@drakon-systems/shieldcortex-realtime 4.47.7 → 4.47.9

package/README.md

@@ -113,6 +113,7 @@ Supported plugin config keys:
 - `actionGuard.enabled`: turn the before-tool-call Action Guard on or off (default `true`)
 - `actionGuard.enforce`: enforce dangerous-operation gating (default `true`); `false` opts down to warn-and-allow. Catastrophic operations are blocked regardless.
 - `actionGuard.autoApprove`: array of operation allowlist entries for unattended agents that legitimately need specific dangerous operations
+- `actionGuard.auditAllows`: audit recognised (sensitive-tier) allow-decisions so "scanned & allowed" is distinguishable from "never scanned" (default `true`; benign allows are never audited)
 - `failurePolicy`: per-severity verdict when a decision can't be obtained unattended (defaults: `low`/`medium` allow, `high`/`critical` deny)
 
 ## Auto-memory

package/dist/interceptor.js

@@ -35,6 +35,7 @@ const DEFAULT_CONFIG = {
         enabled: true,
         enforce: true,
         autoApprove: [],
+        auditAllows: true,
     },
 };
 export { WATCHED_TOOLS, CONTENT_FIELDS, DEFAULT_CONFIG };
@@ -155,7 +156,7 @@ export function formatApprovalPrompt(input) {
 // itself break unattended agents/cron, the outcome ShieldCortex exists to
 // prevent. Mirrored in scripts/pre-tool-hook.mjs for the Claude Code surface.
 const FALLBACK_CATASTROPHIC_PATTERNS = [
-    /\brm\b[^|;&\n]*?(?:-\w*r\w*f\w*|-\w*f\w*r\w*|(?=[^|;&\n]*--recursive)(?=[^|;&\n]*--force))/i,
+    /\brm\b[^|;&\n]*?(?:(?<![\w.\/-])-\w*r\w*f\w*|(?<![\w.\/-])-\w*f\w*r\w*|(?=[^|;&\n]*--recursive)(?=[^|;&\n]*--force))/i,
     /\brm\b[^|;&\n]*\s(?:-\w+\s+)*(?:\/|~|\$HOME|\/\*|\*|\.\/\*)(?:\s|$)/i,
     /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:?\s*&?\s*\}\s*;\s*:/,
     /\bmkfs(\.\w+)?\b/i,
@@ -170,11 +171,49 @@ const FALLBACK_CATASTROPHIC_PATTERNS = [
     /\b(?:curl|wget|fetch)\b[^|\n]*\|[^\n]*\bpython\d?\b[^\n]*\s-m\s*(?:code|pty|pdb)(?![\w.])/i,
     /\bch(?:mod|own)\b[^|;&\n]*(?:-\w*R\w*|--recursive)\b[^|;&\n]*\s\/(?:\s|$)/i,
 ];
+// WS2 dangerous-tier fallback (issue #59). Ports EVERY signal in
+// tool-action-guard.ts's DANGEROUS array — a drift test
+// (ws2-gate-degraded-integration-59) fails if the guard gains a DANGEROUS
+// signal this list doesn't cover, so "kept in sync" is enforced, not just
+// claimed. Used ONLY when the real guard can't scan: a recognised-dangerous
+// shape routes through `failurePolicy` exactly as an unattended real verdict
+// would, instead of the pre-#59 fail-OPEN. Copies the real (already anti-ReDoS,
+// FP-narrowed) patterns verbatim, so read-only forms — `crontab -l`, `npm ls
+// -g`, `--global-style`, shred use/mention — still pass. The one guard shape
+// NOT here is bare `npx`/`bunx`: those are gated CONDITIONALLY by
+// `isGatedNpxBunx` (shape-based, #96), not by a DANGEROUS pattern, and a blunt
+// fallback matching them would over-gate `npx tsc`; `uvx`/`dlx` (unconditional)
+// ARE covered. Mirrored in scripts/pre-tool-hook.mjs + hermes/sc_client.py.
+const FALLBACK_DANGEROUS_PATTERNS = [
+    { re: /\brm\b|\bunlink\b|\brmdir\b|(?:(?:^|[;&|(\n]|\$\()\s*(?:\w+=\S*\s+)*(?:sudo\s+)?|\bxargs\s+(?:-{1,2}\S+\s+)*|-exec\s+)shred\b/i, signal: 'file-delete' },
+    { re: /\bsudo\b|\bdoas\b|\bsu\s/i, signal: 'privilege-escalation' },
+    { re: /\bgit\b[^|\n]*\bpush\b[^|\n]*(--force\b|-f\b|\+)/i, signal: 'git-force-push' },
+    { re: /\bgit\b[^|\n]*\b(branch\s+-D|push\b[^|\n]*--delete|push\b[^|\n]*\s:)/i, signal: 'git-delete-branch' },
+    { re: /\b(systemctl|service)\b[^|\n]*\b(stop|disable|mask)\b|\b(kill|pkill|killall)\b/i, signal: 'stop-process-or-service' },
+    { re: /\b(iptables|ufw|nft|netplan|firewall-cmd)\b/i, signal: 'modify-network-firewall' },
+    { re: /\b(?:apt|apt-get|yum|dnf|brew|pip|pip3|gem|cargo)\b[^|\n]*\b(?:install|add)\b/i, signal: 'install-package' },
+    { re: /\b(?:npm|yarn|pnpm|bun)\b(?=[^|;&\n]*(?:\s['"]?-g\b['"]?|--global(?![\w-])|\bglobal\s+add\b))(?=[^|;&\n]*\s(?:install|add)(?=\s|$|[|;&\n]))|\b(?:npm|pnpm|bun)\s+(?:i(?:n(?:s(?:t(?:a(?:ll?)?)?)?)?)?|isnt(?:all)?)\b[^|;&\n]*(?:\s['"]?-g\b['"]?|--global(?![\w-]))/i, signal: 'install-package-global' },
+    { re: /(?:^|[;&|(\n]|\$\()\s*(?:\w+=\S*\s+)*(?:sudo\s+)?(?:(?:env|nohup|time|stdbuf|nice)\b(?:\s+(?:-{1,2}\S+|\w+=\S*|\d+))*\s+)*(?:sudo\s+)?(?:crontab\b(?!\s+-l\b)|at\b(?!\s+-l\b)(?!\s*$))|\/etc\/cron|\bsystemd-run\b[^|;&\n]*--on-(?:calendar|active|boot|startup|unit-active|unit-inactive)\b/i, signal: 'modify-scheduler' },
+    { re: /\bdd\b[^|;&\n]*\bof=/i, signal: 'dd-overwrite' },
+    { re: /\bch(?:mod|own)\b[^|;&\n]*(?:-\w*R\w*|--recursive)\b[^|;&\n]*\s\/(?:etc|usr|var|home|bin|sbin|boot|lib|lib64|opt|root)(?:\/\*?)?(?:\s|$)/i, signal: 'recursive-perms-system-dir' },
+    { re: /\btruncate\b[^|;&\n]*(?:-s\s*0\b|--size(?:=|\s+)0\b)/i, signal: 'truncate-to-zero' },
+    { re: /\bhistory\s+-c\b|\.bash_history|truncate\b[^|\n]*\.log/i, signal: 'wipe-history-or-logs' },
+    { re: /\/etc\/(passwd|shadow|sudoers)|~\/\.ssh|id_rsa|\.aws\/credentials|\.env\b/i, signal: 'touch-sensitive-path' },
+    { re: /(?:^|[;&|(\n]|\$\()\s*(?:\w+=\S*\s+)*(?:sudo\s+)?uvx\b/i, signal: 'registry-code-exec' },
+    { re: /(?:^|[;&|(\n]|\$\()\s*(?:\w+=\S*\s+)*(?:sudo\s+)?(?:pnpm|yarn)\b[^|;&\n]*\bdlx\b/i, signal: 'registry-code-exec' },
+    { re: /\b(?:base64|openssl|xxd|cat|http)\b[^\n|]*\|(?:[^\n|]*\|)*\s*(?:\w+=\S*\s+)*(?:sudo\s+)?(?:bash|sh|zsh|ksh|python\d?|perl|ruby|node)\b(?:\s+-)?\s*(?:[;&|\n]|$)/i, signal: 'decode-pipe-to-shell' },
+];
 const FALLBACK_SURFACE_KEYS = [
     'command', 'cmd', 'script', 'code', 'input', 'shell', 'run',
     'path', 'file_path', 'filePath', 'file', 'target', 'destination', 'dir', 'directory',
     'url', 'uri', 'endpoint', 'href', 'host', 'to',
 ];
+// The fallback is an outage-only blunt scanner; an UNBOUNDED scan over crafted
+// input is a ReDoS vector (some ported guard patterns are O(n²) on pathological
+// token runs like `git push push push …`). Dangerous/catastrophic shapes appear
+// early in any real command, so cap the scanned surface — 4 KB is far beyond a
+// real shell command. The real guard (no cap) still scans in full when it works.
+const FALLBACK_SCAN_CAP = 4096;
 /** Same command/path/url field set tool-action-guard.ts extracts — narrow, not the whole args object. */
 function fallbackExecSurface(args) {
     const parts = [];
@@ -183,7 +222,7 @@ function fallbackExecSurface(args) {
         if (typeof v === 'string' && v.length > 0)
             parts.push(v);
     }
-    return parts.join('   ');
+    return parts.join('   ').slice(0, FALLBACK_SCAN_CAP);
 }
 function fallbackCatastrophicMatch(args) {
     const text = fallbackExecSurface(args);
@@ -191,6 +230,17 @@ function fallbackCatastrophicMatch(args) {
         return false;
     return FALLBACK_CATASTROPHIC_PATTERNS.some(re => re.test(text));
 }
+/** First matching dangerous signal for the WS2 fallback, or null (issue #59). */
+function fallbackDangerousMatch(args) {
+    const text = fallbackExecSurface(args);
+    if (!text)
+        return null;
+    for (const { re, signal } of FALLBACK_DANGEROUS_PATTERNS) {
+        if (re.test(text))
+            return signal;
+    }
+    return null;
+}
 /** One-line summary of tool args for audit previews (bounded, no secrets dumped). */
 export function summariseToolArgs(args) {
     if (!args)
@@ -220,6 +270,20 @@ export function formatActionGuardPrompt(toolName, v) {
 }
 // --- Audit Logging (local JSONL) ---
 const AUDIT_DIR = join(homedir(), '.shieldcortex', 'audit');
+// Issue #95: an unwritable audit sink used to be swallowed by this bare catch —
+// entries silently dropped forever. Still best-effort (an audit failure must
+// never block the agent), but the FIRST failure now warns loudly with the sink
+// path and the error, and later failures keep a drop count for the breadcrumb.
+let auditSinkFailures = 0;
+export function noteAuditSinkFailure(err) {
+    auditSinkFailures++;
+    if (auditSinkFailures === 1) {
+        const detail = err instanceof Error ? err.message : String(err);
+        console.warn(`[shieldcortex] ⚠️ audit sink UNWRITABLE (${AUDIT_DIR}): ${detail} — audit entries are being DROPPED. ` +
+            `Fix the directory permissions/disk; enforcement continues but leaves no trail until this is resolved.`);
+    }
+}
+export function __resetAuditSinkFailuresForTest() { auditSinkFailures = 0; }
 function writeAuditEntry(entry) {
     try {
         mkdirSync(AUDIT_DIR, { recursive: true });
@@ -227,8 +291,9 @@ function writeAuditEntry(entry) {
         const file = join(AUDIT_DIR, `realtime-${date}.jsonl`);
         appendFileSync(file, JSON.stringify(entry) + '\n');
     }
-    catch {
-        // Best-effort — never block on audit failure
+    catch (err) {
+        // Best-effort — never block on audit failure, but never silent either (#95).
+        noteAuditSinkFailure(err);
     }
 }
 // --- X-Ray Inline Guard ---
@@ -288,34 +353,62 @@ export function createInterceptor(config, pipeline, options) {
     function guardAuditBase(toolName, v, preview) {
         return {
             type: 'intercept', tool: toolName,
-            severity: v.severity === 'catastrophic' ? 'critical' : 'high',
+            severity: v.severity === 'catastrophic' ? 'critical' : v.decision === 'allow' ? 'low' : 'high',
             firewallResult: 'ACTION_GUARD', threats: v.signals,
-            anomalyScore: v.decision === 'block' ? 1 : 0.6,
+            anomalyScore: v.decision === 'block' ? 1 : v.decision === 'allow' ? 0.1 : 0.6,
             trustScore: 0, sensitivityLevel: 'INTERNAL', fragmentationScore: null, pipelineDurationMs: 0,
             preview: preview.slice(0, 200), ts: new Date().toISOString(),
         };
     }
-    // WS2 fail-closed path: when the real guard was never wired in or throws,
-    // run the narrow fallback scan and DENY (throw) a catastrophic-looking
-    // command instead of silently allowing it. The fallback recognising nothing
-    // is not evidence the command is safe, only that it isn't one of the
-    // handful of unambiguous shapes — everything else still falls through to
-    // the pre-existing fail-OPEN log-and-allow.
+    // WS2 fail-closed path (issue #59): when the real guard was never wired in or
+    // throws, run the dependency-free fallback scan. Three tiers, so no dangerous
+    // op is ever silently allowed on a scan failure — and every could-not-scan
+    // decision leaves a `gate_degraded` audit row (ACTION_GUARD_FALLBACK marker),
+    // so forensics can distinguish "scanned & allowed" from "could not scan":
+    //   1. catastrophic → hard deny, always (ignores enforce:false).
+    //   2. dangerous    → route through `failurePolicy` exactly as an unattended
+    //                     real verdict would (deny by default); enforce:false
+    //                     opts down to advisory.
+    //   3. no match     → benign/unknown: fail OPEN (a degraded guard must not
+    //                     wedge normal work) but leave a visible breadcrumb.
     function handleGuardUnavailable(context, reason) {
-        if (!fallbackCatastrophicMatch(context.arguments)) {
-            log.warn(`[shieldcortex] ⚠️ action-guard unavailable (${reason}) — allowing ${context.toolName}`);
+        const preview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`.slice(0, 200);
+        const degradedBase = {
+            type: 'intercept', tool: context.toolName,
+            firewallResult: 'ACTION_GUARD_FALLBACK', trustScore: 0, sensitivityLevel: 'INTERNAL',
+            fragmentationScore: null, pipelineDurationMs: 0, preview, ts: new Date().toISOString(),
+        };
+        // 1. Catastrophic — hard deny, always.
+        if (fallbackCatastrophicMatch(context.arguments)) {
+            emitAudit({
+                ...degradedBase, severity: 'critical', threats: ['fallback-scan'], anomalyScore: 1,
+                action: 'auto_deny', outcome: 'auto_denied',
+            });
+            log.warn(`[shieldcortex] action-guard UNAVAILABLE (${reason}) and fallback scan matched a catastrophic pattern — DENYING ${context.toolName} (fail-closed, WS2)`);
+            throw new Error(`ShieldCortex: tool call blocked — action guard unavailable (${reason}), fallback catastrophic scan matched`);
+        }
+        // 2. Dangerous — route through failurePolicy (the "can't obtain a verdict"
+        //    policy; a degraded guard is precisely that). enforce:false → advisory.
+        const dangerousSignal = fallbackDangerousMatch(context.arguments);
+        if (dangerousSignal) {
+            const dBase = { ...degradedBase, severity: 'high', threats: ['fallback-scan', dangerousSignal], anomalyScore: 0.6 };
+            if (!actionGuardCfg.enforce) {
+                emitAudit({ ...dBase, action: 'gate_degraded', outcome: 'failure_allowed' });
+                log.warn(`[shieldcortex] ⚠️ action-guard unavailable (${reason}) — advisory (enforce:false), allowing dangerous ${context.toolName} [${dangerousSignal}]`);
+                return;
+            }
+            const failAction = config.failurePolicy.high;
+            emitAudit({ ...dBase, action: 'gate_degraded', outcome: failAction === 'deny' ? 'failure_denied' : 'failure_allowed' });
+            if (failAction === 'deny') {
+                log.warn(`[shieldcortex] action-guard UNAVAILABLE (${reason}) and fallback matched a DANGEROUS op [${dangerousSignal}] — DENYING ${context.toolName} (fail-closed, failure policy: deny)`);
+                throw new Error(`ShieldCortex: tool call blocked — action guard unavailable (${reason}), dangerous fallback match [${dangerousSignal}], failure policy: deny`);
+            }
             return;
         }
-        const preview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`;
-        emitAudit({
-            type: 'intercept', tool: context.toolName, severity: 'critical',
-            firewallResult: 'ACTION_GUARD_FALLBACK', threats: ['fallback-scan'],
-            anomalyScore: 1, trustScore: 0, sensitivityLevel: 'INTERNAL', fragmentationScore: null,
-            pipelineDurationMs: 0, preview: preview.slice(0, 200), ts: new Date().toISOString(),
-            action: 'auto_deny', outcome: 'auto_denied',
-        });
-        log.warn(`[shieldcortex] action-guard UNAVAILABLE (${reason}) and fallback scan matched a catastrophic pattern — DENYING ${context.toolName} (fail-closed, WS2)`);
-        throw new Error(`ShieldCortex: tool call blocked — action guard unavailable (${reason}), fallback catastrophic scan matched`);
+        // 3. No match — benign/unknown. Fail open, but never silently: the
+        //    gate_degraded breadcrumb makes the outage window auditable.
+        emitAudit({ ...degradedBase, severity: 'low', threats: ['fallback-scan'], anomalyScore: 0.1, action: 'gate_degraded', outcome: 'failure_allowed' });
+        log.warn(`[shieldcortex] ⚠️ action-guard unavailable (${reason}) — allowing ${context.toolName} (fallback matched nothing; fail-open)`);
     }
     // Action Guard: gates non-memory tool calls (shell / file / network / git).
     // This is what makes "Iron Dome protects what the agent DOES" true at runtime.
@@ -334,8 +427,18 @@ export function createInterceptor(config, pipeline, options) {
             handleGuardUnavailable(context, `action-guard error: ${err instanceof Error ? err.message : err}`);
             return;
         }
-        if (v.decision === 'allow')
+        if (v.decision === 'allow') {
+            // Issue #95: a RECOGNISED allow (the guard evaluated a known operation
+            // family and let it through — severity above benign) leaves an audit
+            // entry, so forensics can distinguish "scanned & allowed" from "never
+            // scanned". Benign allows stay unaudited by design (volume discipline);
+            // `actionGuard.auditAllows: false` opts the recognised entries off too.
+            if (v.severity !== 'benign' && actionGuardCfg.auditAllows !== false) {
+                const allowPreview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`;
+                emitAudit({ ...guardAuditBase(context.toolName, v, allowPreview), action: 'allow', outcome: 'allowed' });
+            }
             return;
+        }
         const preview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`;
         const base = guardAuditBase(context.toolName, v, preview);
         const severity = v.severity === 'catastrophic' ? 'critical' : 'high';

package/dist/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "shieldcortex-realtime",
-  "version": "4.47.7",
+  "version": "4.47.9",
   "name": "ShieldCortex Real-time Scanner",
   "description": "Real-time defence scanning on LLM input, memory extraction on LLM output, and active tool call interception with approval gating.",
   "kind": null,
@@ -93,6 +93,12 @@
       "description": "Family/action/signal names pre-approved for unattended agents that legitimately need specific dangerous operations (case-insensitive substring match). Never applies to catastrophic operations.",
       "type": "array",
       "advanced": true
+    },
+    "interceptor.actionGuard.auditAllows": {
+      "label": "Audit Recognised Allows",
+      "description": "Write an audit entry when the guard evaluates a recognised (sensitive-tier) operation and allows it, so forensics can distinguish scanned-and-allowed from never-scanned. Benign allows are never audited.",
+      "type": "boolean",
+      "advanced": true
     }
   },
   "configSchema": {
@@ -232,6 +238,10 @@
                   "type": "string"
                 },
                 "default": []
+              },
+              "auditAllows": {
+                "type": "boolean",
+                "default": true
               }
             }
           }

package/interceptor.ts

@@ -26,6 +26,9 @@ export interface ActionGuardConfig {
   enabled: boolean;
   enforce: boolean;
   autoApprove?: string[];
+  /** Audit recognised (severity 'sensitive'+) allow-decisions. Default true (issue #95).
+   *  Benign allows are never audited — on a busy agent every `ls` would drown the stream. */
+  auditAllows?: boolean;
 }
 
 /** Structural shape of a Tool Action Guard verdict (kept local to avoid a
@@ -66,8 +69,8 @@ export interface InterceptAuditEntry {
   sensitivityLevel: string;           // from the pipeline result's sensitivity level
   fragmentationScore: number | null;  // from the pipeline result's fragmentation score, or null
   pipelineDurationMs: number;         // wall-clock ms around the runDefencePipeline call
-  action: InterceptAction | 'auto_deny' | 'rate_limit';
-  outcome: 'approved' | 'denied' | 'auto_denied' | 'logged' | 'warned' | 'failure_allowed' | 'failure_denied';
+  action: InterceptAction | 'auto_deny' | 'rate_limit' | 'allow' | 'gate_degraded';
+  outcome: 'approved' | 'denied' | 'auto_denied' | 'logged' | 'warned' | 'failure_allowed' | 'failure_denied' | 'allowed';
   preview: string;
   ts: string;
 }
@@ -107,6 +110,7 @@ const DEFAULT_CONFIG: InterceptorConfig = {
     enabled: true,
     enforce: true,
     autoApprove: [],
+    auditAllows: true,
   },
 };
 
@@ -259,7 +263,7 @@ export function formatApprovalPrompt(input: ApprovalPromptInput): string {
 // itself break unattended agents/cron, the outcome ShieldCortex exists to
 // prevent. Mirrored in scripts/pre-tool-hook.mjs for the Claude Code surface.
 const FALLBACK_CATASTROPHIC_PATTERNS: RegExp[] = [
-  /\brm\b[^|;&\n]*?(?:-\w*r\w*f\w*|-\w*f\w*r\w*|(?=[^|;&\n]*--recursive)(?=[^|;&\n]*--force))/i,
+  /\brm\b[^|;&\n]*?(?:(?<![\w.\/-])-\w*r\w*f\w*|(?<![\w.\/-])-\w*f\w*r\w*|(?=[^|;&\n]*--recursive)(?=[^|;&\n]*--force))/i,
   /\brm\b[^|;&\n]*\s(?:-\w+\s+)*(?:\/|~|\$HOME|\/\*|\*|\.\/\*)(?:\s|$)/i,
   /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:?\s*&?\s*\}\s*;\s*:/,
   /\bmkfs(\.\w+)?\b/i,
@@ -275,12 +279,52 @@ const FALLBACK_CATASTROPHIC_PATTERNS: RegExp[] = [
   /\bch(?:mod|own)\b[^|;&\n]*(?:-\w*R\w*|--recursive)\b[^|;&\n]*\s\/(?:\s|$)/i,
 ];
 
+// WS2 dangerous-tier fallback (issue #59). Ports EVERY signal in
+// tool-action-guard.ts's DANGEROUS array — a drift test
+// (ws2-gate-degraded-integration-59) fails if the guard gains a DANGEROUS
+// signal this list doesn't cover, so "kept in sync" is enforced, not just
+// claimed. Used ONLY when the real guard can't scan: a recognised-dangerous
+// shape routes through `failurePolicy` exactly as an unattended real verdict
+// would, instead of the pre-#59 fail-OPEN. Copies the real (already anti-ReDoS,
+// FP-narrowed) patterns verbatim, so read-only forms — `crontab -l`, `npm ls
+// -g`, `--global-style`, shred use/mention — still pass. The one guard shape
+// NOT here is bare `npx`/`bunx`: those are gated CONDITIONALLY by
+// `isGatedNpxBunx` (shape-based, #96), not by a DANGEROUS pattern, and a blunt
+// fallback matching them would over-gate `npx tsc`; `uvx`/`dlx` (unconditional)
+// ARE covered. Mirrored in scripts/pre-tool-hook.mjs + hermes/sc_client.py.
+const FALLBACK_DANGEROUS_PATTERNS: Array<{ re: RegExp; signal: string }> = [
+  { re: /\brm\b|\bunlink\b|\brmdir\b|(?:(?:^|[;&|(\n]|\$\()\s*(?:\w+=\S*\s+)*(?:sudo\s+)?|\bxargs\s+(?:-{1,2}\S+\s+)*|-exec\s+)shred\b/i, signal: 'file-delete' },
+  { re: /\bsudo\b|\bdoas\b|\bsu\s/i, signal: 'privilege-escalation' },
+  { re: /\bgit\b[^|\n]*\bpush\b[^|\n]*(--force\b|-f\b|\+)/i, signal: 'git-force-push' },
+  { re: /\bgit\b[^|\n]*\b(branch\s+-D|push\b[^|\n]*--delete|push\b[^|\n]*\s:)/i, signal: 'git-delete-branch' },
+  { re: /\b(systemctl|service)\b[^|\n]*\b(stop|disable|mask)\b|\b(kill|pkill|killall)\b/i, signal: 'stop-process-or-service' },
+  { re: /\b(iptables|ufw|nft|netplan|firewall-cmd)\b/i, signal: 'modify-network-firewall' },
+  { re: /\b(?:apt|apt-get|yum|dnf|brew|pip|pip3|gem|cargo)\b[^|\n]*\b(?:install|add)\b/i, signal: 'install-package' },
+  { re: /\b(?:npm|yarn|pnpm|bun)\b(?=[^|;&\n]*(?:\s['"]?-g\b['"]?|--global(?![\w-])|\bglobal\s+add\b))(?=[^|;&\n]*\s(?:install|add)(?=\s|$|[|;&\n]))|\b(?:npm|pnpm|bun)\s+(?:i(?:n(?:s(?:t(?:a(?:ll?)?)?)?)?)?|isnt(?:all)?)\b[^|;&\n]*(?:\s['"]?-g\b['"]?|--global(?![\w-]))/i, signal: 'install-package-global' },
+  { re: /(?:^|[;&|(\n]|\$\()\s*(?:\w+=\S*\s+)*(?:sudo\s+)?(?:(?:env|nohup|time|stdbuf|nice)\b(?:\s+(?:-{1,2}\S+|\w+=\S*|\d+))*\s+)*(?:sudo\s+)?(?:crontab\b(?!\s+-l\b)|at\b(?!\s+-l\b)(?!\s*$))|\/etc\/cron|\bsystemd-run\b[^|;&\n]*--on-(?:calendar|active|boot|startup|unit-active|unit-inactive)\b/i, signal: 'modify-scheduler' },
+  { re: /\bdd\b[^|;&\n]*\bof=/i, signal: 'dd-overwrite' },
+  { re: /\bch(?:mod|own)\b[^|;&\n]*(?:-\w*R\w*|--recursive)\b[^|;&\n]*\s\/(?:etc|usr|var|home|bin|sbin|boot|lib|lib64|opt|root)(?:\/\*?)?(?:\s|$)/i, signal: 'recursive-perms-system-dir' },
+  { re: /\btruncate\b[^|;&\n]*(?:-s\s*0\b|--size(?:=|\s+)0\b)/i, signal: 'truncate-to-zero' },
+  { re: /\bhistory\s+-c\b|\.bash_history|truncate\b[^|\n]*\.log/i, signal: 'wipe-history-or-logs' },
+  { re: /\/etc\/(passwd|shadow|sudoers)|~\/\.ssh|id_rsa|\.aws\/credentials|\.env\b/i, signal: 'touch-sensitive-path' },
+  { re: /(?:^|[;&|(\n]|\$\()\s*(?:\w+=\S*\s+)*(?:sudo\s+)?uvx\b/i, signal: 'registry-code-exec' },
+  { re: /(?:^|[;&|(\n]|\$\()\s*(?:\w+=\S*\s+)*(?:sudo\s+)?(?:pnpm|yarn)\b[^|;&\n]*\bdlx\b/i, signal: 'registry-code-exec' },
+  { re: /\b(?:base64|openssl|xxd|cat|http)\b[^\n|]*\|(?:[^\n|]*\|)*\s*(?:\w+=\S*\s+)*(?:sudo\s+)?(?:bash|sh|zsh|ksh|python\d?|perl|ruby|node)\b(?:\s+-)?\s*(?:[;&|\n]|$)/i, signal: 'decode-pipe-to-shell' },
+];
+
 const FALLBACK_SURFACE_KEYS = [
   'command', 'cmd', 'script', 'code', 'input', 'shell', 'run',
   'path', 'file_path', 'filePath', 'file', 'target', 'destination', 'dir', 'directory',
   'url', 'uri', 'endpoint', 'href', 'host', 'to',
 ];
 
+// The fallback is an outage-only blunt scanner; an UNBOUNDED scan over crafted
+// input is a ReDoS vector (some ported guard patterns are O(n²) on pathological
+// token runs like `git push push push …`). Dangerous/catastrophic shapes appear
+// early in any real command, so cap the scanned surface — 4 KB is far beyond a
+// real shell command. The real guard (no cap) still scans in full when it works.
+const FALLBACK_SCAN_CAP = 4096;
+
 /** Same command/path/url field set tool-action-guard.ts extracts — narrow, not the whole args object. */
 function fallbackExecSurface(args: Record<string, unknown> | undefined): string {
   const parts: string[] = [];
@@ -288,7 +332,7 @@ function fallbackExecSurface(args: Record<string, unknown> | undefined): string
     const v = args?.[k];
     if (typeof v === 'string' && v.length > 0) parts.push(v);
   }
-  return parts.join('   ');
+  return parts.join('   ').slice(0, FALLBACK_SCAN_CAP);
 }
 
 function fallbackCatastrophicMatch(args: Record<string, unknown> | undefined): boolean {
@@ -297,6 +341,16 @@ function fallbackCatastrophicMatch(args: Record<string, unknown> | undefined): b
   return FALLBACK_CATASTROPHIC_PATTERNS.some(re => re.test(text));
 }
 
+/** First matching dangerous signal for the WS2 fallback, or null (issue #59). */
+function fallbackDangerousMatch(args: Record<string, unknown> | undefined): string | null {
+  const text = fallbackExecSurface(args);
+  if (!text) return null;
+  for (const { re, signal } of FALLBACK_DANGEROUS_PATTERNS) {
+    if (re.test(text)) return signal;
+  }
+  return null;
+}
+
 /** One-line summary of tool args for audit previews (bounded, no secrets dumped). */
 export function summariseToolArgs(args: Record<string, unknown> | undefined): string {
   if (!args) return '';
@@ -327,14 +381,32 @@ export function formatActionGuardPrompt(toolName: string, v: ToolGuardVerdictLik
 
 const AUDIT_DIR = join(homedir(), '.shieldcortex', 'audit');
 
+// Issue #95: an unwritable audit sink used to be swallowed by this bare catch —
+// entries silently dropped forever. Still best-effort (an audit failure must
+// never block the agent), but the FIRST failure now warns loudly with the sink
+// path and the error, and later failures keep a drop count for the breadcrumb.
+let auditSinkFailures = 0;
+export function noteAuditSinkFailure(err: unknown): void {
+  auditSinkFailures++;
+  if (auditSinkFailures === 1) {
+    const detail = err instanceof Error ? err.message : String(err);
+    console.warn(
+      `[shieldcortex] ⚠️ audit sink UNWRITABLE (${AUDIT_DIR}): ${detail} — audit entries are being DROPPED. ` +
+      `Fix the directory permissions/disk; enforcement continues but leaves no trail until this is resolved.`,
+    );
+  }
+}
+export function __resetAuditSinkFailuresForTest(): void { auditSinkFailures = 0; }
+
 function writeAuditEntry(entry: InterceptAuditEntry): void {
   try {
     mkdirSync(AUDIT_DIR, { recursive: true });
     const date = new Date().toISOString().slice(0, 10);
     const file = join(AUDIT_DIR, `realtime-${date}.jsonl`);
     appendFileSync(file, JSON.stringify(entry) + '\n');
-  } catch {
-    // Best-effort — never block on audit failure
+  } catch (err) {
+    // Best-effort — never block on audit failure, but never silent either (#95).
+    noteAuditSinkFailure(err);
   }
 }
 
@@ -445,35 +517,66 @@ export function createInterceptor(
   function guardAuditBase(toolName: string, v: ToolGuardVerdictLike, preview: string): Omit<InterceptAuditEntry, 'action' | 'outcome'> {
     return {
       type: 'intercept', tool: toolName,
-      severity: v.severity === 'catastrophic' ? 'critical' : 'high',
+      severity: v.severity === 'catastrophic' ? 'critical' : v.decision === 'allow' ? 'low' : 'high',
       firewallResult: 'ACTION_GUARD', threats: v.signals,
-      anomalyScore: v.decision === 'block' ? 1 : 0.6,
+      anomalyScore: v.decision === 'block' ? 1 : v.decision === 'allow' ? 0.1 : 0.6,
       trustScore: 0, sensitivityLevel: 'INTERNAL', fragmentationScore: null, pipelineDurationMs: 0,
       preview: preview.slice(0, 200), ts: new Date().toISOString(),
     };
   }
 
-  // WS2 fail-closed path: when the real guard was never wired in or throws,
-  // run the narrow fallback scan and DENY (throw) a catastrophic-looking
-  // command instead of silently allowing it. The fallback recognising nothing
-  // is not evidence the command is safe, only that it isn't one of the
-  // handful of unambiguous shapes — everything else still falls through to
-  // the pre-existing fail-OPEN log-and-allow.
+  // WS2 fail-closed path (issue #59): when the real guard was never wired in or
+  // throws, run the dependency-free fallback scan. Three tiers, so no dangerous
+  // op is ever silently allowed on a scan failure — and every could-not-scan
+  // decision leaves a `gate_degraded` audit row (ACTION_GUARD_FALLBACK marker),
+  // so forensics can distinguish "scanned & allowed" from "could not scan":
+  //   1. catastrophic → hard deny, always (ignores enforce:false).
+  //   2. dangerous    → route through `failurePolicy` exactly as an unattended
+  //                     real verdict would (deny by default); enforce:false
+  //                     opts down to advisory.
+  //   3. no match     → benign/unknown: fail OPEN (a degraded guard must not
+  //                     wedge normal work) but leave a visible breadcrumb.
   function handleGuardUnavailable(context: ToolCallContext, reason: string): void {
-    if (!fallbackCatastrophicMatch(context.arguments)) {
-      log.warn(`[shieldcortex] ⚠️ action-guard unavailable (${reason}) — allowing ${context.toolName}`);
+    const preview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`.slice(0, 200);
+    const degradedBase = {
+      type: 'intercept' as const, tool: context.toolName,
+      firewallResult: 'ACTION_GUARD_FALLBACK', trustScore: 0, sensitivityLevel: 'INTERNAL',
+      fragmentationScore: null, pipelineDurationMs: 0, preview, ts: new Date().toISOString(),
+    };
+
+    // 1. Catastrophic — hard deny, always.
+    if (fallbackCatastrophicMatch(context.arguments)) {
+      emitAudit({
+        ...degradedBase, severity: 'critical', threats: ['fallback-scan'], anomalyScore: 1,
+        action: 'auto_deny', outcome: 'auto_denied',
+      });
+      log.warn(`[shieldcortex] action-guard UNAVAILABLE (${reason}) and fallback scan matched a catastrophic pattern — DENYING ${context.toolName} (fail-closed, WS2)`);
+      throw new Error(`ShieldCortex: tool call blocked — action guard unavailable (${reason}), fallback catastrophic scan matched`);
+    }
+
+    // 2. Dangerous — route through failurePolicy (the "can't obtain a verdict"
+    //    policy; a degraded guard is precisely that). enforce:false → advisory.
+    const dangerousSignal = fallbackDangerousMatch(context.arguments);
+    if (dangerousSignal) {
+      const dBase = { ...degradedBase, severity: 'high' as Severity, threats: ['fallback-scan', dangerousSignal], anomalyScore: 0.6 };
+      if (!actionGuardCfg.enforce) {
+        emitAudit({ ...dBase, action: 'gate_degraded', outcome: 'failure_allowed' });
+        log.warn(`[shieldcortex] ⚠️ action-guard unavailable (${reason}) — advisory (enforce:false), allowing dangerous ${context.toolName} [${dangerousSignal}]`);
+        return;
+      }
+      const failAction = config.failurePolicy.high;
+      emitAudit({ ...dBase, action: 'gate_degraded', outcome: failAction === 'deny' ? 'failure_denied' : 'failure_allowed' });
+      if (failAction === 'deny') {
+        log.warn(`[shieldcortex] action-guard UNAVAILABLE (${reason}) and fallback matched a DANGEROUS op [${dangerousSignal}] — DENYING ${context.toolName} (fail-closed, failure policy: deny)`);
+        throw new Error(`ShieldCortex: tool call blocked — action guard unavailable (${reason}), dangerous fallback match [${dangerousSignal}], failure policy: deny`);
+      }
       return;
     }
-    const preview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`;
-    emitAudit({
-      type: 'intercept', tool: context.toolName, severity: 'critical',
-      firewallResult: 'ACTION_GUARD_FALLBACK', threats: ['fallback-scan'],
-      anomalyScore: 1, trustScore: 0, sensitivityLevel: 'INTERNAL', fragmentationScore: null,
-      pipelineDurationMs: 0, preview: preview.slice(0, 200), ts: new Date().toISOString(),
-      action: 'auto_deny', outcome: 'auto_denied',
-    });
-    log.warn(`[shieldcortex] action-guard UNAVAILABLE (${reason}) and fallback scan matched a catastrophic pattern — DENYING ${context.toolName} (fail-closed, WS2)`);
-    throw new Error(`ShieldCortex: tool call blocked — action guard unavailable (${reason}), fallback catastrophic scan matched`);
+
+    // 3. No match — benign/unknown. Fail open, but never silently: the
+    //    gate_degraded breadcrumb makes the outage window auditable.
+    emitAudit({ ...degradedBase, severity: 'low', threats: ['fallback-scan'], anomalyScore: 0.1, action: 'gate_degraded', outcome: 'failure_allowed' });
+    log.warn(`[shieldcortex] ⚠️ action-guard unavailable (${reason}) — allowing ${context.toolName} (fallback matched nothing; fail-open)`);
   }
 
   // Action Guard: gates non-memory tool calls (shell / file / network / git).
@@ -493,7 +596,18 @@ export function createInterceptor(
       handleGuardUnavailable(context, `action-guard error: ${err instanceof Error ? err.message : err}`);
       return;
     }
-    if (v.decision === 'allow') return;
+    if (v.decision === 'allow') {
+      // Issue #95: a RECOGNISED allow (the guard evaluated a known operation
+      // family and let it through — severity above benign) leaves an audit
+      // entry, so forensics can distinguish "scanned & allowed" from "never
+      // scanned". Benign allows stay unaudited by design (volume discipline);
+      // `actionGuard.auditAllows: false` opts the recognised entries off too.
+      if (v.severity !== 'benign' && actionGuardCfg.auditAllows !== false) {
+        const allowPreview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`;
+        emitAudit({ ...guardAuditBase(context.toolName, v, allowPreview), action: 'allow', outcome: 'allowed' });
+      }
+      return;
+    }
 
     const preview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`;
     const base = guardAuditBase(context.toolName, v, preview);

package/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "shieldcortex-realtime",
-  "version": "4.47.7",
+  "version": "4.47.9",
   "name": "ShieldCortex Real-time Scanner",
   "description": "Real-time defence scanning on LLM input, memory extraction on LLM output, and active tool call interception with approval gating.",
   "kind": null,
@@ -93,6 +93,12 @@
       "description": "Family/action/signal names pre-approved for unattended agents that legitimately need specific dangerous operations (case-insensitive substring match). Never applies to catastrophic operations.",
       "type": "array",
       "advanced": true
+    },
+    "interceptor.actionGuard.auditAllows": {
+      "label": "Audit Recognised Allows",
+      "description": "Write an audit entry when the guard evaluates a recognised (sensitive-tier) operation and allows it, so forensics can distinguish scanned-and-allowed from never-scanned. Benign allows are never audited.",
+      "type": "boolean",
+      "advanced": true
     }
   },
   "configSchema": {
@@ -232,6 +238,10 @@
                   "type": "string"
                 },
                 "default": []
+              },
+              "auditAllows": {
+                "type": "boolean",
+                "default": true
               }
             }
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drakon-systems/shieldcortex-realtime",
-  "version": "4.47.7",
+  "version": "4.47.9",
   "description": "OpenClaw plugin for ShieldCortex real-time defence scanning and optional memory extraction.",
   "type": "module",
   "main": "./dist/index.js",