watchmyagents 1.4.1 → 1.4.4

package/src/sources/contract.js

@@ -101,6 +101,23 @@ export const ACTION_TYPES = Object.freeze({
   STATE_TRANSITION: 'state_transition',
 });
 
+// v1.4.2 F-38 (P0 audit) — the three tool-INVOCATION action_types form one
+// security-equivalent family. WHICH surface a tool call came through
+// (provider built-in vs MCP server vs customer-wired custom tool) is an
+// adapter implementation detail, not a security distinction: all three are
+// "the agent invoked a tool." A deny/allowlist policy keyed on the generic
+// `tool_use` MUST catch all three, or it silently misses MCP + custom tool
+// calls — exactly where an attacker pivots. The policy matcher
+// (src/shield/policy.js) expands a generic `tool_use` target to this family;
+// matching a SPECIFIC member (mcp_tool_use / custom_tool_use) stays exact so
+// an operator can still target one surface when they mean to.
+// SignalsAggregator (src/anonymizer.js) uses the same set for IoC capture.
+export const TOOL_USE_FAMILY = Object.freeze([
+  ACTION_TYPES.TOOL_USE,
+  ACTION_TYPES.MCP_TOOL_USE,
+  ACTION_TYPES.CUSTOM_TOOL_USE,
+]);
+
 export const STATUS_VALUES = Object.freeze({
   OK: 'ok',
   ERROR: 'error',

package/src/sources/openai-agents-js.js

@@ -549,10 +549,26 @@ export function wmaToolInputGuardrail(options = {}) {
       try {
         const rs = await ensureRuleset();
 
+        // v1.4.2 F-42 (P1 audit): read the tool name DEFENSIVELY across the
+        // shapes @openai/agents may use for the guardrail's toolCall object.
+        // The adapter already knows the id lives under a non-obvious key
+        // (makeEventId reads callId||id), so the name may likewise sit under
+        // .name, .toolName, or .function.name depending on SDK version/tool
+        // kind. If we only read .name and the SDK puts it elsewhere, tool_name
+        // is null and EVERY tool_name-keyed deny rule silently misses — a
+        // total enforcement bypass. Coalesce all known shapes; null only if
+        // none are present (then tool_name-keyed rules correctly no-match,
+        // and the operator can still deny on action_type alone).
+        const toolName = toolCall?.name
+          ?? toolCall?.toolName
+          ?? toolCall?.function?.name
+          ?? data?.tool?.name
+          ?? null;
+
         // 1. Normalize the about-to-fire tool_use event.
         const event = normalizeToolStart({
           agent,
-          tool: { name: toolCall?.name },
+          tool: { name: toolName },
           toolCall,
           sessionId,
           teamId: getTeamId(),

package/src/tokens.js

@@ -4,14 +4,26 @@
 // token counts (split + by-model) are tracked.
 export const DEFAULT_PRICING = {};
 
+// v1.4.2 F-49 (P2 audit): coerce a token/usage value to a safe non-negative
+// integer. The old `x || 0` is a FALSY guard, not a numeric one — it lets
+// negatives through (`-5 || 0` === -5) and a NaN propagates through later
+// arithmetic to poison totals (`NaN + n` → NaN → `|| null` → null), silently
+// ZEROING a real LLM call's tokens. A malformed or adversarial usage payload
+// could thus under-report the security-relevant consumption signal (a runaway
+// / abused agent) or drive aggregate token/cost negative. Anything not a
+// finite non-negative number becomes 0.
+export function safeNonNegInt(x) {
+  return Number.isFinite(x) && x >= 0 ? Math.trunc(x) : 0;
+}
+
 export function estimateCost(model, t, pricing) {
   if (!model) return null;
   const p = (pricing && pricing[model]) || DEFAULT_PRICING[model];
   if (!p) return null;
-  const inT = t.input_tokens || 0;
-  const outT = t.output_tokens || 0;
-  const cr = t.cache_read_tokens || 0;
-  const cw = t.cache_creation_tokens || 0;
+  const inT = safeNonNegInt(t.input_tokens);
+  const outT = safeNonNegInt(t.output_tokens);
+  const cr = safeNonNegInt(t.cache_read_tokens);
+  const cw = safeNonNegInt(t.cache_creation_tokens);
   const cost = ((inT * (p.input || 0)) + (outT * (p.output || 0)) +
                 (cr * (p.cache_read || 0)) + (cw * (p.cache_write || 0))) / 1_000_000;
   return Math.round(cost * 1_000_000) / 1_000_000;
@@ -38,13 +50,16 @@ export class TokenTracker {
     if (entry.action_type === 'session_end') return;
 
     const t = {
-      input: entry.input_tokens || 0,
-      output: entry.output_tokens || 0,
-      cache_read: entry.cache_read_tokens || 0,
-      cache_creation: entry.cache_creation_tokens || 0,
+      input: safeNonNegInt(entry.input_tokens),
+      output: safeNonNegInt(entry.output_tokens),
+      cache_read: safeNonNegInt(entry.cache_read_tokens),
+      cache_creation: safeNonNegInt(entry.cache_creation_tokens),
     };
-    const sum = entry.tokens_used || (t.input + t.output + t.cache_read + t.cache_creation);
-    const cost = entry.cost_usd || 0;
+    // F-49: a provided tokens_used is sanitized too; 0/missing falls back to
+    // the (sanitized) component sum.
+    const provided = safeNonNegInt(entry.tokens_used);
+    const sum = provided || (t.input + t.output + t.cache_read + t.cache_creation);
+    const cost = Number.isFinite(entry.cost_usd) && entry.cost_usd >= 0 ? entry.cost_usd : 0;
 
     this.total.input += t.input;
     this.total.output += t.output;

package/src/watch-state.js

@@ -0,0 +1,65 @@
+// v1.4.3 F-51 (P2 audit) — bounded dedup state for the long-running watch loop.
+//
+// The watch daemon dedupes events by their stable Anthropic event id so a
+// re-fetch of an already-captured session doesn't double-write the NDJSON.
+// Pre-F-51 every id ever seen lived in a single Set that was only ever added
+// to — on a 24/7 daemon at high event volume that Set grows without bound
+// (hundreds of MB within days), and the daemon eventually OOM-kills and stops
+// collecting (a silent monitoring gap).
+//
+// SeenTracker bounds runtime growth WITHOUT weakening dedup:
+//   - Preloaded ids (read from on-disk NDJSON at startup) sit in a static set,
+//     loaded once. Bounded by what the operator keeps on disk.
+//   - Runtime-discovered ids are tracked PER SESSION. When a session
+//     terminates it is never re-fetched, so its id set is dropped. Live memory
+//     is therefore bounded by ACTIVE sessions, not lifetime event volume.
+//
+// Correctness: Anthropic event ids are globally unique and an event belongs to
+// exactly one session, so checking the preloaded set + that session's set is
+// equivalent to the old global-set membership test (no missed dedup, no
+// missed events).
+export class SeenTracker {
+  constructor(preloadedIds = []) {
+    this._preloaded = new Set(preloadedIds);
+    this._bySession = new Map();   // sessionId -> Set<eventId>
+  }
+
+  // v1.4.4 F-53: fold an agent's on-disk history into the static preloaded
+  // set. Called lazily the first time an agent is seen (including agents that
+  // --all-agents discovers AFTER startup) so their already-captured NDJSON ids
+  // are deduped against — otherwise a late-appearing agent with existing logs
+  // would re-append and re-upload events it already has.
+  addPreloaded(id) {
+    if (id) this._preloaded.add(id);
+  }
+
+  has(sessionId, eventId) {
+    if (this._preloaded.has(eventId)) return true;
+    const s = this._bySession.get(sessionId);
+    return s ? s.has(eventId) : false;
+  }
+
+  add(sessionId, eventId) {
+    let s = this._bySession.get(sessionId);
+    if (!s) { s = new Set(); this._bySession.set(sessionId, s); }
+    s.add(eventId);
+  }
+
+  // Drop a terminated session's runtime id set — it will never be re-fetched,
+  // so its ids no longer need to be remembered for dedup.
+  forgetSession(sessionId) {
+    this._bySession.delete(sessionId);
+  }
+
+  // Total tracked ids (preloaded + all live per-session sets). For observability.
+  get size() {
+    let n = this._preloaded.size;
+    for (const s of this._bySession.values()) n += s.size;
+    return n;
+  }
+
+  // Number of sessions currently holding a runtime id set.
+  get sessionCount() {
+    return this._bySession.size;
+  }
+}