log-llm-config 1.3.61 → 1.3.63

package/dist/compliance_prompt_gate.js

@@ -7,10 +7,13 @@
  * the same JSON line to execute_trusted_restarts (TS allowlist + spawn).
  */
 import { applyAutofixViolations, normalizeAgentToken, pruneSatisfiedOneTimeRemediations, runLocalRemediationComplianceCheck, } from './log_config_files/runtime/compliance_check.js';
-import { existsSync, statSync } from 'node:fs';
+import { existsSync, readFileSync, statSync } from 'node:fs';
 import { getRemediationInstructionsPath } from './log_config_files/runtime/management_storage.js';
 import { hookLogSessionBanner, hookRunLog, logRemediationApplyFailure } from './log_config_files/runtime/hook_logger.js';
 import { isThisCliModule } from './cli_invocation_match.js';
+import { ensureAuthentication } from './log_config_files/auth/auth_flow.js';
+import { sendConfigFile } from './log_config_files/sender/batch_sender.js';
+import { tryResolveHardwareUuid } from './log_config_files/runtime/hardware_uuid.js';
 const MANIFEST_STALE_MS = 7 * 24 * 60 * 60 * 1000;
 function parseIde() {
     const eq = process.argv.find((a) => a.startsWith('--ide='));
@@ -87,6 +90,38 @@ function autofixDialogLine(v) {
     const short = d.length > 160 ? `${d.slice(0, 157)}…` : d;
     return `• [${v.finding_formatted_id}] ${short}`;
 }
+/**
+ * Upload a secondary compliance file to the backend so the server can resolve the finding.
+ * Fire-and-forget: upload runs in background; any failure is logged but does not block the gate.
+ */
+async function _uploadSecondaryFile(entry) {
+    const { uuid, config_file_path, file_type } = entry;
+    if (!file_type) {
+        hookRunLog(`secondary_upload: skipping uuid=${uuid} — no file_type on secondary group`);
+        return;
+    }
+    let rawContent;
+    try {
+        rawContent = JSON.parse(readFileSync(config_file_path, 'utf8'));
+    }
+    catch {
+        hookRunLog(`secondary_upload: could not read file uuid=${uuid} path=${config_file_path}`);
+        return;
+    }
+    const hw = tryResolveHardwareUuid();
+    if (!hw) {
+        hookRunLog(`secondary_upload: hardware UUID unavailable, skipping uuid=${uuid}`);
+        return;
+    }
+    try {
+        const authKey = await ensureAuthentication(hw);
+        const sent = await sendConfigFile({ file_type, file_path: config_file_path, raw_content: rawContent }, hw, authKey);
+        hookRunLog(`secondary_upload: uuid=${uuid} path=${config_file_path} sent=${sent}`);
+    }
+    catch (err) {
+        hookRunLog(`secondary_upload: upload failed uuid=${uuid} path=${config_file_path} err=${err instanceof Error ? err.message : String(err)}`);
+    }
+}
 /**
  * Entry when the default npm bin (`log-llm-config` / cli.js) dispatches
  * `compliance_prompt_gate` — npx does not execute compliance_prompt_gate.js as argv[1], so
@@ -101,6 +136,11 @@ export async function runCompliancePromptGate() {
     const agent = parseAgent(ide);
     hookLogSessionBanner('compliance_prompt_gate (before submit)');
     const status = runLocalRemediationComplianceCheck(agent);
+    // Secondary-satisfied: primary checks failed but settings.json (or equiv) has the fix.
+    // Upload those files fire-and-forget so the backend can resolve the finding immediately.
+    for (const e of status.secondarySatisfied ?? []) {
+        _uploadSecondaryFile(e).catch(() => undefined);
+    }
     if (status.status === 'fail' && status.violations.length > 0) {
         const staleMs = getManifestStalenessMs();
         if (staleMs !== null && staleMs > MANIFEST_STALE_MS) {

package/dist/log_config_files/collection/mcp_tool_collector.js

@@ -4,10 +4,72 @@ import { homedir } from 'node:os';
 import { readJSONFile } from '../readers/file_readers.js';
 import { normalizePathSkipPrefixes } from '../paths/pattern_resolver.js';
 import { getCursorProjectsPath } from '../paths/path_constants_helpers.js';
+import { readVscdbItemTableJson } from '../readers/vscdb_reader.js';
+/**
+ * Read workspaceMetadata.entries from the Cursor global state.vscdb and emit one
+ * cursor_workspace_vscdb ConfigFileData per workspace entry.
+ *
+ * Cursor maintains a canonical mapping of workspace hash → display path in the global
+ * state.vscdb under "workspaceMetadata.entries". Each entry has:
+ *   { workspaceId: "<hash>", displayPath: "~/my-project", folderUri: "file:///Users/..." }
+ *
+ * The per-workspace workspaceStorage/<hash>/state.vscdb holds cursor/disabledMcpServers.
+ * Together they give us: which servers are disabled per workspace + a human-readable label.
+ */
+function collectWorkspaceVscdbs(spec, home = homedir()) {
+    if (!spec.global_vscdb_path_segments?.length || !spec.global_workspace_list_key) {
+        return [];
+    }
+    const globalDbPath = join(home, ...spec.global_vscdb_path_segments);
+    if (!existsSync(globalDbPath))
+        return [];
+    const globalResult = readVscdbItemTableJson(globalDbPath, spec.global_workspace_list_key);
+    if (!globalResult)
+        return [];
+    const rawValue = globalResult[spec.global_workspace_list_key];
+    // The stored value is {"entries": [...]}; unwrap it.
+    const entries = Array.isArray(rawValue)
+        ? rawValue
+        : Array.isArray(rawValue?.entries)
+            ? rawValue.entries
+            : [];
+    if (!entries.length)
+        return [];
+    const workspaceStoragePath = join(home, ...spec.workspace_storage_path_segments);
+    const output = [];
+    for (const entry of entries) {
+        if (!entry || typeof entry !== 'object')
+            continue;
+        const e = entry;
+        const workspaceId = typeof e.workspaceId === 'string' ? e.workspaceId : null;
+        if (!workspaceId)
+            continue;
+        const dbPath = join(workspaceStoragePath, workspaceId, spec.vscdb_filename);
+        if (!existsSync(dbPath))
+            continue;
+        const perWorkspaceResult = readVscdbItemTableJson(dbPath, spec.item_table_key);
+        const disabled = perWorkspaceResult?.[spec.item_table_key];
+        const rawContent = {
+            [spec.item_table_key]: Array.isArray(disabled) ? disabled : [],
+        };
+        if (typeof e.displayPath === 'string')
+            rawContent['displayPath'] = e.displayPath;
+        if (typeof e.folderUri === 'string')
+            rawContent['folderUri'] = e.folderUri;
+        rawContent['workspaceId'] = workspaceId;
+        output.push({
+            file_type: spec.file_type,
+            file_path: `${dbPath}#${spec.item_table_key}`,
+            raw_content: rawContent,
+        });
+    }
+    return output;
+}
 function collectMcpToolFiles(pathSkipPrefixes = [], constants) {
     const result = [];
     const skipPrefixes = normalizePathSkipPrefixes(pathSkipPrefixes);
-    const cursorProjectsPath = getCursorProjectsPath(homedir(), constants);
+    const home = homedir();
+    const cursorProjectsPath = getCursorProjectsPath(home, constants);
     try {
         if (!existsSync(cursorProjectsPath))
             return result;
@@ -34,4 +96,4 @@ function collectMcpToolFiles(pathSkipPrefixes = [], constants) {
     }
     return result;
 }
-export { collectMcpToolFiles };
+export { collectMcpToolFiles, collectWorkspaceVscdbs };

package/dist/log_config_files/readers/vscdb_reader.js

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
-import { readFileCollectionVscdbContract, writeFileCollectionVscdbContract, } from '../runtime/management_storage.js';
+import { readFileCollectionVscdbContract, sanitizeFileCollectionVscdbContract, sanitizeReactiveStorageItemKey, writeFileCollectionVscdbContract, } from '../runtime/management_storage.js';
 /**
  * ItemTable keys that store a bare JSON boolean; compliance paths use `${key}.${field}`.
  * Kept in sync with `coerceItemTableValueToObjectRoot` / `serializeItemTableValueForWrite` in remediation_sync.
@@ -52,11 +52,11 @@ export function normalizeVscdbComposerContractFromPatternsResponse(resp) {
         ((typeof c.reactive_storage_item_key === 'string' && c.reactive_storage_item_key.trim() !== '') ||
             (c.composer_shadow_keys?.length ?? 0) > 0);
     if (hasKey && c) {
-        return {
+        return sanitizeFileCollectionVscdbContract({
             version: 1,
             reactive_storage_item_key: c.reactive_storage_item_key ?? undefined,
             composer_shadow_keys: [...(c.composer_shadow_keys ?? [])],
-        };
+        }) ?? { version: 1, reactive_storage_item_key: undefined, composer_shadow_keys: [] };
     }
     return parseVscdbComposerContractFromReadQueries(resp.vscdb_read_queries);
 }
@@ -88,7 +88,7 @@ export function readVscdbItemTableJson(dbPath, itemKey) {
     try {
         const raw = querySqlite(dbPath, itemKey);
         const contract = readFileCollectionVscdbContract();
-        const reactiveKey = typeof contract?.reactive_storage_item_key === 'string' ? contract.reactive_storage_item_key.trim() : '';
+        const reactiveKey = sanitizeReactiveStorageItemKey(contract?.reactive_storage_item_key) ?? '';
         if (itemKey === 'composerState' && (!raw || raw === '{}') && reactiveKey) {
             const reactive = querySqlite(dbPath, reactiveKey);
             if (reactive) {
@@ -106,6 +106,11 @@ export function readVscdbItemTableJson(dbPath, itemKey) {
         if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {
             return { [itemKey]: parsed };
         }
+        // Bare JSON arrays (e.g. cursor/disabledMcpServers) — wrap under itemKey so ops-based
+        // compliance checks can locate the array via getByPath(itemKey).
+        if (Array.isArray(parsed)) {
+            return { [itemKey]: parsed };
+        }
         // Bare JSON primitives. Scalar toggles must be wrapped so getByPath(key.field) works in compliance checks.
         // Match coerceScalarForItemTableField in remediation_sync: Cursor may store toggles as JSON 0/1, not only booleans.
         if (typeof parsed === 'boolean' || typeof parsed === 'number' || typeof parsed === 'string') {

package/dist/log_config_files/runtime/compliance_check.js

@@ -11,13 +11,15 @@
  * downloads the latest manifest so the gate has fresh data to act on.
  */
 import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
 import { readVscdbItemTableJson } from '../readers/vscdb_reader.js';
 import { readRemediationInstructionsFile, writeRemediationInstructionsFile } from './management_storage.js';
 import { resolveRemediationConfigPath } from './remediation_config_path.js';
 import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
 import { loadEndpointBase } from '../sender/endpoint_config.js';
 import { resolveHardwareUuid, tryResolveHardwareUuid } from './hardware_uuid.js';
-import { buildDeferredCursorRestartCommand, enforceRemediation, fetchSync, isTrustedRestartCommandForAutofix, remediationFixSpec, reportAutofixApplied, syncRemediations, } from './remediation_sync.js';
+import { buildDeferredCursorRestartCommand, discoverAllWorkspaceVscdbs, enforceRemediation, fetchSync, isTrustedRestartCommandForAutofix, remediationFixSpec, reportAutofixApplied, syncRemediations, } from './remediation_sync.js';
 import { sendConfigFile } from '../sender/batch_sender.js';
 import { ensureAuthentication } from '../auth/auth_flow.js';
 /** Normalize manifest/env/CLI agent tokens to a known Agent, or '' if unrecognized. */
@@ -101,9 +103,34 @@ export function getByPath(obj, path) {
     }
     return current;
 }
-/** Deep-equal comparison via JSON serialisation (handles booleans, strings, numbers, null). */
+/** Key-order-independent deep-equal comparison (handles primitives, arrays, plain objects). */
 function deepEqual(a, b) {
-    return JSON.stringify(a) === JSON.stringify(b);
+    if (a === b)
+        return true;
+    if (a === null || b === null || typeof a !== 'object' || typeof b !== 'object')
+        return false;
+    if (Array.isArray(a) || Array.isArray(b)) {
+        if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length)
+            return false;
+        for (let i = 0; i < a.length; i++) {
+            if (!deepEqual(a[i], b[i]))
+                return false;
+        }
+        return true;
+    }
+    const ao = a;
+    const bo = b;
+    const aKeys = Object.keys(ao);
+    const bKeys = Object.keys(bo);
+    if (aKeys.length !== bKeys.length)
+        return false;
+    for (const k of aKeys) {
+        if (!Object.prototype.hasOwnProperty.call(bo, k))
+            return false;
+        if (!deepEqual(ao[k], bo[k]))
+            return false;
+    }
+    return true;
 }
 function isStringArray(v) {
     return Array.isArray(v) && v.every((x) => typeof x === 'string');
@@ -131,16 +158,16 @@ function verifyOpsApplied(configJson, settingPath, ops) {
             continue;
         }
         const cur = getByPath(configJson, targetPath);
-        const curArr = isStringArray(cur) ? cur : [];
+        const curArr = Array.isArray(cur) ? cur : [];
         const toAdd = add[k] ?? [];
         const toRemove = remove[k] ?? [];
         for (const item of toRemove) {
-            if (curArr.includes(item)) {
+            if (curArr.some((curItem) => deepEqual(curItem, item))) {
                 return { ok: false, expected: { op: 'remove', path: targetPath, value: item } };
             }
         }
         for (const item of toAdd) {
-            if (!curArr.includes(item)) {
+            if (!curArr.some((curItem) => deepEqual(curItem, item))) {
                 return { ok: false, expected: { op: 'add', path: targetPath, value: item } };
             }
         }
@@ -177,6 +204,25 @@ function loadRemediationConfigJson(configFilePath, checkSettingPaths = []) {
         return { ok: false, reason: 'parse_error' };
     }
 }
+/**
+ * Evaluate all checks in a secondary group against the group's config file.
+ * Returns true only if every check passes (ops-based). Non-ops checks are treated as failing.
+ */
+function evaluateSecondaryGroup(group) {
+    const loaded = loadRemediationConfigJson(group.config_file_path, group.checks.map((c) => c.setting_path));
+    if (!loaded.ok) {
+        hookRunLog(`evaluateSecondaryGroup: could not load secondary file path=${group.config_file_path} reason=${loaded.reason}`);
+        return false;
+    }
+    for (const check of group.checks) {
+        if (!check.ops)
+            return false;
+        const { ok } = verifyOpsApplied(loaded.json, check.setting_path, check.ops);
+        if (!ok)
+            return false;
+    }
+    return true;
+}
 // ---------------------------------------------------------------------------
 // Check runner — Section 6: real per-check evaluation
 // ---------------------------------------------------------------------------
@@ -194,6 +240,7 @@ export function runLocalRemediationComplianceCheck(agent = 'cursor') {
         }
         const uuids = entries.map((e) => e.uuid);
         const violations = [];
+        const secondarySatisfied = [];
         let skippedNoCompliance = 0;
         let skippedNonJson = 0;
         let skippedNoChecks = 0;
@@ -237,13 +284,63 @@ export function runLocalRemediationComplianceCheck(agent = 'cursor') {
                 continue;
             }
             const configJson = loaded.json;
+            const entryViolations = [];
             for (const check of checks) {
+                // When the check carries a sqlite_op with apply_to_all_workspaces, the authoritative data
+                // lives in workspace state.vscdb files — not in config_file_path (which may be mcp.json in
+                // the fallback case where no workspace vscdb has been collected yet). Verify directly against
+                // every discovered workspace vscdb; fail as a violation if any is missing the required entry.
+                if (check.sqlite_op?.apply_to_all_workspaces && check.ops) {
+                    const segments = check.sqlite_op.workspace_storage_path_segments ?? [
+                        'Library', 'Application Support', 'Cursor', 'User', 'workspaceStorage',
+                    ];
+                    const wsPath = join(homedir(), ...segments);
+                    const vscdbPaths = discoverAllWorkspaceVscdbs(wsPath);
+                    if (vscdbPaths.length === 0) {
+                        hookRunLog(`compliance_check: apply_to_all_workspaces — no workspace vscdbs found at ${wsPath}, skipping uuid=${entry.uuid}`);
+                    }
+                    else {
+                        let violated = false;
+                        let expectedForViolation = null;
+                        for (const dbPath of vscdbPaths) {
+                            const wrapped = readVscdbItemTableJson(dbPath, check.sqlite_op.target_key ?? '');
+                            if (wrapped === null) {
+                                violated = true;
+                                expectedForViolation = { op: 'read_failed', db: dbPath };
+                                break;
+                            }
+                            const { ok, expected } = verifyOpsApplied(wrapped, check.setting_path, check.ops);
+                            if (!ok) {
+                                violated = true;
+                                expectedForViolation = expected;
+                                break;
+                            }
+                        }
+                        if (violated) {
+                            hookRunLog(`compliance_check: VIOLATION (vscdb) uuid=${entry.uuid} path=${check.setting_path} expected=${JSON.stringify(expectedForViolation)}`);
+                            entryViolations.push({
+                                uuid: entry.uuid,
+                                finding_formatted_id: compliance.finding_formatted_id,
+                                setting_path: check.setting_path,
+                                description: check.description,
+                                finding_title: entry.finding_title,
+                                finding_description: entry.finding_description,
+                                severity: compliance.severity,
+                                autofix_allowed: compliance.autofix_allowed,
+                                config_file_path: entry.config_file_path,
+                                expected_value: expectedForViolation,
+                                message: `[${compliance.finding_formatted_id}] ${entry.finding_title ?? compliance.description}\nDescription: ${entry.finding_description ?? compliance.description}\nHow to fix: Apply remediation ops for ${check.setting_path} in workspace state.vscdb files`,
+                            });
+                        }
+                    }
+                    continue;
+                }
                 // Prefer ops-based verification (matches delta apply semantics; doesn't require full after snapshot).
                 if (check.ops) {
                     const { ok, expected } = verifyOpsApplied(configJson, check.setting_path, check.ops);
                     if (!ok) {
                         hookRunLog(`compliance_check: VIOLATION uuid=${entry.uuid} path=${check.setting_path} expected=${JSON.stringify(expected)}`);
-                        violations.push({
+                        entryViolations.push({
                             uuid: entry.uuid,
                             finding_formatted_id: compliance.finding_formatted_id,
                             setting_path: check.setting_path,
@@ -267,7 +364,7 @@ export function runLocalRemediationComplianceCheck(agent = 'cursor') {
                     continue;
                 if (!deepEqual(currentValue, expectedValue)) {
                     hookRunLog(`compliance_check: VIOLATION uuid=${entry.uuid} path=${check.setting_path} current=${JSON.stringify(currentValue)} expected=${JSON.stringify(expectedValue)}`);
-                    violations.push({
+                    entryViolations.push({
                         uuid: entry.uuid,
                         finding_formatted_id: compliance.finding_formatted_id,
                         setting_path: check.setting_path,
@@ -282,12 +379,30 @@ export function runLocalRemediationComplianceCheck(agent = 'cursor') {
                     });
                 }
             }
+            if (entryViolations.length > 0) {
+                const secondaryGroups = compliance.secondary_checks ?? [];
+                const passingGroup = secondaryGroups.length > 0
+                    ? secondaryGroups.find((g) => evaluateSecondaryGroup(g))
+                    : undefined;
+                if (passingGroup) {
+                    hookRunLog(`compliance_check: secondary check satisfied uuid=${entry.uuid} — skipping ${entryViolations.length} primary violation(s)`);
+                    secondarySatisfied.push({
+                        uuid: entry.uuid,
+                        config_file_path: passingGroup.config_file_path,
+                        file_type: passingGroup.file_type,
+                    });
+                }
+                else {
+                    violations.push(...entryViolations);
+                }
+            }
         }
         const status = {
             status: violations.length > 0 ? 'fail' : 'ok',
             checked_at: new Date().toISOString(),
             manifest_uuids: uuids,
             violations,
+            secondarySatisfied: secondarySatisfied.length > 0 ? secondarySatisfied : undefined,
         };
         const skipParts = [];
         if (skippedNoCompliance)
@@ -527,12 +642,41 @@ export function pruneSatisfiedOneTimeRemediations(agent = 'cursor') {
                 okAll = false;
                 break;
             }
+            // apply_to_all_workspaces: verify against workspace vscdbs, not the loaded config file.
+            if (check.sqlite_op?.apply_to_all_workspaces) {
+                const segments = check.sqlite_op.workspace_storage_path_segments ?? [
+                    'Library', 'Application Support', 'Cursor', 'User', 'workspaceStorage',
+                ];
+                const wsPath = join(homedir(), ...segments);
+                const vscdbPaths = discoverAllWorkspaceVscdbs(wsPath);
+                if (vscdbPaths.length === 0) {
+                    okAll = false;
+                    break;
+                }
+                for (const dbPath of vscdbPaths) {
+                    const wrapped = readVscdbItemTableJson(dbPath, check.sqlite_op.target_key ?? '');
+                    if (wrapped === null || !verifyOpsApplied(wrapped, check.setting_path, check.ops).ok) {
+                        okAll = false;
+                        break;
+                    }
+                }
+                if (!okAll)
+                    break;
+                continue;
+            }
             const res = verifyOpsApplied(configJson, check.setting_path, check.ops);
             if (!res.ok) {
                 okAll = false;
                 break;
             }
         }
+        if (!okAll) {
+            const secondaryGroups = spec?.secondary_checks ?? [];
+            if (secondaryGroups.length > 0 && secondaryGroups.some((g) => evaluateSecondaryGroup(g))) {
+                okAll = true;
+                hookRunLog(`remediation_prune: secondary check satisfied uuid=${inst.uuid}`);
+            }
+        }
         if (okAll) {
             removed++;
             hookRunLog(`remediation_prune: satisfied one-time uuid=${inst.uuid} path=${inst.config_file_path}`);

package/dist/log_config_files/runtime/main_runner.js

@@ -12,6 +12,7 @@ import { readJSONFile, readMarkdownFile } from '../readers/file_readers.js';
 import { isVscdbVirtualPath, tryReadVscdbVirtualFile, summarizeComposerPayloadForDiagnostics, } from '../readers/vscdb_config_builder.js';
 import { persistVscdbComposerContractFromPatternsResponse } from '../readers/vscdb_reader.js';
 import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, determineFileTypeFromPath } from '../collection/config_collector.js';
+import { collectWorkspaceVscdbs } from '../collection/mcp_tool_collector.js';
 import { normalizePathSkipPrefixes } from '../paths/pattern_resolver.js';
 import { sendConfigFile, sendConfigFilesBatch, sendHookRequestCreate, sendHookRequestUpdateManifest, sendIngestSessionStart, sendIngestSessionFinish, BATCH_CHUNK_SIZE } from '../sender/batch_sender.js';
 import { canonicalCursorUserStateVscdbPath } from './remediation_config_path.js';
@@ -51,6 +52,16 @@ async function collectAllConfigFiles(endpointBase) {
             configFiles.push(m);
         }
     }
+    if (patternsResponse.workspace_vscdb_spec) {
+        hookRunLog(`scanning Cursor workspace vscdb files`);
+        for (const m of collectWorkspaceVscdbs(patternsResponse.workspace_vscdb_spec)) {
+            const key = `${m.file_type}\t${m.file_path}`;
+            if (!existingPaths.has(key)) {
+                existingPaths.add(key);
+                configFiles.push(m);
+            }
+        }
+    }
     hookRunLog(`scanning installed plugins`);
     if (!patternsResponse.client_path_constants)
         throw new Error('client_path_constants required from API response');

package/dist/log_config_files/runtime/management_storage.js

@@ -17,6 +17,33 @@ export const DEFERRED_VSCDB_RESTART_LOG_BASENAME = 'deferred_vscdb_restart.log';
  * of hardcoded Cursor paths.
  */
 export const FILE_COLLECTION_VSCDB_CONTRACT_BASENAME = 'file_collection_vscdb_contract.json';
+export function sanitizeReactiveStorageItemKey(raw) {
+    if (typeof raw !== 'string')
+        return undefined;
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.length > 512)
+        return undefined;
+    if (/['"\\]/.test(trimmed))
+        return undefined;
+    return trimmed;
+}
+function sanitizeComposerShadowKeys(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    return raw
+        .filter((entry) => typeof entry === 'string')
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+}
+export function sanitizeFileCollectionVscdbContract(contract) {
+    if (!contract || contract.version !== 1)
+        return null;
+    return {
+        version: 1,
+        reactive_storage_item_key: sanitizeReactiveStorageItemKey(contract.reactive_storage_item_key),
+        composer_shadow_keys: sanitizeComposerShadowKeys(contract.composer_shadow_keys),
+    };
+}
 export function getManagementDir() {
     return join(homedir(), OPT_AI_SEC_MANAGEMENT_REL);
 }
@@ -38,16 +65,17 @@ export function readFileCollectionVscdbContract() {
         return null;
     try {
         const parsed = JSON.parse(readFileSync(path, 'utf8'));
-        if (parsed?.version !== 1 || !Array.isArray(parsed.composer_shadow_keys))
-            return null;
-        return parsed;
+        return sanitizeFileCollectionVscdbContract(parsed);
     }
     catch {
         return null;
     }
 }
 export function writeFileCollectionVscdbContract(contract) {
-    atomicWriteJson(getFileCollectionVscdbContractPath(), contract);
+    const sanitized = sanitizeFileCollectionVscdbContract(contract);
+    if (!sanitized)
+        return;
+    atomicWriteJson(getFileCollectionVscdbContractPath(), sanitized);
 }
 export function atomicWriteJson(filePath, data) {
     const dir = dirname(filePath);

package/dist/log_config_files/runtime/remediation_config_path.js

@@ -29,6 +29,11 @@ export function canonicalCursorUserStateVscdbPath(filePath) {
         }
         return filePath.trim();
     }
+    // Per-workspace vscdbs live under workspaceStorage/<hash>/state.vscdb and must NOT be
+    // normalized to the global path — each workspace is a distinct ConfigurationFile row.
+    if (lower.includes('workspacestorage')) {
+        return filePath.trim();
+    }
     const vscdb = 'state.vscdb';
     const vlen = vscdb.length;
     const slashKey = '/' + vscdb;

package/dist/log_config_files/runtime/remediation_sync.js

@@ -1,5 +1,6 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, unlinkSync } from 'node:fs';
-import { delimiter, dirname } from 'node:path';
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, renameSync, unlinkSync } from 'node:fs';
+import { delimiter, dirname, join } from 'node:path';
+import { homedir } from 'node:os';
 import { execFileSync } from 'node:child_process';
 import { executeGet, executeBody } from '../../endpoint_client/http_transport.js';
 import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
@@ -209,6 +210,34 @@ function isPlainObject(v) {
 function isStringArray(v) {
     return Array.isArray(v) && v.every((x) => typeof x === 'string');
 }
+function deepEqual(a, b) {
+    if (a === b)
+        return true;
+    if (a === null || b === null || typeof a !== 'object' || typeof b !== 'object')
+        return false;
+    if (Array.isArray(a) || Array.isArray(b)) {
+        if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length)
+            return false;
+        for (let i = 0; i < a.length; i++) {
+            if (!deepEqual(a[i], b[i]))
+                return false;
+        }
+        return true;
+    }
+    const ao = a;
+    const bo = b;
+    const aKeys = Object.keys(ao);
+    const bKeys = Object.keys(bo);
+    if (aKeys.length !== bKeys.length)
+        return false;
+    for (const k of aKeys) {
+        if (!Object.prototype.hasOwnProperty.call(bo, k))
+            return false;
+        if (!deepEqual(ao[k], bo[k]))
+            return false;
+    }
+    return true;
+}
 function applyStringArrayDelta(current, before, after) {
     const cur = isStringArray(current) ? [...current] : [];
     const b = isStringArray(before) ? before : [];
@@ -253,16 +282,13 @@ function applyCheck(configJson, check) {
                 continue;
             }
             const curVal = getByPath(configJson, targetPath);
-            const cur = isStringArray(curVal) ? [...curVal] : [];
+            const cur = Array.isArray(curVal) ? [...curVal] : [];
             const toRemove = (remove && remove[k]) ?? [];
             const toAdd = (add && add[k]) ?? [];
-            const rmSet = new Set(toRemove);
-            const next = cur.filter((x) => !rmSet.has(x));
-            const nextSet = new Set(next);
+            const next = cur.filter((x) => !toRemove.some((item) => deepEqual(item, x)));
             for (const x of toAdd) {
-                if (!nextSet.has(x)) {
+                if (!next.some((item) => deepEqual(item, x))) {
                     next.push(x);
-                    nextSet.add(x);
                 }
             }
             setByPath(configJson, targetPath, next);
@@ -468,6 +494,11 @@ function coerceItemTableValueToObjectRoot(targetKey, parsed) {
     if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {
         return parsed;
     }
+    // Bare JSON array (e.g. cursor/disabledMcpServers): wrap under target_key so array_union_add
+    // can locate and mutate it via mergeSqliteOpIntoJson.
+    if (Array.isArray(parsed)) {
+        return { [targetKey]: parsed };
+    }
     const field = CURSOR_SCALAR_ITEMTABLE_FIELDS[targetKey];
     if (field) {
         const b = coerceScalarForItemTableField(parsed);
@@ -481,6 +512,12 @@ function coerceItemTableValueToObjectRoot(targetKey, parsed) {
  * object can be ignored or overwritten on launch; match the native primitive shape when disabling.
  */
 function serializeItemTableValueForWrite(targetKey, root) {
+    // Bare-array keys: root was wrapped as { [targetKey]: array } by coerceItemTableValueToObjectRoot.
+    // Unwrap back to a bare JSON array before writing.
+    const keys = Object.keys(root);
+    if (keys.length === 1 && keys[0] === targetKey && Array.isArray(root[targetKey])) {
+        return JSON.stringify(root[targetKey]);
+    }
     const field = CURSOR_SCALAR_ITEMTABLE_FIELDS[targetKey];
     if (field) {
         const keys = Object.keys(root);
@@ -495,6 +532,22 @@ function serializeItemTableValueForWrite(targetKey, root) {
     return JSON.stringify(root);
 }
 function mergeSqliteOpIntoJson(currentJson, sqliteOp) {
+    // Array union: target_key holds a bare JSON array (e.g. cursor/disabledMcpServers).
+    // currentJson here is the coerced object root — the raw array is stored under target_key.
+    if (sqliteOp.array_union_add?.length) {
+        const key = sqliteOp.target_key;
+        const existing = currentJson[key];
+        const arr = Array.isArray(existing) ? existing : [];
+        const lowerSet = new Set(arr.map((v) => String(v).toLowerCase()));
+        for (const item of sqliteOp.array_union_add) {
+            if (!lowerSet.has(item.toLowerCase())) {
+                arr.push(item);
+                lowerSet.add(item.toLowerCase());
+            }
+        }
+        currentJson[key] = arr;
+        return;
+    }
     const where = sqliteOp.array_item_where;
     const jp = sqliteOp.json_path ?? '';
     if (where && typeof where === 'object' && Object.keys(where).length > 0 && jp) {
@@ -769,10 +822,10 @@ export async function applyDeferredVscdbFromDisk() {
             }
             const safeJson = it.new_value_json.replace(/'/g, "''");
             const safeName = it.target_key.replace(/'/g, "''");
-            const sql = `UPDATE ${it.table} SET ${it.value_column}='${safeJson}' WHERE ${it.key_column}='${safeName}';`;
+            const sql = `INSERT OR REPLACE INTO ${it.table} (${it.key_column}, ${it.value_column}) VALUES ('${safeName}', '${safeJson}');`;
             const changed = sqliteRunUpdateReturningChanges(it.dbPath, sql);
             if (changed < 1) {
-                hookRunLog(`deferred_vscdb: UPDATE changed 0 rows key=${it.target_key} db=${it.dbPath} — keeping queue file`);
+                hookRunLog(`deferred_vscdb: INSERT OR REPLACE changed 0 rows key=${it.target_key} db=${it.dbPath} — keeping queue file`);
                 return false;
             }
         }
@@ -1015,6 +1068,24 @@ function applyOrQueueSqliteJsonUpdate(configPath, sqliteOp, deferred) {
         return false;
     }
 }
+/**
+ * Return paths to every state.vscdb found under workspaceStoragePath/<hash>/state.vscdb.
+ * Used for the apply_to_all_workspaces fallback when no specific workspace vscdb was collected.
+ * Exported so compliance_check.ts can verify workspace vscdb state during ops-based checks.
+ */
+export function discoverAllWorkspaceVscdbs(workspaceStoragePath) {
+    if (!existsSync(workspaceStoragePath))
+        return [];
+    try {
+        return readdirSync(workspaceStoragePath, { withFileTypes: true })
+            .filter((e) => e.isDirectory())
+            .map((e) => join(workspaceStoragePath, e.name, 'state.vscdb'))
+            .filter((p) => existsSync(p));
+    }
+    catch {
+        return [];
+    }
+}
 export function enforceRemediation(instruction) {
     const resolvedPath = resolveRemediationConfigPath(instruction.config_file_path);
     const inst = resolvedPath === instruction.config_file_path
@@ -1045,9 +1116,48 @@ export function enforceRemediation(instruction) {
         });
         if (sqliteOps.length > 0) {
             complianceRunnerDiag(`remediation_enforce: sqlite path uuid=${inst.uuid} checks_with_sqlite=${sqliteOps.length}`);
+            const ops = sqliteOps.map((c) => c.sqlite_op);
+            const firstOp = ops[0];
+            // apply_to_all_workspaces: no specific vscdb was collected — discover and patch every
+            // workspaceStorage/<hash>/state.vscdb on disk (fallback for mcp_config-linked findings).
+            if (firstOp?.apply_to_all_workspaces) {
+                const segments = firstOp.workspace_storage_path_segments ?? [
+                    'Library', 'Application Support', 'Cursor', 'User', 'workspaceStorage',
+                ];
+                const wsPath = join(homedir(), ...segments);
+                const vscdbPaths = discoverAllWorkspaceVscdbs(wsPath);
+                hookRunLog(`remediation_enforce: apply_to_all_workspaces uuid=${inst.uuid} wsPath=${wsPath} found=${vscdbPaths.length}`);
+                if (vscdbPaths.length === 0) {
+                    return fail(`no workspace vscdbs found at ${wsPath} (open Cursor in at least one project first)`);
+                }
+                let anyOk = false;
+                for (const vscdbPath of vscdbPaths) {
+                    // Queue a post-apply upload for each workspace vscdb so that after the deferred
+                    // SQLite write is applied at restart time, the updated cursor/disabledMcpServers
+                    // value is immediately sent to the server.  This closes the race condition where
+                    // the user re-enables the server between the enforcement write and the next
+                    // scheduled log-config run: the upload after the deferred apply gives the server
+                    // the authoritative disabled state without waiting for a full log-config cycle.
+                    const postApplyUpload = {
+                        file_path: `${vscdbPath}#${firstOp.target_key}`,
+                        file_type: 'cursor_workspace_vscdb',
+                    };
+                    const q = queueDeferredSqliteOpsMerged(vscdbPath, ops, postApplyUpload);
+                    if (q.ok) {
+                        anyOk = true;
+                        hookRunLog(`remediation_enforce: queued apply_to_all_workspaces op for ${vscdbPath}`);
+                    }
+                    else {
+                        hookRunLog(`remediation_enforce: skip ${vscdbPath}: ${q.reason}`);
+                    }
+                }
+                if (!anyOk) {
+                    return fail('all workspace vscdb deferred writes failed (see sqlite_update lines above)');
+                }
+                return { ok: true, deferredSqlite: true };
+            }
             const restartRequired = !!fixSpec?.restart_required;
             if (restartRequired) {
-                const ops = sqliteOps.map((c) => c.sqlite_op);
                 const ft = inst.file_type?.trim();
                 const postApplyUpload = ft && inst.config_file_path.includes('#')
                     ? { file_path: inst.config_file_path, file_type: ft }

package/dist/tofu.js

@@ -30,7 +30,7 @@ function readEnvironment() {
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const isDevelopment = readEnvironment() === "development";
 // In development: resolve local optimus-tofu dist relative to this file.
-// dist/tofu.js → ../.. → npx_packages/production/ → optimus-tofu/dist/index.js
+// dist/tofu.js → ../.. → npx_packages/staging/ → optimus-tofu/dist/index.js
 const localTofuPath = path.join(__dirname, "../../optimus-tofu/dist/index.js");
 const tofu = (isDevelopment
     ? await import(localTofuPath)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config",
-  "version": "1.3.61",
+  "version": "1.3.63",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {
@@ -57,6 +57,6 @@
   "dependencies": {
     "axios": "^1.15.0",
     "canonicalize": "^2.1.0",
-    "optimus-tofu": "file:../optimus-tofu"
+    "optimus-tofu": "^0.1.14"
   }
 }