log-llm-config-staging 1.3.93 → 1.3.96

package/dist/log_config_files/collection/claude_desktop_extensions_collector.js

@@ -0,0 +1,145 @@
+import { existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { readJSONFile } from '../readers/file_readers.js';
+function claudeAppSupportDir(home) {
+    if (process.platform === 'win32') {
+        const appData = process.env.APPDATA?.trim();
+        if (!appData)
+            return '';
+        return join(appData, 'Claude');
+    }
+    return join(home, 'Library', 'Application Support', 'Claude');
+}
+function claudeDesktopExtensionsDir(home) {
+    const base = claudeAppSupportDir(home);
+    return base ? join(base, 'Claude Extensions') : '';
+}
+function extensionsInstallationsPath(home) {
+    const base = claudeAppSupportDir(home);
+    return base ? join(base, 'extensions-installations.json') : '';
+}
+function normalizePathForMatch(path) {
+    return path.replace(/\\/g, '/');
+}
+function isExtensionsInstallationsUpload(entry) {
+    if (entry.file_type !== 'claude_extensions_installations')
+        return false;
+    return normalizePathForMatch(entry.file_path).includes('extensions-installations.json');
+}
+function registryExtensionIds(home) {
+    const path = extensionsInstallationsPath(home);
+    if (!path || !existsSync(path))
+        return new Set();
+    const raw = readJSONFile(path);
+    if (!raw || typeof raw !== 'object')
+        return new Set();
+    const extensions = raw.extensions;
+    if (!extensions || typeof extensions !== 'object')
+        return new Set();
+    return new Set(Object.keys(extensions));
+}
+function manifestHasMcpConfig(manifest) {
+    const server = manifest.server;
+    if (!server || typeof server !== 'object')
+        return false;
+    const mcpConfig = server.mcp_config;
+    return mcpConfig !== null && typeof mcpConfig === 'object';
+}
+function collectDiskOnlyClaudeDesktopExtensions(home, skipIds) {
+    const extensionsDir = claudeDesktopExtensionsDir(home);
+    if (!extensionsDir || !existsSync(extensionsDir))
+        return {};
+    const out = {};
+    let dirs;
+    try {
+        dirs = readdirSync(extensionsDir, { withFileTypes: true }).filter((d) => d.isDirectory());
+    }
+    catch {
+        return out;
+    }
+    for (const dirent of dirs) {
+        const extId = dirent.name;
+        if (skipIds.has(extId))
+            continue;
+        const manifestPath = join(extensionsDir, extId, 'manifest.json');
+        if (!existsSync(manifestPath))
+            continue;
+        const manifest = readJSONFile(manifestPath);
+        if (!manifest || typeof manifest !== 'object')
+            continue;
+        const manifestObj = manifest;
+        if (!manifestHasMcpConfig(manifestObj))
+            continue;
+        const version = typeof manifestObj.version === 'string' || typeof manifestObj.version === 'number'
+            ? String(manifestObj.version)
+            : undefined;
+        out[extId] = {
+            id: extId,
+            version,
+            manifest: manifestObj,
+            source: 'claude_extensions_directory',
+        };
+    }
+    return out;
+}
+/**
+ * Merge disk-only Desktop extensions into the extensions-installations.json upload
+ * so MCP inventory uses the same ingest path as registry-listed extensions (e.g. iMessage).
+ */
+function enrichClaudeDesktopExtensionsInstallationsUpload(configFiles, home = homedir()) {
+    const skipIds = new Set();
+    for (const id of registryExtensionIds(home))
+        skipIds.add(id);
+    const registryUpload = configFiles.find(isExtensionsInstallationsUpload);
+    if (registryUpload?.raw_content && typeof registryUpload.raw_content === 'object') {
+        const extensions = registryUpload.raw_content.extensions;
+        if (extensions && typeof extensions === 'object') {
+            for (const id of Object.keys(extensions))
+                skipIds.add(id);
+        }
+    }
+    const diskOnly = collectDiskOnlyClaudeDesktopExtensions(home, skipIds);
+    const diskOnlyIds = Object.keys(diskOnly);
+    if (diskOnlyIds.length === 0) {
+        return { mergedCount: 0, hadRegistryUpload: Boolean(registryUpload) };
+    }
+    if (registryUpload) {
+        const raw = registryUpload.raw_content;
+        if (!raw.extensions || typeof raw.extensions !== 'object')
+            raw.extensions = {};
+        Object.assign(raw.extensions, diskOnly);
+        return { mergedCount: diskOnlyIds.length, hadRegistryUpload: true };
+    }
+    const registryPath = extensionsInstallationsPath(home);
+    if (!registryPath)
+        return { mergedCount: 0, hadRegistryUpload: false };
+    configFiles.push({
+        file_type: 'claude_extensions_installations',
+        file_path: registryPath,
+        raw_content: { extensions: diskOnly },
+    });
+    return { mergedCount: diskOnlyIds.length, hadRegistryUpload: false };
+}
+/**
+ * Fallback when extensions-installations.json is not part of the upload batch: one synthetic
+ * claude_extensions_installations payload per disk-only manifest path.
+ */
+function collectClaudeDesktopExtensionManifests(home = homedir()) {
+    const extensionsDir = claudeDesktopExtensionsDir(home);
+    if (!extensionsDir || !existsSync(extensionsDir))
+        return [];
+    const inRegistry = registryExtensionIds(home);
+    const results = [];
+    const diskOnly = collectDiskOnlyClaudeDesktopExtensions(home, inRegistry);
+    for (const [extId, entry] of Object.entries(diskOnly)) {
+        const manifestPath = join(extensionsDir, extId, 'manifest.json');
+        results.push({
+            file_type: 'claude_extensions_installations',
+            file_path: manifestPath,
+            raw_content: { extensions: { [extId]: entry } },
+        });
+    }
+    return results;
+}
+export { claudeAppSupportDir, claudeDesktopExtensionsDir, collectClaudeDesktopExtensionManifests, collectDiskOnlyClaudeDesktopExtensions, enrichClaudeDesktopExtensionsInstallationsUpload, };

package/dist/log_config_files/collection/claude_known_projects_collector.js

@@ -0,0 +1,42 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { readJSONFile } from '../readers/file_readers.js';
+/**
+ * Collect project-level `.mcp.json` for each path listed under `projects` in ~/.claude.json.
+ * Claude Code records known project directories there; MCP config lives at `<project>/.mcp.json`.
+ */
+function collectMcpFromClaudeJsonProjects(home = homedir()) {
+    const claudeJsonPath = join(home, '.claude.json');
+    if (!existsSync(claudeJsonPath))
+        return [];
+    const raw = readJSONFile(claudeJsonPath);
+    if (!raw || typeof raw !== 'object')
+        return [];
+    const projects = raw.projects;
+    if (!projects || typeof projects !== 'object')
+        return [];
+    const seenPaths = new Set();
+    const results = [];
+    for (const projectPath of Object.keys(projects)) {
+        if (!projectPath || typeof projectPath !== 'string')
+            continue;
+        const trimmed = projectPath.trim();
+        if (!trimmed)
+            continue;
+        const mcpPath = join(trimmed, '.mcp.json');
+        if (seenPaths.has(mcpPath) || !existsSync(mcpPath))
+            continue;
+        const content = readJSONFile(mcpPath);
+        if (content === null)
+            continue;
+        seenPaths.add(mcpPath);
+        results.push({
+            file_type: 'claude_plugin_mcp',
+            file_path: mcpPath,
+            raw_content: typeof content === 'object' ? content : { content, source: 'file' },
+        });
+    }
+    return results;
+}
+export { collectMcpFromClaudeJsonProjects };

package/dist/log_config_files/collection/config_collector.js

@@ -153,7 +153,10 @@ function collectConfigFilesFromPatterns(patterns, projectRoot, onProgress, optio
 // ─── Re-exports (barrel for public API) ──────────────────────────────────────
 export { collectConfigFilesFromPatterns };
 export { collectMcpToolFiles } from './mcp_tool_collector.js';
-export { collectConfigFilesFromInstalledPlugins } from './plugin_collector.js';
+export { collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles } from './plugin_collector.js';
+export { collectMcpFromClaudeJsonProjects } from './claude_known_projects_collector.js';
+export { collectClaudeDesktopExtensionManifests, enrichClaudeDesktopExtensionsInstallationsUpload, } from './claude_desktop_extensions_collector.js';
+export { collectCursorProjectWorkspaceMcpConfigs } from './cursor_project_mcp_collector.js';
 export { determineFileTypeFromPath } from './file_type_rules.js';
 export { enrichRawFromRecipe } from './enrichment_helpers.js';
 export { pushDerivedFilesFromRecipe } from './openclaw_helpers.js';

package/dist/log_config_files/collection/cursor_project_mcp_collector.js

@@ -0,0 +1,198 @@
+import { existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { readJSONFile } from '../readers/file_readers.js';
+import { normalizePathSkipPrefixes } from '../paths/pattern_resolver.js';
+import { getCursorProjectsPath } from '../paths/path_constants_helpers.js';
+import { readVscdbItemTableJson } from '../readers/vscdb_reader.js';
+import { isStaleCursorProjectWorkspace } from './cursor_project_workspace_activity.js';
+/** Synthetic manifest path segment — not repo `.cursor/mcp.json`. */
+export const CURSOR_WORKSPACE_MCP_MANIFEST = 'cursor-workspace-mcp-servers.json';
+function fileUriToPath(uri) {
+    const trimmed = uri.trim();
+    if (!trimmed.startsWith('file://'))
+        return null;
+    let p = trimmed.slice('file://'.length);
+    if (!p.startsWith('/'))
+        p = `/${p}`;
+    try {
+        return decodeURIComponent(p);
+    }
+    catch {
+        return p;
+    }
+}
+function normalizeSlugPart(s) {
+    return s.replace(/\\/g, '/').replace(/_/g, '-').toLowerCase();
+}
+/** Best-effort: map a repo absolute path to Cursor's ~/.cursor/projects/<slug> dir name. */
+function cursorProjectSlugFromRepoPath(repoPath, home) {
+    const normHome = home.replace(/\\/g, '/').replace(/\/+$/, '');
+    const normPath = repoPath.replace(/\\/g, '/').replace(/\/+$/, '');
+    if (!normPath.startsWith(`${normHome}/`))
+        return '';
+    const homeSegs = normHome.split('/').filter(Boolean);
+    const tail = normPath.slice(normHome.length + 1);
+    const prefix = homeSegs.join('-');
+    const tailSlug = tail.split('/').join('-').replace(/_/g, '-');
+    return tailSlug ? `${prefix}-${tailSlug}` : prefix;
+}
+function loadWorkspaceMetadataEntries(spec, home) {
+    if (!spec?.global_vscdb_path_segments?.length || !spec.global_workspace_list_key)
+        return [];
+    const globalDbPath = join(home, ...spec.global_vscdb_path_segments);
+    if (!existsSync(globalDbPath))
+        return [];
+    const globalResult = readVscdbItemTableJson(globalDbPath, spec.global_workspace_list_key);
+    if (!globalResult)
+        return [];
+    const rawValue = globalResult[spec.global_workspace_list_key];
+    const entries = Array.isArray(rawValue)
+        ? rawValue
+        : Array.isArray(rawValue?.entries)
+            ? rawValue.entries
+            : [];
+    const out = [];
+    for (const entry of entries) {
+        if (!entry || typeof entry !== 'object')
+            continue;
+        const e = entry;
+        const row = {};
+        if (typeof e.displayPath === 'string')
+            row.displayPath = e.displayPath;
+        if (typeof e.folderUri === 'string')
+            row.folderUri = e.folderUri;
+        if (typeof e.workspaceId === 'string')
+            row.workspaceId = e.workspaceId;
+        out.push(row);
+    }
+    return out;
+}
+function workspaceMetaForSlug(slug, metadataEntries, home) {
+    const slugNorm = normalizeSlugPart(slug);
+    for (const entry of metadataEntries) {
+        if (entry.folderUri) {
+            const repoPath = fileUriToPath(entry.folderUri);
+            if (repoPath && normalizeSlugPart(cursorProjectSlugFromRepoPath(repoPath, home)) === slugNorm) {
+                return entry;
+            }
+        }
+        if (entry.displayPath) {
+            const expanded = entry.displayPath.startsWith('~/')
+                ? join(home, entry.displayPath.slice(2))
+                : entry.displayPath;
+            if (expanded && normalizeSlugPart(cursorProjectSlugFromRepoPath(expanded, home)) === slugNorm) {
+                return entry;
+            }
+        }
+    }
+    return undefined;
+}
+function mcpServerLabelFromMcpsDir(serverDirName, meta) {
+    const fromMeta = (typeof meta?.serverName === 'string' && meta.serverName) ||
+        (typeof meta?.serverIdentifier === 'string' && meta.serverIdentifier) ||
+        serverDirName;
+    if (fromMeta.startsWith('user-'))
+        return fromMeta.slice('user-'.length);
+    return fromMeta;
+}
+function isEphemeralCursorProjectDir(name) {
+    if (/^\d+$/.test(name))
+        return true;
+    return false;
+}
+/** Cursor uses this slug when no repo folder is open; mcps/ there are app-built-in only. */
+function isInternalCursorWorkspaceSlug(slug) {
+    return normalizeSlugPart(slug) === 'empty-window';
+}
+/**
+ * Cursor stores per-workspace MCP state under ~/.cursor/projects/<slug>/ (mcp-cache.json, mcps/*).
+ * This is not the repo file at <repo>/.cursor/mcp.json. Upload one mcp_config per slug with
+ * normalized mcpServers for inventory plus cursor_workspace metadata for scope display.
+ */
+function collectCursorProjectWorkspaceMcpConfigs(pathSkipPrefixes = [], constants, workspaceVscdbSpec, home = homedir()) {
+    const skipPrefixes = normalizePathSkipPrefixes(pathSkipPrefixes);
+    const results = [];
+    const cursorProjectsPath = getCursorProjectsPath(home, constants);
+    const metadataEntries = loadWorkspaceMetadataEntries(workspaceVscdbSpec, home);
+    if (!existsSync(cursorProjectsPath))
+        return results;
+    let projectDirs;
+    try {
+        projectDirs = readdirSync(cursorProjectsPath, { withFileTypes: true }).filter((d) => d.isDirectory());
+    }
+    catch {
+        return results;
+    }
+    for (const projectDir of projectDirs) {
+        if (skipPrefixes.some((p) => projectDir.name.startsWith(p)))
+            continue;
+        if (isEphemeralCursorProjectDir(projectDir.name))
+            continue;
+        if (isInternalCursorWorkspaceSlug(projectDir.name))
+            continue;
+        const projectPath = join(cursorProjectsPath, projectDir.name);
+        if (isStaleCursorProjectWorkspace(projectPath))
+            continue;
+        const mcpServers = {};
+        const cachePath = join(projectPath, 'mcp-cache.json');
+        if (existsSync(cachePath)) {
+            const cache = readJSONFile(cachePath);
+            if (cache && typeof cache === 'object' && !Array.isArray(cache)) {
+                for (const [name, val] of Object.entries(cache)) {
+                    if (!name.trim())
+                        continue;
+                    if (val && typeof val === 'object' && Array.isArray(val.tools)) {
+                        mcpServers[name] = { cursor_source: 'mcp-cache.json' };
+                    }
+                }
+            }
+        }
+        const mcpsPath = join(projectPath, 'mcps');
+        if (existsSync(mcpsPath)) {
+            try {
+                for (const serverDir of readdirSync(mcpsPath, { withFileTypes: true }).filter((d) => d.isDirectory())) {
+                    const metaPath = join(mcpsPath, serverDir.name, 'SERVER_METADATA.json');
+                    const meta = existsSync(metaPath) ? readJSONFile(metaPath) : null;
+                    const metaObj = meta && typeof meta === 'object' ? meta : null;
+                    const label = mcpServerLabelFromMcpsDir(serverDir.name, metaObj);
+                    if (!label)
+                        continue;
+                    if (!(label in mcpServers)) {
+                        mcpServers[label] = {
+                            cursor_source: 'mcps',
+                            server_identifier: serverDir.name,
+                        };
+                    }
+                }
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        if (Object.keys(mcpServers).length === 0)
+            continue;
+        const linked = workspaceMetaForSlug(projectDir.name, metadataEntries, home);
+        const linkedRepoPath = linked?.folderUri ? fileUriToPath(linked.folderUri) : null;
+        const manifestPath = existsSync(cachePath)
+            ? cachePath
+            : join(projectPath, CURSOR_WORKSPACE_MCP_MANIFEST);
+        results.push({
+            file_type: 'mcp_config',
+            file_path: manifestPath,
+            raw_content: {
+                mcpServers,
+                cursor_workspace: {
+                    slug: projectDir.name,
+                    collection_root: projectPath,
+                    display_path: linked?.displayPath,
+                    folder_uri: linked?.folderUri,
+                    linked_repo_path: linkedRepoPath ?? undefined,
+                    note: 'Cursor ~/.cursor/projects workspace MCP; not repo .cursor/mcp.json',
+                },
+            },
+        });
+    }
+    return results;
+}
+export { collectCursorProjectWorkspaceMcpConfigs, cursorProjectSlugFromRepoPath, fileUriToPath, isInternalCursorWorkspaceSlug, workspaceMetaForSlug, };

package/dist/log_config_files/collection/cursor_project_workspace_activity.js

@@ -0,0 +1,73 @@
+import { existsSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+/** Align with backend `AGENT_ACTIVITY_RECENCY_DAYS` — skip workspace MCP when idle longer. */
+export const CURSOR_WORKSPACE_MCP_RECENCY_DAYS = 7;
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+function maxMtimeInTree(root, maxDepth) {
+    if (!existsSync(root))
+        return null;
+    let best = null;
+    const visit = (dir, depth) => {
+        if (depth > maxDepth)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const fullPath = join(dir, entry.name);
+            try {
+                const st = statSync(fullPath);
+                const ms = st.mtimeMs;
+                if (best === null || ms > best)
+                    best = ms;
+                if (entry.isDirectory())
+                    visit(fullPath, depth + 1);
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    };
+    visit(root, 0);
+    return best;
+}
+function pushMtime(candidates, path) {
+    if (!existsSync(path))
+        return;
+    try {
+        candidates.push(statSync(path).mtimeMs);
+    }
+    catch {
+        /* ignore */
+    }
+}
+/**
+ * Latest filesystem activity under a Cursor ~/.cursor/projects/<slug> directory.
+ * Uses mcp-cache, mcps/, agent-tools/, terminals/, and the project root — not hook ingest time.
+ */
+function cursorProjectWorkspaceLatestActivityMs(projectPath) {
+    const candidates = [];
+    pushMtime(candidates, projectPath);
+    pushMtime(candidates, join(projectPath, 'mcp-cache.json'));
+    pushMtime(candidates, join(projectPath, 'terminals'));
+    for (const subdir of ['mcps', 'agent-tools']) {
+        const nested = maxMtimeInTree(join(projectPath, subdir), 5);
+        if (nested !== null)
+            candidates.push(nested);
+    }
+    if (candidates.length === 0)
+        return null;
+    return Math.max(...candidates);
+}
+function isStaleCursorProjectWorkspace(projectPath, recencyDays = CURSOR_WORKSPACE_MCP_RECENCY_DAYS, nowMs = Date.now()) {
+    const latest = cursorProjectWorkspaceLatestActivityMs(projectPath);
+    if (latest === null)
+        return true;
+    const cutoff = nowMs - recencyDays * MS_PER_DAY;
+    return latest < cutoff;
+}
+export { cursorProjectWorkspaceLatestActivityMs, isStaleCursorProjectWorkspace, maxMtimeInTree, };

package/dist/log_config_files/collection/mcp_tool_collector.js

@@ -4,6 +4,8 @@ import { homedir } from 'node:os';
 import { readJSONFile } from '../readers/file_readers.js';
 import { normalizePathSkipPrefixes } from '../paths/pattern_resolver.js';
 import { getCursorProjectsPath } from '../paths/path_constants_helpers.js';
+import { isInternalCursorWorkspaceSlug } from './cursor_project_mcp_collector.js';
+import { isStaleCursorProjectWorkspace } from './cursor_project_workspace_activity.js';
 import { readVscdbItemTableJson } from '../readers/vscdb_reader.js';
 /**
  * Read workspaceMetadata.entries from the Cursor global state.vscdb and emit one
@@ -76,7 +78,12 @@ function collectMcpToolFiles(pathSkipPrefixes = [], constants) {
         for (const projectDir of readdirSync(cursorProjectsPath, { withFileTypes: true }).filter((d) => d.isDirectory())) {
             if (skipPrefixes.some((p) => projectDir.name.startsWith(p)))
                 continue;
-            const mcpsPath = join(cursorProjectsPath, projectDir.name, 'mcps');
+            if (isInternalCursorWorkspaceSlug(projectDir.name))
+                continue;
+            const projectPath = join(cursorProjectsPath, projectDir.name);
+            if (isStaleCursorProjectWorkspace(projectPath))
+                continue;
+            const mcpsPath = join(projectPath, 'mcps');
             if (!existsSync(mcpsPath))
                 continue;
             for (const serverDir of readdirSync(mcpsPath, { withFileTypes: true }).filter((d) => d.isDirectory())) {

package/dist/log_config_files/collection/plugin_collector.js

@@ -60,6 +60,47 @@ function collectPluginInstallEntries(pluginKey, entries, results, constants) {
         collectMcpFile(installPath, results, constants);
     }
 }
+const PLUGIN_CACHE_MCP_FILENAME = '.mcp.json';
+function walkPluginCacheForMcp(dir, results, seenMcpPaths, constants, depth) {
+    if (depth > 12)
+        return;
+    try {
+        for (const ent of readdirSync(dir, { withFileTypes: true }).filter((d) => d.isDirectory() || d.isFile())) {
+            const full = join(dir, ent.name);
+            if (ent.isDirectory()) {
+                walkPluginCacheForMcp(full, results, seenMcpPaths, constants, depth + 1);
+                continue;
+            }
+            if (!ent.isFile() || ent.name !== PLUGIN_CACHE_MCP_FILENAME)
+                continue;
+            if (seenMcpPaths.has(full))
+                continue;
+            const content = readJSONFile(full);
+            if (content === null)
+                continue;
+            seenMcpPaths.add(full);
+            const ver = versionFromPluginCachePath(full, constants);
+            results.push({
+                file_type: 'claude_plugin_mcp',
+                file_path: full,
+                raw_content: typeof content === 'object' ? { ...content, ...(ver ? { version: ver } : {}) } : content,
+            });
+        }
+    }
+    catch {
+        return;
+    }
+}
+/** All plugin MCP manifests under ~/.claude/plugins/cache, whether or not the plugin is enabled. */
+function collectPluginCacheMcpFiles(constants, home = homedir()) {
+    const cacheRoot = join(home, '.claude', 'plugins', 'cache');
+    if (!existsSync(cacheRoot))
+        return [];
+    const results = [];
+    const seenMcpPaths = new Set();
+    walkPluginCacheForMcp(cacheRoot, results, seenMcpPaths, constants, 0);
+    return results;
+}
 function collectConfigFilesFromInstalledPlugins(constants) {
     const home = homedir();
     const installedPluginsPath = getInstalledPluginsPath(home, constants);
@@ -86,4 +127,4 @@ function collectConfigFilesFromInstalledPlugins(constants) {
     }
     return results;
 }
-export { collectConfigFilesFromInstalledPlugins };
+export { collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles };

package/dist/log_config_files/runtime/compliance_check.js

@@ -165,6 +165,21 @@ function deepEqual(a, b) {
 function isStringArray(v) {
     return Array.isArray(v) && v.every((x) => typeof x === 'string');
 }
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/** Match Cursor yolo allowlist entries (same boundary idea as server filter_yolo_allowlist_entries). */
+function allowlistEntryMatchesRemoveToken(entry, token) {
+    const valStr = String(entry).toLowerCase();
+    const t = token.toLowerCase().trim();
+    if (!t)
+        return false;
+    const first = valStr.trim().split(/\s+/)[0] ?? '';
+    if (first === t || valStr === t)
+        return true;
+    const pattern = new RegExp(`(^|[^a-z0-9_|])${escapeRegExp(t)}([^a-z0-9_|]|$)`);
+    return pattern.test(valStr);
+}
 function verifyOpsApplied(configJson, settingPath, ops) {
     const parts = settingPath.split('.');
     const leafKey = parts[parts.length - 1] ?? '';
@@ -186,7 +201,14 @@ function verifyOpsApplied(configJson, settingPath, ops) {
         const curArr = Array.isArray(cur) ? cur : [];
         const toAdd = add[k] ?? [];
         const toRemove = remove[k] ?? [];
+        const isYoloAllowlist = leafKey === 'yoloCommandAllowlist' || targetPath.endsWith('.yoloCommandAllowlist');
         for (const item of toRemove) {
+            if (isYoloAllowlist) {
+                if (curArr.some((entry) => allowlistEntryMatchesRemoveToken(entry, String(item)))) {
+                    return { ok: false, expected: { op: 'remove', path: targetPath, value: item } };
+                }
+                continue;
+            }
             if (curArr.some((curItem) => deepEqual(curItem, item))) {
                 return { ok: false, expected: { op: 'remove', path: targetPath, value: item } };
             }

package/dist/log_config_files/runtime/main_runner.js

@@ -12,8 +12,9 @@ import { ensureAuthentication } from '../auth/auth_flow.js';
 import { readJSONFile, readMarkdownFile } from '../readers/file_readers.js';
 import { isVscdbVirtualPath, tryReadVscdbVirtualFile, summarizeComposerPayloadForDiagnostics, } from '../readers/vscdb_config_builder.js';
 import { persistVscdbComposerContractFromPatternsResponse } from '../readers/vscdb_reader.js';
-import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, determineFileTypeFromPath } from '../collection/config_collector.js';
+import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles, collectMcpFromClaudeJsonProjects, collectClaudeDesktopExtensionManifests, enrichClaudeDesktopExtensionsInstallationsUpload, determineFileTypeFromPath, } from '../collection/config_collector.js';
 import { collectWorkspaceVscdbs } from '../collection/mcp_tool_collector.js';
+import { collectCursorProjectWorkspaceMcpConfigs } from '../collection/cursor_project_mcp_collector.js';
 import { normalizePathSkipPrefixes } from '../paths/pattern_resolver.js';
 import { sendConfigFile, sendConfigFilesBatch, sendHookRequestCreate, sendHookRequestUpdateManifest, sendIngestSessionStart, sendIngestSessionFinish, BATCH_CHUNK_SIZE } from '../sender/batch_sender.js';
 import { canonicalCursorUserStateVscdbPath } from './remediation_config_path.js';
@@ -55,6 +56,14 @@ async function collectAllConfigFiles(endpointBase) {
             configFiles.push(m);
         }
     }
+    hookRunLog(`scanning Cursor project workspace MCP configs (~/.cursor/projects/*/mcp-cache.json)`);
+    for (const m of collectCursorProjectWorkspaceMcpConfigs(mcpToolSkipPrefixes, patternsResponse.client_path_constants, patternsResponse.workspace_vscdb_spec, HOME_DIR)) {
+        const key = `${m.file_type}\t${m.file_path}`;
+        if (!existingPaths.has(key)) {
+            existingPaths.add(key);
+            configFiles.push(m);
+        }
+    }
     if (patternsResponse.workspace_vscdb_spec) {
         hookRunLog(`scanning Cursor workspace vscdb files`);
         for (const m of collectWorkspaceVscdbs(patternsResponse.workspace_vscdb_spec)) {
@@ -69,6 +78,35 @@ async function collectAllConfigFiles(endpointBase) {
     if (!patternsResponse.client_path_constants)
         throw new Error('client_path_constants required from API response');
     configFiles.push(...collectConfigFilesFromInstalledPlugins(patternsResponse.client_path_constants));
+    hookRunLog(`scanning Claude plugin cache MCP manifests`);
+    for (const entry of collectPluginCacheMcpFiles(patternsResponse.client_path_constants, HOME_DIR)) {
+        const key = `${entry.file_type}\t${entry.file_path}`;
+        if (!existingPaths.has(key)) {
+            existingPaths.add(key);
+            configFiles.push(entry);
+        }
+    }
+    hookRunLog(`scanning Claude known projects from ~/.claude.json`);
+    for (const entry of collectMcpFromClaudeJsonProjects(HOME_DIR)) {
+        const key = `${entry.file_type}\t${entry.file_path}`;
+        if (!existingPaths.has(key)) {
+            existingPaths.add(key);
+            configFiles.push(entry);
+        }
+    }
+    hookRunLog(`merging disk-only Claude Desktop extensions into extensions-installations.json`);
+    const diskExtMerge = enrichClaudeDesktopExtensionsInstallationsUpload(configFiles, HOME_DIR);
+    hookRunLog(`claude desktop extensions: merged=${diskExtMerge.mergedCount} had_registry_upload=${diskExtMerge.hadRegistryUpload}`);
+    if (!diskExtMerge.hadRegistryUpload && diskExtMerge.mergedCount > 0) {
+        hookRunLog(`scanning Claude Desktop extension manifests on disk (no registry upload in batch)`);
+        for (const entry of collectClaudeDesktopExtensionManifests(HOME_DIR)) {
+            const key = `${entry.file_type}\t${entry.file_path}`;
+            if (!existingPaths.has(key)) {
+                existingPaths.add(key);
+                configFiles.push(entry);
+            }
+        }
+    }
     const worktreeReport = scanActiveWorktrees(PROJECT_ROOT, HOME_DIR);
     const activeRoots = activeWorktreeRootSet(worktreeReport);
     const beforeFilter = configFiles.length;
@@ -108,7 +146,7 @@ async function sendAllConfigFiles(configFiles, worktreeReport, hardwareUuid, aut
         const ok = await sendHookRequestUpdateManifest(hardwareUuid, authKey, hookRequestId, manifest);
         hookRunLog(`hook-request update manifest result=${ok ? 'ok' : 'fail'}`);
     }
-    // Finish ingest session: OpenClaw hold set, worktree prune (report may be []), and scans.
+    // Finish ingest session: failed_uploads hold set, worktree prune, config prune-on-absence, and scans.
     // Run finish whenever a session was started — even if every upload failed — so worktree
     // cleanup still runs for machines with only stale worktrees on disk.
     if (ingestSessionId) {

package/dist/log_config_files/runtime/remediation_sync.js

@@ -428,6 +428,23 @@ function applyCheck(configJson, check) {
     }
     setByPath(configJson, check.setting_path, value);
 }
+// ---------------------------------------------------------------------------
+// SQLite remediation support
+// ---------------------------------------------------------------------------
+function escapeRegExpForAllowlist(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function allowlistEntryMatchesRemoveToken(entry, token) {
+    const valStr = String(entry).toLowerCase();
+    const t = token.toLowerCase().trim();
+    if (!t)
+        return false;
+    const first = valStr.trim().split(/\s+/)[0] ?? '';
+    if (first === t || valStr === t)
+        return true;
+    const pattern = new RegExp(`(^|[^a-z0-9_|])${escapeRegExpForAllowlist(t)}([^a-z0-9_|]|$)`);
+    return pattern.test(valStr);
+}
 function mergePostApplyUploadIntoPayload(payload, hint) {
     if (!hint)
         return;
@@ -674,6 +691,30 @@ function mergeSqliteOpIntoJson(currentJson, sqliteOp) {
         container[arrayKey] = existing.filter((x) => !removeSet.has(String(x)));
         return;
     }
+    if (sqliteOp.remove_commands?.length &&
+        (sqliteOp.json_path ?? '').includes('yoloCommandAllowlist') &&
+        !sqliteOp.array_remove?.length) {
+        const jp = (sqliteOp.json_path ?? '').trim();
+        const parts = jp.split('.').filter(Boolean);
+        if (parts.length === 0)
+            return;
+        let node = currentJson;
+        for (const p of parts.slice(0, -1)) {
+            if (node == null || typeof node !== 'object' || Array.isArray(node))
+                return;
+            node = node[p];
+        }
+        if (node == null || typeof node !== 'object' || Array.isArray(node))
+            return;
+        const container = node;
+        const arrayKey = parts[parts.length - 1];
+        const existing = container[arrayKey];
+        if (!Array.isArray(existing))
+            return;
+        const tokens = sqliteOp.remove_commands.map((t) => String(t).trim()).filter(Boolean);
+        container[arrayKey] = existing.filter((entry) => !tokens.some((t) => allowlistEntryMatchesRemoveToken(entry, t)));
+        return;
+    }
     const where = sqliteOp.array_item_where;
     const jp = sqliteOp.json_path ?? '';
     if (where && typeof where === 'object' && Object.keys(where).length > 0 && jp) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config-staging",
-  "version": "1.3.93",
+  "version": "1.3.96",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {