@optimuslabs/harness-map-staging 1.5.38 → 1.5.39

package/dist/compliance_prompt_gate.js

@@ -22,7 +22,7 @@ import { parseJsonWithJsoncFallback } from './log_config_files/readers/file_read
 import { PORTABLE_CURSOR_USER_SETTINGS, resolveRemediationConfigPath, resolveRemediationUploadFileType, } from './log_config_files/runtime/remediation_config_path.js';
 import { tryResolveHardwareUuid } from './log_config_files/runtime/hardware_uuid.js';
 import { cursorAutofixDefersInlineVerify, syncRemediations, } from './log_config_files/runtime/remediation_sync.js';
-import { blockedCommandMessage, blockedSkillOfCommand, claudeProcess, recordSessionProcess, stoppedSessionMessage, skillBlockWindow, stoppingSkills, } from './log_config_files/runtime/skill_block_sessions.js';
+import { blockedCommandMessage, blockedSkillOfCommand, claudeProcess, recordSessionProcess, stoppedSessionMessage, openSkillBlockWindow, stoppingSkills, } from './log_config_files/runtime/skill_block_sessions.js';
 import { loadEndpointBase } from './log_config_files/sender/endpoint_config.js';
 import { agentAccessDecision, approvalId } from './agent_access/decision.js';
 import { launchAgentAccessWindow } from './agent_access/window_runner.js';
@@ -103,7 +103,9 @@ function titled(violationMessage) {
 function blockPayload(ide, violationMessage, windowShown = false) {
     const text = titled(violationMessage);
     if (ide === 'claude' || ide === 'copilot' || ide === 'opencode') {
-        return JSON.stringify({ decision: 'block', reason: text, systemMessage: text });
+        // Claude's hook skips its own alert too, and takes the field out before Claude Code reads it.
+        const flag = windowShown && ide === 'claude' ? { __optimus_window: true } : {};
+        return JSON.stringify({ decision: 'block', reason: text, systemMessage: text, ...flag });
     }
     return JSON.stringify({ continue: false, user_message: text, ...(windowShown ? { __optimus_window: true } : {}) });
 }
@@ -348,12 +350,6 @@ async function syncApprovals() {
         // Network or auth failure — fall back to local file state.
     }
 }
-/** Open the skill block window beside the block, in the background, when the sync sent its words. */
-function openSkillBlockWindow(skill) {
-    const words = skillBlockWindow(skill);
-    if (words)
-        launchAgentAccessWindow('claude', words);
-}
 /**
  * Skill block killswitch, Claude Code only for now: refuse the prompt of a session that loaded a
  * skill which is now blocked, or whose `claude` process did in an earlier session (a `/clear` keeps
@@ -372,16 +368,16 @@ function blockedBySkillBlock(agent, ide, sessionId) {
     const skills = stoppingSkills(sessionId, proc);
     if (skills.length > 0) {
         logRemediationApplyFailure('skill_block_session_stopped', { ide, agent, skills: skills.join(',') });
-        openSkillBlockWindow(skills[0]);
-        console.log(blockPayload(ide, stoppedSessionMessage(skills)));
+        const windowShown = openSkillBlockWindow(skills[0]);
+        console.log(blockPayload(ide, stoppedSessionMessage(skills), windowShown));
         return true;
     }
     const typed = blockedSkillOfCommand(process.env.OPTIMUS_PROMPT_FIRST_LINE || '', () => proc?.startedAt ?? null);
     if (!typed)
         return false;
     logRemediationApplyFailure('skill_block_command_refused', { ide, agent, skills: typed });
-    openSkillBlockWindow(typed);
-    console.log(blockPayload(ide, blockedCommandMessage(typed)));
+    const windowShown = openSkillBlockWindow(typed);
+    console.log(blockPayload(ide, blockedCommandMessage(typed), windowShown));
     return true;
 }
 /** Agents whose remediations are JSON files written to disk at once (no deferred SQLite apply). */

package/dist/log_config_files/runtime/remediation_sync.js

@@ -6,6 +6,7 @@ import { parseJsonWithJsoncFallback, parseTomlText, stringifyToml } from '../rea
 import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
 import { atomicWriteJson, getDeferredVscdbApplyPath, getFileCollectionVscdbContractPath, getRemediationInstructionsPath, readRemediationInstructionsFile, writeApprovedTenants, writeUnapprovedEmailDomains, writeAllowedEmailDomains, writeTeamEmailDomains, writeApprovedAgents, writeAgentAccessWindows, writeRemediationInstructionsFile, writeSkillBlockSessions, writeSkillBlockWindows, writeSkillBlocks, } from './management_storage.js';
 import { applySkillBlocks } from './skill_block.js';
+import { openQuarantineWindows } from './skill_block_sessions.js';
 import { readStoredAuthKey } from '../auth/auth_key_store.js';
 import { ensureAuthentication } from '../auth/auth_flow.js';
 import { createSignature } from '../sender/signing.js';
@@ -1711,7 +1712,9 @@ function enforceSkillBlocks(syncResult) {
     storeSkillBlockSessions(syncResult.skill_block_sessions);
     storeSkillBlockWindows(syncResult.skill_block_windows);
     try {
-        applySkillBlocks(entries);
+        const outcome = applySkillBlocks(entries);
+        // Tell the user when a skill is quarantined, whether or not a session of theirs loaded it.
+        openQuarantineWindows(outcome.quarantined, entries);
     }
     catch (err) {
         const msg = `skill_block_error: ${errorText(err)}`;

package/dist/log_config_files/runtime/skill_block.js

@@ -89,7 +89,7 @@ function makeStub(dir) {
     chmodSync(dir, 0o000);
 }
 /** Every file of `dir` with its hash, and every symlink with its target, sorted by path. */
-function hashFolder(dir, prefix = '') {
+function readFolderHashes(dir, prefix = '') {
     const files = [];
     for (const name of readdirSync(dir).sort()) {
         const full = join(dir, name);
@@ -98,7 +98,7 @@ function hashFolder(dir, prefix = '') {
         if (stat.isSymbolicLink())
             files.push({ path: rel, link: readlinkSync(full) });
         else if (stat.isDirectory())
-            files.push(...hashFolder(full, rel));
+            files.push(...readFolderHashes(full, rel));
         else if (stat.isFile()) {
             const sha256 = createHash('sha256').update(readFileSync(full)).digest('hex');
             files.push({ path: rel, sha256, size: stat.size });
@@ -153,7 +153,7 @@ function moveIn(dir, id, entry, outcome) {
         quarantined_at: new Date().toISOString(),
         mode: permissionBits(dir),
         status: 'moving',
-        files: hashFolder(dir),
+        files: readFolderHashes(dir),
     };
     writeReceipt(id, receipt);
     renameSync(dir, vaultPath(id));
@@ -191,7 +191,7 @@ function keepQuarantined(dir, id, receipt, home, outcome) {
         outcome.refused.push({ skill_dir: dir, reason });
         return;
     }
-    if (sameFiles(hashFolder(dir), receipt.files)) {
+    if (sameFiles(readFolderHashes(dir), receipt.files)) {
         rmSync(dir, { recursive: true, force: true });
     }
     else {
@@ -260,7 +260,7 @@ function restore(id, receipt, outcome) {
         return;
     }
     chmodSync(vault, receipt.mode);
-    if (!sameFiles(hashFolder(vault), receipt.files))
+    if (!sameFiles(readFolderHashes(vault), receipt.files))
         log(`skill_block: ${dir} changed in the vault; restored as it is`);
     mkdirSync(dirname(dir), { recursive: true });
     renameSync(vault, dir);

package/dist/log_config_files/runtime/skill_block_sessions.js

@@ -14,6 +14,7 @@ import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { basename } from 'node:path';
 import { atomicWriteJson, getSkillBlockProcessesPath, readRemediationInstructionsFile, } from './management_storage.js';
+import { launchAgentAccessWindow } from '../../agent_access/window_runner.js';
 import { quarantinedAt } from './skill_block.js';
 /** A process's parent, start time and command name, from `ps`; null when it cannot be read. */
 function processRow(pid) {
@@ -97,9 +98,7 @@ export function stoppingSkills(sessionId, proc = null) {
 /** The notice for a stopped session. */
 export function stoppedSessionMessage(skills) {
     const names = [...new Set(skills)].join(', ');
-    return (`Your organization blocked ${names}, which this Claude Code loaded (a /clear keeps it). Copy ` +
-        'anything you need from this conversation, then quit Claude Code and start it again to ' +
-        'continue. Resuming this session keeps it stopped.');
+    return `Your organization blocked ${names}. Quit Claude Code and start it again to clear this session's memory and continue.`;
 }
 /**
  * The blocked skill a typed slash command runs, when this process may still have it, or null:
@@ -114,7 +113,8 @@ export function blockedSkillOfCommand(promptFirstLine, processStartedAt = claude
     if (!command.startsWith('/'))
         return null;
     const typed = command.slice(command.lastIndexOf(':') + 1).replace(/^\//, '').toLowerCase();
-    const blocks = readRemediationInstructionsFile().skill_blocks ?? [];
+    // A plugin skill only: a running Claude Code drops a custom skill by itself once it is quarantined.
+    const blocks = (readRemediationInstructionsFile().skill_blocks ?? []).filter((b) => isPluginSkillDir(b.skill_dir));
     const hits = blocks.filter((b) => b.skill_name.toLowerCase() === typed || basename(b.skill_dir).toLowerCase() === typed);
     if (hits.length === 0)
         return null;
@@ -125,9 +125,18 @@ export function blockedSkillOfCommand(promptFirstLine, processStartedAt = claude
     });
     return mayStillHaveIt ? hits[0].skill_name || typed : null;
 }
+/**
+ * Whether `dir` is a Claude Code plugin's skill (`~/.claude/plugins/...`). Claude Code reads plugin
+ * skills once, when it starts, and keeps them until it quits, so a running one still offers a
+ * quarantined plugin skill. A custom skill (`~/.claude/skills`, a project's `.claude/skills`) is read
+ * again as its folder changes: Claude Code drops it at quarantine (docs/skill-block/DESIGN.md).
+ */
+export function isPluginSkillDir(dir) {
+    return dir.includes('/.claude/plugins/');
+}
 /** The notice for a typed command of a blocked skill in a process that may still have it. */
 export function blockedCommandMessage(skill) {
-    return `Your organization blocked ${skill}. Quit Claude Code and start it again to continue.`;
+    return `Your organization blocked ${skill}. Quit Claude Code and start it again to clear this session's memory and continue.`;
 }
 /**
  * The window to open beside the block of the skill named `skill` (a name `stoppingSkills` or
@@ -135,8 +144,47 @@ export function blockedCommandMessage(skill) {
  * server sent none, so only the one-line block shows.
  */
 export function skillBlockWindow(skill) {
+    const uuid = resourceUuidOf(skill);
+    return uuid ? readRemediationInstructionsFile().skill_block_windows?.[uuid] : undefined;
+}
+/** The resource uuid of the blocked skill named `skill`, from the synced lists; '' when unknown. */
+function resourceUuidOf(skill) {
     const file = readRemediationInstructionsFile();
     const name = skill.toLowerCase();
     const entry = [...(file.skill_block_sessions ?? []), ...(file.skill_blocks ?? [])].find((e) => e.resource_uuid && e.skill_name.toLowerCase() === name);
-    return entry ? file.skill_block_windows?.[entry.resource_uuid] : undefined;
+    return entry?.resource_uuid ?? '';
+}
+/** The skills this run already opened the window for, so a prompt that quarantines a skill and is
+ * refused for it opens one window, not two. */
+const windowsShown = new Set();
+/**
+ * Open the window of one blocked skill, by resource uuid, once per run. True when it is open: just
+ * started, or already started this run; false when the server sent no window for it.
+ */
+function openWindowOf(uuid) {
+    if (!uuid)
+        return false;
+    if (windowsShown.has(uuid))
+        return true;
+    const words = readRemediationInstructionsFile().skill_block_windows?.[uuid];
+    if (!words)
+        return false;
+    windowsShown.add(uuid);
+    return launchAgentAccessWindow('claude', words);
+}
+/** Open the window beside the block of the skill named `skill` (a stopped session, a typed command). */
+export function openSkillBlockWindow(skill) {
+    return openWindowOf(resourceUuidOf(skill));
+}
+/**
+ * Open the window for each skill this sync moved into quarantine (`dirs`, the folders it moved), so
+ * the user hears of it when it happens, even when no session of theirs is known to have loaded it
+ * (a typed command whose turn made no tool call reaches the server as nothing). One window per
+ * skill however many of its folders moved.
+ */
+export function openQuarantineWindows(dirs, entries) {
+    const moved = new Set(dirs);
+    const uuids = new Set(entries.filter((e) => moved.has(e.skill_dir)).map((e) => e.resource_uuid));
+    for (const uuid of uuids)
+        openWindowOf(uuid);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.38",
+  "version": "1.5.39",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {