@optimuslabs/harness-map-staging 1.5.16

package/dist/log_config_files/collection/cursor_token_usage_collector.js

@@ -0,0 +1,192 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { execSqlite3, resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
+/**
+ * Session / version / identity aggregator for Cursor.
+ *
+ * Cursor stores everything in a VSCode-style SQLite state DB at
+ * ~/Library/Application Support/Cursor/User/globalStorage/state.vscdb (macOS).
+ * Two tables carry the data we need:
+ *   ItemTable       — key/value store: Cursor version, cursorAuth/* identity rows
+ *   cursorDiskKV    — key/value store: composerData:<conversationId> entries,
+ *                     each with a JSON blob carrying createdAt, modelConfig.modelName
+ *
+ * We read identity (email, plan, version) from ItemTable and aggregate session counts +
+ * model names from composerData entries in cursorDiskKV, bounded to the last 30 days.
+ * Token counts are no longer written by Cursor 3.8+ so totals are always 0 — `model_token_split`
+ * therefore carries per-model composer COUNTs, not tokens (same convention as Cowork's
+ * session-count split), so the Agent Profile can still surface a "Most used model".
+ * No message content is read — only model names and timestamps.
+ */
+const TOKEN_USAGE_RECENCY_DAYS = 30;
+const TOKEN_USAGE_FILE_TYPE = 'cursor_token_usage';
+const ROW_SEP = '\x1e';
+const FIELD_SEP = '\x1f';
+/** Platform-aware path to Cursor's global state.vscdb. */
+function vscdbPath(home) {
+    if (process.platform === 'darwin') {
+        return join(home, 'Library', 'Application Support', 'Cursor', 'User', 'globalStorage', 'state.vscdb');
+    }
+    if (process.platform === 'linux') {
+        return join(home, '.config', 'Cursor', 'User', 'globalStorage', 'state.vscdb');
+    }
+    // Windows: AppData/Roaming/Cursor/...
+    const appdata = process.env['APPDATA'] || join(home, 'AppData', 'Roaming');
+    return join(appdata, 'Cursor', 'User', 'globalStorage', 'state.vscdb');
+}
+function querySqlite(sqlite3, dbPath, sql) {
+    try {
+        return execSqlite3(sqlite3, ['-readonly', '-noheader', dbPath], `.timeout 5000\n${sql}\n`);
+    }
+    catch {
+        return null;
+    }
+}
+function num(value) {
+    if (typeof value === 'number' && Number.isFinite(value))
+        return value;
+    if (typeof value === 'string') {
+        const n = parseInt(value, 10);
+        return Number.isFinite(n) ? n : 0;
+    }
+    return 0;
+}
+/**
+ * Aggregate Cursor token usage / sessions / version / identity from state.vscdb.
+ * Returns a single-element array (one per-machine aggregate) or [] when no usable DB exists.
+ */
+function collectCursorTokenUsage(home = homedir()) {
+    const dbPath = vscdbPath(home);
+    if (!existsSync(dbPath))
+        return [];
+    const cutoffMs = Date.now() - TOKEN_USAGE_RECENCY_DAYS * 24 * 60 * 60 * 1000;
+    const sqlite3 = resolveSqlite3Binary();
+    if (!sqlite3)
+        return [];
+    // Identity: version, email, plan, subscription status, sign-up type, display name.
+    const identityRaw = querySqlite(sqlite3, dbPath, `SELECT key || char(31) || COALESCE(value, '') || char(30)
+     FROM ItemTable
+     WHERE key IN (
+       'cursor.startupMetrics.lastVersion',
+       'cursorAuth/cachedEmail',
+       'cursorAuth/stripeMembershipType',
+       'cursorAuth/stripeSubscriptionStatus',
+       'cursorAuth/cachedSignUpType',
+       'cursorAuth/cachedScopedProfile'
+     );`);
+    let version = '';
+    let email = '';
+    let plan = '';
+    let subscriptionStatus = '';
+    let signUpType = '';
+    let displayName = '';
+    if (identityRaw) {
+        for (const row of identityRaw.split(ROW_SEP)) {
+            const trimmed = row.trim();
+            if (!trimmed)
+                continue;
+            const sep = trimmed.indexOf(FIELD_SEP);
+            if (sep === -1)
+                continue;
+            const key = trimmed.slice(0, sep);
+            const value = trimmed.slice(sep + 1);
+            switch (key) {
+                case 'cursor.startupMetrics.lastVersion':
+                    version = value;
+                    break;
+                case 'cursorAuth/cachedEmail':
+                    email = value;
+                    break;
+                case 'cursorAuth/stripeMembershipType':
+                    plan = value;
+                    break;
+                case 'cursorAuth/stripeSubscriptionStatus':
+                    subscriptionStatus = value;
+                    break;
+                case 'cursorAuth/cachedSignUpType':
+                    signUpType = value;
+                    break;
+                case 'cursorAuth/cachedScopedProfile':
+                    try {
+                        const profile = JSON.parse(value);
+                        if (typeof profile['displayName'] === 'string')
+                            displayName = profile['displayName'];
+                    }
+                    catch {
+                        /* non-JSON or missing — skip */
+                    }
+                    break;
+            }
+        }
+    }
+    // Usage: aggregate session counts and model names from composerData entries in the last 30
+    // days. composerData:<conversationId> entries carry a Unix ms timestamp in $.createdAt and
+    // the model in $.modelConfig.modelName. Token counts are not written by Cursor 3.8+.
+    // cutoffMs is a safe integer — interpolating directly avoids an extra round-trip.
+    // key range (not LIKE 'composerData:%') so the query hits the primary-key index on `key`
+    // instead of a full-table scan. SQLite's LIKE optimizer only rewrites a prefix match to an
+    // index range scan when the comparison is case-sensitive: either PRAGMA case_sensitive_like
+    // is ON (with `key`'s default BINARY collation), or the column itself uses NOCASE collation.
+    // Neither holds here, so LIKE 'composerData:%' would fall back to a full scan of cursorDiskKV.
+    // ';' is the char after ':' in ASCII, so [composerData: , composerData;) is exactly the
+    // composerData:* prefix range. Note: this also makes the match case-sensitive (BINARY
+    // collation), narrower than the old case-insensitive LIKE — safe because Cursor always
+    // writes this key prefix as the exact literal 'composerData:', never a different casing.
+    const usageRaw = querySqlite(sqlite3, dbPath, `SELECT
+       COALESCE(json_extract(value, '$.modelConfig.modelName'), 'default') || char(31) ||
+       COUNT(*) || char(30)
+     FROM cursorDiskKV
+     WHERE key >= 'composerData:' AND key < 'composerData;'
+       AND CAST(json_extract(value, '$.createdAt') AS INTEGER) >= ${cutoffMs}
+     GROUP BY json_extract(value, '$.modelConfig.modelName');`);
+    const models = new Set();
+    let sessionCount = 0;
+    // Cursor 3.8+ doesn't write token counts, so there's no real per-model token weighting — the
+    // per-model composer COUNT from the query above is the only usage-weight signal available.
+    // Mirrors Cowork's session-count convention (see cowork_extract.py): "Most used model" is
+    // derived from whichever model has the most composers, not the most tokens.
+    const modelComposerCounts = {};
+    if (usageRaw) {
+        for (const row of usageRaw.split(ROW_SEP)) {
+            const trimmed = row.trim();
+            if (!trimmed)
+                continue;
+            const sep = trimmed.indexOf(FIELD_SEP);
+            if (sep === -1)
+                continue;
+            const model = trimmed.slice(0, sep).trim();
+            const cnt = num(trimmed.slice(sep + 1));
+            sessionCount += cnt;
+            if (model) {
+                models.add(model);
+                modelComposerCounts[model] = (modelComposerCounts[model] ?? 0) + cnt;
+            }
+        }
+    }
+    if (sessionCount === 0 && !email && !version)
+        return [];
+    return [
+        {
+            file_type: TOKEN_USAGE_FILE_TYPE,
+            file_path: dbPath,
+            raw_content: {
+                version,
+                session_count: sessionCount,
+                models: [...models].sort(),
+                model_token_split: modelComposerCounts,
+                window_days: TOKEN_USAGE_RECENCY_DAYS,
+                totals: {
+                    input_tokens: 0,
+                    output_tokens: 0,
+                },
+                email,
+                display_name: displayName,
+                plan,
+                subscription_status: subscriptionStatus,
+                auth_method: signUpType ? 'cursor_account' : '',
+            },
+        },
+    ];
+}
+export { collectCursorTokenUsage, TOKEN_USAGE_RECENCY_DAYS, TOKEN_USAGE_FILE_TYPE, vscdbPath };

package/dist/log_config_files/collection/directory_collector.js

@@ -0,0 +1,126 @@
+import { existsSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { readJSONFile, readMarkdownFile } from '../readers/file_readers.js';
+function collectSubdirMdFiles(dirPath, fileType, mdFilename, source) {
+    const results = [];
+    try {
+        for (const entry of readdirSync(dirPath, { withFileTypes: true })) {
+            if (!entry.isDirectory())
+                continue;
+            const mdPath = join(dirPath, entry.name, mdFilename);
+            if (!existsSync(mdPath))
+                continue;
+            const content = readMarkdownFile(mdPath);
+            if (content !== null)
+                results.push({ file_type: fileType, file_path: mdPath, raw_content: { content, source } });
+        }
+    }
+    catch (err) {
+        console.warn(`Error reading ${dirPath}:`, err instanceof Error ? err.message : String(err));
+    }
+    return results;
+}
+function collectDirectoryEntries(t) {
+    if (!existsSync(t.path))
+        return [];
+    const results = [];
+    const glob = t.dir_glob || '*.md';
+    const matchName = (name) => glob.startsWith('*') ? name.endsWith(glob.slice(1)) : name === glob;
+    try {
+        const entries = readdirSync(t.path, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isFile() || !matchName(entry.name))
+                continue;
+            const fullPath = join(t.path, entry.name);
+            // Prefer parsed JSON for .json files so backend/policy engine see top-level keys (e.g. permissions.allow)
+            const content = entry.name.endsWith('.json')
+                ? readJSONFile(fullPath) ?? readMarkdownFile(fullPath)
+                : readMarkdownFile(fullPath) ?? readJSONFile(fullPath);
+            if (content !== null) {
+                const raw = typeof content === 'string' ? { content, source: 'file' } : content;
+                results.push({ file_type: t.file_type, file_path: fullPath, raw_content: raw });
+            }
+        }
+        if (t.dir_subdir_filename && t.dir_subdir_source) {
+            results.push(...collectSubdirMdFiles(t.path, t.file_type, t.dir_subdir_filename, t.dir_subdir_source));
+        }
+    }
+    catch (err) {
+        console.warn(`Error reading directory ${t.path}:`, err instanceof Error ? err.message : String(err));
+    }
+    return results;
+}
+const METADATA_DIR_SCAN_MAX_DEPTH = 8;
+function matchesDirGlob(name, glob) {
+    if (glob === '*')
+        return true;
+    // **/*.jsonl → match any extension suffix after **/
+    if (glob.startsWith('**/')) {
+        const suffix = glob.slice(3);
+        if (suffix === '*' || suffix === '**')
+            return true;
+        if (suffix.startsWith('*.'))
+            return name.endsWith(suffix.slice(1));
+        return name === suffix;
+    }
+    if (glob.startsWith('*.'))
+        return name.endsWith(glob.slice(1));
+    return name === glob;
+}
+/** Walk dir tree (bounded depth) and return the file with the highest mtime matching dir_glob. */
+function findNewestMatchingFile(dirPath, glob, depth, maxDepth) {
+    let best = null;
+    try {
+        for (const entry of readdirSync(dirPath, { withFileTypes: true })) {
+            const fullPath = join(dirPath, entry.name);
+            if (entry.isFile() && matchesDirGlob(entry.name, glob)) {
+                try {
+                    const fileStat = statSync(fullPath);
+                    if (!best || fileStat.mtime > best.mtime) {
+                        best = { path: fullPath, mtime: fileStat.mtime };
+                    }
+                }
+                catch { /* ignore unreadable files */ }
+            }
+            else if (entry.isDirectory() && depth < maxDepth) {
+                const nested = findNewestMatchingFile(fullPath, glob, depth + 1, maxDepth);
+                if (nested && (!best || nested.mtime > best.mtime)) {
+                    best = nested;
+                }
+            }
+        }
+    }
+    catch { /* ignore unreadable dir */ }
+    return best;
+}
+/**
+ * For metadata-style DIR targets: recursively scan files matching dir_glob, return one entry
+ * with the highest mtime found. Falls back to the directory's own mtime if no files match.
+ */
+function collectDirectoryMetadata(t) {
+    try {
+        const dirStat = statSync(t.path);
+        const glob = t.dir_glob ?? '*';
+        // A "|"-delimited dir_glob is an ordered priority list: use the newest match of the FIRST
+        // glob that matches anything, so e.g. "**/*.jsonl|**/*" prefers a session transcript
+        // (events.jsonl) over any other session-state file — even when a non-jsonl file is newer.
+        let newest = null;
+        for (const g of glob.split('|')) {
+            newest = findNewestMatchingFile(t.path, g, 0, METADATA_DIR_SCAN_MAX_DEPTH);
+            if (newest)
+                break;
+        }
+        const bestPath = newest?.path ?? t.path;
+        const bestMtime = newest?.mtime ?? dirStat.mtime;
+        return {
+            file_type: t.file_type,
+            file_path: bestPath,
+            raw_content: { filename: bestPath, last_modified: bestMtime.toISOString(), source: 'file_metadata' },
+            collect_style: 'metadata',
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export { collectDirectoryEntries, collectDirectoryMetadata };

package/dist/log_config_files/collection/enrichment_helpers.js

@@ -0,0 +1,53 @@
+import { join } from 'node:path';
+import { readJSONFile } from '../readers/file_readers.js';
+function getByPath(obj, dotPath) {
+    let cur = obj;
+    for (const part of dotPath.split('.')) {
+        if (cur == null || typeof cur !== 'object')
+            return undefined;
+        cur = cur[part];
+    }
+    return cur;
+}
+function resolveEntryVersion(e, vf) {
+    const v = e.version;
+    if (v !== undefined && v !== null && (typeof v !== 'string' || v.trim() !== ''))
+        return;
+    const basePath = (e.installPath?.trim() || e.sourcePath?.trim());
+    if (!basePath || !vf.version_key)
+        return;
+    const pkg = readJSONFile(join(basePath, 'package.json'));
+    const versionVal = pkg ? pkg[vf.version_key] : undefined;
+    if (typeof versionVal === 'string')
+        e.version = versionVal.trim();
+}
+function enrichRawFromRecipe(raw, recipe) {
+    const installsPath = recipe.installs_path ?? recipe.installs_path_fallback;
+    if (!installsPath)
+        return;
+    let installs = getByPath(raw, installsPath);
+    if (!installs && recipe.installs_path_fallback && recipe.installs_path_fallback !== installsPath) {
+        installs = getByPath(raw, recipe.installs_path_fallback);
+    }
+    if (!installs || !recipe.version_from_file?.version_key)
+        return;
+    const vf = recipe.version_from_file;
+    if (recipe.installs_shape === 'array' && Array.isArray(installs)) {
+        for (const entry of installs) {
+            if (typeof entry === 'object' && entry !== null)
+                resolveEntryVersion(entry, vf);
+        }
+    }
+    else if (typeof installs === 'object' && installs !== null) {
+        for (const key of Object.keys(installs)) {
+            const entry = installs[key];
+            if (typeof entry === 'object' && entry !== null) {
+                const e = entry;
+                if (recipe.installs_shape === 'object' && !('id' in e && e.id != null))
+                    e.id = key;
+                resolveEntryVersion(e, vf);
+            }
+        }
+    }
+}
+export { getByPath, enrichRawFromRecipe };

package/dist/log_config_files/collection/ensure_cursor_user_settings_snapshot.js

@@ -0,0 +1,50 @@
+import { existsSync } from 'node:fs';
+import { readJSONFile } from '../readers/file_readers.js';
+import { PORTABLE_CURSOR_USER_SETTINGS, cursorUserSettingsAbsolutePaths, } from '../runtime/remediation_config_path.js';
+export function isPortableCursorUserSettingsUploadPath(filePath) {
+    const p = filePath.replace(/\\/g, '/').toLowerCase();
+    return (p === 'cursor/user/settings.json' ||
+        p.endsWith('/cursor/user/settings.json') ||
+        p.includes('application support/cursor/user/settings.json'));
+}
+function settingsPayloadHasGlobalIgnoreListKey(raw) {
+    if (!raw || typeof raw !== 'object')
+        return false;
+    const nested = raw.cursor
+        ?.general?.globalCursorIgnoreList;
+    if (Array.isArray(nested))
+        return true;
+    const flat = raw['cursor.general.globalCursorIgnoreList'];
+    return Array.isArray(flat);
+}
+/**
+ * Sensitive Directories scans need full User/settings.json (globalCursorIgnoreList).
+ * Pattern collection can omit the key or send an empty object; merge disk when the batch
+ * lacks an explicit globalCursorIgnoreList array (including []).
+ */
+export function ensureCursorUserSettingsSnapshotInBatch(configFiles) {
+    const hasIgnoreKeyInBatch = configFiles.some((c) => c.file_type === 'vscode_settings' &&
+        isPortableCursorUserSettingsUploadPath(c.file_path) &&
+        settingsPayloadHasGlobalIgnoreListKey(c.raw_content));
+    if (hasIgnoreKeyInBatch)
+        return;
+    for (const abs of cursorUserSettingsAbsolutePaths()) {
+        if (!existsSync(abs))
+            continue;
+        const raw = readJSONFile(abs);
+        if (!raw || Object.keys(raw).length === 0)
+            continue;
+        const entry = {
+            file_type: 'vscode_settings',
+            file_path: PORTABLE_CURSOR_USER_SETTINGS,
+            raw_content: raw,
+        };
+        const idx = configFiles.findIndex((c) => c.file_type === 'vscode_settings' &&
+            isPortableCursorUserSettingsUploadPath(c.file_path));
+        if (idx >= 0)
+            configFiles[idx] = entry;
+        else
+            configFiles.push(entry);
+        return;
+    }
+}

package/dist/log_config_files/collection/file_type_rules.js

@@ -0,0 +1,47 @@
+/**
+ * File type detection from path — API-driven only.
+ *
+ * The backend (file_path_registry) is the single source of truth for path → file_type.
+ * This module matches a concrete path against the patterns returned by the file collection API;
+ * no hardcoded path rules. When patterns are missing (e.g. API unavailable), returns null.
+ */
+/**
+ * Determine file_type for a path using API patterns only (longest match wins).
+ * Returns null if patterns are missing/empty or no pattern matches.
+ */
+export function determineFileTypeFromPath(filePath, patterns) {
+    if (!filePath || !patterns?.length)
+        return null;
+    const norm = filePath.replace(/\\/g, '/');
+    // API patterns are already ordered by descending pattern length (backend).
+    for (const p of patterns) {
+        const pat = p.path.replace(/\\/g, '/').replace(/^~\/?/, '');
+        if (!pat)
+            continue;
+        if (pat.includes('*')) {
+            if (matchGlob(norm, pat))
+                return p.file_type;
+        }
+        else {
+            if (norm === pat || norm.endsWith('/' + pat) || norm.includes(pat))
+                return p.file_type;
+        }
+    }
+    return null;
+}
+/** Simple glob: * = one segment, ** = any path. */
+function matchGlob(path, pattern) {
+    const re = pattern
+        .replace(/\\/g, '/')
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replace(/\*\*/g, '\u0001')
+        .replace(/\*/g, '[^/]*')
+        .replace(/\u0001/g, '.*');
+    try {
+        const regex = new RegExp(re);
+        return regex.test(path);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/log_config_files/collection/grok_cli_version_collector.js

@@ -0,0 +1,53 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * Grok CLI version, read directly from the installed binary.
+ *
+ * Grok ships as a standalone native binary (not an npm/pip package, no manifest to read a
+ * version out of), installed at ~/.grok/bin/grok and typically symlinked onto PATH. The only
+ * way to get its version is to run it: `grok --version` prints e.g. "grok 0.2.114 (0c785038798)".
+ */
+const FILE_TYPE = 'grok_cli_version';
+const VERSION_RE = /^grok\s+(\d+\.\d+\.\d+)(?:\s+\(([0-9a-f]+)\))?/i;
+function grokBinPath(home) {
+    return join(home, '.grok', 'bin', 'grok');
+}
+/** `<binPath> --version`, parsed into {version, build, raw}, or null if unavailable/unparsable. */
+function readGrokVersion(binPath) {
+    let stdout;
+    try {
+        stdout = execFileSync(binPath, ['--version'], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 5000,
+        }).trim();
+    }
+    catch {
+        return null;
+    }
+    const match = VERSION_RE.exec(stdout);
+    if (!match)
+        return null;
+    return { version: match[1], build: match[2] ?? '', raw: stdout };
+}
+/**
+ * Emit the Grok CLI version as a single-element aggregate, or [] when Grok isn't installed
+ * or its version can't be determined.
+ */
+function collectGrokCliVersion(home = homedir(), binPath = grokBinPath(home)) {
+    if (!existsSync(binPath))
+        return [];
+    const parsed = readGrokVersion(binPath);
+    if (!parsed)
+        return [];
+    return [
+        {
+            file_type: FILE_TYPE,
+            file_path: binPath,
+            raw_content: parsed,
+        },
+    ];
+}
+export { collectGrokCliVersion, FILE_TYPE as GROK_CLI_VERSION_FILE_TYPE };