agentmetry 0.7.0__tar.gz → 0.9.0__tar.gz

{agentmetry-0.7.0 → agentmetry-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentmetry
-Version: 0.7.0
+Version: 0.9.0
 Summary: Local-first flight recorder for AI coding agents: hash-chained audit trail, MITRE-mapped sequence detection, DLP
 Project-URL: Homepage, https://agentmetry.ai
 Project-URL: Source, https://github.com/blitzcrieg1/agentmetry
@@ -25,7 +25,7 @@ Requires-Python: >=3.11
 Requires-Dist: aiosqlite>=0.20.0
 Requires-Dist: fastapi>=0.115.0
 Requires-Dist: httpx>=0.28.0
-Requires-Dist: mcp>=1.2
+Requires-Dist: mcp<2,>=1.2
 Requires-Dist: pydantic-settings>=2.6.0
 Requires-Dist: pydantic>=2.9.0
 Requires-Dist: pyyaml>=6.0
@@ -37,7 +37,7 @@ Provides-Extra: dev
 Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
 Requires-Dist: pytest-cov>=6.0; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
-Requires-Dist: ruff==0.16.4; extra == 'dev'
+Requires-Dist: ruff==0.16.6; extra == 'dev'
 Description-Content-Type: text/markdown
 
 # Agentmetry

{agentmetry-0.7.0 → agentmetry-0.9.0}/agentmetry/api/routes/audit.py

@@ -122,6 +122,10 @@ class ExternalIngestBody(BaseModel):
     # fields that separate a shipped release from a rug pull. All hashes and
     # flags: no tool name, no description, nothing model-visible.
     schema_tool_digests: dict[str, str] = Field(default_factory=dict)
+    # Concealed-character counts per category. Declared here because pydantic
+    # drops what it does not know, silently, which has already cost this file
+    # two shipped bugs.
+    schema_concealed: dict[str, int] = Field(default_factory=dict)
     server_version: str = ""
     list_changed: bool | None = None
 

{agentmetry-0.7.0 → agentmetry-0.9.0}/agentmetry/cli/__init__.py

@@ -34,6 +34,7 @@ _BACKUP_EXCLUDE_DIRS = {"logs"}
 logger = logging.getLogger(__name__)
 
 _BACKUP_EXCLUDE_SUFFIXES = {".pid"}
+_CLOSING_DISPOSITIONS = ("resolved", "false_positive", "risk_accepted")
 
 
 def _base_url(port: int, host: str = "127.0.0.1") -> str:
@@ -41,6 +42,15 @@ def _base_url(port: int, host: str = "127.0.0.1") -> str:
     return f"http://{display}:{port}"
 
 
+def _api_base_url(port: int) -> str:
+    return os.environ.get("AGENTMETRY_URL", "").strip().rstrip("/") or _base_url(port)
+
+
+def _api_headers() -> dict[str, str]:
+    key = os.environ.get("AGENTMETRY_API_KEY", "").strip()
+    return {"X-API-Key": key} if key else {}
+
+
 def _lan_ip() -> str | None:
     """Best-effort local IPv4 for phone/LAN access hints."""
     try:
@@ -219,7 +229,8 @@ def cmd_stats(args: argparse.Namespace) -> int:
         return 1
 
     if not data.get("enabled", True):
-        print("Audit export disabled — enable AGENTMETRY_AUDIT_EXPORT to collect stats.")
+        print("Audit export is disabled, so no events are recorded and stats are empty.")
+        print("Set AGENTMETRY_AUDIT_EXPORT_ENABLED=1 and restart.")
         return 1
 
     days = data.get("window_days", args.days)
@@ -241,6 +252,76 @@ def cmd_stats(args: argparse.Namespace) -> int:
     return 0
 
 
+def cmd_detections(args: argparse.Namespace) -> int:
+    try:
+        data = httpx.get(
+            f"{_base_url(args.port)}/api/v1/audit/detections/{args.correlation_id}",
+            timeout=10.0,
+        ).json()
+    except Exception:
+        print("Not running - start Agentmetry first (detections reads via the API).")
+        return 1
+    if not data.get("enabled", True):
+        print("Audit export is disabled, so no sessions are recorded.")
+        print("Set AGENTMETRY_AUDIT_EXPORT_ENABLED=1 and restart.")
+        return 1
+    detections = data.get("detections") or []
+    if not detections:
+        print(f"No detections for {args.correlation_id}.")
+        return 0
+    rule_width = max(len("Rule"), *(len(str(d.get("rule_id", ""))) for d in detections))
+    severity_width = max(
+        len("Severity"), *(len(str(d.get("severity", ""))) for d in detections)
+    )
+    print(f"{'Rule':<{rule_width}}  {'Severity':<{severity_width}}  Summary")
+    print(f"{'-' * rule_width}  {'-' * severity_width}  {'-' * len('Summary')}")
+    for detection in detections:
+        print(
+            f"{str(detection.get('rule_id', '')):<{rule_width}}  "
+            f"{str(detection.get('severity', '')):<{severity_width}}  "
+            f"{detection.get('summary', '')}"
+        )
+    return 0
+
+
+def cmd_disposition(args: argparse.Namespace) -> int:
+    """Close a detection from the shell, using the same API as the dashboard."""
+    note = args.note.strip()
+    if args.status in {"false_positive", "risk_accepted"} and not note:
+        print(f"--note is required for {args.status}")
+        return 1
+
+    try:
+        resp = httpx.post(
+            f"{_api_base_url(args.port)}/api/v1/audit/detections/disposition",
+            json={
+                "correlation_id": args.correlation_id,
+                "rule_id": args.rule_id,
+                "status": args.status,
+                "note": note,
+                "decided_by": args.decided_by,
+            },
+            headers=_api_headers(),
+            timeout=10.0,
+        )
+    except Exception:
+        print("Not running - start Agentmetry first (disposition writes via the API).")
+        return 1
+
+    if resp.status_code >= 400:
+        try:
+            detail = resp.json().get("detail")
+        except Exception:
+            detail = None
+        print(f"FAILED — {detail or resp.text or f'HTTP {resp.status_code}'}")
+        return 1
+
+    current = resp.json().get("disposition", {})
+    status = current.get("status", args.status)
+    print(f"Disposition set: {args.correlation_id} {args.rule_id} -> {status}")
+    return 0
+
+
 def cmd_logs(args: argparse.Namespace) -> int:
     log = _DATA_DIR / "logs" / "orchestrator.log"
     if not log.exists():
@@ -815,6 +896,35 @@ def cmd_mcp(args: argparse.Namespace) -> int:
     return 0
 
 
+def cmd_otel(args: argparse.Namespace) -> int:
+    """Receive Claude Code's native OpenTelemetry stream and record it.
+
+    The other way in for Claude Code, with no hooks installed. It sees what ran,
+    after it ran, so it records and detects but enforces nothing.
+    """
+    from agentmetry.core.audit import otel_ingest
+
+    port = args.listen_port or otel_ingest.default_port()
+    if args.print_mapping:
+        for line in otel_ingest.mapping_lines():
+            print(line)
+        return 0
+    if args.print_env:
+        for line in otel_ingest.claude_env_lines(port):
+            print(line)
+        return 0
+
+    # The receiver forwards through the hook client, which reads its target and
+    # its command-text setting from the environment. Setting them here, in this
+    # process only, is what makes --port and --keep-command mean the same thing
+    # they mean everywhere else.
+    orchestrator = _api_base_url(args.port)
+    os.environ["AGENTMETRY_URL"] = orchestrator
+    if args.keep_command:
+        os.environ["AGENTMETRY_LOG_COMMANDS"] = "1"
+    return otel_ingest.serve(port, orchestrator)
+
+
 def cmd_anchor(args: argparse.Namespace) -> int:
     """Publish, list, or check the checkpoints that commit the trail externally.
 
@@ -1132,6 +1242,14 @@ def main(argv: list[str] | None = None) -> int:
     sub.add_parser("status", help="orchestrator health and audit export status")
     stats = sub.add_parser("stats", help="audit trail metrics for dogfood (events, detections)")
     stats.add_argument("--days", type=int, default=7)
+    detections = sub.add_parser("detections", help="list detections for one session")
+    detections.add_argument("correlation_id", help="correlation_id / session id")
+    disposition = sub.add_parser("disposition", help="close an audit detection from the shell")
+    disposition.add_argument("correlation_id", help="session/correlation id that owns the detection")
+    disposition.add_argument("rule_id", help="detection rule id to close")
+    disposition.add_argument("--status", required=True, choices=_CLOSING_DISPOSITIONS)
+    disposition.add_argument("--note", default="")
+    disposition.add_argument("--decided-by", default="")
     logs = sub.add_parser("logs", help="tail the orchestrator log")
     logs.add_argument("-n", "--lines", type=int, default=50)
     logs.add_argument("-f", "--follow", action="store_true")
@@ -1219,6 +1337,25 @@ def main(argv: list[str] | None = None) -> int:
         "--digest", action="store_true",
         help="also print the config digest, which names no server and is safe to publish",
     )
+    otel = sub.add_parser(
+        "otel", help="receive Claude Code's native OpenTelemetry stream (no hooks needed)"
+    )
+    otel.add_argument(
+        "--listen-port", type=int, default=None,
+        help="port on 127.0.0.1 to receive OTLP on (default AGENTMETRY_OTEL_PORT or 4318)",
+    )
+    otel.add_argument(
+        "--keep-command", action="store_true",
+        help="keep scrubbed command text, as AGENTMETRY_LOG_COMMANDS=1 does for hooks",
+    )
+    otel.add_argument(
+        "--print-mapping", action="store_true",
+        help="list which events are mapped, counted, or unmapped, and exit",
+    )
+    otel.add_argument(
+        "--print-env", action="store_true",
+        help="print the environment Claude Code needs to send here, and exit",
+    )
     verify = sub.add_parser("verify", help="verify evidence pack or JSONL trail chain")
     verify.add_argument(
         "path",
@@ -1273,6 +1410,8 @@ def main(argv: list[str] | None = None) -> int:
         "hook": cmd_hook,
         "status": cmd_status,
         "stats": cmd_stats,
+        "detections": cmd_detections,
+        "disposition": cmd_disposition,
         "logs": cmd_logs,
         "backup": cmd_backup,
         "restore": cmd_restore,
@@ -1283,6 +1422,7 @@ def main(argv: list[str] | None = None) -> int:
         "prove": cmd_prove,
         "anchor": cmd_anchor,
         "mcp": cmd_mcp,
+        "otel": cmd_otel,
         "import-agt": cmd_import_agt,
         "doctor": cmd_doctor,
         "benchmark": cmd_benchmark,

{agentmetry-0.7.0 → agentmetry-0.9.0}/agentmetry/core/audit/ingest.py

@@ -187,6 +187,7 @@ class _SchemaFields(NamedTuple):
     server_version: str
     list_changed: bool | None
     tool_digests: dict[str, str]
+    concealed: dict[str, int]
 
 
 def _schema_payload_fields(payload: dict[str, Any]) -> _SchemaFields:
@@ -202,6 +203,12 @@ def _schema_payload_fields(payload: dict[str, Any]) -> _SchemaFields:
     list_changed = payload.get("list_changed")
     if list_changed is not None and not isinstance(list_changed, bool):
         list_changed = None
+    raw_concealed = payload.get("schema_concealed")
+    concealed = (
+        {str(k): int(v) for k, v in raw_concealed.items() if isinstance(v, int)}
+        if isinstance(raw_concealed, dict)
+        else {}
+    )
     raw_digests = payload.get("schema_tool_digests")
     tool_digests = (
         {str(k): str(v) for k, v in raw_digests.items() if isinstance(v, str)}
@@ -209,7 +216,8 @@ def _schema_payload_fields(payload: dict[str, Any]) -> _SchemaFields:
         else {}
     )
     return _SchemaFields(
-        server, fingerprint, tool_count, source, server_version, list_changed, tool_digests
+        server, fingerprint, tool_count, source, server_version, list_changed,
+        tool_digests, concealed,
     )
 
 
@@ -232,22 +240,47 @@ def build_schema_canonical(
     from agentmetry.core.audit.canonical import SCHEMA_VERSION
     from agentmetry.core.audit.identity import identity_fields
     from agentmetry.core.audit.atlas import RUG_PULL
-    from agentmetry.core.diagnostics.mcp_schema import server_id
+    from agentmetry.core.diagnostics.mcp_schema import FORMATTING_CATEGORY, server_id
 
     fields = _schema_payload_fields(payload)
     server, fingerprint, tool_count = fields.server, fields.fingerprint, fields.tool_count
     server_version, list_changed = fields.server_version, fields.list_changed
     outcome = "changed" if status == "changed" else "success"
-    reason = (
-        "MCP tool schema changed; config may be unchanged (rug-pull candidate)"
-        if status == "changed"
-        else "MCP tool schema observed"
-    )
+    _REASONS = {
+        "changed": "MCP tool schema changed; config may be unchanged (rug-pull candidate)",
+        # Says what it is and what it is not. A re-baseline adopts whatever the
+        # server serves today without comparing it to anything, so if the server
+        # was already poisoned before our hashing changed, this event is the
+        # moment that state became the trusted one. `new` would have hidden that
+        # behind a word that also means "nothing was ever wrong here" (#146).
+        "rebaselined": (
+            "MCP tool schema re-baselined after a fingerprint change; "
+            "trust-on-first-use, not compared against the previous baseline"
+        ),
+    }
+    reason = _REASONS.get(status, "MCP tool schema observed")
+    _formatting = {k: v for k, v in fields.concealed.items() if k == FORMATTING_CATEGORY}
+    _concealment = {k: v for k, v in fields.concealed.items() if k != FORMATTING_CATEGORY}
     mcp_schema: dict[str, Any] = {
         "server_id": server_id(server) if server else "",
         "fingerprint": fingerprint,
         "tool_count": tool_count,
         "status": status,
+        # A baseline nobody has verified against a predecessor. Structured
+        # rather than left in the reason string so a SIEM can count them
+        # instead of matching prose.
+        **({"unverified_baseline": True} if status == "rebaselined" else {}),
+        # Concealed characters in strings the model reads. Counts per category,
+        # never the text. Attached on every status including `new`, because
+        # unlike everything else here it does not need a baseline: this is the
+        # one poisoning visible on a first sighting.
+        **({"concealed": _concealment} if _concealment else {}),
+        # Typography, kept apart from the evidence. A soft hyphen or a
+        # zero-width space arrives in descriptions imported from formatted
+        # documentation, and no neighbouring character can clear it the way one
+        # clears a ZWJ. Reporting it beside real concealment would make an
+        # operator who reads one finding distrust the next.
+        **({"formatting": _formatting} if _formatting else {}),
         # Only a schema that MOVED is the technique. `new` is the first
         # sight of a server and `same` is a quiet reconnect; tagging either
         # as a rug pull would put a Defense Evasion label on installing a