agentwit 0.4.0__tar.gz → 0.5.0__tar.gz

{agentwit-0.4.0 → agentwit-0.5.0}/.github/workflows/mcp_spec_watch.yml

@@ -1,5 +1,8 @@
 name: MCP Spec Watch
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 on:
   schedule:
     - cron: "0 0 1 * *"

{agentwit-0.4.0 → agentwit-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentwit
-Version: 0.4.0
+Version: 0.5.0
 Summary: Transparent proxy witness for AI agent ↔ MCP server communications
 Project-URL: Homepage, https://github.com/tokotokokame/agentwit
 Project-URL: Repository, https://github.com/tokotokokame/agentwit
@@ -23,6 +23,7 @@ Classifier: Topic :: System :: Logging
 Requires-Python: >=3.10
 Requires-Dist: anyio>=4.3.0
 Requires-Dist: click>=8.1.0
+Requires-Dist: cryptography>=41.0.0
 Requires-Dist: fastapi>=0.111.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: uvicorn[standard]>=0.29.0

{agentwit-0.4.0 → agentwit-0.5.0}/agentwit/cli.py

@@ -91,7 +91,13 @@ def proxy(
     logger = WitnessLogger(session_dir=log_dir, actor=actor)
     click.echo(f"Session: {logger.session_path}")
 
-    app = create_proxy_app(target_url=target, witness_logger=logger, actor=actor)
+    app = create_proxy_app(
+        target_url=target,
+        witness_logger=logger,
+        actor=actor,
+        webhook_url=webhook,
+        webhook_on=webhook_on,
+    )
 
     try:
         uvicorn.run(app, host=host, port=port)
@@ -99,6 +105,81 @@ def proxy(
         logger.close()
 
 
+# ---------------------------------------------------------------------------
+# verify
+# ---------------------------------------------------------------------------
+
+@main.command()
+@click.option(
+    "--session",
+    required=True,
+    type=click.Path(exists=True),
+    help="Session directory containing witness.jsonl",
+)
+def verify(session: str) -> None:
+    """Verify SHA-256 chain integrity and ed25519 signatures for a session.
+
+    Example:
+
+        agentwit verify --session ./witness_logs/session_20240101_120000
+    """
+    from .witness.chain import ChainManager
+    from .security.signing import EventSigner
+
+    session_path = Path(session)
+    log_path = session_path / "witness.jsonl"
+
+    if not log_path.exists():
+        click.echo(f"No witness.jsonl found in {session_path}", err=True)
+        sys.exit(1)
+
+    events: list[dict] = []
+    with log_path.open("r", encoding="utf-8") as fh:
+        for line in fh:
+            line = line.strip()
+            if line:
+                events.append(json.loads(line))
+
+    if not events:
+        click.echo("No events found.")
+        return
+
+    chain = ChainManager(session_id=session_path.name)
+    chain_results = chain.verify_chain(events)
+
+    signer = EventSigner()
+
+    click.echo(f"Session: {session_path.name}  ({len(events)} events)")
+    click.echo(f"Key fingerprint: {signer.fingerprint()}")
+    click.echo("")
+    click.echo(f"{'#':>4}  chain   sig     witness_id")
+    click.echo("-" * 72)
+
+    all_valid = True
+    for idx, (event, cr) in enumerate(zip(events, chain_results)):
+        chain_ok = cr["valid"]
+
+        sig = event.get("signature", "")
+        event_without_sig = {k: v for k, v in event.items()
+                             if k not in ("signature", "signed_by")}
+        sig_ok = signer.verify(event_without_sig, sig) if sig else False
+
+        if not chain_ok or not sig_ok:
+            all_valid = False
+
+        chain_str = click.style("OK  ", fg="green") if chain_ok else click.style("FAIL", fg="red", bold=True)
+        sig_str = click.style("OK  ", fg="green") if sig_ok else click.style("FAIL", fg="red", bold=True)
+        witness_id = event.get("witness_id", "?")
+        click.echo(f"{idx:>4}  {chain_str}  {sig_str}  {witness_id}")
+
+    click.echo("")
+    if all_valid:
+        click.echo(click.style("Result: ALL VALID", fg="green", bold=True))
+    else:
+        click.echo(click.style("Result: INTEGRITY ERROR DETECTED", fg="red", bold=True))
+        sys.exit(1)
+
+
 # ---------------------------------------------------------------------------
 # report
 # ---------------------------------------------------------------------------

agentwit-0.5.0/agentwit/monitor/backup.py

@@ -0,0 +1,31 @@
+import shutil, hashlib, json
+from pathlib import Path
+from datetime import datetime
+
+BACKUP_DIR  = Path.home() / ".agentwit" / "backups"
+MAX_BACKUPS = 30
+
+class SessionBackup:
+    def backup(self, session_dir: Path) -> Path:
+        BACKUP_DIR.mkdir(parents=True, exist_ok=True)
+        timestamp = datetime.utcnow().strftime("%Y%m%d_%H%M%S")
+        dest = BACKUP_DIR / f"{session_dir.name}_{timestamp}"
+        shutil.copytree(session_dir, dest)
+        # 整合性ハッシュを記録
+        self._write_hash(dest)
+        # 古いバックアップを削除
+        self._rotate()
+        return dest
+
+    def _write_hash(self, backup_dir: Path):
+        hashes = {}
+        for f in backup_dir.rglob("*.jsonl"):
+            hashes[f.name] = hashlib.sha256(f.read_bytes()).hexdigest()
+        (backup_dir / "backup_hash.json").write_text(
+            json.dumps(hashes, indent=2)
+        )
+
+    def _rotate(self):
+        backups = sorted(BACKUP_DIR.iterdir(), key=lambda p: p.stat().st_mtime)
+        while len(backups) > MAX_BACKUPS:
+            shutil.rmtree(backups.pop(0))

{agentwit-0.4.0 → agentwit-0.5.0}/agentwit/monitor/cost_guard.py

@@ -1,7 +1,9 @@
 """Cost and rate-limit guard for MCP sessions."""
 from __future__ import annotations
 
+from collections import deque
 from dataclasses import dataclass, field
+from datetime import datetime, timedelta
 from typing import Any
 
 
@@ -81,3 +83,38 @@ class CostGuard:
             })
 
         return alerts
+
+
+class AnomalyDetector:
+    def __init__(self):
+        self._call_times: deque = deque(maxlen=100)
+        self._tool_counts: dict = {}
+
+    def record_call(self, tool_name: str):
+        self._call_times.append(datetime.utcnow())
+        self._tool_counts[tool_name] = self._tool_counts.get(tool_name, 0) + 1
+
+    def check_anomalies(self) -> list:
+        alerts = []
+        now = datetime.utcnow()
+
+        # 直近1分間の呼び出し数
+        recent = [t for t in self._call_times
+                  if now - t < timedelta(minutes=1)]
+        if len(recent) > 30:
+            alerts.append({
+                "type":      "call_rate_anomaly",
+                "severity":  "HIGH",
+                "calls_per_minute": len(recent)
+            })
+
+        # 同一ツールへの連続呼び出し
+        for tool, count in self._tool_counts.items():
+            if count > 10:
+                alerts.append({
+                    "type":     "repeated_tool_call",
+                    "severity": "MEDIUM",
+                    "tool":     tool,
+                    "count":    count
+                })
+        return alerts

{agentwit-0.4.0 → agentwit-0.5.0}/agentwit/proxy/http_proxy.py

@@ -6,20 +6,32 @@ to the caller without buffering.
 """
 from __future__ import annotations
 
+import asyncio
 import json
+import logging
+from datetime import datetime, timezone
+from pathlib import Path
 from typing import AsyncIterator
 
 import httpx
 from fastapi import FastAPI, Request, Response
 from fastapi.responses import StreamingResponse
 
+from ..security.bypass_detector import BypassDetector
+from ..monitor.backup import SessionBackup
 from ..witness.log import WitnessLogger
 
+logger = logging.getLogger(__name__)
+
+_AUDIT_PATH = Path.home() / ".agentwit" / "audit.jsonl"
+
 
 def create_proxy_app(
     target_url: str,
     witness_logger: WitnessLogger,
     actor: str = "proxy",
+    webhook_url: str | None = None,
+    webhook_on: str = "HIGH,CRITICAL",
 ) -> FastAPI:
     """Create and return a FastAPI app that transparently proxies to *target_url*.
 
@@ -36,6 +48,7 @@ def create_proxy_app(
     """
     app = FastAPI(title="agentwit proxy", version="0.1.0")
     target = target_url.rstrip("/")
+    bypass_detector = BypassDetector()
 
     # Shared async HTTP client (created at startup, closed at shutdown).
     client: httpx.AsyncClient
@@ -48,6 +61,11 @@ def create_proxy_app(
     @app.on_event("shutdown")
     async def _shutdown() -> None:
         await client.aclose()
+        # セッション終了時に自動バックアップ
+        try:
+            SessionBackup().backup(witness_logger.session_path)
+        except Exception as exc:
+            logger.warning("agentwit session backup failed: %s", exc)
 
     # ------------------------------------------------------------------
     # Single catch-all route
@@ -58,10 +76,32 @@ def create_proxy_app(
         """Forward any request to the upstream server and record the exchange."""
         upstream_url = f"/{path}"
 
+        # バイパス検知: 受信リクエストにプロキシヘッダーがなければ記録
+        bypass_alert = bypass_detector.check_request(dict(request.headers))
+        if bypass_alert:
+            _AUDIT_PATH.parent.mkdir(parents=True, exist_ok=True)
+            with _AUDIT_PATH.open("a", encoding="utf-8") as _af:
+                _af.write(json.dumps({
+                    **bypass_alert,
+                    "timestamp": datetime.now(timezone.utc).isoformat(),
+                    "path": f"/{path}",
+                }) + "\n")
+            if webhook_url:
+                from ..notifier.webhook import WebhookNotifier
+                _notifier = WebhookNotifier(url=webhook_url, min_severity="high")
+                asyncio.ensure_future(_notifier.notify_if_threshold(
+                    {"actor": actor, "tool": None,
+                     "session_id": witness_logger.session_id,
+                     "timestamp": datetime.now(timezone.utc).isoformat()},
+                    [{"pattern": "proxy_bypass", "severity": "high", **bypass_alert}],
+                ))
+
         # Build forwarded headers (drop host so httpx sets it correctly).
         forward_headers = {
             k: v for k, v in request.headers.items() if k.lower() != "host"
         }
+        # リクエスト転送時にプロキシヘッダーを付与
+        bypass_detector.inject_header(forward_headers)
 
         body = await request.body()
 

agentwit-0.5.0/agentwit/security/bypass_detector.py

@@ -0,0 +1,21 @@
+class BypassDetector:
+    PROXY_HEADER = "X-Agentwit-Proxy"
+    PROXY_VALUE  = "1"
+
+    def inject_header(self, headers: dict) -> dict:
+        """プロキシがリクエストに付与するヘッダー"""
+        headers[self.PROXY_HEADER] = self.PROXY_VALUE
+        return headers
+
+    def check_request(self, headers: dict) -> dict | None:
+        """
+        プロキシヘッダーがない場合はバイパスの可能性を返す。
+        正常時はNone、バイパス疑いは dict を返す。
+        """
+        if self.PROXY_HEADER not in headers:
+            return {
+                "type":     "proxy_bypass_detected",
+                "severity": "HIGH",
+                "detail":   "Request missing X-Agentwit-Proxy header"
+            }
+        return None

agentwit-0.5.0/agentwit/security/signing.py

@@ -0,0 +1,63 @@
+from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+    Ed25519PrivateKey, Ed25519PublicKey
+)
+from cryptography.hazmat.primitives import serialization
+from pathlib import Path
+import base64, json
+
+KEY_DIR = Path.home() / ".agentwit"
+PRIVATE_KEY_PATH = KEY_DIR / "signing_key.pem"
+PUBLIC_KEY_PATH  = KEY_DIR / "signing_pub.pem"
+
+class EventSigner:
+    def __init__(self):
+        KEY_DIR.mkdir(exist_ok=True)
+        if not PRIVATE_KEY_PATH.exists():
+            self._generate_keypair()
+        self._private_key = self._load_private_key()
+        self._public_key  = self._private_key.public_key()
+
+    def _generate_keypair(self):
+        key = Ed25519PrivateKey.generate()
+        # 秘密鍵保存
+        with open(PRIVATE_KEY_PATH, "wb") as f:
+            f.write(key.private_bytes(
+                serialization.Encoding.PEM,
+                serialization.PrivateFormat.PKCS8,
+                serialization.NoEncryption()
+            ))
+        PRIVATE_KEY_PATH.chmod(0o600)
+        # 公開鍵保存
+        with open(PUBLIC_KEY_PATH, "wb") as f:
+            f.write(key.public_key().public_bytes(
+                serialization.Encoding.PEM,
+                serialization.PublicFormat.SubjectPublicKeyInfo
+            ))
+
+    def _load_private_key(self) -> Ed25519PrivateKey:
+        with open(PRIVATE_KEY_PATH, "rb") as f:
+            return serialization.load_pem_private_key(f.read(), password=None)
+
+    def sign(self, event: dict) -> str:
+        """イベントをJSON化して署名。base64文字列を返す"""
+        data = json.dumps(event, sort_keys=True, ensure_ascii=False).encode()
+        sig  = self._private_key.sign(data)
+        return base64.b64encode(sig).decode()
+
+    def verify(self, event: dict, signature: str) -> bool:
+        """署名を検証。Trueなら正常"""
+        try:
+            data = json.dumps(event, sort_keys=True, ensure_ascii=False).encode()
+            self._public_key.verify(base64.b64decode(signature), data)
+            return True
+        except Exception:
+            return False
+
+    def fingerprint(self) -> str:
+        """公開鍵のfingerprint（先頭16文字）"""
+        pub = self._public_key.public_bytes(
+            serialization.Encoding.Raw,
+            serialization.PublicFormat.Raw
+        )
+        import hashlib
+        return hashlib.sha256(pub).hexdigest()[:16]

{agentwit-0.4.0 → agentwit-0.5.0}/agentwit/witness/chain.py

@@ -49,7 +49,8 @@ class ChainManager:
             A new dict with ``witness_id`` and ``session_chain`` added.
         """
         # Strip any previously-set chain fields to get a clean base.
-        base = {k: v for k, v in event_data.items() if k not in ("witness_id", "session_chain")}
+        base = {k: v for k, v in event_data.items()
+                if k not in ("witness_id", "session_chain", "signature", "signed_by")}
 
         # Compute chain hash from canonical JSON of the base event.
         event_hash = self._compute_event_hash(base)
@@ -91,7 +92,8 @@ class ChainManager:
             session_chain = event.get("session_chain", "")
 
             # Re-derive the base event (strip chain fields) to recompute hashes.
-            base = {k: v for k, v in event.items() if k not in ("witness_id", "session_chain")}
+            base = {k: v for k, v in event.items()
+                    if k not in ("witness_id", "session_chain", "signature", "signed_by")}
             event_hash = self._compute_event_hash(base)
             expected_chain = self._compute_chain_hash(expected_prev, event_hash)
 

{agentwit-0.4.0 → agentwit-0.5.0}/agentwit/witness/log.py

@@ -12,6 +12,7 @@ from pathlib import Path
 from typing import Any
 
 from .chain import ChainManager
+from ..security.signing import EventSigner
 
 
 def _sha256(data: Any) -> str:
@@ -54,6 +55,7 @@ class WitnessLogger:
 
         self.actor = actor
         self.chain = ChainManager(session_id=self.session_id)
+        self._signer = EventSigner()
 
         log_path = self.session_path / "witness.jsonl"
         self._log_file = log_path.open("a", encoding="utf-8")
@@ -84,6 +86,8 @@ class WitnessLogger:
         """
         event = self._build_event(action, tool, full_payload, risk_indicators or [])
         signed = self.chain.sign(event)
+        signed["signature"] = self._signer.sign(signed)
+        signed["signed_by"] = self._signer.fingerprint()
         self._append(signed)
         return signed
 

agentwit-0.5.0/gui/.claude/settings.local.json

@@ -0,0 +1,15 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(which tauri:*)",
+      "Bash(cargo:*)",
+      "Bash(npx tsc:*)",
+      "Bash(npm run:*)",
+      "Bash(npx tauri:*)",
+      "Bash(python3:*)",
+      "Bash(python:*)",
+      "Bash(timeout 30 pytest tests/test_webhook.py -v --tb=long 2>&1)",
+      "Bash(timeout 10 pytest tests/test_webhook.py -q 2>&1)"
+    ]
+  }
+}

{agentwit-0.4.0 → agentwit-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentwit"
-version = "0.4.0"
+version = "0.5.0"
 description = "Transparent proxy witness for AI agent ↔ MCP server communications"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -29,6 +29,7 @@ dependencies = [
     "httpx>=0.27.0",
     "click>=8.1.0",
     "anyio>=4.3.0",
+    "cryptography>=41.0.0",
 ]
 
 [project.scripts]

agentwit-0.5.0/tests/test_anomaly_detector.py

@@ -0,0 +1,93 @@
+"""Tests for AnomalyDetector: call rate and repeated tool call detection."""
+import pytest
+from datetime import datetime, timedelta
+from unittest.mock import patch
+from agentwit.monitor.cost_guard import AnomalyDetector
+
+
+@pytest.fixture()
+def detector():
+    return AnomalyDetector()
+
+
+def test_no_alerts_for_normal_usage(detector):
+    for _ in range(5):
+        detector.record_call("read_file")
+    alerts = detector.check_anomalies()
+    assert alerts == []
+
+
+def test_call_rate_anomaly_over_30_per_minute(detector):
+    now = datetime.utcnow()
+    # 31 calls within the last minute
+    for i in range(31):
+        detector._call_times.append(now - timedelta(seconds=i))
+    alerts = detector.check_anomalies()
+    rate_alerts = [a for a in alerts if a["type"] == "call_rate_anomaly"]
+    assert len(rate_alerts) == 1
+    assert rate_alerts[0]["severity"] == "HIGH"
+    assert rate_alerts[0]["calls_per_minute"] == 31
+
+
+def test_call_rate_exactly_30_no_alert(detector):
+    now = datetime.utcnow()
+    for i in range(30):
+        detector._call_times.append(now - timedelta(seconds=i))
+    alerts = detector.check_anomalies()
+    rate_alerts = [a for a in alerts if a["type"] == "call_rate_anomaly"]
+    assert len(rate_alerts) == 0
+
+
+def test_old_calls_not_counted_in_rate(detector):
+    now = datetime.utcnow()
+    # 31 calls but older than 1 minute
+    for i in range(31):
+        detector._call_times.append(now - timedelta(minutes=2, seconds=i))
+    alerts = detector.check_anomalies()
+    rate_alerts = [a for a in alerts if a["type"] == "call_rate_anomaly"]
+    assert len(rate_alerts) == 0
+
+
+def test_repeated_tool_call_over_10(detector):
+    for _ in range(11):
+        detector.record_call("bash")
+    alerts = detector.check_anomalies()
+    repeated = [a for a in alerts if a["type"] == "repeated_tool_call"]
+    assert len(repeated) == 1
+    assert repeated[0]["severity"] == "MEDIUM"
+    assert repeated[0]["tool"] == "bash"
+    assert repeated[0]["count"] == 11
+
+
+def test_repeated_tool_call_exactly_10_no_alert(detector):
+    for _ in range(10):
+        detector.record_call("bash")
+    alerts = detector.check_anomalies()
+    repeated = [a for a in alerts if a["type"] == "repeated_tool_call"]
+    assert len(repeated) == 0
+
+
+def test_multiple_tools_repeated(detector):
+    for _ in range(11):
+        detector.record_call("bash")
+    for _ in range(12):
+        detector.record_call("read_file")
+    alerts = detector.check_anomalies()
+    repeated = [a for a in alerts if a["type"] == "repeated_tool_call"]
+    tools = {a["tool"] for a in repeated}
+    assert "bash" in tools
+    assert "read_file" in tools
+
+
+def test_record_call_increments_count(detector):
+    detector.record_call("bash")
+    detector.record_call("bash")
+    detector.record_call("bash")
+    assert detector._tool_counts["bash"] == 3
+
+
+def test_maxlen_on_call_times(detector):
+    """deque maxlen=100 を超えても古いものが自動削除される"""
+    for i in range(150):
+        detector.record_call("tool")
+    assert len(detector._call_times) == 100

agentwit-0.5.0/tests/test_backup.py

@@ -0,0 +1,96 @@
+"""Tests for SessionBackup: backup creation, hash file, and rotation."""
+import json
+import shutil
+import pytest
+from pathlib import Path
+from unittest.mock import patch
+from agentwit.monitor.backup import SessionBackup, MAX_BACKUPS
+
+
+@pytest.fixture()
+def session_dir(tmp_path):
+    """Minimal session directory with a witness.jsonl file."""
+    sd = tmp_path / "session_20260101_000000"
+    sd.mkdir()
+    (sd / "witness.jsonl").write_text('{"event": 1}\n{"event": 2}\n')
+    return sd
+
+
+@pytest.fixture()
+def backup_dir(tmp_path):
+    return tmp_path / "backups"
+
+
+def make_backup(session_dir, backup_dir):
+    with patch("agentwit.monitor.backup.BACKUP_DIR", backup_dir):
+        return SessionBackup().backup(session_dir)
+
+
+def test_backup_creates_directory(session_dir, backup_dir):
+    dest = make_backup(session_dir, backup_dir)
+    assert dest.exists()
+    assert dest.is_dir()
+
+
+def test_backup_name_contains_session_name(session_dir, backup_dir):
+    dest = make_backup(session_dir, backup_dir)
+    assert dest.name.startswith(session_dir.name)
+
+
+def test_backup_copies_witness_jsonl(session_dir, backup_dir):
+    dest = make_backup(session_dir, backup_dir)
+    assert (dest / "witness.jsonl").exists()
+    content = (dest / "witness.jsonl").read_text()
+    assert '{"event": 1}' in content
+
+
+def test_backup_writes_hash_file(session_dir, backup_dir):
+    dest = make_backup(session_dir, backup_dir)
+    hash_file = dest / "backup_hash.json"
+    assert hash_file.exists()
+    hashes = json.loads(hash_file.read_text())
+    assert "witness.jsonl" in hashes
+    assert len(hashes["witness.jsonl"]) == 64  # sha256 hex digest
+
+
+def test_backup_hash_is_correct(session_dir, backup_dir):
+    import hashlib
+    dest = make_backup(session_dir, backup_dir)
+    hashes = json.loads((dest / "backup_hash.json").read_text())
+    original = (session_dir / "witness.jsonl").read_bytes()
+    expected = hashlib.sha256(original).hexdigest()
+    assert hashes["witness.jsonl"] == expected
+
+
+def test_backup_returns_path(session_dir, backup_dir):
+    dest = make_backup(session_dir, backup_dir)
+    assert isinstance(dest, Path)
+
+
+def test_rotation_removes_oldest_when_over_limit(session_dir, tmp_path):
+    backup_dir = tmp_path / "backups"
+    backup_dir.mkdir()
+
+    # MAX_BACKUPS 個のダミーバックアップを作成
+    import time
+    dummy_dirs = []
+    for i in range(MAX_BACKUPS):
+        d = backup_dir / f"old_session_{i:03d}"
+        d.mkdir()
+        (d / "witness.jsonl").write_text(f"dummy {i}")
+        dummy_dirs.append(d)
+        time.sleep(0.01)  # mtime に差をつける
+
+    # 1つ追加すると最古が削除される
+    with patch("agentwit.monitor.backup.BACKUP_DIR", backup_dir):
+        SessionBackup().backup(session_dir)
+
+    remaining = list(backup_dir.iterdir())
+    assert len(remaining) == MAX_BACKUPS
+    # 最古 (old_session_000) が削除されている
+    assert not (backup_dir / "old_session_000").exists()
+
+
+def test_no_rotation_when_under_limit(session_dir, backup_dir):
+    make_backup(session_dir, backup_dir)
+    assert len(list(backup_dir.iterdir())) == 1