log-llm-config 1.5.8 → 1.5.9

package/README.md

@@ -11,7 +11,7 @@ CLI helpers for Optimus Security startup workflows.
 
 #### `log_uuid`
 
-Collects the machine hardware UUID (or uses the `OPTIMUS_HARDWARE_UUID` env variable), prints it, and POSTs a startup payload to `OPTIMUS_ENDPOINT/startup/`. If the server responds with a key, it stores it at `~/opt-ai-sec/management/auth_key.txt`.
+Collects the machine hardware UUID (or uses the `OPTIMUS_HARDWARE_UUID` env variable), prints it, and POSTs a startup payload to `OPTIMUS_ENDPOINT/startup/`. If the server responds with a key, it stores it at `~/.optimuslabs/management/auth_key.txt`.
 
 ```bash
 OPTIMUS_ENDPOINT=http://localhost:8080/endpoint_security/ \

package/dist/bootstrap_constants.js

@@ -2,14 +2,14 @@
  * Bootstrap-level path constants — known before the API response is available.
  * Used by auth, hook logging, and audit output. Do not add agent-specific paths here.
  */
-export const OPT_AI_SEC_MANAGEMENT_REL = 'opt-ai-sec/management';
+export const OPTIMUSLABS_MANAGEMENT_REL = '.optimuslabs/management';
 /**
  * All hook-written log files live under this subdirectory, grouped by type
  * (see LOG_GROUP_* below). Keeping logs in one subtree leaves the management
  * root limited to secrets/identity/state (auth_key, organization-uuid, contracts).
  */
-export const OPT_AI_SEC_LOGS_REL = `${OPT_AI_SEC_MANAGEMENT_REL}/logs`;
-/** Log group subdirectories under {@link OPT_AI_SEC_LOGS_REL}. */
+export const OPTIMUSLABS_LOGS_REL = `${OPTIMUSLABS_MANAGEMENT_REL}/logs`;
+/** Log group subdirectories under {@link OPTIMUSLABS_LOGS_REL}. */
 export const LOG_GROUP_HOOK = 'hook';
 export const LOG_GROUP_COMPLIANCE = 'compliance';
 export const LOG_GROUP_AUDIT = 'audit';

package/dist/dialog_prefs_cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * CLI for macOS non-restart autofix dialogs and dialog preferences in ~/opt-ai-sec/management.
+ * CLI for macOS non-restart autofix dialogs and dialog preferences in ~/.optimuslabs/management.
  * Invoked from optimus-compliance-check.sh hooks.
  */
 import { execFileSync } from 'node:child_process';

package/dist/log_config_files/auth/auth_flow.js

@@ -2,9 +2,9 @@ import path from 'node:path';
 import { postStartupPayload } from '../../endpoint_client/index.js';
 import { ensureAuthentication as ensureTofuAuthentication } from '../../tofu.js';
 import { loadEndpointBase } from '../sender/endpoint_config.js';
-import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
+import { OPTIMUSLABS_MANAGEMENT_REL } from '../../bootstrap_constants.js';
 import { hookRunLog } from '../runtime/hook_logger.js';
-const AUTH_KEY_RELATIVE_PATH = path.join(OPT_AI_SEC_MANAGEMENT_REL, 'auth', 'auth_key.txt');
+const AUTH_KEY_RELATIVE_PATH = path.join(OPTIMUSLABS_MANAGEMENT_REL, 'auth', 'auth_key.txt');
 /** Ensure authentication — verify stored key or request new one via handshake. */
 async function ensureAuthentication(hardwareUuid, endpointBase) {
     const key = await ensureTofuAuthentication({

package/dist/log_config_files/auth/auth_key_store.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import { getAuthKeyPath as getSharedAuthKeyPath, readStoredAuthKey as readSharedStoredAuthKey, } from '../../tofu.js';
-import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
-const AUTH_KEY_RELATIVE_PATH = path.join(OPT_AI_SEC_MANAGEMENT_REL, 'auth', 'auth_key.txt');
+import { OPTIMUSLABS_MANAGEMENT_REL } from '../../bootstrap_constants.js';
+const AUTH_KEY_RELATIVE_PATH = path.join(OPTIMUSLABS_MANAGEMENT_REL, 'auth', 'auth_key.txt');
 const AUTH_KEY_OPTIONS = { authRelativePath: AUTH_KEY_RELATIVE_PATH };
 /** Return absolute path to auth_key.txt, or null if home dir is unavailable. */
 function getAuthKeyPath() {

package/dist/log_config_files/collection/config_collector.js

@@ -235,6 +235,7 @@ export { collectCursorTokenUsage } from './cursor_token_usage_collector.js';
 export { collectHermesTokenUsage } from './hermes_token_usage_collector.js';
 export { collectOpenclawTokenUsage } from './openclaw_token_usage_collector.js';
 export { collectPiTokenUsage } from './pi_token_usage_collector.js';
+export { collectCoworkDesktopVersion } from './cowork_desktop_version_collector.js';
 export { collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, mergeClaudeDesktopExtensionEnableSettings, } from './claude_desktop_extensions_collector.js';
 export { collectCursorProjectWorkspaceMcpConfigs } from './cursor_project_mcp_collector.js';
 export { determineFileTypeFromPath } from './file_type_rules.js';

package/dist/log_config_files/collection/cowork_desktop_version_collector.js

@@ -0,0 +1,60 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * Claude Desktop app version, surfaced as Cowork's Agent Profile `agent_version`.
+ *
+ * Cowork has no per-session version signal — its `local_<sessionId>.json` session files
+ * (see cowork_session_whitelist.ts) carry no version field, confirmed against a live install.
+ * Cowork runs inside the Claude Desktop app rather than as a standalone CLI, so the app's own
+ * bundle version is the only real "version" available for it: `CFBundleShortVersionString` from
+ * Claude.app's Info.plist, read via `plutil` (a stock macOS binary — no new dependency, same
+ * shell-out pattern as the sqlite3-based collectors).
+ *
+ * Gated on the Cowork enablement marker (~/Library/Application Support/Claude/
+ * cowork-enabled-cli-ops.json) so a machine with Claude Desktop installed but Cowork never
+ * enabled doesn't get an agent=cowork version row. macOS only — Claude Desktop/Cowork ships on
+ * macOS today.
+ */
+const FILE_TYPE = 'cowork_desktop_version';
+const BUNDLE_VERSION_KEY = 'CFBundleShortVersionString';
+const CLAUDE_APP_INFO_PLIST = '/Applications/Claude.app/Contents/Info.plist';
+function coworkEnabledMarkerPath(home) {
+    return join(home, 'Library', 'Application Support', 'Claude', 'cowork-enabled-cli-ops.json');
+}
+/** `plutil -extract CFBundleShortVersionString raw <path>`, or '' when plutil/the plist is unavailable. */
+function readBundleVersion(plistPath) {
+    try {
+        return execFileSync('/usr/bin/plutil', ['-extract', BUNDLE_VERSION_KEY, 'raw', plistPath], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Emit the Claude Desktop app version as a single-element aggregate, or [] when this isn't
+ * macOS, Cowork isn't enabled on this machine, or Claude.app/plutil is unavailable.
+ */
+function collectCoworkDesktopVersion(home = homedir(), plistPath = CLAUDE_APP_INFO_PLIST) {
+    if (process.platform !== 'darwin')
+        return [];
+    if (!existsSync(coworkEnabledMarkerPath(home)))
+        return [];
+    if (!existsSync(plistPath))
+        return [];
+    const version = readBundleVersion(plistPath);
+    if (!version)
+        return [];
+    return [
+        {
+            file_type: FILE_TYPE,
+            file_path: plistPath,
+            raw_content: { version },
+        },
+    ];
+}
+export { collectCoworkDesktopVersion, FILE_TYPE as COWORK_DESKTOP_VERSION_FILE_TYPE };

package/dist/log_config_files/collection/openclaw_token_usage_collector.js

@@ -21,6 +21,12 @@ import { homedir } from 'node:os';
  * only — never any other key (openclaw.json's other sections can carry messaging/provider
  * settings).
  *
+ * Auth method comes from a scoped read of openclaw.json's `auth.profiles.*` entries — each
+ * profile is `{provider, mode}` (e.g. `{"provider": "anthropic", "mode": "api_key"}`); we read
+ * only those two keys, never any credential material (profiles carry no token/key fields to
+ * begin with). Exposed per-provider so the extractor can match it against the provider actually
+ * observed in session usage.
+ *
  * Only checks ~/.openclaw (the canonical root); the moltbot/clawdbot compatible-fork roots
  * tracked by the presence/log file types are not covered here.
  */
@@ -113,6 +119,34 @@ function readVersion(openclawDir) {
         return '';
     }
 }
+/**
+ * Scoped read of openclaw.json's `auth.profiles` — provider + mode only, never credentials
+ * (the profiles carry no token/key fields). Returns a provider -> mode map (e.g.
+ * `{"anthropic": "api_key"}`); a provider with multiple profiles keeps the last one read.
+ */
+function readAuthModesByProvider(openclawDir) {
+    try {
+        const raw = JSON.parse(readFileSync(join(openclawDir, 'openclaw.json'), 'utf8'));
+        const auth = raw.auth;
+        const profiles = auth && typeof auth === 'object' ? auth.profiles : undefined;
+        const out = {};
+        if (profiles && typeof profiles === 'object') {
+            for (const value of Object.values(profiles)) {
+                if (!value || typeof value !== 'object')
+                    continue;
+                const entry = value;
+                const provider = str(entry.provider);
+                const mode = str(entry.mode);
+                if (provider && mode)
+                    out[provider] = mode;
+            }
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
 /**
  * Aggregate OpenClaw session count / token usage / models / providers / version across every
  * agent dir's sessions.json store. Returns a single-element array (one per-machine aggregate)
@@ -148,6 +182,7 @@ function collectOpenclawTokenUsage(home = homedir()) {
                 model_token_split: acc.modelTokenSplit,
                 window_days: TOKEN_USAGE_RECENCY_DAYS,
                 totals: acc.totals,
+                auth_modes_by_provider: readAuthModesByProvider(openclawDir),
             },
         },
     ];

package/dist/log_config_files/collection/opencode_token_usage_collector.js

@@ -9,9 +9,11 @@ import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
  * Unlike Claude/Copilot (JSONL transcripts), OpenCode stores everything in a SQLite DB at
  * ~/.local/share/opencode/opencode.db. Each assistant row in the `message` table has a JSON
  * `data` blob carrying `modelID`, `providerID`, `tokens` ({input,output,reasoning,cache:{read,write}})
- * and `cost`; the `account` table carries the login `email`/`url`. We read those via the bundled
- * `sqlite3` binary (same resolver the remediation path uses) and emit only the aggregated numbers
- * (plus the login email) — never message content. The DB is opened read-only.
+ * and `cost`; the `account` table carries the login `email`/`url`; the singleton `account_state`
+ * row carries `active_org_id` (an org identifier — no org *name* exists anywhere in the schema).
+ * We read those via the bundled `sqlite3` binary (same resolver the remediation path uses) and
+ * emit only the aggregated numbers (plus the login email / org id) — never message content. The
+ * DB is opened read-only.
  *
  * Bounded by DB-file mtime recency so a stale install isn't re-read every hook run.
  */
@@ -151,6 +153,10 @@ function collectOpencodeTokenUsage(home = homedir()) {
             .replace(/^https?:\/\//, '')
             .replace(/\/$/, '');
     }
+    // Singleton row; absent on older installs/schemas without account_state — querySqlite
+    // returns null on "no such table" and orgIdRaw stays empty in that case.
+    const orgIdRaw = querySqlite(sqlite3, dbPath, "SELECT COALESCE(active_org_id, '') FROM account_state LIMIT 1;");
+    const orgId = orgIdRaw ? orgIdRaw.trim() : '';
     if (!sawData && !email)
         return [];
     return [
@@ -166,6 +172,7 @@ function collectOpencodeTokenUsage(home = homedir()) {
                 cost,
                 email,
                 host,
+                org_id: orgId,
                 window_days: TOKEN_USAGE_RECENCY_DAYS,
                 totals,
             },

package/dist/log_config_files/collection/pi_token_usage_collector.js

@@ -14,10 +14,11 @@ import { homedir } from 'node:os';
  * session count, and models/providers used without ingesting transcript content.
  *
  * Configured defaults come from a scoped read of settings.json's `defaultProvider` /
- * `defaultModel` / `lastChangelogVersion` keys only — never any other key. auth.json is never
- * touched at all: it holds literal per-provider `{type, key}` credential blobs
- * (`{"anthropic": {"type": ..., "key": ...}}`), the same risk class as Hermes's/Codex's
- * auth.json.
+ * `defaultModel` / `lastChangelogVersion` keys only — never any other key.
+ *
+ * auth.json holds literal per-provider `{type, key}` blobs (`{"anthropic": {"type": ...,
+ * "key": ...}}`), the same risk class as Hermes's/Codex's auth.json. We read only the `type`
+ * field per provider (e.g. `"api_key"`) — never `key`, the actual credential.
  *
  * `lastChangelogVersion` (confirmed against a real install: "0.80.3", matching `pi --version`
  * exactly) is a best-effort CLI version signal, not a guaranteed-current one — it records the
@@ -83,6 +84,27 @@ function readDefaults(home) {
         return { provider: '', model: '', version: '' };
     }
 }
+/**
+ * Scoped read of auth.json's per-provider `type` field only — never the sibling `key`
+ * credential. Returns a provider -> type map (e.g. `{"anthropic": "api_key"}`).
+ */
+function readAuthTypesByProvider(home) {
+    try {
+        const raw = JSON.parse(readFileSync(join(home, '.pi', 'agent', 'auth.json'), 'utf8'));
+        const out = {};
+        for (const [provider, value] of Object.entries(raw)) {
+            if (!value || typeof value !== 'object')
+                continue;
+            const type = str(value.type);
+            if (type)
+                out[provider] = type;
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
 /**
  * Aggregate Pi session count / token usage / models / providers across recent session
  * transcripts. Returns a single-element array (one per-machine aggregate) or [] when there is
@@ -173,6 +195,7 @@ function collectPiTokenUsage(home = homedir()) {
                 configured_provider: defaults.provider,
                 window_days: TOKEN_USAGE_RECENCY_DAYS,
                 totals,
+                auth_types_by_provider: readAuthTypesByProvider(home),
             },
         },
     ];

package/dist/log_config_files/paths/path_constants_helpers.js

@@ -27,7 +27,7 @@ export function getInstalledPluginsPath(home, constants) {
     return join(home, rel.replace(/^~\//, ''));
 }
 export function getOptAiSecManagementPath(home, constants) {
-    const rel = requireKey(constants, 'opt_ai_sec_management_under_home', 'opt-ai-sec management path');
+    const rel = requireKey(constants, 'optimuslabs_management_under_home', '.optimuslabs management path');
     return join(home, rel.replace(/^~\//, ''));
 }
 export function getAuthKeyPathFromConstants(home, constants) {

package/dist/log_config_files/runtime/client_event_reporter.js

@@ -13,7 +13,7 @@
 import { existsSync, mkdirSync, appendFileSync, readFileSync, renameSync, unlinkSync, statSync } from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
+import { OPTIMUSLABS_MANAGEMENT_REL } from '../../bootstrap_constants.js';
 import { executeBody } from '../../endpoint_client/http_transport.js';
 import { loadEndpointBase } from '../sender/endpoint_config.js';
 import { createSignature } from '../sender/signing.js';
@@ -29,7 +29,7 @@ function bufferPath() {
     const home = process.env.HOME || process.env.USERPROFILE;
     if (!home)
         return null;
-    return path.join(home, OPT_AI_SEC_MANAGEMENT_REL, 'telemetry', BUFFER_BASENAME);
+    return path.join(home, OPTIMUSLABS_MANAGEMENT_REL, 'telemetry', BUFFER_BASENAME);
 }
 /** Keep filename-safe chars only — must match optimus_sanitize_id in optimus-hook-common.sh. */
 function sanitizeId(v) {
@@ -40,7 +40,7 @@ function storyFilePath() {
     const home = process.env.HOME || process.env.USERPROFILE;
     if (!home)
         return null;
-    const telemetryDir = path.join(home, OPT_AI_SEC_MANAGEMENT_REL, 'telemetry');
+    const telemetryDir = path.join(home, OPTIMUSLABS_MANAGEMENT_REL, 'telemetry');
     const session = sanitizeId((process.env.OPTIMUS_SESSION_ID || '').trim());
     if (session) {
         const agent = sanitizeId((process.env.OPTIMUS_HOOK_TYPE || process.env.OPTIMUS_AGENT || 'claude').trim()) || 'claude';
@@ -107,7 +107,7 @@ function hookRunFilePath() {
     const home = process.env.HOME || process.env.USERPROFILE;
     if (!home)
         return null;
-    return path.join(home, OPT_AI_SEC_MANAGEMENT_REL, 'telemetry', 'current_hook_run.id');
+    return path.join(home, OPTIMUSLABS_MANAGEMENT_REL, 'telemetry', 'current_hook_run.id');
 }
 /**
  * hook_run_id: one uuid per shell hook invocation.

package/dist/log_config_files/runtime/compliance_session_log.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync, appendFileSync, readFileSync, } from 'node:fs';
 import path from 'node:path';
 import { homedir } from 'node:os';
-import { OPT_AI_SEC_LOGS_REL, LOG_GROUP_COMPLIANCE } from '../../bootstrap_constants.js';
+import { OPTIMUSLABS_LOGS_REL, LOG_GROUP_COMPLIANCE } from '../../bootstrap_constants.js';
 import { buildLogMetadataBlock } from './log_metadata.js';
 const COMPLIANCE_SUBDIR = LOG_GROUP_COMPLIANCE;
 const TIER_NOOP = 'noop';
@@ -35,7 +35,7 @@ export function isFinalizeComplianceSessionArgv(argv) {
     return argv.includes('--finalize-compliance-session');
 }
 export function getComplianceLogDir() {
-    return path.join(homedir(), OPT_AI_SEC_LOGS_REL, COMPLIANCE_SUBDIR);
+    return path.join(homedir(), OPTIMUSLABS_LOGS_REL, COMPLIANCE_SUBDIR);
 }
 export function getActiveComplianceLogPath() {
     return activeComplianceLogPath;

package/dist/log_config_files/runtime/hook_logger.js

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync, appendFileSync, writeFileSync, statSync, readFileSync } from 'node:fs';
 import path from 'node:path';
-import { OPT_AI_SEC_LOGS_REL, LOG_GROUP_HOOK, LOG_GROUP_COMPLIANCE, } from '../../bootstrap_constants.js';
+import { OPTIMUSLABS_LOGS_REL, LOG_GROUP_HOOK, LOG_GROUP_COMPLIANCE, } from '../../bootstrap_constants.js';
 import { getActiveComplianceLogPath } from './compliance_session_log.js';
 import { buildLogMetadataBlock, formatErrorBlock } from './log_metadata.js';
 const HOOK_LOG_FILENAME = 'hook_log.txt';
@@ -12,13 +12,13 @@ function getHookLogPath() {
     const homeDir = process.env.HOME || process.env.USERPROFILE;
     if (!homeDir)
         return null;
-    return path.join(homeDir, OPT_AI_SEC_LOGS_REL, LOG_GROUP_HOOK, HOOK_LOG_FILENAME);
+    return path.join(homeDir, OPTIMUSLABS_LOGS_REL, LOG_GROUP_HOOK, HOOK_LOG_FILENAME);
 }
 function getComplianceRunnerLogPath() {
     const homeDir = process.env.HOME || process.env.USERPROFILE;
     if (!homeDir)
         return null;
-    return path.join(homeDir, OPT_AI_SEC_LOGS_REL, LOG_GROUP_COMPLIANCE, COMPLIANCE_FALLBACK_TIER, COMPLIANCE_RUNNER_LOG_FILENAME);
+    return path.join(homeDir, OPTIMUSLABS_LOGS_REL, LOG_GROUP_COMPLIANCE, COMPLIANCE_FALLBACK_TIER, COMPLIANCE_RUNNER_LOG_FILENAME);
 }
 /**
  * Append one ISO-timestamped line to the active compliance session log.

package/dist/log_config_files/runtime/log_metadata.js

@@ -7,7 +7,7 @@ import os from 'node:os';
 import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
+import { OPTIMUSLABS_MANAGEMENT_REL } from '../../bootstrap_constants.js';
 /** This package's name + version as "<name>: <version>", read from its own package.json. */
 function readPackageVersion() {
     try {
@@ -28,7 +28,7 @@ function readBundleVersion() {
     const home = process.env.HOME || process.env.USERPROFILE;
     if (!home)
         return 'unknown';
-    const p = path.join(home, OPT_AI_SEC_MANAGEMENT_REL, 'release', 'bundle-version.json');
+    const p = path.join(home, OPTIMUSLABS_MANAGEMENT_REL, 'release', 'bundle-version.json');
     try {
         if (!existsSync(p))
             return 'unknown';

package/dist/log_config_files/runtime/main_runner.js

@@ -3,7 +3,7 @@ import { join } from 'node:path';
 import { homedir } from 'node:os';
 const HOME_DIR = homedir();
 import { getFileCollectionPatterns, FILE_PATH_REGISTRY_FILE_PATTERNS_PATH } from '../../endpoint_client/index.js';
-import { OPT_AI_SEC_LOGS_REL, LOG_GROUP_AUDIT } from '../../bootstrap_constants.js';
+import { OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT } from '../../bootstrap_constants.js';
 import { runSensitivePathsAudit } from '../../log_sensitive_paths_audit.js';
 import { loadEndpointBase, getEndpointSource } from '../sender/endpoint_config.js';
 import { hookLogReplace, hookRunLog, hookLogError, readHookLog } from './hook_logger.js';
@@ -14,7 +14,7 @@ import { ensureAuthentication } from '../auth/auth_flow.js';
 import { readJSONFile, readMarkdownFile } from '../readers/file_readers.js';
 import { isVscdbVirtualPath, tryReadVscdbVirtualFile, summarizeComposerPayloadForDiagnostics, } from '../readers/vscdb_config_builder.js';
 import { persistVscdbComposerContractFromPatternsResponse } from '../readers/vscdb_reader.js';
-import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles, collectMcpFromClaudeJsonProjects, collectClaudeTokenUsage, collectCopilotTokenUsage, collectOpencodeTokenUsage, collectCodexTokenUsage, collectCursorTokenUsage, collectHermesTokenUsage, collectOpenclawTokenUsage, collectPiTokenUsage, collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, determineFileTypeFromPath, } from '../collection/config_collector.js';
+import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles, collectMcpFromClaudeJsonProjects, collectClaudeTokenUsage, collectCopilotTokenUsage, collectOpencodeTokenUsage, collectCodexTokenUsage, collectCursorTokenUsage, collectHermesTokenUsage, collectOpenclawTokenUsage, collectPiTokenUsage, collectCoworkDesktopVersion, collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, determineFileTypeFromPath, } from '../collection/config_collector.js';
 import { ensureCursorUserSettingsSnapshotInBatch } from '../collection/ensure_cursor_user_settings_snapshot.js';
 import { collectSkillsCliInstalled } from '../collection/skills_cli_collector.js';
 import { collectWorkspaceVscdbs } from '../collection/mcp_tool_collector.js';
@@ -162,6 +162,14 @@ async function collectAllConfigFiles(endpointBase) {
             configFiles.push(entry);
         }
     }
+    hookRunLog(`reading Claude Desktop app version for Cowork's Agent Profile`);
+    for (const entry of collectCoworkDesktopVersion(HOME_DIR)) {
+        const key = `${entry.file_type}\t${entry.file_path}`;
+        if (!existingPaths.has(key)) {
+            existingPaths.add(key);
+            configFiles.push(entry);
+        }
+    }
     hookRunLog(`merging disk-only Claude Desktop extensions into extensions-installations.json`);
     const diskExtMerge = enrichClaudeDesktopExtensionsInstallationsUpload(configFiles, HOME_DIR);
     hookRunLog(`claude desktop extensions: merged=${diskExtMerge.mergedCount} had_registry_upload=${diskExtMerge.hadRegistryUpload}`);
@@ -199,7 +207,7 @@ async function collectAllConfigFiles(endpointBase) {
 }
 async function addSensitivePathsAudit(endpointBase, configFiles) {
     hookRunLog(`running sensitive paths audit`);
-    const auditOutputDir = join(homedir(), OPT_AI_SEC_LOGS_REL, LOG_GROUP_AUDIT);
+    const auditOutputDir = join(homedir(), OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT);
     try {
         const auditResult = await runSensitivePathsAudit(endpointBase, auditOutputDir, PROJECT_ROOT);
         hookRunLog(`sensitive_paths_audit: ${auditResult.paths.length} path(s)`);

package/dist/log_config_files/runtime/management_storage.js

@@ -1,11 +1,11 @@
 /**
- * Paths and JSON persistence for ~/opt-ai-sec/management:
+ * Paths and JSON persistence for ~/.optimuslabs/management:
  * - remediation_instructions.json (remediations[])
  */
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
-import { OPT_AI_SEC_MANAGEMENT_REL, OPT_AI_SEC_LOGS_REL } from '../../bootstrap_constants.js';
+import { OPTIMUSLABS_MANAGEMENT_REL, OPTIMUSLABS_LOGS_REL } from '../../bootstrap_constants.js';
 export const REMEDIATION_INSTRUCTIONS_BASENAME = 'remediation_instructions.json';
 /** Pending state.vscdb writes applied after Cursor exits (IDE holds the DB locked). */
 export const DEFERRED_VSCDB_APPLY_BASENAME = 'optimus_deferred_vscdb_apply.json';
@@ -51,14 +51,14 @@ export function sanitizeFileCollectionVscdbContract(contract) {
     };
 }
 export function getManagementDir() {
-    return join(homedir(), OPT_AI_SEC_MANAGEMENT_REL);
+    return join(homedir(), OPTIMUSLABS_MANAGEMENT_REL);
 }
-/** Root of the grouped hook log subtree (~/opt-ai-sec/management/logs). */
+/** Root of the grouped hook log subtree (~/.optimuslabs/management/logs). */
 export function getLogsDir() {
-    return join(homedir(), OPT_AI_SEC_LOGS_REL);
+    return join(homedir(), OPTIMUSLABS_LOGS_REL);
 }
 /**
- * Directory for vscdb state/contract files (~/opt-ai-sec/management/vscdb), keeping the
+ * Directory for vscdb state/contract files (~/.optimuslabs/management/vscdb), keeping the
  * several generated vscdb artifacts grouped instead of dangling at the management root.
  * Includes deferred_vscdb_restart.log (detached restart pipeline output).
  */
@@ -66,7 +66,7 @@ export function getVscdbStateDir() {
     return join(getManagementDir(), 'vscdb');
 }
 /**
- * Directory for non-log remediation state (~/opt-ai-sec/management/remediation):
+ * Directory for non-log remediation state (~/.optimuslabs/management/remediation):
  * remediation_instructions.json (what to fix) and remediation_apply_tracking.json
  * (quarantine + verify-failure history that escapes the autofix restart loop).
  * Remediation session logs live under logs/compliance/.
@@ -86,7 +86,7 @@ export function getDeferredVscdbRestartLogPath() {
 export function getFileCollectionVscdbContractPath() {
     return join(getVscdbStateDir(), FILE_COLLECTION_VSCDB_CONTRACT_BASENAME);
 }
-/** Directory for macOS dialog assets/state (~/opt-ai-sec/management/dialog): prefs + cached icon. */
+/** Directory for macOS dialog assets/state (~/.optimuslabs/management/dialog): prefs + cached icon. */
 export function getDialogStateDir() {
     return join(getManagementDir(), 'dialog');
 }

package/dist/log_config_files/runtime/remediation_sync.js

@@ -541,7 +541,7 @@ function assertSafeSqliteIdentifiersForItemTable(table, keyColumn, valueColumn)
  * Canonical Cursor restart_command strings — single source for buildDeferredCursorRestartCommand + allowlist.
  *
  * - **SQLite / state.vscdb (deferred):** autofix queued ItemTable writes; restart runs `apply_deferred_vscdb` then reopens Cursor.
- *   Routing matches shell hooks (`optimus-compliance-check.sh`): read `~/opt-ai-sec/management/optimus_dev.env`
+ *   Routing matches shell hooks (`optimus-compliance-check.sh`): read `~/.optimuslabs/management/optimus_dev.env`
  *   (then `OPTIMUS_ENVIRONMENT`), use `npx=` base for local `dist` when `environment=development`,
  *   `log-llm-config-staging@latest` when `environment=staging`, else production package.
  * - **JSON settings files:** autofix wrote normal config JSON; restart is kill + reopen only (no deferred apply).
@@ -551,8 +551,8 @@ function assertSafeSqliteIdentifiersForItemTable(table, keyColumn, valueColumn)
  */
 const TRUSTED_CURSOR_SQLITE_DEFERRED_RESTART_COMMAND = 'REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd) && export REPO_ROOT && ' +
     'CURSOR_PROJECT="${CURSOR_PROJECT_DIR:-$REPO_ROOT}" && export CURSOR_PROJECT && ' +
-    'OPTIMUS_DEFERRED_LOG="${HOME}/opt-ai-sec/management/vscdb/deferred_vscdb_restart.log" && mkdir -p "$(dirname "$OPTIMUS_DEFERRED_LOG")" && export OPTIMUS_DEFERRED_LOG && ' +
-    "nohup bash -c 'exec >>\"\$OPTIMUS_DEFERRED_LOG\" 2>&1; echo deferred_restart:begin ts=\$(date -u +%Y-%m-%dT%H:%M:%SZ) REPO_ROOT=\"\$REPO_ROOT\" CURSOR_PROJECT=\"\$CURSOR_PROJECT\"; sleep 2; STATIC_DEV_ENV=\"\$HOME/opt-ai-sec/management/optimus_dev.env\"; ENV_LABEL=\"\"; if [ -f \"\$STATIC_DEV_ENV\" ]; then ENV_LABEL=\$(grep -E \"^(environment|ENVIRONMENT|OPTIMUS_ENVIRONMENT)=\" \"\$STATIC_DEV_ENV\" 2>/dev/null | head -1 | cut -d\"=\" -f2- | tr \"[:upper:]\" \"[:lower:]\" | xargs); fi; if [ -z \"\$ENV_LABEL\" ] && [ -n \"\${OPTIMUS_ENVIRONMENT:-}\" ]; then ENV_LABEL=\$(printf \"%s\" \"\$OPTIMUS_ENVIRONMENT\" | tr \"[:upper:]\" \"[:lower:]\" | xargs); fi; [ -z \"\$ENV_LABEL\" ] && ENV_LABEL=\"production\"; NPX_BASE=\"\"; if [ -f \"\$STATIC_DEV_ENV\" ]; then _nb=\$(grep -E \"^npx=\" \"\$STATIC_DEV_ENV\" 2>/dev/null | head -1 | cut -d\"=\" -f2- | xargs); [ -n \"\$_nb\" ] && [ -d \"\$_nb\" ] && NPX_BASE=\"\$_nb\"; fi; p=\"\${npm_config_prefix:-\${NPM_CONFIG_PREFIX:-}}\"; gp=\"\${npm_config_global_prefix:-}\"; gc=\"\${npm_config_globalconfig:-}\"; if [[ \"\$p\" == *\"/Applications/Cursor.app/\"* ]] || [[ \"\$gp\" == *\"/Applications/Cursor.app/\"* ]] || [[ \"\$gc\" == *\"/Applications/Cursor.app/\"* ]]; then unset npm_config_prefix NPM_CONFIG_PREFIX npm_config_global_prefix npm_config_globalconfig npm_node_execpath 2>/dev/null; fi; APPLY_EC=0; if [ -f \"\$REPO_ROOT/dev_npx_packages/log-llm-config/dist/apply_deferred_vscdb.js\" ]; then echo deferred_restart:apply_via_dev_npx_packages; node \"\$REPO_ROOT/dev_npx_packages/log-llm-config/dist/apply_deferred_vscdb.js\"; APPLY_EC=\$?; elif [ \"\$ENV_LABEL\" = \"development\" ] && [ -n \"\$NPX_BASE\" ] && [ -f \"\$NPX_BASE/log-llm-config/dist/apply_deferred_vscdb.js\" ]; then echo deferred_restart:apply_via_optimus_npx_base; node \"\$NPX_BASE/log-llm-config/dist/apply_deferred_vscdb.js\"; APPLY_EC=\$?; elif command -v npx >/dev/null 2>&1; then echo deferred_restart:apply_via_npx env=\"\$ENV_LABEL\"; cd \"\$REPO_ROOT\" || true; if [ \"\$ENV_LABEL\" = \"staging\" ]; then npx --yes --package=log-llm-config-staging@latest apply-deferred-vscdb-staging; APPLY_EC=\$?; else npx --yes --package=log-llm-config@latest apply-deferred-vscdb; APPLY_EC=\$?; fi; else echo deferred_restart:no_npx; APPLY_EC=127; fi; echo deferred_restart:apply_exit=\$APPLY_EC; if [ \$APPLY_EC -ne 0 ]; then echo deferred_restart:APPLY_FAILED_see_messages_above; fi; echo deferred_restart:open_cursor; env -u npm_config_package -u npm_lifecycle_event -u npm_lifecycle_script -u npm_config_local_prefix open -a Cursor \"\$CURSOR_PROJECT\"; echo deferred_restart:open_exit=\$?; echo deferred_restart:end ts=\$(date -u +%Y-%m-%dT%H:%M:%SZ)' >/dev/null 2>&1 & killall -9 Cursor";
+    'OPTIMUS_DEFERRED_LOG="${HOME}/.optimuslabs/management/vscdb/deferred_vscdb_restart.log" && mkdir -p "$(dirname "$OPTIMUS_DEFERRED_LOG")" && export OPTIMUS_DEFERRED_LOG && ' +
+    "nohup bash -c 'exec >>\"\$OPTIMUS_DEFERRED_LOG\" 2>&1; echo deferred_restart:begin ts=\$(date -u +%Y-%m-%dT%H:%M:%SZ) REPO_ROOT=\"\$REPO_ROOT\" CURSOR_PROJECT=\"\$CURSOR_PROJECT\"; sleep 2; STATIC_DEV_ENV=\"\$HOME/.optimuslabs/management/optimus_dev.env\"; ENV_LABEL=\"\"; if [ -f \"\$STATIC_DEV_ENV\" ]; then ENV_LABEL=\$(grep -E \"^(environment|ENVIRONMENT|OPTIMUS_ENVIRONMENT)=\" \"\$STATIC_DEV_ENV\" 2>/dev/null | head -1 | cut -d\"=\" -f2- | tr \"[:upper:]\" \"[:lower:]\" | xargs); fi; if [ -z \"\$ENV_LABEL\" ] && [ -n \"\${OPTIMUS_ENVIRONMENT:-}\" ]; then ENV_LABEL=\$(printf \"%s\" \"\$OPTIMUS_ENVIRONMENT\" | tr \"[:upper:]\" \"[:lower:]\" | xargs); fi; [ -z \"\$ENV_LABEL\" ] && ENV_LABEL=\"production\"; NPX_BASE=\"\"; if [ -f \"\$STATIC_DEV_ENV\" ]; then _nb=\$(grep -E \"^npx=\" \"\$STATIC_DEV_ENV\" 2>/dev/null | head -1 | cut -d\"=\" -f2- | xargs); [ -n \"\$_nb\" ] && [ -d \"\$_nb\" ] && NPX_BASE=\"\$_nb\"; fi; p=\"\${npm_config_prefix:-\${NPM_CONFIG_PREFIX:-}}\"; gp=\"\${npm_config_global_prefix:-}\"; gc=\"\${npm_config_globalconfig:-}\"; if [[ \"\$p\" == *\"/Applications/Cursor.app/\"* ]] || [[ \"\$gp\" == *\"/Applications/Cursor.app/\"* ]] || [[ \"\$gc\" == *\"/Applications/Cursor.app/\"* ]]; then unset npm_config_prefix NPM_CONFIG_PREFIX npm_config_global_prefix npm_config_globalconfig npm_node_execpath 2>/dev/null; fi; APPLY_EC=0; if [ -f \"\$REPO_ROOT/dev_npx_packages/log-llm-config/dist/apply_deferred_vscdb.js\" ]; then echo deferred_restart:apply_via_dev_npx_packages; node \"\$REPO_ROOT/dev_npx_packages/log-llm-config/dist/apply_deferred_vscdb.js\"; APPLY_EC=\$?; elif [ \"\$ENV_LABEL\" = \"development\" ] && [ -n \"\$NPX_BASE\" ] && [ -f \"\$NPX_BASE/log-llm-config/dist/apply_deferred_vscdb.js\" ]; then echo deferred_restart:apply_via_optimus_npx_base; node \"\$NPX_BASE/log-llm-config/dist/apply_deferred_vscdb.js\"; APPLY_EC=\$?; elif command -v npx >/dev/null 2>&1; then echo deferred_restart:apply_via_npx env=\"\$ENV_LABEL\"; cd \"\$REPO_ROOT\" || true; if [ \"\$ENV_LABEL\" = \"staging\" ]; then npx --yes --package=log-llm-config-staging@latest apply-deferred-vscdb-staging; APPLY_EC=\$?; else npx --yes --package=log-llm-config@latest apply-deferred-vscdb; APPLY_EC=\$?; fi; else echo deferred_restart:no_npx; APPLY_EC=127; fi; echo deferred_restart:apply_exit=\$APPLY_EC; if [ \$APPLY_EC -ne 0 ]; then echo deferred_restart:APPLY_FAILED_see_messages_above; fi; echo deferred_restart:open_cursor; env -u npm_config_package -u npm_lifecycle_event -u npm_lifecycle_script -u npm_config_local_prefix open -a Cursor \"\$CURSOR_PROJECT\"; echo deferred_restart:open_exit=\$?; echo deferred_restart:end ts=\$(date -u +%Y-%m-%dT%H:%M:%SZ)' >/dev/null 2>&1 & killall -9 Cursor";
 /** Legacy manifests; hooks may run with cwd under `.cursor` where `pwd` is wrong. */
 const TRUSTED_CURSOR_JSON_SETTINGS_RESTART_COMMAND_LEGACY = 'CURSOR_PROJECT=$(git rev-parse --show-toplevel 2>/dev/null || pwd) && export CURSOR_PROJECT && nohup bash -c \'sleep 2 && open -a Cursor "$CURSOR_PROJECT"\' >/dev/null 2>&1 & killall -9 Cursor';
 const TRUSTED_CURSOR_JSON_SETTINGS_RESTART_COMMAND = 'REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd) && export REPO_ROOT && ' +

package/dist/log_config_files/sender/batch_sender.js

@@ -43,7 +43,7 @@ function readOrganizationUuid() {
     if (envValue)
         return envValue;
     try {
-        return fs.readFileSync(path.join(os.homedir(), 'opt-ai-sec', 'management', 'org', 'organization-uuid.txt'), 'utf8').trim();
+        return fs.readFileSync(path.join(os.homedir(), '.optimuslabs', 'management', 'org', 'organization-uuid.txt'), 'utf8').trim();
     }
     catch {
         return '';

package/dist/log_sensitive_paths_audit.js

@@ -10,7 +10,7 @@ import { existsSync, writeFileSync, mkdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { getSensitivePathsAuditCandidates } from './endpoint_client/index.js';
-import { OPT_AI_SEC_LOGS_REL, LOG_GROUP_AUDIT } from './bootstrap_constants.js';
+import { OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT } from './bootstrap_constants.js';
 import { loadEndpointBase } from './log_config_files/sender/endpoint_config.js';
 const AUDIT_FILENAME = 'sensitive_paths_audit.txt';
 function expandPath(template, cwd) {
@@ -63,7 +63,7 @@ export function writeSensitivePathsAudit(outputDir, pathTemplates, cwd = process
  * Run audit: fetch candidates from backend, check existence, write file. Returns paths for sending.
  * Used by log_config_files to include the audit in the same batch (same auth).
  */
-export async function runSensitivePathsAudit(endpointBase, outputDir = join(homedir(), OPT_AI_SEC_LOGS_REL, LOG_GROUP_AUDIT), cwd = process.cwd()) {
+export async function runSensitivePathsAudit(endpointBase, outputDir = join(homedir(), OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT), cwd = process.cwd()) {
     const response = await getSensitivePathsAuditCandidates(endpointBase);
     const pathTemplates = response?.paths ?? [];
     if (pathTemplates.length === 0 && !response) {
@@ -75,7 +75,7 @@ export async function runSensitivePathsAudit(endpointBase, outputDir = join(home
     return { paths };
 }
 export async function main() {
-    const outputDir = join(homedir(), OPT_AI_SEC_LOGS_REL, LOG_GROUP_AUDIT);
+    const outputDir = join(homedir(), OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT);
     const endpointBase = loadEndpointBase();
     await runSensitivePathsAudit(endpointBase, outputDir, process.cwd());
     process.exit(0);

package/dist/log_uuid/auth_key_store.js

@@ -1,9 +1,9 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
-import { OPT_AI_SEC_MANAGEMENT_REL } from '../bootstrap_constants.js';
+import { OPTIMUSLABS_MANAGEMENT_REL } from '../bootstrap_constants.js';
 import { loadEndpointBase } from '../log_config_files/sender/endpoint_config.js';
 import { buildStartupEndpointUrl, normalizeBaseUrl } from '../tofu.js';
-const AUTH_KEY_RELATIVE_PATH = path.join(OPT_AI_SEC_MANAGEMENT_REL, 'auth', 'auth_key.txt');
+const AUTH_KEY_RELATIVE_PATH = path.join(OPTIMUSLABS_MANAGEMENT_REL, 'auth', 'auth_key.txt');
 const getAuthKeyPath = () => {
     const homeDir = process.env.HOME || process.env.USERPROFILE;
     if (!homeDir)

package/dist/log_uuid/startup_sender.js

@@ -29,7 +29,7 @@ const readOrganizationUuid = () => {
     if (envValue)
         return envValue;
     try {
-        return fs.readFileSync(path.join(os.homedir(), 'opt-ai-sec', 'management', 'org', 'organization-uuid.txt'), 'utf8').trim();
+        return fs.readFileSync(path.join(os.homedir(), '.optimuslabs', 'management', 'org', 'organization-uuid.txt'), 'utf8').trim();
     }
     catch {
         return '';

package/dist/tofu.js

@@ -1,7 +1,7 @@
 /**
  * Tofu shim — centralises all imports from optimus-tofu.
  *
- * Reads ~/opt-ai-sec/management/optimus_dev.env at startup:
+ * Reads ~/.optimuslabs/management/optimus_dev.env at startup:
  *   - No file / unreadable → staging (ignores OPTIMUS_ENVIRONMENT).
  *   - File present → environment= line in file, then OPTIMUS_ENVIRONMENT, then staging.
  *   - environment=development + local dist present → loads sibling optimus-tofu dist

package/dist/tofu_environment.js

@@ -5,7 +5,7 @@ export function managementEnvPath() {
     const home = homedir();
     if (!home)
         return null;
-    return path.join(home, 'opt-ai-sec', 'management', 'optimus_dev.env');
+    return path.join(home, '.optimuslabs', 'management', 'optimus_dev.env');
 }
 /**
  * Resolve optimus environment label (matches shell hooks / optimus-tool-call):

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config",
-  "version": "1.5.8",
+  "version": "1.5.9",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {
@@ -58,6 +58,6 @@
   "dependencies": {
     "axios": "^1.15.2",
     "canonicalize": "^2.1.0",
-    "optimus-tofu": "^0.1.17"
+    "optimus-tofu": "^0.1.18"
   }
 }