agentmetry 0.9.7__tar.gz → 0.9.9__tar.gz

{agentmetry-0.9.7 → agentmetry-0.9.9}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.5
 Name: agentmetry
-Version: 0.9.7
-Summary: Local-first flight recorder for AI coding agents: hash-chained audit trail, MITRE-mapped sequence detection, DLP
+Version: 0.9.9
+Summary: Local-first endpoint sensor for AI coding agents: hash-chained audit trail, MITRE-mapped sequence detection, DLP
 Project-URL: Homepage, https://agentmetry.ai
 Project-URL: Source, https://github.com/blitzcrieg1/agentmetry
 Project-URL: Issues, https://github.com/blitzcrieg1/agentmetry/issues
@@ -37,12 +37,12 @@ Provides-Extra: dev
 Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
 Requires-Dist: pytest-cov>=6.0; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
-Requires-Dist: ruff==0.16.10; extra == 'dev'
+Requires-Dist: ruff==0.17.1; extra == 'dev'
 Description-Content-Type: text/markdown
 
 # Agentmetry
 
-A local-first flight recorder for AI coding agents.
+A local-first endpoint sensor for AI coding agents.
 
 Agentmetry hooks the tool lifecycle of Claude Code, Cursor, Codex and Antigravity,
 writes every tool call, approval and denial to a hash-chained JSONL trail on your

{agentmetry-0.9.7 → agentmetry-0.9.9}/README.md

@@ -1,6 +1,6 @@
 # Agentmetry
 
-A local-first flight recorder for AI coding agents.
+A local-first endpoint sensor for AI coding agents.
 
 Agentmetry hooks the tool lifecycle of Claude Code, Cursor, Codex and Antigravity,
 writes every tool call, approval and denial to a hash-chained JSONL trail on your

{agentmetry-0.9.7 → agentmetry-0.9.9}/agentmetry/api/main.py

@@ -2,6 +2,9 @@ from __future__ import annotations
 
 import asyncio
 import logging
+import os
+import subprocess
+import sys
 from contextlib import asynccontextmanager
 from logging.handlers import RotatingFileHandler
 from pathlib import Path
@@ -76,6 +79,34 @@ def _start_forwarders() -> list[asyncio.Task]:
     return tasks
 
 
+def start_transcript_watcher(watcher_path: Path) -> subprocess.Popen:
+    """Start the Antigravity transcript watcher, tied to this process's life.
+
+    Its stdin is a pipe only this process holds, and the lifeline variable
+    tells it to exit at end-of-file. When this process dies, however it dies,
+    the pipe closes and the watcher follows. Without it each restart left a
+    watcher behind, and every one of them recorded every Antigravity call.
+    """
+    return subprocess.Popen(
+        [sys.executable, str(watcher_path)],
+        stdin=subprocess.PIPE,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+        env={**os.environ, "AGENTMETRY_WATCHER_LIFELINE": "1"},
+    )
+
+
+def stop_transcript_watcher(process: subprocess.Popen) -> None:
+    """Close the lifeline, then terminate. Closing alone is enough; terminate is
+    for a watcher that predates the lifeline."""
+    try:
+        if process.stdin:
+            process.stdin.close()
+    except OSError:
+        pass
+    process.terminate()
+
+
 @asynccontextmanager
 async def lifespan(app: FastAPI):
     from agentmetry.core.audit.migrate import backfill_db_from_jsonl
@@ -177,17 +208,11 @@ async def lifespan(app: FastAPI):
         )
 
     # Launch transcript watcher for Antigravity in the background
-    import subprocess
-    import sys
     watcher_process = None
     try:
         watcher_path = Path(__file__).resolve().parents[4] / "scripts" / "antigravity_transcript_watcher.py"
         if watcher_path.exists():
-            watcher_process = subprocess.Popen(
-                [sys.executable, str(watcher_path)],
-                stdout=subprocess.DEVNULL,
-                stderr=subprocess.DEVNULL,
-            )
+            watcher_process = start_transcript_watcher(watcher_path)
             logger.info("Started Antigravity transcript watcher (PID: %s)", watcher_process.pid)
     except Exception as exc:
         logger.warning("Failed to start Antigravity transcript watcher: %s", exc)
@@ -201,7 +226,7 @@ async def lifespan(app: FastAPI):
     for task in bridge_tasks:
         task.cancel()
     if watcher_process:
-        watcher_process.terminate()
+        stop_transcript_watcher(watcher_process)
 
 
 app = FastAPI(

{agentmetry-0.9.7 → agentmetry-0.9.9}/agentmetry/api/routes/audit.py

@@ -101,11 +101,11 @@ class ExternalIngestBody(BaseModel):
 
     source_app: str = Field(
         ...,
-        description="cursor | claude | antigravity | codex | copilot | mcp_proxy | qwen | kimi | qoder | codebuddy | trae | crewai | opensre",
+        description="cursor | claude | antigravity | codex | copilot | mcp_proxy | qwen | kimi | qoder | codebuddy | trae | crewai | opensre | zcode | grok_bot",
     )
     event_type: str = Field(
         ...,
-        description="session_start | session_end | tool_called | tool_denied | tool_failed | approval_request | approval_response | mcp_schema",
+        description="session_start | session_end | tool_called | tool_denied | tool_failed | approval_request | approval_response | mcp_schema | hook_remediation",
     )
     correlation_id: str = ""
     session_id: str = ""
@@ -309,6 +309,29 @@ async def audit_session(
     }
 
 
+@router.get("/session/{correlation_id}/tree", dependencies=[Depends(require_api_key)])
+async def audit_session_tree(
+    correlation_id: str,
+    limit: int = Query(20000, ge=1, le=50000),
+    around_utc: str = Query("", max_length=40),
+):
+    """One session folded into investigation-tree nodes.
+
+    Each ask, its answer and the call it led to become one node, so a detection
+    that cites the ask and a policy verdict recorded on it land on the call
+    they belong to. A session longer than `limit` is windowed on `around_utc`
+    (a detection's first_seen_utc) when given. See `core/audit/session_tree.py`.
+    """
+    from agentmetry.core.audit.session_tree import session_tree
+
+    if not settings.audit_export_enabled:
+        return {"correlation_id": correlation_id, "enabled": False, "nodes": [], "summary": {}, "truncated": False}
+    try:
+        return await asyncio.to_thread(session_tree, correlation_id, limit, around_utc)
+    except Exception as exc:
+        raise HTTPException(status_code=500, detail=str(exc)) from exc
+
+
 @router.get("/detections/{correlation_id}", dependencies=[Depends(require_api_key)])
 async def audit_detections(correlation_id: str):
     """Run correlated behavioral rules over one session and return detections.

{agentmetry-0.9.7 → agentmetry-0.9.9}/agentmetry/cli/__init__.py

@@ -48,6 +48,70 @@ def _api_base_url(port: int) -> str:
     return os.environ.get("AGENTMETRY_URL", "").strip().rstrip("/") or _base_url(port)
 
 
+def _add_dir_flags(parser: argparse.ArgumentParser) -> None:
+    """The path split. Omit the flags and nothing moves.
+
+    `SUPPRESS`, so the same flag on `agentmetry` and on the subcommand do not
+    overwrite each other with a default of None.
+    """
+    parser.add_argument(
+        "--data-dir", default=argparse.SUPPRESS,
+        help="trail, spool, token and logs (env AGENTMETRY_DATA_DIR)",
+    )
+    parser.add_argument(
+        "--user-profile-dir", default=argparse.SUPPRESS,
+        help="the developer home whose IDE configs to install into and check "
+        "(env AGENTMETRY_USER_PROFILE_DIR); for a recorder run as root or LocalSystem",
+    )
+    parser.add_argument(
+        "--policy-dir", default=argparse.SUPPRESS,
+        help="an extra managed policy location, checked like the platform one "
+        "(env AGENTMETRY_POLICY_DIR)",
+    )
+
+
+def _apply_dir_flags(args: argparse.Namespace) -> None:
+    """Export the path flags before a command reads data_dir() or the profile.
+
+    Exported, not passed: `start` spawns `serve`, and the hook commands it
+    writes run in other processes, all of which read the environment.
+    """
+    global _DATA_DIR, _PID_FILE
+    if getattr(args, "user_profile_dir", None):
+        os.environ["AGENTMETRY_USER_PROFILE_DIR"] = args.user_profile_dir
+    if getattr(args, "policy_dir", None):
+        os.environ["AGENTMETRY_POLICY_DIR"] = args.policy_dir
+    if getattr(args, "data_dir", None):
+        os.environ["AGENTMETRY_DATA_DIR"] = args.data_dir
+        # Only when the flag was given: a caller that already pointed these at
+        # a temp tree must not have them recomputed under it.
+        _DATA_DIR = data_dir()
+        _PID_FILE = _DATA_DIR / "agentmetry.pid"
+
+
+def _apply_managed_policy(args: argparse.Namespace) -> None:
+    """Locks over flags and environment, for this process and everything it starts.
+
+    After `_apply_dir_flags`, so `--data-dir` cannot move a trail a fleet
+    locked. Says so when it overrides a flag: a silently ignored flag reads as
+    a bug.
+    """
+    global _DATA_DIR, _PID_FILE
+    from agentmetry.core import managed_policy
+
+    try:
+        policy = managed_policy.apply_locks()
+    except Exception as exc:
+        print(f"Managed policy was not applied: {exc}", file=sys.stderr)
+        return
+    if "data_dir" not in policy.locked:
+        return
+    if getattr(args, "data_dir", None):
+        print("--data-dir ignored: managed policy locks data_dir.", file=sys.stderr)
+    _DATA_DIR = data_dir()
+    _PID_FILE = _DATA_DIR / "agentmetry.pid"
+
+
 def _api_headers() -> dict[str, str]:
     from agentmetry.core.api_token import client_token
 
@@ -551,6 +615,7 @@ def cmd_cloud(args: argparse.Namespace) -> int:
         map_claude_messages,
         map_claude_session,
         map_cursor_agent,
+        map_outbound_poll,
     )
 
     base = (args.url or "").strip() or None
@@ -576,7 +641,9 @@ def cmd_cloud(args: argparse.Namespace) -> int:
         if not api_key:
             print("CURSOR_API_KEY is not set.")
             return 2
-        for agent in fetch_cursor_agents(api_key, base or __import__("agentmetry.core.audit.cloud_bridge", fromlist=["CURSOR_DEFAULT_BASE"]).CURSOR_DEFAULT_BASE):
+        cursor_base = base or __import__("agentmetry.core.audit.cloud_bridge", fromlist=["CURSOR_DEFAULT_BASE"]).CURSOR_DEFAULT_BASE
+        post(map_outbound_poll("cursor_cloud", "GET", f"{cursor_base.rstrip('/')}/v1/agents"))
+        for agent in fetch_cursor_agents(api_key, cursor_base):
             runs = []
             if not args.skip_runs:
                 try:
@@ -594,7 +661,9 @@ def cmd_cloud(args: argparse.Namespace) -> int:
             print("ANTHROPIC_COMPLIANCE_KEY is not set (a Compliance Access Key with read:compliance_user_data, not an admin key).")
             return 2
         kind = "remote" if args.remote else "local"
-        sessions = fetch_claude_sessions(api_key, kind=kind, base=base or "https://api.anthropic.com", limit=args.limit)
+        claude_base = base or "https://api.anthropic.com"
+        post(map_outbound_poll("claude_cloud", "GET", f"{claude_base.rstrip('/')}/v1/compliance/apps/sessions/{kind}"))
+        sessions = fetch_claude_sessions(api_key, kind=kind, base=claude_base, limit=args.limit)
         for session in sessions[: args.limit]:
             post(map_claude_session(session))
             try:
@@ -631,11 +700,12 @@ def _hooks_status() -> int:
     """
     from agentmetry.core.diagnostics import hook_coverage
 
-    if hook_coverage.is_service_profile():
+    if hook_coverage.profile_blind():
         print(
             "UNDETERMINABLE: running under a service profile. Hook configuration "
             "lives in each developer's profile and none is visible from here. "
-            "Run this in the user's context.",
+            "Run this in the user's context, or name the developer's home with "
+            "--user-profile-dir.",
             file=sys.stderr,
         )
         return 2
@@ -663,6 +733,21 @@ def cmd_hooks(args: argparse.Namespace) -> int:
     from agentmetry.core.audit import hook_bootstrap
     from agentmetry.core.diagnostics import hook_coverage
 
+    if args.action == "install":
+        # Before --managed too: a managed install would put the temporary path
+        # into machine-wide policy files.
+        reason = hook_bootstrap.ephemeral_environment()
+        if reason:
+            print(
+                f"Not installing hooks: {reason}. That cache can be deleted at any "
+                "time, and every hook would then fail (most agents silently stop "
+                "recording; Copilot CLI blocks every tool call). Install Agentmetry "
+                "somewhere that stays, then run this again:\n"
+                "  uv tool install agentmetry   (or: pipx install agentmetry, or: pip install agentmetry)\n"
+                "  agentmetry hooks install",
+                file=sys.stderr,
+            )
+            return 1
     if getattr(args, "managed", False):
         return _hooks_managed(args)
     if args.action == "status":
@@ -1394,10 +1479,10 @@ def cmd_demo(args: argparse.Namespace) -> int:
 def cmd_doctor(args: argparse.Namespace) -> int:
     """SIEM preflight: manifests, trail chain, orchestrator health, hooks."""
     sys.path.insert(0, str(_ORCH_ROOT))
-    from agentmetry.core.diagnostics.doctor import format_report, run_doctor
+    from agentmetry.core.diagnostics.doctor import print_report, run_doctor
 
     report = run_doctor(fix_drivers=getattr(args, "fix", False))
-    print("Agentmetry doctor\n" + format_report(report))
+    print_report(report, as_json=getattr(args, "json", False))
     return report.exit_code
 
 
@@ -1431,6 +1516,7 @@ def main(argv: list[str] | None = None) -> int:
         prog="agentmetry",
         description="Agentmetry local ops. New here? Start with `agentmetry demo`.",
     )
+    _add_dir_flags(parser)
     parser.add_argument("--port", type=int, default=8000)
     sub = parser.add_subparsers(dest="command", required=True)
     # First, so it heads the help: it is the one command that needs nothing set up.
@@ -1445,6 +1531,7 @@ def main(argv: list[str] | None = None) -> int:
 
     sub.add_parser("stop", help="stop the orchestrator")
     start = sub.add_parser("start", help="start the orchestrator (detached)")
+    _add_dir_flags(start)
     start.add_argument(
         "--host",
         default="127.0.0.1",
@@ -1454,12 +1541,14 @@ def main(argv: list[str] | None = None) -> int:
         "serve",
         help="run the orchestrator in the foreground (what autostart registers)",
     )
+    _add_dir_flags(serve)
     serve.add_argument("--host", default="127.0.0.1")
     serve.add_argument("--port", type=int, default=8000)
     hooks = sub.add_parser(
         "hooks",
         help="install IDE hook configs for the agents on this machine",
     )
+    _add_dir_flags(hooks)
     hooks.add_argument(
         "action",
         choices=("install", "status"),
@@ -1661,6 +1750,13 @@ def main(argv: list[str] | None = None) -> int:
     doctor = sub.add_parser(
         "doctor", help="SIEM preflight (manifests, trail chain, health, hooks)"
     )
+    _add_dir_flags(doctor)
+    doctor.add_argument(
+        "--json",
+        action="store_true",
+        help="the report as JSON, for a deployment script: exit_code, "
+        "orchestrator_reachable, hooks, policy and findings",
+    )
     doctor.add_argument(
         "--fix",
         action="store_true",
@@ -1688,6 +1784,8 @@ def main(argv: list[str] | None = None) -> int:
     replay.add_argument("--trail", default="", help="trail to read (default: the configured trail)")
 
     args = parser.parse_args(argv)
+    _apply_dir_flags(args)
+    _apply_managed_policy(args)
     handlers = {
         "demo": cmd_demo,
         "start": cmd_start,

agentmetry-0.9.9/agentmetry/core/audit/antigravity_trajectory.py

@@ -0,0 +1,81 @@
+"""Read tool calls out of an Antigravity conversation database.
+
+The installed hook only matches `run_command`, so file reads, writes, search
+and the other tools never reach the trail. The conversation database stores
+every step. The payload is a protobuf blob. The tool name is a length-prefixed
+ASCII field and the arguments are the JSON object that follows it. That framing
+was read off a real database on 2026-10-16. A blob that does not match it
+yields nothing.
+"""
+
+from __future__ import annotations
+
+import json
+import sqlite3
+from pathlib import Path
+from typing import Any, Iterator
+
+
+def _varint(buf: bytes, index: int) -> tuple[int, int]:
+    value = 0
+    shift = 0
+    while index < len(buf) and shift <= 28:
+        byte = buf[index]
+        index += 1
+        value |= (byte & 0x7F) << shift
+        if not byte & 0x80:
+            return value, index
+        shift += 7
+    raise ValueError("truncated varint")
+
+
+def iter_tool_calls(payload: bytes) -> Iterator[tuple[str, dict[str, Any]]]:
+    """Yield (tool name, arguments) from one step payload."""
+    index = 0
+    while True:
+        marker = payload.find(b"\x12", index)
+        if marker < 0 or marker + 2 >= len(payload):
+            return
+        name_len = payload[marker + 1]
+        if name_len == 0 or name_len > 64 or name_len & 0x80:
+            index = marker + 1
+            continue
+        name_at = marker + 2
+        name_end = name_at + name_len
+        if name_end >= len(payload) or payload[name_end] != 0x1A:
+            index = marker + 1
+            continue
+        name = payload[name_at:name_end]
+        if not name.isascii() or not all(chr(c).isalnum() or c == ord("_") for c in name):
+            index = marker + 1
+            continue
+        try:
+            json_len, json_at = _varint(payload, name_end + 1)
+        except ValueError:
+            index = marker + 1
+            continue
+        blob = payload[json_at : json_at + json_len]
+        if not blob.startswith(b"{"):
+            index = marker + 1
+            continue
+        try:
+            args = json.loads(blob)
+        except json.JSONDecodeError:
+            index = marker + 1
+            continue
+        if isinstance(args, dict):
+            yield name.decode("ascii"), args
+        index = json_at + max(json_len, 1)
+
+
+def tool_names(db_path: Path) -> dict[str, int]:
+    """Count tool names in one conversation database. Arguments are not returned."""
+    counts: dict[str, int] = {}
+    uri = f"file:{Path(db_path).as_posix()}?mode=ro"
+    with sqlite3.connect(uri, uri=True) as con:
+        for (payload,) in con.execute("SELECT step_payload FROM steps"):
+            if not isinstance(payload, (bytes, bytearray)):
+                continue
+            for name, _args in iter_tool_calls(payload):
+                counts[name] = counts.get(name, 0) + 1
+    return counts

{agentmetry-0.9.7 → agentmetry-0.9.9}/agentmetry/core/audit/cloud_bridge.py

@@ -26,6 +26,7 @@ from __future__ import annotations
 import hashlib
 import json
 from typing import Any
+from urllib.parse import urlsplit
 
 REDACT_KEYS = frozenset(
     {"authorization", "api_key", "apikey", "password", "secret", "token", "session_key"}
@@ -110,6 +111,29 @@ def tool_summary(args: Any) -> dict[str, Any]:
     return summary
 
 
+def map_outbound_poll(source_app: str, method: str, url: str) -> dict[str, Any]:
+    """The request this machine sends. The key is not in the payload.
+
+    Query strings are dropped: a token does not belong in the trail. The path
+    and host are the trace of the send.
+    """
+    parts = urlsplit(url)
+    target = f"{method} {parts.netloc}{parts.path}"
+    return {
+        "source_app": source_app,
+        "adapter": "cloud_bridge",
+        "event_type": "tool_called",
+        "outcome": "success",
+        "correlation_id": f"{source_app}-outbound",
+        "reason": "outbound poll; key sent and not stored",
+        "tool": {
+            "qualified": f"{source_app}.poll",
+            "server": source_app,
+            "command": target,
+        },
+    }
+
+
 # --- Cursor Cloud Agents API -------------------------------------------------
 
 CURSOR_DEFAULT_BASE = "https://api.cursor.com"

agentmetry-0.9.9/agentmetry/core/audit/detection/corpus/benign_container_registry_publish.jsonl

@@ -0,0 +1,3 @@
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-registry-publish","event_id":"7a7001f1-6c5b-51ab-92e7-8a72c8f6c001","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-registry-publish","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T10:00:00+00:00","tool":{"arguments":{"command":"docker login registry.example.com --username ci-bot --password-stdin"},"command":"docker login registry.example.com --username ci-bot --password-stdin","input_hash":"1f3b6a8a28dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d01","input_redaction":"hash+command","mitre":{"tactic":"Command and Control","tactic_id":"TA0011","technique":"Web Protocols","technique_id":"T1071.001"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude","traits":["net_egress"]}}
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-registry-publish","event_id":"7a7001f1-6c5b-51ab-92e7-8a72c8f6c002","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-registry-publish","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T10:00:30+00:00","tool":{"arguments":{"command":"docker build -t registry.example.com/team/service:build-42 ."},"command":"docker build -t registry.example.com/team/service:build-42 .","input_hash":"2a4c6d8e28dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d02","input_redaction":"hash+command","mitre":{"tactic":"Execution","tactic_id":"TA0002","technique":"Unix Shell","technique_id":"T1059.004"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude"}}
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-registry-publish","event_id":"7a7001f1-6c5b-51ab-92e7-8a72c8f6c003","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-registry-publish","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T10:01:20+00:00","tool":{"arguments":{"command":"docker push registry.example.com/team/service:build-42"},"command":"docker push registry.example.com/team/service:build-42","input_hash":"3b5d7e9f28dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d03","input_redaction":"hash+command","mitre":{"tactic":"Command and Control","tactic_id":"TA0011","technique":"Web Protocols","technique_id":"T1071.001"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude","traits":["net_egress"]}}

agentmetry-0.9.9/agentmetry/core/audit/detection/corpus/benign_dependency_audit_network_burst.jsonl

@@ -0,0 +1,4 @@
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-dependency-audit","event_id":"9c7001f1-6c5b-51ab-92e7-8a72c8f6e001","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-dependency-audit","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T12:00:00+00:00","tool":{"arguments":{"command":"npm audit --json > reports/npm-audit.json"},"command":"npm audit --json > reports/npm-audit.json","input_hash":"8091234428dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d08","input_redaction":"hash+command","mitre":{"tactic":"Execution","tactic_id":"TA0002","technique":"Unix Shell","technique_id":"T1059.004"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude"}}
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-dependency-audit","event_id":"9c7001f1-6c5b-51ab-92e7-8a72c8f6e002","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-dependency-audit","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T12:00:20+00:00","tool":{"arguments":{"command":"pip-audit -r requirements.txt -f json -o reports/pip-audit.json"},"command":"pip-audit -r requirements.txt -f json -o reports/pip-audit.json","input_hash":"91a2345528dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d09","input_redaction":"hash+command","mitre":{"tactic":"Execution","tactic_id":"TA0002","technique":"Unix Shell","technique_id":"T1059.004"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude"}}
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-dependency-audit","event_id":"9c7001f1-6c5b-51ab-92e7-8a72c8f6e003","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-dependency-audit","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T12:00:40+00:00","tool":{"arguments":{"command":"curl -s https://registry.npmjs.org/-/npm/v1/security/advisories?limit=20 > reports/npm-advisories.json"},"command":"curl -s https://registry.npmjs.org/-/npm/v1/security/advisories?limit=20 > reports/npm-advisories.json","input_hash":"a2b3456628dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d10","input_redaction":"hash+command","mitre":{"tactic":"Command and Control","tactic_id":"TA0011","technique":"Web Protocols","technique_id":"T1071.001"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude","traits":["net_egress"]}}
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-dependency-audit","event_id":"9c7001f1-6c5b-51ab-92e7-8a72c8f6e004","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-dependency-audit","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T12:01:20+00:00","tool":{"arguments":{"command":"python scripts/summarise_audit.py reports/npm-audit.json reports/pip-audit.json reports/npm-advisories.json"},"command":"python scripts/summarise_audit.py reports/npm-audit.json reports/pip-audit.json reports/npm-advisories.json","input_hash":"b3c4567728dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d11","input_redaction":"hash+command","mitre":{"tactic":"Execution","tactic_id":"TA0002","technique":"Unix Shell","technique_id":"T1059.004"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude"}}

agentmetry-0.9.9/agentmetry/core/audit/detection/corpus/benign_terraform_apply_with_profile.jsonl

@@ -0,0 +1,4 @@
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-terraform-apply","event_id":"8b7001f1-6c5b-51ab-92e7-8a72c8f6d001","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-terraform-apply","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T11:00:00+00:00","tool":{"arguments":{"command":"terraform init -backend-config=env/staging.backend"},"command":"terraform init -backend-config=env/staging.backend","input_hash":"4c6e8f1028dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d04","input_redaction":"hash+command","mitre":{"tactic":"Execution","tactic_id":"TA0002","technique":"Unix Shell","technique_id":"T1059.004"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude"}}
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-terraform-apply","event_id":"8b7001f1-6c5b-51ab-92e7-8a72c8f6d002","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-terraform-apply","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T11:02:00+00:00","tool":{"arguments":{"command":"terraform plan -var-file env/staging.tfvars -out tfplan"},"command":"terraform plan -var-file env/staging.tfvars -out tfplan","input_hash":"5d7f901128dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d05","input_redaction":"hash+command","mitre":{"tactic":"Execution","tactic_id":"TA0002","technique":"Unix Shell","technique_id":"T1059.004"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude"}}
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-terraform-apply","event_id":"8b7001f1-6c5b-51ab-92e7-8a72c8f6d003","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-terraform-apply","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T11:04:00+00:00","tool":{"arguments":{"command":"AWS_PROFILE=staging terraform apply -auto-approve tfplan"},"command":"AWS_PROFILE=staging terraform apply -auto-approve tfplan","input_hash":"6e80912228dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d06","input_redaction":"hash+command","mitre":{"tactic":"Execution","tactic_id":"TA0002","technique":"Unix Shell","technique_id":"T1059.004"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude"}}
+{"action":{"outcome":"success","reason":"decision:allow;hook:PreToolUse","type":"tool_called"},"actor":{"id":"operator","role":"operator","type":"agent"},"agent":{"name":"claude","skill_id":""},"correlation_id":"b-terraform-apply","event_id":"8b7001f1-6c5b-51ab-92e7-8a72c8f6d004","fleet_id":"example-fleet","host_id":"BUILD-01","initiator":{"actor_type":"agent","operator_id":"operator","trigger":"manual"},"model":{"id":"claude","provider":"claude"},"schema_version":"1.1.0","session_id":"b-terraform-apply","source":{"adapter":"claude_hook","app":"claude","tier":"external"},"source_topic":"external/claude/tool_called","timestamp_utc":"2026-08-12T11:06:00+00:00","tool":{"arguments":{"command":"aws sts get-caller-identity --profile staging"},"command":"aws sts get-caller-identity --profile staging","input_hash":"7f90123328dd96c5d2e9b8a6a722f78c87b80ac3e4d2cc9d7f5d3a44a9148d07","input_redaction":"hash+command","mitre":{"tactic":"Execution","tactic_id":"TA0002","technique":"Unix Shell","technique_id":"T1059.004"},"name":"Bash","parameters_redacted":false,"qualified":"Bash","server":"claude","traits":["cloud_api"]}}

{agentmetry-0.9.7 → agentmetry-0.9.9}/agentmetry/core/audit/detection/corpus/corpus.yaml

@@ -419,6 +419,34 @@ cases:
       Thirty read-only calls spread over half an hour. Burst rules measure a
       time window; a long session must not trip them by length alone.
 
+  - name: container registry publish
+    session: benign_container_registry_publish.jsonl
+    expect: []
+    benign: true
+    note: >
+      `docker login`, `docker build` and `docker push` against a registry. This
+      looks like authenticated egress, but no credential is read from disk or
+      the environment; the password arrives through stdin and never belongs in
+      the trail.
+
+  - name: terraform apply with a named profile
+    session: benign_terraform_apply_with_profile.jsonl
+    expect: []
+    benign: true
+    note: >
+      Infrastructure automation touches cloud state and later calls `aws sts`,
+      but it uses a named profile rather than reading credentials. Cloud API use
+      by itself is not lateral movement after credential harvest.
+
+  - name: dependency audit touches remote advisories
+    session: benign_dependency_audit_network_burst.jsonl
+    expect: []
+    benign: true
+    note: >
+      Package audits query registries and advisory feeds in quick succession,
+      then run a local summariser. A short network-heavy audit is not a session
+      tool burst, a download cradle or credential exfiltration.
+
   - name: human-driven deletes currently fire
     session: benign_human_driven_deletes.jsonl
     expect: [destructive-delete-burst]

{agentmetry-0.9.7 → agentmetry-0.9.9}/agentmetry/core/audit/external.py

@@ -21,13 +21,13 @@ from agentmetry.core.config import settings
 ExternalApp = Literal[
     "cursor", "claude", "antigravity", "codex", "mcp_proxy",
     "qwen", "kimi", "qoder", "codebuddy", "trae", "crewai", "opensre", "copilot", "zcode",
-    "cursor_cloud", "claude_cloud", "grok_build", "agentmetry",
+    "cursor_cloud", "claude_cloud", "grok_build", "grok_bot", "agentmetry",
 ]
 
 KNOWN_EXTERNAL_APPS = frozenset({
     "cursor", "claude", "antigravity", "codex", "mcp_proxy",
     "qwen", "kimi", "qoder", "codebuddy", "trae", "crewai", "opensre", "copilot", "zcode",
-    "cursor_cloud", "claude_cloud", "grok_build",
+    "cursor_cloud", "claude_cloud", "grok_build", "grok_bot",
 })
 
 _ACTION_MAP = {
@@ -38,8 +38,20 @@ _ACTION_MAP = {
     "tool_failed": ("tool_called", "error"),
     "approval_request": ("approval_request", "pending"),
     "approval_response": ("approval_response", "success"),
+    # A deployment tool (an Intune remediation, a LaunchAgent) reinstalled
+    # hooks. That changes this machine's configuration; it is not a tool call.
+    # Unmapped it was stored as `tool_called`, which tool-sequence rules count.
+    "hook_remediation": ("config_change", "success"),
 }
 
+#: The only payload fields a remediation notice keeps. Anything session- or
+#: tool-shaped a client attached is dropped: it would join the notice to an
+#: agent's session, or give a detection a tool to read.
+_REMEDIATION_FIELDS = frozenset({
+    "event_type", "source_app", "outcome", "reason", "timestamp_utc", "adapter",
+    "triggered_by", "initiator", "operator",
+})
+
 
 def _utc_now() -> str:
     return datetime.now(timezone.utc).isoformat()
@@ -82,8 +94,14 @@ def build_external_canonical(payload: dict[str, Any]) -> dict[str, Any]:
     source_app, claimed_app = _resolve_source_app(payload.get("source_app"))
 
     event_type = str(payload.get("event_type") or "tool_called")
+    if event_type == "hook_remediation":
+        payload = {k: v for k, v in payload.items() if k in _REMEDIATION_FIELDS}
     action_type, default_outcome = _ACTION_MAP.get(event_type, ("tool_called", "success"))
     outcome = str(payload.get("outcome") or default_outcome)
+    if event_type == "hook_remediation" and outcome not in ("success", "error"):
+        # Anything else is not a confirmed success, and a fleet alerting on
+        # failed remediations must not have one hidden by a spelling.
+        outcome = "error"
     reason = str(payload.get("reason") or "")
 
     correlation_id = str(payload.get("correlation_id") or payload.get("thread_id") or "")