@optimuslabs/harness-map-staging 1.5.35 → 1.5.38

package/dist/approved_tenant_gate.js

@@ -87,7 +87,7 @@ export function readClaudeSignedInTenant(env = process.env) {
 /**
  * Block messages, one shape for every agent (Optimus Labs' prompt-block wording):
  * "This device only allows <agent> <under/on/in> the <approved> <kind>. You're signed in to
- * <what>. <how to switch>." With nothing approved yet: "This device doesn't allow <agent> signed in
+ * <what>. <how to switch>." With nothing approved yet: "This device doesn't allow <agent> to be signed in
  * to <what>." and the same last sentence.
  */
 const TENANT_WORDS = {
@@ -96,6 +96,8 @@ const TENANT_WORDS = {
     cursor: { name: 'Cursor', kind: 'team', prep: 'on' },
     codex: { name: 'Codex', kind: 'workspace', prep: 'in' },
 };
+/** How a block that names the organization's own rule begins; such a block needs no title above it. */
+export const ORGANIZATION_LEAD = 'Your organization';
 /** A tenant's name as the admin approved it, or its id when it has none. */
 function nameOf(t) {
     return (t.tenant_name || '').trim() || t.tenant_id.trim();
@@ -108,35 +110,129 @@ function emailDomain(email) {
 function capitalised(word) {
     return word ? word[0].toUpperCase() + word.slice(1) : word;
 }
-/** What to pick to get back in: the one approved tenant, one of several, or the company's own. */
-function choice(approved, kind) {
+/**
+ * What to pick to get back in: the one approved tenant, one of several, or the company's own,
+ * named after `company` when it is known ("your Optimus Labs organization").
+ */
+function choice(approved, kind, company) {
     if (approved.length === 1)
         return approved[0];
-    return approved.length > 1 ? 'one of them' : `your company's ${kind}`;
+    return approved.length > 1 ? 'one of them' : `your ${company || "company's"} ${kind}`;
 }
-function switchStep(agent, approved) {
+function switchStep(agent, approved, company) {
     const kind = TENANT_WORDS[agent].kind;
     if (agent === 'claude_desktop')
-        return `Switch Claude Desktop to ${choice(approved, kind)}.`;
-    if (agent === 'codex')
-        return `Run codex logout, then codex login and choose ${choice(approved, kind)}.`;
+        return `Switch Claude Desktop to ${choice(approved, kind, company)}.`;
+    if (agent === 'codex') {
+        return `Run codex logout, then codex login and choose ${choice(approved, kind, company)}.`;
+    }
     if (agent === 'cursor') {
-        if (approved.length === 1)
-            return `Sign out of Cursor and sign in with your ${approved[0]} team account.`;
+        // Reached only without one account to name (see cursorTeamViolation).
         return approved.length > 1
             ? 'Sign out of Cursor and sign in with an account on one of those teams.'
             : "Sign out of Cursor and sign in with your company's team account.";
     }
-    return `Run /login and choose ${choice(approved, kind)}.`;
+    return `Run /login and choose ${choice(approved, kind, company)}.`;
 }
-/** The block message for `agent` signed in to `signedIn` (already worded) with these approved. */
-export function tenantBlockMessage(agent, approved, signedIn) {
+/**
+ * The block message for `agent` signed in to `signedIn` (already worded) with these approved.
+ * `company` names the company when the agent has nothing approved of its own; '' says "company's".
+ */
+export function tenantBlockMessage(agent, approved, signedIn, company = '') {
     const w = TENANT_WORDS[agent];
     const lead = approved.length
         ? `This device only allows ${w.name} ${w.prep} the ${approved.join(' or ')} ${w.kind}. ` +
             `You're signed in to ${signedIn}.`
-        : `This device doesn't allow ${w.name} signed in to ${signedIn}.`;
-    return `${lead} ${switchStep(agent, approved)}`;
+        : `This device doesn't allow ${w.name} to be signed in to ${signedIn}.`;
+    return `${lead} ${switchStep(agent, approved, company)}`;
+}
+/**
+ * The company's name for "your <company> team account": the one name its approved tenants go by,
+ * across every agent (a Cursor login on no approved team is pointed at the company's Claude
+ * organization's name). '' when there is none, or several. Personal accounts (`@<domain>`) and a
+ * person's own org ("ada@gmail.com's Organization") are not the company's.
+ */
+export function companyName(approved) {
+    const names = new Set(Object.values(approved ?? {})
+        .flatMap((policy) => tenantIds(policy?.tenants))
+        .filter((t) => !t.tenant_id.trim().startsWith('@') && !/'s organization$/i.test(nameOf(t)))
+        .map(nameOf));
+    return names.size === 1 ? [...names][0] : '';
+}
+/** The one account to name: the approved one, else the company's; '' for several or none known. */
+function accountOf(block) {
+    if (block.approved.length === 1)
+        return block.approved[0];
+    return block.approved.length ? '' : block.company;
+}
+/** The one-line block message, as the agent shows it. */
+export function tenantBlockText(block) {
+    const account = accountOf(block);
+    if (block.agent !== 'cursor' || !account) {
+        return tenantBlockMessage(block.agent, block.approved, block.signedIn, block.company);
+    }
+    const domains = block.domains.length ? ` (${block.domains.join(', ')})` : '';
+    return (`${ORGANIZATION_LEAD} does not allow Cursor to be signed in to ${block.signedIn}. ` +
+        `The approved organization's team account for Cursor is ${account}${domains}. ` +
+        'Please sign out and sign in with the approved account to use Cursor.');
+}
+/** What an approved account is called, per agent: "team account" for Cursor's teams. */
+const ACCOUNT_NOUN = {
+    claude: 'organization',
+    claude_desktop: 'organization',
+    cursor: 'team account',
+    codex: 'workspace',
+};
+/** A login block's window has nothing to open, so its one button only acknowledges: OK. */
+function loginWindow(title, reason, path) {
+    return { brand: 'Optimus Labs', scope: 'Org-wide policy', title, reason, best_match: path, cancel: 'OK' };
+}
+/** When personal accounts on an email domain are what is approved: "your optimuslabs.io account". */
+function personalPathCard(name, domains) {
+    return {
+        label: 'Approved path',
+        title: domains.length === 1 ? `Sign in with your ${domains[0]} account` : 'Sign in with an account on one of these domains',
+        subtitle: domains.length === 1 ? '' : domains.join(', '),
+        body: `Sign out of ${name}, then sign in with that account.`,
+    };
+}
+/** When nothing is approved to switch to: say so, and point at an admin rather than an account. */
+function noPathCard(name, kind) {
+    return {
+        label: 'What to do',
+        title: 'Ask an admin which account to use',
+        subtitle: '',
+        body: `Your organisation hasn't approved a ${name} ${kind} yet. Sign out of ${name}, then sign in with your work account once an admin has approved it.`,
+    };
+}
+/** The window for a login whose tenant is refused: what it is signed in to, and what to use instead. */
+export function tenantBlockWindow(block) {
+    const words = TENANT_WORDS[block.agent];
+    const account = accountOf(block);
+    const title = `${words.name} is signed in to an account your organisation doesn't allow`;
+    const reason = {
+        title: block.personal ? "It's a personal account." : `It isn't an approved ${words.kind}.`,
+        body: 'Agents signed in to accounts outside your organisation can send its code and data there.',
+    };
+    // An approved path is something approved for this agent itself: a team, or personal accounts on
+    // an email domain. The company's name alone (from another agent's tenant, such as a Claude
+    // organization) is not one, so it gets What to do.
+    if (!block.approved.length && block.personalDomains.length) {
+        return loginWindow(title, reason, personalPathCard(words.name, block.personalDomains));
+    }
+    if (!block.approved.length)
+        return loginWindow(title, reason, noPathCard(words.name, words.kind));
+    const how = block.agent === 'cursor'
+        ? 'Sign out of Cursor, then sign in with that account.'
+        : switchStep(block.agent, block.approved, block.company);
+    return loginWindow(title, reason, {
+        label: 'Approved path',
+        title: account
+            ? `Sign in with your ${account} ${ACCOUNT_NOUN[block.agent]}`
+            : `Sign in with one of: ${block.approved.join(', ')}`,
+        subtitle: block.domains.join(', '),
+        body: how,
+    });
 }
 const CLAUDE_PERSONAL_PLANS = new Set(['free', 'pro', 'max']);
 /** "a personal Max account (gmail.com)" or "the Beta Corp organization". */
@@ -159,23 +255,31 @@ function tenantIds(tenants) {
 /**
  * The block message when `signedIn` may not be used for `agent`, else null.
  *
- * Mirrors the backend's `tenant_approval`: a tenant the organization marked unapproved is always
- * blocked; a shadow tenant (never decided) only once the agent has at least one approved tenant.
- * Ids compare exactly, as the backend does -- vendor ids are not ours to case-fold.
+ * Only a tenant the organization blocked (marked unapproved) is refused. One never decided is
+ * awaiting review and gets through, as an approved one does. Ids compare exactly, as the backend
+ * does -- vendor ids are not ours to case-fold.
  */
-export function approvedTenantViolation(agent, approved, signedIn) {
+export function approvedTenantBlock(agent, approved, signedIn) {
     if (!signedIn)
         return null;
     const policy = approved?.[agent];
-    const approvedTenants = tenantIds(policy?.tenants);
-    const unapprovedTenants = tenantIds(policy?.unapproved_tenants);
     const signedInId = signedIn.tenant_id.trim();
-    const isIn = (list) => list.some((t) => t.tenant_id.trim() === signedInId);
-    const blocked = isIn(unapprovedTenants) ||
-        ((policy?.enforced || approvedTenants.length > 0) && !isIn(approvedTenants));
-    if (!blocked)
+    if (!tenantIds(policy?.unapproved_tenants).some((t) => t.tenant_id.trim() === signedInId))
         return null;
-    return tenantBlockMessage(agent, approvedTenants.map(nameOf), claudeSignedInText(signedIn));
+    const signedInText = claudeSignedInText(signedIn);
+    return {
+        agent,
+        signedIn: signedInText,
+        personal: signedInText.startsWith('a personal'),
+        approved: tenantIds(policy?.tenants).map(nameOf),
+        company: companyName(approved),
+        domains: [],
+        personalDomains: [],
+    };
+}
+export function approvedTenantViolation(agent, approved, signedIn) {
+    const block = approvedTenantBlock(agent, approved, signedIn);
+    return block ? tenantBlockText(block) : null;
 }
 /**
  * The tenants a Cursor login is in: its teams, or, on no team, `@` and its email domain. Mirrors the
@@ -203,42 +307,37 @@ export function readCursorSignedInTeams(home = homedir()) {
 /**
  * Why a login in these tenants may not be used, or null when it may. Shared by every agent whose
  * login is a list of tenants (Cursor's teams) or one tenant that may be a personal account's
- * `@<domain>` (Codex), and mirrors the backend's `team_tenant_approval`: any approved tenant admits
- * the login; failing that, one marked unapproved is always blocked, and any other -- an unknown
- * tenant, or a personal account -- only once at least one tenant is approved for this agent.
+ * `@<domain>` (Codex). Blocked only when every tenant the login is in was blocked (marked
+ * unapproved): Cursor admits a login when any of its teams is allowed, and a tenant awaiting review
+ * is allowed, as an approved one is.
  */
 function listedTenantViolation(policy, tenants) {
-    const approvedList = tenantIds(policy?.tenants);
-    if (tenants.some((id) => isListed(approvedList, id)))
+    const unapprovedList = tenantIds(policy?.unapproved_tenants);
+    if (!tenants.length || !tenants.every((id) => isListed(unapprovedList, id)))
         return null;
-    const enforced = approvedList.length > 0 || Boolean(policy?.enforced);
-    if (!isRefused(tenants, enforced, tenantIds(policy?.unapproved_tenants)))
-        return null;
-    return { approved: approvedList.map(nameOf) };
+    // Approved personal-account keys (`@acme.io`) are not teams to sign in to: never named as one,
+    // but kept as the email domains whose personal accounts are approved.
+    const approved = tenantIds(policy?.tenants);
+    const isPersonal = (t) => t.tenant_id.trim().startsWith('@');
+    return {
+        approved: approved.filter((t) => !isPersonal(t)).map(nameOf),
+        personalDomains: approved.filter(isPersonal).map((t) => t.tenant_id.trim().slice(1)),
+    };
 }
 function isListed(list, id) {
     return list.some((t) => t.tenant_id.trim() === id);
 }
-/** Whether a login in these tenants is refused: one marked unapproved always; any other only once
- * the agent is enforced (an older backend that sends no flag, with nothing approved, lets it pass). */
-function isRefused(tenants, enforced, unapprovedList) {
-    if (tenants.some((id) => isListed(unapprovedList, id)))
-        return true;
-    return enforced;
-}
 /** A tenant's name from the organization's lists, or '' when it has none there. */
 function knownName(policy, id) {
     const all = [...tenantIds(policy?.tenants), ...tenantIds(policy?.unapproved_tenants)];
     const hit = all.find((t) => t.tenant_id.trim() === id);
     return (hit?.tenant_name || '').trim();
 }
-/** "a personal account on no team (gmail.com)", "the Beta team" or "team 9876". */
+/** "a personal account", "the Beta team" or "team 9876". */
 function cursorSignedInText(signedIn, policy) {
     const tenants = cursorTenants(signedIn);
-    if (!tenants.length || tenants[0].startsWith('@')) {
-        const domain = emailDomain(signedIn.email) || (tenants[0] ?? '').slice(1);
-        return `a personal account on no team${domain ? ` (${domain})` : ''}`;
-    }
+    if (!tenants.length || tenants[0].startsWith('@'))
+        return 'a personal account';
     return tenants
         .map((id) => (knownName(policy, id) ? `the ${knownName(policy, id)} team` : `team ${id}`))
         .join(' and ');
@@ -255,13 +354,27 @@ function codexSignedInText(signedIn, tenants, policy) {
     return name ? `the ${name} workspace` : `workspace ${tenant}`;
 }
 /** The block message when Cursor's login may not be used, else null. */
-export function cursorTeamViolation(approved, signedIn) {
+export function cursorTeamBlock(approved, signedIn, teamDomains = []) {
     if (!signedIn)
         return null;
     const v = listedTenantViolation(approved?.cursor, cursorTenants(signedIn));
     if (!v)
         return null;
-    return tenantBlockMessage('cursor', v.approved, cursorSignedInText(signedIn, approved?.cursor));
+    const signedInText = cursorSignedInText(signedIn, approved?.cursor);
+    // The one account to point at is the approved team, else the company's name (accountOf).
+    return {
+        agent: 'cursor',
+        signedIn: signedInText,
+        personal: signedInText === 'a personal account',
+        approved: v.approved,
+        company: companyName(approved),
+        domains: teamDomains,
+        personalDomains: v.personalDomains,
+    };
+}
+export function cursorTeamViolation(approved, signedIn, teamDomains = []) {
+    const block = cursorTeamBlock(approved, signedIn, teamDomains);
+    return block ? tenantBlockText(block) : null;
 }
 /**
  * Codex plans that are personal, mirroring the backend's `CodexPlans.PERSONAL`. On one of these
@@ -300,41 +413,27 @@ function codexEmailDomainTenant(signedIn) {
     return at >= 0 && at < email.length - 1 ? [`@${email.slice(at + 1).toLowerCase()}`] : [];
 }
 /** The block message when Codex's login may not be used, else null. */
-export function codexTenantViolation(approved, signedIn) {
+export function codexTenantBlock(approved, signedIn) {
     const tenants = signedIn ? codexTenants(signedIn) : null;
     if (!tenants)
         return null;
     const v = listedTenantViolation(approved?.codex, tenants);
     if (!v)
         return null;
-    return tenantBlockMessage('codex', v.approved, codexSignedInText(signedIn, tenants, approved?.codex));
-}
-/**
- * Whether a personal account's `@<domain>` tenant is on a team domain: an allowlisted domain that
- * someone on an approved team or enterprise tenant signs in with (any vendor's). A subdomain counts.
- */
-export function onTeamDomain(tenant, teamDomains) {
-    if (!tenant.startsWith('@') || !teamDomains?.length)
-        return false;
-    const domain = tenant.slice(1);
-    return teamDomains.some((d) => domain === d || domain.endsWith(`.${d}`));
-}
-/**
- * The block message for Cursor's login, else null. A login on a team is checked against the
- * approved teams. A personal account is only checked once its email is on a team domain; then it
- * is blocked unless an admin approved that personal tenant (`@<domain>`).
- */
-export function cursorLoginViolation(approved, signedIn, teamDomains) {
-    if (!signedIn)
-        return null;
-    const checked = signedIn.team_ids.length > 0 || cursorTenants(signedIn).some((t) => onTeamDomain(t, teamDomains));
-    return checked ? cursorTeamViolation(approved, signedIn) : null;
+    const signedInText = codexSignedInText(signedIn, tenants, approved?.codex);
+    return {
+        agent: 'codex',
+        signedIn: signedInText,
+        personal: signedInText.startsWith('a personal'),
+        approved: v.approved,
+        company: companyName(approved),
+        domains: [],
+        personalDomains: v.personalDomains,
+    };
 }
-/** The block message for Codex's login, else null; a personal plan is checked as Cursor's is. */
-export function codexLoginViolation(approved, signedIn, teamDomains) {
-    const tenants = signedIn ? codexTenants(signedIn) : null;
-    const checked = tenants?.some((t) => !t.startsWith('@') || onTeamDomain(t, teamDomains));
-    return checked ? codexTenantViolation(approved, signedIn) : null;
+export function codexTenantViolation(approved, signedIn) {
+    const block = codexTenantBlock(approved, signedIn);
+    return block ? tenantBlockText(block) : null;
 }
 /**
  * The org Claude Desktop is signed into now, for its Code tab's prompts, or null when unknown.
@@ -360,44 +459,36 @@ export function readClaudeDesktopSignedInTenant(home = homedir(), env = process.
         plan: same ? fromClaudeCode.plan : '',
     };
 }
-/**
- * The block message when a login's email is on a domain the organization unapproved, else null.
- *
- * Unapproving a domain covers every agent and every address on it, and its subdomains
- * (`mail.acme.com` falls under `acme.com`), the way an approved domain covers them.
- */
-export function unapprovedEmailDomainViolation(email, unapproved) {
+export function unapprovedEmailDomainBlock(email, unapproved) {
     const address = (email ?? '').trim().toLowerCase();
     const at = address.lastIndexOf('@');
     if (at < 0 || !unapproved?.length)
         return null;
     const domain = address.slice(at + 1);
     const hit = unapproved.find((d) => domain === d || domain.endsWith(`.${d}`));
-    if (!hit)
-        return null;
-    return (`This device doesn't allow accounts on ${hit}. You're signed in as ${address}. ` +
-        'Sign in with your work account.');
+    return hit ? { domain: hit, address } : null;
 }
-/**
- * The block message when a login's email is not on the organization's email allowlist, else null.
- *
- * The allowlist is the organization's approved email domains; a domain covers its subdomains
- * (`mail.acme.com` under `acme.com`). Null, so the login is allowed, when no allowlist has been
- * synced to this machine yet or the login has no email we can read.
- */
-export function emailAllowlistViolation(email, allowed) {
-    if (!Array.isArray(allowed))
-        return null;
-    const address = (email ?? '').trim().toLowerCase();
-    const at = address.lastIndexOf('@');
-    if (at < 0 || at === address.length - 1)
-        return null;
-    const domain = address.slice(at + 1);
-    if (allowed.some((d) => domain === d || domain.endsWith(`.${d}`)))
+export function unapprovedEmailDomainViolation(email, unapproved) {
+    const block = unapprovedEmailDomainBlock(email, unapproved);
+    if (!block)
         return null;
-    return (`This device only allows accounts on your organization's email domains. You're signed in as ${address}. ` +
+    return (`This device doesn't allow accounts on ${block.domain}. You're signed in as ${block.address}. ` +
         'Sign in with your work account.');
 }
+/** The window for a login on an unapproved email domain. `agent` is one the gate reads logins for. */
+export function emailDomainBlockWindow(agent, block, teamDomains = []) {
+    const name = TENANT_WORDS[agent]?.name ?? agent;
+    return loginWindow(`${name} is signed in with an email your organisation doesn't allow`, {
+        title: `Accounts on ${block.domain} aren't allowed.`,
+        body: `You're signed in as ${block.address}. Your organisation doesn't allow this email domain in any agent.`,
+    }, {
+        // With a team domain to name there is an approved path; without one, only advice.
+        label: teamDomains.length ? 'Approved path' : 'What to do',
+        title: 'Sign in with your work account',
+        subtitle: teamDomains.join(', '),
+        body: `Sign out of ${name}, then sign in with your work email.`,
+    });
+}
 /** The id an agent is approved under on the Agents page: Desktop's Code tab runs Claude Code. */
 const APPROVAL_ID = { claude_desktop: 'claude' };
 const AGENT_NAME = {

package/dist/compliance_prompt_gate.js

@@ -22,9 +22,12 @@ import { parseJsonWithJsoncFallback } from './log_config_files/readers/file_read
 import { PORTABLE_CURSOR_USER_SETTINGS, resolveRemediationConfigPath, resolveRemediationUploadFileType, } from './log_config_files/runtime/remediation_config_path.js';
 import { tryResolveHardwareUuid } from './log_config_files/runtime/hardware_uuid.js';
 import { cursorAutofixDefersInlineVerify, syncRemediations, } from './log_config_files/runtime/remediation_sync.js';
+import { blockedCommandMessage, blockedSkillOfCommand, claudeProcess, recordSessionProcess, stoppedSessionMessage, skillBlockWindow, stoppingSkills, } from './log_config_files/runtime/skill_block_sessions.js';
 import { loadEndpointBase } from './log_config_files/sender/endpoint_config.js';
+import { agentAccessDecision, approvalId } from './agent_access/decision.js';
+import { launchAgentAccessWindow } from './agent_access/window_runner.js';
 import { formatRemediationChangePreviewForApplied } from './remediation_change_preview.js';
-import { agentApprovalViolation, approvedTenantViolation, codexLoginViolation, emailAllowlistViolation, cursorLoginViolation, readClaudeDesktopSignedInTenant, readClaudeSignedInTenant, readCodexSignedIn, readCursorSignedInTeams, } from './approved_tenant_gate.js';
+import { agentApprovalViolation, approvedTenantBlock, codexTenantBlock, cursorTeamBlock, emailDomainBlockWindow, ORGANIZATION_LEAD, readClaudeDesktopSignedInTenant, readClaudeSignedInTenant, readCodexSignedIn, readCursorSignedInTeams, tenantBlockText, tenantBlockWindow, unapprovedEmailDomainBlock, unapprovedEmailDomainViolation, } from './approved_tenant_gate.js';
 const MANIFEST_STALE_MS = 7 * 24 * 60 * 60 * 1000;
 /** After verified (or failed verify), push enforcement + session log immediately — do not wait for background runner. */
 async function flushRemediationOutcomeToServer(complianceLogPath) {
@@ -89,19 +92,27 @@ function printAllowWithAdvisory(ide, advisoryMessage) {
 }
 /** Every block reads as an Optimus Labs notice: a title line, then the message. */
 const BLOCK_TITLE = 'Optimus Labs\n\n';
-function blockPayload(ide, violationMessage) {
-    const text = BLOCK_TITLE + violationMessage;
+/** The block as shown: titled, unless it already says it is the organization's rule. */
+function titled(violationMessage) {
+    return violationMessage.startsWith(ORGANIZATION_LEAD) ? violationMessage : BLOCK_TITLE + violationMessage;
+}
+/**
+ * `windowShown` tells Cursor's hook the blocked-agent window already says why, so it skips its own
+ * alert of the same message (`__optimus_window`); Cursor itself ignores the extra field.
+ */
+function blockPayload(ide, violationMessage, windowShown = false) {
+    const text = titled(violationMessage);
     if (ide === 'claude' || ide === 'copilot' || ide === 'opencode') {
         return JSON.stringify({ decision: 'block', reason: text, systemMessage: text });
     }
-    return JSON.stringify({ continue: false, user_message: text });
+    return JSON.stringify({ continue: false, user_message: text, ...(windowShown ? { __optimus_window: true } : {}) });
 }
 /**
  * Codex's block: `reason` only. Codex shows `reason` as the block and `systemMessage` as a separate
  * warning, so the Claude-shaped payload (which carries both) prints the same sentence twice.
  */
 function codexBlockPayload(violationMessage) {
-    return JSON.stringify({ decision: 'block', reason: BLOCK_TITLE + violationMessage });
+    return JSON.stringify({ decision: 'block', reason: titled(violationMessage) });
 }
 function getManifestStalenessMs() {
     try {
@@ -264,51 +275,65 @@ function loginEmail(agent) {
         return readCursorSignedInTeams()?.email ?? '';
     return null;
 }
-/** Why this agent's signed-in tenant is not approved, or null when it is (or cannot be read). */
-function tenantViolation(agent) {
+/** Why this agent's signed-in tenant is blocked, or null when it is not (or cannot be read). */
+function tenantBlock(agent) {
     const { approved_tenants: approved, team_email_domains: teamDomains } = readRemediationInstructionsFile();
     if (agent === 'claude')
-        return approvedTenantViolation('claude', approved, readClaudeSignedInTenant());
+        return approvedTenantBlock('claude', approved, readClaudeSignedInTenant());
     if (agent === 'claude_desktop') {
-        return approvedTenantViolation('claude_desktop', approved, readClaudeDesktopSignedInTenant());
+        return approvedTenantBlock('claude_desktop', approved, readClaudeDesktopSignedInTenant());
     }
-    // A personal account (Cursor on no team, Codex on a personal plan) is left to the email allowlist
-    // until its domain is a team domain; then it needs its personal tenant approved.
     if (agent === 'codex')
-        return codexLoginViolation(approved, readCodexSignedIn(), teamDomains);
+        return codexTenantBlock(approved, readCodexSignedIn());
     if (agent === 'cursor')
-        return cursorLoginViolation(approved, readCursorSignedInTeams(), teamDomains);
+        return cursorTeamBlock(approved, readCursorSignedInTeams(), teamDomains);
     return null;
 }
-/** The block for a login: which check refused it and why, or null when every check passes. */
-function loginBlock(agent, email) {
+/**
+ * The block for a login: which check refused it, why, and the blocked-agent window's words for a
+ * tenant or email-domain block (an agent's own block window comes synced); null when all pass.
+ */
+function loginBlock(agent, email, agentAllowed) {
     const synced = readRemediationInstructionsFile();
-    const agentMsg = agentApprovalViolation(agent, synced.approved_agents);
+    const agentMsg = agentAllowed ? null : agentApprovalViolation(agent, synced.approved_agents);
     if (agentMsg)
         return { event: 'prompt_gate_block_unapproved_agent', reason: agentMsg };
     if (email === null)
         return null;
-    const emailMsg = emailAllowlistViolation(email, synced.allowed_email_domains);
-    if (emailMsg)
-        return { event: 'prompt_gate_block_email_not_allowlisted', reason: emailMsg };
-    const tenantMsg = tenantViolation(agent);
-    return tenantMsg ? { event: 'prompt_gate_block_unapproved_tenant', reason: tenantMsg } : null;
+    const emailBlock = unapprovedEmailDomainBlock(email, synced.unapproved_email_domains);
+    if (emailBlock) {
+        return {
+            event: 'prompt_gate_block_unapproved_email_domain',
+            reason: unapprovedEmailDomainViolation(email, synced.unapproved_email_domains) ?? '',
+            window: emailDomainBlockWindow(agent, emailBlock, synced.team_email_domains),
+        };
+    }
+    const tenant = tenantBlock(agent);
+    if (!tenant)
+        return null;
+    return { event: 'prompt_gate_block_unapproved_tenant', reason: tenantBlockText(tenant), window: tenantBlockWindow(tenant) };
 }
 /**
- * Block the prompt unless the agent is approved, the login's email is on the organization's email
- * allowlist and its tenant is approved (all as remediation sync stored them), printing the block
- * payload; true when it did. A login whose email or tenant cannot be read passes that check, and a
+ * Block the prompt when the agent is not approved, or the login's email domain or its tenant was
+ * blocked (all as remediation sync stored them), printing the block payload; true when it did. A
+ * domain or tenant awaiting review gets through. A login whose email or tenant cannot be read passes that check, and a
  * machine that has synced nothing yet is not blocked.
  */
 function blockedByLogin(agent, ide) {
     if (tenantGateSwitchedOff())
         return false;
     const email = loginEmail(agent);
-    const block = loginBlock(agent, email);
+    const synced = readRemediationInstructionsFile();
+    const access = agentAccessDecision(agent, synced.approved_agents);
+    const block = loginBlock(agent, email, access.allowed);
     if (!block)
         return false;
     logRemediationApplyFailure(block.event, { reason: block.reason, ide, agent, email: email ?? '' });
-    console.log(agent === 'codex' ? codexBlockPayload(block.reason) : blockPayload(ide, block.reason));
+    // The blocked-agent window opens beside every block, in the background, so the hook answers at
+    // once: an agent's own from the synced approvals, a login's from the words built here. Where it
+    // could not start, Cursor's hook keeps its alert.
+    const windowShown = launchAgentAccessWindow(approvalId(agent), block.window);
+    console.log(agent === 'codex' ? codexBlockPayload(block.reason) : blockPayload(ide, block.reason, windowShown));
     return true;
 }
 /** Pull the organization's latest remediations and approved tenants, waiting at most 3 seconds. */
@@ -323,6 +348,42 @@ async function syncApprovals() {
         // Network or auth failure — fall back to local file state.
     }
 }
+/** Open the skill block window beside the block, in the background, when the sync sent its words. */
+function openSkillBlockWindow(skill) {
+    const words = skillBlockWindow(skill);
+    if (words)
+        launchAgentAccessWindow('claude', words);
+}
+/**
+ * Skill block killswitch, Claude Code only for now: refuse the prompt of a session that loaded a
+ * skill which is now blocked, or whose `claude` process did in an earlier session (a `/clear` keeps
+ * the skill), docs/skill-block/DESIGN.md. True when it refused.
+ */
+function blockedBySkillBlock(agent, ide, sessionId) {
+    if (ide !== 'claude')
+        return false;
+    const proc = claudeProcess();
+    try {
+        recordSessionProcess(sessionId, proc);
+    }
+    catch (err) {
+        hookRunLog(`skill_block_process_table_error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const skills = stoppingSkills(sessionId, proc);
+    if (skills.length > 0) {
+        logRemediationApplyFailure('skill_block_session_stopped', { ide, agent, skills: skills.join(',') });
+        openSkillBlockWindow(skills[0]);
+        console.log(blockPayload(ide, stoppedSessionMessage(skills)));
+        return true;
+    }
+    const typed = blockedSkillOfCommand(process.env.OPTIMUS_PROMPT_FIRST_LINE || '', () => proc?.startedAt ?? null);
+    if (!typed)
+        return false;
+    logRemediationApplyFailure('skill_block_command_refused', { ide, agent, skills: typed });
+    openSkillBlockWindow(typed);
+    console.log(blockPayload(ide, blockedCommandMessage(typed)));
+    return true;
+}
 /** Agents whose remediations are JSON files written to disk at once (no deferred SQLite apply). */
 function isImmediateJsonIde(ide) {
     return ide === 'claude' || ide === 'copilot' || ide === 'opencode';
@@ -535,6 +596,8 @@ export async function runCompliancePromptGate() {
     }
     await reportPostRestartVerification(agent, complianceLogPath);
     await syncApprovals();
+    if (blockedBySkillBlock(agent, ide, (process.env.OPTIMUS_SESSION_ID || '').trim()))
+        return;
     const status = runLocalRemediationComplianceCheck(agent);
     uploadSecondarySatisfied(status);
     // Approved tenants (OPT-687): checked against the list the sync above stored locally.

package/dist/log_config_files/collection/skill_symlink.js

@@ -1,6 +1,7 @@
 import { accessSync, constants, lstatSync, readlinkSync, realpathSync } from 'node:fs';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { readMarkdownFile } from '../readers/file_readers.js';
+import { quarantineReceiptFor } from '../runtime/skill_block.js';
 function isMissingPathError(err) {
     const code = err?.code;
     return code === 'ENOENT' || code === 'ENOTDIR';
@@ -173,6 +174,14 @@ export function collectSkillMdRecord(skillDir, fileType, source, skillFilename =
         ...extraRaw,
     };
     const symlink_info = skillLinkPayload(info);
+    const quarantine = quarantineReceiptFor(skillDir);
+    if (quarantine) {
+        // Quarantined for a skill block: moved into the vault, unchanged since (docs/skill-block). The
+        // receipt says when, and which files with which hashes; never their contents.
+        raw.locked_by_optimus = true;
+        raw.quarantine = { quarantined_at: quarantine.quarantined_at, files: quarantine.files };
+        return { file_type: fileType, file_path: mdPath, raw_content: raw, symlink_info };
+    }
     if (info.status === 'valid') {
         const content = readMarkdownFile(mdPath);
         if (content !== null) {