@optimuslabs/harness-map-staging 1.5.29 → 1.5.31

package/dist/approved_tenant_gate.js

@@ -62,6 +62,7 @@ export function readClaudeSignedInTenant(env = process.env) {
             tenant_name: text('organizationName'),
             email: text('emailAddress'),
             account_uuid: text('accountUuid'),
+            plan: text('organizationType').toLowerCase().replace(/^claude_/, ''),
         };
     }
     catch {
@@ -69,14 +70,74 @@ export function readClaudeSignedInTenant(env = process.env) {
         return null;
     }
 }
-/** How to get out of a blocked tenant: Claude Desktop switches organization, Claude Code logs in. */
-function fix(agent, which) {
-    return agent === 'claude_desktop'
-        ? `Switch Claude Desktop to ${which} organization, or sign in to one.`
-        : `Run /login to sign in to ${which} organization.`;
+/**
+ * Block messages, one shape for every agent (Optimus Labs' prompt-block wording):
+ * "This device only allows <agent> <under/on/in> the <approved> <kind>. You're signed in to
+ * <what>. <how to switch>." With nothing approved yet: "This device doesn't allow <agent> signed in
+ * to <what>." and the same last sentence.
+ */
+const TENANT_WORDS = {
+    claude: { name: 'Claude Code', kind: 'organization', prep: 'under' },
+    claude_desktop: { name: 'Claude Desktop', kind: 'organization', prep: 'under' },
+    cursor: { name: 'Cursor', kind: 'team', prep: 'on' },
+    codex: { name: 'Codex', kind: 'workspace', prep: 'in' },
+};
+/** A tenant's name as the admin approved it, or its id when it has none. */
+function nameOf(t) {
+    return (t.tenant_name || '').trim() || t.tenant_id.trim();
+}
+function emailDomain(email) {
+    const address = (email ?? '').trim().toLowerCase();
+    const at = address.lastIndexOf('@');
+    return at >= 0 && at < address.length - 1 ? address.slice(at + 1) : '';
 }
-function label(name, id) {
-    return name ? `${name} (${id})` : id;
+function capitalised(word) {
+    return word ? word[0].toUpperCase() + word.slice(1) : word;
+}
+/** What to pick to get back in: the one approved tenant, one of several, or the company's own. */
+function choice(approved, kind) {
+    if (approved.length === 1)
+        return approved[0];
+    return approved.length > 1 ? 'one of them' : `your company's ${kind}`;
+}
+function switchStep(agent, approved) {
+    const kind = TENANT_WORDS[agent].kind;
+    if (agent === 'claude_desktop')
+        return `Switch Claude Desktop to ${choice(approved, kind)}.`;
+    if (agent === 'codex')
+        return `Run codex logout, then codex login and choose ${choice(approved, kind)}.`;
+    if (agent === 'cursor') {
+        if (approved.length === 1)
+            return `Sign out of Cursor and sign in with your ${approved[0]} team account.`;
+        return approved.length > 1
+            ? 'Sign out of Cursor and sign in with an account on one of those teams.'
+            : "Sign out of Cursor and sign in with your company's team account.";
+    }
+    return `Run /login and choose ${choice(approved, kind)}.`;
+}
+/** The block message for `agent` signed in to `signedIn` (already worded) with these approved. */
+export function tenantBlockMessage(agent, approved, signedIn) {
+    const w = TENANT_WORDS[agent];
+    const lead = approved.length
+        ? `This device only allows ${w.name} ${w.prep} the ${approved.join(' or ')} ${w.kind}. ` +
+            `You're signed in to ${signedIn}.`
+        : `This device doesn't allow ${w.name} signed in to ${signedIn}.`;
+    return `${lead} ${switchStep(agent, approved)}`;
+}
+const CLAUDE_PERSONAL_PLANS = new Set(['free', 'pro', 'max']);
+/** "a personal Max account (gmail.com)" or "the Beta Corp organization". */
+function claudeSignedInText(signedIn) {
+    const plan = (signedIn.plan ?? '').trim().toLowerCase();
+    const domain = emailDomain(signedIn.email);
+    const at = domain ? ` (${domain})` : '';
+    // A personal claude.ai org is named after its owner: "ada@gmail.com's Organization".
+    if (CLAUDE_PERSONAL_PLANS.has(plan) || /'s organization$/i.test(signedIn.tenant_name)) {
+        const planWord = CLAUDE_PERSONAL_PLANS.has(plan) ? `${capitalised(plan)} ` : '';
+        return `a personal ${planWord}account${at}`;
+    }
+    if (signedIn.tenant_name)
+        return `the ${signedIn.tenant_name} organization`;
+    return `an organization your company has not approved${at}`;
 }
 function tenantIds(tenants) {
     return (tenants ?? []).filter((t) => t && typeof t.tenant_id === 'string' && t.tenant_id.trim());
@@ -96,21 +157,11 @@ export function approvedTenantViolation(agent, approved, signedIn) {
     const unapprovedTenants = tenantIds(policy?.unapproved_tenants);
     const signedInId = signedIn.tenant_id.trim();
     const isIn = (list) => list.some((t) => t.tenant_id.trim() === signedInId);
-    let reason;
-    if (isIn(unapprovedTenants)) {
-        reason = 'which your organization has marked unapproved';
-    }
-    else if ((policy?.enforced || approvedTenants.length > 0) && !isIn(approvedTenants)) {
-        reason = 'which your organization has not approved';
-    }
-    else {
+    const blocked = isIn(unapprovedTenants) ||
+        ((policy?.enforced || approvedTenants.length > 0) && !isIn(approvedTenants));
+    if (!blocked)
         return null;
-    }
-    const allowed = approvedTenants.map((t) => label(t.tenant_name, t.tenant_id)).join(', ');
-    return (`this session is signed into ${label(signedIn.tenant_name, signedIn.tenant_id)}, ${reason}. ` +
-        (allowed
-            ? `Approved: ${allowed}. ${fix(agent, 'an approved')}`
-            : fix(agent, 'a different')));
+    return tenantBlockMessage(agent, approvedTenants.map(nameOf), claudeSignedInText(signedIn));
 }
 /**
  * The tenants a Cursor login is in: its teams, or, on no team, `@` and its email domain. Mirrors the
@@ -142,43 +193,61 @@ export function readCursorSignedInTeams(home = homedir()) {
  * the login; failing that, one marked unapproved is always blocked, and any other -- an unknown
  * tenant, or a personal account -- only once at least one tenant is approved for this agent.
  */
-function listedTenantViolation(policy, tenants, noun) {
+function listedTenantViolation(policy, tenants) {
     const approvedList = tenantIds(policy?.tenants);
     if (tenants.some((id) => isListed(approvedList, id)))
         return null;
-    const what = refusedTenantsText(tenants, noun, approvedList.length > 0 || Boolean(policy?.enforced), tenantIds(policy?.unapproved_tenants));
-    if (what === null)
+    const enforced = approvedList.length > 0 || Boolean(policy?.enforced);
+    if (!isRefused(tenants, enforced, tenantIds(policy?.unapproved_tenants)))
         return null;
-    return { what, allowed: approvedList.map((t) => label(t.tenant_name, t.tenant_id)).join(', ') };
+    return { approved: approvedList.map(nameOf) };
 }
 function isListed(list, id) {
     return list.some((t) => t.tenant_id.trim() === id);
 }
-function describeTenant(id, noun) {
-    return id.startsWith('@') ? `a personal account with an ${id} email` : `${noun} ${id}`;
+/** Whether a login in these tenants is refused: one marked unapproved always; any other only once
+ * the agent is enforced (an older backend that sends no flag, with nothing approved, lets it pass). */
+function isRefused(tenants, enforced, unapprovedList) {
+    if (tenants.some((id) => isListed(unapprovedList, id)))
+        return true;
+    return enforced;
 }
-/** What the login is signed into and why that is refused, or null when it is not refused. */
-function refusedTenantsText(tenants, noun, enforced, unapprovedList) {
-    const marked = tenants.find((id) => isListed(unapprovedList, id));
-    if (marked)
-        return `${describeTenant(marked, noun)}, which your organization has marked unapproved`;
-    // Not enforced (an older backend that sends no flag) and nothing approved: shadow passes.
-    if (!enforced)
-        return null;
-    if (tenants.length === 0)
-        return `a personal account that is on no ${noun}, which your organization has not approved`;
-    return `${tenants.map((id) => describeTenant(id, noun)).join(', ')}, which your organization has not approved`;
+/** A tenant's name from the organization's lists, or '' when it has none there. */
+function knownName(policy, id) {
+    const all = [...tenantIds(policy?.tenants), ...tenantIds(policy?.unapproved_tenants)];
+    const hit = all.find((t) => t.tenant_id.trim() === id);
+    return (hit?.tenant_name || '').trim();
+}
+/** "a personal account on no team (gmail.com)", "the Beta team" or "team 9876". */
+function cursorSignedInText(signedIn, policy) {
+    const tenants = cursorTenants(signedIn);
+    if (!tenants.length || tenants[0].startsWith('@')) {
+        const domain = emailDomain(signedIn.email) || (tenants[0] ?? '').slice(1);
+        return `a personal account on no team${domain ? ` (${domain})` : ''}`;
+    }
+    return tenants
+        .map((id) => (knownName(policy, id) ? `the ${knownName(policy, id)} team` : `team ${id}`))
+        .join(' and ');
+}
+/** "a personal ChatGPT Plus account (gmail.com)", "the Beta workspace" or "workspace ws-1". */
+function codexSignedInText(signedIn, tenants, policy) {
+    const tenant = tenants[0] ?? '';
+    if (!tenant || tenant.startsWith('@')) {
+        const plan = capitalised((signedIn.plan ?? '').trim().toLowerCase());
+        const domain = emailDomain(signedIn.email) || tenant.slice(1);
+        return `a personal ChatGPT ${plan ? `${plan} ` : ''}account${domain ? ` (${domain})` : ''}`;
+    }
+    const name = knownName(policy, tenant);
+    return name ? `the ${name} workspace` : `workspace ${tenant}`;
 }
 /** The block message when Cursor's login may not be used, else null. */
 export function cursorTeamViolation(approved, signedIn) {
     if (!signedIn)
         return null;
-    const v = listedTenantViolation(approved?.cursor, cursorTenants(signedIn), 'team');
+    const v = listedTenantViolation(approved?.cursor, cursorTenants(signedIn));
     if (!v)
         return null;
-    return (`this Cursor session is signed into ${v.what}. ` +
-        (v.allowed ? `Approved: ${v.allowed}. ` : '') +
-        'Sign out of Cursor and sign in with an account on an approved team.');
+    return tenantBlockMessage('cursor', v.approved, cursorSignedInText(signedIn, approved?.cursor));
 }
 /**
  * Codex plans that are personal, mirroring the backend's `CodexPlans.PERSONAL`. On one of these
@@ -221,12 +290,10 @@ export function codexTenantViolation(approved, signedIn) {
     const tenants = signedIn ? codexTenants(signedIn) : null;
     if (!tenants)
         return null;
-    const v = listedTenantViolation(approved?.codex, tenants, 'workspace');
+    const v = listedTenantViolation(approved?.codex, tenants);
     if (!v)
         return null;
-    return (`this Codex session is signed into ${v.what}. ` +
-        (v.allowed ? `Approved: ${v.allowed}. ` : '') +
-        'Run `codex logout`, then sign in to an approved workspace.');
+    return tenantBlockMessage('codex', v.approved, codexSignedInText(signedIn, tenants, approved?.codex));
 }
 /**
  * Whether a personal account's `@<domain>` tenant is on a team domain: an allowlisted domain that
@@ -276,6 +343,7 @@ export function readClaudeDesktopSignedInTenant(home = homedir(), env = process.
         tenant_name: same ? fromClaudeCode.tenant_name : '',
         email: same ? fromClaudeCode.email : '',
         account_uuid: account || (same ? fromClaudeCode.account_uuid : ''),
+        plan: same ? fromClaudeCode.plan : '',
     };
 }
 /**
@@ -293,8 +361,8 @@ export function unapprovedEmailDomainViolation(email, unapproved) {
     const hit = unapproved.find((d) => domain === d || domain.endsWith(`.${d}`));
     if (!hit)
         return null;
-    return (`this session is signed in as ${address}, on @${hit}, which your organization has unapproved. ` +
-        'Sign in with an account on an approved email domain.');
+    return (`This device doesn't allow accounts on ${hit}. You're signed in as ${address}. ` +
+        'Sign in with your work account.');
 }
 /**
  * The block message when a login's email is not on the organization's email allowlist, else null.
@@ -313,8 +381,8 @@ export function emailAllowlistViolation(email, allowed) {
     const domain = address.slice(at + 1);
     if (allowed.some((d) => domain === d || domain.endsWith(`.${d}`)))
         return null;
-    return (`this session is signed in as ${address}, and @${domain} is not on your organization's email allowlist. ` +
-        'Sign in with an account on an allowed email domain.');
+    return (`This device only allows accounts on your organization's email domains. You're signed in as ${address}. ` +
+        'Sign in with your work account.');
 }
 /** The id an agent is approved under on the Agents page: Desktop's Code tab runs Claude Code. */
 const APPROVAL_ID = { claude_desktop: 'claude' };

package/dist/compliance_prompt_gate.js

@@ -87,9 +87,10 @@ function printAllowWithAdvisory(ide, advisoryMessage) {
         }));
     }
 }
+/** Every block reads as an Optimus Labs notice: a title line, then the message. */
+const BLOCK_TITLE = 'Optimus Labs\n\n';
 function blockPayload(ide, violationMessage) {
-    const prefix = 'Prompt blocked by Optimus: ';
-    const text = prefix + violationMessage;
+    const text = BLOCK_TITLE + violationMessage;
     if (ide === 'claude' || ide === 'copilot' || ide === 'opencode') {
         return JSON.stringify({ decision: 'block', reason: text, systemMessage: text });
     }
@@ -100,7 +101,7 @@ function blockPayload(ide, violationMessage) {
  * warning, so the Claude-shaped payload (which carries both) prints the same sentence twice.
  */
 function codexBlockPayload(violationMessage) {
-    return JSON.stringify({ decision: 'block', reason: 'Prompt blocked by Optimus: ' + violationMessage });
+    return JSON.stringify({ decision: 'block', reason: BLOCK_TITLE + violationMessage });
 }
 function getManifestStalenessMs() {
     try {

package/dist/endpoint_client/http_transport.js

@@ -13,6 +13,9 @@ function buildGetOptions(url, timeoutMs) {
         path: url.pathname + url.search,
         method: 'GET',
         timeout: timeoutMs,
+        // A fresh socket per GET: Node 19+ keep-alive would reuse a socket left idle
+        // during the inventory disk scan, and a server FIN then looks like a failed fetch.
+        agent: false,
     };
 }
 function buildBodyOptions(url, payload, method, timeoutMs) {
@@ -31,23 +34,36 @@ function buildBodyOptions(url, payload, method, timeoutMs) {
         timeout: timeoutMs,
     };
 }
-/** Execute a GET request. Returns statusCode=0 and empty body on network/timeout failure. */
-export function executeGet(urlStr, timeoutMs) {
+function executeGetOnce(urlStr, timeoutMs) {
     const url = new URL(urlStr);
     const options = buildGetOptions(url, timeoutMs);
     const transport = url.protocol === 'https:' ? https.request : http.request;
     return new Promise((resolve) => {
+        let done = false;
+        const finish = (result) => {
+            if (done)
+                return;
+            done = true;
+            resolve(result);
+        };
         const req = transport(options, (res) => {
             let body = '';
             res.setEncoding('utf8');
             res.on('data', (chunk) => { body += chunk; });
-            res.on('end', () => resolve({ statusCode: res.statusCode ?? 0, body }));
+            res.on('end', () => finish({ statusCode: res.statusCode ?? 0, body }));
         });
-        req.on('error', () => resolve({ statusCode: 0, body: '' }));
-        req.on('timeout', () => { req.destroy(); resolve({ statusCode: 0, body: '' }); });
+        req.on('error', () => finish({ statusCode: 0, body: '' }));
+        req.on('timeout', () => { req.destroy(); finish({ statusCode: 0, body: '' }); });
         req.end();
     });
 }
+/** Execute a GET. Retries once on a dropped connection (status 0). */
+export async function executeGet(urlStr, timeoutMs) {
+    const first = await executeGetOnce(urlStr, timeoutMs);
+    if (first.statusCode !== 0)
+        return first;
+    return executeGetOnce(urlStr, timeoutMs);
+}
 /** Execute a POST/PATCH request. A Buffer payload is sent as `Content-Encoding: gzip`. Rejects on network error or timeout. */
 export function executeBody(urlStr, method, payload, timeoutMs) {
     const url = new URL(urlStr);

package/dist/log_config_files/runtime/main_runner.js

@@ -2,9 +2,9 @@ import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 const HOME_DIR = homedir();
-import { getFileCollectionPatterns, FILE_PATH_REGISTRY_FILE_PATTERNS_PATH } from '../../endpoint_client/index.js';
+import { getFileCollectionPatterns, getSensitivePathsAuditCandidates, FILE_PATH_REGISTRY_FILE_PATTERNS_PATH, } from '../../endpoint_client/index.js';
 import { OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT } from '../../bootstrap_constants.js';
-import { runSensitivePathsAudit } from '../../log_sensitive_paths_audit.js';
+import { CandidatesFetchError, runSensitivePathsAudit } from '../../log_sensitive_paths_audit.js';
 import { buildPathPermissionsAuditEntry, grantPathsFromConfig } from '../../log_path_permissions_audit.js';
 import { loadEndpointBase, getEndpointSource } from '../sender/endpoint_config.js';
 import { hookLogReplace, hookRunLog, hookLogError, readHookLog } from './hook_logger.js';
@@ -115,6 +115,8 @@ function filterToActiveWorktrees(configFiles) {
     return { configFiles: filtered, worktreeReport };
 }
 async function collectAllConfigFiles(endpointBase) {
+    // Same moment as file-patterns, not after the disk scan: that gap is what dropped this GET.
+    const candidatesPromise = getSensitivePathsAuditCandidates(endpointBase);
     const patternsResponse = await fetchPatterns(endpointBase);
     const configFiles = scanPatterns(patternsResponse);
     const seen = new Set(configFiles.map(configFileKey));
@@ -134,26 +136,45 @@ async function collectAllConfigFiles(endpointBase) {
     const skillsCliEntry = collectSkillsCliInstalled(PROJECT_ROOT, hookRunLog);
     if (skillsCliEntry)
         addUnseen(configFiles, seen, [skillsCliEntry]);
-    return filterToActiveWorktrees(configFiles);
+    return { ...filterToActiveWorktrees(configFiles), candidatesPromise };
 }
 /** Adds the sensitive paths audit to the batch; false when it could not be run (nothing added). */
-async function addSensitivePathsAudit(endpointBase, configFiles) {
+async function addSensitivePathsAudit(endpointBase, configFiles, candidatesPromise) {
     hookRunLog(`running sensitive paths audit`);
     const auditOutputDir = join(homedir(), OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT);
+    const prefetched = await candidatesPromise;
     try {
-        const auditResult = await runSensitivePathsAudit(endpointBase, auditOutputDir, PROJECT_ROOT);
+        const auditResult = await runSensitivePathsAudit(endpointBase, auditOutputDir, PROJECT_ROOT, prefetched);
         hookRunLog(`sensitive_paths_audit: ${auditResult.paths.length} path(s)`);
         configFiles.push({ file_type: 'sensitive_paths_audit', file_path: 'sensitive_paths_audit.txt', raw_content: { paths: auditResult.paths } });
         return true;
     }
     catch (err) {
-        // Send no audit rather than an empty one: the backend keeps the machine's last good audit.
-        hookRunLog(`sensitive_paths_audit_error: ${err instanceof Error ? err.message : String(err)} (audit not sent)`);
+        // Keep the last good audit either way. Only a missed candidates GET is transient;
+        // a local write failure (EACCES, ENOSPC) is an endpoint fault and must still
+        // report a failed FunctionalRun so Sensor failing stays visible.
+        const message = err instanceof Error ? err.message : String(err);
+        hookRunLog(`sensitive_paths_audit_error: ${message} (audit not sent)`);
         hookLogError('sensitive_paths_audit', err, { endpoint: endpointBase, output_dir: auditOutputDir });
-        await reportFunctionalFailureAwait('inventory', 'sensitive_paths_audit', err);
+        console.error(`sensitive_paths_audit: ${message}`);
+        if (!(err instanceof CandidatesFetchError)) {
+            await reportFunctionalFailureAwait('inventory', 'sensitive_paths_audit', err);
+        }
         return false;
     }
 }
+async function collectInventory(endpointBase) {
+    const collected = await collectAllConfigFiles(endpointBase);
+    const sensitiveAudited = await addSensitivePathsAudit(endpointBase, collected.configFiles, collected.candidatesPromise);
+    ensureCursorUserSettingsSnapshotInBatch(collected.configFiles);
+    if (sensitiveAudited) {
+        addPathPermissionsAudit(collected.configFiles);
+    }
+    else {
+        hookRunLog('path_permissions_audit: skipped (no sensitive paths audit this run)');
+    }
+    return collected;
+}
 /** POSIX mode of every collected file, plus granted folders (and their ancestors) and sensitive audit hits within a budget. stat() only. */
 function addPathPermissionsAudit(configFiles) {
     const visited = [];
@@ -251,7 +272,7 @@ async function main() {
     let configFiles;
     let worktreeReport = [];
     try {
-        const collected = await collectAllConfigFiles(endpointBase);
+        const collected = await collectInventory(endpointBase);
         configFiles = collected.configFiles;
         worktreeReport = collected.worktreeReport;
     }
@@ -259,16 +280,6 @@ async function main() {
         hookRunLog(`patterns_error: ${err instanceof Error ? err.message : String(err)}`);
         throw err;
     }
-    const sensitiveAudited = await addSensitivePathsAudit(endpointBase, configFiles);
-    ensureCursorUserSettingsSnapshotInBatch(configFiles);
-    if (sensitiveAudited) {
-        addPathPermissionsAudit(configFiles);
-    }
-    else {
-        // Built without the sensitive paths, it would replace the backend's last good permissions
-        // audit and drop those paths' modes; skip it so both audits stay as last sent.
-        hookRunLog('path_permissions_audit: skipped (no sensitive paths audit this run)');
-    }
     const fileTypes = [...new Set(configFiles.map((c) => c.file_type))].join(', ');
     hookRunLog(`collected ${configFiles.length} config file(s) file_types=${fileTypes}`);
     for (const c of configFiles) {
@@ -333,4 +344,4 @@ async function logSingleFile(filePath) {
     }
     return sendConfigFile({ file_type: fileType, file_path: filePath, raw_content: rawContent }, hardwareUuid, authKey);
 }
-export { main, logSingleFile, createSignature, canonicalizePayload, sendConfigFile, sendConfigFilesBatch, BATCH_CHUNK_SIZE };
+export { main, logSingleFile, createSignature, canonicalizePayload, sendConfigFile, sendConfigFilesBatch, BATCH_CHUNK_SIZE, addSensitivePathsAudit, };

package/dist/log_sensitive_paths_audit.js

@@ -9,10 +9,17 @@
 import { existsSync, writeFileSync, mkdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { getSensitivePathsAuditCandidates } from './endpoint_client/index.js';
+import { getSensitivePathsAuditCandidates, } from './endpoint_client/index.js';
 import { OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT } from './bootstrap_constants.js';
 import { loadEndpointBase } from './log_config_files/sender/endpoint_config.js';
 const AUDIT_FILENAME = 'sensitive_paths_audit.txt';
+/** Thrown when the candidates GET returned nothing usable. Transient: do not mark the sensor as failing. */
+export class CandidatesFetchError extends Error {
+    constructor(endpointBase) {
+        super(`could not fetch sensitive path candidates from ${endpointBase}`);
+        this.name = 'CandidatesFetchError';
+    }
+}
 function expandPath(template, cwd) {
     if (template.startsWith('~/')) {
         return join(homedir(), template.slice(2));
@@ -66,10 +73,13 @@ export function writeSensitivePathsAudit(outputDir, pathTemplates, cwd = process
  * Throws when the candidates can't be fetched: an audit run without them would report no
  * sensitive paths, and sending it would replace the machine's last good audit on the backend.
  */
-export async function runSensitivePathsAudit(endpointBase, outputDir = join(homedir(), OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT), cwd = process.cwd()) {
-    const response = await getSensitivePathsAuditCandidates(endpointBase);
+export async function runSensitivePathsAudit(endpointBase, outputDir = join(homedir(), OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT), cwd = process.cwd(), prefetched) {
+    let response = prefetched;
+    if (response == null) {
+        response = await getSensitivePathsAuditCandidates(endpointBase);
+    }
     if (!response) {
-        throw new Error(`could not fetch sensitive path candidates from ${endpointBase}`);
+        throw new CandidatesFetchError(endpointBase);
     }
     const paths = writeSensitivePathsAudit(outputDir, response.paths, cwd);
     const outPath = join(outputDir, AUDIT_FILENAME);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.29",
+  "version": "1.5.31",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {