stacktrace-cli 0.13.0__py3-none-any.whl → 0.14.0__py3-none-any.whl

stacktrace/__init__.py

@@ -2,7 +2,7 @@
 
 import logging as _logging
 
-__version__ = "0.13.0"
+__version__ = "0.14.0"
 
 # Only the daemon attaches a handler (ADR-0048). Without this one, a WARNING
 # logged in any other process would reach Python's last-resort handler and

stacktrace/cost/measures.py

@@ -127,8 +127,8 @@ def repeats(
     most repeated first.
 
     A call that recorded a failure takes no part in any cost measure
-    (cost-phase-1 §1): a denied one reached nothing, and a failing one is
-    `tool-retry-storm`'s. A call in `skip` was already cited by another rule.
+    (cost-phase-1 §1): a denied one reached nothing, and a failing one returned
+    no result to repeat. A call in `skip` was already cited by another rule.
     """
     seen: dict[tuple[str | None, str, str, str], list[ToolCallLike]] = {}
     for call in calls:

stacktrace/cost/rules.py

@@ -244,7 +244,7 @@ class Context:
     zone: tzinfo
     snapshot: Snapshot | None = None
     #: Spans another rule already cited, which the repeats reason leaves out
-    #: (`tool-retry-storm`, `blocked-*`): one event is never reported twice.
+    #: (`blocked-*`): one event is never reported twice.
     cited: frozenset[str] = frozenset()
     #: What correlation placed each call on, by span. A call it does not name
     #: gets a label of ours (`cost/components.py`).

stacktrace/daemon/costs.py

@@ -460,9 +460,9 @@ def summaries_from_rows(rows: Iterable[Mapping[str, Any]]) -> list[Summary]:
     ]
 
 
-#: Rules whose citations the repeats reason leaves out: `tool-retry-storm` and
-#: every `blocked-*` rule, which together are the reliability family. One
-#: event, one report (cost-phase-1 §1).
+#: Rules whose citations the repeats reason leaves out: every `blocked-*` rule,
+#: which together are the reliability family. One event, one report
+#: (cost-phase-1 §1).
 _LOOP_CITERS = RELIABILITY_RULES
 
 
@@ -651,7 +651,7 @@ class CostPass:
         self._log(misses)
 
     def _cited(self, runs: Sequence[Run[Any]]) -> frozenset[str]:
-        """Spans `tool-retry-storm` and the `blocked-*` rules cite, which the
+        """Spans the `blocked-*` rules cite, which the
         repeats reason leaves out: worked out from each changed session this
         tick, and whatever the store already holds for each run's main
         session."""

stacktrace/daemon/fleet.py

@@ -24,6 +24,7 @@ from contextlib import suppress
 from dataclasses import dataclass
 from datetime import UTC, datetime
 from typing import Any, Protocol
+from urllib.parse import urlsplit
 
 import httpx
 
@@ -156,6 +157,17 @@ class DrainReport:
     stopped: str | None = None
 
 
+def _console_origin(url: object) -> str | None:
+    """The scheme and host of Fleet's `dashboard_url`, or None for anything
+    that is not an http(s) URL with a host."""
+    if not isinstance(url, str):
+        return None
+    parts = urlsplit(url)
+    if parts.scheme not in ("http", "https") or not parts.netloc:
+        return None
+    return f"{parts.scheme}://{parts.netloc}"
+
+
 class FleetSubscriber:
     """Drain `records` by cursor, one request per agent kind."""
 
@@ -223,6 +235,7 @@ class FleetSubscriber:
         config = load_remote_config(config_path)
         if config.token is None:
             self.store.clear_cursors()
+            self.store.clear_fleet_console()
             return DrainReport(stopped="not configured")
         if not self.store.has_queued_rows():
             # `partitions()` stays non-empty long after its backlog has fully
@@ -247,6 +260,7 @@ class FleetSubscriber:
             config = load_remote_config(config_path)
             if config.token is None:
                 self.store.clear_cursors()
+                self.store.clear_fleet_console()
                 return DrainReport(stopped="not configured")
             token = config.token
             config = _recover_interrupted_asset_transition(config=config, config_path=config_path)
@@ -272,6 +286,11 @@ class FleetSubscriber:
             if asset_id != config.asset_id:
                 # No separate lock needed — this whole span already holds it.
                 _advance_asset_id(config=config, config_path=config_path, asset_id=asset_id)
+                # A new asset id means a new registration — first-ever, or a
+                # tenant switch — and either way any cached console address
+                # named a prior tenant's Fleet. The next successful upload
+                # replaces it; until then, no webhook alert should link to one.
+                self.store.clear_fleet_console()
 
             uploaded = 0
             parked = 0
@@ -602,6 +621,12 @@ class FleetSubscriber:
         except RemoteClientError as error:
             raise DrainStopped(f"upload rejected: {error}") from error
         else:
+            # Where Fleet's console is, for the link a webhook alert carries
+            # (ADR-0147). Fleet names it on every upload; the origin is all
+            # that is kept.
+            origin = _console_origin(getattr(result, "dashboard_url", None))
+            if origin is not None:
+                self.store.set_fleet_console(origin)
             sent = len(payload["detections"])
             kept = int(getattr(result, "detections_ingested", sent))
             if kept < sent:

stacktrace/daemon/policy_collect.py

@@ -8,6 +8,7 @@ from __future__ import annotations
 
 import contextlib
 import hashlib
+import inspect
 import json
 import os
 import signal
@@ -29,8 +30,11 @@ MAX_BUNDLE_BYTES = 2 * 1024 * 1024
 COLLECT_TIMEOUT = 45
 
 
-def collector_available() -> bool:
-    return callable(getattr(openaca.core, "collect_policy_evidence", None))
+def collector_available(agent_kind: str = "claude-code") -> bool:
+    collector = getattr(openaca.core, "collect_policy_evidence", None)
+    if not callable(collector):
+        return False
+    return agent_kind != "codex" or "agent_kind" in inspect.signature(collector).parameters
 
 
 def _source(ref: ComponentRef, scope: Scope) -> str | None:
@@ -90,11 +94,24 @@ def evaluate_bundle(policy: Policy, evidence: Any, scope: Scope) -> tuple[Entry,
             name = path[-1].get("name")
         if not isinstance(name, str) or not name or len(name) > 4096:
             continue
+        if scope.agent_kind == "codex":
+            from stacktrace.hooks.codex import namespace_for_server
+
+            if component_type != "mcp_server" or ref.extra.get("enabled") is False:
+                continue
+            # Codex exposes the server namespace for both direct and plugin MCPs.
+            # Keep normalized collisions: DecisionCache applies category defaults.
+            name = namespace_for_server(name)
+            if name is None:
+                continue
         blocked = decision.blocked
         rule = next(iter(getattr(decision, "rule_paths", ())), None) if blocked else None
         detail = descriptions.get(rule) if rule is not None else None
         if detail is not None and len(detail) > MAX_RULE_DETAIL:
             detail = detail[: MAX_RULE_DETAIL - 3] + "..."
+        if scope.agent_kind == "codex":
+            entries.append((Entry("mcp_tool", name, "codex", blocked, rule, detail), 0))
+            continue
         owner = decision.subject.ref.name if decision.controlled_by_plugin else None
         source = "plugin" if owner else _source(ref, scope)
         rank = 1 if source in {"project", "local"} and not owner and ":" not in name else 0
@@ -154,6 +171,7 @@ def collect_bounded(document: dict[str, object], scope: Scope) -> Collected:
     request = json.dumps(
         {
             "document": document,
+            "agent_kind": scope.agent_kind,
             "config_root": scope.config_root,
             "project_root": scope.project_root,
             "global_config": scope.global_config,
@@ -188,9 +206,14 @@ def collect_bounded(document: dict[str, object], scope: Scope) -> Collected:
         "inventory_digest",
         "vulnerability_run_id",
         "posture_run_id",
+        "inventory_gap_count",
     }:
         raise ValueError("policy_evidence_invalid")
     for name, value in identifiers.items():
+        if name == "inventory_gap_count":
+            if type(value) is not int or not 0 <= value < 2**31:
+                raise ValueError("policy_evidence_invalid")
+            continue
         if value is None and name != "inventory_digest":
             continue
         if (
@@ -240,12 +263,21 @@ def main() -> int:
         if len(raw) > MAX_BUNDLE_BYTES:
             return 1
         request = json.loads(raw)
-        scope = Scope(request["config_root"], request["project_root"], request["global_config"])
+        scope = Scope(
+            request["config_root"],
+            request["project_root"],
+            request["global_config"],
+            request.get("agent_kind", "claude-code"),
+        )
         # This child owns its environment. Select the same native global file
         # as the launching host, without mutating the resident daemon's env.
         root = Path(scope.config_root)
         target: Path | None = root
-        if Path(scope.global_config) == (root / ".claude.json").resolve():
+        if scope.agent_kind == "codex":
+            if Path(scope.global_config) != (root / "config.toml").resolve():
+                raise ValueError("invalid_global_config")
+            os.environ["CODEX_HOME"] = str(root)
+        elif Path(scope.global_config) == (root / ".claude.json").resolve():
             os.environ["CLAUDE_CONFIG_DIR"] = str(root)
         elif (
             root == (Path.home() / ".claude").resolve()
@@ -265,7 +297,14 @@ def main() -> int:
             os.dup2(quiet.fileno(), 1)
             os.dup2(quiet.fileno(), 2)
             policy = parse_policy(request["document"])
-            evidence: Any = collector(policy, target=target, project=Path(scope.project_root))
+            options: dict[str, Any] = (
+                {"agent_kind": scope.agent_kind} if scope.agent_kind == "codex" else {}
+            )
+            if "allow_partial_inventory" in inspect.signature(collector).parameters:
+                options["allow_partial_inventory"] = True
+            evidence: Any = collector(
+                policy, target=target, project=Path(scope.project_root), **options
+            )
             digest = inventory_digest(evidence)
             # Both gates use this exact owned bundle. The facade exposes no
             # advisory database revision; never invent one from a timestamp.
@@ -274,6 +313,7 @@ def main() -> int:
                 digest,
                 run_id if policy.risk_gates.vulnerabilities is not None else None,
                 run_id if policy.risk_gates.posture_rule_ids else None,
+                len(getattr(evidence, "inventory_gaps", ())),
             )
             paths = sorted(
                 {

stacktrace/daemon/policy_runtime.py

@@ -35,10 +35,20 @@ class Scope:
     config_root: str
     project_root: str
     global_config: str = ""
+    agent_kind: str = "claude-code"
 
     def __post_init__(self) -> None:
+        if self.agent_kind not in {"claude-code", "codex"}:
+            raise ValueError("unsupported_agent")
         if not self.global_config:
-            object.__setattr__(self, "global_config", str(Path(self.config_root) / ".claude.json"))
+            object.__setattr__(
+                self,
+                "global_config",
+                str(
+                    Path(self.config_root)
+                    / ("config.toml" if self.agent_kind == "codex" else ".claude.json")
+                ),
+            )
         for value in (self.config_root, self.project_root, self.global_config):
             if not value or len(value) > 4096 or "\x00" in value or not Path(value).is_absolute():
                 raise ValueError("invalid_scope")
@@ -86,6 +96,7 @@ class EvidenceIds:
     inventory_digest: str
     vulnerability_run_id: str | None
     posture_run_id: str | None
+    inventory_gap_count: int = 0
 
 
 @dataclass(frozen=True)
@@ -227,7 +238,7 @@ class DecisionCache:
         """Use defaults from the same policy as the active decision table."""
         if policy is None:
             return Result("defer", reason, revision)
-        if kind == "mcp_tool" and source in {"user", "project", "local"}:
+        if kind == "mcp_tool" and source in {"user", "project", "local", "codex"}:
             default = policy.mcps.default
             category = "mcps"
         elif (
@@ -263,6 +274,15 @@ def configuration_digest(scope: Scope, watch_paths: tuple[str, ...]) -> str:
         str(root / "plugins" / "installed_plugins.json"),
         *watch_paths,
     }
+    if scope.agent_kind == "codex":
+        paths = {
+            str(root),
+            str(root / "config.toml"),
+            str(root / "hooks.json"),
+            str(project / ".codex"),
+            str(project / ".codex/config.toml"),
+            *watch_paths,
+        }
     records = []
     for name in sorted(paths):
         try:
@@ -408,12 +428,15 @@ class PolicyRuntime:
         try:
             if set(value) != {"agent_kind", "config_root", "global_config", "project_root"}:
                 return False
-            if value["agent_kind"] != "claude-code" or not all(
+            if value["agent_kind"] not in {"claude-code", "codex"} or not all(
                 isinstance(item, str) for item in value.values()
             ):
                 return False
             scope = Scope(
-                str(value["config_root"]), str(value["project_root"]), str(value["global_config"])
+                str(value["config_root"]),
+                str(value["project_root"]),
+                str(value["global_config"]),
+                str(value["agent_kind"]),
             )
             with _asset_transition_lock(self.config_path, timeout=0.05):
                 config = load_remote_config(self.config_path)
@@ -445,7 +468,7 @@ class PolicyRuntime:
                 for key, value in action.items()
             ):
                 return Result("defer", "invalid_action")
-            if action["agent_kind"] != "claude-code":
+            if action["agent_kind"] not in {"claude-code", "codex"}:
                 return Result("defer", "unsupported_agent")
             kind, name, source = action["action_kind"], action["name"], action["source"]
             if kind not in {"mcp_tool", "skill", "command", "plugin_agent"}:
@@ -454,6 +477,7 @@ class PolicyRuntime:
                 str(action["config_root"]),
                 str(action["project_root"]),
                 str(action["global_config"]),
+                str(action["agent_kind"]),
             )
             with _asset_transition_lock(self.config_path, timeout=0.05):
                 config = load_remote_config(self.config_path)
@@ -527,6 +551,7 @@ class PolicyRuntime:
                     {
                         "scope_id": hashlib.sha256(repr(scope).encode()).hexdigest()[:16],
                         "project_root": scope.project_root,
+                        "agent_kind": scope.agent_kind,
                         "evaluated_revision": None if snapshot is None else snapshot.revision,
                         "update_pending": snapshot is None
                         or snapshot.token != self.cache.capture(scope)
@@ -541,6 +566,9 @@ class PolicyRuntime:
                         if snapshot is None or snapshot.evidence is None
                         else snapshot.evidence.posture_run_id,
                         "evidence_age_seconds": age,
+                        "inventory_gap_count": None
+                        if snapshot is None or snapshot.evidence is None
+                        else snapshot.evidence.inventory_gap_count,
                         "valid": inputs_current and snapshot is not None,
                     }
                 )

stacktrace/daemon/presentation.py

@@ -56,6 +56,14 @@ _GUIDANCE = {
         "Code or artifacts were published without explicit user request",
         "Verify the publication was intended and inspect what was made public.",
     ),
+    "stacktrace-credential-switched": (
+        "The agent got past a refusal with a credential nobody gave it",
+        (
+            "Revoke or rotate that credential. Then remove it from where the agent can "
+            "read it. If the agent needs this access, grant it to the agent's own credential."
+        ),
+    ),
+    # Retired by ADR-0149. Findings stored before then still name them.
     "stacktrace-mcp-transient-failure": (
         "MCP auth failure followed by recovery on a server",
         "Investigate whether the recovery involved a credential change or a transient issue.",

stacktrace/daemon/runtime.py

@@ -23,6 +23,7 @@ from stacktrace.cost.clock import environment_zone
 from stacktrace.detector.run import NO_ANALYZER
 from stacktrace.private_state import ensure_private_directory
 from stacktrace.remote.config import get_config_path as remote_config_path
+from stacktrace.remote.identity import resolve_asset_identity
 from stacktrace.sessions.access import IncrementalSessions, collect_sessions
 from stacktrace.telemetry import emit_error
 from stacktrace.telemetry.posthog import flush as telemetry_flush
@@ -79,6 +80,17 @@ INITIAL_COMPOSITION_TIMEOUT = 5.0
 logger = logging.getLogger(__name__)
 
 
+def _environment_name() -> str | None:
+    """This machine as Fleet names it: the `display_name` registration sends
+    (ADR-0105), so a Slack footer reads the same as Fleet's alert. A machine
+    that registered reads its stored id and writes nothing. None if it cannot
+    be read: the footer then leaves the Environment out."""
+    try:
+        return resolve_asset_identity().display_name or None
+    except Exception:  # noqa: BLE001 - a footer label never stops the daemon
+        return None
+
+
 def daemon_is_running(path: Path) -> bool:
     """Whether a daemon this user owns is listening at `path`.
 
@@ -267,7 +279,14 @@ def run_daemon(
             # every reader below: Devin's answer is a call to its server
             # (ADR-0112).
             signed_in = SignedInAccounts(store, org_id=FleetOrg())
-            webhook_subscriber = WebhookSubscriber(store=store, config_path=get_config_path())
+            # The same reader the Fleet upload asks, so a Slack message names
+            # the person exactly when a Fleet detection does (ADR-0147).
+            webhook_subscriber = WebhookSubscriber(
+                store=store,
+                config_path=get_config_path(),
+                person=signed_in.person,
+                environment=_environment_name(),
+            )
             server = NotificationServer(paths.socket, store)
             started_at = datetime.now(UTC).isoformat()
             server.on_status = lambda: {

stacktrace/daemon/store.py

@@ -97,6 +97,10 @@ DEFAULT_PRUNE_INTERVAL = timedelta(hours=6)
 #: that read every transcript.
 _BASELINE_COMPLETE = "cost_baseline_complete"
 
+#: The `schema_meta` key holding the console address Fleet named in its last
+#: upload response, so a webhook alert can link to the finding (ADR-0147).
+_FLEET_CONSOLE = "fleet_console"
+
 #: Usage rows Fleet accepted are kept this long at minute grain, and rows
 #: never sent are rolled into their hour after it (usage-upload.md, Retention).
 USAGE_MINUTE_RETENTION = timedelta(days=7)
@@ -733,6 +737,35 @@ class FindingStore:
                 (_BASELINE_COMPLETE, "true" if complete else "false"),
             )
 
+    def set_fleet_console(self, origin: str) -> None:
+        """Keep the console address Fleet named in an upload response. Each
+        response replaces it, so switching Fleets follows the next upload."""
+        with self._lock:
+            self._connection.execute(
+                "INSERT OR REPLACE INTO schema_meta (key, value) VALUES (?, ?)",
+                (_FLEET_CONSOLE, origin),
+            )
+
+    def fleet_console(self) -> str | None:
+        """The console address the last upload response named, or None
+        before any upload."""
+        with self._lock:
+            row = self._connection.execute(
+                "SELECT value FROM schema_meta WHERE key = ?", (_FLEET_CONSOLE,)
+            ).fetchone()
+        return row[0] if row else None
+
+    def clear_fleet_console(self) -> None:
+        """Forget the cached console address.
+
+        Called alongside `clear_cursors()` when Fleet is unconfigured, and
+        when the drain registers under a new asset id (a tenant switch): the
+        cached origin names the console of the tenant it was uploaded to,
+        and a webhook alert must never link a finding to a console that can
+        no longer resolve it."""
+        with self._lock:
+            self._connection.execute("DELETE FROM schema_meta WHERE key = ?", (_FLEET_CONSOLE,))
+
     def baseline_complete(self) -> bool:
         """Whether the stored baseline rows came from a complete backfill.
         False until one has: a store whose backfill never completed has no
@@ -2467,9 +2500,21 @@ class FindingStore:
     #: the gate (cost-notifications §2.2).
     _ANY_SEVERITY = frozenset({"stacktrace-cost-runaway-session"})
 
+    #: Rules that notify at `medium` confidence when their severity is `high`.
+    #: Credential egress: a credential that left is as serious however its
+    #: egress was seen, and `curl`, `gh` or `ssh` is read from the command
+    #: string, so it is graded `medium` (ADR-0148).
+    _MEDIUM_CONFIDENCE_WHEN_HIGH = frozenset({"stacktrace-credential-egress"})
+
     @staticmethod
     def _eligible(finding: dict[str, object]) -> bool:
-        return finding.get("confidence") == "high" and (
+        confidence = finding.get("confidence")
+        sure = confidence == "high" or (
+            confidence == "medium"
+            and finding.get("severity") == "high"
+            and finding.get("rule_id") in FindingStore._MEDIUM_CONFIDENCE_WHEN_HIGH
+        )
+        return sure and (
             finding.get("severity") in FindingStore._NOTIFIABLE_SEVERITIES
             or finding.get("rule_id") in FindingStore._ANY_SEVERITY
         )