@optimuslabs/harness-map-staging 1.5.23 → 1.5.25

package/dist/log_config_files/runtime/main_runner.js

@@ -214,6 +214,7 @@ async function collectAllConfigFiles(endpointBase) {
     hookRunLog(`worktree_scan: active=${worktreeReport.length} config_files ${beforeFilter}→${filtered.length}`);
     return { configFiles: filtered, worktreeReport };
 }
+/** Adds the sensitive paths audit to the batch; false when it could not be run (nothing added). */
 async function addSensitivePathsAudit(endpointBase, configFiles) {
     hookRunLog(`running sensitive paths audit`);
     const auditOutputDir = join(homedir(), OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT);
@@ -221,11 +222,14 @@ async function addSensitivePathsAudit(endpointBase, configFiles) {
         const auditResult = await runSensitivePathsAudit(endpointBase, auditOutputDir, PROJECT_ROOT);
         hookRunLog(`sensitive_paths_audit: ${auditResult.paths.length} path(s)`);
         configFiles.push({ file_type: 'sensitive_paths_audit', file_path: 'sensitive_paths_audit.txt', raw_content: { paths: auditResult.paths } });
+        return true;
     }
     catch (err) {
-        hookRunLog(`sensitive_paths_audit_error: ${err instanceof Error ? err.message : String(err)}`);
+        // Send no audit rather than an empty one: the backend keeps the machine's last good audit.
+        hookRunLog(`sensitive_paths_audit_error: ${err instanceof Error ? err.message : String(err)} (audit not sent)`);
         hookLogError('sensitive_paths_audit', err, { endpoint: endpointBase, output_dir: auditOutputDir });
-        configFiles.push({ file_type: 'sensitive_paths_audit', file_path: 'sensitive_paths_audit.txt', raw_content: { paths: [] } });
+        await reportFunctionalFailureAwait('inventory', 'sensitive_paths_audit', err);
+        return false;
     }
 }
 /** POSIX mode of every collected file, plus granted folders (and their ancestors) and sensitive audit hits within a budget. stat() only. */
@@ -333,9 +337,16 @@ async function main() {
         hookRunLog(`patterns_error: ${err instanceof Error ? err.message : String(err)}`);
         throw err;
     }
-    await addSensitivePathsAudit(endpointBase, configFiles);
+    const sensitiveAudited = await addSensitivePathsAudit(endpointBase, configFiles);
     ensureCursorUserSettingsSnapshotInBatch(configFiles);
-    addPathPermissionsAudit(configFiles);
+    if (sensitiveAudited) {
+        addPathPermissionsAudit(configFiles);
+    }
+    else {
+        // Built without the sensitive paths, it would replace the backend's last good permissions
+        // audit and drop those paths' modes; skip it so both audits stay as last sent.
+        hookRunLog('path_permissions_audit: skipped (no sensitive paths audit this run)');
+    }
     const fileTypes = [...new Set(configFiles.map((c) => c.file_type))].join(', ');
     hookRunLog(`collected ${configFiles.length} config file(s) file_types=${fileTypes}`);
     for (const c of configFiles) {

package/dist/log_sensitive_paths_audit.js

@@ -62,14 +62,16 @@ export function writeSensitivePathsAudit(outputDir, pathTemplates, cwd = process
 /**
  * Run audit: fetch candidates from backend, check existence, write file. Returns paths for sending.
  * Used by log_config_files to include the audit in the same batch (same auth).
+ *
+ * Throws when the candidates can't be fetched: an audit run without them would report no
+ * sensitive paths, and sending it would replace the machine's last good audit on the backend.
  */
 export async function runSensitivePathsAudit(endpointBase, outputDir = join(homedir(), OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT), cwd = process.cwd()) {
     const response = await getSensitivePathsAuditCandidates(endpointBase);
-    const pathTemplates = response?.paths ?? [];
-    if (pathTemplates.length === 0 && !response) {
-        console.warn('Could not fetch sensitive path candidates from backend; writing empty audit.');
+    if (!response) {
+        throw new Error(`could not fetch sensitive path candidates from ${endpointBase}`);
     }
-    const paths = writeSensitivePathsAudit(outputDir, pathTemplates, cwd);
+    const paths = writeSensitivePathsAudit(outputDir, response.paths, cwd);
     const outPath = join(outputDir, AUDIT_FILENAME);
     console.log(`Sensitive paths audit written to ${outPath} (${paths.length} path(s) present).`);
     return { paths };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.23",
+  "version": "1.5.25",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {