watchmyagents 1.1.5 → 1.1.6

package/SECURITY.md

@@ -11,13 +11,30 @@ WMA needs your Anthropic API key to call the Managed Agents REST API on your beh
 | Property | Behavior |
 |---|---|
 | **Source** | Environment variable `ANTHROPIC_API_KEY` or `--api-key` CLI flag |
-| **Storage** | Held in process memory for the duration of a `wma-fetch` run. Never persisted to disk by WMA. |
+| **Storage (CLI mode)** | Held in process memory for the duration of a `wma-fetch` run. Not persisted to disk. |
+| **Storage (service mode)** | Persisted to `~/.watchmyagents/env` with mode `0600` (user-only read/write) so the launchd / systemd unit can restart the daemon without prompting. See [Service-mode credentials](#service-mode-credentials) below for the exact layout. |
 | **Network** | Sent only to `api.anthropic.com` over HTTPS with strict certificate verification (`rejectUnauthorized: true`) |
 | **Logging** | The key is never written to NDJSON logs, never printed in error messages, never included in any export |
 | **Telemetry** | WMA performs zero telemetry today. No phone-home, no usage reporting. |
 
 **Recommendation:** generate a workspace-scoped API key with read-only permissions on the agents you want to monitor. See [Anthropic Console → API Keys](https://console.anthropic.com/settings/keys).
 
+#### Service-mode credentials
+
+When you run `wma-service install`, WMA registers a launchd (macOS) or systemd (Linux) unit that needs to restart the watch daemon across reboots without human intervention. The daemon's environment is therefore loaded from a small file owned by your user account:
+
+| Path | Mode | Owner | Contents |
+|---|---|---|---|
+| `~/.watchmyagents/` | `0700` | your user | Holds the env file and the launcher shell script |
+| `~/.watchmyagents/env` | `0600` | your user | `KEY=value` lines for `ANTHROPIC_API_KEY`, `WMA_API_KEY`, `WMA_SIGNALS_SALT`, `WMA_FORTRESS_BASE_URL` |
+| `~/.watchmyagents/<label>.launcher.sh` | `0600` | your user | Reads the env file with a literal `read -r` loop (no shell interpolation), then `exec`s `wma-fetch`. |
+
+Hardening notes:
+- The launcher loads secrets with `while IFS='=' read -r k v` instead of `. file` / `source file`. Sourcing would shell-evaluate every value, so a value containing `$(cmd)` would execute at every restart. The literal read assigns the bytes verbatim.
+- Values are validated before write: a newline anywhere in a credential aborts the install (would corrupt the env file or inject extra lines).
+- To wipe the credential without uninstalling the service: `chmod 600 ~/.watchmyagents/env && : > ~/.watchmyagents/env` (the daemon will exit on the next missing-env check).
+- Full removal: `wma-service uninstall` deletes the unit, the launcher, the env file, and the `~/.watchmyagents` directory.
+
 ### Local log files
 
 `wma-fetch` writes NDJSON files to `./watchmyagents-logs/<agent_id>/<date>.ndjson` with the following protections:
@@ -73,8 +90,7 @@ WMA combines **two complementary layers**:
 ## Supply chain
 
 - All code is open source on [GitHub](https://github.com/minedorfbm/watchmyagents)
-- Zero runtime dependencies (uses Node.js 18+ built-ins only)
-- One dev dependency (`@anthropic-ai/sdk`) for the optional adapter examples
+- Zero runtime AND dev dependencies (uses Node.js 18+ built-ins only). Run `npm ls --omit=dev` or check `package.json#dependencies` / `devDependencies` — both are empty.
 - Future releases will use `npm publish --provenance` for SLSA build attestation
 
 ## Reporting a vulnerability

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmyagents",
-  "version": "1.1.5",
+  "version": "1.1.6",
   "description": "Security observability + real-time policy enforcement for AI agents. Local-first NDJSON capture with a continuous Watch daemon that auto-uploads anonymized signals, Shield CLI that blocks policy violations live (with policies pulled from Fortress cloud), anonymizer producing signals-only payloads, bidirectional sync with WatchMyAgents Fortress, and one-command install as an always-on launchd/systemd service — closing the recursive Watch→Guardian→Shield security loop.",
   "type": "module",
   "files": [

package/scripts/fetch-anthropic.js

@@ -91,6 +91,11 @@ function resolveModel(agent) {
 // is misconfigured or compromised; abort.
 const MAX_FORTRESS_RESPONSE_BYTES = 1 * 1024 * 1024;
 
+// v1.1.6 F-22 (P2 Codex audit): hard ceiling on a Fortress POST round
+// trip. Same rationale as in scripts/upload-fortress.js — without this,
+// a slow/unresponsive endpoint hangs the daemon's session loop.
+const FORTRESS_REQUEST_TIMEOUT_MS = 30_000;
+
 function postJson(url, headers, body) {
   return new Promise((resolveReq, rejectReq) => {
     const u = new URL(url);
@@ -125,6 +130,11 @@ function postJson(url, headers, body) {
       });
     });
     req.on('error', rejectReq);
+    // v1.1.6 F-22: bound the round trip so a non-responding endpoint
+    // can't hang the watch daemon's upload loop.
+    req.setTimeout(FORTRESS_REQUEST_TIMEOUT_MS, () => {
+      req.destroy(new Error(`Fortress request timed out after ${FORTRESS_REQUEST_TIMEOUT_MS}ms`));
+    });
     req.write(data); req.end();
   });
 }

package/scripts/upload-fortress.js

@@ -68,6 +68,16 @@ async function collectFiles(p) {
 // against a compromised or misconfigured response.
 const MAX_FORTRESS_RESPONSE_BYTES = 1 * 1024 * 1024;
 
+// v1.1.6 F-22 (P2 Codex audit): hard ceiling on a Fortress POST round
+// trip. Mirrors the timeout already enforced in src/shield/sources/
+// fortress.js. Without this, a Fortress endpoint that accepts the TCP
+// connection but stops responding mid-stream would hang the upload
+// daemon indefinitely — same SLOWLORIS class of bug F-21 fixes for
+// SSE reads. 30 s is plenty for a small JSON POST (signals payloads
+// are kilobytes); legitimate Fortress nodes reply in <1 s in steady
+// state.
+const FORTRESS_REQUEST_TIMEOUT_MS = 30_000;
+
 function postJson(url, headers, body) {
   return new Promise((resolveReq, rejectReq) => {
     const u = new URL(url);
@@ -114,6 +124,10 @@ function postJson(url, headers, body) {
       }
     );
     req.on('error', rejectReq);
+    // v1.1.6 F-22: ensure a non-responding endpoint can't hang the upload.
+    req.setTimeout(FORTRESS_REQUEST_TIMEOUT_MS, () => {
+      req.destroy(new Error(`Fortress request timed out after ${FORTRESS_REQUEST_TIMEOUT_MS}ms`));
+    });
     req.write(data);
     req.end();
   });

package/src/logger.js

@@ -1,8 +1,21 @@
-import { mkdir, appendFile } from 'node:fs/promises';
+import { mkdir, appendFile, chmod } from 'node:fs/promises';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { assertSafePathSegment } from './validate.js';
 
+// v1.1.6 F-24 (P3 Codex audit): the `mode` option on mkdir() and
+// appendFile() is only honored when the directory or file is CREATED.
+// If a previous wma-fetch run, a different user, or a hand-rolled mkdir
+// already left those paths around with the system umask (typically
+// 0755 / 0644), the original constructor would silently keep the loose
+// perms even though SECURITY.md promises 0700 / 0600. tightenMode runs
+// after every mkdir / append to bring the existing inode in line with
+// the docs. Errors are swallowed (best-effort): the chmod is a hardening
+// pass, not a precondition — failing it shouldn't break logging.
+async function tightenMode(path, mode) {
+  try { await chmod(path, mode); } catch { /* not fatal */ }
+}
+
 // PR-B: `framework` → `provider` (canonical name per src/sources/contract.js).
 // PR-C: adds `parent_agent_id` + `composition_pattern` so any future
 // adapter that knows the hierarchy (OpenAI Agents handoffs, CrewAI
@@ -89,8 +102,12 @@ export class Logger {
       output: e.output ?? null,
     };
     try {
-      await mkdir(join(this.logDir, this.agentId), { recursive: true, mode: 0o700 });
+      const dir = join(this.logDir, this.agentId);
+      await mkdir(dir, { recursive: true, mode: 0o700 });
+      // v1.1.6 F-24: tighten existing perms — `mode` is creation-only.
+      await tightenMode(dir, 0o700);
       await appendFile(path, JSON.stringify(full) + '\n', { encoding: 'utf8', mode: 0o600 });
+      await tightenMode(path, 0o600);
       this.count++;
     } catch (err) {
       if (!this.silent) process.stderr.write(`[wma] log write error: ${err.message}\n`);

package/src/shield/stream.js

@@ -21,6 +21,20 @@ const VERSION = '2023-06-01';
 // reconnect logic — same outcome as a network error.
 const MAX_SSE_FRAME_BYTES = 1 * 1024 * 1024;
 
+// v1.1.6 F-21 (P1 Codex audit): inactivity watchdog on the SSE reader.
+// `reader.read()` blocks until the upstream sends bytes — there is no
+// built-in heartbeat check. A misbehaving proxy or compromised upstream
+// can keep the TCP connection open without ever emitting another event,
+// which freezes Shield indefinitely without triggering the reconnect
+// path in streamWithReconnect. 45 s is well above Anthropic's normal
+// inter-event latency (typically sub-second when an agent is active,
+// and the API sends SSE comment heartbeats `: ping` every ~15-30 s
+// when it's idle), so 45 s without any byte at all is a strong signal
+// the stream is dead but TCP-alive. On timeout we throw, the existing
+// try/finally releases the reader, and the caller reconnects with
+// exponential backoff.
+const SSE_INACTIVITY_TIMEOUT_MS = 45_000;
+
 function authHeaders(apiKey) {
   return {
     'x-api-key': apiKey,
@@ -50,7 +64,16 @@ export async function* openEventStream({ apiKey, sessionId, signal }) {
 
   try {
     while (true) {
-      const { done, value } = await reader.read();
+      // v1.1.6 F-21: race the reader against the inactivity watchdog so
+      // a stalled-but-open stream cannot freeze us indefinitely. We
+      // cancel the reader on timeout to release the underlying TCP
+      // resources before throwing — otherwise the pending read() would
+      // leak. The thrown error propagates to streamWithReconnect which
+      // initiates a fresh open with backoff.
+      const { done, value } = await readWithInactivityTimeout(
+        reader,
+        SSE_INACTIVITY_TIMEOUT_MS,
+      );
       if (done) break;
       buffer += decoder.decode(value, { stream: true });
       // v1.1.4 F-18 (P1 Codex audit): normalize all SSE line terminators
@@ -89,6 +112,59 @@ export async function* openEventStream({ apiKey, sessionId, signal }) {
   }
 }
 
+/**
+ * Race a ReadableStreamDefaultReader's `.read()` against an inactivity
+ * timeout. v1.1.6 F-21 (P1 Codex audit).
+ *
+ * Why this exists: a TCP-alive but byte-silent upstream (proxy with
+ * keepalive but no SSE heartbeat, compromised endpoint, slowloris-style
+ * stall) can leave `reader.read()` pending forever, freezing Shield's
+ * event loop. Bounding the wait surfaces the stall as an error so
+ * `streamWithReconnect` initiates a fresh connection.
+ *
+ * Exported so the unit tests can hit it directly with a mock reader
+ * that never resolves.
+ *
+ * @param {ReadableStreamDefaultReader} reader
+ * @param {number} timeoutMs
+ * @returns {Promise<{ done: boolean, value?: Uint8Array }>}
+ */
+export async function readWithInactivityTimeout(reader, timeoutMs) {
+  // We deliberately avoid Promise.race here: racing two pending promises
+  // leaves the loser in a perpetual pending state, which Node's test
+  // runner (rightly) flags as a resource leak. Instead we use the
+  // Web Streams contract — `reader.cancel()` settles a pending read()
+  // to `{ done: true }` — and a simple flag to distinguish the cancel
+  // we issued from a legitimate end-of-stream.
+  let timedOut = false;
+  const timeoutId = setTimeout(() => {
+    timedOut = true;
+    // Cancel resolves the pending read() promise. We swallow any
+    // rejection from cancel (some readers throw on already-cancelled
+    // state) because the relevant error is the timeout itself.
+    Promise.resolve(reader.cancel(new Error('SSE inactivity timeout')))
+      .catch(() => undefined);
+  }, timeoutMs);
+  // NOTE: we deliberately do NOT call timeoutId.unref() here. The
+  // unref() would make the timer non-blocking for the event loop, but
+  // for a Web Stream backed by no actual I/O (e.g. unit tests, in-memory
+  // sources) Node may then consider the loop empty and never fire the
+  // timer at all — the call hangs forever. Since the timer is short-
+  // lived (single-shot, cleared on the success path), keeping it ref'd
+  // is harmless even in long-running daemons.
+  try {
+    const result = await reader.read();
+    if (timedOut) {
+      throw new Error(
+        `SSE stream stalled — no data received for ${timeoutMs}ms (caller should reconnect)`,
+      );
+    }
+    return result;
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
+
 function parseFrame(frame) {
   // Concatenate all `data:` lines per the SSE spec (multi-line payload).
   const parts = [];