@drakon-systems/shieldcortex-realtime 4.47.6 → 4.47.8

package/README.md

@@ -113,6 +113,7 @@ Supported plugin config keys:
 - `actionGuard.enabled`: turn the before-tool-call Action Guard on or off (default `true`)
 - `actionGuard.enforce`: enforce dangerous-operation gating (default `true`); `false` opts down to warn-and-allow. Catastrophic operations are blocked regardless.
 - `actionGuard.autoApprove`: array of operation allowlist entries for unattended agents that legitimately need specific dangerous operations
+- `actionGuard.auditAllows`: audit recognised (sensitive-tier) allow-decisions so "scanned & allowed" is distinguishable from "never scanned" (default `true`; benign allows are never audited)
 - `failurePolicy`: per-severity verdict when a decision can't be obtained unattended (defaults: `low`/`medium` allow, `high`/`critical` deny)
 
 ## Auto-memory

package/dist/interceptor.js

@@ -35,6 +35,7 @@ const DEFAULT_CONFIG = {
         enabled: true,
         enforce: true,
         autoApprove: [],
+        auditAllows: true,
     },
 };
 export { WATCHED_TOOLS, CONTENT_FIELDS, DEFAULT_CONFIG };
@@ -165,6 +166,9 @@ const FALLBACK_CATASTROPHIC_PATTERNS = [
     // <interp>` admitted (issue #92 must-fix 3) — mirrors tool-action-guard.ts's
     // pipe-download-to-shell pattern exactly; kept in sync there.
     /\b(?:curl|wget|fetch)\b[^\n|]*\|(?:[^\n|]*\|)*\s*(?:\w+=\S*\s+)*(?:sudo\s+)?(?:env\s+)?(?:\w+=\S*\s+)*(?:bash|sh|zsh|ksh|python\d?|perl|ruby|node)\b(?!(?:\s+-[a-z]+)*\s+-[cem]\b)/i,
+    // Stdin-executing python MODULES defeat the -m exemption above (issue #86.1) —
+    // mirrors tool-action-guard.ts's pipe-download-module-exec; kept in sync there.
+    /\b(?:curl|wget|fetch)\b[^|\n]*\|[^\n]*\bpython\d?\b[^\n]*\s-m\s*(?:code|pty|pdb)(?![\w.])/i,
     /\bch(?:mod|own)\b[^|;&\n]*(?:-\w*R\w*|--recursive)\b[^|;&\n]*\s\/(?:\s|$)/i,
 ];
 const FALLBACK_SURFACE_KEYS = [
@@ -217,6 +221,20 @@ export function formatActionGuardPrompt(toolName, v) {
 }
 // --- Audit Logging (local JSONL) ---
 const AUDIT_DIR = join(homedir(), '.shieldcortex', 'audit');
+// Issue #95: an unwritable audit sink used to be swallowed by this bare catch —
+// entries silently dropped forever. Still best-effort (an audit failure must
+// never block the agent), but the FIRST failure now warns loudly with the sink
+// path and the error, and later failures keep a drop count for the breadcrumb.
+let auditSinkFailures = 0;
+export function noteAuditSinkFailure(err) {
+    auditSinkFailures++;
+    if (auditSinkFailures === 1) {
+        const detail = err instanceof Error ? err.message : String(err);
+        console.warn(`[shieldcortex] ⚠️ audit sink UNWRITABLE (${AUDIT_DIR}): ${detail} — audit entries are being DROPPED. ` +
+            `Fix the directory permissions/disk; enforcement continues but leaves no trail until this is resolved.`);
+    }
+}
+export function __resetAuditSinkFailuresForTest() { auditSinkFailures = 0; }
 function writeAuditEntry(entry) {
     try {
         mkdirSync(AUDIT_DIR, { recursive: true });
@@ -224,8 +242,9 @@ function writeAuditEntry(entry) {
         const file = join(AUDIT_DIR, `realtime-${date}.jsonl`);
         appendFileSync(file, JSON.stringify(entry) + '\n');
     }
-    catch {
-        // Best-effort — never block on audit failure
+    catch (err) {
+        // Best-effort — never block on audit failure, but never silent either (#95).
+        noteAuditSinkFailure(err);
     }
 }
 // --- X-Ray Inline Guard ---
@@ -285,9 +304,9 @@ export function createInterceptor(config, pipeline, options) {
     function guardAuditBase(toolName, v, preview) {
         return {
             type: 'intercept', tool: toolName,
-            severity: v.severity === 'catastrophic' ? 'critical' : 'high',
+            severity: v.severity === 'catastrophic' ? 'critical' : v.decision === 'allow' ? 'low' : 'high',
             firewallResult: 'ACTION_GUARD', threats: v.signals,
-            anomalyScore: v.decision === 'block' ? 1 : 0.6,
+            anomalyScore: v.decision === 'block' ? 1 : v.decision === 'allow' ? 0.1 : 0.6,
             trustScore: 0, sensitivityLevel: 'INTERNAL', fragmentationScore: null, pipelineDurationMs: 0,
             preview: preview.slice(0, 200), ts: new Date().toISOString(),
         };
@@ -331,8 +350,18 @@ export function createInterceptor(config, pipeline, options) {
             handleGuardUnavailable(context, `action-guard error: ${err instanceof Error ? err.message : err}`);
             return;
         }
-        if (v.decision === 'allow')
+        if (v.decision === 'allow') {
+            // Issue #95: a RECOGNISED allow (the guard evaluated a known operation
+            // family and let it through — severity above benign) leaves an audit
+            // entry, so forensics can distinguish "scanned & allowed" from "never
+            // scanned". Benign allows stay unaudited by design (volume discipline);
+            // `actionGuard.auditAllows: false` opts the recognised entries off too.
+            if (v.severity !== 'benign' && actionGuardCfg.auditAllows !== false) {
+                const allowPreview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`;
+                emitAudit({ ...guardAuditBase(context.toolName, v, allowPreview), action: 'allow', outcome: 'allowed' });
+            }
             return;
+        }
         const preview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`;
         const base = guardAuditBase(context.toolName, v, preview);
         const severity = v.severity === 'catastrophic' ? 'critical' : 'high';

package/dist/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "shieldcortex-realtime",
-  "version": "4.47.6",
+  "version": "4.47.8",
   "name": "ShieldCortex Real-time Scanner",
   "description": "Real-time defence scanning on LLM input, memory extraction on LLM output, and active tool call interception with approval gating.",
   "kind": null,
@@ -93,6 +93,12 @@
       "description": "Family/action/signal names pre-approved for unattended agents that legitimately need specific dangerous operations (case-insensitive substring match). Never applies to catastrophic operations.",
       "type": "array",
       "advanced": true
+    },
+    "interceptor.actionGuard.auditAllows": {
+      "label": "Audit Recognised Allows",
+      "description": "Write an audit entry when the guard evaluates a recognised (sensitive-tier) operation and allows it, so forensics can distinguish scanned-and-allowed from never-scanned. Benign allows are never audited.",
+      "type": "boolean",
+      "advanced": true
     }
   },
   "configSchema": {
@@ -232,6 +238,10 @@
                   "type": "string"
                 },
                 "default": []
+              },
+              "auditAllows": {
+                "type": "boolean",
+                "default": true
               }
             }
           }

package/interceptor.ts

@@ -26,6 +26,9 @@ export interface ActionGuardConfig {
   enabled: boolean;
   enforce: boolean;
   autoApprove?: string[];
+  /** Audit recognised (severity 'sensitive'+) allow-decisions. Default true (issue #95).
+   *  Benign allows are never audited — on a busy agent every `ls` would drown the stream. */
+  auditAllows?: boolean;
 }
 
 /** Structural shape of a Tool Action Guard verdict (kept local to avoid a
@@ -66,8 +69,8 @@ export interface InterceptAuditEntry {
   sensitivityLevel: string;           // from the pipeline result's sensitivity level
   fragmentationScore: number | null;  // from the pipeline result's fragmentation score, or null
   pipelineDurationMs: number;         // wall-clock ms around the runDefencePipeline call
-  action: InterceptAction | 'auto_deny' | 'rate_limit';
-  outcome: 'approved' | 'denied' | 'auto_denied' | 'logged' | 'warned' | 'failure_allowed' | 'failure_denied';
+  action: InterceptAction | 'auto_deny' | 'rate_limit' | 'allow';
+  outcome: 'approved' | 'denied' | 'auto_denied' | 'logged' | 'warned' | 'failure_allowed' | 'failure_denied' | 'allowed';
   preview: string;
   ts: string;
 }
@@ -107,6 +110,7 @@ const DEFAULT_CONFIG: InterceptorConfig = {
     enabled: true,
     enforce: true,
     autoApprove: [],
+    auditAllows: true,
   },
 };
 
@@ -269,6 +273,9 @@ const FALLBACK_CATASTROPHIC_PATTERNS: RegExp[] = [
   // <interp>` admitted (issue #92 must-fix 3) — mirrors tool-action-guard.ts's
   // pipe-download-to-shell pattern exactly; kept in sync there.
   /\b(?:curl|wget|fetch)\b[^\n|]*\|(?:[^\n|]*\|)*\s*(?:\w+=\S*\s+)*(?:sudo\s+)?(?:env\s+)?(?:\w+=\S*\s+)*(?:bash|sh|zsh|ksh|python\d?|perl|ruby|node)\b(?!(?:\s+-[a-z]+)*\s+-[cem]\b)/i,
+  // Stdin-executing python MODULES defeat the -m exemption above (issue #86.1) —
+  // mirrors tool-action-guard.ts's pipe-download-module-exec; kept in sync there.
+  /\b(?:curl|wget|fetch)\b[^|\n]*\|[^\n]*\bpython\d?\b[^\n]*\s-m\s*(?:code|pty|pdb)(?![\w.])/i,
   /\bch(?:mod|own)\b[^|;&\n]*(?:-\w*R\w*|--recursive)\b[^|;&\n]*\s\/(?:\s|$)/i,
 ];
 
@@ -324,14 +331,32 @@ export function formatActionGuardPrompt(toolName: string, v: ToolGuardVerdictLik
 
 const AUDIT_DIR = join(homedir(), '.shieldcortex', 'audit');
 
+// Issue #95: an unwritable audit sink used to be swallowed by this bare catch —
+// entries silently dropped forever. Still best-effort (an audit failure must
+// never block the agent), but the FIRST failure now warns loudly with the sink
+// path and the error, and later failures keep a drop count for the breadcrumb.
+let auditSinkFailures = 0;
+export function noteAuditSinkFailure(err: unknown): void {
+  auditSinkFailures++;
+  if (auditSinkFailures === 1) {
+    const detail = err instanceof Error ? err.message : String(err);
+    console.warn(
+      `[shieldcortex] ⚠️ audit sink UNWRITABLE (${AUDIT_DIR}): ${detail} — audit entries are being DROPPED. ` +
+      `Fix the directory permissions/disk; enforcement continues but leaves no trail until this is resolved.`,
+    );
+  }
+}
+export function __resetAuditSinkFailuresForTest(): void { auditSinkFailures = 0; }
+
 function writeAuditEntry(entry: InterceptAuditEntry): void {
   try {
     mkdirSync(AUDIT_DIR, { recursive: true });
     const date = new Date().toISOString().slice(0, 10);
     const file = join(AUDIT_DIR, `realtime-${date}.jsonl`);
     appendFileSync(file, JSON.stringify(entry) + '\n');
-  } catch {
-    // Best-effort — never block on audit failure
+  } catch (err) {
+    // Best-effort — never block on audit failure, but never silent either (#95).
+    noteAuditSinkFailure(err);
   }
 }
 
@@ -442,9 +467,9 @@ export function createInterceptor(
   function guardAuditBase(toolName: string, v: ToolGuardVerdictLike, preview: string): Omit<InterceptAuditEntry, 'action' | 'outcome'> {
     return {
       type: 'intercept', tool: toolName,
-      severity: v.severity === 'catastrophic' ? 'critical' : 'high',
+      severity: v.severity === 'catastrophic' ? 'critical' : v.decision === 'allow' ? 'low' : 'high',
       firewallResult: 'ACTION_GUARD', threats: v.signals,
-      anomalyScore: v.decision === 'block' ? 1 : 0.6,
+      anomalyScore: v.decision === 'block' ? 1 : v.decision === 'allow' ? 0.1 : 0.6,
       trustScore: 0, sensitivityLevel: 'INTERNAL', fragmentationScore: null, pipelineDurationMs: 0,
       preview: preview.slice(0, 200), ts: new Date().toISOString(),
     };
@@ -490,7 +515,18 @@ export function createInterceptor(
       handleGuardUnavailable(context, `action-guard error: ${err instanceof Error ? err.message : err}`);
       return;
     }
-    if (v.decision === 'allow') return;
+    if (v.decision === 'allow') {
+      // Issue #95: a RECOGNISED allow (the guard evaluated a known operation
+      // family and let it through — severity above benign) leaves an audit
+      // entry, so forensics can distinguish "scanned & allowed" from "never
+      // scanned". Benign allows stay unaudited by design (volume discipline);
+      // `actionGuard.auditAllows: false` opts the recognised entries off too.
+      if (v.severity !== 'benign' && actionGuardCfg.auditAllows !== false) {
+        const allowPreview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`;
+        emitAudit({ ...guardAuditBase(context.toolName, v, allowPreview), action: 'allow', outcome: 'allowed' });
+      }
+      return;
+    }
 
     const preview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`;
     const base = guardAuditBase(context.toolName, v, preview);

package/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "shieldcortex-realtime",
-  "version": "4.47.6",
+  "version": "4.47.8",
   "name": "ShieldCortex Real-time Scanner",
   "description": "Real-time defence scanning on LLM input, memory extraction on LLM output, and active tool call interception with approval gating.",
   "kind": null,
@@ -93,6 +93,12 @@
       "description": "Family/action/signal names pre-approved for unattended agents that legitimately need specific dangerous operations (case-insensitive substring match). Never applies to catastrophic operations.",
       "type": "array",
       "advanced": true
+    },
+    "interceptor.actionGuard.auditAllows": {
+      "label": "Audit Recognised Allows",
+      "description": "Write an audit entry when the guard evaluates a recognised (sensitive-tier) operation and allows it, so forensics can distinguish scanned-and-allowed from never-scanned. Benign allows are never audited.",
+      "type": "boolean",
+      "advanced": true
     }
   },
   "configSchema": {
@@ -232,6 +238,10 @@
                   "type": "string"
                 },
                 "default": []
+              },
+              "auditAllows": {
+                "type": "boolean",
+                "default": true
               }
             }
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drakon-systems/shieldcortex-realtime",
-  "version": "4.47.6",
+  "version": "4.47.8",
   "description": "OpenClaw plugin for ShieldCortex real-time defence scanning and optional memory extraction.",
   "type": "module",
   "main": "./dist/index.js",