failproofai 1.0.4-beta.2 → 1.0.4-beta.4

package/dist/worker.mjs

@@ -3507,7 +3507,7 @@ function parsePackPolicyName(canonicalName) {
 }
 
 // package.json
-var version = "1.0.4-beta.2";
+var version = "1.0.4-beta.4";
 var init_package = () => {};
 
 // src/posthog-key.ts
@@ -5241,6 +5241,20 @@ function shapeNotice(cli, notice, existingStdout = "") {
         return empty;
       return { stdout: text + `
 `, stderr: "" };
+    case "shim": {
+      if (existingStdout.trim().startsWith("{")) {
+        try {
+          const parsed = JSON.parse(existingStdout);
+          parsed.failproofaiNotice = text;
+          return { stdout: JSON.stringify(parsed), stderr: "" };
+        } catch {
+          return empty;
+        }
+      }
+      if (existingStdout.trim())
+        return empty;
+      return { stdout: JSON.stringify({ failproofaiNotice: text }), stderr: "" };
+    }
     default:
       return empty;
   }
@@ -5249,9 +5263,9 @@ function canDeliverNotice(cli) {
   return !!cli && (NOTICE_CHANNEL[cli] ?? "none") !== "none";
 }
 function leakNoticeText(newFindings) {
-  const n = newFindings === 1 ? "a credential" : `${newFindings} credentials`;
+  const n = newFindings === 1 ? "a possible credential exposure" : `${newFindings} possible credential exposures`;
   return `failproofai found ${n} in this project's agent transcripts.
-` + "Run `failproofai audit` to see the details, " + "or `failproofai audit --schedule` to get these by email.";
+` + "Run `failproofai audit` to review the matches and rotate anything real.";
 }
 var NOTICE_CHANNEL, MAX_NOTICE_CHARS = 900;
 var init_notice = __esm(() => {
@@ -5259,7 +5273,9 @@ var init_notice = __esm(() => {
     claude: "systemMessage",
     codex: "systemMessage",
     copilot: "stderr",
-    factory: "stdout"
+    factory: "stdout",
+    opencode: "shim",
+    pi: "shim"
   };
 });
 
@@ -5335,7 +5351,11 @@ function readJson(path) {
 function readLeakIdentity(home) {
   const existing = readJson(auditLeakIdentityFile(home));
   if (existing && typeof existing.salt === "string" && existing.salt.length >= 32) {
-    return { salt: existing.salt, dismissed: existing.dismissed ?? [] };
+    return {
+      salt: existing.salt,
+      dismissed: existing.dismissed ?? [],
+      reportViewedAt: typeof existing.reportViewedAt === "number" && Number.isFinite(existing.reportViewedAt) ? existing.reportViewedAt : undefined
+    };
   }
   const minted = { salt: randomBytes2(32).toString("hex"), dismissed: [] };
   writeLeakIdentity(minted, home);
@@ -5405,33 +5425,39 @@ var init_leak_store = __esm(() => {
 // src/audit/leak-notice.ts
 import { existsSync as existsSync10, mkdirSync as mkdirSync7, readdirSync as readdirSync3, statSync as statSync7, writeFileSync as writeFileSync5, rmSync as rmSync3 } from "node:fs";
 import { resolve as resolve8 } from "node:path";
-function pendingLeakNotice(home, channel = "cli") {
+function sessionNoticePending(sessionId, home) {
   try {
-    const dir = NOTICE_DIR(home, channel);
-    const claimed = new Set(existsSync10(dir) ? readdirSync3(dir) : []);
-    const ids = activeFindings(readLeakRecord(home), home).map((f) => f.id).filter((id) => !claimed.has(id));
-    return { ids, count: ids.length };
+    if (!sessionId || !/^[\w.:-]{1,200}$/.test(sessionId))
+      return { ids: [], count: 0 };
+    const dir = resolve8(auditDir(home), "notified-sessions");
+    if (existsSync10(resolve8(dir, sessionId)))
+      return { ids: [], count: 0 };
+    const findings = activeFindings(readLeakRecord(home), home);
+    if (findings.length === 0)
+      return { ids: [], count: 0 };
+    const viewedAt = readLeakIdentity(home).reportViewedAt ?? 0;
+    const unviewed = findings.filter((f) => {
+      const seen = Date.parse(f.firstSeen);
+      return !Number.isFinite(seen) || seen > viewedAt;
+    });
+    return { ids: unviewed.map((f) => f.id), count: unviewed.length };
   } catch {
     return { ids: [], count: 0 };
   }
 }
-function markLeakNoticeDelivered(ids, home, channel = "cli") {
-  const won = [];
+function markSessionNoticed(sessionId, home) {
   try {
-    const dir = NOTICE_DIR(home, channel);
+    if (!sessionId || !/^[\w.:-]{1,200}$/.test(sessionId))
+      return false;
+    const dir = resolve8(auditDir(home), "notified-sessions");
     mkdirSync7(dir, { recursive: true });
-    for (const id of ids) {
-      if (!isFindingId(id))
-        continue;
-      try {
-        writeFileSync5(resolve8(dir, id), "", { flag: "wx", mode: 384 });
-        won.push(id);
-      } catch {}
-    }
-  } catch {}
-  return won;
+    writeFileSync5(resolve8(dir, sessionId), "", { flag: "wx", mode: 384 });
+    return true;
+  } catch {
+    return false;
+  }
 }
-var NOTICE_DIR = (home, channel = "cli") => resolve8(auditDir(home), channel === "cli" ? "notified" : `notified-${channel}`), MARKER_TTL_MS;
+var MARKER_TTL_MS;
 var init_leak_notice = __esm(() => {
   init_fp_home();
   init_leak_store();
@@ -6130,8 +6156,21 @@ var init_cursor_projects = __esm(() => {
 // lib/sqlite-reader.ts
 import { existsSync as existsSync11, readFileSync as readFileSync7 } from "node:fs";
 import initSqlJs from "sql.js/dist/sql-asm.js";
+function silenceSqliteExperimentalWarning() {
+  if (warningPatched)
+    return;
+  warningPatched = true;
+  const original = process.emitWarning.bind(process);
+  process.emitWarning = (warning, ...rest) => {
+    const text = typeof warning === "string" ? warning : String(warning?.message ?? "");
+    if (text.includes("SQLite is an experimental feature"))
+      return;
+    return original(warning, ...rest);
+  };
+}
 async function tryNodeSqlite(dbPath) {
   try {
+    silenceSqliteExperimentalWarning();
     const mod = await import("node:sqlite");
     const db = new mod.DatabaseSync(dbPath, { readOnly: true });
     return {
@@ -6152,10 +6191,21 @@ function loadSqlJs() {
     sqlPromise = initSqlJs();
   return sqlPromise;
 }
+function clearWalFlag(bytes) {
+  if (bytes.length < 20)
+    return bytes;
+  if (bytes.toString("latin1", 0, 16) !== SQLITE_MAGIC)
+    return bytes;
+  if (bytes[18] === 1 && bytes[19] === 1)
+    return bytes;
+  bytes[18] = 1;
+  bytes[19] = 1;
+  return bytes;
+}
 async function trySqlJs(dbPath) {
   try {
     const SQL = await loadSqlJs();
-    const db = new SQL.Database(readFileSync7(dbPath));
+    const db = new SQL.Database(clearWalFlag(readFileSync7(dbPath)));
     return {
       query(sql, params) {
         const stmt = db.prepare(sql);
@@ -6183,7 +6233,7 @@ async function openSqliteReadonly(dbPath) {
     return null;
   return await tryNodeSqlite(dbPath) ?? await trySqlJs(dbPath);
 }
-var sqlPromise = null;
+var warningPatched = false, sqlPromise = null, SQLITE_MAGIC = "SQLite format 3\x00";
 var init_sqlite_reader = () => {};
 
 // lib/opencode-db.ts
@@ -10231,22 +10281,22 @@ function canonicalizeEventType(raw, cli) {
   }
   return raw;
 }
-function attachLeakNotice(eventType, cli, outcome) {
+function attachLeakNotice(eventType, cli, outcome, sessionId) {
   try {
     if (!canDeliverNotice(cli))
       return outcome;
     if (!cli)
       return outcome;
     const canonical = canonicalizeEventType(eventType, cli);
-    if (canonical !== "Stop" && canonical !== "SessionStart")
+    if (canonical !== "Stop")
       return outcome;
-    const pending = pendingLeakNotice();
+    const pending = sessionNoticePending(sessionId ?? "");
     if (pending.count === 0)
       return outcome;
     const shaped = shapeNotice(cli, leakNoticeText(pending.count), outcome.stdout);
     if (shaped.stdout === outcome.stdout && !shaped.stderr)
       return outcome;
-    markLeakNoticeDelivered(pending.ids);
+    markSessionNoticed(sessionId ?? "");
     return {
       exitCode: outcome.exitCode,
       stdout: shaped.stdout,
@@ -10558,11 +10608,7 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
         }
       } catch {}
     }
-    const withNotice = attachLeakNotice(eventType, cli, {
-      exitCode: result.exitCode,
-      stdout: result.stdout,
-      stderr: result.stderr
-    });
+    const withNotice = attachLeakNotice(eventType, cli, { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr }, sessionId);
     return withNotice;
   } finally {
     if (opts?.awaitTelemetryFlush ?? true) {

package/lib/sqlite-reader.ts

@@ -39,8 +39,42 @@ interface NodeSqliteModule {
   DatabaseSync: new (path: string, options?: { readOnly?: boolean }) => NodeSqliteDb;
 }
 
+/**
+ * Swallow Node's "SQLite is an experimental feature" warning, once.
+ *
+ * It is not information the user can act on — we chose `node:sqlite`
+ * deliberately, and the alternative tier is a WASM build that leaks. But it is
+ * emitted on first use, which lands it in the MIDDLE of whatever is on screen,
+ * and the audit's progress display redraws itself by moving the cursor up a
+ * fixed number of lines. Two unexpected lines of stderr push the cursor down
+ * two rows, so the next redraw repaints the block two rows lower and strands
+ * the top of the previous frame above it. The user sees every stage twice and
+ * reasonably concludes the audit ran twice.
+ *
+ * Filtered by message rather than silenced wholesale: `process.emitWarning` is
+ * how deprecations and real problems surface too, and a blanket
+ * `NODE_NO_WARNINGS` in a tool that installs into other people's machines would
+ * hide those as well.
+ */
+let warningPatched = false;
+function silenceSqliteExperimentalWarning(): void {
+  if (warningPatched) return;
+  warningPatched = true;
+  const original = process.emitWarning.bind(process);
+  // The overloads differ across Node versions; the shape we care about is the
+  // first argument, and everything else is passed straight through.
+  process.emitWarning = ((warning: unknown, ...rest: unknown[]) => {
+    const text = typeof warning === "string" ? warning : String((warning as Error)?.message ?? "");
+    if (text.includes("SQLite is an experimental feature")) return;
+    return (original as (...a: unknown[]) => void)(warning, ...rest);
+  }) as typeof process.emitWarning;
+}
+
 async function tryNodeSqlite(dbPath: string): Promise<SqliteReader | null> {
   try {
+    // Before the import, not after: the warning fires on first use of the
+    // module, which is this line.
+    silenceSqliteExperimentalWarning();
     // Dynamic import: on Node < 22.5 this rejects and we fall through to sql.js.
     const mod = (await import("node:sqlite")) as unknown as NodeSqliteModule;
     const db = new mod.DatabaseSync(dbPath, { readOnly: true });
@@ -66,10 +100,53 @@ function loadSqlJs(): Promise<SqlJsStatic> {
   return sqlPromise;
 }
 
+const SQLITE_MAGIC = "SQLite format 3\0";
+
+/**
+ * Clear the WAL flag on OUR OWN in-memory copy of the database image.
+ *
+ * Header bytes 18 and 19 are the file-format write and read versions; `2`
+ * means WAL. sql.js never sees the `-wal` sidecar — it is handed the main
+ * file's bytes and nothing else, which is exactly the snapshot caveat this
+ * module already documents — so the flag buys us nothing, and it costs a great
+ * deal: opening a WAL-flagged image makes SQLite build a wal-index
+ * shared-memory region that sql.js's MEMFS-backed VFS never reclaims on
+ * `close()` (close unlinks only the db file it created).
+ *
+ * The asm.js build's heap is a FIXED 22,151,168-byte ArrayBuffer with
+ * ALLOW_MEMORY_GROWTH off, so `emscripten_resize_heap` is compiled to
+ * `abort("OOM")`. Measured: the 128th WAL-mode open exhausts it — the same
+ * threshold for a 319 KB database and a 10 MB one, because the leaked region
+ * is a fixed per-connection allocation rather than data.
+ *
+ * And the abort is not confined to that open. `initSqlJs` memoizes one
+ * process-wide module, so once it aborts every later `openSqliteReadonly`
+ * silently returns null. A full audit opens ~150 databases — devin, goose and
+ * opencode each open theirs once per SESSION — so it crossed 128 and then
+ * dropped whatever it had not yet read, with no error anywhere. The
+ * `Aborted(OOM)` lines on stderr were the only symptom, and they read as
+ * harmless because the run still completed.
+ *
+ * Only under bun and Node < 22.5: tier 1 is `node:sqlite`, which bun does not
+ * provide, and `engines.node` allows 20.9. Both fall through to here.
+ */
+function clearWalFlag(bytes: Buffer): Buffer {
+  // Too short to carry a header, or not a SQLite image at all — hand it back
+  // untouched and let sql.js produce its own error.
+  if (bytes.length < 20) return bytes;
+  if (bytes.toString("latin1", 0, 16) !== SQLITE_MAGIC) return bytes;
+  if (bytes[18] === 1 && bytes[19] === 1) return bytes; // already rollback-journal
+  bytes[18] = 1;
+  bytes[19] = 1;
+  return bytes;
+}
+
 async function trySqlJs(dbPath: string): Promise<SqliteReader | null> {
   try {
     const SQL = await loadSqlJs();
-    const db = new SQL.Database(readFileSync(dbPath));
+    // `readFileSync` already returns a private copy, so mutating the two header
+    // bytes cannot touch the file on disk.
+    const db = new SQL.Database(clearWalFlag(readFileSync(dbPath)));
     return {
       query<T = Record<string, unknown>>(sql: string, params?: unknown[]): T[] {
         const stmt = db.prepare(sql);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.4-beta.2",
+  "version": "1.0.4-beta.4",
   "description": "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -117,19 +117,19 @@
     "vite": "8.0.16",
     "undici": "7.29.0",
     "brace-expansion": "5.0.9",
-    "sharp": "0.35.0",
+    "sharp": "0.35.4",
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.4-beta.2",
-    "@failproofai/failproofaid-linux-arm64": "1.0.4-beta.2",
-    "@failproofai/failproofaid-darwin-x64": "1.0.4-beta.2",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.4-beta.2"
+    "@failproofai/failproofaid-linux-x64": "1.0.4-beta.4",
+    "@failproofai/failproofaid-linux-arm64": "1.0.4-beta.4",
+    "@failproofai/failproofaid-darwin-x64": "1.0.4-beta.4",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.4-beta.4"
   },
   "failproofaidBinaries": {
-    "linux-x64": "3039575242ff240c68a79c4ebd4e0e35e865da99c6d8a46d1a17b2d7962cb47b",
-    "linux-arm64": "02fe993dca0faccb528c48472ca1d637274c562992ba7da1bc8d439103dbcc13",
-    "darwin-x64": "2be5a422007a773253611f24f2ad9e2a301f075392ed7bc2dc0f6354d3186696",
-    "darwin-arm64": "5882a4acd7317289346934290ac8277ca79edadb009e284c9fc0b23b74d321d7"
+    "linux-x64": "4487790ed9b881da2914b5985a23b5adca1f20e226d71c635d8170064e6b2340",
+    "linux-arm64": "c903c5e201198213ccd8295fdab741c7d08d22c8dd5c276e52aa766595bedcc2",
+    "darwin-x64": "f0933584abbf0f9ff95cd153f8c6c704e467af1d6ffc8f42f9c426bd44b1142a",
+    "darwin-arm64": "387a3acbf13f667a557c8ac632fe67dee350cda078e3266e71edfcfacb9ecae6"
   }
 }

package/pi-extension/index.ts

@@ -49,6 +49,7 @@ function resolveSpawn(): { cmd: string; args: string[] } {
 interface PolicyDecision {
   permission?: "allow" | "deny";
   reason?: string;
+  failproofaiNotice?: string;
 }
 
 /**
@@ -102,7 +103,7 @@ function forwardPolicy(eventName: string, payload: unknown): void {
   }
 }
 
-function callPolicy(eventName: string, payload: unknown): { block: boolean; reason: string } {
+function callPolicy(eventName: string, payload: unknown): { block: boolean; reason: string; notice?: string } {
   const { cmd, args } = resolveSpawn();
   debug(`callPolicy event=${eventName} cmd=${cmd}`);
   try {
@@ -121,8 +122,13 @@ function callPolicy(eventName: string, payload: unknown): { block: boolean; reas
     const parsed = JSON.parse(stdout) as PolicyDecision;
     if (parsed.permission === "deny") {
       debug(`DENY reason=${parsed.reason}`);
-      return { block: true, reason: parsed.reason ?? "Blocked by failproofai" };
+      return {
+        block: true,
+        reason: parsed.reason ?? "Blocked by failproofai",
+        notice: parsed.failproofaiNotice,
+      };
     }
+    return { block: false, reason: "", notice: parsed.failproofaiNotice };
   } catch (err) {
     debug(`EXCEPTION ${err instanceof Error ? err.message : String(err)}`);
     // Fail-open: never block tool execution because of an infra failure.
@@ -370,7 +376,13 @@ interface PiBeforeAgentStartEvent {
 }
 
 interface PiExtensionApi {
-  on(event: string, handler: (event: unknown) => unknown): void;
+  on(event: string, handler: (event: unknown, ctx?: PiExtensionContext) => unknown): void;
+}
+
+interface PiExtensionContext {
+  ui?: {
+    notify(message: string, type?: "info" | "warning" | "error"): void;
+  };
 }
 
 export default function failproofaiBridge(pi: PiExtensionApi) {
@@ -491,7 +503,7 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
   // The 5 require-*-before-stop builtins thus enforce by gating the NEXT
   // user turn's system prompt rather than by retrying the same loop. If the
   // user kills Pi between turns, the gate is missed — same bound Claude has.
-  pi.on("agent_end", (event: unknown): unknown => {
+  pi.on("agent_end", (event: unknown, ctx?: PiExtensionContext): unknown => {
     const e = event as PiAgentEndEvent;
     const cwd = resolveCwd(e.cwd);
     const sessionId = resolveSessionId(e.sessionId, cwd);
@@ -504,6 +516,9 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
       pendingStopBlockBySession.set(sessionId, decision.reason);
       debug(`agent_end deny stored for session=${sessionId}`);
     }
+    if (decision.notice) {
+      try { ctx?.ui?.notify(decision.notice, "warning"); } catch { /* fail-open */ }
+    }
     return undefined;
   });
 

package/src/audit/cache.ts

@@ -14,6 +14,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, openSync
 import { join } from "node:path";
 import { BUILTIN_POLICIES } from "../hooks/builtin-policies";
 import { AUDIT_DETECTORS } from "./detectors";
+import { LEAK_SCAN_VERSION } from "./leak-scan";
 import type { TranscriptAuditResult, DetectorSessionState } from "./types";
 import { auditCacheDir } from "../hooks/fp-home";
 
@@ -162,6 +163,9 @@ interface CacheEntry {
   sizeBytes: number;
   engineVersion: string;
   detectorVersion: string;
+  /** Separate because leak detection is neither a builtin policy nor one of
+   * the behavioural AUDIT_DETECTORS hashed above. */
+  leakScanVersion: number;
   result: TranscriptAuditResult;
   /**
    * How far into the file the recorded result actually accounts for, at a LINE
@@ -269,6 +273,7 @@ export function readCachedTranscript(
     if (entry.schemaVersion !== CACHE_SCHEMA_VERSION) return null;
     if (entry.engineVersion !== getEngineVersion()) return null;
     if (entry.detectorVersion !== getDetectorVersion()) return null;
+    if (entry.leakScanVersion !== LEAK_SCAN_VERSION) return null;
     // Number.isFinite (not typeof) so a malformed JSON `Infinity` /
     // `NaN` is rejected — those would otherwise bypass the TTL check
     // and pin a stale entry as valid forever.
@@ -332,6 +337,7 @@ export function writeCachedTranscriptResult(
       sizeBytes,
       engineVersion: getEngineVersion(),
       detectorVersion: getDetectorVersion(),
+      leakScanVersion: LEAK_SCAN_VERSION,
       result,
     };
     if (resume && resume.bytesScanned > 0) {

package/src/audit/cli-adapters/claude.ts

@@ -6,6 +6,7 @@
  * parses each via lib/log-entries.ts.
  */
 import { readFile, open, type FileHandle } from "node:fs/promises";
+import { readFileSync } from "node:fs";
 import {
   listClaudeProjects,
   listClaudeTranscripts,
@@ -40,6 +41,17 @@ export async function listClaudeTranscriptMetadata(
     }
     for (const t of transcripts) {
       if (t.mtimeMs < sinceMs) continue;
+      let sessionDescription: string | undefined;
+      if (t.isSubagent) {
+        try {
+          const meta = JSON.parse(
+            readFileSync(t.transcriptPath.replace(/\.jsonl$/, ".meta.json"), "utf8"),
+          ) as { description?: unknown };
+          if (typeof meta.description === "string") sessionDescription = meta.description;
+        } catch {
+          // Sidecars are optional (journal transcripts do not have one).
+        }
+      }
       out.push({
         cli: "claude",
         projectName: project.name,
@@ -47,6 +59,7 @@ export async function listClaudeTranscriptMetadata(
         transcriptPath: t.transcriptPath,
         mtimeMs: t.mtimeMs,
         sizeBytes: t.sizeBytes,
+        sessionDescription,
       });
     }
   }

package/src/audit/cli-login.ts

@@ -173,7 +173,10 @@ export async function ensureSignedIn(preset?: string): Promise<EnsureSignedIn> {
     throw new LoginError(
       "Signing in needs an interactive terminal, and this one is not.\n" +
         "Run `failproofai audit --schedule` from a shell you are sitting at,\n" +
-        "or sign in from the dashboard — both write the same session file.",
+        "or sign in from the dashboard — both write the same session file.\n" +
+        "\n" +
+        "`--email` does not avoid this: it fills in the address so you are not\n" +
+        "asked for it, but a one-time code is still sent there for you to paste.",
     );
   }