@optimuslabs/harness-map-staging 1.5.22 → 1.5.24

package/dist/log_config_files/runtime/main_runner.js

@@ -223,9 +223,10 @@ async function addSensitivePathsAudit(endpointBase, configFiles) {
         configFiles.push({ file_type: 'sensitive_paths_audit', file_path: 'sensitive_paths_audit.txt', raw_content: { paths: auditResult.paths } });
     }
     catch (err) {
-        hookRunLog(`sensitive_paths_audit_error: ${err instanceof Error ? err.message : String(err)}`);
+        // Send no audit rather than an empty one: the backend keeps the machine's last good audit.
+        hookRunLog(`sensitive_paths_audit_error: ${err instanceof Error ? err.message : String(err)} (audit not sent)`);
         hookLogError('sensitive_paths_audit', err, { endpoint: endpointBase, output_dir: auditOutputDir });
-        configFiles.push({ file_type: 'sensitive_paths_audit', file_path: 'sensitive_paths_audit.txt', raw_content: { paths: [] } });
+        await reportFunctionalFailureAwait('inventory', 'sensitive_paths_audit', err);
     }
 }
 /** POSIX mode of every collected file, plus granted folders (and their ancestors) and sensitive audit hits within a budget. stat() only. */

package/dist/log_sensitive_paths_audit.js

@@ -62,14 +62,16 @@ export function writeSensitivePathsAudit(outputDir, pathTemplates, cwd = process
 /**
  * Run audit: fetch candidates from backend, check existence, write file. Returns paths for sending.
  * Used by log_config_files to include the audit in the same batch (same auth).
+ *
+ * Throws when the candidates can't be fetched: an audit run without them would report no
+ * sensitive paths, and sending it would replace the machine's last good audit on the backend.
  */
 export async function runSensitivePathsAudit(endpointBase, outputDir = join(homedir(), OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT), cwd = process.cwd()) {
     const response = await getSensitivePathsAuditCandidates(endpointBase);
-    const pathTemplates = response?.paths ?? [];
-    if (pathTemplates.length === 0 && !response) {
-        console.warn('Could not fetch sensitive path candidates from backend; writing empty audit.');
+    if (!response) {
+        throw new Error(`could not fetch sensitive path candidates from ${endpointBase}`);
     }
-    const paths = writeSensitivePathsAudit(outputDir, pathTemplates, cwd);
+    const paths = writeSensitivePathsAudit(outputDir, response.paths, cwd);
     const outPath = join(outputDir, AUDIT_FILENAME);
     console.log(`Sensitive paths audit written to ${outPath} (${paths.length} path(s) present).`);
     return { paths };

package/dist/log_uuid/startup_sender.js

@@ -64,8 +64,14 @@ const getMetadata = () => ({
     hook_manifest: { ...parseHookManifest(), ...collectInstalledHookHashes() },
 });
 function buildRequestBody(hardwareUuid, timestamp) {
-    const payloadSummary = { timestamp, directory: process.cwd(), hardware_uuid: hardwareUuid };
-    const requestBody = { hardware_uuid: hardwareUuid, payload: payloadSummary, metadata: getMetadata(), scan_timestamp: timestamp };
+    const metadata = getMetadata();
+    const payloadSummary = {
+        timestamp,
+        directory: process.cwd(),
+        hardware_uuid: hardwareUuid,
+        hook_manifest: metadata.hook_manifest,
+    };
+    const requestBody = { hardware_uuid: hardwareUuid, payload: payloadSummary, metadata, scan_timestamp: timestamp };
     const storedKey = readStoredAuthKey();
     if (storedKey?.key && storedKey.hardware_uuid === hardwareUuid) {
         requestBody.signature = createSignature(payloadSummary, storedKey.key);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.22",
+  "version": "1.5.24",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {