@optimuslabs/harness-map-staging 1.5.34 → 1.5.36

package/dist/approved_tenant_gate.js

@@ -87,7 +87,7 @@ export function readClaudeSignedInTenant(env = process.env) {
 /**
  * Block messages, one shape for every agent (Optimus Labs' prompt-block wording):
  * "This device only allows <agent> <under/on/in> the <approved> <kind>. You're signed in to
- * <what>. <how to switch>." With nothing approved yet: "This device doesn't allow <agent> signed in
+ * <what>. <how to switch>." With nothing approved yet: "This device doesn't allow <agent> to be signed in
  * to <what>." and the same last sentence.
  */
 const TENANT_WORDS = {
@@ -96,6 +96,8 @@ const TENANT_WORDS = {
     cursor: { name: 'Cursor', kind: 'team', prep: 'on' },
     codex: { name: 'Codex', kind: 'workspace', prep: 'in' },
 };
+/** How a block that names the organization's own rule begins; such a block needs no title above it. */
+export const ORGANIZATION_LEAD = 'Your organization';
 /** A tenant's name as the admin approved it, or its id when it has none. */
 function nameOf(t) {
     return (t.tenant_name || '').trim() || t.tenant_id.trim();
@@ -108,35 +110,54 @@ function emailDomain(email) {
 function capitalised(word) {
     return word ? word[0].toUpperCase() + word.slice(1) : word;
 }
-/** What to pick to get back in: the one approved tenant, one of several, or the company's own. */
-function choice(approved, kind) {
+/**
+ * What to pick to get back in: the one approved tenant, one of several, or the company's own,
+ * named after `company` when it is known ("your Optimus Labs organization").
+ */
+function choice(approved, kind, company) {
     if (approved.length === 1)
         return approved[0];
-    return approved.length > 1 ? 'one of them' : `your company's ${kind}`;
+    return approved.length > 1 ? 'one of them' : `your ${company || "company's"} ${kind}`;
 }
-function switchStep(agent, approved) {
+function switchStep(agent, approved, company) {
     const kind = TENANT_WORDS[agent].kind;
     if (agent === 'claude_desktop')
-        return `Switch Claude Desktop to ${choice(approved, kind)}.`;
-    if (agent === 'codex')
-        return `Run codex logout, then codex login and choose ${choice(approved, kind)}.`;
+        return `Switch Claude Desktop to ${choice(approved, kind, company)}.`;
+    if (agent === 'codex') {
+        return `Run codex logout, then codex login and choose ${choice(approved, kind, company)}.`;
+    }
     if (agent === 'cursor') {
-        if (approved.length === 1)
-            return `Sign out of Cursor and sign in with your ${approved[0]} team account.`;
+        // Reached only without one account to name (see cursorTeamViolation).
         return approved.length > 1
             ? 'Sign out of Cursor and sign in with an account on one of those teams.'
             : "Sign out of Cursor and sign in with your company's team account.";
     }
-    return `Run /login and choose ${choice(approved, kind)}.`;
+    return `Run /login and choose ${choice(approved, kind, company)}.`;
 }
-/** The block message for `agent` signed in to `signedIn` (already worded) with these approved. */
-export function tenantBlockMessage(agent, approved, signedIn) {
+/**
+ * The block message for `agent` signed in to `signedIn` (already worded) with these approved.
+ * `company` names the company when the agent has nothing approved of its own; '' says "company's".
+ */
+export function tenantBlockMessage(agent, approved, signedIn, company = '') {
     const w = TENANT_WORDS[agent];
     const lead = approved.length
         ? `This device only allows ${w.name} ${w.prep} the ${approved.join(' or ')} ${w.kind}. ` +
             `You're signed in to ${signedIn}.`
-        : `This device doesn't allow ${w.name} signed in to ${signedIn}.`;
-    return `${lead} ${switchStep(agent, approved)}`;
+        : `This device doesn't allow ${w.name} to be signed in to ${signedIn}.`;
+    return `${lead} ${switchStep(agent, approved, company)}`;
+}
+/**
+ * The company's name for "your <company> team account": the one name its approved tenants go by,
+ * across every agent (a Cursor login on no approved team is pointed at the company's Claude
+ * organization's name). '' when there is none, or several. Personal accounts (`@<domain>`) and a
+ * person's own org ("ada@gmail.com's Organization") are not the company's.
+ */
+export function companyName(approved) {
+    const names = new Set(Object.values(approved ?? {})
+        .flatMap((policy) => tenantIds(policy?.tenants))
+        .filter((t) => !t.tenant_id.trim().startsWith('@') && !/'s organization$/i.test(nameOf(t)))
+        .map(nameOf));
+    return names.size === 1 ? [...names][0] : '';
 }
 const CLAUDE_PERSONAL_PLANS = new Set(['free', 'pro', 'max']);
 /** "a personal Max account (gmail.com)" or "the Beta Corp organization". */
@@ -159,23 +180,18 @@ function tenantIds(tenants) {
 /**
  * The block message when `signedIn` may not be used for `agent`, else null.
  *
- * Mirrors the backend's `tenant_approval`: a tenant the organization marked unapproved is always
- * blocked; a shadow tenant (never decided) only once the agent has at least one approved tenant.
- * Ids compare exactly, as the backend does -- vendor ids are not ours to case-fold.
+ * Only a tenant the organization blocked (marked unapproved) is refused. One never decided is
+ * awaiting review and gets through, as an approved one does. Ids compare exactly, as the backend
+ * does -- vendor ids are not ours to case-fold.
  */
 export function approvedTenantViolation(agent, approved, signedIn) {
     if (!signedIn)
         return null;
     const policy = approved?.[agent];
-    const approvedTenants = tenantIds(policy?.tenants);
-    const unapprovedTenants = tenantIds(policy?.unapproved_tenants);
     const signedInId = signedIn.tenant_id.trim();
-    const isIn = (list) => list.some((t) => t.tenant_id.trim() === signedInId);
-    const blocked = isIn(unapprovedTenants) ||
-        ((policy?.enforced || approvedTenants.length > 0) && !isIn(approvedTenants));
-    if (!blocked)
+    if (!tenantIds(policy?.unapproved_tenants).some((t) => t.tenant_id.trim() === signedInId))
         return null;
-    return tenantBlockMessage(agent, approvedTenants.map(nameOf), claudeSignedInText(signedIn));
+    return tenantBlockMessage(agent, tenantIds(policy?.tenants).map(nameOf), claudeSignedInText(signedIn), companyName(approved));
 }
 /**
  * The tenants a Cursor login is in: its teams, or, on no team, `@` and its email domain. Mirrors the
@@ -203,42 +219,30 @@ export function readCursorSignedInTeams(home = homedir()) {
 /**
  * Why a login in these tenants may not be used, or null when it may. Shared by every agent whose
  * login is a list of tenants (Cursor's teams) or one tenant that may be a personal account's
- * `@<domain>` (Codex), and mirrors the backend's `team_tenant_approval`: any approved tenant admits
- * the login; failing that, one marked unapproved is always blocked, and any other -- an unknown
- * tenant, or a personal account -- only once at least one tenant is approved for this agent.
+ * `@<domain>` (Codex). Blocked only when every tenant the login is in was blocked (marked
+ * unapproved): Cursor admits a login when any of its teams is allowed, and a tenant awaiting review
+ * is allowed, as an approved one is.
  */
 function listedTenantViolation(policy, tenants) {
-    const approvedList = tenantIds(policy?.tenants);
-    if (tenants.some((id) => isListed(approvedList, id)))
+    const unapprovedList = tenantIds(policy?.unapproved_tenants);
+    if (!tenants.length || !tenants.every((id) => isListed(unapprovedList, id)))
         return null;
-    const enforced = approvedList.length > 0 || Boolean(policy?.enforced);
-    if (!isRefused(tenants, enforced, tenantIds(policy?.unapproved_tenants)))
-        return null;
-    return { approved: approvedList.map(nameOf) };
+    return { approved: tenantIds(policy?.tenants).map(nameOf) };
 }
 function isListed(list, id) {
     return list.some((t) => t.tenant_id.trim() === id);
 }
-/** Whether a login in these tenants is refused: one marked unapproved always; any other only once
- * the agent is enforced (an older backend that sends no flag, with nothing approved, lets it pass). */
-function isRefused(tenants, enforced, unapprovedList) {
-    if (tenants.some((id) => isListed(unapprovedList, id)))
-        return true;
-    return enforced;
-}
 /** A tenant's name from the organization's lists, or '' when it has none there. */
 function knownName(policy, id) {
     const all = [...tenantIds(policy?.tenants), ...tenantIds(policy?.unapproved_tenants)];
     const hit = all.find((t) => t.tenant_id.trim() === id);
     return (hit?.tenant_name || '').trim();
 }
-/** "a personal account on no team (gmail.com)", "the Beta team" or "team 9876". */
+/** "a personal account", "the Beta team" or "team 9876". */
 function cursorSignedInText(signedIn, policy) {
     const tenants = cursorTenants(signedIn);
-    if (!tenants.length || tenants[0].startsWith('@')) {
-        const domain = emailDomain(signedIn.email) || (tenants[0] ?? '').slice(1);
-        return `a personal account on no team${domain ? ` (${domain})` : ''}`;
-    }
+    if (!tenants.length || tenants[0].startsWith('@'))
+        return 'a personal account';
     return tenants
         .map((id) => (knownName(policy, id) ? `the ${knownName(policy, id)} team` : `team ${id}`))
         .join(' and ');
@@ -255,13 +259,22 @@ function codexSignedInText(signedIn, tenants, policy) {
     return name ? `the ${name} workspace` : `workspace ${tenant}`;
 }
 /** The block message when Cursor's login may not be used, else null. */
-export function cursorTeamViolation(approved, signedIn) {
+export function cursorTeamViolation(approved, signedIn, teamDomains = []) {
     if (!signedIn)
         return null;
     const v = listedTenantViolation(approved?.cursor, cursorTenants(signedIn));
     if (!v)
         return null;
-    return tenantBlockMessage('cursor', v.approved, cursorSignedInText(signedIn, approved?.cursor));
+    const signedInText = cursorSignedInText(signedIn, approved?.cursor);
+    // The one account to point at: the approved team, else the company's name. Several approved
+    // teams, or no name known, keep the generic message.
+    const account = v.approved.length === 1 ? v.approved[0] : v.approved.length ? '' : companyName(approved);
+    if (!account)
+        return tenantBlockMessage('cursor', v.approved, signedInText);
+    const domains = teamDomains.length ? ` (${teamDomains.join(', ')})` : '';
+    return (`${ORGANIZATION_LEAD} does not allow Cursor to be signed in to ${signedInText}. ` +
+        `The approved organization's team account for Cursor is ${account}${domains}. ` +
+        'Please sign out and sign in with the approved account to use Cursor.');
 }
 /**
  * Codex plans that are personal, mirroring the backend's `CodexPlans.PERSONAL`. On one of these
@@ -307,34 +320,7 @@ export function codexTenantViolation(approved, signedIn) {
     const v = listedTenantViolation(approved?.codex, tenants);
     if (!v)
         return null;
-    return tenantBlockMessage('codex', v.approved, codexSignedInText(signedIn, tenants, approved?.codex));
-}
-/**
- * Whether a personal account's `@<domain>` tenant is on a team domain: an allowlisted domain that
- * someone on an approved team or enterprise tenant signs in with (any vendor's). A subdomain counts.
- */
-export function onTeamDomain(tenant, teamDomains) {
-    if (!tenant.startsWith('@') || !teamDomains?.length)
-        return false;
-    const domain = tenant.slice(1);
-    return teamDomains.some((d) => domain === d || domain.endsWith(`.${d}`));
-}
-/**
- * The block message for Cursor's login, else null. A login on a team is checked against the
- * approved teams. A personal account is only checked once its email is on a team domain; then it
- * is blocked unless an admin approved that personal tenant (`@<domain>`).
- */
-export function cursorLoginViolation(approved, signedIn, teamDomains) {
-    if (!signedIn)
-        return null;
-    const checked = signedIn.team_ids.length > 0 || cursorTenants(signedIn).some((t) => onTeamDomain(t, teamDomains));
-    return checked ? cursorTeamViolation(approved, signedIn) : null;
-}
-/** The block message for Codex's login, else null; a personal plan is checked as Cursor's is. */
-export function codexLoginViolation(approved, signedIn, teamDomains) {
-    const tenants = signedIn ? codexTenants(signedIn) : null;
-    const checked = tenants?.some((t) => !t.startsWith('@') || onTeamDomain(t, teamDomains));
-    return checked ? codexTenantViolation(approved, signedIn) : null;
+    return tenantBlockMessage('codex', v.approved, codexSignedInText(signedIn, tenants, approved?.codex), companyName(approved));
 }
 /**
  * The org Claude Desktop is signed into now, for its Code tab's prompts, or null when unknown.
@@ -378,26 +364,6 @@ export function unapprovedEmailDomainViolation(email, unapproved) {
     return (`This device doesn't allow accounts on ${hit}. You're signed in as ${address}. ` +
         'Sign in with your work account.');
 }
-/**
- * The block message when a login's email is not on the organization's email allowlist, else null.
- *
- * The allowlist is the organization's approved email domains; a domain covers its subdomains
- * (`mail.acme.com` under `acme.com`). Null, so the login is allowed, when no allowlist has been
- * synced to this machine yet or the login has no email we can read.
- */
-export function emailAllowlistViolation(email, allowed) {
-    if (!Array.isArray(allowed))
-        return null;
-    const address = (email ?? '').trim().toLowerCase();
-    const at = address.lastIndexOf('@');
-    if (at < 0 || at === address.length - 1)
-        return null;
-    const domain = address.slice(at + 1);
-    if (allowed.some((d) => domain === d || domain.endsWith(`.${d}`)))
-        return null;
-    return (`This device only allows accounts on your organization's email domains. You're signed in as ${address}. ` +
-        'Sign in with your work account.');
-}
 /** The id an agent is approved under on the Agents page: Desktop's Code tab runs Claude Code. */
 const APPROVAL_ID = { claude_desktop: 'claude' };
 const AGENT_NAME = {

package/dist/compliance_prompt_gate.js

@@ -24,7 +24,7 @@ import { tryResolveHardwareUuid } from './log_config_files/runtime/hardware_uuid
 import { cursorAutofixDefersInlineVerify, syncRemediations, } from './log_config_files/runtime/remediation_sync.js';
 import { loadEndpointBase } from './log_config_files/sender/endpoint_config.js';
 import { formatRemediationChangePreviewForApplied } from './remediation_change_preview.js';
-import { agentApprovalViolation, approvedTenantViolation, codexLoginViolation, emailAllowlistViolation, cursorLoginViolation, readClaudeDesktopSignedInTenant, readClaudeSignedInTenant, readCodexSignedIn, readCursorSignedInTeams, } from './approved_tenant_gate.js';
+import { agentApprovalViolation, approvedTenantViolation, codexTenantViolation, cursorTeamViolation, ORGANIZATION_LEAD, readClaudeDesktopSignedInTenant, readClaudeSignedInTenant, readCodexSignedIn, readCursorSignedInTeams, unapprovedEmailDomainViolation, } from './approved_tenant_gate.js';
 const MANIFEST_STALE_MS = 7 * 24 * 60 * 60 * 1000;
 /** After verified (or failed verify), push enforcement + session log immediately — do not wait for background runner. */
 async function flushRemediationOutcomeToServer(complianceLogPath) {
@@ -89,8 +89,12 @@ function printAllowWithAdvisory(ide, advisoryMessage) {
 }
 /** Every block reads as an Optimus Labs notice: a title line, then the message. */
 const BLOCK_TITLE = 'Optimus Labs\n\n';
+/** The block as shown: titled, unless it already says it is the organization's rule. */
+function titled(violationMessage) {
+    return violationMessage.startsWith(ORGANIZATION_LEAD) ? violationMessage : BLOCK_TITLE + violationMessage;
+}
 function blockPayload(ide, violationMessage) {
-    const text = BLOCK_TITLE + violationMessage;
+    const text = titled(violationMessage);
     if (ide === 'claude' || ide === 'copilot' || ide === 'opencode') {
         return JSON.stringify({ decision: 'block', reason: text, systemMessage: text });
     }
@@ -101,7 +105,7 @@ function blockPayload(ide, violationMessage) {
  * warning, so the Claude-shaped payload (which carries both) prints the same sentence twice.
  */
 function codexBlockPayload(violationMessage) {
-    return JSON.stringify({ decision: 'block', reason: BLOCK_TITLE + violationMessage });
+    return JSON.stringify({ decision: 'block', reason: titled(violationMessage) });
 }
 function getManifestStalenessMs() {
     try {
@@ -264,7 +268,7 @@ function loginEmail(agent) {
         return readCursorSignedInTeams()?.email ?? '';
     return null;
 }
-/** Why this agent's signed-in tenant is not approved, or null when it is (or cannot be read). */
+/** Why this agent's signed-in tenant is blocked, or null when it is not (or cannot be read). */
 function tenantViolation(agent) {
     const { approved_tenants: approved, team_email_domains: teamDomains } = readRemediationInstructionsFile();
     if (agent === 'claude')
@@ -272,12 +276,10 @@ function tenantViolation(agent) {
     if (agent === 'claude_desktop') {
         return approvedTenantViolation('claude_desktop', approved, readClaudeDesktopSignedInTenant());
     }
-    // A personal account (Cursor on no team, Codex on a personal plan) is left to the email allowlist
-    // until its domain is a team domain; then it needs its personal tenant approved.
     if (agent === 'codex')
-        return codexLoginViolation(approved, readCodexSignedIn(), teamDomains);
+        return codexTenantViolation(approved, readCodexSignedIn());
     if (agent === 'cursor')
-        return cursorLoginViolation(approved, readCursorSignedInTeams(), teamDomains);
+        return cursorTeamViolation(approved, readCursorSignedInTeams(), teamDomains);
     return null;
 }
 /** The block for a login: which check refused it and why, or null when every check passes. */
@@ -288,16 +290,16 @@ function loginBlock(agent, email) {
         return { event: 'prompt_gate_block_unapproved_agent', reason: agentMsg };
     if (email === null)
         return null;
-    const emailMsg = emailAllowlistViolation(email, synced.allowed_email_domains);
+    const emailMsg = unapprovedEmailDomainViolation(email, synced.unapproved_email_domains);
     if (emailMsg)
-        return { event: 'prompt_gate_block_email_not_allowlisted', reason: emailMsg };
+        return { event: 'prompt_gate_block_unapproved_email_domain', reason: emailMsg };
     const tenantMsg = tenantViolation(agent);
     return tenantMsg ? { event: 'prompt_gate_block_unapproved_tenant', reason: tenantMsg } : null;
 }
 /**
- * Block the prompt unless the agent is approved, the login's email is on the organization's email
- * allowlist and its tenant is approved (all as remediation sync stored them), printing the block
- * payload; true when it did. A login whose email or tenant cannot be read passes that check, and a
+ * Block the prompt when the agent is not approved, or the login's email domain or its tenant was
+ * blocked (all as remediation sync stored them), printing the block payload; true when it did. A
+ * domain or tenant awaiting review gets through. A login whose email or tenant cannot be read passes that check, and a
  * machine that has synced nothing yet is not blocked.
  */
 function blockedByLogin(agent, ide) {

package/dist/endpoint_client/types.js

@@ -1,4 +1,6 @@
-/** Path suffix for file collection patterns (backend: api/file-path-registry/file-patterns/). */
-export const FILE_PATH_REGISTRY_FILE_PATTERNS_PATH = '/api/file-path-registry/file-patterns/';
+/** Path suffix for file collection patterns (backend: api/file-path-registry/file-patterns/).
+ * `allowed_keys=1` says this sensor applies each pattern's allowed_keys and allowed_entries, so the backend
+ * also sends the file types that may only send those keys (hosting project links, OPT-1408). */
+export const FILE_PATH_REGISTRY_FILE_PATTERNS_PATH = '/api/file-path-registry/file-patterns/?allowed_keys=1';
 /** Path suffix for sensitive paths audit candidates (backend: api/file-path-registry/sensitive-paths-audit-candidates/). */
 export const FILE_PATH_REGISTRY_SENSITIVE_PATHS_PATH = '/api/file-path-registry/sensitive-paths-audit-candidates/';

package/dist/log_config_files/collection/allowed_keys.js

@@ -0,0 +1,61 @@
+/**
+ * Keep only the keys a file type allows (OPT-1408, docs/infra-inventory DESIGN.md I25).
+ *
+ * A hosting project link (`.vercel/project.json`, `.netlify/state.json`, `fly.toml`) is needed
+ * only for the project it names, so the backend's pattern lists the identifiers to keep in
+ * `allowed_keys`, and nothing else in the file leaves the device. A file that did not parse as an
+ * object, or holds none of the keys, is not sent at all, so its text can never be sent instead.
+ */
+/** The pattern's allowed keys copied onto one of its targets. */
+export function copyAllowedKeys(target, pattern) {
+    if (pattern.allowed_keys?.length)
+        target.allowed_keys = pattern.allowed_keys;
+    if (pattern.allowed_entries)
+        target.allowed_entries = pattern.allowed_entries;
+}
+/** Whether the target's files may only send the identifiers its rules keep. */
+export function hasAllowedKeys(target) {
+    return Boolean(target.allowed_keys?.length || target.allowed_entries);
+}
+/** The keys of `source` that `keep` names, with string or number values. */
+function plainValues(source, keep) {
+    const kept = {};
+    for (const key of keep) {
+        const value = source[key];
+        // An identifier is a plain value; anything nested could carry more than the identifier.
+        if (typeof value === 'string' || typeof value === 'number')
+            kept[key] = value;
+    }
+    return kept;
+}
+function isObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+/** Each entry of the map `value` cut to `keep`; entries that are not objects, or keep nothing, are dropped. */
+function keptEntries(value, keep) {
+    const kept = {};
+    if (!isObject(value))
+        return kept;
+    for (const [name, entry] of Object.entries(value)) {
+        const cut = isObject(entry) ? plainValues(entry, keep) : {};
+        if (Object.keys(cut).length > 0)
+            kept[name] = cut;
+    }
+    return kept;
+}
+/**
+ * The top-level keys of `raw` that `keep` names, with string or number values, and each map that
+ * `entries` names with every entry cut to its keys (the Railway CLI's linked folders); null when
+ * nothing is kept.
+ */
+export function keepAllowedKeys(raw, keep, entries = {}) {
+    if (!isObject(raw))
+        return null;
+    const kept = plainValues(raw, keep);
+    for (const [key, fields] of Object.entries(entries)) {
+        const cut = keptEntries(raw[key], fields);
+        if (Object.keys(cut).length > 0)
+            kept[key] = cut;
+    }
+    return Object.keys(kept).length > 0 ? kept : null;
+}

package/dist/log_config_files/collection/config_collector.js

@@ -1,10 +1,11 @@
 import { existsSync, readdirSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { readJSONFile, readMCPConfig, readMarkdownFile, readInstalledExtensions } from '../readers/file_readers.js';
+import { readJSONFile, readMCPConfig, readMarkdownFile, readInstalledExtensions, parseTomlText } from '../readers/file_readers.js';
 import { getExtensionsCachePath, getExtensionsCacheInstalledSuffix, getVscdbPath } from '../paths/path_constants_helpers.js';
 import { resolvePatternToTargets, normalizePathSkipPrefixes } from '../paths/pattern_resolver.js';
 import { enrichRawFromRecipe } from './enrichment_helpers.js';
 import { applyCoworkSessionWhitelist } from './cowork_session_whitelist.js';
+import { copyAllowedKeys, hasAllowedKeys, keepAllowedKeys } from './allowed_keys.js';
 import { collectDirectoryEntries, collectDirectoryMetadata } from './directory_collector.js';
 import { collectVscdbEntries } from '../readers/vscdb_config_builder.js';
 import { pushDerivedFilesFromRecipe } from './openclaw_helpers.js';
@@ -65,6 +66,7 @@ function buildCollectionContext(patterns, projectRoot, home, homeRecurseSkipDirs
         for (const t of resolvePatternToTargets(p.path, p.type, p.file_type, projectRoot, home, pathSkipPrefixes, p.collect_style, p.content_format, p.dir_glob, homeRecurseSkipDirs, p.path_resolution, p.resolve_under_home !== false, absolutePathPrefixes, mcpToolGlobSpec, clientPathConstants, pathResolutionSpecs)) {
             if (p.raw_key)
                 t.raw_key = p.raw_key;
+            copyAllowedKeys(t, p);
             if (p.dir_subdir_filename)
                 t.dir_subdir_filename = p.dir_subdir_filename;
             if (p.dir_subdir_source)
@@ -83,6 +85,10 @@ function readContentByFormat(path, format) {
         return readMarkdownFile(path);
     if (format === 'sqlite_vscdb')
         return null; // handled upstream by collectVscdbEntries
+    if (format === 'toml') {
+        const text = readMarkdownFile(path);
+        return text === null ? null : parseTomlText(text);
+    }
     // json (default) — fall back to markdown for .md files from agents not yet annotated
     return readJSONFile(path) ?? readMCPConfig(path) ?? (path.endsWith('.md') ? readMarkdownFile(path) : null);
 }
@@ -92,6 +98,21 @@ function isPortableCursorUserSettingsTarget(t) {
         p.endsWith('/cursor/user/settings.json') ||
         p.includes('application support/cursor/user/settings.json'));
 }
+/** The kept identifiers of a file whose pattern limits what may leave the device, read in the
+ * pattern's content format; null when nothing is kept (OPT-1408). */
+export function keptFileContent(path, pattern) {
+    const content = readContentByFormat(path, pattern.content_format || 'json');
+    return keepAllowedKeys(content, pattern.allowed_keys ?? [], pattern.allowed_entries ?? {});
+}
+/** A file whose pattern limits what may leave the device: the kept identifiers, or nothing. */
+function collectKeptFileEntry(t) {
+    const kept = keptFileContent(t.path, t);
+    return kept === null ? null : { file_type: t.file_type, file_path: t.logicalFilePath ?? t.path, raw_content: kept };
+}
+/** A regular file's entry: cut to its pattern's kept identifiers when it has any. */
+function collectFileEntry(t, enrichByFileType) {
+    return hasAllowedKeys(t) ? collectKeptFileEntry(t) : collectRegularFileEntry(t, enrichByFileType);
+}
 function collectRegularFileEntry(t, enrichByFileType) {
     const format = t.content_format || 'json';
     let content = readContentByFormat(t.path, format);
@@ -212,7 +233,7 @@ function collectConfigFilesFromPatterns(patterns, projectRoot, onProgress, optio
                 configFiles.push(entry);
             continue;
         }
-        const entry = collectRegularFileEntry(t, enrichByFileType);
+        const entry = collectFileEntry(t, enrichByFileType);
         if (entry) {
             configFiles.push(entry);
             const recipe = enrichByFileType[t.file_type];
@@ -229,6 +250,7 @@ export { collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles } fr
 export { collectMcpFromClaudeJsonProjects } from './claude_known_projects_collector.js';
 export { collectClaudeTokenUsage } from './claude_token_usage_collector.js';
 export { collectCopilotTokenUsage } from './copilot_token_usage_collector.js';
+export { collectCopilotUsageWithAccount } from './copilot_account.js';
 export { collectOpencodeTokenUsage } from './opencode_token_usage_collector.js';
 export { collectCodexTokenUsage } from './codex_token_usage_collector.js';
 export { collectCursorTokenUsage } from './cursor_token_usage_collector.js';

package/dist/log_config_files/collection/copilot_account.js

@@ -0,0 +1,149 @@
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { OPTIMUSLABS_MANAGEMENT_REL } from '../../bootstrap_constants.js';
+import { atomicWriteJson } from '../runtime/management_storage.js';
+import { collectCopilotTokenUsage } from './copilot_token_usage_collector.js';
+const GH_TIMEOUT_MS = 5000;
+const POLICY_FIELDS = [
+    'chat_enabled',
+    'cli_enabled',
+    'copilot_app_enabled',
+    'is_mcp_enabled',
+    'editor_preview_features_enabled',
+    'copilotignore_enabled',
+];
+function asObject(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function text(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}
+/** `lastLoggedInUser` from Copilot's config, which starts with `//` comment lines. */
+export function readCopilotLogin(home) {
+    let raw;
+    try {
+        raw = readFileSync(join(home, '.copilot', 'config.json'), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let config;
+    try {
+        config = asObject(JSON.parse(raw.replace(/^\s*\/\/.*$/gm, '')));
+    }
+    catch {
+        return null;
+    }
+    const user = asObject(config.lastLoggedInUser);
+    const login = text(user.login);
+    return login ? { login, host: text(user.host) || 'https://github.com' } : null;
+}
+function parsedGhOutput(output) {
+    try {
+        return JSON.parse(output);
+    }
+    catch {
+        return null;
+    }
+}
+/** The account `gh` is signed in as. Fixed arguments: nothing outside shapes the command. */
+function ghUser() {
+    try {
+        const output = execFileSync('gh', ['api', 'user'], {
+            encoding: 'utf8',
+            timeout: GH_TIMEOUT_MS,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return parsedGhOutput(output);
+    }
+    catch {
+        return null;
+    }
+}
+/** That account's Copilot seat, as Copilot's /status reads it. */
+function ghCopilotSeat() {
+    try {
+        const output = execFileSync('gh', ['api', '/copilot_internal/user'], {
+            encoding: 'utf8',
+            timeout: GH_TIMEOUT_MS,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return parsedGhOutput(output);
+    }
+    catch {
+        return null;
+    }
+}
+const GITHUB_CLI = { user: ghUser, copilotSeat: ghCopilotSeat };
+/** The seat fields worth keeping from a `/copilot_internal/user` answer. */
+export function copilotSeat(answer) {
+    const data = asObject(answer);
+    const organizations = (Array.isArray(data.organization_list) ? data.organization_list : [])
+        .map((org) => text(asObject(org).name) || text(asObject(org).login))
+        .filter(Boolean);
+    const policies = {};
+    for (const field of POLICY_FIELDS) {
+        if (typeof data[field] === 'boolean')
+            policies[field] = data[field];
+    }
+    return {
+        ...(text(data.copilot_plan) ? { plan: text(data.copilot_plan) } : {}),
+        ...(text(data.access_type_sku) ? { sku: text(data.access_type_sku) } : {}),
+        ...(organizations.length ? { organizations } : {}),
+        ...(Object.keys(policies).length ? { policies } : {}),
+    };
+}
+const CACHE_BASENAME = 'copilot_account.json';
+const CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+function cachePath(home) {
+    return join(home, OPTIMUSLABS_MANAGEMENT_REL, CACHE_BASENAME);
+}
+/** Yesterday's answer for this login, or null when there is none or it is out of date. */
+function readCachedAccount(home, login, now) {
+    try {
+        const cached = asObject(JSON.parse(readFileSync(cachePath(home), 'utf8')));
+        const account = asObject(cached.account);
+        const fresh = typeof cached.checked_at === 'number' && now - cached.checked_at < CACHE_MAX_AGE_MS;
+        return fresh && account.login === login ? account : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeCachedAccount(home, account, now) {
+    try {
+        atomicWriteJson(cachePath(home), { checked_at: now, account });
+    }
+    catch {
+        // An unwritable cache only means asking GitHub again next time.
+    }
+}
+export function readCopilotAccount(home, gh = GITHUB_CLI, now = Date.now()) {
+    const signedIn = readCopilotLogin(home);
+    if (!signedIn)
+        return null;
+    const cached = readCachedAccount(home, signedIn.login, now);
+    if (cached)
+        return cached;
+    const account = lookUpSeat(signedIn, gh);
+    writeCachedAccount(home, account, now);
+    return account;
+}
+function lookUpSeat(signedIn, gh) {
+    // gh answers for github.com; an enterprise server host would need gh's --hostname.
+    if (signedIn.host.replace(/\/+$/, '') !== 'https://github.com')
+        return signedIn;
+    const ghLogin = text(asObject(gh.user()).login);
+    if (!ghLogin || ghLogin.toLowerCase() !== signedIn.login.toLowerCase())
+        return signedIn;
+    return { ...signedIn, ...copilotSeat(gh.copilotSeat()) };
+}
+/** The Copilot usage summary with the account added, as one Copilot row per machine. */
+export function collectCopilotUsageWithAccount(home) {
+    const usage = collectCopilotTokenUsage(home);
+    const account = usage.length ? readCopilotAccount(home) : null;
+    if (!account)
+        return usage;
+    return usage.map((entry) => ({ ...entry, raw_content: { ...asObject(entry.raw_content), account } }));
+}

package/dist/log_config_files/runtime/main_runner.js

@@ -15,7 +15,8 @@ import { ensureAuthentication } from '../auth/auth_flow.js';
 import { readJSONFile, readMarkdownFile } from '../readers/file_readers.js';
 import { isVscdbVirtualPath, tryReadVscdbVirtualFile, summarizeComposerPayloadForDiagnostics, } from '../readers/vscdb_config_builder.js';
 import { persistVscdbComposerContractFromPatternsResponse } from '../readers/vscdb_reader.js';
-import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles, collectMcpFromClaudeJsonProjects, collectClaudeTokenUsage, collectCopilotTokenUsage, collectOpencodeTokenUsage, collectCodexTokenUsage, collectCursorTokenUsage, collectHermesTokenUsage, collectOpenclawTokenUsage, collectPiTokenUsage, collectCoworkDesktopVersion, collectClaudeDesktopOrgs, collectGrokCliVersion, collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, determineFileTypeFromPath, } from '../collection/config_collector.js';
+import { hasAllowedKeys } from '../collection/allowed_keys.js';
+import { keptFileContent, collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles, collectMcpFromClaudeJsonProjects, collectClaudeTokenUsage, collectCopilotUsageWithAccount, collectOpencodeTokenUsage, collectCodexTokenUsage, collectCursorTokenUsage, collectHermesTokenUsage, collectOpenclawTokenUsage, collectPiTokenUsage, collectCoworkDesktopVersion, collectClaudeDesktopOrgs, collectGrokCliVersion, collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, determineFileTypeFromPath, } from '../collection/config_collector.js';
 import { ensureCursorUserSettingsSnapshotInBatch } from '../collection/ensure_cursor_user_settings_snapshot.js';
 import { collectSkillsCliInstalled } from '../collection/skills_cli_collector.js';
 import { collectWorkspaceVscdbs } from '../collection/mcp_tool_collector.js';
@@ -43,7 +44,7 @@ function addUnseen(configFiles, seen, entries) {
 const HOME_COLLECTORS = [
     ['scanning Claude known projects from ~/.claude.json', collectMcpFromClaudeJsonProjects],
     ['aggregating Claude token usage from ~/.claude/projects transcripts', collectClaudeTokenUsage],
-    ['aggregating Copilot token usage from ~/.copilot/session-state transcripts', collectCopilotTokenUsage],
+    ['aggregating Copilot token usage and account from ~/.copilot', collectCopilotUsageWithAccount],
     ['aggregating OpenCode token usage from ~/.local/share/opencode/opencode.db', collectOpencodeTokenUsage],
     ['aggregating Codex token usage from ~/.codex/sessions rollouts', collectCodexTokenUsage],
     ['aggregating Cursor token usage from state.vscdb', collectCursorTokenUsage],
@@ -299,49 +300,68 @@ async function main() {
     }
     await sendAllConfigFiles(configFiles, worktreeReport, hardwareUuid, authKey);
 }
+/** The pattern of a file type that limits what may leave the device (OPT-1408), if it has one. */
+function limitedPattern(fileType, patterns) {
+    return patterns.find((p) => p.file_type === fileType && hasAllowedKeys(p));
+}
+/** Send a limited file cut to its kept identifiers, or nothing when it holds none of them. */
+async function logLimitedFile(filePath, pattern, hardwareUuid, authKey) {
+    const kept = keptFileContent(filePath, pattern);
+    if (!kept) {
+        console.error(`Nothing to send from: ${filePath}`);
+        return false;
+    }
+    return sendConfigFile({ file_type: pattern.file_type, file_path: filePath, raw_content: kept }, hardwareUuid, authKey);
+}
+/** Whether the file to log is missing (reported); a vscdb virtual path has no file of its own. */
+function logMissingSingleFile(filePath, isVscdb) {
+    if (isVscdb || existsSync(filePath))
+        return false;
+    console.error(`File not found: ${filePath}`);
+    return true;
+}
+/** A vscdb virtual file's content and type; null (reported) when it cannot be read. */
+function readVscdbSingleFile(filePath, patternsResponse) {
+    const result = tryReadVscdbVirtualFile(filePath, patternsResponse);
+    if (!result) {
+        console.error(`Could not read vscdb virtual file: ${filePath}`);
+        return null;
+    }
+    return { rawContent: result.rawContent, fileType: result.fileType };
+}
+/** A file read as JSON, else as markdown; null (reported) when neither reads. */
+function readPlainSingleFile(filePath, fileType) {
+    const json = readJSONFile(filePath);
+    if (json)
+        return { rawContent: json, fileType };
+    const markdown = readMarkdownFile(filePath);
+    if (markdown === null) {
+        console.error(`Could not read file: ${filePath}`);
+        return null;
+    }
+    return { rawContent: { content: markdown, source: 'file' }, fileType };
+}
 async function logSingleFile(filePath) {
     const hardwareUuid = resolveHardwareUuid();
     const authKey = await ensureAuthentication(hardwareUuid);
-    const patternsResponse = await getFileCollectionPatterns(loadEndpointBase());
-    const isVscdb = isVscdbVirtualPath(filePath, patternsResponse ?? null);
-    if (!existsSync(filePath) && !isVscdb) {
-        console.error(`File not found: ${filePath}`);
+    const patternsResponse = (await getFileCollectionPatterns(loadEndpointBase())) ?? null;
+    const isVscdb = isVscdbVirtualPath(filePath, patternsResponse);
+    if (logMissingSingleFile(filePath, isVscdb))
         return false;
-    }
     const patterns = patternsResponse?.patterns ?? [];
-    let rawContent = null;
-    let fileType = determineFileTypeFromPath(filePath, patterns) ?? undefined;
-    if (isVscdb) {
-        const vscdbResult = tryReadVscdbVirtualFile(filePath, patternsResponse ?? null);
-        if (!vscdbResult) {
-            console.error(`Could not read vscdb virtual file: ${filePath}`);
-            return false;
-        }
-        rawContent = vscdbResult.rawContent;
-        fileType = vscdbResult.fileType;
-    }
-    else {
-        rawContent = readJSONFile(filePath);
-        if (!rawContent) {
-            const markdown = readMarkdownFile(filePath);
-            if (markdown !== null) {
-                rawContent = { content: markdown, source: 'file' };
-                if (!fileType)
-                    fileType = determineFileTypeFromPath(filePath, patterns) ?? undefined;
-            }
-        }
-    }
-    if (!rawContent) {
-        console.error(`Could not read file: ${filePath}`);
+    const pathType = determineFileTypeFromPath(filePath, patterns) ?? undefined;
+    // A file type with allowed keys is sent cut to its kept keys, or not at all (OPT-1408).
+    const limited = limitedPattern(pathType, patterns);
+    if (limited)
+        return logLimitedFile(filePath, limited, hardwareUuid, authKey);
+    const read = isVscdb ? readVscdbSingleFile(filePath, patternsResponse) : readPlainSingleFile(filePath, pathType);
+    if (!read)
         return false;
-    }
+    const fileType = read.fileType ?? pathType;
     if (!fileType) {
-        fileType = determineFileTypeFromPath(filePath, patterns) ?? undefined;
-        if (!fileType) {
-            console.error(`Could not determine file type for: ${filePath}`);
-            return false;
-        }
+        console.error(`Could not determine file type for: ${filePath}`);
+        return false;
     }
-    return sendConfigFile({ file_type: fileType, file_path: filePath, raw_content: rawContent }, hardwareUuid, authKey);
+    return sendConfigFile({ file_type: fileType, file_path: filePath, raw_content: read.rawContent }, hardwareUuid, authKey);
 }
 export { main, logSingleFile, createSignature, canonicalizePayload, sendConfigFile, sendConfigFilesBatch, BATCH_CHUNK_SIZE, addSensitivePathsAudit, };

package/dist/log_config_files/runtime/skill_block.js

@@ -0,0 +1,188 @@
+/**
+ * Skill block (docs/skill-block/DESIGN.md): lock the skill folders the organization blocked so no
+ * agent can load or run them, and give a folder its permissions back once the skill is unblocked.
+ *
+ * The remediation sync stores the server's list under `skill_blocks` in
+ * remediation_instructions.json and then calls `applySkillBlocks`. A folder is locked with
+ * `chmod 000` after its mode is recorded in skill_block_state.json; a recorded folder that is no
+ * longer listed gets that mode back. The folders are where the collection found each skill's
+ * SKILL.md, for any agent. A folder is locked only when it is a real directory inside the home
+ * folder (never the home folder itself) holding a SKILL.md, so a bad path cannot lock anything
+ * that is not a skill.
+ */
+import { chmodSync, existsSync, lstatSync, readFileSync, realpathSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, resolve, sep } from 'node:path';
+import { complianceRunnerDiag, hookRunLog } from './hook_logger.js';
+import { atomicWriteJson, getSkillBlockStatePath } from './management_storage.js';
+function log(message) {
+    hookRunLog(message);
+    complianceRunnerDiag(message);
+}
+export function readSkillBlockState() {
+    const path = getSkillBlockStatePath();
+    if (!existsSync(path))
+        return {};
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+function permissionBits(path) {
+    return lstatSync(path).mode & 0o7777;
+}
+/**
+ * Whether `dir` is a skill folder this endpoint locked for a block and that is still locked. Its
+ * files cannot be read, and nothing can have changed in it since it was locked, so the collection
+ * reports it as locked and the backend keeps the copy it has.
+ */
+export function isLockedByOptimus(dir) {
+    const target = resolve(dir);
+    if (!readSkillBlockState()[target])
+        return false;
+    try {
+        return permissionBits(target) === 0;
+    }
+    catch {
+        return false;
+    }
+}
+/** Why `dir` must not be locked, or null when it is a real skill folder inside the home folder. */
+export function refusalReason(dir, home = homedir()) {
+    const root = resolve(home);
+    const target = resolve(dir);
+    if (!target.startsWith(root + sep))
+        return 'outside the home folder';
+    if (!existsSync(target))
+        return 'missing';
+    const stat = lstatSync(target);
+    if (stat.isSymbolicLink())
+        return 'symlink';
+    if (!stat.isDirectory())
+        return 'not a directory';
+    if (!realpathSync(target).startsWith(realpathSync(root) + sep))
+        return 'resolves outside the home folder';
+    if (!existsSync(join(target, 'SKILL.md')))
+        return 'no SKILL.md';
+    return null;
+}
+/** Lock a recorded folder again if it was opened; its path may have been replaced, so check it. */
+function relockIfOpened(dir, entry, outcome, home) {
+    if (!existsSync(dir) || permissionBits(dir) === 0)
+        return;
+    const reason = refusalReason(dir, home);
+    if (reason) {
+        outcome.refused.push({ skill_dir: entry.skill_dir, reason });
+        return;
+    }
+    chmodSync(dir, 0o000);
+    outcome.relocked.push(dir);
+}
+/** Lock a listed folder, or lock it again when its permissions were opened since. */
+function lockFolder(entry, state, outcome, home) {
+    const dir = resolve(entry.skill_dir);
+    const known = state[dir];
+    if (known) {
+        relockIfOpened(dir, entry, outcome, home);
+        return;
+    }
+    const reason = refusalReason(dir, home);
+    if (reason) {
+        outcome.refused.push({ skill_dir: entry.skill_dir, reason });
+        return;
+    }
+    state[dir] = { mode: permissionBits(dir), resource_uuid: entry.resource_uuid, locked_at: new Date().toISOString() };
+    atomicWriteJson(getSkillBlockStatePath(), state);
+    chmodSync(dir, 0o000);
+    outcome.locked.push(dir);
+}
+/** Give a folder no longer listed the mode it had before it was locked. */
+function restoreFolder(dir, state, outcome) {
+    const { mode } = state[dir];
+    if (existsSync(dir) && !lstatSync(dir).isSymbolicLink()) {
+        chmodSync(dir, mode);
+        outcome.restored.push(dir);
+    }
+    delete state[dir];
+}
+/**
+ * Make the folders on disk match `entries`, the server's whole list for this machine: lock the
+ * listed ones, restore the ones locked before and no longer listed. A folder that fails the checks
+ * is skipped and logged; one failing chmod does not stop the others.
+ */
+export function applySkillBlocks(entries, home = homedir()) {
+    const outcome = { locked: [], relocked: [], restored: [], refused: [] };
+    const lockPath = `${getSkillBlockStatePath()}.lock`;
+    if (!takeStateLock(lockPath)) {
+        log('skill_block: another sync is applying blocks; the next sync applies these');
+        return outcome;
+    }
+    try {
+        applyUnderLock(entries, home, outcome);
+    }
+    finally {
+        releaseStateLock(lockPath);
+    }
+    return outcome;
+}
+/**
+ * Take the lock around reading the state, changing permissions and writing the state. Two syncs at
+ * once (the prompt gate and the compliance runner) could otherwise lose a folder's original mode,
+ * leaving it locked after an unblock. A lock left by a dead process goes after a minute.
+ */
+function takeStateLock(lockPath) {
+    try {
+        if (existsSync(lockPath) && Date.now() - statSync(lockPath).mtimeMs > 60_000)
+            unlinkSync(lockPath);
+        writeFileSync(lockPath, '', { flag: 'wx' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function releaseStateLock(lockPath) {
+    try {
+        unlinkSync(lockPath);
+    }
+    catch {
+        // Already gone; the next sync takes it again.
+    }
+}
+function applyUnderLock(entries, home, outcome) {
+    const state = readSkillBlockState();
+    const wanted = new Set(entries.map((entry) => resolve(entry.skill_dir)));
+    for (const entry of entries) {
+        try {
+            lockFolder(entry, state, outcome, home);
+        }
+        catch (err) {
+            outcome.refused.push({ skill_dir: entry.skill_dir, reason: err instanceof Error ? err.message : String(err) });
+        }
+    }
+    for (const dir of Object.keys(state)) {
+        if (wanted.has(dir))
+            continue;
+        try {
+            restoreFolder(dir, state, outcome);
+        }
+        catch (err) {
+            outcome.refused.push({ skill_dir: dir, reason: err instanceof Error ? err.message : String(err) });
+        }
+    }
+    atomicWriteJson(getSkillBlockStatePath(), state);
+    logOutcome(outcome);
+}
+function logOutcome(outcome) {
+    for (const dir of outcome.locked)
+        log(`skill_block: locked ${dir}`);
+    for (const dir of outcome.relocked)
+        log(`skill_block: locked again (permissions were opened) ${dir}`);
+    for (const dir of outcome.restored)
+        log(`skill_block: restored ${dir}`);
+    for (const { skill_dir, reason } of outcome.refused)
+        log(`skill_block: skipped ${skill_dir} (${reason})`);
+}

package/dist/log_config_files/runtime/skill_block_sessions.js

@@ -0,0 +1,86 @@
+/**
+ * Skill block killswitch (docs/skill-block/DESIGN.md): a session that loaded a skill keeps it in its
+ * conversation, so when that skill is blocked the session is stopped until the user restarts Claude
+ * Code. A restarted process reads its skills with the folder locked, so the skill does not exist.
+ *
+ * The backend knows which sessions loaded a skill: the tool calls the skill usage view attributes to
+ * it. The remediation sync sends this machine's sessions that loaded a blocked skill
+ * (`skill_block_sessions` in remediation_instructions.json), and the prompt gate refuses their
+ * prompts. Only those sessions are stopped; an unblock takes them off the list.
+ */
+import { execFileSync } from 'node:child_process';
+import { basename, resolve } from 'node:path';
+import { readRemediationInstructionsFile } from './management_storage.js';
+import { readSkillBlockState } from './skill_block.js';
+/** A process's parent, start time and command name, from `ps`; null when it cannot be read. */
+function processRow(pid) {
+    try {
+        // A fixed command, no shell, and a process id that is always a number.
+        const out = execFileSync('ps', ['-o', 'ppid=,lstart=,comm=', '-p', String(pid)], { encoding: 'utf8' }).trim(); // nosafe: SAFE801
+        const row = out.match(/^(\d+)\s+(\S+\s+\S+\s+\d+\s+[\d:]+\s+\d+)\s+(.*)$/);
+        return row ? { parent: Number(row[1]), startedAt: Date.parse(row[2]), name: basename(row[3]).toLowerCase() } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * When the `claude` process running this hook started (ms), or null when it cannot be found. It
+ * lists its skills when it starts and keeps them across `/clear`, so this is what tells a real
+ * restart from `/clear`, which only changes the session id.
+ */
+export function claudeProcessStartedAt() {
+    let pid = process.ppid;
+    for (let depth = 0; depth < 12 && pid > 1; depth += 1) {
+        const row = processRow(pid);
+        if (!row)
+            return null;
+        if (row.name === 'claude')
+            return row.startedAt;
+        pid = row.parent;
+    }
+    return null;
+}
+/** The names of the blocked skills this session loaded; empty when it may go on. */
+export function stoppingSkills(sessionId) {
+    if (!sessionId)
+        return [];
+    const sessions = readRemediationInstructionsFile().skill_block_sessions ?? [];
+    return sessions.filter((s) => s.session_id === sessionId).map((s) => s.skill_name || 'a skill');
+}
+/** The notice for a stopped session. */
+export function stoppedSessionMessage(skills) {
+    const names = [...new Set(skills)].join(', ');
+    return (`Your organization blocked ${names}, which this session loaded. Copy anything you need from ` +
+        'this conversation, then quit Claude Code and start it again to continue. Resuming this ' +
+        'session keeps it stopped.');
+}
+/**
+ * The blocked skill a typed slash command runs, when this process may still have it, or null:
+ * `/airtable:airtable-cli …` or `/airtable-cli …`. A process started before the folder was locked
+ * listed the skill and keeps it, even after `/clear`, so this refuses it. A process started after
+ * the lock never listed it: this answers null, and Claude Code says the skill does not exist.
+ * Matches the skill's name or its folder's name, which can differ (`aikido-issues` lives in
+ * `skills/issues`). An unknown start time counts as too old, so a block is never skipped.
+ */
+export function blockedSkillOfCommand(promptFirstLine, processStartedAt = claudeProcessStartedAt) {
+    const command = promptFirstLine.trim().split(/\s+/)[0] ?? '';
+    if (!command.startsWith('/'))
+        return null;
+    const typed = command.slice(command.lastIndexOf(':') + 1).replace(/^\//, '').toLowerCase();
+    const blocks = readRemediationInstructionsFile().skill_blocks ?? [];
+    const hits = blocks.filter((b) => b.skill_name.toLowerCase() === typed || basename(b.skill_dir).toLowerCase() === typed);
+    if (hits.length === 0)
+        return null;
+    const startedAt = processStartedAt();
+    const locks = readSkillBlockState();
+    const mayStillHaveIt = hits.some((b) => {
+        const lockedAt = Date.parse(locks[resolve(b.skill_dir)]?.locked_at ?? '');
+        return startedAt === null || Number.isNaN(lockedAt) || startedAt <= lockedAt;
+    });
+    return mayStillHaveIt ? hits[0].skill_name || typed : null;
+}
+/** The notice for a typed command of a blocked skill in a process that may still have it. */
+export function blockedCommandMessage(skill) {
+    return `Your organization blocked ${skill}. Quit Claude Code and start it again to continue.`;
+}

package/dist/pii_scrub.js

@@ -0,0 +1,15 @@
+/**
+ * pii-scrub shim: the one place that imports @optimuslabs/pii-scrub-staging.
+ *
+ * Loaded the way tofu.ts loads tofu: the sibling local dist when environment=development and it
+ * is built, the published npm package otherwise.
+ */
+import path from "path";
+import { fileURLToPath } from "url";
+import { shouldUseLocalTofuDist } from "./tofu_environment.js";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const localPiiScrubPath = path.join(__dirname, "../../pii-scrub/dist/index.js");
+const piiScrub = (shouldUseLocalTofuDist(localPiiScrubPath)
+    ? await import(localPiiScrubPath)
+    : await import("@optimuslabs/pii-scrub-staging"));
+export const { SCRUBBER_VERSION, containsPlaceholder, scrubFields, scrubText, scrubValue } = piiScrub;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.34",
+  "version": "1.5.36",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {