watchmyagents 1.4.9 → 1.4.13

package/README.md

@@ -106,7 +106,7 @@ import { Agent, Runner } from '@openai/agents';
 import {
   wmaToolInputGuardrail,
   attachWmaWatch,
-} from 'watchmyagents/src/sources/openai-agents-js.js';
+} from 'watchmyagents/openai-agents';
 
 const wmaShield = wmaToolInputGuardrail({
   policiesPath: './examples/policies/mitre-starter.json',
@@ -131,7 +131,7 @@ import { Agent, run } from '@openai/agents';
 import {
   wmaToolInputGuardrail,
   attachWmaWatchToAgent,
-} from 'watchmyagents/src/sources/openai-agents-js.js';
+} from 'watchmyagents/openai-agents';
 
 const wmaShield = wmaToolInputGuardrail({
   policiesPath: './examples/policies/mitre-starter.json',
@@ -154,14 +154,14 @@ That's it. NDJSON lands in `./watchmyagents-logs/openai-agents/`. The MITRE star
 
 See [docs/adapters/openai-agents-js.md](docs/adapters/openai-agents-js.md) for the full options reference + troubleshooting.
 
-## Supported runtimes (v1.3.0)
+## Supported runtimes
 
 | Runtime | Mode | Onboarding | Status |
 |---|---|---|---|
 | **Anthropic Managed Agents** | pull REST/SSE | API key (zero-touch) | ✓ shipped |
-| **OpenAI Agents SDK** (TypeScript/JS) | push (in-process hooks + guardrails) | 2 lines of code | ✓ v1.3.0 |
-| OpenAI Agents SDK (Python) | push (separate `watchmyagents-py` package) | — | planned v1.4.0 |
-| Claude Code (dynamic workflows) | push (hooks via `settings.json`) | — | planned v1.4.x |
+| **OpenAI Agents SDK** (TypeScript/JS) | push (in-process hooks + guardrails) | 2 lines of code, or Fortress "Register an OpenAI agent" | ✓ shipped (live Fortress policies + decisions since v1.4.6) |
+| OpenAI Agents SDK (Python) | push (separate `watchmyagents-py` package) | — | planned |
+| Claude Code / Cowork (hooks) | push (plugin hooks via `settings.json`) | — | planned (Phase 2.B) |
 | AWS Bedrock AgentCore | pull REST/SSE | similar to Anthropic | planned v1.5.0 |
 
 ## What gets logged

package/docs/adapters/openai-agents-js.md

@@ -1,6 +1,6 @@
 # OpenAI Agents SDK adapter (TypeScript / JavaScript)
 
-**Status: v1.3.0 (Phase 2.A) — first adapter that observes a runtime which executes locally on the customer machine.**
+**Status: shipped (introduced v1.3.0, Phase 2.A) — the first adapter that observes a runtime which executes locally on the customer machine. Live Fortress policies + decision upload since v1.4.6.**
 
 This adapter integrates `watchmyagents` with the [OpenAI Agents SDK](https://openai.github.io/openai-agents-js/) (`@openai/agents` on npm). Customers add two lines to their existing agent code; WMA logs every lifecycle event locally and can block tool calls before execution via Shield policies.
 
@@ -67,7 +67,7 @@ import { Agent, Runner } from '@openai/agents';
 import {
   wmaToolInputGuardrail,
   attachWmaWatch,
-} from 'watchmyagents/src/sources/openai-agents-js.js';
+} from 'watchmyagents/openai-agents';
 
 const wmaShield = wmaToolInputGuardrail({
   policiesPath: './examples/policies/mitre-starter.json',
@@ -93,7 +93,7 @@ import { Agent, run } from '@openai/agents';
 import {
   wmaToolInputGuardrail,
   attachWmaWatchToAgent,
-} from 'watchmyagents/src/sources/openai-agents-js.js';
+} from 'watchmyagents/openai-agents';
 
 const wmaShield = wmaToolInputGuardrail({
   policiesPath: './examples/policies/mitre-starter.json',
@@ -161,7 +161,7 @@ Three resolution channels for `team_id`, in precedence order:
 Every `shield_decision` row carries `prev_hash` + `chain_hash` (SHA-256). The audit chain is local-only tamper-evidence. Verify with:
 
 ```typescript
-import { verifyDecisionChain } from 'watchmyagents/src/shield/decision-chain.js';
+import { verifyDecisionChain } from 'watchmyagents';
 import { readFile } from 'node:fs/promises';
 
 const lines = (await readFile('./watchmyagents-logs/openai-agents/2026-06-09.ndjson', 'utf8'))

package/examples/adapters/openai-agents-js-quickstart.ts

@@ -26,7 +26,7 @@ import { z } from 'zod';
 import {
   wmaToolInputGuardrail,
   attachWmaWatch,
-} from 'watchmyagents/src/sources/openai-agents-js.js';
+} from 'watchmyagents/openai-agents';
 
 // ── Tools the agent can call ───────────────────────────────────────────
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmyagents",
-  "version": "1.4.9",
+  "version": "1.4.13",
   "description": "Security observability + real-time policy enforcement for AI agents. Local-first NDJSON capture with a continuous Watch daemon that auto-uploads anonymized signals, Shield CLI that blocks policy violations live (with policies pulled from Fortress cloud), anonymizer producing signals-only payloads, bidirectional sync with WatchMyAgents Fortress, and one-command install as an always-on launchd/systemd service — closing the recursive Watch→Guardian→Shield security loop.",
   "type": "module",
   "files": [

package/scripts/fetch-anthropic.js

@@ -28,7 +28,7 @@ import { URL } from 'node:url';
 import { Logger, tightenMode } from '../src/logger.js';
 import { TokenTracker } from '../src/tokens.js';
 import { SignalsAggregator } from '../src/anonymizer.js';
-import { resolveFortressBase, fortressEndpoint } from '../src/fortress/url.js';
+import { resolveFortressBase, fortressEndpoint, guardedLookup } from '../src/fortress/url.js';
 import { cleanLabel } from '../src/labels.js';
 import { isValidAgentId, isValidSessionId, assertSafePathSegment } from '../src/validate.js';
 import { classifyAgentType } from '../src/typology.js';
@@ -107,6 +107,7 @@ function postJson(url, headers, body) {
       path: u.pathname + (u.search || ''),
       headers: { ...headers, 'content-type': 'application/json', 'content-length': data.length },
       rejectUnauthorized: true,
+      lookup: guardedLookup,   // v1.4.11: DNS-rebinding guard on the Fortress upload
     }, (res) => {
       const chunks = [];
       let receivedBytes = 0;

package/scripts/upload-fortress.js

@@ -29,7 +29,7 @@ import { join, resolve } from 'node:path';
 import { createReadStream } from 'node:fs';
 import { createInterface } from 'node:readline';
 import { SignalsAggregator } from '../src/anonymizer.js';
-import { resolveFortressBase, fortressEndpoint } from '../src/fortress/url.js';
+import { resolveFortressBase, fortressEndpoint, guardedLookup } from '../src/fortress/url.js';
 import { AnthropicManagedSource } from '../src/sources/anthropic-managed.js';
 import { cleanLabel } from '../src/labels.js';
 import { maybePrintVersionAndExit } from '../src/version.js';
@@ -97,6 +97,7 @@ function postJson(url, headers, body) {
           'content-length': data.length,
         },
         rejectUnauthorized: true,
+        lookup: guardedLookup,   // v1.4.11: DNS-rebinding guard on the Fortress upload
       },
       (res) => {
         const chunks = [];

package/src/anonymizer.js

@@ -77,6 +77,7 @@ const WELL_KNOWN_TOOLS = new Set([
  */
 export function hashWithSalt(value, salt) {
   if (value == null) return null;
+  assertStrongSalt(salt, 'hashWithSalt');
   const s = typeof value === 'string' ? value : JSON.stringify(value);
   return 'sha256:' + createHash('sha256').update(salt).update(s).digest('hex').slice(0, 32);
 }
@@ -86,6 +87,25 @@ export function generateSalt() {
   return randomBytes(16).toString('hex');
 }
 
+// v1.4.12 (audit residual): the IoC hashes are only non-reversible if the salt
+// is strong. IoCs are low-entropy (IPs, ports, common URLs/commands), so a
+// weak/short salt lets anyone who obtains the uploaded ioc_hashes[] brute-force
+// them back to the raw values — breaking Containment-at-rest. The wma-* CLIs
+// already enforce a >=16-char floor; this moves it INTO the library so a
+// PROGRAMMATIC consumer (SignalsAggregator, hashWithSalt) can't bypass it with
+// a weak salt. 16 chars matches the CLI floor + generateSalt()'s 32-hex output.
+export const MIN_SALT_LENGTH = 16;
+export function assertStrongSalt(salt, ctx = 'salt') {
+  if (typeof salt !== 'string' || salt.length < MIN_SALT_LENGTH) {
+    const got = typeof salt === 'string' ? `${salt.length} chars` : typeof salt;
+    throw new Error(
+      `${ctx}: salt must be a string of at least ${MIN_SALT_LENGTH} characters (got ${got}). ` +
+      'A weak salt makes the IoC hashes brute-forceable. Use generateSalt() or a ' +
+      'stable >=16-char per-customer secret (WMA_SIGNALS_SALT).',
+    );
+  }
+}
+
 // ── Tool name normalization (Containment hardening, v1.0.1 F-3) ────────
 
 /**
@@ -106,7 +126,7 @@ export function normalizeToolName(toolName, salt) {
   const s = String(toolName);
   if (s.length === 0) return null;
   if (WELL_KNOWN_TOOLS.has(s)) return s;
-  if (!salt) throw new Error('normalizeToolName requires a salt to hash custom tool names');
+  assertStrongSalt(salt, 'normalizeToolName');
   return 'tool_hash:' + createHash('sha256').update(salt).update(s).digest('hex').slice(0, 32);
 }
 
@@ -223,7 +243,7 @@ function extractIocs(entry, salt) {
 
 export class SignalsAggregator {
   constructor({ salt } = {}) {
-    if (!salt) throw new Error('SignalsAggregator requires a salt');
+    assertStrongSalt(salt, 'SignalsAggregator');
     this.salt = salt;
     this.counts = Object.create(null);          // action_type → count
     this.toolCounts = Object.create(null);      // tool_name → count
@@ -369,7 +389,7 @@ export class SignalsAggregator {
 // ── Streaming convenience: anonymize a whole NDJSON file/dir ────────────
 
 export async function anonymizeFile(filePath, { salt } = {}) {
-  if (!salt) throw new Error('anonymizeFile requires a salt');
+  assertStrongSalt(salt, 'anonymizeFile');
   const agg = new SignalsAggregator({ salt });
   const stream = createReadStream(filePath, { encoding: 'utf8' });
   const rl = createInterface({ input: stream, crlfDelay: Infinity });

package/src/fortress/url.js

@@ -1,6 +1,7 @@
 // ─────────────────────────────────────────────────────────────────────────
 // Fortress URL resolution — shared across upload-fortress, shield, etc.
 // ─────────────────────────────────────────────────────────────────────────
+import { lookup as dnsLookup } from 'node:dns';
 // The user sets ONE of:
 //
 //   WMA_FORTRESS_BASE_URL=https://<project>.supabase.co/functions/v1
@@ -54,15 +55,20 @@ export function resolveFortressBase({ explicitUrl, explicitBase, env = process.e
 // host, or a cloud metadata endpoint (169.254.169.254) and exfiltrate the key
 // — the only prior check was `protocol === 'https:'` at the request layer.
 //
-// We require https, reject embedded credentials, and reject IP-LITERAL hosts
-// in private / loopback / link-local / ULA ranges (the direct metadata-
-// endpoint vector). We deliberately do NOT pin to *.supabase.co because
-// operators self-host Fortress; any PUBLIC host is allowed. Residual:
-// DNS-rebinding (a public hostname resolving to a private IP) is not caught
-// here — that needs per-request resolved-IP pinning, out of scope for a sync
-// URL validator. Throws (fail-loud) on a bad URL rather than returning null,
-// so a misconfigured/hostile endpoint stops the run instead of silently
-// disabling upload/enforcement.
+// We require https, reject embedded credentials, and reject IP hosts that are
+// not global-unicast. v1.4.13 (Codex P2) hardens this into a 3-way classify:
+//   - 'blocked'  — loopback / link-local+metadata / multicast / reserved /
+//                  broadcast / CGNAT / TEST-NET / benchmarking / 0/8. NEVER
+//                  allowed, even with the opt-out flag (metadata exfil + the
+//                  other non-routable ranges have no legitimate Fortress use).
+//   - 'private'  — RFC1918 (10/8, 172.16/12, 192.168/16) + IPv6 ULA. Blocked by
+//                  default; allowed ONLY with WMA_FORTRESS_ALLOW_PRIVATE_IPS=1
+//                  (a legitimate self-hosted Fortress on a private network).
+//   - 'public'   — global-unicast / public hostname. Allowed.
+// We deliberately do NOT pin to *.supabase.co because operators self-host. The
+// DNS-rebinding gap (a public hostname resolving to a non-global IP at connect
+// time) is closed by guardedLookup (below) — wired into every Fortress request.
+// Throws (fail-loud) so a misconfigured/hostile endpoint stops the run.
 export function assertSafeFortressBase(base) {
   let u;
   try { u = new URL(base); }
@@ -74,48 +80,125 @@ export function assertSafeFortressBase(base) {
   if (u.username || u.password) {
     throw new Error('Fortress base URL must not embed credentials (user:pass@host).');
   }
-  if (isBlockedHost(u.hostname)) {
+  const cat = classifyHost(u.hostname);
+  if (cat === 'blocked') {
     throw new Error(
-      `Fortress base URL host "${u.hostname}" is a private/loopback/link-local address — refusing (SSRF guard). ` +
-      'Point WMA_FORTRESS_BASE_URL at your public Fortress endpoint.',
+      `Fortress base URL host "${u.hostname}" is a loopback/link-local/metadata/reserved address — refusing (SSRF guard). ` +
+      'This is ALWAYS blocked (the opt-out flag does not apply). Point WMA_FORTRESS_BASE_URL at a public endpoint.',
+    );
+  }
+  if (cat === 'private' && !privateFortressAllowed()) {
+    throw new Error(
+      `Fortress base URL host "${u.hostname}" is a private-network (RFC1918/ULA) address — refusing (SSRF guard). ` +
+      'For a legitimate self-hosted Fortress on a private network, set WMA_FORTRESS_ALLOW_PRIVATE_IPS=1.',
     );
   }
   return base;
 }
 
-// True if the host is an IP literal in a private/loopback/link-local/ULA range,
-// or localhost. Public hostnames and public IPs pass.
-function isBlockedHost(hostname) {
+// Classify a host (literal IP or hostname) into 'public' | 'private' | 'blocked'.
+//   'blocked' — never a legitimate Fortress target (always refused).
+//   'private' — RFC1918 / IPv6 ULA (refused unless the opt-out flag is set).
+//   'public'  — global-unicast / public hostname (allowed).
+// Used by both the URL validator and the per-request DNS guard so a literal IP
+// and a RESOLVED IP go through the EXACT same policy.
+export function classifyHost(hostname) {
   // Node keeps surrounding brackets on IPv6 hostnames (e.g. "[::1]"); strip them.
-  const h = hostname.toLowerCase().replace(/^\[/, '').replace(/\]$/, '');
-  if (h === 'localhost' || h.endsWith('.localhost')) return true;
+  const h = String(hostname).toLowerCase().replace(/^\[/, '').replace(/\]$/, '');
+  if (h === 'localhost' || h.endsWith('.localhost')) return 'blocked';
 
-  // IPv6 literal. Normalize IPv4-mapped form.
+  // IPv6 literal.
   if (h.includes(':')) {
-    if (h === '::1' || h === '::') return true;                 // loopback / unspecified
-    if (h.startsWith('fe8') || h.startsWith('fe9') || h.startsWith('fea') || h.startsWith('feb')) return true; // fe80::/10 link-local
-    if (h.startsWith('fc') || h.startsWith('fd')) return true;  // fc00::/7 unique-local
-    const mapped = h.match(/::ffff:(\d+\.\d+\.\d+\.\d+)$/);     // IPv4-mapped IPv6
-    if (mapped) return isBlockedIpv4(mapped[1]);
-    return false;
+    if (h === '::1' || h === '::') return 'blocked';            // loopback / unspecified
+    if (h.startsWith('fe8') || h.startsWith('fe9') || h.startsWith('fea') || h.startsWith('feb')) return 'blocked'; // fe80::/10 link-local
+    if (h.startsWith('ff')) return 'blocked';                  // ff00::/8 multicast
+    if (h.startsWith('fc') || h.startsWith('fd')) return 'private'; // fc00::/7 ULA (RFC1918-equivalent)
+    // IPv4-mapped IPv6 (::ffff:a.b.c.d). CRITICAL: Node's URL parser normalizes
+    // the dotted form to HEX — new URL('https://[::ffff:127.0.0.1]/').hostname
+    // is '[::ffff:7f00:1]' — so a regex matching only the dotted form lets
+    // 127.0.0.1 / 169.254.169.254 (metadata!) slip past. Decode BOTH forms.
+    const mappedDotted = h.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+    if (mappedDotted) return classifyIpv4(mappedDotted[1]);
+    const mappedHex = h.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+    if (mappedHex) {
+      const hi = parseInt(mappedHex[1], 16), lo = parseInt(mappedHex[2], 16);
+      return classifyIpv4(`${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`);
+    }
+    return 'public';
   }
 
   // IPv4 literal?
-  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(h)) return isBlockedIpv4(h);
-  return false;
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(h)) return classifyIpv4(h);
+  return 'public';   // public hostname (DNS rebinding closed by guardedLookup)
+}
+
+// True if a host is refused under the CURRENT policy (flag-aware).
+function hostRefused(hostname) {
+  const cat = classifyHost(hostname);
+  return cat === 'blocked' || (cat === 'private' && !privateFortressAllowed());
+}
+
+// v1.4.11 (Codex P1/P2): per-request DNS guard — closes the DNS-rebinding gap
+// the name-based check can't (a public hostname resolving to a private IP at
+// connect time). Drop-in `lookup` for https.request: it resolves the hostname,
+// rejects the connection if the RESOLVED ip is private/loopback/link-local
+// (same ranges as isBlockedHost, incl. IPv4-mapped IPv6), and otherwise pins
+// the connection to exactly that resolved address. Wire it into every
+// Fortress-bound https.request via `{ lookup: guardedLookup }`.
+export function guardedLookup(hostname, options, callback) {
+  const cb = typeof options === 'function' ? options : callback;
+  const opts = typeof options === 'function' ? {} : (options || {});
+  // NOTE: we do NOT early-return when the opt-out flag is set. hostRefused()
+  // is flag-aware: it allows RFC1918 ('private') resolutions when the flag is
+  // set, but STILL blocks loopback / link-local / metadata / reserved
+  // ('blocked') even then — the flag must not open the cloud-metadata vector.
+  dnsLookup(hostname, opts, (err, address, family) => {
+    if (err) return cb(err);
+    const list = Array.isArray(address) ? address : [{ address, family }];
+    for (const a of list) {
+      if (hostRefused(a.address)) {
+        const cat = classifyHost(a.address);
+        return cb(new Error(
+          `SSRF guard: "${hostname}" resolved to a ${cat === 'blocked' ? 'loopback/link-local/metadata/reserved' : 'private-network'} ` +
+          `IP (${a.address}) — refusing the connection.` +
+          (cat === 'private' ? ' Set WMA_FORTRESS_ALLOW_PRIVATE_IPS=1 for a self-hosted Fortress on a private network.' : ''),
+        ));
+      }
+    }
+    return cb(null, address, family);
+  });
+}
+
+// Opt-out for self-hosted Fortress on a private network. Default: not allowed.
+function privateFortressAllowed() {
+  return process.env.WMA_FORTRESS_ALLOW_PRIVATE_IPS === '1';
 }
 
-function isBlockedIpv4(ip) {
+// Classify an IPv4 literal. 'private' = RFC1918 (opt-out-able). Everything
+// non-global-unicast and non-RFC1918 is 'blocked' (never allowed): loopback,
+// link-local/metadata, CGNAT, IETF protocol, TEST-NET-1/2/3, benchmarking,
+// multicast, reserved/future, broadcast, this-network. (v1.4.13 Codex P2.)
+function classifyIpv4(ip) {
   const o = ip.split('.').map(Number);
-  if (o.length !== 4 || o.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return true; // malformed → block
-  const [a, b] = o;
-  if (a === 127) return true;                          // 127.0.0.0/8 loopback
-  if (a === 10) return true;                            // 10.0.0.0/8 private
-  if (a === 172 && b >= 16 && b <= 31) return true;     // 172.16.0.0/12 private
-  if (a === 192 && b === 168) return true;              // 192.168.0.0/16 private
-  if (a === 169 && b === 254) return true;              // 169.254.0.0/16 link-local (cloud metadata)
-  if (a === 0) return true;                             // 0.0.0.0/8
-  return false;
+  if (o.length !== 4 || o.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return 'blocked'; // malformed
+  const [a, b, c] = o;
+  // RFC1918 private — the only ranges the opt-out flag un-blocks.
+  if (a === 10) return 'private';                        // 10.0.0.0/8
+  if (a === 172 && b >= 16 && b <= 31) return 'private'; // 172.16.0.0/12
+  if (a === 192 && b === 168) return 'private';          // 192.168.0.0/16
+  // Always blocked (not global-unicast; flag does NOT apply).
+  if (a === 0) return 'blocked';                                 // 0.0.0.0/8 this-network
+  if (a === 127) return 'blocked';                               // 127.0.0.0/8 loopback
+  if (a === 169 && b === 254) return 'blocked';                  // 169.254.0.0/16 link-local + cloud metadata
+  if (a === 100 && b >= 64 && b <= 127) return 'blocked';        // 100.64.0.0/10 CGNAT
+  if (a === 192 && b === 0 && c === 0) return 'blocked';         // 192.0.0.0/24 IETF protocol assignments
+  if (a === 192 && b === 0 && c === 2) return 'blocked';         // 192.0.2.0/24 TEST-NET-1
+  if (a === 198 && (b === 18 || b === 19)) return 'blocked';     // 198.18.0.0/15 benchmarking
+  if (a === 198 && b === 51 && c === 100) return 'blocked';      // 198.51.100.0/24 TEST-NET-2
+  if (a === 203 && b === 0 && c === 113) return 'blocked';       // 203.0.113.0/24 TEST-NET-3
+  if (a >= 224 && a <= 239) return 'blocked';                    // 224.0.0.0/4 multicast
+  if (a >= 240) return 'blocked';                                // 240.0.0.0/4 reserved + 255.255.255.255 broadcast
+  return 'public';
 }
 
 function stripTrailingSlash(s) {

package/src/shield/policy-stream.js

@@ -33,6 +33,7 @@ import { request as httpsRequest } from 'node:https';
 import { URL } from 'node:url';
 import { EventEmitter } from 'node:events';
 import { normalizeSseBuffer } from './sse.js';
+import { guardedLookup } from '../fortress/url.js';
 
 const RECONNECT_MIN_MS = 1_000;
 const RECONNECT_MAX_MS = 60_000;
@@ -109,6 +110,7 @@ export class PolicyStream extends EventEmitter {
         'connection': 'keep-alive',
       },
       rejectUnauthorized: true,
+      lookup: guardedLookup,   // v1.4.11: DNS-rebinding guard on the Fortress SSE
     }, (res) => {
       this._req = req;
 

package/src/shield/sources/fortress.js

@@ -11,7 +11,7 @@
 
 import { request as httpsRequest } from 'node:https';
 import { URL } from 'node:url';
-import { fortressEndpoint } from '../../fortress/url.js';
+import { fortressEndpoint, guardedLookup } from '../../fortress/url.js';
 
 const DEFAULT_TIMEOUT_MS = 15_000;
 // v1.1.2 F-17 (P3 Codex audit): cap on the total bytes we'll accumulate
@@ -41,6 +41,10 @@ function httpsJson(method, url, headers, body, timeoutMs = DEFAULT_TIMEOUT_MS) {
         ...(data ? { 'content-type': 'application/json', 'content-length': data.length } : {}),
       },
       rejectUnauthorized: true,
+      // v1.4.11 (Codex P1/P2): per-request DNS guard — reject a hostname that
+      // resolves to a private/loopback/link-local IP (DNS rebinding), and pin
+      // the connection to the checked address.
+      lookup: guardedLookup,
     };
     const req = httpsRequest(opts, (res) => {
       const chunks = [];
@@ -87,14 +91,25 @@ function httpsJson(method, url, headers, body, timeoutMs = DEFAULT_TIMEOUT_MS) {
  * @param {string} [opts.provider] - runtime provider (default 'anthropic-managed')
  * @returns {Promise<{ ok: true, policies: array, signing_keys: array, fetched_at: string }>}
  */
-// v1.4.9: pure, testable get-policies URL builder. Always carries `provider`
-// so a provider-aware Fortress can scope by (provider, native_agent_id) — an
-// OpenAI agent id is NOT in the `agent_…` shape. Harmless on the older Fortress
-// that ignores unknown query params.
+// v1.4.10: pure, testable get-policies URL builder. Always carries `provider`.
+// The AGENT-ID PARAM NAME is provider-dependent and this matters:
+//   - anthropic-managed → `agent_id` (legacy). Fortress resolves by
+//     anthropic_agent_id, which works for ALL Anthropic agents including legacy
+//     rows whose native_agent_id was never backfilled.
+//   - other providers (openai-agents) → `native_agent_id` (canonical). Fortress
+//     resolves by (provider, native_agent_id). This is REQUIRED: an OpenAI id is
+//     not in the `agent_…` shape and its anthropic_agent_id is null. If we sent
+//     it as `agent_id`, Fortress's `useLegacyLookup` (native absent + agent_id
+//     present) forces the anthropic_agent_id lookup → the OpenAI agent isn't
+//     found → empty policies → default-allow → enforcement SILENTLY OFF (a
+//     fail-OPEN, worse than fail-closed). v1.4.9 had this bug.
 export function buildGetPoliciesUrl(base, { anthropicAgentId, provider = 'anthropic-managed' } = {}) {
   let url = fortressEndpoint(base, 'get-policies');
   const params = [];
-  if (anthropicAgentId) params.push(`agent_id=${encodeURIComponent(anthropicAgentId)}`);
+  if (anthropicAgentId) {
+    const key = provider === 'anthropic-managed' ? 'agent_id' : 'native_agent_id';
+    params.push(`${key}=${encodeURIComponent(anthropicAgentId)}`);
+  }
   params.push(`provider=${encodeURIComponent(provider)}`);
   url += (url.includes('?') ? '&' : '?') + params.join('&');
   return url;

package/src/shield/upload.js

@@ -12,13 +12,17 @@
 // it — only the leak-y field is omitted.
 
 import { createHash } from 'node:crypto';
-import { normalizeToolName } from '../anonymizer.js';
+import { normalizeToolName, MIN_SALT_LENGTH } from '../anonymizer.js';
 
 // Salted SHA-256 hash with the same 32-char truncation as the anonymizer
 // and the rest of Shield's decision flow. Returns null for nullish input
 // or when no salt is configured (fail-safe omission).
+// v1.4.12 (audit residual): a weak/short salt yields a brute-forceable hash, so
+// treat it like NO salt — OMIT the field rather than emit a weak hash. This is
+// the fail-safe / Containment-safe choice and (unlike throwing) can't break the
+// synchronous decision-payload build in shield.js's fireToFortress.
 function hashWithSaltOpt(value, salt) {
-  if (value == null || !salt) return null;
+  if (value == null || typeof salt !== 'string' || salt.length < MIN_SALT_LENGTH) return null;
   const s = typeof value === 'string' ? value : JSON.stringify(value);
   return 'sha256:' + createHash('sha256').update(salt).update(s).digest('hex').slice(0, 32);
 }