@miller-tech/uap 1.81.0 → 1.83.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.81.0",
+  "version": "1.83.0",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/src/policies/enforcers/delivery_enforcement.py

@@ -54,6 +54,31 @@ EXEMPT_PREFIXES = (
 TEST_MARKERS = (".test.", ".spec.", "_test.", "/test/", "/tests/", "/__tests__/")
 
 
+def _is_local_model_session() -> bool:
+    """True when this session targets a self-hosted/local model endpoint."""
+    base = (
+        os.environ.get("ANTHROPIC_BASE_URL")
+        or os.environ.get("OPENAI_BASE_URL")
+        or os.environ.get("UAP_INFERENCE_ENDPOINT")
+        or ""
+    ).lower()
+    return any(h in base for h in ("127.0.0.1", "localhost", "0.0.0.0", "::1"))
+
+
+# #2: a plain local-model session cannot effectively route through deliver and
+# deadlocks under block mode (it can read but never write -> recon loop, observed
+# live). Downgrade block->advisory for local sessions so the model can write
+# directly; the local proxy already guards it. Set UAP_DELIVER_LOCAL_ADVISORY=0
+# to keep strict block for local sessions too.
+_LOCAL_ADVISORY = os.environ.get("UAP_DELIVER_LOCAL_ADVISORY", "on").lower() not in {
+    "0",
+    "off",
+    "false",
+    "no",
+    "",
+}
+
+
 def main() -> None:
     op, args = parse_cli()
     if op not in EDIT_OPS:
@@ -99,6 +124,8 @@ def main() -> None:
     )
 
     mode = os.environ.get("UAP_ENFORCE_DELIVERY", "block").lower()
+    if mode == "block" and _LOCAL_ADVISORY and _is_local_model_session():
+        mode = "advisory"  # #2: unblock plain local-model sessions
     if mode == "block":
         # R1: emit a machine-actionable routing signal so a capable harness can
         # auto-route the blocked change INTO `uap deliver` instead of leaving the

package/src/policies/enforcers/worktree_required.py

@@ -46,10 +46,24 @@ def main() -> None:
     if os.environ.get("UAP_NO_WORKTREE") == "1":
         emit(True, "UAP_NO_WORKTREE override set")
 
+    # R1: a worktree cannot exist without git, so the requirement is
+    # UNSATISFIABLE on a non-git project -- blocking there is a guaranteed
+    # deadlock (the model loops creating tasks about a worktree it can never
+    # create). Fail open when there is no git metadata.
+    if not os.path.exists(os.path.join(str(root), ".git")):
+        emit(True, "not a git repo -- worktrees are not applicable")
+
+    # R3: imperative message with a working fallback command + a machine-
+    # actionable route hint. The old message pointed only at uap worktree
+    # create, which fails on hybrid/bare repos.
     emit(
         False,
-        f"worktree-required: '{rel}' must be edited inside .worktrees/NNN-<slug>/. "
-        "Run: uap worktree create <slug>",
+        f"BLOCKED: '{rel}' must be edited inside a worktree (.worktrees/NNN-<slug>/). "
+        "Create one FIRST, then edit there: `uap worktree create <slug>` "
+        "(or if that fails: `git worktree add .worktrees/001-<slug> -b feature/<slug>`). "
+        "Do NOT keep planning or creating tasks about the worktree -- run the command now.",
+        route="worktree",
+        worktreeHint="uap worktree create <slug>",
     )
 
 

package/tools/agents/scripts/anthropic_proxy.py

@@ -206,6 +206,16 @@ PROXY_COORDINATION_TOOLS = {
 PROXY_COORDINATION_BAN_THRESHOLD = int(
     os.environ.get("PROXY_COORDINATION_BAN_THRESHOLD", "2")
 )
+# R4: early coordination-loop ban. The per-tool cycle ban above engages only
+# inside an active agentic loop (tool_results present). But a model can loop on a
+# coordination tool from the very FIRST moves -- e.g. repeatedly creating a task
+# ABOUT doing X instead of doing X (observed: TaskCreate x4 identical args at
+# session start) -- where the cycle detector never engages. This bans a
+# coordination tool after N consecutive IDENTICAL calls regardless of loop state.
+# 0 disables.
+PROXY_COORDINATION_EARLY_BAN = int(
+    os.environ.get("PROXY_COORDINATION_EARLY_BAN", "3")
+)
 # Force finalize after N consecutive forced_budget_exhausted events where
 # neither cycling nor stagnation was detected — catches "distinct but
 # unproductive" tool spam that defeats per-tool cycle detection.
@@ -1036,6 +1046,8 @@ class SessionMonitor:
     tool_state_unproductive_exhaustion_streak: int = 0
     last_tool_fingerprint: str = ""
     cycling_tool_names: list = field(default_factory=list)
+    coordination_repeat_streak: int = 0  # R4: consecutive identical coordination-tool calls
+    last_coordination_fp: str = ""       # R4: fingerprint of the last coordination call
     session_banned_tools: set = field(default_factory=set)  # tools banned for entire session after repeated cycling
     tool_cycle_counts: dict = field(default_factory=dict)  # {tool_name: cycle_count} across resets
     last_response_garbled: bool = False  # previous turn had garbled/malformed output
@@ -1201,6 +1213,33 @@ class SessionMonitor:
         if len(self.tool_call_history) > 30:
             self.tool_call_history = self.tool_call_history[-30:]
 
+        # R4: early coordination-loop ban (independent of the active-loop cycle
+        # detector). A coordination/bookkeeping tool repeated with IDENTICAL args
+        # is never productive; ban it directly so narrowing drops it next turn,
+        # breaking the "create a task ABOUT X instead of doing X" loop.
+        coord_names = [n for n in (tool_names or []) if n in PROXY_COORDINATION_TOOLS]
+        if fp and coord_names and fp == self.last_coordination_fp:
+            self.coordination_repeat_streak += 1
+        elif coord_names:
+            self.coordination_repeat_streak = 1
+            self.last_coordination_fp = fp
+        else:
+            self.coordination_repeat_streak = 0
+            self.last_coordination_fp = ""
+        if (
+            PROXY_COORDINATION_EARLY_BAN > 0
+            and self.coordination_repeat_streak >= PROXY_COORDINATION_EARLY_BAN
+        ):
+            for n in coord_names:
+                if n not in self.session_banned_tools:
+                    self.session_banned_tools.add(n)
+                    logger.warning(
+                        "TOOL BAN (R4 early): '%s' banned after %d consecutive "
+                        "identical coordination calls",
+                        n,
+                        self.coordination_repeat_streak,
+                    )
+
         # Recon-convergence (B1): count consecutive turns that use tools but
         # produce NO write/deliverable tool call. A turn that uses any write
         # tool resets the streak — that's the model converging from
@@ -3810,6 +3849,22 @@ def _resolve_state_machine_tool_choice(
     return None, "unknown_phase"
 
 
+def _writes_are_gated(openai_body: dict) -> bool:
+    """True when recent tool results show the harness is BLOCKING direct writes
+    (delivery-enforcement), so a "write the file" directive is futile and the
+    model must route through the deliver tool instead. #1: aligns the recon
+    directive with the gate to break the read-forever / can't-write deadlock."""
+    for m in (openai_body.get("messages") or [])[-8:]:
+        c = m.get("content")
+        text = c if isinstance(c, str) else (json.dumps(c) if c else "")
+        low = text.lower()
+        if "delivery-enforcement" in low or (
+            "blocked" in low and "deliver" in low and "tool" in low
+        ):
+            return True
+    return False
+
+
 def _maybe_inject_recon_convergence(
     openai_body: dict,
     monitor: "SessionMonitor",
@@ -3881,6 +3936,18 @@ def _maybe_inject_recon_convergence(
             "if strictly required to write it."
         )
         tier = "firm"
+    # #1: if the harness is blocking direct writes (delivery-enforcement), a
+    # "write the file" directive is impossible to satisfy and the model loops in
+    # recon. Redirect it to the deliver tool — the only write path under a gate.
+    if not escalate and _writes_are_gated(openai_body):
+        directive += (
+            " IMPORTANT: your direct Edit/Write calls are being BLOCKED by policy. "
+            "Do NOT try to write the file directly. Call the `deliver` tool (or run "
+            "`uap deliver \"<one-line task>\"`) to produce the deliverable — that is "
+            "the only path that can write here."
+        )
+        tier = tier + "+deliver-gated"
+
     msgs = openai_body.get("messages", [])
     msgs.append({"role": "user", "content": directive})
     openai_body["messages"] = msgs

package/tools/agents/tests/test_coordination_early_ban.py

@@ -0,0 +1,43 @@
+"""Tests for R4: early coordination-loop ban (independent of active-loop)."""
+import importlib.util
+import unittest
+from pathlib import Path
+
+proxy_path = Path(__file__).resolve().parents[3] / "tools" / "agents" / "scripts" / "anthropic_proxy.py"
+spec = importlib.util.spec_from_file_location("anthropic_proxy", proxy_path)
+ap = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(ap)
+
+
+class EarlyCoordinationBanTest(unittest.TestCase):
+    def test_config_default(self):
+        self.assertEqual(ap.PROXY_COORDINATION_EARLY_BAN, 3)
+
+    def test_identical_coordination_repeats_get_banned(self):
+        m = ap.SessionMonitor(context_window=132096)
+        fp = "TaskCreate:deadbeef"
+        for _ in range(3):
+            m.record_tool_calls(["TaskCreate"], fingerprint=fp)
+        self.assertIn("TaskCreate", m.session_banned_tools)
+
+    def test_two_repeats_not_yet_banned(self):
+        m = ap.SessionMonitor(context_window=132096)
+        for _ in range(2):
+            m.record_tool_calls(["TaskCreate"], fingerprint="TaskCreate:x")
+        self.assertNotIn("TaskCreate", m.session_banned_tools)
+
+    def test_non_coordination_tool_not_banned(self):
+        m = ap.SessionMonitor(context_window=132096)
+        for _ in range(5):
+            m.record_tool_calls(["Bash"], fingerprint="Bash:same")
+        self.assertNotIn("Bash", m.session_banned_tools)
+
+    def test_varying_args_reset_streak(self):
+        m = ap.SessionMonitor(context_window=132096)
+        for i in range(5):
+            m.record_tool_calls(["TaskCreate"], fingerprint=f"TaskCreate:{i}")
+        self.assertNotIn("TaskCreate", m.session_banned_tools)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_delivery_enforcement_worktree.py

@@ -75,3 +75,31 @@ class TestDeliveryEnforcementWorktree(unittest.TestCase):
 
 if __name__ == "__main__":
     unittest.main()
+
+
+import os as _os, subprocess as _sp, sys as _sys, json as _json, tempfile as _tf
+from pathlib import Path as _Path
+_ENF = _Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "delivery_enforcement.py"
+
+class LocalAdvisoryTest(unittest.TestCase):
+    def _run(self, extra_env):
+        with _tf.TemporaryDirectory() as td:
+            root = _Path(td); (root/".git").mkdir()
+            f = root/"src"/"a.ts"; f.parent.mkdir(parents=True); f.write_text("x")
+            e = dict(_os.environ); e["UAP_REPO_ROOT"]=str(root)
+            for k in ("ANTHROPIC_BASE_URL","UAP_DELIVER_LOCAL_ADVISORY","UAP_DELIVER_ACTIVE"): e.pop(k, None)
+            e.update(extra_env)
+            p = _sp.run([_sys.executable, str(_ENF), "--operation","Write","--args",_json.dumps({"file_path":str(f)})], capture_output=True, text=True, env=e)
+            return p.returncode, _json.loads(p.stdout) if p.stdout.strip() else {}
+
+    def test_local_session_downgrades_to_advisory(self):
+        rc, out = self._run({"ANTHROPIC_BASE_URL":"http://127.0.0.1:4000"})
+        self.assertEqual(rc, 0); self.assertTrue(out["allowed"])
+
+    def test_local_advisory_off_keeps_block(self):
+        rc, out = self._run({"ANTHROPIC_BASE_URL":"http://127.0.0.1:4000","UAP_DELIVER_LOCAL_ADVISORY":"0"})
+        self.assertEqual(rc, 2)
+
+    def test_cloud_session_still_blocks(self):
+        rc, out = self._run({"ANTHROPIC_BASE_URL":"https://api.anthropic.com"})
+        self.assertEqual(rc, 2)

package/tools/agents/tests/test_recon_deliver_gate.py

@@ -0,0 +1,45 @@
+"""Tests for #1: RECON directive is write-block aware (routes to deliver)."""
+import importlib.util
+import unittest
+from pathlib import Path
+
+proxy_path = Path(__file__).resolve().parents[3] / "tools" / "agents" / "scripts" / "anthropic_proxy.py"
+spec = importlib.util.spec_from_file_location("anthropic_proxy", proxy_path)
+ap = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(ap)
+
+GATED_MSG = {"role": "user", "content": [
+    {"type": "tool_result", "content": "[UAP policy blocked: delivery-enforcement] BLOCKED: call the `deliver` tool"}
+]}
+PLAIN_MSG = {"role": "user", "content": "read the next file"}
+
+
+class WritesGatedTest(unittest.TestCase):
+    def test_detects_delivery_enforcement_block(self):
+        self.assertTrue(ap._writes_are_gated({"messages": [GATED_MSG]}))
+
+    def test_plain_messages_not_gated(self):
+        self.assertFalse(ap._writes_are_gated({"messages": [PLAIN_MSG]}))
+
+
+class ReconDirectiveTest(unittest.TestCase):
+    def _run(self, gated):
+        m = ap.SessionMonitor(context_window=132096)
+        m.consecutive_no_write_turns = max(1, ap.PROXY_RECON_CONVERGENCE_THRESHOLD)
+        body = {"messages": [GATED_MSG if gated else PLAIN_MSG], "tools": [{"name": "Write"}]}
+        ap._maybe_inject_recon_convergence(body, m)
+        return body["messages"][-1]["content"]
+
+    def test_gated_directive_routes_to_deliver(self):
+        d = self._run(gated=True)
+        self.assertIn("deliver", d.lower())
+        self.assertIn("BLOCKED", d)
+
+    def test_ungated_directive_says_write(self):
+        d = self._run(gated=False)
+        self.assertIn("write", d.lower())
+        self.assertNotIn("being BLOCKED by policy", d)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_worktree_required.py

@@ -0,0 +1,63 @@
+"""Tests for worktree-required R1 (fail-open on non-git) + R3 (route hint)."""
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+ENF = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "worktree_required.py"
+
+
+def run(root, target):
+    e = dict(os.environ)
+    e["UAP_REPO_ROOT"] = str(root)
+    e.pop("UAP_NO_WORKTREE", None)
+    p = subprocess.run(
+        [sys.executable, str(ENF), "--operation", "Write",
+         "--args", json.dumps({"file_path": str(target)})],
+        capture_output=True, text=True, env=e,
+    )
+    out = json.loads(p.stdout) if p.stdout.strip() else {}
+    return p.returncode, out
+
+
+class WorktreeRequiredTest(unittest.TestCase):
+    def test_R1_fail_open_on_non_git(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            f = root / "foo.ts"
+            f.write_text("x")
+            rc, out = run(root, f)
+            self.assertEqual(rc, 0)
+            self.assertTrue(out["allowed"])
+            self.assertIn("not a git repo", out["reason"])
+
+    def test_R3_blocks_with_route_on_git_repo(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            (root / ".git").mkdir()  # make it look like a git repo
+            f = root / "src" / "app.ts"
+            f.parent.mkdir(parents=True)
+            f.write_text("x")
+            rc, out = run(root, f)
+            self.assertEqual(rc, 2)
+            self.assertFalse(out["allowed"])
+            self.assertEqual(out.get("route"), "worktree")
+            self.assertIn("worktreeHint", out)
+            self.assertIn("run the command now", out["reason"])
+
+    def test_worktree_path_allowed(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            (root / ".git").mkdir()
+            f = root / ".worktrees" / "001-x" / "a.ts"
+            f.parent.mkdir(parents=True)
+            f.write_text("x")
+            rc, out = run(root, f)
+            self.assertEqual(rc, 0)
+
+
+if __name__ == "__main__":
+    unittest.main()