@miller-tech/uap 1.63.0 → 1.64.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.63.0",
+  "version": "1.64.1",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/src/policies/enforcers/workdir_scope.py

@@ -80,6 +80,14 @@ def _inside(target: Path, roots: list[Path]) -> bool:
     return False
 
 
+def _is_dev_node(p: Path) -> bool:
+    """True for device pseudo-files under /dev (/dev/null, /dev/stderr,
+    /dev/stdout, /dev/fd/N, /dev/tty, /dev/zero, ...). Redirecting or writing
+    to these never escapes the project workspace — it's universal shell idiom
+    (`2>/dev/null`, `>/dev/stdout`) — so they are always in scope."""
+    return p == Path("/dev") or str(p).startswith("/dev/")
+
+
 def _check_path(target: str, roots: list[Path]) -> str:
     """Return the offending absolute path if out of scope, else ''."""
     if not target:
@@ -88,6 +96,9 @@ def _check_path(target: str, roots: list[Path]) -> str:
     if not p.is_absolute():
         # Relative paths resolve under the enforcer cwd (the project root).
         return ""
+    if _is_dev_node(p):
+        # /dev device nodes are not a filesystem escape (e.g. `2>/dev/null`).
+        return ""
     return "" if _inside(p, roots) else str(p)
 
 

package/tools/agents/scripts/anthropic_proxy.py

@@ -277,20 +277,62 @@ PROXY_HARD_FINALIZE_TURNS = int(
 PROXY_TOOLCALL_PATH_NORMALIZE = os.environ.get(
     "PROXY_TOOLCALL_PATH_NORMALIZE", "off"
 ).lower() in ("on", "1", "true", "yes")
+# Path CONTAINMENT (separate from same-dir normalization): snap a garbled
+# out-of-workdir path (the small quant mangling the absolute PREFIX, e.g.
+# /home/cogtek -> /home/cogtec, octopus_invaders -> octus_invaders) back ONTO the
+# session workdir. Safe because the OS sandbox contains any mis-snap to the
+# workdir — without the sandbox this would risk cross-project relocation, so it
+# defaults ON only alongside sandboxed sessions. Set off to disable.
+PROXY_TOOLCALL_PATH_CONTAIN = os.environ.get(
+    "PROXY_TOOLCALL_PATH_CONTAIN", "on"
+).lower() in ("on", "1", "true", "yes")
 try:
     import sys as _sys
     _sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))  # launch-robust sibling import
     from toolcall_path_normalizer import extract_known_paths as _shz_known_paths
     from toolcall_path_normalizer import normalize_tool_uses as _shz_normalize_tool_uses
+    from toolcall_path_normalizer import derive_workdir as _shz_derive_workdir
+    from toolcall_path_normalizer import contain_tool_uses as _shz_contain_tool_uses
     _TOOLCALL_NORMALIZER_OK = True
 except Exception:  # pragma: no cover - optional middleware
     _TOOLCALL_NORMALIZER_OK = False
 
 
+def _toolcall_workdir_hint(messages: list, limit: int = 8000) -> str:
+    """Recent text/tool_result content (capped) so derive_workdir can recover the
+    real workdir echoed in command outputs even when the model's own tool-call
+    paths are all garbled."""
+    out: list[str] = []
+    total = 0
+    for msg in reversed(messages or []):
+        content = msg.get("content")
+        chunks: list[str] = []
+        if isinstance(content, str):
+            chunks.append(content)
+        elif isinstance(content, list):
+            for b in content:
+                if not isinstance(b, dict) or b.get("type") not in ("text", "tool_result"):
+                    continue
+                c = b.get("content", b.get("text", ""))
+                if isinstance(c, list):
+                    c = " ".join(x.get("text", "") for x in c if isinstance(x, dict))
+                if isinstance(c, str):
+                    chunks.append(c)
+        for c in chunks:
+            out.append(c)
+            total += len(c)
+        if total >= limit:
+            break
+    return " ".join(out)[:limit]
+
+
 def _maybe_normalize_toolcall_paths(anthropic_resp: dict, request_body: dict) -> None:
-    """Gated: snap garbled tool-call paths in the response to paths the model
-    used correctly earlier in the conversation. No-op unless enabled + available."""
-    if not (PROXY_TOOLCALL_PATH_NORMALIZE and _TOOLCALL_NORMALIZER_OK):
+    """Gated: (1) CONTAIN garbled out-of-workdir paths back onto the session
+    workdir (safe under the OS sandbox), then (2) snap remaining garbles to the
+    same real directory. No-op unless enabled + available."""
+    if not _TOOLCALL_NORMALIZER_OK or not (
+        PROXY_TOOLCALL_PATH_NORMALIZE or PROXY_TOOLCALL_PATH_CONTAIN
+    ):
         return
     try:
         content = anthropic_resp.get("content")
@@ -299,15 +341,26 @@ def _maybe_normalize_toolcall_paths(anthropic_resp: dict, request_body: dict) ->
         tool_uses = [b for b in content if isinstance(b, dict) and b.get("type") == "tool_use"]
         if not tool_uses:
             return
-        known = _shz_known_paths(request_body.get("messages", []))
-        if not known:
-            return
-        corrections = _shz_normalize_tool_uses(tool_uses, known)
-        for tu_id, key, frm, to, reason in corrections:
-            logger.info(
-                "TOOLCALL PATH NORMALIZER: %s.%s '%s' -> '%s' (%s)",
-                tu_id, key, frm, to, reason,
-            )
+        messages = request_body.get("messages", [])
+        known = _shz_known_paths(messages)
+
+        # 1) Containment first, so step 2 sees corrected paths.
+        if PROXY_TOOLCALL_PATH_CONTAIN:
+            workdir = _shz_derive_workdir(known, _toolcall_workdir_hint(messages))
+            if workdir:
+                for tu_id, key, frm, to, reason in _shz_contain_tool_uses(tool_uses, workdir):
+                    logger.info(
+                        "TOOLCALL PATH CONTAINMENT: %s.%s '%.80s' -> '%.80s' (%s)",
+                        tu_id, key, frm, to, reason,
+                    )
+
+        # 2) Same-directory filename normalization (filesystem-verified).
+        if PROXY_TOOLCALL_PATH_NORMALIZE and known:
+            for tu_id, key, frm, to, reason in _shz_normalize_tool_uses(tool_uses, known):
+                logger.info(
+                    "TOOLCALL PATH NORMALIZER: %s.%s '%s' -> '%s' (%s)",
+                    tu_id, key, frm, to, reason,
+                )
     except Exception as exc:  # never break a response over normalization
         logger.warning("TOOLCALL PATH NORMALIZER: skipped (%s)", type(exc).__name__)
 # Recon-convergence guardrail: after this many consecutive turns that use

package/tools/agents/scripts/toolcall_path_normalizer.py

@@ -15,11 +15,15 @@ TS reference at src/self-harness/middleware/path-normalizer.ts.
 See docs/design/SELF_HARNESS.md §4 (P2).
 """
 
+import difflib
 import os
 import re
 
 _PATH_ARG_KEYS = ("file_path", "path", "filePath", "notebook_path")
 
+# Absolute paths a tool call might target. Used to scan/rewrite Bash commands.
+_ABS_PATH_RE = re.compile(r"/(?:home|root|Users|tmp|var|opt|srv|mnt)/[A-Za-z0-9._\-/]+")
+
 
 def _squash(s: str) -> str:
     return re.sub(r"[^a-z0-9]", "", s.lower())
@@ -123,6 +127,164 @@ def extract_known_paths(anthropic_messages) -> list:
     return known
 
 
+def _fuzzy_eq(a: str, b: str) -> bool:
+    """Two path components are 'the same intent' if they squash-match or are very
+    close (handles octopus_invaders ~ octopus-invaders / octus_invaders / octpus_)."""
+    if not a or not b:
+        return False
+    if _squash(a) == _squash(b):
+        return True
+    return difflib.SequenceMatcher(None, a.lower(), b.lower()).ratio() >= 0.78
+
+
+def derive_workdir(known_paths, hint_text: str = "") -> str:
+    """Best-effort session working directory, VALIDATED against disk: the deepest
+    absolute directory that exists on disk among the paths the model used
+    (known_paths) and any absolute paths in hint_text (request/tool-result text).
+    Garbled variants (e.g. /home/cogtec/...) don't exist on disk, so the real
+    workdir is recovered. Returns '' if none found.
+    """
+    _STOP = {"/", "/home", "/root", "/tmp", "/var", "/opt", "/srv", "/mnt", "/Users"}
+    cands: set[str] = set()
+    for p in known_paths or []:
+        if isinstance(p, str) and p.startswith("/"):
+            cands.add(p if os.path.isdir(p) else os.path.dirname(p))
+    if hint_text:
+        for m in _ABS_PATH_RE.findall(hint_text):
+            cands.add(m if os.path.isdir(m) else os.path.dirname(m))
+
+    existing: list[str] = []
+    for c in cands:
+        d = c
+        while d and d not in _STOP and not os.path.isdir(d):
+            d = os.path.dirname(d)
+        if d and d not in _STOP and os.path.isdir(d):
+            existing.append(d)
+    if not existing:
+        return ""
+    # Prefer the PROJECT ROOT (a dir with .git/.uap/package.json) over a deep
+    # subdir — anchoring containment on the root catches more garbles. Walk each
+    # existing candidate up to its nearest project-root ancestor.
+    _MARKERS = (".git", ".uap", ".uap.json", "package.json")
+    roots: set[str] = set()
+    for d in existing:
+        x = d
+        while x and x not in _STOP:
+            if any(os.path.exists(os.path.join(x, mk)) for mk in _MARKERS):
+                roots.add(x)
+                break
+            x = os.path.dirname(x)
+    pool = roots or set(existing)
+    # Deepest (most specific) among the chosen pool.
+    return max(pool, key=lambda d: (len(d.split("/")), len(d)))
+
+
+def _fs_correct_suffix(workdir: str, suffix: str) -> str:
+    """Walk `suffix` under `workdir`, fuzzy-correcting each intermediate DIRECTORY
+    component to an existing on-disk sibling when the exact name is absent but a
+    single close match exists (space-shootr -> space-shooter once that dir
+    exists). The final component (the file being created) is left as-is."""
+    if not suffix:
+        return suffix
+    parts = [x for x in suffix.split("/") if x]
+    cur = workdir
+    out: list[str] = []
+    for i, comp in enumerate(parts):
+        nxt = os.path.join(cur, comp)
+        if i == len(parts) - 1 or os.path.exists(nxt):
+            out.append(comp)
+            cur = nxt
+            continue
+        try:
+            cands = [
+                e for e in os.listdir(cur)
+                if os.path.isdir(os.path.join(cur, e)) and _fuzzy_eq(e, comp)
+            ]
+        except OSError:
+            cands = []
+        chosen = cands[0] if len(cands) == 1 else comp
+        out.append(chosen)
+        cur = os.path.join(cur, chosen)
+    return "/".join(out)
+
+
+def contain_to_workdir(path: str, workdir: str):
+    """Snap a garbled in-workdir path back onto `workdir`. Returns
+    (new_path, changed, reason). Two garble classes, both handled:
+
+      * mangled absolute PREFIX / workdir name (/home/cogtek -> /home/cogtec,
+        octopus_invaders -> octus_invaders) — anchored by a fuzzy match of the
+        workdir-name component;
+      * mangled SUBDIR name in the suffix (space-shooter -> space-shootr) —
+        fuzzy-corrected against the real directories on disk.
+
+    Only ever relocates INTO the workdir, and never touches a path that exists
+    elsewhere (the OS sandbox blocks a genuine out-of-workdir write). Safe
+    precisely because the sandbox contains any mis-snap to the workdir.
+    """
+    if not path or not workdir or not path.startswith("/"):
+        return path, False, None
+    wd = workdir.rstrip("/")
+
+    if path == wd or path.startswith(wd + "/"):
+        # Already inside: only fix garbled subdir names against disk.
+        suffix = path[len(wd):].lstrip("/")
+        reason = "corrected garbled subdir(s) under the workdir"
+    elif os.path.exists(path):
+        return path, False, None  # a real path elsewhere — don't touch it
+    else:
+        # Garbled prefix/workdir-name: anchor on a fuzzy workdir-name match.
+        wd_name = wd.rsplit("/", 1)[-1]
+        parts = [x for x in path.split("/") if x]
+        anchor = next(
+            (i for i in range(len(parts) - 1, -1, -1) if _fuzzy_eq(parts[i], wd_name)),
+            None,
+        )
+        if anchor is None:
+            return path, False, None
+        suffix = "/".join(parts[anchor + 1:])
+        reason = f"contained garbled out-of-workdir path to '{wd_name}'"
+
+    corrected = _fs_correct_suffix(wd, suffix)
+    new = wd + ("/" + corrected if corrected else "")
+    if new != path:
+        return new, True, reason
+    return path, False, None
+
+
+def contain_tool_uses(tool_uses, workdir: str):
+    """Contain garbled out-of-workdir paths to `workdir` — in Write/Edit path args
+    AND in Bash command tokens. Returns corrections [(id, key, from, to, reason)].
+    """
+    corrections = []
+    if not workdir:
+        return corrections
+    for tu in tool_uses:
+        if not isinstance(tu, dict) or tu.get("type") != "tool_use":
+            continue
+        inp = tu.get("input")
+        if not isinstance(inp, dict):
+            continue
+        tu_id = tu.get("id", "")
+        for key in _PATH_ARG_KEYS:
+            v = inp.get(key)
+            if isinstance(v, str):
+                nv, changed, reason = contain_to_workdir(v, workdir)
+                if changed:
+                    inp[key] = nv
+                    corrections.append((tu_id, key, v, nv, reason))
+        cmd = inp.get("command")
+        if isinstance(cmd, str) and "/" in cmd:
+            def _sub(m):
+                nv, changed, _ = contain_to_workdir(m.group(0), workdir)
+                return nv if changed else m.group(0)
+            new_cmd = _ABS_PATH_RE.sub(_sub, cmd)
+            if new_cmd != cmd:
+                inp["command"] = new_cmd
+                corrections.append((tu_id, "command", cmd, new_cmd, "contained garbled path(s) in bash command"))
+    return corrections
+
+
 def normalize_tool_uses(tool_uses, known_paths):
     """Normalize path args of a list of Anthropic tool_use blocks in place.
     Returns the list of corrections [(tool_use_id, key, from, to, reason)].

package/tools/agents/tests/test_path_containment.py

@@ -0,0 +1,149 @@
+#!/usr/bin/env python3
+"""Tests for proxy-side path containment — recovering the workdir and snapping a
+small quant's GARBLED absolute paths back onto it (the failure where it mangles
+the prefix: /home/cogtek -> /home/cogtec, octopus_invaders -> octus_invaders).
+Safe under the OS sandbox, which contains any mis-snap to the workdir.
+"""
+
+import importlib.util
+import os
+import tempfile
+import unittest
+from pathlib import Path
+
+
+def _load():
+    # this file: tools/agents/tests/ -> module: tools/agents/scripts/
+    p = Path(__file__).resolve().parents[1] / "scripts" / "toolcall_path_normalizer.py"
+    spec = importlib.util.spec_from_file_location("toolcall_path_normalizer", p)
+    m = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(m)
+    return m
+
+
+N = _load()
+
+
+def _tu(tid, **inp):
+    return {"type": "tool_use", "id": tid, "name": "Write", "input": inp}
+
+
+class TestDeriveWorkdir(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.wd = os.path.join(self._tmp.name, "octopus_invaders")
+        os.makedirs(os.path.join(self.wd, "space-shooter"))
+        os.makedirs(os.path.join(self.wd, ".git"))  # project-root marker
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def test_recovers_workdir_from_correct_and_garbled_known_paths(self):
+        known = [
+            os.path.join(self.wd, "space-shooter", "js", "game.js"),  # correct (parent exists)
+            self.wd.replace("octopus_invaders", "octus_invaders") + "/x.js",  # garble (no exist)
+            "/home/cogtec/dev/octopus_invaders/y.js",  # garble (no exist)
+        ]
+        self.assertEqual(N.derive_workdir(known), self.wd)
+
+    def test_uses_hint_text_when_known_all_garbled(self):
+        known = ["/home/cogtec/dev/octus_invaders/a.js"]  # all garbled
+        hint = f"running in {self.wd} now"
+        self.assertEqual(N.derive_workdir(known, hint), self.wd)
+
+    def test_returns_empty_when_nothing_exists(self):
+        self.assertEqual(N.derive_workdir(["/home/nope/x/y.js"]), "")
+
+
+class TestContainToWorkdir(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.wd = os.path.join(self._tmp.name, "octopus_invaders")
+        os.makedirs(self.wd)
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def test_garbled_prefix_contained(self):
+        p = "/home/cogtec/dev/octopus_invaders/space-shooter/js/game.js"
+        new, changed, _ = N.contain_to_workdir(p, self.wd)
+        self.assertTrue(changed)
+        self.assertEqual(new, self.wd + "/space-shooter/js/game.js")
+
+    def test_garbled_workdir_name_contained(self):
+        for bad in ("octus_invaders", "octpus_invaders", "octopus-invaders", "octopus_invders"):
+            p = f"/home/cogtec/dev/{bad}/space-shooter/css/styles.css"
+            new, changed, _ = N.contain_to_workdir(p, self.wd)
+            self.assertTrue(changed, bad)
+            self.assertEqual(new, self.wd + "/space-shooter/css/styles.css", bad)
+
+    def test_already_inside_unchanged(self):
+        p = self.wd + "/space-shooter/js/game.js"
+        _, changed, _ = N.contain_to_workdir(p, self.wd)
+        self.assertFalse(changed)
+
+    def test_real_existing_path_elsewhere_left_alone(self):
+        other = os.path.join(self._tmp.name, "real_other")
+        os.makedirs(other)
+        open(os.path.join(other, "f.txt"), "w").write("x")
+        p = os.path.join(other, "f.txt")
+        _, changed, _ = N.contain_to_workdir(p, self.wd)
+        self.assertFalse(changed)
+
+    def test_unrelated_nonexistent_path_not_contained(self):
+        # No component fuzzy-matches the workdir name -> leave it (sandbox blocks).
+        p = "/etc/cron.d/totally_unrelated"
+        _, changed, _ = N.contain_to_workdir(p, self.wd)
+        self.assertFalse(changed)
+
+    def test_garbled_subdir_corrected_against_disk(self):
+        # space-shooter exists on disk; a write to garbled space-shootr is fixed.
+        os.makedirs(os.path.join(self.wd, "space-shooter", "js"))
+        p = self.wd + "/space-shootr/js/game.js"  # in-workdir but garbled subdir
+        new, changed, _ = N.contain_to_workdir(p, self.wd)
+        self.assertTrue(changed)
+        self.assertEqual(new, self.wd + "/space-shooter/js/game.js")
+
+    def test_garbled_prefix_and_subdir_both_corrected(self):
+        os.makedirs(os.path.join(self.wd, "space-shooter", "css"))
+        p = "/home/cogtec/dev/octus_invaders/space-shootr/css/styles.css"
+        new, changed, _ = N.contain_to_workdir(p, self.wd)
+        self.assertTrue(changed)
+        self.assertEqual(new, self.wd + "/space-shooter/css/styles.css")
+
+    def test_new_subdir_left_when_no_disk_match(self):
+        # First write that legitimately creates a new dir -> not fuzzy-mangled.
+        p = self.wd + "/space-shooter/js/game.js"
+        new, changed, _ = N.contain_to_workdir(p, self.wd)
+        self.assertFalse(changed)  # nothing to correct; left as-is
+        self.assertEqual(new, p)
+
+
+class TestContainToolUses(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.wd = os.path.join(self._tmp.name, "octopus_invaders")
+        os.makedirs(self.wd)
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def test_contains_write_path_and_bash_command(self):
+        tus = [
+            _tu("t1", file_path="/home/cogtec/dev/octus_invaders/space-shooter/js/game.js", content="x"),
+            {"type": "tool_use", "id": "t2", "name": "Bash",
+             "input": {"command": "mkdir -p /home/cogtk/dev/octopus_invaders/space-shooter/css && echo done"}},
+        ]
+        corr = N.contain_tool_uses(tus, self.wd)
+        self.assertEqual(tus[0]["input"]["file_path"], self.wd + "/space-shooter/js/game.js")
+        self.assertIn(self.wd + "/space-shooter/css", tus[1]["input"]["command"])
+        self.assertTrue(tus[1]["input"]["command"].startswith("mkdir -p "))
+        self.assertEqual(len(corr), 2)
+
+    def test_noop_without_workdir(self):
+        tus = [_tu("t1", file_path="/home/cogtec/dev/octus_invaders/a.js")]
+        self.assertEqual(N.contain_tool_uses(tus, ""), [])
+
+
+if __name__ == "__main__":
+    unittest.main()