feat(ai): attach reporting machine/user to agent activity

Send the discovered UserInfo (machine_id + hostname/username/email) with every
agent-activity batch so GitGuardian can attribute the records and correlate
them with the machine inventory (the machine_id matches the machine scan).
Reuses the user already gathered for discovery.

Issue: NHI-1628

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: amascia-gg

ggshield/cmd/ai/discover.py

@@ -82,7 +82,9 @@ def discover_cmd(
         save_discovery_cache(config)
         if scan_history:
             backfill_report = backfill_mcp_history(client, config)
-            activity_report = collect_agent_activity(client, AGENTS.values())
+            activity_report = collect_agent_activity(
+                client, config.user, AGENTS.values()
+            )
     except Exception as exc:
         if "missing the following scope:" in str(exc):
             scope = str(exc).split("missing the following scope:")[1].strip()

ggshield/verticals/ai/agent_activity/orchestrator.py

@@ -6,7 +6,7 @@
 
 import requests
 from pygitguardian import GGClient
-from pygitguardian.models import Detail
+from pygitguardian.models import Detail, UserInfo
 
 from ggshield.verticals.ai.agent_activity.models import AgentActivityEvent
 
@@ -40,13 +40,13 @@ class AgentActivityReport:
 
 
 def send_agent_activity_batch(
-    client: GGClient, events: List[AgentActivityEvent]
+    client: GGClient, events: List[AgentActivityEvent], user: UserInfo
 ) -> AgentActivityBatchResult:
-    """Serialise events and submit them as one batch."""
+    """Serialise events and submit them as one batch (with the reporting user)."""
     if not events:
         return AgentActivityBatchResult(ingested=0, duplicates=0, success=True)
     payload = [e.to_dict() for e in events]
-    response = client.send_agent_activity(payload)
+    response = client.send_agent_activity(payload, user=user.to_dict())
     if isinstance(response, Detail):
         logger.warning("agent_activity: API returned an error: %s", response.detail)
         return AgentActivityBatchResult(ingested=0, duplicates=0, success=False)
@@ -58,9 +58,13 @@ def send_agent_activity_batch(
 
 
 def collect_agent_activity(
-    client: GGClient, agents: "Iterable[Agent]"
+    client: GGClient, user: UserInfo, agents: "Iterable[Agent]"
 ) -> AgentActivityReport:
-    """Walk each agent's raw sources and ship records in BATCH_SIZE-event batches."""
+    """Walk each agent's raw sources and ship records in BATCH_SIZE-event batches.
+
+    user (the reporting machine/user) is attached to every batch so
+    the server can attribute the activity and correlate it with the machine scan.
+    """
     report = AgentActivityReport()
     buffer: List[AgentActivityEvent] = []
     buffer_bytes = 0
@@ -70,7 +74,7 @@ def flush() -> None:
         if not buffer:
             return
         try:
-            result = send_agent_activity_batch(client, list(buffer))
+            result = send_agent_activity_batch(client, list(buffer), user)
         except requests.exceptions.RequestException as exc:
             logger.warning(
                 "agent_activity: batch of %d events failed: %s", len(buffer), exc

tests/unit/verticals/ai/agent_activity/test_orchestrator.py

@@ -1,7 +1,7 @@
 from unittest.mock import MagicMock
 
 import requests
-from pygitguardian.models import Detail
+from pygitguardian.models import Detail, UserInfo
 
 from ggshield.verticals.ai.agent_activity.models import AgentActivityEvent
 from ggshield.verticals.ai.agent_activity.orchestrator import (
@@ -12,6 +12,9 @@
 )
 
 
+_USER = UserInfo(hostname="dev-laptop", username="dev", machine_id="machine-001")
+
+
 def test_send_agent_activity_batch_serialises_and_calls_client() -> None:
     client = MagicMock()
     client.send_agent_activity.return_value = MagicMock(
@@ -33,7 +36,7 @@ def test_send_agent_activity_batch_serialises_and_calls_client() -> None:
             content='{"key": "bubbleId:abc:xyz", "value": "{"y": 2}"}',
         ),
     ]
-    result = send_agent_activity_batch(client, events)
+    result = send_agent_activity_batch(client, events, _USER)
     client.send_agent_activity.assert_called_once_with(
         [
             {
@@ -51,13 +54,14 @@ def test_send_agent_activity_batch_serialises_and_calls_client() -> None:
                 "content": '{"key": "bubbleId:abc:xyz", "value": "{"y": 2}"}',
             },
         ],
+        user=_USER.to_dict(),
     )
     assert result.ingested == 2
 
 
 def test_send_agent_activity_batch_empty_list_short_circuits() -> None:
     client = MagicMock()
-    result = send_agent_activity_batch(client, [])
+    result = send_agent_activity_batch(client, [], _USER)
     client.send_agent_activity.assert_not_called()
     assert result.ingested == 0
 
@@ -66,7 +70,7 @@ def test_send_agent_activity_batch_treats_detail_as_failure() -> None:
     """An API error (Detail) is reported as a failed batch, not an ingest."""
     client = MagicMock()
     client.send_agent_activity.return_value = Detail("boom", status_code=500)
-    result = send_agent_activity_batch(client, [_event("a", 1)])
+    result = send_agent_activity_batch(client, [_event("a", 1)], _USER)
     assert result.success is False
     assert result.ingested == 0
     assert result.duplicates == 0
@@ -75,7 +79,7 @@ def test_send_agent_activity_batch_treats_detail_as_failure() -> None:
 def test_collect_agent_activity_counts_detail_response_as_failed_batch() -> None:
     client = MagicMock()
     client.send_agent_activity.return_value = Detail("boom", status_code=500)
-    report = collect_agent_activity(client, [_make_agent("a", [_event("a", 1)])])
+    report = collect_agent_activity(client, _USER, [_make_agent("a", [_event("a", 1)])])
     assert report.parsed == 1
     assert report.ingested == 0
     assert report.failed_batches == 1
@@ -98,6 +102,18 @@ def _event(agent_name: str, i: int) -> AgentActivityEvent:
     )
 
 
+def test_collect_agent_activity_attaches_user_to_each_batch() -> None:
+    client = MagicMock()
+    client.send_agent_activity.return_value = MagicMock(
+        success=True, ingested=1, duplicates=0
+    )
+    collect_agent_activity(client, _USER, [_make_agent("a", [_event("a", 1)])])
+
+    _, kwargs = client.send_agent_activity.call_args
+    assert kwargs["user"] == _USER.to_dict()
+    assert kwargs["user"]["machine_id"] == "machine-001"
+
+
 def test_collect_agent_activity_batches_in_chunks_of_batch_size() -> None:
     """An agent yielding more than BATCH_SIZE events triggers multiple sends."""
     events = [_event("a", i) for i in range(BATCH_SIZE + 3)]
@@ -107,7 +123,7 @@ def test_collect_agent_activity_batches_in_chunks_of_batch_size() -> None:
         success=True, ingested=BATCH_SIZE, duplicates=0
     )
 
-    report = collect_agent_activity(client, [agent])
+    report = collect_agent_activity(client, _USER, [agent])
 
     assert client.send_agent_activity.call_count == 2
     assert report.parsed == BATCH_SIZE + 3
@@ -122,7 +138,7 @@ def test_collect_agent_activity_aggregates_per_agent_counts() -> None:
     )
 
     report = collect_agent_activity(
-        client, [_make_agent("a", events_a), _make_agent("b", events_b)]
+        client, _USER, [_make_agent("a", events_a), _make_agent("b", events_b)]
     )
 
     assert report.parsed == 2
@@ -131,7 +147,7 @@ def test_collect_agent_activity_aggregates_per_agent_counts() -> None:
 
 def test_collect_agent_activity_handles_empty_agents() -> None:
     client = MagicMock()
-    report = collect_agent_activity(client, [_make_agent("a", [])])
+    report = collect_agent_activity(client, _USER, [_make_agent("a", [])])
     client.send_agent_activity.assert_not_called()
     assert report.parsed == 0
 
@@ -152,7 +168,7 @@ def test_collect_agent_activity_flushes_on_byte_threshold() -> None:
     client = MagicMock()
     client.send_agent_activity.return_value = MagicMock(ingested=1, duplicates=0)
 
-    report = collect_agent_activity(client, [_make_agent("a", events)])
+    report = collect_agent_activity(client, _USER, [_make_agent("a", events)])
 
     # 3 oversized events => 3 separate sends, none waiting for the 500 count.
     assert client.send_agent_activity.call_count == 3
@@ -163,7 +179,7 @@ def test_collect_agent_activity_counts_network_error_as_failed_batch() -> None:
     """A network error while sending a batch is counted as a failed batch."""
     client = MagicMock()
     client.send_agent_activity.side_effect = requests.exceptions.ConnectionError("down")
-    report = collect_agent_activity(client, [_make_agent("a", [_event("a", 1)])])
+    report = collect_agent_activity(client, _USER, [_make_agent("a", [_event("a", 1)])])
 
     assert report.parsed == 1
     assert report.ingested == 0