log-llm-config 1.3.21 → 1.3.23

package/dist/log_config_files/readers/vscdb_reader.js

@@ -1,5 +1,6 @@
 import { existsSync } from 'node:fs';
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
+import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
 import { readFileCollectionVscdbContract, writeFileCollectionVscdbContract, } from '../runtime/management_storage.js';
 /**
  * ItemTable keys that store a bare JSON boolean; compliance paths use `${key}.${field}`.
@@ -11,10 +12,15 @@ export const CURSOR_SCALAR_ITEMTABLE_FIELDS = {
     'cursor/autoOpenLocalhostUrls': 'autoOpenLocalhostUrls',
 };
 function querySqlite(dbPath, key) {
+    const bin = resolveSqlite3Binary();
+    if (!bin)
+        throw new Error('sqlite3 not found');
     const safe = key.replace(/'/g, "''");
-    return execSync(`sqlite3 "${dbPath}" "SELECT value FROM ItemTable WHERE key='${safe}'"`, {
+    const script = `.timeout 60000\nSELECT value FROM ItemTable WHERE key='${safe}';\n`;
+    return execFileSync(bin, ['-noheader', dbPath], {
+        input: script,
         encoding: 'utf8',
-        stdio: ['ignore', 'pipe', 'pipe'],
+        stdio: ['pipe', 'pipe', 'pipe'],
     }).trim();
 }
 /**
@@ -73,7 +79,8 @@ export function readVscdbItemTableJson(dbPath, itemKey) {
     try {
         if (!dbPath || !existsSync(dbPath))
             return null;
-        execSync('which sqlite3', { stdio: 'ignore' });
+        if (!resolveSqlite3Binary())
+            return null;
     }
     catch {
         return null;
@@ -218,10 +225,7 @@ export function readVSCDBState(dbPath, readQueries, mergeFromComposerStateKeys)
     try {
         if (!dbPath || !existsSync(dbPath))
             return null;
-        try {
-            execSync('which sqlite3', { stdio: 'ignore' });
-        }
-        catch {
+        if (!resolveSqlite3Binary()) {
             console.warn('sqlite3 command not found; skipping vscdb reading');
             return null;
         }

package/dist/log_config_files/runtime/remediation_config_path.js

@@ -52,7 +52,9 @@ export function canonicalCursorUserStateVscdbPath(filePath) {
 function cursorStateVscdbAbsoluteBasePaths() {
     const h = homedir();
     if (process.platform === 'darwin') {
-        return [join(h, 'Library', 'Application Support', 'Cursor', 'User', 'globalStorage', 'state.vscdb')];
+        const support = join(h, 'Library', 'Application Support');
+        const variants = ['Cursor', 'Cursor - Insiders', 'Cursor Nightly', 'Cursor Next'];
+        return variants.map((name) => join(support, name, 'User', 'globalStorage', 'state.vscdb'));
     }
     if (process.platform === 'win32') {
         const appData = process.env.APPDATA;

package/dist/log_config_files/runtime/remediation_sync.js

@@ -1,5 +1,5 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, unlinkSync } from 'node:fs';
-import { dirname } from 'node:path';
+import { delimiter, dirname } from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { executeGet, executeBody } from '../../endpoint_client/http_transport.js';
 import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
@@ -12,6 +12,29 @@ import { CURSOR_SCALAR_ITEMTABLE_FIELDS, persistVscdbComposerContractFromPattern
 import { sendConfigFile } from '../sender/batch_sender.js';
 import { getFileCollectionPatterns } from '../../endpoint_client/registry_api.js';
 import { resolveRemediationConfigPath } from './remediation_config_path.js';
+import { resolveSqlite3Binary } from './sqlite_binary.js';
+/** Best-effort detail from execFileSync failures (stderr, exit code, errno). */
+function formatNodeChildException(err) {
+    if (!(err instanceof Error)) {
+        const s = String(err);
+        return { short: s, long: s };
+    }
+    const e = err;
+    const bits = [e.message];
+    if (e.code)
+        bits.push(`errno_code=${e.code}`);
+    if (typeof e.status === 'number')
+        bits.push(`exit_status=${e.status}`);
+    let stderr = '';
+    if (e.stderr != null) {
+        stderr = typeof e.stderr === 'string' ? e.stderr : e.stderr.toString('utf8');
+        const t = stderr.trim();
+        if (t)
+            bits.push(`stderr=${t.slice(0, 1200)}`);
+    }
+    const long = bits.join(' | ');
+    return { short: bits.slice(0, 2).join(' | '), long };
+}
 function reactiveStorageItemKeyFromContract() {
     const k = readFileCollectionVscdbContract()?.reactive_storage_item_key;
     return typeof k === 'string' && k.trim() !== '' ? k.trim() : undefined;
@@ -309,16 +332,19 @@ function mergePostApplyUploadIntoPayload(payload, hint) {
     payload.post_apply_uploads.push({ file_path: hint.file_path, file_type: ft });
 }
 function assertSqlite3Available() {
-    try {
-        execFileSync('which', ['sqlite3'], { stdio: 'ignore' });
+    const bin = resolveSqlite3Binary();
+    if (bin) {
+        complianceRunnerDiag(`sqlite_update: using sqlite3 binary ${bin}`);
         return true;
     }
-    catch {
-        const line = 'sqlite_update: sqlite3 command not found';
-        hookRunLog(line);
-        complianceRunnerDiag(line);
-        return false;
-    }
+    const pathEnv = process.env.PATH ?? '';
+    const n = pathEnv ? pathEnv.split(delimiter).filter(Boolean).length : 0;
+    const line = 'sqlite_update: sqlite3 command not found';
+    hookRunLog(line);
+    hookRunLog(`sqlite_update: no sqlite3 resolved after checking env OPTIMUS_SQLITE3/SQLITE3_PATH, common paths, and PATH (${n} entries)`);
+    hookRunLog('sqlite_update: hint set OPTIMUS_SQLITE3 to the full path (e.g. /usr/bin/sqlite3 on macOS) if sqlite3 is outside PATH');
+    complianceRunnerDiag(`${line} PATH_entry_count=${n}`);
+    return false;
 }
 /**
  * Unquoted SQLite identifiers must be [A-Za-z_][A-Za-z0-9_]* so values read from
@@ -476,25 +502,49 @@ function mergeSqliteOpIntoJson(currentJson, sqliteOp) {
         const parentParts = parts.slice(0, -1);
         let node = currentJson;
         for (const p of parentParts) {
-            if (node == null || typeof node !== 'object')
+            if (node == null || typeof node !== 'object' || Array.isArray(node))
                 return;
-            node = node[p];
+            const rec = node;
+            const child = rec[p];
+            if (child == null) {
+                rec[p] = {};
+                node = rec[p];
+            }
+            else if (typeof child === 'object' && !Array.isArray(child)) {
+                node = child;
+            }
+            else {
+                return;
+            }
         }
         if (node == null || typeof node !== 'object' || Array.isArray(node))
             return;
         const container = node;
-        const arr = container[arrayKey];
-        if (!Array.isArray(arr))
+        const existing = container[arrayKey];
+        let arr;
+        if (Array.isArray(existing)) {
+            arr = existing;
+        }
+        else if (existing == null) {
+            arr = [];
+            container[arrayKey] = arr;
+        }
+        else {
             return;
+        }
         const idx = arr.findIndex((item) => {
             if (item === null || typeof item !== 'object')
                 return false;
             const o = item;
             return Object.entries(where).every(([k, v]) => o[k] === v);
         });
-        if (idx < 0)
+        if (idx >= 0) {
+            Object.assign(arr[idx], sqliteOp.updates);
             return;
-        Object.assign(arr[idx], sqliteOp.updates);
+        }
+        const newItem = { ...where };
+        Object.assign(newItem, sqliteOp.updates);
+        arr.push(newItem);
         return;
     }
     mergeJsonAtSqlitePath(currentJson, sqliteOp.json_path, sqliteOp.updates);
@@ -586,30 +636,68 @@ function sqliteSelectValueCell(dbPath, table, key_column, value_column, target_k
     if (!assertSafeSqliteIdentifiersForItemTable(table, key_column, value_column)) {
         return '';
     }
+    const sqlite3 = resolveSqlite3Binary();
+    if (!sqlite3) {
+        const line = 'sqlite_update: sqliteSelectValueCell called with no resolved sqlite3 binary (logic error: assertSqlite3Available should run first)';
+        hookRunLog(line);
+        complianceRunnerDiag(line);
+        return '';
+    }
     const safeName = target_key.replace(/'/g, "''");
     const script = `.timeout 60000\nSELECT ${value_column} FROM ${table} WHERE ${key_column}='${safeName}';\n`;
-    return execFileSync('sqlite3', ['-noheader', dbPath], {
-        input: script,
-        encoding: 'utf8',
-        stdio: ['pipe', 'pipe', 'pipe'],
-    }).trim();
+    try {
+        return execFileSync(sqlite3, ['-noheader', dbPath], {
+            input: script,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+    }
+    catch (err) {
+        const { short, long } = formatNodeChildException(err);
+        hookRunLog(`sqlite_update: SELECT failed binary=${sqlite3} db=${dbPath} table=${table} target_key=${target_key} ${long}`);
+        complianceRunnerDiag(`sqlite_update: SELECT failed target_key=${target_key} ${long.slice(0, 1800)}`);
+        throw new Error(`sqlite3 SELECT failed: ${short}`);
+    }
 }
 function sqliteExecWithTimeout(dbPath, sqlBody) {
+    const sqlite3 = resolveSqlite3Binary();
+    if (!sqlite3)
+        throw new Error('sqlite3 not found');
     const script = `.timeout 60000\n${sqlBody}\n`;
-    execFileSync('sqlite3', [dbPath], {
-        input: script,
-        encoding: 'utf8',
-        stdio: ['pipe', 'pipe', 'pipe'],
-    });
+    try {
+        execFileSync(sqlite3, [dbPath], {
+            input: script,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+    }
+    catch (err) {
+        const { long } = formatNodeChildException(err);
+        hookRunLog(`sqlite_update: UPDATE/exec failed binary=${sqlite3} db=${dbPath} ${long}`);
+        complianceRunnerDiag(`sqlite_update: UPDATE/exec failed ${long.slice(0, 1800)}`);
+        throw err;
+    }
 }
 /** Runs a single UPDATE (or other SQL) and returns sqlite `changes()` for the last statement. */
 function sqliteRunUpdateReturningChanges(dbPath, updateSql) {
+    const sqlite3 = resolveSqlite3Binary();
+    if (!sqlite3)
+        throw new Error('sqlite3 not found');
     const script = `.timeout 60000\n${updateSql}\nSELECT changes();\n`;
-    const out = execFileSync('sqlite3', [dbPath], {
-        input: script,
-        encoding: 'utf8',
-        stdio: ['pipe', 'pipe', 'pipe'],
-    }).trim();
+    let out;
+    try {
+        out = execFileSync(sqlite3, [dbPath], {
+            input: script,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+    }
+    catch (err) {
+        const { long } = formatNodeChildException(err);
+        hookRunLog(`sqlite_update: batch UPDATE/changes failed binary=${sqlite3} db=${dbPath} ${long}`);
+        complianceRunnerDiag(`sqlite_update: batch UPDATE failed ${long.slice(0, 1800)}`);
+        throw err;
+    }
     const lines = out.split(/\r?\n/).filter((l) => l.length > 0);
     const last = lines[lines.length - 1] ?? '0';
     return parseInt(last, 10) || 0;
@@ -746,14 +834,24 @@ function assertSafeDeferredItemTableKey(targetKey) {
 }
 function queueDeferredSqliteOpsMerged(configPath, sqliteOps, postApplyUpload) {
     const dbPath = configPath.split('#')[0];
+    hookRunLog(`sqlite_update: deferred_queue begin configPath=${configPath} dbPath=${dbPath} dbExists=${existsSync(dbPath)} sqliteOps=${sqliteOps.length}`);
+    complianceRunnerDiag(`sqlite_update: deferred_queue begin dbExists=${existsSync(dbPath)} ops=${sqliteOps.length}`);
     if (!existsSync(dbPath)) {
         const line = `sqlite_update: database not found at ${dbPath}`;
         hookRunLog(line);
+        hookRunLog(`sqlite_update: parent dir exists=${existsSync(dirname(dbPath))} (if false, wrong Cursor profile path or never launched Cursor)`);
         complianceRunnerDiag(line);
-        return false;
+        return {
+            ok: false,
+            reason: `state.vscdb not on disk at ${dbPath} (Cursor may not have created globalStorage yet — open Cursor once).`,
+        };
+    }
+    if (!assertSqlite3Available()) {
+        return {
+            ok: false,
+            reason: 'sqlite3 CLI not found (IDE hooks often have a minimal PATH). On macOS try OPTIMUS_SQLITE3=/usr/bin/sqlite3 or install sqlite3 and fix PATH.',
+        };
     }
-    if (!assertSqlite3Available())
-        return false;
     const resolvedOps = sqliteOps.map((op) => resolveCursorComposerSqliteOp(dbPath, op));
     const groups = new Map();
     for (const op of resolvedOps) {
@@ -771,12 +869,14 @@ function queueDeferredSqliteOpsMerged(configPath, sqliteOps, postApplyUpload) {
                 const line = `sqlite_update: rejected unsafe or empty target_key for deferred queue (refusing to write state.vscdb)`;
                 hookRunLog(line);
                 complianceRunnerDiag(`${line} target_key_preview=${first.target_key.slice(0, 80)}`);
-                return false;
+                return { ok: false, reason: 'unsafe or empty ItemTable target_key (see hook_log).' };
             }
             complianceRunnerDiag(`sqlite_update: deferred merge db=${dbPath} target_key=${first.target_key} operations=${ops.length}`);
             let currentJson = {};
+            let rawSelectLength = 0;
             try {
                 const result = sqliteSelectValueCell(dbPath, first.table, first.key_column, first.value_column, first.target_key);
+                rawSelectLength = result.length;
                 if (result) {
                     const parsed = JSON.parse(result);
                     currentJson = coerceItemTableValueToObjectRoot(first.target_key, parsed);
@@ -786,7 +886,10 @@ function queueDeferredSqliteOpsMerged(configPath, sqliteOps, postApplyUpload) {
                 const line = `sqlite_update: error querying database: ${e instanceof Error ? e.message : String(e)}`;
                 hookRunLog(line);
                 complianceRunnerDiag(line);
-                return false;
+                return {
+                    ok: false,
+                    reason: `sqlite read/parse failed: ${e instanceof Error ? e.message : String(e)}`,
+                };
             }
             for (const op of ops) {
                 mergeSqliteOpIntoJson(currentJson, op);
@@ -794,10 +897,17 @@ function queueDeferredSqliteOpsMerged(configPath, sqliteOps, postApplyUpload) {
             repairComposerStateEmptySegmentBug(currentJson);
             const updatedJson = serializeItemTableValueForWrite(first.target_key, currentJson);
             if (updatedJson === '{}' && Object.keys(currentJson).length === 0) {
-                const line = `sqlite_update: deferred merge produced empty JSON — refusing to queue (would wipe ItemTable row)`;
+                const opSummary = ops
+                    .map((o) => `path=${o.json_path ?? ''} updates=${JSON.stringify(o.updates ?? {})}`)
+                    .join(' || ')
+                    .slice(0, 900);
+                const line = `sqlite_update: deferred merge produced empty JSON — refusing to queue (would wipe ItemTable row) target_key=${first.target_key} raw_cell_len=${rawSelectLength} ops=${opSummary}`;
                 hookRunLog(line);
-                complianceRunnerDiag(line);
-                return false;
+                complianceRunnerDiag(line.slice(0, 2000));
+                return {
+                    ok: false,
+                    reason: `merge produced empty JSON after ops (target_key=${first.target_key}, raw_cell_len=${rawSelectLength}). Check sqlite_update lines above for SELECT errors or bad sqlite_op merge.`,
+                };
             }
             queueDeferredVscdbItem({
                 dbPath,
@@ -811,13 +921,16 @@ function queueDeferredSqliteOpsMerged(configPath, sqliteOps, postApplyUpload) {
             hookRunLog(okLine);
             complianceRunnerDiag(okLine);
         }
-        return true;
+        return { ok: true };
     }
     catch (err) {
         const line = `sqlite_update: unexpected error: ${err instanceof Error ? err.message : String(err)}`;
         hookRunLog(line);
         complianceRunnerDiag(line);
-        return false;
+        return {
+            ok: false,
+            reason: `unexpected: ${err instanceof Error ? err.message : String(err)}`,
+        };
     }
 }
 /**
@@ -932,11 +1045,16 @@ export function enforceRemediation(instruction) {
                 const postApplyUpload = ft && inst.config_file_path.includes('#')
                     ? { file_path: inst.config_file_path, file_type: ft }
                     : undefined;
-                const ok = queueDeferredSqliteOpsMerged(inst.config_file_path, ops, postApplyUpload);
-                if (!ok) {
-                    return fail('deferred state.vscdb queue failed (database missing, sqlite3 unavailable, or read/merge error — see sqlite_update lines above in hook_log)', { config_file_path: inst.config_file_path });
+                const q = queueDeferredSqliteOpsMerged(inst.config_file_path, ops, postApplyUpload);
+                if (!q.ok) {
+                    const dbOnly = inst.config_file_path.split('#')[0];
+                    return fail(`deferred state.vscdb queue failed — ${q.reason} (see sqlite_update lines above in hook_log for SELECT/exec details)`, {
+                        config_file_path: inst.config_file_path,
+                        resolved_db_path: dbOnly,
+                        sqlite3_binary: resolveSqlite3Binary() ?? 'unresolved',
+                    });
                 }
-                return { ok, deferredSqlite: ok };
+                return { ok: true, deferredSqlite: true };
             }
             let allSuccess = true;
             for (const check of sqliteOps) {

package/dist/log_config_files/runtime/sqlite_binary.js

@@ -0,0 +1,92 @@
+import { existsSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { join } from 'node:path';
+let cached;
+/**
+ * Resolve the sqlite3 CLI for remediations and vscdb reads.
+ *
+ * Cursor/IDE-launched hooks often inherit a minimal PATH (no Homebrew), while macOS still ships
+ * `/usr/bin/sqlite3`. Prefer explicit paths before `which` / bare `sqlite3`.
+ *
+ * Override: `OPTIMUS_SQLITE3`, `SQLITE3_PATH`, or `SQLITE3_BIN` = absolute path to the binary.
+ */
+export function resolveSqlite3Binary() {
+    if (cached !== undefined)
+        return cached;
+    for (const envName of ['OPTIMUS_SQLITE3', 'SQLITE3_PATH', 'SQLITE3_BIN']) {
+        const v = process.env[envName]?.trim();
+        if (v && existsSync(v)) {
+            cached = v;
+            return cached;
+        }
+    }
+    const candidates = [];
+    if (process.platform === 'darwin') {
+        candidates.push('/usr/bin/sqlite3', '/opt/homebrew/bin/sqlite3', '/usr/local/bin/sqlite3', '/opt/local/bin/sqlite3');
+    }
+    else if (process.platform === 'linux') {
+        candidates.push('/usr/bin/sqlite3', '/usr/local/bin/sqlite3');
+    }
+    else if (process.platform === 'win32') {
+        const pf = process.env.ProgramFiles;
+        if (pf) {
+            candidates.push(join(pf, 'Git', 'usr', 'bin', 'sqlite3.exe'));
+        }
+    }
+    for (const p of candidates) {
+        if (p && existsSync(p)) {
+            cached = p;
+            return cached;
+        }
+    }
+    try {
+        if (process.platform === 'win32') {
+            const out = execFileSync('where.exe', ['sqlite3'], {
+                encoding: 'utf8',
+                stdio: ['ignore', 'pipe', 'ignore'],
+            }).trim();
+            const first = out.split(/\r?\n/).find((line) => {
+                const t = line.trim();
+                return t.length > 0 && existsSync(t);
+            });
+            if (first) {
+                cached = first.trim();
+                return cached;
+            }
+        }
+        else {
+            for (const whichBin of ['which', '/usr/bin/which']) {
+                try {
+                    const out = execFileSync(whichBin, ['sqlite3'], {
+                        encoding: 'utf8',
+                        stdio: ['ignore', 'pipe', 'ignore'],
+                    }).trim();
+                    const first = out.split(/\n/)[0]?.trim();
+                    if (first && existsSync(first)) {
+                        cached = first;
+                        return cached;
+                    }
+                }
+                catch {
+                    /* try next */
+                }
+            }
+        }
+    }
+    catch {
+        /* fall through */
+    }
+    try {
+        execFileSync('sqlite3', ['--version'], { stdio: 'ignore' });
+        cached = 'sqlite3';
+        return cached;
+    }
+    catch {
+        cached = null;
+        return null;
+    }
+}
+/** Test-only: reset memoized path after env/path changes. */
+export function clearSqlite3BinaryCacheForTests() {
+    cached = undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config",
-  "version": "1.3.21",
+  "version": "1.3.23",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {