failproofai 1.0.4-beta.1 → 1.0.4-beta.2

package/src/hooks/builtin-policies.ts

@@ -16,12 +16,6 @@ import { POLICY_CATALOG } from "./policy-catalog";
 import { allow, deny, instruct } from "./policy-helpers";
 import { normalizePolicyName, registerPolicy } from "./policy-registry";
 import { hookLogWarn } from "./hook-logger";
-import {
-  ENV_FILE_PATH_RE,
-  SECRET_FILE_RE,
-  SECRET_FILE_ID_RSA_RE,
-  SECRET_FILE_CREDENTIALS_RE,
-} from "./risk-patterns";
 
 /**
  * Whether `resolved` lives under an agent CLI's home directory
@@ -132,15 +126,80 @@ const JWT_RE = /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/;
 
 // sanitizeApiKeys
 const API_KEY_PATTERNS: Array<[RegExp, string]> = [
+  // ── Anthropic ── prefix doc-verified: platform.claude.com says a key
+  // "starts with `sk-ant-`" and its own example is `sk-ant-api03-...`.
+  [/sk-ant-api03-[A-Za-z0-9\-_]{20,}/, "Anthropic API key"],
+  // Minted by the Claude CLI's OAuth flow and billed against a Pro/Max
+  // subscription rather than the API account — a different thing to revoke.
+  [/sk-ant-oat01-[A-Za-z0-9\-_]{20,}/, "Anthropic OAuth token"],
   [/sk-ant-[A-Za-z0-9\-_]{20,}/, "Anthropic API key"],
+
+  // ── OpenAI ── the body charset EXCLUDES `-` and `_` on purpose: with them,
+  // this rule's run would bridge the hyphen in `sk-proj-` and report every
+  // project key a second time under the wrong label.
   [/sk-proj-[A-Za-z0-9\-_]{20,}/, "OpenAI project API key"],
-  [/sk-[A-Za-z0-9]{20,}/, "OpenAI API key"],
-  [/ghp_[A-Za-z0-9]{36}/, "GitHub personal access token"],
+  [/sk-svcacct-[A-Za-z0-9\-_]{20,}/, "OpenAI service-account key"],
+  // Highest blast radius in the family: it authenticates the organisation
+  // admin surface, and lives at a DIFFERENT console from the other keys.
+  [/sk-admin-[A-Za-z0-9\-_]{20,}/, "OpenAI admin key"],
+
+  // ── OpenAI-compatible gateways ──
+  [/sk-or-v1-[A-Za-z0-9\-_]{20,}/, "OpenRouter API key"],
+  // A BARE `sk-` CANNOT BE ATTRIBUTED, and calling it OpenAI is what this rule
+  // used to do. LiteLLM's own docs say its virtual keys "must start with sk-",
+  // and DeepSeek plus every other OpenAI-compatible proxy mints the same shape
+  // — so on a machine running a gateway (this one does) the old label sent the
+  // user to the wrong console to revoke a key that was never OpenAI's. The
+  // honest label names the family, not a vendor.
+  [/sk-[A-Za-z0-9]{20,}/, "OpenAI-compatible key (issuer unknown)"],
+
+  // ── GitHub ── all five documented types. github.blog's token-format post
+  // names ghp/gho/ghu/ghs/ghr; only two of them shipped before.
   [/github_pat_[A-Za-z0-9_]{82}/, "GitHub fine-grained token"],
+  [/ghp_[A-Za-z0-9]{36}/, "GitHub personal access token"],
+  [/gho_[A-Za-z0-9]{36}/, "GitHub OAuth token"],
+  [/ghu_[A-Za-z0-9]{36}/, "GitHub user-to-server token"],
+  [/ghs_[A-Za-z0-9]{36}/, "GitHub server-to-server token"],
+  [/ghr_[A-Za-z0-9]{36}/, "GitHub refresh token"],
+  [/glpat-[A-Za-z0-9\-_]{20,}/, "GitLab personal access token"],
+
+  // ── AWS ── the ID is the PUBLIC half; the paired 40-char secret is the
+  // credential. Reported anyway because an exposed ID names the account and is
+  // what a user searches their console for. `ASIA` (temporary STS) was missing.
   [/AKIA[A-Z0-9]{16}/, "AWS access key ID"],
+  [/ASIA[A-Z0-9]{16}/, "AWS temporary access key ID"],
+
+  // ── Payments ── Stripe documents `pk_*` as "Safe to expose: Yes", so only
+  // the secret and restricted halves appear here.
   [/sk_live_[A-Za-z0-9]{24,}/, "Stripe live secret key"],
   [/sk_test_[A-Za-z0-9]{24,}/, "Stripe test secret key"],
+  [/rk_live_[A-Za-z0-9]{24,}/, "Stripe restricted key"],
+
+  // ── Google ── `AIza` also covers Firebase Web and Maps browser keys, which
+  // are public by design, so the label stays non-committal about severity.
   [/AIza[0-9A-Za-z\-_]{35}/, "Google API key"],
+
+  // ── Messaging ── the Telegram bot token was matched by ZERO of the shipped
+  // patterns and was found only because a phone-number regex tripped over it;
+  // two live-looking ones sit in this machine's corpus right now. Slack's
+  // prefixes were in the Rust collector but not here — one of nine such
+  // divergences between the two engines.
+  [/\d{8,10}:[A-Za-z0-9_-]{35}/, "Telegram bot token"],
+  [/xox[baprs]-[A-Za-z0-9-]{10,}/, "Slack token"],
+  [/xapp-[0-9]-[A-Za-z0-9-]{10,}/, "Slack app-level token"],
+
+  // ── Model hosts ──
+  [/hf_[A-Za-z0-9]{30,}/, "Hugging Face token"],
+  [/gsk_[A-Za-z0-9]{40,}/, "Groq API key"],
+  [/r8_[A-Za-z0-9]{30,}/, "Replicate token"],
+  [/xai-[A-Za-z0-9]{40,}/, "xAI API key"],
+
+  // ── Registries ──
+  [/npm_[A-Za-z0-9]{36}/, "npm access token"],
+  [/dop_v1_[a-f0-9]{64}/, "DigitalOcean token"],
+  [/shpat_[a-fA-F0-9]{32}/, "Shopify access token"],
+  [/sb_secret_[A-Za-z0-9\-_]{20,}/, "Supabase secret key"],
+  [/sbp_[a-f0-9]{40}/, "Supabase personal token"],
 ];
 
 // sanitizeConnectionStrings
@@ -198,6 +257,7 @@ const DOTNET_GETENV_RE = /\[Environment\]::GetEnvironment/i;
 const CMD_ECHO_ENV_RE = /echo\s+%[A-Za-z_]/i;
 
 // blockEnvFiles
+const ENV_FILE_PATH_RE = /(?:^|[\\/])\.env(?:\.|$)/;
 const ENV_CMD_RE = /\.env(?:\b|\s|$|\.)/;
 
 // blockSudo
@@ -449,6 +509,9 @@ const SHORT_FLAG_BUNDLE_RE = /^-[a-zA-Z]*f[a-zA-Z]*$/;
 const SAFE_FORCE_PREFIXES = ["--force-with-lease", "--force-if-includes"] as const;
 
 // blockSecretsWrite
+const SECRET_FILE_RE = /\.(?:pem|key)$/;
+const SECRET_FILE_ID_RSA_RE = /id_rsa/;
+const SECRET_FILE_CREDENTIALS_RE = /credentials/;
 
 // blockWorkOnMain
 const GIT_COMMIT_MERGE_RE = /git\s+(commit|merge|rebase|cherry-pick)\b/;

package/src/hooks/configure-wizard.ts

@@ -74,6 +74,7 @@ import {
   probeDaemonEndToEnd,
   uninstallDaemonService,
 } from "./daemon-service";
+import { installMacNotifier } from "../audit/macos-notifier";
 import { hookLogWarn } from "./hook-logger";
 import {
   readCloudCredentials,
@@ -1442,6 +1443,25 @@ export async function runConfigureWizard(
     // longer referenced by anything. Keeps the previous version for an
     // offline rollback.
     pruneOldDaemonBinaries();
+
+    // The delivery path for what the scheduled audit finds. macOS only, and a
+    // no-op everywhere else: a Linux box's audit talks to the session bus
+    // itself, while on a Mac the daemon runs outside the GUI session and cannot
+    // reach Notification Center at all — see `audit/macos-notifier.ts`.
+    //
+    // Installed here, with the daemon, because it exists only to deliver what
+    // the daemon's scheduled scan produces, and removed alongside it by
+    // `uninstall`. Silent, and not a step in the wizard: it needs no password,
+    // asks nothing, and narrating it would be an apology for the delivery half
+    // of a feature the user just switched on. What they are actually asked —
+    // does this machine scan, and may it interrupt — are real settings, and
+    // both are theirs to change afterwards.
+    //
+    // Its failure is not the wizard's failure. A Mac where `osacompile` is
+    // missing or launchd refuses the job must still finish installing its
+    // daemon, its hooks and its policies, which are the parts that enforce
+    // anything; the notice in-CLI still reaches them either way.
+    installMacNotifier();
   }
 
   // Telemetry runs concurrently with the install (never rejects, 5s-bounded) so

package/src/hooks/enforcement-capability.ts

@@ -253,103 +253,6 @@ export const ENFORCEMENT_CAPABILITY: Record<
     // the policy-evaluator comment both claim "Goose has NO Stop event"; that is
     // false at v1.43.0 (agent.rs:1956, :2840 emit_stop_hook_blocking).
   },
-
-  // grok 1.0.3 (1a29d5bc12). Every "block" row below was proven by a live
-  // probe, not read from grok's hooks doc — which is also where two of the
-  // three surprises came from (see types.ts): the doc's own tool name for the
-  // shell tool disagrees with the wire, and nothing documents that project
-  // hooks need a git repo. grok's capability advertisement corroborates the
-  // blocking set: its ACP initialize response carries
-  //   x.ai/hooks: {blockingEvents:["pre_tool_use","stop","subagent_stop"],
-  //                decisions:["deny","block"], stopSignals:[…]}
-  // — exactly the three rows marked "block" here.
-  grok: {
-    PreToolUse: "block",           // VERIFIED live: {decision:"deny",reason} blocked `echo` and beat --yolo (permissionMode bypassPermissions); Claude's hookSpecificOutput shape did NOT block (A/B on the same hook)
-    Stop: "block",                 // VERIFIED live: {decision:"block",reason} forced another turn — the agent ran the required command, then stopped. ONLY on reason==="end_turn"; the session-shutdown fire is parsed and discarded upstream. Cap: 8 continuations/turn
-    SubagentStop: "block",         // advertised in x.ai/hooks blockingEvents; not exercised by a probe
-    UserPromptSubmit: "observe",   // fired live; not in blockingEvents
-    PostToolUse: "observe",        // fired live; post-hoc, and not in blockingEvents
-    PostToolUseFailure: "observe",
-    SessionStart: "observe",       // fired live
-    SessionEnd: "observe",         // fired live
-    // The six below are the widened set. All OBSERVE by construction, not by
-    // caution: blockingEvents lists exactly three events, so grok cannot honour
-    // a deny on any of these no matter what we send.
-    StopFailure: "observe",        // VERIFIED firing (a 429 turn): {error:"rate_limit", errorDetails, lastAssistantMessage}
-    Notification: "observe",       // VERIFIED firing: notificationType "agent_error" — a type grok's own docs do not list
-    PermissionDenied: "observe",   // config key accepted (count=14); firing not exercised — needs a real permission denial
-    SubagentStart: "observe",      // config key accepted; firing not exercised — needs a subagent
-    PreCompact: "observe",         // config key accepted; firing not exercised — needs compaction
-    PostCompact: "observe",        // config key accepted; firing not exercised — needs compaction
-  },
-
-  // qwen-code 0.21.12. A near-pure Claude clone on the wire, so most rows
-  // inherit Claude's semantics — but only the two proven ones are "block".
-  qwen: {
-    PreToolUse: "block",           // VERIFIED live: hookSpecificOutput.permissionDecision:"deny" blocked run_shell_command and beat -y (yolo); reason reached the model verbatim. ("ask" degrades to deny in headless and background subagents)
-    Stop: "block",                 // VERIFIED live: top-level {decision:"block",reason} forced another turn. NOTE stop_hook_active is true on the FIRST fire, so it is not a usable loop guard here
-    UserPromptSubmit: "observe",   // docs accept a decision, unverified — and it fires per MODEL INVOCATION (4× in one observed turn), so treat as observation until probed
-    PostToolUse: "observe",        // docs accept `decision`, unverified; post-hoc regardless
-    PostToolUseFailure: "observe",
-    PermissionRequest: "observe",
-    PermissionDenied: "observe",
-    SubagentStart: "observe",
-    SubagentStop: "observe",       // sibling of Stop upstream, but not probed — left honest rather than assumed
-    PreCompact: "observe",
-    SessionStart: "observe",       // fired live
-    SessionEnd: "observe",
-    // Widened set. Every one has a real executeHooks() dispatch site in the
-    // shipped bundle; the three marked VERIFIED were also observed firing.
-    TaskCreated: "block",          // qwen's TodoCreated. VERIFIED firing ×4 with phase:"validation", where upstream docs state a {decision:"block"} PREVENTS the write and returns the reason to the model
-    TaskCompleted: "block",        // qwen's TodoCompleted. VERIFIED firing ×4, same validation-phase contract
-    InstructionsLoaded: "observe", // VERIFIED firing: {file_path, memory_type, load_reason}
-    Notification: "observe",       // VERIFIED firing: notification_type "auth_success"
-    StopFailure: "observe",        // upstream documents it fire-and-forget — output and exit code ignored
-    PostCompact: "observe",
-    UserPromptExpansion: "observe",
-  },
-
-  // ── ori ───────────────────────────────────────────────────────────────────
-  // ori 0.12.0+68f9a36, probed LIVE against the built-in `@ori-runloop/
-  // agent-loop` harness driving nvidia/nemotron-3.5-lightning:free. Enforcement
-  // is the `approval-asker` / `unattended-approvals` extension points rather
-  // than a hook-event stream, so PreToolUse is the only row there can be: ori
-  // exposes no prompt-submit, post-tool, session or stop gate to subscribe to.
-  ori: {
-    PreToolUse: "block",           // LIVE: {outcome:"deny"} from our approval-asker provision turned 3 tool.started into 3 tool.failed with ZERO tool.succeeded, and ori held the deny across the model's retries. MODE-GATED — read the note below before quoting this row
-    // DELIBERATELY NO OTHER ROWS. Two things this table cannot express, both
-    // verified live and both load-bearing:
-    //   1. ori's approval mode defaults to `self-drive`, and in that mode the
-    //      DYNAMIC points are never called — so no deny is ever PRODUCED, and
-    //      the row above never gets a chance to apply. Isolated three ways: no
-    //      callback under self-drive; still none after claiming approval-policy
-    //      with defaultAction:"ask"; but defaultAction:"reject" DID block every
-    //      call, which proves the static point is wired and that self-drive
-    //      skips specifically the dynamic asker. Coverage therefore requires
-    //      `--approvals manual` (or /approvals in the TUI).
-    //   2. There is no Stop event at all, so the 5 require-*-before-stop
-    //      builtins are INAPPLICABLE on ori, exactly as on Hermes and Goose.
-  },
-
-  // ── cline ─────────────────────────────────────────────────────────────────
-  // cline v3.0.60. Its hooks are event-NAMED scripts under a hooks directory,
-  // and THE EXIT CODE IS IGNORED on every event — so every row here is a claim
-  // about a stdout SHAPE, never about exit 2. cline's verdict schema has no
-  // `decision` / `block` / `permissionDecision` field at all, which is why every
-  // generic branch in policy-evaluator.ts is inert for it.
-  cline: {
-    PreToolUse: "block",  // LIVE: {"cancel":true,"errorMessage":…} on stdout stopped a real run_commands call and the side effect never happened. CAVEAT, and it is a product decision rather than a footnote: `cancel` becomes {stop:true} -> applyStopControl THROWS ControlledStopError, ABORTING THE WHOLE RUN ("[abort] aborted by another client"), not just this tool call. A STRONGER action than a per-tool deny, not a weaker one
-    Stop: "observe",      // TaskComplete maps here, and `cancel` is NOT a force-retry channel: the task has already completed, so a cancel kills a finished run rather than re-entering the loop. The 5 require-*-before-stop builtins are INAPPLICABLE on cline, exactly as on Hermes, Goose and ori
-    // DELIBERATELY NO OTHER ROWS. PostToolUse, UserPromptSubmit, TaskStart,
-    // TaskResume, TaskCancel, TaskError and SessionShutdown ARE installed — for
-    // the audit trail and for observe-mode custom policies — but nothing has
-    // been probed showing a verdict on any of them changes what the agent does,
-    // and ABSENT MEANS UNKNOWN in this file.
-    //
-    // FAIL-OPEN across the whole surface, and unlike ori there is no
-    // failureBehavior:"deny" to inherit: a timeout (120s default), a parse
-    // failure or a spawn error makes cline SKIP the hook and run the tool.
-  },
 };
 
 /**

package/src/hooks/fp-config.ts

@@ -325,12 +325,53 @@ export interface FpConfig {
      * refresh token expiring must not silently switch off a background feature
      * somebody configured months ago.
      *
-     * OFF by default, and the asymmetry with `telemetry.enabled` above is
-     * deliberate: the audit reads the CONTENTS of every session transcript on
-     * disk — prompts, file contents, command output — so nothing scans on a
-     * timer until somebody asks for it.
+     * ON for a configured machine that has never stated an opinion, OFF for
+     * every machine we could not read an opinion from — which is not the same
+     * default twice, and the difference is the whole design.
+     *
+     * The scan reads the CONTENTS of every session transcript on disk, so the
+     * conservative instinct is to keep it off until asked. But the thing it
+     * looks for now is a leaked credential, and a credential nobody scans for
+     * is a credential nobody revokes: a switch that is off by default is a
+     * feature that, for most users, never runs. Setup is where the machine's
+     * owner is told what it does, so completing setup is the opinion.
+     *
+     * Hence the split. Once `config.json` exists AND carries an `audit` table,
+     * this is on unless it says exactly `false`. Absent file, unparseable JSON,
+     * or no `audit` table at all still read as OFF, because those are the three
+     * ways of not knowing, and "we could not tell" must never turn a transcript
+     * scan on. `crates/failproofaid/src/audit_lane.rs` makes the identical
+     * distinction over the identical bytes — the daemon and this reader must
+     * agree, or the settings page describes a machine that is doing something
+     * else.
+     *
+     * Turning it on sends NOTHING on its own: the digest is gated on
+     * `reportsConsentedAt` below, not on this switch, so a machine that flips
+     * on at upgrade scans locally and mails nobody.
      */
     auto: boolean;
+    /**
+     * Raise a desktop notification when a scan finds a credential.
+     *
+     * Separate from `auto` because they answer different questions: `auto` is
+     * whether the machine scans, this is whether it interrupts. Somebody who
+     * wants the scan and not the banner is a coherent person, and without this
+     * their only way to stop the banner is to stop the scan.
+     *
+     * ON by default, and the direction is the point: this fires at most once
+     * per distinct credential ever (`leak-notice.ts` claims each finding with
+     * an O_EXCL marker), so the volume it can reach is bounded by how many
+     * secrets are actually leaking. A silent default would make the common
+     * case — a user who never opens the dashboard and never gave an email —
+     * a machine that finds the key and tells nobody.
+     *
+     * It does NOT silence the in-CLI notice. That one appears inside a session
+     * the user is already driving, costs two lines, and is the only channel
+     * left when there is no desktop to notify — a headless box, a container, an
+     * SSH session. Turning off every channel at once is not an option this
+     * offers, because the resulting state is indistinguishable from broken.
+     */
+    notify: boolean;
     /**
      * When this machine's owner agreed that a scheduled scan may send what it
      * finds off the box, as epoch ms. Absent means they never did.
@@ -402,7 +443,9 @@ export const DEFAULT_CONFIG: FpConfig = {
     environment: "local",
   },
   telemetry: { enabled: true },
-  audit: { auto: false, intervalDays: DEFAULT_AUDIT_INTERVAL_DAYS },
+  // `auto: false` is the no-file case specifically — see the field's doc for
+  // why a machine that HAS a config reads the other way.
+  audit: { auto: false, notify: true, intervalDays: DEFAULT_AUDIT_INTERVAL_DAYS },
 };
 
 /**
@@ -495,7 +538,11 @@ export function projectConfig(parsed: Record<string, unknown>): FpConfig {
     const daemon = (parsed.daemon ?? {}) as Record<string, unknown>;
     const collector = (parsed.collector ?? {}) as Record<string, unknown>;
     const telemetry = (parsed.telemetry ?? {}) as Record<string, unknown>;
-    const audit = (parsed.audit ?? {}) as Record<string, unknown>;
+    // Presence, not just contents: `audit.auto` reads differently when the
+    // table is absent than when it is present-but-silent. See the field's doc.
+    const auditPresent =
+      !!parsed.audit && typeof parsed.audit === "object" && !Array.isArray(parsed.audit);
+    const audit = (auditPresent ? parsed.audit : {}) as Record<string, unknown>;
     return {
       // Anything unrecognised reads as `oss`. The failure direction matters: a
       // corrupt config must not be able to turn cloud reporting ON.
@@ -525,12 +572,20 @@ export function projectConfig(parsed: Record<string, unknown>): FpConfig {
       // reads as on — the shipped default, and what a config with no
       // [telemetry] block at all means.
       telemetry: { enabled: telemetry.enabled !== false },
-      // Mirror image of telemetry above: only an explicit `true` switches the
-      // scheduled scan on. Absent, misspelled, or `"yes"` all read as off,
-      // because the failure direction here is a machine that starts reading
-      // every transcript it can find on a timer nobody set.
+      // A configured machine with no stated opinion scans; a machine we could
+      // not read an opinion FROM does not. `auditPresent` is what separates
+      // them, and it is the reason this is not simply `!== false`: with no
+      // `audit` table there is no opinion to have been stated, only an absence,
+      // and an absence must not start reading every transcript on disk. Same
+      // three-way split as `audit_lane.rs`, over the same file.
       audit: {
-        auto: audit.auto === true,
+        auto: auditPresent && audit.auto !== false,
+        // Default ON, off only on an explicit `false` — a notification the user
+        // never sees is the same as no detection at all. Ungated on
+        // `auditPresent`, unlike `auto`: this is read at the moment a
+        // notification is about to fire, which means a scan already ran and the
+        // question is only whether to speak.
+        notify: audit.notify !== false,
         intervalDays: readIntervalDays(audit.interval_days),
         // A finite number or nothing. A garbage value reads as absent, which is
         // the direction that sends nothing.
@@ -584,6 +639,7 @@ const OWNED_CONFIG_KEYS: readonly (readonly string[])[] = [
   ["collector", "sources", "*", "extra_paths"],
   ["telemetry", "enabled"],
   ["audit", "auto"],
+  ["audit", "notify"],
   ["audit", "interval_days"],
   ["audit", "reports_consented_at"],
 ];
@@ -688,6 +744,10 @@ export function writeConfig(config: FpConfig, raw?: Record<string, unknown>): vo
     // total rather than conditional.
     audit: {
       auto: config.audit.auto,
+      // Emitted unconditionally, like `auto`. A switch that only appears in the
+      // file once you have used it is a switch nobody discovers, and this one
+      // exists to be found by somebody the banner annoyed.
+      notify: config.audit.notify,
       interval_days: config.audit.intervalDays,
       // Written only once there IS consent, so an untouched machine's config
       // does not grow a key implying it was asked. It is in

package/src/hooks/fp-home.ts

@@ -299,6 +299,31 @@ export const auditSessionFile = (home?: string) => resolve(auditDir(home), "sess
  */
 export const auditMachineFile = (home?: string) => resolve(auditDir(home), "machine.json");
 
+/**
+ * The leak record: one entry per DISTINCT credential seen in a transcript.
+ *
+ * `derived` — every finding in it is reproducible by rescanning, so a reset
+ * costs a rescan and nothing else. What is NOT reproducible lives next door in
+ * `auditLeakIdentityFile`, because the two have opposite reset semantics and
+ * this directory's own header says to classify the children, never the parent.
+ */
+export const auditLeaksFile = (home?: string) => resolve(auditDir(home), "leaks.json");
+
+/**
+ * The two things about a leak that a rescan cannot recreate: the HMAC salt that
+ * gives each finding its stable id, and the ids the user has dismissed.
+ *
+ * `identity`, and both halves for the same reason. Regenerate the salt and every
+ * id changes, so every previously-seen credential reads as brand new and the
+ * machine re-alerts for all of them at once. Drop the dismissals and the
+ * findings a human already judged not-a-secret come back — which is worse than
+ * a missed alert, because it teaches them the tool does not listen.
+ *
+ * Small by construction: a 32-byte salt and a list of 16-char ids.
+ */
+export const auditLeakIdentityFile = (home?: string) =>
+  resolve(auditDir(home), "leak-identity.json");
+
 
 // ── fp-cloud-cli ───────────────────────────────────────────────────────────────────
 
@@ -628,6 +653,7 @@ export const HOME_CLASSES: readonly { path: (home?: string) => string; class: Da
   // history the user was already told about. Kept OUT of `auditSessionFile`
   // precisely so both survive a sign-out.
   { path: auditMachineFile, class: "identity" },
+  { path: auditLeakIdentityFile, class: "identity" },
 
   // ── May be dropped: rebuilt on demand ──
   // NOTE: `auditDir` itself is deliberately absent. Layout 4 made it MIXED — it
@@ -637,6 +663,7 @@ export const HOME_CLASSES: readonly { path: (home?: string) => string; class: Da
   // the delete list.
   { path: auditDashboardFile, class: "derived" },
   { path: auditCacheDir, class: "derived" },
+  { path: auditLeaksFile, class: "derived" },
   { path: auditScheduleFile, class: "derived" },
   { path: collectorHealthFile, class: "derived" },
   { path: codexSessionPathsFile, class: "derived" },

package/src/hooks/handler.ts

@@ -15,7 +15,6 @@ import type {
   HermesHookEventType,
   OpenClawHookEventType,
   AntigravityHookEventType,
-  QwenHookEventType,
 } from "./types";
 import {
   CODEX_EVENT_MAP,
@@ -24,12 +23,9 @@ import {
   HERMES_EVENT_MAP,
   OPENCLAW_EVENT_MAP,
   ANTIGRAVITY_EVENT_MAP,
-  QWEN_EVENT_MAP,
 } from "./types";
 import { canonicalizeToolName, canonicalizeToolInput } from "./tool-name-canonicalize";
-import { expandBatchToolInput } from "./batch-expand";
-import { evaluateExpandedBatch } from "./batch-fanout";
-import { normalizeCliPayload, resolveEffectiveCli } from "./normalize-cli-payload";
+import { normalizeCliPayload } from "./normalize-cli-payload";
 import type { PolicyFunction, PolicyResult, HooksConfig } from "./policy-types";
 import { readMergedHooksConfig } from "./hooks-config";
 import { registerBuiltinPolicies } from "./builtin-policies";
@@ -39,6 +35,8 @@ import { loadAllCustomHooks } from "./custom-hooks-loader";
 import type { CustomHook } from "./policy-types";
 import { persistHookActivity } from "./hook-activity-store";
 import { deliveryHealth, deliveryHealthLine } from "./delivery-health";
+import { shapeNotice, canDeliverNotice, leakNoticeText } from "./notice";
+import { pendingLeakNotice, markLeakNoticeDelivered } from "../audit/leak-notice";
 import { trackHookEvent, flushHookTelemetry } from "./hook-telemetry";
 import { resolveCwd } from "./resolve-cwd";
 import { resolvePermissionMode } from "./resolve-permission-mode";
@@ -97,13 +95,6 @@ export function canonicalizeEventType(raw: string, cli: IntegrationType): HookEv
     const mapped = ANTIGRAVITY_EVENT_MAP[raw as AntigravityHookEventType];
     if (mapped) return mapped;
   }
-  if (cli === "qwen") {
-    // Seventeen of qwen's nineteen events are already canonical; this maps the
-    // two that are not — TodoCreated/TodoCompleted, which are qwen's spelling
-    // of TaskCreated/TaskCompleted. Verified live against qwen-code 0.21.12.
-    const mapped = QWEN_EVENT_MAP[raw as QwenHookEventType];
-    if (mapped) return mapped;
-  }
   // claude / copilot / unknown — already PascalCase, pass through.
   // HOOK_EVENT_TYPES type-checks downstream.
   return raw as HookEventType;
@@ -115,6 +106,48 @@ export interface HookEventOutcome {
   stderr: string;
 }
 
+/**
+ * Merge a pending leak notice into an outcome, once.
+ *
+ * Anchored on Stop wherever the host renders there, and SessionStart only where
+ * it does not: Stop fires once per turn, AFTER the answer, so it never
+ * interrupts what the user was reading — and at session open the background
+ * scan may not have produced the finding yet.
+ *
+ * Every failure is swallowed. A courtesy message must never be the reason a
+ * hook misbehaves, and the finding is on disk either way.
+ */
+function attachLeakNotice(
+  eventType: string,
+  cli: IntegrationType | undefined,
+  outcome: HookEventOutcome,
+): HookEventOutcome {
+  try {
+    if (!canDeliverNotice(cli)) return outcome;
+    // canDeliverNotice() above already proved cli is set; narrow for the call.
+    if (!cli) return outcome;
+    const canonical = canonicalizeEventType(eventType, cli);
+    if (canonical !== "Stop" && canonical !== "SessionStart") return outcome;
+
+    const pending = pendingLeakNotice();
+    if (pending.count === 0) return outcome;
+
+    const shaped = shapeNotice(cli, leakNoticeText(pending.count), outcome.stdout);
+    if (shaped.stdout === outcome.stdout && !shaped.stderr) return outcome;
+
+    // Claimed only once the notice is actually on the stream, so a crash
+    // between the two re-notifies rather than silently swallowing the alert.
+    markLeakNoticeDelivered(pending.ids);
+    return {
+      exitCode: outcome.exitCode,
+      stdout: shaped.stdout,
+      stderr: outcome.stderr + shaped.stderr,
+    };
+  } catch {
+    return outcome;
+  }
+}
+
 export interface EvaluateHookEventOptions {
   /**
    * Await pending telemetry POSTs before returning. Defaults to `true`,
@@ -192,7 +225,7 @@ async function runObserved(
  */
 export async function evaluateHookEvent(
   eventType: string,
-  declaredCli: IntegrationType = "claude",
+  cli: IntegrationType = "claude",
   stdinPayload: string,
   opts?: EvaluateHookEventOptions,
 ): Promise<HookEventOutcome> {
@@ -213,28 +246,12 @@ export async function evaluateHookEvent(
         hookLogWarn(`payload parse failed for ${eventType} (${stdinPayload.length} bytes)`);
         void trackHookEvent(getInstanceId(), "hook_payload_parse_error", {
           event_type: eventType,
-          cli: declaredCli,
+          cli,
           payload_size: stdinPayload.length,
         });
       }
     }
 
-    // grok executes other CLIs' hook configs — including the
-    // `<cwd>/.claude/settings.json` our own claude install writes — passing
-    // `--cli claude` while piping ITS camelCase payload. Resolve the CLI whose
-    // contract actually governs this event BEFORE anything reads `cli`, so both
-    // halves land on grok's path: the tool maps (without which every builtin
-    // reads undefined) and the response shape (grok ignores Claude's
-    // hookSpecificOutput deny — verified by A/B against a live session).
-    // No-op for every other CLI. See normalize-cli-payload.ts:isGrokEnvelope.
-    const cli = resolveEffectiveCli(declaredCli, parsed);
-    if (cli !== declaredCli) {
-      hookLogWarn(
-        `payload for ${eventType} is a ${cli} envelope but --cli says ${declaredCli}; ` +
-          `evaluating with the ${cli} contract`,
-      );
-    }
-
     normalizeCliPayload(cli, parsed);
 
     // Canonicalize event name (Codex sends snake_case; internals expect PascalCase)
@@ -256,11 +273,6 @@ export async function evaluateHookEvent(
     // passes are idempotent because the camelCase keys won't match a
     // snake_case input.
     const rawInput = parsed.tool_input;
-    // Read the RAW batch BEFORE canonicalization collapses it. The expander
-    // emits canonical scalars directly, so there is no ambiguity about whether
-    // canonicalization ran once, twice, or on the wrong shape. Returns null for
-    // every CLI except cline, so the other 15 take the unchanged path below.
-    const batchExpansion = expandBatchToolInput(cli, canonicalToolName, rawInput);
     const canonicalInput = canonicalizeToolInput(canonicalToolName, rawInput, cli);
     if (canonicalInput !== rawInput) {
       parsed.tool_input = canonicalInput;
@@ -677,32 +689,8 @@ export async function evaluateHookEvent(
       );
     }
 
-    // Telemetry keys already emitted in THIS invocation. Threaded into the
-    // evaluator so a batch fan-out reports one event per real fault rather than
-    // one per element. A null set (every non-batch call) changes nothing.
-    const telemetryDedupe = new Set<string>();
-
-    // Evaluate policies (use canonical PascalCase event type).
-    //
-    // Fan out only on PreToolUse: it is the only cline payload shape captured
-    // live, and the only event where a per-element verdict changes anything.
-    // forceDecision is excluded — its synthetic policy denies unconditionally,
-    // so N elements would produce N identical denies and a meaningless locator.
-    const result =
-      batchExpansion && canonicalEventType === "PreToolUse" && !opts?.forceDecision
-        ? await evaluateExpandedBatch(
-            canonicalEventType,
-            parsed,
-            session,
-            config,
-            batchExpansion,
-            telemetryDedupe,
-          )
-        // Deliberately NOT passed the dedupe set: it exists only to collapse
-        // per-element telemetry inside a fan-out, and a single-shot call has
-        // exactly one element. Passing it would change this call's shape for
-        // all 16 CLIs to no effect.
-        : await evaluatePolicies(canonicalEventType, parsed, session, config);
+    // Evaluate policies (use canonical PascalCase event type)
+    const result = await evaluatePolicies(canonicalEventType, parsed, session, config);
     const durationMs = Math.round(performance.now() - startTime);
     hookLogInfo(`result=${result.decision} policy=${result.policyName ?? "none"} duration=${durationMs}ms`);
 
@@ -813,7 +801,21 @@ export async function evaluateHookEvent(
       }
     }
 
-    return { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr };
+    // Attach a pending leak notice, if this event is one that can carry it.
+    //
+    // Emitted HERE rather than in `handleHookEvent`, which is what fixes the
+    // bug this replaced: `bin/failproofai.mjs`'s `isDaemonConfigured()` branch
+    // writes `result.stdout`/`result.stderr` and EXITS INSIDE THAT BRANCH — it
+    // never falls through to `handleHookEvent`. Setup requires the daemon, so
+    // the previous notice was dead code on every configured machine, and had
+    // been since it shipped. Both paths return this object, so producing the
+    // notice here reaches both with no change to either caller.
+    const withNotice = attachLeakNotice(eventType, cli, {
+      exitCode: result.exitCode,
+      stdout: result.stdout,
+      stderr: result.stderr,
+    });
+    return withNotice;
   } finally {
     if (opts?.awaitTelemetryFlush ?? true) {
       // Await any un-awaited (`void trackHookEvent(...)`) events fired during

package/src/hooks/harness-cli.ts

@@ -60,7 +60,7 @@ import {
  * the two lists are identical by reading the Rust source, because nothing else
  * connects them.
  *
- * Fourteen keys, fifteen sources: `claude` covers both the main and the subagent
+ * Twelve keys, thirteen sources: `claude` covers both the main and the subagent
  * transcript formats, which share a root — an extra path holding Claude
  * transcripts holds their subagents too.
  */
@@ -77,8 +77,6 @@ export const HARNESS_KEYS = [
   "opencode",
   "devin",
   "hermes",
-  "grok",
-  "qwen",
 ] as const;
 
 export type HarnessKey = (typeof HARNESS_KEYS)[number];