@miller-tech/uap 1.82.0 → 1.84.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.82.0",
+  "version": "1.84.0",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/src/policies/enforcers/delivery_enforcement.py

@@ -54,6 +54,34 @@ EXEMPT_PREFIXES = (
 TEST_MARKERS = (".test.", ".spec.", "_test.", "/test/", "/tests/", "/__tests__/")
 
 
+def _is_local_model_session() -> bool:
+    """True when this session targets a self-hosted/local model endpoint."""
+    base = (
+        os.environ.get("ANTHROPIC_BASE_URL")
+        or os.environ.get("OPENAI_BASE_URL")
+        or os.environ.get("UAP_INFERENCE_ENDPOINT")
+        or ""
+    ).lower()
+    return any(h in base for h in ("127.0.0.1", "localhost", "0.0.0.0", "::1"))
+
+
+# #2/#3a: how a LOCAL-model session is handled under block mode. A plain local
+# session deadlocks under strict block (can read, never write -> recon loop,
+# observed live). UAP_DELIVER_LOCAL_MODE selects the resolution:
+#   advisory (default) -> allow direct writes (fast; the proxy guards the model)
+#   deliver            -> keep the block + route:deliver so the change is driven
+#                         through `uap deliver` (VERIFIED path; pairs with
+#                         UAP_DELIVER_AUTOROUTE)
+#   block              -> strict block (no relaxation)
+# Back-compat: UAP_DELIVER_LOCAL_ADVISORY=0 maps to "block".
+def _local_mode() -> str:
+    m = os.environ.get("UAP_DELIVER_LOCAL_MODE", "").lower()
+    if m in {"advisory", "deliver", "block"}:
+        return m
+    adv = os.environ.get("UAP_DELIVER_LOCAL_ADVISORY", "on").lower()
+    return "advisory" if adv not in {"0", "off", "false", "no", ""} else "block"
+
+
 def main() -> None:
     op, args = parse_cli()
     if op not in EDIT_OPS:
@@ -99,6 +127,11 @@ def main() -> None:
     )
 
     mode = os.environ.get("UAP_ENFORCE_DELIVERY", "block").lower()
+    if mode == "block" and _is_local_model_session():
+        # #3a: route-through-deliver keeps the block (route:deliver -> autoroute
+        # drives the verified deliver loop); advisory unblocks direct writes.
+        if _local_mode() == "advisory":
+            mode = "advisory"
     if mode == "block":
         # R1: emit a machine-actionable routing signal so a capable harness can
         # auto-route the blocked change INTO `uap deliver` instead of leaving the

package/tools/agents/scripts/anthropic_proxy.py

@@ -3849,6 +3849,22 @@ def _resolve_state_machine_tool_choice(
     return None, "unknown_phase"
 
 
+def _writes_are_gated(openai_body: dict) -> bool:
+    """True when recent tool results show the harness is BLOCKING direct writes
+    (delivery-enforcement), so a "write the file" directive is futile and the
+    model must route through the deliver tool instead. #1: aligns the recon
+    directive with the gate to break the read-forever / can't-write deadlock."""
+    for m in (openai_body.get("messages") or [])[-8:]:
+        c = m.get("content")
+        text = c if isinstance(c, str) else (json.dumps(c) if c else "")
+        low = text.lower()
+        if "delivery-enforcement" in low or (
+            "blocked" in low and "deliver" in low and "tool" in low
+        ):
+            return True
+    return False
+
+
 def _maybe_inject_recon_convergence(
     openai_body: dict,
     monitor: "SessionMonitor",
@@ -3920,6 +3936,18 @@ def _maybe_inject_recon_convergence(
             "if strictly required to write it."
         )
         tier = "firm"
+    # #1: if the harness is blocking direct writes (delivery-enforcement), a
+    # "write the file" directive is impossible to satisfy and the model loops in
+    # recon. Redirect it to the deliver tool — the only write path under a gate.
+    if not escalate and _writes_are_gated(openai_body):
+        directive += (
+            " IMPORTANT: your direct Edit/Write calls are being BLOCKED by policy. "
+            "Do NOT try to write the file directly. Call the `deliver` tool (or run "
+            "`uap deliver \"<one-line task>\"`) to produce the deliverable — that is "
+            "the only path that can write here."
+        )
+        tier = tier + "+deliver-gated"
+
     msgs = openai_body.get("messages", [])
     msgs.append({"role": "user", "content": directive})
     openai_body["messages"] = msgs

package/tools/agents/tests/test_delivery_enforcement_worktree.py

@@ -75,3 +75,60 @@ class TestDeliveryEnforcementWorktree(unittest.TestCase):
 
 if __name__ == "__main__":
     unittest.main()
+
+
+import os as _os, subprocess as _sp, sys as _sys, json as _json, tempfile as _tf
+from pathlib import Path as _Path
+_ENF = _Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "delivery_enforcement.py"
+
+class LocalAdvisoryTest(unittest.TestCase):
+    def _run(self, extra_env):
+        with _tf.TemporaryDirectory() as td:
+            root = _Path(td); (root/".git").mkdir()
+            f = root/"src"/"a.ts"; f.parent.mkdir(parents=True); f.write_text("x")
+            e = dict(_os.environ); e["UAP_REPO_ROOT"]=str(root)
+            for k in ("ANTHROPIC_BASE_URL","UAP_DELIVER_LOCAL_ADVISORY","UAP_DELIVER_ACTIVE"): e.pop(k, None)
+            e.update(extra_env)
+            p = _sp.run([_sys.executable, str(_ENF), "--operation","Write","--args",_json.dumps({"file_path":str(f)})], capture_output=True, text=True, env=e)
+            return p.returncode, _json.loads(p.stdout) if p.stdout.strip() else {}
+
+    def test_local_session_downgrades_to_advisory(self):
+        rc, out = self._run({"ANTHROPIC_BASE_URL":"http://127.0.0.1:4000"})
+        self.assertEqual(rc, 0); self.assertTrue(out["allowed"])
+
+    def test_local_advisory_off_keeps_block(self):
+        rc, out = self._run({"ANTHROPIC_BASE_URL":"http://127.0.0.1:4000","UAP_DELIVER_LOCAL_ADVISORY":"0"})
+        self.assertEqual(rc, 2)
+
+    def test_cloud_session_still_blocks(self):
+        rc, out = self._run({"ANTHROPIC_BASE_URL":"https://api.anthropic.com"})
+        self.assertEqual(rc, 2)
+
+
+class LocalModeTest(unittest.TestCase):
+    def _run(self, env):
+        with _tf.TemporaryDirectory() as td:
+            root = _Path(td); (root/".git").mkdir()
+            f = root/"src"/"a.ts"; f.parent.mkdir(parents=True); f.write_text("x")
+            e = dict(_os.environ); e["UAP_REPO_ROOT"]=str(root)
+            for k in ("ANTHROPIC_BASE_URL","UAP_DELIVER_LOCAL_ADVISORY","UAP_DELIVER_LOCAL_MODE","UAP_DELIVER_ACTIVE"): e.pop(k, None)
+            e.update(env)
+            p = _sp.run([_sys.executable, str(_ENF), "--operation","Write","--args",_json.dumps({"file_path":str(f)})], capture_output=True, text=True, env=e)
+            return p.returncode, _json.loads(p.stdout) if p.stdout.strip() else {}
+
+    def test_local_mode_deliver_routes_through_deliver(self):
+        rc, out = self._run({"ANTHROPIC_BASE_URL":"http://127.0.0.1:4000","UAP_DELIVER_LOCAL_MODE":"deliver"})
+        self.assertEqual(rc, 2)
+        self.assertEqual(out.get("route"), "deliver")
+
+    def test_local_mode_advisory_allows(self):
+        rc, out = self._run({"ANTHROPIC_BASE_URL":"http://127.0.0.1:4000","UAP_DELIVER_LOCAL_MODE":"advisory"})
+        self.assertEqual(rc, 0); self.assertTrue(out["allowed"])
+
+    def test_local_mode_block_strict(self):
+        rc, out = self._run({"ANTHROPIC_BASE_URL":"http://127.0.0.1:4000","UAP_DELIVER_LOCAL_MODE":"block"})
+        self.assertEqual(rc, 2)
+
+    def test_default_is_advisory(self):
+        rc, out = self._run({"ANTHROPIC_BASE_URL":"http://127.0.0.1:4000"})
+        self.assertEqual(rc, 0)

package/tools/agents/tests/test_recon_deliver_gate.py

@@ -0,0 +1,45 @@
+"""Tests for #1: RECON directive is write-block aware (routes to deliver)."""
+import importlib.util
+import unittest
+from pathlib import Path
+
+proxy_path = Path(__file__).resolve().parents[3] / "tools" / "agents" / "scripts" / "anthropic_proxy.py"
+spec = importlib.util.spec_from_file_location("anthropic_proxy", proxy_path)
+ap = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(ap)
+
+GATED_MSG = {"role": "user", "content": [
+    {"type": "tool_result", "content": "[UAP policy blocked: delivery-enforcement] BLOCKED: call the `deliver` tool"}
+]}
+PLAIN_MSG = {"role": "user", "content": "read the next file"}
+
+
+class WritesGatedTest(unittest.TestCase):
+    def test_detects_delivery_enforcement_block(self):
+        self.assertTrue(ap._writes_are_gated({"messages": [GATED_MSG]}))
+
+    def test_plain_messages_not_gated(self):
+        self.assertFalse(ap._writes_are_gated({"messages": [PLAIN_MSG]}))
+
+
+class ReconDirectiveTest(unittest.TestCase):
+    def _run(self, gated):
+        m = ap.SessionMonitor(context_window=132096)
+        m.consecutive_no_write_turns = max(1, ap.PROXY_RECON_CONVERGENCE_THRESHOLD)
+        body = {"messages": [GATED_MSG if gated else PLAIN_MSG], "tools": [{"name": "Write"}]}
+        ap._maybe_inject_recon_convergence(body, m)
+        return body["messages"][-1]["content"]
+
+    def test_gated_directive_routes_to_deliver(self):
+        d = self._run(gated=True)
+        self.assertIn("deliver", d.lower())
+        self.assertIn("BLOCKED", d)
+
+    def test_ungated_directive_says_write(self):
+        d = self._run(gated=False)
+        self.assertIn("write", d.lower())
+        self.assertNotIn("being BLOCKED by policy", d)
+
+
+if __name__ == "__main__":
+    unittest.main()