@miller-tech/uap 1.185.1 → 1.186.1

package/src/policies/enforcers/enforcement_self_protect.py

@@ -19,6 +19,7 @@ would reopen the hole (the model would just set it). Operator override is
 out-of-band only: UAP_SELF_PROTECT_OFF=1 in the trusted launch env.
 """
 import os
+import posixpath
 import re
 import sys
 from pathlib import Path
@@ -26,6 +27,7 @@ from pathlib import Path
 sys.path.insert(0, str(Path(__file__).parent))
 from _common import (  # noqa: E402
     emit, parse_cli, repo_root, REVIEW_ARTIFACT_DIR, REVIEW_WAIVER_DIR,
+    hands_text_to_shell, scannable_command,
 )
 
 EDIT_OPS = {"Edit", "Write", "MultiEdit", "edit", "write", "multiedit"}
@@ -128,56 +130,241 @@ _QUOTES = str.maketrans("", "", "\"'")
 
 
 def _mentions_protected(text: str) -> bool:
-    """True when the text names a protected path and no exempt sub-path."""
-    low = text.translate(_QUOTES).lower()
-    # Normalise ./ and leading slashes so `./.uap`, `/.uap` and `.uap` agree.
-    low = low.replace("./", "/")
-    if any(ex in low for ex in PROTECTED_EXEMPT):
+    """True when any UNIT of `text` names a protected path.
+
+    Judged unit by unit, not over the whole blob. The exemption used to be
+    evaluated across the entire text, so one `policies/waivers` anywhere made
+    everything else invisible — appending a single innocuous line to a deletion
+    list defeated the check completely (found by the review, reproduced).
+    """
+    for raw_unit in text.translate(_QUOTES).lower().split():
+        # Normalise BEFORE matching. `policies/waivers/../../.policy-tools` was
+        # exempt by substring while resolving to a protected path, and the old
+        # "./" -> "/" rewrite ran first and mangled the `..` segments so a later
+        # normpath could not undo it. normpath subsumes that rewrite: it maps
+        # "./.uap" -> ".uap", which is what the rewrite existed to do.
+        unit = posixpath.normpath(raw_unit) if "/" in raw_unit else raw_unit
+        if any(ex in unit for ex in PROTECTED_EXEMPT):
+            continue
+        # The .uap DIRECTORY ITSELF: `rm -rf .uap` destroys the manifest, while
+        # `echo 0 > .uap/verify-cadence` names a deeper path and is ordinary
+        # tooling. Bare directory protected; a file under it is not.
+        for m in re.finditer(re.escape(".uap"), unit):
+            rest = unit[m.end():]
+            if rest[:1] in ("", " ", '"', "'", "*"):
+                return True
+            # `rm -rf .uap/` and `rm -rf .uap/*` name the DIRECTORY, and take
+            # evidence, reviews and interaction with it. A deeper path
+            # (`.uap/verify-cadence`) is ordinary tooling and stays writable.
+            if rest.strip("/") in ("", "*"):
+                return True
+        for target in PROTECTED_TARGETS:
+            t = target.lower()
+            for m in re.finditer(re.escape(t), unit):
+                if unit[m.end():m.end() + 1] in ("", "/", ".", " ", '"', "'", "*"):
+                    return True
+    return False
+
+
+# An argument list is a list of paths; it is never a megabyte. The old 1 MiB cap
+# also SKIPPED anything larger, so padding a list file past the cap was a
+# one-line bypass. Read a bounded prefix instead of skipping.
+_MAX_SRC_BYTES = 1 << 16
+_MAX_SOURCES = 32
+# Commands whose arguments are literal paths we can read now.
+_FILE_READERS = ("cat", "head", "tail", "sort", "uniq", "cut", "tr", "nl", "rev")
+_LITERAL_EMITTERS = ("echo", "printf")
+# Wrappers that hand their remaining words back to a shell as a command.
+_WRAPPERS = ("eval", "env", "exec", "source", ".")
+_SHELL_C = re.compile(
+    r"(?:^|[\s;|&(])(?:ba|z|k|da|a)?sh\s+(?:-\w+\s+)*-\w*c\s+(['\"])(.*?)\1", re.S)
+_REDIRECT = re.compile(r">>?")
+_SUBST_FILE = re.compile(r"\$\(\s*(?:cat\s+)?<?\s*([^\s)]+)[^)]*\)|`\s*cat\s+([^`]+)`")
+_ARGFILE = re.compile(r"--arg-file=([^\s;|&]+)|(?:^|\s)-a\s+([^\s;|&]+)")
+_STDIN_REDIR = re.compile(r"<\s*([^\s;|&<>]+)")
+
+
+
+_LAUNCHERS = ("nohup", "timeout", "command", "builtin", "setsid", "sudo", "doas",
+              "nice", "ionice", "stdbuf", "time", "unbuffer")
+# Producers whose output genuinely cannot be known from the command text.
+_SEARCH_PRODUCERS = ("grep", "egrep", "fgrep", "rg", "ag", "ack", "find", "fd",
+                     "ls", "comm", "diff", "git", "locate", "which")
+
+
+def _verb_of(token: str) -> str:
+    """The command a token invokes, with quoting and \\-escaping removed."""
+    return token.strip("\"'").lstrip("\\").rsplit("/", 1)[-1].lower()
+
+
+def _has_unknown_producer(command: str) -> bool:
+    """True when a pipeline stage feeding a consumer is not a search tool."""
+    stages = [s.strip() for s in command.split("|") if s.strip()]
+    if len(stages) < 2:
         return False
-    # The .uap DIRECTORY ITSELF: `rm -rf .uap` / `find .uap -delete` destroy the
-    # manifest along with everything else, while `echo 0 > .uap/verify-cadence`
-    # names a deeper path and is ordinary tooling. So the bare directory is
-    # protected; a specific file under it is not (unless listed below).
-    for m in re.finditer(re.escape(".uap"), low):
-        if low[m.end():m.end() + 1] in ("", " ", '"', "'", "*"):
+    for stage in stages[:-1]:
+        toks = [t for t in stage.split() if not _ENV_ASSIGN.match(t)]
+        if toks and _verb_of(toks[0]) not in _SEARCH_PRODUCERS:
             return True
-    for target in PROTECTED_TARGETS:
-        t = target.lower()
-        # Word-ish boundary so `.uap` matches `.uap`, `.uap/x` and `.uap.bak`
-        # but not an unrelated longer name like `.uapkeep`.
-        for m in re.finditer(re.escape(t), low):
-            tail = low[m.end():m.end() + 1]
-            if tail in ("", "/", ".", " ", '"', "'", "*"):
-                return True
     return False
 
+def _read_source(tok: str) -> str:
+    """A bounded prefix of `tok` if it is a readable regular file, else ""."""
+    tok = (tok or "").strip("\"'`$()").rstrip(";|&")
+    if not tok or tok.startswith("-"):
+        return ""
+    try:
+        p = Path(tok)
+        if not p.is_file():          # excludes FIFOs and devices: no blocking read
+            return ""
+        with p.open(errors="replace") as fh:
+            return fh.read(_MAX_SRC_BYTES)
+    except (OSError, ValueError):
+        return ""
+
+
+def _resolved_arguments(command: str) -> list[str]:
+    """Text that will actually REACH a command as arguments.
+
+    Only sources knowable right now: a `< file` redirect, xargs --arg-file/-a,
+    $(cat f)/`cat f`, and an upstream pipe stage that is a literal emitter
+    (echo/printf) or a file reader (cat/head/tail/...).
+
+    Deliberately NOT resolved: `grep … | xargs sed`. grep's output is unknown
+    here, and inferring it from the pattern text is exactly what made ordinary
+    refactors unrunnable. Unknowable means allow — the same call made for a path
+    held in a shell variable.
+    """
+    out: list[str] = []
+
+    def add(text: str) -> None:
+        if text and len(out) < _MAX_SOURCES:
+            out.append(text)
 
-def _bash_destructive(command: str) -> bool:
-    """Destructive op against a protected path, judged per command segment."""
+    for m in _STDIN_REDIR.finditer(command):
+        add(_read_source(m.group(1)))
+    for m in _ARGFILE.finditer(command):
+        add(_read_source(m.group(1) or m.group(2)))
+    for m in _SUBST_FILE.finditer(command):
+        add(_read_source(m.group(1) or m.group(2)))
+
+    stages = [s.strip() for s in command.split("|") if s.strip()]
+    for stage in stages[:-1]:                       # producers only
+        toks = [t for t in stage.split() if not _ENV_ASSIGN.match(t)]
+        if not toks:
+            continue
+        verb = toks[0].rsplit("/", 1)[-1].lower()
+        if verb in _LITERAL_EMITTERS:
+            add(" ".join(toks[1:]))
+        elif verb in _FILE_READERS:
+            for t in toks[1:]:
+                if not t.startswith("-"):
+                    add(_read_source(t))
+    return out
+
+
+def _inner_commands(command: str) -> list[str]:
+    """Command strings this command hands back to a shell to execute."""
+    out = [m.group(2) for m in _SHELL_C.finditer(command or "")]
+    for segment in _SEGMENT_SPLIT.split(command or ""):
+        toks = [t for t in segment.split() if not _ENV_ASSIGN.match(t)]
+        if toks and toks[0].rsplit("/", 1)[-1].lower() in _WRAPPERS:
+            rest = " ".join(toks[1:]).strip().strip("\"'")
+            if rest:
+                out.append(rest)
+    return out
+
+
+def _destructive_intent(command: str) -> bool:
+    """A destructive verb or a redirect appears somewhere in `command`."""
+    toks = {t.rsplit("/", 1)[-1].lower().strip("\"'") for t in command.split()}
+    return bool(toks & set(DESTRUCTIVE_VERBS)) or bool(_REDIRECT.search(command))
+
+
+def _direct_destructive(command: str) -> bool:
+    """Destructive op naming a protected path, judged per command segment."""
+    cd_into_protected = False
     for segment in _SEGMENT_SPLIT.split(command or ""):
         seg = segment.strip()
         if not seg:
             continue
         # A redirect writes just as destructively as `rm`; the target may be
         # quoted, ./-prefixed, or fd-numbered (`1> .uap/x`).
-        for m in re.finditer(r">>?", seg):
+        for m in _REDIRECT.finditer(seg):
             if _mentions_protected(seg[m.end():]):
                 return True
         tokens = [t for t in seg.split() if not _ENV_ASSIGN.match(t)]
+        # Step over launchers: `nohup rm -rf x`, `timeout 5 rm -rf x`,
+        # `command rm …`, `sudo rm …` all run rm, but the verb read as the
+        # launcher and the removal was invisible. Flags and their values are
+        # skipped with them.
+        while len(tokens) > 1 and _verb_of(tokens[0]) in _LAUNCHERS:
+            tokens = tokens[1:]
+            while tokens and (tokens[0].startswith("-") or tokens[0].isdigit()):
+                tokens = tokens[1:]
         if not tokens:
             continue
-        verb = tokens[0].rsplit("/", 1)[-1].lower()
+        verb = _verb_of(tokens[0])
+        # `cd .policy-tools && rm -f _common.py` put the protected path in one
+        # segment and the verb in another, so neither segment looked dangerous.
+        if verb == "cd":
+            cd_into_protected = _mentions_protected(" ".join(tokens[1:]))
+            continue
         if verb == "git" and len(tokens) > 1:
             verb = f"git {tokens[1].lower()}"
             if verb not in ("git clean", "git checkout"):
                 continue
         elif verb not in DESTRUCTIVE_VERBS:
             continue
-        if _mentions_protected(" ".join(tokens[1:])):
+        if cd_into_protected or _mentions_protected(" ".join(tokens[1:])):
             return True
     return False
 
 
+def _bash_destructive(command: str, _depth: int = 0) -> bool:
+    """Destructive op against the protected surface, however the target arrives.
+
+    Three ways a target reaches a verb, all of them observed:
+      1. on the command line              -> _direct_destructive
+      2. through a shell wrapper          -> _inner_commands (bash -c, eval, env)
+      3. as resolved arguments            -> _resolved_arguments (xargs, $(cat))
+
+    HONEST LIMIT: shell state this process cannot see still wins. `P=.policy-
+    tools; rm $P/x` expands inside the shell, and no scan of command TEXT can
+    resolve a VALUE. Refusing every destructive command containing a variable
+    would block ordinary work for no real gain, so the residual is accepted and
+    covered by the gate's fail-closed and the _common.py self-heal.
+    """
+    if not command:
+        return False
+    if _direct_destructive(command):
+        return True
+    if _depth < 2:                       # bounded: `bash -c "bash -c ..."`
+        for inner in _inner_commands(command):
+            if _bash_destructive(inner, _depth + 1):
+                return True
+    if not (hands_text_to_shell(command) or "$(" in command or "`" in command):
+        return False
+    sources = _resolved_arguments(command)
+    # Intent can live in the SOURCE rather than the outer text: for
+    # `bash -c "$(cat f)"` the outer words are just bash, so judging intent on
+    # them alone found nothing while f held both the verb and the target.
+    for src in sources:
+        if _mentions_protected(src) and (
+                _destructive_intent(command) or _destructive_intent(src)):
+            return True
+    if not _destructive_intent(command):
+        return False
+    # Nothing resolvable. A SEARCH producer really is unknowable here, and
+    # guessing from its pattern text is what blocked ordinary refactors
+    # (`grep -rl policies/ docs/ | xargs sed -i …`). An arbitrary producer the
+    # agent chose is a different matter: `python3 -c 'print(".policy-tools/x")'
+    # | xargs rm` carries the path in plain sight. Fall back to the text only
+    # when no producer is a search tool.
+    if not sources and _has_unknown_producer(command):
+        return _mentions_protected(scannable_command(command))
+    return False
+
 OVERRIDE = os.environ.get("UAP_SELF_PROTECT_OFF") == "1"
 
 

package/templates/hooks/uap-policy-gate.sh

@@ -117,8 +117,56 @@ markers = ("/.policy-tools/", "/src/policies/", "/policies/", "/.uap.json",
            "uap-reactor-prompt.sh", "pre-tool-use")
 target = a.get("file_path") or a.get("path") or a.get("target") or ""
 cmd = a.get("command") or ""
+# Scan the COMMAND as well as file_path. Only file_path was checked, so for
+# every Bash call SEC_SENSITIVE was 0 unless the command set a bypass var --
+# leaving the fail-closed branch below blind to the entire shell surface. A
+# shell deletion under .policy-tools/ then fell through to fail-OPEN the moment
+# the enforcer could not run. Observed live: deleting .policy-tools/_common.py
+# broke every enforcer at import, and the next `>> .uap/evidence/...` was
+# allowed. Widening this only ever TIGHTENS: SEC_SENSITIVE gates the fail-
+# closed path and the fastpath skip, never an allow.
+#
+# Each token gets a leading "/" for the same reason the target does: the markers
+# are slash-anchored ("/.policy-tools/"), so a bare relative path in a command
+# ("rm .policy-tools/x") would not match without it. Concatenating the raw
+# command silently missed exactly the deletions this fix is about -- caught by
+# measuring old-vs-new, not by reading the diff.
 low = ("/" + str(target)).lower()
 hit = any(m in low for m in markers)
+# The command side needs its own pass. Markers are slash-terminated
+# ("/.policy-tools/"), so a plain substring test missed the DIRECTORY forms --
+# `rm -rf .policy-tools` scored 0, i.e. the single most destructive command
+# against the surface did not arm the fail-closed net. Quoted paths missed too.
+# Match on a path-segment boundary instead, per token, quotes stripped.
+if not hit and cmd:
+    words = str(cmd).lower().replace("./", "/").split()
+    lead = ""
+    for w in words:
+        if "=" in w and not w.startswith("/"):
+            continue
+        lead = w.rsplit("/", 1)[-1]
+        break
+    # A read-only command cannot weaken anything, and arming fail-closed for it
+    # turns `cat .uap.json` into a hard block on any checkout where self-protect
+    # is not attached -- a state this repo has actually been in.
+    readonly = ("cat", "ls", "grep", "rg", "head", "tail", "wc", "jq", "less",
+                "stat", "file", "which", "wc")
+    if lead not in readonly:
+        for w in words:
+            u = "/" + w.strip("\"" + chr(39) + "").lstrip("/")
+            for mk in markers:
+                base = mk.rstrip("/")
+                start = u.find(base)
+                while start != -1:
+                    tail = u[start + len(base):start + len(base) + 1]
+                    if tail in ("", "/", ".", "*"):
+                        hit = True
+                        break
+                    start = u.find(base, start + 1)
+                if hit:
+                    break
+            if hit:
+                break
 bypass = re.search(
     r"UAP_DELIVER_BYPASS\s*=\s*[\x27\"]?1|UAP_ENFORCE_DELIVERY\s*=\s*[\x27\"]?(advisory|off|0|false|no)"
     r"|UAP_SELF_PROTECT_OFF\s*=\s*[\x27\"]?1|UAP_NO_WORKTREE\s*=\s*[\x27\"]?1|UAP_WORKDIR_SCOPE_OFF\s*=\s*[\x27\"]?1|UAP_USER_VALIDATION\s*=\s*[\x27\"]?0",
@@ -225,6 +273,57 @@ record_execution() {
       AND (SELECT COUNT(*) FROM policy_executions) > 2000;" 2>/dev/null || true
 }
 
+# INTEGRITY: the gate runs COPIES in .policy-tools/. Verify them against the
+# manifest written at materialization and restore anything changed or missing,
+# BEFORE any enforcer runs. This is the durable control: a text scan over shell
+# commands cannot stop `python3 -c` from rewriting an enforcer (that is allowed
+# by design), but it does not need to if the surface repairs itself on the next
+# call. Covers the two observed failures — a stale copy leaving a merged fix
+# inert, and deleting _common.py to kill all 29 enforcers at import.
+#
+# Cost is one hash pass over ~30 small files. `sha256sum` on Linux, `shasum` on
+# macOS; with neither, verification is skipped rather than blocking work.
+_PT="$MAIN_ROOT/.policy-tools"
+if [[ -f "$_PT/.integrity.sha256" ]]; then
+  _SUM=""
+  command -v sha256sum >/dev/null 2>&1 && _SUM="sha256sum"
+  [[ -z "$_SUM" ]] && command -v shasum >/dev/null 2>&1 && _SUM="shasum -a 256"
+  if [[ -n "$_SUM" ]]; then
+    # `|| true` is load-bearing: sha256sum exits non-zero when a check fails,
+    # and under `set -euo pipefail` that status propagates out of the command
+    # substitution and kills the gate — turning a repairable drift into a dead
+    # hook. Match only the FAILED lines: they cover BOTH a changed file
+    # ("x.py: FAILED") and a missing one ("x.py: FAILED open or read"), while
+    # sha256sum's own stderr ("sha256sum: x.py: No such file...") would
+    # otherwise be captured with its prefix and restore a file called
+    # "sha256sum: x.py".
+    _BAD="$( cd "$_PT" && { $_SUM --quiet -c .integrity.sha256 2>/dev/null \
+             | sed -n 's/^\(.*\): FAILED.*$/\1/p'; } || true )"
+    if [[ -n "$_BAD" ]]; then
+      _SRC=""
+      [[ -f "$_PT/.integrity.source" ]] && _SRC="$(cat "$_PT/.integrity.source" 2>/dev/null)"
+      [[ -d "$_SRC" ]] || _SRC="$MAIN_ROOT/src/policies/enforcers"
+      while IFS= read -r _f; do
+        [[ -z "$_f" ]] && continue
+        # copies are <uuid>_<tool>.py; sources are <tool>.py
+        _base="${_f#*_}"; [[ "$_f" == "_common.py" ]] && _base="_common.py"
+        [[ -f "$_SRC/$_base" ]] && cp "$_SRC/$_base" "$_PT/$_f" 2>/dev/null || true
+      done <<< "$_BAD"
+      printf '%s\t%s\n' "$(date +%s)" "restored: $(echo "$_BAD" | tr '\n' ' ')" \
+        >> "$MAIN_ROOT/.uap/evidence/integrity.log" 2>/dev/null || true
+    fi
+  fi
+fi
+# Helper fallback for surfaces that predate the manifest.
+if [[ ! -f "$_PT/_common.py" \
+      && -f "$MAIN_ROOT/src/policies/enforcers/_common.py" ]]; then
+  cp "$MAIN_ROOT/src/policies/enforcers/_common.py" \
+     "$_PT/_common.py" 2>/dev/null || true
+fi
+if [[ ! -f "$MAIN_ROOT/.policy-tools/_common.py" && -d "$MAIN_ROOT/.policy-tools" ]]; then
+  [[ "$SEC_SENSITIVE" == "1" ]] && fail_closed "enforcer helper _common.py missing"
+fi
+
 # Did the self-protect enforcer actually run and make a decision this call?
 sec_enforcer_ran=0