@optimuslabs/harness-map-staging 1.5.25 → 1.5.27

package/dist/compliance_prompt_gate.js

@@ -9,7 +9,9 @@
 import { applyAutofixViolations, confirmAppliedAutofixVerified, normalizeAgentToken, pruneSatisfiedOneTimeRemediations, reportCompliantRemediationVerifiedStatus, reportPostRestartVerificationOutcomes, runLocalRemediationComplianceCheck, uploadSatisfiedManifestConfigs, } from './log_config_files/runtime/compliance_check.js';
 import { isRemediationQuarantined } from './log_config_files/runtime/remediation_apply_tracking.js';
 import { existsSync, readFileSync, statSync } from 'node:fs';
-import { getRemediationInstructionsPath } from './log_config_files/runtime/management_storage.js';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { managementEnvPath, readEnvironment } from './tofu_environment.js';
+import { getRemediationInstructionsPath, readRemediationInstructionsFile } from './log_config_files/runtime/management_storage.js';
 import { hookLogSessionBanner, hookRunLog, logRemediationApplyFailure } from './log_config_files/runtime/hook_logger.js';
 import { getStoryId, bufferFunctionalRun } from './log_config_files/runtime/client_event_reporter.js';
 import { finalizeAndUploadComplianceSessionLog, initComplianceSessionForGate, parseComplianceLogArg, } from './log_config_files/runtime/compliance_session_log.js';
@@ -22,6 +24,7 @@ import { tryResolveHardwareUuid } from './log_config_files/runtime/hardware_uuid
 import { cursorAutofixDefersInlineVerify, syncRemediations, } from './log_config_files/runtime/remediation_sync.js';
 import { loadEndpointBase } from './log_config_files/sender/endpoint_config.js';
 import { formatRemediationChangePreviewForApplied } from './remediation_change_preview.js';
+import { agentApprovalViolation, approvedTenantViolation, codexTenantViolation, codexTenants, emailAllowlistViolation, cursorTeamViolation, readClaudeDesktopSignedInTenant, readClaudeSignedInTenant, readCodexSignedIn, readCursorSignedInTeams, } from './approved_tenant_gate.js';
 const MANIFEST_STALE_MS = 7 * 24 * 60 * 60 * 1000;
 /** After verified (or failed verify), push enforcement + session log immediately — do not wait for background runner. */
 async function flushRemediationOutcomeToServer(complianceLogPath) {
@@ -92,8 +95,20 @@ function blockPayload(ide, violationMessage) {
     }
     return JSON.stringify({ continue: false, user_message: text });
 }
+/**
+ * Codex's block: `reason` only. Codex shows `reason` as the block and `systemMessage` as a separate
+ * warning, so the Claude-shaped payload (which carries both) prints the same sentence twice.
+ */
+function codexBlockPayload(violationMessage) {
+    return JSON.stringify({ decision: 'block', reason: 'Prompt blocked by Optimus: ' + violationMessage });
+}
 function getManifestStalenessMs() {
     try {
+        // When the remediations were written, not the file's mtime: approval-list writes rewrite the
+        // file on every sync without touching the remediations.
+        const writtenAt = Date.parse(readRemediationInstructionsFile().remediations_written_at ?? '');
+        if (Number.isFinite(writtenAt))
+            return Date.now() - writtenAt;
         const path = getRemediationInstructionsPath();
         if (!existsSync(path))
             return null;
@@ -218,171 +233,289 @@ export async function runCompliancePromptGateCli() {
         printAllow(parseIde());
     }
 }
-/** Exported for tests; runs when `dist/compliance_prompt_gate.js` is the process entry (argv[1]). */
-export async function runCompliancePromptGate() {
-    const ide = parseIde();
-    const agent = parseAgent(ide);
-    let complianceLogPath = parseComplianceLogArg(process.argv);
-    if (complianceLogPath) {
-        complianceLogPath = initComplianceSessionForGate(complianceLogPath);
+/**
+ * Whether tenant and email-domain blocking is switched off on this machine: a developer's own
+ * escape hatch, `OPTIMUS_TENANT_GATE=off` in ~/.optimuslabs/management/optimus_dev.env. Honoured only
+ * when that file also says `environment=development`, so it can never turn enforcement off on a
+ * customer's machine.
+ */
+export function tenantGateSwitchedOff() {
+    const envPath = managementEnvPath();
+    if (!envPath || readEnvironment() !== 'development')
+        return false;
+    try {
+        return /^OPTIMUS_TENANT_GATE\s*=\s*off\s*$/im.test(readFileSync(envPath, 'utf8'));
     }
-    else {
-        hookLogSessionBanner('compliance_prompt_gate (before submit)');
+    catch {
+        return false;
     }
-    let status = runLocalRemediationComplianceCheck(agent);
-    const postRestartVerify = reportPostRestartVerificationOutcomes(status.violations);
-    if (postRestartVerify.outcomes.length > 0) {
-        await Promise.allSettled(postRestartVerify.reportPromises);
-        await flushRemediationOutcomeToServer(complianceLogPath);
-        hookRunLog(`compliance_prompt_gate: post_restart_verification count=${postRestartVerify.outcomes.length} quarantined=${postRestartVerify.outcomes.filter((o) => o.status === 'quarantined').length}`);
-        status = runLocalRemediationComplianceCheck(agent);
+}
+/** The email the agent is signed in with, '' when it has none we can read, null for an agent not checked. */
+function loginEmail(agent) {
+    if (agent === 'claude')
+        return readClaudeSignedInTenant()?.email ?? '';
+    // Claude Desktop's Code tab runs Claude Code under Desktop's own login, checked as its own agent.
+    if (agent === 'claude_desktop')
+        return readClaudeDesktopSignedInTenant()?.email ?? '';
+    if (agent === 'codex')
+        return readCodexSignedIn()?.email ?? '';
+    if (agent === 'cursor')
+        return readCursorSignedInTeams()?.email ?? '';
+    return null;
+}
+/** Why this agent's signed-in tenant is not approved, or null when it is (or cannot be read). */
+function tenantViolation(agent) {
+    const approved = readRemediationInstructionsFile().approved_tenants;
+    if (agent === 'claude')
+        return approvedTenantViolation('claude', approved, readClaudeSignedInTenant());
+    if (agent === 'claude_desktop') {
+        return approvedTenantViolation('claude_desktop', approved, readClaudeDesktopSignedInTenant());
+    }
+    // A personal account (Cursor on no team, Codex on a personal plan) has no tenant to approve: only
+    // the email allowlist decides it.
+    if (agent === 'codex') {
+        const signedIn = readCodexSignedIn();
+        const tenants = signedIn ? codexTenants(signedIn) : null;
+        return tenants?.some((t) => !t.startsWith('@')) ? codexTenantViolation(approved, signedIn) : null;
+    }
+    if (agent === 'cursor') {
+        const signedIn = readCursorSignedInTeams();
+        return signedIn?.team_ids.length ? cursorTeamViolation(approved, signedIn) : null;
     }
+    return null;
+}
+/** The block for a login: which check refused it and why, or null when every check passes. */
+function loginBlock(agent, email) {
+    const synced = readRemediationInstructionsFile();
+    const agentMsg = agentApprovalViolation(agent, synced.approved_agents);
+    if (agentMsg)
+        return { event: 'prompt_gate_block_unapproved_agent', reason: agentMsg };
+    if (email === null)
+        return null;
+    const emailMsg = emailAllowlistViolation(email, synced.allowed_email_domains);
+    if (emailMsg)
+        return { event: 'prompt_gate_block_email_not_allowlisted', reason: emailMsg };
+    const tenantMsg = tenantViolation(agent);
+    return tenantMsg ? { event: 'prompt_gate_block_unapproved_tenant', reason: tenantMsg } : null;
+}
+/**
+ * Block the prompt unless the agent is approved, the login's email is on the organization's email
+ * allowlist and its tenant is approved (all as remediation sync stored them), printing the block
+ * payload; true when it did. A login whose email or tenant cannot be read passes that check, and a
+ * machine that has synced nothing yet is not blocked.
+ */
+function blockedByLogin(agent, ide) {
+    if (tenantGateSwitchedOff())
+        return false;
+    const email = loginEmail(agent);
+    const block = loginBlock(agent, email);
+    if (!block)
+        return false;
+    logRemediationApplyFailure(block.event, { reason: block.reason, ide, agent, email: email ?? '' });
+    console.log(agent === 'codex' ? codexBlockPayload(block.reason) : blockPayload(ide, block.reason));
+    return true;
+}
+/** Pull the organization's latest remediations and approved tenants, waiting at most 3 seconds. */
+async function syncApprovals() {
     const hw = tryResolveHardwareUuid();
-    if (hw) {
-        try {
-            await Promise.race([
-                syncRemediations(loadEndpointBase(), hw),
-                new Promise((resolve) => setTimeout(resolve, 3000)),
-            ]);
-        }
-        catch {
-            // Network or auth failure — fall back to local file state.
-        }
+    if (!hw)
+        return;
+    try {
+        await Promise.race([syncRemediations(loadEndpointBase(), hw), sleep(3000)]);
+    }
+    catch {
+        // Network or auth failure — fall back to local file state.
     }
-    status = runLocalRemediationComplianceCheck(agent);
-    // Secondary-satisfied: primary checks failed but settings.json (or equiv) has the fix.
-    // Upload those files fire-and-forget so the backend can resolve the finding immediately.
+}
+/** Agents whose remediations are JSON files written to disk at once (no deferred SQLite apply). */
+function isImmediateJsonIde(ide) {
+    return ide === 'claude' || ide === 'copilot' || ide === 'opencode';
+}
+/** The compliance session log this run writes to, or null when it only logs to the hook log. */
+function openComplianceLog() {
+    const complianceLogPath = parseComplianceLogArg(process.argv);
+    if (complianceLogPath)
+        return initComplianceSessionForGate(complianceLogPath);
+    hookLogSessionBanner('compliance_prompt_gate (before submit)');
+    return complianceLogPath;
+}
+/** Report remediations verified (or not) after the restart an earlier autofix asked for. */
+async function reportPostRestartVerification(agent, complianceLogPath) {
+    const status = runLocalRemediationComplianceCheck(agent);
+    const postRestartVerify = reportPostRestartVerificationOutcomes(status.violations);
+    if (postRestartVerify.outcomes.length === 0)
+        return;
+    await Promise.allSettled(postRestartVerify.reportPromises);
+    await flushRemediationOutcomeToServer(complianceLogPath);
+    hookRunLog(`compliance_prompt_gate: post_restart_verification count=${postRestartVerify.outcomes.length} quarantined=${postRestartVerify.outcomes.filter((o) => o.status === 'quarantined').length}`);
+}
+/**
+ * Secondary-satisfied: primary checks failed but settings.json (or equiv) has the fix.
+ * Upload those files fire-and-forget so the backend can resolve the finding immediately.
+ */
+function uploadSecondarySatisfied(status) {
     for (const e of status.secondarySatisfied ?? []) {
         _uploadSecondaryFile(e).catch(() => undefined);
     }
-    if (status.status === 'fail' && status.violations.length > 0) {
-        const staleMs = getManifestStalenessMs();
-        if (staleMs !== null && staleMs > MANIFEST_STALE_MS) {
-            const staleDays = Math.floor(staleMs / (24 * 60 * 60 * 1000));
-            const advisory = `Remediation enforcement suspended: local remediation manifest is stale (${staleDays} days old). ` +
-                'Please reconnect to sync latest policy state.';
-            logRemediationApplyFailure('prompt_gate_stale_manifest_advisory', {
-                reason: advisory,
-                stale_days: staleDays,
-                violation_count: status.violations.length,
-            });
-            printAllowWithAdvisory(ide, advisory);
-            return;
-        }
-        const actionableViolations = status.violations.filter((v) => !isRemediationQuarantined(v.uuid));
-        if (actionableViolations.length === 0 && status.violations.length > 0) {
-            hookRunLog(`compliance_prompt_gate: all ${status.violations.length} violation(s) quarantined — allowing prompt silently (backend notified on quarantine)`);
-            logRemediationApplyFailure('prompt_gate_quarantined_silent_allow', {
-                reason: 'all violations quarantined; no dialog — enforcement paused on this machine',
-                quarantined_count: status.violations.length,
-            });
-            printAllow(ide);
-            return;
-        }
-        const { fixed, appliedViolations = [], restartCommands, failedViolations, reportPromises, deferredSqlitePending, } = applyAutofixViolations(actionableViolations, agent);
-        hookRunLog(`compliance_prompt_gate: autofix result ide=${ide} fixed=${fixed} applied=${appliedViolations.length} failed=${failedViolations.length} restart_commands=${restartCommands.length} deferred_sqlite_pending=${deferredSqlitePending}`);
-        if (fixed > 0) {
-            // Wait for all server reports before exiting so the POST lands.
-            await Promise.allSettled(reportPromises);
-            // Deferred SQLite can leave recheck failing until restart; that must not hide a separate
-            // failed autofix (e.g. JSON remediation failed while vscdb was only queued).
-            if (failedViolations.length > 0) {
-                const ids = failedViolations.map((v) => `[${v.finding_formatted_id}]`).join(', ');
-                const msg = `Auto-fix failed for ${ids} — please fix manually or contact your security team.\n\n${failedViolations[0]?.message ?? ''}`;
-                logRemediationApplyFailure('prompt_gate_block_autofix_failed', {
-                    reason: 'autofix had fixed>0 path but failedViolations non-empty after apply',
-                    ide,
-                    failed_formatted_ids: failedViolations.map((v) => v.finding_formatted_id).join(', '),
-                    detail: failedViolations[0]?.message ?? '',
-                });
-                console.log(blockPayload(ide, msg));
-                return;
-            }
-            const recheck = runLocalRemediationComplianceCheck(agent);
-            const recheckOk = recheck.status === 'ok' || recheck.violations.length === 0;
-            // Cursor: tolerate a failing recheck only when SQLite updates are deferred (apply after restart).
-            // Claude / Copilot: JSON remediations are written immediately; merge/verify timing can still leave
-            // the in-process recheck red for the same UUID — allow in that case for immediate JSON agents.
-            const appliedUuids = new Set(appliedViolations.map((v) => v.uuid));
-            const claudeRecheckStaleAfterImmediateApply = (ide === 'claude' || ide === 'copilot' || ide === 'opencode') &&
-                !recheckOk &&
-                recheck.violations.length > 0 &&
-                recheck.violations.every((v) => appliedUuids.has(v.uuid));
-            if (claudeRecheckStaleAfterImmediateApply) {
-                hookRunLog(`compliance_prompt_gate: ${ide} — autofix wrote JSON; recheck still flags same UUID(s) — proceeding (immediate apply)`);
-            }
-            if (deferredSqlitePending || recheckOk || claudeRecheckStaleAfterImmediateApply) {
-                // Immediate-JSON agents (Claude / Claude Desktop, Copilot, OpenCode) write the config file to
-                // disk synchronously; a restart_command, if present, only reloads the already-compliant file
-                // into the running app — it is not the mechanism that makes the fix take effect. So report
-                // "verified" now instead of leaving the finding "pending" in the UI until the next prompt.
-                // Cursor JSON: disk recheck OK → verified before restart. Cursor deferred vscdb → verify after restart.
-                const immediateJsonAgent = ide === 'claude' || ide === 'copilot' || ide === 'opencode';
-                const diskProvenCompliant = recheckOk || claudeRecheckStaleAfterImmediateApply;
-                const cursorRestartVerifyPending = cursorAutofixDefersInlineVerify(ide, restartCommands.length, deferredSqlitePending === true, diskProvenCompliant);
-                const immediateVerified = !deferredSqlitePending &&
-                    !cursorRestartVerifyPending &&
-                    diskProvenCompliant &&
-                    (restartCommands.length === 0 || immediateJsonAgent || ide === 'cursor');
-                if (immediateVerified) {
-                    confirmAppliedAutofixVerified(appliedViolations, reportPromises);
-                    await Promise.allSettled(reportPromises);
-                    await flushRemediationOutcomeToServer(complianceLogPath);
-                }
-                const changePreview = formatRemediationChangePreviewForApplied(appliedViolations);
-                const changePreviewSuffix = changePreview ? `\n\n${changePreview}` : '';
-                const autofixMessage = ide === 'cursor' && restartCommands.length > 0
-                    ? formatCursorRestartAutofixDialog(appliedViolations)
-                    : ide === 'claude'
-                        ? formatClaudeAutofixDialog(appliedViolations)
-                        : ide === 'copilot'
-                            ? formatCopilotAutofixDialog(appliedViolations)
-                            : ide === 'opencode'
-                                ? formatOpenCodeAutofixDialog(appliedViolations)
-                                : `Optimus Labs auto-fixed ${fixed} ${fixed === 1 ? 'ruleset violation' : 'ruleset violations'}:\n\n${appliedViolations
-                                    .map((v) => autofixDialogLine(v))
-                                    .join('\n')}${changePreviewSuffix}`;
-                const payload = { __optimus_autofix: true, autofix_message: autofixMessage };
-                if (restartCommands.length > 0)
-                    payload.restart_commands = restartCommands;
-                console.log(JSON.stringify(payload));
-                // Restarts: always executed by optimus-compliance-check.sh via execute_trusted_restarts (TS allowlist + spawn).
-                return;
-            }
-            const msg = recheck.violations[0]?.message ?? 'A security ruleset violation has been detected.';
-            logRemediationApplyFailure('prompt_gate_block_recheck_failed', {
-                reason: 'after autofix, local compliance recheck still reports violations',
-                ide,
-                deferred_sqlite_pending: deferredSqlitePending,
-                first_uuid: recheck.violations[0]?.uuid ?? '',
-                message: msg,
-            });
-            console.log(blockPayload(ide, msg));
-            return;
-        }
-        if (failedViolations.length > 0) {
-            const ids = failedViolations.map((v) => `[${v.finding_formatted_id}]`).join(', ');
-            const msg = `Auto-fix failed for ${ids} — please fix manually or contact your security team.\n\n${failedViolations[0]?.message ?? ''}`;
-            logRemediationApplyFailure('prompt_gate_block_autofix_failed', {
-                reason: 'autofix failed (fixed=0 branch or partial failure)',
-                ide,
-                failed_formatted_ids: failedViolations.map((v) => v.finding_formatted_id).join(', '),
-                detail: failedViolations[0]?.message ?? '',
-            });
-            console.log(blockPayload(ide, msg));
-            return;
-        }
-        const msg = status.violations[0]?.message ?? 'A security ruleset violation has been detected.';
-        logRemediationApplyFailure('prompt_gate_block_violations_no_autofix_applied', {
-            reason: 'violations on submit but autofix did not succeed — see autofix_skipped_not_allowed, enforceRemediation, or compliance_check entries',
-            ide,
-            first_uuid: status.violations[0]?.uuid ?? '',
-            finding_formatted_id: status.violations[0]?.finding_formatted_id ?? '',
-        });
-        console.log(blockPayload(ide, msg));
+}
+/** Allow with an advisory when the local manifest is too old to enforce; true when it did. */
+function allowedOnStaleManifest(status, ide) {
+    const staleMs = getManifestStalenessMs();
+    if (staleMs === null || staleMs <= MANIFEST_STALE_MS)
+        return false;
+    const staleDays = Math.floor(staleMs / (24 * 60 * 60 * 1000));
+    const advisory = `Remediation enforcement suspended: local remediation manifest is stale (${staleDays} days old). ` +
+        'Please reconnect to sync latest policy state.';
+    logRemediationApplyFailure('prompt_gate_stale_manifest_advisory', {
+        reason: advisory,
+        stale_days: staleDays,
+        violation_count: status.violations.length,
+    });
+    printAllowWithAdvisory(ide, advisory);
+    return true;
+}
+function allowAllQuarantined(status, ide) {
+    hookRunLog(`compliance_prompt_gate: all ${status.violations.length} violation(s) quarantined — allowing prompt silently (backend notified on quarantine)`);
+    logRemediationApplyFailure('prompt_gate_quarantined_silent_allow', {
+        reason: 'all violations quarantined; no dialog — enforcement paused on this machine',
+        quarantined_count: status.violations.length,
+    });
+    printAllow(ide);
+}
+function blockAutofixFailed(ide, failedViolations, reason) {
+    const ids = failedViolations.map((v) => `[${v.finding_formatted_id}]`).join(', ');
+    const msg = `Auto-fix failed for ${ids} — please fix manually or contact your security team.\n\n${failedViolations[0]?.message ?? ''}`;
+    logRemediationApplyFailure('prompt_gate_block_autofix_failed', {
+        reason,
+        ide,
+        failed_formatted_ids: failedViolations.map((v) => v.finding_formatted_id).join(', '),
+        detail: failedViolations[0]?.message ?? '',
+    });
+    console.log(blockPayload(ide, msg));
+}
+/**
+ * Claude / Copilot: JSON remediations are written immediately; merge/verify timing can still leave
+ * the in-process recheck red for the same UUID — allow in that case for immediate JSON agents.
+ */
+function recheckStaleAfterImmediateApply(ide, recheck, recheckOk, appliedViolations) {
+    const appliedUuids = new Set(appliedViolations.map((v) => v.uuid));
+    return (isImmediateJsonIde(ide) &&
+        !recheckOk &&
+        recheck.violations.length > 0 &&
+        recheck.violations.every((v) => appliedUuids.has(v.uuid)));
+}
+/**
+ * Immediate-JSON agents (Claude / Claude Desktop, Copilot, OpenCode) write the config file to
+ * disk synchronously; a restart_command, if present, only reloads the already-compliant file
+ * into the running app — it is not the mechanism that makes the fix take effect. So report
+ * "verified" now instead of leaving the finding "pending" in the UI until the next prompt.
+ * Cursor JSON: disk recheck OK → verified before restart. Cursor deferred vscdb → verify after restart.
+ */
+function autofixVerifiedNow(ide, result, diskProvenCompliant) {
+    const restartCount = result.restartCommands.length;
+    const cursorRestartVerifyPending = cursorAutofixDefersInlineVerify(ide, restartCount, result.deferredSqlitePending === true, diskProvenCompliant);
+    return (!result.deferredSqlitePending &&
+        !cursorRestartVerifyPending &&
+        diskProvenCompliant &&
+        (restartCount === 0 || isImmediateJsonIde(ide) || ide === 'cursor'));
+}
+function autofixMessage(ide, result) {
+    const { fixed, appliedViolations } = result;
+    if (ide === 'cursor' && result.restartCommands.length > 0)
+        return formatCursorRestartAutofixDialog(appliedViolations);
+    if (ide === 'claude')
+        return formatClaudeAutofixDialog(appliedViolations);
+    if (ide === 'copilot')
+        return formatCopilotAutofixDialog(appliedViolations);
+    if (ide === 'opencode')
+        return formatOpenCodeAutofixDialog(appliedViolations);
+    const changePreview = formatRemediationChangePreviewForApplied(appliedViolations);
+    const changePreviewSuffix = changePreview ? `\n\n${changePreview}` : '';
+    return `Optimus Labs auto-fixed ${fixed} ${fixed === 1 ? 'ruleset violation' : 'ruleset violations'}:\n\n${appliedViolations
+        .map((v) => autofixDialogLine(v))
+        .join('\n')}${changePreviewSuffix}`;
+}
+/** Report the autofix verified when it already is, and print the autofix dialog (and any restarts). */
+async function printAutofixApplied(ide, result, diskProvenCompliant, complianceLogPath) {
+    if (autofixVerifiedNow(ide, result, diskProvenCompliant)) {
+        confirmAppliedAutofixVerified(result.appliedViolations, result.reportPromises);
+        await Promise.allSettled(result.reportPromises);
+        await flushRemediationOutcomeToServer(complianceLogPath);
+    }
+    const payload = { __optimus_autofix: true, autofix_message: autofixMessage(ide, result) };
+    if (result.restartCommands.length > 0)
+        payload.restart_commands = result.restartCommands;
+    console.log(JSON.stringify(payload));
+    // Restarts: always executed by optimus-compliance-check.sh via execute_trusted_restarts (TS allowlist + spawn).
+}
+function blockRecheckFailed(ide, recheck, deferredSqlitePending) {
+    const msg = recheck.violations[0]?.message ?? 'A security ruleset violation has been detected.';
+    logRemediationApplyFailure('prompt_gate_block_recheck_failed', {
+        reason: 'after autofix, local compliance recheck still reports violations',
+        ide,
+        deferred_sqlite_pending: deferredSqlitePending,
+        first_uuid: recheck.violations[0]?.uuid ?? '',
+        message: msg,
+    });
+    console.log(blockPayload(ide, msg));
+}
+/** After an autofix fixed something: block on a partial failure, else recheck and allow or block. */
+async function finishAppliedAutofix(agent, ide, result, complianceLogPath) {
+    // Wait for all server reports before exiting so the POST lands.
+    await Promise.allSettled(result.reportPromises);
+    // Deferred SQLite can leave recheck failing until restart; that must not hide a separate
+    // failed autofix (e.g. JSON remediation failed while vscdb was only queued).
+    if (result.failedViolations.length > 0) {
+        blockAutofixFailed(ide, result.failedViolations, 'autofix had fixed>0 path but failedViolations non-empty after apply');
+        return;
+    }
+    const recheck = runLocalRemediationComplianceCheck(agent);
+    const recheckOk = recheck.status === 'ok' || recheck.violations.length === 0;
+    // Cursor: tolerate a failing recheck only when SQLite updates are deferred (apply after restart).
+    const staleAfterImmediateApply = recheckStaleAfterImmediateApply(ide, recheck, recheckOk, result.appliedViolations);
+    if (staleAfterImmediateApply) {
+        hookRunLog(`compliance_prompt_gate: ${ide} — autofix wrote JSON; recheck still flags same UUID(s) — proceeding (immediate apply)`);
+    }
+    if (result.deferredSqlitePending || recheckOk || staleAfterImmediateApply) {
+        await printAutofixApplied(ide, result, recheckOk || staleAfterImmediateApply, complianceLogPath);
+        return;
+    }
+    blockRecheckFailed(ide, recheck, result.deferredSqlitePending);
+}
+function blockUnfixedViolations(status, ide) {
+    const msg = status.violations[0]?.message ?? 'A security ruleset violation has been detected.';
+    logRemediationApplyFailure('prompt_gate_block_violations_no_autofix_applied', {
+        reason: 'violations on submit but autofix did not succeed — see autofix_skipped_not_allowed, enforceRemediation, or compliance_check entries',
+        ide,
+        first_uuid: status.violations[0]?.uuid ?? '',
+        finding_formatted_id: status.violations[0]?.finding_formatted_id ?? '',
+    });
+    console.log(blockPayload(ide, msg));
+}
+/** Local violations found: allow (stale manifest, all quarantined), autofix, or block. */
+async function enforceViolations(agent, ide, status, complianceLogPath) {
+    if (allowedOnStaleManifest(status, ide))
+        return;
+    const actionableViolations = status.violations.filter((v) => !isRemediationQuarantined(v.uuid));
+    if (actionableViolations.length === 0) {
+        allowAllQuarantined(status, ide);
         return;
     }
-    // No violations: clean up satisfied one-time remediations so they don't linger locally forever.
+    const applied = applyAutofixViolations(actionableViolations, agent);
+    const result = { ...applied, appliedViolations: applied.appliedViolations ?? [] };
+    hookRunLog(`compliance_prompt_gate: autofix result ide=${ide} fixed=${result.fixed} applied=${result.appliedViolations.length} failed=${result.failedViolations.length} restart_commands=${result.restartCommands.length} deferred_sqlite_pending=${result.deferredSqlitePending}`);
+    if (result.fixed > 0) {
+        await finishAppliedAutofix(agent, ide, result, complianceLogPath);
+        return;
+    }
+    if (result.failedViolations.length > 0) {
+        blockAutofixFailed(ide, result.failedViolations, 'autofix failed (fixed=0 branch or partial failure)');
+        return;
+    }
+    blockUnfixedViolations(status, ide);
+}
+/** No violations: clean up satisfied one-time remediations so they don't linger locally forever. */
+async function finishCompliant(agent, ide) {
     const pruned = pruneSatisfiedOneTimeRemediations(agent);
     if (pruned.removed > 0) {
         await Promise.allSettled(pruned.reportPromises);
@@ -391,6 +524,32 @@ export async function runCompliancePromptGate() {
     await Promise.allSettled(reportCompliantRemediationVerifiedStatus(agent));
     printAllow(ide);
 }
+/** Exported for tests; runs when `dist/compliance_prompt_gate.js` is the process entry (argv[1]). */
+export async function runCompliancePromptGate() {
+    const ide = parseIde();
+    const agent = parseAgent(ide);
+    const complianceLogPath = openComplianceLog();
+    // `--tenant-only`: an agent whose hook enforces approved tenants and nothing else yet (Codex). Its
+    // remediations are not enforced from here, so turning this hook on blocks nothing but tenants.
+    if (process.argv.includes('--tenant-only')) {
+        await syncApprovals();
+        if (!blockedByLogin(agent, ide))
+            printAllow(ide);
+        return;
+    }
+    await reportPostRestartVerification(agent, complianceLogPath);
+    await syncApprovals();
+    const status = runLocalRemediationComplianceCheck(agent);
+    uploadSecondarySatisfied(status);
+    // Approved tenants (OPT-687): checked against the list the sync above stored locally.
+    if (blockedByLogin(agent, ide))
+        return;
+    if (status.status === 'fail' && status.violations.length > 0) {
+        await enforceViolations(agent, ide, status, complianceLogPath);
+        return;
+    }
+    await finishCompliant(agent, ide);
+}
 if (isRunAsCliModule()) {
     runCompliancePromptGateCli().finally(() => process.exit(0));
 }