@miller-tech/uap 1.43.3 → 1.45.0

package/dist/delivery/self-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-gate.js","sourceRoot":"","sources":["../../src/delivery/self-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,MAAM,QAAQ,GAAG,cAAc,CAAC;AAChC,MAAM,SAAS,GAAG,WAAW,CAAC;AAC9B,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAsBnC,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,WAAmB;IAC/C,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,oEAAoE;IACpE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,wBAAwB,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CACxB,WAAmB,EACnB,WAAmB,EACnB,aAA4B;IAE5B,MAAM,KAAK,GAAG,aAAa;QACzB,CAAC,CAAC,kDAAkD,aAAa,yEAAyE;QAC1I,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,uEAAuE;QACvE,EAAE;QACF,UAAU,WAAW,EAAE;QACvB,EAAE;QACF,iBAAiB,WAAW,EAAE;QAC9B,EAAE;QACF,gDAAgD;QAChD,+DAA+D;QAC/D,+DAA+D;QAC/D,2EAA2E;QAC3E,wDAAwD;QACxD,2EAA2E;QAC3E,8BAA8B;QAC9B,uCAAuC;QACvC,EAAE;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,6DAA6D;QAC7D,EAAE;QACF,4DAA4D;QAC5D,KAAK;KACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,6DAA6D;AAC7D,SAAS,OAAO,CACd,UAAkB,EAClB,WAAmB,EACnB,SAAiB;IAEjB,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;QACxC,GAAG,EAAE,WAAW;QAChB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/F,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAqB;IAC9D,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,gBAAgB,CAAC;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAElE,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;QACrD,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,8BAA8B,CAAC,CAAC;YAC7D,aAAa,GAAG,+BAA+B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;YAC3E,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;QACD,WAAW,GAAG,IAAI,CAAC;QAEnB,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,yBAAyB,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;YACtF,aAAa,GAAG,yDAAyD,CAAC;YAC1E,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACvB,mEAAmE;YACnE,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,6DAA6D,CAAC,CAAC;YAC5F,aAAa,GAAG,4EAA4E,CAAC;YAC7F,SAAS;QACX,CAAC;QAED,uEAAuE;QACvE,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,uCAAuC,GAAG,CAAC,QAAQ,cAAc,CAAC,CAAC;QAChG,OAAO;YACL,IAAI,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC;YACtC,UAAU;YACV,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,OAAO;YACjB,KAAK;SACN,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,gEAAgE;IAChE,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;QAC3D,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QAC3C,OAAO,EAAE,IAAI;QACb,QAAQ;QACR,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB,EAAE,SAAiB;IACtD,OAAO;QACL,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,2CAA2C;QACjD,OAAO,EAAE,MAAM;QACf,IAAI,EAAE,CAAC,UAAU,CAAC;QAClB,QAAQ,EAAE,IAAI;QACd,SAAS;KACV,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.43.3",
+  "version": "1.45.0",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/tools/agents/install-opencode-local.sh.j2

@@ -118,12 +118,17 @@ else
     # -------------------------------------------------------------------
     # NPM REGISTRY MODE: Fallback when no local mount is present
     # -------------------------------------------------------------------
+    # NOTE: the published package is @miller-tech/uap (the old
+    # `universal-agent-protocol` name 404s). Prefer the local /uap-local mount
+    # (handled above + re-installed by the agent after upload); this registry
+    # path is only a last-resort fallback.
     CURRENT_UAP=$(uap --version 2>/dev/null || echo "none")
-    if [ "$CURRENT_UAP" = "$UAP_VERSION" ]; then
-        echo "  UAP v${UAP_VERSION} already installed - skipping"
+    if [ "$CURRENT_UAP" != "none" ]; then
+        echo "  UAP already installed (v${CURRENT_UAP}) - skipping registry fetch"
     else
-        npm i -g universal-agent-protocol@${UAP_VERSION} 2>/dev/null || true
-        echo "  UAP v${UAP_VERSION} installed from npm registry"
+        npm i -g @miller-tech/uap@latest 2>/dev/null \
+            && echo "  UAP installed from npm registry (@miller-tech/uap@latest)" \
+            || echo "  WARNING: UAP npm registry install failed (will rely on /uap-local)"
     fi
 fi
 

package/tools/agents/opencode_uap_agent.py

@@ -1179,6 +1179,10 @@ class OpenCodeUAP(BaseInstalledAgent):
             "tools/agents",
             "tools/uap_harbor",
             "harbor-configs",
+            # Needed so `uap install opencode` can wire the policy gate +
+            # delivery-enforcement enforcer inside the container.
+            "src/policies/enforcers",
+            "src/policies/schemas/policies",
         ]
         local_upload_files = [
             "package.json",
@@ -1227,6 +1231,13 @@ class OpenCodeUAP(BaseInstalledAgent):
 
         logger.info("[Local UAP] Local project uploaded to /uap-local/")
 
+        # NOTE: we deliberately do NOT `npm i -g file:/uap-local` here. The
+        # install script's npm path already globally installs @miller-tech/uap
+        # (with its runtime deps) and runs `uap install opencode`. Re-linking
+        # the global bin to /uap-local — which has no node_modules — would break
+        # the CLI at runtime (ERR_MODULE_NOT_FOUND: commander). The uploaded
+        # /uap-local copy is kept only for Python-side imports / inspection.
+
     def populate_context_post_run(self, context: AgentContext) -> None:
         _parse_token_counts(self.logs_dir, context)
 
@@ -1398,7 +1409,14 @@ class OpenCodeUAP(BaseInstalledAgent):
     def create_run_agent_commands(self, instruction: str) -> list[ExecInput]:
         model = self.model_name or "llama.cpp/qwen35-a3b-iq4xs"
 
-        env = {"OPENCODE_FAKE_VCS": "git"}
+        env = {
+            "OPENCODE_FAKE_VCS": "git",
+            # Transparent delivery: the uap-enforce plugin reads these to run
+            # the `uap deliver` convergence loop on the first source edit.
+            "UAP_DELIVER_ENDPOINT": self._api_endpoint,
+            "UAP_DELIVER_MODEL": os.environ.get("UAP_DELIVER_MODEL", "qwen35-a3b"),
+            "UAP_ENFORCE_DELIVERY": os.environ.get("UAP_ENFORCE_DELIVERY", "block"),
+        }
 
         # --- Step 0: Build classified CLAUDE.md and enhanced instruction ---
         classified_claude_md = build_classified_claude_md(instruction)
@@ -1524,6 +1542,17 @@ class OpenCodeUAP(BaseInstalledAgent):
         # --- Step 5: Environment bootstrapping ---
         commands.append(ExecInput(command=ENV_BOOTSTRAP_CMD))
 
+        # --- Step 5b: Stage raw task instruction for transparent delivery ---
+        # The uap-enforce plugin reads /app/.uap-deliver/task.txt to seed the
+        # `uap deliver` convergence loop on the first source edit.
+        task_b64 = base64.b64encode(instruction.encode()).decode()
+        deliver_task_cmd = (
+            "mkdir -p /app/.uap-deliver && "
+            f"echo '{task_b64}' | base64 -d > /app/.uap-deliver/task.txt && "
+            "echo '[Deliver] task instruction staged for transparent delivery'"
+        )
+        commands.append(ExecInput(command=deliver_task_cmd))
+
         # --- Step 6: Run opencode with enhanced instruction ---
         # opencode.json baseURL points to proxy at http://127.0.0.1:11435/v1
         # which injects tool_choice="required" and forwards to the real LLM

package/tools/agents/plugins/uap-enforce.ts

@@ -41,6 +41,11 @@ export const UapEnforce: Plugin = async ({ $ }) => {
   let totalToolCalls = 0;
   const SOFT_BUDGET = 30;
 
+  // Transparent delivery: the first substantive source edit triggers the
+  // `uap deliver` convergence loop ONCE per session. Guarded so it never
+  // re-enters or fires per-edit.
+  let deliverRan = false;
+
   const TELEMETRY_PATH = '/tmp/uap-telemetry.jsonl';
 
   const simpleHash = (s: string): string => {
@@ -60,6 +65,47 @@ export const UapEnforce: Plugin = async ({ $ }) => {
     'tool.execute.before': async (input, output) => {
       totalToolCalls++;
 
+      // --- Transparent delivery (Layer 5): converge via `uap deliver` ---
+      // When delivery enforcement is active (the UAP default), the FIRST
+      // substantive write/edit hands the task to the `uap deliver` convergence
+      // loop, which iterates the model against the project's real gates
+      // (build/typecheck/test) before the agent's own edit lands. This is how
+      // deliver "uplifts" a small local model: plausible -> verified. It runs
+      // exactly once per session; the original edit then proceeds normally.
+      // Escape hatches: UAP_ENFORCE_DELIVERY=advisory or UAP_DELIVER_BYPASS=1.
+      if (
+        !deliverRan &&
+        (input.tool === 'write' || input.tool === 'edit') &&
+        process.env.UAP_ENFORCE_DELIVERY !== 'advisory' &&
+        !process.env.UAP_DELIVER_BYPASS
+      ) {
+        deliverRan = true; // set first — prevents re-entry / per-edit loops
+        try {
+          const endpoint = process.env.UAP_DELIVER_ENDPOINT || '';
+          const model = process.env.UAP_DELIVER_MODEL || 'qwen35-a3b';
+          const endpointArg = endpoint ? `--endpoint ${endpoint}` : '';
+          const deliverScript =
+            'source $HOME/.nvm/nvm.sh 2>/dev/null || true; ' +
+            'TASK="$(cat /app/.uap-deliver/task.txt 2>/dev/null)"; ' +
+            'if [ -n "$TASK" ] && command -v uap >/dev/null 2>&1; then ' +
+            `echo "[Deliver] converging via uap deliver (model ${model})..."; ` +
+            `UAP_DELIVER_ACTIVE=1 uap deliver "$TASK" ${endpointArg} --model ${model} ` +
+            '--project-root /app --max-turns 5 --no-until-delivered ' +
+            '> /logs/agent/uap-deliver.log 2>&1 || true; ' +
+            'echo "[Deliver] convergence loop finished"; ' +
+            'else echo "[Deliver] skipped (no task file or uap CLI absent)"; fi';
+          await $`bash -lc ${deliverScript}`.nothrow();
+          await $`echo ${JSON.stringify(
+            JSON.stringify({ event: 'transparent_deliver', tool: input.tool, ts: new Date().toISOString() })
+          )} >> ${TELEMETRY_PATH}`
+            .quiet()
+            .nothrow();
+        } catch {
+          /* fail open — let the original edit proceed */
+        }
+        // fall through: the agent's own edit still executes
+      }
+
       // --- Worktree enforcement (Layer 4) ---
       // Warn when file writes happen outside a worktree
       if ((input.tool === 'write' || input.tool === 'edit') && output.args?.filePath) {