log-llm-config 1.2.8 → 1.3.2

package/dist/log_config_files/runtime/compliance_check.js

@@ -9,23 +9,32 @@
  * Background: compliance_check_runner runs syncRemediations (network) then the same local check.
  */
 import { existsSync, readFileSync } from 'node:fs';
+import { readVscdbItemTableJson } from '../readers/vscdb_reader.js';
 import { readRemediationInstructionsFile, writeRemediationInstructionsFile } from './management_storage.js';
-import { hookRunLog } from './hook_logger.js';
+import { complianceRunnerDiag, hookRunLog } from './hook_logger.js';
 import { loadEndpointBase } from '../sender/endpoint_config.js';
-import { resolveHardwareUuid } from './hardware_uuid.js';
-import { enforceRemediation, fetchSync, remediationFixSpec, reportAutofixApplied, syncRemediations, } from './remediation_sync.js';
+import { resolveHardwareUuid, tryResolveHardwareUuid } from './hardware_uuid.js';
+import { buildDeferredCursorRestartCommand, enforceRemediation, fetchSync, isTrustedRestartCommandForAutofix, remediationFixSpec, reportAutofixApplied, syncRemediations, } from './remediation_sync.js';
 import { sendConfigFile } from '../sender/batch_sender.js';
 import { readStoredAuthKey } from '../auth/auth_key_store.js';
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
 /** Traverse a JSON object using dot-notation path. Returns undefined if any segment is missing. */
-function getByPath(obj, path) {
+export function getByPath(obj, path) {
     const parts = path.split('.');
     let current = obj;
     for (const part of parts) {
         if (current == null || typeof current !== 'object')
             return undefined;
+        // Cursor composerState.modes4: non-numeric segment indexes by mode id (agent row is not always [0]).
+        if (Array.isArray(current) && !/^\d+$/.test(part)) {
+            const idx = current.findIndex((item) => item !== null &&
+                typeof item === 'object' &&
+                item.id === part);
+            current = idx >= 0 ? current[idx] : undefined;
+            continue;
+        }
         current = current[part];
     }
     return current;
@@ -76,6 +85,30 @@ function verifyOpsApplied(configJson, settingPath, ops) {
     }
     return { ok: true, expected: null };
 }
+/** Plain JSON file or virtual `…/state.vscdb#composerState` path for ItemTable-backed settings. */
+function loadRemediationConfigJson(configFilePath) {
+    const hashIdx = configFilePath.indexOf('#');
+    if (hashIdx >= 0) {
+        const dbPath = configFilePath.slice(0, hashIdx);
+        const itemKey = configFilePath.slice(hashIdx + 1).trim();
+        if (!itemKey)
+            return { ok: false, reason: 'empty_vscdb_key' };
+        if (!existsSync(dbPath))
+            return { ok: false, reason: 'db_not_found' };
+        const wrapped = readVscdbItemTableJson(dbPath, itemKey);
+        if (wrapped === null)
+            return { ok: false, reason: 'vscdb_read_failed' };
+        return { ok: true, json: wrapped };
+    }
+    if (!existsSync(configFilePath))
+        return { ok: false, reason: 'file_not_found' };
+    try {
+        return { ok: true, json: JSON.parse(readFileSync(configFilePath, 'utf8')) };
+    }
+    catch {
+        return { ok: false, reason: 'parse_error' };
+    }
+}
 // ---------------------------------------------------------------------------
 // Check runner — Section 6: real per-check evaluation
 // ---------------------------------------------------------------------------
@@ -104,18 +137,21 @@ export function runLocalRemediationComplianceCheck() {
             const checks = compliance.checks ?? [];
             if (checks.length === 0)
                 continue;
-            if (!existsSync(entry.config_file_path)) {
-                hookRunLog(`compliance_check: config file not found, skipping uuid=${entry.uuid}`);
-                continue;
-            }
-            let configJson;
-            try {
-                configJson = JSON.parse(readFileSync(entry.config_file_path, 'utf8'));
-            }
-            catch {
-                hookRunLog(`compliance_check: could not parse config file, skipping uuid=${entry.uuid}`);
+            const loaded = loadRemediationConfigJson(entry.config_file_path);
+            if (!loaded.ok) {
+                const msg = loaded.reason === 'file_not_found'
+                    ? `compliance_check: config file not found, skipping uuid=${entry.uuid}`
+                    : loaded.reason === 'db_not_found'
+                        ? `compliance_check: vscdb file not found, skipping uuid=${entry.uuid}`
+                        : loaded.reason === 'vscdb_read_failed'
+                            ? `compliance_check: could not read vscdb (sqlite3 missing or invalid JSON?), skipping uuid=${entry.uuid}`
+                            : loaded.reason === 'empty_vscdb_key'
+                                ? `compliance_check: invalid vscdb path (empty # key), skipping uuid=${entry.uuid}`
+                                : `compliance_check: could not parse config file, skipping uuid=${entry.uuid}`;
+                hookRunLog(msg);
                 continue;
             }
+            const configJson = loaded.json;
             for (const check of checks) {
                 // Prefer ops-based verification (matches delta apply semantics; doesn't require full after snapshot).
                 if (check.ops) {
@@ -127,6 +163,8 @@ export function runLocalRemediationComplianceCheck() {
                             finding_formatted_id: compliance.finding_formatted_id,
                             setting_path: check.setting_path,
                             description: check.description,
+                            finding_title: entry.finding_title,
+                            finding_description: entry.finding_description,
                             severity: compliance.severity,
                             autofix_allowed: compliance.autofix_allowed,
                             config_file_path: entry.config_file_path,
@@ -149,6 +187,8 @@ export function runLocalRemediationComplianceCheck() {
                         finding_formatted_id: compliance.finding_formatted_id,
                         setting_path: check.setting_path,
                         description: check.description,
+                        finding_title: entry.finding_title,
+                        finding_description: entry.finding_description,
                         severity: compliance.severity,
                         autofix_allowed: compliance.autofix_allowed,
                         config_file_path: entry.config_file_path,
@@ -181,15 +221,23 @@ export function runLocalRemediationComplianceCheck() {
 export function applyAutofixViolations(violations) {
     const autofixable = violations.filter((v) => v.autofix_allowed);
     if (autofixable.length === 0)
-        return { fixed: 0, restartCommands: [], failedViolations: [], reportPromises: [] };
+        return {
+            fixed: 0,
+            appliedViolations: [],
+            restartCommands: [],
+            failedViolations: [],
+            reportPromises: [],
+        };
     const { remediations } = readRemediationInstructionsFile();
     const byUuid = new Map(remediations.map((r) => [r.uuid, r]));
     let fixed = 0;
+    const appliedViolations = [];
     const seen = new Set();
     const restartCommands = [];
     const failedViolations = [];
     const reportPromises = [];
     const oneTimeAppliedUuids = new Set();
+    let deferredSqlitePending = false;
     for (const violation of autofixable) {
         if (seen.has(violation.uuid))
             continue;
@@ -200,48 +248,83 @@ export function applyAutofixViolations(violations) {
             continue;
         }
         const inst = instruction;
-        const ok = enforceRemediation(inst);
-        if (ok) {
-            seen.add(violation.uuid);
-            fixed++;
-            hookRunLog(`autofix: applied uuid=${inst.uuid} path=${inst.config_file_path}`);
-            reportPromises.push(reportAutofixApplied(inst.uuid, 'success'));
-            const authKey = readStoredAuthKey();
-            if (authKey) {
+        complianceRunnerDiag(`autofix: calling enforceRemediation uuid=${inst.uuid} path=${inst.config_file_path}`);
+        const er = enforceRemediation(inst);
+        if (!er.ok) {
+            failedViolations.push(violation);
+            continue;
+        }
+        if (er.deferredSqlite)
+            deferredSqlitePending = true;
+        seen.add(violation.uuid);
+        fixed++;
+        appliedViolations.push(violation);
+        hookRunLog(`autofix: applied uuid=${inst.uuid} path=${inst.config_file_path}`);
+        reportPromises.push(reportAutofixApplied(inst.uuid, 'success'));
+        const authKey = readStoredAuthKey();
+        if (authKey) {
+            if (er.deferredSqlite && inst.config_file_path.includes('#')) {
+                hookRunLog(`autofix: skip immediate vscdb upload (deferred until after restart) uuid=${inst.uuid}`);
+            }
+            else {
                 let updatedContent;
-                try {
-                    updatedContent = JSON.parse(readFileSync(inst.config_file_path, 'utf8'));
+                if (inst.config_file_path.includes('#')) {
+                    const hi = inst.config_file_path.indexOf('#');
+                    const dbPath = inst.config_file_path.slice(0, hi);
+                    const itemKey = inst.config_file_path.slice(hi + 1).trim();
+                    updatedContent =
+                        itemKey ? (readVscdbItemTableJson(dbPath, itemKey) ?? undefined) : undefined;
                 }
-                catch {
-                    updatedContent = undefined;
+                else {
+                    try {
+                        updatedContent = JSON.parse(readFileSync(inst.config_file_path, 'utf8'));
+                    }
+                    catch {
+                        updatedContent = undefined;
+                    }
                 }
                 if (updatedContent !== undefined) {
                     const fileType = (inst.file_type ?? '').trim();
                     if (fileType) {
-                        reportPromises.push(sendConfigFile({ file_type: fileType, file_path: inst.config_file_path, raw_content: updatedContent }, resolveHardwareUuid(), authKey).then((sentOk) => {
-                            hookRunLog(`autofix: uploaded remediated file uuid=${inst.uuid} path=${inst.config_file_path} ok=${sentOk}`);
-                        }));
+                        const hw = tryResolveHardwareUuid();
+                        if (hw) {
+                            reportPromises.push(sendConfigFile({ file_type: fileType, file_path: inst.config_file_path, raw_content: updatedContent }, hw, authKey).then((sentOk) => {
+                                hookRunLog(`autofix: uploaded remediated file uuid=${inst.uuid} path=${inst.config_file_path} ok=${sentOk}`);
+                            }));
+                        }
+                        else {
+                            hookRunLog(`autofix: skip upload uuid=${inst.uuid} (hardware UUID unavailable)`);
+                        }
                     }
                     else {
                         hookRunLog(`autofix: skip upload uuid=${inst.uuid} — remediation_instructions.json missing file_type (re-sync manifest)`);
                     }
                 }
             }
-            else {
-                hookRunLog(`autofix: skip re-upload uuid=${inst.uuid} (no stored auth key)`);
-            }
-            const spec = remediationFixSpec(inst);
-            if (spec?.restart_required && spec.restart_command) {
-                hookRunLog(`autofix: restart required uuid=${inst.uuid} command=${spec.restart_command}`);
-                restartCommands.push(spec.restart_command);
-            }
-            if (!inst.is_enforced) {
-                oneTimeAppliedUuids.add(inst.uuid);
-            }
         }
         else {
-            failedViolations.push(violation);
+            hookRunLog(`autofix: skip re-upload uuid=${inst.uuid} (no stored auth key)`);
         }
+        const spec = remediationFixSpec(inst);
+        if (spec?.restart_required && spec.restart_command) {
+            if (!er.deferredSqlite) {
+                if (isTrustedRestartCommandForAutofix(spec.restart_command)) {
+                    hookRunLog(`autofix: restart required uuid=${inst.uuid} command=${spec.restart_command}`);
+                    restartCommands.push(spec.restart_command);
+                }
+                else {
+                    hookRunLog(`autofix: restart command rejected (not an allowlisted template) uuid=${inst.uuid}`);
+                }
+            }
+        }
+        if (!inst.is_enforced) {
+            oneTimeAppliedUuids.add(inst.uuid);
+        }
+    }
+    if (deferredSqlitePending) {
+        restartCommands.length = 0;
+        restartCommands.push(buildDeferredCursorRestartCommand());
+        hookRunLog('autofix: deferred vscdb — restart command runs apply_deferred_vscdb.js then open -a Cursor');
     }
     if (oneTimeAppliedUuids.size > 0) {
         const remaining = remediations.filter((r) => !oneTimeAppliedUuids.has(r.uuid));
@@ -250,14 +333,20 @@ export function applyAutofixViolations(violations) {
         // Send a post-autofix heartbeat so the server sees the updated (reduced) UUID set immediately,
         // without waiting for the background runner (which may be locked out).
         const remainingUuids = remaining.map((r) => r.uuid);
-        reportPromises.push(fetchSync(loadEndpointBase(), resolveHardwareUuid(), remainingUuids)
-            .then(() => hookRunLog(`autofix: post-autofix heartbeat sent uuids=${remainingUuids.length}`))
-            .catch(() => undefined));
+        const hwHeartbeat = tryResolveHardwareUuid();
+        if (hwHeartbeat) {
+            reportPromises.push(fetchSync(loadEndpointBase(), hwHeartbeat, remainingUuids)
+                .then(() => hookRunLog(`autofix: post-autofix heartbeat sent uuids=${remainingUuids.length}`))
+                .catch(() => undefined));
+        }
+        else {
+            hookRunLog('autofix: skip post-autofix heartbeat (hardware UUID unavailable)');
+        }
     }
     if (fixed > 0) {
         hookRunLog(`autofix: total_applied=${fixed}`);
     }
-    return { fixed, restartCommands, failedViolations, reportPromises };
+    return { fixed, appliedViolations, restartCommands, failedViolations, reportPromises, deferredSqlitePending };
 }
 /**
  * Remove satisfied one-time remediations from local remediation_instructions.json.
@@ -285,18 +374,12 @@ export function pruneSatisfiedOneTimeRemediations() {
             remaining.push(raw);
             continue;
         }
-        if (!existsSync(inst.config_file_path)) {
-            remaining.push(raw);
-            continue;
-        }
-        let configJson;
-        try {
-            configJson = JSON.parse(readFileSync(inst.config_file_path, 'utf8'));
-        }
-        catch {
+        const prLoaded = loadRemediationConfigJson(inst.config_file_path);
+        if (!prLoaded.ok) {
             remaining.push(raw);
             continue;
         }
+        const configJson = prLoaded.json;
         // Only prune when every check is ops-based and currently satisfied.
         let okAll = true;
         for (const check of checks) {
@@ -323,11 +406,16 @@ export function pruneSatisfiedOneTimeRemediations() {
     writeRemediationInstructionsFile({ remediations: remaining });
     hookRunLog(`remediation_prune: removed=${removed} remaining=${remaining.length}`);
     const remainingUuids = remaining.map((r) => r.uuid);
-    const reportPromises = [
-        fetchSync(loadEndpointBase(), resolveHardwareUuid(), remainingUuids)
+    const hw = tryResolveHardwareUuid();
+    const reportPromises = [];
+    if (hw) {
+        reportPromises.push(fetchSync(loadEndpointBase(), hw, remainingUuids)
             .then(() => hookRunLog(`remediation_prune: post-prune heartbeat sent uuids=${remainingUuids.length}`))
-            .catch(() => undefined),
-    ];
+            .catch(() => undefined));
+    }
+    else {
+        hookRunLog('remediation_prune: skip post-prune heartbeat (hardware UUID unavailable)');
+    }
     return { removed, reportPromises };
 }
 /**

package/dist/log_config_files/runtime/hardware_uuid.js

@@ -24,4 +24,13 @@ function resolveHardwareUuid() {
     }
     throw new Error('Unable to determine hardware UUID via ioreg or system_profiler.');
 }
+/** Same as {@link resolveHardwareUuid} but returns null when the host exposes no stable ID (e.g. Linux CI). */
+export function tryResolveHardwareUuid() {
+    try {
+        return resolveHardwareUuid();
+    }
+    catch {
+        return null;
+    }
+}
 export { resolveHardwareUuid };

package/dist/log_config_files/runtime/hook_logger.js

@@ -1,15 +1,40 @@
-import { existsSync, mkdirSync, writeFileSync, appendFileSync } from 'node:fs';
+import { existsSync, mkdirSync, appendFileSync } from 'node:fs';
 import path from 'node:path';
 import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
 const HOOK_LOG_FILENAME = 'hook_log.txt';
+const COMPLIANCE_RUNNER_LOG_FILENAME = 'compliance_runner.log';
 function getHookLogPath() {
     const homeDir = process.env.HOME || process.env.USERPROFILE;
     if (!homeDir)
         return null;
     return path.join(homeDir, OPT_AI_SEC_MANAGEMENT_REL, HOOK_LOG_FILENAME);
 }
-/** Replace hook log file at the start of a run so it doesn't grow unboundedly. */
-function hookLogReplace() {
+function getComplianceRunnerLogPath() {
+    const homeDir = process.env.HOME || process.env.USERPROFILE;
+    if (!homeDir)
+        return null;
+    return path.join(homeDir, OPT_AI_SEC_MANAGEMENT_REL, COMPLIANCE_RUNNER_LOG_FILENAME);
+}
+/**
+ * Append-only diagnostics (not truncated by main_runner). Use for remediation sync / compliance.
+ */
+function complianceRunnerDiag(message) {
+    const logPath = getComplianceRunnerLogPath();
+    if (!logPath)
+        return;
+    try {
+        const dir = path.dirname(logPath);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const ts = new Date().toISOString();
+        appendFileSync(logPath, `${ts} ${message}\n`, 'utf8');
+    }
+    catch {
+        // best-effort
+    }
+}
+/** Visible delimiter between hook_log.txt sessions (compliance gate, upload, etc.). */
+function hookLogSessionBanner(label) {
     const logPath = getHookLogPath();
     if (!logPath)
         return;
@@ -17,12 +42,20 @@ function hookLogReplace() {
         const dir = path.dirname(logPath);
         if (!existsSync(dir))
             mkdirSync(dir, { recursive: true, mode: 0o700 });
-        writeFileSync(logPath, '', 'utf8');
+        const ts = new Date().toISOString();
+        const banner = `\n${'='.repeat(72)}\n${ts} session: ${label}\n${'='.repeat(72)}\n`;
+        appendFileSync(logPath, banner, 'utf8');
     }
     catch {
         // best-effort
     }
 }
+/**
+ * @deprecated Name kept for callers: begins a log_config_files upload section (append-only, does not truncate).
+ */
+function hookLogReplace() {
+    hookLogSessionBanner('log_config_files (config upload)');
+}
 /** Append a timestamped line to hook_log.txt. */
 function hookRunLog(message) {
     const logPath = getHookLogPath();
@@ -48,4 +81,4 @@ function hookLogLine(message) {
         // best-effort
     }
 }
-export { getHookLogPath, hookLogReplace, hookRunLog, hookLogLine };
+export { getHookLogPath, getComplianceRunnerLogPath, hookLogReplace, hookLogSessionBanner, hookRunLog, hookLogLine, complianceRunnerDiag, };

package/dist/log_config_files/runtime/main_runner.js

@@ -10,6 +10,7 @@ import { resolveHardwareUuid } from './hardware_uuid.js';
 import { ensureAuthentication } from '../auth/auth_flow.js';
 import { readJSONFile, readMarkdownFile } from '../readers/file_readers.js';
 import { isVscdbVirtualPath, tryReadVscdbVirtualFile } from '../readers/vscdb_config_builder.js';
+import { persistVscdbComposerContractFromPatternsResponse } from '../readers/vscdb_reader.js';
 import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, determineFileTypeFromPath } from '../collection/config_collector.js';
 import { normalizePathSkipPrefixes } from '../paths/pattern_resolver.js';
 import { sendConfigFile, sendConfigFilesBatch, sendHookRequestCreate, sendHookRequestUpdateManifest, sendIngestSessionStart, sendIngestSessionFinish, BATCH_CHUNK_SIZE } from '../sender/batch_sender.js';
@@ -26,6 +27,7 @@ async function collectAllConfigFiles(endpointBase) {
         hookRunLog(msg);
         throw new Error(msg);
     }
+    persistVscdbComposerContractFromPatternsResponse(patternsResponse);
     hookRunLog(`scanning config files`);
     const configFiles = collectConfigFilesFromPatterns(patternsResponse.patterns, PROJECT_ROOT, hookRunLog, {
         vscdbEntrySpecs: patternsResponse.vscdb_entry_specs,

package/dist/log_config_files/runtime/management_storage.js

@@ -7,12 +7,43 @@ import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
 export const REMEDIATION_INSTRUCTIONS_BASENAME = 'remediation_instructions.json';
+/** Pending state.vscdb writes applied after Cursor exits (IDE holds the DB locked). */
+export const DEFERRED_VSCDB_APPLY_BASENAME = 'optimus_deferred_vscdb_apply.json';
+/**
+ * Cached subset of GET file-patterns: reactive ItemTable key + composer shadow keys from the backend.
+ * Written when patterns are fetched; remediations and vscdb reads use this so the npm package stays free
+ * of hardcoded Cursor paths.
+ */
+export const FILE_COLLECTION_VSCDB_CONTRACT_BASENAME = 'file_collection_vscdb_contract.json';
 export function getManagementDir() {
     return join(homedir(), OPT_AI_SEC_MANAGEMENT_REL);
 }
 export function getRemediationInstructionsPath() {
     return join(getManagementDir(), REMEDIATION_INSTRUCTIONS_BASENAME);
 }
+export function getDeferredVscdbApplyPath() {
+    return join(getManagementDir(), DEFERRED_VSCDB_APPLY_BASENAME);
+}
+export function getFileCollectionVscdbContractPath() {
+    return join(getManagementDir(), FILE_COLLECTION_VSCDB_CONTRACT_BASENAME);
+}
+export function readFileCollectionVscdbContract() {
+    const path = getFileCollectionVscdbContractPath();
+    if (!existsSync(path))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        if (parsed?.version !== 1 || !Array.isArray(parsed.composer_shadow_keys))
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+export function writeFileCollectionVscdbContract(contract) {
+    atomicWriteJson(getFileCollectionVscdbContractPath(), contract);
+}
 export function atomicWriteJson(filePath, data) {
     const dir = dirname(filePath);
     if (!existsSync(dir))