@miller-tech/uap 1.196.0 → 1.196.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.196.0",
+  "version": "1.196.1",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window",
+    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",

package/src/policies/enforcers/enforcement_self_protect.py

@@ -18,6 +18,7 @@ There is intentionally NO model-reachable bypass: honoring UAP_DELIVER_BYPASS he
 would reopen the hole (the model would just set it). Operator override is
 out-of-band only: UAP_SELF_PROTECT_OFF=1 in the trusted launch env.
 """
+import json
 import os
 import posixpath
 import re
@@ -369,6 +370,107 @@ def _mentions_deliver_coord(command: str) -> bool:
     return any(t in text for t in _DELIVER_COORD)
 
 
+# --- Signalling a LIVE deliver run -------------------------------------------
+#
+# The lock, the run checkpoints and the heartbeat are protected above, but the
+# RUN ITSELF was not: `kill <pid>` ended a mission mid-turn and no rule saw it.
+#
+# Measured 2026-08-11: three consecutive runs reached turn 3, turn 8 and turn 10
+# and every one was terminated from outside. The journal caught the exact shape,
+# a kill of that run's own pid followed by a cooperative stop request, five
+# minutes after launch. Both halves are the caller trying to stop a run; only
+# the second keeps the work. The first drops the turn on the floor with the lock
+# still held, and it is why "deliver never gets past planning" was believed
+# while the runs were in fact working.
+#
+# Deliberately NARROW. Killing anything else stays allowed - a blanket refusal
+# on `kill` would block ordinary process cleanup for no gain. The rule fires
+# only when the target is verified to be a live deliver run.
+
+# `kill -0` is a liveness PROBE and must stay allowed: refusing it would break
+# the very check that tells a caller whether a run is still alive.
+_KILL_RE = re.compile(r"\bkill\s+(?P<flag>-[\w]+\s+)?(?P<pids>[\d\s]+)")
+_PKILL_RE = re.compile(r"\b(?:pkill|killall)\b(?P<rest>[^;&|]*)")
+_PROBE_SIGNALS = {"-0"}
+
+
+def _signalled_pids(command: str) -> set:
+    """PIDs a command would send a TERMINATING signal to."""
+    out = set()
+    for m in _KILL_RE.finditer(command or ""):
+        if (m.group("flag") or "").strip() in _PROBE_SIGNALS:
+            continue
+        for tok in (m.group("pids") or "").split():
+            if tok.isdigit():
+                out.add(int(tok))
+    return out
+
+
+def _cmdline_of(pid: int) -> str:
+    try:
+        with open("/proc/%d/cmdline" % pid, "rb") as fh:
+            return fh.read().replace(b"\x00", b" ").decode("utf-8", "replace")
+    except OSError:
+        return ""
+
+
+def _live_deliver_runs(root) -> dict:
+    """{pid: runId} for deliver runs that are RUNNING and still alive.
+
+    Verifies the pid against /proc rather than trusting state.json. Pids are
+    recycled, and a stale record pointing at a reused pid would otherwise refuse
+    an unrelated kill - the same PID-reuse trap that once deadlocked the deliver
+    lock. If the process is not a deliver, the record is stale and the kill is
+    none of this rule's business.
+    """
+    runs = {}
+    base = Path(root) / ".uap" / "deliver-runs"
+    try:
+        entries = list(base.iterdir())
+    except OSError:
+        return runs
+    for entry in entries:
+        try:
+            data = json.loads((entry / "state.json").read_text(encoding="utf-8"))
+        except (OSError, ValueError):
+            continue
+        pid = data.get("pid")
+        if not isinstance(pid, int) or data.get("status") != "running":
+            continue
+        if data.get("exit"):
+            continue
+        if "deliver" not in _cmdline_of(pid):
+            continue
+        runs[pid] = str(data.get("runId") or entry.name)
+    return runs
+
+
+def _kills_live_deliver_run(command: str, root) -> str:
+    """The runId this command would terminate, or "" when it terminates none."""
+    if not command or not re.search(r"\b(?:kill|pkill|killall)\b", command):
+        return ""
+    live = _live_deliver_runs(root)
+    if not live:
+        return ""
+    for pid in _signalled_pids(command):
+        if pid in live:
+            return live[pid]
+    # Pattern kills name no pid: test the pattern against what the run IS.
+    for m in _PKILL_RE.finditer(command):
+        for raw in re.findall(r"""["\']([^"\']+)["\']|(\S+)""", m.group("rest") or ""):
+            token = (raw[0] or raw[1]).strip()
+            if not token or token.startswith("-"):
+                continue
+            try:
+                pat = re.compile(token)
+            except re.error:
+                continue
+            for pid, run_id in live.items():
+                if pat.search(_cmdline_of(pid)):
+                    return run_id
+    return ""
+
+
 def _direct_destructive(command: str) -> bool:
     """Destructive op naming a protected path, judged per command segment."""
     cd_into_protected = False
@@ -532,6 +634,23 @@ def main() -> None:
                     "`deliver` tool instead of disabling the gate. "
                     "(Operator-only override: UAP_SELF_PROTECT_OFF=1.)",
                 )
+        live_run = _kills_live_deliver_run(cmd, repo_root())
+        if live_run:
+            emit(
+                False,
+                "BLOCKED: that signal would kill deliver run %s, which is RUNNING "
+                "right now. Killing it drops the turn in flight - its work is lost "
+                "and the lock stays held until the next launch reclaims it. "
+                "Measured 2026-08-11: three runs were killed this way at turns 3, 8 "
+                "and 10 while they were working, and the runs were then reported as "
+                "'stuck in planning'. "
+                "To STOP it and KEEP the work, request the cooperative stop - "
+                "`touch .uap/deliver-runs/STOP` - which ends the run at the next "
+                "turn boundary with its checkpoint written and the lock released. "
+                "To watch it instead, `uap deliver --await-run` reports live "
+                "progress. (Operator-only override: UAP_SELF_PROTECT_OFF=1.)"
+                % live_run,
+            )
         if _bash_destructive(cmd):
             # Name the SURFACE that was touched. "policy enforcers or proxy env"
             # is simply untrue of a lock file, and a refusal that describes the

package/tools/agents/tests/test_live_deliver_kill.py

@@ -0,0 +1,186 @@
+#!/usr/bin/env python3
+"""Killing a RUNNING deliver run is the blocker, not planning.
+
+Measured 2026-08-11: three consecutive runs reached turn 3, turn 8 and turn 10
+and every one was terminated from outside. The proxy journal caught the shape —
+a kill of the run's own pid, followed by a cooperative stop request, five
+minutes after launch. Both halves are the caller trying to stop a run; only the
+second keeps the work. The first drops the turn in flight with the lock still
+held, and it is why "deliver never gets past planning" was believed while the
+runs were in fact working.
+
+The rule has to be NARROW: killing anything else stays allowed, because a
+blanket refusal on `kill` would block ordinary process cleanup for no gain.
+"""
+
+import importlib.util
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+from pathlib import Path
+
+
+def _load():
+    p = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "enforcement_self_protect.py"
+    spec = importlib.util.spec_from_file_location("esp", p)
+    assert spec and spec.loader
+    m = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(m)
+    return m
+
+
+esp = _load()
+
+
+class LiveRunFixture:
+    """A real sleeping process, recorded as a running deliver run."""
+
+    def __init__(self, root: Path, run_id: str = "run-20260811T091247-84d1f1", pid: int | None = None):
+        self.root = root
+        self.run_id = run_id
+        self.proc = None
+        if pid is None:
+            # argv must contain "deliver" — the rule verifies against /proc so a
+            # recycled pid cannot be mistaken for a run.
+            self.proc = subprocess.Popen(
+                [sys.executable, "-c", "import time,sys; sys.argv.append('deliver'); time.sleep(30)", "deliver"]
+            )
+            pid = self.proc.pid
+        self.pid = pid
+        d = root / ".uap" / "deliver-runs" / run_id
+        d.mkdir(parents=True, exist_ok=True)
+        (d / "state.json").write_text(json.dumps({
+            "runId": run_id, "instruction": "replace the lateral joins",
+            "presetId": "p", "projectRoot": str(root), "status": "running",
+            "createdAt": "2026-08-11T09:12:47Z", "updatedAt": "2026-08-11T09:15:00Z",
+            "pid": self.pid,
+        }))
+
+    def close(self):
+        if self.proc:
+            self.proc.kill()
+            self.proc.wait()
+
+
+class KillsLiveDeliverRun(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.root = Path(self.tmp.name)
+        self.fx = LiveRunFixture(self.root)
+
+    def tearDown(self):
+        self.fx.close()
+        self.tmp.cleanup()
+
+    def test_refuses_the_exact_command_from_the_journal(self):
+        cmd = f"kill {self.fx.pid} 2>/dev/null; touch {self.root}/.uap/deliver-runs/STOP"
+        self.assertEqual(esp._kills_live_deliver_run(cmd, self.root), self.fx.run_id)
+
+    def test_refuses_kill_9_and_explicit_signals(self):
+        for cmd in (f"kill -9 {self.fx.pid}", f"kill -TERM {self.fx.pid}", f"kill -15 {self.fx.pid}"):
+            self.assertTrue(esp._kills_live_deliver_run(cmd, self.root), cmd)
+
+    def test_ALLOWS_kill_0_because_that_is_a_liveness_PROBE(self):
+        # Refusing this would break the very check that tells a caller whether
+        # the run is still alive — and push it back toward killing blindly.
+        self.assertEqual(esp._kills_live_deliver_run(f"kill -0 {self.fx.pid}", self.root), "")
+
+    def test_ALLOWS_killing_an_unrelated_process(self):
+        other = subprocess.Popen([sys.executable, "-c", "import time; time.sleep(30)"])
+        try:
+            self.assertEqual(esp._kills_live_deliver_run(f"kill {other.pid}", self.root), "")
+        finally:
+            other.kill()
+            other.wait()
+
+    def test_refuses_a_pattern_kill_that_would_match_the_run(self):
+        self.assertTrue(esp._kills_live_deliver_run("pkill -f deliver", self.root))
+
+    def test_ALLOWS_a_pattern_kill_that_matches_nothing_of_ours(self):
+        self.assertEqual(esp._kills_live_deliver_run("pkill -f 'http.server 8765'", self.root), "")
+
+    def test_a_recycled_pid_is_not_treated_as_a_live_run(self):
+        # The PID-reuse trap that once deadlocked the deliver lock: the record
+        # says running, but the process at that pid is something else entirely.
+        other = subprocess.Popen([sys.executable, "-c", "import time; time.sleep(30)"])
+        try:
+            fx = LiveRunFixture(self.root, run_id="run-stale-aaaaaa", pid=other.pid)
+            self.assertEqual(esp._kills_live_deliver_run(f"kill {other.pid}", self.root), "")
+        finally:
+            other.kill()
+            other.wait()
+
+    def test_a_dead_pid_is_not_a_live_run(self):
+        dead = subprocess.Popen([sys.executable, "-c", "pass"])
+        dead.wait()
+        time.sleep(0.05)
+        LiveRunFixture(self.root, run_id="run-dead-bbbbbb", pid=dead.pid)
+        self.assertEqual(esp._kills_live_deliver_run(f"kill {dead.pid}", self.root), "")
+
+    def test_a_FINISHED_run_is_not_protected_even_if_its_process_lingers(self):
+        # Only a run that is still RUNNING has work to lose. One marked
+        # delivered or failed has finished; its process may be winding down, and
+        # refusing to kill that would block ordinary cleanup for no benefit.
+        for status in ("delivered", "failed", "interrupted"):
+            d = self.root / ".uap" / "deliver-runs" / self.fx.run_id
+            data = json.loads((d / "state.json").read_text())
+            data["status"] = status
+            (d / "state.json").write_text(json.dumps(data))
+            self.assertEqual(
+                esp._kills_live_deliver_run(f"kill {self.fx.pid}", self.root), "", status
+            )
+
+    def test_a_run_that_already_recorded_an_exit_is_not_live(self):
+        d = self.root / ".uap" / "deliver-runs" / self.fx.run_id
+        data = json.loads((d / "state.json").read_text())
+        data["exit"] = {"at": "2026-08-11T09:18:10Z", "reason": "killed by SIGTERM"}
+        (d / "state.json").write_text(json.dumps(data))
+        self.assertEqual(esp._kills_live_deliver_run(f"kill {self.fx.pid}", self.root), "")
+
+    def test_costs_nothing_when_the_command_is_not_a_kill(self):
+        self.assertEqual(esp._kills_live_deliver_run("uap deliver --await-run", self.root), "")
+        self.assertEqual(esp._kills_live_deliver_run("", self.root), "")
+
+    def test_survives_a_project_with_no_runs_at_all(self):
+        with tempfile.TemporaryDirectory() as empty:
+            self.assertEqual(esp._kills_live_deliver_run("kill 1", Path(empty)), "")
+
+    def test_survives_unreadable_run_state(self):
+        (self.root / ".uap" / "deliver-runs" / "run-junk-cccccc").mkdir(parents=True)
+        (self.root / ".uap" / "deliver-runs" / "run-junk-cccccc" / "state.json").write_text("{not json")
+        self.assertEqual(esp._kills_live_deliver_run(f"kill {self.fx.pid}", self.root), self.fx.run_id)
+
+
+class RefusalIsActionable(unittest.TestCase):
+    """A refusal that does not name the alternative is how a loop survives a guard."""
+
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.root = Path(self.tmp.name)
+        self.fx = LiveRunFixture(self.root)
+
+    def tearDown(self):
+        self.fx.close()
+        self.tmp.cleanup()
+
+    def test_the_enforcer_refuses_end_to_end_and_names_the_cooperative_stop(self):
+        env = dict(os.environ)
+        env.pop("UAP_SELF_PROTECT_OFF", None)
+        env["CLAUDE_PROJECT_DIR"] = str(self.root)
+        enforcer = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "enforcement_self_protect.py"
+        r = subprocess.run(
+            [sys.executable, str(enforcer), "--operation", "Bash",
+             "--args", json.dumps({"command": f"kill {self.fx.pid} 2>/dev/null"})],
+            capture_output=True, text=True, cwd=str(self.root), env=env)
+        out = r.stdout + r.stderr
+        self.assertIn("RUNNING", out, out[:400])
+        self.assertIn("deliver-runs/STOP", out, out[:400])
+        self.assertIn("--await-run", out, out[:400])
+
+
+if __name__ == "__main__":
+    unittest.main()