watchmyagents 0.8.0 → 0.8.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmyagents",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Security observability + real-time policy enforcement for AI agents. Local-first NDJSON capture with a continuous Watch daemon that auto-uploads anonymized signals, Shield CLI that blocks policy violations live (with policies pulled from Fortress cloud), anonymizer producing signals-only payloads, bidirectional sync with WatchMyAgents Fortress, and one-command install as an always-on launchd/systemd service — closing the recursive Watch→Guardian→Shield security loop.",
   "type": "module",
   "files": [
@@ -35,9 +35,7 @@
     "node": ">=18.0.0"
   },
   "dependencies": {},
-  "devDependencies": {
-    "@anthropic-ai/sdk": "^0.42.0"
-  },
+  "devDependencies": {},
   "keywords": [
     "ai",
     "agents",

package/scripts/service.js

@@ -94,11 +94,15 @@ function launcherPath(label) { return join(CONFIG_DIR, `${label}.launcher.sh`);
 
 function writeLauncher(label, scriptPath, args) {
   const argLine = args.map(sh).join(' ');
+  // Load secrets with a read-loop, NOT '. file' / source. Sourcing would
+  // shell-evaluate each value, so a secret like FOO=https://x/$(cmd) would
+  // execute cmd at launch. A read-loop assigns the value literally — the
+  // content is never re-scanned for command substitution.
   const body = `#!/bin/sh
-# Generated by wma-service. Loads secrets then runs the WMA daemon.
-set -a
-. ${sh(ENV_FILE)}
-set +a
+# Generated by wma-service. Loads secrets WITHOUT shell-evaluating their values.
+while IFS='=' read -r __k __v; do
+  [ -n "$__k" ] && export "$__k=$__v"
+done < ${sh(ENV_FILE)}
 exec ${sh(NODE)} ${sh(scriptPath)} ${argLine}
 `;
   const p = launcherPath(label);
@@ -147,15 +151,35 @@ function launchctl(args, { ignoreError = false } = {}) {
   }
 }
 
+// Synchronous sleep (installer CLI — blocking is fine). Used to let launchd's
+// asynchronous bootout finish before we bootstrap again.
+function syncSleep(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function macLoaded(label) {
+  try { execFileSync('launchctl', ['print', `gui/${UID}/${label}`], { stdio: 'pipe' }); return true; }
+  catch { return false; }
+}
+
 function macLoad(label, plist) {
   const domain = `gui/${UID}`;
-  launchctl(['bootout', `${domain}/${label}`], { ignoreError: true }); // unload prior
-  const ok = launchctl(['bootstrap', domain, plist]);
+  // bootout is async: on reinstall, bootstrapping again before the old instance
+  // is gone races and silently fails (symptom: reinstall = dead services).
+  // Wait for the prior instance to disappear, then retry bootstrap.
+  if (macLoaded(label)) {
+    launchctl(['bootout', `${domain}/${label}`], { ignoreError: true });
+    for (let i = 0; i < 20 && macLoaded(label); i++) syncSleep(150);
+  }
+  let ok = false;
+  for (let attempt = 0; attempt < 5 && !ok; attempt++) {
+    ok = launchctl(['bootstrap', domain, plist], { ignoreError: attempt < 4 });
+    if (!ok) syncSleep(250);
+  }
   launchctl(['enable', `${domain}/${label}`], { ignoreError: true });
   if (ok) info(`loaded ${label} (launchd) — running now + at every login`);
   else {
     warn(`could not auto-load ${label}. Load it manually:`);
-    process.stdout.write(`  launchctl bootstrap gui/${UID} ${plist}\n`);
+    process.stdout.write(`  launchctl bootout gui/${UID}/${label} 2>/dev/null; launchctl bootstrap gui/${UID} ${plist}\n`);
   }
 }
 

package/scripts/shield.js

@@ -36,7 +36,7 @@ import { DecisionLogger } from '../src/shield/decisions.js';
 import { listSessions } from '../src/sources/anthropic-managed.js';
 import { FortressPolicySource, postDecision } from '../src/shield/sources/fortress.js';
 import { resolveFortressBase } from '../src/fortress/url.js';
-import { isValidAgentId } from '../src/validate.js';
+import { isValidAgentId, isValidSessionId } from '../src/validate.js';
 
 function parseArgs(argv) {
   const out = {};
@@ -429,6 +429,11 @@ async function main() {
   if (!isValidAgentId(agentId)) {
     die(`error: --agent-id has invalid format (expected "agent_" + alphanumeric, got "${agentId}")`);
   }
+  // --session-id ends up in the Anthropic SSE URL path (src/shield/stream.js).
+  // Validate the same way wma-fetch does so a crafted value can't tamper the URL.
+  if (singleSessionId && !isValidSessionId(singleSessionId)) {
+    die(`error: --session-id has invalid format (expected "sesn_" + alphanumeric, got "${singleSessionId}")`);
+  }
 
   // Policies source: --policies-source fortress | local  (default infers from --policy)
   let ruleset;          // for 'local' mode: static; for 'fortress': initial snapshot