watchmyagents 1.4.3 → 1.4.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmyagents",
-  "version": "1.4.3",
+  "version": "1.4.5",
   "description": "Security observability + real-time policy enforcement for AI agents. Local-first NDJSON capture with a continuous Watch daemon that auto-uploads anonymized signals, Shield CLI that blocks policy violations live (with policies pulled from Fortress cloud), anonymizer producing signals-only payloads, bidirectional sync with WatchMyAgents Fortress, and one-command install as an always-on launchd/systemd service — closing the recursive Watch→Guardian→Shield security loop.",
   "type": "module",
   "files": [

package/scripts/fetch-anthropic.js

@@ -383,17 +383,25 @@ async function runWatch({ apiKey, resolveAgents, fleet, logDir, intervalMs, wind
   let agents = await resolveAgents();
   // v1.4.3 F-51: bounded dedup. Preloaded on-disk ids are static; runtime ids
   // are tracked per-session and dropped on terminate (see src/watch-state.js).
-  const preloaded = [];
-  for (const ag of agents) {
-    for (const id of await preloadSeenIds(logDir, ag.agentId)) preloaded.push(id);
+  const seen = new SeenTracker();
+  // v1.4.4 F-53: preload each agent's on-disk history the FIRST time we see it
+  // — including agents that --all-agents discovers after startup. Pre-fix the
+  // preload ran once for the initial fleet only, so a late-appearing agent with
+  // existing logs re-appended + re-uploaded already-captured events.
+  const preloadedAgents = new Set();
+  async function ensurePreloaded(agentId) {
+    if (preloadedAgents.has(agentId)) return;
+    preloadedAgents.add(agentId);
+    for (const id of await preloadSeenIds(logDir, agentId)) seen.addPreloaded(id);
   }
-  const seen = new SeenTracker(preloaded);
+  for (const ag of agents) await ensurePreloaded(ag.agentId);
   const loggers = new Map();     // sessionId → Logger (session ids are globally unique)
-  const ended = new Set();       // terminated sessions (skip). Grows one id per
-                                  // terminated session over the daemon's life —
-                                  // bounded by session COUNT (ids only, the
-                                  // smallest term); the per-EVENT growth that
-                                  // actually drove OOM is fixed via SeenTracker.
+  // terminated sessions (skip). v1.4.4 F-54: a Map<sid → terminatedAtMs> so we
+  // can TTL-prune. A session terminated more than windowMs ago has created_at
+  // older still, so listSessions (which filters created_at < since, since =
+  // now - windowMs) can no longer return it — its id is then safe to forget,
+  // bounding this map's growth on a long daemon with many short sessions.
+  const ended = new Map();
   const sessionAgent = new Map();// sessionId → { agentId, model, displayName }
   const priors = new Map();      // agentId → previous classification (threads the
                                   // typology state machine across upload cycles)
@@ -413,9 +421,20 @@ async function runWatch({ apiKey, resolveAgents, fleet, logDir, intervalMs, wind
     if (fleet) { const next = await resolveAgents(); if (next.length) agents = next; }
     const since = new Date(Date.now() - windowMs);
 
+    // F-54: forget sessions terminated longer ago than the discovery window —
+    // listSessions can no longer surface them (created_at < since), so their
+    // skip-marker is no longer needed. Bounds `ended` on a long-running daemon.
+    const ttlCutoff = Date.now() - windowMs;
+    for (const [sid, terminatedAt] of ended) {
+      if (terminatedAt < ttlCutoff) ended.delete(sid);
+    }
+
     // (1) Discover sessions in the window; register the owning agent for each.
     for (const ag of agents) {
       if (ac.signal.aborted) break;
+      // F-53: a late-discovered agent (fleet mode) gets its disk history
+      // preloaded before we fetch any of its sessions, so dedup holds.
+      await ensurePreloaded(ag.agentId);
       const tag = fleet ? `[${ag.displayName}] ` : '';
       let sessions = [];
       try { sessions = await listSessions(apiKey, { agentId: ag.agentId, since }); }
@@ -507,7 +526,7 @@ async function runWatch({ apiKey, resolveAgents, fleet, logDir, intervalMs, wind
           session_tokens: { input: stats.input, output: stats.output, cache_read: stats.cache_read, cache_creation: stats.cache_creation, total: stats.sum },
           session_cost_usd: stats.cost_usd || null,
         });
-        ended.add(sid);
+        ended.set(sid, Date.now());
         // v1.4.3 F-51: bound memory — terminated sessions aren't re-fetched,
         // so drop their per-session dedup set AND their Logger object (the
         // latter was never deleted pre-fix → unbounded growth of Logger

package/scripts/shield.js

@@ -34,7 +34,7 @@ import {
 } from '../src/shield/enforce.js';
 import { maybePrintVersionAndExit } from '../src/version.js';
 import { DecisionLogger } from '../src/shield/decisions.js';
-import { listSessions, listAgents } from '../src/sources/anthropic-managed.js';
+import { listSessions, listAgents, fetchRawEvents } from '../src/sources/anthropic-managed.js';
 import { FortressPolicySource, postDecision } from '../src/shield/sources/fortress.js';
 import { resolveFortressBase, fortressEndpoint } from '../src/fortress/url.js';
 import { PolicyStream } from '../src/shield/policy-stream.js';
@@ -223,9 +223,21 @@ async function runSessionWorker({ sessionId, ctx }) {
   try {
     for await (const rawEvent of streamWithReconnect({
       apiKey, sessionId, signal, maxAttempts: 3,
-      onReconnect: ({ attempt, backoffMs, error }) => {
-        sinfo(sessionId, `reconnect attempt ${attempt}/3 in ${backoffMs}ms (${error.message})`);
+      onReconnect: ({ attempt, backoffMs, error, backfilled, afterId, backfillError }) => {
+        if (backfillError) {
+          swarn(sessionId, `reconnect backfill failed (continuing on live stream): ${backfillError.message}`);
+        } else if (backfilled) {
+          // F-55: surface that the gap was closed — these events would
+          // otherwise have been silently missed by enforcement.
+          sinfo(sessionId, `reconnect backfilled ${backfilled} missed event(s) after ${String(afterId).slice(0, 16)}…`);
+        } else {
+          sinfo(sessionId, `reconnect attempt ${attempt}/3 in ${backoffMs}ms (${error?.message ?? 'drop'})`);
+        }
       },
+      // F-55: close the enforcement blind window on reconnect — page the
+      // persisted events endpoint for everything the live stream missed
+      // during the drop, exclusive of the last id we already processed.
+      backfill: (afterId, sig) => fetchRawEvents(apiKey, sessionId, { afterId }),
     })) {
       processed++;
 

package/src/shield/stream.js

@@ -177,15 +177,68 @@ function parseFrame(frame) {
   catch { return null; }
 }
 
+// v1.4.5 F-55 (P1 audit): bounded set of recently-yielded event ids. The
+// reconnect path can re-deliver events (backfill tail overlapping the resumed
+// live head, or an upstream redelivering after a drop). De-duplicating by id
+// makes the whole stream idempotent so Shield never double-enforces /
+// double-records the same event. Bounded so a long-lived stream can't grow it
+// without limit; ordered eviction drops the oldest ids first.
+export function makeSeenIdSet(cap = 4096) {
+  const set = new Set();
+  return {
+    seen(id) {
+      if (set.has(id)) return true;
+      set.add(id);
+      if (set.size > cap) {
+        // Evict oldest insertion-order ids down to ~90% of cap.
+        const target = Math.floor(cap * 0.9);
+        for (const old of set) {
+          set.delete(old);
+          if (set.size <= target) break;
+        }
+      }
+      return false;
+    },
+  };
+}
+
 // High-level wrapper: stream forever, reconnecting on transient errors.
 // Yields events; on fatal/permanent errors throws after maxAttempts.
-export async function* streamWithReconnect({ apiKey, sessionId, signal, maxAttempts = 5, onReconnect }) {
+//
+// v1.4.5 F-55 (P1 audit): SSE reconnect previously re-opened the stream at the
+// LIVE position with no resume cursor, so every event emitted during the drop
+// window was lost — including a `requires_action` (which pauses the agent
+// waiting on Shield) or the `agent.tool_use` that must be cached before it.
+// That was a silent enforcement blind window. Now, before resuming the live
+// stream after a drop, we BACKFILL the gap: page the persisted events endpoint
+// for everything after the last id we yielded, feed those through, then resume
+// live. Yielded ids are de-duplicated so the backfill/live overlap can't cause
+// double-processing.
+//
+// `backfill(afterId, signal)` — optional async-iterable factory the caller
+// injects (Shield passes one backed by fetchRawEvents with `afterId`). Kept as
+// an injected dependency so this module stays import-free of the Anthropic
+// source and remains unit-testable with a stub.
+export async function* streamWithReconnect({ apiKey, sessionId, signal, maxAttempts = 5, onReconnect, backfill, _openStream = openEventStream }) {
   let attempt = 0;
+  let lastEventId = null;
+  const dedup = makeSeenIdSet();
+
+  // Yield an event unless we've already emitted it; track the last id so a
+  // reconnect knows where to backfill from.
+  function shouldYield(ev) {
+    if (ev && ev.id != null) {
+      if (dedup.seen(ev.id)) return false;
+      lastEventId = ev.id;
+    }
+    return true;
+  }
+
   while (true) {
     try {
-      for await (const ev of openEventStream({ apiKey, sessionId, signal })) {
+      for await (const ev of _openStream({ apiKey, sessionId, signal })) {
         attempt = 0; // any event resets the backoff
-        yield ev;
+        if (shouldYield(ev)) yield ev;
       }
       // Stream ended without throwing — session likely closed cleanly. Exit.
       return;
@@ -198,6 +251,22 @@ export async function* streamWithReconnect({ apiKey, sessionId, signal, maxAttem
       const backoffMs = Math.min(30_000, 1000 * 2 ** (attempt - 1));
       if (onReconnect) onReconnect({ attempt, backoffMs, error: e });
       await new Promise(r => setTimeout(r, backoffMs));
+
+      // F-55: backfill the gap the live stream missed before reconnecting.
+      // Best-effort: a backfill failure must not abort enforcement — we log
+      // it and fall through to the live re-open, which will itself retry.
+      if (backfill && lastEventId && !signal?.aborted) {
+        try {
+          let backfilled = 0;
+          for await (const ev of backfill(lastEventId, signal)) {
+            if (signal?.aborted) return;
+            if (shouldYield(ev)) { backfilled++; yield ev; }
+          }
+          if (backfilled && onReconnect) onReconnect({ attempt, backfilled, afterId: lastEventId });
+        } catch (be) {
+          if (onReconnect) onReconnect({ attempt, backfillError: be });
+        }
+      }
     }
   }
 }

package/src/sources/anthropic-managed.js

@@ -168,8 +168,12 @@ export async function listSessions(apiKey, { agentId, since, limit = 100, maxPag
 
 // Yields raw events in chronological order. Accepts an optional types filter
 // to reduce payload (server-side `types[]=...&types[]=...`).
-export async function* fetchRawEvents(apiKey, sessionId, { types } = {}) {
-  let after = null;
+export async function* fetchRawEvents(apiKey, sessionId, { types, afterId } = {}) {
+  // v1.4.5 F-55: `afterId` lets a caller page only events AFTER a known id
+  // (exclusive) — used by Shield's reconnect backfill to fetch exactly the
+  // gap that the live SSE stream missed during a drop, rather than re-walking
+  // the whole session.
+  let after = afterId || null;
   while (true) {
     const qs = new URLSearchParams({ limit: '1000' });
     if (after) qs.set('after_id', after);
@@ -265,6 +269,18 @@ export async function* transformRawEventsToWMAActions(rawEventsAsyncIterable, {
   // distinct API-level IDs will populate parent_agent_id natively.
   const subThreadIds = new Set();
 
+  // v1.4.4 F-52 (P2 audit): only emit the end-of-stream "no_result_observed"
+  // flush when the session ACTUALLY terminated in this stream. In watch mode
+  // fetchRawEvents re-fetches the FULL session every cycle, so a tool whose
+  // start lands in cycle N but whose result lands in cycle N+1 would, with an
+  // unconditional flush, get a phantom no_result_observed row (id = start id)
+  // in cycle N AND the real paired row (id = result id) in cycle N+1 — a
+  // double-count + persistent phantom error skewing error_rate_by_tool. While
+  // the session is still running an unpaired start is in-flight, not
+  // "no result observed"; it stays pending and pairs (or flushes) once the
+  // session's terminal state is observed.
+  let sessionTerminated = false;
+
   // `provider` is the canonical field per src/sources/contract.js (no
   // other consumer ever read the previous `framework` field, so it was
   // dropped in PR-B with zero downstream impact).
@@ -632,6 +648,8 @@ export async function* transformRawEventsToWMAActions(rawEventsAsyncIterable, {
       const prefix = isThread ? 'session.thread_status_' : 'session.status_';
       const state = type.slice(prefix.length); // 'running' | 'idle' | 'rescheduled' | 'terminated'
       const fatal = state === 'terminated';
+      // F-52: a SESSION-scope terminate (not a sub-thread one) gates the flush.
+      if (fatal && !isThread) sessionTerminated = true;
       yield {
         ...base,
         ...subAgentMeta,
@@ -666,6 +684,16 @@ export async function* transformRawEventsToWMAActions(rawEventsAsyncIterable, {
   // explicitly with status='error' keeps the local NDJSON, anonymizer
   // signals (counts, IoC hashes, tool_counts), and Fortress decisions
   // honest about what actually happened.
+  //
+  // v1.4.4 F-52: GATED on sessionTerminated. If the session is still running
+  // (watch mode re-fetches the full session every cycle), an unpaired start is
+  // in-flight, not lost — flushing it now would create a phantom row that the
+  // next cycle's real paired row double-counts. We only flush once the
+  // session's terminal state proves the calls genuinely never resolved. (Both
+  // F-8 and F-50 flush tests feed a session.status_terminated event, so this
+  // gate is satisfied for them.)
+  if (!sessionTerminated) return;
+
   for (const [toolUseId, pending] of pendingToolUse) {
     yield {
       ...base,

package/src/watch-state.js

@@ -24,6 +24,15 @@ export class SeenTracker {
     this._bySession = new Map();   // sessionId -> Set<eventId>
   }
 
+  // v1.4.4 F-53: fold an agent's on-disk history into the static preloaded
+  // set. Called lazily the first time an agent is seen (including agents that
+  // --all-agents discovers AFTER startup) so their already-captured NDJSON ids
+  // are deduped against — otherwise a late-appearing agent with existing logs
+  // would re-append and re-upload events it already has.
+  addPreloaded(id) {
+    if (id) this._preloaded.add(id);
+  }
+
   has(sessionId, eventId) {
     if (this._preloaded.has(eventId)) return true;
     const s = this._bySession.get(sessionId);