log-llm-config 1.3.2 → 1.3.6

package/dist/compliance_prompt_gate.js

@@ -1,20 +1,17 @@
 /**
  * Synchronous pre-prompt gate: local compliance only (stdout = single JSON line for IDE hooks).
  * stderr must stay clean; logs go via hookRunLog (file).
+ *
+ * When autofix returns restart_commands, this process does not spawn them — the shell hook pipes
+ * the same JSON line to execute_trusted_restarts (TS allowlist + spawn).
  */
 import { applyAutofixViolations, pruneSatisfiedOneTimeRemediations, runLocalRemediationComplianceCheck, } from './log_config_files/runtime/compliance_check.js';
 import { existsSync, statSync } from 'node:fs';
-import { spawn } from 'node:child_process';
 import { pathToFileURL } from 'node:url';
 import { resolve } from 'node:path';
 import { getRemediationInstructionsPath } from './log_config_files/runtime/management_storage.js';
-import { hookLogSessionBanner, hookRunLog } from './log_config_files/runtime/hook_logger.js';
+import { hookLogSessionBanner } from './log_config_files/runtime/hook_logger.js';
 const MANIFEST_STALE_MS = 7 * 24 * 60 * 60 * 1000;
-/** Set by optimus-compliance-check.sh only for Claude Desktop (dumb TERM). Hook runs allowlisted restart after osascript. */
-function claudeDesktopHookRunsRestart() {
-    const v = process.env.OPTIMUS_CLAUDE_DESKTOP_DEFER_GATE_RESTART?.trim().toLowerCase();
-    return v === '1' || v === 'true' || v === 'yes';
-}
 function parseIde() {
     const eq = process.argv.find((a) => a.startsWith('--ide='));
     if (eq) {
@@ -51,13 +48,6 @@ function blockPayload(ide, violationMessage) {
     }
     return JSON.stringify({ continue: false, user_message: text });
 }
-function fireRestartCommands(commands) {
-    for (const cmd of commands) {
-        hookRunLog(`restart: firing command="${cmd}"`);
-        const child = spawn('sh', ['-c', cmd], { detached: true, stdio: 'ignore' });
-        child.unref();
-    }
-}
 function getManifestStalenessMs() {
     try {
         const path = getRemediationInstructionsPath();
@@ -127,12 +117,7 @@ export async function runCompliancePromptGate() {
                 if (restartCommands.length > 0)
                     payload.restart_commands = restartCommands;
                 console.log(JSON.stringify(payload));
-                // Cursor: .cursor/hooks runs restart after the osascript dialog — avoid double SIGKILL here.
-                // Claude Desktop: same — optimus-compliance-check.sh shows the dialog then evals allowlisted restarts.
-                // Claude Code (CLI): no shell restart path; gate must spawn here.
-                const fireInGate = ide !== 'cursor' && !(ide === 'claude' && claudeDesktopHookRunsRestart());
-                if (fireInGate)
-                    fireRestartCommands(restartCommands);
+                // Restarts: always executed by optimus-compliance-check.sh via execute_trusted_restarts (TS allowlist + spawn).
                 return;
             }
             const msg = recheck.violations[0]?.message ?? 'A security policy violation has been detected.';

package/dist/execute_trusted_restarts.js

@@ -0,0 +1,56 @@
+/**
+ * CLI: read one JSON line from stdin (same shape as compliance_prompt_gate stdout for __optimus_autofix),
+ * parse restart_commands[], allowlist each in TS, spawn detached. Invoked by optimus-compliance-check.sh only.
+ * stderr stays quiet; failures logged via hookRunLog.
+ */
+import { readFileSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+import { resolve } from 'node:path';
+import { hookRunLog } from './log_config_files/runtime/hook_logger.js';
+import { executeTrustedRestartCommands } from './log_config_files/runtime/trusted_restarts.js';
+function isRunAsCliModule() {
+    const entry = process.argv[1];
+    if (!entry)
+        return false;
+    try {
+        return import.meta.url === pathToFileURL(resolve(entry)).href;
+    }
+    catch {
+        return false;
+    }
+}
+function main() {
+    let raw;
+    try {
+        raw = readFileSync(0, 'utf8');
+    }
+    catch {
+        hookRunLog('execute_trusted_restarts: could not read stdin');
+        return;
+    }
+    const first = raw.trim().split(/\r?\n/)[0]?.trim() ?? '';
+    if (!first)
+        return;
+    let j;
+    try {
+        j = JSON.parse(first);
+    }
+    catch {
+        hookRunLog('execute_trusted_restarts: stdin is not valid JSON');
+        return;
+    }
+    const cmds = j.restart_commands;
+    if (!Array.isArray(cmds))
+        return;
+    const strings = cmds.filter((c) => typeof c === 'string');
+    executeTrustedRestartCommands(strings);
+}
+if (isRunAsCliModule()) {
+    try {
+        main();
+    }
+    catch (e) {
+        hookRunLog(`execute_trusted_restarts: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    process.exit(0);
+}

package/dist/log_config_files/readers/vscdb_reader.js

@@ -92,6 +92,11 @@ export function readVscdbItemTableJson(dbPath, itemKey) {
         }
         // Bare JSON primitives (e.g. cursor/thirdPartyExtensibilityEnabled stores `true`/`false`).
         if (typeof parsed === 'boolean' || typeof parsed === 'number' || typeof parsed === 'string') {
+            const leaf = itemKey.split('/').pop() ?? '';
+            // Legacy cursorai/donotchange/privacyMode row is bare true/false; compliance paths use …/privacyMode.privacyMode.
+            if (typeof parsed === 'boolean' && leaf === 'privacyMode') {
+                return { [itemKey]: { privacyMode: parsed } };
+            }
             return { [itemKey]: parsed };
         }
         return { [itemKey]: {} };

package/dist/log_config_files/runtime/compliance_check.js

@@ -20,6 +20,14 @@ import { readStoredAuthKey } from '../auth/auth_key_store.js';
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
+/**
+ * ItemTable keys use slashes (e.g. cursorai/donotchange/privacyMode) and do not contain dots.
+ * Compliance setting_path is `${itemKey}.${nested.path}` — take the segment before the first `.`.
+ */
+export function itemTableKeyFromSettingPath(settingPath) {
+    const i = settingPath.indexOf('.');
+    return i === -1 ? settingPath : settingPath.slice(0, i);
+}
 /** Traverse a JSON object using dot-notation path. Returns undefined if any segment is missing. */
 export function getByPath(obj, path) {
     const parts = path.split('.');
@@ -85,20 +93,25 @@ function verifyOpsApplied(configJson, settingPath, ops) {
     }
     return { ok: true, expected: null };
 }
-/** Plain JSON file or virtual `…/state.vscdb#composerState` path for ItemTable-backed settings. */
-function loadRemediationConfigJson(configFilePath) {
+/** Plain JSON file or virtual `…/state.vscdb#itemKey` path for ItemTable-backed settings. */
+function loadRemediationConfigJson(configFilePath, checkSettingPaths = []) {
     const hashIdx = configFilePath.indexOf('#');
     if (hashIdx >= 0) {
         const dbPath = configFilePath.slice(0, hashIdx);
-        const itemKey = configFilePath.slice(hashIdx + 1).trim();
-        if (!itemKey)
+        const itemKeyFromPath = configFilePath.slice(hashIdx + 1).trim();
+        if (!itemKeyFromPath)
             return { ok: false, reason: 'empty_vscdb_key' };
         if (!existsSync(dbPath))
             return { ok: false, reason: 'db_not_found' };
-        const wrapped = readVscdbItemTableJson(dbPath, itemKey);
-        if (wrapped === null)
-            return { ok: false, reason: 'vscdb_read_failed' };
-        return { ok: true, json: wrapped };
+        const keys = new Set([itemKeyFromPath, ...checkSettingPaths.map(itemTableKeyFromSettingPath)].filter(Boolean));
+        const merged = {};
+        for (const k of keys) {
+            const wrapped = readVscdbItemTableJson(dbPath, k);
+            if (wrapped === null)
+                return { ok: false, reason: 'vscdb_read_failed' };
+            Object.assign(merged, wrapped);
+        }
+        return { ok: true, json: merged };
     }
     if (!existsSync(configFilePath))
         return { ok: false, reason: 'file_not_found' };
@@ -137,7 +150,7 @@ export function runLocalRemediationComplianceCheck() {
             const checks = compliance.checks ?? [];
             if (checks.length === 0)
                 continue;
-            const loaded = loadRemediationConfigJson(entry.config_file_path);
+            const loaded = loadRemediationConfigJson(entry.config_file_path, checks.map((c) => c.setting_path));
             if (!loaded.ok) {
                 const msg = loaded.reason === 'file_not_found'
                     ? `compliance_check: config file not found, skipping uuid=${entry.uuid}`
@@ -374,7 +387,7 @@ export function pruneSatisfiedOneTimeRemediations() {
             remaining.push(raw);
             continue;
         }
-        const prLoaded = loadRemediationConfigJson(inst.config_file_path);
+        const prLoaded = loadRemediationConfigJson(inst.config_file_path, checks.map((c) => c.setting_path));
         if (!prLoaded.ok) {
             remaining.push(raw);
             continue;

package/dist/log_config_files/runtime/trusted_restarts.js

@@ -0,0 +1,22 @@
+/**
+ * Execute autofix restart_command strings only if allowlisted (same rules as gate enqueue).
+ * Used by the compliance shell hook via execute_trusted_restarts CLI — single place for allowlist + spawn.
+ */
+import { spawn } from 'node:child_process';
+import { hookRunLog } from './hook_logger.js';
+import { isTrustedRestartCommandForAutofix } from './remediation_sync.js';
+/** Spawn each trusted command detached (same pattern as former compliance_prompt_gate fireRestartCommands). */
+export function executeTrustedRestartCommands(commands) {
+    for (const cmd of commands) {
+        const t = cmd.trim();
+        if (!t)
+            continue;
+        if (!isTrustedRestartCommandForAutofix(cmd)) {
+            hookRunLog(`execute_trusted_restarts: rejected (not allowlisted) prefix=${t.slice(0, 120)}`);
+            continue;
+        }
+        hookRunLog(`execute_trusted_restarts: firing command="${t}"`);
+        const child = spawn('sh', ['-c', t], { detached: true, stdio: 'ignore' });
+        child.unref();
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config",
-  "version": "1.3.2",
+  "version": "1.3.6",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {
@@ -8,7 +8,8 @@
     "log_uuid": "dist/log_uuid/index.js",
     "log_config_files": "dist/log_config_files/index.js",
     "log_sensitive_paths_audit": "dist/log_sensitive_paths_audit.js",
-    "apply-deferred-vscdb": "dist/apply_deferred_vscdb.js"
+    "apply-deferred-vscdb": "dist/apply_deferred_vscdb.js",
+    "execute-trusted-restarts": "dist/execute_trusted_restarts.js"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",