watchmyagents 1.4.0 → 1.4.3

package/src/sources/anthropic-managed.js

@@ -22,6 +22,7 @@ import {
   getAgentConfig, detectAlwaysAsk,
   confirmAllow, confirmDeny, interruptSession,
 } from '../shield/enforce.js';
+import { safeNonNegInt } from '../tokens.js';
 
 const API_HOST = 'api.anthropic.com';
 const BETA = 'managed-agents-2026-04-01';
@@ -120,25 +121,48 @@ export async function listAgents(apiKey, { limit = 100 } = {}) {
   return agents;
 }
 
-export async function listSessions(apiKey, { agentId, since, limit = 100 } = {}) {
+// v1.4.2 F-45 (P1 audit): page through the FULL session list and filter by
+// `since` per-row — do NOT early-break. The previous version stopped
+// paginating at the first session older than `since`, assuming the API
+// returns sessions newest-first by created_at. Nothing enforces that ordering
+// (no `order=` param is sent), and the doc never promised it. If the API
+// ordered by id / updated_at, a single out-of-window session aborted
+// pagination while newer in-window sessions sat on later pages — they were
+// NEVER enumerated, so that agent's activity went untraced (a security blind
+// spot, the exact failure this tool exists to prevent). We now scan every
+// page; a session older than `since` is skipped, not a stop signal. A null
+// created_at is treated as in-window (we cannot prove it is old). `maxPages`
+// is a pathological-loop backstop; hitting it warns loudly rather than
+// silently truncating.
+export async function listSessions(apiKey, { agentId, since, limit = 100, maxPages = 1000, _fetch } = {}) {
+  // _fetch is an injectable page-fetcher seam for tests (path -> response
+  // object with { data, has_more }). Production uses the real getWithRetry.
+  const fetchPage = _fetch || ((path) => getWithRetry(apiKey, path));
   const sessions = [];
   let after = null;
-  while (true) {
+  let pages = 0;
+  while (pages < maxPages) {
+    pages++;
     const qs = new URLSearchParams({ limit: String(limit) });
     if (agentId) qs.set('agent_id', agentId);
     if (after) qs.set('after_id', after);
-    const data = await getWithRetry(apiKey, `/v1/sessions?${qs}`);
+    const data = await fetchPage(`/v1/sessions?${qs}`);
     const page = data.data || [];
-    let stop = false;
     for (const s of page) {
       const created = s.created_at ? new Date(s.created_at) : null;
-      if (since && created && created < since) { stop = true; break; }
+      if (since && created && created < since) continue;   // skip, do NOT stop
       sessions.push(s);
     }
-    if (stop || !data.has_more || page.length === 0) break;
+    if (!data.has_more || page.length === 0) break;
     after = page[page.length - 1]?.id;
     if (!after) break;
   }
+  if (pages >= maxPages) {
+    process.stderr.write(
+      `[wma] listSessions: hit maxPages=${maxPages} for agent ${agentId || '(all)'} — ` +
+      'session enumeration may be INCOMPLETE. Raise maxPages or narrow the agent set.\n',
+    );
+  }
   return sessions;
 }
 
@@ -211,6 +235,16 @@ export async function* transformRawEventsToWMAActions(rawEventsAsyncIterable, {
   // Pair-tracking maps: event_id of the "start" → its timestamp + metadata
   const pendingModelReq = new Map();    // span.model_request_start.id → ts
   const pendingToolUse = new Map();     // agent.tool_use.id → { ts, name, isMcp, input }
+  // v1.4.2 F-50 (P2 audit): pair custom tools like provider/MCP tools so the
+  // single yielded row carries the REAL status/error/duration. Pre-F-50
+  // agent.custom_tool_use was emitted immediately with a hardcoded status:'ok'
+  // and its outcome arrived on a SEPARATE custom_tool_result row with
+  // tool_name:null — so a failing custom tool never entered error_rate_by_tool
+  // (the aggregator skips null-named rows) and duration was always null. The
+  // customer-controlled tool surface — the highest-risk one — was the only
+  // family with no error/latency signal. Pairing fixes that with no aggregator
+  // special-case (custom_tool_use is already in TOOL_ACTIONS).
+  const pendingCustomTool = new Map();  // agent.custom_tool_use.id → { ts, name, input, startTimestamp, meta }
 
   // v1.1.3 Phase 1.C — Anthropic sub-agent detection.
   // Anthropic Task tool: when a parent agent delegates, a NEW thread is
@@ -279,10 +313,13 @@ export async function* transformRawEventsToWMAActions(rawEventsAsyncIterable, {
       const startTs = pendingModelReq.get(ev.model_request_start_id);
       pendingModelReq.delete(ev.model_request_start_id);
       const u = ev.model_usage || {};
-      const i = u.input_tokens || 0;
-      const o = u.output_tokens || 0;
-      const cr = u.cache_read_input_tokens || 0;
-      const cw = u.cache_creation_input_tokens || 0;
+      // v1.4.2 F-49 (P2 audit): sanitize to non-negative integers. A
+      // malformed/adversarial model_usage (NaN, negative, string) must not
+      // zero-out or poison the token totals that drive cost/abuse detection.
+      const i = safeNonNegInt(u.input_tokens);
+      const o = safeNonNegInt(u.output_tokens);
+      const cr = safeNonNegInt(u.cache_read_input_tokens);
+      const cw = safeNonNegInt(u.cache_creation_input_tokens);
       yield {
         ...base,
         ...subAgentMeta,
@@ -351,16 +388,36 @@ export async function* transformRawEventsToWMAActions(rawEventsAsyncIterable, {
     }
 
     if (type === 'user.custom_tool_result') {
+      // v1.4.2 F-50: pair with the stored start and emit ONE completed
+      // custom_tool_use row carrying the real status/error/duration + the
+      // tool_name from the start (so a failing custom tool now lands in
+      // error_rate_by_tool). Mirrors the agent.tool_result handler. An
+      // orphan result (no matching start — out-of-order / restart) still
+      // emits, with tool_name null and input from the result only, so we
+      // never drop an action.
+      const cStart = pendingCustomTool.get(ev.custom_tool_use_id);
+      pendingCustomTool.delete(ev.custom_tool_use_id);
+      const isError = ev.is_error === true;
+      const cMeta = cStart ? {
+        session_thread_id: cStart.session_thread_id ?? subAgentMeta.session_thread_id,
+        agent_name: cStart.agent_name ?? subAgentMeta.agent_name,
+        composition_pattern: (cStart.session_thread_id != null && subThreadIds.has(cStart.session_thread_id))
+          ? COMPOSITION_PATTERNS.HIERARCHY
+          : COMPOSITION_PATTERNS.SOLO,
+        parent_agent_id: null,
+      } : subAgentMeta;
       yield {
         ...base,
-        ...subAgentMeta,
+        ...cMeta,
         id: ev.id,
-        action_type: 'custom_tool_result',
-        tool_name: null,
+        action_type: 'custom_tool_use',
+        tool_name: cStart?.name ?? null,
         model: model || null,
         timestamp: ts,
-        status: ev.is_error ? 'error' : 'ok',
-        input: { custom_tool_use_id: ev.custom_tool_use_id },
+        duration_ms: (cStart?.ts && tsMillis) ? tsMillis - cStart.ts : null,
+        status: isError ? 'error' : 'ok',
+        error: isError ? extractText(ev.content).slice(0, 500) : null,
+        input: cStart?.input ?? { custom_tool_use_id: ev.custom_tool_use_id },
         output: { content: ev.content ?? null },
       };
       continue;
@@ -399,7 +456,16 @@ export async function* transformRawEventsToWMAActions(rawEventsAsyncIterable, {
     if (type === 'agent.tool_use' || type === 'agent.mcp_tool_use') {
       pendingToolUse.set(ev.id, {
         ts: tsMillis,
-        name: ev.name || 'unknown',
+        // v1.4.2 F-41 (P1 audit): a missing tool name becomes null, NOT the
+        // literal string 'unknown'. A 'unknown' fallback (a) let a tool_name
+        // DENYLIST silently miss a real tool whose name field was absent
+        // (the rule keys on e.g. "bash"; "unknown" !== "bash" → no match →
+        // default-allow), and (b) collided two distinct unnamed tools into
+        // one forensic bucket. null fails every specific tool_name clause
+        // closed and is honestly absent. tool_name is `string|null` per the
+        // WMAAction contract; normalizeToolName(null) returns null and the
+        // aggregator skips null-named entries from per-tool counts.
+        name: ev.name ?? null,
         isMcp: type === 'agent.mcp_tool_use',
         input: ev.input ?? null,
         mcpServer: ev.server_name ?? ev.mcp_server_name ?? null,
@@ -435,7 +501,7 @@ export async function* transformRawEventsToWMAActions(rawEventsAsyncIterable, {
         ...pairedMeta,
         id: ev.id,
         action_type: start?.isMcp ? 'mcp_tool_use' : 'tool_use',
-        tool_name: start?.name || 'unknown',
+        tool_name: start?.name ?? null,   // F-41: null, never literal 'unknown'
         timestamp: ts,
         duration_ms: (start?.ts && tsMillis) ? tsMillis - start.ts : null,
         status: isError ? 'error' : 'ok',
@@ -447,16 +513,15 @@ export async function* transformRawEventsToWMAActions(rawEventsAsyncIterable, {
     }
 
     if (type === 'agent.custom_tool_use') {
-      yield {
-        ...base,
-        ...subAgentMeta,
-        id: ev.id,
-        action_type: 'custom_tool_use',
-        tool_name: ev.name || 'unknown',
-        timestamp: ts,
-        status: 'ok',
+      // v1.4.2 F-50: store the start; the paired custom_tool_result (or the
+      // end-of-session flush) emits the single completed row with real status.
+      pendingCustomTool.set(ev.id, {
+        ts: tsMillis,
+        name: ev.name ?? null,        // F-41: null, never literal 'unknown'
         input: ev.input ?? null,
-      };
+        startTimestamp: ts,
+        session_thread_id, agent_name,
+      });
       continue;
     }
 
@@ -619,6 +684,28 @@ export async function* transformRawEventsToWMAActions(rawEventsAsyncIterable, {
     };
   }
   pendingToolUse.clear();
+
+  // v1.4.2 F-50: same flush for custom tools that started but never returned
+  // a result (Shield-blocked, denied, died mid-flight, session cut). Emitted
+  // as custom_tool_use / status=error / no_result_observed — the high-value
+  // "started but didn't complete" signal, now also covered for custom tools.
+  for (const [useId, pending] of pendingCustomTool) {
+    yield {
+      ...base,
+      session_thread_id: pending.session_thread_id,
+      agent_name: pending.agent_name,
+      id: useId,
+      action_type: 'custom_tool_use',
+      tool_name: pending.name,
+      model: model || null,
+      timestamp: pending.startTimestamp,
+      duration_ms: null,
+      status: 'error',
+      error: 'no_result_observed',
+      input: pending.input,
+    };
+  }
+  pendingCustomTool.clear();
 }
 
 // ────────────────────────────────────────────────────────────────────────

package/src/sources/contract.js

@@ -101,6 +101,23 @@ export const ACTION_TYPES = Object.freeze({
   STATE_TRANSITION: 'state_transition',
 });
 
+// v1.4.2 F-38 (P0 audit) — the three tool-INVOCATION action_types form one
+// security-equivalent family. WHICH surface a tool call came through
+// (provider built-in vs MCP server vs customer-wired custom tool) is an
+// adapter implementation detail, not a security distinction: all three are
+// "the agent invoked a tool." A deny/allowlist policy keyed on the generic
+// `tool_use` MUST catch all three, or it silently misses MCP + custom tool
+// calls — exactly where an attacker pivots. The policy matcher
+// (src/shield/policy.js) expands a generic `tool_use` target to this family;
+// matching a SPECIFIC member (mcp_tool_use / custom_tool_use) stays exact so
+// an operator can still target one surface when they mean to.
+// SignalsAggregator (src/anonymizer.js) uses the same set for IoC capture.
+export const TOOL_USE_FAMILY = Object.freeze([
+  ACTION_TYPES.TOOL_USE,
+  ACTION_TYPES.MCP_TOOL_USE,
+  ACTION_TYPES.CUSTOM_TOOL_USE,
+]);
+
 export const STATUS_VALUES = Object.freeze({
   OK: 'ok',
   ERROR: 'error',

package/src/sources/openai-agents-js.js

@@ -116,24 +116,48 @@ function readEnv(key, fallback) {
 // Policies that match on tool_name still work; policies that match on
 // argument values silently miss the truncated suffix — which is the
 // correct fail-closed behavior for an oversize input.
+// v1.4.1 F-36 (P3 Codex audit on v1.4.0): proper byte-level truncation
+// for UTF-8 strings. Pre-v1.4.1 we used `str.slice(0, maxBytes)`, which
+// slices by CHARACTERS — with multi-byte Unicode (emoji = 4 bytes per
+// char) the cap could be exceeded by up to 3x. This helper cuts on the
+// byte boundary via Buffer and strips the trailing U+FFFD replacement
+// character if the cut landed mid-sequence. We accept the dropped
+// trailing char as acceptable cost: the result is marked _wmaTruncated.
+function truncateUtf8(str, maxBytes) {
+  if (typeof str !== 'string') return str;
+  const buf = Buffer.from(str, 'utf8');
+  if (buf.length <= maxBytes) return str;
+  return buf.subarray(0, maxBytes).toString('utf8').replace(/�+$/, '');
+}
+
 function safeParseToolArgs(rawArgs, maxBytes = DEFAULT_MAX_ARG_BYTES) {
   if (rawArgs == null) return null;
   if (typeof rawArgs === 'object') {
-    // Already parsed by the SDK or the customer. We don't deep-walk
-    // and truncate — that would silently change policy match semantics
-    // on nested fields. Defer the decision to the caller; the size cap
-    // applies at the string-parse boundary, which is the realistic
-    // SDK entry point.
+    // v1.4.1 F-36 — also cap object inputs by their serialized byte
+    // size. Pre-v1.4.1 already-parsed objects bypassed the cap entirely,
+    // which let a misbehaving tool / customer pass a 5 MB object through
+    // safeParseToolArgs unimpeded. We don't deep-walk-and-truncate (that
+    // would silently change policy match semantics on nested fields);
+    // instead we replace the whole input with a truncation marker if
+    // the serialized form exceeds maxBytes.
+    try {
+      const serialized = JSON.stringify(rawArgs);
+      const byteLen = Buffer.byteLength(serialized, 'utf8');
+      if (byteLen > maxBytes) {
+        return { _wmaTruncated: true, _wmaOriginalBytes: byteLen };
+      }
+    } catch {
+      // Unserializable input — return as-is. Policy match against
+      // anything in this object is going to fail anyway.
+    }
     return rawArgs;
   }
   if (typeof rawArgs !== 'string') return null;
   // Byte cap: Buffer.byteLength is the safe length on the wire.
   const byteLen = Buffer.byteLength(rawArgs, 'utf8');
   if (byteLen > maxBytes) {
-    // Truncate to maxBytes worth of bytes (substring is char-bounded;
-    // good enough — exact byte truncation isn't required since we mark
-    // the result as truncated and never feed it back to a real tool).
-    const head = rawArgs.slice(0, maxBytes);
+    // v1.4.1 F-36 — byte-level truncation (was char-level before).
+    const head = truncateUtf8(rawArgs, maxBytes);
     try {
       const parsed = JSON.parse(head);
       // If by luck the head is valid JSON, return it plus the marker.
@@ -374,8 +398,9 @@ function truncateResult(result, maxBytes = DEFAULT_MAX_RESULT_BYTES) {
   if (typeof result === 'string') {
     const byteLen = Buffer.byteLength(result, 'utf8');
     if (byteLen > maxBytes) {
+      // v1.4.1 F-36 — byte-level truncation (was char-level before).
       return {
-        text: result.slice(0, maxBytes) + TRUNCATION_SENTINEL,
+        text: truncateUtf8(result, maxBytes) + TRUNCATION_SENTINEL,
         _wmaTruncated: true,
         _wmaOriginalBytes: byteLen,
       };
@@ -445,6 +470,23 @@ export function normalizeToolEnd({ agent, tool, result, toolCall, sessionId, tea
 // policy ruleset on first invocation if `policiesPath` is set.
 
 export function wmaToolInputGuardrail(options = {}) {
+  // v1.4.1 F-35 (P2 Codex audit on v1.4.0): fail-loud at construction
+  // time when nothing safety-relevant is configured. Same intent as the
+  // openaiAgents() factory's mode:'enforce' check, but applied to the
+  // lower-level entry point too — defense in depth. Customers using the
+  // direct import path no longer get a silent "allow all" surprise.
+  const hasPolicySource =
+    options.policiesPath != null ||
+    options.ruleset != null ||
+    options.allowAllWhenUnconfigured === true;
+  if (!hasPolicySource) {
+    throw new Error(
+      'wmaToolInputGuardrail: no policy configured. Pass policiesPath or ruleset. ' +
+      'For demos / smoke tests that intentionally allow all tool calls, pass ' +
+      '{ allowAllWhenUnconfigured: true } explicitly.',
+    );
+  }
+
   const failOpen = options.failOpen === true ? true : DEFAULT_FAIL_OPEN;
   const sessionId = options.sessionId || makeSessionId();
   const logDir = options.logDir
@@ -480,14 +522,16 @@ export function wmaToolInputGuardrail(options = {}) {
       ruleset = await loadPolicies(options.policiesPath);
       return ruleset;
     }
-    // No ruleset, no path → default to "always allow". The customer
-    // probably means to use Fortress; we don't ship that wiring in
-    // v1.3.0 from this entry point. Log a warning once.
+    // v1.4.1 F-35: only reachable when the customer passed
+    // `allowAllWhenUnconfigured: true` — the synchronous check at
+    // construction time has already rejected every other un-configured
+    // shape. Log a loud warning once so demo deployments don't quietly
+    // ship without a real ruleset.
     if (!ensureRuleset._warned) {
       ensureRuleset._warned = true;
       process.stderr.write(
-        '[wma/openai-agents] no policy ruleset configured — guardrail will allow all. ' +
-        'Pass { policiesPath } or { ruleset } to wmaToolInputGuardrail() to enforce.\n',
+        '[wma/openai-agents] allowAllWhenUnconfigured=true — guardrail will allow ALL tool calls. ' +
+        'This is intended for demos only; ship with a real ruleset in production.\n',
       );
     }
     ruleset = { policies: [], default: { action: 'allow' } };
@@ -505,10 +549,26 @@ export function wmaToolInputGuardrail(options = {}) {
       try {
         const rs = await ensureRuleset();
 
+        // v1.4.2 F-42 (P1 audit): read the tool name DEFENSIVELY across the
+        // shapes @openai/agents may use for the guardrail's toolCall object.
+        // The adapter already knows the id lives under a non-obvious key
+        // (makeEventId reads callId||id), so the name may likewise sit under
+        // .name, .toolName, or .function.name depending on SDK version/tool
+        // kind. If we only read .name and the SDK puts it elsewhere, tool_name
+        // is null and EVERY tool_name-keyed deny rule silently misses — a
+        // total enforcement bypass. Coalesce all known shapes; null only if
+        // none are present (then tool_name-keyed rules correctly no-match,
+        // and the operator can still deny on action_type alone).
+        const toolName = toolCall?.name
+          ?? toolCall?.toolName
+          ?? toolCall?.function?.name
+          ?? data?.tool?.name
+          ?? null;
+
         // 1. Normalize the about-to-fire tool_use event.
         const event = normalizeToolStart({
           agent,
-          tool: { name: toolCall?.name },
+          tool: { name: toolName },
           toolCall,
           sessionId,
           teamId: getTeamId(),

package/src/tokens.js

@@ -4,14 +4,26 @@
 // token counts (split + by-model) are tracked.
 export const DEFAULT_PRICING = {};
 
+// v1.4.2 F-49 (P2 audit): coerce a token/usage value to a safe non-negative
+// integer. The old `x || 0` is a FALSY guard, not a numeric one — it lets
+// negatives through (`-5 || 0` === -5) and a NaN propagates through later
+// arithmetic to poison totals (`NaN + n` → NaN → `|| null` → null), silently
+// ZEROING a real LLM call's tokens. A malformed or adversarial usage payload
+// could thus under-report the security-relevant consumption signal (a runaway
+// / abused agent) or drive aggregate token/cost negative. Anything not a
+// finite non-negative number becomes 0.
+export function safeNonNegInt(x) {
+  return Number.isFinite(x) && x >= 0 ? Math.trunc(x) : 0;
+}
+
 export function estimateCost(model, t, pricing) {
   if (!model) return null;
   const p = (pricing && pricing[model]) || DEFAULT_PRICING[model];
   if (!p) return null;
-  const inT = t.input_tokens || 0;
-  const outT = t.output_tokens || 0;
-  const cr = t.cache_read_tokens || 0;
-  const cw = t.cache_creation_tokens || 0;
+  const inT = safeNonNegInt(t.input_tokens);
+  const outT = safeNonNegInt(t.output_tokens);
+  const cr = safeNonNegInt(t.cache_read_tokens);
+  const cw = safeNonNegInt(t.cache_creation_tokens);
   const cost = ((inT * (p.input || 0)) + (outT * (p.output || 0)) +
                 (cr * (p.cache_read || 0)) + (cw * (p.cache_write || 0))) / 1_000_000;
   return Math.round(cost * 1_000_000) / 1_000_000;
@@ -38,13 +50,16 @@ export class TokenTracker {
     if (entry.action_type === 'session_end') return;
 
     const t = {
-      input: entry.input_tokens || 0,
-      output: entry.output_tokens || 0,
-      cache_read: entry.cache_read_tokens || 0,
-      cache_creation: entry.cache_creation_tokens || 0,
+      input: safeNonNegInt(entry.input_tokens),
+      output: safeNonNegInt(entry.output_tokens),
+      cache_read: safeNonNegInt(entry.cache_read_tokens),
+      cache_creation: safeNonNegInt(entry.cache_creation_tokens),
     };
-    const sum = entry.tokens_used || (t.input + t.output + t.cache_read + t.cache_creation);
-    const cost = entry.cost_usd || 0;
+    // F-49: a provided tokens_used is sanitized too; 0/missing falls back to
+    // the (sanitized) component sum.
+    const provided = safeNonNegInt(entry.tokens_used);
+    const sum = provided || (t.input + t.output + t.cache_read + t.cache_creation);
+    const cost = Number.isFinite(entry.cost_usd) && entry.cost_usd >= 0 ? entry.cost_usd : 0;
 
     this.total.input += t.input;
     this.total.output += t.output;

package/src/watch-state.js

@@ -0,0 +1,56 @@
+// v1.4.3 F-51 (P2 audit) — bounded dedup state for the long-running watch loop.
+//
+// The watch daemon dedupes events by their stable Anthropic event id so a
+// re-fetch of an already-captured session doesn't double-write the NDJSON.
+// Pre-F-51 every id ever seen lived in a single Set that was only ever added
+// to — on a 24/7 daemon at high event volume that Set grows without bound
+// (hundreds of MB within days), and the daemon eventually OOM-kills and stops
+// collecting (a silent monitoring gap).
+//
+// SeenTracker bounds runtime growth WITHOUT weakening dedup:
+//   - Preloaded ids (read from on-disk NDJSON at startup) sit in a static set,
+//     loaded once. Bounded by what the operator keeps on disk.
+//   - Runtime-discovered ids are tracked PER SESSION. When a session
+//     terminates it is never re-fetched, so its id set is dropped. Live memory
+//     is therefore bounded by ACTIVE sessions, not lifetime event volume.
+//
+// Correctness: Anthropic event ids are globally unique and an event belongs to
+// exactly one session, so checking the preloaded set + that session's set is
+// equivalent to the old global-set membership test (no missed dedup, no
+// missed events).
+export class SeenTracker {
+  constructor(preloadedIds = []) {
+    this._preloaded = new Set(preloadedIds);
+    this._bySession = new Map();   // sessionId -> Set<eventId>
+  }
+
+  has(sessionId, eventId) {
+    if (this._preloaded.has(eventId)) return true;
+    const s = this._bySession.get(sessionId);
+    return s ? s.has(eventId) : false;
+  }
+
+  add(sessionId, eventId) {
+    let s = this._bySession.get(sessionId);
+    if (!s) { s = new Set(); this._bySession.set(sessionId, s); }
+    s.add(eventId);
+  }
+
+  // Drop a terminated session's runtime id set — it will never be re-fetched,
+  // so its ids no longer need to be remembered for dedup.
+  forgetSession(sessionId) {
+    this._bySession.delete(sessionId);
+  }
+
+  // Total tracked ids (preloaded + all live per-session sets). For observability.
+  get size() {
+    let n = this._preloaded.size;
+    for (const s of this._bySession.values()) n += s.size;
+    return n;
+  }
+
+  // Number of sessions currently holding a runtime id set.
+  get sessionCount() {
+    return this._bySession.size;
+  }
+}