agentmetry 0.9.0__tar.gz → 0.9.1__tar.gz

{agentmetry-0.9.0 → agentmetry-0.9.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentmetry
-Version: 0.9.0
+Version: 0.9.1
 Summary: Local-first flight recorder for AI coding agents: hash-chained audit trail, MITRE-mapped sequence detection, DLP
 Project-URL: Homepage, https://agentmetry.ai
 Project-URL: Source, https://github.com/blitzcrieg1/agentmetry

{agentmetry-0.9.0 → agentmetry-0.9.1}/agentmetry/api/routes/audit.py

@@ -70,6 +70,19 @@ class IngestInitiatorBody(BaseModel):
         return v if v in _ACTOR_TYPES else "agent"
 
 
+class IngestOperatorBody(BaseModel):
+    """Which account the capture process ran as, and how it knew.
+
+    Separate from `initiator`, which says what kind of actor acted. A claim,
+    like everything a client sends: `run_context.resolve_operator` decides what
+    is recorded, and an orchestrator-side AGENTMETRY_OPERATOR_ID overrides an
+    id the hook only read from the operating system.
+    """
+
+    id: str = ""
+    source: str = ""
+
+
 class ExternalIngestBody(BaseModel):
     """Adapter payload — normalized to canonical v1.2 on ingest.
 
@@ -113,6 +126,8 @@ class ExternalIngestBody(BaseModel):
     tool_policy: dict[str, Any] | None = None
     # Who the capture surface says triggered this. Honoured by external.py.
     initiator: IngestInitiatorBody | None = None
+    # Which account ran the agent, resolved by the hook as the developer.
+    operator: IngestOperatorBody | None = None
     # Compact `tools/list` fingerprint from mcp_audit_proxy. Hash only: the
     # description never leaves the proxy process.
     schema_fingerprint: str = ""

{agentmetry-0.9.0 → agentmetry-0.9.1}/agentmetry/cli/__init__.py

@@ -284,6 +284,15 @@ def cmd_detections(args: argparse.Namespace) -> int:
     return 0
 
 
+def _triage_operator() -> str:
+    configured = os.environ.get("AGENTMETRY_OPERATOR_ID", "").strip()
+    if configured:
+        return configured
+    from agentmetry.core.operator_identity import os_operator
+
+    return os_operator()
+
+
 def cmd_disposition(args: argparse.Namespace) -> int:
     """Close a detection from the shell, using the same API as the dashboard."""
     note = args.note.strip()
@@ -299,7 +308,8 @@ def cmd_disposition(args: argparse.Namespace) -> int:
                 "rule_id": args.rule_id,
                 "status": args.status,
                 "note": note,
-                "decided_by": args.decided_by,
+                # The CLI runs as the person triaging; the orchestrator may not.
+                "decided_by": args.decided_by or _triage_operator(),
             },
             headers=_api_headers(),
             timeout=10.0,

{agentmetry-0.9.0 → agentmetry-0.9.1}/agentmetry/core/audit/detection/disposition.py

@@ -431,8 +431,14 @@ def build_disposition_event(
     `action.type:detection_disposition AND action.outcome:risk_accepted`
     without understanding Agentmetry's vocabulary. The note is operator-written
     text, never captured command content, so it is safe to forward.
+
+    Who decided falls back to the resolved operator, not to the raw setting:
+    with AGENTMETRY_OPERATOR_ID unset that was an empty string, so a triage
+    record could not say who triaged.
     """
-    from agentmetry.core.config import settings
+    from agentmetry.core.audit.run_context import resolve_operator
+
+    decided_by = decided_by or resolve_operator()[0]
 
     return {
         "schema_version": SCHEMA_VERSION,
@@ -443,8 +449,8 @@ def build_disposition_event(
         **identity_fields(),
         "source_topic": f"disposition/{rule_id}",
         "source": {"tier": "detection", "app": "agentmetry"},
-        "actor": {"id": decided_by or settings.operator_id, "type": "human"},
-        "initiator": {"type": "human", "id": decided_by or settings.operator_id},
+        "actor": {"id": decided_by, "type": "human"},
+        "initiator": {"type": "human", "id": decided_by},
         "action": {
             "type": DISPOSITION_EVENT_TYPE,
             "outcome": status,
@@ -459,7 +465,7 @@ def build_disposition_event(
             "previous_status": previous_status,
             "assignee": assignee,
             "note": note,
-            "decided_by": decided_by or settings.operator_id,
+            "decided_by": decided_by,
         },
     }
 

{agentmetry-0.9.0 → agentmetry-0.9.1}/agentmetry/core/audit/dlp/loader.py

@@ -4,6 +4,13 @@ from typing import List
 
 from .models import RuleMeta
 
+#: libyaml where it is installed. The pure-Python parser was most of the hook's
+#: runtime: the DLP and tool manifests are re-read by every hook process, and
+#: parsing them took ~55 ms of an ~85 ms tool call (#171). Same SafeConstructor,
+#: so the same Python objects, which `test_hook_import_cost.py` checks.
+SAFE_LOADER = getattr(yaml, "CSafeLoader", yaml.SafeLoader)
+
+
 def load_dlp_rules(manifest_path: Path | str) -> List[RuleMeta]:
     """Load DLP rules from a YAML manifest file."""
     path = Path(manifest_path)
@@ -11,7 +18,7 @@ def load_dlp_rules(manifest_path: Path | str) -> List[RuleMeta]:
         return []
     
     with open(path, "r", encoding="utf-8") as f:
-        data = yaml.safe_load(f)
+        data = yaml.load(f, Loader=SAFE_LOADER)  # noqa: S506 - a safe loader
     
     if not data or "rules" not in data:
         return []

{agentmetry-0.9.0 → agentmetry-0.9.1}/agentmetry/core/audit/dlp/scanner.py

@@ -5,7 +5,9 @@ from typing import Any, Dict
 
 from .models import DlpVerdict, DlpMatch
 from .loader import load_dlp_rules
-from ...config import settings
+# Not core.config: that import is pydantic, and the hook paid ~220 ms for it
+# on every tool call to read three values (#171).
+from ..policy_settings import policy_settings
 
 logger = logging.getLogger(__name__)
 
@@ -21,9 +23,10 @@ def reset_rules() -> None:
 def _init_rules() -> None:
     if _COMPILED_RULES:
         return
-    rules = load_dlp_rules(settings.dlp_rules_path)
+    cfg = policy_settings()
+    rules = load_dlp_rules(cfg.dlp_rules_path)
     for r in rules:
-        if not settings.dlp_pii and r.category == "pii":
+        if not cfg.dlp_pii and r.category == "pii":
             continue
         try:
             _COMPILED_RULES.append((re.compile(r.pattern), r))
@@ -59,7 +62,7 @@ def scan(tool_qualified: str, arguments: Dict[str, Any] | str, mode: str | None
     metadata is returned — never the matched value.
     """
     if mode is None:
-        mode = settings.dlp_mode
+        mode = policy_settings().dlp_mode
     if mode == "disable":
         return DlpVerdict(matched=False, mode=mode)
 

{agentmetry-0.9.0 → agentmetry-0.9.1}/agentmetry/core/audit/evidence_pack.py

@@ -23,6 +23,7 @@ from pathlib import Path
 from typing import Any
 
 from agentmetry.core.audit.detection.disposition import extract_dispositions
+from agentmetry.core.audit.run_context import resolve_operator
 from agentmetry.core.config import settings
 from agentmetry.core.version import __version__
 
@@ -290,7 +291,7 @@ def _controls_snapshot() -> dict[str, Any]:
         "detection": {
             "off_hours_enabled": settings.detect_off_hours,
         },
-        "operator_id": settings.operator_id.strip() or "local",
+        "operator_id": resolve_operator()[0],
     }
 
 

{agentmetry-0.9.0 → agentmetry-0.9.1}/agentmetry/core/audit/external.py

@@ -10,7 +10,11 @@ from agentmetry.core.audit.canonical import SCHEMA_VERSION
 from agentmetry.core.audit.identity import identity_fields
 from agentmetry.core.audit.hashing import arguments_sha256
 from agentmetry.core.audit.redaction import scrub_arg_values, scrub_secrets
-from agentmetry.core.audit.run_context import actor_from_initiator, build_initiator
+from agentmetry.core.audit.run_context import (
+    actor_from_initiator,
+    build_initiator,
+    operator_from_payload,
+)
 from agentmetry.core.config import settings
 
 ExternalApp = Literal[
@@ -34,10 +38,6 @@ _ACTION_MAP = {
 }
 
 
-def _operator_id() -> str:
-    return settings.operator_id.strip() or "local"
-
-
 def _utc_now() -> str:
     return datetime.now(timezone.utc).isoformat()
 
@@ -63,16 +63,18 @@ def build_external_canonical(payload: dict[str, Any]) -> dict[str, Any]:
     correlation_id = str(payload.get("correlation_id") or payload.get("thread_id") or "")
     session_id = str(payload.get("session_id") or "")
 
+    operator = operator_from_payload(payload)
     initiator_raw = payload.get("initiator")
     if isinstance(initiator_raw, dict) and initiator_raw.get("actor_type"):
         initiator = {
             "actor_type": str(initiator_raw.get("actor_type") or "human"),
             "trigger": str(initiator_raw.get("trigger") or "manual"),
-            "operator_id": str(initiator_raw.get("operator_id") or _operator_id()),
+            "operator_id": operator[0],
+            "operator_source": operator[1],
         }
     else:
         trigger = str(payload.get("triggered_by") or "manual")
-        initiator = build_initiator(trigger)
+        initiator = build_initiator(trigger, operator)
 
     tool_block = payload.get("tool") if isinstance(payload.get("tool"), dict) else {}
     tool_qualified = str(

{agentmetry-0.9.0 → agentmetry-0.9.1}/agentmetry/core/audit/otel_ingest.py

@@ -276,7 +276,7 @@ def _map_tool_decision(attrs: dict[str, Any], ts_iso: str) -> tuple[dict[str, An
             "outcome": "success",
             "reason": f"otel_decision:{source}",
             "tool_qualified": str(attrs.get("tool_name") or ""),
-            "initiator": {"actor_type": "human", "trigger": "manual", "operator_id": "local"},
+            "initiator": {"actor_type": "human", "trigger": "manual", "operator_id": ""},
         })
         return payload, ""
     if decision == "reject" and source in _HUMAN_REJECT:

agentmetry-0.9.1/agentmetry/core/audit/policy_settings.py

@@ -0,0 +1,162 @@
+"""The five settings DLP and tool policy read, without importing pydantic (#171).
+
+The hook runs in front of every tool call, and on a blocking hook the agent waits
+for it. The DLP scanner and the tool-policy evaluator used to import
+`core.config` to learn a mode and a manifest path each, and that one import
+pulled in pydantic and pydantic-settings: about 220 ms of a 626 ms hook, paid on
+every tool call to read five values.
+
+So there are two ways to get them, and one answer:
+
+* Where `core.config` is already loaded, the orchestrator and the test suite,
+  the real `settings` object is read. A test that monkeypatches
+  `settings.dlp_mode` still changes what the scanner sees.
+* Where it is not, the hook, they are resolved here the way `Settings` resolves
+  them: environment first, matched case-insensitively, then the orchestrator's
+  `.env`, then the same defaults. `test_hook_import_cost.py` checks the two
+  agree.
+
+Standard library only. That is the whole point of the module.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+
+_HERE = Path(__file__).resolve()
+_PACKAGE_ROOT = _HERE.parents[2]       # agentmetry/, as config._PACKAGE_ROOT
+_ORCHESTRATOR_ROOT = _HERE.parents[3]  # where Settings reads .env, as config._ORCHESTRATOR_ROOT
+
+#: pydantic's own boolean vocabulary, so `AGENTMETRY_DLP_PII=off` means the same
+#: thing to the hook as to the orchestrator.
+_TRUE = frozenset({"1", "on", "t", "true", "y", "yes"})
+_FALSE = frozenset({"0", "off", "f", "false", "n", "no"})
+
+_DOTENV_CACHE: tuple[tuple[str, float, int] | None, dict[str, str]] = (None, {})
+
+
+@dataclass(frozen=True)
+class PolicySettings:
+    dlp_mode: str
+    dlp_rules_path: Path
+    dlp_pii: bool
+    tool_policy_mode: str
+    tool_policy_path: Path
+
+
+def _defaults() -> PolicySettings:
+    policies = _PACKAGE_ROOT / "policies"
+    return PolicySettings(
+        dlp_mode="log",
+        dlp_rules_path=policies / "dlp" / "manifest.yaml",
+        dlp_pii=True,
+        tool_policy_mode="log",
+        tool_policy_path=policies / "tool" / "manifest.yaml",
+    )
+
+
+def _parse_dotenv(text: str) -> dict[str, str]:
+    """The subset of python-dotenv that a `.env` for this project uses.
+
+    `export` prefixes, single or double quotes, and a ` #` comment after an
+    unquoted value. Keys are lowercased, because Settings matches them
+    case-insensitively.
+    """
+    out: dict[str, str] = {}
+    for raw in text.splitlines():
+        line = raw.strip()
+        if not line or line.startswith("#") or "=" not in line:
+            continue
+        if line.startswith("export "):
+            line = line[len("export "):].lstrip()
+        key, _, value = line.partition("=")
+        value = value.strip()
+        if len(value) >= 2 and value[0] == value[-1] and value[0] in "\"'":
+            value = value[1:-1]
+        elif " #" in value:
+            value = value.split(" #", 1)[0].rstrip()
+        out[key.strip().lower()] = value
+    return out
+
+
+def _dotenv() -> dict[str, str]:
+    """The orchestrator's `.env`, parsed once per change to the file."""
+    global _DOTENV_CACHE
+    path = _ORCHESTRATOR_ROOT / ".env"
+    try:
+        stat = path.stat()
+    except OSError:
+        return {}
+    stamp = (str(path), stat.st_mtime, stat.st_size)
+    if _DOTENV_CACHE[0] == stamp:
+        return _DOTENV_CACHE[1]
+    try:
+        parsed = _parse_dotenv(path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeDecodeError):
+        return {}
+    _DOTENV_CACHE = (stamp, parsed)
+    return parsed
+
+
+def _lookup(name: str, environ: dict[str, str], dotenv: dict[str, str]) -> str | None:
+    # Present-but-empty counts as set, as it does for Settings (env_ignore_empty
+    # is off): an empty mode is not "use the default".
+    key = name.lower()
+    if key in environ:
+        return environ[key]
+    return dotenv.get(key)
+
+
+def _bool(raw: str | None, default: bool) -> bool:
+    if raw is None:
+        return default
+    text = raw.strip().lower()
+    if text in _TRUE:
+        return True
+    if text in _FALSE:
+        return False
+    # Settings refuses to start on this. The hook must not fail a tool call over
+    # a typo, so it keeps the default and the orchestrator's error stays the
+    # place the operator finds out.
+    return default
+
+
+def resolve() -> PolicySettings:
+    """Resolve without pydantic, as the hook does."""
+    environ = {k.lower(): v for k, v in os.environ.items()}
+    dotenv = _dotenv()
+    base = _defaults()
+
+    def text(name: str, default: str) -> str:
+        value = _lookup(name, environ, dotenv)
+        return default if value is None else value
+
+    def path(name: str, default: Path) -> Path:
+        value = _lookup(name, environ, dotenv)
+        return default if value is None else Path(value)
+
+    return PolicySettings(
+        dlp_mode=text("AGENTMETRY_DLP_MODE", base.dlp_mode),
+        dlp_rules_path=path("AGENTMETRY_DLP_RULES_PATH", base.dlp_rules_path),
+        dlp_pii=_bool(_lookup("AGENTMETRY_DLP_PII", environ, dotenv), base.dlp_pii),
+        tool_policy_mode=text("AGENTMETRY_TOOL_POLICY_MODE", base.tool_policy_mode),
+        tool_policy_path=path("AGENTMETRY_TOOL_POLICY_PATH", base.tool_policy_path),
+    )
+
+
+def policy_settings() -> PolicySettings:
+    """The settings, from the loaded `Settings` object when there is one."""
+    config = sys.modules.get("agentmetry.core.config")
+    settings = getattr(config, "settings", None) if config is not None else None
+    if settings is None:
+        return resolve()
+    return PolicySettings(
+        dlp_mode=settings.dlp_mode,
+        dlp_rules_path=Path(settings.dlp_rules_path),
+        dlp_pii=bool(settings.dlp_pii),
+        tool_policy_mode=settings.tool_policy_mode,
+        tool_policy_path=Path(settings.tool_policy_path),
+    )

agentmetry-0.9.1/agentmetry/core/audit/run_context.py

@@ -0,0 +1,197 @@
+"""Per-run audit context — initiator provenance and last gated tool (schema v1.1)."""
+
+from __future__ import annotations
+
+from functools import lru_cache
+from typing import Any
+
+from agentmetry.core import operator_identity as oid
+from agentmetry.core.config import settings
+
+# thread_id → initiator block (set at run start, server-derived only)
+_thread_initiators: dict[str, dict[str, str]] = {}
+# thread_id → last successful tool call on this run (for approval binding)
+_thread_last_tool: dict[str, dict[str, str]] = {}
+
+
+@lru_cache(maxsize=1)
+def _orchestrator_os() -> str:
+    # The account the recorder runs as does not change under a running process.
+    return oid.os_operator()
+
+
+def resolve_operator(client_id: object = "", client_source: object = "") -> tuple[str, str]:
+    """The operator id to record, and where it came from (`initiator.operator_source`).
+
+    Every event used to say `local`, so the trail could prove a record was not
+    altered and could not say who it was about (#168). In order:
+
+    1. An id the developer configured on their side, which the hook reports as
+       `configured` (`hook_configured`). The most specific statement anybody
+       made.
+    2. AGENTMETRY_OPERATOR_ID on this orchestrator (`orchestrator_configured`):
+       an admin override, for a service account or a shared machine. It used to
+       apply to no hook event at all, because every hook sent `local` and a
+       client value always won.
+    3. The account the hook ran as (`hook_os`). The hook runs inside the
+       developer's agent, so this is the developer.
+    4. An id a client sent without saying how (`client`).
+    5. The account this orchestrator runs as (`orchestrator_os`). On one
+       developer's machine that is the developer; under a fleet service it is
+       the service account, and the label says so rather than letting it pass
+       for a person.
+    6. `local`, labelled `default`, when nothing resolves.
+
+    Everything a client sends is a claim, and the `hook_` and `client` labels
+    say so. The legacy `local` a hook up to 0.9.0 sends counts as not stated.
+    """
+    claimed = oid.stated(client_id)
+    source = str(client_source or "")
+    if claimed and source == oid.CONFIGURED:
+        return claimed, oid.HOOK_CONFIGURED
+    configured = settings.operator_id.strip()
+    if configured:
+        return configured, oid.ORCHESTRATOR_CONFIGURED
+    if claimed:
+        return claimed, oid.HOOK_OS if source == oid.OS else oid.CLIENT
+    local = _orchestrator_os()
+    if local:
+        return local, oid.ORCHESTRATOR_OS
+    return oid.LEGACY_PLACEHOLDER, oid.DEFAULT
+
+
+def operator_from_payload(payload: dict[str, Any]) -> tuple[str, str]:
+    """Resolve from an ingest body: its `operator` block, else `initiator.operator_id`.
+
+    An initiator this orchestrator built already carries a recorded source, and
+    re-resolving it would relabel the recorder's own answer as a client claim.
+    Only internal payloads can carry one: `IngestInitiatorBody` does not declare
+    `operator_source`, so pydantic drops it from anything sent over HTTP.
+    """
+    op = payload.get("operator")
+    if isinstance(op, dict) and oid.stated(op.get("id")):
+        return resolve_operator(op.get("id"), op.get("source"))
+    init = payload.get("initiator")
+    if isinstance(init, dict):
+        recorded = str(init.get("operator_source") or "")
+        if recorded in oid.RECORDED_SOURCES and oid.stated(init.get("operator_id")):
+            return str(init["operator_id"]), recorded
+        return resolve_operator(init.get("operator_id"), init.get("operator_source"))
+    return resolve_operator()
+
+
+def _operator_id() -> str:
+    return resolve_operator()[0]
+
+
+def build_initiator(
+    triggered_by: str, operator: tuple[str, str] | None = None
+) -> dict[str, str]:
+    """Derive initiator from run origin. Must never trust client-supplied headers."""
+    operator_id, operator_source = operator or resolve_operator()
+    if triggered_by == "manual":
+        actor_type, trigger = "human", "manual"
+    elif triggered_by.startswith("channel:"):
+        actor_type, trigger = "human", "channel"
+    else:
+        # cron, vault_watch, ingress, recovery, and anything unrecognised.
+        actor_type, trigger = "autonomous", triggered_by
+    return {
+        "actor_type": actor_type,
+        "trigger": trigger,
+        "operator_id": operator_id,
+        "operator_source": operator_source,
+    }
+
+
+def actor_from_initiator(initiator: dict[str, str]) -> dict[str, str]:
+    human = initiator.get("actor_type") == "human"
+    return {
+        "type": "user" if human else "agent",
+        "id": initiator.get("operator_id") or _operator_id(),
+        "role": "operator",
+    }
+
+
+def default_initiator() -> dict[str, str]:
+    return build_initiator("manual")
+
+
+def set_thread_initiator(thread_id: str, triggered_by: str) -> dict[str, str]:
+    initiator = build_initiator(triggered_by)
+    _thread_initiators[thread_id] = initiator
+    return initiator
+
+
+def get_thread_initiator(thread_id: str) -> dict[str, str] | None:
+    return _thread_initiators.get(thread_id)
+
+
+def resolve_initiator(
+    payload: dict[str, Any], thread_id: str = ""
+) -> dict[str, str]:
+    """Read initiator from payload or thread cache; fallback manual human."""
+    raw = payload.get("initiator")
+    if isinstance(raw, dict) and raw.get("actor_type"):
+        operator_id, operator_source = operator_from_payload(payload)
+        return {
+            "actor_type": str(raw.get("actor_type") or "human"),
+            "trigger": str(raw.get("trigger") or "manual"),
+            "operator_id": operator_id,
+            "operator_source": operator_source,
+        }
+    triggered_by = str(payload.get("triggered_by") or "")
+    if triggered_by:
+        return build_initiator(triggered_by, operator_from_payload(payload))
+    if thread_id:
+        cached = _thread_initiators.get(thread_id)
+        if cached:
+            return cached
+    return default_initiator()
+
+
+def record_tool_call(thread_id: str, qualified: str, arguments_sha256: str) -> None:
+    if not thread_id:
+        return
+    server = qualified.split(".", 1)[0] if "." in qualified else ""
+    _thread_last_tool[thread_id] = {
+        "tool": qualified,
+        "server": server,
+        "input_hash": arguments_sha256,
+    }
+
+
+def last_gated_action(thread_id: str) -> dict[str, str] | None:
+    if not thread_id:
+        return None
+    action = _thread_last_tool.get(thread_id)
+    if not action or not action.get("tool"):
+        return None
+    return dict(action)
+
+
+def clear_run_context(thread_id: str) -> None:
+    _thread_initiators.pop(thread_id, None)
+    _thread_last_tool.pop(thread_id, None)
+
+
+def audit_payload(
+    thread_id: str,
+    triggered_by: str | None = None,
+    *,
+    initiator: dict[str, str] | None = None,
+) -> dict[str, Any]:
+    """Extra bus payload fields for canonical v1.1."""
+    init = initiator or (
+        get_thread_initiator(thread_id)
+        if thread_id
+        else None
+    )
+    if init is None and triggered_by:
+        init = build_initiator(triggered_by)
+    if init is None:
+        init = default_initiator()
+    out: dict[str, Any] = {"initiator": init}
+    if triggered_by:
+        out["triggered_by"] = triggered_by
+    return out

{agentmetry-0.9.0 → agentmetry-0.9.1}/agentmetry/core/audit/tool_policy/evaluator.py

@@ -6,7 +6,8 @@ from typing import Any
 
 from .loader import load_tool_policy
 from .models import ToolPolicyMatch, ToolPolicyRule, ToolPolicyVerdict
-from ...config import settings
+# Not core.config, for the same reason as the DLP scanner (#171).
+from ..policy_settings import policy_settings
 
 logger = logging.getLogger(__name__)
 
@@ -22,7 +23,7 @@ def reset_policy() -> None:
 def _init_policy() -> tuple[list[ToolPolicyRule], str]:
     global _POLICY
     if _POLICY is None:
-        _POLICY = load_tool_policy(settings.tool_policy_path)
+        _POLICY = load_tool_policy(policy_settings().tool_policy_path)
     return _POLICY
 
 
@@ -143,7 +144,7 @@ def evaluate(
 ) -> ToolPolicyVerdict:
     """Evaluate tool allow/deny policy. Runs on plaintext hook data before hashing."""
     if mode is None:
-        mode = settings.tool_policy_mode
+        mode = policy_settings().tool_policy_mode
     if mode == "disable":
         return ToolPolicyVerdict(matched=False, blocked=False, mode=mode)
 

{agentmetry-0.9.0 → agentmetry-0.9.1}/agentmetry/core/audit/tool_policy/loader.py

@@ -7,6 +7,12 @@ from .models import ToolPolicyRule
 
 logger = logging.getLogger(__name__)
 
+#: libyaml where it is installed. The pure-Python parser was most of the hook's
+#: runtime: the DLP and tool manifests are re-read by every hook process, and
+#: parsing them took ~55 ms of an ~85 ms tool call (#171). Same SafeConstructor,
+#: so the same Python objects, which `test_hook_import_cost.py` checks.
+SAFE_LOADER = getattr(yaml, "CSafeLoader", yaml.SafeLoader)
+
 ACTIONS = ("allow", "deny", "ask")
 
 #: `ask` is not a valid default yet. "Ask about everything not allowlisted" is
@@ -47,7 +53,7 @@ def load_tool_policy(manifest_path: Path | str) -> tuple[list[ToolPolicyRule], s
         return [], "allow"
 
     with open(path, encoding="utf-8") as fh:
-        data = yaml.safe_load(fh)
+        data = yaml.load(fh, Loader=SAFE_LOADER)  # noqa: S506 - a safe loader
 
     if not data or "rules" not in data:
         return [], _normalise_default(data.get("default") if data else None)