log-llm-config 1.5.14 → 1.5.18

package/dist/compliance_prompt_gate.js

@@ -119,20 +119,20 @@ function autofixDialogLine(v) {
     const short = d.length > 160 ? `${d.slice(0, 157)}…` : d;
     return `• [${v.finding_formatted_id}] ${short}`;
 }
-/** Policy name(s) for preventive enforcement dialog copy. */
-function uniquePolicyLabelsFromViolations(appliedViolations) {
-    const policyNames = [
+/** Ruleset name(s) for preventive enforcement dialog copy. */
+function uniqueRulesetLabelsFromViolations(appliedViolations) {
+    const rulesetNames = [
         ...new Set(appliedViolations
-            .map((v) => v.policy_name?.trim() || v.finding_title?.trim() || '')
+            .map((v) => v.ruleset_name?.trim() || v.finding_title?.trim() || '')
             .filter(Boolean)),
     ];
-    return policyNames.length > 0 ? policyNames.join('\n\n') : 'Agent security policy';
+    return rulesetNames.length > 0 ? rulesetNames.join('\n\n') : 'Agent security policy';
 }
 function formatPreventiveAutofixDialog(appliedViolations, applyLine) {
     const changePreview = formatRemediationChangePreviewForApplied(appliedViolations);
     const changePreviewBlock = changePreview ? `${changePreview}\n\n` : '';
     return ('Optimus Labs enforced a preventive agent security policy as determined by your security team:\n\n' +
-        `${uniquePolicyLabelsFromViolations(appliedViolations)}\n\n` +
+        `${uniqueRulesetLabelsFromViolations(appliedViolations)}\n\n` +
         changePreviewBlock +
         `${applyLine}\n\n` +
         'Click OK to continue');
@@ -339,7 +339,7 @@ export async function runCompliancePromptGate() {
                             ? formatCopilotAutofixDialog(appliedViolations)
                             : ide === 'opencode'
                                 ? formatOpenCodeAutofixDialog(appliedViolations)
-                                : `Optimus Labs auto-fixed ${fixed} ${fixed === 1 ? 'policy violation' : 'policy violations'}:\n\n${appliedViolations
+                                : `Optimus Labs auto-fixed ${fixed} ${fixed === 1 ? 'ruleset violation' : 'ruleset violations'}:\n\n${appliedViolations
                                     .map((v) => autofixDialogLine(v))
                                     .join('\n')}${changePreviewSuffix}`;
                 const payload = { __optimus_autofix: true, autofix_message: autofixMessage };
@@ -349,7 +349,7 @@ export async function runCompliancePromptGate() {
                 // Restarts: always executed by optimus-compliance-check.sh via execute_trusted_restarts (TS allowlist + spawn).
                 return;
             }
-            const msg = recheck.violations[0]?.message ?? 'A security policy violation has been detected.';
+            const msg = recheck.violations[0]?.message ?? 'A security ruleset violation has been detected.';
             logRemediationApplyFailure('prompt_gate_block_recheck_failed', {
                 reason: 'after autofix, local compliance recheck still reports violations',
                 ide,
@@ -372,7 +372,7 @@ export async function runCompliancePromptGate() {
             console.log(blockPayload(ide, msg));
             return;
         }
-        const msg = status.violations[0]?.message ?? 'A security policy violation has been detected.';
+        const msg = status.violations[0]?.message ?? 'A security ruleset violation has been detected.';
         logRemediationApplyFailure('prompt_gate_block_violations_no_autofix_applied', {
             reason: 'violations on submit but autofix did not succeed — see autofix_skipped_not_allowed, enforceRemediation, or compliance_check entries',
             ide,

package/dist/endpoint_client/compress_payload.js

@@ -0,0 +1,25 @@
+import { spawnSync } from 'node:child_process';
+/** macOS ships gzip at a fixed path; call it directly so a modified PATH cannot redirect us. */
+const GZIP_BIN = '/usr/bin/gzip';
+const GZIP_TIMEOUT_MS = 10_000;
+const GZIP_MAX_OUTPUT_BYTES = 64 * 1024 * 1024;
+/**
+ * Compress a request body with the system gzip. Output is gzip-framed, so it pairs with
+ * `Content-Encoding: gzip`. Throws if gzip is missing, times out, or exits non-zero.
+ */
+export function gzipPayload(payload) {
+    const child = spawnSync(GZIP_BIN, ['-c'], {
+        input: Buffer.from(payload, 'utf8'),
+        timeout: GZIP_TIMEOUT_MS,
+        maxBuffer: GZIP_MAX_OUTPUT_BYTES,
+    });
+    if (child.error)
+        throw child.error;
+    if (child.status !== 0) {
+        const stderr = (child.stderr ?? '').toString().trim();
+        throw new Error(stderr || `${GZIP_BIN} exited ${child.status ?? 'unknown'}`);
+    }
+    if (!child.stdout || child.stdout.length === 0)
+        throw new Error(`${GZIP_BIN} produced no output`);
+    return child.stdout;
+}

package/dist/endpoint_client/http_transport.js

@@ -25,6 +25,8 @@ function buildBodyOptions(url, payload, method, timeoutMs) {
         headers: {
             'Content-Type': 'application/json',
             'Content-Length': Buffer.byteLength(payload).toString(),
+            // A Buffer body is always gzip output from compress_payload.gzipPayload.
+            ...(Buffer.isBuffer(payload) ? { 'Content-Encoding': 'gzip' } : {}),
         },
         timeout: timeoutMs,
     };
@@ -46,7 +48,7 @@ export function executeGet(urlStr, timeoutMs) {
         req.end();
     });
 }
-/** Execute a POST/PATCH request. Rejects on network error or timeout. */
+/** Execute a POST/PATCH request. A Buffer payload is sent as `Content-Encoding: gzip`. Rejects on network error or timeout. */
 export function executeBody(urlStr, method, payload, timeoutMs) {
     const url = new URL(urlStr);
     const options = buildBodyOptions(url, payload, method, timeoutMs);

package/dist/endpoint_client/startup_api.js

@@ -1,6 +1,7 @@
 import { executeBody } from './http_transport.js';
+import { gzipPayload } from './compress_payload.js';
 export const postStartupPayload = async (endpointUrl, body, timeoutMs = 5000) => {
-    const payload = JSON.stringify(body);
+    const payload = gzipPayload(JSON.stringify(body));
     const { statusCode, statusMessage, body: responseBody } = await executeBody(endpointUrl, 'POST', payload, timeoutMs);
     if (statusCode >= 400) {
         const msg = statusCode === 413
@@ -18,7 +19,7 @@ export const postStartupPayload = async (endpointUrl, body, timeoutMs = 5000) =>
     }
 };
 export const patchPayload = async (endpointUrl, body, timeoutMs = 10000) => {
-    const payload = JSON.stringify(body);
+    const payload = gzipPayload(JSON.stringify(body));
     const { body: responseBody } = await executeBody(endpointUrl, 'PATCH', payload, timeoutMs);
     if (!responseBody)
         return { status: 'error', error: 'empty_response' };

package/dist/log_config_files/collection/directory_collector.js

@@ -1,10 +1,20 @@
 import { existsSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { readJSONFile, readMarkdownFile } from '../readers/file_readers.js';
+import { collectSkillMdRecord, isSkillDirEntry } from './skill_symlink.js';
 function collectSubdirMdFiles(dirPath, fileType, mdFilename, source) {
     const results = [];
+    const isSkillMd = mdFilename.toLowerCase() === 'skill.md';
     try {
         for (const entry of readdirSync(dirPath, { withFileTypes: true })) {
+            if (isSkillMd) {
+                if (!isSkillDirEntry(entry))
+                    continue;
+                const record = collectSkillMdRecord(join(dirPath, entry.name), fileType, source, mdFilename);
+                if (record)
+                    results.push(record);
+                continue;
+            }
             if (!entry.isDirectory())
                 continue;
             const mdPath = join(dirPath, entry.name, mdFilename);

package/dist/log_config_files/collection/plugin_collector.js

@@ -1,20 +1,121 @@
-import { existsSync, readdirSync } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { extname, join } from 'node:path';
 import { homedir } from 'node:os';
+import { createHash } from 'node:crypto';
 import { readJSONFile, readMarkdownFile } from '../readers/file_readers.js';
 import { getInstalledPluginsPath, getPluginHooksPath, getPluginMcpPaths, getPluginSkillFilename, getPluginSkillsDir } from '../paths/path_constants_helpers.js';
 import { versionFromPluginCachePath, parseInstalledPluginKey } from './plugin_version_helpers.js';
+import { collectSkillMdRecord, isSkillDirEntry, symlinkInfoAllowsExtraFiles } from './skill_symlink.js';
+/** Directories never worth shipping: git history is huge and already-compressed, deps are not the skill. */
+const SKILL_SKIP_DIRS = new Set(['.git', 'node_modules']);
+/** Fonts are the single largest thing in skill folders (canvas-design ships 54) and carry no signal. */
+const SKILL_SKIP_EXTS = new Set(['.ttf', '.otf', '.woff', '.woff2']);
+/** Inlined as text; everything else is recorded as path + size + hash. */
+const SKILL_TEXT_EXTS = new Set([
+    '.md', '.txt', '.py', '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.json', '.jsonc',
+    '.sh', '.bash', '.zsh', '.yaml', '.yml', '.xml', '.xsd', '.html', '.css', '.toml',
+    '.lock', '.csv', '.sql', '.rb', '.go', '.java', '.php', '.rs',
+]);
+const SKILL_MAX_FILE_BYTES = 1024 * 1024;
+const SKILL_MAX_TOTAL_BYTES = 8 * 1024 * 1024;
+const SKILL_MAX_FILES = 500;
+const SKILL_MAX_DEPTH = 8;
+/** Hidden files are collected, but credential-shaped ones are recorded without their contents. */
+function isSecretName(name) {
+    const lower = name.toLowerCase();
+    return lower === '.env' || lower.startsWith('.env.') || lower === '.npmrc' || lower === '.netrc'
+        || lower === '.pgpass' || lower.endsWith('.pem') || lower.endsWith('.key');
+}
+function skillMetaRecord(filePath, size, sha256, ver) {
+    return {
+        file_type: 'claude_skill',
+        file_path: filePath,
+        collect_style: 'metadata',
+        raw_content: { source: 'file', size, ...(sha256 ? { sha256 } : {}), ...(ver ? { version: ver } : {}) },
+    };
+}
+function collectSkillDirFiles(dir, results, constants, skillFilename, budget, depth) {
+    if (depth > SKILL_MAX_DEPTH)
+        return;
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch (err) {
+        console.warn(`Error reading skill dir ${dir}:`, err instanceof Error ? err.message : String(err));
+        return;
+    }
+    for (const ent of entries) {
+        if (budget.files >= SKILL_MAX_FILES || budget.bytes >= SKILL_MAX_TOTAL_BYTES)
+            return;
+        const full = join(dir, ent.name);
+        if (ent.isDirectory()) {
+            if (!SKILL_SKIP_DIRS.has(ent.name))
+                collectSkillDirFiles(full, results, constants, skillFilename, budget, depth + 1);
+            continue;
+        }
+        if (ent.name === skillFilename)
+            continue;
+        // Extra skill files: skip nested symlinks so the walk stays inside this skill dir.
+        if (!ent.isFile())
+            continue;
+        const ext = extname(ent.name).toLowerCase();
+        if (SKILL_SKIP_EXTS.has(ext))
+            continue;
+        let size;
+        try {
+            size = statSync(full).size;
+        }
+        catch {
+            continue;
+        }
+        const ver = versionFromPluginCachePath(full, constants);
+        if (size > SKILL_MAX_FILE_BYTES) {
+            results.push(skillMetaRecord(full, size, '', ver));
+            budget.files += 1;
+            continue;
+        }
+        if (!SKILL_TEXT_EXTS.has(ext) && ent.name !== skillFilename) {
+            let sha256 = '';
+            try {
+                sha256 = createHash('sha256').update(readFileSync(full)).digest('hex');
+            }
+            catch {
+                continue;
+            }
+            results.push(skillMetaRecord(full, size, sha256, ver));
+            budget.files += 1;
+            continue;
+        }
+        if (isSecretName(ent.name)) {
+            results.push(skillMetaRecord(full, size, '', ver));
+            budget.files += 1;
+            continue;
+        }
+        const content = readMarkdownFile(full);
+        if (content === null)
+            continue;
+        results.push({ file_type: 'claude_skill', file_path: full, raw_content: { content, source: 'file', ...(ver ? { version: ver } : {}) } });
+        budget.files += 1;
+        budget.bytes += Buffer.byteLength(content);
+    }
+}
 function collectSkillFiles(skillsDir, results, constants) {
     const skillFilename = getPluginSkillFilename(constants);
     try {
-        for (const d of readdirSync(skillsDir, { withFileTypes: true }).filter((d) => d.isDirectory())) {
-            const skillPath = join(skillsDir, d.name, skillFilename);
-            if (!existsSync(skillPath))
+        for (const d of readdirSync(skillsDir, { withFileTypes: true }).filter((d) => isSkillDirEntry(d))) {
+            const skillRoot = join(skillsDir, d.name);
+            const ver = versionFromPluginCachePath(join(skillRoot, skillFilename), constants);
+            const record = collectSkillMdRecord(skillRoot, 'claude_skill', 'file', skillFilename, ver ? { version: ver } : {});
+            if (!record)
                 continue;
-            const content = readMarkdownFile(skillPath);
-            if (content !== null) {
-                const ver = versionFromPluginCachePath(skillPath, constants);
-                results.push({ file_type: 'claude_skill', file_path: skillPath, raw_content: { content, source: 'file', ...(ver ? { version: ver } : {}) } });
+            results.push(record);
+            if (!symlinkInfoAllowsExtraFiles(record.symlink_info))
+                continue;
+            const budget = { files: 1, bytes: 0 };
+            collectSkillDirFiles(skillRoot, results, constants, skillFilename, budget, 0);
+            if (budget.files >= SKILL_MAX_FILES || budget.bytes >= SKILL_MAX_TOTAL_BYTES) {
+                console.warn(`Skill ${skillRoot} hit collection cap (${budget.files} files, ${budget.bytes} bytes)`);
             }
         }
     }

package/dist/log_config_files/collection/skill_symlink.js

@@ -0,0 +1,191 @@
+import { accessSync, constants, lstatSync, readlinkSync, realpathSync } from 'node:fs';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { readMarkdownFile } from '../readers/file_readers.js';
+function isMissingPathError(err) {
+    const code = err?.code;
+    return code === 'ENOENT' || code === 'ENOTDIR';
+}
+/**
+ * Resolve readlink's raw target the way the OS does when parent dirs include
+ * symlinks. A lexical join against the logical parent is wrong when that parent
+ * is itself a link (e.g. ~/.config → a dotfiles repo).
+ */
+export function resolveRawSymlinkTarget(linkPath, target) {
+    if (isAbsolute(target))
+        return resolve(target);
+    const physicalParent = realpathSync(dirname(linkPath));
+    return resolve(physicalParent, target);
+}
+function probeAccess(path) {
+    try {
+        accessSync(path, constants.F_OK);
+        return 'valid';
+    }
+    catch (err) {
+        return isMissingPathError(err) ? 'broken' : 'inaccessible';
+    }
+}
+function readResolvedSymlinkTarget(linkPath) {
+    try {
+        const raw = readlinkSync(linkPath);
+        const target = resolveRawSymlinkTarget(linkPath, raw);
+        return { target, status: probeAccess(target) };
+    }
+    catch (err) {
+        if (err?.code === 'EINVAL') {
+            return { target: null, status: 'valid' };
+        }
+        return { target: null, status: isMissingPathError(err) ? 'broken' : 'inaccessible' };
+    }
+}
+function asOverall(status) {
+    return status === 'missing' ? 'broken' : status;
+}
+function worseStatus(current, next) {
+    const rank = { valid: 0, broken: 1, inaccessible: 2 };
+    return rank[next] > rank[current] ? next : current;
+}
+function emptyPath(path, status = 'valid') {
+    return { path, is_symlink: false, points_to: null, status };
+}
+/** True for a skills-dir child that is a real folder or a symlink slot. */
+export function isSkillDirEntry(entry) {
+    return entry.isDirectory() || Boolean(entry.isSymbolicLink?.());
+}
+/**
+ * Inspect one agent skill slot: the folder (local vs symlink) and SKILL.md inside it.
+ */
+export function inspectSkillLink(skillDir, skillFilename = 'SKILL.md') {
+    const skillMdPath = join(skillDir, skillFilename);
+    const skill_folder = emptyPath(skillDir);
+    const skill_md = emptyPath(skillMdPath);
+    try {
+        const dirStat = lstatSync(skillDir);
+        if (dirStat.isSymbolicLink()) {
+            skill_folder.is_symlink = true;
+            const resolved = readResolvedSymlinkTarget(skillDir);
+            skill_folder.points_to = resolved.target;
+            skill_folder.status = resolved.status;
+        }
+        else if (!dirStat.isDirectory()) {
+            skill_folder.status = 'broken';
+        }
+    }
+    catch (err) {
+        skill_folder.status = isMissingPathError(err) ? 'broken' : 'inaccessible';
+        skill_md.status = 'missing';
+        return {
+            status: asOverall(skill_folder.status),
+            skill_folder,
+            skill_md,
+        };
+    }
+    try {
+        const mdStat = lstatSync(skillMdPath);
+        if (mdStat.isSymbolicLink()) {
+            skill_md.is_symlink = true;
+            const resolved = readResolvedSymlinkTarget(skillMdPath);
+            skill_md.points_to = resolved.target;
+            skill_md.status = resolved.status;
+        }
+    }
+    catch (err) {
+        skill_md.status = isMissingPathError(err) ? 'missing' : 'inaccessible';
+    }
+    return {
+        status: worseStatus(asOverall(skill_folder.status), asOverall(skill_md.status)),
+        skill_folder,
+        skill_md,
+    };
+}
+function symlinkEntry(info) {
+    return {
+        path: info.path,
+        points_to: info.points_to,
+        status: info.status === 'missing' ? 'broken' : info.status,
+    };
+}
+/** Only include the path that is actually a symlink. No symlink → `{ symlink_enabled: false }`. */
+export function skillLinkPayload(info) {
+    const symlink_info = { symlink_enabled: false };
+    if (info.skill_folder.is_symlink) {
+        symlink_info.symlink_enabled = true;
+        symlink_info.skill_folder = symlinkEntry(info.skill_folder);
+    }
+    if (info.skill_md.is_symlink) {
+        symlink_info.symlink_enabled = true;
+        symlink_info.skill_md = symlinkEntry(info.skill_md);
+    }
+    return symlink_info;
+}
+export function symlinkInfoAllowsExtraFiles(info) {
+    if (!info || typeof info !== 'object')
+        return true;
+    const payload = info;
+    if (!payload.symlink_enabled)
+        return true;
+    for (const entry of [payload.skill_folder, payload.skill_md]) {
+        if (entry?.status && entry.status !== 'valid')
+            return false;
+    }
+    return true;
+}
+function shouldEmitSkillSlot(info, skillFilename) {
+    if (info.skill_folder.is_symlink)
+        return true;
+    if (info.status === 'inaccessible')
+        return true;
+    if (info.skill_md.is_symlink)
+        return true;
+    try {
+        accessSync(join(info.skill_folder.path, skillFilename), constants.F_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function unknownInspectFailure(skillDir, skillFilename, err) {
+    const status = isMissingPathError(err) ? 'broken' : 'inaccessible';
+    return {
+        status,
+        skill_folder: emptyPath(skillDir, status),
+        skill_md: emptyPath(join(skillDir, skillFilename), 'missing'),
+    };
+}
+/**
+ * Collect one SKILL.md inventory row, including symlink metadata even when the
+ * file is missing, dangling, or unreadable.
+ */
+export function collectSkillMdRecord(skillDir, fileType, source, skillFilename = 'SKILL.md', extraRaw = {}) {
+    let info;
+    try {
+        info = inspectSkillLink(skillDir, skillFilename);
+    }
+    catch (err) {
+        info = unknownInspectFailure(skillDir, skillFilename, err);
+    }
+    if (!shouldEmitSkillSlot(info, skillFilename))
+        return null;
+    const mdPath = join(skillDir, skillFilename);
+    const raw = {
+        source,
+        ...extraRaw,
+    };
+    const symlink_info = skillLinkPayload(info);
+    if (info.status === 'valid') {
+        const content = readMarkdownFile(mdPath);
+        if (content !== null) {
+            raw.content = content;
+        }
+        else if (symlink_info.symlink_enabled) {
+            const skill_md = symlink_info.skill_md;
+            const skill_folder = symlink_info.skill_folder;
+            if (skill_md)
+                skill_md.status = 'inaccessible';
+            else if (skill_folder)
+                skill_folder.status = 'inaccessible';
+        }
+    }
+    return { file_type: fileType, file_path: mdPath, raw_content: raw, symlink_info };
+}

package/dist/log_config_files/collection/skills_cli_collector.js

@@ -75,6 +75,20 @@ export function runSkillsListJson(args, cwd) {
         rmSync(tmpDir, { recursive: true, force: true });
     }
 }
+function assignListLockFields(row, out) {
+    for (const key of ['source', 'sourceUrl', 'sourceType']) {
+        if (!Object.prototype.hasOwnProperty.call(row, key))
+            continue;
+        const raw = row[key];
+        if (raw == null) {
+            out[key] = null;
+        }
+        else {
+            const trimmed = String(raw).trim();
+            out[key] = trimmed || null;
+        }
+    }
+}
 function normalizeListRows(rows, scope) {
     const out = [];
     for (const row of rows) {
@@ -85,12 +99,14 @@ function normalizeListRows(rows, scope) {
         const agents = Array.isArray(row.agents)
             ? row.agents.map((a) => String(a).trim()).filter(Boolean)
             : [];
-        out.push({
+        const entry = {
             name,
             path,
             scope: (row.scope || scope).trim() || scope,
             agents,
-        });
+        };
+        assignListLockFields(row, entry);
+        out.push(entry);
     }
     return out;
 }

package/dist/log_config_files/runtime/compliance_check.js

@@ -212,7 +212,7 @@ function violationFromSecretScanFinding(entry, compliance, finding) {
         description: compliance.description,
         finding_title: entry.finding_title,
         finding_description: entry.finding_description,
-        policy_name: entry.policy_name,
+        ruleset_name: entry.ruleset_name,
         severity: compliance.severity,
         autofix_allowed: compliance.autofix_allowed,
         config_file_path: entry.config_file_path,
@@ -353,7 +353,7 @@ function violationFromCheck(entry, compliance, check, expected) {
         description: check.description,
         finding_title: entry.finding_title,
         finding_description: entry.finding_description,
-        policy_name: entry.policy_name,
+        ruleset_name: entry.ruleset_name,
         severity: compliance.severity,
         autofix_allowed: compliance.autofix_allowed,
         config_file_path: entry.config_file_path,

package/dist/log_config_files/runtime/prompt-collection-policy.js

@@ -0,0 +1,57 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+/** Org-pushed endpoint config. Prompt collection and later org options share this file. */
+const ORG_CONFIG_RELATIVE_PATH = path.join(".optimuslabs", "management", "org", "config.json");
+export function orgConfigPath() {
+    return path.join(os.homedir(), ORG_CONFIG_RELATIVE_PATH);
+}
+function readOrgConfig() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(orgConfigPath(), "utf8"));
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        // Missing or invalid — treat as empty.
+    }
+    return {};
+}
+function collectPromptsFromConfig(cfg) {
+    if (typeof cfg.collect_prompts === "boolean")
+        return cfg.collect_prompts;
+    // Previous on-disk key was inverted (true = hash / don't collect).
+    if (typeof cfg.hash_tool_call_prompts === "boolean")
+        return cfg.hash_tool_call_prompts !== true;
+    // No org config yet: match server default (collection off).
+    return false;
+}
+export function readCollectPrompts() {
+    return collectPromptsFromConfig(readOrgConfig());
+}
+export function persistCollectPrompts(value) {
+    if (typeof value !== "boolean")
+        return;
+    const filePath = orgConfigPath();
+    try {
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+        const next = { ...readOrgConfig(), collect_prompts: value };
+        delete next.hash_tool_call_prompts;
+        fs.writeFileSync(filePath, `${JSON.stringify(next)}\n`, { encoding: "utf8", mode: 0o600 });
+    }
+    catch {
+        // Best-effort: next heartbeat can retry.
+    }
+}
+export function persistCollectPromptsFromResponse(body) {
+    if (!body || typeof body !== "object")
+        return;
+    if (typeof body.collect_prompts === "boolean") {
+        persistCollectPrompts(body.collect_prompts);
+        return;
+    }
+    if (typeof body.hash_tool_call_prompts === "boolean") {
+        persistCollectPrompts(body.hash_tool_call_prompts !== true);
+    }
+}

package/dist/log_config_files/sender/batch_sender.js

@@ -4,6 +4,7 @@ import { loadEndpointBase } from './endpoint_config.js';
 import { hookRunLog } from '../runtime/hook_logger.js';
 import { canonicalCursorUserStateVscdbPath } from '../runtime/remediation_config_path.js';
 import { resolveWorkspaceRepoFromEnv } from '../runtime/workspace_repo.js';
+import { persistCollectPromptsFromResponse } from '../runtime/prompt-collection-policy.js';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -79,11 +80,16 @@ function buildBatchChunks(configFiles, basePayloadSize) {
     return chunks;
 }
 function buildChunkBody(chunk, hardwareUuid, authKey, hookRequestId, metadata) {
-    const config_files = chunk.map((c) => ({
-        file_type: c.file_type,
-        file_path: canonicalCursorUserStateVscdbPath(c.file_path),
-        raw_content: c.raw_content,
-    }));
+    const config_files = chunk.map((c) => {
+        const item = {
+            file_type: c.file_type,
+            file_path: canonicalCursorUserStateVscdbPath(c.file_path),
+            raw_content: c.raw_content,
+        };
+        if (c.symlink_info !== undefined)
+            item.symlink_info = c.symlink_info;
+        return item;
+    });
     const payload = { hardware_uuid: hardwareUuid, metadata, config_files };
     if (hookRequestId != null)
         payload.hook_request_id = hookRequestId;
@@ -127,6 +133,7 @@ async function sendConfigFilesBatch(configFiles, hardwareUuid, authKey, hookRequ
         const timeoutMs = Math.min(20000 + Math.ceil(bodySize / (1024 * 1024)) * 15000, 90000);
         try {
             const response = (await postStartupPayload(apiUrl, body, timeoutMs));
+            persistCollectPromptsFromResponse(response);
             if (response.status === 'accepted') {
                 totals.accepted += typeof response.accepted === 'number' ? response.accepted : chunk.length;
                 const failedList = Array.isArray(response.failed) ? response.failed : [];
@@ -221,6 +228,8 @@ async function sendConfigFile(configFile, hardwareUuid, authKey, repoIdentifier)
     const apiUrl = `${resolveApiBase(endpoint)}/endpoint_security/log-config-file/`;
     const uploadPath = canonicalCursorUserStateVscdbPath(configFile.file_path);
     const payload = { hardware_uuid: hardwareUuid, file_type: configFile.file_type, file_path: uploadPath, raw_content: configFile.raw_content };
+    if (configFile.symlink_info !== undefined)
+        payload.symlink_info = configFile.symlink_info;
     const signature = createSignature(payload, authKey.key);
     const body = { ...payload, signature, key_id: authKey.key_id || '', metadata: { org_identifier: process.env.GITHUB_ORG || process.env.GH_ORG || '', organization_uuid: readOrganizationUuid(), repo_identifier: repoIdentifier ?? resolveWorkspaceRepoFromEnv() } };
     try {

package/dist/log_uuid/startup_sender.js

@@ -5,6 +5,7 @@ import { resolveHardwareUuid } from './hardware_uuid.js';
 import { writeAuthKey, readStoredAuthKey, loadEndpointBase, buildStartupEndpointUrl } from './auth_key_store.js';
 import { resolveUserProfile } from './user_profile.js';
 import { resolveWorkspaceRepo } from '../log_config_files/runtime/workspace_repo.js';
+import { persistCollectPromptsFromResponse } from '../log_config_files/runtime/prompt-collection-policy.js';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -83,6 +84,7 @@ const maybeSendToEndpoint = async (hardwareUuid, timestamp, options = {}) => {
     const requestBody = buildRequestBody(hardwareUuid, timestamp);
     try {
         const response = await postStartupPayload(startupEndpointUrl, requestBody);
+        persistCollectPromptsFromResponse(response);
         const result = classifyEndpointResponse(response);
         console.log(result.message);
         if (result.branch === 'key_issued' && result.key) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config",
-  "version": "1.5.14",
+  "version": "1.5.18",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {