@optimuslabs/harness-map-staging 1.5.24 → 1.5.26

package/dist/log_config_files/runtime/main_runner.js

@@ -15,7 +15,7 @@ import { ensureAuthentication } from '../auth/auth_flow.js';
 import { readJSONFile, readMarkdownFile } from '../readers/file_readers.js';
 import { isVscdbVirtualPath, tryReadVscdbVirtualFile, summarizeComposerPayloadForDiagnostics, } from '../readers/vscdb_config_builder.js';
 import { persistVscdbComposerContractFromPatternsResponse } from '../readers/vscdb_reader.js';
-import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles, collectMcpFromClaudeJsonProjects, collectClaudeTokenUsage, collectCopilotTokenUsage, collectOpencodeTokenUsage, collectCodexTokenUsage, collectCursorTokenUsage, collectHermesTokenUsage, collectOpenclawTokenUsage, collectPiTokenUsage, collectCoworkDesktopVersion, collectGrokCliVersion, collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, determineFileTypeFromPath, } from '../collection/config_collector.js';
+import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles, collectMcpFromClaudeJsonProjects, collectClaudeTokenUsage, collectCopilotTokenUsage, collectOpencodeTokenUsage, collectCodexTokenUsage, collectCursorTokenUsage, collectHermesTokenUsage, collectOpenclawTokenUsage, collectPiTokenUsage, collectCoworkDesktopVersion, collectClaudeDesktopOrgs, collectGrokCliVersion, collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, determineFileTypeFromPath, } from '../collection/config_collector.js';
 import { ensureCursorUserSettingsSnapshotInBatch } from '../collection/ensure_cursor_user_settings_snapshot.js';
 import { collectSkillsCliInstalled } from '../collection/skills_cli_collector.js';
 import { collectWorkspaceVscdbs } from '../collection/mcp_tool_collector.js';
@@ -27,7 +27,34 @@ import { ensureWorkspaceRepoEnv, resolveProjectRoot } from './workspace_repo.js'
 import { scanActiveWorktrees, activeWorktreeRootSet, filterConfigFilesToActiveWorktrees, } from './worktree_scanner.js';
 import { createSignature, canonicalizePayload } from '../sender/signing.js';
 const PROJECT_ROOT = resolveProjectRoot();
-async function collectAllConfigFiles(endpointBase) {
+const configFileKey = (c) => `${c.file_type}\t${c.file_path}`;
+/** Appends the entries not in the batch yet (by file type and path), recording each as seen. */
+function addUnseen(configFiles, seen, entries) {
+    for (const entry of entries) {
+        const key = configFileKey(entry);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        configFiles.push(entry);
+    }
+}
+/** Machine-wide collectors, run in this order after the plugin caches: [hook log line, collector]. */
+const HOME_COLLECTORS = [
+    ['scanning Claude known projects from ~/.claude.json', collectMcpFromClaudeJsonProjects],
+    ['aggregating Claude token usage from ~/.claude/projects transcripts', collectClaudeTokenUsage],
+    ['aggregating Copilot token usage from ~/.copilot/session-state transcripts', collectCopilotTokenUsage],
+    ['aggregating OpenCode token usage from ~/.local/share/opencode/opencode.db', collectOpencodeTokenUsage],
+    ['aggregating Codex token usage from ~/.codex/sessions rollouts', collectCodexTokenUsage],
+    ['aggregating Cursor token usage from state.vscdb', collectCursorTokenUsage],
+    ['aggregating Hermes token usage from ~/.hermes/state.db', collectHermesTokenUsage],
+    ['aggregating OpenClaw token usage from ~/.openclaw/agents/*/sessions/sessions.json', collectOpenclawTokenUsage],
+    ['aggregating Pi token usage from ~/.pi/agent/sessions transcripts', collectPiTokenUsage],
+    ["reading Claude Desktop app version for Cowork's Agent Profile", collectCoworkDesktopVersion],
+    ["reading the orgs Claude Desktop's signed-in account has used", collectClaudeDesktopOrgs],
+    ['reading Grok CLI version', collectGrokCliVersion],
+];
+/** The file-path-registry patterns from the API; throws when none came back. */
+async function fetchPatterns(endpointBase) {
     const patternsUrl = `${endpointBase.replace(/\/+$/, '')}${FILE_PATH_REGISTRY_FILE_PATTERNS_PATH}`;
     hookRunLog(`fetching patterns from ${patternsUrl}`);
     const patternsResponse = await getFileCollectionPatterns(endpointBase);
@@ -38,9 +65,12 @@ async function collectAllConfigFiles(endpointBase) {
         hookRunLog(msg);
         throw new Error(msg);
     }
+    return patternsResponse;
+}
+function scanPatterns(patternsResponse) {
     persistVscdbComposerContractFromPatternsResponse(patternsResponse);
     hookRunLog(`scanning config files`);
-    const configFiles = collectConfigFilesFromPatterns(patternsResponse.patterns, PROJECT_ROOT, hookRunLog, {
+    return collectConfigFilesFromPatterns(patternsResponse.patterns, PROJECT_ROOT, hookRunLog, {
         vscdbEntrySpecs: patternsResponse.vscdb_entry_specs,
         vscdb_read_queries: patternsResponse.vscdb_read_queries,
         vscdb_merge_from_composer_state: patternsResponse.vscdb_merge_from_composer_state,
@@ -50,163 +80,31 @@ async function collectAllConfigFiles(endpointBase) {
         absolute_path_prefixes: patternsResponse.absolute_path_prefixes,
         mcp_tool_glob_spec: patternsResponse.mcp_tool_glob_spec ?? null,
     });
+}
+/** MCP tool caches: the global cache, Cursor's per-project caches and its workspace vscdb files. */
+function addMcpToolCaches(patternsResponse, configFiles, seen) {
     hookRunLog(`scanning MCP tool cache`);
     const mcpToolGlobPattern = patternsResponse.patterns.find((p) => p.path_resolution === 'mcp_tool_glob');
     const mcpToolSkipPrefixes = normalizePathSkipPrefixes(mcpToolGlobPattern?.path_skip_prefixes);
-    const existingPaths = new Set(configFiles.map((c) => `${c.file_type}\t${c.file_path}`));
-    for (const m of collectMcpToolFiles(mcpToolSkipPrefixes, patternsResponse.client_path_constants)) {
-        const key = `${m.file_type}\t${m.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(m);
-        }
-    }
+    addUnseen(configFiles, seen, collectMcpToolFiles(mcpToolSkipPrefixes, patternsResponse.client_path_constants));
     hookRunLog(`scanning Cursor project workspace MCP configs (~/.cursor/projects/*/mcp-cache.json)`);
-    for (const m of collectCursorProjectWorkspaceMcpConfigs(mcpToolSkipPrefixes, patternsResponse.client_path_constants, patternsResponse.workspace_vscdb_spec, HOME_DIR)) {
-        const key = `${m.file_type}\t${m.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(m);
-        }
-    }
+    addUnseen(configFiles, seen, collectCursorProjectWorkspaceMcpConfigs(mcpToolSkipPrefixes, patternsResponse.client_path_constants, patternsResponse.workspace_vscdb_spec, HOME_DIR));
     if (patternsResponse.workspace_vscdb_spec) {
         hookRunLog(`scanning Cursor workspace vscdb files`);
-        for (const m of collectWorkspaceVscdbs(patternsResponse.workspace_vscdb_spec)) {
-            const key = `${m.file_type}\t${m.file_path}`;
-            if (!existingPaths.has(key)) {
-                existingPaths.add(key);
-                configFiles.push(m);
-            }
-        }
-    }
-    hookRunLog(`scanning installed plugins`);
-    if (!patternsResponse.client_path_constants)
-        throw new Error('client_path_constants required from API response');
-    configFiles.push(...collectConfigFilesFromInstalledPlugins(patternsResponse.client_path_constants));
-    hookRunLog(`scanning Claude plugin cache MCP manifests`);
-    for (const entry of collectPluginCacheMcpFiles(patternsResponse.client_path_constants, HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`scanning Claude known projects from ~/.claude.json`);
-    for (const entry of collectMcpFromClaudeJsonProjects(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`aggregating Claude token usage from ~/.claude/projects transcripts`);
-    for (const entry of collectClaudeTokenUsage(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`aggregating Copilot token usage from ~/.copilot/session-state transcripts`);
-    for (const entry of collectCopilotTokenUsage(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`aggregating OpenCode token usage from ~/.local/share/opencode/opencode.db`);
-    for (const entry of collectOpencodeTokenUsage(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`aggregating Codex token usage from ~/.codex/sessions rollouts`);
-    for (const entry of collectCodexTokenUsage(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`aggregating Cursor token usage from state.vscdb`);
-    for (const entry of collectCursorTokenUsage(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`aggregating Hermes token usage from ~/.hermes/state.db`);
-    for (const entry of collectHermesTokenUsage(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`aggregating OpenClaw token usage from ~/.openclaw/agents/*/sessions/sessions.json`);
-    for (const entry of collectOpenclawTokenUsage(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`aggregating Pi token usage from ~/.pi/agent/sessions transcripts`);
-    for (const entry of collectPiTokenUsage(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`reading Claude Desktop app version for Cowork's Agent Profile`);
-    for (const entry of collectCoworkDesktopVersion(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`reading Grok CLI version`);
-    for (const entry of collectGrokCliVersion(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
+        addUnseen(configFiles, seen, collectWorkspaceVscdbs(patternsResponse.workspace_vscdb_spec));
     }
+}
+function addClaudeDesktopExtensions(configFiles, seen) {
     hookRunLog(`merging disk-only Claude Desktop extensions into extensions-installations.json`);
     const diskExtMerge = enrichClaudeDesktopExtensionsInstallationsUpload(configFiles, HOME_DIR);
     hookRunLog(`claude desktop extensions: merged=${diskExtMerge.mergedCount} had_registry_upload=${diskExtMerge.hadRegistryUpload}`);
-    for (const entry of collectClaudeDesktopExtensionSettingsFiles(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
+    addUnseen(configFiles, seen, collectClaudeDesktopExtensionSettingsFiles(HOME_DIR));
     if (!diskExtMerge.hadRegistryUpload && diskExtMerge.mergedCount > 0) {
         hookRunLog(`scanning Claude Desktop extension manifests on disk (no registry upload in batch)`);
-        for (const entry of collectClaudeDesktopExtensionManifests(HOME_DIR)) {
-            const key = `${entry.file_type}\t${entry.file_path}`;
-            if (!existingPaths.has(key)) {
-                existingPaths.add(key);
-                configFiles.push(entry);
-            }
-        }
-    }
-    const skillsCliEntry = collectSkillsCliInstalled(PROJECT_ROOT, hookRunLog);
-    if (skillsCliEntry) {
-        const key = `${skillsCliEntry.file_type}\t${skillsCliEntry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(skillsCliEntry);
-        }
+        addUnseen(configFiles, seen, collectClaudeDesktopExtensionManifests(HOME_DIR));
     }
+}
+function filterToActiveWorktrees(configFiles) {
     const worktreeReport = scanActiveWorktrees(PROJECT_ROOT, HOME_DIR);
     const activeRoots = activeWorktreeRootSet(worktreeReport);
     const beforeFilter = configFiles.length;
@@ -214,6 +112,29 @@ async function collectAllConfigFiles(endpointBase) {
     hookRunLog(`worktree_scan: active=${worktreeReport.length} config_files ${beforeFilter}→${filtered.length}`);
     return { configFiles: filtered, worktreeReport };
 }
+async function collectAllConfigFiles(endpointBase) {
+    const patternsResponse = await fetchPatterns(endpointBase);
+    const configFiles = scanPatterns(patternsResponse);
+    const seen = new Set(configFiles.map(configFileKey));
+    addMcpToolCaches(patternsResponse, configFiles, seen);
+    hookRunLog(`scanning installed plugins`);
+    const clientPathConstants = patternsResponse.client_path_constants;
+    if (!clientPathConstants)
+        throw new Error('client_path_constants required from API response');
+    configFiles.push(...collectConfigFilesFromInstalledPlugins(clientPathConstants));
+    hookRunLog(`scanning Claude plugin cache MCP manifests`);
+    addUnseen(configFiles, seen, collectPluginCacheMcpFiles(clientPathConstants, HOME_DIR));
+    for (const [message, collect] of HOME_COLLECTORS) {
+        hookRunLog(message);
+        addUnseen(configFiles, seen, collect(HOME_DIR));
+    }
+    addClaudeDesktopExtensions(configFiles, seen);
+    const skillsCliEntry = collectSkillsCliInstalled(PROJECT_ROOT, hookRunLog);
+    if (skillsCliEntry)
+        addUnseen(configFiles, seen, [skillsCliEntry]);
+    return filterToActiveWorktrees(configFiles);
+}
+/** Adds the sensitive paths audit to the batch; false when it could not be run (nothing added). */
 async function addSensitivePathsAudit(endpointBase, configFiles) {
     hookRunLog(`running sensitive paths audit`);
     const auditOutputDir = join(homedir(), OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT);
@@ -221,12 +142,14 @@ async function addSensitivePathsAudit(endpointBase, configFiles) {
         const auditResult = await runSensitivePathsAudit(endpointBase, auditOutputDir, PROJECT_ROOT);
         hookRunLog(`sensitive_paths_audit: ${auditResult.paths.length} path(s)`);
         configFiles.push({ file_type: 'sensitive_paths_audit', file_path: 'sensitive_paths_audit.txt', raw_content: { paths: auditResult.paths } });
+        return true;
     }
     catch (err) {
         // Send no audit rather than an empty one: the backend keeps the machine's last good audit.
         hookRunLog(`sensitive_paths_audit_error: ${err instanceof Error ? err.message : String(err)} (audit not sent)`);
         hookLogError('sensitive_paths_audit', err, { endpoint: endpointBase, output_dir: auditOutputDir });
         await reportFunctionalFailureAwait('inventory', 'sensitive_paths_audit', err);
+        return false;
     }
 }
 /** POSIX mode of every collected file, plus granted folders (and their ancestors) and sensitive audit hits within a budget. stat() only. */
@@ -334,9 +257,16 @@ async function main() {
         hookRunLog(`patterns_error: ${err instanceof Error ? err.message : String(err)}`);
         throw err;
     }
-    await addSensitivePathsAudit(endpointBase, configFiles);
+    const sensitiveAudited = await addSensitivePathsAudit(endpointBase, configFiles);
     ensureCursorUserSettingsSnapshotInBatch(configFiles);
-    addPathPermissionsAudit(configFiles);
+    if (sensitiveAudited) {
+        addPathPermissionsAudit(configFiles);
+    }
+    else {
+        // Built without the sensitive paths, it would replace the backend's last good permissions
+        // audit and drop those paths' modes; skip it so both audits stay as last sent.
+        hookRunLog('path_permissions_audit: skipped (no sensitive paths audit this run)');
+    }
     const fileTypes = [...new Set(configFiles.map((c) => c.file_type))].join(', ');
     hookRunLog(`collected ${configFiles.length} config file(s) file_types=${fileTypes}`);
     for (const c of configFiles) {

package/dist/log_config_files/runtime/management_storage.js

@@ -2,7 +2,7 @@
  * Paths and JSON persistence for ~/.optimuslabs/management:
  * - remediation_instructions.json (remediations[])
  */
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { OPTIMUSLABS_MANAGEMENT_REL, OPTIMUSLABS_LOGS_REL } from '../../bootstrap_constants.js';
@@ -129,7 +129,51 @@ function parseInstructionsRaw(raw) {
     }
 }
 export function writeRemediationInstructionsFile(file) {
-    atomicWriteJson(getRemediationInstructionsPath(), file);
+    writeInstructionsFile(file, new Date().toISOString());
+}
+function writeInstructionsFile(file, remediationsWrittenAt) {
+    // Most callers write `{ remediations }` only; keep the approval lists they didn't pass.
+    const onDisk = readRemediationInstructionsFile();
+    const approved_tenants = 'approved_tenants' in file ? file.approved_tenants : onDisk.approved_tenants;
+    const unapproved_email_domains = 'unapproved_email_domains' in file ? file.unapproved_email_domains : onDisk.unapproved_email_domains;
+    const allowed_email_domains = 'allowed_email_domains' in file ? file.allowed_email_domains : onDisk.allowed_email_domains;
+    const approved_agents = 'approved_agents' in file ? file.approved_agents : onDisk.approved_agents;
+    atomicWriteJson(getRemediationInstructionsPath(), {
+        ...file,
+        ...(approved_tenants === undefined ? {} : { approved_tenants }),
+        ...(unapproved_email_domains === undefined ? {} : { unapproved_email_domains }),
+        ...(allowed_email_domains === undefined ? {} : { allowed_email_domains }),
+        ...(approved_agents === undefined ? {} : { approved_agents }),
+        remediations_written_at: remediationsWrittenAt,
+    });
+}
+/** When the remediations on disk were written: recorded, or for an older file its mtime. */
+function remediationsWrittenAtOf(onDisk) {
+    if (onDisk.remediations_written_at)
+        return onDisk.remediations_written_at;
+    const path = getRemediationInstructionsPath();
+    return existsSync(path) ? statSync(path).mtime.toISOString() : new Date().toISOString();
+}
+/** Replace one approval list, keeping the remediations and when they were written. */
+function writeApprovalList(patch) {
+    const onDisk = readRemediationInstructionsFile();
+    writeInstructionsFile({ ...onDisk, ...patch }, remediationsWrittenAtOf(onDisk));
+}
+/** Replace only the unapproved email domains, keeping everything else on disk. */
+export function writeUnapprovedEmailDomains(unapproved_email_domains) {
+    writeApprovalList({ unapproved_email_domains });
+}
+/** Replace only the approved agents, keeping everything else on disk. */
+export function writeApprovedAgents(approved_agents) {
+    writeApprovalList({ approved_agents });
+}
+/** Replace only the email allowlist, keeping everything else on disk. */
+export function writeAllowedEmailDomains(allowed_email_domains) {
+    writeApprovalList({ allowed_email_domains });
+}
+/** Replace only the approved-tenant list, keeping the remediations already on disk. */
+export function writeApprovedTenants(approved_tenants) {
+    writeApprovalList({ approved_tenants });
 }
 export function readRemediationInstructionsFile() {
     const path = getRemediationInstructionsPath();