litmus-cli 1.0.20 → 1.1.0

package/dist/lib/env-hosts.js

@@ -0,0 +1,19 @@
+/**
+ * Maps a 1-character env code (the prefix on a minted assessment token) to the
+ * Vercel preview host that issued it. Production tokens have no prefix and fall
+ * through to the FALLBACK_URL in `errors.ts`.
+ *
+ * Keep in sync with `LITMUS_ENV_CODE` set on the corresponding Vercel envs
+ * (see ENG-440).
+ */
+export const ENV_HOSTS = {
+    c: "https://caroline.litmushiring.com",
+    e: "https://elena.litmushiring.com",
+    s: "https://shaivi.litmushiring.com",
+};
+/** Resolve apiBase from a token's env prefix, or null if no recognized prefix. */
+export function resolveApiBaseFromToken(token) {
+    const m = token.match(/^([a-z])_/);
+    return m && ENV_HOSTS[m[1]] ? ENV_HOSTS[m[1]] : null;
+}
+//# sourceMappingURL=env-hosts.js.map

package/dist/lib/env-hosts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-hosts.js","sourceRoot":"","sources":["../../src/lib/env-hosts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAA2B;IAC/C,CAAC,EAAE,mCAAmC;IACtC,CAAC,EAAE,gCAAgC;IACnC,CAAC,EAAE,iCAAiC;CACrC,CAAA;AAED,kFAAkF;AAClF,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IAClC,OAAO,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACtD,CAAC"}

package/dist/{utils → lib}/errors.d.ts

@@ -1,4 +1,4 @@
-export declare const FALLBACK_URL = "https://www.litmus.build";
+export declare const FALLBACK_URL = "https://www.litmushiring.com";
 export declare class FatalError extends Error {
     constructor();
 }

package/dist/lib/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,YAAY,iCAAiC,CAAA;AAE1D,qBAAa,UAAW,SAAQ,KAAK;;CAEpC;AAID,QAAA,IAAI,YAAY,EAAE;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAEN,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,YAAY,CAAC,GAAG,IAAI,CAEvE;AAaD,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;AAyCnD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAElE;AAED;;;;;;;;GAQG;AACH,wBAAgB,KAAK,CACnB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,GAAG;IAAE,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAAE,GAC/D,KAAK,CA2BP;AAED;;GAEG;AACH,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1C;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE7C;AAED;;GAEG;AACH,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1C"}

package/dist/{utils → lib}/errors.js

@@ -3,7 +3,7 @@ import os from "os";
 import { readFileSync } from "fs";
 import { fileURLToPath } from "url";
 import { dirname, join } from "path";
-export const FALLBACK_URL = "https://www.litmus.build";
+export const FALLBACK_URL = "https://www.litmushiring.com";
 export class FatalError extends Error {
     constructor() { super(); }
 }
@@ -40,7 +40,6 @@ function reportEvent(severity, message, hint, event) {
     const payload = JSON.stringify({
         severity,
         event,
-        token: errorContext.token,
         message,
         hint,
         candidateEmail: errorContext.candidateEmail,
@@ -80,7 +79,7 @@ export function fatal(message, hint, opts) {
     if (hint) {
         console.error(chalk.dim("  Hint: ") + hint);
     }
-    console.error(chalk.dim(`  Need help? Visit ${FALLBACK_URL} or contact founders@litmus.build`));
+    console.error(chalk.dim(`  Need help? Visit ${FALLBACK_URL} or contact founders@litmushiring.com`));
     console.error();
     // Build the full message for the report (includes internal details the candidate doesn't see)
     const reportMessage = internalDetail ? `${message}\n\nInternal detail: ${internalDetail}` : message;

package/dist/lib/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAA;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAA;AACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEpC,MAAM,CAAC,MAAM,YAAY,GAAG,8BAA8B,CAAA;AAE1D,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,gBAAgB,KAAK,EAAE,CAAA,CAAC,CAAC;CAC1B;AACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,YAAY,CAAA;AAEnE,wEAAwE;AACxE,IAAI,YAAY,GAKZ,EAAE,CAAA;AAEN,MAAM,UAAU,eAAe,CAAC,GAAiC;IAC/D,YAAY,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,GAAG,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;QAC1F,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAID;;;;;;;;;GASG;AACH,SAAS,WAAW,CAClB,QAAkB,EAClB,OAAe,EACf,IAAa,EACb,KAAc;IAEd,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,gBAAgB,CAAA;IACtF,MAAM,GAAG,GAAG,GAAG,OAAO,iBAAiB,CAAA;IAEvC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,QAAQ;QACR,KAAK;QACL,OAAO;QACP,IAAI;QACJ,cAAc,EAAE,YAAY,CAAC,cAAc;QAC3C,cAAc,EAAE,YAAY,CAAC,cAAc;QAC3C,UAAU,EAAE,aAAa,EAAE;QAC3B,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE;QACvB,WAAW,EAAE,OAAO,CAAC,OAAO;KAC7B,CAAC,CAAA;IAEF,OAAO,KAAK,CAAC,GAAG,EAAE;QAChB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAK,CAAC;KACnC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,OAAe;IAC1D,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;AAChE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,KAAK,CACnB,OAAe,EACf,IAAa,EACb,IAAgE;IAEhE,+DAA+D;IAC/D,MAAM,EAAE,cAAc,EAAE,QAAQ,GAAG,OAAO,EAAE,GAC1C,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAmB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAEnG,OAAO,CAAC,KAAK,EAAE,CAAA;IACf,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,CAAA;IAC/C,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,sBAAsB,YAAY,uCAAuC,CAAC,CACrF,CAAA;IACD,OAAO,CAAC,KAAK,EAAE,CAAA;IAEf,8FAA8F;IAC9F,MAAM,aAAa,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,OAAO,wBAAwB,cAAc,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IAEnG,gDAAgD;IAChD,mEAAmE;IACnE,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAClC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,IAAK,CAAC,CAAA;IACtC,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAExD,uEAAuE;IACvE,8DAA8D;IAC9D,MAAM,IAAI,UAAU,EAAE,CAAA;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,IAAI,CAAC,OAAe;IAClC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,CAAA;AACrD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,OAAe;IACrC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAA;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,IAAI,CAAC,OAAe;IAClC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAA;AACxC,CAAC"}

package/dist/lib/extract.d.ts

@@ -1,6 +1,6 @@
 /**
  * Extract a ZIP file from disk to a target directory.
- * Using Open.file + extract() is the most reliable unzipper API.
+ * Iterates entries individually to validate paths against traversal attacks.
  */
 export declare function extractZip(zipPath: string, targetDir: string): Promise<void>;
 //# sourceMappingURL=extract.d.ts.map

package/dist/lib/extract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extract.d.ts","sourceRoot":"","sources":["../../src/lib/extract.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf"}
+{"version":3,"file":"extract.d.ts","sourceRoot":"","sources":["../../src/lib/extract.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAqBf"}

package/dist/lib/extract.js

@@ -1,12 +1,28 @@
+import { createWriteStream } from "fs";
 import { mkdir } from "fs/promises";
+import path from "path";
+import { pipeline } from "stream/promises";
 import unzipper from "unzipper";
 /**
  * Extract a ZIP file from disk to a target directory.
- * Using Open.file + extract() is the most reliable unzipper API.
+ * Iterates entries individually to validate paths against traversal attacks.
  */
 export async function extractZip(zipPath, targetDir) {
-    await mkdir(targetDir, { recursive: true });
+    const resolvedTarget = path.resolve(targetDir) + path.sep;
+    await mkdir(resolvedTarget, { recursive: true });
     const directory = await unzipper.Open.file(zipPath);
-    await directory.extract({ path: targetDir });
+    for (const entry of directory.files) {
+        const resolvedPath = path.resolve(resolvedTarget, entry.path);
+        if (!resolvedPath.startsWith(resolvedTarget)) {
+            throw new Error(`ZIP path traversal detected: "${entry.path}" escapes target directory`);
+        }
+        if (entry.type === "Directory") {
+            await mkdir(resolvedPath, { recursive: true });
+        }
+        else {
+            await mkdir(path.dirname(resolvedPath), { recursive: true });
+            await pipeline(entry.stream(), createWriteStream(resolvedPath));
+        }
+    }
 }
 //# sourceMappingURL=extract.js.map

package/dist/lib/extract.js.map

@@ -1 +1 @@
-{"version":3,"file":"extract.js","sourceRoot":"","sources":["../../src/lib/extract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AACnC,OAAO,QAAQ,MAAM,UAAU,CAAA;AAE/B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,SAAiB;IAEjB,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACnD,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;AAC9C,CAAC"}
+{"version":3,"file":"extract.js","sourceRoot":"","sources":["../../src/lib/extract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAA;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AACnC,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC1C,OAAO,QAAQ,MAAM,UAAU,CAAA;AAE/B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,SAAiB;IAEjB,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAA;IACzD,MAAM,KAAK,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEhD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAEnD,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;QACpC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAC7D,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,CAAC,IAAI,4BAA4B,CACxE,CAAA;QACH,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAChD,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAC5D,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/lib/hook-logger.cjs

@@ -58,14 +58,16 @@ function uploadEvent(config, event) {
   if (!config || !config.token || !config.backendUrl) return
 
   const body = JSON.stringify({ events: [event] })
-  const url = new URL(
-    `${config.backendUrl}/cli/activity?token=${encodeURIComponent(config.token)}`
-  )
+  const url = new URL(`${config.backendUrl}/cli/activity`)
   const reqFn = url.protocol === "https:" ? https.request : http.request
 
   const req = reqFn(url, {
     method: "POST",
-    headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) },
+    headers: {
+      "Content-Type": "application/json",
+      "Content-Length": Buffer.byteLength(body),
+      "Authorization": `Bearer ${config.token}`,
+    },
     timeout: 5000,
   })
   req.on("error", () => {}) // Swallow — fire-and-forget

package/dist/lib/platform.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Platform adapter — encapsulates OS-specific commands so detection logic
+ * stays platform-agnostic. Callers never branch on process.platform.
+ */
+/**
+ * Returns lowercase text listing all running processes.
+ * Used for regex matching against editor/AI tool name patterns.
+ *
+ * - macOS/Linux: `ps aux` (full command lines)
+ * - Windows: `tasklist` (image names like Code.exe, Cursor.exe)
+ *
+ * Output is lowercased so patterns like /\bcode\b/ match uniformly.
+ */
+export declare function getProcessList(): string;
+/**
+ * Lists active network connections asynchronously.
+ * Calls cb(err, stdout) with raw connection output.
+ * Handles platform fallbacks internally (lsof → ss on Linux).
+ *
+ * - macOS: `lsof -i -n -P`
+ * - Linux: `lsof -i -n -P`, falls back to `ss -tnp` if lsof is unavailable
+ * - Windows: `netstat -ano`
+ */
+export declare function getConnections(cb: (err: Error | null, stdout?: string) => void): void;
+/**
+ * Extracts the destination IP address from a single connection output line.
+ * Returns a regex match array [fullMatch, ip, port] or null.
+ *
+ * Format varies by tool:
+ *   lsof:    "... ->104.18.7.42:443 ..."
+ *   ss:      "... 104.18.7.42:443"  (IP:port at end of line)
+ *   netstat: "  TCP  local:port  foreign:port  STATE  PID"  (3rd column)
+ *
+ * On Unix, trying both lsof and ss patterns is safe — they don't cross-match.
+ */
+export declare function extractConnectionIP(line: string): RegExpMatchArray | null;
+//# sourceMappingURL=platform.d.ts.map

package/dist/lib/platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/lib/platform.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH;;;;;;;;GAQG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAarF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAYzE"}

package/dist/lib/platform.js

@@ -0,0 +1,69 @@
+/**
+ * Platform adapter — encapsulates OS-specific commands so detection logic
+ * stays platform-agnostic. Callers never branch on process.platform.
+ */
+import { execSync, execFile } from "child_process";
+const isWin = process.platform === "win32";
+const isLinux = process.platform === "linux";
+/**
+ * Returns lowercase text listing all running processes.
+ * Used for regex matching against editor/AI tool name patterns.
+ *
+ * - macOS/Linux: `ps aux` (full command lines)
+ * - Windows: `tasklist` (image names like Code.exe, Cursor.exe)
+ *
+ * Output is lowercased so patterns like /\bcode\b/ match uniformly.
+ */
+export function getProcessList() {
+    const cmd = isWin ? "tasklist" : "ps aux";
+    return execSync(cmd, { timeout: 5000, encoding: "utf8" }).toLowerCase();
+}
+/**
+ * Lists active network connections asynchronously.
+ * Calls cb(err, stdout) with raw connection output.
+ * Handles platform fallbacks internally (lsof → ss on Linux).
+ *
+ * - macOS: `lsof -i -n -P`
+ * - Linux: `lsof -i -n -P`, falls back to `ss -tnp` if lsof is unavailable
+ * - Windows: `netstat -ano`
+ */
+export function getConnections(cb) {
+    if (isWin) {
+        execFile("netstat", ["-ano"], { timeout: 10000, encoding: "utf8", maxBuffer: 2 * 1024 * 1024 }, cb);
+        return;
+    }
+    execFile("lsof", ["-i", "-n", "-P"], { timeout: 10000, encoding: "utf8", maxBuffer: 2 * 1024 * 1024 }, (err, stdout) => {
+        if (err && err.code === "ENOENT" && isLinux) {
+            // lsof unavailable on Linux — fall back to ss
+            execFile("ss", ["-tnp"], { timeout: 5000, encoding: "utf8", maxBuffer: 1024 * 1024 }, cb);
+        }
+        else {
+            cb(err, stdout);
+        }
+    });
+}
+/**
+ * Extracts the destination IP address from a single connection output line.
+ * Returns a regex match array [fullMatch, ip, port] or null.
+ *
+ * Format varies by tool:
+ *   lsof:    "... ->104.18.7.42:443 ..."
+ *   ss:      "... 104.18.7.42:443"  (IP:port at end of line)
+ *   netstat: "  TCP  local:port  foreign:port  STATE  PID"  (3rd column)
+ *
+ * On Unix, trying both lsof and ss patterns is safe — they don't cross-match.
+ */
+export function extractConnectionIP(line) {
+    if (isWin) {
+        const parts = line.trim().split(/\s+/);
+        if (parts.length >= 4 && (parts[0] === "TCP" || parts[0] === "UDP")) {
+            return parts[2].match(/^(\d+\.\d+\.\d+\.\d+):(\d+)$/);
+        }
+        return null;
+    }
+    // lsof "->IP:port" (won't match ss output — no "->" in ss)
+    // ss "IP:port" at EOL (won't match lsof — lines end with "(STATE)")
+    return line.match(/->(\d+\.\d+\.\d+\.\d+):(\d+)/) ||
+        line.match(/\s(\d+\.\d+\.\d+\.\d+):(\d+)\s*$/);
+}
+//# sourceMappingURL=platform.js.map

package/dist/lib/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/lib/platform.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAElD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAE5C;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAA;IACzC,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,EAAgD;IAC7E,IAAI,KAAK,EAAE,CAAC;QACV,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACpG,OAAM;IACR,CAAC;IACD,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QACtH,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;YACvE,8CAA8C;YAC9C,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC3F,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACjB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACtC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACvD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,2DAA2D;IAC3D,oEAAoE;IACpE,OAAO,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAA;AACvD,CAAC"}

package/dist/lib/schemas.d.ts

@@ -0,0 +1,24 @@
+import { z } from "zod";
+export declare const InitMetadataSchema: z.ZodObject<{
+    assessmentId: z.ZodUUID;
+    assessmentName: z.ZodString;
+    folderName: z.ZodString;
+    backendUrl: z.ZodURL;
+    candidateEmail: z.ZodEmail;
+    candidateName: z.ZodString;
+    deadline: z.ZodNullable<z.ZodISODateTime>;
+    timeLimit: z.ZodNullable<z.ZodNumber>;
+    startedAt: z.ZodISODateTime;
+}, z.core.$strip>;
+export type InitMetadata = z.infer<typeof InitMetadataSchema>;
+export declare const SubmitResultSchema: z.ZodObject<{
+    submissionId: z.ZodUUID;
+    success: z.ZodBoolean;
+    message: z.ZodString;
+}, z.core.$strip>;
+export type SubmitResult = z.infer<typeof SubmitResultSchema>;
+export declare const SubmitStatusSchema: z.ZodObject<{
+    videoUploaded: z.ZodBoolean;
+}, z.core.$strip>;
+export type SubmitStatus = z.infer<typeof SubmitStatusSchema>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/lib/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/lib/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,kBAAkB;;;;;;;;;;iBAa7B,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAE7D,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAE7D,eAAO,MAAM,kBAAkB;;iBAE7B,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA"}

package/dist/lib/schemas.js

@@ -0,0 +1,21 @@
+import { z } from "zod";
+export const InitMetadataSchema = z.object({
+    assessmentId: z.uuid(),
+    assessmentName: z.string(),
+    folderName: z.string(),
+    backendUrl: z.url(),
+    candidateEmail: z.email(),
+    candidateName: z.string(),
+    deadline: z.iso.datetime().nullable(),
+    timeLimit: z.number().nullable(),
+    startedAt: z.iso.datetime(),
+});
+export const SubmitResultSchema = z.object({
+    submissionId: z.uuid(),
+    success: z.boolean(),
+    message: z.string(),
+});
+export const SubmitStatusSchema = z.object({
+    videoUploaded: z.boolean(),
+});
+//# sourceMappingURL=schemas.js.map

package/dist/lib/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/lib/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAE1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE;IAEnB,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IAEzB,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAA;AAIF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAA;AAIF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC,CAAA"}

package/dist/lib/tracker.d.ts

@@ -1,6 +1,6 @@
 /**
  * Start the file watcher in the background.
- * Spawns watcher.cjs as a detached process; logs file events to
+ * Spawns watcher.js as a detached process; logs file events to
  * <projectDir>/.litmus/activity.jsonl for later inclusion in the submission ZIP.
  */
 export declare function startTracker(projectDir: string): void;

package/dist/lib/tracker.js

@@ -15,7 +15,7 @@ function isProcessAlive(pid) {
 }
 /**
  * Start the file watcher in the background.
- * Spawns watcher.cjs as a detached process; logs file events to
+ * Spawns watcher.js as a detached process; logs file events to
  * <projectDir>/.litmus/activity.jsonl for later inclusion in the submission ZIP.
  */
 export function startTracker(projectDir) {
@@ -42,7 +42,7 @@ export function startTracker(projectDir) {
         }
     }
     const errFd = openSync(errLog, "a");
-    const watcherPath = path.join(__dirname, "watcher.cjs");
+    const watcherPath = path.join(__dirname, "watcher.js");
     const cliBinPath = path.join(__dirname, "..", "index.js");
     const child = spawn(process.execPath, [watcherPath, projectDir, activityLog, cliBinPath], {
         detached: true,

package/dist/lib/tracker.js.map

@@ -1 +1 @@
-{"version":3,"file":"tracker.js","sourceRoot":"","sources":["../../src/lib/tracker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AACrC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAA;AACjF,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAA;AAEnC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACjD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;AAE1C,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA,CAAC,qCAAqC;QAC1D,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IAClD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;IAElD,IAAI,CAAC;QACH,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,wCAAwC;IACxC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;YACtE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;gBACvD,OAAM,CAAC,0BAA0B;YACnC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IAEzD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE;QACxF,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC;KACnC,CAAC,CAAA;IAEF,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,IAAI,CAAC;YACH,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"tracker.js","sourceRoot":"","sources":["../../src/lib/tracker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AACrC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAA;AACjF,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAA;AAEnC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACjD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;AAE1C,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA,CAAC,qCAAqC;QAC1D,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IAClD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;IAElD,IAAI,CAAC;QACH,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,wCAAwC;IACxC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;YACtE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;gBACvD,OAAM,CAAC,0BAA0B;YACnC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IAEzD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE;QACxF,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC;KACnC,CAAC,CAAA;IAEF,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,IAAI,CAAC;YACH,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/lib/watcher.d.ts

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+/**
+ * Litmus file activity watcher.
+ * Runs as a detached background process started by `litmus init`.
+ * Usage: node watcher.js <projectDir> <activityLogPath> [cliBinPath]
+ *
+ * Tracks:
+ * - File changes with size deltas and large-paste detection (debounced 500ms per file)
+ * - Heartbeat events every 5 minutes
+ * - Git commit events (polled every 30s)
+ * - Editor and AI tool detection (polled every 10 min)
+ * - Auto-submit at deadline (if deadline/timeLimit configured)
+ *
+ * Writes newline-delimited JSON to the activity log.
+ */
+export {};
+//# sourceMappingURL=watcher.d.ts.map

package/dist/lib/watcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"watcher.d.ts","sourceRoot":"","sources":["../../src/lib/watcher.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;GAaG"}