log-llm-config 1.3.7 → 1.3.8

package/dist/compliance_check_runner.js

@@ -2,9 +2,9 @@ import { appendFileSync, mkdirSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { OPT_AI_SEC_MANAGEMENT_REL } from './bootstrap_constants.js';
-import { hookLogSessionBanner } from './log_config_files/runtime/hook_logger.js';
+import { hookLogAppendSection } from './log_config_files/runtime/hook_logger.js';
 import { runComplianceCheck } from './log_config_files/runtime/compliance_check.js';
-/** Append-only log for compliance runner lifecycle; hook_log.txt is also append-only (session banners). */
+/** Append-only log for compliance runner lifecycle; hook_log.txt uses a fresh session from the gate then this section. */
 function runnerFileLog(message) {
     try {
         const dir = join(homedir(), OPT_AI_SEC_MANAGEMENT_REL);
@@ -18,7 +18,7 @@ function runnerFileLog(message) {
     }
 }
 (async () => {
-    hookLogSessionBanner('compliance_check_runner (background sync + check)');
+    hookLogAppendSection('compliance_check_runner (background sync + check)');
     runnerFileLog('compliance_check_runner: start');
     try {
         await runComplianceCheck();

package/dist/log_config_files/runtime/compliance_check.js

@@ -6,14 +6,13 @@
  * and remediation_instructions.json via applyAutofixViolations / enforceRemediation.
  *
  * Prompt gate: compliance_prompt_gate runs runLocalRemediationComplianceCheck then applyAutofixViolations.
- * Background: compliance_check_runner runs syncRemediations (network), the same local check, then
- * applyAutofixViolations + executeTrustedRestartCommands so remediations apply even when only the
- * background path runs (sqlite/vscdb updates remain Cursor-specific; restarts use the shared allowlist).
+ * Background: compliance_check_runner runs syncRemediations (network) then the same local check.
+ * Apply (autofix) is intentionally left to the gate on the next prompt — the background pass only
+ * downloads the latest manifest so the gate has fresh data to act on.
  */
-import { existsSync, readFileSync, statSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { readVscdbItemTableJson } from '../readers/vscdb_reader.js';
-import { getRemediationInstructionsPath, readRemediationInstructionsFile, writeRemediationInstructionsFile, } from './management_storage.js';
-import { executeTrustedRestartCommands } from './trusted_restarts.js';
+import { readRemediationInstructionsFile, writeRemediationInstructionsFile } from './management_storage.js';
 import { complianceRunnerDiag, hookRunLog } from './hook_logger.js';
 import { loadEndpointBase } from '../sender/endpoint_config.js';
 import { resolveHardwareUuid, tryResolveHardwareUuid } from './hardware_uuid.js';
@@ -434,22 +433,10 @@ export function pruneSatisfiedOneTimeRemediations() {
     }
     return { removed, reportPromises };
 }
-/** Same staleness window as compliance_prompt_gate: avoid applying very old local manifests. */
-const MANIFEST_STALE_MS = 7 * 24 * 60 * 60 * 1000;
-function getManifestStalenessMs() {
-    try {
-        const p = getRemediationInstructionsPath();
-        if (!existsSync(p))
-            return null;
-        return Date.now() - statSync(p).mtimeMs;
-    }
-    catch {
-        return null;
-    }
-}
 /**
- * Background refresh: server sync, local evaluation, then autofix + trusted restarts (same enforcement
- * as the prompt gate, without blocking stdin/stdout for the IDE).
+ * Background refresh: server sync for latest instructions, then the same local evaluation as the hook.
+ * Apply (autofix) is intentionally deferred to the gate on the next prompt — this pass only downloads
+ * a fresh manifest so the gate has up-to-date data when it runs.
  */
 export async function runComplianceCheck() {
     try {
@@ -464,31 +451,5 @@ export async function runComplianceCheck() {
         if (pruned.removed > 0) {
             await Promise.allSettled(pruned.reportPromises);
         }
-        return;
-    }
-    const staleMs = getManifestStalenessMs();
-    if (staleMs !== null && staleMs > MANIFEST_STALE_MS) {
-        const staleDays = Math.floor(staleMs / (24 * 60 * 60 * 1000));
-        hookRunLog(`compliance_check_runner: skip autofix — local remediation manifest is stale (${staleDays} days old)`);
-        return;
-    }
-    const { fixed, restartCommands, failedViolations, reportPromises } = applyAutofixViolations(status.violations);
-    if (fixed === 0) {
-        if (failedViolations.length > 0) {
-            hookRunLog(`compliance_check_runner: autofix failed for ${failedViolations.length} violation(s) (see autofix logs above)`);
-        }
-        return;
-    }
-    await Promise.allSettled(reportPromises);
-    if (failedViolations.length > 0) {
-        hookRunLog(`compliance_check_runner: autofix partial failure — ${failedViolations.length} violation(s) still unresolved`);
-    }
-    if (restartCommands.length > 0) {
-        hookRunLog(`compliance_check_runner: executing ${restartCommands.length} trusted restart command(s)`);
-        executeTrustedRestartCommands(restartCommands);
-    }
-    const pruned = pruneSatisfiedOneTimeRemediations();
-    if (pruned.removed > 0) {
-        await Promise.allSettled(pruned.reportPromises);
     }
 }

package/dist/log_config_files/runtime/hook_logger.js

@@ -1,8 +1,10 @@
-import { existsSync, mkdirSync, appendFileSync } from 'node:fs';
+import { existsSync, mkdirSync, appendFileSync, writeFileSync, statSync } from 'node:fs';
 import path from 'node:path';
 import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
 const HOOK_LOG_FILENAME = 'hook_log.txt';
 const COMPLIANCE_RUNNER_LOG_FILENAME = 'compliance_runner.log';
+/** Hard cap so a single upload/sync session cannot grow hook_log.txt without bound. */
+const MAX_HOOK_LOG_BYTES = 2 * 1024 * 1024;
 function getHookLogPath() {
     const homeDir = process.env.HOME || process.env.USERPROFILE;
     if (!homeDir)
@@ -33,7 +35,24 @@ function complianceRunnerDiag(message) {
         // best-effort
     }
 }
-/** Visible delimiter between hook_log.txt sessions (compliance gate, upload, etc.). */
+function ensureHookLogUnderCap() {
+    const logPath = getHookLogPath();
+    if (!logPath || !existsSync(logPath))
+        return;
+    try {
+        if (statSync(logPath).size <= MAX_HOOK_LOG_BYTES)
+            return;
+        const ts = new Date().toISOString();
+        writeFileSync(logPath, `${'='.repeat(72)}\n${ts} hook_log.txt truncated (exceeded ${MAX_HOOK_LOG_BYTES} bytes)\n${'='.repeat(72)}\n`, 'utf8');
+    }
+    catch {
+        // best-effort
+    }
+}
+/**
+ * Start a new hook_log.txt session (replaces the file). Use once per logical run
+ * (e.g. compliance_prompt_gate, log_config_files upload via hookLogReplace).
+ */
 function hookLogSessionBanner(label) {
     const logPath = getHookLogPath();
     if (!logPath)
@@ -44,15 +63,34 @@ function hookLogSessionBanner(label) {
             mkdirSync(dir, { recursive: true, mode: 0o700 });
         const ts = new Date().toISOString();
         const banner = `\n${'='.repeat(72)}\n${ts} session: ${label}\n${'='.repeat(72)}\n`;
-        appendFileSync(logPath, banner, 'utf8');
+        writeFileSync(logPath, banner, 'utf8');
     }
     catch {
         // best-effort
     }
 }
 /**
- * @deprecated Name kept for callers: begins a log_config_files upload section (append-only, does not truncate).
+ * Append a subsection after an existing session (e.g. compliance_check_runner after the gate)
+ * without replacing hook_log.txt.
  */
+function hookLogAppendSection(label) {
+    const logPath = getHookLogPath();
+    if (!logPath)
+        return;
+    try {
+        ensureHookLogUnderCap();
+        const dir = path.dirname(logPath);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const ts = new Date().toISOString();
+        const banner = `\n${'-'.repeat(72)}\n${ts} section: ${label}\n${'-'.repeat(72)}\n`;
+        appendFileSync(logPath, banner, 'utf8');
+    }
+    catch {
+        // best-effort
+    }
+}
+/** Begins a log_config_files upload session (replaces hook_log.txt, same as hookLogSessionBanner). */
 function hookLogReplace() {
     hookLogSessionBanner('log_config_files (config upload)');
 }
@@ -62,6 +100,7 @@ function hookRunLog(message) {
     if (!logPath)
         return;
     try {
+        ensureHookLogUnderCap();
         const ts = new Date().toISOString();
         appendFileSync(logPath, `${ts} ${message}\n`, 'utf8');
     }
@@ -75,10 +114,11 @@ function hookLogLine(message) {
     if (!logPath)
         return;
     try {
+        ensureHookLogUnderCap();
         appendFileSync(logPath, `${message}\n`, 'utf8');
     }
     catch {
         // best-effort
     }
 }
-export { getHookLogPath, getComplianceRunnerLogPath, hookLogReplace, hookLogSessionBanner, hookRunLog, hookLogLine, complianceRunnerDiag, };
+export { getHookLogPath, getComplianceRunnerLogPath, hookLogReplace, hookLogSessionBanner, hookLogAppendSection, hookRunLog, hookLogLine, complianceRunnerDiag, };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config",
-  "version": "1.3.7",
+  "version": "1.3.8",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {