log-llm-config 1.3.2 → 1.3.5

package/dist/compliance_prompt_gate.js

@@ -1,20 +1,17 @@
 /**
  * Synchronous pre-prompt gate: local compliance only (stdout = single JSON line for IDE hooks).
  * stderr must stay clean; logs go via hookRunLog (file).
+ *
+ * When autofix returns restart_commands, this process does not spawn them — the shell hook pipes
+ * the same JSON line to execute_trusted_restarts (TS allowlist + spawn).
  */
 import { applyAutofixViolations, pruneSatisfiedOneTimeRemediations, runLocalRemediationComplianceCheck, } from './log_config_files/runtime/compliance_check.js';
 import { existsSync, statSync } from 'node:fs';
-import { spawn } from 'node:child_process';
 import { pathToFileURL } from 'node:url';
 import { resolve } from 'node:path';
 import { getRemediationInstructionsPath } from './log_config_files/runtime/management_storage.js';
-import { hookLogSessionBanner, hookRunLog } from './log_config_files/runtime/hook_logger.js';
+import { hookLogSessionBanner } from './log_config_files/runtime/hook_logger.js';
 const MANIFEST_STALE_MS = 7 * 24 * 60 * 60 * 1000;
-/** Set by optimus-compliance-check.sh only for Claude Desktop (dumb TERM). Hook runs allowlisted restart after osascript. */
-function claudeDesktopHookRunsRestart() {
-    const v = process.env.OPTIMUS_CLAUDE_DESKTOP_DEFER_GATE_RESTART?.trim().toLowerCase();
-    return v === '1' || v === 'true' || v === 'yes';
-}
 function parseIde() {
     const eq = process.argv.find((a) => a.startsWith('--ide='));
     if (eq) {
@@ -51,13 +48,6 @@ function blockPayload(ide, violationMessage) {
     }
     return JSON.stringify({ continue: false, user_message: text });
 }
-function fireRestartCommands(commands) {
-    for (const cmd of commands) {
-        hookRunLog(`restart: firing command="${cmd}"`);
-        const child = spawn('sh', ['-c', cmd], { detached: true, stdio: 'ignore' });
-        child.unref();
-    }
-}
 function getManifestStalenessMs() {
     try {
         const path = getRemediationInstructionsPath();
@@ -127,12 +117,7 @@ export async function runCompliancePromptGate() {
                 if (restartCommands.length > 0)
                     payload.restart_commands = restartCommands;
                 console.log(JSON.stringify(payload));
-                // Cursor: .cursor/hooks runs restart after the osascript dialog — avoid double SIGKILL here.
-                // Claude Desktop: same — optimus-compliance-check.sh shows the dialog then evals allowlisted restarts.
-                // Claude Code (CLI): no shell restart path; gate must spawn here.
-                const fireInGate = ide !== 'cursor' && !(ide === 'claude' && claudeDesktopHookRunsRestart());
-                if (fireInGate)
-                    fireRestartCommands(restartCommands);
+                // Restarts: always executed by optimus-compliance-check.sh via execute_trusted_restarts (TS allowlist + spawn).
                 return;
             }
             const msg = recheck.violations[0]?.message ?? 'A security policy violation has been detected.';

package/dist/execute_trusted_restarts.js

@@ -0,0 +1,56 @@
+/**
+ * CLI: read one JSON line from stdin (same shape as compliance_prompt_gate stdout for __optimus_autofix),
+ * parse restart_commands[], allowlist each in TS, spawn detached. Invoked by optimus-compliance-check.sh only.
+ * stderr stays quiet; failures logged via hookRunLog.
+ */
+import { readFileSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+import { resolve } from 'node:path';
+import { hookRunLog } from './log_config_files/runtime/hook_logger.js';
+import { executeTrustedRestartCommands } from './log_config_files/runtime/trusted_restarts.js';
+function isRunAsCliModule() {
+    const entry = process.argv[1];
+    if (!entry)
+        return false;
+    try {
+        return import.meta.url === pathToFileURL(resolve(entry)).href;
+    }
+    catch {
+        return false;
+    }
+}
+function main() {
+    let raw;
+    try {
+        raw = readFileSync(0, 'utf8');
+    }
+    catch {
+        hookRunLog('execute_trusted_restarts: could not read stdin');
+        return;
+    }
+    const first = raw.trim().split(/\r?\n/)[0]?.trim() ?? '';
+    if (!first)
+        return;
+    let j;
+    try {
+        j = JSON.parse(first);
+    }
+    catch {
+        hookRunLog('execute_trusted_restarts: stdin is not valid JSON');
+        return;
+    }
+    const cmds = j.restart_commands;
+    if (!Array.isArray(cmds))
+        return;
+    const strings = cmds.filter((c) => typeof c === 'string');
+    executeTrustedRestartCommands(strings);
+}
+if (isRunAsCliModule()) {
+    try {
+        main();
+    }
+    catch (e) {
+        hookRunLog(`execute_trusted_restarts: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    process.exit(0);
+}

package/dist/log_config_files/runtime/trusted_restarts.js

@@ -0,0 +1,22 @@
+/**
+ * Execute autofix restart_command strings only if allowlisted (same rules as gate enqueue).
+ * Used by the compliance shell hook via execute_trusted_restarts CLI — single place for allowlist + spawn.
+ */
+import { spawn } from 'node:child_process';
+import { hookRunLog } from './hook_logger.js';
+import { isTrustedRestartCommandForAutofix } from './remediation_sync.js';
+/** Spawn each trusted command detached (same pattern as former compliance_prompt_gate fireRestartCommands). */
+export function executeTrustedRestartCommands(commands) {
+    for (const cmd of commands) {
+        const t = cmd.trim();
+        if (!t)
+            continue;
+        if (!isTrustedRestartCommandForAutofix(cmd)) {
+            hookRunLog(`execute_trusted_restarts: rejected (not allowlisted) prefix=${t.slice(0, 120)}`);
+            continue;
+        }
+        hookRunLog(`execute_trusted_restarts: firing command="${t}"`);
+        const child = spawn('sh', ['-c', t], { detached: true, stdio: 'ignore' });
+        child.unref();
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config",
-  "version": "1.3.2",
+  "version": "1.3.5",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {
@@ -8,7 +8,8 @@
     "log_uuid": "dist/log_uuid/index.js",
     "log_config_files": "dist/log_config_files/index.js",
     "log_sensitive_paths_audit": "dist/log_sensitive_paths_audit.js",
-    "apply-deferred-vscdb": "dist/apply_deferred_vscdb.js"
+    "apply-deferred-vscdb": "dist/apply_deferred_vscdb.js",
+    "execute-trusted-restarts": "dist/execute_trusted_restarts.js"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",