@drakon-systems/shieldcortex-realtime 5.2.0 → 5.2.1

package/dist/index.js

@@ -630,6 +630,27 @@ function detectHostOpenClawFromDisk() {
 export function detectHostOpenClawVersion() {
     return detectHostOpenClaw().version;
 }
+/**
+ * #594 (ADR-002 §5C): hand the detected host version to the guard so the
+ * reviewed `sessions_spawn` contract is judged by the revision measured at
+ * this host. Returns what was recorded (null = unknown host, which the guard
+ * reads as the union of measured revisions — never a guess). Never throws:
+ * an older installed dist has no setter, and a throwing one must not take
+ * interceptor construction down.
+ */
+export function recordHostVersionForGuard(defenceMod) {
+    const setter = defenceMod?.setNativeHostVersion;
+    if (typeof setter !== 'function')
+        return null;
+    const version = detectHostOpenClaw().version;
+    try {
+        setter('openclaw', version);
+    }
+    catch {
+        return null;
+    }
+    return version;
+}
 /**
  * Does this host have the `before_agent_run` gate at all?
  *
@@ -3619,6 +3640,14 @@ export default {
                         const degradedPipeline = () => {
                             throw new Error('ShieldCortex: defence pipeline unavailable (dist missing or incomplete)');
                         };
+                        // #594 (ADR-002 §5C): tell the guard which host version its reviewed
+                        // native contracts are being judged against, so `sessions_spawn` is
+                        // judged by the revision MEASURED at this host rather than by one flat
+                        // bag. Same evidence order as the conversation gate: the runtime's own
+                        // version first, the install's package.json second, and null (which the
+                        // guard reads as "unknown host — union of measured revisions") when
+                        // neither is available. Absent on an older dist; then nothing changes.
+                        recordHostVersionForGuard(defenceMod);
                         interceptorReady = createInterceptor(interceptorConfig, canRunPipeline ? defenceMod.runDefencePipeline : degradedPipeline, {
                             evaluateToolCall: typeof defenceMod?.evaluateToolCall === 'function'
                                 ? defenceMod.evaluateToolCall

package/dist/interceptor.js

@@ -4,6 +4,26 @@ import { join, isAbsolute, resolve as resolvePath } from 'node:path';
 import { homedir } from 'node:os';
 import { createGatewayInvoker } from './broker-invoker.js';
 import { escalateForTaint } from './session-taint.js';
+/**
+ * One clause for the CONTRACT DRIFT warning naming the judging revision and
+ * what the selection means for the operator (#594). `floor` and `beyond` are
+ * the two that say "the measurement is older than the host — re-measure";
+ * `unknown-host` says the host never stated a version. Bounded: the host
+ * version was neutralised and length-capped where the observation was minted.
+ */
+export function describeDriftRevision(rev) {
+    if (!rev)
+        return '';
+    const host = rev.hostVersion ?? 'unknown';
+    switch (rev.selection) {
+        case 'exact': return `; judged by revision ${rev.measuredAt} = host ${host}`;
+        case 'floor': return `; judged by revision ${rev.measuredAt}, the nearest measured below host ${host} — re-measure the host`;
+        case 'beyond': return `; judged by revision ${rev.measuredAt}, older than host ${host} — re-measure the host`;
+        case 'below': return `; judged by revision ${rev.measuredAt}, newer than host ${host}`;
+        case 'unknown-host': return `; judged by ${rev.measuredAt} — host version unknown`;
+        default: return `; judged by revision ${rev.measuredAt} (${rev.selection}; host ${host})`;
+    }
+}
 /** #372 — the runtime mirror of ApprovalDecisionOutcome: the closure crosses a
  *  plugin boundary, so the union is enforced with a Set, not just the compiler. */
 const CARD_AUDIT_OUTCOMES = new Set([
@@ -219,7 +239,10 @@ const FALLBACK_DANGEROUS_PATTERNS = [
     { re: /\bch(?:mod|own)\b[^|;&\n]*(?:-\w*R\w*|--recursive)\b[^|;&\n]*\s\/(?:etc|usr|var|home|bin|sbin|boot|lib|lib64|opt|root)(?:\/\*?)?(?:\s|$)/i, signal: 'recursive-perms-system-dir' },
     { re: /\btruncate\b[^|;&\n]*(?:-s\s*0\b|--size(?:=|\s+)0\b)/i, signal: 'truncate-to-zero' },
     { re: /\bhistory\s+-c\b|\.bash_history|truncate\b[^|\n]*\.log/i, signal: 'wipe-history-or-logs' },
-    { re: /\/etc\/(passwd|shadow|sudoers)|~\/\.ssh|id_rsa|\.aws\/credentials|\.env\b/i, signal: 'touch-sensitive-path' },
+    // #505: `.ssh` behind any home root + `authorized_keys` as a path segment — mirrors the guard row.
+    { re: /\/etc\/(passwd|shadow|sudoers)|(?:~|\$\{?HOME\}?|\/home\/[^\s\/'"]+|\/root|\/Users\/[^\s\/'"]+)\/\.ssh(?![\w.-])|(?:^|[\s'"=:\/])\.ssh\/authorized_keys2?\b|\/authorized_keys2?\b|id_rsa|\.aws\/credentials|\.env\b/i, signal: 'touch-sensitive-path' },
+    // #505: a shell write shape onto a login/interactive startup file — mirrors the guard row.
+    { re: /(?:(?:>>?|>\|)(?:[ \t]|\\\n)*|\btee\b(?:(?:[ \t]|\\\n)+(?:--?[\w-]+(?:=\S*)?|'[^'\n]*'|"[^"\n]*"|[^\s'"|;&<>\\-][^\s'"|;&<>\\]*))*(?:[ \t]|\\\n)+|\bsed\b(?=[^|;&\n]*[ \t](?:-[a-zA-Z]*i|--in-place))[^|;&\n]*(?:[ \t]|\\\n)+)['"]?(?:[^\s'"|;&<>]*\/)?(?:\.(?:bashrc|zshrc|zprofile|zshenv|zlogin|zlogout|profile|bash_profile|bash_login|bash_logout)(?![\w.-])|\.config\/fish\/config\.fish\b)|\b(?:cp|mv|install)\b[^|;&\n]*(?:[ \t]|\\\n)+['"]?(?:[^\s'"|;&<>]*\/)?(?:\.(?:bashrc|zshrc|zprofile|zshenv|zlogin|zlogout|profile|bash_profile|bash_login|bash_logout)(?![\w.-])|\.config\/fish\/config\.fish\b)['"]?\s*(?=$|[|;&\n])/i, signal: 'modify-shell-startup' },
     // Guard's own approval store (#118): agent-side writes here mint approvals.
     { re: /\.shieldcortex[\\/]+approvals\b/i, signal: 'touch-approval-store' },
     // Session-lease ledger + store (#227): a freeze an agent can edit is not a freeze.
@@ -238,6 +261,8 @@ const FALLBACK_DANGEROUS_PATTERNS = [
     { re: /\bSHIELDCORTEX_(?:DIST_ROOT|PROTECTED_ROOT)\s*=/i, signal: 'disable-action-guard' },
     { re: /\/etc\/shieldcortex(?:\.conf\b|[\\/]|(?![\w.-]))/i, signal: 'disable-action-guard', lockPath: true },
     { re: /(?:^|[\s'"=:(\\/])\.claude[\\/]+settings(?:\.local)?\.json\b/i, signal: 'disable-action-guard', lockPath: true },
+    // #505: the OpenClaw gateway config — the plane's equivalent of the settings file above.
+    { re: /(?:^|[\s'"=:(\\/])\.openclaw[\\/]+openclaw\.json\b/i, signal: 'disable-action-guard', lockPath: true },
     { re: /(?:^|[;&|(\n]|\$\()\s*(?:\w+=\S*\s+)*(?:sudo\s+)?uvx\b/i, signal: 'registry-code-exec' },
     { re: /(?:^|[;&|(\n]|\$\()\s*(?:\w+=\S*\s+)*(?:sudo\s+)?(?:pnpm|yarn)\b[^|;&\n]*\bdlx\b/i, signal: 'registry-code-exec' },
     { re: /\b(?:base64|openssl|xxd|cat|http)\b[^\n|]*\|(?:[^\n|]*\|)*\s*(?:\w+=\S*\s+)*(?:sudo\s+)?(?:bash|sh|zsh|ksh|python\d?|perl|ruby|node)\b(?:\s+-)?\s*(?:[;&|\n]|$)/i, signal: 'decode-pipe-to-shell' },
@@ -371,7 +396,42 @@ function fallbackLockPathAccessIsReadOnly(text, toolName) {
     return sawStage;
 }
 /** First matching dangerous signal for the WS2 fallback, or null (issue #59). */
+// ── #505: startup-file WRITE target, ported to the blunt fallback ────────────
+//
+// The real guard gates a Write/Edit whose TARGET is a shell startup file on
+// the path alone (`isShellStartupWritePath` at the verdict site): a PATH
+// prepend written there carries no dangerous verb, so no content regex can
+// see it. The DANGEROUS row above covers the SHELL spellings only; a tool
+// write carries the target as a path argument, so in degraded mode the same
+// write was invisible. Mirrors `classifyFamily`'s WRITE_TOOLS / READ_TOOLS
+// split: a read-family tool never gates, an unknown tool with no write-like
+// name never gates here (the table rows still apply to it), a write-like
+// tool naming a startup file under a path key gates. Kept in sync across
+// scripts/pre-tool-hook.mjs, plugins/openclaw/interceptor.ts and
+// plugins/hermes/shieldcortex/sc_client.py.
+/** Write-family tool names — the guard's WRITE_TOOLS set. */
+const FALLBACK_WRITE_TOOLS = /(write|edit|create|update|patch|append|save|mkdir|move|copy|cp|mv|rename|chmod|chown)/;
+/** Path-bearing keys only (never `command`): the target of a tool write. */
+const FALLBACK_WRITE_PATH_KEYS = ['path', 'file_path', 'filePath', 'file', 'target', 'destination'];
+/** A login/interactive startup file by basename, plus fish's config — `isShellStartupWritePath`. */
+const FALLBACK_SHELL_STARTUP_PATH_RE = /(?:^|[\\/])(?:\.(?:bashrc|zshrc|zprofile|zshenv|zlogin|zlogout|profile|bash_profile|bash_login|bash_logout)|\.config[\\/]fish[\\/]config\.fish)$/i;
+function fallbackWriteTargetMatch(args, toolName) {
+    const seg = String(toolName || '').toLowerCase().split(/__|\.|:|\//).filter(Boolean).pop() || '';
+    if (!seg || FALLBACK_READ_TOOLS.test(seg) || !FALLBACK_WRITE_TOOLS.test(seg))
+        return null;
+    for (const k of FALLBACK_WRITE_PATH_KEYS) {
+        const v = args?.[k];
+        if (typeof v !== 'string')
+            continue;
+        if (FALLBACK_SHELL_STARTUP_PATH_RE.test(v.trim()))
+            return 'modify-shell-startup';
+    }
+    return null;
+}
 function fallbackDangerousMatch(args, toolName) {
+    const writeTarget = fallbackWriteTargetMatch(args, toolName);
+    if (writeTarget)
+        return writeTarget;
     const text = fallbackExecSurface(args);
     if (!text)
         return null;
@@ -424,6 +484,13 @@ const NATIVE_PROCESS_PHRASE = {
 function isNativeProcessTool(toolName) {
     return String(toolName || '').trim().toLowerCase() === 'process';
 }
+/**
+ * #600: the card's subject. It used to say "Jarvis" on every OpenClaw host,
+ * whatever the agent was called (and on every customer install). The
+ * interceptor has no trustworthy display name to hand — OpenClaw's agentId is
+ * usually `main` — so the card names the role, not a person.
+ */
+export const AGENT_SUBJECT = 'Your agent';
 /**
  * The plain sentence the card LEADS with.
  *
@@ -445,13 +512,13 @@ function actionGuardLead(toolName, v, args) {
         : '';
     const phrase = isNativeProcessTool(toolName) ? NATIVE_PROCESS_PHRASE[verb] : undefined;
     if (phrase) {
-        return `Jarvis wants to ${phrase} (${verb}). Allow once is this call only.`;
+        return `${AGENT_SUBJECT} wants to ${phrase} (${verb}). Allow once is this call only.`;
     }
     if (isSchemaInvalid(v)) {
-        return `Jarvis used ${toolName}, which ShieldCortex does not fully recognise yet. `
+        return `${AGENT_SUBJECT} used ${toolName}, which ShieldCortex does not fully recognise yet. `
             + 'Allow once lets this one call through. It does not teach the tool.';
     }
-    return `Jarvis wants to use ${toolName}, and ShieldCortex rated this call ${v.severity}. `
+    return `${AGENT_SUBJECT} wants to use ${toolName}, and ShieldCortex rated this call ${v.severity}. `
         + 'Allow once is this call only.';
 }
 /** Operator-facing approval prompt for a gated action (not a memory write). */
@@ -1096,7 +1163,11 @@ export function createInterceptor(config, pipeline, options) {
             : undefined;
         if (v.decision === 'allow' && drift && actionGuardCfg.auditAllows !== false) {
             const d = drift.contractDrift;
-            log.warn(`[shieldcortex] action-guard CONTRACT DRIFT ${context.toolName} (${d.contract}): dropped unread field(s) ${d.droppedKeys.join(', ')}${d.truncated ? ', …' : ''}`);
+            // #594: the clause after the contract label names the judging revision
+            // and the selection reason, so a drift row on a host newer than the
+            // newest measurement reads as "re-measure" rather than as noise. The
+            // dropped-field list stays LAST, as data, exactly as before.
+            log.warn(`[shieldcortex] action-guard CONTRACT DRIFT ${context.toolName} (${d.contract}${describeDriftRevision(d.revision)}): dropped unread field(s) ${d.droppedKeys.join(', ')}${d.truncated ? ', …' : ''}`);
         }
         if (v.decision === 'allow') {
             // Issue #95: a RECOGNISED allow (the guard evaluated a known operation

package/dist/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "shieldcortex-realtime",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "name": "ShieldCortex Real-time Scanner",
   "description": "Real-time defence scanning on LLM input, memory extraction on LLM output, and active tool call interception with approval gating.",
   "kind": null,

package/index.ts

@@ -65,6 +65,10 @@ type DefenceModule = {
    *  probe in {@link inlinePolicyLockPresent} rather than by failing open. */
   readPolicyLock?: (options?: { audit?: boolean; warn?: boolean }) => unknown;
   applyPolicyLock?: (raw: Record<string, unknown>, state: unknown) => Record<string, unknown>;
+  /** #594: records the host version the reviewed native contracts are judged
+   *  against. Optional — absent on an older dist, and then the contract is
+   *  judged as `unknown-host` exactly as before this member existed. */
+  setNativeHostVersion?: (host: 'openclaw', version: string | null) => void;
   runDefencePipeline?: (...args: any[]) => any;
   scanToolResponse?: (
     toolName: string,
@@ -926,6 +930,26 @@ export function detectHostOpenClawVersion(): string | null {
   return detectHostOpenClaw().version;
 }
 
+/**
+ * #594 (ADR-002 §5C): hand the detected host version to the guard so the
+ * reviewed `sessions_spawn` contract is judged by the revision measured at
+ * this host. Returns what was recorded (null = unknown host, which the guard
+ * reads as the union of measured revisions — never a guess). Never throws:
+ * an older installed dist has no setter, and a throwing one must not take
+ * interceptor construction down.
+ */
+export function recordHostVersionForGuard(defenceMod: DefenceModule | null | undefined): string | null {
+  const setter = (defenceMod as { setNativeHostVersion?: unknown } | null | undefined)?.setNativeHostVersion;
+  if (typeof setter !== 'function') return null;
+  const version = detectHostOpenClaw().version;
+  try {
+    (setter as (host: 'openclaw', v: string | null) => void)('openclaw', version);
+  } catch {
+    return null;
+  }
+  return version;
+}
+
 export type GateSupport = 'supported' | 'unsupported' | 'unknown';
 
 /**
@@ -4227,6 +4251,15 @@ export default {
           throw new Error('ShieldCortex: defence pipeline unavailable (dist missing or incomplete)');
         };
 
+        // #594 (ADR-002 §5C): tell the guard which host version its reviewed
+        // native contracts are being judged against, so `sessions_spawn` is
+        // judged by the revision MEASURED at this host rather than by one flat
+        // bag. Same evidence order as the conversation gate: the runtime's own
+        // version first, the install's package.json second, and null (which the
+        // guard reads as "unknown host — union of measured revisions") when
+        // neither is available. Absent on an older dist; then nothing changes.
+        recordHostVersionForGuard(defenceMod);
+
         interceptorReady = createInterceptor(
           interceptorConfig,
           canRunPipeline ? (defenceMod!.runDefencePipeline as Parameters<typeof createInterceptor>[1]) : degradedPipeline,

package/interceptor.ts

@@ -52,6 +52,30 @@ export interface ContractDriftLike {
   contract: string;
   droppedKeys: string[];
   truncated?: boolean;
+  /** #594: the measured revision that judged the call and why it was chosen
+   *  (`exact` / `floor` / `beyond` / `below` / `unknown-host`). Absent on an
+   *  older dist or a single-revision contract. */
+  revision?: { measuredAt: string; hostVersion: string | null; selection: string };
+}
+
+/**
+ * One clause for the CONTRACT DRIFT warning naming the judging revision and
+ * what the selection means for the operator (#594). `floor` and `beyond` are
+ * the two that say "the measurement is older than the host — re-measure";
+ * `unknown-host` says the host never stated a version. Bounded: the host
+ * version was neutralised and length-capped where the observation was minted.
+ */
+export function describeDriftRevision(rev: ContractDriftLike['revision']): string {
+  if (!rev) return '';
+  const host = rev.hostVersion ?? 'unknown';
+  switch (rev.selection) {
+    case 'exact': return `; judged by revision ${rev.measuredAt} = host ${host}`;
+    case 'floor': return `; judged by revision ${rev.measuredAt}, the nearest measured below host ${host} — re-measure the host`;
+    case 'beyond': return `; judged by revision ${rev.measuredAt}, older than host ${host} — re-measure the host`;
+    case 'below': return `; judged by revision ${rev.measuredAt}, newer than host ${host}`;
+    case 'unknown-host': return `; judged by ${rev.measuredAt} — host version unknown`;
+    default: return `; judged by revision ${rev.measuredAt} (${rev.selection}; host ${host})`;
+  }
 }
 
 export interface ToolGuardVerdictLike {
@@ -559,7 +583,10 @@ const FALLBACK_DANGEROUS_PATTERNS: Array<{ re: RegExp; signal: string; lockPath?
   { re: /\bch(?:mod|own)\b[^|;&\n]*(?:-\w*R\w*|--recursive)\b[^|;&\n]*\s\/(?:etc|usr|var|home|bin|sbin|boot|lib|lib64|opt|root)(?:\/\*?)?(?:\s|$)/i, signal: 'recursive-perms-system-dir' },
   { re: /\btruncate\b[^|;&\n]*(?:-s\s*0\b|--size(?:=|\s+)0\b)/i, signal: 'truncate-to-zero' },
   { re: /\bhistory\s+-c\b|\.bash_history|truncate\b[^|\n]*\.log/i, signal: 'wipe-history-or-logs' },
-  { re: /\/etc\/(passwd|shadow|sudoers)|~\/\.ssh|id_rsa|\.aws\/credentials|\.env\b/i, signal: 'touch-sensitive-path' },
+  // #505: `.ssh` behind any home root + `authorized_keys` as a path segment — mirrors the guard row.
+  { re: /\/etc\/(passwd|shadow|sudoers)|(?:~|\$\{?HOME\}?|\/home\/[^\s\/'"]+|\/root|\/Users\/[^\s\/'"]+)\/\.ssh(?![\w.-])|(?:^|[\s'"=:\/])\.ssh\/authorized_keys2?\b|\/authorized_keys2?\b|id_rsa|\.aws\/credentials|\.env\b/i, signal: 'touch-sensitive-path' },
+  // #505: a shell write shape onto a login/interactive startup file — mirrors the guard row.
+  { re: /(?:(?:>>?|>\|)(?:[ \t]|\\\n)*|\btee\b(?:(?:[ \t]|\\\n)+(?:--?[\w-]+(?:=\S*)?|'[^'\n]*'|"[^"\n]*"|[^\s'"|;&<>\\-][^\s'"|;&<>\\]*))*(?:[ \t]|\\\n)+|\bsed\b(?=[^|;&\n]*[ \t](?:-[a-zA-Z]*i|--in-place))[^|;&\n]*(?:[ \t]|\\\n)+)['"]?(?:[^\s'"|;&<>]*\/)?(?:\.(?:bashrc|zshrc|zprofile|zshenv|zlogin|zlogout|profile|bash_profile|bash_login|bash_logout)(?![\w.-])|\.config\/fish\/config\.fish\b)|\b(?:cp|mv|install)\b[^|;&\n]*(?:[ \t]|\\\n)+['"]?(?:[^\s'"|;&<>]*\/)?(?:\.(?:bashrc|zshrc|zprofile|zshenv|zlogin|zlogout|profile|bash_profile|bash_login|bash_logout)(?![\w.-])|\.config\/fish\/config\.fish\b)['"]?\s*(?=$|[|;&\n])/i, signal: 'modify-shell-startup' },
   // Guard's own approval store (#118): agent-side writes here mint approvals.
   { re: /\.shieldcortex[\\/]+approvals\b/i, signal: 'touch-approval-store' },
   // Session-lease ledger + store (#227): a freeze an agent can edit is not a freeze.
@@ -578,6 +605,8 @@ const FALLBACK_DANGEROUS_PATTERNS: Array<{ re: RegExp; signal: string; lockPath?
   { re: /\bSHIELDCORTEX_(?:DIST_ROOT|PROTECTED_ROOT)\s*=/i, signal: 'disable-action-guard' },
   { re: /\/etc\/shieldcortex(?:\.conf\b|[\\/]|(?![\w.-]))/i, signal: 'disable-action-guard', lockPath: true },
   { re: /(?:^|[\s'"=:(\\/])\.claude[\\/]+settings(?:\.local)?\.json\b/i, signal: 'disable-action-guard', lockPath: true },
+  // #505: the OpenClaw gateway config — the plane's equivalent of the settings file above.
+  { re: /(?:^|[\s'"=:(\\/])\.openclaw[\\/]+openclaw\.json\b/i, signal: 'disable-action-guard', lockPath: true },
   { re: /(?:^|[;&|(\n]|\$\()\s*(?:\w+=\S*\s+)*(?:sudo\s+)?uvx\b/i, signal: 'registry-code-exec' },
   { re: /(?:^|[;&|(\n]|\$\()\s*(?:\w+=\S*\s+)*(?:sudo\s+)?(?:pnpm|yarn)\b[^|;&\n]*\bdlx\b/i, signal: 'registry-code-exec' },
   { re: /\b(?:base64|openssl|xxd|cat|http)\b[^\n|]*\|(?:[^\n|]*\|)*\s*(?:\w+=\S*\s+)*(?:sudo\s+)?(?:bash|sh|zsh|ksh|python\d?|perl|ruby|node)\b(?:\s+-)?\s*(?:[;&|\n]|$)/i, signal: 'decode-pipe-to-shell' },
@@ -706,7 +735,42 @@ function fallbackLockPathAccessIsReadOnly(text: string, toolName: string | undef
 }
 
 /** First matching dangerous signal for the WS2 fallback, or null (issue #59). */
+
+// ── #505: startup-file WRITE target, ported to the blunt fallback ────────────
+//
+// The real guard gates a Write/Edit whose TARGET is a shell startup file on
+// the path alone (`isShellStartupWritePath` at the verdict site): a PATH
+// prepend written there carries no dangerous verb, so no content regex can
+// see it. The DANGEROUS row above covers the SHELL spellings only; a tool
+// write carries the target as a path argument, so in degraded mode the same
+// write was invisible. Mirrors `classifyFamily`'s WRITE_TOOLS / READ_TOOLS
+// split: a read-family tool never gates, an unknown tool with no write-like
+// name never gates here (the table rows still apply to it), a write-like
+// tool naming a startup file under a path key gates. Kept in sync across
+// scripts/pre-tool-hook.mjs, plugins/openclaw/interceptor.ts and
+// plugins/hermes/shieldcortex/sc_client.py.
+
+/** Write-family tool names — the guard's WRITE_TOOLS set. */
+const FALLBACK_WRITE_TOOLS = /(write|edit|create|update|patch|append|save|mkdir|move|copy|cp|mv|rename|chmod|chown)/;
+/** Path-bearing keys only (never `command`): the target of a tool write. */
+const FALLBACK_WRITE_PATH_KEYS = ['path', 'file_path', 'filePath', 'file', 'target', 'destination'];
+/** A login/interactive startup file by basename, plus fish's config — `isShellStartupWritePath`. */
+const FALLBACK_SHELL_STARTUP_PATH_RE = /(?:^|[\\/])(?:\.(?:bashrc|zshrc|zprofile|zshenv|zlogin|zlogout|profile|bash_profile|bash_login|bash_logout)|\.config[\\/]fish[\\/]config\.fish)$/i;
+
+function fallbackWriteTargetMatch(args: Record<string, unknown> | undefined, toolName?: string): string | null {
+  const seg = String(toolName || '').toLowerCase().split(/__|\.|:|\//).filter(Boolean).pop() || '';
+  if (!seg || FALLBACK_READ_TOOLS.test(seg) || !FALLBACK_WRITE_TOOLS.test(seg)) return null;
+  for (const k of FALLBACK_WRITE_PATH_KEYS) {
+    const v = args?.[k];
+    if (typeof v !== 'string') continue;
+    if (FALLBACK_SHELL_STARTUP_PATH_RE.test(v.trim())) return 'modify-shell-startup';
+  }
+  return null;
+}
+
 function fallbackDangerousMatch(args: Record<string, unknown> | undefined, toolName?: string): string | null {
+  const writeTarget = fallbackWriteTargetMatch(args, toolName);
+  if (writeTarget) return writeTarget;
   const text = fallbackExecSurface(args);
   if (!text) return null;
   const lockReadOnly = fallbackLockPathAccessIsReadOnly(text, toolName);
@@ -757,6 +821,14 @@ function isNativeProcessTool(toolName: string): boolean {
   return String(toolName || '').trim().toLowerCase() === 'process';
 }
 
+/**
+ * #600: the card's subject. It used to say "Jarvis" on every OpenClaw host,
+ * whatever the agent was called (and on every customer install). The
+ * interceptor has no trustworthy display name to hand — OpenClaw's agentId is
+ * usually `main` — so the card names the role, not a person.
+ */
+export const AGENT_SUBJECT = 'Your agent';
+
 /**
  * The plain sentence the card LEADS with.
  *
@@ -782,13 +854,13 @@ function actionGuardLead(
     : '';
   const phrase = isNativeProcessTool(toolName) ? NATIVE_PROCESS_PHRASE[verb] : undefined;
   if (phrase) {
-    return `Jarvis wants to ${phrase} (${verb}). Allow once is this call only.`;
+    return `${AGENT_SUBJECT} wants to ${phrase} (${verb}). Allow once is this call only.`;
   }
   if (isSchemaInvalid(v)) {
-    return `Jarvis used ${toolName}, which ShieldCortex does not fully recognise yet. `
+    return `${AGENT_SUBJECT} used ${toolName}, which ShieldCortex does not fully recognise yet. `
       + 'Allow once lets this one call through. It does not teach the tool.';
   }
-  return `Jarvis wants to use ${toolName}, and ShieldCortex rated this call ${v.severity}. `
+  return `${AGENT_SUBJECT} wants to use ${toolName}, and ShieldCortex rated this call ${v.severity}. `
     + 'Allow once is this call only.';
 }
 
@@ -1545,8 +1617,12 @@ export function createInterceptor(
       : undefined;
     if (v.decision === 'allow' && drift && actionGuardCfg.auditAllows !== false) {
       const d = drift.contractDrift;
+      // #594: the clause after the contract label names the judging revision
+      // and the selection reason, so a drift row on a host newer than the
+      // newest measurement reads as "re-measure" rather than as noise. The
+      // dropped-field list stays LAST, as data, exactly as before.
       log.warn(
-        `[shieldcortex] action-guard CONTRACT DRIFT ${context.toolName} (${d.contract}): dropped unread field(s) ${d.droppedKeys.join(', ')}${d.truncated ? ', …' : ''}`,
+        `[shieldcortex] action-guard CONTRACT DRIFT ${context.toolName} (${d.contract}${describeDriftRevision(d.revision)}): dropped unread field(s) ${d.droppedKeys.join(', ')}${d.truncated ? ', …' : ''}`,
       );
     }
 

package/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "shieldcortex-realtime",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "name": "ShieldCortex Real-time Scanner",
   "description": "Real-time defence scanning on LLM input, memory extraction on LLM output, and active tool call interception with approval gating.",
   "kind": null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drakon-systems/shieldcortex-realtime",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "description": "OpenClaw plugin for ShieldCortex real-time defence scanning and optional memory extraction.",
   "type": "module",
   "main": "./dist/index.js",