ShieldCortex 5.9.0: Fewer False Alarms, Better Global Install Coverage
ShieldCortex 5.9.0 was released on 14 October 2026. It reduces false alarms for data-reading heredocs and read-only global npm queries, while improving coverage for global installs written into scripts and installs with a redirection attached to the package-manager name. These four changes are in Action Guard and the session lease and apply only where those features are on. This is a minor release on 5.8.0.
Read data without a heredoc false alarm
Action Guard again allows a short interpreter heredoc that only reads a data file, such as a Python heredoc loading a markdown table. The relief applies only to a whole-command heredoc with a quoted delimiter and recognised, literal data-read statements. Other heredocs keep the existing scan. A heredoc that only opens a sensitive file can still report the sensitive path, even though it no longer reports an opaque script invocation.
The allow-list is deliberately narrow: computed or piped paths, loaders and evaluators, unlisted calls, blocks, interpolation and malformed input keep the existing scan. The -c and script-file checks are unchanged.
Read-only npm queries no longer take the install lease
The session lease now looks for the install verb and global flag in the package manager's own command. A read-only query such as npm list -g | grep -i x no longer takes or gets refused by the install lease. A global install with a redirection attached directly to the package-manager name, such as npm>/dev/null install -g x, keeps install scope.
Commands the lease cannot parse safely keep conservative install scoping. Some redirection forms may still be scoped as installs even when they are not. The separately reported cross-plane lease identity issue is still open.
Written argv-list installs join the approval gate
When a script file builds a global install as an argument list, for example Python subprocess.run(["npm", "install", "-g", pkg]), writing that file now joins the approval gate, like the string form. When Action Guard is on and enforcing, a recognised argv-list global install in a written script requires approval. An approval prompt needs a host with an approval surface: Hermes has no prompt and blocks held calls while enforcing.
What "on" means depends on the posture you pick in shieldcortex setup: Off, Watch only or Enforce when ready. On Claude Code and OpenClaw, Watch only records ordinary dangerous-tier calls such as this one rather than holding them, and Enforce when ready does the same until its readiness conditions are met.
The reader is bounded. A global flag beyond its 8 KB per-call read is not seen; wrapper options outside its listed set and general npm parsing are not covered. Template-literal and concatenated arguments are read as opaque, and exec APIs outside the listed sinks remain outside this reader.
Action Guard stays off by default in the shared ShieldCortex config. These changes do not turn it on. There are no export, CLI command, config key, default, Node floor or Cloud pin changes.
Upgrade to 5.9.0
npm install -g shieldcortex@5.9.0Built by Drakon Systems.