watchmyagents 1.4.1 → 1.4.3

package/src/shield/policy.js

@@ -24,6 +24,7 @@
 // Field paths use dotted notation (`input.url`, `output.content.text`).
 
 import { readFile } from 'node:fs/promises';
+import { TOOL_USE_FAMILY } from '../sources/contract.js';
 
 export async function loadPolicies(path) {
   const raw = await readFile(path, 'utf8');
@@ -165,6 +166,17 @@ function safeRegexTest(re, value) {
   return re.test(s);
 }
 
+// v1.4.3 F-40: coerce ONLY a clean decimal-number string to a number, for the
+// ordered numeric comparators. Anything else (real number → passthrough;
+// hex/exponent/whitespace/Infinity/non-string → returned as-is so the caller's
+// Number.isFinite check fails closed). Never used for equality or length_*.
+const CLEAN_NUMERIC_STRING = /^-?\d+(\.\d+)?$/;
+function asOrderedNumber(value) {
+  if (typeof value === 'number') return value;
+  if (typeof value === 'string' && CLEAN_NUMERIC_STRING.test(value)) return Number(value);
+  return value;
+}
+
 function matchValue(value, condition) {
   // Literal scalar match
   if (condition === null || typeof condition !== 'object') {
@@ -185,20 +197,34 @@ function matchValue(value, condition) {
     return condition._regex_any.some(r => safeRegexTest(r, value));
   }
   // v1.2.0 — DSL extensions for ABAC / parameter validation.
-  // Numeric comparators are strict: a non-finite VALUE or a non-finite
-  // CONDITION operand fails-closed. Same as the regex branch: we never
-  // coerce or guess intent for a malformed policy.
+  // Numeric comparators reject a non-finite CONDITION operand (malformed
+  // policy → fail-closed).
+  //
+  // v1.4.3 F-40 (P2 audit) — the VALUE is run through asOrderedNumber():
+  // a real number passes through; a CLEAN decimal-number STRING (e.g. a tool
+  // that serializes `bytes` as "1500000") is coerced to its number. Why: a
+  // deny threshold like { gt: 1000000 } previously did NOT match a stringified
+  // value, so the rule silently no-matched and the action fell through to
+  // default-allow — a fail-OPEN on exfil-size / rate thresholds. Coercion is
+  // deliberately NARROW: only /^-?\d+(\.\d+)?$/ (no hex, exponent, whitespace,
+  // Infinity/NaN). This applies ONLY to the ORDERED comparators below.
+  // EQUALITY (literal / in / not_in) stays strict — "3" still never === 3 —
+  // and length_* (further down) still measures the raw string/array length.
   if (Number.isFinite(condition.gt)) {
-    return Number.isFinite(value) && value > condition.gt;
+    const v = asOrderedNumber(value);
+    return Number.isFinite(v) && v > condition.gt;
   }
   if (Number.isFinite(condition.gte)) {
-    return Number.isFinite(value) && value >= condition.gte;
+    const v = asOrderedNumber(value);
+    return Number.isFinite(v) && v >= condition.gte;
   }
   if (Number.isFinite(condition.lt)) {
-    return Number.isFinite(value) && value < condition.lt;
+    const v = asOrderedNumber(value);
+    return Number.isFinite(v) && v < condition.lt;
   }
   if (Number.isFinite(condition.lte)) {
-    return Number.isFinite(value) && value <= condition.lte;
+    const v = asOrderedNumber(value);
+    return Number.isFinite(v) && v <= condition.lte;
   }
   // in_range: tuple [min, max] inclusive both sides. An inverted tuple
   // (min > max) fails-closed — most likely an operator typo, never a
@@ -206,7 +232,8 @@ function matchValue(value, condition) {
   if (Array.isArray(condition.in_range) && condition.in_range.length === 2) {
     const [min, max] = condition.in_range;
     if (!Number.isFinite(min) || !Number.isFinite(max) || min > max) return false;
-    return Number.isFinite(value) && value >= min && value <= max;
+    const v = asOrderedNumber(value);
+    return Number.isFinite(v) && v >= min && v <= max;
   }
   // length_* operators apply to strings or arrays. Anything else (object,
   // number, null) fails-closed — length is meaningless there.
@@ -247,11 +274,55 @@ export function matchesPolicy(event, policy, ctx = {}) {
     const value = field.startsWith('ctx.')
       ? getNested(ctx, field.slice(4))
       : getNested(event, field);
-    if (!matchValue(value, condition)) return false;
+    // v1.4.2 F-38 (P0 audit): the action_type field gets tool-family
+    // expansion so a rule keyed on the generic `tool_use` catches MCP +
+    // custom tool calls too. Every other field uses plain matchValue.
+    const matched = field === 'action_type'
+      ? matchActionType(value, condition)
+      : matchValue(value, condition);
+    if (!matched) return false;
   }
   return true;
 }
 
+// v1.4.2 F-38 (P0 audit) — action_type matching with tool-family expansion.
+//
+// Adapters emit three distinct tool-invocation action_types: `tool_use`
+// (provider built-ins), `mcp_tool_use` (MCP servers), `custom_tool_use`
+// (customer-wired tools). A policy that targets the GENERIC `tool_use` must
+// match all three — otherwise a deny/allowlist rule silently misses MCP and
+// custom tool calls (e.g. the Deep Researcher "only web_search/web_fetch,
+// deny everything else" containment rule had a hole exactly there). The OpenAI
+// adapter emits `custom_tool_use` for EVERY tool, so without this a
+// `tool_use`-keyed rule matched nothing on that runtime at all.
+//
+// Expansion is one-directional and conservative: only the generic `tool_use`
+// token expands to the family. A policy that names a SPECIFIC member
+// (`mcp_tool_use` / `custom_tool_use`) stays an exact match, so an operator
+// who deliberately wants to target one surface still can. Non-set conditions
+// on action_type (regex, numeric — unusual but legal) fall back to matchValue.
+function expandActionTypeTargets(target) {
+  return target === 'tool_use' ? TOOL_USE_FAMILY : [target];
+}
+
+function matchActionType(value, condition) {
+  if (condition === null || typeof condition !== 'object') {
+    return expandActionTypeTargets(condition).includes(value);
+  }
+  if (Array.isArray(condition)) {
+    return condition.flatMap(expandActionTypeTargets).includes(value);
+  }
+  if (condition.in !== undefined) {
+    return condition.in.flatMap(expandActionTypeTargets).includes(value);
+  }
+  if (condition.not_in !== undefined) {
+    return !condition.not_in.flatMap(expandActionTypeTargets).includes(value);
+  }
+  // regex / numeric / unknown shapes on action_type are unusual but legal —
+  // defer to the generic matcher (which fails-closed on unknown shapes).
+  return matchValue(value, condition);
+}
+
 // First-match-wins evaluation. Returns the policy decision and metadata.
 // v1.2.0 — accepts an optional `ctx` for runtime-computed attributes;
 // see matchesPolicy() above. Omitting ctx preserves v1.1.x behavior.

package/src/shield/signature.js

@@ -50,14 +50,47 @@ import { createPublicKey, verify as cryptoVerify } from 'node:crypto';
 
 const POLICY_SIGNED_FIELDS = ['rule_id', 'match', 'action', 'message', 'priority', 'mode'];
 
-// Recursive deterministic JSON: sorted keys at every depth, arrays kept in order.
+// Recursive deterministic JSON: sorted keys at every depth, arrays kept in
+// order. This MUST mirror JSON.stringify's value semantics exactly — the only
+// intentional difference is key sorting for determinism. The reason is
+// load-bearing: the bytes we hash here have to equal the bytes that land on
+// disk after JSON.stringify(record), because the verifier re-reads the disk
+// record (already JSON round-tripped) and re-canonicalizes it.
+//
+// v1.4.2 F-39 (P0 audit) — the previous version emitted the literal token
+// `undefined` for object keys / array elements whose value was `undefined`
+// (or a function / symbol). JSON.stringify DROPS such object keys and renders
+// such array elements as `null`. So a record like { tool_input: { max_uses:
+// undefined } } hashed to `{"tool_input":{"max_uses":undefined}}` at write
+// time but, after JSON.stringify dropped `max_uses` on disk, re-canonicalized
+// to `{"tool_input":{}}` at verify time — chain_hash mismatch on an UNTAMPERED
+// record. That broke the tamper-evidence guarantee (false alarms masking real
+// tampering) and corrupted the Ed25519 signing domain the same way. The fix
+// makes canonicalize JSON-faithful; for JSON-clean data it is byte-identical
+// to the old behavior, so existing valid chains keep verifying.
 export function canonicalize(value) {
-  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (value === null || typeof value !== 'object') {
+    // JSON.stringify(undefined | function | symbol) returns `undefined`
+    // (the JS value, not a string). Default those to `null` so we never
+    // concatenate the literal token `undefined` into the hashed string.
+    const enc = JSON.stringify(value);
+    return enc === undefined ? 'null' : enc;
+  }
   if (Array.isArray(value)) {
-    return '[' + value.map(canonicalize).join(',') + ']';
+    // JSON renders undefined / function / symbol array elements as null —
+    // the primitive branch above already returns 'null' for them.
+    return '[' + value.map((v) => canonicalize(v)).join(',') + ']';
   }
+  // JSON.stringify omits object keys whose value is undefined / a function /
+  // a symbol. Mirror that, or the hashed string carries a key that vanishes
+  // on disk (the F-39 break).
   const keys = Object.keys(value).sort();
-  const pairs = keys.map((k) => JSON.stringify(k) + ':' + canonicalize(value[k]));
+  const pairs = [];
+  for (const k of keys) {
+    const v = value[k];
+    if (v === undefined || typeof v === 'function' || typeof v === 'symbol') continue;
+    pairs.push(JSON.stringify(k) + ':' + canonicalize(v));
+  }
   return '{' + pairs.join(',') + '}';
 }
 

package/src/shield/sources/fortress.js

@@ -167,6 +167,18 @@ function strictModeFromEnv() {
   return true;
 }
 
+// v1.4.2 F-48 (P2 audit) — what to do when a SUCCESSFUL refresh yields zero
+// usable policies even though Fortress SENT some (i.e. every policy was
+// dropped by signature verification or compile validation). 'closed' (the
+// default, the right stance for a security control) refuses to install an
+// empty allow-everything ruleset; 'open' preserves the pre-F-48 behavior
+// (install default-allow) as an explicit opt-out.
+function failModeFromEnv() {
+  const v = process.env.WMA_SHIELD_FAIL_MODE;
+  if (v === 'open') return 'open';
+  return 'closed';                   // unset / anything else → fail-closed
+}
+
 // Parse the embedded root pubkey ONCE at module load. If the file still
 // carries the placeholder, we DO NOT throw — but every refresh logs a
 // loud reminder so an unattended deploy can't silently trust a key whose
@@ -183,7 +195,7 @@ const ROOT_PUBLIC_KEY = (() => {
 })();
 
 export class FortressPolicySource {
-  constructor({ apiKey, base, anthropicAgentId, refreshIntervalMs = 5 * 60_000, onError, onRefresh, requireSignedPolicies }) {
+  constructor({ apiKey, base, anthropicAgentId, refreshIntervalMs = 5 * 60_000, onError, onRefresh, requireSignedPolicies, failMode }) {
     if (!apiKey) throw new Error('FortressPolicySource: apiKey required');
     if (!base) throw new Error('FortressPolicySource: base URL required');
     this.apiKey = apiKey;
@@ -196,12 +208,18 @@ export class FortressPolicySource {
     this.lastFetchedAt = null;
     this._timer = null;
     this._aborted = false;
+    // v1.4.2 F-48: tracks whether this.ruleset came from a non-degraded
+    // refresh (so a later all-dropped refresh can retain last-known-good
+    // instead of wiping it) vs. is still the constructor's default-allow.
+    this._installedFromRefresh = false;
     // v1.1.5: per-instance override of the env var. Tests use this to
     // exercise both modes without touching process.env. If neither the
     // constructor option nor the env var is set, strict mode wins.
     this.requireSignedPolicies = requireSignedPolicies != null
       ? !!requireSignedPolicies
       : strictModeFromEnv();
+    // v1.4.2 F-48: 'closed' (default) | 'open'. Per-instance override for tests.
+    this.failMode = failMode != null ? failMode : failModeFromEnv();
   }
 
   /** Initial fetch — fails loud if it can't reach Fortress at startup. */
@@ -232,14 +250,20 @@ export class FortressPolicySource {
     return this._refresh();
   }
 
+  // v1.4.2 F-48: injectable fetch seam (tests override this to drive _refresh
+  // hermetically). Production hits the real Fortress endpoint.
+  async _fetchPolicies() {
+    return fetchPolicies({
+      apiKey: this.apiKey,
+      base: this.base,
+      anthropicAgentId: this.anthropicAgentId,
+    });
+  }
+
   async _refresh({ initial = false } = {}) {
     if (this._aborted) return;
     try {
-      const { policies, signing_keys, fetched_at } = await fetchPolicies({
-        apiKey: this.apiKey,
-        base: this.base,
-        anthropicAgentId: this.anthropicAgentId,
-      });
+      const { policies, signing_keys, fetched_at } = await this._fetchPolicies();
 
       // v1.1.5 Phase 1.5 — verify the chain-of-trust BEFORE any other
       // processing. We must verify on the raw JSON shape sent by Fortress,
@@ -272,11 +296,47 @@ export class FortressPolicySource {
       // priorities) keep their relative order via the stable sort
       // guarantee in V8 — predictable behavior.
       compiled.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+
+      // v1.4.2 F-48 (P2 audit): FAIL-CLOSED on a "successful" refresh that
+      // dropped EVERYTHING. If Fortress SENT policies (policies.length > 0)
+      // but none survived verification/compile (compiled.length === 0), an
+      // on-path attacker or a broken signing pipeline has effectively
+      // disarmed Shield — installing the empty { default: allow } ruleset
+      // here would silently allow every action while the daemon looks
+      // healthy. We distinguish this from a LEGITIMATELY empty response
+      // (operator cleared all policies → policies.length === 0 → install
+      // allow as intended).
+      const allDropped = policies.length > 0 && compiled.length === 0;
+      if (allDropped && this.failMode === 'closed') {
+        this.lastFetchedAt = fetched_at;
+        if (this._installedFromRefresh) {
+          // We have a last-known-good ruleset → KEEP it; do not overwrite
+          // with allow-everything. Protection continues on the prior rules.
+          this.onError(new Error(
+            `Fortress refresh: all ${policies.length} policies failed verification/compile — ` +
+            'FAIL-CLOSED, retaining last-known-good ruleset (set WMA_SHIELD_FAIL_MODE=open to override).',
+          ));
+          this.onRefresh({ policies: this.ruleset.policies, fetched_at, initial, failClosed: true });
+        } else {
+          // No prior good ruleset (e.g. initial load) → cannot fall back to
+          // allow-everything for a security control. Install deny-by-default
+          // so unmatched actions are denied rather than waved through.
+          this.ruleset = { version: 1, policies: [], default: { action: 'deny' } };
+          this.onError(new Error(
+            `Fortress refresh: all ${policies.length} policies failed verification/compile and there is no ` +
+            'prior ruleset — FAIL-CLOSED to deny-by-default (set WMA_SHIELD_FAIL_MODE=open to override).',
+          ));
+          this.onRefresh({ policies: [], fetched_at, initial, failClosed: true });
+        }
+        return;
+      }
+
       this.ruleset = {
         version: 1,
         policies: compiled,
         default: { action: 'allow' },
       };
+      this._installedFromRefresh = true;
       this.lastFetchedAt = fetched_at;
       this.onRefresh({ policies: compiled, fetched_at, initial });
     } catch (e) {

package/src/shield/upload.js

@@ -57,6 +57,12 @@ function pickInputForHash(input) {
 export function buildFortressDecisionPayload({
   agentId, sessionId, rawEvent, normalized, result, decidedInMs,
   signalsSalt, decidedAtIso,
+  // v1.4.2 F-44 (P1 audit): the real enforcement outcome (true delivered /
+  // false failed / undefined n/a). Lets the Fortress dashboard distinguish a
+  // confirmed block from one whose API call failed — i.e. surface degraded
+  // enforcement instead of trusting the computed verdict. Boolean only; no
+  // raw content, so Containment is unaffected.
+  enforcementDelivered,
 }) {
   // F-19: vendor built-ins survive even without a salt (allowlist short-circuit);
   // custom tool names throw without a salt — we catch and drop the field.
@@ -85,5 +91,7 @@ export function buildFortressDecisionPayload({
     // v1.1.3 Phase 1.D: mode threading so Fortress can store and surface
     // shadow-vs-enforce in the Reports timeline.
     mode: result.mode || undefined,
+    // v1.4.2 F-44: real enforcement outcome (omitted when not applicable).
+    enforcement_delivered: enforcementDelivered === undefined ? undefined : enforcementDelivered,
   };
 }

package/src/sources/anthropic-managed.js

@@ -22,6 +22,7 @@ import {
   getAgentConfig, detectAlwaysAsk,
   confirmAllow, confirmDeny, interruptSession,
 } from '../shield/enforce.js';
+import { safeNonNegInt } from '../tokens.js';
 
 const API_HOST = 'api.anthropic.com';
 const BETA = 'managed-agents-2026-04-01';
@@ -120,25 +121,48 @@ export async function listAgents(apiKey, { limit = 100 } = {}) {
   return agents;
 }
 
-export async function listSessions(apiKey, { agentId, since, limit = 100 } = {}) {
+// v1.4.2 F-45 (P1 audit): page through the FULL session list and filter by
+// `since` per-row — do NOT early-break. The previous version stopped
+// paginating at the first session older than `since`, assuming the API
+// returns sessions newest-first by created_at. Nothing enforces that ordering
+// (no `order=` param is sent), and the doc never promised it. If the API
+// ordered by id / updated_at, a single out-of-window session aborted
+// pagination while newer in-window sessions sat on later pages — they were
+// NEVER enumerated, so that agent's activity went untraced (a security blind
+// spot, the exact failure this tool exists to prevent). We now scan every
+// page; a session older than `since` is skipped, not a stop signal. A null
+// created_at is treated as in-window (we cannot prove it is old). `maxPages`
+// is a pathological-loop backstop; hitting it warns loudly rather than
+// silently truncating.
+export async function listSessions(apiKey, { agentId, since, limit = 100, maxPages = 1000, _fetch } = {}) {
+  // _fetch is an injectable page-fetcher seam for tests (path -> response
+  // object with { data, has_more }). Production uses the real getWithRetry.
+  const fetchPage = _fetch || ((path) => getWithRetry(apiKey, path));
   const sessions = [];
   let after = null;
-  while (true) {
+  let pages = 0;
+  while (pages < maxPages) {
+    pages++;
     const qs = new URLSearchParams({ limit: String(limit) });
     if (agentId) qs.set('agent_id', agentId);
     if (after) qs.set('after_id', after);
-    const data = await getWithRetry(apiKey, `/v1/sessions?${qs}`);
+    const data = await fetchPage(`/v1/sessions?${qs}`);
     const page = data.data || [];
-    let stop = false;
     for (const s of page) {
       const created = s.created_at ? new Date(s.created_at) : null;
-      if (since && created && created < since) { stop = true; break; }
+      if (since && created && created < since) continue;   // skip, do NOT stop
       sessions.push(s);
     }
-    if (stop || !data.has_more || page.length === 0) break;
+    if (!data.has_more || page.length === 0) break;
     after = page[page.length - 1]?.id;
     if (!after) break;
   }
+  if (pages >= maxPages) {
+    process.stderr.write(
+      `[wma] listSessions: hit maxPages=${maxPages} for agent ${agentId || '(all)'} — ` +
+      'session enumeration may be INCOMPLETE. Raise maxPages or narrow the agent set.\n',
+    );
+  }
   return sessions;
 }
 
@@ -211,6 +235,16 @@ export async function* transformRawEventsToWMAActions(rawEventsAsyncIterable, {
   // Pair-tracking maps: event_id of the "start" → its timestamp + metadata
   const pendingModelReq = new Map();    // span.model_request_start.id → ts
   const pendingToolUse = new Map();     // agent.tool_use.id → { ts, name, isMcp, input }
+  // v1.4.2 F-50 (P2 audit): pair custom tools like provider/MCP tools so the
+  // single yielded row carries the REAL status/error/duration. Pre-F-50
+  // agent.custom_tool_use was emitted immediately with a hardcoded status:'ok'
+  // and its outcome arrived on a SEPARATE custom_tool_result row with
+  // tool_name:null — so a failing custom tool never entered error_rate_by_tool
+  // (the aggregator skips null-named rows) and duration was always null. The
+  // customer-controlled tool surface — the highest-risk one — was the only
+  // family with no error/latency signal. Pairing fixes that with no aggregator
+  // special-case (custom_tool_use is already in TOOL_ACTIONS).
+  const pendingCustomTool = new Map();  // agent.custom_tool_use.id → { ts, name, input, startTimestamp, meta }
 
   // v1.1.3 Phase 1.C — Anthropic sub-agent detection.
   // Anthropic Task tool: when a parent agent delegates, a NEW thread is
@@ -279,10 +313,13 @@ export async function* transformRawEventsToWMAActions(rawEventsAsyncIterable, {
       const startTs = pendingModelReq.get(ev.model_request_start_id);
       pendingModelReq.delete(ev.model_request_start_id);
       const u = ev.model_usage || {};
-      const i = u.input_tokens || 0;
-      const o = u.output_tokens || 0;
-      const cr = u.cache_read_input_tokens || 0;
-      const cw = u.cache_creation_input_tokens || 0;
+      // v1.4.2 F-49 (P2 audit): sanitize to non-negative integers. A
+      // malformed/adversarial model_usage (NaN, negative, string) must not
+      // zero-out or poison the token totals that drive cost/abuse detection.
+      const i = safeNonNegInt(u.input_tokens);
+      const o = safeNonNegInt(u.output_tokens);
+      const cr = safeNonNegInt(u.cache_read_input_tokens);
+      const cw = safeNonNegInt(u.cache_creation_input_tokens);
       yield {
         ...base,
         ...subAgentMeta,
@@ -351,16 +388,36 @@ export async function* transformRawEventsToWMAActions(rawEventsAsyncIterable, {
     }
 
     if (type === 'user.custom_tool_result') {
+      // v1.4.2 F-50: pair with the stored start and emit ONE completed
+      // custom_tool_use row carrying the real status/error/duration + the
+      // tool_name from the start (so a failing custom tool now lands in
+      // error_rate_by_tool). Mirrors the agent.tool_result handler. An
+      // orphan result (no matching start — out-of-order / restart) still
+      // emits, with tool_name null and input from the result only, so we
+      // never drop an action.
+      const cStart = pendingCustomTool.get(ev.custom_tool_use_id);
+      pendingCustomTool.delete(ev.custom_tool_use_id);
+      const isError = ev.is_error === true;
+      const cMeta = cStart ? {
+        session_thread_id: cStart.session_thread_id ?? subAgentMeta.session_thread_id,
+        agent_name: cStart.agent_name ?? subAgentMeta.agent_name,
+        composition_pattern: (cStart.session_thread_id != null && subThreadIds.has(cStart.session_thread_id))
+          ? COMPOSITION_PATTERNS.HIERARCHY
+          : COMPOSITION_PATTERNS.SOLO,
+        parent_agent_id: null,
+      } : subAgentMeta;
       yield {
         ...base,
-        ...subAgentMeta,
+        ...cMeta,
         id: ev.id,
-        action_type: 'custom_tool_result',
-        tool_name: null,
+        action_type: 'custom_tool_use',
+        tool_name: cStart?.name ?? null,
         model: model || null,
         timestamp: ts,
-        status: ev.is_error ? 'error' : 'ok',
-        input: { custom_tool_use_id: ev.custom_tool_use_id },
+        duration_ms: (cStart?.ts && tsMillis) ? tsMillis - cStart.ts : null,
+        status: isError ? 'error' : 'ok',
+        error: isError ? extractText(ev.content).slice(0, 500) : null,
+        input: cStart?.input ?? { custom_tool_use_id: ev.custom_tool_use_id },
         output: { content: ev.content ?? null },
       };
       continue;
@@ -399,7 +456,16 @@ export async function* transformRawEventsToWMAActions(rawEventsAsyncIterable, {
     if (type === 'agent.tool_use' || type === 'agent.mcp_tool_use') {
       pendingToolUse.set(ev.id, {
         ts: tsMillis,
-        name: ev.name || 'unknown',
+        // v1.4.2 F-41 (P1 audit): a missing tool name becomes null, NOT the
+        // literal string 'unknown'. A 'unknown' fallback (a) let a tool_name
+        // DENYLIST silently miss a real tool whose name field was absent
+        // (the rule keys on e.g. "bash"; "unknown" !== "bash" → no match →
+        // default-allow), and (b) collided two distinct unnamed tools into
+        // one forensic bucket. null fails every specific tool_name clause
+        // closed and is honestly absent. tool_name is `string|null` per the
+        // WMAAction contract; normalizeToolName(null) returns null and the
+        // aggregator skips null-named entries from per-tool counts.
+        name: ev.name ?? null,
         isMcp: type === 'agent.mcp_tool_use',
         input: ev.input ?? null,
         mcpServer: ev.server_name ?? ev.mcp_server_name ?? null,
@@ -435,7 +501,7 @@ export async function* transformRawEventsToWMAActions(rawEventsAsyncIterable, {
         ...pairedMeta,
         id: ev.id,
         action_type: start?.isMcp ? 'mcp_tool_use' : 'tool_use',
-        tool_name: start?.name || 'unknown',
+        tool_name: start?.name ?? null,   // F-41: null, never literal 'unknown'
         timestamp: ts,
         duration_ms: (start?.ts && tsMillis) ? tsMillis - start.ts : null,
         status: isError ? 'error' : 'ok',
@@ -447,16 +513,15 @@ export async function* transformRawEventsToWMAActions(rawEventsAsyncIterable, {
     }
 
     if (type === 'agent.custom_tool_use') {
-      yield {
-        ...base,
-        ...subAgentMeta,
-        id: ev.id,
-        action_type: 'custom_tool_use',
-        tool_name: ev.name || 'unknown',
-        timestamp: ts,
-        status: 'ok',
+      // v1.4.2 F-50: store the start; the paired custom_tool_result (or the
+      // end-of-session flush) emits the single completed row with real status.
+      pendingCustomTool.set(ev.id, {
+        ts: tsMillis,
+        name: ev.name ?? null,        // F-41: null, never literal 'unknown'
         input: ev.input ?? null,
-      };
+        startTimestamp: ts,
+        session_thread_id, agent_name,
+      });
       continue;
     }
 
@@ -619,6 +684,28 @@ export async function* transformRawEventsToWMAActions(rawEventsAsyncIterable, {
     };
   }
   pendingToolUse.clear();
+
+  // v1.4.2 F-50: same flush for custom tools that started but never returned
+  // a result (Shield-blocked, denied, died mid-flight, session cut). Emitted
+  // as custom_tool_use / status=error / no_result_observed — the high-value
+  // "started but didn't complete" signal, now also covered for custom tools.
+  for (const [useId, pending] of pendingCustomTool) {
+    yield {
+      ...base,
+      session_thread_id: pending.session_thread_id,
+      agent_name: pending.agent_name,
+      id: useId,
+      action_type: 'custom_tool_use',
+      tool_name: pending.name,
+      model: model || null,
+      timestamp: pending.startTimestamp,
+      duration_ms: null,
+      status: 'error',
+      error: 'no_result_observed',
+      input: pending.input,
+    };
+  }
+  pendingCustomTool.clear();
 }
 
 // ────────────────────────────────────────────────────────────────────────

package/src/sources/contract.js

@@ -101,6 +101,23 @@ export const ACTION_TYPES = Object.freeze({
   STATE_TRANSITION: 'state_transition',
 });
 
+// v1.4.2 F-38 (P0 audit) — the three tool-INVOCATION action_types form one
+// security-equivalent family. WHICH surface a tool call came through
+// (provider built-in vs MCP server vs customer-wired custom tool) is an
+// adapter implementation detail, not a security distinction: all three are
+// "the agent invoked a tool." A deny/allowlist policy keyed on the generic
+// `tool_use` MUST catch all three, or it silently misses MCP + custom tool
+// calls — exactly where an attacker pivots. The policy matcher
+// (src/shield/policy.js) expands a generic `tool_use` target to this family;
+// matching a SPECIFIC member (mcp_tool_use / custom_tool_use) stays exact so
+// an operator can still target one surface when they mean to.
+// SignalsAggregator (src/anonymizer.js) uses the same set for IoC capture.
+export const TOOL_USE_FAMILY = Object.freeze([
+  ACTION_TYPES.TOOL_USE,
+  ACTION_TYPES.MCP_TOOL_USE,
+  ACTION_TYPES.CUSTOM_TOOL_USE,
+]);
+
 export const STATUS_VALUES = Object.freeze({
   OK: 'ok',
   ERROR: 'error',

package/src/sources/openai-agents-js.js

@@ -549,10 +549,26 @@ export function wmaToolInputGuardrail(options = {}) {
       try {
         const rs = await ensureRuleset();
 
+        // v1.4.2 F-42 (P1 audit): read the tool name DEFENSIVELY across the
+        // shapes @openai/agents may use for the guardrail's toolCall object.
+        // The adapter already knows the id lives under a non-obvious key
+        // (makeEventId reads callId||id), so the name may likewise sit under
+        // .name, .toolName, or .function.name depending on SDK version/tool
+        // kind. If we only read .name and the SDK puts it elsewhere, tool_name
+        // is null and EVERY tool_name-keyed deny rule silently misses — a
+        // total enforcement bypass. Coalesce all known shapes; null only if
+        // none are present (then tool_name-keyed rules correctly no-match,
+        // and the operator can still deny on action_type alone).
+        const toolName = toolCall?.name
+          ?? toolCall?.toolName
+          ?? toolCall?.function?.name
+          ?? data?.tool?.name
+          ?? null;
+
         // 1. Normalize the about-to-fire tool_use event.
         const event = normalizeToolStart({
           agent,
-          tool: { name: toolCall?.name },
+          tool: { name: toolName },
           toolCall,
           sessionId,
           teamId: getTeamId(),

package/src/tokens.js

@@ -4,14 +4,26 @@
 // token counts (split + by-model) are tracked.
 export const DEFAULT_PRICING = {};
 
+// v1.4.2 F-49 (P2 audit): coerce a token/usage value to a safe non-negative
+// integer. The old `x || 0` is a FALSY guard, not a numeric one — it lets
+// negatives through (`-5 || 0` === -5) and a NaN propagates through later
+// arithmetic to poison totals (`NaN + n` → NaN → `|| null` → null), silently
+// ZEROING a real LLM call's tokens. A malformed or adversarial usage payload
+// could thus under-report the security-relevant consumption signal (a runaway
+// / abused agent) or drive aggregate token/cost negative. Anything not a
+// finite non-negative number becomes 0.
+export function safeNonNegInt(x) {
+  return Number.isFinite(x) && x >= 0 ? Math.trunc(x) : 0;
+}
+
 export function estimateCost(model, t, pricing) {
   if (!model) return null;
   const p = (pricing && pricing[model]) || DEFAULT_PRICING[model];
   if (!p) return null;
-  const inT = t.input_tokens || 0;
-  const outT = t.output_tokens || 0;
-  const cr = t.cache_read_tokens || 0;
-  const cw = t.cache_creation_tokens || 0;
+  const inT = safeNonNegInt(t.input_tokens);
+  const outT = safeNonNegInt(t.output_tokens);
+  const cr = safeNonNegInt(t.cache_read_tokens);
+  const cw = safeNonNegInt(t.cache_creation_tokens);
   const cost = ((inT * (p.input || 0)) + (outT * (p.output || 0)) +
                 (cr * (p.cache_read || 0)) + (cw * (p.cache_write || 0))) / 1_000_000;
   return Math.round(cost * 1_000_000) / 1_000_000;
@@ -38,13 +50,16 @@ export class TokenTracker {
     if (entry.action_type === 'session_end') return;
 
     const t = {
-      input: entry.input_tokens || 0,
-      output: entry.output_tokens || 0,
-      cache_read: entry.cache_read_tokens || 0,
-      cache_creation: entry.cache_creation_tokens || 0,
+      input: safeNonNegInt(entry.input_tokens),
+      output: safeNonNegInt(entry.output_tokens),
+      cache_read: safeNonNegInt(entry.cache_read_tokens),
+      cache_creation: safeNonNegInt(entry.cache_creation_tokens),
     };
-    const sum = entry.tokens_used || (t.input + t.output + t.cache_read + t.cache_creation);
-    const cost = entry.cost_usd || 0;
+    // F-49: a provided tokens_used is sanitized too; 0/missing falls back to
+    // the (sanitized) component sum.
+    const provided = safeNonNegInt(entry.tokens_used);
+    const sum = provided || (t.input + t.output + t.cache_read + t.cache_creation);
+    const cost = Number.isFinite(entry.cost_usd) && entry.cost_usd >= 0 ? entry.cost_usd : 0;
 
     this.total.input += t.input;
     this.total.output += t.output;