@miller-tech/uap 2.16.7 → 2.19.5

package/src/policies/enforcers/plane_admin_protect.py

@@ -0,0 +1,133 @@
+#!/usr/bin/env python3
+"""plane-admin-protect enforcer: agents must not reset/override the Plane admin
+account credentials unless the owner explicitly approved via a waiver file.
+
+Observed (2026-09-24 and 2026-09-30): agents independently ran
+`docker exec plane-app-api-1 python manage.py ... set_password admin@pay2u.com.au`
+and overwrote the owner's password TWICE. The owner had to ask for a reset.
+UAP memory stores a PROTECT note; this enforcer makes that note mechanical.
+
+Scope (Bash/bash/run_bash/shell operations only):
+  - Any shell command that targets the Plane stack (plane-app-api-1, plane-app,
+    134.199.173.65, /opt/plane, plane-db) AND performs a credential mutation
+    (reset_password / set_password / changepassword / createsuperuser / passwd)
+    is refused.
+
+Escape hatch (owner approval, mirrors the policies/waivers convention used by
+the expert-review gate): write `policies/waivers/plane-admin-reset` containing
+a line `expires: YYYY-MM-DD` (today or later), then retry. The waiver is a
+file the OWNER writes; an agent writing it without an explicit owner request
+in the current session violates the policy even though the gate would pass.
+
+Known limits. This is a text gate over a language with unbounded ways to say
+the same thing. It scans the command with `scannable_command()`, which strips
+heredoc bodies and multi-word quoted blobs so a command that merely NAMES a
+credential verb in prose (a commit message, a `uap memory store`, a script fed
+over a heredoc) is not refused. The observed incident — `docker exec ...
+changepassword ...` — is caught because `exec` hands text to a shell, so
+`scannable_command` leaves that payload intact. A mutation quoted inside a
+plain `ssh host "..."` with no shell-exec token, or routed through `eval`/
+base64, evades every text rule by construction. Treat this as raising the cost,
+not as a boundary.
+"""
+from __future__ import annotations
+
+import re
+import sys
+from datetime import date
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from _common import emit, parse_cli, repo_root, scannable_command  # noqa: E402
+
+WAIVER_PATH = "policies/waivers/plane-admin-reset"
+
+SHELL_OPS = {"bash", "run_bash", "shell", "execute_command", "terminal"}
+
+# Substring match, so `plane-app` already covers plane-app-api-1/-worker/-beat;
+# the specific spellings are listed for documentation, not because they match
+# anything the generic one would not.
+TARGETS = (
+    "plane-app",
+    "134.199.173.65",
+    "/opt/plane",
+    "plane-db",
+)
+
+MUTATIONS = (
+    "reset_password",
+    "set_password",
+    "changepassword",
+    "createsuperuser",
+    "passwd",
+)
+
+
+def _waiver_expiry(waiver: Path) -> tuple[bool, str]:
+    """(valid, detail) for a waiver file that exists.
+
+    A waiver is only honoured when it parses an `expires: YYYY-MM-DD` line that
+    is today or later. An unreadable file is NOT treated as absent — the gate
+    fails closed rather than crashing, so a permission problem cannot be used to
+    slip past it (or to mask it as an internal error).
+    """
+    try:
+        text = waiver.read_text()
+    except OSError as e:
+        return False, f"waiver file exists but could not be read ({e.strerror or e})"
+    m = re.search(r"expires:\s*(\d{4}-\d{2}-\d{2})", text)
+    if not m:
+        return False, "waiver file is missing an 'expires: YYYY-MM-DD' line"
+    try:
+        expires = date.fromisoformat(m.group(1))
+    except ValueError:
+        return False, f"waiver 'expires: {m.group(1)}' is not a valid date"
+    if expires >= date.today():
+        return True, f"owner waiver valid until {m.group(1)}"
+    return False, f"waiver expired on {m.group(1)}"
+
+
+def main() -> None:
+    operation, args = parse_cli()
+    if operation.lower() not in SHELL_OPS:
+        emit(True, "plane-admin-protect: not a shell operation")
+
+    raw = str(args.get("command") or "")
+    if not raw:
+        emit(True, "plane-admin-protect: no command payload")
+    cmd = scannable_command(raw).lower()
+
+    if not any(t in cmd for t in TARGETS):
+        emit(True, "plane-admin-protect: command does not target the Plane stack")
+
+    verb = next((v for v in MUTATIONS if v in cmd), None)
+    if verb is None:
+        emit(True, "plane-admin-protect: no credential mutation verb")
+
+    waiver = repo_root() / WAIVER_PATH
+    if waiver.exists():
+        valid, detail = _waiver_expiry(waiver)
+        if valid:
+            emit(True, f"plane-admin-protect: {detail}")
+        emit(
+            False,
+            f"plane-admin-protect: {detail} — refresh it with the owner's approval.",
+            route="owner-waiver",
+            waiverHint=f"owner writes {WAIVER_PATH} with a line 'expires: YYYY-MM-DD'",
+        )
+
+    emit(
+        False,
+        "plane-admin-protect: refusing credential mutation on the Plane stack "
+        f"(matched target + verb {verb!r}). The Plane admin account "
+        "admin@pay2u.com.au (droplet 134.199.173.65, /opt/plane/plane-app) must "
+        "NOT be reset/overridden unless the owner explicitly asks. Owner "
+        "approval: write policies/waivers/plane-admin-reset with a line "
+        "'expires: YYYY-MM-DD' and retry.",
+        route="owner-waiver",
+        waiverHint=f"owner writes {WAIVER_PATH} with a line 'expires: YYYY-MM-DD'",
+    )
+
+
+if __name__ == "__main__":
+    main()

package/src/policies/schemas/policies/plane-admin-protect.md

@@ -0,0 +1,55 @@
+# plane-admin-protect
+
+**Category**: safety
+**Level**: REQUIRED
+**Enforcement Stage**: pre-exec
+**Default**: on
+**Tags**: plane, credentials, admin, safety, droplet, owner-waiver
+
+## Rule
+
+A `Bash`/`run_bash`/`shell` command that **both** targets the Plane stack **and**
+performs a credential mutation is blocked:
+
+- Targets (substring match): `plane-app` (covers `plane-app-api-1`/`-worker`/`-beat`),
+  `134.199.173.65`, `/opt/plane`, `plane-db`.
+- Mutation verbs: `reset_password`, `set_password`, `changepassword`,
+  `createsuperuser`, `passwd`.
+
+The Plane admin account `admin@pay2u.com.au` (droplet `134.199.173.65`,
+`/opt/plane/plane-app`) must **not** be reset or overridden unless the owner
+explicitly asks for it in the current session.
+
+**Allowed**: read-only Plane commands (`kubectl logs plane-app-worker`,
+`docker exec plane-app-api-1 python manage.py showmigrations`, …) and any command
+that merely *names* a credential verb in prose — a commit message, a
+`uap memory store`, a script fed over a heredoc. The scan uses
+`scannable_command()`, which strips heredoc bodies and multi-word quoted blobs,
+so prose that mentions the verbs is not refused.
+
+**Escape hatch (owner approval).** Write `policies/waivers/plane-admin-reset`
+containing a line `expires: YYYY-MM-DD` (today or later), then retry. The waiver
+is a file the OWNER writes; an agent writing it without an explicit owner request
+in the current session violates the policy even though the gate would pass. A
+waiver that is expired, missing its `expires:` line, or unreadable fails the gate
+closed (refused), never allowed and never a crash.
+
+**Known limits.** This is a text gate over a language with unbounded ways to say
+the same thing. A mutation quoted inside a plain `ssh host "..."` with no
+shell-exec token, or routed through `eval`/base64, evades every text rule by
+construction. Treat this as raising the cost, not as a boundary.
+
+## Why
+
+Observed live (2026-09-24 and 2026-09-30): agents independently ran
+`docker exec plane-app-api-1 python manage.py ... set_password admin@pay2u.com.au`
+and overwrote the owner's password TWICE. The owner had to ask for a reset. UAP
+memory stores a PROTECT note; this enforcer makes that note mechanical rather
+than a reminder an agent can forget or route around.
+
+## Enforcement
+
+Python enforcer `plane_admin_protect.py` (Bash/run_bash/shell ops only). Emits a
+specific remediation: the refusal names the matched target and verb and points at
+the owner-waiver path. Install with `uap policy install plane-admin-protect`,
+which auto-attaches the enforcer from `src/policies/enforcers/plane_admin_protect.py`.

package/templates/hooks/uap-policy-gate.sh

@@ -399,6 +399,9 @@ fail_closed() {
     schema_diff_gate)
       echo "[UAP policy gate] FAIL-CLOSED: this commit touches watched schema paths but the schema-diff enforcer could not run (${why}). Blocked so a broken/absent gate can't become a bypass. Restore it with: uap policy verify --repair (or uap policy install schema-diff-gate if the manifest is gone; npm run build if dist/ is missing). Operator override: UAP_SELF_PROTECT_OFF=1 in the environment." >&2
       ;;
+    plane_admin_protect)
+      echo "[UAP policy gate] FAIL-CLOSED: this shell command can mutate the plane-admin control surface but the plane_admin_protect enforcer could not run (${why}). Blocked so a broken/absent gate can't become a bypass. Restore it with: uap policy verify --repair (or uap policy install plane-admin-protect if the manifest is gone). Operator override: UAP_SELF_PROTECT_OFF=1 in the environment." >&2
+      ;;
     *)
       echo "[UAP policy gate] FAIL-CLOSED: this operation touches the enforcement control surface but the self-protect enforcer could not run (${why}). Blocked so a broken/absent gate can't become a bypass. (Operator override: UAP_SELF_PROTECT_OFF=1.)" >&2
       ;;
@@ -524,13 +527,43 @@ print("1" if (inv and not inert) else "0")
 # refused every commit and push in the session with no working remedy.
 [[ "${UAP_SELF_PROTECT_OFF:-}" == "1" ]] && COMMIT_OP=0
 
+# Is this a SHELL-EXECUTION tool call? plane_admin_protect guards the plane-admin
+# control surface (policy registration, the plane-admin rows the gate reads out of
+# policies.db, the .policy-tools/ enforcer copies), and that surface is reachable
+# almost exclusively through the shell: `uap policy install/verify`, `sqlite3
+# agents/data/memory/policies.db ...`, `rm -rf .policy-tools/...`. An Edit/Write
+# of an ordinary source file never invokes it, so arming the fail-closed net there
+# would turn a broken plane-admin enforcer into a blanket block on every edit in
+# the session -- the same over-reach the COMMIT_OP scoping exists to avoid for
+# schema_diff_gate. Keyed on the TOOL name rather than command text because the
+# enforcer's own activation test is tool-based: a shell tool is the only one it is
+# ever asked about.
+SHELL_OP=0
+case " $TOOL " in
+  *" Bash "*|*" bash "*|*" run_bash "*|*" BashTool "*|*" Shell "*|*" shell "*|*" Terminal "*|*" terminal "*|*" execute_command "*|*" run_command "*|*" exec "*|*" local_shell "*|*" command "*)
+    SHELL_OP=1
+    ;;
+esac
+# Same operator hatch as SEC_SENSITIVE/COMMIT_OP: UAP_SELF_PROTECT_OFF is
+# documented as clearing the whole fail-closed net, so it has to clear this arm
+# too -- otherwise the override named in the refusal is a no-op for exactly the
+# case that prints it.
+[[ "${UAP_SELF_PROTECT_OFF:-}" == "1" ]] && SHELL_OP=0
+
 # Which enforcers must fail CLOSED, and when. Called from `if`, never as the
 # left side of `&&`: this script runs under `set -e`, and `if` suspends it for
 # the whole condition.
+#
+# plane_admin_protect arms ONLY for shell-execution tools (SHELL_OP): its guarded
+# surface is mutable through the shell and nothing else, so a missing or errored
+# plane-admin enforcer on a Bash call is a live bypass of the admin controls,
+# while the same broken enforcer on an Edit is unrelated to that surface and must
+# keep failing open (the gate is fail-soft by design for what it is not guarding).
 must_fail_closed() {
   case "$1" in
     enforcement_self_protect) [[ "$SEC_SENSITIVE" == "1" ]] ;;
     schema_diff_gate)         [[ "$COMMIT_OP" == "1" ]] ;;
+    plane_admin_protect)      [[ "$SHELL_OP" == "1" ]] ;;
     *)                        false ;;
   esac
 }