log-llm-config 1.5.11 → 1.5.15

package/dist/compliance_prompt_gate.js

@@ -119,20 +119,20 @@ function autofixDialogLine(v) {
     const short = d.length > 160 ? `${d.slice(0, 157)}…` : d;
     return `• [${v.finding_formatted_id}] ${short}`;
 }
-/** Policy name(s) for preventive enforcement dialog copy. */
-function uniquePolicyLabelsFromViolations(appliedViolations) {
-    const policyNames = [
+/** Ruleset name(s) for preventive enforcement dialog copy. */
+function uniqueRulesetLabelsFromViolations(appliedViolations) {
+    const rulesetNames = [
         ...new Set(appliedViolations
-            .map((v) => v.policy_name?.trim() || v.finding_title?.trim() || '')
+            .map((v) => v.ruleset_name?.trim() || v.finding_title?.trim() || '')
             .filter(Boolean)),
     ];
-    return policyNames.length > 0 ? policyNames.join('\n\n') : 'Agent security policy';
+    return rulesetNames.length > 0 ? rulesetNames.join('\n\n') : 'Agent security policy';
 }
 function formatPreventiveAutofixDialog(appliedViolations, applyLine) {
     const changePreview = formatRemediationChangePreviewForApplied(appliedViolations);
     const changePreviewBlock = changePreview ? `${changePreview}\n\n` : '';
     return ('Optimus Labs enforced a preventive agent security policy as determined by your security team:\n\n' +
-        `${uniquePolicyLabelsFromViolations(appliedViolations)}\n\n` +
+        `${uniqueRulesetLabelsFromViolations(appliedViolations)}\n\n` +
         changePreviewBlock +
         `${applyLine}\n\n` +
         'Click OK to continue');
@@ -339,7 +339,7 @@ export async function runCompliancePromptGate() {
                             ? formatCopilotAutofixDialog(appliedViolations)
                             : ide === 'opencode'
                                 ? formatOpenCodeAutofixDialog(appliedViolations)
-                                : `Optimus Labs auto-fixed ${fixed} ${fixed === 1 ? 'policy violation' : 'policy violations'}:\n\n${appliedViolations
+                                : `Optimus Labs auto-fixed ${fixed} ${fixed === 1 ? 'ruleset violation' : 'ruleset violations'}:\n\n${appliedViolations
                                     .map((v) => autofixDialogLine(v))
                                     .join('\n')}${changePreviewSuffix}`;
                 const payload = { __optimus_autofix: true, autofix_message: autofixMessage };
@@ -349,7 +349,7 @@ export async function runCompliancePromptGate() {
                 // Restarts: always executed by optimus-compliance-check.sh via execute_trusted_restarts (TS allowlist + spawn).
                 return;
             }
-            const msg = recheck.violations[0]?.message ?? 'A security policy violation has been detected.';
+            const msg = recheck.violations[0]?.message ?? 'A security ruleset violation has been detected.';
             logRemediationApplyFailure('prompt_gate_block_recheck_failed', {
                 reason: 'after autofix, local compliance recheck still reports violations',
                 ide,
@@ -372,7 +372,7 @@ export async function runCompliancePromptGate() {
             console.log(blockPayload(ide, msg));
             return;
         }
-        const msg = status.violations[0]?.message ?? 'A security policy violation has been detected.';
+        const msg = status.violations[0]?.message ?? 'A security ruleset violation has been detected.';
         logRemediationApplyFailure('prompt_gate_block_violations_no_autofix_applied', {
             reason: 'violations on submit but autofix did not succeed — see autofix_skipped_not_allowed, enforceRemediation, or compliance_check entries',
             ide,

package/dist/log_config_files/collection/claude_token_usage_collector.js

@@ -25,18 +25,34 @@ function emptyTotals() {
 }
 function addUsage(totals, usage) {
     for (const key of Object.keys(totals)) {
-        const value = usage[key];
-        if (typeof value === 'number' && Number.isFinite(value))
+        const value = readTokenField(usage, key);
+        if (value > 0)
             totals[key] += value;
     }
 }
-/** Sum the token fields of one usage block (used for per-model attribution). */
+/** Read one token field, preferring the nested 5m+1h cache-creation sum over the flat field. */
+function readTokenField(usage, key) {
+    if (key === 'cache_creation_input_tokens') {
+        const nested = usage.cache_creation;
+        if (nested && typeof nested === 'object') {
+            const n = nested;
+            const has5m = typeof n.ephemeral_5m_input_tokens === 'number' && Number.isFinite(n.ephemeral_5m_input_tokens);
+            const has1h = typeof n.ephemeral_1h_input_tokens === 'number' && Number.isFinite(n.ephemeral_1h_input_tokens);
+            // Fall back to the flat field only when the nested block is truly absent — a
+            // legitimately-zero nested sum (both fields present as 0) must not be overridden by it.
+            if (has5m || has1h) {
+                return (has5m ? n.ephemeral_5m_input_tokens : 0) + (has1h ? n.ephemeral_1h_input_tokens : 0);
+            }
+        }
+    }
+    const value = usage[key];
+    return typeof value === 'number' && Number.isFinite(value) ? value : 0;
+}
+/** Sum the token fields of one usage block (used for per-model attribution and dedup tiebreaks). */
 function usageSum(usage) {
     let sum = 0;
     for (const key of ['input_tokens', 'output_tokens', 'cache_creation_input_tokens', 'cache_read_input_tokens']) {
-        const value = usage[key];
-        if (typeof value === 'number' && Number.isFinite(value))
-            sum += value;
+        sum += readTokenField(usage, key);
     }
     return sum;
 }
@@ -86,6 +102,14 @@ function collectClaudeTokenUsage(home = homedir()) {
     let version = '';
     let versionAt = '';
     let sawData = false;
+    // Claude Code writes one JSONL line per streaming snapshot of the same assistant message,
+    // so message.id/requestId repeat with a growing usage total; only the final snapshot is
+    // the true total. Dedup by (message.id, requestId), taking the per-field max across all
+    // snapshots for that key (order-independent — robust to out-of-order lines, and safe even
+    // if a snapshot has a genuinely-lower or reset value in one field while another snapshot in
+    // the same group peaks a different field). Entries without a message.id can't be deduped and
+    // are accumulated directly.
+    const dedupedUsage = new Map();
     for (const file of files) {
         let content;
         try {
@@ -125,16 +149,39 @@ function collectClaudeTokenUsage(home = homedir()) {
                     models.add(model);
                 if (msg.usage && typeof msg.usage === 'object') {
                     const usage = msg.usage;
-                    addUsage(totals, usage);
-                    if (model) {
+                    const messageId = typeof msg.id === 'string' ? msg.id : '';
+                    if (messageId) {
+                        const requestId = typeof entry.requestId === 'string' ? entry.requestId : '';
+                        const dedupeKey = `${messageId} ${requestId}`;
+                        const existing = dedupedUsage.get(dedupeKey) ?? { totals: emptyTotals(), model: '' };
+                        for (const key of Object.keys(existing.totals)) {
+                            const value = readTokenField(usage, key);
+                            if (value > existing.totals[key])
+                                existing.totals[key] = value;
+                        }
+                        if (model)
+                            existing.model = model;
+                        dedupedUsage.set(dedupeKey, existing);
+                    }
+                    else {
+                        addUsage(totals, usage);
                         const sum = usageSum(usage);
-                        if (sum > 0)
+                        if (model && sum > 0)
                             modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + sum;
                     }
                 }
             }
         }
     }
+    for (const { totals: merged, model } of dedupedUsage.values()) {
+        let sum = 0;
+        for (const key of Object.keys(totals)) {
+            totals[key] += merged[key];
+            sum += merged[key];
+        }
+        if (model && sum > 0)
+            modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + sum;
+    }
     if (!sawData)
         return [];
     return [

package/dist/log_config_files/collection/config_collector.js

@@ -236,6 +236,7 @@ export { collectHermesTokenUsage } from './hermes_token_usage_collector.js';
 export { collectOpenclawTokenUsage } from './openclaw_token_usage_collector.js';
 export { collectPiTokenUsage } from './pi_token_usage_collector.js';
 export { collectCoworkDesktopVersion } from './cowork_desktop_version_collector.js';
+export { collectGrokCliVersion } from './grok_cli_version_collector.js';
 export { collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, mergeClaudeDesktopExtensionEnableSettings, } from './claude_desktop_extensions_collector.js';
 export { collectCursorProjectWorkspaceMcpConfigs } from './cursor_project_mcp_collector.js';
 export { determineFileTypeFromPath } from './file_type_rules.js';

package/dist/log_config_files/collection/cursor_project_mcp_collector.js

@@ -188,6 +188,9 @@ function collectCursorProjectWorkspaceMcpConfigs(pathSkipPrefixes = [], constant
                         cursor_source: 'mcps',
                         server_identifier: serverDir.name,
                     };
+                    if (metaObj) {
+                        entry.cursor_server_metadata = metaObj;
+                    }
                     const cacheTools = cursorMcpCacheToolsForServer(mcpToolCache, label, serverDir.name);
                     if (cacheTools !== undefined) {
                         entry.cursor_mcp_cache_tools = cacheTools;

package/dist/log_config_files/collection/grok_cli_version_collector.js

@@ -0,0 +1,53 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * Grok CLI version, read directly from the installed binary.
+ *
+ * Grok ships as a standalone native binary (not an npm/pip package, no manifest to read a
+ * version out of), installed at ~/.grok/bin/grok and typically symlinked onto PATH. The only
+ * way to get its version is to run it: `grok --version` prints e.g. "grok 0.2.114 (0c785038798)".
+ */
+const FILE_TYPE = 'grok_cli_version';
+const VERSION_RE = /^grok\s+(\d+\.\d+\.\d+)(?:\s+\(([0-9a-f]+)\))?/i;
+function grokBinPath(home) {
+    return join(home, '.grok', 'bin', 'grok');
+}
+/** `<binPath> --version`, parsed into {version, build, raw}, or null if unavailable/unparsable. */
+function readGrokVersion(binPath) {
+    let stdout;
+    try {
+        stdout = execFileSync(binPath, ['--version'], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 5000,
+        }).trim();
+    }
+    catch {
+        return null;
+    }
+    const match = VERSION_RE.exec(stdout);
+    if (!match)
+        return null;
+    return { version: match[1], build: match[2] ?? '', raw: stdout };
+}
+/**
+ * Emit the Grok CLI version as a single-element aggregate, or [] when Grok isn't installed
+ * or its version can't be determined.
+ */
+function collectGrokCliVersion(home = homedir(), binPath = grokBinPath(home)) {
+    if (!existsSync(binPath))
+        return [];
+    const parsed = readGrokVersion(binPath);
+    if (!parsed)
+        return [];
+    return [
+        {
+            file_type: FILE_TYPE,
+            file_path: binPath,
+            raw_content: parsed,
+        },
+    ];
+}
+export { collectGrokCliVersion, FILE_TYPE as GROK_CLI_VERSION_FILE_TYPE };

package/dist/log_config_files/readers/file_readers.js

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync } from 'node:fs';
+import { parse as parseToml, stringify as stringifyTomlValue } from 'smol-toml';
 function stripJsoncComments(input) {
     let out = '';
     let inString = false;
@@ -176,4 +177,20 @@ function readInstalledExtensions(extensionsCachePath) {
     }
     return extensions;
 }
-export { readMCPConfig, readJSONFile, readMarkdownFile, readInstalledExtensions, parseJsonWithJsoncFallback, };
+/** Parse TOML text into a nested object. Returns null on parse failure. */
+function parseTomlText(raw) {
+    try {
+        const parsed = parseToml(raw);
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Serialize a nested object to TOML (used when writing remediated .toml configs). */
+function stringifyToml(value) {
+    return stringifyTomlValue(value);
+}
+export { readMCPConfig, readJSONFile, readMarkdownFile, readInstalledExtensions, parseJsonWithJsoncFallback, parseTomlText, stringifyToml, };

package/dist/log_config_files/runtime/compliance_check.js

@@ -13,7 +13,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { parseJsonWithJsoncFallback } from '../readers/file_readers.js';
+import { parseJsonWithJsoncFallback, parseTomlText } from '../readers/file_readers.js';
 import { mergeComposerShadowKeysFromReactiveBlob, readVscdbItemTableJson, } from '../readers/vscdb_reader.js';
 import { readRemediationInstructionsFile, writeRemediationInstructionsFile, } from './management_storage.js';
 import { resolveRemediationConfigPath, resolveRemediationUploadFileType } from './remediation_config_path.js';
@@ -212,7 +212,7 @@ function violationFromSecretScanFinding(entry, compliance, finding) {
         description: compliance.description,
         finding_title: entry.finding_title,
         finding_description: entry.finding_description,
-        policy_name: entry.policy_name,
+        ruleset_name: entry.ruleset_name,
         severity: compliance.severity,
         autofix_allowed: compliance.autofix_allowed,
         config_file_path: entry.config_file_path,
@@ -280,7 +280,7 @@ function shouldMergeComposerShadowKeys(itemKeyFromPath, checkSettingPaths) {
 }
 /** @deprecated Import from vscdb_reader — re-export for existing tests. */
 export { mergeComposerShadowKeysFromReactiveBlob } from '../readers/vscdb_reader.js';
-/** Plain JSON file or virtual `…/state.vscdb#itemKey` path for ItemTable-backed settings. */
+/** Plain JSON/TOML file or virtual `…/state.vscdb#itemKey` path for ItemTable-backed settings. */
 function loadRemediationConfigJson(configFilePath, checkSettingPaths = []) {
     const resolvedPath = resolveRemediationConfigPath(configFilePath);
     const hashIdx = resolvedPath.indexOf('#');
@@ -306,13 +306,23 @@ function loadRemediationConfigJson(configFilePath, checkSettingPaths = []) {
     }
     if (!existsSync(resolvedPath))
         return { ok: false, reason: 'file_not_found' };
+    const rawText = readFileSync(resolvedPath, 'utf8');
+    if (resolvedPath.toLowerCase().endsWith('.toml')) {
+        const parsedToml = parseTomlText(rawText);
+        if (parsedToml === null)
+            return { ok: false, reason: 'parse_error' };
+        return { ok: true, json: parsedToml };
+    }
     // OpenCode configs are JSONC (comments / trailing commas); parse strict JSON first, then
     // fall back to JSONC sanitization so comment-bearing files are not skipped as parse_error.
-    const parsed = parseJsonWithJsoncFallback(readFileSync(resolvedPath, 'utf8'));
+    const parsed = parseJsonWithJsoncFallback(rawText);
     if (parsed === null)
         return { ok: false, reason: 'parse_error' };
     return { ok: true, json: parsed };
 }
+function isSupportedTextConfigFormat(fileFormat) {
+    return fileFormat === 'json' || fileFormat === 'toml';
+}
 /**
  * Evaluate all checks in a secondary group against the group's config file.
  * Returns true only if every check passes (ops-based). Non-ops checks are treated as failing.
@@ -343,7 +353,7 @@ function violationFromCheck(entry, compliance, check, expected) {
         description: check.description,
         finding_title: entry.finding_title,
         finding_description: entry.finding_description,
-        policy_name: entry.policy_name,
+        ruleset_name: entry.ruleset_name,
         severity: compliance.severity,
         autofix_allowed: compliance.autofix_allowed,
         config_file_path: entry.config_file_path,
@@ -354,7 +364,7 @@ function violationFromCheck(entry, compliance, check, expected) {
 /** Evaluate one manifest row against on-disk config (used by gate + post-restart verify). */
 export function evaluateManifestEntryCompliance(entry) {
     const compliance = entry.fix ?? entry.compliance;
-    if (!compliance || compliance.file_format !== 'json')
+    if (!compliance || !isSupportedTextConfigFormat(compliance.file_format))
         return { violations: [] };
     const checks = compliance.checks ?? [];
     if (checks.length === 0)
@@ -463,9 +473,9 @@ export function runLocalRemediationComplianceCheck(agent = 'cursor') {
                 skippedNoCompliance++;
                 continue;
             }
-            if (compliance.file_format !== 'json') {
+            if (!isSupportedTextConfigFormat(compliance.file_format)) {
                 skippedNonJson++;
-                hookRunLog(`compliance_check: skipping non-json entry uuid=${entry.uuid}`);
+                hookRunLog(`compliance_check: skipping unsupported file_format=${compliance.file_format} uuid=${entry.uuid}`);
                 continue;
             }
             if ((compliance.checks ?? []).length === 0) {
@@ -795,7 +805,7 @@ export function pruneSatisfiedOneTimeRemediations(agent = 'cursor') {
             continue;
         }
         const spec = remediationFixSpec(inst);
-        const checks = spec?.file_format === 'json' ? (spec.checks ?? []) : [];
+        const checks = isSupportedTextConfigFormat(spec?.file_format) ? (spec?.checks ?? []) : [];
         if (checks.length === 0) {
             remaining.push(raw);
             continue;

package/dist/log_config_files/runtime/main_runner.js

@@ -14,7 +14,7 @@ import { ensureAuthentication } from '../auth/auth_flow.js';
 import { readJSONFile, readMarkdownFile } from '../readers/file_readers.js';
 import { isVscdbVirtualPath, tryReadVscdbVirtualFile, summarizeComposerPayloadForDiagnostics, } from '../readers/vscdb_config_builder.js';
 import { persistVscdbComposerContractFromPatternsResponse } from '../readers/vscdb_reader.js';
-import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles, collectMcpFromClaudeJsonProjects, collectClaudeTokenUsage, collectCopilotTokenUsage, collectOpencodeTokenUsage, collectCodexTokenUsage, collectCursorTokenUsage, collectHermesTokenUsage, collectOpenclawTokenUsage, collectPiTokenUsage, collectCoworkDesktopVersion, collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, determineFileTypeFromPath, } from '../collection/config_collector.js';
+import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles, collectMcpFromClaudeJsonProjects, collectClaudeTokenUsage, collectCopilotTokenUsage, collectOpencodeTokenUsage, collectCodexTokenUsage, collectCursorTokenUsage, collectHermesTokenUsage, collectOpenclawTokenUsage, collectPiTokenUsage, collectCoworkDesktopVersion, collectGrokCliVersion, collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, determineFileTypeFromPath, } from '../collection/config_collector.js';
 import { ensureCursorUserSettingsSnapshotInBatch } from '../collection/ensure_cursor_user_settings_snapshot.js';
 import { collectSkillsCliInstalled } from '../collection/skills_cli_collector.js';
 import { collectWorkspaceVscdbs } from '../collection/mcp_tool_collector.js';
@@ -170,6 +170,14 @@ async function collectAllConfigFiles(endpointBase) {
             configFiles.push(entry);
         }
     }
+    hookRunLog(`reading Grok CLI version`);
+    for (const entry of collectGrokCliVersion(HOME_DIR)) {
+        const key = `${entry.file_type}\t${entry.file_path}`;
+        if (!existingPaths.has(key)) {
+            existingPaths.add(key);
+            configFiles.push(entry);
+        }
+    }
     hookRunLog(`merging disk-only Claude Desktop extensions into extensions-installations.json`);
     const diskExtMerge = enrichClaudeDesktopExtensionsInstallationsUpload(configFiles, HOME_DIR);
     hookRunLog(`claude desktop extensions: merged=${diskExtMerge.mergedCount} had_registry_upload=${diskExtMerge.hadRegistryUpload}`);

package/dist/log_config_files/runtime/remediation_apply_tracking.js

@@ -5,7 +5,7 @@
  */
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { atomicWriteJson, getRemediationStateDir } from './management_storage.js';
+import { atomicWriteJson, getDeferredVscdbApplyPath, getRemediationStateDir, } from './management_storage.js';
 import { hookRunLog } from './hook_logger.js';
 export const REMEDIATION_APPLY_TRACKING_BASENAME = 'remediation_apply_tracking.json';
 /** Consecutive post-restart verification failures before we stop autofix for a UUID. */
@@ -116,6 +116,9 @@ export function recordRemediationVerificationFailure(uuid, reason) {
  * supported for unit tests only — do not use a global violation list from compliance_check
  * in production: shadow-key merge bugs once made that list empty while the setting was still
  * wrong, which incorrectly marked remediations verified.
+ *
+ * If the deferred vscdb queue file is still on disk, Cursor restart / apply_deferred_vscdb has
+ * not completed — leave pending and do not quarantine (setting unchanged is expected).
  */
 export function processPendingPostRestartVerifications(violationProbe) {
     const isStillViolating = typeof violationProbe === 'function'
@@ -123,6 +126,7 @@ export function processPendingPostRestartVerifications(violationProbe) {
         : (uuid) => violationProbe.has(uuid);
     const file = readRemediationApplyTrackingFile();
     const outcomes = [];
+    const deferredQueuePending = existsSync(getDeferredVscdbApplyPath());
     for (const [uuid, entry] of Object.entries(file.entries)) {
         if (!entry.pending_post_restart_verify)
             continue;
@@ -131,6 +135,10 @@ export function processPendingPostRestartVerifications(violationProbe) {
             outcomes.push({ uuid, status: 'verified', consecutive_failures: 0 });
             continue;
         }
+        if (deferredQueuePending) {
+            hookRunLog(`remediation_tracking: defer verify uuid=${uuid} — deferred vscdb queue still pending (restart/apply not done yet)`);
+            continue;
+        }
         const reason = 'Setting unchanged after apply — the agent may have changed its config format and auto-fix cannot apply this policy.';
         const { entry: updated, newlyQuarantined } = recordRemediationVerificationFailure(uuid, reason);
         outcomes.push({

package/dist/log_config_files/runtime/remediation_sync.js

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, rename
 import { delimiter, dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { executeBody } from '../../endpoint_client/http_transport.js';
-import { parseJsonWithJsoncFallback } from '../readers/file_readers.js';
+import { parseJsonWithJsoncFallback, parseTomlText, stringifyToml } from '../readers/file_readers.js';
 import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
 import { atomicWriteJson, getDeferredVscdbApplyPath, getFileCollectionVscdbContractPath, getRemediationInstructionsPath, readRemediationInstructionsFile, writeRemediationInstructionsFile, } from './management_storage.js';
 import { readStoredAuthKey } from '../auth/auth_key_store.js';
@@ -1031,10 +1031,15 @@ export async function applyDeferredVscdbFromDisk() {
         return true;
     }
     try {
+        let applied = 0;
+        let skippedMissing = 0;
         for (const it of payload.items) {
+            // Workspace storage can disappear between queue and restart (Cursor GC). Skip those
+            // items instead of aborting the whole batch — other workspaces still need the write.
             if (!existsSync(it.dbPath)) {
-                hookRunLog(`deferred_vscdb: database missing ${it.dbPath}`);
-                return false;
+                hookRunLog(`deferred_vscdb: database missing — skipping ${it.dbPath}`);
+                skippedMissing++;
+                continue;
             }
             if (!assertSafeSqliteIdentifiersForItemTable(it.table, it.key_column, it.value_column)) {
                 return false;
@@ -1047,8 +1052,9 @@ export async function applyDeferredVscdbFromDisk() {
                 hookRunLog(`deferred_vscdb: INSERT OR REPLACE changed 0 rows key=${it.target_key} db=${it.dbPath} — keeping queue file`);
                 return false;
             }
+            applied++;
         }
-        hookRunLog(`deferred_vscdb: applied ${payload.items.length} queued update(s)`);
+        hookRunLog(`deferred_vscdb: applied ${applied} queued update(s) skipped_missing=${skippedMissing}`);
         const authKey = readStoredAuthKey();
         for (const u of postApplyUploads) {
             if (!authKey) {
@@ -1422,7 +1428,7 @@ export function enforceRemediation(instruction) {
             }
             return { ok: true, deferredSqlite: false };
         }
-        if (fixSpec?.file_format !== 'json') {
+        if (fixSpec?.file_format !== 'json' && fixSpec?.file_format !== 'toml') {
             return fail(`unsupported file format: ${String(fixSpec?.file_format ?? 'undefined')}`);
         }
         const worktreeRoot = parseWorktreeRootFromPath(inst.config_file_path);
@@ -1445,26 +1451,39 @@ export function enforceRemediation(instruction) {
         else if (!existsSync(dir)) {
             mkdirSync(dir, { recursive: true, mode: 0o700 });
         }
-        let configJson = {};
+        const isToml = fixSpec?.file_format === 'toml';
+        let configObj = {};
         if (existsSync(inst.config_file_path)) {
-            // OpenCode configs are JSONC; parse strict JSON first, then JSONC fallback so a
-            // comment-bearing opencode.json(c) keeps its existing settings instead of being reset to
-            // {} on a parse failure. NOTE: the write-back below is JSON.stringify, so comments and
-            // trailing commas in the original file are not preserved (same as every other agent's
-            // JSON config) — only the key/value settings are retained and patched.
-            const parsed = parseJsonWithJsoncFallback(readFileSync(inst.config_file_path, 'utf8'));
-            if (parsed !== null) {
-                configJson = parsed;
+            const rawText = readFileSync(inst.config_file_path, 'utf8');
+            if (isToml) {
+                const parsed = parseTomlText(rawText);
+                if (parsed !== null) {
+                    configObj = parsed;
+                }
+                else {
+                    hookRunLog(`remediation_enforce: could not parse existing TOML file, starting fresh uuid=${inst.uuid}`);
+                }
             }
             else {
-                hookRunLog(`remediation_enforce: could not parse existing file, starting fresh uuid=${inst.uuid}`);
+                // OpenCode configs are JSONC; parse strict JSON first, then JSONC fallback so a
+                // comment-bearing opencode.json(c) keeps its existing settings instead of being reset to
+                // {} on a parse failure. NOTE: the write-back below is JSON.stringify, so comments and
+                // trailing commas in the original file are not preserved (same as every other agent's
+                // JSON config) — only the key/value settings are retained and patched.
+                const parsed = parseJsonWithJsoncFallback(rawText);
+                if (parsed !== null) {
+                    configObj = parsed;
+                }
+                else {
+                    hookRunLog(`remediation_enforce: could not parse existing file, starting fresh uuid=${inst.uuid}`);
+                }
             }
         }
         for (const check of checks) {
-            applyCheck(configJson, check);
+            applyCheck(configObj, check);
         }
-        syncFlatGlobalCursorIgnoreListKey(configJson);
-        const content = JSON.stringify(configJson, null, 2);
+        syncFlatGlobalCursorIgnoreListKey(configObj);
+        const content = isToml ? stringifyToml(configObj) : JSON.stringify(configObj, null, 2);
         const tmp = `${inst.config_file_path}.tmp`;
         writeFileSync(tmp, content, 'utf8');
         renameSync(tmp, inst.config_file_path);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config",
-  "version": "1.5.11",
+  "version": "1.5.15",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {
@@ -56,8 +56,9 @@
     "vitest": "^4.1.8"
   },
   "dependencies": {
-    "axios": "^1.15.2",
+    "axios": "^1.18.1",
     "canonicalize": "^2.1.0",
-    "optimus-tofu": "^0.1.18"
+    "optimus-tofu": "^0.1.18",
+    "smol-toml": "^1.7.1"
   }
 }