@miller-tech/uap 1.189.1 → 1.189.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.189.1",
+  "version": "1.189.2",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/src/policies/enforcers/enforcement_self_protect.py

@@ -161,6 +161,22 @@ PROTECTED_TARGETS = (
     # stopped with the STOP file, which leaves the checkpoint intact.
     ".uap/deliver.lock",
     ".uap/deliver-runs",
+    # The heartbeat is part of the SAME guard, and leaving it out left the
+    # bypass open one file over. `isDeliverLockAbandoned` treats a MISSING
+    # heartbeat plus a lock older than the wedge timeout as abandoned, so
+    # deleting it makes a live holder look dead and the next launch reclaims
+    # its lock. Verified: with the heartbeat present a two-hour-old lock held
+    # by a live pid is abandoned=False; delete it and the same lock is
+    # abandoned=True.
+    ".uap/deliver.heartbeat",
+    # NOT `.uap/pending-deliver.jsonl`, though the delivery-enforcement policy
+    # names it alongside these. It is an APPEND-ONLY queue the tooling writes
+    # constantly, and the destructive check treats every redirect alike, so
+    # protecting it here refuses `echo x >> .uap/pending-deliver.jsonl` — the
+    # ordinary way the queue is filled. Caught by the Python enforcer suite
+    # (test_gate_evidence), which asserts that exact append stays allowed.
+    # Guarding it needs a rule that tells `>>` from `>`; blocking the queue's
+    # own writes to protect it is not that rule.
     ".uap.json",
     "anthropic-proxy.env",
 )
@@ -322,7 +338,11 @@ def _destructive_intent(command: str) -> bool:
     return bool(toks & set(DESTRUCTIVE_VERBS)) or bool(_REDIRECT.search(command))
 
 
-_DELIVER_COORD = (".uap/deliver.lock", ".uap/deliver-runs")
+_DELIVER_COORD = (
+    ".uap/deliver.lock",
+    ".uap/deliver-runs",
+    ".uap/deliver.heartbeat",
+)
 
 
 def _mentions_deliver_coord(command: str) -> bool:
@@ -512,7 +532,9 @@ def main() -> None:
                     "does not free anything, it puts a SECOND mission on the same "
                     "tree, and two of them overwrite each other's edits. "
                     "`.uap/deliver-runs/` holds every run's checkpoint, which is "
-                    "the work itself. "
+                    "the work itself. `.uap/deliver.heartbeat` is how a live run is "
+                    "told apart from an abandoned one - remove it and the next launch "
+                    "reclaims a RUNNING mission's lock. "
                     "You never need to remove either: a lock whose holder is dead "
                     "or wedged is reclaimed automatically by the next launch. "
                     "To STOP a run instead of forcing past it, request the "