@optimuslabs/harness-map-staging 1.5.34 → 1.5.35

package/dist/endpoint_client/types.js

@@ -1,4 +1,6 @@
-/** Path suffix for file collection patterns (backend: api/file-path-registry/file-patterns/). */
-export const FILE_PATH_REGISTRY_FILE_PATTERNS_PATH = '/api/file-path-registry/file-patterns/';
+/** Path suffix for file collection patterns (backend: api/file-path-registry/file-patterns/).
+ * `allowed_keys=1` says this sensor applies each pattern's allowed_keys and allowed_entries, so the backend
+ * also sends the file types that may only send those keys (hosting project links, OPT-1408). */
+export const FILE_PATH_REGISTRY_FILE_PATTERNS_PATH = '/api/file-path-registry/file-patterns/?allowed_keys=1';
 /** Path suffix for sensitive paths audit candidates (backend: api/file-path-registry/sensitive-paths-audit-candidates/). */
 export const FILE_PATH_REGISTRY_SENSITIVE_PATHS_PATH = '/api/file-path-registry/sensitive-paths-audit-candidates/';

package/dist/log_config_files/collection/allowed_keys.js

@@ -0,0 +1,61 @@
+/**
+ * Keep only the keys a file type allows (OPT-1408, docs/infra-inventory DESIGN.md I25).
+ *
+ * A hosting project link (`.vercel/project.json`, `.netlify/state.json`, `fly.toml`) is needed
+ * only for the project it names, so the backend's pattern lists the identifiers to keep in
+ * `allowed_keys`, and nothing else in the file leaves the device. A file that did not parse as an
+ * object, or holds none of the keys, is not sent at all, so its text can never be sent instead.
+ */
+/** The pattern's allowed keys copied onto one of its targets. */
+export function copyAllowedKeys(target, pattern) {
+    if (pattern.allowed_keys?.length)
+        target.allowed_keys = pattern.allowed_keys;
+    if (pattern.allowed_entries)
+        target.allowed_entries = pattern.allowed_entries;
+}
+/** Whether the target's files may only send the identifiers its rules keep. */
+export function hasAllowedKeys(target) {
+    return Boolean(target.allowed_keys?.length || target.allowed_entries);
+}
+/** The keys of `source` that `keep` names, with string or number values. */
+function plainValues(source, keep) {
+    const kept = {};
+    for (const key of keep) {
+        const value = source[key];
+        // An identifier is a plain value; anything nested could carry more than the identifier.
+        if (typeof value === 'string' || typeof value === 'number')
+            kept[key] = value;
+    }
+    return kept;
+}
+function isObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+/** Each entry of the map `value` cut to `keep`; entries that are not objects, or keep nothing, are dropped. */
+function keptEntries(value, keep) {
+    const kept = {};
+    if (!isObject(value))
+        return kept;
+    for (const [name, entry] of Object.entries(value)) {
+        const cut = isObject(entry) ? plainValues(entry, keep) : {};
+        if (Object.keys(cut).length > 0)
+            kept[name] = cut;
+    }
+    return kept;
+}
+/**
+ * The top-level keys of `raw` that `keep` names, with string or number values, and each map that
+ * `entries` names with every entry cut to its keys (the Railway CLI's linked folders); null when
+ * nothing is kept.
+ */
+export function keepAllowedKeys(raw, keep, entries = {}) {
+    if (!isObject(raw))
+        return null;
+    const kept = plainValues(raw, keep);
+    for (const [key, fields] of Object.entries(entries)) {
+        const cut = keptEntries(raw[key], fields);
+        if (Object.keys(cut).length > 0)
+            kept[key] = cut;
+    }
+    return Object.keys(kept).length > 0 ? kept : null;
+}

package/dist/log_config_files/collection/config_collector.js

@@ -1,10 +1,11 @@
 import { existsSync, readdirSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { readJSONFile, readMCPConfig, readMarkdownFile, readInstalledExtensions } from '../readers/file_readers.js';
+import { readJSONFile, readMCPConfig, readMarkdownFile, readInstalledExtensions, parseTomlText } from '../readers/file_readers.js';
 import { getExtensionsCachePath, getExtensionsCacheInstalledSuffix, getVscdbPath } from '../paths/path_constants_helpers.js';
 import { resolvePatternToTargets, normalizePathSkipPrefixes } from '../paths/pattern_resolver.js';
 import { enrichRawFromRecipe } from './enrichment_helpers.js';
 import { applyCoworkSessionWhitelist } from './cowork_session_whitelist.js';
+import { copyAllowedKeys, hasAllowedKeys, keepAllowedKeys } from './allowed_keys.js';
 import { collectDirectoryEntries, collectDirectoryMetadata } from './directory_collector.js';
 import { collectVscdbEntries } from '../readers/vscdb_config_builder.js';
 import { pushDerivedFilesFromRecipe } from './openclaw_helpers.js';
@@ -65,6 +66,7 @@ function buildCollectionContext(patterns, projectRoot, home, homeRecurseSkipDirs
         for (const t of resolvePatternToTargets(p.path, p.type, p.file_type, projectRoot, home, pathSkipPrefixes, p.collect_style, p.content_format, p.dir_glob, homeRecurseSkipDirs, p.path_resolution, p.resolve_under_home !== false, absolutePathPrefixes, mcpToolGlobSpec, clientPathConstants, pathResolutionSpecs)) {
             if (p.raw_key)
                 t.raw_key = p.raw_key;
+            copyAllowedKeys(t, p);
             if (p.dir_subdir_filename)
                 t.dir_subdir_filename = p.dir_subdir_filename;
             if (p.dir_subdir_source)
@@ -83,6 +85,10 @@ function readContentByFormat(path, format) {
         return readMarkdownFile(path);
     if (format === 'sqlite_vscdb')
         return null; // handled upstream by collectVscdbEntries
+    if (format === 'toml') {
+        const text = readMarkdownFile(path);
+        return text === null ? null : parseTomlText(text);
+    }
     // json (default) — fall back to markdown for .md files from agents not yet annotated
     return readJSONFile(path) ?? readMCPConfig(path) ?? (path.endsWith('.md') ? readMarkdownFile(path) : null);
 }
@@ -92,6 +98,21 @@ function isPortableCursorUserSettingsTarget(t) {
         p.endsWith('/cursor/user/settings.json') ||
         p.includes('application support/cursor/user/settings.json'));
 }
+/** The kept identifiers of a file whose pattern limits what may leave the device, read in the
+ * pattern's content format; null when nothing is kept (OPT-1408). */
+export function keptFileContent(path, pattern) {
+    const content = readContentByFormat(path, pattern.content_format || 'json');
+    return keepAllowedKeys(content, pattern.allowed_keys ?? [], pattern.allowed_entries ?? {});
+}
+/** A file whose pattern limits what may leave the device: the kept identifiers, or nothing. */
+function collectKeptFileEntry(t) {
+    const kept = keptFileContent(t.path, t);
+    return kept === null ? null : { file_type: t.file_type, file_path: t.logicalFilePath ?? t.path, raw_content: kept };
+}
+/** A regular file's entry: cut to its pattern's kept identifiers when it has any. */
+function collectFileEntry(t, enrichByFileType) {
+    return hasAllowedKeys(t) ? collectKeptFileEntry(t) : collectRegularFileEntry(t, enrichByFileType);
+}
 function collectRegularFileEntry(t, enrichByFileType) {
     const format = t.content_format || 'json';
     let content = readContentByFormat(t.path, format);
@@ -212,7 +233,7 @@ function collectConfigFilesFromPatterns(patterns, projectRoot, onProgress, optio
                 configFiles.push(entry);
             continue;
         }
-        const entry = collectRegularFileEntry(t, enrichByFileType);
+        const entry = collectFileEntry(t, enrichByFileType);
         if (entry) {
             configFiles.push(entry);
             const recipe = enrichByFileType[t.file_type];
@@ -229,6 +250,7 @@ export { collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles } fr
 export { collectMcpFromClaudeJsonProjects } from './claude_known_projects_collector.js';
 export { collectClaudeTokenUsage } from './claude_token_usage_collector.js';
 export { collectCopilotTokenUsage } from './copilot_token_usage_collector.js';
+export { collectCopilotUsageWithAccount } from './copilot_account.js';
 export { collectOpencodeTokenUsage } from './opencode_token_usage_collector.js';
 export { collectCodexTokenUsage } from './codex_token_usage_collector.js';
 export { collectCursorTokenUsage } from './cursor_token_usage_collector.js';

package/dist/log_config_files/collection/copilot_account.js

@@ -0,0 +1,149 @@
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { OPTIMUSLABS_MANAGEMENT_REL } from '../../bootstrap_constants.js';
+import { atomicWriteJson } from '../runtime/management_storage.js';
+import { collectCopilotTokenUsage } from './copilot_token_usage_collector.js';
+const GH_TIMEOUT_MS = 5000;
+const POLICY_FIELDS = [
+    'chat_enabled',
+    'cli_enabled',
+    'copilot_app_enabled',
+    'is_mcp_enabled',
+    'editor_preview_features_enabled',
+    'copilotignore_enabled',
+];
+function asObject(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function text(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}
+/** `lastLoggedInUser` from Copilot's config, which starts with `//` comment lines. */
+export function readCopilotLogin(home) {
+    let raw;
+    try {
+        raw = readFileSync(join(home, '.copilot', 'config.json'), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let config;
+    try {
+        config = asObject(JSON.parse(raw.replace(/^\s*\/\/.*$/gm, '')));
+    }
+    catch {
+        return null;
+    }
+    const user = asObject(config.lastLoggedInUser);
+    const login = text(user.login);
+    return login ? { login, host: text(user.host) || 'https://github.com' } : null;
+}
+function parsedGhOutput(output) {
+    try {
+        return JSON.parse(output);
+    }
+    catch {
+        return null;
+    }
+}
+/** The account `gh` is signed in as. Fixed arguments: nothing outside shapes the command. */
+function ghUser() {
+    try {
+        const output = execFileSync('gh', ['api', 'user'], {
+            encoding: 'utf8',
+            timeout: GH_TIMEOUT_MS,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return parsedGhOutput(output);
+    }
+    catch {
+        return null;
+    }
+}
+/** That account's Copilot seat, as Copilot's /status reads it. */
+function ghCopilotSeat() {
+    try {
+        const output = execFileSync('gh', ['api', '/copilot_internal/user'], {
+            encoding: 'utf8',
+            timeout: GH_TIMEOUT_MS,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return parsedGhOutput(output);
+    }
+    catch {
+        return null;
+    }
+}
+const GITHUB_CLI = { user: ghUser, copilotSeat: ghCopilotSeat };
+/** The seat fields worth keeping from a `/copilot_internal/user` answer. */
+export function copilotSeat(answer) {
+    const data = asObject(answer);
+    const organizations = (Array.isArray(data.organization_list) ? data.organization_list : [])
+        .map((org) => text(asObject(org).name) || text(asObject(org).login))
+        .filter(Boolean);
+    const policies = {};
+    for (const field of POLICY_FIELDS) {
+        if (typeof data[field] === 'boolean')
+            policies[field] = data[field];
+    }
+    return {
+        ...(text(data.copilot_plan) ? { plan: text(data.copilot_plan) } : {}),
+        ...(text(data.access_type_sku) ? { sku: text(data.access_type_sku) } : {}),
+        ...(organizations.length ? { organizations } : {}),
+        ...(Object.keys(policies).length ? { policies } : {}),
+    };
+}
+const CACHE_BASENAME = 'copilot_account.json';
+const CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+function cachePath(home) {
+    return join(home, OPTIMUSLABS_MANAGEMENT_REL, CACHE_BASENAME);
+}
+/** Yesterday's answer for this login, or null when there is none or it is out of date. */
+function readCachedAccount(home, login, now) {
+    try {
+        const cached = asObject(JSON.parse(readFileSync(cachePath(home), 'utf8')));
+        const account = asObject(cached.account);
+        const fresh = typeof cached.checked_at === 'number' && now - cached.checked_at < CACHE_MAX_AGE_MS;
+        return fresh && account.login === login ? account : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeCachedAccount(home, account, now) {
+    try {
+        atomicWriteJson(cachePath(home), { checked_at: now, account });
+    }
+    catch {
+        // An unwritable cache only means asking GitHub again next time.
+    }
+}
+export function readCopilotAccount(home, gh = GITHUB_CLI, now = Date.now()) {
+    const signedIn = readCopilotLogin(home);
+    if (!signedIn)
+        return null;
+    const cached = readCachedAccount(home, signedIn.login, now);
+    if (cached)
+        return cached;
+    const account = lookUpSeat(signedIn, gh);
+    writeCachedAccount(home, account, now);
+    return account;
+}
+function lookUpSeat(signedIn, gh) {
+    // gh answers for github.com; an enterprise server host would need gh's --hostname.
+    if (signedIn.host.replace(/\/+$/, '') !== 'https://github.com')
+        return signedIn;
+    const ghLogin = text(asObject(gh.user()).login);
+    if (!ghLogin || ghLogin.toLowerCase() !== signedIn.login.toLowerCase())
+        return signedIn;
+    return { ...signedIn, ...copilotSeat(gh.copilotSeat()) };
+}
+/** The Copilot usage summary with the account added, as one Copilot row per machine. */
+export function collectCopilotUsageWithAccount(home) {
+    const usage = collectCopilotTokenUsage(home);
+    const account = usage.length ? readCopilotAccount(home) : null;
+    if (!account)
+        return usage;
+    return usage.map((entry) => ({ ...entry, raw_content: { ...asObject(entry.raw_content), account } }));
+}

package/dist/log_config_files/runtime/main_runner.js

@@ -15,7 +15,8 @@ import { ensureAuthentication } from '../auth/auth_flow.js';
 import { readJSONFile, readMarkdownFile } from '../readers/file_readers.js';
 import { isVscdbVirtualPath, tryReadVscdbVirtualFile, summarizeComposerPayloadForDiagnostics, } from '../readers/vscdb_config_builder.js';
 import { persistVscdbComposerContractFromPatternsResponse } from '../readers/vscdb_reader.js';
-import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles, collectMcpFromClaudeJsonProjects, collectClaudeTokenUsage, collectCopilotTokenUsage, collectOpencodeTokenUsage, collectCodexTokenUsage, collectCursorTokenUsage, collectHermesTokenUsage, collectOpenclawTokenUsage, collectPiTokenUsage, collectCoworkDesktopVersion, collectClaudeDesktopOrgs, collectGrokCliVersion, collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, determineFileTypeFromPath, } from '../collection/config_collector.js';
+import { hasAllowedKeys } from '../collection/allowed_keys.js';
+import { keptFileContent, collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles, collectMcpFromClaudeJsonProjects, collectClaudeTokenUsage, collectCopilotUsageWithAccount, collectOpencodeTokenUsage, collectCodexTokenUsage, collectCursorTokenUsage, collectHermesTokenUsage, collectOpenclawTokenUsage, collectPiTokenUsage, collectCoworkDesktopVersion, collectClaudeDesktopOrgs, collectGrokCliVersion, collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, determineFileTypeFromPath, } from '../collection/config_collector.js';
 import { ensureCursorUserSettingsSnapshotInBatch } from '../collection/ensure_cursor_user_settings_snapshot.js';
 import { collectSkillsCliInstalled } from '../collection/skills_cli_collector.js';
 import { collectWorkspaceVscdbs } from '../collection/mcp_tool_collector.js';
@@ -43,7 +44,7 @@ function addUnseen(configFiles, seen, entries) {
 const HOME_COLLECTORS = [
     ['scanning Claude known projects from ~/.claude.json', collectMcpFromClaudeJsonProjects],
     ['aggregating Claude token usage from ~/.claude/projects transcripts', collectClaudeTokenUsage],
-    ['aggregating Copilot token usage from ~/.copilot/session-state transcripts', collectCopilotTokenUsage],
+    ['aggregating Copilot token usage and account from ~/.copilot', collectCopilotUsageWithAccount],
     ['aggregating OpenCode token usage from ~/.local/share/opencode/opencode.db', collectOpencodeTokenUsage],
     ['aggregating Codex token usage from ~/.codex/sessions rollouts', collectCodexTokenUsage],
     ['aggregating Cursor token usage from state.vscdb', collectCursorTokenUsage],
@@ -299,49 +300,68 @@ async function main() {
     }
     await sendAllConfigFiles(configFiles, worktreeReport, hardwareUuid, authKey);
 }
+/** The pattern of a file type that limits what may leave the device (OPT-1408), if it has one. */
+function limitedPattern(fileType, patterns) {
+    return patterns.find((p) => p.file_type === fileType && hasAllowedKeys(p));
+}
+/** Send a limited file cut to its kept identifiers, or nothing when it holds none of them. */
+async function logLimitedFile(filePath, pattern, hardwareUuid, authKey) {
+    const kept = keptFileContent(filePath, pattern);
+    if (!kept) {
+        console.error(`Nothing to send from: ${filePath}`);
+        return false;
+    }
+    return sendConfigFile({ file_type: pattern.file_type, file_path: filePath, raw_content: kept }, hardwareUuid, authKey);
+}
+/** Whether the file to log is missing (reported); a vscdb virtual path has no file of its own. */
+function logMissingSingleFile(filePath, isVscdb) {
+    if (isVscdb || existsSync(filePath))
+        return false;
+    console.error(`File not found: ${filePath}`);
+    return true;
+}
+/** A vscdb virtual file's content and type; null (reported) when it cannot be read. */
+function readVscdbSingleFile(filePath, patternsResponse) {
+    const result = tryReadVscdbVirtualFile(filePath, patternsResponse);
+    if (!result) {
+        console.error(`Could not read vscdb virtual file: ${filePath}`);
+        return null;
+    }
+    return { rawContent: result.rawContent, fileType: result.fileType };
+}
+/** A file read as JSON, else as markdown; null (reported) when neither reads. */
+function readPlainSingleFile(filePath, fileType) {
+    const json = readJSONFile(filePath);
+    if (json)
+        return { rawContent: json, fileType };
+    const markdown = readMarkdownFile(filePath);
+    if (markdown === null) {
+        console.error(`Could not read file: ${filePath}`);
+        return null;
+    }
+    return { rawContent: { content: markdown, source: 'file' }, fileType };
+}
 async function logSingleFile(filePath) {
     const hardwareUuid = resolveHardwareUuid();
     const authKey = await ensureAuthentication(hardwareUuid);
-    const patternsResponse = await getFileCollectionPatterns(loadEndpointBase());
-    const isVscdb = isVscdbVirtualPath(filePath, patternsResponse ?? null);
-    if (!existsSync(filePath) && !isVscdb) {
-        console.error(`File not found: ${filePath}`);
+    const patternsResponse = (await getFileCollectionPatterns(loadEndpointBase())) ?? null;
+    const isVscdb = isVscdbVirtualPath(filePath, patternsResponse);
+    if (logMissingSingleFile(filePath, isVscdb))
         return false;
-    }
     const patterns = patternsResponse?.patterns ?? [];
-    let rawContent = null;
-    let fileType = determineFileTypeFromPath(filePath, patterns) ?? undefined;
-    if (isVscdb) {
-        const vscdbResult = tryReadVscdbVirtualFile(filePath, patternsResponse ?? null);
-        if (!vscdbResult) {
-            console.error(`Could not read vscdb virtual file: ${filePath}`);
-            return false;
-        }
-        rawContent = vscdbResult.rawContent;
-        fileType = vscdbResult.fileType;
-    }
-    else {
-        rawContent = readJSONFile(filePath);
-        if (!rawContent) {
-            const markdown = readMarkdownFile(filePath);
-            if (markdown !== null) {
-                rawContent = { content: markdown, source: 'file' };
-                if (!fileType)
-                    fileType = determineFileTypeFromPath(filePath, patterns) ?? undefined;
-            }
-        }
-    }
-    if (!rawContent) {
-        console.error(`Could not read file: ${filePath}`);
+    const pathType = determineFileTypeFromPath(filePath, patterns) ?? undefined;
+    // A file type with allowed keys is sent cut to its kept keys, or not at all (OPT-1408).
+    const limited = limitedPattern(pathType, patterns);
+    if (limited)
+        return logLimitedFile(filePath, limited, hardwareUuid, authKey);
+    const read = isVscdb ? readVscdbSingleFile(filePath, patternsResponse) : readPlainSingleFile(filePath, pathType);
+    if (!read)
         return false;
-    }
+    const fileType = read.fileType ?? pathType;
     if (!fileType) {
-        fileType = determineFileTypeFromPath(filePath, patterns) ?? undefined;
-        if (!fileType) {
-            console.error(`Could not determine file type for: ${filePath}`);
-            return false;
-        }
+        console.error(`Could not determine file type for: ${filePath}`);
+        return false;
     }
-    return sendConfigFile({ file_type: fileType, file_path: filePath, raw_content: rawContent }, hardwareUuid, authKey);
+    return sendConfigFile({ file_type: fileType, file_path: filePath, raw_content: read.rawContent }, hardwareUuid, authKey);
 }
 export { main, logSingleFile, createSignature, canonicalizePayload, sendConfigFile, sendConfigFilesBatch, BATCH_CHUNK_SIZE, addSensitivePathsAudit, };

package/dist/log_config_files/runtime/skill_block.js

@@ -0,0 +1,188 @@
+/**
+ * Skill block (docs/skill-block/DESIGN.md): lock the skill folders the organization blocked so no
+ * agent can load or run them, and give a folder its permissions back once the skill is unblocked.
+ *
+ * The remediation sync stores the server's list under `skill_blocks` in
+ * remediation_instructions.json and then calls `applySkillBlocks`. A folder is locked with
+ * `chmod 000` after its mode is recorded in skill_block_state.json; a recorded folder that is no
+ * longer listed gets that mode back. The folders are where the collection found each skill's
+ * SKILL.md, for any agent. A folder is locked only when it is a real directory inside the home
+ * folder (never the home folder itself) holding a SKILL.md, so a bad path cannot lock anything
+ * that is not a skill.
+ */
+import { chmodSync, existsSync, lstatSync, readFileSync, realpathSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, resolve, sep } from 'node:path';
+import { complianceRunnerDiag, hookRunLog } from './hook_logger.js';
+import { atomicWriteJson, getSkillBlockStatePath } from './management_storage.js';
+function log(message) {
+    hookRunLog(message);
+    complianceRunnerDiag(message);
+}
+export function readSkillBlockState() {
+    const path = getSkillBlockStatePath();
+    if (!existsSync(path))
+        return {};
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+function permissionBits(path) {
+    return lstatSync(path).mode & 0o7777;
+}
+/**
+ * Whether `dir` is a skill folder this endpoint locked for a block and that is still locked. Its
+ * files cannot be read, and nothing can have changed in it since it was locked, so the collection
+ * reports it as locked and the backend keeps the copy it has.
+ */
+export function isLockedByOptimus(dir) {
+    const target = resolve(dir);
+    if (!readSkillBlockState()[target])
+        return false;
+    try {
+        return permissionBits(target) === 0;
+    }
+    catch {
+        return false;
+    }
+}
+/** Why `dir` must not be locked, or null when it is a real skill folder inside the home folder. */
+export function refusalReason(dir, home = homedir()) {
+    const root = resolve(home);
+    const target = resolve(dir);
+    if (!target.startsWith(root + sep))
+        return 'outside the home folder';
+    if (!existsSync(target))
+        return 'missing';
+    const stat = lstatSync(target);
+    if (stat.isSymbolicLink())
+        return 'symlink';
+    if (!stat.isDirectory())
+        return 'not a directory';
+    if (!realpathSync(target).startsWith(realpathSync(root) + sep))
+        return 'resolves outside the home folder';
+    if (!existsSync(join(target, 'SKILL.md')))
+        return 'no SKILL.md';
+    return null;
+}
+/** Lock a recorded folder again if it was opened; its path may have been replaced, so check it. */
+function relockIfOpened(dir, entry, outcome, home) {
+    if (!existsSync(dir) || permissionBits(dir) === 0)
+        return;
+    const reason = refusalReason(dir, home);
+    if (reason) {
+        outcome.refused.push({ skill_dir: entry.skill_dir, reason });
+        return;
+    }
+    chmodSync(dir, 0o000);
+    outcome.relocked.push(dir);
+}
+/** Lock a listed folder, or lock it again when its permissions were opened since. */
+function lockFolder(entry, state, outcome, home) {
+    const dir = resolve(entry.skill_dir);
+    const known = state[dir];
+    if (known) {
+        relockIfOpened(dir, entry, outcome, home);
+        return;
+    }
+    const reason = refusalReason(dir, home);
+    if (reason) {
+        outcome.refused.push({ skill_dir: entry.skill_dir, reason });
+        return;
+    }
+    state[dir] = { mode: permissionBits(dir), resource_uuid: entry.resource_uuid, locked_at: new Date().toISOString() };
+    atomicWriteJson(getSkillBlockStatePath(), state);
+    chmodSync(dir, 0o000);
+    outcome.locked.push(dir);
+}
+/** Give a folder no longer listed the mode it had before it was locked. */
+function restoreFolder(dir, state, outcome) {
+    const { mode } = state[dir];
+    if (existsSync(dir) && !lstatSync(dir).isSymbolicLink()) {
+        chmodSync(dir, mode);
+        outcome.restored.push(dir);
+    }
+    delete state[dir];
+}
+/**
+ * Make the folders on disk match `entries`, the server's whole list for this machine: lock the
+ * listed ones, restore the ones locked before and no longer listed. A folder that fails the checks
+ * is skipped and logged; one failing chmod does not stop the others.
+ */
+export function applySkillBlocks(entries, home = homedir()) {
+    const outcome = { locked: [], relocked: [], restored: [], refused: [] };
+    const lockPath = `${getSkillBlockStatePath()}.lock`;
+    if (!takeStateLock(lockPath)) {
+        log('skill_block: another sync is applying blocks; the next sync applies these');
+        return outcome;
+    }
+    try {
+        applyUnderLock(entries, home, outcome);
+    }
+    finally {
+        releaseStateLock(lockPath);
+    }
+    return outcome;
+}
+/**
+ * Take the lock around reading the state, changing permissions and writing the state. Two syncs at
+ * once (the prompt gate and the compliance runner) could otherwise lose a folder's original mode,
+ * leaving it locked after an unblock. A lock left by a dead process goes after a minute.
+ */
+function takeStateLock(lockPath) {
+    try {
+        if (existsSync(lockPath) && Date.now() - statSync(lockPath).mtimeMs > 60_000)
+            unlinkSync(lockPath);
+        writeFileSync(lockPath, '', { flag: 'wx' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function releaseStateLock(lockPath) {
+    try {
+        unlinkSync(lockPath);
+    }
+    catch {
+        // Already gone; the next sync takes it again.
+    }
+}
+function applyUnderLock(entries, home, outcome) {
+    const state = readSkillBlockState();
+    const wanted = new Set(entries.map((entry) => resolve(entry.skill_dir)));
+    for (const entry of entries) {
+        try {
+            lockFolder(entry, state, outcome, home);
+        }
+        catch (err) {
+            outcome.refused.push({ skill_dir: entry.skill_dir, reason: err instanceof Error ? err.message : String(err) });
+        }
+    }
+    for (const dir of Object.keys(state)) {
+        if (wanted.has(dir))
+            continue;
+        try {
+            restoreFolder(dir, state, outcome);
+        }
+        catch (err) {
+            outcome.refused.push({ skill_dir: dir, reason: err instanceof Error ? err.message : String(err) });
+        }
+    }
+    atomicWriteJson(getSkillBlockStatePath(), state);
+    logOutcome(outcome);
+}
+function logOutcome(outcome) {
+    for (const dir of outcome.locked)
+        log(`skill_block: locked ${dir}`);
+    for (const dir of outcome.relocked)
+        log(`skill_block: locked again (permissions were opened) ${dir}`);
+    for (const dir of outcome.restored)
+        log(`skill_block: restored ${dir}`);
+    for (const { skill_dir, reason } of outcome.refused)
+        log(`skill_block: skipped ${skill_dir} (${reason})`);
+}

package/dist/log_config_files/runtime/skill_block_sessions.js

@@ -0,0 +1,86 @@
+/**
+ * Skill block killswitch (docs/skill-block/DESIGN.md): a session that loaded a skill keeps it in its
+ * conversation, so when that skill is blocked the session is stopped until the user restarts Claude
+ * Code. A restarted process reads its skills with the folder locked, so the skill does not exist.
+ *
+ * The backend knows which sessions loaded a skill: the tool calls the skill usage view attributes to
+ * it. The remediation sync sends this machine's sessions that loaded a blocked skill
+ * (`skill_block_sessions` in remediation_instructions.json), and the prompt gate refuses their
+ * prompts. Only those sessions are stopped; an unblock takes them off the list.
+ */
+import { execFileSync } from 'node:child_process';
+import { basename, resolve } from 'node:path';
+import { readRemediationInstructionsFile } from './management_storage.js';
+import { readSkillBlockState } from './skill_block.js';
+/** A process's parent, start time and command name, from `ps`; null when it cannot be read. */
+function processRow(pid) {
+    try {
+        // A fixed command, no shell, and a process id that is always a number.
+        const out = execFileSync('ps', ['-o', 'ppid=,lstart=,comm=', '-p', String(pid)], { encoding: 'utf8' }).trim(); // nosafe: SAFE801
+        const row = out.match(/^(\d+)\s+(\S+\s+\S+\s+\d+\s+[\d:]+\s+\d+)\s+(.*)$/);
+        return row ? { parent: Number(row[1]), startedAt: Date.parse(row[2]), name: basename(row[3]).toLowerCase() } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * When the `claude` process running this hook started (ms), or null when it cannot be found. It
+ * lists its skills when it starts and keeps them across `/clear`, so this is what tells a real
+ * restart from `/clear`, which only changes the session id.
+ */
+export function claudeProcessStartedAt() {
+    let pid = process.ppid;
+    for (let depth = 0; depth < 12 && pid > 1; depth += 1) {
+        const row = processRow(pid);
+        if (!row)
+            return null;
+        if (row.name === 'claude')
+            return row.startedAt;
+        pid = row.parent;
+    }
+    return null;
+}
+/** The names of the blocked skills this session loaded; empty when it may go on. */
+export function stoppingSkills(sessionId) {
+    if (!sessionId)
+        return [];
+    const sessions = readRemediationInstructionsFile().skill_block_sessions ?? [];
+    return sessions.filter((s) => s.session_id === sessionId).map((s) => s.skill_name || 'a skill');
+}
+/** The notice for a stopped session. */
+export function stoppedSessionMessage(skills) {
+    const names = [...new Set(skills)].join(', ');
+    return (`Your organization blocked ${names}, which this session loaded. Copy anything you need from ` +
+        'this conversation, then quit Claude Code and start it again to continue. Resuming this ' +
+        'session keeps it stopped.');
+}
+/**
+ * The blocked skill a typed slash command runs, when this process may still have it, or null:
+ * `/airtable:airtable-cli …` or `/airtable-cli …`. A process started before the folder was locked
+ * listed the skill and keeps it, even after `/clear`, so this refuses it. A process started after
+ * the lock never listed it: this answers null, and Claude Code says the skill does not exist.
+ * Matches the skill's name or its folder's name, which can differ (`aikido-issues` lives in
+ * `skills/issues`). An unknown start time counts as too old, so a block is never skipped.
+ */
+export function blockedSkillOfCommand(promptFirstLine, processStartedAt = claudeProcessStartedAt) {
+    const command = promptFirstLine.trim().split(/\s+/)[0] ?? '';
+    if (!command.startsWith('/'))
+        return null;
+    const typed = command.slice(command.lastIndexOf(':') + 1).replace(/^\//, '').toLowerCase();
+    const blocks = readRemediationInstructionsFile().skill_blocks ?? [];
+    const hits = blocks.filter((b) => b.skill_name.toLowerCase() === typed || basename(b.skill_dir).toLowerCase() === typed);
+    if (hits.length === 0)
+        return null;
+    const startedAt = processStartedAt();
+    const locks = readSkillBlockState();
+    const mayStillHaveIt = hits.some((b) => {
+        const lockedAt = Date.parse(locks[resolve(b.skill_dir)]?.locked_at ?? '');
+        return startedAt === null || Number.isNaN(lockedAt) || startedAt <= lockedAt;
+    });
+    return mayStillHaveIt ? hits[0].skill_name || typed : null;
+}
+/** The notice for a typed command of a blocked skill in a process that may still have it. */
+export function blockedCommandMessage(skill) {
+    return `Your organization blocked ${skill}. Quit Claude Code and start it again to continue.`;
+}

package/dist/pii_scrub.js

@@ -0,0 +1,15 @@
+/**
+ * pii-scrub shim: the one place that imports @optimuslabs/pii-scrub-staging.
+ *
+ * Loaded the way tofu.ts loads tofu: the sibling local dist when environment=development and it
+ * is built, the published npm package otherwise.
+ */
+import path from "path";
+import { fileURLToPath } from "url";
+import { shouldUseLocalTofuDist } from "./tofu_environment.js";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const localPiiScrubPath = path.join(__dirname, "../../pii-scrub/dist/index.js");
+const piiScrub = (shouldUseLocalTofuDist(localPiiScrubPath)
+    ? await import(localPiiScrubPath)
+    : await import("@optimuslabs/pii-scrub-staging"));
+export const { SCRUBBER_VERSION, containsPlaceholder, scrubFields, scrubText, scrubValue } = piiScrub;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.34",
+  "version": "1.5.35",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {