@optimuslabs/harness-map-staging 1.5.30 → 1.5.32

package/dist/endpoint_client/http_transport.js

@@ -13,6 +13,9 @@ function buildGetOptions(url, timeoutMs) {
         path: url.pathname + url.search,
         method: 'GET',
         timeout: timeoutMs,
+        // A fresh socket per GET: Node 19+ keep-alive would reuse a socket left idle
+        // during the inventory disk scan, and a server FIN then looks like a failed fetch.
+        agent: false,
     };
 }
 function buildBodyOptions(url, payload, method, timeoutMs) {
@@ -31,23 +34,36 @@ function buildBodyOptions(url, payload, method, timeoutMs) {
         timeout: timeoutMs,
     };
 }
-/** Execute a GET request. Returns statusCode=0 and empty body on network/timeout failure. */
-export function executeGet(urlStr, timeoutMs) {
+function executeGetOnce(urlStr, timeoutMs) {
     const url = new URL(urlStr);
     const options = buildGetOptions(url, timeoutMs);
     const transport = url.protocol === 'https:' ? https.request : http.request;
     return new Promise((resolve) => {
+        let done = false;
+        const finish = (result) => {
+            if (done)
+                return;
+            done = true;
+            resolve(result);
+        };
         const req = transport(options, (res) => {
             let body = '';
             res.setEncoding('utf8');
             res.on('data', (chunk) => { body += chunk; });
-            res.on('end', () => resolve({ statusCode: res.statusCode ?? 0, body }));
+            res.on('end', () => finish({ statusCode: res.statusCode ?? 0, body }));
         });
-        req.on('error', () => resolve({ statusCode: 0, body: '' }));
-        req.on('timeout', () => { req.destroy(); resolve({ statusCode: 0, body: '' }); });
+        req.on('error', () => finish({ statusCode: 0, body: '' }));
+        req.on('timeout', () => { req.destroy(); finish({ statusCode: 0, body: '' }); });
         req.end();
     });
 }
+/** Execute a GET. Retries once on a dropped connection (status 0). */
+export async function executeGet(urlStr, timeoutMs) {
+    const first = await executeGetOnce(urlStr, timeoutMs);
+    if (first.statusCode !== 0)
+        return first;
+    return executeGetOnce(urlStr, timeoutMs);
+}
 /** Execute a POST/PATCH request. A Buffer payload is sent as `Content-Encoding: gzip`. Rejects on network error or timeout. */
 export function executeBody(urlStr, method, payload, timeoutMs) {
     const url = new URL(urlStr);

package/dist/log_config_files/runtime/main_runner.js

@@ -2,9 +2,9 @@ import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 const HOME_DIR = homedir();
-import { getFileCollectionPatterns, FILE_PATH_REGISTRY_FILE_PATTERNS_PATH } from '../../endpoint_client/index.js';
+import { getFileCollectionPatterns, getSensitivePathsAuditCandidates, FILE_PATH_REGISTRY_FILE_PATTERNS_PATH, } from '../../endpoint_client/index.js';
 import { OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT } from '../../bootstrap_constants.js';
-import { runSensitivePathsAudit } from '../../log_sensitive_paths_audit.js';
+import { CandidatesFetchError, runSensitivePathsAudit } from '../../log_sensitive_paths_audit.js';
 import { buildPathPermissionsAuditEntry, grantPathsFromConfig } from '../../log_path_permissions_audit.js';
 import { loadEndpointBase, getEndpointSource } from '../sender/endpoint_config.js';
 import { hookLogReplace, hookRunLog, hookLogError, readHookLog } from './hook_logger.js';
@@ -115,6 +115,8 @@ function filterToActiveWorktrees(configFiles) {
     return { configFiles: filtered, worktreeReport };
 }
 async function collectAllConfigFiles(endpointBase) {
+    // Same moment as file-patterns, not after the disk scan: that gap is what dropped this GET.
+    const candidatesPromise = getSensitivePathsAuditCandidates(endpointBase);
     const patternsResponse = await fetchPatterns(endpointBase);
     const configFiles = scanPatterns(patternsResponse);
     const seen = new Set(configFiles.map(configFileKey));
@@ -134,26 +136,45 @@ async function collectAllConfigFiles(endpointBase) {
     const skillsCliEntry = collectSkillsCliInstalled(PROJECT_ROOT, hookRunLog);
     if (skillsCliEntry)
         addUnseen(configFiles, seen, [skillsCliEntry]);
-    return filterToActiveWorktrees(configFiles);
+    return { ...filterToActiveWorktrees(configFiles), candidatesPromise };
 }
 /** Adds the sensitive paths audit to the batch; false when it could not be run (nothing added). */
-async function addSensitivePathsAudit(endpointBase, configFiles) {
+async function addSensitivePathsAudit(endpointBase, configFiles, candidatesPromise) {
     hookRunLog(`running sensitive paths audit`);
     const auditOutputDir = join(homedir(), OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT);
+    const prefetched = await candidatesPromise;
     try {
-        const auditResult = await runSensitivePathsAudit(endpointBase, auditOutputDir, PROJECT_ROOT);
+        const auditResult = await runSensitivePathsAudit(endpointBase, auditOutputDir, PROJECT_ROOT, prefetched);
         hookRunLog(`sensitive_paths_audit: ${auditResult.paths.length} path(s)`);
         configFiles.push({ file_type: 'sensitive_paths_audit', file_path: 'sensitive_paths_audit.txt', raw_content: { paths: auditResult.paths } });
         return true;
     }
     catch (err) {
-        // Send no audit rather than an empty one: the backend keeps the machine's last good audit.
-        hookRunLog(`sensitive_paths_audit_error: ${err instanceof Error ? err.message : String(err)} (audit not sent)`);
+        // Keep the last good audit either way. Only a missed candidates GET is transient;
+        // a local write failure (EACCES, ENOSPC) is an endpoint fault and must still
+        // report a failed FunctionalRun so Sensor failing stays visible.
+        const message = err instanceof Error ? err.message : String(err);
+        hookRunLog(`sensitive_paths_audit_error: ${message} (audit not sent)`);
         hookLogError('sensitive_paths_audit', err, { endpoint: endpointBase, output_dir: auditOutputDir });
-        await reportFunctionalFailureAwait('inventory', 'sensitive_paths_audit', err);
+        console.error(`sensitive_paths_audit: ${message}`);
+        if (!(err instanceof CandidatesFetchError)) {
+            await reportFunctionalFailureAwait('inventory', 'sensitive_paths_audit', err);
+        }
         return false;
     }
 }
+async function collectInventory(endpointBase) {
+    const collected = await collectAllConfigFiles(endpointBase);
+    const sensitiveAudited = await addSensitivePathsAudit(endpointBase, collected.configFiles, collected.candidatesPromise);
+    ensureCursorUserSettingsSnapshotInBatch(collected.configFiles);
+    if (sensitiveAudited) {
+        addPathPermissionsAudit(collected.configFiles);
+    }
+    else {
+        hookRunLog('path_permissions_audit: skipped (no sensitive paths audit this run)');
+    }
+    return collected;
+}
 /** POSIX mode of every collected file, plus granted folders (and their ancestors) and sensitive audit hits within a budget. stat() only. */
 function addPathPermissionsAudit(configFiles) {
     const visited = [];
@@ -251,7 +272,7 @@ async function main() {
     let configFiles;
     let worktreeReport = [];
     try {
-        const collected = await collectAllConfigFiles(endpointBase);
+        const collected = await collectInventory(endpointBase);
         configFiles = collected.configFiles;
         worktreeReport = collected.worktreeReport;
     }
@@ -259,16 +280,6 @@ async function main() {
         hookRunLog(`patterns_error: ${err instanceof Error ? err.message : String(err)}`);
         throw err;
     }
-    const sensitiveAudited = await addSensitivePathsAudit(endpointBase, configFiles);
-    ensureCursorUserSettingsSnapshotInBatch(configFiles);
-    if (sensitiveAudited) {
-        addPathPermissionsAudit(configFiles);
-    }
-    else {
-        // Built without the sensitive paths, it would replace the backend's last good permissions
-        // audit and drop those paths' modes; skip it so both audits stay as last sent.
-        hookRunLog('path_permissions_audit: skipped (no sensitive paths audit this run)');
-    }
     const fileTypes = [...new Set(configFiles.map((c) => c.file_type))].join(', ');
     hookRunLog(`collected ${configFiles.length} config file(s) file_types=${fileTypes}`);
     for (const c of configFiles) {
@@ -333,4 +344,4 @@ async function logSingleFile(filePath) {
     }
     return sendConfigFile({ file_type: fileType, file_path: filePath, raw_content: rawContent }, hardwareUuid, authKey);
 }
-export { main, logSingleFile, createSignature, canonicalizePayload, sendConfigFile, sendConfigFilesBatch, BATCH_CHUNK_SIZE };
+export { main, logSingleFile, createSignature, canonicalizePayload, sendConfigFile, sendConfigFilesBatch, BATCH_CHUNK_SIZE, addSensitivePathsAudit, };

package/dist/log_sensitive_paths_audit.js

@@ -9,10 +9,17 @@
 import { existsSync, writeFileSync, mkdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { getSensitivePathsAuditCandidates } from './endpoint_client/index.js';
+import { getSensitivePathsAuditCandidates, } from './endpoint_client/index.js';
 import { OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT } from './bootstrap_constants.js';
 import { loadEndpointBase } from './log_config_files/sender/endpoint_config.js';
 const AUDIT_FILENAME = 'sensitive_paths_audit.txt';
+/** Thrown when the candidates GET returned nothing usable. Transient: do not mark the sensor as failing. */
+export class CandidatesFetchError extends Error {
+    constructor(endpointBase) {
+        super(`could not fetch sensitive path candidates from ${endpointBase}`);
+        this.name = 'CandidatesFetchError';
+    }
+}
 function expandPath(template, cwd) {
     if (template.startsWith('~/')) {
         return join(homedir(), template.slice(2));
@@ -66,10 +73,13 @@ export function writeSensitivePathsAudit(outputDir, pathTemplates, cwd = process
  * Throws when the candidates can't be fetched: an audit run without them would report no
  * sensitive paths, and sending it would replace the machine's last good audit on the backend.
  */
-export async function runSensitivePathsAudit(endpointBase, outputDir = join(homedir(), OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT), cwd = process.cwd()) {
-    const response = await getSensitivePathsAuditCandidates(endpointBase);
+export async function runSensitivePathsAudit(endpointBase, outputDir = join(homedir(), OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT), cwd = process.cwd(), prefetched) {
+    let response = prefetched;
+    if (response == null) {
+        response = await getSensitivePathsAuditCandidates(endpointBase);
+    }
     if (!response) {
-        throw new Error(`could not fetch sensitive path candidates from ${endpointBase}`);
+        throw new CandidatesFetchError(endpointBase);
     }
     const paths = writeSensitivePathsAudit(outputDir, response.paths, cwd);
     const outPath = join(outputDir, AUDIT_FILENAME);

package/dist/pii_scrub.js

@@ -0,0 +1,15 @@
+/**
+ * pii-scrub shim: the one place that imports @optimuslabs/pii-scrub-staging.
+ *
+ * Loaded the way tofu.ts loads tofu: the sibling local dist when environment=development and it
+ * is built, the published npm package otherwise.
+ */
+import path from "path";
+import { fileURLToPath } from "url";
+import { shouldUseLocalTofuDist } from "./tofu_environment.js";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const localPiiScrubPath = path.join(__dirname, "../../pii-scrub/dist/index.js");
+const piiScrub = (shouldUseLocalTofuDist(localPiiScrubPath)
+    ? await import(localPiiScrubPath)
+    : await import("@optimuslabs/pii-scrub-staging"));
+export const { SCRUBBER_VERSION, containsPlaceholder, scrubFields, scrubText, scrubValue } = piiScrub;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.30",
+  "version": "1.5.32",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {
@@ -49,17 +49,17 @@
   },
   "devDependencies": {
     "@types/node": "^24.10.1",
-    "@vitest/coverage-v8": "^4.1.8",
-    "@vitest/ui": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.12",
+    "@vitest/ui": "^4.1.12",
     "ts-node": "^10.9.2",
     "typescript": "^5.4.5",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.12"
   },
   "dependencies": {
     "@optimuslabs/tofu-staging": "^0.1.18",
     "axios": "^1.20.0",
     "canonicalize": "^2.1.0",
-    "smol-toml": "^1.7.1"
+    "smol-toml": "^1.9.1"
   },
   "publishConfig": {
     "access": "public"