watchmyagents 1.4.1 → 1.4.4

package/README.md

@@ -5,8 +5,12 @@
 Designed around four guarantees:
 
 1. **Local-first.** Raw payloads (prompts, outputs, tool arguments) stay 100% on your machine. Nothing leaves unless you explicitly opt in.
-2. **Trace everything, not just what costs tokens.** A `web_fetch` to a suspicious URL carries zero tokens but is exactly what a security audit needs to see. Even tool calls that were blocked, denied, or interrupted before producing a result are logged with `status: error` so the audit trail is complete.
-3. **Real-time enforcement, not post-hoc auditing.** A policy accepted in Fortress UI is active in Shield within ~1 second via SSE + Postgres realtime. A policy violation is blocked in ~3ms via Anthropic's `user.tool_confirmation` / `user.interrupt` events. Measured in production, not promised in roadmap.
+2. **Trace everything, not just what costs tokens.** A `web_fetch` to a suspicious URL carries zero tokens but is exactly what a security audit needs to see. Tool calls that Shield denied — and sessions it interrupted — are logged with their `status` so the audit trail is complete.
+3. **Real-time enforcement.** A policy accepted in Fortress UI is active in Shield within ~1 second via SSE + Postgres realtime. Shield renders an allow/deny **decision in ~3ms** (local evaluation, measured in production). How that decision is *applied* depends on the agent's configuration, and the distinction matters:
+   - **`tool_confirmation` mode** — when the agent has a tool with `permission_policy: always_ask`, Anthropic pauses the agent and Shield **blocks the tool *before* it executes** (`user.tool_confirmation`). True prevention.
+   - **`interrupt` mode** (zero-config default) — Shield observes the tool-use event *after* Anthropic's cloud has already run the tool, then **terminates the session** (`user.interrupt`). This is **detect-and-terminate, not prevention**: the offending call has already executed; the interrupt stops *subsequent* steps. A single-shot action (one exfil `web_fetch`, one `rm -rf`) is not prevented in this mode.
+
+   See [Shield — real-time policy enforcement](#shield--real-time-policy-enforcement) for how to configure pre-execution blocking.
 4. **Zero dependencies.** Only Node.js 18+ built-ins. No telemetry, no phone-home, no hidden network calls. Preserved through every release including the SSE realtime work (custom RFC-compliant SSE parser, no `@supabase/realtime-js` or `ws` dep).
 
 ### Measured end-to-end loop latency (v1.1.0+)
@@ -17,9 +21,11 @@ Watch capture        ────────► Fortress signal upload   : ≤
 Fortress signal      ────────► Guardian analysis        : ≤ 30s     (event-triggered, debounced)
 Guardian proposal    ────────► Operator accepts in UI   : (human)
 Policy accepted      ────────► Shield receives via SSE  : ≤ 1s      (sub-second push, validated)
-Shield evaluates     ────────► Decision (allow/deny)    : ≤ 3ms     (measured on Anthropic Managed)
+Shield evaluates     ────────► Decision (allow/deny)    : ≤ 3ms     (decision latency, not time-to-block)
 ```
 
+> The ≤ 3ms is Shield's local *decision* latency. Time-to-**block** depends on the enforcement mode: `tool_confirmation` blocks before execution; `interrupt` (default) terminates the session *after* the violating tool ran. See guarantee #3 above and the Shield section.
+
 Full audit-clean: 3 successful Codex audit passes (v1.0.1, v1.0.2, v1.0.3) closed 7 findings with zero regression. Containment invariant (raw payloads never leave the customer machine) is formalized in `docs/CONTAINMENT.md` and locked by 8 regression tests.
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmyagents",
-  "version": "1.4.1",
+  "version": "1.4.4",
   "description": "Security observability + real-time policy enforcement for AI agents. Local-first NDJSON capture with a continuous Watch daemon that auto-uploads anonymized signals, Shield CLI that blocks policy violations live (with policies pulled from Fortress cloud), anonymizer producing signals-only payloads, bidirectional sync with WatchMyAgents Fortress, and one-command install as an always-on launchd/systemd service — closing the recursive Watch→Guardian→Shield security loop.",
   "type": "module",
   "files": [

package/scripts/fetch-anthropic.js

@@ -38,6 +38,7 @@ import {
   AnthropicManagedSource, effectiveEnforcementMode,
 } from '../src/sources/anthropic-managed.js';
 import { maybePrintVersionAndExit } from '../src/version.js';
+import { SeenTracker } from '../src/watch-state.js';
 
 function parseArgs(argv) {
   const out = {};
@@ -380,12 +381,27 @@ async function fetchOneShot({ apiKey, agentId, model, logDir, since, sessionId,
 // Fortress display_name (opt-in); default sends the agent id only (Containment).
 async function runWatch({ apiKey, resolveAgents, fleet, logDir, intervalMs, windowMs, uploadCtx, sendNames }) {
   let agents = await resolveAgents();
-  const seenIds = new Set();     // stable Anthropic event ids already captured
-  for (const ag of agents) {
-    for (const id of await preloadSeenIds(logDir, ag.agentId)) seenIds.add(id);
+  // v1.4.3 F-51: bounded dedup. Preloaded on-disk ids are static; runtime ids
+  // are tracked per-session and dropped on terminate (see src/watch-state.js).
+  const seen = new SeenTracker();
+  // v1.4.4 F-53: preload each agent's on-disk history the FIRST time we see it
+  // — including agents that --all-agents discovers after startup. Pre-fix the
+  // preload ran once for the initial fleet only, so a late-appearing agent with
+  // existing logs re-appended + re-uploaded already-captured events.
+  const preloadedAgents = new Set();
+  async function ensurePreloaded(agentId) {
+    if (preloadedAgents.has(agentId)) return;
+    preloadedAgents.add(agentId);
+    for (const id of await preloadSeenIds(logDir, agentId)) seen.addPreloaded(id);
   }
+  for (const ag of agents) await ensurePreloaded(ag.agentId);
   const loggers = new Map();     // sessionId → Logger (session ids are globally unique)
-  const ended = new Set();       // terminated sessions (skip)
+  // terminated sessions (skip). v1.4.4 F-54: a Map<sid → terminatedAtMs> so we
+  // can TTL-prune. A session terminated more than windowMs ago has created_at
+  // older still, so listSessions (which filters created_at < since, since =
+  // now - windowMs) can no longer return it — its id is then safe to forget,
+  // bounding this map's growth on a long daemon with many short sessions.
+  const ended = new Map();
   const sessionAgent = new Map();// sessionId → { agentId, model, displayName }
   const priors = new Map();      // agentId → previous classification (threads the
                                   // typology state machine across upload cycles)
@@ -399,15 +415,26 @@ async function runWatch({ apiKey, resolveAgents, fleet, logDir, intervalMs, wind
   process.on('SIGINT', shutdown);
   process.on('SIGTERM', shutdown);
 
-  info(`watch mode — ${agents.length} agent(s)${fleet ? ' (fleet, re-discovered each cycle)' : ''}, interval ${Math.round(intervalMs / 1000)}s, discovery window ${Math.round(windowMs / 3600000)}h, upload ${uploadCtx ? 'ON' : 'OFF'}, ${seenIds.size} known events preloaded`);
+  info(`watch mode — ${agents.length} agent(s)${fleet ? ' (fleet, re-discovered each cycle)' : ''}, interval ${Math.round(intervalMs / 1000)}s, discovery window ${Math.round(windowMs / 3600000)}h, upload ${uploadCtx ? 'ON' : 'OFF'}, ${seen.size} known events preloaded`);
 
   while (!ac.signal.aborted) {
     if (fleet) { const next = await resolveAgents(); if (next.length) agents = next; }
     const since = new Date(Date.now() - windowMs);
 
+    // F-54: forget sessions terminated longer ago than the discovery window —
+    // listSessions can no longer surface them (created_at < since), so their
+    // skip-marker is no longer needed. Bounds `ended` on a long-running daemon.
+    const ttlCutoff = Date.now() - windowMs;
+    for (const [sid, terminatedAt] of ended) {
+      if (terminatedAt < ttlCutoff) ended.delete(sid);
+    }
+
     // (1) Discover sessions in the window; register the owning agent for each.
     for (const ag of agents) {
       if (ac.signal.aborted) break;
+      // F-53: a late-discovered agent (fleet mode) gets its disk history
+      // preloaded before we fetch any of its sessions, so dedup holds.
+      await ensurePreloaded(ag.agentId);
       const tag = fleet ? `[${ag.displayName}] ` : '';
       let sessions = [];
       try { sessions = await listSessions(apiKey, { agentId: ag.agentId, since }); }
@@ -427,6 +454,14 @@ async function runWatch({ apiKey, resolveAgents, fleet, logDir, intervalMs, wind
       if (ac.signal.aborted) break;
       if (ended.has(sid)) continue;
       const tag = fleet ? `[${ag.displayName}] ` : '';
+      // v1.4.3 F-51: top-level guard around the WHOLE per-session body. Pre-fix
+      // only the fetch + upload had try/catch; an unguarded throw elsewhere
+      // (e.g. ENOSPC/EACCES on the fail-loud session_end logger.write, or a
+      // malformed entry in TokenTracker) propagated out of the loop and
+      // KILLED the daemon — silent total collection-stop on a backgrounded
+      // process. Now any single session's failure drops that session for the
+      // cycle and the daemon survives.
+      try {
       let logger = loggers.get(sid);
       if (!logger) { logger = new Logger({ logDir, agentId: ag.agentId, sessionId: sid, silent: true }); loggers.set(sid, logger); }
 
@@ -434,8 +469,8 @@ async function runWatch({ apiKey, resolveAgents, fleet, logDir, intervalMs, wind
       let sawTerminated = false;
       try {
         for await (const entry of fetchSessionEntries({ apiKey, agentId: ag.agentId, sessionId: sid, model: ag.model })) {
-          if (entry.id && seenIds.has(entry.id)) continue;
-          if (entry.id) seenIds.add(entry.id);
+          if (entry.id && seen.has(sid, entry.id)) continue;
+          if (entry.id) seen.add(sid, entry.id);
           const written = await logger.write(entry);
           fresh.push(written);
           if (entry.action_type === 'state_transition'
@@ -491,10 +526,20 @@ async function runWatch({ apiKey, resolveAgents, fleet, logDir, intervalMs, wind
           session_tokens: { input: stats.input, output: stats.output, cache_read: stats.cache_read, cache_creation: stats.cache_creation, total: stats.sum },
           session_cost_usd: stats.cost_usd || null,
         });
-        ended.add(sid);
-        sessionAgent.delete(sid);   // bound memory: terminated sessions aren't re-fetched
+        ended.set(sid, Date.now());
+        // v1.4.3 F-51: bound memory — terminated sessions aren't re-fetched,
+        // so drop their per-session dedup set AND their Logger object (the
+        // latter was never deleted pre-fix → unbounded growth of Logger
+        // instances over a long daemon run).
+        sessionAgent.delete(sid);
+        seen.forgetSession(sid);
+        loggers.delete(sid);
         info(`${tag}session ${sid.slice(0, 16)}… terminated — closed`);
       }
+      } catch (e) {
+        // F-51 top-level guard: never let one session's failure kill the loop.
+        warn(`${tag}session ${sid.slice(0, 16)}…: cycle error (skipped): ${e.message}`);
+      }
     }
 
     if (cycleNew === 0) info('cycle: no new events');
@@ -567,7 +612,25 @@ async function main() {
     const intervalMs = parseDurationMs(args.interval, 60_000);
     // Discovery window for NEW sessions (default 7d, configurable). Sessions we
     // already track are re-fetched regardless of age, so long-lived ones don't drop.
-    const windowMs = parseDurationMs(args['discovery-since'], 7 * 24 * 3600_000);
+    let windowMs = parseDurationMs(args['discovery-since'], 7 * 24 * 3600_000);
+    // v1.4.2 F-46 (P1 audit): the discovery window must comfortably exceed the
+    // poll interval. Discovery runs once per cycle; a session that is created
+    // AND ends/ages-out between two sweeps is never added to the tracked set,
+    // so its events are never fetched (untraced activity). Requiring
+    // windowMs >= 2*intervalMs guarantees every session appears in at least
+    // two consecutive discovery sweeps before it can leave the window. The 7d
+    // default is far above this; the guard only bites when an operator sets
+    // --discovery-since too tight relative to --interval. Clamp + warn rather
+    // than silently honoring a value that opens a per-cycle blind window.
+    const minWindowMs = intervalMs * 2;
+    if (windowMs < minWindowMs) {
+      process.stderr.write(
+        `[wma] --discovery-since (${Math.round(windowMs / 1000)}s) is below 2x --interval ` +
+        `(${Math.round(intervalMs / 1000)}s) — a short-lived session could be missed between ` +
+        `sweeps. Clamping discovery window up to ${Math.round(minWindowMs / 1000)}s.\n`,
+      );
+      windowMs = minWindowMs;
+    }
     // display_name on the Fortress payload: defaults to the human agent name
     // (UX-friendly — operators identify agents by name in the dashboard). The
     // name is sanitized via cleanLabel() so log/payload injection is impossible.

package/scripts/shield.js

@@ -146,16 +146,42 @@ async function runSessionWorker({ sessionId, ctx }) {
   // isolation. The helper drops any field it cannot safely normalize
   // (custom tool without salt, missing salt for hashes) rather than
   // passing the raw value through.
-  const fireToFortress = (rawEvent, normalized, result, decidedInMs) => {
+  const fireToFortress = (rawEvent, normalized, result, decidedInMs, enforcementDelivered) => {
     if (!pushDecisionToFortress) return;
     const payload = buildFortressDecisionPayload({
       agentId, sessionId, rawEvent, normalized, result, decidedInMs,
-      signalsSalt,
+      signalsSalt, enforcementDelivered,
     });
     pushDecisionToFortress(payload).catch(() => undefined);
   };
 
-  let processed = 0, enforced = 0, sessionInterrupted = false;
+  // v1.4.2 F-44 (P1 audit): enforcement API calls (confirmDeny / interrupt)
+  // could fail (15s timeout, 5xx, network drop) and the old code just logged
+  // and continued — the violating session kept running with no retry, while
+  // the decision row still claimed "enforced". Retry the call (these are
+  // idempotent: a duplicate deny/interrupt on the same tool_use/session is
+  // safe), and return whether it was ultimately delivered so the caller can
+  // record the REAL outcome and surface a loud failure. Backoff is short and
+  // bounded — the tool already ran in interrupt mode, so landing the session
+  // termination quickly matters more than long waits.
+  const enforceWithRetry = async (thunk, { label, attempts = 3 } = {}) => {
+    let lastErr;
+    for (let i = 0; i < attempts; i++) {
+      try {
+        await thunk();
+        return true;
+      } catch (e) {
+        lastErr = e;
+        if (i < attempts - 1) await sleep(250 * (i + 1));
+      }
+    }
+    process.stderr.write(
+      `[shield/${sessionId.slice(0, 12)}] ${label} FAILED after ${attempts} attempts: ${lastErr?.message}\n`,
+    );
+    return false;
+  };
+
+  let processed = 0, enforced = 0, enforcementFailed = 0, sessionInterrupted = false;
 
   // v1.2.0 — per-session context tracker. Feeds runtime attributes
   // (hour_of_day_utc, agent_age_minutes, recent_error_rate, …) into the
@@ -237,36 +263,43 @@ async function runSessionWorker({ sessionId, ctx }) {
         const modeTag = result.mode === 'shadow' ? ' [SHADOW]' : '';
         sinfo(sessionId, `${rawEvent.type} tool=${normalized.tool_name} → ${result.decision}${modeTag}${result.rule_id ? ` (${result.rule_id})` : ''}`);
 
-        await decisions(sessionId).record({
-          sourceEvent: rawEvent, decision: result.decision,
-          ruleId: result.rule_id, ruleName: result.rule_name,
-          message: result.message, decidedInMs,
-          mode: result.mode,
-        });
-        fireToFortress(rawEvent, normalized, result, decidedInMs);
-
-        // v1.1.3 Phase 1.D — in shadow mode, the decision is COMPUTED + LOGGED
-        // but NOT enforced. The rule's "would_deny" / "would_interrupt"
-        // outcome flows to Fortress for Platt-scaling calibration + diff-in-diff
-        // efficacy measurement (Guardian Core hardening axes 1 + 4), but the
-        // agent's session continues uninterrupted. Promote to enforce only
-        // after calibration confidence + lifecycle gates (Guardian Core spec
-        // observe → shadow → enforce → retired).
-        if (result.mode === 'shadow') continue;
-
-        if ((result.decision === 'deny' || result.decision === 'interrupt') && !sessionInterrupted) {
-          try {
-            await interruptSession({
+        // v1.4.2 F-44 (P1 audit): ENFORCE FIRST, then record the REAL outcome.
+        // Pre-F-44 the decision was recorded as "enforced" before (and
+        // regardless of) the interrupt call, and a failed interrupt was
+        // swallowed with the session left running. Now: shadow + non-blocking
+        // decisions don't enforce (enforcementDelivered stays undefined);
+        // deny/interrupt attempts the interrupt with bounded retry and the
+        // recorded row + Fortress payload carry whether it actually landed.
+        const willEnforce = result.mode !== 'shadow'
+          && (result.decision === 'deny' || result.decision === 'interrupt')
+          && !sessionInterrupted;
+
+        let enforcementDelivered;   // undefined unless we attempt enforcement
+        if (willEnforce) {
+          enforcementDelivered = await enforceWithRetry(
+            () => interruptSession({
               apiKey, sessionId,
               followUpMessage: `Shield interrupted: ${result.message || result.rule_name || 'policy violation'}`,
-            });
+            }),
+            { label: 'interrupt' },
+          );
+          if (enforcementDelivered) {
             sessionInterrupted = true;
             enforced++;
             swarn(sessionId, 'session interrupted — agent loop stopped');
-          } catch (e) {
-            process.stderr.write(`[shield/${sessionId.slice(0, 12)}] interrupt error: ${e.message}\n`);
+          } else {
+            enforcementFailed++;
+            swarn(sessionId, `ENFORCEMENT FAILED — session NOT interrupted; violating action was NOT blocked (${result.rule_id || 'policy'})`);
           }
         }
+
+        await decisions(sessionId).record({
+          sourceEvent: rawEvent, decision: result.decision,
+          ruleId: result.rule_id, ruleName: result.rule_name,
+          message: result.message, decidedInMs,
+          mode: result.mode, enforcementDelivered,
+        });
+        fireToFortress(rawEvent, normalized, result, decidedInMs, enforcementDelivered);
         continue;
       }
 
@@ -286,13 +319,18 @@ async function runSessionWorker({ sessionId, ctx }) {
           const sourceEvent = cached?.event;
           if (!sourceEvent) {
             swarn(sessionId, `requires_action for unknown event_id ${eventId} — denying defensively`);
-            try {
-              await confirmDeny({
+            // F-44: retry + loud. If the defensive deny doesn't land, the
+            // agent may proceed or hang — either way the operator must know.
+            const delivered = await enforceWithRetry(
+              () => confirmDeny({
                 apiKey, sessionId, toolUseId: eventId,
                 denyMessage: 'Shield never saw the original tool_use. Denying defensively.',
-              });
-            } catch (e) {
-              process.stderr.write(`[shield/${sessionId.slice(0, 12)}] enforcement error: ${e.message}\n`);
+              }),
+              { label: 'confirmDeny(unknown)' },
+            );
+            if (!delivered) {
+              enforcementFailed++;
+              swarn(sessionId, `ENFORCEMENT FAILED — defensive deny NOT delivered for event ${eventId}`);
             }
             continue;
           }
@@ -312,54 +350,75 @@ async function runSessionWorker({ sessionId, ctx }) {
           const modeTag = result.mode === 'shadow' ? ' [SHADOW]' : '';
           sinfo(sessionId, `requires_action ${sourceEvent.type} tool=${normalized.tool_name} → ${result.decision}${modeTag}${result.rule_id ? ` (${result.rule_id})` : ''}`);
 
-          await decisions(sessionId).record({
-            sourceEvent, decision: result.decision,
-            ruleId: result.rule_id, ruleName: result.rule_name,
-            message: result.message, decidedInMs,
-            mode: result.mode,
-          });
-          fireToFortress(sourceEvent, normalized, result, decidedInMs);
-
           // v1.1.3 Phase 1.D — shadow mode in tool_confirmation: we MUST
           // still send confirmAllow even when the rule said deny/interrupt,
           // otherwise the agent hangs waiting for our response. The
           // decision is logged with mode=shadow so calibration can compare
           // what the rule said vs what was enforced (which is "nothing"
-          // here). For mode=enforce, the original branching below stands.
+          // here). For mode=enforce, the branching below stands.
+          //
+          // v1.4.2 F-44 — ENFORCE FIRST, then record the REAL outcome (see
+          // the interrupt-mode block above for the rationale). Retry + loud
+          // on failure so a swallowed confirm/deny/interrupt can no longer
+          // leave the audit row claiming a block that never happened.
           if (result.mode === 'shadow') {
-            try {
-              await confirmAllow({ apiKey, sessionId, toolUseId: eventId });
-              // No enforced++ — shadow doesn't enforce by definition.
-            } catch (e) {
-              process.stderr.write(`[shield/${sessionId.slice(0, 12)}] shadow confirmAllow error: ${e.message}\n`);
-            }
+            await enforceWithRetry(
+              () => confirmAllow({ apiKey, sessionId, toolUseId: eventId }),
+              { label: 'shadow confirmAllow' },
+            );
+            // No enforced++ — shadow doesn't enforce by definition.
+            await decisions(sessionId).record({
+              sourceEvent, decision: result.decision,
+              ruleId: result.rule_id, ruleName: result.rule_name,
+              message: result.message, decidedInMs, mode: result.mode,
+            });
+            fireToFortress(sourceEvent, normalized, result, decidedInMs);
             continue;
           }
 
-          try {
-            if (result.decision === 'allow') {
-              await confirmAllow({ apiKey, sessionId, toolUseId: eventId });
-              enforced++;
-            } else if (result.decision === 'deny') {
-              await confirmDeny({
+          let enforcementDelivered;   // undefined for allow (no block attempted)
+          let shouldBreak = false;
+          if (result.decision === 'allow') {
+            // An allow is not a block; confirmAllow just lets the tool
+            // proceed. Retry to avoid hangs, but this is not fail-open.
+            const ok = await enforceWithRetry(
+              () => confirmAllow({ apiKey, sessionId, toolUseId: eventId }),
+              { label: 'confirmAllow' },
+            );
+            if (ok) enforced++;
+            else { enforcementFailed++; swarn(sessionId, `confirmAllow NOT delivered for event ${eventId} — agent may hang`); }
+          } else if (result.decision === 'deny') {
+            enforcementDelivered = await enforceWithRetry(
+              () => confirmDeny({
                 apiKey, sessionId, toolUseId: eventId,
                 denyMessage: result.message || `Blocked by ${result.rule_name}`,
-              });
-              enforced++;
-            } else if (result.decision === 'interrupt') {
-              await interruptSession({
+              }),
+              { label: 'confirmDeny' },
+            );
+            if (enforcementDelivered) enforced++;
+            else { enforcementFailed++; swarn(sessionId, `ENFORCEMENT FAILED — deny NOT delivered; tool NOT blocked (${result.rule_id || 'policy'})`); }
+          } else if (result.decision === 'interrupt') {
+            enforcementDelivered = await enforceWithRetry(
+              () => interruptSession({
                 apiKey, sessionId,
                 followUpMessage: `Shield interrupted: ${result.message || result.rule_name}`,
-              });
-              sessionInterrupted = true;
-              enforced++;
-              break;
-            }
-          } catch (e) {
-            process.stderr.write(`[shield/${sessionId.slice(0, 12)}] enforcement error on event ${eventId}: ${e.message}\n`);
+              }),
+              { label: 'interrupt' },
+            );
+            if (enforcementDelivered) { sessionInterrupted = true; enforced++; shouldBreak = true; }
+            else { enforcementFailed++; swarn(sessionId, `ENFORCEMENT FAILED — interrupt NOT delivered; session NOT stopped (${result.rule_id || 'policy'})`); }
           }
 
+          await decisions(sessionId).record({
+            sourceEvent, decision: result.decision,
+            ruleId: result.rule_id, ruleName: result.rule_name,
+            message: result.message, decidedInMs,
+            mode: result.mode, enforcementDelivered,
+          });
+          fireToFortress(sourceEvent, normalized, result, decidedInMs, enforcementDelivered);
+
           toolUseCache.delete(eventId);
+          if (shouldBreak) break;
         }
         continue;
       }
@@ -631,9 +690,21 @@ async function main() {
     catch (e) { warn(`${tag}could not fetch agent config (${e.message}). Defaulting to interrupt mode.`); }
 
     info(`${tag}armed — ${ruleset.policies.length} policies · default ${ruleset.default.action} · mode ${mode}${agentMeta?.name ? ` · "${agentMeta.name}"` : ''}`);
-    if (mode === 'interrupt' && !fleet) {
-      warn('DEGRADED mode — Shield will interrupt AFTER a violating tool runs.');
-      warn(`For pre-execution blocking, run: wma-shield --setup-guide --agent-id ${aid}`);
+    // v1.4.2 F-43 (P0 audit): surface the DEGRADED (interrupt) mode in BOTH
+    // single and fleet runs. Pre-fix this warning was gated on `!fleet`, so a
+    // fleet operator — the LEAST likely to inspect each agent's mode and the
+    // MOST likely to assume uniform pre-execution blocking — got no signal
+    // that some/all of the fleet only terminates the session AFTER a
+    // violating tool runs. In fleet mode we warn per newly-armed degraded
+    // agent (once per agent lifetime, not per event) AND the caller emits a
+    // fleet-level summary count after the initial arm.
+    if (mode === 'interrupt') {
+      if (fleet) {
+        warn(`${tag}DEGRADED mode (interrupt) — no pre-execution blocking; session is terminated AFTER a violating tool runs.`);
+      } else {
+        warn('DEGRADED mode — Shield will interrupt AFTER a violating tool runs.');
+        warn(`For pre-execution blocking, run: wma-shield --setup-guide --agent-id ${aid}`);
+      }
     }
 
     const loggers = new Map();
@@ -660,6 +731,7 @@ async function main() {
   // created after startup gets armed + protected without a restart. A per-agent
   // arm failure is skipped and retried on the next reconcile.
   const armed = new Set();
+  const degraded = new Set();   // F-43: agents armed in interrupt (no pre-block) mode
   const running = [];
   const armNew = async (ids) => {
     for (const aid of ids) {
@@ -667,14 +739,20 @@ async function main() {
       const ctx = await setupAgent(aid);
       if (!ctx) continue;                 // skipped (policy fetch failed) → retry next reconcile
       armed.add(aid);
+      if (ctx.mode === 'interrupt') degraded.add(aid);
       running.push(runAgentWide(ctx));    // fire; blocks on the shared signal until shutdown
-      info(`fleet: armed ${aid.slice(0, 16)}…`);
+      info(`fleet: armed ${aid.slice(0, 16)}… (mode ${ctx.mode})`);
     }
   };
   await armNew(agentIds);
   if (armed.size === 0) {
     die(`error: no agents could be armed (${agentIds.length} discovered; all policy fetches failed). Check WMA_API_KEY / WMA_FORTRESS_BASE_URL.`);
   }
+  // F-43: fleet-level honesty summary — how much of the fleet has only
+  // post-hoc termination vs true pre-execution blocking.
+  if (degraded.size > 0) {
+    warn(`fleet: ${degraded.size}/${armed.size} agent(s) in DEGRADED interrupt mode — those have NO pre-execution blocking (the tool runs, then the session is terminated). Configure permission_policy: always_ask on those agents for true pre-block.`);
+  }
   // v1.1.0 Phase 1 L3: supervisor reconcile every 30s (was 60s) so a
   // freshly-created Anthropic agent gets armed sub-30s instead of sub-minute.
   info(`fleet: ${armed.size}/${agentIds.length} agent(s) armed; reconciling every 30s for new agents.`);

package/src/anonymizer.js

@@ -36,6 +36,7 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { createReadStream } from 'node:fs';
 import { createInterface } from 'node:readline';
+import { safeNonNegInt } from './tokens.js';
 
 // ── Configuration ────────────────────────────────────────────────────────
 
@@ -297,8 +298,10 @@ export class SignalsAggregator {
       for (const h of extractIocs(entry, this.salt)) this.iocHashes.add(h);
     }
 
-    // Tokens
-    if (typeof entry.tokens_used === 'number') this.tokensTotal += entry.tokens_used;
+    // Tokens — v1.4.2 F-49: sanitize so a NaN/Infinity/negative tokens_used
+    // can't poison the uploaded tokens_total (a single absurd value would
+    // otherwise distort the whole window's cost-anomaly signal).
+    this.tokensTotal += safeNonNegInt(entry.tokens_used);
 
     // Stop reasons (state_transition entries carry these)
     const stopType = entry.output?.stop_reason?.type;

package/src/fortress/url.js

@@ -21,29 +21,103 @@
  */
 export function resolveFortressBase({ explicitUrl, explicitBase, env = process.env } = {}) {
   // 1. Explicit base URL from CLI
-  if (explicitBase) return stripTrailingSlash(explicitBase);
+  if (explicitBase) return assertSafeFortressBase(stripTrailingSlash(explicitBase));
 
   // 2. Env: WMA_FORTRESS_BASE_URL (preferred)
-  if (env.WMA_FORTRESS_BASE_URL) return stripTrailingSlash(env.WMA_FORTRESS_BASE_URL);
+  if (env.WMA_FORTRESS_BASE_URL) return assertSafeFortressBase(stripTrailingSlash(env.WMA_FORTRESS_BASE_URL));
 
   // 3. Legacy: WMA_FORTRESS_URL (full path to ingest-signals)
   const legacy = explicitUrl || env.WMA_FORTRESS_URL;
   if (legacy) {
     // Strip last path segment to get the base
+    let derived;
     try {
       const u = new URL(legacy);
       const parts = u.pathname.split('/').filter(Boolean);
       if (parts.length > 0) parts.pop();
       u.pathname = '/' + parts.join('/');
-      return stripTrailingSlash(u.toString());
+      derived = stripTrailingSlash(u.toString());
     } catch {
       return null;
     }
+    return assertSafeFortressBase(derived);
   }
 
   return null;
 }
 
+// v1.4.2 F-47 (P1->P2 audit) — SSRF guard on the operator-supplied Fortress
+// base URL. WMA POSTs the customer's Bearer API key + signals/decisions to
+// this URL and PULLS live-enforcement policies from it, so an attacker who can
+// influence the SDK's environment (templated deploy, shared .env, compromised
+// orchestration layer) could previously point it at http://, an internal
+// host, or a cloud metadata endpoint (169.254.169.254) and exfiltrate the key
+// — the only prior check was `protocol === 'https:'` at the request layer.
+//
+// We require https, reject embedded credentials, and reject IP-LITERAL hosts
+// in private / loopback / link-local / ULA ranges (the direct metadata-
+// endpoint vector). We deliberately do NOT pin to *.supabase.co because
+// operators self-host Fortress; any PUBLIC host is allowed. Residual:
+// DNS-rebinding (a public hostname resolving to a private IP) is not caught
+// here — that needs per-request resolved-IP pinning, out of scope for a sync
+// URL validator. Throws (fail-loud) on a bad URL rather than returning null,
+// so a misconfigured/hostile endpoint stops the run instead of silently
+// disabling upload/enforcement.
+export function assertSafeFortressBase(base) {
+  let u;
+  try { u = new URL(base); }
+  catch { throw new Error(`Fortress base URL is not a valid URL: ${base}`); }
+
+  if (u.protocol !== 'https:') {
+    throw new Error(`Fortress base URL must use https:// (got ${u.protocol}//). Refusing to send credentials over ${u.protocol}//.`);
+  }
+  if (u.username || u.password) {
+    throw new Error('Fortress base URL must not embed credentials (user:pass@host).');
+  }
+  if (isBlockedHost(u.hostname)) {
+    throw new Error(
+      `Fortress base URL host "${u.hostname}" is a private/loopback/link-local address — refusing (SSRF guard). ` +
+      'Point WMA_FORTRESS_BASE_URL at your public Fortress endpoint.',
+    );
+  }
+  return base;
+}
+
+// True if the host is an IP literal in a private/loopback/link-local/ULA range,
+// or localhost. Public hostnames and public IPs pass.
+function isBlockedHost(hostname) {
+  // Node keeps surrounding brackets on IPv6 hostnames (e.g. "[::1]"); strip them.
+  const h = hostname.toLowerCase().replace(/^\[/, '').replace(/\]$/, '');
+  if (h === 'localhost' || h.endsWith('.localhost')) return true;
+
+  // IPv6 literal. Normalize IPv4-mapped form.
+  if (h.includes(':')) {
+    if (h === '::1' || h === '::') return true;                 // loopback / unspecified
+    if (h.startsWith('fe8') || h.startsWith('fe9') || h.startsWith('fea') || h.startsWith('feb')) return true; // fe80::/10 link-local
+    if (h.startsWith('fc') || h.startsWith('fd')) return true;  // fc00::/7 unique-local
+    const mapped = h.match(/::ffff:(\d+\.\d+\.\d+\.\d+)$/);     // IPv4-mapped IPv6
+    if (mapped) return isBlockedIpv4(mapped[1]);
+    return false;
+  }
+
+  // IPv4 literal?
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(h)) return isBlockedIpv4(h);
+  return false;
+}
+
+function isBlockedIpv4(ip) {
+  const o = ip.split('.').map(Number);
+  if (o.length !== 4 || o.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return true; // malformed → block
+  const [a, b] = o;
+  if (a === 127) return true;                          // 127.0.0.0/8 loopback
+  if (a === 10) return true;                            // 10.0.0.0/8 private
+  if (a === 172 && b >= 16 && b <= 31) return true;     // 172.16.0.0/12 private
+  if (a === 192 && b === 168) return true;              // 192.168.0.0/16 private
+  if (a === 169 && b === 254) return true;              // 169.254.0.0/16 link-local (cloud metadata)
+  if (a === 0) return true;                             // 0.0.0.0/8
+  return false;
+}
+
 function stripTrailingSlash(s) {
   return s.endsWith('/') ? s.slice(0, -1) : s;
 }