agentmetry 0.9.4__tar.gz → 0.9.5__tar.gz

{agentmetry-0.9.4 → agentmetry-0.9.5}/.gitignore

@@ -100,3 +100,11 @@ docs/*-audit-*.md
 # pytest-cov data file
 .coverage
 .coverage.*
+
+# Demo video renders and their working files (scripts/make_demo_video.py).
+# The site serves its own copy from ai-audit-watch/public/video/.
+docs/assets/*.mp4
+docs/assets/agentmetry-demo-poster.png
+docs/assets/agentmetry-linkedin-*-poster.png
+docs/assets/voice/
+docs/assets/demo-stills/

{agentmetry-0.9.4 → agentmetry-0.9.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentmetry
-Version: 0.9.4
+Version: 0.9.5
 Summary: Local-first flight recorder for AI coding agents: hash-chained audit trail, MITRE-mapped sequence detection, DLP
 Project-URL: Homepage, https://agentmetry.ai
 Project-URL: Source, https://github.com/blitzcrieg1/agentmetry
@@ -37,7 +37,7 @@ Provides-Extra: dev
 Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
 Requires-Dist: pytest-cov>=6.0; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
-Requires-Dist: ruff==0.16.9; extra == 'dev'
+Requires-Dist: ruff==0.16.10; extra == 'dev'
 Description-Content-Type: text/markdown
 
 # Agentmetry

{agentmetry-0.9.4 → agentmetry-0.9.5}/agentmetry/core/audit/atlas.py

@@ -170,7 +170,7 @@ def attach_atlas(tool: Any) -> None:
 # adversary technique a whole sequence is evidence of, which is a claim only a
 # rule can make and never a single call.
 #
-# Deliberately small. Of the fifteen built-in rules, one describes an ATLAS
+# Deliberately small. Of the fourteen published rules, one describes an ATLAS
 # technique; the rest are host and operations behaviour that ATT&CK already
 # covers, and tagging them would put an AI-threat label on a shell command.
 # The empty entries are the design, not a backlog.

{agentmetry-0.9.4 → agentmetry-0.9.5}/agentmetry/core/audit/canonical.py

@@ -1,4 +1,4 @@
-"""Map durable outbox rows to Agentmetry canonical events (schema v1.1.0)."""
+"""Map durable outbox rows to Agentmetry canonical events (schema v1.2.0)."""
 
 from __future__ import annotations
 

{agentmetry-0.9.4 → agentmetry-0.9.5}/agentmetry/core/version.py

@@ -10,4 +10,4 @@ Bump this here and add the matching CHANGELOG section in the same commit.
 
 from __future__ import annotations
 
-__version__ = "0.9.4"
+__version__ = "0.9.5"

{agentmetry-0.9.4 → agentmetry-0.9.5}/agentmetry/hooks/ingest.py

@@ -1489,7 +1489,7 @@ def map_hook(hook_name: str, data: dict[str, Any]) -> dict[str, Any] | None:
 
 
 def _emit_hook_stdout(hook_name: str) -> None:
-    """Antigravity requires JSON on stdout; Cursor/Codex use permission when enforcing."""
+    """Antigravity requires JSON on stdout; the rest print a decision only when enforcing."""
     source = _source_app()
     enforce = os.environ.get("AGENTMETRY_ENFORCE", "").strip().lower()
 
@@ -1546,6 +1546,49 @@ def _is_blocking_hook(hook_name: str, data: dict[str, Any]) -> bool:
 #: the vendor's published schema; the rest inherit it.
 _CLAUDE_PROTOCOL = frozenset({"claude", "qwen", "qoder", "codebuddy", "kimi"})
 
+#: Codex's deny reason must be non-empty, or Codex rejects the whole output.
+_CODEX_DEFAULT_REASON = "Blocked by Agentmetry policy"
+
+
+def _codex_decision_output(hook_name: str, decision: str, reason: str) -> dict[str, Any]:
+    """Codex's hook schema, which is Claude-shaped and strict where Claude is not.
+
+    Checked against Codex's parser (openai/codex `codex-rs/hooks`, 806d2d1,
+    2026-10-08), not only its docs, because every way this goes wrong fails
+    open. Codex parses hook stdout with `deny_unknown_fields`. Output it cannot
+    parse, or parses and rejects, marks the hook run `Failed` and the tool runs.
+    Until this fix Codex was sent Cursor's `{"permission": "deny"}`, which is an
+    unknown field, so every Agentmetry deny on Codex ran the tool while the
+    trail recorded `outcome: denied`.
+
+    The other rejections, each also a silent allow:
+
+      * `permissionDecision: "deny"` without a non-empty reason.
+      * `permissionDecision: "ask"`, "parsed but not supported yet".
+      * `permissionDecision: "allow"` without `updatedInput`.
+
+    So on PreToolUse a deny always carries a reason, an ask becomes a deny, and
+    an allow is an empty object, which Codex reads as no objection. On
+    PermissionRequest the behaviour is allow|deny, and an ask becomes a deny.
+    """
+    reason = reason.strip() or _CODEX_DEFAULT_REASON
+    if decision != "allow":
+        decision = "deny"
+    if hook_name == "PermissionRequest":
+        verdict: dict[str, Any] = {"behavior": decision}
+        if decision == "deny":
+            verdict["message"] = reason
+        return {"hookSpecificOutput": {"hookEventName": hook_name, "decision": verdict}}
+    if decision == "allow":
+        return {}
+    return {
+        "hookSpecificOutput": {
+            "hookEventName": hook_name,
+            "permissionDecision": "deny",
+            "permissionDecisionReason": reason,
+        }
+    }
+
 
 def _decision_output(hook_name: str, decision: str, reason: str = "") -> dict[str, Any]:
     """A hook decision in the exact shape the calling agent honours.
@@ -1568,10 +1611,13 @@ def _decision_output(hook_name: str, decision: str, reason: str = "") -> dict[st
         The safe direction, never the other way.
       * Cursor: top-level `permission`. Unchanged, because it already worked.
       * Antigravity: top-level `decision`.
+      * Codex: Claude-shaped, but strict. See `_codex_decision_output`.
     """
     source = _source_app()
     if source == "antigravity":
         return {"decision": decision}
+    if source == "codex":
+        return _codex_decision_output(hook_name, decision, reason)
     if source in _CLAUDE_PROTOCOL:
         if hook_name == "PermissionRequest":
             behaviour = "allow" if decision == "allow" else "deny"

{agentmetry-0.9.4 → agentmetry-0.9.5}/pyproject.toml

@@ -52,7 +52,7 @@ dependencies = [
 # so a linter release could turn a green branch red with no change to this repo.
 # It did: 0.16.0 widened the default rule set and CI reported 132 errors against
 # code that passed locally on 0.15.x. Bump this deliberately, not by accident.
-dev = ["pytest>=8.0", "pytest-asyncio>=0.24", "pytest-cov>=6.0", "ruff==0.16.9"]
+dev = ["pytest>=8.0", "pytest-asyncio>=0.24", "pytest-cov>=6.0", "ruff==0.16.10"]
 
 [project.urls]
 Homepage = "https://agentmetry.ai"

agentmetry-0.9.5/tests/fixtures/codex_hooks/README.md

@@ -0,0 +1,10 @@
+# Codex hook output schemas
+
+Copied unchanged from [openai/codex](https://github.com/openai/codex) (Apache-2.0),
+`codex-rs/hooks/schema/generated/`, at commit
+`806d2d1cc194548170a606946aa6c68e99927e58` (2026-10-08).
+
+`tests/test_hook_decision_format.py` validates every decision the hook prints
+for Codex against these, because Codex parses hook output with
+`deny_unknown_fields` and runs the tool when it cannot. When Codex changes its
+schema, refresh both files from the same path and rerun that test.

agentmetry-0.9.5/tests/fixtures/codex_hooks/permission-request.command.output.schema.json

@@ -0,0 +1,91 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": false,
+  "definitions": {
+    "PermissionRequestBehaviorWire": {
+      "enum": [
+        "allow",
+        "deny"
+      ],
+      "type": "string"
+    },
+    "PermissionRequestDecisionWire": {
+      "additionalProperties": false,
+      "properties": {
+        "behavior": {
+          "$ref": "#/definitions/PermissionRequestBehaviorWire"
+        },
+        "interrupt": {
+          "default": false,
+          "description": "Reserved for future short-circuiting semantics.\n\nPermissionRequest hooks currently fail closed if this field is `true`.",
+          "type": "boolean"
+        },
+        "message": {
+          "default": null,
+          "type": "string"
+        },
+        "updatedInput": {
+          "default": null,
+          "description": "Reserved for a future input-rewrite capability.\n\nPermissionRequest hooks currently fail closed if this field is present."
+        },
+        "updatedPermissions": {
+          "default": null,
+          "description": "Reserved for a future permission-rewrite capability.\n\nPermissionRequest hooks currently fail closed if this field is present."
+        }
+      },
+      "required": [
+        "behavior"
+      ],
+      "type": "object"
+    },
+    "PermissionRequestHookSpecificOutputWire": {
+      "additionalProperties": false,
+      "properties": {
+        "decision": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/PermissionRequestDecisionWire"
+            }
+          ],
+          "default": null
+        },
+        "hookEventName": {
+          "const": "PermissionRequest",
+          "type": "string"
+        }
+      },
+      "required": [
+        "hookEventName"
+      ],
+      "type": "object"
+    }
+  },
+  "properties": {
+    "continue": {
+      "default": true,
+      "type": "boolean"
+    },
+    "hookSpecificOutput": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/PermissionRequestHookSpecificOutputWire"
+        }
+      ],
+      "default": null
+    },
+    "stopReason": {
+      "default": null,
+      "type": "string"
+    },
+    "suppressOutput": {
+      "default": false,
+      "type": "boolean"
+    },
+    "systemMessage": {
+      "default": null,
+      "type": "string"
+    }
+  },
+  "title": "permission-request.command.output",
+  "type": "object"
+}

agentmetry-0.9.5/tests/fixtures/codex_hooks/pre-tool-use.command.output.schema.json

@@ -0,0 +1,93 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": false,
+  "definitions": {
+    "PreToolUseDecisionWire": {
+      "enum": [
+        "approve",
+        "block"
+      ],
+      "type": "string"
+    },
+    "PreToolUseHookSpecificOutputWire": {
+      "additionalProperties": false,
+      "properties": {
+        "additionalContext": {
+          "default": null,
+          "type": "string"
+        },
+        "hookEventName": {
+          "const": "PreToolUse",
+          "type": "string"
+        },
+        "permissionDecision": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/PreToolUsePermissionDecisionWire"
+            }
+          ],
+          "default": null
+        },
+        "permissionDecisionReason": {
+          "default": null,
+          "type": "string"
+        },
+        "updatedInput": {
+          "default": null
+        }
+      },
+      "required": [
+        "hookEventName"
+      ],
+      "type": "object"
+    },
+    "PreToolUsePermissionDecisionWire": {
+      "enum": [
+        "allow",
+        "deny",
+        "ask"
+      ],
+      "type": "string"
+    }
+  },
+  "properties": {
+    "continue": {
+      "default": true,
+      "type": "boolean"
+    },
+    "decision": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/PreToolUseDecisionWire"
+        }
+      ],
+      "default": null
+    },
+    "hookSpecificOutput": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/PreToolUseHookSpecificOutputWire"
+        }
+      ],
+      "default": null
+    },
+    "reason": {
+      "default": null,
+      "type": "string"
+    },
+    "stopReason": {
+      "default": null,
+      "type": "string"
+    },
+    "suppressOutput": {
+      "default": false,
+      "type": "boolean"
+    },
+    "systemMessage": {
+      "default": null,
+      "type": "string"
+    }
+  },
+  "title": "pre-tool-use.command.output",
+  "type": "object"
+}

{agentmetry-0.9.4 → agentmetry-0.9.5}/tests/test_atlas_detection_enrichment.py

@@ -4,7 +4,7 @@ ATT&CK describes what one tool call did. ATLAS at the detection level describes
 the adversary technique the sequence is evidence of, which is a claim only a
 rule is in a position to make.
 
-The mapping is deliberately one rule wide. Of the fifteen built-in rules, one
+The mapping is deliberately one rule wide. Of the fourteen published rules, one
 describes an ATLAS technique; the rest are host and operations behaviour that
 ATT&CK already covers, and labelling those would put an AI-threat technique on
 a shell command. Most of this file exists to hold that line, because the

{agentmetry-0.9.4 → agentmetry-0.9.5}/tests/test_hook_decision_format.py

@@ -19,6 +19,10 @@ Schemas, from each vendor's hook documentation:
   Claude Code PermissionRequest hookSpecificOutput.decision.behavior  allow|deny, no ask
   Cursor                        top-level permission                   allow|deny|ask
   Antigravity                   top-level decision
+  Codex                         Claude-shaped, strict; see the Codex section
+
+Codex was the one agent the 0.9.0 fix missed. It kept receiving Cursor's key,
+and its parser rejects unknown fields, so every deny ran the tool.
 """
 
 from __future__ import annotations
@@ -131,6 +135,97 @@ def test_antigravity_output_is_unchanged(monkeypatch):
     assert _decision(monkeypatch, "antigravity", "PreToolUse", "deny") == {"decision": "deny"}
 
 
+# --- Codex: checked against its own schema and parser rules ------------------
+#
+# Codex parses hook stdout with `deny_unknown_fields` (openai/codex
+# codex-rs/hooks, 806d2d1). Anything it cannot parse, or parses and rejects,
+# marks the hook `Failed` and the tool runs. So a shape check is not enough:
+# these validate against Codex's published schema, then apply the parser's
+# rejections that the schema cannot express.
+
+_CODEX_SCHEMAS = Path(__file__).parent / "fixtures" / "codex_hooks"
+
+
+def _codex_blocks(hook: str, out: dict) -> bool:
+    """What Codex does with this output: True blocks, False runs the tool.
+
+    Raises if Codex would mark the hook `Failed`, which also runs the tool, but
+    is a malformed decision rather than a deliberate allow.
+    """
+    import jsonschema
+
+    name = {"PreToolUse": "pre-tool-use", "PermissionRequest": "permission-request"}[hook]
+    schema = json.loads((_CODEX_SCHEMAS / f"{name}.command.output.schema.json").read_text())
+    jsonschema.validate(out, schema)
+    specific = out.get("hookSpecificOutput") or {}
+    if hook == "PermissionRequest":
+        return (specific.get("decision") or {}).get("behavior") == "deny"
+    decision = specific.get("permissionDecision")
+    if decision == "ask":
+        raise AssertionError("Codex rejects permissionDecision:ask")
+    if decision == "allow" and "updatedInput" not in specific:
+        raise AssertionError("Codex rejects permissionDecision:allow without updatedInput")
+    if decision == "deny":
+        if not str(specific.get("permissionDecisionReason") or "").strip():
+            raise AssertionError("Codex rejects a deny without a non-empty reason")
+        return True
+    return False
+
+
+def test_codex_is_never_sent_the_cursor_key(monkeypatch):
+    """The defect: Codex rejected `permission` as an unknown field and ran the tool."""
+    import jsonschema
+
+    old = {"permission": "deny"}
+    schema = json.loads((_CODEX_SCHEMAS / "pre-tool-use.command.output.schema.json").read_text())
+    with pytest.raises(jsonschema.ValidationError):
+        jsonschema.validate(old, schema)
+    for hook in ("PreToolUse", "PermissionRequest"):
+        for decision in ("allow", "deny", "ask"):
+            assert "permission" not in _decision(monkeypatch, "codex", hook, decision), (hook, decision)
+
+
+@pytest.mark.parametrize("hook", ["PreToolUse", "PermissionRequest"])
+@pytest.mark.parametrize("reason", ["dlp:aws_key", ""])
+def test_codex_deny_blocks(monkeypatch, hook, reason):
+    """Including an empty reason, which Codex would otherwise reject as a fail-open."""
+    assert _codex_blocks(hook, _decision(monkeypatch, "codex", hook, "deny", reason))
+
+
+@pytest.mark.parametrize("hook", ["PreToolUse", "PermissionRequest"])
+def test_codex_ask_becomes_deny_never_allow(monkeypatch, hook):
+    """Codex marks an ask `Failed` and runs the tool, so an ask has to be a deny."""
+    assert _codex_blocks(hook, _decision(monkeypatch, "codex", hook, "ask", "tool_policy:x"))
+
+
+@pytest.mark.parametrize("hook", ["PreToolUse", "PermissionRequest"])
+def test_codex_allow_is_a_clean_allow(monkeypatch, hook):
+    assert not _codex_blocks(hook, _decision(monkeypatch, "codex", hook, "allow"))
+
+
+def test_codex_deny_keeps_the_rule_in_the_reason(monkeypatch):
+    out = _decision(monkeypatch, "codex", "PreToolUse", "deny", "tool_policy:block_shell_rm")
+    assert out["hookSpecificOutput"]["permissionDecisionReason"] == "tool_policy:block_shell_rm"
+    out = _decision(monkeypatch, "codex", "PermissionRequest", "deny", "dlp:aws_key")
+    assert out["hookSpecificOutput"]["decision"]["message"] == "dlp:aws_key"
+
+
+def test_a_real_policy_block_on_codex_blocks(monkeypatch, capsys):
+    """End to end through hook_main, with Codex's own Bash tool input."""
+    monkeypatch.setenv("AGENTMETRY_SOURCE_APP", "codex")
+    _block(monkeypatch, "block_shell_rm")
+    monkeypatch.setattr(
+        ingest,
+        "read_hook_stdin",
+        lambda: ({"session_id": "s1", "hook_event_name": "PreToolUse", "tool_name": "Bash",
+                  "tool_input": {"command": "rm -rf /"}}, False),
+    )
+    ingest.hook_main("PreToolUse")
+    out = _last_json(capsys)
+    assert _codex_blocks("PreToolUse", out)
+    assert out["hookSpecificOutput"]["permissionDecisionReason"] == "tool_policy:block_shell_rm"
+
+
 # --- through the real hook path ---------------------------------------------
 
 

{agentmetry-0.9.4 → agentmetry-0.9.5}/tests/test_readme_claims.py

@@ -241,3 +241,43 @@ def test_readme_sigma_count_matches_the_pack():
     assert int(match.group(1)) == shipped, (
         f"README claims {match.group(1)} Sigma rules, pack ships {shipped}"
     )
+
+
+def test_readme_collected_count_matches_pytest():
+    """The README quotes the suite size. Collection is the check.
+
+    A full `pytest -q` is too slow to pin the pass count here. The collected
+    total moves on the same commits, and it is what a reader can reproduce
+    without waiting on the suite.
+    """
+    import subprocess
+    import sys
+
+    match = re.search(r"(\d+) tests collected", _readme())
+    assert match, "README no longer states a collected test count"
+
+    root = Path(__file__).resolve().parents[1]
+    proc = subprocess.run(
+        [sys.executable, "-m", "pytest", "--collect-only", "-q", "-p", "no:cacheprovider"],
+        cwd=root,
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    combined = proc.stdout + "\n" + proc.stderr
+    assert proc.returncode == 0, combined
+    collected = re.search(r"(\d+) tests collected", combined)
+    assert collected, combined
+    assert int(match.group(1)) == int(collected.group(1)), (
+        f"README says {match.group(1)} tests collected; pytest collected {collected.group(1)}"
+    )
+
+
+def test_readme_coverage_floor_matches_ci():
+    """The durable coverage claim is the CI floor, not last Tuesday's percentage."""
+    match = re.search(r"CI fails the coverage job under (\d+)%", _readme())
+    assert match, "README no longer states the CI coverage floor"
+    ci = Path(__file__).resolve().parents[3] / ".github" / "workflows" / "ci.yml"
+    floor = re.search(r"cov-fail-under=(\d+)", ci.read_text(encoding="utf-8"))
+    assert floor, "ci.yml lost cov-fail-under"
+    assert match.group(1) == floor.group(1)

{agentmetry-0.9.4 → agentmetry-0.9.5}/tools/generate_sigma_pack.py

@@ -8,12 +8,12 @@ Run from the orchestrator:
 
 The Sigma pack that already existed covers the recorder's own health: heartbeat
 silence, degraded coverage, MCP schema drift, denial bursts. Useful, and none of
-it is the product. The fifteen sequence detections, which are what a SOC would
+it is the product. The published sequence detections, which are what a SOC would
 actually route on, had no Sigma representation at all, so a Splunk or Sentinel
 team wanting to alert on `credential-exfil` had to write the search themselves
 from a schema document.
 
-Hand-writing fifteen would put rule ids, severities and MITRE ids in a second
+Hand-writing them would put rule ids, severities and MITRE ids in a second
 place that drifts from the first. So the metadata is harvested by replaying the
 benchmark corpus through the real engine and reading the `Detection` objects it
 emits. A severity that changes in `rules.py` changes here on the next run, and
@@ -107,7 +107,7 @@ def _stable_uuid(rule_id: str, severity: str = "") -> str:
 
     Sigma requires a UUID and consumers key on it, so running this twice must
     produce no diff. Severity joins the seed only for a split rule, which keeps
-    the fourteen unsplit ids exactly where they are.
+    the unsplit ids exactly where they are.
     """
     seed = f"agentmetry.sigma.{rule_id}" + (f".{severity}" if severity else "")
     return str(uuid.UUID(bytes=hashlib.sha256(seed.encode()).digest()[:16], version=5))