watchmyagents 1.1.3 → 1.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmyagents",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "description": "Security observability + real-time policy enforcement for AI agents. Local-first NDJSON capture with a continuous Watch daemon that auto-uploads anonymized signals, Shield CLI that blocks policy violations live (with policies pulled from Fortress cloud), anonymizer producing signals-only payloads, bidirectional sync with WatchMyAgents Fortress, and one-command install as an always-on launchd/systemd service — closing the recursive Watch→Guardian→Shield security loop.",
   "type": "module",
   "files": [

package/scripts/shield.js

@@ -25,7 +25,6 @@
 // ANTHROPIC_API_KEY env var is used if --api-key is omitted.
 
 import { resolve } from 'node:path';
-import { createHash } from 'node:crypto';
 import { streamWithReconnect } from '../src/shield/stream.js';
 import { loadPolicies, evaluate } from '../src/shield/policy.js';
 import {
@@ -39,6 +38,12 @@ import { FortressPolicySource, postDecision } from '../src/shield/sources/fortre
 import { resolveFortressBase, fortressEndpoint } from '../src/fortress/url.js';
 import { PolicyStream } from '../src/shield/policy-stream.js';
 import { isValidAgentId, isValidSessionId } from '../src/validate.js';
+// v1.1.4 F-19 (P1 Codex audit): all egress to Fortress now flows through
+// buildFortressDecisionPayload, which normalizes tool_name via the
+// anonymizer's allowlist + salted-hash scheme and drops anything it can't
+// safely normalize. Keeps Shield's payload aligned with the README
+// promise that decisions ship fingerprints, not raw values.
+import { buildFortressDecisionPayload } from '../src/shield/upload.js';
 
 function parseArgs(argv) {
   const out = {};
@@ -133,38 +138,20 @@ async function runSessionWorker({ sessionId, ctx }) {
   // refreshes from Fortress (every 5 min) take effect without restart.
   sinfo(sessionId, `attached (${mode} mode)`);
 
-  // Helper: hash an IoC value with the customer salt (same one used by
-  // anonymizer for signals → correlates decisions to signals in Fortress).
-  // Returns null if no salt is configured (decisions still upload, just
-  // without input_hash).
-  const hashIoc = (value) => {
-    if (!signalsSalt || value == null) return null;
-    const s = typeof value === 'string' ? value : JSON.stringify(value);
-    return 'sha256:' + createHash('sha256').update(signalsSalt).update(s).digest('hex').slice(0, 32);
-  };
-
   // Helper: assemble + fire the decision push to Fortress (fire-and-forget).
+  // v1.1.4 F-19 (P1 Codex audit): delegates payload construction to the
+  // pure helper in src/shield/upload.js so the egress-side containment
+  // logic (tool_name allowlist + salted hashing) is unit-tested in
+  // isolation. The helper drops any field it cannot safely normalize
+  // (custom tool without salt, missing salt for hashes) rather than
+  // passing the raw value through.
   const fireToFortress = (rawEvent, normalized, result, decidedInMs) => {
     if (!pushDecisionToFortress) return;
-    // Extract the most relevant input value to hash (URL > command > query > path)
-    const inp = normalized?.input;
-    let inputForHash = null;
-    if (inp && typeof inp === 'object') {
-      inputForHash = inp.url || inp.command || inp.query || inp.path || inp.file_path || null;
-    }
-    pushDecisionToFortress({
-      anthropic_agent_id: agentId,
-      decision: result.decision,
-      rule_id: result.rule_id || undefined,
-      session_hash: hashIoc(sessionId) || undefined,
-      event_id_hash: hashIoc(rawEvent?.id) || undefined,
-      input_hash: hashIoc(inputForHash) || undefined,
-      action_type: normalized?.action_type || undefined,
-      tool_name: normalized?.tool_name || undefined,
-      message: result.message || result.rule_name || undefined,
-      decided_at: new Date().toISOString(),
-      decided_in_ms: decidedInMs,
-    }).catch(() => undefined);
+    const payload = buildFortressDecisionPayload({
+      agentId, sessionId, rawEvent, normalized, result, decidedInMs,
+      signalsSalt,
+    });
+    pushDecisionToFortress(payload).catch(() => undefined);
   };
 
   let processed = 0, enforced = 0, sessionInterrupted = false;

package/src/shield/policy-stream.js

@@ -32,6 +32,7 @@
 import { request as httpsRequest } from 'node:https';
 import { URL } from 'node:url';
 import { EventEmitter } from 'node:events';
+import { normalizeSseBuffer } from './sse.js';
 
 const RECONNECT_MIN_MS = 1_000;
 const RECONNECT_MAX_MS = 60_000;
@@ -154,6 +155,13 @@ export class PolicyStream extends EventEmitter {
       let buffer = '';
       res.on('data', (chunk) => {
         buffer += chunk;
+        // v1.1.4 F-18 (P1 Codex audit): normalize CR / CRLF line
+        // terminators to LF before scanning for the event separator.
+        // Without this, a Fortress deployment behind a reverse-proxy
+        // that emits CRLF would never trigger a policy refresh push —
+        // updates would silently fall back to the 60s polling loop,
+        // breaking the "sub-second propagation" promise.
+        buffer = normalizeSseBuffer(buffer);
         // v1.1.1 F-9: cap on a single SSE event buffer. A buggy/compromised
         // endpoint that never emits "\n\n" would otherwise OOM Shield.
         // Abort + reconnect on overflow; the buffer is dropped so we
@@ -165,7 +173,8 @@ export class PolicyStream extends EventEmitter {
           if (!this._closed) this._scheduleReconnect();
           return;
         }
-        // SSE events are separated by a blank line ("\n\n").
+        // SSE events are separated by a blank line. Post-normalize the
+        // canonical separator is "\n\n".
         let eolIdx;
         while ((eolIdx = buffer.indexOf('\n\n')) !== -1) {
           const rawEvent = buffer.slice(0, eolIdx);

package/src/shield/policy.js

@@ -68,28 +68,61 @@ export async function loadPolicies(path) {
   return data;
 }
 
-// ReDoS protection: regexes are loaded from a user-provided JSON policy file,
-// so a malicious or buggy pattern (e.g. `(a+)+$`) could pin the CPU on a long
-// input. We mitigate two ways:
+// ReDoS protection: regexes are loaded from a user-provided JSON policy file
+// (LOCAL adapter) AND from Fortress / Guardian-generated rules (FORTRESS
+// adapter), so a malicious or buggy pattern (e.g. `(a+)+$`) could pin
+// Shield's CPU on a long input — taking the whole enforcement loop down.
+// We mitigate three ways:
 //   1) Cap the maximum input length passed to any regex test to MAX_REGEX_INPUT
 //      bytes. Above that we truncate before testing. Real agent values
-//      (URLs, commands, queries) are well under this in practice.
-//   2) Reject obviously dangerous patterns at compile time (heuristic).
+//      (URLs, commands, queries, file paths) are well under this in practice.
+//   2) Reject obviously dangerous patterns at compile time (heuristic — see
+//      SUSPICIOUS_REGEX_PATTERNS below). The list errs toward false positives
+//      because Shield runs in the hot path: a rejected rule is loud (the
+//      rule is dropped at load time with a clear error) while a runaway
+//      regex would silently degrade Shield to "no enforcement" until the
+//      operator notices a CPU spike.
+//   3) Hard upper bound on the regex source length so a deeply nested
+//      pattern can't game the heuristic by spreading the gadget across
+//      thousands of chars.
 //
-// A future v0.5 may add a proper safe-regex-2 dependency for thorough analysis.
-const MAX_REGEX_INPUT = 8192;
+// Future work (v1.2+): proper RE2 or safe-regex-2 dependency for thorough
+// analysis, or moving evaluation into a worker with a hard CPU timeout.
+// We can't ship that today without breaking the zero-runtime-deps promise.
+//
+// v1.1.4 F-20 (P2 Codex audit): cap reduced from 8192 → 2048 (4×). Worst
+// realistic IoC values (URL with long query string, base64 in a path)
+// remain comfortably under 2048; the previous 8192 was a defence-in-depth
+// holdover that no real workload exercises.
+const MAX_REGEX_INPUT = 2048;
 
+// v1.1.4 F-20: heuristic list extended to catch ambiguous alternation
+// (`(a|a)*`, `(a|ab)+`, `(.|.)*`) — these don't trip the existing
+// nested-quantifier heuristic but exhibit the same exponential behavior
+// because every char has two paths to match. The new pattern rejects any
+// alternation group immediately followed by `+` or `*`; this is intentionally
+// over-broad — a customer who needs `(http|https):` should use either a
+// character class (`[a-z]+:`) or move the optional letter (`https?:`).
 const SUSPICIOUS_REGEX_PATTERNS = [
   /(\([^)]*[+*][^)]*\))[+*]/,   // (x+)+ or (x*)* — classic catastrophic backtracking
   /(\.\*){3,}/,                  // multiple .* in a row
+  // F-20: alternation inside a group, then `+` or `*` — `(a|a)*`, `(a|ab)+`,
+  // `(.|.)*`. The `[^)]*\|[^)]*` body requires at least one `|` inside the
+  // group; a single-branch group like `(foo)+` is NOT matched.
+  /\([^)]*\|[^)]*\)[+*]/,
 ];
 
 export function validateRegexString(src, where) {
   if (typeof src !== 'string') {
     throw new Error(`policy ${where}: regex must be a string`);
   }
-  if (src.length > 2000) {
-    throw new Error(`policy ${where}: regex too long (>2000 chars)`);
+  // v1.1.4 F-20: cap regex source at 1024 chars (was 2000). Real Shield
+  // policies are short (URL-prefix match, host-list deny, command-prefix
+  // check). A 1KB regex source is already an outlier; anything longer is
+  // either pathological or trying to bypass the heuristics by smuggling
+  // a gadget across many bytes.
+  if (src.length > 1024) {
+    throw new Error(`policy ${where}: regex too long (>1024 chars)`);
   }
   for (const sus of SUSPICIOUS_REGEX_PATTERNS) {
     if (sus.test(src)) {

package/src/shield/sse.js

@@ -0,0 +1,48 @@
+// SSE line terminator normalization — v1.1.4 F-18 (P1 Codex audit).
+//
+// The HTML Living Standard's event-stream parsing rules (whatwg SSE)
+// accept three line terminator forms: LF (\n), CR (\r), and CRLF (\r\n).
+// An event ends at a blank line: TWO consecutive line terminators of any
+// of those forms, possibly mixed (e.g. \r\n\r\n, \r\r, \n\n, \r\n\n).
+//
+// Before this fix, Shield's two SSE consumers (stream.js for live agent
+// events, policy-stream.js for Fortress policy push) only looked for
+// the LF-LF separator. An upstream proxy or endpoint that emitted CRLF
+// (most production-grade reverse-proxies do, by default!) would yield
+// a buffer that never matched \n\n — Shield would silently never see
+// the events:
+//   - agent-stream side: no deny/interrupt would fire live, breaking
+//     the sub-second enforcement promise
+//   - policy-stream side: updates would fall back to the 60s polling
+//     loop, making rule rollouts visibly slow
+//
+// Fix: normalize the buffer to LF-only before scanning. The normalize
+// step is chunk-safe: a CR at the very end of the current buffer is
+// preserved verbatim (it might be the first half of an incoming CRLF
+// on the next chunk). Once a CR is no longer trailing, it's converted.
+
+/**
+ * Normalize SSE line terminators in a streaming buffer to LF.
+ *
+ * Use as: `buffer = normalizeSseBuffer(buffer + newChunk);`
+ *
+ * Guarantees, after the call:
+ *   - every `\r\n` pair has been replaced by `\n`
+ *   - every bare `\r` NOT at the very end has been replaced by `\n`
+ *   - a trailing `\r` is preserved verbatim so the next iteration can
+ *     check whether it was actually the first half of a CRLF
+ *
+ * @param {string} buffer  the streaming buffer (already concatenated)
+ * @returns {string}       buffer with line terminators normalized to LF
+ */
+export function normalizeSseBuffer(buffer) {
+  if (typeof buffer !== 'string' || buffer.length === 0) return buffer;
+  // Defer the very last character if it's a CR — we don't know yet
+  // whether it's a bare CR terminator or the first half of CRLF.
+  const tail = buffer.endsWith('\r') ? '\r' : '';
+  const scannable = tail ? buffer.slice(0, -1) : buffer;
+  // Two-pass replace: CRLF first (so we don't double-convert the LF
+  // half), then any remaining bare CR.
+  const normalized = scannable.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
+  return tail ? normalized + tail : normalized;
+}

package/src/shield/stream.js

@@ -6,6 +6,8 @@
 //
 // Uses built-in fetch + ReadableStream (Node 18+). Zero deps.
 
+import { normalizeSseBuffer } from './sse.js';
+
 const API_BASE = 'https://api.anthropic.com';
 const BETA = 'managed-agents-2026-04-01';
 const VERSION = '2023-06-01';
@@ -51,6 +53,12 @@ export async function* openEventStream({ apiKey, sessionId, signal }) {
       const { done, value } = await reader.read();
       if (done) break;
       buffer += decoder.decode(value, { stream: true });
+      // v1.1.4 F-18 (P1 Codex audit): normalize all SSE line terminators
+      // (CR, CRLF) to LF so the indexOf('\n\n') scan below catches every
+      // event boundary the spec allows. Without this, an upstream that
+      // emits CRLF (common in reverse-proxy paths) yielded a buffer that
+      // never matched and Shield silently lost the live enforcement loop.
+      buffer = normalizeSseBuffer(buffer);
 
       // v1.1.2 F-16: guard against an upstream that never emits "\n\n" —
       // throw to abort the stream cleanly, the caller's reconnect logic
@@ -60,8 +68,9 @@ export async function* openEventStream({ apiKey, sessionId, signal }) {
         throw new Error(`SSE frame exceeded ${MAX_SSE_FRAME_BYTES} bytes — aborting stream (caller should reconnect)`);
       }
 
-      // SSE frames are separated by a blank line ("\n\n"). Each frame may
-      // contain multiple lines; we only care about `data:` lines for now.
+      // SSE frames are separated by a blank line. Post-normalize, the
+      // canonical separator is "\n\n"; each frame may contain multiple
+      // lines; we only care about `data:` lines for now.
       let nlIdx;
       while ((nlIdx = buffer.indexOf('\n\n')) !== -1) {
         const frame = buffer.slice(0, nlIdx);

package/src/shield/upload.js

@@ -0,0 +1,89 @@
+// Shield → Fortress decision payload builder.
+// v1.1.4 F-19 (P1 Codex audit): pure helper extracted from scripts/shield.js
+// so the egress-side containment can be unit-tested in isolation. The
+// security invariant under test:
+//
+//   nothing on this payload may carry raw customer identifiers — tool
+//   names, session ids, event ids, input values must either be in the
+//   documented allowlist (vendor built-ins) or salted-hashed.
+//
+// Anything that can't be safely normalized is DROPPED (set to undefined)
+// rather than passed through. Decision still ships so Fortress can count
+// it — only the leak-y field is omitted.
+
+import { createHash } from 'node:crypto';
+import { normalizeToolName } from '../anonymizer.js';
+
+// Salted SHA-256 hash with the same 32-char truncation as the anonymizer
+// and the rest of Shield's decision flow. Returns null for nullish input
+// or when no salt is configured (fail-safe omission).
+function hashWithSaltOpt(value, salt) {
+  if (value == null || !salt) return null;
+  const s = typeof value === 'string' ? value : JSON.stringify(value);
+  return 'sha256:' + createHash('sha256').update(salt).update(s).digest('hex').slice(0, 32);
+}
+
+// Extract the most relevant input value to fingerprint (URL > command >
+// query > path > file_path). The actual hashing is done downstream by
+// hashIoc — this function only picks the IoC field.
+function pickInputForHash(input) {
+  if (!input || typeof input !== 'object') return null;
+  return input.url || input.command || input.query || input.path || input.file_path || null;
+}
+
+/**
+ * Build the body POSTed to Fortress's ingest-decisions endpoint.
+ *
+ * Containment guarantees:
+ *   - tool_name: vendor allowlist returned in clear; custom/MCP names
+ *     return as "tool_hash:<32hex>" when a salt is configured; dropped
+ *     entirely otherwise.
+ *   - session_hash / event_id_hash / input_hash: salted SHA-256, omitted
+ *     when no salt is configured.
+ *   - Raw payload values (rawEvent.input, normalized.input) never
+ *     appear on the wire — only their hashes do.
+ *
+ * @param {object} opts
+ * @param {string} opts.agentId - Anthropic agent id (already an opaque token)
+ * @param {string} opts.sessionId - Anthropic session id (hashed before egress)
+ * @param {object} opts.rawEvent  - raw upstream event (id field is hashed)
+ * @param {object} opts.normalized - normalized event from normalizeForPolicy()
+ * @param {object} opts.result    - policy evaluator output
+ * @param {number} opts.decidedInMs
+ * @param {string|null|undefined} opts.signalsSalt
+ * @param {string} [opts.decidedAtIso] - ISO 8601 timestamp; defaults to now()
+ * @returns {object} payload ready to POST to ingest-decisions
+ */
+export function buildFortressDecisionPayload({
+  agentId, sessionId, rawEvent, normalized, result, decidedInMs,
+  signalsSalt, decidedAtIso,
+}) {
+  // F-19: vendor built-ins survive even without a salt (allowlist short-circuit);
+  // custom tool names throw without a salt — we catch and drop the field.
+  let safeToolName;
+  const rawToolName = normalized?.tool_name;
+  if (rawToolName) {
+    try {
+      safeToolName = normalizeToolName(rawToolName, signalsSalt);
+    } catch {
+      safeToolName = undefined;
+    }
+  }
+
+  return {
+    anthropic_agent_id: agentId,
+    decision: result.decision,
+    rule_id: result.rule_id || undefined,
+    session_hash: hashWithSaltOpt(sessionId, signalsSalt) || undefined,
+    event_id_hash: hashWithSaltOpt(rawEvent?.id, signalsSalt) || undefined,
+    input_hash: hashWithSaltOpt(pickInputForHash(normalized?.input), signalsSalt) || undefined,
+    action_type: normalized?.action_type || undefined,
+    tool_name: safeToolName,
+    message: result.message || result.rule_name || undefined,
+    decided_at: decidedAtIso || new Date().toISOString(),
+    decided_in_ms: decidedInMs,
+    // v1.1.3 Phase 1.D: mode threading so Fortress can store and surface
+    // shadow-vs-enforce in the Reports timeline.
+    mode: result.mode || undefined,
+  };
+}