log-llm-config 1.4.10 → 1.4.12

package/dist/compliance_prompt_gate.js

@@ -286,9 +286,16 @@ export async function runCompliancePromptGate() {
                 hookRunLog(`compliance_prompt_gate: ${ide} — autofix wrote JSON; recheck still flags same UUID(s) — proceeding (immediate apply)`);
             }
             if (deferredSqlitePending || recheckOk || claudeRecheckStaleAfterImmediateApply) {
-                const immediateVerified = restartCommands.length === 0 &&
-                    !deferredSqlitePending &&
-                    (recheckOk || claudeRecheckStaleAfterImmediateApply);
+                // Immediate-JSON agents (Claude / Claude Desktop, Copilot, OpenCode) write the config file to
+                // disk synchronously; a restart_command, if present, only reloads the already-compliant file
+                // into the running app — it is not the mechanism that makes the fix take effect. So report
+                // "verified" now instead of leaving the finding "pending" in the UI until the next prompt.
+                // Cursor's restart can carry a deferred state.vscdb write that only lands post-restart, so
+                // Cursor still verifies inline only when no restart is pending.
+                const immediateJsonAgent = ide === 'claude' || ide === 'copilot' || ide === 'opencode';
+                const immediateVerified = !deferredSqlitePending &&
+                    (recheckOk || claudeRecheckStaleAfterImmediateApply) &&
+                    (restartCommands.length === 0 || immediateJsonAgent);
                 if (immediateVerified) {
                     confirmAppliedAutofixVerified(appliedViolations, reportPromises);
                     await Promise.allSettled(reportPromises);

package/dist/log_config_files/collection/directory_collector.js

@@ -101,7 +101,15 @@ function collectDirectoryMetadata(t) {
     try {
         const dirStat = statSync(t.path);
         const glob = t.dir_glob ?? '*';
-        const newest = findNewestMatchingFile(t.path, glob, 0, METADATA_DIR_SCAN_MAX_DEPTH);
+        // A "|"-delimited dir_glob is an ordered priority list: use the newest match of the FIRST
+        // glob that matches anything, so e.g. "**/*.jsonl|**/*" prefers a session transcript
+        // (events.jsonl) over any other session-state file — even when a non-jsonl file is newer.
+        let newest = null;
+        for (const g of glob.split('|')) {
+            newest = findNewestMatchingFile(t.path, g, 0, METADATA_DIR_SCAN_MAX_DEPTH);
+            if (newest)
+                break;
+        }
         const bestPath = newest?.path ?? t.path;
         const bestMtime = newest?.mtime ?? dirStat.mtime;
         return {

package/dist/log_config_files/readers/vscdb_item_table_registry.js

@@ -0,0 +1,82 @@
+/**
+ * ItemTable key metadata from backend file_path_registry (vscdb_read_queries), cached in
+ * file_collection_vscdb_contract.json — no hardcoded Cursor paths in compliance/remediation.
+ */
+import { readFileCollectionVscdbContract } from '../runtime/management_storage.js';
+function sanitizeItemTableKey(raw) {
+    if (typeof raw !== 'string')
+        return undefined;
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.length > 512 || /['"\\]/.test(trimmed))
+        return undefined;
+    return trimmed;
+}
+function sanitizeStateKey(raw) {
+    if (typeof raw !== 'string')
+        return undefined;
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.length > 256)
+        return undefined;
+    return trimmed;
+}
+export function itemTableKeyToStateKeyFromReadQueries(queries) {
+    const out = {};
+    if (!queries?.length)
+        return out;
+    for (const step of queries) {
+        const stateKey = sanitizeStateKey(step.state_key);
+        if (!stateKey)
+            continue;
+        for (const rawKey of step.item_table_keys ?? []) {
+            const key = sanitizeItemTableKey(rawKey);
+            if (key)
+                out[key] = stateKey;
+        }
+    }
+    return out;
+}
+/** Boolean ItemTable rows: field name under `${itemKey}.${field}` for compliance paths. */
+export function scalarItemTableFieldByItemKeyFromReadQueries(queries) {
+    const out = {};
+    if (!queries?.length)
+        return out;
+    for (const step of queries) {
+        if (step.value_kind !== 'boolean')
+            continue;
+        const stateKey = sanitizeStateKey(step.state_key);
+        if (!stateKey)
+            continue;
+        for (const rawKey of step.item_table_keys ?? []) {
+            const key = sanitizeItemTableKey(rawKey);
+            if (key)
+                out[key] = stateKey;
+        }
+    }
+    return out;
+}
+export function scalarItemTableFieldForKey(itemKey) {
+    const key = sanitizeItemTableKey(itemKey);
+    if (!key)
+        return undefined;
+    const contract = readFileCollectionVscdbContract();
+    const map = contract?.scalar_item_table_field_by_item_key;
+    const field = map?.[key];
+    if (typeof field === 'string' && field.trim())
+        return field.trim();
+    // Older cached contracts may omit scalar map; state_key from registry matches compliance field names.
+    const stateKey = contract?.item_table_key_to_state_key?.[key];
+    return typeof stateKey === 'string' && stateKey.trim() ? stateKey.trim() : undefined;
+}
+/** Separate registry rows (different state_key) — do not remap compliance paths onto manifest # key. */
+export function itemTableKeysAreDistinctStateRows(applyKey, verifyKey) {
+    const a = sanitizeItemTableKey(applyKey);
+    const b = sanitizeItemTableKey(verifyKey);
+    if (!a || !b)
+        return false;
+    const map = readFileCollectionVscdbContract()?.item_table_key_to_state_key;
+    if (!map)
+        return false;
+    const stateA = map[a];
+    const stateB = map[b];
+    return typeof stateA === 'string' && typeof stateB === 'string' && stateA !== stateB;
+}

package/dist/post_restart_verify.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+// Runs after Cursor reopens: delayed compliance verify, then deferred config uploads if verified.
+import { runPostApplyVerification } from './log_config_files/runtime/compliance_check.js';
+import { hookRunLog } from './log_config_files/runtime/hook_logger.js';
+import { clearDeferredPostApplyUploads, delayMs, POST_RESTART_VERIFY_DELAY_MS, runDeferredPostApplyUploadsFromSidecar, } from './log_config_files/runtime/remediation_sync.js';
+import { finalizeAndUploadComplianceSessionLog, setActiveComplianceLogPath, } from './log_config_files/runtime/compliance_session_log.js';
+import { isThisCliModule } from './cli_invocation_match.js';
+const complianceLogPath = process.env.OPTIMUS_COMPLIANCE_LOG?.trim() || null;
+if (complianceLogPath) {
+    setActiveComplianceLogPath(complianceLogPath);
+}
+export async function runPostRestartVerify() {
+    hookRunLog(`post_restart_verify: sleeping ${POST_RESTART_VERIFY_DELAY_MS}ms before verify`);
+    await delayMs(POST_RESTART_VERIFY_DELAY_MS);
+    const outcomes = await runPostApplyVerification();
+    if (outcomes.length > 0) {
+        hookRunLog(`post_restart_verify: outcomes count=${outcomes.length} verified=${outcomes.filter((o) => o.status === 'verified').length}`);
+    }
+    else {
+        hookRunLog('post_restart_verify: no pending post-restart verifications');
+        clearDeferredPostApplyUploads();
+        return true;
+    }
+    const allVerified = outcomes.every((o) => o.status === 'verified');
+    if (allVerified) {
+        await runDeferredPostApplyUploadsFromSidecar();
+        return true;
+    }
+    clearDeferredPostApplyUploads();
+    return false;
+}
+if (isThisCliModule(process.argv[1], import.meta.url)) {
+    runPostRestartVerify()
+        .then(async (ok) => {
+        if (complianceLogPath) {
+            await finalizeAndUploadComplianceSessionLog(complianceLogPath, ok ? 'success' : 'error');
+        }
+        process.exit(ok ? 0 : 1);
+    })
+        .catch(async (e) => {
+        hookRunLog(`post_restart_verify: error: ${e instanceof Error ? e.message : String(e)}`);
+        clearDeferredPostApplyUploads();
+        if (complianceLogPath) {
+            await finalizeAndUploadComplianceSessionLog(complianceLogPath, 'error');
+        }
+        process.exit(1);
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config",
-  "version": "1.4.10",
+  "version": "1.4.12",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {