computer-agent-py 0.2.1__tar.gz → 0.2.3__tar.gz

{computer_agent_py-0.2.1 → computer_agent_py-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: computer-agent-py
-Version: 0.2.1
+Version: 0.2.3
 Summary: Drop-in replacement for claude-agent-sdk that adds a proxied telemetry pipeline (PII redaction + guardrails) with OpenTelemetry and AgentOS sinks.
 Keywords: computeragent,claude-agent-sdk,claude,agent,telemetry,otel,opentelemetry,agentos,pii
 Author: Abhi Bhat
@@ -42,9 +42,9 @@ Requires-Dist: opentelemetry-semantic-conventions>=0.48b0 ; extra == 'otel'
 Requires-Dist: httpx>=0.27 ; extra == 'remote'
 Requires-Dist: aiosqlite>=0.20,<1 ; extra == 'sqlite'
 Requires-Python: >=3.10
-Project-URL: Changelog, https://github.com/open-gitagent/computer-agent-py/blob/main/CHANGELOG.md
 Project-URL: Homepage, https://github.com/open-gitagent/computer-agent-py
 Project-URL: Issues, https://github.com/open-gitagent/computer-agent-py/issues
+Project-URL: Changelog, https://github.com/open-gitagent/computer-agent-py/blob/main/CHANGELOG.md
 Provides-Extra: agentos
 Provides-Extra: all
 Provides-Extra: cedar
@@ -509,7 +509,7 @@ configure(
         PiiRedactor(strategy="hash", extra_patterns=[r"BADGE-\d{6}"]),
         GuardrailFilter(
             max_attribute_length=4096,
-            tool_name_allowlist={"Read", "Glob", "Grep", "mcp__nordassist-tools__*"},
+            tool_name_allowlist={"Read", "Glob", "Grep", "mcp__acme-assist-tools__*"},
             cost_ceiling_usd=1.50,
         ),
     ],
@@ -551,7 +551,7 @@ opa = OpaPolicyEngine(
 authorizer = PolicyToolAuthorizer(
     engine=opa,
     principal_resolver=lambda ctx: PolicyPrincipal(id="alice", groups=["engineer"]),
-    resource_resolver=lambda ctx: PolicyResource(agent_name="nordassist", model="claude-sonnet-4-5"),
+    resource_resolver=lambda ctx: PolicyResource(agent_name="acme-assist", model="claude-sonnet-4-5"),
     context_resolver=lambda ctx: {"env": "prod"},
 )
 
@@ -650,7 +650,7 @@ The proxy is a pure tap — messages are never modified or reordered. Sinks run
 
 | File | Demonstrates |
 |---|---|
-| [`examples/pdf_drop_in.py`](examples/pdf_drop_in.py) | The minimum drop-in change |
+| [`examples/drop_in.py`](examples/drop_in.py) | The minimum drop-in change |
 | [`examples/with_otel.py`](examples/with_otel.py) | OTel pointed at a local collector |
 | [`examples/with_new_relic.py`](examples/with_new_relic.py) | OTel pointed at New Relic (just env vars) |
 | [`examples/with_datadog.py`](examples/with_datadog.py) | OTel pointed at Datadog |

{computer_agent_py-0.2.1 → computer_agent_py-0.2.3}/README.md

@@ -452,7 +452,7 @@ configure(
         PiiRedactor(strategy="hash", extra_patterns=[r"BADGE-\d{6}"]),
         GuardrailFilter(
             max_attribute_length=4096,
-            tool_name_allowlist={"Read", "Glob", "Grep", "mcp__nordassist-tools__*"},
+            tool_name_allowlist={"Read", "Glob", "Grep", "mcp__acme-assist-tools__*"},
             cost_ceiling_usd=1.50,
         ),
     ],
@@ -494,7 +494,7 @@ opa = OpaPolicyEngine(
 authorizer = PolicyToolAuthorizer(
     engine=opa,
     principal_resolver=lambda ctx: PolicyPrincipal(id="alice", groups=["engineer"]),
-    resource_resolver=lambda ctx: PolicyResource(agent_name="nordassist", model="claude-sonnet-4-5"),
+    resource_resolver=lambda ctx: PolicyResource(agent_name="acme-assist", model="claude-sonnet-4-5"),
     context_resolver=lambda ctx: {"env": "prod"},
 )
 
@@ -593,7 +593,7 @@ The proxy is a pure tap — messages are never modified or reordered. Sinks run
 
 | File | Demonstrates |
 |---|---|
-| [`examples/pdf_drop_in.py`](examples/pdf_drop_in.py) | The minimum drop-in change |
+| [`examples/drop_in.py`](examples/drop_in.py) | The minimum drop-in change |
 | [`examples/with_otel.py`](examples/with_otel.py) | OTel pointed at a local collector |
 | [`examples/with_new_relic.py`](examples/with_new_relic.py) | OTel pointed at New Relic (just env vars) |
 | [`examples/with_datadog.py`](examples/with_datadog.py) | OTel pointed at Datadog |

{computer_agent_py-0.2.1 → computer_agent_py-0.2.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "computer-agent-py"
-version = "0.2.1"
+version = "0.2.3"
 description = "Drop-in replacement for claude-agent-sdk that adds a proxied telemetry pipeline (PII redaction + guardrails) with OpenTelemetry and AgentOS sinks."
 authors = [
     { name = "Abhi Bhat", email = "abhishek.bhat@lyzr.ai" },

{computer_agent_py-0.2.1 → computer_agent_py-0.2.3}/src/computeragent/__init__.py

@@ -42,7 +42,7 @@ _upstream_all = [n for n in getattr(_cas, "__all__", []) if n != "__version__"]
 for _name in _upstream_all:
     globals()[_name] = getattr(_cas, _name)
 
-__version__ = "0.2.1"
+__version__ = "0.2.3"
 upstream_version = getattr(_cas, "__version__", "unknown")
 
 # Override the two entry points with the proxied versions. Same signatures,

{computer_agent_py-0.2.1 → computer_agent_py-0.2.3}/src/computeragent/_proxy/client.py

@@ -143,7 +143,7 @@ class ClaudeSDKClient:
                 self._upstream_session_id = real_sid
             for ev in TelemetryEvent.from_message(
                 msg, session_id=self._session_id, agent_name=self._agent_name
-            ):
+            ) or []:  # None → non-SDK payload; the proxy only wraps claude_agent_sdk
                 if self._agent_description is not None:
                     ev.agent_description = self._agent_description
                 await pipeline.emit(ev)
@@ -168,7 +168,7 @@ class ClaudeSDKClient:
                 self._upstream_session_id = real_sid
             for ev in TelemetryEvent.from_message(
                 msg, session_id=self._session_id, agent_name=self._agent_name
-            ):
+            ) or []:  # None → non-SDK payload; the proxy only wraps claude_agent_sdk
                 if self._agent_description is not None:
                     ev.agent_description = self._agent_description
                 await pipeline.emit(ev)

{computer_agent_py-0.2.1 → computer_agent_py-0.2.3}/src/computeragent/_proxy/query.py

@@ -91,7 +91,7 @@ async def query(  # noqa: PLR0912 - mirror upstream's tolerant param surface
 
             for ev in TelemetryEvent.from_message(
                 msg, session_id=session_id, agent_name=agent_name
-            ):
+            ) or []:  # None → non-SDK payload; the proxy only wraps claude_agent_sdk
                 # Carry the description forward on every event so sinks that
                 # group by description (or want to surface it on per-message
                 # telemetry) don't have to back-reference session_started.
@@ -169,8 +169,8 @@ def _derive_agent_name(options: Any) -> str | None:
     Strategy:
       1. Explicit ``agent_name`` attribute (not in upstream today but cheap to
          honour if a fork adds it).
-      2. First non-empty line of ``system_prompt`` (NordAssist's prod prompt
-         starts with "You are NordAssist..." — that line is the natural label).
+      2. First non-empty line of ``system_prompt`` (prod prompts typically
+         start with "You are <Name>..." — that line is the natural label).
       3. ``None`` — the sinks fall back to an anonymous hash.
     """
     if options is None:

{computer_agent_py-0.2.1 → computer_agent_py-0.2.3}/src/computeragent/agentos.py

@@ -124,6 +124,97 @@ def otel_url() -> str | None:
     return _resolve("otel", "AGENTOS_OTEL_URL")
 
 
+def policy_config_url(name: str) -> str | None:
+    """AgentOS ingest ``policy-config/{name}`` URL, derived from the ingest
+    endpoint (``…/ingest/events`` → ``…/ingest/policy-config/{name}``).
+
+    ``None`` when no ingest endpoint is configured."""
+    base = ingest_url()
+    if not base:
+        return None
+    from urllib.parse import quote
+
+    root = base[: -len("/events")] if base.endswith("/events") else base
+    return f"{root}/policy-config/{quote(name, safe='')}"
+
+
+def fetch_policy_binding(
+    name: str, *, token: str | None = None, timeout: float = 5.0
+) -> dict[str, str] | None:
+    """Fetch the SRS policy *binding* for an agent name from AgentOS.
+
+    Returns ``{"kind": "srs", "policyId": …, "principalId": …}`` when the agent
+    has a bound policy, else ``None``. Never returns the SRS endpoint/key — those
+    stay server-side; the CAS fills them from its own env. Best-effort: any
+    network/config error logs and returns ``None`` (no policy rather than a crash).
+    """
+    url = policy_config_url(name)
+    if not url:
+        return None
+    try:
+        import httpx
+    except ImportError:  # pragma: no cover - httpx ships with [remote]/[agentos]
+        logger.debug("httpx not installed; cannot fetch AgentOS policy-config")
+        return None
+
+    headers = {"accept": "application/json"}
+    key = token or cak()
+    if key:
+        headers["authorization"] = f"Bearer {key}"
+    try:
+        resp = httpx.get(url, headers=headers, timeout=timeout)
+        resp.raise_for_status()
+        doc = resp.json()
+    except Exception as exc:  # network / DNS / TLS / bad JSON — never fatal
+        logger.warning("AgentOS policy-config fetch from %s failed (%s)", url, exc)
+        return None
+
+    policy = doc.get("policy") if isinstance(doc, dict) else None
+    if not isinstance(policy, dict) or not policy.get("policyId"):
+        return None
+    return {
+        "kind": "srs",
+        "policyId": str(policy["policyId"]),
+        "principalId": str(policy.get("principalId") or name),
+    }
+
+
+def bind_policy(
+    agent_id: str, policy_id: str | None, *, token: str | None = None, timeout: float = 10.0
+) -> dict[str, str] | None:
+    """Attach (or detach) an SRS policy to an agent — same write the AgentOS UI's
+    Policy tab performs (``PUT /agents/{id}/policy``).
+
+    ``agent_id`` is the registry id from the dashboard URL; ``policy_id`` is the
+    policy ``_id`` from the Policies page (``None`` detaches). Persistent: future
+    runs of the agent (UI and SDK alike) pick the binding up automatically.
+    Returns the resulting binding (``{"policyId": …}``) or ``None`` when detached.
+    Raises ``RuntimeError`` when AgentOS is unreachable/unconfigured — a silent
+    no-op here would masquerade as an attached policy.
+    """
+    base = api_url()
+    key = token or cak()
+    if not base or not key:
+        raise RuntimeError(
+            "bind_policy needs AgentOS — set AGENTOS_DISCOVERY_URL (or AGENTOS_API_URL) "
+            "and a cak_ key (COMPUTERAGENT_HARNESS_TOKEN)."
+        )
+    import httpx
+    from urllib.parse import quote
+
+    resp = httpx.put(
+        f"{base}/agents/{quote(agent_id, safe='')}/policy",
+        headers={"authorization": f"Bearer {key}", "content-type": "application/json"},
+        json={"policy_id": policy_id},
+        timeout=timeout,
+    )
+    if resp.status_code >= 400:
+        raise RuntimeError(f"bind_policy: AgentOS returned {resp.status_code}: {resp.text[:200]}")
+    doc = resp.json()
+    binding = doc.get("binding") if isinstance(doc, dict) else None
+    return binding if isinstance(binding, dict) else None
+
+
 def _reset_cache_for_tests() -> None:
     """Clear the memoized discovery result (test-only)."""
     global _endpoints

{computer_agent_py-0.2.1 → computer_agent_py-0.2.3}/src/computeragent/engines/claude_agent.py

@@ -100,9 +100,12 @@ def _build_options(ctx: EngineContext) -> Any:
     # Always stream partials so the harness sees mid-turn assistant text.
     payload.setdefault("include_partial_messages", True)
     # Wire policy decider into the can_use_tool slot. ``PolicyToolAuthorizer``
-    # already matches the CanUseTool signature, so no glue.
+    # already matches the CanUseTool signature; the wrapper only stamps the
+    # harness session id onto the SDK's ToolPermissionContext (which doesn't
+    # carry one) so the resulting policy_decision telemetry correlates with
+    # this session's open OTel spans instead of landing on "unknown".
     if ctx.policy_decider is not None:
-        payload["can_use_tool"] = ctx.policy_decider
+        payload["can_use_tool"] = _bind_session_id(ctx.policy_decider, ctx.session_id)
 
     options = ClaudeAgentOptions(**payload)
     # Surface harness-supplied agent identity to the proxy's
@@ -116,6 +119,20 @@ def _build_options(ctx: EngineContext) -> Any:
     return options
 
 
+def _bind_session_id(decider: Any, session_id: str) -> Any:
+    """Wrap a ``can_use_tool`` decider so the permission context carries the
+    harness session id. ``ToolPermissionContext`` is a plain dataclass, so the
+    extra attribute attaches cleanly; if upstream ever forbids it the stamp is
+    skipped and the decider still runs."""
+
+    async def _can_use_tool(tool_name: str, tool_input: dict[str, Any], context: Any) -> Any:
+        with suppress(Exception):
+            context.session_id = session_id
+        return await decider(tool_name, tool_input, context)
+
+    return _can_use_tool
+
+
 def _is_result_message(msg: Any) -> bool:
     try:
         from claude_agent_sdk.types import ResultMessage  # type: ignore

{computer_agent_py-0.2.1 → computer_agent_py-0.2.3}/src/computeragent/harness/__init__.py

@@ -199,6 +199,11 @@ class ComputerAgent:
         # API key for the remote server, sent as `Authorization: Bearer`.
         # Falls back to the COMPUTERAGENT_HARNESS_TOKEN env var when omitted.
         harness_token: str | None = None,
+        # SRS policy id (the `_id` shown in the AgentOS Policies UI). When set,
+        # it is used directly — no AgentOS binding lookup — so you can copy the
+        # id from the UI and paste it here. When omitted, the policy bound to
+        # `agent_name` in AgentOS (the UI's Policy tab) is fetched and used.
+        policy_id: str | None = None,
     ) -> None:
         from .. import agentos as _agentos
 
@@ -278,6 +283,24 @@ class ComputerAgent:
             # An explicit telemetry_pipeline= still wins for callers who want
             # client-side telemetry on purpose.
             remote_pipeline = telemetry_pipeline if telemetry_pipeline is not None else Pipeline(sinks=[])
+            # SRS policy parity with the AgentOS UI: the UI's chat-sandbox route
+            # looks up the agent's bound policy and attaches it; talking to the CAS
+            # directly skips that. An explicit `policy_id=` kwarg wins (copy the id
+            # from the Policies UI); otherwise resolve the binding (by agent name)
+            # from AgentOS. Either way only {policyId, principalId} is forwarded —
+            # the CAS fills the SRS endpoint/key from its own env.
+            if policy_id:
+                remote_policy: dict[str, str] | None = {
+                    "kind": "srs",
+                    "policyId": policy_id,
+                    "principalId": agent_name or "agent",
+                }
+            else:
+                remote_policy = (
+                    _agentos.fetch_policy_binding(agent_name, token=harness_token)
+                    if agent_name
+                    else None
+                )
             self._coordinator: _CoordinatorLike = _build_remote_coordinator_from_kwargs(
                 harness_url=harness_url,
                 harness_kind=harness_kind,
@@ -296,6 +319,7 @@ class ComputerAgent:
                 harness_auth=harness_auth,
                 harness_token=harness_token,
                 telemetry_pipeline=remote_pipeline,
+                policy=remote_policy,
             )
             return
 
@@ -399,6 +423,7 @@ def _build_remote_coordinator_from_kwargs(
     harness_auth: tuple[str, str] | str | None,
     harness_token: str | None,
     telemetry_pipeline: Pipeline | None,
+    policy: Mapping[str, Any] | None = None,
 ) -> _CoordinatorLike:
     """Map ``ComputerAgent`` kwargs → a ``RemoteCoordinator``. Imported lazily
     so the ``[remote]`` extra (httpx) is only required in remote mode."""
@@ -433,6 +458,7 @@ def _build_remote_coordinator_from_kwargs(
         auth=harness_auth,
         token=harness_token,
         telemetry_pipeline=telemetry_pipeline,
+        policy=policy,
     )
 
 

{computer_agent_py-0.2.1 → computer_agent_py-0.2.3}/src/computeragent/harness/coordinator.py

@@ -345,6 +345,9 @@ class HarnessCoordinator:
         """Iterate the engine, translate each event, push telemetry."""
         last_assistant_text = ""
         result_payload: Any = None
+        # Fired once per turn when the first streamed content chunk arrives →
+        # time-to-first-token. Only the OtelSink consumes it.
+        first_token_emitted = False
         try:
             async for ev in self._engine.start_session(ctx):
                 if ev.kind == "usage_snapshot":
@@ -391,6 +394,11 @@ class HarnessCoordinator:
                             if state.agent_description is not None:
                                 tev.agent_description = state.agent_description
                             await self._emit(tev)
+                            # An assistant_message marks the end of one LLM call;
+                            # re-arm so the NEXT call's first streamed token fires
+                            # its own response_first_token (per-call TTFT).
+                            if tev.kind == "assistant_message":
+                                first_token_emitted = False
                     elif upstream_events is None:
                         # from_message returned None → unrecognized type, not a
                         # claude-agent-sdk message (e.g. Anthropic raw response,
@@ -404,7 +412,20 @@ class HarnessCoordinator:
                         ):
                             await self._emit(tev)
                     # upstream_events == [] → recognised SDK type with nothing to
-                    # emit (StreamEvent, RateLimitEvent, …) — skip silently.
+                    # emit (StreamEvent, RateLimitEvent, …). Use the first
+                    # content-bearing StreamEvent of the turn as the
+                    # time-to-first-token signal (OtelSink-only).
+                    elif not first_token_emitted and _is_first_token_stream_event(ev.payload):
+                        first_token_emitted = True
+                        with suppress(Exception):
+                            ft_ev = TelemetryEvent(
+                                kind="response_first_token",
+                                session_id=state.session_id,
+                                agent_name=state.agent_name,
+                            )
+                            if state.agent_description is not None:
+                                ft_ev.agent_description = state.agent_description
+                            await self._emit(ft_ev)
                 elif ev.kind == "permission_request":
                     # Engines ask the harness; the harness routes to user
                     # callbacks / policy decider. The Future returned by
@@ -479,13 +500,19 @@ class HarnessCoordinator:
             ev.payload["agent_version"] = manifest.version
         if getattr(manifest, "sha", None):
             ev.payload["agent_sha"] = manifest.sha
-        # Signal harness-mode to the AgentOS server's ingest projection.
-        # The server writes ``source.type = "library"`` for harness-mode
-        # docs, which fails AgentOS's ``hasResolvableSource`` check so
-        # the UI hides the chat-sandbox button (there's no Python HTTP
-        # harness on :8787 to proxy to). Drop-in proxy callers don't set
-        # this flag → existing ``type: "inline"`` shape is preserved.
-        ev.payload["harness_mode"] = True
+        # Signal harness-mode to the AgentOS server's ingest projection, which
+        # then writes ``source.type = "library"`` (no server-runnable source →
+        # the UI hides live chat). We set it for sources the AgentOS harness
+        # can't reconstruct on its own (a git URL or a local path that only
+        # exists on this machine). We deliberately do NOT set it for an INLINE
+        # source: the server's ``inlineSourceFor`` rebuilds a runnable
+        # ``agent.yaml`` + ``CLAUDE.md`` from this event's payload
+        # (system_prompt / allowed_tools / max_turns / permission_mode / model),
+        # so an inline agent stays live-chattable in the AgentOS UI via the TS
+        # harness's inline loader. (Drop-in proxy callers never reach here.)
+        is_inline = isinstance(self._source, dict) and self._source.get("type") == "inline"
+        if not is_inline:
+            ev.payload["harness_mode"] = True
         await self._emit(ev)
 
     async def _emit(self, ev: TelemetryEvent) -> None:
@@ -525,7 +552,42 @@ class HarnessCoordinator:
                         }
             if self._on_permission_request_user is not None:
                 with suppress(Exception):
-                    return await self._on_permission_request_user(req)
+                    started_at = time.monotonic()
+                    decision = await self._on_permission_request_user(req)
+                    # Mirror PolicyToolAuthorizer: every gate decision emits a
+                    # policy_decision event so the OTel sink can stamp the
+                    # decision + reason onto the live execute_tool span.
+                    # (The policy_decider path above emits its own.)
+                    with suppress(Exception):
+                        await self._emit(
+                            TelemetryEvent(
+                                kind="policy_decision",
+                                session_id=state.session_id,
+                                agent_name=state.agent_name,
+                                payload={
+                                    "engine": "on_tool_call",
+                                    "decision": (
+                                        "deny"
+                                        if isinstance(decision, dict)
+                                        and decision.get("behavior") == "deny"
+                                        else "allow"
+                                    ),
+                                    "reason": (
+                                        str(decision.get("message") or "")
+                                        if isinstance(decision, dict)
+                                        else ""
+                                    ),
+                                    "latency_ms": (time.monotonic() - started_at) * 1000.0,
+                                    "principal_id": "",
+                                    "principal_groups": [],
+                                    "tool_name": req.tool_name,
+                                    "call_id": req.call_id,
+                                    "agent_name": state.agent_name or "",
+                                    "session_id": state.session_id,
+                                },
+                            )
+                        )
+                    return decision
             # Default — allow with original input.
             return {"behavior": "allow", "updated_input": dict(req.input or {})}
 
@@ -616,6 +678,19 @@ def _maybe_assistant_text(payload: Any, current: str) -> str:
     return "".join(parts) if parts else current
 
 
+def _is_first_token_stream_event(payload: Any) -> bool:
+    """True for a claude-agent-sdk ``StreamEvent`` carrying the first model
+    output of a turn — a ``content_block_start`` / ``content_block_delta`` raw
+    Anthropic stream event. Duck-typed (no hard import) so non-streaming engines
+    (gitagent) never trip it. ``message_start`` is excluded: it opens the stream
+    before any content, so it would understate time-to-first-token."""
+    if type(payload).__name__ != "StreamEvent":
+        return False
+    event = getattr(payload, "event", None)
+    etype = event.get("type") if isinstance(event, dict) else getattr(event, "type", None)
+    return etype in ("content_block_start", "content_block_delta")
+
+
 def _maybe_result_payload(payload: Any, current: Any) -> Any:
     """Track the latest ``ResultMessage``-shaped payload across the stream."""
     try:

{computer_agent_py-0.2.1 → computer_agent_py-0.2.3}/src/computeragent/harness/remote.py

@@ -171,6 +171,7 @@ class ComputerAgentServerTransport:
         model: str | None,
         agent_id: str | None = None,
         agent_name: str | None = None,
+        policy: Mapping[str, Any] | None = None,
     ) -> None:
         self._client = client
         self._engine = engine
@@ -181,6 +182,7 @@ class ComputerAgentServerTransport:
         self._model = model
         self._agent_id = agent_id
         self._agent_name = agent_name
+        self._policy = dict(policy) if policy else None
         self._sandbox_id: str | None = None
 
     async def ensure_open(self, lifecycle_session_id: str) -> str:
@@ -207,6 +209,11 @@ class ComputerAgentServerTransport:
             body["identity"] = {"agentId": self._agent_id}
         if self._agent_name:
             body["agentName"] = self._agent_name
+        # Per-tool-call SRS policy. We send only the binding (policyId/principalId);
+        # the CAS fills the SRS endpoint+key from its own env, so the key never
+        # rides the wire. Omitted entirely when the agent has no bound policy.
+        if self._policy:
+            body["policy"] = self._policy
         resp = await self._client.create_sandbox(body)
         self._sandbox_id = str(resp["sandboxId"])
         return self._sandbox_id
@@ -254,6 +261,7 @@ class RemoteCoordinator:
         auth: tuple[str, str] | str | None,
         token: str | None,
         telemetry_pipeline: Pipeline | None,
+        policy: Mapping[str, Any] | None = None,
     ) -> None:
         self._url = harness_url.rstrip("/")
         self._kind = harness_kind
@@ -270,6 +278,9 @@ class RemoteCoordinator:
         # _emit_safe AND sent in the CAS sandbox body (server transport) as
         # `identity.agentId` so the server tags spans + writes the session index.
         self._agent_id = agent_id
+        # SRS policy binding ({kind, policyId, principalId}); attached to the CAS
+        # sandbox body so the server builds its SrsPolicyDecider. None → no policy.
+        self._policy = dict(policy) if policy else None
         self._on_tool_call = on_tool_call
         self._auth = auth
         self._token = token
@@ -308,6 +319,7 @@ class RemoteCoordinator:
                 model=self._model,
                 agent_id=self._agent_id,
                 agent_name=self._agent_name,
+                policy=self._policy,
             )
         else:
             opts = dict(self._options)
@@ -603,6 +615,7 @@ def build_remote_coordinator(
     auth: tuple[str, str] | str | None,
     token: str | None,
     telemetry_pipeline: Pipeline | None,
+    policy: Mapping[str, Any] | None = None,
 ) -> RemoteCoordinator:
     return RemoteCoordinator(
         harness_url=harness_url,
@@ -622,6 +635,7 @@ def build_remote_coordinator(
         auth=auth,
         token=token,
         telemetry_pipeline=telemetry_pipeline,
+        policy=policy,
     )
 
 

{computer_agent_py-0.2.1 → computer_agent_py-0.2.3}/src/computeragent/policy/authorizer.py

@@ -70,6 +70,14 @@ class PolicyToolAuthorizer:
         context: ToolPermissionContext,
     ) -> PermissionResultAllow | PermissionResultDeny:
         started_at = time.monotonic()
+        # Correlation ids for the telemetry event. The upstream context is
+        # either a ToolPermissionContext (claude-agent-sdk — carries
+        # ``tool_use_id``; ``session_id`` is stamped on by the harness engine)
+        # or the coordinator's plain dict (``{"session_id", "call_id"}``).
+        # Without these the policy_decision event lands on session "unknown"
+        # and the OTel sink can't annotate the live execute_tool span.
+        session_id = str(_ctx_value(context, "session_id") or "")
+        call_id = str(_ctx_value(context, "tool_use_id", "call_id") or "")
         input_obj = await self._build_input(tool_name, tool_input, context)
         try:
             result = await self._engine.evaluate(input_obj)
@@ -85,10 +93,14 @@ class PolicyToolAuthorizer:
                 message=f"policy engine error: {exc}",
                 interrupt=self._on_deny == "interrupt",
             )
-            await self._emit_telemetry(input_obj, None, exc, started_at)
+            await self._emit_telemetry(
+                input_obj, None, exc, started_at, session_id=session_id, call_id=call_id
+            )
             return permission
 
-        await self._emit_telemetry(input_obj, result, None, started_at)
+        await self._emit_telemetry(
+            input_obj, result, None, started_at, session_id=session_id, call_id=call_id
+        )
 
         if result.decision == PolicyDecision.ALLOW:
             return PermissionResultAllow(updated_input=tool_input)
@@ -114,13 +126,13 @@ class PolicyToolAuthorizer:
         else:
             resource = PolicyResource(
                 type="agent",
-                session_id=getattr(context, "session_id", "") or "",
+                session_id=str(_ctx_value(context, "session_id") or ""),
             )
         ctx: dict[str, Any]
         if self._context_resolver is not None:
             ctx = await _maybe_await(self._context_resolver(context))
         else:
-            ctx = {"session_id": getattr(context, "session_id", "") or ""}
+            ctx = {"session_id": str(_ctx_value(context, "session_id") or "")}
 
         return PolicyInput(
             principal=principal,
@@ -139,6 +151,9 @@ class PolicyToolAuthorizer:
         result: Any,
         error: BaseException | None,
         started_at: float,
+        *,
+        session_id: str = "",
+        call_id: str = "",
     ) -> None:
         latency_ms = (time.monotonic() - started_at) * 1000.0
         try:
@@ -148,6 +163,8 @@ class PolicyToolAuthorizer:
                 error=error,
                 latency_ms=latency_ms,
                 engine_name=getattr(self._engine, "name", type(self._engine).__name__),
+                session_id=session_id,
+                call_id=call_id,
             )
             await get_pipeline().emit(event)
         except Exception:  # noqa: BLE001
@@ -159,3 +176,16 @@ async def _maybe_await(value: Any) -> Any:
     if hasattr(value, "__await__"):
         return await value
     return value
+
+
+def _ctx_value(context: Any, *names: str) -> Any:
+    """Read a correlation field off whatever shape the upstream context has —
+    attribute access for ToolPermissionContext-style objects, key access for
+    the coordinator's plain-dict context. First non-empty wins."""
+    for name in names:
+        value = getattr(context, name, None)
+        if value is None and isinstance(context, dict):
+            value = context.get(name)
+        if value:
+            return value
+    return None

{computer_agent_py-0.2.1 → computer_agent_py-0.2.3}/src/computeragent/policy/cedar.py

@@ -10,8 +10,8 @@ Translation rules:
   → ``User::"alice"`` with parents ``[Group::"engineer", ...]``.
 * ``PolicyAction(name="tool_use", tool_name="Read")``
   → ``Action::"toolUse"`` with attribute ``tool: "Read"``.
-* ``PolicyResource(type="agent", agent_name="nordassist")``
-  → ``Agent::"nordassist"``.
+* ``PolicyResource(type="agent", agent_name="acme-assist")``
+  → ``Agent::"acme-assist"``.
 
 Optional extra: ``pip install 'computer-agent-py[cedar]'``.
 """