log-llm-config-staging 1.3.70 → 1.3.72

package/dist/log_config_files/runtime/npm_env_sanitize.js

@@ -0,0 +1,40 @@
+/**
+ * npm/npx --package=... sets lifecycle env vars that break unrelated scoped `npx @scope/pkg`
+ * (e.g. MCP servers). Strip before spawning shells that may reopen Cursor or run other npx.
+ */
+export const NPM_EXEC_POLLUTION_KEYS = [
+    'npm_command',
+    'npm_config_local_prefix',
+    'npm_config_package',
+    'npm_lifecycle_event',
+    'npm_lifecycle_script',
+    'npm_lifecycle_inject_node',
+    'npm_package_json',
+    'npm_execpath',
+    'npm_config_yes',
+    'npm_config_node_gyp',
+    'npm_config_npm_version',
+    'npm_config_user_agent',
+    'NPM_COMMAND',
+    'NPM_CONFIG_LOCAL_PREFIX',
+    'NPM_CONFIG_PACKAGE',
+    'NPM_LIFECYCLE_EVENT',
+    'NPM_LIFECYCLE_SCRIPT',
+    'NPM_EXECPATH',
+    'NPM_CONFIG_YES',
+];
+export function envWithoutNpmExecPollution(env) {
+    const clean = { ...env };
+    for (const key of NPM_EXEC_POLLUTION_KEYS) {
+        delete clean[key];
+    }
+    return clean;
+}
+/** Bash prefix: unset lifecycle vars before running npx in deferred restart shells. */
+export const DEFERRED_RESTART_UNSET_NPM_ENV = 'unset npm_command npm_config_local_prefix npm_config_package npm_lifecycle_event ' +
+    'npm_lifecycle_script npm_lifecycle_inject_node npm_package_json npm_execpath npm_config_yes ' +
+    'npm_config_node_gyp npm_config_npm_version npm_config_user_agent ' +
+    'NPM_COMMAND NPM_CONFIG_LOCAL_PREFIX NPM_CONFIG_PACKAGE NPM_LIFECYCLE_EVENT NPM_LIFECYCLE_SCRIPT NPM_EXECPATH 2>/dev/null; ';
+/** Bash wrapper for npx in deferred restart (env -u strips inherited npm exec state). */
+export const DEFERRED_RESTART_NPX = 'env -u npm_command -u npm_config_local_prefix -u npm_config_package -u npm_lifecycle_event ' +
+    '-u npm_lifecycle_script -u npm_lifecycle_inject_node -u npm_package_json -u npm_execpath npx';

package/dist/log_config_files/runtime/remediation_sync.js

@@ -394,7 +394,7 @@ function assertSafeSqliteIdentifiersForItemTable(table, keyColumn, valueColumn)
 const TRUSTED_CURSOR_SQLITE_DEFERRED_RESTART_COMMAND = 'REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd) && export REPO_ROOT && ' +
     'CURSOR_PROJECT="${CURSOR_PROJECT_DIR:-$REPO_ROOT}" && export CURSOR_PROJECT && ' +
     'OPTIMUS_DEFERRED_LOG="${HOME}/opt-ai-sec/management/deferred_vscdb_restart.log" && mkdir -p "$(dirname "$OPTIMUS_DEFERRED_LOG")" && export OPTIMUS_DEFERRED_LOG && ' +
-    "nohup bash -c 'exec >>\"\$OPTIMUS_DEFERRED_LOG\" 2>&1; echo deferred_restart:begin ts=\$(date -u +%Y-%m-%dT%H:%M:%SZ) REPO_ROOT=\"\$REPO_ROOT\" CURSOR_PROJECT=\"\$CURSOR_PROJECT\"; sleep 2; STATIC_DEV_ENV=\"\$HOME/opt-ai-sec/management/optimus_dev.env\"; ENV_LABEL=\"\"; if [ -f \"\$STATIC_DEV_ENV\" ]; then ENV_LABEL=\$(grep -E \"^(environment|ENVIRONMENT|OPTIMUS_ENVIRONMENT)=\" \"\$STATIC_DEV_ENV\" 2>/dev/null | head -1 | cut -d\"=\" -f2- | tr \"[:upper:]\" \"[:lower:]\" | xargs); fi; if [ -z \"\$ENV_LABEL\" ] && [ -n \"\${OPTIMUS_ENVIRONMENT:-}\" ]; then ENV_LABEL=\$(printf \"%s\" \"\$OPTIMUS_ENVIRONMENT\" | tr \"[:upper:]\" \"[:lower:]\" | xargs); fi; [ -z \"\$ENV_LABEL\" ] && ENV_LABEL=\"production\"; NPX_BASE=\"\"; if [ -f \"\$STATIC_DEV_ENV\" ]; then _nb=\$(grep -E \"^npx=\" \"\$STATIC_DEV_ENV\" 2>/dev/null | head -1 | cut -d\"=\" -f2- | xargs); [ -n \"\$_nb\" ] && [ -d \"\$_nb\" ] && NPX_BASE=\"\$_nb\"; fi; p=\"\${npm_config_prefix:-\${NPM_CONFIG_PREFIX:-}}\"; gp=\"\${npm_config_global_prefix:-}\"; gc=\"\${npm_config_globalconfig:-}\"; if [[ \"\$p\" == *\"/Applications/Cursor.app/\"* ]] || [[ \"\$gp\" == *\"/Applications/Cursor.app/\"* ]] || [[ \"\$gc\" == *\"/Applications/Cursor.app/\"* ]]; then unset npm_config_prefix NPM_CONFIG_PREFIX npm_config_global_prefix npm_config_globalconfig npm_node_execpath 2>/dev/null; fi; APPLY_EC=0; if [ -f \"\$REPO_ROOT/dev_npx_packages/log-llm-config/dist/apply_deferred_vscdb.js\" ]; then echo deferred_restart:apply_via_dev_npx_packages; node \"\$REPO_ROOT/dev_npx_packages/log-llm-config/dist/apply_deferred_vscdb.js\"; APPLY_EC=\$?; elif [ \"\$ENV_LABEL\" = \"development\" ] && [ -n \"\$NPX_BASE\" ] && [ -f \"\$NPX_BASE/log-llm-config/dist/apply_deferred_vscdb.js\" ]; then echo deferred_restart:apply_via_optimus_npx_base; node \"\$NPX_BASE/log-llm-config/dist/apply_deferred_vscdb.js\"; APPLY_EC=\$?; elif command -v npx >/dev/null 2>&1; then echo deferred_restart:apply_via_npx env=\"\$ENV_LABEL\"; cd \"\$REPO_ROOT\" || true; if [ \"\$ENV_LABEL\" = \"staging\" ]; then npx --yes --package=log-llm-config-staging@latest apply-deferred-vscdb-staging; APPLY_EC=\$?; else npx --yes --package=log-llm-config@latest apply-deferred-vscdb; APPLY_EC=\$?; fi; else echo deferred_restart:no_npx; APPLY_EC=127; fi; echo deferred_restart:apply_exit=\$APPLY_EC; if [ \$APPLY_EC -ne 0 ]; then echo deferred_restart:APPLY_FAILED_see_messages_above; fi; echo deferred_restart:open_cursor; open -a Cursor \"\$CURSOR_PROJECT\"; echo deferred_restart:open_exit=\$?; echo deferred_restart:end ts=\$(date -u +%Y-%m-%dT%H:%M:%SZ)' >/dev/null 2>&1 & killall -9 Cursor";
+    "nohup bash -c 'exec >>\"\$OPTIMUS_DEFERRED_LOG\" 2>&1; echo deferred_restart:begin ts=\$(date -u +%Y-%m-%dT%H:%M:%SZ) REPO_ROOT=\"\$REPO_ROOT\" CURSOR_PROJECT=\"\$CURSOR_PROJECT\"; sleep 2; STATIC_DEV_ENV=\"\$HOME/opt-ai-sec/management/optimus_dev.env\"; ENV_LABEL=\"\"; if [ -f \"\$STATIC_DEV_ENV\" ]; then ENV_LABEL=\$(grep -E \"^(environment|ENVIRONMENT|OPTIMUS_ENVIRONMENT)=\" \"\$STATIC_DEV_ENV\" 2>/dev/null | head -1 | cut -d\"=\" -f2- | tr \"[:upper:]\" \"[:lower:]\" | xargs); fi; if [ -z \"\$ENV_LABEL\" ] && [ -n \"\${OPTIMUS_ENVIRONMENT:-}\" ]; then ENV_LABEL=\$(printf \"%s\" \"\$OPTIMUS_ENVIRONMENT\" | tr \"[:upper:]\" \"[:lower:]\" | xargs); fi; [ -z \"\$ENV_LABEL\" ] && ENV_LABEL=\"production\"; NPX_BASE=\"\"; if [ -f \"\$STATIC_DEV_ENV\" ]; then _nb=\$(grep -E \"^npx=\" \"\$STATIC_DEV_ENV\" 2>/dev/null | head -1 | cut -d\"=\" -f2- | xargs); [ -n \"\$_nb\" ] && [ -d \"\$_nb\" ] && NPX_BASE=\"\$_nb\"; fi; p=\"\${npm_config_prefix:-\${NPM_CONFIG_PREFIX:-}}\"; gp=\"\${npm_config_global_prefix:-}\"; gc=\"\${npm_config_globalconfig:-}\"; if [[ \"\$p\" == *\"/Applications/Cursor.app/\"* ]] || [[ \"\$gp\" == *\"/Applications/Cursor.app/\"* ]] || [[ \"\$gc\" == *\"/Applications/Cursor.app/\"* ]]; then unset npm_config_prefix NPM_CONFIG_PREFIX npm_config_global_prefix npm_config_globalconfig npm_node_execpath 2>/dev/null; fi; APPLY_EC=0; if [ -f \"\$REPO_ROOT/dev_npx_packages/log-llm-config/dist/apply_deferred_vscdb.js\" ]; then echo deferred_restart:apply_via_dev_npx_packages; node \"\$REPO_ROOT/dev_npx_packages/log-llm-config/dist/apply_deferred_vscdb.js\"; APPLY_EC=\$?; elif [ \"\$ENV_LABEL\" = \"development\" ] && [ -n \"\$NPX_BASE\" ] && [ -f \"\$NPX_BASE/log-llm-config/dist/apply_deferred_vscdb.js\" ]; then echo deferred_restart:apply_via_optimus_npx_base; node \"\$NPX_BASE/log-llm-config/dist/apply_deferred_vscdb.js\"; APPLY_EC=\$?; elif command -v npx >/dev/null 2>&1; then echo deferred_restart:apply_via_npx env=\"\$ENV_LABEL\"; cd \"\$REPO_ROOT\" || true; if [ \"\$ENV_LABEL\" = \"staging\" ]; then npx --yes --package=log-llm-config-staging@latest apply-deferred-vscdb-staging; APPLY_EC=\$?; else npx --yes --package=log-llm-config@latest apply-deferred-vscdb; APPLY_EC=\$?; fi; else echo deferred_restart:no_npx; APPLY_EC=127; fi; echo deferred_restart:apply_exit=\$APPLY_EC; if [ \$APPLY_EC -ne 0 ]; then echo deferred_restart:APPLY_FAILED_see_messages_above; fi; echo deferred_restart:open_cursor; env -u npm_config_package -u npm_lifecycle_event -u npm_lifecycle_script -u npm_config_local_prefix open -a Cursor \"\$CURSOR_PROJECT\"; echo deferred_restart:open_exit=\$?; echo deferred_restart:end ts=\$(date -u +%Y-%m-%dT%H:%M:%SZ)' >/dev/null 2>&1 & killall -9 Cursor";
 const TRUSTED_CURSOR_JSON_SETTINGS_RESTART_COMMAND = 'CURSOR_PROJECT=$(git rev-parse --show-toplevel 2>/dev/null || pwd) && export CURSOR_PROJECT && nohup bash -c \'sleep 2 && open -a Cursor "$CURSOR_PROJECT"\' >/dev/null 2>&1 & killall -9 Cursor';
 const TRUSTED_CLAUDE_RESTART_COMMAND = "nohup bash -c 'sleep 2 && open -a Claude' >/dev/null 2>&1 & pkill -x 'Claude'";
 export function isClaudeRestartCommand(cmd) {

package/dist/log_config_files/runtime/trusted_restarts.js

@@ -8,6 +8,20 @@ import { getDeferredVscdbRestartLogPath } from './management_storage.js';
 import { normalizeAgentToken } from './compliance_check.js';
 import { isClaudeRestartCommand, isCursorRestartCommand, isTrustedRestartCommandForAutofix } from './remediation_sync.js';
 const FALLBACK_PATH = '/usr/bin:/bin:/usr/local/bin:/opt/homebrew/bin';
+/** Vars set by `npx --package=...` that break unrelated scoped `npx @scope/pkg` after Cursor reopen. */
+const NPM_RESTART_POLLUTION = [
+    'npm_config_package',
+    'npm_lifecycle_event',
+    'npm_lifecycle_script',
+    'npm_config_local_prefix',
+];
+function envForRestartSpawn(base) {
+    const env = { ...base };
+    for (const key of NPM_RESTART_POLLUTION) {
+        delete env[key];
+    }
+    return env;
+}
 function isDeferredVscdbRestart(cmd) {
     return cmd.includes('OPTIMUS_DEFERRED_LOG') || cmd.includes('apply_deferred_vscdb');
 }
@@ -61,12 +75,12 @@ export function executeTrustedRestartCommands(commands) {
         const child = spawn('sh', ['-c', t], {
             detached: true,
             stdio: 'ignore',
-            env: {
+            env: envForRestartSpawn({
                 ...process.env,
                 PATH: process.env.PATH && String(process.env.PATH).trim().length > 0
                     ? process.env.PATH
                     : FALLBACK_PATH,
-            },
+            }),
         });
         child.on('error', (err) => {
             const emsg = err instanceof Error ? err.message : String(err);

package/dist/tofu.js

@@ -2,37 +2,48 @@
  * Tofu shim — centralises all imports from optimus-tofu-staging.
  *
  * Reads ~/opt-ai-sec/management/optimus_dev.env at startup:
- *   - environment=development → loads local dist (file-relative path)
- *   - anything else           → loads the published npm package
+ *   - No file / unreadable → staging (ignores OPTIMUS_ENVIRONMENT).
+ *   - File present → environment= line in file, then OPTIMUS_ENVIRONMENT, then staging.
+ *   - environment=development + local dist present → loads sibling optimus-tofu dist
+ *   - staging / production / npx installs → published optimus-tofu-staging npm package
  *
  * All other source files import from this module, never directly from
  * "optimus-tofu-staging", so the conditional lives in exactly one place.
  */
-import { readFileSync } from "fs";
+import { existsSync, readFileSync } from "fs";
 import { homedir } from "os";
 import path from "path";
 import { fileURLToPath } from "url";
+function managementEnvPath() {
+    const home = homedir();
+    if (!home)
+        return null;
+    return path.join(home, "opt-ai-sec", "management", "optimus_dev.env");
+}
 function readEnvironment() {
-    const fromEnv = process.env.OPTIMUS_ENVIRONMENT?.trim().toLowerCase();
-    if (fromEnv)
-        return fromEnv;
+    const envPath = managementEnvPath();
+    if (!envPath) {
+        return "staging";
+    }
     try {
-        const content = readFileSync(path.join(homedir(), "opt-ai-sec", "management", "optimus_dev.env"), "utf8");
+        const content = readFileSync(envPath, "utf8");
         const match = content.match(/^(?:environment|ENVIRONMENT|OPTIMUS_ENVIRONMENT)\s*=\s*(.+)/m);
         if (match)
             return match[1].trim().toLowerCase();
     }
     catch {
-        // file missing or unreadable — default to production
+        // No management file: this staging package defaults to staging (promotion rewrites to production).
+        return "staging";
     }
-    return "production";
+    const fromEnv = process.env.OPTIMUS_ENVIRONMENT?.trim().toLowerCase();
+    if (fromEnv)
+        return fromEnv;
+    return "staging";
 }
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const isDevelopment = readEnvironment() === "development";
-// In development: resolve local optimus-tofu dist relative to this file.
-// dist/tofu.js → ../.. → npx_packages/staging/ → optimus-tofu/dist/index.js
 const localTofuPath = path.join(__dirname, "../../optimus-tofu/dist/index.js");
-const tofu = (isDevelopment
+const useLocalTofu = readEnvironment() === "development" && existsSync(localTofuPath);
+const tofu = (useLocalTofu
     ? await import(localTofuPath)
     : await import("optimus-tofu-staging"));
 export const { loadEndpointBase, buildStartupEndpointUrl, createSignature, persistAuthKey, readStoredAuthKey, ensureAuthentication, getEndpointSource, canonicalizePayload, getAuthKeyPath, } = tofu;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config-staging",
-  "version": "1.3.70",
+  "version": "1.3.72",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {