watchmyagents 1.2.0 → 1.2.1

package/SECURITY.md

@@ -81,7 +81,7 @@ WMA combines **two complementary layers**:
 ### What WMA does NOT defend against
 
 - **A compromised host.** If an attacker has read access to your user account, they can read the log files. Consider encryption at rest (filesystem-level, or future opt-in via `age`) for sensitive environments.
-- **Tampering with local logs.** Files are append-only by convention, not enforced. A future release will add a per-line hash chain for tamper-evident audit.
+- **Tampering with local logs (full coverage).** As of v1.2.0, `shield_decision` rows carry a SHA-256 hash chain (`prev_hash` + `chain_hash`) — `verifyDecisionChain()` detects in-place modification, mid-chain deletion, and insertion. This is **local tamper-evidence**, not tamper-proof: (a) tail truncation (removing the most recent rows) is invisible to an append-only chain, and (b) an attacker with the Shield binary can mint a fresh chain from scratch by re-executing. Both gaps are closed by Fortress-side append-only ingest (planned). Watch's non-decision rows (tool_use, etc.) remain append-only-by-convention and are NOT chained.
 - **Shield being killed.** Shield is an external process. If killed, the agent runs without enforcement until Shield restarts. Run under a process supervisor (systemd, pm2, docker `restart: always`) in production.
 - **Pre-installation activity.** Shield only enforces from the moment it attaches forward. Past events are not retroactively replayed or re-evaluated.
 - **A malicious policy file.** Shield's policy engine refuses obviously unsafe regex patterns (e.g. catastrophic backtracking) and truncates inputs before regex tests to mitigate ReDoS. But a user-controlled policy file remains a code-adjacent input — treat it as you would treat sourcecode.

package/examples/policies/mitre-starter.json

@@ -0,0 +1,133 @@
+{
+  "_comment_doc": "WatchMyAgents starter policy bundle — MITRE ATT&CK + ATLAS coverage. Tune to your environment before promoting from mode=shadow → mode=enforce. See docs/MITRE-ATTCK-COVERAGE.md for technique mapping. Every policy ships in shadow mode so the first run only LOGS would-be decisions without blocking — calibrate, then promote.",
+  "_comment_lifecycle": "Lifecycle: observe → shadow → enforce → retired. Per [[project_recursive_fractal_loop]], shadow is the calibration bench (Platt scaling + diff-in-diff efficacy). Promote a rule to mode=enforce only after you've seen enough shadow decisions to be confident the rule isn't false-positiving on your workload.",
+  "_comment_uses": "Uses v1.2.0+ DSL extensions (gt, in_range, length_gt) and ctx.* namespace (hour_of_day_utc, recent_error_rate, event_count_recent). Falls back gracefully on v1.1.x where unknown operators / ctx paths fail-closed (no false-allow).",
+
+  "policies": [
+    {
+      "id": "mitre-t1567-exfil-large-post",
+      "name": "T1567 Exfiltration Over Web Service — large outbound POST",
+      "action": "deny",
+      "mode": "shadow",
+      "message": "MITRE T1567: outbound POST exceeds 1MB threshold. Likely exfil channel.",
+      "match": {
+        "action_type": "tool_use",
+        "tool_name": { "in": ["web_fetch", "http_post"] },
+        "input.method": "POST",
+        "input.bytes": { "gt": 1000000 }
+      }
+    },
+
+    {
+      "id": "mitre-t1041-c2-host-allowlist",
+      "name": "T1041 Exfiltration Over C2 Channel — host allowlist",
+      "action": "deny",
+      "mode": "shadow",
+      "message": "MITRE T1041: outbound to non-allowlisted host. Replace the regex with your trusted egress hosts.",
+      "match": {
+        "action_type": "tool_use",
+        "tool_name": { "in": ["web_fetch", "http_post"] },
+        "input.url": { "not_regex": "^https://(api\\.openai\\.com|api\\.anthropic\\.com|github\\.com|api\\.github\\.com|raw\\.githubusercontent\\.com|wikipedia\\.org|en\\.wikipedia\\.org)(/|$|:[0-9]+)" }
+      }
+    },
+
+    {
+      "id": "mitre-t1485-data-destruction",
+      "name": "T1485 Data Destruction — destructive shell patterns",
+      "action": "deny",
+      "mode": "shadow",
+      "message": "MITRE T1485: destructive shell pattern (rm -rf / mkfs / dd if=).",
+      "match": {
+        "tool_name": "bash",
+        "input.command": { "regex": "(^|\\s|;|&&|\\|\\|)(rm\\s+-rf\\s|mkfs[. ]|dd\\s+if=)" }
+      }
+    },
+
+    {
+      "id": "mitre-t1548-privilege-escalation",
+      "name": "T1548 Abuse Elevation Control — sudo / pkexec / doas",
+      "action": "interrupt",
+      "mode": "shadow",
+      "message": "MITRE T1548: privilege-escalation attempt via sudo / pkexec / doas.",
+      "match": {
+        "tool_name": "bash",
+        "input.command": { "regex": "(^|\\s|;|&&|\\|\\|)(sudo|pkexec|doas)\\s" }
+      }
+    },
+
+    {
+      "id": "mitre-t1059-bash-command-length",
+      "name": "T1059 Command and Scripting Interpreter — improbably long command",
+      "action": "deny",
+      "mode": "shadow",
+      "message": "MITRE T1059: bash command exceeds 2KB — likely a base64-encoded payload or pipeline obfuscation.",
+      "match": {
+        "tool_name": "bash",
+        "input.command": { "length_gt": 2048 }
+      }
+    },
+
+    {
+      "id": "mitre-t1083-after-hours-discovery",
+      "name": "T1083 File and Directory Discovery — outside business hours (late)",
+      "action": "interrupt",
+      "mode": "shadow",
+      "message": "MITRE T1083: file discovery between 22:00 and 23:59 UTC. Tune for your business hours.",
+      "match": {
+        "tool_name": { "in": ["bash", "file_list"] },
+        "ctx.hour_of_day_utc": { "in_range": [22, 23] }
+      }
+    },
+
+    {
+      "id": "mitre-t1083-after-hours-discovery-early",
+      "name": "T1083 File and Directory Discovery — outside business hours (early)",
+      "action": "interrupt",
+      "mode": "shadow",
+      "message": "MITRE T1083: file discovery between 00:00 and 06:59 UTC. Tune for your business hours.",
+      "match": {
+        "tool_name": { "in": ["bash", "file_list"] },
+        "ctx.hour_of_day_utc": { "in_range": [0, 6] }
+      }
+    },
+
+    {
+      "id": "mitre-t1020-flailing-agent-throttle",
+      "name": "T1020 Automated Exfiltration — throttle flailing agent (high error rate)",
+      "action": "interrupt",
+      "mode": "shadow",
+      "message": "MITRE T1020: agent recent_error_rate > 0.5 across last >= 4 events — likely a runaway loop or retry storm.",
+      "match": {
+        "action_type": "tool_use",
+        "ctx.recent_error_rate": { "gt": 0.5 },
+        "ctx.event_count_recent": { "gte": 4 }
+      }
+    },
+
+    {
+      "id": "mitre-t1053-cron-persistence",
+      "name": "T1053 Scheduled Task/Job — cron / launchd persistence",
+      "action": "deny",
+      "mode": "shadow",
+      "message": "MITRE T1053: agent attempted to write a persistent task. Possible C2 persistence.",
+      "match": {
+        "tool_name": { "in": ["bash", "file_write"] },
+        "input.path": { "regex": "(crontab|/etc/cron\\.[a-z]+/|\\.crontab|/Library/LaunchAgents/|/Library/LaunchDaemons/|\\.service$|/etc/systemd/system/)" }
+      }
+    },
+
+    {
+      "id": "mitre-t1552-credential-store-read",
+      "name": "T1552 Unsecured Credentials — read of well-known credential store",
+      "action": "deny",
+      "mode": "shadow",
+      "message": "MITRE T1552: agent attempted to read a credential store. Tighten the path regex for your environment.",
+      "match": {
+        "tool_name": { "in": ["bash", "file_read"] },
+        "input.path": { "regex": "(/\\.aws/credentials|/\\.aws/config|/\\.ssh/id_[a-z]+|/\\.netrc|Library/Keychains|/etc/shadow)" }
+      }
+    }
+  ],
+
+  "default": { "action": "allow" }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmyagents",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Security observability + real-time policy enforcement for AI agents. Local-first NDJSON capture with a continuous Watch daemon that auto-uploads anonymized signals, Shield CLI that blocks policy violations live (with policies pulled from Fortress cloud), anonymizer producing signals-only payloads, bidirectional sync with WatchMyAgents Fortress, and one-command install as an always-on launchd/systemd service — closing the recursive Watch→Guardian→Shield security loop.",
   "type": "module",
   "files": [
@@ -12,6 +12,7 @@
     "scripts/upload-fortress.js",
     "scripts/service.js",
     "scripts/agents.js",
+    "examples/policies/",
     "README.md",
     "SECURITY.md",
     "LICENSE"

package/scripts/shield.js

@@ -203,18 +203,35 @@ async function runSessionWorker({ sessionId, ctx }) {
     })) {
       processed++;
 
+      // v1.2.1 F-26 (P1 Codex audit on v1.2.0): record EVERY event
+      // flowing through Shield, not just the cacheable tool_use ones.
+      // The previous wiring only called record() inside the cacheable
+      // branches, so events that DO carry the is_error / error / content
+      // tool_result markers (which arrive as a DIFFERENT event type
+      // from the upstream tool_use) never reached the tracker. Result
+      // in production: ctx.recent_error_rate stayed pinned at 0 even
+      // when the agent's tools were failing constantly, making the
+      // "throttle a flailing agent" policy class effectively a no-op.
+      //
+      // Implementation note: try/finally guarantees record() runs even
+      // when the cacheable branches `continue;` out mid-iteration. The
+      // finally executes BEFORE the continue takes effect (JS spec), so
+      // the compute() calls below — which must see PRIOR history only —
+      // still observe the correct window.
+      try {
+
       // ── INTERRUPT MODE ──────────────────────────────────────────────
       if (mode === 'interrupt' && CACHEABLE_TOOL_TYPES.has(rawEvent.type)) {
         // No caching in interrupt mode — react synchronously, free memory.
         const normalized = normalizeForPolicy(rawEvent);
         // v1.2.0 — compute policy context BEFORE evaluate so rules see
-        // PRIOR history (recent_error_rate, agent_age_minutes, …), then
-        // record AFTER so the next event sees this one in its window.
+        // PRIOR history (recent_error_rate, agent_age_minutes, …). The
+        // finally at the end of this iteration records the event so the
+        // NEXT iteration sees this one in its window.
         const policyCtx = policyTracker.compute(rawEvent);
         const t0 = Date.now();
         const result = evaluate(normalized, ctx.ruleset, policyCtx);
         const decidedInMs = Date.now() - t0;
-        policyTracker.record(rawEvent);
 
         // v1.1.3 Phase 1.D — mode badge in the log line for operator visibility.
         const modeTag = result.mode === 'shadow' ? ' [SHADOW]' : '';
@@ -282,12 +299,14 @@ async function runSessionWorker({ sessionId, ctx }) {
 
           const normalized = normalizeForPolicy(sourceEvent);
           // v1.2.0 — see interrupt-mode block above for the compute /
-          // record ordering rationale.
+          // record ordering rationale. sourceEvent here was the original
+          // tool_use rawEvent at an earlier loop iteration, and was
+          // recorded by THAT iteration's finally — so compute() correctly
+          // sees it as PRIOR history, not as the current event.
           const policyCtx = policyTracker.compute(sourceEvent);
           const t0 = Date.now();
           const result = evaluate(normalized, ctx.ruleset, policyCtx);
           const decidedInMs = Date.now() - t0;
-          policyTracker.record(sourceEvent);
 
           // v1.1.3 Phase 1.D — mode badge in the log line for operator visibility.
           const modeTag = result.mode === 'shadow' ? ' [SHADOW]' : '';
@@ -350,6 +369,21 @@ async function runSessionWorker({ sessionId, ctx }) {
         sinfo(sessionId, `session terminated: ${rawEvent.stop_reason?.type || 'unknown'}`);
         break;
       }
+
+      } finally {
+        // v1.2.1 F-26: record EVERY event into the policy tracker so
+        // recent_error_rate reflects real tool failures (which arrive
+        // as tool_result events carrying is_error: true, NOT as the
+        // upstream tool_use events). defaultIsError() inside the
+        // tracker handles the is_error / error / content[].is_error /
+        // type-contains-'error' shapes — see src/shield/context.js.
+        //
+        // Order: every compute() call above happens BEFORE this
+        // record() (JS guarantees finally runs after try-body but
+        // before continue/break take effect), so the "PRIOR history"
+        // contract of recent_error_rate is preserved.
+        policyTracker.record(rawEvent);
+      }
     }
   } catch (e) {
     if (!signal.aborted) {