log-llm-config 1.3.6 → 1.3.8

package/dist/compliance_check_runner.js

@@ -2,9 +2,9 @@ import { appendFileSync, mkdirSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { OPT_AI_SEC_MANAGEMENT_REL } from './bootstrap_constants.js';
-import { hookLogSessionBanner } from './log_config_files/runtime/hook_logger.js';
+import { hookLogAppendSection } from './log_config_files/runtime/hook_logger.js';
 import { runComplianceCheck } from './log_config_files/runtime/compliance_check.js';
-/** Append-only log for compliance runner lifecycle; hook_log.txt is also append-only (session banners). */
+/** Append-only log for compliance runner lifecycle; hook_log.txt uses a fresh session from the gate then this section. */
 function runnerFileLog(message) {
     try {
         const dir = join(homedir(), OPT_AI_SEC_MANAGEMENT_REL);
@@ -18,7 +18,7 @@ function runnerFileLog(message) {
     }
 }
 (async () => {
-    hookLogSessionBanner('compliance_check_runner (background sync + check)');
+    hookLogAppendSection('compliance_check_runner (background sync + check)');
     runnerFileLog('compliance_check_runner: start');
     try {
         await runComplianceCheck();

package/dist/compliance_prompt_gate.js

@@ -10,7 +10,7 @@ import { existsSync, statSync } from 'node:fs';
 import { pathToFileURL } from 'node:url';
 import { resolve } from 'node:path';
 import { getRemediationInstructionsPath } from './log_config_files/runtime/management_storage.js';
-import { hookLogSessionBanner } from './log_config_files/runtime/hook_logger.js';
+import { hookLogSessionBanner, hookRunLog } from './log_config_files/runtime/hook_logger.js';
 const MANIFEST_STALE_MS = 7 * 24 * 60 * 60 * 1000;
 function parseIde() {
     const eq = process.argv.find((a) => a.startsWith('--ide='));
@@ -111,7 +111,18 @@ export async function runCompliancePromptGate() {
             }
             const recheck = runLocalRemediationComplianceCheck();
             const recheckOk = recheck.status === 'ok' || recheck.violations.length === 0;
-            if (deferredSqlitePending || recheckOk) {
+            // Cursor: tolerate a failing recheck only when SQLite updates are deferred (apply after restart).
+            // Claude Code: JSON remediations are written immediately; merge/verify timing can still leave the
+            // in-process recheck red for the same UUID — allow in that case only for --ide=claude.
+            const appliedUuids = new Set(appliedViolations.map((v) => v.uuid));
+            const claudeRecheckStaleAfterImmediateApply = ide === 'claude' &&
+                !recheckOk &&
+                recheck.violations.length > 0 &&
+                recheck.violations.every((v) => appliedUuids.has(v.uuid));
+            if (claudeRecheckStaleAfterImmediateApply) {
+                hookRunLog('compliance_prompt_gate: Claude — autofix wrote JSON; recheck still flags same UUID(s) — proceeding (immediate apply)');
+            }
+            if (deferredSqlitePending || recheckOk || claudeRecheckStaleAfterImmediateApply) {
                 const autofixMessage = `Optimus Security auto-fixed ${fixed} policy violation(s):\n${appliedViolations.map((v) => autofixDialogLine(v)).join('\n')}`;
                 const payload = { __optimus_autofix: true, autofix_message: autofixMessage };
                 if (restartCommands.length > 0)

package/dist/log_config_files/readers/vscdb_reader.js

@@ -1,6 +1,15 @@
 import { existsSync } from 'node:fs';
 import { execSync } from 'node:child_process';
 import { readFileCollectionVscdbContract, writeFileCollectionVscdbContract, } from '../runtime/management_storage.js';
+/**
+ * ItemTable keys that store a bare JSON boolean; compliance paths use `${key}.${field}`.
+ * Kept in sync with `coerceItemTableValueToObjectRoot` / `serializeItemTableValueForWrite` in remediation_sync.
+ */
+export const CURSOR_SCALAR_ITEMTABLE_FIELDS = {
+    'cursor/thirdPartyExtensibilityEnabled': 'thirdPartyExtensibilityEnabled',
+    'cursorai/donotchange/privacyMode': 'privacyMode',
+    'cursor/autoOpenLocalhostUrls': 'autoOpenLocalhostUrls',
+};
 function querySqlite(dbPath, key) {
     const safe = key.replace(/'/g, "''");
     return execSync(`sqlite3 "${dbPath}" "SELECT value FROM ItemTable WHERE key='${safe}'"`, {
@@ -90,12 +99,13 @@ export function readVscdbItemTableJson(dbPath, itemKey) {
         if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {
             return { [itemKey]: parsed };
         }
-        // Bare JSON primitives (e.g. cursor/thirdPartyExtensibilityEnabled stores `true`/`false`).
+        // Bare JSON primitives. Scalar toggles must be wrapped so getByPath(key.field) works in compliance checks.
         if (typeof parsed === 'boolean' || typeof parsed === 'number' || typeof parsed === 'string') {
-            const leaf = itemKey.split('/').pop() ?? '';
-            // Legacy cursorai/donotchange/privacyMode row is bare true/false; compliance paths use …/privacyMode.privacyMode.
-            if (typeof parsed === 'boolean' && leaf === 'privacyMode') {
-                return { [itemKey]: { privacyMode: parsed } };
+            if (typeof parsed === 'boolean') {
+                const field = CURSOR_SCALAR_ITEMTABLE_FIELDS[itemKey];
+                if (field) {
+                    return { [itemKey]: { [field]: parsed } };
+                }
             }
             return { [itemKey]: parsed };
         }

package/dist/log_config_files/runtime/compliance_check.js

@@ -5,8 +5,10 @@
  * ComplianceStatus; the prompt gate and tests use that return value. Autofix may write config files
  * and remediation_instructions.json via applyAutofixViolations / enforceRemediation.
  *
- * Prompt gate: compliance_prompt_gate runs runLocalRemediationComplianceCheck (local files only).
+ * Prompt gate: compliance_prompt_gate runs runLocalRemediationComplianceCheck then applyAutofixViolations.
  * Background: compliance_check_runner runs syncRemediations (network) then the same local check.
+ * Apply (autofix) is intentionally left to the gate on the next prompt — the background pass only
+ * downloads the latest manifest so the gate has fresh data to act on.
  */
 import { existsSync, readFileSync } from 'node:fs';
 import { readVscdbItemTableJson } from '../readers/vscdb_reader.js';
@@ -433,7 +435,8 @@ export function pruneSatisfiedOneTimeRemediations() {
 }
 /**
  * Background refresh: server sync for latest instructions, then the same local evaluation as the hook.
- * Does not persist compliance state to disk.
+ * Apply (autofix) is intentionally deferred to the gate on the next prompt — this pass only downloads
+ * a fresh manifest so the gate has up-to-date data when it runs.
  */
 export async function runComplianceCheck() {
     try {
@@ -442,5 +445,11 @@ export async function runComplianceCheck() {
     catch (err) {
         hookRunLog(`compliance_check: remediation_sync unexpected error: ${err instanceof Error ? err.message : String(err)}`);
     }
-    runLocalRemediationComplianceCheck();
+    const status = runLocalRemediationComplianceCheck();
+    if (status.status === 'ok' || status.violations.length === 0) {
+        const pruned = pruneSatisfiedOneTimeRemediations();
+        if (pruned.removed > 0) {
+            await Promise.allSettled(pruned.reportPromises);
+        }
+    }
 }

package/dist/log_config_files/runtime/hook_logger.js

@@ -1,8 +1,10 @@
-import { existsSync, mkdirSync, appendFileSync } from 'node:fs';
+import { existsSync, mkdirSync, appendFileSync, writeFileSync, statSync } from 'node:fs';
 import path from 'node:path';
 import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
 const HOOK_LOG_FILENAME = 'hook_log.txt';
 const COMPLIANCE_RUNNER_LOG_FILENAME = 'compliance_runner.log';
+/** Hard cap so a single upload/sync session cannot grow hook_log.txt without bound. */
+const MAX_HOOK_LOG_BYTES = 2 * 1024 * 1024;
 function getHookLogPath() {
     const homeDir = process.env.HOME || process.env.USERPROFILE;
     if (!homeDir)
@@ -33,7 +35,24 @@ function complianceRunnerDiag(message) {
         // best-effort
     }
 }
-/** Visible delimiter between hook_log.txt sessions (compliance gate, upload, etc.). */
+function ensureHookLogUnderCap() {
+    const logPath = getHookLogPath();
+    if (!logPath || !existsSync(logPath))
+        return;
+    try {
+        if (statSync(logPath).size <= MAX_HOOK_LOG_BYTES)
+            return;
+        const ts = new Date().toISOString();
+        writeFileSync(logPath, `${'='.repeat(72)}\n${ts} hook_log.txt truncated (exceeded ${MAX_HOOK_LOG_BYTES} bytes)\n${'='.repeat(72)}\n`, 'utf8');
+    }
+    catch {
+        // best-effort
+    }
+}
+/**
+ * Start a new hook_log.txt session (replaces the file). Use once per logical run
+ * (e.g. compliance_prompt_gate, log_config_files upload via hookLogReplace).
+ */
 function hookLogSessionBanner(label) {
     const logPath = getHookLogPath();
     if (!logPath)
@@ -44,15 +63,34 @@ function hookLogSessionBanner(label) {
             mkdirSync(dir, { recursive: true, mode: 0o700 });
         const ts = new Date().toISOString();
         const banner = `\n${'='.repeat(72)}\n${ts} session: ${label}\n${'='.repeat(72)}\n`;
-        appendFileSync(logPath, banner, 'utf8');
+        writeFileSync(logPath, banner, 'utf8');
     }
     catch {
         // best-effort
     }
 }
 /**
- * @deprecated Name kept for callers: begins a log_config_files upload section (append-only, does not truncate).
+ * Append a subsection after an existing session (e.g. compliance_check_runner after the gate)
+ * without replacing hook_log.txt.
  */
+function hookLogAppendSection(label) {
+    const logPath = getHookLogPath();
+    if (!logPath)
+        return;
+    try {
+        ensureHookLogUnderCap();
+        const dir = path.dirname(logPath);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const ts = new Date().toISOString();
+        const banner = `\n${'-'.repeat(72)}\n${ts} section: ${label}\n${'-'.repeat(72)}\n`;
+        appendFileSync(logPath, banner, 'utf8');
+    }
+    catch {
+        // best-effort
+    }
+}
+/** Begins a log_config_files upload session (replaces hook_log.txt, same as hookLogSessionBanner). */
 function hookLogReplace() {
     hookLogSessionBanner('log_config_files (config upload)');
 }
@@ -62,6 +100,7 @@ function hookRunLog(message) {
     if (!logPath)
         return;
     try {
+        ensureHookLogUnderCap();
         const ts = new Date().toISOString();
         appendFileSync(logPath, `${ts} ${message}\n`, 'utf8');
     }
@@ -75,10 +114,11 @@ function hookLogLine(message) {
     if (!logPath)
         return;
     try {
+        ensureHookLogUnderCap();
         appendFileSync(logPath, `${message}\n`, 'utf8');
     }
     catch {
         // best-effort
     }
 }
-export { getHookLogPath, getComplianceRunnerLogPath, hookLogReplace, hookLogSessionBanner, hookRunLog, hookLogLine, complianceRunnerDiag, };
+export { getHookLogPath, getComplianceRunnerLogPath, hookLogReplace, hookLogSessionBanner, hookLogAppendSection, hookRunLog, hookLogLine, complianceRunnerDiag, };

package/dist/log_config_files/runtime/remediation_sync.js

@@ -8,7 +8,7 @@ import { readStoredAuthKey } from '../auth/auth_key_store.js';
 import { createSignature } from '../sender/signing.js';
 import { loadEndpointBase } from '../sender/endpoint_config.js';
 import { tryResolveHardwareUuid } from './hardware_uuid.js';
-import { persistVscdbComposerContractFromPatternsResponse, readVscdbItemTableJson, } from '../readers/vscdb_reader.js';
+import { CURSOR_SCALAR_ITEMTABLE_FIELDS, persistVscdbComposerContractFromPatternsResponse, readVscdbItemTableJson, } from '../readers/vscdb_reader.js';
 import { sendConfigFile } from '../sender/batch_sender.js';
 import { getFileCollectionPatterns } from '../../endpoint_client/registry_api.js';
 function reactiveStorageItemKeyFromContract() {
@@ -410,12 +410,6 @@ function resolveCursorComposerSqliteOp(dbPath, sqliteOp) {
     return sqliteOp;
 }
 /** Apply sqlite merge: dot-path, or array match where `json_path` is `…container.arrayKey` (e.g. `modes4` or `composerState.modes4`). */
-/** ItemTable keys that store a JSON primitive; map to one field for merge + serialize. */
-const CURSOR_SCALAR_ITEMTABLE_FIELDS = {
-    'cursor/thirdPartyExtensibilityEnabled': 'thirdPartyExtensibilityEnabled',
-    'cursorai/donotchange/privacyMode': 'privacyMode',
-    'cursor/autoOpenLocalhostUrls': 'autoOpenLocalhostUrls',
-};
 function coerceScalarForItemTableField(parsed) {
     if (typeof parsed === 'boolean')
         return parsed;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config",
-  "version": "1.3.6",
+  "version": "1.3.8",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {