watchmyagents 1.4.0 → 1.4.1

package/README.md

@@ -287,7 +287,7 @@ export WMA_SIGNALS_SALT="..."                                 # stable per-custo
 
 wma-service install (--agent-id agent_01ABC... | --all-agents) [--interval 1m] [--with-shield]
 wma-service status
-wma-service uninstall [--with-shield]
+wma-service uninstall [--with-shield] [--purge]
 ```
 
 - macOS → **launchd** LaunchAgent · Linux → **systemd** user unit.
@@ -295,6 +295,9 @@ wma-service uninstall [--with-shield]
   runtime — **never** written into the plist/unit.
 - `--with-shield` also runs `wma-shield --policies-source fortress` always-on for
   live enforcement.
+- `uninstall` by default **leaves `~/.watchmyagents/env` on disk** so a re-install
+  keeps your snapshotted keys. Pass `--purge` to also delete the env file and the
+  whole `~/.watchmyagents` directory (including local logs).
 - Raw logs stay local (`~/.watchmyagents/logs`); only anonymized signals upload.
 
 After this, the full Watch→Guardian→Shield loop runs hands-off.

package/SECURITY.md

@@ -33,7 +33,8 @@ Hardening notes:
 - The launcher loads secrets with `while IFS='=' read -r k v` instead of `. file` / `source file`. Sourcing would shell-evaluate every value, so a value containing `$(cmd)` would execute at every restart. The literal read assigns the bytes verbatim.
 - Values are validated before write: a newline anywhere in a credential aborts the install (would corrupt the env file or inject extra lines).
 - To wipe the credential without uninstalling the service: `chmod 600 ~/.watchmyagents/env && : > ~/.watchmyagents/env` (the daemon will exit on the next missing-env check).
-- Full removal: `wma-service uninstall` deletes the unit, the launcher, the env file, and the `~/.watchmyagents` directory.
+- Service removal: `wma-service uninstall` removes the unit and the launcher but **leaves `~/.watchmyagents/env` on disk** so a re-install keeps your snapshotted keys. This is the default since v1.4.1 (F-37) and is the safer behavior — uninstalling to retry an install does not destroy your API keys.
+- Full removal incl. secrets: `wma-service uninstall --purge` removes the unit, the launcher, the env file, and the whole `~/.watchmyagents` directory (including local NDJSON logs under `~/.watchmyagents/logs`). Use this when you really want to scrub the machine.
 
 ### Local log files
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmyagents",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "description": "Security observability + real-time policy enforcement for AI agents. Local-first NDJSON capture with a continuous Watch daemon that auto-uploads anonymized signals, Shield CLI that blocks policy violations live (with policies pulled from Fortress cloud), anonymizer producing signals-only payloads, bidirectional sync with WatchMyAgents Fortress, and one-command install as an always-on launchd/systemd service — closing the recursive Watch→Guardian→Shield security loop.",
   "type": "module",
   "files": [

package/scripts/fetch-anthropic.js

@@ -25,7 +25,7 @@ import { createInterface } from 'node:readline';
 import { join, resolve } from 'node:path';
 import { request as httpsRequest } from 'node:https';
 import { URL } from 'node:url';
-import { Logger } from '../src/logger.js';
+import { Logger, tightenMode } from '../src/logger.js';
 import { TokenTracker } from '../src/tokens.js';
 import { SignalsAggregator } from '../src/anonymizer.js';
 import { resolveFortressBase, fortressEndpoint } from '../src/fortress/url.js';
@@ -321,10 +321,26 @@ async function fetchOneShot({ apiKey, agentId, model, logDir, since, sessionId,
     process.stdout.write(`\n[wma-fetch] session ${sid}\n`);
     if (dumpRaw) {
       assertSafePathSegment(sid, 'session-id'); // defense-in-depth: sid → file path
-      const rawPath = join(logDir, agentId, `raw-${sid}.jsonl`);
-      await mkdir(join(logDir, agentId), { recursive: true, mode: 0o700 });
+      const rawDir = join(logDir, agentId);
+      const rawPath = join(rawDir, `raw-${sid}.jsonl`);
+      await mkdir(rawDir, { recursive: true, mode: 0o700 });
+      // v1.4.1 F-34 (P2 Codex audit): mkdir/appendFile `mode` is creation-
+      // only. If a previous `wma-fetch` run, a different user, or a hand-
+      // rolled mkdir left the directory or file in place with loose perms
+      // (typically 0755/0644 via umask), the original code path kept them.
+      // The raw JSONL carries unredacted API events, so loose perms make
+      // them readable to any local user. Tighten after the directory and
+      // after the first append so an existing inode is brought in line
+      // with the doc promise (0700/0600). Best-effort: chmod failures
+      // here MUST NOT break wma-fetch.
+      await tightenMode(rawDir, 0o700);
+      let firstAppend = true;
       for await (const ev of fetchRawEvents(apiKey, sid)) {
         await appendFile(rawPath, JSON.stringify(ev) + '\n', { encoding: 'utf8', mode: 0o600 });
+        if (firstAppend) {
+          await tightenMode(rawPath, 0o600);
+          firstAppend = false;
+        }
       }
       process.stdout.write(`  raw events  → ${rawPath}\n`);
     }

package/scripts/service.js

@@ -11,7 +11,14 @@
 // One integrated install:
 //   wma-service install --agent-id agent_xxx [--interval 5m] [--with-shield]
 //   wma-service status
-//   wma-service uninstall [--with-shield]
+//   wma-service uninstall [--with-shield] [--purge]
+//
+// v1.4.1 F-37 (P3 Codex audit on v1.4.0): `uninstall` defaults to LEAVING
+// ~/.watchmyagents/env on disk (containing the snapshotted API keys). This
+// matches the historical behavior and protects users who uninstall just to
+// reinstall with a different agent-id from losing their snapshot. To wipe
+// the env file + config dir, pass `--purge` explicitly. SECURITY.md says
+// the same thing; do not let the doc + the code drift again.
 //
 // Secrets NEVER go in the plist/unit. They're snapshotted (from the current
 // environment) into a protected env file (~/.watchmyagents/env, chmod 600) that
@@ -289,6 +296,7 @@ function cmdInstall(args) {
 
 function cmdUninstall(args) {
   const withShield = !!args['with-shield'];
+  const purge = !!args.purge;
   if (PLATFORM === 'darwin') {
     macUnload(WATCH_LABEL);
     if (withShield) macUnload(SHIELD_LABEL);
@@ -298,7 +306,18 @@ function cmdUninstall(args) {
   } else {
     die(`unsupported platform "${PLATFORM}"`);
   }
-  info('uninstalled. (Secrets in ' + ENV_FILE + ' left intact — delete manually if you want them gone.)');
+  if (purge) {
+    // F-37: explicit opt-in only. Removes the snapshotted env file (chmod
+    // 600, contains API keys) and the whole config dir. Logs under
+    // ~/.watchmyagents/logs are wiped too — the user asked for purge, so
+    // we do not second-guess them on local NDJSON. `force: true` ensures
+    // we don't throw if the path is already gone.
+    try { rmSync(ENV_FILE, { force: true }); } catch { /* best-effort */ }
+    try { rmSync(CONFIG_DIR, { recursive: true, force: true }); } catch { /* best-effort */ }
+    info(`uninstalled + purged ${CONFIG_DIR} (env file and local logs removed).`);
+  } else {
+    info(`uninstalled. Secrets in ${ENV_FILE} left intact — re-run with --purge to wipe them.`);
+  }
 }
 
 function cmdStatus() {
@@ -328,11 +347,15 @@ function usage() {
 Usage:
   wma-service install --agent-id agent_xxx [--interval 5m] [--log-dir DIR] [--with-shield]
   wma-service status
-  wma-service uninstall [--with-shield]
+  wma-service uninstall [--with-shield] [--purge]
 
 Required env at install (snapshotted to ~/.watchmyagents/env, chmod 600):
   ANTHROPIC_API_KEY, WMA_API_KEY, WMA_FORTRESS_BASE_URL, WMA_SIGNALS_SALT
 
+Uninstall by default leaves ~/.watchmyagents/env on disk so a re-install
+keeps your snapshotted keys. Pass --purge to also delete the env file and
+the whole ~/.watchmyagents directory (including local logs).
+
 macOS → launchd LaunchAgent · Linux → systemd user unit.
 The service starts at login and restarts on crash. Raw logs stay local.
 `);

package/src/logger.js

@@ -16,6 +16,14 @@ async function tightenMode(path, mode) {
   try { await chmod(path, mode); } catch { /* not fatal */ }
 }
 
+// v1.4.1 F-34 (P2 Codex audit on v1.4.0): re-exported so other writers
+// of WMA-controlled log paths can defend against the same loose-perms
+// trap (mkdir/appendFile `mode` is creation-only). Used by:
+//   scripts/fetch-anthropic.js --dump-raw  (raw API events on disk)
+//   any future code path that mkdir/appendFile into a customer log dir
+// Best-effort by design — failure of chmod must NOT break log writes.
+export { tightenMode };
+
 // PR-B: `framework` → `provider` (canonical name per src/sources/contract.js).
 // PR-C: adds `parent_agent_id` + `composition_pattern` so any future
 // adapter that knows the hierarchy (OpenAI Agents handoffs, CrewAI

package/src/sources/openai-agents-js.js

@@ -116,24 +116,48 @@ function readEnv(key, fallback) {
 // Policies that match on tool_name still work; policies that match on
 // argument values silently miss the truncated suffix — which is the
 // correct fail-closed behavior for an oversize input.
+// v1.4.1 F-36 (P3 Codex audit on v1.4.0): proper byte-level truncation
+// for UTF-8 strings. Pre-v1.4.1 we used `str.slice(0, maxBytes)`, which
+// slices by CHARACTERS — with multi-byte Unicode (emoji = 4 bytes per
+// char) the cap could be exceeded by up to 3x. This helper cuts on the
+// byte boundary via Buffer and strips the trailing U+FFFD replacement
+// character if the cut landed mid-sequence. We accept the dropped
+// trailing char as acceptable cost: the result is marked _wmaTruncated.
+function truncateUtf8(str, maxBytes) {
+  if (typeof str !== 'string') return str;
+  const buf = Buffer.from(str, 'utf8');
+  if (buf.length <= maxBytes) return str;
+  return buf.subarray(0, maxBytes).toString('utf8').replace(/�+$/, '');
+}
+
 function safeParseToolArgs(rawArgs, maxBytes = DEFAULT_MAX_ARG_BYTES) {
   if (rawArgs == null) return null;
   if (typeof rawArgs === 'object') {
-    // Already parsed by the SDK or the customer. We don't deep-walk
-    // and truncate — that would silently change policy match semantics
-    // on nested fields. Defer the decision to the caller; the size cap
-    // applies at the string-parse boundary, which is the realistic
-    // SDK entry point.
+    // v1.4.1 F-36 — also cap object inputs by their serialized byte
+    // size. Pre-v1.4.1 already-parsed objects bypassed the cap entirely,
+    // which let a misbehaving tool / customer pass a 5 MB object through
+    // safeParseToolArgs unimpeded. We don't deep-walk-and-truncate (that
+    // would silently change policy match semantics on nested fields);
+    // instead we replace the whole input with a truncation marker if
+    // the serialized form exceeds maxBytes.
+    try {
+      const serialized = JSON.stringify(rawArgs);
+      const byteLen = Buffer.byteLength(serialized, 'utf8');
+      if (byteLen > maxBytes) {
+        return { _wmaTruncated: true, _wmaOriginalBytes: byteLen };
+      }
+    } catch {
+      // Unserializable input — return as-is. Policy match against
+      // anything in this object is going to fail anyway.
+    }
     return rawArgs;
   }
   if (typeof rawArgs !== 'string') return null;
   // Byte cap: Buffer.byteLength is the safe length on the wire.
   const byteLen = Buffer.byteLength(rawArgs, 'utf8');
   if (byteLen > maxBytes) {
-    // Truncate to maxBytes worth of bytes (substring is char-bounded;
-    // good enough — exact byte truncation isn't required since we mark
-    // the result as truncated and never feed it back to a real tool).
-    const head = rawArgs.slice(0, maxBytes);
+    // v1.4.1 F-36 — byte-level truncation (was char-level before).
+    const head = truncateUtf8(rawArgs, maxBytes);
     try {
       const parsed = JSON.parse(head);
       // If by luck the head is valid JSON, return it plus the marker.
@@ -374,8 +398,9 @@ function truncateResult(result, maxBytes = DEFAULT_MAX_RESULT_BYTES) {
   if (typeof result === 'string') {
     const byteLen = Buffer.byteLength(result, 'utf8');
     if (byteLen > maxBytes) {
+      // v1.4.1 F-36 — byte-level truncation (was char-level before).
       return {
-        text: result.slice(0, maxBytes) + TRUNCATION_SENTINEL,
+        text: truncateUtf8(result, maxBytes) + TRUNCATION_SENTINEL,
         _wmaTruncated: true,
         _wmaOriginalBytes: byteLen,
       };
@@ -445,6 +470,23 @@ export function normalizeToolEnd({ agent, tool, result, toolCall, sessionId, tea
 // policy ruleset on first invocation if `policiesPath` is set.
 
 export function wmaToolInputGuardrail(options = {}) {
+  // v1.4.1 F-35 (P2 Codex audit on v1.4.0): fail-loud at construction
+  // time when nothing safety-relevant is configured. Same intent as the
+  // openaiAgents() factory's mode:'enforce' check, but applied to the
+  // lower-level entry point too — defense in depth. Customers using the
+  // direct import path no longer get a silent "allow all" surprise.
+  const hasPolicySource =
+    options.policiesPath != null ||
+    options.ruleset != null ||
+    options.allowAllWhenUnconfigured === true;
+  if (!hasPolicySource) {
+    throw new Error(
+      'wmaToolInputGuardrail: no policy configured. Pass policiesPath or ruleset. ' +
+      'For demos / smoke tests that intentionally allow all tool calls, pass ' +
+      '{ allowAllWhenUnconfigured: true } explicitly.',
+    );
+  }
+
   const failOpen = options.failOpen === true ? true : DEFAULT_FAIL_OPEN;
   const sessionId = options.sessionId || makeSessionId();
   const logDir = options.logDir
@@ -480,14 +522,16 @@ export function wmaToolInputGuardrail(options = {}) {
       ruleset = await loadPolicies(options.policiesPath);
       return ruleset;
     }
-    // No ruleset, no path → default to "always allow". The customer
-    // probably means to use Fortress; we don't ship that wiring in
-    // v1.3.0 from this entry point. Log a warning once.
+    // v1.4.1 F-35: only reachable when the customer passed
+    // `allowAllWhenUnconfigured: true` — the synchronous check at
+    // construction time has already rejected every other un-configured
+    // shape. Log a loud warning once so demo deployments don't quietly
+    // ship without a real ruleset.
     if (!ensureRuleset._warned) {
       ensureRuleset._warned = true;
       process.stderr.write(
-        '[wma/openai-agents] no policy ruleset configured — guardrail will allow all. ' +
-        'Pass { policiesPath } or { ruleset } to wmaToolInputGuardrail() to enforce.\n',
+        '[wma/openai-agents] allowAllWhenUnconfigured=true — guardrail will allow ALL tool calls. ' +
+        'This is intended for demos only; ship with a real ruleset in production.\n',
       );
     }
     ruleset = { policies: [], default: { action: 'allow' } };