@optimuslabs/harness-map-staging 1.5.35 → 1.5.38

package/dist/log_config_files/runtime/management_storage.js

@@ -77,6 +77,18 @@ export function getRemediationStateDir() {
 export function getRemediationInstructionsPath() {
     return join(getRemediationStateDir(), REMEDIATION_INSTRUCTIONS_BASENAME);
 }
+/** The mode each locked skill folder had before it was locked, so unblocking can restore it. */
+export function getSkillBlockStatePath() {
+    return join(getRemediationStateDir(), 'skill_block_state.json');
+}
+/** The vault of quarantined skill folders and their receipts (docs/skill-block, "Quarantine"). */
+export function getQuarantineDir() {
+    return join(getManagementDir(), 'quarantine');
+}
+/** The session ids each `claude` process has run, so a `/clear` cannot escape a skill block stop. */
+export function getSkillBlockProcessesPath() {
+    return join(getRemediationStateDir(), 'skill_block_processes.json');
+}
 export function getDeferredVscdbApplyPath() {
     return join(getVscdbStateDir(), DEFERRED_VSCDB_APPLY_BASENAME);
 }
@@ -139,12 +151,18 @@ function writeInstructionsFile(file, remediationsWrittenAt) {
         remediations_written_at: remediationsWrittenAt,
     });
 }
+// The lists the sync replaces on every answer (the skill blocks with them); a writer that passes
+// only `remediations` keeps them.
 const APPROVAL_LISTS = [
     'approved_tenants',
     'unapproved_email_domains',
     'allowed_email_domains',
     'approved_agents',
     'team_email_domains',
+    'skill_blocks',
+    'skill_block_sessions',
+    'skill_block_windows',
+    'agent_access_windows',
 ];
 /** Each approval list from `file` when it names one, else the one on disk; absent ones left out. */
 function keptApprovalLists(file, onDisk) {
@@ -172,6 +190,10 @@ function writeApprovalList(patch) {
 export function writeUnapprovedEmailDomains(unapproved_email_domains) {
     writeApprovalList({ unapproved_email_domains });
 }
+/** Replace only the blocked-agent windows, keeping everything else on disk. */
+export function writeAgentAccessWindows(agent_access_windows) {
+    writeApprovalList({ agent_access_windows });
+}
 /** Replace only the approved agents, keeping everything else on disk. */
 export function writeApprovedAgents(approved_agents) {
     writeApprovalList({ approved_agents });
@@ -184,6 +206,18 @@ export function writeTeamEmailDomains(team_email_domains) {
 export function writeAllowedEmailDomains(allowed_email_domains) {
     writeApprovalList({ allowed_email_domains });
 }
+/** Replace only the skill blocks, keeping everything else on disk. */
+export function writeSkillBlocks(skill_blocks) {
+    writeApprovalList({ skill_blocks });
+}
+/** Replace only the sessions to stop for skill blocks, keeping everything else on disk. */
+export function writeSkillBlockSessions(skill_block_sessions) {
+    writeApprovalList({ skill_block_sessions });
+}
+/** Replace only the skill block windows, keeping everything else on disk. */
+export function writeSkillBlockWindows(skill_block_windows) {
+    writeApprovalList({ skill_block_windows });
+}
 /** Replace only the approved-tenant list, keeping the remediations already on disk. */
 export function writeApprovedTenants(approved_tenants) {
     writeApprovalList({ approved_tenants });

package/dist/log_config_files/runtime/remediation_sync.js

@@ -4,7 +4,8 @@ import { homedir } from 'node:os';
 import { executeBody } from '../../endpoint_client/http_transport.js';
 import { parseJsonWithJsoncFallback, parseTomlText, stringifyToml } from '../readers/file_readers.js';
 import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
-import { atomicWriteJson, getDeferredVscdbApplyPath, getFileCollectionVscdbContractPath, getRemediationInstructionsPath, readRemediationInstructionsFile, writeApprovedTenants, writeUnapprovedEmailDomains, writeAllowedEmailDomains, writeTeamEmailDomains, writeApprovedAgents, writeRemediationInstructionsFile, } from './management_storage.js';
+import { atomicWriteJson, getDeferredVscdbApplyPath, getFileCollectionVscdbContractPath, getRemediationInstructionsPath, readRemediationInstructionsFile, writeApprovedTenants, writeUnapprovedEmailDomains, writeAllowedEmailDomains, writeTeamEmailDomains, writeApprovedAgents, writeAgentAccessWindows, writeRemediationInstructionsFile, writeSkillBlockSessions, writeSkillBlockWindows, writeSkillBlocks, } from './management_storage.js';
+import { applySkillBlocks } from './skill_block.js';
 import { readStoredAuthKey } from '../auth/auth_key_store.js';
 import { ensureAuthentication } from '../auth/auth_flow.js';
 import { createSignature } from '../sender/signing.js';
@@ -1656,6 +1657,67 @@ function storeApprovals(syncResult) {
     const teamDomains = syncResult.team_email_domains;
     if (Array.isArray(teamDomains))
         writeTeamEmailDomains(lowercaseStrings(teamDomains));
+    storeAgentAccess(syncResult);
+}
+/** The blocked-agent window's words for each agent that is not approved. */
+function storeAgentAccess(syncResult) {
+    const windows = syncResult.agent_access_windows;
+    if (windows && typeof windows === 'object' && !Array.isArray(windows))
+        writeAgentAccessWindows(windows);
+}
+function isSkillBlockEntry(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const entry = value;
+    return typeof entry.skill_dir === 'string' && entry.skill_dir !== '' && typeof entry.resource_uuid === 'string';
+}
+/** Keep the server's sessions to stop (for the prompt gate); an older server sends none. */
+function storeSkillBlockSessions(sessions) {
+    if (!Array.isArray(sessions))
+        return;
+    writeSkillBlockSessions(sessions
+        .filter((s) => typeof s?.session_id === 'string' && s.session_id !== '')
+        .map((s) => ({
+        session_id: s.session_id,
+        resource_uuid: typeof s.resource_uuid === 'string' ? s.resource_uuid : '',
+        skill_name: typeof s.skill_name === 'string' ? s.skill_name : '',
+    })));
+}
+/** Keep the server's skill block windows (words only, drawn as sent); an older server sends none. */
+function storeSkillBlockWindows(windows) {
+    if (!windows || typeof windows !== 'object' || Array.isArray(windows))
+        return;
+    const kept = {};
+    for (const [uuid, words] of Object.entries(windows)) {
+        if (words && typeof words === 'object' && !Array.isArray(words))
+            kept[uuid] = words;
+    }
+    writeSkillBlockWindows(kept);
+}
+/**
+ * Store the server's skill blocks and make the folders on disk match them. An older server sends
+ * no `skill_blocks`: the folders are then left as they are, never unlocked by mistake.
+ */
+function enforceSkillBlocks(syncResult) {
+    const blocks = syncResult.skill_blocks;
+    if (!Array.isArray(blocks))
+        return;
+    const entries = blocks.filter(isSkillBlockEntry).map((entry) => ({
+        resource_uuid: entry.resource_uuid,
+        skill_name: typeof entry.skill_name === 'string' ? entry.skill_name : '',
+        skill_dir: entry.skill_dir,
+    }));
+    writeSkillBlocks(entries);
+    storeSkillBlockSessions(syncResult.skill_block_sessions);
+    storeSkillBlockWindows(syncResult.skill_block_windows);
+    try {
+        applySkillBlocks(entries);
+    }
+    catch (err) {
+        const msg = `skill_block_error: ${errorText(err)}`;
+        hookRunLog(msg);
+        complianceRunnerDiag(msg);
+    }
 }
 async function reconcileInstructions(endpointBase, machineUuid, want) {
     try {
@@ -1792,6 +1854,7 @@ export async function syncRemediations(endpointBase, machineUuid) {
         return;
     applyClearApplyTrackingUuids(syncResult.clear_apply_tracking_uuids);
     storeApprovals(syncResult);
+    enforceSkillBlocks(syncResult);
     if (syncResult.status === 'unchanged') {
         await reconcileUnchanged(endpointBase, machineUuid, remediations, activeUuids);
         return;

package/dist/log_config_files/runtime/skill_block.js

@@ -1,56 +1,131 @@
 /**
- * Skill block (docs/skill-block/DESIGN.md): lock the skill folders the organization blocked so no
- * agent can load or run them, and give a folder its permissions back once the skill is unblocked.
+ * Skill quarantine (docs/skill-block/DESIGN.md, "Quarantine"): move the skill folders the
+ * organization blocked into a vault, as an antivirus quarantines a file, and move them back once the
+ * skill is approved again.
  *
  * The remediation sync stores the server's list under `skill_blocks` in
- * remediation_instructions.json and then calls `applySkillBlocks`. A folder is locked with
- * `chmod 000` after its mode is recorded in skill_block_state.json; a recorded folder that is no
- * longer listed gets that mode back. The folders are where the collection found each skill's
- * SKILL.md, for any agent. A folder is locked only when it is a real directory inside the home
- * folder (never the home folder itself) holding a SKILL.md, so a bad path cannot lock anything
- * that is not a skill.
+ * remediation_instructions.json and then calls `applySkillBlocks`. A listed folder is moved into
+ * `~/.optimuslabs/management/quarantine/<id>/` with a receipt `<id>.json` (where it came from, when,
+ * and each file's hash, never its content); the vault entry is `chmod 000`, and an empty `chmod 000`
+ * folder is left at the original path so that no app (Claude Code re-syncing account skills, a
+ * plugin update) can put the skill back. A receipt whose folder is no longer listed is restored.
+ * A folder is only ever moved when it is a real directory inside the home folder (never the home
+ * folder itself) holding a SKILL.md, so a bad path cannot move anything that is not a skill.
  */
-import { chmodSync, existsSync, lstatSync, readFileSync, realpathSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { homedir } from 'node:os';
-import { join, resolve, sep } from 'node:path';
+import { dirname, join, resolve, sep } from 'node:path';
 import { complianceRunnerDiag, hookRunLog } from './hook_logger.js';
-import { atomicWriteJson, getSkillBlockStatePath } from './management_storage.js';
+import { atomicWriteJson, getQuarantineDir, getSkillBlockStatePath, } from './management_storage.js';
 function log(message) {
     hookRunLog(message);
     complianceRunnerDiag(message);
 }
-export function readSkillBlockState() {
-    const path = getSkillBlockStatePath();
-    if (!existsSync(path))
-        return {};
+function permissionBits(path) {
+    return lstatSync(path).mode & 0o7777;
+}
+/** The vault id of an original path: one path, one entry. */
+function entryId(dir) {
+    return createHash('sha256').update(resolve(dir)).digest('hex').slice(0, 16);
+}
+function vaultPath(id) {
+    return join(getQuarantineDir(), id);
+}
+function receiptPath(id) {
+    return join(getQuarantineDir(), `${id}.json`);
+}
+function readReceipt(id) {
     try {
-        const parsed = JSON.parse(readFileSync(path, 'utf8'));
-        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+        const parsed = JSON.parse(readFileSync(receiptPath(id), 'utf8'));
+        return parsed && typeof parsed.original_path === 'string' ? parsed : null;
     }
     catch {
-        return {};
+        return null;
     }
 }
-function permissionBits(path) {
-    return lstatSync(path).mode & 0o7777;
+function writeReceipt(id, receipt) {
+    atomicWriteJson(receiptPath(id), receipt);
 }
-/**
- * Whether `dir` is a skill folder this endpoint locked for a block and that is still locked. Its
- * files cannot be read, and nothing can have changed in it since it was locked, so the collection
- * reports it as locked and the backend keeps the copy it has.
- */
-export function isLockedByOptimus(dir) {
-    const target = resolve(dir);
-    if (!readSkillBlockState()[target])
+/** Every receipt in the vault, by id. */
+function readReceipts() {
+    let names;
+    try {
+        names = readdirSync(getQuarantineDir());
+    }
+    catch {
+        return [];
+    }
+    const receipts = [];
+    for (const name of names) {
+        const match = name.match(/^([0-9a-f]{16})\.json$/);
+        const receipt = match ? readReceipt(match[1]) : null;
+        if (match && receipt)
+            receipts.push([match[1], receipt]);
+    }
+    return receipts;
+}
+function exists(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch {
         return false;
+    }
+}
+/** The empty `chmod 000` folder quarantine leaves at an original path. */
+function isStub(dir) {
     try {
-        return permissionBits(target) === 0;
+        const stat = lstatSync(dir);
+        return stat.isDirectory() && !stat.isSymbolicLink() && (stat.mode & 0o7777) === 0;
     }
     catch {
         return false;
     }
 }
-/** Why `dir` must not be locked, or null when it is a real skill folder inside the home folder. */
+function makeStub(dir) {
+    mkdirSync(dir);
+    chmodSync(dir, 0o000);
+}
+/** Every file of `dir` with its hash, and every symlink with its target, sorted by path. */
+function hashFolder(dir, prefix = '') {
+    const files = [];
+    for (const name of readdirSync(dir).sort()) {
+        const full = join(dir, name);
+        const rel = prefix ? `${prefix}/${name}` : name;
+        const stat = lstatSync(full);
+        if (stat.isSymbolicLink())
+            files.push({ path: rel, link: readlinkSync(full) });
+        else if (stat.isDirectory())
+            files.push(...hashFolder(full, rel));
+        else if (stat.isFile()) {
+            const sha256 = createHash('sha256').update(readFileSync(full)).digest('hex');
+            files.push({ path: rel, sha256, size: stat.size });
+        }
+    }
+    return files;
+}
+function sameFiles(a, b) {
+    return JSON.stringify(a) === JSON.stringify(b);
+}
+/** When the folder at `dir` was quarantined, or null when it is not. */
+export function quarantinedAt(dir) {
+    const receipt = readReceipt(entryId(dir));
+    return receipt && receipt.status !== 'moving' ? receipt.quarantined_at : null;
+}
+/**
+ * The receipt of the skill folder quarantined from `dir`, when the empty folder quarantine left
+ * is still there. The collection reports such a path as quarantined: its skill cannot have changed
+ * since it was moved, and the server keeps the copy it has.
+ */
+export function quarantineReceiptFor(dir) {
+    if (!isStub(resolve(dir)))
+        return null;
+    const receipt = readReceipt(entryId(dir));
+    return receipt && receipt.status !== 'moving' ? receipt : null;
+}
+/** Why `dir` must not be moved, or null when it is a real skill folder inside the home folder. */
 export function refusalReason(dir, home = homedir()) {
     const root = resolve(home);
     const target = resolve(dir);
@@ -69,24 +144,79 @@ export function refusalReason(dir, home = homedir()) {
         return 'no SKILL.md';
     return null;
 }
-/** Lock a recorded folder again if it was opened; its path may have been replaced, so check it. */
-function relockIfOpened(dir, entry, outcome, home) {
-    if (!existsSync(dir) || permissionBits(dir) === 0)
+/** Move a listed folder into the vault, with its receipt, and leave the empty folder behind. */
+function moveIn(dir, id, entry, outcome) {
+    const receipt = {
+        original_path: dir,
+        resource_uuid: entry.resource_uuid,
+        skill_name: entry.skill_name,
+        quarantined_at: new Date().toISOString(),
+        mode: permissionBits(dir),
+        status: 'moving',
+        files: hashFolder(dir),
+    };
+    writeReceipt(id, receipt);
+    renameSync(dir, vaultPath(id));
+    finishMove(dir, id, receipt);
+    outcome.quarantined.push(dir);
+}
+/** The steps after the move, also run to finish one a crash interrupted. */
+function finishMove(dir, id, receipt) {
+    if (!exists(dir))
+        makeStub(dir);
+    chmodSync(vaultPath(id), 0o000);
+    writeReceipt(id, { ...receipt, status: 'done' });
+}
+/**
+ * A listed folder already in the vault: keep its original path closed. The empty folder may have
+ * been removed, opened, or replaced by the skill itself (an app re-created it); a copy identical
+ * to the vault's is discarded, a different one is kept in the vault beside it.
+ */
+function keepQuarantined(dir, id, receipt, home, outcome) {
+    if (isStub(dir))
+        return;
+    if (!exists(dir)) {
+        makeStub(dir);
+        outcome.requarantined.push(dir);
         return;
+    }
+    const stat = lstatSync(dir);
+    if (stat.isDirectory() && !stat.isSymbolicLink() && readdirSync(dir).length === 0) {
+        chmodSync(dir, 0o000);
+        outcome.requarantined.push(dir);
+        return;
+    }
     const reason = refusalReason(dir, home);
     if (reason) {
-        outcome.refused.push({ skill_dir: entry.skill_dir, reason });
+        outcome.refused.push({ skill_dir: dir, reason });
         return;
     }
-    chmodSync(dir, 0o000);
-    outcome.relocked.push(dir);
+    if (sameFiles(hashFolder(dir), receipt.files)) {
+        rmSync(dir, { recursive: true, force: true });
+    }
+    else {
+        const kept = `${vaultPath(id)}.${Date.now()}`;
+        renameSync(dir, kept);
+        chmodSync(kept, 0o000);
+        log(`skill_block: a different copy came back at ${dir}; kept in the vault as ${kept}`);
+    }
+    makeStub(dir);
+    outcome.requarantined.push(dir);
 }
-/** Lock a listed folder, or lock it again when its permissions were opened since. */
-function lockFolder(entry, state, outcome, home) {
+/** Quarantine one listed folder, or keep it quarantined. */
+function quarantine(entry, home, outcome) {
     const dir = resolve(entry.skill_dir);
-    const known = state[dir];
-    if (known) {
-        relockIfOpened(dir, entry, outcome, home);
+    const id = entryId(dir);
+    let receipt = readReceipt(id);
+    if (receipt?.status === 'moving') {
+        if (existsSync(vaultPath(id)))
+            finishMove(dir, id, receipt);
+        else
+            unlinkSync(receiptPath(id));
+        receipt = readReceipt(id);
+    }
+    if (receipt) {
+        keepQuarantined(dir, id, receipt, home, outcome);
         return;
     }
     const reason = refusalReason(dir, home);
@@ -94,28 +224,79 @@ function lockFolder(entry, state, outcome, home) {
         outcome.refused.push({ skill_dir: entry.skill_dir, reason });
         return;
     }
-    state[dir] = { mode: permissionBits(dir), resource_uuid: entry.resource_uuid, locked_at: new Date().toISOString() };
-    atomicWriteJson(getSkillBlockStatePath(), state);
-    chmodSync(dir, 0o000);
-    outcome.locked.push(dir);
+    moveIn(dir, id, entry, outcome);
+}
+/**
+ * Clear the original path for a restore: our empty folder (or an emptied one) is removed. Anything
+ * else there now is someone's copy: it is left alone and the vault entry is kept (a conflict).
+ */
+function clearOriginalPath(dir) {
+    if (!exists(dir))
+        return true;
+    const stat = lstatSync(dir);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        return false;
+    chmodSync(dir, 0o700);
+    if (readdirSync(dir).length > 0) {
+        chmodSync(dir, stat.mode & 0o7777);
+        return false;
+    }
+    rmdirSync(dir);
+    return true;
+}
+/** Move a folder no longer listed back where it came from, with its mode. */
+function restore(id, receipt, outcome) {
+    const dir = receipt.original_path;
+    const vault = vaultPath(id);
+    if (!existsSync(vault)) {
+        unlinkSync(receiptPath(id));
+        log(`skill_block: the vault entry of ${dir} is missing; its receipt is dropped`);
+        return;
+    }
+    if (!clearOriginalPath(dir)) {
+        if (receipt.status !== 'conflict')
+            writeReceipt(id, { ...receipt, status: 'conflict' });
+        outcome.conflicts.push(dir);
+        return;
+    }
+    chmodSync(vault, receipt.mode);
+    if (!sameFiles(hashFolder(vault), receipt.files))
+        log(`skill_block: ${dir} changed in the vault; restored as it is`);
+    mkdirSync(dirname(dir), { recursive: true });
+    renameSync(vault, dir);
+    unlinkSync(receiptPath(id));
+    outcome.restored.push(dir);
 }
-/** Give a folder no longer listed the mode it had before it was locked. */
-function restoreFolder(dir, state, outcome) {
-    const { mode } = state[dir];
-    if (existsSync(dir) && !lstatSync(dir).isSymbolicLink()) {
-        chmodSync(dir, mode);
-        outcome.restored.push(dir);
+/**
+ * The previous version locked folders in place (`chmod 000`, modes in skill_block_state.json).
+ * Give them their modes back once; the listed ones are then quarantined like any other.
+ */
+function releaseInPlaceLocks() {
+    const path = getSkillBlockStatePath();
+    if (!existsSync(path))
+        return;
+    try {
+        const state = JSON.parse(readFileSync(path, 'utf8'));
+        for (const [dir, entry] of Object.entries(state)) {
+            if (typeof entry?.mode === 'number' && existsSync(dir) && !lstatSync(dir).isSymbolicLink()) {
+                chmodSync(dir, entry.mode);
+            }
+        }
+    }
+    catch (err) {
+        log(`skill_block: could not read the in-place locks: ${err instanceof Error ? err.message : String(err)}`);
     }
-    delete state[dir];
+    unlinkSync(path);
 }
 /**
- * Make the folders on disk match `entries`, the server's whole list for this machine: lock the
- * listed ones, restore the ones locked before and no longer listed. A folder that fails the checks
- * is skipped and logged; one failing chmod does not stop the others.
+ * Make the vault match `entries`, the server's whole list for this machine: quarantine the listed
+ * folders, keep them quarantined, and restore the ones no longer listed. A folder that fails the
+ * checks is skipped and logged; one failure does not stop the others.
  */
 export function applySkillBlocks(entries, home = homedir()) {
-    const outcome = { locked: [], relocked: [], restored: [], refused: [] };
-    const lockPath = `${getSkillBlockStatePath()}.lock`;
+    const outcome = { quarantined: [], requarantined: [], restored: [], conflicts: [], refused: [] };
+    mkdirSync(getQuarantineDir(), { recursive: true, mode: 0o700 });
+    const lockPath = `${getQuarantineDir()}.lock`;
     if (!takeStateLock(lockPath)) {
         log('skill_block: another sync is applying blocks; the next sync applies these');
         return outcome;
@@ -129,9 +310,8 @@ export function applySkillBlocks(entries, home = homedir()) {
     return outcome;
 }
 /**
- * Take the lock around reading the state, changing permissions and writing the state. Two syncs at
- * once (the prompt gate and the compliance runner) could otherwise lose a folder's original mode,
- * leaving it locked after an unblock. A lock left by a dead process goes after a minute.
+ * Take the lock around the vault: two syncs at once (the prompt gate and the compliance runner)
+ * could otherwise move the same folder twice. A lock left by a dead process goes after a minute.
  */
 function takeStateLock(lockPath) {
     try {
@@ -153,36 +333,37 @@ function releaseStateLock(lockPath) {
     }
 }
 function applyUnderLock(entries, home, outcome) {
-    const state = readSkillBlockState();
-    const wanted = new Set(entries.map((entry) => resolve(entry.skill_dir)));
+    releaseInPlaceLocks();
+    const wanted = new Set(entries.map((entry) => entryId(entry.skill_dir)));
     for (const entry of entries) {
         try {
-            lockFolder(entry, state, outcome, home);
+            quarantine(entry, home, outcome);
         }
         catch (err) {
             outcome.refused.push({ skill_dir: entry.skill_dir, reason: err instanceof Error ? err.message : String(err) });
         }
     }
-    for (const dir of Object.keys(state)) {
-        if (wanted.has(dir))
+    for (const [id, receipt] of readReceipts()) {
+        if (wanted.has(id))
             continue;
         try {
-            restoreFolder(dir, state, outcome);
+            restore(id, receipt, outcome);
         }
         catch (err) {
-            outcome.refused.push({ skill_dir: dir, reason: err instanceof Error ? err.message : String(err) });
+            outcome.refused.push({ skill_dir: receipt.original_path, reason: err instanceof Error ? err.message : String(err) });
         }
     }
-    atomicWriteJson(getSkillBlockStatePath(), state);
     logOutcome(outcome);
 }
 function logOutcome(outcome) {
-    for (const dir of outcome.locked)
-        log(`skill_block: locked ${dir}`);
-    for (const dir of outcome.relocked)
-        log(`skill_block: locked again (permissions were opened) ${dir}`);
+    for (const dir of outcome.quarantined)
+        log(`skill_block: quarantined ${dir}`);
+    for (const dir of outcome.requarantined)
+        log(`skill_block: closed again ${dir}`);
     for (const dir of outcome.restored)
         log(`skill_block: restored ${dir}`);
+    for (const dir of outcome.conflicts)
+        log(`skill_block: not restored, something else is at ${dir}`);
     for (const { skill_dir, reason } of outcome.refused)
         log(`skill_block: skipped ${skill_dir} (${reason})`);
 }