litmus-cli 1.4.3 → 1.4.6

package/dist/lib/hook-logger.cjs

@@ -155,6 +155,47 @@ function isAssessmentLitmusDir(litmusDir) {
   }
 }
 
+// ── Shadow fallback (ENG-1453; kept in step with cli/src/lib/shadow.ts) ──
+// `litmus init`/`doctor` mirror each assessment's config to
+// ~/.litmus/assessments/<assessmentId>/config.json, stamped with the project
+// dir it was written for. When the in-repo config is deleted mid-session
+// (the ENG-1446 incident), that mirror lets capture keep working instead of
+// exiting silently. Gated on the caller: only registry-listed project dirs
+// that still exist are ever matched, so a deleted or retired assessment can
+// never resurrect capture (ENG-953 principle).
+
+function realpathOr(p) {
+  // macOS: process.cwd() is realpath-resolved but stored paths may not be
+  // (e.g. /var vs /private/var), so compare both sides through realpath.
+  try { return fs.realpathSync(p) } catch { return path.resolve(p) }
+}
+
+function readShadowConfigForProject(projectDir) {
+  try {
+    const home = os.homedir()
+    if (!home) return null
+    const root = path.join(home, ".litmus", "assessments")
+    const target = realpathOr(projectDir)
+    for (const id of fs.readdirSync(root)) {
+      let cfg
+      try {
+        cfg = JSON.parse(fs.readFileSync(path.join(root, id, "config.json"), "utf8"))
+      } catch { continue }
+      if (!cfg || typeof cfg.projectDir !== "string" || typeof cfg.token !== "string") continue
+      if (realpathOr(cfg.projectDir) === target) return cfg
+    }
+  } catch { /* no shadows on this machine */ }
+  return null
+}
+
+function isLiveProjectDir(p) {
+  try {
+    return fs.statSync(p).isDirectory()
+  } catch {
+    return false
+  }
+}
+
 // Walk up from `startDir` looking for an assessment .litmus dir.
 function walkUpForLitmusDir(startDir) {
   let dir = startDir
@@ -222,7 +263,12 @@ function findLitmusDir(hintDirs = [], sessionDirs = []) {
     const list = JSON.parse(fs.readFileSync(registry, "utf8"))
     if (!Array.isArray(list)) return null
     const valid = list.filter(
-      p => typeof p === "string" && isAssessmentLitmusDir(path.join(p, ".litmus")),
+      p => typeof p === "string" && (
+        isAssessmentLitmusDir(path.join(p, ".litmus"))
+        // ENG-1453: config wiped but the assessment is alive — the dir still
+        // exists and its shadow mirror supplies identity + credentials.
+        || (isLiveProjectDir(p) && readShadowConfigForProject(p) !== null)
+      ),
     )
     if (!valid.length) return null
 
@@ -245,7 +291,9 @@ function readConfig(litmusDir) {
     const configPath = path.join(litmusDir, "config.json")
     return JSON.parse(fs.readFileSync(configPath, "utf8"))
   } catch {
-    return null
+    // ENG-1453: in-repo config gone — the shadow mirror keeps capture alive
+    // until the watcher's self-heal restores the file.
+    return readShadowConfigForProject(path.dirname(litmusDir))
   }
 }
 

package/dist/lib/platform.d.ts

@@ -17,21 +17,45 @@ export declare function getProcessList(): string;
  * Calls cb(err, stdout) with raw connection output.
  * Handles platform fallbacks internally (lsof → ss on Linux).
  *
- * - macOS: `lsof -i -n -P`
- * - Linux: `lsof -i -n -P`, falls back to `ss -tnp` if lsof is unavailable
- * - Windows: `netstat -ano`
+ * - macOS: `lsof -i -n -P +c0` (+c0 = untruncated COMMAND, so the owning
+ *   process is attributable — default lsof cuts it at 9 chars, which mangles
+ *   names like `com.apple.WebKit.Networking`)
+ * - Linux: same lsof, falls back to `ss -tnp` if lsof is unavailable
+ * - Windows: `netstat -ano` (PID only; resolve names via resolvePidNames)
  */
 export declare function getConnections(cb: (err: Error | null, stdout?: string) => void): void;
+export interface ConnectionMatch {
+    ip: string;
+    port: string;
+    /**
+     * Name of the process that owns the connection, exactly as the OS reported
+     * it — case matters (macOS: `Claude` is the Desktop app, `claude` is the
+     * Claude Code CLI). Empty when the OS output doesn't carry a name on the
+     * line (Windows netstat, permission-restricted ss rows).
+     */
+    owner: string;
+    /** Owning PID, only where the OS gives a PID instead of a name (Windows). */
+    pid?: string;
+}
 /**
- * Extracts the destination IP address from a single connection output line.
- * Returns a regex match array [fullMatch, ip, port] or null.
+ * Parses a single connection output line into destination IP/port plus the
+ * owning process, or null if the line isn't a connection row.
  *
  * Format varies by tool:
- *   lsof:    "... ->104.18.7.42:443 ..."
- *   ss:      "... 104.18.7.42:443"  (IP:port at end of line)
- *   netstat: "  TCP  local:port  foreign:port  STATE  PID"  (3rd column)
+ *   lsof:    "COMMAND PID USER ... ->104.18.7.42:443 (ESTABLISHED)"  (owner = col 1)
+ *   ss -tnp: "... dst:port users:((\"chrome\",pid=123,fd=9))"        (owner in users:())
+ *   netstat: "  TCP  local:port  foreign:port  STATE  PID"           (PID only, last col)
  *
- * On Unix, trying both lsof and ss patterns is safe — they don't cross-match.
+ * On Unix, trying both lsof and ss patterns is safe — they don't cross-match:
+ * lsof peers carry "->", and an ss peer is followed only by the optional
+ * users:() column.
  */
-export declare function extractConnectionIP(line: string): RegExpMatchArray | null;
+export declare function extractConnection(line: string): ConnectionMatch | null;
+/**
+ * Resolves PIDs to process image names where connection output only carries
+ * PIDs (Windows netstat). Calls cb with a PID → name map, or null on
+ * platforms where connection lines already name their owner (Unix) or when
+ * tasklist fails. Never throws.
+ */
+export declare function resolvePidNames(cb: (names: Map<string, string> | null) => void): void;
 //# sourceMappingURL=platform.d.ts.map

package/dist/lib/platform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/lib/platform.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH;;;;;;;;GAQG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAarF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAYzE"}
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/lib/platform.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH;;;;;;;;GAQG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAarF;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAA;IACb,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAqBtE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAkBrF"}

package/dist/lib/platform.js

@@ -23,16 +23,18 @@ export function getProcessList() {
  * Calls cb(err, stdout) with raw connection output.
  * Handles platform fallbacks internally (lsof → ss on Linux).
  *
- * - macOS: `lsof -i -n -P`
- * - Linux: `lsof -i -n -P`, falls back to `ss -tnp` if lsof is unavailable
- * - Windows: `netstat -ano`
+ * - macOS: `lsof -i -n -P +c0` (+c0 = untruncated COMMAND, so the owning
+ *   process is attributable — default lsof cuts it at 9 chars, which mangles
+ *   names like `com.apple.WebKit.Networking`)
+ * - Linux: same lsof, falls back to `ss -tnp` if lsof is unavailable
+ * - Windows: `netstat -ano` (PID only; resolve names via resolvePidNames)
  */
 export function getConnections(cb) {
     if (isWin) {
         execFile("netstat", ["-ano"], { timeout: 10000, encoding: "utf8", maxBuffer: 2 * 1024 * 1024 }, cb);
         return;
     }
-    execFile("lsof", ["-i", "-n", "-P"], { timeout: 10000, encoding: "utf8", maxBuffer: 2 * 1024 * 1024 }, (err, stdout) => {
+    execFile("lsof", ["-i", "-n", "-P", "+c0"], { timeout: 10000, encoding: "utf8", maxBuffer: 2 * 1024 * 1024 }, (err, stdout) => {
         if (err && err.code === "ENOENT" && isLinux) {
             // lsof unavailable on Linux — fall back to ss
             execFile("ss", ["-tnp"], { timeout: 5000, encoding: "utf8", maxBuffer: 1024 * 1024 }, cb);
@@ -43,27 +45,65 @@ export function getConnections(cb) {
     });
 }
 /**
- * Extracts the destination IP address from a single connection output line.
- * Returns a regex match array [fullMatch, ip, port] or null.
+ * Parses a single connection output line into destination IP/port plus the
+ * owning process, or null if the line isn't a connection row.
  *
  * Format varies by tool:
- *   lsof:    "... ->104.18.7.42:443 ..."
- *   ss:      "... 104.18.7.42:443"  (IP:port at end of line)
- *   netstat: "  TCP  local:port  foreign:port  STATE  PID"  (3rd column)
+ *   lsof:    "COMMAND PID USER ... ->104.18.7.42:443 (ESTABLISHED)"  (owner = col 1)
+ *   ss -tnp: "... dst:port users:((\"chrome\",pid=123,fd=9))"        (owner in users:())
+ *   netstat: "  TCP  local:port  foreign:port  STATE  PID"           (PID only, last col)
  *
- * On Unix, trying both lsof and ss patterns is safe — they don't cross-match.
+ * On Unix, trying both lsof and ss patterns is safe — they don't cross-match:
+ * lsof peers carry "->", and an ss peer is followed only by the optional
+ * users:() column.
  */
-export function extractConnectionIP(line) {
+export function extractConnection(line) {
     if (isWin) {
         const parts = line.trim().split(/\s+/);
         if (parts.length >= 4 && (parts[0] === "TCP" || parts[0] === "UDP")) {
-            return parts[2].match(/^(\d+\.\d+\.\d+\.\d+):(\d+)$/);
+            const m = parts[2].match(/^(\d+\.\d+\.\d+\.\d+):(\d+)$/);
+            if (!m)
+                return null;
+            return { ip: m[1], port: m[2], owner: "", pid: parts[parts.length - 1] };
         }
         return null;
     }
-    // lsof "->IP:port" (won't match ss output — no "->" in ss)
-    // ss "IP:port" at EOL (won't match lsof — lines end with "(STATE)")
-    return line.match(/->(\d+\.\d+\.\d+\.\d+):(\d+)/) ||
-        line.match(/\s(\d+\.\d+\.\d+\.\d+):(\d+)\s*$/);
+    const lsof = line.match(/->(\d+\.\d+\.\d+\.\d+):(\d+)/);
+    if (lsof) {
+        return { ip: lsof[1], port: lsof[2], owner: line.split(/\s+/, 1)[0] ?? "" };
+    }
+    // ss: the peer address is followed by the users:() column when ss can see
+    // the owner (own processes, or root), and ends the line when it can't.
+    const ss = line.match(/\s(\d+\.\d+\.\d+\.\d+):(\d+)(?:\s+users:\(\("([^"]+)".*)?$/);
+    if (ss) {
+        return { ip: ss[1], port: ss[2], owner: ss[3] ?? "" };
+    }
+    return null;
+}
+/**
+ * Resolves PIDs to process image names where connection output only carries
+ * PIDs (Windows netstat). Calls cb with a PID → name map, or null on
+ * platforms where connection lines already name their owner (Unix) or when
+ * tasklist fails. Never throws.
+ */
+export function resolvePidNames(cb) {
+    if (!isWin) {
+        cb(null);
+        return;
+    }
+    execFile("tasklist", ["/fo", "csv", "/nh"], { timeout: 10000, encoding: "utf8", maxBuffer: 2 * 1024 * 1024 }, (err, stdout) => {
+        if (err || !stdout) {
+            cb(null);
+            return;
+        }
+        const names = new Map();
+        for (const line of stdout.split("\n")) {
+            // CSV row: "Image Name","PID","Session Name","Session#","Mem Usage"
+            const m = line.match(/^"([^"]+)","(\d+)"/);
+            if (m)
+                names.set(m[2], m[1]);
+        }
+        cb(names);
+    });
 }
 //# sourceMappingURL=platform.js.map

package/dist/lib/platform.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/lib/platform.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAElD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAE5C;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAA;IACzC,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,EAAgD;IAC7E,IAAI,KAAK,EAAE,CAAC;QACV,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACpG,OAAM;IACR,CAAC;IACD,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QACtH,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;YACvE,8CAA8C;YAC9C,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC3F,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACjB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACtC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACvD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,2DAA2D;IAC3D,oEAAoE;IACpE,OAAO,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAA;AACvD,CAAC"}
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/lib/platform.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAElD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAE5C;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAA;IACzC,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,EAAgD;IAC7E,IAAI,KAAK,EAAE,CAAC;QACV,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACpG,OAAM;IACR,CAAC;IACD,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QAC7H,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;YACvE,8CAA8C;YAC9C,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC3F,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACjB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAgBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACtC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;YACxD,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAA;YACnB,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAA;QAC1E,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACvD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;IAC7E,CAAC;IACD,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAA;IACnF,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;IACvD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,EAA+C;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,EAAE,CAAC,IAAI,CAAC,CAAA;QACR,OAAM;IACR,CAAC;IACD,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QAC7H,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACnB,EAAE,CAAC,IAAI,CAAC,CAAA;YACR,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;QACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,oEAAoE;YACpE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;YAC1C,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,CAAC;QACD,EAAE,CAAC,KAAK,CAAC,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/lib/schemas.d.ts

@@ -19,6 +19,12 @@ export declare const SubmitResultSchema: z.ZodObject<{
     dashboardUrl: z.ZodOptional<z.ZodNullable<z.ZodURL>>;
 }, z.core.$strip>;
 export type SubmitResult = z.infer<typeof SubmitResultSchema>;
+export declare const ServerTimesSchema: z.ZodObject<{
+    startedAt: z.ZodNullable<z.ZodISODateTime>;
+    deadline: z.ZodNullable<z.ZodISODateTime>;
+    timeLimit: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strip>;
+export type ServerTimes = z.infer<typeof ServerTimesSchema>;
 export declare const SubmitStatusSchema: z.ZodObject<{
     videoUploaded: z.ZodBoolean;
 }, z.core.$strip>;

package/dist/lib/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/lib/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,kBAAkB;;;;;;;;;;;iBAgB7B,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAE7D,eAAO,MAAM,kBAAkB;;;;;iBAQ7B,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAE7D,eAAO,MAAM,kBAAkB;;iBAE7B,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAM7D,eAAO,MAAM,yBAAyB;;;;;;iBAQpC,CAAA;AAEF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/lib/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,kBAAkB;;;;;;;;;;;iBAgB7B,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAE7D,eAAO,MAAM,kBAAkB;;;;;iBAQ7B,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAK7D,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAA;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE3D,eAAO,MAAM,kBAAkB;;iBAE7B,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAM7D,eAAO,MAAM,yBAAyB;;;;;;iBAQpC,CAAA;AAEF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA"}

package/dist/lib/schemas.js

@@ -22,6 +22,14 @@ export const SubmitResultSchema = z.object({
     // Optional so this stays compatible with mode=NONE responses.
     dashboardUrl: z.url().nullish(),
 });
+// ENG-1489: authoritative times riding the /cli/activity response, so a live
+// watcher re-arms when the deadline moves server-side. Offset-tolerant: the
+// backend emits Z-suffixed ISO, but any valid offset is the same instant.
+export const ServerTimesSchema = z.object({
+    startedAt: z.iso.datetime({ offset: true }).nullable(),
+    deadline: z.iso.datetime({ offset: true }).nullable(),
+    timeLimit: z.number().nullable(),
+});
 export const SubmitStatusSchema = z.object({
     videoUploaded: z.boolean(),
 });

package/dist/lib/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/lib/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAE1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE;IAEnB,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IAEzB,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,4DAA4D;IAC5D,2EAA2E;IAC3E,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAA;AAIF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,0EAA0E;IAC1E,2EAA2E;IAC3E,8DAA8D;IAC9D,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;CAChC,CAAC,CAAA;AAIF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC,CAAA;AAIF,kEAAkE;AAClE,uEAAuE;AACvE,2EAA2E;AAC3E,yEAAyE;AACzE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,uEAAuE;IACvE,8EAA8E;IAC9E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CACtC,CAAC,CAAA"}
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/lib/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAE1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE;IAEnB,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IAEzB,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,4DAA4D;IAC5D,2EAA2E;IAC3E,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAA;AAIF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,0EAA0E;IAC1E,2EAA2E;IAC3E,8DAA8D;IAC9D,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;CAChC,CAAC,CAAA;AAIF,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAIF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC,CAAA;AAIF,kEAAkE;AAClE,uEAAuE;AACvE,2EAA2E;AAC3E,yEAAyE;AACzE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,uEAAuE;IACvE,8EAA8E;IAC9E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CACtC,CAAC,CAAA"}

package/dist/lib/shadow.d.ts

@@ -0,0 +1,79 @@
+import type { LitmusConfig } from "./config.js";
+/**
+ * Shadow store for tracking-critical state (ENG-1453).
+ *
+ * Everything AI-capture depends on used to live only inside the assessment
+ * repo, gitignored — which put it squarely inside `git clean -fdX`'s blast
+ * radius (the ENG-1446 incident: one ordinary cleanup command deleted the
+ * config, the Copilot hook, and the forensic log at once). This module keeps
+ * a copy of the small, load-bearing pieces OUTSIDE the repo, next to the
+ * registry that already lives there:
+ *
+ *   ~/.litmus/assessments/<assessmentId>/
+ *     config.json     verbatim mirror of .litmus/config.json + { projectDir, mirroredAt }
+ *     chain.json      last uploaded chain position { seq, hash }
+ *     tracker.pid     mirror — lets doctor find a live watcher after a repo wipe
+ *     tracker.nonce   mirror — same
+ *   ~/.litmus/logs/<assessmentId>.log   tracker log (relocated, not mirrored)
+ *
+ * Rules (from the ENG-1453 security review):
+ *  - The in-repo config is ALWAYS authoritative when present; shadows are read
+ *    only when it is missing.
+ *  - Every write here is best-effort: a failing shadow write must never break
+ *    init, doctor, or the watcher.
+ *  - Shadows die with the assessment: deleted on submit/terminal outcomes and
+ *    pruned when their project dir is gone and unregistered.
+ */
+export interface ShadowConfig extends LitmusConfig {
+    /** Absolute assessment root the mirror was written for — the lookup key
+     *  when the in-repo config (and its directory) no longer exists. */
+    projectDir: string;
+    mirroredAt: string;
+}
+export interface ChainCursor {
+    seq: number;
+    hash: string;
+    updatedAt: string;
+}
+export declare function shadowRootDir(): string;
+export declare function shadowDirFor(assessmentId: string): string | null;
+export declare function shadowLogPath(assessmentId: string): string | null;
+/** Mirror a just-written config. Best-effort; returns whether it stuck. */
+export declare function writeShadowConfig(projectDir: string, config: LitmusConfig): boolean;
+export declare function readShadowConfigById(assessmentId: string): ShadowConfig | null;
+/** Find the shadow whose mirror was written for this project dir. */
+export declare function findShadowConfigForDir(projectDir: string): ShadowConfig | null;
+/** Record the last chain position the SERVER has (written after each
+ *  successful upload), so a replacement watcher whose activity.jsonl is gone
+ *  continues the chain instead of forking a second genesis. */
+export declare function writeShadowChainCursor(assessmentId: string, seq: number, hash: string): void;
+export declare function readShadowChainCursor(assessmentId: string): ChainCursor | null;
+export declare function writeShadowTrackerFile(assessmentId: string, name: "tracker.pid" | "tracker.nonce", content: string): void;
+export declare function readShadowTrackerFile(assessmentId: string, name: "tracker.pid" | "tracker.nonce"): string | null;
+export declare function shadowTrackerFileMtime(assessmentId: string, name: "tracker.pid" | "tracker.nonce"): number | null;
+export declare function deleteShadowForAssessment(assessmentId: string): void;
+/** Delete the shadow keyed to a project dir — works when the in-repo config
+ *  (which would have named the assessment) is already gone. */
+export declare function deleteShadowForProject(projectDir: string): void;
+/**
+ * Remove shadows whose assessment is demonstrably over on this machine:
+ * project dir no longer exists AND no registry entry points at it. A live
+ * assessment whose folder was merely wiped keeps its registry entry, so it
+ * survives pruning until submit/expiry releases it.
+ */
+export declare function pruneShadows(registryPaths: string[]): number;
+export declare const REPAIR_FILE_NAME = "LITMUS-REPAIR.md";
+/** Written by the watcher only when self-heal could not act (server
+ *  unreachable, no usable shadow, AND the in-memory restore failed to write).
+ *  Rewritten every heartbeat while the outage lasts — a cleanup pass that
+ *  deletes it gets it back — and removed the moment the config is restored.
+ *
+ *  Deliberately carries NO credentials: a project-root file can be committed,
+ *  pushed, read into an AI agent's context, or shipped in the submission zip,
+ *  so the token must never appear here. The candidate's assessment page
+ *  ("Something not working?") shows the full copy-paste repair command, and
+ *  `litmus doctor` run bare prompts for the token pointing at that panel. */
+export declare function repairFileContent(): string;
+export declare function writeRepairFile(projectDir: string): void;
+export declare function removeRepairFile(projectDir: string): void;
+//# sourceMappingURL=shadow.d.ts.map

package/dist/lib/shadow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shadow.d.ts","sourceRoot":"","sources":["../../src/lib/shadow.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,WAAW,YAAa,SAAQ,YAAY;IAChD;wEACoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB;AAMD,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAOD,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGhE;AAED,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGjE;AA6BD,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAcnF;AAiBD,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAQ9E;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAO9E;AAcD;;+DAE+D;AAC/D,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAS5F;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAU9E;AAID,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,eAAe,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAOzH;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,MAAM,GAAG,IAAI,CAQhH;AAED,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,MAAM,GAAG,IAAI,CAQjH;AAID,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAQpE;AAED;+DAC+D;AAC/D,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAG/D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,CAe5D;AAID,eAAO,MAAM,gBAAgB,qBAAqB,CAAA;AAElD;;;;;;;;;6EAS6E;AAC7E,wBAAgB,iBAAiB,IAAI,MAAM,CAoB1C;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAIxD;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAEzD"}

package/dist/lib/shadow.js

@@ -0,0 +1,268 @@
+import fs from "fs";
+import os from "os";
+import path from "path";
+function litmusHome() {
+    return path.join(os.homedir(), ".litmus");
+}
+export function shadowRootDir() {
+    return path.join(litmusHome(), "assessments");
+}
+/** Assessment ids are server-issued UUIDs; refuse anything path-like. */
+function safeId(assessmentId) {
+    return /^[A-Za-z0-9-]{1,64}$/.test(assessmentId) ? assessmentId : null;
+}
+export function shadowDirFor(assessmentId) {
+    const id = safeId(assessmentId);
+    return id ? path.join(shadowRootDir(), id) : null;
+}
+export function shadowLogPath(assessmentId) {
+    const id = safeId(assessmentId);
+    return id ? path.join(litmusHome(), "logs", `${id}.log`) : null;
+}
+/** Resolve through whatever ancestors still exist so a deleted project dir
+ *  still normalizes the same way it did when the mirror was written
+ *  (macOS /tmp→/private/tmp and symlinked homes). */
+function normalizeDir(p) {
+    let base = path.resolve(p);
+    const tail = [];
+    for (;;) {
+        try {
+            const real = fs.realpathSync(base);
+            return tail.length ? path.join(real, ...tail.reverse()) : real;
+        }
+        catch { /* keep walking up */ }
+        const parent = path.dirname(base);
+        if (parent === base)
+            return path.resolve(p);
+        tail.push(path.basename(base));
+        base = parent;
+    }
+}
+function atomicWrite(filePath, content) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    const tmp = `${filePath}.tmp-${process.pid}-${Date.now()}`;
+    fs.writeFileSync(tmp, content, "utf8");
+    fs.renameSync(tmp, filePath);
+}
+// ── Config mirror ─────────────────────────────────────────────────
+/** Mirror a just-written config. Best-effort; returns whether it stuck. */
+export function writeShadowConfig(projectDir, config) {
+    const dir = shadowDirFor(config.assessmentId);
+    if (!dir)
+        return false;
+    const shadow = {
+        ...config,
+        projectDir: normalizeDir(projectDir),
+        mirroredAt: new Date().toISOString(),
+    };
+    try {
+        atomicWrite(path.join(dir, "config.json"), JSON.stringify(shadow, null, 2));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function parseShadowConfig(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    const s = parsed;
+    // Field validation: a shadow missing any of these cannot restore anything.
+    for (const key of ["assessmentId", "token", "startedAt", "apiBase", "projectDir"]) {
+        if (typeof s[key] !== "string" || !s[key])
+            return null;
+    }
+    return s;
+}
+export function readShadowConfigById(assessmentId) {
+    const dir = shadowDirFor(assessmentId);
+    if (!dir)
+        return null;
+    try {
+        return parseShadowConfig(fs.readFileSync(path.join(dir, "config.json"), "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+/** Find the shadow whose mirror was written for this project dir. */
+export function findShadowConfigForDir(projectDir) {
+    const target = normalizeDir(projectDir);
+    for (const entry of listShadowIds()) {
+        const shadow = readShadowConfigById(entry);
+        if (shadow && normalizeDir(shadow.projectDir) === target)
+            return shadow;
+    }
+    return null;
+}
+function listShadowIds() {
+    try {
+        return fs.readdirSync(shadowRootDir(), { withFileTypes: true })
+            .filter((d) => d.isDirectory())
+            .map((d) => d.name);
+    }
+    catch {
+        return [];
+    }
+}
+// ── Chain cursor ──────────────────────────────────────────────────
+/** Record the last chain position the SERVER has (written after each
+ *  successful upload), so a replacement watcher whose activity.jsonl is gone
+ *  continues the chain instead of forking a second genesis. */
+export function writeShadowChainCursor(assessmentId, seq, hash) {
+    const dir = shadowDirFor(assessmentId);
+    if (!dir)
+        return;
+    try {
+        atomicWrite(path.join(dir, "chain.json"), JSON.stringify({ seq, hash, updatedAt: new Date().toISOString() }));
+    }
+    catch { /* best effort */ }
+}
+export function readShadowChainCursor(assessmentId) {
+    const dir = shadowDirFor(assessmentId);
+    if (!dir)
+        return null;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(dir, "chain.json"), "utf8"));
+        if (typeof parsed.seq !== "number" || typeof parsed.hash !== "string" || !parsed.hash)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+// ── Tracker pid/nonce mirrors ─────────────────────────────────────
+export function writeShadowTrackerFile(assessmentId, name, content) {
+    const dir = shadowDirFor(assessmentId);
+    if (!dir)
+        return;
+    try {
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(path.join(dir, name), content);
+    }
+    catch { /* best effort */ }
+}
+export function readShadowTrackerFile(assessmentId, name) {
+    const dir = shadowDirFor(assessmentId);
+    if (!dir)
+        return null;
+    try {
+        return fs.readFileSync(path.join(dir, name), "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+export function shadowTrackerFileMtime(assessmentId, name) {
+    const dir = shadowDirFor(assessmentId);
+    if (!dir)
+        return null;
+    try {
+        return fs.statSync(path.join(dir, name)).mtimeMs;
+    }
+    catch {
+        return null;
+    }
+}
+// ── Lifecycle ─────────────────────────────────────────────────────
+export function deleteShadowForAssessment(assessmentId) {
+    const dir = shadowDirFor(assessmentId);
+    if (!dir)
+        return;
+    try {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+    catch { /* best effort */ }
+    const logPath = shadowLogPath(assessmentId);
+    if (logPath) {
+        try {
+            fs.rmSync(logPath, { force: true });
+        }
+        catch { /* best effort */ }
+    }
+}
+/** Delete the shadow keyed to a project dir — works when the in-repo config
+ *  (which would have named the assessment) is already gone. */
+export function deleteShadowForProject(projectDir) {
+    const shadow = findShadowConfigForDir(projectDir);
+    if (shadow)
+        deleteShadowForAssessment(shadow.assessmentId);
+}
+/**
+ * Remove shadows whose assessment is demonstrably over on this machine:
+ * project dir no longer exists AND no registry entry points at it. A live
+ * assessment whose folder was merely wiped keeps its registry entry, so it
+ * survives pruning until submit/expiry releases it.
+ */
+export function pruneShadows(registryPaths) {
+    const registered = new Set(registryPaths.map((p) => normalizeDir(p)));
+    let pruned = 0;
+    for (const id of listShadowIds()) {
+        const shadow = readShadowConfigById(id);
+        if (!shadow)
+            continue; // unreadable shadow: leave for a human, never silently discard
+        const dir = normalizeDir(shadow.projectDir);
+        let dirExists = false;
+        try {
+            dirExists = fs.existsSync(dir);
+        }
+        catch { /* treat as missing */ }
+        if (!dirExists && !registered.has(dir)) {
+            deleteShadowForAssessment(id);
+            pruned++;
+        }
+    }
+    return pruned;
+}
+// ── Candidate-facing repair file (last resort) ────────────────────
+export const REPAIR_FILE_NAME = "LITMUS-REPAIR.md";
+/** Written by the watcher only when self-heal could not act (server
+ *  unreachable, no usable shadow, AND the in-memory restore failed to write).
+ *  Rewritten every heartbeat while the outage lasts — a cleanup pass that
+ *  deletes it gets it back — and removed the moment the config is restored.
+ *
+ *  Deliberately carries NO credentials: a project-root file can be committed,
+ *  pushed, read into an AI agent's context, or shipped in the submission zip,
+ *  so the token must never appear here. The candidate's assessment page
+ *  ("Something not working?") shows the full copy-paste repair command, and
+ *  `litmus doctor` run bare prompts for the token pointing at that panel. */
+export function repairFileContent() {
+    return [
+        "# Litmus needs a one-minute repair",
+        "",
+        "Your assessment's tracking settings went missing, so your activity is not",
+        "being recorded and `litmus submit` will not work until they are restored.",
+        "",
+        "Open your assessment page (the link from your invite email) and under",
+        '"Something not working?" copy the repair command shown there. Or run:',
+        "",
+        "```",
+        "npm install -g litmus-cli@latest",
+        "litmus doctor",
+        "```",
+        "",
+        "and paste your assessment token when asked (it is on that same page).",
+        "Your work and your deadline are not affected. This file disappears once",
+        "the repair has run.",
+        "",
+    ].join("\n");
+}
+export function writeRepairFile(projectDir) {
+    try {
+        fs.writeFileSync(path.join(projectDir, REPAIR_FILE_NAME), repairFileContent(), "utf8");
+    }
+    catch { /* best effort */ }
+}
+export function removeRepairFile(projectDir) {
+    try {
+        fs.rmSync(path.join(projectDir, REPAIR_FILE_NAME), { force: true });
+    }
+    catch { /* best effort */ }
+}
+//# sourceMappingURL=shadow.js.map