log-llm-config-staging 1.4.0 → 1.4.2

package/dist/log_config_files/runtime/compliance_check.js

@@ -43,6 +43,8 @@ export function normalizeAgentToken(raw) {
         return 'copilot';
     if (s === 'opencode')
         return 'opencode';
+    if (s === 'codex')
+        return 'codex';
     return '';
 }
 function currentAgentFromEnv() {
@@ -58,6 +60,8 @@ function currentAgentFromEnv() {
         return 'copilot';
     if (hookType === 'opencode')
         return 'opencode';
+    if (hookType === 'codex')
+        return 'codex';
     return 'claude';
 }
 function targetsCurrentAgent(entry, agent) {

package/dist/log_config_files/runtime/hook_type_for_request.js

@@ -6,7 +6,7 @@ function normalizeToken(raw) {
         return 'claude';
     if (s === 'github_copilot')
         return 'copilot';
-    if (s === 'cursor' || s === 'claude' || s === 'copilot' || s === 'opencode')
+    if (s === 'cursor' || s === 'claude' || s === 'copilot' || s === 'opencode' || s === 'codex')
         return s;
     // Legacy hooks set OPTIMUS_AGENT=Cursor (display casing)
     if (raw.trim() === 'Cursor')
@@ -24,5 +24,7 @@ export function resolveHookTypeFromEnv(env = process.env) {
         return 'copilot';
     if (token === 'opencode')
         return 'opencode';
+    if (token === 'codex')
+        return 'codex';
     return 'claude';
 }

package/dist/log_config_files/runtime/trusted_restarts.js

@@ -36,6 +36,8 @@ function currentAgentFromEnv() {
         return 'copilot';
     if (override === 'opencode')
         return 'opencode';
+    if (override === 'codex')
+        return 'codex';
     if (override === 'claude' || override === 'claude_desktop')
         return 'claude';
     const hookType = normalizeAgentToken(process.env.OPTIMUS_HOOK_TYPE);
@@ -45,6 +47,8 @@ function currentAgentFromEnv() {
         return 'copilot';
     if (hookType === 'opencode')
         return 'opencode';
+    if (hookType === 'codex')
+        return 'codex';
     return 'claude';
 }
 /** Spawn each trusted command detached (same pattern as former compliance_prompt_gate fireRestartCommands). */

package/dist/log_sensitive_paths_audit.js

@@ -6,7 +6,7 @@
  * Path templates are fetched from the backend (GET api/file-path-registry/sensitive-paths-audit-candidates/).
  * The audit is sent with the rest of the config files in log_config_files (same auth, same batch).
  */
-import { existsSync, writeFileSync, mkdirSync } from 'node:fs';
+import { existsSync, writeFileSync, mkdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { getSensitivePathsAuditCandidates } from './endpoint_client/index.js';
@@ -22,16 +22,35 @@ function expandPath(template, cwd) {
     }
     return join(cwd, template);
 }
+/** True when path exists: directories always qualify; files must be non-empty (size > 0). */
+function shouldIncludeSensitivePath(resolved) {
+    if (!existsSync(resolved)) {
+        return false;
+    }
+    try {
+        const st = statSync(resolved);
+        if (st.isDirectory()) {
+            return true;
+        }
+        if (st.isFile()) {
+            return st.size > 0;
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Write sensitive_paths_audit.txt under outputDir. pathTemplates from backend (~ = home).
- * Lists one path per line for paths that exist. No file contents are read.
+ * Lists one path per line for paths that exist (files must be non-empty). No file contents are read.
  * Overwrites the file on each run (same as hook_log.txt); does not append.
  */
 export function writeSensitivePathsAudit(outputDir, pathTemplates, cwd = process.cwd()) {
     const existing = [];
     for (const template of pathTemplates) {
         const resolved = expandPath(template, cwd);
-        if (existsSync(resolved)) {
+        if (shouldIncludeSensitivePath(resolved)) {
             existing.push(resolved);
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config-staging",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {
@@ -49,11 +49,11 @@
   },
   "devDependencies": {
     "@types/node": "^24.10.1",
-    "@vitest/coverage-v8": "^3.2.4",
-    "@vitest/ui": "^3.2.4",
+    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/ui": "^4.1.8",
     "ts-node": "^10.9.2",
     "typescript": "^5.4.5",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.8"
   },
   "dependencies": {
     "axios": "^1.15.2",

package/dist/log_config_files/runtime/npm_env_sanitize.js

@@ -1,40 +0,0 @@
-/**
- * npm/npx --package=... sets lifecycle env vars that break unrelated scoped `npx @scope/pkg`
- * (e.g. MCP servers). Strip before spawning shells that may reopen Cursor or run other npx.
- */
-export const NPM_EXEC_POLLUTION_KEYS = [
-    'npm_command',
-    'npm_config_local_prefix',
-    'npm_config_package',
-    'npm_lifecycle_event',
-    'npm_lifecycle_script',
-    'npm_lifecycle_inject_node',
-    'npm_package_json',
-    'npm_execpath',
-    'npm_config_yes',
-    'npm_config_node_gyp',
-    'npm_config_npm_version',
-    'npm_config_user_agent',
-    'NPM_COMMAND',
-    'NPM_CONFIG_LOCAL_PREFIX',
-    'NPM_CONFIG_PACKAGE',
-    'NPM_LIFECYCLE_EVENT',
-    'NPM_LIFECYCLE_SCRIPT',
-    'NPM_EXECPATH',
-    'NPM_CONFIG_YES',
-];
-export function envWithoutNpmExecPollution(env) {
-    const clean = { ...env };
-    for (const key of NPM_EXEC_POLLUTION_KEYS) {
-        delete clean[key];
-    }
-    return clean;
-}
-/** Bash prefix: unset lifecycle vars before running npx in deferred restart shells. */
-export const DEFERRED_RESTART_UNSET_NPM_ENV = 'unset npm_command npm_config_local_prefix npm_config_package npm_lifecycle_event ' +
-    'npm_lifecycle_script npm_lifecycle_inject_node npm_package_json npm_execpath npm_config_yes ' +
-    'npm_config_node_gyp npm_config_npm_version npm_config_user_agent ' +
-    'NPM_COMMAND NPM_CONFIG_LOCAL_PREFIX NPM_CONFIG_PACKAGE NPM_LIFECYCLE_EVENT NPM_LIFECYCLE_SCRIPT NPM_EXECPATH 2>/dev/null; ';
-/** Bash wrapper for npx in deferred restart (env -u strips inherited npm exec state). */
-export const DEFERRED_RESTART_NPX = 'env -u npm_command -u npm_config_local_prefix -u npm_config_package -u npm_lifecycle_event ' +
-    '-u npm_lifecycle_script -u npm_lifecycle_inject_node -u npm_package_json -u npm_execpath npx';