@miller-tech/uap 1.215.1 → 1.215.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.215.1",
+  "version": "1.215.2",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_schema_diff_inline tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_gate_failclosed_schema_diff tools.agents.tests.test_rtk_wrap tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window tools.agents.tests.test_thinking_template_kwargs tools.agents.tests.test_cycle_break_wait_poll",
+    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_conditional_destructive_verbs tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_schema_diff_inline tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_gate_failclosed_schema_diff tools.agents.tests.test_rtk_wrap tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window tools.agents.tests.test_thinking_template_kwargs tools.agents.tests.test_cycle_break_wait_poll",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",

package/src/policies/enforcers/enforcement_self_protect.py

@@ -127,6 +127,48 @@ DESTRUCTIVE_VERBS = (
     "dd", "cp", "tee", "install", "sed", "find", "ln",
 )
 
+
+# Verbs from that list that only mutate under a FLAG. Without one they are
+# stdout filters, exactly like `awk` and `grep` -- which this enforcer already
+# allows against a protected path, because READING one is not tampering.
+#
+# Measured on this enforcer (2026-08-20): of six read-only ways to inspect a
+# protected file, five were refused -- `sed -n '1,5p'`, `sed 's/a/b/'`, the same
+# piped to `wc`, `find <dir> -name '*.py'` and `find <dir> -type f` -- while
+# `cat`, `grep`, `head`, `wc` and `awk` were allowed. Those refusals protected
+# nothing and cost real work: in one session they blocked READING this file
+# twice, blocked `cp <protected> /tmp/` (a read FROM a protected path), and
+# blocked a `gh pr close --comment` whose comment text merely quoted a path.
+#
+# Each predicate answers one question -- "does THIS invocation write?" -- and
+# fails CLOSED: an unrecognised short-flag cluster containing `i` counts as a
+# write, and any -exec-family action counts as a write, because what it runs
+# cannot be judged from the flag alone. A verb NOT listed here is unchanged:
+# still unconditionally destructive.
+def _sed_writes(tokens) -> bool:
+    """GNU sed mutates only with -i / --in-place (optionally suffixed)."""
+    for t in tokens:
+        if t.startswith("--"):
+            if t.startswith("--in-place"):
+                return True
+            continue
+        if t.startswith("-") and len(t) > 1:
+            # Short-flag cluster: -i, -i.bak, -ni, -Ei all carry the write.
+            # Anything after the first '.' is the backup suffix, not flags.
+            if "i" in t[1:].split(".", 1)[0]:
+                return True
+    return False
+
+
+def _find_writes(tokens) -> bool:
+    """`find` mutates via -delete, an -exec-family action, or an -f* writer."""
+    mutating = {"-delete", "-exec", "-execdir", "-ok", "-okdir",
+                "-fprint", "-fprint0", "-fprintf", "-fls"}
+    return any(t in mutating for t in tokens)
+
+
+CONDITIONAL_VERBS = {"sed": _sed_writes, "find": _find_writes}
+
 # Paths inside a protected tree that the agent legitimately writes. Without
 # these the enforcer deadlocks the workflows it exists to support: the
 # expert-review gate REQUIRES writing .uap/reviews/<branch>.json, and the visual
@@ -518,6 +560,9 @@ def _direct_destructive(command: str) -> bool:
                 continue
         elif verb not in DESTRUCTIVE_VERBS:
             continue
+        # A conditionally-destructive verb without its write flag is a READ.
+        elif verb in CONDITIONAL_VERBS and not CONDITIONAL_VERBS[verb](tokens[1:]):
+            continue
         if cd_into_protected or _mentions_protected(" ".join(tokens[1:])):
             return True
     return False

package/tools/agents/tests/test_conditional_destructive_verbs.py

@@ -0,0 +1,156 @@
+"""`sed` and `find` are only destructive when a flag makes them write.
+
+Both sit in DESTRUCTIVE_VERBS, but without a write flag they are stdout filters
+-- exactly like `awk` and `grep`, which this enforcer already allows against a
+protected path, because READING one is not tampering.
+
+Measured before the fix (2026-08-20): of six read-only ways to inspect a
+protected file, five were refused -- `sed -n '1,5p'`, `sed 's/a/b/'`, the same
+piped to `wc`, `find <dir> -name '*.py'` and `find <dir> -type f`. Those refusals
+protected nothing and cost real work: in one session they blocked READING the
+enforcer twice, blocked `cp <protected> /tmp/` (a read FROM a protected path),
+and blocked a `gh pr close --comment` whose comment text merely quoted a path.
+
+The predicates fail CLOSED, so the second class below matters more than the
+first: every way of making `sed` or `find` write must still be refused.
+"""
+import importlib.util
+import json
+import os
+import subprocess
+import sys
+import unittest
+from pathlib import Path
+
+ENF = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "enforcement_self_protect.py"
+REPO = Path(__file__).resolve().parents[3]
+T = "src/policies/enforcers/enforcement_self_protect.py"
+D = "src/policies/enforcers"
+
+
+def blocked(cmd):
+    e = dict(os.environ)
+    e["UAP_REPO_ROOT"] = str(REPO)
+    e.pop("UAP_SELF_PROTECT_OFF", None)
+    p = subprocess.run(
+        [sys.executable, str(ENF), "--operation", "Bash", "--args", json.dumps({"command": cmd})],
+        capture_output=True, text=True, env=e,
+    )
+    return p.returncode != 0
+
+
+class ReadsAreAllowedTest(unittest.TestCase):
+    """A read of a protected file is not tampering, whatever tool does it."""
+
+    def test_sed_without_in_place_is_a_read(self):
+        for cmd in (
+            "sed -n '1,5p' " + T,
+            "sed 's/a/b/' " + T,
+            "sed -E 's/a+/b/' " + T,
+            "sed -n '1,5p' " + T + " | wc -l",
+        ):
+            with self.subTest(cmd=cmd):
+                self.assertFalse(blocked(cmd), cmd)
+
+    def test_find_without_a_mutating_action_is_a_read(self):
+        for cmd in ("find " + D + " -name '*.py'", "find " + D + " -type f"):
+            with self.subTest(cmd=cmd):
+                self.assertFalse(blocked(cmd), cmd)
+
+    def test_the_readers_that_always_worked_still_work(self):
+        # Controls. If these ever start blocking, the regression is upstream of
+        # the conditional-verb logic, not in it.
+        for cmd in ("cat " + T, "grep -n x " + T, "awk 'NR<5' " + T, "head -5 " + T):
+            with self.subTest(cmd=cmd):
+                self.assertFalse(blocked(cmd), cmd)
+
+
+class WritesStayRefusedTest(unittest.TestCase):
+    """Every way of making these two verbs write must still be refused."""
+
+    def test_sed_in_place_in_all_its_spellings(self):
+        for cmd in (
+            "sed -i 's/a/b/' " + T,
+            "sed --in-place 's/a/b/' " + T,
+            "sed -i.bak 's/a/b/' " + T,        # suffixed backup
+            "sed -ni 's/a/b/' " + T,           # bundled short flags
+            "sed -Ei 's/a/b/' " + T,           # bundled with -E
+            "sed --in-place=.bak 's/a/b/' " + T,
+        ):
+            with self.subTest(cmd=cmd):
+                self.assertTrue(blocked(cmd), cmd)
+
+    def test_find_mutating_actions(self):
+        for cmd in (
+            "find " + D + " -name '*.py' -delete",
+            "find " + D + " -name '*.py' -exec rm {} ;",
+            "find " + D + " -execdir rm {} ;",
+            "find " + D + " -ok rm {} ;",
+            "find " + D + " -fprintf " + T + " %p",
+        ):
+            with self.subTest(cmd=cmd):
+                self.assertTrue(blocked(cmd), cmd)
+
+    def test_unconditional_verbs_are_untouched(self):
+        # A verb NOT in CONDITIONAL_VERBS keeps its old, flag-independent
+        # treatment. This is the guard against the fix widening past its scope.
+        for cmd in (
+            "rm " + T,
+            "mv " + T + " /tmp/x",
+            "cp /tmp/x " + T,
+            "echo x | tee " + T,
+            "echo x > " + T,
+            "chmod 000 " + T,
+            "truncate -s 0 " + T,
+            "shred " + T,
+            "ln -sf /tmp/x " + T,
+        ):
+            with self.subTest(cmd=cmd):
+                self.assertTrue(blocked(cmd), cmd)
+
+
+class PredicatesFailClosedTest(unittest.TestCase):
+    """Unit-level: an unrecognised flag must read as a WRITE, not a read."""
+
+    @classmethod
+    def setUpClass(cls):
+        spec = importlib.util.spec_from_file_location("esp", ENF)
+        cls.m = importlib.util.module_from_spec(spec)
+        sys.modules["esp"] = cls.m
+        spec.loader.exec_module(cls.m)
+
+    def test_sed_short_flag_cluster_containing_i_is_a_write(self):
+        for toks in (["-i"], ["-i.bak"], ["-ni"], ["-Ei"], ["-i", "s/a/b/"]):
+            with self.subTest(toks=toks):
+                self.assertTrue(self.m._sed_writes(toks), toks)
+
+    def test_sed_flags_without_i_are_reads(self):
+        for toks in (["-n"], ["-E"], ["-r"], ["-e", "s/a/b/"], ["--expression=s/a/b/"]):
+            with self.subTest(toks=toks):
+                self.assertFalse(self.m._sed_writes(toks), toks)
+
+    def test_sed_backup_suffix_is_not_parsed_as_flags(self):
+        # `-n.i` would otherwise look like a write because of the trailing i;
+        # everything after the first '.' is the suffix, not a flag cluster.
+        self.assertFalse(self.m._sed_writes(["-n.i"]))
+
+    def test_find_exec_family_is_a_write_whatever_it_runs(self):
+        # What -exec runs cannot be judged from the flag, so it counts as a write.
+        for tok in ("-delete", "-exec", "-execdir", "-ok", "-okdir",
+                    "-fprint", "-fprint0", "-fprintf", "-fls"):
+            with self.subTest(tok=tok):
+                self.assertTrue(self.m._find_writes([tok]))
+
+    def test_find_pure_predicates_are_reads(self):
+        for toks in (["-name", "*.py"], ["-type", "f"], ["-maxdepth", "2"], ["-print"]):
+            with self.subTest(toks=toks):
+                self.assertFalse(self.m._find_writes(toks), toks)
+
+    def test_only_these_two_verbs_are_conditional(self):
+        # Widening this map is a security decision; pin the membership so it
+        # cannot grow by accident.
+        self.assertEqual(set(self.m.CONDITIONAL_VERBS), {"sed", "find"})
+
+
+if __name__ == "__main__":
+    unittest.main()