failproofai 1.0.4-beta.2 → 1.0.4-beta.4

package/src/audit/leak-scan.ts

@@ -24,18 +24,26 @@
  * them apart so the report can tell a user which of the two happened.
  */
 import { SECRET_PATTERNS } from "../hooks/builtin-policies";
-import { isSecretName } from "./redact-example";
+
+/**
+ * Cache key for the credential detector.
+ *
+ * The transcript cache used to key only on builtin policies and behavioural
+ * audit detectors. Changing THIS scanner therefore kept serving the old
+ * `result.leaks` forever, which made a precision fix appear to do nothing on a
+ * warm machine. Bump this whenever matching or suppression semantics change.
+ */
+export const LEAK_SCAN_VERSION = 5;
 
 /** One credential value found in one event. */
 export interface SecretMatch {
   /** The raw value. Held in memory only — the caller fingerprints it and must
    *  never persist or transmit this. */
   value: string;
-  /** The identifier it was assigned to, when it came from an assignment. For
-   *  the first-party class (230 of 237 secret-named assignments match no vendor
-   *  pattern) this is the only actionable label there is. */
+  /** The identifier it was assigned to, when a recognized shaped value also
+   *  appeared in an assignment. Used only as an actionable label. */
   name: string | null;
-  /** Which rule found it — a vendor label, or "assigned secret". */
+  /** Which recognizable credential shape found it. */
   rule: string;
   /** Whether the value carried a recognised vendor shape. Drives the record's
    *  confidence, and therefore whether an alert may name a console. */
@@ -69,36 +77,6 @@ export interface SecretMatch {
 const ASSIGNMENT_RE =
   /(["']?)\b([A-Za-z_][A-Za-z0-9_]{0,127})\1([ \t]*(?::(?!\/\/)|=)[ \t]*)("[^"]*"|'[^']*'|[^\s;|&"']+)/g;
 
-/** Shortest value worth reporting. Below this it is a flag, a boolean or a
- *  placeholder far more often than a credential. */
-const MIN_VALUE_LEN = 8;
-
-/**
- * Values that are structurally incapable of being a leaked credential.
- *
- * Deliberately structural, never entropy: the corpus's one confirmed-live
- * password measures 3.19 bits per character while 1.3 million UUIDs in the same
- * corpus sit at 3.72, so any entropy threshold that catches the password also
- * catches every UUID. These tests are decisive instead — a `$VAR` reference
- * contains no secret by construction, and `process.env.X` is the CORRECT secure
- * form, which the redactor currently flags 7,870 times.
- */
-function isNotACredential(value: string): boolean {
-  if (value.length < MIN_VALUE_LEN) return true;
-  // Shell/template indirection: the value is a reference, not a secret.
-  if (/^[$<{(`%]/.test(value)) return true;
-  if (value.includes("${") || value.includes("{{") || value.includes("%(")) return true;
-  // A code expression — `process.env.DISCORD_TOKEN` is how you SHOULD do it.
-  if (/^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)+$/.test(value)) return true;
-  // Already masked, by us or by anyone else.
-  if (value.includes("[REDACTED") || /^[•*#.]+$/.test(value)) return true;
-  if (/(.)\1{5,}/.test(value)) return true;          // xxxxxxxx, 00000000
-  if (/^(true|false|null|undefined|none)$/i.test(value)) return true;
-  if (/^-?\d+(\.\d+)?$/.test(value)) return true;    // pure number
-  if (/^\/|^~\/|^\.\.?\//.test(value)) return true;  // a path
-  return false;
-}
-
 /** Strip one layer of surrounding quotes. */
 function unquote(v: string): string {
   return (v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))
@@ -249,19 +227,17 @@ export function findSecrets(text: string): SecretMatch[] {
     }
   }
 
+  // Names annotate a value the shape layer already proved; they no longer
+  // create findings. Even after increasingly elaborate value heuristics, the
+  // name-only lane still produced hundreds of code literals and test fixtures
+  // on the measured machine. The product now deliberately prefers missing an
+  // unrecognisable first-party password over telling somebody they leaked 500
+  // credentials they do not have.
   for (const m of text.matchAll(ASSIGNMENT_RE)) {
     const name = m[2];
     const value = unquote(m[4]);
-    if (!isSecretName(name) || isNotACredential(value) || isDocsLiteral(value)) continue;
     const existing = byValue.get(value);
-    if (existing) {
-      // A vendor-shaped value that also has a name: keep the vendor rule (it
-      // can name a console) and gain the name (it says which of the user's
-      // variables to change).
-      existing.name ??= name;
-      continue;
-    }
-    byValue.set(value, { value, name, rule: "assigned secret", shaped: false });
+    if (existing) existing.name ??= name;
   }
 
   return [...byValue.values()];

package/src/audit/leak-store.ts

@@ -46,6 +46,24 @@ interface LeakIdentity {
   salt: string;
   /** Finding ids the user has said are not secrets. */
   dismissed: string[];
+  /**
+   * When the user last actually LOOKED at the leak report, as epoch ms.
+   *
+   * This is what stops the in-CLI notice, and it replaces a per-finding "we
+   * emitted it once" marker that silently lost the alert twice in one day: once
+   * because it was claimed on an event whose channel the host ignores, and once
+   * because hooks were disabled in the project being tested. Both marked every
+   * finding delivered and showed nothing, with no retry, ever.
+   *
+   * Keyed on the user's own action rather than on ours, the failure direction
+   * inverts: a dropped notice simply reappears next session, and the only thing
+   * that silences it is the user opening the report — which is the outcome the
+   * notice exists to produce.
+   *
+   * `identity`, alongside `dismissed`, for the same reason: losing it re-alerts
+   * about credentials somebody has already seen and judged.
+   */
+  reportViewedAt?: number;
 }
 
 /** Mode for both files. They carry no credential, but they do carry a machine
@@ -74,7 +92,14 @@ function readJson<T>(path: string): T | null {
 export function readLeakIdentity(home?: string): LeakIdentity {
   const existing = readJson<Partial<LeakIdentity>>(auditLeakIdentityFile(home));
   if (existing && typeof existing.salt === "string" && existing.salt.length >= 32) {
-    return { salt: existing.salt, dismissed: existing.dismissed ?? [] };
+    return {
+      salt: existing.salt,
+      dismissed: existing.dismissed ?? [],
+      reportViewedAt:
+        typeof existing.reportViewedAt === "number" && Number.isFinite(existing.reportViewedAt)
+          ? existing.reportViewedAt
+          : undefined,
+    };
   }
   const minted: LeakIdentity = { salt: randomBytes(32).toString("hex"), dismissed: [] };
   writeLeakIdentity(minted, home);
@@ -194,6 +219,29 @@ export function writeLeakRecord(record: LeakRecord, home?: string, nowMs = Date.
 }
 
 /** Mark a finding as not-a-secret. Survives a reset; see the module header. */
+/**
+ * Record that the user has seen the leak report.
+ *
+ * Called from the dashboard when it reads the findings, and from the
+ * interactive `failproofai audit`, which prints them. Both are the user
+ * looking — which is the only signal worth silencing the notice on.
+ *
+ * Never throws: failing to record a view costs one extra notice, which is the
+ * side this whole design errs on.
+ */
+export function markLeakReportViewed(home?: string, nowMs = Date.now()): void {
+  try {
+    const identity = readLeakIdentity(home);
+    writeJsonAtomically(
+      auditLeakIdentityFile(home),
+      { ...identity, reportViewedAt: nowMs },
+      { mode: FILE_MODE },
+    );
+  } catch {
+    // See the doc comment: an unrecorded view re-notifies once.
+  }
+}
+
 export function dismissFinding(id: string, home?: string): boolean {
   const identity = readLeakIdentity(home);
   if (identity.dismissed.includes(id)) return true;

package/src/audit/redact-example.ts

@@ -147,14 +147,40 @@ const SECRET_NAME_SUBSTRINGS = [
   "APIKEY",
   "PRIVATEKEY",
 ];
-const SECRET_NAME_COMPONENTS = ["KEY", "PASS", "AUTH", "PAT", "SIG", "SIGNATURE", "SESSION", "COOKIE"];
+const SECRET_NAME_COMPONENTS = ["PASS", "AUTH", "PAT", "SIG", "SIGNATURE", "COOKIE"];
 
 /**
- * `PWD` names a credential only in a COMPOUND identifier. `MYSQL_PWD` is
- * MySQL's documented password variable; a bare `PWD` is the shell's working
- * directory, which is on every second line of a captured session.
+ * Names that mean "credential" only inside a COMPOUND identifier.
+ *
+ * Every entry here was measured as a dominant false positive on a real 2,664-
+ * transcript corpus, and the reason they are demotions rather than deletions is
+ * that the SHAPE layer already catches real vendor keys regardless of what they
+ * are called. The name layer exists for FIRST-PARTY secrets with no recognisable
+ * format — and those essentially always carry a qualified name
+ * (`COMPOSIO_API_KEY`, `DB_PASSWORD`), never a bare one. So requiring a compound
+ * costs almost nothing real and removes most of the noise.
+ *
+ *   PWD      `MYSQL_PWD` is MySQL's documented password variable; a bare `PWD`
+ *            is the shell's working directory, on every second line of a
+ *            captured session.
+ *   KEY      a bare `key=` is a React list prop, a map entry, a sort field.
+ *            80 findings on the measured corpus, none of them credentials.
+ *
+ * `SIG` was demoted here too and put back: a bare `sig=` in a URL query IS a
+ * request signature, and an existing test says so. It also never appeared in
+ * the measured noise, unlike the two above — the rule is that a demotion needs
+ * evidence, not a plausible story.
+ *
+ * `SESSION` is REMOVED from both lists rather than demoted, and the difference
+ * matters: demoting it would have changed nothing, because
+ * `DBUS_SESSION_BUS_ADDRESS` is already a compound. It was the single largest
+ * source of noise measured — 254 of 500 findings, every one of them
+ * `DBUS_SESSION_BUS_ADDRESS`, `XDG_SESSION_TYPE`, `SESSION_MANAGER`,
+ * `session_id` or `sessionUpdate`. A session IDENTIFIER is not a rotatable
+ * credential; a session SECRET still matches through `SECRET`, `TOKEN`, or
+ * `KEY` in `sessionKey`.
  */
-const COMPOUND_ONLY_COMPONENTS = ["PWD"];
+const COMPOUND_ONLY_COMPONENTS = ["PWD", "KEY"];
 
 /**
  * Split an identifier into its uppercased components, on `_`, `-`, `.` AND
@@ -300,6 +326,35 @@ export function isPublishedByDesign(name: string): boolean {
   return PUBLISHED_MARKERS.test(upper);
 }
 
+/**
+ * How confidently the NAME alone says "credential".
+ *
+ * `strong` — the word means secret and nothing else: `DB_PASSWORD`,
+ * `STRIPE_SECRET`, `PRIVATE_KEY`. A short value here is still worth flagging;
+ * `hunter2` assigned to `PASSWORD` is a leaked password.
+ *
+ * `weak` — the word is ALSO ordinary programming vocabulary: `key`, `token`,
+ * `auth`, `sig`. Measured on a real 2,664-transcript machine these produced
+ * `keyType`, `tokenLimitCancelled`, `max_output_tokens`, `resultKey`,
+ * `configDirKey` — 394 findings from this layer, of which 389 had no vendor
+ * prefix and 227 were under 24 characters. Nothing that short is an API key.
+ * A weak name has to be backed by a value that actually looks like a secret.
+ */
+export type SecretNameStrength = "strong" | "weak" | "none";
+
+const STRONG_NAME_WORDS = ["SECRET", "PASSWORD", "PASSWD", "PASSPHRASE", "CREDENTIAL", "APIKEY", "PRIVATEKEY"];
+
+export function secretNameStrength(name: string): SecretNameStrength {
+  if (!isSecretName(name)) return "none";
+  const upper = name.toUpperCase();
+  if (STRONG_NAME_WORDS.some((w) => upper.includes(w))) return "strong";
+  // `API_KEY` / `apiKey` split into components rather than matching APIKEY as a
+  // substring, and they are as unambiguous as the substring form.
+  const parts = identifierComponents(name);
+  if (parts.includes("API") && parts.includes("KEY")) return "strong";
+  return "weak";
+}
+
 export function isSecretName(name: string): boolean {
   // Runs first and beats every other signal: a value the framework compiles
   // into the browser bundle is public no matter what the rest of the name says.

package/src/audit/types.ts

@@ -45,6 +45,9 @@ export interface TranscriptMetadata {
   mtimeMs: number;
   /** Byte size of the transcript file. Used for cache invalidation. */
   sizeBytes: number;
+  /** Optional host-authored session purpose. Used only to distinguish
+   * deliberate credential-scanner research from evidence of a leak. */
+  sessionDescription?: string;
 }
 
 /** Per-session detector state. Detectors mutate this freely. */
@@ -172,6 +175,9 @@ export interface TranscriptAuditResult {
    * absent reads as "this transcript predates leak scanning", not "clean".
    */
   leaks?: TranscriptLeak[];
+  /** The session was explicitly generating/researching credential fixtures,
+   * so its matches are examples rather than evidence of user leakage. */
+  leakScanSuppressed?: "credential-research";
   /** First/last timestamp per name. */
   rangeByName: Record<string, { first: string; last: string }>;
 }

package/src/hooks/handler.ts

@@ -36,7 +36,7 @@ import type { CustomHook } from "./policy-types";
 import { persistHookActivity } from "./hook-activity-store";
 import { deliveryHealth, deliveryHealthLine } from "./delivery-health";
 import { shapeNotice, canDeliverNotice, leakNoticeText } from "./notice";
-import { pendingLeakNotice, markLeakNoticeDelivered } from "../audit/leak-notice";
+import { sessionNoticePending, markSessionNoticed } from "../audit/leak-notice";
 import { trackHookEvent, flushHookTelemetry } from "./hook-telemetry";
 import { resolveCwd } from "./resolve-cwd";
 import { resolvePermissionMode } from "./resolve-permission-mode";
@@ -121,15 +121,34 @@ function attachLeakNotice(
   eventType: string,
   cli: IntegrationType | undefined,
   outcome: HookEventOutcome,
+  sessionId: string | undefined,
 ): HookEventOutcome {
   try {
     if (!canDeliverNotice(cli)) return outcome;
     // canDeliverNotice() above already proved cli is set; narrow for the call.
     if (!cli) return outcome;
     const canonical = canonicalizeEventType(eventType, cli);
-    if (canonical !== "Stop" && canonical !== "SessionStart") return outcome;
-
-    const pending = pendingLeakNotice();
+    // STOP ONLY, and the narrowing is the fix for a measured failure rather
+    // than caution. `notice.ts` derived each host's channel from a live probe
+    // on **Stop**; SessionStart was allowed here on the assumption that a
+    // channel proven on one event works on another. It does not. On a real
+    // machine 499 findings were CLAIMED and the user saw nothing: SessionStart
+    // fires first in a session, consumed every claim, and the host dropped the
+    // field — Claude Code documents `hookSpecificOutput.additionalContext` for
+    // SessionStart, not `systemMessage`.
+    //
+    // That is the worst outcome this design has: a finding recorded as
+    // delivered that reached nobody, and never retried. Stop fires at the end
+    // of every assistant turn, so nothing is lost by waiting for it — the user
+    // is reading output at that moment anyway. Add SessionStart back only with
+    // a probe showing the notice actually rendered there.
+    if (canonical !== "Stop") return outcome;
+
+    // Keyed on the SESSION and on whether the user has opened the report, not
+    // on a per-finding "we emitted this once" marker — see
+    // `sessionNoticePending` for the two ways that marker lost the alert
+    // permanently. A dropped notice now costs one session's silence instead.
+    const pending = sessionNoticePending(sessionId ?? "");
     if (pending.count === 0) return outcome;
 
     const shaped = shapeNotice(cli, leakNoticeText(pending.count), outcome.stdout);
@@ -137,7 +156,7 @@ function attachLeakNotice(
 
     // Claimed only once the notice is actually on the stream, so a crash
     // between the two re-notifies rather than silently swallowing the alert.
-    markLeakNoticeDelivered(pending.ids);
+    markSessionNoticed(sessionId ?? "");
     return {
       exitCode: outcome.exitCode,
       stdout: shaped.stdout,
@@ -810,11 +829,12 @@ export async function evaluateHookEvent(
     // the previous notice was dead code on every configured machine, and had
     // been since it shipped. Both paths return this object, so producing the
     // notice here reaches both with no change to either caller.
-    const withNotice = attachLeakNotice(eventType, cli, {
-      exitCode: result.exitCode,
-      stdout: result.stdout,
-      stderr: result.stderr,
-    });
+    const withNotice = attachLeakNotice(
+      eventType,
+      cli,
+      { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr },
+      sessionId,
+    );
     return withNotice;
   } finally {
     if (opts?.awaitTelemetryFlush ?? true) {

package/src/hooks/integrations.ts

@@ -784,6 +784,7 @@ export const cursor: Integration = {
 //   • exit 2 OR `permissionDecision: "deny"` → `throw new Error(reason)`
 //     (which OpenCode surfaces as a tool-call failure to the agent)
 //   • `additionalContext` → `client.session.prompt(...)` (fire-and-forget)
+//   • `failproofaiNotice` → `client.tui.showToast(...)` (user-visible)
 //   • everything else → no-op (allow)
 //
 // Settings paths:
@@ -956,6 +957,19 @@ async function applyDecision(result, ctx, eventName) {
   if (out && out.decision && out.decision.behavior === "deny") {
     throw new Error((out.decision.message) || "Blocked by failproofai");
   }
+  const notice = parsed.failproofaiNotice;
+  if (typeof notice === "string" && notice && ctx && ctx.client && ctx.client.tui) {
+    try {
+      await ctx.client.tui.showToast({
+        body: {
+          title: "failproofai audit",
+          message: notice,
+          variant: "warning",
+          duration: 12_000,
+        },
+      });
+    } catch { /* a courtesy notice must never break the host hook */ }
+  }
   // Forward additional context as a prompt to the session. For Stop /
   // SubagentStop the prompt is the only force-retry channel (session.idle
   // already fired), so AWAIT to ensure the SDK round-trip completes before

package/src/hooks/notice.ts

@@ -28,16 +28,17 @@
  *   copilot  exit 0 + stderr        renders as a `!` session warning
  *   factory  plain stdout           renders under a `Hooks Stop` block
  *
- * opencode, pi and openclaw have real channels too, but they live inside the
- * plugin shims we ship rather than in a hook's stdout, so they are wired there.
- * cursor, devin, goose, antigravity and hermes have no channel that reaches a
- * human without an unsupported escape hatch — they get nothing here, and their
- * users get the finding from `failproofai audit` and the emailed digest.
+ * opencode and pi have real channels too, but they live inside the plugin shims
+ * we ship rather than in a hook's stdout, so a private JSON field is consumed
+ * there and handed to `showToast` / `ui.notify`. OpenClaw, cursor, devin, goose,
+ * antigravity and hermes have no verified channel that reaches a human without
+ * an unsupported escape hatch — they get nothing here, and their users get the
+ * finding from `failproofai audit` and the scheduled desktop notification.
  */
 import type { IntegrationType } from "./types";
 
 /** How a notice is delivered on one CLI. */
-type NoticeChannel = "systemMessage" | "stderr" | "stdout" | "none";
+type NoticeChannel = "systemMessage" | "stderr" | "stdout" | "shim" | "none";
 
 /**
  * Per-CLI channel, from live probes rather than documentation.
@@ -52,6 +53,8 @@ const NOTICE_CHANNEL: Partial<Record<IntegrationType, NoticeChannel>> = {
   codex: "systemMessage",
   copilot: "stderr",
   factory: "stdout",
+  opencode: "shim",
+  pi: "shim",
 };
 
 /**
@@ -123,6 +126,23 @@ export function shapeNotice(
       // verdict JSON is already on the stream.
       if (existingStdout.trim()) return empty;
       return { stdout: text + "\n", stderr: "" };
+    case "shim": {
+      // OpenCode and Pi are in-process plugin integrations. Their generated
+      // shims consume this private field and call the host's real user-facing
+      // notification API; putting the text in additionalContext would send it
+      // to the model instead.
+      if (existingStdout.trim().startsWith("{")) {
+        try {
+          const parsed = JSON.parse(existingStdout) as Record<string, unknown>;
+          parsed.failproofaiNotice = text;
+          return { stdout: JSON.stringify(parsed), stderr: "" };
+        } catch {
+          return empty;
+        }
+      }
+      if (existingStdout.trim()) return empty;
+      return { stdout: JSON.stringify({ failproofaiNotice: text }), stderr: "" };
+    }
     default:
       return empty;
   }
@@ -146,10 +166,26 @@ export function canDeliverNotice(cli: IntegrationType | undefined): boolean {
  * directly in the prompt. So nothing scanned ever reaches this template.
  */
 export function leakNoticeText(newFindings: number): string {
-  const n = newFindings === 1 ? "a credential" : `${newFindings} credentials`;
+  const n = newFindings === 1
+    ? "a possible credential exposure"
+    : `${newFindings} possible credential exposures`;
   return (
     `failproofai found ${n} in this project's agent transcripts.\n` +
-    "Run `failproofai audit` to see the details, " +
-    "or `failproofai audit --schedule` to get these by email."
+    "Run `failproofai audit` to review the matches and rotate anything real."
   );
 }
+
+/** Copy for the OS notification raised by an unattended scheduled scan.
+ *
+ * Deliberately omits the count. A burst of generated fixtures can hit the
+ * record cap, and a desktop banner saying "500 leaked credentials" states a
+ * conclusion the detector cannot support. The dashboard carries the evidence;
+ * the banner's job is only to ask for review. */
+export function desktopLeakNotice(): { title: string; body: string } {
+  return {
+    title: "failproofai audit needs review",
+    body:
+      "Possible credential exposure was found in your agent transcripts. " +
+      "Run failproofai audit to verify the matches and rotate anything real.",
+  };
+}

package/.next/standalone/.next/server/chunks/ssr/[root-of-the-server]__0rgu2r3._.js

@@ -1,3 +0,0 @@
-module.exports=[18622,(a,b,c)=>{b.exports=a.x("next/dist/compiled/next-server/app-page-turbo.runtime.prod.js",()=>require("next/dist/compiled/next-server/app-page-turbo.runtime.prod.js"))},20635,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/action-async-storage.external.js",()=>require("next/dist/server/app-render/action-async-storage.external.js"))},24725,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/after-task-async-storage.external.js",()=>require("next/dist/server/app-render/after-task-async-storage.external.js"))},43285,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/dynamic-access-async-storage.external.js",()=>require("next/dist/server/app-render/dynamic-access-async-storage.external.js"))},56704,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/work-async-storage.external.js",()=>require("next/dist/server/app-render/work-async-storage.external.js"))},32319,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/work-unit-async-storage.external.js",()=>require("next/dist/server/app-render/work-unit-async-storage.external.js"))},59043,(a,b,c)=>{b.exports=a.x("next/dist/server/runtime-reacts.external.js",()=>require("next/dist/server/runtime-reacts.external.js"))},1355,a=>{"use strict";var b=a.i(5050);let c=(0,b.createServerReference)("000ae5b9f039195740b0697383b66ef36475abe12d",b.callServer,void 0,b.findSourceMapURL,"getTelemetryConfig");a.s(["getTelemetryConfig",0,c])},3171,a=>{"use strict";var b=a.i(87924),c=a.i(72131),d=a.i(1355),e=a.i(66036);a.s(["default",0,function({error:a,reset:f}){return(0,c.useEffect)(()=>{(0,d.getTelemetryConfig)().then(b=>{(0,e.setClientTelemetryConfig)(b),(0,e.captureClientEvent)("client_error",{error_message:a.message,error_name:a.name,error_digest:a.digest,boundary:"global"})}).catch(()=>{})},[a]),(0,b.jsx)("html",{children:(0,b.jsx)("body",{children:(0,b.jsx)("main",{style:{minHeight:"100vh",display:"flex",alignItems:"center",justifyContent:"center",background:"#031035",color:"#f8fafc",fontFamily:"system-ui, sans-serif"},children:(0,b.jsxs)("div",{style:{textAlign:"center",padding:"2rem",border:"1px solid rgba(239,68,68,0.4)",borderRadius:"0.5rem",maxWidth:"500px"},children:[(0,b.jsx)("h2",{style:{color:"#ef4444",marginBottom:"0.5rem",fontSize:"1.25rem"},children:"Something went wrong"}),(0,b.jsx)("p",{style:{color:"#94a3b8",marginBottom:"1.5rem"},children:a.message||"An unexpected error occurred."}),(0,b.jsx)("button",{onClick:f,style:{padding:"0.5rem 1.25rem",background:"#3b82f6",color:"white",border:"none",borderRadius:"0.375rem",cursor:"pointer",fontSize:"0.875rem"},children:"Try again"})]})})})})}])},66036,a=>{"use strict";a.s(["captureClientEvent",0,function(a,b){},"setClientTelemetryConfig",0,function(a){}])},46058,(a,b,c)=>{"use strict";function d(a){if("function"!=typeof WeakMap)return null;var b=new WeakMap,c=new WeakMap;return(d=function(a){return a?c:b})(a)}c._=function(a,b){if(!b&&a&&a.__esModule)return a;if(null===a||"object"!=typeof a&&"function"!=typeof a)return{default:a};var c=d(b);if(c&&c.has(a))return c.get(a);var e={__proto__:null},f=Object.defineProperty&&Object.getOwnPropertyDescriptor;for(var g in a)if("default"!==g&&Object.prototype.hasOwnProperty.call(a,g)){var h=f?Object.getOwnPropertyDescriptor(a,g):null;h&&(h.get||h.set)?Object.defineProperty(e,g,h):e[g]=a[g]}return e.default=a,c&&c.set(a,e),e}},5050,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={callServer:function(){return f.callServer},createServerReference:function(){return h.createServerReference},findSourceMapURL:function(){return g.findSourceMapURL}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f=a.r(20611),g=a.r(1722),h=a.r(38783)},20611,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"callServer",{enumerable:!0,get:function(){return g}});let d=a.r(72131),e=a.r(88347),f=a.r(90841);async function g(a,b){return new Promise((c,g)=>{(0,d.startTransition)(()=>{(0,f.dispatchAppRouterAction)({type:e.ACTION_SERVER_ACTION,actionId:a,actionArgs:b,resolve:c,reject:g})})})}("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},1722,(a,b,c)=>{"use strict";let d;Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"findSourceMapURL",{enumerable:!0,get:function(){return d}});("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},88347,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d,e,f={ACTION_HMR_REFRESH:function(){return l},ACTION_NAVIGATE:function(){return i},ACTION_REFRESH:function(){return h},ACTION_RESTORE:function(){return j},ACTION_SERVER_ACTION:function(){return m},ACTION_SERVER_PATCH:function(){return k},PrefetchKind:function(){return n},ScrollBehavior:function(){return o}};for(var g in f)Object.defineProperty(c,g,{enumerable:!0,get:f[g]});let h="refresh",i="navigate",j="restore",k="server-patch",l="hmr-refresh",m="server-action";var n=((d={}).AUTO="auto",d.FULL="full",d),o=((e={})[e.Default=0]="Default",e[e.NoScroll=1]="NoScroll",e);("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},90841,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={dispatchAppRouterAction:function(){return i},dispatchGestureState:function(){return j},refreshOnInstantNavigationUnlock:function(){return h},useActionQueue:function(){return k}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f=a.r(46058)._(a.r(72131)),g=a.r(67009);a.r(88347);function h(){}function i(a){!0;throw Object.defineProperty(Error("Internal Next.js error: Router action dispatched before initialization."),"__NEXT_ERROR_CODE",{value:"E668",enumerable:!1,configurable:!0})}function j(a){!0;throw Object.defineProperty(Error("Internal Next.js error: Router action dispatched before initialization."),"__NEXT_ERROR_CODE",{value:"E668",enumerable:!1,configurable:!0})}function k(a){let[b,c]=f.default.useState(a.state),[d,e]=(0,f.useOptimistic)(b),h=(0,f.useMemo)(()=>d,[d]);return(0,g.isThenable)(h)?(0,f.use)(h):h}("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},42602,(a,b,c)=>{"use strict";b.exports=a.r(18622)},9270,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored.contexts.AppRouterContext},36313,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored.contexts.HooksClientContext},18341,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored.contexts.ServerInsertedHtml},35112,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored["react-ssr"].ReactDOM},87924,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored["react-ssr"].ReactJsxRuntime},38783,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored["react-ssr"].ReactServerDOMTurbopackClient},72131,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored["react-ssr"].React},67009,(a,b,c)=>{"use strict";function d(a){return null!==a&&"object"==typeof a&&"then"in a&&"function"==typeof a.then}Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"isThenable",{enumerable:!0,get:function(){return d}})}];
-
-//# sourceMappingURL=%5Broot-of-the-server%5D__0rgu2r3._.js.map

package/.next/standalone/.next/server/chunks/ssr/_0-oij9d._.js

@@ -1,23 +0,0 @@
-module.exports=[1355,a=>{"use strict";var b=a.i(5050);let c=(0,b.createServerReference)("000ae5b9f039195740b0697383b66ef36475abe12d",b.callServer,void 0,b.findSourceMapURL,"getTelemetryConfig");a.s(["getTelemetryConfig",0,c])},18952,a=>{"use strict";var b=a.i(87924),c=a.i(72131);let d=[],e=0,f=new Set;function g(){for(let a of f)a()}function h(a){return f.add(a),()=>f.delete(a)}function i(){return d}function j({message:a}){let[d,e]=(0,c.useState)(!1);return(0,c.useEffect)(()=>{requestAnimationFrame(()=>e(!0));let a=setTimeout(()=>e(!1),2e3);return()=>clearTimeout(a)},[]),(0,b.jsx)("div",{className:`bg-card border border-border text-foreground text-sm px-4 py-2 rounded-lg shadow-lg transition-opacity duration-300 ${d?"opacity-100":"opacity-0"}`,children:a})}a.s(["Toaster",0,function(){let a=(0,c.useSyncExternalStore)(h,i,i);return(0,b.jsx)("div",{className:"fixed bottom-4 right-4 z-50 flex flex-col gap-2",children:a.map(a=>(0,b.jsx)(j,{message:a.message},a.id))})},"toast",0,function(a){let b=e++;d=[...d,{id:b,message:a}],g(),setTimeout(()=>{d=d.filter(a=>a.id!==b),g()},2500)}])},10765,a=>{"use strict";var b=a.i(87924),c=a.i(72131),d=a.i(50944),e=a.i(1355),f=a.i(66036);let g=(0,c.createContext)(void 0);a.s(["PostHogProvider",0,function({children:a}){let h=(0,d.usePathname)(),i=(0,c.useRef)(null),j=(0,c.useRef)(!1);(0,c.useEffect)(()=>{let a=!1;return(0,e.getTelemetryConfig)().then(b=>{a||((0,f.setClientTelemetryConfig)(b),j.current=!0,(0,f.captureClientEvent)("$pageview"),i.current=window.location.pathname)}),()=>{a=!0}},[]),(0,c.useEffect)(()=>{j.current&&i.current!==h&&(i.current=h,(0,f.captureClientEvent)("$pageview"))},[h]);let k=c.default.useCallback((a,b)=>{(0,f.captureClientEvent)(a,b)},[]);return(0,b.jsx)(g.Provider,{value:{capture:k},children:a})},"usePostHog",0,function(){let a=(0,c.useContext)(g);if(void 0===a)throw Error("usePostHog must be used within a PostHogProvider");return a}])},66036,a=>{"use strict";a.s(["captureClientEvent",0,function(a,b){},"setClientTelemetryConfig",0,function(a){}])},46058,(a,b,c)=>{"use strict";function d(a){if("function"!=typeof WeakMap)return null;var b=new WeakMap,c=new WeakMap;return(d=function(a){return a?c:b})(a)}c._=function(a,b){if(!b&&a&&a.__esModule)return a;if(null===a||"object"!=typeof a&&"function"!=typeof a)return{default:a};var c=d(b);if(c&&c.has(a))return c.get(a);var e={__proto__:null},f=Object.defineProperty&&Object.getOwnPropertyDescriptor;for(var g in a)if("default"!==g&&Object.prototype.hasOwnProperty.call(a,g)){var h=f?Object.getOwnPropertyDescriptor(a,g):null;h&&(h.get||h.set)?Object.defineProperty(e,g,h):e[g]=a[g]}return e.default=a,c&&c.set(a,e),e}},5050,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={callServer:function(){return f.callServer},createServerReference:function(){return h.createServerReference},findSourceMapURL:function(){return g.findSourceMapURL}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f=a.r(20611),g=a.r(1722),h=a.r(38783)},20611,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"callServer",{enumerable:!0,get:function(){return g}});let d=a.r(72131),e=a.r(88347),f=a.r(90841);async function g(a,b){return new Promise((c,g)=>{(0,d.startTransition)(()=>{(0,f.dispatchAppRouterAction)({type:e.ACTION_SERVER_ACTION,actionId:a,actionArgs:b,resolve:c,reject:g})})})}("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},1722,(a,b,c)=>{"use strict";let d;Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"findSourceMapURL",{enumerable:!0,get:function(){return d}});("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},88347,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d,e,f={ACTION_HMR_REFRESH:function(){return l},ACTION_NAVIGATE:function(){return i},ACTION_REFRESH:function(){return h},ACTION_RESTORE:function(){return j},ACTION_SERVER_ACTION:function(){return m},ACTION_SERVER_PATCH:function(){return k},PrefetchKind:function(){return n},ScrollBehavior:function(){return o}};for(var g in f)Object.defineProperty(c,g,{enumerable:!0,get:f[g]});let h="refresh",i="navigate",j="restore",k="server-patch",l="hmr-refresh",m="server-action";var n=((d={}).AUTO="auto",d.FULL="full",d),o=((e={})[e.Default=0]="Default",e[e.NoScroll=1]="NoScroll",e);("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},90841,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={dispatchAppRouterAction:function(){return i},dispatchGestureState:function(){return j},refreshOnInstantNavigationUnlock:function(){return h},useActionQueue:function(){return k}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f=a.r(46058)._(a.r(72131)),g=a.r(67009);a.r(88347);function h(){}function i(a){!0;throw Object.defineProperty(Error("Internal Next.js error: Router action dispatched before initialization."),"__NEXT_ERROR_CODE",{value:"E668",enumerable:!1,configurable:!0})}function j(a){!0;throw Object.defineProperty(Error("Internal Next.js error: Router action dispatched before initialization."),"__NEXT_ERROR_CODE",{value:"E668",enumerable:!1,configurable:!0})}function k(a){let[b,c]=f.default.useState(a.state),[d,e]=(0,f.useOptimistic)(b),h=(0,f.useMemo)(()=>d,[d]);return(0,g.isThenable)(h)?(0,f.use)(h):h}("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},14827,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={createLinkPrefetchPartialError:function(){return g},createUnrenderedSegmentError:function(){return f}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});function f(a,b){let c=`Route "${a}": Could not validate that a segment in your UI has instant navigation.`;if(b.length>0){let a=1===b.length?"Dropped segment":"Dropped segments";c+=`
-
-This segment was dropped from rendering. Issues that would prevent instant navigation will go undetected.
-
-${a}:
-${b.map(a=>`  ${a}`).join("\n")}
-
-Ways to fix this:
-  - [render] Render the dropped segment
-  - [ignore] Set \`export const instant = false\` to opt the dropped segment out of instant-navigation validation
-
-Learn more: https://nextjs.org/docs/messages/instant-unrendered-segment`}return Object.defineProperty(Error(c),"__NEXT_ERROR_CODE",{value:"E1286",enumerable:!1,configurable:!0})}function g(a){return Object.defineProperty(Error(`Next.js encountered dynamic data during prefetching for "${a}".
-
-This will lead to slower, more expensive prefetches.
-
-Ways to fix this:
-  - [upgrade] Opt into Partial Prefetching by exporting \`const prefetch = 'partial'\` from the page or layout, or by setting \`partialPrefetching: true\` in next.config to opt the whole app in
-  - [disable] Remove \`prefetch={true}\` from the <Link> to use the default prefetch
-  - [ignore] Set \`export const instant = false\` to opt the route out of instant-navigation validation
-
-Learn more: https://nextjs.org/docs/messages/instant-link-prefetch-partial`),"__NEXT_ERROR_CODE",{value:"E1435",enumerable:!1,configurable:!0})}},88644,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"InvariantError",{enumerable:!0,get:function(){return d}});class d extends Error{constructor(a,b){super(`Invariant: ${a.endsWith(".")?a:a+"."} This is a bug in Next.js.`,b),Object.defineProperty(this,"__NEXT_ERROR_CODE",{value:"E1179",enumerable:!1,configurable:!0}),this.name="InvariantError"}}},67009,(a,b,c)=>{"use strict";function d(a){return null!==a&&"object"==typeof a&&"then"in a&&"function"==typeof a.then}Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"isThenable",{enumerable:!0,get:function(){return d}})},41997,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={BailoutToCSRError:function(){return g},isBailoutToCSRError:function(){return h}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f="BAILOUT_TO_CLIENT_SIDE_RENDERING";class g extends Error{constructor(a){super(`Bail out to client-side rendering: ${a}`),this.reason=a,this.digest=f}}function h(a){return"object"==typeof a&&null!==a&&"digest"in a&&a.digest===f}},54427,(a,b,c)=>{"use strict";function d(){let a,b,c=new Promise((c,d)=>{a=c,b=d});return{resolve:a,reject:b,promise:c}}Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"createPromiseWithResolvers",{enumerable:!0,get:function(){return d}})},39118,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={DEFAULT_SEGMENT_KEY:function(){return l},NOT_FOUND_SEGMENT_KEY:function(){return m},PAGE_SEGMENT_KEY:function(){return k},addSearchParamsIfPageSegment:function(){return i},computeSelectedLayoutSegment:function(){return j},getSegmentValue:function(){return f},getSelectedLayoutSegmentPath:function(){return function a(b,c,d=!0,e=[]){let g;if(d)g=b[1][c];else{let a=b[1];g=a.children??Object.values(a)[0]}if(!g)return e;let h=f(g[0]);return!h||h.startsWith(k)?e:(e.push(h),a(g,c,!1,e))}},isGroupSegment:function(){return g},isParallelRouteSegment:function(){return h}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});function f(a){return Array.isArray(a)?a[1]:a}function g(a){return"("===a[0]&&a.endsWith(")")}function h(a){return a.startsWith("@")&&"@children"!==a}function i(a,b){if(a.includes(k)){let a=JSON.stringify(b);return"{}"!==a?k+"?"+a:k}return a}function j(a,b){if(!a||0===a.length)return null;let c="children"===b?a[0]:a[a.length-1];return c===l?null:c}let k="__PAGE__",l="__DEFAULT__",m="/_not-found"}];
-
-//# sourceMappingURL=_0-oij9d._.js.map

package/.next/standalone/.next/static/chunks/0zebh1n9jkfbt.js

@@ -1 +0,0 @@
-(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,24358,e=>{"use strict";var s=e.i(43476),a=e.i(71645),t=e.i(95187);let n=(0,t.createServerReference)("00840e34fdc0ab0093541d34b83cc649ce4f5d86f3",t.callServer,void 0,t.findSourceMapURL,"getAuditResultAction");var r=e.i(12344);function i({cachedAt:e,fixed:a=!1}){return(0,s.jsxs)("footer",{className:a?"report-footer report-footer--fixed":"report-footer",children:[(0,s.jsx)("img",{src:"/logo.svg",alt:"failproof_ai",style:{height:18,display:"inline-block",verticalAlign:"middle"}}),(0,s.jsx)("span",{style:{margin:"0 12px",color:"var(--line-2)"},children:"·"}),"audit v1.0",(0,s.jsx)("span",{style:{margin:"0 12px",color:"var(--line-2)"},children:"·"}),"generated ",function(e){if(!e)return"—";let s=new Date(e);if(Number.isNaN(s.getTime()))return"—";let a=s.getUTCDate().toString().padStart(2,"0"),t=["jan","feb","mar","apr","may","jun","jul","aug","sep","oct","nov","dec"][s.getUTCMonth()],n=s.getUTCFullYear(),r=s.getUTCHours().toString().padStart(2,"0"),i=s.getUTCMinutes().toString().padStart(2,"0");return`${a} ${t} ${n}, ${r}:${i} utc`}(e),(0,s.jsx)("span",{style:{margin:"0 12px",color:"var(--line-2)"},children:"·"}),(0,s.jsx)("span",{style:{color:"var(--ink-2)"},children:"auto-healing for your agents."})]})}let l=(0,t.createServerReference)("40d9250b20c84e4d86f5898290e4a7a464c019b309",t.callServer,void 0,t.findSourceMapURL,"dismissLeakAction"),c=(0,t.createServerReference)("00290d6c5d144e8bf121d1b8e95c08990b6bafca27",t.callServer,void 0,t.findSourceMapURL,"getLeaksAction"),d=(0,t.createServerReference)("40f2667668aae1ab9d2a5b00c81eebc40f91a3fc8b",t.callServer,void 0,t.findSourceMapURL,"setLeakNotifyAction");function o(){let[e,t]=(0,a.useState)(null),[n,r]=(0,a.useState)(!0),[i,o]=(0,a.useState)(null),u=(0,a.useCallback)(async()=>{let e=await c();t(e.rows),r(e.notify)},[]);(0,a.useEffect)(()=>{u()},[u]);let h=(0,a.useCallback)(async e=>{o(e);try{await l(e)&&t(s=>s?.filter(s=>s.id!==e)??null)}finally{o(null)}},[]),p=(0,a.useCallback)(async()=>{let e=!n;r(e),await d(e)||r(!e)},[n]);return null===e?null:(0,s.jsxs)("section",{className:"audit-sec","data-screen-label":"02 Leaks",children:[(0,s.jsxs)("div",{className:"audit-sec-head",children:[(0,s.jsxs)("span",{className:"audit-sec-eyebrow",children:[(0,s.jsx)("span",{className:"ix",children:"02"}),"// credentials"]}),(0,s.jsx)("button",{type:"button",className:"cbb-toggle leak-notify","data-on":n,onClick:p,"aria-label":n?"turn desktop notifications off":"turn desktop notifications on",title:"desktop notification when a new credential is found",children:(0,s.jsx)("span",{className:"cbb-toggle-knob"})})]}),0===e.length?(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)("h2",{className:"audit-sec-title",children:"no credentials found"}),(0,s.jsxs)("div",{className:"audit-sec-sub",children:["// nothing in this machine's transcripts matched a known key format",(0,s.jsx)("br",{}),"// or a secret-named assignment."]})]}):(0,s.jsxs)(s.Fragment,{children:[(0,s.jsxs)("h2",{className:"audit-sec-title",children:[e.length," credential",1===e.length?"":"s"," in your transcripts"]}),(0,s.jsx)("div",{className:"audit-sec-sub",children:"// one row per distinct key — an exposure count is not a key count."}),(0,s.jsx)("ul",{className:"leak-list",children:e.map(e=>(0,s.jsxs)("li",{className:"leak-row","data-attributed":e.attributed,children:[(0,s.jsxs)("div",{className:"leak-row-top",children:[(0,s.jsx)("code",{className:"leak-key",children:e.display}),(0,s.jsx)("span",{className:"leak-label",children:e.label}),e.name?(0,s.jsx)("span",{className:"leak-name",children:e.name}):null,(0,s.jsx)("button",{type:"button",className:"leak-dismiss",onClick:()=>void h(e.id),disabled:i===e.id,children:"not a secret"})]}),(0,s.jsxs)("div",{className:"leak-how",children:[(0,s.jsx)("span",{className:"leak-verb",children:e.mechanism})," in ",(0,s.jsx)("span",{className:"leak-where",children:e.project})," via ",(0,s.jsx)("span",{className:"leak-who",children:e.cli})," · ",(0,s.jsx)("span",{className:"leak-when",children:function(e){let s=Date.parse(e);if(!Number.isFinite(s))return"unknown";let a=Math.floor((Date.now()-s)/864e5);return a<=0?"today":1===a?"yesterday":a<30?`${a}d ago`:new Date(s).toLocaleDateString(void 0,{month:"short",day:"numeric"})}(e.lastSeen)})]}),(0,s.jsxs)("div",{className:"leak-foot",children:[(0,s.jsxs)("span",{className:"leak-meta",children:[e.occurrences," exposure",1===e.occurrences?"":"s",e.sessions>1?` \xb7 ${e.sessions} sessions`:""," · ",e.length," chars"]}),(0,s.jsx)("span",{className:"leak-dir",children:"input"===e.direction?"sent by the agent — blockable at PreToolUse":"returned to the agent — already in the transcript"}),(0,s.jsx)("span",{className:"leak-fix",children:e.attributed?`rotate it in the ${e.label.replace(/ (API )?(key|token).*$/i,"")} console`:e.name?`find what reads ${e.name}, then rotate it there`:"trace it to its owner, then rotate it"})]})]},e.id))})]})]})}var u=e.i(86616);function h({mode:e,running:a,onStarted:t,onCompleted:n}){let{capture:i}=(0,r.usePostHog)(),l=async()=>{i("audit_first_run_clicked",{source:"empty_state",mode:e}),t();try{await (0,u.triggerRun)({cli:[],since:"all"})}catch(e){console.error("audit first run failed:",e)}finally{await n()}};return"no-cache"===e?(0,s.jsxs)("section",{className:"section empty-section","data-screen-label":"00 Empty",children:[(0,s.jsxs)("div",{className:"section-mast",children:[(0,s.jsxs)("div",{className:"section-label",children:[(0,s.jsx)("span",{className:"glyph",children:"━━"})," audit"," ",(0,s.jsx)("span",{className:"sep",children:"·"})," first run"]}),(0,s.jsxs)("div",{className:"section-meta",children:[(0,s.jsx)("span",{style:{color:"var(--dim)"},children:"○"})," no cache yet"]})]}),(0,s.jsx)("h2",{className:"section-h",children:"scan and see."}),(0,s.jsxs)("div",{className:"panel empty-panel",children:[(0,s.jsxs)("div",{className:"empty-glyph","aria-hidden":"true",children:[(0,s.jsx)("div",{className:"empty-glyph-grid",children:Array.from({length:36}).map((e,a)=>{let t=["1","5","8","10","13","17","20","23","25","30","32"].includes(String(a));return(0,s.jsx)("span",{className:"px"+(t?" on":"")},a)})}),(0,s.jsx)("div",{className:"empty-glyph-label",children:"▮▮ no audit data yet"})]}),(0,s.jsx)("h3",{className:"empty-headline",children:"run your first audit."}),(0,s.jsxs)("p",{className:"empty-sub",children:["we'll walk every transcript across your installed CLIs — Claude Code, Codex, Copilot, Cursor, OpenCode, Pi — and count every wasteful","or risky action. you'll get your agent's archetype and a punch-list."]}),(0,s.jsxs)("div",{className:"empty-actions",children:[(0,s.jsx)("button",{type:"button",className:"btn btn-primary btn-press empty-cta",onClick:l,disabled:a,children:a?"[ scanning… ]":"[ run audit ]"}),(0,s.jsx)("span",{className:"empty-meta",children:"scans all sessions · all installed CLIs · may take a while"})]})]})]}):(0,s.jsxs)("section",{className:"section empty-section","data-screen-label":"00 Empty",children:[(0,s.jsxs)("div",{className:"section-mast",children:[(0,s.jsxs)("div",{className:"section-label",children:[(0,s.jsx)("span",{className:"glyph",children:"━━"})," audit"," ",(0,s.jsx)("span",{className:"sep",children:"·"})," zero transcripts"]}),(0,s.jsxs)("div",{className:"section-meta",children:[(0,s.jsx)("span",{style:{color:"var(--amber)"},children:"●"})," hooks not installed"]})]}),(0,s.jsx)("h2",{className:"section-h",children:"nothing to read."}),(0,s.jsxs)("div",{className:"panel empty-panel",children:[(0,s.jsxs)("div",{className:"empty-glyph","aria-hidden":"true",children:[(0,s.jsx)("div",{className:"empty-glyph-grid",children:Array.from({length:36}).map((e,a)=>{let t=["2","4","9","11","16","18","23","25","27","30","33"].includes(String(a));return(0,s.jsx)("span",{className:"px"+(t?" on":"")},a)})}),(0,s.jsx)("div",{className:"empty-glyph-label",children:"▮▮ no sessions found"})]}),(0,s.jsx)("h3",{className:"empty-headline",children:"install hooks first."}),(0,s.jsx)("p",{className:"empty-sub",children:"failproofai couldn't find any transcripts to scan on this machine. install the hooks for at least one CLI and come back."}),(0,s.jsxs)("div",{className:"empty-actions",children:[(0,s.jsx)("a",{href:"https://docs.befailproof.ai/getting-started",target:"_blank",rel:"noopener noreferrer",className:"btn btn-primary btn-press empty-cta",onClick:()=>{i("audit_install_guide_clicked",{source:"empty_state",mode:e})},children:"[ install guide → ]"}),(0,s.jsx)("span",{className:"empty-meta",children:"takes about 30 seconds · one command per CLI"})]})]})]})}let p=[{label:"discovering transcripts",detail:"walking ~/.claude, ~/.codex, ~/.cursor, …"},{label:"parsing session logs",detail:"reading JSONL + sqlite session stores"},{label:"running policy checks",detail:"replaying every policy against each tool call"},{label:"aggregating results",detail:"counting hits, ranking by frequency"}];function m(){let[e,t]=(0,a.useState)(0),[n,r]=(0,a.useState)(0);(0,a.useEffect)(()=>{let e=setInterval(()=>{t(e=>Math.min(e+1,p.length-1))},4e3),s=setInterval(()=>r(e=>(e+1)%4),350);return()=>{clearInterval(e),clearInterval(s)}},[]);let i=".".repeat(n+1),l=e===p.length-1,c=Math.round(100*Math.min(.9,(e+1)/p.length*.9));return(0,s.jsxs)("section",{className:"section running-section","data-screen-label":"00 Running",children:[(0,s.jsxs)("div",{className:"section-mast",children:[(0,s.jsxs)("div",{className:"section-label",children:[(0,s.jsx)("span",{className:"glyph",children:"━━"})," audit"," ",(0,s.jsx)("span",{className:"sep",children:"·"})," in progress"]}),(0,s.jsxs)("div",{className:"section-meta",children:[(0,s.jsx)("span",{style:{color:"var(--accent-pink)"},children:"●"})," scanning"]})]}),(0,s.jsxs)("h2",{className:"section-h",children:["scanning sessions",i]}),(0,s.jsxs)("div",{className:"panel running-panel",children:[(0,s.jsxs)("div",{className:"running-header",children:[(0,s.jsx)("span",{className:"running-prompt",children:"$"}),(0,s.jsx)("span",{className:"running-cmd",children:"failproofai audit"}),(0,s.jsx)("span",{className:"running-cursor","aria-hidden":"true",children:"▮"})]}),(0,s.jsx)("ul",{className:"running-stages",children:p.map((a,t)=>{let r=t<e,i=t===e;return(0,s.jsxs)("li",{className:"running-stage"+(r?" done":i?" active":" queued"),children:[(0,s.jsx)("span",{className:"running-marker","aria-hidden":"true",children:r?"✓":i?"▮▮":"○"}),(0,s.jsxs)("div",{className:"running-stage-body",children:[(0,s.jsx)("div",{className:"running-stage-label",children:a.label}),i&&(0,s.jsx)("div",{className:"running-stage-detail",children:l?"finishing up…":a.detail})]}),i&&(0,s.jsx)("span",{className:"running-stage-spin","aria-hidden":"true",children:["⠋","⠙","⠹","⠸"][n]})]},t)})}),(0,s.jsxs)("div",{className:"running-bar-label",children:[(0,s.jsx)("span",{children:"progress"}),(0,s.jsxs)("span",{style:{color:"var(--dim)"},children:[c,"%"]})]}),(0,s.jsx)("div",{className:"running-bar-track",children:(0,s.jsx)("div",{className:"running-bar-fill",style:{width:`${c}%`}})}),(0,s.jsx)("p",{className:"running-foot",children:"this can take a while depending on how much session history you have."})]})]})}let g={timeout:"audit took too long — try again",network:"network hiccup — check your connection",post_failed:"audit failed — try again"};function x({status:e,onDismiss:t}){let[n,r]=(0,a.useState)(()=>Date.now());if((0,a.useEffect)(()=>{if("running"!==e.kind)return;let s=setInterval(()=>r(Date.now()),1e3);return()=>clearInterval(s)},[e.kind]),"idle"===e.kind)return null;if("running"===e.kind){let a=Math.max(0,n-e.startedAt);return(0,s.jsxs)("div",{className:"audit-progress-strip",role:"status","aria-live":"polite",children:[(0,s.jsxs)("div",{className:"audit-progress-strip__inner",children:[(0,s.jsxs)("span",{className:"audit-progress-strip__label",children:[(0,s.jsx)("span",{className:"audit-progress-strip__spinner","aria-hidden":"true"}),"re-auditing your sessions"]}),(0,s.jsx)("span",{className:"audit-progress-strip__elapsed",children:function(e){if(e<0)return"00:00";let s=Math.floor(e/1e3),a=Math.floor(s/60).toString().padStart(2,"0"),t=(s%60).toString().padStart(2,"0");return`${a}:${t}`}(a)})]}),(0,s.jsx)("div",{className:"audit-progress-strip__pulse","aria-hidden":"true"})]})}return(0,s.jsx)("div",{className:"audit-progress-strip audit-progress-strip--failed",role:"alert",children:(0,s.jsxs)("div",{className:"audit-progress-strip__inner",children:[(0,s.jsxs)("span",{className:"audit-progress-strip__label",children:[(0,s.jsx)("span",{className:"audit-progress-strip__x","aria-hidden":"true",children:"×"}),g[e.reason]]}),(0,s.jsx)("button",{type:"button",className:"audit-progress-strip__dismiss",onClick:t,"aria-label":"dismiss",children:"[ dismiss ]"})]})})}function f({result:e,cachedAt:t,projectFromUrl:n,isRunning:l,rerunStatus:c,onRerun:d,onDismissRerun:u}){let{capture:h}=(0,r.usePostHog)(),{detectorsTriggered:p,missing:m}=(0,a.useMemo)(()=>{let s=0,a=0;for(let t of e.results)t.hits>0&&s++,"builtin"===t.source&&!t.enabledInConfig&&t.hits>0&&a++;return{detectorsTriggered:s,missing:a}},[e]),g=(0,a.useRef)(!1);return(0,a.useEffect)(()=>{g.current||(g.current=!0,h("audit_dashboard_viewed",{missing:m,transcripts_scanned:e.transcripts.scanned,results_count:e.results.length,detectors_triggered:p}))},[h,m,e.transcripts.scanned,e.results.length,p]),(0,s.jsxs)("div",{className:"app",children:[(0,s.jsx)(x,{status:c,onDismiss:u}),(0,s.jsxs)("div",{className:"app-shell",children:[(0,s.jsxs)("div",{className:"report",children:[(0,s.jsx)(j,{transcripts:e.transcripts.scanned,events:e.eventsScanned??0,projects:e.projectsScanned.length}),(0,s.jsx)(o,{})]}),(0,s.jsx)(i,{cachedAt:t})]})]})}function j({transcripts:e,events:a,projects:t}){return(0,s.jsxs)("section",{className:"audit-sec","data-screen-label":"01 Scan",children:[(0,s.jsx)("div",{className:"audit-sec-head",children:(0,s.jsxs)("span",{className:"audit-sec-eyebrow",children:[(0,s.jsx)("span",{className:"ix",children:"01"}),"// scan"]})}),(0,s.jsx)("h2",{className:"audit-sec-title",children:"scan complete"}),(0,s.jsxs)("div",{className:"audit-sec-sub",children:[a.toLocaleString()," tool call",1===a?"":"s"," across ",e.toLocaleString()," ","transcript",1===e?"":"s",t>0?` \xb7 ${t.toLocaleString()} project${1===t?"":"s"}`:""]}),(0,s.jsxs)("div",{className:"audit-sec-sub",children:["// the report is being rebuilt around leak detection. the scan, the",(0,s.jsx)("br",{}),"// 12-CLI transcript reader and the emailed digest are unaffected."]})]})}function y({running:e,mode:a="no-cache",rerunStatus:t,onDismissRerun:n,onStarted:r,onCompleted:l}){return(0,s.jsxs)("div",{className:"app",children:[(0,s.jsx)(x,{status:t,onDismiss:n}),(0,s.jsxs)("div",{className:"app-shell",children:[(0,s.jsx)("div",{className:"report",children:e?(0,s.jsx)(m,{}):(0,s.jsx)(h,{mode:a,running:e,onStarted:r,onCompleted:l})}),(0,s.jsx)(i,{cachedAt:null,fixed:!0})]})]})}e.s(["AuditDashboard",0,function({initial:e,projectFromUrl:t,totalCatalogSize:i}){let[l,c]=(0,a.useState)(e),[d,o]=(0,a.useState)(!1),[h,p]=(0,a.useState)({kind:"idle"}),{capture:m}=(0,r.usePostHog)(),g=(0,a.useRef)(null),x=(0,a.useRef)(!1),j="cached"===l.status?l.result.transcripts.scanned:0,b="cached"===l.status?l.result.results.length:0,N=(0,a.useCallback)(async()=>{c(await n())},[]),v=(0,a.useCallback)(async e=>{if(d)return;m("audit_rerun_clicked",{source:e,since:"all"}),o(!0);let s=Date.now();p({kind:"running",startedAt:s});try{await (0,u.triggerRun)({cli:[],since:"all",noCache:!0}),await N(),m("audit_rerun_succeeded",{source:e,since:"all",duration_ms:Date.now()-s}),p({kind:"idle"})}catch(t){let a=t instanceof u.RerunError?t.kind:"network";m("audit_rerun_failed",{kind:a,source:e,since:"all",cli_filter:"all",duration_ms:Date.now()-s}),p({kind:"failed",reason:a,failedAt:Date.now()})}finally{o(!1)}},[m,N,d]),k=(0,a.useCallback)(()=>{p({kind:"idle"})},[]);if((0,a.useEffect)(()=>(document.body.classList.add("audit-body"),()=>document.body.classList.remove("audit-body")),[]),(0,a.useEffect)(()=>{let e=d?"running":"empty"===l.status?"empty":0===j?"zero_sessions":"report";g.current!==e&&(g.current=e,m("audit_page_viewed",{state:e,has_cache:"cached"===l.status}))},[l.status,m,d,j]),(0,a.useEffect)(()=>{x.current=!1},[l.status,d,j]),(0,a.useEffect)(()=>{if(d||"cached"!==l.status||0===j)return;let e=0,s=()=>{if(e=0,x.current)return;let s=document.documentElement.scrollHeight-window.innerHeight;s<=0||window.scrollY>=s-24&&(x.current=!0,m("audit_page_scrolled_to_end",{results_count:b,transcripts_scanned:j}))},a=()=>{0===e&&(e=requestAnimationFrame(s))};return s(),window.addEventListener("scroll",a,{passive:!0}),()=>{window.removeEventListener("scroll",a),0!==e&&cancelAnimationFrame(e)}},[l.status,m,b,d,j]),"empty"===l.status&&!d)return(0,s.jsx)(y,{running:!1,rerunStatus:h,onDismissRerun:k,onStarted:()=>o(!0),onCompleted:async()=>{o(!1),await N()}});if("empty"===l.status&&d)return(0,s.jsx)(y,{running:!0,rerunStatus:h,onDismissRerun:k,onStarted:()=>{},onCompleted:async()=>{o(!1),await N()}});let w="cached"===l.status?l.result:null;if(!w)return null;let S="cached"===l.status?l.cachedAt:null;return 0===w.transcripts.scanned?(0,s.jsx)(y,{running:d,mode:"zero-sessions",rerunStatus:h,onDismissRerun:k,onStarted:()=>o(!0),onCompleted:async()=>{o(!1),await N()}}):(0,s.jsx)(f,{result:w,cachedAt:S,projectFromUrl:t,isRunning:d,rerunStatus:h,onRerun:e=>v(e),onDismissRerun:k})}],24358)},86616,29054,e=>{"use strict";function s(e,a={},t=15e3){let n=AbortSignal.timeout(t),r=a.signal?AbortSignal.any([a.signal,n]):n;return fetch(e,{...a,signal:r})}function a(e){if(null===e||"object"!=typeof e)return!1;let s=e.name;return"AbortError"===s||"TimeoutError"===s}e.s(["fetchWithTimeout",0,s,"isAbortError",0,a],29054);class t extends Error{kind;constructor(e,s){super(s),this.kind=e,this.name="RerunError"}}async function n(e){try{let a=await s("/api/audit/run",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({cli:e.cli.length>0?e.cli:void 0,since:"all"===e.since?void 0:e.since,noCache:!!e.noCache||void 0})});if(!a.ok&&409!==a.status){let e=await a.text().catch(()=>"");throw console.error("audit run failed:",a.status,e),new t("post_failed",`audit run failed (${a.status})`)}}catch(e){if(e instanceof t)throw e;throw console.error("audit run request failed:",e),new t(a(e)?"timeout":"network","audit run request failed")}let n=0;for(;;){await new Promise(e=>setTimeout(e,1e3));let e=null;try{let a=await s("/api/audit/status",{cache:"no-store"});a.ok&&(e=await a.json())}catch{}if(null===e){if(++n>=10)throw new t("network","audit status poll lost the server");continue}if(n=0,!e.running){if(e.error)throw new t("post_failed",e.error);return}}}e.s(["RerunError",0,t,"triggerRun",0,n],86616)}]);