release: v0.7.0 — richer tool observability (full argv + cwd)

The exec probe captures argv[0..] in-kernel (up to 12x64B) — the agent's intent (curl <url>,
sh -c '<cmd>'), not just the binary — and the collector fills cwd from /proc/<pid>/cwd.
Host-validated: a marker exec surfaced its full argv + cwd. Folds in the heartbeat-write
warning. 0.6.0 -> 0.7.0.

Author: RoyLin

CHANGELOG.md

@@ -2,10 +2,14 @@
 
 All notable changes to a3s-observer will be documented in this file.
 
-## [Unreleased]
+## [0.7.0] — richer tool observability (full argv + cwd)
 
-### Changed
+### Added / Changed
 
+- **Full command line on `ToolExec`** — the exec probe captures `argv[0..]` in-kernel (up to 12
+  args × 64 bytes), not just the binary, so an agent's *intent* is visible
+  (`curl --url=… "two words"`, `sh -c "<cmd>"`); the working directory (`cwd`) is filled from
+  `/proc/<pid>/cwd`. Host-validated: a marker exec surfaced its full argv + cwd.
 - The collector warns if the liveness heartbeat write fails — an unwritable
   `A3S_OBSERVER_HEARTBEAT` path would otherwise cause a silent livenessProbe restart-loop.
 

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer"
-version = "0.6.0"
+version = "0.7.0"
 edition = "2021"
 license = "MIT"
 description = "General-purpose, language-agnostic eBPF observability for AI agents (LLM calls, tools, files, network egress)."

Cargo.toml

@@ -43,7 +43,7 @@ latency / TTFT, or plaintext) / **where** (peer IP / hostname).
 
 | signal | kernel hook | event |
 |---|---|---|
-| `exec` | `sys_enter_execve` | `ToolExec` — tool / subprocess (argv, comm, uid) |
+| `exec` | `sys_enter_execve` | `ToolExec` — tool / subprocess: **full argv** + cwd, comm, uid |
 | `connect` | `sys_enter_connect` | `Egress` — peer IP:port |
 | `sni` | TLS ClientHello (plaintext `server_name`) | LLM **provider** + endpoint |
 | `dns` | `sendto` / `sendmsg` / `sendmmsg` to :53 | `Dns` — resolved hostname |
@@ -63,7 +63,8 @@ in-kernel `comm` fallback for short-lived processes), a `(pid,fd)→peer` **corr
  "req_bytes":284,"resp_bytes":3832,"latency":{"secs":1,"nanos":210000000},
  "ttft":{"secs":0,"nanos":410000000}}}}
 {"identity":{"agent":"python3","task":"1903","session":null},"provider":null,
- "event":{"ToolExec":{"pid":1903,"ppid":1841,"argv":["/usr/bin/git"],"cwd":""}}}
+ "event":{"ToolExec":{"pid":1903,"ppid":1841,
+ "argv":["git","clone","https://github.com/acme/repo"],"cwd":"/home/agent/work"}}}
 {"identity":{"agent":"python3","task":"1841","session":null},"provider":null,
  "event":{"SslContent":{"pid":1841,"is_read":false,
  "content":"POST /v1/messages HTTP/1.1\r\nHost: api.anthropic.com\r\n..."}}}

README.md

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-collector"
-version = "0.6.0"
+version = "0.7.0"
 edition = "2021"
 license = "MIT"
 description = "a3s-observer collector: loads the eBPF probes and exports enriched events."

a3s-observer-collector/Cargo.toml

@@ -216,8 +216,8 @@ async fn main() -> anyhow::Result<()> {
                             event: AgentEvent::ToolExec {
                                 pid: ev.pid,
                                 ppid: read_ppid(ev.pid),
-                                argv: argv_of(&ev.filename),
-                                cwd: String::new(),
+                                argv: argv_of(&ev),
+                                cwd: read_cwd(ev.pid),
                             },
                         });
                     }
@@ -387,8 +387,26 @@ fn read_pod<T: Copy>(item: &[u8]) -> Option<T> {
         .then(|| unsafe { core::ptr::read_unaligned(item.as_ptr() as *const T) })
 }
 
-fn argv_of(filename: &[u8; 128]) -> Vec<String> {
-    vec![cstr(filename)]
+/// Full argv (argv[0..argc]) captured in-kernel; falls back to the binary path if none.
+fn argv_of(ev: &ExecEvent) -> Vec<String> {
+    let n = (ev.argc as usize).min(ev.args.len());
+    let argv: Vec<String> = ev.args[..n]
+        .iter()
+        .map(|a| cstr(a))
+        .filter(|s| !s.is_empty())
+        .collect();
+    if argv.is_empty() {
+        vec![cstr(&ev.filename)]
+    } else {
+        argv
+    }
+}
+
+/// The process's current working directory (≈ exec-time for a fresh process).
+fn read_cwd(pid: u32) -> String {
+    std::fs::read_link(format!("/proc/{pid}/cwd"))
+        .map(|p| p.to_string_lossy().into_owned())
+        .unwrap_or_default()
 }
 
 /// A NUL-terminated byte buffer (from a kernel copy) as a lossy String.

a3s-observer-collector/src/main.rs

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-common"
-version = "0.6.0"
+version = "0.7.0"
 edition = "2021"
 license = "MIT"
 description = "Shared no_std types crossing the eBPF <-> userspace boundary for a3s-observer."

a3s-observer-common/Cargo.toml

@@ -8,14 +8,21 @@
 ///
 /// This is the language-agnostic "tool ran" signal — AgentSight's flagship is catching
 /// subprocesses that bypass app-level instrumentation, and this is how we see them.
+/// Up to `ARGV_SLOTS` arguments, each truncated to `ARG_LEN` bytes, are captured per exec —
+/// the args carry the agent's intent (`curl <url>`, `sh -c "<cmd>"`), not just the binary.
+pub const ARGV_SLOTS: usize = 12;
+pub const ARG_LEN: usize = 64;
+
 #[repr(C)]
 #[derive(Clone, Copy)]
 pub struct ExecEvent {
     pub pid: u32,
     pub ppid: u32,
     pub uid: u32,
+    pub argc: u32, // number of args captured into `args` (may be < the real argc)
     pub comm: [u8; 16],
     pub filename: [u8; 128],
+    pub args: [[u8; ARG_LEN]; ARGV_SLOTS], // argv[0..argc], each NUL-terminated
 }
 
 /// The leading bytes of an outbound TLS ClientHello, captured at the send syscall.

a3s-observer-common/src/lib.rs

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-ebpf"
-version = "0.6.0"
+version = "0.7.0"
 edition = "2021"
 license = "MIT"
 publish = false

a3s-observer-ebpf/Cargo.toml

@@ -2,8 +2,8 @@
 #![no_main]
 
 use a3s_observer_common::{
-    ConnectEvent, DnsEvent, ExecEvent, FileEvent, LlmEvent, SslEvent, TlsEvent, DNS_SNAP_LEN,
-    PATH_SNAP_LEN, SSL_SNAP_LEN, TLS_SNAP_LEN,
+    ConnectEvent, DnsEvent, ExecEvent, FileEvent, LlmEvent, SslEvent, TlsEvent, ARGV_SLOTS,
+    ARG_LEN, DNS_SNAP_LEN, PATH_SNAP_LEN, SSL_SNAP_LEN, TLS_SNAP_LEN,
 };
 use aya_ebpf::{
     helpers::gen::bpf_probe_read_user,
@@ -122,6 +122,22 @@ fn try_exec(ctx: &TracePointContext) -> Result<u32, i64> {
         if let Ok(filename_ptr) = ctx.read_at::<*const u8>(16) {
             let _ = bpf_probe_read_user_str_bytes(filename_ptr, &mut (*ev).filename);
         }
+        // `const char *const *argv` at offset 24 — capture up to ARGV_SLOTS args (the intent:
+        // which URL / which command, not just the binary). Bounded for the verifier.
+        (*ev).argc = 0;
+        (*ev).args = [[0u8; ARG_LEN]; ARGV_SLOTS];
+        if let Ok(argv) = ctx.read_at::<*const u8>(24) {
+            for i in 0..ARGV_SLOTS {
+                let Some(argp) = read_user_u64(argv.add(i * 8)) else {
+                    break;
+                };
+                if argp == 0 {
+                    break; // end of argv
+                }
+                let _ = bpf_probe_read_user_str_bytes(argp as *const u8, &mut (*ev).args[i]);
+                (*ev).argc += 1;
+            }
+        }
     }
     entry.submit(0);
     Ok(0)