@miller-tech/uap 1.61.3 → 1.62.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.61.3",
+  "version": "1.62.0",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/src/policies/enforcers/workdir_scope.py

@@ -0,0 +1,170 @@
+#!/usr/bin/env python3
+"""workdir-scope enforcer: file-mutating tool calls must stay within the project
+working directory (the repo root + its worktrees + a small scratch allow-list).
+
+Creating/writing/moving a path OUTSIDE the workdir is blocked by default — it
+requires explicit operator approval. This is the policy-engine enforcement of the
+operator rule "never step outside the current path without explicit permission":
+agents running with --dangerously-skip-permissions emit absolute paths that can
+escape the project (e.g. a sibling at ~/dev, or a garbled `octopusspace-shooter`),
+silently creating directories outside the intended workspace.
+
+Allowed targets:
+  * anything under the current working tree (UAP_WORKTREE_ROOT) or the main
+    checkout (UAP_REPO_ROOT) — worktrees included;
+  * relative paths (they resolve under the project root);
+  * a scratch allow-list: /tmp, $TMPDIR, ~/.cache/uap, ~/.config/uap, plus any
+    colon-separated prefixes in UAP_WORKDIR_ALLOW.
+
+Escape hatch: UAP_WORKDIR_SCOPE_OFF=1 allows everything (operator override).
+"""
+from __future__ import annotations
+
+import os
+import re
+import shlex
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent))
+from _common import emit, parse_cli, repo_root, worktree_root  # noqa: E402
+
+# Tools that create/modify a file at an explicit path argument.
+PATH_WRITE_OPS = {
+    "Write", "Edit", "MultiEdit", "NotebookEdit",
+    "write", "edit", "multiedit", "notebookedit",
+}
+PATH_ARG_KEYS = ("file_path", "path", "notebook_path", "filePath", "target")
+
+# Bash verbs that CREATE/MOVE filesystem entries (pure-read commands are ignored).
+_BASH_CREATE = ("mkdir", "touch", "install", "tee")
+_BASH_DEST_LAST = ("cp", "mv", "rsync")  # destination is the final argument
+
+
+def _expand(p: str) -> Path:
+    return Path(os.path.expanduser(os.path.expandvars(p)))
+
+
+def _allowed_roots() -> list[Path]:
+    roots: list[Path] = []
+
+    def add(p: Path) -> None:
+        try:
+            r = p.resolve()
+        except Exception:  # noqa: BLE001
+            r = p
+        if r not in roots:
+            roots.append(r)
+
+    add(worktree_root())
+    add(repo_root())
+    for p in ("/tmp", os.environ.get("TMPDIR", "/tmp"), "~/.cache/uap", "~/.config/uap"):
+        add(_expand(p))
+    for p in os.environ.get("UAP_WORKDIR_ALLOW", "").split(":"):
+        if p.strip():
+            add(_expand(p))
+    return roots
+
+
+def _inside(target: Path, roots: list[Path]) -> bool:
+    try:
+        t = target.resolve()
+    except Exception:  # noqa: BLE001
+        t = target
+    for root in roots:
+        try:
+            t.relative_to(root)
+            return True
+        except ValueError:
+            continue
+    return False
+
+
+def _check_path(target: str, roots: list[Path]) -> str:
+    """Return the offending absolute path if out of scope, else ''."""
+    if not target:
+        return ""
+    p = _expand(target)
+    if not p.is_absolute():
+        # Relative paths resolve under the enforcer cwd (the project root).
+        return ""
+    return "" if _inside(p, roots) else str(p)
+
+
+def _scan_bash(cmd: str, roots: list[Path]) -> str:
+    """Best-effort: flag an out-of-scope absolute path that a CREATE/MOVE command
+    would write. Conservative — only inspects the destinations of known
+    create/move verbs and output redirections, and ignores read sources."""
+    if not cmd:
+        return ""
+    try:
+        tokens = shlex.split(cmd, comments=True)
+    except ValueError:
+        tokens = cmd.split()
+
+    candidates: list[str] = []
+
+    # Output redirections: > /abs, >> /abs (also 2>/abs).
+    for m in re.finditer(r'(?:\d*>>?|&>)\s*("?)(/[^\s"\';|&)]+)\1', cmd):
+        candidates.append(m.group(2))
+
+    # Split into pipeline/sequence segments so we read each command's own verb.
+    segments = re.split(r'\|\||&&|[;|&\n]', cmd)
+    for seg in segments:
+        try:
+            parts = shlex.split(seg, comments=True)
+        except ValueError:
+            parts = seg.split()
+        if not parts:
+            continue
+        verb = os.path.basename(parts[0])
+        argv = [a for a in parts[1:] if not a.startswith("-")]
+        if verb in _BASH_CREATE:
+            candidates.extend(argv)  # all targets are created
+        elif verb in _BASH_DEST_LAST and argv:
+            candidates.append(argv[-1])  # only the destination is written
+
+    for c in candidates:
+        bad = _check_path(c, roots)
+        if bad:
+            return bad
+    return ""
+
+
+def main() -> None:
+    op, args = parse_cli()
+
+    if os.environ.get("UAP_WORKDIR_SCOPE_OFF") == "1":
+        emit(True, "UAP_WORKDIR_SCOPE_OFF override set")
+
+    roots = _allowed_roots()
+
+    if op in PATH_WRITE_OPS:
+        for key in PATH_ARG_KEYS:
+            bad = _check_path(args.get(key) or "", roots)
+            if bad:
+                _deny(bad)
+        emit(True, "target within workdir scope")
+
+    if op in {"Bash", "bash"}:
+        bad = _scan_bash(args.get("command") or "", roots)
+        if bad:
+            _deny(bad, bash=True)
+        emit(True, "no out-of-scope write target in command")
+
+    emit(True, "not a path-mutating operation")
+
+
+def _deny(path: str, bash: bool = False) -> None:
+    where = "command writes to" if bash else "target"
+    emit(
+        False,
+        f"workdir-scope: {where} '{path}' is OUTSIDE the project working directory. "
+        "Stepping outside the current path requires explicit permission. "
+        "Write inside the project, or — if this is intended — re-run with "
+        "UAP_WORKDIR_SCOPE_OFF=1 (or add the prefix to UAP_WORKDIR_ALLOW).",
+    )
+
+
+if __name__ == "__main__":
+    main()

package/src/policies/schemas/policies/workdir-scope.md

@@ -0,0 +1,38 @@
+# workdir-scope
+
+**Category**: safety
+**Level**: REQUIRED
+**Enforcement Stage**: pre-exec
+**Tags**: filesystem, scope, safety, permission
+
+## Rule
+
+File-mutating tool calls MUST stay within the project working directory. A
+`Write`, `Edit`, `MultiEdit`, or `NotebookEdit` whose target — or a `Bash`
+command whose create/move destination (`mkdir`, `touch`, `cp`, `mv`, `install`,
+`tee`, output redirection) — resolves OUTSIDE the working tree is **blocked**.
+
+In scope (allowed): the current working tree and main checkout (worktrees
+included), relative paths, and a scratch allow-list (`/tmp`, `$TMPDIR`,
+`~/.cache/uap`, `~/.config/uap`, plus `UAP_WORKDIR_ALLOW` prefixes).
+
+## Why
+
+Agents running with `--dangerously-skip-permissions` emit absolute paths that can
+escape the project (a sibling at `~/dev`, or a garbled name like
+`octopusspace-shooter`), silently creating directories and writing files outside
+the intended workspace. Stepping outside the current path must require explicit
+operator permission — not happen silently.
+
+## Enforcement
+
+Python enforcer `workdir_scope.py` resolves each target/destination against the
+working-tree roots and rejects any that fall outside (minus the scratch
+allow-list). Escape hatch: `UAP_WORKDIR_SCOPE_OFF=1` allows everything;
+`UAP_WORKDIR_ALLOW=/extra/prefix:...` widens the allow-list.
+
+```rules
+- title: "File writes must stay inside the project working directory"
+  keywords: [write, edit, multiedit, notebookedit, mkdir, create-file, bash]
+  antiPatterns: []
+```

package/tools/agents/tests/test_workdir_scope_enforcer.py

@@ -0,0 +1,134 @@
+#!/usr/bin/env python3
+"""Tests for the workdir-scope policy enforcer.
+
+Invoked the way the policy gate invokes it: a subprocess given --operation and
+--args, returning {"allowed": bool, "reason": str} on stdout and exit 0/2. The
+project roots are supplied via UAP_REPO_ROOT / UAP_WORKTREE_ROOT (as the gate
+does), pointed at a temp directory so tests are hermetic.
+"""
+
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+ENFORCER = (
+    Path(__file__).resolve().parents[3]
+    / "src" / "policies" / "enforcers" / "workdir_scope.py"
+)
+
+
+def run(op, args, root, env_extra=None):
+    env = dict(os.environ)
+    env["UAP_REPO_ROOT"] = str(root)
+    env["UAP_WORKTREE_ROOT"] = str(root)
+    env.pop("UAP_WORKDIR_SCOPE_OFF", None)
+    env.pop("UAP_WORKDIR_ALLOW", None)
+    if env_extra:
+        env.update(env_extra)
+    p = subprocess.run(
+        [sys.executable, str(ENFORCER), "--operation", op, "--args", json.dumps(args)],
+        capture_output=True, text=True, env=env, cwd=str(root),
+    )
+    try:
+        out = json.loads(p.stdout)
+    except json.JSONDecodeError:
+        out = {"allowed": True, "reason": f"<unparseable: {p.stdout!r} {p.stderr!r}>"}
+    return out, p.returncode
+
+
+class TestWorkdirScopeEnforcer(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.root = Path(self._tmp.name).resolve()
+        (self.root / ".worktrees" / "001-x").mkdir(parents=True)
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def _allow(self, out, code, msg=""):
+        self.assertTrue(out["allowed"], f"{msg}: {out}")
+        self.assertEqual(code, 0)
+
+    def _block(self, out, code, msg=""):
+        self.assertFalse(out["allowed"], f"{msg}: {out}")
+        self.assertEqual(code, 2)
+        self.assertIn("workdir-scope", out["reason"])
+
+    # --- file-write tools ---
+
+    def test_write_inside_root_allowed(self):
+        out, c = run("Write", {"file_path": str(self.root / "src/a.js")}, self.root)
+        self._allow(out, c, "in-root write")
+
+    def test_write_outside_root_blocked(self):
+        out, c = run("Write", {"file_path": "/home/cogtek/dev/octopusspace-shooter/x.js"}, self.root)
+        self._block(out, c, "out-of-root write")
+
+    def test_relative_path_allowed(self):
+        out, c = run("Edit", {"file_path": "src/a.js"}, self.root)
+        self._allow(out, c, "relative path")
+
+    def test_scratch_tmp_allowed(self):
+        out, c = run("Write", {"file_path": "/tmp/uap-scratch/x"}, self.root)
+        self._allow(out, c, "/tmp scratch")
+
+    def test_worktree_path_allowed(self):
+        out, c = run("Write", {"file_path": str(self.root / ".worktrees/001-x/f.ts")}, self.root)
+        self._allow(out, c, "worktree path")
+
+    def test_notebook_edit_outside_blocked(self):
+        out, c = run("NotebookEdit", {"notebook_path": "/etc/evil.ipynb"}, self.root)
+        self._block(out, c, "notebook outside")
+
+    # --- bash ---
+
+    def test_bash_mkdir_outside_blocked(self):
+        out, c = run("Bash", {"command": "mkdir -p /home/cogtek/dev/octopusspace-shooter/js"}, self.root)
+        self._block(out, c, "mkdir outside")
+
+    def test_bash_mkdir_inside_allowed(self):
+        out, c = run("Bash", {"command": "mkdir -p ./src/new"}, self.root)
+        self._allow(out, c, "mkdir inside")
+
+    def test_bash_read_only_allowed(self):
+        out, c = run("Bash", {"command": "cat /etc/hosts && ls /usr/bin"}, self.root)
+        self._allow(out, c, "read-only command")
+
+    def test_bash_cp_dest_outside_blocked(self):
+        out, c = run("Bash", {"command": "cp ./a.txt /var/tmp2/out/b.txt"}, self.root)
+        self._block(out, c, "cp dest outside")
+
+    def test_bash_cp_source_outside_dest_inside_allowed(self):
+        out, c = run("Bash", {"command": "cp /etc/hosts ./local-hosts"}, self.root)
+        self._allow(out, c, "read source outside, write inside")
+
+    def test_bash_redirect_outside_blocked(self):
+        out, c = run("Bash", {"command": "echo hi > /opt/somewhere/file"}, self.root)
+        self._block(out, c, "redirect outside")
+
+    # --- overrides / non-mutating ---
+
+    def test_scope_off_override_allows(self):
+        out, c = run("Write", {"file_path": "/anywhere/x"}, self.root, {"UAP_WORKDIR_SCOPE_OFF": "1"})
+        self._allow(out, c, "scope-off override")
+
+    def test_workdir_allow_widens(self):
+        out, c = run("Write", {"file_path": "/opt/extra/x"}, self.root, {"UAP_WORKDIR_ALLOW": "/opt/extra"})
+        self._allow(out, c, "allow-list widened")
+
+    def test_non_path_op_allowed(self):
+        out, c = run("Grep", {"pattern": "foo"}, self.root)
+        self._allow(out, c, "non-path op")
+
+    def test_read_op_outside_allowed(self):
+        # Reading outside the workdir is fine; only mutations are scoped.
+        out, c = run("Read", {"file_path": "/etc/hosts"}, self.root)
+        self._allow(out, c, "read outside allowed")
+
+
+if __name__ == "__main__":
+    unittest.main()