@optimuslabs/harness-map-staging 1.5.21 → 1.5.22

package/dist/log_uuid/installed_hook_hashes.js

@@ -0,0 +1,50 @@
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+/**
+ * Where install.sh places each agent's Optimus hooks, relative to $HOME. Hashing every
+ * agent's copy on each inventory run lets the server spot an edited hook without waiting
+ * for that particular agent to be launched.
+ */
+const AGENT_HOOK_DIRS = {
+    claude: '.claude/hooks',
+    cursor: '.cursor/hooks',
+    copilot: '.copilot/hooks',
+    codex: '.codex/hooks',
+    opencode: '.config/opencode/plugins',
+};
+/** Optimus-shipped hook files (optimus-*.sh, plus OpenCode's optimus-*.ts plugin). */
+const HOOK_FILE = /^optimus-.+\.(sh|ts)$/;
+/**
+ * SHA-256 of every installed Optimus hook file, keyed "agent/hook-name" (file name without
+ * extension) — the same keys the hook scripts send in OPTIMUS_HOOK_MANIFEST. Missing or
+ * unreadable directories/files are skipped; never throws.
+ */
+export function collectInstalledHookHashes(home = os.homedir()) {
+    const hashes = {};
+    for (const [agent, relDir] of Object.entries(AGENT_HOOK_DIRS)) {
+        const dir = path.join(home, relDir);
+        let entries;
+        try {
+            entries = fs.readdirSync(dir);
+        }
+        catch {
+            continue;
+        }
+        if (!Array.isArray(entries))
+            continue;
+        for (const name of entries) {
+            if (!HOOK_FILE.test(name))
+                continue;
+            try {
+                const digest = createHash('sha256').update(fs.readFileSync(path.join(dir, name))).digest('hex');
+                hashes[`${agent}/${path.parse(name).name}`] = digest;
+            }
+            catch {
+                // unreadable — skip
+            }
+        }
+    }
+    return hashes;
+}

package/dist/log_uuid/startup_sender.js

@@ -5,6 +5,7 @@ import { resolveHardwareUuid } from './hardware_uuid.js';
 import { writeAuthKey, readStoredAuthKey, loadEndpointBase, buildStartupEndpointUrl } from './auth_key_store.js';
 import { resolveUserProfile } from './user_profile.js';
 import { resolveWorkspaceRepo } from '../log_config_files/runtime/workspace_repo.js';
+import { collectInstalledHookHashes } from './installed_hook_hashes.js';
 import { persistCollectPromptsFromResponse } from '../log_config_files/runtime/prompt-collection-policy.js';
 import fs from 'node:fs';
 import os from 'node:os';
@@ -59,7 +60,8 @@ const getMetadata = () => ({
     commit_sha: process.env.GITHUB_SHA || '',
     agent_name: process.env.OPTIMUS_AGENT || '',
     user_profile: { ...resolveUserProfile() },
-    hook_manifest: parseHookManifest(),
+    // Every installed agent's hooks from disk, not just the launching agent's (OPTIMUS_HOOK_MANIFEST).
+    hook_manifest: { ...parseHookManifest(), ...collectInstalledHookHashes() },
 });
 function buildRequestBody(hardwareUuid, timestamp) {
     const payloadSummary = { timestamp, directory: process.cwd(), hardware_uuid: hardwareUuid };
@@ -89,7 +91,8 @@ const maybeSendToEndpoint = async (hardwareUuid, timestamp, options = {}) => {
         console.log(result.message);
         if (result.branch === 'key_issued' && result.key) {
             writeAuthKey(result.key, result.keyId, hardwareUuid);
-            const manifest = parseHookManifest();
+            // What was actually sent (env manifest + on-disk hashes): the server only records it signed.
+            const manifest = requestBody.metadata.hook_manifest;
             if (options.allowKeyIssuedRetry !== false &&
                 Object.keys(manifest).length > 0) {
                 return maybeSendToEndpoint(hardwareUuid, new Date().toISOString(), {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.21",
+  "version": "1.5.22",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {