litmus-cli 1.4.84-desktop.2 → 1.4.84-desktop.4

package/README.md

@@ -98,6 +98,10 @@ litmus connect <token> --ide claude
 Both configure the same dedicated Litmus SSH key and host alias and verify SSH plus
 remote runtime/capture configuration before handing off. Codex App uses Settings →
 Connections → SSH: enable the printed host and choose `/home/candidate/workspace`.
+If the workspace uses your own AI account, first run
+`ssh -t <litmus-host-alias> codex login --device-auth`, open the printed browser
+link, and enter the one-time code. Enable device code login in ChatGPT security
+settings if prompted. Litmus pre-authenticated workspaces do not need this step.
 Claude Desktop opens its Code tab with that host and folder prefilled (v2.110.0 or
 later); confirm the connection. Neither requires downloading the assessment locally.
 Keep edits in the workspace folder, without a separate worktree, and submit through

package/dist/lib/desktop-app.d.ts

@@ -8,6 +8,7 @@ export type DesktopApp = "codex" | "claude";
 export declare const DESKTOP_WORKSPACE_FOLDER = "/home/candidate/workspace";
 export declare function claudeDesktopUrl(alias: string): string;
 export declare function desktopAppInstructions(app: DesktopApp, alias: string): string[];
-/** Read only configuration presence; never print credentials or candidate files. */
+/** Validate remote configuration without printing credentials or candidate content. */
+export declare function desktopAppConfigurationScript(app: DesktopApp): string;
 export declare function desktopAppProbeCommand(app: DesktopApp): string;
 //# sourceMappingURL=desktop-app.d.ts.map

package/dist/lib/desktop-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"desktop-app.d.ts","sourceRoot":"","sources":["../../src/lib/desktop-app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,QAAQ,CAAA;AAC3C,eAAO,MAAM,wBAAwB,8BAA8B,CAAA;AAEnE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAc/E;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAI9D"}
+{"version":3,"file":"desktop-app.d.ts","sourceRoot":"","sources":["../../src/lib/desktop-app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,QAAQ,CAAA;AAC3C,eAAO,MAAM,wBAAwB,8BAA8B,CAAA;AAEnE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB/E;AAED,uFAAuF;AACvF,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAgDrE;AAID,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAQ9D"}

package/dist/lib/desktop-app.js

@@ -14,17 +14,74 @@ export function desktopAppInstructions(app, alias) {
             "Use the project folder directly rather than creating a worktree. Submit from your Litmus assessment page.",
         ];
     return [
+        "If this workspace uses your own AI account, sign in to Codex on the workspace first:",
+        `  ssh -t ${alias} codex login --device-auth`,
+        "Open the printed link in your browser and enter the one-time code. Enable device code login in your ChatGPT security settings if needed.",
         "Open Codex App, then Settings > Connections > SSH.",
         `Add or enable SSH host: ${alias}`,
         `Choose project folder: ${DESKTOP_WORKSPACE_FOLDER}`,
         "Start a chat in that remote project. Submit from your Litmus assessment page.",
     ];
 }
-/** Read only configuration presence; never print credentials or candidate files. */
+/** Validate remote configuration without printing credentials or candidate content. */
+export function desktopAppConfigurationScript(app) {
+    const common = `import json,os,pathlib,tomllib,urllib.parse
+home=pathlib.Path.home()
+def require(ok):
+    if not ok: raise ValueError("Desktop app configuration is incomplete")
+proxy=urllib.parse.urlparse(os.environ.get("HTTPS_PROXY",""))
+require(proxy.scheme in ("http","https") and bool(proxy.hostname))
+ca=pathlib.Path(os.environ.get("NODE_EXTRA_CA_CERTS","/nonexistent"))
+require(ca.is_file() and os.access(ca,os.R_OK))
+`;
+    if (app === "claude")
+        return common + `s=json.loads((home/".claude/settings.json").read_text())
+require(isinstance(s,dict) and s.get("disableAllHooks") is not True)
+h=s.get("hooks",{})
+command="node /opt/litmus/lib/hook-logger.cjs claude /home/candidate/workspace --hosted-workspace /home/candidate"
+for event in ("UserPromptSubmit","Stop"):
+    entries=[e for g in h.get(event,[]) if g.get("matcher") is None for e in g.get("hooks",[]) if e.get("command")==command and e.get("type")=="command" and isinstance(e.get("timeout"),(int,float)) and e["timeout"]>=15 and not e.get("async",False)]
+    require(len(entries)==1)
+env=s.get("env",{})
+require(isinstance(env,dict) and env.get("CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC")=="1")
+for key in ("HTTPS_PROXY","HTTP_PROXY","NODE_EXTRA_CA_CERTS"):
+    require(key not in env or env[key]==os.environ.get(key))
+# Authentication may be supplied by Desktop sign-in. If workspace pre-auth is set,
+# both its route and credential must be present; never print either value.
+base=os.environ.get("ANTHROPIC_BASE_URL","")
+if base:
+    require(urllib.parse.urlparse(base).scheme in ("http","https") and bool(urllib.parse.urlparse(base).hostname))
+    require(bool(os.environ.get("ANTHROPIC_AUTH_TOKEN") or os.environ.get("ANTHROPIC_API_KEY")))
+print("ready")
+`;
+    return common + `config=tomllib.loads((home/".codex/config.toml").read_text())
+require(config.get("check_for_update_on_startup") is False)
+require(config.get("sandbox_mode")=="danger-full-access")
+require(config.get("features",{}).get("hooks") is not False)
+daemon=json.loads((home/".codex/app-server-daemon/settings.json").read_text())
+require(daemon.get("updater",{}).get("autoUpdateEnabled") is False)
+provider=config.get("model_provider")
+if provider=="litmus":
+    route=config.get("model_providers",{}).get("litmus",{})
+    require(route.get("wire_api")=="responses")
+    url=urllib.parse.urlparse(route.get("base_url",""))
+    require(url.scheme in ("http","https") and bool(url.hostname))
+    require(bool(os.environ.get(route.get("env_key",""))))
+    require(route.get("http_headers",{}).get("X-Litmus-Client")=="codex")
+else:
+    # Personal account sign-in is supported; an unknown provider is not our config.
+    require(provider in (None,"openai"))
+print("ready")
+`;
+}
+function shellQuote(value) { return "'" + value.replace(/'/g, "'\\''") + "'"; }
 export function desktopAppProbeCommand(app) {
-    if (app === "codex")
-        return "bash -lc 'command -v codex >/dev/null && codex app-server --help >/dev/null 2>&1 && test -r ~/.codex/config.toml && test -r /etc/codex/hooks.json && test -r /etc/codex/requirements.toml && test -r /opt/litmus/lib/hook-logger.cjs && printf ready'";
-    // Desktop uploads its own runtime and reads remote user settings, including hooks.
-    return `python3 -c 'import json,pathlib; p=pathlib.Path.home()/".claude/settings.json"; s=json.loads(p.read_text()); h=s.get("hooks",{}); assert all(any(e.get("command","").split()[:3] == ["node","/opt/litmus/lib/hook-logger.cjs","claude"] for g in h.get(k,[]) for e in g.get("hooks",[])) for k in ("UserPromptSubmit","Stop")); assert isinstance(s.get("env"),dict); print("ready")'`;
+    const configuration = `python3 -c ${shellQuote(desktopAppConfigurationScript(app))}`;
+    if (app === "codex") {
+        // Reuse the image's exact hook/requirements/node verifier, including root ownership,
+        // rather than maintaining another approximation of its shell command contract.
+        return "bash -lc 'command -v codex >/dev/null && codex app-server --help >/dev/null 2>&1' && python3 /opt/litmus/lib/install_codex_hook.py verify --expect-root-owned --expect-node >/dev/null 2>&1 && test -r /opt/litmus/lib/hook-logger.cjs && " + configuration;
+    }
+    return "command -v node >/dev/null && test -r /opt/litmus/lib/hook-logger.cjs && " + configuration;
 }
 //# sourceMappingURL=desktop-app.js.map

package/dist/lib/desktop-app.js.map

@@ -1 +1 @@
-{"version":3,"file":"desktop-app.js","sourceRoot":"","sources":["../../src/lib/desktop-app.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAA;AAEnE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC1F,OAAO,8BAA8B,kBAAkB,CAAC,KAAK,CAAC,eAAe,kBAAkB,CAAC,wBAAwB,CAAC,EAAE,CAAA;AAC7H,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAe,EAAE,KAAa;IACnE,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO;YAC3B,oGAAoG;YACpG,gBAAgB,CAAC,KAAK,CAAC;YACvB,aAAa,KAAK,EAAE;YACpB,mBAAmB,wBAAwB,EAAE;YAC7C,2GAA2G;SAC5G,CAAA;IACD,OAAO;QACL,oDAAoD;QACpD,2BAA2B,KAAK,EAAE;QAClC,0BAA0B,wBAAwB,EAAE;QACpD,+EAA+E;KAChF,CAAA;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,GAAe;IACpD,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,uPAAuP,CAAA;IACnR,mFAAmF;IACnF,OAAO,uXAAuX,CAAA;AAChY,CAAC"}
+{"version":3,"file":"desktop-app.js","sourceRoot":"","sources":["../../src/lib/desktop-app.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAA;AAEnE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC1F,OAAO,8BAA8B,kBAAkB,CAAC,KAAK,CAAC,eAAe,kBAAkB,CAAC,wBAAwB,CAAC,EAAE,CAAA;AAC7H,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAe,EAAE,KAAa;IACnE,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO;YAC3B,oGAAoG;YACpG,gBAAgB,CAAC,KAAK,CAAC;YACvB,aAAa,KAAK,EAAE;YACpB,mBAAmB,wBAAwB,EAAE;YAC7C,2GAA2G;SAC5G,CAAA;IACD,OAAO;QACL,sFAAsF;QACtF,YAAY,KAAK,4BAA4B;QAC7C,0IAA0I;QAC1I,oDAAoD;QACpD,2BAA2B,KAAK,EAAE;QAClC,0BAA0B,wBAAwB,EAAE;QACpD,+EAA+E;KAChF,CAAA;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,6BAA6B,CAAC,GAAe;IAC3D,MAAM,MAAM,GAAG;;;;;;;;CAQhB,CAAA;IACC,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,MAAM,GAAG;;;;;;;;;;;;;;;;;;CAkBvC,CAAA;IACC,OAAO,MAAM,GAAG;;;;;;;;;;;;;;;;;;CAkBjB,CAAA;AACD,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,IAAY,OAAO,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG,CAAA,CAAC,CAAC;AAE9F,MAAM,UAAU,sBAAsB,CAAC,GAAe;IACpD,MAAM,aAAa,GAAG,cAAc,UAAU,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC,EAAE,CAAA;IACpF,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,qFAAqF;QACrF,+EAA+E;QAC/E,OAAO,4OAA4O,GAAG,aAAa,CAAA;IACrQ,CAAC;IACD,OAAO,2EAA2E,GAAG,aAAa,CAAA;AACpG,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "litmus-cli",
-  "version": "1.4.84-desktop.2",
+  "version": "1.4.84-desktop.4",
   "description": "CLI tool for Litmus engineering assessments",
   "license": "MIT",
   "author": "elenazhao",