agentmetry 0.5.0__tar.gz → 0.7.0__tar.gz

{agentmetry-0.5.0 → agentmetry-0.7.0}/.gitignore

@@ -96,3 +96,7 @@ docs/*-review-*.md
 docs/*audit*prompt*.md
 docs/audit-*.md
 docs/*-audit-*.md
+
+# pytest-cov data file
+.coverage
+.coverage.*

{agentmetry-0.5.0 → agentmetry-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentmetry
-Version: 0.5.0
+Version: 0.7.0
 Summary: Local-first flight recorder for AI coding agents: hash-chained audit trail, MITRE-mapped sequence detection, DLP
 Project-URL: Homepage, https://agentmetry.ai
 Project-URL: Source, https://github.com/blitzcrieg1/agentmetry
@@ -35,8 +35,9 @@ Requires-Dist: uvicorn[standard]>=0.32.0
 Requires-Dist: websockets>=14.0
 Provides-Extra: dev
 Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
+Requires-Dist: pytest-cov>=6.0; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
-Requires-Dist: ruff==0.16.0; extra == 'dev'
+Requires-Dist: ruff==0.16.4; extra == 'dev'
 Description-Content-Type: text/markdown
 
 # Agentmetry

{agentmetry-0.5.0 → agentmetry-0.7.0}/agentmetry/api/routes/audit.py

@@ -8,7 +8,7 @@ from typing import Any, Literal
 
 from fastapi import APIRouter, Depends, HTTPException, Query
 from fastapi.responses import FileResponse
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, field_validator
 
 from agentmetry.core.auth import require_api_key
 from agentmetry.core.audit.detection.disposition import STATUSES, get_disposition_store
@@ -42,8 +42,48 @@ class IngestToolBody(BaseModel):
     mitre: dict[str, str] | None = None
 
 
+#: Actor kinds a capture surface may assert. Anything else is coerced to
+#: `agent`, which is the safe direction: never silently promoted to `human`
+#: (whose approvals reset detection gates) and never to `autonomous` (which
+#: `autonomous-unapproved-write` keys on). A surface that needs a new kind adds
+#: it here deliberately rather than by sending a novel string.
+_ACTOR_TYPES = frozenset({"human", "agent", "autonomous", "system"})
+
+
+class IngestInitiatorBody(BaseModel):
+    """Who triggered this call, as the capture surface saw it.
+
+    This is not identity. `identity_fields()` stamps `host_id` and `fleet_id` on
+    the receiving orchestrator whatever a client sends, and that lockdown is
+    unchanged here: this field says what *kind* of actor acted, never which
+    machine it was. `external.py` already reads and honours it; without the
+    field declared, pydantic dropped it before that code ever saw it.
+    """
+
+    actor_type: str = "human"
+    trigger: str = "manual"
+    operator_id: str = ""
+
+    @field_validator("actor_type")
+    @classmethod
+    def _known_actor(cls, v: str) -> str:
+        return v if v in _ACTOR_TYPES else "agent"
+
+
 class ExternalIngestBody(BaseModel):
-    """Adapter payload — normalized to canonical v1.1 on ingest."""
+    """Adapter payload — normalized to canonical v1.2 on ingest.
+
+    Every field a capture surface sends must be declared here. Pydantic ignores
+    what it does not know, silently, so an undeclared field is not an error at
+    ingest: it is a feature that works in unit tests and disappears over HTTP.
+
+    That has now happened twice. `traits` and `mitre` were dropped, which made
+    hashed-only events invisible to every command rule. Then 0.6.0 shipped MCP
+    per-tool digests and the initialize handshake, and those were dropped too,
+    so the release headline did not survive the wire. `test_ingest_roundtrip.py`
+    exists so there is not a third time: it builds real proxy payloads and fails
+    if any key does not survive this model.
+    """
 
     source_app: str = Field(
         ...,
@@ -71,10 +111,19 @@ class ExternalIngestBody(BaseModel):
     # pydantic drops it and a `log`-mode match is silently lost.
     dlp: dict[str, Any] | None = None
     tool_policy: dict[str, Any] | None = None
+    # Who the capture surface says triggered this. Honoured by external.py.
+    initiator: IngestInitiatorBody | None = None
     # Compact `tools/list` fingerprint from mcp_audit_proxy. Hash only: the
     # description never leaves the proxy process.
     schema_fingerprint: str = ""
     schema_tool_count: int = 0
+    # 0.6.0 MCP fields. Per-tool digests so a schema move names the tool that
+    # moved rather than only the server, and the two initialize handshake
+    # fields that separate a shipped release from a rug pull. All hashes and
+    # flags: no tool name, no description, nothing model-visible.
+    schema_tool_digests: dict[str, str] = Field(default_factory=dict)
+    server_version: str = ""
+    list_changed: bool | None = None
 
 
 def _parse_event_ts(event: dict[str, Any]) -> datetime | None:

{agentmetry-0.5.0 → agentmetry-0.7.0}/agentmetry/cli/__init__.py

@@ -7,6 +7,7 @@ Pure stdlib + httpx; never imports the FastAPI app (fast startup, no side effect
 from __future__ import annotations
 
 import argparse
+import logging
 import os
 import shutil
 import socket
@@ -30,11 +31,13 @@ _TASK_NAME = "Agentmetry Orchestrator"
 # Paths bundled by backup, relative to the repo root.
 _BACKUP_PREFIXES = ("vault/", "apps/orchestrator/data/")
 _BACKUP_EXCLUDE_DIRS = {"logs"}
+logger = logging.getLogger(__name__)
+
 _BACKUP_EXCLUDE_SUFFIXES = {".pid"}
 
 
 def _base_url(port: int, host: str = "127.0.0.1") -> str:
-    display = host if host != "0.0.0.0" else "127.0.0.1"
+    display = host if host != "0.0.0.0" else "127.0.0.1"  # noqa: S104
     return f"http://{display}:{port}"
 
 
@@ -65,8 +68,12 @@ def _fetch_health(port: int) -> dict | None:
         resp = httpx.get(f"{_base_url(port)}/api/v1/health", timeout=10.0)
         if resp.status_code == 200:
             return resp.json()
-    except Exception:
-        pass
+    except Exception as exc:
+        # Not running is the expected answer here and `None` says so. Logged at
+        # debug anyway: a probe that fails for a reason other than "nothing is
+        # listening" (TLS, a proxy, a permission error) otherwise looks identical
+        # to a stopped orchestrator, and that is an hour of somebody's afternoon.
+        logger.debug("health probe on port %s failed: %s", port, exc)
     return None
 
 
@@ -77,7 +84,7 @@ def cmd_start(args: argparse.Namespace) -> int:
     host = getattr(args, "host", "127.0.0.1")
     if _fetch_health(args.port):
         print(f"Already running on {_base_url(args.port, host)}")
-        if host == "0.0.0.0":
+        if host == "0.0.0.0":  # noqa: S104
             _print_lan_hint(args.port)
         return 0
 
@@ -112,7 +119,7 @@ def cmd_start(args: argparse.Namespace) -> int:
     while time.monotonic() < deadline:
         if _fetch_health(args.port):
             print(f"Agentmetry running on {_base_url(args.port, host)} (pid {proc.pid})")
-            if host == "0.0.0.0":
+            if host == "0.0.0.0":  # noqa: S104
                 _print_lan_hint(args.port)
             return 0
         if proc.poll() is not None:
@@ -937,7 +944,7 @@ def cmd_verify(args: argparse.Namespace) -> int:
                 print(line)
             if source == "config" and not anchor_log.is_file():
                 print(f"    AGENTMETRY_ANCHOR_LOG points at {anchor_log}, which does not exist")
-            if not coverage.ok:
+            if coverage.tampering:
                 # The chain printed OK several lines ago and it was telling the
                 # truth: the file is internally consistent, because whoever
                 # rewrote it made it so. Leaving that as the last word would let
@@ -947,6 +954,17 @@ def cmd_verify(args: argparse.Namespace) -> int:
                     "published anchor. The file was rewritten."
                 )
                 return 1
+            if not coverage.ok:
+                # Checkpoints exist and none of them cover this file. Worth
+                # failing, because an operator who configured an anchor log
+                # believes they are anchored. Not worth calling tampering:
+                # nothing here contradicts the trail, and a trust command that
+                # says "rewritten" about a clean file gets muted.
+                print(
+                    "FAILED — no checkpoint in this anchor log covers this trail. "
+                    "Check AGENTMETRY_ANCHOR_LOG, or anchor this file."
+                )
+                return 1
             return 0
         print(f"FAILED — {result.message}")
         if result.first_bad_line:
@@ -1055,7 +1073,12 @@ def main(argv: list[str] | None = None) -> int:
     # platform. Same guard as scripts/demo.py.
     try:
         sys.stdout.reconfigure(encoding="utf-8")  # type: ignore[union-attr]
-    except Exception:  # pragma: no cover - depends on the host console
+    except Exception:  # noqa: S110  # pragma: no cover - host console dependent
+        # The one swallow with nowhere to swallow into: this runs before logging
+        # is configured, and the failure means the console cannot render UTF-8,
+        # which is also why a log line about it would not render. The fallback is
+        # the console's own encoding, which is what would have happened without
+        # the call.
         pass
 
     parser = argparse.ArgumentParser(prog="agentmetry", description="Agentmetry local ops")

agentmetry-0.7.0/agentmetry/core/audit/detection/corpus/benign_env_example_read.jsonl

@@ -0,0 +1,4 @@
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp44-1", "event_id": "fp44-1-0", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp44-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:00:00+00:00", "tool": {"command": "cat .env.example", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp44-1", "event_id": "fp44-1-1", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp44-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:01:00+00:00", "tool": {"command": "cp .env.example .env.local", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp44-1", "event_id": "fp44-1-2", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp44-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:02:00+00:00", "tool": {"command": "cat config/.env.template", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Read", "server": "claude"}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp44-1", "event_id": "fp44-1-3", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp44-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:03:00+00:00", "tool": {"command": "npm run dev", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}

agentmetry-0.7.0/agentmetry/core/audit/detection/corpus/benign_fetch_piped_into_own_script.jsonl

@@ -0,0 +1,3 @@
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp50-1", "event_id": "fp50-1-0", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp50-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:00:00+00:00", "tool": {"command": "curl -s https://api.example.com/schema.json | python -c \"import sys,json;print(len(json.load(sys.stdin)))\"", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp50-1", "event_id": "fp50-1-1", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp50-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:02:00+00:00", "tool": {"command": "curl -s https://registry.example.com/v1/index | node -e \"let d='';process.stdin.on('data',c=>d+=c)\"", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp50-1", "event_id": "fp50-1-2", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp50-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:04:00+00:00", "tool": {"command": "pytest -q", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}

agentmetry-0.7.0/agentmetry/core/audit/detection/corpus/benign_github_raw_docs_then_script.jsonl

@@ -0,0 +1,3 @@
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp51-1", "event_id": "fp51-1-0", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp51-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:00:00+00:00", "tool": {"command": "curl -s https://raw.githubusercontent.com/psf/requests/main/README.md", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp51-1", "event_id": "fp51-1-1", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp51-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:06:00+00:00", "tool": {"command": "python -c \"import json;print(json.dumps({'ok':True}))\"", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp51-1", "event_id": "fp51-1-2", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp51-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:09:00+00:00", "tool": {"command": "pytest -q", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}

{agentmetry-0.5.0 → agentmetry-0.7.0}/agentmetry/core/audit/detection/corpus/benign_loopback_pipe_to_interpreter.jsonl

@@ -1,3 +1,3 @@
-{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "bl-1", "event_id": "bl-1-0", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.1.0", "session_id": "bl-1", "source": {"app": "claude"}, "timestamp_utc": "2026-07-30T10:00:00+00:00", "tool": {"command": "curl -s http://127.0.0.1:8000/api/v1/audit/status | python -c \"import sys,json;print(json.load(sys.stdin))\"", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude", "traits": ["pipe_to_shell_local", "risky_exec"]}}
-{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "bl-1", "event_id": "bl-1-1", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.1.0", "session_id": "bl-1", "source": {"app": "claude"}, "timestamp_utc": "2026-07-30T10:02:00+00:00", "tool": {"command": "curl -s http://localhost:3000/health | node -e \"process.stdin.pipe(process.stdout)\"", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude", "traits": ["pipe_to_shell_local", "risky_exec"]}}
-{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "bl-1", "event_id": "bl-1-2", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.1.0", "session_id": "bl-1", "source": {"app": "claude"}, "timestamp_utc": "2026-07-30T10:05:00+00:00", "tool": {"command": "npm run test", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude", "traits": []}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "bl-1", "event_id": "bl-1-0", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "bl-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:00:00+00:00", "tool": {"command": "curl -s http://127.0.0.1:8000/tmp/bootstrap.sh | bash", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude", "traits": ["pipe_to_shell_local", "risky_exec"]}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "bl-1", "event_id": "bl-1-1", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "bl-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:02:00+00:00", "tool": {"command": "curl -s http://localhost:3000/setup.sh | sh", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude", "traits": ["pipe_to_shell_local", "risky_exec"]}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "bl-1", "event_id": "bl-1-2", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "bl-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:04:00+00:00", "tool": {"command": "npm run test", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}

agentmetry-0.7.0/agentmetry/core/audit/detection/corpus/benign_mcp_text_mentions_credential_path.jsonl

@@ -0,0 +1,3 @@
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp49-1", "event_id": "fp49-1-0", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp49-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:00:00+00:00", "tool": {"arguments": {"channel": "#eng", "text": "reminder: never commit ~/.aws/credentials or ~/.ssh/id_rsa"}, "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "mcp.slack.post_message", "server": "claude"}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp49-1", "event_id": "fp49-1-1", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp49-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:02:00+00:00", "tool": {"arguments": {"description": "the old key is still in ~/.aws/credentials on the build box", "title": "Rotate keys"}, "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "mcp.linear.create_issue", "server": "claude"}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp49-1", "event_id": "fp49-1-2", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp49-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:04:00+00:00", "tool": {"command": "git status", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}

{agentmetry-0.5.0 → agentmetry-0.7.0}/agentmetry/core/audit/detection/corpus/corpus.yaml

@@ -454,6 +454,48 @@ cases:
       at low with no T1105 and no TA0011, neither of which a loopback fetch
       earns.
 
+  - name: fetch piped into the interpreter's own script
+    session: benign_fetch_piped_into_own_script.jsonl
+    expect: []
+    benign: true
+    note: >
+      Issue #50. `curl api/x.json | python -c 'json.load(sys.stdin)'` was
+      critical. An interpreter handed its own program does not execute the pipe,
+      it reads it as data, so this is a data pipeline and not a cradle. The
+      cradle shapes have no inline script and still fire: see the two cases
+      above.
+
+  - name: read .env.example while setting a project up
+    session: benign_env_example_read.jsonl
+    expect: []
+    benign: true
+    note: >
+      Issue #44, six of seventeen week-one dogfood findings and every one a
+      critical. `.env.example` is the file you commit *instead* of a credential
+      file, and reading it is day one in any repository. A bare `.env` and
+      `.env.local` still map to credential access.
+
+  - name: fetch docs from GitHub raw, then run an unrelated script
+    session: benign_github_raw_docs_then_script.jsonl
+    expect: []
+    benign: true
+    note: >
+      Issue #51. Any staging-host fetch followed by any `python -c` was critical
+      with nothing linking the two. GitHub raw serves documentation as well as
+      payloads, and a fetch that only printed staged no artifact for a later
+      command to run. The bound form, where the file downloaded is the file
+      executed, still fires.
+
+  - name: MCP message that names a credential path
+    session: benign_mcp_text_mentions_credential_path.jsonl
+    expect: []
+    benign: true
+    note: >
+      Issue #49, the sibling of #44. Structured tool arguments have no shell
+      quoting to mask, so a path inside a free-text field read as a credential
+      access. Naming `~/.aws/credentials` in a Slack message is a mention. The
+      same path arriving in a `path` argument is still a read.
+
   - name: remote pipe to shell is still a cradle
     session: attack_remote_pipe_to_shell.jsonl
     expect: [encoded-command-download]

{agentmetry-0.5.0 → agentmetry-0.7.0}/agentmetry/core/audit/detection/disposition.py

@@ -62,6 +62,44 @@ _NOTE_REQUIRED = frozenset({"false_positive", "risk_accepted"})
 #: States that mean no further action is expected.
 CLOSED_STATUSES = frozenset({"resolved", "false_positive", "risk_accepted"})
 
+
+def _loggable(value: object, *, limit: int = 120) -> str:
+    """Flatten a value so it cannot forge log lines.
+
+    `rule_id`, `decided_by` and the disposition keys derived from
+    `correlation_id` all originate outside this process: a rule id can come from
+    an operator's YAML, a correlation id comes from the agent. A newline in any
+    of them lets the writer append whatever they like to the orchestrator log,
+    including lines that look like ours.
+
+    The bound is worth stating precisely. The trail is unaffected: canonical
+    events are JSON and the encoder escapes a newline inside a string, so
+    evidence was never forgeable this way. This protects the operator log, which
+    is what a human reads while deciding whether the evidence is worth opening.
+
+    The replacements are written out one call at a time on purpose. An earlier
+    version did the same job with `str.encode("unicode_escape")`, which is
+    shorter and which CodeQL cannot follow, so `py/log-injection` stayed open on
+    code that was already fixed. A sanitizer the scanner does not recognise
+    leaves you arguing with a dashboard instead of reading it.
+
+    Line breaks become visible escapes rather than disappearing, so a value that
+    contained one still looks different from one that did not.
+    """
+    text = str(value)
+    if len(text) > limit:
+        text = text[: limit - 3] + "..."
+    # Backslash first, or the escapes introduced below get double-escaped.
+    text = text.replace("\\", "\\\\")
+    text = text.replace("\r", "\\r")
+    text = text.replace("\n", "\\n")
+    text = text.replace("\t", "\\t")
+    # Anything else non-printable (NUL, the ESC that starts an ANSI sequence)
+    # is dropped rather than escaped: it carries no meaning a reader needs and
+    # a terminal will act on some of it.
+    return "".join(ch for ch in text if ch.isprintable())
+
+
 _MAX_NOTE_CHARS = 4000
 _MAX_ASSIGNEE_CHARS = 128
 
@@ -234,7 +272,11 @@ class DispositionStore:
                     "DELETE FROM detection_dispositions WHERE detection_key = ?",
                     (stale_key,),
                 )
-                logger.info("Migrated disposition %s -> %s after rule rename", stale_key, key)
+                logger.info(
+                    "Migrated disposition %s -> %s after rule rename",
+                    _loggable(stale_key),
+                    _loggable(key),
+                )
 
         history.append({
             "status": normalized,
@@ -535,14 +577,18 @@ async def apply_disposition(
         try:
             await sink.emit(event)
         except Exception:
-            logger.exception("Failed to forward disposition for %s", rule_id)
+            logger.exception("Failed to forward disposition for %s", _loggable(rule_id))
 
+    # `previous` and `normalized` are validated against STATUSES before they get
+    # here, so passing them raw was safe and CodeQL kept flagging them anyway.
+    # Sanitizing a closed-set value is a no-op, and a no-op costs less than a
+    # dismissal somebody has to re-justify every time the tab is read.
     logger.info(
         "DISPOSITION %s %s -> %s by %s",
-        rule_id,
-        previous,
-        normalized,
-        decided_by or "operator",
+        _loggable(rule_id),
+        _loggable(previous),
+        _loggable(normalized),
+        _loggable(decided_by or "operator"),
     )
     return current
 

{agentmetry-0.5.0 → agentmetry-0.7.0}/agentmetry/core/audit/detection/rules.py

@@ -43,6 +43,7 @@ from .traits import (
     PR_MERGE_COMMAND as _PR_MERGE_COMMAND,
     RAW_IP_URL as _RAW_IP_URL,
     RISKY_EXEC_AFTER_STAGING as _RISKY_EXEC_AFTER_STAGING,
+    STAGES_ARTIFACT as _STAGES_ARTIFACT,
     STAGING_FETCH as _STAGING_FETCH,
     STAGING_HOST as _STAGING_HOST,
     UNTRUSTED_INPUT_COMMAND as _UNTRUSTED_INPUT_COMMAND,
@@ -307,7 +308,14 @@ def _is_staging_fetch(event: dict[str, Any]) -> bool:
         if not _STAGING_HOST.search(cmd):
             return False
         words = _command_words(event)
-        return bool(_STAGING_FETCH.search(words) or _DOWNLOAD_EXEC.search(words))
+        if not (_STAGING_FETCH.search(words) or _DOWNLOAD_EXEC.search(words)):
+            return False
+        # A fetch that only printed staged nothing, so there is no artifact for
+        # a later command to run. `curl raw.githubusercontent.com/.../README.md`
+        # followed an hour later by any `python -c` was reported as critical
+        # staging with no link between the two (issue #51). GitHub raw is where
+        # documentation lives as well as where payloads do.
+        return bool(_STAGES_ARTIFACT.search(cmd))
     return _has_trait(event, "staging_fetch")
 
 
@@ -1265,9 +1273,30 @@ HOST_REGISTRY = [
 #: and the alternative is calling every rule to find out what it might say.
 #: `test_detection_rule_identity.py` greps this module and fails if the two
 #: disagree, so it cannot drift silently.
+#: Rules that are in the tree and run, but are NOT part of the published set.
+#:
+#: `autonomous-unapproved-write` keys on `initiator.actor_type == "autonomous"`.
+#: The bus and SDK paths do produce that (cron, vault_watch, ingress, recovery),
+#: so the rule is correct and still registered. The IDE hook path never does:
+#: across roughly 32,000 events of real dogfood traffic from five agent
+#: surfaces, the actor is `human`, `agent` or `system` and never once
+#: `autonomous`. Ingest coercion deliberately cannot promote a client into it
+#: either, because that would let anyone fake this rule.
+#:
+#: So on every capture surface a user actually installs, it cannot fire. It was
+#: being counted in "fifteen detection rules", shipped in the Sigma pack at
+#: severity high, and named in the pitch as the flagship no-default-self-approve
+#: story. A published rule that cannot fire is a claim, not a detection.
+#:
+#: It stays registered so that a session which really is autonomous is still
+#: caught. It leaves the published set until a capture surface produces the
+#: signal it reads.
+EXPERIMENTAL_RULE_IDS: frozenset[str] = frozenset({
+    "autonomous-unapproved-write",
+})
+
 BUILTIN_RULE_IDS: frozenset[str] = frozenset({
     "credential-exfil",
-    "autonomous-unapproved-write",
     "discovery-then-collect",
     "approval-denied-then-executed",
     "encoded-command-download",

{agentmetry-0.5.0 → agentmetry-0.7.0}/agentmetry/core/audit/detection/traits.py

@@ -44,11 +44,22 @@ DOWNLOAD_EXEC = re.compile(
 ENCODED_CMD = re.compile(r"-enc(odedcommand)?\b|frombase64string", re.IGNORECASE)
 
 # Fetch remote content and feed it straight to an interpreter (ADI §4.2).
+# An interpreter given its own program does not execute the pipe; it reads it as
+# data. `curl api/x.json | python -c 'json.load(sys.stdin)'` is a data pipeline,
+# and calling it a download cradle put a critical on ordinary scripting (issue
+# #50). `curl x.sh | python` has no script of its own, so the download *is* the
+# program, and that stays a cradle.
+#
+# Residual, stated rather than hidden: `| python -c "exec(sys.stdin.read())"`
+# reaches for the download deliberately and slips this. INLINE_EVAL sees that
+# shape, and a cradle written that way is no longer hiding.
+_INLINE_SCRIPT = r"(?!\s*-\w*[ce]\b)"
+
 PIPE_TO_SHELL = re.compile(
     r"\b(curl|wget|iwr|invoke-webrequest|invoke-restmethod)\b[^|;&]*[|]\s*"
-    r"(sudo\s+)?\b(ba|z|k|da)?sh\b|"
+    r"(sudo\s+)?\b(ba|z|k|da)?sh\b" + _INLINE_SCRIPT + r"|"
     r"\b(curl|wget|iwr|invoke-webrequest|invoke-restmethod)\b[^|;&]*[|]\s*"
-    r"(iex|invoke-expression|python\d?|perl|ruby|node)\b",
+    r"(iex|invoke-expression|python\d?|perl|ruby|node)\b" + _INLINE_SCRIPT,
     re.IGNORECASE,
 )
 
@@ -314,6 +325,18 @@ RISKY_EXEC_AFTER_STAGING = re.compile(
     r"\bpowershell(?:\.exe)?\s+-(?:enc|f|file)\b",
     re.IGNORECASE,
 )
+#: A fetch that leaves something behind: written to disk, or handed onward. A
+#: fetch that only printed staged nothing, so there is no artifact for a later
+#: command to run (issue #51).
+STAGES_ARTIFACT = re.compile(
+    r"\s-[a-zA-Z]*[oO]|"          # curl -o / -O, wget -O
+    r"\s--output(?:-document)?|"
+    r"\s>\s*\S|"                     # shell redirect to a file
+    r"\s-[a-zA-Z]*P|"             # wget -P <dir>
+    r"[|]",                          # piped onward, including into an interpreter
+    re.IGNORECASE,
+)
+
 BENIGN_AFTER_STAGING = re.compile(
     r"\b(npm|yarn|pnpm|pip|pip3|cargo|go)\s+(?:install|run|build)\b",
     re.IGNORECASE,
@@ -359,13 +382,27 @@ CREDENTIAL_PATH = re.compile(
 # directly after something that reads a file. A bare mention in prose does not
 # qualify, which costs nothing: nobody reads a credential file without naming a
 # path or a verb.
+# `.env.example` is not a credential file. It is the file you commit *instead*
+# of one, and reading it is what every developer does on their first day in a
+# repository. It was six of seventeen week-one dogfood findings, every one a
+# critical, which is the exact rate at which people stop reading criticals
+# (issue #44).
+#
+# The lookahead sits immediately after `\.env` rather than at the end, because
+# at the end it fails and the engine simply matches the shorter `.env` prefix,
+# leaving the placeholder tagged anyway.
+#
+# Placeholders only. `.env.local`, `.env.production` and a bare `.env` still
+# match, because those hold real values.
+_ENV_PLACEHOLDER = r"(?!\.(?:example|sample|template|dist|defaults|placeholder)\b)"
+
 ENV_FILE = re.compile(
-    r"[\w.~$-]*[/\\]\.env(?:\.[A-Za-z0-9_-]+)?\b|"
+    r"[\w.~$-]*[/\\]\.env" + _ENV_PLACEHOLDER + r"(?:\.[A-Za-z0-9_-]+)?\b|"
     r"\b(?:cat|bat|less|more|head|tail|type|source|export|dotenv|load_dotenv|"
     r"get-content|gc|cp|mv|scp|rsync|base64|xxd|od|strings|"
     r"grep|rg|ag|awk|sed|nano|vim|vi|emacs|code|open|start)"
-    r"\s+(?:-[-\w]+\s+)*\.env(?:\.[A-Za-z0-9_-]+)?\b|"
-    r"^\s*\.env(?:\.[A-Za-z0-9_-]+)?\b",
+    r"\s+(?:-[-\w]+\s+)*\.env" + _ENV_PLACEHOLDER + r"(?:\.[A-Za-z0-9_-]+)?\b|"
+    r"^\s*\.env" + _ENV_PLACEHOLDER + r"(?:\.[A-Za-z0-9_-]+)?\b",
     re.IGNORECASE | re.MULTILINE,
 )
 

{agentmetry-0.5.0 → agentmetry-0.7.0}/agentmetry/core/audit/detection/yaml_config.py

@@ -2,11 +2,14 @@
 
 from __future__ import annotations
 
+import logging
 from pathlib import Path
 from typing import Any
 
 import yaml
 
+logger = logging.getLogger(__name__)
+
 _ORCH_ROOT = Path(__file__).resolve().parents[4]
 _DEFAULT_MANIFEST = _ORCH_ROOT.parent.parent / "policies" / "detection" / "manifest.yaml"
 
@@ -35,8 +38,11 @@ def _manifest_path() -> Path:
         custom = settings.detection_rules_path
         if custom:
             return Path(custom)
-    except Exception:
-        pass
+    except Exception as exc:
+        # Falling back to the packaged manifest is correct, but doing it in
+        # silence means an operator who configured their own rules runs the
+        # default ones and is never told.
+        logger.debug("could not read detection_rules_path from settings: %s", exc)
     return _DEFAULT_MANIFEST