@drakon-systems/shieldcortex-realtime 4.54.8 → 4.54.9

package/dist/index.js

@@ -2764,6 +2764,12 @@ function handleLlmOutput(event, ctx) {
 }
 class TypedApprovalRequest extends Error {
     request;
+    /** #372 — one-shot audit writer the interceptor hangs on this error at hold
+     *  time, carrying the guard's audit base and the session the hold belongs to.
+     *  Both mint sites attach it (action-guard and memory-write pipelines).
+     *  Absent only for an older installed interceptor: then no `onResolution`
+     *  is wired at all and the card behaves exactly as it did before #372. */
+    decisionAudit;
     constructor(message, request) {
         super(message);
         this.name = "TypedApprovalRequest";
@@ -2819,6 +2825,26 @@ function buildTypedApprovalRequest(message) {
     };
 }
 export const __buildTypedApprovalRequestForTest = buildTypedApprovalRequest;
+/** #372 — the operator's answer, as the audit stream records it.
+ *
+ * `allow-always` is defensive: today's card only offers allow-once/deny (see
+ * `allowedDecisions`), but a host that grows the button must not be able to
+ * produce an approval nobody can find afterwards. It maps to `approved_once`
+ * rather than a sticky outcome because ShieldCortex grants nothing durable
+ * here — the next call is gated again. */
+/** The decision label as it may appear in a gateway log line. Host-supplied,
+ *  so it is reduced to an identifier shape first — a log line is not a place to
+ *  render whatever a caller passed. */
+function safeDecisionLabel(decision) {
+    return String(decision).replace(/[^A-Za-z0-9_.:-]/gu, "?").slice(0, 32) || "unknown";
+}
+const CARD_DECISION_OUTCOME = {
+    "allow-once": "approved_once",
+    "allow-always": "approved_once",
+    deny: "card_denied",
+    timeout: "card_timeout",
+    cancelled: "card_cancelled",
+};
 async function handleTypedBeforeToolCall(event, interceptor, logger, ctx) {
     const sessionId = resolveHookSessionId(event, ctx);
     // #310: a card is only worth minting when a human is there to tap it. Cron
@@ -2844,6 +2870,28 @@ async function handleTypedBeforeToolCall(event, interceptor, logger, ctx) {
     }
     catch (err) {
         if (err instanceof TypedApprovalRequest) {
+            const decisionAudit = err.decisionAudit;
+            if (decisionAudit) {
+                // #372: the hold writes no row because no decision exists yet — THIS is
+                // where the operator's answer becomes one. The host owns this callback
+                // and awaits it, so it must never see a throw: a broken audit sink is
+                // not a reason to disturb a decision the operator already made.
+                err.request.onResolution = (decision) => {
+                    try {
+                        const outcome = Object.hasOwn(CARD_DECISION_OUTCOME, decision) ? CARD_DECISION_OUTCOME[decision] : undefined;
+                        if (!outcome) {
+                            // A decision this build does not know. Say so loudly rather than
+                            // guess — inventing an outcome would forge the operator's answer.
+                            logger?.warn?.(`[shieldcortex] unrecognised approval decision '${safeDecisionLabel(decision)}' — no audit row written`);
+                            return;
+                        }
+                        decisionAudit(outcome);
+                    }
+                    catch (auditErr) {
+                        logger?.warn?.(`[shieldcortex] approval decision audit failed (${safeDecisionLabel(decision)}): ${auditErr instanceof Error ? auditErr.message : auditErr}`);
+                    }
+                };
+            }
             return { requireApproval: err.request };
         }
         if (err instanceof Error && err.message.startsWith("ShieldCortex:")) {

package/dist/interceptor.js

@@ -4,6 +4,11 @@ import { join, isAbsolute, resolve as resolvePath } from 'node:path';
 import { homedir } from 'node:os';
 import { createGatewayInvoker } from './broker-invoker.js';
 import { escalateForTaint } from './session-taint.js';
+/** #372 — the runtime mirror of ApprovalDecisionOutcome: the closure crosses a
+ *  plugin boundary, so the union is enforced with a Set, not just the compiler. */
+const CARD_AUDIT_OUTCOMES = new Set([
+    'approved_once', 'card_denied', 'card_timeout', 'card_cancelled',
+]);
 const WATCHED_TOOLS = ['remember', 'mcp__memory__remember'];
 const CONTENT_FIELDS = {
     remember: ['content', 'title'],
@@ -538,14 +543,16 @@ export function createInterceptor(config, pipeline, options) {
     const judgeLimiter = new RateLimiter(options?.maxJudgeCallsPerMinute ?? 20);
     /** Bare tool names seen this session, newest last. See buildSessionSummary. */
     const recentTools = [];
-    function emitAudit(entry) {
-        const sessionKey = options?.sessionGuard?.keyFor(lastSessionId) ?? undefined;
+    /** The one write path every intercept row takes. `captured` is normally the
+     *  in-flight call (emitAudit below); #372 hands it a hold-time snapshot so a
+     *  decision that arrives after the turn moved on still lands on ITS call. */
+    function emitAuditWith(entry, captured) {
         const withOrigin = {
             ...entry,
             origin: 'openclaw-interceptor',
-            ...(sessionKey ? { sessionKey } : {}),
+            ...(captured.sessionKey ? { sessionKey: captured.sessionKey } : {}),
         };
-        const bound = bindAudit ? bindAudit(withOrigin, lastCallArgs) : withOrigin;
+        const bound = bindAudit ? bindAudit(withOrigin, captured.args) : withOrigin;
         writeAuditEntry(bound);
         try {
             options?.sessionGuard?.index(bound);
@@ -553,6 +560,62 @@ export function createInterceptor(config, pipeline, options) {
         catch { /* never wedge the turn */ }
         onAuditEntry?.(bound);
     }
+    function emitAudit(entry) {
+        emitAuditWith(entry, {
+            sessionKey: options?.sessionGuard?.keyFor(lastSessionId) ?? undefined,
+            args: lastCallArgs,
+        });
+    }
+    /**
+     * #372 — hang a one-shot decision writer on a minted approval card.
+     *
+     * The hold itself is still unaudited by design: no decision exists yet. What
+     * was missing is the other end — the host reports the operator's answer on
+     * the request's `onResolution`, and nothing on that path knew what the guard
+     * saw, so an operator-APPROVED dangerous action left no intercept row at all
+     * (invisible to the #260 session summaries).
+     *
+     * Everything the row needs is captured HERE: the guard's audit base, the
+     * session key, and the args behind the #224 actionKey. Nothing about the
+     * approval prompt is retained — the preview is the guard's own already-bounded
+     * one, so the secret-egress discipline the card copy follows holds here too.
+     */
+    function attachDecisionAudit(err, auditBase) {
+        let sessionKey;
+        // Resolving the key is new work on the card path — nothing used to call
+        // keyFor here. A throwing resolver costs the row its key; it must never
+        // turn a mintable card into an approval error.
+        try {
+            sessionKey = options?.sessionGuard?.keyFor(lastSessionId) ?? undefined;
+        }
+        catch { /* unkeyed row */ }
+        // Shallow-snapshot the args: reference capture would let in-place mutation
+        // of the params object between hold and resolution rewrite the one
+        // forensic binding this row exists to protect (review nit, both reviewers).
+        const captured = { sessionKey, args: lastCallArgs ? { ...lastCallArgs } : undefined };
+        const held = { ...auditBase };
+        let written = false;
+        err.decisionAudit = (outcome) => {
+            // The closure's type says CardAuditOutcome, but it crosses a plugin
+            // boundary — make the union real at runtime rather than trusting the
+            // caller's compiler (defence-in-depth, both reviewers).
+            if (!CARD_AUDIT_OUTCOMES.has(outcome))
+                return;
+            // The host resolves a card once. Enforcing it here is cheaper than
+            // trusting it: a duplicate row would double-count in every summary.
+            if (written)
+                return;
+            written = true;
+            // Never throws, by contract — even if the audit plumbing does. The latch
+            // is consumed either way: never-double-write beats a retried row.
+            try {
+                // ts is the DECISION time; the hold time stays in heldAtTs so
+                // forensics can see both ends of the operator's think.
+                emitAuditWith({ ...held, heldAtTs: held.ts, ts: new Date().toISOString(), action: 'require_approval', outcome }, captured);
+            }
+            catch { /* audit is best-effort; the decision itself already happened */ }
+        };
+    }
     function guardAuditBase(toolName, v, preview) {
         return {
             type: 'intercept', tool: toolName,
@@ -931,8 +994,12 @@ export function createInterceptor(config, pipeline, options) {
             // #310: a minted approval card, not an error. Re-thrown untouched so the
             // typed-hook bridge can turn it into the operator's card; auditing it
             // here would write a denial for a decision nobody has made yet.
-            if (isTypedApprovalRequest(err))
+            if (isTypedApprovalRequest(err)) {
+                // #372: still no row for the hold — but the card leaves carrying the
+                // closure that writes one the moment the operator answers.
+                attachDecisionAudit(err, auditBase);
                 throw err;
+            }
             if (brokered && err instanceof ApprovalTimeout) {
                 // The asymmetric path. Silence is only ever a yes for something the
                 // broker already pre-cleared — and that returned long before here — so
@@ -1103,8 +1170,17 @@ export function createInterceptor(config, pipeline, options) {
         catch (err) {
             // #310: same bridge, same rule — the card request is not an approval
             // failure. Everything else below stays fail-closed.
-            if (isTypedApprovalRequest(err))
+            // #372: this path (memory-write pipeline) mints cards too — its
+            // operator decision must leave the same audit row as the action-guard
+            // lane, captured at hold time for the same attribution reasons.
+            if (isTypedApprovalRequest(err)) {
+                attachDecisionAudit(err, {
+                    type: 'intercept', tool: context.toolName, severity, firewallResult,
+                    threats, anomalyScore, trustScore, sensitivityLevel, fragmentationScore, pipelineDurationMs,
+                    preview: fullContent.slice(0, 200), ts: new Date().toISOString(),
+                });
                 throw err;
+            }
             const failAction = config.failurePolicy[severity];
             log.warn(`[shieldcortex] ⚠️ requireApproval error: ${err instanceof Error ? err.message : err} — failure policy: ${failAction}`);
             const entry = {

package/dist/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "shieldcortex-realtime",
-  "version": "4.54.8",
+  "version": "4.54.9",
   "name": "ShieldCortex Real-time Scanner",
   "description": "Real-time defence scanning on LLM input, memory extraction on LLM output, and active tool call interception with approval gating.",
   "kind": null,
@@ -121,7 +121,7 @@
     },
     "interceptor.conversation.posture": {
       "label": "Conversation Firewall",
-      "description": "What the conversation firewall does with a detection on the input path. off = do not scan; observe = scan, audit and alert the operator but never stop the turn (default); enforce = block the run via before_agent_run. Requires plugins.entries.shieldcortex-realtime.hooks.allowConversationAccess=true on this host \u2014 OpenClaw refuses conversation hooks without that operator grant, and ShieldCortex will never set it for you.",
+      "description": "What the conversation firewall does with a detection on the input path. off = do not scan; observe = scan, audit and alert the operator but never stop the turn (default); enforce = block the run via before_agent_run. Requires plugins.entries.shieldcortex-realtime.hooks.allowConversationAccess=true on this host — OpenClaw refuses conversation hooks without that operator grant, and ShieldCortex will never set it for you.",
       "type": "string"
     },
     "interceptor.actionGuard.notify.enabled": {
@@ -132,7 +132,7 @@
     },
     "interceptor.actionGuard.notify.webhookUrl": {
       "label": "Notify Webhook URL",
-      "description": "http(s) endpoint the notification is POSTed to. Conversation-firewall alerts carry no approve/deny affordance \u2014 there is nothing to approve.",
+      "description": "http(s) endpoint the notification is POSTed to. Conversation-firewall alerts carry no approve/deny affordance — there is nothing to approve.",
       "type": "string",
       "advanced": true
     },
@@ -156,7 +156,7 @@
     "properties": {
       "enabled": {
         "type": "boolean",
-        "description": "Unused \u2014 plugin on/off is controlled by plugins.entries[id].enabled on the host, not this nested config value. See #115."
+        "description": "Unused — plugin on/off is controlled by plugins.entries[id].enabled on the host, not this nested config value. See #115."
       },
       "binaryPath": {
         "type": "string"
@@ -190,7 +190,7 @@
           "trustOwnerInput": {
             "type": "boolean",
             "default": true,
-            "description": "Default true: a message the host attributes to the gateway OWNER is an instruction, so a detection in it is audited and alerted but never taints the session or blocks the turn. Set false on a host where the owner routinely pastes untrusted content and you would rather have the caution than the quiet. Content from anyone else \u2014 including another agent on a trusted channel \u2014 is data regardless of this setting."
+            "description": "Default true: a message the host attributes to the gateway OWNER is an instruction, so a detection in it is audited and alerted but never taints the session or blocks the turn. Set false on a host where the owner routinely pastes untrusted content and you would rather have the caution than the quiet. Content from anyone else — including another agent on a trusted channel — is data regardless of this setting."
           }
         }
       },
@@ -368,7 +368,7 @@
               "notify": {
                 "type": "object",
                 "additionalProperties": false,
-                "description": "Operator-notify transport (#143), also used by the conversation firewall\u2019s detection sink (#225). Off unless enabled is exactly true.",
+                "description": "Operator-notify transport (#143), also used by the conversation firewall’s detection sink (#225). Off unless enabled is exactly true.",
                 "properties": {
                   "enabled": {
                     "type": "boolean",
@@ -491,7 +491,7 @@
           "notify": {
             "type": "object",
             "additionalProperties": false,
-            "description": "Operator-notify transport (#143), also used by the conversation firewall\u2019s detection sink (#225). Off unless enabled is exactly true.",
+            "description": "Operator-notify transport (#143), also used by the conversation firewall’s detection sink (#225). Off unless enabled is exactly true.",
             "properties": {
               "enabled": {
                 "type": "boolean",

package/index.ts

@@ -38,7 +38,7 @@ import { isTaintingScanSummary, severityFromScanSummary } from './scan-taint-pol
 import { classifyConversationOrigin } from './conversation-trust.js';
 import type { ConversationTrustDecision } from './conversation-trust.js';
 import { createInterceptor, DEFAULT_CONFIG as DEFAULT_INTERCEPTOR_CONFIG } from './interceptor.js';
-import type { InterceptorConfig, BrokerRuntime } from './interceptor.js';
+import type { ApprovalDecisionAudit, ApprovalDecisionOutcome, InterceptorConfig, BrokerRuntime } from './interceptor.js';
 import { syncInterceptEvent } from './intercept-ingest.js';
 import { cloudSync } from './cloud-sync.js';
 import { createGatewayNotifyChannel } from './gateway-notify-channel.js';
@@ -405,6 +405,10 @@ type TypedBeforeToolCallEvent = {
   // send one, and every other hook's event carries it.
   sessionId?: string;
 };
+/** Every answer the host can report for a minted card. The first three are
+ *  buttons (a subset of which the card offers via `allowedDecisions`); the last
+ *  two are the host closing the card without one. */
+type CardDecision = "allow-once" | "allow-always" | "deny" | "timeout" | "cancelled";
 type TypedBeforeToolCallResult = {
   block?: boolean;
   blockReason?: string;
@@ -414,8 +418,8 @@ type TypedBeforeToolCallResult = {
     severity?: "info" | "warning" | "critical";
     timeoutMs?: number;
     timeoutBehavior?: "allow" | "deny";
-    allowedDecisions?: Array<"allow-once" | "allow-always" | "deny">;
-    onResolution?: (decision: "allow-once" | "allow-always" | "deny" | "timeout" | "cancelled") => Promise<void> | void;
+    allowedDecisions?: Array<Extract<CardDecision, "allow-once" | "allow-always" | "deny">>;
+    onResolution?: (decision: CardDecision) => Promise<void> | void;
   };
 };
 type PluginApi = {
@@ -3292,6 +3296,12 @@ function handleLlmOutput(event: LlmOutputEvent, ctx: AgentCtx): void {
 
 class TypedApprovalRequest extends Error {
   request: NonNullable<TypedBeforeToolCallResult["requireApproval"]>;
+  /** #372 — one-shot audit writer the interceptor hangs on this error at hold
+   *  time, carrying the guard's audit base and the session the hold belongs to.
+   *  Both mint sites attach it (action-guard and memory-write pipelines).
+   *  Absent only for an older installed interceptor: then no `onResolution`
+   *  is wired at all and the card behaves exactly as it did before #372. */
+  decisionAudit?: ApprovalDecisionAudit;
 
   constructor(message: string, request: NonNullable<TypedBeforeToolCallResult["requireApproval"]>) {
     super(message);
@@ -3355,6 +3365,28 @@ function buildTypedApprovalRequest(message: string): NonNullable<TypedBeforeTool
 
 export const __buildTypedApprovalRequestForTest = buildTypedApprovalRequest;
 
+/** #372 — the operator's answer, as the audit stream records it.
+ *
+ * `allow-always` is defensive: today's card only offers allow-once/deny (see
+ * `allowedDecisions`), but a host that grows the button must not be able to
+ * produce an approval nobody can find afterwards. It maps to `approved_once`
+ * rather than a sticky outcome because ShieldCortex grants nothing durable
+ * here — the next call is gated again. */
+/** The decision label as it may appear in a gateway log line. Host-supplied,
+ *  so it is reduced to an identifier shape first — a log line is not a place to
+ *  render whatever a caller passed. */
+function safeDecisionLabel(decision: unknown): string {
+  return String(decision).replace(/[^A-Za-z0-9_.:-]/gu, "?").slice(0, 32) || "unknown";
+}
+
+const CARD_DECISION_OUTCOME: Record<CardDecision, ApprovalDecisionOutcome> = {
+  "allow-once": "approved_once",
+  "allow-always": "approved_once",
+  deny: "card_denied",
+  timeout: "card_timeout",
+  cancelled: "card_cancelled",
+};
+
 async function handleTypedBeforeToolCall(
   event: TypedBeforeToolCallEvent,
   interceptor: ReturnType<typeof createInterceptor>,
@@ -3384,6 +3416,27 @@ async function handleTypedBeforeToolCall(
     });
   } catch (err) {
     if (err instanceof TypedApprovalRequest) {
+      const decisionAudit = err.decisionAudit;
+      if (decisionAudit) {
+        // #372: the hold writes no row because no decision exists yet — THIS is
+        // where the operator's answer becomes one. The host owns this callback
+        // and awaits it, so it must never see a throw: a broken audit sink is
+        // not a reason to disturb a decision the operator already made.
+        err.request.onResolution = (decision: CardDecision) => {
+          try {
+            const outcome = Object.hasOwn(CARD_DECISION_OUTCOME, decision) ? CARD_DECISION_OUTCOME[decision] : undefined;
+            if (!outcome) {
+              // A decision this build does not know. Say so loudly rather than
+              // guess — inventing an outcome would forge the operator's answer.
+              (logger as any)?.warn?.(`[shieldcortex] unrecognised approval decision '${safeDecisionLabel(decision)}' — no audit row written`);
+              return;
+            }
+            decisionAudit(outcome);
+          } catch (auditErr) {
+            (logger as any)?.warn?.(`[shieldcortex] approval decision audit failed (${safeDecisionLabel(decision)}): ${auditErr instanceof Error ? auditErr.message : auditErr}`);
+          }
+        };
+      }
       return { requireApproval: err.request };
     }
 

package/interceptor.ts

@@ -198,9 +198,55 @@ export interface ToolCallContext {
   sessionId?: string;
 }
 
+/**
+ * #372 — outcomes only an OpenClaw-native approval card can produce.
+ *
+ * The card is minted by throwing (see isTypedApprovalRequest) and the
+ * operator's answer comes back through the host minutes later, long after the
+ * hook returned. These outcomes are deliberately distinct from the synchronous
+ * `approved`/`denied` pair: a row that says `approved_once` is a human tapping
+ * a button on a card, not an approver function returning true inside the turn.
+ */
+export type ApprovalDecisionOutcome =
+  | 'approved_once'
+  | 'card_denied'
+  | 'card_timeout'
+  | 'card_cancelled';
+
+/** #372 — the runtime mirror of ApprovalDecisionOutcome: the closure crosses a
+ *  plugin boundary, so the union is enforced with a Set, not just the compiler. */
+const CARD_AUDIT_OUTCOMES: ReadonlySet<string> = new Set([
+  'approved_once', 'card_denied', 'card_timeout', 'card_cancelled',
+]);
+
+/** #372 — one-shot writer for the decision a held card eventually receives.
+ *  Hung on the thrown approval request by the interceptor; invoked by the
+ *  plugin bridge from the host's `onResolution`. Never throws. */
+export type ApprovalDecisionAudit = (outcome: ApprovalDecisionOutcome) => void;
+
+/** Structural view of the plugin's TypedApprovalRequest error. Matched by
+ *  shape and never imported — the same compile-time-independence discipline as
+ *  isTypedApprovalRequest and ToolGuardVerdictLike. */
+interface DecisionAuditCarrier {
+  decisionAudit?: ApprovalDecisionAudit;
+}
+
+/** #372 — what an audit row needs from the tool call that produced it,
+ *  snapshotted at hold time. A card decision lands minutes later, by which
+ *  point the interceptor's live `lastSessionId`/`lastCallArgs` may describe a
+ *  completely different call — attributing the decision to THAT call would be
+ *  a forgery in exactly the record forensics trusts. */
+interface CapturedAuditContext {
+  sessionKey?: string;
+  args?: Record<string, unknown>;
+}
+
 export interface InterceptAuditEntry {
   type: 'intercept';
   tool: string;
+  /** #372 — card decision rows only: when the action was HELD. `ts` on those
+   *  rows is the operator's decision time; the pair bounds the wait. */
+  heldAtTs?: string;
   severity: Severity;
   firewallResult: string;
   threats: string[];
@@ -210,7 +256,10 @@ export interface InterceptAuditEntry {
   fragmentationScore: number | null;  // from the pipeline result's fragmentation score, or null
   pipelineDurationMs: number;         // wall-clock ms around the runDefencePipeline call
   action: InterceptAction | 'auto_deny' | 'rate_limit' | 'allow' | 'gate_degraded';
-  outcome: 'approved' | 'denied' | 'auto_denied' | 'logged' | 'warned' | 'failure_allowed' | 'failure_denied' | 'allowed';
+  outcome: 'approved' | 'denied' | 'auto_denied' | 'logged' | 'warned' | 'failure_allowed' | 'failure_denied' | 'allowed'
+    // #372 — card-held decisions, written when the operator answers rather than
+    // when the hold is taken. `action` for these rows is 'require_approval'.
+    | ApprovalDecisionOutcome;
   preview: string;
   ts: string;
   /** The approval broker's record for this call (#143). Present on exactly the
@@ -560,7 +609,7 @@ export function formatActionGuardPrompt(toolName: string, v: ToolGuardVerdictLik
  * error is exactly what turned every native card into a `failure_denied` the
  * operator never saw.
  */
-function isTypedApprovalRequest(err: unknown): boolean {
+function isTypedApprovalRequest(err: unknown): err is Error & DecisionAuditCarrier {
   return err instanceof Error && err.name === 'TypedApprovalRequest';
 }
 
@@ -907,19 +956,79 @@ export function createInterceptor(
   /** Bare tool names seen this session, newest last. See buildSessionSummary. */
   const recentTools: string[] = [];
 
-  function emitAudit(entry: InterceptAuditEntry): void {
-    const sessionKey = options?.sessionGuard?.keyFor(lastSessionId) ?? undefined;
+  /** The one write path every intercept row takes. `captured` is normally the
+   *  in-flight call (emitAudit below); #372 hands it a hold-time snapshot so a
+   *  decision that arrives after the turn moved on still lands on ITS call. */
+  function emitAuditWith(entry: InterceptAuditEntry, captured: CapturedAuditContext): void {
     const withOrigin: InterceptAuditEntry = {
       ...entry,
       origin: 'openclaw-interceptor',
-      ...(sessionKey ? { sessionKey } : {}),
+      ...(captured.sessionKey ? { sessionKey: captured.sessionKey } : {}),
     };
-    const bound = bindAudit ? bindAudit(withOrigin, lastCallArgs) : withOrigin;
+    const bound = bindAudit ? bindAudit(withOrigin, captured.args) : withOrigin;
     writeAuditEntry(bound);
     try { options?.sessionGuard?.index(bound); } catch { /* never wedge the turn */ }
     onAuditEntry?.(bound);
   }
 
+  function emitAudit(entry: InterceptAuditEntry): void {
+    emitAuditWith(entry, {
+      sessionKey: options?.sessionGuard?.keyFor(lastSessionId) ?? undefined,
+      args: lastCallArgs,
+    });
+  }
+
+  /**
+   * #372 — hang a one-shot decision writer on a minted approval card.
+   *
+   * The hold itself is still unaudited by design: no decision exists yet. What
+   * was missing is the other end — the host reports the operator's answer on
+   * the request's `onResolution`, and nothing on that path knew what the guard
+   * saw, so an operator-APPROVED dangerous action left no intercept row at all
+   * (invisible to the #260 session summaries).
+   *
+   * Everything the row needs is captured HERE: the guard's audit base, the
+   * session key, and the args behind the #224 actionKey. Nothing about the
+   * approval prompt is retained — the preview is the guard's own already-bounded
+   * one, so the secret-egress discipline the card copy follows holds here too.
+   */
+  function attachDecisionAudit(
+    err: Error & DecisionAuditCarrier,
+    auditBase: Omit<InterceptAuditEntry, 'action' | 'outcome'>,
+  ): void {
+    let sessionKey: string | undefined;
+    // Resolving the key is new work on the card path — nothing used to call
+    // keyFor here. A throwing resolver costs the row its key; it must never
+    // turn a mintable card into an approval error.
+    try { sessionKey = options?.sessionGuard?.keyFor(lastSessionId) ?? undefined; } catch { /* unkeyed row */ }
+    // Shallow-snapshot the args: reference capture would let in-place mutation
+    // of the params object between hold and resolution rewrite the one
+    // forensic binding this row exists to protect (review nit, both reviewers).
+    const captured: CapturedAuditContext = { sessionKey, args: lastCallArgs ? { ...lastCallArgs } : undefined };
+    const held: Omit<InterceptAuditEntry, 'action' | 'outcome'> = { ...auditBase };
+    let written = false;
+    err.decisionAudit = (outcome) => {
+      // The closure's type says CardAuditOutcome, but it crosses a plugin
+      // boundary — make the union real at runtime rather than trusting the
+      // caller's compiler (defence-in-depth, both reviewers).
+      if (!CARD_AUDIT_OUTCOMES.has(outcome)) return;
+      // The host resolves a card once. Enforcing it here is cheaper than
+      // trusting it: a duplicate row would double-count in every summary.
+      if (written) return;
+      written = true;
+      // Never throws, by contract — even if the audit plumbing does. The latch
+      // is consumed either way: never-double-write beats a retried row.
+      try {
+        // ts is the DECISION time; the hold time stays in heldAtTs so
+        // forensics can see both ends of the operator's think.
+        emitAuditWith(
+          { ...held, heldAtTs: held.ts, ts: new Date().toISOString(), action: 'require_approval', outcome },
+          captured,
+        );
+      } catch { /* audit is best-effort; the decision itself already happened */ }
+    };
+  }
+
   function guardAuditBase(toolName: string, v: ToolGuardVerdictLike, preview: string): Omit<InterceptAuditEntry, 'action' | 'outcome'> {
     return {
       type: 'intercept', tool: toolName,
@@ -1317,7 +1426,12 @@ export function createInterceptor(
       // #310: a minted approval card, not an error. Re-thrown untouched so the
       // typed-hook bridge can turn it into the operator's card; auditing it
       // here would write a denial for a decision nobody has made yet.
-      if (isTypedApprovalRequest(err)) throw err;
+      if (isTypedApprovalRequest(err)) {
+        // #372: still no row for the hold — but the card leaves carrying the
+        // closure that writes one the moment the operator answers.
+        attachDecisionAudit(err, auditBase);
+        throw err;
+      }
       if (brokered && err instanceof ApprovalTimeout) {
         // The asymmetric path. Silence is only ever a yes for something the
         // broker already pre-cleared — and that returned long before here — so
@@ -1500,7 +1614,17 @@ export function createInterceptor(
     } catch (err) {
       // #310: same bridge, same rule — the card request is not an approval
       // failure. Everything else below stays fail-closed.
-      if (isTypedApprovalRequest(err)) throw err;
+      // #372: this path (memory-write pipeline) mints cards too — its
+      // operator decision must leave the same audit row as the action-guard
+      // lane, captured at hold time for the same attribution reasons.
+      if (isTypedApprovalRequest(err)) {
+        attachDecisionAudit(err, {
+          type: 'intercept', tool: context.toolName, severity, firewallResult,
+          threats, anomalyScore, trustScore, sensitivityLevel, fragmentationScore, pipelineDurationMs,
+          preview: fullContent.slice(0, 200), ts: new Date().toISOString(),
+        });
+        throw err;
+      }
       const failAction = config.failurePolicy[severity];
       log.warn(`[shieldcortex] ⚠️ requireApproval error: ${err instanceof Error ? err.message : err} — failure policy: ${failAction}`);
       const entry: InterceptAuditEntry = {

package/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "shieldcortex-realtime",
-  "version": "4.54.8",
+  "version": "4.54.9",
   "name": "ShieldCortex Real-time Scanner",
   "description": "Real-time defence scanning on LLM input, memory extraction on LLM output, and active tool call interception with approval gating.",
   "kind": null,
@@ -121,7 +121,7 @@
     },
     "interceptor.conversation.posture": {
       "label": "Conversation Firewall",
-      "description": "What the conversation firewall does with a detection on the input path. off = do not scan; observe = scan, audit and alert the operator but never stop the turn (default); enforce = block the run via before_agent_run. Requires plugins.entries.shieldcortex-realtime.hooks.allowConversationAccess=true on this host \u2014 OpenClaw refuses conversation hooks without that operator grant, and ShieldCortex will never set it for you.",
+      "description": "What the conversation firewall does with a detection on the input path. off = do not scan; observe = scan, audit and alert the operator but never stop the turn (default); enforce = block the run via before_agent_run. Requires plugins.entries.shieldcortex-realtime.hooks.allowConversationAccess=true on this host — OpenClaw refuses conversation hooks without that operator grant, and ShieldCortex will never set it for you.",
       "type": "string"
     },
     "interceptor.actionGuard.notify.enabled": {
@@ -132,7 +132,7 @@
     },
     "interceptor.actionGuard.notify.webhookUrl": {
       "label": "Notify Webhook URL",
-      "description": "http(s) endpoint the notification is POSTed to. Conversation-firewall alerts carry no approve/deny affordance \u2014 there is nothing to approve.",
+      "description": "http(s) endpoint the notification is POSTed to. Conversation-firewall alerts carry no approve/deny affordance — there is nothing to approve.",
       "type": "string",
       "advanced": true
     },
@@ -156,7 +156,7 @@
     "properties": {
       "enabled": {
         "type": "boolean",
-        "description": "Unused \u2014 plugin on/off is controlled by plugins.entries[id].enabled on the host, not this nested config value. See #115."
+        "description": "Unused — plugin on/off is controlled by plugins.entries[id].enabled on the host, not this nested config value. See #115."
       },
       "binaryPath": {
         "type": "string"
@@ -190,7 +190,7 @@
           "trustOwnerInput": {
             "type": "boolean",
             "default": true,
-            "description": "Default true: a message the host attributes to the gateway OWNER is an instruction, so a detection in it is audited and alerted but never taints the session or blocks the turn. Set false on a host where the owner routinely pastes untrusted content and you would rather have the caution than the quiet. Content from anyone else \u2014 including another agent on a trusted channel \u2014 is data regardless of this setting."
+            "description": "Default true: a message the host attributes to the gateway OWNER is an instruction, so a detection in it is audited and alerted but never taints the session or blocks the turn. Set false on a host where the owner routinely pastes untrusted content and you would rather have the caution than the quiet. Content from anyone else — including another agent on a trusted channel — is data regardless of this setting."
           }
         }
       },
@@ -368,7 +368,7 @@
               "notify": {
                 "type": "object",
                 "additionalProperties": false,
-                "description": "Operator-notify transport (#143), also used by the conversation firewall\u2019s detection sink (#225). Off unless enabled is exactly true.",
+                "description": "Operator-notify transport (#143), also used by the conversation firewall’s detection sink (#225). Off unless enabled is exactly true.",
                 "properties": {
                   "enabled": {
                     "type": "boolean",
@@ -491,7 +491,7 @@
           "notify": {
             "type": "object",
             "additionalProperties": false,
-            "description": "Operator-notify transport (#143), also used by the conversation firewall\u2019s detection sink (#225). Off unless enabled is exactly true.",
+            "description": "Operator-notify transport (#143), also used by the conversation firewall’s detection sink (#225). Off unless enabled is exactly true.",
             "properties": {
               "enabled": {
                 "type": "boolean",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drakon-systems/shieldcortex-realtime",
-  "version": "4.54.8",
+  "version": "4.54.9",
   "description": "OpenClaw plugin for ShieldCortex real-time defence scanning and optional memory extraction.",
   "type": "module",
   "main": "./dist/index.js",
@@ -24,7 +24,7 @@
   ],
   "scripts": {
     "pack:verify": "npm pack --dry-run",
-    "prepublishOnly": "node -e \"if(!require('fs').existsSync('dist/index.js'))throw new Error('plugin dist/index.js missing \u2014 run `npm run build:ts` from the repo root before publishing')\""
+    "prepublishOnly": "node -e \"if(!require('fs').existsSync('dist/index.js'))throw new Error('plugin dist/index.js missing — run `npm run build:ts` from the repo root before publishing')\""
   },
   "peerDependencies": {
     "shieldcortex": "^4.54.8",