litmus-cli 1.4.3 → 1.4.5

package/dist/lib/detection.js

@@ -0,0 +1,80 @@
+/**
+ * Claude surface classification — pure functions, unit-testable (watcher.ts
+ * is a spawned script, so logic living there can't be imported by tests).
+ *
+ * "claude" on a candidate machine is at least three different products, and
+ * the old bare-word pattern labeled them all `claude` — which report readers
+ * took to mean Claude Code with zero prompts captured, i.e. broken tracking:
+ *   claude_code    — the CLI / IDE extension; prompts capturable via hook
+ *   claude_desktop — the Desktop app; no hook exists
+ *   claude_web     — claude.ai in a browser tab; no hook can exist
+ *   claude         — legacy/unattributable, kept so old readers keep working
+ */
+/**
+ * Classifies every process-list line containing "claude" into surfaces.
+ * `ps` is the lowercased `ps aux` / `tasklist` output from getProcessList().
+ * A line matching no surface pattern stays legacy `claude` (unattributable —
+ * notably Windows tasklist, where Desktop and Claude Code are both bare
+ * `claude.exe` image names, and bystander strings like the VS Code
+ * extension's install path in some process's args).
+ */
+export function classifyClaudeProcesses(ps) {
+    const found = new Set();
+    for (const line of ps.split("\n")) {
+        if (!/\bclaude\b/.test(line))
+            continue;
+        if (/claude\.app|claude helper/.test(line)) {
+            // macOS Desktop app bundle and its renderer/GPU helpers
+            found.add("claude_desktop");
+        }
+        else if (/claude-code[/\\]cli\.js|[/\\]claude(?:\s|$)/.test(line)) {
+            // The npm entrypoint, or the `claude` binary itself as the executed
+            // path. Path-anchored so the word inside a directory name (the VS Code
+            // extension's install path, a .claude config dir) doesn't count as the
+            // CLI running. Desktop's binary also ends in /claude but its lines
+            // match the app-bundle branch above first.
+            found.add("claude_code");
+        }
+        else {
+            found.add("claude");
+        }
+    }
+    return [...found];
+}
+// Owners that mean "a browser tab". First-token matching: lsof reports
+// multi-word app names ("Google Chrome Helper", "Brave Browser") but the
+// leading token identifies the browser; Safari's network traffic comes from
+// com.apple.WebKit.Networking.
+const BROWSER_OWNER_RE = /^(google|chrome|chromium|safari|com\.apple\.webkit|firefox|msedge|microsoft|edge|brave|arc|opera|vivaldi)/i;
+/**
+ * Re-labels an Anthropic-bound connection by its owning process. The IP alone
+ * cannot separate the surfaces (claude.ai is Cloudflare-fronted and shares
+ * IPs), but the owner can, and each surface reads very differently in a
+ * report: Claude Code captures prompts via hook; Claude Desktop and a browser
+ * tab cannot capture anything.
+ *
+ * `owner` is the process name exactly as the OS reported it — case matters.
+ */
+export function refineClaudeTool(tool, owner) {
+    if (tool !== "claude_web" && tool !== "claude_api")
+        return tool;
+    if (!owner)
+        return tool; // OS gave no owner — keep the IP-derived label
+    // Windows image name: Desktop and Claude Code are both `claude.exe`, so the
+    // surface stays unattributable.
+    if (/^claude\.exe$/i.test(owner))
+        return "claude";
+    // Case is the signal on mac/linux: `claude` is the Claude Code CLI binary,
+    // `Claude` / `Claude Helper …` is the Desktop app (verified live on macOS).
+    if (/^claude(-code)?$/.test(owner))
+        return "claude_code";
+    if (/^Claude\b/.test(owner))
+        return "claude_desktop";
+    if (BROWSER_OWNER_RE.test(owner))
+        return tool;
+    // Some other app owns the socket (an Electron webview, a shared Cloudflare
+    // IP that isn't Anthropic at all). claude.ai traffic keeps the vendor but
+    // drops the surface claim; api traffic keeps its API label.
+    return tool === "claude_web" ? "claude" : tool;
+}
+//# sourceMappingURL=detection.js.map

package/dist/lib/detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detection.js","sourceRoot":"","sources":["../../src/lib/detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,EAAU;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAQ;QACtC,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,wDAAwD;YACxD,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;QAC7B,CAAC;aAAM,IAAI,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpE,oEAAoE;YACpE,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,2CAA2C;YAC3C,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QAC1B,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAA;AACnB,CAAC;AAED,uEAAuE;AACvE,yEAAyE;AACzE,4EAA4E;AAC5E,+BAA+B;AAC/B,MAAM,gBAAgB,GAAG,4GAA4G,CAAA;AAErI;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAC1D,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAA;IAC/D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA,CAAC,+CAA+C;IACvE,4EAA4E;IAC5E,gCAAgC;IAChC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IACjD,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAA;IACxD,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAA;IACpD,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,2EAA2E;IAC3E,0EAA0E;IAC1E,4DAA4D;IAC5D,OAAO,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC"}

package/dist/lib/hook-logger.cjs

@@ -155,6 +155,47 @@ function isAssessmentLitmusDir(litmusDir) {
   }
 }
 
+// ── Shadow fallback (ENG-1453; kept in step with cli/src/lib/shadow.ts) ──
+// `litmus init`/`doctor` mirror each assessment's config to
+// ~/.litmus/assessments/<assessmentId>/config.json, stamped with the project
+// dir it was written for. When the in-repo config is deleted mid-session
+// (the ENG-1446 incident), that mirror lets capture keep working instead of
+// exiting silently. Gated on the caller: only registry-listed project dirs
+// that still exist are ever matched, so a deleted or retired assessment can
+// never resurrect capture (ENG-953 principle).
+
+function realpathOr(p) {
+  // macOS: process.cwd() is realpath-resolved but stored paths may not be
+  // (e.g. /var vs /private/var), so compare both sides through realpath.
+  try { return fs.realpathSync(p) } catch { return path.resolve(p) }
+}
+
+function readShadowConfigForProject(projectDir) {
+  try {
+    const home = os.homedir()
+    if (!home) return null
+    const root = path.join(home, ".litmus", "assessments")
+    const target = realpathOr(projectDir)
+    for (const id of fs.readdirSync(root)) {
+      let cfg
+      try {
+        cfg = JSON.parse(fs.readFileSync(path.join(root, id, "config.json"), "utf8"))
+      } catch { continue }
+      if (!cfg || typeof cfg.projectDir !== "string" || typeof cfg.token !== "string") continue
+      if (realpathOr(cfg.projectDir) === target) return cfg
+    }
+  } catch { /* no shadows on this machine */ }
+  return null
+}
+
+function isLiveProjectDir(p) {
+  try {
+    return fs.statSync(p).isDirectory()
+  } catch {
+    return false
+  }
+}
+
 // Walk up from `startDir` looking for an assessment .litmus dir.
 function walkUpForLitmusDir(startDir) {
   let dir = startDir
@@ -222,7 +263,12 @@ function findLitmusDir(hintDirs = [], sessionDirs = []) {
     const list = JSON.parse(fs.readFileSync(registry, "utf8"))
     if (!Array.isArray(list)) return null
     const valid = list.filter(
-      p => typeof p === "string" && isAssessmentLitmusDir(path.join(p, ".litmus")),
+      p => typeof p === "string" && (
+        isAssessmentLitmusDir(path.join(p, ".litmus"))
+        // ENG-1453: config wiped but the assessment is alive — the dir still
+        // exists and its shadow mirror supplies identity + credentials.
+        || (isLiveProjectDir(p) && readShadowConfigForProject(p) !== null)
+      ),
     )
     if (!valid.length) return null
 
@@ -245,7 +291,9 @@ function readConfig(litmusDir) {
     const configPath = path.join(litmusDir, "config.json")
     return JSON.parse(fs.readFileSync(configPath, "utf8"))
   } catch {
-    return null
+    // ENG-1453: in-repo config gone — the shadow mirror keeps capture alive
+    // until the watcher's self-heal restores the file.
+    return readShadowConfigForProject(path.dirname(litmusDir))
   }
 }
 

package/dist/lib/platform.d.ts

@@ -17,21 +17,45 @@ export declare function getProcessList(): string;
  * Calls cb(err, stdout) with raw connection output.
  * Handles platform fallbacks internally (lsof → ss on Linux).
  *
- * - macOS: `lsof -i -n -P`
- * - Linux: `lsof -i -n -P`, falls back to `ss -tnp` if lsof is unavailable
- * - Windows: `netstat -ano`
+ * - macOS: `lsof -i -n -P +c0` (+c0 = untruncated COMMAND, so the owning
+ *   process is attributable — default lsof cuts it at 9 chars, which mangles
+ *   names like `com.apple.WebKit.Networking`)
+ * - Linux: same lsof, falls back to `ss -tnp` if lsof is unavailable
+ * - Windows: `netstat -ano` (PID only; resolve names via resolvePidNames)
  */
 export declare function getConnections(cb: (err: Error | null, stdout?: string) => void): void;
+export interface ConnectionMatch {
+    ip: string;
+    port: string;
+    /**
+     * Name of the process that owns the connection, exactly as the OS reported
+     * it — case matters (macOS: `Claude` is the Desktop app, `claude` is the
+     * Claude Code CLI). Empty when the OS output doesn't carry a name on the
+     * line (Windows netstat, permission-restricted ss rows).
+     */
+    owner: string;
+    /** Owning PID, only where the OS gives a PID instead of a name (Windows). */
+    pid?: string;
+}
 /**
- * Extracts the destination IP address from a single connection output line.
- * Returns a regex match array [fullMatch, ip, port] or null.
+ * Parses a single connection output line into destination IP/port plus the
+ * owning process, or null if the line isn't a connection row.
  *
  * Format varies by tool:
- *   lsof:    "... ->104.18.7.42:443 ..."
- *   ss:      "... 104.18.7.42:443"  (IP:port at end of line)
- *   netstat: "  TCP  local:port  foreign:port  STATE  PID"  (3rd column)
+ *   lsof:    "COMMAND PID USER ... ->104.18.7.42:443 (ESTABLISHED)"  (owner = col 1)
+ *   ss -tnp: "... dst:port users:((\"chrome\",pid=123,fd=9))"        (owner in users:())
+ *   netstat: "  TCP  local:port  foreign:port  STATE  PID"           (PID only, last col)
  *
- * On Unix, trying both lsof and ss patterns is safe — they don't cross-match.
+ * On Unix, trying both lsof and ss patterns is safe — they don't cross-match:
+ * lsof peers carry "->", and an ss peer is followed only by the optional
+ * users:() column.
  */
-export declare function extractConnectionIP(line: string): RegExpMatchArray | null;
+export declare function extractConnection(line: string): ConnectionMatch | null;
+/**
+ * Resolves PIDs to process image names where connection output only carries
+ * PIDs (Windows netstat). Calls cb with a PID → name map, or null on
+ * platforms where connection lines already name their owner (Unix) or when
+ * tasklist fails. Never throws.
+ */
+export declare function resolvePidNames(cb: (names: Map<string, string> | null) => void): void;
 //# sourceMappingURL=platform.d.ts.map

package/dist/lib/platform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/lib/platform.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH;;;;;;;;GAQG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAarF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAYzE"}
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/lib/platform.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH;;;;;;;;GAQG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAarF;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAA;IACb,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAqBtE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAkBrF"}

package/dist/lib/platform.js

@@ -23,16 +23,18 @@ export function getProcessList() {
  * Calls cb(err, stdout) with raw connection output.
  * Handles platform fallbacks internally (lsof → ss on Linux).
  *
- * - macOS: `lsof -i -n -P`
- * - Linux: `lsof -i -n -P`, falls back to `ss -tnp` if lsof is unavailable
- * - Windows: `netstat -ano`
+ * - macOS: `lsof -i -n -P +c0` (+c0 = untruncated COMMAND, so the owning
+ *   process is attributable — default lsof cuts it at 9 chars, which mangles
+ *   names like `com.apple.WebKit.Networking`)
+ * - Linux: same lsof, falls back to `ss -tnp` if lsof is unavailable
+ * - Windows: `netstat -ano` (PID only; resolve names via resolvePidNames)
  */
 export function getConnections(cb) {
     if (isWin) {
         execFile("netstat", ["-ano"], { timeout: 10000, encoding: "utf8", maxBuffer: 2 * 1024 * 1024 }, cb);
         return;
     }
-    execFile("lsof", ["-i", "-n", "-P"], { timeout: 10000, encoding: "utf8", maxBuffer: 2 * 1024 * 1024 }, (err, stdout) => {
+    execFile("lsof", ["-i", "-n", "-P", "+c0"], { timeout: 10000, encoding: "utf8", maxBuffer: 2 * 1024 * 1024 }, (err, stdout) => {
         if (err && err.code === "ENOENT" && isLinux) {
             // lsof unavailable on Linux — fall back to ss
             execFile("ss", ["-tnp"], { timeout: 5000, encoding: "utf8", maxBuffer: 1024 * 1024 }, cb);
@@ -43,27 +45,65 @@ export function getConnections(cb) {
     });
 }
 /**
- * Extracts the destination IP address from a single connection output line.
- * Returns a regex match array [fullMatch, ip, port] or null.
+ * Parses a single connection output line into destination IP/port plus the
+ * owning process, or null if the line isn't a connection row.
  *
  * Format varies by tool:
- *   lsof:    "... ->104.18.7.42:443 ..."
- *   ss:      "... 104.18.7.42:443"  (IP:port at end of line)
- *   netstat: "  TCP  local:port  foreign:port  STATE  PID"  (3rd column)
+ *   lsof:    "COMMAND PID USER ... ->104.18.7.42:443 (ESTABLISHED)"  (owner = col 1)
+ *   ss -tnp: "... dst:port users:((\"chrome\",pid=123,fd=9))"        (owner in users:())
+ *   netstat: "  TCP  local:port  foreign:port  STATE  PID"           (PID only, last col)
  *
- * On Unix, trying both lsof and ss patterns is safe — they don't cross-match.
+ * On Unix, trying both lsof and ss patterns is safe — they don't cross-match:
+ * lsof peers carry "->", and an ss peer is followed only by the optional
+ * users:() column.
  */
-export function extractConnectionIP(line) {
+export function extractConnection(line) {
     if (isWin) {
         const parts = line.trim().split(/\s+/);
         if (parts.length >= 4 && (parts[0] === "TCP" || parts[0] === "UDP")) {
-            return parts[2].match(/^(\d+\.\d+\.\d+\.\d+):(\d+)$/);
+            const m = parts[2].match(/^(\d+\.\d+\.\d+\.\d+):(\d+)$/);
+            if (!m)
+                return null;
+            return { ip: m[1], port: m[2], owner: "", pid: parts[parts.length - 1] };
         }
         return null;
     }
-    // lsof "->IP:port" (won't match ss output — no "->" in ss)
-    // ss "IP:port" at EOL (won't match lsof — lines end with "(STATE)")
-    return line.match(/->(\d+\.\d+\.\d+\.\d+):(\d+)/) ||
-        line.match(/\s(\d+\.\d+\.\d+\.\d+):(\d+)\s*$/);
+    const lsof = line.match(/->(\d+\.\d+\.\d+\.\d+):(\d+)/);
+    if (lsof) {
+        return { ip: lsof[1], port: lsof[2], owner: line.split(/\s+/, 1)[0] ?? "" };
+    }
+    // ss: the peer address is followed by the users:() column when ss can see
+    // the owner (own processes, or root), and ends the line when it can't.
+    const ss = line.match(/\s(\d+\.\d+\.\d+\.\d+):(\d+)(?:\s+users:\(\("([^"]+)".*)?$/);
+    if (ss) {
+        return { ip: ss[1], port: ss[2], owner: ss[3] ?? "" };
+    }
+    return null;
+}
+/**
+ * Resolves PIDs to process image names where connection output only carries
+ * PIDs (Windows netstat). Calls cb with a PID → name map, or null on
+ * platforms where connection lines already name their owner (Unix) or when
+ * tasklist fails. Never throws.
+ */
+export function resolvePidNames(cb) {
+    if (!isWin) {
+        cb(null);
+        return;
+    }
+    execFile("tasklist", ["/fo", "csv", "/nh"], { timeout: 10000, encoding: "utf8", maxBuffer: 2 * 1024 * 1024 }, (err, stdout) => {
+        if (err || !stdout) {
+            cb(null);
+            return;
+        }
+        const names = new Map();
+        for (const line of stdout.split("\n")) {
+            // CSV row: "Image Name","PID","Session Name","Session#","Mem Usage"
+            const m = line.match(/^"([^"]+)","(\d+)"/);
+            if (m)
+                names.set(m[2], m[1]);
+        }
+        cb(names);
+    });
 }
 //# sourceMappingURL=platform.js.map

package/dist/lib/platform.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/lib/platform.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAElD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAE5C;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAA;IACzC,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,EAAgD;IAC7E,IAAI,KAAK,EAAE,CAAC;QACV,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACpG,OAAM;IACR,CAAC;IACD,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QACtH,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;YACvE,8CAA8C;YAC9C,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC3F,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACjB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACtC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACvD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,2DAA2D;IAC3D,oEAAoE;IACpE,OAAO,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAA;AACvD,CAAC"}
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/lib/platform.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAElD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAE5C;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAA;IACzC,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,EAAgD;IAC7E,IAAI,KAAK,EAAE,CAAC;QACV,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACpG,OAAM;IACR,CAAC;IACD,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QAC7H,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;YACvE,8CAA8C;YAC9C,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC3F,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACjB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAgBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACtC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;YACxD,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAA;YACnB,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAA;QAC1E,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACvD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;IAC7E,CAAC;IACD,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAA;IACnF,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;IACvD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,EAA+C;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,EAAE,CAAC,IAAI,CAAC,CAAA;QACR,OAAM;IACR,CAAC;IACD,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QAC7H,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACnB,EAAE,CAAC,IAAI,CAAC,CAAA;YACR,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;QACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,oEAAoE;YACpE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;YAC1C,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,CAAC;QACD,EAAE,CAAC,KAAK,CAAC,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/lib/shadow.d.ts

@@ -0,0 +1,79 @@
+import type { LitmusConfig } from "./config.js";
+/**
+ * Shadow store for tracking-critical state (ENG-1453).
+ *
+ * Everything AI-capture depends on used to live only inside the assessment
+ * repo, gitignored — which put it squarely inside `git clean -fdX`'s blast
+ * radius (the ENG-1446 incident: one ordinary cleanup command deleted the
+ * config, the Copilot hook, and the forensic log at once). This module keeps
+ * a copy of the small, load-bearing pieces OUTSIDE the repo, next to the
+ * registry that already lives there:
+ *
+ *   ~/.litmus/assessments/<assessmentId>/
+ *     config.json     verbatim mirror of .litmus/config.json + { projectDir, mirroredAt }
+ *     chain.json      last uploaded chain position { seq, hash }
+ *     tracker.pid     mirror — lets doctor find a live watcher after a repo wipe
+ *     tracker.nonce   mirror — same
+ *   ~/.litmus/logs/<assessmentId>.log   tracker log (relocated, not mirrored)
+ *
+ * Rules (from the ENG-1453 security review):
+ *  - The in-repo config is ALWAYS authoritative when present; shadows are read
+ *    only when it is missing.
+ *  - Every write here is best-effort: a failing shadow write must never break
+ *    init, doctor, or the watcher.
+ *  - Shadows die with the assessment: deleted on submit/terminal outcomes and
+ *    pruned when their project dir is gone and unregistered.
+ */
+export interface ShadowConfig extends LitmusConfig {
+    /** Absolute assessment root the mirror was written for — the lookup key
+     *  when the in-repo config (and its directory) no longer exists. */
+    projectDir: string;
+    mirroredAt: string;
+}
+export interface ChainCursor {
+    seq: number;
+    hash: string;
+    updatedAt: string;
+}
+export declare function shadowRootDir(): string;
+export declare function shadowDirFor(assessmentId: string): string | null;
+export declare function shadowLogPath(assessmentId: string): string | null;
+/** Mirror a just-written config. Best-effort; returns whether it stuck. */
+export declare function writeShadowConfig(projectDir: string, config: LitmusConfig): boolean;
+export declare function readShadowConfigById(assessmentId: string): ShadowConfig | null;
+/** Find the shadow whose mirror was written for this project dir. */
+export declare function findShadowConfigForDir(projectDir: string): ShadowConfig | null;
+/** Record the last chain position the SERVER has (written after each
+ *  successful upload), so a replacement watcher whose activity.jsonl is gone
+ *  continues the chain instead of forking a second genesis. */
+export declare function writeShadowChainCursor(assessmentId: string, seq: number, hash: string): void;
+export declare function readShadowChainCursor(assessmentId: string): ChainCursor | null;
+export declare function writeShadowTrackerFile(assessmentId: string, name: "tracker.pid" | "tracker.nonce", content: string): void;
+export declare function readShadowTrackerFile(assessmentId: string, name: "tracker.pid" | "tracker.nonce"): string | null;
+export declare function shadowTrackerFileMtime(assessmentId: string, name: "tracker.pid" | "tracker.nonce"): number | null;
+export declare function deleteShadowForAssessment(assessmentId: string): void;
+/** Delete the shadow keyed to a project dir — works when the in-repo config
+ *  (which would have named the assessment) is already gone. */
+export declare function deleteShadowForProject(projectDir: string): void;
+/**
+ * Remove shadows whose assessment is demonstrably over on this machine:
+ * project dir no longer exists AND no registry entry points at it. A live
+ * assessment whose folder was merely wiped keeps its registry entry, so it
+ * survives pruning until submit/expiry releases it.
+ */
+export declare function pruneShadows(registryPaths: string[]): number;
+export declare const REPAIR_FILE_NAME = "LITMUS-REPAIR.md";
+/** Written by the watcher only when self-heal could not act (server
+ *  unreachable, no usable shadow, AND the in-memory restore failed to write).
+ *  Rewritten every heartbeat while the outage lasts — a cleanup pass that
+ *  deletes it gets it back — and removed the moment the config is restored.
+ *
+ *  Deliberately carries NO credentials: a project-root file can be committed,
+ *  pushed, read into an AI agent's context, or shipped in the submission zip,
+ *  so the token must never appear here. The candidate's assessment page
+ *  ("Something not working?") shows the full copy-paste repair command, and
+ *  `litmus doctor` run bare prompts for the token pointing at that panel. */
+export declare function repairFileContent(): string;
+export declare function writeRepairFile(projectDir: string): void;
+export declare function removeRepairFile(projectDir: string): void;
+//# sourceMappingURL=shadow.d.ts.map

package/dist/lib/shadow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shadow.d.ts","sourceRoot":"","sources":["../../src/lib/shadow.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,WAAW,YAAa,SAAQ,YAAY;IAChD;wEACoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB;AAMD,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAOD,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGhE;AAED,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGjE;AA6BD,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAcnF;AAiBD,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAQ9E;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAO9E;AAcD;;+DAE+D;AAC/D,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAS5F;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAU9E;AAID,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,eAAe,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAOzH;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,MAAM,GAAG,IAAI,CAQhH;AAED,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,MAAM,GAAG,IAAI,CAQjH;AAID,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAQpE;AAED;+DAC+D;AAC/D,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAG/D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,CAe5D;AAID,eAAO,MAAM,gBAAgB,qBAAqB,CAAA;AAElD;;;;;;;;;6EAS6E;AAC7E,wBAAgB,iBAAiB,IAAI,MAAM,CAoB1C;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAIxD;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAEzD"}