watchmyagents 1.4.5 → 1.4.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmyagents",
-  "version": "1.4.5",
+  "version": "1.4.7",
   "description": "Security observability + real-time policy enforcement for AI agents. Local-first NDJSON capture with a continuous Watch daemon that auto-uploads anonymized signals, Shield CLI that blocks policy violations live (with policies pulled from Fortress cloud), anonymizer producing signals-only payloads, bidirectional sync with WatchMyAgents Fortress, and one-command install as an always-on launchd/systemd service — closing the recursive Watch→Guardian→Shield security loop.",
   "type": "module",
   "files": [

package/scripts/upload-fortress.js

@@ -139,6 +139,14 @@ async function main() {
   const args = parseArgs(process.argv.slice(2));
 
   const agentId = args['agent-id'];
+  // v1.4.6: provider-aware upload (Fortress OpenAI register flow). Default
+  // anthropic-managed for back-compat; pass --provider openai-agents (or
+  // WMA_PROVIDER) when uploading an OpenAI agent's local NDJSON.
+  const VALID_PROVIDERS = ['anthropic-managed', 'openai-agents'];
+  const provider = args.provider || process.env.WMA_PROVIDER || 'anthropic-managed';
+  if (!VALID_PROVIDERS.includes(provider)) {
+    die(`error: --provider must be one of ${VALID_PROVIDERS.join(', ')} (got "${provider}")`);
+  }
   const logDir = resolve(args['log-dir'] || './watchmyagents-logs');
   const apiKey = args['api-key'] || process.env.WMA_API_KEY;
   const salt = args.salt || process.env.WMA_SIGNALS_SALT;
@@ -160,11 +168,18 @@ async function main() {
   const fortressUrl = fortressBase ? fortressEndpoint(fortressBase, 'ingest-signals') : null;
 
   // Validation
-  if (!agentId) die('error: --agent-id required (Anthropic agent_id, e.g. agent_01ABC...)');
-  // Strict alphanumeric to prevent path traversal in collectFiles below
-  // (--agent-id ends up as a filesystem path segment).
-  if (!/^agent_[a-zA-Z0-9]+$/.test(agentId)) {
-    die(`error: --agent-id has invalid format (expected "agent_" + alphanumeric, got "${agentId}")`);
+  if (!agentId) die('error: --agent-id required (e.g. agent_01ABC... for Anthropic, or your agent name for OpenAI)');
+  // --agent-id ends up as a filesystem path segment → must be traversal-safe.
+  // Anthropic native ids are `agent_…`; other providers (OpenAI) use arbitrary
+  // but filesystem-safe agent names.
+  if (provider === 'anthropic-managed') {
+    if (!/^agent_[a-zA-Z0-9]+$/.test(agentId)) {
+      die(`error: --agent-id has invalid format for anthropic-managed (expected "agent_" + alphanumeric, got "${agentId}")`);
+    }
+  } else if (!/^[A-Za-z0-9._-]+$/.test(agentId) || agentId.includes('..')) {
+    // reject ".." explicitly: it passes the charset but is a path-traversal
+    // segment (agentId becomes a directory under logDir in collectFiles).
+    die(`error: --agent-id has unsafe characters or path traversal (allowed: letters, digits, . _ - ; no "..", got "${agentId}")`);
   }
   if (!dryRun && !fortressUrl) {
     die('error: --fortress-url or WMA_FORTRESS_URL required (full URL to /functions/v1/ingest-signals).\n' +
@@ -231,12 +246,15 @@ async function main() {
   // call. Best-effort: send the max; the daemon's subsequent uploads
   // will correct the value once it resolves.
   const body = {
-    provider: AnthropicManagedSource.providerName,
+    provider,
     native_agent_id: agentId,
-    anthropic_agent_id: agentId,
+    // legacy field only meaningful for the Anthropic runtime
+    anthropic_agent_id: provider === 'anthropic-managed' ? agentId : undefined,
     parent_agent_id: null,
     composition_pattern: 'solo',
-    enforcement_mode: AnthropicManagedSource.enforcementMode,
+    // enforcement_mode is an Anthropic confirm-vs-interrupt concept; don't
+    // send a misleading Anthropic value for other runtimes (Fortress defaults).
+    enforcement_mode: provider === 'anthropic-managed' ? AnthropicManagedSource.enforcementMode : undefined,
     display_name: displayName,
     window_start: signals.window_start,
     window_end: signals.window_end,

package/src/openai-agents.js

@@ -40,11 +40,24 @@ import {
   attachWmaWatchToAgent,
   adapterMeta,
 } from './sources/openai-agents-js.js';
+import { FortressPolicySource, postDecision } from './shield/sources/fortress.js';
+import { resolveFortressBase } from './fortress/url.js';
 
 /**
  * Build the WMA OpenAI Agents SDK adapter from a single shared config.
  *
  * @param {object} [options]
+ * @param {string} [options.agentId]           v1.4.6 — the agent id registered
+ *                                             in Fortress. Used as the NDJSON
+ *                                             path segment + native_agent_id,
+ *                                             and to scope the Fortress policy
+ *                                             pull. Required with
+ *                                             policies.source='fortress'.
+ * @param {object} [options.policies]          v1.4.6 — live policy source.
+ *   `{ source: 'fortress', baseUrl?, apiKey?, requireSignedPolicies?, failMode? }`
+ *   pulls the ruleset from Fortress (apiKey defaults to WMA_API_KEY, baseUrl to
+ *   WMA_FORTRESS_BASE_URL) and refreshes it in the background — the same control
+ *   plane wma-shield uses for Anthropic.
  * @param {string} [options.policiesPath]      Local JSON policy file.
  * @param {object} [options.ruleset]           In-memory ruleset.
  * @param {string} [options.logDir]            NDJSON log dir.
@@ -82,22 +95,75 @@ export function openaiAgents(options = {}) {
     );
   }
 
+  // v1.4.6 — Fortress live policy source (the OpenAI register flow). When
+  // `policies: { source: 'fortress' }` is set, build a FortressPolicySource
+  // that the guardrail pulls from (+ background refresh), mirroring how
+  // wma-shield gets its ruleset for Anthropic. Requires an agentId to scope
+  // the pull, a base URL (option or WMA_FORTRESS_BASE_URL), and WMA_API_KEY.
+  let fortressPolicySource = null;
+  let fortressDecisionSink = null;
+  if (options.policies && options.policies.source === 'fortress') {
+    if (!options.agentId) {
+      throw new Error(
+        "openaiAgents({ policies: { source: 'fortress' } }) requires `agentId` " +
+        "(the agent id you registered in Fortress) to scope the policy pull.",
+      );
+    }
+    const apiKey = options.policies.apiKey || process.env.WMA_API_KEY;
+    if (!apiKey) {
+      throw new Error(
+        "openaiAgents fortress policies: WMA_API_KEY is required (env or " +
+        "policies.apiKey) to authenticate the policy pull.",
+      );
+    }
+    const base = resolveFortressBase({
+      explicitBase: options.policies.baseUrl,
+      env: process.env,
+    });
+    if (!base) {
+      throw new Error(
+        "openaiAgents fortress policies: no base URL — set policies.baseUrl or " +
+        "WMA_FORTRESS_BASE_URL (e.g. https://<project>.supabase.co/functions/v1).",
+      );
+    }
+    fortressPolicySource = new FortressPolicySource({
+      apiKey,
+      base,
+      anthropicAgentId: options.agentId,   // scopes get-policies by native agent id
+      requireSignedPolicies: options.policies.requireSignedPolicies,
+      failMode: options.policies.failMode,
+    });
+
+    // v1.4.7 (#1): ship decisions to the SAME Fortress (the control plane you
+    // pull policies from is where the decisions belong). Auto-on; opt out with
+    // policies.uploadDecisions === false to keep decisions local-only. The
+    // guardrail fires these best-effort, off its hot path.
+    if (options.policies.uploadDecisions !== false) {
+      fortressDecisionSink = (decision) => postDecision({ apiKey, base, decision });
+    }
+  }
+
   // v1.4 Codex #2 — fail-loud refusal to start in enforce mode without
   // any policy source. Avoids the v1.3.0 footgun where missing policies
   // silently degraded to "allow all" with only a stderr warning. The
   // failure surfaces at config time (not on the first request) so it's
   // impossible to deploy a build that LOOKS armed but isn't.
-  if (mode === 'enforce' && options.policiesPath == null && options.ruleset == null) {
+  if (mode === 'enforce' && options.policiesPath == null && options.ruleset == null
+      && fortressPolicySource == null) {
     throw new Error(
-      "openaiAgents({ mode: 'enforce' }) requires policiesPath or ruleset. " +
-      "Either provide one, or switch to { mode: 'observe' } if you only " +
-      "want Watch (NDJSON capture) without Shield enforcement.",
+      "openaiAgents({ mode: 'enforce' }) requires policiesPath, ruleset, or " +
+      "policies: { source: 'fortress' }. Either provide one, or switch to " +
+      "{ mode: 'observe' } if you only want Watch (NDJSON capture) without Shield.",
     );
   }
 
   // Shared config we thread into both shield() and watch() so the
   // customer doesn't have to repeat it.
   const sharedOptions = {
+    agentId:         options.agentId,            // v1.4.6: NDJSON path + native_agent_id
+    fortressPolicySource,                        // v1.4.6: live Fortress ruleset (or null)
+    fortressDecisionSink,                        // v1.4.7 #1: ship decisions (or null)
+    signalsSalt:     options.signalsSalt || process.env.WMA_SIGNALS_SALT,  // hash session/input
     policiesPath:    options.policiesPath,
     ruleset:         options.ruleset,
     logDir:          options.logDir,

package/src/shield/upload.js

@@ -63,6 +63,14 @@ export function buildFortressDecisionPayload({
   // enforcement instead of trusting the computed verdict. Boolean only; no
   // raw content, so Containment is unaffected.
   enforcementDelivered,
+  // v1.4.6 (SDK prereq for the Fortress OpenAI register flow): provider +
+  // native_agent_id so Fortress's ingest-decisions attributes the decision to
+  // the right runtime. Defaults preserve the legacy Anthropic shape
+  // (provider='anthropic-managed', anthropic_agent_id=agentId) so existing
+  // callers (wma-shield) are unchanged. ingest-decisions keys on
+  // (provider, native_agent_id) with a fallback to anthropic_agent_id.
+  provider,
+  nativeAgentId,
 }) {
   // F-19: vendor built-ins survive even without a salt (allowlist short-circuit);
   // custom tool names throw without a salt — we catch and drop the field.
@@ -76,8 +84,13 @@ export function buildFortressDecisionPayload({
     }
   }
 
+  const effectiveProvider = provider || 'anthropic-managed';
   return {
-    anthropic_agent_id: agentId,
+    provider: effectiveProvider,
+    native_agent_id: nativeAgentId || agentId,
+    // Keep the legacy field only for the Anthropic runtime (an OpenAI agent id
+    // is not an `agent_…` value and the field is meaningless there).
+    anthropic_agent_id: effectiveProvider === 'anthropic-managed' ? agentId : undefined,
     decision: result.decision,
     rule_id: result.rule_id || undefined,
     session_hash: hashWithSaltOpt(sessionId, signalsSalt) || undefined,

package/src/sources/openai-agents-js.js

@@ -54,6 +54,7 @@ import {
 import { evaluate, loadPolicies } from '../shield/policy.js';
 import { createContextTracker } from '../shield/context.js';
 import { DecisionLogger } from '../shield/decisions.js';
+import { buildFortressDecisionPayload } from '../shield/upload.js';
 import { Logger } from '../logger.js';
 import { normalizeToolInput } from '../anonymizer.js';
 
@@ -478,12 +479,13 @@ export function wmaToolInputGuardrail(options = {}) {
   const hasPolicySource =
     options.policiesPath != null ||
     options.ruleset != null ||
+    options.fortressPolicySource != null ||   // v1.4.6: live Fortress source
     options.allowAllWhenUnconfigured === true;
   if (!hasPolicySource) {
     throw new Error(
-      'wmaToolInputGuardrail: no policy configured. Pass policiesPath or ruleset. ' +
-      'For demos / smoke tests that intentionally allow all tool calls, pass ' +
-      '{ allowAllWhenUnconfigured: true } explicitly.',
+      'wmaToolInputGuardrail: no policy configured. Pass policiesPath, ruleset, or ' +
+      'fortressPolicySource. For demos / smoke tests that intentionally allow all ' +
+      'tool calls, pass { allowAllWhenUnconfigured: true } explicitly.',
     );
   }
 
@@ -502,10 +504,16 @@ export function wmaToolInputGuardrail(options = {}) {
   // mis-attributed to 'anthropic-managed' (DecisionLogger's pre-v1.3.1
   // hardcoded default). Fortress / Guardian forensic surfaces depend on
   // this for correct multi-provider attribution.
+  // v1.4.6: when the customer registers a named agent (Fortress OpenAI flow),
+  // use that id for the NDJSON path + as the native_agent_id, instead of the
+  // generic 'openai-agents'. Falls back to 'openai-agents' for the un-named
+  // single-agent case (backward compatible). assertSafePathSegment in the
+  // Logger validates it as a path segment (fails loud on an unsafe name).
+  const loggerAgentId = options.agentId || 'openai-agents';
   const decisionLogger = options.decisionLogger
-    || new DecisionLogger({ logDir, agentId: 'openai-agents', sessionId, provider: PROVIDER });
+    || new DecisionLogger({ logDir, agentId: loggerAgentId, sessionId, provider: PROVIDER });
   const logger = options.logger
-    || new Logger({ logDir, agentId: 'openai-agents', sessionId, silent: true, bestEffort: false });
+    || new Logger({ logDir, agentId: loggerAgentId, sessionId, silent: true, bestEffort: false });
 
   // Team tracker — re-used for the entire run of this guardrail.
   const envTeamId = teamIdFromEnv();
@@ -516,7 +524,26 @@ export function wmaToolInputGuardrail(options = {}) {
     : () => teamTracker.bootstrap(sessionId);
 
   // Lazily load the ruleset on first invocation if a path was given.
+  // v1.4.6: SINGLE-FLIGHT start. start() creates a setInterval, so two
+  // concurrent first tool-calls must NOT both call it (that leaks a second
+  // timer the source can't clear + double-fetches). They share one promise;
+  // on failure we reset it so the next call retries (and that call fails
+  // CLOSED via the guardrail's try/catch in the meantime).
+  let fortressStartPromise = null;
   async function ensureRuleset() {
+    // v1.4.6: live Fortress policy source — pull on first call + background
+    // refresh (the source owns a setInterval; its timer is unref'd so it can't
+    // keep the process alive). On initial-fetch failure start() throws, which
+    // propagates to the guardrail's try/catch → that tool call fails CLOSED
+    // (default) and we retry start() next call rather than caching a failure.
+    if (options.fortressPolicySource) {
+      if (!fortressStartPromise) {
+        fortressStartPromise = Promise.resolve(options.fortressPolicySource.start())
+          .catch((e) => { fortressStartPromise = null; throw e; });
+      }
+      await fortressStartPromise;
+      return options.fortressPolicySource.current();
+    }
     if (ruleset != null) return ruleset;
     if (options.policiesPath) {
       ruleset = await loadPolicies(options.policiesPath);
@@ -588,6 +615,13 @@ export function wmaToolInputGuardrail(options = {}) {
         const decidedInMs = Date.now() - t0;
 
         // 4. Audit-grade log (chain-signed).
+        // v1.4.6: the in-process guardrail delivers a block SYNCHRONOUSLY by
+        // returning rejectContent/throwException below — there is no separate
+        // enforcement API call that can fail (unlike Anthropic's async
+        // interrupt). So an enforced deny/interrupt IS delivered: record it as
+        // such. undefined when not applicable (allow / shadow).
+        const enforcedBlock = result.mode !== 'shadow'
+          && (result.decision === 'deny' || result.decision === 'interrupt');
         await decisionLogger.record({
           sourceEvent: { id: event.id, type: event.action_type, tool_name: event.tool_name, input: event.input },
           decision: result.decision,
@@ -596,8 +630,36 @@ export function wmaToolInputGuardrail(options = {}) {
           message: result.message,
           decidedInMs,
           mode: result.mode,
+          enforcementDelivered: enforcedBlock ? true : undefined,
         });
 
+        // 4b. v1.4.7 (#1): ship the decision to Fortress's ingest-decisions when
+        // a sink is configured. FIRE-AND-FORGET, off the guardrail's hot path —
+        // identical model to the Anthropic shield's fireToFortress(). The NDJSON
+        // row above is the durable local record; this live post is best-effort
+        // (a failure is swallowed, never blocks the tool call or crashes the
+        // guardrail). Payload is anonymized (hashes + decision/rule/provider) so
+        // Containment holds. Carries provider='openai-agents' + native_agent_id +
+        // enforcement_delivered (the v1.4.6 prereqs) so Fortress attributes it
+        // to the right runtime and surfaces degraded enforcement.
+        if (options.fortressDecisionSink) {
+          try {
+            const payload = buildFortressDecisionPayload({
+              agentId: loggerAgentId,
+              provider: PROVIDER,
+              nativeAgentId: loggerAgentId,
+              sessionId,
+              rawEvent: event,
+              normalized: event,
+              result,
+              decidedInMs,
+              signalsSalt: options.signalsSalt,
+              enforcementDelivered: enforcedBlock ? true : undefined,
+            });
+            Promise.resolve(options.fortressDecisionSink(payload)).catch(() => undefined);
+          } catch { /* payload build must never break enforcement */ }
+        }
+
         // 5. Watch log (the event itself, separate from the decision).
         await logger.write(event);