@miller-tech/uap 2.21.1 → 2.21.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "2.21.1",
+  "version": "2.21.3",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/src/policies/enforcers/enforcement_self_protect.py

@@ -734,7 +734,15 @@ def main() -> None:
     op, args = parse_cli()
 
     if op in EDIT_OPS:
-        target = args.get("file_path") or args.get("path") or args.get("target") or ""
+        # Key list widened for opencode, which sends camelCase `filePath`.
+        # It previously landed on the fail-open "no file path in args" branch,
+        # so agent edits to protected files (.uap.json, enforcers, hooks) were
+        # allowed whenever the caller used a different key convention — the
+        # gate armed its fail-closed net, then this enforcer blinked first and
+        # allowed. Widening only ever BLOCKS: every added key names a file the
+        # agent is editing, not one it is merely reading.
+        target = (args.get("file_path") or args.get("filePath") or args.get("path")
+                  or args.get("target") or args.get("filename") or args.get("file") or "")
         if not target:
             emit(True, "no file path in args")
         rp = Path(target).resolve()

package/templates/hooks/uap-policy-gate.sh

@@ -252,7 +252,14 @@ except Exception: a = {}
 markers = ("/.policy-tools/", "/src/policies/", "/policies/", "/.uap.json",
            ".uap.json", "/.uap/", "anthropic-proxy.env", "uap-policy-gate.sh",
            "uap-reactor-prompt.sh", "pre-tool-use")
-target = a.get("file_path") or a.get("path") or a.get("target") or ""
+# Key list matches the one at the top of this script (worktree resolution):
+# harnesses disagree on the arg name (file_path vs filePath vs target/…), and
+# an op whose path key this list misses scores SEC_SENSITIVE=0 — arming
+# neither the fail-closed net nor the fastpath skip. Observed live: opencode
+# sends filePath (camelCase), so a trivial agent edit to .uap.json was
+# fast-pathed around the self-protect enforcer. Widening only TIGHTENS.
+target = (a.get("file_path") or a.get("filePath") or a.get("path")
+          or a.get("target") or a.get("filename") or a.get("file") or "")
 cmd = a.get("command") or ""
 # Scan the COMMAND as well as file_path. Only file_path was checked, so for
 # every Bash call SEC_SENSITIVE was 0 unless the command set a bypass var --

package/tools/agents/tests/test_enforcement_self_protect.py

@@ -37,6 +37,25 @@ class SelfProtectTest(unittest.TestCase):
         rc, out = run("Edit", {"file_path": str(REPO / ".uap.json")})
         self.assertEqual(rc, 2)
 
+    def test_blocks_edit_to_uap_json_camel_case(self):
+        # opencode sends camelCase `filePath`. The extraction previously read
+        # only file_path/path/target, so this shape landed on the fail-open
+        # "no file path in args" branch and the edit was ALLOWED — observed
+        # live: a looping client repeatedly tried to strip a policy flag from
+        # .uap.json and every attempt sailed past this enforcer.
+        rc, out = run("Edit", {"filePath": str(REPO / ".uap.json"), "oldString": "x", "newString": "y"})
+        self.assertEqual(rc, 2)
+        self.assertFalse(out["allowed"])
+        self.assertIn("BLOCKED", out["reason"])
+
+    def test_allows_normal_file_edit_camel_case(self):
+        # The widened key list must not over-block: an ordinary file named with
+        # the same convention still allows, with the same reason as before.
+        rc, out = run("Edit", {"filePath": str(REPO / "README.md"), "oldString": "x", "newString": "y"})
+        self.assertEqual(rc, 0)
+        self.assertTrue(out["allowed"])
+        self.assertEqual(out["reason"], "not an enforcement-control file")
+
     def test_blocks_edit_to_policy_tools(self):
         rc, out = run("Write", {"file_path": str(REPO / ".policy-tools/abc_delivery_enforcement.py")})
         self.assertEqual(rc, 2)