log-llm-config-staging 1.3.80 → 1.3.82

package/dist/log_config_files/collection/directory_collector.js

@@ -50,38 +50,58 @@ function collectDirectoryEntries(t) {
     }
     return results;
 }
-/**
- * For metadata-style DIR targets: scan files matching dir_glob, return one entry
- * with the highest mtime found. Falls back to the directory's own mtime if no files match.
- */
-function collectDirectoryMetadata(t) {
+const METADATA_DIR_SCAN_MAX_DEPTH = 8;
+function matchesDirGlob(name, glob) {
+    if (glob === '*')
+        return true;
+    // **/*.jsonl → match any extension suffix after **/
+    if (glob.startsWith('**/')) {
+        const suffix = glob.slice(3);
+        if (suffix.startsWith('*.'))
+            return name.endsWith(suffix.slice(1));
+        return name === suffix;
+    }
+    if (glob.startsWith('*.'))
+        return name.endsWith(glob.slice(1));
+    return name === glob;
+}
+/** Walk dir tree (bounded depth) and return the file with the highest mtime matching dir_glob. */
+function findNewestMatchingFile(dirPath, glob, depth, maxDepth) {
+    let best = null;
     try {
-        const dirStat = statSync(t.path);
-        let bestMtime = dirStat.mtime;
-        let bestPath = t.path;
-        const glob = t.dir_glob ?? '*';
-        const matchName = (name) => {
-            if (glob === '*')
-                return true;
-            if (glob.startsWith('*.'))
-                return name.endsWith(glob.slice(1));
-            return name === glob;
-        };
-        try {
-            for (const entry of readdirSync(t.path, { withFileTypes: true })) {
-                if (!entry.isFile() || !matchName(entry.name))
-                    continue;
+        for (const entry of readdirSync(dirPath, { withFileTypes: true })) {
+            const fullPath = join(dirPath, entry.name);
+            if (entry.isFile() && matchesDirGlob(entry.name, glob)) {
                 try {
-                    const fileStat = statSync(join(t.path, entry.name));
-                    if (fileStat.mtime > bestMtime) {
-                        bestMtime = fileStat.mtime;
-                        bestPath = join(t.path, entry.name);
+                    const fileStat = statSync(fullPath);
+                    if (!best || fileStat.mtime > best.mtime) {
+                        best = { path: fullPath, mtime: fileStat.mtime };
                     }
                 }
                 catch { /* ignore unreadable files */ }
             }
+            else if (entry.isDirectory() && depth < maxDepth) {
+                const nested = findNewestMatchingFile(fullPath, glob, depth + 1, maxDepth);
+                if (nested && (!best || nested.mtime > best.mtime)) {
+                    best = nested;
+                }
+            }
         }
-        catch { /* ignore unreadable dir */ }
+    }
+    catch { /* ignore unreadable dir */ }
+    return best;
+}
+/**
+ * For metadata-style DIR targets: recursively scan files matching dir_glob, return one entry
+ * with the highest mtime found. Falls back to the directory's own mtime if no files match.
+ */
+function collectDirectoryMetadata(t) {
+    try {
+        const dirStat = statSync(t.path);
+        const glob = t.dir_glob ?? '*';
+        const newest = findNewestMatchingFile(t.path, glob, 0, METADATA_DIR_SCAN_MAX_DEPTH);
+        const bestPath = newest?.path ?? t.path;
+        const bestMtime = newest?.mtime ?? dirStat.mtime;
         return {
             file_type: t.file_type,
             file_path: bestPath,

package/dist/log_config_files/runtime/main_runner.js

@@ -1,6 +1,7 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
+const HOME_DIR = homedir();
 import { getFileCollectionPatterns, FILE_PATH_REGISTRY_FILE_PATTERNS_PATH } from '../../endpoint_client/index.js';
 import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
 import { runSensitivePathsAudit } from '../../log_sensitive_paths_audit.js';
@@ -17,6 +18,7 @@ import { normalizePathSkipPrefixes } from '../paths/pattern_resolver.js';
 import { sendConfigFile, sendConfigFilesBatch, sendHookRequestCreate, sendHookRequestUpdateManifest, sendIngestSessionStart, sendIngestSessionFinish, BATCH_CHUNK_SIZE } from '../sender/batch_sender.js';
 import { canonicalCursorUserStateVscdbPath } from './remediation_config_path.js';
 import { ensureWorkspaceRepoEnv, resolveProjectRoot } from './workspace_repo.js';
+import { scanActiveWorktrees, activeWorktreeRootSet, filterConfigFilesToActiveWorktrees, } from './worktree_scanner.js';
 import { createSignature, canonicalizePayload } from '../sender/signing.js';
 const PROJECT_ROOT = resolveProjectRoot();
 async function collectAllConfigFiles(endpointBase) {
@@ -67,7 +69,12 @@ async function collectAllConfigFiles(endpointBase) {
     if (!patternsResponse.client_path_constants)
         throw new Error('client_path_constants required from API response');
     configFiles.push(...collectConfigFilesFromInstalledPlugins(patternsResponse.client_path_constants));
-    return configFiles;
+    const worktreeReport = scanActiveWorktrees(PROJECT_ROOT, HOME_DIR);
+    const activeRoots = activeWorktreeRootSet(worktreeReport);
+    const beforeFilter = configFiles.length;
+    const filtered = filterConfigFilesToActiveWorktrees(configFiles, activeRoots);
+    hookRunLog(`worktree_scan: active=${worktreeReport.length} config_files ${beforeFilter}→${filtered.length}`);
+    return { configFiles: filtered, worktreeReport };
 }
 async function addSensitivePathsAudit(endpointBase, configFiles) {
     hookRunLog(`running sensitive paths audit`);
@@ -82,7 +89,7 @@ async function addSensitivePathsAudit(endpointBase, configFiles) {
         configFiles.push({ file_type: 'sensitive_paths_audit', file_path: 'sensitive_paths_audit.txt', raw_content: { paths: [] } });
     }
 }
-async function sendAllConfigFiles(configFiles, hardwareUuid, authKey) {
+async function sendAllConfigFiles(configFiles, worktreeReport, hardwareUuid, authKey) {
     const hookTypeRaw = (process.env.OPTIMUS_HOOK_TYPE || 'claude').toLowerCase();
     const hookType = hookTypeRaw === 'cursor' ? 'cursor' : 'claude';
     const manifest = configFiles.map((c) => canonicalCursorUserStateVscdbPath(c.file_path));
@@ -101,9 +108,15 @@ async function sendAllConfigFiles(configFiles, hardwareUuid, authKey) {
         const ok = await sendHookRequestUpdateManifest(hardwareUuid, authKey, hookRequestId, manifest);
         hookRunLog(`hook-request update manifest result=${ok ? 'ok' : 'fail'}`);
     }
-    if (ingestSessionId && batchResult.accepted > 0) {
-        const ok = await sendIngestSessionFinish(hardwareUuid, authKey, ingestSessionId);
-        hookRunLog(`ingest-session finish result=${ok ? 'ok' : 'fail'}`);
+    // Finish ingest session: OpenClaw hold set, worktree prune (report may be []), and scans.
+    // Run finish whenever a session was started — even if every upload failed — so worktree
+    // cleanup still runs for machines with only stale worktrees on disk.
+    if (ingestSessionId) {
+        const ok = await sendIngestSessionFinish(hardwareUuid, authKey, ingestSessionId, batchResult.failedArtifacts, worktreeReport);
+        hookRunLog(`ingest-session finish result=${ok ? 'ok' : 'fail'}`
+            + (batchResult.failedArtifacts.length > 0
+                ? ` held=${batchResult.failedArtifacts.length} failed upload(s)`
+                : ''));
     }
     // Exit 0 if anything was persisted so the shell hook keeps last_log and throttles. Exit 1 only when
     // every item failed (e.g. SQLite locked on server) — otherwise partial success used to return 1,
@@ -129,8 +142,11 @@ async function main() {
         throw err;
     }
     let configFiles;
+    let worktreeReport = [];
     try {
-        configFiles = await collectAllConfigFiles(endpointBase);
+        const collected = await collectAllConfigFiles(endpointBase);
+        configFiles = collected.configFiles;
+        worktreeReport = collected.worktreeReport;
     }
     catch (err) {
         hookRunLog(`patterns_error: ${err instanceof Error ? err.message : String(err)}`);
@@ -154,7 +170,7 @@ async function main() {
         hookRunLog('no config files found, exiting');
         process.exit(0);
     }
-    await sendAllConfigFiles(configFiles, hardwareUuid, authKey);
+    await sendAllConfigFiles(configFiles, worktreeReport, hardwareUuid, authKey);
 }
 async function logSingleFile(filePath) {
     const hardwareUuid = resolveHardwareUuid();

package/dist/log_config_files/runtime/remediation_sync.js

@@ -11,6 +11,8 @@ import { loadEndpointBase } from '../sender/endpoint_config.js';
 import { tryResolveHardwareUuid } from './hardware_uuid.js';
 import { CURSOR_SCALAR_ITEMTABLE_FIELDS, persistVscdbComposerContractFromPatternsResponse, readVscdbItemTableJson, } from '../readers/vscdb_reader.js';
 import { sendConfigFile } from '../sender/batch_sender.js';
+import { parseWorktreeRootFromPath } from './worktree_scanner.js';
+import { reportAbsentWorktrees } from './worktree_absent.js';
 import { buildApiUrl, getFileCollectionPatterns } from '../../endpoint_client/registry_api.js';
 import { resolveRemediationConfigPath } from './remediation_config_path.js';
 import { resolveSqlite3Binary } from './sqlite_binary.js';
@@ -1189,9 +1191,26 @@ export function enforceRemediation(instruction) {
         if (fixSpec?.file_format !== 'json') {
             return fail(`unsupported file format: ${String(fixSpec?.file_format ?? 'undefined')}`);
         }
+        const worktreeRoot = parseWorktreeRootFromPath(inst.config_file_path);
+        if (worktreeRoot && !existsSync(worktreeRoot)) {
+            void reportAbsentWorktrees([
+                {
+                    worktree_root: worktreeRoot,
+                    reason: 'path_missing_on_remediate',
+                    source_path: inst.config_file_path,
+                },
+            ]);
+            return fail('worktree_absent');
+        }
         const dir = dirname(inst.config_file_path);
-        if (!existsSync(dir))
+        if (worktreeRoot) {
+            if (!existsSync(dir)) {
+                return fail('worktree_path_missing');
+            }
+        }
+        else if (!existsSync(dir)) {
             mkdirSync(dir, { recursive: true, mode: 0o700 });
+        }
         let configJson = {};
         if (existsSync(inst.config_file_path)) {
             try {

package/dist/log_config_files/runtime/worktree_absent.js

@@ -0,0 +1,50 @@
+import { executeBody } from '../../endpoint_client/http_transport.js';
+import { buildApiUrl } from '../../endpoint_client/registry_api.js';
+import { loadEndpointBase } from '../sender/endpoint_config.js';
+import { createSignature } from '../sender/signing.js';
+import { readStoredAuthKey } from '../auth/auth_key_store.js';
+import { tryResolveHardwareUuid } from './hardware_uuid.js';
+import { hookRunLog } from './hook_logger.js';
+import { normalizePathForWorktree } from './worktree_scanner.js';
+/**
+ * Notify server that worktree directories are gone so inventory/findings are pruned.
+ */
+export function reportAbsentWorktrees(entries) {
+    const authKey = readStoredAuthKey();
+    if (!authKey) {
+        hookRunLog('worktree_absent: no auth key, skipping');
+        return Promise.resolve();
+    }
+    const hardwareUuid = tryResolveHardwareUuid();
+    if (!hardwareUuid) {
+        hookRunLog('worktree_absent: no hardware uuid, skipping');
+        return Promise.resolve();
+    }
+    const absent_worktrees = entries
+        .map((e) => ({
+        worktree_root: normalizePathForWorktree(e.worktree_root).replace(/\/+$/, ''),
+        reason: (e.reason || 'path_missing').slice(0, 64),
+    }))
+        .filter((e) => e.worktree_root)
+        .sort((a, b) => a.worktree_root.localeCompare(b.worktree_root));
+    if (absent_worktrees.length === 0) {
+        return Promise.resolve();
+    }
+    const endpointBase = loadEndpointBase();
+    const url = buildApiUrl(endpointBase, '/endpoint_security/worktree-absent/');
+    const payload = { hardware_uuid: hardwareUuid, absent_worktrees };
+    const signature = createSignature(payload, authKey.key);
+    const body = JSON.stringify({ ...payload, signature, key_id: authKey.key_id || '' });
+    return executeBody(url, 'POST', body, 8000)
+        .then(({ statusCode }) => {
+        if (statusCode !== 200) {
+            hookRunLog(`worktree_absent: server returned ${statusCode}`);
+        }
+        else {
+            hookRunLog(`worktree_absent: reported ${absent_worktrees.length} root(s)`);
+        }
+    })
+        .catch((err) => {
+        hookRunLog(`worktree_absent: request failed: ${err instanceof Error ? err.message : String(err)}`);
+    });
+}

package/dist/log_config_files/runtime/worktree_scanner.js

@@ -0,0 +1,137 @@
+import { existsSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+/** Worktrees touched within this window are reported and collected (Phase 1). */
+export const WORKTREE_ACTIVE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+const IN_REPO_SEGMENT = '/.claude/worktrees/';
+const HOME_SEGMENT = '/.claude-worktrees/';
+export function normalizePathForWorktree(path) {
+    return path.replace(/\\/g, '/');
+}
+export function parseWorktreeRootFromPath(filePath) {
+    const norm = normalizePathForWorktree(filePath);
+    if (norm.includes(HOME_SEGMENT)) {
+        const parts = norm.split(HOME_SEGMENT);
+        if (parts.length !== 2)
+            return null;
+        const prefix = parts[0];
+        const after = parts[1].replace(/^\/+/, '');
+        const segments = after.split('/');
+        if (segments.length < 2)
+            return null;
+        return `${prefix}${HOME_SEGMENT}${segments[0]}/${segments[1]}`.replace(/\/+$/, '');
+    }
+    if (norm.includes(IN_REPO_SEGMENT)) {
+        const idx = norm.indexOf(IN_REPO_SEGMENT);
+        const before = norm.slice(0, idx).replace(/\/+$/, '');
+        const after = norm.slice(idx + IN_REPO_SEGMENT.length).replace(/^\/+/, '');
+        const name = after.split('/')[0];
+        if (!name)
+            return null;
+        return `${before}${IN_REPO_SEGMENT}${name}`.replace(/\/+$/, '');
+    }
+    return null;
+}
+function isActiveDir(dirPath, maxAgeMs) {
+    if (!existsSync(dirPath))
+        return false;
+    try {
+        const st = statSync(dirPath);
+        if (!st.isDirectory())
+            return false;
+        return Date.now() - st.mtimeMs <= maxAgeMs;
+    }
+    catch {
+        return false;
+    }
+}
+function scanInRepoWorktrees(projectRoot, maxAgeMs) {
+    const base = join(projectRoot, '.claude', 'worktrees');
+    if (!existsSync(base))
+        return [];
+    const repoName = projectRoot.split(/[/\\]/).filter(Boolean).pop() || '';
+    const entries = [];
+    try {
+        for (const dirent of readdirSync(base, { withFileTypes: true })) {
+            if (!dirent.isDirectory())
+                continue;
+            const root = join(base, dirent.name);
+            if (!isActiveDir(root, maxAgeMs))
+                continue;
+            const st = statSync(root);
+            entries.push({
+                worktree_root: normalizePathForWorktree(root),
+                worktree_name: dirent.name,
+                repo_identifier: repoName,
+                layout: 'in_repo',
+                last_modified: st.mtime.toISOString(),
+            });
+        }
+    }
+    catch {
+        return entries;
+    }
+    return entries;
+}
+function scanHomeWorktrees(home, maxAgeMs) {
+    const base = join(home, '.claude-worktrees');
+    if (!existsSync(base))
+        return [];
+    const entries = [];
+    try {
+        for (const repoDir of readdirSync(base, { withFileTypes: true })) {
+            if (!repoDir.isDirectory())
+                continue;
+            const repoPath = join(base, repoDir.name);
+            let worktreeNames = [];
+            try {
+                worktreeNames = readdirSync(repoPath, { withFileTypes: true })
+                    .filter((d) => d.isDirectory())
+                    .map((d) => d.name);
+            }
+            catch {
+                continue;
+            }
+            for (const wtName of worktreeNames) {
+                const root = join(repoPath, wtName);
+                if (!isActiveDir(root, maxAgeMs))
+                    continue;
+                const st = statSync(root);
+                entries.push({
+                    worktree_root: normalizePathForWorktree(root),
+                    worktree_name: wtName,
+                    repo_identifier: repoDir.name,
+                    layout: 'home',
+                    last_modified: st.mtime.toISOString(),
+                });
+            }
+        }
+    }
+    catch {
+        return entries;
+    }
+    return entries;
+}
+/**
+ * Scan project and home Claude worktree directories; return those active within maxAgeMs.
+ */
+export function scanActiveWorktrees(projectRoot, home, maxAgeMs = WORKTREE_ACTIVE_MAX_AGE_MS) {
+    const byRoot = new Map();
+    for (const e of [...scanInRepoWorktrees(projectRoot, maxAgeMs), ...scanHomeWorktrees(home, maxAgeMs)]) {
+        byRoot.set(e.worktree_root, e);
+    }
+    return [...byRoot.values()].sort((a, b) => a.worktree_root.localeCompare(b.worktree_root));
+}
+export function activeWorktreeRootSet(entries) {
+    return new Set(entries.map((e) => e.worktree_root));
+}
+export function filterConfigFilesToActiveWorktrees(files, activeRoots) {
+    if (activeRoots.size === 0) {
+        return files.filter((f) => parseWorktreeRootFromPath(f.file_path) === null);
+    }
+    return files.filter((f) => {
+        const root = parseWorktreeRootFromPath(f.file_path);
+        if (root === null)
+            return true;
+        return activeRoots.has(root);
+    });
+}

package/dist/log_config_files/sender/batch_sender.js

@@ -11,6 +11,17 @@ import path from 'node:path';
 export const BATCH_CHUNK_SIZE = 20;
 const MAX_BATCH_SIZE_BYTES = 500 * 1024; // 500KB
 export { resolveRepoFromPath } from '../runtime/workspace_repo.js';
+function recordFailedArtifacts(target, files, seen) {
+    for (const file of files) {
+        const file_path = canonicalCursorUserStateVscdbPath(file.file_path);
+        const file_type = file.file_type || '';
+        const key = `${file_type}\t${file_path}`;
+        if (!file_type || seen.has(key))
+            continue;
+        seen.add(key);
+        target.push({ file_path, file_type });
+    }
+}
 function resolveApiBase(endpoint) {
     try {
         return new URL(endpoint).origin;
@@ -92,6 +103,8 @@ async function sendConfigFilesBatch(configFiles, hardwareUuid, authKey, hookRequ
     const basePayloadSize = JSON.stringify({ hardware_uuid: hardwareUuid, metadata }).length + 800;
     const chunks = buildBatchChunks(configFiles, basePayloadSize);
     const totals = { accepted: 0, failed: 0 };
+    const failedArtifacts = [];
+    const failedArtifactKeys = new Set();
     let chunkIndex = 0;
     while (chunkIndex < chunks.length) {
         let chunk = chunks[chunkIndex];
@@ -118,11 +131,21 @@ async function sendConfigFilesBatch(configFiles, hardwareUuid, authKey, hookRequ
                 totals.accepted += typeof response.accepted === 'number' ? response.accepted : chunk.length;
                 const failedList = Array.isArray(response.failed) ? response.failed : [];
                 totals.failed += failedList.length;
-                if (failedList.length > 0)
+                if (failedList.length > 0) {
                     hookRunLog(`batch chunk failed items: ${JSON.stringify(failedList.slice(0, 3))}`);
+                    for (const item of failedList) {
+                        const idx = typeof item.index === 'number'
+                            ? item.index
+                            : -1;
+                        if (idx >= 0 && idx < chunk.length) {
+                            recordFailedArtifacts(failedArtifacts, [chunk[idx]], failedArtifactKeys);
+                        }
+                    }
+                }
             }
             else {
                 totals.failed += chunk.length;
+                recordFailedArtifacts(failedArtifacts, chunk, failedArtifactKeys);
                 hookRunLog(`batch chunk failed: ${response.error || response.message || response.status}`);
             }
         }
@@ -130,10 +153,11 @@ async function sendConfigFilesBatch(configFiles, hardwareUuid, authKey, hookRequ
             const errorMessage = error instanceof Error ? error.message : String(error);
             hookRunLog(`batch chunk error: ${errorMessage}`);
             totals.failed += chunk.length;
+            recordFailedArtifacts(failedArtifacts, chunk, failedArtifactKeys);
         }
         chunkIndex++;
     }
-    return totals;
+    return { ...totals, failedArtifacts };
 }
 async function sendIngestSessionStart(hardwareUuid, authKey) {
     const endpoint = loadEndpointBase();
@@ -153,10 +177,31 @@ async function sendIngestSessionStart(hardwareUuid, authKey) {
         return null;
     }
 }
-async function sendIngestSessionFinish(hardwareUuid, authKey, ingestSessionId) {
+async function sendIngestSessionFinish(hardwareUuid, authKey, ingestSessionId, failedUploads = [], worktreeReport = []) {
     const endpoint = loadEndpointBase();
     const apiUrl = `${resolveApiBase(endpoint)}/endpoint_security/ingest-session/finish/`;
-    const payload = { hardware_uuid: hardwareUuid, action: 'ingest_session_finish', ingest_session_id: ingestSessionId };
+    const failed_uploads = [...failedUploads]
+        .map(({ file_path, file_type }) => ({ file_path, file_type }))
+        .sort((a, b) => a.file_path.localeCompare(b.file_path) || a.file_type.localeCompare(b.file_type));
+    const payload = {
+        hardware_uuid: hardwareUuid,
+        action: 'ingest_session_finish',
+        ingest_session_id: ingestSessionId,
+    };
+    if (failed_uploads.length > 0) {
+        payload.failed_uploads = failed_uploads;
+    }
+    const worktree_report = [...worktreeReport]
+        .map((e) => ({
+        worktree_root: e.worktree_root,
+        worktree_name: e.worktree_name,
+        repo_identifier: e.repo_identifier,
+        layout: e.layout,
+        last_modified: e.last_modified,
+    }))
+        .sort((a, b) => a.worktree_root.localeCompare(b.worktree_root));
+    // Always send the key (may be []) so the server prunes stale worktrees when none are active.
+    payload.worktree_report = worktree_report;
     const signature = createSignature(payload, authKey.key);
     const body = { ...payload, signature, key_id: authKey.key_id || '' };
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config-staging",
-  "version": "1.3.80",
+  "version": "1.3.82",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {