@optimuslabs/harness-map-staging 1.5.36 → 1.5.39

package/dist/compliance_prompt_gate.js

@@ -22,9 +22,12 @@ import { parseJsonWithJsoncFallback } from './log_config_files/readers/file_read
 import { PORTABLE_CURSOR_USER_SETTINGS, resolveRemediationConfigPath, resolveRemediationUploadFileType, } from './log_config_files/runtime/remediation_config_path.js';
 import { tryResolveHardwareUuid } from './log_config_files/runtime/hardware_uuid.js';
 import { cursorAutofixDefersInlineVerify, syncRemediations, } from './log_config_files/runtime/remediation_sync.js';
+import { blockedCommandMessage, blockedSkillOfCommand, claudeProcess, recordSessionProcess, stoppedSessionMessage, openSkillBlockWindow, stoppingSkills, } from './log_config_files/runtime/skill_block_sessions.js';
 import { loadEndpointBase } from './log_config_files/sender/endpoint_config.js';
+import { agentAccessDecision, approvalId } from './agent_access/decision.js';
+import { launchAgentAccessWindow } from './agent_access/window_runner.js';
 import { formatRemediationChangePreviewForApplied } from './remediation_change_preview.js';
-import { agentApprovalViolation, approvedTenantViolation, codexTenantViolation, cursorTeamViolation, ORGANIZATION_LEAD, readClaudeDesktopSignedInTenant, readClaudeSignedInTenant, readCodexSignedIn, readCursorSignedInTeams, unapprovedEmailDomainViolation, } from './approved_tenant_gate.js';
+import { agentApprovalViolation, approvedTenantBlock, codexTenantBlock, cursorTeamBlock, emailDomainBlockWindow, ORGANIZATION_LEAD, readClaudeDesktopSignedInTenant, readClaudeSignedInTenant, readCodexSignedIn, readCursorSignedInTeams, tenantBlockText, tenantBlockWindow, unapprovedEmailDomainBlock, unapprovedEmailDomainViolation, } from './approved_tenant_gate.js';
 const MANIFEST_STALE_MS = 7 * 24 * 60 * 60 * 1000;
 /** After verified (or failed verify), push enforcement + session log immediately — do not wait for background runner. */
 async function flushRemediationOutcomeToServer(complianceLogPath) {
@@ -93,12 +96,18 @@ const BLOCK_TITLE = 'Optimus Labs\n\n';
 function titled(violationMessage) {
     return violationMessage.startsWith(ORGANIZATION_LEAD) ? violationMessage : BLOCK_TITLE + violationMessage;
 }
-function blockPayload(ide, violationMessage) {
+/**
+ * `windowShown` tells Cursor's hook the blocked-agent window already says why, so it skips its own
+ * alert of the same message (`__optimus_window`); Cursor itself ignores the extra field.
+ */
+function blockPayload(ide, violationMessage, windowShown = false) {
     const text = titled(violationMessage);
     if (ide === 'claude' || ide === 'copilot' || ide === 'opencode') {
-        return JSON.stringify({ decision: 'block', reason: text, systemMessage: text });
+        // Claude's hook skips its own alert too, and takes the field out before Claude Code reads it.
+        const flag = windowShown && ide === 'claude' ? { __optimus_window: true } : {};
+        return JSON.stringify({ decision: 'block', reason: text, systemMessage: text, ...flag });
     }
-    return JSON.stringify({ continue: false, user_message: text });
+    return JSON.stringify({ continue: false, user_message: text, ...(windowShown ? { __optimus_window: true } : {}) });
 }
 /**
  * Codex's block: `reason` only. Codex shows `reason` as the block and `systemMessage` as a separate
@@ -269,32 +278,42 @@ function loginEmail(agent) {
     return null;
 }
 /** Why this agent's signed-in tenant is blocked, or null when it is not (or cannot be read). */
-function tenantViolation(agent) {
+function tenantBlock(agent) {
     const { approved_tenants: approved, team_email_domains: teamDomains } = readRemediationInstructionsFile();
     if (agent === 'claude')
-        return approvedTenantViolation('claude', approved, readClaudeSignedInTenant());
+        return approvedTenantBlock('claude', approved, readClaudeSignedInTenant());
     if (agent === 'claude_desktop') {
-        return approvedTenantViolation('claude_desktop', approved, readClaudeDesktopSignedInTenant());
+        return approvedTenantBlock('claude_desktop', approved, readClaudeDesktopSignedInTenant());
     }
     if (agent === 'codex')
-        return codexTenantViolation(approved, readCodexSignedIn());
+        return codexTenantBlock(approved, readCodexSignedIn());
     if (agent === 'cursor')
-        return cursorTeamViolation(approved, readCursorSignedInTeams(), teamDomains);
+        return cursorTeamBlock(approved, readCursorSignedInTeams(), teamDomains);
     return null;
 }
-/** The block for a login: which check refused it and why, or null when every check passes. */
-function loginBlock(agent, email) {
+/**
+ * The block for a login: which check refused it, why, and the blocked-agent window's words for a
+ * tenant or email-domain block (an agent's own block window comes synced); null when all pass.
+ */
+function loginBlock(agent, email, agentAllowed) {
     const synced = readRemediationInstructionsFile();
-    const agentMsg = agentApprovalViolation(agent, synced.approved_agents);
+    const agentMsg = agentAllowed ? null : agentApprovalViolation(agent, synced.approved_agents);
     if (agentMsg)
         return { event: 'prompt_gate_block_unapproved_agent', reason: agentMsg };
     if (email === null)
         return null;
-    const emailMsg = unapprovedEmailDomainViolation(email, synced.unapproved_email_domains);
-    if (emailMsg)
-        return { event: 'prompt_gate_block_unapproved_email_domain', reason: emailMsg };
-    const tenantMsg = tenantViolation(agent);
-    return tenantMsg ? { event: 'prompt_gate_block_unapproved_tenant', reason: tenantMsg } : null;
+    const emailBlock = unapprovedEmailDomainBlock(email, synced.unapproved_email_domains);
+    if (emailBlock) {
+        return {
+            event: 'prompt_gate_block_unapproved_email_domain',
+            reason: unapprovedEmailDomainViolation(email, synced.unapproved_email_domains) ?? '',
+            window: emailDomainBlockWindow(agent, emailBlock, synced.team_email_domains),
+        };
+    }
+    const tenant = tenantBlock(agent);
+    if (!tenant)
+        return null;
+    return { event: 'prompt_gate_block_unapproved_tenant', reason: tenantBlockText(tenant), window: tenantBlockWindow(tenant) };
 }
 /**
  * Block the prompt when the agent is not approved, or the login's email domain or its tenant was
@@ -306,11 +325,17 @@ function blockedByLogin(agent, ide) {
     if (tenantGateSwitchedOff())
         return false;
     const email = loginEmail(agent);
-    const block = loginBlock(agent, email);
+    const synced = readRemediationInstructionsFile();
+    const access = agentAccessDecision(agent, synced.approved_agents);
+    const block = loginBlock(agent, email, access.allowed);
     if (!block)
         return false;
     logRemediationApplyFailure(block.event, { reason: block.reason, ide, agent, email: email ?? '' });
-    console.log(agent === 'codex' ? codexBlockPayload(block.reason) : blockPayload(ide, block.reason));
+    // The blocked-agent window opens beside every block, in the background, so the hook answers at
+    // once: an agent's own from the synced approvals, a login's from the words built here. Where it
+    // could not start, Cursor's hook keeps its alert.
+    const windowShown = launchAgentAccessWindow(approvalId(agent), block.window);
+    console.log(agent === 'codex' ? codexBlockPayload(block.reason) : blockPayload(ide, block.reason, windowShown));
     return true;
 }
 /** Pull the organization's latest remediations and approved tenants, waiting at most 3 seconds. */
@@ -325,6 +350,36 @@ async function syncApprovals() {
         // Network or auth failure — fall back to local file state.
     }
 }
+/**
+ * Skill block killswitch, Claude Code only for now: refuse the prompt of a session that loaded a
+ * skill which is now blocked, or whose `claude` process did in an earlier session (a `/clear` keeps
+ * the skill), docs/skill-block/DESIGN.md. True when it refused.
+ */
+function blockedBySkillBlock(agent, ide, sessionId) {
+    if (ide !== 'claude')
+        return false;
+    const proc = claudeProcess();
+    try {
+        recordSessionProcess(sessionId, proc);
+    }
+    catch (err) {
+        hookRunLog(`skill_block_process_table_error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const skills = stoppingSkills(sessionId, proc);
+    if (skills.length > 0) {
+        logRemediationApplyFailure('skill_block_session_stopped', { ide, agent, skills: skills.join(',') });
+        const windowShown = openSkillBlockWindow(skills[0]);
+        console.log(blockPayload(ide, stoppedSessionMessage(skills), windowShown));
+        return true;
+    }
+    const typed = blockedSkillOfCommand(process.env.OPTIMUS_PROMPT_FIRST_LINE || '', () => proc?.startedAt ?? null);
+    if (!typed)
+        return false;
+    logRemediationApplyFailure('skill_block_command_refused', { ide, agent, skills: typed });
+    const windowShown = openSkillBlockWindow(typed);
+    console.log(blockPayload(ide, blockedCommandMessage(typed), windowShown));
+    return true;
+}
 /** Agents whose remediations are JSON files written to disk at once (no deferred SQLite apply). */
 function isImmediateJsonIde(ide) {
     return ide === 'claude' || ide === 'copilot' || ide === 'opencode';
@@ -537,6 +592,8 @@ export async function runCompliancePromptGate() {
     }
     await reportPostRestartVerification(agent, complianceLogPath);
     await syncApprovals();
+    if (blockedBySkillBlock(agent, ide, (process.env.OPTIMUS_SESSION_ID || '').trim()))
+        return;
     const status = runLocalRemediationComplianceCheck(agent);
     uploadSecondarySatisfied(status);
     // Approved tenants (OPT-687): checked against the list the sync above stored locally.

package/dist/log_config_files/collection/skill_symlink.js

@@ -1,6 +1,7 @@
 import { accessSync, constants, lstatSync, readlinkSync, realpathSync } from 'node:fs';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { readMarkdownFile } from '../readers/file_readers.js';
+import { quarantineReceiptFor } from '../runtime/skill_block.js';
 function isMissingPathError(err) {
     const code = err?.code;
     return code === 'ENOENT' || code === 'ENOTDIR';
@@ -173,6 +174,14 @@ export function collectSkillMdRecord(skillDir, fileType, source, skillFilename =
         ...extraRaw,
     };
     const symlink_info = skillLinkPayload(info);
+    const quarantine = quarantineReceiptFor(skillDir);
+    if (quarantine) {
+        // Quarantined for a skill block: moved into the vault, unchanged since (docs/skill-block). The
+        // receipt says when, and which files with which hashes; never their contents.
+        raw.locked_by_optimus = true;
+        raw.quarantine = { quarantined_at: quarantine.quarantined_at, files: quarantine.files };
+        return { file_type: fileType, file_path: mdPath, raw_content: raw, symlink_info };
+    }
     if (info.status === 'valid') {
         const content = readMarkdownFile(mdPath);
         if (content !== null) {

package/dist/log_config_files/runtime/management_storage.js

@@ -77,6 +77,18 @@ export function getRemediationStateDir() {
 export function getRemediationInstructionsPath() {
     return join(getRemediationStateDir(), REMEDIATION_INSTRUCTIONS_BASENAME);
 }
+/** The mode each locked skill folder had before it was locked, so unblocking can restore it. */
+export function getSkillBlockStatePath() {
+    return join(getRemediationStateDir(), 'skill_block_state.json');
+}
+/** The vault of quarantined skill folders and their receipts (docs/skill-block, "Quarantine"). */
+export function getQuarantineDir() {
+    return join(getManagementDir(), 'quarantine');
+}
+/** The session ids each `claude` process has run, so a `/clear` cannot escape a skill block stop. */
+export function getSkillBlockProcessesPath() {
+    return join(getRemediationStateDir(), 'skill_block_processes.json');
+}
 export function getDeferredVscdbApplyPath() {
     return join(getVscdbStateDir(), DEFERRED_VSCDB_APPLY_BASENAME);
 }
@@ -139,12 +151,18 @@ function writeInstructionsFile(file, remediationsWrittenAt) {
         remediations_written_at: remediationsWrittenAt,
     });
 }
+// The lists the sync replaces on every answer (the skill blocks with them); a writer that passes
+// only `remediations` keeps them.
 const APPROVAL_LISTS = [
     'approved_tenants',
     'unapproved_email_domains',
     'allowed_email_domains',
     'approved_agents',
     'team_email_domains',
+    'skill_blocks',
+    'skill_block_sessions',
+    'skill_block_windows',
+    'agent_access_windows',
 ];
 /** Each approval list from `file` when it names one, else the one on disk; absent ones left out. */
 function keptApprovalLists(file, onDisk) {
@@ -172,6 +190,10 @@ function writeApprovalList(patch) {
 export function writeUnapprovedEmailDomains(unapproved_email_domains) {
     writeApprovalList({ unapproved_email_domains });
 }
+/** Replace only the blocked-agent windows, keeping everything else on disk. */
+export function writeAgentAccessWindows(agent_access_windows) {
+    writeApprovalList({ agent_access_windows });
+}
 /** Replace only the approved agents, keeping everything else on disk. */
 export function writeApprovedAgents(approved_agents) {
     writeApprovalList({ approved_agents });
@@ -184,6 +206,18 @@ export function writeTeamEmailDomains(team_email_domains) {
 export function writeAllowedEmailDomains(allowed_email_domains) {
     writeApprovalList({ allowed_email_domains });
 }
+/** Replace only the skill blocks, keeping everything else on disk. */
+export function writeSkillBlocks(skill_blocks) {
+    writeApprovalList({ skill_blocks });
+}
+/** Replace only the sessions to stop for skill blocks, keeping everything else on disk. */
+export function writeSkillBlockSessions(skill_block_sessions) {
+    writeApprovalList({ skill_block_sessions });
+}
+/** Replace only the skill block windows, keeping everything else on disk. */
+export function writeSkillBlockWindows(skill_block_windows) {
+    writeApprovalList({ skill_block_windows });
+}
 /** Replace only the approved-tenant list, keeping the remediations already on disk. */
 export function writeApprovedTenants(approved_tenants) {
     writeApprovalList({ approved_tenants });

package/dist/log_config_files/runtime/remediation_sync.js

@@ -4,7 +4,9 @@ import { homedir } from 'node:os';
 import { executeBody } from '../../endpoint_client/http_transport.js';
 import { parseJsonWithJsoncFallback, parseTomlText, stringifyToml } from '../readers/file_readers.js';
 import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
-import { atomicWriteJson, getDeferredVscdbApplyPath, getFileCollectionVscdbContractPath, getRemediationInstructionsPath, readRemediationInstructionsFile, writeApprovedTenants, writeUnapprovedEmailDomains, writeAllowedEmailDomains, writeTeamEmailDomains, writeApprovedAgents, writeRemediationInstructionsFile, } from './management_storage.js';
+import { atomicWriteJson, getDeferredVscdbApplyPath, getFileCollectionVscdbContractPath, getRemediationInstructionsPath, readRemediationInstructionsFile, writeApprovedTenants, writeUnapprovedEmailDomains, writeAllowedEmailDomains, writeTeamEmailDomains, writeApprovedAgents, writeAgentAccessWindows, writeRemediationInstructionsFile, writeSkillBlockSessions, writeSkillBlockWindows, writeSkillBlocks, } from './management_storage.js';
+import { applySkillBlocks } from './skill_block.js';
+import { openQuarantineWindows } from './skill_block_sessions.js';
 import { readStoredAuthKey } from '../auth/auth_key_store.js';
 import { ensureAuthentication } from '../auth/auth_flow.js';
 import { createSignature } from '../sender/signing.js';
@@ -1656,6 +1658,69 @@ function storeApprovals(syncResult) {
     const teamDomains = syncResult.team_email_domains;
     if (Array.isArray(teamDomains))
         writeTeamEmailDomains(lowercaseStrings(teamDomains));
+    storeAgentAccess(syncResult);
+}
+/** The blocked-agent window's words for each agent that is not approved. */
+function storeAgentAccess(syncResult) {
+    const windows = syncResult.agent_access_windows;
+    if (windows && typeof windows === 'object' && !Array.isArray(windows))
+        writeAgentAccessWindows(windows);
+}
+function isSkillBlockEntry(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const entry = value;
+    return typeof entry.skill_dir === 'string' && entry.skill_dir !== '' && typeof entry.resource_uuid === 'string';
+}
+/** Keep the server's sessions to stop (for the prompt gate); an older server sends none. */
+function storeSkillBlockSessions(sessions) {
+    if (!Array.isArray(sessions))
+        return;
+    writeSkillBlockSessions(sessions
+        .filter((s) => typeof s?.session_id === 'string' && s.session_id !== '')
+        .map((s) => ({
+        session_id: s.session_id,
+        resource_uuid: typeof s.resource_uuid === 'string' ? s.resource_uuid : '',
+        skill_name: typeof s.skill_name === 'string' ? s.skill_name : '',
+    })));
+}
+/** Keep the server's skill block windows (words only, drawn as sent); an older server sends none. */
+function storeSkillBlockWindows(windows) {
+    if (!windows || typeof windows !== 'object' || Array.isArray(windows))
+        return;
+    const kept = {};
+    for (const [uuid, words] of Object.entries(windows)) {
+        if (words && typeof words === 'object' && !Array.isArray(words))
+            kept[uuid] = words;
+    }
+    writeSkillBlockWindows(kept);
+}
+/**
+ * Store the server's skill blocks and make the folders on disk match them. An older server sends
+ * no `skill_blocks`: the folders are then left as they are, never unlocked by mistake.
+ */
+function enforceSkillBlocks(syncResult) {
+    const blocks = syncResult.skill_blocks;
+    if (!Array.isArray(blocks))
+        return;
+    const entries = blocks.filter(isSkillBlockEntry).map((entry) => ({
+        resource_uuid: entry.resource_uuid,
+        skill_name: typeof entry.skill_name === 'string' ? entry.skill_name : '',
+        skill_dir: entry.skill_dir,
+    }));
+    writeSkillBlocks(entries);
+    storeSkillBlockSessions(syncResult.skill_block_sessions);
+    storeSkillBlockWindows(syncResult.skill_block_windows);
+    try {
+        const outcome = applySkillBlocks(entries);
+        // Tell the user when a skill is quarantined, whether or not a session of theirs loaded it.
+        openQuarantineWindows(outcome.quarantined, entries);
+    }
+    catch (err) {
+        const msg = `skill_block_error: ${errorText(err)}`;
+        hookRunLog(msg);
+        complianceRunnerDiag(msg);
+    }
 }
 async function reconcileInstructions(endpointBase, machineUuid, want) {
     try {
@@ -1792,6 +1857,7 @@ export async function syncRemediations(endpointBase, machineUuid) {
         return;
     applyClearApplyTrackingUuids(syncResult.clear_apply_tracking_uuids);
     storeApprovals(syncResult);
+    enforceSkillBlocks(syncResult);
     if (syncResult.status === 'unchanged') {
         await reconcileUnchanged(endpointBase, machineUuid, remediations, activeUuids);
         return;