watchmyagents 1.4.9 → 1.4.12

package/README.md

@@ -106,7 +106,7 @@ import { Agent, Runner } from '@openai/agents';
 import {
   wmaToolInputGuardrail,
   attachWmaWatch,
-} from 'watchmyagents/src/sources/openai-agents-js.js';
+} from 'watchmyagents/openai-agents';
 
 const wmaShield = wmaToolInputGuardrail({
   policiesPath: './examples/policies/mitre-starter.json',
@@ -131,7 +131,7 @@ import { Agent, run } from '@openai/agents';
 import {
   wmaToolInputGuardrail,
   attachWmaWatchToAgent,
-} from 'watchmyagents/src/sources/openai-agents-js.js';
+} from 'watchmyagents/openai-agents';
 
 const wmaShield = wmaToolInputGuardrail({
   policiesPath: './examples/policies/mitre-starter.json',
@@ -154,14 +154,14 @@ That's it. NDJSON lands in `./watchmyagents-logs/openai-agents/`. The MITRE star
 
 See [docs/adapters/openai-agents-js.md](docs/adapters/openai-agents-js.md) for the full options reference + troubleshooting.
 
-## Supported runtimes (v1.3.0)
+## Supported runtimes
 
 | Runtime | Mode | Onboarding | Status |
 |---|---|---|---|
 | **Anthropic Managed Agents** | pull REST/SSE | API key (zero-touch) | ✓ shipped |
-| **OpenAI Agents SDK** (TypeScript/JS) | push (in-process hooks + guardrails) | 2 lines of code | ✓ v1.3.0 |
-| OpenAI Agents SDK (Python) | push (separate `watchmyagents-py` package) | — | planned v1.4.0 |
-| Claude Code (dynamic workflows) | push (hooks via `settings.json`) | — | planned v1.4.x |
+| **OpenAI Agents SDK** (TypeScript/JS) | push (in-process hooks + guardrails) | 2 lines of code, or Fortress "Register an OpenAI agent" | ✓ shipped (live Fortress policies + decisions since v1.4.6) |
+| OpenAI Agents SDK (Python) | push (separate `watchmyagents-py` package) | — | planned |
+| Claude Code / Cowork (hooks) | push (plugin hooks via `settings.json`) | — | planned (Phase 2.B) |
 | AWS Bedrock AgentCore | pull REST/SSE | similar to Anthropic | planned v1.5.0 |
 
 ## What gets logged

package/docs/adapters/openai-agents-js.md

@@ -1,6 +1,6 @@
 # OpenAI Agents SDK adapter (TypeScript / JavaScript)
 
-**Status: v1.3.0 (Phase 2.A) — first adapter that observes a runtime which executes locally on the customer machine.**
+**Status: shipped (introduced v1.3.0, Phase 2.A) — the first adapter that observes a runtime which executes locally on the customer machine. Live Fortress policies + decision upload since v1.4.6.**
 
 This adapter integrates `watchmyagents` with the [OpenAI Agents SDK](https://openai.github.io/openai-agents-js/) (`@openai/agents` on npm). Customers add two lines to their existing agent code; WMA logs every lifecycle event locally and can block tool calls before execution via Shield policies.
 
@@ -67,7 +67,7 @@ import { Agent, Runner } from '@openai/agents';
 import {
   wmaToolInputGuardrail,
   attachWmaWatch,
-} from 'watchmyagents/src/sources/openai-agents-js.js';
+} from 'watchmyagents/openai-agents';
 
 const wmaShield = wmaToolInputGuardrail({
   policiesPath: './examples/policies/mitre-starter.json',
@@ -93,7 +93,7 @@ import { Agent, run } from '@openai/agents';
 import {
   wmaToolInputGuardrail,
   attachWmaWatchToAgent,
-} from 'watchmyagents/src/sources/openai-agents-js.js';
+} from 'watchmyagents/openai-agents';
 
 const wmaShield = wmaToolInputGuardrail({
   policiesPath: './examples/policies/mitre-starter.json',
@@ -161,7 +161,7 @@ Three resolution channels for `team_id`, in precedence order:
 Every `shield_decision` row carries `prev_hash` + `chain_hash` (SHA-256). The audit chain is local-only tamper-evidence. Verify with:
 
 ```typescript
-import { verifyDecisionChain } from 'watchmyagents/src/shield/decision-chain.js';
+import { verifyDecisionChain } from 'watchmyagents';
 import { readFile } from 'node:fs/promises';
 
 const lines = (await readFile('./watchmyagents-logs/openai-agents/2026-06-09.ndjson', 'utf8'))

package/examples/adapters/openai-agents-js-quickstart.ts

@@ -26,7 +26,7 @@ import { z } from 'zod';
 import {
   wmaToolInputGuardrail,
   attachWmaWatch,
-} from 'watchmyagents/src/sources/openai-agents-js.js';
+} from 'watchmyagents/openai-agents';
 
 // ── Tools the agent can call ───────────────────────────────────────────
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmyagents",
-  "version": "1.4.9",
+  "version": "1.4.12",
   "description": "Security observability + real-time policy enforcement for AI agents. Local-first NDJSON capture with a continuous Watch daemon that auto-uploads anonymized signals, Shield CLI that blocks policy violations live (with policies pulled from Fortress cloud), anonymizer producing signals-only payloads, bidirectional sync with WatchMyAgents Fortress, and one-command install as an always-on launchd/systemd service — closing the recursive Watch→Guardian→Shield security loop.",
   "type": "module",
   "files": [

package/scripts/fetch-anthropic.js

@@ -28,7 +28,7 @@ import { URL } from 'node:url';
 import { Logger, tightenMode } from '../src/logger.js';
 import { TokenTracker } from '../src/tokens.js';
 import { SignalsAggregator } from '../src/anonymizer.js';
-import { resolveFortressBase, fortressEndpoint } from '../src/fortress/url.js';
+import { resolveFortressBase, fortressEndpoint, guardedLookup } from '../src/fortress/url.js';
 import { cleanLabel } from '../src/labels.js';
 import { isValidAgentId, isValidSessionId, assertSafePathSegment } from '../src/validate.js';
 import { classifyAgentType } from '../src/typology.js';
@@ -107,6 +107,7 @@ function postJson(url, headers, body) {
       path: u.pathname + (u.search || ''),
       headers: { ...headers, 'content-type': 'application/json', 'content-length': data.length },
       rejectUnauthorized: true,
+      lookup: guardedLookup,   // v1.4.11: DNS-rebinding guard on the Fortress upload
     }, (res) => {
       const chunks = [];
       let receivedBytes = 0;

package/scripts/upload-fortress.js

@@ -29,7 +29,7 @@ import { join, resolve } from 'node:path';
 import { createReadStream } from 'node:fs';
 import { createInterface } from 'node:readline';
 import { SignalsAggregator } from '../src/anonymizer.js';
-import { resolveFortressBase, fortressEndpoint } from '../src/fortress/url.js';
+import { resolveFortressBase, fortressEndpoint, guardedLookup } from '../src/fortress/url.js';
 import { AnthropicManagedSource } from '../src/sources/anthropic-managed.js';
 import { cleanLabel } from '../src/labels.js';
 import { maybePrintVersionAndExit } from '../src/version.js';
@@ -97,6 +97,7 @@ function postJson(url, headers, body) {
           'content-length': data.length,
         },
         rejectUnauthorized: true,
+        lookup: guardedLookup,   // v1.4.11: DNS-rebinding guard on the Fortress upload
       },
       (res) => {
         const chunks = [];

package/src/anonymizer.js

@@ -77,6 +77,7 @@ const WELL_KNOWN_TOOLS = new Set([
  */
 export function hashWithSalt(value, salt) {
   if (value == null) return null;
+  assertStrongSalt(salt, 'hashWithSalt');
   const s = typeof value === 'string' ? value : JSON.stringify(value);
   return 'sha256:' + createHash('sha256').update(salt).update(s).digest('hex').slice(0, 32);
 }
@@ -86,6 +87,25 @@ export function generateSalt() {
   return randomBytes(16).toString('hex');
 }
 
+// v1.4.12 (audit residual): the IoC hashes are only non-reversible if the salt
+// is strong. IoCs are low-entropy (IPs, ports, common URLs/commands), so a
+// weak/short salt lets anyone who obtains the uploaded ioc_hashes[] brute-force
+// them back to the raw values — breaking Containment-at-rest. The wma-* CLIs
+// already enforce a >=16-char floor; this moves it INTO the library so a
+// PROGRAMMATIC consumer (SignalsAggregator, hashWithSalt) can't bypass it with
+// a weak salt. 16 chars matches the CLI floor + generateSalt()'s 32-hex output.
+export const MIN_SALT_LENGTH = 16;
+export function assertStrongSalt(salt, ctx = 'salt') {
+  if (typeof salt !== 'string' || salt.length < MIN_SALT_LENGTH) {
+    const got = typeof salt === 'string' ? `${salt.length} chars` : typeof salt;
+    throw new Error(
+      `${ctx}: salt must be a string of at least ${MIN_SALT_LENGTH} characters (got ${got}). ` +
+      'A weak salt makes the IoC hashes brute-forceable. Use generateSalt() or a ' +
+      'stable >=16-char per-customer secret (WMA_SIGNALS_SALT).',
+    );
+  }
+}
+
 // ── Tool name normalization (Containment hardening, v1.0.1 F-3) ────────
 
 /**
@@ -106,7 +126,7 @@ export function normalizeToolName(toolName, salt) {
   const s = String(toolName);
   if (s.length === 0) return null;
   if (WELL_KNOWN_TOOLS.has(s)) return s;
-  if (!salt) throw new Error('normalizeToolName requires a salt to hash custom tool names');
+  assertStrongSalt(salt, 'normalizeToolName');
   return 'tool_hash:' + createHash('sha256').update(salt).update(s).digest('hex').slice(0, 32);
 }
 
@@ -223,7 +243,7 @@ function extractIocs(entry, salt) {
 
 export class SignalsAggregator {
   constructor({ salt } = {}) {
-    if (!salt) throw new Error('SignalsAggregator requires a salt');
+    assertStrongSalt(salt, 'SignalsAggregator');
     this.salt = salt;
     this.counts = Object.create(null);          // action_type → count
     this.toolCounts = Object.create(null);      // tool_name → count
@@ -369,7 +389,7 @@ export class SignalsAggregator {
 // ── Streaming convenience: anonymize a whole NDJSON file/dir ────────────
 
 export async function anonymizeFile(filePath, { salt } = {}) {
-  if (!salt) throw new Error('anonymizeFile requires a salt');
+  assertStrongSalt(salt, 'anonymizeFile');
   const agg = new SignalsAggregator({ salt });
   const stream = createReadStream(filePath, { encoding: 'utf8' });
   const rl = createInterface({ input: stream, crlfDelay: Infinity });

package/src/fortress/url.js

@@ -1,6 +1,7 @@
 // ─────────────────────────────────────────────────────────────────────────
 // Fortress URL resolution — shared across upload-fortress, shield, etc.
 // ─────────────────────────────────────────────────────────────────────────
+import { lookup as dnsLookup } from 'node:dns';
 // The user sets ONE of:
 //
 //   WMA_FORTRESS_BASE_URL=https://<project>.supabase.co/functions/v1
@@ -74,29 +75,40 @@ export function assertSafeFortressBase(base) {
   if (u.username || u.password) {
     throw new Error('Fortress base URL must not embed credentials (user:pass@host).');
   }
-  if (isBlockedHost(u.hostname)) {
+  if (!privateFortressAllowed() && isBlockedHost(u.hostname)) {
     throw new Error(
       `Fortress base URL host "${u.hostname}" is a private/loopback/link-local address — refusing (SSRF guard). ` +
-      'Point WMA_FORTRESS_BASE_URL at your public Fortress endpoint.',
+      'Point WMA_FORTRESS_BASE_URL at your public Fortress endpoint, or set ' +
+      'WMA_FORTRESS_ALLOW_PRIVATE_IPS=1 for a self-hosted Fortress on a private network.',
     );
   }
   return base;
 }
 
 // True if the host is an IP literal in a private/loopback/link-local/ULA range,
-// or localhost. Public hostnames and public IPs pass.
-function isBlockedHost(hostname) {
+// or localhost. Public hostnames and public IPs pass. Exported so the per-request
+// DNS guard (guardedLookup) can check RESOLVED ips with the exact same logic.
+export function isBlockedHost(hostname) {
   // Node keeps surrounding brackets on IPv6 hostnames (e.g. "[::1]"); strip them.
-  const h = hostname.toLowerCase().replace(/^\[/, '').replace(/\]$/, '');
+  const h = String(hostname).toLowerCase().replace(/^\[/, '').replace(/\]$/, '');
   if (h === 'localhost' || h.endsWith('.localhost')) return true;
 
-  // IPv6 literal. Normalize IPv4-mapped form.
+  // IPv6 literal.
   if (h.includes(':')) {
     if (h === '::1' || h === '::') return true;                 // loopback / unspecified
     if (h.startsWith('fe8') || h.startsWith('fe9') || h.startsWith('fea') || h.startsWith('feb')) return true; // fe80::/10 link-local
     if (h.startsWith('fc') || h.startsWith('fd')) return true;  // fc00::/7 unique-local
-    const mapped = h.match(/::ffff:(\d+\.\d+\.\d+\.\d+)$/);     // IPv4-mapped IPv6
-    if (mapped) return isBlockedIpv4(mapped[1]);
+    // IPv4-mapped IPv6 (::ffff:a.b.c.d). CRITICAL: Node's URL parser normalizes
+    // the dotted form to HEX — new URL('https://[::ffff:127.0.0.1]/').hostname
+    // is '[::ffff:7f00:1]' — so a regex matching only the dotted form lets
+    // 127.0.0.1 / 169.254.169.254 (metadata!) slip past. Decode BOTH forms.
+    const mappedDotted = h.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+    if (mappedDotted) return isBlockedIpv4(mappedDotted[1]);
+    const mappedHex = h.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+    if (mappedHex) {
+      const hi = parseInt(mappedHex[1], 16), lo = parseInt(mappedHex[2], 16);
+      return isBlockedIpv4(`${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`);
+    }
     return false;
   }
 
@@ -105,6 +117,40 @@ function isBlockedHost(hostname) {
   return false;
 }
 
+// v1.4.11 (Codex P1/P2): per-request DNS guard — closes the DNS-rebinding gap
+// the name-based check can't (a public hostname resolving to a private IP at
+// connect time). Drop-in `lookup` for https.request: it resolves the hostname,
+// rejects the connection if the RESOLVED ip is private/loopback/link-local
+// (same ranges as isBlockedHost, incl. IPv4-mapped IPv6), and otherwise pins
+// the connection to exactly that resolved address. Wire it into every
+// Fortress-bound https.request via `{ lookup: guardedLookup }`.
+export function guardedLookup(hostname, options, callback) {
+  const cb = typeof options === 'function' ? options : callback;
+  const opts = typeof options === 'function' ? {} : (options || {});
+  // Escape hatch for a LEGITIMATE self-hosted Fortress on a private network
+  // (hostname → 10.x/192.168.x/etc). Off by default — the secure posture is to
+  // refuse private resolutions. Same flag gates assertSafeFortressBase.
+  if (privateFortressAllowed()) return dnsLookup(hostname, opts, cb);
+  dnsLookup(hostname, opts, (err, address, family) => {
+    if (err) return cb(err);
+    const list = Array.isArray(address) ? address : [{ address, family }];
+    for (const a of list) {
+      if (isBlockedHost(a.address)) {
+        return cb(new Error(
+          `SSRF guard: "${hostname}" resolved to a private/loopback/link-local IP (${a.address}) — refusing the connection. ` +
+          'Set WMA_FORTRESS_ALLOW_PRIVATE_IPS=1 to allow a self-hosted Fortress on a private network.',
+        ));
+      }
+    }
+    return cb(null, address, family);
+  });
+}
+
+// Opt-out for self-hosted Fortress on a private network. Default: not allowed.
+function privateFortressAllowed() {
+  return process.env.WMA_FORTRESS_ALLOW_PRIVATE_IPS === '1';
+}
+
 function isBlockedIpv4(ip) {
   const o = ip.split('.').map(Number);
   if (o.length !== 4 || o.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return true; // malformed → block

package/src/shield/policy-stream.js

@@ -33,6 +33,7 @@ import { request as httpsRequest } from 'node:https';
 import { URL } from 'node:url';
 import { EventEmitter } from 'node:events';
 import { normalizeSseBuffer } from './sse.js';
+import { guardedLookup } from '../fortress/url.js';
 
 const RECONNECT_MIN_MS = 1_000;
 const RECONNECT_MAX_MS = 60_000;
@@ -109,6 +110,7 @@ export class PolicyStream extends EventEmitter {
         'connection': 'keep-alive',
       },
       rejectUnauthorized: true,
+      lookup: guardedLookup,   // v1.4.11: DNS-rebinding guard on the Fortress SSE
     }, (res) => {
       this._req = req;
 

package/src/shield/sources/fortress.js

@@ -11,7 +11,7 @@
 
 import { request as httpsRequest } from 'node:https';
 import { URL } from 'node:url';
-import { fortressEndpoint } from '../../fortress/url.js';
+import { fortressEndpoint, guardedLookup } from '../../fortress/url.js';
 
 const DEFAULT_TIMEOUT_MS = 15_000;
 // v1.1.2 F-17 (P3 Codex audit): cap on the total bytes we'll accumulate
@@ -41,6 +41,10 @@ function httpsJson(method, url, headers, body, timeoutMs = DEFAULT_TIMEOUT_MS) {
         ...(data ? { 'content-type': 'application/json', 'content-length': data.length } : {}),
       },
       rejectUnauthorized: true,
+      // v1.4.11 (Codex P1/P2): per-request DNS guard — reject a hostname that
+      // resolves to a private/loopback/link-local IP (DNS rebinding), and pin
+      // the connection to the checked address.
+      lookup: guardedLookup,
     };
     const req = httpsRequest(opts, (res) => {
       const chunks = [];
@@ -87,14 +91,25 @@ function httpsJson(method, url, headers, body, timeoutMs = DEFAULT_TIMEOUT_MS) {
  * @param {string} [opts.provider] - runtime provider (default 'anthropic-managed')
  * @returns {Promise<{ ok: true, policies: array, signing_keys: array, fetched_at: string }>}
  */
-// v1.4.9: pure, testable get-policies URL builder. Always carries `provider`
-// so a provider-aware Fortress can scope by (provider, native_agent_id) — an
-// OpenAI agent id is NOT in the `agent_…` shape. Harmless on the older Fortress
-// that ignores unknown query params.
+// v1.4.10: pure, testable get-policies URL builder. Always carries `provider`.
+// The AGENT-ID PARAM NAME is provider-dependent and this matters:
+//   - anthropic-managed → `agent_id` (legacy). Fortress resolves by
+//     anthropic_agent_id, which works for ALL Anthropic agents including legacy
+//     rows whose native_agent_id was never backfilled.
+//   - other providers (openai-agents) → `native_agent_id` (canonical). Fortress
+//     resolves by (provider, native_agent_id). This is REQUIRED: an OpenAI id is
+//     not in the `agent_…` shape and its anthropic_agent_id is null. If we sent
+//     it as `agent_id`, Fortress's `useLegacyLookup` (native absent + agent_id
+//     present) forces the anthropic_agent_id lookup → the OpenAI agent isn't
+//     found → empty policies → default-allow → enforcement SILENTLY OFF (a
+//     fail-OPEN, worse than fail-closed). v1.4.9 had this bug.
 export function buildGetPoliciesUrl(base, { anthropicAgentId, provider = 'anthropic-managed' } = {}) {
   let url = fortressEndpoint(base, 'get-policies');
   const params = [];
-  if (anthropicAgentId) params.push(`agent_id=${encodeURIComponent(anthropicAgentId)}`);
+  if (anthropicAgentId) {
+    const key = provider === 'anthropic-managed' ? 'agent_id' : 'native_agent_id';
+    params.push(`${key}=${encodeURIComponent(anthropicAgentId)}`);
+  }
   params.push(`provider=${encodeURIComponent(provider)}`);
   url += (url.includes('?') ? '&' : '?') + params.join('&');
   return url;

package/src/shield/upload.js

@@ -12,13 +12,17 @@
 // it — only the leak-y field is omitted.
 
 import { createHash } from 'node:crypto';
-import { normalizeToolName } from '../anonymizer.js';
+import { normalizeToolName, MIN_SALT_LENGTH } from '../anonymizer.js';
 
 // Salted SHA-256 hash with the same 32-char truncation as the anonymizer
 // and the rest of Shield's decision flow. Returns null for nullish input
 // or when no salt is configured (fail-safe omission).
+// v1.4.12 (audit residual): a weak/short salt yields a brute-forceable hash, so
+// treat it like NO salt — OMIT the field rather than emit a weak hash. This is
+// the fail-safe / Containment-safe choice and (unlike throwing) can't break the
+// synchronous decision-payload build in shield.js's fireToFortress.
 function hashWithSaltOpt(value, salt) {
-  if (value == null || !salt) return null;
+  if (value == null || typeof salt !== 'string' || salt.length < MIN_SALT_LENGTH) return null;
   const s = typeof value === 'string' ? value : JSON.stringify(value);
   return 'sha256:' + createHash('sha256').update(salt).update(s).digest('hex').slice(0, 32);
 }