@optimuslabs/harness-map-staging 1.5.27 → 1.5.28

package/dist/approved_tenant_gate.js

@@ -218,6 +218,33 @@ export function codexTenantViolation(approved, signedIn) {
         (v.allowed ? `Approved: ${v.allowed}. ` : '') +
         'Run `codex logout`, then sign in to an approved workspace.');
 }
+/**
+ * Whether a personal account's `@<domain>` tenant is on a team domain: an allowlisted domain that
+ * someone on an approved team or enterprise tenant signs in with (any vendor's). A subdomain counts.
+ */
+export function onTeamDomain(tenant, teamDomains) {
+    if (!tenant.startsWith('@') || !teamDomains?.length)
+        return false;
+    const domain = tenant.slice(1);
+    return teamDomains.some((d) => domain === d || domain.endsWith(`.${d}`));
+}
+/**
+ * The block message for Cursor's login, else null. A login on a team is checked against the
+ * approved teams. A personal account is only checked once its email is on a team domain; then it
+ * is blocked unless an admin approved that personal tenant (`@<domain>`).
+ */
+export function cursorLoginViolation(approved, signedIn, teamDomains) {
+    if (!signedIn)
+        return null;
+    const checked = signedIn.team_ids.length > 0 || cursorTenants(signedIn).some((t) => onTeamDomain(t, teamDomains));
+    return checked ? cursorTeamViolation(approved, signedIn) : null;
+}
+/** The block message for Codex's login, else null; a personal plan is checked as Cursor's is. */
+export function codexLoginViolation(approved, signedIn, teamDomains) {
+    const tenants = signedIn ? codexTenants(signedIn) : null;
+    const checked = tenants?.some((t) => !t.startsWith('@') || onTeamDomain(t, teamDomains));
+    return checked ? codexTenantViolation(approved, signedIn) : null;
+}
 /**
  * The org Claude Desktop is signed into now, for its Code tab's prompts, or null when unknown.
  *

package/dist/compliance_prompt_gate.js

@@ -24,7 +24,7 @@ import { tryResolveHardwareUuid } from './log_config_files/runtime/hardware_uuid
 import { cursorAutofixDefersInlineVerify, syncRemediations, } from './log_config_files/runtime/remediation_sync.js';
 import { loadEndpointBase } from './log_config_files/sender/endpoint_config.js';
 import { formatRemediationChangePreviewForApplied } from './remediation_change_preview.js';
-import { agentApprovalViolation, approvedTenantViolation, codexTenantViolation, codexTenants, emailAllowlistViolation, cursorTeamViolation, readClaudeDesktopSignedInTenant, readClaudeSignedInTenant, readCodexSignedIn, readCursorSignedInTeams, } from './approved_tenant_gate.js';
+import { agentApprovalViolation, approvedTenantViolation, codexLoginViolation, emailAllowlistViolation, cursorLoginViolation, readClaudeDesktopSignedInTenant, readClaudeSignedInTenant, readCodexSignedIn, readCursorSignedInTeams, } from './approved_tenant_gate.js';
 const MANIFEST_STALE_MS = 7 * 24 * 60 * 60 * 1000;
 /** After verified (or failed verify), push enforcement + session log immediately — do not wait for background runner. */
 async function flushRemediationOutcomeToServer(complianceLogPath) {
@@ -265,23 +265,18 @@ function loginEmail(agent) {
 }
 /** Why this agent's signed-in tenant is not approved, or null when it is (or cannot be read). */
 function tenantViolation(agent) {
-    const approved = readRemediationInstructionsFile().approved_tenants;
+    const { approved_tenants: approved, team_email_domains: teamDomains } = readRemediationInstructionsFile();
     if (agent === 'claude')
         return approvedTenantViolation('claude', approved, readClaudeSignedInTenant());
     if (agent === 'claude_desktop') {
         return approvedTenantViolation('claude_desktop', approved, readClaudeDesktopSignedInTenant());
     }
-    // A personal account (Cursor on no team, Codex on a personal plan) has no tenant to approve: only
-    // the email allowlist decides it.
-    if (agent === 'codex') {
-        const signedIn = readCodexSignedIn();
-        const tenants = signedIn ? codexTenants(signedIn) : null;
-        return tenants?.some((t) => !t.startsWith('@')) ? codexTenantViolation(approved, signedIn) : null;
-    }
-    if (agent === 'cursor') {
-        const signedIn = readCursorSignedInTeams();
-        return signedIn?.team_ids.length ? cursorTeamViolation(approved, signedIn) : null;
-    }
+    // A personal account (Cursor on no team, Codex on a personal plan) is left to the email allowlist
+    // until its domain is a team domain; then it needs its personal tenant approved.
+    if (agent === 'codex')
+        return codexLoginViolation(approved, readCodexSignedIn(), teamDomains);
+    if (agent === 'cursor')
+        return cursorLoginViolation(approved, readCursorSignedInTeams(), teamDomains);
     return null;
 }
 /** The block for a login: which check refused it and why, or null when every check passes. */

package/dist/log_config_files/runtime/management_storage.js

@@ -133,20 +133,29 @@ export function writeRemediationInstructionsFile(file) {
 }
 function writeInstructionsFile(file, remediationsWrittenAt) {
     // Most callers write `{ remediations }` only; keep the approval lists they didn't pass.
-    const onDisk = readRemediationInstructionsFile();
-    const approved_tenants = 'approved_tenants' in file ? file.approved_tenants : onDisk.approved_tenants;
-    const unapproved_email_domains = 'unapproved_email_domains' in file ? file.unapproved_email_domains : onDisk.unapproved_email_domains;
-    const allowed_email_domains = 'allowed_email_domains' in file ? file.allowed_email_domains : onDisk.allowed_email_domains;
-    const approved_agents = 'approved_agents' in file ? file.approved_agents : onDisk.approved_agents;
     atomicWriteJson(getRemediationInstructionsPath(), {
         ...file,
-        ...(approved_tenants === undefined ? {} : { approved_tenants }),
-        ...(unapproved_email_domains === undefined ? {} : { unapproved_email_domains }),
-        ...(allowed_email_domains === undefined ? {} : { allowed_email_domains }),
-        ...(approved_agents === undefined ? {} : { approved_agents }),
+        ...keptApprovalLists(file, readRemediationInstructionsFile()),
         remediations_written_at: remediationsWrittenAt,
     });
 }
+const APPROVAL_LISTS = [
+    'approved_tenants',
+    'unapproved_email_domains',
+    'allowed_email_domains',
+    'approved_agents',
+    'team_email_domains',
+];
+/** Each approval list from `file` when it names one, else the one on disk; absent ones left out. */
+function keptApprovalLists(file, onDisk) {
+    const kept = {};
+    for (const key of APPROVAL_LISTS) {
+        const value = key in file ? file[key] : onDisk[key];
+        if (value !== undefined)
+            kept[key] = value;
+    }
+    return kept;
+}
 /** When the remediations on disk were written: recorded, or for an older file its mtime. */
 function remediationsWrittenAtOf(onDisk) {
     if (onDisk.remediations_written_at)
@@ -167,6 +176,10 @@ export function writeUnapprovedEmailDomains(unapproved_email_domains) {
 export function writeApprovedAgents(approved_agents) {
     writeApprovalList({ approved_agents });
 }
+/** Replace only the team email domains, keeping everything else on disk. */
+export function writeTeamEmailDomains(team_email_domains) {
+    writeApprovalList({ team_email_domains });
+}
 /** Replace only the email allowlist, keeping everything else on disk. */
 export function writeAllowedEmailDomains(allowed_email_domains) {
     writeApprovalList({ allowed_email_domains });

package/dist/log_config_files/runtime/remediation_sync.js

@@ -4,7 +4,7 @@ import { homedir } from 'node:os';
 import { executeBody } from '../../endpoint_client/http_transport.js';
 import { parseJsonWithJsoncFallback, parseTomlText, stringifyToml } from '../readers/file_readers.js';
 import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
-import { atomicWriteJson, getDeferredVscdbApplyPath, getFileCollectionVscdbContractPath, getRemediationInstructionsPath, readRemediationInstructionsFile, writeApprovedTenants, writeUnapprovedEmailDomains, writeAllowedEmailDomains, writeApprovedAgents, writeRemediationInstructionsFile, } from './management_storage.js';
+import { atomicWriteJson, getDeferredVscdbApplyPath, getFileCollectionVscdbContractPath, getRemediationInstructionsPath, readRemediationInstructionsFile, writeApprovedTenants, writeUnapprovedEmailDomains, writeAllowedEmailDomains, writeTeamEmailDomains, writeApprovedAgents, writeRemediationInstructionsFile, } from './management_storage.js';
 import { readStoredAuthKey } from '../auth/auth_key_store.js';
 import { ensureAuthentication } from '../auth/auth_flow.js';
 import { createSignature } from '../sender/signing.js';
@@ -1653,6 +1653,9 @@ function storeApprovals(syncResult) {
     const allowedDomains = syncResult.allowed_email_domains;
     if (Array.isArray(allowedDomains))
         writeAllowedEmailDomains(lowercaseStrings(allowedDomains));
+    const teamDomains = syncResult.team_email_domains;
+    if (Array.isArray(teamDomains))
+        writeTeamEmailDomains(lowercaseStrings(teamDomains));
 }
 async function reconcileInstructions(endpointBase, machineUuid, want) {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.27",
+  "version": "1.5.28",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {