litmus-cli 1.4.35 → 1.4.36

package/dist/lib/hook-logger.cjs

@@ -123,9 +123,7 @@ function isAtOrUnder(child, parent) {
 
 /**
  * Does an explicitly named assessment agree with where the session reports it
- * is? Agreement means either direction of containment: the session sits inside
- * that assessment, or the assessment sits under the session's directory (the
- * editor-opened-at-a-parent shape, ENG-771).
+ * is? Agreement means the session sits inside that assessment.
  *
  * `sessionDirs` are locations the TOOL reported (workspace roots, payload cwd)
  * — deliberately not this process's cwd. A hook runner's cwd is not the
@@ -135,21 +133,13 @@ function isAtOrUnder(child, parent) {
  * the silent Copilot Chat loss ENG-1292 fixed. When the tool reports nothing —
  * exactly the Copilot Chat case the argument exists for — the argument stands.
  *
- * ACCEPTED RESIDUAL — the shared-parent case. If the tool reports a workspace
- * that CONTAINS the named assessment, reverse containment agrees, so a config
- * copied into a sibling project under that same parent still resolves to the
- * original assessment. This is not fixable from a path comparison and not
- * worth narrowing for:
- *
- *  - It is indistinguishable from the legitimate shape. "Editor opened at a
- *    parent of the assessment" is ENG-771, the reason resolution looks
- *    downward at all; when the session reports only the parent, nothing in the
- *    payload says which child the prompt came from.
- *  - Rejecting here changes nothing. Verified: with the assessment registered
- *    (which `litmus init` always does), dropping the explicit path just falls
- *    through to the registry, which returns that same assessment. The only
- *    candidates it would affect are project-scope ones, who have no registry
- *    entry — so tightening this trades zero privacy gain for real capture loss.
+ * A session reporting a PARENT of the named assessment does not agree
+ * (ENG-953). It used to, as the "editor opened at a parent" shape (ENG-771),
+ * which also let a config copied into a sibling project under that parent file
+ * its prompts against the original assessment. Nothing in such a payload says
+ * the prompt came from inside the assessment, and the registry fallback no
+ * longer claims parent-rooted sessions either, so neither route records work
+ * from outside the assessment folder.
  */
 function explicitAgreesWithSession(assessmentDir, sessionDirs) {
   const target = realpathOrNull(assessmentDir)
@@ -161,7 +151,7 @@ function explicitAgreesWithSession(assessmentDir, sessionDirs) {
     if (real && !roots.includes(real)) roots.push(real)
   }
   if (roots.length === 0) return true // tool reported no location — the blind case
-  return roots.some(root => isAtOrUnder(root, target) || isAtOrUnder(target, root))
+  return roots.some(root => isAtOrUnder(root, target))
 }
 
 // A directory only counts as an assessment if it has a config.json — the
@@ -229,21 +219,29 @@ function walkUpForLitmusDir(startDir) {
 }
 
 /**
- * True when `child` sits strictly inside `parent`.
+ * The registered assessment whose tree holds `location`, as a project dir, or
+ * null. When registered assessments nest, the innermost one wins: it is the
+ * assessment the session is actually in.
  *
  * Reuses ENG-1311's `realpathOrNull` + `isAtOrUnder` rather than carrying a
  * second path comparison: realpath is what makes this work at all, since the
  * registry stores the string `litmus init` was given while payloads report the
  * tool's own cwd, and on macOS the same directory routinely differs in form
- * (/tmp vs /private/tmp, symlinked homes). Strict because an assessment is not
- * "inside itself" for the purpose of picking a registry entry — an exact match
- * is already handled by the walk-up above.
+ * (/tmp vs /private/tmp, symlinked homes).
  */
-function isStrictlyInside(parent, child) {
-  const p = realpathOrNull(parent)
-  const c = realpathOrNull(child)
-  if (!p || !c || p === c) return false
-  return isAtOrUnder(c, p)
+function registeredAssessmentHolding(location, registered) {
+  const loc = realpathOrNull(location)
+  if (!loc) return null
+  let best = null
+  let bestReal = ""
+  for (const p of registered) {
+    const real = realpathOrNull(p)
+    if (real && isAtOrUnder(loc, real) && real.length > bestReal.length) {
+      best = p
+      bestReal = real
+    }
+  }
+  return best
 }
 
 // Find the .litmus directory — walk up from any workspace roots the tool told
@@ -252,24 +250,29 @@ function isStrictlyInside(parent, child) {
 // every tool runs the hook from the workspace (Cursor invokes hooks with
 // cwd = its own config dir and passes the workspace in `workspace_roots`).
 //
-// `sessionDirs` is where the payload says the session lives, and it exists to
-// pick the RIGHT registry entry. The fallback used to take the first valid
-// entry regardless, which silently misfiled capture whenever a session could
-// not be placed by walk-up — verified live: an editor opened at the PARENT of
-// an assessment, and CLI tools launched from $HOME, all had their prompts and
-// responses written into an unrelated assessment that merely happened to be
-// registered first. Walk-up only goes upward, so a parent-rooted session can
-// never find an assessment nested below it, which makes this the common case
-// rather than an edge one.
+// The walk-ups are never gated: a session placed inside an assessment is
+// captured whatever the registry says.
+//
+// The registry fallback is SCOPED (ENG-953). It answers only for a session
+// that is inside a registered assessment's tree, and names that assessment.
+// That is the case walk-up misses while the assessment is live: the in-repo
+// config was deleted mid-session and the shadow mirror carries identity
+// (ENG-1453), or the session sits deeper than the walk-up's ten levels.
+//
+// It used to answer for anything. With no match it returned the first
+// registered assessment, so a prompt typed in an unrelated project on the same
+// machine was written into the assessment and uploaded, and a later version
+// also claimed any session rooted at a PARENT of an assessment ($HOME
+// included). Both captured work outside the assessment folder, which the
+// candidate disclosure says we do not record. A session placed nowhere now
+// captures nothing.
 //
-// So among registered assessments we prefer one that sits INSIDE the declared
-// location, and of those the most recently registered — the assessment the
-// candidate most recently ran `litmus init` for. With a single registered
-// assessment (the normal case) every branch here picks the same directory, so
-// this only changes behavior when there is genuine ambiguity to resolve.
-function findLitmusDir(hintDirs = [], sessionDirs = []) {
-  for (const hint of hintDirs) {
-    if (typeof hint !== "string" || !hint) continue
+// Where the session is: the tool's reported locations (`hintDirs`), or this
+// process's cwd when the tool reported none, since a hook runner's cwd is only
+// a stand-in for the session's.
+function findLitmusDir(hintDirs = []) {
+  const reported = hintDirs.filter(d => typeof d === "string" && d)
+  for (const hint of reported) {
     const found = walkUpForLitmusDir(hint)
     if (found) return found
   }
@@ -282,7 +285,7 @@ function findLitmusDir(hintDirs = [], sessionDirs = []) {
     const list = JSON.parse(fs.readFileSync(registry, "utf8"))
     if (!Array.isArray(list)) return null
     const valid = list.filter(
-      p => typeof p === "string" && (
+      p => typeof p === "string" && p && (
         isAssessmentLitmusDir(path.join(p, ".litmus"))
         // ENG-1453: config wiped but the assessment is alive — the dir still
         // exists and its shadow mirror supplies identity + credentials.
@@ -291,15 +294,11 @@ function findLitmusDir(hintDirs = [], sessionDirs = []) {
     )
     if (!valid.length) return null
 
-    const declared = sessionDirs.filter(d => typeof d === "string" && d)
-    if (declared.length) {
-      const contained = valid.filter(p => declared.some(d => isStrictlyInside(d, p)))
-      // Most recently registered wins; `litmus init` appends.
-      if (contained.length) return path.join(contained[contained.length - 1], ".litmus")
+    const locations = reported.length ? reported : [process.cwd()]
+    for (const location of locations) {
+      const holder = registeredAssessmentHolding(location, valid)
+      if (holder) return path.join(holder, ".litmus")
     }
-    // Nothing placeable — keep the long-standing behavior rather than dropping
-    // the event, so a tool that reports no location at all still captures.
-    return path.join(valid[0], ".litmus")
   } catch { /* no registry — give up silently */ }
   return null
 }
@@ -1676,8 +1675,8 @@ function claimPrompt(generationId) {
  * Where the TOOL says this session is: workspace roots (Cursor) or the
  * payload's own cwd (Claude Code, Codex, Copilot CLI). VS Code Copilot Chat
  * reports neither. Two uses: checking the explicit path (ENG-1311), and
- * picking the RIGHT registry entry when walk-up finds nothing (ENG-1323 — see
- * findLitmusDir).
+ * deciding which registered assessment, if any, holds the session when
+ * walk-up finds nothing (ENG-953, see findLitmusDir).
  *
  * Explicit hint first: it is correct by construction — but only once it
  * agrees with the session's own reported location, since the hook config
@@ -1687,9 +1686,7 @@ function claimPrompt(generationId) {
  * Those merits include every location the tool reported, cwd included. The
  * reported cwd beats this process's cwd (a hook runner's need not be the
  * session's) and is the only pointer left once a copied explicit path has
- * been rejected — without it a rejected Copilot prompt, which carries no
- * workspace roots, would fall through to the registry and be filed against
- * an unrelated assessment.
+ * been rejected.
  */
 function resolveAssessmentDir(parsed, workspaceRoots) {
   const sessionDirs = [
@@ -1701,7 +1698,7 @@ function resolveAssessmentDir(parsed, workspaceRoots) {
   const hintDirs = trustExplicit
     ? [explicitAssessmentDir, ...sessionDirs]
     : sessionDirs
-  return findLitmusDir(hintDirs, sessionDirs)
+  return findLitmusDir(hintDirs)
 }
 
 async function main() {

package/dist/lib/platform.d.ts

@@ -10,15 +10,28 @@
  * a no-op on Unix; tests/unit/windows-hide.test.ts enforces it.
  */
 /**
- * Returns lowercase text listing all running processes.
- * Used for regex matching against editor/AI tool name patterns.
+ * Returns lowercase text listing running processes, one per line.
+ * Tool detection parses it into rows and keeps the watcher's own user's
+ * (detection.ts detectTools); never match a word against the whole text.
  *
- * - macOS/Linux: `ps aux` (full command lines)
- * - Windows: `tasklist` (image names like Code.exe, Cursor.exe)
- *
- * Output is lowercased so patterns like /\bcode\b/ match uniformly.
+ * - macOS/Linux: `ps aux` (full command lines, every user's)
+ * - Windows: `tasklist /fo csv /nh` (full image names like Code.exe,
+ *   Cursor.exe; the default table truncates them at 25 characters), asked for
+ *   the current user's processes only. tasklist rows carry a Session#, not
+ *   an account, and another account can run in the candidate's session
+ *   (`runas`), so the user filter has to happen here, and it never widens:
+ *   see ownTasklist.
  */
 export declare function getProcessList(): string;
+/**
+ * The first user-filtered tasklist that contains this very process (`pid`),
+ * trying each spelling of the account in turn (DOMAIN\user, then user).
+ * When none does, the filter did not match how this machine names the
+ * account, and ownership cannot be established: the result is empty, so
+ * nothing counts. It never falls back to an unfiltered or session-scoped
+ * list, which would badge another account's processes.
+ */
+export declare function ownTasklist(run: (account: string) => string, accounts: string[], pid: number): string;
 /**
  * Lists active network connections asynchronously.
  * Calls cb(err, stdout) with raw connection output.

package/dist/lib/platform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/lib/platform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH;;;;;;;;GAQG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAarF;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAA;IACb,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAqBtE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAkBrF"}
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/lib/platform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAavC;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAQrG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAarF;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAA;IACb,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAqBtE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAkBrF"}

package/dist/lib/platform.js

@@ -9,21 +9,52 @@
  * see terminal windows flash on every detection cycle (ENG-2010). The flag is
  * a no-op on Unix; tests/unit/windows-hide.test.ts enforces it.
  */
-import { execSync, execFile } from "child_process";
+import { execSync, execFile, execFileSync } from "child_process";
+import { userInfo } from "os";
 const isWin = process.platform === "win32";
 const isLinux = process.platform === "linux";
 /**
- * Returns lowercase text listing all running processes.
- * Used for regex matching against editor/AI tool name patterns.
+ * Returns lowercase text listing running processes, one per line.
+ * Tool detection parses it into rows and keeps the watcher's own user's
+ * (detection.ts detectTools); never match a word against the whole text.
  *
- * - macOS/Linux: `ps aux` (full command lines)
- * - Windows: `tasklist` (image names like Code.exe, Cursor.exe)
- *
- * Output is lowercased so patterns like /\bcode\b/ match uniformly.
+ * - macOS/Linux: `ps aux` (full command lines, every user's)
+ * - Windows: `tasklist /fo csv /nh` (full image names like Code.exe,
+ *   Cursor.exe; the default table truncates them at 25 characters), asked for
+ *   the current user's processes only. tasklist rows carry a Session#, not
+ *   an account, and another account can run in the candidate's session
+ *   (`runas`), so the user filter has to happen here, and it never widens:
+ *   see ownTasklist.
  */
 export function getProcessList() {
-    const cmd = isWin ? "tasklist" : "ps aux";
-    return execSync(cmd, { timeout: 5000, encoding: "utf8", windowsHide: true }).toLowerCase();
+    if (!isWin)
+        return execSync("ps aux", { timeout: 5000, encoding: "utf8", windowsHide: true }).toLowerCase();
+    const user = userInfo().username;
+    const domain = process.env.USERDOMAIN;
+    return ownTasklist((account) => execFileSync("tasklist", ["/fo", "csv", "/nh", "/fi", `USERNAME eq ${account}`], {
+        timeout: 5000,
+        encoding: "utf8",
+        windowsHide: true,
+    }), domain ? [`${domain}\\${user}`, user] : [user], process.pid);
+}
+/**
+ * The first user-filtered tasklist that contains this very process (`pid`),
+ * trying each spelling of the account in turn (DOMAIN\user, then user).
+ * When none does, the filter did not match how this machine names the
+ * account, and ownership cannot be established: the result is empty, so
+ * nothing counts. It never falls back to an unfiltered or session-scoped
+ * list, which would badge another account's processes.
+ */
+export function ownTasklist(run, accounts, pid) {
+    for (const account of accounts) {
+        try {
+            const out = run(account).toLowerCase();
+            if (out.includes(`","${pid}","`))
+                return out;
+        }
+        catch { /* try the next spelling */ }
+    }
+    return "";
 }
 /**
  * Lists active network connections asynchronously.

package/dist/lib/platform.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/lib/platform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAElD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAE5C;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAA;IACzC,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AAC5F,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,EAAgD;IAC7E,IAAI,KAAK,EAAE,CAAC;QACV,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACvH,OAAM;IACR,CAAC;IACD,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QAChJ,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;YACvE,8CAA8C;YAC9C,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9G,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACjB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAgBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACtC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;YACxD,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAA;YACnB,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAA;QAC1E,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACvD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;IAC7E,CAAC;IACD,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAA;IACnF,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;IACvD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,EAA+C;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,EAAE,CAAC,IAAI,CAAC,CAAA;QACR,OAAM;IACR,CAAC;IACD,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QAChJ,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACnB,EAAE,CAAC,IAAI,CAAC,CAAA;YACR,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;QACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,oEAAoE;YACpE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;YAC1C,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,CAAC;QACD,EAAE,CAAC,KAAK,CAAC,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/lib/platform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAA;AAE7B,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAE5C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAC3G,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC,QAAQ,CAAA;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAA;IACrC,OAAO,WAAW,CAChB,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,OAAO,EAAE,CAAC,EAAE;QAC5F,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,IAAI;KAClB,CAAC,EACF,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAC9C,OAAO,CAAC,GAAG,CACZ,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,GAAgC,EAAE,QAAkB,EAAE,GAAW;IAC3F,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;YACtC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAA;QAC9C,CAAC;QAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,EAAgD;IAC7E,IAAI,KAAK,EAAE,CAAC;QACV,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACvH,OAAM;IACR,CAAC;IACD,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QAChJ,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;YACvE,8CAA8C;YAC9C,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9G,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACjB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAgBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACtC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;YACxD,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAA;YACnB,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAA;QAC1E,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACvD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;IAC7E,CAAC;IACD,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAA;IACnF,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;IACvD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,EAA+C;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,EAAE,CAAC,IAAI,CAAC,CAAA;QACR,OAAM;IACR,CAAC;IACD,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QAChJ,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACnB,EAAE,CAAC,IAAI,CAAC,CAAA;YACR,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;QACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,oEAAoE;YACpE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;YAC1C,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,CAAC;QACD,EAAE,CAAC,KAAK,CAAC,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/lib/watcher.js

@@ -36,7 +36,7 @@ import { setupAiTracking } from "../commands/init.js";
 import { writeShadowChainCursor, readShadowChainCursor, writeShadowTrackerFile, writeShadowReviveInfo, readShadowConfigById, findShadowConfigForDir, deleteShadowForAssessment, writeRepairFile, removeRepairFile, REPAIR_FILE_NAME, } from "./shadow.js";
 import { createKeepAliveGuard } from "./keepalive.js";
 import { getProcessList, getConnections, extractConnection, resolvePidNames } from "./platform.js";
-import { classifyClaudeProcesses, refineClaudeTool } from "./detection.js";
+import { detectTools, refineClaudeTool } from "./detection.js";
 import { decideNudge, loadNudgeState, saveNudgeState, initialPromptCursor, scanPromptCount, writeAiNoticeFile, removeAiNoticeFile, nudgeNotificationCopy, isCliNoticeArtifact, AI_NOTICE_FILE_NAME, } from "./capture-nudge.js";
 import { desktopNotify } from "./notify.js";
 // ENG-1491: an uncaught throw no longer always kills the watcher — on a
@@ -999,34 +999,6 @@ function checkGitCommits() {
     catch { /* git not available or command failed — skip */ }
 }
 setInterval(checkGitCommits, 30 * 1000); // Every 30 seconds
-// ── Editor & AI tool detection ───────────────────────────────────
-const EDITOR_PATTERNS = {
-    vscode: /\bcode\b/,
-    cursor: /\bcursor\b/,
-    vim: /\b[gn]?vim\b/,
-    intellij: /\bidea\b/,
-    webstorm: /\bwebstorm\b/,
-    sublime: /\bsubl\b/,
-    emacs: /\bemacs\b/,
-    zed: /\bzed\b/,
-};
-const AI_TOOL_PATTERNS = {
-    aider: /\baider\b/,
-    codeium: /\bcodeium\b/,
-    codex: /\bcodex\b/,
-    copilot: /\bcopilot\b/,
-    gemini: /\bgemini\b/,
-    windsurf: /\bwindsurf\b/,
-    ollama: /\bollama\b/,
-    tabnine: /\btabnine\b/,
-    supermaven: /\bsupermaven\b/,
-    cline: /\bcline\b/,
-    cody: /\bsourcegraph-cody\b|\bcody-agent\b/,
-    "amazon-q": /\bamazon-q\b/,
-    "roo-code": /\broo-code\b|\broo_code\b/,
-    pearai: /\bpearai\b/,
-    ghostwriter: /\bghostwriter\b/,
-};
 // ── Capture nudge (ENG-1857) ─────────────────────────────────────
 // A hook-capturable AI tool running with ZERO captured prompts is the silent
 // Codex/Copilot trust-gate signature: the candidate's AI work is invisibly
@@ -1091,18 +1063,9 @@ function runCaptureNudge(aiTools) {
 }
 function detectEnvironment() {
     try {
-        const ps = getProcessList();
-        const editors = Object.entries(EDITOR_PATTERNS)
-            .filter(([, re]) => re.test(ps))
-            .map(([name]) => name);
-        const aiTools = Object.entries(AI_TOOL_PATTERNS)
-            .filter(([, re]) => re.test(ps))
-            .map(([name]) => name);
-        aiTools.push(...classifyClaudeProcesses(ps));
-        // Cursor is both an editor and an AI tool
-        if (editors.includes("cursor") && !aiTools.includes("cursor")) {
-            aiTools.push("cursor");
-        }
+        // Per process row, own user only, matched on the program — see
+        // detectTools (ENG-1273).
+        const { editors, aiTools } = detectTools(getProcessList(), process.platform, process.pid);
         if (editors.length > 0 || aiTools.length > 0) {
             const event = {
                 ts: new Date().toISOString(),