log-llm-config 1.4.12 → 1.5.2

package/dist/apply_deferred_vscdb.js

@@ -25,13 +25,13 @@ applyDeferredVscdbFromDisk()
         catch (e) {
             hookRunLog(`apply_deferred_vscdb: post_apply_verification error: ${e instanceof Error ? e.message : String(e)}`);
             if (complianceLogPath) {
-                await finalizeAndUploadComplianceSessionLog(complianceLogPath, 'error');
+                await finalizeAndUploadComplianceSessionLog(complianceLogPath, 'failures');
             }
         }
     }
     else if (complianceLogPath) {
         hookRunLog('apply_deferred_vscdb: apply failed');
-        await finalizeAndUploadComplianceSessionLog(complianceLogPath, 'error');
+        await finalizeAndUploadComplianceSessionLog(complianceLogPath, 'failures');
     }
     process.exit(ok ? 0 : 1);
 })

package/dist/bootstrap_constants.js

@@ -3,3 +3,13 @@
  * Used by auth, hook logging, and audit output. Do not add agent-specific paths here.
  */
 export const OPT_AI_SEC_MANAGEMENT_REL = 'opt-ai-sec/management';
+/**
+ * All hook-written log files live under this subdirectory, grouped by type
+ * (see LOG_GROUP_* below). Keeping logs in one subtree leaves the management
+ * root limited to secrets/identity/state (auth_key, organization-uuid, contracts).
+ */
+export const OPT_AI_SEC_LOGS_REL = `${OPT_AI_SEC_MANAGEMENT_REL}/logs`;
+/** Log group subdirectories under {@link OPT_AI_SEC_LOGS_REL}. */
+export const LOG_GROUP_HOOK = 'hook';
+export const LOG_GROUP_COMPLIANCE = 'compliance';
+export const LOG_GROUP_AUDIT = 'audit';

package/dist/cli.js

@@ -111,4 +111,34 @@ function parseAndSetLogUuidEnvVars() {
     if (agentArg)
         process.env.OPTIMUS_AGENT = agentArg;
 }
-void main();
+/** Map each cli command to its functional unit for failure telemetry. */
+const COMMAND_UNIT = {
+    log_uuid: 'auth_version',
+    log_config_files: 'inventory',
+    log_sensitive_paths_audit: 'inventory',
+    compliance_prompt_gate: 'compliance',
+    compliance_check_runner: 'compliance',
+    'apply-deferred-vscdb': 'compliance',
+    'execute-trusted-restarts': 'compliance',
+    dialog_prefs: 'compliance',
+};
+main().catch(async (err) => {
+    // Top-level safety net: any uncaught error in a cli command is reported as a failed
+    // FunctionalRun (awaited so the POST lands before exit), then surfaced + non-zero exit.
+    try {
+        const cmd = args[0] || '';
+        const unit = COMMAND_UNIT[cmd] || 'inventory';
+        const { reportFunctionalFailureAwait } = await import('./log_config_files/runtime/client_event_reporter.js');
+        await reportFunctionalFailureAwait(unit, cmd, err);
+    }
+    catch {
+        /* never let telemetry mask the original error */
+    }
+    console.error(err instanceof Error ? err.stack || err.message : String(err));
+    try {
+        process.exit(1);
+    }
+    catch {
+        /* process.exit may be mocked in tests */
+    }
+});

package/dist/compliance_check_runner.js

@@ -3,6 +3,7 @@ import { complianceRunnerRunnerLine, hookLogAppendSection } from './log_config_f
 import { normalizeAgentToken, runComplianceCheck, } from './log_config_files/runtime/compliance_check.js';
 import { finalizeAndUploadComplianceSessionLog, initComplianceSessionForRunner, isFinalizeComplianceSessionArgv, isInflightComplianceLogPath, parseComplianceLogArg, resolveComplianceSessionLogPath, } from './log_config_files/runtime/compliance_session_log.js';
 import { existsSync } from 'node:fs';
+import { getStoryId, flushBufferedClientEvents, reportFunctionalRun, reportFunctionalFailureAwait, } from './log_config_files/runtime/client_event_reporter.js';
 function parseAgentArg() {
     const eq = process.argv.find((a) => a.startsWith('--agent='));
     if (!eq)
@@ -24,7 +25,6 @@ function parseAgentArg() {
             complianceLogPath = initComplianceSessionForRunner(resolved);
         }
         else {
-            // Gate may have finalized+moved the session before this background runner started.
             complianceLogPath = null;
         }
     }
@@ -32,9 +32,13 @@ function parseAgentArg() {
         hookLogAppendSection('compliance_check_runner (background sync + check)');
     }
     complianceRunnerRunnerLine('compliance_check_runner: start');
+    // Background runner: opportunistically flush any telemetry the (non-blocking) gate buffered.
+    getStoryId();
+    await flushBufferedClientEvents();
     try {
         await runComplianceCheck(parseAgentArg());
         complianceRunnerRunnerLine('compliance_check_runner: finished ok');
+        await reportFunctionalRun({ unit: 'compliance', command: 'compliance_check_runner', outcome: 'ok' });
     }
     catch (err) {
         const detail = err instanceof Error ? err.stack ?? err.message : String(err);
@@ -42,8 +46,9 @@ function parseAgentArg() {
         complianceRunnerRunnerLine(`compliance_check_runner: stack_or_detail ${detail.slice(0, 4000)}`);
         process.stderr.write(`compliance_check_runner error: ${err instanceof Error ? err.message : String(err)}\n`);
         if (complianceLogPath) {
-            await finalizeAndUploadComplianceSessionLog(complianceLogPath, 'error');
+            await finalizeAndUploadComplianceSessionLog(complianceLogPath, 'failures');
         }
+        await reportFunctionalFailureAwait('compliance', 'compliance_check_runner', err);
         process.exit(1);
     }
     if (complianceLogPath) {

package/dist/compliance_prompt_gate.js

@@ -6,17 +6,20 @@
  * When autofix returns restart_commands, this process does not spawn them — the shell hook pipes
  * the same JSON line to execute_trusted_restarts (TS allowlist + spawn).
  */
-import { applyAutofixViolations, confirmAppliedAutofixVerified, normalizeAgentToken, pruneSatisfiedOneTimeRemediations, reportPostRestartVerificationOutcomes, runLocalRemediationComplianceCheck, uploadSatisfiedManifestConfigs, } from './log_config_files/runtime/compliance_check.js';
+import { applyAutofixViolations, confirmAppliedAutofixVerified, normalizeAgentToken, pruneSatisfiedOneTimeRemediations, reportCompliantRemediationVerifiedStatus, reportPostRestartVerificationOutcomes, runLocalRemediationComplianceCheck, uploadSatisfiedManifestConfigs, } from './log_config_files/runtime/compliance_check.js';
 import { isRemediationQuarantined } from './log_config_files/runtime/remediation_apply_tracking.js';
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { getRemediationInstructionsPath } from './log_config_files/runtime/management_storage.js';
 import { hookLogSessionBanner, hookRunLog, logRemediationApplyFailure } from './log_config_files/runtime/hook_logger.js';
+import { getStoryId, bufferFunctionalRun } from './log_config_files/runtime/client_event_reporter.js';
 import { finalizeAndUploadComplianceSessionLog, initComplianceSessionForGate, parseComplianceLogArg, } from './log_config_files/runtime/compliance_session_log.js';
 import { isThisCliModule } from './cli_invocation_match.js';
 import { ensureAuthentication } from './log_config_files/auth/auth_flow.js';
 import { sendConfigFile } from './log_config_files/sender/batch_sender.js';
+import { parseJsonWithJsoncFallback } from './log_config_files/readers/file_readers.js';
+import { PORTABLE_CURSOR_USER_SETTINGS, resolveRemediationConfigPath, resolveRemediationUploadFileType, } from './log_config_files/runtime/remediation_config_path.js';
 import { tryResolveHardwareUuid } from './log_config_files/runtime/hardware_uuid.js';
-import { syncRemediations } from './log_config_files/runtime/remediation_sync.js';
+import { cursorAutofixDefersInlineVerify, syncRemediations, } from './log_config_files/runtime/remediation_sync.js';
 import { loadEndpointBase } from './log_config_files/sender/endpoint_config.js';
 import { formatRemediationChangePreviewForApplied } from './remediation_change_preview.js';
 const MANIFEST_STALE_MS = 7 * 24 * 60 * 60 * 1000;
@@ -146,9 +149,9 @@ export function formatCopilotAutofixDialog(appliedViolations) {
 export function formatOpenCodeAutofixDialog(appliedViolations) {
     return formatPreventiveAutofixDialog(appliedViolations, 'OpenCode will now apply this policy to your environment.');
 }
-/** Cursor restart dialog after enforced/preventive remediation is applied locally. */
+/** Cursor restart after local autofix (all JSON settings + vscdb paths use restart_commands). */
 export function formatCursorRestartAutofixDialog(appliedViolations) {
-    return formatPreventiveAutofixDialog(appliedViolations, 'Cursor will now restart to apply this policy, and your context will be retained.');
+    return formatPreventiveAutofixDialog(appliedViolations, 'Cursor will restart so the running app reloads policy from disk. Your context will be retained.');
 }
 /**
  * Upload a secondary compliance file to the backend so the server can resolve the finding.
@@ -156,16 +159,23 @@ export function formatCursorRestartAutofixDialog(appliedViolations) {
  */
 async function _uploadSecondaryFile(entry) {
     const { uuid, config_file_path, file_type } = entry;
-    if (!file_type) {
+    const uploadFileType = resolveRemediationUploadFileType(config_file_path, file_type ?? undefined);
+    if (!uploadFileType) {
         hookRunLog(`secondary_upload: skipping uuid=${uuid} — no file_type on secondary group`);
         return;
     }
+    const diskPath = resolveRemediationConfigPath(config_file_path);
     let rawContent;
     try {
-        rawContent = JSON.parse(readFileSync(config_file_path, 'utf8'));
+        const parsed = parseJsonWithJsoncFallback(readFileSync(diskPath, 'utf8'));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            hookRunLog(`secondary_upload: invalid JSON uuid=${uuid} path=${diskPath}`);
+            return;
+        }
+        rawContent = parsed;
     }
     catch {
-        hookRunLog(`secondary_upload: could not read file uuid=${uuid} path=${config_file_path}`);
+        hookRunLog(`secondary_upload: could not read file uuid=${uuid} path=${diskPath}`);
         return;
     }
     const hw = tryResolveHardwareUuid();
@@ -173,13 +183,16 @@ async function _uploadSecondaryFile(entry) {
         hookRunLog(`secondary_upload: hardware UUID unavailable, skipping uuid=${uuid}`);
         return;
     }
+    const portablePath = config_file_path.includes('Cursor/User/settings.json')
+        ? PORTABLE_CURSOR_USER_SETTINGS
+        : config_file_path.trim() || diskPath;
     try {
         const authKey = await ensureAuthentication(hw);
-        const sent = await sendConfigFile({ file_type, file_path: config_file_path, raw_content: rawContent }, hw, authKey);
-        hookRunLog(`secondary_upload: uuid=${uuid} path=${config_file_path} sent=${sent}`);
+        const sent = await sendConfigFile({ file_type: uploadFileType, file_path: portablePath, raw_content: rawContent }, hw, authKey);
+        hookRunLog(`secondary_upload: uuid=${uuid} path=${portablePath} sent=${sent}`);
     }
     catch (err) {
-        hookRunLog(`secondary_upload: upload failed uuid=${uuid} path=${config_file_path} err=${err instanceof Error ? err.message : String(err)}`);
+        hookRunLog(`secondary_upload: upload failed uuid=${uuid} path=${portablePath} err=${err instanceof Error ? err.message : String(err)}`);
     }
 }
 /**
@@ -188,7 +201,22 @@ async function _uploadSecondaryFile(entry) {
  * {@link isRunAsCliModule} is false and the gate must be invoked explicitly from cli.ts.
  */
 export async function runCompliancePromptGateCli() {
-    await runCompliancePromptGate().catch(() => printAllow(parseIde()));
+    getStoryId();
+    try {
+        await runCompliancePromptGate();
+        // Gate blocks prompt submit — buffer telemetry (no inline POST); the background runner flushes it.
+        bufferFunctionalRun({ unit: 'compliance', command: 'compliance_prompt_gate', outcome: 'ok' });
+    }
+    catch (err) {
+        bufferFunctionalRun({
+            unit: 'compliance',
+            command: 'compliance_prompt_gate',
+            outcome: 'failed',
+            message: err instanceof Error ? `${err.name}: ${err.message}` : String(err),
+            detail: err instanceof Error && err.stack ? err.stack : String(err),
+        });
+        printAllow(parseIde());
+    }
 }
 /** Exported for tests; runs when `dist/compliance_prompt_gate.js` is the process entry (argv[1]). */
 export async function runCompliancePromptGate() {
@@ -202,8 +230,6 @@ export async function runCompliancePromptGate() {
         hookLogSessionBanner('compliance_prompt_gate (before submit)');
     }
     let status = runLocalRemediationComplianceCheck(agent);
-    // Post-restart verify + server reports BEFORE sync so a manifest UUID swap cannot delay
-    // verified / activity-log until the following prompt.
     const postRestartVerify = reportPostRestartVerificationOutcomes(status.violations);
     if (postRestartVerify.outcomes.length > 0) {
         await Promise.allSettled(postRestartVerify.reportPromises);
@@ -290,12 +316,14 @@ export async function runCompliancePromptGate() {
                 // disk synchronously; a restart_command, if present, only reloads the already-compliant file
                 // into the running app — it is not the mechanism that makes the fix take effect. So report
                 // "verified" now instead of leaving the finding "pending" in the UI until the next prompt.
-                // Cursor's restart can carry a deferred state.vscdb write that only lands post-restart, so
-                // Cursor still verifies inline only when no restart is pending.
+                // Cursor JSON: disk recheck OK → verified before restart. Cursor deferred vscdb → verify after restart.
                 const immediateJsonAgent = ide === 'claude' || ide === 'copilot' || ide === 'opencode';
+                const diskProvenCompliant = recheckOk || claudeRecheckStaleAfterImmediateApply;
+                const cursorRestartVerifyPending = cursorAutofixDefersInlineVerify(ide, restartCommands.length, deferredSqlitePending === true, diskProvenCompliant);
                 const immediateVerified = !deferredSqlitePending &&
-                    (recheckOk || claudeRecheckStaleAfterImmediateApply) &&
-                    (restartCommands.length === 0 || immediateJsonAgent);
+                    !cursorRestartVerifyPending &&
+                    diskProvenCompliant &&
+                    (restartCommands.length === 0 || immediateJsonAgent || ide === 'cursor');
                 if (immediateVerified) {
                     confirmAppliedAutofixVerified(appliedViolations, reportPromises);
                     await Promise.allSettled(reportPromises);
@@ -360,6 +388,7 @@ export async function runCompliancePromptGate() {
         await Promise.allSettled(pruned.reportPromises);
     }
     await Promise.allSettled(uploadSatisfiedManifestConfigs(agent));
+    await Promise.allSettled(reportCompliantRemediationVerifiedStatus(agent));
     printAllow(ide);
 }
 if (isRunAsCliModule()) {

package/dist/log_config_files/auth/auth_flow.js

@@ -4,7 +4,7 @@ import { ensureAuthentication as ensureTofuAuthentication } from '../../tofu.js'
 import { loadEndpointBase } from '../sender/endpoint_config.js';
 import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
 import { hookRunLog } from '../runtime/hook_logger.js';
-const AUTH_KEY_RELATIVE_PATH = path.join(OPT_AI_SEC_MANAGEMENT_REL, 'auth_key.txt');
+const AUTH_KEY_RELATIVE_PATH = path.join(OPT_AI_SEC_MANAGEMENT_REL, 'auth', 'auth_key.txt');
 /** Ensure authentication — verify stored key or request new one via handshake. */
 async function ensureAuthentication(hardwareUuid, endpointBase) {
     const key = await ensureTofuAuthentication({

package/dist/log_config_files/auth/auth_key_store.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import { getAuthKeyPath as getSharedAuthKeyPath, readStoredAuthKey as readSharedStoredAuthKey, } from '../../tofu.js';
 import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
-const AUTH_KEY_RELATIVE_PATH = path.join(OPT_AI_SEC_MANAGEMENT_REL, 'auth_key.txt');
+const AUTH_KEY_RELATIVE_PATH = path.join(OPT_AI_SEC_MANAGEMENT_REL, 'auth', 'auth_key.txt');
 const AUTH_KEY_OPTIONS = { authRelativePath: AUTH_KEY_RELATIVE_PATH };
 /** Return absolute path to auth_key.txt, or null if home dir is unavailable. */
 function getAuthKeyPath() {

package/dist/log_config_files/collection/config_collector.js

@@ -86,6 +86,12 @@ function readContentByFormat(path, format) {
     // json (default) — fall back to markdown for .md files from agents not yet annotated
     return readJSONFile(path) ?? readMCPConfig(path) ?? (path.endsWith('.md') ? readMarkdownFile(path) : null);
 }
+function isPortableCursorUserSettingsTarget(t) {
+    const p = (t.logicalFilePath ?? t.path).replace(/\\/g, '/').toLowerCase();
+    return (p === 'cursor/user/settings.json' ||
+        p.endsWith('/cursor/user/settings.json') ||
+        p.includes('application support/cursor/user/settings.json'));
+}
 function collectRegularFileEntry(t, enrichByFileType) {
     const format = t.content_format || 'json';
     let content = readContentByFormat(t.path, format);
@@ -120,6 +126,12 @@ function collectRegularFileEntry(t, enrichByFileType) {
             return null;
         raw = filtered;
     }
+    if (t.file_type === 'vscode_settings' &&
+        isPortableCursorUserSettingsTarget(t) &&
+        Object.keys(raw).length === 0) {
+        console.warn(`Skipping empty Cursor User/settings.json upload (path=${t.path}); global ignore would be invisible to the server.`);
+        return null;
+    }
     return { file_type: t.file_type, file_path: t.logicalFilePath ?? t.path, raw_content: raw };
 }
 function collectMetadataEntry(t) {

package/dist/log_config_files/collection/ensure_cursor_user_settings_snapshot.js

@@ -0,0 +1,50 @@
+import { existsSync } from 'node:fs';
+import { readJSONFile } from '../readers/file_readers.js';
+import { PORTABLE_CURSOR_USER_SETTINGS, cursorUserSettingsAbsolutePaths, } from '../runtime/remediation_config_path.js';
+export function isPortableCursorUserSettingsUploadPath(filePath) {
+    const p = filePath.replace(/\\/g, '/').toLowerCase();
+    return (p === 'cursor/user/settings.json' ||
+        p.endsWith('/cursor/user/settings.json') ||
+        p.includes('application support/cursor/user/settings.json'));
+}
+function settingsPayloadHasGlobalIgnoreListKey(raw) {
+    if (!raw || typeof raw !== 'object')
+        return false;
+    const nested = raw.cursor
+        ?.general?.globalCursorIgnoreList;
+    if (Array.isArray(nested))
+        return true;
+    const flat = raw['cursor.general.globalCursorIgnoreList'];
+    return Array.isArray(flat);
+}
+/**
+ * Sensitive Directories scans need full User/settings.json (globalCursorIgnoreList).
+ * Pattern collection can omit the key or send an empty object; merge disk when the batch
+ * lacks an explicit globalCursorIgnoreList array (including []).
+ */
+export function ensureCursorUserSettingsSnapshotInBatch(configFiles) {
+    const hasIgnoreKeyInBatch = configFiles.some((c) => c.file_type === 'vscode_settings' &&
+        isPortableCursorUserSettingsUploadPath(c.file_path) &&
+        settingsPayloadHasGlobalIgnoreListKey(c.raw_content));
+    if (hasIgnoreKeyInBatch)
+        return;
+    for (const abs of cursorUserSettingsAbsolutePaths()) {
+        if (!existsSync(abs))
+            continue;
+        const raw = readJSONFile(abs);
+        if (!raw || Object.keys(raw).length === 0)
+            continue;
+        const entry = {
+            file_type: 'vscode_settings',
+            file_path: PORTABLE_CURSOR_USER_SETTINGS,
+            raw_content: raw,
+        };
+        const idx = configFiles.findIndex((c) => c.file_type === 'vscode_settings' &&
+            isPortableCursorUserSettingsUploadPath(c.file_path));
+        if (idx >= 0)
+            configFiles[idx] = entry;
+        else
+            configFiles.push(entry);
+        return;
+    }
+}

package/dist/log_config_files/paths/pattern_resolver.js

@@ -9,7 +9,7 @@ function normalizePathSkipPrefixes(prefixes) {
     return prefixes.filter((p) => typeof p === 'string' && p.length > 0);
 }
 /**
- * Expands glob patterns containing double-asterisk (recursive directory traversal).
+ * Expands glob patterns with double-asterisk (recursive directory traversal).
  *
  * Example: ~/.cursor/plugins/cache/ ** /skills/ recursively finds all skills
  * directories under the cache folder, up to RECURSIVE_GLOB_MAX_DEPTH.