@optimuslabs/harness-map-staging 1.5.16

package/dist/log_config_files/runtime/secret_regex_scan.js

@@ -0,0 +1,126 @@
+/**
+ * Lightweight hardcoded-secret detection for local compliance (requires_secret_scan rows).
+ * Regex set aligned with policy_engine HardcodedSecretRule — not a full Secretlint/Gitleaks port.
+ */
+/** Values that reference env vars are never treated as hardcoded secrets. */
+export function isEnvBackedSecretValue(value) {
+    if (typeof value !== 'string')
+        return false;
+    const s = value.trim();
+    if (!s)
+        return false;
+    return s.includes('${env:') || s.includes('$env:') || s.includes('process.env.');
+}
+/** Provider / format patterns (order matters — first match wins). */
+const KNOWN_SECRET_PATTERNS = [
+    { re: /sk-proj-[a-zA-Z0-9_-]{20,}/i, label: 'OpenAI API key' },
+    { re: /sk-ant-[a-zA-Z0-9_-]{20,}/i, label: 'Anthropic API key' },
+    { re: /sk-[a-zA-Z0-9]{20,}/i, label: 'API key (sk-...)' },
+    { re: /sk_(?:live|test|prod)_[a-zA-Z0-9]{20,}/i, label: 'Stripe secret key' },
+    { re: /pk_(?:live|test)_[a-zA-Z0-9]{20,}/i, label: 'Stripe publishable key' },
+    { re: /pk_[a-zA-Z0-9_]{20,}/i, label: 'API key (pk_...)' },
+    { re: /whsec_[a-zA-Z0-9]{20,}/i, label: 'Stripe webhook secret' },
+    { re: /rk_(?:live|test)_[a-zA-Z0-9]{20,}/i, label: 'Stripe restricted key' },
+    { re: /pplx-[a-zA-Z0-9-]{20,}/i, label: 'Perplexity API key' },
+    { re: /ghp_[a-zA-Z0-9]{36}/i, label: 'GitHub personal access token' },
+    { re: /gho_[a-zA-Z0-9]{36}/i, label: 'GitHub OAuth token' },
+    { re: /ghu_[a-zA-Z0-9]{36}/i, label: 'GitHub user-to-server token' },
+    { re: /ghs_[a-zA-Z0-9]{36}/i, label: 'GitHub server-to-server token' },
+    { re: /ghr_[a-zA-Z0-9]{76}/i, label: 'GitHub refresh token' },
+    { re: /github_pat_[a-zA-Z0-9_]{20,}/i, label: 'GitHub fine-grained PAT' },
+    { re: /glpat-[a-zA-Z0-9_-]{20,}/i, label: 'GitLab personal access token' },
+    { re: /glcbt-[a-zA-Z0-9_-]{20,}/i, label: 'GitLab CI job token' },
+    { re: /xoxb-[a-zA-Z0-9-]+/i, label: 'Slack bot token' },
+    { re: /xoxp-[a-zA-Z0-9-]+/i, label: 'Slack user token' },
+    { re: /xoxa-[a-zA-Z0-9-]+/i, label: 'Slack app-level token' },
+    { re: /xapp-[a-zA-Z0-9-]+/i, label: 'Slack app token' },
+    { re: /AKIA[0-9A-Z]{16}/i, label: 'AWS access key ID' },
+    { re: /ASIA[0-9A-Z]{16}/i, label: 'AWS temporary access key ID' },
+    { re: /AIza[0-9A-Za-z_-]{35}/i, label: 'Google API key' },
+    { re: /ya29\.[0-9A-Za-z_-]+/i, label: 'Google OAuth access token' },
+    { re: /AC[a-z0-9]{32}/i, label: 'Twilio account SID' },
+    { re: /SK[a-z0-9]{32}/i, label: 'Twilio API key' },
+    { re: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/i, label: 'SendGrid API key' },
+    { re: /key-[a-f0-9]{32}/i, label: 'Mailgun API key' },
+    { re: /npm_[a-zA-Z0-9]{36}/i, label: 'npm access token' },
+    { re: /pypi-[a-zA-Z0-9_-]{50,}/i, label: 'PyPI API token' },
+    { re: /discord(?:app)?\.com\/api\/webhooks\/\d+\/[a-zA-Z0-9_-]+/i, label: 'Discord webhook URL' },
+    { re: /hooks\.slack\.com\/services\/T[a-zA-Z0-9_]+\/B[a-zA-Z0-9_]+\/[a-zA-Z0-9_]+/i, label: 'Slack webhook URL' },
+    { re: /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/i, label: 'JWT (JSON Web Token)' },
+    { re: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/i, label: 'Private key block' },
+    { re: /sq0[a-zA-Z0-9_-]{20,}/i, label: 'Square access token' },
+    { re: /shpat_[a-fA-F0-9]{32}/i, label: 'Shopify access token' },
+    { re: /shpca_[a-fA-F0-9]{32}/i, label: 'Shopify custom app token' },
+    { re: /shpss_[a-fA-F0-9]{32}/i, label: 'Shopify shared secret' },
+    { re: /dop_v1_[a-f0-9]{64}/i, label: 'DigitalOcean personal access token' },
+    { re: /pat_[a-zA-Z0-9]{22}_[a-fA-F0-9]{59}/i, label: 'Atlassian API token' },
+    { re: /Bearer\s+[a-zA-Z0-9\-_.]{20,}/i, label: 'Bearer token' },
+];
+const BASIC_AUTH_IN_URL = /[a-zA-Z0-9._%+-]+:[a-zA-Z0-9._%+-]+@/gi;
+const GENERIC_TOKEN = /\b[a-zA-Z0-9]{32,}\b/g;
+const GENERIC_KEY_HINT = /(?:api[_-]?key|app[_-]?key|secret|token|password|passwd|pass\b|(?<!o)auth|credential|private[_-]?key|access[_-]?key|master[_-]?key)/i;
+function basicAuthMatchIsCredential(value, matchIndex) {
+    const before = value.slice(0, matchIndex);
+    const schemeIdx = before.lastIndexOf('://');
+    if (schemeIdx === -1)
+        return true;
+    const between = value.slice(schemeIdx + 3, matchIndex);
+    return !between.includes('/');
+}
+function looksLikeUrlContext(value) {
+    return value.includes(':') && (value.toLowerCase().includes('http') || value.includes('://'));
+}
+/**
+ * Scan one scalar config value. Returns secret type label or null if clean / env-backed.
+ */
+export function scanScalarForHardcodedSecret(value, keyName) {
+    if (value == null)
+        return null;
+    const valueStr = String(value);
+    if (isEnvBackedSecretValue(valueStr))
+        return null;
+    for (const { re, label } of KNOWN_SECRET_PATTERNS) {
+        if (re.test(valueStr))
+            return label;
+    }
+    BASIC_AUTH_IN_URL.lastIndex = 0;
+    for (const match of valueStr.matchAll(BASIC_AUTH_IN_URL)) {
+        if (basicAuthMatchIsCredential(valueStr, match.index ?? 0)) {
+            return 'Basic authentication credentials';
+        }
+    }
+    if (!GENERIC_KEY_HINT.test(keyName) || looksLikeUrlContext(valueStr)) {
+        return null;
+    }
+    const genericMatches = valueStr.match(GENERIC_TOKEN) ?? [];
+    if (genericMatches.some((token) => token.length >= 40)) {
+        return 'Potential token/secret';
+    }
+    return null;
+}
+function collectScalarLeaves(value, path = '') {
+    if (value == null)
+        return [];
+    if (Array.isArray(value)) {
+        return value.flatMap((item, idx) => collectScalarLeaves(item, path ? `${path}.${idx}` : String(idx)));
+    }
+    if (typeof value === 'object') {
+        return Object.entries(value).flatMap(([key, nested]) => collectScalarLeaves(nested, path ? `${path}.${key}` : key));
+    }
+    if (typeof value !== 'string' && typeof value !== 'number' && typeof value !== 'boolean') {
+        return [];
+    }
+    const key = path.split('.').pop() ?? path;
+    return [{ path: path || '.', key, value }];
+}
+/** Walk parsed JSON and return all hardcoded-secret hits (JSON dot paths). */
+export function scanJsonForHardcodedSecrets(configJson) {
+    const findings = [];
+    for (const leaf of collectScalarLeaves(configJson)) {
+        const secretType = scanScalarForHardcodedSecret(leaf.value, leaf.key);
+        if (secretType) {
+            findings.push({ path: leaf.path, key: leaf.key, secretType });
+        }
+    }
+    return findings;
+}

package/dist/log_config_files/runtime/sqlite_binary.js

@@ -0,0 +1,124 @@
+import { existsSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { join } from 'node:path';
+let cached;
+/**
+ * Resolve the sqlite3 CLI for remediations and vscdb reads.
+ *
+ * Cursor/IDE-launched hooks often inherit a minimal PATH (no Homebrew), while macOS still ships
+ * `/usr/bin/sqlite3`. Prefer explicit paths before `which` / bare `sqlite3`.
+ *
+ * Override: `OPTIMUS_SQLITE3`, `SQLITE3_PATH`, or `SQLITE3_BIN` = absolute path to the binary.
+ */
+export function resolveSqlite3Binary() {
+    if (cached !== undefined)
+        return cached;
+    for (const envName of ['OPTIMUS_SQLITE3', 'SQLITE3_PATH', 'SQLITE3_BIN']) {
+        const v = process.env[envName]?.trim();
+        if (v && existsSync(v)) {
+            cached = v;
+            return cached;
+        }
+    }
+    const candidates = [];
+    if (process.platform === 'darwin') {
+        candidates.push('/usr/bin/sqlite3', '/opt/homebrew/bin/sqlite3', '/usr/local/bin/sqlite3', '/opt/local/bin/sqlite3');
+    }
+    else if (process.platform === 'linux') {
+        candidates.push('/usr/bin/sqlite3', '/usr/local/bin/sqlite3');
+    }
+    else if (process.platform === 'win32') {
+        const pf = process.env.ProgramFiles;
+        if (pf) {
+            candidates.push(join(pf, 'Git', 'usr', 'bin', 'sqlite3.exe'));
+        }
+    }
+    for (const p of candidates) {
+        if (p && existsSync(p)) {
+            cached = p;
+            return cached;
+        }
+    }
+    try {
+        if (process.platform === 'win32') {
+            const out = execFileSync('where.exe', ['sqlite3'], {
+                encoding: 'utf8',
+                stdio: ['ignore', 'pipe', 'ignore'],
+            }).trim();
+            const first = out.split(/\r?\n/).find((line) => {
+                const t = line.trim();
+                return t.length > 0 && existsSync(t);
+            });
+            if (first) {
+                cached = first.trim();
+                return cached;
+            }
+        }
+        else {
+            for (const whichBin of ['which', '/usr/bin/which']) {
+                try {
+                    const out = execFileSync(whichBin, ['sqlite3'], {
+                        encoding: 'utf8',
+                        stdio: ['ignore', 'pipe', 'ignore'],
+                    }).trim();
+                    const first = out.split(/\n/)[0]?.trim();
+                    if (first && existsSync(first)) {
+                        cached = first;
+                        return cached;
+                    }
+                }
+                catch {
+                    /* try next */
+                }
+            }
+        }
+    }
+    catch {
+        /* fall through */
+    }
+    try {
+        execFileSync('sqlite3', ['--version'], { stdio: 'ignore' });
+        cached = 'sqlite3';
+        return cached;
+    }
+    catch {
+        cached = null;
+        return null;
+    }
+}
+/** Test-only: reset memoized path after env/path changes. */
+export function clearSqlite3BinaryCacheForTests() {
+    cached = undefined;
+}
+/**
+ * Run the sqlite3 CLI with `-escape off` inserted before the trailing dbPath argument, so raw
+ * control-byte output (our char(30)/char(31) row/field separators, or any control byte in a
+ * stored value) survives instead of being rendered as printable caret-notation text — the
+ * default in sqlite3 CLI builds that support `-escape` (added alongside the `-escape symbol`
+ * default; confirmed present in a macOS-bundled 3.51.0 from 2025-06).
+ *
+ * Falls back to the same call without `-escape off` if the flag itself isn't recognized (an
+ * older CLI predating the flag also predates the `-escape symbol` default that motivates it, so
+ * dropping the flag there is safe, not a silent behavior change). `argsWithDbPathLast`'s last
+ * element must be the database path.
+ */
+export function execSqlite3(sqlite3, argsWithDbPathLast, input) {
+    const dbPath = argsWithDbPathLast[argsWithDbPathLast.length - 1];
+    const leadingArgs = argsWithDbPathLast.slice(0, -1);
+    const options = {
+        input,
+        encoding: 'utf8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+    };
+    try {
+        return execFileSync(sqlite3, [...leadingArgs, '-escape', 'off', dbPath], options);
+    }
+    catch (err) {
+        try {
+            return execFileSync(sqlite3, argsWithDbPathLast, options);
+        }
+        catch {
+            throw err;
+        }
+    }
+}

package/dist/log_config_files/runtime/trusted_restarts.js

@@ -0,0 +1,113 @@
+/**
+ * Execute autofix restart_command strings only if allowlisted (same rules as gate enqueue).
+ * Used by the compliance shell hook via execute_trusted_restarts CLI — single place for allowlist + spawn.
+ */
+import { spawn } from 'node:child_process';
+import { appendComplianceRunnerLine, hookRunLog } from './hook_logger.js';
+import { getActiveComplianceLogPath } from './compliance_session_log.js';
+import { getDeferredVscdbRestartLogPath } from './management_storage.js';
+import { normalizeAgentToken } from './compliance_check.js';
+import { isClaudeRestartCommand, isCursorRestartCommand, isTrustedRestartCommandForAutofix } from './remediation_sync.js';
+import { resolveProjectRoot } from './workspace_repo.js';
+const FALLBACK_PATH = '/usr/bin:/bin:/usr/local/bin:/opt/homebrew/bin';
+/** Vars set by `npx --package=...` that break unrelated scoped `npx @scope/pkg` after Cursor reopen. */
+const NPM_RESTART_POLLUTION = [
+    'npm_config_package',
+    'npm_lifecycle_event',
+    'npm_lifecycle_script',
+    'npm_config_local_prefix',
+];
+function envForRestartSpawn(base) {
+    const env = { ...base };
+    for (const key of NPM_RESTART_POLLUTION) {
+        delete env[key];
+    }
+    return env;
+}
+function isDeferredVscdbRestart(cmd) {
+    return cmd.includes('OPTIMUS_DEFERRED_LOG') || cmd.includes('apply_deferred_vscdb');
+}
+function currentAgentFromEnv() {
+    // Keep restart scoping consistent with remediation scoping:
+    // prefer OPTIMUS_AGENT override, then fall back to OPTIMUS_HOOK_TYPE.
+    const override = normalizeAgentToken(process.env.OPTIMUS_AGENT);
+    if (override === 'cursor')
+        return 'cursor';
+    if (override === 'copilot')
+        return 'copilot';
+    if (override === 'opencode')
+        return 'opencode';
+    if (override === 'codex')
+        return 'codex';
+    if (override === 'claude' || override === 'claude_desktop')
+        return 'claude';
+    const hookType = normalizeAgentToken(process.env.OPTIMUS_HOOK_TYPE);
+    if (hookType === 'cursor')
+        return 'cursor';
+    if (hookType === 'copilot')
+        return 'copilot';
+    if (hookType === 'opencode')
+        return 'opencode';
+    if (hookType === 'codex')
+        return 'codex';
+    return 'claude';
+}
+/** Spawn each trusted command detached (same pattern as former compliance_prompt_gate fireRestartCommands). */
+export function executeTrustedRestartCommands(commands) {
+    const agent = currentAgentFromEnv();
+    for (const cmd of commands) {
+        const t = cmd.trim();
+        if (!t)
+            continue;
+        if (!isTrustedRestartCommandForAutofix(cmd)) {
+            const msg = `rejected_not_allowlisted prefix=${t.slice(0, 200)}`;
+            hookRunLog(`execute_trusted_restarts: ${msg}`);
+            appendComplianceRunnerLine('RESTART', msg);
+            continue;
+        }
+        // Safety: never restart the wrong app for the current hook type.
+        if (agent === 'cursor' && isClaudeRestartCommand(t)) {
+            const msg = 'rejected_claude_restart_in_cursor_hook';
+            hookRunLog(`execute_trusted_restarts: ${msg}`);
+            appendComplianceRunnerLine('RESTART', msg);
+            continue;
+        }
+        if (agent === 'claude' && isCursorRestartCommand(t)) {
+            const msg = 'rejected_cursor_restart_in_claude_hook';
+            hookRunLog(`execute_trusted_restarts: ${msg}`);
+            appendComplianceRunnerLine('RESTART', msg);
+            continue;
+        }
+        const deferred = isDeferredVscdbRestart(t);
+        const detailPath = getDeferredVscdbRestartLogPath();
+        if (deferred) {
+            hookRunLog(`execute_trusted_restarts: spawning deferred state.vscdb restart (killall Cursor, then apply + reopen). Step-by-step log → ${detailPath}`);
+            appendComplianceRunnerLine('RESTART', `spawn deferred_vscdb_restart sh -c (detail_log=${detailPath}) cwd_inherited_from_node`);
+        }
+        else {
+            hookRunLog('execute_trusted_restarts: spawning trusted restart (see compliance session log [RESTART])');
+            appendComplianceRunnerLine('RESTART', 'spawn trusted_restart sh -c (non-deferred)');
+        }
+        const projectRoot = resolveProjectRoot();
+        const complianceLogPath = getActiveComplianceLogPath();
+        const child = spawn('sh', ['-c', t], {
+            detached: true,
+            stdio: 'ignore',
+            cwd: projectRoot,
+            env: envForRestartSpawn({
+                ...process.env,
+                CURSOR_PROJECT_DIR: process.env.CURSOR_PROJECT_DIR || projectRoot,
+                ...(complianceLogPath ? { OPTIMUS_COMPLIANCE_LOG: complianceLogPath } : {}),
+                PATH: process.env.PATH && String(process.env.PATH).trim().length > 0
+                    ? process.env.PATH
+                    : FALLBACK_PATH,
+            }),
+        });
+        child.on('error', (err) => {
+            const emsg = err instanceof Error ? err.message : String(err);
+            hookRunLog(`execute_trusted_restarts: spawn failed ${emsg}`);
+            appendComplianceRunnerLine('RESTART', `spawn_error ${emsg}`);
+        });
+        child.unref();
+    }
+}

package/dist/log_config_files/runtime/workspace_repo.js

@@ -0,0 +1,170 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { hookRunLog } from './hook_logger.js';
+const GIT_TIMEOUT_MS = 3000;
+const MAX_WALK_UP = 25;
+function gitRemoteInDir(dir) {
+    try {
+        return execFileSync('git', ['remote', '-v'], {
+            cwd: dir,
+            timeout: GIT_TIMEOUT_MS,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+    }
+    catch {
+        return '';
+    }
+}
+function gitToplevelFromDir(dir) {
+    try {
+        return execFileSync('git', ['rev-parse', '--show-toplevel'], {
+            cwd: dir,
+            timeout: GIT_TIMEOUT_MS,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+    }
+    catch {
+        return '';
+    }
+}
+export function resolveProjectDirFromEnv() {
+    for (const candidate of [
+        process.env.OPTIMUS_PROJECT_DIR,
+        process.env.CLAUDE_PROJECT_DIR,
+        process.env.CURSOR_PROJECT_DIR,
+    ]) {
+        const dir = (candidate || '').trim();
+        if (dir && fs.existsSync(dir))
+            return dir;
+    }
+    return '';
+}
+export function resolveWorkspaceRepoFromEnv() {
+    for (const candidate of [
+        process.env.OPTIMUS_WORKSPACE_REPO,
+        process.env.GITHUB_REPOSITORY,
+        process.env.GH_REPOSITORY,
+    ]) {
+        const value = (candidate || '').trim();
+        if (value)
+            return value;
+    }
+    return '';
+}
+function expandManifestPath(filePath) {
+    const trimmed = (filePath || '').trim();
+    if (!trimmed)
+        return '';
+    if (trimmed.startsWith('/'))
+        return trimmed;
+    if (/^Users-[^/]+/.test(trimmed)) {
+        return path.join(os.homedir(), '.cursor', 'projects', trimmed);
+    }
+    return path.resolve(trimmed);
+}
+export function resolveRepoFromPath(filePath) {
+    const remote = gitRemoteFromPathWalk(filePath);
+    return remote || resolveWorkspaceRepoFromEnv();
+}
+function gitRemoteFromPathWalk(filePath) {
+    let dir = expandManifestPath(filePath);
+    if (!dir)
+        return '';
+    try {
+        if (fs.existsSync(dir) && fs.statSync(dir).isFile())
+            dir = path.dirname(dir);
+        else if (!fs.existsSync(dir))
+            dir = path.dirname(dir);
+    }
+    catch {
+        dir = path.dirname(dir);
+    }
+    for (let i = 0; i < MAX_WALK_UP; i++) {
+        const remote = gitRemoteInDir(dir);
+        if (remote)
+            return remote;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return '';
+}
+function manifestPathPriority(filePath) {
+    if (filePath.startsWith('/Users/') || filePath.startsWith('/home/'))
+        return 0;
+    if (filePath.startsWith('/'))
+        return 1;
+    if (/^Users-[^/]+/.test(filePath))
+        return 2;
+    return 3;
+}
+export function resolveWorkspaceRepoFromManifest(manifest) {
+    if (!manifest.length)
+        return '';
+    const candidates = [...manifest]
+        .map((entry) => (entry || '').trim())
+        .filter(Boolean)
+        .sort((a, b) => manifestPathPriority(a) - manifestPathPriority(b));
+    for (const candidate of candidates) {
+        const remote = gitRemoteFromPathWalk(candidate);
+        if (remote)
+            return remote;
+    }
+    return '';
+}
+export function resolveWorkspaceRepo(manifest) {
+    const fromEnv = resolveWorkspaceRepoFromEnv();
+    if (fromEnv) {
+        hookRunLog(`workspace_repo: env (${fromEnv.slice(0, 80)}${fromEnv.length > 80 ? '…' : ''})`);
+        return fromEnv;
+    }
+    const projectDir = resolveProjectDirFromEnv();
+    if (projectDir) {
+        const remote = gitRemoteInDir(projectDir);
+        if (remote) {
+            hookRunLog(`workspace_repo: project_dir (${projectDir})`);
+            return remote;
+        }
+    }
+    const cwdRemote = gitRemoteInDir(process.cwd());
+    if (cwdRemote) {
+        hookRunLog(`workspace_repo: cwd (${process.cwd()})`);
+        return cwdRemote;
+    }
+    if (manifest?.length) {
+        const fromManifest = resolveWorkspaceRepoFromManifest(manifest);
+        if (fromManifest) {
+            hookRunLog('workspace_repo: manifest');
+            return fromManifest;
+        }
+    }
+    hookRunLog(`workspace_repo: unresolved (project_dir=${projectDir || 'unset'} cwd=${process.cwd()})`);
+    return '';
+}
+export function resolveProjectRoot() {
+    const projectDir = resolveProjectDirFromEnv();
+    if (projectDir) {
+        const top = gitToplevelFromDir(projectDir);
+        if (top)
+            return top;
+        return projectDir;
+    }
+    const cwdTop = gitToplevelFromDir(process.cwd());
+    if (cwdTop)
+        return cwdTop;
+    return process.cwd();
+}
+export function ensureWorkspaceRepoEnv(manifest) {
+    const resolved = resolveWorkspaceRepo(manifest);
+    if (resolved) {
+        process.env.OPTIMUS_WORKSPACE_REPO = resolved;
+        if (!process.env.GITHUB_REPOSITORY)
+            process.env.GITHUB_REPOSITORY = resolved;
+    }
+    return resolved;
+}

package/dist/log_config_files/runtime/worktree_absent.js

@@ -0,0 +1,50 @@
+import { executeBody } from '../../endpoint_client/http_transport.js';
+import { buildApiUrl } from '../../endpoint_client/registry_api.js';
+import { loadEndpointBase } from '../sender/endpoint_config.js';
+import { createSignature } from '../sender/signing.js';
+import { readStoredAuthKey } from '../auth/auth_key_store.js';
+import { tryResolveHardwareUuid } from './hardware_uuid.js';
+import { hookRunLog } from './hook_logger.js';
+import { normalizePathForWorktree } from './worktree_scanner.js';
+/**
+ * Notify server that worktree directories are gone so inventory/findings are pruned.
+ */
+export function reportAbsentWorktrees(entries) {
+    const authKey = readStoredAuthKey();
+    if (!authKey) {
+        hookRunLog('worktree_absent: no auth key, skipping');
+        return Promise.resolve();
+    }
+    const hardwareUuid = tryResolveHardwareUuid();
+    if (!hardwareUuid) {
+        hookRunLog('worktree_absent: no hardware uuid, skipping');
+        return Promise.resolve();
+    }
+    const absent_worktrees = entries
+        .map((e) => ({
+        worktree_root: normalizePathForWorktree(e.worktree_root).replace(/\/+$/, ''),
+        reason: (e.reason || 'path_missing').slice(0, 64),
+    }))
+        .filter((e) => e.worktree_root)
+        .sort((a, b) => a.worktree_root.localeCompare(b.worktree_root));
+    if (absent_worktrees.length === 0) {
+        return Promise.resolve();
+    }
+    const endpointBase = loadEndpointBase();
+    const url = buildApiUrl(endpointBase, '/endpoint_security/worktree-absent/');
+    const payload = { hardware_uuid: hardwareUuid, absent_worktrees };
+    const signature = createSignature(payload, authKey.key);
+    const body = JSON.stringify({ ...payload, signature, key_id: authKey.key_id || '' });
+    return executeBody(url, 'POST', body, 8000)
+        .then(({ statusCode }) => {
+        if (statusCode !== 200) {
+            hookRunLog(`worktree_absent: server returned ${statusCode}`);
+        }
+        else {
+            hookRunLog(`worktree_absent: reported ${absent_worktrees.length} root(s)`);
+        }
+    })
+        .catch((err) => {
+        hookRunLog(`worktree_absent: request failed: ${err instanceof Error ? err.message : String(err)}`);
+    });
+}