litmus-cli 1.4.20 → 1.4.21

package/dist/lib/hook-logger.cjs

@@ -12,12 +12,21 @@
  * `hook_event_name`, not argv — the same logger command is registered for both
  * event kinds per tool.
  *
+ * An `ai_response` may additionally carry the turn's metering, when the tool's
+ * payload has it: `model`, `input_tokens`, `output_tokens`, `cache_read_tokens`,
+ * `status` (ENG-1956, Cursor `stop` today). Those names are the GATEWAY
+ * emitter's, so a reader needs no per-tool branch — see cursorTurnMeta.
+ *
  * Response sources per tool:
  *   claude  Stop payload -> read transcript_path (JSONL), assistant text of the
  *           final turn
  *   codex   Stop payload -> `last_assistant_message` directly
  *   cursor  afterAgentResponse payload -> `text` directly (IDE only; the
- *           cursor-agent CLI never fires it)
+ *           cursor-agent CLI never fires it, and Cursor 3.17.19 does not list
+ *           the event at all, so the container lane's only response event is
+ *           `stop` and this branch is unreachable there)
+ *           stop payload -> read transcript_path (JSONL), the final turn's
+ *           answer, plus the payload's own model + token counts
  *   copilot Stop payload -> read transcript_path (JSONL), assistant.message
  *           entries of the final turn (VS Code shape; CLI best-effort)
  *   gemini  AfterAgent payload -> `prompt_response` directly (arrives inline;
@@ -35,7 +44,7 @@ const os = require("os")
 const https = require("https")
 const http = require("http")
 const crypto = require("crypto")
-const { spawn } = require("child_process")
+const { spawn, spawnSync } = require("child_process")
 
 // Keep under the server's MAX_EVENT_SIZE (2048 bytes) after JSON serialization.
 // ~1800 chars of prompt + ~150 bytes of wrapper fields + JSON escaping = safely under 2KB.
@@ -513,6 +522,186 @@ function uploadEvent(config, event) {
   })
 }
 
+// ── The drain lane (ENG-1962) ─────────────────────────────────────
+//
+// `activity.jsonl` is `-rw-r--r-- candidate candidate`, and until submission it
+// is the ONLY copy of a captured prompt. A candidate can edit it or delete it
+// after the fact and nothing notices — measured on production 2026-08-28, a
+// container held six correctly paired Cursor events while the database held
+// none, with terminal commands from the same container arriving within ~4s
+// throughout. So the append below is also the trigger for a second copy, sent
+// at write time down a lane the candidate cannot reach afterwards:
+//
+//   this process -> /opt/litmus/bin/litmus-ttee-send -> /run/litmus/ttee.sock
+//     -> ttee-drain (root) -> the container's root-owned json-log
+//     -> hostd `docker logs` -> /internal/host/activity
+//
+// What that buys and what it does not. The host holds the upload credential, so
+// nothing here needs one — which is why this beats giving the container a
+// submission token, since that token would have to live in `.litmus/config.json`
+// and ride into every submission zip and backup tar. The record becomes
+// hard to SUPPRESS. It does not become unforgeable: the drain's own peer check
+// is a filter against a naive injector, and this binary is on the rootfs any
+// process can invoke. See ttee-drain.c's honest-residual note.
+//
+// FAIL-OPEN, like every other line of this lane. A missing sender, a missing
+// socket, a full drain, a machine that is not the workspace at all — every one
+// of them degrades to file-only capture, which is exactly what happens today.
+//
+// Absolute paths, never PATH and never an env override. Two independent reasons,
+// and the second is the one that bites:
+//
+//   * The drain grades an AI frame by this exact path (`ai_peer_verdict`,
+//     ttee-drain.c): a peer here is ATTESTED, a peer under /home or /tmp is
+//     rejected outright, and anything else is accepted but marked unattested.
+//     In the container it can never read a cross-uid peer at all — that needs
+//     CAP_SYS_PTRACE, which is deliberately dropped — so every frame there is
+//     unattested today. The path still matters for the day it can, and it is
+//     what install-ttee.sh asserts against. See HARDENING.md's residual.
+//   * PATH is the single input to this lane a candidate can influence, and an
+//     env override would hand them a one-variable way to turn capture off
+//     without touching anything we can see.
+//
+// Historical note, corrected rather than deleted because the old reason is the
+// one people remember: this used to be justified by cursor-server shipping its
+// own node under /home, which the drain's rootfs check rejected. Since the
+// connecting process is this sender and never node, the INTERPRETER's path no
+// longer decides whether a frame is accepted — the SENDER's does.
+const DRAIN_SENDER = "/opt/litmus/bin/litmus-ttee-send"
+const DRAIN_SOCKET = "/run/litmus/ttee.sock"
+
+// Must stay at or under ttee-drain's TTEE_MAX_FRAME (8192). The drain recv()s a
+// fixed-size buffer with no MSG_TRUNC check, so an oversize frame arrives cut
+// mid-JSON, hostd's json.loads fails and the event disappears with no diagnostic
+// — which is why the sender REFUSES an over-cap frame rather than clipping it,
+// and why the body is trimmed here, on the only side that knows which field is
+// the body. The margin covers the drain's own envelope and a pathological
+// escape expansion in the fields we do not trim.
+const MAX_DRAIN_FRAME_BYTES = 7800
+
+// The drain answers in microseconds (one connect + one datagram to a local
+// SEQPACKET socket). This bound exists for the pathological case — a wedged
+// socket, a stopped drain process — not the normal one, and it is an order of
+// magnitude under every hook runner's allowance.
+const DRAIN_SEND_TIMEOUT_MS = 1500
+
+// The marker a trimmed body carries. ASCII on purpose: `…` reaches the judge as
+// `?`, and a reader with no marker at all cannot tell a short reply from a cut one.
+const TRUNCATION_MARKER = "...[truncated]"
+
+/**
+ * Trim `event[field]` by halving until the whole event serializes inside
+ * `maxBytes`. Returns true if it fits, false if it cannot at any body length.
+ *
+ * The halving is over the ORIGINAL body, tracked in a counter that strictly
+ * decreases, and NOT over the already-trimmed value. Slicing the trimmed value
+ * does not converge: TRUNCATION_MARKER is 14 characters, so once the body is
+ * short each pass adds back more than it removes and the length oscillates —
+ * 13, 27, 13, 27 — forever. That is an infinite loop inside a candidate's
+ * prompt hook, which is the one thing this file must never do, and it is
+ * reachable through any wrapper field a tool controls the size of (`sessionId`
+ * and `model` both arrive from the tool's payload).
+ *
+ * Character caps do not bound SERIALIZED size, which is why this measures bytes:
+ * JSON.stringify escapes non-ASCII and control characters, so a body well under
+ * a character cap can be far over a byte one in CJK, Devanagari, emoji, or
+ * heavily escaped text.
+ */
+function trimEventToBytes(event, field, maxBytes) {
+  const full = typeof event[field] === "string" ? event[field] : ""
+  let kept = full.length
+  while (Buffer.byteLength(JSON.stringify(event), "utf8") > maxBytes) {
+    if (kept === 0) return false   // the non-body fields alone blow the cap
+    kept = Math.floor(kept / 2)
+    event[field] = kept ? full.slice(0, kept) + TRUNCATION_MARKER : ""
+  }
+  return true
+}
+
+/**
+ * The frame ttee-drain forwards for one captured event, or null if it cannot be
+ * built inside the cap.
+ *
+ * `ev` names the LANE, not the tool: `cursor_hook` is the hook-binary-to-drain
+ * route, and the tool that produced the event rides in `tool`. The name is the
+ * one already pinned by hostd's `_parse_cursor_hook` and by the bakeoff gate
+ * `hook_frame_captured`, which greps for it literally — change it in one place
+ * and the frame is dropped by the parser and reported as "no frame arrived".
+ *
+ * ONE frame per event, never chunked: the drain emits one log line per frame and
+ * hostd turns one line into one event, so a split prompt would reach the grader
+ * as prompts the candidate never sent (bakeoff gate `hook_oversize_prompt`
+ * fails on more than one frame for exactly this reason).
+ *
+ * Exported for tests.
+ */
+function buildDrainFrame(event, hookEventName) {
+  if (!event || typeof event !== "object") return null
+  const bodyField = event.type === "ai_response" ? "text" : "prompt"
+  const body = typeof event[bodyField] === "string" ? event[bodyField] : ""
+  // Rebuilt rather than spread: the payload this event came from carries the
+  // candidate's real email address and whatever else the tool decides to add
+  // next, so the frame is an ALLOW-LIST for the same reason cursorTurnMeta is.
+  const frame = {
+    ev: "cursor_hook",
+    kind: event.type,
+    tool: event.tool,
+    ts: event.ts,
+  }
+  // The per-event id minted before either copy was written. It is what makes the
+  // two copies of ONE exchange one stored event — see where it is minted for why
+  // the pairing cannot rest on (sessionId, turnId). Carried ahead of the body so
+  // the trim below can never cost it.
+  if (event.id) frame.id = event.id
+  if (typeof hookEventName === "string" && hookEventName) frame.hook = hookEventName
+  // `sessionId` deliberately does NOT ride under that name. hostd runs every
+  // event it emits through `strip_credentials`, whose key list drops anything
+  // spelled session / sessionid / session_id — an HTTP-audit rule that is right
+  // for its own purpose and a false positive on a chat-session key. hostd's own
+  // recovered events already spell it `conversationId` for this reason; the
+  // frame matches so the two sides read the same. (Do not "fix" this back.)
+  if (event.sessionId) frame.conversationId = event.sessionId
+  if (event.turnId) frame.turnId = event.turnId
+  for (const k of ["model", "input_tokens", "output_tokens", "cache_read_tokens", "status"]) {
+    if (event[k] !== undefined) frame[k] = event[k]
+  }
+  frame.text = body
+  // Trim the BODY only, so the metering and the pairing ids always survive —
+  // they are what makes a truncated record still worth having, and they cost a
+  // fixed ~200 bytes.
+  if (!trimEventToBytes(frame, "text", MAX_DRAIN_FRAME_BYTES)) return null
+  if (!frame.text) return null   // trimmed to nothing: a husk with a turn id and
+                                 // no content reads downstream as a captured
+                                 // prompt that said nothing. Send no frame.
+  if (frame.text !== body) frame.textTruncated = true
+  return JSON.stringify(frame)
+}
+
+/**
+ * Best-effort copy of `event` onto the root drain. Returns nothing and throws
+ * nothing: every failure is file-only capture, the state this lane is in today.
+ */
+function emitToDrain(event, hookEventName) {
+  try {
+    // Cheapest possible negative. On a candidate's own laptop — where this file
+    // is also installed — neither path exists and this costs two stat calls.
+    if (process.platform !== "linux") return
+    if (!fs.existsSync(DRAIN_SENDER) || !fs.existsSync(DRAIN_SOCKET)) return
+    const frame = buildDrainFrame(event, hookEventName)
+    if (!frame) return
+    spawnSync(DRAIN_SENDER, [], {
+      input: frame,
+      timeout: DRAIN_SEND_TIMEOUT_MS,
+      // stdout is discarded on principle (the sender writes none, and a byte on
+      // OUR stdout would be a byte in Cursor's verdict); stderr is inherited so
+      // a refused frame leaves a breadcrumb in the hook log instead of nothing.
+      stdio: ["pipe", "ignore", "inherit"],
+    })
+  } catch {
+    // Unwritable, unspawnable, out of pids — never the candidate's problem.
+  }
+}
+
 function readStdin() {
   return new Promise((resolve) => {
     let resolved = false
@@ -899,6 +1088,43 @@ function readCursorTranscriptResponse(transcriptPath) {
   return readSettledTranscript(transcriptPath, raw => parseCursorTranscript(raw).text)
 }
 
+/**
+ * The turn's metering, lifted off a Cursor `stop` payload (ENG-1956).
+ *
+ * FIELD NAMES ARE THE GATEWAY'S, NOT CURSOR'S, and that is the point: the
+ * gateway emitter (backend/services/gateway_capture.py `build_event`) already
+ * publishes `model` / `input_tokens` / `output_tokens` alongside a reply, and
+ * every downstream reader is written against those names. Renaming Cursor's
+ * `model_id` to `model` here is what keeps this lane from needing a special
+ * case anywhere in the grader. `cache_read_tokens` and `status` have no gateway
+ * counterpart; they are carried under their own payload names.
+ *
+ * `model_id` before `model` deliberately: the payload's `model` is Cursor's
+ * internal variant string ("cursor-grok-4.6-high-fast") while `model_id` is the
+ * model identity ("grok-4.6"), and identity is what is comparable to what every
+ * other lane reports.
+ *
+ * AN ALLOW-LIST, NEVER A COPY-WITH-DELETIONS. The `stop` payload also carries
+ * `user_email` — the candidate's real personal address — so the only safe
+ * construction is one that names what it takes. A spread-then-delete would
+ * publish the next PII field Cursor adds, on the day they add it, with nothing
+ * failing.
+ */
+function cursorTurnMeta(data) {
+  if (!data || typeof data !== "object") return null
+  const meta = {}
+  const model = data.model_id || data.model
+  if (typeof model === "string" && model) meta.model = model
+  for (const key of ["input_tokens", "output_tokens", "cache_read_tokens"]) {
+    const value = data[key]
+    // `typeof true === "boolean"`, so bool cannot sneak in here — but a
+    // non-finite number can, and JSON.stringify would render it `null`.
+    if (typeof value === "number" && Number.isFinite(value)) meta[key] = Math.trunc(value)
+  }
+  if (typeof data.status === "string" && data.status) meta.status = data.status
+  return Object.keys(meta).length ? meta : null
+}
+
 /**
  * Extract the assistant response from a post-response hook payload. Returns
  * `{ text, sessionId }` with text=null when the payload carries no capturable
@@ -955,6 +1181,9 @@ function extractResponse(data, toolName) {
       const common = {
         sessionId: data.session_id || data.conversation_id || null,
         workspaceRoots: Array.isArray(data.workspace_roots) ? data.workspace_roots : [],
+        // Present on `stop` (which carries the metering and no text) and absent
+        // from `afterAgentResponse` (which carries the text and no metering).
+        meta: cursorTurnMeta(data),
       }
       // afterAgentResponse (IDE only) hands us the text directly — preferred,
       // since it needs no transcript and has no flush race.
@@ -1224,11 +1453,13 @@ async function main() {
   let content = null
   let sessionId = null
   let workspaceRoots = []
+  let responseMeta = null
   if (responseEvent) {
     const extracted = extractResponse(parsed, effectiveTool)
     content = extracted.text
     sessionId = extracted.sessionId
     workspaceRoots = extracted.workspaceRoots || []
+    responseMeta = extracted.meta || null
   } else {
     const extracted = extractPrompt(raw, effectiveTool)
     content = extracted.prompt
@@ -1305,25 +1536,48 @@ async function main() {
       tool: effectiveTool,
       prompt: truncated,
     }
+  // ENG-1962: ONE id per captured event, minted here — before either copy is
+  // written — so the copy in `activity.jsonl` and the copy that goes down the
+  // drain carry the same one and collapse into a single stored event.
+  //
+  // Lane-independent on purpose. The obvious pairing handle is
+  // (sessionId, turnId), and it is not enough: `startTurn` returns null for a
+  // payload with no session id, and several tools have none to give (VS Code
+  // Copilot Chat's `session_id` is optional, an unrecognised tool takes the
+  // `default:` branch, and a reply whose prompt-side turn file is missing gets
+  // no turn either). Every one of those exchanges would then be stored and
+  // graded twice — the ENG-1347 2x count, arriving by this new route. An id we
+  // mint ourselves pairs the two copies whatever the tool reports.
+  //
+  // `id` rather than a name of our own because `activity_dedupe_key` already
+  // prefers it over the whole-event digest, so both seams collapse the pair with
+  // no second mechanism; and it survives hostd's `strip_credentials`, whose key
+  // list would have deleted anything spelled session/token/secret.
+  event.id = crypto.randomUUID()
   if (sessionId) event.sessionId = sessionId
   if (turnId) event.turnId = turnId
-
-  // Character caps don't bound SERIALIZED size: the server measures
-  // JSON bytes, and JSON.stringify escapes non-ASCII and control characters —
-  // a response well under MAX_RESPONSE_LENGTH characters can exceed the
-  // server's 65536-byte content cap in CJK, Devanagari, emoji, or heavily
-  // escaped text. The server now trims rather than drops, but trimming here
-  // too keeps that a backstop instead of the normal path, and keeps the
-  // in-zip activity.jsonl consistent with what was uploaded.
+  // The turn's model and token counts (ENG-1956). Attached BEFORE the byte-cap
+  // loop below so their bytes are counted against the same budget the body is
+  // trimmed to fit — otherwise a reply trimmed to exactly the cap could be
+  // pushed back over it by the metering, and the server would trim it again.
+  // They are a fixed ~120 bytes, so they never meaningfully cost reply text.
+  if (responseMeta) Object.assign(event, responseMeta)
+
+  // Character caps don't bound SERIALIZED size — see trimEventToBytes, which
+  // also carries the reason this halves the ORIGINAL body rather than the
+  // already-trimmed one. This loop used to do the latter and could therefore
+  // spin forever on any event whose wrapper fields alone approached the cap;
+  // that needed a ~60 KB `sessionId` or `model` (both arrive from the tool's
+  // payload) so it had never fired, but it is a hang in a candidate's prompt
+  // hook and the drain lane above reuses the same idiom at a much tighter cap,
+  // where it fires easily. One helper, one convergence argument.
+  //
+  // The server now trims rather than drops, but trimming here too keeps that a
+  // backstop instead of the normal path, and keeps the in-zip activity.jsonl
+  // consistent with what was uploaded.
   const MAX_SERIALIZED_BYTES = 60000
   const bodyField = responseEvent ? "text" : "prompt"
-  while (
-    Buffer.byteLength(JSON.stringify(event), "utf8") > MAX_SERIALIZED_BYTES
-    && event[bodyField].length > 0
-  ) {
-    const kept = Math.max(0, Math.floor(event[bodyField].length / 2))
-    event[bodyField] = kept ? event[bodyField].slice(0, kept) + "...[truncated]" : ""
-  }
+  trimEventToBytes(event, bodyField, MAX_SERIALIZED_BYTES)
 
   // Record that this turn's reply is captured, so the sibling `stop` hook
   // doesn't record it a second time (IDE only — see the claim helpers).
@@ -1339,6 +1593,12 @@ async function main() {
     // Non-critical
   }
 
+  // 1b. Same moment, second copy: onto the root drain, where the candidate
+  // cannot edit or delete it afterwards (ENG-1962). Additive — step 1 above
+  // stays the submission-zip path, so a container whose drain lane is down
+  // still grades exactly as it does today.
+  emitToDrain(event, parsed && parsed.hook_event_name)
+
   // 2. Upload to the server. Awaited, bounded — see uploadEvent.
   const config = readConfig(litmusDir)
   await uploadEvent(config, event)
@@ -1355,8 +1615,13 @@ async function main() {
 module.exports = {
   watcherPresumedDead,
   reviveThrottleAllows,
+  buildDrainFrame,
+  trimEventToBytes,
   WATCHER_NONCE_MAX_AGE_MS,
   REVIVE_THROTTLE_MS,
+  MAX_DRAIN_FRAME_BYTES,
+  DRAIN_SENDER,
+  DRAIN_SOCKET,
 }
 
 if (require.main === module) {

package/dist/lib/platform.d.ts

@@ -1,6 +1,13 @@
 /**
  * Platform adapter — encapsulates OS-specific commands so detection logic
  * stays platform-agnostic. Callers never branch on process.platform.
+ *
+ * Every child_process call here MUST pass `windowsHide: true`. This module
+ * runs inside the watcher, which is spawned detached and therefore has no
+ * console on Windows — and a console-subsystem child (tasklist, netstat) of
+ * a console-less parent allocates a NEW VISIBLE console window, so candidates
+ * see terminal windows flash on every detection cycle (ENG-2010). The flag is
+ * a no-op on Unix; tests/unit/windows-hide.test.ts enforces it.
  */
 /**
  * Returns lowercase text listing all running processes.

package/dist/lib/platform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/lib/platform.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH;;;;;;;;GAQG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAarF;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAA;IACb,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAqBtE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAkBrF"}
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/lib/platform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH;;;;;;;;GAQG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAarF;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAA;IACb,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAqBtE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAkBrF"}

package/dist/lib/platform.js

@@ -1,6 +1,13 @@
 /**
  * Platform adapter — encapsulates OS-specific commands so detection logic
  * stays platform-agnostic. Callers never branch on process.platform.
+ *
+ * Every child_process call here MUST pass `windowsHide: true`. This module
+ * runs inside the watcher, which is spawned detached and therefore has no
+ * console on Windows — and a console-subsystem child (tasklist, netstat) of
+ * a console-less parent allocates a NEW VISIBLE console window, so candidates
+ * see terminal windows flash on every detection cycle (ENG-2010). The flag is
+ * a no-op on Unix; tests/unit/windows-hide.test.ts enforces it.
  */
 import { execSync, execFile } from "child_process";
 const isWin = process.platform === "win32";
@@ -16,7 +23,7 @@ const isLinux = process.platform === "linux";
  */
 export function getProcessList() {
     const cmd = isWin ? "tasklist" : "ps aux";
-    return execSync(cmd, { timeout: 5000, encoding: "utf8" }).toLowerCase();
+    return execSync(cmd, { timeout: 5000, encoding: "utf8", windowsHide: true }).toLowerCase();
 }
 /**
  * Lists active network connections asynchronously.
@@ -31,13 +38,13 @@ export function getProcessList() {
  */
 export function getConnections(cb) {
     if (isWin) {
-        execFile("netstat", ["-ano"], { timeout: 10000, encoding: "utf8", maxBuffer: 2 * 1024 * 1024 }, cb);
+        execFile("netstat", ["-ano"], { timeout: 10000, encoding: "utf8", maxBuffer: 2 * 1024 * 1024, windowsHide: true }, cb);
         return;
     }
-    execFile("lsof", ["-i", "-n", "-P", "+c0"], { timeout: 10000, encoding: "utf8", maxBuffer: 2 * 1024 * 1024 }, (err, stdout) => {
+    execFile("lsof", ["-i", "-n", "-P", "+c0"], { timeout: 10000, encoding: "utf8", maxBuffer: 2 * 1024 * 1024, windowsHide: true }, (err, stdout) => {
         if (err && err.code === "ENOENT" && isLinux) {
             // lsof unavailable on Linux — fall back to ss
-            execFile("ss", ["-tnp"], { timeout: 5000, encoding: "utf8", maxBuffer: 1024 * 1024 }, cb);
+            execFile("ss", ["-tnp"], { timeout: 5000, encoding: "utf8", maxBuffer: 1024 * 1024, windowsHide: true }, cb);
         }
         else {
             cb(err, stdout);
@@ -91,7 +98,7 @@ export function resolvePidNames(cb) {
         cb(null);
         return;
     }
-    execFile("tasklist", ["/fo", "csv", "/nh"], { timeout: 10000, encoding: "utf8", maxBuffer: 2 * 1024 * 1024 }, (err, stdout) => {
+    execFile("tasklist", ["/fo", "csv", "/nh"], { timeout: 10000, encoding: "utf8", maxBuffer: 2 * 1024 * 1024, windowsHide: true }, (err, stdout) => {
         if (err || !stdout) {
             cb(null);
             return;

package/dist/lib/platform.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/lib/platform.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAElD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAE5C;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAA;IACzC,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,EAAgD;IAC7E,IAAI,KAAK,EAAE,CAAC;QACV,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACpG,OAAM;IACR,CAAC;IACD,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QAC7H,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;YACvE,8CAA8C;YAC9C,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC3F,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACjB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAgBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACtC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;YACxD,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAA;YACnB,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAA;QAC1E,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACvD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;IAC7E,CAAC;IACD,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAA;IACnF,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;IACvD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,EAA+C;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,EAAE,CAAC,IAAI,CAAC,CAAA;QACR,OAAM;IACR,CAAC;IACD,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QAC7H,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACnB,EAAE,CAAC,IAAI,CAAC,CAAA;YACR,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;QACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,oEAAoE;YACpE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;YAC1C,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,CAAC;QACD,EAAE,CAAC,KAAK,CAAC,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/lib/platform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAElD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAE5C;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAA;IACzC,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AAC5F,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,EAAgD;IAC7E,IAAI,KAAK,EAAE,CAAC;QACV,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACvH,OAAM;IACR,CAAC;IACD,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QAChJ,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;YACvE,8CAA8C;YAC9C,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9G,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACjB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAgBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACtC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;YACxD,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAA;YACnB,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAA;QAC1E,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACvD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;IAC7E,CAAC;IACD,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAA;IACnF,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;IACvD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,EAA+C;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,EAAE,CAAC,IAAI,CAAC,CAAA;QACR,OAAM;IACR,CAAC;IACD,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QAChJ,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACnB,EAAE,CAAC,IAAI,CAAC,CAAA;YACR,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;QACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,oEAAoE;YACpE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;YAC1C,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,CAAC;QACD,EAAE,CAAC,KAAK,CAAC,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/lib/watcher.js

@@ -946,7 +946,10 @@ function checkGitCommits() {
         if (!currentHash || currentHash === lastCommitHash)
             return;
         lastCommitHash = currentHash;
-        const info = execSync('git log -1 --numstat --pretty=format:"%H|%aI|%s"', { cwd: projectDir, timeout: 5000, encoding: "utf8" });
+        // windowsHide on every shell-out in this file: the watcher is spawned
+        // detached (no console on Windows), so a console-subsystem child would
+        // otherwise open a visible console window in the candidate's face (ENG-2010).
+        const info = execSync('git log -1 --numstat --pretty=format:"%H|%aI|%s"', { cwd: projectDir, timeout: 5000, encoding: "utf8", windowsHide: true });
         const lines = info.trim().split("\n");
         const header = lines[0].replace(/^"|"$/g, "");
         const firstPipe = header.indexOf("|");
@@ -1367,6 +1370,7 @@ function getGitDiff() {
             cwd: projectDir,
             maxBuffer: 500000,
             timeout: 10000,
+            windowsHide: true,
         }).toString().slice(0, 200000);
     }
     catch {
@@ -1376,6 +1380,7 @@ function getGitDiff() {
                 cwd: projectDir,
                 maxBuffer: 500000,
                 timeout: 10000,
+                windowsHide: true,
             }).toString().slice(0, 200000);
         }
         catch {
@@ -1389,6 +1394,7 @@ function getRecentCommits() {
             cwd: projectDir,
             maxBuffer: 100000,
             timeout: 10000,
+            windowsHide: true,
         }).toString();
         const commits = [];
         const lines = raw.split("\n");
@@ -1489,7 +1495,7 @@ setTimeout(() => {
 if (cliBinPath && litmusConfig) {
     const runAutoSubmit = () => new Promise((resolveRun) => {
         process.stderr.write("[watcher] deadline reached (server-verified), auto-submitting\n");
-        execFile(process.execPath, [cliBinPath, "submit", "--yes"], { cwd: projectDir, timeout: 5 * 60000 }, (err, stdout, stderr) => {
+        execFile(process.execPath, [cliBinPath, "submit", "--yes"], { cwd: projectDir, timeout: 5 * 60000, windowsHide: true }, (err, stdout, stderr) => {
             if (!err) {
                 process.stderr.write("[watcher] auto-submit succeeded\n");
                 // The watcher's spawn() in tracker.ts uses stdio:["ignore", "ignore",