@optimuslabs/harness-map-staging 1.5.18 → 1.5.20

package/dist/log_config_files/runtime/compliance_check.js

@@ -89,6 +89,12 @@ function targetsCurrentAgent(entry, agent) {
         complianceRunnerDiag(`Ignoring remediation with unknown target_agent: ${t}`);
         return false;
     }
+    // Claude Desktop cannot run hooks, so nothing ever executes with --agent=claude_desktop and
+    // these rows would otherwise never be applied by anyone. The Claude Code hook owns them: it
+    // writes Desktop's own config file and the spec's restart_command relaunches the app
+    // (trusted_restarts already maps claude_desktop -> claude for exactly this reason).
+    if (normalized === 'claude_desktop' && agent === 'claude')
+        return true;
     return normalized === agent;
 }
 // ---------------------------------------------------------------------------
@@ -361,6 +367,28 @@ function violationFromCheck(entry, compliance, check, expected) {
         message: `[${compliance.finding_formatted_id}] ${entry.finding_title ?? compliance.description}\nDescription: ${entry.finding_description ?? compliance.description}\nHow to fix: Apply remediation ops for ${check.setting_path} in ${entry.config_file_path}`,
     };
 }
+/**
+ * True when a secret-scan hit sits at (or under) a path this remediation has ops for.
+ *
+ * The scan reads the whole file, but the entry only carries ops for its own checks. Blocking on
+ * any other hit pins the row non-compliant forever -- the gate re-prompts on every turn with a fix
+ * that cannot resolve it (e.g. Claude Code's own 64-hex `machineID` matching a provider pattern).
+ */
+function secretFindingIsOwnedByEntry(findingPath, entry, checks) {
+    return checks.some((check) => {
+        const target = canonicalComplianceSettingPath(entry.config_file_path, check);
+        if (!target)
+            return false;
+        if (target.includes('*')) {
+            const pattern = target
+                .split('.')
+                .map((seg) => (seg === '*' ? '[^.]+' : seg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')))
+                .join('\\.');
+            return new RegExp(`^${pattern}(\\.|$)`).test(findingPath);
+        }
+        return findingPath === target || findingPath.startsWith(`${target}.`);
+    });
+}
 /** Evaluate one manifest row against on-disk config (used by gate + post-restart verify). */
 export function evaluateManifestEntryCompliance(entry) {
     const compliance = entry.fix ?? entry.compliance;
@@ -370,11 +398,15 @@ export function evaluateManifestEntryCompliance(entry) {
     if (checks.length === 0)
         return { violations: [] };
     const loaded = loadRemediationConfigJson(entry.config_file_path, checks.map((c) => c.setting_path));
-    if (!loaded.ok)
-        return { violations: [] };
+    if (!loaded.ok) {
+        // A config we cannot read is not a config we can call compliant. file_not_found is genuinely
+        // compliant (the config is gone); any other reason means the file is there and we simply could
+        // not parse it, so callers must not treat the empty violation list as "verified".
+        return { violations: [], unevaluable: loaded.reason !== 'file_not_found' };
+    }
     const configJson = loaded.json;
     if (compliance.requires_secret_scan === true) {
-        const secretFindings = scanJsonForHardcodedSecrets(configJson);
+        const secretFindings = scanJsonForHardcodedSecrets(configJson).filter((f) => secretFindingIsOwnedByEntry(f.path, entry, checks));
         return secretFindings.length === 0
             ? { violations: [] }
             : {
@@ -565,8 +597,12 @@ export function reportPostRestartVerificationOutcomes(violations) {
     const entriesByUuid = new Map(remediations.map((entry) => [entry.uuid, entry]));
     const outcomes = processPendingPostRestartVerifications((uuid) => {
         const entry = entriesByUuid.get(uuid);
-        if (entry && collectManifestEntryViolations(entry).length > 0)
-            return true;
+        if (entry) {
+            // Unreadable config counts as still-violating: never verify what could not be checked.
+            const { violations: entryViolations, unevaluable } = evaluateManifestEntryCompliance(entry);
+            if (unevaluable || entryViolations.length > 0)
+                return true;
+        }
         return violations.some((v) => v.uuid === uuid);
     });
     const reportPromises = outcomes.map((o) => {
@@ -597,6 +633,35 @@ export async function runPostApplyVerification(agent = 'cursor') {
     }
     return outcomes;
 }
+/**
+ * Re-read the remediated config so the server can verify the apply instead of trusting the report.
+ *
+ * Without a snapshot the server's post-apply re-check has nothing to evaluate and clears the
+ * linked findings on the endpoint's word alone -- the same blind close that let a fix that never
+ * happened be recorded as remediated. vscdb-backed paths are not JSON files, so they stay absent.
+ */
+function configSnapshotForReport(configFilePath) {
+    const diskPath = resolveRemediationConfigPath(configFilePath);
+    if (diskPath.includes('#'))
+        return undefined;
+    try {
+        const parsed = parseJsonWithJsoncFallback(readFileSync(diskPath, 'utf8'));
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        /* unreadable: report without a snapshot rather than failing the report */
+    }
+    return undefined;
+}
+/** Report an apply outcome, attaching the on-disk config only when it can actually be read. */
+function reportAutofixWithSnapshot(uuid, result, configFilePath) {
+    const snapshot = configSnapshotForReport(configFilePath);
+    return snapshot
+        ? reportAutofixApplied(uuid, result, { config_snapshot_after: snapshot })
+        : reportAutofixApplied(uuid, result);
+}
 /**
  * Immediate autofix succeeded (inline recheck OK or Claude stale-recheck tolerance).
  * Clear pending verification locally and report verified so the next prompt does not POST
@@ -605,7 +670,7 @@ export async function runPostApplyVerification(agent = 'cursor') {
 export function confirmAppliedAutofixVerified(appliedViolations, reportPromises) {
     for (const v of appliedViolations) {
         markRemediationApplyVerified(v.uuid);
-        reportPromises.push(reportAutofixApplied(v.uuid, 'verified'));
+        reportPromises.push(reportAutofixWithSnapshot(v.uuid, 'verified', v.config_file_path));
     }
 }
 export function applyAutofixViolations(violations, agent = 'cursor') {
@@ -682,7 +747,7 @@ export function applyAutofixViolations(violations, agent = 'cursor') {
         fixed++;
         appliedViolations.push(violation);
         hookRunLog(`autofix: applied uuid=${inst.uuid} path=${configPathForDisk}`);
-        reportPromises.push(reportAutofixApplied(inst.uuid, 'success'));
+        reportPromises.push(reportAutofixWithSnapshot(inst.uuid, 'success', inst.config_file_path));
         // Every successful autofix (Cursor + Claude, restart or immediate JSON) awaits verification on
         // the next compliance check so we can quarantine stuck applies and stop restart/retry loops.
         markRemediationApplyPendingVerification(inst.uuid);
@@ -904,8 +969,8 @@ export function uploadSatisfiedManifestConfigs(agent = 'cursor') {
     const entries = remediations.filter((e) => targetsCurrentAgent(e, agent));
     const promises = [];
     for (const entry of entries) {
-        const { violations } = evaluateManifestEntryCompliance(entry);
-        if (violations.length > 0)
+        const { violations, unevaluable } = evaluateManifestEntryCompliance(entry);
+        if (violations.length > 0 || unevaluable)
             continue;
         const inst = entry;
         const uploadFileType = resolveRemediationUploadFileType(entry.config_file_path, inst.file_type ?? undefined);
@@ -969,8 +1034,8 @@ export function reportCompliantRemediationVerifiedStatus(agent = 'cursor') {
     const entries = remediations.filter((e) => targetsCurrentAgent(e, agent));
     const promises = [];
     for (const entry of entries) {
-        const { violations } = evaluateManifestEntryCompliance(entry);
-        if (violations.length > 0)
+        const { violations, unevaluable } = evaluateManifestEntryCompliance(entry);
+        if (violations.length > 0 || unevaluable)
             continue;
         const tracking = readRemediationApplyTrackingFile();
         const prev = tracking.entries[entry.uuid];
@@ -982,7 +1047,13 @@ export function reportCompliantRemediationVerifiedStatus(agent = 'cursor') {
         const rawContent = parseJsonWithJsoncFallback(readFileSync(diskPath, 'utf8'));
         if (rawContent === null)
             continue;
-        promises.push(reportAutofixApplied(entry.uuid, 'verified', { config_snapshot_after: rawContent }).then(() => {
+        promises.push(
+        // Nothing was applied on this path, so before === after. Sending both makes a no-op
+        // "verified" distinguishable from a real apply in EnforcementLog.
+        reportAutofixApplied(entry.uuid, 'verified', {
+            config_snapshot_before: rawContent,
+            config_snapshot_after: rawContent,
+        }).then(() => {
             markRemediationApplyVerified(entry.uuid);
             hookRunLog(`compliance_check: reported verified (already compliant) uuid=${entry.uuid}`);
         }));

package/dist/log_config_files/runtime/remediation_sync.js

@@ -264,16 +264,46 @@ async function fetchManifest(endpointBase, machineUuid, uuids, timeoutMs = 8000)
 // Enforce / remove
 // ---------------------------------------------------------------------------
 function setByPath(obj, path, value) {
-    const parts = path.split('.');
+    const parts = path.split('.').filter((part) => part.length > 0);
+    if (parts.length === 0)
+        return;
     let current = obj;
     for (let i = 0; i < parts.length - 1; i++) {
         const part = parts[i];
-        if (current[part] == null || typeof current[part] !== 'object' || Array.isArray(current[part])) {
-            current[part] = {};
+        if (Array.isArray(current)) {
+            if (!/^\d+$/.test(part))
+                return;
+            const idx = Number(part);
+            if (idx >= current.length)
+                return;
+            current = current[idx];
+            continue;
         }
-        current = current[part];
+        if (current == null || typeof current !== 'object')
+            return;
+        const rec = current;
+        const next = rec[part];
+        if (Array.isArray(next)) {
+            current = next;
+            continue;
+        }
+        if (next == null || typeof next !== 'object') {
+            rec[part] = {};
+        }
+        current = rec[part];
+    }
+    const leaf = parts[parts.length - 1];
+    if (Array.isArray(current)) {
+        if (!/^\d+$/.test(leaf))
+            return;
+        const idx = Number(leaf);
+        if (idx >= 0 && idx < current.length)
+            current[idx] = value;
+        return;
+    }
+    if (current != null && typeof current === 'object') {
+        current[leaf] = value;
     }
-    current[parts[parts.length - 1]] = value;
 }
 /** Traverse a JSON object using dot-notation path. Returns undefined if any segment is missing. */
 function getByPath(obj, path) {
@@ -557,9 +587,20 @@ const TRUSTED_CURSOR_JSON_SETTINGS_RESTART_COMMAND_LEGACY = 'CURSOR_PROJECT=$(gi
 const TRUSTED_CURSOR_JSON_SETTINGS_RESTART_COMMAND = 'REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd) && export REPO_ROOT && ' +
     'CURSOR_PROJECT="${CURSOR_PROJECT_DIR:-$REPO_ROOT}" && export CURSOR_PROJECT && ' +
     "nohup bash -c 'sleep 2 && open -a Cursor \"$CURSOR_PROJECT\"' >/dev/null 2>&1 & killall -9 Cursor";
-const TRUSTED_CLAUDE_RESTART_COMMAND = "nohup bash -c 'sleep 2 && open -a Claude' >/dev/null 2>&1 & pkill -x 'Claude'";
+/** Pre-wait-loop command; still accepted so an older manifest keeps restarting on a new client. */
+const TRUSTED_CLAUDE_RESTART_COMMAND_LEGACY = "nohup bash -c 'sleep 2 && open -a Claude' >/dev/null 2>&1 & pkill -x 'Claude'";
+/**
+ * Relaunch Claude Desktop once it has actually exited.
+ *
+ * The legacy command killed the app and relaunched after a flat 2s. A quit that takes longer (state
+ * save) meant `open -a Claude` landed while the app was still terminating, the launch was coalesced
+ * into the dying instance, and Desktop never came back. Poll for exit instead, bounded at ~20s.
+ * executeTrustedRestartCommands already spawns this detached, so it runs inline (no nohup/&).
+ */
+const TRUSTED_CLAUDE_RESTART_COMMAND = "pkill -x 'Claude'; for i in $(seq 1 80); do pgrep -x 'Claude' >/dev/null || break; sleep 0.25; done; open -a Claude";
 export function isClaudeRestartCommand(cmd) {
-    return cmd.trim() === TRUSTED_CLAUDE_RESTART_COMMAND;
+    const t = cmd.trim();
+    return t === TRUSTED_CLAUDE_RESTART_COMMAND || t === TRUSTED_CLAUDE_RESTART_COMMAND_LEGACY;
 }
 export function isCursorRestartCommand(cmd) {
     const t = cmd.trim();
@@ -579,7 +620,8 @@ export function isTrustedRestartCommandForAutofix(cmd) {
     return (t === TRUSTED_CURSOR_SQLITE_DEFERRED_RESTART_COMMAND ||
         t === TRUSTED_CURSOR_JSON_SETTINGS_RESTART_COMMAND ||
         t === TRUSTED_CURSOR_JSON_SETTINGS_RESTART_COMMAND_LEGACY ||
-        t === TRUSTED_CLAUDE_RESTART_COMMAND);
+        t === TRUSTED_CLAUDE_RESTART_COMMAND ||
+        t === TRUSTED_CLAUDE_RESTART_COMMAND_LEGACY);
 }
 /** Legacy Cursor: dedicated ItemTable row `composerState`. Current Cursor: nested under reactive `applicationUser` blob. */
 function cursorVscdbHasUsableComposerStateRow(dbPath, sqliteOp) {
@@ -1537,6 +1579,9 @@ export function reportAutofixApplied(remediationUuid, result, details) {
     if (details?.config_snapshot_after && typeof details.config_snapshot_after === 'object') {
         bodyPayload.config_snapshot_after = details.config_snapshot_after;
     }
+    if (details?.config_snapshot_before && typeof details.config_snapshot_before === 'object') {
+        bodyPayload.config_snapshot_before = details.config_snapshot_before;
+    }
     const signature = createSignature(payload, authKey.key);
     const body = JSON.stringify({ ...bodyPayload, signature });
     return executeBody(url, 'POST', body, 8000)

package/dist/log_config_files/runtime/secret_regex_scan.js

@@ -38,10 +38,12 @@ const KNOWN_SECRET_PATTERNS = [
     { re: /ASIA[0-9A-Z]{16}/i, label: 'AWS temporary access key ID' },
     { re: /AIza[0-9A-Za-z_-]{35}/i, label: 'Google API key' },
     { re: /ya29\.[0-9A-Za-z_-]+/i, label: 'Google OAuth access token' },
-    { re: /AC[a-z0-9]{32}/i, label: 'Twilio account SID' },
-    { re: /SK[a-z0-9]{32}/i, label: 'Twilio API key' },
+    // Anchored + case-sensitive: Twilio SIDs are uppercase AC/SK + exactly 32 hex. Unanchored
+    // /AC[a-z0-9]{32}/i matched any long hex string containing "ac" (e.g. a 64-hex machine id).
+    { re: /\bAC[a-f0-9]{32}\b/, label: 'Twilio account SID' },
+    { re: /\bSK[a-f0-9]{32}\b/, label: 'Twilio API key' },
     { re: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/i, label: 'SendGrid API key' },
-    { re: /key-[a-f0-9]{32}/i, label: 'Mailgun API key' },
+    { re: /\bkey-[a-f0-9]{32}\b/i, label: 'Mailgun API key' },
     { re: /npm_[a-zA-Z0-9]{36}/i, label: 'npm access token' },
     { re: /pypi-[a-zA-Z0-9_-]{50,}/i, label: 'PyPI API token' },
     { re: /discord(?:app)?\.com\/api\/webhooks\/\d+\/[a-zA-Z0-9_-]+/i, label: 'Discord webhook URL' },
@@ -55,9 +57,14 @@ const KNOWN_SECRET_PATTERNS = [
     { re: /dop_v1_[a-f0-9]{64}/i, label: 'DigitalOcean personal access token' },
     { re: /pat_[a-zA-Z0-9]{22}_[a-fA-F0-9]{59}/i, label: 'Atlassian API token' },
     { re: /Bearer\s+[a-zA-Z0-9\-_.]{20,}/i, label: 'Bearer token' },
+    // Isolated 32-hex (Azure OpenAI). Lookarounds keep a longer hex string from matching.
+    // Same pattern as HardcodedSecretRule — MCP tokens in args (ISO-005) are this shape.
+    { re: /(?<![a-zA-Z0-9])[a-fA-F0-9]{32}(?![a-zA-Z0-9])/, label: 'Azure OpenAI key' },
 ];
 const BASIC_AUTH_IN_URL = /[a-zA-Z0-9._%+-]+:[a-zA-Z0-9._%+-]+@/gi;
-const GENERIC_TOKEN = /\b[a-zA-Z0-9]{32,}\b/g;
+// Hyphens/underscores count as part of one token so hyphenated keys (ctx7sk-..., sk-ant-...)
+// are measured as a single candidate instead of segment-by-segment (matches HardcodedSecretRule).
+const GENERIC_TOKEN = /\b[a-zA-Z0-9][a-zA-Z0-9_-]{31,}\b/g;
 const GENERIC_KEY_HINT = /(?:api[_-]?key|app[_-]?key|secret|token|password|passwd|pass\b|(?<!o)auth|credential|private[_-]?key|access[_-]?key|master[_-]?key)/i;
 function basicAuthMatchIsCredential(value, matchIndex) {
     const before = value.slice(0, matchIndex);
@@ -70,6 +77,20 @@ function basicAuthMatchIsCredential(value, matchIndex) {
 function looksLikeUrlContext(value) {
     return value.includes(':') && (value.toLowerCase().includes('http') || value.includes('://'));
 }
+/**
+ * Values to run GENERIC_TOKEN against. A URL's host/path is skipped (high false-positive rate),
+ * but query-string values are scanned — MCP tokens commonly live there. Mirrors
+ * HardcodedSecretRule._generic_token_scan_targets.
+ */
+function genericTokenScanTargets(value) {
+    if (!looksLikeUrlContext(value))
+        return [value];
+    const queryStart = value.indexOf('?');
+    if (queryStart === -1)
+        return [];
+    const query = value.slice(queryStart + 1).split('#')[0] ?? '';
+    return [...new URLSearchParams(query).values()];
+}
 /**
  * Scan one scalar config value. Returns secret type label or null if clean / env-backed.
  */
@@ -89,12 +110,14 @@ export function scanScalarForHardcodedSecret(value, keyName) {
             return 'Basic authentication credentials';
         }
     }
-    if (!GENERIC_KEY_HINT.test(keyName) || looksLikeUrlContext(valueStr)) {
+    if (!GENERIC_KEY_HINT.test(keyName)) {
         return null;
     }
-    const genericMatches = valueStr.match(GENERIC_TOKEN) ?? [];
-    if (genericMatches.some((token) => token.length >= 40)) {
-        return 'Potential token/secret';
+    for (const target of genericTokenScanTargets(valueStr)) {
+        const genericMatches = target.match(GENERIC_TOKEN) ?? [];
+        if (genericMatches.some((token) => token.length >= 40)) {
+            return 'Potential token/secret';
+        }
     }
     return null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.18",
+  "version": "1.5.20",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {