agentmetry 0.9.2__tar.gz → 0.9.3__tar.gz

{agentmetry-0.9.2 → agentmetry-0.9.3}/.env.example

@@ -10,6 +10,22 @@ AGENTMETRY_VAULT_PATH=../../vault
 # override: an email, or a pseudonym to keep account names out of a SIEM.
 AGENTMETRY_OPERATOR_ID=
 AGENTMETRY_FLEET_ID=
+
+# Per-fleet secret for tool-argument fingerprints. Unset: plain SHA-256, which
+# anyone with the trail or SIEM can recompute for a guessable argument. Set:
+# HMAC-SHA256 under this key, labelled input_redaction "hmac". Use the same
+# value on every host in a fleet so fingerprints still correlate.
+AGENTMETRY_HASH_KEY=
+
+# Host names the API answers to besides localhost / 127.0.0.1 / ::1. Anything
+# else gets 400 (DNS-rebinding guard). Set this when the API is reached by
+# another name: a container service name, a LAN address, a reverse proxy.
+# AGENTMETRY_TRUSTED_HOSTS=orchestrator,devbox.corp.example
+
+# The API needs a token by default: the first start writes one, owner-only,
+# to the data directory, and the hooks and CLI read it from there. Set this
+# only to distribute your own key across a fleet; it then replaces the file.
+# AGENTMETRY_AUTH_DISABLED=1 turns authentication off (development only).
 AGENTMETRY_API_KEY=
 
 # Hook boundary — log | block | disable
@@ -19,6 +35,12 @@ AGENTMETRY_DLP_MODE=log
 # Audit export (JSONL + SQLite index)
 AGENTMETRY_AUDIT_EXPORT_ENABLED=1
 AGENTMETRY_AUDIT_SINK=file
+# Network sinks forward from the trail with a cursor, batching and retrying
+# while the SIEM is down. 0 = the old inline one-request-per-event sinks.
+# AGENTMETRY_AUDIT_FORWARDER=1
+# Rotate the trail into <trail>.archive/ at this size; the chain continues
+# across segments and nothing is deleted (docs/trail-retention.md). 0 = never.
+# AGENTMETRY_TRAIL_ROTATE_BYTES=268435456
 
 # Anchor log, when it is not the file sitting beside the trail. Point this at a
 # working copy of a remote this machine cannot rewrite and `verify --trail` and

agentmetry-0.9.3/Dockerfile

@@ -0,0 +1,42 @@
+# Agentmetry recorder in one image: the orchestrator API, serving the dashboard's
+# static export. Build from the repository root:
+#
+#   docker build -f apps/orchestrator/Dockerfile -t agentmetry .
+#
+# It used to start `uvicorn api.main:app`, a module path that has not existed
+# since the package became `agentmetry`, so the image could not boot. It also
+# installed gcc and libpq for a Postgres the recorder no longer uses.
+
+FROM node:20-alpine AS dashboard
+WORKDIR /dashboard
+COPY apps/dashboard/package.json apps/dashboard/package-lock.json ./
+RUN npm ci
+COPY apps/dashboard/ ./
+# Same-origin build: the dashboard talks to the API that serves it. No API key
+# is baked into the bundle.
+ENV NEXT_PUBLIC_SAME_ORIGIN=true
+RUN npm run build
+
+FROM python:3.12-slim
+WORKDIR /app
+
+COPY apps/orchestrator/ ./
+RUN pip install --no-cache-dir . \
+    && useradd --system --uid 10001 --home-dir /data agentmetry \
+    && mkdir -p /data && chown agentmetry /data
+
+# agentmetry/api/main.py serves <three levels up>/dashboard/out.
+COPY --from=dashboard /dashboard/out /dashboard/out
+
+ENV AGENTMETRY_AUDIT_EXPORT_PATH=/data/audit-forward.jsonl \
+    AGENTMETRY_AUDIT_DB_PATH=/data/audit.db \
+    AGENTMETRY_DETECTION_LIVE_DB_PATH=/data/detection_live.db \
+    AGENTMETRY_DETECTION_DISPOSITION_DB_PATH=/data/detection_dispositions.db
+
+USER agentmetry
+VOLUME ["/data"]
+EXPOSE 8000
+
+# 0.0.0.0 inside the container is required for port publishing to work; the
+# compose file publishes it on the host's loopback only.
+CMD ["uvicorn", "agentmetry.api.main:app", "--host", "0.0.0.0", "--port", "8000"]

{agentmetry-0.9.2 → agentmetry-0.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentmetry
-Version: 0.9.2
+Version: 0.9.3
 Summary: Local-first flight recorder for AI coding agents: hash-chained audit trail, MITRE-mapped sequence detection, DLP
 Project-URL: Homepage, https://agentmetry.ai
 Project-URL: Source, https://github.com/blitzcrieg1/agentmetry

{agentmetry-0.9.2 → agentmetry-0.9.3}/agentmetry/api/main.py

@@ -9,6 +9,9 @@ from pathlib import Path
 from fastapi import FastAPI, Query, WebSocket, WebSocketDisconnect
 from fastapi.middleware.cors import CORSMiddleware
 
+from agentmetry.api.routes.auth import router as auth_router
+from agentmetry.api.trusted_host import TrustedHostMiddleware
+
 from agentmetry.api.routes.audit import router as audit_router
 from agentmetry.api.websocket import ws_manager
 from agentmetry.api.ws_bridge import ws_event_bridge
@@ -18,13 +21,14 @@ from agentmetry.core.bus.bridges import outbox_persister
 from agentmetry.core.bus.bus import bus
 from agentmetry.core.bus.outbox import get_outbox
 from agentmetry.core.config import settings
+from agentmetry.core.paths import data_dir
 from agentmetry.core.extensions import load_extensions
 from agentmetry.core.health import get_system_health
 from agentmetry.core.version import __version__
 
 logger = logging.getLogger(__name__)
 
-_LOG_DIR = Path(__file__).resolve().parents[2] / "data" / "logs"
+_LOG_DIR = data_dir() / "logs"
 
 
 def _setup_logging() -> None:
@@ -57,6 +61,21 @@ _setup_logging()
 
 
 
+def _start_forwarders() -> list[asyncio.Task]:
+    """One task per network sink, tailing the trail (pilot hardening item 19)."""
+    if not (settings.audit_export_enabled and settings.audit_forwarder):
+        return []
+    from agentmetry.core.audit.forwarder import Forwarder
+    from agentmetry.core.audit.sinks import forward_destinations
+
+    tasks = []
+    for destination in forward_destinations(settings):
+        forwarder = Forwarder(destination, settings.audit_export_path)
+        tasks.append(asyncio.create_task(forwarder.run(), name=f"forward-{destination.name}"))
+        logger.info("Forwarding the trail to %s from its cursor", destination.name)
+    return tasks
+
+
 @asynccontextmanager
 async def lifespan(app: FastAPI):
     from agentmetry.core.audit.migrate import backfill_db_from_jsonl
@@ -114,22 +133,48 @@ async def lifespan(app: FastAPI):
         # if presence was being asserted.
         asyncio.create_task(heartbeat_forever(), name="heartbeat"),
     ]
+    bridge_tasks += _start_forwarders()
 
-    # Drivers mount in the background: a slow npx download must not delay boot.
-    from agentmetry.core.drivers.host import get_mcp_host
+    # The removed agent runtime's MCP driver host. Off unless
+    # AGENTMETRY_LEGACY_DRIVERS=1 (#209): it spawned tools/vault_fs_server.py on
+    # every boot of a recorder that has no use for it.
+    mount_task = None
+    if settings.legacy_drivers:
+        from agentmetry.core.drivers.host import get_mcp_host
 
-    mount_task = asyncio.create_task(get_mcp_host().mount_all(), name="driver-mounts")
+        # Mount in the background: a slow npx download must not delay boot.
+        mount_task = asyncio.create_task(get_mcp_host().mount_all(), name="driver-mounts")
 
-    from agentmetry.core.audit.hook_bootstrap import bootstrap_tier_b_hooks
+    # Create the per-install API token now, before the first hook asks for it.
+    from agentmetry.core.auth import effective_key
 
     try:
-        hook_paths = bootstrap_tier_b_hooks()
-        if hook_paths.get("cursor"):
-            logger.info("Global Cursor hooks ready: %s", hook_paths["cursor"])
-        if hook_paths.get("claude"):
-            logger.info("Global Claude hooks ready: %s", hook_paths["claude"])
-    except Exception as exc:
-        logger.warning("Tier B hook bootstrap failed: %s", exc)
+        if effective_key():
+            logger.info("API authentication on; local clients read the token from the data directory")
+        else:
+            logger.warning("API authentication is OFF (AGENTMETRY_AUTH_DISABLED); development only")
+    except OSError as exc:
+        logger.error("Could not create the API token (%s); every request will be refused", exc)
+
+    # Opt-in (AGENTMETRY_AUTO_INSTALL_HOOKS=1). Unconditional, this rewrote the
+    # developer's global IDE hook configs to point at whichever checkout booted,
+    # which is how a test clone or demo instance took over live hooks.
+    if settings.auto_install_hooks:
+        from agentmetry.core.audit.hook_bootstrap import bootstrap_tier_b_hooks
+
+        try:
+            hook_paths = bootstrap_tier_b_hooks()
+            if hook_paths.get("cursor"):
+                logger.info("Global Cursor hooks ready: %s", hook_paths["cursor"])
+            if hook_paths.get("claude"):
+                logger.info("Global Claude hooks ready: %s", hook_paths["claude"])
+        except Exception as exc:
+            logger.warning("Tier B hook bootstrap failed: %s", exc)
+    else:
+        logger.info(
+            "IDE hooks are not rewritten at boot. Install or repair them with "
+            "`agentmetry hooks install`, or set AGENTMETRY_AUTO_INSTALL_HOOKS=1."
+        )
 
     # Launch transcript watcher for Antigravity in the background
     import subprocess
@@ -148,8 +193,11 @@ async def lifespan(app: FastAPI):
         logger.warning("Failed to start Antigravity transcript watcher: %s", exc)
 
     yield
-    mount_task.cancel()
-    await get_mcp_host().unmount_all()
+    if mount_task is not None:
+        from agentmetry.core.drivers.host import get_mcp_host
+
+        mount_task.cancel()
+        await get_mcp_host().unmount_all()
     for task in bridge_tasks:
         task.cancel()
     if watcher_process:
@@ -177,8 +225,12 @@ app.add_middleware(
     allow_methods=["*"],
     allow_headers=["*"],
 )
+# Outermost, so a request with a foreign Host header is refused before CORS or
+# any route sees it (DNS rebinding; pilot hardening item 9).
+app.add_middleware(TrustedHostMiddleware)
 
 app.include_router(audit_router, prefix="/api/v1")
+app.include_router(auth_router, prefix="/api/v1")
 
 load_extensions(app, settings=settings)
 

{agentmetry-0.9.2 → agentmetry-0.9.3}/agentmetry/api/routes/audit.py

@@ -6,7 +6,7 @@ from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import Any, Literal
 
-from fastapi import APIRouter, Depends, HTTPException, Query
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
 from fastapi.responses import FileResponse
 from pydantic import BaseModel, Field, field_validator
 
@@ -350,8 +350,32 @@ class DispositionBody(BaseModel):
     severity: str = ""
 
 
+def _forward_status() -> dict:
+    from agentmetry.core.audit.forwarder import forward_status
+
+    return forward_status()
+
+
+def _decider(request: Request, claimed: str) -> str:
+    """Who made this decision, as far as the server can tell.
+
+    A dashboard session and an extension principal are server-side facts, so
+    they win over anything the body claims. A token-authenticated caller (the
+    CLI, on this machine) states who it is; with nothing stated, the resolved
+    operator is recorded rather than an empty string.
+    """
+    kind, who = getattr(request.state, "auth", ("", ""))
+    if kind in ("session", "extension") and who:
+        return who
+    if claimed.strip():
+        return claimed.strip()
+    from agentmetry.core.audit.run_context import resolve_operator
+
+    return resolve_operator()[0]
+
+
 @router.post("/detections/disposition", dependencies=[Depends(require_api_key)])
-async def audit_set_disposition(body: DispositionBody):
+async def audit_set_disposition(body: DispositionBody, request: Request):
     """Record what a human decided about a detection.
 
     The decision is appended to the trail as a `detection_disposition` event
@@ -369,7 +393,7 @@ async def audit_set_disposition(body: DispositionBody):
             status=body.status,
             assignee=body.assignee,
             note=body.note,
-            decided_by=body.decided_by,
+            decided_by=_decider(request, body.decided_by),
             severity=body.severity,
         )
     except DispositionError as exc:
@@ -453,6 +477,8 @@ async def audit_status():
         "by_source": status_data["by_source"],
         "path": str(path),
         "spool_pending": spool_depth(),
+        # Per SIEM: the last seq it accepted, and how long it has been failing.
+        "forwarding": _forward_status(),
         "spool_oldest_age_seconds": spool_oldest_age_seconds(),
     }
 

agentmetry-0.9.3/agentmetry/api/routes/auth.py

@@ -0,0 +1,84 @@
+"""Dashboard sign-in (pilot hardening items 8 and 13).
+
+`agentmetry dashboard` calls POST /auth/dashboard-link with the API token and
+opens the URL it returns. That URL exchanges a one-time code for an HttpOnly,
+SameSite=Strict session cookie, so the browser is signed in without ever
+holding the key.
+"""
+
+from __future__ import annotations
+
+
+from fastapi import APIRouter, Depends, HTTPException, Request
+from fastapi.responses import RedirectResponse
+from pydantic import BaseModel
+
+from agentmetry.core.auth import require_api_key
+from agentmetry.core.dashboard_session import (
+    CODE_SECONDS,
+    SESSION_COOKIE,
+    SESSION_SECONDS,
+    sessions,
+)
+
+router = APIRouter(prefix="/auth", tags=["auth"])
+
+
+
+class DashboardLinkBody(BaseModel):
+    operator: str = ""
+
+
+#: Where a sign-in may land. A lookup, not validation: the Location header is
+#: always one of these constants, never anything taken from the request. The
+#: dashboard is one page, so `/` is the only real destination; `dev` is the
+#: Next dev server on its default port, for working on the dashboard itself.
+#: (The previous "starts with one slash" check let `/\evil.example` through,
+#: which browsers read as `//evil.example`.)
+_LANDINGS = {
+    "": "/",
+    "/": "/",
+    "dev": "http://localhost:3000/",
+}
+
+
+def _safe_next(target: str) -> str:
+    """Where to land after sign-in. Anything not in the table lands on `/`."""
+    return _LANDINGS.get(target or "", "/")
+
+
+@router.post("/dashboard-link")
+async def dashboard_link(body: DashboardLinkBody, request: Request, _: None = Depends(require_api_key)):
+    """A one-time sign-in link. Needs the token itself, not a session."""
+    kind, _who = getattr(request.state, "auth", ("", ""))
+    if kind == "session":
+        raise HTTPException(status_code=403, detail="a dashboard session cannot mint sign-in links")
+    if not body.operator.strip():
+        from agentmetry.core.audit.run_context import resolve_operator
+
+        operator = resolve_operator()[0]
+    else:
+        operator = body.operator.strip()
+    code = sessions.issue_code(operator)
+    return {"url": f"/api/v1/auth/dashboard?code={code}", "expires_in": CODE_SECONDS}
+
+
+@router.get("/dashboard")
+async def dashboard_sign_in(request: Request, code: str = "", next: str = ""):  # noqa: A002
+    session_id = sessions.redeem(code)
+    if session_id is None:
+        raise HTTPException(status_code=401, detail="sign-in link expired or already used; run `agentmetry dashboard`")
+    resp = RedirectResponse(_safe_next(next), status_code=303)
+    resp.set_cookie(
+        SESSION_COOKIE, session_id, max_age=SESSION_SECONDS, httponly=True,
+        samesite="strict", secure=request.url.scheme == "https", path="/",
+    )
+    return resp
+
+
+@router.post("/logout")
+async def dashboard_logout(request: Request):
+    sessions.revoke(request.cookies.get(SESSION_COOKIE))
+    resp = RedirectResponse("/", status_code=303)
+    resp.delete_cookie(SESSION_COOKIE, path="/")
+    return resp

agentmetry-0.9.3/agentmetry/api/trusted_host.py

@@ -0,0 +1,72 @@
+"""Refuse requests whose Host header is not this machine (pilot hardening item 9).
+
+The orchestrator listens on loopback, and that is not enough on its own. A web
+page the developer visits can make its own hostname resolve to 127.0.0.1 (DNS
+rebinding) and then read the local API as same-origin, trail included, because
+the browser believes it is talking to the attacker's site. The one thing that
+gives it away is the Host header, which still names the attacker's domain.
+
+So only loopback names and the names an operator configures are accepted:
+`localhost`, `127.0.0.1`, `::1`, plus `AGENTMETRY_TRUSTED_HOSTS`
+(comma-separated, `*` to disable the check). `mobile.bat` adds the LAN address
+it detects.
+
+Written as plain ASGI rather than Starlette's TrustedHostMiddleware because
+that one fixes its list at startup, and this reads settings on each request so
+a test or an edited `.env` takes effect.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+LOOPBACK = frozenset({"localhost", "127.0.0.1", "::1"})
+
+
+def allowed_hosts() -> frozenset[str]:
+    from agentmetry.core.config import settings
+
+    configured = {h.strip().lower() for h in str(getattr(settings, "trusted_hosts", "")).split(",") if h.strip()}
+    return LOOPBACK | frozenset(configured)
+
+
+def host_of(header: str) -> str:
+    """The hostname in a Host header, without the port, lowercased."""
+    value = header.strip().lower()
+    if value.startswith("["):  # [::1]:8000
+        end = value.find("]")
+        return value[1:end] if end > 0 else value
+    if value.count(":") == 1:
+        return value.split(":", 1)[0]
+    return value
+
+
+class TrustedHostMiddleware:
+    def __init__(self, app: Any) -> None:
+        self.app = app
+
+    async def __call__(self, scope: dict, receive: Any, send: Any) -> None:
+        if scope.get("type") not in ("http", "websocket"):
+            return await self.app(scope, receive, send)
+        allowed = allowed_hosts()
+        if "*" in allowed:
+            return await self.app(scope, receive, send)
+        header = ""
+        for name, value in scope.get("headers") or []:
+            if name == b"host":
+                header = value.decode("latin-1")
+                break
+        if host_of(header) in allowed:
+            return await self.app(scope, receive, send)
+        if scope["type"] == "websocket":
+            message = await receive()
+            if message.get("type") == "websocket.connect":
+                await send({"type": "websocket.close", "code": 1008})
+            return None
+        body = b"Invalid host header"
+        await send({
+            "type": "http.response.start", "status": 400,
+            "headers": [(b"content-type", b"text/plain"), (b"content-length", str(len(body)).encode())],
+        })
+        await send({"type": "http.response.body", "body": body})
+        return None