log-llm-config 1.3.17 → 1.3.18

package/dist/compliance_prompt_gate.js

@@ -10,7 +10,7 @@ import { existsSync, statSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { basename } from 'node:path';
 import { getRemediationInstructionsPath } from './log_config_files/runtime/management_storage.js';
-import { hookLogSessionBanner, hookRunLog } from './log_config_files/runtime/hook_logger.js';
+import { hookLogSessionBanner, hookRunLog, logRemediationApplyFailure } from './log_config_files/runtime/hook_logger.js';
 const MANIFEST_STALE_MS = 7 * 24 * 60 * 60 * 1000;
 function parseIde() {
     const eq = process.argv.find((a) => a.startsWith('--ide='));
@@ -101,6 +101,11 @@ export async function runCompliancePromptGate() {
             const staleDays = Math.floor(staleMs / (24 * 60 * 60 * 1000));
             const advisory = `Remediation enforcement suspended: local remediation manifest is stale (${staleDays} days old). ` +
                 'Please reconnect to sync latest policy state.';
+            logRemediationApplyFailure('prompt_gate_stale_manifest_advisory', {
+                reason: advisory,
+                stale_days: staleDays,
+                violation_count: status.violations.length,
+            });
             printAllowWithAdvisory(ide, advisory);
             return;
         }
@@ -113,6 +118,12 @@ export async function runCompliancePromptGate() {
             if (failedViolations.length > 0) {
                 const ids = failedViolations.map((v) => `[${v.finding_formatted_id}]`).join(', ');
                 const msg = `Auto-fix failed for ${ids} — please fix manually or contact your security team.\n\n${failedViolations[0]?.message ?? ''}`;
+                logRemediationApplyFailure('prompt_gate_block_autofix_failed', {
+                    reason: 'autofix had fixed>0 path but failedViolations non-empty after apply',
+                    ide,
+                    failed_formatted_ids: failedViolations.map((v) => v.finding_formatted_id).join(', '),
+                    detail: failedViolations[0]?.message ?? '',
+                });
                 console.log(blockPayload(ide, msg));
                 return;
             }
@@ -139,16 +150,35 @@ export async function runCompliancePromptGate() {
                 return;
             }
             const msg = recheck.violations[0]?.message ?? 'A security policy violation has been detected.';
+            logRemediationApplyFailure('prompt_gate_block_recheck_failed', {
+                reason: 'after autofix, local compliance recheck still reports violations',
+                ide,
+                deferred_sqlite_pending: deferredSqlitePending,
+                first_uuid: recheck.violations[0]?.uuid ?? '',
+                message: msg,
+            });
             console.log(blockPayload(ide, msg));
             return;
         }
         if (failedViolations.length > 0) {
             const ids = failedViolations.map((v) => `[${v.finding_formatted_id}]`).join(', ');
             const msg = `Auto-fix failed for ${ids} — please fix manually or contact your security team.\n\n${failedViolations[0]?.message ?? ''}`;
+            logRemediationApplyFailure('prompt_gate_block_autofix_failed', {
+                reason: 'autofix failed (fixed=0 branch or partial failure)',
+                ide,
+                failed_formatted_ids: failedViolations.map((v) => v.finding_formatted_id).join(', '),
+                detail: failedViolations[0]?.message ?? '',
+            });
             console.log(blockPayload(ide, msg));
             return;
         }
         const msg = status.violations[0]?.message ?? 'A security policy violation has been detected.';
+        logRemediationApplyFailure('prompt_gate_block_violations_no_autofix_applied', {
+            reason: 'violations on submit but autofix did not succeed — see autofix_skipped_not_allowed, enforceRemediation, or compliance_check entries',
+            ide,
+            first_uuid: status.violations[0]?.uuid ?? '',
+            finding_formatted_id: status.violations[0]?.finding_formatted_id ?? '',
+        });
         console.log(blockPayload(ide, msg));
         return;
     }

package/dist/log_config_files/readers/vscdb_config_builder.js

@@ -2,6 +2,7 @@ import { homedir } from 'node:os';
 import { readVSCDBState } from './vscdb_reader.js';
 import { getVscdbPath } from '../paths/path_constants_helpers.js';
 import { getByPath } from '../collection/enrichment_helpers.js';
+import { hookRunLog } from '../runtime/hook_logger.js';
 /** True if path is a vscdb virtual path (db file or db#fragment). Uses backend vscdb_basename and vscdb_entry_specs only. */
 export function isVscdbVirtualPath(filePath, response) {
     if (!response?.vscdb_entry_specs?.length)
@@ -93,17 +94,47 @@ function buildVscdbRawContentFromSpec(state, spec) {
  * Build config file entries from state.vscdb using backend-driven specs and read queries.
  * No hardcoded file_type, path fragments, or ItemTable keys; all from API.
  */
+function summarizeComposerStateValue(composerState) {
+    if (composerState === null || composerState === undefined || typeof composerState !== 'object' || Array.isArray(composerState)) {
+        return `composerState_type=${composerState === null ? 'null' : typeof composerState}`;
+    }
+    const o = composerState;
+    const m4 = o.modes4;
+    if (!Array.isArray(m4))
+        return `modes4=${m4 === undefined ? 'absent' : typeof m4}`;
+    const agent = m4.find((x) => x !== null && typeof x === 'object' && !Array.isArray(x) && x.id === 'agent');
+    if (!agent)
+        return `modes4_len=${m4.length} agent_row=missing`;
+    return `modes4_len=${m4.length} agent_autoRun=${JSON.stringify(agent.autoRun)} agent_fullAutoRun=${JSON.stringify(agent.fullAutoRun)}`;
+}
+/** Exported for main_runner: one-line summary of uploaded #composerState payload (policy full-auto-run input). */
+export function summarizeComposerPayloadForDiagnostics(raw) {
+    const inner = summarizeComposerStateValue(raw.composerState);
+    const rawKeys = Object.keys(raw)
+        .filter((k) => k !== 'source' && k !== 'extracted_at')
+        .slice(0, 16);
+    return `${inner} payload_keys=[${rawKeys.join(',')}]`;
+}
 function collectVscdbEntries(vscdbPath, specs, readQueries, mergeFromComposerState) {
     if (!specs?.length)
         return [];
     const state = readVSCDBState(vscdbPath, readQueries, mergeFromComposerState);
-    if (!state || typeof state !== 'object')
+    if (!state || typeof state !== 'object') {
+        hookRunLog(`diag vscdb collect: readVSCDBState returned null/invalid vscdb=${vscdbPath}`);
         return [];
+    }
+    const sk = Object.keys(state);
+    hookRunLog(`diag vscdb collect: readVSCDBState ok vscdb=${vscdbPath} top_keys=[${sk.slice(0, 24).join(',')}] ${summarizeComposerStateValue(state.composerState)}`);
     const entries = [];
     for (const spec of specs) {
+        const atPath = getByPath(state, spec.state_key);
         const rawContent = buildVscdbRawContentFromSpec(state, spec);
-        if (!rawContent)
+        if (!rawContent) {
+            if (spec.state_key === 'composerState' || spec.path_suffix === '#composerState') {
+                hookRunLog(`diag vscdb collect: skipped composer emit value_constraint=${spec.value_constraint ?? 'none'} at_path=${atPath === undefined ? 'undefined' : atPath === null ? 'null' : typeof atPath} path_suffix=${spec.path_suffix}`);
+            }
             continue;
+        }
         entries.push({
             file_type: spec.file_type,
             file_path: `${vscdbPath}${spec.path_suffix}`,

package/dist/log_config_files/runtime/compliance_check.js

@@ -13,7 +13,8 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { readVscdbItemTableJson } from '../readers/vscdb_reader.js';
 import { readRemediationInstructionsFile, writeRemediationInstructionsFile } from './management_storage.js';
-import { complianceRunnerDiag, hookRunLog } from './hook_logger.js';
+import { resolveRemediationConfigPath } from './remediation_config_path.js';
+import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
 import { loadEndpointBase } from '../sender/endpoint_config.js';
 import { resolveHardwareUuid, tryResolveHardwareUuid } from './hardware_uuid.js';
 import { buildDeferredCursorRestartCommand, enforceRemediation, fetchSync, isTrustedRestartCommandForAutofix, remediationFixSpec, reportAutofixApplied, syncRemediations, } from './remediation_sync.js';
@@ -97,10 +98,11 @@ function verifyOpsApplied(configJson, settingPath, ops) {
 }
 /** Plain JSON file or virtual `…/state.vscdb#itemKey` path for ItemTable-backed settings. */
 function loadRemediationConfigJson(configFilePath, checkSettingPaths = []) {
-    const hashIdx = configFilePath.indexOf('#');
+    const resolvedPath = resolveRemediationConfigPath(configFilePath);
+    const hashIdx = resolvedPath.indexOf('#');
     if (hashIdx >= 0) {
-        const dbPath = configFilePath.slice(0, hashIdx);
-        const itemKeyFromPath = configFilePath.slice(hashIdx + 1).trim();
+        const dbPath = resolvedPath.slice(0, hashIdx);
+        const itemKeyFromPath = resolvedPath.slice(hashIdx + 1).trim();
         if (!itemKeyFromPath)
             return { ok: false, reason: 'empty_vscdb_key' };
         if (!existsSync(dbPath))
@@ -115,10 +117,10 @@ function loadRemediationConfigJson(configFilePath, checkSettingPaths = []) {
         }
         return { ok: true, json: merged };
     }
-    if (!existsSync(configFilePath))
+    if (!existsSync(resolvedPath))
         return { ok: false, reason: 'file_not_found' };
     try {
-        return { ok: true, json: JSON.parse(readFileSync(configFilePath, 'utf8')) };
+        return { ok: true, json: JSON.parse(readFileSync(resolvedPath, 'utf8')) };
     }
     catch {
         return { ok: false, reason: 'parse_error' };
@@ -164,6 +166,13 @@ export function runLocalRemediationComplianceCheck() {
                                 ? `compliance_check: invalid vscdb path (empty # key), skipping uuid=${entry.uuid}`
                                 : `compliance_check: could not parse config file, skipping uuid=${entry.uuid}`;
                 hookRunLog(msg);
+                logRemediationApplyFailure('compliance_check_config_unreadable', {
+                    uuid: entry.uuid,
+                    config_file_path: entry.config_file_path,
+                    finding_formatted_id: compliance.finding_formatted_id,
+                    load_reason: loaded.reason,
+                    reason: 'cannot read config for compliance verify — remediation may not run until path/db is valid',
+                });
                 continue;
             }
             const configJson = loaded.json;
@@ -223,7 +232,14 @@ export function runLocalRemediationComplianceCheck() {
         return status;
     }
     catch (err) {
-        hookRunLog(`compliance_check: unexpected error: ${err instanceof Error ? err.message : String(err)}`);
+        const emsg = err instanceof Error ? err.message : String(err);
+        const stack = err instanceof Error ? err.stack : undefined;
+        hookRunLog(`compliance_check: unexpected error: ${emsg}`);
+        logRemediationApplyFailure('compliance_check_exception', {
+            reason: 'runLocalRemediationComplianceCheck threw',
+            error: emsg,
+            stack: stack ?? '',
+        });
         const fallback = {
             status: 'ok',
             checked_at: new Date().toISOString(),
@@ -234,6 +250,17 @@ export function runLocalRemediationComplianceCheck() {
     }
 }
 export function applyAutofixViolations(violations) {
+    for (const v of violations) {
+        if (!v.autofix_allowed) {
+            logRemediationApplyFailure('autofix_skipped_not_allowed', {
+                uuid: v.uuid,
+                finding_formatted_id: v.finding_formatted_id,
+                config_file_path: v.config_file_path,
+                setting_path: v.setting_path,
+                reason: 'autofix_allowed is false — policy/manual fix required',
+            });
+        }
+    }
     const autofixable = violations.filter((v) => v.autofix_allowed);
     if (autofixable.length === 0)
         return {
@@ -259,11 +286,19 @@ export function applyAutofixViolations(violations) {
         const instruction = byUuid.get(violation.uuid);
         if (!instruction) {
             hookRunLog(`autofix: no instruction found for uuid=${violation.uuid}, skipping`);
+            logRemediationApplyFailure('autofix_no_local_instruction', {
+                uuid: violation.uuid,
+                finding_formatted_id: violation.finding_formatted_id,
+                config_file_path: violation.config_file_path,
+                setting_path: violation.setting_path,
+                reason: 'violation UUID not present in remediation_instructions.json remediations[]',
+            });
             failedViolations.push(violation);
             continue;
         }
         const inst = instruction;
-        complianceRunnerDiag(`autofix: calling enforceRemediation uuid=${inst.uuid} path=${inst.config_file_path}`);
+        const configPathForDisk = resolveRemediationConfigPath(inst.config_file_path);
+        complianceRunnerDiag(`autofix: calling enforceRemediation uuid=${inst.uuid} path=${configPathForDisk}`);
         const er = enforceRemediation(inst);
         if (!er.ok) {
             failedViolations.push(violation);
@@ -274,25 +309,25 @@ export function applyAutofixViolations(violations) {
         seen.add(violation.uuid);
         fixed++;
         appliedViolations.push(violation);
-        hookRunLog(`autofix: applied uuid=${inst.uuid} path=${inst.config_file_path}`);
+        hookRunLog(`autofix: applied uuid=${inst.uuid} path=${configPathForDisk}`);
         reportPromises.push(reportAutofixApplied(inst.uuid, 'success'));
         const authKey = readStoredAuthKey();
         if (authKey) {
-            if (er.deferredSqlite && inst.config_file_path.includes('#')) {
+            if (er.deferredSqlite && configPathForDisk.includes('#')) {
                 hookRunLog(`autofix: skip immediate vscdb upload (deferred until after restart) uuid=${inst.uuid}`);
             }
             else {
                 let updatedContent;
-                if (inst.config_file_path.includes('#')) {
-                    const hi = inst.config_file_path.indexOf('#');
-                    const dbPath = inst.config_file_path.slice(0, hi);
-                    const itemKey = inst.config_file_path.slice(hi + 1).trim();
+                if (configPathForDisk.includes('#')) {
+                    const hi = configPathForDisk.indexOf('#');
+                    const dbPath = configPathForDisk.slice(0, hi);
+                    const itemKey = configPathForDisk.slice(hi + 1).trim();
                     updatedContent =
                         itemKey ? (readVscdbItemTableJson(dbPath, itemKey) ?? undefined) : undefined;
                 }
                 else {
                     try {
-                        updatedContent = JSON.parse(readFileSync(inst.config_file_path, 'utf8'));
+                        updatedContent = JSON.parse(readFileSync(configPathForDisk, 'utf8'));
                     }
                     catch {
                         updatedContent = undefined;
@@ -303,8 +338,8 @@ export function applyAutofixViolations(violations) {
                     if (fileType) {
                         const hw = tryResolveHardwareUuid();
                         if (hw) {
-                            reportPromises.push(sendConfigFile({ file_type: fileType, file_path: inst.config_file_path, raw_content: updatedContent }, hw, authKey).then((sentOk) => {
-                                hookRunLog(`autofix: uploaded remediated file uuid=${inst.uuid} path=${inst.config_file_path} ok=${sentOk}`);
+                            reportPromises.push(sendConfigFile({ file_type: fileType, file_path: configPathForDisk, raw_content: updatedContent }, hw, authKey).then((sentOk) => {
+                                hookRunLog(`autofix: uploaded remediated file uuid=${inst.uuid} path=${configPathForDisk} ok=${sentOk}`);
                             }));
                         }
                         else {
@@ -313,6 +348,11 @@ export function applyAutofixViolations(violations) {
                     }
                     else {
                         hookRunLog(`autofix: skip upload uuid=${inst.uuid} — remediation_instructions.json missing file_type (re-sync manifest)`);
+                        logRemediationApplyFailure('autofix_post_apply_upload_skipped', {
+                            uuid: inst.uuid,
+                            config_file_path: inst.config_file_path,
+                            reason: 'file_type missing on instruction — server sync/manifest will not see applied file',
+                        });
                     }
                 }
             }

package/dist/log_config_files/runtime/hook_logger.js

@@ -3,6 +3,8 @@ import path from 'node:path';
 import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
 const HOOK_LOG_FILENAME = 'hook_log.txt';
 const COMPLIANCE_RUNNER_LOG_FILENAME = 'compliance_runner.log';
+/** Append-only: remediation verify/apply failures (not cleared per hook session). */
+const REMEDIATION_APPLY_FAILURES_FILENAME = 'remediation_apply_failures.log';
 /** Hard cap so a single upload/sync session cannot grow hook_log.txt without bound. */
 const MAX_HOOK_LOG_BYTES = 2 * 1024 * 1024;
 function getHookLogPath() {
@@ -17,6 +19,12 @@ function getComplianceRunnerLogPath() {
         return null;
     return path.join(homeDir, OPT_AI_SEC_MANAGEMENT_REL, COMPLIANCE_RUNNER_LOG_FILENAME);
 }
+function getRemediationApplyFailuresLogPath() {
+    const homeDir = process.env.HOME || process.env.USERPROFILE;
+    if (!homeDir)
+        return null;
+    return path.join(homeDir, OPT_AI_SEC_MANAGEMENT_REL, REMEDIATION_APPLY_FAILURES_FILENAME);
+}
 /**
  * Append-only diagnostics (not truncated by main_runner). Use for remediation sync / compliance.
  */
@@ -35,6 +43,53 @@ function complianceRunnerDiag(message) {
         // best-effort
     }
 }
+/**
+ * Loud, append-only record when a remediation cannot be verified or applied. Writes
+ * {@link REMEDIATION_APPLY_FAILURES_FILENAME} and mirrors the same block to compliance_runner.log;
+ * also appends a single summary line to hook_log.txt for the current session.
+ */
+function logRemediationApplyFailure(context, fields) {
+    const ts = new Date().toISOString();
+    const bodyLines = Object.entries(fields)
+        .filter(([, v]) => v !== undefined && v !== null && String(v) !== '')
+        .map(([k, v]) => `  ${k}: ${typeof v === 'string' ? v : JSON.stringify(v)}`);
+    const block = [
+        '',
+        '='.repeat(72),
+        `${ts} REMEDIATION APPLY FAILURE — ${context}`,
+        ...bodyLines,
+        '='.repeat(72),
+        '',
+    ].join('\n');
+    const summary = fields.reason != null
+        ? String(fields.reason)
+        : fields.message != null
+            ? String(fields.message)
+            : 'see fields above';
+    const writeAppend = (filePath) => {
+        const dir = path.dirname(filePath);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        appendFileSync(filePath, block, 'utf8');
+    };
+    try {
+        const failPath = getRemediationApplyFailuresLogPath();
+        if (failPath)
+            writeAppend(failPath);
+        const crPath = getComplianceRunnerLogPath();
+        if (crPath)
+            writeAppend(crPath);
+    }
+    catch {
+        /* best-effort */
+    }
+    try {
+        hookRunLog(`REMEDIATION_APPLY_FAILURE [${context}] ${fields.uuid != null ? `uuid=${fields.uuid} ` : ''}${summary}`);
+    }
+    catch {
+        /* best-effort */
+    }
+}
 function ensureHookLogUnderCap() {
     const logPath = getHookLogPath();
     if (!logPath || !existsSync(logPath))
@@ -121,4 +176,4 @@ function hookLogLine(message) {
         // best-effort
     }
 }
-export { getHookLogPath, getComplianceRunnerLogPath, hookLogReplace, hookLogSessionBanner, hookLogAppendSection, hookRunLog, hookLogLine, complianceRunnerDiag, };
+export { getHookLogPath, getComplianceRunnerLogPath, hookLogReplace, hookLogSessionBanner, hookLogAppendSection, hookRunLog, hookLogLine, complianceRunnerDiag, logRemediationApplyFailure, };

package/dist/log_config_files/runtime/main_runner.js

@@ -9,7 +9,7 @@ import { hookLogReplace, hookRunLog } from './hook_logger.js';
 import { resolveHardwareUuid } from './hardware_uuid.js';
 import { ensureAuthentication } from '../auth/auth_flow.js';
 import { readJSONFile, readMarkdownFile } from '../readers/file_readers.js';
-import { isVscdbVirtualPath, tryReadVscdbVirtualFile } from '../readers/vscdb_config_builder.js';
+import { isVscdbVirtualPath, tryReadVscdbVirtualFile, summarizeComposerPayloadForDiagnostics, } from '../readers/vscdb_config_builder.js';
 import { persistVscdbComposerContractFromPatternsResponse } from '../readers/vscdb_reader.js';
 import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, determineFileTypeFromPath } from '../collection/config_collector.js';
 import { normalizePathSkipPrefixes } from '../paths/pattern_resolver.js';
@@ -126,6 +126,12 @@ async function main() {
     await addSensitivePathsAudit(endpointBase, configFiles);
     const fileTypes = [...new Set(configFiles.map((c) => c.file_type))].join(', ');
     hookRunLog(`collected ${configFiles.length} config file(s) file_types=${fileTypes}`);
+    for (const c of configFiles) {
+        if (!c.file_path.replace(/\\/g, '/').includes('#composerState'))
+            continue;
+        const tail = c.file_path.length > 120 ? `…${c.file_path.slice(-120)}` : c.file_path;
+        hookRunLog(`diag pre-upload #composerState ${summarizeComposerPayloadForDiagnostics(c.raw_content)} path=${tail}`);
+    }
     const claudeSettings = configFiles.filter((c) => c.file_type === 'claude_settings');
     if (claudeSettings.length > 0)
         hookRunLog(`claude_settings in batch: ${claudeSettings.length} path(s): ${claudeSettings.map((c) => c.file_path).join(', ')}`);

package/dist/log_config_files/runtime/remediation_config_path.js

@@ -0,0 +1,48 @@
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/**
+ * Portable key stored by the server for Cursor User globalStorage state.vscdb
+ * (see optimus_security/endpoint/log_config_file/handler._canonical_cursor_user_state_vscdb_path).
+ */
+export const PORTABLE_CURSOR_USER_STATE_VSCDB = 'Cursor/User/globalStorage/state.vscdb';
+function normalizeSlashes(p) {
+    return p.trim().replace(/\\/g, '/');
+}
+function cursorStateVscdbAbsoluteBasePaths() {
+    const h = homedir();
+    if (process.platform === 'darwin') {
+        return [join(h, 'Library', 'Application Support', 'Cursor', 'User', 'globalStorage', 'state.vscdb')];
+    }
+    if (process.platform === 'win32') {
+        const appData = process.env.APPDATA;
+        if (appData)
+            return [join(appData, 'Cursor', 'User', 'globalStorage', 'state.vscdb')];
+        return [join(h, 'AppData', 'Roaming', 'Cursor', 'User', 'globalStorage', 'state.vscdb')];
+    }
+    return [join(h, '.config', 'Cursor', 'User', 'globalStorage', 'state.vscdb')];
+}
+/**
+ * Expand server-side portable Cursor state.vscdb paths to a local absolute path.
+ * No-op for absolute paths and for relative paths that are not the portable vscdb key.
+ */
+export function resolveRemediationConfigPath(configFilePath) {
+    const t = normalizeSlashes(configFilePath);
+    const hash = t.indexOf('#');
+    const base = hash >= 0 ? t.slice(0, hash) : t;
+    const frag = hash >= 0 ? t.slice(hash) : '';
+    const baseNorm = base.replace(/\/+$/, '');
+    if (baseNorm.startsWith('/') || /^[a-zA-Z]:\//.test(baseNorm)) {
+        return configFilePath;
+    }
+    const portable = PORTABLE_CURSOR_USER_STATE_VSCDB;
+    if (baseNorm !== portable && !baseNorm.endsWith('/' + portable)) {
+        return configFilePath;
+    }
+    const candidates = cursorStateVscdbAbsoluteBasePaths();
+    for (const abs of candidates) {
+        if (existsSync(abs))
+            return `${abs}${frag}`;
+    }
+    return `${candidates[0]}${frag}`;
+}

package/dist/log_config_files/runtime/remediation_sync.js

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, unlinkS
 import { dirname } from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { executeGet, executeBody } from '../../endpoint_client/http_transport.js';
-import { complianceRunnerDiag, hookRunLog } from './hook_logger.js';
+import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
 import { atomicWriteJson, getDeferredVscdbApplyPath, getFileCollectionVscdbContractPath, getRemediationInstructionsPath, readFileCollectionVscdbContract, readRemediationInstructionsFile, writeRemediationInstructionsFile, } from './management_storage.js';
 import { readStoredAuthKey } from '../auth/auth_key_store.js';
 import { createSignature } from '../sender/signing.js';
@@ -11,6 +11,7 @@ import { tryResolveHardwareUuid } from './hardware_uuid.js';
 import { CURSOR_SCALAR_ITEMTABLE_FIELDS, persistVscdbComposerContractFromPatternsResponse, readVscdbItemTableJson, } from '../readers/vscdb_reader.js';
 import { sendConfigFile } from '../sender/batch_sender.js';
 import { getFileCollectionPatterns } from '../../endpoint_client/registry_api.js';
+import { resolveRemediationConfigPath } from './remediation_config_path.js';
 function reactiveStorageItemKeyFromContract() {
     const k = readFileCollectionVscdbContract()?.reactive_storage_item_key;
     return typeof k === 'string' && k.trim() !== '' ? k.trim() : undefined;
@@ -735,6 +736,14 @@ function sqliteRowGroupKey(dbPath, op) {
  * entry per row. Without this, two ops on the same `composerState` row each read the stale DB and queue
  * two full JSON blobs — the second UPDATE overwrites the first (e.g. only one of autoRun/fullAutoRun sticks).
  */
+/** ItemTable keys must not contain SQL-quote garbage (bad vscdb #fragment or corrupted manifest). */
+function assertSafeDeferredItemTableKey(targetKey) {
+    if (!targetKey || targetKey.length > 512)
+        return false;
+    if (/['"\\]/.test(targetKey))
+        return false;
+    return true;
+}
 function queueDeferredSqliteOpsMerged(configPath, sqliteOps, postApplyUpload) {
     const dbPath = configPath.split('#')[0];
     if (!existsSync(dbPath)) {
@@ -758,6 +767,12 @@ function queueDeferredSqliteOpsMerged(configPath, sqliteOps, postApplyUpload) {
     try {
         for (const ops of groups.values()) {
             const first = ops[0];
+            if (!assertSafeDeferredItemTableKey(first.target_key)) {
+                const line = `sqlite_update: rejected unsafe or empty target_key for deferred queue (refusing to write state.vscdb)`;
+                hookRunLog(line);
+                complianceRunnerDiag(`${line} target_key_preview=${first.target_key.slice(0, 80)}`);
+                return false;
+            }
             complianceRunnerDiag(`sqlite_update: deferred merge db=${dbPath} target_key=${first.target_key} operations=${ops.length}`);
             let currentJson = {};
             try {
@@ -778,6 +793,12 @@ function queueDeferredSqliteOpsMerged(configPath, sqliteOps, postApplyUpload) {
             }
             repairComposerStateEmptySegmentBug(currentJson);
             const updatedJson = serializeItemTableValueForWrite(first.target_key, currentJson);
+            if (updatedJson === '{}' && Object.keys(currentJson).length === 0) {
+                const line = `sqlite_update: deferred merge produced empty JSON — refusing to queue (would wipe ItemTable row)`;
+                hookRunLog(line);
+                complianceRunnerDiag(line);
+                return false;
+            }
             queueDeferredVscdbItem({
                 dbPath,
                 table: first.table,
@@ -875,67 +896,99 @@ function applyOrQueueSqliteJsonUpdate(configPath, sqliteOp, deferred) {
     }
 }
 export function enforceRemediation(instruction) {
+    const resolvedPath = resolveRemediationConfigPath(instruction.config_file_path);
+    const inst = resolvedPath === instruction.config_file_path
+        ? instruction
+        : { ...instruction, config_file_path: resolvedPath };
+    const fail = (reason, extra) => {
+        const spec = remediationFixSpec(inst);
+        logRemediationApplyFailure('enforceRemediation', {
+            uuid: inst.uuid,
+            config_file_path: inst.config_file_path,
+            file_type: inst.file_type ?? '',
+            finding_formatted_id: spec?.finding_formatted_id ?? '',
+            reason,
+            ...extra,
+        });
+        hookRunLog(`remediation_enforce: failed uuid=${inst.uuid} reason=${reason}`);
+        return { ok: false, failureReason: reason };
+    };
     try {
-        const fixSpec = remediationFixSpec(instruction);
+        const fixSpec = remediationFixSpec(inst);
         const checks = fixSpec?.checks ?? [];
         if (checks.length === 0) {
-            hookRunLog(`remediation_enforce: no checks to apply uuid=${instruction.uuid}`);
-            return { ok: false };
+            return fail('no checks in fix spec (empty or missing compliance checks)');
         }
         const sqliteOps = checks.filter((c) => {
             const raw = c;
             return raw.sqlite_op !== undefined;
         });
         if (sqliteOps.length > 0) {
-            complianceRunnerDiag(`remediation_enforce: sqlite path uuid=${instruction.uuid} checks_with_sqlite=${sqliteOps.length}`);
+            complianceRunnerDiag(`remediation_enforce: sqlite path uuid=${inst.uuid} checks_with_sqlite=${sqliteOps.length}`);
             const restartRequired = !!fixSpec?.restart_required;
             if (restartRequired) {
                 const ops = sqliteOps.map((c) => c.sqlite_op);
-                const ft = instruction.file_type?.trim();
-                const postApplyUpload = ft && instruction.config_file_path.includes('#')
-                    ? { file_path: instruction.config_file_path, file_type: ft }
+                const ft = inst.file_type?.trim();
+                const postApplyUpload = ft && inst.config_file_path.includes('#')
+                    ? { file_path: inst.config_file_path, file_type: ft }
                     : undefined;
-                const ok = queueDeferredSqliteOpsMerged(instruction.config_file_path, ops, postApplyUpload);
+                const ok = queueDeferredSqliteOpsMerged(inst.config_file_path, ops, postApplyUpload);
+                if (!ok) {
+                    return fail('deferred state.vscdb queue failed (database missing, sqlite3 unavailable, or read/merge error — see sqlite_update lines above in hook_log)', { config_file_path: inst.config_file_path });
+                }
                 return { ok, deferredSqlite: ok };
             }
             let allSuccess = true;
             for (const check of sqliteOps) {
                 const raw = check;
                 const sqliteOp = raw.sqlite_op;
-                const rowOk = applyOrQueueSqliteJsonUpdate(instruction.config_file_path, sqliteOp, false);
+                const rowOk = applyOrQueueSqliteJsonUpdate(inst.config_file_path, sqliteOp, false);
                 if (!rowOk)
                     allSuccess = false;
             }
-            return { ok: allSuccess, deferredSqlite: false };
+            if (!allSuccess) {
+                return fail('immediate sqlite apply failed for one or more checks');
+            }
+            return { ok: true, deferredSqlite: false };
         }
         if (fixSpec?.file_format !== 'json') {
-            hookRunLog(`remediation_enforce: unsupported file format ${fixSpec?.file_format} uuid=${instruction.uuid}`);
-            return { ok: false };
+            return fail(`unsupported file format: ${String(fixSpec?.file_format ?? 'undefined')}`);
         }
-        const dir = dirname(instruction.config_file_path);
+        const dir = dirname(inst.config_file_path);
         if (!existsSync(dir))
             mkdirSync(dir, { recursive: true, mode: 0o700 });
         let configJson = {};
-        if (existsSync(instruction.config_file_path)) {
+        if (existsSync(inst.config_file_path)) {
             try {
-                configJson = JSON.parse(readFileSync(instruction.config_file_path, 'utf8'));
+                configJson = JSON.parse(readFileSync(inst.config_file_path, 'utf8'));
             }
             catch {
-                hookRunLog(`remediation_enforce: could not parse existing file, starting fresh uuid=${instruction.uuid}`);
+                hookRunLog(`remediation_enforce: could not parse existing file, starting fresh uuid=${inst.uuid}`);
             }
         }
         for (const check of checks) {
             applyCheck(configJson, check);
         }
         const content = JSON.stringify(configJson, null, 2);
-        const tmp = `${instruction.config_file_path}.tmp`;
+        const tmp = `${inst.config_file_path}.tmp`;
         writeFileSync(tmp, content, 'utf8');
-        renameSync(tmp, instruction.config_file_path);
+        renameSync(tmp, inst.config_file_path);
         return { ok: true };
     }
     catch (err) {
-        hookRunLog(`remediation_enforce_error: uuid=${instruction.uuid} err=${err instanceof Error ? err.message : String(err)}`);
-        return { ok: false };
+        const msg = err instanceof Error ? err.message : String(err);
+        const stack = err instanceof Error ? err.stack : undefined;
+        logRemediationApplyFailure('enforceRemediation', {
+            uuid: inst.uuid,
+            config_file_path: inst.config_file_path,
+            file_type: inst.file_type ?? '',
+            finding_formatted_id: remediationFixSpec(inst)?.finding_formatted_id ?? '',
+            reason: 'exception during enforce',
+            error: msg,
+            stack: stack ?? '',
+        });
+        hookRunLog(`remediation_enforce_error: uuid=${inst.uuid} err=${msg}`);
+        return { ok: false, failureReason: `exception: ${msg}` };
     }
 }
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config",
-  "version": "1.3.17",
+  "version": "1.3.18",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {