log-llm-config 1.5.0 → 1.5.2

package/dist/compliance_prompt_gate.js

@@ -6,7 +6,7 @@
  * When autofix returns restart_commands, this process does not spawn them — the shell hook pipes
  * the same JSON line to execute_trusted_restarts (TS allowlist + spawn).
  */
-import { applyAutofixViolations, confirmAppliedAutofixVerified, normalizeAgentToken, pruneSatisfiedOneTimeRemediations, reportPostRestartVerificationOutcomes, runLocalRemediationComplianceCheck, uploadSatisfiedManifestConfigs, } from './log_config_files/runtime/compliance_check.js';
+import { applyAutofixViolations, confirmAppliedAutofixVerified, normalizeAgentToken, pruneSatisfiedOneTimeRemediations, reportCompliantRemediationVerifiedStatus, reportPostRestartVerificationOutcomes, runLocalRemediationComplianceCheck, uploadSatisfiedManifestConfigs, } from './log_config_files/runtime/compliance_check.js';
 import { isRemediationQuarantined } from './log_config_files/runtime/remediation_apply_tracking.js';
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { getRemediationInstructionsPath } from './log_config_files/runtime/management_storage.js';
@@ -16,8 +16,10 @@ import { finalizeAndUploadComplianceSessionLog, initComplianceSessionForGate, pa
 import { isThisCliModule } from './cli_invocation_match.js';
 import { ensureAuthentication } from './log_config_files/auth/auth_flow.js';
 import { sendConfigFile } from './log_config_files/sender/batch_sender.js';
+import { parseJsonWithJsoncFallback } from './log_config_files/readers/file_readers.js';
+import { PORTABLE_CURSOR_USER_SETTINGS, resolveRemediationConfigPath, resolveRemediationUploadFileType, } from './log_config_files/runtime/remediation_config_path.js';
 import { tryResolveHardwareUuid } from './log_config_files/runtime/hardware_uuid.js';
-import { syncRemediations } from './log_config_files/runtime/remediation_sync.js';
+import { cursorAutofixDefersInlineVerify, syncRemediations, } from './log_config_files/runtime/remediation_sync.js';
 import { loadEndpointBase } from './log_config_files/sender/endpoint_config.js';
 import { formatRemediationChangePreviewForApplied } from './remediation_change_preview.js';
 const MANIFEST_STALE_MS = 7 * 24 * 60 * 60 * 1000;
@@ -147,9 +149,9 @@ export function formatCopilotAutofixDialog(appliedViolations) {
 export function formatOpenCodeAutofixDialog(appliedViolations) {
     return formatPreventiveAutofixDialog(appliedViolations, 'OpenCode will now apply this policy to your environment.');
 }
-/** Cursor restart dialog after enforced/preventive remediation is applied locally. */
+/** Cursor restart after local autofix (all JSON settings + vscdb paths use restart_commands). */
 export function formatCursorRestartAutofixDialog(appliedViolations) {
-    return formatPreventiveAutofixDialog(appliedViolations, 'Cursor will now restart to apply this policy, and your context will be retained.');
+    return formatPreventiveAutofixDialog(appliedViolations, 'Cursor will restart so the running app reloads policy from disk. Your context will be retained.');
 }
 /**
  * Upload a secondary compliance file to the backend so the server can resolve the finding.
@@ -157,16 +159,23 @@ export function formatCursorRestartAutofixDialog(appliedViolations) {
  */
 async function _uploadSecondaryFile(entry) {
     const { uuid, config_file_path, file_type } = entry;
-    if (!file_type) {
+    const uploadFileType = resolveRemediationUploadFileType(config_file_path, file_type ?? undefined);
+    if (!uploadFileType) {
         hookRunLog(`secondary_upload: skipping uuid=${uuid} — no file_type on secondary group`);
         return;
     }
+    const diskPath = resolveRemediationConfigPath(config_file_path);
     let rawContent;
     try {
-        rawContent = JSON.parse(readFileSync(config_file_path, 'utf8'));
+        const parsed = parseJsonWithJsoncFallback(readFileSync(diskPath, 'utf8'));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            hookRunLog(`secondary_upload: invalid JSON uuid=${uuid} path=${diskPath}`);
+            return;
+        }
+        rawContent = parsed;
     }
     catch {
-        hookRunLog(`secondary_upload: could not read file uuid=${uuid} path=${config_file_path}`);
+        hookRunLog(`secondary_upload: could not read file uuid=${uuid} path=${diskPath}`);
         return;
     }
     const hw = tryResolveHardwareUuid();
@@ -174,13 +183,16 @@ async function _uploadSecondaryFile(entry) {
         hookRunLog(`secondary_upload: hardware UUID unavailable, skipping uuid=${uuid}`);
         return;
     }
+    const portablePath = config_file_path.includes('Cursor/User/settings.json')
+        ? PORTABLE_CURSOR_USER_SETTINGS
+        : config_file_path.trim() || diskPath;
     try {
         const authKey = await ensureAuthentication(hw);
-        const sent = await sendConfigFile({ file_type, file_path: config_file_path, raw_content: rawContent }, hw, authKey);
-        hookRunLog(`secondary_upload: uuid=${uuid} path=${config_file_path} sent=${sent}`);
+        const sent = await sendConfigFile({ file_type: uploadFileType, file_path: portablePath, raw_content: rawContent }, hw, authKey);
+        hookRunLog(`secondary_upload: uuid=${uuid} path=${portablePath} sent=${sent}`);
     }
     catch (err) {
-        hookRunLog(`secondary_upload: upload failed uuid=${uuid} path=${config_file_path} err=${err instanceof Error ? err.message : String(err)}`);
+        hookRunLog(`secondary_upload: upload failed uuid=${uuid} path=${portablePath} err=${err instanceof Error ? err.message : String(err)}`);
     }
 }
 /**
@@ -218,8 +230,6 @@ export async function runCompliancePromptGate() {
         hookLogSessionBanner('compliance_prompt_gate (before submit)');
     }
     let status = runLocalRemediationComplianceCheck(agent);
-    // Post-restart verify + server reports BEFORE sync so a manifest UUID swap cannot delay
-    // verified / activity-log until the following prompt.
     const postRestartVerify = reportPostRestartVerificationOutcomes(status.violations);
     if (postRestartVerify.outcomes.length > 0) {
         await Promise.allSettled(postRestartVerify.reportPromises);
@@ -306,12 +316,14 @@ export async function runCompliancePromptGate() {
                 // disk synchronously; a restart_command, if present, only reloads the already-compliant file
                 // into the running app — it is not the mechanism that makes the fix take effect. So report
                 // "verified" now instead of leaving the finding "pending" in the UI until the next prompt.
-                // Cursor's restart can carry a deferred state.vscdb write that only lands post-restart, so
-                // Cursor still verifies inline only when no restart is pending.
+                // Cursor JSON: disk recheck OK → verified before restart. Cursor deferred vscdb → verify after restart.
                 const immediateJsonAgent = ide === 'claude' || ide === 'copilot' || ide === 'opencode';
+                const diskProvenCompliant = recheckOk || claudeRecheckStaleAfterImmediateApply;
+                const cursorRestartVerifyPending = cursorAutofixDefersInlineVerify(ide, restartCommands.length, deferredSqlitePending === true, diskProvenCompliant);
                 const immediateVerified = !deferredSqlitePending &&
-                    (recheckOk || claudeRecheckStaleAfterImmediateApply) &&
-                    (restartCommands.length === 0 || immediateJsonAgent);
+                    !cursorRestartVerifyPending &&
+                    diskProvenCompliant &&
+                    (restartCommands.length === 0 || immediateJsonAgent || ide === 'cursor');
                 if (immediateVerified) {
                     confirmAppliedAutofixVerified(appliedViolations, reportPromises);
                     await Promise.allSettled(reportPromises);
@@ -376,6 +388,7 @@ export async function runCompliancePromptGate() {
         await Promise.allSettled(pruned.reportPromises);
     }
     await Promise.allSettled(uploadSatisfiedManifestConfigs(agent));
+    await Promise.allSettled(reportCompliantRemediationVerifiedStatus(agent));
     printAllow(ide);
 }
 if (isRunAsCliModule()) {

package/dist/log_config_files/collection/config_collector.js

@@ -86,6 +86,12 @@ function readContentByFormat(path, format) {
     // json (default) — fall back to markdown for .md files from agents not yet annotated
     return readJSONFile(path) ?? readMCPConfig(path) ?? (path.endsWith('.md') ? readMarkdownFile(path) : null);
 }
+function isPortableCursorUserSettingsTarget(t) {
+    const p = (t.logicalFilePath ?? t.path).replace(/\\/g, '/').toLowerCase();
+    return (p === 'cursor/user/settings.json' ||
+        p.endsWith('/cursor/user/settings.json') ||
+        p.includes('application support/cursor/user/settings.json'));
+}
 function collectRegularFileEntry(t, enrichByFileType) {
     const format = t.content_format || 'json';
     let content = readContentByFormat(t.path, format);
@@ -120,6 +126,12 @@ function collectRegularFileEntry(t, enrichByFileType) {
             return null;
         raw = filtered;
     }
+    if (t.file_type === 'vscode_settings' &&
+        isPortableCursorUserSettingsTarget(t) &&
+        Object.keys(raw).length === 0) {
+        console.warn(`Skipping empty Cursor User/settings.json upload (path=${t.path}); global ignore would be invisible to the server.`);
+        return null;
+    }
     return { file_type: t.file_type, file_path: t.logicalFilePath ?? t.path, raw_content: raw };
 }
 function collectMetadataEntry(t) {

package/dist/log_config_files/collection/ensure_cursor_user_settings_snapshot.js

@@ -0,0 +1,50 @@
+import { existsSync } from 'node:fs';
+import { readJSONFile } from '../readers/file_readers.js';
+import { PORTABLE_CURSOR_USER_SETTINGS, cursorUserSettingsAbsolutePaths, } from '../runtime/remediation_config_path.js';
+export function isPortableCursorUserSettingsUploadPath(filePath) {
+    const p = filePath.replace(/\\/g, '/').toLowerCase();
+    return (p === 'cursor/user/settings.json' ||
+        p.endsWith('/cursor/user/settings.json') ||
+        p.includes('application support/cursor/user/settings.json'));
+}
+function settingsPayloadHasGlobalIgnoreListKey(raw) {
+    if (!raw || typeof raw !== 'object')
+        return false;
+    const nested = raw.cursor
+        ?.general?.globalCursorIgnoreList;
+    if (Array.isArray(nested))
+        return true;
+    const flat = raw['cursor.general.globalCursorIgnoreList'];
+    return Array.isArray(flat);
+}
+/**
+ * Sensitive Directories scans need full User/settings.json (globalCursorIgnoreList).
+ * Pattern collection can omit the key or send an empty object; merge disk when the batch
+ * lacks an explicit globalCursorIgnoreList array (including []).
+ */
+export function ensureCursorUserSettingsSnapshotInBatch(configFiles) {
+    const hasIgnoreKeyInBatch = configFiles.some((c) => c.file_type === 'vscode_settings' &&
+        isPortableCursorUserSettingsUploadPath(c.file_path) &&
+        settingsPayloadHasGlobalIgnoreListKey(c.raw_content));
+    if (hasIgnoreKeyInBatch)
+        return;
+    for (const abs of cursorUserSettingsAbsolutePaths()) {
+        if (!existsSync(abs))
+            continue;
+        const raw = readJSONFile(abs);
+        if (!raw || Object.keys(raw).length === 0)
+            continue;
+        const entry = {
+            file_type: 'vscode_settings',
+            file_path: PORTABLE_CURSOR_USER_SETTINGS,
+            raw_content: raw,
+        };
+        const idx = configFiles.findIndex((c) => c.file_type === 'vscode_settings' &&
+            isPortableCursorUserSettingsUploadPath(c.file_path));
+        if (idx >= 0)
+            configFiles[idx] = entry;
+        else
+            configFiles.push(entry);
+        return;
+    }
+}

package/dist/log_config_files/paths/pattern_resolver.js

@@ -9,7 +9,7 @@ function normalizePathSkipPrefixes(prefixes) {
     return prefixes.filter((p) => typeof p === 'string' && p.length > 0);
 }
 /**
- * Expands glob patterns containing double-asterisk (recursive directory traversal).
+ * Expands glob patterns with double-asterisk (recursive directory traversal).
  *
  * Example: ~/.cursor/plugins/cache/ ** /skills/ recursively finds all skills
  * directories under the cache folder, up to RECURSIVE_GLOB_MAX_DEPTH.

package/dist/log_config_files/runtime/client_event_reporter.js

@@ -31,12 +31,22 @@ function bufferPath() {
         return null;
     return path.join(home, OPT_AI_SEC_MANAGEMENT_REL, 'telemetry', BUFFER_BASENAME);
 }
+/** Keep filename-safe chars only — must match optimus_sanitize_id in optimus-hook-common.sh. */
+function sanitizeId(v) {
+    return v.replace(/[^A-Za-z0-9._-]/g, '');
+}
 /** File start-every-prompt overwrites each submit with this prompt's story id (short-lived handoff). */
 function storyFilePath() {
     const home = process.env.HOME || process.env.USERPROFILE;
     if (!home)
         return null;
-    return path.join(home, OPT_AI_SEC_MANAGEMENT_REL, 'telemetry', 'current_story.id');
+    const telemetryDir = path.join(home, OPT_AI_SEC_MANAGEMENT_REL, 'telemetry');
+    const session = sanitizeId((process.env.OPTIMUS_SESSION_ID || '').trim());
+    if (session) {
+        const agent = sanitizeId((process.env.OPTIMUS_HOOK_TYPE || process.env.OPTIMUS_AGENT || 'claude').trim()) || 'claude';
+        return path.join(telemetryDir, `current_story.${agent}.${session}.id`);
+    }
+    return path.join(telemetryDir, 'current_story.id');
 }
 /** Match shell OPTIMUS_STORY_FILE_MAX_AGE_SEC — ignore stale ids from a prior prompt. */
 const STORY_FILE_MAX_AGE_MS = 180_000;

package/dist/log_config_files/runtime/compliance_check.js

@@ -16,14 +16,14 @@ import { join } from 'node:path';
 import { parseJsonWithJsoncFallback } from '../readers/file_readers.js';
 import { mergeComposerShadowKeysFromReactiveBlob, readVscdbItemTableJson, } from '../readers/vscdb_reader.js';
 import { readRemediationInstructionsFile, writeRemediationInstructionsFile, } from './management_storage.js';
-import { resolveRemediationConfigPath } from './remediation_config_path.js';
+import { resolveRemediationConfigPath, resolveRemediationUploadFileType } from './remediation_config_path.js';
 import { resolveOpsTargetPath } from './ops_target_path.js';
 import { isRemediationQuarantined, markRemediationApplyPendingVerification, markRemediationApplyVerified, processPendingPostRestartVerifications, readRemediationApplyTrackingFile, writeRemediationApplyTrackingFile, } from './remediation_apply_tracking.js';
 import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
 import { isEnvBackedSecretValue, scanJsonForHardcodedSecrets, } from './secret_regex_scan.js';
 import { loadEndpointBase } from '../sender/endpoint_config.js';
 import { resolveHardwareUuid, tryResolveHardwareUuid } from './hardware_uuid.js';
-import { buildDeferredCursorRestartCommand, discoverAllWorkspaceVscdbs, enforceRemediation, fetchSync, isTrustedRestartCommandForAutofix, remediationFixSpec, reportAutofixApplied, syncRemediations, } from './remediation_sync.js';
+import { buildDeferredCursorRestartCommand, discoverAllWorkspaceVscdbs, enforceRemediation, fetchSync, globalCursorIgnoreListFromSettings, GLOBAL_CURSOR_IGNORE_SETTING_PATH, isTrustedRestartCommandForAutofix, remediationFixSpec, reportAutofixApplied, syncRemediations, } from './remediation_sync.js';
 import { sendConfigFile } from '../sender/batch_sender.js';
 import { ensureAuthentication } from '../auth/auth_flow.js';
 /** Normalize manifest/env/CLI agent tokens to a known Agent, or '' if unrecognized. */
@@ -220,6 +220,16 @@ function violationFromSecretScanFinding(entry, compliance, finding) {
         message: `[${compliance.finding_formatted_id}] ${entry.finding_title ?? compliance.description}\nDescription: ${entry.finding_description ?? compliance.description}\nHow to fix: Remove the hardcoded ${finding.secretType} from ${finding.path} in ${entry.config_file_path}`,
     };
 }
+function currentArrayAtComplianceTarget(configJson, targetPath) {
+    if (configJson &&
+        typeof configJson === 'object' &&
+        !Array.isArray(configJson) &&
+        targetPath === GLOBAL_CURSOR_IGNORE_SETTING_PATH) {
+        return globalCursorIgnoreListFromSettings(configJson);
+    }
+    const cur = getByPath(configJson, targetPath);
+    return Array.isArray(cur) ? cur : [];
+}
 function verifyOpsApplied(configJson, settingPath, ops) {
     const parts = settingPath.split('.');
     const leafKey = parts[parts.length - 1] ?? '';
@@ -231,15 +241,16 @@ function verifyOpsApplied(configJson, settingPath, ops) {
     for (const k of keys) {
         const targetPath = resolveOpsTargetPath(settingPath, k);
         if (Object.prototype.hasOwnProperty.call(set, k)) {
-            const cur = getByPath(configJson, targetPath);
             const expected = set[k];
-            if (!remediationSetOpSatisfied(cur, expected)) {
+            const currentForSet = targetPath === GLOBAL_CURSOR_IGNORE_SETTING_PATH
+                ? globalCursorIgnoreListFromSettings(configJson)
+                : getByPath(configJson, targetPath);
+            if (!remediationSetOpSatisfied(currentForSet, expected)) {
                 return { ok: false, expected: { op: 'set', path: targetPath, value: expected } };
             }
             continue;
         }
-        const cur = getByPath(configJson, targetPath);
-        const curArr = Array.isArray(cur) ? cur : [];
+        const curArr = currentArrayAtComplianceTarget(configJson, targetPath);
         const toAdd = add[k] ?? [];
         const toRemove = remove[k] ?? [];
         const isYoloAllowlist = leafKey === 'yoloCommandAllowlist' || targetPath.endsWith('.yoloCommandAllowlist');
@@ -565,9 +576,8 @@ export function reportPostRestartVerificationOutcomes(violations) {
     return { outcomes, reportPromises };
 }
 /**
- * Run immediately after a deferred state.vscdb write lands on disk (post-restart, before the
- * user's next prompt) so `pending_post_restart_verify` remediations are confirmed and reported
- * to the server right away — the UI does not need to wait for another gate invocation.
+ * After deferred vscdb apply (`apply_deferred_vscdb.ts`): confirm pending remediations and POST
+ * outcomes before the user's next prompt.
  */
 export async function runPostApplyVerification(agent = 'cursor') {
     const status = runLocalRemediationComplianceCheck(agent);
@@ -683,7 +693,7 @@ export function applyAutofixViolations(violations, agent = 'cursor') {
                     parseJsonWithJsoncFallback(readFileSync(configPathForDisk, 'utf8')) ?? undefined;
             }
             if (updatedContent !== undefined) {
-                const fileType = (inst.file_type ?? '').trim();
+                const fileType = resolveRemediationUploadFileType(inst.config_file_path, inst.file_type ?? undefined);
                 if (fileType) {
                     const hw = tryResolveHardwareUuid();
                     if (hw) {
@@ -888,8 +898,8 @@ export function uploadSatisfiedManifestConfigs(agent = 'cursor') {
         if (violations.length > 0)
             continue;
         const inst = entry;
-        const fileType = (inst.file_type ?? '').trim();
-        if (!fileType)
+        const uploadFileType = resolveRemediationUploadFileType(entry.config_file_path, inst.file_type ?? undefined);
+        if (!uploadFileType)
             continue;
         const diskPath = resolveRemediationConfigPath(entry.config_file_path);
         if (diskPath.includes('#'))
@@ -914,16 +924,24 @@ export function uploadSatisfiedManifestConfigs(agent = 'cursor') {
             continue;
         }
         const uploadPath = entry.config_file_path.trim() || diskPath;
+        const shouldReportVerified = !prev?.pending_post_restart_verify && !prev?.server_verified_at;
         promises.push(ensureAuthentication(hw)
-            .then((authKey) => sendConfigFile({ file_type: fileType, file_path: uploadPath, raw_content: rawContent }, hw, authKey))
-            .then((sentOk) => {
+            .then((authKey) => sendConfigFile({ file_type: uploadFileType, file_path: uploadPath, raw_content: rawContent }, hw, authKey))
+            .then(async (sentOk) => {
             hookRunLog(`satisfied_upload: uuid=${entry.uuid} path=${uploadPath} ok=${sentOk}`);
-            if (sentOk) {
-                const file = readRemediationApplyTrackingFile();
-                const ent = file.entries[entry.uuid] ?? { consecutive_verify_failures: 0, quarantined: false };
-                ent.last_satisfied_upload_at = new Date().toISOString();
-                file.entries[entry.uuid] = ent;
-                writeRemediationApplyTrackingFile(file);
+            if (!sentOk)
+                return;
+            const file = readRemediationApplyTrackingFile();
+            const ent = file.entries[entry.uuid] ?? { consecutive_verify_failures: 0, quarantined: false };
+            ent.last_satisfied_upload_at = new Date().toISOString();
+            file.entries[entry.uuid] = ent;
+            writeRemediationApplyTrackingFile(file);
+            if (shouldReportVerified) {
+                await reportAutofixApplied(entry.uuid, 'verified', {
+                    config_snapshot_after: rawContent,
+                });
+                markRemediationApplyVerified(entry.uuid);
+                hookRunLog(`satisfied_upload: reported verified uuid=${entry.uuid}`);
             }
         })
             .catch((err) => {
@@ -932,6 +950,35 @@ export function uploadSatisfiedManifestConfigs(agent = 'cursor') {
     }
     return promises;
 }
+/**
+ * When disk already matches remediation ops but autofix never ran, POST verified so the UI
+ * leaves Pending (EnforcementLog) even if satisfied_upload is throttled.
+ */
+export function reportCompliantRemediationVerifiedStatus(agent = 'cursor') {
+    const { remediations } = readRemediationInstructionsFile();
+    const entries = remediations.filter((e) => targetsCurrentAgent(e, agent));
+    const promises = [];
+    for (const entry of entries) {
+        const { violations } = evaluateManifestEntryCompliance(entry);
+        if (violations.length > 0)
+            continue;
+        const tracking = readRemediationApplyTrackingFile();
+        const prev = tracking.entries[entry.uuid];
+        if (prev?.pending_post_restart_verify || prev?.server_verified_at)
+            continue;
+        const diskPath = resolveRemediationConfigPath(entry.config_file_path);
+        if (diskPath.includes('#'))
+            continue;
+        const rawContent = parseJsonWithJsoncFallback(readFileSync(diskPath, 'utf8'));
+        if (rawContent === null)
+            continue;
+        promises.push(reportAutofixApplied(entry.uuid, 'verified', { config_snapshot_after: rawContent }).then(() => {
+            markRemediationApplyVerified(entry.uuid);
+            hookRunLog(`compliance_check: reported verified (already compliant) uuid=${entry.uuid}`);
+        }));
+    }
+    return promises;
+}
 /**
  * Background refresh: server sync for latest instructions, then the same local evaluation as the hook.
  * Apply (autofix) is intentionally deferred to the gate on the next prompt — this pass only downloads

package/dist/log_config_files/runtime/main_runner.js

@@ -15,6 +15,7 @@ import { readJSONFile, readMarkdownFile } from '../readers/file_readers.js';
 import { isVscdbVirtualPath, tryReadVscdbVirtualFile, summarizeComposerPayloadForDiagnostics, } from '../readers/vscdb_config_builder.js';
 import { persistVscdbComposerContractFromPatternsResponse } from '../readers/vscdb_reader.js';
 import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles, collectMcpFromClaudeJsonProjects, collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, determineFileTypeFromPath, } from '../collection/config_collector.js';
+import { ensureCursorUserSettingsSnapshotInBatch } from '../collection/ensure_cursor_user_settings_snapshot.js';
 import { collectSkillsCliInstalled } from '../collection/skills_cli_collector.js';
 import { collectWorkspaceVscdbs } from '../collection/mcp_tool_collector.js';
 import { collectCursorProjectWorkspaceMcpConfigs } from '../collection/cursor_project_mcp_collector.js';
@@ -227,6 +228,7 @@ async function main() {
         throw err;
     }
     await addSensitivePathsAudit(endpointBase, configFiles);
+    ensureCursorUserSettingsSnapshotInBatch(configFiles);
     const fileTypes = [...new Set(configFiles.map((c) => c.file_type))].join(', ');
     hookRunLog(`collected ${configFiles.length} config file(s) file_types=${fileTypes}`);
     for (const c of configFiles) {

package/dist/log_config_files/runtime/remediation_apply_tracking.js

@@ -69,6 +69,7 @@ export function markRemediationApplyPendingVerification(uuid) {
         ...prev,
         pending_post_restart_verify: true,
         last_apply_at: new Date().toISOString(),
+        server_verified_at: undefined,
     };
     writeRemediationApplyTrackingFile(file);
     hookRunLog(`remediation_tracking: pending_post_restart_verify uuid=${uuid}`);
@@ -83,6 +84,7 @@ export function markRemediationApplyVerified(uuid) {
         quarantined: false,
         last_failure_reason: undefined,
         quarantined_at: undefined,
+        server_verified_at: new Date().toISOString(),
     };
     file.entries[uuid] = next;
     writeRemediationApplyTrackingFile(file);

package/dist/log_config_files/runtime/remediation_config_path.js

@@ -15,7 +15,7 @@ function expandLeadingTilde(configFilePath) {
     }
     return configFilePath;
 }
-function cursorUserSettingsAbsolutePaths() {
+export function cursorUserSettingsAbsolutePaths() {
     const h = homedir();
     if (process.platform === 'darwin') {
         const support = join(h, 'Library', 'Application Support');
@@ -127,3 +127,14 @@ export function resolveRemediationConfigPath(configFilePath) {
     }
     return `${candidates[0]}${frag}`;
 }
+/** Correct log-config file_type when manifest rows target Cursor User/settings.json. */
+export function resolveRemediationUploadFileType(configFilePath, manifestFileType) {
+    const t = normalizeSlashes(configFilePath.trim());
+    const portableSettings = PORTABLE_CURSOR_USER_SETTINGS;
+    if (t === portableSettings ||
+        t.endsWith(`/${portableSettings}`) ||
+        t.toLowerCase().includes('cursor/user/settings.json')) {
+        return 'vscode_settings';
+    }
+    return (manifestFileType ?? '').trim();
+}

package/dist/log_config_files/runtime/remediation_sync.js

@@ -355,6 +355,50 @@ function applyStringArrayDelta(current, before, after) {
     }
     return next;
 }
+export const GLOBAL_CURSOR_IGNORE_SETTING_PATH = 'cursor.general.globalCursorIgnoreList';
+export function isGlobalCursorIgnoreRemediationViolation(v) {
+    return (v.setting_path ?? '').trim() === GLOBAL_CURSOR_IGNORE_SETTING_PATH;
+}
+/** Match server scan: flat VS Code key wins when present (including []). */
+export function globalCursorIgnoreListFromSettings(configJson) {
+    const flat = configJson[GLOBAL_CURSOR_IGNORE_SETTING_PATH];
+    if (Array.isArray(flat))
+        return flat;
+    const nested = getByPath(configJson, GLOBAL_CURSOR_IGNORE_SETTING_PATH);
+    if (Array.isArray(nested))
+        return nested;
+    return [];
+}
+export function persistGlobalCursorIgnoreList(configJson, list) {
+    configJson[GLOBAL_CURSOR_IGNORE_SETTING_PATH] = list;
+    setByPathNested(configJson, GLOBAL_CURSOR_IGNORE_SETTING_PATH, list);
+}
+/** Keep flat and nested global ignore lists aligned; prefer flat when it is an array. */
+function syncFlatGlobalCursorIgnoreListKey(configJson) {
+    const flat = configJson[GLOBAL_CURSOR_IGNORE_SETTING_PATH];
+    if (Array.isArray(flat)) {
+        setByPathNested(configJson, GLOBAL_CURSOR_IGNORE_SETTING_PATH, flat);
+        return;
+    }
+    const nested = getByPath(configJson, GLOBAL_CURSOR_IGNORE_SETTING_PATH);
+    if (Array.isArray(nested)) {
+        configJson[GLOBAL_CURSOR_IGNORE_SETTING_PATH] = nested;
+    }
+}
+function listForComplianceTarget(configJson, targetPath) {
+    if (targetPath === GLOBAL_CURSOR_IGNORE_SETTING_PATH) {
+        return [...globalCursorIgnoreListFromSettings(configJson)];
+    }
+    const curVal = getByPath(configJson, targetPath);
+    return Array.isArray(curVal) ? [...curVal] : [];
+}
+function writeListAtComplianceTarget(configJson, targetPath, next) {
+    if (targetPath === GLOBAL_CURSOR_IGNORE_SETTING_PATH) {
+        persistGlobalCursorIgnoreList(configJson, next);
+        return;
+    }
+    setByPath(configJson, targetPath, next);
+}
 function applyCheck(configJson, check) {
     const parts = check.setting_path.split('.');
     const leafKey = parts[parts.length - 1] ?? '';
@@ -370,11 +414,16 @@ function applyCheck(configJson, check) {
         for (const k of keys) {
             const targetPath = resolveOpsTargetPath(check.setting_path, k);
             if (set && Object.prototype.hasOwnProperty.call(set, k)) {
-                setByPath(configJson, targetPath, set[k]);
+                const value = set[k];
+                if (targetPath === GLOBAL_CURSOR_IGNORE_SETTING_PATH && Array.isArray(value)) {
+                    persistGlobalCursorIgnoreList(configJson, value);
+                }
+                else {
+                    setByPath(configJson, targetPath, value);
+                }
                 continue;
             }
-            const curVal = getByPath(configJson, targetPath);
-            const cur = Array.isArray(curVal) ? [...curVal] : [];
+            const cur = listForComplianceTarget(configJson, targetPath);
             const toRemove = (remove && remove[k]) ?? [];
             const toAdd = (add && add[k]) ?? [];
             const next = cur.filter((x) => !toRemove.some((item) => deepEqual(item, x)));
@@ -383,7 +432,7 @@ function applyCheck(configJson, check) {
                     next.push(x);
                 }
             }
-            setByPath(configJson, targetPath, next);
+            writeListAtComplianceTarget(configJson, targetPath, next);
         }
         return;
     }
@@ -1051,8 +1100,8 @@ export async function applyDeferredVscdbFromDisk() {
  * macOS Cursor: after deferred **SQLite / state.vscdb** autofix — apply queued writes, SIGKILL, reopen project.
  *
  * When autofix used the deferred vscdb path, `applyAutofixViolations` replaces any manifest `restart_command`
- * with this string (see compliance_check.ts). For **JSON settings-file** remediations only, the trusted template
- * is the JSON-settings-only Cursor template (kill + reopen, no `apply_deferred_vscdb`).
+ * with this string (see compliance_check.ts). For **JSON settings-file** remediations, use
+ * {@link buildCursorJsonSettingsRestartCommand} (kill + reopen).
  */
 export function buildDeferredCursorRestartCommand() {
     // Prefer monorepo path when hooks run from optimus-secure-fdn; otherwise `npx --yes log-llm-config@latest apply-deferred-vscdb`
@@ -1062,6 +1111,20 @@ export function buildDeferredCursorRestartCommand() {
 export function buildCursorJsonSettingsRestartCommand() {
     return TRUSTED_CURSOR_JSON_SETTINGS_RESTART_COMMAND;
 }
+/**
+ * Cursor JSON settings are written synchronously; when local recheck passes, report verified before
+ * restart (restart only reloads disk into the running app). Deferred state.vscdb must wait until
+ * apply_deferred_vscdb runs in the trusted restart script, then the next compliance gate.
+ */
+export function cursorAutofixDefersInlineVerify(ide, restartCommandCount, deferredSqlitePending, recheckOk) {
+    if (ide !== 'cursor' || restartCommandCount === 0)
+        return false;
+    if (deferredSqlitePending)
+        return true;
+    if (recheckOk)
+        return false;
+    return true;
+}
 function sqliteRowGroupKey(dbPath, op) {
     return `${dbPath}|${op.table}|${op.key_column}|${op.value_column}|${op.target_key}`;
 }
@@ -1413,6 +1476,7 @@ export function enforceRemediation(instruction) {
         for (const check of checks) {
             applyCheck(configJson, check);
         }
+        syncFlatGlobalCursorIgnoreListKey(configJson);
         const content = JSON.stringify(configJson, null, 2);
         const tmp = `${inst.config_file_path}.tmp`;
         writeFileSync(tmp, content, 'utf8');
@@ -1463,8 +1527,12 @@ export function reportAutofixApplied(remediationUuid, result, details) {
         payload.failure_reason = details.failure_reason.slice(0, 2000);
     if (details?.consecutive_failures != null)
         payload.consecutive_failures = details.consecutive_failures;
+    const bodyPayload = { ...payload, signature: '' };
+    if (details?.config_snapshot_after && typeof details.config_snapshot_after === 'object') {
+        bodyPayload.config_snapshot_after = details.config_snapshot_after;
+    }
     const signature = createSignature(payload, authKey.key);
-    const body = JSON.stringify({ ...payload, signature });
+    const body = JSON.stringify({ ...bodyPayload, signature });
     return executeBody(url, 'POST', body, 8000)
         .then(({ statusCode }) => {
         if (statusCode === 200) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {