agentmetry 0.9.7__tar.gz → 0.9.8__tar.gz

{agentmetry-0.9.7 → agentmetry-0.9.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentmetry
-Version: 0.9.7
+Version: 0.9.8
 Summary: Local-first flight recorder for AI coding agents: hash-chained audit trail, MITRE-mapped sequence detection, DLP
 Project-URL: Homepage, https://agentmetry.ai
 Project-URL: Source, https://github.com/blitzcrieg1/agentmetry

{agentmetry-0.9.7 → agentmetry-0.9.8}/agentmetry/api/main.py

@@ -2,6 +2,9 @@ from __future__ import annotations
 
 import asyncio
 import logging
+import os
+import subprocess
+import sys
 from contextlib import asynccontextmanager
 from logging.handlers import RotatingFileHandler
 from pathlib import Path
@@ -76,6 +79,34 @@ def _start_forwarders() -> list[asyncio.Task]:
     return tasks
 
 
+def start_transcript_watcher(watcher_path: Path) -> subprocess.Popen:
+    """Start the Antigravity transcript watcher, tied to this process's life.
+
+    Its stdin is a pipe only this process holds, and the lifeline variable
+    tells it to exit at end-of-file. When this process dies, however it dies,
+    the pipe closes and the watcher follows. Without it each restart left a
+    watcher behind, and every one of them recorded every Antigravity call.
+    """
+    return subprocess.Popen(
+        [sys.executable, str(watcher_path)],
+        stdin=subprocess.PIPE,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+        env={**os.environ, "AGENTMETRY_WATCHER_LIFELINE": "1"},
+    )
+
+
+def stop_transcript_watcher(process: subprocess.Popen) -> None:
+    """Close the lifeline, then terminate. Closing alone is enough; terminate is
+    for a watcher that predates the lifeline."""
+    try:
+        if process.stdin:
+            process.stdin.close()
+    except OSError:
+        pass
+    process.terminate()
+
+
 @asynccontextmanager
 async def lifespan(app: FastAPI):
     from agentmetry.core.audit.migrate import backfill_db_from_jsonl
@@ -177,17 +208,11 @@ async def lifespan(app: FastAPI):
         )
 
     # Launch transcript watcher for Antigravity in the background
-    import subprocess
-    import sys
     watcher_process = None
     try:
         watcher_path = Path(__file__).resolve().parents[4] / "scripts" / "antigravity_transcript_watcher.py"
         if watcher_path.exists():
-            watcher_process = subprocess.Popen(
-                [sys.executable, str(watcher_path)],
-                stdout=subprocess.DEVNULL,
-                stderr=subprocess.DEVNULL,
-            )
+            watcher_process = start_transcript_watcher(watcher_path)
             logger.info("Started Antigravity transcript watcher (PID: %s)", watcher_process.pid)
     except Exception as exc:
         logger.warning("Failed to start Antigravity transcript watcher: %s", exc)
@@ -201,7 +226,7 @@ async def lifespan(app: FastAPI):
     for task in bridge_tasks:
         task.cancel()
     if watcher_process:
-        watcher_process.terminate()
+        stop_transcript_watcher(watcher_process)
 
 
 app = FastAPI(

{agentmetry-0.9.7 → agentmetry-0.9.8}/agentmetry/api/routes/audit.py

@@ -101,7 +101,7 @@ class ExternalIngestBody(BaseModel):
 
     source_app: str = Field(
         ...,
-        description="cursor | claude | antigravity | codex | copilot | mcp_proxy | qwen | kimi | qoder | codebuddy | trae | crewai | opensre",
+        description="cursor | claude | antigravity | codex | copilot | mcp_proxy | qwen | kimi | qoder | codebuddy | trae | crewai | opensre | zcode | grok_bot",
     )
     event_type: str = Field(
         ...,
@@ -309,6 +309,29 @@ async def audit_session(
     }
 
 
+@router.get("/session/{correlation_id}/tree", dependencies=[Depends(require_api_key)])
+async def audit_session_tree(
+    correlation_id: str,
+    limit: int = Query(20000, ge=1, le=50000),
+    around_utc: str = Query("", max_length=40),
+):
+    """One session folded into investigation-tree nodes.
+
+    Each ask, its answer and the call it led to become one node, so a detection
+    that cites the ask and a policy verdict recorded on it land on the call
+    they belong to. A session longer than `limit` is windowed on `around_utc`
+    (a detection's first_seen_utc) when given. See `core/audit/session_tree.py`.
+    """
+    from agentmetry.core.audit.session_tree import session_tree
+
+    if not settings.audit_export_enabled:
+        return {"correlation_id": correlation_id, "enabled": False, "nodes": [], "summary": {}, "truncated": False}
+    try:
+        return await asyncio.to_thread(session_tree, correlation_id, limit, around_utc)
+    except Exception as exc:
+        raise HTTPException(status_code=500, detail=str(exc)) from exc
+
+
 @router.get("/detections/{correlation_id}", dependencies=[Depends(require_api_key)])
 async def audit_detections(correlation_id: str):
     """Run correlated behavioral rules over one session and return detections.

{agentmetry-0.9.7 → agentmetry-0.9.8}/agentmetry/cli/__init__.py

@@ -551,6 +551,7 @@ def cmd_cloud(args: argparse.Namespace) -> int:
         map_claude_messages,
         map_claude_session,
         map_cursor_agent,
+        map_outbound_poll,
     )
 
     base = (args.url or "").strip() or None
@@ -576,7 +577,9 @@ def cmd_cloud(args: argparse.Namespace) -> int:
         if not api_key:
             print("CURSOR_API_KEY is not set.")
             return 2
-        for agent in fetch_cursor_agents(api_key, base or __import__("agentmetry.core.audit.cloud_bridge", fromlist=["CURSOR_DEFAULT_BASE"]).CURSOR_DEFAULT_BASE):
+        cursor_base = base or __import__("agentmetry.core.audit.cloud_bridge", fromlist=["CURSOR_DEFAULT_BASE"]).CURSOR_DEFAULT_BASE
+        post(map_outbound_poll("cursor_cloud", "GET", f"{cursor_base.rstrip('/')}/v1/agents"))
+        for agent in fetch_cursor_agents(api_key, cursor_base):
             runs = []
             if not args.skip_runs:
                 try:
@@ -594,7 +597,9 @@ def cmd_cloud(args: argparse.Namespace) -> int:
             print("ANTHROPIC_COMPLIANCE_KEY is not set (a Compliance Access Key with read:compliance_user_data, not an admin key).")
             return 2
         kind = "remote" if args.remote else "local"
-        sessions = fetch_claude_sessions(api_key, kind=kind, base=base or "https://api.anthropic.com", limit=args.limit)
+        claude_base = base or "https://api.anthropic.com"
+        post(map_outbound_poll("claude_cloud", "GET", f"{claude_base.rstrip('/')}/v1/compliance/apps/sessions/{kind}"))
+        sessions = fetch_claude_sessions(api_key, kind=kind, base=claude_base, limit=args.limit)
         for session in sessions[: args.limit]:
             post(map_claude_session(session))
             try:
@@ -663,6 +668,21 @@ def cmd_hooks(args: argparse.Namespace) -> int:
     from agentmetry.core.audit import hook_bootstrap
     from agentmetry.core.diagnostics import hook_coverage
 
+    if args.action == "install":
+        # Before --managed too: a managed install would put the temporary path
+        # into machine-wide policy files.
+        reason = hook_bootstrap.ephemeral_environment()
+        if reason:
+            print(
+                f"Not installing hooks: {reason}. That cache can be deleted at any "
+                "time, and every hook would then fail (most agents silently stop "
+                "recording; Copilot CLI blocks every tool call). Install Agentmetry "
+                "somewhere that stays, then run this again:\n"
+                "  uv tool install agentmetry   (or: pipx install agentmetry, or: pip install agentmetry)\n"
+                "  agentmetry hooks install",
+                file=sys.stderr,
+            )
+            return 1
     if getattr(args, "managed", False):
         return _hooks_managed(args)
     if args.action == "status":

agentmetry-0.9.8/agentmetry/core/audit/antigravity_trajectory.py

@@ -0,0 +1,81 @@
+"""Read tool calls out of an Antigravity conversation database.
+
+The installed hook only matches `run_command`, so file reads, writes, search
+and the other tools never reach the trail. The conversation database stores
+every step. The payload is a protobuf blob. The tool name is a length-prefixed
+ASCII field and the arguments are the JSON object that follows it. That framing
+was read off a real database on 2026-10-16. A blob that does not match it
+yields nothing.
+"""
+
+from __future__ import annotations
+
+import json
+import sqlite3
+from pathlib import Path
+from typing import Any, Iterator
+
+
+def _varint(buf: bytes, index: int) -> tuple[int, int]:
+    value = 0
+    shift = 0
+    while index < len(buf) and shift <= 28:
+        byte = buf[index]
+        index += 1
+        value |= (byte & 0x7F) << shift
+        if not byte & 0x80:
+            return value, index
+        shift += 7
+    raise ValueError("truncated varint")
+
+
+def iter_tool_calls(payload: bytes) -> Iterator[tuple[str, dict[str, Any]]]:
+    """Yield (tool name, arguments) from one step payload."""
+    index = 0
+    while True:
+        marker = payload.find(b"\x12", index)
+        if marker < 0 or marker + 2 >= len(payload):
+            return
+        name_len = payload[marker + 1]
+        if name_len == 0 or name_len > 64 or name_len & 0x80:
+            index = marker + 1
+            continue
+        name_at = marker + 2
+        name_end = name_at + name_len
+        if name_end >= len(payload) or payload[name_end] != 0x1A:
+            index = marker + 1
+            continue
+        name = payload[name_at:name_end]
+        if not name.isascii() or not all(chr(c).isalnum() or c == ord("_") for c in name):
+            index = marker + 1
+            continue
+        try:
+            json_len, json_at = _varint(payload, name_end + 1)
+        except ValueError:
+            index = marker + 1
+            continue
+        blob = payload[json_at : json_at + json_len]
+        if not blob.startswith(b"{"):
+            index = marker + 1
+            continue
+        try:
+            args = json.loads(blob)
+        except json.JSONDecodeError:
+            index = marker + 1
+            continue
+        if isinstance(args, dict):
+            yield name.decode("ascii"), args
+        index = json_at + max(json_len, 1)
+
+
+def tool_names(db_path: Path) -> dict[str, int]:
+    """Count tool names in one conversation database. Arguments are not returned."""
+    counts: dict[str, int] = {}
+    uri = f"file:{Path(db_path).as_posix()}?mode=ro"
+    with sqlite3.connect(uri, uri=True) as con:
+        for (payload,) in con.execute("SELECT step_payload FROM steps"):
+            if not isinstance(payload, (bytes, bytearray)):
+                continue
+            for name, _args in iter_tool_calls(payload):
+                counts[name] = counts.get(name, 0) + 1
+    return counts

{agentmetry-0.9.7 → agentmetry-0.9.8}/agentmetry/core/audit/cloud_bridge.py

@@ -26,6 +26,7 @@ from __future__ import annotations
 import hashlib
 import json
 from typing import Any
+from urllib.parse import urlsplit
 
 REDACT_KEYS = frozenset(
     {"authorization", "api_key", "apikey", "password", "secret", "token", "session_key"}
@@ -110,6 +111,29 @@ def tool_summary(args: Any) -> dict[str, Any]:
     return summary
 
 
+def map_outbound_poll(source_app: str, method: str, url: str) -> dict[str, Any]:
+    """The request this machine sends. The key is not in the payload.
+
+    Query strings are dropped: a token does not belong in the trail. The path
+    and host are the trace of the send.
+    """
+    parts = urlsplit(url)
+    target = f"{method} {parts.netloc}{parts.path}"
+    return {
+        "source_app": source_app,
+        "adapter": "cloud_bridge",
+        "event_type": "tool_called",
+        "outcome": "success",
+        "correlation_id": f"{source_app}-outbound",
+        "reason": "outbound poll; key sent and not stored",
+        "tool": {
+            "qualified": f"{source_app}.poll",
+            "server": source_app,
+            "command": target,
+        },
+    }
+
+
 # --- Cursor Cloud Agents API -------------------------------------------------
 
 CURSOR_DEFAULT_BASE = "https://api.cursor.com"

agentmetry-0.9.8/agentmetry/core/audit/detection/corpus/benign_container_registry_publish.jsonl

@@ -0,0 +1,3 @@
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-registry-publish","event_id":"7a7001f1-6c5b-51ab-92e7-8a72c8f6c001","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-registry-publish","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T10:00:00+00:00","tool":{"arguments":{"command":"docker login registry.example.com --username ci-bot --password-stdin"},"command":"docker login registry.example.com --username ci-bot --password-stdin","input_hash":"1f3b6a8a28dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d01","input_redaction":"hash+command","mitre":{"tactic":"Command and Control","tactic_id":"TA0011","technique":"Web Protocols","technique_id":"T1071.001"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude","traits":["net_egress"]}}
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-registry-publish","event_id":"7a7001f1-6c5b-51ab-92e7-8a72c8f6c002","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-registry-publish","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T10:00:30+00:00","tool":{"arguments":{"command":"docker build -t registry.example.com/team/service:build-42 ."},"command":"docker build -t registry.example.com/team/service:build-42 .","input_hash":"2a4c6d8e28dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d02","input_redaction":"hash+command","mitre":{"tactic":"Execution","tactic_id":"TA0002","technique":"Unix Shell","technique_id":"T1059.004"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude"}}
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-registry-publish","event_id":"7a7001f1-6c5b-51ab-92e7-8a72c8f6c003","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-registry-publish","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T10:01:20+00:00","tool":{"arguments":{"command":"docker push registry.example.com/team/service:build-42"},"command":"docker push registry.example.com/team/service:build-42","input_hash":"3b5d7e9f28dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d03","input_redaction":"hash+command","mitre":{"tactic":"Command and Control","tactic_id":"TA0011","technique":"Web Protocols","technique_id":"T1071.001"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude","traits":["net_egress"]}}

agentmetry-0.9.8/agentmetry/core/audit/detection/corpus/benign_dependency_audit_network_burst.jsonl

@@ -0,0 +1,4 @@
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-dependency-audit","event_id":"9c7001f1-6c5b-51ab-92e7-8a72c8f6e001","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-dependency-audit","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T12:00:00+00:00","tool":{"arguments":{"command":"npm audit --json > reports/npm-audit.json"},"command":"npm audit --json > reports/npm-audit.json","input_hash":"8091234428dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d08","input_redaction":"hash+command","mitre":{"tactic":"Execution","tactic_id":"TA0002","technique":"Unix Shell","technique_id":"T1059.004"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude"}}
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-dependency-audit","event_id":"9c7001f1-6c5b-51ab-92e7-8a72c8f6e002","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-dependency-audit","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T12:00:20+00:00","tool":{"arguments":{"command":"pip-audit -r requirements.txt -f json -o reports/pip-audit.json"},"command":"pip-audit -r requirements.txt -f json -o reports/pip-audit.json","input_hash":"91a2345528dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d09","input_redaction":"hash+command","mitre":{"tactic":"Execution","tactic_id":"TA0002","technique":"Unix Shell","technique_id":"T1059.004"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude"}}
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-dependency-audit","event_id":"9c7001f1-6c5b-51ab-92e7-8a72c8f6e003","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-dependency-audit","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T12:00:40+00:00","tool":{"arguments":{"command":"curl -s https://registry.npmjs.org/-/npm/v1/security/advisories?limit=20 > reports/npm-advisories.json"},"command":"curl -s https://registry.npmjs.org/-/npm/v1/security/advisories?limit=20 > reports/npm-advisories.json","input_hash":"a2b3456628dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d10","input_redaction":"hash+command","mitre":{"tactic":"Command and Control","tactic_id":"TA0011","technique":"Web Protocols","technique_id":"T1071.001"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude","traits":["net_egress"]}}
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-dependency-audit","event_id":"9c7001f1-6c5b-51ab-92e7-8a72c8f6e004","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-dependency-audit","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T12:01:20+00:00","tool":{"arguments":{"command":"python scripts/summarise_audit.py reports/npm-audit.json reports/pip-audit.json reports/npm-advisories.json"},"command":"python scripts/summarise_audit.py reports/npm-audit.json reports/pip-audit.json reports/npm-advisories.json","input_hash":"b3c4567728dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d11","input_redaction":"hash+command","mitre":{"tactic":"Execution","tactic_id":"TA0002","technique":"Unix Shell","technique_id":"T1059.004"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude"}}

agentmetry-0.9.8/agentmetry/core/audit/detection/corpus/benign_terraform_apply_with_profile.jsonl

@@ -0,0 +1,4 @@
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-terraform-apply","event_id":"8b7001f1-6c5b-51ab-92e7-8a72c8f6d001","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-terraform-apply","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T11:00:00+00:00","tool":{"arguments":{"command":"terraform init -backend-config=env/staging.backend"},"command":"terraform init -backend-config=env/staging.backend","input_hash":"4c6e8f1028dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d04","input_redaction":"hash+command","mitre":{"tactic":"Execution","tactic_id":"TA0002","technique":"Unix Shell","technique_id":"T1059.004"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude"}}
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-terraform-apply","event_id":"8b7001f1-6c5b-51ab-92e7-8a72c8f6d002","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-terraform-apply","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T11:02:00+00:00","tool":{"arguments":{"command":"terraform plan -var-file env/staging.tfvars -out tfplan"},"command":"terraform plan -var-file env/staging.tfvars -out tfplan","input_hash":"5d7f901128dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d05","input_redaction":"hash+command","mitre":{"tactic":"Execution","tactic_id":"TA0002","technique":"Unix Shell","technique_id":"T1059.004"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude"}}
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-terraform-apply","event_id":"8b7001f1-6c5b-51ab-92e7-8a72c8f6d003","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-terraform-apply","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T11:04:00+00:00","tool":{"arguments":{"command":"AWS_PROFILE=staging terraform apply -auto-approve tfplan"},"command":"AWS_PROFILE=staging terraform apply -auto-approve tfplan","input_hash":"6e80912228dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d06","input_redaction":"hash+command","mitre":{"tactic":"Execution","tactic_id":"TA0002","technique":"Unix Shell","technique_id":"T1059.004"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude"}}
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-terraform-apply","event_id":"8b7001f1-6c5b-51ab-92e7-8a72c8f6d004","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-terraform-apply","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T11:06:00+00:00","tool":{"arguments":{"command":"aws sts get-caller-identity --profile staging"},"command":"aws sts get-caller-identity --profile staging","input_hash":"7f90123328dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d07","input_redaction":"hash+command","mitre":{"tactic":"Execution","tactic_id":"TA0002","technique":"Unix Shell","technique_id":"T1059.004"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude","traits":["cloud_api"]}}

{agentmetry-0.9.7 → agentmetry-0.9.8}/agentmetry/core/audit/detection/corpus/corpus.yaml

@@ -419,6 +419,34 @@ cases:
       Thirty read-only calls spread over half an hour. Burst rules measure a
       time window; a long session must not trip them by length alone.
 
+  - name: container registry publish
+    session: benign_container_registry_publish.jsonl
+    expect: []
+    benign: true
+    note: >
+      `docker login`, `docker build` and `docker push` against a registry. This
+      looks like authenticated egress, but no credential is read from disk or
+      the environment; the password arrives through stdin and never belongs in
+      the trail.
+
+  - name: terraform apply with a named profile
+    session: benign_terraform_apply_with_profile.jsonl
+    expect: []
+    benign: true
+    note: >
+      Infrastructure automation touches cloud state and later calls `aws sts`,
+      but it uses a named profile rather than reading credentials. Cloud API use
+      by itself is not lateral movement after credential harvest.
+
+  - name: dependency audit touches remote advisories
+    session: benign_dependency_audit_network_burst.jsonl
+    expect: []
+    benign: true
+    note: >
+      Package audits query registries and advisory feeds in quick succession,
+      then run a local summariser. A short network-heavy audit is not a session
+      tool burst, a download cradle or credential exfiltration.
+
   - name: human-driven deletes currently fire
     session: benign_human_driven_deletes.jsonl
     expect: [destructive-delete-burst]

{agentmetry-0.9.7 → agentmetry-0.9.8}/agentmetry/core/audit/external.py

@@ -21,13 +21,13 @@ from agentmetry.core.config import settings
 ExternalApp = Literal[
     "cursor", "claude", "antigravity", "codex", "mcp_proxy",
     "qwen", "kimi", "qoder", "codebuddy", "trae", "crewai", "opensre", "copilot", "zcode",
-    "cursor_cloud", "claude_cloud", "grok_build", "agentmetry",
+    "cursor_cloud", "claude_cloud", "grok_build", "grok_bot", "agentmetry",
 ]
 
 KNOWN_EXTERNAL_APPS = frozenset({
     "cursor", "claude", "antigravity", "codex", "mcp_proxy",
     "qwen", "kimi", "qoder", "codebuddy", "trae", "crewai", "opensre", "copilot", "zcode",
-    "cursor_cloud", "claude_cloud", "grok_build",
+    "cursor_cloud", "claude_cloud", "grok_build", "grok_bot",
 })
 
 _ACTION_MAP = {

agentmetry-0.9.8/agentmetry/core/audit/grok_bot_transcript.py

@@ -0,0 +1,58 @@
+"""Grok Bot desktop chat cache to ingest payloads.
+
+The desktop app writes the conversation to sand-client-persistence. Those
+lines are the bot's own turns. They are not Cursor tool calls, and posting
+them without source_app grok_bot used to land them as unknown or, before
+that, as Cursor.
+"""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import Any
+
+
+def message_text(entry: dict[str, Any]) -> str:
+    if entry.get("kind") == "message":
+        text = entry.get("content")
+        return text if isinstance(text, str) else ""
+    message = entry.get("message")
+    if isinstance(message, dict):
+        text = message.get("content")
+        return text if isinstance(text, str) else ""
+    return ""
+
+
+def _timestamp(entry: dict[str, Any]) -> str:
+    raw = entry.get("timestampMs")
+    if isinstance(raw, (int, float)) and raw > 1_000_000_000_000:
+        return datetime.fromtimestamp(raw / 1000, timezone.utc).isoformat()
+    return ""
+
+
+def payloads_for_entries(entries: list[dict[str, Any]], *, agent_id: str) -> list[dict[str, Any]]:
+    """One ingest payload per chat line. The command column carries the text."""
+    out: list[dict[str, Any]] = []
+    for entry in entries:
+        text = message_text(entry).strip()
+        entry_id = str(entry.get("id") or "")
+        if not text or not entry_id:
+            continue
+        role = "user" if entry.get("role") == "user" else "assistant"
+        payload: dict[str, Any] = {
+            "source_app": "grok_bot",
+            "adapter": "grok_bot_transcript",
+            "event_type": "tool_called",
+            "correlation_id": agent_id,
+            "outcome": "success",
+            "tool": {
+                "qualified": f"grok_bot.{role}",
+                "server": "grok_bot",
+                "command": text[:2000],
+            },
+        }
+        stamp = _timestamp(entry)
+        if stamp:
+            payload["timestamp_utc"] = stamp
+        out.append(payload)
+    return out

{agentmetry-0.9.7 → agentmetry-0.9.8}/agentmetry/core/audit/hook_bootstrap.py

@@ -174,6 +174,36 @@ def _console_script() -> Path | None:
     return None
 
 
+def ephemeral_environment(executable: str | None = None) -> str:
+    """Why this interpreter is a temporary one, or "" when it will still exist later.
+
+    `uvx agentmetry ...` and `pipx run agentmetry ...` run from a cache the tool
+    may delete at any time (`uv cache clean`, a pipx cache expiry). A hook
+    config written from there names an executable inside that cache: it works
+    today, and after the next clean every hook fails. Most agents treat a
+    failing hook as a non-blocking error, so recording stops without a word;
+    Copilot CLI fails closed on a broken pre-tool hook and blocks every tool
+    call. Coverage would still report the agent covered, because it checks the
+    hook text in the config, not the file it points at.
+    """
+    raw = executable or sys.executable
+    try:
+        resolved = Path(raw).resolve()
+    except OSError:
+        resolved = Path(raw)
+    # Split on both separators by hand: on POSIX a Windows path is one part.
+    text = str(resolved).replace("\\", "/").lower()
+    parts = [p for p in text.split("/") if p]
+    cache = os.environ.get("UV_CACHE_DIR", "").strip()
+    if cache and text.startswith(str(Path(cache).resolve()).replace("\\", "/").lower() + "/"):
+        return f"this interpreter is inside uv's cache ({resolved})"
+    if "uv" in parts and ("archive-v0" in parts or "builds-v0" in parts):
+        return f"this interpreter is inside uv's cache ({resolved})"
+    if "pipx" in parts and ".cache" in parts:
+        return f"this interpreter is inside pipx's run cache ({resolved})"
+    return ""
+
+
 def hook_target(repo_root: Path | None = None) -> str:
     """Which of the three ways to reach ingest exists here: repo, frozen, wheel.