watchmyagents 1.3.0 → 1.4.0

package/docs/adapters/openai-agents-js.md

@@ -196,7 +196,7 @@ Tool arguments and results stay LOCAL. The anonymizer converts WMAAction → sig
 
 - Node.js: **20+** (matches the WMA SDK baseline and `@openai/agents`'s requirement)
 - TypeScript: any version — types live in `src/sources/openai-agents-js.d.ts`
-- `@openai/agents` version range: tested against `^x.y` (verified in CI against the version pinned in our integration fixtures — see `test/fixtures/openai-agents-events/README.md`)
+- `@openai/agents` version range: **`^0.2.0`** (declared in `package.json#peerDependencies`). Real fixtures in `test/fixtures/openai-agents-events/` were captured against 0.2.x and the adapter's lifecycle event signatures match that line. Older 0.1.x lacked AgentHooks ergonomics the adapter relies on.
 
 ## Limits + known gaps (v1.3.0)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmyagents",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Security observability + real-time policy enforcement for AI agents. Local-first NDJSON capture with a continuous Watch daemon that auto-uploads anonymized signals, Shield CLI that blocks policy violations live (with policies pulled from Fortress cloud), anonymizer producing signals-only payloads, bidirectional sync with WatchMyAgents Fortress, and one-command install as an always-on launchd/systemd service — closing the recursive Watch→Guardian→Shield security loop.",
   "type": "module",
   "files": [
@@ -19,6 +19,14 @@
     "SECURITY.md",
     "LICENSE"
   ],
+  "exports": {
+    ".": "./src/index.js",
+    "./openai-agents": {
+      "types": "./src/sources/openai-agents-js.d.ts",
+      "default": "./src/openai-agents.js"
+    },
+    "./package.json": "./package.json"
+  },
   "bin": {
     "wma-inspect": "scripts/inspect.js",
     "wma-fetch": "scripts/fetch-anthropic.js",

package/src/anonymizer.js

@@ -156,17 +156,65 @@ export function normalizeToolInput(rawInput, aliases = {}) {
 // programmatically reference the contract.
 export { HASHABLE_INPUT_FIELDS };
 
+// ── Heuristic field-name patterns (v1.3.1 F-30 Codex audit on v1.3.0) ───
+//
+// HASHABLE_INPUT_FIELDS is the canonical set; adapter authors are also
+// encouraged to call `normalizeToolInput()` to map their native names.
+// But OpenAI Agents SDK customers define their own tool argument names
+// (`endpoint_url`, `shell_cmd`, `requestUrl`, …) and rarely think to
+// register aliases. The result before v1.3.1: those fields silently
+// disappeared from Fortress signals — not a leak (the raw payload stays
+// LOCAL), but a detection blind spot.
+//
+// This heuristic catches the long tail. For each non-canonical input
+// field, if its NAME matches a common suffix/word pattern, hash its
+// value as if it were the corresponding canonical field. Conservative
+// by design: regex anchored to word/suffix boundaries (`_url` matches,
+// `urlsafe` does NOT) so we err toward false positives (hashing a
+// harmless field is fine) over false negatives (missing a sensitive
+// field is the bug we're fixing).
+//
+// Add new patterns here when adapters surface new common names.
+const HEURISTIC_FIELD_PATTERNS = Object.freeze({
+  url:     /(?:^|[_-])(?:url|uri|endpoint|webhook|address)$/i,
+  command: /(?:^|[_-])(?:cmd|command|shell|exec|script)$/i,
+  path:    /(?:^|[_-])(?:path|file|filename|filepath|dir|folder)$/i,
+  query:   /(?:^|[_-])(?:query|search|q|prompt|term)$/i,
+});
+
+function fieldMatchesCanonicalByHeuristic(fieldName, canonical) {
+  const pat = HEURISTIC_FIELD_PATTERNS[canonical];
+  return pat ? pat.test(fieldName) : false;
+}
+
 // ── Single-entry extractor: what hashable IoCs are in this entry? ────────
 
 function extractIocs(entry, salt) {
   const out = [];
   if (!entry.input || typeof entry.input !== 'object') return out;
+
+  // Exact canonical match (original v1.0+ behavior — backwards compat).
   for (const field of HASHABLE_INPUT_FIELDS) {
     const v = entry.input[field];
     if (typeof v === 'string' && v.length > 0) {
       out.push(hashWithSalt(v, salt));
     }
   }
+
+  // v1.3.1 F-30 — heuristic suffix matching for non-canonical field
+  // names common to OpenAI Agents SDK / LangGraph / CrewAI tools. Skip
+  // fields already handled above so we never double-hash.
+  for (const [key, v] of Object.entries(entry.input)) {
+    if (HASHABLE_INPUT_FIELDS.includes(key)) continue;
+    if (typeof v !== 'string' || v.length === 0) continue;
+    for (const canonical of HASHABLE_INPUT_FIELDS) {
+      if (fieldMatchesCanonicalByHeuristic(key, canonical)) {
+        out.push(hashWithSalt(v, salt));
+        break; // one canonical bucket per field — first match wins
+      }
+    }
+  }
+
   return out;
 }
 

package/src/index.js

@@ -0,0 +1,52 @@
+// WatchMyAgents — main entry point (v1.4 Codex #10).
+//
+// `import { ... } from 'watchmyagents'` resolves here via the package.json
+// `exports['.']` field. For adapter-specific imports (the recommended
+// path for v1.4+), use the sub-entries:
+//
+//   import { openaiAgents } from 'watchmyagents/openai-agents';
+//
+// This root entry exposes the most stable cross-adapter primitives:
+//   - the source-adapter contract (PROVIDERS, ACTION_TYPES, COMPOSITION_PATTERNS,
+//     ENFORCEMENT_MODES, validateWMAAction)
+//   - the policy engine + context tracker + decision chain that EVERY
+//     adapter shares
+//   - the Logger
+//
+// Internal modules (`src/sources/openai-agents-js.js`,
+// `src/shield/*.js`, etc.) remain accessible to advanced consumers via
+// deep imports, but those paths are NOT part of the stable surface;
+// they may move between minor releases. Stick to the sub-entries and
+// this root export for production code.
+
+// ── Source-adapter contract ─────────────────────────────────────────
+export {
+  PROVIDERS,
+  ACTION_TYPES,
+  STATUS_VALUES,
+  ENFORCEMENT_MODES,
+  COMPOSITION_PATTERNS,
+  validateWMAAction,
+} from './sources/contract.js';
+
+// ── Shield engine (policy eval + context + audit chain) ─────────────
+export {
+  evaluate,
+  matchesPolicy,
+  loadPolicies,
+} from './shield/policy.js';
+
+export { createContextTracker, defaultIsError } from './shield/context.js';
+
+export {
+  createDecisionChain,
+  verifyDecisionChain,
+  buildGenesisMarker,
+  newChainId,
+  CHAIN_FIELDS,
+} from './shield/decision-chain.js';
+
+export { DecisionLogger } from './shield/decisions.js';
+
+// ── Logger ──────────────────────────────────────────────────────────
+export { Logger } from './logger.js';

package/src/openai-agents.js

@@ -0,0 +1,202 @@
+// Public entry point for the OpenAI Agents SDK adapter (v1.4 Codex #1).
+//
+// Customers import the SDK like this:
+//
+//   import { openaiAgents } from 'watchmyagents/openai-agents';
+//
+//   const wma = openaiAgents({
+//     policiesPath: './policies.json',
+//     logDir: './watchmyagents-logs',
+//     mode: 'enforce',  // 'observe' | 'enforce' (default 'enforce')
+//     toolInputs: {
+//       fetch_url: { endpoint_url: 'url' },     // per-tool aliases
+//       shell:     { shell_cmd: 'command' },
+//     },
+//   });
+//
+//   const agent = new Agent({
+//     name: 'support_bot',
+//     tools,
+//     toolInputGuardrails: [wma.shield()],   // ← Shield
+//   });
+//
+//   wma.watch(agent);   // ← Watch (auto-detects Agent vs Runner)
+//   // or:
+//   wma.watch(runner);
+//
+//   await run(agent, 'help me');
+//
+// Why a factory: it lets the customer configure once (policy path,
+// log dir, mode, tool input aliases) and get back a small object with
+// `shield()` and `watch()` methods that share that config. The pre-v1.4
+// pattern asked customers to import deep paths (
+// `watchmyagents/src/sources/openai-agents-js.js`) and pass options to
+// each call — fragile and verbose. This entry point is the stable
+// surface; the internal module stays free to refactor.
+
+import {
+  wmaToolInputGuardrail,
+  attachWmaWatch,
+  attachWmaWatchToAgent,
+  adapterMeta,
+} from './sources/openai-agents-js.js';
+
+/**
+ * Build the WMA OpenAI Agents SDK adapter from a single shared config.
+ *
+ * @param {object} [options]
+ * @param {string} [options.policiesPath]      Local JSON policy file.
+ * @param {object} [options.ruleset]           In-memory ruleset.
+ * @param {string} [options.logDir]            NDJSON log dir.
+ * @param {'observe'|'enforce'} [options.mode] v1.4 Codex #2 — explicit
+ *                                             mode. `enforce` requires
+ *                                             a policy source; `observe`
+ *                                             attaches Watch only and
+ *                                             refuses to issue a Shield
+ *                                             (calling `.shield()` throws
+ *                                             so it's impossible to ship
+ *                                             a build that looks armed
+ *                                             but isn't).
+ * @param {object<string, object>} [options.toolInputs]
+ *   v1.4 Codex #4 — per-tool argument aliases. Maps tool_name →
+ *   { nativeFieldName: canonicalFieldName }. Applied alongside the
+ *   F-30 heuristic so customers with off-canonical arg names get
+ *   exact hashing without relying on the suffix heuristic.
+ * @param {boolean} [options.failOpen]         Default false (closed).
+ * @param {number} [options.maxArgBytes]       Default 256 KB.
+ * @param {number} [options.maxResultBytes]    Default 256 KB.
+ * @param {object} [options.tracker]           Inject ContextTracker.
+ * @param {object} [options.logger]            Inject Logger.
+ * @param {object} [options.decisionLogger]    Inject DecisionLogger.
+ * @returns {{
+ *   shield: () => object,
+ *   watch:  (target: object) => () => void,
+ *   meta:   typeof adapterMeta,
+ * }}
+ */
+export function openaiAgents(options = {}) {
+  const mode = options.mode || 'enforce';
+  if (mode !== 'observe' && mode !== 'enforce') {
+    throw new TypeError(
+      `openaiAgents: options.mode must be 'observe' or 'enforce', got '${mode}'`,
+    );
+  }
+
+  // v1.4 Codex #2 — fail-loud refusal to start in enforce mode without
+  // any policy source. Avoids the v1.3.0 footgun where missing policies
+  // silently degraded to "allow all" with only a stderr warning. The
+  // failure surfaces at config time (not on the first request) so it's
+  // impossible to deploy a build that LOOKS armed but isn't.
+  if (mode === 'enforce' && options.policiesPath == null && options.ruleset == null) {
+    throw new Error(
+      "openaiAgents({ mode: 'enforce' }) requires policiesPath or ruleset. " +
+      "Either provide one, or switch to { mode: 'observe' } if you only " +
+      "want Watch (NDJSON capture) without Shield enforcement.",
+    );
+  }
+
+  // Shared config we thread into both shield() and watch() so the
+  // customer doesn't have to repeat it.
+  const sharedOptions = {
+    policiesPath:    options.policiesPath,
+    ruleset:         options.ruleset,
+    logDir:          options.logDir,
+    sessionId:       options.sessionId,
+    failOpen:        options.failOpen,
+    recentWindowSize: options.recentWindowSize,
+    getTeamId:       options.getTeamId,
+    tracker:         options.tracker,
+    logger:          options.logger,
+    decisionLogger:  options.decisionLogger,
+    toolInputs:      options.toolInputs,
+    maxArgBytes:     options.maxArgBytes,
+    maxResultBytes:  options.maxResultBytes,
+  };
+
+  return Object.freeze({
+    /** Returns the @openai/agents Tool Input Guardrail. In `observe`
+     *  mode this throws — the customer asked for Watch-only and a
+     *  guardrail would be misleading. */
+    shield() {
+      if (mode === 'observe') {
+        throw new Error(
+          "openaiAgents({ mode: 'observe' }).shield() is not allowed. " +
+          "Observe mode does not produce Shield enforcement. " +
+          "Switch to { mode: 'enforce', policiesPath: '...' } if you want to block.",
+        );
+      }
+      return wmaToolInputGuardrail(sharedOptions);
+    },
+
+    /** Attaches Watch listeners. Auto-detects whether `target` is an
+     *  Agent (AgentHooks) or a Runner (RunHooks) by checking method
+     *  shape and known fields. Returns a detach function. */
+    watch(target) {
+      return autoAttachWatch(target, sharedOptions);
+    },
+
+    /** Adapter metadata — useful for tooling that wants to introspect
+     *  what's available (capabilities, peer-dep min version, etc.). */
+    meta: adapterMeta,
+
+    /** The configured mode, exposed for runtime introspection. */
+    mode,
+  });
+}
+
+// v1.4 Codex #7 — auto-detect Runner vs Agent and dispatch to the
+// matching attach function. The shape difference:
+//   - @openai/agents Runner has `.run(agent, input)` AND emits the
+//     RunHooks events with the agent as an explicit arg.
+//   - @openai/agents Agent has `.name`/`.instructions`/`.tools` AND
+//     emits AgentHooks events with the agent IMPLICIT (closure-
+//     captured by attachWmaWatchToAgent).
+//
+// Both expose `.on()` from the EventEmitter base. We detect the
+// runner by checking for `.run` (function) — it's the convenience the
+// Runner class exposes that Agent doesn't. As a tiebreaker we look
+// at the presence of `.tools` (Agent-only) and the absence of `.name`
+// is fine as a hint but not load-bearing.
+function autoAttachWatch(target, options) {
+  if (!target || typeof target.on !== 'function') {
+    throw new TypeError(
+      'openaiAgents().watch(target): target must expose .on(event, listener). ' +
+      'Pass an @openai/agents Runner or Agent instance.',
+    );
+  }
+  // Independent signal checks — DO NOT make `looksLikeRunner` exclusive
+  // of `looksLikeAgent`. The whole point of the ambiguity check below
+  // is to catch targets that satisfy both shapes.
+  const hasRunMethod = typeof target.run === 'function';
+  const hasAgentShape = Array.isArray(target.tools) && typeof target.name === 'string';
+
+  if (hasRunMethod && hasAgentShape) {
+    throw new TypeError(
+      'openaiAgents().watch(target): target looks like both Agent and Runner ' +
+      '(has .tools[] AND .name AND .run() method). Disambiguate by calling ' +
+      'attachWmaWatch(runner) or attachWmaWatchToAgent(agent) directly.',
+    );
+  }
+  if (hasAgentShape) {
+    return attachWmaWatchToAgent(target, options);
+  }
+  if (hasRunMethod) {
+    return attachWmaWatch(target, options);
+  }
+  // Neither shape unambiguously identified — fall back to AgentHooks
+  // since the convenience `run(agent, ...)` function dispatches
+  // AgentHooks, which is the more common path for new customers
+  // (validated against real fixtures captured 2026-06-10).
+  return attachWmaWatchToAgent(target, options);
+}
+
+// Re-export the low-level functions so customers that need fine-grained
+// control (e.g. test scaffolding, advanced multi-runner setups) can
+// still reach them. The factory is the recommended entry point; these
+// are the escape hatches.
+export {
+  wmaToolInputGuardrail,
+  attachWmaWatch,
+  attachWmaWatchToAgent,
+  adapterMeta,
+};

package/src/shield/decisions.js

@@ -15,7 +15,17 @@ import { Logger } from '../logger.js';
 import { createDecisionChain, buildGenesisMarker, newChainId } from './decision-chain.js';
 
 export class DecisionLogger {
-  constructor({ logDir, agentId, sessionId }) {
+  // v1.3.1 F-29 (P1 Codex audit on v1.3.0): `provider` is now an
+  // explicit constructor option. Before v1.3.1 the provider was
+  // hard-coded to `anthropic-managed` in record() — when the OpenAI
+  // Agents SDK adapter (shipped v1.3.0) wrote shield_decision rows
+  // through this logger, those rows were mis-attributed to Anthropic.
+  // Fortress / Guardian forensic surfaces saw OpenAI blocks as
+  // Anthropic blocks. Default is preserved at `anthropic-managed` so
+  // existing v1.2.x callers behave unchanged; the OpenAI adapter
+  // explicitly passes `provider: PROVIDERS.OPENAI_AGENTS`.
+  constructor({ logDir, agentId, sessionId, provider }) {
+    this._provider = provider || 'anthropic-managed';
     // Each DecisionLogger instance owns a single chain segment. A Shield
     // restart creates a fresh DecisionLogger → fresh genesis. The
     // genesis marker is self-describing (agent + session + start time +
@@ -53,7 +63,7 @@ export class DecisionLogger {
       && (decision === 'deny' || decision === 'interrupt');
     return this._logger.write({
       action_type: 'shield_decision',
-      provider: 'anthropic-managed',
+      provider: this._provider,
       tool_name: sourceEvent?.name || sourceEvent?.tool_name || null,
       status: enforced ? 'error' : 'ok',
       error: enforced ? message : null,

package/src/sources/openai-agents-js.js

@@ -55,6 +55,7 @@ import { evaluate, loadPolicies } from '../shield/policy.js';
 import { createContextTracker } from '../shield/context.js';
 import { DecisionLogger } from '../shield/decisions.js';
 import { Logger } from '../logger.js';
+import { normalizeToolInput } from '../anonymizer.js';
 
 // ── Constants ──────────────────────────────────────────────────────────
 
@@ -65,6 +66,18 @@ const PROVIDER = PROVIDERS.OPENAI_AGENTS;
 // the customer must opt into explicitly, with all the implications.
 const DEFAULT_FAIL_OPEN = false;
 
+// v1.4 F-32 (P2 Codex audit on v1.3.0): bound the bytes we accept on
+// the hot path. A misbehaving tool, a model hallucinating a huge
+// response, or a malicious customer-controlled fixture can otherwise
+// pin CPU on JSON.parse, blow up the NDJSON line, or fill the disk.
+// 256 KB is generous for legitimate tool inputs/outputs (real-world
+// captures from the Guardian agent peak at < 2 KB) and well under what
+// would degrade Watch / Shield. Customers with outlier traffic can
+// override per-guardrail via options.maxArgBytes / options.maxResultBytes.
+const DEFAULT_MAX_ARG_BYTES = 256 * 1024;
+const DEFAULT_MAX_RESULT_BYTES = 256 * 1024;
+const TRUNCATION_SENTINEL = '…[truncated by WMA Shield]';
+
 // Mirror of '@openai/agents' value object factory. Replicated here so we
 // don't take a runtime dep. If '@openai/agents' ever changes the shape
 // (extreme low probability), fixture tests will catch it.
@@ -95,10 +108,44 @@ function readEnv(key, fallback) {
 // as a JSON string; some custom tool implementations pass them through
 // already-parsed. Fail-closed: if we can't parse, return null and let
 // the policy match against {} (which fails any specific clause).
-function safeParseToolArgs(rawArgs) {
+//
+// v1.4 F-32 — cap the input bytes before JSON.parse. Beyond the cap
+// the input is truncated with a sentinel and a parsed shape that
+// preserves the field structure as much as possible (try-parse the
+// truncated text, fall back to `{ _wmaTruncated: true, original_bytes }`).
+// Policies that match on tool_name still work; policies that match on
+// argument values silently miss the truncated suffix — which is the
+// correct fail-closed behavior for an oversize input.
+function safeParseToolArgs(rawArgs, maxBytes = DEFAULT_MAX_ARG_BYTES) {
   if (rawArgs == null) return null;
-  if (typeof rawArgs === 'object') return rawArgs;
+  if (typeof rawArgs === 'object') {
+    // Already parsed by the SDK or the customer. We don't deep-walk
+    // and truncate — that would silently change policy match semantics
+    // on nested fields. Defer the decision to the caller; the size cap
+    // applies at the string-parse boundary, which is the realistic
+    // SDK entry point.
+    return rawArgs;
+  }
   if (typeof rawArgs !== 'string') return null;
+  // Byte cap: Buffer.byteLength is the safe length on the wire.
+  const byteLen = Buffer.byteLength(rawArgs, 'utf8');
+  if (byteLen > maxBytes) {
+    // Truncate to maxBytes worth of bytes (substring is char-bounded;
+    // good enough — exact byte truncation isn't required since we mark
+    // the result as truncated and never feed it back to a real tool).
+    const head = rawArgs.slice(0, maxBytes);
+    try {
+      const parsed = JSON.parse(head);
+      // If by luck the head is valid JSON, return it plus the marker.
+      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+        return { ...parsed, _wmaTruncated: true, _wmaOriginalBytes: byteLen };
+      }
+      return { _wmaTruncated: true, _wmaOriginalBytes: byteLen, head: parsed };
+    } catch {
+      // Common path: truncated JSON is invalid mid-tree.
+      return { _wmaTruncated: true, _wmaOriginalBytes: byteLen };
+    }
+  }
   try { return JSON.parse(rawArgs); }
   catch { return null; }
 }
@@ -110,6 +157,17 @@ function makeSessionId() {
   return `oai-${randomUUID()}`;
 }
 
+// v1.4 F-31 — short reference code minted per Shield internal error.
+// Returned to the model as `Ref: WMA-SHL-<8hex>` and logged to stderr
+// alongside the full err.message so an operator can correlate the
+// generic model-facing message to the local detailed log without
+// leaking the raw error to the model.
+function makeErrorRef() {
+  // 8 hex chars from a fresh UUID — wide enough to deconflict within
+  // a session, short enough to be readable in a tool result.
+  return `WMA-SHL-${randomUUID().replace(/-/g, '').slice(0, 8)}`;
+}
+
 // Derive a stable, monotonic event id from the SDK's tool_call id when
 // present (so deduplication after restart works), else mint a UUID.
 function makeEventId(toolCall) {
@@ -274,8 +332,18 @@ export function normalizeAgentHandoff({ fromAgent, toAgent, sessionId, teamId })
   });
 }
 
-export function normalizeToolStart({ agent, tool, toolCall, sessionId, teamId }) {
+export function normalizeToolStart({ agent, tool, toolCall, sessionId, teamId, toolInputs }) {
   const parsedArgs = safeParseToolArgs(toolCall?.arguments);
+  // v1.4 Codex #4 — per-tool argument aliases. If `toolInputs` is
+  // provided AND has an entry for this tool's name, apply the alias
+  // map via normalizeToolInput() from the anonymizer. The result
+  // populates canonical names (`url`, `query`, `command`, `path`,
+  // `file_path`) so the SignalsAggregator hashes them EXACTLY, not
+  // via the F-30 suffix heuristic (which is the opt-out safety net,
+  // not the precision path). Both layers coexist: explicit aliases
+  // win on declared fields; heuristic catches the long tail.
+  const aliases = toolInputs && tool?.name ? toolInputs[tool.name] : null;
+  const finalInput = aliases ? normalizeToolInput(parsedArgs, aliases) : parsedArgs;
   return Object.freeze({
     id: makeEventId(toolCall),
     provider: PROVIDER,
@@ -292,11 +360,44 @@ export function normalizeToolStart({ agent, tool, toolCall, sessionId, teamId })
     parent_agent_id: null,
     composition_pattern: COMPOSITION_PATTERNS.SOLO,
     team_id: teamId,
-    input: parsedArgs,
+    input: finalInput,
     output: null,
   });
 }
 
+// v1.4 F-32 — cap result bytes before writing NDJSON. Verbose tools
+// (HTML scrapers, web_fetch with full-page payloads, computer use
+// screenshots base64'd) can return arbitrary megabytes. Without a cap
+// we'd write a single ~MB-sized JSON line per call into the rotation
+// file, fill the disk, and slow every subsequent NDJSON read.
+function truncateResult(result, maxBytes = DEFAULT_MAX_RESULT_BYTES) {
+  if (typeof result === 'string') {
+    const byteLen = Buffer.byteLength(result, 'utf8');
+    if (byteLen > maxBytes) {
+      return {
+        text: result.slice(0, maxBytes) + TRUNCATION_SENTINEL,
+        _wmaTruncated: true,
+        _wmaOriginalBytes: byteLen,
+      };
+    }
+    return { text: result };
+  }
+  if (result == null) return { value: null };
+  // Object / array result: serialize, check size, truncate if needed.
+  try {
+    const serialized = JSON.stringify(result);
+    const byteLen = Buffer.byteLength(serialized, 'utf8');
+    if (byteLen > maxBytes) {
+      return {
+        value: { _wmaTruncated: true, _wmaOriginalBytes: byteLen },
+      };
+    }
+    return { value: result };
+  } catch {
+    return { value: { _wmaTruncated: true, _wmaUnserializable: true } };
+  }
+}
+
 export function normalizeToolEnd({ agent, tool, result, toolCall, sessionId, teamId }) {
   return Object.freeze({
     id: `${makeEventId(toolCall)}-end`,
@@ -315,7 +416,7 @@ export function normalizeToolEnd({ agent, tool, result, toolCall, sessionId, tea
     composition_pattern: COMPOSITION_PATTERNS.SOLO,
     team_id: teamId,
     input: null,
-    output: typeof result === 'string' ? { text: result } : { value: result },
+    output: truncateResult(result),
   });
 }
 
@@ -354,8 +455,13 @@ export function wmaToolInputGuardrail(options = {}) {
   let ruleset = options.ruleset || null;
   const tracker = options.tracker
     || createContextTracker({ recentWindowSize: options.recentWindowSize ?? 20 });
+  // v1.3.1 F-29 (P1 Codex audit): provider must be passed explicitly so
+  // shield_decision NDJSON rows carry 'openai-agents' instead of being
+  // mis-attributed to 'anthropic-managed' (DecisionLogger's pre-v1.3.1
+  // hardcoded default). Fortress / Guardian forensic surfaces depend on
+  // this for correct multi-provider attribution.
   const decisionLogger = options.decisionLogger
-    || new DecisionLogger({ logDir, agentId: 'openai-agents', sessionId });
+    || new DecisionLogger({ logDir, agentId: 'openai-agents', sessionId, provider: PROVIDER });
   const logger = options.logger
     || new Logger({ logDir, agentId: 'openai-agents', sessionId, silent: true, bestEffort: false });
 
@@ -406,6 +512,10 @@ export function wmaToolInputGuardrail(options = {}) {
           toolCall,
           sessionId,
           teamId: getTeamId(),
+          // v1.4 Codex #4 — per-tool alias map (option `toolInputs`).
+          // Threaded through so the anonymizer hashes by canonical name
+          // for tools the customer explicitly mapped.
+          toolInputs: options.toolInputs,
         });
 
         // 2. Compute policy context BEFORE evaluation so recent_error_rate
@@ -462,17 +572,39 @@ export function wmaToolInputGuardrail(options = {}) {
         // Shield internal failure (policy file unreadable, disk full on
         // log write, etc.). Default fail-CLOSED unless customer opted
         // into fail-OPEN.
+        //
+        // v1.4 F-31 (P2 Codex audit on v1.3.0): the agent must NOT see
+        // the raw err.message — it can carry local paths, policy file
+        // names, disk-mount strings, permission codes, or even fragments
+        // of the policy itself that should never reach a model context.
+        // We mint a short reference code, log the full error locally to
+        // stderr keyed by that code, and return a generic message that
+        // operators can correlate against the local log without exposing
+        // anything actionable to the model. The outputInfo (which is NOT
+        // surfaced to the model — it stays in the application's run
+        // metadata) keeps the err.message for SDK-side tracing.
+        const errorRef = makeErrorRef();
         process.stderr.write(
-          `[wma/openai-agents] guardrail error: ${err.message}\n`,
+          `[wma/openai-agents] [${errorRef}] guardrail error: ${err.message}\n`,
         );
         if (failOpen) {
           return ToolGuardrailFunctionOutputFactory.allow({
-            wma: { error: err.message, failOpenApplied: true },
+            wma: {
+              errorRef,
+              error: err.message,
+              failOpenApplied: true,
+            },
           });
         }
         return ToolGuardrailFunctionOutputFactory.rejectContent(
-          `WMA Shield error: ${err.message} (fail-closed)`,
-          { wma: { error: err.message, failOpenApplied: false } },
+          `WMA Shield internal error (fail-closed). Ref: ${errorRef}`,
+          {
+            wma: {
+              errorRef,
+              error: err.message,
+              failOpenApplied: false,
+            },
+          },
         );
       }
     },
@@ -545,6 +677,7 @@ export function attachWmaWatch(runner, options = {}) {
         const teamId = teamTracker.resolve(sessionId) || teamTracker.bootstrap(sessionId);
         const event = normalizeToolStart({
           agent, tool, toolCall: details?.toolCall, sessionId, teamId,
+          toolInputs: options.toolInputs,  // v1.4 Codex #4
         });
         await logger.write(event);
       } catch (e) {
@@ -669,6 +802,7 @@ export function attachWmaWatchToAgent(agent, options = {}) {
         const teamId = teamTracker.resolve(sessionId) || teamTracker.bootstrap(sessionId);
         const event = normalizeToolStart({
           agent, tool, toolCall: details?.toolCall, sessionId, teamId,
+          toolInputs: options.toolInputs,  // v1.4 Codex #4
         });
         await logger.write(event);
       } catch (e) {
@@ -710,7 +844,12 @@ export const adapterMeta = Object.freeze({
   compositionDefault: COMPOSITION_PATTERNS.SOLO,
   customerInstrumented: true,                // not auto-discovery
   peerPackage: '@openai/agents',
-  minPeerVersion: '0.1.0',                    // adjust after testing
+  // v1.4 F-33 — aligned with package.json#peerDependencies range
+  // `^0.2.0`. Real fixtures captured against 0.2.x verified the
+  // lifecycle event signatures in v1.3.0; minPeerVersion below that is
+  // unsupported and may show drift in args layout (the AgentHooks vs
+  // RunHooks gap that motivated the v1.3.0 finalize commit).
+  minPeerVersion: '0.2.0',
   capabilities: Object.freeze({
     watch: true,
     shield: true,