@miller-tech/uap 1.78.0 → 1.80.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.78.0",
+  "version": "1.80.0",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/src/policies/enforcers/delivery_enforcement.py

@@ -100,7 +100,16 @@ def main() -> None:
 
     mode = os.environ.get("UAP_ENFORCE_DELIVERY", "block").lower()
     if mode == "block":
-        emit(False, msg)
+        # R1: emit a machine-actionable routing signal so a capable harness can
+        # auto-route the blocked change INTO `uap deliver` instead of leaving the
+        # agent to flail. `route`/`deliverHint` are advisory extra fields; harness
+        # adapters that understand them route, others just show `reason`.
+        emit(
+            False,
+            msg,
+            route="deliver",
+            deliverHint=f'uap deliver "implement the intended change to {rel_posix}"',
+        )
 
     # Advisory (opt-out): never blocks. Surface the nudge, then allow.
     print(f"[delivery-enforcement advisory] {msg}", file=sys.stderr)

package/src/policies/enforcers/enforcement_self_protect.py

@@ -0,0 +1,119 @@
+"""enforcement-self-protect enforcer: the model must not be able to disable
+the delivery gate.
+
+A weak local model that hits the delivery-enforcement block tends to try to
+ESCAPE it — observed live (qwen <think>): "set enforcement to advisory mode",
+"just use UAP_DELIVER_BYPASS=1". A single shell `export` does not persist across
+tool calls, so the only way to actually weaken the gate is to PERSIST a bypass:
+write it into a config/env file, or edit the policy/enforcer itself. This
+enforcer blocks exactly those persistence paths.
+
+Scope:
+  - Edit/Write/MultiEdit to the enforcement control surface (policy md/enforcers,
+    .policy-tools/, .uap.json, proxy env, the policy-gate hook scripts).
+  - Bash commands that set/export UAP_DELIVER_BYPASS or relax UAP_ENFORCE_DELIVERY,
+    write those to a file, or delete/chmod a policy enforcer.
+
+There is intentionally NO model-reachable bypass: honoring UAP_DELIVER_BYPASS here
+would reopen the hole (the model would just set it). Operator override is
+out-of-band only: UAP_SELF_PROTECT_OFF=1 in the trusted launch env.
+"""
+import os
+import re
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent))
+from _common import emit, parse_cli, repo_root  # noqa: E402
+
+EDIT_OPS = {"Edit", "Write", "MultiEdit", "edit", "write", "multiedit"}
+
+# Path substrings that control delivery enforcement. A write touching any of
+# these can weaken the gate, so it is protected regardless of file extension.
+PROTECTED_MARKERS = (
+    "/.policy-tools/",
+    "/src/policies/",
+    "/policies/",            # the policy-definition markdown dir
+    "/.uap.json",
+    "/.uap/",
+    "anthropic-proxy.env",
+    "uap-policy-gate.sh",
+    "uap-reactor-prompt.sh",
+    "pre-tool-use",
+)
+# Normalize leading-slash matching for repo-relative paths.
+PROTECTED_REL = tuple(m.lstrip("/") for m in PROTECTED_MARKERS)
+
+# Bash patterns that persist a bypass or relax enforcement.
+BYPASS_PATTERNS = (
+    re.compile(r"UAP_DELIVER_BYPASS\s*=\s*['\"]?1", re.I),
+    re.compile(r"UAP_ENFORCE_DELIVERY\s*=\s*['\"]?(advisory|off|0|false|no)", re.I),
+    re.compile(r"UAP_SELF_PROTECT_OFF\s*=\s*['\"]?1", re.I),
+    re.compile(r"UAP_NO_WORKTREE\s*=\s*['\"]?1", re.I),
+    re.compile(r"UAP_WORKDIR_SCOPE_OFF\s*=\s*['\"]?1", re.I),
+)
+# Destructive ops against the enforcer/policy surface.
+DESTRUCTIVE = re.compile(
+    r"\b(rm|unlink|shred|truncate|mv|chmod)\b[^\n|;&]*"
+    r"(\.policy-tools|src/policies|/policies/|anthropic-proxy\.env)",
+    re.I,
+)
+
+OVERRIDE = os.environ.get("UAP_SELF_PROTECT_OFF") == "1"
+
+
+def _is_protected_path(rel_posix: str) -> bool:
+    low = rel_posix.lower()
+    return any(m in ("/" + low) for m in PROTECTED_REL)
+
+
+def main() -> None:
+    if OVERRIDE:
+        emit(True, "self-protect disabled by trusted operator override")
+
+    op, args = parse_cli()
+
+    if op in EDIT_OPS:
+        target = args.get("file_path") or args.get("path") or args.get("target") or ""
+        if not target:
+            emit(True, "no file path in args")
+        try:
+            rel = str(Path(target).resolve().relative_to(repo_root()))
+        except ValueError:
+            # Out-of-repo writes (e.g. the proxy env in ~/.config) — match by name.
+            rel = target
+        rel_posix = rel.replace(os.sep, "/")
+        if _is_protected_path(rel_posix):
+            emit(
+                False,
+                "BLOCKED: this file controls delivery enforcement and cannot be "
+                f"edited by the agent ('{rel_posix}'). Do not try to disable or "
+                "relax the gate — route your change through the `deliver` tool "
+                "instead. (Operator-only override: UAP_SELF_PROTECT_OFF=1.)",
+            )
+        emit(True, "not an enforcement-control file")
+
+    if op in {"Bash", "bash"}:
+        cmd = args.get("command") or ""
+        for pat in BYPASS_PATTERNS:
+            if pat.search(cmd):
+                emit(
+                    False,
+                    "BLOCKED: setting a delivery-enforcement bypass/advisory flag is "
+                    "not allowed for the agent. Route your change through the "
+                    "`deliver` tool instead of disabling the gate. "
+                    "(Operator-only override: UAP_SELF_PROTECT_OFF=1.)",
+                )
+        if DESTRUCTIVE.search(cmd):
+            emit(
+                False,
+                "BLOCKED: modifying/removing the policy enforcers or proxy env is "
+                "not allowed for the agent.",
+            )
+        emit(True, "no enforcement-tampering in command")
+
+    emit(True, "not a protected operation")
+
+
+if __name__ == "__main__":
+    main()

package/src/policies/schemas/policies/enforcement-self-protect.md

@@ -0,0 +1,24 @@
+# Enforcement Self-Protect
+
+The delivery gate exists to route coding through `uap deliver`. A weak local
+model that hits the block tends to try to ESCAPE it rather than comply
+(observed: "set enforcement to advisory", "use UAP_DELIVER_BYPASS=1"). This
+policy makes the gate non-disableable by the agent.
+
+## Rules
+
+1. **The control surface is read-only to the agent.** Edits to policy
+   definitions, enforcers (`src/policies/`, `.policy-tools/`), `.uap.json`,
+   `.uap/`, the proxy env, and the policy-gate hook scripts are blocked.
+2. **Bypass/relax flags cannot be set by the agent.** Bash commands that set or
+   persist `UAP_DELIVER_BYPASS`, relax `UAP_ENFORCE_DELIVERY`, or disable the
+   workdir/worktree gates are blocked. (A shell `export` alone does not persist
+   across tool calls; this blocks the persistence paths.)
+3. **No model-reachable bypass.** Honoring a bypass here would reopen the hole.
+   Operator override is out-of-band only: `UAP_SELF_PROTECT_OFF=1` in the
+   trusted launch environment.
+
+## Rationale
+
+Compliance must be the easy path and non-compliance the blocked one. Route
+substantive coding through the `deliver` tool; do not weaken the gate.

package/templates/hooks/deliver_autoroute.py

@@ -0,0 +1,124 @@
+#!/usr/bin/env python3
+"""deliver-autoroute: R1 follow-up — consume a delivery-enforcement block's
+`route:deliver` signal at the harness boundary.
+
+The policy-gate hook pipes a blocked enforcer's JSON output to this helper. When
+the block carries route == "deliver", the helper:
+  1. Logs the blocked intent to the project's .uap pending-deliver log (so the
+     intent is never lost).
+  2. If UAP_DELIVER_AUTOROUTE is on, spawns `uap deliver "<hint>"` detached in
+     the background (deduped per file so a retrying model does not fan out
+     dozens of runs), and annotates the message.
+  3. Prints the (possibly annotated) block message on stdout for the hook to
+     surface to the agent.
+
+Default (autoroute off): just logs the intent + returns the message unchanged —
+no behavior change. The hook still blocks (exit 2); this only enriches the block.
+"""
+import argparse
+import json
+import os
+import sys
+import time
+from pathlib import Path
+
+PENDING_LOG = "pending-deliver.jsonl"
+SEEN_FILE = "autoroute-seen"
+UAP_DIR = ".uap"
+
+
+def _autoroute_enabled() -> bool:
+    v = os.environ.get("UAP_DELIVER_AUTOROUTE", "").lower()
+    return v not in {"", "0", "off", "false", "no"}
+
+
+def decide(out: dict, tool: str, args: dict, autoroute_on: bool, seen_files: set) -> dict:
+    """Pure decision: what message to show, whether to spawn, and the intent."""
+    reason = out.get("reason", "")
+    route = out.get("route")
+    hint = out.get("deliverHint") or ""
+    file_path = args.get("file_path") or args.get("path") or args.get("target") or ""
+
+    if route != "deliver":
+        return {"message": reason, "route": route, "spawn": False,
+                "file_path": file_path, "hint": hint, "intent": None}
+
+    intent = {"ts": int(time.time()), "tool": tool, "file_path": file_path, "hint": hint}
+    spawn = bool(autoroute_on and hint and file_path and file_path not in seen_files)
+    message = reason
+    if spawn:
+        message = reason + " [auto-routed to `uap deliver` — running in the background]"
+    elif autoroute_on and file_path in seen_files:
+        message = reason + " [already auto-routed to `uap deliver` this session — wait for it]"
+    return {"message": message, "route": route, "spawn": spawn,
+            "file_path": file_path, "hint": hint, "intent": intent}
+
+
+def _seen_path(root: Path) -> Path:
+    return root / UAP_DIR / SEEN_FILE
+
+
+def _load_seen(root: Path) -> set:
+    try:
+        return set(l.strip() for l in _seen_path(root).read_text().splitlines() if l.strip())
+    except Exception:
+        return set()
+
+
+def _spawn_deliver(root: Path, hint: str) -> None:
+    """Spawn `uap deliver "<hint>"` fully detached. Best-effort; never raises."""
+    import subprocess
+    try:
+        subprocess.Popen(
+            ["uap", "deliver", hint],
+            cwd=str(root),
+            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, stdin=subprocess.DEVNULL,
+            start_new_session=True,
+        )
+    except Exception:
+        pass
+
+
+def main() -> None:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--tool", default="")
+    ap.add_argument("--args", default="{}")
+    ap.add_argument("--root", default=".")
+    ap.add_argument("--policy", default="")
+    ns = ap.parse_args()
+
+    try:
+        out = json.loads(sys.stdin.read() or "{}")
+    except Exception:
+        out = {}
+    try:
+        args = json.loads(ns.args or "{}")
+    except Exception:
+        args = {}
+
+    root = Path(ns.root)
+    d = decide(out, ns.tool, args, _autoroute_enabled(), _load_seen(root))
+
+    if d["intent"] is not None:
+        try:
+            uap_dir = root / UAP_DIR
+            uap_dir.mkdir(parents=True, exist_ok=True)
+            with (uap_dir / PENDING_LOG).open("a") as f:
+                f.write(json.dumps(d["intent"]) + "\n")
+        except Exception:
+            pass
+
+    if d["spawn"]:
+        try:
+            with _seen_path(root).open("a") as f:
+                f.write(d["file_path"] + "\n")
+        except Exception:
+            pass
+        _spawn_deliver(root, d["hint"])
+
+    prefix = ("[UAP policy blocked: " + ns.policy + "] ") if ns.policy else ""
+    sys.stdout.write(prefix + d["message"])
+
+
+if __name__ == "__main__":
+    main()

package/templates/hooks/uap-policy-gate.sh

@@ -55,10 +55,20 @@ while IFS='|' read -r pid pname tool; do
 try: d=json.loads(sys.stdin.read()); print("1" if d.get("allowed",True) else "0")
 except: print("1")' 2>/dev/null || echo 1)"
   if [[ "$allowed" == "0" ]]; then
-    reason="$(printf '%s' "$out" | python3 -c 'import json,sys;
+    # R1: consume the enforcer's route:deliver signal (log intent, opt-in
+    # background auto-route to `uap deliver`). Falls back to the plain reason if
+    # the helper is missing/fails.
+    msg=""
+    if [[ -f "$HOOK_DIR/deliver_autoroute.py" ]]; then
+      msg="$(printf '%s' "$out" | python3 "$HOOK_DIR/deliver_autoroute.py" --tool "$TOOL" --args "$ARGS" --root "$MAIN_ROOT" --policy "$pname" 2>/dev/null || true)"
+    fi
+    if [[ -z "$msg" ]]; then
+      reason="$(printf '%s' "$out" | python3 -c 'import json,sys;
 try: print(json.loads(sys.stdin.read()).get("reason",""))
 except: print("")' 2>/dev/null || echo "")"
-    echo "[UAP policy blocked: $pname] $reason" >&2
+      msg="[UAP policy blocked: $pname] $reason"
+    fi
+    echo "$msg" >&2
     exit 2
   fi
 done < <(sqlite3 "$DB" "SELECT p.id, p.name, t.toolName FROM policies p JOIN executable_tools t ON t.policyId=p.id WHERE p.isActive=1;")

package/tools/agents/tests/test_deliver_autoroute.py

@@ -0,0 +1,73 @@
+"""Tests for deliver-autoroute (R1 follow-up): consume route:deliver."""
+import importlib.util
+import json
+import os
+import tempfile
+import unittest
+from pathlib import Path
+
+HELPER = Path(__file__).resolve().parents[3] / "templates" / "hooks" / "deliver_autoroute.py"
+spec = importlib.util.spec_from_file_location("deliver_autoroute", HELPER)
+mod = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(mod)
+
+BLOCK_OUT = {
+    "allowed": False,
+    "reason": "BLOCKED: do not edit src/foo.ts directly.",
+    "route": "deliver",
+    "deliverHint": 'uap deliver "implement the intended change to src/foo.ts"',
+}
+ARGS = {"file_path": "/repo/src/foo.ts"}
+
+
+class DecideTest(unittest.TestCase):
+    def test_non_deliver_route_is_passthrough(self):
+        d = mod.decide({"reason": "blocked", "route": "worktree"}, "Write", ARGS, True, set())
+        self.assertFalse(d["spawn"])
+        self.assertIsNone(d["intent"])
+        self.assertEqual(d["message"], "blocked")
+
+    def test_deliver_route_logs_intent_no_spawn_when_off(self):
+        d = mod.decide(BLOCK_OUT, "Write", ARGS, False, set())
+        self.assertFalse(d["spawn"])
+        self.assertIsNotNone(d["intent"])
+        self.assertEqual(d["intent"]["file_path"], "/repo/src/foo.ts")
+        self.assertEqual(d["message"], BLOCK_OUT["reason"])  # unchanged
+
+    def test_deliver_route_spawns_when_on_and_unseen(self):
+        d = mod.decide(BLOCK_OUT, "Write", ARGS, True, set())
+        self.assertTrue(d["spawn"])
+        self.assertIn("auto-routed", d["message"])
+
+    def test_deliver_route_dedupes_seen_file(self):
+        d = mod.decide(BLOCK_OUT, "Write", ARGS, True, {"/repo/src/foo.ts"})
+        self.assertFalse(d["spawn"])
+        self.assertIn("already auto-routed", d["message"])
+
+    def test_no_spawn_without_hint(self):
+        out = dict(BLOCK_OUT); out["deliverHint"] = ""
+        d = mod.decide(out, "Write", ARGS, True, set())
+        self.assertFalse(d["spawn"])
+
+
+class LoggingTest(unittest.TestCase):
+    def test_main_logs_pending_intent(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            # invoke main() via subprocess to exercise the full path (autoroute off)
+            import subprocess, sys
+            env = dict(os.environ); env.pop("UAP_DELIVER_AUTOROUTE", None)
+            p = subprocess.run(
+                [sys.executable, str(HELPER), "--tool", "Write",
+                 "--args", json.dumps(ARGS), "--root", str(root), "--policy", "delivery-enforcement"],
+                input=json.dumps(BLOCK_OUT), capture_output=True, text=True, env=env,
+            )
+            self.assertIn("BLOCKED", p.stdout)
+            log = root / ".uap" / "pending-deliver.jsonl"
+            self.assertTrue(log.exists(), "intent must be logged")
+            rec = json.loads(log.read_text().strip())
+            self.assertEqual(rec["file_path"], "/repo/src/foo.ts")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_enforcement_self_protect.py

@@ -0,0 +1,71 @@
+"""Tests for the enforcement-self-protect enforcer (R2)."""
+import importlib.util
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+ENF = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "enforcement_self_protect.py"
+REPO = Path(__file__).resolve().parents[3]
+
+
+def run(op, args, env=None):
+    e = dict(os.environ)
+    e["UAP_REPO_ROOT"] = str(REPO)
+    e.pop("UAP_SELF_PROTECT_OFF", None)
+    if env:
+        e.update(env)
+    p = subprocess.run(
+        [sys.executable, str(ENF), "--operation", op, "--args", json.dumps(args)],
+        capture_output=True, text=True, env=e,
+    )
+    out = json.loads(p.stdout) if p.stdout.strip() else {}
+    return p.returncode, out
+
+
+import unittest
+
+
+class SelfProtectTest(unittest.TestCase):
+    def test_blocks_edit_to_policy_enforcer(self):
+        rc, out = run("Write", {"file_path": str(REPO / "src/policies/enforcers/delivery_enforcement.py")})
+        self.assertEqual(rc, 2)
+        self.assertFalse(out["allowed"])
+
+    def test_blocks_edit_to_uap_json(self):
+        rc, out = run("Edit", {"file_path": str(REPO / ".uap.json")})
+        self.assertEqual(rc, 2)
+
+    def test_blocks_edit_to_policy_tools(self):
+        rc, out = run("Write", {"file_path": str(REPO / ".policy-tools/abc_delivery_enforcement.py")})
+        self.assertEqual(rc, 2)
+
+    def test_blocks_bash_setting_bypass(self):
+        rc, out = run("Bash", {"command": "export UAP_DELIVER_BYPASS=1 && echo hi"})
+        self.assertEqual(rc, 2)
+
+    def test_blocks_bash_advisory_relax(self):
+        rc, out = run("Bash", {"command": "UAP_ENFORCE_DELIVERY=advisory uap deliver x"})
+        self.assertEqual(rc, 2)
+
+    def test_blocks_bash_rm_enforcer(self):
+        rc, out = run("Bash", {"command": "rm -f .policy-tools/abc_delivery_enforcement.py"})
+        self.assertEqual(rc, 2)
+
+    def test_allows_normal_source_edit(self):
+        rc, out = run("Write", {"file_path": str(REPO / "src/app/index.ts")})
+        self.assertEqual(rc, 0)
+        self.assertTrue(out["allowed"])
+
+    def test_allows_normal_bash(self):
+        rc, out = run("Bash", {"command": "npm test"})
+        self.assertEqual(rc, 0)
+
+    def test_operator_override_allows(self):
+        rc, out = run("Bash", {"command": "export UAP_DELIVER_BYPASS=1"}, env={"UAP_SELF_PROTECT_OFF": "1"})
+        self.assertEqual(rc, 0)
+
+
+if __name__ == "__main__":
+    unittest.main()