log-llm-config 1.4.9 → 1.4.11

package/dist/compliance_prompt_gate.js

@@ -39,6 +39,8 @@ function parseIde() {
             return 'claude';
         if (v === 'copilot')
             return 'copilot';
+        if (v === 'opencode')
+            return 'opencode';
         return 'cursor';
     }
     if (process.argv.includes('--claude'))
@@ -48,6 +50,8 @@ function parseIde() {
 function defaultAgentFromIde(ide) {
     if (ide === 'copilot')
         return 'copilot';
+    if (ide === 'opencode')
+        return 'opencode';
     return ide === 'claude' ? 'claude' : 'cursor';
 }
 function parseAgent(ide) {
@@ -60,13 +64,13 @@ function parseAgent(ide) {
     return defaultAgentFromIde(ide);
 }
 function printAllow(ide) {
-    if (ide === 'claude' || ide === 'copilot')
+    if (ide === 'claude' || ide === 'copilot' || ide === 'opencode')
         console.log('{}');
     else
         console.log(JSON.stringify({ continue: true }));
 }
 function printAllowWithAdvisory(ide, advisoryMessage) {
-    if (ide === 'claude' || ide === 'copilot') {
+    if (ide === 'claude' || ide === 'copilot' || ide === 'opencode') {
         console.log(JSON.stringify({ __optimus_advisory: true, advisory_message: advisoryMessage }));
     }
     else {
@@ -80,7 +84,7 @@ function printAllowWithAdvisory(ide, advisoryMessage) {
 function blockPayload(ide, violationMessage) {
     const prefix = 'Prompt blocked by Optimus: ';
     const text = prefix + violationMessage;
-    if (ide === 'claude' || ide === 'copilot') {
+    if (ide === 'claude' || ide === 'copilot' || ide === 'opencode') {
         return JSON.stringify({ decision: 'block', reason: text, systemMessage: text });
     }
     return JSON.stringify({ continue: false, user_message: text });
@@ -138,6 +142,10 @@ export function formatClaudeAutofixDialog(appliedViolations) {
 export function formatCopilotAutofixDialog(appliedViolations) {
     return formatPreventiveAutofixDialog(appliedViolations, 'Copilot will now apply this policy to your environment.');
 }
+/** OpenCode dialog after enforced/preventive remediation is applied locally (terminal, no restart). */
+export function formatOpenCodeAutofixDialog(appliedViolations) {
+    return formatPreventiveAutofixDialog(appliedViolations, 'OpenCode will now apply this policy to your environment.');
+}
 /** Cursor restart dialog after enforced/preventive remediation is applied locally. */
 export function formatCursorRestartAutofixDialog(appliedViolations) {
     return formatPreventiveAutofixDialog(appliedViolations, 'Cursor will now restart to apply this policy, and your context will be retained.');
@@ -270,7 +278,7 @@ export async function runCompliancePromptGate() {
             // Claude / Copilot: JSON remediations are written immediately; merge/verify timing can still leave
             // the in-process recheck red for the same UUID — allow in that case for immediate JSON agents.
             const appliedUuids = new Set(appliedViolations.map((v) => v.uuid));
-            const claudeRecheckStaleAfterImmediateApply = (ide === 'claude' || ide === 'copilot') &&
+            const claudeRecheckStaleAfterImmediateApply = (ide === 'claude' || ide === 'copilot' || ide === 'opencode') &&
                 !recheckOk &&
                 recheck.violations.length > 0 &&
                 recheck.violations.every((v) => appliedUuids.has(v.uuid));
@@ -278,9 +286,16 @@ export async function runCompliancePromptGate() {
                 hookRunLog(`compliance_prompt_gate: ${ide} — autofix wrote JSON; recheck still flags same UUID(s) — proceeding (immediate apply)`);
             }
             if (deferredSqlitePending || recheckOk || claudeRecheckStaleAfterImmediateApply) {
-                const immediateVerified = restartCommands.length === 0 &&
-                    !deferredSqlitePending &&
-                    (recheckOk || claudeRecheckStaleAfterImmediateApply);
+                // Immediate-JSON agents (Claude / Claude Desktop, Copilot, OpenCode) write the config file to
+                // disk synchronously; a restart_command, if present, only reloads the already-compliant file
+                // into the running app — it is not the mechanism that makes the fix take effect. So report
+                // "verified" now instead of leaving the finding "pending" in the UI until the next prompt.
+                // Cursor's restart can carry a deferred state.vscdb write that only lands post-restart, so
+                // Cursor still verifies inline only when no restart is pending.
+                const immediateJsonAgent = ide === 'claude' || ide === 'copilot' || ide === 'opencode';
+                const immediateVerified = !deferredSqlitePending &&
+                    (recheckOk || claudeRecheckStaleAfterImmediateApply) &&
+                    (restartCommands.length === 0 || immediateJsonAgent);
                 if (immediateVerified) {
                     confirmAppliedAutofixVerified(appliedViolations, reportPromises);
                     await Promise.allSettled(reportPromises);
@@ -294,9 +309,11 @@ export async function runCompliancePromptGate() {
                         ? formatClaudeAutofixDialog(appliedViolations)
                         : ide === 'copilot'
                             ? formatCopilotAutofixDialog(appliedViolations)
-                            : `Optimus Labs auto-fixed ${fixed} ${fixed === 1 ? 'policy violation' : 'policy violations'}:\n\n${appliedViolations
-                                .map((v) => autofixDialogLine(v))
-                                .join('\n')}${changePreviewSuffix}`;
+                            : ide === 'opencode'
+                                ? formatOpenCodeAutofixDialog(appliedViolations)
+                                : `Optimus Labs auto-fixed ${fixed} ${fixed === 1 ? 'policy violation' : 'policy violations'}:\n\n${appliedViolations
+                                    .map((v) => autofixDialogLine(v))
+                                    .join('\n')}${changePreviewSuffix}`;
                 const payload = { __optimus_autofix: true, autofix_message: autofixMessage };
                 if (restartCommands.length > 0)
                     payload.restart_commands = restartCommands;

package/dist/log_config_files/collection/config_collector.js

@@ -69,7 +69,7 @@ function buildCollectionContext(patterns, projectRoot, home, homeRecurseSkipDirs
                 t.dir_subdir_filename = p.dir_subdir_filename;
             if (p.dir_subdir_source)
                 t.dir_subdir_source = p.dir_subdir_source;
-            const key = `${t.path}\t${t.file_type}`;
+            const key = `${t.path}\t${t.file_type}\t${t.isDirectory ? 'dir' : 'file'}\t${t.dir_glob ?? ''}`;
             if (!seenPaths.has(key)) {
                 seenPaths.add(key);
                 targets.push(t);

package/dist/log_config_files/readers/file_readers.js

@@ -176,4 +176,4 @@ function readInstalledExtensions(extensionsCachePath) {
     }
     return extensions;
 }
-export { readMCPConfig, readJSONFile, readMarkdownFile, readInstalledExtensions };
+export { readMCPConfig, readJSONFile, readMarkdownFile, readInstalledExtensions, parseJsonWithJsoncFallback, };

package/dist/log_config_files/readers/vscdb_item_table_registry.js

@@ -0,0 +1,82 @@
+/**
+ * ItemTable key metadata from backend file_path_registry (vscdb_read_queries), cached in
+ * file_collection_vscdb_contract.json — no hardcoded Cursor paths in compliance/remediation.
+ */
+import { readFileCollectionVscdbContract } from '../runtime/management_storage.js';
+function sanitizeItemTableKey(raw) {
+    if (typeof raw !== 'string')
+        return undefined;
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.length > 512 || /['"\\]/.test(trimmed))
+        return undefined;
+    return trimmed;
+}
+function sanitizeStateKey(raw) {
+    if (typeof raw !== 'string')
+        return undefined;
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.length > 256)
+        return undefined;
+    return trimmed;
+}
+export function itemTableKeyToStateKeyFromReadQueries(queries) {
+    const out = {};
+    if (!queries?.length)
+        return out;
+    for (const step of queries) {
+        const stateKey = sanitizeStateKey(step.state_key);
+        if (!stateKey)
+            continue;
+        for (const rawKey of step.item_table_keys ?? []) {
+            const key = sanitizeItemTableKey(rawKey);
+            if (key)
+                out[key] = stateKey;
+        }
+    }
+    return out;
+}
+/** Boolean ItemTable rows: field name under `${itemKey}.${field}` for compliance paths. */
+export function scalarItemTableFieldByItemKeyFromReadQueries(queries) {
+    const out = {};
+    if (!queries?.length)
+        return out;
+    for (const step of queries) {
+        if (step.value_kind !== 'boolean')
+            continue;
+        const stateKey = sanitizeStateKey(step.state_key);
+        if (!stateKey)
+            continue;
+        for (const rawKey of step.item_table_keys ?? []) {
+            const key = sanitizeItemTableKey(rawKey);
+            if (key)
+                out[key] = stateKey;
+        }
+    }
+    return out;
+}
+export function scalarItemTableFieldForKey(itemKey) {
+    const key = sanitizeItemTableKey(itemKey);
+    if (!key)
+        return undefined;
+    const contract = readFileCollectionVscdbContract();
+    const map = contract?.scalar_item_table_field_by_item_key;
+    const field = map?.[key];
+    if (typeof field === 'string' && field.trim())
+        return field.trim();
+    // Older cached contracts may omit scalar map; state_key from registry matches compliance field names.
+    const stateKey = contract?.item_table_key_to_state_key?.[key];
+    return typeof stateKey === 'string' && stateKey.trim() ? stateKey.trim() : undefined;
+}
+/** Separate registry rows (different state_key) — do not remap compliance paths onto manifest # key. */
+export function itemTableKeysAreDistinctStateRows(applyKey, verifyKey) {
+    const a = sanitizeItemTableKey(applyKey);
+    const b = sanitizeItemTableKey(verifyKey);
+    if (!a || !b)
+        return false;
+    const map = readFileCollectionVscdbContract()?.item_table_key_to_state_key;
+    if (!map)
+        return false;
+    const stateA = map[a];
+    const stateB = map[b];
+    return typeof stateA === 'string' && typeof stateB === 'string' && stateA !== stateB;
+}

package/dist/log_config_files/runtime/compliance_check.js

@@ -13,6 +13,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { parseJsonWithJsoncFallback } from '../readers/file_readers.js';
 import { mergeComposerShadowKeysFromReactiveBlob, readVscdbItemTableJson, } from '../readers/vscdb_reader.js';
 import { readRemediationInstructionsFile, writeRemediationInstructionsFile, } from './management_storage.js';
 import { resolveRemediationConfigPath } from './remediation_config_path.js';
@@ -294,12 +295,12 @@ function loadRemediationConfigJson(configFilePath, checkSettingPaths = []) {
     }
     if (!existsSync(resolvedPath))
         return { ok: false, reason: 'file_not_found' };
-    try {
-        return { ok: true, json: JSON.parse(readFileSync(resolvedPath, 'utf8')) };
-    }
-    catch {
+    // OpenCode configs are JSONC (comments / trailing commas); parse strict JSON first, then
+    // fall back to JSONC sanitization so comment-bearing files are not skipped as parse_error.
+    const parsed = parseJsonWithJsoncFallback(readFileSync(resolvedPath, 'utf8'));
+    if (parsed === null)
         return { ok: false, reason: 'parse_error' };
-    }
+    return { ok: true, json: parsed };
 }
 /**
  * Evaluate all checks in a secondary group against the group's config file.
@@ -678,12 +679,8 @@ export function applyAutofixViolations(violations, agent = 'cursor') {
                 updatedContent = itemKey ? (readVscdbItemTableJson(dbPath, itemKey) ?? undefined) : undefined;
             }
             else {
-                try {
-                    updatedContent = JSON.parse(readFileSync(configPathForDisk, 'utf8'));
-                }
-                catch {
-                    updatedContent = undefined;
-                }
+                updatedContent =
+                    parseJsonWithJsoncFallback(readFileSync(configPathForDisk, 'utf8')) ?? undefined;
             }
             if (updatedContent !== undefined) {
                 const fileType = (inst.file_type ?? '').trim();
@@ -906,11 +903,8 @@ export function uploadSatisfiedManifestConfigs(agent = 'cursor') {
                 continue;
             }
         }
-        let rawContent;
-        try {
-            rawContent = JSON.parse(readFileSync(diskPath, 'utf8'));
-        }
-        catch {
+        const rawContent = parseJsonWithJsoncFallback(readFileSync(diskPath, 'utf8'));
+        if (rawContent === null) {
             hookRunLog(`satisfied_upload: could not read path=${diskPath} uuid=${entry.uuid}`);
             continue;
         }

package/dist/log_config_files/runtime/remediation_sync.js

@@ -3,6 +3,7 @@ import { delimiter, dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { execFileSync } from 'node:child_process';
 import { executeBody } from '../../endpoint_client/http_transport.js';
+import { parseJsonWithJsoncFallback } from '../readers/file_readers.js';
 import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
 import { atomicWriteJson, getDeferredVscdbApplyPath, getFileCollectionVscdbContractPath, getRemediationInstructionsPath, readRemediationInstructionsFile, writeRemediationInstructionsFile, } from './management_storage.js';
 import { readStoredAuthKey } from '../auth/auth_key_store.js';
@@ -1396,10 +1397,16 @@ export function enforceRemediation(instruction) {
         }
         let configJson = {};
         if (existsSync(inst.config_file_path)) {
-            try {
-                configJson = JSON.parse(readFileSync(inst.config_file_path, 'utf8'));
+            // OpenCode configs are JSONC; parse strict JSON first, then JSONC fallback so a
+            // comment-bearing opencode.json(c) keeps its existing settings instead of being reset to
+            // {} on a parse failure. NOTE: the write-back below is JSON.stringify, so comments and
+            // trailing commas in the original file are not preserved (same as every other agent's
+            // JSON config) — only the key/value settings are retained and patched.
+            const parsed = parseJsonWithJsoncFallback(readFileSync(inst.config_file_path, 'utf8'));
+            if (parsed !== null) {
+                configJson = parsed;
             }
-            catch {
+            else {
                 hookRunLog(`remediation_enforce: could not parse existing file, starting fresh uuid=${inst.uuid}`);
             }
         }

package/dist/post_restart_verify.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+// Runs after Cursor reopens: delayed compliance verify, then deferred config uploads if verified.
+import { runPostApplyVerification } from './log_config_files/runtime/compliance_check.js';
+import { hookRunLog } from './log_config_files/runtime/hook_logger.js';
+import { clearDeferredPostApplyUploads, delayMs, POST_RESTART_VERIFY_DELAY_MS, runDeferredPostApplyUploadsFromSidecar, } from './log_config_files/runtime/remediation_sync.js';
+import { finalizeAndUploadComplianceSessionLog, setActiveComplianceLogPath, } from './log_config_files/runtime/compliance_session_log.js';
+import { isThisCliModule } from './cli_invocation_match.js';
+const complianceLogPath = process.env.OPTIMUS_COMPLIANCE_LOG?.trim() || null;
+if (complianceLogPath) {
+    setActiveComplianceLogPath(complianceLogPath);
+}
+export async function runPostRestartVerify() {
+    hookRunLog(`post_restart_verify: sleeping ${POST_RESTART_VERIFY_DELAY_MS}ms before verify`);
+    await delayMs(POST_RESTART_VERIFY_DELAY_MS);
+    const outcomes = await runPostApplyVerification();
+    if (outcomes.length > 0) {
+        hookRunLog(`post_restart_verify: outcomes count=${outcomes.length} verified=${outcomes.filter((o) => o.status === 'verified').length}`);
+    }
+    else {
+        hookRunLog('post_restart_verify: no pending post-restart verifications');
+        clearDeferredPostApplyUploads();
+        return true;
+    }
+    const allVerified = outcomes.every((o) => o.status === 'verified');
+    if (allVerified) {
+        await runDeferredPostApplyUploadsFromSidecar();
+        return true;
+    }
+    clearDeferredPostApplyUploads();
+    return false;
+}
+if (isThisCliModule(process.argv[1], import.meta.url)) {
+    runPostRestartVerify()
+        .then(async (ok) => {
+        if (complianceLogPath) {
+            await finalizeAndUploadComplianceSessionLog(complianceLogPath, ok ? 'success' : 'error');
+        }
+        process.exit(ok ? 0 : 1);
+    })
+        .catch(async (e) => {
+        hookRunLog(`post_restart_verify: error: ${e instanceof Error ? e.message : String(e)}`);
+        clearDeferredPostApplyUploads();
+        if (complianceLogPath) {
+            await finalizeAndUploadComplianceSessionLog(complianceLogPath, 'error');
+        }
+        process.exit(1);
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config",
-  "version": "1.4.9",
+  "version": "1.4.11",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {