failproofai 1.0.3 → 1.0.4-beta.2

package/src/hooks/configure-wizard.ts

@@ -74,6 +74,7 @@ import {
   probeDaemonEndToEnd,
   uninstallDaemonService,
 } from "./daemon-service";
+import { installMacNotifier } from "../audit/macos-notifier";
 import { hookLogWarn } from "./hook-logger";
 import {
   readCloudCredentials,
@@ -1442,6 +1443,25 @@ export async function runConfigureWizard(
     // longer referenced by anything. Keeps the previous version for an
     // offline rollback.
     pruneOldDaemonBinaries();
+
+    // The delivery path for what the scheduled audit finds. macOS only, and a
+    // no-op everywhere else: a Linux box's audit talks to the session bus
+    // itself, while on a Mac the daemon runs outside the GUI session and cannot
+    // reach Notification Center at all — see `audit/macos-notifier.ts`.
+    //
+    // Installed here, with the daemon, because it exists only to deliver what
+    // the daemon's scheduled scan produces, and removed alongside it by
+    // `uninstall`. Silent, and not a step in the wizard: it needs no password,
+    // asks nothing, and narrating it would be an apology for the delivery half
+    // of a feature the user just switched on. What they are actually asked —
+    // does this machine scan, and may it interrupt — are real settings, and
+    // both are theirs to change afterwards.
+    //
+    // Its failure is not the wizard's failure. A Mac where `osacompile` is
+    // missing or launchd refuses the job must still finish installing its
+    // daemon, its hooks and its policies, which are the parts that enforce
+    // anything; the notice in-CLI still reaches them either way.
+    installMacNotifier();
   }
 
   // Telemetry runs concurrently with the install (never rejects, 5s-bounded) so

package/src/hooks/fp-config.ts

@@ -325,12 +325,53 @@ export interface FpConfig {
      * refresh token expiring must not silently switch off a background feature
      * somebody configured months ago.
      *
-     * OFF by default, and the asymmetry with `telemetry.enabled` above is
-     * deliberate: the audit reads the CONTENTS of every session transcript on
-     * disk — prompts, file contents, command output — so nothing scans on a
-     * timer until somebody asks for it.
+     * ON for a configured machine that has never stated an opinion, OFF for
+     * every machine we could not read an opinion from — which is not the same
+     * default twice, and the difference is the whole design.
+     *
+     * The scan reads the CONTENTS of every session transcript on disk, so the
+     * conservative instinct is to keep it off until asked. But the thing it
+     * looks for now is a leaked credential, and a credential nobody scans for
+     * is a credential nobody revokes: a switch that is off by default is a
+     * feature that, for most users, never runs. Setup is where the machine's
+     * owner is told what it does, so completing setup is the opinion.
+     *
+     * Hence the split. Once `config.json` exists AND carries an `audit` table,
+     * this is on unless it says exactly `false`. Absent file, unparseable JSON,
+     * or no `audit` table at all still read as OFF, because those are the three
+     * ways of not knowing, and "we could not tell" must never turn a transcript
+     * scan on. `crates/failproofaid/src/audit_lane.rs` makes the identical
+     * distinction over the identical bytes — the daemon and this reader must
+     * agree, or the settings page describes a machine that is doing something
+     * else.
+     *
+     * Turning it on sends NOTHING on its own: the digest is gated on
+     * `reportsConsentedAt` below, not on this switch, so a machine that flips
+     * on at upgrade scans locally and mails nobody.
      */
     auto: boolean;
+    /**
+     * Raise a desktop notification when a scan finds a credential.
+     *
+     * Separate from `auto` because they answer different questions: `auto` is
+     * whether the machine scans, this is whether it interrupts. Somebody who
+     * wants the scan and not the banner is a coherent person, and without this
+     * their only way to stop the banner is to stop the scan.
+     *
+     * ON by default, and the direction is the point: this fires at most once
+     * per distinct credential ever (`leak-notice.ts` claims each finding with
+     * an O_EXCL marker), so the volume it can reach is bounded by how many
+     * secrets are actually leaking. A silent default would make the common
+     * case — a user who never opens the dashboard and never gave an email —
+     * a machine that finds the key and tells nobody.
+     *
+     * It does NOT silence the in-CLI notice. That one appears inside a session
+     * the user is already driving, costs two lines, and is the only channel
+     * left when there is no desktop to notify — a headless box, a container, an
+     * SSH session. Turning off every channel at once is not an option this
+     * offers, because the resulting state is indistinguishable from broken.
+     */
+    notify: boolean;
     /**
      * When this machine's owner agreed that a scheduled scan may send what it
      * finds off the box, as epoch ms. Absent means they never did.
@@ -402,7 +443,9 @@ export const DEFAULT_CONFIG: FpConfig = {
     environment: "local",
   },
   telemetry: { enabled: true },
-  audit: { auto: false, intervalDays: DEFAULT_AUDIT_INTERVAL_DAYS },
+  // `auto: false` is the no-file case specifically — see the field's doc for
+  // why a machine that HAS a config reads the other way.
+  audit: { auto: false, notify: true, intervalDays: DEFAULT_AUDIT_INTERVAL_DAYS },
 };
 
 /**
@@ -495,7 +538,11 @@ export function projectConfig(parsed: Record<string, unknown>): FpConfig {
     const daemon = (parsed.daemon ?? {}) as Record<string, unknown>;
     const collector = (parsed.collector ?? {}) as Record<string, unknown>;
     const telemetry = (parsed.telemetry ?? {}) as Record<string, unknown>;
-    const audit = (parsed.audit ?? {}) as Record<string, unknown>;
+    // Presence, not just contents: `audit.auto` reads differently when the
+    // table is absent than when it is present-but-silent. See the field's doc.
+    const auditPresent =
+      !!parsed.audit && typeof parsed.audit === "object" && !Array.isArray(parsed.audit);
+    const audit = (auditPresent ? parsed.audit : {}) as Record<string, unknown>;
     return {
       // Anything unrecognised reads as `oss`. The failure direction matters: a
       // corrupt config must not be able to turn cloud reporting ON.
@@ -525,12 +572,20 @@ export function projectConfig(parsed: Record<string, unknown>): FpConfig {
       // reads as on — the shipped default, and what a config with no
       // [telemetry] block at all means.
       telemetry: { enabled: telemetry.enabled !== false },
-      // Mirror image of telemetry above: only an explicit `true` switches the
-      // scheduled scan on. Absent, misspelled, or `"yes"` all read as off,
-      // because the failure direction here is a machine that starts reading
-      // every transcript it can find on a timer nobody set.
+      // A configured machine with no stated opinion scans; a machine we could
+      // not read an opinion FROM does not. `auditPresent` is what separates
+      // them, and it is the reason this is not simply `!== false`: with no
+      // `audit` table there is no opinion to have been stated, only an absence,
+      // and an absence must not start reading every transcript on disk. Same
+      // three-way split as `audit_lane.rs`, over the same file.
       audit: {
-        auto: audit.auto === true,
+        auto: auditPresent && audit.auto !== false,
+        // Default ON, off only on an explicit `false` — a notification the user
+        // never sees is the same as no detection at all. Ungated on
+        // `auditPresent`, unlike `auto`: this is read at the moment a
+        // notification is about to fire, which means a scan already ran and the
+        // question is only whether to speak.
+        notify: audit.notify !== false,
         intervalDays: readIntervalDays(audit.interval_days),
         // A finite number or nothing. A garbage value reads as absent, which is
         // the direction that sends nothing.
@@ -584,6 +639,7 @@ const OWNED_CONFIG_KEYS: readonly (readonly string[])[] = [
   ["collector", "sources", "*", "extra_paths"],
   ["telemetry", "enabled"],
   ["audit", "auto"],
+  ["audit", "notify"],
   ["audit", "interval_days"],
   ["audit", "reports_consented_at"],
 ];
@@ -688,6 +744,10 @@ export function writeConfig(config: FpConfig, raw?: Record<string, unknown>): vo
     // total rather than conditional.
     audit: {
       auto: config.audit.auto,
+      // Emitted unconditionally, like `auto`. A switch that only appears in the
+      // file once you have used it is a switch nobody discovers, and this one
+      // exists to be found by somebody the banner annoyed.
+      notify: config.audit.notify,
       interval_days: config.audit.intervalDays,
       // Written only once there IS consent, so an untouched machine's config
       // does not grow a key implying it was asked. It is in

package/src/hooks/fp-home.ts

@@ -299,6 +299,31 @@ export const auditSessionFile = (home?: string) => resolve(auditDir(home), "sess
  */
 export const auditMachineFile = (home?: string) => resolve(auditDir(home), "machine.json");
 
+/**
+ * The leak record: one entry per DISTINCT credential seen in a transcript.
+ *
+ * `derived` — every finding in it is reproducible by rescanning, so a reset
+ * costs a rescan and nothing else. What is NOT reproducible lives next door in
+ * `auditLeakIdentityFile`, because the two have opposite reset semantics and
+ * this directory's own header says to classify the children, never the parent.
+ */
+export const auditLeaksFile = (home?: string) => resolve(auditDir(home), "leaks.json");
+
+/**
+ * The two things about a leak that a rescan cannot recreate: the HMAC salt that
+ * gives each finding its stable id, and the ids the user has dismissed.
+ *
+ * `identity`, and both halves for the same reason. Regenerate the salt and every
+ * id changes, so every previously-seen credential reads as brand new and the
+ * machine re-alerts for all of them at once. Drop the dismissals and the
+ * findings a human already judged not-a-secret come back — which is worse than
+ * a missed alert, because it teaches them the tool does not listen.
+ *
+ * Small by construction: a 32-byte salt and a list of 16-char ids.
+ */
+export const auditLeakIdentityFile = (home?: string) =>
+  resolve(auditDir(home), "leak-identity.json");
+
 
 // ── fp-cloud-cli ───────────────────────────────────────────────────────────────────
 
@@ -628,6 +653,7 @@ export const HOME_CLASSES: readonly { path: (home?: string) => string; class: Da
   // history the user was already told about. Kept OUT of `auditSessionFile`
   // precisely so both survive a sign-out.
   { path: auditMachineFile, class: "identity" },
+  { path: auditLeakIdentityFile, class: "identity" },
 
   // ── May be dropped: rebuilt on demand ──
   // NOTE: `auditDir` itself is deliberately absent. Layout 4 made it MIXED — it
@@ -637,6 +663,7 @@ export const HOME_CLASSES: readonly { path: (home?: string) => string; class: Da
   // the delete list.
   { path: auditDashboardFile, class: "derived" },
   { path: auditCacheDir, class: "derived" },
+  { path: auditLeaksFile, class: "derived" },
   { path: auditScheduleFile, class: "derived" },
   { path: collectorHealthFile, class: "derived" },
   { path: codexSessionPathsFile, class: "derived" },

package/src/hooks/handler.ts

@@ -35,6 +35,8 @@ import { loadAllCustomHooks } from "./custom-hooks-loader";
 import type { CustomHook } from "./policy-types";
 import { persistHookActivity } from "./hook-activity-store";
 import { deliveryHealth, deliveryHealthLine } from "./delivery-health";
+import { shapeNotice, canDeliverNotice, leakNoticeText } from "./notice";
+import { pendingLeakNotice, markLeakNoticeDelivered } from "../audit/leak-notice";
 import { trackHookEvent, flushHookTelemetry } from "./hook-telemetry";
 import { resolveCwd } from "./resolve-cwd";
 import { resolvePermissionMode } from "./resolve-permission-mode";
@@ -104,6 +106,48 @@ export interface HookEventOutcome {
   stderr: string;
 }
 
+/**
+ * Merge a pending leak notice into an outcome, once.
+ *
+ * Anchored on Stop wherever the host renders there, and SessionStart only where
+ * it does not: Stop fires once per turn, AFTER the answer, so it never
+ * interrupts what the user was reading — and at session open the background
+ * scan may not have produced the finding yet.
+ *
+ * Every failure is swallowed. A courtesy message must never be the reason a
+ * hook misbehaves, and the finding is on disk either way.
+ */
+function attachLeakNotice(
+  eventType: string,
+  cli: IntegrationType | undefined,
+  outcome: HookEventOutcome,
+): HookEventOutcome {
+  try {
+    if (!canDeliverNotice(cli)) return outcome;
+    // canDeliverNotice() above already proved cli is set; narrow for the call.
+    if (!cli) return outcome;
+    const canonical = canonicalizeEventType(eventType, cli);
+    if (canonical !== "Stop" && canonical !== "SessionStart") return outcome;
+
+    const pending = pendingLeakNotice();
+    if (pending.count === 0) return outcome;
+
+    const shaped = shapeNotice(cli, leakNoticeText(pending.count), outcome.stdout);
+    if (shaped.stdout === outcome.stdout && !shaped.stderr) return outcome;
+
+    // Claimed only once the notice is actually on the stream, so a crash
+    // between the two re-notifies rather than silently swallowing the alert.
+    markLeakNoticeDelivered(pending.ids);
+    return {
+      exitCode: outcome.exitCode,
+      stdout: shaped.stdout,
+      stderr: outcome.stderr + shaped.stderr,
+    };
+  } catch {
+    return outcome;
+  }
+}
+
 export interface EvaluateHookEventOptions {
   /**
    * Await pending telemetry POSTs before returning. Defaults to `true`,
@@ -757,7 +801,21 @@ export async function evaluateHookEvent(
       }
     }
 
-    return { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr };
+    // Attach a pending leak notice, if this event is one that can carry it.
+    //
+    // Emitted HERE rather than in `handleHookEvent`, which is what fixes the
+    // bug this replaced: `bin/failproofai.mjs`'s `isDaemonConfigured()` branch
+    // writes `result.stdout`/`result.stderr` and EXITS INSIDE THAT BRANCH — it
+    // never falls through to `handleHookEvent`. Setup requires the daemon, so
+    // the previous notice was dead code on every configured machine, and had
+    // been since it shipped. Both paths return this object, so producing the
+    // notice here reaches both with no change to either caller.
+    const withNotice = attachLeakNotice(eventType, cli, {
+      exitCode: result.exitCode,
+      stdout: result.stdout,
+      stderr: result.stderr,
+    });
+    return withNotice;
   } finally {
     if (opts?.awaitTelemetryFlush ?? true) {
       // Await any un-awaited (`void trackHookEvent(...)`) events fired during

package/src/hooks/integrations.ts

@@ -828,7 +828,7 @@ function buildOpenCodePluginShim(binaryPath: string, scope: HookScope): string {
 // Re-generate via: failproofai policies --install --cli opencode
 // Plugin shim that bridges OpenCode's plugin API to the failproofai binary.
 // See: https://opencode.ai/docs/plugins/
-import { spawnSync } from "node:child_process";
+import { spawn } from "node:child_process";
 
 // Map opencode bus-event types → canonical failproofai event names.
 // (The binary sees PascalCase — the binary's --cli=opencode flag is for
@@ -891,18 +891,52 @@ function canonicalizeToolInput(canonicalToolName, args) {
 const FAILPROOFAI_BIN = ${escapedBin};
 const USE_NPX = ${useNpx};
 
-function runFailproofai(eventName, payload, directory) {
+/**
+ * Run failproofai for one event WITHOUT blocking opencode's event loop.
+ *
+ * This was spawnSync, and opencode loads the plugin in-process in the TUI —
+ * so every hook froze rendering and input for the subprocess's full duration,
+ * with a 60s ceiling. The verdicts are unchanged: every caller already awaits
+ * applyDecision, so the deny still lands before the tool runs. What changes
+ * is that the wait is now a promise rather than a blocked thread, and the TUI
+ * keeps painting while it happens.
+ *
+ * Fail-open on spawn error, and on the timeout — a policy that never ran must
+ * not read as a deny.
+ */
+async function runFailproofai(eventName, payload, directory) {
   const cmd = USE_NPX ? "npx" : FAILPROOFAI_BIN;
   const args = USE_NPX
     ? ["-y", "failproofai", "--hook", eventName, "--cli", "opencode"]
     : ["--hook", eventName, "--cli", "opencode"];
-  const r = spawnSync(cmd, args, {
-    input: JSON.stringify(payload),
-    encoding: "utf8",
-    timeout: 60_000,
-    cwd: directory,
+  return await new Promise((resolveRun) => {
+    let child;
+    try {
+      child = spawn(cmd, args, { cwd: directory });
+    } catch {
+      resolveRun({ exitCode: 0, stdout: "", stderr: "" });
+      return;
+    }
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const finish = (exitCode) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolveRun({ exitCode, stdout, stderr });
+    };
+    const timer = setTimeout(() => {
+      try { child.kill("SIGKILL"); } catch { /* already gone */ }
+      finish(0);
+    }, 60_000);
+    child.stdout.on("data", (d) => { stdout += d; });
+    child.stderr.on("data", (d) => { stderr += d; });
+    child.on("error", () => finish(0));
+    child.on("close", (code) => finish(code ?? 0));
+    child.stdin.on("error", () => {});
+    child.stdin.end(JSON.stringify(payload));
   });
-  return { exitCode: r.status ?? 0, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
 }
 
 async function applyDecision(result, ctx, eventName) {
@@ -967,7 +1001,7 @@ export default async function failproofaiPlugin({ client, directory }) {
           }
         }
         if (!prompt) prompt = (info.text || info.content || props.text || "").toString();
-        const r = runFailproofai("UserPromptSubmit", {
+        const r = await runFailproofai("UserPromptSubmit", {
           session_id: sessionID, cwd: directory, hook_event_name: "UserPromptSubmit", prompt,
         }, directory);
         await applyDecision(r, { client, sessionID }, "UserPromptSubmit");
@@ -978,7 +1012,7 @@ export default async function failproofaiPlugin({ client, directory }) {
       if (!claudeEvent) return;
       const props = event.properties || {};
       const sessionID = props.sessionID || (props.session && props.session.id) || props.id;
-      const r = runFailproofai(claudeEvent, {
+      const r = await runFailproofai(claudeEvent, {
         session_id: sessionID, cwd: directory, hook_event_name: claudeEvent,
       }, directory);
       await applyDecision(r, { client, sessionID }, claudeEvent);
@@ -987,7 +1021,7 @@ export default async function failproofaiPlugin({ client, directory }) {
     // First-class PreToolUse hook. Note: tool args live on output.args (mutable).
     "tool.execute.before": async (input, output) => {
       const canonicalTool = canonicalizeTool(input.tool);
-      const r = runFailproofai("PreToolUse", {
+      const r = await runFailproofai("PreToolUse", {
         session_id: input.sessionID,
         cwd: directory,
         tool_name: canonicalTool,
@@ -1000,7 +1034,7 @@ export default async function failproofaiPlugin({ client, directory }) {
     // First-class PostToolUse hook. Note: tool args live on input.args here.
     "tool.execute.after": async (input, output) => {
       const canonicalTool = canonicalizeTool(input.tool);
-      const r = runFailproofai("PostToolUse", {
+      const r = await runFailproofai("PostToolUse", {
         session_id: input.sessionID,
         cwd: directory,
         tool_name: canonicalTool,
@@ -1014,7 +1048,7 @@ export default async function failproofaiPlugin({ client, directory }) {
     // Cleaner deny UX for prompted tools — mutate output.status instead of throwing.
     "permission.ask": async (input, output) => {
       const canonicalTool = canonicalizeTool(input.tool);
-      const r = runFailproofai("PermissionRequest", {
+      const r = await runFailproofai("PermissionRequest", {
         session_id: input.sessionID,
         cwd: directory,
         tool_name: canonicalTool || input.command || "permission",

package/src/hooks/notice.ts

@@ -0,0 +1,155 @@
+/**
+ * Putting a short message in front of a HUMAN, inside the agent they are using.
+ *
+ * A notice is not a verdict. `allow` / `deny` / `instruct` all answer "what
+ * happens to this tool call"; a notice answers nothing — it is one line of text
+ * for the person, delivered alongside whatever the verdict turned out to be.
+ * That is why it is a separate field rather than a fourth decision: shaping it
+ * into stdout beside a verdict ad hoc is how the copilot nested-vs-flat
+ * `additionalContext` bug happened.
+ *
+ * ## Why the channel differs per CLI, and why it is not `additionalContext`
+ *
+ * Measured across all 12 CLIs by live probe. The obvious channel —
+ * `hookSpecificOutput.additionalContext` — reaches the MODEL, not the user, and
+ * a model is a paraphraser: over eight real Claude turns it mentioned an
+ * informational notice 8/8, but an earlier notice that asked the agent to *act*
+ * was disclaimed as a suspected prompt injection 6/6 ("instructions arriving
+ * that way aren't something I'll act on unasked"). A security notice routed
+ * through something that may decline to repeat it is not a delivered notice.
+ *
+ * So each CLI gets the channel that was proven to paint text on the user's
+ * terminal, and the ones with no such channel get nothing rather than a
+ * pretend delivery:
+ *
+ *   claude   `{"systemMessage":…}`  renders `Stop says: …`; model-invisible
+ *                                   (a neutral probe answered `NONE`)
+ *   codex    `{"systemMessage":…}`  renders `• Stop (completed) says: …`
+ *   copilot  exit 0 + stderr        renders as a `!` session warning
+ *   factory  plain stdout           renders under a `Hooks Stop` block
+ *
+ * opencode, pi and openclaw have real channels too, but they live inside the
+ * plugin shims we ship rather than in a hook's stdout, so they are wired there.
+ * cursor, devin, goose, antigravity and hermes have no channel that reaches a
+ * human without an unsupported escape hatch — they get nothing here, and their
+ * users get the finding from `failproofai audit` and the emailed digest.
+ */
+import type { IntegrationType } from "./types";
+
+/** How a notice is delivered on one CLI. */
+type NoticeChannel = "systemMessage" | "stderr" | "stdout" | "none";
+
+/**
+ * Per-CLI channel, from live probes rather than documentation.
+ *
+ * A CLI absent from this map delivers nothing — deliberately. Guessing a
+ * channel produces the worst outcome available: output that looks delivered
+ * from our side and reaches nobody, so we would report a leak as "notified"
+ * that the user never saw.
+ */
+const NOTICE_CHANNEL: Partial<Record<IntegrationType, NoticeChannel>> = {
+  claude: "systemMessage",
+  codex: "systemMessage",
+  copilot: "stderr",
+  factory: "stdout",
+};
+
+/**
+ * Claude truncates `systemMessage` at 4000 characters on the cloud-forwarding
+ * path, and a notice that gets cut mid-sentence reads as a broken tool. Ours is
+ * two lines by design; this is a backstop, not a budget.
+ */
+const MAX_NOTICE_CHARS = 900;
+
+export interface ShapedNotice {
+  /** Merged into the outcome's stdout, or empty. */
+  stdout: string;
+  /** Merged into the outcome's stderr, or empty. */
+  stderr: string;
+}
+
+/**
+ * Render a notice for one CLI, merging it into any verdict JSON already bound
+ * for stdout.
+ *
+ * `existingStdout` matters: a Stop-gate deny already emits a JSON object on
+ * several CLIs, and emitting a second object would produce two JSON documents
+ * on one stream — which every host parses as a syntax error and drops, taking
+ * the deny with it. So the notice is merged INTO that object when there is one.
+ */
+export function shapeNotice(
+  cli: IntegrationType | undefined,
+  notice: string,
+  existingStdout = "",
+): ShapedNotice {
+  const empty: ShapedNotice = { stdout: existingStdout, stderr: "" };
+  if (!notice.trim() || !cli) return empty;
+
+  const channel = NOTICE_CHANNEL[cli] ?? "none";
+  const text = notice.length > MAX_NOTICE_CHARS
+    ? notice.slice(0, MAX_NOTICE_CHARS - 1) + "…"
+    : notice;
+
+  switch (channel) {
+    case "systemMessage": {
+      // Merge into the verdict object when one exists, so the stream stays a
+      // single JSON document.
+      if (existingStdout.trim().startsWith("{")) {
+        try {
+          const parsed = JSON.parse(existingStdout) as Record<string, unknown>;
+          parsed.systemMessage = text;
+          return { stdout: JSON.stringify(parsed), stderr: "" };
+        } catch {
+          // Not the JSON we thought it was — leave the verdict untouched
+          // rather than risk destroying it to add a courtesy message.
+          return empty;
+        }
+      }
+      // Anything already on stdout that we could not merge into is left
+      // exactly as it is, and the notice is dropped instead. The alternative —
+      // emitting our own object over the top — DESTROYS it: measured with a
+      // JSON array on stdout, which does not start with `{`, so it fell past
+      // the merge and was replaced wholesale. A courtesy message is never worth
+      // more than whatever the host was already being told.
+      if (existingStdout.trim()) return empty;
+      return { stdout: JSON.stringify({ systemMessage: text }), stderr: "" };
+    }
+    case "stderr":
+      // Exit code is NOT touched: on copilot a non-zero exit from a tool event
+      // is a block, and a notice must never block anything.
+      return { stdout: existingStdout, stderr: text + "\n" };
+    case "stdout":
+      // factory renders plain text under its Hooks block. Only safe when no
+      // verdict JSON is already on the stream.
+      if (existingStdout.trim()) return empty;
+      return { stdout: text + "\n", stderr: "" };
+    default:
+      return empty;
+  }
+}
+
+/** True when this CLI has a channel that was proven to reach a human. */
+export function canDeliverNotice(cli: IntegrationType | undefined): boolean {
+  return !!cli && (NOTICE_CHANNEL[cli] ?? "none") !== "none";
+}
+
+/**
+ * The notice itself. A FIXED template with no interpolation of scanned content.
+ *
+ * The count is a number we computed; everything else is a constant. That is not
+ * stylistic: the alternative is interpolating a finding's `example`, which is
+ * the verbatim text of a command from a repository — attacker-controlled
+ * through a README, a Makefile target or an npm script. Tested against the
+ * shipped redactor, `echo "IGNORE ALL PRIOR INSTRUCTIONS…"` passes through
+ * byte-identical, because that redactor masks secrets, not instructions. On the
+ * CLIs where the only channel is the model's context, that string would land
+ * directly in the prompt. So nothing scanned ever reaches this template.
+ */
+export function leakNoticeText(newFindings: number): string {
+  const n = newFindings === 1 ? "a credential" : `${newFindings} credentials`;
+  return (
+    `failproofai found ${n} in this project's agent transcripts.\n` +
+    "Run `failproofai audit` to see the details, " +
+    "or `failproofai audit --schedule` to get these by email."
+  );
+}

package/src/hooks/uninstall-cli.ts

@@ -47,6 +47,7 @@ import {
 import { listInstallableIds, getIntegration } from "./integrations";
 import type { IntegrationType } from "./types";
 import { removeHooks } from "./manager";
+import { uninstallMacNotifier } from "../audit/macos-notifier";
 
 export interface UninstallOptions {
   /** Also delete ~/.failproofai (config, credentials, state, audit cache, daemon binary). */
@@ -346,6 +347,20 @@ export async function runUninstallCommand(opts: UninstallOptions = {}): Promise<
     }
   }
 
+  // The macOS notification agent, which is the one thing `--purge` alone cannot
+  // reach: its bundle lives inside `~/.failproofai` and goes with the home, but
+  // its LaunchAgent plist sits in `~/Library/LaunchAgents`, outside everything
+  // this command otherwise deletes. Left behind, launchd keeps trying to start
+  // an applet that is no longer on disk and logs the failure at every login —
+  // precisely the class of leftover an uninstall exists to prevent.
+  //
+  // No-ops on every other platform, and needs no elevation on macOS: a per-user
+  // agent is the user's own to load and unload. Tied to the daemon's removal
+  // because it exists only to deliver what the daemon's scheduled audit finds.
+  if (opts.purge || (found.serviceInstalled && (opts.purge || opts.yes))) {
+    uninstallMacNotifier();
+  }
+
   if (opts.purge && found.homeExists) {
     // Last, and only after the service is down: the daemon binary and its
     // socket live here, and deleting them out from under a running unit is how

package/.next/standalone/.next/server/chunks/ssr/[root-of-the-server]__1b5jzxr._.js

@@ -1,3 +0,0 @@
-module.exports=[18622,(a,b,c)=>{b.exports=a.x("next/dist/compiled/next-server/app-page-turbo.runtime.prod.js",()=>require("next/dist/compiled/next-server/app-page-turbo.runtime.prod.js"))},20635,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/action-async-storage.external.js",()=>require("next/dist/server/app-render/action-async-storage.external.js"))},24725,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/after-task-async-storage.external.js",()=>require("next/dist/server/app-render/after-task-async-storage.external.js"))},43285,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/dynamic-access-async-storage.external.js",()=>require("next/dist/server/app-render/dynamic-access-async-storage.external.js"))},56704,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/work-async-storage.external.js",()=>require("next/dist/server/app-render/work-async-storage.external.js"))},32319,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/work-unit-async-storage.external.js",()=>require("next/dist/server/app-render/work-unit-async-storage.external.js"))},59043,(a,b,c)=>{b.exports=a.x("next/dist/server/runtime-reacts.external.js",()=>require("next/dist/server/runtime-reacts.external.js"))},31677,a=>{"use strict";var b=a.i(5050);let c=(0,b.createServerReference)("0021127018a217bb03f53322147dee0b96bd0077f2",b.callServer,void 0,b.findSourceMapURL,"getTelemetryConfig");a.s(["getTelemetryConfig",0,c])},3171,a=>{"use strict";var b=a.i(87924),c=a.i(72131),d=a.i(31677),e=a.i(66036);a.s(["default",0,function({error:a,reset:f}){return(0,c.useEffect)(()=>{(0,d.getTelemetryConfig)().then(b=>{(0,e.setClientTelemetryConfig)(b),(0,e.captureClientEvent)("client_error",{error_message:a.message,error_name:a.name,error_digest:a.digest,boundary:"global"})}).catch(()=>{})},[a]),(0,b.jsx)("html",{children:(0,b.jsx)("body",{children:(0,b.jsx)("main",{style:{minHeight:"100vh",display:"flex",alignItems:"center",justifyContent:"center",background:"#031035",color:"#f8fafc",fontFamily:"system-ui, sans-serif"},children:(0,b.jsxs)("div",{style:{textAlign:"center",padding:"2rem",border:"1px solid rgba(239,68,68,0.4)",borderRadius:"0.5rem",maxWidth:"500px"},children:[(0,b.jsx)("h2",{style:{color:"#ef4444",marginBottom:"0.5rem",fontSize:"1.25rem"},children:"Something went wrong"}),(0,b.jsx)("p",{style:{color:"#94a3b8",marginBottom:"1.5rem"},children:a.message||"An unexpected error occurred."}),(0,b.jsx)("button",{onClick:f,style:{padding:"0.5rem 1.25rem",background:"#3b82f6",color:"white",border:"none",borderRadius:"0.375rem",cursor:"pointer",fontSize:"0.875rem"},children:"Try again"})]})})})})}])},66036,a=>{"use strict";a.s(["captureClientEvent",0,function(a,b){},"setClientTelemetryConfig",0,function(a){}])},46058,(a,b,c)=>{"use strict";function d(a){if("function"!=typeof WeakMap)return null;var b=new WeakMap,c=new WeakMap;return(d=function(a){return a?c:b})(a)}c._=function(a,b){if(!b&&a&&a.__esModule)return a;if(null===a||"object"!=typeof a&&"function"!=typeof a)return{default:a};var c=d(b);if(c&&c.has(a))return c.get(a);var e={__proto__:null},f=Object.defineProperty&&Object.getOwnPropertyDescriptor;for(var g in a)if("default"!==g&&Object.prototype.hasOwnProperty.call(a,g)){var h=f?Object.getOwnPropertyDescriptor(a,g):null;h&&(h.get||h.set)?Object.defineProperty(e,g,h):e[g]=a[g]}return e.default=a,c&&c.set(a,e),e}},5050,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={callServer:function(){return f.callServer},createServerReference:function(){return h.createServerReference},findSourceMapURL:function(){return g.findSourceMapURL}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f=a.r(20611),g=a.r(1722),h=a.r(38783)},20611,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"callServer",{enumerable:!0,get:function(){return g}});let d=a.r(72131),e=a.r(88347),f=a.r(90841);async function g(a,b){return new Promise((c,g)=>{(0,d.startTransition)(()=>{(0,f.dispatchAppRouterAction)({type:e.ACTION_SERVER_ACTION,actionId:a,actionArgs:b,resolve:c,reject:g})})})}("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},1722,(a,b,c)=>{"use strict";let d;Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"findSourceMapURL",{enumerable:!0,get:function(){return d}});("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},88347,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d,e,f={ACTION_HMR_REFRESH:function(){return l},ACTION_NAVIGATE:function(){return i},ACTION_REFRESH:function(){return h},ACTION_RESTORE:function(){return j},ACTION_SERVER_ACTION:function(){return m},ACTION_SERVER_PATCH:function(){return k},PrefetchKind:function(){return n},ScrollBehavior:function(){return o}};for(var g in f)Object.defineProperty(c,g,{enumerable:!0,get:f[g]});let h="refresh",i="navigate",j="restore",k="server-patch",l="hmr-refresh",m="server-action";var n=((d={}).AUTO="auto",d.FULL="full",d),o=((e={})[e.Default=0]="Default",e[e.NoScroll=1]="NoScroll",e);("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},90841,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={dispatchAppRouterAction:function(){return i},dispatchGestureState:function(){return j},refreshOnInstantNavigationUnlock:function(){return h},useActionQueue:function(){return k}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f=a.r(46058)._(a.r(72131)),g=a.r(67009);a.r(88347);function h(){}function i(a){!0;throw Object.defineProperty(Error("Internal Next.js error: Router action dispatched before initialization."),"__NEXT_ERROR_CODE",{value:"E668",enumerable:!1,configurable:!0})}function j(a){!0;throw Object.defineProperty(Error("Internal Next.js error: Router action dispatched before initialization."),"__NEXT_ERROR_CODE",{value:"E668",enumerable:!1,configurable:!0})}function k(a){let[b,c]=f.default.useState(a.state),[d,e]=(0,f.useOptimistic)(b),h=(0,f.useMemo)(()=>d,[d]);return(0,g.isThenable)(h)?(0,f.use)(h):h}("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},42602,(a,b,c)=>{"use strict";b.exports=a.r(18622)},9270,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored.contexts.AppRouterContext},36313,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored.contexts.HooksClientContext},18341,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored.contexts.ServerInsertedHtml},35112,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored["react-ssr"].ReactDOM},87924,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored["react-ssr"].ReactJsxRuntime},38783,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored["react-ssr"].ReactServerDOMTurbopackClient},72131,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored["react-ssr"].React},67009,(a,b,c)=>{"use strict";function d(a){return null!==a&&"object"==typeof a&&"then"in a&&"function"==typeof a.then}Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"isThenable",{enumerable:!0,get:function(){return d}})}];
-
-//# sourceMappingURL=%5Broot-of-the-server%5D__1b5jzxr._.js.map