@drakon-systems/shieldcortex-realtime 4.47.35 → 4.47.37

package/dist/conversation-access.js

@@ -0,0 +1,69 @@
+/**
+ * #225 phase 1 — the plugin-side copy of the conversation-access grant reader.
+ *
+ * Duplicated from `src/integrations/openclaw-conversation-access.ts` because
+ * the plugin is a separate build with no `src/` imports (same boundary as the
+ * reviewed-script allowlist and the fallback guard patterns). The two copies
+ * are held together by a parity test — see
+ * `src/__tests__/conversation-access-honesty-225.test.ts`.
+ *
+ * Why the plugin needs it at all: the startup line announced
+ * `registered (llm_input + llm_output + …)` unconditionally, on hosts where
+ * OpenClaw had just dropped both for want of the grant. The plugin cannot
+ * observe that rejection (the host emits it as its own diagnostic and `api.on`
+ * returns void), so it must read the same config the host reads and describe
+ * only what will actually be live.
+ */
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+/** Pure: evaluate a parsed openclaw.json object. */
+export function evaluateConversationAccess(config, pluginId) {
+    if (!config || typeof config !== 'object') {
+        return { granted: false, readable: false, entryPresent: false };
+    }
+    const plugins = config.plugins;
+    const entries = plugins && typeof plugins === 'object'
+        ? plugins.entries
+        : undefined;
+    const entry = entries && typeof entries === 'object'
+        ? entries[pluginId]
+        : undefined;
+    if (!entry || typeof entry !== 'object') {
+        return { granted: false, readable: true, entryPresent: false };
+    }
+    const hooks = entry.hooks;
+    const raw = hooks && typeof hooks === 'object'
+        ? hooks.allowConversationAccess
+        : undefined;
+    // Strict `true`, matching OpenClaw's own `!== true` comparison exactly.
+    return { granted: raw === true, readable: true, entryPresent: true };
+}
+/** Read `~/.openclaw/openclaw.json` and evaluate the grant. Never throws. */
+export function readConversationAccess(home, pluginId) {
+    try {
+        const raw = readFileSync(path.join(home, '.openclaw', 'openclaw.json'), 'utf-8');
+        return evaluateConversationAccess(JSON.parse(raw), pluginId);
+    }
+    catch {
+        return { granted: false, readable: false, entryPresent: false };
+    }
+}
+/**
+ * The hooks this plugin can honestly claim at startup. Conversation hooks are
+ * only listed when the host will actually keep them.
+ */
+export function describeRegisteredHooks(opts) {
+    const live = [];
+    if (opts.access.granted)
+        live.push('llm_input', 'llm_output');
+    if (opts.beforeToolCallRegistered)
+        live.push('before_tool_call');
+    live.push('/shieldcortex-status');
+    let line = live.join(' + ');
+    if (!opts.access.granted) {
+        line += opts.access.readable
+            ? ' — conversation scanning INACTIVE (llm_input/llm_output dropped by OpenClaw: set plugins.entries.shieldcortex-realtime.hooks.allowConversationAccess=true to enable)'
+            : ' — conversation scanning state UNKNOWN (could not read openclaw.json)';
+    }
+    return line;
+}

package/dist/conversation-trust.js

@@ -0,0 +1,72 @@
+/**
+ * Source trust for conversation content.
+ *
+ * The operator's own typing is the highest-trust input that exists. Treating it
+ * as a possible attack is nearly pure cost: it produces false alarms, and false
+ * alarms are how a security control gets switched off. "Delete the old logs"
+ * typed by the owner is an INSTRUCTION, not an injection.
+ *
+ * The rule this encodes:
+ *
+ *     the human speaks instructions; everything else is data.
+ *
+ * Two things it deliberately does NOT do:
+ *
+ * 1. **It does not trust the channel.** Telegram is a trusted pipe, but a web
+ *    page pasted into Telegram is untrusted content arriving through it.
+ *    Riding a trusted channel is prompt injection's entire trick, so only the
+ *    SENDER can confer trust — never the transport.
+ *
+ * 2. **It does not treat agent-to-agent traffic as trusted.** This is the
+ *    counterintuitive one. If agent A reads a poisoned issue and relays it to
+ *    agent B over a closed platform, the platform being closed is exactly what
+ *    lets the injection spread — a confused deputy with good transport. Anything
+ *    whose sender is not provably the owner is data.
+ *
+ *    ShieldCortex's memory side already says this: a sub-agent write has its
+ *    trust cut per level away from the human and lands in a hold band. This is
+ *    the same principle applied to the conversation path.
+ *
+ * IMPORTANT — trust gates the CONSEQUENCE, not the detection. Content is always
+ * scanned and a detection is always audited, whatever its origin; trust decides
+ * only whether that detection may escalate the Action Guard (#233). Skipping the
+ * scan would trade away visibility, which is what got us into #225 in the first
+ * place. This keeps the operator's false-alarm cost at zero without going blind.
+ */
+export function classifyConversationOrigin(input) {
+    // Strict `=== true`. A missing or non-boolean flag is NOT the owner: on a host
+    // or host version that does not supply it, defaulting to "trusted" would
+    // silently disable escalation everywhere. Unknown fails toward caution.
+    const isOwner = input.senderIsOwner === true;
+    const trustOwner = input.trustOwnerInput !== false;
+    if (isOwner && trustOwner) {
+        return {
+            origin: 'owner',
+            scan: true,
+            mayTaint: false,
+            reason: 'sender is the gateway owner — their input is an instruction, not an injection vector',
+        };
+    }
+    if (isOwner && !trustOwner) {
+        return {
+            origin: 'owner',
+            scan: true,
+            mayTaint: true,
+            reason: 'sender is the owner, but conversationTrust.trustOwnerInput is disabled on this host',
+        };
+    }
+    if (input.senderIsOwner === false) {
+        return {
+            origin: 'non-owner',
+            scan: true,
+            mayTaint: true,
+            reason: 'sender is not the owner — treated as data, including another agent on a trusted channel',
+        };
+    }
+    return {
+        origin: 'unknown',
+        scan: true,
+        mayTaint: true,
+        reason: 'sender unknown (host did not supply senderIsOwner) — cannot prove owner, so treated as data',
+    };
+}

package/dist/index.js

@@ -13,6 +13,9 @@ import { existsSync, readFileSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { readConversationAccess, describeRegisteredHooks } from './conversation-access.js';
+import { createSessionTaintStore } from './session-taint.js';
+import { classifyConversationOrigin } from './conversation-trust.js';
 import { createInterceptor, DEFAULT_CONFIG as DEFAULT_INTERCEPTOR_CONFIG } from './interceptor.js';
 import { syncInterceptEvent } from './intercept-ingest.js';
 import { cloudSync } from './cloud-sync.js';
@@ -134,6 +137,11 @@ async function getDefenceModule() {
     return _defenceModPromise;
 }
 // Test seams (jest only): inject a stub defence module / spy runtime, then reset.
+/** Test seam for the conversation-taint store — lets a test assert that a
+ *  detection actually reached the store (or, for owner input, did not). */
+export function __getSessionTaintForTest() {
+    return sessionTaint;
+}
 export function __setDefenceModuleForTest(mod) {
     _defenceModOverride = mod;
     _defenceModPromise = null;
@@ -155,6 +163,13 @@ const INTERCEPT_SEVERITIES = ['low', 'medium', 'high', 'critical'];
 const INTERCEPT_ACTIONS = ['log', 'warn', 'require_approval'];
 const FAILURE_ACTIONS = ['allow', 'deny'];
 const PLUGIN_ID = "shieldcortex-realtime";
+/**
+ * #233: conversation-level taint, shared between the conversation scan (which
+ * writes it) and the Action Guard (which reads it). Both run in THIS process,
+ * so an in-memory store is the whole mechanism — keyed per session because one
+ * gateway serves many concurrent chats.
+ */
+const sessionTaint = createSessionTaintStore();
 const PLUGIN_PACKAGE_NAME = "@drakon-systems/shieldcortex-realtime";
 const PLUGIN_CONFIG_UI_HINTS = {
     binaryPath: {
@@ -859,6 +874,24 @@ function isInternalContent(text) {
 export async function scanLlmInput(event, _ctx) {
     try {
         // Only scan user content, skip system/boot/heartbeat prompts
+        // Trust is resolved per TURN, not per message: the host tells us who sent
+        // this turn, but history messages carry no individual attribution, so there
+        // is no honest way to score them separately.
+        //
+        // Resolved LAZILY, on first detection only. Computing it up front would put
+        // a config read on every single turn to answer a question that only matters
+        // when something is actually found.
+        let trustMemo = null;
+        const resolveTrust = async () => {
+            if (!trustMemo) {
+                trustMemo = classifyConversationOrigin({
+                    senderIsOwner: event.senderIsOwner,
+                    trustOwnerInput: (await loadConfig())
+                        ?.conversationTrust?.trustOwnerInput,
+                });
+            }
+            return trustMemo;
+        };
         const userTexts = extractUserContent(event.historyMessages).slice(-5);
         const texts = [event.prompt, ...userTexts].filter(t => t && !isInternalContent(t));
         for (const text of texts) {
@@ -866,7 +899,22 @@ export async function scanLlmInput(event, _ctx) {
                 continue;
             const result = await scanRealtimeContent(text);
             if (!result.clean) {
-                console.warn(`[shieldcortex] ⚠️ Threat in LLM input: ${result.summary}`);
+                const trust = await resolveTrust();
+                console.warn(`[shieldcortex] ⚠️ Threat in LLM input: ${result.summary} [${trust.origin}]`);
+                // #233: THE sink that has teeth. Logging a detection changed nothing —
+                // the tool call this injection is steering, one turn later, was
+                // evaluated as if it had never been seen. Tainting the session makes
+                // the Action Guard tighten by one notch for a bounded window.
+                //
+                // Source trust gates the CONSEQUENCE, never the detection: the warn and
+                // the audit row above happen whoever sent this. What trust decides is
+                // whether it may tighten the guard. The operator typing "delete the old
+                // logs" is an instruction, and treating it as an attack is the false
+                // alarm that gets a control switched off. Everything the agent was
+                // handed — including another agent on a closed channel — is data.
+                if (trust.mayTaint) {
+                    sessionTaint.mark(event.sessionId, { reason: `conversation scan: ${result.summary}` });
+                }
                 const entry = {
                     type: "threat", hook: "llm_input", sessionId: event.sessionId,
                     model: event.model, reason: result.summary,
@@ -989,11 +1037,12 @@ function buildTypedApprovalRequest(message) {
         allowedDecisions: ["allow-once", "deny"],
     };
 }
-async function handleTypedBeforeToolCall(event, interceptor, logger) {
+async function handleTypedBeforeToolCall(event, interceptor, logger, sessionId) {
     try {
         await interceptor.handleToolCall({
             toolName: event.toolName,
             arguments: event.params ?? {},
+            sessionId,
             requireApproval: async (message) => {
                 throw new TypedApprovalRequest(message, buildTypedApprovalRequest(message));
             },
@@ -1168,6 +1217,13 @@ export default {
                             ? defenceMod.evaluateToolCall
                             : undefined,
                         broker: resolveBrokerRuntime(defenceMod, interceptorConfig.actionGuard?.broker, api),
+                        // #233: the read side of conversation taint. Returns null for a clean
+                        // or unknown session, so the guard behaves exactly as before unless a
+                        // conversation detection actually happened in THIS session.
+                        sessionTaint: (sessionId) => {
+                            const rec = sessionId ? sessionTaint.get(sessionId) : null;
+                            return rec ? { reason: rec.reason } : null;
+                        },
                         onAuditEntry: (entry) => syncInterceptEvent(entry, {
                             cloudApiKey: scConfig.cloudApiKey ?? '',
                             cloudBaseUrl: scConfig.cloudBaseUrl ?? 'https://api.shieldcortex.ai',
@@ -1203,17 +1259,25 @@ export default {
             if (!interceptorDisabledInHostConfig) {
                 // Typed before_tool_call hook: this is the OpenClaw agent-loop gate that
                 // can block or require approval before the selected tool executes.
-                api.on('before_tool_call', async (event) => {
+                api.on('before_tool_call', async (event, ctx) => {
                     const interceptor = await initInterceptor();
                     if (!interceptor)
                         return;
-                    return handleTypedBeforeToolCall(event, interceptor, api.logger);
+                    // #233: the host supplies the session on the tool CONTEXT, not the
+                    // event. Without it a taint cannot be matched to the call it should
+                    // gate, so the escalation would silently never fire.
+                    return handleTypedBeforeToolCall(event, interceptor, api.logger, ctx?.sessionId);
                 }, { priority: 80, timeoutMs: 30_000 });
                 _beforeToolCallRegistered = true;
                 // Try to register session_end for cache cleanup (only meaningful while
                 // an interceptor can exist)
                 try {
-                    api.on('session_end', () => { interceptorReady?.resetSession(); });
+                    api.on('session_end', (ev) => {
+                        interceptorReady?.resetSession();
+                        // #233: a taint must not outlive the conversation that earned it.
+                        if (ev?.sessionId)
+                            sessionTaint.clear(ev.sessionId);
+                    });
                 }
                 catch {
                     // session_end may not be a supported hook — TTL safety net handles this
@@ -1222,9 +1286,25 @@ export default {
             else {
                 api.logger?.info?.('[shieldcortex] interceptor.enabled:false in plugin config — before_tool_call hook not registered');
             }
+            // These two are CONVERSATION hooks: OpenClaw drops them at registration
+            // for a non-bundled plugin unless the host grants
+            // plugins.entries.<id>.hooks.allowConversationAccess = true. We still
+            // attempt registration (the host decides, and the grant can be added
+            // without a code change), but we must not CLAIM them afterwards — see the
+            // honesty note on the log line below (#225).
             api.on("llm_input", handleLlmInput, { timeoutMs: 30_000 });
             api.on("llm_output", handleLlmOutput, { timeoutMs: 30_000 });
-            api.logger.info(`[shieldcortex] v${_version} registered (llm_input + llm_output${_beforeToolCallRegistered ? " + before_tool_call" : ""} + /shieldcortex-status)`);
+            // #225: this line used to announce `llm_input + llm_output` unconditionally.
+            // On any host without the conversation-access grant the gateway logged, on
+            // the very next two lines, that it had dropped both — so ShieldCortex was
+            // claiming conversation protection it did not have, in the one place an
+            // operator looks to confirm startup. Report only what is actually live, and
+            // name the missing grant when it is the reason.
+            const conversationAccess = readConversationAccess(homedir(), PLUGIN_ID);
+            api.logger.info(`[shieldcortex] v${_version} registered (${describeRegisteredHooks({
+                access: conversationAccess,
+                beforeToolCallRegistered: _beforeToolCallRegistered,
+            })})`);
         }
         catch (err) {
             // Plugin must never block channel startup — warn and bail gracefully.

package/dist/interceptor.js

@@ -3,6 +3,7 @@ import { mkdirSync, appendFileSync, readFileSync, realpathSync, statSync } from
 import { join, isAbsolute, resolve as resolvePath } from 'node:path';
 import { homedir } from 'node:os';
 import { createGatewayInvoker } from './broker-invoker.js';
+import { escalateForTaint } from './session-taint.js';
 const WATCHED_TOOLS = ['remember', 'mcp__memory__remember'];
 const CONTENT_FIELDS = {
     remember: ['content', 'title'],
@@ -693,6 +694,44 @@ export function createInterceptor(config, pipeline, options) {
             handleGuardUnavailable(context, `action-guard error: ${err instanceof Error ? err.message : err}`);
             return;
         }
+        // #233: a prompt injection detected on the CONVERSATION path earlier in this
+        // session tightens the guard by one notch for a bounded window — sensitive
+        // work starts asking, dangerous work stops. Benign work is untouched: an
+        // agent that cannot read a file is useless, and a taint response that halts
+        // ordinary work is one operators switch off.
+        //
+        // This is the enforcement answer instead of blocking the turn itself
+        // (see docs/design/2026-08-10-conversation-taint-escalation.md): the guard
+        // is already trusted, already gates actions, and a false positive here
+        // costs an approval prompt rather than the user's message.
+        //
+        // Failure is soft by construction — no taint lookup, or a throwing one,
+        // simply means no escalation. This must never become a way for a broken
+        // scanner to start denying tool calls.
+        let taint = null;
+        try {
+            taint = options?.sessionTaint?.(context.sessionId) ?? null;
+        }
+        catch {
+            taint = null;
+        }
+        let escalation;
+        if (taint) {
+            const esc = escalateForTaint({
+                decision: v.decision,
+                severity: v.severity,
+                tainted: true,
+            });
+            if (esc.escalated) {
+                log.warn(`[shieldcortex] action-guard ESCALATED ${context.toolName}: ${v.decision} → ${esc.decision} (tainted session: ${taint.reason})`);
+                // Recorded STRUCTURALLY, not just in the reason string: the audit entry
+                // has no reason field, so an escalation folded into the verdict text
+                // would vanish from the durable record — invisible in exactly the
+                // forensic view that needs it.
+                escalation = { by: 'session-taint', from: v.decision, to: esc.decision, reason: taint.reason };
+                v = { ...v, decision: esc.decision, reason: `${v.reason} — ESCALATED by tainted session: ${taint.reason}` };
+            }
+        }
         if (v.decision === 'allow') {
             // Issue #95: a RECOGNISED allow (the guard evaluated a known operation
             // family and let it through — severity above benign) leaves an audit
@@ -706,7 +745,7 @@ export function createInterceptor(config, pipeline, options) {
             return;
         }
         const preview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`;
-        const base = guardAuditBase(context.toolName, v, preview);
+        const base = { ...guardAuditBase(context.toolName, v, preview), ...(escalation ? { escalated: escalation } : {}) };
         const severity = v.severity === 'catastrophic' ? 'critical' : 'high';
         // Catastrophic / exfil — hard block, always enforced when the guard is enabled.
         if (v.decision === 'block') {

package/dist/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "shieldcortex-realtime",
-  "version": "4.47.35",
+  "version": "4.47.37",
   "name": "ShieldCortex Real-time Scanner",
   "description": "Real-time defence scanning on LLM input, memory extraction on LLM output, and active tool call interception with approval gating.",
   "kind": null,

package/dist/session-taint.js

@@ -0,0 +1,130 @@
+/**
+ * Session taint → Action Guard escalation (issue #233).
+ *
+ * The hole this closes: the conversation-scan path and the Action Guard share
+ * NO state today. `scanLlmInput` detects a prompt injection, writes a log line
+ * and a JSONL row that nothing reads back, and the tool call that injection is
+ * steering — one turn later — is evaluated as if nothing had happened.
+ *
+ * The fix is deliberately NOT to block the turn. `before_agent_run` is
+ * fail-closed with a 15s budget the host owns, so every ShieldCortex fault
+ * (throw, timeout, a stray `null`) becomes a dead user turn, and a false
+ * positive destroys the user's message irrecoverably. See
+ * docs/design/2026-08-10-conversation-taint-escalation.md.
+ *
+ * Instead: a detection TAINTS the session, and the Action Guard — which
+ * already gates actions, is already trusted, and is not a conversation hook —
+ * reads that taint and tightens by one notch for a bounded window. The agent
+ * keeps thinking; it just needs a human before it does anything consequential.
+ *
+ * Both the conversation scan and the interceptor run in the SAME gateway
+ * process, so this store is in-memory by design. It is keyed per session
+ * because one gateway serves many concurrent chats — a process-global flag
+ * would leak one conversation's taint onto every other conversation's tools.
+ */
+/** How long a single detection keeps a session tainted. */
+export const TAINT_TTL_MS = 15 * 60_000;
+/** Hard cap on tracked sessions — a long-lived gateway must not grow forever. */
+export const MAX_TAINTED_SESSIONS = 500;
+export function createSessionTaintStore() {
+    const records = new Map();
+    function prune(nowMs) {
+        for (const [id, rec] of records) {
+            if (rec.expiresAtMs <= nowMs)
+                records.delete(id);
+        }
+        // Still over cap after expiry (many live sessions): drop the oldest marks.
+        // Evicting the OLDEST is the safe direction — the most recent detections
+        // are the ones whose tool calls have not happened yet.
+        if (records.size > MAX_TAINTED_SESSIONS) {
+            const bySeniority = [...records.entries()].sort((a, b) => a[1].markedAtMs - b[1].markedAtMs);
+            for (const [id] of bySeniority.slice(0, records.size - MAX_TAINTED_SESSIONS))
+                records.delete(id);
+        }
+    }
+    return {
+        mark(sessionId, input) {
+            if (!sessionId)
+                return;
+            const nowMs = input.nowMs ?? Date.now();
+            const ttl = input.ttlMs ?? TAINT_TTL_MS;
+            const severity = input.severity ?? 'unknown';
+            const existing = records.get(sessionId);
+            // Re-marking EXTENDS the window and keeps the higher severity — a second
+            // injection in the same session must never shorten the hold or downgrade
+            // it to the newer, milder finding.
+            const next = {
+                sessionId,
+                severity: existing && rank(existing.severity) > rank(severity) ? existing.severity : severity,
+                reason: input.reason,
+                markedAtMs: nowMs,
+                expiresAtMs: Math.max(nowMs + ttl, existing?.expiresAtMs ?? 0),
+            };
+            records.set(sessionId, next);
+            prune(nowMs);
+        },
+        get(sessionId, nowMs = Date.now()) {
+            if (!sessionId)
+                return null;
+            const rec = records.get(sessionId);
+            if (!rec)
+                return null;
+            if (rec.expiresAtMs <= nowMs) {
+                records.delete(sessionId);
+                return null;
+            }
+            return rec;
+        },
+        clear(sessionId) {
+            records.delete(sessionId);
+        },
+        reset() {
+            records.clear();
+        },
+        size() {
+            return records.size;
+        },
+    };
+}
+function rank(s) {
+    switch (s) {
+        case 'critical': return 4;
+        case 'high': return 3;
+        case 'medium': return 2;
+        case 'low': return 1;
+        default: return 0;
+    }
+}
+/**
+ * One notch tighter while tainted. Benign work is untouched on purpose: an
+ * agent that cannot read a file is useless, and a taint response that stops
+ * ordinary work is one operators will switch off.
+ *
+ *   benign        → unchanged (allow)
+ *   sensitive     → require approval   (was allow)
+ *   dangerous     → block              (was require approval)
+ *   catastrophic  → unchanged (already blocked)
+ *
+ * Escalation NEVER downgrades: if the guard already decided something stricter
+ * than the escalated value, the guard wins.
+ */
+export function escalateForTaint(input) {
+    const { decision, severity, tainted } = input;
+    if (!tainted)
+        return { decision, escalated: false };
+    let target = decision;
+    if (severity === 'sensitive')
+        target = 'require_approval';
+    else if (severity === 'dangerous')
+        target = 'block';
+    // Only ever move toward caution.
+    const next = strength(target) > strength(decision) ? target : decision;
+    return { decision: next, escalated: next !== decision };
+}
+function strength(d) {
+    switch (d) {
+        case 'block': return 3;
+        case 'require_approval': return 2;
+        default: return 1;
+    }
+}

package/index.ts

@@ -15,6 +15,9 @@ import path from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
+import { readConversationAccess, describeRegisteredHooks } from './conversation-access.js';
+import { createSessionTaintStore } from './session-taint.js';
+import { classifyConversationOrigin } from './conversation-trust.js';
 import { createInterceptor, DEFAULT_CONFIG as DEFAULT_INTERCEPTOR_CONFIG } from './interceptor.js';
 import type { InterceptorConfig, BrokerRuntime } from './interceptor.js';
 import { syncInterceptEvent } from './intercept-ingest.js';
@@ -170,6 +173,12 @@ async function getDefenceModule(): Promise<DefenceModule | null> {
 }
 
 // Test seams (jest only): inject a stub defence module / spy runtime, then reset.
+/** Test seam for the conversation-taint store — lets a test assert that a
+ *  detection actually reached the store (or, for owner input, did not). */
+export function __getSessionTaintForTest(): typeof sessionTaint {
+  return sessionTaint;
+}
+
 export function __setDefenceModuleForTest(mod: DefenceModule | null | undefined): void {
   _defenceModOverride = mod;
   _defenceModPromise = null;
@@ -190,6 +199,9 @@ export function __resetConfigStateForTest(): void {
 type LlmInputEvent = {
   runId: string; sessionId: string; provider: string; model: string;
   systemPrompt?: string; prompt: string; historyMessages: unknown[]; imagesCount: number;
+  /** Host-supplied: this turn came from the gateway's owner. Absent on hosts
+   *  that do not report it — treated as NOT the owner, never as trusted. */
+  senderIsOwner?: boolean;
 };
 type LlmOutputEvent = {
   runId: string; sessionId: string; provider: string; model: string;
@@ -267,6 +279,14 @@ interface SCConfig {
 }
 
 const PLUGIN_ID = "shieldcortex-realtime";
+
+/**
+ * #233: conversation-level taint, shared between the conversation scan (which
+ * writes it) and the Action Guard (which reads it). Both run in THIS process,
+ * so an in-memory store is the whole mechanism — keyed per session because one
+ * gateway serves many concurrent chats.
+ */
+const sessionTaint = createSessionTaintStore();
 const PLUGIN_PACKAGE_NAME = "@drakon-systems/shieldcortex-realtime";
 const PLUGIN_CONFIG_UI_HINTS = {
   binaryPath: {
@@ -1033,13 +1053,46 @@ function isInternalContent(text: string): boolean {
 export async function scanLlmInput(event: LlmInputEvent, _ctx: AgentCtx): Promise<void> {
   try {
     // Only scan user content, skip system/boot/heartbeat prompts
+    // Trust is resolved per TURN, not per message: the host tells us who sent
+    // this turn, but history messages carry no individual attribution, so there
+    // is no honest way to score them separately.
+    //
+    // Resolved LAZILY, on first detection only. Computing it up front would put
+    // a config read on every single turn to answer a question that only matters
+    // when something is actually found.
+    let trustMemo: ReturnType<typeof classifyConversationOrigin> | null = null;
+    const resolveTrust = async () => {
+      if (!trustMemo) {
+        trustMemo = classifyConversationOrigin({
+          senderIsOwner: event.senderIsOwner,
+          trustOwnerInput: (await loadConfig() as { conversationTrust?: { trustOwnerInput?: boolean } })
+            ?.conversationTrust?.trustOwnerInput,
+        });
+      }
+      return trustMemo;
+    };
     const userTexts = extractUserContent(event.historyMessages).slice(-5);
     const texts = [event.prompt, ...userTexts].filter(t => t && !isInternalContent(t));
     for (const text of texts) {
       if (!text || text.length < 10) continue;
       const result = await scanRealtimeContent(text);
       if (!result.clean) {
-        console.warn(`[shieldcortex] ⚠️ Threat in LLM input: ${result.summary}`);
+        const trust = await resolveTrust();
+        console.warn(`[shieldcortex] ⚠️ Threat in LLM input: ${result.summary} [${trust.origin}]`);
+        // #233: THE sink that has teeth. Logging a detection changed nothing —
+        // the tool call this injection is steering, one turn later, was
+        // evaluated as if it had never been seen. Tainting the session makes
+        // the Action Guard tighten by one notch for a bounded window.
+        //
+        // Source trust gates the CONSEQUENCE, never the detection: the warn and
+        // the audit row above happen whoever sent this. What trust decides is
+        // whether it may tighten the guard. The operator typing "delete the old
+        // logs" is an instruction, and treating it as an attack is the false
+        // alarm that gets a control switched off. Everything the agent was
+        // handed — including another agent on a closed channel — is data.
+        if (trust.mayTaint) {
+          sessionTaint.mark(event.sessionId, { reason: `conversation scan: ${result.summary}` });
+        }
         const entry = {
           type: "threat", hook: "llm_input", sessionId: event.sessionId,
           model: event.model, reason: result.summary,
@@ -1168,11 +1221,13 @@ async function handleTypedBeforeToolCall(
   event: TypedBeforeToolCallEvent,
   interceptor: ReturnType<typeof createInterceptor>,
   logger: PluginApi["logger"],
+  sessionId?: string,
 ): Promise<TypedBeforeToolCallResult | void> {
   try {
     await interceptor.handleToolCall({
       toolName: event.toolName,
       arguments: event.params ?? {},
+      sessionId,
       requireApproval: async (message: string) => {
         throw new TypedApprovalRequest(message, buildTypedApprovalRequest(message));
       },
@@ -1364,6 +1419,13 @@ export default {
             ? ((defenceMod as any).evaluateToolCall as Parameters<typeof createInterceptor>[2] extends { evaluateToolCall?: infer E } ? E : never)
             : undefined,
           broker: resolveBrokerRuntime(defenceMod, interceptorConfig.actionGuard?.broker, api),
+          // #233: the read side of conversation taint. Returns null for a clean
+          // or unknown session, so the guard behaves exactly as before unless a
+          // conversation detection actually happened in THIS session.
+          sessionTaint: (sessionId) => {
+            const rec = sessionId ? sessionTaint.get(sessionId) : null;
+            return rec ? { reason: rec.reason } : null;
+          },
           onAuditEntry: (entry) => syncInterceptEvent(entry, {
             cloudApiKey: (scConfig as any).cloudApiKey ?? '',
             cloudBaseUrl: (scConfig as any).cloudBaseUrl ?? 'https://api.shieldcortex.ai',
@@ -1400,17 +1462,24 @@ export default {
     if (!interceptorDisabledInHostConfig) {
       // Typed before_tool_call hook: this is the OpenClaw agent-loop gate that
       // can block or require approval before the selected tool executes.
-      api.on('before_tool_call', async (event: TypedBeforeToolCallEvent) => {
+      api.on('before_tool_call', async (event: TypedBeforeToolCallEvent, ctx?: { sessionId?: string }) => {
         const interceptor = await initInterceptor();
         if (!interceptor) return;
-        return handleTypedBeforeToolCall(event, interceptor, api.logger);
+        // #233: the host supplies the session on the tool CONTEXT, not the
+        // event. Without it a taint cannot be matched to the call it should
+        // gate, so the escalation would silently never fire.
+        return handleTypedBeforeToolCall(event, interceptor, api.logger, ctx?.sessionId);
       }, { priority: 80, timeoutMs: 30_000 });
       _beforeToolCallRegistered = true;
 
       // Try to register session_end for cache cleanup (only meaningful while
       // an interceptor can exist)
       try {
-        api.on('session_end', () => { interceptorReady?.resetSession(); });
+        api.on('session_end', (ev?: { sessionId?: string }) => {
+          interceptorReady?.resetSession();
+          // #233: a taint must not outlive the conversation that earned it.
+          if (ev?.sessionId) sessionTaint.clear(ev.sessionId);
+        });
       } catch {
         // session_end may not be a supported hook — TTL safety net handles this
       }
@@ -1418,10 +1487,28 @@ export default {
       api.logger?.info?.('[shieldcortex] interceptor.enabled:false in plugin config — before_tool_call hook not registered');
     }
 
+    // These two are CONVERSATION hooks: OpenClaw drops them at registration
+    // for a non-bundled plugin unless the host grants
+    // plugins.entries.<id>.hooks.allowConversationAccess = true. We still
+    // attempt registration (the host decides, and the grant can be added
+    // without a code change), but we must not CLAIM them afterwards — see the
+    // honesty note on the log line below (#225).
     api.on("llm_input", handleLlmInput, { timeoutMs: 30_000 });
     api.on("llm_output", handleLlmOutput, { timeoutMs: 30_000 });
 
-    api.logger.info(`[shieldcortex] v${_version} registered (llm_input + llm_output${_beforeToolCallRegistered ? " + before_tool_call" : ""} + /shieldcortex-status)`);
+    // #225: this line used to announce `llm_input + llm_output` unconditionally.
+    // On any host without the conversation-access grant the gateway logged, on
+    // the very next two lines, that it had dropped both — so ShieldCortex was
+    // claiming conversation protection it did not have, in the one place an
+    // operator looks to confirm startup. Report only what is actually live, and
+    // name the missing grant when it is the reason.
+    const conversationAccess = readConversationAccess(homedir(), PLUGIN_ID);
+    api.logger.info(
+      `[shieldcortex] v${_version} registered (${describeRegisteredHooks({
+        access: conversationAccess,
+        beforeToolCallRegistered: _beforeToolCallRegistered,
+      })})`,
+    );
     } catch (err) {
       // Plugin must never block channel startup — warn and bail gracefully.
       // #134 §2: this used to be a bare console.warn, which bypasses the

package/interceptor.ts

@@ -3,6 +3,7 @@ import { mkdirSync, appendFileSync, readFileSync, realpathSync, statSync } from
 import { join, isAbsolute, resolve as resolvePath } from 'node:path';
 import { homedir } from 'node:os';
 import { createGatewayInvoker, type BrokerInvokerContext, type ModelInvokerLike } from './broker-invoker.js';
+import { escalateForTaint, type GuardDecision, type GuardSeverity } from './session-taint.js';
 
 export type Severity = 'low' | 'medium' | 'high' | 'critical';
 export type InterceptAction = 'log' | 'warn' | 'require_approval';
@@ -166,6 +167,9 @@ export interface ToolCallContext {
    *  used to resolve a relative script path (issue #4). Falls back to the
    *  call's own `cwd` argument, then `process.cwd()`. */
   cwd?: string;
+  /** The gateway session this call belongs to (#233). Used to look up a
+   *  conversation-level taint; absent means no escalation, never a default. */
+  sessionId?: string;
 }
 
 export interface InterceptAuditEntry {
@@ -191,6 +195,11 @@ export interface InterceptAuditEntry {
    *  no pattern produced a span. `secret-egress` never contributes one — the
    *  span would be the secret. */
   matches?: Array<{ signal: string; span: string }>;
+  /** Set when a conversation-level detection earlier in this session tightened
+   *  the verdict (#233). Present ONLY when taint actually changed the answer,
+   *  so an escalated denial is tellable from a natively catastrophic one — and
+   *  a reviewer can find every decision the conversation scanner influenced. */
+  escalated?: { by: 'session-taint'; from: string; to: string; reason: string };
   /** Files the reviewed-script allowlist exempted from folding (#189). */
   reviewedScripts?: string[];
 }
@@ -749,6 +758,10 @@ interface InterceptorOptions {
   onAuditEntry?: (entry: InterceptAuditEntry) => void;
   /** Tool Action Guard evaluator, injected from `shieldcortex/defence` at runtime. */
   evaluateToolCall?: ToolGuardEvaluator;
+  /** #233: look up a conversation-level taint for this session. Returning null
+   *  (or throwing) means no escalation — a broken scanner must never become a
+   *  new source of denials. */
+  sessionTaint?: (sessionId: string | undefined) => { reason: string } | null;
   /** Approval broker (#143), injected from `shieldcortex/defence` at runtime.
    *  Absent, or present with `config.enabled: false`, means no model is ever
    *  consulted and the guard behaves exactly as it did before #143. */
@@ -984,6 +997,47 @@ export function createInterceptor(
       handleGuardUnavailable(context, `action-guard error: ${err instanceof Error ? err.message : err}`);
       return;
     }
+
+    // #233: a prompt injection detected on the CONVERSATION path earlier in this
+    // session tightens the guard by one notch for a bounded window — sensitive
+    // work starts asking, dangerous work stops. Benign work is untouched: an
+    // agent that cannot read a file is useless, and a taint response that halts
+    // ordinary work is one operators switch off.
+    //
+    // This is the enforcement answer instead of blocking the turn itself
+    // (see docs/design/2026-08-10-conversation-taint-escalation.md): the guard
+    // is already trusted, already gates actions, and a false positive here
+    // costs an approval prompt rather than the user's message.
+    //
+    // Failure is soft by construction — no taint lookup, or a throwing one,
+    // simply means no escalation. This must never become a way for a broken
+    // scanner to start denying tool calls.
+    let taint: { reason: string } | null = null;
+    try {
+      taint = options?.sessionTaint?.(context.sessionId) ?? null;
+    } catch {
+      taint = null;
+    }
+    let escalation: InterceptAuditEntry['escalated'] | undefined;
+    if (taint) {
+      const esc = escalateForTaint({
+        decision: v.decision as GuardDecision,
+        severity: v.severity as GuardSeverity,
+        tainted: true,
+      });
+      if (esc.escalated) {
+        log.warn(
+          `[shieldcortex] action-guard ESCALATED ${context.toolName}: ${v.decision} → ${esc.decision} (tainted session: ${taint.reason})`,
+        );
+        // Recorded STRUCTURALLY, not just in the reason string: the audit entry
+        // has no reason field, so an escalation folded into the verdict text
+        // would vanish from the durable record — invisible in exactly the
+        // forensic view that needs it.
+        escalation = { by: 'session-taint', from: v.decision, to: esc.decision, reason: taint.reason };
+        v = { ...v, decision: esc.decision, reason: `${v.reason} — ESCALATED by tainted session: ${taint.reason}` };
+      }
+    }
+
     if (v.decision === 'allow') {
       // Issue #95: a RECOGNISED allow (the guard evaluated a known operation
       // family and let it through — severity above benign) leaves an audit
@@ -998,7 +1052,7 @@ export function createInterceptor(
     }
 
     const preview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`;
-    const base = guardAuditBase(context.toolName, v, preview);
+    const base = { ...guardAuditBase(context.toolName, v, preview), ...(escalation ? { escalated: escalation } : {}) };
     const severity: Severity = v.severity === 'catastrophic' ? 'critical' : 'high';
 
     // Catastrophic / exfil — hard block, always enforced when the guard is enabled.

package/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "shieldcortex-realtime",
-  "version": "4.47.35",
+  "version": "4.47.37",
   "name": "ShieldCortex Real-time Scanner",
   "description": "Real-time defence scanning on LLM input, memory extraction on LLM output, and active tool call interception with approval gating.",
   "kind": null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drakon-systems/shieldcortex-realtime",
-  "version": "4.47.35",
+  "version": "4.47.37",
   "description": "OpenClaw plugin for ShieldCortex real-time defence scanning and optional memory extraction.",
   "type": "module",
   "main": "./dist/index.js",