litmus-cli 1.4.33 → 1.4.34

package/dist/lib/cursor-restart.js

@@ -0,0 +1,308 @@
+/**
+ * Quit-and-relaunch Cursor so a hook config it hasn't read yet gets loaded
+ * before the candidate's clock starts (ENG-2491).
+ *
+ * THE PROBLEM THIS CLOSES. Cursor's hooks service reads its configuration
+ * once, at application startup, and never again — not on a window reload,
+ * not on a fresh Remote-SSH connection (measured, ENG-1728). `litmus init`
+ * and `litmus connect` have said so in increasingly loud text for months
+ * (`restartWarningLines` in commands/init.ts, `announceCursorFullQuit` in
+ * commands/connect.ts), and ENG-2481 measured what depending on a candidate
+ * to act on that text costs: 121 of 151 dark sessions in 30 days carry
+ * exactly this signature. A warning read in a timed interview is not a fix.
+ * This module is the fix: quit Cursor for the candidate, confirm it is
+ * gone, reopen it, confirm it is back.
+ *
+ * THE HAZARD THIS IS WRITTEN AROUND. Quitting an editor out from under
+ * someone can destroy unsaved work, and a full-app quit takes every window
+ * with it — including ones that have nothing to do with this assessment.
+ * The design answer is NOT "trust Cursor's hot-exit". Hot exit is VS Code's
+ * documented behaviour and Cursor, a VS Code fork, inherits it unmodified —
+ * but a candidate can have it turned off, and nothing in this module can
+ * ask Cursor whether they have. The design answer is narrower and does not
+ * depend on that fact being true: we never send a kill signal, only the
+ * same Apple Event Cmd+Q sends (`tell application "Cursor" to quit`), and
+ * we give Cursor a real window to actually finish quitting before calling
+ * it done. A dirty buffer that would raise a "Save changes?" dialog, and a
+ * first-run automation-permission prompt, look identical from here: the
+ * process is still running once our wait is over. Either way we STOP — we
+ * never relaunch a process that never actually quit (see `attemptQuit`) —
+ * so the worst thing this module can do to a candidate's own work is
+ * nothing at all, and their answer to whatever dialog Cursor itself put up
+ * is never touched, let alone overridden.
+ *
+ * THE OTHER FAILURE DIRECTION. A quit that succeeds and a relaunch that
+ * does not is strictly worse than doing nothing: it leaves a candidate with
+ * no editor and a running clock. So a relaunch is only ever attempted after
+ * a quit is CONFIRMED — the process is actually gone, not merely "the
+ * request was sent" — and a relaunch that does not reappear within its own
+ * budget is reported with the exact command a candidate can run to finish
+ * the job themselves. See `restartCursorForCapture`.
+ *
+ * PLATFORM. `tell application "..." to quit` is AppleScript, so this whole
+ * module is macOS-only by construction (`platformSupportsGracefulCursorRestart`).
+ * That is not an oversight to fill in later: Windows' nearest equivalent is
+ * a close-main-window request, which is not the same guarantee a graceful
+ * quit is and degrades to `taskkill /F` — a hard kill — the moment a window
+ * does not respond, and Linux's depends on the window manager and has no
+ * reliable answer at all under Wayland, which deliberately restricts this
+ * exact kind of cross-application control. A platform that cannot CONFIRM a
+ * graceful quit falls back to the existing warning, unchanged, rather than
+ * shipping a weaker, unconfirmable version of this feature — this ticket
+ * ruled that out rather than leaving it unconsidered. If the mechanism ever
+ * generalises to those platforms, it needs its own confirmed-quit primitive
+ * first; see this PR's description for the same note.
+ *
+ * WHY `osascript`/`open` AND NOT `System Events`. Sending an Apple Event
+ * directly to an application you name — `tell application "Cursor" to
+ * quit` — is a different permission from UI-scripting an app through
+ * `System Events` (synthetic keystrokes/clicks): the former is what Cmd+Q
+ * itself amounts to, and it is what stays available on a machine that has
+ * never granted the latter. `System Events` was confirmed BLOCKED on the
+ * machine this ticket was built on — `-1743, not authorized to send Apple
+ * events` — which is the exact wall a manual Cursor probe hit earlier the
+ * same day (ENG-1728). Needing `System Events` for this feature would have
+ * been a design mistake, not a permission gap to work around: it is also
+ * how a candidate's own keystrokes would be synthesised, which this module
+ * has no business doing.
+ *
+ * A SCAN FAILURE IS NOT AN ANSWER (Greptile on #2613). `isRunning` reads a
+ * process list, and that read itself can fail or time out — `ps` wedged,
+ * killed, whatever. Collapsing that into "not running" is the exact bug
+ * this ticket exists to remove, reappearing one layer down: a failed scan
+ * between the initial check and `attemptQuit` would read as "Cursor already
+ * quit", skip the quit request entirely, relaunch on top of the still-live
+ * original process, and report `restarted` once a later scan happens to
+ * succeed — Cursor never actually restarted, the hook it just got is still
+ * unloaded, and the candidate is told capture is live. So presence is
+ * three-valued (`ProcessPresence`), not two, and only an EXPLICIT "gone" or
+ * "present" reading can ever satisfy `attemptQuit`/`attemptRelaunch`'s wait
+ * loops — "unknown" never does, on either side, so a persistently failing
+ * scan times out to the honest "could not confirm" outcome instead of
+ * quietly resolving to success.
+ *
+ * A QUIT MUST NOT HAPPEN ON A PATH THAT CANNOT USEFULLY RELAUNCH (Greptile
+ * on #2613, and the brief's own "conditional on being able to reopen, not
+ * the other way round"). `restartCursorForCapture` (used by `init`/`doctor`,
+ * whose relaunch is a bare `open -a Cursor`) checks, BEFORE sending any quit
+ * request, that Cursor is resolvable as a launchable application at all
+ * (`canRelaunch`) — a read-only Launch Services query, `path to application
+ * "Cursor"`, which neither launches nor addresses the app and so needs no
+ * automation permission of any kind. If that cannot be confirmed, nothing is
+ * quit. `connect` does not need this check: it already resolves and
+ * verifies the exact command it is about to launch Cursor with (elsewhere in
+ * that file) before it ever reaches the quit — a stronger guarantee than a
+ * generic "is Cursor launchable" probe — so it reuses that existing
+ * verification rather than adding a second one. See connect.ts for how the
+ * ORDER matters there too: a quit sequenced before a check that can still
+ * refuse the launch is the same hazard from a different direction.
+ */
+import { spawnSync } from "child_process";
+import chalk from "chalk";
+import { detectRunningHookTools } from "./capture-selftest.js";
+import { getProcessList } from "./platform.js";
+export function platformSupportsGracefulCursorRestart(platform) {
+    return platform === "darwin";
+}
+export const QUIT_CONFIRM_TIMEOUT_MS = 10000;
+export const RELAUNCH_CONFIRM_TIMEOUT_MS = 20000;
+const POLL_INTERVAL_MS = 500;
+async function waitUntil(predicate, timeoutMs, sleep) {
+    const deadline = Date.now() + timeoutMs;
+    while (!predicate() && Date.now() < deadline) {
+        await sleep(Math.min(POLL_INTERVAL_MS, Math.max(0, deadline - Date.now())));
+    }
+    return predicate();
+}
+/**
+ * Ask Cursor to quit, then WAIT to see whether it actually did — never trust
+ * the request alone. `requestQuit` returning true means only that the Apple
+ * Event was delivered, the same as `exit 0` from `osascript`; Cursor can
+ * still be sitting on a "Save changes?" dialog, or a first-run automation
+ * permission prompt can be blocking it, and neither is distinguishable from
+ * out here except by the one thing they have in common: the process is
+ * still there a few seconds later. Timing out is therefore not a special
+ * case to handle — it IS the safety mechanism. A candidate's dirty buffer
+ * is never at risk from this function, because once the request is sent it
+ * never does anything BUT wait; whatever is protecting that buffer (a
+ * dialog Cursor itself put up) is left completely alone, and its answer is
+ * always the candidate's, never ours.
+ *
+ * Already-CONFIRMED-not-running short-circuits to `true`: there is nothing
+ * to confirm, and a caller asking "is it safe to relaunch" should get the
+ * same answer whether Cursor quit a moment ago or was never open at all. An
+ * "unknown" reading does NOT short-circuit — see this file's header on why
+ * that would be the same bug as the wait loop below collapsing "unknown"
+ * into "gone".
+ */
+export async function attemptQuit(io, timeoutMs = QUIT_CONFIRM_TIMEOUT_MS) {
+    if (io.isRunning() === "not-running")
+        return true;
+    if (!io.requestQuit())
+        return false;
+    return waitUntil(() => io.isRunning() === "not-running", timeoutMs, io.sleep);
+}
+/**
+ * Ask Cursor to relaunch, then wait to see whether it actually came back.
+ * Callers must only reach this after `attemptQuit` has CONFIRMED Cursor is
+ * gone (see `restartCursorForCapture`) — relaunching a process that never
+ * quit would, at best, just refocus the singleton app and do nothing, and
+ * at worst race whatever dialog it was showing. Only an EXPLICIT "running"
+ * reading counts as confirmed; "unknown" keeps waiting, same as `attemptQuit`.
+ */
+export async function attemptRelaunch(io, timeoutMs = RELAUNCH_CONFIRM_TIMEOUT_MS) {
+    if (!io.requestRelaunch())
+        return false;
+    return waitUntil(() => io.isRunning() === "running", timeoutMs, io.sleep);
+}
+/**
+ * The whole sequence for `init` and `doctor`, which both need Cursor closed
+ * AND reopened (unlike `connect`, which is about to open it anyway — see
+ * that command for how it reuses just `attemptQuit`). Never reaches
+ * `attemptRelaunch` on an unconfirmed quit: that ordering is the one rule
+ * this function exists to enforce, not an incidental sequence of steps.
+ *
+ * Requires an EXPLICIT "running" reading before doing anything at all — an
+ * "unknown" presence at the very start is treated the same as "not running"
+ * here (nothing attempted, existing warning still covers it), because the
+ * question this function answers is "should we act", and "we can't tell" is
+ * always answered no. `canRelaunch` runs only once that gate is passed, and
+ * BEFORE any quit request — refusing to quit on a Cursor this module cannot
+ * confirm it can reopen (see this file's header).
+ *
+ * `onCommitted`, if given, fires exactly once — right after both gates pass
+ * and right before the quit request is sent — never before. That is the
+ * one moment a caller can announce "restarting Cursor now" and have it stay
+ * true: announcing any earlier could be followed by a silent `not-running`
+ * or `relaunch-not-verifiable` (said something was about to happen, then
+ * nothing did), and announcing later would tell a candidate about a quit
+ * that had already happened to them, on their own screen, unannounced.
+ */
+export async function restartCursorForCapture(platform, io, opts = {}) {
+    if (!platformSupportsGracefulCursorRestart(platform))
+        return { kind: "unsupported" };
+    if (io.isRunning() !== "running")
+        return { kind: "not-running" };
+    if (!io.canRelaunch())
+        return { kind: "relaunch-not-verifiable" };
+    opts.onCommitted?.();
+    const quit = await attemptQuit(io, opts.quitMs);
+    if (!quit)
+        return { kind: "quit-unconfirmed" };
+    const relaunched = await attemptRelaunch(io, opts.relaunchMs);
+    return relaunched ? { kind: "restarted" } : { kind: "relaunch-unconfirmed" };
+}
+// ── Real IO (macOS) ──────────────────────────────────────────────
+/** What a candidate can run themselves to finish the job if we could not. */
+export const CURSOR_RELAUNCH_COMMAND = "open -a Cursor";
+function runOsascript(script) {
+    try {
+        const r = spawnSync("osascript", ["-e", script], { timeout: 10000, encoding: "utf8" });
+        return { ok: !r.error && r.status === 0, stdout: r.stdout ?? "" };
+    }
+    catch {
+        return { ok: false, stdout: "" };
+    }
+}
+/**
+ * Real process control, macOS only. `ps` is injectable (defaults to the
+ * real live scan, which can throw — see below) purely so a caller that has
+ * already paid for one process-list read this tick can hand it in rather
+ * than triggering a second `ps`.
+ *
+ * `isRunning` is the ONLY place a scan failure is caught, and it is caught
+ * into `"unknown"`, never into `"not-running"` — see this file's header for
+ * why folding those together is the exact bug this ticket exists to fix,
+ * one layer down.
+ *
+ * `canRelaunch` asks Launch Services where the application named "Cursor"
+ * lives (`path to application`, a Standard Additions query, not an event
+ * sent to Cursor itself) and succeeds only if it resolves to something —
+ * this neither launches nor addresses the app, so it needs no automation
+ * permission at all, unlike `requestQuit` below.
+ *
+ * `requestQuit` targets Cursor BY NAME, never `System Events` — see this
+ * file's header for why that distinction is load-bearing, not stylistic.
+ * `requestRelaunch` is plain Launch Services (`open -a`), which needs no
+ * automation permission either: it is exactly what double-clicking the Dock
+ * icon does.
+ */
+export function realCursorProcessIo(ps = getProcessList) {
+    return {
+        isRunning: () => {
+            let list;
+            try {
+                list = ps();
+            }
+            catch {
+                return "unknown";
+            }
+            return detectRunningHookTools(list).includes("cursor") ? "running" : "not-running";
+        },
+        canRelaunch: () => {
+            const result = runOsascript('POSIX path of (path to application "Cursor")');
+            return result.ok && result.stdout.trim().length > 0;
+        },
+        requestQuit: () => runOsascript('tell application "Cursor" to quit').ok,
+        requestRelaunch: () => {
+            try {
+                const r = spawnSync("open", ["-a", "Cursor"], { timeout: 10000, stdio: "ignore" });
+                return !r.error && r.status === 0;
+            }
+            catch {
+                return false;
+            }
+        },
+        sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    };
+}
+// ── Candidate-facing copy ────────────────────────────────────────
+/**
+ * Said BEFORE anything happens (Greptile's own rule on #2223, applied here):
+ * a candidate whose editor vanishes without warning will reasonably think
+ * something broke, and in a timed interview that costs real minutes and
+ * composure. Also the one place the "other windows reopen the same way"
+ * caveat lives — a full quit cannot spare them, and saying so up front is
+ * more honest than a relaunch that quietly does not restore everything they
+ * had open.
+ */
+export function announceCursorAutoRestart() {
+    return [
+        "",
+        chalk.yellow.bold("  Cursor is open right now, and it only reads hook config at launch — so it"),
+        chalk.yellow.bold("  can't see the tracking hooks just installed until it restarts."),
+        "",
+        "     Restarting it for you now. If it asks to save anything, go ahead — Cursor",
+        "     will carry on once you answer, and this will pick up from there once you do.",
+        "     Any other Cursor windows you have open will reopen the same way.",
+    ];
+}
+/** What to say once the attempt is over — pass or one of the two ways it fails. */
+export function renderCursorRestartOutcome(outcome) {
+    switch (outcome.kind) {
+        case "restarted":
+            return ["", chalk.green("  ✓ Cursor restarted — it will use the hooks installed above.")];
+        case "quit-unconfirmed":
+            return [
+                "",
+                chalk.yellow("  Cursor didn't quit. It may be waiting on you — a \"Save changes?\" dialog, or a"),
+                chalk.yellow("  one-time permission prompt — or this machine hasn't allowed Litmus to control"),
+                chalk.yellow("  it yet. Nothing was changed: Cursor is exactly as you left it."),
+            ];
+        case "relaunch-unconfirmed":
+            return [
+                "",
+                chalk.red.bold("  Cursor quit, but didn't reopen. Nothing is running right now — reopen it"),
+                chalk.red.bold(`  yourself: ${CURSOR_RELAUNCH_COMMAND}`),
+                chalk.red("  (or launch it from Spotlight or the Dock), then run \"litmus doctor\" to confirm"),
+                chalk.red("  capture is working."),
+            ];
+        case "not-running":
+        case "unsupported":
+        // Silent, exactly like "not-running": nothing was touched, so nothing
+        // new needs saying, and the existing static warning still applies.
+        case "relaunch-not-verifiable":
+            return [];
+    }
+}
+//# sourceMappingURL=cursor-restart.js.map

package/dist/lib/cursor-restart.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-restart.js","sourceRoot":"","sources":["../../src/lib/cursor-restart.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAsD9C,MAAM,UAAU,qCAAqC,CAAC,QAAyB;IAC7E,OAAO,QAAQ,KAAK,QAAQ,CAAA;AAC9B,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAM,CAAA;AAC7C,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAM,CAAA;AACjD,MAAM,gBAAgB,GAAG,GAAG,CAAA;AAE5B,KAAK,UAAU,SAAS,CACtB,SAAwB,EACxB,SAAiB,EACjB,KAA+B;IAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;IACvC,OAAO,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7C,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7E,CAAC;IACD,OAAO,SAAS,EAAE,CAAA;AACpB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAmB,EAAE,SAAS,GAAG,uBAAuB;IACxF,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,aAAa;QAAE,OAAO,IAAI,CAAA;IACjD,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;QAAE,OAAO,KAAK,CAAA;IACnC,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,aAAa,EAAE,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,CAAA;AAC/E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAmB,EAAE,SAAS,GAAG,2BAA2B;IAChG,IAAI,CAAC,EAAE,CAAC,eAAe,EAAE;QAAE,OAAO,KAAK,CAAA;IACvC,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,CAAA;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAyB,EACzB,EAAmB,EACnB,OAA2E,EAAE;IAE7E,IAAI,CAAC,qCAAqC,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;IACpF,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;IAChE,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAA;IACjE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAA;IACpB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;IAC9C,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IAC7D,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAA;AAC9E,CAAC;AAED,oEAAoE;AAEpE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAA;AAEvD,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;QACvF,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAA;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAClC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAmB,cAAc;IACnE,OAAO;QACL,SAAS,EAAE,GAAG,EAAE;YACd,IAAI,IAAY,CAAA;YAChB,IAAI,CAAC;gBACH,IAAI,GAAG,EAAE,EAAE,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAA;QACpF,CAAC;QACD,WAAW,EAAE,GAAG,EAAE;YAChB,MAAM,MAAM,GAAG,YAAY,CAAC,8CAA8C,CAAC,CAAA;YAC3E,OAAO,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;QACrD,CAAC;QACD,WAAW,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,mCAAmC,CAAC,CAAC,EAAE;QACvE,eAAe,EAAE,GAAG,EAAE;YACpB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;gBACnF,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;QACD,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;KACjE,CAAA;AACH,CAAC;AAED,oEAAoE;AAEpE;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,EAAE;QACF,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,6EAA6E,CAAC;QAChG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,kEAAkE,CAAC;QACrF,EAAE;QACF,gFAAgF;QAChF,mFAAmF;QACnF,uEAAuE;KACxE,CAAA;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,0BAA0B,CAAC,OAAuB;IAChE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC,CAAA;QAC3F,KAAK,kBAAkB;YACrB,OAAO;gBACL,EAAE;gBACF,KAAK,CAAC,MAAM,CAAC,mFAAmF,CAAC;gBACjG,KAAK,CAAC,MAAM,CAAC,iFAAiF,CAAC;gBAC/F,KAAK,CAAC,MAAM,CAAC,kEAAkE,CAAC;aACjF,CAAA;QACH,KAAK,sBAAsB;YACzB,OAAO;gBACL,EAAE;gBACF,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC;gBAC5F,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,uBAAuB,EAAE,CAAC;gBACxD,KAAK,CAAC,GAAG,CAAC,oFAAoF,CAAC;gBAC/F,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC;aACnC,CAAA;QACH,KAAK,aAAa,CAAC;QACnB,KAAK,aAAa,CAAC;QACnB,sEAAsE;QACtE,mEAAmE;QACnE,KAAK,yBAAyB;YAC5B,OAAO,EAAE,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/lib/schemas.d.ts

@@ -10,6 +10,7 @@ export declare const InitMetadataSchema: z.ZodObject<{
     timeLimit: z.ZodNullable<z.ZodNumber>;
     walkthroughWindowMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
     startedAt: z.ZodISODateTime;
+    workTrial: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export type InitMetadata = z.infer<typeof InitMetadataSchema>;
 export declare const SubmitResultSchema: z.ZodObject<{

package/dist/lib/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/lib/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,kBAAkB;;;;;;;;;;;iBAgB7B,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAE7D,eAAO,MAAM,kBAAkB;;;;;iBAQ7B,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAK7D,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAA;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE3D,eAAO,MAAM,kBAAkB;;iBAE7B,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAI7D,eAAO,MAAM,qBAAqB;;iBAEhC,CAAA;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAMnE,eAAO,MAAM,yBAAyB;;;;;;iBAQpC,CAAA;AAEF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAU3E,eAAO,MAAM,sBAAsB;;;;;iBAKjC,CAAA;AAEF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/lib/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,kBAAkB;;;;;;;;;;;;iBAqB7B,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAE7D,eAAO,MAAM,kBAAkB;;;;;iBAQ7B,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAK7D,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAA;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE3D,eAAO,MAAM,kBAAkB;;iBAE7B,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAI7D,eAAO,MAAM,qBAAqB;;iBAEhC,CAAA;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAMnE,eAAO,MAAM,yBAAyB;;;;;;iBAQpC,CAAA;AAEF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAU3E,eAAO,MAAM,sBAAsB;;;;;iBAKjC,CAAA;AAEF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA"}

package/dist/lib/schemas.js

@@ -12,6 +12,11 @@ export const InitMetadataSchema = z.object({
     // services/walkthrough_shared.py) — the fallback when the server omits it.
     walkthroughWindowMinutes: z.number().positive().optional().default(10),
     startedAt: z.iso.datetime(),
+    // ENG-2523: true for a work trial, whose submit is a checkpoint (ENG-2378).
+    // THREE-VALUED on purpose: `undefined` means an older frontend did not say,
+    // which is not the same as "a take-home". Wording that is only true of a
+    // take-home is gated on `=== false`; the checkpoint copy on `=== true`.
+    workTrial: z.boolean().optional(),
 });
 export const SubmitResultSchema = z.object({
     submissionId: z.uuid(),

package/dist/lib/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/lib/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAE1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE;IAEnB,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IAEzB,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,4DAA4D;IAC5D,2EAA2E;IAC3E,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAA;AAIF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,0EAA0E;IAC1E,2EAA2E;IAC3E,8DAA8D;IAC9D,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;CAChC,CAAC,CAAA;AAIF,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAIF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC,CAAA;AAIF,gFAAgF;AAChF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAA;AAIF,kEAAkE;AAClE,uEAAuE;AACvE,2EAA2E;AAC3E,yEAAyE;AACzE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,uEAAuE;IACvE,8EAA8E;IAC9E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CACtC,CAAC,CAAA;AAIF,2FAA2F;AAC3F,0FAA0F;AAC1F,2FAA2F;AAC3F,EAAE;AACF,uFAAuF;AACvF,qFAAqF;AACrF,uFAAuF;AACvF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CAC5B,CAAC,CAAA"}
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/lib/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAE1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE;IAEnB,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IAEzB,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,4DAA4D;IAC5D,2EAA2E;IAC3E,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC3B,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,wEAAwE;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAA;AAIF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,0EAA0E;IAC1E,2EAA2E;IAC3E,8DAA8D;IAC9D,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;CAChC,CAAC,CAAA;AAIF,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAIF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC,CAAA;AAIF,gFAAgF;AAChF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAA;AAIF,kEAAkE;AAClE,uEAAuE;AACvE,2EAA2E;AAC3E,yEAAyE;AACzE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,uEAAuE;IACvE,8EAA8E;IAC9E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CACtC,CAAC,CAAA;AAIF,2FAA2F;AAC3F,0FAA0F;AAC1F,2FAA2F;AAC3F,EAAE;AACF,uFAAuF;AACvF,qFAAqF;AACrF,uFAAuF;AACvF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CAC5B,CAAC,CAAA"}

package/dist/lib/submit-route.d.ts

@@ -1,42 +1,39 @@
 /**
- * Which command actually hands work in, for the install this CLI is running from
- * (ENG-2130).
+ * Which command hands work in, for the install this CLI is running from.
  *
- * There are two flows and each has exactly one submit command:
+ * There are two flows, and inside a Codespaces v2 workspace both names reach the
+ * same place:
  *
- *   * ON A LAPTOP (the CLI flow) it is `litmus submit`, which zips the local
- *     checkout and uploads it to `/cli/submit`.
- *   * INSIDE A CODESPACES v2 WORKSPACE it is `litmus push`, which POSTs
- *     `/workspace/submit` — the same endpoint the assessment page's Submit
- *     button calls, capturing the live container filesystem host-side (ENG-621).
- *     There is nothing local to zip.
+ *   * ON A LAPTOP (the CLI flow) `litmus submit` zips the local checkout and
+ *     uploads it to `/cli/submit`.
+ *   * INSIDE A WORKSPACE `litmus push` POSTs `/workspace/submit` — the same
+ *     endpoint the assessment page's Submit button calls, capturing the live
+ *     container filesystem host-side (ENG-621). There is nothing local to zip.
+ *     Since ENG-2523 `litmus submit` there runs `push` rather than refusing
+ *     (ENG-2130), because candidates reach for `submit` and a refusal sent them
+ *     back to the browser to press the button.
  *
- * WHY THIS MODULE EXISTS RATHER THAN A CHECK PER SITE. Before ENG-2064 the CLI
- * was not in the container at all, so `litmus submit` there was `command not
- * found` — useless but unambiguous. That ticket put the CLI on the container's
- * PATH and wired the injected `LITMUS_ASSESSMENT_TOKEN` into `push` alone, so
- * `submit` became present, runnable, and unable to authenticate: it reads its
- * bearer from `.litmus/config.json`, and `hostd._stage_litmus_config` writes
- * that file with DELIBERATELY no `token` because it rides the submission zip and
- * the R2 durability tar, where a live credential must never sit. The upload
- * therefore went out as a literal `Authorization: Bearer undefined` and was
- * refused — AFTER the archive had been built, so a candidate read it as an
- * upload failure rather than as the wrong command. Every surface that names a
- * submit command was naming the laptop one to both audiences, so the answer is
- * derived in one place and the sites ask.
+ * WHY `submit` DELEGATES RATHER THAN READING THE INJECTED TOKEN ITSELF. Giving it
+ * the env fallback `push` has would route a v2 candidate down `/cli/submit`,
+ * which grades an UPLOADED zip, while v2's canonical submit grades the live
+ * filesystem — the two flows would then disagree about what a submission is.
+ * Delegating keeps one definition. The token must also never be written into
+ * `.litmus/config.json` (what `submit` reads on a laptop): hostd stages that file
+ * with deliberately no `token` because it rides the submission zip and the R2
+ * durability tar.
  *
- * NOT FIXED BY GIVING `submit` THE ENV FALLBACK `push` HAS. That would make the
- * command "work", but it routes a v2 candidate down `/cli/submit`, which grades
- * an uploaded zip, while v2's canonical submit grades the live filesystem — the
- * two flows would then disagree about what a submission is. That is a product
- * decision, not a patch. And it must NOT be fixed by writing the token into
- * `.litmus/config.json`, for the reason that file has none today.
+ * WHY THE COMMAND WE NAME IS STILL `push`. `submitCommandFor` answers `push`
+ * inside a workspace even though `submit` now works there, because the delegation
+ * is keyed on the INSTALL, not the assessment: a v2 candidate who learns
+ * `litmus submit` and runs it on their own laptop uploads whatever local folder
+ * they are in, and `/cli/submit` does not check the provider. `push` does the
+ * right thing from either place, so it is the one to teach.
  *
  * The predicate is `isWorkspaceInstall`, read from our own module path for the
  * reasons its own docstring gives (an env marker is absent in an sshd session,
  * and a marker injected alongside the token disappears in exactly the case we
  * need to describe). Nothing security-relevant hangs off any of this: it only
- * decides which command a candidate is told to run.
+ * decides which command runs and which one a candidate is told to run.
  */
 /** The submit command inside a Codespaces v2 workspace. */
 export declare const WORKSPACE_SUBMIT_COMMAND = "litmus push";
@@ -50,19 +47,13 @@ export declare const LOCAL_SUBMIT_COMMAND = "litmus submit";
  * the laptop one.
  */
 export declare function submitCommandFor(moduleUrl: string): string;
-/** A refusal to run, as `fatal(message, hint)` takes it. */
-export type SubmitRefusal = {
-    message: string;
-    hint: string;
-};
 /**
- * Why `litmus submit` must not run here, or `null` when it may.
+ * Whether `litmus submit` should submit the workspace (run `push`) instead of
+ * zipping a local checkout.
  *
- * Non-null only for the in-workspace install. The caller is expected to refuse
- * on it BEFORE doing any work — the whole defect is that the failure used to
- * arrive after a full archive build, which is what made it read as an upload
- * problem. Both routes named in the hint reach `/workspace/submit`, so this
- * points at the two things that work and sends the candidate nowhere new.
+ * True only for the in-workspace install. The caller must ask BEFORE doing any
+ * work: the laptop path walks the cwd, reads `.litmus/config.json` and builds an
+ * archive, none of which means anything in a workspace (ENG-2130).
  */
-export declare function workspaceSubmitRefusal(moduleUrl: string): SubmitRefusal | null;
+export declare function submitsWorkspace(moduleUrl: string): boolean;
 //# sourceMappingURL=submit-route.d.ts.map

package/dist/lib/submit-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"submit-route.d.ts","sourceRoot":"","sources":["../../src/lib/submit-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,2DAA2D;AAC3D,eAAO,MAAM,wBAAwB,gBAAgB,CAAA;AAErD,yDAAyD;AACzD,eAAO,MAAM,oBAAoB,kBAAkB,CAAA;AAEnD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,4DAA4D;AAC5D,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAO9E"}
+{"version":3,"file":"submit-route.d.ts","sourceRoot":"","sources":["../../src/lib/submit-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAIH,2DAA2D;AAC3D,eAAO,MAAM,wBAAwB,gBAAgB,CAAA;AAErD,yDAAyD;AACzD,eAAO,MAAM,oBAAoB,kBAAkB,CAAA;AAEnD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D"}

package/dist/lib/submit-route.js

@@ -1,42 +1,39 @@
 /**
- * Which command actually hands work in, for the install this CLI is running from
- * (ENG-2130).
+ * Which command hands work in, for the install this CLI is running from.
  *
- * There are two flows and each has exactly one submit command:
+ * There are two flows, and inside a Codespaces v2 workspace both names reach the
+ * same place:
  *
- *   * ON A LAPTOP (the CLI flow) it is `litmus submit`, which zips the local
- *     checkout and uploads it to `/cli/submit`.
- *   * INSIDE A CODESPACES v2 WORKSPACE it is `litmus push`, which POSTs
- *     `/workspace/submit` — the same endpoint the assessment page's Submit
- *     button calls, capturing the live container filesystem host-side (ENG-621).
- *     There is nothing local to zip.
+ *   * ON A LAPTOP (the CLI flow) `litmus submit` zips the local checkout and
+ *     uploads it to `/cli/submit`.
+ *   * INSIDE A WORKSPACE `litmus push` POSTs `/workspace/submit` — the same
+ *     endpoint the assessment page's Submit button calls, capturing the live
+ *     container filesystem host-side (ENG-621). There is nothing local to zip.
+ *     Since ENG-2523 `litmus submit` there runs `push` rather than refusing
+ *     (ENG-2130), because candidates reach for `submit` and a refusal sent them
+ *     back to the browser to press the button.
  *
- * WHY THIS MODULE EXISTS RATHER THAN A CHECK PER SITE. Before ENG-2064 the CLI
- * was not in the container at all, so `litmus submit` there was `command not
- * found` — useless but unambiguous. That ticket put the CLI on the container's
- * PATH and wired the injected `LITMUS_ASSESSMENT_TOKEN` into `push` alone, so
- * `submit` became present, runnable, and unable to authenticate: it reads its
- * bearer from `.litmus/config.json`, and `hostd._stage_litmus_config` writes
- * that file with DELIBERATELY no `token` because it rides the submission zip and
- * the R2 durability tar, where a live credential must never sit. The upload
- * therefore went out as a literal `Authorization: Bearer undefined` and was
- * refused — AFTER the archive had been built, so a candidate read it as an
- * upload failure rather than as the wrong command. Every surface that names a
- * submit command was naming the laptop one to both audiences, so the answer is
- * derived in one place and the sites ask.
+ * WHY `submit` DELEGATES RATHER THAN READING THE INJECTED TOKEN ITSELF. Giving it
+ * the env fallback `push` has would route a v2 candidate down `/cli/submit`,
+ * which grades an UPLOADED zip, while v2's canonical submit grades the live
+ * filesystem — the two flows would then disagree about what a submission is.
+ * Delegating keeps one definition. The token must also never be written into
+ * `.litmus/config.json` (what `submit` reads on a laptop): hostd stages that file
+ * with deliberately no `token` because it rides the submission zip and the R2
+ * durability tar.
  *
- * NOT FIXED BY GIVING `submit` THE ENV FALLBACK `push` HAS. That would make the
- * command "work", but it routes a v2 candidate down `/cli/submit`, which grades
- * an uploaded zip, while v2's canonical submit grades the live filesystem — the
- * two flows would then disagree about what a submission is. That is a product
- * decision, not a patch. And it must NOT be fixed by writing the token into
- * `.litmus/config.json`, for the reason that file has none today.
+ * WHY THE COMMAND WE NAME IS STILL `push`. `submitCommandFor` answers `push`
+ * inside a workspace even though `submit` now works there, because the delegation
+ * is keyed on the INSTALL, not the assessment: a v2 candidate who learns
+ * `litmus submit` and runs it on their own laptop uploads whatever local folder
+ * they are in, and `/cli/submit` does not check the provider. `push` does the
+ * right thing from either place, so it is the one to teach.
  *
  * The predicate is `isWorkspaceInstall`, read from our own module path for the
  * reasons its own docstring gives (an env marker is absent in an sshd session,
  * and a marker injected alongside the token disappears in exactly the case we
  * need to describe). Nothing security-relevant hangs off any of this: it only
- * decides which command a candidate is told to run.
+ * decides which command runs and which one a candidate is told to run.
  */
 import { isWorkspaceInstall } from "./workspace-token.js";
 /** The submit command inside a Codespaces v2 workspace. */
@@ -54,20 +51,14 @@ export function submitCommandFor(moduleUrl) {
     return isWorkspaceInstall(moduleUrl) ? WORKSPACE_SUBMIT_COMMAND : LOCAL_SUBMIT_COMMAND;
 }
 /**
- * Why `litmus submit` must not run here, or `null` when it may.
+ * Whether `litmus submit` should submit the workspace (run `push`) instead of
+ * zipping a local checkout.
  *
- * Non-null only for the in-workspace install. The caller is expected to refuse
- * on it BEFORE doing any work — the whole defect is that the failure used to
- * arrive after a full archive build, which is what made it read as an upload
- * problem. Both routes named in the hint reach `/workspace/submit`, so this
- * points at the two things that work and sends the candidate nowhere new.
+ * True only for the in-workspace install. The caller must ask BEFORE doing any
+ * work: the laptop path walks the cwd, reads `.litmus/config.json` and builds an
+ * archive, none of which means anything in a workspace (ENG-2130).
  */
-export function workspaceSubmitRefusal(moduleUrl) {
-    if (!isWorkspaceInstall(moduleUrl))
-        return null;
-    return {
-        message: "`litmus submit` cannot submit a Litmus workspace: it uploads a local checkout, and your work lives in this container.",
-        hint: `Run \`${WORKSPACE_SUBMIT_COMMAND}\` in this terminal instead, or click Submit assessment on your assessment page.`,
-    };
+export function submitsWorkspace(moduleUrl) {
+    return isWorkspaceInstall(moduleUrl);
 }
 //# sourceMappingURL=submit-route.js.map

package/dist/lib/submit-route.js.map

@@ -1 +1 @@
-{"version":3,"file":"submit-route.js","sourceRoot":"","sources":["../../src/lib/submit-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAEzD,2DAA2D;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAA;AAErD,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAA;AAEnD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,oBAAoB,CAAA;AACxF,CAAC;AAQD;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/C,OAAO;QACL,OAAO,EACL,uHAAuH;QACzH,IAAI,EAAE,SAAS,wBAAwB,kFAAkF;KAC1H,CAAA;AACH,CAAC"}
+{"version":3,"file":"submit-route.js","sourceRoot":"","sources":["../../src/lib/submit-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAEzD,2DAA2D;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAA;AAErD,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAA;AAEnD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,oBAAoB,CAAA;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAA;AACtC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "litmus-cli",
-  "version": "1.4.33",
+  "version": "1.4.34",
   "description": "CLI tool for Litmus engineering assessments",
   "license": "MIT",
   "author": "elenazhao",