@miller-tech/uap 1.78.0 → 1.79.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.78.0",
+  "version": "1.79.0",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/src/policies/enforcers/delivery_enforcement.py

@@ -100,7 +100,16 @@ def main() -> None:
 
     mode = os.environ.get("UAP_ENFORCE_DELIVERY", "block").lower()
     if mode == "block":
-        emit(False, msg)
+        # R1: emit a machine-actionable routing signal so a capable harness can
+        # auto-route the blocked change INTO `uap deliver` instead of leaving the
+        # agent to flail. `route`/`deliverHint` are advisory extra fields; harness
+        # adapters that understand them route, others just show `reason`.
+        emit(
+            False,
+            msg,
+            route="deliver",
+            deliverHint=f'uap deliver "implement the intended change to {rel_posix}"',
+        )
 
     # Advisory (opt-out): never blocks. Surface the nudge, then allow.
     print(f"[delivery-enforcement advisory] {msg}", file=sys.stderr)

package/src/policies/enforcers/enforcement_self_protect.py

@@ -0,0 +1,119 @@
+"""enforcement-self-protect enforcer: the model must not be able to disable
+the delivery gate.
+
+A weak local model that hits the delivery-enforcement block tends to try to
+ESCAPE it — observed live (qwen <think>): "set enforcement to advisory mode",
+"just use UAP_DELIVER_BYPASS=1". A single shell `export` does not persist across
+tool calls, so the only way to actually weaken the gate is to PERSIST a bypass:
+write it into a config/env file, or edit the policy/enforcer itself. This
+enforcer blocks exactly those persistence paths.
+
+Scope:
+  - Edit/Write/MultiEdit to the enforcement control surface (policy md/enforcers,
+    .policy-tools/, .uap.json, proxy env, the policy-gate hook scripts).
+  - Bash commands that set/export UAP_DELIVER_BYPASS or relax UAP_ENFORCE_DELIVERY,
+    write those to a file, or delete/chmod a policy enforcer.
+
+There is intentionally NO model-reachable bypass: honoring UAP_DELIVER_BYPASS here
+would reopen the hole (the model would just set it). Operator override is
+out-of-band only: UAP_SELF_PROTECT_OFF=1 in the trusted launch env.
+"""
+import os
+import re
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent))
+from _common import emit, parse_cli, repo_root  # noqa: E402
+
+EDIT_OPS = {"Edit", "Write", "MultiEdit", "edit", "write", "multiedit"}
+
+# Path substrings that control delivery enforcement. A write touching any of
+# these can weaken the gate, so it is protected regardless of file extension.
+PROTECTED_MARKERS = (
+    "/.policy-tools/",
+    "/src/policies/",
+    "/policies/",            # the policy-definition markdown dir
+    "/.uap.json",
+    "/.uap/",
+    "anthropic-proxy.env",
+    "uap-policy-gate.sh",
+    "uap-reactor-prompt.sh",
+    "pre-tool-use",
+)
+# Normalize leading-slash matching for repo-relative paths.
+PROTECTED_REL = tuple(m.lstrip("/") for m in PROTECTED_MARKERS)
+
+# Bash patterns that persist a bypass or relax enforcement.
+BYPASS_PATTERNS = (
+    re.compile(r"UAP_DELIVER_BYPASS\s*=\s*['\"]?1", re.I),
+    re.compile(r"UAP_ENFORCE_DELIVERY\s*=\s*['\"]?(advisory|off|0|false|no)", re.I),
+    re.compile(r"UAP_SELF_PROTECT_OFF\s*=\s*['\"]?1", re.I),
+    re.compile(r"UAP_NO_WORKTREE\s*=\s*['\"]?1", re.I),
+    re.compile(r"UAP_WORKDIR_SCOPE_OFF\s*=\s*['\"]?1", re.I),
+)
+# Destructive ops against the enforcer/policy surface.
+DESTRUCTIVE = re.compile(
+    r"\b(rm|unlink|shred|truncate|mv|chmod)\b[^\n|;&]*"
+    r"(\.policy-tools|src/policies|/policies/|anthropic-proxy\.env)",
+    re.I,
+)
+
+OVERRIDE = os.environ.get("UAP_SELF_PROTECT_OFF") == "1"
+
+
+def _is_protected_path(rel_posix: str) -> bool:
+    low = rel_posix.lower()
+    return any(m in ("/" + low) for m in PROTECTED_REL)
+
+
+def main() -> None:
+    if OVERRIDE:
+        emit(True, "self-protect disabled by trusted operator override")
+
+    op, args = parse_cli()
+
+    if op in EDIT_OPS:
+        target = args.get("file_path") or args.get("path") or args.get("target") or ""
+        if not target:
+            emit(True, "no file path in args")
+        try:
+            rel = str(Path(target).resolve().relative_to(repo_root()))
+        except ValueError:
+            # Out-of-repo writes (e.g. the proxy env in ~/.config) — match by name.
+            rel = target
+        rel_posix = rel.replace(os.sep, "/")
+        if _is_protected_path(rel_posix):
+            emit(
+                False,
+                "BLOCKED: this file controls delivery enforcement and cannot be "
+                f"edited by the agent ('{rel_posix}'). Do not try to disable or "
+                "relax the gate — route your change through the `deliver` tool "
+                "instead. (Operator-only override: UAP_SELF_PROTECT_OFF=1.)",
+            )
+        emit(True, "not an enforcement-control file")
+
+    if op in {"Bash", "bash"}:
+        cmd = args.get("command") or ""
+        for pat in BYPASS_PATTERNS:
+            if pat.search(cmd):
+                emit(
+                    False,
+                    "BLOCKED: setting a delivery-enforcement bypass/advisory flag is "
+                    "not allowed for the agent. Route your change through the "
+                    "`deliver` tool instead of disabling the gate. "
+                    "(Operator-only override: UAP_SELF_PROTECT_OFF=1.)",
+                )
+        if DESTRUCTIVE.search(cmd):
+            emit(
+                False,
+                "BLOCKED: modifying/removing the policy enforcers or proxy env is "
+                "not allowed for the agent.",
+            )
+        emit(True, "no enforcement-tampering in command")
+
+    emit(True, "not a protected operation")
+
+
+if __name__ == "__main__":
+    main()

package/src/policies/schemas/policies/enforcement-self-protect.md

@@ -0,0 +1,24 @@
+# Enforcement Self-Protect
+
+The delivery gate exists to route coding through `uap deliver`. A weak local
+model that hits the block tends to try to ESCAPE it rather than comply
+(observed: "set enforcement to advisory", "use UAP_DELIVER_BYPASS=1"). This
+policy makes the gate non-disableable by the agent.
+
+## Rules
+
+1. **The control surface is read-only to the agent.** Edits to policy
+   definitions, enforcers (`src/policies/`, `.policy-tools/`), `.uap.json`,
+   `.uap/`, the proxy env, and the policy-gate hook scripts are blocked.
+2. **Bypass/relax flags cannot be set by the agent.** Bash commands that set or
+   persist `UAP_DELIVER_BYPASS`, relax `UAP_ENFORCE_DELIVERY`, or disable the
+   workdir/worktree gates are blocked. (A shell `export` alone does not persist
+   across tool calls; this blocks the persistence paths.)
+3. **No model-reachable bypass.** Honoring a bypass here would reopen the hole.
+   Operator override is out-of-band only: `UAP_SELF_PROTECT_OFF=1` in the
+   trusted launch environment.
+
+## Rationale
+
+Compliance must be the easy path and non-compliance the blocked one. Route
+substantive coding through the `deliver` tool; do not weaken the gate.

package/tools/agents/tests/test_enforcement_self_protect.py

@@ -0,0 +1,71 @@
+"""Tests for the enforcement-self-protect enforcer (R2)."""
+import importlib.util
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+ENF = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "enforcement_self_protect.py"
+REPO = Path(__file__).resolve().parents[3]
+
+
+def run(op, args, env=None):
+    e = dict(os.environ)
+    e["UAP_REPO_ROOT"] = str(REPO)
+    e.pop("UAP_SELF_PROTECT_OFF", None)
+    if env:
+        e.update(env)
+    p = subprocess.run(
+        [sys.executable, str(ENF), "--operation", op, "--args", json.dumps(args)],
+        capture_output=True, text=True, env=e,
+    )
+    out = json.loads(p.stdout) if p.stdout.strip() else {}
+    return p.returncode, out
+
+
+import unittest
+
+
+class SelfProtectTest(unittest.TestCase):
+    def test_blocks_edit_to_policy_enforcer(self):
+        rc, out = run("Write", {"file_path": str(REPO / "src/policies/enforcers/delivery_enforcement.py")})
+        self.assertEqual(rc, 2)
+        self.assertFalse(out["allowed"])
+
+    def test_blocks_edit_to_uap_json(self):
+        rc, out = run("Edit", {"file_path": str(REPO / ".uap.json")})
+        self.assertEqual(rc, 2)
+
+    def test_blocks_edit_to_policy_tools(self):
+        rc, out = run("Write", {"file_path": str(REPO / ".policy-tools/abc_delivery_enforcement.py")})
+        self.assertEqual(rc, 2)
+
+    def test_blocks_bash_setting_bypass(self):
+        rc, out = run("Bash", {"command": "export UAP_DELIVER_BYPASS=1 && echo hi"})
+        self.assertEqual(rc, 2)
+
+    def test_blocks_bash_advisory_relax(self):
+        rc, out = run("Bash", {"command": "UAP_ENFORCE_DELIVERY=advisory uap deliver x"})
+        self.assertEqual(rc, 2)
+
+    def test_blocks_bash_rm_enforcer(self):
+        rc, out = run("Bash", {"command": "rm -f .policy-tools/abc_delivery_enforcement.py"})
+        self.assertEqual(rc, 2)
+
+    def test_allows_normal_source_edit(self):
+        rc, out = run("Write", {"file_path": str(REPO / "src/app/index.ts")})
+        self.assertEqual(rc, 0)
+        self.assertTrue(out["allowed"])
+
+    def test_allows_normal_bash(self):
+        rc, out = run("Bash", {"command": "npm test"})
+        self.assertEqual(rc, 0)
+
+    def test_operator_override_allows(self):
+        rc, out = run("Bash", {"command": "export UAP_DELIVER_BYPASS=1"}, env={"UAP_SELF_PROTECT_OFF": "1"})
+        self.assertEqual(rc, 0)
+
+
+if __name__ == "__main__":
+    unittest.main()