+  command -v sha256sum >/dev/null 2>&1 && _SUM="sha256sum"
+  [[ -z "$_SUM" ]] && command -v shasum >/dev/null 2>&1 && _SUM="shasum -a 256"
+  if [[ -n "$_SUM" ]]; then
+    # `|| true` is load-bearing: sha256sum exits non-zero when a check fails,
+    # and under `set -euo pipefail` that status propagates out of the command
+    # substitution and kills the gate — turning a repairable drift into a dead
+    # hook. Match only the FAILED lines: they cover BOTH a changed file
+    # ("x.py: FAILED") and a missing one ("x.py: FAILED open or read"), while
+    # sha256sum's own stderr ("sha256sum: x.py: No such file...") would
+    # otherwise be captured with its prefix and restore a file called
+    # "sha256sum: x.py".
+    _BAD="$( cd "$_PT" && { $_SUM --quiet -c .integrity.sha256 2>/dev/null \
+             | sed -n 's/^\(.*\): FAILED.*$/\1/p'; } || true )"
+    if [[ -n "$_BAD" ]]; then
+      _SRC=""
+      [[ -f "$_PT/.integrity.source" ]] && _SRC="$(cat "$_PT/.integrity.source" 2>/dev/null)"
+      [[ -d "$_SRC" ]] || _SRC="$MAIN_ROOT/src/policies/enforcers"
+      while IFS= read -r _f; do
+        [[ -z "$_f" ]] && continue
+        # copies are <uuid>_<tool>.py; sources are <tool>.py
+        _base="${_f#*_}"; [[ "$_f" == "_common.py" ]] && _base="_common.py"
+        [[ -f "$_SRC/$_base" ]] && cp "$_SRC/$_base" "$_PT/$_f" 2>/dev/null || true
+      done <<< "$_BAD"
+      printf '%s\t%s\n' "$(date +%s)" "restored: $(echo "$_BAD" | tr '\n' ' ')" \
+        >> "$MAIN_ROOT/.uap/evidence/integrity.log" 2>/dev/null || true
+    fi
+  fi
+fi
+# Helper fallback for surfaces that predate the manifest.
+if [[ ! -f "$_PT/_common.py" \
+      && -f "$MAIN_ROOT/src/policies/enforcers/_common.py" ]]; then
+  cp "$MAIN_ROOT/src/policies/enforcers/_common.py" \
+     "$_PT/_common.py" 2>/dev/null || true
+fi
+if [[ ! -f "$MAIN_ROOT/.policy-tools/_common.py" && -d "$MAIN_ROOT/.policy-tools" ]]; then
+  [[ "$SEC_SENSITIVE" == "1" ]] && fail_closed "enforcer helper _common.py missing"
+fi
+
 # Did the self-protect enforcer actually run and make a decision this call?
 sec_enforcer_ran=0
 

package/tools/agents/scripts/anthropic_proxy.py

@@ -12650,6 +12650,57 @@ def _parse_anthropic_sse_to_message(raw: bytes) -> dict | None:
     }
 
 
+ADVERTISED_MODEL_IDS = (
+    "claude-haiku-4-5-20251001",
+    "claude-sonnet-4-6",
+    "claude-sonnet-5-20250514",
+    "claude-fable-5",
+    "qwen36-35b-a3b-iq4xs",
+)
+
+# Keys OpenAI-compatible clients probe for a model's context window. There is no
+# standard, so emit the common spellings rather than betting on one: hermes reads
+# context_length / context_window / max_context_length / max_model_len / n_ctx
+# (agent/model_metadata.py:_CONTEXT_LENGTH_KEYS), LiteLLM and vLLM prefer
+# max_model_len, LM Studio uses max_context_length. They are all the same number.
+_CONTEXT_WINDOW_KEYS = (
+    "context_length",
+    "context_window",
+    "max_context_length",
+    "max_model_len",
+    "n_ctx",
+)
+
+
+def _model_entry(model_id: str) -> dict:
+    """One /v1/models row, carrying the context window when we know it.
+
+    Advertising this is not cosmetic. A client that cannot discover the window
+    cannot size its own history to it, so it grows unbounded and the FIRST thing
+    that notices is this proxy — which can then only prune blind, after the
+    prompt is already built.
+
+    Live, 2026-08-04: hermes has a context compressor and probes for exactly
+    these keys. We advertised bare {"id", "object"} rows, its model cache held no
+    entry for our model, so the compressor never engaged. It sent 470 messages /
+    219,957 tokens against a 130,048 window (169%), and the proxy CRITICAL PRUNEd
+    290 of them to fit — 61 such events in 18 hours. Raising the window from
+    86,784 to 130,048 had not helped, because the growth was never sized to the
+    window in the first place.
+
+    Only advertised for models this proxy serves LOCALLY. A model that
+    round-trips to api.anthropic.com has its own (much larger) window, and
+    stamping the local llama.cpp figure on it would make clients truncate
+    needlessly — a worse bug than the one being fixed, so when in doubt emit
+    nothing and leave the client on its own defaults.
+    """
+    entry = {"id": model_id, "object": "model"}
+    if PROXY_CONTEXT_WINDOW > 0 and not _should_passthrough_model(model_id):
+        for key in _CONTEXT_WINDOW_KEYS:
+            entry[key] = PROXY_CONTEXT_WINDOW
+    return entry
+
+
 @app.get("/v1/models")
 async def models():
     """Return available model list.
@@ -12666,15 +12717,7 @@ async def models():
     ANTHROPIC_PASSTHROUGH_MODELS=__local_only__ is set, all IDs (including
     the Claude ones below) are served by the local llama.cpp backend.
     """
-    return {
-        "data": [
-            {"id": "claude-haiku-4-5-20251001", "object": "model"},
-            {"id": "claude-sonnet-4-6", "object": "model"},
-            {"id": "claude-sonnet-5-20250514", "object": "model"},
-            {"id": "claude-fable-5", "object": "model"},
-            {"id": "qwen36-35b-a3b-iq4xs", "object": "model"},
-        ]
-    }
+    return {"data": [_model_entry(mid) for mid in ADVERTISED_MODEL_IDS]}
 
 
 @app.get("/health")