@optimuslabs/harness-map-staging 1.5.35 → 1.5.38

package/dist/log_config_files/runtime/skill_block_sessions.js

@@ -6,12 +6,15 @@
  * The backend knows which sessions loaded a skill: the tool calls the skill usage view attributes to
  * it. The remediation sync sends this machine's sessions that loaded a blocked skill
  * (`skill_block_sessions` in remediation_instructions.json), and the prompt gate refuses their
- * prompts. Only those sessions are stopped; an unblock takes them off the list.
+ * prompts. `/clear` gives a new session id but the `claude` process keeps the skill, so the gate also
+ * records which session ids each process has run (skill_block_processes.json) and stops every session
+ * of a process that ran a listed one. An unblock takes the sessions off the list.
  */
 import { execFileSync } from 'node:child_process';
-import { basename, resolve } from 'node:path';
-import { readRemediationInstructionsFile } from './management_storage.js';
-import { readSkillBlockState } from './skill_block.js';
+import { existsSync, readFileSync } from 'node:fs';
+import { basename } from 'node:path';
+import { atomicWriteJson, getSkillBlockProcessesPath, readRemediationInstructionsFile, } from './management_storage.js';
+import { quarantinedAt } from './skill_block.js';
 /** A process's parent, start time and command name, from `ps`; null when it cannot be read. */
 function processRow(pid) {
     try {
@@ -25,41 +28,84 @@ function processRow(pid) {
     }
 }
 /**
- * When the `claude` process running this hook started (ms), or null when it cannot be found. It
- * lists its skills when it starts and keeps them across `/clear`, so this is what tells a real
- * restart from `/clear`, which only changes the session id.
+ * The `claude` process running this hook, or null when it cannot be found. It lists its skills when
+ * it starts and keeps them across `/clear`, which only changes the session id, so the process (not
+ * the session) is what holds a loaded skill.
  */
-export function claudeProcessStartedAt() {
+export function claudeProcess() {
     let pid = process.ppid;
     for (let depth = 0; depth < 12 && pid > 1; depth += 1) {
         const row = processRow(pid);
         if (!row)
             return null;
         if (row.name === 'claude')
-            return row.startedAt;
+            return Number.isNaN(row.startedAt) ? null : { pid, startedAt: row.startedAt };
         pid = row.parent;
     }
     return null;
 }
-/** The names of the blocked skills this session loaded; empty when it may go on. */
-export function stoppingSkills(sessionId) {
+/** When the `claude` process running this hook started (ms), or null when it cannot be found. */
+export function claudeProcessStartedAt() {
+    return claudeProcess()?.startedAt ?? null;
+}
+/** The table's key: a pid with its start time, since the system reuses pids. */
+function processKey(proc) {
+    return `${proc.pid}:${proc.startedAt}`;
+}
+function readProcessTable() {
+    const path = getSkillBlockProcessesPath();
+    if (!existsSync(path))
+        return {};
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Record that `proc` runs `sessionId`, and drop processes not seen for 30 days (the server's window).
+ * Two prompts at once can each write the table and lose one session; the next prompt records it again.
+ */
+export function recordSessionProcess(sessionId, proc, now = Date.now()) {
+    if (!sessionId || !proc)
+        return;
+    const table = readProcessTable();
+    const cutoff = now - 30 * 24 * 60 * 60 * 1000;
+    for (const [key, entry] of Object.entries(table)) {
+        if (!(Date.parse(entry?.last_seen ?? '') >= cutoff))
+            delete table[key];
+    }
+    const key = processKey(proc);
+    const sessions = new Set(table[key]?.sessions ?? []);
+    sessions.add(sessionId);
+    table[key] = { sessions: [...sessions], last_seen: new Date(now).toISOString() };
+    atomicWriteJson(getSkillBlockProcessesPath(), table);
+}
+/**
+ * The names of the blocked skills this session loaded, or its process loaded in an earlier session
+ * (before a `/clear`); empty when it may go on. Without the process, only the session id counts.
+ */
+export function stoppingSkills(sessionId, proc = null) {
     if (!sessionId)
         return [];
+    const own = new Set([sessionId, ...(proc ? (readProcessTable()[processKey(proc)]?.sessions ?? []) : [])]);
     const sessions = readRemediationInstructionsFile().skill_block_sessions ?? [];
-    return sessions.filter((s) => s.session_id === sessionId).map((s) => s.skill_name || 'a skill');
+    return sessions.filter((s) => own.has(s.session_id)).map((s) => s.skill_name || 'a skill');
 }
 /** The notice for a stopped session. */
 export function stoppedSessionMessage(skills) {
     const names = [...new Set(skills)].join(', ');
-    return (`Your organization blocked ${names}, which this session loaded. Copy anything you need from ` +
-        'this conversation, then quit Claude Code and start it again to continue. Resuming this ' +
-        'session keeps it stopped.');
+    return (`Your organization blocked ${names}, which this Claude Code loaded (a /clear keeps it). Copy ` +
+        'anything you need from this conversation, then quit Claude Code and start it again to ' +
+        'continue. Resuming this session keeps it stopped.');
 }
 /**
  * The blocked skill a typed slash command runs, when this process may still have it, or null:
- * `/airtable:airtable-cli …` or `/airtable-cli …`. A process started before the folder was locked
- * listed the skill and keeps it, even after `/clear`, so this refuses it. A process started after
- * the lock never listed it: this answers null, and Claude Code says the skill does not exist.
+ * `/airtable:airtable-cli …` or `/airtable-cli …`. A process started before the folder was
+ * quarantined listed the skill and keeps it, even after `/clear`, so this refuses it. A process
+ * started after it never listed it: this answers null, and Claude Code says the skill does not exist.
  * Matches the skill's name or its folder's name, which can differ (`aikido-issues` lives in
  * `skills/issues`). An unknown start time counts as too old, so a block is never skipped.
  */
@@ -73,9 +119,8 @@ export function blockedSkillOfCommand(promptFirstLine, processStartedAt = claude
     if (hits.length === 0)
         return null;
     const startedAt = processStartedAt();
-    const locks = readSkillBlockState();
     const mayStillHaveIt = hits.some((b) => {
-        const lockedAt = Date.parse(locks[resolve(b.skill_dir)]?.locked_at ?? '');
+        const lockedAt = Date.parse(quarantinedAt(b.skill_dir) ?? '');
         return startedAt === null || Number.isNaN(lockedAt) || startedAt <= lockedAt;
     });
     return mayStillHaveIt ? hits[0].skill_name || typed : null;
@@ -84,3 +129,14 @@ export function blockedSkillOfCommand(promptFirstLine, processStartedAt = claude
 export function blockedCommandMessage(skill) {
     return `Your organization blocked ${skill}. Quit Claude Code and start it again to continue.`;
 }
+/**
+ * The window to open beside the block of the skill named `skill` (a name `stoppingSkills` or
+ * `blockedSkillOfCommand` gave), as the sync sent it for that skill's resource; undefined when the
+ * server sent none, so only the one-line block shows.
+ */
+export function skillBlockWindow(skill) {
+    const file = readRemediationInstructionsFile();
+    const name = skill.toLowerCase();
+    const entry = [...(file.skill_block_sessions ?? []), ...(file.skill_blocks ?? [])].find((e) => e.resource_uuid && e.skill_name.toLowerCase() === name);
+    return entry ? file.skill_block_windows?.[entry.resource_uuid] : undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.35",
+  "version": "1.5.38",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {
@@ -15,7 +15,7 @@
     "dialog_prefs-staging": "dist/cli.js"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json && node ../../../scripts/ensure-bin-executable.mjs",
+    "build": "tsc -p tsconfig.json && node ../../../scripts/ensure-bin-executable.mjs && node -e \"const fs=require('fs');fs.mkdirSync('dist/agent_block_window',{recursive:true});fs.copyFileSync('src/agent_block_window/agent_block_window.jxa','dist/agent_block_window/agent_block_window.jxa')\"",
     "dev": "ts-node src/cli.ts",
     "lint": "eslint \"src/**/*.ts\"",
     "prepare": "npm run build",