log-llm-config 1.3.20 → 1.3.22

package/dist/log_config_files/readers/vscdb_reader.js

@@ -110,6 +110,12 @@ export function readVscdbItemTableJson(dbPath, itemKey) {
                 if (typeof parsed === 'number' && !Number.isNaN(parsed)) {
                     return { [itemKey]: { [field]: parsed !== 0 } };
                 }
+                if (typeof parsed === 'string') {
+                    const lower = parsed.trim().toLowerCase();
+                    return {
+                        [itemKey]: { [field]: lower === 'true' || lower === '1' || lower === 'yes' },
+                    };
+                }
             }
             return { [itemKey]: parsed };
         }

package/dist/log_config_files/runtime/main_runner.js

@@ -14,6 +14,7 @@ import { persistVscdbComposerContractFromPatternsResponse } from '../readers/vsc
 import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, determineFileTypeFromPath } from '../collection/config_collector.js';
 import { normalizePathSkipPrefixes } from '../paths/pattern_resolver.js';
 import { sendConfigFile, sendConfigFilesBatch, sendHookRequestCreate, sendHookRequestUpdateManifest, sendIngestSessionStart, sendIngestSessionFinish, BATCH_CHUNK_SIZE } from '../sender/batch_sender.js';
+import { canonicalCursorUserStateVscdbPath } from './remediation_config_path.js';
 import { createSignature, canonicalizePayload } from '../sender/signing.js';
 const PROJECT_ROOT = process.cwd();
 async function collectAllConfigFiles(endpointBase) {
@@ -73,7 +74,7 @@ async function sendAllConfigFiles(configFiles, hardwareUuid, authKey) {
     const hookTypeRaw = (process.env.OPTIMUS_HOOK_TYPE || 'claude').toLowerCase();
     const hookType = hookTypeRaw === 'cursor' ? 'cursor' : 'claude';
     const workspaceRepo = process.env.OPTIMUS_WORKSPACE_REPO || process.env.GITHUB_REPOSITORY || '';
-    const manifest = configFiles.map((c) => c.file_path);
+    const manifest = configFiles.map((c) => canonicalCursorUserStateVscdbPath(c.file_path));
     const hookRequestId = await sendHookRequestCreate(hardwareUuid, authKey, hookType, workspaceRepo);
     hookRunLog(`hook-request id=${hookRequestId ?? 'none'}`);
     const ingestSessionId = await sendIngestSessionStart(hardwareUuid, authKey);

package/dist/log_config_files/runtime/remediation_config_path.js

@@ -9,6 +9,46 @@ export const PORTABLE_CURSOR_USER_STATE_VSCDB = 'Cursor/User/globalStorage/state
 function normalizeSlashes(p) {
     return p.trim().replace(/\\/g, '/');
 }
+/**
+ * Canonical `file_path` for Cursor User globalStorage state.vscdb uploads, matching
+ * `optimus_security.endpoint.log_config_file.handler._canonical_cursor_user_state_vscdb_path`.
+ * Always use before sending log-config-file(s) so findings dedupe regardless of absolute vs portable input.
+ */
+export function canonicalCursorUserStateVscdbPath(filePath) {
+    const s = normalizeSlashes(filePath);
+    const lower = s.toLowerCase();
+    const needle = 'cursor/user/globalstorage/state.vscdb';
+    const idx = lower.indexOf(needle);
+    if (idx >= 0) {
+        const tail = s.slice(idx + needle.length);
+        if (tail.startsWith('#')) {
+            return `${PORTABLE_CURSOR_USER_STATE_VSCDB}${tail}`;
+        }
+        if (tail === '') {
+            return PORTABLE_CURSOR_USER_STATE_VSCDB;
+        }
+        return filePath.trim();
+    }
+    const vscdb = 'state.vscdb';
+    const vlen = vscdb.length;
+    const slashKey = '/' + vscdb;
+    let start;
+    const pos = lower.lastIndexOf(slashKey);
+    if (pos >= 0) {
+        start = pos + 1;
+    }
+    else if (lower.startsWith(vscdb)) {
+        start = 0;
+    }
+    else {
+        return filePath.trim();
+    }
+    const tail = s.slice(start + vlen);
+    if (tail.startsWith('#') || tail === '') {
+        return `${PORTABLE_CURSOR_USER_STATE_VSCDB}${tail}`;
+    }
+    return filePath.trim();
+}
 function cursorStateVscdbAbsoluteBasePaths() {
     const h = homedir();
     if (process.platform === 'darwin') {

package/dist/log_config_files/runtime/remediation_sync.js

@@ -476,25 +476,49 @@ function mergeSqliteOpIntoJson(currentJson, sqliteOp) {
         const parentParts = parts.slice(0, -1);
         let node = currentJson;
         for (const p of parentParts) {
-            if (node == null || typeof node !== 'object')
+            if (node == null || typeof node !== 'object' || Array.isArray(node))
                 return;
-            node = node[p];
+            const rec = node;
+            const child = rec[p];
+            if (child == null) {
+                rec[p] = {};
+                node = rec[p];
+            }
+            else if (typeof child === 'object' && !Array.isArray(child)) {
+                node = child;
+            }
+            else {
+                return;
+            }
         }
         if (node == null || typeof node !== 'object' || Array.isArray(node))
             return;
         const container = node;
-        const arr = container[arrayKey];
-        if (!Array.isArray(arr))
+        const existing = container[arrayKey];
+        let arr;
+        if (Array.isArray(existing)) {
+            arr = existing;
+        }
+        else if (existing == null) {
+            arr = [];
+            container[arrayKey] = arr;
+        }
+        else {
             return;
+        }
         const idx = arr.findIndex((item) => {
             if (item === null || typeof item !== 'object')
                 return false;
             const o = item;
             return Object.entries(where).every(([k, v]) => o[k] === v);
         });
-        if (idx < 0)
+        if (idx >= 0) {
+            Object.assign(arr[idx], sqliteOp.updates);
             return;
-        Object.assign(arr[idx], sqliteOp.updates);
+        }
+        const newItem = { ...where };
+        Object.assign(newItem, sqliteOp.updates);
+        arr.push(newItem);
         return;
     }
     mergeJsonAtSqlitePath(currentJson, sqliteOp.json_path, sqliteOp.updates);
@@ -750,10 +774,17 @@ function queueDeferredSqliteOpsMerged(configPath, sqliteOps, postApplyUpload) {
         const line = `sqlite_update: database not found at ${dbPath}`;
         hookRunLog(line);
         complianceRunnerDiag(line);
-        return false;
+        return {
+            ok: false,
+            reason: `state.vscdb not on disk at ${dbPath} (Cursor may not have created globalStorage yet — open Cursor once).`,
+        };
+    }
+    if (!assertSqlite3Available()) {
+        return {
+            ok: false,
+            reason: 'sqlite3 CLI not found in PATH (IDE hooks often inherit a minimal PATH; install Xcode CLT / sqlite3 or fix PATH).',
+        };
     }
-    if (!assertSqlite3Available())
-        return false;
     const resolvedOps = sqliteOps.map((op) => resolveCursorComposerSqliteOp(dbPath, op));
     const groups = new Map();
     for (const op of resolvedOps) {
@@ -771,7 +802,7 @@ function queueDeferredSqliteOpsMerged(configPath, sqliteOps, postApplyUpload) {
                 const line = `sqlite_update: rejected unsafe or empty target_key for deferred queue (refusing to write state.vscdb)`;
                 hookRunLog(line);
                 complianceRunnerDiag(`${line} target_key_preview=${first.target_key.slice(0, 80)}`);
-                return false;
+                return { ok: false, reason: 'unsafe or empty ItemTable target_key (see hook_log).' };
             }
             complianceRunnerDiag(`sqlite_update: deferred merge db=${dbPath} target_key=${first.target_key} operations=${ops.length}`);
             let currentJson = {};
@@ -786,7 +817,10 @@ function queueDeferredSqliteOpsMerged(configPath, sqliteOps, postApplyUpload) {
                 const line = `sqlite_update: error querying database: ${e instanceof Error ? e.message : String(e)}`;
                 hookRunLog(line);
                 complianceRunnerDiag(line);
-                return false;
+                return {
+                    ok: false,
+                    reason: `sqlite read/parse failed: ${e instanceof Error ? e.message : String(e)}`,
+                };
             }
             for (const op of ops) {
                 mergeSqliteOpIntoJson(currentJson, op);
@@ -797,7 +831,10 @@ function queueDeferredSqliteOpsMerged(configPath, sqliteOps, postApplyUpload) {
                 const line = `sqlite_update: deferred merge produced empty JSON — refusing to queue (would wipe ItemTable row)`;
                 hookRunLog(line);
                 complianceRunnerDiag(line);
-                return false;
+                return {
+                    ok: false,
+                    reason: 'merge produced empty JSON (no-op merge — often missing modes4/agent structure or outdated log-llm-config; publish latest package and retry).',
+                };
             }
             queueDeferredVscdbItem({
                 dbPath,
@@ -811,13 +848,16 @@ function queueDeferredSqliteOpsMerged(configPath, sqliteOps, postApplyUpload) {
             hookRunLog(okLine);
             complianceRunnerDiag(okLine);
         }
-        return true;
+        return { ok: true };
     }
     catch (err) {
         const line = `sqlite_update: unexpected error: ${err instanceof Error ? err.message : String(err)}`;
         hookRunLog(line);
         complianceRunnerDiag(line);
-        return false;
+        return {
+            ok: false,
+            reason: `unexpected: ${err instanceof Error ? err.message : String(err)}`,
+        };
     }
 }
 /**
@@ -932,11 +972,11 @@ export function enforceRemediation(instruction) {
                 const postApplyUpload = ft && inst.config_file_path.includes('#')
                     ? { file_path: inst.config_file_path, file_type: ft }
                     : undefined;
-                const ok = queueDeferredSqliteOpsMerged(inst.config_file_path, ops, postApplyUpload);
-                if (!ok) {
-                    return fail('deferred state.vscdb queue failed (database missing, sqlite3 unavailable, or read/merge error — see sqlite_update lines above in hook_log)', { config_file_path: inst.config_file_path });
+                const q = queueDeferredSqliteOpsMerged(inst.config_file_path, ops, postApplyUpload);
+                if (!q.ok) {
+                    return fail(`deferred state.vscdb queue failed — ${q.reason} (see sqlite_update lines in ~/opt-ai-sec/management/hook_log.txt)`, { config_file_path: inst.config_file_path });
                 }
-                return { ok, deferredSqlite: ok };
+                return { ok: true, deferredSqlite: true };
             }
             let allSuccess = true;
             for (const check of sqliteOps) {

package/dist/log_config_files/sender/batch_sender.js

@@ -2,6 +2,7 @@ import { postStartupPayload, patchPayload } from '../../endpoint_client/index.js
 import { createSignature } from './signing.js';
 import { loadEndpointBase } from './endpoint_config.js';
 import { hookRunLog } from '../runtime/hook_logger.js';
+import { canonicalCursorUserStateVscdbPath } from '../runtime/remediation_config_path.js';
 /** Chunk size per batch request. */
 export const BATCH_CHUNK_SIZE = 20;
 const MAX_BATCH_SIZE_BYTES = 500 * 1024; // 500KB
@@ -51,7 +52,11 @@ function buildBatchChunks(configFiles, basePayloadSize) {
     return chunks;
 }
 function buildChunkBody(chunk, hardwareUuid, authKey, hookRequestId, metadata) {
-    const config_files = chunk.map((c) => ({ file_type: c.file_type, file_path: c.file_path, raw_content: c.raw_content }));
+    const config_files = chunk.map((c) => ({
+        file_type: c.file_type,
+        file_path: canonicalCursorUserStateVscdbPath(c.file_path),
+        raw_content: c.raw_content,
+    }));
     const payload = { hardware_uuid: hardwareUuid, metadata, config_files };
     if (hookRequestId != null)
         payload.hook_request_id = hookRequestId;
@@ -153,18 +158,19 @@ async function sendIngestSessionFinish(hardwareUuid, authKey, ingestSessionId) {
 async function sendConfigFile(configFile, hardwareUuid, authKey) {
     const endpoint = loadEndpointBase();
     const apiUrl = `${resolveApiBase(endpoint)}/endpoint_security/log-config-file/`;
-    const payload = { hardware_uuid: hardwareUuid, file_type: configFile.file_type, file_path: configFile.file_path, raw_content: configFile.raw_content };
+    const uploadPath = canonicalCursorUserStateVscdbPath(configFile.file_path);
+    const payload = { hardware_uuid: hardwareUuid, file_type: configFile.file_type, file_path: uploadPath, raw_content: configFile.raw_content };
     const signature = createSignature(payload, authKey.key);
     const body = { ...payload, signature, key_id: authKey.key_id || '', metadata: { org_identifier: process.env.GITHUB_ORG || process.env.GH_ORG || '', repo_identifier: process.env.GITHUB_REPOSITORY || process.env.GH_REPOSITORY || '' } };
     try {
         const response = await postStartupPayload(apiUrl, body);
         if (response.status !== 'accepted') {
-            hookRunLog(`sendConfigFile: rejected status=${response.status} error=${response.error ?? ''} path=${configFile.file_path}`);
+            hookRunLog(`sendConfigFile: rejected status=${response.status} error=${response.error ?? ''} path=${uploadPath}`);
         }
         return response.status === 'accepted';
     }
     catch (err) {
-        hookRunLog(`sendConfigFile: request failed path=${configFile.file_path} err=${err instanceof Error ? err.message : String(err)}`);
+        hookRunLog(`sendConfigFile: request failed path=${uploadPath} err=${err instanceof Error ? err.message : String(err)}`);
         return false;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config",
-  "version": "1.3.20",
+  "version": "1.3.22",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {