@optimuslabs/harness-map-staging 1.5.16

package/dist/log_config_files/collection/copilot_token_usage_collector.js

@@ -0,0 +1,167 @@
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * Token-usage / session / CLI-version aggregator for GitHub Copilot CLI.
+ *
+ * Copilot CLI writes one transcript per session under ~/.copilot/session-state/<id>/events.jsonl.
+ * Each transcript's `session.start` carries `copilotVersion` + `selectedModel`; its
+ * `session.shutdown` carries `tokenDetails` ({input,output,cache_read}.tokenCount),
+ * `totalPremiumRequests`, and per-model `modelMetrics`. We aggregate the *numbers* (and version /
+ * model ids) on the endpoint and emit only those — never transcript content.
+ *
+ * Per-model split uses each model's `modelMetrics.<model>.tokenDetails` — NOT its sibling
+ * `modelMetrics.<model>.usage` — because `usage.{input,output,cacheRead}Tokens` counts a larger,
+ * differently-scoped quantity (confirmed on a real transcript: usage.inputTokens was ~25x the
+ * session's own top-level tokenDetails.input.tokenCount for the same shutdown event, apparently
+ * including reprocessed/cumulative context rather than the exchange delta). Each model's nested
+ * `tokenDetails` mirrors the top-level `tokenDetails` shape and, for a single-model session,
+ * its exact values — so summing nested tokenDetails per model stays consistent with the
+ * top-level `totals` this same function computes, unlike `usage`.
+ *
+ * Bounded by mtime recency so a large session history is not fully re-parsed on every hook run.
+ */
+const TOKEN_USAGE_RECENCY_DAYS = 30;
+const TOKEN_USAGE_FILE_TYPE = 'copilot_token_usage';
+function emptyTotals() {
+    return { input_tokens: 0, output_tokens: 0, cache_read_input_tokens: 0 };
+}
+function num(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : 0;
+}
+function asObject(value) {
+    return value && typeof value === 'object' ? value : {};
+}
+/** session.shutdown.tokenDetails → {input,output,cache_read}.tokenCount */
+function addTokenDetails(totals, tokenDetails) {
+    totals.input_tokens += num(asObject(tokenDetails.input).tokenCount);
+    totals.output_tokens += num(asObject(tokenDetails.output).tokenCount);
+    totals.cache_read_input_tokens += num(asObject(tokenDetails.cache_read).tokenCount);
+}
+/** Recursively collect events.jsonl files whose mtime is within the recency window. */
+function recentEventFiles(dir, cutoffMs) {
+    const out = [];
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const entry of entries) {
+        const full = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            out.push(...recentEventFiles(full, cutoffMs));
+        }
+        else if (entry.isFile() && entry.name === 'events.jsonl') {
+            try {
+                if (statSync(full).mtimeMs >= cutoffMs)
+                    out.push(full);
+            }
+            catch {
+                /* unreadable — skip */
+            }
+        }
+    }
+    return out;
+}
+/**
+ * Aggregate Copilot token usage / session count / version across recent session transcripts.
+ * Returns a single-element array (one per-machine aggregate) or [] when there is no recent data.
+ */
+function collectCopilotTokenUsage(home = homedir()) {
+    const sessionsDir = join(home, '.copilot', 'session-state');
+    if (!existsSync(sessionsDir))
+        return [];
+    const cutoffMs = Date.now() - TOKEN_USAGE_RECENCY_DAYS * 24 * 60 * 60 * 1000;
+    const files = recentEventFiles(sessionsDir, cutoffMs);
+    if (files.length === 0)
+        return [];
+    const totals = emptyTotals();
+    const sessions = new Set();
+    const models = new Set();
+    const modelTokenSplit = {};
+    let premiumRequests = 0;
+    let version = '';
+    let versionAt = -1;
+    let sawData = false;
+    for (const file of files) {
+        let content;
+        try {
+            content = readFileSync(file, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        for (const line of content.split('\n')) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            let entry;
+            try {
+                entry = JSON.parse(trimmed);
+            }
+            catch {
+                continue;
+            }
+            sawData = true;
+            const type = entry.type;
+            const data = asObject(entry.data);
+            const sessionId = data.sessionId;
+            if (typeof sessionId === 'string' && sessionId)
+                sessions.add(sessionId);
+            if (type === 'session.start') {
+                // Keep the copilotVersion from the most recently started session.
+                const startTime = num(data.startTime);
+                const v = data.copilotVersion;
+                if (typeof v === 'string' && v && startTime >= versionAt) {
+                    version = v;
+                    versionAt = startTime;
+                }
+                if (typeof data.selectedModel === 'string' && data.selectedModel) {
+                    models.add(data.selectedModel);
+                }
+            }
+            else if (type === 'assistant.message') {
+                if (typeof data.model === 'string' && data.model)
+                    models.add(data.model);
+            }
+            else if (type === 'session.shutdown') {
+                premiumRequests += num(data.totalPremiumRequests);
+                addTokenDetails(totals, asObject(data.tokenDetails));
+                const modelMetrics = asObject(data.modelMetrics);
+                for (const [model, metrics] of Object.entries(modelMetrics)) {
+                    models.add(model);
+                    // tokenDetails, not usage — see the module docstring's note on why usage.* isn't
+                    // comparable to the top-level tokenDetails-derived `totals`.
+                    const modelTokenDetails = asObject(asObject(metrics).tokenDetails);
+                    const sum = num(asObject(modelTokenDetails.input).tokenCount) +
+                        num(asObject(modelTokenDetails.output).tokenCount) +
+                        num(asObject(modelTokenDetails.cache_read).tokenCount);
+                    if (sum > 0)
+                        modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + sum;
+                }
+            }
+        }
+    }
+    if (!sawData)
+        return [];
+    // Sessions without a sessionId in data still count via their transcript file.
+    const sessionCount = Math.max(sessions.size, files.length);
+    return [
+        {
+            file_type: TOKEN_USAGE_FILE_TYPE,
+            file_path: sessionsDir, // stable synthetic path → one aggregate row per machine
+            raw_content: {
+                version,
+                session_count: sessionCount,
+                models: [...models].sort(),
+                premium_requests: premiumRequests,
+                model_token_split: modelTokenSplit,
+                window_days: TOKEN_USAGE_RECENCY_DAYS,
+                totals,
+            },
+        },
+    ];
+}
+export { collectCopilotTokenUsage, TOKEN_USAGE_RECENCY_DAYS, TOKEN_USAGE_FILE_TYPE };

package/dist/log_config_files/collection/cowork_desktop_version_collector.js

@@ -0,0 +1,60 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * Claude Desktop app version, surfaced as Cowork's Agent Profile `agent_version`.
+ *
+ * Cowork has no per-session version signal — its `local_<sessionId>.json` session files
+ * (see cowork_session_whitelist.ts) carry no version field, confirmed against a live install.
+ * Cowork runs inside the Claude Desktop app rather than as a standalone CLI, so the app's own
+ * bundle version is the only real "version" available for it: `CFBundleShortVersionString` from
+ * Claude.app's Info.plist, read via `plutil` (a stock macOS binary — no new dependency, same
+ * shell-out pattern as the sqlite3-based collectors).
+ *
+ * Gated on the Cowork enablement marker (~/Library/Application Support/Claude/
+ * cowork-enabled-cli-ops.json) so a machine with Claude Desktop installed but Cowork never
+ * enabled doesn't get an agent=cowork version row. macOS only — Claude Desktop/Cowork ships on
+ * macOS today.
+ */
+const FILE_TYPE = 'cowork_desktop_version';
+const BUNDLE_VERSION_KEY = 'CFBundleShortVersionString';
+const CLAUDE_APP_INFO_PLIST = '/Applications/Claude.app/Contents/Info.plist';
+function coworkEnabledMarkerPath(home) {
+    return join(home, 'Library', 'Application Support', 'Claude', 'cowork-enabled-cli-ops.json');
+}
+/** `plutil -extract CFBundleShortVersionString raw <path>`, or '' when plutil/the plist is unavailable. */
+function readBundleVersion(plistPath) {
+    try {
+        return execFileSync('/usr/bin/plutil', ['-extract', BUNDLE_VERSION_KEY, 'raw', plistPath], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Emit the Claude Desktop app version as a single-element aggregate, or [] when this isn't
+ * macOS, Cowork isn't enabled on this machine, or Claude.app/plutil is unavailable.
+ */
+function collectCoworkDesktopVersion(home = homedir(), plistPath = CLAUDE_APP_INFO_PLIST) {
+    if (process.platform !== 'darwin')
+        return [];
+    if (!existsSync(coworkEnabledMarkerPath(home)))
+        return [];
+    if (!existsSync(plistPath))
+        return [];
+    const version = readBundleVersion(plistPath);
+    if (!version)
+        return [];
+    return [
+        {
+            file_type: FILE_TYPE,
+            file_path: plistPath,
+            raw_content: { version },
+        },
+    ];
+}
+export { collectCoworkDesktopVersion, FILE_TYPE as COWORK_DESKTOP_VERSION_FILE_TYPE };

package/dist/log_config_files/collection/cowork_session_whitelist.js

@@ -0,0 +1,89 @@
+/**
+ * PII boundary for Cowork session metadata (`local_<sessionId>.json`).
+ *
+ * Each Cowork session file carries ~47 KB of system prompt plus the user's
+ * conversation seed, selected folders, etc. We only need a small activity
+ * signal (which MCP servers were connected, recency, archived state). This
+ * reduces a parsed session object to a whitelist of top-level keys BEFORE it
+ * leaves the device — minimum-egress, matching DeepSecurityAndPrivacyEnhancer.
+ *
+ *   - Only the keys in ALLOWED_KEYS survive; everything else is dropped.
+ *   - `accountName` / `emailAddress` are sha256-hashed (cross-session joins
+ *     without storing raw identity).
+ *   - `remoteMcpServersConfig[]` keeps `{name, uuid, tools}` only; `url` is
+ *     dropped (remote-MCP endpoint URLs can embed workspace ids / tokens).
+ *
+ * The sibling `local_<sessionId>/` directory (audit.jsonl, outputs/, uploads/)
+ * is never collected — see the collection glob in agents/cowork.py. Server-side
+ * ingest re-validates the shape and rejects any denied key as defense in depth.
+ *
+ * See design_notes/Phase0_5CoworkActivityEvidence.md.
+ */
+import crypto from 'node:crypto';
+export const COWORK_SESSION_ALLOWED_KEYS = [
+    'sessionId',
+    'accountName', // hashed
+    'emailAddress', // hashed
+    'model',
+    'createdAt',
+    'lastActivityAt',
+    'isArchived',
+    'pluginsEnabled',
+    'skillsEnabled',
+    'memoryEnabled',
+    'hostLoopMode',
+    'cwd',
+    'enabledMcpTools', // dict "<serverUUID>:<tool>" -> bool
+    'remoteMcpServersConfig', // list of {name, uuid, tools} (url dropped)
+];
+const HASHED_KEYS = new Set(['accountName', 'emailAddress']);
+const REMOTE_SERVER_KEEP = ['name', 'uuid', 'tools'];
+function sha256Hex(value) {
+    return crypto.createHash('sha256').update(String(value)).digest('hex');
+}
+function sanitizeRemoteServers(value) {
+    if (!Array.isArray(value))
+        return [];
+    const out = [];
+    for (const entry of value) {
+        // Drop any non-object entry: a malformed/tampered remoteMcpServersConfig
+        // could carry a raw string (e.g. "https://…?token=…") that would otherwise
+        // survive the whitelist. Only keep whitelisted keys of well-formed objects.
+        if (entry === null || typeof entry !== 'object' || Array.isArray(entry))
+            continue;
+        const e = entry;
+        const kept = {};
+        for (const k of REMOTE_SERVER_KEEP) {
+            if (k in e)
+                kept[k] = e[k];
+        }
+        out.push(kept);
+    }
+    return out;
+}
+/**
+ * Reduce a parsed Cowork session object to the whitelisted, hashed shape.
+ * Returns `null` when nothing survives (e.g. a non-object or a file that
+ * failed to parse to the expected shape) so the caller can drop the entry
+ * rather than emit an empty row — and, critically, never emit raw content.
+ */
+export function applyCoworkSessionWhitelist(raw) {
+    if (raw === null || raw === undefined || typeof raw !== 'object')
+        return null;
+    const out = {};
+    for (const key of COWORK_SESSION_ALLOWED_KEYS) {
+        if (!(key in raw))
+            continue;
+        if (HASHED_KEYS.has(key)) {
+            const v = raw[key];
+            out[key] = v === null || v === undefined || v === '' ? '' : sha256Hex(v);
+        }
+        else if (key === 'remoteMcpServersConfig') {
+            out[key] = sanitizeRemoteServers(raw[key]);
+        }
+        else {
+            out[key] = raw[key];
+        }
+    }
+    return Object.keys(out).length > 0 ? out : null;
+}

package/dist/log_config_files/collection/cursor_project_mcp_collector.js

@@ -0,0 +1,230 @@
+import { existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { readJSONFile } from '../readers/file_readers.js';
+import { normalizePathSkipPrefixes } from '../paths/pattern_resolver.js';
+import { getCursorProjectsPath } from '../paths/path_constants_helpers.js';
+import { readVscdbItemTableJson } from '../readers/vscdb_reader.js';
+import { isStaleCursorProjectWorkspace } from './cursor_project_workspace_activity.js';
+/** Synthetic manifest path segment — not repo `.cursor/mcp.json`. */
+export const CURSOR_WORKSPACE_MCP_MANIFEST = 'cursor-workspace-mcp-servers.json';
+function fileUriToPath(uri) {
+    const trimmed = uri.trim();
+    if (!trimmed.startsWith('file://'))
+        return null;
+    let p = trimmed.slice('file://'.length);
+    if (!p.startsWith('/'))
+        p = `/${p}`;
+    try {
+        return decodeURIComponent(p);
+    }
+    catch {
+        return p;
+    }
+}
+function normalizeSlugPart(s) {
+    return s.replace(/\\/g, '/').replace(/_/g, '-').toLowerCase();
+}
+/** Best-effort: map a repo absolute path to Cursor's ~/.cursor/projects/<slug> dir name. */
+function cursorProjectSlugFromRepoPath(repoPath, home) {
+    const normHome = home.replace(/\\/g, '/').replace(/\/+$/, '');
+    const normPath = repoPath.replace(/\\/g, '/').replace(/\/+$/, '');
+    if (!normPath.startsWith(`${normHome}/`))
+        return '';
+    const homeSegs = normHome.split('/').filter(Boolean);
+    const tail = normPath.slice(normHome.length + 1);
+    const prefix = homeSegs.join('-');
+    const tailSlug = tail.split('/').join('-').replace(/_/g, '-');
+    return tailSlug ? `${prefix}-${tailSlug}` : prefix;
+}
+function loadWorkspaceMetadataEntries(spec, home) {
+    if (!spec?.global_vscdb_path_segments?.length || !spec.global_workspace_list_key)
+        return [];
+    const globalDbPath = join(home, ...spec.global_vscdb_path_segments);
+    if (!existsSync(globalDbPath))
+        return [];
+    const globalResult = readVscdbItemTableJson(globalDbPath, spec.global_workspace_list_key);
+    if (!globalResult)
+        return [];
+    const rawValue = globalResult[spec.global_workspace_list_key];
+    const entries = Array.isArray(rawValue)
+        ? rawValue
+        : Array.isArray(rawValue?.entries)
+            ? rawValue.entries
+            : [];
+    const out = [];
+    for (const entry of entries) {
+        if (!entry || typeof entry !== 'object')
+            continue;
+        const e = entry;
+        const row = {};
+        if (typeof e.displayPath === 'string')
+            row.displayPath = e.displayPath;
+        if (typeof e.folderUri === 'string')
+            row.folderUri = e.folderUri;
+        if (typeof e.workspaceId === 'string')
+            row.workspaceId = e.workspaceId;
+        out.push(row);
+    }
+    return out;
+}
+function workspaceMetaForSlug(slug, metadataEntries, home) {
+    const slugNorm = normalizeSlugPart(slug);
+    for (const entry of metadataEntries) {
+        if (entry.folderUri) {
+            const repoPath = fileUriToPath(entry.folderUri);
+            if (repoPath && normalizeSlugPart(cursorProjectSlugFromRepoPath(repoPath, home)) === slugNorm) {
+                return entry;
+            }
+        }
+        if (entry.displayPath) {
+            const expanded = entry.displayPath.startsWith('~/')
+                ? join(home, entry.displayPath.slice(2))
+                : entry.displayPath;
+            if (expanded && normalizeSlugPart(cursorProjectSlugFromRepoPath(expanded, home)) === slugNorm) {
+                return entry;
+            }
+        }
+    }
+    return undefined;
+}
+function mcpServerLabelFromMcpsDir(serverDirName, meta) {
+    const fromMeta = (typeof meta?.serverName === 'string' && meta.serverName) ||
+        (typeof meta?.serverIdentifier === 'string' && meta.serverIdentifier) ||
+        serverDirName;
+    if (fromMeta.startsWith('user-'))
+        return fromMeta.slice('user-'.length);
+    return fromMeta;
+}
+function isEphemeralCursorProjectDir(name) {
+    if (/^\d+$/.test(name))
+        return true;
+    return false;
+}
+/** Cursor uses this slug when no repo folder is open; mcps/ there are app-built-in only. */
+function isInternalCursorWorkspaceSlug(slug) {
+    return normalizeSlugPart(slug) === 'empty-window';
+}
+function readMcpToolCache(projectPath) {
+    const cachePath = join(projectPath, 'mcp-cache.json');
+    if (!existsSync(cachePath))
+        return null;
+    const cache = readJSONFile(cachePath);
+    if (cache && typeof cache === 'object' && !Array.isArray(cache)) {
+        return cache;
+    }
+    return null;
+}
+/** Tool schemas from mcp-cache.json for a connected mcps/ server (never creates inventory rows). */
+function cursorMcpCacheToolsForServer(cache, label, serverDirName) {
+    if (!cache)
+        return undefined;
+    const aliases = new Set();
+    const addAlias = (s) => {
+        const t = s.trim();
+        if (t)
+            aliases.add(t.toLowerCase());
+    };
+    addAlias(label);
+    addAlias(serverDirName);
+    if (serverDirName.startsWith('user-'))
+        addAlias(serverDirName.slice('user-'.length));
+    else
+        addAlias(`user-${label}`);
+    for (const [key, val] of Object.entries(cache)) {
+        if (!key.trim() || !aliases.has(key.trim().toLowerCase()))
+            continue;
+        if (val && typeof val === 'object' && Array.isArray(val.tools)) {
+            return val.tools;
+        }
+    }
+    return undefined;
+}
+/**
+ * Cursor stores per-workspace MCP state under ~/.cursor/projects/<slug>/ (mcp-cache.json, mcps/*).
+ * This is not the repo file at <repo>/.cursor/mcp.json. Upload one mcp_config per slug with
+ * mcpServers from mcps/ only; mcp-cache.json supplies supplementary tool schemas when names match.
+ */
+function collectCursorProjectWorkspaceMcpConfigs(pathSkipPrefixes = [], constants, workspaceVscdbSpec, home = homedir()) {
+    const skipPrefixes = normalizePathSkipPrefixes(pathSkipPrefixes);
+    const results = [];
+    const cursorProjectsPath = getCursorProjectsPath(home, constants);
+    const metadataEntries = loadWorkspaceMetadataEntries(workspaceVscdbSpec, home);
+    if (!existsSync(cursorProjectsPath))
+        return results;
+    let projectDirs;
+    try {
+        projectDirs = readdirSync(cursorProjectsPath, { withFileTypes: true }).filter((d) => d.isDirectory());
+    }
+    catch {
+        return results;
+    }
+    for (const projectDir of projectDirs) {
+        if (skipPrefixes.some((p) => projectDir.name.startsWith(p)))
+            continue;
+        if (isEphemeralCursorProjectDir(projectDir.name))
+            continue;
+        if (isInternalCursorWorkspaceSlug(projectDir.name))
+            continue;
+        const projectPath = join(cursorProjectsPath, projectDir.name);
+        if (isStaleCursorProjectWorkspace(projectPath))
+            continue;
+        const mcpServers = {};
+        const cachePath = join(projectPath, 'mcp-cache.json');
+        const mcpToolCache = readMcpToolCache(projectPath);
+        const mcpsPath = join(projectPath, 'mcps');
+        if (existsSync(mcpsPath)) {
+            try {
+                for (const serverDir of readdirSync(mcpsPath, { withFileTypes: true }).filter((d) => d.isDirectory())) {
+                    const metaPath = join(mcpsPath, serverDir.name, 'SERVER_METADATA.json');
+                    const meta = existsSync(metaPath) ? readJSONFile(metaPath) : null;
+                    const metaObj = meta && typeof meta === 'object' ? meta : null;
+                    const label = mcpServerLabelFromMcpsDir(serverDir.name, metaObj);
+                    if (!label)
+                        continue;
+                    if (label in mcpServers)
+                        continue;
+                    const entry = {
+                        cursor_source: 'mcps',
+                        server_identifier: serverDir.name,
+                    };
+                    if (metaObj) {
+                        entry.cursor_server_metadata = metaObj;
+                    }
+                    const cacheTools = cursorMcpCacheToolsForServer(mcpToolCache, label, serverDir.name);
+                    if (cacheTools !== undefined) {
+                        entry.cursor_mcp_cache_tools = cacheTools;
+                    }
+                    mcpServers[label] = entry;
+                }
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        if (Object.keys(mcpServers).length === 0)
+            continue;
+        const linked = workspaceMetaForSlug(projectDir.name, metadataEntries, home);
+        const linkedRepoPath = linked?.folderUri ? fileUriToPath(linked.folderUri) : null;
+        const manifestPath = existsSync(cachePath)
+            ? cachePath
+            : join(projectPath, CURSOR_WORKSPACE_MCP_MANIFEST);
+        results.push({
+            file_type: 'mcp_config',
+            file_path: manifestPath,
+            raw_content: {
+                mcpServers,
+                cursor_workspace: {
+                    slug: projectDir.name,
+                    collection_root: projectPath,
+                    display_path: linked?.displayPath,
+                    folder_uri: linked?.folderUri,
+                    linked_repo_path: linkedRepoPath ?? undefined,
+                    note: 'Cursor ~/.cursor/projects workspace MCP; not repo .cursor/mcp.json',
+                },
+            },
+        });
+    }
+    return results;
+}
+export { collectCursorProjectWorkspaceMcpConfigs, cursorProjectSlugFromRepoPath, fileUriToPath, isInternalCursorWorkspaceSlug, workspaceMetaForSlug, };

package/dist/log_config_files/collection/cursor_project_workspace_activity.js

@@ -0,0 +1,73 @@
+import { existsSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+/** Align with backend `AGENT_ACTIVITY_RECENCY_DAYS` — skip workspace MCP when idle longer. */
+export const CURSOR_WORKSPACE_MCP_RECENCY_DAYS = 7;
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+function maxMtimeInTree(root, maxDepth) {
+    if (!existsSync(root))
+        return null;
+    let best = null;
+    const visit = (dir, depth) => {
+        if (depth > maxDepth)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const fullPath = join(dir, entry.name);
+            try {
+                const st = statSync(fullPath);
+                const ms = st.mtimeMs;
+                if (best === null || ms > best)
+                    best = ms;
+                if (entry.isDirectory())
+                    visit(fullPath, depth + 1);
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    };
+    visit(root, 0);
+    return best;
+}
+function pushMtime(candidates, path) {
+    if (!existsSync(path))
+        return;
+    try {
+        candidates.push(statSync(path).mtimeMs);
+    }
+    catch {
+        /* ignore */
+    }
+}
+/**
+ * Latest filesystem activity under a Cursor ~/.cursor/projects/<slug> directory.
+ * Uses mcp-cache, mcps/, agent-tools/, terminals/, and the project root — not hook ingest time.
+ */
+function cursorProjectWorkspaceLatestActivityMs(projectPath) {
+    const candidates = [];
+    pushMtime(candidates, projectPath);
+    pushMtime(candidates, join(projectPath, 'mcp-cache.json'));
+    pushMtime(candidates, join(projectPath, 'terminals'));
+    for (const subdir of ['mcps', 'agent-tools']) {
+        const nested = maxMtimeInTree(join(projectPath, subdir), 5);
+        if (nested !== null)
+            candidates.push(nested);
+    }
+    if (candidates.length === 0)
+        return null;
+    return Math.max(...candidates);
+}
+function isStaleCursorProjectWorkspace(projectPath, recencyDays = CURSOR_WORKSPACE_MCP_RECENCY_DAYS, nowMs = Date.now()) {
+    const latest = cursorProjectWorkspaceLatestActivityMs(projectPath);
+    if (latest === null)
+        return true;
+    const cutoff = nowMs - recencyDays * MS_PER_DAY;
+    return latest < cutoff;
+}
+export { cursorProjectWorkspaceLatestActivityMs, isStaleCursorProjectWorkspace, maxMtimeInTree, };