agentmetry 0.8.0__tar.gz → 0.9.1__tar.gz

{agentmetry-0.8.0 → agentmetry-0.9.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentmetry
-Version: 0.8.0
+Version: 0.9.1
 Summary: Local-first flight recorder for AI coding agents: hash-chained audit trail, MITRE-mapped sequence detection, DLP
 Project-URL: Homepage, https://agentmetry.ai
 Project-URL: Source, https://github.com/blitzcrieg1/agentmetry

{agentmetry-0.8.0 → agentmetry-0.9.1}/agentmetry/api/routes/audit.py

@@ -70,6 +70,19 @@ class IngestInitiatorBody(BaseModel):
         return v if v in _ACTOR_TYPES else "agent"
 
 
+class IngestOperatorBody(BaseModel):
+    """Which account the capture process ran as, and how it knew.
+
+    Separate from `initiator`, which says what kind of actor acted. A claim,
+    like everything a client sends: `run_context.resolve_operator` decides what
+    is recorded, and an orchestrator-side AGENTMETRY_OPERATOR_ID overrides an
+    id the hook only read from the operating system.
+    """
+
+    id: str = ""
+    source: str = ""
+
+
 class ExternalIngestBody(BaseModel):
     """Adapter payload — normalized to canonical v1.2 on ingest.
 
@@ -113,6 +126,8 @@ class ExternalIngestBody(BaseModel):
     tool_policy: dict[str, Any] | None = None
     # Who the capture surface says triggered this. Honoured by external.py.
     initiator: IngestInitiatorBody | None = None
+    # Which account ran the agent, resolved by the hook as the developer.
+    operator: IngestOperatorBody | None = None
     # Compact `tools/list` fingerprint from mcp_audit_proxy. Hash only: the
     # description never leaves the proxy process.
     schema_fingerprint: str = ""

{agentmetry-0.8.0 → agentmetry-0.9.1}/agentmetry/cli/__init__.py

@@ -284,6 +284,15 @@ def cmd_detections(args: argparse.Namespace) -> int:
     return 0
 
 
+def _triage_operator() -> str:
+    configured = os.environ.get("AGENTMETRY_OPERATOR_ID", "").strip()
+    if configured:
+        return configured
+    from agentmetry.core.operator_identity import os_operator
+
+    return os_operator()
+
+
 def cmd_disposition(args: argparse.Namespace) -> int:
     """Close a detection from the shell, using the same API as the dashboard."""
     note = args.note.strip()
@@ -299,7 +308,8 @@ def cmd_disposition(args: argparse.Namespace) -> int:
                 "rule_id": args.rule_id,
                 "status": args.status,
                 "note": note,
-                "decided_by": args.decided_by,
+                # The CLI runs as the person triaging; the orchestrator may not.
+                "decided_by": args.decided_by or _triage_operator(),
             },
             headers=_api_headers(),
             timeout=10.0,
@@ -896,6 +906,35 @@ def cmd_mcp(args: argparse.Namespace) -> int:
     return 0
 
 
+def cmd_otel(args: argparse.Namespace) -> int:
+    """Receive Claude Code's native OpenTelemetry stream and record it.
+
+    The other way in for Claude Code, with no hooks installed. It sees what ran,
+    after it ran, so it records and detects but enforces nothing.
+    """
+    from agentmetry.core.audit import otel_ingest
+
+    port = args.listen_port or otel_ingest.default_port()
+    if args.print_mapping:
+        for line in otel_ingest.mapping_lines():
+            print(line)
+        return 0
+    if args.print_env:
+        for line in otel_ingest.claude_env_lines(port):
+            print(line)
+        return 0
+
+    # The receiver forwards through the hook client, which reads its target and
+    # its command-text setting from the environment. Setting them here, in this
+    # process only, is what makes --port and --keep-command mean the same thing
+    # they mean everywhere else.
+    orchestrator = _api_base_url(args.port)
+    os.environ["AGENTMETRY_URL"] = orchestrator
+    if args.keep_command:
+        os.environ["AGENTMETRY_LOG_COMMANDS"] = "1"
+    return otel_ingest.serve(port, orchestrator)
+
+
 def cmd_anchor(args: argparse.Namespace) -> int:
     """Publish, list, or check the checkpoints that commit the trail externally.
 
@@ -1308,6 +1347,25 @@ def main(argv: list[str] | None = None) -> int:
         "--digest", action="store_true",
         help="also print the config digest, which names no server and is safe to publish",
     )
+    otel = sub.add_parser(
+        "otel", help="receive Claude Code's native OpenTelemetry stream (no hooks needed)"
+    )
+    otel.add_argument(
+        "--listen-port", type=int, default=None,
+        help="port on 127.0.0.1 to receive OTLP on (default AGENTMETRY_OTEL_PORT or 4318)",
+    )
+    otel.add_argument(
+        "--keep-command", action="store_true",
+        help="keep scrubbed command text, as AGENTMETRY_LOG_COMMANDS=1 does for hooks",
+    )
+    otel.add_argument(
+        "--print-mapping", action="store_true",
+        help="list which events are mapped, counted, or unmapped, and exit",
+    )
+    otel.add_argument(
+        "--print-env", action="store_true",
+        help="print the environment Claude Code needs to send here, and exit",
+    )
     verify = sub.add_parser("verify", help="verify evidence pack or JSONL trail chain")
     verify.add_argument(
         "path",
@@ -1374,6 +1432,7 @@ def main(argv: list[str] | None = None) -> int:
         "prove": cmd_prove,
         "anchor": cmd_anchor,
         "mcp": cmd_mcp,
+        "otel": cmd_otel,
         "import-agt": cmd_import_agt,
         "doctor": cmd_doctor,
         "benchmark": cmd_benchmark,

{agentmetry-0.8.0 → agentmetry-0.9.1}/agentmetry/core/audit/detection/disposition.py

@@ -431,8 +431,14 @@ def build_disposition_event(
     `action.type:detection_disposition AND action.outcome:risk_accepted`
     without understanding Agentmetry's vocabulary. The note is operator-written
     text, never captured command content, so it is safe to forward.
+
+    Who decided falls back to the resolved operator, not to the raw setting:
+    with AGENTMETRY_OPERATOR_ID unset that was an empty string, so a triage
+    record could not say who triaged.
     """
-    from agentmetry.core.config import settings
+    from agentmetry.core.audit.run_context import resolve_operator
+
+    decided_by = decided_by or resolve_operator()[0]
 
     return {
         "schema_version": SCHEMA_VERSION,
@@ -443,8 +449,8 @@ def build_disposition_event(
         **identity_fields(),
         "source_topic": f"disposition/{rule_id}",
         "source": {"tier": "detection", "app": "agentmetry"},
-        "actor": {"id": decided_by or settings.operator_id, "type": "human"},
-        "initiator": {"type": "human", "id": decided_by or settings.operator_id},
+        "actor": {"id": decided_by, "type": "human"},
+        "initiator": {"type": "human", "id": decided_by},
         "action": {
             "type": DISPOSITION_EVENT_TYPE,
             "outcome": status,
@@ -459,7 +465,7 @@ def build_disposition_event(
             "previous_status": previous_status,
             "assignee": assignee,
             "note": note,
-            "decided_by": decided_by or settings.operator_id,
+            "decided_by": decided_by,
         },
     }
 

{agentmetry-0.8.0 → agentmetry-0.9.1}/agentmetry/core/audit/dlp/loader.py

@@ -4,6 +4,13 @@ from typing import List
 
 from .models import RuleMeta
 
+#: libyaml where it is installed. The pure-Python parser was most of the hook's
+#: runtime: the DLP and tool manifests are re-read by every hook process, and
+#: parsing them took ~55 ms of an ~85 ms tool call (#171). Same SafeConstructor,
+#: so the same Python objects, which `test_hook_import_cost.py` checks.
+SAFE_LOADER = getattr(yaml, "CSafeLoader", yaml.SafeLoader)
+
+
 def load_dlp_rules(manifest_path: Path | str) -> List[RuleMeta]:
     """Load DLP rules from a YAML manifest file."""
     path = Path(manifest_path)
@@ -11,7 +18,7 @@ def load_dlp_rules(manifest_path: Path | str) -> List[RuleMeta]:
         return []
     
     with open(path, "r", encoding="utf-8") as f:
-        data = yaml.safe_load(f)
+        data = yaml.load(f, Loader=SAFE_LOADER)  # noqa: S506 - a safe loader
     
     if not data or "rules" not in data:
         return []

{agentmetry-0.8.0 → agentmetry-0.9.1}/agentmetry/core/audit/dlp/scanner.py

@@ -5,7 +5,9 @@ from typing import Any, Dict
 
 from .models import DlpVerdict, DlpMatch
 from .loader import load_dlp_rules
-from ...config import settings
+# Not core.config: that import is pydantic, and the hook paid ~220 ms for it
+# on every tool call to read three values (#171).
+from ..policy_settings import policy_settings
 
 logger = logging.getLogger(__name__)
 
@@ -21,9 +23,10 @@ def reset_rules() -> None:
 def _init_rules() -> None:
     if _COMPILED_RULES:
         return
-    rules = load_dlp_rules(settings.dlp_rules_path)
+    cfg = policy_settings()
+    rules = load_dlp_rules(cfg.dlp_rules_path)
     for r in rules:
-        if not settings.dlp_pii and r.category == "pii":
+        if not cfg.dlp_pii and r.category == "pii":
             continue
         try:
             _COMPILED_RULES.append((re.compile(r.pattern), r))
@@ -59,7 +62,7 @@ def scan(tool_qualified: str, arguments: Dict[str, Any] | str, mode: str | None
     metadata is returned — never the matched value.
     """
     if mode is None:
-        mode = settings.dlp_mode
+        mode = policy_settings().dlp_mode
     if mode == "disable":
         return DlpVerdict(matched=False, mode=mode)
 

{agentmetry-0.8.0 → agentmetry-0.9.1}/agentmetry/core/audit/evidence_pack.py

@@ -23,6 +23,7 @@ from pathlib import Path
 from typing import Any
 
 from agentmetry.core.audit.detection.disposition import extract_dispositions
+from agentmetry.core.audit.run_context import resolve_operator
 from agentmetry.core.config import settings
 from agentmetry.core.version import __version__
 
@@ -290,7 +291,7 @@ def _controls_snapshot() -> dict[str, Any]:
         "detection": {
             "off_hours_enabled": settings.detect_off_hours,
         },
-        "operator_id": settings.operator_id.strip() or "local",
+        "operator_id": resolve_operator()[0],
     }
 
 

{agentmetry-0.8.0 → agentmetry-0.9.1}/agentmetry/core/audit/external.py

@@ -10,7 +10,11 @@ from agentmetry.core.audit.canonical import SCHEMA_VERSION
 from agentmetry.core.audit.identity import identity_fields
 from agentmetry.core.audit.hashing import arguments_sha256
 from agentmetry.core.audit.redaction import scrub_arg_values, scrub_secrets
-from agentmetry.core.audit.run_context import actor_from_initiator, build_initiator
+from agentmetry.core.audit.run_context import (
+    actor_from_initiator,
+    build_initiator,
+    operator_from_payload,
+)
 from agentmetry.core.config import settings
 
 ExternalApp = Literal[
@@ -34,10 +38,6 @@ _ACTION_MAP = {
 }
 
 
-def _operator_id() -> str:
-    return settings.operator_id.strip() or "local"
-
-
 def _utc_now() -> str:
     return datetime.now(timezone.utc).isoformat()
 
@@ -63,16 +63,18 @@ def build_external_canonical(payload: dict[str, Any]) -> dict[str, Any]:
     correlation_id = str(payload.get("correlation_id") or payload.get("thread_id") or "")
     session_id = str(payload.get("session_id") or "")
 
+    operator = operator_from_payload(payload)
     initiator_raw = payload.get("initiator")
     if isinstance(initiator_raw, dict) and initiator_raw.get("actor_type"):
         initiator = {
             "actor_type": str(initiator_raw.get("actor_type") or "human"),
             "trigger": str(initiator_raw.get("trigger") or "manual"),
-            "operator_id": str(initiator_raw.get("operator_id") or _operator_id()),
+            "operator_id": operator[0],
+            "operator_source": operator[1],
         }
     else:
         trigger = str(payload.get("triggered_by") or "manual")
-        initiator = build_initiator(trigger)
+        initiator = build_initiator(trigger, operator)
 
     tool_block = payload.get("tool") if isinstance(payload.get("tool"), dict) else {}
     tool_qualified = str(