agentmetry 0.6.0__tar.gz → 0.8.0__tar.gz

{agentmetry-0.6.0 → agentmetry-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentmetry
-Version: 0.6.0
+Version: 0.8.0
 Summary: Local-first flight recorder for AI coding agents: hash-chained audit trail, MITRE-mapped sequence detection, DLP
 Project-URL: Homepage, https://agentmetry.ai
 Project-URL: Source, https://github.com/blitzcrieg1/agentmetry
@@ -25,7 +25,7 @@ Requires-Python: >=3.11
 Requires-Dist: aiosqlite>=0.20.0
 Requires-Dist: fastapi>=0.115.0
 Requires-Dist: httpx>=0.28.0
-Requires-Dist: mcp>=1.2
+Requires-Dist: mcp<2,>=1.2
 Requires-Dist: pydantic-settings>=2.6.0
 Requires-Dist: pydantic>=2.9.0
 Requires-Dist: pyyaml>=6.0
@@ -37,7 +37,7 @@ Provides-Extra: dev
 Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
 Requires-Dist: pytest-cov>=6.0; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
-Requires-Dist: ruff==0.16.4; extra == 'dev'
+Requires-Dist: ruff==0.16.6; extra == 'dev'
 Description-Content-Type: text/markdown
 
 # Agentmetry

{agentmetry-0.6.0 → agentmetry-0.8.0}/agentmetry/api/routes/audit.py

@@ -8,7 +8,7 @@ from typing import Any, Literal
 
 from fastapi import APIRouter, Depends, HTTPException, Query
 from fastapi.responses import FileResponse
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, field_validator
 
 from agentmetry.core.auth import require_api_key
 from agentmetry.core.audit.detection.disposition import STATUSES, get_disposition_store
@@ -42,8 +42,48 @@ class IngestToolBody(BaseModel):
     mitre: dict[str, str] | None = None
 
 
+#: Actor kinds a capture surface may assert. Anything else is coerced to
+#: `agent`, which is the safe direction: never silently promoted to `human`
+#: (whose approvals reset detection gates) and never to `autonomous` (which
+#: `autonomous-unapproved-write` keys on). A surface that needs a new kind adds
+#: it here deliberately rather than by sending a novel string.
+_ACTOR_TYPES = frozenset({"human", "agent", "autonomous", "system"})
+
+
+class IngestInitiatorBody(BaseModel):
+    """Who triggered this call, as the capture surface saw it.
+
+    This is not identity. `identity_fields()` stamps `host_id` and `fleet_id` on
+    the receiving orchestrator whatever a client sends, and that lockdown is
+    unchanged here: this field says what *kind* of actor acted, never which
+    machine it was. `external.py` already reads and honours it; without the
+    field declared, pydantic dropped it before that code ever saw it.
+    """
+
+    actor_type: str = "human"
+    trigger: str = "manual"
+    operator_id: str = ""
+
+    @field_validator("actor_type")
+    @classmethod
+    def _known_actor(cls, v: str) -> str:
+        return v if v in _ACTOR_TYPES else "agent"
+
+
 class ExternalIngestBody(BaseModel):
-    """Adapter payload — normalized to canonical v1.1 on ingest."""
+    """Adapter payload — normalized to canonical v1.2 on ingest.
+
+    Every field a capture surface sends must be declared here. Pydantic ignores
+    what it does not know, silently, so an undeclared field is not an error at
+    ingest: it is a feature that works in unit tests and disappears over HTTP.
+
+    That has now happened twice. `traits` and `mitre` were dropped, which made
+    hashed-only events invisible to every command rule. Then 0.6.0 shipped MCP
+    per-tool digests and the initialize handshake, and those were dropped too,
+    so the release headline did not survive the wire. `test_ingest_roundtrip.py`
+    exists so there is not a third time: it builds real proxy payloads and fails
+    if any key does not survive this model.
+    """
 
     source_app: str = Field(
         ...,
@@ -71,10 +111,23 @@ class ExternalIngestBody(BaseModel):
     # pydantic drops it and a `log`-mode match is silently lost.
     dlp: dict[str, Any] | None = None
     tool_policy: dict[str, Any] | None = None
+    # Who the capture surface says triggered this. Honoured by external.py.
+    initiator: IngestInitiatorBody | None = None
     # Compact `tools/list` fingerprint from mcp_audit_proxy. Hash only: the
     # description never leaves the proxy process.
     schema_fingerprint: str = ""
     schema_tool_count: int = 0
+    # 0.6.0 MCP fields. Per-tool digests so a schema move names the tool that
+    # moved rather than only the server, and the two initialize handshake
+    # fields that separate a shipped release from a rug pull. All hashes and
+    # flags: no tool name, no description, nothing model-visible.
+    schema_tool_digests: dict[str, str] = Field(default_factory=dict)
+    # Concealed-character counts per category. Declared here because pydantic
+    # drops what it does not know, silently, which has already cost this file
+    # two shipped bugs.
+    schema_concealed: dict[str, int] = Field(default_factory=dict)
+    server_version: str = ""
+    list_changed: bool | None = None
 
 
 def _parse_event_ts(event: dict[str, Any]) -> datetime | None:

{agentmetry-0.6.0 → agentmetry-0.8.0}/agentmetry/cli/__init__.py

@@ -34,6 +34,7 @@ _BACKUP_EXCLUDE_DIRS = {"logs"}
 logger = logging.getLogger(__name__)
 
 _BACKUP_EXCLUDE_SUFFIXES = {".pid"}
+_CLOSING_DISPOSITIONS = ("resolved", "false_positive", "risk_accepted")
 
 
 def _base_url(port: int, host: str = "127.0.0.1") -> str:
@@ -41,6 +42,15 @@ def _base_url(port: int, host: str = "127.0.0.1") -> str:
     return f"http://{display}:{port}"
 
 
+def _api_base_url(port: int) -> str:
+    return os.environ.get("AGENTMETRY_URL", "").strip().rstrip("/") or _base_url(port)
+
+
+def _api_headers() -> dict[str, str]:
+    key = os.environ.get("AGENTMETRY_API_KEY", "").strip()
+    return {"X-API-Key": key} if key else {}
+
+
 def _lan_ip() -> str | None:
     """Best-effort local IPv4 for phone/LAN access hints."""
     try:
@@ -219,7 +229,8 @@ def cmd_stats(args: argparse.Namespace) -> int:
         return 1
 
     if not data.get("enabled", True):
-        print("Audit export disabled — enable AGENTMETRY_AUDIT_EXPORT to collect stats.")
+        print("Audit export is disabled, so no events are recorded and stats are empty.")
+        print("Set AGENTMETRY_AUDIT_EXPORT_ENABLED=1 and restart.")
         return 1
 
     days = data.get("window_days", args.days)
@@ -241,6 +252,76 @@ def cmd_stats(args: argparse.Namespace) -> int:
     return 0
 
 
+def cmd_detections(args: argparse.Namespace) -> int:
+    try:
+        data = httpx.get(
+            f"{_base_url(args.port)}/api/v1/audit/detections/{args.correlation_id}",
+            timeout=10.0,
+        ).json()
+    except Exception:
+        print("Not running - start Agentmetry first (detections reads via the API).")
+        return 1
+    if not data.get("enabled", True):
+        print("Audit export is disabled, so no sessions are recorded.")
+        print("Set AGENTMETRY_AUDIT_EXPORT_ENABLED=1 and restart.")
+        return 1
+    detections = data.get("detections") or []
+    if not detections:
+        print(f"No detections for {args.correlation_id}.")
+        return 0
+    rule_width = max(len("Rule"), *(len(str(d.get("rule_id", ""))) for d in detections))
+    severity_width = max(
+        len("Severity"), *(len(str(d.get("severity", ""))) for d in detections)
+    )
+    print(f"{'Rule':<{rule_width}}  {'Severity':<{severity_width}}  Summary")
+    print(f"{'-' * rule_width}  {'-' * severity_width}  {'-' * len('Summary')}")
+    for detection in detections:
+        print(
+            f"{str(detection.get('rule_id', '')):<{rule_width}}  "
+            f"{str(detection.get('severity', '')):<{severity_width}}  "
+            f"{detection.get('summary', '')}"
+        )
+    return 0
+
+
+def cmd_disposition(args: argparse.Namespace) -> int:
+    """Close a detection from the shell, using the same API as the dashboard."""
+    note = args.note.strip()
+    if args.status in {"false_positive", "risk_accepted"} and not note:
+        print(f"--note is required for {args.status}")
+        return 1
+
+    try:
+        resp = httpx.post(
+            f"{_api_base_url(args.port)}/api/v1/audit/detections/disposition",
+            json={
+                "correlation_id": args.correlation_id,
+                "rule_id": args.rule_id,
+                "status": args.status,
+                "note": note,
+                "decided_by": args.decided_by,
+            },
+            headers=_api_headers(),
+            timeout=10.0,
+        )
+    except Exception:
+        print("Not running - start Agentmetry first (disposition writes via the API).")
+        return 1
+
+    if resp.status_code >= 400:
+        try:
+            detail = resp.json().get("detail")
+        except Exception:
+            detail = None
+        print(f"FAILED — {detail or resp.text or f'HTTP {resp.status_code}'}")
+        return 1
+
+    current = resp.json().get("disposition", {})
+    status = current.get("status", args.status)
+    print(f"Disposition set: {args.correlation_id} {args.rule_id} -> {status}")
+    return 0
+
+
 def cmd_logs(args: argparse.Namespace) -> int:
     log = _DATA_DIR / "logs" / "orchestrator.log"
     if not log.exists():
@@ -1132,6 +1213,14 @@ def main(argv: list[str] | None = None) -> int:
     sub.add_parser("status", help="orchestrator health and audit export status")
     stats = sub.add_parser("stats", help="audit trail metrics for dogfood (events, detections)")
     stats.add_argument("--days", type=int, default=7)
+    detections = sub.add_parser("detections", help="list detections for one session")
+    detections.add_argument("correlation_id", help="correlation_id / session id")
+    disposition = sub.add_parser("disposition", help="close an audit detection from the shell")
+    disposition.add_argument("correlation_id", help="session/correlation id that owns the detection")
+    disposition.add_argument("rule_id", help="detection rule id to close")
+    disposition.add_argument("--status", required=True, choices=_CLOSING_DISPOSITIONS)
+    disposition.add_argument("--note", default="")
+    disposition.add_argument("--decided-by", default="")
     logs = sub.add_parser("logs", help="tail the orchestrator log")
     logs.add_argument("-n", "--lines", type=int, default=50)
     logs.add_argument("-f", "--follow", action="store_true")
@@ -1273,6 +1362,8 @@ def main(argv: list[str] | None = None) -> int:
         "hook": cmd_hook,
         "status": cmd_status,
         "stats": cmd_stats,
+        "detections": cmd_detections,
+        "disposition": cmd_disposition,
         "logs": cmd_logs,
         "backup": cmd_backup,
         "restore": cmd_restore,

agentmetry-0.8.0/agentmetry/core/audit/detection/corpus/benign_env_example_read.jsonl

@@ -0,0 +1,4 @@
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp44-1", "event_id": "fp44-1-0", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp44-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:00:00+00:00", "tool": {"command": "cat .env.example", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp44-1", "event_id": "fp44-1-1", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp44-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:01:00+00:00", "tool": {"command": "cp .env.example .env.local", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp44-1", "event_id": "fp44-1-2", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp44-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:02:00+00:00", "tool": {"command": "cat config/.env.template", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Read", "server": "claude"}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp44-1", "event_id": "fp44-1-3", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp44-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:03:00+00:00", "tool": {"command": "npm run dev", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}

agentmetry-0.8.0/agentmetry/core/audit/detection/corpus/benign_fetch_piped_into_own_script.jsonl

@@ -0,0 +1,3 @@
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp50-1", "event_id": "fp50-1-0", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp50-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:00:00+00:00", "tool": {"command": "curl -s https://api.example.com/schema.json | python -c \"import sys,json;print(len(json.load(sys.stdin)))\"", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp50-1", "event_id": "fp50-1-1", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp50-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:02:00+00:00", "tool": {"command": "curl -s https://registry.example.com/v1/index | node -e \"let d='';process.stdin.on('data',c=>d+=c)\"", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp50-1", "event_id": "fp50-1-2", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp50-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:04:00+00:00", "tool": {"command": "pytest -q", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}

agentmetry-0.8.0/agentmetry/core/audit/detection/corpus/benign_github_raw_docs_then_script.jsonl

@@ -0,0 +1,3 @@
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp51-1", "event_id": "fp51-1-0", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp51-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:00:00+00:00", "tool": {"command": "curl -s https://raw.githubusercontent.com/psf/requests/main/README.md", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp51-1", "event_id": "fp51-1-1", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp51-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:06:00+00:00", "tool": {"command": "python -c \"import json;print(json.dumps({'ok':True}))\"", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp51-1", "event_id": "fp51-1-2", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp51-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:09:00+00:00", "tool": {"command": "pytest -q", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}

{agentmetry-0.6.0 → agentmetry-0.8.0}/agentmetry/core/audit/detection/corpus/benign_loopback_pipe_to_interpreter.jsonl

@@ -1,3 +1,3 @@
-{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "bl-1", "event_id": "bl-1-0", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.1.0", "session_id": "bl-1", "source": {"app": "claude"}, "timestamp_utc": "2026-07-30T10:00:00+00:00", "tool": {"command": "curl -s http://127.0.0.1:8000/api/v1/audit/status | python -c \"import sys,json;print(json.load(sys.stdin))\"", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude", "traits": ["pipe_to_shell_local", "risky_exec"]}}
-{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "bl-1", "event_id": "bl-1-1", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.1.0", "session_id": "bl-1", "source": {"app": "claude"}, "timestamp_utc": "2026-07-30T10:02:00+00:00", "tool": {"command": "curl -s http://localhost:3000/health | node -e \"process.stdin.pipe(process.stdout)\"", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude", "traits": ["pipe_to_shell_local", "risky_exec"]}}
-{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "bl-1", "event_id": "bl-1-2", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.1.0", "session_id": "bl-1", "source": {"app": "claude"}, "timestamp_utc": "2026-07-30T10:05:00+00:00", "tool": {"command": "npm run test", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude", "traits": []}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "bl-1", "event_id": "bl-1-0", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "bl-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:00:00+00:00", "tool": {"command": "curl -s http://127.0.0.1:8000/tmp/bootstrap.sh | bash", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude", "traits": ["pipe_to_shell_local", "risky_exec"]}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "bl-1", "event_id": "bl-1-1", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "bl-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:02:00+00:00", "tool": {"command": "curl -s http://localhost:3000/setup.sh | sh", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude", "traits": ["pipe_to_shell_local", "risky_exec"]}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "bl-1", "event_id": "bl-1-2", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "bl-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:04:00+00:00", "tool": {"command": "npm run test", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}

agentmetry-0.8.0/agentmetry/core/audit/detection/corpus/benign_mcp_text_mentions_credential_path.jsonl

@@ -0,0 +1,3 @@
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp49-1", "event_id": "fp49-1-0", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp49-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:00:00+00:00", "tool": {"arguments": {"channel": "#eng", "text": "reminder: never commit ~/.aws/credentials or ~/.ssh/id_rsa"}, "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "mcp.slack.post_message", "server": "claude"}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp49-1", "event_id": "fp49-1-1", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp49-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:02:00+00:00", "tool": {"arguments": {"description": "the old key is still in ~/.aws/credentials on the build box", "title": "Rotate keys"}, "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "mcp.linear.create_issue", "server": "claude"}}
+{"action": {"outcome": "success", "reason": "", "type": "tool_called"}, "actor": {"id": "corpus", "role": "agent", "type": "agent"}, "agent": {"name": "claude", "skill_id": ""}, "correlation_id": "fp49-1", "event_id": "fp49-1-2", "host_id": "corpus-host", "initiator": {"actor_type": "agent", "operator_id": "corpus", "trigger": "autonomous"}, "schema_version": "1.2.0", "session_id": "fp49-1", "source": {"app": "claude"}, "timestamp_utc": "2026-08-26T10:04:00+00:00", "tool": {"command": "git status", "input_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "qualified": "claude.Bash", "server": "claude"}}

{agentmetry-0.6.0 → agentmetry-0.8.0}/agentmetry/core/audit/detection/corpus/corpus.yaml

@@ -454,6 +454,48 @@ cases:
       at low with no T1105 and no TA0011, neither of which a loopback fetch
       earns.
 
+  - name: fetch piped into the interpreter's own script
+    session: benign_fetch_piped_into_own_script.jsonl
+    expect: []
+    benign: true
+    note: >
+      Issue #50. `curl api/x.json | python -c 'json.load(sys.stdin)'` was
+      critical. An interpreter handed its own program does not execute the pipe,
+      it reads it as data, so this is a data pipeline and not a cradle. The
+      cradle shapes have no inline script and still fire: see the two cases
+      above.
+
+  - name: read .env.example while setting a project up
+    session: benign_env_example_read.jsonl
+    expect: []
+    benign: true
+    note: >
+      Issue #44, six of seventeen week-one dogfood findings and every one a
+      critical. `.env.example` is the file you commit *instead* of a credential
+      file, and reading it is day one in any repository. A bare `.env` and
+      `.env.local` still map to credential access.
+
+  - name: fetch docs from GitHub raw, then run an unrelated script
+    session: benign_github_raw_docs_then_script.jsonl
+    expect: []
+    benign: true
+    note: >
+      Issue #51. Any staging-host fetch followed by any `python -c` was critical
+      with nothing linking the two. GitHub raw serves documentation as well as
+      payloads, and a fetch that only printed staged no artifact for a later
+      command to run. The bound form, where the file downloaded is the file
+      executed, still fires.
+
+  - name: MCP message that names a credential path
+    session: benign_mcp_text_mentions_credential_path.jsonl
+    expect: []
+    benign: true
+    note: >
+      Issue #49, the sibling of #44. Structured tool arguments have no shell
+      quoting to mask, so a path inside a free-text field read as a credential
+      access. Naming `~/.aws/credentials` in a Slack message is a mention. The
+      same path arriving in a `path` argument is still a read.
+
   - name: remote pipe to shell is still a cradle
     session: attack_remote_pipe_to_shell.jsonl
     expect: [encoded-command-download]

{agentmetry-0.6.0 → agentmetry-0.8.0}/agentmetry/core/audit/detection/rules.py

@@ -43,6 +43,7 @@ from .traits import (
     PR_MERGE_COMMAND as _PR_MERGE_COMMAND,
     RAW_IP_URL as _RAW_IP_URL,
     RISKY_EXEC_AFTER_STAGING as _RISKY_EXEC_AFTER_STAGING,
+    STAGES_ARTIFACT as _STAGES_ARTIFACT,
     STAGING_FETCH as _STAGING_FETCH,
     STAGING_HOST as _STAGING_HOST,
     UNTRUSTED_INPUT_COMMAND as _UNTRUSTED_INPUT_COMMAND,
@@ -307,7 +308,14 @@ def _is_staging_fetch(event: dict[str, Any]) -> bool:
         if not _STAGING_HOST.search(cmd):
             return False
         words = _command_words(event)
-        return bool(_STAGING_FETCH.search(words) or _DOWNLOAD_EXEC.search(words))
+        if not (_STAGING_FETCH.search(words) or _DOWNLOAD_EXEC.search(words)):
+            return False
+        # A fetch that only printed staged nothing, so there is no artifact for
+        # a later command to run. `curl raw.githubusercontent.com/.../README.md`
+        # followed an hour later by any `python -c` was reported as critical
+        # staging with no link between the two (issue #51). GitHub raw is where
+        # documentation lives as well as where payloads do.
+        return bool(_STAGES_ARTIFACT.search(cmd))
     return _has_trait(event, "staging_fetch")
 
 
@@ -1265,9 +1273,30 @@ HOST_REGISTRY = [
 #: and the alternative is calling every rule to find out what it might say.
 #: `test_detection_rule_identity.py` greps this module and fails if the two
 #: disagree, so it cannot drift silently.
+#: Rules that are in the tree and run, but are NOT part of the published set.
+#:
+#: `autonomous-unapproved-write` keys on `initiator.actor_type == "autonomous"`.
+#: The bus and SDK paths do produce that (cron, vault_watch, ingress, recovery),
+#: so the rule is correct and still registered. The IDE hook path never does:
+#: across roughly 32,000 events of real dogfood traffic from five agent
+#: surfaces, the actor is `human`, `agent` or `system` and never once
+#: `autonomous`. Ingest coercion deliberately cannot promote a client into it
+#: either, because that would let anyone fake this rule.
+#:
+#: So on every capture surface a user actually installs, it cannot fire. It was
+#: being counted in "fifteen detection rules", shipped in the Sigma pack at
+#: severity high, and named in the pitch as the flagship no-default-self-approve
+#: story. A published rule that cannot fire is a claim, not a detection.
+#:
+#: It stays registered so that a session which really is autonomous is still
+#: caught. It leaves the published set until a capture surface produces the
+#: signal it reads.
+EXPERIMENTAL_RULE_IDS: frozenset[str] = frozenset({
+    "autonomous-unapproved-write",
+})
+
 BUILTIN_RULE_IDS: frozenset[str] = frozenset({
     "credential-exfil",
-    "autonomous-unapproved-write",
     "discovery-then-collect",
     "approval-denied-then-executed",
     "encoded-command-download",

{agentmetry-0.6.0 → agentmetry-0.8.0}/agentmetry/core/audit/detection/traits.py

@@ -44,11 +44,22 @@ DOWNLOAD_EXEC = re.compile(
 ENCODED_CMD = re.compile(r"-enc(odedcommand)?\b|frombase64string", re.IGNORECASE)
 
 # Fetch remote content and feed it straight to an interpreter (ADI §4.2).
+# An interpreter given its own program does not execute the pipe; it reads it as
+# data. `curl api/x.json | python -c 'json.load(sys.stdin)'` is a data pipeline,
+# and calling it a download cradle put a critical on ordinary scripting (issue
+# #50). `curl x.sh | python` has no script of its own, so the download *is* the
+# program, and that stays a cradle.
+#
+# Residual, stated rather than hidden: `| python -c "exec(sys.stdin.read())"`
+# reaches for the download deliberately and slips this. INLINE_EVAL sees that
+# shape, and a cradle written that way is no longer hiding.
+_INLINE_SCRIPT = r"(?!\s*-\w*[ce]\b)"
+
 PIPE_TO_SHELL = re.compile(
     r"\b(curl|wget|iwr|invoke-webrequest|invoke-restmethod)\b[^|;&]*[|]\s*"
-    r"(sudo\s+)?\b(ba|z|k|da)?sh\b|"
+    r"(sudo\s+)?\b(ba|z|k|da)?sh\b" + _INLINE_SCRIPT + r"|"
     r"\b(curl|wget|iwr|invoke-webrequest|invoke-restmethod)\b[^|;&]*[|]\s*"
-    r"(iex|invoke-expression|python\d?|perl|ruby|node)\b",
+    r"(iex|invoke-expression|python\d?|perl|ruby|node)\b" + _INLINE_SCRIPT,
     re.IGNORECASE,
 )
 
@@ -314,6 +325,18 @@ RISKY_EXEC_AFTER_STAGING = re.compile(
     r"\bpowershell(?:\.exe)?\s+-(?:enc|f|file)\b",
     re.IGNORECASE,
 )
+#: A fetch that leaves something behind: written to disk, or handed onward. A
+#: fetch that only printed staged nothing, so there is no artifact for a later
+#: command to run (issue #51).
+STAGES_ARTIFACT = re.compile(
+    r"\s-[a-zA-Z]*[oO]|"          # curl -o / -O, wget -O
+    r"\s--output(?:-document)?|"
+    r"\s>\s*\S|"                     # shell redirect to a file
+    r"\s-[a-zA-Z]*P|"             # wget -P <dir>
+    r"[|]",                          # piped onward, including into an interpreter
+    re.IGNORECASE,
+)
+
 BENIGN_AFTER_STAGING = re.compile(
     r"\b(npm|yarn|pnpm|pip|pip3|cargo|go)\s+(?:install|run|build)\b",
     re.IGNORECASE,
@@ -359,13 +382,27 @@ CREDENTIAL_PATH = re.compile(
 # directly after something that reads a file. A bare mention in prose does not
 # qualify, which costs nothing: nobody reads a credential file without naming a
 # path or a verb.
+# `.env.example` is not a credential file. It is the file you commit *instead*
+# of one, and reading it is what every developer does on their first day in a
+# repository. It was six of seventeen week-one dogfood findings, every one a
+# critical, which is the exact rate at which people stop reading criticals
+# (issue #44).
+#
+# The lookahead sits immediately after `\.env` rather than at the end, because
+# at the end it fails and the engine simply matches the shorter `.env` prefix,
+# leaving the placeholder tagged anyway.
+#
+# Placeholders only. `.env.local`, `.env.production` and a bare `.env` still
+# match, because those hold real values.
+_ENV_PLACEHOLDER = r"(?!\.(?:example|sample|template|dist|defaults|placeholder)\b)"
+
 ENV_FILE = re.compile(
-    r"[\w.~$-]*[/\\]\.env(?:\.[A-Za-z0-9_-]+)?\b|"
+    r"[\w.~$-]*[/\\]\.env" + _ENV_PLACEHOLDER + r"(?:\.[A-Za-z0-9_-]+)?\b|"
     r"\b(?:cat|bat|less|more|head|tail|type|source|export|dotenv|load_dotenv|"
     r"get-content|gc|cp|mv|scp|rsync|base64|xxd|od|strings|"
     r"grep|rg|ag|awk|sed|nano|vim|vi|emacs|code|open|start)"
-    r"\s+(?:-[-\w]+\s+)*\.env(?:\.[A-Za-z0-9_-]+)?\b|"
-    r"^\s*\.env(?:\.[A-Za-z0-9_-]+)?\b",
+    r"\s+(?:-[-\w]+\s+)*\.env" + _ENV_PLACEHOLDER + r"(?:\.[A-Za-z0-9_-]+)?\b|"
+    r"^\s*\.env" + _ENV_PLACEHOLDER + r"(?:\.[A-Za-z0-9_-]+)?\b",
     re.IGNORECASE | re.MULTILINE,
 )
 

{agentmetry-0.6.0 → agentmetry-0.8.0}/agentmetry/core/audit/ingest.py

@@ -187,6 +187,7 @@ class _SchemaFields(NamedTuple):
     server_version: str
     list_changed: bool | None
     tool_digests: dict[str, str]
+    concealed: dict[str, int]
 
 
 def _schema_payload_fields(payload: dict[str, Any]) -> _SchemaFields:
@@ -202,6 +203,12 @@ def _schema_payload_fields(payload: dict[str, Any]) -> _SchemaFields:
     list_changed = payload.get("list_changed")
     if list_changed is not None and not isinstance(list_changed, bool):
         list_changed = None
+    raw_concealed = payload.get("schema_concealed")
+    concealed = (
+        {str(k): int(v) for k, v in raw_concealed.items() if isinstance(v, int)}
+        if isinstance(raw_concealed, dict)
+        else {}
+    )
     raw_digests = payload.get("schema_tool_digests")
     tool_digests = (
         {str(k): str(v) for k, v in raw_digests.items() if isinstance(v, str)}
@@ -209,7 +216,8 @@ def _schema_payload_fields(payload: dict[str, Any]) -> _SchemaFields:
         else {}
     )
     return _SchemaFields(
-        server, fingerprint, tool_count, source, server_version, list_changed, tool_digests
+        server, fingerprint, tool_count, source, server_version, list_changed,
+        tool_digests, concealed,
     )
 
 
@@ -232,22 +240,47 @@ def build_schema_canonical(
     from agentmetry.core.audit.canonical import SCHEMA_VERSION
     from agentmetry.core.audit.identity import identity_fields
     from agentmetry.core.audit.atlas import RUG_PULL
-    from agentmetry.core.diagnostics.mcp_schema import server_id
+    from agentmetry.core.diagnostics.mcp_schema import FORMATTING_CATEGORY, server_id
 
     fields = _schema_payload_fields(payload)
     server, fingerprint, tool_count = fields.server, fields.fingerprint, fields.tool_count
     server_version, list_changed = fields.server_version, fields.list_changed
     outcome = "changed" if status == "changed" else "success"
-    reason = (
-        "MCP tool schema changed; config may be unchanged (rug-pull candidate)"
-        if status == "changed"
-        else "MCP tool schema observed"
-    )
+    _REASONS = {
+        "changed": "MCP tool schema changed; config may be unchanged (rug-pull candidate)",
+        # Says what it is and what it is not. A re-baseline adopts whatever the
+        # server serves today without comparing it to anything, so if the server
+        # was already poisoned before our hashing changed, this event is the
+        # moment that state became the trusted one. `new` would have hidden that
+        # behind a word that also means "nothing was ever wrong here" (#146).
+        "rebaselined": (
+            "MCP tool schema re-baselined after a fingerprint change; "
+            "trust-on-first-use, not compared against the previous baseline"
+        ),
+    }
+    reason = _REASONS.get(status, "MCP tool schema observed")
+    _formatting = {k: v for k, v in fields.concealed.items() if k == FORMATTING_CATEGORY}
+    _concealment = {k: v for k, v in fields.concealed.items() if k != FORMATTING_CATEGORY}
     mcp_schema: dict[str, Any] = {
         "server_id": server_id(server) if server else "",
         "fingerprint": fingerprint,
         "tool_count": tool_count,
         "status": status,
+        # A baseline nobody has verified against a predecessor. Structured
+        # rather than left in the reason string so a SIEM can count them
+        # instead of matching prose.
+        **({"unverified_baseline": True} if status == "rebaselined" else {}),
+        # Concealed characters in strings the model reads. Counts per category,
+        # never the text. Attached on every status including `new`, because
+        # unlike everything else here it does not need a baseline: this is the
+        # one poisoning visible on a first sighting.
+        **({"concealed": _concealment} if _concealment else {}),
+        # Typography, kept apart from the evidence. A soft hyphen or a
+        # zero-width space arrives in descriptions imported from formatted
+        # documentation, and no neighbouring character can clear it the way one
+        # clears a ZWJ. Reporting it beside real concealment would make an
+        # operator who reads one finding distrust the next.
+        **({"formatting": _formatting} if _formatting else {}),
         # Only a schema that MOVED is the technique. `new` is the first
         # sight of a server and `same` is a quiet reconnect; tagging either
         # as a rug pull would put a Defense Evasion label on installing a

{agentmetry-0.6.0 → agentmetry-0.8.0}/agentmetry/core/audit/mitre.py

@@ -160,6 +160,33 @@ def _reaches_remote_host(text: str) -> bool:
     return any(not _LOOPBACK.match(host) for host in hosts)
 
 
+#: Argument names that carry free text a human or a model wrote. A credential
+#: path inside one of these is something being talked about.
+_PROSE_KEYS = frozenset(
+    {
+        "text", "content", "body", "message", "prompt", "query", "description",
+        "summary", "comment", "note", "title", "instruction", "instructions",
+        "question", "answer", "input", "output", "markdown", "html",
+    }
+)
+
+
+def _path_evidence_text(evidence: Any, fallback: str) -> str:
+    """Evidence with prose arguments removed, for path-based rules only.
+
+    Returns everything except the free-text values, so `{"path": "~/.ssh/id_rsa"}`
+    still reads as a credential access and `{"text": "look in ~/.ssh/id_rsa"}`
+    does not. Non-dict evidence is unchanged: there are no argument names to
+    reason about, and guessing would be worse than not trying.
+    """
+    if not isinstance(evidence, dict):
+        return fallback
+    kept = {k: v for k, v in evidence.items() if str(k).lower() not in _PROSE_KEYS}
+    if not kept:
+        return ""
+    return _evidence_text(kept)
+
+
 def _shell_text(evidence: Any) -> str | None:
     """The shell command inside `evidence`, or None if this is not shell text.
 
@@ -210,8 +237,21 @@ def get_mitre_mapping(
         # text somebody is writing, not a file somebody is reading. Structured
         # evidence is not masked at all -- see _shell_text.
         shell = _shell_text(evidence)
-        literal = mask_literals(shell, include_double=False).lower() if shell else text
-        written = mask_literals(shell).lower() if shell else text
+        if shell:
+            literal = mask_literals(shell, include_double=False).lower()
+            written = mask_literals(shell).lower()
+        else:
+            # Structured args, so there is no shell quoting to mask. Path rules
+            # then run against whichever values could plausibly *be* a path.
+            #
+            # An MCP tool called with `{"text": "check ~/.aws/credentials"}` is
+            # a message that names a file, not a read of one, and it was being
+            # mapped to T1552 (issue #49). Prose lives in `text`, `content`,
+            # `prompt` and their siblings; a path the tool will open arrives in
+            # `path`, `file`, `target`. Same defect class as #44: a mention
+            # treated as a read.
+            literal = _path_evidence_text(evidence, text)
+            written = text
         if PRIVATE_KEY_PATH.search(literal):
             return _PRIVATE_KEY
         if (