log-llm-config-staging 1.3.44

package/dist/endpoint_client/startup_api.js

@@ -0,0 +1,43 @@
+import { executeBody } from './http_transport.js';
+export const postStartupPayload = async (endpointUrl, body, timeoutMs = 5000) => {
+    const payload = JSON.stringify(body);
+    const { statusCode, statusMessage, body: responseBody } = await executeBody(endpointUrl, 'POST', payload, timeoutMs);
+    if (statusCode >= 400) {
+        const msg = statusCode === 413
+            ? `413 Request Entity Too Large: ${responseBody.substring(0, 200)}`
+            : `HTTP ${statusCode} ${statusMessage}: ${responseBody.substring(0, 200)}`;
+        throw new Error(msg);
+    }
+    if (!responseBody)
+        return { status: 'error', message: 'Empty response from endpoint' };
+    try {
+        return JSON.parse(responseBody);
+    }
+    catch (error) {
+        throw new Error(`Failed to parse endpoint response (${error.message}): ${responseBody}`);
+    }
+};
+export const patchPayload = async (endpointUrl, body, timeoutMs = 10000) => {
+    const payload = JSON.stringify(body);
+    const { body: responseBody } = await executeBody(endpointUrl, 'PATCH', payload, timeoutMs);
+    if (!responseBody)
+        return { status: 'error', error: 'empty_response' };
+    try {
+        return JSON.parse(responseBody);
+    }
+    catch {
+        throw new Error(`Invalid JSON: ${responseBody.slice(0, 200)}`);
+    }
+};
+export const classifyEndpointResponse = (response) => {
+    if (response.status === 'key_issued' && response.key) {
+        return { branch: 'key_issued', message: 'Server issued a new symmetric key; store it for future signatures.', key: response.key, keyId: response.key_id };
+    }
+    if (response.status === 'accepted' && response.signature_valid) {
+        return { branch: 'accepted', message: 'Startup payload accepted and signature verified.' };
+    }
+    if (response.status === 'error' && response.error) {
+        return { branch: 'error', message: response.error };
+    }
+    return { branch: 'error', message: response.message || 'Endpoint returned an unexpected response.' };
+};

package/dist/endpoint_client/types.js

@@ -0,0 +1,4 @@
+/** Path suffix for file collection patterns (backend: api/file-path-registry/file-patterns/). */
+export const FILE_PATH_REGISTRY_FILE_PATTERNS_PATH = '/api/file-path-registry/file-patterns/';
+/** Path suffix for sensitive paths audit candidates (backend: api/file-path-registry/sensitive-paths-audit-candidates/). */
+export const FILE_PATH_REGISTRY_SENSITIVE_PATHS_PATH = '/api/file-path-registry/sensitive-paths-audit-candidates/';

package/dist/execute_trusted_restarts.js

@@ -0,0 +1,54 @@
+/**
+ * CLI: read one JSON line from stdin (same shape as compliance_prompt_gate stdout for __optimus_autofix),
+ * parse restart_commands[], allowlist each in TS, spawn detached. Invoked by optimus-compliance-check.sh only.
+ * stderr stays quiet; failures logged via hookRunLog.
+ */
+import { readFileSync } from 'node:fs';
+import { isThisCliModule } from './cli_invocation_match.js';
+import { appendComplianceRunnerLine, hookRunLog } from './log_config_files/runtime/hook_logger.js';
+import { executeTrustedRestartCommands } from './log_config_files/runtime/trusted_restarts.js';
+/** Invoked by dist entrypoint or by `npx log-llm-config@latest execute-trusted-restarts` (cli.js dispatches here). */
+export function runExecuteTrustedRestartsFromStdin() {
+    let raw;
+    try {
+        raw = readFileSync(0, 'utf8');
+    }
+    catch {
+        const msg = 'execute_trusted_restarts: could not read stdin';
+        hookRunLog(msg);
+        appendComplianceRunnerLine('RESTART', msg);
+        return;
+    }
+    const first = raw.trim().split(/\r?\n/)[0]?.trim() ?? '';
+    if (!first) {
+        appendComplianceRunnerLine('RESTART', 'empty stdin — no restart_commands');
+        return;
+    }
+    let j;
+    try {
+        j = JSON.parse(first);
+    }
+    catch {
+        const msg = 'execute_trusted_restarts: stdin is not valid JSON';
+        hookRunLog(msg);
+        appendComplianceRunnerLine('RESTART', msg);
+        return;
+    }
+    const cmds = j.restart_commands;
+    if (!Array.isArray(cmds)) {
+        appendComplianceRunnerLine('RESTART', 'JSON missing restart_commands array — nothing to run');
+        return;
+    }
+    const strings = cmds.filter((c) => typeof c === 'string');
+    appendComplianceRunnerLine('RESTART', `stdin ok restart_commands=${strings.length}`);
+    executeTrustedRestartCommands(strings);
+}
+if (isThisCliModule(process.argv[1], import.meta.url)) {
+    try {
+        runExecuteTrustedRestartsFromStdin();
+    }
+    catch (e) {
+        hookRunLog(`execute_trusted_restarts: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    process.exit(0);
+}

package/dist/log_config_files/auth/auth_flow.js

@@ -0,0 +1,22 @@
+import path from 'node:path';
+import { postStartupPayload } from '../../endpoint_client/index.js';
+import { ensureAuthentication as ensureTofuAuthentication } from 'optimus-tofu-staging';
+import { loadEndpointBase } from '../sender/endpoint_config.js';
+import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
+import { hookRunLog } from '../runtime/hook_logger.js';
+const AUTH_KEY_RELATIVE_PATH = path.join(OPT_AI_SEC_MANAGEMENT_REL, 'auth_key.txt');
+/** Ensure authentication — verify stored key or request new one via handshake. */
+async function ensureAuthentication(hardwareUuid) {
+    const key = await ensureTofuAuthentication({
+        hardwareUuid,
+        endpointBase: loadEndpointBase(),
+        authRelativePath: AUTH_KEY_RELATIVE_PATH,
+        postJson: (endpointUrl, body) => postStartupPayload(endpointUrl, body),
+        onLog: (message) => {
+            if (message.startsWith('auth:'))
+                hookRunLog(message);
+        },
+    });
+    return key;
+}
+export { ensureAuthentication };

package/dist/log_config_files/auth/auth_key_store.js

@@ -0,0 +1,14 @@
+import path from 'node:path';
+import { getAuthKeyPath as getSharedAuthKeyPath, readStoredAuthKey as readSharedStoredAuthKey, } from 'optimus-tofu-staging';
+import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
+const AUTH_KEY_RELATIVE_PATH = path.join(OPT_AI_SEC_MANAGEMENT_REL, 'auth_key.txt');
+const AUTH_KEY_OPTIONS = { authRelativePath: AUTH_KEY_RELATIVE_PATH };
+/** Return absolute path to auth_key.txt, or null if home dir is unavailable. */
+function getAuthKeyPath() {
+    return getSharedAuthKeyPath(AUTH_KEY_OPTIONS);
+}
+/** Read and parse the stored auth key, or return null if absent/unreadable. */
+function readStoredAuthKey() {
+    return readSharedStoredAuthKey(AUTH_KEY_OPTIONS);
+}
+export { getAuthKeyPath, readStoredAuthKey };

package/dist/log_config_files/collection/config_collector.js

@@ -0,0 +1,160 @@
+import { existsSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { readJSONFile, readMCPConfig, readMarkdownFile, readInstalledExtensions } from '../readers/file_readers.js';
+import { getExtensionsCachePath, getExtensionsCacheInstalledSuffix, getVscdbPath } from '../paths/path_constants_helpers.js';
+import { resolvePatternToTargets, normalizePathSkipPrefixes } from '../paths/pattern_resolver.js';
+import { enrichRawFromRecipe } from './enrichment_helpers.js';
+import { collectDirectoryEntries, collectDirectoryMetadata } from './directory_collector.js';
+import { collectVscdbEntries } from '../readers/vscdb_config_builder.js';
+import { pushDerivedFilesFromRecipe } from './openclaw_helpers.js';
+function buildCollectionContext(patterns, projectRoot, home, homeRecurseSkipDirs = [], absolutePathPrefixes = [], mcpToolGlobSpec = null, clientPathConstants = null, pathResolutionSpecs = null) {
+    const seenPaths = new Set();
+    const targets = [];
+    const enrichByFileType = {};
+    const metadataOnlyFileTypes = new Set(patterns.filter((p) => p.collect_style === 'metadata').map((p) => p.file_type));
+    if (metadataOnlyFileTypes.size === 0)
+        metadataOnlyFileTypes.add('claude_log');
+    for (const p of patterns) {
+        if (p.enrich && !enrichByFileType[p.file_type])
+            enrichByFileType[p.file_type] = p.enrich;
+    }
+    for (const p of patterns) {
+        const pathSkipPrefixes = p.path_resolution === 'mcp_tool_glob' ? normalizePathSkipPrefixes(p.path_skip_prefixes) : [];
+        for (const t of resolvePatternToTargets(p.path, p.type, p.file_type, projectRoot, home, pathSkipPrefixes, p.collect_style, p.content_format, p.dir_glob, homeRecurseSkipDirs, p.path_resolution, p.resolve_under_home !== false, absolutePathPrefixes, mcpToolGlobSpec, clientPathConstants, pathResolutionSpecs)) {
+            if (p.raw_key)
+                t.raw_key = p.raw_key;
+            if (p.dir_subdir_filename)
+                t.dir_subdir_filename = p.dir_subdir_filename;
+            if (p.dir_subdir_source)
+                t.dir_subdir_source = p.dir_subdir_source;
+            const key = `${t.path}\t${t.file_type}`;
+            if (!seenPaths.has(key)) {
+                seenPaths.add(key);
+                targets.push(t);
+            }
+        }
+    }
+    return { targets, enrichByFileType, metadataOnlyFileTypes };
+}
+function readContentByFormat(path, format) {
+    if (format === 'markdown' || format === 'text')
+        return readMarkdownFile(path);
+    if (format === 'sqlite_vscdb')
+        return null; // handled upstream by collectVscdbEntries
+    // json (default) — fall back to markdown for .md files from agents not yet annotated
+    return readJSONFile(path) ?? readMCPConfig(path) ?? (path.endsWith('.md') ? readMarkdownFile(path) : null);
+}
+function collectRegularFileEntry(t, enrichByFileType) {
+    const format = t.content_format || 'json';
+    let content = readContentByFormat(t.path, format);
+    if (content === null)
+        return null;
+    // For JSON-format files, backend/policy engine expect raw_content to be the parsed object (e.g. permissions.allow)
+    if (format === 'json' && typeof content === 'string') {
+        try {
+            content = JSON.parse(content);
+        }
+        catch {
+            // leave as string if parse fails
+        }
+    }
+    let raw;
+    if (t.raw_key && typeof content === 'string') {
+        raw = { [t.raw_key]: content };
+    }
+    else {
+        raw = typeof content === 'string' ? { content, source: 'file' } : content;
+    }
+    const recipe = enrichByFileType[t.file_type];
+    if (recipe)
+        enrichRawFromRecipe(raw, recipe);
+    return { file_type: t.file_type, file_path: t.logicalFilePath ?? t.path, raw_content: raw };
+}
+function collectMetadataEntry(t) {
+    try {
+        const stats = statSync(t.path);
+        return { file_type: t.file_type, file_path: t.logicalFilePath ?? t.path, raw_content: { filename: t.path, last_modified: stats.mtime.toISOString(), source: 'file_metadata' }, collect_style: 'metadata' };
+    }
+    catch (err) {
+        console.warn(`Error stating ${t.path}:`, err instanceof Error ? err.message : String(err));
+        return null;
+    }
+}
+function handleInstalledExtensions(handledSpecialPaths, configFiles, extensionsCachePath, pathConstants) {
+    if (handledSpecialPaths.has(extensionsCachePath))
+        return;
+    handledSpecialPaths.add(extensionsCachePath);
+    const installed = readInstalledExtensions(extensionsCachePath);
+    const suffix = getExtensionsCacheInstalledSuffix(pathConstants);
+    if (installed.length > 0)
+        configFiles.push({ file_type: 'cursor_extensions', file_path: `${extensionsCachePath}${suffix}`, raw_content: { installedExtensions: installed, source: 'extensions.user.cache', extracted_at: new Date().toISOString() } });
+}
+function collectConfigFilesFromPatterns(patterns, projectRoot, onProgress, options) {
+    // Prefer process.env.HOME so hook invoker (e.g. Cursor) can pass real home when it differs from os.homedir()
+    const home = (process.env.HOME && process.env.HOME.trim()) || homedir();
+    const pathConstants = options?.client_path_constants;
+    if (!pathConstants)
+        throw new Error('client_path_constants required from API response but not provided');
+    const vscdbPath = getVscdbPath(home, pathConstants);
+    const extensionsCachePath = getExtensionsCachePath(home, pathConstants);
+    const extensionsInstalledSuffix = getExtensionsCacheInstalledSuffix(pathConstants);
+    const { targets, enrichByFileType, metadataOnlyFileTypes } = buildCollectionContext(patterns, projectRoot, home, options?.home_recurse_skip_dirs ?? [], options?.absolute_path_prefixes ?? [], options?.mcp_tool_glob_spec ?? null, pathConstants, options?.path_resolution_specs ?? null);
+    const configFiles = [];
+    const handledSpecialPaths = new Set();
+    const loggedFileTypes = new Set();
+    const vscdbEntrySpecs = options?.vscdbEntrySpecs;
+    const vscdbReadQueries = options?.vscdb_read_queries;
+    const vscdbMergeFromComposerState = options?.vscdb_merge_from_composer_state;
+    for (const t of targets) {
+        if (onProgress && !loggedFileTypes.has(t.file_type)) {
+            loggedFileTypes.add(t.file_type);
+            onProgress(`scanning file_type=${t.file_type}`);
+        }
+        if (t.isDirectory) {
+            if (metadataOnlyFileTypes.has(t.file_type) || t.collect_style === 'metadata') {
+                const entry = collectDirectoryMetadata(t);
+                if (entry)
+                    configFiles.push(entry);
+            }
+            else {
+                configFiles.push(...collectDirectoryEntries(t));
+            }
+            continue;
+        }
+        if (extensionsInstalledSuffix && t.path.includes(extensionsInstalledSuffix)) {
+            handleInstalledExtensions(handledSpecialPaths, configFiles, extensionsCachePath, pathConstants);
+            continue;
+        }
+        if (t.path === vscdbPath || t.path.startsWith(vscdbPath + '#')) {
+            if (!handledSpecialPaths.has(vscdbPath)) {
+                handledSpecialPaths.add(vscdbPath);
+                configFiles.push(...collectVscdbEntries(vscdbPath, vscdbEntrySpecs, vscdbReadQueries, vscdbMergeFromComposerState));
+            }
+            continue;
+        }
+        if (!existsSync(t.path))
+            continue;
+        if ((metadataOnlyFileTypes.has(t.file_type) || t.collect_style === 'metadata') && !t.isDirectory) {
+            const entry = collectMetadataEntry(t);
+            if (entry)
+                configFiles.push(entry);
+            continue;
+        }
+        const entry = collectRegularFileEntry(t, enrichByFileType);
+        if (entry) {
+            configFiles.push(entry);
+            const recipe = enrichByFileType[t.file_type];
+            if (recipe?.derived_files?.length)
+                pushDerivedFilesFromRecipe(entry.raw_content, configFiles, recipe);
+        }
+    }
+    return configFiles;
+}
+// ─── Re-exports (barrel for public API) ──────────────────────────────────────
+export { collectConfigFilesFromPatterns };
+export { collectMcpToolFiles } from './mcp_tool_collector.js';
+export { collectConfigFilesFromInstalledPlugins } from './plugin_collector.js';
+export { determineFileTypeFromPath } from './file_type_rules.js';
+export { enrichRawFromRecipe } from './enrichment_helpers.js';
+export { pushDerivedFilesFromRecipe } from './openclaw_helpers.js';
+export { getByPath } from './enrichment_helpers.js';

package/dist/log_config_files/collection/directory_collector.js

@@ -0,0 +1,96 @@
+import { existsSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { readJSONFile, readMarkdownFile } from '../readers/file_readers.js';
+function collectSubdirMdFiles(dirPath, fileType, mdFilename, source) {
+    const results = [];
+    try {
+        for (const entry of readdirSync(dirPath, { withFileTypes: true })) {
+            if (!entry.isDirectory())
+                continue;
+            const mdPath = join(dirPath, entry.name, mdFilename);
+            if (!existsSync(mdPath))
+                continue;
+            const content = readMarkdownFile(mdPath);
+            if (content !== null)
+                results.push({ file_type: fileType, file_path: mdPath, raw_content: { content, source } });
+        }
+    }
+    catch (err) {
+        console.warn(`Error reading ${dirPath}:`, err instanceof Error ? err.message : String(err));
+    }
+    return results;
+}
+function collectDirectoryEntries(t) {
+    if (!existsSync(t.path))
+        return [];
+    const results = [];
+    const glob = t.dir_glob || '*.md';
+    const matchName = (name) => glob.startsWith('*') ? name.endsWith(glob.slice(1)) : name === glob;
+    try {
+        const entries = readdirSync(t.path, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isFile() || !matchName(entry.name))
+                continue;
+            const fullPath = join(t.path, entry.name);
+            // Prefer parsed JSON for .json files so backend/policy engine see top-level keys (e.g. permissions.allow)
+            const content = entry.name.endsWith('.json')
+                ? readJSONFile(fullPath) ?? readMarkdownFile(fullPath)
+                : readMarkdownFile(fullPath) ?? readJSONFile(fullPath);
+            if (content !== null) {
+                const raw = typeof content === 'string' ? { content, source: 'file' } : content;
+                results.push({ file_type: t.file_type, file_path: fullPath, raw_content: raw });
+            }
+        }
+        if (t.dir_subdir_filename && t.dir_subdir_source) {
+            results.push(...collectSubdirMdFiles(t.path, t.file_type, t.dir_subdir_filename, t.dir_subdir_source));
+        }
+    }
+    catch (err) {
+        console.warn(`Error reading directory ${t.path}:`, err instanceof Error ? err.message : String(err));
+    }
+    return results;
+}
+/**
+ * For metadata-style DIR targets: scan files matching dir_glob, return one entry
+ * with the highest mtime found. Falls back to the directory's own mtime if no files match.
+ */
+function collectDirectoryMetadata(t) {
+    try {
+        const dirStat = statSync(t.path);
+        let bestMtime = dirStat.mtime;
+        let bestPath = t.path;
+        const glob = t.dir_glob ?? '*';
+        const matchName = (name) => {
+            if (glob === '*')
+                return true;
+            if (glob.startsWith('*.'))
+                return name.endsWith(glob.slice(1));
+            return name === glob;
+        };
+        try {
+            for (const entry of readdirSync(t.path, { withFileTypes: true })) {
+                if (!entry.isFile() || !matchName(entry.name))
+                    continue;
+                try {
+                    const fileStat = statSync(join(t.path, entry.name));
+                    if (fileStat.mtime > bestMtime) {
+                        bestMtime = fileStat.mtime;
+                        bestPath = join(t.path, entry.name);
+                    }
+                }
+                catch { /* ignore unreadable files */ }
+            }
+        }
+        catch { /* ignore unreadable dir */ }
+        return {
+            file_type: t.file_type,
+            file_path: bestPath,
+            raw_content: { filename: bestPath, last_modified: bestMtime.toISOString(), source: 'file_metadata' },
+            collect_style: 'metadata',
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export { collectDirectoryEntries, collectDirectoryMetadata };

package/dist/log_config_files/collection/enrichment_helpers.js

@@ -0,0 +1,53 @@
+import { join } from 'node:path';
+import { readJSONFile } from '../readers/file_readers.js';
+function getByPath(obj, dotPath) {
+    let cur = obj;
+    for (const part of dotPath.split('.')) {
+        if (cur == null || typeof cur !== 'object')
+            return undefined;
+        cur = cur[part];
+    }
+    return cur;
+}
+function resolveEntryVersion(e, vf) {
+    const v = e.version;
+    if (v !== undefined && v !== null && (typeof v !== 'string' || v.trim() !== ''))
+        return;
+    const basePath = (e.installPath?.trim() || e.sourcePath?.trim());
+    if (!basePath || !vf.version_key)
+        return;
+    const pkg = readJSONFile(join(basePath, 'package.json'));
+    const versionVal = pkg ? pkg[vf.version_key] : undefined;
+    if (typeof versionVal === 'string')
+        e.version = versionVal.trim();
+}
+function enrichRawFromRecipe(raw, recipe) {
+    const installsPath = recipe.installs_path ?? recipe.installs_path_fallback;
+    if (!installsPath)
+        return;
+    let installs = getByPath(raw, installsPath);
+    if (!installs && recipe.installs_path_fallback && recipe.installs_path_fallback !== installsPath) {
+        installs = getByPath(raw, recipe.installs_path_fallback);
+    }
+    if (!installs || !recipe.version_from_file?.version_key)
+        return;
+    const vf = recipe.version_from_file;
+    if (recipe.installs_shape === 'array' && Array.isArray(installs)) {
+        for (const entry of installs) {
+            if (typeof entry === 'object' && entry !== null)
+                resolveEntryVersion(entry, vf);
+        }
+    }
+    else if (typeof installs === 'object' && installs !== null) {
+        for (const key of Object.keys(installs)) {
+            const entry = installs[key];
+            if (typeof entry === 'object' && entry !== null) {
+                const e = entry;
+                if (recipe.installs_shape === 'object' && !('id' in e && e.id != null))
+                    e.id = key;
+                resolveEntryVersion(e, vf);
+            }
+        }
+    }
+}
+export { getByPath, enrichRawFromRecipe };

package/dist/log_config_files/collection/file_type_rules.js

@@ -0,0 +1,47 @@
+/**
+ * File type detection from path — API-driven only.
+ *
+ * The backend (file_path_registry) is the single source of truth for path → file_type.
+ * This module matches a concrete path against the patterns returned by the file collection API;
+ * no hardcoded path rules. When patterns are missing (e.g. API unavailable), returns null.
+ */
+/**
+ * Determine file_type for a path using API patterns only (longest match wins).
+ * Returns null if patterns are missing/empty or no pattern matches.
+ */
+export function determineFileTypeFromPath(filePath, patterns) {
+    if (!filePath || !patterns?.length)
+        return null;
+    const norm = filePath.replace(/\\/g, '/');
+    // API patterns are already ordered by descending pattern length (backend).
+    for (const p of patterns) {
+        const pat = p.path.replace(/\\/g, '/').replace(/^~\/?/, '');
+        if (!pat)
+            continue;
+        if (pat.includes('*')) {
+            if (matchGlob(norm, pat))
+                return p.file_type;
+        }
+        else {
+            if (norm === pat || norm.endsWith('/' + pat) || norm.includes(pat))
+                return p.file_type;
+        }
+    }
+    return null;
+}
+/** Simple glob: * = one segment, ** = any path. */
+function matchGlob(path, pattern) {
+    const re = pattern
+        .replace(/\\/g, '/')
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replace(/\*\*/g, '\u0001')
+        .replace(/\*/g, '[^/]*')
+        .replace(/\u0001/g, '.*');
+    try {
+        const regex = new RegExp(re);
+        return regex.test(path);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/log_config_files/collection/mcp_tool_collector.js

@@ -0,0 +1,37 @@
+import { existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { readJSONFile } from '../readers/file_readers.js';
+import { normalizePathSkipPrefixes } from '../paths/pattern_resolver.js';
+import { getCursorProjectsPath } from '../paths/path_constants_helpers.js';
+function collectMcpToolFiles(pathSkipPrefixes = [], constants) {
+    const result = [];
+    const skipPrefixes = normalizePathSkipPrefixes(pathSkipPrefixes);
+    const cursorProjectsPath = getCursorProjectsPath(homedir(), constants);
+    try {
+        if (!existsSync(cursorProjectsPath))
+            return result;
+        for (const projectDir of readdirSync(cursorProjectsPath, { withFileTypes: true }).filter((d) => d.isDirectory())) {
+            if (skipPrefixes.some((p) => projectDir.name.startsWith(p)))
+                continue;
+            const mcpsPath = join(cursorProjectsPath, projectDir.name, 'mcps');
+            if (!existsSync(mcpsPath))
+                continue;
+            for (const serverDir of readdirSync(mcpsPath, { withFileTypes: true }).filter((d) => d.isDirectory())) {
+                const toolsPath = join(mcpsPath, serverDir.name, 'tools');
+                if (!existsSync(toolsPath))
+                    continue;
+                for (const toolFile of readdirSync(toolsPath).filter((n) => n.endsWith('.json'))) {
+                    const content = readJSONFile(join(toolsPath, toolFile));
+                    if (content)
+                        result.push({ file_type: 'mcp_tool', file_path: `${projectDir.name}/mcps/${serverDir.name}/tools/${toolFile}`, raw_content: content });
+                }
+            }
+        }
+    }
+    catch (error) {
+        console.warn('Error collecting MCP tool files:', error instanceof Error ? error.message : String(error));
+    }
+    return result;
+}
+export { collectMcpToolFiles };

package/dist/log_config_files/collection/openclaw_helpers.js

@@ -0,0 +1,55 @@
+import { join } from 'node:path';
+import { readJSONFile } from '../readers/file_readers.js';
+import { getByPath } from './enrichment_helpers.js';
+function getInstallsEntries(raw, recipe) {
+    const installsPath = recipe.installs_path ?? recipe.installs_path_fallback;
+    if (!installsPath)
+        return [];
+    let installs = getByPath(raw, installsPath);
+    if (!installs && recipe.installs_path_fallback && recipe.installs_path_fallback !== installsPath) {
+        installs = getByPath(raw, recipe.installs_path_fallback);
+    }
+    if (!installs)
+        return [];
+    if (Array.isArray(installs)) {
+        return installs.filter((e) => typeof e === 'object' && e !== null);
+    }
+    if (typeof installs === 'object' && installs !== null) {
+        return Object.values(installs).filter((e) => typeof e === 'object' && e !== null);
+    }
+    return [];
+}
+function resolvePathFromTemplate(entry, pathTemplate) {
+    const installPath = entry.installPath?.trim() ?? '';
+    const sourcePath = entry.sourcePath?.trim() ?? '';
+    return pathTemplate
+        .replace(/\{\{installPath\}\}/g, installPath)
+        .replace(/\{\{sourcePath\}\}/g, sourcePath);
+}
+/**
+ * For file types whose enrich recipe has derived_files: from each install entry in raw,
+ * resolve path from path_template ({{installPath}}, {{sourcePath}}), read file, push with recipe file_type.
+ * Driven by backend FILE_TYPE_ENRICHMENT.derived_files; no openclaw-specific logic here.
+ */
+function pushDerivedFilesFromRecipe(raw, configFiles, recipe) {
+    const derived = recipe.derived_files;
+    if (!derived?.length)
+        return;
+    const entries = getInstallsEntries(raw, recipe);
+    for (const entry of entries) {
+        for (const spec of derived) {
+            let path = resolvePathFromTemplate(entry, spec.path_template).replace(/\/+/g, '/').trim();
+            if (!path && spec.path_template_fallback) {
+                path = resolvePathFromTemplate(entry, spec.path_template_fallback).replace(/\/+/g, '/').trim();
+            }
+            if (!path)
+                continue;
+            const fullPath = path.startsWith('/') ? path : join(process.cwd(), path);
+            const content = readJSONFile(fullPath);
+            if (content !== null) {
+                configFiles.push({ file_type: spec.file_type, file_path: fullPath, raw_content: content });
+            }
+        }
+    }
+}
+export { pushDerivedFilesFromRecipe };