watchmyagents 1.3.0 → 1.4.1

package/README.md

@@ -287,7 +287,7 @@ export WMA_SIGNALS_SALT="..."                                 # stable per-custo
 
 wma-service install (--agent-id agent_01ABC... | --all-agents) [--interval 1m] [--with-shield]
 wma-service status
-wma-service uninstall [--with-shield]
+wma-service uninstall [--with-shield] [--purge]
 ```
 
 - macOS → **launchd** LaunchAgent · Linux → **systemd** user unit.
@@ -295,6 +295,9 @@ wma-service uninstall [--with-shield]
   runtime — **never** written into the plist/unit.
 - `--with-shield` also runs `wma-shield --policies-source fortress` always-on for
   live enforcement.
+- `uninstall` by default **leaves `~/.watchmyagents/env` on disk** so a re-install
+  keeps your snapshotted keys. Pass `--purge` to also delete the env file and the
+  whole `~/.watchmyagents` directory (including local logs).
 - Raw logs stay local (`~/.watchmyagents/logs`); only anonymized signals upload.
 
 After this, the full Watch→Guardian→Shield loop runs hands-off.

package/SECURITY.md

@@ -33,7 +33,8 @@ Hardening notes:
 - The launcher loads secrets with `while IFS='=' read -r k v` instead of `. file` / `source file`. Sourcing would shell-evaluate every value, so a value containing `$(cmd)` would execute at every restart. The literal read assigns the bytes verbatim.
 - Values are validated before write: a newline anywhere in a credential aborts the install (would corrupt the env file or inject extra lines).
 - To wipe the credential without uninstalling the service: `chmod 600 ~/.watchmyagents/env && : > ~/.watchmyagents/env` (the daemon will exit on the next missing-env check).
-- Full removal: `wma-service uninstall` deletes the unit, the launcher, the env file, and the `~/.watchmyagents` directory.
+- Service removal: `wma-service uninstall` removes the unit and the launcher but **leaves `~/.watchmyagents/env` on disk** so a re-install keeps your snapshotted keys. This is the default since v1.4.1 (F-37) and is the safer behavior — uninstalling to retry an install does not destroy your API keys.
+- Full removal incl. secrets: `wma-service uninstall --purge` removes the unit, the launcher, the env file, and the whole `~/.watchmyagents` directory (including local NDJSON logs under `~/.watchmyagents/logs`). Use this when you really want to scrub the machine.
 
 ### Local log files
 

package/docs/adapters/openai-agents-js.md

@@ -196,7 +196,7 @@ Tool arguments and results stay LOCAL. The anonymizer converts WMAAction → sig
 
 - Node.js: **20+** (matches the WMA SDK baseline and `@openai/agents`'s requirement)
 - TypeScript: any version — types live in `src/sources/openai-agents-js.d.ts`
-- `@openai/agents` version range: tested against `^x.y` (verified in CI against the version pinned in our integration fixtures — see `test/fixtures/openai-agents-events/README.md`)
+- `@openai/agents` version range: **`^0.2.0`** (declared in `package.json#peerDependencies`). Real fixtures in `test/fixtures/openai-agents-events/` were captured against 0.2.x and the adapter's lifecycle event signatures match that line. Older 0.1.x lacked AgentHooks ergonomics the adapter relies on.
 
 ## Limits + known gaps (v1.3.0)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmyagents",
-  "version": "1.3.0",
+  "version": "1.4.1",
   "description": "Security observability + real-time policy enforcement for AI agents. Local-first NDJSON capture with a continuous Watch daemon that auto-uploads anonymized signals, Shield CLI that blocks policy violations live (with policies pulled from Fortress cloud), anonymizer producing signals-only payloads, bidirectional sync with WatchMyAgents Fortress, and one-command install as an always-on launchd/systemd service — closing the recursive Watch→Guardian→Shield security loop.",
   "type": "module",
   "files": [
@@ -19,6 +19,14 @@
     "SECURITY.md",
     "LICENSE"
   ],
+  "exports": {
+    ".": "./src/index.js",
+    "./openai-agents": {
+      "types": "./src/sources/openai-agents-js.d.ts",
+      "default": "./src/openai-agents.js"
+    },
+    "./package.json": "./package.json"
+  },
   "bin": {
     "wma-inspect": "scripts/inspect.js",
     "wma-fetch": "scripts/fetch-anthropic.js",

package/scripts/fetch-anthropic.js

@@ -25,7 +25,7 @@ import { createInterface } from 'node:readline';
 import { join, resolve } from 'node:path';
 import { request as httpsRequest } from 'node:https';
 import { URL } from 'node:url';
-import { Logger } from '../src/logger.js';
+import { Logger, tightenMode } from '../src/logger.js';
 import { TokenTracker } from '../src/tokens.js';
 import { SignalsAggregator } from '../src/anonymizer.js';
 import { resolveFortressBase, fortressEndpoint } from '../src/fortress/url.js';
@@ -321,10 +321,26 @@ async function fetchOneShot({ apiKey, agentId, model, logDir, since, sessionId,
     process.stdout.write(`\n[wma-fetch] session ${sid}\n`);
     if (dumpRaw) {
       assertSafePathSegment(sid, 'session-id'); // defense-in-depth: sid → file path
-      const rawPath = join(logDir, agentId, `raw-${sid}.jsonl`);
-      await mkdir(join(logDir, agentId), { recursive: true, mode: 0o700 });
+      const rawDir = join(logDir, agentId);
+      const rawPath = join(rawDir, `raw-${sid}.jsonl`);
+      await mkdir(rawDir, { recursive: true, mode: 0o700 });
+      // v1.4.1 F-34 (P2 Codex audit): mkdir/appendFile `mode` is creation-
+      // only. If a previous `wma-fetch` run, a different user, or a hand-
+      // rolled mkdir left the directory or file in place with loose perms
+      // (typically 0755/0644 via umask), the original code path kept them.
+      // The raw JSONL carries unredacted API events, so loose perms make
+      // them readable to any local user. Tighten after the directory and
+      // after the first append so an existing inode is brought in line
+      // with the doc promise (0700/0600). Best-effort: chmod failures
+      // here MUST NOT break wma-fetch.
+      await tightenMode(rawDir, 0o700);
+      let firstAppend = true;
       for await (const ev of fetchRawEvents(apiKey, sid)) {
         await appendFile(rawPath, JSON.stringify(ev) + '\n', { encoding: 'utf8', mode: 0o600 });
+        if (firstAppend) {
+          await tightenMode(rawPath, 0o600);
+          firstAppend = false;
+        }
       }
       process.stdout.write(`  raw events  → ${rawPath}\n`);
     }

package/scripts/service.js

@@ -11,7 +11,14 @@
 // One integrated install:
 //   wma-service install --agent-id agent_xxx [--interval 5m] [--with-shield]
 //   wma-service status
-//   wma-service uninstall [--with-shield]
+//   wma-service uninstall [--with-shield] [--purge]
+//
+// v1.4.1 F-37 (P3 Codex audit on v1.4.0): `uninstall` defaults to LEAVING
+// ~/.watchmyagents/env on disk (containing the snapshotted API keys). This
+// matches the historical behavior and protects users who uninstall just to
+// reinstall with a different agent-id from losing their snapshot. To wipe
+// the env file + config dir, pass `--purge` explicitly. SECURITY.md says
+// the same thing; do not let the doc + the code drift again.
 //
 // Secrets NEVER go in the plist/unit. They're snapshotted (from the current
 // environment) into a protected env file (~/.watchmyagents/env, chmod 600) that
@@ -289,6 +296,7 @@ function cmdInstall(args) {
 
 function cmdUninstall(args) {
   const withShield = !!args['with-shield'];
+  const purge = !!args.purge;
   if (PLATFORM === 'darwin') {
     macUnload(WATCH_LABEL);
     if (withShield) macUnload(SHIELD_LABEL);
@@ -298,7 +306,18 @@ function cmdUninstall(args) {
   } else {
     die(`unsupported platform "${PLATFORM}"`);
   }
-  info('uninstalled. (Secrets in ' + ENV_FILE + ' left intact — delete manually if you want them gone.)');
+  if (purge) {
+    // F-37: explicit opt-in only. Removes the snapshotted env file (chmod
+    // 600, contains API keys) and the whole config dir. Logs under
+    // ~/.watchmyagents/logs are wiped too — the user asked for purge, so
+    // we do not second-guess them on local NDJSON. `force: true` ensures
+    // we don't throw if the path is already gone.
+    try { rmSync(ENV_FILE, { force: true }); } catch { /* best-effort */ }
+    try { rmSync(CONFIG_DIR, { recursive: true, force: true }); } catch { /* best-effort */ }
+    info(`uninstalled + purged ${CONFIG_DIR} (env file and local logs removed).`);
+  } else {
+    info(`uninstalled. Secrets in ${ENV_FILE} left intact — re-run with --purge to wipe them.`);
+  }
 }
 
 function cmdStatus() {
@@ -328,11 +347,15 @@ function usage() {
 Usage:
   wma-service install --agent-id agent_xxx [--interval 5m] [--log-dir DIR] [--with-shield]
   wma-service status
-  wma-service uninstall [--with-shield]
+  wma-service uninstall [--with-shield] [--purge]
 
 Required env at install (snapshotted to ~/.watchmyagents/env, chmod 600):
   ANTHROPIC_API_KEY, WMA_API_KEY, WMA_FORTRESS_BASE_URL, WMA_SIGNALS_SALT
 
+Uninstall by default leaves ~/.watchmyagents/env on disk so a re-install
+keeps your snapshotted keys. Pass --purge to also delete the env file and
+the whole ~/.watchmyagents directory (including local logs).
+
 macOS → launchd LaunchAgent · Linux → systemd user unit.
 The service starts at login and restarts on crash. Raw logs stay local.
 `);

package/src/anonymizer.js

@@ -156,17 +156,65 @@ export function normalizeToolInput(rawInput, aliases = {}) {
 // programmatically reference the contract.
 export { HASHABLE_INPUT_FIELDS };
 
+// ── Heuristic field-name patterns (v1.3.1 F-30 Codex audit on v1.3.0) ───
+//
+// HASHABLE_INPUT_FIELDS is the canonical set; adapter authors are also
+// encouraged to call `normalizeToolInput()` to map their native names.
+// But OpenAI Agents SDK customers define their own tool argument names
+// (`endpoint_url`, `shell_cmd`, `requestUrl`, …) and rarely think to
+// register aliases. The result before v1.3.1: those fields silently
+// disappeared from Fortress signals — not a leak (the raw payload stays
+// LOCAL), but a detection blind spot.
+//
+// This heuristic catches the long tail. For each non-canonical input
+// field, if its NAME matches a common suffix/word pattern, hash its
+// value as if it were the corresponding canonical field. Conservative
+// by design: regex anchored to word/suffix boundaries (`_url` matches,
+// `urlsafe` does NOT) so we err toward false positives (hashing a
+// harmless field is fine) over false negatives (missing a sensitive
+// field is the bug we're fixing).
+//
+// Add new patterns here when adapters surface new common names.
+const HEURISTIC_FIELD_PATTERNS = Object.freeze({
+  url:     /(?:^|[_-])(?:url|uri|endpoint|webhook|address)$/i,
+  command: /(?:^|[_-])(?:cmd|command|shell|exec|script)$/i,
+  path:    /(?:^|[_-])(?:path|file|filename|filepath|dir|folder)$/i,
+  query:   /(?:^|[_-])(?:query|search|q|prompt|term)$/i,
+});
+
+function fieldMatchesCanonicalByHeuristic(fieldName, canonical) {
+  const pat = HEURISTIC_FIELD_PATTERNS[canonical];
+  return pat ? pat.test(fieldName) : false;
+}
+
 // ── Single-entry extractor: what hashable IoCs are in this entry? ────────
 
 function extractIocs(entry, salt) {
   const out = [];
   if (!entry.input || typeof entry.input !== 'object') return out;
+
+  // Exact canonical match (original v1.0+ behavior — backwards compat).
   for (const field of HASHABLE_INPUT_FIELDS) {
     const v = entry.input[field];
     if (typeof v === 'string' && v.length > 0) {
       out.push(hashWithSalt(v, salt));
     }
   }
+
+  // v1.3.1 F-30 — heuristic suffix matching for non-canonical field
+  // names common to OpenAI Agents SDK / LangGraph / CrewAI tools. Skip
+  // fields already handled above so we never double-hash.
+  for (const [key, v] of Object.entries(entry.input)) {
+    if (HASHABLE_INPUT_FIELDS.includes(key)) continue;
+    if (typeof v !== 'string' || v.length === 0) continue;
+    for (const canonical of HASHABLE_INPUT_FIELDS) {
+      if (fieldMatchesCanonicalByHeuristic(key, canonical)) {
+        out.push(hashWithSalt(v, salt));
+        break; // one canonical bucket per field — first match wins
+      }
+    }
+  }
+
   return out;
 }
 

package/src/index.js

@@ -0,0 +1,52 @@
+// WatchMyAgents — main entry point (v1.4 Codex #10).
+//
+// `import { ... } from 'watchmyagents'` resolves here via the package.json
+// `exports['.']` field. For adapter-specific imports (the recommended
+// path for v1.4+), use the sub-entries:
+//
+//   import { openaiAgents } from 'watchmyagents/openai-agents';
+//
+// This root entry exposes the most stable cross-adapter primitives:
+//   - the source-adapter contract (PROVIDERS, ACTION_TYPES, COMPOSITION_PATTERNS,
+//     ENFORCEMENT_MODES, validateWMAAction)
+//   - the policy engine + context tracker + decision chain that EVERY
+//     adapter shares
+//   - the Logger
+//
+// Internal modules (`src/sources/openai-agents-js.js`,
+// `src/shield/*.js`, etc.) remain accessible to advanced consumers via
+// deep imports, but those paths are NOT part of the stable surface;
+// they may move between minor releases. Stick to the sub-entries and
+// this root export for production code.
+
+// ── Source-adapter contract ─────────────────────────────────────────
+export {
+  PROVIDERS,
+  ACTION_TYPES,
+  STATUS_VALUES,
+  ENFORCEMENT_MODES,
+  COMPOSITION_PATTERNS,
+  validateWMAAction,
+} from './sources/contract.js';
+
+// ── Shield engine (policy eval + context + audit chain) ─────────────
+export {
+  evaluate,
+  matchesPolicy,
+  loadPolicies,
+} from './shield/policy.js';
+
+export { createContextTracker, defaultIsError } from './shield/context.js';
+
+export {
+  createDecisionChain,
+  verifyDecisionChain,
+  buildGenesisMarker,
+  newChainId,
+  CHAIN_FIELDS,
+} from './shield/decision-chain.js';
+
+export { DecisionLogger } from './shield/decisions.js';
+
+// ── Logger ──────────────────────────────────────────────────────────
+export { Logger } from './logger.js';

package/src/logger.js

@@ -16,6 +16,14 @@ async function tightenMode(path, mode) {
   try { await chmod(path, mode); } catch { /* not fatal */ }
 }
 
+// v1.4.1 F-34 (P2 Codex audit on v1.4.0): re-exported so other writers
+// of WMA-controlled log paths can defend against the same loose-perms
+// trap (mkdir/appendFile `mode` is creation-only). Used by:
+//   scripts/fetch-anthropic.js --dump-raw  (raw API events on disk)
+//   any future code path that mkdir/appendFile into a customer log dir
+// Best-effort by design — failure of chmod must NOT break log writes.
+export { tightenMode };
+
 // PR-B: `framework` → `provider` (canonical name per src/sources/contract.js).
 // PR-C: adds `parent_agent_id` + `composition_pattern` so any future
 // adapter that knows the hierarchy (OpenAI Agents handoffs, CrewAI

package/src/openai-agents.js

@@ -0,0 +1,202 @@
+// Public entry point for the OpenAI Agents SDK adapter (v1.4 Codex #1).
+//
+// Customers import the SDK like this:
+//
+//   import { openaiAgents } from 'watchmyagents/openai-agents';
+//
+//   const wma = openaiAgents({
+//     policiesPath: './policies.json',
+//     logDir: './watchmyagents-logs',
+//     mode: 'enforce',  // 'observe' | 'enforce' (default 'enforce')
+//     toolInputs: {
+//       fetch_url: { endpoint_url: 'url' },     // per-tool aliases
+//       shell:     { shell_cmd: 'command' },
+//     },
+//   });
+//
+//   const agent = new Agent({
+//     name: 'support_bot',
+//     tools,
+//     toolInputGuardrails: [wma.shield()],   // ← Shield
+//   });
+//
+//   wma.watch(agent);   // ← Watch (auto-detects Agent vs Runner)
+//   // or:
+//   wma.watch(runner);
+//
+//   await run(agent, 'help me');
+//
+// Why a factory: it lets the customer configure once (policy path,
+// log dir, mode, tool input aliases) and get back a small object with
+// `shield()` and `watch()` methods that share that config. The pre-v1.4
+// pattern asked customers to import deep paths (
+// `watchmyagents/src/sources/openai-agents-js.js`) and pass options to
+// each call — fragile and verbose. This entry point is the stable
+// surface; the internal module stays free to refactor.
+
+import {
+  wmaToolInputGuardrail,
+  attachWmaWatch,
+  attachWmaWatchToAgent,
+  adapterMeta,
+} from './sources/openai-agents-js.js';
+
+/**
+ * Build the WMA OpenAI Agents SDK adapter from a single shared config.
+ *
+ * @param {object} [options]
+ * @param {string} [options.policiesPath]      Local JSON policy file.
+ * @param {object} [options.ruleset]           In-memory ruleset.
+ * @param {string} [options.logDir]            NDJSON log dir.
+ * @param {'observe'|'enforce'} [options.mode] v1.4 Codex #2 — explicit
+ *                                             mode. `enforce` requires
+ *                                             a policy source; `observe`
+ *                                             attaches Watch only and
+ *                                             refuses to issue a Shield
+ *                                             (calling `.shield()` throws
+ *                                             so it's impossible to ship
+ *                                             a build that looks armed
+ *                                             but isn't).
+ * @param {object<string, object>} [options.toolInputs]
+ *   v1.4 Codex #4 — per-tool argument aliases. Maps tool_name →
+ *   { nativeFieldName: canonicalFieldName }. Applied alongside the
+ *   F-30 heuristic so customers with off-canonical arg names get
+ *   exact hashing without relying on the suffix heuristic.
+ * @param {boolean} [options.failOpen]         Default false (closed).
+ * @param {number} [options.maxArgBytes]       Default 256 KB.
+ * @param {number} [options.maxResultBytes]    Default 256 KB.
+ * @param {object} [options.tracker]           Inject ContextTracker.
+ * @param {object} [options.logger]            Inject Logger.
+ * @param {object} [options.decisionLogger]    Inject DecisionLogger.
+ * @returns {{
+ *   shield: () => object,
+ *   watch:  (target: object) => () => void,
+ *   meta:   typeof adapterMeta,
+ * }}
+ */
+export function openaiAgents(options = {}) {
+  const mode = options.mode || 'enforce';
+  if (mode !== 'observe' && mode !== 'enforce') {
+    throw new TypeError(
+      `openaiAgents: options.mode must be 'observe' or 'enforce', got '${mode}'`,
+    );
+  }
+
+  // v1.4 Codex #2 — fail-loud refusal to start in enforce mode without
+  // any policy source. Avoids the v1.3.0 footgun where missing policies
+  // silently degraded to "allow all" with only a stderr warning. The
+  // failure surfaces at config time (not on the first request) so it's
+  // impossible to deploy a build that LOOKS armed but isn't.
+  if (mode === 'enforce' && options.policiesPath == null && options.ruleset == null) {
+    throw new Error(
+      "openaiAgents({ mode: 'enforce' }) requires policiesPath or ruleset. " +
+      "Either provide one, or switch to { mode: 'observe' } if you only " +
+      "want Watch (NDJSON capture) without Shield enforcement.",
+    );
+  }
+
+  // Shared config we thread into both shield() and watch() so the
+  // customer doesn't have to repeat it.
+  const sharedOptions = {
+    policiesPath:    options.policiesPath,
+    ruleset:         options.ruleset,
+    logDir:          options.logDir,
+    sessionId:       options.sessionId,
+    failOpen:        options.failOpen,
+    recentWindowSize: options.recentWindowSize,
+    getTeamId:       options.getTeamId,
+    tracker:         options.tracker,
+    logger:          options.logger,
+    decisionLogger:  options.decisionLogger,
+    toolInputs:      options.toolInputs,
+    maxArgBytes:     options.maxArgBytes,
+    maxResultBytes:  options.maxResultBytes,
+  };
+
+  return Object.freeze({
+    /** Returns the @openai/agents Tool Input Guardrail. In `observe`
+     *  mode this throws — the customer asked for Watch-only and a
+     *  guardrail would be misleading. */
+    shield() {
+      if (mode === 'observe') {
+        throw new Error(
+          "openaiAgents({ mode: 'observe' }).shield() is not allowed. " +
+          "Observe mode does not produce Shield enforcement. " +
+          "Switch to { mode: 'enforce', policiesPath: '...' } if you want to block.",
+        );
+      }
+      return wmaToolInputGuardrail(sharedOptions);
+    },
+
+    /** Attaches Watch listeners. Auto-detects whether `target` is an
+     *  Agent (AgentHooks) or a Runner (RunHooks) by checking method
+     *  shape and known fields. Returns a detach function. */
+    watch(target) {
+      return autoAttachWatch(target, sharedOptions);
+    },
+
+    /** Adapter metadata — useful for tooling that wants to introspect
+     *  what's available (capabilities, peer-dep min version, etc.). */
+    meta: adapterMeta,
+
+    /** The configured mode, exposed for runtime introspection. */
+    mode,
+  });
+}
+
+// v1.4 Codex #7 — auto-detect Runner vs Agent and dispatch to the
+// matching attach function. The shape difference:
+//   - @openai/agents Runner has `.run(agent, input)` AND emits the
+//     RunHooks events with the agent as an explicit arg.
+//   - @openai/agents Agent has `.name`/`.instructions`/`.tools` AND
+//     emits AgentHooks events with the agent IMPLICIT (closure-
+//     captured by attachWmaWatchToAgent).
+//
+// Both expose `.on()` from the EventEmitter base. We detect the
+// runner by checking for `.run` (function) — it's the convenience the
+// Runner class exposes that Agent doesn't. As a tiebreaker we look
+// at the presence of `.tools` (Agent-only) and the absence of `.name`
+// is fine as a hint but not load-bearing.
+function autoAttachWatch(target, options) {
+  if (!target || typeof target.on !== 'function') {
+    throw new TypeError(
+      'openaiAgents().watch(target): target must expose .on(event, listener). ' +
+      'Pass an @openai/agents Runner or Agent instance.',
+    );
+  }
+  // Independent signal checks — DO NOT make `looksLikeRunner` exclusive
+  // of `looksLikeAgent`. The whole point of the ambiguity check below
+  // is to catch targets that satisfy both shapes.
+  const hasRunMethod = typeof target.run === 'function';
+  const hasAgentShape = Array.isArray(target.tools) && typeof target.name === 'string';
+
+  if (hasRunMethod && hasAgentShape) {
+    throw new TypeError(
+      'openaiAgents().watch(target): target looks like both Agent and Runner ' +
+      '(has .tools[] AND .name AND .run() method). Disambiguate by calling ' +
+      'attachWmaWatch(runner) or attachWmaWatchToAgent(agent) directly.',
+    );
+  }
+  if (hasAgentShape) {
+    return attachWmaWatchToAgent(target, options);
+  }
+  if (hasRunMethod) {
+    return attachWmaWatch(target, options);
+  }
+  // Neither shape unambiguously identified — fall back to AgentHooks
+  // since the convenience `run(agent, ...)` function dispatches
+  // AgentHooks, which is the more common path for new customers
+  // (validated against real fixtures captured 2026-06-10).
+  return attachWmaWatchToAgent(target, options);
+}
+
+// Re-export the low-level functions so customers that need fine-grained
+// control (e.g. test scaffolding, advanced multi-runner setups) can
+// still reach them. The factory is the recommended entry point; these
+// are the escape hatches.
+export {
+  wmaToolInputGuardrail,
+  attachWmaWatch,
+  attachWmaWatchToAgent,
+  adapterMeta,
+};

package/src/shield/decisions.js

@@ -15,7 +15,17 @@ import { Logger } from '../logger.js';
 import { createDecisionChain, buildGenesisMarker, newChainId } from './decision-chain.js';
 
 export class DecisionLogger {
-  constructor({ logDir, agentId, sessionId }) {
+  // v1.3.1 F-29 (P1 Codex audit on v1.3.0): `provider` is now an
+  // explicit constructor option. Before v1.3.1 the provider was
+  // hard-coded to `anthropic-managed` in record() — when the OpenAI
+  // Agents SDK adapter (shipped v1.3.0) wrote shield_decision rows
+  // through this logger, those rows were mis-attributed to Anthropic.
+  // Fortress / Guardian forensic surfaces saw OpenAI blocks as
+  // Anthropic blocks. Default is preserved at `anthropic-managed` so
+  // existing v1.2.x callers behave unchanged; the OpenAI adapter
+  // explicitly passes `provider: PROVIDERS.OPENAI_AGENTS`.
+  constructor({ logDir, agentId, sessionId, provider }) {
+    this._provider = provider || 'anthropic-managed';
     // Each DecisionLogger instance owns a single chain segment. A Shield
     // restart creates a fresh DecisionLogger → fresh genesis. The
     // genesis marker is self-describing (agent + session + start time +
@@ -53,7 +63,7 @@ export class DecisionLogger {
       && (decision === 'deny' || decision === 'interrupt');
     return this._logger.write({
       action_type: 'shield_decision',
-      provider: 'anthropic-managed',
+      provider: this._provider,
       tool_name: sourceEvent?.name || sourceEvent?.tool_name || null,
       status: enforced ? 'error' : 'ok',
       error: enforced ? message : null,

package/src/sources/openai-agents-js.js

@@ -55,6 +55,7 @@ import { evaluate, loadPolicies } from '../shield/policy.js';
 import { createContextTracker } from '../shield/context.js';
 import { DecisionLogger } from '../shield/decisions.js';
 import { Logger } from '../logger.js';
+import { normalizeToolInput } from '../anonymizer.js';
 
 // ── Constants ──────────────────────────────────────────────────────────
 
@@ -65,6 +66,18 @@ const PROVIDER = PROVIDERS.OPENAI_AGENTS;
 // the customer must opt into explicitly, with all the implications.
 const DEFAULT_FAIL_OPEN = false;
 
+// v1.4 F-32 (P2 Codex audit on v1.3.0): bound the bytes we accept on
+// the hot path. A misbehaving tool, a model hallucinating a huge
+// response, or a malicious customer-controlled fixture can otherwise
+// pin CPU on JSON.parse, blow up the NDJSON line, or fill the disk.
+// 256 KB is generous for legitimate tool inputs/outputs (real-world
+// captures from the Guardian agent peak at < 2 KB) and well under what
+// would degrade Watch / Shield. Customers with outlier traffic can
+// override per-guardrail via options.maxArgBytes / options.maxResultBytes.
+const DEFAULT_MAX_ARG_BYTES = 256 * 1024;
+const DEFAULT_MAX_RESULT_BYTES = 256 * 1024;
+const TRUNCATION_SENTINEL = '…[truncated by WMA Shield]';
+
 // Mirror of '@openai/agents' value object factory. Replicated here so we
 // don't take a runtime dep. If '@openai/agents' ever changes the shape
 // (extreme low probability), fixture tests will catch it.
@@ -95,10 +108,68 @@ function readEnv(key, fallback) {
 // as a JSON string; some custom tool implementations pass them through
 // already-parsed. Fail-closed: if we can't parse, return null and let
 // the policy match against {} (which fails any specific clause).
-function safeParseToolArgs(rawArgs) {
+//
+// v1.4 F-32 — cap the input bytes before JSON.parse. Beyond the cap
+// the input is truncated with a sentinel and a parsed shape that
+// preserves the field structure as much as possible (try-parse the
+// truncated text, fall back to `{ _wmaTruncated: true, original_bytes }`).
+// Policies that match on tool_name still work; policies that match on
+// argument values silently miss the truncated suffix — which is the
+// correct fail-closed behavior for an oversize input.
+// v1.4.1 F-36 (P3 Codex audit on v1.4.0): proper byte-level truncation
+// for UTF-8 strings. Pre-v1.4.1 we used `str.slice(0, maxBytes)`, which
+// slices by CHARACTERS — with multi-byte Unicode (emoji = 4 bytes per
+// char) the cap could be exceeded by up to 3x. This helper cuts on the
+// byte boundary via Buffer and strips the trailing U+FFFD replacement
+// character if the cut landed mid-sequence. We accept the dropped
+// trailing char as acceptable cost: the result is marked _wmaTruncated.
+function truncateUtf8(str, maxBytes) {
+  if (typeof str !== 'string') return str;
+  const buf = Buffer.from(str, 'utf8');
+  if (buf.length <= maxBytes) return str;
+  return buf.subarray(0, maxBytes).toString('utf8').replace(/�+$/, '');
+}
+
+function safeParseToolArgs(rawArgs, maxBytes = DEFAULT_MAX_ARG_BYTES) {
   if (rawArgs == null) return null;
-  if (typeof rawArgs === 'object') return rawArgs;
+  if (typeof rawArgs === 'object') {
+    // v1.4.1 F-36 — also cap object inputs by their serialized byte
+    // size. Pre-v1.4.1 already-parsed objects bypassed the cap entirely,
+    // which let a misbehaving tool / customer pass a 5 MB object through
+    // safeParseToolArgs unimpeded. We don't deep-walk-and-truncate (that
+    // would silently change policy match semantics on nested fields);
+    // instead we replace the whole input with a truncation marker if
+    // the serialized form exceeds maxBytes.
+    try {
+      const serialized = JSON.stringify(rawArgs);
+      const byteLen = Buffer.byteLength(serialized, 'utf8');
+      if (byteLen > maxBytes) {
+        return { _wmaTruncated: true, _wmaOriginalBytes: byteLen };
+      }
+    } catch {
+      // Unserializable input — return as-is. Policy match against
+      // anything in this object is going to fail anyway.
+    }
+    return rawArgs;
+  }
   if (typeof rawArgs !== 'string') return null;
+  // Byte cap: Buffer.byteLength is the safe length on the wire.
+  const byteLen = Buffer.byteLength(rawArgs, 'utf8');
+  if (byteLen > maxBytes) {
+    // v1.4.1 F-36 — byte-level truncation (was char-level before).
+    const head = truncateUtf8(rawArgs, maxBytes);
+    try {
+      const parsed = JSON.parse(head);
+      // If by luck the head is valid JSON, return it plus the marker.
+      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+        return { ...parsed, _wmaTruncated: true, _wmaOriginalBytes: byteLen };
+      }
+      return { _wmaTruncated: true, _wmaOriginalBytes: byteLen, head: parsed };
+    } catch {
+      // Common path: truncated JSON is invalid mid-tree.
+      return { _wmaTruncated: true, _wmaOriginalBytes: byteLen };
+    }
+  }
   try { return JSON.parse(rawArgs); }
   catch { return null; }
 }
@@ -110,6 +181,17 @@ function makeSessionId() {
   return `oai-${randomUUID()}`;
 }
 
+// v1.4 F-31 — short reference code minted per Shield internal error.
+// Returned to the model as `Ref: WMA-SHL-<8hex>` and logged to stderr
+// alongside the full err.message so an operator can correlate the
+// generic model-facing message to the local detailed log without
+// leaking the raw error to the model.
+function makeErrorRef() {
+  // 8 hex chars from a fresh UUID — wide enough to deconflict within
+  // a session, short enough to be readable in a tool result.
+  return `WMA-SHL-${randomUUID().replace(/-/g, '').slice(0, 8)}`;
+}
+
 // Derive a stable, monotonic event id from the SDK's tool_call id when
 // present (so deduplication after restart works), else mint a UUID.
 function makeEventId(toolCall) {
@@ -274,8 +356,18 @@ export function normalizeAgentHandoff({ fromAgent, toAgent, sessionId, teamId })
   });
 }
 
-export function normalizeToolStart({ agent, tool, toolCall, sessionId, teamId }) {
+export function normalizeToolStart({ agent, tool, toolCall, sessionId, teamId, toolInputs }) {
   const parsedArgs = safeParseToolArgs(toolCall?.arguments);
+  // v1.4 Codex #4 — per-tool argument aliases. If `toolInputs` is
+  // provided AND has an entry for this tool's name, apply the alias
+  // map via normalizeToolInput() from the anonymizer. The result
+  // populates canonical names (`url`, `query`, `command`, `path`,
+  // `file_path`) so the SignalsAggregator hashes them EXACTLY, not
+  // via the F-30 suffix heuristic (which is the opt-out safety net,
+  // not the precision path). Both layers coexist: explicit aliases
+  // win on declared fields; heuristic catches the long tail.
+  const aliases = toolInputs && tool?.name ? toolInputs[tool.name] : null;
+  const finalInput = aliases ? normalizeToolInput(parsedArgs, aliases) : parsedArgs;
   return Object.freeze({
     id: makeEventId(toolCall),
     provider: PROVIDER,
@@ -292,11 +384,45 @@ export function normalizeToolStart({ agent, tool, toolCall, sessionId, teamId })
     parent_agent_id: null,
     composition_pattern: COMPOSITION_PATTERNS.SOLO,
     team_id: teamId,
-    input: parsedArgs,
+    input: finalInput,
     output: null,
   });
 }
 
+// v1.4 F-32 — cap result bytes before writing NDJSON. Verbose tools
+// (HTML scrapers, web_fetch with full-page payloads, computer use
+// screenshots base64'd) can return arbitrary megabytes. Without a cap
+// we'd write a single ~MB-sized JSON line per call into the rotation
+// file, fill the disk, and slow every subsequent NDJSON read.
+function truncateResult(result, maxBytes = DEFAULT_MAX_RESULT_BYTES) {
+  if (typeof result === 'string') {
+    const byteLen = Buffer.byteLength(result, 'utf8');
+    if (byteLen > maxBytes) {
+      // v1.4.1 F-36 — byte-level truncation (was char-level before).
+      return {
+        text: truncateUtf8(result, maxBytes) + TRUNCATION_SENTINEL,
+        _wmaTruncated: true,
+        _wmaOriginalBytes: byteLen,
+      };
+    }
+    return { text: result };
+  }
+  if (result == null) return { value: null };
+  // Object / array result: serialize, check size, truncate if needed.
+  try {
+    const serialized = JSON.stringify(result);
+    const byteLen = Buffer.byteLength(serialized, 'utf8');
+    if (byteLen > maxBytes) {
+      return {
+        value: { _wmaTruncated: true, _wmaOriginalBytes: byteLen },
+      };
+    }
+    return { value: result };
+  } catch {
+    return { value: { _wmaTruncated: true, _wmaUnserializable: true } };
+  }
+}
+
 export function normalizeToolEnd({ agent, tool, result, toolCall, sessionId, teamId }) {
   return Object.freeze({
     id: `${makeEventId(toolCall)}-end`,
@@ -315,7 +441,7 @@ export function normalizeToolEnd({ agent, tool, result, toolCall, sessionId, tea
     composition_pattern: COMPOSITION_PATTERNS.SOLO,
     team_id: teamId,
     input: null,
-    output: typeof result === 'string' ? { text: result } : { value: result },
+    output: truncateResult(result),
   });
 }
 
@@ -344,6 +470,23 @@ export function normalizeToolEnd({ agent, tool, result, toolCall, sessionId, tea
 // policy ruleset on first invocation if `policiesPath` is set.
 
 export function wmaToolInputGuardrail(options = {}) {
+  // v1.4.1 F-35 (P2 Codex audit on v1.4.0): fail-loud at construction
+  // time when nothing safety-relevant is configured. Same intent as the
+  // openaiAgents() factory's mode:'enforce' check, but applied to the
+  // lower-level entry point too — defense in depth. Customers using the
+  // direct import path no longer get a silent "allow all" surprise.
+  const hasPolicySource =
+    options.policiesPath != null ||
+    options.ruleset != null ||
+    options.allowAllWhenUnconfigured === true;
+  if (!hasPolicySource) {
+    throw new Error(
+      'wmaToolInputGuardrail: no policy configured. Pass policiesPath or ruleset. ' +
+      'For demos / smoke tests that intentionally allow all tool calls, pass ' +
+      '{ allowAllWhenUnconfigured: true } explicitly.',
+    );
+  }
+
   const failOpen = options.failOpen === true ? true : DEFAULT_FAIL_OPEN;
   const sessionId = options.sessionId || makeSessionId();
   const logDir = options.logDir
@@ -354,8 +497,13 @@ export function wmaToolInputGuardrail(options = {}) {
   let ruleset = options.ruleset || null;
   const tracker = options.tracker
     || createContextTracker({ recentWindowSize: options.recentWindowSize ?? 20 });
+  // v1.3.1 F-29 (P1 Codex audit): provider must be passed explicitly so
+  // shield_decision NDJSON rows carry 'openai-agents' instead of being
+  // mis-attributed to 'anthropic-managed' (DecisionLogger's pre-v1.3.1
+  // hardcoded default). Fortress / Guardian forensic surfaces depend on
+  // this for correct multi-provider attribution.
   const decisionLogger = options.decisionLogger
-    || new DecisionLogger({ logDir, agentId: 'openai-agents', sessionId });
+    || new DecisionLogger({ logDir, agentId: 'openai-agents', sessionId, provider: PROVIDER });
   const logger = options.logger
     || new Logger({ logDir, agentId: 'openai-agents', sessionId, silent: true, bestEffort: false });
 
@@ -374,14 +522,16 @@ export function wmaToolInputGuardrail(options = {}) {
       ruleset = await loadPolicies(options.policiesPath);
       return ruleset;
     }
-    // No ruleset, no path → default to "always allow". The customer
-    // probably means to use Fortress; we don't ship that wiring in
-    // v1.3.0 from this entry point. Log a warning once.
+    // v1.4.1 F-35: only reachable when the customer passed
+    // `allowAllWhenUnconfigured: true` — the synchronous check at
+    // construction time has already rejected every other un-configured
+    // shape. Log a loud warning once so demo deployments don't quietly
+    // ship without a real ruleset.
     if (!ensureRuleset._warned) {
       ensureRuleset._warned = true;
       process.stderr.write(
-        '[wma/openai-agents] no policy ruleset configured — guardrail will allow all. ' +
-        'Pass { policiesPath } or { ruleset } to wmaToolInputGuardrail() to enforce.\n',
+        '[wma/openai-agents] allowAllWhenUnconfigured=true — guardrail will allow ALL tool calls. ' +
+        'This is intended for demos only; ship with a real ruleset in production.\n',
       );
     }
     ruleset = { policies: [], default: { action: 'allow' } };
@@ -406,6 +556,10 @@ export function wmaToolInputGuardrail(options = {}) {
           toolCall,
           sessionId,
           teamId: getTeamId(),
+          // v1.4 Codex #4 — per-tool alias map (option `toolInputs`).
+          // Threaded through so the anonymizer hashes by canonical name
+          // for tools the customer explicitly mapped.
+          toolInputs: options.toolInputs,
         });
 
         // 2. Compute policy context BEFORE evaluation so recent_error_rate
@@ -462,17 +616,39 @@ export function wmaToolInputGuardrail(options = {}) {
         // Shield internal failure (policy file unreadable, disk full on
         // log write, etc.). Default fail-CLOSED unless customer opted
         // into fail-OPEN.
+        //
+        // v1.4 F-31 (P2 Codex audit on v1.3.0): the agent must NOT see
+        // the raw err.message — it can carry local paths, policy file
+        // names, disk-mount strings, permission codes, or even fragments
+        // of the policy itself that should never reach a model context.
+        // We mint a short reference code, log the full error locally to
+        // stderr keyed by that code, and return a generic message that
+        // operators can correlate against the local log without exposing
+        // anything actionable to the model. The outputInfo (which is NOT
+        // surfaced to the model — it stays in the application's run
+        // metadata) keeps the err.message for SDK-side tracing.
+        const errorRef = makeErrorRef();
         process.stderr.write(
-          `[wma/openai-agents] guardrail error: ${err.message}\n`,
+          `[wma/openai-agents] [${errorRef}] guardrail error: ${err.message}\n`,
         );
         if (failOpen) {
           return ToolGuardrailFunctionOutputFactory.allow({
-            wma: { error: err.message, failOpenApplied: true },
+            wma: {
+              errorRef,
+              error: err.message,
+              failOpenApplied: true,
+            },
           });
         }
         return ToolGuardrailFunctionOutputFactory.rejectContent(
-          `WMA Shield error: ${err.message} (fail-closed)`,
-          { wma: { error: err.message, failOpenApplied: false } },
+          `WMA Shield internal error (fail-closed). Ref: ${errorRef}`,
+          {
+            wma: {
+              errorRef,
+              error: err.message,
+              failOpenApplied: false,
+            },
+          },
         );
       }
     },
@@ -545,6 +721,7 @@ export function attachWmaWatch(runner, options = {}) {
         const teamId = teamTracker.resolve(sessionId) || teamTracker.bootstrap(sessionId);
         const event = normalizeToolStart({
           agent, tool, toolCall: details?.toolCall, sessionId, teamId,
+          toolInputs: options.toolInputs,  // v1.4 Codex #4
         });
         await logger.write(event);
       } catch (e) {
@@ -669,6 +846,7 @@ export function attachWmaWatchToAgent(agent, options = {}) {
         const teamId = teamTracker.resolve(sessionId) || teamTracker.bootstrap(sessionId);
         const event = normalizeToolStart({
           agent, tool, toolCall: details?.toolCall, sessionId, teamId,
+          toolInputs: options.toolInputs,  // v1.4 Codex #4
         });
         await logger.write(event);
       } catch (e) {
@@ -710,7 +888,12 @@ export const adapterMeta = Object.freeze({
   compositionDefault: COMPOSITION_PATTERNS.SOLO,
   customerInstrumented: true,                // not auto-discovery
   peerPackage: '@openai/agents',
-  minPeerVersion: '0.1.0',                    // adjust after testing
+  // v1.4 F-33 — aligned with package.json#peerDependencies range
+  // `^0.2.0`. Real fixtures captured against 0.2.x verified the
+  // lifecycle event signatures in v1.3.0; minPeerVersion below that is
+  // unsupported and may show drift in args layout (the AgentHooks vs
+  // RunHooks gap that motivated the v1.3.0 finalize commit).
+  minPeerVersion: '0.2.0',
   capabilities: Object.freeze({
     watch: true,
     shield: true,