log-llm-config 1.3.22 → 1.3.24

package/dist/endpoint_client/index.js

@@ -1,3 +1,3 @@
 export { FILE_PATH_REGISTRY_FILE_PATTERNS_PATH, FILE_PATH_REGISTRY_SENSITIVE_PATHS_PATH, } from './types.js';
-export { getFileCollectionPatterns, getSensitivePathsAuditCandidates } from './registry_api.js';
+export { buildApiUrl, getFileCollectionPatterns, getSensitivePathsAuditCandidates, } from './registry_api.js';
 export { postStartupPayload, patchPayload, classifyEndpointResponse } from './startup_api.js';

package/dist/endpoint_client/registry_api.js

@@ -1,7 +1,11 @@
+import { URL } from 'node:url';
 import { executeGet } from './http_transport.js';
 import { FILE_PATH_REGISTRY_FILE_PATTERNS_PATH, FILE_PATH_REGISTRY_SENSITIVE_PATHS_PATH, } from './types.js';
-function buildApiUrl(base, path) {
-    return `${base.replace(/\/+$/, '')}${path}`.replace(/([^/])\/+/g, '$1/');
+/** Join API base (may include a path prefix, e.g. https://host/optimus/) with an absolute API path. */
+export function buildApiUrl(base, path) {
+    const normalizedBase = `${base.replace(/\/+$/, '')}/`;
+    const relativePath = path.replace(/^\/+/, '');
+    return new URL(relativePath, normalizedBase).href;
 }
 /**
  * GET file collection patterns from the backend (what to look for).

package/dist/log_config_files/readers/vscdb_reader.js

@@ -1,5 +1,6 @@
 import { existsSync } from 'node:fs';
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
+import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
 import { readFileCollectionVscdbContract, writeFileCollectionVscdbContract, } from '../runtime/management_storage.js';
 /**
  * ItemTable keys that store a bare JSON boolean; compliance paths use `${key}.${field}`.
@@ -11,10 +12,15 @@ export const CURSOR_SCALAR_ITEMTABLE_FIELDS = {
     'cursor/autoOpenLocalhostUrls': 'autoOpenLocalhostUrls',
 };
 function querySqlite(dbPath, key) {
+    const bin = resolveSqlite3Binary();
+    if (!bin)
+        throw new Error('sqlite3 not found');
     const safe = key.replace(/'/g, "''");
-    return execSync(`sqlite3 "${dbPath}" "SELECT value FROM ItemTable WHERE key='${safe}'"`, {
+    const script = `.timeout 60000\nSELECT value FROM ItemTable WHERE key='${safe}';\n`;
+    return execFileSync(bin, ['-noheader', dbPath], {
+        input: script,
         encoding: 'utf8',
-        stdio: ['ignore', 'pipe', 'pipe'],
+        stdio: ['pipe', 'pipe', 'pipe'],
     }).trim();
 }
 /**
@@ -73,7 +79,8 @@ export function readVscdbItemTableJson(dbPath, itemKey) {
     try {
         if (!dbPath || !existsSync(dbPath))
             return null;
-        execSync('which sqlite3', { stdio: 'ignore' });
+        if (!resolveSqlite3Binary())
+            return null;
     }
     catch {
         return null;
@@ -218,10 +225,7 @@ export function readVSCDBState(dbPath, readQueries, mergeFromComposerStateKeys)
     try {
         if (!dbPath || !existsSync(dbPath))
             return null;
-        try {
-            execSync('which sqlite3', { stdio: 'ignore' });
-        }
-        catch {
+        if (!resolveSqlite3Binary()) {
             console.warn('sqlite3 command not found; skipping vscdb reading');
             return null;
         }

package/dist/log_config_files/runtime/remediation_config_path.js

@@ -52,7 +52,9 @@ export function canonicalCursorUserStateVscdbPath(filePath) {
 function cursorStateVscdbAbsoluteBasePaths() {
     const h = homedir();
     if (process.platform === 'darwin') {
-        return [join(h, 'Library', 'Application Support', 'Cursor', 'User', 'globalStorage', 'state.vscdb')];
+        const support = join(h, 'Library', 'Application Support');
+        const variants = ['Cursor', 'Cursor - Insiders', 'Cursor Nightly', 'Cursor Next'];
+        return variants.map((name) => join(support, name, 'User', 'globalStorage', 'state.vscdb'));
     }
     if (process.platform === 'win32') {
         const appData = process.env.APPDATA;

package/dist/log_config_files/runtime/remediation_sync.js

@@ -1,5 +1,5 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, unlinkSync } from 'node:fs';
-import { dirname } from 'node:path';
+import { delimiter, dirname } from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { executeGet, executeBody } from '../../endpoint_client/http_transport.js';
 import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
@@ -10,8 +10,31 @@ import { loadEndpointBase } from '../sender/endpoint_config.js';
 import { tryResolveHardwareUuid } from './hardware_uuid.js';
 import { CURSOR_SCALAR_ITEMTABLE_FIELDS, persistVscdbComposerContractFromPatternsResponse, readVscdbItemTableJson, } from '../readers/vscdb_reader.js';
 import { sendConfigFile } from '../sender/batch_sender.js';
-import { getFileCollectionPatterns } from '../../endpoint_client/registry_api.js';
+import { buildApiUrl, getFileCollectionPatterns } from '../../endpoint_client/registry_api.js';
 import { resolveRemediationConfigPath } from './remediation_config_path.js';
+import { resolveSqlite3Binary } from './sqlite_binary.js';
+/** Best-effort detail from execFileSync failures (stderr, exit code, errno). */
+function formatNodeChildException(err) {
+    if (!(err instanceof Error)) {
+        const s = String(err);
+        return { short: s, long: s };
+    }
+    const e = err;
+    const bits = [e.message];
+    if (e.code)
+        bits.push(`errno_code=${e.code}`);
+    if (typeof e.status === 'number')
+        bits.push(`exit_status=${e.status}`);
+    let stderr = '';
+    if (e.stderr != null) {
+        stderr = typeof e.stderr === 'string' ? e.stderr : e.stderr.toString('utf8');
+        const t = stderr.trim();
+        if (t)
+            bits.push(`stderr=${t.slice(0, 1200)}`);
+    }
+    const long = bits.join(' | ');
+    return { short: bits.slice(0, 2).join(' | '), long };
+}
 function reactiveStorageItemKeyFromContract() {
     const k = readFileCollectionVscdbContract()?.reactive_storage_item_key;
     return typeof k === 'string' && k.trim() !== '' ? k.trim() : undefined;
@@ -96,17 +119,9 @@ async function ensureInstructionsForUuids(endpointBase, machineUuid, want, overl
 // ---------------------------------------------------------------------------
 // API helpers
 // ---------------------------------------------------------------------------
-function resolveOrigin(endpointBase) {
-    try {
-        return new URL(endpointBase).origin;
-    }
-    catch {
-        return endpointBase.replace(/\/+$/, '');
-    }
-}
 export async function fetchSync(endpointBase, machineUuid, activeUuids, timeoutMs = 8000) {
     const uuidsParam = activeUuids.join(',');
-    const url = `${resolveOrigin(endpointBase)}/api/findings/remediations/sync/?machine_uuid=${encodeURIComponent(machineUuid)}&active_uuids=${encodeURIComponent(uuidsParam)}`;
+    const url = `${buildApiUrl(endpointBase, '/api/findings/remediations/sync/')}?machine_uuid=${encodeURIComponent(machineUuid)}&active_uuids=${encodeURIComponent(uuidsParam)}`;
     const { statusCode, body } = await executeGet(url, timeoutMs);
     if (statusCode !== 200 || !body) {
         const line = `remediation_sync_get: url=${url} status=${statusCode} bytes=${body?.length ?? 0}`;
@@ -124,7 +139,7 @@ export async function fetchSync(endpointBase, machineUuid, activeUuids, timeoutM
     }
 }
 async function fetchManifest(endpointBase, machineUuid, uuids, timeoutMs = 8000) {
-    const url = `${resolveOrigin(endpointBase)}/api/findings/remediations/manifest/?machine_uuid=${encodeURIComponent(machineUuid)}&uuids=${encodeURIComponent(uuids.join(','))}`;
+    const url = `${buildApiUrl(endpointBase, '/api/findings/remediations/manifest/')}?machine_uuid=${encodeURIComponent(machineUuid)}&uuids=${encodeURIComponent(uuids.join(','))}`;
     const { statusCode, body } = await executeGet(url, timeoutMs);
     if (statusCode !== 200 || !body) {
         const line = `remediation_manifest_get: url=${url} status=${statusCode} bytes=${body?.length ?? 0}`;
@@ -309,16 +324,19 @@ function mergePostApplyUploadIntoPayload(payload, hint) {
     payload.post_apply_uploads.push({ file_path: hint.file_path, file_type: ft });
 }
 function assertSqlite3Available() {
-    try {
-        execFileSync('which', ['sqlite3'], { stdio: 'ignore' });
+    const bin = resolveSqlite3Binary();
+    if (bin) {
+        complianceRunnerDiag(`sqlite_update: using sqlite3 binary ${bin}`);
         return true;
     }
-    catch {
-        const line = 'sqlite_update: sqlite3 command not found';
-        hookRunLog(line);
-        complianceRunnerDiag(line);
-        return false;
-    }
+    const pathEnv = process.env.PATH ?? '';
+    const n = pathEnv ? pathEnv.split(delimiter).filter(Boolean).length : 0;
+    const line = 'sqlite_update: sqlite3 command not found';
+    hookRunLog(line);
+    hookRunLog(`sqlite_update: no sqlite3 resolved after checking env OPTIMUS_SQLITE3/SQLITE3_PATH, common paths, and PATH (${n} entries)`);
+    hookRunLog('sqlite_update: hint set OPTIMUS_SQLITE3 to the full path (e.g. /usr/bin/sqlite3 on macOS) if sqlite3 is outside PATH');
+    complianceRunnerDiag(`${line} PATH_entry_count=${n}`);
+    return false;
 }
 /**
  * Unquoted SQLite identifiers must be [A-Za-z_][A-Za-z0-9_]* so values read from
@@ -610,30 +628,68 @@ function sqliteSelectValueCell(dbPath, table, key_column, value_column, target_k
     if (!assertSafeSqliteIdentifiersForItemTable(table, key_column, value_column)) {
         return '';
     }
+    const sqlite3 = resolveSqlite3Binary();
+    if (!sqlite3) {
+        const line = 'sqlite_update: sqliteSelectValueCell called with no resolved sqlite3 binary (logic error: assertSqlite3Available should run first)';
+        hookRunLog(line);
+        complianceRunnerDiag(line);
+        return '';
+    }
     const safeName = target_key.replace(/'/g, "''");
     const script = `.timeout 60000\nSELECT ${value_column} FROM ${table} WHERE ${key_column}='${safeName}';\n`;
-    return execFileSync('sqlite3', ['-noheader', dbPath], {
-        input: script,
-        encoding: 'utf8',
-        stdio: ['pipe', 'pipe', 'pipe'],
-    }).trim();
+    try {
+        return execFileSync(sqlite3, ['-noheader', dbPath], {
+            input: script,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+    }
+    catch (err) {
+        const { short, long } = formatNodeChildException(err);
+        hookRunLog(`sqlite_update: SELECT failed binary=${sqlite3} db=${dbPath} table=${table} target_key=${target_key} ${long}`);
+        complianceRunnerDiag(`sqlite_update: SELECT failed target_key=${target_key} ${long.slice(0, 1800)}`);
+        throw new Error(`sqlite3 SELECT failed: ${short}`);
+    }
 }
 function sqliteExecWithTimeout(dbPath, sqlBody) {
+    const sqlite3 = resolveSqlite3Binary();
+    if (!sqlite3)
+        throw new Error('sqlite3 not found');
     const script = `.timeout 60000\n${sqlBody}\n`;
-    execFileSync('sqlite3', [dbPath], {
-        input: script,
-        encoding: 'utf8',
-        stdio: ['pipe', 'pipe', 'pipe'],
-    });
+    try {
+        execFileSync(sqlite3, [dbPath], {
+            input: script,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+    }
+    catch (err) {
+        const { long } = formatNodeChildException(err);
+        hookRunLog(`sqlite_update: UPDATE/exec failed binary=${sqlite3} db=${dbPath} ${long}`);
+        complianceRunnerDiag(`sqlite_update: UPDATE/exec failed ${long.slice(0, 1800)}`);
+        throw err;
+    }
 }
 /** Runs a single UPDATE (or other SQL) and returns sqlite `changes()` for the last statement. */
 function sqliteRunUpdateReturningChanges(dbPath, updateSql) {
+    const sqlite3 = resolveSqlite3Binary();
+    if (!sqlite3)
+        throw new Error('sqlite3 not found');
     const script = `.timeout 60000\n${updateSql}\nSELECT changes();\n`;
-    const out = execFileSync('sqlite3', [dbPath], {
-        input: script,
-        encoding: 'utf8',
-        stdio: ['pipe', 'pipe', 'pipe'],
-    }).trim();
+    let out;
+    try {
+        out = execFileSync(sqlite3, [dbPath], {
+            input: script,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+    }
+    catch (err) {
+        const { long } = formatNodeChildException(err);
+        hookRunLog(`sqlite_update: batch UPDATE/changes failed binary=${sqlite3} db=${dbPath} ${long}`);
+        complianceRunnerDiag(`sqlite_update: batch UPDATE failed ${long.slice(0, 1800)}`);
+        throw err;
+    }
     const lines = out.split(/\r?\n/).filter((l) => l.length > 0);
     const last = lines[lines.length - 1] ?? '0';
     return parseInt(last, 10) || 0;
@@ -770,9 +826,12 @@ function assertSafeDeferredItemTableKey(targetKey) {
 }
 function queueDeferredSqliteOpsMerged(configPath, sqliteOps, postApplyUpload) {
     const dbPath = configPath.split('#')[0];
+    hookRunLog(`sqlite_update: deferred_queue begin configPath=${configPath} dbPath=${dbPath} dbExists=${existsSync(dbPath)} sqliteOps=${sqliteOps.length}`);
+    complianceRunnerDiag(`sqlite_update: deferred_queue begin dbExists=${existsSync(dbPath)} ops=${sqliteOps.length}`);
     if (!existsSync(dbPath)) {
         const line = `sqlite_update: database not found at ${dbPath}`;
         hookRunLog(line);
+        hookRunLog(`sqlite_update: parent dir exists=${existsSync(dirname(dbPath))} (if false, wrong Cursor profile path or never launched Cursor)`);
         complianceRunnerDiag(line);
         return {
             ok: false,
@@ -782,7 +841,7 @@ function queueDeferredSqliteOpsMerged(configPath, sqliteOps, postApplyUpload) {
     if (!assertSqlite3Available()) {
         return {
             ok: false,
-            reason: 'sqlite3 CLI not found in PATH (IDE hooks often inherit a minimal PATH; install Xcode CLT / sqlite3 or fix PATH).',
+            reason: 'sqlite3 CLI not found (IDE hooks often have a minimal PATH). On macOS try OPTIMUS_SQLITE3=/usr/bin/sqlite3 or install sqlite3 and fix PATH.',
         };
     }
     const resolvedOps = sqliteOps.map((op) => resolveCursorComposerSqliteOp(dbPath, op));
@@ -806,8 +865,10 @@ function queueDeferredSqliteOpsMerged(configPath, sqliteOps, postApplyUpload) {
             }
             complianceRunnerDiag(`sqlite_update: deferred merge db=${dbPath} target_key=${first.target_key} operations=${ops.length}`);
             let currentJson = {};
+            let rawSelectLength = 0;
             try {
                 const result = sqliteSelectValueCell(dbPath, first.table, first.key_column, first.value_column, first.target_key);
+                rawSelectLength = result.length;
                 if (result) {
                     const parsed = JSON.parse(result);
                     currentJson = coerceItemTableValueToObjectRoot(first.target_key, parsed);
@@ -828,12 +889,16 @@ function queueDeferredSqliteOpsMerged(configPath, sqliteOps, postApplyUpload) {
             repairComposerStateEmptySegmentBug(currentJson);
             const updatedJson = serializeItemTableValueForWrite(first.target_key, currentJson);
             if (updatedJson === '{}' && Object.keys(currentJson).length === 0) {
-                const line = `sqlite_update: deferred merge produced empty JSON — refusing to queue (would wipe ItemTable row)`;
+                const opSummary = ops
+                    .map((o) => `path=${o.json_path ?? ''} updates=${JSON.stringify(o.updates ?? {})}`)
+                    .join(' || ')
+                    .slice(0, 900);
+                const line = `sqlite_update: deferred merge produced empty JSON — refusing to queue (would wipe ItemTable row) target_key=${first.target_key} raw_cell_len=${rawSelectLength} ops=${opSummary}`;
                 hookRunLog(line);
-                complianceRunnerDiag(line);
+                complianceRunnerDiag(line.slice(0, 2000));
                 return {
                     ok: false,
-                    reason: 'merge produced empty JSON (no-op merge — often missing modes4/agent structure or outdated log-llm-config; publish latest package and retry).',
+                    reason: `merge produced empty JSON after ops (target_key=${first.target_key}, raw_cell_len=${rawSelectLength}). Check sqlite_update lines above for SELECT errors or bad sqlite_op merge.`,
                 };
             }
             queueDeferredVscdbItem({
@@ -974,7 +1039,12 @@ export function enforceRemediation(instruction) {
                     : undefined;
                 const q = queueDeferredSqliteOpsMerged(inst.config_file_path, ops, postApplyUpload);
                 if (!q.ok) {
-                    return fail(`deferred state.vscdb queue failed — ${q.reason} (see sqlite_update lines in ~/opt-ai-sec/management/hook_log.txt)`, { config_file_path: inst.config_file_path });
+                    const dbOnly = inst.config_file_path.split('#')[0];
+                    return fail(`deferred state.vscdb queue failed — ${q.reason} (see sqlite_update lines above in hook_log for SELECT/exec details)`, {
+                        config_file_path: inst.config_file_path,
+                        resolved_db_path: dbOnly,
+                        sqlite3_binary: resolveSqlite3Binary() ?? 'unresolved',
+                    });
                 }
                 return { ok: true, deferredSqlite: true };
             }
@@ -1052,7 +1122,7 @@ export function reportAutofixApplied(remediationUuid, result) {
         return Promise.resolve();
     }
     const endpointBase = loadEndpointBase();
-    const url = `${resolveOrigin(endpointBase)}/endpoint_security/api/autofix-applied/`;
+    const url = buildApiUrl(endpointBase, '/endpoint_security/api/autofix-applied/');
     const payload = { hardware_uuid: hardwareUuid, remediation_uuid: remediationUuid, result };
     const signature = createSignature(payload, authKey.key);
     const body = JSON.stringify({ ...payload, signature });

package/dist/log_config_files/runtime/sqlite_binary.js

@@ -0,0 +1,92 @@
+import { existsSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { join } from 'node:path';
+let cached;
+/**
+ * Resolve the sqlite3 CLI for remediations and vscdb reads.
+ *
+ * Cursor/IDE-launched hooks often inherit a minimal PATH (no Homebrew), while macOS still ships
+ * `/usr/bin/sqlite3`. Prefer explicit paths before `which` / bare `sqlite3`.
+ *
+ * Override: `OPTIMUS_SQLITE3`, `SQLITE3_PATH`, or `SQLITE3_BIN` = absolute path to the binary.
+ */
+export function resolveSqlite3Binary() {
+    if (cached !== undefined)
+        return cached;
+    for (const envName of ['OPTIMUS_SQLITE3', 'SQLITE3_PATH', 'SQLITE3_BIN']) {
+        const v = process.env[envName]?.trim();
+        if (v && existsSync(v)) {
+            cached = v;
+            return cached;
+        }
+    }
+    const candidates = [];
+    if (process.platform === 'darwin') {
+        candidates.push('/usr/bin/sqlite3', '/opt/homebrew/bin/sqlite3', '/usr/local/bin/sqlite3', '/opt/local/bin/sqlite3');
+    }
+    else if (process.platform === 'linux') {
+        candidates.push('/usr/bin/sqlite3', '/usr/local/bin/sqlite3');
+    }
+    else if (process.platform === 'win32') {
+        const pf = process.env.ProgramFiles;
+        if (pf) {
+            candidates.push(join(pf, 'Git', 'usr', 'bin', 'sqlite3.exe'));
+        }
+    }
+    for (const p of candidates) {
+        if (p && existsSync(p)) {
+            cached = p;
+            return cached;
+        }
+    }
+    try {
+        if (process.platform === 'win32') {
+            const out = execFileSync('where.exe', ['sqlite3'], {
+                encoding: 'utf8',
+                stdio: ['ignore', 'pipe', 'ignore'],
+            }).trim();
+            const first = out.split(/\r?\n/).find((line) => {
+                const t = line.trim();
+                return t.length > 0 && existsSync(t);
+            });
+            if (first) {
+                cached = first.trim();
+                return cached;
+            }
+        }
+        else {
+            for (const whichBin of ['which', '/usr/bin/which']) {
+                try {
+                    const out = execFileSync(whichBin, ['sqlite3'], {
+                        encoding: 'utf8',
+                        stdio: ['ignore', 'pipe', 'ignore'],
+                    }).trim();
+                    const first = out.split(/\n/)[0]?.trim();
+                    if (first && existsSync(first)) {
+                        cached = first;
+                        return cached;
+                    }
+                }
+                catch {
+                    /* try next */
+                }
+            }
+        }
+    }
+    catch {
+        /* fall through */
+    }
+    try {
+        execFileSync('sqlite3', ['--version'], { stdio: 'ignore' });
+        cached = 'sqlite3';
+        return cached;
+    }
+    catch {
+        cached = null;
+        return null;
+    }
+}
+/** Test-only: reset memoized path after env/path changes. */
+export function clearSqlite3BinaryCacheForTests() {
+    cached = undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config",
-  "version": "1.3.22",
+  "version": "1.3.24",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {