watchmyagents 1.4.4 → 1.4.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmyagents",
-  "version": "1.4.4",
+  "version": "1.4.6",
   "description": "Security observability + real-time policy enforcement for AI agents. Local-first NDJSON capture with a continuous Watch daemon that auto-uploads anonymized signals, Shield CLI that blocks policy violations live (with policies pulled from Fortress cloud), anonymizer producing signals-only payloads, bidirectional sync with WatchMyAgents Fortress, and one-command install as an always-on launchd/systemd service — closing the recursive Watch→Guardian→Shield security loop.",
   "type": "module",
   "files": [

package/scripts/shield.js

@@ -34,7 +34,7 @@ import {
 } from '../src/shield/enforce.js';
 import { maybePrintVersionAndExit } from '../src/version.js';
 import { DecisionLogger } from '../src/shield/decisions.js';
-import { listSessions, listAgents } from '../src/sources/anthropic-managed.js';
+import { listSessions, listAgents, fetchRawEvents } from '../src/sources/anthropic-managed.js';
 import { FortressPolicySource, postDecision } from '../src/shield/sources/fortress.js';
 import { resolveFortressBase, fortressEndpoint } from '../src/fortress/url.js';
 import { PolicyStream } from '../src/shield/policy-stream.js';
@@ -223,9 +223,21 @@ async function runSessionWorker({ sessionId, ctx }) {
   try {
     for await (const rawEvent of streamWithReconnect({
       apiKey, sessionId, signal, maxAttempts: 3,
-      onReconnect: ({ attempt, backoffMs, error }) => {
-        sinfo(sessionId, `reconnect attempt ${attempt}/3 in ${backoffMs}ms (${error.message})`);
+      onReconnect: ({ attempt, backoffMs, error, backfilled, afterId, backfillError }) => {
+        if (backfillError) {
+          swarn(sessionId, `reconnect backfill failed (continuing on live stream): ${backfillError.message}`);
+        } else if (backfilled) {
+          // F-55: surface that the gap was closed — these events would
+          // otherwise have been silently missed by enforcement.
+          sinfo(sessionId, `reconnect backfilled ${backfilled} missed event(s) after ${String(afterId).slice(0, 16)}…`);
+        } else {
+          sinfo(sessionId, `reconnect attempt ${attempt}/3 in ${backoffMs}ms (${error?.message ?? 'drop'})`);
+        }
       },
+      // F-55: close the enforcement blind window on reconnect — page the
+      // persisted events endpoint for everything the live stream missed
+      // during the drop, exclusive of the last id we already processed.
+      backfill: (afterId, sig) => fetchRawEvents(apiKey, sessionId, { afterId }),
     })) {
       processed++;
 

package/scripts/upload-fortress.js

@@ -139,6 +139,14 @@ async function main() {
   const args = parseArgs(process.argv.slice(2));
 
   const agentId = args['agent-id'];
+  // v1.4.6: provider-aware upload (Fortress OpenAI register flow). Default
+  // anthropic-managed for back-compat; pass --provider openai-agents (or
+  // WMA_PROVIDER) when uploading an OpenAI agent's local NDJSON.
+  const VALID_PROVIDERS = ['anthropic-managed', 'openai-agents'];
+  const provider = args.provider || process.env.WMA_PROVIDER || 'anthropic-managed';
+  if (!VALID_PROVIDERS.includes(provider)) {
+    die(`error: --provider must be one of ${VALID_PROVIDERS.join(', ')} (got "${provider}")`);
+  }
   const logDir = resolve(args['log-dir'] || './watchmyagents-logs');
   const apiKey = args['api-key'] || process.env.WMA_API_KEY;
   const salt = args.salt || process.env.WMA_SIGNALS_SALT;
@@ -160,11 +168,18 @@ async function main() {
   const fortressUrl = fortressBase ? fortressEndpoint(fortressBase, 'ingest-signals') : null;
 
   // Validation
-  if (!agentId) die('error: --agent-id required (Anthropic agent_id, e.g. agent_01ABC...)');
-  // Strict alphanumeric to prevent path traversal in collectFiles below
-  // (--agent-id ends up as a filesystem path segment).
-  if (!/^agent_[a-zA-Z0-9]+$/.test(agentId)) {
-    die(`error: --agent-id has invalid format (expected "agent_" + alphanumeric, got "${agentId}")`);
+  if (!agentId) die('error: --agent-id required (e.g. agent_01ABC... for Anthropic, or your agent name for OpenAI)');
+  // --agent-id ends up as a filesystem path segment → must be traversal-safe.
+  // Anthropic native ids are `agent_…`; other providers (OpenAI) use arbitrary
+  // but filesystem-safe agent names.
+  if (provider === 'anthropic-managed') {
+    if (!/^agent_[a-zA-Z0-9]+$/.test(agentId)) {
+      die(`error: --agent-id has invalid format for anthropic-managed (expected "agent_" + alphanumeric, got "${agentId}")`);
+    }
+  } else if (!/^[A-Za-z0-9._-]+$/.test(agentId) || agentId.includes('..')) {
+    // reject ".." explicitly: it passes the charset but is a path-traversal
+    // segment (agentId becomes a directory under logDir in collectFiles).
+    die(`error: --agent-id has unsafe characters or path traversal (allowed: letters, digits, . _ - ; no "..", got "${agentId}")`);
   }
   if (!dryRun && !fortressUrl) {
     die('error: --fortress-url or WMA_FORTRESS_URL required (full URL to /functions/v1/ingest-signals).\n' +
@@ -231,12 +246,15 @@ async function main() {
   // call. Best-effort: send the max; the daemon's subsequent uploads
   // will correct the value once it resolves.
   const body = {
-    provider: AnthropicManagedSource.providerName,
+    provider,
     native_agent_id: agentId,
-    anthropic_agent_id: agentId,
+    // legacy field only meaningful for the Anthropic runtime
+    anthropic_agent_id: provider === 'anthropic-managed' ? agentId : undefined,
     parent_agent_id: null,
     composition_pattern: 'solo',
-    enforcement_mode: AnthropicManagedSource.enforcementMode,
+    // enforcement_mode is an Anthropic confirm-vs-interrupt concept; don't
+    // send a misleading Anthropic value for other runtimes (Fortress defaults).
+    enforcement_mode: provider === 'anthropic-managed' ? AnthropicManagedSource.enforcementMode : undefined,
     display_name: displayName,
     window_start: signals.window_start,
     window_end: signals.window_end,

package/src/openai-agents.js

@@ -40,11 +40,24 @@ import {
   attachWmaWatchToAgent,
   adapterMeta,
 } from './sources/openai-agents-js.js';
+import { FortressPolicySource } from './shield/sources/fortress.js';
+import { resolveFortressBase } from './fortress/url.js';
 
 /**
  * Build the WMA OpenAI Agents SDK adapter from a single shared config.
  *
  * @param {object} [options]
+ * @param {string} [options.agentId]           v1.4.6 — the agent id registered
+ *                                             in Fortress. Used as the NDJSON
+ *                                             path segment + native_agent_id,
+ *                                             and to scope the Fortress policy
+ *                                             pull. Required with
+ *                                             policies.source='fortress'.
+ * @param {object} [options.policies]          v1.4.6 — live policy source.
+ *   `{ source: 'fortress', baseUrl?, apiKey?, requireSignedPolicies?, failMode? }`
+ *   pulls the ruleset from Fortress (apiKey defaults to WMA_API_KEY, baseUrl to
+ *   WMA_FORTRESS_BASE_URL) and refreshes it in the background — the same control
+ *   plane wma-shield uses for Anthropic.
  * @param {string} [options.policiesPath]      Local JSON policy file.
  * @param {object} [options.ruleset]           In-memory ruleset.
  * @param {string} [options.logDir]            NDJSON log dir.
@@ -82,22 +95,64 @@ export function openaiAgents(options = {}) {
     );
   }
 
+  // v1.4.6 — Fortress live policy source (the OpenAI register flow). When
+  // `policies: { source: 'fortress' }` is set, build a FortressPolicySource
+  // that the guardrail pulls from (+ background refresh), mirroring how
+  // wma-shield gets its ruleset for Anthropic. Requires an agentId to scope
+  // the pull, a base URL (option or WMA_FORTRESS_BASE_URL), and WMA_API_KEY.
+  let fortressPolicySource = null;
+  if (options.policies && options.policies.source === 'fortress') {
+    if (!options.agentId) {
+      throw new Error(
+        "openaiAgents({ policies: { source: 'fortress' } }) requires `agentId` " +
+        "(the agent id you registered in Fortress) to scope the policy pull.",
+      );
+    }
+    const apiKey = options.policies.apiKey || process.env.WMA_API_KEY;
+    if (!apiKey) {
+      throw new Error(
+        "openaiAgents fortress policies: WMA_API_KEY is required (env or " +
+        "policies.apiKey) to authenticate the policy pull.",
+      );
+    }
+    const base = resolveFortressBase({
+      explicitBase: options.policies.baseUrl,
+      env: process.env,
+    });
+    if (!base) {
+      throw new Error(
+        "openaiAgents fortress policies: no base URL — set policies.baseUrl or " +
+        "WMA_FORTRESS_BASE_URL (e.g. https://<project>.supabase.co/functions/v1).",
+      );
+    }
+    fortressPolicySource = new FortressPolicySource({
+      apiKey,
+      base,
+      anthropicAgentId: options.agentId,   // scopes get-policies by native agent id
+      requireSignedPolicies: options.policies.requireSignedPolicies,
+      failMode: options.policies.failMode,
+    });
+  }
+
   // v1.4 Codex #2 — fail-loud refusal to start in enforce mode without
   // any policy source. Avoids the v1.3.0 footgun where missing policies
   // silently degraded to "allow all" with only a stderr warning. The
   // failure surfaces at config time (not on the first request) so it's
   // impossible to deploy a build that LOOKS armed but isn't.
-  if (mode === 'enforce' && options.policiesPath == null && options.ruleset == null) {
+  if (mode === 'enforce' && options.policiesPath == null && options.ruleset == null
+      && fortressPolicySource == null) {
     throw new Error(
-      "openaiAgents({ mode: 'enforce' }) requires policiesPath or ruleset. " +
-      "Either provide one, or switch to { mode: 'observe' } if you only " +
-      "want Watch (NDJSON capture) without Shield enforcement.",
+      "openaiAgents({ mode: 'enforce' }) requires policiesPath, ruleset, or " +
+      "policies: { source: 'fortress' }. Either provide one, or switch to " +
+      "{ mode: 'observe' } if you only want Watch (NDJSON capture) without Shield.",
     );
   }
 
   // Shared config we thread into both shield() and watch() so the
   // customer doesn't have to repeat it.
   const sharedOptions = {
+    agentId:         options.agentId,            // v1.4.6: NDJSON path + native_agent_id
+    fortressPolicySource,                        // v1.4.6: live Fortress ruleset (or null)
     policiesPath:    options.policiesPath,
     ruleset:         options.ruleset,
     logDir:          options.logDir,

package/src/shield/stream.js

@@ -177,15 +177,68 @@ function parseFrame(frame) {
   catch { return null; }
 }
 
+// v1.4.5 F-55 (P1 audit): bounded set of recently-yielded event ids. The
+// reconnect path can re-deliver events (backfill tail overlapping the resumed
+// live head, or an upstream redelivering after a drop). De-duplicating by id
+// makes the whole stream idempotent so Shield never double-enforces /
+// double-records the same event. Bounded so a long-lived stream can't grow it
+// without limit; ordered eviction drops the oldest ids first.
+export function makeSeenIdSet(cap = 4096) {
+  const set = new Set();
+  return {
+    seen(id) {
+      if (set.has(id)) return true;
+      set.add(id);
+      if (set.size > cap) {
+        // Evict oldest insertion-order ids down to ~90% of cap.
+        const target = Math.floor(cap * 0.9);
+        for (const old of set) {
+          set.delete(old);
+          if (set.size <= target) break;
+        }
+      }
+      return false;
+    },
+  };
+}
+
 // High-level wrapper: stream forever, reconnecting on transient errors.
 // Yields events; on fatal/permanent errors throws after maxAttempts.
-export async function* streamWithReconnect({ apiKey, sessionId, signal, maxAttempts = 5, onReconnect }) {
+//
+// v1.4.5 F-55 (P1 audit): SSE reconnect previously re-opened the stream at the
+// LIVE position with no resume cursor, so every event emitted during the drop
+// window was lost — including a `requires_action` (which pauses the agent
+// waiting on Shield) or the `agent.tool_use` that must be cached before it.
+// That was a silent enforcement blind window. Now, before resuming the live
+// stream after a drop, we BACKFILL the gap: page the persisted events endpoint
+// for everything after the last id we yielded, feed those through, then resume
+// live. Yielded ids are de-duplicated so the backfill/live overlap can't cause
+// double-processing.
+//
+// `backfill(afterId, signal)` — optional async-iterable factory the caller
+// injects (Shield passes one backed by fetchRawEvents with `afterId`). Kept as
+// an injected dependency so this module stays import-free of the Anthropic
+// source and remains unit-testable with a stub.
+export async function* streamWithReconnect({ apiKey, sessionId, signal, maxAttempts = 5, onReconnect, backfill, _openStream = openEventStream }) {
   let attempt = 0;
+  let lastEventId = null;
+  const dedup = makeSeenIdSet();
+
+  // Yield an event unless we've already emitted it; track the last id so a
+  // reconnect knows where to backfill from.
+  function shouldYield(ev) {
+    if (ev && ev.id != null) {
+      if (dedup.seen(ev.id)) return false;
+      lastEventId = ev.id;
+    }
+    return true;
+  }
+
   while (true) {
     try {
-      for await (const ev of openEventStream({ apiKey, sessionId, signal })) {
+      for await (const ev of _openStream({ apiKey, sessionId, signal })) {
         attempt = 0; // any event resets the backoff
-        yield ev;
+        if (shouldYield(ev)) yield ev;
       }
       // Stream ended without throwing — session likely closed cleanly. Exit.
       return;
@@ -198,6 +251,22 @@ export async function* streamWithReconnect({ apiKey, sessionId, signal, maxAttem
       const backoffMs = Math.min(30_000, 1000 * 2 ** (attempt - 1));
       if (onReconnect) onReconnect({ attempt, backoffMs, error: e });
       await new Promise(r => setTimeout(r, backoffMs));
+
+      // F-55: backfill the gap the live stream missed before reconnecting.
+      // Best-effort: a backfill failure must not abort enforcement — we log
+      // it and fall through to the live re-open, which will itself retry.
+      if (backfill && lastEventId && !signal?.aborted) {
+        try {
+          let backfilled = 0;
+          for await (const ev of backfill(lastEventId, signal)) {
+            if (signal?.aborted) return;
+            if (shouldYield(ev)) { backfilled++; yield ev; }
+          }
+          if (backfilled && onReconnect) onReconnect({ attempt, backfilled, afterId: lastEventId });
+        } catch (be) {
+          if (onReconnect) onReconnect({ attempt, backfillError: be });
+        }
+      }
     }
   }
 }

package/src/shield/upload.js

@@ -63,6 +63,14 @@ export function buildFortressDecisionPayload({
   // enforcement instead of trusting the computed verdict. Boolean only; no
   // raw content, so Containment is unaffected.
   enforcementDelivered,
+  // v1.4.6 (SDK prereq for the Fortress OpenAI register flow): provider +
+  // native_agent_id so Fortress's ingest-decisions attributes the decision to
+  // the right runtime. Defaults preserve the legacy Anthropic shape
+  // (provider='anthropic-managed', anthropic_agent_id=agentId) so existing
+  // callers (wma-shield) are unchanged. ingest-decisions keys on
+  // (provider, native_agent_id) with a fallback to anthropic_agent_id.
+  provider,
+  nativeAgentId,
 }) {
   // F-19: vendor built-ins survive even without a salt (allowlist short-circuit);
   // custom tool names throw without a salt — we catch and drop the field.
@@ -76,8 +84,13 @@ export function buildFortressDecisionPayload({
     }
   }
 
+  const effectiveProvider = provider || 'anthropic-managed';
   return {
-    anthropic_agent_id: agentId,
+    provider: effectiveProvider,
+    native_agent_id: nativeAgentId || agentId,
+    // Keep the legacy field only for the Anthropic runtime (an OpenAI agent id
+    // is not an `agent_…` value and the field is meaningless there).
+    anthropic_agent_id: effectiveProvider === 'anthropic-managed' ? agentId : undefined,
     decision: result.decision,
     rule_id: result.rule_id || undefined,
     session_hash: hashWithSaltOpt(sessionId, signalsSalt) || undefined,

package/src/sources/anthropic-managed.js

@@ -168,8 +168,12 @@ export async function listSessions(apiKey, { agentId, since, limit = 100, maxPag
 
 // Yields raw events in chronological order. Accepts an optional types filter
 // to reduce payload (server-side `types[]=...&types[]=...`).
-export async function* fetchRawEvents(apiKey, sessionId, { types } = {}) {
-  let after = null;
+export async function* fetchRawEvents(apiKey, sessionId, { types, afterId } = {}) {
+  // v1.4.5 F-55: `afterId` lets a caller page only events AFTER a known id
+  // (exclusive) — used by Shield's reconnect backfill to fetch exactly the
+  // gap that the live SSE stream missed during a drop, rather than re-walking
+  // the whole session.
+  let after = afterId || null;
   while (true) {
     const qs = new URLSearchParams({ limit: '1000' });
     if (after) qs.set('after_id', after);

package/src/sources/openai-agents-js.js

@@ -478,12 +478,13 @@ export function wmaToolInputGuardrail(options = {}) {
   const hasPolicySource =
     options.policiesPath != null ||
     options.ruleset != null ||
+    options.fortressPolicySource != null ||   // v1.4.6: live Fortress source
     options.allowAllWhenUnconfigured === true;
   if (!hasPolicySource) {
     throw new Error(
-      'wmaToolInputGuardrail: no policy configured. Pass policiesPath or ruleset. ' +
-      'For demos / smoke tests that intentionally allow all tool calls, pass ' +
-      '{ allowAllWhenUnconfigured: true } explicitly.',
+      'wmaToolInputGuardrail: no policy configured. Pass policiesPath, ruleset, or ' +
+      'fortressPolicySource. For demos / smoke tests that intentionally allow all ' +
+      'tool calls, pass { allowAllWhenUnconfigured: true } explicitly.',
     );
   }
 
@@ -502,10 +503,16 @@ export function wmaToolInputGuardrail(options = {}) {
   // mis-attributed to 'anthropic-managed' (DecisionLogger's pre-v1.3.1
   // hardcoded default). Fortress / Guardian forensic surfaces depend on
   // this for correct multi-provider attribution.
+  // v1.4.6: when the customer registers a named agent (Fortress OpenAI flow),
+  // use that id for the NDJSON path + as the native_agent_id, instead of the
+  // generic 'openai-agents'. Falls back to 'openai-agents' for the un-named
+  // single-agent case (backward compatible). assertSafePathSegment in the
+  // Logger validates it as a path segment (fails loud on an unsafe name).
+  const loggerAgentId = options.agentId || 'openai-agents';
   const decisionLogger = options.decisionLogger
-    || new DecisionLogger({ logDir, agentId: 'openai-agents', sessionId, provider: PROVIDER });
+    || new DecisionLogger({ logDir, agentId: loggerAgentId, sessionId, provider: PROVIDER });
   const logger = options.logger
-    || new Logger({ logDir, agentId: 'openai-agents', sessionId, silent: true, bestEffort: false });
+    || new Logger({ logDir, agentId: loggerAgentId, sessionId, silent: true, bestEffort: false });
 
   // Team tracker — re-used for the entire run of this guardrail.
   const envTeamId = teamIdFromEnv();
@@ -516,7 +523,26 @@ export function wmaToolInputGuardrail(options = {}) {
     : () => teamTracker.bootstrap(sessionId);
 
   // Lazily load the ruleset on first invocation if a path was given.
+  // v1.4.6: SINGLE-FLIGHT start. start() creates a setInterval, so two
+  // concurrent first tool-calls must NOT both call it (that leaks a second
+  // timer the source can't clear + double-fetches). They share one promise;
+  // on failure we reset it so the next call retries (and that call fails
+  // CLOSED via the guardrail's try/catch in the meantime).
+  let fortressStartPromise = null;
   async function ensureRuleset() {
+    // v1.4.6: live Fortress policy source — pull on first call + background
+    // refresh (the source owns a setInterval; its timer is unref'd so it can't
+    // keep the process alive). On initial-fetch failure start() throws, which
+    // propagates to the guardrail's try/catch → that tool call fails CLOSED
+    // (default) and we retry start() next call rather than caching a failure.
+    if (options.fortressPolicySource) {
+      if (!fortressStartPromise) {
+        fortressStartPromise = Promise.resolve(options.fortressPolicySource.start())
+          .catch((e) => { fortressStartPromise = null; throw e; });
+      }
+      await fortressStartPromise;
+      return options.fortressPolicySource.current();
+    }
     if (ruleset != null) return ruleset;
     if (options.policiesPath) {
       ruleset = await loadPolicies(options.policiesPath);
@@ -588,6 +614,13 @@ export function wmaToolInputGuardrail(options = {}) {
         const decidedInMs = Date.now() - t0;
 
         // 4. Audit-grade log (chain-signed).
+        // v1.4.6: the in-process guardrail delivers a block SYNCHRONOUSLY by
+        // returning rejectContent/throwException below — there is no separate
+        // enforcement API call that can fail (unlike Anthropic's async
+        // interrupt). So an enforced deny/interrupt IS delivered: record it as
+        // such. undefined when not applicable (allow / shadow).
+        const enforcedBlock = result.mode !== 'shadow'
+          && (result.decision === 'deny' || result.decision === 'interrupt');
         await decisionLogger.record({
           sourceEvent: { id: event.id, type: event.action_type, tool_name: event.tool_name, input: event.input },
           decision: result.decision,
@@ -596,6 +629,7 @@ export function wmaToolInputGuardrail(options = {}) {
           message: result.message,
           decidedInMs,
           mode: result.mode,
+          enforcementDelivered: enforcedBlock ? true : undefined,
         });
 
         // 5. Watch log (the event itself, separate from the decision).