watchmyagents 1.4.6 → 1.4.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmyagents",
-  "version": "1.4.6",
+  "version": "1.4.7",
   "description": "Security observability + real-time policy enforcement for AI agents. Local-first NDJSON capture with a continuous Watch daemon that auto-uploads anonymized signals, Shield CLI that blocks policy violations live (with policies pulled from Fortress cloud), anonymizer producing signals-only payloads, bidirectional sync with WatchMyAgents Fortress, and one-command install as an always-on launchd/systemd service — closing the recursive Watch→Guardian→Shield security loop.",
   "type": "module",
   "files": [

package/src/openai-agents.js

@@ -40,7 +40,7 @@ import {
   attachWmaWatchToAgent,
   adapterMeta,
 } from './sources/openai-agents-js.js';
-import { FortressPolicySource } from './shield/sources/fortress.js';
+import { FortressPolicySource, postDecision } from './shield/sources/fortress.js';
 import { resolveFortressBase } from './fortress/url.js';
 
 /**
@@ -101,6 +101,7 @@ export function openaiAgents(options = {}) {
   // wma-shield gets its ruleset for Anthropic. Requires an agentId to scope
   // the pull, a base URL (option or WMA_FORTRESS_BASE_URL), and WMA_API_KEY.
   let fortressPolicySource = null;
+  let fortressDecisionSink = null;
   if (options.policies && options.policies.source === 'fortress') {
     if (!options.agentId) {
       throw new Error(
@@ -132,6 +133,14 @@ export function openaiAgents(options = {}) {
       requireSignedPolicies: options.policies.requireSignedPolicies,
       failMode: options.policies.failMode,
     });
+
+    // v1.4.7 (#1): ship decisions to the SAME Fortress (the control plane you
+    // pull policies from is where the decisions belong). Auto-on; opt out with
+    // policies.uploadDecisions === false to keep decisions local-only. The
+    // guardrail fires these best-effort, off its hot path.
+    if (options.policies.uploadDecisions !== false) {
+      fortressDecisionSink = (decision) => postDecision({ apiKey, base, decision });
+    }
   }
 
   // v1.4 Codex #2 — fail-loud refusal to start in enforce mode without
@@ -153,6 +162,8 @@ export function openaiAgents(options = {}) {
   const sharedOptions = {
     agentId:         options.agentId,            // v1.4.6: NDJSON path + native_agent_id
     fortressPolicySource,                        // v1.4.6: live Fortress ruleset (or null)
+    fortressDecisionSink,                        // v1.4.7 #1: ship decisions (or null)
+    signalsSalt:     options.signalsSalt || process.env.WMA_SIGNALS_SALT,  // hash session/input
     policiesPath:    options.policiesPath,
     ruleset:         options.ruleset,
     logDir:          options.logDir,

package/src/sources/openai-agents-js.js

@@ -54,6 +54,7 @@ import {
 import { evaluate, loadPolicies } from '../shield/policy.js';
 import { createContextTracker } from '../shield/context.js';
 import { DecisionLogger } from '../shield/decisions.js';
+import { buildFortressDecisionPayload } from '../shield/upload.js';
 import { Logger } from '../logger.js';
 import { normalizeToolInput } from '../anonymizer.js';
 
@@ -632,6 +633,33 @@ export function wmaToolInputGuardrail(options = {}) {
           enforcementDelivered: enforcedBlock ? true : undefined,
         });
 
+        // 4b. v1.4.7 (#1): ship the decision to Fortress's ingest-decisions when
+        // a sink is configured. FIRE-AND-FORGET, off the guardrail's hot path —
+        // identical model to the Anthropic shield's fireToFortress(). The NDJSON
+        // row above is the durable local record; this live post is best-effort
+        // (a failure is swallowed, never blocks the tool call or crashes the
+        // guardrail). Payload is anonymized (hashes + decision/rule/provider) so
+        // Containment holds. Carries provider='openai-agents' + native_agent_id +
+        // enforcement_delivered (the v1.4.6 prereqs) so Fortress attributes it
+        // to the right runtime and surfaces degraded enforcement.
+        if (options.fortressDecisionSink) {
+          try {
+            const payload = buildFortressDecisionPayload({
+              agentId: loggerAgentId,
+              provider: PROVIDER,
+              nativeAgentId: loggerAgentId,
+              sessionId,
+              rawEvent: event,
+              normalized: event,
+              result,
+              decidedInMs,
+              signalsSalt: options.signalsSalt,
+              enforcementDelivered: enforcedBlock ? true : undefined,
+            });
+            Promise.resolve(options.fortressDecisionSink(payload)).catch(() => undefined);
+          } catch { /* payload build must never break enforcement */ }
+        }
+
         // 5. Watch log (the event itself, separate from the decision).
         await logger.write(event);