@optimuslabs/harness-map-staging 1.5.36 → 1.5.39

package/dist/log_config_files/runtime/skill_block.js

@@ -1,56 +1,131 @@
 /**
- * Skill block (docs/skill-block/DESIGN.md): lock the skill folders the organization blocked so no
- * agent can load or run them, and give a folder its permissions back once the skill is unblocked.
+ * Skill quarantine (docs/skill-block/DESIGN.md, "Quarantine"): move the skill folders the
+ * organization blocked into a vault, as an antivirus quarantines a file, and move them back once the
+ * skill is approved again.
  *
  * The remediation sync stores the server's list under `skill_blocks` in
- * remediation_instructions.json and then calls `applySkillBlocks`. A folder is locked with
- * `chmod 000` after its mode is recorded in skill_block_state.json; a recorded folder that is no
- * longer listed gets that mode back. The folders are where the collection found each skill's
- * SKILL.md, for any agent. A folder is locked only when it is a real directory inside the home
- * folder (never the home folder itself) holding a SKILL.md, so a bad path cannot lock anything
- * that is not a skill.
+ * remediation_instructions.json and then calls `applySkillBlocks`. A listed folder is moved into
+ * `~/.optimuslabs/management/quarantine/<id>/` with a receipt `<id>.json` (where it came from, when,
+ * and each file's hash, never its content); the vault entry is `chmod 000`, and an empty `chmod 000`
+ * folder is left at the original path so that no app (Claude Code re-syncing account skills, a
+ * plugin update) can put the skill back. A receipt whose folder is no longer listed is restored.
+ * A folder is only ever moved when it is a real directory inside the home folder (never the home
+ * folder itself) holding a SKILL.md, so a bad path cannot move anything that is not a skill.
  */
-import { chmodSync, existsSync, lstatSync, readFileSync, realpathSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { homedir } from 'node:os';
-import { join, resolve, sep } from 'node:path';
+import { dirname, join, resolve, sep } from 'node:path';
 import { complianceRunnerDiag, hookRunLog } from './hook_logger.js';
-import { atomicWriteJson, getSkillBlockStatePath } from './management_storage.js';
+import { atomicWriteJson, getQuarantineDir, getSkillBlockStatePath, } from './management_storage.js';
 function log(message) {
     hookRunLog(message);
     complianceRunnerDiag(message);
 }
-export function readSkillBlockState() {
-    const path = getSkillBlockStatePath();
-    if (!existsSync(path))
-        return {};
+function permissionBits(path) {
+    return lstatSync(path).mode & 0o7777;
+}
+/** The vault id of an original path: one path, one entry. */
+function entryId(dir) {
+    return createHash('sha256').update(resolve(dir)).digest('hex').slice(0, 16);
+}
+function vaultPath(id) {
+    return join(getQuarantineDir(), id);
+}
+function receiptPath(id) {
+    return join(getQuarantineDir(), `${id}.json`);
+}
+function readReceipt(id) {
     try {
-        const parsed = JSON.parse(readFileSync(path, 'utf8'));
-        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+        const parsed = JSON.parse(readFileSync(receiptPath(id), 'utf8'));
+        return parsed && typeof parsed.original_path === 'string' ? parsed : null;
     }
     catch {
-        return {};
+        return null;
     }
 }
-function permissionBits(path) {
-    return lstatSync(path).mode & 0o7777;
+function writeReceipt(id, receipt) {
+    atomicWriteJson(receiptPath(id), receipt);
 }
-/**
- * Whether `dir` is a skill folder this endpoint locked for a block and that is still locked. Its
- * files cannot be read, and nothing can have changed in it since it was locked, so the collection
- * reports it as locked and the backend keeps the copy it has.
- */
-export function isLockedByOptimus(dir) {
-    const target = resolve(dir);
-    if (!readSkillBlockState()[target])
+/** Every receipt in the vault, by id. */
+function readReceipts() {
+    let names;
+    try {
+        names = readdirSync(getQuarantineDir());
+    }
+    catch {
+        return [];
+    }
+    const receipts = [];
+    for (const name of names) {
+        const match = name.match(/^([0-9a-f]{16})\.json$/);
+        const receipt = match ? readReceipt(match[1]) : null;
+        if (match && receipt)
+            receipts.push([match[1], receipt]);
+    }
+    return receipts;
+}
+function exists(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch {
         return false;
+    }
+}
+/** The empty `chmod 000` folder quarantine leaves at an original path. */
+function isStub(dir) {
     try {
-        return permissionBits(target) === 0;
+        const stat = lstatSync(dir);
+        return stat.isDirectory() && !stat.isSymbolicLink() && (stat.mode & 0o7777) === 0;
     }
     catch {
         return false;
     }
 }
-/** Why `dir` must not be locked, or null when it is a real skill folder inside the home folder. */
+function makeStub(dir) {
+    mkdirSync(dir);
+    chmodSync(dir, 0o000);
+}
+/** Every file of `dir` with its hash, and every symlink with its target, sorted by path. */
+function readFolderHashes(dir, prefix = '') {
+    const files = [];
+    for (const name of readdirSync(dir).sort()) {
+        const full = join(dir, name);
+        const rel = prefix ? `${prefix}/${name}` : name;
+        const stat = lstatSync(full);
+        if (stat.isSymbolicLink())
+            files.push({ path: rel, link: readlinkSync(full) });
+        else if (stat.isDirectory())
+            files.push(...readFolderHashes(full, rel));
+        else if (stat.isFile()) {
+            const sha256 = createHash('sha256').update(readFileSync(full)).digest('hex');
+            files.push({ path: rel, sha256, size: stat.size });
+        }
+    }
+    return files;
+}
+function sameFiles(a, b) {
+    return JSON.stringify(a) === JSON.stringify(b);
+}
+/** When the folder at `dir` was quarantined, or null when it is not. */
+export function quarantinedAt(dir) {
+    const receipt = readReceipt(entryId(dir));
+    return receipt && receipt.status !== 'moving' ? receipt.quarantined_at : null;
+}
+/**
+ * The receipt of the skill folder quarantined from `dir`, when the empty folder quarantine left
+ * is still there. The collection reports such a path as quarantined: its skill cannot have changed
+ * since it was moved, and the server keeps the copy it has.
+ */
+export function quarantineReceiptFor(dir) {
+    if (!isStub(resolve(dir)))
+        return null;
+    const receipt = readReceipt(entryId(dir));
+    return receipt && receipt.status !== 'moving' ? receipt : null;
+}
+/** Why `dir` must not be moved, or null when it is a real skill folder inside the home folder. */
 export function refusalReason(dir, home = homedir()) {
     const root = resolve(home);
     const target = resolve(dir);
@@ -69,24 +144,79 @@ export function refusalReason(dir, home = homedir()) {
         return 'no SKILL.md';
     return null;
 }
-/** Lock a recorded folder again if it was opened; its path may have been replaced, so check it. */
-function relockIfOpened(dir, entry, outcome, home) {
-    if (!existsSync(dir) || permissionBits(dir) === 0)
+/** Move a listed folder into the vault, with its receipt, and leave the empty folder behind. */
+function moveIn(dir, id, entry, outcome) {
+    const receipt = {
+        original_path: dir,
+        resource_uuid: entry.resource_uuid,
+        skill_name: entry.skill_name,
+        quarantined_at: new Date().toISOString(),
+        mode: permissionBits(dir),
+        status: 'moving',
+        files: readFolderHashes(dir),
+    };
+    writeReceipt(id, receipt);
+    renameSync(dir, vaultPath(id));
+    finishMove(dir, id, receipt);
+    outcome.quarantined.push(dir);
+}
+/** The steps after the move, also run to finish one a crash interrupted. */
+function finishMove(dir, id, receipt) {
+    if (!exists(dir))
+        makeStub(dir);
+    chmodSync(vaultPath(id), 0o000);
+    writeReceipt(id, { ...receipt, status: 'done' });
+}
+/**
+ * A listed folder already in the vault: keep its original path closed. The empty folder may have
+ * been removed, opened, or replaced by the skill itself (an app re-created it); a copy identical
+ * to the vault's is discarded, a different one is kept in the vault beside it.
+ */
+function keepQuarantined(dir, id, receipt, home, outcome) {
+    if (isStub(dir))
+        return;
+    if (!exists(dir)) {
+        makeStub(dir);
+        outcome.requarantined.push(dir);
         return;
+    }
+    const stat = lstatSync(dir);
+    if (stat.isDirectory() && !stat.isSymbolicLink() && readdirSync(dir).length === 0) {
+        chmodSync(dir, 0o000);
+        outcome.requarantined.push(dir);
+        return;
+    }
     const reason = refusalReason(dir, home);
     if (reason) {
-        outcome.refused.push({ skill_dir: entry.skill_dir, reason });
+        outcome.refused.push({ skill_dir: dir, reason });
         return;
     }
-    chmodSync(dir, 0o000);
-    outcome.relocked.push(dir);
+    if (sameFiles(readFolderHashes(dir), receipt.files)) {
+        rmSync(dir, { recursive: true, force: true });
+    }
+    else {
+        const kept = `${vaultPath(id)}.${Date.now()}`;
+        renameSync(dir, kept);
+        chmodSync(kept, 0o000);
+        log(`skill_block: a different copy came back at ${dir}; kept in the vault as ${kept}`);
+    }
+    makeStub(dir);
+    outcome.requarantined.push(dir);
 }
-/** Lock a listed folder, or lock it again when its permissions were opened since. */
-function lockFolder(entry, state, outcome, home) {
+/** Quarantine one listed folder, or keep it quarantined. */
+function quarantine(entry, home, outcome) {
     const dir = resolve(entry.skill_dir);
-    const known = state[dir];
-    if (known) {
-        relockIfOpened(dir, entry, outcome, home);
+    const id = entryId(dir);
+    let receipt = readReceipt(id);
+    if (receipt?.status === 'moving') {
+        if (existsSync(vaultPath(id)))
+            finishMove(dir, id, receipt);
+        else
+            unlinkSync(receiptPath(id));
+        receipt = readReceipt(id);
+    }
+    if (receipt) {
+        keepQuarantined(dir, id, receipt, home, outcome);
         return;
     }
     const reason = refusalReason(dir, home);
@@ -94,28 +224,79 @@ function lockFolder(entry, state, outcome, home) {
         outcome.refused.push({ skill_dir: entry.skill_dir, reason });
         return;
     }
-    state[dir] = { mode: permissionBits(dir), resource_uuid: entry.resource_uuid, locked_at: new Date().toISOString() };
-    atomicWriteJson(getSkillBlockStatePath(), state);
-    chmodSync(dir, 0o000);
-    outcome.locked.push(dir);
+    moveIn(dir, id, entry, outcome);
+}
+/**
+ * Clear the original path for a restore: our empty folder (or an emptied one) is removed. Anything
+ * else there now is someone's copy: it is left alone and the vault entry is kept (a conflict).
+ */
+function clearOriginalPath(dir) {
+    if (!exists(dir))
+        return true;
+    const stat = lstatSync(dir);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        return false;
+    chmodSync(dir, 0o700);
+    if (readdirSync(dir).length > 0) {
+        chmodSync(dir, stat.mode & 0o7777);
+        return false;
+    }
+    rmdirSync(dir);
+    return true;
+}
+/** Move a folder no longer listed back where it came from, with its mode. */
+function restore(id, receipt, outcome) {
+    const dir = receipt.original_path;
+    const vault = vaultPath(id);
+    if (!existsSync(vault)) {
+        unlinkSync(receiptPath(id));
+        log(`skill_block: the vault entry of ${dir} is missing; its receipt is dropped`);
+        return;
+    }
+    if (!clearOriginalPath(dir)) {
+        if (receipt.status !== 'conflict')
+            writeReceipt(id, { ...receipt, status: 'conflict' });
+        outcome.conflicts.push(dir);
+        return;
+    }
+    chmodSync(vault, receipt.mode);
+    if (!sameFiles(readFolderHashes(vault), receipt.files))
+        log(`skill_block: ${dir} changed in the vault; restored as it is`);
+    mkdirSync(dirname(dir), { recursive: true });
+    renameSync(vault, dir);
+    unlinkSync(receiptPath(id));
+    outcome.restored.push(dir);
 }
-/** Give a folder no longer listed the mode it had before it was locked. */
-function restoreFolder(dir, state, outcome) {
-    const { mode } = state[dir];
-    if (existsSync(dir) && !lstatSync(dir).isSymbolicLink()) {
-        chmodSync(dir, mode);
-        outcome.restored.push(dir);
+/**
+ * The previous version locked folders in place (`chmod 000`, modes in skill_block_state.json).
+ * Give them their modes back once; the listed ones are then quarantined like any other.
+ */
+function releaseInPlaceLocks() {
+    const path = getSkillBlockStatePath();
+    if (!existsSync(path))
+        return;
+    try {
+        const state = JSON.parse(readFileSync(path, 'utf8'));
+        for (const [dir, entry] of Object.entries(state)) {
+            if (typeof entry?.mode === 'number' && existsSync(dir) && !lstatSync(dir).isSymbolicLink()) {
+                chmodSync(dir, entry.mode);
+            }
+        }
+    }
+    catch (err) {
+        log(`skill_block: could not read the in-place locks: ${err instanceof Error ? err.message : String(err)}`);
     }
-    delete state[dir];
+    unlinkSync(path);
 }
 /**
- * Make the folders on disk match `entries`, the server's whole list for this machine: lock the
- * listed ones, restore the ones locked before and no longer listed. A folder that fails the checks
- * is skipped and logged; one failing chmod does not stop the others.
+ * Make the vault match `entries`, the server's whole list for this machine: quarantine the listed
+ * folders, keep them quarantined, and restore the ones no longer listed. A folder that fails the
+ * checks is skipped and logged; one failure does not stop the others.
  */
 export function applySkillBlocks(entries, home = homedir()) {
-    const outcome = { locked: [], relocked: [], restored: [], refused: [] };
-    const lockPath = `${getSkillBlockStatePath()}.lock`;
+    const outcome = { quarantined: [], requarantined: [], restored: [], conflicts: [], refused: [] };
+    mkdirSync(getQuarantineDir(), { recursive: true, mode: 0o700 });
+    const lockPath = `${getQuarantineDir()}.lock`;
     if (!takeStateLock(lockPath)) {
         log('skill_block: another sync is applying blocks; the next sync applies these');
         return outcome;
@@ -129,9 +310,8 @@ export function applySkillBlocks(entries, home = homedir()) {
     return outcome;
 }
 /**
- * Take the lock around reading the state, changing permissions and writing the state. Two syncs at
- * once (the prompt gate and the compliance runner) could otherwise lose a folder's original mode,
- * leaving it locked after an unblock. A lock left by a dead process goes after a minute.
+ * Take the lock around the vault: two syncs at once (the prompt gate and the compliance runner)
+ * could otherwise move the same folder twice. A lock left by a dead process goes after a minute.
  */
 function takeStateLock(lockPath) {
     try {
@@ -153,36 +333,37 @@ function releaseStateLock(lockPath) {
     }
 }
 function applyUnderLock(entries, home, outcome) {
-    const state = readSkillBlockState();
-    const wanted = new Set(entries.map((entry) => resolve(entry.skill_dir)));
+    releaseInPlaceLocks();
+    const wanted = new Set(entries.map((entry) => entryId(entry.skill_dir)));
     for (const entry of entries) {
         try {
-            lockFolder(entry, state, outcome, home);
+            quarantine(entry, home, outcome);
         }
         catch (err) {
             outcome.refused.push({ skill_dir: entry.skill_dir, reason: err instanceof Error ? err.message : String(err) });
         }
     }
-    for (const dir of Object.keys(state)) {
-        if (wanted.has(dir))
+    for (const [id, receipt] of readReceipts()) {
+        if (wanted.has(id))
             continue;
         try {
-            restoreFolder(dir, state, outcome);
+            restore(id, receipt, outcome);
         }
         catch (err) {
-            outcome.refused.push({ skill_dir: dir, reason: err instanceof Error ? err.message : String(err) });
+            outcome.refused.push({ skill_dir: receipt.original_path, reason: err instanceof Error ? err.message : String(err) });
         }
     }
-    atomicWriteJson(getSkillBlockStatePath(), state);
     logOutcome(outcome);
 }
 function logOutcome(outcome) {
-    for (const dir of outcome.locked)
-        log(`skill_block: locked ${dir}`);
-    for (const dir of outcome.relocked)
-        log(`skill_block: locked again (permissions were opened) ${dir}`);
+    for (const dir of outcome.quarantined)
+        log(`skill_block: quarantined ${dir}`);
+    for (const dir of outcome.requarantined)
+        log(`skill_block: closed again ${dir}`);
     for (const dir of outcome.restored)
         log(`skill_block: restored ${dir}`);
+    for (const dir of outcome.conflicts)
+        log(`skill_block: not restored, something else is at ${dir}`);
     for (const { skill_dir, reason } of outcome.refused)
         log(`skill_block: skipped ${skill_dir} (${reason})`);
 }

package/dist/log_config_files/runtime/skill_block_sessions.js

@@ -6,12 +6,16 @@
  * The backend knows which sessions loaded a skill: the tool calls the skill usage view attributes to
  * it. The remediation sync sends this machine's sessions that loaded a blocked skill
  * (`skill_block_sessions` in remediation_instructions.json), and the prompt gate refuses their
- * prompts. Only those sessions are stopped; an unblock takes them off the list.
+ * prompts. `/clear` gives a new session id but the `claude` process keeps the skill, so the gate also
+ * records which session ids each process has run (skill_block_processes.json) and stops every session
+ * of a process that ran a listed one. An unblock takes the sessions off the list.
  */
 import { execFileSync } from 'node:child_process';
-import { basename, resolve } from 'node:path';
-import { readRemediationInstructionsFile } from './management_storage.js';
-import { readSkillBlockState } from './skill_block.js';
+import { existsSync, readFileSync } from 'node:fs';
+import { basename } from 'node:path';
+import { atomicWriteJson, getSkillBlockProcessesPath, readRemediationInstructionsFile, } from './management_storage.js';
+import { launchAgentAccessWindow } from '../../agent_access/window_runner.js';
+import { quarantinedAt } from './skill_block.js';
 /** A process's parent, start time and command name, from `ps`; null when it cannot be read. */
 function processRow(pid) {
     try {
@@ -25,41 +29,82 @@ function processRow(pid) {
     }
 }
 /**
- * When the `claude` process running this hook started (ms), or null when it cannot be found. It
- * lists its skills when it starts and keeps them across `/clear`, so this is what tells a real
- * restart from `/clear`, which only changes the session id.
+ * The `claude` process running this hook, or null when it cannot be found. It lists its skills when
+ * it starts and keeps them across `/clear`, which only changes the session id, so the process (not
+ * the session) is what holds a loaded skill.
  */
-export function claudeProcessStartedAt() {
+export function claudeProcess() {
     let pid = process.ppid;
     for (let depth = 0; depth < 12 && pid > 1; depth += 1) {
         const row = processRow(pid);
         if (!row)
             return null;
         if (row.name === 'claude')
-            return row.startedAt;
+            return Number.isNaN(row.startedAt) ? null : { pid, startedAt: row.startedAt };
         pid = row.parent;
     }
     return null;
 }
-/** The names of the blocked skills this session loaded; empty when it may go on. */
-export function stoppingSkills(sessionId) {
+/** When the `claude` process running this hook started (ms), or null when it cannot be found. */
+export function claudeProcessStartedAt() {
+    return claudeProcess()?.startedAt ?? null;
+}
+/** The table's key: a pid with its start time, since the system reuses pids. */
+function processKey(proc) {
+    return `${proc.pid}:${proc.startedAt}`;
+}
+function readProcessTable() {
+    const path = getSkillBlockProcessesPath();
+    if (!existsSync(path))
+        return {};
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Record that `proc` runs `sessionId`, and drop processes not seen for 30 days (the server's window).
+ * Two prompts at once can each write the table and lose one session; the next prompt records it again.
+ */
+export function recordSessionProcess(sessionId, proc, now = Date.now()) {
+    if (!sessionId || !proc)
+        return;
+    const table = readProcessTable();
+    const cutoff = now - 30 * 24 * 60 * 60 * 1000;
+    for (const [key, entry] of Object.entries(table)) {
+        if (!(Date.parse(entry?.last_seen ?? '') >= cutoff))
+            delete table[key];
+    }
+    const key = processKey(proc);
+    const sessions = new Set(table[key]?.sessions ?? []);
+    sessions.add(sessionId);
+    table[key] = { sessions: [...sessions], last_seen: new Date(now).toISOString() };
+    atomicWriteJson(getSkillBlockProcessesPath(), table);
+}
+/**
+ * The names of the blocked skills this session loaded, or its process loaded in an earlier session
+ * (before a `/clear`); empty when it may go on. Without the process, only the session id counts.
+ */
+export function stoppingSkills(sessionId, proc = null) {
     if (!sessionId)
         return [];
+    const own = new Set([sessionId, ...(proc ? (readProcessTable()[processKey(proc)]?.sessions ?? []) : [])]);
     const sessions = readRemediationInstructionsFile().skill_block_sessions ?? [];
-    return sessions.filter((s) => s.session_id === sessionId).map((s) => s.skill_name || 'a skill');
+    return sessions.filter((s) => own.has(s.session_id)).map((s) => s.skill_name || 'a skill');
 }
 /** The notice for a stopped session. */
 export function stoppedSessionMessage(skills) {
     const names = [...new Set(skills)].join(', ');
-    return (`Your organization blocked ${names}, which this session loaded. Copy anything you need from ` +
-        'this conversation, then quit Claude Code and start it again to continue. Resuming this ' +
-        'session keeps it stopped.');
+    return `Your organization blocked ${names}. Quit Claude Code and start it again to clear this session's memory and continue.`;
 }
 /**
  * The blocked skill a typed slash command runs, when this process may still have it, or null:
- * `/airtable:airtable-cli …` or `/airtable-cli …`. A process started before the folder was locked
- * listed the skill and keeps it, even after `/clear`, so this refuses it. A process started after
- * the lock never listed it: this answers null, and Claude Code says the skill does not exist.
+ * `/airtable:airtable-cli …` or `/airtable-cli …`. A process started before the folder was
+ * quarantined listed the skill and keeps it, even after `/clear`, so this refuses it. A process
+ * started after it never listed it: this answers null, and Claude Code says the skill does not exist.
  * Matches the skill's name or its folder's name, which can differ (`aikido-issues` lives in
  * `skills/issues`). An unknown start time counts as too old, so a block is never skipped.
  */
@@ -68,19 +113,78 @@ export function blockedSkillOfCommand(promptFirstLine, processStartedAt = claude
     if (!command.startsWith('/'))
         return null;
     const typed = command.slice(command.lastIndexOf(':') + 1).replace(/^\//, '').toLowerCase();
-    const blocks = readRemediationInstructionsFile().skill_blocks ?? [];
+    // A plugin skill only: a running Claude Code drops a custom skill by itself once it is quarantined.
+    const blocks = (readRemediationInstructionsFile().skill_blocks ?? []).filter((b) => isPluginSkillDir(b.skill_dir));
     const hits = blocks.filter((b) => b.skill_name.toLowerCase() === typed || basename(b.skill_dir).toLowerCase() === typed);
     if (hits.length === 0)
         return null;
     const startedAt = processStartedAt();
-    const locks = readSkillBlockState();
     const mayStillHaveIt = hits.some((b) => {
-        const lockedAt = Date.parse(locks[resolve(b.skill_dir)]?.locked_at ?? '');
+        const lockedAt = Date.parse(quarantinedAt(b.skill_dir) ?? '');
         return startedAt === null || Number.isNaN(lockedAt) || startedAt <= lockedAt;
     });
     return mayStillHaveIt ? hits[0].skill_name || typed : null;
 }
+/**
+ * Whether `dir` is a Claude Code plugin's skill (`~/.claude/plugins/...`). Claude Code reads plugin
+ * skills once, when it starts, and keeps them until it quits, so a running one still offers a
+ * quarantined plugin skill. A custom skill (`~/.claude/skills`, a project's `.claude/skills`) is read
+ * again as its folder changes: Claude Code drops it at quarantine (docs/skill-block/DESIGN.md).
+ */
+export function isPluginSkillDir(dir) {
+    return dir.includes('/.claude/plugins/');
+}
 /** The notice for a typed command of a blocked skill in a process that may still have it. */
 export function blockedCommandMessage(skill) {
-    return `Your organization blocked ${skill}. Quit Claude Code and start it again to continue.`;
+    return `Your organization blocked ${skill}. Quit Claude Code and start it again to clear this session's memory and continue.`;
+}
+/**
+ * The window to open beside the block of the skill named `skill` (a name `stoppingSkills` or
+ * `blockedSkillOfCommand` gave), as the sync sent it for that skill's resource; undefined when the
+ * server sent none, so only the one-line block shows.
+ */
+export function skillBlockWindow(skill) {
+    const uuid = resourceUuidOf(skill);
+    return uuid ? readRemediationInstructionsFile().skill_block_windows?.[uuid] : undefined;
+}
+/** The resource uuid of the blocked skill named `skill`, from the synced lists; '' when unknown. */
+function resourceUuidOf(skill) {
+    const file = readRemediationInstructionsFile();
+    const name = skill.toLowerCase();
+    const entry = [...(file.skill_block_sessions ?? []), ...(file.skill_blocks ?? [])].find((e) => e.resource_uuid && e.skill_name.toLowerCase() === name);
+    return entry?.resource_uuid ?? '';
+}
+/** The skills this run already opened the window for, so a prompt that quarantines a skill and is
+ * refused for it opens one window, not two. */
+const windowsShown = new Set();
+/**
+ * Open the window of one blocked skill, by resource uuid, once per run. True when it is open: just
+ * started, or already started this run; false when the server sent no window for it.
+ */
+function openWindowOf(uuid) {
+    if (!uuid)
+        return false;
+    if (windowsShown.has(uuid))
+        return true;
+    const words = readRemediationInstructionsFile().skill_block_windows?.[uuid];
+    if (!words)
+        return false;
+    windowsShown.add(uuid);
+    return launchAgentAccessWindow('claude', words);
+}
+/** Open the window beside the block of the skill named `skill` (a stopped session, a typed command). */
+export function openSkillBlockWindow(skill) {
+    return openWindowOf(resourceUuidOf(skill));
+}
+/**
+ * Open the window for each skill this sync moved into quarantine (`dirs`, the folders it moved), so
+ * the user hears of it when it happens, even when no session of theirs is known to have loaded it
+ * (a typed command whose turn made no tool call reaches the server as nothing). One window per
+ * skill however many of its folders moved.
+ */
+export function openQuarantineWindows(dirs, entries) {
+    const moved = new Set(dirs);
+    const uuids = new Set(entries.filter((e) => moved.has(e.skill_dir)).map((e) => e.resource_uuid));
+    for (const uuid of uuids)
+        openWindowOf(uuid);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.36",
+  "version": "1.5.39",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {
@@ -15,7 +15,7 @@
     "dialog_prefs-staging": "dist/cli.js"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json && node ../../../scripts/ensure-bin-executable.mjs",
+    "build": "tsc -p tsconfig.json && node ../../../scripts/ensure-bin-executable.mjs && node -e \"const fs=require('fs');fs.mkdirSync('dist/agent_block_window',{recursive:true});fs.copyFileSync('src/agent_block_window/agent_block_window.jxa','dist/agent_block_window/agent_block_window.jxa')\"",
     "dev": "ts-node src/cli.ts",
     "lint": "eslint \"src/**/*.ts\"",
     "prepare": "npm run build",