watchmyagents 1.4.0 → 1.4.3

package/README.md

@@ -5,8 +5,12 @@
 Designed around four guarantees:
 
 1. **Local-first.** Raw payloads (prompts, outputs, tool arguments) stay 100% on your machine. Nothing leaves unless you explicitly opt in.
-2. **Trace everything, not just what costs tokens.** A `web_fetch` to a suspicious URL carries zero tokens but is exactly what a security audit needs to see. Even tool calls that were blocked, denied, or interrupted before producing a result are logged with `status: error` so the audit trail is complete.
-3. **Real-time enforcement, not post-hoc auditing.** A policy accepted in Fortress UI is active in Shield within ~1 second via SSE + Postgres realtime. A policy violation is blocked in ~3ms via Anthropic's `user.tool_confirmation` / `user.interrupt` events. Measured in production, not promised in roadmap.
+2. **Trace everything, not just what costs tokens.** A `web_fetch` to a suspicious URL carries zero tokens but is exactly what a security audit needs to see. Tool calls that Shield denied — and sessions it interrupted — are logged with their `status` so the audit trail is complete.
+3. **Real-time enforcement.** A policy accepted in Fortress UI is active in Shield within ~1 second via SSE + Postgres realtime. Shield renders an allow/deny **decision in ~3ms** (local evaluation, measured in production). How that decision is *applied* depends on the agent's configuration, and the distinction matters:
+   - **`tool_confirmation` mode** — when the agent has a tool with `permission_policy: always_ask`, Anthropic pauses the agent and Shield **blocks the tool *before* it executes** (`user.tool_confirmation`). True prevention.
+   - **`interrupt` mode** (zero-config default) — Shield observes the tool-use event *after* Anthropic's cloud has already run the tool, then **terminates the session** (`user.interrupt`). This is **detect-and-terminate, not prevention**: the offending call has already executed; the interrupt stops *subsequent* steps. A single-shot action (one exfil `web_fetch`, one `rm -rf`) is not prevented in this mode.
+
+   See [Shield — real-time policy enforcement](#shield--real-time-policy-enforcement) for how to configure pre-execution blocking.
 4. **Zero dependencies.** Only Node.js 18+ built-ins. No telemetry, no phone-home, no hidden network calls. Preserved through every release including the SSE realtime work (custom RFC-compliant SSE parser, no `@supabase/realtime-js` or `ws` dep).
 
 ### Measured end-to-end loop latency (v1.1.0+)
@@ -17,9 +21,11 @@ Watch capture        ────────► Fortress signal upload   : ≤
 Fortress signal      ────────► Guardian analysis        : ≤ 30s     (event-triggered, debounced)
 Guardian proposal    ────────► Operator accepts in UI   : (human)
 Policy accepted      ────────► Shield receives via SSE  : ≤ 1s      (sub-second push, validated)
-Shield evaluates     ────────► Decision (allow/deny)    : ≤ 3ms     (measured on Anthropic Managed)
+Shield evaluates     ────────► Decision (allow/deny)    : ≤ 3ms     (decision latency, not time-to-block)
 ```
 
+> The ≤ 3ms is Shield's local *decision* latency. Time-to-**block** depends on the enforcement mode: `tool_confirmation` blocks before execution; `interrupt` (default) terminates the session *after* the violating tool ran. See guarantee #3 above and the Shield section.
+
 Full audit-clean: 3 successful Codex audit passes (v1.0.1, v1.0.2, v1.0.3) closed 7 findings with zero regression. Containment invariant (raw payloads never leave the customer machine) is formalized in `docs/CONTAINMENT.md` and locked by 8 regression tests.
 
 ---
@@ -287,7 +293,7 @@ export WMA_SIGNALS_SALT="..."                                 # stable per-custo
 
 wma-service install (--agent-id agent_01ABC... | --all-agents) [--interval 1m] [--with-shield]
 wma-service status
-wma-service uninstall [--with-shield]
+wma-service uninstall [--with-shield] [--purge]
 ```
 
 - macOS → **launchd** LaunchAgent · Linux → **systemd** user unit.
@@ -295,6 +301,9 @@ wma-service uninstall [--with-shield]
   runtime — **never** written into the plist/unit.
 - `--with-shield` also runs `wma-shield --policies-source fortress` always-on for
   live enforcement.
+- `uninstall` by default **leaves `~/.watchmyagents/env` on disk** so a re-install
+  keeps your snapshotted keys. Pass `--purge` to also delete the env file and the
+  whole `~/.watchmyagents` directory (including local logs).
 - Raw logs stay local (`~/.watchmyagents/logs`); only anonymized signals upload.
 
 After this, the full Watch→Guardian→Shield loop runs hands-off.

package/SECURITY.md

@@ -33,7 +33,8 @@ Hardening notes:
 - The launcher loads secrets with `while IFS='=' read -r k v` instead of `. file` / `source file`. Sourcing would shell-evaluate every value, so a value containing `$(cmd)` would execute at every restart. The literal read assigns the bytes verbatim.
 - Values are validated before write: a newline anywhere in a credential aborts the install (would corrupt the env file or inject extra lines).
 - To wipe the credential without uninstalling the service: `chmod 600 ~/.watchmyagents/env && : > ~/.watchmyagents/env` (the daemon will exit on the next missing-env check).
-- Full removal: `wma-service uninstall` deletes the unit, the launcher, the env file, and the `~/.watchmyagents` directory.
+- Service removal: `wma-service uninstall` removes the unit and the launcher but **leaves `~/.watchmyagents/env` on disk** so a re-install keeps your snapshotted keys. This is the default since v1.4.1 (F-37) and is the safer behavior — uninstalling to retry an install does not destroy your API keys.
+- Full removal incl. secrets: `wma-service uninstall --purge` removes the unit, the launcher, the env file, and the whole `~/.watchmyagents` directory (including local NDJSON logs under `~/.watchmyagents/logs`). Use this when you really want to scrub the machine.
 
 ### Local log files
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmyagents",
-  "version": "1.4.0",
+  "version": "1.4.3",
   "description": "Security observability + real-time policy enforcement for AI agents. Local-first NDJSON capture with a continuous Watch daemon that auto-uploads anonymized signals, Shield CLI that blocks policy violations live (with policies pulled from Fortress cloud), anonymizer producing signals-only payloads, bidirectional sync with WatchMyAgents Fortress, and one-command install as an always-on launchd/systemd service — closing the recursive Watch→Guardian→Shield security loop.",
   "type": "module",
   "files": [

package/scripts/fetch-anthropic.js

@@ -25,7 +25,7 @@ import { createInterface } from 'node:readline';
 import { join, resolve } from 'node:path';
 import { request as httpsRequest } from 'node:https';
 import { URL } from 'node:url';
-import { Logger } from '../src/logger.js';
+import { Logger, tightenMode } from '../src/logger.js';
 import { TokenTracker } from '../src/tokens.js';
 import { SignalsAggregator } from '../src/anonymizer.js';
 import { resolveFortressBase, fortressEndpoint } from '../src/fortress/url.js';
@@ -38,6 +38,7 @@ import {
   AnthropicManagedSource, effectiveEnforcementMode,
 } from '../src/sources/anthropic-managed.js';
 import { maybePrintVersionAndExit } from '../src/version.js';
+import { SeenTracker } from '../src/watch-state.js';
 
 function parseArgs(argv) {
   const out = {};
@@ -321,10 +322,26 @@ async function fetchOneShot({ apiKey, agentId, model, logDir, since, sessionId,
     process.stdout.write(`\n[wma-fetch] session ${sid}\n`);
     if (dumpRaw) {
       assertSafePathSegment(sid, 'session-id'); // defense-in-depth: sid → file path
-      const rawPath = join(logDir, agentId, `raw-${sid}.jsonl`);
-      await mkdir(join(logDir, agentId), { recursive: true, mode: 0o700 });
+      const rawDir = join(logDir, agentId);
+      const rawPath = join(rawDir, `raw-${sid}.jsonl`);
+      await mkdir(rawDir, { recursive: true, mode: 0o700 });
+      // v1.4.1 F-34 (P2 Codex audit): mkdir/appendFile `mode` is creation-
+      // only. If a previous `wma-fetch` run, a different user, or a hand-
+      // rolled mkdir left the directory or file in place with loose perms
+      // (typically 0755/0644 via umask), the original code path kept them.
+      // The raw JSONL carries unredacted API events, so loose perms make
+      // them readable to any local user. Tighten after the directory and
+      // after the first append so an existing inode is brought in line
+      // with the doc promise (0700/0600). Best-effort: chmod failures
+      // here MUST NOT break wma-fetch.
+      await tightenMode(rawDir, 0o700);
+      let firstAppend = true;
       for await (const ev of fetchRawEvents(apiKey, sid)) {
         await appendFile(rawPath, JSON.stringify(ev) + '\n', { encoding: 'utf8', mode: 0o600 });
+        if (firstAppend) {
+          await tightenMode(rawPath, 0o600);
+          firstAppend = false;
+        }
       }
       process.stdout.write(`  raw events  → ${rawPath}\n`);
     }
@@ -364,12 +381,19 @@ async function fetchOneShot({ apiKey, agentId, model, logDir, since, sessionId,
 // Fortress display_name (opt-in); default sends the agent id only (Containment).
 async function runWatch({ apiKey, resolveAgents, fleet, logDir, intervalMs, windowMs, uploadCtx, sendNames }) {
   let agents = await resolveAgents();
-  const seenIds = new Set();     // stable Anthropic event ids already captured
+  // v1.4.3 F-51: bounded dedup. Preloaded on-disk ids are static; runtime ids
+  // are tracked per-session and dropped on terminate (see src/watch-state.js).
+  const preloaded = [];
   for (const ag of agents) {
-    for (const id of await preloadSeenIds(logDir, ag.agentId)) seenIds.add(id);
+    for (const id of await preloadSeenIds(logDir, ag.agentId)) preloaded.push(id);
   }
+  const seen = new SeenTracker(preloaded);
   const loggers = new Map();     // sessionId → Logger (session ids are globally unique)
-  const ended = new Set();       // terminated sessions (skip)
+  const ended = new Set();       // terminated sessions (skip). Grows one id per
+                                  // terminated session over the daemon's life —
+                                  // bounded by session COUNT (ids only, the
+                                  // smallest term); the per-EVENT growth that
+                                  // actually drove OOM is fixed via SeenTracker.
   const sessionAgent = new Map();// sessionId → { agentId, model, displayName }
   const priors = new Map();      // agentId → previous classification (threads the
                                   // typology state machine across upload cycles)
@@ -383,7 +407,7 @@ async function runWatch({ apiKey, resolveAgents, fleet, logDir, intervalMs, wind
   process.on('SIGINT', shutdown);
   process.on('SIGTERM', shutdown);
 
-  info(`watch mode — ${agents.length} agent(s)${fleet ? ' (fleet, re-discovered each cycle)' : ''}, interval ${Math.round(intervalMs / 1000)}s, discovery window ${Math.round(windowMs / 3600000)}h, upload ${uploadCtx ? 'ON' : 'OFF'}, ${seenIds.size} known events preloaded`);
+  info(`watch mode — ${agents.length} agent(s)${fleet ? ' (fleet, re-discovered each cycle)' : ''}, interval ${Math.round(intervalMs / 1000)}s, discovery window ${Math.round(windowMs / 3600000)}h, upload ${uploadCtx ? 'ON' : 'OFF'}, ${seen.size} known events preloaded`);
 
   while (!ac.signal.aborted) {
     if (fleet) { const next = await resolveAgents(); if (next.length) agents = next; }
@@ -411,6 +435,14 @@ async function runWatch({ apiKey, resolveAgents, fleet, logDir, intervalMs, wind
       if (ac.signal.aborted) break;
       if (ended.has(sid)) continue;
       const tag = fleet ? `[${ag.displayName}] ` : '';
+      // v1.4.3 F-51: top-level guard around the WHOLE per-session body. Pre-fix
+      // only the fetch + upload had try/catch; an unguarded throw elsewhere
+      // (e.g. ENOSPC/EACCES on the fail-loud session_end logger.write, or a
+      // malformed entry in TokenTracker) propagated out of the loop and
+      // KILLED the daemon — silent total collection-stop on a backgrounded
+      // process. Now any single session's failure drops that session for the
+      // cycle and the daemon survives.
+      try {
       let logger = loggers.get(sid);
       if (!logger) { logger = new Logger({ logDir, agentId: ag.agentId, sessionId: sid, silent: true }); loggers.set(sid, logger); }
 
@@ -418,8 +450,8 @@ async function runWatch({ apiKey, resolveAgents, fleet, logDir, intervalMs, wind
       let sawTerminated = false;
       try {
         for await (const entry of fetchSessionEntries({ apiKey, agentId: ag.agentId, sessionId: sid, model: ag.model })) {
-          if (entry.id && seenIds.has(entry.id)) continue;
-          if (entry.id) seenIds.add(entry.id);
+          if (entry.id && seen.has(sid, entry.id)) continue;
+          if (entry.id) seen.add(sid, entry.id);
           const written = await logger.write(entry);
           fresh.push(written);
           if (entry.action_type === 'state_transition'
@@ -476,9 +508,19 @@ async function runWatch({ apiKey, resolveAgents, fleet, logDir, intervalMs, wind
           session_cost_usd: stats.cost_usd || null,
         });
         ended.add(sid);
-        sessionAgent.delete(sid);   // bound memory: terminated sessions aren't re-fetched
+        // v1.4.3 F-51: bound memory — terminated sessions aren't re-fetched,
+        // so drop their per-session dedup set AND their Logger object (the
+        // latter was never deleted pre-fix → unbounded growth of Logger
+        // instances over a long daemon run).
+        sessionAgent.delete(sid);
+        seen.forgetSession(sid);
+        loggers.delete(sid);
         info(`${tag}session ${sid.slice(0, 16)}… terminated — closed`);
       }
+      } catch (e) {
+        // F-51 top-level guard: never let one session's failure kill the loop.
+        warn(`${tag}session ${sid.slice(0, 16)}…: cycle error (skipped): ${e.message}`);
+      }
     }
 
     if (cycleNew === 0) info('cycle: no new events');
@@ -551,7 +593,25 @@ async function main() {
     const intervalMs = parseDurationMs(args.interval, 60_000);
     // Discovery window for NEW sessions (default 7d, configurable). Sessions we
     // already track are re-fetched regardless of age, so long-lived ones don't drop.
-    const windowMs = parseDurationMs(args['discovery-since'], 7 * 24 * 3600_000);
+    let windowMs = parseDurationMs(args['discovery-since'], 7 * 24 * 3600_000);
+    // v1.4.2 F-46 (P1 audit): the discovery window must comfortably exceed the
+    // poll interval. Discovery runs once per cycle; a session that is created
+    // AND ends/ages-out between two sweeps is never added to the tracked set,
+    // so its events are never fetched (untraced activity). Requiring
+    // windowMs >= 2*intervalMs guarantees every session appears in at least
+    // two consecutive discovery sweeps before it can leave the window. The 7d
+    // default is far above this; the guard only bites when an operator sets
+    // --discovery-since too tight relative to --interval. Clamp + warn rather
+    // than silently honoring a value that opens a per-cycle blind window.
+    const minWindowMs = intervalMs * 2;
+    if (windowMs < minWindowMs) {
+      process.stderr.write(
+        `[wma] --discovery-since (${Math.round(windowMs / 1000)}s) is below 2x --interval ` +
+        `(${Math.round(intervalMs / 1000)}s) — a short-lived session could be missed between ` +
+        `sweeps. Clamping discovery window up to ${Math.round(minWindowMs / 1000)}s.\n`,
+      );
+      windowMs = minWindowMs;
+    }
     // display_name on the Fortress payload: defaults to the human agent name
     // (UX-friendly — operators identify agents by name in the dashboard). The
     // name is sanitized via cleanLabel() so log/payload injection is impossible.

package/scripts/service.js

@@ -11,7 +11,14 @@
 // One integrated install:
 //   wma-service install --agent-id agent_xxx [--interval 5m] [--with-shield]
 //   wma-service status
-//   wma-service uninstall [--with-shield]
+//   wma-service uninstall [--with-shield] [--purge]
+//
+// v1.4.1 F-37 (P3 Codex audit on v1.4.0): `uninstall` defaults to LEAVING
+// ~/.watchmyagents/env on disk (containing the snapshotted API keys). This
+// matches the historical behavior and protects users who uninstall just to
+// reinstall with a different agent-id from losing their snapshot. To wipe
+// the env file + config dir, pass `--purge` explicitly. SECURITY.md says
+// the same thing; do not let the doc + the code drift again.
 //
 // Secrets NEVER go in the plist/unit. They're snapshotted (from the current
 // environment) into a protected env file (~/.watchmyagents/env, chmod 600) that
@@ -289,6 +296,7 @@ function cmdInstall(args) {
 
 function cmdUninstall(args) {
   const withShield = !!args['with-shield'];
+  const purge = !!args.purge;
   if (PLATFORM === 'darwin') {
     macUnload(WATCH_LABEL);
     if (withShield) macUnload(SHIELD_LABEL);
@@ -298,7 +306,18 @@ function cmdUninstall(args) {
   } else {
     die(`unsupported platform "${PLATFORM}"`);
   }
-  info('uninstalled. (Secrets in ' + ENV_FILE + ' left intact — delete manually if you want them gone.)');
+  if (purge) {
+    // F-37: explicit opt-in only. Removes the snapshotted env file (chmod
+    // 600, contains API keys) and the whole config dir. Logs under
+    // ~/.watchmyagents/logs are wiped too — the user asked for purge, so
+    // we do not second-guess them on local NDJSON. `force: true` ensures
+    // we don't throw if the path is already gone.
+    try { rmSync(ENV_FILE, { force: true }); } catch { /* best-effort */ }
+    try { rmSync(CONFIG_DIR, { recursive: true, force: true }); } catch { /* best-effort */ }
+    info(`uninstalled + purged ${CONFIG_DIR} (env file and local logs removed).`);
+  } else {
+    info(`uninstalled. Secrets in ${ENV_FILE} left intact — re-run with --purge to wipe them.`);
+  }
 }
 
 function cmdStatus() {
@@ -328,11 +347,15 @@ function usage() {
 Usage:
   wma-service install --agent-id agent_xxx [--interval 5m] [--log-dir DIR] [--with-shield]
   wma-service status
-  wma-service uninstall [--with-shield]
+  wma-service uninstall [--with-shield] [--purge]
 
 Required env at install (snapshotted to ~/.watchmyagents/env, chmod 600):
   ANTHROPIC_API_KEY, WMA_API_KEY, WMA_FORTRESS_BASE_URL, WMA_SIGNALS_SALT
 
+Uninstall by default leaves ~/.watchmyagents/env on disk so a re-install
+keeps your snapshotted keys. Pass --purge to also delete the env file and
+the whole ~/.watchmyagents directory (including local logs).
+
 macOS → launchd LaunchAgent · Linux → systemd user unit.
 The service starts at login and restarts on crash. Raw logs stay local.
 `);

package/scripts/shield.js

@@ -146,16 +146,42 @@ async function runSessionWorker({ sessionId, ctx }) {
   // isolation. The helper drops any field it cannot safely normalize
   // (custom tool without salt, missing salt for hashes) rather than
   // passing the raw value through.
-  const fireToFortress = (rawEvent, normalized, result, decidedInMs) => {
+  const fireToFortress = (rawEvent, normalized, result, decidedInMs, enforcementDelivered) => {
     if (!pushDecisionToFortress) return;
     const payload = buildFortressDecisionPayload({
       agentId, sessionId, rawEvent, normalized, result, decidedInMs,
-      signalsSalt,
+      signalsSalt, enforcementDelivered,
     });
     pushDecisionToFortress(payload).catch(() => undefined);
   };
 
-  let processed = 0, enforced = 0, sessionInterrupted = false;
+  // v1.4.2 F-44 (P1 audit): enforcement API calls (confirmDeny / interrupt)
+  // could fail (15s timeout, 5xx, network drop) and the old code just logged
+  // and continued — the violating session kept running with no retry, while
+  // the decision row still claimed "enforced". Retry the call (these are
+  // idempotent: a duplicate deny/interrupt on the same tool_use/session is
+  // safe), and return whether it was ultimately delivered so the caller can
+  // record the REAL outcome and surface a loud failure. Backoff is short and
+  // bounded — the tool already ran in interrupt mode, so landing the session
+  // termination quickly matters more than long waits.
+  const enforceWithRetry = async (thunk, { label, attempts = 3 } = {}) => {
+    let lastErr;
+    for (let i = 0; i < attempts; i++) {
+      try {
+        await thunk();
+        return true;
+      } catch (e) {
+        lastErr = e;
+        if (i < attempts - 1) await sleep(250 * (i + 1));
+      }
+    }
+    process.stderr.write(
+      `[shield/${sessionId.slice(0, 12)}] ${label} FAILED after ${attempts} attempts: ${lastErr?.message}\n`,
+    );
+    return false;
+  };
+
+  let processed = 0, enforced = 0, enforcementFailed = 0, sessionInterrupted = false;
 
   // v1.2.0 — per-session context tracker. Feeds runtime attributes
   // (hour_of_day_utc, agent_age_minutes, recent_error_rate, …) into the
@@ -237,36 +263,43 @@ async function runSessionWorker({ sessionId, ctx }) {
         const modeTag = result.mode === 'shadow' ? ' [SHADOW]' : '';
         sinfo(sessionId, `${rawEvent.type} tool=${normalized.tool_name} → ${result.decision}${modeTag}${result.rule_id ? ` (${result.rule_id})` : ''}`);
 
-        await decisions(sessionId).record({
-          sourceEvent: rawEvent, decision: result.decision,
-          ruleId: result.rule_id, ruleName: result.rule_name,
-          message: result.message, decidedInMs,
-          mode: result.mode,
-        });
-        fireToFortress(rawEvent, normalized, result, decidedInMs);
-
-        // v1.1.3 Phase 1.D — in shadow mode, the decision is COMPUTED + LOGGED
-        // but NOT enforced. The rule's "would_deny" / "would_interrupt"
-        // outcome flows to Fortress for Platt-scaling calibration + diff-in-diff
-        // efficacy measurement (Guardian Core hardening axes 1 + 4), but the
-        // agent's session continues uninterrupted. Promote to enforce only
-        // after calibration confidence + lifecycle gates (Guardian Core spec
-        // observe → shadow → enforce → retired).
-        if (result.mode === 'shadow') continue;
-
-        if ((result.decision === 'deny' || result.decision === 'interrupt') && !sessionInterrupted) {
-          try {
-            await interruptSession({
+        // v1.4.2 F-44 (P1 audit): ENFORCE FIRST, then record the REAL outcome.
+        // Pre-F-44 the decision was recorded as "enforced" before (and
+        // regardless of) the interrupt call, and a failed interrupt was
+        // swallowed with the session left running. Now: shadow + non-blocking
+        // decisions don't enforce (enforcementDelivered stays undefined);
+        // deny/interrupt attempts the interrupt with bounded retry and the
+        // recorded row + Fortress payload carry whether it actually landed.
+        const willEnforce = result.mode !== 'shadow'
+          && (result.decision === 'deny' || result.decision === 'interrupt')
+          && !sessionInterrupted;
+
+        let enforcementDelivered;   // undefined unless we attempt enforcement
+        if (willEnforce) {
+          enforcementDelivered = await enforceWithRetry(
+            () => interruptSession({
               apiKey, sessionId,
               followUpMessage: `Shield interrupted: ${result.message || result.rule_name || 'policy violation'}`,
-            });
+            }),
+            { label: 'interrupt' },
+          );
+          if (enforcementDelivered) {
             sessionInterrupted = true;
             enforced++;
             swarn(sessionId, 'session interrupted — agent loop stopped');
-          } catch (e) {
-            process.stderr.write(`[shield/${sessionId.slice(0, 12)}] interrupt error: ${e.message}\n`);
+          } else {
+            enforcementFailed++;
+            swarn(sessionId, `ENFORCEMENT FAILED — session NOT interrupted; violating action was NOT blocked (${result.rule_id || 'policy'})`);
           }
         }
+
+        await decisions(sessionId).record({
+          sourceEvent: rawEvent, decision: result.decision,
+          ruleId: result.rule_id, ruleName: result.rule_name,
+          message: result.message, decidedInMs,
+          mode: result.mode, enforcementDelivered,
+        });
+        fireToFortress(rawEvent, normalized, result, decidedInMs, enforcementDelivered);
         continue;
       }
 
@@ -286,13 +319,18 @@ async function runSessionWorker({ sessionId, ctx }) {
           const sourceEvent = cached?.event;
           if (!sourceEvent) {
             swarn(sessionId, `requires_action for unknown event_id ${eventId} — denying defensively`);
-            try {
-              await confirmDeny({
+            // F-44: retry + loud. If the defensive deny doesn't land, the
+            // agent may proceed or hang — either way the operator must know.
+            const delivered = await enforceWithRetry(
+              () => confirmDeny({
                 apiKey, sessionId, toolUseId: eventId,
                 denyMessage: 'Shield never saw the original tool_use. Denying defensively.',
-              });
-            } catch (e) {
-              process.stderr.write(`[shield/${sessionId.slice(0, 12)}] enforcement error: ${e.message}\n`);
+              }),
+              { label: 'confirmDeny(unknown)' },
+            );
+            if (!delivered) {
+              enforcementFailed++;
+              swarn(sessionId, `ENFORCEMENT FAILED — defensive deny NOT delivered for event ${eventId}`);
             }
             continue;
           }
@@ -312,54 +350,75 @@ async function runSessionWorker({ sessionId, ctx }) {
           const modeTag = result.mode === 'shadow' ? ' [SHADOW]' : '';
           sinfo(sessionId, `requires_action ${sourceEvent.type} tool=${normalized.tool_name} → ${result.decision}${modeTag}${result.rule_id ? ` (${result.rule_id})` : ''}`);
 
-          await decisions(sessionId).record({
-            sourceEvent, decision: result.decision,
-            ruleId: result.rule_id, ruleName: result.rule_name,
-            message: result.message, decidedInMs,
-            mode: result.mode,
-          });
-          fireToFortress(sourceEvent, normalized, result, decidedInMs);
-
           // v1.1.3 Phase 1.D — shadow mode in tool_confirmation: we MUST
           // still send confirmAllow even when the rule said deny/interrupt,
           // otherwise the agent hangs waiting for our response. The
           // decision is logged with mode=shadow so calibration can compare
           // what the rule said vs what was enforced (which is "nothing"
-          // here). For mode=enforce, the original branching below stands.
+          // here). For mode=enforce, the branching below stands.
+          //
+          // v1.4.2 F-44 — ENFORCE FIRST, then record the REAL outcome (see
+          // the interrupt-mode block above for the rationale). Retry + loud
+          // on failure so a swallowed confirm/deny/interrupt can no longer
+          // leave the audit row claiming a block that never happened.
           if (result.mode === 'shadow') {
-            try {
-              await confirmAllow({ apiKey, sessionId, toolUseId: eventId });
-              // No enforced++ — shadow doesn't enforce by definition.
-            } catch (e) {
-              process.stderr.write(`[shield/${sessionId.slice(0, 12)}] shadow confirmAllow error: ${e.message}\n`);
-            }
+            await enforceWithRetry(
+              () => confirmAllow({ apiKey, sessionId, toolUseId: eventId }),
+              { label: 'shadow confirmAllow' },
+            );
+            // No enforced++ — shadow doesn't enforce by definition.
+            await decisions(sessionId).record({
+              sourceEvent, decision: result.decision,
+              ruleId: result.rule_id, ruleName: result.rule_name,
+              message: result.message, decidedInMs, mode: result.mode,
+            });
+            fireToFortress(sourceEvent, normalized, result, decidedInMs);
             continue;
           }
 
-          try {
-            if (result.decision === 'allow') {
-              await confirmAllow({ apiKey, sessionId, toolUseId: eventId });
-              enforced++;
-            } else if (result.decision === 'deny') {
-              await confirmDeny({
+          let enforcementDelivered;   // undefined for allow (no block attempted)
+          let shouldBreak = false;
+          if (result.decision === 'allow') {
+            // An allow is not a block; confirmAllow just lets the tool
+            // proceed. Retry to avoid hangs, but this is not fail-open.
+            const ok = await enforceWithRetry(
+              () => confirmAllow({ apiKey, sessionId, toolUseId: eventId }),
+              { label: 'confirmAllow' },
+            );
+            if (ok) enforced++;
+            else { enforcementFailed++; swarn(sessionId, `confirmAllow NOT delivered for event ${eventId} — agent may hang`); }
+          } else if (result.decision === 'deny') {
+            enforcementDelivered = await enforceWithRetry(
+              () => confirmDeny({
                 apiKey, sessionId, toolUseId: eventId,
                 denyMessage: result.message || `Blocked by ${result.rule_name}`,
-              });
-              enforced++;
-            } else if (result.decision === 'interrupt') {
-              await interruptSession({
+              }),
+              { label: 'confirmDeny' },
+            );
+            if (enforcementDelivered) enforced++;
+            else { enforcementFailed++; swarn(sessionId, `ENFORCEMENT FAILED — deny NOT delivered; tool NOT blocked (${result.rule_id || 'policy'})`); }
+          } else if (result.decision === 'interrupt') {
+            enforcementDelivered = await enforceWithRetry(
+              () => interruptSession({
                 apiKey, sessionId,
                 followUpMessage: `Shield interrupted: ${result.message || result.rule_name}`,
-              });
-              sessionInterrupted = true;
-              enforced++;
-              break;
-            }
-          } catch (e) {
-            process.stderr.write(`[shield/${sessionId.slice(0, 12)}] enforcement error on event ${eventId}: ${e.message}\n`);
+              }),
+              { label: 'interrupt' },
+            );
+            if (enforcementDelivered) { sessionInterrupted = true; enforced++; shouldBreak = true; }
+            else { enforcementFailed++; swarn(sessionId, `ENFORCEMENT FAILED — interrupt NOT delivered; session NOT stopped (${result.rule_id || 'policy'})`); }
           }
 
+          await decisions(sessionId).record({
+            sourceEvent, decision: result.decision,
+            ruleId: result.rule_id, ruleName: result.rule_name,
+            message: result.message, decidedInMs,
+            mode: result.mode, enforcementDelivered,
+          });
+          fireToFortress(sourceEvent, normalized, result, decidedInMs, enforcementDelivered);
+
           toolUseCache.delete(eventId);
+          if (shouldBreak) break;
         }
         continue;
       }
@@ -631,9 +690,21 @@ async function main() {
     catch (e) { warn(`${tag}could not fetch agent config (${e.message}). Defaulting to interrupt mode.`); }
 
     info(`${tag}armed — ${ruleset.policies.length} policies · default ${ruleset.default.action} · mode ${mode}${agentMeta?.name ? ` · "${agentMeta.name}"` : ''}`);
-    if (mode === 'interrupt' && !fleet) {
-      warn('DEGRADED mode — Shield will interrupt AFTER a violating tool runs.');
-      warn(`For pre-execution blocking, run: wma-shield --setup-guide --agent-id ${aid}`);
+    // v1.4.2 F-43 (P0 audit): surface the DEGRADED (interrupt) mode in BOTH
+    // single and fleet runs. Pre-fix this warning was gated on `!fleet`, so a
+    // fleet operator — the LEAST likely to inspect each agent's mode and the
+    // MOST likely to assume uniform pre-execution blocking — got no signal
+    // that some/all of the fleet only terminates the session AFTER a
+    // violating tool runs. In fleet mode we warn per newly-armed degraded
+    // agent (once per agent lifetime, not per event) AND the caller emits a
+    // fleet-level summary count after the initial arm.
+    if (mode === 'interrupt') {
+      if (fleet) {
+        warn(`${tag}DEGRADED mode (interrupt) — no pre-execution blocking; session is terminated AFTER a violating tool runs.`);
+      } else {
+        warn('DEGRADED mode — Shield will interrupt AFTER a violating tool runs.');
+        warn(`For pre-execution blocking, run: wma-shield --setup-guide --agent-id ${aid}`);
+      }
     }
 
     const loggers = new Map();
@@ -660,6 +731,7 @@ async function main() {
   // created after startup gets armed + protected without a restart. A per-agent
   // arm failure is skipped and retried on the next reconcile.
   const armed = new Set();
+  const degraded = new Set();   // F-43: agents armed in interrupt (no pre-block) mode
   const running = [];
   const armNew = async (ids) => {
     for (const aid of ids) {
@@ -667,14 +739,20 @@ async function main() {
       const ctx = await setupAgent(aid);
       if (!ctx) continue;                 // skipped (policy fetch failed) → retry next reconcile
       armed.add(aid);
+      if (ctx.mode === 'interrupt') degraded.add(aid);
       running.push(runAgentWide(ctx));    // fire; blocks on the shared signal until shutdown
-      info(`fleet: armed ${aid.slice(0, 16)}…`);
+      info(`fleet: armed ${aid.slice(0, 16)}… (mode ${ctx.mode})`);
     }
   };
   await armNew(agentIds);
   if (armed.size === 0) {
     die(`error: no agents could be armed (${agentIds.length} discovered; all policy fetches failed). Check WMA_API_KEY / WMA_FORTRESS_BASE_URL.`);
   }
+  // F-43: fleet-level honesty summary — how much of the fleet has only
+  // post-hoc termination vs true pre-execution blocking.
+  if (degraded.size > 0) {
+    warn(`fleet: ${degraded.size}/${armed.size} agent(s) in DEGRADED interrupt mode — those have NO pre-execution blocking (the tool runs, then the session is terminated). Configure permission_policy: always_ask on those agents for true pre-block.`);
+  }
   // v1.1.0 Phase 1 L3: supervisor reconcile every 30s (was 60s) so a
   // freshly-created Anthropic agent gets armed sub-30s instead of sub-minute.
   info(`fleet: ${armed.size}/${agentIds.length} agent(s) armed; reconciling every 30s for new agents.`);

package/src/anonymizer.js

@@ -36,6 +36,7 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { createReadStream } from 'node:fs';
 import { createInterface } from 'node:readline';
+import { safeNonNegInt } from './tokens.js';
 
 // ── Configuration ────────────────────────────────────────────────────────
 
@@ -297,8 +298,10 @@ export class SignalsAggregator {
       for (const h of extractIocs(entry, this.salt)) this.iocHashes.add(h);
     }
 
-    // Tokens
-    if (typeof entry.tokens_used === 'number') this.tokensTotal += entry.tokens_used;
+    // Tokens — v1.4.2 F-49: sanitize so a NaN/Infinity/negative tokens_used
+    // can't poison the uploaded tokens_total (a single absurd value would
+    // otherwise distort the whole window's cost-anomaly signal).
+    this.tokensTotal += safeNonNegInt(entry.tokens_used);
 
     // Stop reasons (state_transition entries carry these)
     const stopType = entry.output?.stop_reason?.type;