@optimuslabs/harness-map-staging 1.5.42 → 1.5.44

package/dist/log_config_files/runtime/management_storage.js

@@ -90,6 +90,10 @@ export function getQuarantineDir() {
 export function getSkillBlockProcessesPath() {
     return join(getRemediationStateDir(), 'skill_block_processes.json');
 }
+/** The blocked skills the user was already shown the quarantine window for, per server. */
+export function getSkillBlockWindowsShownPath() {
+    return join(getRemediationStateDir(), 'skill_block_windows_shown.json');
+}
 export function getDeferredVscdbApplyPath() {
     return join(getVscdbStateDir(), DEFERRED_VSCDB_APPLY_BASENAME);
 }
@@ -173,6 +177,7 @@ const APPROVAL_LISTS = [
     'skill_blocks',
     'skill_block_sessions',
     'skill_block_windows',
+    'skill_block_group_window',
     'agent_access_windows',
 ];
 /** Each approval list from `file` when it names one, else the one on disk; absent ones left out. */
@@ -225,6 +230,10 @@ export function writeSkillBlocks(skill_blocks) {
 export function writeSkillBlockSessions(skill_block_sessions) {
     writeApprovalList({ skill_block_sessions });
 }
+/** Replace only the window for several blocked skills at once, keeping everything else on disk. */
+export function writeSkillBlockGroupWindow(skill_block_group_window) {
+    writeApprovalList({ skill_block_group_window });
+}
 /** Replace only the skill block windows, keeping everything else on disk. */
 export function writeSkillBlockWindows(skill_block_windows) {
     writeApprovalList({ skill_block_windows });

package/dist/log_config_files/runtime/remediation_sync.js

@@ -4,7 +4,7 @@ import { homedir } from 'node:os';
 import { executeBody } from '../../endpoint_client/http_transport.js';
 import { parseJsonWithJsoncFallback, parseTomlText, stringifyToml } from '../readers/file_readers.js';
 import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
-import { atomicWriteJson, getDeferredVscdbApplyPath, getFileCollectionVscdbContractPath, getRemediationInstructionsPath, readRemediationInstructionsFile, writeApprovedTenants, writeUnapprovedEmailDomains, writeAllowedEmailDomains, writeTeamEmailDomains, writeApprovedAgents, writeAgentAccessWindows, writeRemediationInstructionsFile, writeSkillBlockSessions, writeSkillBlockWindows, writeSkillBlocks, } from './management_storage.js';
+import { atomicWriteJson, getDeferredVscdbApplyPath, getFileCollectionVscdbContractPath, getRemediationInstructionsPath, readRemediationInstructionsFile, writeApprovedTenants, writeUnapprovedEmailDomains, writeAllowedEmailDomains, writeTeamEmailDomains, writeApprovedAgents, writeAgentAccessWindows, writeRemediationInstructionsFile, writeSkillBlockSessions, writeSkillBlockGroupWindow, writeSkillBlockWindows, writeSkillBlocks, } from './management_storage.js';
 import { applySkillBlocks } from './skill_block.js';
 import { openQuarantineWindows } from './skill_block_sessions.js';
 import { readStoredAuthKey } from '../auth/auth_key_store.js';
@@ -1695,11 +1695,17 @@ function storeSkillBlockWindows(windows) {
     }
     writeSkillBlockWindows(kept);
 }
+/** Keep the server's window for several skills at once; null when nothing is blocked. */
+function storeSkillBlockGroupWindow(words) {
+    if (words === undefined)
+        return;
+    writeSkillBlockGroupWindow(words && typeof words === 'object' && !Array.isArray(words) ? words : null);
+}
 /**
  * Store the server's skill blocks and make the folders on disk match them. An older server sends
  * no `skill_blocks`: the folders are then left as they are, never unlocked by mistake.
  */
-function enforceSkillBlocks(syncResult) {
+function enforceSkillBlocks(syncResult, endpointBase) {
     const blocks = syncResult.skill_blocks;
     if (!Array.isArray(blocks))
         return;
@@ -1711,10 +1717,11 @@ function enforceSkillBlocks(syncResult) {
     writeSkillBlocks(entries);
     storeSkillBlockSessions(syncResult.skill_block_sessions);
     storeSkillBlockWindows(syncResult.skill_block_windows);
+    storeSkillBlockGroupWindow(syncResult.skill_block_group_window);
     try {
         const outcome = applySkillBlocks(entries);
         // Tell the user when a skill is quarantined, whether or not a session of theirs loaded it.
-        openQuarantineWindows(outcome.quarantined, entries);
+        openQuarantineWindows(outcome.quarantined, entries, endpointBase);
     }
     catch (err) {
         const msg = `skill_block_error: ${errorText(err)}`;
@@ -1857,7 +1864,7 @@ export async function syncRemediations(endpointBase, machineUuid) {
         return;
     applyClearApplyTrackingUuids(syncResult.clear_apply_tracking_uuids);
     storeApprovals(syncResult);
-    enforceSkillBlocks(syncResult);
+    enforceSkillBlocks(syncResult, endpointBase);
     if (syncResult.status === 'unchanged') {
         await reconcileUnchanged(endpointBase, machineUuid, remediations, activeUuids);
         return;

package/dist/log_config_files/runtime/skill_block.js

@@ -9,8 +9,11 @@
  * and each file's hash, never its content); the vault entry is `chmod 000`, and an empty `chmod 000`
  * folder is left at the original path so that no app (Claude Code re-syncing account skills, a
  * plugin update) can put the skill back. A receipt whose folder is no longer listed is restored.
- * A folder is only ever moved when it is a real directory inside the home folder (never the home
- * folder itself) holding a SKILL.md, so a bad path cannot move anything that is not a skill.
+ * Any folder the inventory reported is quarantined, wherever it is, as long as it is a real
+ * directory holding a SKILL.md and never the home folder or a folder above it, so a bad path cannot
+ * move anything that is not a skill. The hooks run as the user, so a folder the user cannot move
+ * (owned by root) fails and is logged. A listed path that is a symlink quarantines the folder it
+ * points to (`quarantinePath`).
  */
 import { createHash } from 'node:crypto';
 import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
@@ -25,6 +28,30 @@ function log(message) {
 function permissionBits(path) {
     return lstatSync(path).mode & 0o7777;
 }
+/**
+ * The folder a listed path quarantines: the path itself, or, for a symlink, the folder it points to.
+ * The skills CLI (`npx skills add`) installs one copy in `~/.agents/skills/<name>` and links each
+ * agent's folder to it (`~/.claude/skills/<name>`), and a link was refused, so a skill the server
+ * knew only by its link stayed usable by every agent. Quarantining the folder behind the link closes
+ * it for every link and every agent reading it. A chain of more than eight links is left as it is,
+ * and refused.
+ */
+function quarantinePath(dir) {
+    let path = resolve(dir);
+    for (let hop = 0; hop < 8; hop++) {
+        const next = linkTarget(path);
+        if (next === null)
+            return path;
+        path = next;
+    }
+    return path;
+}
+/** Where the link at `path` leads, or null when `path` is not a link (missing ones included). */
+function linkTarget(path) {
+    if (!exists(path) || !lstatSync(path).isSymbolicLink())
+        return null;
+    return resolve(dirname(path), readlinkSync(path));
+}
 /** The vault id of an original path: one path, one entry. */
 function entryId(dir) {
     return createHash('sha256').update(resolve(dir)).digest('hex').slice(0, 16);
@@ -111,26 +138,31 @@ function sameFiles(a, b) {
 }
 /** When the folder at `dir` was quarantined, or null when it is not. */
 export function quarantinedAt(dir) {
-    const receipt = readReceipt(entryId(dir));
+    const receipt = readReceipt(entryId(quarantinePath(dir)));
     return receipt && receipt.status !== 'moving' ? receipt.quarantined_at : null;
 }
 /**
  * The receipt of the skill folder quarantined from `dir`, when the empty folder quarantine left
  * is still there. The collection reports such a path as quarantined: its skill cannot have changed
- * since it was moved, and the server keeps the copy it has.
+ * since it was moved, and the server keeps the copy it has. A link to a quarantined folder is
+ * reported the same way.
  */
 export function quarantineReceiptFor(dir) {
-    if (!isStub(resolve(dir)))
+    const path = quarantinePath(dir);
+    if (!isStub(path))
         return null;
-    const receipt = readReceipt(entryId(dir));
+    const receipt = readReceipt(entryId(path));
     return receipt && receipt.status !== 'moving' ? receipt : null;
 }
-/** Why `dir` must not be moved, or null when it is a real skill folder inside the home folder. */
+/**
+ * Why `dir` must not be moved, or null when it is a real skill folder. Any location the inventory
+ * reported can be moved (a project on another drive, a shared folder), except the home folder and
+ * the folders above it.
+ */
 export function refusalReason(dir, home = homedir()) {
-    const root = resolve(home);
     const target = resolve(dir);
-    if (!target.startsWith(root + sep))
-        return 'outside the home folder';
+    if (isHomeOrAbove(target, home))
+        return 'the home folder or above it';
     if (!existsSync(target))
         return 'missing';
     const stat = lstatSync(target);
@@ -138,12 +170,17 @@ export function refusalReason(dir, home = homedir()) {
         return 'symlink';
     if (!stat.isDirectory())
         return 'not a directory';
-    if (!realpathSync(target).startsWith(realpathSync(root) + sep))
-        return 'resolves outside the home folder';
+    if (isHomeOrAbove(realpathSync(target), realpathSync(home)))
+        return 'the home folder or above it';
     if (!existsSync(join(target, 'SKILL.md')))
         return 'no SKILL.md';
     return null;
 }
+/** Whether `dir` is the home folder or a folder that holds it (`/Users`, `/`). */
+function isHomeOrAbove(dir, home) {
+    const folder = dir.endsWith(sep) ? dir : dir + sep;
+    return (resolve(home) + sep).startsWith(folder);
+}
 /** Move a listed folder into the vault, with its receipt, and leave the empty folder behind. */
 function moveIn(dir, id, entry, outcome) {
     const receipt = {
@@ -203,9 +240,9 @@ function keepQuarantined(dir, id, receipt, home, outcome) {
     makeStub(dir);
     outcome.requarantined.push(dir);
 }
-/** Quarantine one listed folder, or keep it quarantined. */
+/** Quarantine one listed folder (the one a link points to), or keep it quarantined. */
 function quarantine(entry, home, outcome) {
-    const dir = resolve(entry.skill_dir);
+    const dir = quarantinePath(entry.skill_dir);
     const id = entryId(dir);
     let receipt = readReceipt(id);
     if (receipt?.status === 'moving') {
@@ -334,7 +371,7 @@ function releaseStateLock(lockPath) {
 }
 function applyUnderLock(entries, home, outcome) {
     releaseInPlaceLocks();
-    const wanted = new Set(entries.map((entry) => entryId(entry.skill_dir)));
+    const wanted = new Set(entries.map((entry) => entryId(quarantinePath(entry.skill_dir))));
     for (const entry of entries) {
         try {
             quarantine(entry, home, outcome);

package/dist/log_config_files/runtime/skill_block_sessions.js

@@ -11,9 +11,9 @@
  * of a process that ran a listed one. An unblock takes the sessions off the list.
  */
 import { execFileSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
 import { basename } from 'node:path';
-import { atomicWriteJson, getSkillBlockProcessesPath, readRemediationInstructionsFile, } from './management_storage.js';
+import { atomicWriteJson, getSkillBlockProcessesPath, getSkillBlockWindowsShownPath, readRemediationInstructionsFile, } from './management_storage.js';
 import { launchAgentAccessWindow } from '../../agent_access/window_runner.js';
 import { quarantinedAt } from './skill_block.js';
 /**
@@ -162,9 +162,85 @@ function resourceUuidOf(skill) {
 /** The skills this run already opened the window for, so a prompt that quarantines a skill and is
  * refused for it opens one window, not two. */
 const windowsShown = new Set();
+function readWindowsShown() {
+    try {
+        const path = getSkillBlockWindowsShownPath();
+        if (!existsSync(path))
+            return {};
+        const shown = JSON.parse(readFileSync(path, 'utf8'));
+        return shown && typeof shown === 'object' && !Array.isArray(shown) ? shown : {};
+    }
+    catch {
+        return {};
+    }
+}
+const lockWait = new Int32Array(new SharedArrayBuffer(4));
+/** Try once to take the lock: 'held', 'busy' (another run holds it), or 'none' (it cannot be made). */
+function takeWindowsLock(lock) {
+    try {
+        if (existsSync(lock) && Date.now() - statSync(lock).mtimeMs > 60_000)
+            unlinkSync(lock);
+        writeFileSync(lock, '', { flag: 'wx' });
+        return 'held';
+    }
+    catch (err) {
+        return err.code === 'EEXIST' ? 'busy' : 'none';
+    }
+}
+/**
+ * Run `decide` holding the lock on the remembered windows, so the gate and the runner of one prompt
+ * decide in turn and the second sees what the first opened. Waits up to two seconds while the other
+ * holds it; false, `decide` not run, when it still does. A lock a dead process left goes after a
+ * minute. When the lock cannot be made at all (no state folder), `decide` runs without it: a missing
+ * folder must not cost the user the window.
+ */
+function withWindowsLock(decide) {
+    const lock = `${getSkillBlockWindowsShownPath()}.lock`;
+    let taken = takeWindowsLock(lock);
+    for (let attempt = 1; attempt < 20 && taken === 'busy'; attempt++) {
+        Atomics.wait(lockWait, 0, 0, 100);
+        taken = takeWindowsLock(lock);
+    }
+    if (taken === 'busy')
+        return false;
+    const held = taken === 'held';
+    try {
+        const state = readWindowsShown();
+        const before = JSON.stringify(state);
+        decide(state);
+        if (JSON.stringify(state) !== before)
+            atomicWriteJson(getSkillBlockWindowsShownPath(), state);
+    }
+    finally {
+        try {
+            if (held)
+                unlinkSync(lock);
+        }
+        catch {
+            // Already gone; the next run takes it again.
+        }
+    }
+    return true;
+}
+/**
+ * Open `words` as this prompt's one skill window: 'shown', 'taken' when this prompt (this run, or
+ * the other process of the same prompt) already opened one, or 'failed' when it could not open.
+ */
+function openForPrompt(words, state) {
+    // The prompt's story id when the hook gave one (the gate and the runner share it), else this run.
+    const prompt = (process.env.OPTIMUS_STORY_ID || '').trim();
+    if (prompt ? state.prompt === prompt : windowsShown.size > 0)
+        return 'taken';
+    if (!launchAgentAccessWindow('claude', 'skill', words))
+        return 'failed';
+    if (prompt)
+        state.prompt = prompt;
+    return 'shown';
+}
 /**
- * Open the window of one blocked skill, by resource uuid, once per run. True when it is open: just
- * started, or already started this run; false when the server sent no window for it.
+ * Open the window of one blocked skill, by resource uuid, beside a refusal. True when it is open:
+ * just started, or already started this run; false when the server sent no window for it, or this
+ * prompt already showed another skill's window (the hook then shows its one-line alert).
  */
 function openWindowOf(uuid) {
     if (!uuid)
@@ -174,22 +250,76 @@ function openWindowOf(uuid) {
     const words = readRemediationInstructionsFile().skill_block_windows?.[uuid];
     if (!words)
         return false;
-    windowsShown.add(uuid);
-    return launchAgentAccessWindow('claude', 'skill', words);
+    let open = false;
+    withWindowsLock((state) => {
+        open = openForPrompt(words, state) === 'shown';
+    });
+    if (open)
+        windowsShown.add(uuid);
+    return open;
 }
 /** Open the window beside the block of the skill named `skill` (a stopped session, a typed command). */
 export function openSkillBlockWindow(skill) {
     return openWindowOf(resourceUuidOf(skill));
 }
 /**
- * Open the window for each skill this sync moved into quarantine (`dirs`, the folders it moved), so
- * the user hears of it when it happens, even when no session of theirs is known to have loaded it
- * (a typed command whose turn made no tool call reaches the server as nothing). One window per
- * skill however many of its folders moved.
+ * The words for a window opened because the skills in `uuids` were newly blocked (at least one). It
+ * lists every skill the server blocks on this machine (`entries`), not only the new ones, so the
+ * user sees the whole list each time: the skill's own window when that is one skill, else the
+ * server's window for several, its red box listing each by name. An older server sends no window
+ * for several: the first new skill's own window then stands for them.
  */
-export function openQuarantineWindows(dirs, entries) {
+function quarantineWords(uuids, entries) {
+    const file = readRemediationInstructionsFile();
+    const own = file.skill_block_windows ?? {};
+    const names = [...new Set(entries.map((e) => e.skill_name))];
+    const first = uuids.map((uuid) => own[uuid]).find(Boolean);
+    const group = file.skill_block_group_window;
+    if (names.length < 2 || !group)
+        return first;
+    const reason = (group.reason && typeof group.reason === 'object' ? group.reason : {});
+    const label = typeof group.group_skill_label === 'string' ? group.group_skill_label : '';
+    const findings = [...names].sort().map((name) => ({ severity: 'unknown', label, text: name }));
+    return { ...group, reason: { ...reason, findings } };
+}
+/**
+ * Open the window for the skills this sync moved into quarantine (`dirs`, the folders it moved), so
+ * the user hears of a block when it happens, even when no session of theirs is known to have loaded
+ * the skill (a typed command whose turn made no tool call reaches the server as nothing).
+ *
+ * One window per prompt, listing every skill blocked on the machine (the ones told about before
+ * too), and the gate and the runner of the same prompt open at most one between them. A window
+ * opens only when a skill is newly blocked, once per skill, by name: a
+ * blocked skill gains folders after its block (Claude Desktop copies its skills into a new folder
+ * for each session, one skill is in several agents' folders, and each version of a skill is a
+ * resource of its own, so `docx` can be several), and each new folder is quarantined by a later
+ * sync. The skills told about are remembered per `server` (resource uuids are the server's own,
+ * and a machine can sync with more than one), and forgotten once that server no longer blocks
+ * them, so a block after an unblock is told again. Skills newly blocked by the second sync of a
+ * prompt that already had its window are counted as told.
+ */
+export function openQuarantineWindows(dirs, entries, server) {
     const moved = new Set(dirs);
-    const uuids = new Set(entries.filter((e) => moved.has(e.skill_dir)).map((e) => e.resource_uuid));
-    for (const uuid of uuids)
-        openWindowOf(uuid);
+    withWindowsLock((state) => {
+        const nameOf = new Map(entries.map((e) => [e.resource_uuid, e.skill_name.toLowerCase()]));
+        const servers = state.servers ?? {};
+        const shown = Object.fromEntries(Object.entries(servers[server] ?? {}).filter(([uuid]) => nameOf.has(uuid)));
+        const toldNames = new Set(Object.keys(shown).map((uuid) => nameOf.get(uuid)));
+        const newly = [...new Set(entries.filter((e) => moved.has(e.skill_dir)).map((e) => e.resource_uuid))].filter((uuid) => !shown[uuid]);
+        const now = new Date().toISOString();
+        const fresh = newly.filter((uuid) => !toldNames.has(nameOf.get(uuid)));
+        // Another folder or version of a skill already told about: no window.
+        for (const uuid of newly)
+            if (!fresh.includes(uuid))
+                shown[uuid] = now;
+        const words = fresh.length > 0 ? quarantineWords(fresh, entries) : undefined;
+        const outcome = words ? openForPrompt(words, state) : 'failed';
+        // Told when this prompt's window shows them, or another one already did; not when none opened.
+        for (const uuid of outcome === 'failed' ? [] : fresh)
+            shown[uuid] = now;
+        if (outcome === 'shown')
+            fresh.forEach((uuid) => windowsShown.add(uuid));
+        servers[server] = shown;
+        state.servers = servers;
+    });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.42",
+  "version": "1.5.44",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {