log-llm-config-staging 1.3.86 → 1.3.89

package/dist/compliance_prompt_gate.js

@@ -6,8 +6,8 @@
  * When autofix returns restart_commands, this process does not spawn them — the shell hook pipes
  * the same JSON line to execute_trusted_restarts (TS allowlist + spawn).
  */
-import { applyAutofixViolations, normalizeAgentToken, pruneSatisfiedOneTimeRemediations, reportPostRestartVerificationOutcomes, runLocalRemediationComplianceCheck, uploadSatisfiedManifestConfigs, } from './log_config_files/runtime/compliance_check.js';
-import { isRemediationQuarantined, markRemediationApplyVerified, } from './log_config_files/runtime/remediation_apply_tracking.js';
+import { applyAutofixViolations, confirmAppliedAutofixVerified, normalizeAgentToken, pruneSatisfiedOneTimeRemediations, reportPostRestartVerificationOutcomes, runLocalRemediationComplianceCheck, uploadSatisfiedManifestConfigs, } from './log_config_files/runtime/compliance_check.js';
+import { isRemediationQuarantined } from './log_config_files/runtime/remediation_apply_tracking.js';
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { getRemediationInstructionsPath } from './log_config_files/runtime/management_storage.js';
 import { hookLogSessionBanner, hookRunLog, logRemediationApplyFailure } from './log_config_files/runtime/hook_logger.js';
@@ -249,12 +249,12 @@ export async function runCompliancePromptGate() {
                 hookRunLog('compliance_prompt_gate: Claude — autofix wrote JSON; recheck still flags same UUID(s) — proceeding (immediate apply)');
             }
             if (deferredSqlitePending || recheckOk || claudeRecheckStaleAfterImmediateApply) {
-                // For immediate (non-restart, non-deferred) fixes that the inline recheck confirmed,
-                // mark verified now so the next hook run does not false-quarantine due to pending flag.
-                if (recheckOk && restartCommands.length === 0 && !deferredSqlitePending) {
-                    for (const v of appliedViolations) {
-                        markRemediationApplyVerified(v.uuid);
-                    }
+                const immediateVerified = restartCommands.length === 0 &&
+                    !deferredSqlitePending &&
+                    (recheckOk || claudeRecheckStaleAfterImmediateApply);
+                if (immediateVerified) {
+                    confirmAppliedAutofixVerified(appliedViolations, reportPromises);
+                    await Promise.allSettled(reportPromises);
                 }
                 const changePreview = formatRemediationChangePreviewForApplied(appliedViolations);
                 const changePreviewSuffix = changePreview ? `\n\n${changePreview}` : '';

package/dist/log_config_files/runtime/compliance_check.js

@@ -17,7 +17,7 @@ import { mergeComposerShadowKeysFromReactiveBlob, readVscdbItemTableJson, } from
 import { readRemediationInstructionsFile, writeRemediationInstructionsFile, } from './management_storage.js';
 import { resolveRemediationConfigPath } from './remediation_config_path.js';
 import { resolveOpsTargetPath } from './ops_target_path.js';
-import { isRemediationQuarantined, markRemediationApplyPendingVerification, processPendingPostRestartVerifications, readRemediationApplyTrackingFile, writeRemediationApplyTrackingFile, } from './remediation_apply_tracking.js';
+import { isRemediationQuarantined, markRemediationApplyPendingVerification, markRemediationApplyVerified, processPendingPostRestartVerifications, readRemediationApplyTrackingFile, writeRemediationApplyTrackingFile, } from './remediation_apply_tracking.js';
 import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
 import { loadEndpointBase } from '../sender/endpoint_config.js';
 import { resolveHardwareUuid, tryResolveHardwareUuid } from './hardware_uuid.js';
@@ -487,6 +487,17 @@ export function reportPostRestartVerificationOutcomes(violations) {
     });
     return { outcomes, reportPromises };
 }
+/**
+ * Immediate autofix succeeded (inline recheck OK or Claude stale-recheck tolerance).
+ * Clear pending verification locally and report verified so the next prompt does not POST
+ * verification_failed while the user already saw a successful fix.
+ */
+export function confirmAppliedAutofixVerified(appliedViolations, reportPromises) {
+    for (const v of appliedViolations) {
+        markRemediationApplyVerified(v.uuid);
+        reportPromises.push(reportAutofixApplied(v.uuid, 'verified'));
+    }
+}
 export function applyAutofixViolations(violations, agent = 'cursor') {
     for (const v of violations) {
         if (!v.autofix_allowed) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config-staging",
-  "version": "1.3.86",
+  "version": "1.3.89",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {