log-llm-config 1.2.7 → 1.3.0

package/dist/apply_deferred_vscdb.js

@@ -0,0 +1,8 @@
+/**
+ * Runs after Cursor SIGKILL: applies queued state.vscdb patches from
+ * ~/opt-ai-sec/management/optimus_deferred_vscdb_apply.json (see remediation_sync).
+ */
+import { applyDeferredVscdbFromDisk } from './log_config_files/runtime/remediation_sync.js';
+applyDeferredVscdbFromDisk()
+    .then((ok) => process.exit(ok ? 0 : 1))
+    .catch(() => process.exit(1));

package/dist/cli/bash_script_generator.js

@@ -1,3 +1,9 @@
+import { readFileCollectionVscdbContract } from '../log_config_files/runtime/management_storage.js';
+/** Reactive ItemTable key from backend-derived cache (written on log-config); same path as remediations. */
+function readReactiveStorageItemKeyFromDisk() {
+    const k = readFileCollectionVscdbContract()?.reactive_storage_item_key;
+    return typeof k === 'string' && k.trim() !== '' ? k.trim() : null;
+}
 const fileCategories = [
     { label: 'Cursor: mcp.json', targets: ['./.cursor/mcp.json', '$HOME/.cursor/mcp.json'] },
     { label: 'Claude: .mcp.json', targets: ['./mcp.json', './.mcp.json', '/Library/Application Support/ClaudeCode/managed-mcp.json'] },
@@ -5,15 +11,20 @@ const fileCategories = [
     { label: 'Cursor: hooks.json', targets: ['./.cursor/hooks.json', '$HOME/.cursor/hooks.json', '/Library/Application Support/Cursor/hooks.json'] },
     { label: 'Cursor: User/settings.json (user-level)', targets: ['$HOME/Library/Application Support/Cursor/User/settings.json'] },
 ];
-const sqliteCategories = [
-    {
-        label: 'Cursor: state.vscdb (composerState)',
-        dbPath: '$HOME/Library/Application Support/Cursor/User/globalStorage/state.vscdb',
-        table: 'ItemTable',
-        key: 'src.vs.platform.reactivestorage.browser.reactiveStorageServiceImpl.persistentStorage.applicationUser',
-        jsonPaths: [['composerState'], []],
-    },
-];
+function buildSqliteCategories() {
+    const key = readReactiveStorageItemKeyFromDisk();
+    if (!key)
+        return [];
+    return [
+        {
+            label: 'Cursor: state.vscdb (reactive blob / composerState)',
+            dbPath: '$HOME/Library/Application Support/Cursor/User/globalStorage/state.vscdb',
+            table: 'ItemTable',
+            key,
+            jsonPaths: [['composerState'], []],
+        },
+    ];
+}
 function buildFileCategoryLines(category) {
     return [
         `echo "===== ${category.label} ====="`,
@@ -38,12 +49,13 @@ function buildFileCategoryLines(category) {
 }
 function buildSqliteCategoryLines(category) {
     const jsonPathsLiteral = JSON.stringify(category.jsonPaths);
+    const safeSqlKey = category.key.replace(/'/g, "''");
     return [
         `echo "===== ${category.label} ====="`, `db_path="${category.dbPath}"`,
         'expanded=$(eval echo "$db_path")',
         'if [ -f "$expanded" ]; then', '  if command -v sqlite3 >/dev/null 2>&1; then',
         '    echo "===== $expanded ====="',
-        `    query_result=$(sqlite3 "$expanded" "SELECT value FROM ${category.table} WHERE key='${category.key}'")`,
+        `    query_result=$(sqlite3 "$expanded" "SELECT value FROM ${category.table} WHERE key='${safeSqlKey}'")`,
         '    if [ -n "$query_result" ]; then',
         `      echo "===== key: ${category.key} ====="`,
         `      LOG_CONFIG_JSON_VALUE="$query_result" python3 - <<'PY'`,
@@ -76,7 +88,7 @@ function renderBashScript() {
         '    local suffix="${path#"$repo_root"}"', '    if [ -z "$suffix" ]; then', '      echo "<project_root>"',
         '    else', '      echo "<project_root>${suffix}"', '    fi', '  else', '    echo "$path"', '  fi', '}', '',
         ...fileCategories.flatMap(buildFileCategoryLines),
-        ...sqliteCategories.flatMap(buildSqliteCategoryLines),
+        ...buildSqliteCategories().flatMap(buildSqliteCategoryLines),
     ];
     return scriptLines.join('\n');
 }

package/dist/compliance_check_runner.js

@@ -1,9 +1,40 @@
+import { appendFileSync, mkdirSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { OPT_AI_SEC_MANAGEMENT_REL } from './bootstrap_constants.js';
+import { hookLogSessionBanner } from './log_config_files/runtime/hook_logger.js';
 import { runComplianceCheck } from './log_config_files/runtime/compliance_check.js';
+/** Append-only log for compliance runner lifecycle; hook_log.txt is also append-only (session banners). */
+function runnerFileLog(message) {
+    try {
+        const dir = join(homedir(), OPT_AI_SEC_MANAGEMENT_REL);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const path = join(dir, 'compliance_runner.log');
+        appendFileSync(path, `${new Date().toISOString()} ${message}\n`, 'utf8');
+    }
+    catch {
+        /* ignore */
+    }
+}
 (async () => {
+    hookLogSessionBanner('compliance_check_runner (background sync + check)');
+    runnerFileLog('compliance_check_runner: start');
     try {
         await runComplianceCheck();
+        runnerFileLog('compliance_check_runner: finished ok');
     }
     catch (err) {
+        const detail = err instanceof Error ? err.stack ?? err.message : String(err);
+        runnerFileLog('compliance_check_runner: uncaught error');
+        try {
+            const dir = join(homedir(), OPT_AI_SEC_MANAGEMENT_REL);
+            const path = join(dir, 'compliance_runner.log');
+            appendFileSync(path, `${detail}\n\n`, 'utf8');
+        }
+        catch {
+            /* ignore */
+        }
         process.stderr.write(`compliance_check_runner error: ${err instanceof Error ? err.message : String(err)}\n`);
         process.exit(1);
     }

package/dist/compliance_prompt_gate.js

@@ -4,7 +4,9 @@
  */
 import { applyAutofixViolations, pruneSatisfiedOneTimeRemediations, runLocalRemediationComplianceCheck, } from './log_config_files/runtime/compliance_check.js';
 import { existsSync, statSync } from 'node:fs';
+import { spawn } from 'node:child_process';
 import { getRemediationInstructionsPath } from './log_config_files/runtime/management_storage.js';
+import { hookLogSessionBanner, hookRunLog } from './log_config_files/runtime/hook_logger.js';
 const MANIFEST_STALE_MS = 7 * 24 * 60 * 60 * 1000;
 function parseIde() {
     const eq = process.argv.find((a) => a.startsWith('--ide='));
@@ -42,6 +44,13 @@ function blockPayload(ide, violationMessage) {
     }
     return JSON.stringify({ continue: false, user_message: text });
 }
+function fireRestartCommands(commands) {
+    for (const cmd of commands) {
+        hookRunLog(`restart: firing command="${cmd}"`);
+        const child = spawn('sh', ['-c', cmd], { detached: true, stdio: 'ignore' });
+        child.unref();
+    }
+}
 function getManifestStalenessMs() {
     try {
         const path = getRemediationInstructionsPath();
@@ -55,7 +64,20 @@ function getManifestStalenessMs() {
     }
 }
 const ide = parseIde();
+/** Short line for success dialog: finding title/sentence from manifest, not per-check remediation technical text. */
+function autofixDialogLine(v) {
+    const title = v.finding_title?.trim();
+    if (title)
+        return `• [${v.finding_formatted_id}] ${title}`;
+    const fd = v.finding_description?.trim();
+    if (fd)
+        return `• [${v.finding_formatted_id}] ${fd}`;
+    const d = v.description.trim();
+    const short = d.length > 160 ? `${d.slice(0, 157)}…` : d;
+    return `• [${v.finding_formatted_id}] ${short}`;
+}
 async function run() {
+    hookLogSessionBanner('compliance_prompt_gate (before submit)');
     const status = runLocalRemediationComplianceCheck();
     if (status.status === 'fail' && status.violations.length > 0) {
         const staleMs = getManifestStalenessMs();
@@ -66,19 +88,28 @@ async function run() {
             printAllowWithAdvisory(ide, advisory);
             return;
         }
-        const { fixed, restartCommands, failedViolations, reportPromises } = applyAutofixViolations(status.violations);
+        const { fixed, restartCommands, failedViolations, reportPromises, deferredSqlitePending } = applyAutofixViolations(status.violations);
         if (fixed > 0) {
             // Wait for all server reports before exiting so the POST lands.
             await Promise.allSettled(reportPromises);
             const recheck = runLocalRemediationComplianceCheck();
-            if (recheck.status === 'ok' || recheck.violations.length === 0) {
+            const recheckOk = recheck.status === 'ok' || recheck.violations.length === 0;
+            if (deferredSqlitePending || recheckOk) {
                 const fixedViolations = status.violations.filter((v) => v.autofix_allowed);
-                const lines = fixedViolations.map((v) => `• [${v.finding_formatted_id}] ${v.description}`);
-                const autofixMessage = `Optimus Security auto-fixed ${fixed} policy violation(s):\n${lines.join('\n')}`;
+                const byUuid = new Map();
+                for (const v of fixedViolations) {
+                    if (!byUuid.has(v.uuid))
+                        byUuid.set(v.uuid, v);
+                }
+                const deduped = [...byUuid.values()];
+                const autofixMessage = `Optimus Security auto-fixed ${deduped.length} policy violation(s):\n${deduped.map((v) => autofixDialogLine(v)).join('\n')}`;
                 const payload = { __optimus_autofix: true, autofix_message: autofixMessage };
                 if (restartCommands.length > 0)
                     payload.restart_commands = restartCommands;
                 console.log(JSON.stringify(payload));
+                // Cursor: .cursor/hooks runs restart after the osascript dialog — avoid double SIGKILL here.
+                if (ide !== 'cursor')
+                    fireRestartCommands(restartCommands);
                 return;
             }
             const msg = recheck.violations[0]?.message ?? 'A security policy violation has been detected.';

package/dist/log_config_files/readers/vscdb_config_builder.js

@@ -81,8 +81,12 @@ function buildVscdbRawContentFromSpec(state, spec) {
         if (!Array.isArray(value) || value.length === 0)
             return null;
     }
-    if (spec.value_constraint === 'boolean' && typeof value !== 'boolean')
-        return null;
+    if (spec.value_constraint === 'boolean') {
+        const okBool = typeof value === 'boolean';
+        const okSqliteInt = typeof value === 'number' && (value === 0 || value === 1);
+        if (!okBool && !okSqliteInt)
+            return null;
+    }
     return buildRawContent(state, spec.state_key, value, spec.include_keys, new Date().toISOString());
 }
 /**

package/dist/log_config_files/readers/vscdb_reader.js

@@ -1,5 +1,6 @@
 import { existsSync } from 'node:fs';
 import { execSync } from 'node:child_process';
+import { readFileCollectionVscdbContract, writeFileCollectionVscdbContract, } from '../runtime/management_storage.js';
 function querySqlite(dbPath, key) {
     const safe = key.replace(/'/g, "''");
     return execSync(`sqlite3 "${dbPath}" "SELECT value FROM ItemTable WHERE key='${safe}'"`, {
@@ -7,6 +8,98 @@ function querySqlite(dbPath, key) {
         stdio: ['ignore', 'pipe', 'pipe'],
     }).trim();
 }
+/**
+ * Fallback if the API omits vscdb_composer_contract (older server): derive from vscdb_read_queries.
+ */
+export function parseVscdbComposerContractFromReadQueries(queries) {
+    const empty = {
+        version: 1,
+        reactive_storage_item_key: undefined,
+        composer_shadow_keys: [],
+    };
+    if (!queries?.length)
+        return empty;
+    for (const step of queries) {
+        if (step.value_kind === 'composer_with_include' && step.state_key === 'composerState') {
+            const keys = step.item_table_keys ?? [];
+            return {
+                version: 1,
+                reactive_storage_item_key: keys[0],
+                composer_shadow_keys: [...(step.include_keys ?? [])],
+            };
+        }
+    }
+    return empty;
+}
+export function normalizeVscdbComposerContractFromPatternsResponse(resp) {
+    const c = resp.vscdb_composer_contract;
+    const hasKey = c != null &&
+        ((typeof c.reactive_storage_item_key === 'string' && c.reactive_storage_item_key.trim() !== '') ||
+            (c.composer_shadow_keys?.length ?? 0) > 0);
+    if (hasKey && c) {
+        return {
+            version: 1,
+            reactive_storage_item_key: c.reactive_storage_item_key ?? undefined,
+            composer_shadow_keys: [...(c.composer_shadow_keys ?? [])],
+        };
+    }
+    return parseVscdbComposerContractFromReadQueries(resp.vscdb_read_queries);
+}
+/** Persist backend-derived contract next to remediation_instructions.json. */
+export function persistVscdbComposerContractFromPatternsResponse(resp) {
+    const norm = normalizeVscdbComposerContractFromPatternsResponse(resp);
+    if (norm.reactive_storage_item_key || norm.composer_shadow_keys.length > 0) {
+        writeFileCollectionVscdbContract(norm);
+    }
+}
+/**
+ * Read one ItemTable JSON blob (e.g. key `composerState`) and return `{ [itemKey]: object }` so
+ * dot-paths like `composerState.modes4.agent.autoRun` (or legacy numeric `modes4.0`) work in compliance checks. Empty / missing value
+ * yields `{ [itemKey]: {} }`. Returns null if the DB is missing, sqlite3 is unavailable, or JSON parse fails.
+ *
+ * When `file_collection_vscdb_contract.json` lists `reactive_storage_item_key`, a missing legacy `composerState` row
+ * falls back to nested `composerState` inside that reactive blob (paths from the backend API only).
+ */
+export function readVscdbItemTableJson(dbPath, itemKey) {
+    try {
+        if (!dbPath || !existsSync(dbPath))
+            return null;
+        execSync('which sqlite3', { stdio: 'ignore' });
+    }
+    catch {
+        return null;
+    }
+    try {
+        const raw = querySqlite(dbPath, itemKey);
+        const contract = readFileCollectionVscdbContract();
+        const reactiveKey = typeof contract?.reactive_storage_item_key === 'string' ? contract.reactive_storage_item_key.trim() : '';
+        if (itemKey === 'composerState' && (!raw || raw === '{}') && reactiveKey) {
+            const reactive = querySqlite(dbPath, reactiveKey);
+            if (reactive) {
+                const root = JSON.parse(reactive);
+                const cs = root.composerState;
+                if (cs !== null && typeof cs === 'object' && !Array.isArray(cs)) {
+                    return { composerState: cs };
+                }
+            }
+        }
+        if (!raw) {
+            return { [itemKey]: {} };
+        }
+        const parsed = JSON.parse(raw);
+        if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            return { [itemKey]: parsed };
+        }
+        // Bare JSON primitives (e.g. cursor/thirdPartyExtensibilityEnabled stores `true`/`false`).
+        if (typeof parsed === 'boolean' || typeof parsed === 'number' || typeof parsed === 'string') {
+            return { [itemKey]: parsed };
+        }
+        return { [itemKey]: {} };
+    }
+    catch {
+        return null;
+    }
+}
 function setNested(obj, dotPath, value) {
     const parts = dotPath.split('.');
     const safe = (k) => k !== '__proto__' && k !== 'constructor' && k !== 'prototype';
@@ -42,9 +135,17 @@ function runOneStep(dbPath, stateData, step) {
                     stateData.composerState = composerState;
                 }
                 if (step.include_keys?.length) {
+                    const nested = composerState && typeof composerState === 'object'
+                        ? composerState
+                        : undefined;
                     for (const k of step.include_keys) {
-                        if (k in obj && obj[k] !== undefined)
+                        // Prefer the value inside composerState when present; blob root can be stale vs the UI.
+                        if (nested && k in nested && nested[k] !== undefined) {
+                            stateData[k] = nested[k];
+                        }
+                        else if (k in obj && obj[k] !== undefined) {
                             stateData[k] = obj[k];
+                        }
                     }
                 }
                 return;

package/dist/log_config_files/runtime/compliance_check.js

@@ -9,23 +9,32 @@
  * Background: compliance_check_runner runs syncRemediations (network) then the same local check.
  */
 import { existsSync, readFileSync } from 'node:fs';
+import { readVscdbItemTableJson } from '../readers/vscdb_reader.js';
 import { readRemediationInstructionsFile, writeRemediationInstructionsFile } from './management_storage.js';
-import { hookRunLog } from './hook_logger.js';
+import { complianceRunnerDiag, hookRunLog } from './hook_logger.js';
 import { loadEndpointBase } from '../sender/endpoint_config.js';
 import { resolveHardwareUuid } from './hardware_uuid.js';
-import { enforceRemediation, fetchSync, remediationFixSpec, reportAutofixApplied, syncRemediations, } from './remediation_sync.js';
+import { buildDeferredCursorRestartCommand, enforceRemediation, fetchSync, remediationFixSpec, reportAutofixApplied, syncRemediations, } from './remediation_sync.js';
 import { sendConfigFile } from '../sender/batch_sender.js';
 import { readStoredAuthKey } from '../auth/auth_key_store.js';
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
 /** Traverse a JSON object using dot-notation path. Returns undefined if any segment is missing. */
-function getByPath(obj, path) {
+export function getByPath(obj, path) {
     const parts = path.split('.');
     let current = obj;
     for (const part of parts) {
         if (current == null || typeof current !== 'object')
             return undefined;
+        // Cursor composerState.modes4: non-numeric segment indexes by mode id (agent row is not always [0]).
+        if (Array.isArray(current) && !/^\d+$/.test(part)) {
+            const idx = current.findIndex((item) => item !== null &&
+                typeof item === 'object' &&
+                item.id === part);
+            current = idx >= 0 ? current[idx] : undefined;
+            continue;
+        }
         current = current[part];
     }
     return current;
@@ -76,6 +85,30 @@ function verifyOpsApplied(configJson, settingPath, ops) {
     }
     return { ok: true, expected: null };
 }
+/** Plain JSON file or virtual `…/state.vscdb#composerState` path for ItemTable-backed settings. */
+function loadRemediationConfigJson(configFilePath) {
+    const hashIdx = configFilePath.indexOf('#');
+    if (hashIdx >= 0) {
+        const dbPath = configFilePath.slice(0, hashIdx);
+        const itemKey = configFilePath.slice(hashIdx + 1).trim();
+        if (!itemKey)
+            return { ok: false, reason: 'empty_vscdb_key' };
+        if (!existsSync(dbPath))
+            return { ok: false, reason: 'db_not_found' };
+        const wrapped = readVscdbItemTableJson(dbPath, itemKey);
+        if (wrapped === null)
+            return { ok: false, reason: 'vscdb_read_failed' };
+        return { ok: true, json: wrapped };
+    }
+    if (!existsSync(configFilePath))
+        return { ok: false, reason: 'file_not_found' };
+    try {
+        return { ok: true, json: JSON.parse(readFileSync(configFilePath, 'utf8')) };
+    }
+    catch {
+        return { ok: false, reason: 'parse_error' };
+    }
+}
 // ---------------------------------------------------------------------------
 // Check runner — Section 6: real per-check evaluation
 // ---------------------------------------------------------------------------
@@ -104,18 +137,21 @@ export function runLocalRemediationComplianceCheck() {
             const checks = compliance.checks ?? [];
             if (checks.length === 0)
                 continue;
-            if (!existsSync(entry.config_file_path)) {
-                hookRunLog(`compliance_check: config file not found, skipping uuid=${entry.uuid}`);
-                continue;
-            }
-            let configJson;
-            try {
-                configJson = JSON.parse(readFileSync(entry.config_file_path, 'utf8'));
-            }
-            catch {
-                hookRunLog(`compliance_check: could not parse config file, skipping uuid=${entry.uuid}`);
+            const loaded = loadRemediationConfigJson(entry.config_file_path);
+            if (!loaded.ok) {
+                const msg = loaded.reason === 'file_not_found'
+                    ? `compliance_check: config file not found, skipping uuid=${entry.uuid}`
+                    : loaded.reason === 'db_not_found'
+                        ? `compliance_check: vscdb file not found, skipping uuid=${entry.uuid}`
+                        : loaded.reason === 'vscdb_read_failed'
+                            ? `compliance_check: could not read vscdb (sqlite3 missing or invalid JSON?), skipping uuid=${entry.uuid}`
+                            : loaded.reason === 'empty_vscdb_key'
+                                ? `compliance_check: invalid vscdb path (empty # key), skipping uuid=${entry.uuid}`
+                                : `compliance_check: could not parse config file, skipping uuid=${entry.uuid}`;
+                hookRunLog(msg);
                 continue;
             }
+            const configJson = loaded.json;
             for (const check of checks) {
                 // Prefer ops-based verification (matches delta apply semantics; doesn't require full after snapshot).
                 if (check.ops) {
@@ -127,6 +163,8 @@ export function runLocalRemediationComplianceCheck() {
                             finding_formatted_id: compliance.finding_formatted_id,
                             setting_path: check.setting_path,
                             description: check.description,
+                            finding_title: entry.finding_title,
+                            finding_description: entry.finding_description,
                             severity: compliance.severity,
                             autofix_allowed: compliance.autofix_allowed,
                             config_file_path: entry.config_file_path,
@@ -149,6 +187,8 @@ export function runLocalRemediationComplianceCheck() {
                         finding_formatted_id: compliance.finding_formatted_id,
                         setting_path: check.setting_path,
                         description: check.description,
+                        finding_title: entry.finding_title,
+                        finding_description: entry.finding_description,
                         severity: compliance.severity,
                         autofix_allowed: compliance.autofix_allowed,
                         config_file_path: entry.config_file_path,
@@ -190,6 +230,7 @@ export function applyAutofixViolations(violations) {
     const failedViolations = [];
     const reportPromises = [];
     const oneTimeAppliedUuids = new Set();
+    let deferredSqlitePending = false;
     for (const violation of autofixable) {
         if (seen.has(violation.uuid))
             continue;
@@ -200,20 +241,39 @@ export function applyAutofixViolations(violations) {
             continue;
         }
         const inst = instruction;
-        const ok = enforceRemediation(inst);
-        if (ok) {
-            seen.add(violation.uuid);
-            fixed++;
-            hookRunLog(`autofix: applied uuid=${inst.uuid} path=${inst.config_file_path}`);
-            reportPromises.push(reportAutofixApplied(inst.uuid, 'success'));
-            const authKey = readStoredAuthKey();
-            if (authKey) {
+        complianceRunnerDiag(`autofix: calling enforceRemediation uuid=${inst.uuid} path=${inst.config_file_path}`);
+        const er = enforceRemediation(inst);
+        if (!er.ok) {
+            failedViolations.push(violation);
+            continue;
+        }
+        if (er.deferredSqlite)
+            deferredSqlitePending = true;
+        seen.add(violation.uuid);
+        fixed++;
+        hookRunLog(`autofix: applied uuid=${inst.uuid} path=${inst.config_file_path}`);
+        reportPromises.push(reportAutofixApplied(inst.uuid, 'success'));
+        const authKey = readStoredAuthKey();
+        if (authKey) {
+            if (er.deferredSqlite && inst.config_file_path.includes('#')) {
+                hookRunLog(`autofix: skip immediate vscdb upload (deferred until after restart) uuid=${inst.uuid}`);
+            }
+            else {
                 let updatedContent;
-                try {
-                    updatedContent = JSON.parse(readFileSync(inst.config_file_path, 'utf8'));
+                if (inst.config_file_path.includes('#')) {
+                    const hi = inst.config_file_path.indexOf('#');
+                    const dbPath = inst.config_file_path.slice(0, hi);
+                    const itemKey = inst.config_file_path.slice(hi + 1).trim();
+                    updatedContent =
+                        itemKey ? (readVscdbItemTableJson(dbPath, itemKey) ?? undefined) : undefined;
                 }
-                catch {
-                    updatedContent = undefined;
+                else {
+                    try {
+                        updatedContent = JSON.parse(readFileSync(inst.config_file_path, 'utf8'));
+                    }
+                    catch {
+                        updatedContent = undefined;
+                    }
                 }
                 if (updatedContent !== undefined) {
                     const fileType = (inst.file_type ?? '').trim();
@@ -227,22 +287,26 @@ export function applyAutofixViolations(violations) {
                     }
                 }
             }
-            else {
-                hookRunLog(`autofix: skip re-upload uuid=${inst.uuid} (no stored auth key)`);
-            }
-            const spec = remediationFixSpec(inst);
-            if (spec?.restart_required && spec.restart_command) {
+        }
+        else {
+            hookRunLog(`autofix: skip re-upload uuid=${inst.uuid} (no stored auth key)`);
+        }
+        const spec = remediationFixSpec(inst);
+        if (spec?.restart_required && spec.restart_command) {
+            if (!er.deferredSqlite) {
                 hookRunLog(`autofix: restart required uuid=${inst.uuid} command=${spec.restart_command}`);
                 restartCommands.push(spec.restart_command);
             }
-            if (!inst.is_enforced) {
-                oneTimeAppliedUuids.add(inst.uuid);
-            }
         }
-        else {
-            failedViolations.push(violation);
+        if (!inst.is_enforced) {
+            oneTimeAppliedUuids.add(inst.uuid);
         }
     }
+    if (deferredSqlitePending) {
+        restartCommands.length = 0;
+        restartCommands.push(buildDeferredCursorRestartCommand());
+        hookRunLog('autofix: deferred vscdb — restart command runs apply_deferred_vscdb.js then open -a Cursor');
+    }
     if (oneTimeAppliedUuids.size > 0) {
         const remaining = remediations.filter((r) => !oneTimeAppliedUuids.has(r.uuid));
         writeRemediationInstructionsFile({ remediations: remaining });
@@ -257,7 +321,7 @@ export function applyAutofixViolations(violations) {
     if (fixed > 0) {
         hookRunLog(`autofix: total_applied=${fixed}`);
     }
-    return { fixed, restartCommands, failedViolations, reportPromises };
+    return { fixed, restartCommands, failedViolations, reportPromises, deferredSqlitePending };
 }
 /**
  * Remove satisfied one-time remediations from local remediation_instructions.json.
@@ -285,18 +349,12 @@ export function pruneSatisfiedOneTimeRemediations() {
             remaining.push(raw);
             continue;
         }
-        if (!existsSync(inst.config_file_path)) {
-            remaining.push(raw);
-            continue;
-        }
-        let configJson;
-        try {
-            configJson = JSON.parse(readFileSync(inst.config_file_path, 'utf8'));
-        }
-        catch {
+        const prLoaded = loadRemediationConfigJson(inst.config_file_path);
+        if (!prLoaded.ok) {
             remaining.push(raw);
             continue;
         }
+        const configJson = prLoaded.json;
         // Only prune when every check is ops-based and currently satisfied.
         let okAll = true;
         for (const check of checks) {

package/dist/log_config_files/runtime/hook_logger.js

@@ -1,15 +1,40 @@
-import { existsSync, mkdirSync, writeFileSync, appendFileSync } from 'node:fs';
+import { existsSync, mkdirSync, appendFileSync } from 'node:fs';
 import path from 'node:path';
 import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
 const HOOK_LOG_FILENAME = 'hook_log.txt';
+const COMPLIANCE_RUNNER_LOG_FILENAME = 'compliance_runner.log';
 function getHookLogPath() {
     const homeDir = process.env.HOME || process.env.USERPROFILE;
     if (!homeDir)
         return null;
     return path.join(homeDir, OPT_AI_SEC_MANAGEMENT_REL, HOOK_LOG_FILENAME);
 }
-/** Replace hook log file at the start of a run so it doesn't grow unboundedly. */
-function hookLogReplace() {
+function getComplianceRunnerLogPath() {
+    const homeDir = process.env.HOME || process.env.USERPROFILE;
+    if (!homeDir)
+        return null;
+    return path.join(homeDir, OPT_AI_SEC_MANAGEMENT_REL, COMPLIANCE_RUNNER_LOG_FILENAME);
+}
+/**
+ * Append-only diagnostics (not truncated by main_runner). Use for remediation sync / compliance.
+ */
+function complianceRunnerDiag(message) {
+    const logPath = getComplianceRunnerLogPath();
+    if (!logPath)
+        return;
+    try {
+        const dir = path.dirname(logPath);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const ts = new Date().toISOString();
+        appendFileSync(logPath, `${ts} ${message}\n`, 'utf8');
+    }
+    catch {
+        // best-effort
+    }
+}
+/** Visible delimiter between hook_log.txt sessions (compliance gate, upload, etc.). */
+function hookLogSessionBanner(label) {
     const logPath = getHookLogPath();
     if (!logPath)
         return;
@@ -17,12 +42,20 @@ function hookLogReplace() {
         const dir = path.dirname(logPath);
         if (!existsSync(dir))
             mkdirSync(dir, { recursive: true, mode: 0o700 });
-        writeFileSync(logPath, '', 'utf8');
+        const ts = new Date().toISOString();
+        const banner = `\n${'='.repeat(72)}\n${ts} session: ${label}\n${'='.repeat(72)}\n`;
+        appendFileSync(logPath, banner, 'utf8');
     }
     catch {
         // best-effort
     }
 }
+/**
+ * @deprecated Name kept for callers: begins a log_config_files upload section (append-only, does not truncate).
+ */
+function hookLogReplace() {
+    hookLogSessionBanner('log_config_files (config upload)');
+}
 /** Append a timestamped line to hook_log.txt. */
 function hookRunLog(message) {
     const logPath = getHookLogPath();
@@ -48,4 +81,4 @@ function hookLogLine(message) {
         // best-effort
     }
 }
-export { getHookLogPath, hookLogReplace, hookRunLog, hookLogLine };
+export { getHookLogPath, getComplianceRunnerLogPath, hookLogReplace, hookLogSessionBanner, hookRunLog, hookLogLine, complianceRunnerDiag, };