watchmyagents 1.1.2 → 1.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmyagents",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "description": "Security observability + real-time policy enforcement for AI agents. Local-first NDJSON capture with a continuous Watch daemon that auto-uploads anonymized signals, Shield CLI that blocks policy violations live (with policies pulled from Fortress cloud), anonymizer producing signals-only payloads, bidirectional sync with WatchMyAgents Fortress, and one-command install as an always-on launchd/systemd service — closing the recursive Watch→Guardian→Shield security loop.",
   "type": "module",
   "files": [

package/scripts/shield.js

@@ -25,7 +25,6 @@
 // ANTHROPIC_API_KEY env var is used if --api-key is omitted.
 
 import { resolve } from 'node:path';
-import { createHash } from 'node:crypto';
 import { streamWithReconnect } from '../src/shield/stream.js';
 import { loadPolicies, evaluate } from '../src/shield/policy.js';
 import {
@@ -39,6 +38,12 @@ import { FortressPolicySource, postDecision } from '../src/shield/sources/fortre
 import { resolveFortressBase, fortressEndpoint } from '../src/fortress/url.js';
 import { PolicyStream } from '../src/shield/policy-stream.js';
 import { isValidAgentId, isValidSessionId } from '../src/validate.js';
+// v1.1.4 F-19 (P1 Codex audit): all egress to Fortress now flows through
+// buildFortressDecisionPayload, which normalizes tool_name via the
+// anonymizer's allowlist + salted-hash scheme and drops anything it can't
+// safely normalize. Keeps Shield's payload aligned with the README
+// promise that decisions ship fingerprints, not raw values.
+import { buildFortressDecisionPayload } from '../src/shield/upload.js';
 
 function parseArgs(argv) {
   const out = {};
@@ -133,38 +138,20 @@ async function runSessionWorker({ sessionId, ctx }) {
   // refreshes from Fortress (every 5 min) take effect without restart.
   sinfo(sessionId, `attached (${mode} mode)`);
 
-  // Helper: hash an IoC value with the customer salt (same one used by
-  // anonymizer for signals → correlates decisions to signals in Fortress).
-  // Returns null if no salt is configured (decisions still upload, just
-  // without input_hash).
-  const hashIoc = (value) => {
-    if (!signalsSalt || value == null) return null;
-    const s = typeof value === 'string' ? value : JSON.stringify(value);
-    return 'sha256:' + createHash('sha256').update(signalsSalt).update(s).digest('hex').slice(0, 32);
-  };
-
   // Helper: assemble + fire the decision push to Fortress (fire-and-forget).
+  // v1.1.4 F-19 (P1 Codex audit): delegates payload construction to the
+  // pure helper in src/shield/upload.js so the egress-side containment
+  // logic (tool_name allowlist + salted hashing) is unit-tested in
+  // isolation. The helper drops any field it cannot safely normalize
+  // (custom tool without salt, missing salt for hashes) rather than
+  // passing the raw value through.
   const fireToFortress = (rawEvent, normalized, result, decidedInMs) => {
     if (!pushDecisionToFortress) return;
-    // Extract the most relevant input value to hash (URL > command > query > path)
-    const inp = normalized?.input;
-    let inputForHash = null;
-    if (inp && typeof inp === 'object') {
-      inputForHash = inp.url || inp.command || inp.query || inp.path || inp.file_path || null;
-    }
-    pushDecisionToFortress({
-      anthropic_agent_id: agentId,
-      decision: result.decision,
-      rule_id: result.rule_id || undefined,
-      session_hash: hashIoc(sessionId) || undefined,
-      event_id_hash: hashIoc(rawEvent?.id) || undefined,
-      input_hash: hashIoc(inputForHash) || undefined,
-      action_type: normalized?.action_type || undefined,
-      tool_name: normalized?.tool_name || undefined,
-      message: result.message || result.rule_name || undefined,
-      decided_at: new Date().toISOString(),
-      decided_in_ms: decidedInMs,
-    }).catch(() => undefined);
+    const payload = buildFortressDecisionPayload({
+      agentId, sessionId, rawEvent, normalized, result, decidedInMs,
+      signalsSalt,
+    });
+    pushDecisionToFortress(payload).catch(() => undefined);
   };
 
   let processed = 0, enforced = 0, sessionInterrupted = false;
@@ -214,15 +201,27 @@ async function runSessionWorker({ sessionId, ctx }) {
         const result = evaluate(normalized, ctx.ruleset);
         const decidedInMs = Date.now() - t0;
 
-        sinfo(sessionId, `${rawEvent.type} tool=${normalized.tool_name} → ${result.decision}${result.rule_id ? ` (${result.rule_id})` : ''}`);
+        // v1.1.3 Phase 1.D — mode badge in the log line for operator visibility.
+        const modeTag = result.mode === 'shadow' ? ' [SHADOW]' : '';
+        sinfo(sessionId, `${rawEvent.type} tool=${normalized.tool_name} → ${result.decision}${modeTag}${result.rule_id ? ` (${result.rule_id})` : ''}`);
 
         await decisions(sessionId).record({
           sourceEvent: rawEvent, decision: result.decision,
           ruleId: result.rule_id, ruleName: result.rule_name,
           message: result.message, decidedInMs,
+          mode: result.mode,
         });
         fireToFortress(rawEvent, normalized, result, decidedInMs);
 
+        // v1.1.3 Phase 1.D — in shadow mode, the decision is COMPUTED + LOGGED
+        // but NOT enforced. The rule's "would_deny" / "would_interrupt"
+        // outcome flows to Fortress for Platt-scaling calibration + diff-in-diff
+        // efficacy measurement (Guardian Core hardening axes 1 + 4), but the
+        // agent's session continues uninterrupted. Promote to enforce only
+        // after calibration confidence + lifecycle gates (Guardian Core spec
+        // observe → shadow → enforce → retired).
+        if (result.mode === 'shadow') continue;
+
         if ((result.decision === 'deny' || result.decision === 'interrupt') && !sessionInterrupted) {
           try {
             await interruptSession({
@@ -271,15 +270,34 @@ async function runSessionWorker({ sessionId, ctx }) {
           const result = evaluate(normalized, ctx.ruleset);
           const decidedInMs = Date.now() - t0;
 
-          sinfo(sessionId, `requires_action ${sourceEvent.type} tool=${normalized.tool_name} → ${result.decision}${result.rule_id ? ` (${result.rule_id})` : ''}`);
+          // v1.1.3 Phase 1.D — mode badge in the log line for operator visibility.
+          const modeTag = result.mode === 'shadow' ? ' [SHADOW]' : '';
+          sinfo(sessionId, `requires_action ${sourceEvent.type} tool=${normalized.tool_name} → ${result.decision}${modeTag}${result.rule_id ? ` (${result.rule_id})` : ''}`);
 
           await decisions(sessionId).record({
             sourceEvent, decision: result.decision,
             ruleId: result.rule_id, ruleName: result.rule_name,
             message: result.message, decidedInMs,
+            mode: result.mode,
           });
           fireToFortress(sourceEvent, normalized, result, decidedInMs);
 
+          // v1.1.3 Phase 1.D — shadow mode in tool_confirmation: we MUST
+          // still send confirmAllow even when the rule said deny/interrupt,
+          // otherwise the agent hangs waiting for our response. The
+          // decision is logged with mode=shadow so calibration can compare
+          // what the rule said vs what was enforced (which is "nothing"
+          // here). For mode=enforce, the original branching below stands.
+          if (result.mode === 'shadow') {
+            try {
+              await confirmAllow({ apiKey, sessionId, toolUseId: eventId });
+              // No enforced++ — shadow doesn't enforce by definition.
+            } catch (e) {
+              process.stderr.write(`[shield/${sessionId.slice(0, 12)}] shadow confirmAllow error: ${e.message}\n`);
+            }
+            continue;
+          }
+
           try {
             if (result.decision === 'allow') {
               await confirmAllow({ apiKey, sessionId, toolUseId: eventId });

package/src/anonymizer.js

@@ -109,6 +109,53 @@ export function normalizeToolName(toolName, salt) {
   return 'tool_hash:' + createHash('sha256').update(salt).update(s).digest('hex').slice(0, 32);
 }
 
+// ── Tool input field normalization (Phase 1.A L-2, v1.1.3) ──────────────
+//
+// HASHABLE_INPUT_FIELDS is the canonical set of input field names the
+// anonymizer knows how to hash. These names came from the Anthropic tool
+// shape (`web_fetch.url`, `web_search.query`, `bash.command`, file tools).
+// Other frameworks use different native names — OpenAI function tools
+// have arbitrary user-defined argument names, LangGraph tools use the
+// `tools[].args` shape, CrewAI uses `task.context`, etc.
+//
+// To avoid silent IoC loss when a new adapter lands, adapters can call
+// `normalizeToolInput()` BEFORE yielding their WMAAction to map their
+// native tool argument names to the canonical set. The function takes
+// the raw input object and an alias map `{nativeName: canonicalName}`
+// and returns a new object where canonical names are populated from
+// the corresponding native fields (without losing the originals — both
+// are kept so the local NDJSON preserves full fidelity).
+//
+// Example for a future OpenAI function tool that exposes `endpoint_url`:
+//   yield {
+//     ...,
+//     action_type: 'custom_tool_use',
+//     tool_name: 'fetch_remote',
+//     input: normalizeToolInput(rawInput, { endpoint_url: 'url' }),
+//   };
+// Now `entry.input.url` is populated → the anonymizer's IoC hashing
+// fires → Fortress receives a hashed signal as expected.
+//
+// Adapters that already use canonical names (Anthropic) can skip the
+// helper — it's a no-op when no aliases match.
+export function normalizeToolInput(rawInput, aliases = {}) {
+  if (rawInput == null || typeof rawInput !== 'object') return rawInput;
+  const out = { ...rawInput };
+  for (const [nativeName, canonicalName] of Object.entries(aliases)) {
+    if (!HASHABLE_INPUT_FIELDS.includes(canonicalName)) {
+      throw new Error(`normalizeToolInput: "${canonicalName}" is not a canonical hashable field (must be one of: ${HASHABLE_INPUT_FIELDS.join(', ')})`);
+    }
+    if (out[canonicalName] == null && rawInput[nativeName] != null) {
+      out[canonicalName] = rawInput[nativeName];
+    }
+  }
+  return out;
+}
+
+// Re-export the canonical hashable-fields list so adapter authors can
+// programmatically reference the contract.
+export { HASHABLE_INPUT_FIELDS };
+
 // ── Single-entry extractor: what hashable IoCs are in this entry? ────────
 
 function extractIocs(entry, salt) {

package/src/shield/decisions.js

@@ -22,13 +22,22 @@ export class DecisionLogger {
     ruleName,
     message,
     decidedInMs,
+    mode,             // v1.1.3 Phase 1.D: 'enforce' | 'shadow' (default 'enforce' if absent)
   }) {
+    // In shadow mode the decision is computed and logged but NOT enforced.
+    // status must reflect what actually happened on the wire: shadow + deny
+    // didn't actually block, so status='ok' keeps Watch's aggregations honest.
+    // output.mode is what calibration reads to compare would-have-blocked vs
+    // did-block.
+    const effectiveMode = mode || 'enforce';
+    const enforced = effectiveMode === 'enforce'
+      && (decision === 'deny' || decision === 'interrupt');
     return this._logger.write({
       action_type: 'shield_decision',
       provider: 'anthropic-managed',
       tool_name: sourceEvent?.name || sourceEvent?.tool_name || null,
-      status: decision === 'deny' || decision === 'interrupt' ? 'error' : 'ok',
-      error: decision === 'deny' || decision === 'interrupt' ? message : null,
+      status: enforced ? 'error' : 'ok',
+      error: enforced ? message : null,
       duration_ms: decidedInMs ?? null,
       input: {
         source_event_id: sourceEvent?.id || null,
@@ -40,6 +49,7 @@ export class DecisionLogger {
         rule_id: ruleId,
         rule_name: ruleName,
         message,
+        mode: effectiveMode,
       },
     });
   }

package/src/shield/policy-stream.js

@@ -32,6 +32,7 @@
 import { request as httpsRequest } from 'node:https';
 import { URL } from 'node:url';
 import { EventEmitter } from 'node:events';
+import { normalizeSseBuffer } from './sse.js';
 
 const RECONNECT_MIN_MS = 1_000;
 const RECONNECT_MAX_MS = 60_000;
@@ -154,6 +155,13 @@ export class PolicyStream extends EventEmitter {
       let buffer = '';
       res.on('data', (chunk) => {
         buffer += chunk;
+        // v1.1.4 F-18 (P1 Codex audit): normalize CR / CRLF line
+        // terminators to LF before scanning for the event separator.
+        // Without this, a Fortress deployment behind a reverse-proxy
+        // that emits CRLF would never trigger a policy refresh push —
+        // updates would silently fall back to the 60s polling loop,
+        // breaking the "sub-second propagation" promise.
+        buffer = normalizeSseBuffer(buffer);
         // v1.1.1 F-9: cap on a single SSE event buffer. A buggy/compromised
         // endpoint that never emits "\n\n" would otherwise OOM Shield.
         // Abort + reconnect on overflow; the buffer is dropped so we
@@ -165,7 +173,8 @@ export class PolicyStream extends EventEmitter {
           if (!this._closed) this._scheduleReconnect();
           return;
         }
-        // SSE events are separated by a blank line ("\n\n").
+        // SSE events are separated by a blank line. Post-normalize the
+        // canonical separator is "\n\n".
         let eolIdx;
         while ((eolIdx = buffer.indexOf('\n\n')) !== -1) {
           const rawEvent = buffer.slice(0, eolIdx);

package/src/shield/policy.js

@@ -33,11 +33,23 @@ export async function loadPolicies(path) {
   }
   // Pre-compile regex for performance + early failure on bad patterns.
   const VALID_ACTIONS = ['allow', 'deny', 'interrupt'];
+  // v1.1.3 Phase 1.D — policy mode: 'enforce' (default) actually enforces
+  // the decision via the Anthropic API; 'shadow' computes the decision
+  // and logs it but skips enforcement. Shadow is the calibration bench
+  // for Guardian Core scoring (Platt scaling, diff-in-diff efficacy)
+  // and a safe staging step for new policies before promoting to enforce.
+  const VALID_MODES = ['enforce', 'shadow'];
   for (const p of data.policies) {
     compileMatchRegexes(p.match || {});
     if (!VALID_ACTIONS.includes(p.action)) {
       throw new Error(`policy ${p.id || p.name}: unsupported action "${p.action}"`);
     }
+    // Default to 'enforce' if mode is omitted → preserves v1.0.x / v1.1.x
+    // behavior for policies authored before shadow mode existed.
+    if (p.mode == null) p.mode = 'enforce';
+    if (!VALID_MODES.includes(p.mode)) {
+      throw new Error(`policy ${p.id || p.name}: unsupported mode "${p.mode}" (must be one of: ${VALID_MODES.join(', ')})`);
+    }
   }
   // v1.1.2 F-14 (P2 Codex audit): validate the ruleset's default.action
   // against the SAME canonical set as per-policy actions. Before this fix
@@ -56,28 +68,61 @@ export async function loadPolicies(path) {
   return data;
 }
 
-// ReDoS protection: regexes are loaded from a user-provided JSON policy file,
-// so a malicious or buggy pattern (e.g. `(a+)+$`) could pin the CPU on a long
-// input. We mitigate two ways:
+// ReDoS protection: regexes are loaded from a user-provided JSON policy file
+// (LOCAL adapter) AND from Fortress / Guardian-generated rules (FORTRESS
+// adapter), so a malicious or buggy pattern (e.g. `(a+)+$`) could pin
+// Shield's CPU on a long input — taking the whole enforcement loop down.
+// We mitigate three ways:
 //   1) Cap the maximum input length passed to any regex test to MAX_REGEX_INPUT
 //      bytes. Above that we truncate before testing. Real agent values
-//      (URLs, commands, queries) are well under this in practice.
-//   2) Reject obviously dangerous patterns at compile time (heuristic).
+//      (URLs, commands, queries, file paths) are well under this in practice.
+//   2) Reject obviously dangerous patterns at compile time (heuristic — see
+//      SUSPICIOUS_REGEX_PATTERNS below). The list errs toward false positives
+//      because Shield runs in the hot path: a rejected rule is loud (the
+//      rule is dropped at load time with a clear error) while a runaway
+//      regex would silently degrade Shield to "no enforcement" until the
+//      operator notices a CPU spike.
+//   3) Hard upper bound on the regex source length so a deeply nested
+//      pattern can't game the heuristic by spreading the gadget across
+//      thousands of chars.
+//
+// Future work (v1.2+): proper RE2 or safe-regex-2 dependency for thorough
+// analysis, or moving evaluation into a worker with a hard CPU timeout.
+// We can't ship that today without breaking the zero-runtime-deps promise.
 //
-// A future v0.5 may add a proper safe-regex-2 dependency for thorough analysis.
-const MAX_REGEX_INPUT = 8192;
+// v1.1.4 F-20 (P2 Codex audit): cap reduced from 8192 → 2048 (4×). Worst
+// realistic IoC values (URL with long query string, base64 in a path)
+// remain comfortably under 2048; the previous 8192 was a defence-in-depth
+// holdover that no real workload exercises.
+const MAX_REGEX_INPUT = 2048;
 
+// v1.1.4 F-20: heuristic list extended to catch ambiguous alternation
+// (`(a|a)*`, `(a|ab)+`, `(.|.)*`) — these don't trip the existing
+// nested-quantifier heuristic but exhibit the same exponential behavior
+// because every char has two paths to match. The new pattern rejects any
+// alternation group immediately followed by `+` or `*`; this is intentionally
+// over-broad — a customer who needs `(http|https):` should use either a
+// character class (`[a-z]+:`) or move the optional letter (`https?:`).
 const SUSPICIOUS_REGEX_PATTERNS = [
   /(\([^)]*[+*][^)]*\))[+*]/,   // (x+)+ or (x*)* — classic catastrophic backtracking
   /(\.\*){3,}/,                  // multiple .* in a row
+  // F-20: alternation inside a group, then `+` or `*` — `(a|a)*`, `(a|ab)+`,
+  // `(.|.)*`. The `[^)]*\|[^)]*` body requires at least one `|` inside the
+  // group; a single-branch group like `(foo)+` is NOT matched.
+  /\([^)]*\|[^)]*\)[+*]/,
 ];
 
 export function validateRegexString(src, where) {
   if (typeof src !== 'string') {
     throw new Error(`policy ${where}: regex must be a string`);
   }
-  if (src.length > 2000) {
-    throw new Error(`policy ${where}: regex too long (>2000 chars)`);
+  // v1.1.4 F-20: cap regex source at 1024 chars (was 2000). Real Shield
+  // policies are short (URL-prefix match, host-list deny, command-prefix
+  // check). A 1KB regex source is already an outlier; anything longer is
+  // either pathological or trying to bypass the heuristics by smuggling
+  // a gadget across many bytes.
+  if (src.length > 1024) {
+    throw new Error(`policy ${where}: regex too long (>1024 chars)`);
   }
   for (const sus of SUSPICIOUS_REGEX_PATTERNS) {
     if (sus.test(src)) {
@@ -157,6 +202,10 @@ export function evaluate(event, ruleset) {
         rule_id: policy.id || null,
         rule_name: policy.name || null,
         message: policy.message || null,
+        // v1.1.3 Phase 1.D — `mode` propagated so the Shield runtime can
+        // decide whether to actually call the Anthropic enforcement API
+        // (mode=enforce) or just log the would-be decision (mode=shadow).
+        mode: policy.mode || 'enforce',
       };
     }
   }
@@ -165,5 +214,8 @@ export function evaluate(event, ruleset) {
     rule_id: null,
     rule_name: '(default)',
     message: null,
+    // The ruleset-level default has no shadow concept — defaults always
+    // enforce (or, when the default is 'allow', do nothing of consequence).
+    mode: 'enforce',
   };
 }

package/src/shield/sources/fortress.js

@@ -233,6 +233,9 @@ export class FortressPolicySource {
 // Convert a Fortress DB policy row to the local Shield format.
 // Throws on anything invalid so _refresh can skip it (policies from the cloud
 // are NOT fully trusted — apply the same hardening as the local JSON loader).
+// v1.1.3 Phase 1.D — same modes as the local JSON loader.
+const VALID_MODES = new Set(['enforce', 'shadow']);
+
 function compilePolicyFromFortress(p) {
   if (!p || typeof p !== 'object') throw new Error('policy is not an object');
   if (!VALID_ACTIONS.has(p.action)) {
@@ -244,6 +247,14 @@ function compilePolicyFromFortress(p) {
   if (p.priority != null && (typeof p.priority !== 'number' || !Number.isFinite(p.priority))) {
     throw new Error(`priority must be a finite number (got ${p.priority})`);
   }
+  // v1.1.3 Phase 1.D — accept `mode` from Fortress rows (added by Lovable
+  // when the companion prompt deploys the schema column). Default to
+  // 'enforce' for backwards compat: existing Fortress instances without
+  // the `mode` column yield policies that enforce, as they always have.
+  const mode = p.mode ?? 'enforce';
+  if (!VALID_MODES.has(mode)) {
+    throw new Error(`unsupported mode "${mode}" (expected enforce|shadow)`);
+  }
   const out = {
     id: p.rule_id,
     name: p.name,
@@ -252,6 +263,7 @@ function compilePolicyFromFortress(p) {
     action: p.action,
     message: p.message,
     priority: p.priority ?? 100,
+    mode,
   };
   // Reuse the SAME ReDoS-safe compiler as the local JSON loader (rejects
   // catastrophic-backtracking patterns + over-long regexes). Previously this

package/src/shield/sse.js

@@ -0,0 +1,48 @@
+// SSE line terminator normalization — v1.1.4 F-18 (P1 Codex audit).
+//
+// The HTML Living Standard's event-stream parsing rules (whatwg SSE)
+// accept three line terminator forms: LF (\n), CR (\r), and CRLF (\r\n).
+// An event ends at a blank line: TWO consecutive line terminators of any
+// of those forms, possibly mixed (e.g. \r\n\r\n, \r\r, \n\n, \r\n\n).
+//
+// Before this fix, Shield's two SSE consumers (stream.js for live agent
+// events, policy-stream.js for Fortress policy push) only looked for
+// the LF-LF separator. An upstream proxy or endpoint that emitted CRLF
+// (most production-grade reverse-proxies do, by default!) would yield
+// a buffer that never matched \n\n — Shield would silently never see
+// the events:
+//   - agent-stream side: no deny/interrupt would fire live, breaking
+//     the sub-second enforcement promise
+//   - policy-stream side: updates would fall back to the 60s polling
+//     loop, making rule rollouts visibly slow
+//
+// Fix: normalize the buffer to LF-only before scanning. The normalize
+// step is chunk-safe: a CR at the very end of the current buffer is
+// preserved verbatim (it might be the first half of an incoming CRLF
+// on the next chunk). Once a CR is no longer trailing, it's converted.
+
+/**
+ * Normalize SSE line terminators in a streaming buffer to LF.
+ *
+ * Use as: `buffer = normalizeSseBuffer(buffer + newChunk);`
+ *
+ * Guarantees, after the call:
+ *   - every `\r\n` pair has been replaced by `\n`
+ *   - every bare `\r` NOT at the very end has been replaced by `\n`
+ *   - a trailing `\r` is preserved verbatim so the next iteration can
+ *     check whether it was actually the first half of a CRLF
+ *
+ * @param {string} buffer  the streaming buffer (already concatenated)
+ * @returns {string}       buffer with line terminators normalized to LF
+ */
+export function normalizeSseBuffer(buffer) {
+  if (typeof buffer !== 'string' || buffer.length === 0) return buffer;
+  // Defer the very last character if it's a CR — we don't know yet
+  // whether it's a bare CR terminator or the first half of CRLF.
+  const tail = buffer.endsWith('\r') ? '\r' : '';
+  const scannable = tail ? buffer.slice(0, -1) : buffer;
+  // Two-pass replace: CRLF first (so we don't double-convert the LF
+  // half), then any remaining bare CR.
+  const normalized = scannable.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
+  return tail ? normalized + tail : normalized;
+}

package/src/shield/stream.js

@@ -6,6 +6,8 @@
 //
 // Uses built-in fetch + ReadableStream (Node 18+). Zero deps.
 
+import { normalizeSseBuffer } from './sse.js';
+
 const API_BASE = 'https://api.anthropic.com';
 const BETA = 'managed-agents-2026-04-01';
 const VERSION = '2023-06-01';
@@ -51,6 +53,12 @@ export async function* openEventStream({ apiKey, sessionId, signal }) {
       const { done, value } = await reader.read();
       if (done) break;
       buffer += decoder.decode(value, { stream: true });
+      // v1.1.4 F-18 (P1 Codex audit): normalize all SSE line terminators
+      // (CR, CRLF) to LF so the indexOf('\n\n') scan below catches every
+      // event boundary the spec allows. Without this, an upstream that
+      // emits CRLF (common in reverse-proxy paths) yielded a buffer that
+      // never matched and Shield silently lost the live enforcement loop.
+      buffer = normalizeSseBuffer(buffer);
 
       // v1.1.2 F-16: guard against an upstream that never emits "\n\n" —
       // throw to abort the stream cleanly, the caller's reconnect logic
@@ -60,8 +68,9 @@ export async function* openEventStream({ apiKey, sessionId, signal }) {
         throw new Error(`SSE frame exceeded ${MAX_SSE_FRAME_BYTES} bytes — aborting stream (caller should reconnect)`);
       }
 
-      // SSE frames are separated by a blank line ("\n\n"). Each frame may
-      // contain multiple lines; we only care about `data:` lines for now.
+      // SSE frames are separated by a blank line. Post-normalize, the
+      // canonical separator is "\n\n"; each frame may contain multiple
+      // lines; we only care about `data:` lines for now.
       let nlIdx;
       while ((nlIdx = buffer.indexOf('\n\n')) !== -1) {
         const frame = buffer.slice(0, nlIdx);

package/src/shield/upload.js

@@ -0,0 +1,89 @@
+// Shield → Fortress decision payload builder.
+// v1.1.4 F-19 (P1 Codex audit): pure helper extracted from scripts/shield.js
+// so the egress-side containment can be unit-tested in isolation. The
+// security invariant under test:
+//
+//   nothing on this payload may carry raw customer identifiers — tool
+//   names, session ids, event ids, input values must either be in the
+//   documented allowlist (vendor built-ins) or salted-hashed.
+//
+// Anything that can't be safely normalized is DROPPED (set to undefined)
+// rather than passed through. Decision still ships so Fortress can count
+// it — only the leak-y field is omitted.
+
+import { createHash } from 'node:crypto';
+import { normalizeToolName } from '../anonymizer.js';
+
+// Salted SHA-256 hash with the same 32-char truncation as the anonymizer
+// and the rest of Shield's decision flow. Returns null for nullish input
+// or when no salt is configured (fail-safe omission).
+function hashWithSaltOpt(value, salt) {
+  if (value == null || !salt) return null;
+  const s = typeof value === 'string' ? value : JSON.stringify(value);
+  return 'sha256:' + createHash('sha256').update(salt).update(s).digest('hex').slice(0, 32);
+}
+
+// Extract the most relevant input value to fingerprint (URL > command >
+// query > path > file_path). The actual hashing is done downstream by
+// hashIoc — this function only picks the IoC field.
+function pickInputForHash(input) {
+  if (!input || typeof input !== 'object') return null;
+  return input.url || input.command || input.query || input.path || input.file_path || null;
+}
+
+/**
+ * Build the body POSTed to Fortress's ingest-decisions endpoint.
+ *
+ * Containment guarantees:
+ *   - tool_name: vendor allowlist returned in clear; custom/MCP names
+ *     return as "tool_hash:<32hex>" when a salt is configured; dropped
+ *     entirely otherwise.
+ *   - session_hash / event_id_hash / input_hash: salted SHA-256, omitted
+ *     when no salt is configured.
+ *   - Raw payload values (rawEvent.input, normalized.input) never
+ *     appear on the wire — only their hashes do.
+ *
+ * @param {object} opts
+ * @param {string} opts.agentId - Anthropic agent id (already an opaque token)
+ * @param {string} opts.sessionId - Anthropic session id (hashed before egress)
+ * @param {object} opts.rawEvent  - raw upstream event (id field is hashed)
+ * @param {object} opts.normalized - normalized event from normalizeForPolicy()
+ * @param {object} opts.result    - policy evaluator output
+ * @param {number} opts.decidedInMs
+ * @param {string|null|undefined} opts.signalsSalt
+ * @param {string} [opts.decidedAtIso] - ISO 8601 timestamp; defaults to now()
+ * @returns {object} payload ready to POST to ingest-decisions
+ */
+export function buildFortressDecisionPayload({
+  agentId, sessionId, rawEvent, normalized, result, decidedInMs,
+  signalsSalt, decidedAtIso,
+}) {
+  // F-19: vendor built-ins survive even without a salt (allowlist short-circuit);
+  // custom tool names throw without a salt — we catch and drop the field.
+  let safeToolName;
+  const rawToolName = normalized?.tool_name;
+  if (rawToolName) {
+    try {
+      safeToolName = normalizeToolName(rawToolName, signalsSalt);
+    } catch {
+      safeToolName = undefined;
+    }
+  }
+
+  return {
+    anthropic_agent_id: agentId,
+    decision: result.decision,
+    rule_id: result.rule_id || undefined,
+    session_hash: hashWithSaltOpt(sessionId, signalsSalt) || undefined,
+    event_id_hash: hashWithSaltOpt(rawEvent?.id, signalsSalt) || undefined,
+    input_hash: hashWithSaltOpt(pickInputForHash(normalized?.input), signalsSalt) || undefined,
+    action_type: normalized?.action_type || undefined,
+    tool_name: safeToolName,
+    message: result.message || result.rule_name || undefined,
+    decided_at: decidedAtIso || new Date().toISOString(),
+    decided_in_ms: decidedInMs,
+    // v1.1.3 Phase 1.D: mode threading so Fortress can store and surface
+    // shadow-vs-enforce in the Reports timeline.
+    mode: result.mode || undefined,
+  };
+}

package/src/sources/anthropic-managed.js

@@ -17,7 +17,7 @@
 
 import { request } from 'node:https';
 import { URLSearchParams } from 'node:url';
-import { Source, PROVIDERS, ENFORCEMENT_MODES, ACTION_TYPES } from './contract.js';
+import { Source, PROVIDERS, ENFORCEMENT_MODES, ACTION_TYPES, COMPOSITION_PATTERNS } from './contract.js';
 import {
   getAgentConfig, detectAlwaysAsk,
   confirmAllow, confirmDeny, interruptSession,
@@ -183,11 +183,54 @@ const RELEVANT_TYPES = [
 
 const tsMs = ev => Date.parse(ev.processed_at || ev.created_at || '') || null;
 
+// v1.1.3 Phase 1.B — `fetchSessionEntries` is now a 3-line wrapper around
+// the pure async transformer below. The HTTP layer (fetchRawEvents) is
+// the only thing that needs the network — the per-event normalization
+// logic is a pure async generator that any test can drive with synthetic
+// event arrays. Same external contract; new internal seam for testing.
 export async function* fetchSessionEntries({ apiKey, agentId, sessionId, model }) {
+  yield* transformRawEventsToWMAActions(
+    fetchRawEvents(apiKey, sessionId),
+    { agentId, sessionId, model },
+  );
+}
+
+/**
+ * Pure async transformer: raw Anthropic events → WMAAction objects.
+ *
+ * Takes any async iterable of raw Anthropic events (live HTTP stream OR
+ * synthetic test fixture array) plus the routing metadata, yields one
+ * WMAAction per relevant event. Maintains all the cross-event state
+ * (pendingModelReq / pendingToolUse pairs, subThreadIds tracking, F-6a
+ * discriminators, F-8 end-of-session flush of unresolved tool calls).
+ *
+ * Why a separate function: keeps `fetchSessionEntries` HTTP-only and
+ * makes integration tests trivial — no network mocking required.
+ */
+export async function* transformRawEventsToWMAActions(rawEventsAsyncIterable, { agentId, sessionId, model }) {
   // Pair-tracking maps: event_id of the "start" → its timestamp + metadata
   const pendingModelReq = new Map();    // span.model_request_start.id → ts
   const pendingToolUse = new Map();     // agent.tool_use.id → { ts, name, isMcp, input }
 
+  // v1.1.3 Phase 1.C — Anthropic sub-agent detection.
+  // Anthropic Task tool: when a parent agent delegates, a NEW thread is
+  // spawned within the parent's session (`session.thread_created` event).
+  // Subsequent events with that session_thread_id belong to the sub-agent.
+  // We track the set of "spawned" thread ids and, for each event, set
+  // composition_pattern='hierarchy' if it happened inside a sub-thread.
+  //
+  // Important Anthropic-specific design note: the sub-agent does NOT have
+  // a separate agent_id at the Anthropic API level — it runs inside the
+  // parent's session and its actions are attributed to the parent's
+  // agent_id. So `parent_agent_id` STAYS NULL for all events of this
+  // session (the sub-agent shares identity with the parent). Operators
+  // who want per-sub-agent visibility use the local NDJSON's
+  // `session_thread_id` + `agent_name` discriminators (captured since
+  // v1.0.2 F-6a) to differentiate. Other adapters (OpenAI handoffs,
+  // CrewAI manager, Hermes spawn_subagent) where sub-agents DO have
+  // distinct API-level IDs will populate parent_agent_id natively.
+  const subThreadIds = new Set();
+
   // `provider` is the canonical field per src/sources/contract.js (no
   // other consumer ever read the previous `framework` field, so it was
   // dropped in PR-B with zero downstream impact).
@@ -201,7 +244,7 @@ export async function* fetchSessionEntries({ apiKey, agentId, sessionId, model }
   // exact filterable set is undocumented & evolves. We pull everything and
   // filter here, ensuring future event types are surfaced rather than dropped.
   const RELEVANT = new Set(RELEVANT_TYPES);
-  for await (const ev of fetchRawEvents(apiKey, sessionId)) {
+  for await (const ev of rawEventsAsyncIterable) {
     if (!RELEVANT.has(ev.type)) continue;
     const type = ev.type;
     const ts = ev.processed_at || ev.created_at || new Date().toISOString();
@@ -211,7 +254,21 @@ export async function* fetchSessionEntries({ apiKey, agentId, sessionId, model }
     // Preserved LOCALLY (NDJSON) only — never sent raw to Fortress.
     const session_thread_id = ev.session_thread_id ?? null;
     const agent_name = ev.agent_name ?? null;
-    const subAgentMeta = { session_thread_id, agent_name };
+    // v1.1.3 Phase 1.C: derive composition_pattern at event level.
+    // Sub-thread events (session_thread_id registered in subThreadIds via
+    // a prior session.thread_created) → hierarchy. Root-thread events
+    // OR events without thread_id → solo. The aggregator in uploadSignals
+    // upgrades the AGENT-level composition_pattern to "hierarchy" when
+    // any event in the window is non-solo, so even pre-spawn root events
+    // contribute correctly to the agent's overall classification.
+    const inSubThread = session_thread_id != null && subThreadIds.has(session_thread_id);
+    const composition_pattern = inSubThread ? COMPOSITION_PATTERNS.HIERARCHY : COMPOSITION_PATTERNS.SOLO;
+    // parent_agent_id: see the design note at the top of fetchSessionEntries.
+    // Anthropic Task tool sub-agents share the parent's agent_id at the API
+    // level, so the field is null for ALL Anthropic events. Explicitly
+    // null (not undefined) so consumers see a documented value per WMAAction
+    // schema and downstream tests can assert it cleanly.
+    const subAgentMeta = { session_thread_id, agent_name, composition_pattern, parent_agent_id: null };
     const tsMillis = tsMs(ev);
 
     if (type === 'span.model_request_start') {
@@ -358,9 +415,24 @@ export async function* fetchSessionEntries({ apiKey, agentId, sessionId, model }
       const start = pendingToolUse.get(ev.tool_use_id);
       pendingToolUse.delete(ev.tool_use_id);
       const isError = ev.is_error === true;
+      // v1.1.3 Phase 1.B fix: the yielded action represents the TOOL CALL
+      // as a whole (input from start, output from result). Its discriminators
+      // (session_thread_id, agent_name, composition_pattern) should reflect
+      // the START's context — where the tool was INVOKED — not the result
+      // event's, which may or may not carry these fields depending on
+      // provider event-shape quirks. Falls back to the current event's
+      // subAgentMeta if the start somehow didn't capture them (defensive).
+      const pairedMeta = start ? {
+        session_thread_id: start.session_thread_id ?? subAgentMeta.session_thread_id,
+        agent_name: start.agent_name ?? subAgentMeta.agent_name,
+        composition_pattern: (start.session_thread_id != null && subThreadIds.has(start.session_thread_id))
+          ? COMPOSITION_PATTERNS.HIERARCHY
+          : COMPOSITION_PATTERNS.SOLO,
+        parent_agent_id: null,  // see subAgentMeta — Anthropic shares parent's agent_id
+      } : subAgentMeta;
       yield {
         ...base,
-        ...subAgentMeta,
+        ...pairedMeta,
         id: ev.id,
         action_type: start?.isMcp ? 'mcp_tool_use' : 'tool_use',
         tool_name: start?.name || 'unknown',
@@ -447,6 +519,14 @@ export async function* fetchSessionEntries({ apiKey, agentId, sessionId, model }
     }
 
     if (type === 'session.thread_created') {
+      // v1.1.3 Phase 1.C: register the newly-spawned thread as a sub-thread
+      // BEFORE yielding so subsequent events with this session_thread_id are
+      // correctly marked composition_pattern='hierarchy'. The thread_created
+      // event itself is yielded with the pattern computed before this line —
+      // it's the PARENT's act of spawning, so 'solo' is correct here (the
+      // parent did this act in its own context); only the events that
+      // FOLLOW inside the new thread get 'hierarchy'.
+      if (ev.session_thread_id) subThreadIds.add(ev.session_thread_id);
       yield {
         ...base,
         ...subAgentMeta,
@@ -587,7 +667,12 @@ function extractText(content) {
 
 export class AnthropicManagedSource extends Source {
   static providerName = PROVIDERS.ANTHROPIC_MANAGED;
-  static enforcementMode = ENFORCEMENT_MODES.SYNC_CONFIRM;
+  // v1.1.3: renamed from `enforcementMode` — the static field is the MAX
+  // capability the provider exposes; the EFFECTIVE per-agent mode is
+  // resolved at runtime via effectiveEnforcementMode() since v1.0.1 F-2.
+  // The `enforcementMode` getter inherited from Source.enforcementMode
+  // returns this value, so callers reading either name still work.
+  static enforcementCapability = ENFORCEMENT_MODES.SYNC_CONFIRM;
 
   constructor({ apiKey } = {}) {
     super({ apiKey });

package/src/sources/contract.js

@@ -29,26 +29,76 @@
 // Every WMAAction.action_type MUST be one of these. New adapters that
 // emit a novel kind of action should propose adding a new constant here
 // (and document it) rather than inventing one inline.
+//
+// Audit note (Phase 1.A, v1.1.3): the vocabulary is grouped into two
+// tiers to make the contract honest about which types are framework-
+// agnostic vs which originated from one specific framework (Anthropic
+// Managed Agents was the seed adapter). New adapters can:
+//   1. Use UNIVERSAL types directly — they're always meaningful.
+//   2. Use FRAMEWORK-SPECIFIC types ONLY if the new framework has a
+//      genuinely equivalent concept. Otherwise emit a UNIVERSAL type
+//      (e.g., OpenAI handoffs → HANDOFF, NOT THREAD_MESSAGE_SENT).
+//   3. Propose a new constant via a PR when their framework exposes a
+//      genuinely new category of event.
 export const ACTION_TYPES = Object.freeze({
+  // ── UNIVERSAL (every adapter should be able to emit these) ─────────────
+  /** Model inference call (with token usage + duration). */
   LLM_CALL: 'llm_call',
+  /** Provider-built-in tool invocation (web_search, web_fetch, bash, code_exec, …). */
   TOOL_USE: 'tool_use',
+  /** MCP server tool invocation. */
   MCP_TOOL_USE: 'mcp_tool_use',
+  /** Customer-defined tool invocation (the agent calls a tool the user wired). */
   CUSTOM_TOOL_USE: 'custom_tool_use',
+  /** Customer returned the result of a custom tool. */
   CUSTOM_TOOL_RESULT: 'custom_tool_result',
+  /** Human (or orchestrator) approved/denied a pending tool call. */
   TOOL_CONFIRMATION: 'tool_confirmation',
+  /** User sent input to the agent (prompt, follow-up question, …). */
   USER_MESSAGE: 'user_message',
+  /** User cancelled execution mid-flight. */
   USER_INTERRUPT: 'user_interrupt',
+  /** Agent emitted an output message (final reply or intermediate). */
   MESSAGE: 'message',
+  /** Agent emitted internal reasoning (extended thinking / scratchpad). */
   THINKING: 'thinking',
+  /** Session-level error from the provider runtime. */
+  SESSION_ERROR: 'session_error',
+  /** Agent A passes control to agent B (OpenAI Agents handoffs, AgentCore
+   *  multi-agent, CrewAI manager delegation, Hermes spawn_subagent, LangGraph
+   *  subgraph spawn). For Anthropic Task tool, this is typically emitted as
+   *  THREAD_MESSAGE_SENT — both are valid for that framework. */
+  HANDOFF: 'handoff',
+  /** Graph-flavored frameworks (LangGraph, AutoGen state machine,
+   *  conditional workflow engines) emit this when execution moves from one
+   *  node/state to another. Carries `from_node`/`to_node` in `output`. */
+  GRAPH_NODE_TRANSITION: 'graph_node_transition',
+  /** Shield-internal — emitted when WMA itself blocks/allows/interrupts
+   *  an action. Always carries the decision in `output`. */
+  SHIELD_DECISION: 'shield_decision',
+
+  // ── FRAMEWORK-SPECIFIC (Anthropic Managed Agents-origin, may map cleanly to
+  //    other frameworks but were named after the Anthropic event vocabulary) ──
+  /** Anthropic-specific: emitted when the context window saturates and the
+   *  thread is compacted (some history lost). OpenAI/CrewAI/LangGraph
+   *  generally roll the window silently without an explicit event. */
   CONTEXT_COMPACTED: 'context_compacted',
+  /** Anthropic-specific: a sub-thread was spawned within a session (Task
+   *  tool delegation). Other frameworks model this as HANDOFF + a new
+   *  agent identity. */
   THREAD_CREATED: 'thread_created',
+  /** Anthropic-specific: inter-agent message in a thread (parent → sub-agent). */
   THREAD_MESSAGE_SENT: 'thread_message_sent',
+  /** Anthropic-specific: reply from a sub-agent in a thread (sub → parent). */
   THREAD_MESSAGE_RECEIVED: 'thread_message_received',
+  /** Anthropic-specific: session configuration changed mid-flight
+   *  (`session.updated` event with a diff). Other frameworks generally
+   *  don't expose live config edits as events. */
   CONFIG_CHANGE: 'config_change',
+  /** Anthropic-specific: session/thread lifecycle state change (running/
+   *  idle/rescheduled/terminated). Other frameworks have different state
+   *  machines; map cautiously. */
   STATE_TRANSITION: 'state_transition',
-  SESSION_ERROR: 'session_error',
-  // Shield-only — emitted when WMA itself blocks an action:
-  SHIELD_DECISION: 'shield_decision',
 });
 
 export const STATUS_VALUES = Object.freeze({
@@ -185,19 +235,35 @@ export function validateWMAAction(obj) {
  * provider-agnostic.
  *
  * Static contract:
- *   providerName        — value from PROVIDERS
- *   enforcementMode     — value from ENFORCEMENT_MODES
+ *   providerName            — value from PROVIDERS
+ *   enforcementCapability   — value from ENFORCEMENT_MODES; the MAX the
+ *                             provider can do. The EFFECTIVE per-agent
+ *                             mode may be weaker (resolved at runtime
+ *                             via the provider's effectiveEnforcementMode
+ *                             helper; see AnthropicManagedSource for the
+ *                             reference impl).
+ *
+ *   ⚠️  Renamed from `enforcementMode` in v1.1.3 because the previous
+ *       name was misleading (a static field is the capability ceiling,
+ *       not the runtime mode). `enforcementMode` is kept as a backward-
+ *       compat alias for v1.x consumers; it returns the same value.
  *
  * Instance contract:
- *   listAgents()        — return all agents accessible with the client creds
- *   streamEvents(id)    — async generator yielding WMAAction objects
- *   enforce(action, d)  — only required if enforcementMode != detect_only
+ *   listAgents()       — return all agents accessible with the client creds
+ *   streamEvents(id)   — async generator yielding WMAAction objects
+ *   enforce(action, d) — only required if enforcementCapability != detect_only
  *
  * See `docs/SOURCE-ADAPTER-CONTRACT.md` for the full author guide.
  */
 export class Source {
   static providerName = null;
-  static enforcementMode = null;
+  static enforcementCapability = null;
+  // v1.1.3 backwards-compat alias for the renamed static field. Subclasses
+  // that set `enforcementMode` directly still work; new subclasses should
+  // set `enforcementCapability` instead. Resolved as a getter at read
+  // time so the rename can land without breaking consumers like
+  // assertImplementsSource() that read it from the class.
+  static get enforcementMode() { return this.enforcementCapability; }
 
   constructor(config = {}) {
     if (new.target === Source) {
@@ -237,7 +303,7 @@ export class Source {
    * @returns {Promise<{enforced: boolean, native_response?: object}>}
    */
   async enforce(action, decision) { // eslint-disable-line no-unused-vars
-    if (this.constructor.enforcementMode === ENFORCEMENT_MODES.DETECT_ONLY) {
+    if (this.constructor.enforcementCapability === ENFORCEMENT_MODES.DETECT_ONLY) {
       throw new Error(`${this.constructor.name} is detect_only — enforce() must not be called`);
     }
     throw new Error(`${this.constructor.name}.enforce() not implemented`);
@@ -256,8 +322,11 @@ export function assertImplementsSource(SourceClass) {
   if (!Object.values(PROVIDERS).includes(SourceClass.providerName)) {
     throw new Error(`${SourceClass.name}.providerName="${SourceClass.providerName}" not in PROVIDERS`);
   }
-  if (!Object.values(ENFORCEMENT_MODES).includes(SourceClass.enforcementMode)) {
-    throw new Error(`${SourceClass.name}.enforcementMode="${SourceClass.enforcementMode}" not in ENFORCEMENT_MODES`);
+  // v1.1.3: read enforcementCapability (the new canonical name) but fall
+  // back to enforcementMode for legacy subclasses that haven't migrated.
+  const capability = SourceClass.enforcementCapability ?? SourceClass.enforcementMode;
+  if (!Object.values(ENFORCEMENT_MODES).includes(capability)) {
+    throw new Error(`${SourceClass.name}.enforcementCapability="${capability}" not in ENFORCEMENT_MODES`);
   }
   // The base class throws "not implemented" — a real subclass must override.
   for (const m of ['listAgents', 'streamEvents']) {
@@ -265,8 +334,8 @@ export function assertImplementsSource(SourceClass) {
       throw new Error(`${SourceClass.name}.${m}() must be overridden`);
     }
   }
-  if (SourceClass.enforcementMode !== ENFORCEMENT_MODES.DETECT_ONLY
+  if (capability !== ENFORCEMENT_MODES.DETECT_ONLY
       && SourceClass.prototype.enforce === Source.prototype.enforce) {
-    throw new Error(`${SourceClass.name}.enforce() must be overridden (enforcementMode=${SourceClass.enforcementMode})`);
+    throw new Error(`${SourceClass.name}.enforce() must be overridden (enforcementCapability=${capability})`);
   }
 }