@miller-tech/uap 2.39.1 → 2.44.2

package/src/policies/enforcers/delivery_enforcement.py

@@ -193,16 +193,32 @@ def _trivial_edit_chars() -> int:
 
 def _changed_chars(args: dict) -> int | None:
     """Total changed characters for an Edit/MultiEdit, or None when it can't be
-    measured (e.g. a whole-file Write) — None means 'not trivially small'."""
+    measured (e.g. a whole-file Write) — None means 'not trivially small'.
+
+    Harnesses spell the anchor fields three ways: Claude Code sends
+    old_string/new_string, some SDKs oldString/newString, and Droid (Factory)
+    old_str/new_str. An unrecognized spelling measured as None — read as a
+    whole-file rewrite — which force-escalated every Droid Edit as complex
+    regardless of size (observed live 2026-11-12: a 4-line comment insert was
+    refused as 'a whole-file rewrite that replaces most of a substantial
+    file'). grab() recognizes all three spellings at both call sites."""
+    def grab(d: dict) -> tuple[object, object]:
+        old = d.get("old_string") or d.get("oldString") or d.get("old_str")
+        new = d.get("new_string") or d.get("newString") or d.get("new_str")
+        return old, new
     def pair(o: object, n: object) -> int:
         return len(str(o or "")) + len(str(n or ""))
     if "edits" in args and isinstance(args["edits"], list):
-        return sum(
-            pair(e.get("old_string") or e.get("oldString"), e.get("new_string") or e.get("newString"))
-            for e in args["edits"] if isinstance(e, dict)
-        )
-    old = args.get("old_string") or args.get("oldString")
-    new = args.get("new_string") or args.get("newString")
+        total, measured = 0, False
+        for e in args["edits"]:
+            if not isinstance(e, dict):
+                continue
+            old, new = grab(e)
+            if old is not None or new is not None:
+                measured = True
+                total += pair(old, new)
+        return total if measured else None
+    old, new = grab(args)
     if old is not None or new is not None:
         return pair(old, new)
     return None  # Write (full content) — not a trivial edit
@@ -232,7 +248,7 @@ def _write_cost(args: dict, root: Path) -> int | None:
     """
     content = args.get("content")
     if content is None:
-        content = args.get("new_string") or args.get("newString")
+        content = args.get("new_string") or args.get("newString") or args.get("new_str")
     if content is None:
         return None
     new_len = len(str(content))
@@ -460,8 +476,11 @@ def _escalation_block(rel: str, kind: str, detail: str, args: dict) -> None:
         intent = {
             k: v
             for k, v in (
-                ("old_string", args.get("old_string", args.get("oldString"))),
-                ("new_string", args.get("new_string", args.get("newString"))),
+                # Same three spellings as _changed_chars/_write_cost — an
+                # escalated Droid edit (old_str/new_str) must be recorded as a
+                # replayable intent, not silently dropped to None.
+                ("old_string", args.get("old_string") or args.get("oldString") or args.get("old_str")),
+                ("new_string", args.get("new_string") or args.get("newString") or args.get("new_str")),
                 ("content", args.get("content")),
             )
             if isinstance(v, str)
@@ -868,8 +887,11 @@ def main() -> None:
         intent_payload = {
             k: v
             for k, v in (
-                ("old_string", args.get("old_string", args.get("oldString"))),
-                ("new_string", args.get("new_string", args.get("newString"))),
+                # Same three spellings as _changed_chars/_write_cost — an
+                # escalated Droid edit (old_str/new_str) must be recorded as a
+                # replayable intent, not silently dropped to None.
+                ("old_string", args.get("old_string") or args.get("oldString") or args.get("old_str")),
+                ("new_string", args.get("new_string") or args.get("newString") or args.get("new_str")),
                 ("content", args.get("content")),
             )
             if isinstance(v, str)

package/templates/hooks/pre-tool-use-bash.sh

@@ -14,8 +14,18 @@ fi
 # Read tool input from stdin (JSON)
 INPUT=$(cat)
 
-# Extract command from tool_input
-CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null || true)
+# Extract command from tool_input, with bounded retries. Under a full
+# parallel suite (or a busy box) a jq spawn can fail transiently, and a
+# fail-open on that would silently allow exactly the edits this guard
+# exists to block — measured as the recurring jq '.version = "9.9.9"'
+# semver-suite flake (3 strikes on 2026-11-12: two CI runs, one local).
+# Fail-open stays the LAST resort for genuinely unparseable input.
+CMD=""
+for _attempt in 1 2 3 4 5; do
+  CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null || true)
+  [ -n "$CMD" ] && break
+  sleep 0.05
+done
 
 # If we can't determine the command, fail open
 if [ -z "$CMD" ]; then
@@ -178,7 +188,28 @@ fi
 # That is a READ. Splitting on ; && || | and newline keeps every real edit
 # (each has sed/awk/jq and package.json inside one statement) and drops the
 # cross-statement coincidence. Verified against both corpora before and after.
-if printf '%s' "$CMD" | tr ';|&\n' '\n\n\n\n' | grep -qE "(sed|awk).*package\.json.*(version|\"version\")|((sed|awk).*version.*package\.json)|(jq.*\.version.*package\.json)"; then
+#
+# Evaluated with BUILT-INS ONLY: parameter expansion for the statement split,
+# [[ =~ ]] for the match. An earlier `printf | tr | grep -qE` pipeline looked
+# equivalent but had a load-shaped hole: in an `if` condition a grep that fails
+# to spawn (exit 2/126/127 under fork pressure) is indistinguishable from a
+# no-match (exit 1), so the rule silently failed OPEN under the full parallel
+# suite — the canary still refused, so it looked like a genuine allow. That was
+# the recurring semver-suite flake (3 strikes on 2026-11-12: two CI runs, one
+# local version-bump gate). Zero forks here means no spawn can hiccup, and no
+# pipeline stage can mask a match.
+_semv_split="${CMD//[;|&]/$'\n'}"
+_semv_a='(sed|awk).*package\.json.*version'
+_semv_b='(sed|awk).*version.*package\.json'
+_semv_c='jq.*\.version.*package\.json'
+_semv_hit=""
+while IFS= read -r _semv_stmt; do
+  if [[ "$_semv_stmt" =~ $_semv_a || "$_semv_stmt" =~ $_semv_b || "$_semv_stmt" =~ $_semv_c ]]; then
+    _semv_hit="yes"
+    break
+  fi
+done <<< "$_semv_split"
+if [ -n "$_semv_hit" ]; then
   echo "BLOCKED [semver-versioning]: Manual package.json version edits are prohibited. Use: npm run version:patch, version:minor, or version:major. See policies/semver-versioning.md" >&2
   exit 2
 fi

package/templates/hooks/stop.sh

@@ -233,10 +233,49 @@ if [ "$CODE_CHANGED" = "true" ] && [ "${UAP_VERIFY_ON_STOP:-1}" != "0" ] && comm
     fi
   fi
   set -e
+  # A green verify (or a gate that never ran) resets the consecutive-block
+  # counter below — a fresh red streak starts from zero.
+  if [ "$VERIFY_RC" = "0" ]; then
+    rm -f "${PROJECT_DIR}/.uap/stop-gate/blocks" 2>/dev/null || true
+  fi
   # RC 1 = a REAL gate failure (code is broken) → block. Everything else fails
   # OPEN: RC 3 = infra (gate timed out / couldn't spawn), 124 = outer timeout,
   # 127 = missing, any other = internal — none should ever wedge a session.
   if [ "$VERIFY_RC" = "1" ]; then
+    # Bounded consecutive-block relief. The re-entrancy guard at the top
+    # relents only when the harness sends stop_hook_active:true (the Claude
+    # Code contract). Harnesses that send no Stop payload (observed: Factory
+    # Droid on pay2u, 2026-10-18) never trip that guard, so a persistently-red
+    # gate — e.g. max-fidelity interaction fail-closed on a repo with entry
+    # pages but no manifest — became an unbounded Stop→continue→Stop loop:
+    # exactly the wedge this hook's fail-open design promises cannot happen.
+    # Count consecutive RC-1 blocks per project; relent (allow the stop, with
+    # the red verdict still on record) after UAP_STOP_BLOCK_LIMIT (default 3).
+    # A block older than an hour starts a fresh count: the counter tracks a
+    # LOOP, not history — a new session gets a fresh budget.
+    mkdir -p "${PROJECT_DIR}/.uap/stop-gate" 2>/dev/null || true
+    BLOCK_FILE="${PROJECT_DIR}/.uap/stop-gate/blocks"
+    BLOCK_COUNT=0
+    BLOCK_TS=0
+    if [ -f "$BLOCK_FILE" ]; then
+      BLOCK_COUNT="$(head -1 "$BLOCK_FILE" 2>/dev/null || echo 0)"
+      BLOCK_TS="$(tail -1 "$BLOCK_FILE" 2>/dev/null || echo 0)"
+    fi
+    case "$BLOCK_COUNT" in ''|*[!0-9]*) BLOCK_COUNT=0 ;; esac
+    case "$BLOCK_TS" in ''|*[!0-9]*) BLOCK_TS=0 ;; esac
+    NOW="$(date +%s 2>/dev/null || echo 0)"
+    case "$NOW" in ''|*[!0-9]*) NOW=0 ;; esac
+    if [ "$NOW" -gt 0 ] && [ "$((NOW - BLOCK_TS))" -gt 3600 ]; then
+      BLOCK_COUNT=0
+    fi
+    BLOCK_LIMIT="${UAP_STOP_BLOCK_LIMIT:-3}"
+    case "$BLOCK_LIMIT" in ''|*[!0-9]*) BLOCK_LIMIT=3 ;; esac
+    if [ "$BLOCK_COUNT" -ge "$BLOCK_LIMIT" ]; then
+      echo ""
+      echo "## RUNTIME/USER-PATH GATE still red after $BLOCK_COUNT consecutive blocks — allowing stop so the session cannot wedge. The verdict above stays on record; fix the failure in a follow-up session. (Bound: UAP_STOP_BLOCK_LIMIT=$BLOCK_LIMIT; full bypass: UAP_VERIFY_ON_STOP=0.)"
+      exit 0
+    fi
+    printf '%s\n%s\n' "$((BLOCK_COUNT + 1))" "$NOW" > "$BLOCK_FILE" 2>/dev/null || true
     echo ""
     echo "## RUNTIME/USER-PATH GATE FAILED — the code does not run or does not work for a real user"
     echo "$VERIFY_OUT"

package/tools/agents/tests/test_delivery_enforcement_write_complexity.py

@@ -94,6 +94,32 @@ class WriteComplexityTest(unittest.TestCase):
         self.assertEqual(small[0], 0, small[1])
         self.assertEqual(big[0], 2, big[1])
 
+    def test_droid_edit_spelling_is_measured_the_same(self):
+        # Droid (Factory) sends old_str/new_str. Before 2026-11-12 those
+        # spellings measured as None — "whole-file rewrite" — so EVERY Droid
+        # Edit escalated as complex regardless of size. Same sizes as the
+        # Claude-spelling case must get the same verdicts.
+        root = project()
+        target = os.path.join(root, "src", "thing.ts")
+        small = run(root, {"file_path": target, "old_str": "a" * 20, "new_str": "b" * 20}, op="Edit")
+        big = run(root, {"file_path": target, "old_str": "a" * 300, "new_str": "b" * 300}, op="Edit")
+        self.assertEqual(small[0], 0, small[1])
+        self.assertEqual(big[0], 2, big[1])
+
+    def test_multiedit_droid_spelling_sums_across_edits(self):
+        root = project()
+        target = os.path.join(root, "src", "multi.ts")
+        code_ok, out_ok = run(root, {"file_path": target, "edits": [
+            {"old_str": "a" * 20, "new_str": "b" * 20},
+            {"old_str": "c" * 20, "new_str": "d" * 20},
+        ]}, op="MultiEdit")
+        code_big, _ = run(root, {"file_path": target, "edits": [
+            {"old_str": "a" * 200, "new_str": "b" * 200},
+            {"old_str": "c" * 200, "new_str": "d" * 200},
+        ]}, op="MultiEdit")
+        self.assertEqual(code_ok, 0, out_ok)
+        self.assertEqual(code_big, 2)
+
     def test_nature_exemptions_are_unchanged(self):
         root = project()
         docs = run(root, {"file_path": os.path.join(root, "docs", "n.md"), "content": "x" * 9000})