@miller-tech/uap 1.61.2 → 1.62.0

package/tools/agents/tests/test_path_normalizer_hardened.py

@@ -0,0 +1,144 @@
+#!/usr/bin/env python3
+"""Tests for the hardened (filesystem-verified, same-directory-only) tool-call
+path normalizer.
+
+The heuristic predecessor silently RELOCATED writes across projects/worktrees
+(e.g. octopus_invaders/js/config.js -> octopus-invader/space-shooter/js/config.js),
+turning a loud self-correcting failure into a silent wrong-write. These tests
+pin the conservative contract: only a filename may be repaired, only inside a
+directory that already exists on disk, only when exactly one real sibling
+matches — and a wrong/garbled directory or any ambiguity is left untouched.
+"""
+
+import importlib.util
+import os
+import tempfile
+import unittest
+from pathlib import Path
+
+
+def _load():
+    p = Path(__file__).resolve().parents[1] / "scripts" / "toolcall_path_normalizer.py"
+    spec = importlib.util.spec_from_file_location("toolcall_path_normalizer", p)
+    m = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(m)
+    return m
+
+
+norm = _load()
+
+
+def _touch(path):
+    os.makedirs(os.path.dirname(path), exist_ok=True)
+    with open(path, "w") as f:
+        f.write("x")
+    return path
+
+
+class TestHardenedNormalizer(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.root = self._tmp.name
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    # --- the repairs it SHOULD make (filename only, same real dir) ---
+
+    def test_fixes_case_in_same_directory(self):
+        real = _touch(os.path.join(self.root, "proj", "config.js"))
+        proposed = os.path.join(self.root, "proj", "Config.js")  # wrong case, doesn't exist
+        path, changed, _ = norm.normalize_tool_path(proposed)
+        self.assertTrue(changed)
+        self.assertEqual(path, real)
+
+    def test_fixes_dropped_extension_in_same_directory(self):
+        real = _touch(os.path.join(self.root, "proj", "config.js"))
+        proposed = os.path.join(self.root, "proj", "configjs")  # squash-match
+        path, changed, _ = norm.normalize_tool_path(proposed)
+        self.assertTrue(changed)
+        self.assertEqual(path, real)
+
+    def test_trims_whitespace_on_real_path(self):
+        real = _touch(os.path.join(self.root, "proj", "a.js"))
+        path, changed, reason = norm.normalize_tool_path(f"  {real}  ")
+        self.assertTrue(changed)
+        self.assertEqual(path, real)
+        self.assertIn("trimmed", reason)
+
+    # --- the corruption it MUST NOT cause anymore ---
+
+    def test_does_not_relocate_to_a_different_directory(self):
+        # config.js exists only in projA; a (non-existent) write to projB/config.js
+        # must NOT be snapped into projA — the live octopus-style corruption.
+        _touch(os.path.join(self.root, "projA", "config.js"))
+        os.makedirs(os.path.join(self.root, "projB"))  # real but has no config.js
+        proposed = os.path.join(self.root, "projB", "config.js")
+        path, changed, _ = norm.normalize_tool_path(proposed)
+        self.assertFalse(changed)
+        self.assertEqual(path, proposed)
+
+    def test_garbled_directory_is_never_guessed(self):
+        # The real dir is 'octopus-invader/space-shooter/js'; the model wrote to a
+        # DIFFERENT, non-existent dir 'octopus_invaders/js'. Must be a no-op.
+        _touch(os.path.join(self.root, "octopus-invader", "space-shooter", "js", "config.js"))
+        proposed = os.path.join(self.root, "octopus_invaders", "js", "config.js")
+        path, changed, _ = norm.normalize_tool_path(proposed)
+        self.assertFalse(changed)
+        self.assertEqual(path, proposed)
+
+    def test_punctuation_only_directory_difference_is_not_crossed(self):
+        # 's-space-shooter' vs 's space-shooter' are DIFFERENT real dirs; the old
+        # squash() guard treated them as the same. Must not relocate.
+        _touch(os.path.join(self.root, "s space-shooter", "css", "styles.css"))
+        os.makedirs(os.path.join(self.root, "s-space-shooter", "css"))
+        proposed = os.path.join(self.root, "s-space-shooter", "css", "styles.css")
+        path, changed, _ = norm.normalize_tool_path(proposed)
+        self.assertFalse(changed)
+        self.assertEqual(path, proposed)
+
+    def test_ambiguous_match_is_left_alone(self):
+        # Two files squash-match the garbled basename -> ambiguous -> no-op.
+        _touch(os.path.join(self.root, "proj", "config.js"))
+        _touch(os.path.join(self.root, "proj", "config.ts"))
+        proposed = os.path.join(self.root, "proj", "configjs?")  # squashes to 'configjs'/'configts'?
+        # Make it genuinely ambiguous: 'config' squashes both 'config.js' and 'config.ts'.
+        proposed = os.path.join(self.root, "proj", "config")
+        path, changed, _ = norm.normalize_tool_path(proposed)
+        self.assertFalse(changed)
+        self.assertEqual(path, proposed)
+
+    def test_legitimate_new_file_passes_through(self):
+        # Creating a brand-new file in a real dir with no sibling match -> unchanged.
+        os.makedirs(os.path.join(self.root, "proj"))
+        proposed = os.path.join(self.root, "proj", "brand_new_helper.js")
+        path, changed, _ = norm.normalize_tool_path(proposed)
+        self.assertFalse(changed)
+        self.assertEqual(path, proposed)
+
+    def test_already_correct_path_unchanged(self):
+        real = _touch(os.path.join(self.root, "proj", "a.js"))
+        path, changed, _ = norm.normalize_tool_path(real)
+        self.assertFalse(changed)
+        self.assertEqual(path, real)
+
+    def test_relative_path_is_not_touched(self):
+        # No reliable cwd at the proxy -> relative paths pass through untouched.
+        path, changed, _ = norm.normalize_tool_path("src/Config.js")
+        self.assertFalse(changed)
+        self.assertEqual(path, "src/Config.js")
+
+    # --- integration through the public entry point ---
+
+    def test_normalize_tool_uses_applies_and_reports(self):
+        real = _touch(os.path.join(self.root, "proj", "config.js"))
+        wrong = os.path.join(self.root, "proj", "CONFIG.JS")
+        tool_uses = [{"type": "tool_use", "id": "t1", "input": {"file_path": wrong, "content": "y"}}]
+        corrections = norm.normalize_tool_uses(tool_uses, known_paths=[])
+        self.assertEqual(tool_uses[0]["input"]["file_path"], real)
+        self.assertEqual(tool_uses[0]["input"]["content"], "y")  # non-path arg untouched
+        self.assertEqual(len(corrections), 1)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_workdir_scope_enforcer.py

@@ -0,0 +1,134 @@
+#!/usr/bin/env python3
+"""Tests for the workdir-scope policy enforcer.
+
+Invoked the way the policy gate invokes it: a subprocess given --operation and
+--args, returning {"allowed": bool, "reason": str} on stdout and exit 0/2. The
+project roots are supplied via UAP_REPO_ROOT / UAP_WORKTREE_ROOT (as the gate
+does), pointed at a temp directory so tests are hermetic.
+"""
+
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+ENFORCER = (
+    Path(__file__).resolve().parents[3]
+    / "src" / "policies" / "enforcers" / "workdir_scope.py"
+)
+
+
+def run(op, args, root, env_extra=None):
+    env = dict(os.environ)
+    env["UAP_REPO_ROOT"] = str(root)
+    env["UAP_WORKTREE_ROOT"] = str(root)
+    env.pop("UAP_WORKDIR_SCOPE_OFF", None)
+    env.pop("UAP_WORKDIR_ALLOW", None)
+    if env_extra:
+        env.update(env_extra)
+    p = subprocess.run(
+        [sys.executable, str(ENFORCER), "--operation", op, "--args", json.dumps(args)],
+        capture_output=True, text=True, env=env, cwd=str(root),
+    )
+    try:
+        out = json.loads(p.stdout)
+    except json.JSONDecodeError:
+        out = {"allowed": True, "reason": f"<unparseable: {p.stdout!r} {p.stderr!r}>"}
+    return out, p.returncode
+
+
+class TestWorkdirScopeEnforcer(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.root = Path(self._tmp.name).resolve()
+        (self.root / ".worktrees" / "001-x").mkdir(parents=True)
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def _allow(self, out, code, msg=""):
+        self.assertTrue(out["allowed"], f"{msg}: {out}")
+        self.assertEqual(code, 0)
+
+    def _block(self, out, code, msg=""):
+        self.assertFalse(out["allowed"], f"{msg}: {out}")
+        self.assertEqual(code, 2)
+        self.assertIn("workdir-scope", out["reason"])
+
+    # --- file-write tools ---
+
+    def test_write_inside_root_allowed(self):
+        out, c = run("Write", {"file_path": str(self.root / "src/a.js")}, self.root)
+        self._allow(out, c, "in-root write")
+
+    def test_write_outside_root_blocked(self):
+        out, c = run("Write", {"file_path": "/home/cogtek/dev/octopusspace-shooter/x.js"}, self.root)
+        self._block(out, c, "out-of-root write")
+
+    def test_relative_path_allowed(self):
+        out, c = run("Edit", {"file_path": "src/a.js"}, self.root)
+        self._allow(out, c, "relative path")
+
+    def test_scratch_tmp_allowed(self):
+        out, c = run("Write", {"file_path": "/tmp/uap-scratch/x"}, self.root)
+        self._allow(out, c, "/tmp scratch")
+
+    def test_worktree_path_allowed(self):
+        out, c = run("Write", {"file_path": str(self.root / ".worktrees/001-x/f.ts")}, self.root)
+        self._allow(out, c, "worktree path")
+
+    def test_notebook_edit_outside_blocked(self):
+        out, c = run("NotebookEdit", {"notebook_path": "/etc/evil.ipynb"}, self.root)
+        self._block(out, c, "notebook outside")
+
+    # --- bash ---
+
+    def test_bash_mkdir_outside_blocked(self):
+        out, c = run("Bash", {"command": "mkdir -p /home/cogtek/dev/octopusspace-shooter/js"}, self.root)
+        self._block(out, c, "mkdir outside")
+
+    def test_bash_mkdir_inside_allowed(self):
+        out, c = run("Bash", {"command": "mkdir -p ./src/new"}, self.root)
+        self._allow(out, c, "mkdir inside")
+
+    def test_bash_read_only_allowed(self):
+        out, c = run("Bash", {"command": "cat /etc/hosts && ls /usr/bin"}, self.root)
+        self._allow(out, c, "read-only command")
+
+    def test_bash_cp_dest_outside_blocked(self):
+        out, c = run("Bash", {"command": "cp ./a.txt /var/tmp2/out/b.txt"}, self.root)
+        self._block(out, c, "cp dest outside")
+
+    def test_bash_cp_source_outside_dest_inside_allowed(self):
+        out, c = run("Bash", {"command": "cp /etc/hosts ./local-hosts"}, self.root)
+        self._allow(out, c, "read source outside, write inside")
+
+    def test_bash_redirect_outside_blocked(self):
+        out, c = run("Bash", {"command": "echo hi > /opt/somewhere/file"}, self.root)
+        self._block(out, c, "redirect outside")
+
+    # --- overrides / non-mutating ---
+
+    def test_scope_off_override_allows(self):
+        out, c = run("Write", {"file_path": "/anywhere/x"}, self.root, {"UAP_WORKDIR_SCOPE_OFF": "1"})
+        self._allow(out, c, "scope-off override")
+
+    def test_workdir_allow_widens(self):
+        out, c = run("Write", {"file_path": "/opt/extra/x"}, self.root, {"UAP_WORKDIR_ALLOW": "/opt/extra"})
+        self._allow(out, c, "allow-list widened")
+
+    def test_non_path_op_allowed(self):
+        out, c = run("Grep", {"pattern": "foo"}, self.root)
+        self._allow(out, c, "non-path op")
+
+    def test_read_op_outside_allowed(self):
+        # Reading outside the workdir is fine; only mutations are scoped.
+        out, c = run("Read", {"file_path": "/etc/hosts"}, self.root)
+        self._allow(out, c, "read outside allowed")
+
+
+if __name__ == "__main__":
+    unittest.main()