@miller-tech/uap 1.189.3 → 1.190.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.189.3",
+  "version": "1.190.0",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window",
+    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",

package/src/policies/enforcers/delivery_enforcement.py

@@ -167,6 +167,57 @@ def _changed_chars(args: dict) -> int | None:
     return None  # Write (full content) — not a trivial edit
 
 
+def _write_cost(args: dict, root: Path) -> int | None:
+    """Changed characters for a whole-file Write, or None when it is not small.
+
+    A Write used to be judged only by being a Write: a 120-character new file
+    and a 9000-character rewrite were the same answer. That is nature without
+    complexity, and it is why creating one small module cost a full
+    decompose -> epics -> gates cycle (~10 min on a local executor) while an
+    equivalent Edit went straight through.
+
+    Two things make a Write cheap, and BOTH are required:
+
+      - the content is small — same budget as an edit, so there is one number
+        to reason about and one env var to tune; and
+      - it does not REPLACE substantial existing content. Creating a file, or
+        growing a small one, risks little. Overwriting 8000 characters with 120
+        is the gutting signature, and the size of what is being destroyed is
+        the whole point — measuring only the new content would call the most
+        destructive write the cheapest.
+
+    None means "not trivially small", which is what every caller already treats
+    as "route it through deliver".
+    """
+    content = args.get("content")
+    if content is None:
+        content = args.get("new_string") or args.get("newString")
+    if content is None:
+        return None
+    new_len = len(str(content))
+    # No size check here on purpose: the caller already compares the returned
+    # cost against the same budget, and applying it twice was provably dead —
+    # a mutant deleting this check could not be distinguished by any test,
+    # because both paths refuse an oversized write. One place to change the
+    # threshold is worth more than an early return that saves one stat().
+    try:
+        prev_len = (root / _rel_of(args)).stat().st_size
+    except (OSError, ValueError, TypeError):
+        prev_len = 0  # new file: nothing to destroy
+    # Shrinking a substantial file is gutting, however small the new content.
+    # Thresholds match the executor's own anti-gutting predicate so the two
+    # cannot disagree about the same write.
+    if prev_len >= 1500 and new_len < prev_len * 0.35:
+        return None
+    return new_len
+
+
+def _rel_of(args: dict) -> str:
+    """The write target as given, for a best-effort size lookup."""
+    p = args.get("file_path") or args.get("filePath") or args.get("path") or ""
+    return str(p)
+
+
 def _deliver_lock_holder(root: Path) -> str | None:
     """PID string of a LIVE deliver run holding the project lock, else None."""
     lock = root / ".uap" / "deliver.lock"
@@ -512,6 +563,10 @@ def main() -> None:
     # than paying a full deliver cycle for a one-liner.
     if _fastpath_on():
         changed = _changed_chars(args)
+        if changed is None:
+            # Not an Edit — judge the Write on the same two axes rather than
+            # refusing it for being a Write.
+            changed = _write_cost(args, root)
         if changed is not None and changed <= _trivial_edit_chars():
             print(
                 f"[delivery-enforcement] trivial edit to '{rel_posix}' "

package/tools/agents/tests/test_delivery_enforcement_filepath.py

@@ -24,14 +24,23 @@ def run(args, env=None):
     return p.returncode, p.stdout
 
 
+# Content big enough to be past the trivial-write budget. These two tests are
+# about the KEY being recognised, and a tiny sample can no longer show that: a
+# small new file is now allowed on its own merits, so "allowed" would no longer
+# distinguish "the key was not recognised" from "the write was trivial". The
+# sample has to be substantial for the assertion to mean what the test name
+# says. The assertions themselves are unchanged.
+SUBSTANTIAL = "export const x = 1;\n" * 40
+
+
 class FilePathKeyTest(unittest.TestCase):
     def test_opencode_filePath_is_gated(self):
-        code, out = run({"filePath": "src/newfeature.ts", "content": "export const x=1;"})
+        code, out = run({"filePath": "src/newfeature.ts", "content": SUBSTANTIAL})
         self.assertEqual(code, 2, out)
         self.assertIn("route", out)
 
     def test_claude_file_path_still_gated(self):
-        code, _ = run({"file_path": "src/newfeature.ts", "content": "x"})
+        code, _ = run({"file_path": "src/newfeature.ts", "content": SUBSTANTIAL})
         self.assertEqual(code, 2)
 
     def test_test_file_allowed(self):

package/tools/agents/tests/test_delivery_enforcement_write_complexity.py

@@ -0,0 +1,125 @@
+#!/usr/bin/env python3
+"""A Write should be judged on nature AND complexity, not on being a Write.
+
+Before this, an Edit was judged by how much it changed and a Write was judged
+only by being a Write: a 120-character new module and a 9000-character rewrite
+got the same answer. Creating one small file therefore cost a full
+decompose -> epics -> gates cycle — roughly ten minutes on a local executor —
+while an equivalent Edit went straight through. That asymmetry is what made
+"route everything through deliver" feel arbitrary to the caller, and a caller
+that reads a gate as arbitrary goes looking for ways around it.
+
+Two things make a Write cheap, and BOTH are required: the content is small, and
+it does not replace substantial existing content. The second is the load-bearing
+half — measuring only the new content would call the most destructive write
+(120 characters over 8000) the cheapest one.
+"""
+import json, os, subprocess, sys, tempfile, unittest
+from pathlib import Path
+
+ENF = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "delivery_enforcement.py"
+BUDGET = 240  # UAP_DELIVER_TRIVIAL_EDIT_CHARS default
+
+
+def project() -> str:
+    root = tempfile.mkdtemp(prefix="uap-writecx-")
+    for d in ("src", "docs", "test"):
+        os.makedirs(os.path.join(root, d), exist_ok=True)
+    Path(root, ".uap.json").write_text("{}")
+    os.makedirs(os.path.join(root, ".git"), exist_ok=True)
+    return root
+
+
+def run(root: str, args: dict, op: str = "Write") -> tuple[int, str]:
+    e = {**os.environ, "UAP_ENFORCE_DELIVERY": "block", "UAP_REPO_ROOT": root}
+    # Same strips as the sibling tests: a local-model session downgrades block
+    # to advisory, which would make every block-expecting case here allow.
+    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE",
+              "UAP_DELIVER_LOCAL_ADVISORY", "UAP_FASTPATH_ROUTED",
+              "ANTHROPIC_BASE_URL", "OPENAI_BASE_URL", "UAP_INFERENCE_ENDPOINT"):
+        e.pop(k, None)
+    p = subprocess.run([sys.executable, str(ENF), "--operation", op, "--args", json.dumps(args)],
+                       capture_output=True, text=True, env=e, cwd=root)
+    return p.returncode, p.stdout
+
+
+class WriteComplexityTest(unittest.TestCase):
+    def test_small_new_file_is_allowed(self):
+        root = project()
+        code, out = run(root, {"file_path": os.path.join(root, "src", "tiny.ts"),
+                               "content": "x" * 120})
+        self.assertEqual(code, 0, out)
+
+    def test_write_at_the_budget_is_allowed(self):
+        root = project()
+        code, out = run(root, {"file_path": os.path.join(root, "src", "edge.ts"),
+                               "content": "x" * BUDGET})
+        self.assertEqual(code, 0, out)
+
+    def test_write_just_over_the_budget_is_gated(self):
+        root = project()
+        code, _ = run(root, {"file_path": os.path.join(root, "src", "edge2.ts"),
+                             "content": "x" * (BUDGET + 1)})
+        self.assertEqual(code, 2)
+
+    def test_large_new_file_is_gated(self):
+        root = project()
+        code, _ = run(root, {"file_path": os.path.join(root, "src", "huge.ts"),
+                             "content": "x" * 9000})
+        self.assertEqual(code, 2)
+
+    def test_growing_a_small_file_is_allowed(self):
+        # Not a new file, but nothing substantial is destroyed.
+        root = project()
+        target = os.path.join(root, "src", "small.ts")
+        Path(target).write_text("x" * 100)
+        code, out = run(root, {"file_path": target, "content": "x" * 200})
+        self.assertEqual(code, 0, out)
+
+    def test_small_write_over_a_substantial_file_is_gated(self):
+        # The load-bearing case: judged by what is DESTROYED, not by how little
+        # arrives. Measuring only the new content would call this the cheapest
+        # write of all, when it is the most destructive.
+        root = project()
+        target = os.path.join(root, "src", "existing.ts")
+        Path(target).write_text("x" * 8000)
+        code, _ = run(root, {"file_path": target, "content": "x" * 120})
+        self.assertEqual(code, 2)
+
+    def test_edit_behaviour_is_unchanged(self):
+        root = project()
+        target = os.path.join(root, "src", "thing.ts")
+        small = run(root, {"file_path": target, "old_string": "a" * 20, "new_string": "b" * 20}, op="Edit")
+        big = run(root, {"file_path": target, "old_string": "a" * 300, "new_string": "b" * 300}, op="Edit")
+        self.assertEqual(small[0], 0, small[1])
+        self.assertEqual(big[0], 2, big[1])
+
+    def test_nature_exemptions_are_unchanged(self):
+        root = project()
+        docs = run(root, {"file_path": os.path.join(root, "docs", "n.md"), "content": "x" * 9000})
+        tests = run(root, {"file_path": os.path.join(root, "test", "a.test.ts"), "content": "x" * 9000})
+        self.assertEqual(docs[0], 0, docs[1])
+        self.assertEqual(tests[0], 0, tests[1])
+
+    def test_fastpath_off_gates_the_small_write_too(self):
+        # The new allowance rides the SAME switch as the trivial-edit one, so an
+        # operator turning the fast-path off gets the strict behaviour back for
+        # both rather than only for edits.
+        root = project()
+        code, _ = run(root, {"file_path": os.path.join(root, "src", "tiny.ts"),
+                             "content": "x" * 120})
+        self.assertEqual(code, 0)
+        e = {"UAP_DELIVER_FASTPATH": "off"}
+        p = subprocess.run(
+            [sys.executable, str(ENF), "--operation", "Write", "--args",
+             json.dumps({"file_path": os.path.join(root, "src", "tiny.ts"), "content": "x" * 120})],
+            capture_output=True, text=True, cwd=root,
+            env={**{k: v for k, v in os.environ.items()
+                    if k not in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE",
+                                 "ANTHROPIC_BASE_URL", "OPENAI_BASE_URL", "UAP_INFERENCE_ENDPOINT")},
+                 "UAP_ENFORCE_DELIVERY": "block", "UAP_REPO_ROOT": root, **e})
+        self.assertEqual(p.returncode, 2, p.stdout)
+
+
+if __name__ == "__main__":
+    unittest.main()