@optimuslabs/harness-map-staging 1.5.16

package/dist/log_config_files/runtime/remediation_apply_tracking.js

@@ -0,0 +1,152 @@
+/**
+ * Tracks remediation apply attempts and post-apply verification (next compliance check)
+ * so we do not restart-loop or retry forever when an agent config format changed and
+ * autofix can never stick. Applies to every remediation on Cursor and Claude.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { atomicWriteJson, getDeferredVscdbApplyPath, getRemediationStateDir, } from './management_storage.js';
+import { hookRunLog } from './hook_logger.js';
+export const REMEDIATION_APPLY_TRACKING_BASENAME = 'remediation_apply_tracking.json';
+/** Consecutive post-restart verification failures before we stop autofix for a UUID. */
+export const MAX_CONSECUTIVE_VERIFY_FAILURES = 1;
+export function getRemediationApplyTrackingPath() {
+    return join(getRemediationStateDir(), REMEDIATION_APPLY_TRACKING_BASENAME);
+}
+function emptyTrackingFile() {
+    return { entries: {} };
+}
+export function readRemediationApplyTrackingFile() {
+    const path = getRemediationApplyTrackingPath();
+    if (!existsSync(path))
+        return emptyTrackingFile();
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        if (!parsed || typeof parsed !== 'object' || !parsed.entries || typeof parsed.entries !== 'object') {
+            return emptyTrackingFile();
+        }
+        return parsed;
+    }
+    catch {
+        return emptyTrackingFile();
+    }
+}
+export function writeRemediationApplyTrackingFile(file) {
+    atomicWriteJson(getRemediationApplyTrackingPath(), file);
+}
+function defaultEntry() {
+    return { consecutive_verify_failures: 0, quarantined: false };
+}
+export function getRemediationApplyTrackingEntry(uuid) {
+    const file = readRemediationApplyTrackingFile();
+    return file.entries[uuid] ?? defaultEntry();
+}
+export function isRemediationQuarantined(uuid) {
+    return getRemediationApplyTrackingEntry(uuid).quarantined === true;
+}
+/** Admin retry: reset quarantine counters so autofix can run again on next prompt. */
+export function clearRemediationApplyQuarantine(uuid) {
+    const file = readRemediationApplyTrackingFile();
+    const prev = file.entries[uuid];
+    if (!prev)
+        return;
+    file.entries[uuid] = {
+        consecutive_verify_failures: 0,
+        quarantined: false,
+        pending_post_restart_verify: false,
+    };
+    writeRemediationApplyTrackingFile(file);
+    hookRunLog(`remediation_tracking: quarantine_cleared uuid=${uuid}`);
+}
+export function hasPendingPostRestartVerification() {
+    const file = readRemediationApplyTrackingFile();
+    return Object.values(file.entries).some((e) => e.pending_post_restart_verify === true);
+}
+export function markRemediationApplyPendingVerification(uuid) {
+    const file = readRemediationApplyTrackingFile();
+    const prev = file.entries[uuid] ?? defaultEntry();
+    file.entries[uuid] = {
+        ...prev,
+        pending_post_restart_verify: true,
+        last_apply_at: new Date().toISOString(),
+        server_verified_at: undefined,
+    };
+    writeRemediationApplyTrackingFile(file);
+    hookRunLog(`remediation_tracking: pending_post_restart_verify uuid=${uuid}`);
+}
+export function markRemediationApplyVerified(uuid) {
+    const file = readRemediationApplyTrackingFile();
+    const prev = file.entries[uuid] ?? defaultEntry();
+    const next = {
+        ...prev,
+        pending_post_restart_verify: false,
+        consecutive_verify_failures: 0,
+        quarantined: false,
+        last_failure_reason: undefined,
+        quarantined_at: undefined,
+        server_verified_at: new Date().toISOString(),
+    };
+    file.entries[uuid] = next;
+    writeRemediationApplyTrackingFile(file);
+    hookRunLog(`remediation_tracking: verified uuid=${uuid}`);
+    return next;
+}
+export function recordRemediationVerificationFailure(uuid, reason) {
+    const file = readRemediationApplyTrackingFile();
+    const prev = file.entries[uuid] ?? defaultEntry();
+    const failures = (prev.consecutive_verify_failures ?? 0) + 1;
+    const quarantined = failures >= MAX_CONSECUTIVE_VERIFY_FAILURES;
+    const next = {
+        ...prev,
+        pending_post_restart_verify: false,
+        consecutive_verify_failures: failures,
+        quarantined,
+        last_failure_reason: reason,
+        ...(quarantined ? { quarantined_at: new Date().toISOString() } : {}),
+    };
+    file.entries[uuid] = next;
+    writeRemediationApplyTrackingFile(file);
+    hookRunLog(`remediation_tracking: verification_failed uuid=${uuid} failures=${failures} quarantined=${quarantined}`);
+    return { entry: next, newlyQuarantined: quarantined && !prev.quarantined };
+}
+/**
+ * For each UUID awaiting post-restart verification, decide pass/fail.
+ *
+ * Prefer a per-UUID probe (re-runs that remediation's checks on disk). A Set of UUIDs is
+ * supported for unit tests only — do not use a global violation list from compliance_check
+ * in production: shadow-key merge bugs once made that list empty while the setting was still
+ * wrong, which incorrectly marked remediations verified.
+ *
+ * If the deferred vscdb queue file is still on disk, Cursor restart / apply_deferred_vscdb has
+ * not completed — leave pending and do not quarantine (setting unchanged is expected).
+ */
+export function processPendingPostRestartVerifications(violationProbe) {
+    const isStillViolating = typeof violationProbe === 'function'
+        ? violationProbe
+        : (uuid) => violationProbe.has(uuid);
+    const file = readRemediationApplyTrackingFile();
+    const outcomes = [];
+    const deferredQueuePending = existsSync(getDeferredVscdbApplyPath());
+    for (const [uuid, entry] of Object.entries(file.entries)) {
+        if (!entry.pending_post_restart_verify)
+            continue;
+        if (!isStillViolating(uuid)) {
+            markRemediationApplyVerified(uuid);
+            outcomes.push({ uuid, status: 'verified', consecutive_failures: 0 });
+            continue;
+        }
+        if (deferredQueuePending) {
+            hookRunLog(`remediation_tracking: defer verify uuid=${uuid} — deferred vscdb queue still pending (restart/apply not done yet)`);
+            continue;
+        }
+        const reason = 'Setting unchanged after apply — the agent may have changed its config format and auto-fix cannot apply this policy.';
+        const { entry: updated, newlyQuarantined } = recordRemediationVerificationFailure(uuid, reason);
+        outcomes.push({
+            uuid,
+            status: newlyQuarantined || updated.quarantined ? 'quarantined' : 'verification_failed',
+            reason,
+            consecutive_failures: updated.consecutive_verify_failures,
+        });
+    }
+    return outcomes;
+}

package/dist/log_config_files/runtime/remediation_config_path.js

@@ -0,0 +1,140 @@
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/**
+ * Portable key stored by the server for Cursor User globalStorage state.vscdb
+ * (see optimus_security/endpoint/log_config_file/handler._canonical_cursor_user_state_vscdb_path).
+ */
+export const PORTABLE_CURSOR_USER_STATE_VSCDB = 'Cursor/User/globalStorage/state.vscdb';
+/** Portable key for Cursor User settings.json (globalCursorIgnoreList). */
+export const PORTABLE_CURSOR_USER_SETTINGS = 'Cursor/User/settings.json';
+function expandLeadingTilde(configFilePath) {
+    const t = configFilePath.trim();
+    if (t.startsWith('~/')) {
+        return join(homedir(), t.slice(2));
+    }
+    return configFilePath;
+}
+export function cursorUserSettingsAbsolutePaths() {
+    const h = homedir();
+    if (process.platform === 'darwin') {
+        const support = join(h, 'Library', 'Application Support');
+        const variants = ['Cursor', 'Cursor - Insiders', 'Cursor Nightly', 'Cursor Next'];
+        return variants.map((name) => join(support, name, 'User', 'settings.json'));
+    }
+    if (process.platform === 'win32') {
+        const appData = process.env.APPDATA;
+        if (appData)
+            return [join(appData, 'Cursor', 'User', 'settings.json')];
+        return [join(h, 'AppData', 'Roaming', 'Cursor', 'User', 'settings.json')];
+    }
+    return [join(h, '.config', 'Cursor', 'User', 'settings.json')];
+}
+function normalizeSlashes(p) {
+    return p.trim().replace(/\\/g, '/');
+}
+/**
+ * Canonical `file_path` for Cursor User globalStorage state.vscdb uploads, matching
+ * `optimus_security.endpoint.log_config_file.handler._canonical_cursor_user_state_vscdb_path`.
+ * Always use before sending log-config-file(s) so findings dedupe regardless of absolute vs portable input.
+ */
+export function canonicalCursorUserStateVscdbPath(filePath) {
+    const s = normalizeSlashes(filePath);
+    const lower = s.toLowerCase();
+    const needle = 'cursor/user/globalstorage/state.vscdb';
+    const idx = lower.indexOf(needle);
+    if (idx >= 0) {
+        const tail = s.slice(idx + needle.length);
+        if (tail.startsWith('#')) {
+            return `${PORTABLE_CURSOR_USER_STATE_VSCDB}${tail}`;
+        }
+        if (tail === '') {
+            return PORTABLE_CURSOR_USER_STATE_VSCDB;
+        }
+        return filePath.trim();
+    }
+    // Per-workspace vscdbs live under workspaceStorage/<hash>/state.vscdb and must NOT be
+    // normalized to the global path — each workspace is a distinct ConfigurationFile row.
+    if (lower.includes('workspacestorage')) {
+        return filePath.trim();
+    }
+    const vscdb = 'state.vscdb';
+    const vlen = vscdb.length;
+    const slashKey = '/' + vscdb;
+    let start;
+    const pos = lower.lastIndexOf(slashKey);
+    if (pos >= 0) {
+        start = pos + 1;
+    }
+    else if (lower.startsWith(vscdb)) {
+        start = 0;
+    }
+    else {
+        return filePath.trim();
+    }
+    const tail = s.slice(start + vlen);
+    if (tail.startsWith('#') || tail === '') {
+        return `${PORTABLE_CURSOR_USER_STATE_VSCDB}${tail}`;
+    }
+    return filePath.trim();
+}
+function cursorStateVscdbAbsoluteBasePaths() {
+    const h = homedir();
+    if (process.platform === 'darwin') {
+        const support = join(h, 'Library', 'Application Support');
+        const variants = ['Cursor', 'Cursor - Insiders', 'Cursor Nightly', 'Cursor Next'];
+        return variants.map((name) => join(support, name, 'User', 'globalStorage', 'state.vscdb'));
+    }
+    if (process.platform === 'win32') {
+        const appData = process.env.APPDATA;
+        if (appData)
+            return [join(appData, 'Cursor', 'User', 'globalStorage', 'state.vscdb')];
+        return [join(h, 'AppData', 'Roaming', 'Cursor', 'User', 'globalStorage', 'state.vscdb')];
+    }
+    return [join(h, '.config', 'Cursor', 'User', 'globalStorage', 'state.vscdb')];
+}
+/**
+ * Expand server-side portable Cursor state.vscdb paths to a local absolute path.
+ * No-op for absolute paths and for relative paths that are not the portable vscdb key.
+ */
+export function resolveRemediationConfigPath(configFilePath) {
+    const expandedTilde = expandLeadingTilde(configFilePath);
+    const t = normalizeSlashes(expandedTilde);
+    const hash = t.indexOf('#');
+    const base = hash >= 0 ? t.slice(0, hash) : t;
+    const frag = hash >= 0 ? t.slice(hash) : '';
+    const baseNorm = base.replace(/\/+$/, '');
+    if (baseNorm.startsWith('/') || /^[a-zA-Z]:\//.test(baseNorm)) {
+        return expandedTilde;
+    }
+    const portableSettings = PORTABLE_CURSOR_USER_SETTINGS;
+    if (baseNorm === portableSettings || baseNorm.endsWith('/' + portableSettings)) {
+        const candidates = cursorUserSettingsAbsolutePaths();
+        for (const abs of candidates) {
+            if (existsSync(abs))
+                return abs;
+        }
+        return candidates[0];
+    }
+    const portable = PORTABLE_CURSOR_USER_STATE_VSCDB;
+    if (baseNorm !== portable && !baseNorm.endsWith('/' + portable)) {
+        return configFilePath;
+    }
+    const candidates = cursorStateVscdbAbsoluteBasePaths();
+    for (const abs of candidates) {
+        if (existsSync(abs))
+            return `${abs}${frag}`;
+    }
+    return `${candidates[0]}${frag}`;
+}
+/** Correct log-config file_type when manifest rows target Cursor User/settings.json. */
+export function resolveRemediationUploadFileType(configFilePath, manifestFileType) {
+    const t = normalizeSlashes(configFilePath.trim());
+    const portableSettings = PORTABLE_CURSOR_USER_SETTINGS;
+    if (t === portableSettings ||
+        t.endsWith(`/${portableSettings}`) ||
+        t.toLowerCase().includes('cursor/user/settings.json')) {
+        return 'vscode_settings';
+    }
+    return (manifestFileType ?? '').trim();
+}