agentmetry 0.9.4__tar.gz → 0.9.6__tar.gz

{agentmetry-0.9.4 → agentmetry-0.9.6}/.gitignore

@@ -100,3 +100,11 @@ docs/*-audit-*.md
 # pytest-cov data file
 .coverage
 .coverage.*
+
+# Demo video renders and their working files (scripts/make_demo_video.py).
+# The site serves its own copy from ai-audit-watch/public/video/.
+docs/assets/*.mp4
+docs/assets/agentmetry-demo-poster.png
+docs/assets/agentmetry-linkedin-*-poster.png
+docs/assets/voice/
+docs/assets/demo-stills/

{agentmetry-0.9.4 → agentmetry-0.9.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentmetry
-Version: 0.9.4
+Version: 0.9.6
 Summary: Local-first flight recorder for AI coding agents: hash-chained audit trail, MITRE-mapped sequence detection, DLP
 Project-URL: Homepage, https://agentmetry.ai
 Project-URL: Source, https://github.com/blitzcrieg1/agentmetry
@@ -37,7 +37,7 @@ Provides-Extra: dev
 Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
 Requires-Dist: pytest-cov>=6.0; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
-Requires-Dist: ruff==0.16.9; extra == 'dev'
+Requires-Dist: ruff==0.16.10; extra == 'dev'
 Description-Content-Type: text/markdown
 
 # Agentmetry

{agentmetry-0.9.4 → agentmetry-0.9.6}/agentmetry/cli/__init__.py

@@ -526,7 +526,7 @@ def cmd_install(args: argparse.Namespace) -> int:
 #: live in ~/.gemini and are written by scripts/install_antigravity_hooks.ps1,
 #: which has no Python equivalent. Listing it here and quietly doing nothing
 #: would be the reporting failure this codebase keeps finding in itself.
-_HOOK_INSTALLERS = ("cursor", "claude", "codex", "qwen", "kimi", "qoder", "codebuddy")
+_HOOK_INSTALLERS = ("cursor", "claude", "codex", "qwen", "kimi", "qoder", "codebuddy", "copilot")
 
 
 def _hooks_status() -> int:
@@ -972,6 +972,35 @@ def cmd_mcp(args: argparse.Namespace) -> int:
     return 0
 
 
+def cmd_posture(args: argparse.Namespace) -> int:
+    """Report agent settings that take a human or a hook out of the loop.
+
+    Exits 0 with findings by default, like `mcp`: a posture is a risk report, and
+    a health check somebody wired into MDM should not fail on one. `--strict`
+    turns any high finding into exit 1 for a pipeline that wants exactly that.
+    """
+    import json as _json
+    from pathlib import Path as _Path
+
+    from agentmetry.core.diagnostics.posture import HIGH, NOT_CHECKED, collect, summary_lines
+
+    posture = collect(_Path(args.project).resolve() if args.project else _Path.cwd())
+    if args.json:
+        print(_json.dumps({
+            "findings": [{**f.wire(), "why": f.why} for f in posture.sorted()],
+            "counts": posture.counts(),
+            "files_read": len(posture.files_read),
+            "files_unreadable": len(posture.unreadable),
+            "not_checked": sorted(NOT_CHECKED),
+        }, indent=2))
+    else:
+        for line in summary_lines(posture):
+            print(line)
+    if args.strict and posture.counts()[HIGH]:
+        return 1
+    return 0
+
+
 def cmd_otel(args: argparse.Namespace) -> int:
     """Receive Claude Code's native OpenTelemetry stream and record it.
 
@@ -1360,7 +1389,7 @@ def main(argv: list[str] | None = None) -> int:
     hooks.add_argument(
         "--managed",
         action="store_true",
-        help="use each vendor's admin-managed, machine-wide location (claude, cursor, codex); needs admin",
+        help="use each vendor's admin-managed, machine-wide location (claude, cursor, codex, copilot); needs admin",
     )
     hooks.add_argument(
         "--lock",
@@ -1485,6 +1514,14 @@ def main(argv: list[str] | None = None) -> int:
         "--digest", action="store_true",
         help="also print the config digest, which names no server and is safe to publish",
     )
+    posture = sub.add_parser(
+        "posture", help="report agent settings that skip approval prompts or turn hooks off"
+    )
+    posture.add_argument("--project", default=None, help="project root to include (default: cwd)")
+    posture.add_argument("--json", action="store_true", help="print findings as JSON")
+    posture.add_argument(
+        "--strict", action="store_true", help="exit 1 when any high-severity finding is present",
+    )
     otel = sub.add_parser(
         "otel", help="receive Claude Code's native OpenTelemetry stream (no hooks needed)"
     )
@@ -1586,6 +1623,7 @@ def main(argv: list[str] | None = None) -> int:
         "prove": cmd_prove,
         "anchor": cmd_anchor,
         "mcp": cmd_mcp,
+        "posture": cmd_posture,
         "dashboard": cmd_dashboard,
         "otel": cmd_otel,
         "import-agt": cmd_import_agt,

{agentmetry-0.9.4 → agentmetry-0.9.6}/agentmetry/core/audit/atlas.py

@@ -170,7 +170,7 @@ def attach_atlas(tool: Any) -> None:
 # adversary technique a whole sequence is evidence of, which is a claim only a
 # rule can make and never a single call.
 #
-# Deliberately small. Of the fifteen built-in rules, one describes an ATLAS
+# Deliberately small. Of the fourteen published rules, one describes an ATLAS
 # technique; the rest are host and operations behaviour that ATT&CK already
 # covers, and tagging them would put an AI-threat label on a shell command.
 # The empty entries are the design, not a backlog.

{agentmetry-0.9.4 → agentmetry-0.9.6}/agentmetry/core/audit/canonical.py

@@ -1,4 +1,4 @@
-"""Map durable outbox rows to Agentmetry canonical events (schema v1.1.0)."""
+"""Map durable outbox rows to Agentmetry canonical events (schema v1.2.0)."""
 
 from __future__ import annotations
 

{agentmetry-0.9.4 → agentmetry-0.9.6}/agentmetry/core/audit/external.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import re
 import uuid
 from datetime import datetime, timezone
 from typing import Any, Literal
@@ -19,12 +20,12 @@ from agentmetry.core.config import settings
 
 ExternalApp = Literal[
     "cursor", "claude", "antigravity", "codex", "mcp_proxy",
-    "qwen", "kimi", "qoder", "codebuddy", "trae", "crewai", "opensre", "agentmetry",
+    "qwen", "kimi", "qoder", "codebuddy", "trae", "crewai", "opensre", "copilot", "agentmetry",
 ]
 
 KNOWN_EXTERNAL_APPS = frozenset({
     "cursor", "claude", "antigravity", "codex", "mcp_proxy",
-    "qwen", "kimi", "qoder", "codebuddy", "trae", "crewai", "opensre",
+    "qwen", "kimi", "qoder", "codebuddy", "trae", "crewai", "opensre", "copilot",
 })
 
 _ACTION_MAP = {
@@ -49,11 +50,34 @@ def _split_tool(qualified: str) -> tuple[str, str]:
     return "", qualified
 
 
+#: What an agent that is not on the allowlist is recorded as.
+UNKNOWN_APP = "unknown"
+
+_CLAIMED_APP_UNSAFE = re.compile(r"[^a-z0-9_.-]")
+
+
+def _resolve_source_app(raw: Any) -> tuple[str, str]:
+    """The app to record, and the name the client claimed when that differs.
+
+    An unlisted name used to be recorded as `cursor`. So an OpenClaw plugin, a
+    LangGraph handler or anything else posting to ingest landed in the trail,
+    the SIEM and the detections attributed to Cursor: a confident wrong answer
+    in a record whose value is that it is right. It is now `unknown`, with the
+    claimed name kept beside it, reduced to a short identifier so a client
+    cannot write arbitrary text into a field SIEM rules group on.
+
+    A missing name still means Cursor. That default predates `source_app`, and
+    hooks installed before it may still post without one.
+    """
+    source_app = str(raw or "cursor").strip().lower()
+    if source_app in KNOWN_EXTERNAL_APPS or source_app == "agentmetry":
+        return source_app, ""
+    return UNKNOWN_APP, _CLAIMED_APP_UNSAFE.sub("", source_app)[:64]
+
+
 def build_external_canonical(payload: dict[str, Any]) -> dict[str, Any]:
     """Normalize an adapter payload into canonical v1.1 JSON."""
-    source_app = str(payload.get("source_app") or "cursor").lower()
-    if source_app not in KNOWN_EXTERNAL_APPS and source_app != "agentmetry":
-        source_app = "cursor"
+    source_app, claimed_app = _resolve_source_app(payload.get("source_app"))
 
     event_type = str(payload.get("event_type") or "tool_called")
     action_type, default_outcome = _ACTION_MAP.get(event_type, ("tool_called", "success"))
@@ -130,6 +154,8 @@ def build_external_canonical(payload: dict[str, Any]) -> dict[str, Any]:
         },
         "model": {"id": model_id, "provider": model_provider},
     }
+    if claimed_app:
+        event["source"]["claimed_app"] = claimed_app
 
     if tool_qualified:
         server = str(tool_block.get("server") or driver_name or source_app)

{agentmetry-0.9.4 → agentmetry-0.9.6}/agentmetry/core/audit/heartbeat.py

@@ -300,6 +300,7 @@ async def heartbeat_forever(interval: float | None = None) -> None:
     import asyncio
 
     from agentmetry.core.audit.mcp_inventory_event import InventoryState, maybe_emit_inventory
+    from agentmetry.core.audit.posture_event import PostureState, maybe_emit_posture
 
     period = interval if interval is not None else interval_seconds()
     if not period:
@@ -307,6 +308,7 @@ async def heartbeat_forever(interval: float | None = None) -> None:
         return
 
     inventory_state = InventoryState()
+    posture_state = PostureState()
     while True:
         try:
             event = await emit_heartbeat()
@@ -321,4 +323,9 @@ async def heartbeat_forever(interval: float | None = None) -> None:
             await maybe_emit_inventory(inventory_state)
         except Exception:
             logger.exception("MCP inventory event failed")
+        try:
+            # Opt-in, like the inventory, and in its own try for the same reason.
+            await maybe_emit_posture(posture_state)
+        except Exception:
+            logger.exception("Posture event failed")
         await asyncio.sleep(period)

{agentmetry-0.9.4 → agentmetry-0.9.6}/agentmetry/core/audit/hook_bootstrap.py

@@ -555,6 +555,83 @@ def install_codex_global_hooks(
     return hooks_path
 
 
+# --- GitHub Copilot (CLI and VS Code agent mode, ~/.copilot/hooks/) -----------
+# One file serves both. Copilot CLI reads every *.json in ~/.copilot/hooks (or
+# $COPILOT_HOME/hooks), and VS Code's Local harness reads the same directory and
+# accepts the CLI's format, detected by its `version` field: lowerCamel event
+# names, mapped to its own, and `bash` / `powershell` command fields, mapped to
+# its per-OS commands (microsoft/vscode `hookSchema.ts`, `hookTypes.ts`).
+#
+# The file is ours alone, so it is written whole rather than merged: a user's own
+# hooks live in their own files beside it, and Copilot loads them all.
+#
+# The PowerShell form needs `&`. VS Code on Windows runs a hook through
+# `powershell -Command`, where a command that starts with a quoted path is a
+# string expression, not a call. Without the call operator the hook would exit
+# non-zero, which VS Code treats as a non-blocking error: nothing recorded and
+# every deny an allow.
+COPILOT_HOOK_FILE = "agentmetry.json"
+
+#: (Copilot's event key, the PascalCase name our mapper and enforcement key on).
+#: `permissionRequest` is CLI-only and VS Code does not map it; `preToolUse` is
+#: the gate on both.
+COPILOT_HOOK_EVENTS: tuple[tuple[str, str], ...] = (
+    ("sessionStart", "SessionStart"),
+    ("userPromptSubmitted", "UserPromptSubmit"),
+    ("preToolUse", "PreToolUse"),
+    ("postToolUse", "PostToolUse"),
+    ("sessionEnd", "SessionEnd"),
+    ("agentStop", "Stop"),
+)
+
+
+def copilot_hooks_dir() -> Path:
+    home = os.environ.get("COPILOT_HOME", "").strip()
+    return (Path(home).expanduser() if home else Path.home() / ".copilot") / "hooks"
+
+
+def copilot_hooks_document(
+    *, python: str | None = None, ingest: Path | None = None, repo_root: Path | None = None
+) -> dict[str, Any]:
+    """The whole hooks file, in Copilot CLI's version-1 format."""
+    hooks: dict[str, Any] = {}
+    for key, event in COPILOT_HOOK_EVENTS:
+        command = hook_command("copilot", event, python=python, ingest=ingest, repo_root=repo_root)
+        hooks[key] = [
+            {
+                "type": "command",
+                "bash": command,
+                "powershell": f"& {command}",
+                "timeoutSec": 10,
+            }
+        ]
+    return {"version": 1, "hooks": hooks}
+
+
+def install_copilot_global_hooks(
+    *, repo_root: Path | None = None, python: str | None = None
+) -> Path | None:
+    """Write ~/.copilot/hooks/agentmetry.json for Copilot CLI and VS Code agent mode.
+
+    Not called from `bootstrap_tier_b_hooks`. VS Code's hooks are a preview
+    feature an organisation can switch off, so a silent install could look like
+    coverage that is not there; installing is a decision `hooks install` makes.
+    """
+    root = repo_root or _repo_root()
+    if hook_target(root) == "none":
+        logger.warning("Copilot hook bootstrap skipped: no way to reach ingest from %s", root)
+        return None
+    doc = copilot_hooks_document(
+        python=python or sys.executable, ingest=_ingest_script(root), repo_root=root
+    )
+    hooks_dir = copilot_hooks_dir()
+    hooks_dir.mkdir(parents=True, exist_ok=True)
+    path = hooks_dir / COPILOT_HOOK_FILE
+    path.write_text(json.dumps(doc, indent=2) + "\n", encoding="utf-8")
+    logger.info("Installed global Copilot audit hooks -> %s", path)
+    return path
+
+
 def _kimi_config_dir() -> Path:
     home = os.environ.get("KIMI_CODE_HOME", "").strip()
     if home:
@@ -648,9 +725,10 @@ if __name__ == "__main__":
         "qoder": install_qoder_global_hooks,
         "codebuddy": install_codebuddy_global_hooks,
         "codex": install_codex_global_hooks,
+        "copilot": install_copilot_global_hooks,
     }
     fn = installers.get(target, bootstrap_tier_b_hooks)
-    if target in ("qwen", "kimi", "qoder", "codebuddy", "codex"):
+    if target in ("qwen", "kimi", "qoder", "codebuddy", "codex", "copilot"):
         path = fn()
         if path:
             print(f"Installed global {target} hooks -> {path}")

{agentmetry-0.9.4 → agentmetry-0.9.6}/agentmetry/core/audit/managed_hooks.py

@@ -18,6 +18,14 @@ survive anything the user does to their own config:
 - Codex: `requirements.toml` (Windows `%ProgramData%\\OpenAI\\Codex`, else
   `/etc/codex`), `[[hooks.<Event>]]` entries; `allow_managed_hooks_only`
   (opt-in) skips user, project and plugin hooks.
+- GitHub Copilot CLI: a policy hook file in `policy.d` (Windows
+  `C:\\ProgramData\\GitHub\\Copilot\\policy.d`, else
+  `/etc/github-copilot/policy.d`). Policy hooks load before every other hook,
+  `disableAllHooks` cannot turn them off, and on POSIX Copilot ignores one that
+  is not root-owned or is group- or world-writable, so it is written 0644. There
+  is no lock to opt into: a policy hook already cannot be disabled. GitHub's
+  docs describe policy hooks for the CLI; whether VS Code agent mode reads them
+  is not documented, so the per-user install still matters there.
 
 Paths and keys are from the vendors' documentation as of 2026-10. Two of these
 files are shared with whatever else an organisation manages, so every write
@@ -38,7 +46,7 @@ from typing import Any
 
 from agentmetry.core.audit import hook_bootstrap as hb
 
-MANAGED_AGENTS = ("claude", "cursor", "codex")
+MANAGED_AGENTS = ("claude", "cursor", "codex", "copilot")
 CLAUDE_DROPIN = "50-agentmetry.json"
 CODEX_BEGIN = "# agentmetry managed hooks begin (written by `agentmetry hooks install --managed`)"
 CODEX_END = "# agentmetry managed hooks end"
@@ -70,11 +78,18 @@ def codex_requirements() -> Path:
     return Path("/etc/codex/requirements.toml")
 
 
+def copilot_policy_dir() -> Path:
+    if sys.platform == "win32":
+        return _program_data() / "GitHub" / "Copilot" / "policy.d"
+    return Path("/etc/github-copilot/policy.d")
+
+
 def managed_paths() -> dict[str, Path]:
     return {
         "claude": claude_managed_dir() / "managed-settings.d" / CLAUDE_DROPIN,
         "cursor": cursor_enterprise_hooks(),
         "codex": codex_requirements(),
+        "copilot": copilot_policy_dir() / hb.COPILOT_HOOK_FILE,
     }
 
 
@@ -190,9 +205,15 @@ def install(agent: str, *, lock: bool = False) -> Path:
     elif agent == "codex":
         current = path.read_text(encoding="utf-8") if path.is_file() else ""
         text = merge_codex_requirements(current, lock=lock)
+    elif agent == "copilot":
+        # Ours alone, like the Claude drop-in: written, not merged.
+        text = json.dumps(hb.copilot_hooks_document(), indent=2) + "\n"
     else:
         raise ValueError(f"no managed location for {agent}")
     _write(path, text)
+    if agent == "copilot" and sys.platform != "win32":
+        # Copilot skips a policy file that is group- or world-writable.
+        os.chmod(path, 0o644)
     return path
 
 

agentmetry-0.9.6/agentmetry/core/audit/posture_event.py

@@ -0,0 +1,104 @@
+"""Agent posture as an event a SIEM can see, when an operator asks.
+
+`agentmetry posture` answers "which agents here skip approval or have hooks
+off", for whoever runs it on that machine. A fleet wants the same answer in the
+SIEM, by host, and wants to know the day it changed.
+
+Same contract as the MCP inventory event (`mcp_inventory_event`): off unless
+`AGENTMETRY_POSTURE=1`, emitted when the recorder starts, when the findings
+change and once a day regardless, written to the trail first and then to every
+sink. Each finding is agent, scope label, setting, value and severity: no file
+path, so no home directory or username leaves the machine.
+"""
+
+from __future__ import annotations
+
+import time
+import uuid
+from dataclasses import dataclass
+from typing import Any
+
+from agentmetry.core.audit.canonical import SCHEMA_VERSION
+from agentmetry.core.audit.identity import identity_fields
+
+#: Re-emit an unchanged posture this often, so a fleet view over a day is whole.
+SNAPSHOT_SECONDS = 24 * 3600
+
+
+def enabled() -> bool:
+    from agentmetry.core.config import settings
+
+    return bool(getattr(settings, "posture_enabled", False))
+
+
+@dataclass
+class PostureState:
+    digest: str | None = None
+    emitted_at: float = 0.0
+
+
+def build_posture_event(now_utc: str, posture: Any, *, outcome: str) -> dict[str, Any]:
+    from agentmetry.core.diagnostics.posture import NOT_CHECKED
+
+    findings = [f.wire() for f in posture.sorted()]
+    counts = posture.counts()
+    return {
+        "schema_version": SCHEMA_VERSION,
+        "event_id": str(uuid.uuid4()),
+        "session_id": "",
+        "correlation_id": "",
+        "timestamp_utc": now_utc,
+        **identity_fields(),
+        "source_topic": "agentmetry/posture",
+        "source": {"tier": "agentmetry", "app": "agentmetry", "adapter": "posture"},
+        "initiator": {"actor_type": "system", "trigger": "scheduled", "operator_id": ""},
+        "actor": {"type": "system", "id": "agentmetry", "role": "recorder"},
+        "action": {
+            "type": "posture",
+            "outcome": outcome,
+            "reason": f"{counts['high']} high, {counts['medium']} medium, {counts['low']} low",
+        },
+        "agent": {"name": "agentmetry", "skill_id": ""},
+        "posture": {
+            "findings": findings,
+            "counts": counts,
+            "digest": posture.digest()[:16],
+            "files_read": len(posture.files_read),
+            "files_unreadable": len(posture.unreadable),
+            "not_checked": sorted(NOT_CHECKED),
+        },
+    }
+
+
+def due(state: PostureState, digest: str, now_monotonic: float) -> str | None:
+    """`snapshot`, `changed`, or None when there is nothing to say."""
+    if state.digest is None:
+        return "snapshot"
+    if digest != state.digest:
+        return "changed"
+    if now_monotonic - state.emitted_at >= SNAPSHOT_SECONDS:
+        return "snapshot"
+    return None
+
+
+async def maybe_emit_posture(state: PostureState) -> dict[str, Any] | None:
+    """Emit the posture if the operator turned it on and there is news."""
+    if not enabled():
+        return None
+    from datetime import datetime, timezone
+
+    from agentmetry.core.audit.ingest import _get_sink
+    from agentmetry.core.audit.trail_db import get_trail_db
+    from agentmetry.core.diagnostics.posture import collect
+
+    posture = collect()
+    digest = posture.digest()
+    now = time.monotonic()
+    outcome = due(state, digest, now)
+    if outcome is None:
+        return None
+    event = build_posture_event(datetime.now(timezone.utc).isoformat(), posture, outcome=outcome)
+    get_trail_db().insert(event)
+    await _get_sink().emit(event)
+    state.digest, state.emitted_at = digest, now
+    return event

{agentmetry-0.9.4 → agentmetry-0.9.6}/agentmetry/core/audit/tool_policy/evaluator.py

@@ -52,11 +52,12 @@ def _nested_arg_containers(hook_data: dict[str, Any]) -> tuple[list[dict[str, An
     Cursor shell hooks put `command` at the top level, but Claude and Codex nest
     it under `tool_input` and Antigravity under `toolCall.args`. Without those,
     a `command_pattern` rule matched nothing on three of the four supported IDEs
-    — the shipped block_shell_rm rule was Cursor-only in practice.
+    — the shipped block_shell_rm rule was Cursor-only in practice. Copilot CLI
+    sends `toolArgs`, and the same gap would have opened again for it.
     """
     containers: list[dict[str, Any]] = []
     raw = ""
-    for key in ("arguments", "args", "input", "tool_input", "toolInput"):
+    for key in ("arguments", "args", "input", "tool_input", "toolInput", "toolArgs"):
         val = hook_data.get(key)
         if isinstance(val, str):
             try:

{agentmetry-0.9.4 → agentmetry-0.9.6}/agentmetry/core/config.py

@@ -220,6 +220,14 @@ class Settings(BaseSettings):
         validation_alias=AliasChoices("AGENTMETRY_MCP_INVENTORY"),
     )
 
+    # Agent settings that skip approval or turn hooks off, as a `posture` event
+    # (`agentmetry posture`). Off by default, for the same reason as the
+    # inventory: what reaches a SOC from a laptop is the operator's decision.
+    posture_enabled: bool = Field(
+        default=False,
+        validation_alias=AliasChoices("AGENTMETRY_POSTURE"),
+    )
+
     # Rewrite ~/.claude/settings.json and ~/.cursor/hooks.json on every boot to
     # point at this checkout. Off by default: it used to always run, so booting
     # any second checkout (a test clone, a feature branch, a demo instance)

{agentmetry-0.9.4 → agentmetry-0.9.6}/agentmetry/core/diagnostics/hook_coverage.py

@@ -99,6 +99,11 @@ class Surface:
     configs: tuple[str, ...]
     #: Overridden where our command is not the ingest script itself.
     markers: tuple[str, ...] = _DEFAULT_MARKERS
+    #: Paths under that directory that only this agent creates. Empty means the
+    #: directory is the agent's own and its existence is the answer. Set where
+    #: the directory is shared with another program, so that program's presence
+    #: does not read as this agent's.
+    presence: tuple[str, ...] = ()
 
     def directory(self) -> Path:
         override = os.environ.get(self.home_env, "").strip() if self.home_env else ""
@@ -106,6 +111,20 @@ class Surface:
             return Path(override).expanduser()
         return Path.home() / self.home_rel
 
+    def installed(self) -> bool:
+        """Whether this agent is on the machine, as far as the disk can say.
+
+        A config we write counts as presence too: if our hook is in one of its
+        files, somebody installed it for this agent, and reporting the agent
+        absent would hide a hook that is there.
+        """
+        root = self.directory()
+        if not root.is_dir():
+            return False
+        if not self.presence:
+            return True
+        return any((root / rel).exists() for rel in (*self.presence, *self.configs))
+
 
 #: Mirrors hook_bootstrap's installers, plus the two surfaces that have none.
 #: Adding an installer without adding a row here is the drift this module exists
@@ -124,16 +143,30 @@ SURFACES: tuple[Surface, ...] = (
     # Codex's hash-based trust prompt, which skips untrusted hooks silently, so
     # a covered Codex is configured rather than proven to be firing.
     Surface("codex", "", ".codex", ("hooks.json",)),
+    # Copilot CLI and VS Code agent mode both read ~/.copilot/hooks/*.json, and
+    # the installer writes its own file there. The directory is Copilot CLI's,
+    # so a machine with only VS Code Copilot may report absent: VS Code does not
+    # necessarily create it. What a file check cannot see is VS Code's
+    # `chat.useHooks` switch or an organisation policy that turns hooks off,
+    # which `agentmetry posture` reports.
+    Surface("copilot", "COPILOT_HOME", ".copilot", ("hooks/agentmetry.json",)),
     # Antigravity 2.0 usually runs from ~/.gemini/antigravity/scratch rather
     # than the repo, so scripts/install_antigravity_hooks.ps1 writes both. Either
     # one means the agent is recorded. Its command is a .cmd wrapper, not the
     # ingest script, hence the marker override.
+    #
+    # ~/.gemini is not Antigravity's alone: Gemini CLI keeps its settings.json
+    # there too. Treating the directory as the answer reported every machine
+    # with only Gemini CLI as an uncovered Antigravity, which degraded its beat
+    # for an agent that was never installed. Antigravity's own data lives in
+    # ~/.gemini/antigravity, so that, or one of our hook files, is presence.
     Surface(
         "antigravity",
         "",
         ".gemini",
         ("config/hooks.json", "antigravity/scratch/.agents/hooks.json"),
         markers=("agentmetry_antigravity_hook", *_DEFAULT_MARKERS),
+        presence=("antigravity",),
     ),
 )
 
@@ -175,7 +208,7 @@ def coverage() -> dict[str, str]:
     result: dict[str, str] = {}
     for surface in SURFACES:
         try:
-            present = surface.directory().is_dir()
+            present = surface.installed()
         except OSError:
             present = False
         if not present: